]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blame - test/grsecurity-2.2.2-2.6.39.2-201107011911.patch
projects / thirdparty / grsecurity-scrape.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-2.6.39.2-201107011911.patch
CommitLineData
8549b3bc
PK		 1diff -urNp linux-2.6.39.2/arch/alpha/include/asm/dma-mapping.h linux-2.6.39.2/arch/alpha/include/asm/dma-mapping.h
2--- linux-2.6.39.2/arch/alpha/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3+++ linux-2.6.39.2/arch/alpha/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
4@@ -3,9 +3,9 @@
5
6 #include <linux/dma-attrs.h>
7
8-extern struct dma_map_ops *dma_ops;
9+extern const struct dma_map_ops *dma_ops;
10
11-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
12+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
13 {
14 return dma_ops;
15 }
16diff -urNp linux-2.6.39.2/arch/alpha/include/asm/elf.h linux-2.6.39.2/arch/alpha/include/asm/elf.h
17--- linux-2.6.39.2/arch/alpha/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
18+++ linux-2.6.39.2/arch/alpha/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
19@@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
20
21 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
22
23+#ifdef CONFIG_PAX_ASLR
24+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
25+
26+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
27+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
28+#endif
29+
30 /* $0 is set by ld.so to a pointer to a function which might be
31 registered using atexit. This provides a mean for the dynamic
32 linker to call DT_FINI functions for shared libraries that have
33diff -urNp linux-2.6.39.2/arch/alpha/include/asm/pgtable.h linux-2.6.39.2/arch/alpha/include/asm/pgtable.h
34--- linux-2.6.39.2/arch/alpha/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
35+++ linux-2.6.39.2/arch/alpha/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
36@@ -101,6 +101,17 @@ struct vm_area_struct;
37 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
38 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
39 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
40+
41+#ifdef CONFIG_PAX_PAGEEXEC
42+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
43+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
44+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
45+#else
46+# define PAGE_SHARED_NOEXEC PAGE_SHARED
47+# define PAGE_COPY_NOEXEC PAGE_COPY
48+# define PAGE_READONLY_NOEXEC PAGE_READONLY
49+#endif
50+
51 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
52
53 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
54diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_apecs.c linux-2.6.39.2/arch/alpha/kernel/core_apecs.c
55--- linux-2.6.39.2/arch/alpha/kernel/core_apecs.c 2011-05-19 00:06:34.000000000 -0400
56+++ linux-2.6.39.2/arch/alpha/kernel/core_apecs.c 2011-05-22 19:36:30.000000000 -0400
57@@ -305,7 +305,7 @@ apecs_write_config(struct pci_bus *bus,
58 return PCIBIOS_SUCCESSFUL;
59 }
60
61-struct pci_ops apecs_pci_ops =
62+const struct pci_ops apecs_pci_ops =
63 {
64 .read = apecs_read_config,
65 .write = apecs_write_config,
66diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_cia.c linux-2.6.39.2/arch/alpha/kernel/core_cia.c
67--- linux-2.6.39.2/arch/alpha/kernel/core_cia.c 2011-05-19 00:06:34.000000000 -0400
68+++ linux-2.6.39.2/arch/alpha/kernel/core_cia.c 2011-05-22 19:36:30.000000000 -0400
69@@ -239,7 +239,7 @@ cia_write_config(struct pci_bus *bus, un
70 return PCIBIOS_SUCCESSFUL;
71 }
72
73-struct pci_ops cia_pci_ops =
74+const struct pci_ops cia_pci_ops =
75 {
76 .read = cia_read_config,
77 .write = cia_write_config,
78diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_irongate.c linux-2.6.39.2/arch/alpha/kernel/core_irongate.c
79--- linux-2.6.39.2/arch/alpha/kernel/core_irongate.c 2011-05-19 00:06:34.000000000 -0400
80+++ linux-2.6.39.2/arch/alpha/kernel/core_irongate.c 2011-05-22 19:36:30.000000000 -0400
81@@ -155,7 +155,7 @@ irongate_write_config(struct pci_bus *bu
82 return PCIBIOS_SUCCESSFUL;
83 }
84
85-struct pci_ops irongate_pci_ops =
86+const struct pci_ops irongate_pci_ops =
87 {
88 .read = irongate_read_config,
89 .write = irongate_write_config,
90diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_lca.c linux-2.6.39.2/arch/alpha/kernel/core_lca.c
91--- linux-2.6.39.2/arch/alpha/kernel/core_lca.c 2011-05-19 00:06:34.000000000 -0400
92+++ linux-2.6.39.2/arch/alpha/kernel/core_lca.c 2011-05-22 19:36:30.000000000 -0400
93@@ -231,7 +231,7 @@ lca_write_config(struct pci_bus *bus, un
94 return PCIBIOS_SUCCESSFUL;
95 }
96
97-struct pci_ops lca_pci_ops =
98+const struct pci_ops lca_pci_ops =
99 {
100 .read = lca_read_config,
101 .write = lca_write_config,
102diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_marvel.c linux-2.6.39.2/arch/alpha/kernel/core_marvel.c
103--- linux-2.6.39.2/arch/alpha/kernel/core_marvel.c 2011-05-19 00:06:34.000000000 -0400
104+++ linux-2.6.39.2/arch/alpha/kernel/core_marvel.c 2011-05-22 19:36:30.000000000 -0400
105@@ -588,7 +588,7 @@ marvel_write_config(struct pci_bus *bus,
106 return PCIBIOS_SUCCESSFUL;
107 }
108
109-struct pci_ops marvel_pci_ops =
110+const struct pci_ops marvel_pci_ops =
111 {
112 .read = marvel_read_config,
113 .write = marvel_write_config,
114diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_mcpcia.c linux-2.6.39.2/arch/alpha/kernel/core_mcpcia.c
115--- linux-2.6.39.2/arch/alpha/kernel/core_mcpcia.c 2011-05-19 00:06:34.000000000 -0400
116+++ linux-2.6.39.2/arch/alpha/kernel/core_mcpcia.c 2011-05-22 19:36:30.000000000 -0400
117@@ -235,7 +235,7 @@ mcpcia_write_config(struct pci_bus *bus,
118 return PCIBIOS_SUCCESSFUL;
119 }
120
121-struct pci_ops mcpcia_pci_ops =
122+const struct pci_ops mcpcia_pci_ops =
123 {
124 .read = mcpcia_read_config,
125 .write = mcpcia_write_config,
126diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_polaris.c linux-2.6.39.2/arch/alpha/kernel/core_polaris.c
127--- linux-2.6.39.2/arch/alpha/kernel/core_polaris.c 2011-05-19 00:06:34.000000000 -0400
128+++ linux-2.6.39.2/arch/alpha/kernel/core_polaris.c 2011-05-22 19:36:30.000000000 -0400
129@@ -136,7 +136,7 @@ polaris_write_config(struct pci_bus *bus
130 return PCIBIOS_SUCCESSFUL;
131 }
132
133-struct pci_ops polaris_pci_ops =
134+const struct pci_ops polaris_pci_ops =
135 {
136 .read = polaris_read_config,
137 .write = polaris_write_config,
138diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_t2.c linux-2.6.39.2/arch/alpha/kernel/core_t2.c
139--- linux-2.6.39.2/arch/alpha/kernel/core_t2.c 2011-05-19 00:06:34.000000000 -0400
140+++ linux-2.6.39.2/arch/alpha/kernel/core_t2.c 2011-05-22 19:36:30.000000000 -0400
141@@ -314,7 +314,7 @@ t2_write_config(struct pci_bus *bus, uns
142 return PCIBIOS_SUCCESSFUL;
143 }
144
145-struct pci_ops t2_pci_ops =
146+const struct pci_ops t2_pci_ops =
147 {
148 .read = t2_read_config,
149 .write = t2_write_config,
150diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_titan.c linux-2.6.39.2/arch/alpha/kernel/core_titan.c
151--- linux-2.6.39.2/arch/alpha/kernel/core_titan.c 2011-05-19 00:06:34.000000000 -0400
152+++ linux-2.6.39.2/arch/alpha/kernel/core_titan.c 2011-05-22 19:36:30.000000000 -0400
153@@ -191,7 +191,7 @@ titan_write_config(struct pci_bus *bus,
154 return PCIBIOS_SUCCESSFUL;
155 }
156
157-struct pci_ops titan_pci_ops =
158+const struct pci_ops titan_pci_ops =
159 {
160 .read = titan_read_config,
161 .write = titan_write_config,
162diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_tsunami.c linux-2.6.39.2/arch/alpha/kernel/core_tsunami.c
163--- linux-2.6.39.2/arch/alpha/kernel/core_tsunami.c 2011-05-19 00:06:34.000000000 -0400
164+++ linux-2.6.39.2/arch/alpha/kernel/core_tsunami.c 2011-05-22 19:36:30.000000000 -0400
165@@ -166,7 +166,7 @@ tsunami_write_config(struct pci_bus *bus
166 return PCIBIOS_SUCCESSFUL;
167 }
168
169-struct pci_ops tsunami_pci_ops =
170+const struct pci_ops tsunami_pci_ops =
171 {
172 .read = tsunami_read_config,
173 .write = tsunami_write_config,
174diff -urNp linux-2.6.39.2/arch/alpha/kernel/core_wildfire.c linux-2.6.39.2/arch/alpha/kernel/core_wildfire.c
175--- linux-2.6.39.2/arch/alpha/kernel/core_wildfire.c 2011-05-19 00:06:34.000000000 -0400
176+++ linux-2.6.39.2/arch/alpha/kernel/core_wildfire.c 2011-05-22 19:36:30.000000000 -0400
177@@ -431,7 +431,7 @@ wildfire_write_config(struct pci_bus *bu
178 return PCIBIOS_SUCCESSFUL;
179 }
180
181-struct pci_ops wildfire_pci_ops =
182+const struct pci_ops wildfire_pci_ops =
183 {
184 .read = wildfire_read_config,
185 .write = wildfire_write_config,
186diff -urNp linux-2.6.39.2/arch/alpha/kernel/module.c linux-2.6.39.2/arch/alpha/kernel/module.c
187--- linux-2.6.39.2/arch/alpha/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
188+++ linux-2.6.39.2/arch/alpha/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
189@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
190
191 /* The small sections were sorted to the end of the segment.
192 The following should definitely cover them. */
193- gp = (u64)me->module_core + me->core_size - 0x8000;
194+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
195 got = sechdrs[me->arch.gotsecindex].sh_addr;
196
197 for (i = 0; i < n; i++) {
198diff -urNp linux-2.6.39.2/arch/alpha/kernel/osf_sys.c linux-2.6.39.2/arch/alpha/kernel/osf_sys.c
199--- linux-2.6.39.2/arch/alpha/kernel/osf_sys.c 2011-05-19 00:06:34.000000000 -0400
200+++ linux-2.6.39.2/arch/alpha/kernel/osf_sys.c 2011-06-13 17:19:07.000000000 -0400
201@@ -409,7 +409,7 @@ SYSCALL_DEFINE2(osf_getdomainname, char
202 return -EFAULT;
203
204 len = namelen;
205- if (namelen > 32)
206+ if (len > 32)
207 len = 32;
208
209 down_read(&uts_sem);
210@@ -594,7 +594,7 @@ SYSCALL_DEFINE3(osf_sysinfo, int, comman
211 down_read(&uts_sem);
212 res = sysinfo_table[offset];
213 len = strlen(res)+1;
214- if (len > count)
215+ if ((unsigned long)len > (unsigned long)count)
216 len = count;
217 if (copy_to_user(buf, res, len))
218 err = -EFAULT;
219@@ -649,7 +649,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned
220 return 1;
221
222 case GSI_GET_HWRPB:
223- if (nbytes < sizeof(*hwrpb))
224+ if (nbytes > sizeof(*hwrpb))
225 return -EINVAL;
226 if (copy_to_user(buffer, hwrpb, nbytes) != 0)
227 return -EFAULT;
228@@ -1008,6 +1008,7 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i
229 {
230 struct rusage r;
231 long ret, err;
232+ unsigned int status = 0;
233 mm_segment_t old_fs;
234
235 if (!ur)
236@@ -1016,13 +1017,15 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i
237 old_fs = get_fs();
238
239 set_fs (KERNEL_DS);
240- ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r);
241+ ret = sys_wait4(pid, (unsigned int __user *) &status, options,
242+ (struct rusage __user *) &r);
243 set_fs (old_fs);
244
245 if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
246 return -EFAULT;
247
248 err = 0;
249+ err |= put_user(status, ustatus);
250 err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
251 err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
252 err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
253@@ -1142,7 +1145,7 @@ arch_get_unmapped_area_1(unsigned long a
254 /* At this point: (!vma || addr < vma->vm_end). */
255 if (limit - len < addr)
256 return -ENOMEM;
257- if (!vma || addr + len <= vma->vm_start)
258+ if (check_heap_stack_gap(vma, addr, len))
259 return addr;
260 addr = vma->vm_end;
261 vma = vma->vm_next;
262@@ -1178,6 +1181,10 @@ arch_get_unmapped_area(struct file *filp
263 merely specific addresses, but regions of memory -- perhaps
264 this feature should be incorporated into all ports? */
265
266+#ifdef CONFIG_PAX_RANDMMAP
267+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
268+#endif
269+
270 if (addr) {
271 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
272 if (addr != (unsigned long) -ENOMEM)
273@@ -1185,8 +1192,8 @@ arch_get_unmapped_area(struct file *filp
274 }
275
276 /* Next, try allocating at TASK_UNMAPPED_BASE. */
277- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
278- len, limit);
279+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
280+
281 if (addr != (unsigned long) -ENOMEM)
282 return addr;
283
284diff -urNp linux-2.6.39.2/arch/alpha/kernel/pci_iommu.c linux-2.6.39.2/arch/alpha/kernel/pci_iommu.c
285--- linux-2.6.39.2/arch/alpha/kernel/pci_iommu.c 2011-05-19 00:06:34.000000000 -0400
286+++ linux-2.6.39.2/arch/alpha/kernel/pci_iommu.c 2011-05-22 19:36:30.000000000 -0400
287@@ -950,7 +950,7 @@ static int alpha_pci_set_mask(struct dev
288 return 0;
289 }
290
291-struct dma_map_ops alpha_pci_ops = {
292+const struct dma_map_ops alpha_pci_ops = {
293 .alloc_coherent = alpha_pci_alloc_coherent,
294 .free_coherent = alpha_pci_free_coherent,
295 .map_page = alpha_pci_map_page,
296@@ -962,5 +962,5 @@ struct dma_map_ops alpha_pci_ops = {
297 .set_dma_mask = alpha_pci_set_mask,
298 };
299
300-struct dma_map_ops *dma_ops = &alpha_pci_ops;
301+const struct dma_map_ops *dma_ops = &alpha_pci_ops;
302 EXPORT_SYMBOL(dma_ops);
303diff -urNp linux-2.6.39.2/arch/alpha/kernel/pci-noop.c linux-2.6.39.2/arch/alpha/kernel/pci-noop.c
304--- linux-2.6.39.2/arch/alpha/kernel/pci-noop.c 2011-05-19 00:06:34.000000000 -0400
305+++ linux-2.6.39.2/arch/alpha/kernel/pci-noop.c 2011-05-22 19:36:30.000000000 -0400
306@@ -173,7 +173,7 @@ static int alpha_noop_set_mask(struct de
307 return 0;
308 }
309
310-struct dma_map_ops alpha_noop_ops = {
311+const struct dma_map_ops alpha_noop_ops = {
312 .alloc_coherent = alpha_noop_alloc_coherent,
313 .free_coherent = alpha_noop_free_coherent,
314 .map_page = alpha_noop_map_page,
315@@ -183,7 +183,7 @@ struct dma_map_ops alpha_noop_ops = {
316 .set_dma_mask = alpha_noop_set_mask,
317 };
318
319-struct dma_map_ops *dma_ops = &alpha_noop_ops;
320+const struct dma_map_ops *dma_ops = &alpha_noop_ops;
321 EXPORT_SYMBOL(dma_ops);
322
323 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
324diff -urNp linux-2.6.39.2/arch/alpha/kernel/proto.h linux-2.6.39.2/arch/alpha/kernel/proto.h
325--- linux-2.6.39.2/arch/alpha/kernel/proto.h 2011-05-19 00:06:34.000000000 -0400
326+++ linux-2.6.39.2/arch/alpha/kernel/proto.h 2011-05-22 19:36:30.000000000 -0400
327@@ -17,14 +17,14 @@ struct pci_dev;
328 struct pci_controller;
329
330 /* core_apecs.c */
331-extern struct pci_ops apecs_pci_ops;
332+extern const struct pci_ops apecs_pci_ops;
333 extern void apecs_init_arch(void);
334 extern void apecs_pci_clr_err(void);
335 extern void apecs_machine_check(unsigned long vector, unsigned long la_ptr);
336 extern void apecs_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
337
338 /* core_cia.c */
339-extern struct pci_ops cia_pci_ops;
340+extern const struct pci_ops cia_pci_ops;
341 extern void cia_init_pci(void);
342 extern void cia_init_arch(void);
343 extern void pyxis_init_arch(void);
344@@ -33,19 +33,19 @@ extern void cia_machine_check(unsigned l
345 extern void cia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
346
347 /* core_irongate.c */
348-extern struct pci_ops irongate_pci_ops;
349+extern const struct pci_ops irongate_pci_ops;
350 extern int irongate_pci_clr_err(void);
351 extern void irongate_init_arch(void);
352 #define irongate_pci_tbi ((void *)0)
353
354 /* core_lca.c */
355-extern struct pci_ops lca_pci_ops;
356+extern const struct pci_ops lca_pci_ops;
357 extern void lca_init_arch(void);
358 extern void lca_machine_check(unsigned long vector, unsigned long la_ptr);
359 extern void lca_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
360
361 /* core_marvel.c */
362-extern struct pci_ops marvel_pci_ops;
363+extern const struct pci_ops marvel_pci_ops;
364 extern void marvel_init_arch(void);
365 extern void marvel_kill_arch(int);
366 extern void marvel_machine_check(unsigned long, unsigned long);
367@@ -60,14 +60,14 @@ struct io7 *marvel_next_io7(struct io7 *
368 void io7_clear_errors(struct io7 *io7);
369
370 /* core_mcpcia.c */
371-extern struct pci_ops mcpcia_pci_ops;
372+extern const struct pci_ops mcpcia_pci_ops;
373 extern void mcpcia_init_arch(void);
374 extern void mcpcia_init_hoses(void);
375 extern void mcpcia_machine_check(unsigned long vector, unsigned long la_ptr);
376 extern void mcpcia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
377
378 /* core_polaris.c */
379-extern struct pci_ops polaris_pci_ops;
380+extern const struct pci_ops polaris_pci_ops;
381 extern int polaris_read_config_dword(struct pci_dev *, int, u32 *);
382 extern int polaris_write_config_dword(struct pci_dev *, int, u32);
383 extern void polaris_init_arch(void);
384@@ -75,14 +75,14 @@ extern void polaris_machine_check(unsign
385 #define polaris_pci_tbi ((void *)0)
386
387 /* core_t2.c */
388-extern struct pci_ops t2_pci_ops;
389+extern const struct pci_ops t2_pci_ops;
390 extern void t2_init_arch(void);
391 extern void t2_kill_arch(int);
392 extern void t2_machine_check(unsigned long vector, unsigned long la_ptr);
393 extern void t2_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
394
395 /* core_titan.c */
396-extern struct pci_ops titan_pci_ops;
397+extern const struct pci_ops titan_pci_ops;
398 extern void titan_init_arch(void);
399 extern void titan_kill_arch(int);
400 extern void titan_machine_check(unsigned long, unsigned long);
401@@ -90,14 +90,14 @@ extern void titan_pci_tbi(struct pci_con
402 extern struct _alpha_agp_info *titan_agp_info(void);
403
404 /* core_tsunami.c */
405-extern struct pci_ops tsunami_pci_ops;
406+extern const struct pci_ops tsunami_pci_ops;
407 extern void tsunami_init_arch(void);
408 extern void tsunami_kill_arch(int);
409 extern void tsunami_machine_check(unsigned long vector, unsigned long la_ptr);
410 extern void tsunami_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
411
412 /* core_wildfire.c */
413-extern struct pci_ops wildfire_pci_ops;
414+extern const struct pci_ops wildfire_pci_ops;
415 extern void wildfire_init_arch(void);
416 extern void wildfire_kill_arch(int);
417 extern void wildfire_machine_check(unsigned long vector, unsigned long la_ptr);
418diff -urNp linux-2.6.39.2/arch/alpha/mm/fault.c linux-2.6.39.2/arch/alpha/mm/fault.c
419--- linux-2.6.39.2/arch/alpha/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
420+++ linux-2.6.39.2/arch/alpha/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
421@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
422 __reload_thread(pcb);
423 }
424
425+#ifdef CONFIG_PAX_PAGEEXEC
426+/*
427+ * PaX: decide what to do with offenders (regs->pc = fault address)
428+ *
429+ * returns 1 when task should be killed
430+ * 2 when patched PLT trampoline was detected
431+ * 3 when unpatched PLT trampoline was detected
432+ */
433+static int pax_handle_fetch_fault(struct pt_regs *regs)
434+{
435+
436+#ifdef CONFIG_PAX_EMUPLT
437+ int err;
438+
439+ do { /* PaX: patched PLT emulation #1 */
440+ unsigned int ldah, ldq, jmp;
441+
442+ err = get_user(ldah, (unsigned int *)regs->pc);
443+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
444+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
445+
446+ if (err)
447+ break;
448+
449+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
450+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
451+ jmp == 0x6BFB0000U)
452+ {
453+ unsigned long r27, addr;
454+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
455+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
456+
457+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
458+ err = get_user(r27, (unsigned long *)addr);
459+ if (err)
460+ break;
461+
462+ regs->r27 = r27;
463+ regs->pc = r27;
464+ return 2;
465+ }
466+ } while (0);
467+
468+ do { /* PaX: patched PLT emulation #2 */
469+ unsigned int ldah, lda, br;
470+
471+ err = get_user(ldah, (unsigned int *)regs->pc);
472+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
473+ err |= get_user(br, (unsigned int *)(regs->pc+8));
474+
475+ if (err)
476+ break;
477+
478+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
479+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
480+ (br & 0xFFE00000U) == 0xC3E00000U)
481+ {
482+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
483+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
484+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
485+
486+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
487+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
488+ return 2;
489+ }
490+ } while (0);
491+
492+ do { /* PaX: unpatched PLT emulation */
493+ unsigned int br;
494+
495+ err = get_user(br, (unsigned int *)regs->pc);
496+
497+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
498+ unsigned int br2, ldq, nop, jmp;
499+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
500+
501+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
502+ err = get_user(br2, (unsigned int *)addr);
503+ err |= get_user(ldq, (unsigned int *)(addr+4));
504+ err |= get_user(nop, (unsigned int *)(addr+8));
505+ err |= get_user(jmp, (unsigned int *)(addr+12));
506+ err |= get_user(resolver, (unsigned long *)(addr+16));
507+
508+ if (err)
509+ break;
510+
511+ if (br2 == 0xC3600000U &&
512+ ldq == 0xA77B000CU &&
513+ nop == 0x47FF041FU &&
514+ jmp == 0x6B7B0000U)
515+ {
516+ regs->r28 = regs->pc+4;
517+ regs->r27 = addr+16;
518+ regs->pc = resolver;
519+ return 3;
520+ }
521+ }
522+ } while (0);
523+#endif
524+
525+ return 1;
526+}
527+
528+void pax_report_insns(void *pc, void *sp)
529+{
530+ unsigned long i;
531+
532+ printk(KERN_ERR "PAX: bytes at PC: ");
533+ for (i = 0; i < 5; i++) {
534+ unsigned int c;
535+ if (get_user(c, (unsigned int *)pc+i))
536+ printk(KERN_CONT "???????? ");
537+ else
538+ printk(KERN_CONT "%08x ", c);
539+ }
540+ printk("\n");
541+}
542+#endif
543
544 /*
545 * This routine handles page faults. It determines the address,
546@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
547 good_area:
548 si_code = SEGV_ACCERR;
549 if (cause < 0) {
550- if (!(vma->vm_flags & VM_EXEC))
551+ if (!(vma->vm_flags & VM_EXEC)) {
552+
553+#ifdef CONFIG_PAX_PAGEEXEC
554+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
555+ goto bad_area;
556+
557+ up_read(&mm->mmap_sem);
558+ switch (pax_handle_fetch_fault(regs)) {
559+
560+#ifdef CONFIG_PAX_EMUPLT
561+ case 2:
562+ case 3:
563+ return;
564+#endif
565+
566+ }
567+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
568+ do_group_exit(SIGKILL);
569+#else
570 goto bad_area;
571+#endif
572+
573+ }
574 } else if (!cause) {
575 /* Allow reads even for write-only mappings */
576 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
577diff -urNp linux-2.6.39.2/arch/arm/common/it8152.c linux-2.6.39.2/arch/arm/common/it8152.c
578--- linux-2.6.39.2/arch/arm/common/it8152.c 2011-05-19 00:06:34.000000000 -0400
579+++ linux-2.6.39.2/arch/arm/common/it8152.c 2011-05-22 19:36:30.000000000 -0400
580@@ -221,7 +221,7 @@ static int it8152_pci_write_config(struc
581 return PCIBIOS_SUCCESSFUL;
582 }
583
584-static struct pci_ops it8152_ops = {
585+static const struct pci_ops it8152_ops = {
586 .read = it8152_pci_read_config,
587 .write = it8152_pci_write_config,
588 };
589diff -urNp linux-2.6.39.2/arch/arm/common/via82c505.c linux-2.6.39.2/arch/arm/common/via82c505.c
590--- linux-2.6.39.2/arch/arm/common/via82c505.c 2011-05-19 00:06:34.000000000 -0400
591+++ linux-2.6.39.2/arch/arm/common/via82c505.c 2011-05-22 19:36:30.000000000 -0400
592@@ -52,7 +52,7 @@ via82c505_write_config(struct pci_bus *b
593 return PCIBIOS_SUCCESSFUL;
594 }
595
596-static struct pci_ops via82c505_ops = {
597+static const struct pci_ops via82c505_ops = {
598 .read = via82c505_read_config,
599 .write = via82c505_write_config,
600 };
601diff -urNp linux-2.6.39.2/arch/arm/include/asm/cacheflush.h linux-2.6.39.2/arch/arm/include/asm/cacheflush.h
602--- linux-2.6.39.2/arch/arm/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
603+++ linux-2.6.39.2/arch/arm/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
604@@ -115,7 +115,7 @@ struct cpu_cache_fns {
605 */
606 #ifdef MULTI_CACHE
607
608-extern struct cpu_cache_fns cpu_cache;
609+extern const struct cpu_cache_fns cpu_cache;
610
611 #define __cpuc_flush_icache_all cpu_cache.flush_icache_all
612 #define __cpuc_flush_kern_all cpu_cache.flush_kern_all
613diff -urNp linux-2.6.39.2/arch/arm/include/asm/elf.h linux-2.6.39.2/arch/arm/include/asm/elf.h
614--- linux-2.6.39.2/arch/arm/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
615+++ linux-2.6.39.2/arch/arm/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
616@@ -115,7 +115,14 @@ int dump_task_regs(struct task_struct *t
617 the loader. We need to make sure that it is out of the way of the program
618 that it will "exec", and that there is sufficient room for the brk. */
619
620-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
621+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
622+
623+#ifdef CONFIG_PAX_ASLR
624+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
625+
626+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
627+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
628+#endif
629
630 /* When the program starts, a1 contains a pointer to a function to be
631 registered with atexit, as per the SVR4 ABI. A value of 0 means we
632@@ -125,10 +132,6 @@ int dump_task_regs(struct task_struct *t
633 extern void elf_set_personality(const struct elf32_hdr *);
634 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
635
636-struct mm_struct;
637-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
638-#define arch_randomize_brk arch_randomize_brk
639-
640 extern int vectors_user_mapping(void);
641 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
642 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
643diff -urNp linux-2.6.39.2/arch/arm/include/asm/kmap_types.h linux-2.6.39.2/arch/arm/include/asm/kmap_types.h
644--- linux-2.6.39.2/arch/arm/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
645+++ linux-2.6.39.2/arch/arm/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
646@@ -21,6 +21,7 @@ enum km_type {
647 KM_L1_CACHE,
648 KM_L2_CACHE,
649 KM_KDB,
650+ KM_CLEARPAGE,
651 KM_TYPE_NR
652 };
653
654diff -urNp linux-2.6.39.2/arch/arm/include/asm/outercache.h linux-2.6.39.2/arch/arm/include/asm/outercache.h
655--- linux-2.6.39.2/arch/arm/include/asm/outercache.h 2011-05-19 00:06:34.000000000 -0400
656+++ linux-2.6.39.2/arch/arm/include/asm/outercache.h 2011-05-22 19:36:30.000000000 -0400
657@@ -38,7 +38,7 @@ struct outer_cache_fns {
658
659 #ifdef CONFIG_OUTER_CACHE
660
661-extern struct outer_cache_fns outer_cache;
662+extern const struct outer_cache_fns outer_cache;
663
664 static inline void outer_inv_range(phys_addr_t start, phys_addr_t end)
665 {
666diff -urNp linux-2.6.39.2/arch/arm/include/asm/page.h linux-2.6.39.2/arch/arm/include/asm/page.h
667--- linux-2.6.39.2/arch/arm/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
668+++ linux-2.6.39.2/arch/arm/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
669@@ -126,7 +126,7 @@ struct cpu_user_fns {
670 };
671
672 #ifdef MULTI_USER
673-extern struct cpu_user_fns cpu_user;
674+extern const struct cpu_user_fns cpu_user;
675
676 #define __cpu_clear_user_highpage cpu_user.cpu_clear_user_highpage
677 #define __cpu_copy_user_highpage cpu_user.cpu_copy_user_highpage
678diff -urNp linux-2.6.39.2/arch/arm/include/asm/uaccess.h linux-2.6.39.2/arch/arm/include/asm/uaccess.h
679--- linux-2.6.39.2/arch/arm/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
680+++ linux-2.6.39.2/arch/arm/include/asm/uaccess.h 2011-06-29 21:04:12.000000000 -0400
681@@ -22,6 +22,8 @@
682 #define VERIFY_READ 0
683 #define VERIFY_WRITE 1
684
685+extern void check_object_size(const void *ptr, unsigned long n, bool to);
686+
687 /*
688 * The exception table consists of pairs of addresses: the first is the
689 * address of an instruction that is allowed to fault, and the second is
690@@ -387,8 +389,23 @@ do { \
691
692
693 #ifdef CONFIG_MMU
694-extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
695-extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
696+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
697+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
698+
699+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
700+{
701+ if (!__builtin_constant_p(n))
702+ check_object_size(to, n, false);
703+ return ___copy_from_user(to, from, n);
704+}
705+
706+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
707+{
708+ if (!__builtin_constant_p(n))
709+ check_object_size(from, n, true);
710+ return ___copy_to_user(to, from, n);
711+}
712+
713 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
714 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
715 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
716@@ -403,6 +420,9 @@ extern unsigned long __must_check __strn
717
718 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
719 {
720+ if ((long)n < 0)
721+ return n;
722+
723 if (access_ok(VERIFY_READ, from, n))
724 n = __copy_from_user(to, from, n);
725 else /* security hole - plug it */
726@@ -412,6 +432,9 @@ static inline unsigned long __must_check
727
728 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
729 {
730+ if ((long)n < 0)
731+ return n;
732+
733 if (access_ok(VERIFY_WRITE, to, n))
734 n = __copy_to_user(to, from, n);
735 return n;
736diff -urNp linux-2.6.39.2/arch/arm/kernel/kgdb.c linux-2.6.39.2/arch/arm/kernel/kgdb.c
737--- linux-2.6.39.2/arch/arm/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
738+++ linux-2.6.39.2/arch/arm/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
739@@ -246,7 +246,7 @@ void kgdb_arch_exit(void)
740 * and we handle the normal undef case within the do_undefinstr
741 * handler.
742 */
743-struct kgdb_arch arch_kgdb_ops = {
744+const struct kgdb_arch arch_kgdb_ops = {
745 #ifndef __ARMEB__
746 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
747 #else /* ! __ARMEB__ */
748diff -urNp linux-2.6.39.2/arch/arm/kernel/process.c linux-2.6.39.2/arch/arm/kernel/process.c
749--- linux-2.6.39.2/arch/arm/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
750+++ linux-2.6.39.2/arch/arm/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
751@@ -28,7 +28,6 @@
752 #include <linux/tick.h>
753 #include <linux/utsname.h>
754 #include <linux/uaccess.h>
755-#include <linux/random.h>
756 #include <linux/hw_breakpoint.h>
757
758 #include <asm/cacheflush.h>
759@@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru
760 return 0;
761 }
762
763-unsigned long arch_randomize_brk(struct mm_struct *mm)
764-{
765- unsigned long range_end = mm->brk + 0x02000000;
766- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
767-}
768-
769 #ifdef CONFIG_MMU
770 /*
771 * The vectors page is always readable from user space for the
772diff -urNp linux-2.6.39.2/arch/arm/kernel/traps.c linux-2.6.39.2/arch/arm/kernel/traps.c
773--- linux-2.6.39.2/arch/arm/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
774+++ linux-2.6.39.2/arch/arm/kernel/traps.c 2011-06-13 21:30:34.000000000 -0400
775@@ -258,6 +258,8 @@ static int __die(const char *str, int er
776
777 static DEFINE_SPINLOCK(die_lock);
778
779+extern void gr_handle_kernel_exploit(void);
780+
781 /*
782 * This function is protected against re-entrancy.
783 */
784@@ -285,6 +287,9 @@ void die(const char *str, struct pt_regs
785 panic("Fatal exception in interrupt");
786 if (panic_on_oops)
787 panic("Fatal exception");
788+
789+ gr_handle_kernel_exploit();
790+
791 if (ret != NOTIFY_STOP)
792 do_exit(SIGSEGV);
793 }
794diff -urNp linux-2.6.39.2/arch/arm/lib/copy_from_user.S linux-2.6.39.2/arch/arm/lib/copy_from_user.S
795--- linux-2.6.39.2/arch/arm/lib/copy_from_user.S 2011-05-19 00:06:34.000000000 -0400
796+++ linux-2.6.39.2/arch/arm/lib/copy_from_user.S 2011-06-29 20:58:18.000000000 -0400
797@@ -16,7 +16,7 @@
798 /*
799 * Prototype:
800 *
801- * size_t __copy_from_user(void *to, const void *from, size_t n)
802+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
803 *
804 * Purpose:
805 *
806@@ -84,11 +84,11 @@
807
808 .text
809
810-ENTRY(__copy_from_user)
811+ENTRY(___copy_from_user)
812
813 #include "copy_template.S"
814
815-ENDPROC(__copy_from_user)
816+ENDPROC(___copy_from_user)
817
818 .pushsection .fixup,"ax"
819 .align 0
820diff -urNp linux-2.6.39.2/arch/arm/lib/copy_to_user.S linux-2.6.39.2/arch/arm/lib/copy_to_user.S
821--- linux-2.6.39.2/arch/arm/lib/copy_to_user.S 2011-05-19 00:06:34.000000000 -0400
822+++ linux-2.6.39.2/arch/arm/lib/copy_to_user.S 2011-06-29 20:59:20.000000000 -0400
823@@ -16,7 +16,7 @@
824 /*
825 * Prototype:
826 *
827- * size_t __copy_to_user(void *to, const void *from, size_t n)
828+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
829 *
830 * Purpose:
831 *
832@@ -88,11 +88,11 @@
833 .text
834
835 ENTRY(__copy_to_user_std)
836-WEAK(__copy_to_user)
837+WEAK(___copy_to_user)
838
839 #include "copy_template.S"
840
841-ENDPROC(__copy_to_user)
842+ENDPROC(___copy_to_user)
843 ENDPROC(__copy_to_user_std)
844
845 .pushsection .fixup,"ax"
846diff -urNp linux-2.6.39.2/arch/arm/lib/uaccess.S linux-2.6.39.2/arch/arm/lib/uaccess.S
847--- linux-2.6.39.2/arch/arm/lib/uaccess.S 2011-05-19 00:06:34.000000000 -0400
848+++ linux-2.6.39.2/arch/arm/lib/uaccess.S 2011-06-29 20:59:01.000000000 -0400
849@@ -20,7 +20,7 @@
850
851 #define PAGE_SHIFT 12
852
853-/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
854+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
855 * Purpose : copy a block to user memory from kernel memory
856 * Params : to - user memory
857 * : from - kernel memory
858@@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May f
859 sub r2, r2, ip
860 b .Lc2u_dest_aligned
861
862-ENTRY(__copy_to_user)
863+ENTRY(___copy_to_user)
864 stmfd sp!, {r2, r4 - r7, lr}
865 cmp r2, #4
866 blt .Lc2u_not_enough
867@@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May f
868 ldrgtb r3, [r1], #0
869 USER( T(strgtb) r3, [r0], #1) @ May fault
870 b .Lc2u_finished
871-ENDPROC(__copy_to_user)
872+ENDPROC(___copy_to_user)
873
874 .pushsection .fixup,"ax"
875 .align 0
876 9001: ldmfd sp!, {r0, r4 - r7, pc}
877 .popsection
878
879-/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
880+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
881 * Purpose : copy a block from user memory to kernel memory
882 * Params : to - kernel memory
883 * : from - user memory
884@@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May f
885 sub r2, r2, ip
886 b .Lcfu_dest_aligned
887
888-ENTRY(__copy_from_user)
889+ENTRY(___copy_from_user)
890 stmfd sp!, {r0, r2, r4 - r7, lr}
891 cmp r2, #4
892 blt .Lcfu_not_enough
893@@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May f
894 USER( T(ldrgtb) r3, [r1], #1) @ May fault
895 strgtb r3, [r0], #1
896 b .Lcfu_finished
897-ENDPROC(__copy_from_user)
898+ENDPROC(___copy_from_user)
899
900 .pushsection .fixup,"ax"
901 .align 0
902diff -urNp linux-2.6.39.2/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.39.2/arch/arm/lib/uaccess_with_memcpy.c
903--- linux-2.6.39.2/arch/arm/lib/uaccess_with_memcpy.c 2011-05-19 00:06:34.000000000 -0400
904+++ linux-2.6.39.2/arch/arm/lib/uaccess_with_memcpy.c 2011-06-29 20:59:55.000000000 -0400
905@@ -103,7 +103,7 @@ out:
906 }
907
908 unsigned long
909-__copy_to_user(void __user *to, const void *from, unsigned long n)
910+___copy_to_user(void __user *to, const void *from, unsigned long n)
911 {
912 /*
913 * This test is stubbed out of the main function above to keep
914diff -urNp linux-2.6.39.2/arch/arm/mach-cns3xxx/pcie.c linux-2.6.39.2/arch/arm/mach-cns3xxx/pcie.c
915--- linux-2.6.39.2/arch/arm/mach-cns3xxx/pcie.c 2011-05-19 00:06:34.000000000 -0400
916+++ linux-2.6.39.2/arch/arm/mach-cns3xxx/pcie.c 2011-05-22 19:36:30.000000000 -0400
917@@ -162,7 +162,7 @@ static int cns3xxx_pci_setup(int nr, str
918 return 1;
919 }
920
921-static struct pci_ops cns3xxx_pcie_ops = {
922+static const struct pci_ops cns3xxx_pcie_ops = {
923 .read = cns3xxx_pci_read_config,
924 .write = cns3xxx_pci_write_config,
925 };
926diff -urNp linux-2.6.39.2/arch/arm/mach-dove/pcie.c linux-2.6.39.2/arch/arm/mach-dove/pcie.c
927--- linux-2.6.39.2/arch/arm/mach-dove/pcie.c 2011-05-19 00:06:34.000000000 -0400
928+++ linux-2.6.39.2/arch/arm/mach-dove/pcie.c 2011-05-22 19:36:30.000000000 -0400
929@@ -155,7 +155,7 @@ static int pcie_wr_conf(struct pci_bus *
930 return ret;
931 }
932
933-static struct pci_ops pcie_ops = {
934+static const struct pci_ops pcie_ops = {
935 .read = pcie_rd_conf,
936 .write = pcie_wr_conf,
937 };
938diff -urNp linux-2.6.39.2/arch/arm/mach-footbridge/dc21285.c linux-2.6.39.2/arch/arm/mach-footbridge/dc21285.c
939--- linux-2.6.39.2/arch/arm/mach-footbridge/dc21285.c 2011-05-19 00:06:34.000000000 -0400
940+++ linux-2.6.39.2/arch/arm/mach-footbridge/dc21285.c 2011-05-22 19:36:30.000000000 -0400
941@@ -129,7 +129,7 @@ dc21285_write_config(struct pci_bus *bus
942 return PCIBIOS_SUCCESSFUL;
943 }
944
945-static struct pci_ops dc21285_ops = {
946+static const struct pci_ops dc21285_ops = {
947 .read = dc21285_read_config,
948 .write = dc21285_write_config,
949 };
950diff -urNp linux-2.6.39.2/arch/arm/mach-integrator/pci_v3.c linux-2.6.39.2/arch/arm/mach-integrator/pci_v3.c
951--- linux-2.6.39.2/arch/arm/mach-integrator/pci_v3.c 2011-05-19 00:06:34.000000000 -0400
952+++ linux-2.6.39.2/arch/arm/mach-integrator/pci_v3.c 2011-05-22 19:36:30.000000000 -0400
953@@ -340,7 +340,7 @@ static int v3_write_config(struct pci_bu
954 return PCIBIOS_SUCCESSFUL;
955 }
956
957-static struct pci_ops pci_v3_ops = {
958+static const struct pci_ops pci_v3_ops = {
959 .read = v3_read_config,
960 .write = v3_write_config,
961 };
962diff -urNp linux-2.6.39.2/arch/arm/mach-iop13xx/pci.c linux-2.6.39.2/arch/arm/mach-iop13xx/pci.c
963--- linux-2.6.39.2/arch/arm/mach-iop13xx/pci.c 2011-05-19 00:06:34.000000000 -0400
964+++ linux-2.6.39.2/arch/arm/mach-iop13xx/pci.c 2011-05-22 19:36:30.000000000 -0400
965@@ -324,7 +324,7 @@ iop13xx_atux_write_config(struct pci_bus
966 return PCIBIOS_SUCCESSFUL;
967 }
968
969-static struct pci_ops iop13xx_atux_ops = {
970+static const struct pci_ops iop13xx_atux_ops = {
971 .read = iop13xx_atux_read_config,
972 .write = iop13xx_atux_write_config,
973 };
974@@ -471,7 +471,7 @@ iop13xx_atue_write_config(struct pci_bus
975 return PCIBIOS_SUCCESSFUL;
976 }
977
978-static struct pci_ops iop13xx_atue_ops = {
979+static const struct pci_ops iop13xx_atue_ops = {
980 .read = iop13xx_atue_read_config,
981 .write = iop13xx_atue_write_config,
982 };
983diff -urNp linux-2.6.39.2/arch/arm/mach-ixp2000/enp2611.c linux-2.6.39.2/arch/arm/mach-ixp2000/enp2611.c
984--- linux-2.6.39.2/arch/arm/mach-ixp2000/enp2611.c 2011-05-19 00:06:34.000000000 -0400
985+++ linux-2.6.39.2/arch/arm/mach-ixp2000/enp2611.c 2011-05-22 19:36:30.000000000 -0400
986@@ -137,7 +137,7 @@ static int enp2611_pci_write_config(stru
987 return PCIBIOS_DEVICE_NOT_FOUND;
988 }
989
990-static struct pci_ops enp2611_pci_ops = {
991+static const struct pci_ops enp2611_pci_ops = {
992 .read = enp2611_pci_read_config,
993 .write = enp2611_pci_write_config
994 };
995diff -urNp linux-2.6.39.2/arch/arm/mach-ixp2000/pci.c linux-2.6.39.2/arch/arm/mach-ixp2000/pci.c
996--- linux-2.6.39.2/arch/arm/mach-ixp2000/pci.c 2011-05-19 00:06:34.000000000 -0400
997+++ linux-2.6.39.2/arch/arm/mach-ixp2000/pci.c 2011-05-22 19:36:30.000000000 -0400
998@@ -125,7 +125,7 @@ int ixp2000_pci_write_config(struct pci_
999 }
1000
1001
1002-static struct pci_ops ixp2000_pci_ops = {
1003+static const struct pci_ops ixp2000_pci_ops = {
1004 .read = ixp2000_pci_read_config,
1005 .write = ixp2000_pci_write_config
1006 };
1007diff -urNp linux-2.6.39.2/arch/arm/mach-ixp23xx/pci.c linux-2.6.39.2/arch/arm/mach-ixp23xx/pci.c
1008--- linux-2.6.39.2/arch/arm/mach-ixp23xx/pci.c 2011-05-19 00:06:34.000000000 -0400
1009+++ linux-2.6.39.2/arch/arm/mach-ixp23xx/pci.c 2011-05-22 19:36:30.000000000 -0400
1010@@ -136,7 +136,7 @@ static int ixp23xx_pci_write_config(stru
1011 return PCIBIOS_SUCCESSFUL;
1012 }
1013
1014-struct pci_ops ixp23xx_pci_ops = {
1015+const struct pci_ops ixp23xx_pci_ops = {
1016 .read = ixp23xx_pci_read_config,
1017 .write = ixp23xx_pci_write_config,
1018 };
1019diff -urNp linux-2.6.39.2/arch/arm/mach-ixp4xx/common-pci.c linux-2.6.39.2/arch/arm/mach-ixp4xx/common-pci.c
1020--- linux-2.6.39.2/arch/arm/mach-ixp4xx/common-pci.c 2011-05-19 00:06:34.000000000 -0400
1021+++ linux-2.6.39.2/arch/arm/mach-ixp4xx/common-pci.c 2011-05-22 19:36:30.000000000 -0400
1022@@ -283,7 +283,7 @@ static int ixp4xx_pci_write_config(struc
1023 return PCIBIOS_SUCCESSFUL;
1024 }
1025
1026-struct pci_ops ixp4xx_ops = {
1027+const struct pci_ops ixp4xx_ops = {
1028 .read = ixp4xx_pci_read_config,
1029 .write = ixp4xx_pci_write_config,
1030 };
1031diff -urNp linux-2.6.39.2/arch/arm/mach-kirkwood/pcie.c linux-2.6.39.2/arch/arm/mach-kirkwood/pcie.c
1032--- linux-2.6.39.2/arch/arm/mach-kirkwood/pcie.c 2011-05-19 00:06:34.000000000 -0400
1033+++ linux-2.6.39.2/arch/arm/mach-kirkwood/pcie.c 2011-05-22 19:36:30.000000000 -0400
1034@@ -111,7 +111,7 @@ static int pcie_wr_conf(struct pci_bus *
1035 return ret;
1036 }
1037
1038-static struct pci_ops pcie_ops = {
1039+static const struct pci_ops pcie_ops = {
1040 .read = pcie_rd_conf,
1041 .write = pcie_wr_conf,
1042 };
1043diff -urNp linux-2.6.39.2/arch/arm/mach-ks8695/pci.c linux-2.6.39.2/arch/arm/mach-ks8695/pci.c
1044--- linux-2.6.39.2/arch/arm/mach-ks8695/pci.c 2011-05-19 00:06:34.000000000 -0400
1045+++ linux-2.6.39.2/arch/arm/mach-ks8695/pci.c 2011-05-22 19:36:30.000000000 -0400
1046@@ -136,7 +136,7 @@ static void ks8695_local_writeconfig(int
1047 __raw_writel(value, KS8695_PCI_VA + KS8695_PBCD);
1048 }
1049
1050-static struct pci_ops ks8695_pci_ops = {
1051+static const struct pci_ops ks8695_pci_ops = {
1052 .read = ks8695_pci_readconfig,
1053 .write = ks8695_pci_writeconfig,
1054 };
1055diff -urNp linux-2.6.39.2/arch/arm/mach-mmp/clock.c linux-2.6.39.2/arch/arm/mach-mmp/clock.c
1056--- linux-2.6.39.2/arch/arm/mach-mmp/clock.c 2011-05-19 00:06:34.000000000 -0400
1057+++ linux-2.6.39.2/arch/arm/mach-mmp/clock.c 2011-05-22 19:36:30.000000000 -0400
1058@@ -29,7 +29,7 @@ static void apbc_clk_disable(struct clk
1059 __raw_writel(0, clk->clk_rst);
1060 }
1061
1062-struct clkops apbc_clk_ops = {
1063+const struct clkops apbc_clk_ops = {
1064 .enable = apbc_clk_enable,
1065 .disable = apbc_clk_disable,
1066 };
1067@@ -44,7 +44,7 @@ static void apmu_clk_disable(struct clk
1068 __raw_writel(0, clk->clk_rst);
1069 }
1070
1071-struct clkops apmu_clk_ops = {
1072+const struct clkops apmu_clk_ops = {
1073 .enable = apmu_clk_enable,
1074 .disable = apmu_clk_disable,
1075 };
1076diff -urNp linux-2.6.39.2/arch/arm/mach-msm/iommu.c linux-2.6.39.2/arch/arm/mach-msm/iommu.c
1077--- linux-2.6.39.2/arch/arm/mach-msm/iommu.c 2011-05-19 00:06:34.000000000 -0400
1078+++ linux-2.6.39.2/arch/arm/mach-msm/iommu.c 2011-05-22 19:36:30.000000000 -0400
1079@@ -669,7 +669,7 @@ fail:
1080 return 0;
1081 }
1082
1083-static struct iommu_ops msm_iommu_ops = {
1084+static const struct iommu_ops msm_iommu_ops = {
1085 .domain_init = msm_iommu_domain_init,
1086 .domain_destroy = msm_iommu_domain_destroy,
1087 .attach_dev = msm_iommu_attach_dev,
1088diff -urNp linux-2.6.39.2/arch/arm/mach-msm/last_radio_log.c linux-2.6.39.2/arch/arm/mach-msm/last_radio_log.c
1089--- linux-2.6.39.2/arch/arm/mach-msm/last_radio_log.c 2011-05-19 00:06:34.000000000 -0400
1090+++ linux-2.6.39.2/arch/arm/mach-msm/last_radio_log.c 2011-05-22 19:36:30.000000000 -0400
1091@@ -48,6 +48,7 @@ static ssize_t last_radio_log_read(struc
1092 }
1093
1094 static struct file_operations last_radio_log_fops = {
1095+ /* cannot be const, see msm_init_last_radio_log */
1096 .read = last_radio_log_read,
1097 .llseek = default_llseek,
1098 };
1099diff -urNp linux-2.6.39.2/arch/arm/mach-mv78xx0/pcie.c linux-2.6.39.2/arch/arm/mach-mv78xx0/pcie.c
1100--- linux-2.6.39.2/arch/arm/mach-mv78xx0/pcie.c 2011-05-19 00:06:34.000000000 -0400
1101+++ linux-2.6.39.2/arch/arm/mach-mv78xx0/pcie.c 2011-05-22 19:36:30.000000000 -0400
1102@@ -222,7 +222,7 @@ static int pcie_wr_conf(struct pci_bus *
1103 return ret;
1104 }
1105
1106-static struct pci_ops pcie_ops = {
1107+static const struct pci_ops pcie_ops = {
1108 .read = pcie_rd_conf,
1109 .write = pcie_wr_conf,
1110 };
1111diff -urNp linux-2.6.39.2/arch/arm/mach-orion5x/pci.c linux-2.6.39.2/arch/arm/mach-orion5x/pci.c
1112--- linux-2.6.39.2/arch/arm/mach-orion5x/pci.c 2011-05-19 00:06:34.000000000 -0400
1113+++ linux-2.6.39.2/arch/arm/mach-orion5x/pci.c 2011-05-22 19:36:30.000000000 -0400
1114@@ -130,7 +130,7 @@ static int pcie_wr_conf(struct pci_bus *
1115 return ret;
1116 }
1117
1118-static struct pci_ops pcie_ops = {
1119+static const struct pci_ops pcie_ops = {
1120 .read = pcie_rd_conf,
1121 .write = pcie_wr_conf,
1122 };
1123@@ -368,7 +368,7 @@ static int orion5x_pci_wr_conf(struct pc
1124 PCI_FUNC(devfn), where, size, val);
1125 }
1126
1127-static struct pci_ops pci_ops = {
1128+static const struct pci_ops pci_ops = {
1129 .read = orion5x_pci_rd_conf,
1130 .write = orion5x_pci_wr_conf,
1131 };
1132diff -urNp linux-2.6.39.2/arch/arm/mach-sa1100/pci-nanoengine.c linux-2.6.39.2/arch/arm/mach-sa1100/pci-nanoengine.c
1133--- linux-2.6.39.2/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-19 00:06:34.000000000 -0400
1134+++ linux-2.6.39.2/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-22 19:36:30.000000000 -0400
1135@@ -117,7 +117,7 @@ static int nanoengine_write_config(struc
1136 return PCIBIOS_SUCCESSFUL;
1137 }
1138
1139-static struct pci_ops pci_nano_ops = {
1140+static const struct pci_ops pci_nano_ops = {
1141 .read = nanoengine_read_config,
1142 .write = nanoengine_write_config,
1143 };
1144diff -urNp linux-2.6.39.2/arch/arm/mach-tegra/pcie.c linux-2.6.39.2/arch/arm/mach-tegra/pcie.c
1145--- linux-2.6.39.2/arch/arm/mach-tegra/pcie.c 2011-05-19 00:06:34.000000000 -0400
1146+++ linux-2.6.39.2/arch/arm/mach-tegra/pcie.c 2011-05-22 19:36:30.000000000 -0400
1147@@ -336,7 +336,7 @@ static int tegra_pcie_write_conf(struct
1148 return PCIBIOS_SUCCESSFUL;
1149 }
1150
1151-static struct pci_ops tegra_pcie_ops = {
1152+static const struct pci_ops tegra_pcie_ops = {
1153 .read = tegra_pcie_read_conf,
1154 .write = tegra_pcie_write_conf,
1155 };
1156diff -urNp linux-2.6.39.2/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.39.2/arch/arm/mach-ux500/mbox-db5500.c
1157--- linux-2.6.39.2/arch/arm/mach-ux500/mbox-db5500.c 2011-05-19 00:06:34.000000000 -0400
1158+++ linux-2.6.39.2/arch/arm/mach-ux500/mbox-db5500.c 2011-05-22 19:41:32.000000000 -0400
1159@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
1160 return sprintf(buf, "0x%X\n", mbox_value);
1161 }
1162
1163-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
1164+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
1165
1166 static int mbox_show(struct seq_file *s, void *data)
1167 {
1168diff -urNp linux-2.6.39.2/arch/arm/mach-versatile/pci.c linux-2.6.39.2/arch/arm/mach-versatile/pci.c
1169--- linux-2.6.39.2/arch/arm/mach-versatile/pci.c 2011-05-19 00:06:34.000000000 -0400
1170+++ linux-2.6.39.2/arch/arm/mach-versatile/pci.c 2011-05-22 19:36:30.000000000 -0400
1171@@ -165,7 +165,7 @@ static int versatile_write_config(struct
1172 return PCIBIOS_SUCCESSFUL;
1173 }
1174
1175-static struct pci_ops pci_versatile_ops = {
1176+static const struct pci_ops pci_versatile_ops = {
1177 .read = versatile_read_config,
1178 .write = versatile_write_config,
1179 };
1180diff -urNp linux-2.6.39.2/arch/arm/mm/fault.c linux-2.6.39.2/arch/arm/mm/fault.c
1181--- linux-2.6.39.2/arch/arm/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1182+++ linux-2.6.39.2/arch/arm/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1183@@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk,
1184 }
1185 #endif
1186
1187+#ifdef CONFIG_PAX_PAGEEXEC
1188+ if (fsr & FSR_LNX_PF) {
1189+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
1190+ do_group_exit(SIGKILL);
1191+ }
1192+#endif
1193+
1194 tsk->thread.address = addr;
1195 tsk->thread.error_code = fsr;
1196 tsk->thread.trap_no = 14;
1197@@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign
1198 }
1199 #endif /* CONFIG_MMU */
1200
1201+#ifdef CONFIG_PAX_PAGEEXEC
1202+void pax_report_insns(void *pc, void *sp)
1203+{
1204+ long i;
1205+
1206+ printk(KERN_ERR "PAX: bytes at PC: ");
1207+ for (i = 0; i < 20; i++) {
1208+ unsigned char c;
1209+ if (get_user(c, (__force unsigned char __user *)pc+i))
1210+ printk(KERN_CONT "?? ");
1211+ else
1212+ printk(KERN_CONT "%02x ", c);
1213+ }
1214+ printk("\n");
1215+
1216+ printk(KERN_ERR "PAX: bytes at SP-4: ");
1217+ for (i = -1; i < 20; i++) {
1218+ unsigned long c;
1219+ if (get_user(c, (__force unsigned long __user *)sp+i))
1220+ printk(KERN_CONT "???????? ");
1221+ else
1222+ printk(KERN_CONT "%08lx ", c);
1223+ }
1224+ printk("\n");
1225+}
1226+#endif
1227+
1228 /*
1229 * First Level Translation Fault Handler
1230 *
1231diff -urNp linux-2.6.39.2/arch/arm/mm/mmap.c linux-2.6.39.2/arch/arm/mm/mmap.c
1232--- linux-2.6.39.2/arch/arm/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
1233+++ linux-2.6.39.2/arch/arm/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
1234@@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp
1235 if (len > TASK_SIZE)
1236 return -ENOMEM;
1237
1238+#ifdef CONFIG_PAX_RANDMMAP
1239+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1240+#endif
1241+
1242 if (addr) {
1243 if (do_align)
1244 addr = COLOUR_ALIGN(addr, pgoff);
1245@@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp
1246 addr = PAGE_ALIGN(addr);
1247
1248 vma = find_vma(mm, addr);
1249- if (TASK_SIZE - len >= addr &&
1250- (!vma || addr + len <= vma->vm_start))
1251+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1252 return addr;
1253 }
1254 if (len > mm->cached_hole_size) {
1255- start_addr = addr = mm->free_area_cache;
1256+ start_addr = addr = mm->free_area_cache;
1257 } else {
1258- start_addr = addr = TASK_UNMAPPED_BASE;
1259- mm->cached_hole_size = 0;
1260+ start_addr = addr = mm->mmap_base;
1261+ mm->cached_hole_size = 0;
1262 }
1263 /* 8 bits of randomness in 20 address space bits */
1264 if ((current->flags & PF_RANDOMIZE) &&
1265@@ -100,14 +103,14 @@ full_search:
1266 * Start a new search - just in case we missed
1267 * some holes.
1268 */
1269- if (start_addr != TASK_UNMAPPED_BASE) {
1270- start_addr = addr = TASK_UNMAPPED_BASE;
1271+ if (start_addr != mm->mmap_base) {
1272+ start_addr = addr = mm->mmap_base;
1273 mm->cached_hole_size = 0;
1274 goto full_search;
1275 }
1276 return -ENOMEM;
1277 }
1278- if (!vma || addr + len <= vma->vm_start) {
1279+ if (check_heap_stack_gap(vma, addr, len)) {
1280 /*
1281 * Remember the place where we stopped the search:
1282 */
1283diff -urNp linux-2.6.39.2/arch/arm/plat-iop/pci.c linux-2.6.39.2/arch/arm/plat-iop/pci.c
1284--- linux-2.6.39.2/arch/arm/plat-iop/pci.c 2011-05-19 00:06:34.000000000 -0400
1285+++ linux-2.6.39.2/arch/arm/plat-iop/pci.c 2011-05-22 19:36:30.000000000 -0400
1286@@ -161,7 +161,7 @@ iop3xx_write_config(struct pci_bus *bus,
1287 return PCIBIOS_SUCCESSFUL;
1288 }
1289
1290-static struct pci_ops iop3xx_ops = {
1291+static const struct pci_ops iop3xx_ops = {
1292 .read = iop3xx_read_config,
1293 .write = iop3xx_write_config,
1294 };
1295diff -urNp linux-2.6.39.2/arch/avr32/include/asm/elf.h linux-2.6.39.2/arch/avr32/include/asm/elf.h
1296--- linux-2.6.39.2/arch/avr32/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1297+++ linux-2.6.39.2/arch/avr32/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1298@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
1299 the loader. We need to make sure that it is out of the way of the program
1300 that it will "exec", and that there is sufficient room for the brk. */
1301
1302-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1303+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1304
1305+#ifdef CONFIG_PAX_ASLR
1306+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1307+
1308+#define PAX_DELTA_MMAP_LEN 15
1309+#define PAX_DELTA_STACK_LEN 15
1310+#endif
1311
1312 /* This yields a mask that user programs can use to figure out what
1313 instruction set this CPU supports. This could be done in user space,
1314diff -urNp linux-2.6.39.2/arch/avr32/include/asm/kmap_types.h linux-2.6.39.2/arch/avr32/include/asm/kmap_types.h
1315--- linux-2.6.39.2/arch/avr32/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1316+++ linux-2.6.39.2/arch/avr32/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1317@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1318 D(11) KM_IRQ1,
1319 D(12) KM_SOFTIRQ0,
1320 D(13) KM_SOFTIRQ1,
1321-D(14) KM_TYPE_NR
1322+D(14) KM_CLEARPAGE,
1323+D(15) KM_TYPE_NR
1324 };
1325
1326 #undef D
1327diff -urNp linux-2.6.39.2/arch/avr32/mm/fault.c linux-2.6.39.2/arch/avr32/mm/fault.c
1328--- linux-2.6.39.2/arch/avr32/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1329+++ linux-2.6.39.2/arch/avr32/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1330@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
1331
1332 int exception_trace = 1;
1333
1334+#ifdef CONFIG_PAX_PAGEEXEC
1335+void pax_report_insns(void *pc, void *sp)
1336+{
1337+ unsigned long i;
1338+
1339+ printk(KERN_ERR "PAX: bytes at PC: ");
1340+ for (i = 0; i < 20; i++) {
1341+ unsigned char c;
1342+ if (get_user(c, (unsigned char *)pc+i))
1343+ printk(KERN_CONT "???????? ");
1344+ else
1345+ printk(KERN_CONT "%02x ", c);
1346+ }
1347+ printk("\n");
1348+}
1349+#endif
1350+
1351 /*
1352 * This routine handles page faults. It determines the address and the
1353 * problem, and then passes it off to one of the appropriate routines.
1354@@ -156,6 +173,16 @@ bad_area:
1355 up_read(&mm->mmap_sem);
1356
1357 if (user_mode(regs)) {
1358+
1359+#ifdef CONFIG_PAX_PAGEEXEC
1360+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1361+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1362+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1363+ do_group_exit(SIGKILL);
1364+ }
1365+ }
1366+#endif
1367+
1368 if (exception_trace && printk_ratelimit())
1369 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1370 "sp %08lx ecr %lu\n",
1371diff -urNp linux-2.6.39.2/arch/blackfin/kernel/kgdb.c linux-2.6.39.2/arch/blackfin/kernel/kgdb.c
1372--- linux-2.6.39.2/arch/blackfin/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1373+++ linux-2.6.39.2/arch/blackfin/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1374@@ -420,7 +420,7 @@ int kgdb_arch_handle_exception(int vecto
1375 return -1; /* this means that we do not want to exit from the handler */
1376 }
1377
1378-struct kgdb_arch arch_kgdb_ops = {
1379+const struct kgdb_arch arch_kgdb_ops = {
1380 .gdb_bpt_instr = {0xa1},
1381 .flags = KGDB_HW_BREAKPOINT,
1382 .set_hw_breakpoint = bfin_set_hw_break,
1383diff -urNp linux-2.6.39.2/arch/blackfin/mm/maccess.c linux-2.6.39.2/arch/blackfin/mm/maccess.c
1384--- linux-2.6.39.2/arch/blackfin/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
1385+++ linux-2.6.39.2/arch/blackfin/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
1386@@ -16,7 +16,7 @@ static int validate_memory_access_addres
1387 return bfin_mem_access_type(addr, size);
1388 }
1389
1390-long probe_kernel_read(void *dst, void *src, size_t size)
1391+long probe_kernel_read(void *dst, const void *src, size_t size)
1392 {
1393 unsigned long lsrc = (unsigned long)src;
1394 int mem_type;
1395@@ -55,7 +55,7 @@ long probe_kernel_read(void *dst, void *
1396 return -EFAULT;
1397 }
1398
1399-long probe_kernel_write(void *dst, void *src, size_t size)
1400+long probe_kernel_write(void *dst, const void *src, size_t size)
1401 {
1402 unsigned long ldst = (unsigned long)dst;
1403 int mem_type;
1404diff -urNp linux-2.6.39.2/arch/frv/include/asm/kmap_types.h linux-2.6.39.2/arch/frv/include/asm/kmap_types.h
1405--- linux-2.6.39.2/arch/frv/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1406+++ linux-2.6.39.2/arch/frv/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1407@@ -23,6 +23,7 @@ enum km_type {
1408 KM_IRQ1,
1409 KM_SOFTIRQ0,
1410 KM_SOFTIRQ1,
1411+ KM_CLEARPAGE,
1412 KM_TYPE_NR
1413 };
1414
1415diff -urNp linux-2.6.39.2/arch/frv/mb93090-mb00/pci-frv.h linux-2.6.39.2/arch/frv/mb93090-mb00/pci-frv.h
1416--- linux-2.6.39.2/arch/frv/mb93090-mb00/pci-frv.h 2011-05-19 00:06:34.000000000 -0400
1417+++ linux-2.6.39.2/arch/frv/mb93090-mb00/pci-frv.h 2011-05-22 19:36:30.000000000 -0400
1418@@ -34,7 +34,7 @@ void pcibios_resource_survey(void);
1419
1420 extern int __nongpreldata pcibios_last_bus;
1421 extern struct pci_bus *__nongpreldata pci_root_bus;
1422-extern struct pci_ops *__nongpreldata pci_root_ops;
1423+extern const struct pci_ops *__nongpreldata pci_root_ops;
1424
1425 /* pci-irq.c */
1426 extern unsigned int pcibios_irq_mask;
1427diff -urNp linux-2.6.39.2/arch/frv/mb93090-mb00/pci-vdk.c linux-2.6.39.2/arch/frv/mb93090-mb00/pci-vdk.c
1428--- linux-2.6.39.2/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-19 00:06:34.000000000 -0400
1429+++ linux-2.6.39.2/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-22 19:36:30.000000000 -0400
1430@@ -27,7 +27,7 @@ unsigned int __nongpreldata pci_probe =
1431
1432 int __nongpreldata pcibios_last_bus = -1;
1433 struct pci_bus *__nongpreldata pci_root_bus;
1434-struct pci_ops *__nongpreldata pci_root_ops;
1435+const struct pci_ops *__nongpreldata pci_root_ops;
1436
1437 /*
1438 * The accessible PCI window does not cover the entire CPU address space, but
1439@@ -169,7 +169,7 @@ static int pci_frv_write_config(struct p
1440 return PCIBIOS_SUCCESSFUL;
1441 }
1442
1443-static struct pci_ops pci_direct_frv = {
1444+static const struct pci_ops pci_direct_frv = {
1445 pci_frv_read_config,
1446 pci_frv_write_config,
1447 };
1448@@ -356,7 +356,7 @@ void __init pcibios_fixup_bus(struct pci
1449
1450 int __init pcibios_init(void)
1451 {
1452- struct pci_ops *dir = NULL;
1453+ const struct pci_ops *dir = NULL;
1454
1455 if (!mb93090_mb00_detected)
1456 return -ENXIO;
1457diff -urNp linux-2.6.39.2/arch/frv/mm/elf-fdpic.c linux-2.6.39.2/arch/frv/mm/elf-fdpic.c
1458--- linux-2.6.39.2/arch/frv/mm/elf-fdpic.c 2011-05-19 00:06:34.000000000 -0400
1459+++ linux-2.6.39.2/arch/frv/mm/elf-fdpic.c 2011-05-22 19:36:30.000000000 -0400
1460@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
1461 if (addr) {
1462 addr = PAGE_ALIGN(addr);
1463 vma = find_vma(current->mm, addr);
1464- if (TASK_SIZE - len >= addr &&
1465- (!vma || addr + len <= vma->vm_start))
1466+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1467 goto success;
1468 }
1469
1470@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
1471 for (; vma; vma = vma->vm_next) {
1472 if (addr > limit)
1473 break;
1474- if (addr + len <= vma->vm_start)
1475+ if (check_heap_stack_gap(vma, addr, len))
1476 goto success;
1477 addr = vma->vm_end;
1478 }
1479@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
1480 for (; vma; vma = vma->vm_next) {
1481 if (addr > limit)
1482 break;
1483- if (addr + len <= vma->vm_start)
1484+ if (check_heap_stack_gap(vma, addr, len))
1485 goto success;
1486 addr = vma->vm_end;
1487 }
1488diff -urNp linux-2.6.39.2/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.39.2/arch/ia64/hp/common/hwsw_iommu.c
1489--- linux-2.6.39.2/arch/ia64/hp/common/hwsw_iommu.c 2011-05-19 00:06:34.000000000 -0400
1490+++ linux-2.6.39.2/arch/ia64/hp/common/hwsw_iommu.c 2011-05-22 19:36:30.000000000 -0400
1491@@ -17,7 +17,7 @@
1492 #include <linux/swiotlb.h>
1493 #include <asm/machvec.h>
1494
1495-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1496+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1497
1498 /* swiotlb declarations & definitions: */
1499 extern int swiotlb_late_init_with_default_size (size_t size);
1500@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
1501 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
1502 }
1503
1504-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1505+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1506 {
1507 if (use_swiotlb(dev))
1508 return &swiotlb_dma_ops;
1509diff -urNp linux-2.6.39.2/arch/ia64/hp/common/sba_iommu.c linux-2.6.39.2/arch/ia64/hp/common/sba_iommu.c
1510--- linux-2.6.39.2/arch/ia64/hp/common/sba_iommu.c 2011-05-19 00:06:34.000000000 -0400
1511+++ linux-2.6.39.2/arch/ia64/hp/common/sba_iommu.c 2011-05-22 19:36:30.000000000 -0400
1512@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
1513 },
1514 };
1515
1516-extern struct dma_map_ops swiotlb_dma_ops;
1517+extern const struct dma_map_ops swiotlb_dma_ops;
1518
1519 static int __init
1520 sba_init(void)
1521@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
1522
1523 __setup("sbapagesize=",sba_page_override);
1524
1525-struct dma_map_ops sba_dma_ops = {
1526+const struct dma_map_ops sba_dma_ops = {
1527 .alloc_coherent = sba_alloc_coherent,
1528 .free_coherent = sba_free_coherent,
1529 .map_page = sba_map_page,
1530diff -urNp linux-2.6.39.2/arch/ia64/include/asm/dma-mapping.h linux-2.6.39.2/arch/ia64/include/asm/dma-mapping.h
1531--- linux-2.6.39.2/arch/ia64/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1532+++ linux-2.6.39.2/arch/ia64/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1533@@ -14,7 +14,7 @@
1534
1535 #define DMA_ERROR_CODE 0
1536
1537-extern struct dma_map_ops *dma_ops;
1538+extern const struct dma_map_ops *dma_ops;
1539 extern struct ia64_machine_vector ia64_mv;
1540 extern void set_iommu_machvec(void);
1541
1542@@ -26,7 +26,7 @@ extern void machvec_dma_sync_sg(struct d
1543 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1544 dma_addr_t *daddr, gfp_t gfp)
1545 {
1546- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1547+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1548 void *caddr;
1549
1550 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
1551@@ -37,7 +37,7 @@ static inline void *dma_alloc_coherent(s
1552 static inline void dma_free_coherent(struct device *dev, size_t size,
1553 void *caddr, dma_addr_t daddr)
1554 {
1555- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1556+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1557 debug_dma_free_coherent(dev, size, caddr, daddr);
1558 ops->free_coherent(dev, size, caddr, daddr);
1559 }
1560@@ -51,13 +51,13 @@ static inline void dma_free_coherent(str
1561
1562 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
1563 {
1564- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1565+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1566 return ops->mapping_error(dev, daddr);
1567 }
1568
1569 static inline int dma_supported(struct device *dev, u64 mask)
1570 {
1571- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1572+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1573 return ops->dma_supported(dev, mask);
1574 }
1575
1576diff -urNp linux-2.6.39.2/arch/ia64/include/asm/elf.h linux-2.6.39.2/arch/ia64/include/asm/elf.h
1577--- linux-2.6.39.2/arch/ia64/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1578+++ linux-2.6.39.2/arch/ia64/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1579@@ -42,6 +42,13 @@
1580 */
1581 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1582
1583+#ifdef CONFIG_PAX_ASLR
1584+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1585+
1586+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1587+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1588+#endif
1589+
1590 #define PT_IA_64_UNWIND 0x70000001
1591
1592 /* IA-64 relocations: */
1593diff -urNp linux-2.6.39.2/arch/ia64/include/asm/machvec.h linux-2.6.39.2/arch/ia64/include/asm/machvec.h
1594--- linux-2.6.39.2/arch/ia64/include/asm/machvec.h 2011-05-19 00:06:34.000000000 -0400
1595+++ linux-2.6.39.2/arch/ia64/include/asm/machvec.h 2011-05-22 19:36:30.000000000 -0400
1596@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1597 /* DMA-mapping interface: */
1598 typedef void ia64_mv_dma_init (void);
1599 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1600-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1601+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1602
1603 /*
1604 * WARNING: The legacy I/O space is _architected_. Platforms are
1605@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1606 # endif /* CONFIG_IA64_GENERIC */
1607
1608 extern void swiotlb_dma_init(void);
1609-extern struct dma_map_ops *dma_get_ops(struct device *);
1610+extern const struct dma_map_ops *dma_get_ops(struct device *);
1611
1612 /*
1613 * Define default versions so we can extend machvec for new platforms without having
1614diff -urNp linux-2.6.39.2/arch/ia64/include/asm/pgtable.h linux-2.6.39.2/arch/ia64/include/asm/pgtable.h
1615--- linux-2.6.39.2/arch/ia64/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
1616+++ linux-2.6.39.2/arch/ia64/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
1617@@ -12,7 +12,7 @@
1618 * David Mosberger-Tang <davidm@hpl.hp.com>
1619 */
1620
1621-
1622+#include <linux/const.h>
1623 #include <asm/mman.h>
1624 #include <asm/page.h>
1625 #include <asm/processor.h>
1626@@ -143,6 +143,17 @@
1627 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1628 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1629 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1630+
1631+#ifdef CONFIG_PAX_PAGEEXEC
1632+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1633+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1634+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1635+#else
1636+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1637+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1638+# define PAGE_COPY_NOEXEC PAGE_COPY
1639+#endif
1640+
1641 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1642 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1643 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1644diff -urNp linux-2.6.39.2/arch/ia64/include/asm/spinlock.h linux-2.6.39.2/arch/ia64/include/asm/spinlock.h
1645--- linux-2.6.39.2/arch/ia64/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
1646+++ linux-2.6.39.2/arch/ia64/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
1647@@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1648 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1649
1650 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1651- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1652+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1653 }
1654
1655 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1656diff -urNp linux-2.6.39.2/arch/ia64/include/asm/uaccess.h linux-2.6.39.2/arch/ia64/include/asm/uaccess.h
1657--- linux-2.6.39.2/arch/ia64/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
1658+++ linux-2.6.39.2/arch/ia64/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
1659@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1660 const void *__cu_from = (from); \
1661 long __cu_len = (n); \
1662 \
1663- if (__access_ok(__cu_to, __cu_len, get_fs())) \
1664+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1665 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1666 __cu_len; \
1667 })
1668@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1669 long __cu_len = (n); \
1670 \
1671 __chk_user_ptr(__cu_from); \
1672- if (__access_ok(__cu_from, __cu_len, get_fs())) \
1673+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1674 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1675 __cu_len; \
1676 })
1677diff -urNp linux-2.6.39.2/arch/ia64/kernel/dma-mapping.c linux-2.6.39.2/arch/ia64/kernel/dma-mapping.c
1678--- linux-2.6.39.2/arch/ia64/kernel/dma-mapping.c 2011-05-19 00:06:34.000000000 -0400
1679+++ linux-2.6.39.2/arch/ia64/kernel/dma-mapping.c 2011-05-22 19:36:30.000000000 -0400
1680@@ -3,7 +3,7 @@
1681 /* Set this to 1 if there is a HW IOMMU in the system */
1682 int iommu_detected __read_mostly;
1683
1684-struct dma_map_ops *dma_ops;
1685+const struct dma_map_ops *dma_ops;
1686 EXPORT_SYMBOL(dma_ops);
1687
1688 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1689@@ -16,7 +16,7 @@ static int __init dma_init(void)
1690 }
1691 fs_initcall(dma_init);
1692
1693-struct dma_map_ops *dma_get_ops(struct device *dev)
1694+const struct dma_map_ops *dma_get_ops(struct device *dev)
1695 {
1696 return dma_ops;
1697 }
1698diff -urNp linux-2.6.39.2/arch/ia64/kernel/module.c linux-2.6.39.2/arch/ia64/kernel/module.c
1699--- linux-2.6.39.2/arch/ia64/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
1700+++ linux-2.6.39.2/arch/ia64/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
1701@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1702 void
1703 module_free (struct module *mod, void *module_region)
1704 {
1705- if (mod && mod->arch.init_unw_table &&
1706- module_region == mod->module_init) {
1707+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1708 unw_remove_unwind_table(mod->arch.init_unw_table);
1709 mod->arch.init_unw_table = NULL;
1710 }
1711@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1712 }
1713
1714 static inline int
1715+in_init_rx (const struct module *mod, uint64_t addr)
1716+{
1717+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1718+}
1719+
1720+static inline int
1721+in_init_rw (const struct module *mod, uint64_t addr)
1722+{
1723+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1724+}
1725+
1726+static inline int
1727 in_init (const struct module *mod, uint64_t addr)
1728 {
1729- return addr - (uint64_t) mod->module_init < mod->init_size;
1730+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1731+}
1732+
1733+static inline int
1734+in_core_rx (const struct module *mod, uint64_t addr)
1735+{
1736+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1737+}
1738+
1739+static inline int
1740+in_core_rw (const struct module *mod, uint64_t addr)
1741+{
1742+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1743 }
1744
1745 static inline int
1746 in_core (const struct module *mod, uint64_t addr)
1747 {
1748- return addr - (uint64_t) mod->module_core < mod->core_size;
1749+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1750 }
1751
1752 static inline int
1753@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1754 break;
1755
1756 case RV_BDREL:
1757- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1758+ if (in_init_rx(mod, val))
1759+ val -= (uint64_t) mod->module_init_rx;
1760+ else if (in_init_rw(mod, val))
1761+ val -= (uint64_t) mod->module_init_rw;
1762+ else if (in_core_rx(mod, val))
1763+ val -= (uint64_t) mod->module_core_rx;
1764+ else if (in_core_rw(mod, val))
1765+ val -= (uint64_t) mod->module_core_rw;
1766 break;
1767
1768 case RV_LTV:
1769@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1770 * addresses have been selected...
1771 */
1772 uint64_t gp;
1773- if (mod->core_size > MAX_LTOFF)
1774+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1775 /*
1776 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1777 * at the end of the module.
1778 */
1779- gp = mod->core_size - MAX_LTOFF / 2;
1780+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1781 else
1782- gp = mod->core_size / 2;
1783- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1784+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1785+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1786 mod->arch.gp = gp;
1787 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1788 }
1789diff -urNp linux-2.6.39.2/arch/ia64/kernel/pci-dma.c linux-2.6.39.2/arch/ia64/kernel/pci-dma.c
1790--- linux-2.6.39.2/arch/ia64/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
1791+++ linux-2.6.39.2/arch/ia64/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
1792@@ -43,7 +43,7 @@ struct device fallback_dev = {
1793 .dma_mask = &fallback_dev.coherent_dma_mask,
1794 };
1795
1796-extern struct dma_map_ops intel_dma_ops;
1797+extern const struct dma_map_ops intel_dma_ops;
1798
1799 static int __init pci_iommu_init(void)
1800 {
1801diff -urNp linux-2.6.39.2/arch/ia64/kernel/pci-swiotlb.c linux-2.6.39.2/arch/ia64/kernel/pci-swiotlb.c
1802--- linux-2.6.39.2/arch/ia64/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
1803+++ linux-2.6.39.2/arch/ia64/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
1804@@ -22,7 +22,7 @@ static void *ia64_swiotlb_alloc_coherent
1805 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1806 }
1807
1808-struct dma_map_ops swiotlb_dma_ops = {
1809+const struct dma_map_ops swiotlb_dma_ops = {
1810 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1811 .free_coherent = swiotlb_free_coherent,
1812 .map_page = swiotlb_map_page,
1813diff -urNp linux-2.6.39.2/arch/ia64/kernel/sys_ia64.c linux-2.6.39.2/arch/ia64/kernel/sys_ia64.c
1814--- linux-2.6.39.2/arch/ia64/kernel/sys_ia64.c 2011-05-19 00:06:34.000000000 -0400
1815+++ linux-2.6.39.2/arch/ia64/kernel/sys_ia64.c 2011-05-22 19:36:30.000000000 -0400
1816@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1817 if (REGION_NUMBER(addr) == RGN_HPAGE)
1818 addr = 0;
1819 #endif
1820+
1821+#ifdef CONFIG_PAX_RANDMMAP
1822+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1823+ addr = mm->free_area_cache;
1824+ else
1825+#endif
1826+
1827 if (!addr)
1828 addr = mm->free_area_cache;
1829
1830@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
1831 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1832 /* At this point: (!vma || addr < vma->vm_end). */
1833 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1834- if (start_addr != TASK_UNMAPPED_BASE) {
1835+ if (start_addr != mm->mmap_base) {
1836 /* Start a new search --- just in case we missed some holes. */
1837- addr = TASK_UNMAPPED_BASE;
1838+ addr = mm->mmap_base;
1839 goto full_search;
1840 }
1841 return -ENOMEM;
1842 }
1843- if (!vma || addr + len <= vma->vm_start) {
1844+ if (check_heap_stack_gap(vma, addr, len)) {
1845 /* Remember the address where we stopped this search: */
1846 mm->free_area_cache = addr + len;
1847 return addr;
1848diff -urNp linux-2.6.39.2/arch/ia64/kernel/vmlinux.lds.S linux-2.6.39.2/arch/ia64/kernel/vmlinux.lds.S
1849--- linux-2.6.39.2/arch/ia64/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
1850+++ linux-2.6.39.2/arch/ia64/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
1851@@ -199,7 +199,7 @@ SECTIONS {
1852 /* Per-cpu data: */
1853 . = ALIGN(PERCPU_PAGE_SIZE);
1854 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1855- __phys_per_cpu_start = __per_cpu_load;
1856+ __phys_per_cpu_start = per_cpu_load;
1857 /*
1858 * ensure percpu data fits
1859 * into percpu page size
1860diff -urNp linux-2.6.39.2/arch/ia64/mm/fault.c linux-2.6.39.2/arch/ia64/mm/fault.c
1861--- linux-2.6.39.2/arch/ia64/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1862+++ linux-2.6.39.2/arch/ia64/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1863@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1864 return pte_present(pte);
1865 }
1866
1867+#ifdef CONFIG_PAX_PAGEEXEC
1868+void pax_report_insns(void *pc, void *sp)
1869+{
1870+ unsigned long i;
1871+
1872+ printk(KERN_ERR "PAX: bytes at PC: ");
1873+ for (i = 0; i < 8; i++) {
1874+ unsigned int c;
1875+ if (get_user(c, (unsigned int *)pc+i))
1876+ printk(KERN_CONT "???????? ");
1877+ else
1878+ printk(KERN_CONT "%08x ", c);
1879+ }
1880+ printk("\n");
1881+}
1882+#endif
1883+
1884 void __kprobes
1885 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1886 {
1887@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1888 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1889 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1890
1891- if ((vma->vm_flags & mask) != mask)
1892+ if ((vma->vm_flags & mask) != mask) {
1893+
1894+#ifdef CONFIG_PAX_PAGEEXEC
1895+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1896+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1897+ goto bad_area;
1898+
1899+ up_read(&mm->mmap_sem);
1900+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1901+ do_group_exit(SIGKILL);
1902+ }
1903+#endif
1904+
1905 goto bad_area;
1906
1907+ }
1908+
1909 /*
1910 * If for any reason at all we couldn't handle the fault, make
1911 * sure we exit gracefully rather than endlessly redo the
1912diff -urNp linux-2.6.39.2/arch/ia64/mm/hugetlbpage.c linux-2.6.39.2/arch/ia64/mm/hugetlbpage.c
1913--- linux-2.6.39.2/arch/ia64/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
1914+++ linux-2.6.39.2/arch/ia64/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
1915@@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
1916 /* At this point: (!vmm || addr < vmm->vm_end). */
1917 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1918 return -ENOMEM;
1919- if (!vmm || (addr + len) <= vmm->vm_start)
1920+ if (check_heap_stack_gap(vmm, addr, len))
1921 return addr;
1922 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1923 }
1924diff -urNp linux-2.6.39.2/arch/ia64/mm/init.c linux-2.6.39.2/arch/ia64/mm/init.c
1925--- linux-2.6.39.2/arch/ia64/mm/init.c 2011-05-19 00:06:34.000000000 -0400
1926+++ linux-2.6.39.2/arch/ia64/mm/init.c 2011-05-22 19:36:30.000000000 -0400
1927@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1928 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1929 vma->vm_end = vma->vm_start + PAGE_SIZE;
1930 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1931+
1932+#ifdef CONFIG_PAX_PAGEEXEC
1933+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1934+ vma->vm_flags &= ~VM_EXEC;
1935+
1936+#ifdef CONFIG_PAX_MPROTECT
1937+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1938+ vma->vm_flags &= ~VM_MAYEXEC;
1939+#endif
1940+
1941+ }
1942+#endif
1943+
1944 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1945 down_write(&current->mm->mmap_sem);
1946 if (insert_vm_struct(current->mm, vma)) {
1947diff -urNp linux-2.6.39.2/arch/ia64/pci/pci.c linux-2.6.39.2/arch/ia64/pci/pci.c
1948--- linux-2.6.39.2/arch/ia64/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
1949+++ linux-2.6.39.2/arch/ia64/pci/pci.c 2011-05-22 19:36:30.000000000 -0400
1950@@ -109,7 +109,7 @@ static int pci_write(struct pci_bus *bus
1951 devfn, where, size, value);
1952 }
1953
1954-struct pci_ops pci_root_ops = {
1955+const struct pci_ops pci_root_ops = {
1956 .read = pci_read,
1957 .write = pci_write,
1958 };
1959diff -urNp linux-2.6.39.2/arch/ia64/sn/pci/pci_dma.c linux-2.6.39.2/arch/ia64/sn/pci/pci_dma.c
1960--- linux-2.6.39.2/arch/ia64/sn/pci/pci_dma.c 2011-05-19 00:06:34.000000000 -0400
1961+++ linux-2.6.39.2/arch/ia64/sn/pci/pci_dma.c 2011-05-22 19:36:30.000000000 -0400
1962@@ -465,7 +465,7 @@ int sn_pci_legacy_write(struct pci_bus *
1963 return ret;
1964 }
1965
1966-static struct dma_map_ops sn_dma_ops = {
1967+static const struct dma_map_ops sn_dma_ops = {
1968 .alloc_coherent = sn_dma_alloc_coherent,
1969 .free_coherent = sn_dma_free_coherent,
1970 .map_page = sn_dma_map_page,
1971diff -urNp linux-2.6.39.2/arch/m32r/lib/usercopy.c linux-2.6.39.2/arch/m32r/lib/usercopy.c
1972--- linux-2.6.39.2/arch/m32r/lib/usercopy.c 2011-05-19 00:06:34.000000000 -0400
1973+++ linux-2.6.39.2/arch/m32r/lib/usercopy.c 2011-05-22 19:36:30.000000000 -0400
1974@@ -14,6 +14,9 @@
1975 unsigned long
1976 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1977 {
1978+ if ((long)n < 0)
1979+ return n;
1980+
1981 prefetch(from);
1982 if (access_ok(VERIFY_WRITE, to, n))
1983 __copy_user(to,from,n);
1984@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1985 unsigned long
1986 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1987 {
1988+ if ((long)n < 0)
1989+ return n;
1990+
1991 prefetchw(to);
1992 if (access_ok(VERIFY_READ, from, n))
1993 __copy_user_zeroing(to,from,n);
1994diff -urNp linux-2.6.39.2/arch/microblaze/include/asm/device.h linux-2.6.39.2/arch/microblaze/include/asm/device.h
1995--- linux-2.6.39.2/arch/microblaze/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1996+++ linux-2.6.39.2/arch/microblaze/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
1997@@ -13,7 +13,7 @@ struct device_node;
1998
1999 struct dev_archdata {
2000 /* DMA operations on that device */
2001- struct dma_map_ops *dma_ops;
2002+ const struct dma_map_ops *dma_ops;
2003 void *dma_data;
2004 };
2005
2006diff -urNp linux-2.6.39.2/arch/microblaze/include/asm/dma-mapping.h linux-2.6.39.2/arch/microblaze/include/asm/dma-mapping.h
2007--- linux-2.6.39.2/arch/microblaze/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
2008+++ linux-2.6.39.2/arch/microblaze/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
2009@@ -43,14 +43,14 @@ static inline unsigned long device_to_ma
2010 return 0xfffffffful;
2011 }
2012
2013-extern struct dma_map_ops *dma_ops;
2014+extern const struct dma_map_ops *dma_ops;
2015
2016 /*
2017 * Available generic sets of operations
2018 */
2019-extern struct dma_map_ops dma_direct_ops;
2020+extern const struct dma_map_ops dma_direct_ops;
2021
2022-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
2023+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2024 {
2025 /* We don't handle the NULL dev case for ISA for now. We could
2026 * do it via an out of line call but it is not needed for now. The
2027@@ -63,14 +63,14 @@ static inline struct dma_map_ops *get_dm
2028 return dev->archdata.dma_ops;
2029 }
2030
2031-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
2032+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
2033 {
2034 dev->archdata.dma_ops = ops;
2035 }
2036
2037 static inline int dma_supported(struct device *dev, u64 mask)
2038 {
2039- struct dma_map_ops *ops = get_dma_ops(dev);
2040+ const struct dma_map_ops *ops = get_dma_ops(dev);
2041
2042 if (unlikely(!ops))
2043 return 0;
2044@@ -81,7 +81,7 @@ static inline int dma_supported(struct d
2045
2046 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
2047 {
2048- struct dma_map_ops *ops = get_dma_ops(dev);
2049+ const struct dma_map_ops *ops = get_dma_ops(dev);
2050
2051 if (unlikely(ops == NULL))
2052 return -EIO;
2053@@ -97,7 +97,7 @@ static inline int dma_set_mask(struct de
2054
2055 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
2056 {
2057- struct dma_map_ops *ops = get_dma_ops(dev);
2058+ const struct dma_map_ops *ops = get_dma_ops(dev);
2059 if (ops->mapping_error)
2060 return ops->mapping_error(dev, dma_addr);
2061
2062@@ -110,7 +110,7 @@ static inline int dma_mapping_error(stru
2063 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
2064 dma_addr_t *dma_handle, gfp_t flag)
2065 {
2066- struct dma_map_ops *ops = get_dma_ops(dev);
2067+ const struct dma_map_ops *ops = get_dma_ops(dev);
2068 void *memory;
2069
2070 BUG_ON(!ops);
2071@@ -124,7 +124,7 @@ static inline void *dma_alloc_coherent(s
2072 static inline void dma_free_coherent(struct device *dev, size_t size,
2073 void *cpu_addr, dma_addr_t dma_handle)
2074 {
2075- struct dma_map_ops *ops = get_dma_ops(dev);
2076+ const struct dma_map_ops *ops = get_dma_ops(dev);
2077
2078 BUG_ON(!ops);
2079 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
2080diff -urNp linux-2.6.39.2/arch/microblaze/include/asm/pci.h linux-2.6.39.2/arch/microblaze/include/asm/pci.h
2081--- linux-2.6.39.2/arch/microblaze/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
2082+++ linux-2.6.39.2/arch/microblaze/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
2083@@ -54,8 +54,8 @@ static inline void pcibios_penalize_isa_
2084 }
2085
2086 #ifdef CONFIG_PCI
2087-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
2088-extern struct dma_map_ops *get_pci_dma_ops(void);
2089+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
2090+extern const struct dma_map_ops *get_pci_dma_ops(void);
2091 #else /* CONFIG_PCI */
2092 #define set_pci_dma_ops(d)
2093 #define get_pci_dma_ops() NULL
2094diff -urNp linux-2.6.39.2/arch/microblaze/kernel/dma.c linux-2.6.39.2/arch/microblaze/kernel/dma.c
2095--- linux-2.6.39.2/arch/microblaze/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
2096+++ linux-2.6.39.2/arch/microblaze/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
2097@@ -134,7 +134,7 @@ static inline void dma_direct_unmap_page
2098 __dma_sync_page(dma_address, 0 , size, direction);
2099 }
2100
2101-struct dma_map_ops dma_direct_ops = {
2102+const struct dma_map_ops dma_direct_ops = {
2103 .alloc_coherent = dma_direct_alloc_coherent,
2104 .free_coherent = dma_direct_free_coherent,
2105 .map_sg = dma_direct_map_sg,
2106diff -urNp linux-2.6.39.2/arch/microblaze/kernel/kgdb.c linux-2.6.39.2/arch/microblaze/kernel/kgdb.c
2107--- linux-2.6.39.2/arch/microblaze/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
2108+++ linux-2.6.39.2/arch/microblaze/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
2109@@ -141,7 +141,7 @@ void kgdb_arch_exit(void)
2110 /*
2111 * Global data
2112 */
2113-struct kgdb_arch arch_kgdb_ops = {
2114+const struct kgdb_arch arch_kgdb_ops = {
2115 #ifdef __MICROBLAZEEL__
2116 .gdb_bpt_instr = {0x18, 0x00, 0x0c, 0xba}, /* brki r16, 0x18 */
2117 #else
2118diff -urNp linux-2.6.39.2/arch/microblaze/pci/indirect_pci.c linux-2.6.39.2/arch/microblaze/pci/indirect_pci.c
2119--- linux-2.6.39.2/arch/microblaze/pci/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
2120+++ linux-2.6.39.2/arch/microblaze/pci/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
2121@@ -140,7 +140,7 @@ indirect_write_config(struct pci_bus *bu
2122 return PCIBIOS_SUCCESSFUL;
2123 }
2124
2125-static struct pci_ops indirect_pci_ops = {
2126+static const struct pci_ops indirect_pci_ops = {
2127 .read = indirect_read_config,
2128 .write = indirect_write_config,
2129 };
2130diff -urNp linux-2.6.39.2/arch/microblaze/pci/pci-common.c linux-2.6.39.2/arch/microblaze/pci/pci-common.c
2131--- linux-2.6.39.2/arch/microblaze/pci/pci-common.c 2011-05-19 00:06:34.000000000 -0400
2132+++ linux-2.6.39.2/arch/microblaze/pci/pci-common.c 2011-05-22 19:36:30.000000000 -0400
2133@@ -48,14 +48,14 @@ resource_size_t isa_mem_base;
2134 /* Default PCI flags is 0 on ppc32, modified at boot on ppc64 */
2135 unsigned int pci_flags;
2136
2137-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2138+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2139
2140-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
2141+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
2142 {
2143 pci_dma_ops = dma_ops;
2144 }
2145
2146-struct dma_map_ops *get_pci_dma_ops(void)
2147+const struct dma_map_ops *get_pci_dma_ops(void)
2148 {
2149 return pci_dma_ops;
2150 }
2151@@ -1583,7 +1583,7 @@ null_write_config(struct pci_bus *bus, u
2152 return PCIBIOS_DEVICE_NOT_FOUND;
2153 }
2154
2155-static struct pci_ops null_pci_ops = {
2156+static const struct pci_ops null_pci_ops = {
2157 .read = null_read_config,
2158 .write = null_write_config,
2159 };
2160diff -urNp linux-2.6.39.2/arch/mips/alchemy/common/pci.c linux-2.6.39.2/arch/mips/alchemy/common/pci.c
2161--- linux-2.6.39.2/arch/mips/alchemy/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2162+++ linux-2.6.39.2/arch/mips/alchemy/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2163@@ -51,7 +51,7 @@ static struct resource pci_mem_resource
2164 .flags = IORESOURCE_MEM
2165 };
2166
2167-extern struct pci_ops au1x_pci_ops;
2168+extern const struct pci_ops au1x_pci_ops;
2169
2170 static struct pci_controller au1x_controller = {
2171 .pci_ops = &au1x_pci_ops,
2172diff -urNp linux-2.6.39.2/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.39.2/arch/mips/cavium-octeon/dma-octeon.c
2173--- linux-2.6.39.2/arch/mips/cavium-octeon/dma-octeon.c 2011-05-19 00:06:34.000000000 -0400
2174+++ linux-2.6.39.2/arch/mips/cavium-octeon/dma-octeon.c 2011-05-22 19:36:30.000000000 -0400
2175@@ -202,7 +202,7 @@ static phys_addr_t octeon_unity_dma_to_p
2176 }
2177
2178 struct octeon_dma_map_ops {
2179- struct dma_map_ops dma_map_ops;
2180+ const struct dma_map_ops dma_map_ops;
2181 dma_addr_t (*phys_to_dma)(struct device *dev, phys_addr_t paddr);
2182 phys_addr_t (*dma_to_phys)(struct device *dev, dma_addr_t daddr);
2183 };
2184@@ -324,7 +324,7 @@ static struct octeon_dma_map_ops _octeon
2185 },
2186 };
2187
2188-struct dma_map_ops *octeon_pci_dma_map_ops;
2189+const struct dma_map_ops *octeon_pci_dma_map_ops;
2190
2191 void __init octeon_pci_dma_init(void)
2192 {
2193diff -urNp linux-2.6.39.2/arch/mips/cobalt/pci.c linux-2.6.39.2/arch/mips/cobalt/pci.c
2194--- linux-2.6.39.2/arch/mips/cobalt/pci.c 2011-05-19 00:06:34.000000000 -0400
2195+++ linux-2.6.39.2/arch/mips/cobalt/pci.c 2011-05-22 19:36:30.000000000 -0400
2196@@ -14,7 +14,7 @@
2197
2198 #include <asm/gt64120.h>
2199
2200-extern struct pci_ops gt64xxx_pci0_ops;
2201+extern const struct pci_ops gt64xxx_pci0_ops;
2202
2203 static struct resource cobalt_mem_resource = {
2204 .start = GT_DEF_PCI0_MEM0_BASE,
2205diff -urNp linux-2.6.39.2/arch/mips/include/asm/device.h linux-2.6.39.2/arch/mips/include/asm/device.h
2206--- linux-2.6.39.2/arch/mips/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
2207+++ linux-2.6.39.2/arch/mips/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
2208@@ -10,7 +10,7 @@ struct dma_map_ops;
2209
2210 struct dev_archdata {
2211 /* DMA operations on that device */
2212- struct dma_map_ops *dma_ops;
2213+ const struct dma_map_ops *dma_ops;
2214 };
2215
2216 struct pdev_archdata {
2217diff -urNp linux-2.6.39.2/arch/mips/include/asm/dma-mapping.h linux-2.6.39.2/arch/mips/include/asm/dma-mapping.h
2218--- linux-2.6.39.2/arch/mips/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
2219+++ linux-2.6.39.2/arch/mips/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
2220@@ -9,9 +9,9 @@
2221 #include <dma-coherence.h>
2222 #endif
2223
2224-extern struct dma_map_ops *mips_dma_map_ops;
2225+extern const struct dma_map_ops *mips_dma_map_ops;
2226
2227-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
2228+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2229 {
2230 if (dev && dev->archdata.dma_ops)
2231 return dev->archdata.dma_ops;
2232@@ -33,13 +33,13 @@ static inline void dma_mark_clean(void *
2233
2234 static inline int dma_supported(struct device *dev, u64 mask)
2235 {
2236- struct dma_map_ops *ops = get_dma_ops(dev);
2237+ const struct dma_map_ops *ops = get_dma_ops(dev);
2238 return ops->dma_supported(dev, mask);
2239 }
2240
2241 static inline int dma_mapping_error(struct device *dev, u64 mask)
2242 {
2243- struct dma_map_ops *ops = get_dma_ops(dev);
2244+ const struct dma_map_ops *ops = get_dma_ops(dev);
2245 return ops->mapping_error(dev, mask);
2246 }
2247
2248@@ -61,7 +61,7 @@ static inline void *dma_alloc_coherent(s
2249 dma_addr_t *dma_handle, gfp_t gfp)
2250 {
2251 void *ret;
2252- struct dma_map_ops *ops = get_dma_ops(dev);
2253+ const struct dma_map_ops *ops = get_dma_ops(dev);
2254
2255 ret = ops->alloc_coherent(dev, size, dma_handle, gfp);
2256
2257@@ -73,7 +73,7 @@ static inline void *dma_alloc_coherent(s
2258 static inline void dma_free_coherent(struct device *dev, size_t size,
2259 void *vaddr, dma_addr_t dma_handle)
2260 {
2261- struct dma_map_ops *ops = get_dma_ops(dev);
2262+ const struct dma_map_ops *ops = get_dma_ops(dev);
2263
2264 ops->free_coherent(dev, size, vaddr, dma_handle);
2265
2266diff -urNp linux-2.6.39.2/arch/mips/include/asm/elf.h linux-2.6.39.2/arch/mips/include/asm/elf.h
2267--- linux-2.6.39.2/arch/mips/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2268+++ linux-2.6.39.2/arch/mips/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
2269@@ -372,13 +372,16 @@ extern const char *__elf_platform;
2270 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
2271 #endif
2272
2273+#ifdef CONFIG_PAX_ASLR
2274+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2275+
2276+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2277+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2278+#endif
2279+
2280 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2281 struct linux_binprm;
2282 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2283 int uses_interp);
2284
2285-struct mm_struct;
2286-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2287-#define arch_randomize_brk arch_randomize_brk
2288-
2289 #endif /* _ASM_ELF_H */
2290diff -urNp linux-2.6.39.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h linux-2.6.39.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h
2291--- linux-2.6.39.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-19 00:06:34.000000000 -0400
2292+++ linux-2.6.39.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-22 19:36:30.000000000 -0400
2293@@ -66,7 +66,7 @@ dma_addr_t phys_to_dma(struct device *de
2294 phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr);
2295
2296 struct dma_map_ops;
2297-extern struct dma_map_ops *octeon_pci_dma_map_ops;
2298+extern const struct dma_map_ops *octeon_pci_dma_map_ops;
2299 extern char *octeon_swiotlb;
2300
2301 #endif /* __ASM_MACH_CAVIUM_OCTEON_DMA_COHERENCE_H */
2302diff -urNp linux-2.6.39.2/arch/mips/include/asm/page.h linux-2.6.39.2/arch/mips/include/asm/page.h
2303--- linux-2.6.39.2/arch/mips/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
2304+++ linux-2.6.39.2/arch/mips/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
2305@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
2306 #ifdef CONFIG_CPU_MIPS32
2307 typedef struct { unsigned long pte_low, pte_high; } pte_t;
2308 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
2309- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
2310+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
2311 #else
2312 typedef struct { unsigned long long pte; } pte_t;
2313 #define pte_val(x) ((x).pte)
2314diff -urNp linux-2.6.39.2/arch/mips/include/asm/pci/bridge.h linux-2.6.39.2/arch/mips/include/asm/pci/bridge.h
2315--- linux-2.6.39.2/arch/mips/include/asm/pci/bridge.h 2011-05-19 00:06:34.000000000 -0400
2316+++ linux-2.6.39.2/arch/mips/include/asm/pci/bridge.h 2011-05-22 19:36:30.000000000 -0400
2317@@ -849,6 +849,6 @@ struct bridge_controller {
2318 extern void register_bridge_irq(unsigned int irq);
2319 extern int request_bridge_irq(struct bridge_controller *bc);
2320
2321-extern struct pci_ops bridge_pci_ops;
2322+extern const struct pci_ops bridge_pci_ops;
2323
2324 #endif /* _ASM_PCI_BRIDGE_H */
2325diff -urNp linux-2.6.39.2/arch/mips/include/asm/system.h linux-2.6.39.2/arch/mips/include/asm/system.h
2326--- linux-2.6.39.2/arch/mips/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
2327+++ linux-2.6.39.2/arch/mips/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
2328@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
2329 */
2330 #define __ARCH_WANT_UNLOCKED_CTXSW
2331
2332-extern unsigned long arch_align_stack(unsigned long sp);
2333+#define arch_align_stack(x) ((x) & ~0xfUL)
2334
2335 #endif /* _ASM_SYSTEM_H */
2336diff -urNp linux-2.6.39.2/arch/mips/kernel/binfmt_elfn32.c linux-2.6.39.2/arch/mips/kernel/binfmt_elfn32.c
2337--- linux-2.6.39.2/arch/mips/kernel/binfmt_elfn32.c 2011-05-19 00:06:34.000000000 -0400
2338+++ linux-2.6.39.2/arch/mips/kernel/binfmt_elfn32.c 2011-05-22 19:36:30.000000000 -0400
2339@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2340 #undef ELF_ET_DYN_BASE
2341 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2342
2343+#ifdef CONFIG_PAX_ASLR
2344+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2345+
2346+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2347+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2348+#endif
2349+
2350 #include <asm/processor.h>
2351 #include <linux/module.h>
2352 #include <linux/elfcore.h>
2353diff -urNp linux-2.6.39.2/arch/mips/kernel/binfmt_elfo32.c linux-2.6.39.2/arch/mips/kernel/binfmt_elfo32.c
2354--- linux-2.6.39.2/arch/mips/kernel/binfmt_elfo32.c 2011-05-19 00:06:34.000000000 -0400
2355+++ linux-2.6.39.2/arch/mips/kernel/binfmt_elfo32.c 2011-05-22 19:36:30.000000000 -0400
2356@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2357 #undef ELF_ET_DYN_BASE
2358 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2359
2360+#ifdef CONFIG_PAX_ASLR
2361+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2362+
2363+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2364+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2365+#endif
2366+
2367 #include <asm/processor.h>
2368
2369 /*
2370diff -urNp linux-2.6.39.2/arch/mips/kernel/kgdb.c linux-2.6.39.2/arch/mips/kernel/kgdb.c
2371--- linux-2.6.39.2/arch/mips/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
2372+++ linux-2.6.39.2/arch/mips/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
2373@@ -351,7 +351,7 @@ int kgdb_arch_handle_exception(int vecto
2374 return -1;
2375 }
2376
2377-struct kgdb_arch arch_kgdb_ops;
2378+struct kgdb_arch arch_kgdb_ops; /* cannot be const, see kgdb_arch_init */
2379
2380 /*
2381 * We use kgdb_early_setup so that functions we need to call now don't
2382diff -urNp linux-2.6.39.2/arch/mips/kernel/process.c linux-2.6.39.2/arch/mips/kernel/process.c
2383--- linux-2.6.39.2/arch/mips/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
2384+++ linux-2.6.39.2/arch/mips/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
2385@@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
2386 out:
2387 return pc;
2388 }
2389-
2390-/*
2391- * Don't forget that the stack pointer must be aligned on a 8 bytes
2392- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
2393- */
2394-unsigned long arch_align_stack(unsigned long sp)
2395-{
2396- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2397- sp -= get_random_int() & ~PAGE_MASK;
2398-
2399- return sp & ALMASK;
2400-}
2401diff -urNp linux-2.6.39.2/arch/mips/kernel/syscall.c linux-2.6.39.2/arch/mips/kernel/syscall.c
2402--- linux-2.6.39.2/arch/mips/kernel/syscall.c 2011-05-19 00:06:34.000000000 -0400
2403+++ linux-2.6.39.2/arch/mips/kernel/syscall.c 2011-05-22 19:36:30.000000000 -0400
2404@@ -108,14 +108,18 @@ unsigned long arch_get_unmapped_area(str
2405 do_color_align = 0;
2406 if (filp || (flags & MAP_SHARED))
2407 do_color_align = 1;
2408+
2409+#ifdef CONFIG_PAX_RANDMMAP
2410+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
2411+#endif
2412+
2413 if (addr) {
2414 if (do_color_align)
2415 addr = COLOUR_ALIGN(addr, pgoff);
2416 else
2417 addr = PAGE_ALIGN(addr);
2418 vmm = find_vma(current->mm, addr);
2419- if (task_size - len >= addr &&
2420- (!vmm || addr + len <= vmm->vm_start))
2421+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
2422 return addr;
2423 }
2424 addr = current->mm->mmap_base;
2425@@ -128,7 +132,7 @@ unsigned long arch_get_unmapped_area(str
2426 /* At this point: (!vmm || addr < vmm->vm_end). */
2427 if (task_size - len < addr)
2428 return -ENOMEM;
2429- if (!vmm || addr + len <= vmm->vm_start)
2430+ if (check_heap_stack_gap(vmm, addr, len))
2431 return addr;
2432 addr = vmm->vm_end;
2433 if (do_color_align)
2434@@ -154,33 +158,6 @@ void arch_pick_mmap_layout(struct mm_str
2435 mm->unmap_area = arch_unmap_area;
2436 }
2437
2438-static inline unsigned long brk_rnd(void)
2439-{
2440- unsigned long rnd = get_random_int();
2441-
2442- rnd = rnd << PAGE_SHIFT;
2443- /* 8MB for 32bit, 256MB for 64bit */
2444- if (TASK_IS_32BIT_ADDR)
2445- rnd = rnd & 0x7ffffful;
2446- else
2447- rnd = rnd & 0xffffffful;
2448-
2449- return rnd;
2450-}
2451-
2452-unsigned long arch_randomize_brk(struct mm_struct *mm)
2453-{
2454- unsigned long base = mm->brk;
2455- unsigned long ret;
2456-
2457- ret = PAGE_ALIGN(base + brk_rnd());
2458-
2459- if (ret < mm->brk)
2460- return mm->brk;
2461-
2462- return ret;
2463-}
2464-
2465 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
2466 unsigned long, prot, unsigned long, flags, unsigned long,
2467 fd, off_t, offset)
2468diff -urNp linux-2.6.39.2/arch/mips/mm/dma-default.c linux-2.6.39.2/arch/mips/mm/dma-default.c
2469--- linux-2.6.39.2/arch/mips/mm/dma-default.c 2011-05-19 00:06:34.000000000 -0400
2470+++ linux-2.6.39.2/arch/mips/mm/dma-default.c 2011-05-22 19:36:30.000000000 -0400
2471@@ -300,7 +300,7 @@ void dma_cache_sync(struct device *dev,
2472
2473 EXPORT_SYMBOL(dma_cache_sync);
2474
2475-static struct dma_map_ops mips_default_dma_map_ops = {
2476+static const struct dma_map_ops mips_default_dma_map_ops = {
2477 .alloc_coherent = mips_dma_alloc_coherent,
2478 .free_coherent = mips_dma_free_coherent,
2479 .map_page = mips_dma_map_page,
2480@@ -315,7 +315,7 @@ static struct dma_map_ops mips_default_d
2481 .dma_supported = mips_dma_supported
2482 };
2483
2484-struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2485+const struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2486 EXPORT_SYMBOL(mips_dma_map_ops);
2487
2488 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
2489diff -urNp linux-2.6.39.2/arch/mips/mm/fault.c linux-2.6.39.2/arch/mips/mm/fault.c
2490--- linux-2.6.39.2/arch/mips/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
2491+++ linux-2.6.39.2/arch/mips/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
2492@@ -28,6 +28,23 @@
2493 #include <asm/highmem.h> /* For VMALLOC_END */
2494 #include <linux/kdebug.h>
2495
2496+#ifdef CONFIG_PAX_PAGEEXEC
2497+void pax_report_insns(void *pc, void *sp)
2498+{
2499+ unsigned long i;
2500+
2501+ printk(KERN_ERR "PAX: bytes at PC: ");
2502+ for (i = 0; i < 5; i++) {
2503+ unsigned int c;
2504+ if (get_user(c, (unsigned int *)pc+i))
2505+ printk(KERN_CONT "???????? ");
2506+ else
2507+ printk(KERN_CONT "%08x ", c);
2508+ }
2509+ printk("\n");
2510+}
2511+#endif
2512+
2513 /*
2514 * This routine handles page faults. It determines the address,
2515 * and the problem, and then passes it off to one of the appropriate
2516diff -urNp linux-2.6.39.2/arch/mips/mti-malta/malta-pci.c linux-2.6.39.2/arch/mips/mti-malta/malta-pci.c
2517--- linux-2.6.39.2/arch/mips/mti-malta/malta-pci.c 2011-05-19 00:06:34.000000000 -0400
2518+++ linux-2.6.39.2/arch/mips/mti-malta/malta-pci.c 2011-05-22 19:36:30.000000000 -0400
2519@@ -64,9 +64,9 @@ static struct resource msc_io_resource =
2520 .flags = IORESOURCE_IO,
2521 };
2522
2523-extern struct pci_ops bonito64_pci_ops;
2524-extern struct pci_ops gt64xxx_pci0_ops;
2525-extern struct pci_ops msc_pci_ops;
2526+extern const struct pci_ops bonito64_pci_ops;
2527+extern const struct pci_ops gt64xxx_pci0_ops;
2528+extern const struct pci_ops msc_pci_ops;
2529
2530 static struct pci_controller bonito64_controller = {
2531 .pci_ops = &bonito64_pci_ops,
2532diff -urNp linux-2.6.39.2/arch/mips/nxp/pnx8550/common/pci.c linux-2.6.39.2/arch/mips/nxp/pnx8550/common/pci.c
2533--- linux-2.6.39.2/arch/mips/nxp/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2534+++ linux-2.6.39.2/arch/mips/nxp/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2535@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2536 .flags = IORESOURCE_MEM
2537 };
2538
2539-extern struct pci_ops pnx8550_pci_ops;
2540+extern const struct pci_ops pnx8550_pci_ops;
2541
2542 static struct pci_controller pnx8550_controller = {
2543 .pci_ops = &pnx8550_pci_ops,
2544diff -urNp linux-2.6.39.2/arch/mips/pci/ops-au1000.c linux-2.6.39.2/arch/mips/pci/ops-au1000.c
2545--- linux-2.6.39.2/arch/mips/pci/ops-au1000.c 2011-05-19 00:06:34.000000000 -0400
2546+++ linux-2.6.39.2/arch/mips/pci/ops-au1000.c 2011-05-22 19:36:30.000000000 -0400
2547@@ -302,7 +302,7 @@ static int config_write(struct pci_bus *
2548 }
2549 }
2550
2551-struct pci_ops au1x_pci_ops = {
2552+const struct pci_ops au1x_pci_ops = {
2553 config_read,
2554 config_write
2555 };
2556diff -urNp linux-2.6.39.2/arch/mips/pci/ops-bcm63xx.c linux-2.6.39.2/arch/mips/pci/ops-bcm63xx.c
2557--- linux-2.6.39.2/arch/mips/pci/ops-bcm63xx.c 2011-05-19 00:06:34.000000000 -0400
2558+++ linux-2.6.39.2/arch/mips/pci/ops-bcm63xx.c 2011-05-22 19:36:30.000000000 -0400
2559@@ -173,7 +173,7 @@ static int bcm63xx_pci_write(struct pci_
2560 where, size, val);
2561 }
2562
2563-struct pci_ops bcm63xx_pci_ops = {
2564+const struct pci_ops bcm63xx_pci_ops = {
2565 .read = bcm63xx_pci_read,
2566 .write = bcm63xx_pci_write
2567 };
2568@@ -402,7 +402,7 @@ static int bcm63xx_cb_write(struct pci_b
2569 return PCIBIOS_DEVICE_NOT_FOUND;
2570 }
2571
2572-struct pci_ops bcm63xx_cb_ops = {
2573+const struct pci_ops bcm63xx_cb_ops = {
2574 .read = bcm63xx_cb_read,
2575 .write = bcm63xx_cb_write,
2576 };
2577diff -urNp linux-2.6.39.2/arch/mips/pci/ops-bonito64.c linux-2.6.39.2/arch/mips/pci/ops-bonito64.c
2578--- linux-2.6.39.2/arch/mips/pci/ops-bonito64.c 2011-05-19 00:06:34.000000000 -0400
2579+++ linux-2.6.39.2/arch/mips/pci/ops-bonito64.c 2011-05-22 19:36:30.000000000 -0400
2580@@ -155,7 +155,7 @@ static int bonito64_pcibios_write(struct
2581 return PCIBIOS_SUCCESSFUL;
2582 }
2583
2584-struct pci_ops bonito64_pci_ops = {
2585+const struct pci_ops bonito64_pci_ops = {
2586 .read = bonito64_pcibios_read,
2587 .write = bonito64_pcibios_write
2588 };
2589diff -urNp linux-2.6.39.2/arch/mips/pci/ops-bridge.c linux-2.6.39.2/arch/mips/pci/ops-bridge.c
2590--- linux-2.6.39.2/arch/mips/pci/ops-bridge.c 2011-05-19 00:06:34.000000000 -0400
2591+++ linux-2.6.39.2/arch/mips/pci/ops-bridge.c 2011-05-22 19:36:30.000000000 -0400
2592@@ -316,7 +316,7 @@ static int pci_write_config(struct pci_b
2593 return pci_conf0_write_config(bus, devfn, where, size, value);
2594 }
2595
2596-struct pci_ops bridge_pci_ops = {
2597+const struct pci_ops bridge_pci_ops = {
2598 .read = pci_read_config,
2599 .write = pci_write_config,
2600 };
2601diff -urNp linux-2.6.39.2/arch/mips/pci/ops-emma2rh.c linux-2.6.39.2/arch/mips/pci/ops-emma2rh.c
2602--- linux-2.6.39.2/arch/mips/pci/ops-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2603+++ linux-2.6.39.2/arch/mips/pci/ops-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2604@@ -176,7 +176,7 @@ static int pci_config_write(struct pci_b
2605 return PCIBIOS_SUCCESSFUL;
2606 }
2607
2608-struct pci_ops emma2rh_pci_ops = {
2609+const struct pci_ops emma2rh_pci_ops = {
2610 .read = pci_config_read,
2611 .write = pci_config_write,
2612 };
2613diff -urNp linux-2.6.39.2/arch/mips/pci/ops-gt64xxx_pci0.c linux-2.6.39.2/arch/mips/pci/ops-gt64xxx_pci0.c
2614--- linux-2.6.39.2/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-19 00:06:34.000000000 -0400
2615+++ linux-2.6.39.2/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-22 19:36:30.000000000 -0400
2616@@ -146,7 +146,7 @@ static int gt64xxx_pci0_pcibios_write(st
2617 return PCIBIOS_SUCCESSFUL;
2618 }
2619
2620-struct pci_ops gt64xxx_pci0_ops = {
2621+const struct pci_ops gt64xxx_pci0_ops = {
2622 .read = gt64xxx_pci0_pcibios_read,
2623 .write = gt64xxx_pci0_pcibios_write
2624 };
2625diff -urNp linux-2.6.39.2/arch/mips/pci/ops-loongson2.c linux-2.6.39.2/arch/mips/pci/ops-loongson2.c
2626--- linux-2.6.39.2/arch/mips/pci/ops-loongson2.c 2011-05-19 00:06:34.000000000 -0400
2627+++ linux-2.6.39.2/arch/mips/pci/ops-loongson2.c 2011-05-22 19:36:30.000000000 -0400
2628@@ -174,7 +174,7 @@ static int loongson_pcibios_write(struct
2629 return PCIBIOS_SUCCESSFUL;
2630 }
2631
2632-struct pci_ops loongson_pci_ops = {
2633+const struct pci_ops loongson_pci_ops = {
2634 .read = loongson_pcibios_read,
2635 .write = loongson_pcibios_write
2636 };
2637diff -urNp linux-2.6.39.2/arch/mips/pci/ops-mace.c linux-2.6.39.2/arch/mips/pci/ops-mace.c
2638--- linux-2.6.39.2/arch/mips/pci/ops-mace.c 2011-05-19 00:06:34.000000000 -0400
2639+++ linux-2.6.39.2/arch/mips/pci/ops-mace.c 2011-05-22 19:36:30.000000000 -0400
2640@@ -96,7 +96,7 @@ mace_pci_write_config(struct pci_bus *bu
2641 return PCIBIOS_SUCCESSFUL;
2642 }
2643
2644-struct pci_ops mace_pci_ops = {
2645+const struct pci_ops mace_pci_ops = {
2646 .read = mace_pci_read_config,
2647 .write = mace_pci_write_config,
2648 };
2649diff -urNp linux-2.6.39.2/arch/mips/pci/ops-msc.c linux-2.6.39.2/arch/mips/pci/ops-msc.c
2650--- linux-2.6.39.2/arch/mips/pci/ops-msc.c 2011-05-19 00:06:34.000000000 -0400
2651+++ linux-2.6.39.2/arch/mips/pci/ops-msc.c 2011-05-22 19:36:30.000000000 -0400
2652@@ -142,7 +142,7 @@ static int msc_pcibios_write(struct pci_
2653 return PCIBIOS_SUCCESSFUL;
2654 }
2655
2656-struct pci_ops msc_pci_ops = {
2657+const struct pci_ops msc_pci_ops = {
2658 .read = msc_pcibios_read,
2659 .write = msc_pcibios_write
2660 };
2661diff -urNp linux-2.6.39.2/arch/mips/pci/ops-nile4.c linux-2.6.39.2/arch/mips/pci/ops-nile4.c
2662--- linux-2.6.39.2/arch/mips/pci/ops-nile4.c 2011-05-19 00:06:34.000000000 -0400
2663+++ linux-2.6.39.2/arch/mips/pci/ops-nile4.c 2011-05-22 19:36:30.000000000 -0400
2664@@ -141,7 +141,7 @@ static int nile4_pcibios_write(struct pc
2665 return PCIBIOS_SUCCESSFUL;
2666 }
2667
2668-struct pci_ops nile4_pci_ops = {
2669+const struct pci_ops nile4_pci_ops = {
2670 .read = nile4_pcibios_read,
2671 .write = nile4_pcibios_write,
2672 };
2673diff -urNp linux-2.6.39.2/arch/mips/pci/ops-pmcmsp.c linux-2.6.39.2/arch/mips/pci/ops-pmcmsp.c
2674--- linux-2.6.39.2/arch/mips/pci/ops-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
2675+++ linux-2.6.39.2/arch/mips/pci/ops-pmcmsp.c 2011-05-22 19:36:30.000000000 -0400
2676@@ -904,7 +904,7 @@ msp_pcibios_write_config(struct pci_bus
2677 * write - function for Linux to generate PCI Configuration writes.
2678 *
2679 ****************************************************************************/
2680-struct pci_ops msp_pci_ops = {
2681+const struct pci_ops msp_pci_ops = {
2682 .read = msp_pcibios_read_config,
2683 .write = msp_pcibios_write_config
2684 };
2685diff -urNp linux-2.6.39.2/arch/mips/pci/ops-pnx8550.c linux-2.6.39.2/arch/mips/pci/ops-pnx8550.c
2686--- linux-2.6.39.2/arch/mips/pci/ops-pnx8550.c 2011-05-19 00:06:34.000000000 -0400
2687+++ linux-2.6.39.2/arch/mips/pci/ops-pnx8550.c 2011-05-22 19:36:30.000000000 -0400
2688@@ -276,7 +276,7 @@ static int config_write(struct pci_bus *
2689 }
2690 }
2691
2692-struct pci_ops pnx8550_pci_ops = {
2693+const struct pci_ops pnx8550_pci_ops = {
2694 config_read,
2695 config_write
2696 };
2697diff -urNp linux-2.6.39.2/arch/mips/pci/ops-rc32434.c linux-2.6.39.2/arch/mips/pci/ops-rc32434.c
2698--- linux-2.6.39.2/arch/mips/pci/ops-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2699+++ linux-2.6.39.2/arch/mips/pci/ops-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2700@@ -201,7 +201,7 @@ static int pci_config_write(struct pci_b
2701 }
2702 }
2703
2704-struct pci_ops rc32434_pci_ops = {
2705+const struct pci_ops rc32434_pci_ops = {
2706 .read = pci_config_read,
2707 .write = pci_config_write,
2708 };
2709diff -urNp linux-2.6.39.2/arch/mips/pci/ops-sni.c linux-2.6.39.2/arch/mips/pci/ops-sni.c
2710--- linux-2.6.39.2/arch/mips/pci/ops-sni.c 2011-05-19 00:06:34.000000000 -0400
2711+++ linux-2.6.39.2/arch/mips/pci/ops-sni.c 2011-05-22 19:36:30.000000000 -0400
2712@@ -83,7 +83,7 @@ static int pcimt_write(struct pci_bus *b
2713 return 0;
2714 }
2715
2716-struct pci_ops sni_pcimt_ops = {
2717+const struct pci_ops sni_pcimt_ops = {
2718 .read = pcimt_read,
2719 .write = pcimt_write,
2720 };
2721@@ -158,7 +158,7 @@ static int pcit_write(struct pci_bus *bu
2722 }
2723
2724
2725-struct pci_ops sni_pcit_ops = {
2726+const struct pci_ops sni_pcit_ops = {
2727 .read = pcit_read,
2728 .write = pcit_write,
2729 };
2730diff -urNp linux-2.6.39.2/arch/mips/pci/ops-titan.c linux-2.6.39.2/arch/mips/pci/ops-titan.c
2731--- linux-2.6.39.2/arch/mips/pci/ops-titan.c 2011-05-19 00:06:34.000000000 -0400
2732+++ linux-2.6.39.2/arch/mips/pci/ops-titan.c 2011-05-22 19:36:30.000000000 -0400
2733@@ -105,7 +105,7 @@ static int titan_write_config(struct pci
2734 /*
2735 * Titan PCI structure
2736 */
2737-struct pci_ops titan_pci_ops = {
2738+const struct pci_ops titan_pci_ops = {
2739 titan_read_config,
2740 titan_write_config,
2741 };
2742diff -urNp linux-2.6.39.2/arch/mips/pci/ops-titan-ht.c linux-2.6.39.2/arch/mips/pci/ops-titan-ht.c
2743--- linux-2.6.39.2/arch/mips/pci/ops-titan-ht.c 2011-05-19 00:06:34.000000000 -0400
2744+++ linux-2.6.39.2/arch/mips/pci/ops-titan-ht.c 2011-05-22 19:36:30.000000000 -0400
2745@@ -118,7 +118,7 @@ static int titan_ht_config_write(struct
2746 return PCIBIOS_SUCCESSFUL;
2747 }
2748
2749-struct pci_ops titan_ht_pci_ops = {
2750+const struct pci_ops titan_ht_pci_ops = {
2751 .read = titan_ht_config_read,
2752 .write = titan_ht_config_write,
2753 };
2754diff -urNp linux-2.6.39.2/arch/mips/pci/ops-tx3927.c linux-2.6.39.2/arch/mips/pci/ops-tx3927.c
2755--- linux-2.6.39.2/arch/mips/pci/ops-tx3927.c 2011-05-19 00:06:34.000000000 -0400
2756+++ linux-2.6.39.2/arch/mips/pci/ops-tx3927.c 2011-05-22 19:36:30.000000000 -0400
2757@@ -121,7 +121,7 @@ static int tx3927_pci_write_config(struc
2758 return check_abort();
2759 }
2760
2761-static struct pci_ops tx3927_pci_ops = {
2762+static const struct pci_ops tx3927_pci_ops = {
2763 .read = tx3927_pci_read_config,
2764 .write = tx3927_pci_write_config,
2765 };
2766diff -urNp linux-2.6.39.2/arch/mips/pci/ops-vr41xx.c linux-2.6.39.2/arch/mips/pci/ops-vr41xx.c
2767--- linux-2.6.39.2/arch/mips/pci/ops-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2768+++ linux-2.6.39.2/arch/mips/pci/ops-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2769@@ -120,7 +120,7 @@ static int pci_config_write(struct pci_b
2770 return PCIBIOS_SUCCESSFUL;
2771 }
2772
2773-struct pci_ops vr41xx_pci_ops = {
2774+const struct pci_ops vr41xx_pci_ops = {
2775 .read = pci_config_read,
2776 .write = pci_config_write,
2777 };
2778diff -urNp linux-2.6.39.2/arch/mips/pci/pci-bcm1480.c linux-2.6.39.2/arch/mips/pci/pci-bcm1480.c
2779--- linux-2.6.39.2/arch/mips/pci/pci-bcm1480.c 2011-05-19 00:06:34.000000000 -0400
2780+++ linux-2.6.39.2/arch/mips/pci/pci-bcm1480.c 2011-05-22 19:36:30.000000000 -0400
2781@@ -171,7 +171,7 @@ static int bcm1480_pcibios_write(struct
2782 return PCIBIOS_SUCCESSFUL;
2783 }
2784
2785-struct pci_ops bcm1480_pci_ops = {
2786+const struct pci_ops bcm1480_pci_ops = {
2787 bcm1480_pcibios_read,
2788 bcm1480_pcibios_write,
2789 };
2790diff -urNp linux-2.6.39.2/arch/mips/pci/pci-bcm1480ht.c linux-2.6.39.2/arch/mips/pci/pci-bcm1480ht.c
2791--- linux-2.6.39.2/arch/mips/pci/pci-bcm1480ht.c 2011-05-19 00:06:34.000000000 -0400
2792+++ linux-2.6.39.2/arch/mips/pci/pci-bcm1480ht.c 2011-05-22 19:36:30.000000000 -0400
2793@@ -166,7 +166,7 @@ static int bcm1480ht_pcibios_get_busno(v
2794 return 0;
2795 }
2796
2797-struct pci_ops bcm1480ht_pci_ops = {
2798+const struct pci_ops bcm1480ht_pci_ops = {
2799 .read = bcm1480ht_pcibios_read,
2800 .write = bcm1480ht_pcibios_write,
2801 };
2802diff -urNp linux-2.6.39.2/arch/mips/pci/pci-bcm63xx.h linux-2.6.39.2/arch/mips/pci/pci-bcm63xx.h
2803--- linux-2.6.39.2/arch/mips/pci/pci-bcm63xx.h 2011-05-19 00:06:34.000000000 -0400
2804+++ linux-2.6.39.2/arch/mips/pci/pci-bcm63xx.h 2011-05-22 19:36:30.000000000 -0400
2805@@ -16,8 +16,8 @@
2806 /*
2807 * defined in ops-bcm63xx.c
2808 */
2809-extern struct pci_ops bcm63xx_pci_ops;
2810-extern struct pci_ops bcm63xx_cb_ops;
2811+extern const struct pci_ops bcm63xx_pci_ops;
2812+extern const struct pci_ops bcm63xx_cb_ops;
2813
2814 /*
2815 * defined in pci-bcm63xx.c
2816diff -urNp linux-2.6.39.2/arch/mips/pci/pci-emma2rh.c linux-2.6.39.2/arch/mips/pci/pci-emma2rh.c
2817--- linux-2.6.39.2/arch/mips/pci/pci-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2818+++ linux-2.6.39.2/arch/mips/pci/pci-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2819@@ -43,7 +43,7 @@ static struct resource pci_mem_resource
2820 .flags = IORESOURCE_MEM,
2821 };
2822
2823-extern struct pci_ops emma2rh_pci_ops;
2824+extern const struct pci_ops emma2rh_pci_ops;
2825
2826 static struct pci_controller emma2rh_pci_controller = {
2827 .pci_ops = &emma2rh_pci_ops,
2828diff -urNp linux-2.6.39.2/arch/mips/pci/pcie-octeon.c linux-2.6.39.2/arch/mips/pci/pcie-octeon.c
2829--- linux-2.6.39.2/arch/mips/pci/pcie-octeon.c 2011-05-19 00:06:34.000000000 -0400
2830+++ linux-2.6.39.2/arch/mips/pci/pcie-octeon.c 2011-05-22 19:36:30.000000000 -0400
2831@@ -1237,7 +1237,7 @@ static int octeon_pcie1_write_config(str
2832 return octeon_pcie_write_config(1, bus, devfn, reg, size, val);
2833 }
2834
2835-static struct pci_ops octeon_pcie0_ops = {
2836+static const struct pci_ops octeon_pcie0_ops = {
2837 octeon_pcie0_read_config,
2838 octeon_pcie0_write_config,
2839 };
2840@@ -1258,7 +1258,7 @@ static struct pci_controller octeon_pcie
2841 .io_resource = &octeon_pcie0_io_resource,
2842 };
2843
2844-static struct pci_ops octeon_pcie1_ops = {
2845+static const struct pci_ops octeon_pcie1_ops = {
2846 octeon_pcie1_read_config,
2847 octeon_pcie1_write_config,
2848 };
2849diff -urNp linux-2.6.39.2/arch/mips/pci/pci-ip27.c linux-2.6.39.2/arch/mips/pci/pci-ip27.c
2850--- linux-2.6.39.2/arch/mips/pci/pci-ip27.c 2011-05-19 00:06:34.000000000 -0400
2851+++ linux-2.6.39.2/arch/mips/pci/pci-ip27.c 2011-05-22 19:36:30.000000000 -0400
2852@@ -39,7 +39,7 @@ static struct bridge_controller bridges[
2853 struct bridge_controller *irq_to_bridge[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2854 int irq_to_slot[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2855
2856-extern struct pci_ops bridge_pci_ops;
2857+extern const struct pci_ops bridge_pci_ops;
2858
2859 int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
2860 {
2861diff -urNp linux-2.6.39.2/arch/mips/pci/pci-ip32.c linux-2.6.39.2/arch/mips/pci/pci-ip32.c
2862--- linux-2.6.39.2/arch/mips/pci/pci-ip32.c 2011-05-19 00:06:34.000000000 -0400
2863+++ linux-2.6.39.2/arch/mips/pci/pci-ip32.c 2011-05-22 19:36:30.000000000 -0400
2864@@ -82,7 +82,7 @@ static irqreturn_t macepci_error(int irq
2865 }
2866
2867
2868-extern struct pci_ops mace_pci_ops;
2869+extern const struct pci_ops mace_pci_ops;
2870 #ifdef CONFIG_64BIT
2871 static struct resource mace_pci_mem_resource = {
2872 .name = "SGI O2 PCI MEM",
2873diff -urNp linux-2.6.39.2/arch/mips/pci/pci-lasat.c linux-2.6.39.2/arch/mips/pci/pci-lasat.c
2874--- linux-2.6.39.2/arch/mips/pci/pci-lasat.c 2011-05-19 00:06:34.000000000 -0400
2875+++ linux-2.6.39.2/arch/mips/pci/pci-lasat.c 2011-05-22 19:36:30.000000000 -0400
2876@@ -14,8 +14,8 @@
2877
2878 #include <irq.h>
2879
2880-extern struct pci_ops nile4_pci_ops;
2881-extern struct pci_ops gt64xxx_pci0_ops;
2882+extern const struct pci_ops nile4_pci_ops;
2883+extern const struct pci_ops gt64xxx_pci0_ops;
2884 static struct resource lasat_pci_mem_resource = {
2885 .name = "LASAT PCI MEM",
2886 .start = 0x18000000,
2887diff -urNp linux-2.6.39.2/arch/mips/pci/pci-octeon.c linux-2.6.39.2/arch/mips/pci/pci-octeon.c
2888--- linux-2.6.39.2/arch/mips/pci/pci-octeon.c 2011-05-19 00:06:34.000000000 -0400
2889+++ linux-2.6.39.2/arch/mips/pci/pci-octeon.c 2011-05-22 19:36:30.000000000 -0400
2890@@ -334,7 +334,7 @@ static int octeon_write_config(struct pc
2891 }
2892
2893
2894-static struct pci_ops octeon_pci_ops = {
2895+static const struct pci_ops octeon_pci_ops = {
2896 octeon_read_config,
2897 octeon_write_config,
2898 };
2899diff -urNp linux-2.6.39.2/arch/mips/pci/pci-rc32434.c linux-2.6.39.2/arch/mips/pci/pci-rc32434.c
2900--- linux-2.6.39.2/arch/mips/pci/pci-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2901+++ linux-2.6.39.2/arch/mips/pci/pci-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2902@@ -75,7 +75,7 @@ static struct resource rc32434_res_pci_i
2903 .flags = IORESOURCE_IO,
2904 };
2905
2906-extern struct pci_ops rc32434_pci_ops;
2907+extern const struct pci_ops rc32434_pci_ops;
2908
2909 #define PCI_MEM1_START PCI_ADDR_START
2910 #define PCI_MEM1_END (PCI_ADDR_START + CPUTOPCI_MEM_WIN - 1)
2911diff -urNp linux-2.6.39.2/arch/mips/pci/pci-sb1250.c linux-2.6.39.2/arch/mips/pci/pci-sb1250.c
2912--- linux-2.6.39.2/arch/mips/pci/pci-sb1250.c 2011-05-19 00:06:34.000000000 -0400
2913+++ linux-2.6.39.2/arch/mips/pci/pci-sb1250.c 2011-05-22 19:36:30.000000000 -0400
2914@@ -181,7 +181,7 @@ static int sb1250_pcibios_write(struct p
2915 return PCIBIOS_SUCCESSFUL;
2916 }
2917
2918-struct pci_ops sb1250_pci_ops = {
2919+const struct pci_ops sb1250_pci_ops = {
2920 .read = sb1250_pcibios_read,
2921 .write = sb1250_pcibios_write,
2922 };
2923diff -urNp linux-2.6.39.2/arch/mips/pci/pci-vr41xx.c linux-2.6.39.2/arch/mips/pci/pci-vr41xx.c
2924--- linux-2.6.39.2/arch/mips/pci/pci-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2925+++ linux-2.6.39.2/arch/mips/pci/pci-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2926@@ -36,7 +36,7 @@
2927
2928 #include "pci-vr41xx.h"
2929
2930-extern struct pci_ops vr41xx_pci_ops;
2931+extern const struct pci_ops vr41xx_pci_ops;
2932
2933 static void __iomem *pciu_base;
2934
2935diff -urNp linux-2.6.39.2/arch/mips/pci/pci-yosemite.c linux-2.6.39.2/arch/mips/pci/pci-yosemite.c
2936--- linux-2.6.39.2/arch/mips/pci/pci-yosemite.c 2011-05-19 00:06:34.000000000 -0400
2937+++ linux-2.6.39.2/arch/mips/pci/pci-yosemite.c 2011-05-22 19:36:30.000000000 -0400
2938@@ -11,7 +11,7 @@
2939 #include <linux/pci.h>
2940 #include <asm/titan_dep.h>
2941
2942-extern struct pci_ops titan_pci_ops;
2943+extern const struct pci_ops titan_pci_ops;
2944
2945 static struct resource py_mem_resource = {
2946 .start = 0xe0000000UL,
2947diff -urNp linux-2.6.39.2/arch/mips/pmc-sierra/yosemite/ht.c linux-2.6.39.2/arch/mips/pmc-sierra/yosemite/ht.c
2948--- linux-2.6.39.2/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-19 00:06:34.000000000 -0400
2949+++ linux-2.6.39.2/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-22 19:36:30.000000000 -0400
2950@@ -366,7 +366,7 @@ resource_size_t pcibios_align_resource(v
2951 return start;
2952 }
2953
2954-struct pci_ops titan_pci_ops = {
2955+const struct pci_ops titan_pci_ops = {
2956 titan_ht_config_read_byte,
2957 titan_ht_config_read_word,
2958 titan_ht_config_read_dword,
2959diff -urNp linux-2.6.39.2/arch/mips/pnx8550/common/pci.c linux-2.6.39.2/arch/mips/pnx8550/common/pci.c
2960--- linux-2.6.39.2/arch/mips/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2961+++ linux-2.6.39.2/arch/mips/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2962@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2963 .flags = IORESOURCE_MEM
2964 };
2965
2966-extern struct pci_ops pnx8550_pci_ops;
2967+extern const struct pci_ops pnx8550_pci_ops;
2968
2969 static struct pci_controller pnx8550_controller = {
2970 .pci_ops = &pnx8550_pci_ops,
2971diff -urNp linux-2.6.39.2/arch/mips/sni/pcimt.c linux-2.6.39.2/arch/mips/sni/pcimt.c
2972--- linux-2.6.39.2/arch/mips/sni/pcimt.c 2011-05-19 00:06:34.000000000 -0400
2973+++ linux-2.6.39.2/arch/mips/sni/pcimt.c 2011-05-22 19:36:30.000000000 -0400
2974@@ -183,7 +183,7 @@ static void __init sni_pcimt_resource_in
2975 request_resource(&sni_mem_resource, pcimt_mem_resources + i);
2976 }
2977
2978-extern struct pci_ops sni_pcimt_ops;
2979+extern const struct pci_ops sni_pcimt_ops;
2980
2981 static struct pci_controller sni_controller = {
2982 .pci_ops = &sni_pcimt_ops,
2983diff -urNp linux-2.6.39.2/arch/mips/sni/pcit.c linux-2.6.39.2/arch/mips/sni/pcit.c
2984--- linux-2.6.39.2/arch/mips/sni/pcit.c 2011-05-19 00:06:34.000000000 -0400
2985+++ linux-2.6.39.2/arch/mips/sni/pcit.c 2011-05-22 19:36:30.000000000 -0400
2986@@ -145,7 +145,7 @@ static void __init sni_pcit_resource_ini
2987 }
2988
2989
2990-extern struct pci_ops sni_pcit_ops;
2991+extern const struct pci_ops sni_pcit_ops;
2992
2993 static struct pci_controller sni_pcit_controller = {
2994 .pci_ops = &sni_pcit_ops,
2995diff -urNp linux-2.6.39.2/arch/mips/wrppmc/pci.c linux-2.6.39.2/arch/mips/wrppmc/pci.c
2996--- linux-2.6.39.2/arch/mips/wrppmc/pci.c 2011-05-19 00:06:34.000000000 -0400
2997+++ linux-2.6.39.2/arch/mips/wrppmc/pci.c 2011-05-22 19:36:30.000000000 -0400
2998@@ -14,7 +14,7 @@
2999
3000 #include <asm/gt64120.h>
3001
3002-extern struct pci_ops gt64xxx_pci0_ops;
3003+extern const struct pci_ops gt64xxx_pci0_ops;
3004
3005 static struct resource pci0_io_resource = {
3006 .name = "pci_0 io",
3007diff -urNp linux-2.6.39.2/arch/mn10300/unit-asb2305/pci-asb2305.h linux-2.6.39.2/arch/mn10300/unit-asb2305/pci-asb2305.h
3008--- linux-2.6.39.2/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-19 00:06:34.000000000 -0400
3009+++ linux-2.6.39.2/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-22 19:36:30.000000000 -0400
3010@@ -39,7 +39,7 @@ extern void pcibios_resource_survey(void
3011
3012 extern int pcibios_last_bus;
3013 extern struct pci_bus *pci_root_bus;
3014-extern struct pci_ops *pci_root_ops;
3015+extern const struct pci_ops *pci_root_ops;
3016
3017 extern struct irq_routing_table *pcibios_get_irq_routing_table(void);
3018 extern int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq);
3019diff -urNp linux-2.6.39.2/arch/mn10300/unit-asb2305/pci.c linux-2.6.39.2/arch/mn10300/unit-asb2305/pci.c
3020--- linux-2.6.39.2/arch/mn10300/unit-asb2305/pci.c 2011-05-19 00:06:34.000000000 -0400
3021+++ linux-2.6.39.2/arch/mn10300/unit-asb2305/pci.c 2011-05-22 19:36:30.000000000 -0400
3022@@ -24,7 +24,7 @@ unsigned int pci_probe = 1;
3023
3024 int pcibios_last_bus = -1;
3025 struct pci_bus *pci_root_bus;
3026-struct pci_ops *pci_root_ops;
3027+const struct pci_ops *pci_root_ops;
3028
3029 /*
3030 * The accessible PCI window does not cover the entire CPU address space, but
3031@@ -274,7 +274,7 @@ static int pci_ampci_write_config(struct
3032 }
3033 }
3034
3035-static struct pci_ops pci_direct_ampci = {
3036+static const struct pci_ops pci_direct_ampci = {
3037 pci_ampci_read_config,
3038 pci_ampci_write_config,
3039 };
3040@@ -289,7 +289,7 @@ static struct pci_ops pci_direct_ampci =
3041 * This should be close to trivial, but it isn't, because there are buggy
3042 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
3043 */
3044-static int __init pci_sanity_check(struct pci_ops *o)
3045+static int __init pci_sanity_check(const struct pci_ops *o)
3046 {
3047 struct pci_bus bus; /* Fake bus and device */
3048 u32 x;
3049diff -urNp linux-2.6.39.2/arch/parisc/include/asm/elf.h linux-2.6.39.2/arch/parisc/include/asm/elf.h
3050--- linux-2.6.39.2/arch/parisc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
3051+++ linux-2.6.39.2/arch/parisc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
3052@@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration..
3053
3054 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
3055
3056+#ifdef CONFIG_PAX_ASLR
3057+#define PAX_ELF_ET_DYN_BASE 0x10000UL
3058+
3059+#define PAX_DELTA_MMAP_LEN 16
3060+#define PAX_DELTA_STACK_LEN 16
3061+#endif
3062+
3063 /* This yields a mask that user programs can use to figure out what
3064 instruction set this CPU supports. This could be done in user space,
3065 but it's not easy, and we've already done it here. */
3066diff -urNp linux-2.6.39.2/arch/parisc/include/asm/pgtable.h linux-2.6.39.2/arch/parisc/include/asm/pgtable.h
3067--- linux-2.6.39.2/arch/parisc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
3068+++ linux-2.6.39.2/arch/parisc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
3069@@ -207,6 +207,17 @@ struct vm_area_struct;
3070 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
3071 #define PAGE_COPY PAGE_EXECREAD
3072 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
3073+
3074+#ifdef CONFIG_PAX_PAGEEXEC
3075+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
3076+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
3077+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
3078+#else
3079+# define PAGE_SHARED_NOEXEC PAGE_SHARED
3080+# define PAGE_COPY_NOEXEC PAGE_COPY
3081+# define PAGE_READONLY_NOEXEC PAGE_READONLY
3082+#endif
3083+
3084 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
3085 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
3086 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
3087diff -urNp linux-2.6.39.2/arch/parisc/kernel/module.c linux-2.6.39.2/arch/parisc/kernel/module.c
3088--- linux-2.6.39.2/arch/parisc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
3089+++ linux-2.6.39.2/arch/parisc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
3090@@ -96,16 +96,38 @@
3091
3092 /* three functions to determine where in the module core
3093 * or init pieces the location is */
3094+static inline int in_init_rx(struct module *me, void *loc)
3095+{
3096+ return (loc >= me->module_init_rx &&
3097+ loc < (me->module_init_rx + me->init_size_rx));
3098+}
3099+
3100+static inline int in_init_rw(struct module *me, void *loc)
3101+{
3102+ return (loc >= me->module_init_rw &&
3103+ loc < (me->module_init_rw + me->init_size_rw));
3104+}
3105+
3106 static inline int in_init(struct module *me, void *loc)
3107 {
3108- return (loc >= me->module_init &&
3109- loc <= (me->module_init + me->init_size));
3110+ return in_init_rx(me, loc) || in_init_rw(me, loc);
3111+}
3112+
3113+static inline int in_core_rx(struct module *me, void *loc)
3114+{
3115+ return (loc >= me->module_core_rx &&
3116+ loc < (me->module_core_rx + me->core_size_rx));
3117+}
3118+
3119+static inline int in_core_rw(struct module *me, void *loc)
3120+{
3121+ return (loc >= me->module_core_rw &&
3122+ loc < (me->module_core_rw + me->core_size_rw));
3123 }
3124
3125 static inline int in_core(struct module *me, void *loc)
3126 {
3127- return (loc >= me->module_core &&
3128- loc <= (me->module_core + me->core_size));
3129+ return in_core_rx(me, loc) || in_core_rw(me, loc);
3130 }
3131
3132 static inline int in_local(struct module *me, void *loc)
3133@@ -365,13 +387,13 @@ int module_frob_arch_sections(CONST Elf_
3134 }
3135
3136 /* align things a bit */
3137- me->core_size = ALIGN(me->core_size, 16);
3138- me->arch.got_offset = me->core_size;
3139- me->core_size += gots * sizeof(struct got_entry);
3140-
3141- me->core_size = ALIGN(me->core_size, 16);
3142- me->arch.fdesc_offset = me->core_size;
3143- me->core_size += fdescs * sizeof(Elf_Fdesc);
3144+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
3145+ me->arch.got_offset = me->core_size_rw;
3146+ me->core_size_rw += gots * sizeof(struct got_entry);
3147+
3148+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
3149+ me->arch.fdesc_offset = me->core_size_rw;
3150+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
3151
3152 me->arch.got_max = gots;
3153 me->arch.fdesc_max = fdescs;
3154@@ -389,7 +411,7 @@ static Elf64_Word get_got(struct module
3155
3156 BUG_ON(value == 0);
3157
3158- got = me->module_core + me->arch.got_offset;
3159+ got = me->module_core_rw + me->arch.got_offset;
3160 for (i = 0; got[i].addr; i++)
3161 if (got[i].addr == value)
3162 goto out;
3163@@ -407,7 +429,7 @@ static Elf64_Word get_got(struct module
3164 #ifdef CONFIG_64BIT
3165 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
3166 {
3167- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
3168+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
3169
3170 if (!value) {
3171 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
3172@@ -425,7 +447,7 @@ static Elf_Addr get_fdesc(struct module
3173
3174 /* Create new one */
3175 fdesc->addr = value;
3176- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
3177+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
3178 return (Elf_Addr)fdesc;
3179 }
3180 #endif /* CONFIG_64BIT */
3181@@ -849,7 +871,7 @@ register_unwind_table(struct module *me,
3182
3183 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
3184 end = table + sechdrs[me->arch.unwind_section].sh_size;
3185- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
3186+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
3187
3188 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
3189 me->arch.unwind_section, table, end, gp);
3190diff -urNp linux-2.6.39.2/arch/parisc/kernel/sys_parisc.c linux-2.6.39.2/arch/parisc/kernel/sys_parisc.c
3191--- linux-2.6.39.2/arch/parisc/kernel/sys_parisc.c 2011-05-19 00:06:34.000000000 -0400
3192+++ linux-2.6.39.2/arch/parisc/kernel/sys_parisc.c 2011-05-22 19:36:30.000000000 -0400
3193@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
3194 /* At this point: (!vma || addr < vma->vm_end). */
3195 if (TASK_SIZE - len < addr)
3196 return -ENOMEM;
3197- if (!vma || addr + len <= vma->vm_start)
3198+ if (check_heap_stack_gap(vma, addr, len))
3199 return addr;
3200 addr = vma->vm_end;
3201 }
3202@@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
3203 /* At this point: (!vma || addr < vma->vm_end). */
3204 if (TASK_SIZE - len < addr)
3205 return -ENOMEM;
3206- if (!vma || addr + len <= vma->vm_start)
3207+ if (check_heap_stack_gap(vma, addr, len))
3208 return addr;
3209 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
3210 if (addr < vma->vm_end) /* handle wraparound */
3211@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
3212 if (flags & MAP_FIXED)
3213 return addr;
3214 if (!addr)
3215- addr = TASK_UNMAPPED_BASE;
3216+ addr = current->mm->mmap_base;
3217
3218 if (filp) {
3219 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
3220diff -urNp linux-2.6.39.2/arch/parisc/kernel/traps.c linux-2.6.39.2/arch/parisc/kernel/traps.c
3221--- linux-2.6.39.2/arch/parisc/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
3222+++ linux-2.6.39.2/arch/parisc/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
3223@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
3224
3225 down_read(&current->mm->mmap_sem);
3226 vma = find_vma(current->mm,regs->iaoq[0]);
3227- if (vma && (regs->iaoq[0] >= vma->vm_start)
3228- && (vma->vm_flags & VM_EXEC)) {
3229-
3230+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
3231 fault_address = regs->iaoq[0];
3232 fault_space = regs->iasq[0];
3233
3234diff -urNp linux-2.6.39.2/arch/parisc/mm/fault.c linux-2.6.39.2/arch/parisc/mm/fault.c
3235--- linux-2.6.39.2/arch/parisc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
3236+++ linux-2.6.39.2/arch/parisc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
3237@@ -15,6 +15,7 @@
3238 #include <linux/sched.h>
3239 #include <linux/interrupt.h>
3240 #include <linux/module.h>
3241+#include <linux/unistd.h>
3242
3243 #include <asm/uaccess.h>
3244 #include <asm/traps.h>
3245@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
3246 static unsigned long
3247 parisc_acctyp(unsigned long code, unsigned int inst)
3248 {
3249- if (code == 6 || code == 16)
3250+ if (code == 6 || code == 7 || code == 16)
3251 return VM_EXEC;
3252
3253 switch (inst & 0xf0000000) {
3254@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
3255 }
3256 #endif
3257
3258+#ifdef CONFIG_PAX_PAGEEXEC
3259+/*
3260+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
3261+ *
3262+ * returns 1 when task should be killed
3263+ * 2 when rt_sigreturn trampoline was detected
3264+ * 3 when unpatched PLT trampoline was detected
3265+ */
3266+static int pax_handle_fetch_fault(struct pt_regs *regs)
3267+{
3268+
3269+#ifdef CONFIG_PAX_EMUPLT
3270+ int err;
3271+
3272+ do { /* PaX: unpatched PLT emulation */
3273+ unsigned int bl, depwi;
3274+
3275+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
3276+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
3277+
3278+ if (err)
3279+ break;
3280+
3281+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
3282+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
3283+
3284+ err = get_user(ldw, (unsigned int *)addr);
3285+ err |= get_user(bv, (unsigned int *)(addr+4));
3286+ err |= get_user(ldw2, (unsigned int *)(addr+8));
3287+
3288+ if (err)
3289+ break;
3290+
3291+ if (ldw == 0x0E801096U &&
3292+ bv == 0xEAC0C000U &&
3293+ ldw2 == 0x0E881095U)
3294+ {
3295+ unsigned int resolver, map;
3296+
3297+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
3298+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
3299+ if (err)
3300+ break;
3301+
3302+ regs->gr[20] = instruction_pointer(regs)+8;
3303+ regs->gr[21] = map;
3304+ regs->gr[22] = resolver;
3305+ regs->iaoq[0] = resolver | 3UL;
3306+ regs->iaoq[1] = regs->iaoq[0] + 4;
3307+ return 3;
3308+ }
3309+ }
3310+ } while (0);
3311+#endif
3312+
3313+#ifdef CONFIG_PAX_EMUTRAMP
3314+
3315+#ifndef CONFIG_PAX_EMUSIGRT
3316+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
3317+ return 1;
3318+#endif
3319+
3320+ do { /* PaX: rt_sigreturn emulation */
3321+ unsigned int ldi1, ldi2, bel, nop;
3322+
3323+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
3324+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
3325+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
3326+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
3327+
3328+ if (err)
3329+ break;
3330+
3331+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
3332+ ldi2 == 0x3414015AU &&
3333+ bel == 0xE4008200U &&
3334+ nop == 0x08000240U)
3335+ {
3336+ regs->gr[25] = (ldi1 & 2) >> 1;
3337+ regs->gr[20] = __NR_rt_sigreturn;
3338+ regs->gr[31] = regs->iaoq[1] + 16;
3339+ regs->sr[0] = regs->iasq[1];
3340+ regs->iaoq[0] = 0x100UL;
3341+ regs->iaoq[1] = regs->iaoq[0] + 4;
3342+ regs->iasq[0] = regs->sr[2];
3343+ regs->iasq[1] = regs->sr[2];
3344+ return 2;
3345+ }
3346+ } while (0);
3347+#endif
3348+
3349+ return 1;
3350+}
3351+
3352+void pax_report_insns(void *pc, void *sp)
3353+{
3354+ unsigned long i;
3355+
3356+ printk(KERN_ERR "PAX: bytes at PC: ");
3357+ for (i = 0; i < 5; i++) {
3358+ unsigned int c;
3359+ if (get_user(c, (unsigned int *)pc+i))
3360+ printk(KERN_CONT "???????? ");
3361+ else
3362+ printk(KERN_CONT "%08x ", c);
3363+ }
3364+ printk("\n");
3365+}
3366+#endif
3367+
3368 int fixup_exception(struct pt_regs *regs)
3369 {
3370 const struct exception_table_entry *fix;
3371@@ -192,8 +303,33 @@ good_area:
3372
3373 acc_type = parisc_acctyp(code,regs->iir);
3374
3375- if ((vma->vm_flags & acc_type) != acc_type)
3376+ if ((vma->vm_flags & acc_type) != acc_type) {
3377+
3378+#ifdef CONFIG_PAX_PAGEEXEC
3379+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
3380+ (address & ~3UL) == instruction_pointer(regs))
3381+ {
3382+ up_read(&mm->mmap_sem);
3383+ switch (pax_handle_fetch_fault(regs)) {
3384+
3385+#ifdef CONFIG_PAX_EMUPLT
3386+ case 3:
3387+ return;
3388+#endif
3389+
3390+#ifdef CONFIG_PAX_EMUTRAMP
3391+ case 2:
3392+ return;
3393+#endif
3394+
3395+ }
3396+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
3397+ do_group_exit(SIGKILL);
3398+ }
3399+#endif
3400+
3401 goto bad_area;
3402+ }
3403
3404 /*
3405 * If for any reason at all we couldn't handle the fault, make
3406diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/device.h linux-2.6.39.2/arch/powerpc/include/asm/device.h
3407--- linux-2.6.39.2/arch/powerpc/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
3408+++ linux-2.6.39.2/arch/powerpc/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
3409@@ -17,7 +17,7 @@ struct device_node;
3410 */
3411 struct dev_archdata {
3412 /* DMA operations on that device */
3413- struct dma_map_ops *dma_ops;
3414+ const struct dma_map_ops *dma_ops;
3415
3416 /*
3417 * When an iommu is in use, dma_data is used as a ptr to the base of the
3418diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/dma-mapping.h linux-2.6.39.2/arch/powerpc/include/asm/dma-mapping.h
3419--- linux-2.6.39.2/arch/powerpc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3420+++ linux-2.6.39.2/arch/powerpc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
3421@@ -67,12 +67,13 @@ static inline unsigned long device_to_ma
3422 /*
3423 * Available generic sets of operations
3424 */
3425+/* cannot be const */
3426 #ifdef CONFIG_PPC64
3427-extern struct dma_map_ops dma_iommu_ops;
3428+extern const struct dma_map_ops dma_iommu_ops;
3429 #endif
3430-extern struct dma_map_ops dma_direct_ops;
3431+extern const struct dma_map_ops dma_direct_ops;
3432
3433-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3434+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3435 {
3436 /* We don't handle the NULL dev case for ISA for now. We could
3437 * do it via an out of line call but it is not needed for now. The
3438@@ -85,7 +86,7 @@ static inline struct dma_map_ops *get_dm
3439 return dev->archdata.dma_ops;
3440 }
3441
3442-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
3443+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
3444 {
3445 dev->archdata.dma_ops = ops;
3446 }
3447@@ -119,7 +120,7 @@ static inline void set_dma_offset(struct
3448
3449 static inline int dma_supported(struct device *dev, u64 mask)
3450 {
3451- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3452+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3453
3454 if (unlikely(dma_ops == NULL))
3455 return 0;
3456@@ -133,7 +134,7 @@ extern int dma_set_mask(struct device *d
3457 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3458 dma_addr_t *dma_handle, gfp_t flag)
3459 {
3460- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3461+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3462 void *cpu_addr;
3463
3464 BUG_ON(!dma_ops);
3465@@ -148,7 +149,7 @@ static inline void *dma_alloc_coherent(s
3466 static inline void dma_free_coherent(struct device *dev, size_t size,
3467 void *cpu_addr, dma_addr_t dma_handle)
3468 {
3469- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3470+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3471
3472 BUG_ON(!dma_ops);
3473
3474@@ -159,7 +160,7 @@ static inline void dma_free_coherent(str
3475
3476 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
3477 {
3478- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3479+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3480
3481 if (dma_ops->mapping_error)
3482 return dma_ops->mapping_error(dev, dma_addr);
3483diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/elf.h linux-2.6.39.2/arch/powerpc/include/asm/elf.h
3484--- linux-2.6.39.2/arch/powerpc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
3485+++ linux-2.6.39.2/arch/powerpc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
3486@@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
3487 the loader. We need to make sure that it is out of the way of the program
3488 that it will "exec", and that there is sufficient room for the brk. */
3489
3490-extern unsigned long randomize_et_dyn(unsigned long base);
3491-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
3492+#define ELF_ET_DYN_BASE (0x20000000)
3493+
3494+#ifdef CONFIG_PAX_ASLR
3495+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
3496+
3497+#ifdef __powerpc64__
3498+#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
3499+#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
3500+#else
3501+#define PAX_DELTA_MMAP_LEN 15
3502+#define PAX_DELTA_STACK_LEN 15
3503+#endif
3504+#endif
3505
3506 /*
3507 * Our registers are always unsigned longs, whether we're a 32 bit
3508@@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
3509 (0x7ff >> (PAGE_SHIFT - 12)) : \
3510 (0x3ffff >> (PAGE_SHIFT - 12)))
3511
3512-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
3513-#define arch_randomize_brk arch_randomize_brk
3514-
3515 #endif /* __KERNEL__ */
3516
3517 /*
3518diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/iommu.h linux-2.6.39.2/arch/powerpc/include/asm/iommu.h
3519--- linux-2.6.39.2/arch/powerpc/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
3520+++ linux-2.6.39.2/arch/powerpc/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
3521@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
3522 extern void iommu_init_early_dart(void);
3523 extern void iommu_init_early_pasemi(void);
3524
3525+/* dma-iommu.c */
3526+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
3527+
3528 #ifdef CONFIG_PCI
3529 extern void pci_iommu_init(void);
3530 extern void pci_direct_iommu_init(void);
3531diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/kmap_types.h linux-2.6.39.2/arch/powerpc/include/asm/kmap_types.h
3532--- linux-2.6.39.2/arch/powerpc/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
3533+++ linux-2.6.39.2/arch/powerpc/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
3534@@ -27,6 +27,7 @@ enum km_type {
3535 KM_PPC_SYNC_PAGE,
3536 KM_PPC_SYNC_ICACHE,
3537 KM_KDB,
3538+ KM_CLEARPAGE,
3539 KM_TYPE_NR
3540 };
3541
3542diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/page_64.h linux-2.6.39.2/arch/powerpc/include/asm/page_64.h
3543--- linux-2.6.39.2/arch/powerpc/include/asm/page_64.h 2011-05-19 00:06:34.000000000 -0400
3544+++ linux-2.6.39.2/arch/powerpc/include/asm/page_64.h 2011-05-22 19:36:30.000000000 -0400
3545@@ -172,15 +172,18 @@ do { \
3546 * stack by default, so in the absence of a PT_GNU_STACK program header
3547 * we turn execute permission off.
3548 */
3549-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3550- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3551+#define VM_STACK_DEFAULT_FLAGS32 \
3552+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3553+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3554
3555 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3556 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3557
3558+#ifndef CONFIG_PAX_PAGEEXEC
3559 #define VM_STACK_DEFAULT_FLAGS \
3560 (is_32bit_task() ? \
3561 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
3562+#endif
3563
3564 #include <asm-generic/getorder.h>
3565
3566diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/page.h linux-2.6.39.2/arch/powerpc/include/asm/page.h
3567--- linux-2.6.39.2/arch/powerpc/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
3568+++ linux-2.6.39.2/arch/powerpc/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
3569@@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
3570 * and needs to be executable. This means the whole heap ends
3571 * up being executable.
3572 */
3573-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3574- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3575+#define VM_DATA_DEFAULT_FLAGS32 \
3576+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3577+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3578
3579 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3580 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3581@@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
3582 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
3583 #endif
3584
3585+#define ktla_ktva(addr) (addr)
3586+#define ktva_ktla(addr) (addr)
3587+
3588 #ifndef __ASSEMBLY__
3589
3590 #undef STRICT_MM_TYPECHECKS
3591diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/pci.h linux-2.6.39.2/arch/powerpc/include/asm/pci.h
3592--- linux-2.6.39.2/arch/powerpc/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
3593+++ linux-2.6.39.2/arch/powerpc/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
3594@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
3595 }
3596
3597 #ifdef CONFIG_PCI
3598-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
3599-extern struct dma_map_ops *get_pci_dma_ops(void);
3600+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
3601+extern const struct dma_map_ops *get_pci_dma_ops(void);
3602 #else /* CONFIG_PCI */
3603 #define set_pci_dma_ops(d)
3604 #define get_pci_dma_ops() NULL
3605diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/pgtable.h linux-2.6.39.2/arch/powerpc/include/asm/pgtable.h
3606--- linux-2.6.39.2/arch/powerpc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
3607+++ linux-2.6.39.2/arch/powerpc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
3608@@ -2,6 +2,7 @@
3609 #define _ASM_POWERPC_PGTABLE_H
3610 #ifdef __KERNEL__
3611
3612+#include <linux/const.h>
3613 #ifndef __ASSEMBLY__
3614 #include <asm/processor.h> /* For TASK_SIZE */
3615 #include <asm/mmu.h>
3616diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/pte-hash32.h linux-2.6.39.2/arch/powerpc/include/asm/pte-hash32.h
3617--- linux-2.6.39.2/arch/powerpc/include/asm/pte-hash32.h 2011-05-19 00:06:34.000000000 -0400
3618+++ linux-2.6.39.2/arch/powerpc/include/asm/pte-hash32.h 2011-05-22 19:36:30.000000000 -0400
3619@@ -21,6 +21,7 @@
3620 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
3621 #define _PAGE_USER 0x004 /* usermode access allowed */
3622 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
3623+#define _PAGE_EXEC _PAGE_GUARDED
3624 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
3625 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
3626 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
3627diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/reg.h linux-2.6.39.2/arch/powerpc/include/asm/reg.h
3628--- linux-2.6.39.2/arch/powerpc/include/asm/reg.h 2011-05-19 00:06:34.000000000 -0400
3629+++ linux-2.6.39.2/arch/powerpc/include/asm/reg.h 2011-05-22 19:36:30.000000000 -0400
3630@@ -201,6 +201,7 @@
3631 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
3632 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
3633 #define DSISR_NOHPTE 0x40000000 /* no translation found */
3634+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
3635 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
3636 #define DSISR_ISSTORE 0x02000000 /* access was a store */
3637 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
3638diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/swiotlb.h linux-2.6.39.2/arch/powerpc/include/asm/swiotlb.h
3639--- linux-2.6.39.2/arch/powerpc/include/asm/swiotlb.h 2011-05-19 00:06:34.000000000 -0400
3640+++ linux-2.6.39.2/arch/powerpc/include/asm/swiotlb.h 2011-05-22 19:36:30.000000000 -0400
3641@@ -13,7 +13,7 @@
3642
3643 #include <linux/swiotlb.h>
3644
3645-extern struct dma_map_ops swiotlb_dma_ops;
3646+extern const struct dma_map_ops swiotlb_dma_ops;
3647
3648 static inline void dma_mark_clean(void *addr, size_t size) {}
3649
3650diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/system.h linux-2.6.39.2/arch/powerpc/include/asm/system.h
3651--- linux-2.6.39.2/arch/powerpc/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
3652+++ linux-2.6.39.2/arch/powerpc/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
3653@@ -533,7 +533,7 @@ __cmpxchg_local(volatile void *ptr, unsi
3654 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
3655 #endif
3656
3657-extern unsigned long arch_align_stack(unsigned long sp);
3658+#define arch_align_stack(x) ((x) & ~0xfUL)
3659
3660 /* Used in very early kernel initialization. */
3661 extern unsigned long reloc_offset(void);
3662diff -urNp linux-2.6.39.2/arch/powerpc/include/asm/uaccess.h linux-2.6.39.2/arch/powerpc/include/asm/uaccess.h
3663--- linux-2.6.39.2/arch/powerpc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
3664+++ linux-2.6.39.2/arch/powerpc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
3665@@ -13,6 +13,8 @@
3666 #define VERIFY_READ 0
3667 #define VERIFY_WRITE 1
3668
3669+extern void check_object_size(const void *ptr, unsigned long n, bool to);
3670+
3671 /*
3672 * The fs value determines whether argument validity checking should be
3673 * performed or not. If get_fs() == USER_DS, checking is performed, with
3674@@ -327,52 +329,6 @@ do { \
3675 extern unsigned long __copy_tofrom_user(void __user *to,
3676 const void __user *from, unsigned long size);
3677
3678-#ifndef __powerpc64__
3679-
3680-static inline unsigned long copy_from_user(void *to,
3681- const void __user *from, unsigned long n)
3682-{
3683- unsigned long over;
3684-
3685- if (access_ok(VERIFY_READ, from, n))
3686- return __copy_tofrom_user((__force void __user *)to, from, n);
3687- if ((unsigned long)from < TASK_SIZE) {
3688- over = (unsigned long)from + n - TASK_SIZE;
3689- return __copy_tofrom_user((__force void __user *)to, from,
3690- n - over) + over;
3691- }
3692- return n;
3693-}
3694-
3695-static inline unsigned long copy_to_user(void __user *to,
3696- const void *from, unsigned long n)
3697-{
3698- unsigned long over;
3699-
3700- if (access_ok(VERIFY_WRITE, to, n))
3701- return __copy_tofrom_user(to, (__force void __user *)from, n);
3702- if ((unsigned long)to < TASK_SIZE) {
3703- over = (unsigned long)to + n - TASK_SIZE;
3704- return __copy_tofrom_user(to, (__force void __user *)from,
3705- n - over) + over;
3706- }
3707- return n;
3708-}
3709-
3710-#else /* __powerpc64__ */
3711-
3712-#define __copy_in_user(to, from, size) \
3713- __copy_tofrom_user((to), (from), (size))
3714-
3715-extern unsigned long copy_from_user(void *to, const void __user *from,
3716- unsigned long n);
3717-extern unsigned long copy_to_user(void __user *to, const void *from,
3718- unsigned long n);
3719-extern unsigned long copy_in_user(void __user *to, const void __user *from,
3720- unsigned long n);
3721-
3722-#endif /* __powerpc64__ */
3723-
3724 static inline unsigned long __copy_from_user_inatomic(void *to,
3725 const void __user *from, unsigned long n)
3726 {
3727@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
3728 if (ret == 0)
3729 return 0;
3730 }
3731+
3732+ if (!__builtin_constant_p(n))
3733+ check_object_size(to, n, false);
3734+
3735 return __copy_tofrom_user((__force void __user *)to, from, n);
3736 }
3737
3738@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
3739 if (ret == 0)
3740 return 0;
3741 }
3742+
3743+ if (!__builtin_constant_p(n))
3744+ check_object_size(from, n, true);
3745+
3746 return __copy_tofrom_user(to, (__force const void __user *)from, n);
3747 }
3748
3749@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
3750 return __copy_to_user_inatomic(to, from, size);
3751 }
3752
3753+#ifndef __powerpc64__
3754+
3755+static inline unsigned long __must_check copy_from_user(void *to,
3756+ const void __user *from, unsigned long n)
3757+{
3758+ unsigned long over;
3759+
3760+ if ((long)n < 0)
3761+ return n;
3762+
3763+ if (access_ok(VERIFY_READ, from, n)) {
3764+ if (!__builtin_constant_p(n))
3765+ check_object_size(to, n, false);
3766+ return __copy_tofrom_user((__force void __user *)to, from, n);
3767+ }
3768+ if ((unsigned long)from < TASK_SIZE) {
3769+ over = (unsigned long)from + n - TASK_SIZE;
3770+ if (!__builtin_constant_p(n - over))
3771+ check_object_size(to, n - over, false);
3772+ return __copy_tofrom_user((__force void __user *)to, from,
3773+ n - over) + over;
3774+ }
3775+ return n;
3776+}
3777+
3778+static inline unsigned long __must_check copy_to_user(void __user *to,
3779+ const void *from, unsigned long n)
3780+{
3781+ unsigned long over;
3782+
3783+ if ((long)n < 0)
3784+ return n;
3785+
3786+ if (access_ok(VERIFY_WRITE, to, n)) {
3787+ if (!__builtin_constant_p(n))
3788+ check_object_size(from, n, true);
3789+ return __copy_tofrom_user(to, (__force void __user *)from, n);
3790+ }
3791+ if ((unsigned long)to < TASK_SIZE) {
3792+ over = (unsigned long)to + n - TASK_SIZE;
3793+ if (!__builtin_constant_p(n))
3794+ check_object_size(from, n - over, true);
3795+ return __copy_tofrom_user(to, (__force void __user *)from,
3796+ n - over) + over;
3797+ }
3798+ return n;
3799+}
3800+
3801+#else /* __powerpc64__ */
3802+
3803+#define __copy_in_user(to, from, size) \
3804+ __copy_tofrom_user((to), (from), (size))
3805+
3806+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
3807+{
3808+ if ((long)n < 0 || n > INT_MAX)
3809+ return n;
3810+
3811+ if (!__builtin_constant_p(n))
3812+ check_object_size(to, n, false);
3813+
3814+ if (likely(access_ok(VERIFY_READ, from, n)))
3815+ n = __copy_from_user(to, from, n);
3816+ else
3817+ memset(to, 0, n);
3818+ return n;
3819+}
3820+
3821+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
3822+{
3823+ if ((long)n < 0 || n > INT_MAX)
3824+ return n;
3825+
3826+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
3827+ if (!__builtin_constant_p(n))
3828+ check_object_size(from, n, true);
3829+ n = __copy_to_user(to, from, n);
3830+ }
3831+ return n;
3832+}
3833+
3834+extern unsigned long copy_in_user(void __user *to, const void __user *from,
3835+ unsigned long n);
3836+
3837+#endif /* __powerpc64__ */
3838+
3839 extern unsigned long __clear_user(void __user *addr, unsigned long size);
3840
3841 static inline unsigned long clear_user(void __user *addr, unsigned long size)
3842diff -urNp linux-2.6.39.2/arch/powerpc/kernel/dma.c linux-2.6.39.2/arch/powerpc/kernel/dma.c
3843--- linux-2.6.39.2/arch/powerpc/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
3844+++ linux-2.6.39.2/arch/powerpc/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
3845@@ -136,7 +136,7 @@ static inline void dma_direct_sync_singl
3846 }
3847 #endif
3848
3849-struct dma_map_ops dma_direct_ops = {
3850+const struct dma_map_ops dma_direct_ops = {
3851 .alloc_coherent = dma_direct_alloc_coherent,
3852 .free_coherent = dma_direct_free_coherent,
3853 .map_sg = dma_direct_map_sg,
3854@@ -157,7 +157,7 @@ EXPORT_SYMBOL(dma_direct_ops);
3855
3856 int dma_set_mask(struct device *dev, u64 dma_mask)
3857 {
3858- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3859+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3860
3861 if (ppc_md.dma_set_mask)
3862 return ppc_md.dma_set_mask(dev, dma_mask);
3863diff -urNp linux-2.6.39.2/arch/powerpc/kernel/dma-iommu.c linux-2.6.39.2/arch/powerpc/kernel/dma-iommu.c
3864--- linux-2.6.39.2/arch/powerpc/kernel/dma-iommu.c 2011-05-19 00:06:34.000000000 -0400
3865+++ linux-2.6.39.2/arch/powerpc/kernel/dma-iommu.c 2011-05-22 19:36:30.000000000 -0400
3866@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
3867 }
3868
3869 /* We support DMA to/from any memory page via the iommu */
3870-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
3871+int dma_iommu_dma_supported(struct device *dev, u64 mask)
3872 {
3873 struct iommu_table *tbl = get_iommu_table_base(dev);
3874
3875@@ -90,7 +90,7 @@ static int dma_iommu_dma_supported(struc
3876 return 1;
3877 }
3878
3879-struct dma_map_ops dma_iommu_ops = {
3880+struct dma_map_ops dma_iommu_ops = { /* cannot be const, see arch/powerpc/platforms/cell/iommu.c */
3881 .alloc_coherent = dma_iommu_alloc_coherent,
3882 .free_coherent = dma_iommu_free_coherent,
3883 .map_sg = dma_iommu_map_sg,
3884diff -urNp linux-2.6.39.2/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.39.2/arch/powerpc/kernel/dma-swiotlb.c
3885--- linux-2.6.39.2/arch/powerpc/kernel/dma-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
3886+++ linux-2.6.39.2/arch/powerpc/kernel/dma-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
3887@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
3888 * map_page, and unmap_page on highmem, use normal dma_ops
3889 * for everything else.
3890 */
3891-struct dma_map_ops swiotlb_dma_ops = {
3892+const struct dma_map_ops swiotlb_dma_ops = {
3893 .alloc_coherent = dma_direct_alloc_coherent,
3894 .free_coherent = dma_direct_free_coherent,
3895 .map_sg = swiotlb_map_sg_attrs,
3896diff -urNp linux-2.6.39.2/arch/powerpc/kernel/exceptions-64e.S linux-2.6.39.2/arch/powerpc/kernel/exceptions-64e.S
3897--- linux-2.6.39.2/arch/powerpc/kernel/exceptions-64e.S 2011-05-19 00:06:34.000000000 -0400
3898+++ linux-2.6.39.2/arch/powerpc/kernel/exceptions-64e.S 2011-05-22 19:36:30.000000000 -0400
3899@@ -495,6 +495,7 @@ storage_fault_common:
3900 std r14,_DAR(r1)
3901 std r15,_DSISR(r1)
3902 addi r3,r1,STACK_FRAME_OVERHEAD
3903+ bl .save_nvgprs
3904 mr r4,r14
3905 mr r5,r15
3906 ld r14,PACA_EXGEN+EX_R14(r13)
3907@@ -504,8 +505,7 @@ storage_fault_common:
3908 cmpdi r3,0
3909 bne- 1f
3910 b .ret_from_except_lite
3911-1: bl .save_nvgprs
3912- mr r5,r3
3913+1: mr r5,r3
3914 addi r3,r1,STACK_FRAME_OVERHEAD
3915 ld r4,_DAR(r1)
3916 bl .bad_page_fault
3917diff -urNp linux-2.6.39.2/arch/powerpc/kernel/exceptions-64s.S linux-2.6.39.2/arch/powerpc/kernel/exceptions-64s.S
3918--- linux-2.6.39.2/arch/powerpc/kernel/exceptions-64s.S 2011-05-19 00:06:34.000000000 -0400
3919+++ linux-2.6.39.2/arch/powerpc/kernel/exceptions-64s.S 2011-05-22 19:36:30.000000000 -0400
3920@@ -848,10 +848,10 @@ handle_page_fault:
3921 11: ld r4,_DAR(r1)
3922 ld r5,_DSISR(r1)
3923 addi r3,r1,STACK_FRAME_OVERHEAD
3924+ bl .save_nvgprs
3925 bl .do_page_fault
3926 cmpdi r3,0
3927 beq+ 13f
3928- bl .save_nvgprs
3929 mr r5,r3
3930 addi r3,r1,STACK_FRAME_OVERHEAD
3931 lwz r4,_DAR(r1)
3932diff -urNp linux-2.6.39.2/arch/powerpc/kernel/ibmebus.c linux-2.6.39.2/arch/powerpc/kernel/ibmebus.c
3933--- linux-2.6.39.2/arch/powerpc/kernel/ibmebus.c 2011-05-19 00:06:34.000000000 -0400
3934+++ linux-2.6.39.2/arch/powerpc/kernel/ibmebus.c 2011-05-22 19:36:30.000000000 -0400
3935@@ -128,7 +128,7 @@ static int ibmebus_dma_supported(struct
3936 return 1;
3937 }
3938
3939-static struct dma_map_ops ibmebus_dma_ops = {
3940+static const struct dma_map_ops ibmebus_dma_ops = {
3941 .alloc_coherent = ibmebus_alloc_coherent,
3942 .free_coherent = ibmebus_free_coherent,
3943 .map_sg = ibmebus_map_sg,
3944diff -urNp linux-2.6.39.2/arch/powerpc/kernel/kgdb.c linux-2.6.39.2/arch/powerpc/kernel/kgdb.c
3945--- linux-2.6.39.2/arch/powerpc/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
3946+++ linux-2.6.39.2/arch/powerpc/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
3947@@ -422,7 +422,7 @@ int kgdb_arch_handle_exception(int vecto
3948 /*
3949 * Global data
3950 */
3951-struct kgdb_arch arch_kgdb_ops = {
3952+const struct kgdb_arch arch_kgdb_ops = {
3953 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
3954 };
3955
3956diff -urNp linux-2.6.39.2/arch/powerpc/kernel/module_32.c linux-2.6.39.2/arch/powerpc/kernel/module_32.c
3957--- linux-2.6.39.2/arch/powerpc/kernel/module_32.c 2011-05-19 00:06:34.000000000 -0400
3958+++ linux-2.6.39.2/arch/powerpc/kernel/module_32.c 2011-05-22 19:36:30.000000000 -0400
3959@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
3960 me->arch.core_plt_section = i;
3961 }
3962 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
3963- printk("Module doesn't contain .plt or .init.plt sections.\n");
3964+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
3965 return -ENOEXEC;
3966 }
3967
3968@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
3969
3970 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
3971 /* Init, or core PLT? */
3972- if (location >= mod->module_core
3973- && location < mod->module_core + mod->core_size)
3974+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
3975+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
3976 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
3977- else
3978+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
3979+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
3980 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
3981+ else {
3982+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
3983+ return ~0UL;
3984+ }
3985
3986 /* Find this entry, or if that fails, the next avail. entry */
3987 while (entry->jump[0]) {
3988diff -urNp linux-2.6.39.2/arch/powerpc/kernel/module.c linux-2.6.39.2/arch/powerpc/kernel/module.c
3989--- linux-2.6.39.2/arch/powerpc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
3990+++ linux-2.6.39.2/arch/powerpc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
3991@@ -31,11 +31,24 @@
3992
3993 LIST_HEAD(module_bug_list);
3994
3995+#ifdef CONFIG_PAX_KERNEXEC
3996 void *module_alloc(unsigned long size)
3997 {
3998 if (size == 0)
3999 return NULL;
4000
4001+ return vmalloc(size);
4002+}
4003+
4004+void *module_alloc_exec(unsigned long size)
4005+#else
4006+void *module_alloc(unsigned long size)
4007+#endif
4008+
4009+{
4010+ if (size == 0)
4011+ return NULL;
4012+
4013 return vmalloc_exec(size);
4014 }
4015
4016@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
4017 vfree(module_region);
4018 }
4019
4020+#ifdef CONFIG_PAX_KERNEXEC
4021+void module_free_exec(struct module *mod, void *module_region)
4022+{
4023+ module_free(mod, module_region);
4024+}
4025+#endif
4026+
4027 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
4028 const Elf_Shdr *sechdrs,
4029 const char *name)
4030diff -urNp linux-2.6.39.2/arch/powerpc/kernel/pci-common.c linux-2.6.39.2/arch/powerpc/kernel/pci-common.c
4031--- linux-2.6.39.2/arch/powerpc/kernel/pci-common.c 2011-05-19 00:06:34.000000000 -0400
4032+++ linux-2.6.39.2/arch/powerpc/kernel/pci-common.c 2011-05-22 19:36:30.000000000 -0400
4033@@ -53,14 +53,14 @@ resource_size_t isa_mem_base;
4034 unsigned int ppc_pci_flags = 0;
4035
4036
4037-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
4038+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
4039
4040-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
4041+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
4042 {
4043 pci_dma_ops = dma_ops;
4044 }
4045
4046-struct dma_map_ops *get_pci_dma_ops(void)
4047+const struct dma_map_ops *get_pci_dma_ops(void)
4048 {
4049 return pci_dma_ops;
4050 }
4051@@ -1639,7 +1639,7 @@ null_write_config(struct pci_bus *bus, u
4052 return PCIBIOS_DEVICE_NOT_FOUND;
4053 }
4054
4055-static struct pci_ops null_pci_ops =
4056+static const struct pci_ops null_pci_ops =
4057 {
4058 .read = null_read_config,
4059 .write = null_write_config,
4060diff -urNp linux-2.6.39.2/arch/powerpc/kernel/process.c linux-2.6.39.2/arch/powerpc/kernel/process.c
4061--- linux-2.6.39.2/arch/powerpc/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4062+++ linux-2.6.39.2/arch/powerpc/kernel/process.c 2011-05-22 19:41:32.000000000 -0400
4063@@ -655,8 +655,8 @@ void show_regs(struct pt_regs * regs)
4064 * Lookup NIP late so we have the best change of getting the
4065 * above info out without failing
4066 */
4067- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
4068- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
4069+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
4070+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
4071 #endif
4072 show_stack(current, (unsigned long *) regs->gpr[1]);
4073 if (!user_mode(regs))
4074@@ -1146,10 +1146,10 @@ void show_stack(struct task_struct *tsk,
4075 newsp = stack[0];
4076 ip = stack[STACK_FRAME_LR_SAVE];
4077 if (!firstframe || ip != lr) {
4078- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
4079+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
4080 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
4081 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
4082- printk(" (%pS)",
4083+ printk(" (%pA)",
4084 (void *)current->ret_stack[curr_frame].ret);
4085 curr_frame--;
4086 }
4087@@ -1169,7 +1169,7 @@ void show_stack(struct task_struct *tsk,
4088 struct pt_regs *regs = (struct pt_regs *)
4089 (sp + STACK_FRAME_OVERHEAD);
4090 lr = regs->link;
4091- printk("--- Exception: %lx at %pS\n LR = %pS\n",
4092+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
4093 regs->trap, (void *)regs->nip, (void *)lr);
4094 firstframe = 1;
4095 }
4096@@ -1244,58 +1244,3 @@ void thread_info_cache_init(void)
4097 }
4098
4099 #endif /* THREAD_SHIFT < PAGE_SHIFT */
4100-
4101-unsigned long arch_align_stack(unsigned long sp)
4102-{
4103- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4104- sp -= get_random_int() & ~PAGE_MASK;
4105- return sp & ~0xf;
4106-}
4107-
4108-static inline unsigned long brk_rnd(void)
4109-{
4110- unsigned long rnd = 0;
4111-
4112- /* 8MB for 32bit, 1GB for 64bit */
4113- if (is_32bit_task())
4114- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
4115- else
4116- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
4117-
4118- return rnd << PAGE_SHIFT;
4119-}
4120-
4121-unsigned long arch_randomize_brk(struct mm_struct *mm)
4122-{
4123- unsigned long base = mm->brk;
4124- unsigned long ret;
4125-
4126-#ifdef CONFIG_PPC_STD_MMU_64
4127- /*
4128- * If we are using 1TB segments and we are allowed to randomise
4129- * the heap, we can put it above 1TB so it is backed by a 1TB
4130- * segment. Otherwise the heap will be in the bottom 1TB
4131- * which always uses 256MB segments and this may result in a
4132- * performance penalty.
4133- */
4134- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
4135- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
4136-#endif
4137-
4138- ret = PAGE_ALIGN(base + brk_rnd());
4139-
4140- if (ret < mm->brk)
4141- return mm->brk;
4142-
4143- return ret;
4144-}
4145-
4146-unsigned long randomize_et_dyn(unsigned long base)
4147-{
4148- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4149-
4150- if (ret < base)
4151- return base;
4152-
4153- return ret;
4154-}
4155diff -urNp linux-2.6.39.2/arch/powerpc/kernel/rtas_pci.c linux-2.6.39.2/arch/powerpc/kernel/rtas_pci.c
4156--- linux-2.6.39.2/arch/powerpc/kernel/rtas_pci.c 2011-05-19 00:06:34.000000000 -0400
4157+++ linux-2.6.39.2/arch/powerpc/kernel/rtas_pci.c 2011-05-22 19:36:30.000000000 -0400
4158@@ -149,7 +149,7 @@ static int rtas_pci_write_config(struct
4159 return PCIBIOS_DEVICE_NOT_FOUND;
4160 }
4161
4162-static struct pci_ops rtas_pci_ops = {
4163+static const struct pci_ops rtas_pci_ops = {
4164 .read = rtas_pci_read_config,
4165 .write = rtas_pci_write_config,
4166 };
4167diff -urNp linux-2.6.39.2/arch/powerpc/kernel/signal_32.c linux-2.6.39.2/arch/powerpc/kernel/signal_32.c
4168--- linux-2.6.39.2/arch/powerpc/kernel/signal_32.c 2011-05-19 00:06:34.000000000 -0400
4169+++ linux-2.6.39.2/arch/powerpc/kernel/signal_32.c 2011-05-22 19:36:30.000000000 -0400
4170@@ -858,7 +858,7 @@ int handle_rt_signal32(unsigned long sig
4171 /* Save user registers on the stack */
4172 frame = &rt_sf->uc.uc_mcontext;
4173 addr = frame;
4174- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
4175+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
4176 if (save_user_regs(regs, frame, 0, 1))
4177 goto badframe;
4178 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
4179diff -urNp linux-2.6.39.2/arch/powerpc/kernel/signal_64.c linux-2.6.39.2/arch/powerpc/kernel/signal_64.c
4180--- linux-2.6.39.2/arch/powerpc/kernel/signal_64.c 2011-05-19 00:06:34.000000000 -0400
4181+++ linux-2.6.39.2/arch/powerpc/kernel/signal_64.c 2011-05-22 19:36:30.000000000 -0400
4182@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
4183 current->thread.fpscr.val = 0;
4184
4185 /* Set up to return from userspace. */
4186- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
4187+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
4188 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
4189 } else {
4190 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
4191diff -urNp linux-2.6.39.2/arch/powerpc/kernel/traps.c linux-2.6.39.2/arch/powerpc/kernel/traps.c
4192--- linux-2.6.39.2/arch/powerpc/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
4193+++ linux-2.6.39.2/arch/powerpc/kernel/traps.c 2011-06-13 21:33:04.000000000 -0400
4194@@ -96,6 +96,8 @@ static void pmac_backlight_unblank(void)
4195 static inline void pmac_backlight_unblank(void) { }
4196 #endif
4197
4198+extern void gr_handle_kernel_exploit(void);
4199+
4200 int die(const char *str, struct pt_regs *regs, long err)
4201 {
4202 static struct {
4203@@ -170,6 +172,8 @@ int die(const char *str, struct pt_regs
4204 if (panic_on_oops)
4205 panic("Fatal exception");
4206
4207+ gr_handle_kernel_exploit();
4208+
4209 oops_exit();
4210 do_exit(err);
4211
4212diff -urNp linux-2.6.39.2/arch/powerpc/kernel/vdso.c linux-2.6.39.2/arch/powerpc/kernel/vdso.c
4213--- linux-2.6.39.2/arch/powerpc/kernel/vdso.c 2011-05-19 00:06:34.000000000 -0400
4214+++ linux-2.6.39.2/arch/powerpc/kernel/vdso.c 2011-05-22 19:36:30.000000000 -0400
4215@@ -36,6 +36,7 @@
4216 #include <asm/firmware.h>
4217 #include <asm/vdso.h>
4218 #include <asm/vdso_datapage.h>
4219+#include <asm/mman.h>
4220
4221 #include "setup.h"
4222
4223@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
4224 vdso_base = VDSO32_MBASE;
4225 #endif
4226
4227- current->mm->context.vdso_base = 0;
4228+ current->mm->context.vdso_base = ~0UL;
4229
4230 /* vDSO has a problem and was disabled, just don't "enable" it for the
4231 * process
4232@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
4233 vdso_base = get_unmapped_area(NULL, vdso_base,
4234 (vdso_pages << PAGE_SHIFT) +
4235 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
4236- 0, 0);
4237+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
4238 if (IS_ERR_VALUE(vdso_base)) {
4239 rc = vdso_base;
4240 goto fail_mmapsem;
4241diff -urNp linux-2.6.39.2/arch/powerpc/kernel/vio.c linux-2.6.39.2/arch/powerpc/kernel/vio.c
4242--- linux-2.6.39.2/arch/powerpc/kernel/vio.c 2011-05-19 00:06:34.000000000 -0400
4243+++ linux-2.6.39.2/arch/powerpc/kernel/vio.c 2011-05-22 19:36:30.000000000 -0400
4244@@ -605,11 +605,12 @@ static int vio_dma_iommu_dma_supported(s
4245 return dma_iommu_ops.dma_supported(dev, mask);
4246 }
4247
4248-struct dma_map_ops vio_dma_mapping_ops = {
4249+const struct dma_map_ops vio_dma_mapping_ops = {
4250 .alloc_coherent = vio_dma_iommu_alloc_coherent,
4251 .free_coherent = vio_dma_iommu_free_coherent,
4252 .map_sg = vio_dma_iommu_map_sg,
4253 .unmap_sg = vio_dma_iommu_unmap_sg,
4254+ .dma_supported = dma_iommu_dma_supported,
4255 .map_page = vio_dma_iommu_map_page,
4256 .unmap_page = vio_dma_iommu_unmap_page,
4257 .dma_supported = vio_dma_iommu_dma_supported,
4258diff -urNp linux-2.6.39.2/arch/powerpc/lib/usercopy_64.c linux-2.6.39.2/arch/powerpc/lib/usercopy_64.c
4259--- linux-2.6.39.2/arch/powerpc/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
4260+++ linux-2.6.39.2/arch/powerpc/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
4261@@ -9,22 +9,6 @@
4262 #include <linux/module.h>
4263 #include <asm/uaccess.h>
4264
4265-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4266-{
4267- if (likely(access_ok(VERIFY_READ, from, n)))
4268- n = __copy_from_user(to, from, n);
4269- else
4270- memset(to, 0, n);
4271- return n;
4272-}
4273-
4274-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4275-{
4276- if (likely(access_ok(VERIFY_WRITE, to, n)))
4277- n = __copy_to_user(to, from, n);
4278- return n;
4279-}
4280-
4281 unsigned long copy_in_user(void __user *to, const void __user *from,
4282 unsigned long n)
4283 {
4284@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
4285 return n;
4286 }
4287
4288-EXPORT_SYMBOL(copy_from_user);
4289-EXPORT_SYMBOL(copy_to_user);
4290 EXPORT_SYMBOL(copy_in_user);
4291
4292diff -urNp linux-2.6.39.2/arch/powerpc/mm/fault.c linux-2.6.39.2/arch/powerpc/mm/fault.c
4293--- linux-2.6.39.2/arch/powerpc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
4294+++ linux-2.6.39.2/arch/powerpc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
4295@@ -31,6 +31,10 @@
4296 #include <linux/kdebug.h>
4297 #include <linux/perf_event.h>
4298 #include <linux/magic.h>
4299+#include <linux/slab.h>
4300+#include <linux/pagemap.h>
4301+#include <linux/compiler.h>
4302+#include <linux/unistd.h>
4303
4304 #include <asm/firmware.h>
4305 #include <asm/page.h>
4306@@ -42,6 +46,7 @@
4307 #include <asm/tlbflush.h>
4308 #include <asm/siginfo.h>
4309 #include <mm/mmu_decl.h>
4310+#include <asm/ptrace.h>
4311
4312 #ifdef CONFIG_KPROBES
4313 static inline int notify_page_fault(struct pt_regs *regs)
4314@@ -65,6 +70,33 @@ static inline int notify_page_fault(stru
4315 }
4316 #endif
4317
4318+#ifdef CONFIG_PAX_PAGEEXEC
4319+/*
4320+ * PaX: decide what to do with offenders (regs->nip = fault address)
4321+ *
4322+ * returns 1 when task should be killed
4323+ */
4324+static int pax_handle_fetch_fault(struct pt_regs *regs)
4325+{
4326+ return 1;
4327+}
4328+
4329+void pax_report_insns(void *pc, void *sp)
4330+{
4331+ unsigned long i;
4332+
4333+ printk(KERN_ERR "PAX: bytes at PC: ");
4334+ for (i = 0; i < 5; i++) {
4335+ unsigned int c;
4336+ if (get_user(c, (unsigned int __user *)pc+i))
4337+ printk(KERN_CONT "???????? ");
4338+ else
4339+ printk(KERN_CONT "%08x ", c);
4340+ }
4341+ printk("\n");
4342+}
4343+#endif
4344+
4345 /*
4346 * Check whether the instruction at regs->nip is a store using
4347 * an update addressing form which will update r1.
4348@@ -135,7 +167,7 @@ int __kprobes do_page_fault(struct pt_re
4349 * indicate errors in DSISR but can validly be set in SRR1.
4350 */
4351 if (trap == 0x400)
4352- error_code &= 0x48200000;
4353+ error_code &= 0x58200000;
4354 else
4355 is_write = error_code & DSISR_ISSTORE;
4356 #else
4357@@ -258,7 +290,7 @@ good_area:
4358 * "undefined". Of those that can be set, this is the only
4359 * one which seems bad.
4360 */
4361- if (error_code & 0x10000000)
4362+ if (error_code & DSISR_GUARDED)
4363 /* Guarded storage error. */
4364 goto bad_area;
4365 #endif /* CONFIG_8xx */
4366@@ -273,7 +305,7 @@ good_area:
4367 * processors use the same I/D cache coherency mechanism
4368 * as embedded.
4369 */
4370- if (error_code & DSISR_PROTFAULT)
4371+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
4372 goto bad_area;
4373 #endif /* CONFIG_PPC_STD_MMU */
4374
4375@@ -342,6 +374,23 @@ bad_area:
4376 bad_area_nosemaphore:
4377 /* User mode accesses cause a SIGSEGV */
4378 if (user_mode(regs)) {
4379+
4380+#ifdef CONFIG_PAX_PAGEEXEC
4381+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
4382+#ifdef CONFIG_PPC_STD_MMU
4383+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
4384+#else
4385+ if (is_exec && regs->nip == address) {
4386+#endif
4387+ switch (pax_handle_fetch_fault(regs)) {
4388+ }
4389+
4390+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
4391+ do_group_exit(SIGKILL);
4392+ }
4393+ }
4394+#endif
4395+
4396 _exception(SIGSEGV, regs, code, address);
4397 return 0;
4398 }
4399diff -urNp linux-2.6.39.2/arch/powerpc/mm/mmap_64.c linux-2.6.39.2/arch/powerpc/mm/mmap_64.c
4400--- linux-2.6.39.2/arch/powerpc/mm/mmap_64.c 2011-05-19 00:06:34.000000000 -0400
4401+++ linux-2.6.39.2/arch/powerpc/mm/mmap_64.c 2011-05-22 19:36:30.000000000 -0400
4402@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
4403 */
4404 if (mmap_is_legacy()) {
4405 mm->mmap_base = TASK_UNMAPPED_BASE;
4406+
4407+#ifdef CONFIG_PAX_RANDMMAP
4408+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4409+ mm->mmap_base += mm->delta_mmap;
4410+#endif
4411+
4412 mm->get_unmapped_area = arch_get_unmapped_area;
4413 mm->unmap_area = arch_unmap_area;
4414 } else {
4415 mm->mmap_base = mmap_base();
4416+
4417+#ifdef CONFIG_PAX_RANDMMAP
4418+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4419+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4420+#endif
4421+
4422 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4423 mm->unmap_area = arch_unmap_area_topdown;
4424 }
4425diff -urNp linux-2.6.39.2/arch/powerpc/mm/slice.c linux-2.6.39.2/arch/powerpc/mm/slice.c
4426--- linux-2.6.39.2/arch/powerpc/mm/slice.c 2011-05-19 00:06:34.000000000 -0400
4427+++ linux-2.6.39.2/arch/powerpc/mm/slice.c 2011-05-22 19:36:30.000000000 -0400
4428@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
4429 if ((mm->task_size - len) < addr)
4430 return 0;
4431 vma = find_vma(mm, addr);
4432- return (!vma || (addr + len) <= vma->vm_start);
4433+ return check_heap_stack_gap(vma, addr, len);
4434 }
4435
4436 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
4437@@ -256,7 +256,7 @@ full_search:
4438 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
4439 continue;
4440 }
4441- if (!vma || addr + len <= vma->vm_start) {
4442+ if (check_heap_stack_gap(vma, addr, len)) {
4443 /*
4444 * Remember the place where we stopped the search:
4445 */
4446@@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
4447 }
4448 }
4449
4450- addr = mm->mmap_base;
4451- while (addr > len) {
4452+ if (mm->mmap_base < len)
4453+ addr = -ENOMEM;
4454+ else
4455+ addr = mm->mmap_base - len;
4456+
4457+ while (!IS_ERR_VALUE(addr)) {
4458 /* Go down by chunk size */
4459- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
4460+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
4461
4462 /* Check for hit with different page size */
4463 mask = slice_range_to_mask(addr, len);
4464@@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
4465 * return with success:
4466 */
4467 vma = find_vma(mm, addr);
4468- if (!vma || (addr + len) <= vma->vm_start) {
4469+ if (check_heap_stack_gap(vma, addr, len)) {
4470 /* remember the address as a hint for next time */
4471 if (use_cache)
4472 mm->free_area_cache = addr;
4473@@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
4474 mm->cached_hole_size = vma->vm_start - addr;
4475
4476 /* try just below the current vma->vm_start */
4477- addr = vma->vm_start;
4478+ addr = skip_heap_stack_gap(vma, len);
4479 }
4480
4481 /*
4482@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
4483 if (fixed && addr > (mm->task_size - len))
4484 return -EINVAL;
4485
4486+#ifdef CONFIG_PAX_RANDMMAP
4487+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
4488+ addr = 0;
4489+#endif
4490+
4491 /* If hint, make sure it matches our alignment restrictions */
4492 if (!fixed && addr) {
4493 addr = _ALIGN_UP(addr, 1ul << pshift);
4494diff -urNp linux-2.6.39.2/arch/powerpc/platforms/52xx/efika.c linux-2.6.39.2/arch/powerpc/platforms/52xx/efika.c
4495--- linux-2.6.39.2/arch/powerpc/platforms/52xx/efika.c 2011-05-19 00:06:34.000000000 -0400
4496+++ linux-2.6.39.2/arch/powerpc/platforms/52xx/efika.c 2011-05-22 19:36:30.000000000 -0400
4497@@ -60,7 +60,7 @@ static int rtas_write_config(struct pci_
4498 return rval ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
4499 }
4500
4501-static struct pci_ops rtas_pci_ops = {
4502+static const struct pci_ops rtas_pci_ops = {
4503 .read = rtas_read_config,
4504 .write = rtas_write_config,
4505 };
4506diff -urNp linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_pci.c linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_pci.c
4507--- linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-19 00:06:34.000000000 -0400
4508+++ linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-22 19:36:30.000000000 -0400
4509@@ -234,7 +234,7 @@ static int celleb_fake_pci_write_config(
4510 return PCIBIOS_SUCCESSFUL;
4511 }
4512
4513-static struct pci_ops celleb_fake_pci_ops = {
4514+static const struct pci_ops celleb_fake_pci_ops = {
4515 .read = celleb_fake_pci_read_config,
4516 .write = celleb_fake_pci_write_config,
4517 };
4518diff -urNp linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_epci.c linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_epci.c
4519--- linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-19 00:06:34.000000000 -0400
4520+++ linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-22 19:36:30.000000000 -0400
4521@@ -245,7 +245,7 @@ static int celleb_epci_write_config(stru
4522 return celleb_epci_check_abort(hose, addr);
4523 }
4524
4525-struct pci_ops celleb_epci_ops = {
4526+const struct pci_ops celleb_epci_ops = {
4527 .read = celleb_epci_read_config,
4528 .write = celleb_epci_write_config,
4529 };
4530diff -urNp linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_pciex.c linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_pciex.c
4531--- linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-19 00:06:34.000000000 -0400
4532+++ linux-2.6.39.2/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-22 19:36:30.000000000 -0400
4533@@ -399,7 +399,7 @@ static int scc_pciex_write_config(struct
4534 return PCIBIOS_SUCCESSFUL;
4535 }
4536
4537-static struct pci_ops scc_pciex_pci_ops = {
4538+static const struct pci_ops scc_pciex_pci_ops = {
4539 scc_pciex_read_config,
4540 scc_pciex_write_config,
4541 };
4542diff -urNp linux-2.6.39.2/arch/powerpc/platforms/cell/iommu.c linux-2.6.39.2/arch/powerpc/platforms/cell/iommu.c
4543--- linux-2.6.39.2/arch/powerpc/platforms/cell/iommu.c 2011-05-19 00:06:34.000000000 -0400
4544+++ linux-2.6.39.2/arch/powerpc/platforms/cell/iommu.c 2011-05-22 19:36:30.000000000 -0400
4545@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
4546
4547 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
4548
4549-struct dma_map_ops dma_iommu_fixed_ops = {
4550+const struct dma_map_ops dma_iommu_fixed_ops = {
4551 .alloc_coherent = dma_fixed_alloc_coherent,
4552 .free_coherent = dma_fixed_free_coherent,
4553 .map_sg = dma_fixed_map_sg,
4554diff -urNp linux-2.6.39.2/arch/powerpc/platforms/chrp/pci.c linux-2.6.39.2/arch/powerpc/platforms/chrp/pci.c
4555--- linux-2.6.39.2/arch/powerpc/platforms/chrp/pci.c 2011-05-19 00:06:34.000000000 -0400
4556+++ linux-2.6.39.2/arch/powerpc/platforms/chrp/pci.c 2011-05-22 19:36:30.000000000 -0400
4557@@ -84,7 +84,7 @@ int gg2_write_config(struct pci_bus *bus
4558 return PCIBIOS_SUCCESSFUL;
4559 }
4560
4561-static struct pci_ops gg2_pci_ops =
4562+static const struct pci_ops gg2_pci_ops =
4563 {
4564 .read = gg2_read_config,
4565 .write = gg2_write_config,
4566@@ -122,7 +122,7 @@ int rtas_write_config(struct pci_bus *bu
4567 return rval? PCIBIOS_DEVICE_NOT_FOUND: PCIBIOS_SUCCESSFUL;
4568 }
4569
4570-static struct pci_ops rtas_pci_ops =
4571+static const struct pci_ops rtas_pci_ops =
4572 {
4573 .read = rtas_read_config,
4574 .write = rtas_write_config,
4575diff -urNp linux-2.6.39.2/arch/powerpc/platforms/iseries/pci.c linux-2.6.39.2/arch/powerpc/platforms/iseries/pci.c
4576--- linux-2.6.39.2/arch/powerpc/platforms/iseries/pci.c 2011-05-19 00:06:34.000000000 -0400
4577+++ linux-2.6.39.2/arch/powerpc/platforms/iseries/pci.c 2011-05-22 19:36:30.000000000 -0400
4578@@ -533,7 +533,7 @@ static int iSeries_pci_write_config(stru
4579 return 0;
4580 }
4581
4582-static struct pci_ops iSeries_pci_ops = {
4583+static const struct pci_ops iSeries_pci_ops = {
4584 .read = iSeries_pci_read_config,
4585 .write = iSeries_pci_write_config
4586 };
4587diff -urNp linux-2.6.39.2/arch/powerpc/platforms/maple/pci.c linux-2.6.39.2/arch/powerpc/platforms/maple/pci.c
4588--- linux-2.6.39.2/arch/powerpc/platforms/maple/pci.c 2011-05-19 00:06:34.000000000 -0400
4589+++ linux-2.6.39.2/arch/powerpc/platforms/maple/pci.c 2011-05-22 19:36:30.000000000 -0400
4590@@ -180,7 +180,7 @@ static int u3_agp_write_config(struct pc
4591 return PCIBIOS_SUCCESSFUL;
4592 }
4593
4594-static struct pci_ops u3_agp_pci_ops =
4595+static const struct pci_ops u3_agp_pci_ops =
4596 {
4597 .read = u3_agp_read_config,
4598 .write = u3_agp_write_config,
4599@@ -276,7 +276,7 @@ static int u3_ht_write_config(struct pci
4600 return PCIBIOS_SUCCESSFUL;
4601 }
4602
4603-static struct pci_ops u3_ht_pci_ops =
4604+static const struct pci_ops u3_ht_pci_ops =
4605 {
4606 .read = u3_ht_read_config,
4607 .write = u3_ht_write_config,
4608@@ -381,7 +381,7 @@ static int u4_pcie_write_config(struct p
4609 return PCIBIOS_SUCCESSFUL;
4610 }
4611
4612-static struct pci_ops u4_pcie_pci_ops =
4613+static const struct pci_ops u4_pcie_pci_ops =
4614 {
4615 .read = u4_pcie_read_config,
4616 .write = u4_pcie_write_config,
4617diff -urNp linux-2.6.39.2/arch/powerpc/platforms/pasemi/pci.c linux-2.6.39.2/arch/powerpc/platforms/pasemi/pci.c
4618--- linux-2.6.39.2/arch/powerpc/platforms/pasemi/pci.c 2011-05-19 00:06:34.000000000 -0400
4619+++ linux-2.6.39.2/arch/powerpc/platforms/pasemi/pci.c 2011-05-22 19:36:30.000000000 -0400
4620@@ -176,7 +176,7 @@ static int pa_pxp_write_config(struct pc
4621 return PCIBIOS_SUCCESSFUL;
4622 }
4623
4624-static struct pci_ops pa_pxp_ops = {
4625+static const struct pci_ops pa_pxp_ops = {
4626 .read = pa_pxp_read_config,
4627 .write = pa_pxp_write_config,
4628 };
4629diff -urNp linux-2.6.39.2/arch/powerpc/platforms/powermac/pci.c linux-2.6.39.2/arch/powerpc/platforms/powermac/pci.c
4630--- linux-2.6.39.2/arch/powerpc/platforms/powermac/pci.c 2011-05-19 00:06:34.000000000 -0400
4631+++ linux-2.6.39.2/arch/powerpc/platforms/powermac/pci.c 2011-05-22 19:36:30.000000000 -0400
4632@@ -218,7 +218,7 @@ static int macrisc_write_config(struct p
4633 return PCIBIOS_SUCCESSFUL;
4634 }
4635
4636-static struct pci_ops macrisc_pci_ops =
4637+static const struct pci_ops macrisc_pci_ops =
4638 {
4639 .read = macrisc_read_config,
4640 .write = macrisc_write_config,
4641@@ -273,7 +273,7 @@ chaos_write_config(struct pci_bus *bus,
4642 return macrisc_write_config(bus, devfn, offset, len, val);
4643 }
4644
4645-static struct pci_ops chaos_pci_ops =
4646+static const struct pci_ops chaos_pci_ops =
4647 {
4648 .read = chaos_read_config,
4649 .write = chaos_write_config,
4650diff -urNp linux-2.6.39.2/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.39.2/arch/powerpc/platforms/ps3/system-bus.c
4651--- linux-2.6.39.2/arch/powerpc/platforms/ps3/system-bus.c 2011-05-19 00:06:34.000000000 -0400
4652+++ linux-2.6.39.2/arch/powerpc/platforms/ps3/system-bus.c 2011-05-22 19:36:30.000000000 -0400
4653@@ -695,7 +695,7 @@ static int ps3_dma_supported(struct devi
4654 return mask >= DMA_BIT_MASK(32);
4655 }
4656
4657-static struct dma_map_ops ps3_sb_dma_ops = {
4658+static const struct dma_map_ops ps3_sb_dma_ops = {
4659 .alloc_coherent = ps3_alloc_coherent,
4660 .free_coherent = ps3_free_coherent,
4661 .map_sg = ps3_sb_map_sg,
4662@@ -705,7 +705,7 @@ static struct dma_map_ops ps3_sb_dma_ops
4663 .unmap_page = ps3_unmap_page,
4664 };
4665
4666-static struct dma_map_ops ps3_ioc0_dma_ops = {
4667+static const struct dma_map_ops ps3_ioc0_dma_ops = {
4668 .alloc_coherent = ps3_alloc_coherent,
4669 .free_coherent = ps3_free_coherent,
4670 .map_sg = ps3_ioc0_map_sg,
4671diff -urNp linux-2.6.39.2/arch/powerpc/sysdev/fsl_pci.c linux-2.6.39.2/arch/powerpc/sysdev/fsl_pci.c
4672--- linux-2.6.39.2/arch/powerpc/sysdev/fsl_pci.c 2011-05-19 00:06:34.000000000 -0400
4673+++ linux-2.6.39.2/arch/powerpc/sysdev/fsl_pci.c 2011-05-22 19:36:30.000000000 -0400
4674@@ -573,7 +573,7 @@ static int mpc83xx_pcie_write_config(str
4675 return PCIBIOS_SUCCESSFUL;
4676 }
4677
4678-static struct pci_ops mpc83xx_pcie_ops = {
4679+static const struct pci_ops mpc83xx_pcie_ops = {
4680 .read = mpc83xx_pcie_read_config,
4681 .write = mpc83xx_pcie_write_config,
4682 };
4683diff -urNp linux-2.6.39.2/arch/powerpc/sysdev/indirect_pci.c linux-2.6.39.2/arch/powerpc/sysdev/indirect_pci.c
4684--- linux-2.6.39.2/arch/powerpc/sysdev/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
4685+++ linux-2.6.39.2/arch/powerpc/sysdev/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
4686@@ -148,7 +148,7 @@ indirect_write_config(struct pci_bus *bu
4687 return PCIBIOS_SUCCESSFUL;
4688 }
4689
4690-static struct pci_ops indirect_pci_ops =
4691+static const struct pci_ops indirect_pci_ops =
4692 {
4693 .read = indirect_read_config,
4694 .write = indirect_write_config,
4695diff -urNp linux-2.6.39.2/arch/powerpc/sysdev/ppc4xx_pci.c linux-2.6.39.2/arch/powerpc/sysdev/ppc4xx_pci.c
4696--- linux-2.6.39.2/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-19 00:06:34.000000000 -0400
4697+++ linux-2.6.39.2/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-22 19:36:30.000000000 -0400
4698@@ -1514,7 +1514,7 @@ static int ppc4xx_pciex_write_config(str
4699 return PCIBIOS_SUCCESSFUL;
4700 }
4701
4702-static struct pci_ops ppc4xx_pciex_pci_ops =
4703+static const struct pci_ops ppc4xx_pciex_pci_ops =
4704 {
4705 .read = ppc4xx_pciex_read_config,
4706 .write = ppc4xx_pciex_write_config,
4707diff -urNp linux-2.6.39.2/arch/powerpc/sysdev/tsi108_pci.c linux-2.6.39.2/arch/powerpc/sysdev/tsi108_pci.c
4708--- linux-2.6.39.2/arch/powerpc/sysdev/tsi108_pci.c 2011-05-19 00:06:34.000000000 -0400
4709+++ linux-2.6.39.2/arch/powerpc/sysdev/tsi108_pci.c 2011-05-22 19:36:30.000000000 -0400
4710@@ -190,7 +190,7 @@ void tsi108_clear_pci_cfg_error(void)
4711 tsi108_clear_pci_error(tsi108_pci_cfg_phys);
4712 }
4713
4714-static struct pci_ops tsi108_direct_pci_ops = {
4715+static const struct pci_ops tsi108_direct_pci_ops = {
4716 .read = tsi108_direct_read_config,
4717 .write = tsi108_direct_write_config,
4718 };
4719diff -urNp linux-2.6.39.2/arch/s390/include/asm/elf.h linux-2.6.39.2/arch/s390/include/asm/elf.h
4720--- linux-2.6.39.2/arch/s390/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
4721+++ linux-2.6.39.2/arch/s390/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
4722@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
4723 the loader. We need to make sure that it is out of the way of the program
4724 that it will "exec", and that there is sufficient room for the brk. */
4725
4726-extern unsigned long randomize_et_dyn(unsigned long base);
4727-#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
4728+#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
4729+
4730+#ifdef CONFIG_PAX_ASLR
4731+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
4732+
4733+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4734+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4735+#endif
4736
4737 /* This yields a mask that user programs can use to figure out what
4738 instruction set this CPU supports. */
4739@@ -222,7 +228,4 @@ struct linux_binprm;
4740 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
4741 int arch_setup_additional_pages(struct linux_binprm *, int);
4742
4743-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
4744-#define arch_randomize_brk arch_randomize_brk
4745-
4746 #endif
4747diff -urNp linux-2.6.39.2/arch/s390/include/asm/system.h linux-2.6.39.2/arch/s390/include/asm/system.h
4748--- linux-2.6.39.2/arch/s390/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4749+++ linux-2.6.39.2/arch/s390/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4750@@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co
4751 extern void (*_machine_halt)(void);
4752 extern void (*_machine_power_off)(void);
4753
4754-extern unsigned long arch_align_stack(unsigned long sp);
4755+#define arch_align_stack(x) ((x) & ~0xfUL)
4756
4757 static inline int tprot(unsigned long addr)
4758 {
4759diff -urNp linux-2.6.39.2/arch/s390/include/asm/uaccess.h linux-2.6.39.2/arch/s390/include/asm/uaccess.h
4760--- linux-2.6.39.2/arch/s390/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
4761+++ linux-2.6.39.2/arch/s390/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
4762@@ -234,6 +234,10 @@ static inline unsigned long __must_check
4763 copy_to_user(void __user *to, const void *from, unsigned long n)
4764 {
4765 might_fault();
4766+
4767+ if ((long)n < 0)
4768+ return n;
4769+
4770 if (access_ok(VERIFY_WRITE, to, n))
4771 n = __copy_to_user(to, from, n);
4772 return n;
4773@@ -259,6 +263,9 @@ copy_to_user(void __user *to, const void
4774 static inline unsigned long __must_check
4775 __copy_from_user(void *to, const void __user *from, unsigned long n)
4776 {
4777+ if ((long)n < 0)
4778+ return n;
4779+
4780 if (__builtin_constant_p(n) && (n <= 256))
4781 return uaccess.copy_from_user_small(n, from, to);
4782 else
4783@@ -293,6 +300,10 @@ copy_from_user(void *to, const void __us
4784 unsigned int sz = __compiletime_object_size(to);
4785
4786 might_fault();
4787+
4788+ if ((long)n < 0)
4789+ return n;
4790+
4791 if (unlikely(sz != -1 && sz < n)) {
4792 copy_from_user_overflow();
4793 return n;
4794diff -urNp linux-2.6.39.2/arch/s390/Kconfig linux-2.6.39.2/arch/s390/Kconfig
4795--- linux-2.6.39.2/arch/s390/Kconfig 2011-05-19 00:06:34.000000000 -0400
4796+++ linux-2.6.39.2/arch/s390/Kconfig 2011-05-22 19:36:30.000000000 -0400
4797@@ -234,11 +234,9 @@ config S390_EXEC_PROTECT
4798 prompt "Data execute protection"
4799 help
4800 This option allows to enable a buffer overflow protection for user
4801- space programs and it also selects the addressing mode option above.
4802- The kernel parameter noexec=on will enable this feature and also
4803- switch the addressing modes, default is disabled. Enabling this (via
4804- kernel parameter) on machines earlier than IBM System z9 this will
4805- reduce system performance.
4806+ space programs.
4807+ Enabling this (via kernel parameter) on machines earlier than IBM
4808+ System z9 this will reduce system performance.
4809
4810 comment "Code generation options"
4811
4812diff -urNp linux-2.6.39.2/arch/s390/kernel/module.c linux-2.6.39.2/arch/s390/kernel/module.c
4813--- linux-2.6.39.2/arch/s390/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
4814+++ linux-2.6.39.2/arch/s390/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
4815@@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
4816
4817 /* Increase core size by size of got & plt and set start
4818 offsets for got and plt. */
4819- me->core_size = ALIGN(me->core_size, 4);
4820- me->arch.got_offset = me->core_size;
4821- me->core_size += me->arch.got_size;
4822- me->arch.plt_offset = me->core_size;
4823- me->core_size += me->arch.plt_size;
4824+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
4825+ me->arch.got_offset = me->core_size_rw;
4826+ me->core_size_rw += me->arch.got_size;
4827+ me->arch.plt_offset = me->core_size_rx;
4828+ me->core_size_rx += me->arch.plt_size;
4829 return 0;
4830 }
4831
4832@@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4833 if (info->got_initialized == 0) {
4834 Elf_Addr *gotent;
4835
4836- gotent = me->module_core + me->arch.got_offset +
4837+ gotent = me->module_core_rw + me->arch.got_offset +
4838 info->got_offset;
4839 *gotent = val;
4840 info->got_initialized = 1;
4841@@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4842 else if (r_type == R_390_GOTENT ||
4843 r_type == R_390_GOTPLTENT)
4844 *(unsigned int *) loc =
4845- (val + (Elf_Addr) me->module_core - loc) >> 1;
4846+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
4847 else if (r_type == R_390_GOT64 ||
4848 r_type == R_390_GOTPLT64)
4849 *(unsigned long *) loc = val;
4850@@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4851 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
4852 if (info->plt_initialized == 0) {
4853 unsigned int *ip;
4854- ip = me->module_core + me->arch.plt_offset +
4855+ ip = me->module_core_rx + me->arch.plt_offset +
4856 info->plt_offset;
4857 #ifndef CONFIG_64BIT
4858 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
4859@@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4860 val - loc + 0xffffUL < 0x1ffffeUL) ||
4861 (r_type == R_390_PLT32DBL &&
4862 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
4863- val = (Elf_Addr) me->module_core +
4864+ val = (Elf_Addr) me->module_core_rx +
4865 me->arch.plt_offset +
4866 info->plt_offset;
4867 val += rela->r_addend - loc;
4868@@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4869 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
4870 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
4871 val = val + rela->r_addend -
4872- ((Elf_Addr) me->module_core + me->arch.got_offset);
4873+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
4874 if (r_type == R_390_GOTOFF16)
4875 *(unsigned short *) loc = val;
4876 else if (r_type == R_390_GOTOFF32)
4877@@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4878 break;
4879 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
4880 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
4881- val = (Elf_Addr) me->module_core + me->arch.got_offset +
4882+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
4883 rela->r_addend - loc;
4884 if (r_type == R_390_GOTPC)
4885 *(unsigned int *) loc = val;
4886diff -urNp linux-2.6.39.2/arch/s390/kernel/process.c linux-2.6.39.2/arch/s390/kernel/process.c
4887--- linux-2.6.39.2/arch/s390/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4888+++ linux-2.6.39.2/arch/s390/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
4889@@ -334,39 +334,3 @@ unsigned long get_wchan(struct task_stru
4890 }
4891 return 0;
4892 }
4893-
4894-unsigned long arch_align_stack(unsigned long sp)
4895-{
4896- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4897- sp -= get_random_int() & ~PAGE_MASK;
4898- return sp & ~0xf;
4899-}
4900-
4901-static inline unsigned long brk_rnd(void)
4902-{
4903- /* 8MB for 32bit, 1GB for 64bit */
4904- if (is_32bit_task())
4905- return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
4906- else
4907- return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
4908-}
4909-
4910-unsigned long arch_randomize_brk(struct mm_struct *mm)
4911-{
4912- unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
4913-
4914- if (ret < mm->brk)
4915- return mm->brk;
4916- return ret;
4917-}
4918-
4919-unsigned long randomize_et_dyn(unsigned long base)
4920-{
4921- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4922-
4923- if (!(current->flags & PF_RANDOMIZE))
4924- return base;
4925- if (ret < base)
4926- return base;
4927- return ret;
4928-}
4929diff -urNp linux-2.6.39.2/arch/s390/kernel/setup.c linux-2.6.39.2/arch/s390/kernel/setup.c
4930--- linux-2.6.39.2/arch/s390/kernel/setup.c 2011-05-19 00:06:34.000000000 -0400
4931+++ linux-2.6.39.2/arch/s390/kernel/setup.c 2011-05-22 19:36:30.000000000 -0400
4932@@ -271,7 +271,7 @@ static int __init early_parse_mem(char *
4933 }
4934 early_param("mem", early_parse_mem);
4935
4936-unsigned int user_mode = HOME_SPACE_MODE;
4937+unsigned int user_mode = SECONDARY_SPACE_MODE;
4938 EXPORT_SYMBOL_GPL(user_mode);
4939
4940 static int set_amode_and_uaccess(unsigned long user_amode,
4941@@ -300,17 +300,6 @@ static int set_amode_and_uaccess(unsigne
4942 }
4943 }
4944
4945-/*
4946- * Switch kernel/user addressing modes?
4947- */
4948-static int __init early_parse_switch_amode(char *p)
4949-{
4950- if (user_mode != SECONDARY_SPACE_MODE)
4951- user_mode = PRIMARY_SPACE_MODE;
4952- return 0;
4953-}
4954-early_param("switch_amode", early_parse_switch_amode);
4955-
4956 static int __init early_parse_user_mode(char *p)
4957 {
4958 if (p && strcmp(p, "primary") == 0)
4959@@ -327,20 +316,6 @@ static int __init early_parse_user_mode(
4960 }
4961 early_param("user_mode", early_parse_user_mode);
4962
4963-#ifdef CONFIG_S390_EXEC_PROTECT
4964-/*
4965- * Enable execute protection?
4966- */
4967-static int __init early_parse_noexec(char *p)
4968-{
4969- if (!strncmp(p, "off", 3))
4970- return 0;
4971- user_mode = SECONDARY_SPACE_MODE;
4972- return 0;
4973-}
4974-early_param("noexec", early_parse_noexec);
4975-#endif /* CONFIG_S390_EXEC_PROTECT */
4976-
4977 static void setup_addressing_mode(void)
4978 {
4979 if (user_mode == SECONDARY_SPACE_MODE) {
4980diff -urNp linux-2.6.39.2/arch/s390/mm/maccess.c linux-2.6.39.2/arch/s390/mm/maccess.c
4981--- linux-2.6.39.2/arch/s390/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
4982+++ linux-2.6.39.2/arch/s390/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
4983@@ -45,7 +45,7 @@ static long probe_kernel_write_odd(void
4984 return rc ? rc : count;
4985 }
4986
4987-long probe_kernel_write(void *dst, void *src, size_t size)
4988+long probe_kernel_write(void *dst, const void *src, size_t size)
4989 {
4990 long copied = 0;
4991
4992diff -urNp linux-2.6.39.2/arch/s390/mm/mmap.c linux-2.6.39.2/arch/s390/mm/mmap.c
4993--- linux-2.6.39.2/arch/s390/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4994+++ linux-2.6.39.2/arch/s390/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
4995@@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
4996 */
4997 if (mmap_is_legacy()) {
4998 mm->mmap_base = TASK_UNMAPPED_BASE;
4999+
5000+#ifdef CONFIG_PAX_RANDMMAP
5001+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5002+ mm->mmap_base += mm->delta_mmap;
5003+#endif
5004+
5005 mm->get_unmapped_area = arch_get_unmapped_area;
5006 mm->unmap_area = arch_unmap_area;
5007 } else {
5008 mm->mmap_base = mmap_base();
5009+
5010+#ifdef CONFIG_PAX_RANDMMAP
5011+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5012+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
5013+#endif
5014+
5015 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
5016 mm->unmap_area = arch_unmap_area_topdown;
5017 }
5018@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str
5019 */
5020 if (mmap_is_legacy()) {
5021 mm->mmap_base = TASK_UNMAPPED_BASE;
5022+
5023+#ifdef CONFIG_PAX_RANDMMAP
5024+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5025+ mm->mmap_base += mm->delta_mmap;
5026+#endif
5027+
5028 mm->get_unmapped_area = s390_get_unmapped_area;
5029 mm->unmap_area = arch_unmap_area;
5030 } else {
5031 mm->mmap_base = mmap_base();
5032+
5033+#ifdef CONFIG_PAX_RANDMMAP
5034+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5035+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
5036+#endif
5037+
5038 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
5039 mm->unmap_area = arch_unmap_area_topdown;
5040 }
5041diff -urNp linux-2.6.39.2/arch/score/include/asm/system.h linux-2.6.39.2/arch/score/include/asm/system.h
5042--- linux-2.6.39.2/arch/score/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
5043+++ linux-2.6.39.2/arch/score/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
5044@@ -17,7 +17,7 @@ do { \
5045 #define finish_arch_switch(prev) do {} while (0)
5046
5047 typedef void (*vi_handler_t)(void);
5048-extern unsigned long arch_align_stack(unsigned long sp);
5049+#define arch_align_stack(x) (x)
5050
5051 #define mb() barrier()
5052 #define rmb() barrier()
5053diff -urNp linux-2.6.39.2/arch/score/kernel/process.c linux-2.6.39.2/arch/score/kernel/process.c
5054--- linux-2.6.39.2/arch/score/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
5055+++ linux-2.6.39.2/arch/score/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
5056@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
5057
5058 return task_pt_regs(task)->cp0_epc;
5059 }
5060-
5061-unsigned long arch_align_stack(unsigned long sp)
5062-{
5063- return sp;
5064-}
5065diff -urNp linux-2.6.39.2/arch/sh/drivers/pci/ops-dreamcast.c linux-2.6.39.2/arch/sh/drivers/pci/ops-dreamcast.c
5066--- linux-2.6.39.2/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-19 00:06:34.000000000 -0400
5067+++ linux-2.6.39.2/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-22 19:36:30.000000000 -0400
5068@@ -76,7 +76,7 @@ static int gapspci_write(struct pci_bus
5069 return PCIBIOS_SUCCESSFUL;
5070 }
5071
5072-struct pci_ops gapspci_pci_ops = {
5073+const struct pci_ops gapspci_pci_ops = {
5074 .read = gapspci_read,
5075 .write = gapspci_write,
5076 };
5077diff -urNp linux-2.6.39.2/arch/sh/drivers/pci/ops-sh4.c linux-2.6.39.2/arch/sh/drivers/pci/ops-sh4.c
5078--- linux-2.6.39.2/arch/sh/drivers/pci/ops-sh4.c 2011-05-19 00:06:34.000000000 -0400
5079+++ linux-2.6.39.2/arch/sh/drivers/pci/ops-sh4.c 2011-05-22 19:36:30.000000000 -0400
5080@@ -96,7 +96,7 @@ static int sh4_pci_write(struct pci_bus
5081 return PCIBIOS_SUCCESSFUL;
5082 }
5083
5084-struct pci_ops sh4_pci_ops = {
5085+const struct pci_ops sh4_pci_ops = {
5086 .read = sh4_pci_read,
5087 .write = sh4_pci_write,
5088 };
5089diff -urNp linux-2.6.39.2/arch/sh/drivers/pci/ops-sh5.c linux-2.6.39.2/arch/sh/drivers/pci/ops-sh5.c
5090--- linux-2.6.39.2/arch/sh/drivers/pci/ops-sh5.c 2011-05-19 00:06:34.000000000 -0400
5091+++ linux-2.6.39.2/arch/sh/drivers/pci/ops-sh5.c 2011-05-22 19:36:30.000000000 -0400
5092@@ -62,7 +62,7 @@ static int sh5pci_write(struct pci_bus *
5093 return PCIBIOS_SUCCESSFUL;
5094 }
5095
5096-struct pci_ops sh5_pci_ops = {
5097+const struct pci_ops sh5_pci_ops = {
5098 .read = sh5pci_read,
5099 .write = sh5pci_write,
5100 };
5101diff -urNp linux-2.6.39.2/arch/sh/drivers/pci/ops-sh7786.c linux-2.6.39.2/arch/sh/drivers/pci/ops-sh7786.c
5102--- linux-2.6.39.2/arch/sh/drivers/pci/ops-sh7786.c 2011-05-19 00:06:34.000000000 -0400
5103+++ linux-2.6.39.2/arch/sh/drivers/pci/ops-sh7786.c 2011-05-22 19:36:30.000000000 -0400
5104@@ -165,7 +165,7 @@ out:
5105 return ret;
5106 }
5107
5108-struct pci_ops sh7786_pci_ops = {
5109+const struct pci_ops sh7786_pci_ops = {
5110 .read = sh7786_pcie_read,
5111 .write = sh7786_pcie_write,
5112 };
5113diff -urNp linux-2.6.39.2/arch/sh/drivers/pci/pcie-sh7786.c linux-2.6.39.2/arch/sh/drivers/pci/pcie-sh7786.c
5114--- linux-2.6.39.2/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-19 00:06:34.000000000 -0400
5115+++ linux-2.6.39.2/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-22 19:36:30.000000000 -0400
5116@@ -109,7 +109,7 @@ static struct resource sh7786_pci2_resou
5117 },
5118 };
5119
5120-extern struct pci_ops sh7786_pci_ops;
5121+extern const struct pci_ops sh7786_pci_ops;
5122
5123 #define DEFINE_CONTROLLER(start, idx) \
5124 { \
5125diff -urNp linux-2.6.39.2/arch/sh/drivers/pci/pci-sh4.h linux-2.6.39.2/arch/sh/drivers/pci/pci-sh4.h
5126--- linux-2.6.39.2/arch/sh/drivers/pci/pci-sh4.h 2011-05-19 00:06:34.000000000 -0400
5127+++ linux-2.6.39.2/arch/sh/drivers/pci/pci-sh4.h 2011-05-22 19:36:30.000000000 -0400
5128@@ -161,7 +161,7 @@
5129 #define SH4_PCIPDR 0x220 /* Port IO Data Register */
5130
5131 /* arch/sh/kernel/drivers/pci/ops-sh4.c */
5132-extern struct pci_ops sh4_pci_ops;
5133+extern const struct pci_ops sh4_pci_ops;
5134 int pci_fixup_pcic(struct pci_channel *chan);
5135
5136 struct sh4_pci_address_space {
5137diff -urNp linux-2.6.39.2/arch/sh/drivers/pci/pci-sh5.h linux-2.6.39.2/arch/sh/drivers/pci/pci-sh5.h
5138--- linux-2.6.39.2/arch/sh/drivers/pci/pci-sh5.h 2011-05-19 00:06:34.000000000 -0400
5139+++ linux-2.6.39.2/arch/sh/drivers/pci/pci-sh5.h 2011-05-22 19:36:30.000000000 -0400
5140@@ -105,6 +105,6 @@ extern unsigned long pcicr_virt;
5141 #define PCISH5_MEM_SIZCONV(x) (((x / 0x40000) - 1) << 18)
5142 #define PCISH5_IO_SIZCONV(x) (((x / 0x40000) - 1) << 18)
5143
5144-extern struct pci_ops sh5_pci_ops;
5145+extern const struct pci_ops sh5_pci_ops;
5146
5147 #endif /* __PCI_SH5_H */
5148diff -urNp linux-2.6.39.2/arch/sh/include/asm/dma-mapping.h linux-2.6.39.2/arch/sh/include/asm/dma-mapping.h
5149--- linux-2.6.39.2/arch/sh/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
5150+++ linux-2.6.39.2/arch/sh/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
5151@@ -1,10 +1,10 @@
5152 #ifndef __ASM_SH_DMA_MAPPING_H
5153 #define __ASM_SH_DMA_MAPPING_H
5154
5155-extern struct dma_map_ops *dma_ops;
5156+extern const struct dma_map_ops *dma_ops;
5157 extern void no_iommu_init(void);
5158
5159-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
5160+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
5161 {
5162 return dma_ops;
5163 }
5164@@ -14,7 +14,7 @@ static inline struct dma_map_ops *get_dm
5165
5166 static inline int dma_supported(struct device *dev, u64 mask)
5167 {
5168- struct dma_map_ops *ops = get_dma_ops(dev);
5169+ const struct dma_map_ops *ops = get_dma_ops(dev);
5170
5171 if (ops->dma_supported)
5172 return ops->dma_supported(dev, mask);
5173@@ -24,7 +24,7 @@ static inline int dma_supported(struct d
5174
5175 static inline int dma_set_mask(struct device *dev, u64 mask)
5176 {
5177- struct dma_map_ops *ops = get_dma_ops(dev);
5178+ const struct dma_map_ops *ops = get_dma_ops(dev);
5179
5180 if (!dev->dma_mask || !dma_supported(dev, mask))
5181 return -EIO;
5182@@ -44,7 +44,7 @@ void dma_cache_sync(struct device *dev,
5183
5184 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
5185 {
5186- struct dma_map_ops *ops = get_dma_ops(dev);
5187+ const struct dma_map_ops *ops = get_dma_ops(dev);
5188
5189 if (ops->mapping_error)
5190 return ops->mapping_error(dev, dma_addr);
5191@@ -55,7 +55,7 @@ static inline int dma_mapping_error(stru
5192 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
5193 dma_addr_t *dma_handle, gfp_t gfp)
5194 {
5195- struct dma_map_ops *ops = get_dma_ops(dev);
5196+ const struct dma_map_ops *ops = get_dma_ops(dev);
5197 void *memory;
5198
5199 if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
5200@@ -72,7 +72,7 @@ static inline void *dma_alloc_coherent(s
5201 static inline void dma_free_coherent(struct device *dev, size_t size,
5202 void *vaddr, dma_addr_t dma_handle)
5203 {
5204- struct dma_map_ops *ops = get_dma_ops(dev);
5205+ const struct dma_map_ops *ops = get_dma_ops(dev);
5206
5207 if (dma_release_from_coherent(dev, get_order(size), vaddr))
5208 return;
5209diff -urNp linux-2.6.39.2/arch/sh/kernel/dma-nommu.c linux-2.6.39.2/arch/sh/kernel/dma-nommu.c
5210--- linux-2.6.39.2/arch/sh/kernel/dma-nommu.c 2011-05-19 00:06:34.000000000 -0400
5211+++ linux-2.6.39.2/arch/sh/kernel/dma-nommu.c 2011-05-22 19:36:30.000000000 -0400
5212@@ -62,7 +62,7 @@ static void nommu_sync_sg(struct device
5213 }
5214 #endif
5215
5216-struct dma_map_ops nommu_dma_ops = {
5217+const struct dma_map_ops nommu_dma_ops = {
5218 .alloc_coherent = dma_generic_alloc_coherent,
5219 .free_coherent = dma_generic_free_coherent,
5220 .map_page = nommu_map_page,
5221diff -urNp linux-2.6.39.2/arch/sh/kernel/kgdb.c linux-2.6.39.2/arch/sh/kernel/kgdb.c
5222--- linux-2.6.39.2/arch/sh/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
5223+++ linux-2.6.39.2/arch/sh/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
5224@@ -319,7 +319,7 @@ void kgdb_arch_exit(void)
5225 unregister_die_notifier(&kgdb_notifier);
5226 }
5227
5228-struct kgdb_arch arch_kgdb_ops = {
5229+const struct kgdb_arch arch_kgdb_ops = {
5230 /* Breakpoint instruction: trapa #0x3c */
5231 #ifdef CONFIG_CPU_LITTLE_ENDIAN
5232 .gdb_bpt_instr = { 0x3c, 0xc3 },
5233diff -urNp linux-2.6.39.2/arch/sh/mm/consistent.c linux-2.6.39.2/arch/sh/mm/consistent.c
5234--- linux-2.6.39.2/arch/sh/mm/consistent.c 2011-05-19 00:06:34.000000000 -0400
5235+++ linux-2.6.39.2/arch/sh/mm/consistent.c 2011-05-22 19:36:30.000000000 -0400
5236@@ -22,7 +22,7 @@
5237
5238 #define PREALLOC_DMA_DEBUG_ENTRIES 4096
5239
5240-struct dma_map_ops *dma_ops;
5241+const struct dma_map_ops *dma_ops;
5242 EXPORT_SYMBOL(dma_ops);
5243
5244 static int __init dma_init(void)
5245diff -urNp linux-2.6.39.2/arch/sh/mm/mmap.c linux-2.6.39.2/arch/sh/mm/mmap.c
5246--- linux-2.6.39.2/arch/sh/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
5247+++ linux-2.6.39.2/arch/sh/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
5248@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
5249 addr = PAGE_ALIGN(addr);
5250
5251 vma = find_vma(mm, addr);
5252- if (TASK_SIZE - len >= addr &&
5253- (!vma || addr + len <= vma->vm_start))
5254+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5255 return addr;
5256 }
5257
5258@@ -106,7 +105,7 @@ full_search:
5259 }
5260 return -ENOMEM;
5261 }
5262- if (likely(!vma || addr + len <= vma->vm_start)) {
5263+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5264 /*
5265 * Remember the place where we stopped the search:
5266 */
5267@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
5268 addr = PAGE_ALIGN(addr);
5269
5270 vma = find_vma(mm, addr);
5271- if (TASK_SIZE - len >= addr &&
5272- (!vma || addr + len <= vma->vm_start))
5273+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5274 return addr;
5275 }
5276
5277@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
5278 /* make sure it can fit in the remaining address space */
5279 if (likely(addr > len)) {
5280 vma = find_vma(mm, addr-len);
5281- if (!vma || addr <= vma->vm_start) {
5282+ if (check_heap_stack_gap(vma, addr - len, len)) {
5283 /* remember the address as a hint for next time */
5284 return (mm->free_area_cache = addr-len);
5285 }
5286@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
5287 if (unlikely(mm->mmap_base < len))
5288 goto bottomup;
5289
5290- addr = mm->mmap_base-len;
5291- if (do_colour_align)
5292- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5293+ addr = mm->mmap_base - len;
5294
5295 do {
5296+ if (do_colour_align)
5297+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5298 /*
5299 * Lookup failure means no vma is above this address,
5300 * else if new region fits below vma->vm_start,
5301 * return with success:
5302 */
5303 vma = find_vma(mm, addr);
5304- if (likely(!vma || addr+len <= vma->vm_start)) {
5305+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5306 /* remember the address as a hint for next time */
5307 return (mm->free_area_cache = addr);
5308 }
5309@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
5310 mm->cached_hole_size = vma->vm_start - addr;
5311
5312 /* try just below the current vma->vm_start */
5313- addr = vma->vm_start-len;
5314- if (do_colour_align)
5315- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5316- } while (likely(len < vma->vm_start));
5317+ addr = skip_heap_stack_gap(vma, len);
5318+ } while (!IS_ERR_VALUE(addr));
5319
5320 bottomup:
5321 /*
5322diff -urNp linux-2.6.39.2/arch/sparc/include/asm/atomic_64.h linux-2.6.39.2/arch/sparc/include/asm/atomic_64.h
5323--- linux-2.6.39.2/arch/sparc/include/asm/atomic_64.h 2011-05-19 00:06:34.000000000 -0400
5324+++ linux-2.6.39.2/arch/sparc/include/asm/atomic_64.h 2011-05-22 19:36:30.000000000 -0400
5325@@ -14,18 +14,40 @@
5326 #define ATOMIC64_INIT(i) { (i) }
5327
5328 #define atomic_read(v) (*(volatile int *)&(v)->counter)
5329+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5330+{
5331+ return v->counter;
5332+}
5333 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
5334+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
5335+{
5336+ return v->counter;
5337+}
5338
5339 #define atomic_set(v, i) (((v)->counter) = i)
5340+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5341+{
5342+ v->counter = i;
5343+}
5344 #define atomic64_set(v, i) (((v)->counter) = i)
5345+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
5346+{
5347+ v->counter = i;
5348+}
5349
5350 extern void atomic_add(int, atomic_t *);
5351+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
5352 extern void atomic64_add(long, atomic64_t *);
5353+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
5354 extern void atomic_sub(int, atomic_t *);
5355+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
5356 extern void atomic64_sub(long, atomic64_t *);
5357+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
5358
5359 extern int atomic_add_ret(int, atomic_t *);
5360+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
5361 extern long atomic64_add_ret(long, atomic64_t *);
5362+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
5363 extern int atomic_sub_ret(int, atomic_t *);
5364 extern long atomic64_sub_ret(long, atomic64_t *);
5365
5366@@ -33,12 +55,24 @@ extern long atomic64_sub_ret(long, atomi
5367 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
5368
5369 #define atomic_inc_return(v) atomic_add_ret(1, v)
5370+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
5371+{
5372+ return atomic_add_ret_unchecked(1, v);
5373+}
5374 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
5375+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
5376+{
5377+ return atomic64_add_ret_unchecked(1, v);
5378+}
5379
5380 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
5381 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
5382
5383 #define atomic_add_return(i, v) atomic_add_ret(i, v)
5384+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5385+{
5386+ return atomic_add_ret_unchecked(i, v);
5387+}
5388 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
5389
5390 /*
5391@@ -50,6 +84,7 @@ extern long atomic64_sub_ret(long, atomi
5392 * other cases.
5393 */
5394 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
5395+#define atomic_inc_and_test_unchecked(v) (atomic_inc_return_unchecked(v) == 0)
5396 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
5397
5398 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
5399@@ -59,30 +94,59 @@ extern long atomic64_sub_ret(long, atomi
5400 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
5401
5402 #define atomic_inc(v) atomic_add(1, v)
5403+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5404+{
5405+ atomic_add_unchecked(1, v);
5406+}
5407 #define atomic64_inc(v) atomic64_add(1, v)
5408+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
5409+{
5410+ atomic64_add_unchecked(1, v);
5411+}
5412
5413 #define atomic_dec(v) atomic_sub(1, v)
5414+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
5415+{
5416+ atomic_sub_unchecked(1, v);
5417+}
5418 #define atomic64_dec(v) atomic64_sub(1, v)
5419+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
5420+{
5421+ atomic64_sub_unchecked(1, v);
5422+}
5423
5424 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
5425 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
5426
5427 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5428+#define atomic_cmpxchg_unchecked(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5429 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
5430+#define atomic_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
5431
5432 static inline int atomic_add_unless(atomic_t *v, int a, int u)
5433 {
5434- int c, old;
5435+ int c, old, new;
5436 c = atomic_read(v);
5437 for (;;) {
5438- if (unlikely(c == (u)))
5439+ if (unlikely(c == u))
5440 break;
5441- old = atomic_cmpxchg((v), c, c + (a));
5442+
5443+ asm volatile("addcc %2, %0, %0\n"
5444+
5445+#ifdef CONFIG_PAX_REFCOUNT
5446+ "tvs %%icc, 6\n"
5447+#endif
5448+
5449+ : "=r" (new)
5450+ : "0" (c), "ir" (a)
5451+ : "cc");
5452+
5453+ old = atomic_cmpxchg(v, c, new);
5454 if (likely(old == c))
5455 break;
5456 c = old;
5457 }
5458- return c != (u);
5459+ return c != u;
5460 }
5461
5462 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
5463@@ -93,17 +157,28 @@ static inline int atomic_add_unless(atom
5464
5465 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
5466 {
5467- long c, old;
5468+ long c, old, new;
5469 c = atomic64_read(v);
5470 for (;;) {
5471- if (unlikely(c == (u)))
5472+ if (unlikely(c == u))
5473 break;
5474- old = atomic64_cmpxchg((v), c, c + (a));
5475+
5476+ asm volatile("addcc %2, %0, %0\n"
5477+
5478+#ifdef CONFIG_PAX_REFCOUNT
5479+ "tvs %%xcc, 6\n"
5480+#endif
5481+
5482+ : "=r" (new)
5483+ : "0" (c), "ir" (a)
5484+ : "cc");
5485+
5486+ old = atomic64_cmpxchg(v, c, new);
5487 if (likely(old == c))
5488 break;
5489 c = old;
5490 }
5491- return c != (u);
5492+ return c != u;
5493 }
5494
5495 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
5496diff -urNp linux-2.6.39.2/arch/sparc/include/asm/cache.h linux-2.6.39.2/arch/sparc/include/asm/cache.h
5497--- linux-2.6.39.2/arch/sparc/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
5498+++ linux-2.6.39.2/arch/sparc/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
5499@@ -10,7 +10,7 @@
5500 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
5501
5502 #define L1_CACHE_SHIFT 5
5503-#define L1_CACHE_BYTES 32
5504+#define L1_CACHE_BYTES 32U
5505
5506 #ifdef CONFIG_SPARC32
5507 #define SMP_CACHE_BYTES_SHIFT 5
5508diff -urNp linux-2.6.39.2/arch/sparc/include/asm/dma-mapping.h linux-2.6.39.2/arch/sparc/include/asm/dma-mapping.h
5509--- linux-2.6.39.2/arch/sparc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
5510+++ linux-2.6.39.2/arch/sparc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
5511@@ -12,10 +12,10 @@ extern int dma_supported(struct device *
5512 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
5513 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
5514
5515-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
5516+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
5517 extern struct bus_type pci_bus_type;
5518
5519-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
5520+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
5521 {
5522 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
5523 if (dev->bus == &pci_bus_type)
5524@@ -29,7 +29,7 @@ static inline struct dma_map_ops *get_dm
5525 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
5526 dma_addr_t *dma_handle, gfp_t flag)
5527 {
5528- struct dma_map_ops *ops = get_dma_ops(dev);
5529+ const struct dma_map_ops *ops = get_dma_ops(dev);
5530 void *cpu_addr;
5531
5532 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
5533@@ -40,7 +40,7 @@ static inline void *dma_alloc_coherent(s
5534 static inline void dma_free_coherent(struct device *dev, size_t size,
5535 void *cpu_addr, dma_addr_t dma_handle)
5536 {
5537- struct dma_map_ops *ops = get_dma_ops(dev);
5538+ const struct dma_map_ops *ops = get_dma_ops(dev);
5539
5540 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
5541 ops->free_coherent(dev, size, cpu_addr, dma_handle);
5542diff -urNp linux-2.6.39.2/arch/sparc/include/asm/elf_32.h linux-2.6.39.2/arch/sparc/include/asm/elf_32.h
5543--- linux-2.6.39.2/arch/sparc/include/asm/elf_32.h 2011-05-19 00:06:34.000000000 -0400
5544+++ linux-2.6.39.2/arch/sparc/include/asm/elf_32.h 2011-05-22 19:36:30.000000000 -0400
5545@@ -114,6 +114,13 @@ typedef struct {
5546
5547 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
5548
5549+#ifdef CONFIG_PAX_ASLR
5550+#define PAX_ELF_ET_DYN_BASE 0x10000UL
5551+
5552+#define PAX_DELTA_MMAP_LEN 16
5553+#define PAX_DELTA_STACK_LEN 16
5554+#endif
5555+
5556 /* This yields a mask that user programs can use to figure out what
5557 instruction set this cpu supports. This can NOT be done in userspace
5558 on Sparc. */
5559diff -urNp linux-2.6.39.2/arch/sparc/include/asm/elf_64.h linux-2.6.39.2/arch/sparc/include/asm/elf_64.h
5560--- linux-2.6.39.2/arch/sparc/include/asm/elf_64.h 2011-05-19 00:06:34.000000000 -0400
5561+++ linux-2.6.39.2/arch/sparc/include/asm/elf_64.h 2011-05-22 19:36:30.000000000 -0400
5562@@ -162,6 +162,12 @@ typedef struct {
5563 #define ELF_ET_DYN_BASE 0x0000010000000000UL
5564 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
5565
5566+#ifdef CONFIG_PAX_ASLR
5567+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
5568+
5569+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
5570+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
5571+#endif
5572
5573 /* This yields a mask that user programs can use to figure out what
5574 instruction set this cpu supports. */
5575diff -urNp linux-2.6.39.2/arch/sparc/include/asm/pgtable_32.h linux-2.6.39.2/arch/sparc/include/asm/pgtable_32.h
5576--- linux-2.6.39.2/arch/sparc/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
5577+++ linux-2.6.39.2/arch/sparc/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
5578@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
5579 BTFIXUPDEF_INT(page_none)
5580 BTFIXUPDEF_INT(page_copy)
5581 BTFIXUPDEF_INT(page_readonly)
5582+
5583+#ifdef CONFIG_PAX_PAGEEXEC
5584+BTFIXUPDEF_INT(page_shared_noexec)
5585+BTFIXUPDEF_INT(page_copy_noexec)
5586+BTFIXUPDEF_INT(page_readonly_noexec)
5587+#endif
5588+
5589 BTFIXUPDEF_INT(page_kernel)
5590
5591 #define PMD_SHIFT SUN4C_PMD_SHIFT
5592@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
5593 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
5594 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
5595
5596+#ifdef CONFIG_PAX_PAGEEXEC
5597+extern pgprot_t PAGE_SHARED_NOEXEC;
5598+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
5599+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
5600+#else
5601+# define PAGE_SHARED_NOEXEC PAGE_SHARED
5602+# define PAGE_COPY_NOEXEC PAGE_COPY
5603+# define PAGE_READONLY_NOEXEC PAGE_READONLY
5604+#endif
5605+
5606 extern unsigned long page_kernel;
5607
5608 #ifdef MODULE
5609diff -urNp linux-2.6.39.2/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.39.2/arch/sparc/include/asm/pgtsrmmu.h
5610--- linux-2.6.39.2/arch/sparc/include/asm/pgtsrmmu.h 2011-05-19 00:06:34.000000000 -0400
5611+++ linux-2.6.39.2/arch/sparc/include/asm/pgtsrmmu.h 2011-05-22 19:36:30.000000000 -0400
5612@@ -115,6 +115,13 @@
5613 SRMMU_EXEC | SRMMU_REF)
5614 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
5615 SRMMU_EXEC | SRMMU_REF)
5616+
5617+#ifdef CONFIG_PAX_PAGEEXEC
5618+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
5619+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5620+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5621+#endif
5622+
5623 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
5624 SRMMU_DIRTY | SRMMU_REF)
5625
5626diff -urNp linux-2.6.39.2/arch/sparc/include/asm/spinlock_64.h linux-2.6.39.2/arch/sparc/include/asm/spinlock_64.h
5627--- linux-2.6.39.2/arch/sparc/include/asm/spinlock_64.h 2011-05-19 00:06:34.000000000 -0400
5628+++ linux-2.6.39.2/arch/sparc/include/asm/spinlock_64.h 2011-05-22 19:36:30.000000000 -0400
5629@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
5630
5631 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
5632
5633-static void inline arch_read_lock(arch_rwlock_t *lock)
5634+static inline void arch_read_lock(arch_rwlock_t *lock)
5635 {
5636 unsigned long tmp1, tmp2;
5637
5638 __asm__ __volatile__ (
5639 "1: ldsw [%2], %0\n"
5640 " brlz,pn %0, 2f\n"
5641-"4: add %0, 1, %1\n"
5642+"4: addcc %0, 1, %1\n"
5643+
5644+#ifdef CONFIG_PAX_REFCOUNT
5645+" tvs %%icc, 6\n"
5646+#endif
5647+
5648 " cas [%2], %0, %1\n"
5649 " cmp %0, %1\n"
5650 " bne,pn %%icc, 1b\n"
5651@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
5652 " .previous"
5653 : "=&r" (tmp1), "=&r" (tmp2)
5654 : "r" (lock)
5655- : "memory");
5656+ : "memory", "cc");
5657 }
5658
5659-static int inline arch_read_trylock(arch_rwlock_t *lock)
5660+static inline int arch_read_trylock(arch_rwlock_t *lock)
5661 {
5662 int tmp1, tmp2;
5663
5664@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
5665 "1: ldsw [%2], %0\n"
5666 " brlz,a,pn %0, 2f\n"
5667 " mov 0, %0\n"
5668-" add %0, 1, %1\n"
5669+" addcc %0, 1, %1\n"
5670+
5671+#ifdef CONFIG_PAX_REFCOUNT
5672+" tvs %%icc, 6\n"
5673+#endif
5674+
5675 " cas [%2], %0, %1\n"
5676 " cmp %0, %1\n"
5677 " bne,pn %%icc, 1b\n"
5678@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
5679 return tmp1;
5680 }
5681
5682-static void inline arch_read_unlock(arch_rwlock_t *lock)
5683+static inline void arch_read_unlock(arch_rwlock_t *lock)
5684 {
5685 unsigned long tmp1, tmp2;
5686
5687 __asm__ __volatile__(
5688 "1: lduw [%2], %0\n"
5689-" sub %0, 1, %1\n"
5690+" subcc %0, 1, %1\n"
5691+
5692+#ifdef CONFIG_PAX_REFCOUNT
5693+" tvs %%icc, 6\n"
5694+#endif
5695+
5696 " cas [%2], %0, %1\n"
5697 " cmp %0, %1\n"
5698 " bne,pn %%xcc, 1b\n"
5699@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
5700 : "memory");
5701 }
5702
5703-static void inline arch_write_lock(arch_rwlock_t *lock)
5704+static inline void arch_write_lock(arch_rwlock_t *lock)
5705 {
5706 unsigned long mask, tmp1, tmp2;
5707
5708@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
5709 : "memory");
5710 }
5711
5712-static void inline arch_write_unlock(arch_rwlock_t *lock)
5713+static inline void arch_write_unlock(arch_rwlock_t *lock)
5714 {
5715 __asm__ __volatile__(
5716 " stw %%g0, [%0]"
5717@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
5718 : "memory");
5719 }
5720
5721-static int inline arch_write_trylock(arch_rwlock_t *lock)
5722+static inline int arch_write_trylock(arch_rwlock_t *lock)
5723 {
5724 unsigned long mask, tmp1, tmp2, result;
5725
5726diff -urNp linux-2.6.39.2/arch/sparc/include/asm/thread_info_32.h linux-2.6.39.2/arch/sparc/include/asm/thread_info_32.h
5727--- linux-2.6.39.2/arch/sparc/include/asm/thread_info_32.h 2011-05-19 00:06:34.000000000 -0400
5728+++ linux-2.6.39.2/arch/sparc/include/asm/thread_info_32.h 2011-06-03 01:14:03.000000000 -0400
5729@@ -50,6 +50,8 @@ struct thread_info {
5730 unsigned long w_saved;
5731
5732 struct restart_block restart_block;
5733+
5734+ unsigned long lowest_stack;
5735 };
5736
5737 /*
5738diff -urNp linux-2.6.39.2/arch/sparc/include/asm/thread_info_64.h linux-2.6.39.2/arch/sparc/include/asm/thread_info_64.h
5739--- linux-2.6.39.2/arch/sparc/include/asm/thread_info_64.h 2011-05-19 00:06:34.000000000 -0400
5740+++ linux-2.6.39.2/arch/sparc/include/asm/thread_info_64.h 2011-06-03 01:14:21.000000000 -0400
5741@@ -63,6 +63,8 @@ struct thread_info {
5742 struct pt_regs *kern_una_regs;
5743 unsigned int kern_una_insn;
5744
5745+ unsigned long lowest_stack;
5746+
5747 unsigned long fpregs[0] __attribute__ ((aligned(64)));
5748 };
5749
5750diff -urNp linux-2.6.39.2/arch/sparc/include/asm/uaccess_32.h linux-2.6.39.2/arch/sparc/include/asm/uaccess_32.h
5751--- linux-2.6.39.2/arch/sparc/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
5752+++ linux-2.6.39.2/arch/sparc/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
5753@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
5754
5755 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
5756 {
5757- if (n && __access_ok((unsigned long) to, n))
5758+ if ((long)n < 0)
5759+ return n;
5760+
5761+ if (n && __access_ok((unsigned long) to, n)) {
5762+ if (!__builtin_constant_p(n))
5763+ check_object_size(from, n, true);
5764 return __copy_user(to, (__force void __user *) from, n);
5765- else
5766+ } else
5767 return n;
5768 }
5769
5770 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
5771 {
5772+ if ((long)n < 0)
5773+ return n;
5774+
5775+ if (!__builtin_constant_p(n))
5776+ check_object_size(from, n, true);
5777+
5778 return __copy_user(to, (__force void __user *) from, n);
5779 }
5780
5781 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
5782 {
5783- if (n && __access_ok((unsigned long) from, n))
5784+ if ((long)n < 0)
5785+ return n;
5786+
5787+ if (n && __access_ok((unsigned long) from, n)) {
5788+ if (!__builtin_constant_p(n))
5789+ check_object_size(to, n, false);
5790 return __copy_user((__force void __user *) to, from, n);
5791- else
5792+ } else
5793 return n;
5794 }
5795
5796 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
5797 {
5798+ if ((long)n < 0)
5799+ return n;
5800+
5801 return __copy_user((__force void __user *) to, from, n);
5802 }
5803
5804diff -urNp linux-2.6.39.2/arch/sparc/include/asm/uaccess_64.h linux-2.6.39.2/arch/sparc/include/asm/uaccess_64.h
5805--- linux-2.6.39.2/arch/sparc/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
5806+++ linux-2.6.39.2/arch/sparc/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
5807@@ -10,6 +10,7 @@
5808 #include <linux/compiler.h>
5809 #include <linux/string.h>
5810 #include <linux/thread_info.h>
5811+#include <linux/kernel.h>
5812 #include <asm/asi.h>
5813 #include <asm/system.h>
5814 #include <asm/spitfire.h>
5815@@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu
5816 static inline unsigned long __must_check
5817 copy_from_user(void *to, const void __user *from, unsigned long size)
5818 {
5819- unsigned long ret = ___copy_from_user(to, from, size);
5820+ unsigned long ret;
5821
5822+ if ((long)size < 0 || size > INT_MAX)
5823+ return size;
5824+
5825+ if (!__builtin_constant_p(size))
5826+ check_object_size(to, size, false);
5827+
5828+ ret = ___copy_from_user(to, from, size);
5829 if (unlikely(ret))
5830 ret = copy_from_user_fixup(to, from, size);
5831
5832@@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(
5833 static inline unsigned long __must_check
5834 copy_to_user(void __user *to, const void *from, unsigned long size)
5835 {
5836- unsigned long ret = ___copy_to_user(to, from, size);
5837+ unsigned long ret;
5838+
5839+ if ((long)size < 0 || size > INT_MAX)
5840+ return size;
5841+
5842+ if (!__builtin_constant_p(size))
5843+ check_object_size(from, size, true);
5844
5845+ ret = ___copy_to_user(to, from, size);
5846 if (unlikely(ret))
5847 ret = copy_to_user_fixup(to, from, size);
5848 return ret;
5849diff -urNp linux-2.6.39.2/arch/sparc/include/asm/uaccess.h linux-2.6.39.2/arch/sparc/include/asm/uaccess.h
5850--- linux-2.6.39.2/arch/sparc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
5851+++ linux-2.6.39.2/arch/sparc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
5852@@ -1,5 +1,13 @@
5853 #ifndef ___ASM_SPARC_UACCESS_H
5854 #define ___ASM_SPARC_UACCESS_H
5855+
5856+#ifdef __KERNEL__
5857+#ifndef __ASSEMBLY__
5858+#include <linux/types.h>
5859+extern void check_object_size(const void *ptr, unsigned long n, bool to);
5860+#endif
5861+#endif
5862+
5863 #if defined(__sparc__) && defined(__arch64__)
5864 #include <asm/uaccess_64.h>
5865 #else
5866diff -urNp linux-2.6.39.2/arch/sparc/kernel/iommu.c linux-2.6.39.2/arch/sparc/kernel/iommu.c
5867--- linux-2.6.39.2/arch/sparc/kernel/iommu.c 2011-05-19 00:06:34.000000000 -0400
5868+++ linux-2.6.39.2/arch/sparc/kernel/iommu.c 2011-05-22 19:36:30.000000000 -0400
5869@@ -824,7 +824,7 @@ static void dma_4u_sync_sg_for_cpu(struc
5870 spin_unlock_irqrestore(&iommu->lock, flags);
5871 }
5872
5873-static struct dma_map_ops sun4u_dma_ops = {
5874+static const struct dma_map_ops sun4u_dma_ops = {
5875 .alloc_coherent = dma_4u_alloc_coherent,
5876 .free_coherent = dma_4u_free_coherent,
5877 .map_page = dma_4u_map_page,
5878@@ -835,7 +835,7 @@ static struct dma_map_ops sun4u_dma_ops
5879 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
5880 };
5881
5882-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5883+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5884 EXPORT_SYMBOL(dma_ops);
5885
5886 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
5887diff -urNp linux-2.6.39.2/arch/sparc/kernel/ioport.c linux-2.6.39.2/arch/sparc/kernel/ioport.c
5888--- linux-2.6.39.2/arch/sparc/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
5889+++ linux-2.6.39.2/arch/sparc/kernel/ioport.c 2011-05-22 19:36:30.000000000 -0400
5890@@ -402,7 +402,7 @@ static void sbus_sync_sg_for_device(stru
5891 BUG();
5892 }
5893
5894-struct dma_map_ops sbus_dma_ops = {
5895+const struct dma_map_ops sbus_dma_ops = {
5896 .alloc_coherent = sbus_alloc_coherent,
5897 .free_coherent = sbus_free_coherent,
5898 .map_page = sbus_map_page,
5899@@ -653,7 +653,7 @@ static void pci32_sync_sg_for_device(str
5900 }
5901 }
5902
5903-struct dma_map_ops pci32_dma_ops = {
5904+const struct dma_map_ops pci32_dma_ops = {
5905 .alloc_coherent = pci32_alloc_coherent,
5906 .free_coherent = pci32_free_coherent,
5907 .map_page = pci32_map_page,
5908diff -urNp linux-2.6.39.2/arch/sparc/kernel/kgdb_32.c linux-2.6.39.2/arch/sparc/kernel/kgdb_32.c
5909--- linux-2.6.39.2/arch/sparc/kernel/kgdb_32.c 2011-05-19 00:06:34.000000000 -0400
5910+++ linux-2.6.39.2/arch/sparc/kernel/kgdb_32.c 2011-05-22 19:36:30.000000000 -0400
5911@@ -164,7 +164,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5912 regs->npc = regs->pc + 4;
5913 }
5914
5915-struct kgdb_arch arch_kgdb_ops = {
5916+const struct kgdb_arch arch_kgdb_ops = {
5917 /* Breakpoint instruction: ta 0x7d */
5918 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
5919 };
5920diff -urNp linux-2.6.39.2/arch/sparc/kernel/kgdb_64.c linux-2.6.39.2/arch/sparc/kernel/kgdb_64.c
5921--- linux-2.6.39.2/arch/sparc/kernel/kgdb_64.c 2011-05-19 00:06:34.000000000 -0400
5922+++ linux-2.6.39.2/arch/sparc/kernel/kgdb_64.c 2011-05-22 19:36:30.000000000 -0400
5923@@ -187,7 +187,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5924 regs->tnpc = regs->tpc + 4;
5925 }
5926
5927-struct kgdb_arch arch_kgdb_ops = {
5928+const struct kgdb_arch arch_kgdb_ops = {
5929 /* Breakpoint instruction: ta 0x72 */
5930 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
5931 };
5932diff -urNp linux-2.6.39.2/arch/sparc/kernel/Makefile linux-2.6.39.2/arch/sparc/kernel/Makefile
5933--- linux-2.6.39.2/arch/sparc/kernel/Makefile 2011-05-19 00:06:34.000000000 -0400
5934+++ linux-2.6.39.2/arch/sparc/kernel/Makefile 2011-05-22 19:36:30.000000000 -0400
5935@@ -3,7 +3,7 @@
5936 #
5937
5938 asflags-y := -ansi
5939-ccflags-y := -Werror
5940+#ccflags-y := -Werror
5941
5942 extra-y := head_$(BITS).o
5943 extra-y += init_task.o
5944diff -urNp linux-2.6.39.2/arch/sparc/kernel/pcic.c linux-2.6.39.2/arch/sparc/kernel/pcic.c
5945--- linux-2.6.39.2/arch/sparc/kernel/pcic.c 2011-05-19 00:06:34.000000000 -0400
5946+++ linux-2.6.39.2/arch/sparc/kernel/pcic.c 2011-05-22 19:36:30.000000000 -0400
5947@@ -268,7 +268,7 @@ static int pcic_write_config(struct pci_
5948 return -EINVAL;
5949 }
5950
5951-static struct pci_ops pcic_ops = {
5952+static const struct pci_ops pcic_ops = {
5953 .read = pcic_read_config,
5954 .write = pcic_write_config,
5955 };
5956diff -urNp linux-2.6.39.2/arch/sparc/kernel/pci_common.c linux-2.6.39.2/arch/sparc/kernel/pci_common.c
5957--- linux-2.6.39.2/arch/sparc/kernel/pci_common.c 2011-05-19 00:06:34.000000000 -0400
5958+++ linux-2.6.39.2/arch/sparc/kernel/pci_common.c 2011-05-22 19:36:30.000000000 -0400
5959@@ -249,7 +249,7 @@ static int sun4u_write_pci_cfg(struct pc
5960 return PCIBIOS_SUCCESSFUL;
5961 }
5962
5963-struct pci_ops sun4u_pci_ops = {
5964+const struct pci_ops sun4u_pci_ops = {
5965 .read = sun4u_read_pci_cfg,
5966 .write = sun4u_write_pci_cfg,
5967 };
5968@@ -310,7 +310,7 @@ static int sun4v_write_pci_cfg(struct pc
5969 return PCIBIOS_SUCCESSFUL;
5970 }
5971
5972-struct pci_ops sun4v_pci_ops = {
5973+const struct pci_ops sun4v_pci_ops = {
5974 .read = sun4v_read_pci_cfg,
5975 .write = sun4v_write_pci_cfg,
5976 };
5977diff -urNp linux-2.6.39.2/arch/sparc/kernel/pci_impl.h linux-2.6.39.2/arch/sparc/kernel/pci_impl.h
5978--- linux-2.6.39.2/arch/sparc/kernel/pci_impl.h 2011-05-19 00:06:34.000000000 -0400
5979+++ linux-2.6.39.2/arch/sparc/kernel/pci_impl.h 2011-05-22 19:36:30.000000000 -0400
5980@@ -175,8 +175,8 @@ extern void pci_config_write8(u8 *addr,
5981 extern void pci_config_write16(u16 *addr, u16 val);
5982 extern void pci_config_write32(u32 *addr, u32 val);
5983
5984-extern struct pci_ops sun4u_pci_ops;
5985-extern struct pci_ops sun4v_pci_ops;
5986+extern const struct pci_ops sun4u_pci_ops;
5987+extern const struct pci_ops sun4v_pci_ops;
5988
5989 extern volatile int pci_poke_in_progress;
5990 extern volatile int pci_poke_cpu;
5991diff -urNp linux-2.6.39.2/arch/sparc/kernel/pci_sun4v.c linux-2.6.39.2/arch/sparc/kernel/pci_sun4v.c
5992--- linux-2.6.39.2/arch/sparc/kernel/pci_sun4v.c 2011-05-19 00:06:34.000000000 -0400
5993+++ linux-2.6.39.2/arch/sparc/kernel/pci_sun4v.c 2011-05-22 19:36:30.000000000 -0400
5994@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
5995 spin_unlock_irqrestore(&iommu->lock, flags);
5996 }
5997
5998-static struct dma_map_ops sun4v_dma_ops = {
5999+static const struct dma_map_ops sun4v_dma_ops = {
6000 .alloc_coherent = dma_4v_alloc_coherent,
6001 .free_coherent = dma_4v_free_coherent,
6002 .map_page = dma_4v_map_page,
6003diff -urNp linux-2.6.39.2/arch/sparc/kernel/process_32.c linux-2.6.39.2/arch/sparc/kernel/process_32.c
6004--- linux-2.6.39.2/arch/sparc/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
6005+++ linux-2.6.39.2/arch/sparc/kernel/process_32.c 2011-05-22 19:41:32.000000000 -0400
6006@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
6007 rw->ins[4], rw->ins[5],
6008 rw->ins[6],
6009 rw->ins[7]);
6010- printk("%pS\n", (void *) rw->ins[7]);
6011+ printk("%pA\n", (void *) rw->ins[7]);
6012 rw = (struct reg_window32 *) rw->ins[6];
6013 }
6014 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
6015@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
6016
6017 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
6018 r->psr, r->pc, r->npc, r->y, print_tainted());
6019- printk("PC: <%pS>\n", (void *) r->pc);
6020+ printk("PC: <%pA>\n", (void *) r->pc);
6021 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
6022 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
6023 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
6024 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
6025 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
6026 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
6027- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
6028+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
6029
6030 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
6031 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
6032@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
6033 rw = (struct reg_window32 *) fp;
6034 pc = rw->ins[7];
6035 printk("[%08lx : ", pc);
6036- printk("%pS ] ", (void *) pc);
6037+ printk("%pA ] ", (void *) pc);
6038 fp = rw->ins[6];
6039 } while (++count < 16);
6040 printk("\n");
6041diff -urNp linux-2.6.39.2/arch/sparc/kernel/process_64.c linux-2.6.39.2/arch/sparc/kernel/process_64.c
6042--- linux-2.6.39.2/arch/sparc/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
6043+++ linux-2.6.39.2/arch/sparc/kernel/process_64.c 2011-05-22 19:41:32.000000000 -0400
6044@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
6045 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
6046 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
6047 if (regs->tstate & TSTATE_PRIV)
6048- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
6049+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
6050 }
6051
6052 void show_regs(struct pt_regs *regs)
6053 {
6054 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
6055 regs->tpc, regs->tnpc, regs->y, print_tainted());
6056- printk("TPC: <%pS>\n", (void *) regs->tpc);
6057+ printk("TPC: <%pA>\n", (void *) regs->tpc);
6058 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
6059 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
6060 regs->u_regs[3]);
6061@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
6062 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
6063 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
6064 regs->u_regs[15]);
6065- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
6066+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
6067 show_regwindow(regs);
6068 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
6069 }
6070@@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void
6071 ((tp && tp->task) ? tp->task->pid : -1));
6072
6073 if (gp->tstate & TSTATE_PRIV) {
6074- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
6075+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
6076 (void *) gp->tpc,
6077 (void *) gp->o7,
6078 (void *) gp->i7,
6079diff -urNp linux-2.6.39.2/arch/sparc/kernel/sys_sparc_32.c linux-2.6.39.2/arch/sparc/kernel/sys_sparc_32.c
6080--- linux-2.6.39.2/arch/sparc/kernel/sys_sparc_32.c 2011-05-19 00:06:34.000000000 -0400
6081+++ linux-2.6.39.2/arch/sparc/kernel/sys_sparc_32.c 2011-05-22 19:36:30.000000000 -0400
6082@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
6083 if (ARCH_SUN4C && len > 0x20000000)
6084 return -ENOMEM;
6085 if (!addr)
6086- addr = TASK_UNMAPPED_BASE;
6087+ addr = current->mm->mmap_base;
6088
6089 if (flags & MAP_SHARED)
6090 addr = COLOUR_ALIGN(addr);
6091@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
6092 }
6093 if (TASK_SIZE - PAGE_SIZE - len < addr)
6094 return -ENOMEM;
6095- if (!vmm || addr + len <= vmm->vm_start)
6096+ if (check_heap_stack_gap(vmm, addr, len))
6097 return addr;
6098 addr = vmm->vm_end;
6099 if (flags & MAP_SHARED)
6100diff -urNp linux-2.6.39.2/arch/sparc/kernel/sys_sparc_64.c linux-2.6.39.2/arch/sparc/kernel/sys_sparc_64.c
6101--- linux-2.6.39.2/arch/sparc/kernel/sys_sparc_64.c 2011-05-19 00:06:34.000000000 -0400
6102+++ linux-2.6.39.2/arch/sparc/kernel/sys_sparc_64.c 2011-05-22 19:36:30.000000000 -0400
6103@@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
6104 /* We do not accept a shared mapping if it would violate
6105 * cache aliasing constraints.
6106 */
6107- if ((flags & MAP_SHARED) &&
6108+ if ((filp || (flags & MAP_SHARED)) &&
6109 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
6110 return -EINVAL;
6111 return addr;
6112@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
6113 if (filp || (flags & MAP_SHARED))
6114 do_color_align = 1;
6115
6116+#ifdef CONFIG_PAX_RANDMMAP
6117+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
6118+#endif
6119+
6120 if (addr) {
6121 if (do_color_align)
6122 addr = COLOUR_ALIGN(addr, pgoff);
6123@@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str
6124 addr = PAGE_ALIGN(addr);
6125
6126 vma = find_vma(mm, addr);
6127- if (task_size - len >= addr &&
6128- (!vma || addr + len <= vma->vm_start))
6129+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
6130 return addr;
6131 }
6132
6133 if (len > mm->cached_hole_size) {
6134- start_addr = addr = mm->free_area_cache;
6135+ start_addr = addr = mm->free_area_cache;
6136 } else {
6137- start_addr = addr = TASK_UNMAPPED_BASE;
6138+ start_addr = addr = mm->mmap_base;
6139 mm->cached_hole_size = 0;
6140 }
6141
6142@@ -174,14 +177,14 @@ full_search:
6143 vma = find_vma(mm, VA_EXCLUDE_END);
6144 }
6145 if (unlikely(task_size < addr)) {
6146- if (start_addr != TASK_UNMAPPED_BASE) {
6147- start_addr = addr = TASK_UNMAPPED_BASE;
6148+ if (start_addr != mm->mmap_base) {
6149+ start_addr = addr = mm->mmap_base;
6150 mm->cached_hole_size = 0;
6151 goto full_search;
6152 }
6153 return -ENOMEM;
6154 }
6155- if (likely(!vma || addr + len <= vma->vm_start)) {
6156+ if (likely(check_heap_stack_gap(vma, addr, len))) {
6157 /*
6158 * Remember the place where we stopped the search:
6159 */
6160@@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi
6161 /* We do not accept a shared mapping if it would violate
6162 * cache aliasing constraints.
6163 */
6164- if ((flags & MAP_SHARED) &&
6165+ if ((filp || (flags & MAP_SHARED)) &&
6166 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
6167 return -EINVAL;
6168 return addr;
6169@@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
6170 addr = PAGE_ALIGN(addr);
6171
6172 vma = find_vma(mm, addr);
6173- if (task_size - len >= addr &&
6174- (!vma || addr + len <= vma->vm_start))
6175+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
6176 return addr;
6177 }
6178
6179@@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi
6180 /* make sure it can fit in the remaining address space */
6181 if (likely(addr > len)) {
6182 vma = find_vma(mm, addr-len);
6183- if (!vma || addr <= vma->vm_start) {
6184+ if (check_heap_stack_gap(vma, addr - len, len)) {
6185 /* remember the address as a hint for next time */
6186 return (mm->free_area_cache = addr-len);
6187 }
6188@@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi
6189 if (unlikely(mm->mmap_base < len))
6190 goto bottomup;
6191
6192- addr = mm->mmap_base-len;
6193- if (do_color_align)
6194- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
6195+ addr = mm->mmap_base - len;
6196
6197 do {
6198+ if (do_color_align)
6199+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
6200 /*
6201 * Lookup failure means no vma is above this address,
6202 * else if new region fits below vma->vm_start,
6203 * return with success:
6204 */
6205 vma = find_vma(mm, addr);
6206- if (likely(!vma || addr+len <= vma->vm_start)) {
6207+ if (likely(check_heap_stack_gap(vma, addr, len))) {
6208 /* remember the address as a hint for next time */
6209 return (mm->free_area_cache = addr);
6210 }
6211@@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi
6212 mm->cached_hole_size = vma->vm_start - addr;
6213
6214 /* try just below the current vma->vm_start */
6215- addr = vma->vm_start-len;
6216- if (do_color_align)
6217- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
6218- } while (likely(len < vma->vm_start));
6219+ addr = skip_heap_stack_gap(vma, len);
6220+ } while (!IS_ERR_VALUE(addr));
6221
6222 bottomup:
6223 /*
6224@@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
6225 gap == RLIM_INFINITY ||
6226 sysctl_legacy_va_layout) {
6227 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
6228+
6229+#ifdef CONFIG_PAX_RANDMMAP
6230+ if (mm->pax_flags & MF_PAX_RANDMMAP)
6231+ mm->mmap_base += mm->delta_mmap;
6232+#endif
6233+
6234 mm->get_unmapped_area = arch_get_unmapped_area;
6235 mm->unmap_area = arch_unmap_area;
6236 } else {
6237@@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
6238 gap = (task_size / 6 * 5);
6239
6240 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
6241+
6242+#ifdef CONFIG_PAX_RANDMMAP
6243+ if (mm->pax_flags & MF_PAX_RANDMMAP)
6244+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
6245+#endif
6246+
6247 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
6248 mm->unmap_area = arch_unmap_area_topdown;
6249 }
6250diff -urNp linux-2.6.39.2/arch/sparc/kernel/traps_32.c linux-2.6.39.2/arch/sparc/kernel/traps_32.c
6251--- linux-2.6.39.2/arch/sparc/kernel/traps_32.c 2011-05-19 00:06:34.000000000 -0400
6252+++ linux-2.6.39.2/arch/sparc/kernel/traps_32.c 2011-06-13 21:29:23.000000000 -0400
6253@@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
6254 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
6255 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
6256
6257+extern void gr_handle_kernel_exploit(void);
6258+
6259 void die_if_kernel(char *str, struct pt_regs *regs)
6260 {
6261 static int die_counter;
6262@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
6263 count++ < 30 &&
6264 (((unsigned long) rw) >= PAGE_OFFSET) &&
6265 !(((unsigned long) rw) & 0x7)) {
6266- printk("Caller[%08lx]: %pS\n", rw->ins[7],
6267+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
6268 (void *) rw->ins[7]);
6269 rw = (struct reg_window32 *)rw->ins[6];
6270 }
6271 }
6272 printk("Instruction DUMP:");
6273 instruction_dump ((unsigned long *) regs->pc);
6274- if(regs->psr & PSR_PS)
6275+ if(regs->psr & PSR_PS) {
6276+ gr_handle_kernel_exploit();
6277 do_exit(SIGKILL);
6278+ }
6279 do_exit(SIGSEGV);
6280 }
6281
6282diff -urNp linux-2.6.39.2/arch/sparc/kernel/traps_64.c linux-2.6.39.2/arch/sparc/kernel/traps_64.c
6283--- linux-2.6.39.2/arch/sparc/kernel/traps_64.c 2011-05-19 00:06:34.000000000 -0400
6284+++ linux-2.6.39.2/arch/sparc/kernel/traps_64.c 2011-06-13 21:28:54.000000000 -0400
6285@@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
6286 i + 1,
6287 p->trapstack[i].tstate, p->trapstack[i].tpc,
6288 p->trapstack[i].tnpc, p->trapstack[i].tt);
6289- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
6290+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
6291 }
6292 }
6293
6294@@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long
6295
6296 lvl -= 0x100;
6297 if (regs->tstate & TSTATE_PRIV) {
6298+
6299+#ifdef CONFIG_PAX_REFCOUNT
6300+ if (lvl == 6)
6301+ pax_report_refcount_overflow(regs);
6302+#endif
6303+
6304 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
6305 die_if_kernel(buffer, regs);
6306 }
6307@@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long
6308 void bad_trap_tl1(struct pt_regs *regs, long lvl)
6309 {
6310 char buffer[32];
6311-
6312+
6313 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
6314 0, lvl, SIGTRAP) == NOTIFY_STOP)
6315 return;
6316
6317+#ifdef CONFIG_PAX_REFCOUNT
6318+ if (lvl == 6)
6319+ pax_report_refcount_overflow(regs);
6320+#endif
6321+
6322 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
6323
6324 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
6325@@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt
6326 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
6327 printk("%s" "ERROR(%d): ",
6328 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
6329- printk("TPC<%pS>\n", (void *) regs->tpc);
6330+ printk("TPC<%pA>\n", (void *) regs->tpc);
6331 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
6332 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
6333 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
6334@@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type,
6335 smp_processor_id(),
6336 (type & 0x1) ? 'I' : 'D',
6337 regs->tpc);
6338- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
6339+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
6340 panic("Irrecoverable Cheetah+ parity error.");
6341 }
6342
6343@@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type,
6344 smp_processor_id(),
6345 (type & 0x1) ? 'I' : 'D',
6346 regs->tpc);
6347- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
6348+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
6349 }
6350
6351 struct sun4v_error_entry {
6352@@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r
6353
6354 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
6355 regs->tpc, tl);
6356- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
6357+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
6358 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6359- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
6360+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
6361 (void *) regs->u_regs[UREG_I7]);
6362 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
6363 "pte[%lx] error[%lx]\n",
6364@@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r
6365
6366 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
6367 regs->tpc, tl);
6368- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
6369+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
6370 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6371- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
6372+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
6373 (void *) regs->u_regs[UREG_I7]);
6374 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
6375 "pte[%lx] error[%lx]\n",
6376@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
6377 fp = (unsigned long)sf->fp + STACK_BIAS;
6378 }
6379
6380- printk(" [%016lx] %pS\n", pc, (void *) pc);
6381+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6382 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
6383 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
6384 int index = tsk->curr_ret_stack;
6385 if (tsk->ret_stack && index >= graph) {
6386 pc = tsk->ret_stack[index - graph].ret;
6387- printk(" [%016lx] %pS\n", pc, (void *) pc);
6388+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6389 graph++;
6390 }
6391 }
6392@@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_
6393 return (struct reg_window *) (fp + STACK_BIAS);
6394 }
6395
6396+extern void gr_handle_kernel_exploit(void);
6397+
6398 void die_if_kernel(char *str, struct pt_regs *regs)
6399 {
6400 static int die_counter;
6401@@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_
6402 while (rw &&
6403 count++ < 30 &&
6404 kstack_valid(tp, (unsigned long) rw)) {
6405- printk("Caller[%016lx]: %pS\n", rw->ins[7],
6406+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
6407 (void *) rw->ins[7]);
6408
6409 rw = kernel_stack_up(rw);
6410@@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_
6411 }
6412 user_instruction_dump ((unsigned int __user *) regs->tpc);
6413 }
6414- if (regs->tstate & TSTATE_PRIV)
6415+ if (regs->tstate & TSTATE_PRIV) {
6416+ gr_handle_kernel_exploit();
6417 do_exit(SIGKILL);
6418+ }
6419 do_exit(SIGSEGV);
6420 }
6421 EXPORT_SYMBOL(die_if_kernel);
6422diff -urNp linux-2.6.39.2/arch/sparc/kernel/unaligned_64.c linux-2.6.39.2/arch/sparc/kernel/unaligned_64.c
6423--- linux-2.6.39.2/arch/sparc/kernel/unaligned_64.c 2011-05-19 00:06:34.000000000 -0400
6424+++ linux-2.6.39.2/arch/sparc/kernel/unaligned_64.c 2011-05-22 19:41:32.000000000 -0400
6425@@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs
6426 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
6427
6428 if (__ratelimit(&ratelimit)) {
6429- printk("Kernel unaligned access at TPC[%lx] %pS\n",
6430+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
6431 regs->tpc, (void *) regs->tpc);
6432 }
6433 }
6434diff -urNp linux-2.6.39.2/arch/sparc/lib/atomic_64.S linux-2.6.39.2/arch/sparc/lib/atomic_64.S
6435--- linux-2.6.39.2/arch/sparc/lib/atomic_64.S 2011-05-19 00:06:34.000000000 -0400
6436+++ linux-2.6.39.2/arch/sparc/lib/atomic_64.S 2011-05-22 19:36:30.000000000 -0400
6437@@ -18,7 +18,12 @@
6438 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
6439 BACKOFF_SETUP(%o2)
6440 1: lduw [%o1], %g1
6441- add %g1, %o0, %g7
6442+ addcc %g1, %o0, %g7
6443+
6444+#ifdef CONFIG_PAX_REFCOUNT
6445+ tvs %icc, 6
6446+#endif
6447+
6448 cas [%o1], %g1, %g7
6449 cmp %g1, %g7
6450 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6451@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
6452 2: BACKOFF_SPIN(%o2, %o3, 1b)
6453 .size atomic_add, .-atomic_add
6454
6455+ .globl atomic_add_unchecked
6456+ .type atomic_add_unchecked,#function
6457+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6458+ BACKOFF_SETUP(%o2)
6459+1: lduw [%o1], %g1
6460+ add %g1, %o0, %g7
6461+ cas [%o1], %g1, %g7
6462+ cmp %g1, %g7
6463+ bne,pn %icc, 2f
6464+ nop
6465+ retl
6466+ nop
6467+2: BACKOFF_SPIN(%o2, %o3, 1b)
6468+ .size atomic_add_unchecked, .-atomic_add_unchecked
6469+
6470 .globl atomic_sub
6471 .type atomic_sub,#function
6472 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6473 BACKOFF_SETUP(%o2)
6474 1: lduw [%o1], %g1
6475- sub %g1, %o0, %g7
6476+ subcc %g1, %o0, %g7
6477+
6478+#ifdef CONFIG_PAX_REFCOUNT
6479+ tvs %icc, 6
6480+#endif
6481+
6482 cas [%o1], %g1, %g7
6483 cmp %g1, %g7
6484 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6485@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
6486 2: BACKOFF_SPIN(%o2, %o3, 1b)
6487 .size atomic_sub, .-atomic_sub
6488
6489+ .globl atomic_sub_unchecked
6490+ .type atomic_sub_unchecked,#function
6491+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6492+ BACKOFF_SETUP(%o2)
6493+1: lduw [%o1], %g1
6494+ sub %g1, %o0, %g7
6495+ cas [%o1], %g1, %g7
6496+ cmp %g1, %g7
6497+ bne,pn %icc, 2f
6498+ nop
6499+ retl
6500+ nop
6501+2: BACKOFF_SPIN(%o2, %o3, 1b)
6502+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
6503+
6504 .globl atomic_add_ret
6505 .type atomic_add_ret,#function
6506 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6507 BACKOFF_SETUP(%o2)
6508 1: lduw [%o1], %g1
6509- add %g1, %o0, %g7
6510+ addcc %g1, %o0, %g7
6511+
6512+#ifdef CONFIG_PAX_REFCOUNT
6513+ tvs %icc, 6
6514+#endif
6515+
6516 cas [%o1], %g1, %g7
6517 cmp %g1, %g7
6518 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6519@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1
6520 2: BACKOFF_SPIN(%o2, %o3, 1b)
6521 .size atomic_add_ret, .-atomic_add_ret
6522
6523+ .globl atomic_add_ret_unchecked
6524+ .type atomic_add_ret_unchecked,#function
6525+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6526+ BACKOFF_SETUP(%o2)
6527+1: lduw [%o1], %g1
6528+ addcc %g1, %o0, %g7
6529+ cas [%o1], %g1, %g7
6530+ cmp %g1, %g7
6531+ bne,pn %icc, 2f
6532+ add %g7, %o0, %g7
6533+ sra %g7, 0, %o0
6534+ retl
6535+ nop
6536+2: BACKOFF_SPIN(%o2, %o3, 1b)
6537+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
6538+
6539 .globl atomic_sub_ret
6540 .type atomic_sub_ret,#function
6541 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6542 BACKOFF_SETUP(%o2)
6543 1: lduw [%o1], %g1
6544- sub %g1, %o0, %g7
6545+ subcc %g1, %o0, %g7
6546+
6547+#ifdef CONFIG_PAX_REFCOUNT
6548+ tvs %icc, 6
6549+#endif
6550+
6551 cas [%o1], %g1, %g7
6552 cmp %g1, %g7
6553 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6554@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
6555 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
6556 BACKOFF_SETUP(%o2)
6557 1: ldx [%o1], %g1
6558- add %g1, %o0, %g7
6559+ addcc %g1, %o0, %g7
6560+
6561+#ifdef CONFIG_PAX_REFCOUNT
6562+ tvs %xcc, 6
6563+#endif
6564+
6565 casx [%o1], %g1, %g7
6566 cmp %g1, %g7
6567 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6568@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 =
6569 2: BACKOFF_SPIN(%o2, %o3, 1b)
6570 .size atomic64_add, .-atomic64_add
6571
6572+ .globl atomic64_add_unchecked
6573+ .type atomic64_add_unchecked,#function
6574+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6575+ BACKOFF_SETUP(%o2)
6576+1: ldx [%o1], %g1
6577+ addcc %g1, %o0, %g7
6578+ casx [%o1], %g1, %g7
6579+ cmp %g1, %g7
6580+ bne,pn %xcc, 2f
6581+ nop
6582+ retl
6583+ nop
6584+2: BACKOFF_SPIN(%o2, %o3, 1b)
6585+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
6586+
6587 .globl atomic64_sub
6588 .type atomic64_sub,#function
6589 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6590 BACKOFF_SETUP(%o2)
6591 1: ldx [%o1], %g1
6592- sub %g1, %o0, %g7
6593+ subcc %g1, %o0, %g7
6594+
6595+#ifdef CONFIG_PAX_REFCOUNT
6596+ tvs %xcc, 6
6597+#endif
6598+
6599 casx [%o1], %g1, %g7
6600 cmp %g1, %g7
6601 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6602@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
6603 2: BACKOFF_SPIN(%o2, %o3, 1b)
6604 .size atomic64_sub, .-atomic64_sub
6605
6606+ .globl atomic64_sub_unchecked
6607+ .type atomic64_sub_unchecked,#function
6608+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6609+ BACKOFF_SETUP(%o2)
6610+1: ldx [%o1], %g1
6611+ subcc %g1, %o0, %g7
6612+ casx [%o1], %g1, %g7
6613+ cmp %g1, %g7
6614+ bne,pn %xcc, 2f
6615+ nop
6616+ retl
6617+ nop
6618+2: BACKOFF_SPIN(%o2, %o3, 1b)
6619+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
6620+
6621 .globl atomic64_add_ret
6622 .type atomic64_add_ret,#function
6623 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6624 BACKOFF_SETUP(%o2)
6625 1: ldx [%o1], %g1
6626- add %g1, %o0, %g7
6627+ addcc %g1, %o0, %g7
6628+
6629+#ifdef CONFIG_PAX_REFCOUNT
6630+ tvs %xcc, 6
6631+#endif
6632+
6633 casx [%o1], %g1, %g7
6634 cmp %g1, %g7
6635 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6636@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o
6637 2: BACKOFF_SPIN(%o2, %o3, 1b)
6638 .size atomic64_add_ret, .-atomic64_add_ret
6639
6640+ .globl atomic64_add_ret_unchecked
6641+ .type atomic64_add_ret_unchecked,#function
6642+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6643+ BACKOFF_SETUP(%o2)
6644+1: ldx [%o1], %g1
6645+ addcc %g1, %o0, %g7
6646+ casx [%o1], %g1, %g7
6647+ cmp %g1, %g7
6648+ bne,pn %xcc, 2f
6649+ add %g7, %o0, %g7
6650+ mov %g7, %o0
6651+ retl
6652+ nop
6653+2: BACKOFF_SPIN(%o2, %o3, 1b)
6654+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
6655+
6656 .globl atomic64_sub_ret
6657 .type atomic64_sub_ret,#function
6658 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6659 BACKOFF_SETUP(%o2)
6660 1: ldx [%o1], %g1
6661- sub %g1, %o0, %g7
6662+ subcc %g1, %o0, %g7
6663+
6664+#ifdef CONFIG_PAX_REFCOUNT
6665+ tvs %xcc, 6
6666+#endif
6667+
6668 casx [%o1], %g1, %g7
6669 cmp %g1, %g7
6670 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6671diff -urNp linux-2.6.39.2/arch/sparc/lib/ksyms.c linux-2.6.39.2/arch/sparc/lib/ksyms.c
6672--- linux-2.6.39.2/arch/sparc/lib/ksyms.c 2011-05-19 00:06:34.000000000 -0400
6673+++ linux-2.6.39.2/arch/sparc/lib/ksyms.c 2011-05-22 19:36:30.000000000 -0400
6674@@ -142,12 +142,17 @@ EXPORT_SYMBOL(__downgrade_write);
6675
6676 /* Atomic counter implementation. */
6677 EXPORT_SYMBOL(atomic_add);
6678+EXPORT_SYMBOL(atomic_add_unchecked);
6679 EXPORT_SYMBOL(atomic_add_ret);
6680 EXPORT_SYMBOL(atomic_sub);
6681+EXPORT_SYMBOL(atomic_sub_unchecked);
6682 EXPORT_SYMBOL(atomic_sub_ret);
6683 EXPORT_SYMBOL(atomic64_add);
6684+EXPORT_SYMBOL(atomic64_add_unchecked);
6685 EXPORT_SYMBOL(atomic64_add_ret);
6686+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
6687 EXPORT_SYMBOL(atomic64_sub);
6688+EXPORT_SYMBOL(atomic64_sub_unchecked);
6689 EXPORT_SYMBOL(atomic64_sub_ret);
6690
6691 /* Atomic bit operations. */
6692diff -urNp linux-2.6.39.2/arch/sparc/lib/Makefile linux-2.6.39.2/arch/sparc/lib/Makefile
6693--- linux-2.6.39.2/arch/sparc/lib/Makefile 2011-05-19 00:06:34.000000000 -0400
6694+++ linux-2.6.39.2/arch/sparc/lib/Makefile 2011-05-22 19:36:30.000000000 -0400
6695@@ -2,7 +2,7 @@
6696 #
6697
6698 asflags-y := -ansi -DST_DIV0=0x02
6699-ccflags-y := -Werror
6700+#ccflags-y := -Werror
6701
6702 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
6703 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
6704diff -urNp linux-2.6.39.2/arch/sparc/Makefile linux-2.6.39.2/arch/sparc/Makefile
6705--- linux-2.6.39.2/arch/sparc/Makefile 2011-05-19 00:06:34.000000000 -0400
6706+++ linux-2.6.39.2/arch/sparc/Makefile 2011-05-22 19:41:32.000000000 -0400
6707@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
6708 # Export what is needed by arch/sparc/boot/Makefile
6709 export VMLINUX_INIT VMLINUX_MAIN
6710 VMLINUX_INIT := $(head-y) $(init-y)
6711-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
6712+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
6713 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
6714 VMLINUX_MAIN += $(drivers-y) $(net-y)
6715
6716diff -urNp linux-2.6.39.2/arch/sparc/mm/fault_32.c linux-2.6.39.2/arch/sparc/mm/fault_32.c
6717--- linux-2.6.39.2/arch/sparc/mm/fault_32.c 2011-05-19 00:06:34.000000000 -0400
6718+++ linux-2.6.39.2/arch/sparc/mm/fault_32.c 2011-05-22 19:36:30.000000000 -0400
6719@@ -22,6 +22,9 @@
6720 #include <linux/interrupt.h>
6721 #include <linux/module.h>
6722 #include <linux/kdebug.h>
6723+#include <linux/slab.h>
6724+#include <linux/pagemap.h>
6725+#include <linux/compiler.h>
6726
6727 #include <asm/system.h>
6728 #include <asm/page.h>
6729@@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str
6730 return safe_compute_effective_address(regs, insn);
6731 }
6732
6733+#ifdef CONFIG_PAX_PAGEEXEC
6734+#ifdef CONFIG_PAX_DLRESOLVE
6735+static void pax_emuplt_close(struct vm_area_struct *vma)
6736+{
6737+ vma->vm_mm->call_dl_resolve = 0UL;
6738+}
6739+
6740+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6741+{
6742+ unsigned int *kaddr;
6743+
6744+ vmf->page = alloc_page(GFP_HIGHUSER);
6745+ if (!vmf->page)
6746+ return VM_FAULT_OOM;
6747+
6748+ kaddr = kmap(vmf->page);
6749+ memset(kaddr, 0, PAGE_SIZE);
6750+ kaddr[0] = 0x9DE3BFA8U; /* save */
6751+ flush_dcache_page(vmf->page);
6752+ kunmap(vmf->page);
6753+ return VM_FAULT_MAJOR;
6754+}
6755+
6756+static const struct vm_operations_struct pax_vm_ops = {
6757+ .close = pax_emuplt_close,
6758+ .fault = pax_emuplt_fault
6759+};
6760+
6761+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6762+{
6763+ int ret;
6764+
6765+ INIT_LIST_HEAD(&vma->anon_vma_chain);
6766+ vma->vm_mm = current->mm;
6767+ vma->vm_start = addr;
6768+ vma->vm_end = addr + PAGE_SIZE;
6769+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6770+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6771+ vma->vm_ops = &pax_vm_ops;
6772+
6773+ ret = insert_vm_struct(current->mm, vma);
6774+ if (ret)
6775+ return ret;
6776+
6777+ ++current->mm->total_vm;
6778+ return 0;
6779+}
6780+#endif
6781+
6782+/*
6783+ * PaX: decide what to do with offenders (regs->pc = fault address)
6784+ *
6785+ * returns 1 when task should be killed
6786+ * 2 when patched PLT trampoline was detected
6787+ * 3 when unpatched PLT trampoline was detected
6788+ */
6789+static int pax_handle_fetch_fault(struct pt_regs *regs)
6790+{
6791+
6792+#ifdef CONFIG_PAX_EMUPLT
6793+ int err;
6794+
6795+ do { /* PaX: patched PLT emulation #1 */
6796+ unsigned int sethi1, sethi2, jmpl;
6797+
6798+ err = get_user(sethi1, (unsigned int *)regs->pc);
6799+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
6800+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
6801+
6802+ if (err)
6803+ break;
6804+
6805+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6806+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
6807+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
6808+ {
6809+ unsigned int addr;
6810+
6811+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6812+ addr = regs->u_regs[UREG_G1];
6813+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6814+ regs->pc = addr;
6815+ regs->npc = addr+4;
6816+ return 2;
6817+ }
6818+ } while (0);
6819+
6820+ { /* PaX: patched PLT emulation #2 */
6821+ unsigned int ba;
6822+
6823+ err = get_user(ba, (unsigned int *)regs->pc);
6824+
6825+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6826+ unsigned int addr;
6827+
6828+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6829+ regs->pc = addr;
6830+ regs->npc = addr+4;
6831+ return 2;
6832+ }
6833+ }
6834+
6835+ do { /* PaX: patched PLT emulation #3 */
6836+ unsigned int sethi, jmpl, nop;
6837+
6838+ err = get_user(sethi, (unsigned int *)regs->pc);
6839+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
6840+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6841+
6842+ if (err)
6843+ break;
6844+
6845+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6846+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6847+ nop == 0x01000000U)
6848+ {
6849+ unsigned int addr;
6850+
6851+ addr = (sethi & 0x003FFFFFU) << 10;
6852+ regs->u_regs[UREG_G1] = addr;
6853+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6854+ regs->pc = addr;
6855+ regs->npc = addr+4;
6856+ return 2;
6857+ }
6858+ } while (0);
6859+
6860+ do { /* PaX: unpatched PLT emulation step 1 */
6861+ unsigned int sethi, ba, nop;
6862+
6863+ err = get_user(sethi, (unsigned int *)regs->pc);
6864+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
6865+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6866+
6867+ if (err)
6868+ break;
6869+
6870+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6871+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6872+ nop == 0x01000000U)
6873+ {
6874+ unsigned int addr, save, call;
6875+
6876+ if ((ba & 0xFFC00000U) == 0x30800000U)
6877+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6878+ else
6879+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6880+
6881+ err = get_user(save, (unsigned int *)addr);
6882+ err |= get_user(call, (unsigned int *)(addr+4));
6883+ err |= get_user(nop, (unsigned int *)(addr+8));
6884+ if (err)
6885+ break;
6886+
6887+#ifdef CONFIG_PAX_DLRESOLVE
6888+ if (save == 0x9DE3BFA8U &&
6889+ (call & 0xC0000000U) == 0x40000000U &&
6890+ nop == 0x01000000U)
6891+ {
6892+ struct vm_area_struct *vma;
6893+ unsigned long call_dl_resolve;
6894+
6895+ down_read(&current->mm->mmap_sem);
6896+ call_dl_resolve = current->mm->call_dl_resolve;
6897+ up_read(&current->mm->mmap_sem);
6898+ if (likely(call_dl_resolve))
6899+ goto emulate;
6900+
6901+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
6902+
6903+ down_write(&current->mm->mmap_sem);
6904+ if (current->mm->call_dl_resolve) {
6905+ call_dl_resolve = current->mm->call_dl_resolve;
6906+ up_write(&current->mm->mmap_sem);
6907+ if (vma)
6908+ kmem_cache_free(vm_area_cachep, vma);
6909+ goto emulate;
6910+ }
6911+
6912+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6913+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
6914+ up_write(&current->mm->mmap_sem);
6915+ if (vma)
6916+ kmem_cache_free(vm_area_cachep, vma);
6917+ return 1;
6918+ }
6919+
6920+ if (pax_insert_vma(vma, call_dl_resolve)) {
6921+ up_write(&current->mm->mmap_sem);
6922+ kmem_cache_free(vm_area_cachep, vma);
6923+ return 1;
6924+ }
6925+
6926+ current->mm->call_dl_resolve = call_dl_resolve;
6927+ up_write(&current->mm->mmap_sem);
6928+
6929+emulate:
6930+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6931+ regs->pc = call_dl_resolve;
6932+ regs->npc = addr+4;
6933+ return 3;
6934+ }
6935+#endif
6936+
6937+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
6938+ if ((save & 0xFFC00000U) == 0x05000000U &&
6939+ (call & 0xFFFFE000U) == 0x85C0A000U &&
6940+ nop == 0x01000000U)
6941+ {
6942+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6943+ regs->u_regs[UREG_G2] = addr + 4;
6944+ addr = (save & 0x003FFFFFU) << 10;
6945+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6946+ regs->pc = addr;
6947+ regs->npc = addr+4;
6948+ return 3;
6949+ }
6950+ }
6951+ } while (0);
6952+
6953+ do { /* PaX: unpatched PLT emulation step 2 */
6954+ unsigned int save, call, nop;
6955+
6956+ err = get_user(save, (unsigned int *)(regs->pc-4));
6957+ err |= get_user(call, (unsigned int *)regs->pc);
6958+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
6959+ if (err)
6960+ break;
6961+
6962+ if (save == 0x9DE3BFA8U &&
6963+ (call & 0xC0000000U) == 0x40000000U &&
6964+ nop == 0x01000000U)
6965+ {
6966+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
6967+
6968+ regs->u_regs[UREG_RETPC] = regs->pc;
6969+ regs->pc = dl_resolve;
6970+ regs->npc = dl_resolve+4;
6971+ return 3;
6972+ }
6973+ } while (0);
6974+#endif
6975+
6976+ return 1;
6977+}
6978+
6979+void pax_report_insns(void *pc, void *sp)
6980+{
6981+ unsigned long i;
6982+
6983+ printk(KERN_ERR "PAX: bytes at PC: ");
6984+ for (i = 0; i < 8; i++) {
6985+ unsigned int c;
6986+ if (get_user(c, (unsigned int *)pc+i))
6987+ printk(KERN_CONT "???????? ");
6988+ else
6989+ printk(KERN_CONT "%08x ", c);
6990+ }
6991+ printk("\n");
6992+}
6993+#endif
6994+
6995 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
6996 int text_fault)
6997 {
6998@@ -281,6 +546,24 @@ good_area:
6999 if(!(vma->vm_flags & VM_WRITE))
7000 goto bad_area;
7001 } else {
7002+
7003+#ifdef CONFIG_PAX_PAGEEXEC
7004+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
7005+ up_read(&mm->mmap_sem);
7006+ switch (pax_handle_fetch_fault(regs)) {
7007+
7008+#ifdef CONFIG_PAX_EMUPLT
7009+ case 2:
7010+ case 3:
7011+ return;
7012+#endif
7013+
7014+ }
7015+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
7016+ do_group_exit(SIGKILL);
7017+ }
7018+#endif
7019+
7020 /* Allow reads even for write-only mappings */
7021 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
7022 goto bad_area;
7023diff -urNp linux-2.6.39.2/arch/sparc/mm/fault_64.c linux-2.6.39.2/arch/sparc/mm/fault_64.c
7024--- linux-2.6.39.2/arch/sparc/mm/fault_64.c 2011-05-19 00:06:34.000000000 -0400
7025+++ linux-2.6.39.2/arch/sparc/mm/fault_64.c 2011-05-22 19:41:32.000000000 -0400
7026@@ -21,6 +21,9 @@
7027 #include <linux/kprobes.h>
7028 #include <linux/kdebug.h>
7029 #include <linux/percpu.h>
7030+#include <linux/slab.h>
7031+#include <linux/pagemap.h>
7032+#include <linux/compiler.h>
7033
7034 #include <asm/page.h>
7035 #include <asm/pgtable.h>
7036@@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru
7037 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
7038 regs->tpc);
7039 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
7040- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
7041+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
7042 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
7043 dump_stack();
7044 unhandled_fault(regs->tpc, current, regs);
7045@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b
7046 show_regs(regs);
7047 }
7048
7049+#ifdef CONFIG_PAX_PAGEEXEC
7050+#ifdef CONFIG_PAX_DLRESOLVE
7051+static void pax_emuplt_close(struct vm_area_struct *vma)
7052+{
7053+ vma->vm_mm->call_dl_resolve = 0UL;
7054+}
7055+
7056+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
7057+{
7058+ unsigned int *kaddr;
7059+
7060+ vmf->page = alloc_page(GFP_HIGHUSER);
7061+ if (!vmf->page)
7062+ return VM_FAULT_OOM;
7063+
7064+ kaddr = kmap(vmf->page);
7065+ memset(kaddr, 0, PAGE_SIZE);
7066+ kaddr[0] = 0x9DE3BFA8U; /* save */
7067+ flush_dcache_page(vmf->page);
7068+ kunmap(vmf->page);
7069+ return VM_FAULT_MAJOR;
7070+}
7071+
7072+static const struct vm_operations_struct pax_vm_ops = {
7073+ .close = pax_emuplt_close,
7074+ .fault = pax_emuplt_fault
7075+};
7076+
7077+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
7078+{
7079+ int ret;
7080+
7081+ INIT_LIST_HEAD(&vma->anon_vma_chain);
7082+ vma->vm_mm = current->mm;
7083+ vma->vm_start = addr;
7084+ vma->vm_end = addr + PAGE_SIZE;
7085+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
7086+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
7087+ vma->vm_ops = &pax_vm_ops;
7088+
7089+ ret = insert_vm_struct(current->mm, vma);
7090+ if (ret)
7091+ return ret;
7092+
7093+ ++current->mm->total_vm;
7094+ return 0;
7095+}
7096+#endif
7097+
7098+/*
7099+ * PaX: decide what to do with offenders (regs->tpc = fault address)
7100+ *
7101+ * returns 1 when task should be killed
7102+ * 2 when patched PLT trampoline was detected
7103+ * 3 when unpatched PLT trampoline was detected
7104+ */
7105+static int pax_handle_fetch_fault(struct pt_regs *regs)
7106+{
7107+
7108+#ifdef CONFIG_PAX_EMUPLT
7109+ int err;
7110+
7111+ do { /* PaX: patched PLT emulation #1 */
7112+ unsigned int sethi1, sethi2, jmpl;
7113+
7114+ err = get_user(sethi1, (unsigned int *)regs->tpc);
7115+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
7116+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
7117+
7118+ if (err)
7119+ break;
7120+
7121+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
7122+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
7123+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
7124+ {
7125+ unsigned long addr;
7126+
7127+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
7128+ addr = regs->u_regs[UREG_G1];
7129+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7130+
7131+ if (test_thread_flag(TIF_32BIT))
7132+ addr &= 0xFFFFFFFFUL;
7133+
7134+ regs->tpc = addr;
7135+ regs->tnpc = addr+4;
7136+ return 2;
7137+ }
7138+ } while (0);
7139+
7140+ { /* PaX: patched PLT emulation #2 */
7141+ unsigned int ba;
7142+
7143+ err = get_user(ba, (unsigned int *)regs->tpc);
7144+
7145+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
7146+ unsigned long addr;
7147+
7148+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
7149+
7150+ if (test_thread_flag(TIF_32BIT))
7151+ addr &= 0xFFFFFFFFUL;
7152+
7153+ regs->tpc = addr;
7154+ regs->tnpc = addr+4;
7155+ return 2;
7156+ }
7157+ }
7158+
7159+ do { /* PaX: patched PLT emulation #3 */
7160+ unsigned int sethi, jmpl, nop;
7161+
7162+ err = get_user(sethi, (unsigned int *)regs->tpc);
7163+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
7164+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7165+
7166+ if (err)
7167+ break;
7168+
7169+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7170+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
7171+ nop == 0x01000000U)
7172+ {
7173+ unsigned long addr;
7174+
7175+ addr = (sethi & 0x003FFFFFU) << 10;
7176+ regs->u_regs[UREG_G1] = addr;
7177+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7178+
7179+ if (test_thread_flag(TIF_32BIT))
7180+ addr &= 0xFFFFFFFFUL;
7181+
7182+ regs->tpc = addr;
7183+ regs->tnpc = addr+4;
7184+ return 2;
7185+ }
7186+ } while (0);
7187+
7188+ do { /* PaX: patched PLT emulation #4 */
7189+ unsigned int sethi, mov1, call, mov2;
7190+
7191+ err = get_user(sethi, (unsigned int *)regs->tpc);
7192+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
7193+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
7194+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
7195+
7196+ if (err)
7197+ break;
7198+
7199+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7200+ mov1 == 0x8210000FU &&
7201+ (call & 0xC0000000U) == 0x40000000U &&
7202+ mov2 == 0x9E100001U)
7203+ {
7204+ unsigned long addr;
7205+
7206+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
7207+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7208+
7209+ if (test_thread_flag(TIF_32BIT))
7210+ addr &= 0xFFFFFFFFUL;
7211+
7212+ regs->tpc = addr;
7213+ regs->tnpc = addr+4;
7214+ return 2;
7215+ }
7216+ } while (0);
7217+
7218+ do { /* PaX: patched PLT emulation #5 */
7219+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
7220+
7221+ err = get_user(sethi, (unsigned int *)regs->tpc);
7222+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
7223+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
7224+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
7225+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
7226+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
7227+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
7228+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
7229+
7230+ if (err)
7231+ break;
7232+
7233+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7234+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
7235+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7236+ (or1 & 0xFFFFE000U) == 0x82106000U &&
7237+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
7238+ sllx == 0x83287020U &&
7239+ jmpl == 0x81C04005U &&
7240+ nop == 0x01000000U)
7241+ {
7242+ unsigned long addr;
7243+
7244+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7245+ regs->u_regs[UREG_G1] <<= 32;
7246+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7247+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7248+ regs->tpc = addr;
7249+ regs->tnpc = addr+4;
7250+ return 2;
7251+ }
7252+ } while (0);
7253+
7254+ do { /* PaX: patched PLT emulation #6 */
7255+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
7256+
7257+ err = get_user(sethi, (unsigned int *)regs->tpc);
7258+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
7259+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
7260+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
7261+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
7262+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
7263+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
7264+
7265+ if (err)
7266+ break;
7267+
7268+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7269+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
7270+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7271+ sllx == 0x83287020U &&
7272+ (or & 0xFFFFE000U) == 0x8A116000U &&
7273+ jmpl == 0x81C04005U &&
7274+ nop == 0x01000000U)
7275+ {
7276+ unsigned long addr;
7277+
7278+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
7279+ regs->u_regs[UREG_G1] <<= 32;
7280+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
7281+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7282+ regs->tpc = addr;
7283+ regs->tnpc = addr+4;
7284+ return 2;
7285+ }
7286+ } while (0);
7287+
7288+ do { /* PaX: unpatched PLT emulation step 1 */
7289+ unsigned int sethi, ba, nop;
7290+
7291+ err = get_user(sethi, (unsigned int *)regs->tpc);
7292+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7293+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7294+
7295+ if (err)
7296+ break;
7297+
7298+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7299+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
7300+ nop == 0x01000000U)
7301+ {
7302+ unsigned long addr;
7303+ unsigned int save, call;
7304+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
7305+
7306+ if ((ba & 0xFFC00000U) == 0x30800000U)
7307+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
7308+ else
7309+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7310+
7311+ if (test_thread_flag(TIF_32BIT))
7312+ addr &= 0xFFFFFFFFUL;
7313+
7314+ err = get_user(save, (unsigned int *)addr);
7315+ err |= get_user(call, (unsigned int *)(addr+4));
7316+ err |= get_user(nop, (unsigned int *)(addr+8));
7317+ if (err)
7318+ break;
7319+
7320+#ifdef CONFIG_PAX_DLRESOLVE
7321+ if (save == 0x9DE3BFA8U &&
7322+ (call & 0xC0000000U) == 0x40000000U &&
7323+ nop == 0x01000000U)
7324+ {
7325+ struct vm_area_struct *vma;
7326+ unsigned long call_dl_resolve;
7327+
7328+ down_read(&current->mm->mmap_sem);
7329+ call_dl_resolve = current->mm->call_dl_resolve;
7330+ up_read(&current->mm->mmap_sem);
7331+ if (likely(call_dl_resolve))
7332+ goto emulate;
7333+
7334+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
7335+
7336+ down_write(&current->mm->mmap_sem);
7337+ if (current->mm->call_dl_resolve) {
7338+ call_dl_resolve = current->mm->call_dl_resolve;
7339+ up_write(&current->mm->mmap_sem);
7340+ if (vma)
7341+ kmem_cache_free(vm_area_cachep, vma);
7342+ goto emulate;
7343+ }
7344+
7345+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7346+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7347+ up_write(&current->mm->mmap_sem);
7348+ if (vma)
7349+ kmem_cache_free(vm_area_cachep, vma);
7350+ return 1;
7351+ }
7352+
7353+ if (pax_insert_vma(vma, call_dl_resolve)) {
7354+ up_write(&current->mm->mmap_sem);
7355+ kmem_cache_free(vm_area_cachep, vma);
7356+ return 1;
7357+ }
7358+
7359+ current->mm->call_dl_resolve = call_dl_resolve;
7360+ up_write(&current->mm->mmap_sem);
7361+
7362+emulate:
7363+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7364+ regs->tpc = call_dl_resolve;
7365+ regs->tnpc = addr+4;
7366+ return 3;
7367+ }
7368+#endif
7369+
7370+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
7371+ if ((save & 0xFFC00000U) == 0x05000000U &&
7372+ (call & 0xFFFFE000U) == 0x85C0A000U &&
7373+ nop == 0x01000000U)
7374+ {
7375+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7376+ regs->u_regs[UREG_G2] = addr + 4;
7377+ addr = (save & 0x003FFFFFU) << 10;
7378+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7379+
7380+ if (test_thread_flag(TIF_32BIT))
7381+ addr &= 0xFFFFFFFFUL;
7382+
7383+ regs->tpc = addr;
7384+ regs->tnpc = addr+4;
7385+ return 3;
7386+ }
7387+
7388+ /* PaX: 64-bit PLT stub */
7389+ err = get_user(sethi1, (unsigned int *)addr);
7390+ err |= get_user(sethi2, (unsigned int *)(addr+4));
7391+ err |= get_user(or1, (unsigned int *)(addr+8));
7392+ err |= get_user(or2, (unsigned int *)(addr+12));
7393+ err |= get_user(sllx, (unsigned int *)(addr+16));
7394+ err |= get_user(add, (unsigned int *)(addr+20));
7395+ err |= get_user(jmpl, (unsigned int *)(addr+24));
7396+ err |= get_user(nop, (unsigned int *)(addr+28));
7397+ if (err)
7398+ break;
7399+
7400+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
7401+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7402+ (or1 & 0xFFFFE000U) == 0x88112000U &&
7403+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
7404+ sllx == 0x89293020U &&
7405+ add == 0x8A010005U &&
7406+ jmpl == 0x89C14000U &&
7407+ nop == 0x01000000U)
7408+ {
7409+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7410+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7411+ regs->u_regs[UREG_G4] <<= 32;
7412+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7413+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
7414+ regs->u_regs[UREG_G4] = addr + 24;
7415+ addr = regs->u_regs[UREG_G5];
7416+ regs->tpc = addr;
7417+ regs->tnpc = addr+4;
7418+ return 3;
7419+ }
7420+ }
7421+ } while (0);
7422+
7423+#ifdef CONFIG_PAX_DLRESOLVE
7424+ do { /* PaX: unpatched PLT emulation step 2 */
7425+ unsigned int save, call, nop;
7426+
7427+ err = get_user(save, (unsigned int *)(regs->tpc-4));
7428+ err |= get_user(call, (unsigned int *)regs->tpc);
7429+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
7430+ if (err)
7431+ break;
7432+
7433+ if (save == 0x9DE3BFA8U &&
7434+ (call & 0xC0000000U) == 0x40000000U &&
7435+ nop == 0x01000000U)
7436+ {
7437+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7438+
7439+ if (test_thread_flag(TIF_32BIT))
7440+ dl_resolve &= 0xFFFFFFFFUL;
7441+
7442+ regs->u_regs[UREG_RETPC] = regs->tpc;
7443+ regs->tpc = dl_resolve;
7444+ regs->tnpc = dl_resolve+4;
7445+ return 3;
7446+ }
7447+ } while (0);
7448+#endif
7449+
7450+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
7451+ unsigned int sethi, ba, nop;
7452+
7453+ err = get_user(sethi, (unsigned int *)regs->tpc);
7454+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7455+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7456+
7457+ if (err)
7458+ break;
7459+
7460+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7461+ (ba & 0xFFF00000U) == 0x30600000U &&
7462+ nop == 0x01000000U)
7463+ {
7464+ unsigned long addr;
7465+
7466+ addr = (sethi & 0x003FFFFFU) << 10;
7467+ regs->u_regs[UREG_G1] = addr;
7468+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7469+
7470+ if (test_thread_flag(TIF_32BIT))
7471+ addr &= 0xFFFFFFFFUL;
7472+
7473+ regs->tpc = addr;
7474+ regs->tnpc = addr+4;
7475+ return 2;
7476+ }
7477+ } while (0);
7478+
7479+#endif
7480+
7481+ return 1;
7482+}
7483+
7484+void pax_report_insns(void *pc, void *sp)
7485+{
7486+ unsigned long i;
7487+
7488+ printk(KERN_ERR "PAX: bytes at PC: ");
7489+ for (i = 0; i < 8; i++) {
7490+ unsigned int c;
7491+ if (get_user(c, (unsigned int *)pc+i))
7492+ printk(KERN_CONT "???????? ");
7493+ else
7494+ printk(KERN_CONT "%08x ", c);
7495+ }
7496+ printk("\n");
7497+}
7498+#endif
7499+
7500 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
7501 {
7502 struct mm_struct *mm = current->mm;
7503@@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau
7504 if (!vma)
7505 goto bad_area;
7506
7507+#ifdef CONFIG_PAX_PAGEEXEC
7508+ /* PaX: detect ITLB misses on non-exec pages */
7509+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
7510+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
7511+ {
7512+ if (address != regs->tpc)
7513+ goto good_area;
7514+
7515+ up_read(&mm->mmap_sem);
7516+ switch (pax_handle_fetch_fault(regs)) {
7517+
7518+#ifdef CONFIG_PAX_EMUPLT
7519+ case 2:
7520+ case 3:
7521+ return;
7522+#endif
7523+
7524+ }
7525+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
7526+ do_group_exit(SIGKILL);
7527+ }
7528+#endif
7529+
7530 /* Pure DTLB misses do not tell us whether the fault causing
7531 * load/store/atomic was a write or not, it only says that there
7532 * was no match. So in such a case we (carefully) read the
7533diff -urNp linux-2.6.39.2/arch/sparc/mm/hugetlbpage.c linux-2.6.39.2/arch/sparc/mm/hugetlbpage.c
7534--- linux-2.6.39.2/arch/sparc/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
7535+++ linux-2.6.39.2/arch/sparc/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
7536@@ -68,7 +68,7 @@ full_search:
7537 }
7538 return -ENOMEM;
7539 }
7540- if (likely(!vma || addr + len <= vma->vm_start)) {
7541+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7542 /*
7543 * Remember the place where we stopped the search:
7544 */
7545@@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct
7546 /* make sure it can fit in the remaining address space */
7547 if (likely(addr > len)) {
7548 vma = find_vma(mm, addr-len);
7549- if (!vma || addr <= vma->vm_start) {
7550+ if (check_heap_stack_gap(vma, addr - len, len)) {
7551 /* remember the address as a hint for next time */
7552 return (mm->free_area_cache = addr-len);
7553 }
7554@@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct
7555 if (unlikely(mm->mmap_base < len))
7556 goto bottomup;
7557
7558- addr = (mm->mmap_base-len) & HPAGE_MASK;
7559+ addr = mm->mmap_base - len;
7560
7561 do {
7562+ addr &= HPAGE_MASK;
7563 /*
7564 * Lookup failure means no vma is above this address,
7565 * else if new region fits below vma->vm_start,
7566 * return with success:
7567 */
7568 vma = find_vma(mm, addr);
7569- if (likely(!vma || addr+len <= vma->vm_start)) {
7570+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7571 /* remember the address as a hint for next time */
7572 return (mm->free_area_cache = addr);
7573 }
7574@@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct
7575 mm->cached_hole_size = vma->vm_start - addr;
7576
7577 /* try just below the current vma->vm_start */
7578- addr = (vma->vm_start-len) & HPAGE_MASK;
7579- } while (likely(len < vma->vm_start));
7580+ addr = skip_heap_stack_gap(vma, len);
7581+ } while (!IS_ERR_VALUE(addr));
7582
7583 bottomup:
7584 /*
7585@@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f
7586 if (addr) {
7587 addr = ALIGN(addr, HPAGE_SIZE);
7588 vma = find_vma(mm, addr);
7589- if (task_size - len >= addr &&
7590- (!vma || addr + len <= vma->vm_start))
7591+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
7592 return addr;
7593 }
7594 if (mm->get_unmapped_area == arch_get_unmapped_area)
7595diff -urNp linux-2.6.39.2/arch/sparc/mm/init_32.c linux-2.6.39.2/arch/sparc/mm/init_32.c
7596--- linux-2.6.39.2/arch/sparc/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
7597+++ linux-2.6.39.2/arch/sparc/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
7598@@ -318,6 +318,9 @@ extern void device_scan(void);
7599 pgprot_t PAGE_SHARED __read_mostly;
7600 EXPORT_SYMBOL(PAGE_SHARED);
7601
7602+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
7603+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
7604+
7605 void __init paging_init(void)
7606 {
7607 switch(sparc_cpu_model) {
7608@@ -346,17 +349,17 @@ void __init paging_init(void)
7609
7610 /* Initialize the protection map with non-constant, MMU dependent values. */
7611 protection_map[0] = PAGE_NONE;
7612- protection_map[1] = PAGE_READONLY;
7613- protection_map[2] = PAGE_COPY;
7614- protection_map[3] = PAGE_COPY;
7615+ protection_map[1] = PAGE_READONLY_NOEXEC;
7616+ protection_map[2] = PAGE_COPY_NOEXEC;
7617+ protection_map[3] = PAGE_COPY_NOEXEC;
7618 protection_map[4] = PAGE_READONLY;
7619 protection_map[5] = PAGE_READONLY;
7620 protection_map[6] = PAGE_COPY;
7621 protection_map[7] = PAGE_COPY;
7622 protection_map[8] = PAGE_NONE;
7623- protection_map[9] = PAGE_READONLY;
7624- protection_map[10] = PAGE_SHARED;
7625- protection_map[11] = PAGE_SHARED;
7626+ protection_map[9] = PAGE_READONLY_NOEXEC;
7627+ protection_map[10] = PAGE_SHARED_NOEXEC;
7628+ protection_map[11] = PAGE_SHARED_NOEXEC;
7629 protection_map[12] = PAGE_READONLY;
7630 protection_map[13] = PAGE_READONLY;
7631 protection_map[14] = PAGE_SHARED;
7632diff -urNp linux-2.6.39.2/arch/sparc/mm/Makefile linux-2.6.39.2/arch/sparc/mm/Makefile
7633--- linux-2.6.39.2/arch/sparc/mm/Makefile 2011-05-19 00:06:34.000000000 -0400
7634+++ linux-2.6.39.2/arch/sparc/mm/Makefile 2011-05-22 19:36:30.000000000 -0400
7635@@ -2,7 +2,7 @@
7636 #
7637
7638 asflags-y := -ansi
7639-ccflags-y := -Werror
7640+#ccflags-y := -Werror
7641
7642 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
7643 obj-y += fault_$(BITS).o
7644diff -urNp linux-2.6.39.2/arch/sparc/mm/srmmu.c linux-2.6.39.2/arch/sparc/mm/srmmu.c
7645--- linux-2.6.39.2/arch/sparc/mm/srmmu.c 2011-05-19 00:06:34.000000000 -0400
7646+++ linux-2.6.39.2/arch/sparc/mm/srmmu.c 2011-05-22 19:36:30.000000000 -0400
7647@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
7648 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
7649 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
7650 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
7651+
7652+#ifdef CONFIG_PAX_PAGEEXEC
7653+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
7654+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
7655+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
7656+#endif
7657+
7658 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
7659 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
7660
7661diff -urNp linux-2.6.39.2/arch/tile/kernel/pci.c linux-2.6.39.2/arch/tile/kernel/pci.c
7662--- linux-2.6.39.2/arch/tile/kernel/pci.c 2011-06-25 12:55:22.000000000 -0400
7663+++ linux-2.6.39.2/arch/tile/kernel/pci.c 2011-06-25 13:00:25.000000000 -0400
7664@@ -60,7 +60,7 @@ int __write_once tile_plx_gen1;
7665 static struct pci_controller controllers[TILE_NUM_PCIE];
7666 static int num_controllers;
7667
7668-static struct pci_ops tile_cfg_ops;
7669+static const struct pci_ops tile_cfg_ops;
7670
7671
7672 /*
7673@@ -563,7 +563,7 @@ static int __devinit tile_cfg_write(stru
7674 }
7675
7676
7677-static struct pci_ops tile_cfg_ops = {
7678+static const struct pci_ops tile_cfg_ops = {
7679 .read = tile_cfg_read,
7680 .write = tile_cfg_write,
7681 };
7682diff -urNp linux-2.6.39.2/arch/um/include/asm/kmap_types.h linux-2.6.39.2/arch/um/include/asm/kmap_types.h
7683--- linux-2.6.39.2/arch/um/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
7684+++ linux-2.6.39.2/arch/um/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
7685@@ -23,6 +23,7 @@ enum km_type {
7686 KM_IRQ1,
7687 KM_SOFTIRQ0,
7688 KM_SOFTIRQ1,
7689+ KM_CLEARPAGE,
7690 KM_TYPE_NR
7691 };
7692
7693diff -urNp linux-2.6.39.2/arch/um/include/asm/page.h linux-2.6.39.2/arch/um/include/asm/page.h
7694--- linux-2.6.39.2/arch/um/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
7695+++ linux-2.6.39.2/arch/um/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
7696@@ -14,6 +14,9 @@
7697 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
7698 #define PAGE_MASK (~(PAGE_SIZE-1))
7699
7700+#define ktla_ktva(addr) (addr)
7701+#define ktva_ktla(addr) (addr)
7702+
7703 #ifndef __ASSEMBLY__
7704
7705 struct page;
7706diff -urNp linux-2.6.39.2/arch/um/kernel/process.c linux-2.6.39.2/arch/um/kernel/process.c
7707--- linux-2.6.39.2/arch/um/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
7708+++ linux-2.6.39.2/arch/um/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
7709@@ -404,22 +404,6 @@ int singlestepping(void * t)
7710 return 2;
7711 }
7712
7713-/*
7714- * Only x86 and x86_64 have an arch_align_stack().
7715- * All other arches have "#define arch_align_stack(x) (x)"
7716- * in their asm/system.h
7717- * As this is included in UML from asm-um/system-generic.h,
7718- * we can use it to behave as the subarch does.
7719- */
7720-#ifndef arch_align_stack
7721-unsigned long arch_align_stack(unsigned long sp)
7722-{
7723- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
7724- sp -= get_random_int() % 8192;
7725- return sp & ~0xf;
7726-}
7727-#endif
7728-
7729 unsigned long get_wchan(struct task_struct *p)
7730 {
7731 unsigned long stack_page, sp, ip;
7732diff -urNp linux-2.6.39.2/arch/um/sys-i386/syscalls.c linux-2.6.39.2/arch/um/sys-i386/syscalls.c
7733--- linux-2.6.39.2/arch/um/sys-i386/syscalls.c 2011-05-19 00:06:34.000000000 -0400
7734+++ linux-2.6.39.2/arch/um/sys-i386/syscalls.c 2011-05-22 19:36:30.000000000 -0400
7735@@ -11,6 +11,21 @@
7736 #include "asm/uaccess.h"
7737 #include "asm/unistd.h"
7738
7739+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
7740+{
7741+ unsigned long pax_task_size = TASK_SIZE;
7742+
7743+#ifdef CONFIG_PAX_SEGMEXEC
7744+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
7745+ pax_task_size = SEGMEXEC_TASK_SIZE;
7746+#endif
7747+
7748+ if (len > pax_task_size || addr > pax_task_size - len)
7749+ return -EINVAL;
7750+
7751+ return 0;
7752+}
7753+
7754 /*
7755 * The prototype on i386 is:
7756 *
7757diff -urNp linux-2.6.39.2/arch/unicore32/kernel/pci.c linux-2.6.39.2/arch/unicore32/kernel/pci.c
7758--- linux-2.6.39.2/arch/unicore32/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7759+++ linux-2.6.39.2/arch/unicore32/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7760@@ -66,7 +66,7 @@ puv3_write_config(struct pci_bus *bus, u
7761 return PCIBIOS_SUCCESSFUL;
7762 }
7763
7764-struct pci_ops pci_puv3_ops = {
7765+const struct pci_ops pci_puv3_ops = {
7766 .read = puv3_read_config,
7767 .write = puv3_write_config,
7768 };
7769diff -urNp linux-2.6.39.2/arch/x86/boot/bitops.h linux-2.6.39.2/arch/x86/boot/bitops.h
7770--- linux-2.6.39.2/arch/x86/boot/bitops.h 2011-05-19 00:06:34.000000000 -0400
7771+++ linux-2.6.39.2/arch/x86/boot/bitops.h 2011-05-22 19:36:30.000000000 -0400
7772@@ -26,7 +26,7 @@ static inline int variable_test_bit(int
7773 u8 v;
7774 const u32 *p = (const u32 *)addr;
7775
7776- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7777+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7778 return v;
7779 }
7780
7781@@ -37,7 +37,7 @@ static inline int variable_test_bit(int
7782
7783 static inline void set_bit(int nr, void *addr)
7784 {
7785- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7786+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7787 }
7788
7789 #endif /* BOOT_BITOPS_H */
7790diff -urNp linux-2.6.39.2/arch/x86/boot/boot.h linux-2.6.39.2/arch/x86/boot/boot.h
7791--- linux-2.6.39.2/arch/x86/boot/boot.h 2011-05-19 00:06:34.000000000 -0400
7792+++ linux-2.6.39.2/arch/x86/boot/boot.h 2011-05-22 19:36:30.000000000 -0400
7793@@ -85,7 +85,7 @@ static inline void io_delay(void)
7794 static inline u16 ds(void)
7795 {
7796 u16 seg;
7797- asm("movw %%ds,%0" : "=rm" (seg));
7798+ asm volatile("movw %%ds,%0" : "=rm" (seg));
7799 return seg;
7800 }
7801
7802@@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t
7803 static inline int memcmp(const void *s1, const void *s2, size_t len)
7804 {
7805 u8 diff;
7806- asm("repe; cmpsb; setnz %0"
7807+ asm volatile("repe; cmpsb; setnz %0"
7808 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
7809 return diff;
7810 }
7811diff -urNp linux-2.6.39.2/arch/x86/boot/compressed/head_32.S linux-2.6.39.2/arch/x86/boot/compressed/head_32.S
7812--- linux-2.6.39.2/arch/x86/boot/compressed/head_32.S 2011-05-19 00:06:34.000000000 -0400
7813+++ linux-2.6.39.2/arch/x86/boot/compressed/head_32.S 2011-05-22 19:36:30.000000000 -0400
7814@@ -76,7 +76,7 @@ ENTRY(startup_32)
7815 notl %eax
7816 andl %eax, %ebx
7817 #else
7818- movl $LOAD_PHYSICAL_ADDR, %ebx
7819+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7820 #endif
7821
7822 /* Target address to relocate to for decompression */
7823@@ -162,7 +162,7 @@ relocated:
7824 * and where it was actually loaded.
7825 */
7826 movl %ebp, %ebx
7827- subl $LOAD_PHYSICAL_ADDR, %ebx
7828+ subl $____LOAD_PHYSICAL_ADDR, %ebx
7829 jz 2f /* Nothing to be done if loaded at compiled addr. */
7830 /*
7831 * Process relocations.
7832@@ -170,8 +170,7 @@ relocated:
7833
7834 1: subl $4, %edi
7835 movl (%edi), %ecx
7836- testl %ecx, %ecx
7837- jz 2f
7838+ jecxz 2f
7839 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
7840 jmp 1b
7841 2:
7842diff -urNp linux-2.6.39.2/arch/x86/boot/compressed/head_64.S linux-2.6.39.2/arch/x86/boot/compressed/head_64.S
7843--- linux-2.6.39.2/arch/x86/boot/compressed/head_64.S 2011-05-19 00:06:34.000000000 -0400
7844+++ linux-2.6.39.2/arch/x86/boot/compressed/head_64.S 2011-05-22 19:36:30.000000000 -0400
7845@@ -91,7 +91,7 @@ ENTRY(startup_32)
7846 notl %eax
7847 andl %eax, %ebx
7848 #else
7849- movl $LOAD_PHYSICAL_ADDR, %ebx
7850+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7851 #endif
7852
7853 /* Target address to relocate to for decompression */
7854@@ -233,7 +233,7 @@ ENTRY(startup_64)
7855 notq %rax
7856 andq %rax, %rbp
7857 #else
7858- movq $LOAD_PHYSICAL_ADDR, %rbp
7859+ movq $____LOAD_PHYSICAL_ADDR, %rbp
7860 #endif
7861
7862 /* Target address to relocate to for decompression */
7863diff -urNp linux-2.6.39.2/arch/x86/boot/compressed/misc.c linux-2.6.39.2/arch/x86/boot/compressed/misc.c
7864--- linux-2.6.39.2/arch/x86/boot/compressed/misc.c 2011-05-19 00:06:34.000000000 -0400
7865+++ linux-2.6.39.2/arch/x86/boot/compressed/misc.c 2011-05-22 19:36:30.000000000 -0400
7866@@ -310,7 +310,7 @@ static void parse_elf(void *output)
7867 case PT_LOAD:
7868 #ifdef CONFIG_RELOCATABLE
7869 dest = output;
7870- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
7871+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
7872 #else
7873 dest = (void *)(phdr->p_paddr);
7874 #endif
7875@@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *
7876 error("Destination address too large");
7877 #endif
7878 #ifndef CONFIG_RELOCATABLE
7879- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
7880+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
7881 error("Wrong destination address");
7882 #endif
7883
7884diff -urNp linux-2.6.39.2/arch/x86/boot/compressed/relocs.c linux-2.6.39.2/arch/x86/boot/compressed/relocs.c
7885--- linux-2.6.39.2/arch/x86/boot/compressed/relocs.c 2011-05-19 00:06:34.000000000 -0400
7886+++ linux-2.6.39.2/arch/x86/boot/compressed/relocs.c 2011-05-22 19:36:30.000000000 -0400
7887@@ -13,8 +13,11 @@
7888
7889 static void die(char *fmt, ...);
7890
7891+#include "../../../../include/generated/autoconf.h"
7892+
7893 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
7894 static Elf32_Ehdr ehdr;
7895+static Elf32_Phdr *phdr;
7896 static unsigned long reloc_count, reloc_idx;
7897 static unsigned long *relocs;
7898
7899@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
7900 }
7901 }
7902
7903+static void read_phdrs(FILE *fp)
7904+{
7905+ unsigned int i;
7906+
7907+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
7908+ if (!phdr) {
7909+ die("Unable to allocate %d program headers\n",
7910+ ehdr.e_phnum);
7911+ }
7912+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
7913+ die("Seek to %d failed: %s\n",
7914+ ehdr.e_phoff, strerror(errno));
7915+ }
7916+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
7917+ die("Cannot read ELF program headers: %s\n",
7918+ strerror(errno));
7919+ }
7920+ for(i = 0; i < ehdr.e_phnum; i++) {
7921+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
7922+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
7923+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
7924+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
7925+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
7926+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
7927+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
7928+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
7929+ }
7930+
7931+}
7932+
7933 static void read_shdrs(FILE *fp)
7934 {
7935- int i;
7936+ unsigned int i;
7937 Elf32_Shdr shdr;
7938
7939 secs = calloc(ehdr.e_shnum, sizeof(struct section));
7940@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
7941
7942 static void read_strtabs(FILE *fp)
7943 {
7944- int i;
7945+ unsigned int i;
7946 for (i = 0; i < ehdr.e_shnum; i++) {
7947 struct section *sec = &secs[i];
7948 if (sec->shdr.sh_type != SHT_STRTAB) {
7949@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
7950
7951 static void read_symtabs(FILE *fp)
7952 {
7953- int i,j;
7954+ unsigned int i,j;
7955 for (i = 0; i < ehdr.e_shnum; i++) {
7956 struct section *sec = &secs[i];
7957 if (sec->shdr.sh_type != SHT_SYMTAB) {
7958@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
7959
7960 static void read_relocs(FILE *fp)
7961 {
7962- int i,j;
7963+ unsigned int i,j;
7964+ uint32_t base;
7965+
7966 for (i = 0; i < ehdr.e_shnum; i++) {
7967 struct section *sec = &secs[i];
7968 if (sec->shdr.sh_type != SHT_REL) {
7969@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
7970 die("Cannot read symbol table: %s\n",
7971 strerror(errno));
7972 }
7973+ base = 0;
7974+ for (j = 0; j < ehdr.e_phnum; j++) {
7975+ if (phdr[j].p_type != PT_LOAD )
7976+ continue;
7977+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
7978+ continue;
7979+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
7980+ break;
7981+ }
7982 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
7983 Elf32_Rel *rel = &sec->reltab[j];
7984- rel->r_offset = elf32_to_cpu(rel->r_offset);
7985+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
7986 rel->r_info = elf32_to_cpu(rel->r_info);
7987 }
7988 }
7989@@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
7990
7991 static void print_absolute_symbols(void)
7992 {
7993- int i;
7994+ unsigned int i;
7995 printf("Absolute symbols\n");
7996 printf(" Num: Value Size Type Bind Visibility Name\n");
7997 for (i = 0; i < ehdr.e_shnum; i++) {
7998 struct section *sec = &secs[i];
7999 char *sym_strtab;
8000 Elf32_Sym *sh_symtab;
8001- int j;
8002+ unsigned int j;
8003
8004 if (sec->shdr.sh_type != SHT_SYMTAB) {
8005 continue;
8006@@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
8007
8008 static void print_absolute_relocs(void)
8009 {
8010- int i, printed = 0;
8011+ unsigned int i, printed = 0;
8012
8013 for (i = 0; i < ehdr.e_shnum; i++) {
8014 struct section *sec = &secs[i];
8015 struct section *sec_applies, *sec_symtab;
8016 char *sym_strtab;
8017 Elf32_Sym *sh_symtab;
8018- int j;
8019+ unsigned int j;
8020 if (sec->shdr.sh_type != SHT_REL) {
8021 continue;
8022 }
8023@@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
8024
8025 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
8026 {
8027- int i;
8028+ unsigned int i;
8029 /* Walk through the relocations */
8030 for (i = 0; i < ehdr.e_shnum; i++) {
8031 char *sym_strtab;
8032 Elf32_Sym *sh_symtab;
8033 struct section *sec_applies, *sec_symtab;
8034- int j;
8035+ unsigned int j;
8036 struct section *sec = &secs[i];
8037
8038 if (sec->shdr.sh_type != SHT_REL) {
8039@@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
8040 !is_rel_reloc(sym_name(sym_strtab, sym))) {
8041 continue;
8042 }
8043+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
8044+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
8045+ continue;
8046+
8047+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
8048+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
8049+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
8050+ continue;
8051+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
8052+ continue;
8053+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
8054+ continue;
8055+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
8056+ continue;
8057+#endif
8058+
8059 switch (r_type) {
8060 case R_386_NONE:
8061 case R_386_PC32:
8062@@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
8063
8064 static void emit_relocs(int as_text)
8065 {
8066- int i;
8067+ unsigned int i;
8068 /* Count how many relocations I have and allocate space for them. */
8069 reloc_count = 0;
8070 walk_relocs(count_reloc);
8071@@ -665,6 +725,7 @@ int main(int argc, char **argv)
8072 fname, strerror(errno));
8073 }
8074 read_ehdr(fp);
8075+ read_phdrs(fp);
8076 read_shdrs(fp);
8077 read_strtabs(fp);
8078 read_symtabs(fp);
8079diff -urNp linux-2.6.39.2/arch/x86/boot/cpucheck.c linux-2.6.39.2/arch/x86/boot/cpucheck.c
8080--- linux-2.6.39.2/arch/x86/boot/cpucheck.c 2011-05-19 00:06:34.000000000 -0400
8081+++ linux-2.6.39.2/arch/x86/boot/cpucheck.c 2011-05-22 19:36:30.000000000 -0400
8082@@ -74,7 +74,7 @@ static int has_fpu(void)
8083 u16 fcw = -1, fsw = -1;
8084 u32 cr0;
8085
8086- asm("movl %%cr0,%0" : "=r" (cr0));
8087+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
8088 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
8089 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
8090 asm volatile("movl %0,%%cr0" : : "r" (cr0));
8091@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
8092 {
8093 u32 f0, f1;
8094
8095- asm("pushfl ; "
8096+ asm volatile("pushfl ; "
8097 "pushfl ; "
8098 "popl %0 ; "
8099 "movl %0,%1 ; "
8100@@ -115,7 +115,7 @@ static void get_flags(void)
8101 set_bit(X86_FEATURE_FPU, cpu.flags);
8102
8103 if (has_eflag(X86_EFLAGS_ID)) {
8104- asm("cpuid"
8105+ asm volatile("cpuid"
8106 : "=a" (max_intel_level),
8107 "=b" (cpu_vendor[0]),
8108 "=d" (cpu_vendor[1]),
8109@@ -124,7 +124,7 @@ static void get_flags(void)
8110
8111 if (max_intel_level >= 0x00000001 &&
8112 max_intel_level <= 0x0000ffff) {
8113- asm("cpuid"
8114+ asm volatile("cpuid"
8115 : "=a" (tfms),
8116 "=c" (cpu.flags[4]),
8117 "=d" (cpu.flags[0])
8118@@ -136,7 +136,7 @@ static void get_flags(void)
8119 cpu.model += ((tfms >> 16) & 0xf) << 4;
8120 }
8121
8122- asm("cpuid"
8123+ asm volatile("cpuid"
8124 : "=a" (max_amd_level)
8125 : "a" (0x80000000)
8126 : "ebx", "ecx", "edx");
8127@@ -144,7 +144,7 @@ static void get_flags(void)
8128 if (max_amd_level >= 0x80000001 &&
8129 max_amd_level <= 0x8000ffff) {
8130 u32 eax = 0x80000001;
8131- asm("cpuid"
8132+ asm volatile("cpuid"
8133 : "+a" (eax),
8134 "=c" (cpu.flags[6]),
8135 "=d" (cpu.flags[1])
8136@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
8137 u32 ecx = MSR_K7_HWCR;
8138 u32 eax, edx;
8139
8140- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8141+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8142 eax &= ~(1 << 15);
8143- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8144+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8145
8146 get_flags(); /* Make sure it really did something */
8147 err = check_flags();
8148@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
8149 u32 ecx = MSR_VIA_FCR;
8150 u32 eax, edx;
8151
8152- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8153+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8154 eax |= (1<<1)|(1<<7);
8155- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8156+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8157
8158 set_bit(X86_FEATURE_CX8, cpu.flags);
8159 err = check_flags();
8160@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
8161 u32 eax, edx;
8162 u32 level = 1;
8163
8164- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8165- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
8166- asm("cpuid"
8167+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8168+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
8169+ asm volatile("cpuid"
8170 : "+a" (level), "=d" (cpu.flags[0])
8171 : : "ecx", "ebx");
8172- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8173+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8174
8175 err = check_flags();
8176 }
8177diff -urNp linux-2.6.39.2/arch/x86/boot/header.S linux-2.6.39.2/arch/x86/boot/header.S
8178--- linux-2.6.39.2/arch/x86/boot/header.S 2011-05-19 00:06:34.000000000 -0400
8179+++ linux-2.6.39.2/arch/x86/boot/header.S 2011-05-22 19:36:30.000000000 -0400
8180@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
8181 # single linked list of
8182 # struct setup_data
8183
8184-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
8185+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
8186
8187 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
8188 #define VO_INIT_SIZE (VO__end - VO__text)
8189diff -urNp linux-2.6.39.2/arch/x86/boot/memory.c linux-2.6.39.2/arch/x86/boot/memory.c
8190--- linux-2.6.39.2/arch/x86/boot/memory.c 2011-05-19 00:06:34.000000000 -0400
8191+++ linux-2.6.39.2/arch/x86/boot/memory.c 2011-05-22 19:36:30.000000000 -0400
8192@@ -19,7 +19,7 @@
8193
8194 static int detect_memory_e820(void)
8195 {
8196- int count = 0;
8197+ unsigned int count = 0;
8198 struct biosregs ireg, oreg;
8199 struct e820entry *desc = boot_params.e820_map;
8200 static struct e820entry buf; /* static so it is zeroed */
8201diff -urNp linux-2.6.39.2/arch/x86/boot/video.c linux-2.6.39.2/arch/x86/boot/video.c
8202--- linux-2.6.39.2/arch/x86/boot/video.c 2011-05-19 00:06:34.000000000 -0400
8203+++ linux-2.6.39.2/arch/x86/boot/video.c 2011-05-22 19:36:30.000000000 -0400
8204@@ -96,7 +96,7 @@ static void store_mode_params(void)
8205 static unsigned int get_entry(void)
8206 {
8207 char entry_buf[4];
8208- int i, len = 0;
8209+ unsigned int i, len = 0;
8210 int key;
8211 unsigned int v;
8212
8213diff -urNp linux-2.6.39.2/arch/x86/boot/video-vesa.c linux-2.6.39.2/arch/x86/boot/video-vesa.c
8214--- linux-2.6.39.2/arch/x86/boot/video-vesa.c 2011-05-19 00:06:34.000000000 -0400
8215+++ linux-2.6.39.2/arch/x86/boot/video-vesa.c 2011-05-22 19:36:30.000000000 -0400
8216@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
8217
8218 boot_params.screen_info.vesapm_seg = oreg.es;
8219 boot_params.screen_info.vesapm_off = oreg.di;
8220+ boot_params.screen_info.vesapm_size = oreg.cx;
8221 }
8222
8223 /*
8224diff -urNp linux-2.6.39.2/arch/x86/ia32/ia32_aout.c linux-2.6.39.2/arch/x86/ia32/ia32_aout.c
8225--- linux-2.6.39.2/arch/x86/ia32/ia32_aout.c 2011-05-19 00:06:34.000000000 -0400
8226+++ linux-2.6.39.2/arch/x86/ia32/ia32_aout.c 2011-05-22 19:41:32.000000000 -0400
8227@@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
8228 unsigned long dump_start, dump_size;
8229 struct user32 dump;
8230
8231+ memset(&dump, 0, sizeof(dump));
8232+
8233 fs = get_fs();
8234 set_fs(KERNEL_DS);
8235 has_dumped = 1;
8236diff -urNp linux-2.6.39.2/arch/x86/ia32/ia32entry.S linux-2.6.39.2/arch/x86/ia32/ia32entry.S
8237--- linux-2.6.39.2/arch/x86/ia32/ia32entry.S 2011-05-19 00:06:34.000000000 -0400
8238+++ linux-2.6.39.2/arch/x86/ia32/ia32entry.S 2011-05-23 17:16:01.000000000 -0400
8239@@ -13,6 +13,7 @@
8240 #include <asm/thread_info.h>
8241 #include <asm/segment.h>
8242 #include <asm/irqflags.h>
8243+#include <asm/pgtable.h>
8244 #include <linux/linkage.h>
8245
8246 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
8247@@ -95,6 +96,32 @@ ENTRY(native_irq_enable_sysexit)
8248 ENDPROC(native_irq_enable_sysexit)
8249 #endif
8250
8251+ .macro pax_enter_kernel_user
8252+#ifdef CONFIG_PAX_MEMORY_UDEREF
8253+ call pax_enter_kernel_user
8254+#endif
8255+ .endm
8256+
8257+ .macro pax_exit_kernel_user
8258+#ifdef CONFIG_PAX_MEMORY_UDEREF
8259+ call pax_exit_kernel_user
8260+#endif
8261+#ifdef CONFIG_PAX_RANDKSTACK
8262+ pushq %rax
8263+ call pax_randomize_kstack
8264+ popq %rax
8265+#endif
8266+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
8267+ call pax_erase_kstack
8268+#endif
8269+ .endm
8270+
8271+ .macro pax_erase_kstack
8272+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
8273+ call pax_erase_kstack
8274+#endif
8275+ .endm
8276+
8277 /*
8278 * 32bit SYSENTER instruction entry.
8279 *
8280@@ -121,7 +148,7 @@ ENTRY(ia32_sysenter_target)
8281 CFI_REGISTER rsp,rbp
8282 SWAPGS_UNSAFE_STACK
8283 movq PER_CPU_VAR(kernel_stack), %rsp
8284- addq $(KERNEL_STACK_OFFSET),%rsp
8285+ pax_enter_kernel_user
8286 /*
8287 * No need to follow this irqs on/off section: the syscall
8288 * disabled irqs, here we enable it straight after entry:
8289@@ -134,7 +161,8 @@ ENTRY(ia32_sysenter_target)
8290 CFI_REL_OFFSET rsp,0
8291 pushfq_cfi
8292 /*CFI_REL_OFFSET rflags,0*/
8293- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
8294+ GET_THREAD_INFO(%r10)
8295+ movl TI_sysenter_return(%r10), %r10d
8296 CFI_REGISTER rip,r10
8297 pushq_cfi $__USER32_CS
8298 /*CFI_REL_OFFSET cs,0*/
8299@@ -146,6 +174,12 @@ ENTRY(ia32_sysenter_target)
8300 SAVE_ARGS 0,0,1
8301 /* no need to do an access_ok check here because rbp has been
8302 32bit zero extended */
8303+
8304+#ifdef CONFIG_PAX_MEMORY_UDEREF
8305+ mov $PAX_USER_SHADOW_BASE,%r10
8306+ add %r10,%rbp
8307+#endif
8308+
8309 1: movl (%rbp),%ebp
8310 .section __ex_table,"a"
8311 .quad 1b,ia32_badarg
8312@@ -168,6 +202,7 @@ sysenter_dispatch:
8313 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8314 jnz sysexit_audit
8315 sysexit_from_sys_call:
8316+ pax_exit_kernel_user
8317 andl $~TS_COMPAT,TI_status(%r10)
8318 /* clear IF, that popfq doesn't enable interrupts early */
8319 andl $~0x200,EFLAGS-R11(%rsp)
8320@@ -194,6 +229,9 @@ sysexit_from_sys_call:
8321 movl %eax,%esi /* 2nd arg: syscall number */
8322 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
8323 call audit_syscall_entry
8324+
8325+ pax_erase_kstack
8326+
8327 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
8328 cmpq $(IA32_NR_syscalls-1),%rax
8329 ja ia32_badsys
8330@@ -246,6 +284,9 @@ sysenter_tracesys:
8331 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
8332 movq %rsp,%rdi /* &pt_regs -> arg1 */
8333 call syscall_trace_enter
8334+
8335+ pax_erase_kstack
8336+
8337 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8338 RESTORE_REST
8339 cmpq $(IA32_NR_syscalls-1),%rax
8340@@ -277,19 +318,24 @@ ENDPROC(ia32_sysenter_target)
8341 ENTRY(ia32_cstar_target)
8342 CFI_STARTPROC32 simple
8343 CFI_SIGNAL_FRAME
8344- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
8345+ CFI_DEF_CFA rsp,0
8346 CFI_REGISTER rip,rcx
8347 /*CFI_REGISTER rflags,r11*/
8348 SWAPGS_UNSAFE_STACK
8349 movl %esp,%r8d
8350 CFI_REGISTER rsp,r8
8351 movq PER_CPU_VAR(kernel_stack),%rsp
8352+
8353+#ifdef CONFIG_PAX_MEMORY_UDEREF
8354+ pax_enter_kernel_user
8355+#endif
8356+
8357 /*
8358 * No need to follow this irqs on/off section: the syscall
8359 * disabled irqs and here we enable it straight after entry:
8360 */
8361 ENABLE_INTERRUPTS(CLBR_NONE)
8362- SAVE_ARGS 8,1,1
8363+ SAVE_ARGS 8*6,1,1
8364 movl %eax,%eax /* zero extension */
8365 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
8366 movq %rcx,RIP-ARGOFFSET(%rsp)
8367@@ -305,6 +351,12 @@ ENTRY(ia32_cstar_target)
8368 /* no need to do an access_ok check here because r8 has been
8369 32bit zero extended */
8370 /* hardware stack frame is complete now */
8371+
8372+#ifdef CONFIG_PAX_MEMORY_UDEREF
8373+ mov $PAX_USER_SHADOW_BASE,%r10
8374+ add %r10,%r8
8375+#endif
8376+
8377 1: movl (%r8),%r9d
8378 .section __ex_table,"a"
8379 .quad 1b,ia32_badarg
8380@@ -327,6 +379,7 @@ cstar_dispatch:
8381 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8382 jnz sysretl_audit
8383 sysretl_from_sys_call:
8384+ pax_exit_kernel_user
8385 andl $~TS_COMPAT,TI_status(%r10)
8386 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
8387 movl RIP-ARGOFFSET(%rsp),%ecx
8388@@ -364,6 +417,9 @@ cstar_tracesys:
8389 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8390 movq %rsp,%rdi /* &pt_regs -> arg1 */
8391 call syscall_trace_enter
8392+
8393+ pax_erase_kstack
8394+
8395 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
8396 RESTORE_REST
8397 xchgl %ebp,%r9d
8398@@ -409,6 +465,7 @@ ENTRY(ia32_syscall)
8399 CFI_REL_OFFSET rip,RIP-RIP
8400 PARAVIRT_ADJUST_EXCEPTION_FRAME
8401 SWAPGS
8402+ pax_enter_kernel_user
8403 /*
8404 * No need to follow this irqs on/off section: the syscall
8405 * disabled irqs and here we enable it straight after entry:
8406@@ -441,6 +498,9 @@ ia32_tracesys:
8407 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8408 movq %rsp,%rdi /* &pt_regs -> arg1 */
8409 call syscall_trace_enter
8410+
8411+ pax_erase_kstack
8412+
8413 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8414 RESTORE_REST
8415 cmpq $(IA32_NR_syscalls-1),%rax
8416diff -urNp linux-2.6.39.2/arch/x86/ia32/ia32_signal.c linux-2.6.39.2/arch/x86/ia32/ia32_signal.c
8417--- linux-2.6.39.2/arch/x86/ia32/ia32_signal.c 2011-05-19 00:06:34.000000000 -0400
8418+++ linux-2.6.39.2/arch/x86/ia32/ia32_signal.c 2011-05-22 19:36:30.000000000 -0400
8419@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
8420 sp -= frame_size;
8421 /* Align the stack pointer according to the i386 ABI,
8422 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
8423- sp = ((sp + 4) & -16ul) - 4;
8424+ sp = ((sp - 12) & -16ul) - 4;
8425 return (void __user *) sp;
8426 }
8427
8428@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
8429 * These are actually not used anymore, but left because some
8430 * gdb versions depend on them as a marker.
8431 */
8432- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8433+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8434 } put_user_catch(err);
8435
8436 if (err)
8437@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
8438 0xb8,
8439 __NR_ia32_rt_sigreturn,
8440 0x80cd,
8441- 0,
8442+ 0
8443 };
8444
8445 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
8446@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
8447
8448 if (ka->sa.sa_flags & SA_RESTORER)
8449 restorer = ka->sa.sa_restorer;
8450+ else if (current->mm->context.vdso)
8451+ /* Return stub is in 32bit vsyscall page */
8452+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
8453 else
8454- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
8455- rt_sigreturn);
8456+ restorer = &frame->retcode;
8457 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
8458
8459 /*
8460 * Not actually used anymore, but left because some gdb
8461 * versions need it.
8462 */
8463- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8464+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8465 } put_user_catch(err);
8466
8467 if (err)
8468diff -urNp linux-2.6.39.2/arch/x86/include/asm/alternative.h linux-2.6.39.2/arch/x86/include/asm/alternative.h
8469--- linux-2.6.39.2/arch/x86/include/asm/alternative.h 2011-05-19 00:06:34.000000000 -0400
8470+++ linux-2.6.39.2/arch/x86/include/asm/alternative.h 2011-05-22 19:36:30.000000000 -0400
8471@@ -94,7 +94,7 @@ static inline int alternatives_text_rese
8472 ".section .discard,\"aw\",@progbits\n" \
8473 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
8474 ".previous\n" \
8475- ".section .altinstr_replacement, \"ax\"\n" \
8476+ ".section .altinstr_replacement, \"a\"\n" \
8477 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
8478 ".previous"
8479
8480diff -urNp linux-2.6.39.2/arch/x86/include/asm/apm.h linux-2.6.39.2/arch/x86/include/asm/apm.h
8481--- linux-2.6.39.2/arch/x86/include/asm/apm.h 2011-05-19 00:06:34.000000000 -0400
8482+++ linux-2.6.39.2/arch/x86/include/asm/apm.h 2011-05-22 19:36:30.000000000 -0400
8483@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
8484 __asm__ __volatile__(APM_DO_ZERO_SEGS
8485 "pushl %%edi\n\t"
8486 "pushl %%ebp\n\t"
8487- "lcall *%%cs:apm_bios_entry\n\t"
8488+ "lcall *%%ss:apm_bios_entry\n\t"
8489 "setc %%al\n\t"
8490 "popl %%ebp\n\t"
8491 "popl %%edi\n\t"
8492@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
8493 __asm__ __volatile__(APM_DO_ZERO_SEGS
8494 "pushl %%edi\n\t"
8495 "pushl %%ebp\n\t"
8496- "lcall *%%cs:apm_bios_entry\n\t"
8497+ "lcall *%%ss:apm_bios_entry\n\t"
8498 "setc %%bl\n\t"
8499 "popl %%ebp\n\t"
8500 "popl %%edi\n\t"
8501diff -urNp linux-2.6.39.2/arch/x86/include/asm/atomic64_32.h linux-2.6.39.2/arch/x86/include/asm/atomic64_32.h
8502--- linux-2.6.39.2/arch/x86/include/asm/atomic64_32.h 2011-05-19 00:06:34.000000000 -0400
8503+++ linux-2.6.39.2/arch/x86/include/asm/atomic64_32.h 2011-05-22 19:36:30.000000000 -0400
8504@@ -12,6 +12,14 @@ typedef struct {
8505 u64 __aligned(8) counter;
8506 } atomic64_t;
8507
8508+#ifdef CONFIG_PAX_REFCOUNT
8509+typedef struct {
8510+ u64 __aligned(8) counter;
8511+} atomic64_unchecked_t;
8512+#else
8513+typedef atomic64_t atomic64_unchecked_t;
8514+#endif
8515+
8516 #define ATOMIC64_INIT(val) { (val) }
8517
8518 #ifdef CONFIG_X86_CMPXCHG64
8519@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
8520 }
8521
8522 /**
8523+ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
8524+ * @p: pointer to type atomic64_unchecked_t
8525+ * @o: expected value
8526+ * @n: new value
8527+ *
8528+ * Atomically sets @v to @n if it was equal to @o and returns
8529+ * the old value.
8530+ */
8531+
8532+static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
8533+{
8534+ return cmpxchg64(&v->counter, o, n);
8535+}
8536+
8537+/**
8538 * atomic64_xchg - xchg atomic64 variable
8539 * @v: pointer to type atomic64_t
8540 * @n: value to assign
8541@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
8542 }
8543
8544 /**
8545+ * atomic64_set_unchecked - set atomic64 variable
8546+ * @v: pointer to type atomic64_unchecked_t
8547+ * @n: value to assign
8548+ *
8549+ * Atomically sets the value of @v to @n.
8550+ */
8551+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
8552+{
8553+ unsigned high = (unsigned)(i >> 32);
8554+ unsigned low = (unsigned)i;
8555+ asm volatile(ATOMIC64_ALTERNATIVE(set)
8556+ : "+b" (low), "+c" (high)
8557+ : "S" (v)
8558+ : "eax", "edx", "memory"
8559+ );
8560+}
8561+
8562+/**
8563 * atomic64_read - read atomic64 variable
8564 * @v: pointer to type atomic64_t
8565 *
8566@@ -93,6 +134,22 @@ static inline long long atomic64_read(at
8567 }
8568
8569 /**
8570+ * atomic64_read_unchecked - read atomic64 variable
8571+ * @v: pointer to type atomic64_unchecked_t
8572+ *
8573+ * Atomically reads the value of @v and returns it.
8574+ */
8575+static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
8576+{
8577+ long long r;
8578+ asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
8579+ : "=A" (r), "+c" (v)
8580+ : : "memory"
8581+ );
8582+ return r;
8583+ }
8584+
8585+/**
8586 * atomic64_add_return - add and return
8587 * @i: integer value to add
8588 * @v: pointer to type atomic64_t
8589@@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
8590 return i;
8591 }
8592
8593+/**
8594+ * atomic64_add_return_unchecked - add and return
8595+ * @i: integer value to add
8596+ * @v: pointer to type atomic64_unchecked_t
8597+ *
8598+ * Atomically adds @i to @v and returns @i + *@v
8599+ */
8600+static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
8601+{
8602+ asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
8603+ : "+A" (i), "+c" (v)
8604+ : : "memory"
8605+ );
8606+ return i;
8607+}
8608+
8609 /*
8610 * Other variants with different arithmetic operators:
8611 */
8612@@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
8613 return a;
8614 }
8615
8616+static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8617+{
8618+ long long a;
8619+ asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
8620+ : "=A" (a)
8621+ : "S" (v)
8622+ : "memory", "ecx"
8623+ );
8624+ return a;
8625+}
8626+
8627 static inline long long atomic64_dec_return(atomic64_t *v)
8628 {
8629 long long a;
8630@@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
8631 }
8632
8633 /**
8634+ * atomic64_add_unchecked - add integer to atomic64 variable
8635+ * @i: integer value to add
8636+ * @v: pointer to type atomic64_unchecked_t
8637+ *
8638+ * Atomically adds @i to @v.
8639+ */
8640+static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
8641+{
8642+ asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
8643+ : "+A" (i), "+c" (v)
8644+ : : "memory"
8645+ );
8646+ return i;
8647+}
8648+
8649+/**
8650 * atomic64_sub - subtract the atomic64 variable
8651 * @i: integer value to subtract
8652 * @v: pointer to type atomic64_t
8653diff -urNp linux-2.6.39.2/arch/x86/include/asm/atomic64_64.h linux-2.6.39.2/arch/x86/include/asm/atomic64_64.h
8654--- linux-2.6.39.2/arch/x86/include/asm/atomic64_64.h 2011-05-19 00:06:34.000000000 -0400
8655+++ linux-2.6.39.2/arch/x86/include/asm/atomic64_64.h 2011-05-22 19:36:30.000000000 -0400
8656@@ -18,7 +18,19 @@
8657 */
8658 static inline long atomic64_read(const atomic64_t *v)
8659 {
8660- return (*(volatile long *)&(v)->counter);
8661+ return (*(volatile const long *)&(v)->counter);
8662+}
8663+
8664+/**
8665+ * atomic64_read_unchecked - read atomic64 variable
8666+ * @v: pointer of type atomic64_unchecked_t
8667+ *
8668+ * Atomically reads the value of @v.
8669+ * Doesn't imply a read memory barrier.
8670+ */
8671+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8672+{
8673+ return (*(volatile const long *)&(v)->counter);
8674 }
8675
8676 /**
8677@@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64
8678 }
8679
8680 /**
8681+ * atomic64_set_unchecked - set atomic64 variable
8682+ * @v: pointer to type atomic64_unchecked_t
8683+ * @i: required value
8684+ *
8685+ * Atomically sets the value of @v to @i.
8686+ */
8687+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8688+{
8689+ v->counter = i;
8690+}
8691+
8692+/**
8693 * atomic64_add - add integer to atomic64 variable
8694 * @i: integer value to add
8695 * @v: pointer to type atomic64_t
8696@@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64
8697 */
8698 static inline void atomic64_add(long i, atomic64_t *v)
8699 {
8700+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
8701+
8702+#ifdef CONFIG_PAX_REFCOUNT
8703+ "jno 0f\n"
8704+ LOCK_PREFIX "subq %1,%0\n"
8705+ "int $4\n0:\n"
8706+ _ASM_EXTABLE(0b, 0b)
8707+#endif
8708+
8709+ : "=m" (v->counter)
8710+ : "er" (i), "m" (v->counter));
8711+}
8712+
8713+/**
8714+ * atomic64_add_unchecked - add integer to atomic64 variable
8715+ * @i: integer value to add
8716+ * @v: pointer to type atomic64_unchecked_t
8717+ *
8718+ * Atomically adds @i to @v.
8719+ */
8720+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
8721+{
8722 asm volatile(LOCK_PREFIX "addq %1,%0"
8723 : "=m" (v->counter)
8724 : "er" (i), "m" (v->counter));
8725@@ -56,7 +102,29 @@ static inline void atomic64_add(long i,
8726 */
8727 static inline void atomic64_sub(long i, atomic64_t *v)
8728 {
8729- asm volatile(LOCK_PREFIX "subq %1,%0"
8730+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
8731+
8732+#ifdef CONFIG_PAX_REFCOUNT
8733+ "jno 0f\n"
8734+ LOCK_PREFIX "addq %1,%0\n"
8735+ "int $4\n0:\n"
8736+ _ASM_EXTABLE(0b, 0b)
8737+#endif
8738+
8739+ : "=m" (v->counter)
8740+ : "er" (i), "m" (v->counter));
8741+}
8742+
8743+/**
8744+ * atomic64_sub_unchecked - subtract the atomic64 variable
8745+ * @i: integer value to subtract
8746+ * @v: pointer to type atomic64_unchecked_t
8747+ *
8748+ * Atomically subtracts @i from @v.
8749+ */
8750+static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
8751+{
8752+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
8753 : "=m" (v->counter)
8754 : "er" (i), "m" (v->counter));
8755 }
8756@@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(
8757 {
8758 unsigned char c;
8759
8760- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
8761+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
8762+
8763+#ifdef CONFIG_PAX_REFCOUNT
8764+ "jno 0f\n"
8765+ LOCK_PREFIX "addq %2,%0\n"
8766+ "int $4\n0:\n"
8767+ _ASM_EXTABLE(0b, 0b)
8768+#endif
8769+
8770+ "sete %1\n"
8771 : "=m" (v->counter), "=qm" (c)
8772 : "er" (i), "m" (v->counter) : "memory");
8773 return c;
8774@@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(
8775 */
8776 static inline void atomic64_inc(atomic64_t *v)
8777 {
8778+ asm volatile(LOCK_PREFIX "incq %0\n"
8779+
8780+#ifdef CONFIG_PAX_REFCOUNT
8781+ "jno 0f\n"
8782+ LOCK_PREFIX "decq %0\n"
8783+ "int $4\n0:\n"
8784+ _ASM_EXTABLE(0b, 0b)
8785+#endif
8786+
8787+ : "=m" (v->counter)
8788+ : "m" (v->counter));
8789+}
8790+
8791+/**
8792+ * atomic64_inc_unchecked - increment atomic64 variable
8793+ * @v: pointer to type atomic64_unchecked_t
8794+ *
8795+ * Atomically increments @v by 1.
8796+ */
8797+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8798+{
8799 asm volatile(LOCK_PREFIX "incq %0"
8800 : "=m" (v->counter)
8801 : "m" (v->counter));
8802@@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64
8803 */
8804 static inline void atomic64_dec(atomic64_t *v)
8805 {
8806- asm volatile(LOCK_PREFIX "decq %0"
8807+ asm volatile(LOCK_PREFIX "decq %0\n"
8808+
8809+#ifdef CONFIG_PAX_REFCOUNT
8810+ "jno 0f\n"
8811+ LOCK_PREFIX "incq %0\n"
8812+ "int $4\n0:\n"
8813+ _ASM_EXTABLE(0b, 0b)
8814+#endif
8815+
8816+ : "=m" (v->counter)
8817+ : "m" (v->counter));
8818+}
8819+
8820+/**
8821+ * atomic64_dec_unchecked - decrement atomic64 variable
8822+ * @v: pointer to type atomic64_t
8823+ *
8824+ * Atomically decrements @v by 1.
8825+ */
8826+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8827+{
8828+ asm volatile(LOCK_PREFIX "decq %0\n"
8829 : "=m" (v->counter)
8830 : "m" (v->counter));
8831 }
8832@@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(
8833 {
8834 unsigned char c;
8835
8836- asm volatile(LOCK_PREFIX "decq %0; sete %1"
8837+ asm volatile(LOCK_PREFIX "decq %0\n"
8838+
8839+#ifdef CONFIG_PAX_REFCOUNT
8840+ "jno 0f\n"
8841+ LOCK_PREFIX "incq %0\n"
8842+ "int $4\n0:\n"
8843+ _ASM_EXTABLE(0b, 0b)
8844+#endif
8845+
8846+ "sete %1\n"
8847 : "=m" (v->counter), "=qm" (c)
8848 : "m" (v->counter) : "memory");
8849 return c != 0;
8850@@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(
8851 {
8852 unsigned char c;
8853
8854- asm volatile(LOCK_PREFIX "incq %0; sete %1"
8855+ asm volatile(LOCK_PREFIX "incq %0\n"
8856+
8857+#ifdef CONFIG_PAX_REFCOUNT
8858+ "jno 0f\n"
8859+ LOCK_PREFIX "decq %0\n"
8860+ "int $4\n0:\n"
8861+ _ASM_EXTABLE(0b, 0b)
8862+#endif
8863+
8864+ "sete %1\n"
8865 : "=m" (v->counter), "=qm" (c)
8866 : "m" (v->counter) : "memory");
8867 return c != 0;
8868@@ -155,7 +292,16 @@ static inline int atomic64_add_negative(
8869 {
8870 unsigned char c;
8871
8872- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8873+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
8874+
8875+#ifdef CONFIG_PAX_REFCOUNT
8876+ "jno 0f\n"
8877+ LOCK_PREFIX "subq %2,%0\n"
8878+ "int $4\n0:\n"
8879+ _ASM_EXTABLE(0b, 0b)
8880+#endif
8881+
8882+ "sets %1\n"
8883 : "=m" (v->counter), "=qm" (c)
8884 : "er" (i), "m" (v->counter) : "memory");
8885 return c;
8886@@ -171,7 +317,31 @@ static inline int atomic64_add_negative(
8887 static inline long atomic64_add_return(long i, atomic64_t *v)
8888 {
8889 long __i = i;
8890- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8891+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8892+
8893+#ifdef CONFIG_PAX_REFCOUNT
8894+ "jno 0f\n"
8895+ "movq %0, %1\n"
8896+ "int $4\n0:\n"
8897+ _ASM_EXTABLE(0b, 0b)
8898+#endif
8899+
8900+ : "+r" (i), "+m" (v->counter)
8901+ : : "memory");
8902+ return i + __i;
8903+}
8904+
8905+/**
8906+ * atomic64_add_return_unchecked - add and return
8907+ * @i: integer value to add
8908+ * @v: pointer to type atomic64_unchecked_t
8909+ *
8910+ * Atomically adds @i to @v and returns @i + @v
8911+ */
8912+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8913+{
8914+ long __i = i;
8915+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
8916 : "+r" (i), "+m" (v->counter)
8917 : : "memory");
8918 return i + __i;
8919@@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l
8920 }
8921
8922 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
8923+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8924+{
8925+ return atomic64_add_return_unchecked(1, v);
8926+}
8927 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8928
8929 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
8930@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
8931 return cmpxchg(&v->counter, old, new);
8932 }
8933
8934+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8935+{
8936+ return cmpxchg(&v->counter, old, new);
8937+}
8938+
8939 static inline long atomic64_xchg(atomic64_t *v, long new)
8940 {
8941 return xchg(&v->counter, new);
8942@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
8943 */
8944 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
8945 {
8946- long c, old;
8947+ long c, old, new;
8948 c = atomic64_read(v);
8949 for (;;) {
8950- if (unlikely(c == (u)))
8951+ if (unlikely(c == u))
8952 break;
8953- old = atomic64_cmpxchg((v), c, c + (a));
8954+
8955+ asm volatile("add %2,%0\n"
8956+
8957+#ifdef CONFIG_PAX_REFCOUNT
8958+ "jno 0f\n"
8959+ "sub %2,%0\n"
8960+ "int $4\n0:\n"
8961+ _ASM_EXTABLE(0b, 0b)
8962+#endif
8963+
8964+ : "=r" (new)
8965+ : "0" (c), "ir" (a));
8966+
8967+ old = atomic64_cmpxchg(v, c, new);
8968 if (likely(old == c))
8969 break;
8970 c = old;
8971 }
8972- return c != (u);
8973+ return c != u;
8974 }
8975
8976 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
8977diff -urNp linux-2.6.39.2/arch/x86/include/asm/atomic.h linux-2.6.39.2/arch/x86/include/asm/atomic.h
8978--- linux-2.6.39.2/arch/x86/include/asm/atomic.h 2011-05-19 00:06:34.000000000 -0400
8979+++ linux-2.6.39.2/arch/x86/include/asm/atomic.h 2011-05-22 19:36:30.000000000 -0400
8980@@ -22,7 +22,18 @@
8981 */
8982 static inline int atomic_read(const atomic_t *v)
8983 {
8984- return (*(volatile int *)&(v)->counter);
8985+ return (*(volatile const int *)&(v)->counter);
8986+}
8987+
8988+/**
8989+ * atomic_read_unchecked - read atomic variable
8990+ * @v: pointer of type atomic_unchecked_t
8991+ *
8992+ * Atomically reads the value of @v.
8993+ */
8994+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
8995+{
8996+ return (*(volatile const int *)&(v)->counter);
8997 }
8998
8999 /**
9000@@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *
9001 }
9002
9003 /**
9004+ * atomic_set_unchecked - set atomic variable
9005+ * @v: pointer of type atomic_unchecked_t
9006+ * @i: required value
9007+ *
9008+ * Atomically sets the value of @v to @i.
9009+ */
9010+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
9011+{
9012+ v->counter = i;
9013+}
9014+
9015+/**
9016 * atomic_add - add integer to atomic variable
9017 * @i: integer value to add
9018 * @v: pointer of type atomic_t
9019@@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *
9020 */
9021 static inline void atomic_add(int i, atomic_t *v)
9022 {
9023- asm volatile(LOCK_PREFIX "addl %1,%0"
9024+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
9025+
9026+#ifdef CONFIG_PAX_REFCOUNT
9027+ "jno 0f\n"
9028+ LOCK_PREFIX "subl %1,%0\n"
9029+ "int $4\n0:\n"
9030+ _ASM_EXTABLE(0b, 0b)
9031+#endif
9032+
9033+ : "+m" (v->counter)
9034+ : "ir" (i));
9035+}
9036+
9037+/**
9038+ * atomic_add_unchecked - add integer to atomic variable
9039+ * @i: integer value to add
9040+ * @v: pointer of type atomic_unchecked_t
9041+ *
9042+ * Atomically adds @i to @v.
9043+ */
9044+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
9045+{
9046+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
9047 : "+m" (v->counter)
9048 : "ir" (i));
9049 }
9050@@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato
9051 */
9052 static inline void atomic_sub(int i, atomic_t *v)
9053 {
9054- asm volatile(LOCK_PREFIX "subl %1,%0"
9055+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
9056+
9057+#ifdef CONFIG_PAX_REFCOUNT
9058+ "jno 0f\n"
9059+ LOCK_PREFIX "addl %1,%0\n"
9060+ "int $4\n0:\n"
9061+ _ASM_EXTABLE(0b, 0b)
9062+#endif
9063+
9064+ : "+m" (v->counter)
9065+ : "ir" (i));
9066+}
9067+
9068+/**
9069+ * atomic_sub_unchecked - subtract integer from atomic variable
9070+ * @i: integer value to subtract
9071+ * @v: pointer of type atomic_unchecked_t
9072+ *
9073+ * Atomically subtracts @i from @v.
9074+ */
9075+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
9076+{
9077+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
9078 : "+m" (v->counter)
9079 : "ir" (i));
9080 }
9081@@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in
9082 {
9083 unsigned char c;
9084
9085- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
9086+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
9087+
9088+#ifdef CONFIG_PAX_REFCOUNT
9089+ "jno 0f\n"
9090+ LOCK_PREFIX "addl %2,%0\n"
9091+ "int $4\n0:\n"
9092+ _ASM_EXTABLE(0b, 0b)
9093+#endif
9094+
9095+ "sete %1\n"
9096 : "+m" (v->counter), "=qm" (c)
9097 : "ir" (i) : "memory");
9098 return c;
9099@@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in
9100 */
9101 static inline void atomic_inc(atomic_t *v)
9102 {
9103- asm volatile(LOCK_PREFIX "incl %0"
9104+ asm volatile(LOCK_PREFIX "incl %0\n"
9105+
9106+#ifdef CONFIG_PAX_REFCOUNT
9107+ "jno 0f\n"
9108+ LOCK_PREFIX "decl %0\n"
9109+ "int $4\n0:\n"
9110+ _ASM_EXTABLE(0b, 0b)
9111+#endif
9112+
9113+ : "+m" (v->counter));
9114+}
9115+
9116+/**
9117+ * atomic_inc_unchecked - increment atomic variable
9118+ * @v: pointer of type atomic_unchecked_t
9119+ *
9120+ * Atomically increments @v by 1.
9121+ */
9122+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
9123+{
9124+ asm volatile(LOCK_PREFIX "incl %0\n"
9125 : "+m" (v->counter));
9126 }
9127
9128@@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *
9129 */
9130 static inline void atomic_dec(atomic_t *v)
9131 {
9132- asm volatile(LOCK_PREFIX "decl %0"
9133+ asm volatile(LOCK_PREFIX "decl %0\n"
9134+
9135+#ifdef CONFIG_PAX_REFCOUNT
9136+ "jno 0f\n"
9137+ LOCK_PREFIX "incl %0\n"
9138+ "int $4\n0:\n"
9139+ _ASM_EXTABLE(0b, 0b)
9140+#endif
9141+
9142+ : "+m" (v->counter));
9143+}
9144+
9145+/**
9146+ * atomic_dec_unchecked - decrement atomic variable
9147+ * @v: pointer of type atomic_unchecked_t
9148+ *
9149+ * Atomically decrements @v by 1.
9150+ */
9151+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
9152+{
9153+ asm volatile(LOCK_PREFIX "decl %0\n"
9154 : "+m" (v->counter));
9155 }
9156
9157@@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at
9158 {
9159 unsigned char c;
9160
9161- asm volatile(LOCK_PREFIX "decl %0; sete %1"
9162+ asm volatile(LOCK_PREFIX "decl %0\n"
9163+
9164+#ifdef CONFIG_PAX_REFCOUNT
9165+ "jno 0f\n"
9166+ LOCK_PREFIX "incl %0\n"
9167+ "int $4\n0:\n"
9168+ _ASM_EXTABLE(0b, 0b)
9169+#endif
9170+
9171+ "sete %1\n"
9172 : "+m" (v->counter), "=qm" (c)
9173 : : "memory");
9174 return c != 0;
9175@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
9176 {
9177 unsigned char c;
9178
9179- asm volatile(LOCK_PREFIX "incl %0; sete %1"
9180+ asm volatile(LOCK_PREFIX "incl %0\n"
9181+
9182+#ifdef CONFIG_PAX_REFCOUNT
9183+ "jno 0f\n"
9184+ LOCK_PREFIX "decl %0\n"
9185+ "int $4\n0:\n"
9186+ _ASM_EXTABLE(0b, 0b)
9187+#endif
9188+
9189+ "sete %1\n"
9190+ : "+m" (v->counter), "=qm" (c)
9191+ : : "memory");
9192+ return c != 0;
9193+}
9194+
9195+/**
9196+ * atomic_inc_and_test_unchecked - increment and test
9197+ * @v: pointer of type atomic_unchecked_t
9198+ *
9199+ * Atomically increments @v by 1
9200+ * and returns true if the result is zero, or false for all
9201+ * other cases.
9202+ */
9203+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
9204+{
9205+ unsigned char c;
9206+
9207+ asm volatile(LOCK_PREFIX "incl %0\n"
9208+ "sete %1\n"
9209 : "+m" (v->counter), "=qm" (c)
9210 : : "memory");
9211 return c != 0;
9212@@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
9213 {
9214 unsigned char c;
9215
9216- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
9217+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
9218+
9219+#ifdef CONFIG_PAX_REFCOUNT
9220+ "jno 0f\n"
9221+ LOCK_PREFIX "subl %2,%0\n"
9222+ "int $4\n0:\n"
9223+ _ASM_EXTABLE(0b, 0b)
9224+#endif
9225+
9226+ "sets %1\n"
9227 : "+m" (v->counter), "=qm" (c)
9228 : "ir" (i) : "memory");
9229 return c;
9230@@ -180,6 +342,46 @@ static inline int atomic_add_return(int
9231 #endif
9232 /* Modern 486+ processor */
9233 __i = i;
9234+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
9235+
9236+#ifdef CONFIG_PAX_REFCOUNT
9237+ "jno 0f\n"
9238+ "movl %0, %1\n"
9239+ "int $4\n0:\n"
9240+ _ASM_EXTABLE(0b, 0b)
9241+#endif
9242+
9243+ : "+r" (i), "+m" (v->counter)
9244+ : : "memory");
9245+ return i + __i;
9246+
9247+#ifdef CONFIG_M386
9248+no_xadd: /* Legacy 386 processor */
9249+ local_irq_save(flags);
9250+ __i = atomic_read(v);
9251+ atomic_set(v, i + __i);
9252+ local_irq_restore(flags);
9253+ return i + __i;
9254+#endif
9255+}
9256+
9257+/**
9258+ * atomic_add_return_unchecked - add integer and return
9259+ * @v: pointer of type atomic_unchecked_t
9260+ * @i: integer value to add
9261+ *
9262+ * Atomically adds @i to @v and returns @i + @v
9263+ */
9264+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
9265+{
9266+ int __i;
9267+#ifdef CONFIG_M386
9268+ unsigned long flags;
9269+ if (unlikely(boot_cpu_data.x86 <= 3))
9270+ goto no_xadd;
9271+#endif
9272+ /* Modern 486+ processor */
9273+ __i = i;
9274 asm volatile(LOCK_PREFIX "xaddl %0, %1"
9275 : "+r" (i), "+m" (v->counter)
9276 : : "memory");
9277@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int
9278 }
9279
9280 #define atomic_inc_return(v) (atomic_add_return(1, v))
9281+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
9282+{
9283+ return atomic_add_return_unchecked(1, v);
9284+}
9285 #define atomic_dec_return(v) (atomic_sub_return(1, v))
9286
9287 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
9288@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
9289 return cmpxchg(&v->counter, old, new);
9290 }
9291
9292+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
9293+{
9294+ return cmpxchg(&v->counter, old, new);
9295+}
9296+
9297 static inline int atomic_xchg(atomic_t *v, int new)
9298 {
9299 return xchg(&v->counter, new);
9300 }
9301
9302+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
9303+{
9304+ return xchg(&v->counter, new);
9305+}
9306+
9307 /**
9308 * atomic_add_unless - add unless the number is already a given value
9309 * @v: pointer of type atomic_t
9310@@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
9311 */
9312 static inline int atomic_add_unless(atomic_t *v, int a, int u)
9313 {
9314- int c, old;
9315+ int c, old, new;
9316 c = atomic_read(v);
9317 for (;;) {
9318- if (unlikely(c == (u)))
9319+ if (unlikely(c == u))
9320 break;
9321- old = atomic_cmpxchg((v), c, c + (a));
9322+
9323+ asm volatile("addl %2,%0\n"
9324+
9325+#ifdef CONFIG_PAX_REFCOUNT
9326+ "jno 0f\n"
9327+ "subl %2,%0\n"
9328+ "int $4\n0:\n"
9329+ _ASM_EXTABLE(0b, 0b)
9330+#endif
9331+
9332+ : "=r" (new)
9333+ : "0" (c), "ir" (a));
9334+
9335+ old = atomic_cmpxchg(v, c, new);
9336 if (likely(old == c))
9337 break;
9338 c = old;
9339 }
9340- return c != (u);
9341+ return c != u;
9342 }
9343
9344 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
9345
9346+/**
9347+ * atomic_inc_not_zero_hint - increment if not null
9348+ * @v: pointer of type atomic_t
9349+ * @hint: probable value of the atomic before the increment
9350+ *
9351+ * This version of atomic_inc_not_zero() gives a hint of probable
9352+ * value of the atomic. This helps processor to not read the memory
9353+ * before doing the atomic read/modify/write cycle, lowering
9354+ * number of bus transactions on some arches.
9355+ *
9356+ * Returns: 0 if increment was not done, 1 otherwise.
9357+ */
9358+#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
9359+static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
9360+{
9361+ int val, c = hint, new;
9362+
9363+ /* sanity test, should be removed by compiler if hint is a constant */
9364+ if (!hint)
9365+ return atomic_inc_not_zero(v);
9366+
9367+ do {
9368+ asm volatile("incl %0\n"
9369+
9370+#ifdef CONFIG_PAX_REFCOUNT
9371+ "jno 0f\n"
9372+ "decl %0\n"
9373+ "int $4\n0:\n"
9374+ _ASM_EXTABLE(0b, 0b)
9375+#endif
9376+
9377+ : "=r" (new)
9378+ : "0" (c));
9379+
9380+ val = atomic_cmpxchg(v, c, new);
9381+ if (val == c)
9382+ return 1;
9383+ c = val;
9384+ } while (c);
9385+
9386+ return 0;
9387+}
9388+
9389 /*
9390 * atomic_dec_if_positive - decrement by 1 if old value positive
9391 * @v: pointer of type atomic_t
9392diff -urNp linux-2.6.39.2/arch/x86/include/asm/bitops.h linux-2.6.39.2/arch/x86/include/asm/bitops.h
9393--- linux-2.6.39.2/arch/x86/include/asm/bitops.h 2011-05-19 00:06:34.000000000 -0400
9394+++ linux-2.6.39.2/arch/x86/include/asm/bitops.h 2011-05-22 19:36:30.000000000 -0400
9395@@ -38,7 +38,7 @@
9396 * a mask operation on a byte.
9397 */
9398 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
9399-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
9400+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
9401 #define CONST_MASK(nr) (1 << ((nr) & 7))
9402
9403 /**
9404diff -urNp linux-2.6.39.2/arch/x86/include/asm/boot.h linux-2.6.39.2/arch/x86/include/asm/boot.h
9405--- linux-2.6.39.2/arch/x86/include/asm/boot.h 2011-05-19 00:06:34.000000000 -0400
9406+++ linux-2.6.39.2/arch/x86/include/asm/boot.h 2011-05-22 19:36:30.000000000 -0400
9407@@ -11,10 +11,15 @@
9408 #include <asm/pgtable_types.h>
9409
9410 /* Physical address where kernel should be loaded. */
9411-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9412+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9413 + (CONFIG_PHYSICAL_ALIGN - 1)) \
9414 & ~(CONFIG_PHYSICAL_ALIGN - 1))
9415
9416+#ifndef __ASSEMBLY__
9417+extern unsigned char __LOAD_PHYSICAL_ADDR[];
9418+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
9419+#endif
9420+
9421 /* Minimum kernel alignment, as a power of two */
9422 #ifdef CONFIG_X86_64
9423 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
9424diff -urNp linux-2.6.39.2/arch/x86/include/asm/cacheflush.h linux-2.6.39.2/arch/x86/include/asm/cacheflush.h
9425--- linux-2.6.39.2/arch/x86/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
9426+++ linux-2.6.39.2/arch/x86/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
9427@@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
9428 unsigned long pg_flags = pg->flags & _PGMT_MASK;
9429
9430 if (pg_flags == _PGMT_DEFAULT)
9431- return -1;
9432+ return ~0UL;
9433 else if (pg_flags == _PGMT_WC)
9434 return _PAGE_CACHE_WC;
9435 else if (pg_flags == _PGMT_UC_MINUS)
9436diff -urNp linux-2.6.39.2/arch/x86/include/asm/cache.h linux-2.6.39.2/arch/x86/include/asm/cache.h
9437--- linux-2.6.39.2/arch/x86/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
9438+++ linux-2.6.39.2/arch/x86/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
9439@@ -5,12 +5,13 @@
9440
9441 /* L1 cache line size */
9442 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
9443-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9444+#define L1_CACHE_BYTES (_AC(1,U) << L1_CACHE_SHIFT)
9445
9446 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9447+#define __read_only __attribute__((__section__(".data..read_only")))
9448
9449 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
9450-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
9451+#define INTERNODE_CACHE_BYTES (_AC(1,U) << INTERNODE_CACHE_SHIFT)
9452
9453 #ifdef CONFIG_X86_VSMP
9454 #ifdef CONFIG_SMP
9455diff -urNp linux-2.6.39.2/arch/x86/include/asm/checksum_32.h linux-2.6.39.2/arch/x86/include/asm/checksum_32.h
9456--- linux-2.6.39.2/arch/x86/include/asm/checksum_32.h 2011-05-19 00:06:34.000000000 -0400
9457+++ linux-2.6.39.2/arch/x86/include/asm/checksum_32.h 2011-05-22 19:36:30.000000000 -0400
9458@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
9459 int len, __wsum sum,
9460 int *src_err_ptr, int *dst_err_ptr);
9461
9462+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
9463+ int len, __wsum sum,
9464+ int *src_err_ptr, int *dst_err_ptr);
9465+
9466+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
9467+ int len, __wsum sum,
9468+ int *src_err_ptr, int *dst_err_ptr);
9469+
9470 /*
9471 * Note: when you get a NULL pointer exception here this means someone
9472 * passed in an incorrect kernel address to one of these functions.
9473@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
9474 int *err_ptr)
9475 {
9476 might_sleep();
9477- return csum_partial_copy_generic((__force void *)src, dst,
9478+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
9479 len, sum, err_ptr, NULL);
9480 }
9481
9482@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
9483 {
9484 might_sleep();
9485 if (access_ok(VERIFY_WRITE, dst, len))
9486- return csum_partial_copy_generic(src, (__force void *)dst,
9487+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
9488 len, sum, NULL, err_ptr);
9489
9490 if (len)
9491diff -urNp linux-2.6.39.2/arch/x86/include/asm/cpufeature.h linux-2.6.39.2/arch/x86/include/asm/cpufeature.h
9492--- linux-2.6.39.2/arch/x86/include/asm/cpufeature.h 2011-06-03 00:04:13.000000000 -0400
9493+++ linux-2.6.39.2/arch/x86/include/asm/cpufeature.h 2011-06-03 00:32:04.000000000 -0400
9494@@ -351,7 +351,7 @@ static __always_inline __pure bool __sta
9495 ".section .discard,\"aw\",@progbits\n"
9496 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
9497 ".previous\n"
9498- ".section .altinstr_replacement,\"ax\"\n"
9499+ ".section .altinstr_replacement,\"a\"\n"
9500 "3: movb $1,%0\n"
9501 "4:\n"
9502 ".previous\n"
9503diff -urNp linux-2.6.39.2/arch/x86/include/asm/desc_defs.h linux-2.6.39.2/arch/x86/include/asm/desc_defs.h
9504--- linux-2.6.39.2/arch/x86/include/asm/desc_defs.h 2011-05-19 00:06:34.000000000 -0400
9505+++ linux-2.6.39.2/arch/x86/include/asm/desc_defs.h 2011-05-22 19:36:30.000000000 -0400
9506@@ -31,6 +31,12 @@ struct desc_struct {
9507 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
9508 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
9509 };
9510+ struct {
9511+ u16 offset_low;
9512+ u16 seg;
9513+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
9514+ unsigned offset_high: 16;
9515+ } gate;
9516 };
9517 } __attribute__((packed));
9518
9519diff -urNp linux-2.6.39.2/arch/x86/include/asm/desc.h linux-2.6.39.2/arch/x86/include/asm/desc.h
9520--- linux-2.6.39.2/arch/x86/include/asm/desc.h 2011-05-19 00:06:34.000000000 -0400
9521+++ linux-2.6.39.2/arch/x86/include/asm/desc.h 2011-05-22 19:36:30.000000000 -0400
9522@@ -4,6 +4,7 @@
9523 #include <asm/desc_defs.h>
9524 #include <asm/ldt.h>
9525 #include <asm/mmu.h>
9526+#include <asm/pgtable.h>
9527 #include <linux/smp.h>
9528
9529 static inline void fill_ldt(struct desc_struct *desc,
9530@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
9531 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
9532 desc->type = (info->read_exec_only ^ 1) << 1;
9533 desc->type |= info->contents << 2;
9534+ desc->type |= info->seg_not_present ^ 1;
9535 desc->s = 1;
9536 desc->dpl = 0x3;
9537 desc->p = info->seg_not_present ^ 1;
9538@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
9539 }
9540
9541 extern struct desc_ptr idt_descr;
9542-extern gate_desc idt_table[];
9543-
9544-struct gdt_page {
9545- struct desc_struct gdt[GDT_ENTRIES];
9546-} __attribute__((aligned(PAGE_SIZE)));
9547-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
9548+extern gate_desc idt_table[256];
9549
9550+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
9551 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
9552 {
9553- return per_cpu(gdt_page, cpu).gdt;
9554+ return cpu_gdt_table[cpu];
9555 }
9556
9557 #ifdef CONFIG_X86_64
9558@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
9559 unsigned long base, unsigned dpl, unsigned flags,
9560 unsigned short seg)
9561 {
9562- gate->a = (seg << 16) | (base & 0xffff);
9563- gate->b = (base & 0xffff0000) |
9564- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
9565+ gate->gate.offset_low = base;
9566+ gate->gate.seg = seg;
9567+ gate->gate.reserved = 0;
9568+ gate->gate.type = type;
9569+ gate->gate.s = 0;
9570+ gate->gate.dpl = dpl;
9571+ gate->gate.p = 1;
9572+ gate->gate.offset_high = base >> 16;
9573 }
9574
9575 #endif
9576@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
9577 static inline void native_write_idt_entry(gate_desc *idt, int entry,
9578 const gate_desc *gate)
9579 {
9580+ pax_open_kernel();
9581 memcpy(&idt[entry], gate, sizeof(*gate));
9582+ pax_close_kernel();
9583 }
9584
9585 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
9586 const void *desc)
9587 {
9588+ pax_open_kernel();
9589 memcpy(&ldt[entry], desc, 8);
9590+ pax_close_kernel();
9591 }
9592
9593 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
9594@@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
9595 size = sizeof(struct desc_struct);
9596 break;
9597 }
9598+
9599+ pax_open_kernel();
9600 memcpy(&gdt[entry], desc, size);
9601+ pax_close_kernel();
9602 }
9603
9604 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
9605@@ -211,7 +221,9 @@ static inline void native_set_ldt(const
9606
9607 static inline void native_load_tr_desc(void)
9608 {
9609+ pax_open_kernel();
9610 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
9611+ pax_close_kernel();
9612 }
9613
9614 static inline void native_load_gdt(const struct desc_ptr *dtr)
9615@@ -246,8 +258,10 @@ static inline void native_load_tls(struc
9616 unsigned int i;
9617 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
9618
9619+ pax_open_kernel();
9620 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
9621 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
9622+ pax_close_kernel();
9623 }
9624
9625 #define _LDT_empty(info) \
9626@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
9627 desc->limit = (limit >> 16) & 0xf;
9628 }
9629
9630-static inline void _set_gate(int gate, unsigned type, void *addr,
9631+static inline void _set_gate(int gate, unsigned type, const void *addr,
9632 unsigned dpl, unsigned ist, unsigned seg)
9633 {
9634 gate_desc s;
9635@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
9636 * Pentium F0 0F bugfix can have resulted in the mapped
9637 * IDT being write-protected.
9638 */
9639-static inline void set_intr_gate(unsigned int n, void *addr)
9640+static inline void set_intr_gate(unsigned int n, const void *addr)
9641 {
9642 BUG_ON((unsigned)n > 0xFF);
9643 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
9644@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
9645 /*
9646 * This routine sets up an interrupt gate at directory privilege level 3.
9647 */
9648-static inline void set_system_intr_gate(unsigned int n, void *addr)
9649+static inline void set_system_intr_gate(unsigned int n, const void *addr)
9650 {
9651 BUG_ON((unsigned)n > 0xFF);
9652 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
9653 }
9654
9655-static inline void set_system_trap_gate(unsigned int n, void *addr)
9656+static inline void set_system_trap_gate(unsigned int n, const void *addr)
9657 {
9658 BUG_ON((unsigned)n > 0xFF);
9659 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
9660 }
9661
9662-static inline void set_trap_gate(unsigned int n, void *addr)
9663+static inline void set_trap_gate(unsigned int n, const void *addr)
9664 {
9665 BUG_ON((unsigned)n > 0xFF);
9666 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
9667@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
9668 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
9669 {
9670 BUG_ON((unsigned)n > 0xFF);
9671- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
9672+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
9673 }
9674
9675-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
9676+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
9677 {
9678 BUG_ON((unsigned)n > 0xFF);
9679 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
9680 }
9681
9682-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
9683+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
9684 {
9685 BUG_ON((unsigned)n > 0xFF);
9686 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
9687 }
9688
9689+#ifdef CONFIG_X86_32
9690+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
9691+{
9692+ struct desc_struct d;
9693+
9694+ if (likely(limit))
9695+ limit = (limit - 1UL) >> PAGE_SHIFT;
9696+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
9697+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
9698+}
9699+#endif
9700+
9701 #endif /* _ASM_X86_DESC_H */
9702diff -urNp linux-2.6.39.2/arch/x86/include/asm/device.h linux-2.6.39.2/arch/x86/include/asm/device.h
9703--- linux-2.6.39.2/arch/x86/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
9704+++ linux-2.6.39.2/arch/x86/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
9705@@ -6,7 +6,7 @@ struct dev_archdata {
9706 void *acpi_handle;
9707 #endif
9708 #ifdef CONFIG_X86_64
9709-struct dma_map_ops *dma_ops;
9710+ const struct dma_map_ops *dma_ops;
9711 #endif
9712 #if defined(CONFIG_DMAR) || defined(CONFIG_AMD_IOMMU)
9713 void *iommu; /* hook for IOMMU specific extension */
9714diff -urNp linux-2.6.39.2/arch/x86/include/asm/dma-mapping.h linux-2.6.39.2/arch/x86/include/asm/dma-mapping.h
9715--- linux-2.6.39.2/arch/x86/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
9716+++ linux-2.6.39.2/arch/x86/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
9717@@ -26,9 +26,9 @@ extern int iommu_merge;
9718 extern struct device x86_dma_fallback_dev;
9719 extern int panic_on_overflow;
9720
9721-extern struct dma_map_ops *dma_ops;
9722+extern const struct dma_map_ops *dma_ops;
9723
9724-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
9725+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
9726 {
9727 #ifdef CONFIG_X86_32
9728 return dma_ops;
9729@@ -45,7 +45,7 @@ static inline struct dma_map_ops *get_dm
9730 /* Make sure we keep the same behaviour */
9731 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
9732 {
9733- struct dma_map_ops *ops = get_dma_ops(dev);
9734+ const struct dma_map_ops *ops = get_dma_ops(dev);
9735 if (ops->mapping_error)
9736 return ops->mapping_error(dev, dma_addr);
9737
9738@@ -115,7 +115,7 @@ static inline void *
9739 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
9740 gfp_t gfp)
9741 {
9742- struct dma_map_ops *ops = get_dma_ops(dev);
9743+ const struct dma_map_ops *ops = get_dma_ops(dev);
9744 void *memory;
9745
9746 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
9747@@ -142,7 +142,7 @@ dma_alloc_coherent(struct device *dev, s
9748 static inline void dma_free_coherent(struct device *dev, size_t size,
9749 void *vaddr, dma_addr_t bus)
9750 {
9751- struct dma_map_ops *ops = get_dma_ops(dev);
9752+ const struct dma_map_ops *ops = get_dma_ops(dev);
9753
9754 WARN_ON(irqs_disabled()); /* for portability */
9755
9756diff -urNp linux-2.6.39.2/arch/x86/include/asm/e820.h linux-2.6.39.2/arch/x86/include/asm/e820.h
9757--- linux-2.6.39.2/arch/x86/include/asm/e820.h 2011-05-19 00:06:34.000000000 -0400
9758+++ linux-2.6.39.2/arch/x86/include/asm/e820.h 2011-05-22 19:36:30.000000000 -0400
9759@@ -69,7 +69,7 @@ struct e820map {
9760 #define ISA_START_ADDRESS 0xa0000
9761 #define ISA_END_ADDRESS 0x100000
9762
9763-#define BIOS_BEGIN 0x000a0000
9764+#define BIOS_BEGIN 0x000c0000
9765 #define BIOS_END 0x00100000
9766
9767 #define BIOS_ROM_BASE 0xffe00000
9768diff -urNp linux-2.6.39.2/arch/x86/include/asm/elf.h linux-2.6.39.2/arch/x86/include/asm/elf.h
9769--- linux-2.6.39.2/arch/x86/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
9770+++ linux-2.6.39.2/arch/x86/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
9771@@ -237,7 +237,25 @@ extern int force_personality32;
9772 the loader. We need to make sure that it is out of the way of the program
9773 that it will "exec", and that there is sufficient room for the brk. */
9774
9775+#ifdef CONFIG_PAX_SEGMEXEC
9776+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
9777+#else
9778 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
9779+#endif
9780+
9781+#ifdef CONFIG_PAX_ASLR
9782+#ifdef CONFIG_X86_32
9783+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
9784+
9785+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9786+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9787+#else
9788+#define PAX_ELF_ET_DYN_BASE 0x400000UL
9789+
9790+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9791+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9792+#endif
9793+#endif
9794
9795 /* This yields a mask that user programs can use to figure out what
9796 instruction set this CPU supports. This could be done in user space,
9797@@ -291,8 +309,7 @@ do { \
9798 #define ARCH_DLINFO \
9799 do { \
9800 if (vdso_enabled) \
9801- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
9802- (unsigned long)current->mm->context.vdso); \
9803+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
9804 } while (0)
9805
9806 #define AT_SYSINFO 32
9807@@ -303,7 +320,7 @@ do { \
9808
9809 #endif /* !CONFIG_X86_32 */
9810
9811-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
9812+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
9813
9814 #define VDSO_ENTRY \
9815 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
9816@@ -317,7 +334,4 @@ extern int arch_setup_additional_pages(s
9817 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
9818 #define compat_arch_setup_additional_pages syscall32_setup_pages
9819
9820-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
9821-#define arch_randomize_brk arch_randomize_brk
9822-
9823 #endif /* _ASM_X86_ELF_H */
9824diff -urNp linux-2.6.39.2/arch/x86/include/asm/emergency-restart.h linux-2.6.39.2/arch/x86/include/asm/emergency-restart.h
9825--- linux-2.6.39.2/arch/x86/include/asm/emergency-restart.h 2011-05-19 00:06:34.000000000 -0400
9826+++ linux-2.6.39.2/arch/x86/include/asm/emergency-restart.h 2011-05-22 19:36:30.000000000 -0400
9827@@ -15,6 +15,6 @@ enum reboot_type {
9828
9829 extern enum reboot_type reboot_type;
9830
9831-extern void machine_emergency_restart(void);
9832+extern void machine_emergency_restart(void) __noreturn;
9833
9834 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
9835diff -urNp linux-2.6.39.2/arch/x86/include/asm/futex.h linux-2.6.39.2/arch/x86/include/asm/futex.h
9836--- linux-2.6.39.2/arch/x86/include/asm/futex.h 2011-05-19 00:06:34.000000000 -0400
9837+++ linux-2.6.39.2/arch/x86/include/asm/futex.h 2011-05-22 19:36:30.000000000 -0400
9838@@ -12,16 +12,18 @@
9839 #include <asm/system.h>
9840
9841 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
9842+ typecheck(u32 *, uaddr); \
9843 asm volatile("1:\t" insn "\n" \
9844 "2:\t.section .fixup,\"ax\"\n" \
9845 "3:\tmov\t%3, %1\n" \
9846 "\tjmp\t2b\n" \
9847 "\t.previous\n" \
9848 _ASM_EXTABLE(1b, 3b) \
9849- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
9850+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
9851 : "i" (-EFAULT), "0" (oparg), "1" (0))
9852
9853 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
9854+ typecheck(u32 *, uaddr); \
9855 asm volatile("1:\tmovl %2, %0\n" \
9856 "\tmovl\t%0, %3\n" \
9857 "\t" insn "\n" \
9858@@ -34,7 +36,7 @@
9859 _ASM_EXTABLE(1b, 4b) \
9860 _ASM_EXTABLE(2b, 4b) \
9861 : "=&a" (oldval), "=&r" (ret), \
9862- "+m" (*uaddr), "=&r" (tem) \
9863+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \
9864 : "r" (oparg), "i" (-EFAULT), "1" (0))
9865
9866 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
9867@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
9868
9869 switch (op) {
9870 case FUTEX_OP_SET:
9871- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
9872+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
9873 break;
9874 case FUTEX_OP_ADD:
9875- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
9876+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
9877 uaddr, oparg);
9878 break;
9879 case FUTEX_OP_OR:
9880@@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i
9881 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
9882 return -EFAULT;
9883
9884- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
9885+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
9886 "2:\t.section .fixup, \"ax\"\n"
9887 "3:\tmov %3, %0\n"
9888 "\tjmp 2b\n"
9889 "\t.previous\n"
9890 _ASM_EXTABLE(1b, 3b)
9891- : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
9892+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
9893 : "i" (-EFAULT), "r" (newval), "1" (oldval)
9894 : "memory"
9895 );
9896diff -urNp linux-2.6.39.2/arch/x86/include/asm/hw_irq.h linux-2.6.39.2/arch/x86/include/asm/hw_irq.h
9897--- linux-2.6.39.2/arch/x86/include/asm/hw_irq.h 2011-05-19 00:06:34.000000000 -0400
9898+++ linux-2.6.39.2/arch/x86/include/asm/hw_irq.h 2011-05-22 19:36:30.000000000 -0400
9899@@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void);
9900 extern void enable_IO_APIC(void);
9901
9902 /* Statistics */
9903-extern atomic_t irq_err_count;
9904-extern atomic_t irq_mis_count;
9905+extern atomic_unchecked_t irq_err_count;
9906+extern atomic_unchecked_t irq_mis_count;
9907
9908 /* EISA */
9909 extern void eisa_set_level_irq(unsigned int irq);
9910diff -urNp linux-2.6.39.2/arch/x86/include/asm/i387.h linux-2.6.39.2/arch/x86/include/asm/i387.h
9911--- linux-2.6.39.2/arch/x86/include/asm/i387.h 2011-05-19 00:06:34.000000000 -0400
9912+++ linux-2.6.39.2/arch/x86/include/asm/i387.h 2011-05-22 19:36:30.000000000 -0400
9913@@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
9914 {
9915 int err;
9916
9917+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9918+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9919+ fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
9920+#endif
9921+
9922 /* See comment in fxsave() below. */
9923 #ifdef CONFIG_AS_FXSAVEQ
9924 asm volatile("1: fxrstorq %[fx]\n\t"
9925@@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38
9926 {
9927 int err;
9928
9929+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9930+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9931+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
9932+#endif
9933+
9934 /*
9935 * Clear the bytes not touched by the fxsave and reserved
9936 * for the SW usage.
9937@@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu
9938 #endif /* CONFIG_X86_64 */
9939
9940 /* We need a safe address that is cheap to find and that is already
9941- in L1 during context switch. The best choices are unfortunately
9942- different for UP and SMP */
9943-#ifdef CONFIG_SMP
9944-#define safe_address (__per_cpu_offset[0])
9945-#else
9946-#define safe_address (kstat_cpu(0).cpustat.user)
9947-#endif
9948+ in L1 during context switch. */
9949+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
9950
9951 /*
9952 * These must be called with preempt disabled
9953@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
9954 struct thread_info *me = current_thread_info();
9955 preempt_disable();
9956 if (me->status & TS_USEDFPU)
9957- __save_init_fpu(me->task);
9958+ __save_init_fpu(current);
9959 else
9960 clts();
9961 }
9962diff -urNp linux-2.6.39.2/arch/x86/include/asm/io.h linux-2.6.39.2/arch/x86/include/asm/io.h
9963--- linux-2.6.39.2/arch/x86/include/asm/io.h 2011-05-19 00:06:34.000000000 -0400
9964+++ linux-2.6.39.2/arch/x86/include/asm/io.h 2011-05-22 19:36:30.000000000 -0400
9965@@ -216,6 +216,17 @@ extern void set_iounmap_nonlazy(void);
9966
9967 #include <linux/vmalloc.h>
9968
9969+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9970+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9971+{
9972+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9973+}
9974+
9975+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9976+{
9977+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9978+}
9979+
9980 /*
9981 * Convert a virtual cached pointer to an uncached pointer
9982 */
9983diff -urNp linux-2.6.39.2/arch/x86/include/asm/iommu.h linux-2.6.39.2/arch/x86/include/asm/iommu.h
9984--- linux-2.6.39.2/arch/x86/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
9985+++ linux-2.6.39.2/arch/x86/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
9986@@ -1,7 +1,7 @@
9987 #ifndef _ASM_X86_IOMMU_H
9988 #define _ASM_X86_IOMMU_H
9989
9990-extern struct dma_map_ops nommu_dma_ops;
9991+extern const struct dma_map_ops nommu_dma_ops;
9992 extern int force_iommu, no_iommu;
9993 extern int iommu_detected;
9994 extern int iommu_pass_through;
9995diff -urNp linux-2.6.39.2/arch/x86/include/asm/irqflags.h linux-2.6.39.2/arch/x86/include/asm/irqflags.h
9996--- linux-2.6.39.2/arch/x86/include/asm/irqflags.h 2011-05-19 00:06:34.000000000 -0400
9997+++ linux-2.6.39.2/arch/x86/include/asm/irqflags.h 2011-05-22 19:36:30.000000000 -0400
9998@@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
9999 sti; \
10000 sysexit
10001
10002+#define GET_CR0_INTO_RDI mov %cr0, %rdi
10003+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
10004+#define GET_CR3_INTO_RDI mov %cr3, %rdi
10005+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
10006+
10007 #else
10008 #define INTERRUPT_RETURN iret
10009 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
10010diff -urNp linux-2.6.39.2/arch/x86/include/asm/kprobes.h linux-2.6.39.2/arch/x86/include/asm/kprobes.h
10011--- linux-2.6.39.2/arch/x86/include/asm/kprobes.h 2011-05-19 00:06:34.000000000 -0400
10012+++ linux-2.6.39.2/arch/x86/include/asm/kprobes.h 2011-05-22 19:36:30.000000000 -0400
10013@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
10014 #define RELATIVEJUMP_SIZE 5
10015 #define RELATIVECALL_OPCODE 0xe8
10016 #define RELATIVE_ADDR_SIZE 4
10017-#define MAX_STACK_SIZE 64
10018-#define MIN_STACK_SIZE(ADDR) \
10019- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
10020- THREAD_SIZE - (unsigned long)(ADDR))) \
10021- ? (MAX_STACK_SIZE) \
10022- : (((unsigned long)current_thread_info()) + \
10023- THREAD_SIZE - (unsigned long)(ADDR)))
10024+#define MAX_STACK_SIZE 64UL
10025+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
10026
10027 #define flush_insn_slot(p) do { } while (0)
10028
10029diff -urNp linux-2.6.39.2/arch/x86/include/asm/kvm_host.h linux-2.6.39.2/arch/x86/include/asm/kvm_host.h
10030--- linux-2.6.39.2/arch/x86/include/asm/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
10031+++ linux-2.6.39.2/arch/x86/include/asm/kvm_host.h 2011-05-22 19:36:30.000000000 -0400
10032@@ -419,7 +419,7 @@ struct kvm_arch {
10033 unsigned int n_used_mmu_pages;
10034 unsigned int n_requested_mmu_pages;
10035 unsigned int n_max_mmu_pages;
10036- atomic_t invlpg_counter;
10037+ atomic_unchecked_t invlpg_counter;
10038 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
10039 /*
10040 * Hash table of struct kvm_mmu_page.
10041@@ -599,7 +599,7 @@ struct kvm_arch_async_pf {
10042 bool direct_map;
10043 };
10044
10045-extern struct kvm_x86_ops *kvm_x86_ops;
10046+extern const struct kvm_x86_ops *kvm_x86_ops;
10047
10048 int kvm_mmu_module_init(void);
10049 void kvm_mmu_module_exit(void);
10050diff -urNp linux-2.6.39.2/arch/x86/include/asm/local.h linux-2.6.39.2/arch/x86/include/asm/local.h
10051--- linux-2.6.39.2/arch/x86/include/asm/local.h 2011-05-19 00:06:34.000000000 -0400
10052+++ linux-2.6.39.2/arch/x86/include/asm/local.h 2011-05-22 19:36:30.000000000 -0400
10053@@ -18,26 +18,58 @@ typedef struct {
10054
10055 static inline void local_inc(local_t *l)
10056 {
10057- asm volatile(_ASM_INC "%0"
10058+ asm volatile(_ASM_INC "%0\n"
10059+
10060+#ifdef CONFIG_PAX_REFCOUNT
10061+ "jno 0f\n"
10062+ _ASM_DEC "%0\n"
10063+ "int $4\n0:\n"
10064+ _ASM_EXTABLE(0b, 0b)
10065+#endif
10066+
10067 : "+m" (l->a.counter));
10068 }
10069
10070 static inline void local_dec(local_t *l)
10071 {
10072- asm volatile(_ASM_DEC "%0"
10073+ asm volatile(_ASM_DEC "%0\n"
10074+
10075+#ifdef CONFIG_PAX_REFCOUNT
10076+ "jno 0f\n"
10077+ _ASM_INC "%0\n"
10078+ "int $4\n0:\n"
10079+ _ASM_EXTABLE(0b, 0b)
10080+#endif
10081+
10082 : "+m" (l->a.counter));
10083 }
10084
10085 static inline void local_add(long i, local_t *l)
10086 {
10087- asm volatile(_ASM_ADD "%1,%0"
10088+ asm volatile(_ASM_ADD "%1,%0\n"
10089+
10090+#ifdef CONFIG_PAX_REFCOUNT
10091+ "jno 0f\n"
10092+ _ASM_SUB "%1,%0\n"
10093+ "int $4\n0:\n"
10094+ _ASM_EXTABLE(0b, 0b)
10095+#endif
10096+
10097 : "+m" (l->a.counter)
10098 : "ir" (i));
10099 }
10100
10101 static inline void local_sub(long i, local_t *l)
10102 {
10103- asm volatile(_ASM_SUB "%1,%0"
10104+ asm volatile(_ASM_SUB "%1,%0\n"
10105+
10106+#ifdef CONFIG_PAX_REFCOUNT
10107+ "jno 0f\n"
10108+ _ASM_ADD "%1,%0\n"
10109+ "int $4\n0:\n"
10110+ _ASM_EXTABLE(0b, 0b)
10111+#endif
10112+
10113 : "+m" (l->a.counter)
10114 : "ir" (i));
10115 }
10116@@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
10117 {
10118 unsigned char c;
10119
10120- asm volatile(_ASM_SUB "%2,%0; sete %1"
10121+ asm volatile(_ASM_SUB "%2,%0\n"
10122+
10123+#ifdef CONFIG_PAX_REFCOUNT
10124+ "jno 0f\n"
10125+ _ASM_ADD "%2,%0\n"
10126+ "int $4\n0:\n"
10127+ _ASM_EXTABLE(0b, 0b)
10128+#endif
10129+
10130+ "sete %1\n"
10131 : "+m" (l->a.counter), "=qm" (c)
10132 : "ir" (i) : "memory");
10133 return c;
10134@@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
10135 {
10136 unsigned char c;
10137
10138- asm volatile(_ASM_DEC "%0; sete %1"
10139+ asm volatile(_ASM_DEC "%0\n"
10140+
10141+#ifdef CONFIG_PAX_REFCOUNT
10142+ "jno 0f\n"
10143+ _ASM_INC "%0\n"
10144+ "int $4\n0:\n"
10145+ _ASM_EXTABLE(0b, 0b)
10146+#endif
10147+
10148+ "sete %1\n"
10149 : "+m" (l->a.counter), "=qm" (c)
10150 : : "memory");
10151 return c != 0;
10152@@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
10153 {
10154 unsigned char c;
10155
10156- asm volatile(_ASM_INC "%0; sete %1"
10157+ asm volatile(_ASM_INC "%0\n"
10158+
10159+#ifdef CONFIG_PAX_REFCOUNT
10160+ "jno 0f\n"
10161+ _ASM_DEC "%0\n"
10162+ "int $4\n0:\n"
10163+ _ASM_EXTABLE(0b, 0b)
10164+#endif
10165+
10166+ "sete %1\n"
10167 : "+m" (l->a.counter), "=qm" (c)
10168 : : "memory");
10169 return c != 0;
10170@@ -110,7 +169,16 @@ static inline int local_add_negative(lon
10171 {
10172 unsigned char c;
10173
10174- asm volatile(_ASM_ADD "%2,%0; sets %1"
10175+ asm volatile(_ASM_ADD "%2,%0\n"
10176+
10177+#ifdef CONFIG_PAX_REFCOUNT
10178+ "jno 0f\n"
10179+ _ASM_SUB "%2,%0\n"
10180+ "int $4\n0:\n"
10181+ _ASM_EXTABLE(0b, 0b)
10182+#endif
10183+
10184+ "sets %1\n"
10185 : "+m" (l->a.counter), "=qm" (c)
10186 : "ir" (i) : "memory");
10187 return c;
10188@@ -133,7 +201,15 @@ static inline long local_add_return(long
10189 #endif
10190 /* Modern 486+ processor */
10191 __i = i;
10192- asm volatile(_ASM_XADD "%0, %1;"
10193+ asm volatile(_ASM_XADD "%0, %1\n"
10194+
10195+#ifdef CONFIG_PAX_REFCOUNT
10196+ "jno 0f\n"
10197+ _ASM_MOV "%0,%1\n"
10198+ "int $4\n0:\n"
10199+ _ASM_EXTABLE(0b, 0b)
10200+#endif
10201+
10202 : "+r" (i), "+m" (l->a.counter)
10203 : : "memory");
10204 return i + __i;
10205diff -urNp linux-2.6.39.2/arch/x86/include/asm/mce.h linux-2.6.39.2/arch/x86/include/asm/mce.h
10206--- linux-2.6.39.2/arch/x86/include/asm/mce.h 2011-05-19 00:06:34.000000000 -0400
10207+++ linux-2.6.39.2/arch/x86/include/asm/mce.h 2011-05-22 19:36:30.000000000 -0400
10208@@ -198,7 +198,7 @@ int mce_notify_irq(void);
10209 void mce_notify_process(void);
10210
10211 DECLARE_PER_CPU(struct mce, injectm);
10212-extern struct file_operations mce_chrdev_ops;
10213+extern struct file_operations mce_chrdev_ops; /* cannot be const, see arch/x86/kernel/cpu/mcheck/mce. */
10214
10215 /*
10216 * Exception handler
10217diff -urNp linux-2.6.39.2/arch/x86/include/asm/microcode.h linux-2.6.39.2/arch/x86/include/asm/microcode.h
10218--- linux-2.6.39.2/arch/x86/include/asm/microcode.h 2011-05-19 00:06:34.000000000 -0400
10219+++ linux-2.6.39.2/arch/x86/include/asm/microcode.h 2011-05-22 19:36:30.000000000 -0400
10220@@ -12,13 +12,13 @@ struct device;
10221 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
10222
10223 struct microcode_ops {
10224- enum ucode_state (*request_microcode_user) (int cpu,
10225+ enum ucode_state (* const request_microcode_user) (int cpu,
10226 const void __user *buf, size_t size);
10227
10228- enum ucode_state (*request_microcode_fw) (int cpu,
10229+ enum ucode_state (* const request_microcode_fw) (int cpu,
10230 struct device *device);
10231
10232- void (*microcode_fini_cpu) (int cpu);
10233+ void (* const microcode_fini_cpu) (int cpu);
10234
10235 /*
10236 * The generic 'microcode_core' part guarantees that
10237@@ -38,16 +38,16 @@ struct ucode_cpu_info {
10238 extern struct ucode_cpu_info ucode_cpu_info[];
10239
10240 #ifdef CONFIG_MICROCODE_INTEL
10241-extern struct microcode_ops * __init init_intel_microcode(void);
10242+extern const struct microcode_ops * __init init_intel_microcode(void);
10243 #else
10244-static inline struct microcode_ops * __init init_intel_microcode(void)
10245+static inline const struct microcode_ops * __init init_intel_microcode(void)
10246 {
10247 return NULL;
10248 }
10249 #endif /* CONFIG_MICROCODE_INTEL */
10250
10251 #ifdef CONFIG_MICROCODE_AMD
10252-extern struct microcode_ops * __init init_amd_microcode(void);
10253+extern const struct microcode_ops * __init init_amd_microcode(void);
10254
10255 static inline void get_ucode_data(void *to, const u8 *from, size_t n)
10256 {
10257@@ -55,7 +55,7 @@ static inline void get_ucode_data(void *
10258 }
10259
10260 #else
10261-static inline struct microcode_ops * __init init_amd_microcode(void)
10262+static inline const struct microcode_ops * __init init_amd_microcode(void)
10263 {
10264 return NULL;
10265 }
10266diff -urNp linux-2.6.39.2/arch/x86/include/asm/mman.h linux-2.6.39.2/arch/x86/include/asm/mman.h
10267--- linux-2.6.39.2/arch/x86/include/asm/mman.h 2011-05-19 00:06:34.000000000 -0400
10268+++ linux-2.6.39.2/arch/x86/include/asm/mman.h 2011-05-22 19:36:30.000000000 -0400
10269@@ -5,4 +5,14 @@
10270
10271 #include <asm-generic/mman.h>
10272
10273+#ifdef __KERNEL__
10274+#ifndef __ASSEMBLY__
10275+#ifdef CONFIG_X86_32
10276+#define arch_mmap_check i386_mmap_check
10277+int i386_mmap_check(unsigned long addr, unsigned long len,
10278+ unsigned long flags);
10279+#endif
10280+#endif
10281+#endif
10282+
10283 #endif /* _ASM_X86_MMAN_H */
10284diff -urNp linux-2.6.39.2/arch/x86/include/asm/mmu_context.h linux-2.6.39.2/arch/x86/include/asm/mmu_context.h
10285--- linux-2.6.39.2/arch/x86/include/asm/mmu_context.h 2011-05-19 00:06:34.000000000 -0400
10286+++ linux-2.6.39.2/arch/x86/include/asm/mmu_context.h 2011-05-22 19:36:30.000000000 -0400
10287@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
10288
10289 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
10290 {
10291+
10292+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10293+ unsigned int i;
10294+ pgd_t *pgd;
10295+
10296+ pax_open_kernel();
10297+ pgd = get_cpu_pgd(smp_processor_id());
10298+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
10299+ if (paravirt_enabled())
10300+ set_pgd(pgd+i, native_make_pgd(0));
10301+ else
10302+ pgd[i] = native_make_pgd(0);
10303+ pax_close_kernel();
10304+#endif
10305+
10306 #ifdef CONFIG_SMP
10307 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
10308 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
10309@@ -34,16 +49,30 @@ static inline void switch_mm(struct mm_s
10310 struct task_struct *tsk)
10311 {
10312 unsigned cpu = smp_processor_id();
10313+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
10314+ int tlbstate = TLBSTATE_OK;
10315+#endif
10316
10317 if (likely(prev != next)) {
10318 #ifdef CONFIG_SMP
10319+#ifdef CONFIG_X86_32
10320+ tlbstate = percpu_read(cpu_tlbstate.state);
10321+#endif
10322 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10323 percpu_write(cpu_tlbstate.active_mm, next);
10324 #endif
10325 cpumask_set_cpu(cpu, mm_cpumask(next));
10326
10327 /* Re-load page tables */
10328+#ifdef CONFIG_PAX_PER_CPU_PGD
10329+ pax_open_kernel();
10330+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10331+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10332+ pax_close_kernel();
10333+ load_cr3(get_cpu_pgd(cpu));
10334+#else
10335 load_cr3(next->pgd);
10336+#endif
10337
10338 /* stop flush ipis for the previous mm */
10339 cpumask_clear_cpu(cpu, mm_cpumask(prev));
10340@@ -53,9 +82,38 @@ static inline void switch_mm(struct mm_s
10341 */
10342 if (unlikely(prev->context.ldt != next->context.ldt))
10343 load_LDT_nolock(&next->context);
10344- }
10345+
10346+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10347+ if (!(__supported_pte_mask & _PAGE_NX)) {
10348+ smp_mb__before_clear_bit();
10349+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
10350+ smp_mb__after_clear_bit();
10351+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10352+ }
10353+#endif
10354+
10355+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10356+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
10357+ prev->context.user_cs_limit != next->context.user_cs_limit))
10358+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10359 #ifdef CONFIG_SMP
10360+ else if (unlikely(tlbstate != TLBSTATE_OK))
10361+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10362+#endif
10363+#endif
10364+
10365+ }
10366 else {
10367+
10368+#ifdef CONFIG_PAX_PER_CPU_PGD
10369+ pax_open_kernel();
10370+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10371+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10372+ pax_close_kernel();
10373+ load_cr3(get_cpu_pgd(cpu));
10374+#endif
10375+
10376+#ifdef CONFIG_SMP
10377 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10378 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
10379
10380@@ -64,11 +122,28 @@ static inline void switch_mm(struct mm_s
10381 * tlb flush IPI delivery. We must reload CR3
10382 * to make sure to use no freed page tables.
10383 */
10384+
10385+#ifndef CONFIG_PAX_PER_CPU_PGD
10386 load_cr3(next->pgd);
10387+#endif
10388+
10389 load_LDT_nolock(&next->context);
10390+
10391+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
10392+ if (!(__supported_pte_mask & _PAGE_NX))
10393+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10394+#endif
10395+
10396+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10397+#ifdef CONFIG_PAX_PAGEEXEC
10398+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
10399+#endif
10400+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10401+#endif
10402+
10403 }
10404- }
10405 #endif
10406+ }
10407 }
10408
10409 #define activate_mm(prev, next) \
10410diff -urNp linux-2.6.39.2/arch/x86/include/asm/mmu.h linux-2.6.39.2/arch/x86/include/asm/mmu.h
10411--- linux-2.6.39.2/arch/x86/include/asm/mmu.h 2011-05-19 00:06:34.000000000 -0400
10412+++ linux-2.6.39.2/arch/x86/include/asm/mmu.h 2011-05-22 19:36:30.000000000 -0400
10413@@ -9,10 +9,22 @@
10414 * we put the segment information here.
10415 */
10416 typedef struct {
10417- void *ldt;
10418+ struct desc_struct *ldt;
10419 int size;
10420 struct mutex lock;
10421- void *vdso;
10422+ unsigned long vdso;
10423+
10424+#ifdef CONFIG_X86_32
10425+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
10426+ unsigned long user_cs_base;
10427+ unsigned long user_cs_limit;
10428+
10429+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10430+ cpumask_t cpu_user_cs_mask;
10431+#endif
10432+
10433+#endif
10434+#endif
10435
10436 #ifdef CONFIG_X86_64
10437 /* True if mm supports a task running in 32 bit compatibility mode. */
10438diff -urNp linux-2.6.39.2/arch/x86/include/asm/module.h linux-2.6.39.2/arch/x86/include/asm/module.h
10439--- linux-2.6.39.2/arch/x86/include/asm/module.h 2011-05-19 00:06:34.000000000 -0400
10440+++ linux-2.6.39.2/arch/x86/include/asm/module.h 2011-05-22 19:41:32.000000000 -0400
10441@@ -5,6 +5,7 @@
10442
10443 #ifdef CONFIG_X86_64
10444 /* X86_64 does not define MODULE_PROC_FAMILY */
10445+#define MODULE_PROC_FAMILY ""
10446 #elif defined CONFIG_M386
10447 #define MODULE_PROC_FAMILY "386 "
10448 #elif defined CONFIG_M486
10449@@ -59,8 +60,30 @@
10450 #error unknown processor family
10451 #endif
10452
10453-#ifdef CONFIG_X86_32
10454-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
10455+#ifdef CONFIG_PAX_MEMORY_UDEREF
10456+#define MODULE_PAX_UDEREF "UDEREF "
10457+#else
10458+#define MODULE_PAX_UDEREF ""
10459+#endif
10460+
10461+#ifdef CONFIG_PAX_KERNEXEC
10462+#define MODULE_PAX_KERNEXEC "KERNEXEC "
10463+#else
10464+#define MODULE_PAX_KERNEXEC ""
10465 #endif
10466
10467+#ifdef CONFIG_PAX_REFCOUNT
10468+#define MODULE_PAX_REFCOUNT "REFCOUNT "
10469+#else
10470+#define MODULE_PAX_REFCOUNT ""
10471+#endif
10472+
10473+#ifdef CONFIG_GRKERNSEC
10474+#define MODULE_GRSEC "GRSECURITY "
10475+#else
10476+#define MODULE_GRSEC ""
10477+#endif
10478+
10479+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
10480+
10481 #endif /* _ASM_X86_MODULE_H */
10482diff -urNp linux-2.6.39.2/arch/x86/include/asm/page_64_types.h linux-2.6.39.2/arch/x86/include/asm/page_64_types.h
10483--- linux-2.6.39.2/arch/x86/include/asm/page_64_types.h 2011-05-19 00:06:34.000000000 -0400
10484+++ linux-2.6.39.2/arch/x86/include/asm/page_64_types.h 2011-05-22 19:36:30.000000000 -0400
10485@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
10486
10487 /* duplicated to the one in bootmem.h */
10488 extern unsigned long max_pfn;
10489-extern unsigned long phys_base;
10490+extern const unsigned long phys_base;
10491
10492 extern unsigned long __phys_addr(unsigned long);
10493 #define __phys_reloc_hide(x) (x)
10494diff -urNp linux-2.6.39.2/arch/x86/include/asm/paravirt.h linux-2.6.39.2/arch/x86/include/asm/paravirt.h
10495--- linux-2.6.39.2/arch/x86/include/asm/paravirt.h 2011-05-19 00:06:34.000000000 -0400
10496+++ linux-2.6.39.2/arch/x86/include/asm/paravirt.h 2011-05-22 19:36:30.000000000 -0400
10497@@ -739,6 +739,21 @@ static inline void __set_fixmap(unsigned
10498 pv_mmu_ops.set_fixmap(idx, phys, flags);
10499 }
10500
10501+#ifdef CONFIG_PAX_KERNEXEC
10502+static inline unsigned long pax_open_kernel(void)
10503+{
10504+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
10505+}
10506+
10507+static inline unsigned long pax_close_kernel(void)
10508+{
10509+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
10510+}
10511+#else
10512+static inline unsigned long pax_open_kernel(void) { return 0; }
10513+static inline unsigned long pax_close_kernel(void) { return 0; }
10514+#endif
10515+
10516 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
10517
10518 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
10519@@ -955,7 +970,7 @@ extern void default_banner(void);
10520
10521 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
10522 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
10523-#define PARA_INDIRECT(addr) *%cs:addr
10524+#define PARA_INDIRECT(addr) *%ss:addr
10525 #endif
10526
10527 #define INTERRUPT_RETURN \
10528@@ -1032,6 +1047,21 @@ extern void default_banner(void);
10529 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
10530 CLBR_NONE, \
10531 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
10532+
10533+#define GET_CR0_INTO_RDI \
10534+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
10535+ mov %rax,%rdi
10536+
10537+#define SET_RDI_INTO_CR0 \
10538+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
10539+
10540+#define GET_CR3_INTO_RDI \
10541+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
10542+ mov %rax,%rdi
10543+
10544+#define SET_RDI_INTO_CR3 \
10545+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
10546+
10547 #endif /* CONFIG_X86_32 */
10548
10549 #endif /* __ASSEMBLY__ */
10550diff -urNp linux-2.6.39.2/arch/x86/include/asm/paravirt_types.h linux-2.6.39.2/arch/x86/include/asm/paravirt_types.h
10551--- linux-2.6.39.2/arch/x86/include/asm/paravirt_types.h 2011-05-19 00:06:34.000000000 -0400
10552+++ linux-2.6.39.2/arch/x86/include/asm/paravirt_types.h 2011-05-22 19:36:30.000000000 -0400
10553@@ -317,6 +317,12 @@ struct pv_mmu_ops {
10554 an mfn. We can tell which is which from the index. */
10555 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
10556 phys_addr_t phys, pgprot_t flags);
10557+
10558+#ifdef CONFIG_PAX_KERNEXEC
10559+ unsigned long (*pax_open_kernel)(void);
10560+ unsigned long (*pax_close_kernel)(void);
10561+#endif
10562+
10563 };
10564
10565 struct arch_spinlock;
10566diff -urNp linux-2.6.39.2/arch/x86/include/asm/pci_x86.h linux-2.6.39.2/arch/x86/include/asm/pci_x86.h
10567--- linux-2.6.39.2/arch/x86/include/asm/pci_x86.h 2011-05-19 00:06:34.000000000 -0400
10568+++ linux-2.6.39.2/arch/x86/include/asm/pci_x86.h 2011-05-22 19:36:30.000000000 -0400
10569@@ -93,16 +93,16 @@ extern int (*pcibios_enable_irq)(struct
10570 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
10571
10572 struct pci_raw_ops {
10573- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10574+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10575 int reg, int len, u32 *val);
10576- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10577+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10578 int reg, int len, u32 val);
10579 };
10580
10581-extern struct pci_raw_ops *raw_pci_ops;
10582-extern struct pci_raw_ops *raw_pci_ext_ops;
10583+extern const struct pci_raw_ops *raw_pci_ops;
10584+extern const struct pci_raw_ops *raw_pci_ext_ops;
10585
10586-extern struct pci_raw_ops pci_direct_conf1;
10587+extern const struct pci_raw_ops pci_direct_conf1;
10588 extern bool port_cf9_safe;
10589
10590 /* arch_initcall level */
10591diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgalloc.h linux-2.6.39.2/arch/x86/include/asm/pgalloc.h
10592--- linux-2.6.39.2/arch/x86/include/asm/pgalloc.h 2011-05-19 00:06:34.000000000 -0400
10593+++ linux-2.6.39.2/arch/x86/include/asm/pgalloc.h 2011-05-22 19:36:30.000000000 -0400
10594@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
10595 pmd_t *pmd, pte_t *pte)
10596 {
10597 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10598+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
10599+}
10600+
10601+static inline void pmd_populate_user(struct mm_struct *mm,
10602+ pmd_t *pmd, pte_t *pte)
10603+{
10604+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10605 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
10606 }
10607
10608diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable-2level.h linux-2.6.39.2/arch/x86/include/asm/pgtable-2level.h
10609--- linux-2.6.39.2/arch/x86/include/asm/pgtable-2level.h 2011-05-19 00:06:34.000000000 -0400
10610+++ linux-2.6.39.2/arch/x86/include/asm/pgtable-2level.h 2011-05-22 19:36:30.000000000 -0400
10611@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
10612
10613 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10614 {
10615+ pax_open_kernel();
10616 *pmdp = pmd;
10617+ pax_close_kernel();
10618 }
10619
10620 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
10621diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable_32.h linux-2.6.39.2/arch/x86/include/asm/pgtable_32.h
10622--- linux-2.6.39.2/arch/x86/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
10623+++ linux-2.6.39.2/arch/x86/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
10624@@ -25,9 +25,6 @@
10625 struct mm_struct;
10626 struct vm_area_struct;
10627
10628-extern pgd_t swapper_pg_dir[1024];
10629-extern pgd_t initial_page_table[1024];
10630-
10631 static inline void pgtable_cache_init(void) { }
10632 static inline void check_pgt_cache(void) { }
10633 void paging_init(void);
10634@@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u
10635 # include <asm/pgtable-2level.h>
10636 #endif
10637
10638+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
10639+extern pgd_t initial_page_table[PTRS_PER_PGD];
10640+#ifdef CONFIG_X86_PAE
10641+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
10642+#endif
10643+
10644 #if defined(CONFIG_HIGHPTE)
10645 #define pte_offset_map(dir, address) \
10646 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
10647@@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u
10648 /* Clear a kernel PTE and flush it from the TLB */
10649 #define kpte_clear_flush(ptep, vaddr) \
10650 do { \
10651+ pax_open_kernel(); \
10652 pte_clear(&init_mm, (vaddr), (ptep)); \
10653+ pax_close_kernel(); \
10654 __flush_tlb_one((vaddr)); \
10655 } while (0)
10656
10657@@ -74,6 +79,9 @@ do { \
10658
10659 #endif /* !__ASSEMBLY__ */
10660
10661+#define HAVE_ARCH_UNMAPPED_AREA
10662+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
10663+
10664 /*
10665 * kern_addr_valid() is (1) for FLATMEM and (0) for
10666 * SPARSEMEM and DISCONTIGMEM
10667diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable_32_types.h linux-2.6.39.2/arch/x86/include/asm/pgtable_32_types.h
10668--- linux-2.6.39.2/arch/x86/include/asm/pgtable_32_types.h 2011-05-19 00:06:34.000000000 -0400
10669+++ linux-2.6.39.2/arch/x86/include/asm/pgtable_32_types.h 2011-05-22 19:36:30.000000000 -0400
10670@@ -8,7 +8,7 @@
10671 */
10672 #ifdef CONFIG_X86_PAE
10673 # include <asm/pgtable-3level_types.h>
10674-# define PMD_SIZE (1UL << PMD_SHIFT)
10675+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
10676 # define PMD_MASK (~(PMD_SIZE - 1))
10677 #else
10678 # include <asm/pgtable-2level_types.h>
10679@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
10680 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
10681 #endif
10682
10683+#ifdef CONFIG_PAX_KERNEXEC
10684+#ifndef __ASSEMBLY__
10685+extern unsigned char MODULES_EXEC_VADDR[];
10686+extern unsigned char MODULES_EXEC_END[];
10687+#endif
10688+#include <asm/boot.h>
10689+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
10690+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
10691+#else
10692+#define ktla_ktva(addr) (addr)
10693+#define ktva_ktla(addr) (addr)
10694+#endif
10695+
10696 #define MODULES_VADDR VMALLOC_START
10697 #define MODULES_END VMALLOC_END
10698 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
10699diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable-3level.h linux-2.6.39.2/arch/x86/include/asm/pgtable-3level.h
10700--- linux-2.6.39.2/arch/x86/include/asm/pgtable-3level.h 2011-05-19 00:06:34.000000000 -0400
10701+++ linux-2.6.39.2/arch/x86/include/asm/pgtable-3level.h 2011-05-22 19:36:30.000000000 -0400
10702@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
10703
10704 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10705 {
10706+ pax_open_kernel();
10707 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
10708+ pax_close_kernel();
10709 }
10710
10711 static inline void native_set_pud(pud_t *pudp, pud_t pud)
10712 {
10713+ pax_open_kernel();
10714 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
10715+ pax_close_kernel();
10716 }
10717
10718 /*
10719diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable_64.h linux-2.6.39.2/arch/x86/include/asm/pgtable_64.h
10720--- linux-2.6.39.2/arch/x86/include/asm/pgtable_64.h 2011-05-19 00:06:34.000000000 -0400
10721+++ linux-2.6.39.2/arch/x86/include/asm/pgtable_64.h 2011-05-22 19:36:30.000000000 -0400
10722@@ -16,10 +16,13 @@
10723
10724 extern pud_t level3_kernel_pgt[512];
10725 extern pud_t level3_ident_pgt[512];
10726+extern pud_t level3_vmalloc_pgt[512];
10727+extern pud_t level3_vmemmap_pgt[512];
10728+extern pud_t level2_vmemmap_pgt[512];
10729 extern pmd_t level2_kernel_pgt[512];
10730 extern pmd_t level2_fixmap_pgt[512];
10731-extern pmd_t level2_ident_pgt[512];
10732-extern pgd_t init_level4_pgt[];
10733+extern pmd_t level2_ident_pgt[512*2];
10734+extern pgd_t init_level4_pgt[512];
10735
10736 #define swapper_pg_dir init_level4_pgt
10737
10738@@ -61,7 +64,9 @@ static inline void native_set_pte_atomic
10739
10740 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10741 {
10742+ pax_open_kernel();
10743 *pmdp = pmd;
10744+ pax_close_kernel();
10745 }
10746
10747 static inline void native_pmd_clear(pmd_t *pmd)
10748@@ -107,7 +112,9 @@ static inline void native_pud_clear(pud_
10749
10750 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
10751 {
10752+ pax_open_kernel();
10753 *pgdp = pgd;
10754+ pax_close_kernel();
10755 }
10756
10757 static inline void native_pgd_clear(pgd_t *pgd)
10758diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable_64_types.h linux-2.6.39.2/arch/x86/include/asm/pgtable_64_types.h
10759--- linux-2.6.39.2/arch/x86/include/asm/pgtable_64_types.h 2011-05-19 00:06:34.000000000 -0400
10760+++ linux-2.6.39.2/arch/x86/include/asm/pgtable_64_types.h 2011-05-22 19:36:30.000000000 -0400
10761@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
10762 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
10763 #define MODULES_END _AC(0xffffffffff000000, UL)
10764 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
10765+#define MODULES_EXEC_VADDR MODULES_VADDR
10766+#define MODULES_EXEC_END MODULES_END
10767+
10768+#define ktla_ktva(addr) (addr)
10769+#define ktva_ktla(addr) (addr)
10770
10771 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
10772diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable.h linux-2.6.39.2/arch/x86/include/asm/pgtable.h
10773--- linux-2.6.39.2/arch/x86/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
10774+++ linux-2.6.39.2/arch/x86/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
10775@@ -81,12 +81,51 @@ extern struct mm_struct *pgd_page_get_mm
10776
10777 #define arch_end_context_switch(prev) do {} while(0)
10778
10779+#define pax_open_kernel() native_pax_open_kernel()
10780+#define pax_close_kernel() native_pax_close_kernel()
10781 #endif /* CONFIG_PARAVIRT */
10782
10783+#define __HAVE_ARCH_PAX_OPEN_KERNEL
10784+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
10785+
10786+#ifdef CONFIG_PAX_KERNEXEC
10787+static inline unsigned long native_pax_open_kernel(void)
10788+{
10789+ unsigned long cr0;
10790+
10791+ preempt_disable();
10792+ barrier();
10793+ cr0 = read_cr0() ^ X86_CR0_WP;
10794+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
10795+ write_cr0(cr0);
10796+ return cr0 ^ X86_CR0_WP;
10797+}
10798+
10799+static inline unsigned long native_pax_close_kernel(void)
10800+{
10801+ unsigned long cr0;
10802+
10803+ cr0 = read_cr0() ^ X86_CR0_WP;
10804+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
10805+ write_cr0(cr0);
10806+ barrier();
10807+ preempt_enable_no_resched();
10808+ return cr0 ^ X86_CR0_WP;
10809+}
10810+#else
10811+static inline unsigned long native_pax_open_kernel(void) { return 0; }
10812+static inline unsigned long native_pax_close_kernel(void) { return 0; }
10813+#endif
10814+
10815 /*
10816 * The following only work if pte_present() is true.
10817 * Undefined behaviour if not..
10818 */
10819+static inline int pte_user(pte_t pte)
10820+{
10821+ return pte_val(pte) & _PAGE_USER;
10822+}
10823+
10824 static inline int pte_dirty(pte_t pte)
10825 {
10826 return pte_flags(pte) & _PAGE_DIRTY;
10827@@ -196,9 +235,29 @@ static inline pte_t pte_wrprotect(pte_t
10828 return pte_clear_flags(pte, _PAGE_RW);
10829 }
10830
10831+static inline pte_t pte_mkread(pte_t pte)
10832+{
10833+ return __pte(pte_val(pte) | _PAGE_USER);
10834+}
10835+
10836 static inline pte_t pte_mkexec(pte_t pte)
10837 {
10838- return pte_clear_flags(pte, _PAGE_NX);
10839+#ifdef CONFIG_X86_PAE
10840+ if (__supported_pte_mask & _PAGE_NX)
10841+ return pte_clear_flags(pte, _PAGE_NX);
10842+ else
10843+#endif
10844+ return pte_set_flags(pte, _PAGE_USER);
10845+}
10846+
10847+static inline pte_t pte_exprotect(pte_t pte)
10848+{
10849+#ifdef CONFIG_X86_PAE
10850+ if (__supported_pte_mask & _PAGE_NX)
10851+ return pte_set_flags(pte, _PAGE_NX);
10852+ else
10853+#endif
10854+ return pte_clear_flags(pte, _PAGE_USER);
10855 }
10856
10857 static inline pte_t pte_mkdirty(pte_t pte)
10858@@ -390,6 +449,15 @@ pte_t *populate_extra_pte(unsigned long
10859 #endif
10860
10861 #ifndef __ASSEMBLY__
10862+
10863+#ifdef CONFIG_PAX_PER_CPU_PGD
10864+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
10865+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
10866+{
10867+ return cpu_pgd[cpu];
10868+}
10869+#endif
10870+
10871 #include <linux/mm_types.h>
10872
10873 static inline int pte_none(pte_t pte)
10874@@ -560,7 +628,7 @@ static inline pud_t *pud_offset(pgd_t *p
10875
10876 static inline int pgd_bad(pgd_t pgd)
10877 {
10878- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
10879+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
10880 }
10881
10882 static inline int pgd_none(pgd_t pgd)
10883@@ -583,7 +651,12 @@ static inline int pgd_none(pgd_t pgd)
10884 * pgd_offset() returns a (pgd_t *)
10885 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
10886 */
10887-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
10888+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
10889+
10890+#ifdef CONFIG_PAX_PER_CPU_PGD
10891+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
10892+#endif
10893+
10894 /*
10895 * a shortcut which implies the use of the kernel's pgd, instead
10896 * of a process's
10897@@ -594,6 +667,20 @@ static inline int pgd_none(pgd_t pgd)
10898 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
10899 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
10900
10901+#ifdef CONFIG_X86_32
10902+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
10903+#else
10904+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
10905+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
10906+
10907+#ifdef CONFIG_PAX_MEMORY_UDEREF
10908+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
10909+#else
10910+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
10911+#endif
10912+
10913+#endif
10914+
10915 #ifndef __ASSEMBLY__
10916
10917 extern int direct_gbpages;
10918@@ -758,11 +845,23 @@ static inline void pmdp_set_wrprotect(st
10919 * dst and src can be on the same page, but the range must not overlap,
10920 * and must not cross a page boundary.
10921 */
10922-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
10923+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
10924 {
10925- memcpy(dst, src, count * sizeof(pgd_t));
10926+ pax_open_kernel();
10927+ while (count--)
10928+ *dst++ = *src++;
10929+ pax_close_kernel();
10930 }
10931
10932+#ifdef CONFIG_PAX_PER_CPU_PGD
10933+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10934+#endif
10935+
10936+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10937+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10938+#else
10939+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
10940+#endif
10941
10942 #include <asm-generic/pgtable.h>
10943 #endif /* __ASSEMBLY__ */
10944diff -urNp linux-2.6.39.2/arch/x86/include/asm/pgtable_types.h linux-2.6.39.2/arch/x86/include/asm/pgtable_types.h
10945--- linux-2.6.39.2/arch/x86/include/asm/pgtable_types.h 2011-05-19 00:06:34.000000000 -0400
10946+++ linux-2.6.39.2/arch/x86/include/asm/pgtable_types.h 2011-05-22 19:36:30.000000000 -0400
10947@@ -16,13 +16,12 @@
10948 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
10949 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
10950 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
10951-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
10952+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
10953 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
10954 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
10955 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
10956-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
10957-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
10958-#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
10959+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
10960+#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
10961 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
10962
10963 /* If _PAGE_BIT_PRESENT is clear, we use these: */
10964@@ -40,7 +39,6 @@
10965 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
10966 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
10967 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
10968-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
10969 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
10970 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
10971 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
10972@@ -57,8 +55,10 @@
10973
10974 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
10975 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
10976-#else
10977+#elif defined(CONFIG_KMEMCHECK)
10978 #define _PAGE_NX (_AT(pteval_t, 0))
10979+#else
10980+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
10981 #endif
10982
10983 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
10984@@ -96,6 +96,9 @@
10985 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
10986 _PAGE_ACCESSED)
10987
10988+#define PAGE_READONLY_NOEXEC PAGE_READONLY
10989+#define PAGE_SHARED_NOEXEC PAGE_SHARED
10990+
10991 #define __PAGE_KERNEL_EXEC \
10992 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
10993 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
10994@@ -106,8 +109,8 @@
10995 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
10996 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
10997 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
10998-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
10999-#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
11000+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
11001+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
11002 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
11003 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
11004 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
11005@@ -166,8 +169,8 @@
11006 * bits are combined, this will alow user to access the high address mapped
11007 * VDSO in the presence of CONFIG_COMPAT_VDSO
11008 */
11009-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
11010-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
11011+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
11012+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
11013 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
11014 #endif
11015
11016@@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p
11017 {
11018 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
11019 }
11020+#endif
11021
11022+#if PAGETABLE_LEVELS == 3
11023+#include <asm-generic/pgtable-nopud.h>
11024+#endif
11025+
11026+#if PAGETABLE_LEVELS == 2
11027+#include <asm-generic/pgtable-nopmd.h>
11028+#endif
11029+
11030+#ifndef __ASSEMBLY__
11031 #if PAGETABLE_LEVELS > 3
11032 typedef struct { pudval_t pud; } pud_t;
11033
11034@@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu
11035 return pud.pud;
11036 }
11037 #else
11038-#include <asm-generic/pgtable-nopud.h>
11039-
11040 static inline pudval_t native_pud_val(pud_t pud)
11041 {
11042 return native_pgd_val(pud.pgd);
11043@@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm
11044 return pmd.pmd;
11045 }
11046 #else
11047-#include <asm-generic/pgtable-nopmd.h>
11048-
11049 static inline pmdval_t native_pmd_val(pmd_t pmd)
11050 {
11051 return native_pgd_val(pmd.pud.pgd);
11052@@ -281,7 +290,6 @@ typedef struct page *pgtable_t;
11053
11054 extern pteval_t __supported_pte_mask;
11055 extern void set_nx(void);
11056-extern int nx_enabled;
11057
11058 #define pgprot_writecombine pgprot_writecombine
11059 extern pgprot_t pgprot_writecombine(pgprot_t prot);
11060diff -urNp linux-2.6.39.2/arch/x86/include/asm/processor.h linux-2.6.39.2/arch/x86/include/asm/processor.h
11061--- linux-2.6.39.2/arch/x86/include/asm/processor.h 2011-05-19 00:06:34.000000000 -0400
11062+++ linux-2.6.39.2/arch/x86/include/asm/processor.h 2011-05-22 19:36:30.000000000 -0400
11063@@ -266,7 +266,7 @@ struct tss_struct {
11064
11065 } ____cacheline_aligned;
11066
11067-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
11068+extern struct tss_struct init_tss[NR_CPUS];
11069
11070 /*
11071 * Save the original ist values for checking stack pointers during debugging
11072@@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co
11073 */
11074 #define TASK_SIZE PAGE_OFFSET
11075 #define TASK_SIZE_MAX TASK_SIZE
11076+
11077+#ifdef CONFIG_PAX_SEGMEXEC
11078+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
11079+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
11080+#else
11081 #define STACK_TOP TASK_SIZE
11082-#define STACK_TOP_MAX STACK_TOP
11083+#endif
11084+
11085+#define STACK_TOP_MAX TASK_SIZE
11086
11087 #define INIT_THREAD { \
11088- .sp0 = sizeof(init_stack) + (long)&init_stack, \
11089+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
11090 .vm86_info = NULL, \
11091 .sysenter_cs = __KERNEL_CS, \
11092 .io_bitmap_ptr = NULL, \
11093@@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co
11094 */
11095 #define INIT_TSS { \
11096 .x86_tss = { \
11097- .sp0 = sizeof(init_stack) + (long)&init_stack, \
11098+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
11099 .ss0 = __KERNEL_DS, \
11100 .ss1 = __KERNEL_CS, \
11101 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
11102@@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co
11103 extern unsigned long thread_saved_pc(struct task_struct *tsk);
11104
11105 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
11106-#define KSTK_TOP(info) \
11107-({ \
11108- unsigned long *__ptr = (unsigned long *)(info); \
11109- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
11110-})
11111+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
11112
11113 /*
11114 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
11115@@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str
11116 #define task_pt_regs(task) \
11117 ({ \
11118 struct pt_regs *__regs__; \
11119- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
11120+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
11121 __regs__ - 1; \
11122 })
11123
11124@@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str
11125 /*
11126 * User space process size. 47bits minus one guard page.
11127 */
11128-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
11129+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
11130
11131 /* This decides where the kernel will search for a free chunk of vm
11132 * space during mmap's.
11133 */
11134 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
11135- 0xc0000000 : 0xFFFFe000)
11136+ 0xc0000000 : 0xFFFFf000)
11137
11138 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
11139 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
11140@@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str
11141 #define STACK_TOP_MAX TASK_SIZE_MAX
11142
11143 #define INIT_THREAD { \
11144- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
11145+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
11146 }
11147
11148 #define INIT_TSS { \
11149- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
11150+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
11151 }
11152
11153 /*
11154@@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs
11155 */
11156 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
11157
11158+#ifdef CONFIG_PAX_SEGMEXEC
11159+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
11160+#endif
11161+
11162 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
11163
11164 /* Get/set a process' ability to use the timestamp counter instruction */
11165diff -urNp linux-2.6.39.2/arch/x86/include/asm/ptrace.h linux-2.6.39.2/arch/x86/include/asm/ptrace.h
11166--- linux-2.6.39.2/arch/x86/include/asm/ptrace.h 2011-05-19 00:06:34.000000000 -0400
11167+++ linux-2.6.39.2/arch/x86/include/asm/ptrace.h 2011-05-22 19:36:30.000000000 -0400
11168@@ -152,28 +152,29 @@ static inline unsigned long regs_return_
11169 }
11170
11171 /*
11172- * user_mode_vm(regs) determines whether a register set came from user mode.
11173+ * user_mode(regs) determines whether a register set came from user mode.
11174 * This is true if V8086 mode was enabled OR if the register set was from
11175 * protected mode with RPL-3 CS value. This tricky test checks that with
11176 * one comparison. Many places in the kernel can bypass this full check
11177- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
11178+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
11179+ * be used.
11180 */
11181-static inline int user_mode(struct pt_regs *regs)
11182+static inline int user_mode_novm(struct pt_regs *regs)
11183 {
11184 #ifdef CONFIG_X86_32
11185 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
11186 #else
11187- return !!(regs->cs & 3);
11188+ return !!(regs->cs & SEGMENT_RPL_MASK);
11189 #endif
11190 }
11191
11192-static inline int user_mode_vm(struct pt_regs *regs)
11193+static inline int user_mode(struct pt_regs *regs)
11194 {
11195 #ifdef CONFIG_X86_32
11196 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
11197 USER_RPL;
11198 #else
11199- return user_mode(regs);
11200+ return user_mode_novm(regs);
11201 #endif
11202 }
11203
11204diff -urNp linux-2.6.39.2/arch/x86/include/asm/reboot.h linux-2.6.39.2/arch/x86/include/asm/reboot.h
11205--- linux-2.6.39.2/arch/x86/include/asm/reboot.h 2011-05-19 00:06:34.000000000 -0400
11206+++ linux-2.6.39.2/arch/x86/include/asm/reboot.h 2011-05-22 19:36:30.000000000 -0400
11207@@ -6,19 +6,19 @@
11208 struct pt_regs;
11209
11210 struct machine_ops {
11211- void (*restart)(char *cmd);
11212- void (*halt)(void);
11213- void (*power_off)(void);
11214+ void (* __noreturn restart)(char *cmd);
11215+ void (* __noreturn halt)(void);
11216+ void (* __noreturn power_off)(void);
11217 void (*shutdown)(void);
11218 void (*crash_shutdown)(struct pt_regs *);
11219- void (*emergency_restart)(void);
11220+ void (* __noreturn emergency_restart)(void);
11221 };
11222
11223 extern struct machine_ops machine_ops;
11224
11225 void native_machine_crash_shutdown(struct pt_regs *regs);
11226 void native_machine_shutdown(void);
11227-void machine_real_restart(unsigned int type);
11228+void machine_real_restart(unsigned int type) __noreturn;
11229 /* These must match dispatch_table in reboot_32.S */
11230 #define MRR_BIOS 0
11231 #define MRR_APM 1
11232diff -urNp linux-2.6.39.2/arch/x86/include/asm/rwsem.h linux-2.6.39.2/arch/x86/include/asm/rwsem.h
11233--- linux-2.6.39.2/arch/x86/include/asm/rwsem.h 2011-05-19 00:06:34.000000000 -0400
11234+++ linux-2.6.39.2/arch/x86/include/asm/rwsem.h 2011-05-22 19:36:30.000000000 -0400
11235@@ -64,6 +64,14 @@ static inline void __down_read(struct rw
11236 {
11237 asm volatile("# beginning down_read\n\t"
11238 LOCK_PREFIX _ASM_INC "(%1)\n\t"
11239+
11240+#ifdef CONFIG_PAX_REFCOUNT
11241+ "jno 0f\n"
11242+ LOCK_PREFIX _ASM_DEC "(%1)\n"
11243+ "int $4\n0:\n"
11244+ _ASM_EXTABLE(0b, 0b)
11245+#endif
11246+
11247 /* adds 0x00000001 */
11248 " jns 1f\n"
11249 " call call_rwsem_down_read_failed\n"
11250@@ -85,6 +93,14 @@ static inline int __down_read_trylock(st
11251 "1:\n\t"
11252 " mov %1,%2\n\t"
11253 " add %3,%2\n\t"
11254+
11255+#ifdef CONFIG_PAX_REFCOUNT
11256+ "jno 0f\n"
11257+ "sub %3,%2\n"
11258+ "int $4\n0:\n"
11259+ _ASM_EXTABLE(0b, 0b)
11260+#endif
11261+
11262 " jle 2f\n\t"
11263 LOCK_PREFIX " cmpxchg %2,%0\n\t"
11264 " jnz 1b\n\t"
11265@@ -104,6 +120,14 @@ static inline void __down_write_nested(s
11266 long tmp;
11267 asm volatile("# beginning down_write\n\t"
11268 LOCK_PREFIX " xadd %1,(%2)\n\t"
11269+
11270+#ifdef CONFIG_PAX_REFCOUNT
11271+ "jno 0f\n"
11272+ "mov %1,(%2)\n"
11273+ "int $4\n0:\n"
11274+ _ASM_EXTABLE(0b, 0b)
11275+#endif
11276+
11277 /* adds 0xffff0001, returns the old value */
11278 " test %1,%1\n\t"
11279 /* was the count 0 before? */
11280@@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s
11281 long tmp;
11282 asm volatile("# beginning __up_read\n\t"
11283 LOCK_PREFIX " xadd %1,(%2)\n\t"
11284+
11285+#ifdef CONFIG_PAX_REFCOUNT
11286+ "jno 0f\n"
11287+ "mov %1,(%2)\n"
11288+ "int $4\n0:\n"
11289+ _ASM_EXTABLE(0b, 0b)
11290+#endif
11291+
11292 /* subtracts 1, returns the old value */
11293 " jns 1f\n\t"
11294 " call call_rwsem_wake\n" /* expects old value in %edx */
11295@@ -159,6 +191,14 @@ static inline void __up_write(struct rw_
11296 long tmp;
11297 asm volatile("# beginning __up_write\n\t"
11298 LOCK_PREFIX " xadd %1,(%2)\n\t"
11299+
11300+#ifdef CONFIG_PAX_REFCOUNT
11301+ "jno 0f\n"
11302+ "mov %1,(%2)\n"
11303+ "int $4\n0:\n"
11304+ _ASM_EXTABLE(0b, 0b)
11305+#endif
11306+
11307 /* subtracts 0xffff0001, returns the old value */
11308 " jns 1f\n\t"
11309 " call call_rwsem_wake\n" /* expects old value in %edx */
11310@@ -176,6 +216,14 @@ static inline void __downgrade_write(str
11311 {
11312 asm volatile("# beginning __downgrade_write\n\t"
11313 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
11314+
11315+#ifdef CONFIG_PAX_REFCOUNT
11316+ "jno 0f\n"
11317+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
11318+ "int $4\n0:\n"
11319+ _ASM_EXTABLE(0b, 0b)
11320+#endif
11321+
11322 /*
11323 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
11324 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
11325@@ -194,7 +242,15 @@ static inline void __downgrade_write(str
11326 */
11327 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
11328 {
11329- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
11330+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
11331+
11332+#ifdef CONFIG_PAX_REFCOUNT
11333+ "jno 0f\n"
11334+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
11335+ "int $4\n0:\n"
11336+ _ASM_EXTABLE(0b, 0b)
11337+#endif
11338+
11339 : "+m" (sem->count)
11340 : "er" (delta));
11341 }
11342@@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l
11343 {
11344 long tmp = delta;
11345
11346- asm volatile(LOCK_PREFIX "xadd %0,%1"
11347+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
11348+
11349+#ifdef CONFIG_PAX_REFCOUNT
11350+ "jno 0f\n"
11351+ "mov %0,%1\n"
11352+ "int $4\n0:\n"
11353+ _ASM_EXTABLE(0b, 0b)
11354+#endif
11355+
11356 : "+r" (tmp), "+m" (sem->count)
11357 : : "memory");
11358
11359diff -urNp linux-2.6.39.2/arch/x86/include/asm/segment.h linux-2.6.39.2/arch/x86/include/asm/segment.h
11360--- linux-2.6.39.2/arch/x86/include/asm/segment.h 2011-05-19 00:06:34.000000000 -0400
11361+++ linux-2.6.39.2/arch/x86/include/asm/segment.h 2011-05-22 19:36:30.000000000 -0400
11362@@ -64,8 +64,8 @@
11363 * 26 - ESPFIX small SS
11364 * 27 - per-cpu [ offset to per-cpu data area ]
11365 * 28 - stack_canary-20 [ for stack protector ]
11366- * 29 - unused
11367- * 30 - unused
11368+ * 29 - PCI BIOS CS
11369+ * 30 - PCI BIOS DS
11370 * 31 - TSS for double fault handler
11371 */
11372 #define GDT_ENTRY_TLS_MIN 6
11373@@ -79,6 +79,8 @@
11374
11375 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
11376
11377+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
11378+
11379 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
11380
11381 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
11382@@ -104,6 +106,12 @@
11383 #define __KERNEL_STACK_CANARY 0
11384 #endif
11385
11386+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
11387+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
11388+
11389+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
11390+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
11391+
11392 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
11393
11394 /*
11395@@ -141,7 +149,7 @@
11396 */
11397
11398 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
11399-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
11400+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
11401
11402
11403 #else
11404@@ -165,6 +173,8 @@
11405 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
11406 #define __USER32_DS __USER_DS
11407
11408+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
11409+
11410 #define GDT_ENTRY_TSS 8 /* needs two entries */
11411 #define GDT_ENTRY_LDT 10 /* needs two entries */
11412 #define GDT_ENTRY_TLS_MIN 12
11413@@ -185,6 +195,7 @@
11414 #endif
11415
11416 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
11417+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
11418 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
11419 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
11420 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
11421diff -urNp linux-2.6.39.2/arch/x86/include/asm/smp.h linux-2.6.39.2/arch/x86/include/asm/smp.h
11422--- linux-2.6.39.2/arch/x86/include/asm/smp.h 2011-05-19 00:06:34.000000000 -0400
11423+++ linux-2.6.39.2/arch/x86/include/asm/smp.h 2011-05-22 19:36:30.000000000 -0400
11424@@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_
11425 /* cpus sharing the last level cache: */
11426 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
11427 DECLARE_PER_CPU(u16, cpu_llc_id);
11428-DECLARE_PER_CPU(int, cpu_number);
11429+DECLARE_PER_CPU(unsigned int, cpu_number);
11430
11431 static inline struct cpumask *cpu_sibling_mask(int cpu)
11432 {
11433@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd
11434 extern int safe_smp_processor_id(void);
11435
11436 #elif defined(CONFIG_X86_64_SMP)
11437-#define raw_smp_processor_id() (percpu_read(cpu_number))
11438-
11439-#define stack_smp_processor_id() \
11440-({ \
11441- struct thread_info *ti; \
11442- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
11443- ti->cpu; \
11444-})
11445+#define raw_smp_processor_id() (percpu_read(cpu_number))
11446+#define stack_smp_processor_id() raw_smp_processor_id()
11447 #define safe_smp_processor_id() smp_processor_id()
11448
11449 #endif
11450diff -urNp linux-2.6.39.2/arch/x86/include/asm/spinlock.h linux-2.6.39.2/arch/x86/include/asm/spinlock.h
11451--- linux-2.6.39.2/arch/x86/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
11452+++ linux-2.6.39.2/arch/x86/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
11453@@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
11454 static inline void arch_read_lock(arch_rwlock_t *rw)
11455 {
11456 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
11457+
11458+#ifdef CONFIG_PAX_REFCOUNT
11459+ "jno 0f\n"
11460+ LOCK_PREFIX " addl $1,(%0)\n"
11461+ "int $4\n0:\n"
11462+ _ASM_EXTABLE(0b, 0b)
11463+#endif
11464+
11465 "jns 1f\n"
11466 "call __read_lock_failed\n\t"
11467 "1:\n"
11468@@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r
11469 static inline void arch_write_lock(arch_rwlock_t *rw)
11470 {
11471 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
11472+
11473+#ifdef CONFIG_PAX_REFCOUNT
11474+ "jno 0f\n"
11475+ LOCK_PREFIX " addl %1,(%0)\n"
11476+ "int $4\n0:\n"
11477+ _ASM_EXTABLE(0b, 0b)
11478+#endif
11479+
11480 "jz 1f\n"
11481 "call __write_lock_failed\n\t"
11482 "1:\n"
11483@@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc
11484
11485 static inline void arch_read_unlock(arch_rwlock_t *rw)
11486 {
11487- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
11488+ asm volatile(LOCK_PREFIX "incl %0\n"
11489+
11490+#ifdef CONFIG_PAX_REFCOUNT
11491+ "jno 0f\n"
11492+ LOCK_PREFIX "decl %0\n"
11493+ "int $4\n0:\n"
11494+ _ASM_EXTABLE(0b, 0b)
11495+#endif
11496+
11497+ :"+m" (rw->lock) : : "memory");
11498 }
11499
11500 static inline void arch_write_unlock(arch_rwlock_t *rw)
11501 {
11502- asm volatile(LOCK_PREFIX "addl %1, %0"
11503+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
11504+
11505+#ifdef CONFIG_PAX_REFCOUNT
11506+ "jno 0f\n"
11507+ LOCK_PREFIX "subl %1, %0\n"
11508+ "int $4\n0:\n"
11509+ _ASM_EXTABLE(0b, 0b)
11510+#endif
11511+
11512 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
11513 }
11514
11515diff -urNp linux-2.6.39.2/arch/x86/include/asm/stackprotector.h linux-2.6.39.2/arch/x86/include/asm/stackprotector.h
11516--- linux-2.6.39.2/arch/x86/include/asm/stackprotector.h 2011-05-19 00:06:34.000000000 -0400
11517+++ linux-2.6.39.2/arch/x86/include/asm/stackprotector.h 2011-05-22 19:36:30.000000000 -0400
11518@@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
11519
11520 static inline void load_stack_canary_segment(void)
11521 {
11522-#ifdef CONFIG_X86_32
11523+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
11524 asm volatile ("mov %0, %%gs" : : "r" (0));
11525 #endif
11526 }
11527diff -urNp linux-2.6.39.2/arch/x86/include/asm/stacktrace.h linux-2.6.39.2/arch/x86/include/asm/stacktrace.h
11528--- linux-2.6.39.2/arch/x86/include/asm/stacktrace.h 2011-05-19 00:06:34.000000000 -0400
11529+++ linux-2.6.39.2/arch/x86/include/asm/stacktrace.h 2011-05-22 19:36:30.000000000 -0400
11530@@ -11,28 +11,20 @@
11531
11532 extern int kstack_depth_to_print;
11533
11534-struct thread_info;
11535+struct task_struct;
11536 struct stacktrace_ops;
11537
11538-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
11539- unsigned long *stack,
11540- unsigned long bp,
11541- const struct stacktrace_ops *ops,
11542- void *data,
11543- unsigned long *end,
11544- int *graph);
11545-
11546-extern unsigned long
11547-print_context_stack(struct thread_info *tinfo,
11548- unsigned long *stack, unsigned long bp,
11549- const struct stacktrace_ops *ops, void *data,
11550- unsigned long *end, int *graph);
11551-
11552-extern unsigned long
11553-print_context_stack_bp(struct thread_info *tinfo,
11554- unsigned long *stack, unsigned long bp,
11555- const struct stacktrace_ops *ops, void *data,
11556- unsigned long *end, int *graph);
11557+typedef unsigned long walk_stack_t(struct task_struct *task,
11558+ void *stack_start,
11559+ unsigned long *stack,
11560+ unsigned long bp,
11561+ const struct stacktrace_ops *ops,
11562+ void *data,
11563+ unsigned long *end,
11564+ int *graph);
11565+
11566+extern walk_stack_t print_context_stack;
11567+extern walk_stack_t print_context_stack_bp;
11568
11569 /* Generic stack tracer with callbacks */
11570
11571@@ -43,7 +35,7 @@ struct stacktrace_ops {
11572 void (*address)(void *data, unsigned long address, int reliable);
11573 /* On negative return stop dumping */
11574 int (*stack)(void *data, char *name);
11575- walk_stack_t walk_stack;
11576+ walk_stack_t *walk_stack;
11577 };
11578
11579 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
11580diff -urNp linux-2.6.39.2/arch/x86/include/asm/system.h linux-2.6.39.2/arch/x86/include/asm/system.h
11581--- linux-2.6.39.2/arch/x86/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
11582+++ linux-2.6.39.2/arch/x86/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
11583@@ -129,7 +129,7 @@ do { \
11584 "call __switch_to\n\t" \
11585 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
11586 __switch_canary \
11587- "movq %P[thread_info](%%rsi),%%r8\n\t" \
11588+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
11589 "movq %%rax,%%rdi\n\t" \
11590 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
11591 "jnz ret_from_fork\n\t" \
11592@@ -140,7 +140,7 @@ do { \
11593 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
11594 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
11595 [_tif_fork] "i" (_TIF_FORK), \
11596- [thread_info] "i" (offsetof(struct task_struct, stack)), \
11597+ [thread_info] "m" (current_tinfo), \
11598 [current_task] "m" (current_task) \
11599 __switch_canary_iparam \
11600 : "memory", "cc" __EXTRA_CLOBBER)
11601@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
11602 {
11603 unsigned long __limit;
11604 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
11605- return __limit + 1;
11606+ return __limit;
11607 }
11608
11609 static inline void native_clts(void)
11610@@ -340,12 +340,12 @@ void enable_hlt(void);
11611
11612 void cpu_idle_wait(void);
11613
11614-extern unsigned long arch_align_stack(unsigned long sp);
11615+#define arch_align_stack(x) ((x) & ~0xfUL)
11616 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
11617
11618 void default_idle(void);
11619
11620-void stop_this_cpu(void *dummy);
11621+void stop_this_cpu(void *dummy) __noreturn;
11622
11623 /*
11624 * Force strict CPU ordering.
11625diff -urNp linux-2.6.39.2/arch/x86/include/asm/thread_info.h linux-2.6.39.2/arch/x86/include/asm/thread_info.h
11626--- linux-2.6.39.2/arch/x86/include/asm/thread_info.h 2011-05-19 00:06:34.000000000 -0400
11627+++ linux-2.6.39.2/arch/x86/include/asm/thread_info.h 2011-05-22 19:36:30.000000000 -0400
11628@@ -10,6 +10,7 @@
11629 #include <linux/compiler.h>
11630 #include <asm/page.h>
11631 #include <asm/types.h>
11632+#include <asm/percpu.h>
11633
11634 /*
11635 * low level task data that entry.S needs immediate access to
11636@@ -24,7 +25,6 @@ struct exec_domain;
11637 #include <asm/atomic.h>
11638
11639 struct thread_info {
11640- struct task_struct *task; /* main task structure */
11641 struct exec_domain *exec_domain; /* execution domain */
11642 __u32 flags; /* low level flags */
11643 __u32 status; /* thread synchronous flags */
11644@@ -34,18 +34,12 @@ struct thread_info {
11645 mm_segment_t addr_limit;
11646 struct restart_block restart_block;
11647 void __user *sysenter_return;
11648-#ifdef CONFIG_X86_32
11649- unsigned long previous_esp; /* ESP of the previous stack in
11650- case of nested (IRQ) stacks
11651- */
11652- __u8 supervisor_stack[0];
11653-#endif
11654+ unsigned long lowest_stack;
11655 int uaccess_err;
11656 };
11657
11658-#define INIT_THREAD_INFO(tsk) \
11659+#define INIT_THREAD_INFO \
11660 { \
11661- .task = &tsk, \
11662 .exec_domain = &default_exec_domain, \
11663 .flags = 0, \
11664 .cpu = 0, \
11665@@ -56,7 +50,7 @@ struct thread_info {
11666 }, \
11667 }
11668
11669-#define init_thread_info (init_thread_union.thread_info)
11670+#define init_thread_info (init_thread_union.stack)
11671 #define init_stack (init_thread_union.stack)
11672
11673 #else /* !__ASSEMBLY__ */
11674@@ -170,6 +164,23 @@ struct thread_info {
11675 ret; \
11676 })
11677
11678+#ifdef __ASSEMBLY__
11679+/* how to get the thread information struct from ASM */
11680+#define GET_THREAD_INFO(reg) \
11681+ mov PER_CPU_VAR(current_tinfo), reg
11682+
11683+/* use this one if reg already contains %esp */
11684+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
11685+#else
11686+/* how to get the thread information struct from C */
11687+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
11688+
11689+static __always_inline struct thread_info *current_thread_info(void)
11690+{
11691+ return percpu_read_stable(current_tinfo);
11692+}
11693+#endif
11694+
11695 #ifdef CONFIG_X86_32
11696
11697 #define STACK_WARN (THREAD_SIZE/8)
11698@@ -180,35 +191,13 @@ struct thread_info {
11699 */
11700 #ifndef __ASSEMBLY__
11701
11702-
11703 /* how to get the current stack pointer from C */
11704 register unsigned long current_stack_pointer asm("esp") __used;
11705
11706-/* how to get the thread information struct from C */
11707-static inline struct thread_info *current_thread_info(void)
11708-{
11709- return (struct thread_info *)
11710- (current_stack_pointer & ~(THREAD_SIZE - 1));
11711-}
11712-
11713-#else /* !__ASSEMBLY__ */
11714-
11715-/* how to get the thread information struct from ASM */
11716-#define GET_THREAD_INFO(reg) \
11717- movl $-THREAD_SIZE, reg; \
11718- andl %esp, reg
11719-
11720-/* use this one if reg already contains %esp */
11721-#define GET_THREAD_INFO_WITH_ESP(reg) \
11722- andl $-THREAD_SIZE, reg
11723-
11724 #endif
11725
11726 #else /* X86_32 */
11727
11728-#include <asm/percpu.h>
11729-#define KERNEL_STACK_OFFSET (5*8)
11730-
11731 /*
11732 * macros/functions for gaining access to the thread information structure
11733 * preempt_count needs to be 1 initially, until the scheduler is functional.
11734@@ -216,21 +205,8 @@ static inline struct thread_info *curren
11735 #ifndef __ASSEMBLY__
11736 DECLARE_PER_CPU(unsigned long, kernel_stack);
11737
11738-static inline struct thread_info *current_thread_info(void)
11739-{
11740- struct thread_info *ti;
11741- ti = (void *)(percpu_read_stable(kernel_stack) +
11742- KERNEL_STACK_OFFSET - THREAD_SIZE);
11743- return ti;
11744-}
11745-
11746-#else /* !__ASSEMBLY__ */
11747-
11748-/* how to get the thread information struct from ASM */
11749-#define GET_THREAD_INFO(reg) \
11750- movq PER_CPU_VAR(kernel_stack),reg ; \
11751- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
11752-
11753+/* how to get the current stack pointer from C */
11754+register unsigned long current_stack_pointer asm("rsp") __used;
11755 #endif
11756
11757 #endif /* !X86_32 */
11758@@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
11759 extern void free_thread_info(struct thread_info *ti);
11760 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
11761 #define arch_task_cache_init arch_task_cache_init
11762+
11763+#define __HAVE_THREAD_FUNCTIONS
11764+#define task_thread_info(task) (&(task)->tinfo)
11765+#define task_stack_page(task) ((task)->stack)
11766+#define setup_thread_stack(p, org) do {} while (0)
11767+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
11768+
11769+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
11770+extern struct task_struct *alloc_task_struct_node(int node);
11771+extern void free_task_struct(struct task_struct *);
11772+
11773 #endif
11774 #endif /* _ASM_X86_THREAD_INFO_H */
11775diff -urNp linux-2.6.39.2/arch/x86/include/asm/uaccess_32.h linux-2.6.39.2/arch/x86/include/asm/uaccess_32.h
11776--- linux-2.6.39.2/arch/x86/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
11777+++ linux-2.6.39.2/arch/x86/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
11778@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
11779 static __always_inline unsigned long __must_check
11780 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
11781 {
11782+ pax_track_stack();
11783+
11784+ if ((long)n < 0)
11785+ return n;
11786+
11787 if (__builtin_constant_p(n)) {
11788 unsigned long ret;
11789
11790@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
11791 return ret;
11792 }
11793 }
11794+ if (!__builtin_constant_p(n))
11795+ check_object_size(from, n, true);
11796 return __copy_to_user_ll(to, from, n);
11797 }
11798
11799@@ -83,12 +90,16 @@ static __always_inline unsigned long __m
11800 __copy_to_user(void __user *to, const void *from, unsigned long n)
11801 {
11802 might_fault();
11803+
11804 return __copy_to_user_inatomic(to, from, n);
11805 }
11806
11807 static __always_inline unsigned long
11808 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
11809 {
11810+ if ((long)n < 0)
11811+ return n;
11812+
11813 /* Avoid zeroing the tail if the copy fails..
11814 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
11815 * but as the zeroing behaviour is only significant when n is not
11816@@ -138,6 +149,12 @@ static __always_inline unsigned long
11817 __copy_from_user(void *to, const void __user *from, unsigned long n)
11818 {
11819 might_fault();
11820+
11821+ pax_track_stack();
11822+
11823+ if ((long)n < 0)
11824+ return n;
11825+
11826 if (__builtin_constant_p(n)) {
11827 unsigned long ret;
11828
11829@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
11830 return ret;
11831 }
11832 }
11833+ if (!__builtin_constant_p(n))
11834+ check_object_size(to, n, false);
11835 return __copy_from_user_ll(to, from, n);
11836 }
11837
11838@@ -160,6 +179,10 @@ static __always_inline unsigned long __c
11839 const void __user *from, unsigned long n)
11840 {
11841 might_fault();
11842+
11843+ if ((long)n < 0)
11844+ return n;
11845+
11846 if (__builtin_constant_p(n)) {
11847 unsigned long ret;
11848
11849@@ -182,15 +205,19 @@ static __always_inline unsigned long
11850 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
11851 unsigned long n)
11852 {
11853- return __copy_from_user_ll_nocache_nozero(to, from, n);
11854-}
11855+ if ((long)n < 0)
11856+ return n;
11857
11858-unsigned long __must_check copy_to_user(void __user *to,
11859- const void *from, unsigned long n);
11860-unsigned long __must_check _copy_from_user(void *to,
11861- const void __user *from,
11862- unsigned long n);
11863+ return __copy_from_user_ll_nocache_nozero(to, from, n);
11864+}
11865
11866+extern void copy_to_user_overflow(void)
11867+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11868+ __compiletime_error("copy_to_user() buffer size is not provably correct")
11869+#else
11870+ __compiletime_warning("copy_to_user() buffer size is not provably correct")
11871+#endif
11872+;
11873
11874 extern void copy_from_user_overflow(void)
11875 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11876@@ -200,17 +227,61 @@ extern void copy_from_user_overflow(void
11877 #endif
11878 ;
11879
11880-static inline unsigned long __must_check copy_from_user(void *to,
11881- const void __user *from,
11882- unsigned long n)
11883+/**
11884+ * copy_to_user: - Copy a block of data into user space.
11885+ * @to: Destination address, in user space.
11886+ * @from: Source address, in kernel space.
11887+ * @n: Number of bytes to copy.
11888+ *
11889+ * Context: User context only. This function may sleep.
11890+ *
11891+ * Copy data from kernel space to user space.
11892+ *
11893+ * Returns number of bytes that could not be copied.
11894+ * On success, this will be zero.
11895+ */
11896+static inline unsigned long __must_check
11897+copy_to_user(void __user *to, const void *from, unsigned long n)
11898+{
11899+ int sz = __compiletime_object_size(from);
11900+
11901+ if (unlikely(sz != -1 && sz < n))
11902+ copy_to_user_overflow();
11903+ else if (access_ok(VERIFY_WRITE, to, n))
11904+ n = __copy_to_user(to, from, n);
11905+ return n;
11906+}
11907+
11908+/**
11909+ * copy_from_user: - Copy a block of data from user space.
11910+ * @to: Destination address, in kernel space.
11911+ * @from: Source address, in user space.
11912+ * @n: Number of bytes to copy.
11913+ *
11914+ * Context: User context only. This function may sleep.
11915+ *
11916+ * Copy data from user space to kernel space.
11917+ *
11918+ * Returns number of bytes that could not be copied.
11919+ * On success, this will be zero.
11920+ *
11921+ * If some data could not be copied, this function will pad the copied
11922+ * data to the requested size using zero bytes.
11923+ */
11924+static inline unsigned long __must_check
11925+copy_from_user(void *to, const void __user *from, unsigned long n)
11926 {
11927 int sz = __compiletime_object_size(to);
11928
11929- if (likely(sz == -1 || sz >= n))
11930- n = _copy_from_user(to, from, n);
11931- else
11932+ if (unlikely(sz != -1 && sz < n))
11933 copy_from_user_overflow();
11934-
11935+ else if (access_ok(VERIFY_READ, from, n))
11936+ n = __copy_from_user(to, from, n);
11937+ else if ((long)n > 0) {
11938+ if (!__builtin_constant_p(n))
11939+ check_object_size(to, n, false);
11940+ memset(to, 0, n);
11941+ }
11942 return n;
11943 }
11944
11945diff -urNp linux-2.6.39.2/arch/x86/include/asm/uaccess_64.h linux-2.6.39.2/arch/x86/include/asm/uaccess_64.h
11946--- linux-2.6.39.2/arch/x86/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
11947+++ linux-2.6.39.2/arch/x86/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
11948@@ -11,6 +11,9 @@
11949 #include <asm/alternative.h>
11950 #include <asm/cpufeature.h>
11951 #include <asm/page.h>
11952+#include <asm/pgtable.h>
11953+
11954+#define set_fs(x) (current_thread_info()->addr_limit = (x))
11955
11956 /*
11957 * Copy To/From Userspace
11958@@ -37,26 +40,26 @@ copy_user_generic(void *to, const void *
11959 return ret;
11960 }
11961
11962-__must_check unsigned long
11963-_copy_to_user(void __user *to, const void *from, unsigned len);
11964-__must_check unsigned long
11965-_copy_from_user(void *to, const void __user *from, unsigned len);
11966+static __always_inline __must_check unsigned long
11967+__copy_to_user(void __user *to, const void *from, unsigned len);
11968+static __always_inline __must_check unsigned long
11969+__copy_from_user(void *to, const void __user *from, unsigned len);
11970 __must_check unsigned long
11971 copy_in_user(void __user *to, const void __user *from, unsigned len);
11972
11973 static inline unsigned long __must_check copy_from_user(void *to,
11974 const void __user *from,
11975- unsigned long n)
11976+ unsigned n)
11977 {
11978- int sz = __compiletime_object_size(to);
11979-
11980 might_fault();
11981- if (likely(sz == -1 || sz >= n))
11982- n = _copy_from_user(to, from, n);
11983-#ifdef CONFIG_DEBUG_VM
11984- else
11985- WARN(1, "Buffer overflow detected!\n");
11986-#endif
11987+
11988+ if (access_ok(VERIFY_READ, from, n))
11989+ n = __copy_from_user(to, from, n);
11990+ else if ((int)n > 0) {
11991+ if (!__builtin_constant_p(n))
11992+ check_object_size(to, n, false);
11993+ memset(to, 0, n);
11994+ }
11995 return n;
11996 }
11997
11998@@ -65,110 +68,198 @@ int copy_to_user(void __user *dst, const
11999 {
12000 might_fault();
12001
12002- return _copy_to_user(dst, src, size);
12003+ if (access_ok(VERIFY_WRITE, dst, size))
12004+ size = __copy_to_user(dst, src, size);
12005+ return size;
12006 }
12007
12008 static __always_inline __must_check
12009-int __copy_from_user(void *dst, const void __user *src, unsigned size)
12010+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
12011 {
12012- int ret = 0;
12013+ int sz = __compiletime_object_size(dst);
12014+ unsigned ret = 0;
12015
12016 might_fault();
12017- if (!__builtin_constant_p(size))
12018- return copy_user_generic(dst, (__force void *)src, size);
12019+
12020+ pax_track_stack();
12021+
12022+ if ((int)size < 0)
12023+ return size;
12024+
12025+#ifdef CONFIG_PAX_MEMORY_UDEREF
12026+ if (!__access_ok(VERIFY_READ, src, size))
12027+ return size;
12028+#endif
12029+
12030+ if (unlikely(sz != -1 && sz < size)) {
12031+#ifdef CONFIG_DEBUG_VM
12032+ WARN(1, "Buffer overflow detected!\n");
12033+#endif
12034+ return size;
12035+ }
12036+
12037+ if (!__builtin_constant_p(size)) {
12038+ check_object_size(dst, size, false);
12039+
12040+#ifdef CONFIG_PAX_MEMORY_UDEREF
12041+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12042+ src += PAX_USER_SHADOW_BASE;
12043+#endif
12044+
12045+ return copy_user_generic(dst, (__force const void *)src, size);
12046+ }
12047 switch (size) {
12048- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
12049+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
12050 ret, "b", "b", "=q", 1);
12051 return ret;
12052- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
12053+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
12054 ret, "w", "w", "=r", 2);
12055 return ret;
12056- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
12057+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
12058 ret, "l", "k", "=r", 4);
12059 return ret;
12060- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
12061+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
12062 ret, "q", "", "=r", 8);
12063 return ret;
12064 case 10:
12065- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
12066+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
12067 ret, "q", "", "=r", 10);
12068 if (unlikely(ret))
12069 return ret;
12070 __get_user_asm(*(u16 *)(8 + (char *)dst),
12071- (u16 __user *)(8 + (char __user *)src),
12072+ (const u16 __user *)(8 + (const char __user *)src),
12073 ret, "w", "w", "=r", 2);
12074 return ret;
12075 case 16:
12076- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
12077+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
12078 ret, "q", "", "=r", 16);
12079 if (unlikely(ret))
12080 return ret;
12081 __get_user_asm(*(u64 *)(8 + (char *)dst),
12082- (u64 __user *)(8 + (char __user *)src),
12083+ (const u64 __user *)(8 + (const char __user *)src),
12084 ret, "q", "", "=r", 8);
12085 return ret;
12086 default:
12087- return copy_user_generic(dst, (__force void *)src, size);
12088+
12089+#ifdef CONFIG_PAX_MEMORY_UDEREF
12090+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12091+ src += PAX_USER_SHADOW_BASE;
12092+#endif
12093+
12094+ return copy_user_generic(dst, (__force const void *)src, size);
12095 }
12096 }
12097
12098 static __always_inline __must_check
12099-int __copy_to_user(void __user *dst, const void *src, unsigned size)
12100+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
12101 {
12102- int ret = 0;
12103+ int sz = __compiletime_object_size(src);
12104+ unsigned ret = 0;
12105
12106 might_fault();
12107- if (!__builtin_constant_p(size))
12108+
12109+ pax_track_stack();
12110+
12111+ if ((int)size < 0)
12112+ return size;
12113+
12114+#ifdef CONFIG_PAX_MEMORY_UDEREF
12115+ if (!__access_ok(VERIFY_WRITE, dst, size))
12116+ return size;
12117+#endif
12118+
12119+ if (unlikely(sz != -1 && sz < size)) {
12120+#ifdef CONFIG_DEBUG_VM
12121+ WARN(1, "Buffer overflow detected!\n");
12122+#endif
12123+ return size;
12124+ }
12125+
12126+ if (!__builtin_constant_p(size)) {
12127+ check_object_size(src, size, true);
12128+
12129+#ifdef CONFIG_PAX_MEMORY_UDEREF
12130+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12131+ dst += PAX_USER_SHADOW_BASE;
12132+#endif
12133+
12134 return copy_user_generic((__force void *)dst, src, size);
12135+ }
12136 switch (size) {
12137- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
12138+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
12139 ret, "b", "b", "iq", 1);
12140 return ret;
12141- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
12142+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
12143 ret, "w", "w", "ir", 2);
12144 return ret;
12145- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
12146+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
12147 ret, "l", "k", "ir", 4);
12148 return ret;
12149- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
12150+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
12151 ret, "q", "", "er", 8);
12152 return ret;
12153 case 10:
12154- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
12155+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
12156 ret, "q", "", "er", 10);
12157 if (unlikely(ret))
12158 return ret;
12159 asm("":::"memory");
12160- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
12161+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
12162 ret, "w", "w", "ir", 2);
12163 return ret;
12164 case 16:
12165- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
12166+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
12167 ret, "q", "", "er", 16);
12168 if (unlikely(ret))
12169 return ret;
12170 asm("":::"memory");
12171- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
12172+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
12173 ret, "q", "", "er", 8);
12174 return ret;
12175 default:
12176+
12177+#ifdef CONFIG_PAX_MEMORY_UDEREF
12178+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12179+ dst += PAX_USER_SHADOW_BASE;
12180+#endif
12181+
12182 return copy_user_generic((__force void *)dst, src, size);
12183 }
12184 }
12185
12186 static __always_inline __must_check
12187-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
12188+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
12189 {
12190- int ret = 0;
12191+ unsigned ret = 0;
12192
12193 might_fault();
12194- if (!__builtin_constant_p(size))
12195+
12196+ if ((int)size < 0)
12197+ return size;
12198+
12199+#ifdef CONFIG_PAX_MEMORY_UDEREF
12200+ if (!__access_ok(VERIFY_READ, src, size))
12201+ return size;
12202+ if (!__access_ok(VERIFY_WRITE, dst, size))
12203+ return size;
12204+#endif
12205+
12206+ if (!__builtin_constant_p(size)) {
12207+
12208+#ifdef CONFIG_PAX_MEMORY_UDEREF
12209+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12210+ src += PAX_USER_SHADOW_BASE;
12211+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12212+ dst += PAX_USER_SHADOW_BASE;
12213+#endif
12214+
12215 return copy_user_generic((__force void *)dst,
12216- (__force void *)src, size);
12217+ (__force const void *)src, size);
12218+ }
12219 switch (size) {
12220 case 1: {
12221 u8 tmp;
12222- __get_user_asm(tmp, (u8 __user *)src,
12223+ __get_user_asm(tmp, (const u8 __user *)src,
12224 ret, "b", "b", "=q", 1);
12225 if (likely(!ret))
12226 __put_user_asm(tmp, (u8 __user *)dst,
12227@@ -177,7 +268,7 @@ int __copy_in_user(void __user *dst, con
12228 }
12229 case 2: {
12230 u16 tmp;
12231- __get_user_asm(tmp, (u16 __user *)src,
12232+ __get_user_asm(tmp, (const u16 __user *)src,
12233 ret, "w", "w", "=r", 2);
12234 if (likely(!ret))
12235 __put_user_asm(tmp, (u16 __user *)dst,
12236@@ -187,7 +278,7 @@ int __copy_in_user(void __user *dst, con
12237
12238 case 4: {
12239 u32 tmp;
12240- __get_user_asm(tmp, (u32 __user *)src,
12241+ __get_user_asm(tmp, (const u32 __user *)src,
12242 ret, "l", "k", "=r", 4);
12243 if (likely(!ret))
12244 __put_user_asm(tmp, (u32 __user *)dst,
12245@@ -196,7 +287,7 @@ int __copy_in_user(void __user *dst, con
12246 }
12247 case 8: {
12248 u64 tmp;
12249- __get_user_asm(tmp, (u64 __user *)src,
12250+ __get_user_asm(tmp, (const u64 __user *)src,
12251 ret, "q", "", "=r", 8);
12252 if (likely(!ret))
12253 __put_user_asm(tmp, (u64 __user *)dst,
12254@@ -204,8 +295,16 @@ int __copy_in_user(void __user *dst, con
12255 return ret;
12256 }
12257 default:
12258+
12259+#ifdef CONFIG_PAX_MEMORY_UDEREF
12260+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12261+ src += PAX_USER_SHADOW_BASE;
12262+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12263+ dst += PAX_USER_SHADOW_BASE;
12264+#endif
12265+
12266 return copy_user_generic((__force void *)dst,
12267- (__force void *)src, size);
12268+ (__force const void *)src, size);
12269 }
12270 }
12271
12272@@ -222,33 +321,72 @@ __must_check unsigned long __clear_user(
12273 static __must_check __always_inline int
12274 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
12275 {
12276+ pax_track_stack();
12277+
12278+ if ((int)size < 0)
12279+ return size;
12280+
12281+#ifdef CONFIG_PAX_MEMORY_UDEREF
12282+ if (!__access_ok(VERIFY_READ, src, size))
12283+ return size;
12284+
12285+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12286+ src += PAX_USER_SHADOW_BASE;
12287+#endif
12288+
12289 return copy_user_generic(dst, (__force const void *)src, size);
12290 }
12291
12292-static __must_check __always_inline int
12293+static __must_check __always_inline unsigned long
12294 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
12295 {
12296+ if ((int)size < 0)
12297+ return size;
12298+
12299+#ifdef CONFIG_PAX_MEMORY_UDEREF
12300+ if (!__access_ok(VERIFY_WRITE, dst, size))
12301+ return size;
12302+
12303+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12304+ dst += PAX_USER_SHADOW_BASE;
12305+#endif
12306+
12307 return copy_user_generic((__force void *)dst, src, size);
12308 }
12309
12310-extern long __copy_user_nocache(void *dst, const void __user *src,
12311+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
12312 unsigned size, int zerorest);
12313
12314-static inline int
12315-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12316+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12317 {
12318 might_sleep();
12319+
12320+ if ((int)size < 0)
12321+ return size;
12322+
12323+#ifdef CONFIG_PAX_MEMORY_UDEREF
12324+ if (!__access_ok(VERIFY_READ, src, size))
12325+ return size;
12326+#endif
12327+
12328 return __copy_user_nocache(dst, src, size, 1);
12329 }
12330
12331-static inline int
12332-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12333+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12334 unsigned size)
12335 {
12336+ if ((int)size < 0)
12337+ return size;
12338+
12339+#ifdef CONFIG_PAX_MEMORY_UDEREF
12340+ if (!__access_ok(VERIFY_READ, src, size))
12341+ return size;
12342+#endif
12343+
12344 return __copy_user_nocache(dst, src, size, 0);
12345 }
12346
12347-unsigned long
12348+extern unsigned long
12349 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
12350
12351 #endif /* _ASM_X86_UACCESS_64_H */
12352diff -urNp linux-2.6.39.2/arch/x86/include/asm/uaccess.h linux-2.6.39.2/arch/x86/include/asm/uaccess.h
12353--- linux-2.6.39.2/arch/x86/include/asm/uaccess.h 2011-06-03 00:04:13.000000000 -0400
12354+++ linux-2.6.39.2/arch/x86/include/asm/uaccess.h 2011-06-03 00:32:04.000000000 -0400
12355@@ -8,12 +8,15 @@
12356 #include <linux/thread_info.h>
12357 #include <linux/prefetch.h>
12358 #include <linux/string.h>
12359+#include <linux/sched.h>
12360 #include <asm/asm.h>
12361 #include <asm/page.h>
12362
12363 #define VERIFY_READ 0
12364 #define VERIFY_WRITE 1
12365
12366+extern void check_object_size(const void *ptr, unsigned long n, bool to);
12367+
12368 /*
12369 * The fs value determines whether argument validity checking should be
12370 * performed or not. If get_fs() == USER_DS, checking is performed, with
12371@@ -29,7 +32,12 @@
12372
12373 #define get_ds() (KERNEL_DS)
12374 #define get_fs() (current_thread_info()->addr_limit)
12375+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12376+void __set_fs(mm_segment_t x);
12377+void set_fs(mm_segment_t x);
12378+#else
12379 #define set_fs(x) (current_thread_info()->addr_limit = (x))
12380+#endif
12381
12382 #define segment_eq(a, b) ((a).seg == (b).seg)
12383
12384@@ -77,7 +85,33 @@
12385 * checks that the pointer is in the user space range - after calling
12386 * this function, memory access functions may still return -EFAULT.
12387 */
12388-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12389+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12390+#define access_ok(type, addr, size) \
12391+({ \
12392+ long __size = size; \
12393+ unsigned long __addr = (unsigned long)addr; \
12394+ unsigned long __addr_ao = __addr & PAGE_MASK; \
12395+ unsigned long __end_ao = __addr + __size - 1; \
12396+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
12397+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
12398+ while(__addr_ao <= __end_ao) { \
12399+ char __c_ao; \
12400+ __addr_ao += PAGE_SIZE; \
12401+ if (__size > PAGE_SIZE) \
12402+ cond_resched(); \
12403+ if (__get_user(__c_ao, (char __user *)__addr)) \
12404+ break; \
12405+ if (type != VERIFY_WRITE) { \
12406+ __addr = __addr_ao; \
12407+ continue; \
12408+ } \
12409+ if (__put_user(__c_ao, (char __user *)__addr)) \
12410+ break; \
12411+ __addr = __addr_ao; \
12412+ } \
12413+ } \
12414+ __ret_ao; \
12415+})
12416
12417 /*
12418 * The exception table consists of pairs of addresses: the first is the
12419@@ -183,12 +217,20 @@ extern int __get_user_bad(void);
12420 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
12421 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
12422
12423-
12424+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12425+#define __copyuser_seg "gs;"
12426+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
12427+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
12428+#else
12429+#define __copyuser_seg
12430+#define __COPYUSER_SET_ES
12431+#define __COPYUSER_RESTORE_ES
12432+#endif
12433
12434 #ifdef CONFIG_X86_32
12435 #define __put_user_asm_u64(x, addr, err, errret) \
12436- asm volatile("1: movl %%eax,0(%2)\n" \
12437- "2: movl %%edx,4(%2)\n" \
12438+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
12439+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
12440 "3:\n" \
12441 ".section .fixup,\"ax\"\n" \
12442 "4: movl %3,%0\n" \
12443@@ -200,8 +242,8 @@ extern int __get_user_bad(void);
12444 : "A" (x), "r" (addr), "i" (errret), "0" (err))
12445
12446 #define __put_user_asm_ex_u64(x, addr) \
12447- asm volatile("1: movl %%eax,0(%1)\n" \
12448- "2: movl %%edx,4(%1)\n" \
12449+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
12450+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
12451 "3:\n" \
12452 _ASM_EXTABLE(1b, 2b - 1b) \
12453 _ASM_EXTABLE(2b, 3b - 2b) \
12454@@ -374,7 +416,7 @@ do { \
12455 } while (0)
12456
12457 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12458- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
12459+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
12460 "2:\n" \
12461 ".section .fixup,\"ax\"\n" \
12462 "3: mov %3,%0\n" \
12463@@ -382,7 +424,7 @@ do { \
12464 " jmp 2b\n" \
12465 ".previous\n" \
12466 _ASM_EXTABLE(1b, 3b) \
12467- : "=r" (err), ltype(x) \
12468+ : "=r" (err), ltype (x) \
12469 : "m" (__m(addr)), "i" (errret), "0" (err))
12470
12471 #define __get_user_size_ex(x, ptr, size) \
12472@@ -407,7 +449,7 @@ do { \
12473 } while (0)
12474
12475 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
12476- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
12477+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
12478 "2:\n" \
12479 _ASM_EXTABLE(1b, 2b - 1b) \
12480 : ltype(x) : "m" (__m(addr)))
12481@@ -424,13 +466,24 @@ do { \
12482 int __gu_err; \
12483 unsigned long __gu_val; \
12484 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
12485- (x) = (__force __typeof__(*(ptr)))__gu_val; \
12486+ (x) = (__typeof__(*(ptr)))__gu_val; \
12487 __gu_err; \
12488 })
12489
12490 /* FIXME: this hack is definitely wrong -AK */
12491 struct __large_struct { unsigned long buf[100]; };
12492-#define __m(x) (*(struct __large_struct __user *)(x))
12493+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12494+#define ____m(x) \
12495+({ \
12496+ unsigned long ____x = (unsigned long)(x); \
12497+ if (____x < PAX_USER_SHADOW_BASE) \
12498+ ____x += PAX_USER_SHADOW_BASE; \
12499+ (void __user *)____x; \
12500+})
12501+#else
12502+#define ____m(x) (x)
12503+#endif
12504+#define __m(x) (*(struct __large_struct __user *)____m(x))
12505
12506 /*
12507 * Tell gcc we read from memory instead of writing: this is because
12508@@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
12509 * aliasing issues.
12510 */
12511 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12512- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
12513+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
12514 "2:\n" \
12515 ".section .fixup,\"ax\"\n" \
12516 "3: mov %3,%0\n" \
12517@@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
12518 ".previous\n" \
12519 _ASM_EXTABLE(1b, 3b) \
12520 : "=r"(err) \
12521- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
12522+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
12523
12524 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
12525- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
12526+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
12527 "2:\n" \
12528 _ASM_EXTABLE(1b, 2b - 1b) \
12529 : : ltype(x), "m" (__m(addr)))
12530@@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
12531 * On error, the variable @x is set to zero.
12532 */
12533
12534+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12535+#define __get_user(x, ptr) get_user((x), (ptr))
12536+#else
12537 #define __get_user(x, ptr) \
12538 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
12539+#endif
12540
12541 /**
12542 * __put_user: - Write a simple value into user space, with less checking.
12543@@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
12544 * Returns zero on success, or -EFAULT on error.
12545 */
12546
12547+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12548+#define __put_user(x, ptr) put_user((x), (ptr))
12549+#else
12550 #define __put_user(x, ptr) \
12551 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
12552+#endif
12553
12554 #define __get_user_unaligned __get_user
12555 #define __put_user_unaligned __put_user
12556@@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
12557 #define get_user_ex(x, ptr) do { \
12558 unsigned long __gue_val; \
12559 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
12560- (x) = (__force __typeof__(*(ptr)))__gue_val; \
12561+ (x) = (__typeof__(*(ptr)))__gue_val; \
12562 } while (0)
12563
12564 #ifdef CONFIG_X86_WP_WORKS_OK
12565@@ -567,6 +628,7 @@ extern struct movsl_mask {
12566
12567 #define ARCH_HAS_NOCACHE_UACCESS 1
12568
12569+#define ARCH_HAS_SORT_EXTABLE
12570 #ifdef CONFIG_X86_32
12571 # include "uaccess_32.h"
12572 #else
12573diff -urNp linux-2.6.39.2/arch/x86/include/asm/vgtod.h linux-2.6.39.2/arch/x86/include/asm/vgtod.h
12574--- linux-2.6.39.2/arch/x86/include/asm/vgtod.h 2011-05-19 00:06:34.000000000 -0400
12575+++ linux-2.6.39.2/arch/x86/include/asm/vgtod.h 2011-05-22 19:36:30.000000000 -0400
12576@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
12577 int sysctl_enabled;
12578 struct timezone sys_tz;
12579 struct { /* extract of a clocksource struct */
12580+ char name[8];
12581 cycle_t (*vread)(void);
12582 cycle_t cycle_last;
12583 cycle_t mask;
12584diff -urNp linux-2.6.39.2/arch/x86/include/asm/vsyscall.h linux-2.6.39.2/arch/x86/include/asm/vsyscall.h
12585--- linux-2.6.39.2/arch/x86/include/asm/vsyscall.h 2011-05-19 00:06:34.000000000 -0400
12586+++ linux-2.6.39.2/arch/x86/include/asm/vsyscall.h 2011-05-22 19:36:30.000000000 -0400
12587@@ -15,9 +15,10 @@ enum vsyscall_num {
12588
12589 #ifdef __KERNEL__
12590 #include <linux/seqlock.h>
12591+#include <linux/getcpu.h>
12592+#include <linux/time.h>
12593
12594 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
12595-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
12596
12597 /* Definitions for CONFIG_GENERIC_TIME definitions */
12598 #define __section_vsyscall_gtod_data __attribute__ \
12599@@ -31,7 +32,6 @@ enum vsyscall_num {
12600 #define VGETCPU_LSL 2
12601
12602 extern int __vgetcpu_mode;
12603-extern volatile unsigned long __jiffies;
12604
12605 /* kernel space (writeable) */
12606 extern int vgetcpu_mode;
12607@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
12608
12609 extern void map_vsyscall(void);
12610
12611+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
12612+extern time_t vtime(time_t *t);
12613+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
12614 #endif /* __KERNEL__ */
12615
12616 #endif /* _ASM_X86_VSYSCALL_H */
12617diff -urNp linux-2.6.39.2/arch/x86/include/asm/xen/pci.h linux-2.6.39.2/arch/x86/include/asm/xen/pci.h
12618--- linux-2.6.39.2/arch/x86/include/asm/xen/pci.h 2011-05-19 00:06:34.000000000 -0400
12619+++ linux-2.6.39.2/arch/x86/include/asm/xen/pci.h 2011-05-22 19:36:30.000000000 -0400
12620@@ -33,7 +33,7 @@ struct xen_pci_frontend_ops {
12621 void (*disable_msix)(struct pci_dev *dev);
12622 };
12623
12624-extern struct xen_pci_frontend_ops *xen_pci_frontend;
12625+extern const struct xen_pci_frontend_ops *xen_pci_frontend;
12626
12627 static inline int xen_pci_frontend_enable_msi(struct pci_dev *dev,
12628 int vectors[])
12629diff -urNp linux-2.6.39.2/arch/x86/include/asm/xsave.h linux-2.6.39.2/arch/x86/include/asm/xsave.h
12630--- linux-2.6.39.2/arch/x86/include/asm/xsave.h 2011-05-19 00:06:34.000000000 -0400
12631+++ linux-2.6.39.2/arch/x86/include/asm/xsave.h 2011-05-22 19:36:30.000000000 -0400
12632@@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
12633 {
12634 int err;
12635
12636+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12637+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
12638+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
12639+#endif
12640+
12641 /*
12642 * Clear the xsave header first, so that reserved fields are
12643 * initialized to zero.
12644@@ -100,6 +105,11 @@ static inline int xrestore_user(struct x
12645 u32 lmask = mask;
12646 u32 hmask = mask >> 32;
12647
12648+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12649+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
12650+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
12651+#endif
12652+
12653 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
12654 "2:\n"
12655 ".section .fixup,\"ax\"\n"
12656diff -urNp linux-2.6.39.2/arch/x86/Kconfig linux-2.6.39.2/arch/x86/Kconfig
12657--- linux-2.6.39.2/arch/x86/Kconfig 2011-05-19 00:06:34.000000000 -0400
12658+++ linux-2.6.39.2/arch/x86/Kconfig 2011-05-22 19:41:32.000000000 -0400
12659@@ -224,7 +224,7 @@ config X86_HT
12660
12661 config X86_32_LAZY_GS
12662 def_bool y
12663- depends on X86_32 && !CC_STACKPROTECTOR
12664+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
12665
12666 config ARCH_HWEIGHT_CFLAGS
12667 string
12668@@ -1022,7 +1022,7 @@ choice
12669
12670 config NOHIGHMEM
12671 bool "off"
12672- depends on !X86_NUMAQ
12673+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12674 ---help---
12675 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
12676 However, the address space of 32-bit x86 processors is only 4
12677@@ -1059,7 +1059,7 @@ config NOHIGHMEM
12678
12679 config HIGHMEM4G
12680 bool "4GB"
12681- depends on !X86_NUMAQ
12682+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12683 ---help---
12684 Select this if you have a 32-bit processor and between 1 and 4
12685 gigabytes of physical RAM.
12686@@ -1113,7 +1113,7 @@ config PAGE_OFFSET
12687 hex
12688 default 0xB0000000 if VMSPLIT_3G_OPT
12689 default 0x80000000 if VMSPLIT_2G
12690- default 0x78000000 if VMSPLIT_2G_OPT
12691+ default 0x70000000 if VMSPLIT_2G_OPT
12692 default 0x40000000 if VMSPLIT_1G
12693 default 0xC0000000
12694 depends on X86_32
12695@@ -1457,7 +1457,7 @@ config ARCH_USES_PG_UNCACHED
12696
12697 config EFI
12698 bool "EFI runtime service support"
12699- depends on ACPI
12700+ depends on ACPI && !PAX_KERNEXEC
12701 ---help---
12702 This enables the kernel to use EFI runtime services that are
12703 available (such as the EFI variable services).
12704@@ -1487,6 +1487,7 @@ config SECCOMP
12705
12706 config CC_STACKPROTECTOR
12707 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
12708+ depends on X86_64 || !PAX_MEMORY_UDEREF
12709 ---help---
12710 This option turns on the -fstack-protector GCC feature. This
12711 feature puts, at the beginning of functions, a canary value on
12712@@ -1544,6 +1545,7 @@ config KEXEC_JUMP
12713 config PHYSICAL_START
12714 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
12715 default "0x1000000"
12716+ range 0x400000 0x40000000
12717 ---help---
12718 This gives the physical address where the kernel is loaded.
12719
12720@@ -1607,6 +1609,7 @@ config X86_NEED_RELOCS
12721 config PHYSICAL_ALIGN
12722 hex "Alignment value to which kernel should be aligned" if X86_32
12723 default "0x1000000"
12724+ range 0x400000 0x1000000 if PAX_KERNEXEC
12725 range 0x2000 0x1000000
12726 ---help---
12727 This value puts the alignment restrictions on physical address
12728@@ -1638,9 +1641,10 @@ config HOTPLUG_CPU
12729 Say N if you want to disable CPU hotplug.
12730
12731 config COMPAT_VDSO
12732- def_bool y
12733+ def_bool n
12734 prompt "Compat VDSO support"
12735 depends on X86_32 || IA32_EMULATION
12736+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
12737 ---help---
12738 Map the 32-bit VDSO to the predictable old-style address too.
12739
12740diff -urNp linux-2.6.39.2/arch/x86/Kconfig.cpu linux-2.6.39.2/arch/x86/Kconfig.cpu
12741--- linux-2.6.39.2/arch/x86/Kconfig.cpu 2011-05-19 00:06:34.000000000 -0400
12742+++ linux-2.6.39.2/arch/x86/Kconfig.cpu 2011-05-22 19:36:30.000000000 -0400
12743@@ -334,7 +334,7 @@ config X86_PPRO_FENCE
12744
12745 config X86_F00F_BUG
12746 def_bool y
12747- depends on M586MMX || M586TSC || M586 || M486 || M386
12748+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
12749
12750 config X86_INVD_BUG
12751 def_bool y
12752@@ -358,7 +358,7 @@ config X86_POPAD_OK
12753
12754 config X86_ALIGNMENT_16
12755 def_bool y
12756- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12757+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12758
12759 config X86_INTEL_USERCOPY
12760 def_bool y
12761@@ -404,7 +404,7 @@ config X86_CMPXCHG64
12762 # generates cmov.
12763 config X86_CMOV
12764 def_bool y
12765- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12766+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12767
12768 config X86_MINIMUM_CPU_FAMILY
12769 int
12770diff -urNp linux-2.6.39.2/arch/x86/Kconfig.debug linux-2.6.39.2/arch/x86/Kconfig.debug
12771--- linux-2.6.39.2/arch/x86/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
12772+++ linux-2.6.39.2/arch/x86/Kconfig.debug 2011-05-22 19:36:30.000000000 -0400
12773@@ -101,7 +101,7 @@ config X86_PTDUMP
12774 config DEBUG_RODATA
12775 bool "Write protect kernel read-only data structures"
12776 default y
12777- depends on DEBUG_KERNEL
12778+ depends on DEBUG_KERNEL && BROKEN
12779 ---help---
12780 Mark the kernel read-only data as write-protected in the pagetables,
12781 in order to catch accidental (and incorrect) writes to such const
12782@@ -119,7 +119,7 @@ config DEBUG_RODATA_TEST
12783
12784 config DEBUG_SET_MODULE_RONX
12785 bool "Set loadable kernel module data as NX and text as RO"
12786- depends on MODULES
12787+ depends on MODULES && BROKEN
12788 ---help---
12789 This option helps catch unintended modifications to loadable
12790 kernel module's text and read-only data. It also prevents execution
12791diff -urNp linux-2.6.39.2/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.39.2/arch/x86/kernel/acpi/realmode/wakeup.S
12792--- linux-2.6.39.2/arch/x86/kernel/acpi/realmode/wakeup.S 2011-05-19 00:06:34.000000000 -0400
12793+++ linux-2.6.39.2/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-01 18:27:29.000000000 -0400
12794@@ -94,6 +94,9 @@ wakeup_code:
12795 /* Do any other stuff... */
12796
12797 #ifndef CONFIG_64BIT
12798+ /* Recheck NX bit overrides (64bit path does this in trampoline */
12799+ call verify_cpu
12800+
12801 /* This could also be done in C code... */
12802 movl pmode_cr3, %eax
12803 movl %eax, %cr3
12804@@ -117,6 +120,7 @@ wakeup_code:
12805 movl pmode_cr0, %eax
12806 movl %eax, %cr0
12807 jmp pmode_return
12808+# include "../../verify_cpu.S"
12809 #else
12810 pushw $0
12811 pushw trampoline_segment
12812diff -urNp linux-2.6.39.2/arch/x86/kernel/acpi/sleep.c linux-2.6.39.2/arch/x86/kernel/acpi/sleep.c
12813--- linux-2.6.39.2/arch/x86/kernel/acpi/sleep.c 2011-05-19 00:06:34.000000000 -0400
12814+++ linux-2.6.39.2/arch/x86/kernel/acpi/sleep.c 2011-05-22 19:36:30.000000000 -0400
12815@@ -88,8 +88,12 @@ int acpi_suspend_lowlevel(void)
12816 header->trampoline_segment = trampoline_address() >> 4;
12817 #ifdef CONFIG_SMP
12818 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
12819+
12820+ pax_open_kernel();
12821 early_gdt_descr.address =
12822 (unsigned long)get_cpu_gdt_table(smp_processor_id());
12823+ pax_close_kernel();
12824+
12825 initial_gs = per_cpu_offset(smp_processor_id());
12826 #endif
12827 initial_code = (unsigned long)wakeup_long64;
12828diff -urNp linux-2.6.39.2/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.39.2/arch/x86/kernel/acpi/wakeup_32.S
12829--- linux-2.6.39.2/arch/x86/kernel/acpi/wakeup_32.S 2011-05-19 00:06:34.000000000 -0400
12830+++ linux-2.6.39.2/arch/x86/kernel/acpi/wakeup_32.S 2011-05-22 19:36:30.000000000 -0400
12831@@ -30,13 +30,11 @@ wakeup_pmode_return:
12832 # and restore the stack ... but you need gdt for this to work
12833 movl saved_context_esp, %esp
12834
12835- movl %cs:saved_magic, %eax
12836- cmpl $0x12345678, %eax
12837+ cmpl $0x12345678, saved_magic
12838 jne bogus_magic
12839
12840 # jump to place where we left off
12841- movl saved_eip, %eax
12842- jmp *%eax
12843+ jmp *(saved_eip)
12844
12845 bogus_magic:
12846 jmp bogus_magic
12847diff -urNp linux-2.6.39.2/arch/x86/kernel/alternative.c linux-2.6.39.2/arch/x86/kernel/alternative.c
12848--- linux-2.6.39.2/arch/x86/kernel/alternative.c 2011-05-19 00:06:34.000000000 -0400
12849+++ linux-2.6.39.2/arch/x86/kernel/alternative.c 2011-05-22 19:36:30.000000000 -0400
12850@@ -248,7 +248,7 @@ static void alternatives_smp_lock(const
12851 if (!*poff || ptr < text || ptr >= text_end)
12852 continue;
12853 /* turn DS segment override prefix into lock prefix */
12854- if (*ptr == 0x3e)
12855+ if (*ktla_ktva(ptr) == 0x3e)
12856 text_poke(ptr, ((unsigned char []){0xf0}), 1);
12857 };
12858 mutex_unlock(&text_mutex);
12859@@ -269,7 +269,7 @@ static void alternatives_smp_unlock(cons
12860 if (!*poff || ptr < text || ptr >= text_end)
12861 continue;
12862 /* turn lock prefix into DS segment override prefix */
12863- if (*ptr == 0xf0)
12864+ if (*ktla_ktva(ptr) == 0xf0)
12865 text_poke(ptr, ((unsigned char []){0x3E}), 1);
12866 };
12867 mutex_unlock(&text_mutex);
12868@@ -438,7 +438,7 @@ void __init_or_module apply_paravirt(str
12869
12870 BUG_ON(p->len > MAX_PATCH_LEN);
12871 /* prep the buffer with the original instructions */
12872- memcpy(insnbuf, p->instr, p->len);
12873+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
12874 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
12875 (unsigned long)p->instr, p->len);
12876
12877@@ -506,7 +506,7 @@ void __init alternative_instructions(voi
12878 if (smp_alt_once)
12879 free_init_pages("SMP alternatives",
12880 (unsigned long)__smp_locks,
12881- (unsigned long)__smp_locks_end);
12882+ PAGE_ALIGN((unsigned long)__smp_locks_end));
12883
12884 restart_nmi();
12885 }
12886@@ -523,13 +523,17 @@ void __init alternative_instructions(voi
12887 * instructions. And on the local CPU you need to be protected again NMI or MCE
12888 * handlers seeing an inconsistent instruction while you patch.
12889 */
12890-void *__init_or_module text_poke_early(void *addr, const void *opcode,
12891+void *__kprobes text_poke_early(void *addr, const void *opcode,
12892 size_t len)
12893 {
12894 unsigned long flags;
12895 local_irq_save(flags);
12896- memcpy(addr, opcode, len);
12897+
12898+ pax_open_kernel();
12899+ memcpy(ktla_ktva(addr), opcode, len);
12900 sync_core();
12901+ pax_close_kernel();
12902+
12903 local_irq_restore(flags);
12904 /* Could also do a CLFLUSH here to speed up CPU recovery; but
12905 that causes hangs on some VIA CPUs. */
12906@@ -551,36 +555,22 @@ void *__init_or_module text_poke_early(v
12907 */
12908 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
12909 {
12910- unsigned long flags;
12911- char *vaddr;
12912+ unsigned char *vaddr = ktla_ktva(addr);
12913 struct page *pages[2];
12914- int i;
12915+ size_t i;
12916
12917 if (!core_kernel_text((unsigned long)addr)) {
12918- pages[0] = vmalloc_to_page(addr);
12919- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
12920+ pages[0] = vmalloc_to_page(vaddr);
12921+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
12922 } else {
12923- pages[0] = virt_to_page(addr);
12924+ pages[0] = virt_to_page(vaddr);
12925 WARN_ON(!PageReserved(pages[0]));
12926- pages[1] = virt_to_page(addr + PAGE_SIZE);
12927+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
12928 }
12929 BUG_ON(!pages[0]);
12930- local_irq_save(flags);
12931- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
12932- if (pages[1])
12933- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
12934- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
12935- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
12936- clear_fixmap(FIX_TEXT_POKE0);
12937- if (pages[1])
12938- clear_fixmap(FIX_TEXT_POKE1);
12939- local_flush_tlb();
12940- sync_core();
12941- /* Could also do a CLFLUSH here to speed up CPU recovery; but
12942- that causes hangs on some VIA CPUs. */
12943+ text_poke_early(addr, opcode, len);
12944 for (i = 0; i < len; i++)
12945- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
12946- local_irq_restore(flags);
12947+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
12948 return addr;
12949 }
12950
12951@@ -682,9 +672,9 @@ void __kprobes text_poke_smp_batch(struc
12952 #if defined(CONFIG_DYNAMIC_FTRACE) || defined(HAVE_JUMP_LABEL)
12953
12954 #ifdef CONFIG_X86_64
12955-unsigned char ideal_nop5[5] = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12956+unsigned char ideal_nop5[5] __read_only = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12957 #else
12958-unsigned char ideal_nop5[5] = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12959+unsigned char ideal_nop5[5] __read_only = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12960 #endif
12961
12962 void __init arch_init_ideal_nop5(void)
12963diff -urNp linux-2.6.39.2/arch/x86/kernel/amd_iommu.c linux-2.6.39.2/arch/x86/kernel/amd_iommu.c
12964--- linux-2.6.39.2/arch/x86/kernel/amd_iommu.c 2011-06-25 12:55:22.000000000 -0400
12965+++ linux-2.6.39.2/arch/x86/kernel/amd_iommu.c 2011-06-25 13:00:25.000000000 -0400
12966@@ -49,7 +49,7 @@ static DEFINE_SPINLOCK(iommu_pd_list_loc
12967 */
12968 static struct protection_domain *pt_domain;
12969
12970-static struct iommu_ops amd_iommu_ops;
12971+static const struct iommu_ops amd_iommu_ops;
12972
12973 /*
12974 * general struct to manage commands send to an IOMMU
12975@@ -2307,7 +2307,7 @@ static void prealloc_protection_domains(
12976 }
12977 }
12978
12979-static struct dma_map_ops amd_iommu_dma_ops = {
12980+static const struct dma_map_ops amd_iommu_dma_ops = {
12981 .alloc_coherent = alloc_coherent,
12982 .free_coherent = free_coherent,
12983 .map_page = map_page,
12984@@ -2624,7 +2624,7 @@ static int amd_iommu_domain_has_cap(stru
12985 return 0;
12986 }
12987
12988-static struct iommu_ops amd_iommu_ops = {
12989+static const struct iommu_ops amd_iommu_ops = {
12990 .domain_init = amd_iommu_domain_init,
12991 .domain_destroy = amd_iommu_domain_destroy,
12992 .attach_dev = amd_iommu_attach_device,
12993diff -urNp linux-2.6.39.2/arch/x86/kernel/apic/apic.c linux-2.6.39.2/arch/x86/kernel/apic/apic.c
12994--- linux-2.6.39.2/arch/x86/kernel/apic/apic.c 2011-05-19 00:06:34.000000000 -0400
12995+++ linux-2.6.39.2/arch/x86/kernel/apic/apic.c 2011-05-22 19:36:30.000000000 -0400
12996@@ -1821,7 +1821,7 @@ void smp_error_interrupt(struct pt_regs
12997 apic_write(APIC_ESR, 0);
12998 v1 = apic_read(APIC_ESR);
12999 ack_APIC_irq();
13000- atomic_inc(&irq_err_count);
13001+ atomic_inc_unchecked(&irq_err_count);
13002
13003 /*
13004 * Here is what the APIC error bits mean:
13005@@ -2204,6 +2204,8 @@ static int __cpuinit apic_cluster_num(vo
13006 u16 *bios_cpu_apicid;
13007 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
13008
13009+ pax_track_stack();
13010+
13011 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
13012 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
13013
13014diff -urNp linux-2.6.39.2/arch/x86/kernel/apic/io_apic.c linux-2.6.39.2/arch/x86/kernel/apic/io_apic.c
13015--- linux-2.6.39.2/arch/x86/kernel/apic/io_apic.c 2011-06-03 00:04:13.000000000 -0400
13016+++ linux-2.6.39.2/arch/x86/kernel/apic/io_apic.c 2011-06-03 00:42:37.000000000 -0400
13017@@ -623,7 +623,7 @@ struct IO_APIC_route_entry **alloc_ioapi
13018 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
13019 GFP_ATOMIC);
13020 if (!ioapic_entries)
13021- return 0;
13022+ return NULL;
13023
13024 for (apic = 0; apic < nr_ioapics; apic++) {
13025 ioapic_entries[apic] =
13026@@ -640,7 +640,7 @@ nomem:
13027 kfree(ioapic_entries[apic]);
13028 kfree(ioapic_entries);
13029
13030- return 0;
13031+ return NULL;
13032 }
13033
13034 /*
13035@@ -1040,7 +1040,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
13036 }
13037 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
13038
13039-void lock_vector_lock(void)
13040+void lock_vector_lock(void) __acquires(vector_lock)
13041 {
13042 /* Used to the online set of cpus does not change
13043 * during assign_irq_vector.
13044@@ -1048,7 +1048,7 @@ void lock_vector_lock(void)
13045 raw_spin_lock(&vector_lock);
13046 }
13047
13048-void unlock_vector_lock(void)
13049+void unlock_vector_lock(void) __releases(vector_lock)
13050 {
13051 raw_spin_unlock(&vector_lock);
13052 }
13053@@ -2379,7 +2379,7 @@ static void ack_apic_edge(struct irq_dat
13054 ack_APIC_irq();
13055 }
13056
13057-atomic_t irq_mis_count;
13058+atomic_unchecked_t irq_mis_count;
13059
13060 /*
13061 * IO-APIC versions below 0x20 don't support EOI register.
13062@@ -2487,7 +2487,7 @@ static void ack_apic_level(struct irq_da
13063 * at the cpu.
13064 */
13065 if (!(v & (1 << (i & 0x1f)))) {
13066- atomic_inc(&irq_mis_count);
13067+ atomic_inc_unchecked(&irq_mis_count);
13068
13069 eoi_ioapic_irq(irq, cfg);
13070 }
13071diff -urNp linux-2.6.39.2/arch/x86/kernel/apm_32.c linux-2.6.39.2/arch/x86/kernel/apm_32.c
13072--- linux-2.6.39.2/arch/x86/kernel/apm_32.c 2011-05-19 00:06:34.000000000 -0400
13073+++ linux-2.6.39.2/arch/x86/kernel/apm_32.c 2011-05-22 19:36:30.000000000 -0400
13074@@ -412,7 +412,7 @@ static DEFINE_MUTEX(apm_mutex);
13075 * This is for buggy BIOS's that refer to (real mode) segment 0x40
13076 * even though they are called in protected mode.
13077 */
13078-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
13079+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
13080 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
13081
13082 static const char driver_version[] = "1.16ac"; /* no spaces */
13083@@ -590,7 +590,10 @@ static long __apm_bios_call(void *_call)
13084 BUG_ON(cpu != 0);
13085 gdt = get_cpu_gdt_table(cpu);
13086 save_desc_40 = gdt[0x40 / 8];
13087+
13088+ pax_open_kernel();
13089 gdt[0x40 / 8] = bad_bios_desc;
13090+ pax_close_kernel();
13091
13092 apm_irq_save(flags);
13093 APM_DO_SAVE_SEGS;
13094@@ -599,7 +602,11 @@ static long __apm_bios_call(void *_call)
13095 &call->esi);
13096 APM_DO_RESTORE_SEGS;
13097 apm_irq_restore(flags);
13098+
13099+ pax_open_kernel();
13100 gdt[0x40 / 8] = save_desc_40;
13101+ pax_close_kernel();
13102+
13103 put_cpu();
13104
13105 return call->eax & 0xff;
13106@@ -666,7 +673,10 @@ static long __apm_bios_call_simple(void
13107 BUG_ON(cpu != 0);
13108 gdt = get_cpu_gdt_table(cpu);
13109 save_desc_40 = gdt[0x40 / 8];
13110+
13111+ pax_open_kernel();
13112 gdt[0x40 / 8] = bad_bios_desc;
13113+ pax_close_kernel();
13114
13115 apm_irq_save(flags);
13116 APM_DO_SAVE_SEGS;
13117@@ -674,7 +684,11 @@ static long __apm_bios_call_simple(void
13118 &call->eax);
13119 APM_DO_RESTORE_SEGS;
13120 apm_irq_restore(flags);
13121+
13122+ pax_open_kernel();
13123 gdt[0x40 / 8] = save_desc_40;
13124+ pax_close_kernel();
13125+
13126 put_cpu();
13127 return error;
13128 }
13129@@ -2351,12 +2365,15 @@ static int __init apm_init(void)
13130 * code to that CPU.
13131 */
13132 gdt = get_cpu_gdt_table(0);
13133+
13134+ pax_open_kernel();
13135 set_desc_base(&gdt[APM_CS >> 3],
13136 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
13137 set_desc_base(&gdt[APM_CS_16 >> 3],
13138 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
13139 set_desc_base(&gdt[APM_DS >> 3],
13140 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
13141+ pax_close_kernel();
13142
13143 proc_create("apm", 0, NULL, &apm_file_ops);
13144
13145diff -urNp linux-2.6.39.2/arch/x86/kernel/asm-offsets_64.c linux-2.6.39.2/arch/x86/kernel/asm-offsets_64.c
13146--- linux-2.6.39.2/arch/x86/kernel/asm-offsets_64.c 2011-05-19 00:06:34.000000000 -0400
13147+++ linux-2.6.39.2/arch/x86/kernel/asm-offsets_64.c 2011-05-22 19:36:30.000000000 -0400
13148@@ -69,6 +69,7 @@ int main(void)
13149 BLANK();
13150 #undef ENTRY
13151
13152+ DEFINE(TSS_size, sizeof(struct tss_struct));
13153 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
13154 BLANK();
13155
13156diff -urNp linux-2.6.39.2/arch/x86/kernel/asm-offsets.c linux-2.6.39.2/arch/x86/kernel/asm-offsets.c
13157--- linux-2.6.39.2/arch/x86/kernel/asm-offsets.c 2011-05-19 00:06:34.000000000 -0400
13158+++ linux-2.6.39.2/arch/x86/kernel/asm-offsets.c 2011-05-25 17:35:48.000000000 -0400
13159@@ -33,6 +33,8 @@ void common(void) {
13160 OFFSET(TI_status, thread_info, status);
13161 OFFSET(TI_addr_limit, thread_info, addr_limit);
13162 OFFSET(TI_preempt_count, thread_info, preempt_count);
13163+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
13164+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
13165
13166 BLANK();
13167 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
13168@@ -53,8 +55,26 @@ void common(void) {
13169 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
13170 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
13171 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
13172+
13173+#ifdef CONFIG_PAX_KERNEXEC
13174+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
13175+#endif
13176+
13177+#ifdef CONFIG_PAX_MEMORY_UDEREF
13178+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
13179+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
13180+#ifdef CONFIG_X86_64
13181+ OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
13182+#endif
13183 #endif
13184
13185+#endif
13186+
13187+ BLANK();
13188+ DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
13189+ DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
13190+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
13191+
13192 #ifdef CONFIG_XEN
13193 BLANK();
13194 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
13195diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/amd.c linux-2.6.39.2/arch/x86/kernel/cpu/amd.c
13196--- linux-2.6.39.2/arch/x86/kernel/cpu/amd.c 2011-06-03 00:04:13.000000000 -0400
13197+++ linux-2.6.39.2/arch/x86/kernel/cpu/amd.c 2011-06-03 00:32:04.000000000 -0400
13198@@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_c
13199 unsigned int size)
13200 {
13201 /* AMD errata T13 (order #21922) */
13202- if ((c->x86 == 6)) {
13203+ if (c->x86 == 6) {
13204 /* Duron Rev A0 */
13205 if (c->x86_model == 3 && c->x86_mask == 0)
13206 size = 64;
13207diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/common.c linux-2.6.39.2/arch/x86/kernel/cpu/common.c
13208--- linux-2.6.39.2/arch/x86/kernel/cpu/common.c 2011-06-03 00:04:13.000000000 -0400
13209+++ linux-2.6.39.2/arch/x86/kernel/cpu/common.c 2011-06-03 00:32:04.000000000 -0400
13210@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
13211
13212 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
13213
13214-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
13215-#ifdef CONFIG_X86_64
13216- /*
13217- * We need valid kernel segments for data and code in long mode too
13218- * IRET will check the segment types kkeil 2000/10/28
13219- * Also sysret mandates a special GDT layout
13220- *
13221- * TLS descriptors are currently at a different place compared to i386.
13222- * Hopefully nobody expects them at a fixed place (Wine?)
13223- */
13224- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
13225- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
13226- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
13227- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
13228- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
13229- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
13230-#else
13231- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
13232- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
13233- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
13234- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
13235- /*
13236- * Segments used for calling PnP BIOS have byte granularity.
13237- * They code segments and data segments have fixed 64k limits,
13238- * the transfer segment sizes are set at run time.
13239- */
13240- /* 32-bit code */
13241- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
13242- /* 16-bit code */
13243- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
13244- /* 16-bit data */
13245- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
13246- /* 16-bit data */
13247- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
13248- /* 16-bit data */
13249- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
13250- /*
13251- * The APM segments have byte granularity and their bases
13252- * are set at run time. All have 64k limits.
13253- */
13254- /* 32-bit code */
13255- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
13256- /* 16-bit code */
13257- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
13258- /* data */
13259- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
13260-
13261- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
13262- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
13263- GDT_STACK_CANARY_INIT
13264-#endif
13265-} };
13266-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
13267-
13268 static int __init x86_xsave_setup(char *s)
13269 {
13270 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
13271@@ -352,7 +298,7 @@ void switch_to_new_gdt(int cpu)
13272 {
13273 struct desc_ptr gdt_descr;
13274
13275- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
13276+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
13277 gdt_descr.size = GDT_SIZE - 1;
13278 load_gdt(&gdt_descr);
13279 /* Reload the per-cpu base */
13280@@ -824,6 +770,10 @@ static void __cpuinit identify_cpu(struc
13281 /* Filter out anything that depends on CPUID levels we don't have */
13282 filter_cpuid_features(c, true);
13283
13284+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
13285+ setup_clear_cpu_cap(X86_FEATURE_SEP);
13286+#endif
13287+
13288 /* If the model name is still unset, do table lookup. */
13289 if (!c->x86_model_id[0]) {
13290 const char *p;
13291@@ -1003,6 +953,9 @@ static __init int setup_disablecpuid(cha
13292 }
13293 __setup("clearcpuid=", setup_disablecpuid);
13294
13295+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
13296+EXPORT_PER_CPU_SYMBOL(current_tinfo);
13297+
13298 #ifdef CONFIG_X86_64
13299 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
13300
13301@@ -1018,7 +971,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
13302 EXPORT_PER_CPU_SYMBOL(current_task);
13303
13304 DEFINE_PER_CPU(unsigned long, kernel_stack) =
13305- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
13306+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
13307 EXPORT_PER_CPU_SYMBOL(kernel_stack);
13308
13309 DEFINE_PER_CPU(char *, irq_stack_ptr) =
13310@@ -1083,7 +1036,7 @@ struct pt_regs * __cpuinit idle_regs(str
13311 {
13312 memset(regs, 0, sizeof(struct pt_regs));
13313 regs->fs = __KERNEL_PERCPU;
13314- regs->gs = __KERNEL_STACK_CANARY;
13315+ savesegment(gs, regs->gs);
13316
13317 return regs;
13318 }
13319@@ -1138,7 +1091,7 @@ void __cpuinit cpu_init(void)
13320 int i;
13321
13322 cpu = stack_smp_processor_id();
13323- t = &per_cpu(init_tss, cpu);
13324+ t = init_tss + cpu;
13325 oist = &per_cpu(orig_ist, cpu);
13326
13327 #ifdef CONFIG_NUMA
13328@@ -1164,7 +1117,7 @@ void __cpuinit cpu_init(void)
13329 switch_to_new_gdt(cpu);
13330 loadsegment(fs, 0);
13331
13332- load_idt((const struct desc_ptr *)&idt_descr);
13333+ load_idt(&idt_descr);
13334
13335 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
13336 syscall_init();
13337@@ -1173,7 +1126,6 @@ void __cpuinit cpu_init(void)
13338 wrmsrl(MSR_KERNEL_GS_BASE, 0);
13339 barrier();
13340
13341- x86_configure_nx();
13342 if (cpu != 0)
13343 enable_x2apic();
13344
13345@@ -1227,7 +1179,7 @@ void __cpuinit cpu_init(void)
13346 {
13347 int cpu = smp_processor_id();
13348 struct task_struct *curr = current;
13349- struct tss_struct *t = &per_cpu(init_tss, cpu);
13350+ struct tss_struct *t = init_tss + cpu;
13351 struct thread_struct *thread = &curr->thread;
13352
13353 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
13354diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/intel.c linux-2.6.39.2/arch/x86/kernel/cpu/intel.c
13355--- linux-2.6.39.2/arch/x86/kernel/cpu/intel.c 2011-05-19 00:06:34.000000000 -0400
13356+++ linux-2.6.39.2/arch/x86/kernel/cpu/intel.c 2011-05-22 19:36:30.000000000 -0400
13357@@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
13358 * Update the IDT descriptor and reload the IDT so that
13359 * it uses the read-only mapped virtual address.
13360 */
13361- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
13362+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
13363 load_idt(&idt_descr);
13364 }
13365 #endif
13366diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/Makefile linux-2.6.39.2/arch/x86/kernel/cpu/Makefile
13367--- linux-2.6.39.2/arch/x86/kernel/cpu/Makefile 2011-05-19 00:06:34.000000000 -0400
13368+++ linux-2.6.39.2/arch/x86/kernel/cpu/Makefile 2011-05-22 19:36:30.000000000 -0400
13369@@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
13370 CFLAGS_REMOVE_perf_event.o = -pg
13371 endif
13372
13373-# Make sure load_percpu_segment has no stackprotector
13374-nostackp := $(call cc-option, -fno-stack-protector)
13375-CFLAGS_common.o := $(nostackp)
13376-
13377 obj-y := intel_cacheinfo.o scattered.o topology.o
13378 obj-y += proc.o capflags.o powerflags.o common.o
13379 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
13380diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.39.2/arch/x86/kernel/cpu/mcheck/mce.c
13381--- linux-2.6.39.2/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-19 00:06:34.000000000 -0400
13382+++ linux-2.6.39.2/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-22 19:36:30.000000000 -0400
13383@@ -46,6 +46,7 @@
13384 #include <asm/ipi.h>
13385 #include <asm/mce.h>
13386 #include <asm/msr.h>
13387+#include <asm/local.h>
13388
13389 #include "mce-internal.h"
13390
13391@@ -220,7 +221,7 @@ static void print_mce(struct mce *m)
13392 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
13393 m->cs, m->ip);
13394
13395- if (m->cs == __KERNEL_CS)
13396+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
13397 print_symbol("{%s}", m->ip);
13398 pr_cont("\n");
13399 }
13400@@ -244,10 +245,10 @@ static void print_mce(struct mce *m)
13401
13402 #define PANIC_TIMEOUT 5 /* 5 seconds */
13403
13404-static atomic_t mce_paniced;
13405+static atomic_unchecked_t mce_paniced;
13406
13407 static int fake_panic;
13408-static atomic_t mce_fake_paniced;
13409+static atomic_unchecked_t mce_fake_paniced;
13410
13411 /* Panic in progress. Enable interrupts and wait for final IPI */
13412 static void wait_for_panic(void)
13413@@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct
13414 /*
13415 * Make sure only one CPU runs in machine check panic
13416 */
13417- if (atomic_inc_return(&mce_paniced) > 1)
13418+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
13419 wait_for_panic();
13420 barrier();
13421
13422@@ -279,7 +280,7 @@ static void mce_panic(char *msg, struct
13423 console_verbose();
13424 } else {
13425 /* Don't log too much for fake panic */
13426- if (atomic_inc_return(&mce_fake_paniced) > 1)
13427+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
13428 return;
13429 }
13430 /* First print corrected ones that are still unlogged */
13431@@ -647,7 +648,7 @@ static int mce_timed_out(u64 *t)
13432 * might have been modified by someone else.
13433 */
13434 rmb();
13435- if (atomic_read(&mce_paniced))
13436+ if (atomic_read_unchecked(&mce_paniced))
13437 wait_for_panic();
13438 if (!monarch_timeout)
13439 goto out;
13440@@ -1461,14 +1462,14 @@ void __cpuinit mcheck_cpu_init(struct cp
13441 */
13442
13443 static DEFINE_SPINLOCK(mce_state_lock);
13444-static int open_count; /* #times opened */
13445+static local_t open_count; /* #times opened */
13446 static int open_exclu; /* already open exclusive? */
13447
13448 static int mce_open(struct inode *inode, struct file *file)
13449 {
13450 spin_lock(&mce_state_lock);
13451
13452- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
13453+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
13454 spin_unlock(&mce_state_lock);
13455
13456 return -EBUSY;
13457@@ -1476,7 +1477,7 @@ static int mce_open(struct inode *inode,
13458
13459 if (file->f_flags & O_EXCL)
13460 open_exclu = 1;
13461- open_count++;
13462+ local_inc(&open_count);
13463
13464 spin_unlock(&mce_state_lock);
13465
13466@@ -1487,7 +1488,7 @@ static int mce_release(struct inode *ino
13467 {
13468 spin_lock(&mce_state_lock);
13469
13470- open_count--;
13471+ local_dec(&open_count);
13472 open_exclu = 0;
13473
13474 spin_unlock(&mce_state_lock);
13475@@ -2174,7 +2175,7 @@ struct dentry *mce_get_debugfs_dir(void)
13476 static void mce_reset(void)
13477 {
13478 cpu_missing = 0;
13479- atomic_set(&mce_fake_paniced, 0);
13480+ atomic_set_unchecked(&mce_fake_paniced, 0);
13481 atomic_set(&mce_executing, 0);
13482 atomic_set(&mce_callin, 0);
13483 atomic_set(&global_nwo, 0);
13484diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/main.c
13485--- linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/main.c 2011-05-19 00:06:34.000000000 -0400
13486+++ linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/main.c 2011-05-22 19:36:30.000000000 -0400
13487@@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
13488 u64 size_or_mask, size_and_mask;
13489 static bool mtrr_aps_delayed_init;
13490
13491-static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
13492+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
13493
13494 const struct mtrr_ops *mtrr_if;
13495
13496diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/mtrr.h
13497--- linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-19 00:06:34.000000000 -0400
13498+++ linux-2.6.39.2/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-22 19:36:30.000000000 -0400
13499@@ -12,19 +12,19 @@
13500 extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
13501
13502 struct mtrr_ops {
13503- u32 vendor;
13504- u32 use_intel_if;
13505- void (*set)(unsigned int reg, unsigned long base,
13506+ const u32 vendor;
13507+ const u32 use_intel_if;
13508+ void (* const set)(unsigned int reg, unsigned long base,
13509 unsigned long size, mtrr_type type);
13510- void (*set_all)(void);
13511+ void (* const set_all)(void);
13512
13513- void (*get)(unsigned int reg, unsigned long *base,
13514+ void (* const get)(unsigned int reg, unsigned long *base,
13515 unsigned long *size, mtrr_type *type);
13516- int (*get_free_region)(unsigned long base, unsigned long size,
13517+ int (* const get_free_region)(unsigned long base, unsigned long size,
13518 int replace_reg);
13519- int (*validate_add_page)(unsigned long base, unsigned long size,
13520+ int (* const validate_add_page)(unsigned long base, unsigned long size,
13521 unsigned int type);
13522- int (*have_wrcomb)(void);
13523+ int (* const have_wrcomb)(void);
13524 };
13525
13526 extern int generic_get_free_region(unsigned long base, unsigned long size,
13527diff -urNp linux-2.6.39.2/arch/x86/kernel/cpu/perf_event.c linux-2.6.39.2/arch/x86/kernel/cpu/perf_event.c
13528--- linux-2.6.39.2/arch/x86/kernel/cpu/perf_event.c 2011-05-19 00:06:34.000000000 -0400
13529+++ linux-2.6.39.2/arch/x86/kernel/cpu/perf_event.c 2011-05-22 19:36:30.000000000 -0400
13530@@ -774,6 +774,8 @@ static int x86_schedule_events(struct cp
13531 int i, j, w, wmax, num = 0;
13532 struct hw_perf_event *hwc;
13533
13534+ pax_track_stack();
13535+
13536 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
13537
13538 for (i = 0; i < n; i++) {
13539@@ -1878,7 +1880,7 @@ perf_callchain_user(struct perf_callchai
13540 break;
13541
13542 perf_callchain_store(entry, frame.return_address);
13543- fp = frame.next_frame;
13544+ fp = (__force const void __user *)frame.next_frame;
13545 }
13546 }
13547
13548diff -urNp linux-2.6.39.2/arch/x86/kernel/crash.c linux-2.6.39.2/arch/x86/kernel/crash.c
13549--- linux-2.6.39.2/arch/x86/kernel/crash.c 2011-05-19 00:06:34.000000000 -0400
13550+++ linux-2.6.39.2/arch/x86/kernel/crash.c 2011-05-22 19:36:30.000000000 -0400
13551@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu,
13552 regs = args->regs;
13553
13554 #ifdef CONFIG_X86_32
13555- if (!user_mode_vm(regs)) {
13556+ if (!user_mode(regs)) {
13557 crash_fixup_ss_esp(&fixed_regs, regs);
13558 regs = &fixed_regs;
13559 }
13560diff -urNp linux-2.6.39.2/arch/x86/kernel/doublefault_32.c linux-2.6.39.2/arch/x86/kernel/doublefault_32.c
13561--- linux-2.6.39.2/arch/x86/kernel/doublefault_32.c 2011-05-19 00:06:34.000000000 -0400
13562+++ linux-2.6.39.2/arch/x86/kernel/doublefault_32.c 2011-05-22 19:36:30.000000000 -0400
13563@@ -11,7 +11,7 @@
13564
13565 #define DOUBLEFAULT_STACKSIZE (1024)
13566 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
13567-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
13568+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
13569
13570 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
13571
13572@@ -21,7 +21,7 @@ static void doublefault_fn(void)
13573 unsigned long gdt, tss;
13574
13575 store_gdt(&gdt_desc);
13576- gdt = gdt_desc.address;
13577+ gdt = (unsigned long)gdt_desc.address;
13578
13579 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
13580
13581@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
13582 /* 0x2 bit is always set */
13583 .flags = X86_EFLAGS_SF | 0x2,
13584 .sp = STACK_START,
13585- .es = __USER_DS,
13586+ .es = __KERNEL_DS,
13587 .cs = __KERNEL_CS,
13588 .ss = __KERNEL_DS,
13589- .ds = __USER_DS,
13590+ .ds = __KERNEL_DS,
13591 .fs = __KERNEL_PERCPU,
13592
13593 .__cr3 = __pa_nodebug(swapper_pg_dir),
13594diff -urNp linux-2.6.39.2/arch/x86/kernel/dumpstack_32.c linux-2.6.39.2/arch/x86/kernel/dumpstack_32.c
13595--- linux-2.6.39.2/arch/x86/kernel/dumpstack_32.c 2011-05-19 00:06:34.000000000 -0400
13596+++ linux-2.6.39.2/arch/x86/kernel/dumpstack_32.c 2011-05-22 19:36:30.000000000 -0400
13597@@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task
13598 bp = stack_frame(task, regs);
13599
13600 for (;;) {
13601- struct thread_info *context;
13602+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13603
13604- context = (struct thread_info *)
13605- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
13606- bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
13607+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13608
13609- stack = (unsigned long *)context->previous_esp;
13610- if (!stack)
13611+ if (stack_start == task_stack_page(task))
13612 break;
13613+ stack = *(unsigned long **)stack_start;
13614 if (ops->stack(data, "IRQ") < 0)
13615 break;
13616 touch_nmi_watchdog();
13617@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs
13618 * When in-kernel, we also print out the stack and code at the
13619 * time of the fault..
13620 */
13621- if (!user_mode_vm(regs)) {
13622+ if (!user_mode(regs)) {
13623 unsigned int code_prologue = code_bytes * 43 / 64;
13624 unsigned int code_len = code_bytes;
13625 unsigned char c;
13626 u8 *ip;
13627+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
13628
13629 printk(KERN_EMERG "Stack:\n");
13630 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
13631
13632 printk(KERN_EMERG "Code: ");
13633
13634- ip = (u8 *)regs->ip - code_prologue;
13635+ ip = (u8 *)regs->ip - code_prologue + cs_base;
13636 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
13637 /* try starting at IP */
13638- ip = (u8 *)regs->ip;
13639+ ip = (u8 *)regs->ip + cs_base;
13640 code_len = code_len - code_prologue + 1;
13641 }
13642 for (i = 0; i < code_len; i++, ip++) {
13643@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs
13644 printk(" Bad EIP value.");
13645 break;
13646 }
13647- if (ip == (u8 *)regs->ip)
13648+ if (ip == (u8 *)regs->ip + cs_base)
13649 printk("<%02x> ", c);
13650 else
13651 printk("%02x ", c);
13652@@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
13653 {
13654 unsigned short ud2;
13655
13656+ ip = ktla_ktva(ip);
13657 if (ip < PAGE_OFFSET)
13658 return 0;
13659 if (probe_kernel_address((unsigned short *)ip, ud2))
13660diff -urNp linux-2.6.39.2/arch/x86/kernel/dumpstack_64.c linux-2.6.39.2/arch/x86/kernel/dumpstack_64.c
13661--- linux-2.6.39.2/arch/x86/kernel/dumpstack_64.c 2011-05-19 00:06:34.000000000 -0400
13662+++ linux-2.6.39.2/arch/x86/kernel/dumpstack_64.c 2011-05-22 19:36:30.000000000 -0400
13663@@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task
13664 unsigned long *irq_stack_end =
13665 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
13666 unsigned used = 0;
13667- struct thread_info *tinfo;
13668 int graph = 0;
13669 unsigned long dummy;
13670+ void *stack_start;
13671
13672 if (!task)
13673 task = current;
13674@@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
13675 * current stack address. If the stacks consist of nested
13676 * exceptions
13677 */
13678- tinfo = task_thread_info(task);
13679 for (;;) {
13680 char *id;
13681 unsigned long *estack_end;
13682+
13683 estack_end = in_exception_stack(cpu, (unsigned long)stack,
13684 &used, &id);
13685
13686@@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
13687 if (ops->stack(data, id) < 0)
13688 break;
13689
13690- bp = ops->walk_stack(tinfo, stack, bp, ops,
13691+ bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
13692 data, estack_end, &graph);
13693 ops->stack(data, "<EOE>");
13694 /*
13695@@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
13696 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
13697 if (ops->stack(data, "IRQ") < 0)
13698 break;
13699- bp = ops->walk_stack(tinfo, stack, bp,
13700+ bp = ops->walk_stack(task, irq_stack, stack, bp,
13701 ops, data, irq_stack_end, &graph);
13702 /*
13703 * We link to the next stack (which would be
13704@@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
13705 /*
13706 * This handles the process stack:
13707 */
13708- bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
13709+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13710+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13711 put_cpu();
13712 }
13713 EXPORT_SYMBOL(dump_trace);
13714diff -urNp linux-2.6.39.2/arch/x86/kernel/dumpstack.c linux-2.6.39.2/arch/x86/kernel/dumpstack.c
13715--- linux-2.6.39.2/arch/x86/kernel/dumpstack.c 2011-05-19 00:06:34.000000000 -0400
13716+++ linux-2.6.39.2/arch/x86/kernel/dumpstack.c 2011-05-22 19:41:32.000000000 -0400
13717@@ -2,6 +2,9 @@
13718 * Copyright (C) 1991, 1992 Linus Torvalds
13719 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
13720 */
13721+#ifdef CONFIG_GRKERNSEC_HIDESYM
13722+#define __INCLUDED_BY_HIDESYM 1
13723+#endif
13724 #include <linux/kallsyms.h>
13725 #include <linux/kprobes.h>
13726 #include <linux/uaccess.h>
13727@@ -35,9 +38,8 @@ void printk_address(unsigned long addres
13728 static void
13729 print_ftrace_graph_addr(unsigned long addr, void *data,
13730 const struct stacktrace_ops *ops,
13731- struct thread_info *tinfo, int *graph)
13732+ struct task_struct *task, int *graph)
13733 {
13734- struct task_struct *task = tinfo->task;
13735 unsigned long ret_addr;
13736 int index = task->curr_ret_stack;
13737
13738@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
13739 static inline void
13740 print_ftrace_graph_addr(unsigned long addr, void *data,
13741 const struct stacktrace_ops *ops,
13742- struct thread_info *tinfo, int *graph)
13743+ struct task_struct *task, int *graph)
13744 { }
13745 #endif
13746
13747@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
13748 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
13749 */
13750
13751-static inline int valid_stack_ptr(struct thread_info *tinfo,
13752- void *p, unsigned int size, void *end)
13753+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
13754 {
13755- void *t = tinfo;
13756 if (end) {
13757 if (p < end && p >= (end-THREAD_SIZE))
13758 return 1;
13759@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
13760 }
13761
13762 unsigned long
13763-print_context_stack(struct thread_info *tinfo,
13764+print_context_stack(struct task_struct *task, void *stack_start,
13765 unsigned long *stack, unsigned long bp,
13766 const struct stacktrace_ops *ops, void *data,
13767 unsigned long *end, int *graph)
13768 {
13769 struct stack_frame *frame = (struct stack_frame *)bp;
13770
13771- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
13772+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
13773 unsigned long addr;
13774
13775 addr = *stack;
13776@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
13777 } else {
13778 ops->address(data, addr, 0);
13779 }
13780- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13781+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13782 }
13783 stack++;
13784 }
13785@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
13786 EXPORT_SYMBOL_GPL(print_context_stack);
13787
13788 unsigned long
13789-print_context_stack_bp(struct thread_info *tinfo,
13790+print_context_stack_bp(struct task_struct *task, void *stack_start,
13791 unsigned long *stack, unsigned long bp,
13792 const struct stacktrace_ops *ops, void *data,
13793 unsigned long *end, int *graph)
13794@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
13795 struct stack_frame *frame = (struct stack_frame *)bp;
13796 unsigned long *ret_addr = &frame->return_address;
13797
13798- while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
13799+ while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
13800 unsigned long addr = *ret_addr;
13801
13802 if (!__kernel_text_address(addr))
13803@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
13804 ops->address(data, addr, 1);
13805 frame = frame->next_frame;
13806 ret_addr = &frame->return_address;
13807- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13808+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13809 }
13810
13811 return (unsigned long)frame;
13812@@ -202,7 +202,7 @@ void dump_stack(void)
13813
13814 bp = stack_frame(current, NULL);
13815 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
13816- current->pid, current->comm, print_tainted(),
13817+ task_pid_nr(current), current->comm, print_tainted(),
13818 init_utsname()->release,
13819 (int)strcspn(init_utsname()->version, " "),
13820 init_utsname()->version);
13821@@ -238,6 +238,8 @@ unsigned __kprobes long oops_begin(void)
13822 }
13823 EXPORT_SYMBOL_GPL(oops_begin);
13824
13825+extern void gr_handle_kernel_exploit(void);
13826+
13827 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13828 {
13829 if (regs && kexec_should_crash(current))
13830@@ -259,7 +261,10 @@ void __kprobes oops_end(unsigned long fl
13831 panic("Fatal exception in interrupt");
13832 if (panic_on_oops)
13833 panic("Fatal exception");
13834- do_exit(signr);
13835+
13836+ gr_handle_kernel_exploit();
13837+
13838+ do_group_exit(signr);
13839 }
13840
13841 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
13842@@ -286,7 +291,7 @@ int __kprobes __die(const char *str, str
13843
13844 show_registers(regs);
13845 #ifdef CONFIG_X86_32
13846- if (user_mode_vm(regs)) {
13847+ if (user_mode(regs)) {
13848 sp = regs->sp;
13849 ss = regs->ss & 0xffff;
13850 } else {
13851@@ -314,7 +319,7 @@ void die(const char *str, struct pt_regs
13852 unsigned long flags = oops_begin();
13853 int sig = SIGSEGV;
13854
13855- if (!user_mode_vm(regs))
13856+ if (!user_mode(regs))
13857 report_bug(regs->ip, regs);
13858
13859 if (__die(str, regs, err))
13860diff -urNp linux-2.6.39.2/arch/x86/kernel/early_printk.c linux-2.6.39.2/arch/x86/kernel/early_printk.c
13861--- linux-2.6.39.2/arch/x86/kernel/early_printk.c 2011-05-19 00:06:34.000000000 -0400
13862+++ linux-2.6.39.2/arch/x86/kernel/early_printk.c 2011-05-22 19:36:30.000000000 -0400
13863@@ -7,6 +7,7 @@
13864 #include <linux/pci_regs.h>
13865 #include <linux/pci_ids.h>
13866 #include <linux/errno.h>
13867+#include <linux/sched.h>
13868 #include <asm/io.h>
13869 #include <asm/processor.h>
13870 #include <asm/fcntl.h>
13871@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char
13872 int n;
13873 va_list ap;
13874
13875+ pax_track_stack();
13876+
13877 va_start(ap, fmt);
13878 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13879 early_console->write(early_console, buf, n);
13880diff -urNp linux-2.6.39.2/arch/x86/kernel/entry_32.S linux-2.6.39.2/arch/x86/kernel/entry_32.S
13881--- linux-2.6.39.2/arch/x86/kernel/entry_32.S 2011-05-19 00:06:34.000000000 -0400
13882+++ linux-2.6.39.2/arch/x86/kernel/entry_32.S 2011-05-23 17:07:00.000000000 -0400
13883@@ -185,13 +185,146 @@
13884 /*CFI_REL_OFFSET gs, PT_GS*/
13885 .endm
13886 .macro SET_KERNEL_GS reg
13887+
13888+#ifdef CONFIG_CC_STACKPROTECTOR
13889 movl $(__KERNEL_STACK_CANARY), \reg
13890+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13891+ movl $(__USER_DS), \reg
13892+#else
13893+ xorl \reg, \reg
13894+#endif
13895+
13896 movl \reg, %gs
13897 .endm
13898
13899 #endif /* CONFIG_X86_32_LAZY_GS */
13900
13901-.macro SAVE_ALL
13902+.macro pax_enter_kernel
13903+#ifdef CONFIG_PAX_KERNEXEC
13904+ call pax_enter_kernel
13905+#endif
13906+.endm
13907+
13908+.macro pax_exit_kernel
13909+#ifdef CONFIG_PAX_KERNEXEC
13910+ call pax_exit_kernel
13911+#endif
13912+.endm
13913+
13914+#ifdef CONFIG_PAX_KERNEXEC
13915+ENTRY(pax_enter_kernel)
13916+#ifdef CONFIG_PARAVIRT
13917+ pushl %eax
13918+ pushl %ecx
13919+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13920+ mov %eax, %esi
13921+#else
13922+ mov %cr0, %esi
13923+#endif
13924+ bts $16, %esi
13925+ jnc 1f
13926+ mov %cs, %esi
13927+ cmp $__KERNEL_CS, %esi
13928+ jz 3f
13929+ ljmp $__KERNEL_CS, $3f
13930+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13931+2:
13932+#ifdef CONFIG_PARAVIRT
13933+ mov %esi, %eax
13934+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13935+#else
13936+ mov %esi, %cr0
13937+#endif
13938+3:
13939+#ifdef CONFIG_PARAVIRT
13940+ popl %ecx
13941+ popl %eax
13942+#endif
13943+ ret
13944+ENDPROC(pax_enter_kernel)
13945+
13946+ENTRY(pax_exit_kernel)
13947+#ifdef CONFIG_PARAVIRT
13948+ pushl %eax
13949+ pushl %ecx
13950+#endif
13951+ mov %cs, %esi
13952+ cmp $__KERNEXEC_KERNEL_CS, %esi
13953+ jnz 2f
13954+#ifdef CONFIG_PARAVIRT
13955+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13956+ mov %eax, %esi
13957+#else
13958+ mov %cr0, %esi
13959+#endif
13960+ btr $16, %esi
13961+ ljmp $__KERNEL_CS, $1f
13962+1:
13963+#ifdef CONFIG_PARAVIRT
13964+ mov %esi, %eax
13965+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13966+#else
13967+ mov %esi, %cr0
13968+#endif
13969+2:
13970+#ifdef CONFIG_PARAVIRT
13971+ popl %ecx
13972+ popl %eax
13973+#endif
13974+ ret
13975+ENDPROC(pax_exit_kernel)
13976+#endif
13977+
13978+.macro pax_erase_kstack
13979+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13980+ call pax_erase_kstack
13981+#endif
13982+.endm
13983+
13984+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13985+/*
13986+ * ebp: thread_info
13987+ * ecx, edx: can be clobbered
13988+ */
13989+ENTRY(pax_erase_kstack)
13990+ pushl %edi
13991+ pushl %eax
13992+
13993+ mov TI_lowest_stack(%ebp), %edi
13994+ mov $-0xBEEF, %eax
13995+ std
13996+
13997+1: mov %edi, %ecx
13998+ and $THREAD_SIZE_asm - 1, %ecx
13999+ shr $2, %ecx
14000+ repne scasl
14001+ jecxz 2f
14002+
14003+ cmp $2*16, %ecx
14004+ jc 2f
14005+
14006+ mov $2*16, %ecx
14007+ repe scasl
14008+ jecxz 2f
14009+ jne 1b
14010+
14011+2: cld
14012+ mov %esp, %ecx
14013+ sub %edi, %ecx
14014+ shr $2, %ecx
14015+ rep stosl
14016+
14017+ mov TI_task_thread_sp0(%ebp), %edi
14018+ sub $128, %edi
14019+ mov %edi, TI_lowest_stack(%ebp)
14020+
14021+ popl %eax
14022+ popl %edi
14023+ ret
14024+ENDPROC(pax_erase_kstack)
14025+#endif
14026+
14027+.macro __SAVE_ALL _DS
14028 cld
14029 PUSH_GS
14030 pushl_cfi %fs
14031@@ -214,7 +347,7 @@
14032 CFI_REL_OFFSET ecx, 0
14033 pushl_cfi %ebx
14034 CFI_REL_OFFSET ebx, 0
14035- movl $(__USER_DS), %edx
14036+ movl $\_DS, %edx
14037 movl %edx, %ds
14038 movl %edx, %es
14039 movl $(__KERNEL_PERCPU), %edx
14040@@ -222,6 +355,15 @@
14041 SET_KERNEL_GS %edx
14042 .endm
14043
14044+.macro SAVE_ALL
14045+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
14046+ __SAVE_ALL __KERNEL_DS
14047+ pax_enter_kernel
14048+#else
14049+ __SAVE_ALL __USER_DS
14050+#endif
14051+.endm
14052+
14053 .macro RESTORE_INT_REGS
14054 popl_cfi %ebx
14055 CFI_RESTORE ebx
14056@@ -332,7 +474,15 @@ check_userspace:
14057 movb PT_CS(%esp), %al
14058 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
14059 cmpl $USER_RPL, %eax
14060+
14061+#ifdef CONFIG_PAX_KERNEXEC
14062+ jae resume_userspace
14063+
14064+ PAX_EXIT_KERNEL
14065+ jmp resume_kernel
14066+#else
14067 jb resume_kernel # not returning to v8086 or userspace
14068+#endif
14069
14070 ENTRY(resume_userspace)
14071 LOCKDEP_SYS_EXIT
14072@@ -344,7 +494,7 @@ ENTRY(resume_userspace)
14073 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
14074 # int/exception return?
14075 jne work_pending
14076- jmp restore_all
14077+ jmp restore_all_pax
14078 END(ret_from_exception)
14079
14080 #ifdef CONFIG_PREEMPT
14081@@ -394,23 +544,34 @@ sysenter_past_esp:
14082 /*CFI_REL_OFFSET cs, 0*/
14083 /*
14084 * Push current_thread_info()->sysenter_return to the stack.
14085- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
14086- * pushed above; +8 corresponds to copy_thread's esp0 setting.
14087 */
14088- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
14089+ pushl_cfi $0
14090 CFI_REL_OFFSET eip, 0
14091
14092 pushl_cfi %eax
14093 SAVE_ALL
14094+ GET_THREAD_INFO(%ebp)
14095+ movl TI_sysenter_return(%ebp),%ebp
14096+ movl %ebp,PT_EIP(%esp)
14097 ENABLE_INTERRUPTS(CLBR_NONE)
14098
14099 /*
14100 * Load the potential sixth argument from user stack.
14101 * Careful about security.
14102 */
14103+ movl PT_OLDESP(%esp),%ebp
14104+
14105+#ifdef CONFIG_PAX_MEMORY_UDEREF
14106+ mov PT_OLDSS(%esp),%ds
14107+1: movl %ds:(%ebp),%ebp
14108+ push %ss
14109+ pop %ds
14110+#else
14111 cmpl $__PAGE_OFFSET-3,%ebp
14112 jae syscall_fault
14113 1: movl (%ebp),%ebp
14114+#endif
14115+
14116 movl %ebp,PT_EBP(%esp)
14117 .section __ex_table,"a"
14118 .align 4
14119@@ -433,12 +594,23 @@ sysenter_do_call:
14120 testl $_TIF_ALLWORK_MASK, %ecx
14121 jne sysexit_audit
14122 sysenter_exit:
14123+
14124+#ifdef CONFIG_PAX_RANDKSTACK
14125+ pushl_cfi %eax
14126+ call pax_randomize_kstack
14127+ popl_cfi %eax
14128+#endif
14129+
14130+ pax_erase_kstack
14131+
14132 /* if something modifies registers it must also disable sysexit */
14133 movl PT_EIP(%esp), %edx
14134 movl PT_OLDESP(%esp), %ecx
14135 xorl %ebp,%ebp
14136 TRACE_IRQS_ON
14137 1: mov PT_FS(%esp), %fs
14138+2: mov PT_DS(%esp), %ds
14139+3: mov PT_ES(%esp), %es
14140 PTGS_TO_GS
14141 ENABLE_INTERRUPTS_SYSEXIT
14142
14143@@ -455,6 +627,9 @@ sysenter_audit:
14144 movl %eax,%edx /* 2nd arg: syscall number */
14145 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
14146 call audit_syscall_entry
14147+
14148+ pax_erase_kstack
14149+
14150 pushl_cfi %ebx
14151 movl PT_EAX(%esp),%eax /* reload syscall number */
14152 jmp sysenter_do_call
14153@@ -481,11 +656,17 @@ sysexit_audit:
14154
14155 CFI_ENDPROC
14156 .pushsection .fixup,"ax"
14157-2: movl $0,PT_FS(%esp)
14158+4: movl $0,PT_FS(%esp)
14159+ jmp 1b
14160+5: movl $0,PT_DS(%esp)
14161+ jmp 1b
14162+6: movl $0,PT_ES(%esp)
14163 jmp 1b
14164 .section __ex_table,"a"
14165 .align 4
14166- .long 1b,2b
14167+ .long 1b,4b
14168+ .long 2b,5b
14169+ .long 3b,6b
14170 .popsection
14171 PTGS_TO_GS_EX
14172 ENDPROC(ia32_sysenter_target)
14173@@ -518,6 +699,14 @@ syscall_exit:
14174 testl $_TIF_ALLWORK_MASK, %ecx # current->work
14175 jne syscall_exit_work
14176
14177+restore_all_pax:
14178+
14179+#ifdef CONFIG_PAX_RANDKSTACK
14180+ call pax_randomize_kstack
14181+#endif
14182+
14183+ pax_erase_kstack
14184+
14185 restore_all:
14186 TRACE_IRQS_IRET
14187 restore_all_notrace:
14188@@ -577,14 +766,21 @@ ldt_ss:
14189 * compensating for the offset by changing to the ESPFIX segment with
14190 * a base address that matches for the difference.
14191 */
14192-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
14193+#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
14194 mov %esp, %edx /* load kernel esp */
14195 mov PT_OLDESP(%esp), %eax /* load userspace esp */
14196 mov %dx, %ax /* eax: new kernel esp */
14197 sub %eax, %edx /* offset (low word is 0) */
14198+#ifdef CONFIG_SMP
14199+ movl PER_CPU_VAR(cpu_number), %ebx
14200+ shll $PAGE_SHIFT_asm, %ebx
14201+ addl $cpu_gdt_table, %ebx
14202+#else
14203+ movl $cpu_gdt_table, %ebx
14204+#endif
14205 shr $16, %edx
14206- mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
14207- mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
14208+ mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
14209+ mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
14210 pushl_cfi $__ESPFIX_SS
14211 pushl_cfi %eax /* new kernel esp */
14212 /* Disable interrupts, but do not irqtrace this section: we
14213@@ -613,29 +809,23 @@ work_resched:
14214 movl TI_flags(%ebp), %ecx
14215 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
14216 # than syscall tracing?
14217- jz restore_all
14218+ jz restore_all_pax
14219 testb $_TIF_NEED_RESCHED, %cl
14220 jnz work_resched
14221
14222 work_notifysig: # deal with pending signals and
14223 # notify-resume requests
14224+ movl %esp, %eax
14225 #ifdef CONFIG_VM86
14226 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
14227- movl %esp, %eax
14228- jne work_notifysig_v86 # returning to kernel-space or
14229+ jz 1f # returning to kernel-space or
14230 # vm86-space
14231- xorl %edx, %edx
14232- call do_notify_resume
14233- jmp resume_userspace_sig
14234
14235- ALIGN
14236-work_notifysig_v86:
14237 pushl_cfi %ecx # save ti_flags for do_notify_resume
14238 call save_v86_state # %eax contains pt_regs pointer
14239 popl_cfi %ecx
14240 movl %eax, %esp
14241-#else
14242- movl %esp, %eax
14243+1:
14244 #endif
14245 xorl %edx, %edx
14246 call do_notify_resume
14247@@ -648,6 +838,9 @@ syscall_trace_entry:
14248 movl $-ENOSYS,PT_EAX(%esp)
14249 movl %esp, %eax
14250 call syscall_trace_enter
14251+
14252+ pax_erase_kstack
14253+
14254 /* What it returned is what we'll actually use. */
14255 cmpl $(nr_syscalls), %eax
14256 jnae syscall_call
14257@@ -670,6 +863,10 @@ END(syscall_exit_work)
14258
14259 RING0_INT_FRAME # can't unwind into user space anyway
14260 syscall_fault:
14261+#ifdef CONFIG_PAX_MEMORY_UDEREF
14262+ push %ss
14263+ pop %ds
14264+#endif
14265 GET_THREAD_INFO(%ebp)
14266 movl $-EFAULT,PT_EAX(%esp)
14267 jmp resume_userspace
14268@@ -752,6 +949,36 @@ ptregs_clone:
14269 CFI_ENDPROC
14270 ENDPROC(ptregs_clone)
14271
14272+ ALIGN;
14273+ENTRY(kernel_execve)
14274+ CFI_STARTPROC
14275+ pushl_cfi %ebp
14276+ sub $PT_OLDSS+4,%esp
14277+ pushl_cfi %edi
14278+ pushl_cfi %ecx
14279+ pushl_cfi %eax
14280+ lea 3*4(%esp),%edi
14281+ mov $PT_OLDSS/4+1,%ecx
14282+ xorl %eax,%eax
14283+ rep stosl
14284+ popl_cfi %eax
14285+ popl_cfi %ecx
14286+ popl_cfi %edi
14287+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
14288+ pushl_cfi %esp
14289+ call sys_execve
14290+ add $4,%esp
14291+ CFI_ADJUST_CFA_OFFSET -4
14292+ GET_THREAD_INFO(%ebp)
14293+ test %eax,%eax
14294+ jz syscall_exit
14295+ add $PT_OLDSS+4,%esp
14296+ CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
14297+ popl_cfi %ebp
14298+ ret
14299+ CFI_ENDPROC
14300+ENDPROC(kernel_execve)
14301+
14302 .macro FIXUP_ESPFIX_STACK
14303 /*
14304 * Switch back for ESPFIX stack to the normal zerobased stack
14305@@ -761,8 +988,15 @@ ENDPROC(ptregs_clone)
14306 * normal stack and adjusts ESP with the matching offset.
14307 */
14308 /* fixup the stack */
14309- mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
14310- mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
14311+#ifdef CONFIG_SMP
14312+ movl PER_CPU_VAR(cpu_number), %ebx
14313+ shll $PAGE_SHIFT_asm, %ebx
14314+ addl $cpu_gdt_table, %ebx
14315+#else
14316+ movl $cpu_gdt_table, %ebx
14317+#endif
14318+ mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
14319+ mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
14320 shl $16, %eax
14321 addl %esp, %eax /* the adjusted stack pointer */
14322 pushl_cfi $__KERNEL_DS
14323@@ -1213,7 +1447,6 @@ return_to_handler:
14324 jmp *%ecx
14325 #endif
14326
14327-.section .rodata,"a"
14328 #include "syscall_table_32.S"
14329
14330 syscall_table_size=(.-sys_call_table)
14331@@ -1259,9 +1492,12 @@ error_code:
14332 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
14333 REG_TO_PTGS %ecx
14334 SET_KERNEL_GS %ecx
14335- movl $(__USER_DS), %ecx
14336+ movl $(__KERNEL_DS), %ecx
14337 movl %ecx, %ds
14338 movl %ecx, %es
14339+
14340+ pax_enter_kernel
14341+
14342 TRACE_IRQS_OFF
14343 movl %esp,%eax # pt_regs pointer
14344 call *%edi
14345@@ -1346,6 +1582,9 @@ nmi_stack_correct:
14346 xorl %edx,%edx # zero error code
14347 movl %esp,%eax # pt_regs pointer
14348 call do_nmi
14349+
14350+ pax_exit_kernel
14351+
14352 jmp restore_all_notrace
14353 CFI_ENDPROC
14354
14355@@ -1382,6 +1621,9 @@ nmi_espfix_stack:
14356 FIXUP_ESPFIX_STACK # %eax == %esp
14357 xorl %edx,%edx # zero error code
14358 call do_nmi
14359+
14360+ pax_exit_kernel
14361+
14362 RESTORE_REGS
14363 lss 12+4(%esp), %esp # back to espfix stack
14364 CFI_ADJUST_CFA_OFFSET -24
14365diff -urNp linux-2.6.39.2/arch/x86/kernel/entry_64.S linux-2.6.39.2/arch/x86/kernel/entry_64.S
14366--- linux-2.6.39.2/arch/x86/kernel/entry_64.S 2011-05-19 00:06:34.000000000 -0400
14367+++ linux-2.6.39.2/arch/x86/kernel/entry_64.S 2011-05-23 17:10:49.000000000 -0400
14368@@ -53,6 +53,7 @@
14369 #include <asm/paravirt.h>
14370 #include <asm/ftrace.h>
14371 #include <asm/percpu.h>
14372+#include <asm/pgtable.h>
14373
14374 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14375 #include <linux/elf-em.h>
14376@@ -176,6 +177,259 @@ ENTRY(native_usergs_sysret64)
14377 ENDPROC(native_usergs_sysret64)
14378 #endif /* CONFIG_PARAVIRT */
14379
14380+ .macro ljmpq sel, off
14381+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
14382+ .byte 0x48; ljmp *1234f(%rip)
14383+ .pushsection .rodata
14384+ .align 16
14385+ 1234: .quad \off; .word \sel
14386+ .popsection
14387+#else
14388+ pushq $\sel
14389+ pushq $\off
14390+ lretq
14391+#endif
14392+ .endm
14393+
14394+ .macro pax_enter_kernel
14395+#ifdef CONFIG_PAX_KERNEXEC
14396+ call pax_enter_kernel
14397+#endif
14398+ .endm
14399+
14400+ .macro pax_exit_kernel
14401+#ifdef CONFIG_PAX_KERNEXEC
14402+ call pax_exit_kernel
14403+#endif
14404+ .endm
14405+
14406+#ifdef CONFIG_PAX_KERNEXEC
14407+ENTRY(pax_enter_kernel)
14408+ pushq %rdi
14409+
14410+#ifdef CONFIG_PARAVIRT
14411+ PV_SAVE_REGS(CLBR_RDI)
14412+#endif
14413+
14414+ GET_CR0_INTO_RDI
14415+ bts $16,%rdi
14416+ jnc 1f
14417+ mov %cs,%edi
14418+ cmp $__KERNEL_CS,%edi
14419+ jz 3f
14420+ ljmpq __KERNEL_CS,3f
14421+1: ljmpq __KERNEXEC_KERNEL_CS,2f
14422+2: SET_RDI_INTO_CR0
14423+3:
14424+
14425+#ifdef CONFIG_PARAVIRT
14426+ PV_RESTORE_REGS(CLBR_RDI)
14427+#endif
14428+
14429+ popq %rdi
14430+ retq
14431+ENDPROC(pax_enter_kernel)
14432+
14433+ENTRY(pax_exit_kernel)
14434+ pushq %rdi
14435+
14436+#ifdef CONFIG_PARAVIRT
14437+ PV_SAVE_REGS(CLBR_RDI)
14438+#endif
14439+
14440+ mov %cs,%rdi
14441+ cmp $__KERNEXEC_KERNEL_CS,%edi
14442+ jnz 2f
14443+ GET_CR0_INTO_RDI
14444+ btr $16,%rdi
14445+ ljmpq __KERNEL_CS,1f
14446+1: SET_RDI_INTO_CR0
14447+2:
14448+
14449+#ifdef CONFIG_PARAVIRT
14450+ PV_RESTORE_REGS(CLBR_RDI);
14451+#endif
14452+
14453+ popq %rdi
14454+ retq
14455+ENDPROC(pax_exit_kernel)
14456+#endif
14457+
14458+ .macro pax_enter_kernel_user
14459+#ifdef CONFIG_PAX_MEMORY_UDEREF
14460+ call pax_enter_kernel_user
14461+#endif
14462+ .endm
14463+
14464+ .macro pax_exit_kernel_user
14465+#ifdef CONFIG_PAX_MEMORY_UDEREF
14466+ call pax_exit_kernel_user
14467+#endif
14468+#ifdef CONFIG_PAX_RANDKSTACK
14469+ push %rax
14470+ call pax_randomize_kstack
14471+ pop %rax
14472+#endif
14473+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14474+ call pax_erase_kstack
14475+#endif
14476+ .endm
14477+
14478+#ifdef CONFIG_PAX_MEMORY_UDEREF
14479+ENTRY(pax_enter_kernel_user)
14480+ pushq %rdi
14481+ pushq %rbx
14482+
14483+#ifdef CONFIG_PARAVIRT
14484+ PV_SAVE_REGS(CLBR_RDI)
14485+#endif
14486+
14487+ GET_CR3_INTO_RDI
14488+ mov %rdi,%rbx
14489+ add $__START_KERNEL_map,%rbx
14490+ sub phys_base(%rip),%rbx
14491+
14492+#ifdef CONFIG_PARAVIRT
14493+ pushq %rdi
14494+ cmpl $0, pv_info+PARAVIRT_enabled
14495+ jz 1f
14496+ i = 0
14497+ .rept USER_PGD_PTRS
14498+ mov i*8(%rbx),%rsi
14499+ mov $0,%sil
14500+ lea i*8(%rbx),%rdi
14501+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14502+ i = i + 1
14503+ .endr
14504+ jmp 2f
14505+1:
14506+#endif
14507+
14508+ i = 0
14509+ .rept USER_PGD_PTRS
14510+ movb $0,i*8(%rbx)
14511+ i = i + 1
14512+ .endr
14513+
14514+#ifdef CONFIG_PARAVIRT
14515+2: popq %rdi
14516+#endif
14517+ SET_RDI_INTO_CR3
14518+
14519+#ifdef CONFIG_PAX_KERNEXEC
14520+ GET_CR0_INTO_RDI
14521+ bts $16,%rdi
14522+ SET_RDI_INTO_CR0
14523+#endif
14524+
14525+#ifdef CONFIG_PARAVIRT
14526+ PV_RESTORE_REGS(CLBR_RDI)
14527+#endif
14528+
14529+ popq %rbx
14530+ popq %rdi
14531+ retq
14532+ENDPROC(pax_enter_kernel_user)
14533+
14534+ENTRY(pax_exit_kernel_user)
14535+ push %rdi
14536+
14537+#ifdef CONFIG_PARAVIRT
14538+ pushq %rbx
14539+ PV_SAVE_REGS(CLBR_RDI)
14540+#endif
14541+
14542+#ifdef CONFIG_PAX_KERNEXEC
14543+ GET_CR0_INTO_RDI
14544+ btr $16,%rdi
14545+ SET_RDI_INTO_CR0
14546+#endif
14547+
14548+ GET_CR3_INTO_RDI
14549+ add $__START_KERNEL_map,%rdi
14550+ sub phys_base(%rip),%rdi
14551+
14552+#ifdef CONFIG_PARAVIRT
14553+ cmpl $0, pv_info+PARAVIRT_enabled
14554+ jz 1f
14555+ mov %rdi,%rbx
14556+ i = 0
14557+ .rept USER_PGD_PTRS
14558+ mov i*8(%rbx),%rsi
14559+ mov $0x67,%sil
14560+ lea i*8(%rbx),%rdi
14561+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14562+ i = i + 1
14563+ .endr
14564+ jmp 2f
14565+1:
14566+#endif
14567+
14568+ i = 0
14569+ .rept USER_PGD_PTRS
14570+ movb $0x67,i*8(%rdi)
14571+ i = i + 1
14572+ .endr
14573+
14574+#ifdef CONFIG_PARAVIRT
14575+2: PV_RESTORE_REGS(CLBR_RDI)
14576+ popq %rbx
14577+#endif
14578+
14579+ popq %rdi
14580+ retq
14581+ENDPROC(pax_exit_kernel_user)
14582+#endif
14583+
14584+ .macro pax_erase_kstack
14585+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14586+ call pax_erase_kstack
14587+#endif
14588+ .endm
14589+
14590+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14591+/*
14592+ * r10: thread_info
14593+ * rcx, rdx: can be clobbered
14594+ */
14595+ENTRY(pax_erase_kstack)
14596+ pushq %rdi
14597+ pushq %rax
14598+
14599+ GET_THREAD_INFO(%r10)
14600+ mov TI_lowest_stack(%r10), %rdi
14601+ mov $-0xBEEF, %rax
14602+ std
14603+
14604+1: mov %edi, %ecx
14605+ and $THREAD_SIZE_asm - 1, %ecx
14606+ shr $3, %ecx
14607+ repne scasq
14608+ jecxz 2f
14609+
14610+ cmp $2*8, %ecx
14611+ jc 2f
14612+
14613+ mov $2*8, %ecx
14614+ repe scasq
14615+ jecxz 2f
14616+ jne 1b
14617+
14618+2: cld
14619+ mov %esp, %ecx
14620+ sub %edi, %ecx
14621+ shr $3, %ecx
14622+ rep stosq
14623+
14624+ mov TI_task_thread_sp0(%r10), %rdi
14625+ sub $256, %rdi
14626+ mov %rdi, TI_lowest_stack(%r10)
14627+
14628+ popq %rax
14629+ popq %rdi
14630+ ret
14631+ENDPROC(pax_erase_kstack)
14632+#endif
14633
14634 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14635 #ifdef CONFIG_TRACE_IRQFLAGS
14636@@ -318,7 +572,7 @@ ENTRY(save_args)
14637 leaq -RBP+8(%rsp),%rdi /* arg1 for handler */
14638 movq_cfi rbp, 8 /* push %rbp */
14639 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14640- testl $3, CS(%rdi)
14641+ testb $3, CS(%rdi)
14642 je 1f
14643 SWAPGS
14644 /*
14645@@ -409,7 +663,7 @@ ENTRY(ret_from_fork)
14646
14647 RESTORE_REST
14648
14649- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14650+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14651 je int_ret_from_sys_call
14652
14653 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
14654@@ -455,7 +709,7 @@ END(ret_from_fork)
14655 ENTRY(system_call)
14656 CFI_STARTPROC simple
14657 CFI_SIGNAL_FRAME
14658- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14659+ CFI_DEF_CFA rsp,0
14660 CFI_REGISTER rip,rcx
14661 /*CFI_REGISTER rflags,r11*/
14662 SWAPGS_UNSAFE_STACK
14663@@ -468,12 +722,13 @@ ENTRY(system_call_after_swapgs)
14664
14665 movq %rsp,PER_CPU_VAR(old_rsp)
14666 movq PER_CPU_VAR(kernel_stack),%rsp
14667+ pax_enter_kernel_user
14668 /*
14669 * No need to follow this irqs off/on section - it's straight
14670 * and short:
14671 */
14672 ENABLE_INTERRUPTS(CLBR_NONE)
14673- SAVE_ARGS 8,1
14674+ SAVE_ARGS 8*6,1
14675 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14676 movq %rcx,RIP-ARGOFFSET(%rsp)
14677 CFI_REL_OFFSET rip,RIP-ARGOFFSET
14678@@ -502,6 +757,7 @@ sysret_check:
14679 andl %edi,%edx
14680 jnz sysret_careful
14681 CFI_REMEMBER_STATE
14682+ pax_exit_kernel_user
14683 /*
14684 * sysretq will re-enable interrupts:
14685 */
14686@@ -560,6 +816,9 @@ auditsys:
14687 movq %rax,%rsi /* 2nd arg: syscall number */
14688 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14689 call audit_syscall_entry
14690+
14691+ pax_erase_kstack
14692+
14693 LOAD_ARGS 0 /* reload call-clobbered registers */
14694 jmp system_call_fastpath
14695
14696@@ -590,6 +849,9 @@ tracesys:
14697 FIXUP_TOP_OF_STACK %rdi
14698 movq %rsp,%rdi
14699 call syscall_trace_enter
14700+
14701+ pax_erase_kstack
14702+
14703 /*
14704 * Reload arg registers from stack in case ptrace changed them.
14705 * We don't reload %rax because syscall_trace_enter() returned
14706@@ -611,7 +873,7 @@ tracesys:
14707 GLOBAL(int_ret_from_sys_call)
14708 DISABLE_INTERRUPTS(CLBR_NONE)
14709 TRACE_IRQS_OFF
14710- testl $3,CS-ARGOFFSET(%rsp)
14711+ testb $3,CS-ARGOFFSET(%rsp)
14712 je retint_restore_args
14713 movl $_TIF_ALLWORK_MASK,%edi
14714 /* edi: mask to check */
14715@@ -793,6 +1055,16 @@ END(interrupt)
14716 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
14717 call save_args
14718 PARTIAL_FRAME 0
14719+#ifdef CONFIG_PAX_MEMORY_UDEREF
14720+ testb $3, CS(%rdi)
14721+ jnz 1f
14722+ pax_enter_kernel
14723+ jmp 2f
14724+1: pax_enter_kernel_user
14725+2:
14726+#else
14727+ pax_enter_kernel
14728+#endif
14729 call \func
14730 .endm
14731
14732@@ -825,7 +1097,7 @@ ret_from_intr:
14733 CFI_ADJUST_CFA_OFFSET -8
14734 exit_intr:
14735 GET_THREAD_INFO(%rcx)
14736- testl $3,CS-ARGOFFSET(%rsp)
14737+ testb $3,CS-ARGOFFSET(%rsp)
14738 je retint_kernel
14739
14740 /* Interrupt came from user space */
14741@@ -847,12 +1119,14 @@ retint_swapgs: /* return to user-space
14742 * The iretq could re-enable interrupts:
14743 */
14744 DISABLE_INTERRUPTS(CLBR_ANY)
14745+ pax_exit_kernel_user
14746 TRACE_IRQS_IRETQ
14747 SWAPGS
14748 jmp restore_args
14749
14750 retint_restore_args: /* return to kernel space */
14751 DISABLE_INTERRUPTS(CLBR_ANY)
14752+ pax_exit_kernel
14753 /*
14754 * The iretq could re-enable interrupts:
14755 */
14756@@ -1027,6 +1301,16 @@ ENTRY(\sym)
14757 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14758 call error_entry
14759 DEFAULT_FRAME 0
14760+#ifdef CONFIG_PAX_MEMORY_UDEREF
14761+ testb $3, CS(%rsp)
14762+ jnz 1f
14763+ pax_enter_kernel
14764+ jmp 2f
14765+1: pax_enter_kernel_user
14766+2:
14767+#else
14768+ pax_enter_kernel
14769+#endif
14770 movq %rsp,%rdi /* pt_regs pointer */
14771 xorl %esi,%esi /* no error code */
14772 call \do_sym
14773@@ -1044,6 +1328,16 @@ ENTRY(\sym)
14774 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14775 call save_paranoid
14776 TRACE_IRQS_OFF
14777+#ifdef CONFIG_PAX_MEMORY_UDEREF
14778+ testb $3, CS(%rsp)
14779+ jnz 1f
14780+ pax_enter_kernel
14781+ jmp 2f
14782+1: pax_enter_kernel_user
14783+2:
14784+#else
14785+ pax_enter_kernel
14786+#endif
14787 movq %rsp,%rdi /* pt_regs pointer */
14788 xorl %esi,%esi /* no error code */
14789 call \do_sym
14790@@ -1052,7 +1346,7 @@ ENTRY(\sym)
14791 END(\sym)
14792 .endm
14793
14794-#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14795+#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14796 .macro paranoidzeroentry_ist sym do_sym ist
14797 ENTRY(\sym)
14798 INTR_FRAME
14799@@ -1062,8 +1356,24 @@ ENTRY(\sym)
14800 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14801 call save_paranoid
14802 TRACE_IRQS_OFF
14803+#ifdef CONFIG_PAX_MEMORY_UDEREF
14804+ testb $3, CS(%rsp)
14805+ jnz 1f
14806+ pax_enter_kernel
14807+ jmp 2f
14808+1: pax_enter_kernel_user
14809+2:
14810+#else
14811+ pax_enter_kernel
14812+#endif
14813 movq %rsp,%rdi /* pt_regs pointer */
14814 xorl %esi,%esi /* no error code */
14815+#ifdef CONFIG_SMP
14816+ imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14817+ lea init_tss(%r12), %r12
14818+#else
14819+ lea init_tss(%rip), %r12
14820+#endif
14821 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14822 call \do_sym
14823 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14824@@ -1080,6 +1390,16 @@ ENTRY(\sym)
14825 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14826 call error_entry
14827 DEFAULT_FRAME 0
14828+#ifdef CONFIG_PAX_MEMORY_UDEREF
14829+ testb $3, CS(%rsp)
14830+ jnz 1f
14831+ pax_enter_kernel
14832+ jmp 2f
14833+1: pax_enter_kernel_user
14834+2:
14835+#else
14836+ pax_enter_kernel
14837+#endif
14838 movq %rsp,%rdi /* pt_regs pointer */
14839 movq ORIG_RAX(%rsp),%rsi /* get error code */
14840 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14841@@ -1099,6 +1419,16 @@ ENTRY(\sym)
14842 call save_paranoid
14843 DEFAULT_FRAME 0
14844 TRACE_IRQS_OFF
14845+#ifdef CONFIG_PAX_MEMORY_UDEREF
14846+ testb $3, CS(%rsp)
14847+ jnz 1f
14848+ pax_enter_kernel
14849+ jmp 2f
14850+1: pax_enter_kernel_user
14851+2:
14852+#else
14853+ pax_enter_kernel
14854+#endif
14855 movq %rsp,%rdi /* pt_regs pointer */
14856 movq ORIG_RAX(%rsp),%rsi /* get error code */
14857 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14858@@ -1361,14 +1691,27 @@ ENTRY(paranoid_exit)
14859 TRACE_IRQS_OFF
14860 testl %ebx,%ebx /* swapgs needed? */
14861 jnz paranoid_restore
14862- testl $3,CS(%rsp)
14863+ testb $3,CS(%rsp)
14864 jnz paranoid_userspace
14865+#ifdef CONFIG_PAX_MEMORY_UDEREF
14866+ pax_exit_kernel
14867+ TRACE_IRQS_IRETQ 0
14868+ SWAPGS_UNSAFE_STACK
14869+ RESTORE_ALL 8
14870+ jmp irq_return
14871+#endif
14872 paranoid_swapgs:
14873+#ifdef CONFIG_PAX_MEMORY_UDEREF
14874+ pax_exit_kernel_user
14875+#else
14876+ pax_exit_kernel
14877+#endif
14878 TRACE_IRQS_IRETQ 0
14879 SWAPGS_UNSAFE_STACK
14880 RESTORE_ALL 8
14881 jmp irq_return
14882 paranoid_restore:
14883+ pax_exit_kernel
14884 TRACE_IRQS_IRETQ 0
14885 RESTORE_ALL 8
14886 jmp irq_return
14887@@ -1426,7 +1769,7 @@ ENTRY(error_entry)
14888 movq_cfi r14, R14+8
14889 movq_cfi r15, R15+8
14890 xorl %ebx,%ebx
14891- testl $3,CS+8(%rsp)
14892+ testb $3,CS+8(%rsp)
14893 je error_kernelspace
14894 error_swapgs:
14895 SWAPGS
14896@@ -1490,6 +1833,16 @@ ENTRY(nmi)
14897 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14898 call save_paranoid
14899 DEFAULT_FRAME 0
14900+#ifdef CONFIG_PAX_MEMORY_UDEREF
14901+ testb $3, CS(%rsp)
14902+ jnz 1f
14903+ pax_enter_kernel
14904+ jmp 2f
14905+1: pax_enter_kernel_user
14906+2:
14907+#else
14908+ pax_enter_kernel
14909+#endif
14910 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14911 movq %rsp,%rdi
14912 movq $-1,%rsi
14913@@ -1500,11 +1853,25 @@ ENTRY(nmi)
14914 DISABLE_INTERRUPTS(CLBR_NONE)
14915 testl %ebx,%ebx /* swapgs needed? */
14916 jnz nmi_restore
14917- testl $3,CS(%rsp)
14918+ testb $3,CS(%rsp)
14919 jnz nmi_userspace
14920+#ifdef CONFIG_PAX_MEMORY_UDEREF
14921+ pax_exit_kernel
14922+ SWAPGS_UNSAFE_STACK
14923+ RESTORE_ALL 8
14924+ jmp irq_return
14925+#endif
14926 nmi_swapgs:
14927+#ifdef CONFIG_PAX_MEMORY_UDEREF
14928+ pax_exit_kernel_user
14929+#else
14930+ pax_exit_kernel
14931+#endif
14932 SWAPGS_UNSAFE_STACK
14933+ RESTORE_ALL 8
14934+ jmp irq_return
14935 nmi_restore:
14936+ pax_exit_kernel
14937 RESTORE_ALL 8
14938 jmp irq_return
14939 nmi_userspace:
14940diff -urNp linux-2.6.39.2/arch/x86/kernel/ftrace.c linux-2.6.39.2/arch/x86/kernel/ftrace.c
14941--- linux-2.6.39.2/arch/x86/kernel/ftrace.c 2011-05-19 00:06:34.000000000 -0400
14942+++ linux-2.6.39.2/arch/x86/kernel/ftrace.c 2011-05-22 19:36:30.000000000 -0400
14943@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the
14944 static void *mod_code_newcode; /* holds the text to write to the IP */
14945
14946 static unsigned nmi_wait_count;
14947-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14948+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14949
14950 int ftrace_arch_read_dyn_info(char *buf, int size)
14951 {
14952@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
14953
14954 r = snprintf(buf, size, "%u %u",
14955 nmi_wait_count,
14956- atomic_read(&nmi_update_count));
14957+ atomic_read_unchecked(&nmi_update_count));
14958 return r;
14959 }
14960
14961@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14962
14963 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14964 smp_rmb();
14965+ pax_open_kernel();
14966 ftrace_mod_code();
14967- atomic_inc(&nmi_update_count);
14968+ pax_close_kernel();
14969+ atomic_inc_unchecked(&nmi_update_count);
14970 }
14971 /* Must have previous changes seen before executions */
14972 smp_mb();
14973@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
14974 {
14975 unsigned char replaced[MCOUNT_INSN_SIZE];
14976
14977+ ip = ktla_ktva(ip);
14978+
14979 /*
14980 * Note: Due to modules and __init, code can
14981 * disappear and change, we need to protect against faulting
14982@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun
14983 unsigned char old[MCOUNT_INSN_SIZE], *new;
14984 int ret;
14985
14986- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14987+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14988 new = ftrace_call_replace(ip, (unsigned long)func);
14989 ret = ftrace_modify_code(ip, old, new);
14990
14991@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long
14992 {
14993 unsigned char code[MCOUNT_INSN_SIZE];
14994
14995+ ip = ktla_ktva(ip);
14996+
14997 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14998 return -EFAULT;
14999
15000diff -urNp linux-2.6.39.2/arch/x86/kernel/head32.c linux-2.6.39.2/arch/x86/kernel/head32.c
15001--- linux-2.6.39.2/arch/x86/kernel/head32.c 2011-05-19 00:06:34.000000000 -0400
15002+++ linux-2.6.39.2/arch/x86/kernel/head32.c 2011-05-22 19:36:30.000000000 -0400
15003@@ -19,6 +19,7 @@
15004 #include <asm/io_apic.h>
15005 #include <asm/bios_ebda.h>
15006 #include <asm/tlbflush.h>
15007+#include <asm/boot.h>
15008
15009 static void __init i386_default_early_setup(void)
15010 {
15011@@ -34,7 +35,7 @@ void __init i386_start_kernel(void)
15012 {
15013 memblock_init();
15014
15015- memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
15016+ memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
15017
15018 #ifdef CONFIG_BLK_DEV_INITRD
15019 /* Reserve INITRD */
15020diff -urNp linux-2.6.39.2/arch/x86/kernel/head_32.S linux-2.6.39.2/arch/x86/kernel/head_32.S
15021--- linux-2.6.39.2/arch/x86/kernel/head_32.S 2011-05-19 00:06:34.000000000 -0400
15022+++ linux-2.6.39.2/arch/x86/kernel/head_32.S 2011-05-22 19:36:30.000000000 -0400
15023@@ -25,6 +25,12 @@
15024 /* Physical address */
15025 #define pa(X) ((X) - __PAGE_OFFSET)
15026
15027+#ifdef CONFIG_PAX_KERNEXEC
15028+#define ta(X) (X)
15029+#else
15030+#define ta(X) ((X) - __PAGE_OFFSET)
15031+#endif
15032+
15033 /*
15034 * References to members of the new_cpu_data structure.
15035 */
15036@@ -54,11 +60,7 @@
15037 * and small than max_low_pfn, otherwise will waste some page table entries
15038 */
15039
15040-#if PTRS_PER_PMD > 1
15041-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
15042-#else
15043-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
15044-#endif
15045+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
15046
15047 /* Number of possible pages in the lowmem region */
15048 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
15049@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
15050 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
15051
15052 /*
15053+ * Real beginning of normal "text" segment
15054+ */
15055+ENTRY(stext)
15056+ENTRY(_stext)
15057+
15058+/*
15059 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
15060 * %esi points to the real-mode code as a 32-bit pointer.
15061 * CS and DS must be 4 GB flat segments, but we don't depend on
15062@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
15063 * can.
15064 */
15065 __HEAD
15066+
15067+#ifdef CONFIG_PAX_KERNEXEC
15068+ jmp startup_32
15069+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
15070+.fill PAGE_SIZE-5,1,0xcc
15071+#endif
15072+
15073 ENTRY(startup_32)
15074 movl pa(stack_start),%ecx
15075
15076@@ -105,6 +120,57 @@ ENTRY(startup_32)
15077 2:
15078 leal -__PAGE_OFFSET(%ecx),%esp
15079
15080+#ifdef CONFIG_SMP
15081+ movl $pa(cpu_gdt_table),%edi
15082+ movl $__per_cpu_load,%eax
15083+ movw %ax,__KERNEL_PERCPU + 2(%edi)
15084+ rorl $16,%eax
15085+ movb %al,__KERNEL_PERCPU + 4(%edi)
15086+ movb %ah,__KERNEL_PERCPU + 7(%edi)
15087+ movl $__per_cpu_end - 1,%eax
15088+ subl $__per_cpu_start,%eax
15089+ movw %ax,__KERNEL_PERCPU + 0(%edi)
15090+#endif
15091+
15092+#ifdef CONFIG_PAX_MEMORY_UDEREF
15093+ movl $NR_CPUS,%ecx
15094+ movl $pa(cpu_gdt_table),%edi
15095+1:
15096+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
15097+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
15098+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
15099+ addl $PAGE_SIZE_asm,%edi
15100+ loop 1b
15101+#endif
15102+
15103+#ifdef CONFIG_PAX_KERNEXEC
15104+ movl $pa(boot_gdt),%edi
15105+ movl $__LOAD_PHYSICAL_ADDR,%eax
15106+ movw %ax,__BOOT_CS + 2(%edi)
15107+ rorl $16,%eax
15108+ movb %al,__BOOT_CS + 4(%edi)
15109+ movb %ah,__BOOT_CS + 7(%edi)
15110+ rorl $16,%eax
15111+
15112+ ljmp $(__BOOT_CS),$1f
15113+1:
15114+
15115+ movl $NR_CPUS,%ecx
15116+ movl $pa(cpu_gdt_table),%edi
15117+ addl $__PAGE_OFFSET,%eax
15118+1:
15119+ movw %ax,__KERNEL_CS + 2(%edi)
15120+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
15121+ rorl $16,%eax
15122+ movb %al,__KERNEL_CS + 4(%edi)
15123+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
15124+ movb %ah,__KERNEL_CS + 7(%edi)
15125+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
15126+ rorl $16,%eax
15127+ addl $PAGE_SIZE_asm,%edi
15128+ loop 1b
15129+#endif
15130+
15131 /*
15132 * Clear BSS first so that there are no surprises...
15133 */
15134@@ -195,8 +261,11 @@ ENTRY(startup_32)
15135 movl %eax, pa(max_pfn_mapped)
15136
15137 /* Do early initialization of the fixmap area */
15138- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
15139- movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
15140+#ifdef CONFIG_COMPAT_VDSO
15141+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
15142+#else
15143+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
15144+#endif
15145 #else /* Not PAE */
15146
15147 page_pde_offset = (__PAGE_OFFSET >> 20);
15148@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
15149 movl %eax, pa(max_pfn_mapped)
15150
15151 /* Do early initialization of the fixmap area */
15152- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
15153- movl %eax,pa(initial_page_table+0xffc)
15154+#ifdef CONFIG_COMPAT_VDSO
15155+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
15156+#else
15157+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
15158+#endif
15159 #endif
15160
15161 #ifdef CONFIG_PARAVIRT
15162@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
15163 cmpl $num_subarch_entries, %eax
15164 jae bad_subarch
15165
15166- movl pa(subarch_entries)(,%eax,4), %eax
15167- subl $__PAGE_OFFSET, %eax
15168- jmp *%eax
15169+ jmp *pa(subarch_entries)(,%eax,4)
15170
15171 bad_subarch:
15172 WEAK(lguest_entry)
15173@@ -255,10 +325,10 @@ WEAK(xen_entry)
15174 __INITDATA
15175
15176 subarch_entries:
15177- .long default_entry /* normal x86/PC */
15178- .long lguest_entry /* lguest hypervisor */
15179- .long xen_entry /* Xen hypervisor */
15180- .long default_entry /* Moorestown MID */
15181+ .long ta(default_entry) /* normal x86/PC */
15182+ .long ta(lguest_entry) /* lguest hypervisor */
15183+ .long ta(xen_entry) /* Xen hypervisor */
15184+ .long ta(default_entry) /* Moorestown MID */
15185 num_subarch_entries = (. - subarch_entries) / 4
15186 .previous
15187 #else
15188@@ -312,6 +382,7 @@ default_entry:
15189 orl %edx,%eax
15190 movl %eax,%cr4
15191
15192+#ifdef CONFIG_X86_PAE
15193 testb $X86_CR4_PAE, %al # check if PAE is enabled
15194 jz 6f
15195
15196@@ -340,6 +411,9 @@ default_entry:
15197 /* Make changes effective */
15198 wrmsr
15199
15200+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
15201+#endif
15202+
15203 6:
15204
15205 /*
15206@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
15207 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
15208 movl %eax,%ss # after changing gdt.
15209
15210- movl $(__USER_DS),%eax # DS/ES contains default USER segment
15211+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
15212 movl %eax,%ds
15213 movl %eax,%es
15214
15215@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
15216 */
15217 cmpb $0,ready
15218 jne 1f
15219- movl $gdt_page,%eax
15220+ movl $cpu_gdt_table,%eax
15221 movl $stack_canary,%ecx
15222+#ifdef CONFIG_SMP
15223+ addl $__per_cpu_load,%ecx
15224+#endif
15225 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
15226 shrl $16, %ecx
15227 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
15228 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
15229 1:
15230-#endif
15231 movl $(__KERNEL_STACK_CANARY),%eax
15232+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
15233+ movl $(__USER_DS),%eax
15234+#else
15235+ xorl %eax,%eax
15236+#endif
15237 movl %eax,%gs
15238
15239 xorl %eax,%eax # Clear LDT
15240@@ -558,22 +639,22 @@ early_page_fault:
15241 jmp early_fault
15242
15243 early_fault:
15244- cld
15245 #ifdef CONFIG_PRINTK
15246+ cmpl $1,%ss:early_recursion_flag
15247+ je hlt_loop
15248+ incl %ss:early_recursion_flag
15249+ cld
15250 pusha
15251 movl $(__KERNEL_DS),%eax
15252 movl %eax,%ds
15253 movl %eax,%es
15254- cmpl $2,early_recursion_flag
15255- je hlt_loop
15256- incl early_recursion_flag
15257 movl %cr2,%eax
15258 pushl %eax
15259 pushl %edx /* trapno */
15260 pushl $fault_msg
15261 call printk
15262+; call dump_stack
15263 #endif
15264- call dump_stack
15265 hlt_loop:
15266 hlt
15267 jmp hlt_loop
15268@@ -581,8 +662,11 @@ hlt_loop:
15269 /* This is the default interrupt "handler" :-) */
15270 ALIGN
15271 ignore_int:
15272- cld
15273 #ifdef CONFIG_PRINTK
15274+ cmpl $2,%ss:early_recursion_flag
15275+ je hlt_loop
15276+ incl %ss:early_recursion_flag
15277+ cld
15278 pushl %eax
15279 pushl %ecx
15280 pushl %edx
15281@@ -591,9 +675,6 @@ ignore_int:
15282 movl $(__KERNEL_DS),%eax
15283 movl %eax,%ds
15284 movl %eax,%es
15285- cmpl $2,early_recursion_flag
15286- je hlt_loop
15287- incl early_recursion_flag
15288 pushl 16(%esp)
15289 pushl 24(%esp)
15290 pushl 32(%esp)
15291@@ -622,29 +703,43 @@ ENTRY(initial_code)
15292 /*
15293 * BSS section
15294 */
15295-__PAGE_ALIGNED_BSS
15296- .align PAGE_SIZE
15297 #ifdef CONFIG_X86_PAE
15298+.section .initial_pg_pmd,"a",@progbits
15299 initial_pg_pmd:
15300 .fill 1024*KPMDS,4,0
15301 #else
15302+.section .initial_page_table,"a",@progbits
15303 ENTRY(initial_page_table)
15304 .fill 1024,4,0
15305 #endif
15306+.section .initial_pg_fixmap,"a",@progbits
15307 initial_pg_fixmap:
15308 .fill 1024,4,0
15309+.section .empty_zero_page,"a",@progbits
15310 ENTRY(empty_zero_page)
15311 .fill 4096,1,0
15312+.section .swapper_pg_dir,"a",@progbits
15313 ENTRY(swapper_pg_dir)
15314+#ifdef CONFIG_X86_PAE
15315+ .fill 4,8,0
15316+#else
15317 .fill 1024,4,0
15318+#endif
15319+
15320+/*
15321+ * The IDT has to be page-aligned to simplify the Pentium
15322+ * F0 0F bug workaround.. We have a special link segment
15323+ * for this.
15324+ */
15325+.section .idt,"a",@progbits
15326+ENTRY(idt_table)
15327+ .fill 256,8,0
15328
15329 /*
15330 * This starts the data section.
15331 */
15332 #ifdef CONFIG_X86_PAE
15333-__PAGE_ALIGNED_DATA
15334- /* Page-aligned for the benefit of paravirt? */
15335- .align PAGE_SIZE
15336+.section .initial_page_table,"a",@progbits
15337 ENTRY(initial_page_table)
15338 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
15339 # if KPMDS == 3
15340@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
15341 # error "Kernel PMDs should be 1, 2 or 3"
15342 # endif
15343 .align PAGE_SIZE /* needs to be page-sized too */
15344+
15345+#ifdef CONFIG_PAX_PER_CPU_PGD
15346+ENTRY(cpu_pgd)
15347+ .rept NR_CPUS
15348+ .fill 4,8,0
15349+ .endr
15350+#endif
15351+
15352 #endif
15353
15354 .data
15355 .balign 4
15356 ENTRY(stack_start)
15357- .long init_thread_union+THREAD_SIZE
15358+ .long init_thread_union+THREAD_SIZE-8
15359+
15360+ready: .byte 0
15361
15362+.section .rodata,"a",@progbits
15363 early_recursion_flag:
15364 .long 0
15365
15366-ready: .byte 0
15367-
15368 int_msg:
15369 .asciz "Unknown interrupt or fault at: %p %p %p\n"
15370
15371@@ -707,7 +811,7 @@ fault_msg:
15372 .word 0 # 32 bit align gdt_desc.address
15373 boot_gdt_descr:
15374 .word __BOOT_DS+7
15375- .long boot_gdt - __PAGE_OFFSET
15376+ .long pa(boot_gdt)
15377
15378 .word 0 # 32-bit align idt_desc.address
15379 idt_descr:
15380@@ -718,7 +822,7 @@ idt_descr:
15381 .word 0 # 32 bit align gdt_desc.address
15382 ENTRY(early_gdt_descr)
15383 .word GDT_ENTRIES*8-1
15384- .long gdt_page /* Overwritten for secondary CPUs */
15385+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
15386
15387 /*
15388 * The boot_gdt must mirror the equivalent in setup.S and is
15389@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
15390 .align L1_CACHE_BYTES
15391 ENTRY(boot_gdt)
15392 .fill GDT_ENTRY_BOOT_CS,8,0
15393- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
15394- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
15395+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
15396+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
15397+
15398+ .align PAGE_SIZE_asm
15399+ENTRY(cpu_gdt_table)
15400+ .rept NR_CPUS
15401+ .quad 0x0000000000000000 /* NULL descriptor */
15402+ .quad 0x0000000000000000 /* 0x0b reserved */
15403+ .quad 0x0000000000000000 /* 0x13 reserved */
15404+ .quad 0x0000000000000000 /* 0x1b reserved */
15405+
15406+#ifdef CONFIG_PAX_KERNEXEC
15407+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
15408+#else
15409+ .quad 0x0000000000000000 /* 0x20 unused */
15410+#endif
15411+
15412+ .quad 0x0000000000000000 /* 0x28 unused */
15413+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
15414+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
15415+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
15416+ .quad 0x0000000000000000 /* 0x4b reserved */
15417+ .quad 0x0000000000000000 /* 0x53 reserved */
15418+ .quad 0x0000000000000000 /* 0x5b reserved */
15419+
15420+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
15421+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
15422+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
15423+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
15424+
15425+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
15426+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
15427+
15428+ /*
15429+ * Segments used for calling PnP BIOS have byte granularity.
15430+ * The code segments and data segments have fixed 64k limits,
15431+ * the transfer segment sizes are set at run time.
15432+ */
15433+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
15434+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
15435+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
15436+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
15437+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
15438+
15439+ /*
15440+ * The APM segments have byte granularity and their bases
15441+ * are set at run time. All have 64k limits.
15442+ */
15443+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
15444+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
15445+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
15446+
15447+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
15448+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
15449+ .quad 0x0040910000000018 /* 0xe0 - STACK_CANARY */
15450+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
15451+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
15452+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
15453+
15454+ /* Be sure this is zeroed to avoid false validations in Xen */
15455+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
15456+ .endr
15457diff -urNp linux-2.6.39.2/arch/x86/kernel/head_64.S linux-2.6.39.2/arch/x86/kernel/head_64.S
15458--- linux-2.6.39.2/arch/x86/kernel/head_64.S 2011-05-19 00:06:34.000000000 -0400
15459+++ linux-2.6.39.2/arch/x86/kernel/head_64.S 2011-05-22 19:36:30.000000000 -0400
15460@@ -19,6 +19,7 @@
15461 #include <asm/cache.h>
15462 #include <asm/processor-flags.h>
15463 #include <asm/percpu.h>
15464+#include <asm/cpufeature.h>
15465
15466 #ifdef CONFIG_PARAVIRT
15467 #include <asm/asm-offsets.h>
15468@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
15469 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
15470 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
15471 L3_START_KERNEL = pud_index(__START_KERNEL_map)
15472+L4_VMALLOC_START = pgd_index(VMALLOC_START)
15473+L3_VMALLOC_START = pud_index(VMALLOC_START)
15474+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
15475+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
15476
15477 .text
15478 __HEAD
15479@@ -85,35 +90,22 @@ startup_64:
15480 */
15481 addq %rbp, init_level4_pgt + 0(%rip)
15482 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
15483+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
15484+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
15485 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
15486
15487 addq %rbp, level3_ident_pgt + 0(%rip)
15488+#ifndef CONFIG_XEN
15489+ addq %rbp, level3_ident_pgt + 8(%rip)
15490+#endif
15491
15492- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
15493- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
15494+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
15495
15496- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15497+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
15498+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
15499
15500- /* Add an Identity mapping if I am above 1G */
15501- leaq _text(%rip), %rdi
15502- andq $PMD_PAGE_MASK, %rdi
15503-
15504- movq %rdi, %rax
15505- shrq $PUD_SHIFT, %rax
15506- andq $(PTRS_PER_PUD - 1), %rax
15507- jz ident_complete
15508-
15509- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
15510- leaq level3_ident_pgt(%rip), %rbx
15511- movq %rdx, 0(%rbx, %rax, 8)
15512-
15513- movq %rdi, %rax
15514- shrq $PMD_SHIFT, %rax
15515- andq $(PTRS_PER_PMD - 1), %rax
15516- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15517- leaq level2_spare_pgt(%rip), %rbx
15518- movq %rdx, 0(%rbx, %rax, 8)
15519-ident_complete:
15520+ addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15521+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15522
15523 /*
15524 * Fixup the kernel text+data virtual addresses. Note that
15525@@ -160,8 +152,8 @@ ENTRY(secondary_startup_64)
15526 * after the boot processor executes this code.
15527 */
15528
15529- /* Enable PAE mode and PGE */
15530- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15531+ /* Enable PAE mode and PSE/PGE */
15532+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15533 movq %rax, %cr4
15534
15535 /* Setup early boot stage 4 level pagetables. */
15536@@ -183,9 +175,14 @@ ENTRY(secondary_startup_64)
15537 movl $MSR_EFER, %ecx
15538 rdmsr
15539 btsl $_EFER_SCE, %eax /* Enable System Call */
15540- btl $20,%edi /* No Execute supported? */
15541+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15542 jnc 1f
15543 btsl $_EFER_NX, %eax
15544+ leaq init_level4_pgt(%rip), %rdi
15545+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15546+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15547+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15548+ btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15549 1: wrmsr /* Make changes effective */
15550
15551 /* Setup cr0 */
15552@@ -269,7 +266,7 @@ ENTRY(secondary_startup_64)
15553 bad_address:
15554 jmp bad_address
15555
15556- .section ".init.text","ax"
15557+ __INIT
15558 #ifdef CONFIG_EARLY_PRINTK
15559 .globl early_idt_handlers
15560 early_idt_handlers:
15561@@ -314,18 +311,23 @@ ENTRY(early_idt_handler)
15562 #endif /* EARLY_PRINTK */
15563 1: hlt
15564 jmp 1b
15565+ .previous
15566
15567 #ifdef CONFIG_EARLY_PRINTK
15568+ __INITDATA
15569 early_recursion_flag:
15570 .long 0
15571+ .previous
15572
15573+ .section .rodata,"a",@progbits
15574 early_idt_msg:
15575 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15576 early_idt_ripmsg:
15577 .asciz "RIP %s\n"
15578-#endif /* CONFIG_EARLY_PRINTK */
15579 .previous
15580+#endif /* CONFIG_EARLY_PRINTK */
15581
15582+ .section .rodata,"a",@progbits
15583 #define NEXT_PAGE(name) \
15584 .balign PAGE_SIZE; \
15585 ENTRY(name)
15586@@ -338,7 +340,6 @@ ENTRY(name)
15587 i = i + 1 ; \
15588 .endr
15589
15590- .data
15591 /*
15592 * This default setting generates an ident mapping at address 0x100000
15593 * and a mapping for the kernel that precisely maps virtual address
15594@@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt)
15595 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15596 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15597 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15598+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15599+ .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
15600+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15601+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15602 .org init_level4_pgt + L4_START_KERNEL*8, 0
15603 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15604 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15605
15606+#ifdef CONFIG_PAX_PER_CPU_PGD
15607+NEXT_PAGE(cpu_pgd)
15608+ .rept NR_CPUS
15609+ .fill 512,8,0
15610+ .endr
15611+#endif
15612+
15613 NEXT_PAGE(level3_ident_pgt)
15614 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15615+#ifdef CONFIG_XEN
15616 .fill 511,8,0
15617+#else
15618+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15619+ .fill 510,8,0
15620+#endif
15621+
15622+NEXT_PAGE(level3_vmalloc_pgt)
15623+ .fill 512,8,0
15624+
15625+NEXT_PAGE(level3_vmemmap_pgt)
15626+ .fill L3_VMEMMAP_START,8,0
15627+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15628
15629 NEXT_PAGE(level3_kernel_pgt)
15630 .fill L3_START_KERNEL,8,0
15631@@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt)
15632 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15633 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15634
15635+NEXT_PAGE(level2_vmemmap_pgt)
15636+ .fill 512,8,0
15637+
15638 NEXT_PAGE(level2_fixmap_pgt)
15639- .fill 506,8,0
15640- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15641- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15642- .fill 5,8,0
15643+ .fill 507,8,0
15644+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15645+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15646+ .fill 4,8,0
15647
15648-NEXT_PAGE(level1_fixmap_pgt)
15649+NEXT_PAGE(level1_vsyscall_pgt)
15650 .fill 512,8,0
15651
15652-NEXT_PAGE(level2_ident_pgt)
15653- /* Since I easily can, map the first 1G.
15654+ /* Since I easily can, map the first 2G.
15655 * Don't set NX because code runs from these pages.
15656 */
15657- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15658+NEXT_PAGE(level2_ident_pgt)
15659+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15660
15661 NEXT_PAGE(level2_kernel_pgt)
15662 /*
15663@@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt)
15664 * If you want to increase this then increase MODULES_VADDR
15665 * too.)
15666 */
15667- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15668- KERNEL_IMAGE_SIZE/PMD_SIZE)
15669-
15670-NEXT_PAGE(level2_spare_pgt)
15671- .fill 512, 8, 0
15672+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15673
15674 #undef PMDS
15675 #undef NEXT_PAGE
15676
15677- .data
15678+ .align PAGE_SIZE
15679+ENTRY(cpu_gdt_table)
15680+ .rept NR_CPUS
15681+ .quad 0x0000000000000000 /* NULL descriptor */
15682+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15683+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15684+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15685+ .quad 0x00cffb000000ffff /* __USER32_CS */
15686+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15687+ .quad 0x00affb000000ffff /* __USER_CS */
15688+
15689+#ifdef CONFIG_PAX_KERNEXEC
15690+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15691+#else
15692+ .quad 0x0 /* unused */
15693+#endif
15694+
15695+ .quad 0,0 /* TSS */
15696+ .quad 0,0 /* LDT */
15697+ .quad 0,0,0 /* three TLS descriptors */
15698+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15699+ /* asm/segment.h:GDT_ENTRIES must match this */
15700+
15701+ /* zero the remaining page */
15702+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15703+ .endr
15704+
15705 .align 16
15706 .globl early_gdt_descr
15707 early_gdt_descr:
15708 .word GDT_ENTRIES*8-1
15709 early_gdt_descr_base:
15710- .quad INIT_PER_CPU_VAR(gdt_page)
15711+ .quad cpu_gdt_table
15712
15713 ENTRY(phys_base)
15714 /* This must match the first entry in level2_kernel_pgt */
15715 .quad 0x0000000000000000
15716
15717 #include "../../x86/xen/xen-head.S"
15718-
15719- .section .bss, "aw", @nobits
15720+
15721+ .section .rodata,"a",@progbits
15722 .align L1_CACHE_BYTES
15723 ENTRY(idt_table)
15724- .skip IDT_ENTRIES * 16
15725+ .fill 512,8,0
15726
15727 __PAGE_ALIGNED_BSS
15728 .align PAGE_SIZE
15729diff -urNp linux-2.6.39.2/arch/x86/kernel/i386_ksyms_32.c linux-2.6.39.2/arch/x86/kernel/i386_ksyms_32.c
15730--- linux-2.6.39.2/arch/x86/kernel/i386_ksyms_32.c 2011-05-19 00:06:34.000000000 -0400
15731+++ linux-2.6.39.2/arch/x86/kernel/i386_ksyms_32.c 2011-05-22 19:36:30.000000000 -0400
15732@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15733 EXPORT_SYMBOL(cmpxchg8b_emu);
15734 #endif
15735
15736+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15737+
15738 /* Networking helper routines. */
15739 EXPORT_SYMBOL(csum_partial_copy_generic);
15740+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15741+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15742
15743 EXPORT_SYMBOL(__get_user_1);
15744 EXPORT_SYMBOL(__get_user_2);
15745@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15746
15747 EXPORT_SYMBOL(csum_partial);
15748 EXPORT_SYMBOL(empty_zero_page);
15749+
15750+#ifdef CONFIG_PAX_KERNEXEC
15751+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15752+#endif
15753diff -urNp linux-2.6.39.2/arch/x86/kernel/i8259.c linux-2.6.39.2/arch/x86/kernel/i8259.c
15754--- linux-2.6.39.2/arch/x86/kernel/i8259.c 2011-05-19 00:06:34.000000000 -0400
15755+++ linux-2.6.39.2/arch/x86/kernel/i8259.c 2011-05-22 19:36:30.000000000 -0400
15756@@ -210,7 +210,7 @@ spurious_8259A_irq:
15757 "spurious 8259A interrupt: IRQ%d.\n", irq);
15758 spurious_irq_mask |= irqmask;
15759 }
15760- atomic_inc(&irq_err_count);
15761+ atomic_inc_unchecked(&irq_err_count);
15762 /*
15763 * Theoretically we do not have to handle this IRQ,
15764 * but in Linux this does not cause problems and is
15765diff -urNp linux-2.6.39.2/arch/x86/kernel/init_task.c linux-2.6.39.2/arch/x86/kernel/init_task.c
15766--- linux-2.6.39.2/arch/x86/kernel/init_task.c 2011-05-19 00:06:34.000000000 -0400
15767+++ linux-2.6.39.2/arch/x86/kernel/init_task.c 2011-05-22 19:36:30.000000000 -0400
15768@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
15769 * way process stacks are handled. This is done by having a special
15770 * "init_task" linker map entry..
15771 */
15772-union thread_union init_thread_union __init_task_data =
15773- { INIT_THREAD_INFO(init_task) };
15774+union thread_union init_thread_union __init_task_data;
15775
15776 /*
15777 * Initial task structure.
15778@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15779 * section. Since TSS's are completely CPU-local, we want them
15780 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15781 */
15782-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15783-
15784+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15785+EXPORT_SYMBOL(init_tss);
15786diff -urNp linux-2.6.39.2/arch/x86/kernel/ioport.c linux-2.6.39.2/arch/x86/kernel/ioport.c
15787--- linux-2.6.39.2/arch/x86/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
15788+++ linux-2.6.39.2/arch/x86/kernel/ioport.c 2011-05-22 19:41:32.000000000 -0400
15789@@ -6,6 +6,7 @@
15790 #include <linux/sched.h>
15791 #include <linux/kernel.h>
15792 #include <linux/capability.h>
15793+#include <linux/security.h>
15794 #include <linux/errno.h>
15795 #include <linux/types.h>
15796 #include <linux/ioport.h>
15797@@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long
15798
15799 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15800 return -EINVAL;
15801+#ifdef CONFIG_GRKERNSEC_IO
15802+ if (turn_on && grsec_disable_privio) {
15803+ gr_handle_ioperm();
15804+ return -EPERM;
15805+ }
15806+#endif
15807 if (turn_on && !capable(CAP_SYS_RAWIO))
15808 return -EPERM;
15809
15810@@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long
15811 * because the ->io_bitmap_max value must match the bitmap
15812 * contents:
15813 */
15814- tss = &per_cpu(init_tss, get_cpu());
15815+ tss = init_tss + get_cpu();
15816
15817 if (turn_on)
15818 bitmap_clear(t->io_bitmap_ptr, from, num);
15819@@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct
15820 return -EINVAL;
15821 /* Trying to gain more privileges? */
15822 if (level > old) {
15823+#ifdef CONFIG_GRKERNSEC_IO
15824+ if (grsec_disable_privio) {
15825+ gr_handle_iopl();
15826+ return -EPERM;
15827+ }
15828+#endif
15829 if (!capable(CAP_SYS_RAWIO))
15830 return -EPERM;
15831 }
15832diff -urNp linux-2.6.39.2/arch/x86/kernel/irq_32.c linux-2.6.39.2/arch/x86/kernel/irq_32.c
15833--- linux-2.6.39.2/arch/x86/kernel/irq_32.c 2011-05-19 00:06:34.000000000 -0400
15834+++ linux-2.6.39.2/arch/x86/kernel/irq_32.c 2011-05-22 19:36:30.000000000 -0400
15835@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15836 __asm__ __volatile__("andl %%esp,%0" :
15837 "=r" (sp) : "0" (THREAD_SIZE - 1));
15838
15839- return sp < (sizeof(struct thread_info) + STACK_WARN);
15840+ return sp < STACK_WARN;
15841 }
15842
15843 static void print_stack_overflow(void)
15844@@ -54,8 +54,8 @@ static inline void print_stack_overflow(
15845 * per-CPU IRQ handling contexts (thread information and stack)
15846 */
15847 union irq_ctx {
15848- struct thread_info tinfo;
15849- u32 stack[THREAD_SIZE/sizeof(u32)];
15850+ unsigned long previous_esp;
15851+ u32 stack[THREAD_SIZE/sizeof(u32)];
15852 } __attribute__((aligned(THREAD_SIZE)));
15853
15854 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15855@@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
15856 static inline int
15857 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15858 {
15859- union irq_ctx *curctx, *irqctx;
15860+ union irq_ctx *irqctx;
15861 u32 *isp, arg1, arg2;
15862
15863- curctx = (union irq_ctx *) current_thread_info();
15864 irqctx = __this_cpu_read(hardirq_ctx);
15865
15866 /*
15867@@ -87,21 +86,17 @@ execute_on_irq_stack(int overflow, struc
15868 * handler) we can't do that and just have to keep using the
15869 * current stack (which is the irq stack already after all)
15870 */
15871- if (unlikely(curctx == irqctx))
15872+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15873 return 0;
15874
15875 /* build the stack frame on the IRQ stack */
15876- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15877- irqctx->tinfo.task = curctx->tinfo.task;
15878- irqctx->tinfo.previous_esp = current_stack_pointer;
15879+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15880+ irqctx->previous_esp = current_stack_pointer;
15881+ add_preempt_count(HARDIRQ_OFFSET);
15882
15883- /*
15884- * Copy the softirq bits in preempt_count so that the
15885- * softirq checks work in the hardirq context.
15886- */
15887- irqctx->tinfo.preempt_count =
15888- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15889- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15890+#ifdef CONFIG_PAX_MEMORY_UDEREF
15891+ __set_fs(MAKE_MM_SEG(0));
15892+#endif
15893
15894 if (unlikely(overflow))
15895 call_on_stack(print_stack_overflow, isp);
15896@@ -113,6 +108,12 @@ execute_on_irq_stack(int overflow, struc
15897 : "0" (irq), "1" (desc), "2" (isp),
15898 "D" (desc->handle_irq)
15899 : "memory", "cc", "ecx");
15900+
15901+#ifdef CONFIG_PAX_MEMORY_UDEREF
15902+ __set_fs(current_thread_info()->addr_limit);
15903+#endif
15904+
15905+ sub_preempt_count(HARDIRQ_OFFSET);
15906 return 1;
15907 }
15908
15909@@ -121,29 +122,11 @@ execute_on_irq_stack(int overflow, struc
15910 */
15911 void __cpuinit irq_ctx_init(int cpu)
15912 {
15913- union irq_ctx *irqctx;
15914-
15915 if (per_cpu(hardirq_ctx, cpu))
15916 return;
15917
15918- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15919- THREAD_FLAGS,
15920- THREAD_ORDER));
15921- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15922- irqctx->tinfo.cpu = cpu;
15923- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15924- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15925-
15926- per_cpu(hardirq_ctx, cpu) = irqctx;
15927-
15928- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15929- THREAD_FLAGS,
15930- THREAD_ORDER));
15931- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15932- irqctx->tinfo.cpu = cpu;
15933- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15934-
15935- per_cpu(softirq_ctx, cpu) = irqctx;
15936+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15937+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15938
15939 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15940 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15941@@ -152,7 +135,6 @@ void __cpuinit irq_ctx_init(int cpu)
15942 asmlinkage void do_softirq(void)
15943 {
15944 unsigned long flags;
15945- struct thread_info *curctx;
15946 union irq_ctx *irqctx;
15947 u32 *isp;
15948
15949@@ -162,15 +144,22 @@ asmlinkage void do_softirq(void)
15950 local_irq_save(flags);
15951
15952 if (local_softirq_pending()) {
15953- curctx = current_thread_info();
15954 irqctx = __this_cpu_read(softirq_ctx);
15955- irqctx->tinfo.task = curctx->task;
15956- irqctx->tinfo.previous_esp = current_stack_pointer;
15957+ irqctx->previous_esp = current_stack_pointer;
15958
15959 /* build the stack frame on the softirq stack */
15960- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15961+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15962+
15963+#ifdef CONFIG_PAX_MEMORY_UDEREF
15964+ __set_fs(MAKE_MM_SEG(0));
15965+#endif
15966
15967 call_on_stack(__do_softirq, isp);
15968+
15969+#ifdef CONFIG_PAX_MEMORY_UDEREF
15970+ __set_fs(current_thread_info()->addr_limit);
15971+#endif
15972+
15973 /*
15974 * Shouldn't happen, we returned above if in_interrupt():
15975 */
15976diff -urNp linux-2.6.39.2/arch/x86/kernel/irq.c linux-2.6.39.2/arch/x86/kernel/irq.c
15977--- linux-2.6.39.2/arch/x86/kernel/irq.c 2011-05-19 00:06:34.000000000 -0400
15978+++ linux-2.6.39.2/arch/x86/kernel/irq.c 2011-05-22 19:36:30.000000000 -0400
15979@@ -17,7 +17,7 @@
15980 #include <asm/mce.h>
15981 #include <asm/hw_irq.h>
15982
15983-atomic_t irq_err_count;
15984+atomic_unchecked_t irq_err_count;
15985
15986 /* Function pointer for generic interrupt vector handling */
15987 void (*x86_platform_ipi_callback)(void) = NULL;
15988@@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file
15989 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15990 seq_printf(p, " Machine check polls\n");
15991 #endif
15992- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15993+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15994 #if defined(CONFIG_X86_IO_APIC)
15995- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15996+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15997 #endif
15998 return 0;
15999 }
16000@@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
16001
16002 u64 arch_irq_stat(void)
16003 {
16004- u64 sum = atomic_read(&irq_err_count);
16005+ u64 sum = atomic_read_unchecked(&irq_err_count);
16006
16007 #ifdef CONFIG_X86_IO_APIC
16008- sum += atomic_read(&irq_mis_count);
16009+ sum += atomic_read_unchecked(&irq_mis_count);
16010 #endif
16011 return sum;
16012 }
16013diff -urNp linux-2.6.39.2/arch/x86/kernel/kgdb.c linux-2.6.39.2/arch/x86/kernel/kgdb.c
16014--- linux-2.6.39.2/arch/x86/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
16015+++ linux-2.6.39.2/arch/x86/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
16016@@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem,
16017 #ifdef CONFIG_X86_32
16018 switch (regno) {
16019 case GDB_SS:
16020- if (!user_mode_vm(regs))
16021+ if (!user_mode(regs))
16022 *(unsigned long *)mem = __KERNEL_DS;
16023 break;
16024 case GDB_SP:
16025- if (!user_mode_vm(regs))
16026+ if (!user_mode(regs))
16027 *(unsigned long *)mem = kernel_stack_pointer(regs);
16028 break;
16029 case GDB_GS:
16030@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
16031 case 'k':
16032 /* clear the trace bit */
16033 linux_regs->flags &= ~X86_EFLAGS_TF;
16034- atomic_set(&kgdb_cpu_doing_single_step, -1);
16035+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
16036
16037 /* set the trace bit if we're stepping */
16038 if (remcomInBuffer[0] == 's') {
16039 linux_regs->flags |= X86_EFLAGS_TF;
16040- atomic_set(&kgdb_cpu_doing_single_step,
16041+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
16042 raw_smp_processor_id());
16043 }
16044
16045@@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args
16046 return NOTIFY_DONE;
16047
16048 case DIE_DEBUG:
16049- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
16050+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
16051 if (user_mode(regs))
16052 return single_step_cont(regs, args);
16053 break;
16054@@ -710,7 +710,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
16055 regs->ip = ip;
16056 }
16057
16058-struct kgdb_arch arch_kgdb_ops = {
16059+const struct kgdb_arch arch_kgdb_ops = {
16060 /* Breakpoint instruction: */
16061 .gdb_bpt_instr = { 0xcc },
16062 .flags = KGDB_HW_BREAKPOINT,
16063diff -urNp linux-2.6.39.2/arch/x86/kernel/kprobes.c linux-2.6.39.2/arch/x86/kernel/kprobes.c
16064--- linux-2.6.39.2/arch/x86/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
16065+++ linux-2.6.39.2/arch/x86/kernel/kprobes.c 2011-05-22 19:36:30.000000000 -0400
16066@@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat
16067 } __attribute__((packed)) *insn;
16068
16069 insn = (struct __arch_relative_insn *)from;
16070+
16071+ pax_open_kernel();
16072 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
16073 insn->op = op;
16074+ pax_close_kernel();
16075 }
16076
16077 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
16078@@ -153,7 +156,7 @@ static int __kprobes can_boost(kprobe_op
16079 kprobe_opcode_t opcode;
16080 kprobe_opcode_t *orig_opcodes = opcodes;
16081
16082- if (search_exception_tables((unsigned long)opcodes))
16083+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
16084 return 0; /* Page fault may occur on this address. */
16085
16086 retry:
16087@@ -314,7 +317,9 @@ static int __kprobes __copy_instruction(
16088 }
16089 }
16090 insn_get_length(&insn);
16091+ pax_open_kernel();
16092 memcpy(dest, insn.kaddr, insn.length);
16093+ pax_close_kernel();
16094
16095 #ifdef CONFIG_X86_64
16096 if (insn_rip_relative(&insn)) {
16097@@ -338,7 +343,9 @@ static int __kprobes __copy_instruction(
16098 (u8 *) dest;
16099 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
16100 disp = (u8 *) dest + insn_offset_displacement(&insn);
16101+ pax_open_kernel();
16102 *(s32 *) disp = (s32) newdisp;
16103+ pax_close_kernel();
16104 }
16105 #endif
16106 return insn.length;
16107@@ -352,12 +359,12 @@ static void __kprobes arch_copy_kprobe(s
16108 */
16109 __copy_instruction(p->ainsn.insn, p->addr, 0);
16110
16111- if (can_boost(p->addr))
16112+ if (can_boost(ktla_ktva(p->addr)))
16113 p->ainsn.boostable = 0;
16114 else
16115 p->ainsn.boostable = -1;
16116
16117- p->opcode = *p->addr;
16118+ p->opcode = *(ktla_ktva(p->addr));
16119 }
16120
16121 int __kprobes arch_prepare_kprobe(struct kprobe *p)
16122@@ -474,7 +481,7 @@ static void __kprobes setup_singlestep(s
16123 * nor set current_kprobe, because it doesn't use single
16124 * stepping.
16125 */
16126- regs->ip = (unsigned long)p->ainsn.insn;
16127+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
16128 preempt_enable_no_resched();
16129 return;
16130 }
16131@@ -493,7 +500,7 @@ static void __kprobes setup_singlestep(s
16132 if (p->opcode == BREAKPOINT_INSTRUCTION)
16133 regs->ip = (unsigned long)p->addr;
16134 else
16135- regs->ip = (unsigned long)p->ainsn.insn;
16136+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
16137 }
16138
16139 /*
16140@@ -572,7 +579,7 @@ static int __kprobes kprobe_handler(stru
16141 setup_singlestep(p, regs, kcb, 0);
16142 return 1;
16143 }
16144- } else if (*addr != BREAKPOINT_INSTRUCTION) {
16145+ } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
16146 /*
16147 * The breakpoint instruction was removed right
16148 * after we hit it. Another cpu has removed
16149@@ -817,7 +824,7 @@ static void __kprobes resume_execution(s
16150 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
16151 {
16152 unsigned long *tos = stack_addr(regs);
16153- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
16154+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
16155 unsigned long orig_ip = (unsigned long)p->addr;
16156 kprobe_opcode_t *insn = p->ainsn.insn;
16157
16158@@ -999,7 +1006,7 @@ int __kprobes kprobe_exceptions_notify(s
16159 struct die_args *args = data;
16160 int ret = NOTIFY_DONE;
16161
16162- if (args->regs && user_mode_vm(args->regs))
16163+ if (args->regs && user_mode(args->regs))
16164 return ret;
16165
16166 switch (val) {
16167@@ -1381,7 +1388,7 @@ int __kprobes arch_prepare_optimized_kpr
16168 * Verify if the address gap is in 2GB range, because this uses
16169 * a relative jump.
16170 */
16171- rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
16172+ rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
16173 if (abs(rel) > 0x7fffffff)
16174 return -ERANGE;
16175
16176@@ -1402,11 +1409,11 @@ int __kprobes arch_prepare_optimized_kpr
16177 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
16178
16179 /* Set probe function call */
16180- synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
16181+ synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
16182
16183 /* Set returning jmp instruction at the tail of out-of-line buffer */
16184 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
16185- (u8 *)op->kp.addr + op->optinsn.size);
16186+ (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
16187
16188 flush_icache_range((unsigned long) buf,
16189 (unsigned long) buf + TMPL_END_IDX +
16190@@ -1428,7 +1435,7 @@ static void __kprobes setup_optimize_kpr
16191 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
16192
16193 /* Backup instructions which will be replaced by jump address */
16194- memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
16195+ memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
16196 RELATIVE_ADDR_SIZE);
16197
16198 insn_buf[0] = RELATIVEJUMP_OPCODE;
16199diff -urNp linux-2.6.39.2/arch/x86/kernel/ldt.c linux-2.6.39.2/arch/x86/kernel/ldt.c
16200--- linux-2.6.39.2/arch/x86/kernel/ldt.c 2011-05-19 00:06:34.000000000 -0400
16201+++ linux-2.6.39.2/arch/x86/kernel/ldt.c 2011-05-22 19:36:30.000000000 -0400
16202@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
16203 if (reload) {
16204 #ifdef CONFIG_SMP
16205 preempt_disable();
16206- load_LDT(pc);
16207+ load_LDT_nolock(pc);
16208 if (!cpumask_equal(mm_cpumask(current->mm),
16209 cpumask_of(smp_processor_id())))
16210 smp_call_function(flush_ldt, current->mm, 1);
16211 preempt_enable();
16212 #else
16213- load_LDT(pc);
16214+ load_LDT_nolock(pc);
16215 #endif
16216 }
16217 if (oldsize) {
16218@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t
16219 return err;
16220
16221 for (i = 0; i < old->size; i++)
16222- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
16223+ write_ldt_entry(new->ldt, i, old->ldt + i);
16224 return 0;
16225 }
16226
16227@@ -116,6 +116,24 @@ int init_new_context(struct task_struct
16228 retval = copy_ldt(&mm->context, &old_mm->context);
16229 mutex_unlock(&old_mm->context.lock);
16230 }
16231+
16232+ if (tsk == current) {
16233+ mm->context.vdso = 0;
16234+
16235+#ifdef CONFIG_X86_32
16236+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
16237+ mm->context.user_cs_base = 0UL;
16238+ mm->context.user_cs_limit = ~0UL;
16239+
16240+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
16241+ cpus_clear(mm->context.cpu_user_cs_mask);
16242+#endif
16243+
16244+#endif
16245+#endif
16246+
16247+ }
16248+
16249 return retval;
16250 }
16251
16252@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u
16253 }
16254 }
16255
16256+#ifdef CONFIG_PAX_SEGMEXEC
16257+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
16258+ error = -EINVAL;
16259+ goto out_unlock;
16260+ }
16261+#endif
16262+
16263 fill_ldt(&ldt, &ldt_info);
16264 if (oldmode)
16265 ldt.avl = 0;
16266diff -urNp linux-2.6.39.2/arch/x86/kernel/machine_kexec_32.c linux-2.6.39.2/arch/x86/kernel/machine_kexec_32.c
16267--- linux-2.6.39.2/arch/x86/kernel/machine_kexec_32.c 2011-05-19 00:06:34.000000000 -0400
16268+++ linux-2.6.39.2/arch/x86/kernel/machine_kexec_32.c 2011-05-22 19:36:30.000000000 -0400
16269@@ -27,7 +27,7 @@
16270 #include <asm/cacheflush.h>
16271 #include <asm/debugreg.h>
16272
16273-static void set_idt(void *newidt, __u16 limit)
16274+static void set_idt(struct desc_struct *newidt, __u16 limit)
16275 {
16276 struct desc_ptr curidt;
16277
16278@@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
16279 }
16280
16281
16282-static void set_gdt(void *newgdt, __u16 limit)
16283+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
16284 {
16285 struct desc_ptr curgdt;
16286
16287@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
16288 }
16289
16290 control_page = page_address(image->control_code_page);
16291- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
16292+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
16293
16294 relocate_kernel_ptr = control_page;
16295 page_list[PA_CONTROL_PAGE] = __pa(control_page);
16296diff -urNp linux-2.6.39.2/arch/x86/kernel/microcode_amd.c linux-2.6.39.2/arch/x86/kernel/microcode_amd.c
16297--- linux-2.6.39.2/arch/x86/kernel/microcode_amd.c 2011-05-19 00:06:34.000000000 -0400
16298+++ linux-2.6.39.2/arch/x86/kernel/microcode_amd.c 2011-05-22 19:36:30.000000000 -0400
16299@@ -339,7 +339,7 @@ static void microcode_fini_cpu_amd(int c
16300 uci->mc = NULL;
16301 }
16302
16303-static struct microcode_ops microcode_amd_ops = {
16304+static const struct microcode_ops microcode_amd_ops = {
16305 .request_microcode_user = request_microcode_user,
16306 .request_microcode_fw = request_microcode_amd,
16307 .collect_cpu_info = collect_cpu_info_amd,
16308@@ -347,7 +347,7 @@ static struct microcode_ops microcode_am
16309 .microcode_fini_cpu = microcode_fini_cpu_amd,
16310 };
16311
16312-struct microcode_ops * __init init_amd_microcode(void)
16313+const struct microcode_ops * __init init_amd_microcode(void)
16314 {
16315 return &microcode_amd_ops;
16316 }
16317diff -urNp linux-2.6.39.2/arch/x86/kernel/microcode_core.c linux-2.6.39.2/arch/x86/kernel/microcode_core.c
16318--- linux-2.6.39.2/arch/x86/kernel/microcode_core.c 2011-05-19 00:06:34.000000000 -0400
16319+++ linux-2.6.39.2/arch/x86/kernel/microcode_core.c 2011-05-22 19:36:30.000000000 -0400
16320@@ -93,7 +93,7 @@ MODULE_LICENSE("GPL");
16321
16322 #define MICROCODE_VERSION "2.00"
16323
16324-static struct microcode_ops *microcode_ops;
16325+static const struct microcode_ops *microcode_ops;
16326
16327 /*
16328 * Synchronization.
16329diff -urNp linux-2.6.39.2/arch/x86/kernel/microcode_intel.c linux-2.6.39.2/arch/x86/kernel/microcode_intel.c
16330--- linux-2.6.39.2/arch/x86/kernel/microcode_intel.c 2011-05-19 00:06:34.000000000 -0400
16331+++ linux-2.6.39.2/arch/x86/kernel/microcode_intel.c 2011-05-22 19:36:30.000000000 -0400
16332@@ -440,13 +440,13 @@ static enum ucode_state request_microcod
16333
16334 static int get_ucode_user(void *to, const void *from, size_t n)
16335 {
16336- return copy_from_user(to, from, n);
16337+ return copy_from_user(to, (__force const void __user *)from, n);
16338 }
16339
16340 static enum ucode_state
16341 request_microcode_user(int cpu, const void __user *buf, size_t size)
16342 {
16343- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
16344+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
16345 }
16346
16347 static void microcode_fini_cpu(int cpu)
16348@@ -457,7 +457,7 @@ static void microcode_fini_cpu(int cpu)
16349 uci->mc = NULL;
16350 }
16351
16352-static struct microcode_ops microcode_intel_ops = {
16353+static const struct microcode_ops microcode_intel_ops = {
16354 .request_microcode_user = request_microcode_user,
16355 .request_microcode_fw = request_microcode_fw,
16356 .collect_cpu_info = collect_cpu_info,
16357@@ -465,7 +465,7 @@ static struct microcode_ops microcode_in
16358 .microcode_fini_cpu = microcode_fini_cpu,
16359 };
16360
16361-struct microcode_ops * __init init_intel_microcode(void)
16362+const struct microcode_ops * __init init_intel_microcode(void)
16363 {
16364 return &microcode_intel_ops;
16365 }
16366diff -urNp linux-2.6.39.2/arch/x86/kernel/module.c linux-2.6.39.2/arch/x86/kernel/module.c
16367--- linux-2.6.39.2/arch/x86/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
16368+++ linux-2.6.39.2/arch/x86/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
16369@@ -35,21 +35,66 @@
16370 #define DEBUGP(fmt...)
16371 #endif
16372
16373-void *module_alloc(unsigned long size)
16374+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
16375 {
16376 if (PAGE_ALIGN(size) > MODULES_LEN)
16377 return NULL;
16378 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
16379- GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
16380+ GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
16381 -1, __builtin_return_address(0));
16382 }
16383
16384+void *module_alloc(unsigned long size)
16385+{
16386+
16387+#ifdef CONFIG_PAX_KERNEXEC
16388+ return __module_alloc(size, PAGE_KERNEL);
16389+#else
16390+ return __module_alloc(size, PAGE_KERNEL_EXEC);
16391+#endif
16392+
16393+}
16394+
16395 /* Free memory returned from module_alloc */
16396 void module_free(struct module *mod, void *module_region)
16397 {
16398 vfree(module_region);
16399 }
16400
16401+#ifdef CONFIG_PAX_KERNEXEC
16402+#ifdef CONFIG_X86_32
16403+void *module_alloc_exec(unsigned long size)
16404+{
16405+ struct vm_struct *area;
16406+
16407+ if (size == 0)
16408+ return NULL;
16409+
16410+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
16411+ return area ? area->addr : NULL;
16412+}
16413+EXPORT_SYMBOL(module_alloc_exec);
16414+
16415+void module_free_exec(struct module *mod, void *module_region)
16416+{
16417+ vunmap(module_region);
16418+}
16419+EXPORT_SYMBOL(module_free_exec);
16420+#else
16421+void module_free_exec(struct module *mod, void *module_region)
16422+{
16423+ module_free(mod, module_region);
16424+}
16425+EXPORT_SYMBOL(module_free_exec);
16426+
16427+void *module_alloc_exec(unsigned long size)
16428+{
16429+ return __module_alloc(size, PAGE_KERNEL_RX);
16430+}
16431+EXPORT_SYMBOL(module_alloc_exec);
16432+#endif
16433+#endif
16434+
16435 /* We don't need anything special. */
16436 int module_frob_arch_sections(Elf_Ehdr *hdr,
16437 Elf_Shdr *sechdrs,
16438@@ -69,14 +114,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16439 unsigned int i;
16440 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
16441 Elf32_Sym *sym;
16442- uint32_t *location;
16443+ uint32_t *plocation, location;
16444
16445 DEBUGP("Applying relocate section %u to %u\n", relsec,
16446 sechdrs[relsec].sh_info);
16447 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
16448 /* This is where to make the change */
16449- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
16450- + rel[i].r_offset;
16451+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
16452+ location = (uint32_t)plocation;
16453+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
16454+ plocation = ktla_ktva((void *)plocation);
16455 /* This is the symbol it is referring to. Note that all
16456 undefined symbols have been resolved. */
16457 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
16458@@ -85,11 +132,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16459 switch (ELF32_R_TYPE(rel[i].r_info)) {
16460 case R_386_32:
16461 /* We add the value into the location given */
16462- *location += sym->st_value;
16463+ pax_open_kernel();
16464+ *plocation += sym->st_value;
16465+ pax_close_kernel();
16466 break;
16467 case R_386_PC32:
16468 /* Add the value, subtract its postition */
16469- *location += sym->st_value - (uint32_t)location;
16470+ pax_open_kernel();
16471+ *plocation += sym->st_value - location;
16472+ pax_close_kernel();
16473 break;
16474 default:
16475 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
16476@@ -145,21 +196,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
16477 case R_X86_64_NONE:
16478 break;
16479 case R_X86_64_64:
16480+ pax_open_kernel();
16481 *(u64 *)loc = val;
16482+ pax_close_kernel();
16483 break;
16484 case R_X86_64_32:
16485+ pax_open_kernel();
16486 *(u32 *)loc = val;
16487+ pax_close_kernel();
16488 if (val != *(u32 *)loc)
16489 goto overflow;
16490 break;
16491 case R_X86_64_32S:
16492+ pax_open_kernel();
16493 *(s32 *)loc = val;
16494+ pax_close_kernel();
16495 if ((s64)val != *(s32 *)loc)
16496 goto overflow;
16497 break;
16498 case R_X86_64_PC32:
16499 val -= (u64)loc;
16500+ pax_open_kernel();
16501 *(u32 *)loc = val;
16502+ pax_close_kernel();
16503+
16504 #if 0
16505 if ((s64)val != *(s32 *)loc)
16506 goto overflow;
16507diff -urNp linux-2.6.39.2/arch/x86/kernel/paravirt.c linux-2.6.39.2/arch/x86/kernel/paravirt.c
16508--- linux-2.6.39.2/arch/x86/kernel/paravirt.c 2011-05-19 00:06:34.000000000 -0400
16509+++ linux-2.6.39.2/arch/x86/kernel/paravirt.c 2011-05-22 19:36:30.000000000 -0400
16510@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
16511 * corresponding structure. */
16512 static void *get_call_destination(u8 type)
16513 {
16514- struct paravirt_patch_template tmpl = {
16515+ const struct paravirt_patch_template tmpl = {
16516 .pv_init_ops = pv_init_ops,
16517 .pv_time_ops = pv_time_ops,
16518 .pv_cpu_ops = pv_cpu_ops,
16519@@ -133,6 +133,9 @@ static void *get_call_destination(u8 typ
16520 .pv_lock_ops = pv_lock_ops,
16521 #endif
16522 };
16523+
16524+ pax_track_stack();
16525+
16526 return *((void **)&tmpl + type);
16527 }
16528
16529@@ -145,14 +148,14 @@ unsigned paravirt_patch_default(u8 type,
16530 if (opfunc == NULL)
16531 /* If there's no function, patch it with a ud2a (BUG) */
16532 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16533- else if (opfunc == _paravirt_nop)
16534+ else if (opfunc == (void *)_paravirt_nop)
16535 /* If the operation is a nop, then nop the callsite */
16536 ret = paravirt_patch_nop();
16537
16538 /* identity functions just return their single argument */
16539- else if (opfunc == _paravirt_ident_32)
16540+ else if (opfunc == (void *)_paravirt_ident_32)
16541 ret = paravirt_patch_ident_32(insnbuf, len);
16542- else if (opfunc == _paravirt_ident_64)
16543+ else if (opfunc == (void *)_paravirt_ident_64)
16544 ret = paravirt_patch_ident_64(insnbuf, len);
16545
16546 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16547@@ -178,7 +181,7 @@ unsigned paravirt_patch_insns(void *insn
16548 if (insn_len > len || start == NULL)
16549 insn_len = len;
16550 else
16551- memcpy(insnbuf, start, insn_len);
16552+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16553
16554 return insn_len;
16555 }
16556@@ -294,22 +297,22 @@ void arch_flush_lazy_mmu_mode(void)
16557 preempt_enable();
16558 }
16559
16560-struct pv_info pv_info = {
16561+struct pv_info pv_info __read_only = {
16562 .name = "bare hardware",
16563 .paravirt_enabled = 0,
16564 .kernel_rpl = 0,
16565 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
16566 };
16567
16568-struct pv_init_ops pv_init_ops = {
16569+struct pv_init_ops pv_init_ops __read_only = {
16570 .patch = native_patch,
16571 };
16572
16573-struct pv_time_ops pv_time_ops = {
16574+struct pv_time_ops pv_time_ops __read_only = {
16575 .sched_clock = native_sched_clock,
16576 };
16577
16578-struct pv_irq_ops pv_irq_ops = {
16579+struct pv_irq_ops pv_irq_ops __read_only = {
16580 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16581 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16582 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16583@@ -321,7 +324,7 @@ struct pv_irq_ops pv_irq_ops = {
16584 #endif
16585 };
16586
16587-struct pv_cpu_ops pv_cpu_ops = {
16588+struct pv_cpu_ops pv_cpu_ops __read_only = {
16589 .cpuid = native_cpuid,
16590 .get_debugreg = native_get_debugreg,
16591 .set_debugreg = native_set_debugreg,
16592@@ -382,7 +385,7 @@ struct pv_cpu_ops pv_cpu_ops = {
16593 .end_context_switch = paravirt_nop,
16594 };
16595
16596-struct pv_apic_ops pv_apic_ops = {
16597+struct pv_apic_ops pv_apic_ops __read_only = {
16598 #ifdef CONFIG_X86_LOCAL_APIC
16599 .startup_ipi_hook = paravirt_nop,
16600 #endif
16601@@ -396,7 +399,7 @@ struct pv_apic_ops pv_apic_ops = {
16602 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16603 #endif
16604
16605-struct pv_mmu_ops pv_mmu_ops = {
16606+struct pv_mmu_ops pv_mmu_ops __read_only = {
16607
16608 .read_cr2 = native_read_cr2,
16609 .write_cr2 = native_write_cr2,
16610@@ -465,6 +468,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16611 },
16612
16613 .set_fixmap = native_set_fixmap,
16614+
16615+#ifdef CONFIG_PAX_KERNEXEC
16616+ .pax_open_kernel = native_pax_open_kernel,
16617+ .pax_close_kernel = native_pax_close_kernel,
16618+#endif
16619+
16620 };
16621
16622 EXPORT_SYMBOL_GPL(pv_time_ops);
16623diff -urNp linux-2.6.39.2/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.39.2/arch/x86/kernel/paravirt-spinlocks.c
16624--- linux-2.6.39.2/arch/x86/kernel/paravirt-spinlocks.c 2011-05-19 00:06:34.000000000 -0400
16625+++ linux-2.6.39.2/arch/x86/kernel/paravirt-spinlocks.c 2011-05-22 19:36:30.000000000 -0400
16626@@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
16627 arch_spin_lock(lock);
16628 }
16629
16630-struct pv_lock_ops pv_lock_ops = {
16631+struct pv_lock_ops pv_lock_ops __read_only = {
16632 #ifdef CONFIG_SMP
16633 .spin_is_locked = __ticket_spin_is_locked,
16634 .spin_is_contended = __ticket_spin_is_contended,
16635diff -urNp linux-2.6.39.2/arch/x86/kernel/pci-calgary_64.c linux-2.6.39.2/arch/x86/kernel/pci-calgary_64.c
16636--- linux-2.6.39.2/arch/x86/kernel/pci-calgary_64.c 2011-05-19 00:06:34.000000000 -0400
16637+++ linux-2.6.39.2/arch/x86/kernel/pci-calgary_64.c 2011-05-22 19:36:30.000000000 -0400
16638@@ -179,13 +179,13 @@ static void calioc2_dump_error_regs(stru
16639 static void calgary_init_bitmap_from_tce_table(struct iommu_table *tbl);
16640 static void get_tce_space_from_tar(void);
16641
16642-static struct cal_chipset_ops calgary_chip_ops = {
16643+static const struct cal_chipset_ops calgary_chip_ops = {
16644 .handle_quirks = calgary_handle_quirks,
16645 .tce_cache_blast = calgary_tce_cache_blast,
16646 .dump_error_regs = calgary_dump_error_regs
16647 };
16648
16649-static struct cal_chipset_ops calioc2_chip_ops = {
16650+static const struct cal_chipset_ops calioc2_chip_ops = {
16651 .handle_quirks = calioc2_handle_quirks,
16652 .tce_cache_blast = calioc2_tce_cache_blast,
16653 .dump_error_regs = calioc2_dump_error_regs
16654@@ -476,7 +476,7 @@ static void calgary_free_coherent(struct
16655 free_pages((unsigned long)vaddr, get_order(size));
16656 }
16657
16658-static struct dma_map_ops calgary_dma_ops = {
16659+static const struct dma_map_ops calgary_dma_ops = {
16660 .alloc_coherent = calgary_alloc_coherent,
16661 .free_coherent = calgary_free_coherent,
16662 .map_sg = calgary_map_sg,
16663diff -urNp linux-2.6.39.2/arch/x86/kernel/pci-dma.c linux-2.6.39.2/arch/x86/kernel/pci-dma.c
16664--- linux-2.6.39.2/arch/x86/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
16665+++ linux-2.6.39.2/arch/x86/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
16666@@ -16,7 +16,7 @@
16667
16668 static int forbid_dac __read_mostly;
16669
16670-struct dma_map_ops *dma_ops = &nommu_dma_ops;
16671+const struct dma_map_ops *dma_ops = &nommu_dma_ops;
16672 EXPORT_SYMBOL(dma_ops);
16673
16674 static int iommu_sac_force __read_mostly;
16675@@ -250,7 +250,7 @@ early_param("iommu", iommu_setup);
16676
16677 int dma_supported(struct device *dev, u64 mask)
16678 {
16679- struct dma_map_ops *ops = get_dma_ops(dev);
16680+ const struct dma_map_ops *ops = get_dma_ops(dev);
16681
16682 #ifdef CONFIG_PCI
16683 if (mask > 0xffffffff && forbid_dac > 0) {
16684diff -urNp linux-2.6.39.2/arch/x86/kernel/pci-gart_64.c linux-2.6.39.2/arch/x86/kernel/pci-gart_64.c
16685--- linux-2.6.39.2/arch/x86/kernel/pci-gart_64.c 2011-05-19 00:06:34.000000000 -0400
16686+++ linux-2.6.39.2/arch/x86/kernel/pci-gart_64.c 2011-05-22 19:36:30.000000000 -0400
16687@@ -695,7 +695,7 @@ static __init int init_amd_gatt(struct a
16688 return -1;
16689 }
16690
16691-static struct dma_map_ops gart_dma_ops = {
16692+static const struct dma_map_ops gart_dma_ops = {
16693 .map_sg = gart_map_sg,
16694 .unmap_sg = gart_unmap_sg,
16695 .map_page = gart_map_page,
16696diff -urNp linux-2.6.39.2/arch/x86/kernel/pci-iommu_table.c linux-2.6.39.2/arch/x86/kernel/pci-iommu_table.c
16697--- linux-2.6.39.2/arch/x86/kernel/pci-iommu_table.c 2011-05-19 00:06:34.000000000 -0400
16698+++ linux-2.6.39.2/arch/x86/kernel/pci-iommu_table.c 2011-05-22 19:36:30.000000000 -0400
16699@@ -2,7 +2,7 @@
16700 #include <asm/iommu_table.h>
16701 #include <linux/string.h>
16702 #include <linux/kallsyms.h>
16703-
16704+#include <linux/sched.h>
16705
16706 #define DEBUG 1
16707
16708@@ -53,6 +53,8 @@ void __init check_iommu_entries(struct i
16709 char sym_p[KSYM_SYMBOL_LEN];
16710 char sym_q[KSYM_SYMBOL_LEN];
16711
16712+ pax_track_stack();
16713+
16714 /* Simple cyclic dependency checker. */
16715 for (p = start; p < finish; p++) {
16716 q = find_dependents_of(start, finish, p);
16717diff -urNp linux-2.6.39.2/arch/x86/kernel/pci-nommu.c linux-2.6.39.2/arch/x86/kernel/pci-nommu.c
16718--- linux-2.6.39.2/arch/x86/kernel/pci-nommu.c 2011-05-19 00:06:34.000000000 -0400
16719+++ linux-2.6.39.2/arch/x86/kernel/pci-nommu.c 2011-05-22 19:36:30.000000000 -0400
16720@@ -95,7 +95,7 @@ static void nommu_sync_sg_for_device(str
16721 flush_write_buffers();
16722 }
16723
16724-struct dma_map_ops nommu_dma_ops = {
16725+const struct dma_map_ops nommu_dma_ops = {
16726 .alloc_coherent = dma_generic_alloc_coherent,
16727 .free_coherent = nommu_free_coherent,
16728 .map_sg = nommu_map_sg,
16729diff -urNp linux-2.6.39.2/arch/x86/kernel/pci-swiotlb.c linux-2.6.39.2/arch/x86/kernel/pci-swiotlb.c
16730--- linux-2.6.39.2/arch/x86/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
16731+++ linux-2.6.39.2/arch/x86/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
16732@@ -26,7 +26,7 @@ static void *x86_swiotlb_alloc_coherent(
16733 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
16734 }
16735
16736-static struct dma_map_ops swiotlb_dma_ops = {
16737+static const struct dma_map_ops swiotlb_dma_ops = {
16738 .mapping_error = swiotlb_dma_mapping_error,
16739 .alloc_coherent = x86_swiotlb_alloc_coherent,
16740 .free_coherent = swiotlb_free_coherent,
16741diff -urNp linux-2.6.39.2/arch/x86/kernel/process_32.c linux-2.6.39.2/arch/x86/kernel/process_32.c
16742--- linux-2.6.39.2/arch/x86/kernel/process_32.c 2011-06-25 12:55:22.000000000 -0400
16743+++ linux-2.6.39.2/arch/x86/kernel/process_32.c 2011-06-25 13:00:25.000000000 -0400
16744@@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
16745 unsigned long thread_saved_pc(struct task_struct *tsk)
16746 {
16747 return ((unsigned long *)tsk->thread.sp)[3];
16748+//XXX return tsk->thread.eip;
16749 }
16750
16751 #ifndef CONFIG_SMP
16752@@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i
16753 unsigned long sp;
16754 unsigned short ss, gs;
16755
16756- if (user_mode_vm(regs)) {
16757+ if (user_mode(regs)) {
16758 sp = regs->sp;
16759 ss = regs->ss & 0xffff;
16760- gs = get_user_gs(regs);
16761 } else {
16762 sp = kernel_stack_pointer(regs);
16763 savesegment(ss, ss);
16764- savesegment(gs, gs);
16765 }
16766+ gs = get_user_gs(regs);
16767
16768 show_regs_common();
16769
16770@@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
16771 struct task_struct *tsk;
16772 int err;
16773
16774- childregs = task_pt_regs(p);
16775+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16776 *childregs = *regs;
16777 childregs->ax = 0;
16778 childregs->sp = sp;
16779
16780 p->thread.sp = (unsigned long) childregs;
16781 p->thread.sp0 = (unsigned long) (childregs+1);
16782+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16783
16784 p->thread.ip = (unsigned long) ret_from_fork;
16785
16786@@ -292,7 +293,7 @@ __switch_to(struct task_struct *prev_p,
16787 struct thread_struct *prev = &prev_p->thread,
16788 *next = &next_p->thread;
16789 int cpu = smp_processor_id();
16790- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16791+ struct tss_struct *tss = init_tss + cpu;
16792 bool preload_fpu;
16793
16794 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16795@@ -327,6 +328,10 @@ __switch_to(struct task_struct *prev_p,
16796 */
16797 lazy_save_gs(prev->gs);
16798
16799+#ifdef CONFIG_PAX_MEMORY_UDEREF
16800+ __set_fs(task_thread_info(next_p)->addr_limit);
16801+#endif
16802+
16803 /*
16804 * Load the per-thread Thread-Local Storage descriptor.
16805 */
16806@@ -362,6 +367,9 @@ __switch_to(struct task_struct *prev_p,
16807 */
16808 arch_end_context_switch(next_p);
16809
16810+ percpu_write(current_task, next_p);
16811+ percpu_write(current_tinfo, &next_p->tinfo);
16812+
16813 if (preload_fpu)
16814 __math_state_restore();
16815
16816@@ -371,8 +379,6 @@ __switch_to(struct task_struct *prev_p,
16817 if (prev->gs | next->gs)
16818 lazy_load_gs(next->gs);
16819
16820- percpu_write(current_task, next_p);
16821-
16822 return prev_p;
16823 }
16824
16825@@ -402,4 +408,3 @@ unsigned long get_wchan(struct task_stru
16826 } while (count++ < 16);
16827 return 0;
16828 }
16829-
16830diff -urNp linux-2.6.39.2/arch/x86/kernel/process_64.c linux-2.6.39.2/arch/x86/kernel/process_64.c
16831--- linux-2.6.39.2/arch/x86/kernel/process_64.c 2011-06-25 12:55:22.000000000 -0400
16832+++ linux-2.6.39.2/arch/x86/kernel/process_64.c 2011-06-25 13:00:25.000000000 -0400
16833@@ -87,7 +87,7 @@ static void __exit_idle(void)
16834 void exit_idle(void)
16835 {
16836 /* idle loop has pid 0 */
16837- if (current->pid)
16838+ if (task_pid_nr(current))
16839 return;
16840 __exit_idle();
16841 }
16842@@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
16843 struct pt_regs *childregs;
16844 struct task_struct *me = current;
16845
16846- childregs = ((struct pt_regs *)
16847- (THREAD_SIZE + task_stack_page(p))) - 1;
16848+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16849 *childregs = *regs;
16850
16851 childregs->ax = 0;
16852@@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
16853 p->thread.sp = (unsigned long) childregs;
16854 p->thread.sp0 = (unsigned long) (childregs+1);
16855 p->thread.usersp = me->thread.usersp;
16856+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16857
16858 set_tsk_thread_flag(p, TIF_FORK);
16859
16860@@ -375,7 +375,7 @@ __switch_to(struct task_struct *prev_p,
16861 struct thread_struct *prev = &prev_p->thread;
16862 struct thread_struct *next = &next_p->thread;
16863 int cpu = smp_processor_id();
16864- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16865+ struct tss_struct *tss = init_tss + cpu;
16866 unsigned fsindex, gsindex;
16867 bool preload_fpu;
16868
16869@@ -471,10 +471,9 @@ __switch_to(struct task_struct *prev_p,
16870 prev->usersp = percpu_read(old_rsp);
16871 percpu_write(old_rsp, next->usersp);
16872 percpu_write(current_task, next_p);
16873+ percpu_write(current_tinfo, &next_p->tinfo);
16874
16875- percpu_write(kernel_stack,
16876- (unsigned long)task_stack_page(next_p) +
16877- THREAD_SIZE - KERNEL_STACK_OFFSET);
16878+ percpu_write(kernel_stack, next->sp0);
16879
16880 /*
16881 * Now maybe reload the debug registers and handle I/O bitmaps
16882@@ -536,12 +535,11 @@ unsigned long get_wchan(struct task_stru
16883 if (!p || p == current || p->state == TASK_RUNNING)
16884 return 0;
16885 stack = (unsigned long)task_stack_page(p);
16886- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16887+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16888 return 0;
16889 fp = *(u64 *)(p->thread.sp);
16890 do {
16891- if (fp < (unsigned long)stack ||
16892- fp >= (unsigned long)stack+THREAD_SIZE)
16893+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16894 return 0;
16895 ip = *(u64 *)(fp+8);
16896 if (!in_sched_functions(ip))
16897diff -urNp linux-2.6.39.2/arch/x86/kernel/process.c linux-2.6.39.2/arch/x86/kernel/process.c
16898--- linux-2.6.39.2/arch/x86/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
16899+++ linux-2.6.39.2/arch/x86/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
16900@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
16901
16902 void free_thread_info(struct thread_info *ti)
16903 {
16904- free_thread_xstate(ti->task);
16905 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16906 }
16907
16908+static struct kmem_cache *task_struct_cachep;
16909+
16910 void arch_task_cache_init(void)
16911 {
16912- task_xstate_cachep =
16913- kmem_cache_create("task_xstate", xstate_size,
16914+ /* create a slab on which task_structs can be allocated */
16915+ task_struct_cachep =
16916+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16917+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16918+
16919+ task_xstate_cachep =
16920+ kmem_cache_create("task_xstate", xstate_size,
16921 __alignof__(union thread_xstate),
16922- SLAB_PANIC | SLAB_NOTRACK, NULL);
16923+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16924+}
16925+
16926+struct task_struct *alloc_task_struct_node(int node)
16927+{
16928+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16929+}
16930+
16931+void free_task_struct(struct task_struct *task)
16932+{
16933+ free_thread_xstate(task);
16934+ kmem_cache_free(task_struct_cachep, task);
16935 }
16936
16937 /*
16938@@ -70,7 +87,7 @@ void exit_thread(void)
16939 unsigned long *bp = t->io_bitmap_ptr;
16940
16941 if (bp) {
16942- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16943+ struct tss_struct *tss = init_tss + get_cpu();
16944
16945 t->io_bitmap_ptr = NULL;
16946 clear_thread_flag(TIF_IO_BITMAP);
16947@@ -106,7 +123,7 @@ void show_regs_common(void)
16948
16949 printk(KERN_CONT "\n");
16950 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16951- current->pid, current->comm, print_tainted(),
16952+ task_pid_nr(current), current->comm, print_tainted(),
16953 init_utsname()->release,
16954 (int)strcspn(init_utsname()->version, " "),
16955 init_utsname()->version);
16956@@ -120,6 +137,9 @@ void flush_thread(void)
16957 {
16958 struct task_struct *tsk = current;
16959
16960+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16961+ loadsegment(gs, 0);
16962+#endif
16963 flush_ptrace_hw_breakpoint(tsk);
16964 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16965 /*
16966@@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi
16967 regs.di = (unsigned long) arg;
16968
16969 #ifdef CONFIG_X86_32
16970- regs.ds = __USER_DS;
16971- regs.es = __USER_DS;
16972+ regs.ds = __KERNEL_DS;
16973+ regs.es = __KERNEL_DS;
16974 regs.fs = __KERNEL_PERCPU;
16975- regs.gs = __KERNEL_STACK_CANARY;
16976+ savesegment(gs, regs.gs);
16977 #else
16978 regs.ss = __KERNEL_DS;
16979 #endif
16980@@ -401,7 +421,7 @@ void default_idle(void)
16981 EXPORT_SYMBOL(default_idle);
16982 #endif
16983
16984-void stop_this_cpu(void *dummy)
16985+__noreturn void stop_this_cpu(void *dummy)
16986 {
16987 local_irq_disable();
16988 /*
16989@@ -665,16 +685,34 @@ static int __init idle_setup(char *str)
16990 }
16991 early_param("idle", idle_setup);
16992
16993-unsigned long arch_align_stack(unsigned long sp)
16994+#ifdef CONFIG_PAX_RANDKSTACK
16995+asmlinkage void pax_randomize_kstack(void)
16996 {
16997- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16998- sp -= get_random_int() % 8192;
16999- return sp & ~0xf;
17000-}
17001+ struct thread_struct *thread = &current->thread;
17002+ unsigned long time;
17003
17004-unsigned long arch_randomize_brk(struct mm_struct *mm)
17005-{
17006- unsigned long range_end = mm->brk + 0x02000000;
17007- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
17008-}
17009+ if (!randomize_va_space)
17010+ return;
17011+
17012+ rdtscl(time);
17013+
17014+ /* P4 seems to return a 0 LSB, ignore it */
17015+#ifdef CONFIG_MPENTIUM4
17016+ time &= 0x3EUL;
17017+ time <<= 2;
17018+#elif defined(CONFIG_X86_64)
17019+ time &= 0xFUL;
17020+ time <<= 4;
17021+#else
17022+ time &= 0x1FUL;
17023+ time <<= 3;
17024+#endif
17025+
17026+ thread->sp0 ^= time;
17027+ load_sp0(init_tss + smp_processor_id(), thread);
17028
17029+#ifdef CONFIG_X86_64
17030+ percpu_write(kernel_stack, thread->sp0);
17031+#endif
17032+}
17033+#endif
17034diff -urNp linux-2.6.39.2/arch/x86/kernel/ptrace.c linux-2.6.39.2/arch/x86/kernel/ptrace.c
17035--- linux-2.6.39.2/arch/x86/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
17036+++ linux-2.6.39.2/arch/x86/kernel/ptrace.c 2011-05-22 19:36:30.000000000 -0400
17037@@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
17038 unsigned long addr, unsigned long data)
17039 {
17040 int ret;
17041- unsigned long __user *datap = (unsigned long __user *)data;
17042+ unsigned long __user *datap = (__force unsigned long __user *)data;
17043
17044 switch (request) {
17045 /* read the word at location addr in the USER area. */
17046@@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
17047 if ((int) addr < 0)
17048 return -EIO;
17049 ret = do_get_thread_area(child, addr,
17050- (struct user_desc __user *)data);
17051+ (__force struct user_desc __user *) data);
17052 break;
17053
17054 case PTRACE_SET_THREAD_AREA:
17055 if ((int) addr < 0)
17056 return -EIO;
17057 ret = do_set_thread_area(child, addr,
17058- (struct user_desc __user *)data, 0);
17059+ (__force struct user_desc __user *) data, 0);
17060 break;
17061 #endif
17062
17063@@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
17064 memset(info, 0, sizeof(*info));
17065 info->si_signo = SIGTRAP;
17066 info->si_code = si_code;
17067- info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
17068+ info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
17069 }
17070
17071 void user_single_step_siginfo(struct task_struct *tsk,
17072@@ -1363,7 +1363,7 @@ void send_sigtrap(struct task_struct *ts
17073 * We must return the syscall number to actually look up in the table.
17074 * This can be -1L to skip running any syscall at all.
17075 */
17076-asmregparm long syscall_trace_enter(struct pt_regs *regs)
17077+long syscall_trace_enter(struct pt_regs *regs)
17078 {
17079 long ret = 0;
17080
17081@@ -1408,7 +1408,7 @@ asmregparm long syscall_trace_enter(stru
17082 return ret ?: regs->orig_ax;
17083 }
17084
17085-asmregparm void syscall_trace_leave(struct pt_regs *regs)
17086+void syscall_trace_leave(struct pt_regs *regs)
17087 {
17088 bool step;
17089
17090diff -urNp linux-2.6.39.2/arch/x86/kernel/pvclock.c linux-2.6.39.2/arch/x86/kernel/pvclock.c
17091--- linux-2.6.39.2/arch/x86/kernel/pvclock.c 2011-05-19 00:06:34.000000000 -0400
17092+++ linux-2.6.39.2/arch/x86/kernel/pvclock.c 2011-05-22 19:36:30.000000000 -0400
17093@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
17094 return pv_tsc_khz;
17095 }
17096
17097-static atomic64_t last_value = ATOMIC64_INIT(0);
17098+static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
17099
17100 void pvclock_resume(void)
17101 {
17102- atomic64_set(&last_value, 0);
17103+ atomic64_set_unchecked(&last_value, 0);
17104 }
17105
17106 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
17107@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct
17108 * updating at the same time, and one of them could be slightly behind,
17109 * making the assumption that last_value always go forward fail to hold.
17110 */
17111- last = atomic64_read(&last_value);
17112+ last = atomic64_read_unchecked(&last_value);
17113 do {
17114 if (ret < last)
17115 return last;
17116- last = atomic64_cmpxchg(&last_value, last, ret);
17117+ last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
17118 } while (unlikely(last != ret));
17119
17120 return ret;
17121diff -urNp linux-2.6.39.2/arch/x86/kernel/reboot.c linux-2.6.39.2/arch/x86/kernel/reboot.c
17122--- linux-2.6.39.2/arch/x86/kernel/reboot.c 2011-05-19 00:06:34.000000000 -0400
17123+++ linux-2.6.39.2/arch/x86/kernel/reboot.c 2011-05-23 17:07:00.000000000 -0400
17124@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
17125 EXPORT_SYMBOL(pm_power_off);
17126
17127 static const struct desc_ptr no_idt = {};
17128-static int reboot_mode;
17129+static unsigned short reboot_mode;
17130 enum reboot_type reboot_type = BOOT_KBD;
17131 int reboot_force;
17132
17133@@ -307,13 +307,17 @@ core_initcall(reboot_init);
17134 extern const unsigned char machine_real_restart_asm[];
17135 extern const u64 machine_real_restart_gdt[3];
17136
17137-void machine_real_restart(unsigned int type)
17138+__noreturn void machine_real_restart(unsigned int type)
17139 {
17140 void *restart_va;
17141 unsigned long restart_pa;
17142- void (*restart_lowmem)(unsigned int);
17143+ void (* __noreturn restart_lowmem)(unsigned int);
17144 u64 *lowmem_gdt;
17145
17146+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
17147+ struct desc_struct *gdt;
17148+#endif
17149+
17150 local_irq_disable();
17151
17152 /* Write zero to CMOS register number 0x0f, which the BIOS POST
17153@@ -339,14 +343,14 @@ void machine_real_restart(unsigned int t
17154 boot)". This seems like a fairly standard thing that gets set by
17155 REBOOT.COM programs, and the previous reset routine did this
17156 too. */
17157- *((unsigned short *)0x472) = reboot_mode;
17158+ *(unsigned short *)(__va(0x472)) = reboot_mode;
17159
17160 /* Patch the GDT in the low memory trampoline */
17161 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
17162
17163 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
17164 restart_pa = virt_to_phys(restart_va);
17165- restart_lowmem = (void (*)(unsigned int))restart_pa;
17166+ restart_lowmem = (void *)restart_pa;
17167
17168 /* GDT[0]: GDT self-pointer */
17169 lowmem_gdt[0] =
17170@@ -357,7 +361,33 @@ void machine_real_restart(unsigned int t
17171 GDT_ENTRY(0x009b, restart_pa, 0xffff);
17172
17173 /* Jump to the identity-mapped low memory code */
17174+
17175+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
17176+ gdt = get_cpu_gdt_table(smp_processor_id());
17177+ pax_open_kernel();
17178+#ifdef CONFIG_PAX_MEMORY_UDEREF
17179+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
17180+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
17181+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
17182+#endif
17183+#ifdef CONFIG_PAX_KERNEXEC
17184+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
17185+ gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
17186+ gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
17187+ gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
17188+ gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
17189+ gdt[GDT_ENTRY_KERNEL_CS].g = 1;
17190+#endif
17191+ pax_close_kernel();
17192+#endif
17193+
17194+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17195+ asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
17196+ unreachable();
17197+#else
17198 restart_lowmem(type);
17199+#endif
17200+
17201 }
17202 #ifdef CONFIG_APM_MODULE
17203 EXPORT_SYMBOL(machine_real_restart);
17204@@ -478,7 +508,7 @@ void __attribute__((weak)) mach_reboot_f
17205 {
17206 }
17207
17208-static void native_machine_emergency_restart(void)
17209+__noreturn static void native_machine_emergency_restart(void)
17210 {
17211 int i;
17212
17213@@ -593,13 +623,13 @@ void native_machine_shutdown(void)
17214 #endif
17215 }
17216
17217-static void __machine_emergency_restart(int emergency)
17218+static __noreturn void __machine_emergency_restart(int emergency)
17219 {
17220 reboot_emergency = emergency;
17221 machine_ops.emergency_restart();
17222 }
17223
17224-static void native_machine_restart(char *__unused)
17225+static __noreturn void native_machine_restart(char *__unused)
17226 {
17227 printk("machine restart\n");
17228
17229@@ -608,7 +638,7 @@ static void native_machine_restart(char
17230 __machine_emergency_restart(0);
17231 }
17232
17233-static void native_machine_halt(void)
17234+static __noreturn void native_machine_halt(void)
17235 {
17236 /* stop other cpus and apics */
17237 machine_shutdown();
17238@@ -619,7 +649,7 @@ static void native_machine_halt(void)
17239 stop_this_cpu(NULL);
17240 }
17241
17242-static void native_machine_power_off(void)
17243+__noreturn static void native_machine_power_off(void)
17244 {
17245 if (pm_power_off) {
17246 if (!reboot_force)
17247@@ -628,6 +658,7 @@ static void native_machine_power_off(voi
17248 }
17249 /* a fallback in case there is no PM info available */
17250 tboot_shutdown(TB_SHUTDOWN_HALT);
17251+ unreachable();
17252 }
17253
17254 struct machine_ops machine_ops = {
17255diff -urNp linux-2.6.39.2/arch/x86/kernel/setup.c linux-2.6.39.2/arch/x86/kernel/setup.c
17256--- linux-2.6.39.2/arch/x86/kernel/setup.c 2011-06-25 12:55:22.000000000 -0400
17257+++ linux-2.6.39.2/arch/x86/kernel/setup.c 2011-06-25 13:00:25.000000000 -0400
17258@@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
17259 * area (640->1Mb) as ram even though it is not.
17260 * take them out.
17261 */
17262- e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
17263+ e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
17264 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
17265 }
17266
17267@@ -775,14 +775,14 @@ void __init setup_arch(char **cmdline_p)
17268
17269 if (!boot_params.hdr.root_flags)
17270 root_mountflags &= ~MS_RDONLY;
17271- init_mm.start_code = (unsigned long) _text;
17272- init_mm.end_code = (unsigned long) _etext;
17273+ init_mm.start_code = ktla_ktva((unsigned long) _text);
17274+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
17275 init_mm.end_data = (unsigned long) _edata;
17276 init_mm.brk = _brk_end;
17277
17278- code_resource.start = virt_to_phys(_text);
17279- code_resource.end = virt_to_phys(_etext)-1;
17280- data_resource.start = virt_to_phys(_etext);
17281+ code_resource.start = virt_to_phys(ktla_ktva(_text));
17282+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
17283+ data_resource.start = virt_to_phys(_sdata);
17284 data_resource.end = virt_to_phys(_edata)-1;
17285 bss_resource.start = virt_to_phys(&__bss_start);
17286 bss_resource.end = virt_to_phys(&__bss_stop)-1;
17287diff -urNp linux-2.6.39.2/arch/x86/kernel/setup_percpu.c linux-2.6.39.2/arch/x86/kernel/setup_percpu.c
17288--- linux-2.6.39.2/arch/x86/kernel/setup_percpu.c 2011-05-19 00:06:34.000000000 -0400
17289+++ linux-2.6.39.2/arch/x86/kernel/setup_percpu.c 2011-06-04 20:08:30.000000000 -0400
17290@@ -21,19 +21,17 @@
17291 #include <asm/cpu.h>
17292 #include <asm/stackprotector.h>
17293
17294-DEFINE_PER_CPU(int, cpu_number);
17295+#ifdef CONFIG_SMP
17296+DEFINE_PER_CPU(unsigned int, cpu_number);
17297 EXPORT_PER_CPU_SYMBOL(cpu_number);
17298+#endif
17299
17300-#ifdef CONFIG_X86_64
17301 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
17302-#else
17303-#define BOOT_PERCPU_OFFSET 0
17304-#endif
17305
17306 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
17307 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
17308
17309-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
17310+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
17311 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
17312 };
17313 EXPORT_SYMBOL(__per_cpu_offset);
17314@@ -155,10 +153,10 @@ static inline void setup_percpu_segment(
17315 {
17316 #ifdef CONFIG_X86_32
17317 struct desc_struct gdt;
17318+ unsigned long base = per_cpu_offset(cpu);
17319
17320- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
17321- 0x2 | DESCTYPE_S, 0x8);
17322- gdt.s = 1;
17323+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
17324+ 0x83 | DESCTYPE_S, 0xC);
17325 write_gdt_entry(get_cpu_gdt_table(cpu),
17326 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
17327 #endif
17328@@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
17329 /* alrighty, percpu areas up and running */
17330 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
17331 for_each_possible_cpu(cpu) {
17332+#ifdef CONFIG_CC_STACKPROTECTOR
17333+#ifdef CONFIG_X86_32
17334+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
17335+#endif
17336+#endif
17337 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
17338 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
17339 per_cpu(cpu_number, cpu) = cpu;
17340@@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
17341 */
17342 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
17343 #endif
17344+#ifdef CONFIG_CC_STACKPROTECTOR
17345+#ifdef CONFIG_X86_32
17346+ if (!cpu)
17347+ per_cpu(stack_canary.canary, cpu) = canary;
17348+#endif
17349+#endif
17350 /*
17351 * Up to this point, the boot CPU has been using .init.data
17352 * area. Reload any changed state for the boot CPU.
17353diff -urNp linux-2.6.39.2/arch/x86/kernel/signal.c linux-2.6.39.2/arch/x86/kernel/signal.c
17354--- linux-2.6.39.2/arch/x86/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
17355+++ linux-2.6.39.2/arch/x86/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
17356@@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
17357 * Align the stack pointer according to the i386 ABI,
17358 * i.e. so that on function entry ((sp + 4) & 15) == 0.
17359 */
17360- sp = ((sp + 4) & -16ul) - 4;
17361+ sp = ((sp - 12) & -16ul) - 4;
17362 #else /* !CONFIG_X86_32 */
17363 sp = round_down(sp, 16) - 8;
17364 #endif
17365@@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
17366 * Return an always-bogus address instead so we will die with SIGSEGV.
17367 */
17368 if (onsigstack && !likely(on_sig_stack(sp)))
17369- return (void __user *)-1L;
17370+ return (__force void __user *)-1L;
17371
17372 /* save i387 state */
17373 if (used_math() && save_i387_xstate(*fpstate) < 0)
17374- return (void __user *)-1L;
17375+ return (__force void __user *)-1L;
17376
17377 return (void __user *)sp;
17378 }
17379@@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
17380 }
17381
17382 if (current->mm->context.vdso)
17383- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17384+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17385 else
17386- restorer = &frame->retcode;
17387+ restorer = (void __user *)&frame->retcode;
17388 if (ka->sa.sa_flags & SA_RESTORER)
17389 restorer = ka->sa.sa_restorer;
17390
17391@@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
17392 * reasons and because gdb uses it as a signature to notice
17393 * signal handler stack frames.
17394 */
17395- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
17396+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
17397
17398 if (err)
17399 return -EFAULT;
17400@@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str
17401 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
17402
17403 /* Set up to return from userspace. */
17404- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17405+ if (current->mm->context.vdso)
17406+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17407+ else
17408+ restorer = (void __user *)&frame->retcode;
17409 if (ka->sa.sa_flags & SA_RESTORER)
17410 restorer = ka->sa.sa_restorer;
17411 put_user_ex(restorer, &frame->pretcode);
17412@@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str
17413 * reasons and because gdb uses it as a signature to notice
17414 * signal handler stack frames.
17415 */
17416- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
17417+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
17418 } put_user_catch(err);
17419
17420 if (err)
17421@@ -773,6 +776,8 @@ static void do_signal(struct pt_regs *re
17422 int signr;
17423 sigset_t *oldset;
17424
17425+ pax_track_stack();
17426+
17427 /*
17428 * We want the common case to go fast, which is why we may in certain
17429 * cases get here from kernel mode. Just return without doing anything
17430@@ -780,7 +785,7 @@ static void do_signal(struct pt_regs *re
17431 * X86_32: vm86 regs switched out by assembly code before reaching
17432 * here, so testing against kernel CS suffices.
17433 */
17434- if (!user_mode(regs))
17435+ if (!user_mode_novm(regs))
17436 return;
17437
17438 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
17439diff -urNp linux-2.6.39.2/arch/x86/kernel/smpboot.c linux-2.6.39.2/arch/x86/kernel/smpboot.c
17440--- linux-2.6.39.2/arch/x86/kernel/smpboot.c 2011-06-25 12:55:22.000000000 -0400
17441+++ linux-2.6.39.2/arch/x86/kernel/smpboot.c 2011-06-25 13:00:25.000000000 -0400
17442@@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int api
17443 set_idle_for_cpu(cpu, c_idle.idle);
17444 do_rest:
17445 per_cpu(current_task, cpu) = c_idle.idle;
17446+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
17447 #ifdef CONFIG_X86_32
17448 /* Stack for startup_32 can be just as for start_secondary onwards */
17449 irq_ctx_init(cpu);
17450 #else
17451 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
17452 initial_gs = per_cpu_offset(cpu);
17453- per_cpu(kernel_stack, cpu) =
17454- (unsigned long)task_stack_page(c_idle.idle) -
17455- KERNEL_STACK_OFFSET + THREAD_SIZE;
17456+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
17457 #endif
17458+
17459+ pax_open_kernel();
17460 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
17461+ pax_close_kernel();
17462+
17463 initial_code = (unsigned long)start_secondary;
17464 stack_start = c_idle.idle->thread.sp;
17465
17466@@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int
17467
17468 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
17469
17470+#ifdef CONFIG_PAX_PER_CPU_PGD
17471+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
17472+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17473+ KERNEL_PGD_PTRS);
17474+#endif
17475+
17476 err = do_boot_cpu(apicid, cpu);
17477 if (err) {
17478 pr_debug("do_boot_cpu failed %d\n", err);
17479diff -urNp linux-2.6.39.2/arch/x86/kernel/step.c linux-2.6.39.2/arch/x86/kernel/step.c
17480--- linux-2.6.39.2/arch/x86/kernel/step.c 2011-05-19 00:06:34.000000000 -0400
17481+++ linux-2.6.39.2/arch/x86/kernel/step.c 2011-05-22 19:36:30.000000000 -0400
17482@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
17483 struct desc_struct *desc;
17484 unsigned long base;
17485
17486- seg &= ~7UL;
17487+ seg >>= 3;
17488
17489 mutex_lock(&child->mm->context.lock);
17490- if (unlikely((seg >> 3) >= child->mm->context.size))
17491+ if (unlikely(seg >= child->mm->context.size))
17492 addr = -1L; /* bogus selector, access would fault */
17493 else {
17494 desc = child->mm->context.ldt + seg;
17495@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
17496 addr += base;
17497 }
17498 mutex_unlock(&child->mm->context.lock);
17499- }
17500+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
17501+ addr = ktla_ktva(addr);
17502
17503 return addr;
17504 }
17505@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
17506 unsigned char opcode[15];
17507 unsigned long addr = convert_ip_to_linear(child, regs);
17508
17509+ if (addr == -EINVAL)
17510+ return 0;
17511+
17512 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
17513 for (i = 0; i < copied; i++) {
17514 switch (opcode[i]) {
17515@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
17516
17517 #ifdef CONFIG_X86_64
17518 case 0x40 ... 0x4f:
17519- if (regs->cs != __USER_CS)
17520+ if ((regs->cs & 0xffff) != __USER_CS)
17521 /* 32-bit mode: register increment */
17522 return 0;
17523 /* 64-bit mode: REX prefix */
17524diff -urNp linux-2.6.39.2/arch/x86/kernel/syscall_table_32.S linux-2.6.39.2/arch/x86/kernel/syscall_table_32.S
17525--- linux-2.6.39.2/arch/x86/kernel/syscall_table_32.S 2011-05-19 00:06:34.000000000 -0400
17526+++ linux-2.6.39.2/arch/x86/kernel/syscall_table_32.S 2011-05-22 19:36:30.000000000 -0400
17527@@ -1,3 +1,4 @@
17528+.section .rodata,"a",@progbits
17529 ENTRY(sys_call_table)
17530 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17531 .long sys_exit
17532diff -urNp linux-2.6.39.2/arch/x86/kernel/sys_i386_32.c linux-2.6.39.2/arch/x86/kernel/sys_i386_32.c
17533--- linux-2.6.39.2/arch/x86/kernel/sys_i386_32.c 2011-05-19 00:06:34.000000000 -0400
17534+++ linux-2.6.39.2/arch/x86/kernel/sys_i386_32.c 2011-05-22 19:36:30.000000000 -0400
17535@@ -24,17 +24,224 @@
17536
17537 #include <asm/syscalls.h>
17538
17539-/*
17540- * Do a system call from kernel instead of calling sys_execve so we
17541- * end up with proper pt_regs.
17542- */
17543-int kernel_execve(const char *filename,
17544- const char *const argv[],
17545- const char *const envp[])
17546+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
17547 {
17548- long __res;
17549- asm volatile ("int $0x80"
17550- : "=a" (__res)
17551- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
17552- return __res;
17553+ unsigned long pax_task_size = TASK_SIZE;
17554+
17555+#ifdef CONFIG_PAX_SEGMEXEC
17556+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
17557+ pax_task_size = SEGMEXEC_TASK_SIZE;
17558+#endif
17559+
17560+ if (len > pax_task_size || addr > pax_task_size - len)
17561+ return -EINVAL;
17562+
17563+ return 0;
17564+}
17565+
17566+unsigned long
17567+arch_get_unmapped_area(struct file *filp, unsigned long addr,
17568+ unsigned long len, unsigned long pgoff, unsigned long flags)
17569+{
17570+ struct mm_struct *mm = current->mm;
17571+ struct vm_area_struct *vma;
17572+ unsigned long start_addr, pax_task_size = TASK_SIZE;
17573+
17574+#ifdef CONFIG_PAX_SEGMEXEC
17575+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17576+ pax_task_size = SEGMEXEC_TASK_SIZE;
17577+#endif
17578+
17579+ pax_task_size -= PAGE_SIZE;
17580+
17581+ if (len > pax_task_size)
17582+ return -ENOMEM;
17583+
17584+ if (flags & MAP_FIXED)
17585+ return addr;
17586+
17587+#ifdef CONFIG_PAX_RANDMMAP
17588+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17589+#endif
17590+
17591+ if (addr) {
17592+ addr = PAGE_ALIGN(addr);
17593+ if (pax_task_size - len >= addr) {
17594+ vma = find_vma(mm, addr);
17595+ if (check_heap_stack_gap(vma, addr, len))
17596+ return addr;
17597+ }
17598+ }
17599+ if (len > mm->cached_hole_size) {
17600+ start_addr = addr = mm->free_area_cache;
17601+ } else {
17602+ start_addr = addr = mm->mmap_base;
17603+ mm->cached_hole_size = 0;
17604+ }
17605+
17606+#ifdef CONFIG_PAX_PAGEEXEC
17607+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17608+ start_addr = 0x00110000UL;
17609+
17610+#ifdef CONFIG_PAX_RANDMMAP
17611+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17612+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17613+#endif
17614+
17615+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17616+ start_addr = addr = mm->mmap_base;
17617+ else
17618+ addr = start_addr;
17619+ }
17620+#endif
17621+
17622+full_search:
17623+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17624+ /* At this point: (!vma || addr < vma->vm_end). */
17625+ if (pax_task_size - len < addr) {
17626+ /*
17627+ * Start a new search - just in case we missed
17628+ * some holes.
17629+ */
17630+ if (start_addr != mm->mmap_base) {
17631+ start_addr = addr = mm->mmap_base;
17632+ mm->cached_hole_size = 0;
17633+ goto full_search;
17634+ }
17635+ return -ENOMEM;
17636+ }
17637+ if (check_heap_stack_gap(vma, addr, len))
17638+ break;
17639+ if (addr + mm->cached_hole_size < vma->vm_start)
17640+ mm->cached_hole_size = vma->vm_start - addr;
17641+ addr = vma->vm_end;
17642+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17643+ start_addr = addr = mm->mmap_base;
17644+ mm->cached_hole_size = 0;
17645+ goto full_search;
17646+ }
17647+ }
17648+
17649+ /*
17650+ * Remember the place where we stopped the search:
17651+ */
17652+ mm->free_area_cache = addr + len;
17653+ return addr;
17654+}
17655+
17656+unsigned long
17657+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17658+ const unsigned long len, const unsigned long pgoff,
17659+ const unsigned long flags)
17660+{
17661+ struct vm_area_struct *vma;
17662+ struct mm_struct *mm = current->mm;
17663+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17664+
17665+#ifdef CONFIG_PAX_SEGMEXEC
17666+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17667+ pax_task_size = SEGMEXEC_TASK_SIZE;
17668+#endif
17669+
17670+ pax_task_size -= PAGE_SIZE;
17671+
17672+ /* requested length too big for entire address space */
17673+ if (len > pax_task_size)
17674+ return -ENOMEM;
17675+
17676+ if (flags & MAP_FIXED)
17677+ return addr;
17678+
17679+#ifdef CONFIG_PAX_PAGEEXEC
17680+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17681+ goto bottomup;
17682+#endif
17683+
17684+#ifdef CONFIG_PAX_RANDMMAP
17685+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17686+#endif
17687+
17688+ /* requesting a specific address */
17689+ if (addr) {
17690+ addr = PAGE_ALIGN(addr);
17691+ if (pax_task_size - len >= addr) {
17692+ vma = find_vma(mm, addr);
17693+ if (check_heap_stack_gap(vma, addr, len))
17694+ return addr;
17695+ }
17696+ }
17697+
17698+ /* check if free_area_cache is useful for us */
17699+ if (len <= mm->cached_hole_size) {
17700+ mm->cached_hole_size = 0;
17701+ mm->free_area_cache = mm->mmap_base;
17702+ }
17703+
17704+ /* either no address requested or can't fit in requested address hole */
17705+ addr = mm->free_area_cache;
17706+
17707+ /* make sure it can fit in the remaining address space */
17708+ if (addr > len) {
17709+ vma = find_vma(mm, addr-len);
17710+ if (check_heap_stack_gap(vma, addr - len, len))
17711+ /* remember the address as a hint for next time */
17712+ return (mm->free_area_cache = addr-len);
17713+ }
17714+
17715+ if (mm->mmap_base < len)
17716+ goto bottomup;
17717+
17718+ addr = mm->mmap_base-len;
17719+
17720+ do {
17721+ /*
17722+ * Lookup failure means no vma is above this address,
17723+ * else if new region fits below vma->vm_start,
17724+ * return with success:
17725+ */
17726+ vma = find_vma(mm, addr);
17727+ if (check_heap_stack_gap(vma, addr, len))
17728+ /* remember the address as a hint for next time */
17729+ return (mm->free_area_cache = addr);
17730+
17731+ /* remember the largest hole we saw so far */
17732+ if (addr + mm->cached_hole_size < vma->vm_start)
17733+ mm->cached_hole_size = vma->vm_start - addr;
17734+
17735+ /* try just below the current vma->vm_start */
17736+ addr = skip_heap_stack_gap(vma, len);
17737+ } while (!IS_ERR_VALUE(addr));
17738+
17739+bottomup:
17740+ /*
17741+ * A failed mmap() very likely causes application failure,
17742+ * so fall back to the bottom-up function here. This scenario
17743+ * can happen with large stack limits and large mmap()
17744+ * allocations.
17745+ */
17746+
17747+#ifdef CONFIG_PAX_SEGMEXEC
17748+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17749+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17750+ else
17751+#endif
17752+
17753+ mm->mmap_base = TASK_UNMAPPED_BASE;
17754+
17755+#ifdef CONFIG_PAX_RANDMMAP
17756+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17757+ mm->mmap_base += mm->delta_mmap;
17758+#endif
17759+
17760+ mm->free_area_cache = mm->mmap_base;
17761+ mm->cached_hole_size = ~0UL;
17762+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17763+ /*
17764+ * Restore the topdown base:
17765+ */
17766+ mm->mmap_base = base;
17767+ mm->free_area_cache = base;
17768+ mm->cached_hole_size = ~0UL;
17769+
17770+ return addr;
17771 }
17772diff -urNp linux-2.6.39.2/arch/x86/kernel/sys_x86_64.c linux-2.6.39.2/arch/x86/kernel/sys_x86_64.c
17773--- linux-2.6.39.2/arch/x86/kernel/sys_x86_64.c 2011-05-19 00:06:34.000000000 -0400
17774+++ linux-2.6.39.2/arch/x86/kernel/sys_x86_64.c 2011-05-22 19:36:30.000000000 -0400
17775@@ -32,8 +32,8 @@ out:
17776 return error;
17777 }
17778
17779-static void find_start_end(unsigned long flags, unsigned long *begin,
17780- unsigned long *end)
17781+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17782+ unsigned long *begin, unsigned long *end)
17783 {
17784 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17785 unsigned long new_begin;
17786@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
17787 *begin = new_begin;
17788 }
17789 } else {
17790- *begin = TASK_UNMAPPED_BASE;
17791+ *begin = mm->mmap_base;
17792 *end = TASK_SIZE;
17793 }
17794 }
17795@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
17796 if (flags & MAP_FIXED)
17797 return addr;
17798
17799- find_start_end(flags, &begin, &end);
17800+ find_start_end(mm, flags, &begin, &end);
17801
17802 if (len > end)
17803 return -ENOMEM;
17804
17805+#ifdef CONFIG_PAX_RANDMMAP
17806+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17807+#endif
17808+
17809 if (addr) {
17810 addr = PAGE_ALIGN(addr);
17811 vma = find_vma(mm, addr);
17812- if (end - len >= addr &&
17813- (!vma || addr + len <= vma->vm_start))
17814+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17815 return addr;
17816 }
17817 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17818@@ -106,7 +109,7 @@ full_search:
17819 }
17820 return -ENOMEM;
17821 }
17822- if (!vma || addr + len <= vma->vm_start) {
17823+ if (check_heap_stack_gap(vma, addr, len)) {
17824 /*
17825 * Remember the place where we stopped the search:
17826 */
17827@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
17828 {
17829 struct vm_area_struct *vma;
17830 struct mm_struct *mm = current->mm;
17831- unsigned long addr = addr0;
17832+ unsigned long base = mm->mmap_base, addr = addr0;
17833
17834 /* requested length too big for entire address space */
17835 if (len > TASK_SIZE)
17836@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
17837 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17838 goto bottomup;
17839
17840+#ifdef CONFIG_PAX_RANDMMAP
17841+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17842+#endif
17843+
17844 /* requesting a specific address */
17845 if (addr) {
17846 addr = PAGE_ALIGN(addr);
17847- vma = find_vma(mm, addr);
17848- if (TASK_SIZE - len >= addr &&
17849- (!vma || addr + len <= vma->vm_start))
17850- return addr;
17851+ if (TASK_SIZE - len >= addr) {
17852+ vma = find_vma(mm, addr);
17853+ if (check_heap_stack_gap(vma, addr, len))
17854+ return addr;
17855+ }
17856 }
17857
17858 /* check if free_area_cache is useful for us */
17859@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
17860 /* make sure it can fit in the remaining address space */
17861 if (addr > len) {
17862 vma = find_vma(mm, addr-len);
17863- if (!vma || addr <= vma->vm_start)
17864+ if (check_heap_stack_gap(vma, addr - len, len))
17865 /* remember the address as a hint for next time */
17866 return mm->free_area_cache = addr-len;
17867 }
17868@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
17869 * return with success:
17870 */
17871 vma = find_vma(mm, addr);
17872- if (!vma || addr+len <= vma->vm_start)
17873+ if (check_heap_stack_gap(vma, addr, len))
17874 /* remember the address as a hint for next time */
17875 return mm->free_area_cache = addr;
17876
17877@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
17878 mm->cached_hole_size = vma->vm_start - addr;
17879
17880 /* try just below the current vma->vm_start */
17881- addr = vma->vm_start-len;
17882- } while (len < vma->vm_start);
17883+ addr = skip_heap_stack_gap(vma, len);
17884+ } while (!IS_ERR_VALUE(addr));
17885
17886 bottomup:
17887 /*
17888@@ -198,13 +206,21 @@ bottomup:
17889 * can happen with large stack limits and large mmap()
17890 * allocations.
17891 */
17892+ mm->mmap_base = TASK_UNMAPPED_BASE;
17893+
17894+#ifdef CONFIG_PAX_RANDMMAP
17895+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17896+ mm->mmap_base += mm->delta_mmap;
17897+#endif
17898+
17899+ mm->free_area_cache = mm->mmap_base;
17900 mm->cached_hole_size = ~0UL;
17901- mm->free_area_cache = TASK_UNMAPPED_BASE;
17902 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17903 /*
17904 * Restore the topdown base:
17905 */
17906- mm->free_area_cache = mm->mmap_base;
17907+ mm->mmap_base = base;
17908+ mm->free_area_cache = base;
17909 mm->cached_hole_size = ~0UL;
17910
17911 return addr;
17912diff -urNp linux-2.6.39.2/arch/x86/kernel/tboot.c linux-2.6.39.2/arch/x86/kernel/tboot.c
17913--- linux-2.6.39.2/arch/x86/kernel/tboot.c 2011-05-19 00:06:34.000000000 -0400
17914+++ linux-2.6.39.2/arch/x86/kernel/tboot.c 2011-05-22 19:36:30.000000000 -0400
17915@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17916
17917 void tboot_shutdown(u32 shutdown_type)
17918 {
17919- void (*shutdown)(void);
17920+ void (* __noreturn shutdown)(void);
17921
17922 if (!tboot_enabled())
17923 return;
17924@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17925
17926 switch_to_tboot_pt();
17927
17928- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17929+ shutdown = (void *)tboot->shutdown_entry;
17930 shutdown();
17931
17932 /* should not reach here */
17933@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
17934 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17935 }
17936
17937-static atomic_t ap_wfs_count;
17938+static atomic_unchecked_t ap_wfs_count;
17939
17940 static int tboot_wait_for_aps(int num_aps)
17941 {
17942@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(
17943 {
17944 switch (action) {
17945 case CPU_DYING:
17946- atomic_inc(&ap_wfs_count);
17947+ atomic_inc_unchecked(&ap_wfs_count);
17948 if (num_online_cpus() == 1)
17949- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17950+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17951 return NOTIFY_BAD;
17952 break;
17953 }
17954@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17955
17956 tboot_create_trampoline();
17957
17958- atomic_set(&ap_wfs_count, 0);
17959+ atomic_set_unchecked(&ap_wfs_count, 0);
17960 register_hotcpu_notifier(&tboot_cpu_notifier);
17961 return 0;
17962 }
17963diff -urNp linux-2.6.39.2/arch/x86/kernel/time.c linux-2.6.39.2/arch/x86/kernel/time.c
17964--- linux-2.6.39.2/arch/x86/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
17965+++ linux-2.6.39.2/arch/x86/kernel/time.c 2011-05-22 19:36:30.000000000 -0400
17966@@ -22,17 +22,13 @@
17967 #include <asm/hpet.h>
17968 #include <asm/time.h>
17969
17970-#ifdef CONFIG_X86_64
17971-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
17972-#endif
17973-
17974 unsigned long profile_pc(struct pt_regs *regs)
17975 {
17976 unsigned long pc = instruction_pointer(regs);
17977
17978- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17979+ if (!user_mode(regs) && in_lock_functions(pc)) {
17980 #ifdef CONFIG_FRAME_POINTER
17981- return *(unsigned long *)(regs->bp + sizeof(long));
17982+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17983 #else
17984 unsigned long *sp =
17985 (unsigned long *)kernel_stack_pointer(regs);
17986@@ -41,11 +37,17 @@ unsigned long profile_pc(struct pt_regs
17987 * or above a saved flags. Eflags has bits 22-31 zero,
17988 * kernel addresses don't.
17989 */
17990+
17991+#ifdef CONFIG_PAX_KERNEXEC
17992+ return ktla_ktva(sp[0]);
17993+#else
17994 if (sp[0] >> 22)
17995 return sp[0];
17996 if (sp[1] >> 22)
17997 return sp[1];
17998 #endif
17999+
18000+#endif
18001 }
18002 return pc;
18003 }
18004diff -urNp linux-2.6.39.2/arch/x86/kernel/tls.c linux-2.6.39.2/arch/x86/kernel/tls.c
18005--- linux-2.6.39.2/arch/x86/kernel/tls.c 2011-05-19 00:06:34.000000000 -0400
18006+++ linux-2.6.39.2/arch/x86/kernel/tls.c 2011-05-22 19:36:30.000000000 -0400
18007@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
18008 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
18009 return -EINVAL;
18010
18011+#ifdef CONFIG_PAX_SEGMEXEC
18012+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
18013+ return -EINVAL;
18014+#endif
18015+
18016 set_tls_desc(p, idx, &info, 1);
18017
18018 return 0;
18019diff -urNp linux-2.6.39.2/arch/x86/kernel/trampoline_32.S linux-2.6.39.2/arch/x86/kernel/trampoline_32.S
18020--- linux-2.6.39.2/arch/x86/kernel/trampoline_32.S 2011-05-19 00:06:34.000000000 -0400
18021+++ linux-2.6.39.2/arch/x86/kernel/trampoline_32.S 2011-05-22 19:36:30.000000000 -0400
18022@@ -32,6 +32,12 @@
18023 #include <asm/segment.h>
18024 #include <asm/page_types.h>
18025
18026+#ifdef CONFIG_PAX_KERNEXEC
18027+#define ta(X) (X)
18028+#else
18029+#define ta(X) ((X) - __PAGE_OFFSET)
18030+#endif
18031+
18032 #ifdef CONFIG_SMP
18033
18034 .section ".x86_trampoline","a"
18035@@ -62,7 +68,7 @@ r_base = .
18036 inc %ax # protected mode (PE) bit
18037 lmsw %ax # into protected mode
18038 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
18039- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
18040+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
18041
18042 # These need to be in the same 64K segment as the above;
18043 # hence we don't use the boot_gdt_descr defined in head.S
18044diff -urNp linux-2.6.39.2/arch/x86/kernel/trampoline_64.S linux-2.6.39.2/arch/x86/kernel/trampoline_64.S
18045--- linux-2.6.39.2/arch/x86/kernel/trampoline_64.S 2011-05-19 00:06:34.000000000 -0400
18046+++ linux-2.6.39.2/arch/x86/kernel/trampoline_64.S 2011-05-22 19:36:30.000000000 -0400
18047@@ -90,7 +90,7 @@ startup_32:
18048 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
18049 movl %eax, %ds
18050
18051- movl $X86_CR4_PAE, %eax
18052+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
18053 movl %eax, %cr4 # Enable PAE mode
18054
18055 # Setup trampoline 4 level pagetables
18056@@ -138,7 +138,7 @@ tidt:
18057 # so the kernel can live anywhere
18058 .balign 4
18059 tgdt:
18060- .short tgdt_end - tgdt # gdt limit
18061+ .short tgdt_end - tgdt - 1 # gdt limit
18062 .long tgdt - r_base
18063 .short 0
18064 .quad 0x00cf9b000000ffff # __KERNEL32_CS
18065diff -urNp linux-2.6.39.2/arch/x86/kernel/traps.c linux-2.6.39.2/arch/x86/kernel/traps.c
18066--- linux-2.6.39.2/arch/x86/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
18067+++ linux-2.6.39.2/arch/x86/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
18068@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
18069
18070 /* Do we ignore FPU interrupts ? */
18071 char ignore_fpu_irq;
18072-
18073-/*
18074- * The IDT has to be page-aligned to simplify the Pentium
18075- * F0 0F bug workaround.
18076- */
18077-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
18078 #endif
18079
18080 DECLARE_BITMAP(used_vectors, NR_VECTORS);
18081@@ -117,13 +111,13 @@ static inline void preempt_conditional_c
18082 }
18083
18084 static void __kprobes
18085-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
18086+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
18087 long error_code, siginfo_t *info)
18088 {
18089 struct task_struct *tsk = current;
18090
18091 #ifdef CONFIG_X86_32
18092- if (regs->flags & X86_VM_MASK) {
18093+ if (v8086_mode(regs)) {
18094 /*
18095 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
18096 * On nmi (interrupt 2), do_trap should not be called.
18097@@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str
18098 }
18099 #endif
18100
18101- if (!user_mode(regs))
18102+ if (!user_mode_novm(regs))
18103 goto kernel_trap;
18104
18105 #ifdef CONFIG_X86_32
18106@@ -157,7 +151,7 @@ trap_signal:
18107 printk_ratelimit()) {
18108 printk(KERN_INFO
18109 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
18110- tsk->comm, tsk->pid, str,
18111+ tsk->comm, task_pid_nr(tsk), str,
18112 regs->ip, regs->sp, error_code);
18113 print_vma_addr(" in ", regs->ip);
18114 printk("\n");
18115@@ -174,8 +168,20 @@ kernel_trap:
18116 if (!fixup_exception(regs)) {
18117 tsk->thread.error_code = error_code;
18118 tsk->thread.trap_no = trapnr;
18119+
18120+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18121+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
18122+ str = "PAX: suspicious stack segment fault";
18123+#endif
18124+
18125 die(str, regs, error_code);
18126 }
18127+
18128+#ifdef CONFIG_PAX_REFCOUNT
18129+ if (trapnr == 4)
18130+ pax_report_refcount_overflow(regs);
18131+#endif
18132+
18133 return;
18134
18135 #ifdef CONFIG_X86_32
18136@@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re
18137 conditional_sti(regs);
18138
18139 #ifdef CONFIG_X86_32
18140- if (regs->flags & X86_VM_MASK)
18141+ if (v8086_mode(regs))
18142 goto gp_in_vm86;
18143 #endif
18144
18145 tsk = current;
18146- if (!user_mode(regs))
18147+ if (!user_mode_novm(regs))
18148 goto gp_in_kernel;
18149
18150+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
18151+ if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
18152+ struct mm_struct *mm = tsk->mm;
18153+ unsigned long limit;
18154+
18155+ down_write(&mm->mmap_sem);
18156+ limit = mm->context.user_cs_limit;
18157+ if (limit < TASK_SIZE) {
18158+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
18159+ up_write(&mm->mmap_sem);
18160+ return;
18161+ }
18162+ up_write(&mm->mmap_sem);
18163+ }
18164+#endif
18165+
18166 tsk->thread.error_code = error_code;
18167 tsk->thread.trap_no = 13;
18168
18169@@ -304,6 +326,13 @@ gp_in_kernel:
18170 if (notify_die(DIE_GPF, "general protection fault", regs,
18171 error_code, 13, SIGSEGV) == NOTIFY_STOP)
18172 return;
18173+
18174+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18175+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
18176+ die("PAX: suspicious general protection fault", regs, error_code);
18177+ else
18178+#endif
18179+
18180 die("general protection fault", regs, error_code);
18181 }
18182
18183@@ -569,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
18184 /* It's safe to allow irq's after DR6 has been saved */
18185 preempt_conditional_sti(regs);
18186
18187- if (regs->flags & X86_VM_MASK) {
18188+ if (v8086_mode(regs)) {
18189 handle_vm86_trap((struct kernel_vm86_regs *) regs,
18190 error_code, 1);
18191 preempt_conditional_cli(regs);
18192@@ -583,7 +612,7 @@ dotraplinkage void __kprobes do_debug(st
18193 * We already checked v86 mode above, so we can check for kernel mode
18194 * by just checking the CPL of CS.
18195 */
18196- if ((dr6 & DR_STEP) && !user_mode(regs)) {
18197+ if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
18198 tsk->thread.debugreg6 &= ~DR_STEP;
18199 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
18200 regs->flags &= ~X86_EFLAGS_TF;
18201@@ -612,7 +641,7 @@ void math_error(struct pt_regs *regs, in
18202 return;
18203 conditional_sti(regs);
18204
18205- if (!user_mode_vm(regs))
18206+ if (!user_mode(regs))
18207 {
18208 if (!fixup_exception(regs)) {
18209 task->thread.error_code = error_code;
18210@@ -723,7 +752,7 @@ asmlinkage void __attribute__((weak)) sm
18211 void __math_state_restore(void)
18212 {
18213 struct thread_info *thread = current_thread_info();
18214- struct task_struct *tsk = thread->task;
18215+ struct task_struct *tsk = current;
18216
18217 /*
18218 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
18219@@ -750,8 +779,7 @@ void __math_state_restore(void)
18220 */
18221 asmlinkage void math_state_restore(void)
18222 {
18223- struct thread_info *thread = current_thread_info();
18224- struct task_struct *tsk = thread->task;
18225+ struct task_struct *tsk = current;
18226
18227 if (!tsk_used_math(tsk)) {
18228 local_irq_enable();
18229diff -urNp linux-2.6.39.2/arch/x86/kernel/verify_cpu.S linux-2.6.39.2/arch/x86/kernel/verify_cpu.S
18230--- linux-2.6.39.2/arch/x86/kernel/verify_cpu.S 2011-05-19 00:06:34.000000000 -0400
18231+++ linux-2.6.39.2/arch/x86/kernel/verify_cpu.S 2011-07-01 18:28:04.000000000 -0400
18232@@ -20,6 +20,7 @@
18233 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
18234 * arch/x86/kernel/trampoline_64.S: secondary processor verification
18235 * arch/x86/kernel/head_32.S: processor startup
18236+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
18237 *
18238 * verify_cpu, returns the status of longmode and SSE in register %eax.
18239 * 0: Success 1: Failure
18240diff -urNp linux-2.6.39.2/arch/x86/kernel/vm86_32.c linux-2.6.39.2/arch/x86/kernel/vm86_32.c
18241--- linux-2.6.39.2/arch/x86/kernel/vm86_32.c 2011-05-19 00:06:34.000000000 -0400
18242+++ linux-2.6.39.2/arch/x86/kernel/vm86_32.c 2011-05-22 19:41:32.000000000 -0400
18243@@ -41,6 +41,7 @@
18244 #include <linux/ptrace.h>
18245 #include <linux/audit.h>
18246 #include <linux/stddef.h>
18247+#include <linux/grsecurity.h>
18248
18249 #include <asm/uaccess.h>
18250 #include <asm/io.h>
18251@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
18252 do_exit(SIGSEGV);
18253 }
18254
18255- tss = &per_cpu(init_tss, get_cpu());
18256+ tss = init_tss + get_cpu();
18257 current->thread.sp0 = current->thread.saved_sp0;
18258 current->thread.sysenter_cs = __KERNEL_CS;
18259 load_sp0(tss, &current->thread);
18260@@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use
18261 struct task_struct *tsk;
18262 int tmp, ret = -EPERM;
18263
18264+#ifdef CONFIG_GRKERNSEC_VM86
18265+ if (!capable(CAP_SYS_RAWIO)) {
18266+ gr_handle_vm86();
18267+ goto out;
18268+ }
18269+#endif
18270+
18271 tsk = current;
18272 if (tsk->thread.saved_sp0)
18273 goto out;
18274@@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned
18275 int tmp, ret;
18276 struct vm86plus_struct __user *v86;
18277
18278+#ifdef CONFIG_GRKERNSEC_VM86
18279+ if (!capable(CAP_SYS_RAWIO)) {
18280+ gr_handle_vm86();
18281+ ret = -EPERM;
18282+ goto out;
18283+ }
18284+#endif
18285+
18286 tsk = current;
18287 switch (cmd) {
18288 case VM86_REQUEST_IRQ:
18289@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
18290 tsk->thread.saved_fs = info->regs32->fs;
18291 tsk->thread.saved_gs = get_user_gs(info->regs32);
18292
18293- tss = &per_cpu(init_tss, get_cpu());
18294+ tss = init_tss + get_cpu();
18295 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
18296 if (cpu_has_sep)
18297 tsk->thread.sysenter_cs = 0;
18298@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
18299 goto cannot_handle;
18300 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
18301 goto cannot_handle;
18302- intr_ptr = (unsigned long __user *) (i << 2);
18303+ intr_ptr = (__force unsigned long __user *) (i << 2);
18304 if (get_user(segoffs, intr_ptr))
18305 goto cannot_handle;
18306 if ((segoffs >> 16) == BIOSSEG)
18307diff -urNp linux-2.6.39.2/arch/x86/kernel/vmlinux.lds.S linux-2.6.39.2/arch/x86/kernel/vmlinux.lds.S
18308--- linux-2.6.39.2/arch/x86/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
18309+++ linux-2.6.39.2/arch/x86/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
18310@@ -26,6 +26,13 @@
18311 #include <asm/page_types.h>
18312 #include <asm/cache.h>
18313 #include <asm/boot.h>
18314+#include <asm/segment.h>
18315+
18316+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18317+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
18318+#else
18319+#define __KERNEL_TEXT_OFFSET 0
18320+#endif
18321
18322 #undef i386 /* in case the preprocessor is a 32bit one */
18323
18324@@ -34,11 +41,9 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
18325 #ifdef CONFIG_X86_32
18326 OUTPUT_ARCH(i386)
18327 ENTRY(phys_startup_32)
18328-jiffies = jiffies_64;
18329 #else
18330 OUTPUT_ARCH(i386:x86-64)
18331 ENTRY(phys_startup_64)
18332-jiffies_64 = jiffies;
18333 #endif
18334
18335 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
18336@@ -69,31 +74,46 @@ jiffies_64 = jiffies;
18337
18338 PHDRS {
18339 text PT_LOAD FLAGS(5); /* R_E */
18340+#ifdef CONFIG_X86_32
18341+ module PT_LOAD FLAGS(5); /* R_E */
18342+#endif
18343+#ifdef CONFIG_XEN
18344+ rodata PT_LOAD FLAGS(5); /* R_E */
18345+#else
18346+ rodata PT_LOAD FLAGS(4); /* R__ */
18347+#endif
18348 data PT_LOAD FLAGS(6); /* RW_ */
18349 #ifdef CONFIG_X86_64
18350 user PT_LOAD FLAGS(5); /* R_E */
18351+#endif
18352+ init.begin PT_LOAD FLAGS(6); /* RW_ */
18353 #ifdef CONFIG_SMP
18354 percpu PT_LOAD FLAGS(6); /* RW_ */
18355 #endif
18356+ text.init PT_LOAD FLAGS(5); /* R_E */
18357+ text.exit PT_LOAD FLAGS(5); /* R_E */
18358 init PT_LOAD FLAGS(7); /* RWE */
18359-#endif
18360 note PT_NOTE FLAGS(0); /* ___ */
18361 }
18362
18363 SECTIONS
18364 {
18365 #ifdef CONFIG_X86_32
18366- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
18367- phys_startup_32 = startup_32 - LOAD_OFFSET;
18368+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
18369 #else
18370- . = __START_KERNEL;
18371- phys_startup_64 = startup_64 - LOAD_OFFSET;
18372+ . = __START_KERNEL;
18373 #endif
18374
18375 /* Text and read-only data */
18376- .text : AT(ADDR(.text) - LOAD_OFFSET) {
18377- _text = .;
18378+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18379 /* bootstrapping code */
18380+#ifdef CONFIG_X86_32
18381+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18382+#else
18383+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18384+#endif
18385+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18386+ _text = .;
18387 HEAD_TEXT
18388 #ifdef CONFIG_X86_32
18389 . = ALIGN(PAGE_SIZE);
18390@@ -109,13 +129,47 @@ SECTIONS
18391 IRQENTRY_TEXT
18392 *(.fixup)
18393 *(.gnu.warning)
18394- /* End of text section */
18395- _etext = .;
18396 } :text = 0x9090
18397
18398- NOTES :text :note
18399+ . += __KERNEL_TEXT_OFFSET;
18400+
18401+#ifdef CONFIG_X86_32
18402+ . = ALIGN(PAGE_SIZE);
18403+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
18404+
18405+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
18406+ MODULES_EXEC_VADDR = .;
18407+ BYTE(0)
18408+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
18409+ . = ALIGN(HPAGE_SIZE);
18410+ MODULES_EXEC_END = . - 1;
18411+#endif
18412+
18413+ } :module
18414+#endif
18415+
18416+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
18417+ /* End of text section */
18418+ _etext = . - __KERNEL_TEXT_OFFSET;
18419+ }
18420
18421- EXCEPTION_TABLE(16) :text = 0x9090
18422+#ifdef CONFIG_X86_32
18423+ . = ALIGN(PAGE_SIZE);
18424+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
18425+ *(.idt)
18426+ . = ALIGN(PAGE_SIZE);
18427+ *(.empty_zero_page)
18428+ *(.initial_pg_fixmap)
18429+ *(.initial_pg_pmd)
18430+ *(.initial_page_table)
18431+ *(.swapper_pg_dir)
18432+ } :rodata
18433+#endif
18434+
18435+ . = ALIGN(PAGE_SIZE);
18436+ NOTES :rodata :note
18437+
18438+ EXCEPTION_TABLE(16) :rodata
18439
18440 #if defined(CONFIG_DEBUG_RODATA)
18441 /* .text should occupy whole number of pages */
18442@@ -127,16 +181,20 @@ SECTIONS
18443
18444 /* Data */
18445 .data : AT(ADDR(.data) - LOAD_OFFSET) {
18446+
18447+#ifdef CONFIG_PAX_KERNEXEC
18448+ . = ALIGN(HPAGE_SIZE);
18449+#else
18450+ . = ALIGN(PAGE_SIZE);
18451+#endif
18452+
18453 /* Start of data section */
18454 _sdata = .;
18455
18456 /* init_task */
18457 INIT_TASK_DATA(THREAD_SIZE)
18458
18459-#ifdef CONFIG_X86_32
18460- /* 32 bit has nosave before _edata */
18461 NOSAVE_DATA
18462-#endif
18463
18464 PAGE_ALIGNED_DATA(PAGE_SIZE)
18465
18466@@ -145,6 +203,8 @@ SECTIONS
18467 DATA_DATA
18468 CONSTRUCTORS
18469
18470+ jiffies = jiffies_64;
18471+
18472 /* rarely changed data like cpu maps */
18473 READ_MOSTLY_DATA(INTERNODE_CACHE_BYTES)
18474
18475@@ -199,12 +259,6 @@ SECTIONS
18476 }
18477 vgetcpu_mode = VVIRT(.vgetcpu_mode);
18478
18479- . = ALIGN(L1_CACHE_BYTES);
18480- .jiffies : AT(VLOAD(.jiffies)) {
18481- *(.jiffies)
18482- }
18483- jiffies = VVIRT(.jiffies);
18484-
18485 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
18486 *(.vsyscall_3)
18487 }
18488@@ -220,12 +274,19 @@ SECTIONS
18489 #endif /* CONFIG_X86_64 */
18490
18491 /* Init code and data - will be freed after init */
18492- . = ALIGN(PAGE_SIZE);
18493 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
18494+ BYTE(0)
18495+
18496+#ifdef CONFIG_PAX_KERNEXEC
18497+ . = ALIGN(HPAGE_SIZE);
18498+#else
18499+ . = ALIGN(PAGE_SIZE);
18500+#endif
18501+
18502 __init_begin = .; /* paired with __init_end */
18503- }
18504+ } :init.begin
18505
18506-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
18507+#ifdef CONFIG_SMP
18508 /*
18509 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
18510 * output PHDR, so the next output section - .init.text - should
18511@@ -234,12 +295,27 @@ SECTIONS
18512 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
18513 #endif
18514
18515- INIT_TEXT_SECTION(PAGE_SIZE)
18516-#ifdef CONFIG_X86_64
18517- :init
18518-#endif
18519+ . = ALIGN(PAGE_SIZE);
18520+ init_begin = .;
18521+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
18522+ VMLINUX_SYMBOL(_sinittext) = .;
18523+ INIT_TEXT
18524+ VMLINUX_SYMBOL(_einittext) = .;
18525+ . = ALIGN(PAGE_SIZE);
18526+ } :text.init
18527
18528- INIT_DATA_SECTION(16)
18529+ /*
18530+ * .exit.text is discard at runtime, not link time, to deal with
18531+ * references from .altinstructions and .eh_frame
18532+ */
18533+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18534+ EXIT_TEXT
18535+ . = ALIGN(16);
18536+ } :text.exit
18537+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
18538+
18539+ . = ALIGN(PAGE_SIZE);
18540+ INIT_DATA_SECTION(16) :init
18541
18542 /*
18543 * Code and data for a variety of lowlevel trampolines, to be
18544@@ -306,19 +382,12 @@ SECTIONS
18545 }
18546
18547 . = ALIGN(8);
18548- /*
18549- * .exit.text is discard at runtime, not link time, to deal with
18550- * references from .altinstructions and .eh_frame
18551- */
18552- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
18553- EXIT_TEXT
18554- }
18555
18556 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
18557 EXIT_DATA
18558 }
18559
18560-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
18561+#ifndef CONFIG_SMP
18562 PERCPU(INTERNODE_CACHE_BYTES, PAGE_SIZE)
18563 #endif
18564
18565@@ -337,16 +406,10 @@ SECTIONS
18566 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
18567 __smp_locks = .;
18568 *(.smp_locks)
18569- . = ALIGN(PAGE_SIZE);
18570 __smp_locks_end = .;
18571+ . = ALIGN(PAGE_SIZE);
18572 }
18573
18574-#ifdef CONFIG_X86_64
18575- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
18576- NOSAVE_DATA
18577- }
18578-#endif
18579-
18580 /* BSS */
18581 . = ALIGN(PAGE_SIZE);
18582 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
18583@@ -362,6 +425,7 @@ SECTIONS
18584 __brk_base = .;
18585 . += 64 * 1024; /* 64k alignment slop space */
18586 *(.brk_reservation) /* areas brk users have reserved */
18587+ . = ALIGN(HPAGE_SIZE);
18588 __brk_limit = .;
18589 }
18590
18591@@ -388,13 +452,12 @@ SECTIONS
18592 * for the boot processor.
18593 */
18594 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18595-INIT_PER_CPU(gdt_page);
18596 INIT_PER_CPU(irq_stack_union);
18597
18598 /*
18599 * Build-time check on the image size:
18600 */
18601-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18602+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18603 "kernel image bigger than KERNEL_IMAGE_SIZE");
18604
18605 #ifdef CONFIG_SMP
18606diff -urNp linux-2.6.39.2/arch/x86/kernel/vsyscall_64.c linux-2.6.39.2/arch/x86/kernel/vsyscall_64.c
18607--- linux-2.6.39.2/arch/x86/kernel/vsyscall_64.c 2011-05-19 00:06:34.000000000 -0400
18608+++ linux-2.6.39.2/arch/x86/kernel/vsyscall_64.c 2011-05-22 19:36:30.000000000 -0400
18609@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
18610
18611 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
18612 /* copy vsyscall data */
18613+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
18614 vsyscall_gtod_data.clock.vread = clock->vread;
18615 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
18616 vsyscall_gtod_data.clock.mask = clock->mask;
18617@@ -208,7 +209,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
18618 We do this here because otherwise user space would do it on
18619 its own in a likely inferior way (no access to jiffies).
18620 If you don't like it pass NULL. */
18621- if (tcache && tcache->blob[0] == (j = __jiffies)) {
18622+ if (tcache && tcache->blob[0] == (j = jiffies)) {
18623 p = tcache->blob[1];
18624 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
18625 /* Load per CPU data from RDTSCP */
18626diff -urNp linux-2.6.39.2/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.39.2/arch/x86/kernel/x8664_ksyms_64.c
18627--- linux-2.6.39.2/arch/x86/kernel/x8664_ksyms_64.c 2011-05-19 00:06:34.000000000 -0400
18628+++ linux-2.6.39.2/arch/x86/kernel/x8664_ksyms_64.c 2011-05-22 19:36:30.000000000 -0400
18629@@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18630 EXPORT_SYMBOL(copy_user_generic_string);
18631 EXPORT_SYMBOL(copy_user_generic_unrolled);
18632 EXPORT_SYMBOL(__copy_user_nocache);
18633-EXPORT_SYMBOL(_copy_from_user);
18634-EXPORT_SYMBOL(_copy_to_user);
18635
18636 EXPORT_SYMBOL(copy_page);
18637 EXPORT_SYMBOL(clear_page);
18638diff -urNp linux-2.6.39.2/arch/x86/kernel/xsave.c linux-2.6.39.2/arch/x86/kernel/xsave.c
18639--- linux-2.6.39.2/arch/x86/kernel/xsave.c 2011-05-19 00:06:34.000000000 -0400
18640+++ linux-2.6.39.2/arch/x86/kernel/xsave.c 2011-05-22 19:36:30.000000000 -0400
18641@@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
18642 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18643 return -EINVAL;
18644
18645- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18646+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18647 fx_sw_user->extended_size -
18648 FP_XSTATE_MAGIC2_SIZE));
18649 if (err)
18650@@ -267,7 +267,7 @@ fx_only:
18651 * the other extended state.
18652 */
18653 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18654- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18655+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
18656 }
18657
18658 /*
18659@@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf
18660 if (use_xsave())
18661 err = restore_user_xstate(buf);
18662 else
18663- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18664+ err = fxrstor_checking((struct i387_fxsave_struct __user *)
18665 buf);
18666 if (unlikely(err)) {
18667 /*
18668diff -urNp linux-2.6.39.2/arch/x86/kvm/emulate.c linux-2.6.39.2/arch/x86/kvm/emulate.c
18669--- linux-2.6.39.2/arch/x86/kvm/emulate.c 2011-05-19 00:06:34.000000000 -0400
18670+++ linux-2.6.39.2/arch/x86/kvm/emulate.c 2011-05-22 19:36:30.000000000 -0400
18671@@ -89,7 +89,7 @@
18672 #define Src2ImmByte (2<<29)
18673 #define Src2One (3<<29)
18674 #define Src2Imm (4<<29)
18675-#define Src2Mask (7<<29)
18676+#define Src2Mask (7U<<29)
18677
18678 #define X2(x...) x, x
18679 #define X3(x...) X2(x), x
18680@@ -190,6 +190,7 @@ struct group_dual {
18681
18682 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18683 do { \
18684+ unsigned long _tmp; \
18685 __asm__ __volatile__ ( \
18686 _PRE_EFLAGS("0", "4", "2") \
18687 _op _suffix " %"_x"3,%1; " \
18688@@ -203,8 +204,6 @@ struct group_dual {
18689 /* Raw emulation: instruction has two explicit operands. */
18690 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18691 do { \
18692- unsigned long _tmp; \
18693- \
18694 switch ((_dst).bytes) { \
18695 case 2: \
18696 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18697@@ -220,7 +219,6 @@ struct group_dual {
18698
18699 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18700 do { \
18701- unsigned long _tmp; \
18702 switch ((_dst).bytes) { \
18703 case 1: \
18704 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18705diff -urNp linux-2.6.39.2/arch/x86/kvm/lapic.c linux-2.6.39.2/arch/x86/kvm/lapic.c
18706--- linux-2.6.39.2/arch/x86/kvm/lapic.c 2011-05-19 00:06:34.000000000 -0400
18707+++ linux-2.6.39.2/arch/x86/kvm/lapic.c 2011-05-22 19:36:30.000000000 -0400
18708@@ -53,7 +53,7 @@
18709 #define APIC_BUS_CYCLE_NS 1
18710
18711 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18712-#define apic_debug(fmt, arg...)
18713+#define apic_debug(fmt, arg...) do {} while (0)
18714
18715 #define APIC_LVT_NUM 6
18716 /* 14 is the version for Xeon and Pentium 8.4.8*/
18717diff -urNp linux-2.6.39.2/arch/x86/kvm/mmu.c linux-2.6.39.2/arch/x86/kvm/mmu.c
18718--- linux-2.6.39.2/arch/x86/kvm/mmu.c 2011-05-19 00:06:34.000000000 -0400
18719+++ linux-2.6.39.2/arch/x86/kvm/mmu.c 2011-05-22 19:36:30.000000000 -0400
18720@@ -3240,7 +3240,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18721
18722 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18723
18724- invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18725+ invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18726
18727 /*
18728 * Assume that the pte write on a page table of the same type
18729@@ -3275,7 +3275,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18730 smp_rmb();
18731
18732 spin_lock(&vcpu->kvm->mmu_lock);
18733- if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18734+ if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18735 gentry = 0;
18736 kvm_mmu_free_some_pages(vcpu);
18737 ++vcpu->kvm->stat.mmu_pte_write;
18738diff -urNp linux-2.6.39.2/arch/x86/kvm/paging_tmpl.h linux-2.6.39.2/arch/x86/kvm/paging_tmpl.h
18739--- linux-2.6.39.2/arch/x86/kvm/paging_tmpl.h 2011-05-19 00:06:34.000000000 -0400
18740+++ linux-2.6.39.2/arch/x86/kvm/paging_tmpl.h 2011-05-22 19:36:30.000000000 -0400
18741@@ -552,6 +552,8 @@ static int FNAME(page_fault)(struct kvm_
18742 unsigned long mmu_seq;
18743 bool map_writable;
18744
18745+ pax_track_stack();
18746+
18747 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18748
18749 r = mmu_topup_memory_caches(vcpu);
18750@@ -672,7 +674,7 @@ static void FNAME(invlpg)(struct kvm_vcp
18751 if (need_flush)
18752 kvm_flush_remote_tlbs(vcpu->kvm);
18753
18754- atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18755+ atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18756
18757 spin_unlock(&vcpu->kvm->mmu_lock);
18758
18759diff -urNp linux-2.6.39.2/arch/x86/kvm/svm.c linux-2.6.39.2/arch/x86/kvm/svm.c
18760--- linux-2.6.39.2/arch/x86/kvm/svm.c 2011-05-19 00:06:34.000000000 -0400
18761+++ linux-2.6.39.2/arch/x86/kvm/svm.c 2011-05-22 19:36:30.000000000 -0400
18762@@ -3278,7 +3278,11 @@ static void reload_tss(struct kvm_vcpu *
18763 int cpu = raw_smp_processor_id();
18764
18765 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18766+
18767+ pax_open_kernel();
18768 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18769+ pax_close_kernel();
18770+
18771 load_TR_desc();
18772 }
18773
18774@@ -3656,6 +3660,10 @@ static void svm_vcpu_run(struct kvm_vcpu
18775 #endif
18776 #endif
18777
18778+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18779+ __set_fs(current_thread_info()->addr_limit);
18780+#endif
18781+
18782 reload_tss(vcpu);
18783
18784 local_irq_disable();
18785@@ -3871,7 +3879,7 @@ static void svm_fpu_deactivate(struct kv
18786 update_cr0_intercept(svm);
18787 }
18788
18789-static struct kvm_x86_ops svm_x86_ops = {
18790+static const struct kvm_x86_ops svm_x86_ops = {
18791 .cpu_has_kvm_support = has_svm,
18792 .disabled_by_bios = is_disabled,
18793 .hardware_setup = svm_hardware_setup,
18794diff -urNp linux-2.6.39.2/arch/x86/kvm/vmx.c linux-2.6.39.2/arch/x86/kvm/vmx.c
18795--- linux-2.6.39.2/arch/x86/kvm/vmx.c 2011-05-19 00:06:34.000000000 -0400
18796+++ linux-2.6.39.2/arch/x86/kvm/vmx.c 2011-05-22 19:36:30.000000000 -0400
18797@@ -725,7 +725,11 @@ static void reload_tss(void)
18798 struct desc_struct *descs;
18799
18800 descs = (void *)gdt->address;
18801+
18802+ pax_open_kernel();
18803 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18804+ pax_close_kernel();
18805+
18806 load_TR_desc();
18807 }
18808
18809@@ -1648,8 +1652,11 @@ static __init int hardware_setup(void)
18810 if (!cpu_has_vmx_flexpriority())
18811 flexpriority_enabled = 0;
18812
18813- if (!cpu_has_vmx_tpr_shadow())
18814- kvm_x86_ops->update_cr8_intercept = NULL;
18815+ if (!cpu_has_vmx_tpr_shadow()) {
18816+ pax_open_kernel();
18817+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18818+ pax_close_kernel();
18819+ }
18820
18821 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18822 kvm_disable_largepages();
18823@@ -2693,7 +2700,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
18824 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18825
18826 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
18827- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
18828+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
18829 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
18830 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
18831 vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
18832@@ -4068,6 +4075,12 @@ static void __noclone vmx_vcpu_run(struc
18833 "jmp .Lkvm_vmx_return \n\t"
18834 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18835 ".Lkvm_vmx_return: "
18836+
18837+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18838+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18839+ ".Lkvm_vmx_return2: "
18840+#endif
18841+
18842 /* Save guest registers, load host registers, keep flags */
18843 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18844 "pop %0 \n\t"
18845@@ -4116,6 +4129,11 @@ static void __noclone vmx_vcpu_run(struc
18846 #endif
18847 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18848 [wordsize]"i"(sizeof(ulong))
18849+
18850+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18851+ ,[cs]"i"(__KERNEL_CS)
18852+#endif
18853+
18854 : "cc", "memory"
18855 , R"ax", R"bx", R"di", R"si"
18856 #ifdef CONFIG_X86_64
18857@@ -4130,7 +4148,16 @@ static void __noclone vmx_vcpu_run(struc
18858
18859 vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
18860
18861- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18862+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18863+
18864+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18865+ loadsegment(fs, __KERNEL_PERCPU);
18866+#endif
18867+
18868+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18869+ __set_fs(current_thread_info()->addr_limit);
18870+#endif
18871+
18872 vmx->launched = 1;
18873
18874 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18875@@ -4368,7 +4395,7 @@ static void vmx_set_supported_cpuid(u32
18876 {
18877 }
18878
18879-static struct kvm_x86_ops vmx_x86_ops = {
18880+static const struct kvm_x86_ops vmx_x86_ops = {
18881 .cpu_has_kvm_support = cpu_has_kvm_support,
18882 .disabled_by_bios = vmx_disabled_by_bios,
18883 .hardware_setup = hardware_setup,
18884diff -urNp linux-2.6.39.2/arch/x86/kvm/x86.c linux-2.6.39.2/arch/x86/kvm/x86.c
18885--- linux-2.6.39.2/arch/x86/kvm/x86.c 2011-05-19 00:06:34.000000000 -0400
18886+++ linux-2.6.39.2/arch/x86/kvm/x86.c 2011-05-22 19:36:30.000000000 -0400
18887@@ -94,7 +94,7 @@ static void update_cr8_intercept(struct
18888 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
18889 struct kvm_cpuid_entry2 __user *entries);
18890
18891-struct kvm_x86_ops *kvm_x86_ops;
18892+const struct kvm_x86_ops *kvm_x86_ops;
18893 EXPORT_SYMBOL_GPL(kvm_x86_ops);
18894
18895 int ignore_msrs = 0;
18896@@ -2050,6 +2050,8 @@ long kvm_arch_dev_ioctl(struct file *fil
18897 if (n < msr_list.nmsrs)
18898 goto out;
18899 r = -EFAULT;
18900+ if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18901+ goto out;
18902 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18903 num_msrs_to_save * sizeof(u32)))
18904 goto out;
18905@@ -2217,15 +2219,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
18906 struct kvm_cpuid2 *cpuid,
18907 struct kvm_cpuid_entry2 __user *entries)
18908 {
18909- int r;
18910+ int r, i;
18911
18912 r = -E2BIG;
18913 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18914 goto out;
18915 r = -EFAULT;
18916- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18917- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18918+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18919 goto out;
18920+ for (i = 0; i < cpuid->nent; ++i) {
18921+ struct kvm_cpuid_entry2 cpuid_entry;
18922+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18923+ goto out;
18924+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18925+ }
18926 vcpu->arch.cpuid_nent = cpuid->nent;
18927 kvm_apic_set_version(vcpu);
18928 kvm_x86_ops->cpuid_update(vcpu);
18929@@ -2240,15 +2247,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
18930 struct kvm_cpuid2 *cpuid,
18931 struct kvm_cpuid_entry2 __user *entries)
18932 {
18933- int r;
18934+ int r, i;
18935
18936 r = -E2BIG;
18937 if (cpuid->nent < vcpu->arch.cpuid_nent)
18938 goto out;
18939 r = -EFAULT;
18940- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18941- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18942+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18943 goto out;
18944+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18945+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18946+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18947+ goto out;
18948+ }
18949 return 0;
18950
18951 out:
18952@@ -2526,7 +2537,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
18953 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18954 struct kvm_interrupt *irq)
18955 {
18956- if (irq->irq < 0 || irq->irq >= 256)
18957+ if (irq->irq >= 256)
18958 return -EINVAL;
18959 if (irqchip_in_kernel(vcpu->kvm))
18960 return -ENXIO;
18961@@ -4672,7 +4683,7 @@ static unsigned long kvm_get_guest_ip(vo
18962 return ip;
18963 }
18964
18965-static struct perf_guest_info_callbacks kvm_guest_cbs = {
18966+static const struct perf_guest_info_callbacks kvm_guest_cbs = {
18967 .is_in_guest = kvm_is_in_guest,
18968 .is_user_mode = kvm_is_user_mode,
18969 .get_guest_ip = kvm_get_guest_ip,
18970@@ -4690,10 +4701,10 @@ void kvm_after_handle_nmi(struct kvm_vcp
18971 }
18972 EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
18973
18974-int kvm_arch_init(void *opaque)
18975+int kvm_arch_init(const void *opaque)
18976 {
18977 int r;
18978- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18979+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
18980
18981 if (kvm_x86_ops) {
18982 printk(KERN_ERR "kvm: already loaded the other module\n");
18983diff -urNp linux-2.6.39.2/arch/x86/lib/atomic64_32.c linux-2.6.39.2/arch/x86/lib/atomic64_32.c
18984--- linux-2.6.39.2/arch/x86/lib/atomic64_32.c 2011-05-19 00:06:34.000000000 -0400
18985+++ linux-2.6.39.2/arch/x86/lib/atomic64_32.c 2011-05-22 19:36:30.000000000 -0400
18986@@ -8,18 +8,30 @@
18987
18988 long long atomic64_read_cx8(long long, const atomic64_t *v);
18989 EXPORT_SYMBOL(atomic64_read_cx8);
18990+long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18991+EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18992 long long atomic64_set_cx8(long long, const atomic64_t *v);
18993 EXPORT_SYMBOL(atomic64_set_cx8);
18994+long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18995+EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18996 long long atomic64_xchg_cx8(long long, unsigned high);
18997 EXPORT_SYMBOL(atomic64_xchg_cx8);
18998 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18999 EXPORT_SYMBOL(atomic64_add_return_cx8);
19000+long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
19001+EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
19002 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
19003 EXPORT_SYMBOL(atomic64_sub_return_cx8);
19004+long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
19005+EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
19006 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
19007 EXPORT_SYMBOL(atomic64_inc_return_cx8);
19008+long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
19009+EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
19010 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
19011 EXPORT_SYMBOL(atomic64_dec_return_cx8);
19012+long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
19013+EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
19014 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
19015 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
19016 int atomic64_inc_not_zero_cx8(atomic64_t *v);
19017@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
19018 #ifndef CONFIG_X86_CMPXCHG64
19019 long long atomic64_read_386(long long, const atomic64_t *v);
19020 EXPORT_SYMBOL(atomic64_read_386);
19021+long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
19022+EXPORT_SYMBOL(atomic64_read_unchecked_386);
19023 long long atomic64_set_386(long long, const atomic64_t *v);
19024 EXPORT_SYMBOL(atomic64_set_386);
19025+long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
19026+EXPORT_SYMBOL(atomic64_set_unchecked_386);
19027 long long atomic64_xchg_386(long long, unsigned high);
19028 EXPORT_SYMBOL(atomic64_xchg_386);
19029 long long atomic64_add_return_386(long long a, atomic64_t *v);
19030 EXPORT_SYMBOL(atomic64_add_return_386);
19031+long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
19032+EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
19033 long long atomic64_sub_return_386(long long a, atomic64_t *v);
19034 EXPORT_SYMBOL(atomic64_sub_return_386);
19035+long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
19036+EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
19037 long long atomic64_inc_return_386(long long a, atomic64_t *v);
19038 EXPORT_SYMBOL(atomic64_inc_return_386);
19039+long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
19040+EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
19041 long long atomic64_dec_return_386(long long a, atomic64_t *v);
19042 EXPORT_SYMBOL(atomic64_dec_return_386);
19043+long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
19044+EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
19045 long long atomic64_add_386(long long a, atomic64_t *v);
19046 EXPORT_SYMBOL(atomic64_add_386);
19047+long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
19048+EXPORT_SYMBOL(atomic64_add_unchecked_386);
19049 long long atomic64_sub_386(long long a, atomic64_t *v);
19050 EXPORT_SYMBOL(atomic64_sub_386);
19051+long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
19052+EXPORT_SYMBOL(atomic64_sub_unchecked_386);
19053 long long atomic64_inc_386(long long a, atomic64_t *v);
19054 EXPORT_SYMBOL(atomic64_inc_386);
19055+long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
19056+EXPORT_SYMBOL(atomic64_inc_unchecked_386);
19057 long long atomic64_dec_386(long long a, atomic64_t *v);
19058 EXPORT_SYMBOL(atomic64_dec_386);
19059+long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
19060+EXPORT_SYMBOL(atomic64_dec_unchecked_386);
19061 long long atomic64_dec_if_positive_386(atomic64_t *v);
19062 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
19063 int atomic64_inc_not_zero_386(atomic64_t *v);
19064diff -urNp linux-2.6.39.2/arch/x86/lib/atomic64_386_32.S linux-2.6.39.2/arch/x86/lib/atomic64_386_32.S
19065--- linux-2.6.39.2/arch/x86/lib/atomic64_386_32.S 2011-05-19 00:06:34.000000000 -0400
19066+++ linux-2.6.39.2/arch/x86/lib/atomic64_386_32.S 2011-05-22 19:36:30.000000000 -0400
19067@@ -48,6 +48,10 @@ BEGIN(read)
19068 movl (v), %eax
19069 movl 4(v), %edx
19070 RET_ENDP
19071+BEGIN(read_unchecked)
19072+ movl (v), %eax
19073+ movl 4(v), %edx
19074+RET_ENDP
19075 #undef v
19076
19077 #define v %esi
19078@@ -55,6 +59,10 @@ BEGIN(set)
19079 movl %ebx, (v)
19080 movl %ecx, 4(v)
19081 RET_ENDP
19082+BEGIN(set_unchecked)
19083+ movl %ebx, (v)
19084+ movl %ecx, 4(v)
19085+RET_ENDP
19086 #undef v
19087
19088 #define v %esi
19089@@ -70,6 +78,20 @@ RET_ENDP
19090 BEGIN(add)
19091 addl %eax, (v)
19092 adcl %edx, 4(v)
19093+
19094+#ifdef CONFIG_PAX_REFCOUNT
19095+ jno 0f
19096+ subl %eax, (v)
19097+ sbbl %edx, 4(v)
19098+ int $4
19099+0:
19100+ _ASM_EXTABLE(0b, 0b)
19101+#endif
19102+
19103+RET_ENDP
19104+BEGIN(add_unchecked)
19105+ addl %eax, (v)
19106+ adcl %edx, 4(v)
19107 RET_ENDP
19108 #undef v
19109
19110@@ -77,6 +99,24 @@ RET_ENDP
19111 BEGIN(add_return)
19112 addl (v), %eax
19113 adcl 4(v), %edx
19114+
19115+#ifdef CONFIG_PAX_REFCOUNT
19116+ into
19117+1234:
19118+ _ASM_EXTABLE(1234b, 2f)
19119+#endif
19120+
19121+ movl %eax, (v)
19122+ movl %edx, 4(v)
19123+
19124+#ifdef CONFIG_PAX_REFCOUNT
19125+2:
19126+#endif
19127+
19128+RET_ENDP
19129+BEGIN(add_return_unchecked)
19130+ addl (v), %eax
19131+ adcl 4(v), %edx
19132 movl %eax, (v)
19133 movl %edx, 4(v)
19134 RET_ENDP
19135@@ -86,6 +126,20 @@ RET_ENDP
19136 BEGIN(sub)
19137 subl %eax, (v)
19138 sbbl %edx, 4(v)
19139+
19140+#ifdef CONFIG_PAX_REFCOUNT
19141+ jno 0f
19142+ addl %eax, (v)
19143+ adcl %edx, 4(v)
19144+ int $4
19145+0:
19146+ _ASM_EXTABLE(0b, 0b)
19147+#endif
19148+
19149+RET_ENDP
19150+BEGIN(sub_unchecked)
19151+ subl %eax, (v)
19152+ sbbl %edx, 4(v)
19153 RET_ENDP
19154 #undef v
19155
19156@@ -96,6 +150,27 @@ BEGIN(sub_return)
19157 sbbl $0, %edx
19158 addl (v), %eax
19159 adcl 4(v), %edx
19160+
19161+#ifdef CONFIG_PAX_REFCOUNT
19162+ into
19163+1234:
19164+ _ASM_EXTABLE(1234b, 2f)
19165+#endif
19166+
19167+ movl %eax, (v)
19168+ movl %edx, 4(v)
19169+
19170+#ifdef CONFIG_PAX_REFCOUNT
19171+2:
19172+#endif
19173+
19174+RET_ENDP
19175+BEGIN(sub_return_unchecked)
19176+ negl %edx
19177+ negl %eax
19178+ sbbl $0, %edx
19179+ addl (v), %eax
19180+ adcl 4(v), %edx
19181 movl %eax, (v)
19182 movl %edx, 4(v)
19183 RET_ENDP
19184@@ -105,6 +180,20 @@ RET_ENDP
19185 BEGIN(inc)
19186 addl $1, (v)
19187 adcl $0, 4(v)
19188+
19189+#ifdef CONFIG_PAX_REFCOUNT
19190+ jno 0f
19191+ subl $1, (v)
19192+ sbbl $0, 4(v)
19193+ int $4
19194+0:
19195+ _ASM_EXTABLE(0b, 0b)
19196+#endif
19197+
19198+RET_ENDP
19199+BEGIN(inc_unchecked)
19200+ addl $1, (v)
19201+ adcl $0, 4(v)
19202 RET_ENDP
19203 #undef v
19204
19205@@ -114,6 +203,26 @@ BEGIN(inc_return)
19206 movl 4(v), %edx
19207 addl $1, %eax
19208 adcl $0, %edx
19209+
19210+#ifdef CONFIG_PAX_REFCOUNT
19211+ into
19212+1234:
19213+ _ASM_EXTABLE(1234b, 2f)
19214+#endif
19215+
19216+ movl %eax, (v)
19217+ movl %edx, 4(v)
19218+
19219+#ifdef CONFIG_PAX_REFCOUNT
19220+2:
19221+#endif
19222+
19223+RET_ENDP
19224+BEGIN(inc_return_unchecked)
19225+ movl (v), %eax
19226+ movl 4(v), %edx
19227+ addl $1, %eax
19228+ adcl $0, %edx
19229 movl %eax, (v)
19230 movl %edx, 4(v)
19231 RET_ENDP
19232@@ -123,6 +232,20 @@ RET_ENDP
19233 BEGIN(dec)
19234 subl $1, (v)
19235 sbbl $0, 4(v)
19236+
19237+#ifdef CONFIG_PAX_REFCOUNT
19238+ jno 0f
19239+ addl $1, (v)
19240+ adcl $0, 4(v)
19241+ int $4
19242+0:
19243+ _ASM_EXTABLE(0b, 0b)
19244+#endif
19245+
19246+RET_ENDP
19247+BEGIN(dec_unchecked)
19248+ subl $1, (v)
19249+ sbbl $0, 4(v)
19250 RET_ENDP
19251 #undef v
19252
19253@@ -132,6 +255,26 @@ BEGIN(dec_return)
19254 movl 4(v), %edx
19255 subl $1, %eax
19256 sbbl $0, %edx
19257+
19258+#ifdef CONFIG_PAX_REFCOUNT
19259+ into
19260+1234:
19261+ _ASM_EXTABLE(1234b, 2f)
19262+#endif
19263+
19264+ movl %eax, (v)
19265+ movl %edx, 4(v)
19266+
19267+#ifdef CONFIG_PAX_REFCOUNT
19268+2:
19269+#endif
19270+
19271+RET_ENDP
19272+BEGIN(dec_return_unchecked)
19273+ movl (v), %eax
19274+ movl 4(v), %edx
19275+ subl $1, %eax
19276+ sbbl $0, %edx
19277 movl %eax, (v)
19278 movl %edx, 4(v)
19279 RET_ENDP
19280@@ -143,6 +286,13 @@ BEGIN(add_unless)
19281 adcl %edx, %edi
19282 addl (v), %eax
19283 adcl 4(v), %edx
19284+
19285+#ifdef CONFIG_PAX_REFCOUNT
19286+ into
19287+1234:
19288+ _ASM_EXTABLE(1234b, 2f)
19289+#endif
19290+
19291 cmpl %eax, %esi
19292 je 3f
19293 1:
19294@@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
19295 1:
19296 addl $1, %eax
19297 adcl $0, %edx
19298+
19299+#ifdef CONFIG_PAX_REFCOUNT
19300+ into
19301+1234:
19302+ _ASM_EXTABLE(1234b, 2f)
19303+#endif
19304+
19305 movl %eax, (v)
19306 movl %edx, 4(v)
19307 movl $1, %eax
19308@@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
19309 movl 4(v), %edx
19310 subl $1, %eax
19311 sbbl $0, %edx
19312+
19313+#ifdef CONFIG_PAX_REFCOUNT
19314+ into
19315+1234:
19316+ _ASM_EXTABLE(1234b, 1f)
19317+#endif
19318+
19319 js 1f
19320 movl %eax, (v)
19321 movl %edx, 4(v)
19322diff -urNp linux-2.6.39.2/arch/x86/lib/atomic64_cx8_32.S linux-2.6.39.2/arch/x86/lib/atomic64_cx8_32.S
19323--- linux-2.6.39.2/arch/x86/lib/atomic64_cx8_32.S 2011-05-19 00:06:34.000000000 -0400
19324+++ linux-2.6.39.2/arch/x86/lib/atomic64_cx8_32.S 2011-05-22 19:36:30.000000000 -0400
19325@@ -39,6 +39,14 @@ ENTRY(atomic64_read_cx8)
19326 CFI_ENDPROC
19327 ENDPROC(atomic64_read_cx8)
19328
19329+ENTRY(atomic64_read_unchecked_cx8)
19330+ CFI_STARTPROC
19331+
19332+ read64 %ecx
19333+ ret
19334+ CFI_ENDPROC
19335+ENDPROC(atomic64_read_unchecked_cx8)
19336+
19337 ENTRY(atomic64_set_cx8)
19338 CFI_STARTPROC
19339
19340@@ -52,6 +60,19 @@ ENTRY(atomic64_set_cx8)
19341 CFI_ENDPROC
19342 ENDPROC(atomic64_set_cx8)
19343
19344+ENTRY(atomic64_set_unchecked_cx8)
19345+ CFI_STARTPROC
19346+
19347+1:
19348+/* we don't need LOCK_PREFIX since aligned 64-bit writes
19349+ * are atomic on 586 and newer */
19350+ cmpxchg8b (%esi)
19351+ jne 1b
19352+
19353+ ret
19354+ CFI_ENDPROC
19355+ENDPROC(atomic64_set_unchecked_cx8)
19356+
19357 ENTRY(atomic64_xchg_cx8)
19358 CFI_STARTPROC
19359
19360@@ -66,8 +87,8 @@ ENTRY(atomic64_xchg_cx8)
19361 CFI_ENDPROC
19362 ENDPROC(atomic64_xchg_cx8)
19363
19364-.macro addsub_return func ins insc
19365-ENTRY(atomic64_\func\()_return_cx8)
19366+.macro addsub_return func ins insc unchecked=""
19367+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19368 CFI_STARTPROC
19369 SAVE ebp
19370 SAVE ebx
19371@@ -84,27 +105,43 @@ ENTRY(atomic64_\func\()_return_cx8)
19372 movl %edx, %ecx
19373 \ins\()l %esi, %ebx
19374 \insc\()l %edi, %ecx
19375+
19376+.ifb \unchecked
19377+#ifdef CONFIG_PAX_REFCOUNT
19378+ into
19379+2:
19380+ _ASM_EXTABLE(2b, 3f)
19381+#endif
19382+.endif
19383+
19384 LOCK_PREFIX
19385 cmpxchg8b (%ebp)
19386 jne 1b
19387-
19388-10:
19389 movl %ebx, %eax
19390 movl %ecx, %edx
19391+
19392+.ifb \unchecked
19393+#ifdef CONFIG_PAX_REFCOUNT
19394+3:
19395+#endif
19396+.endif
19397+
19398 RESTORE edi
19399 RESTORE esi
19400 RESTORE ebx
19401 RESTORE ebp
19402 ret
19403 CFI_ENDPROC
19404-ENDPROC(atomic64_\func\()_return_cx8)
19405+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19406 .endm
19407
19408 addsub_return add add adc
19409 addsub_return sub sub sbb
19410+addsub_return add add adc _unchecked
19411+addsub_return sub sub sbb _unchecked
19412
19413-.macro incdec_return func ins insc
19414-ENTRY(atomic64_\func\()_return_cx8)
19415+.macro incdec_return func ins insc unchecked
19416+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19417 CFI_STARTPROC
19418 SAVE ebx
19419
19420@@ -114,21 +151,38 @@ ENTRY(atomic64_\func\()_return_cx8)
19421 movl %edx, %ecx
19422 \ins\()l $1, %ebx
19423 \insc\()l $0, %ecx
19424+
19425+.ifb \unchecked
19426+#ifdef CONFIG_PAX_REFCOUNT
19427+ into
19428+2:
19429+ _ASM_EXTABLE(2b, 3f)
19430+#endif
19431+.endif
19432+
19433 LOCK_PREFIX
19434 cmpxchg8b (%esi)
19435 jne 1b
19436
19437-10:
19438 movl %ebx, %eax
19439 movl %ecx, %edx
19440+
19441+.ifb \unchecked
19442+#ifdef CONFIG_PAX_REFCOUNT
19443+3:
19444+#endif
19445+.endif
19446+
19447 RESTORE ebx
19448 ret
19449 CFI_ENDPROC
19450-ENDPROC(atomic64_\func\()_return_cx8)
19451+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19452 .endm
19453
19454 incdec_return inc add adc
19455 incdec_return dec sub sbb
19456+incdec_return inc add adc _unchecked
19457+incdec_return dec sub sbb _unchecked
19458
19459 ENTRY(atomic64_dec_if_positive_cx8)
19460 CFI_STARTPROC
19461@@ -140,6 +194,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
19462 movl %edx, %ecx
19463 subl $1, %ebx
19464 sbb $0, %ecx
19465+
19466+#ifdef CONFIG_PAX_REFCOUNT
19467+ into
19468+1234:
19469+ _ASM_EXTABLE(1234b, 2f)
19470+#endif
19471+
19472 js 2f
19473 LOCK_PREFIX
19474 cmpxchg8b (%esi)
19475@@ -174,6 +235,13 @@ ENTRY(atomic64_add_unless_cx8)
19476 movl %edx, %ecx
19477 addl %esi, %ebx
19478 adcl %edi, %ecx
19479+
19480+#ifdef CONFIG_PAX_REFCOUNT
19481+ into
19482+1234:
19483+ _ASM_EXTABLE(1234b, 3f)
19484+#endif
19485+
19486 LOCK_PREFIX
19487 cmpxchg8b (%ebp)
19488 jne 1b
19489@@ -206,6 +274,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
19490 movl %edx, %ecx
19491 addl $1, %ebx
19492 adcl $0, %ecx
19493+
19494+#ifdef CONFIG_PAX_REFCOUNT
19495+ into
19496+1234:
19497+ _ASM_EXTABLE(1234b, 3f)
19498+#endif
19499+
19500 LOCK_PREFIX
19501 cmpxchg8b (%esi)
19502 jne 1b
19503diff -urNp linux-2.6.39.2/arch/x86/lib/checksum_32.S linux-2.6.39.2/arch/x86/lib/checksum_32.S
19504--- linux-2.6.39.2/arch/x86/lib/checksum_32.S 2011-05-19 00:06:34.000000000 -0400
19505+++ linux-2.6.39.2/arch/x86/lib/checksum_32.S 2011-05-22 19:36:30.000000000 -0400
19506@@ -28,7 +28,8 @@
19507 #include <linux/linkage.h>
19508 #include <asm/dwarf2.h>
19509 #include <asm/errno.h>
19510-
19511+#include <asm/segment.h>
19512+
19513 /*
19514 * computes a partial checksum, e.g. for TCP/UDP fragments
19515 */
19516@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (
19517
19518 #define ARGBASE 16
19519 #define FP 12
19520-
19521-ENTRY(csum_partial_copy_generic)
19522+
19523+ENTRY(csum_partial_copy_generic_to_user)
19524 CFI_STARTPROC
19525+
19526+#ifdef CONFIG_PAX_MEMORY_UDEREF
19527+ pushl_cfi %gs
19528+ popl_cfi %es
19529+ jmp csum_partial_copy_generic
19530+#endif
19531+
19532+ENTRY(csum_partial_copy_generic_from_user)
19533+
19534+#ifdef CONFIG_PAX_MEMORY_UDEREF
19535+ pushl_cfi %gs
19536+ popl_cfi %ds
19537+#endif
19538+
19539+ENTRY(csum_partial_copy_generic)
19540 subl $4,%esp
19541 CFI_ADJUST_CFA_OFFSET 4
19542 pushl_cfi %edi
19543@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19544 jmp 4f
19545 SRC(1: movw (%esi), %bx )
19546 addl $2, %esi
19547-DST( movw %bx, (%edi) )
19548+DST( movw %bx, %es:(%edi) )
19549 addl $2, %edi
19550 addw %bx, %ax
19551 adcl $0, %eax
19552@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19553 SRC(1: movl (%esi), %ebx )
19554 SRC( movl 4(%esi), %edx )
19555 adcl %ebx, %eax
19556-DST( movl %ebx, (%edi) )
19557+DST( movl %ebx, %es:(%edi) )
19558 adcl %edx, %eax
19559-DST( movl %edx, 4(%edi) )
19560+DST( movl %edx, %es:4(%edi) )
19561
19562 SRC( movl 8(%esi), %ebx )
19563 SRC( movl 12(%esi), %edx )
19564 adcl %ebx, %eax
19565-DST( movl %ebx, 8(%edi) )
19566+DST( movl %ebx, %es:8(%edi) )
19567 adcl %edx, %eax
19568-DST( movl %edx, 12(%edi) )
19569+DST( movl %edx, %es:12(%edi) )
19570
19571 SRC( movl 16(%esi), %ebx )
19572 SRC( movl 20(%esi), %edx )
19573 adcl %ebx, %eax
19574-DST( movl %ebx, 16(%edi) )
19575+DST( movl %ebx, %es:16(%edi) )
19576 adcl %edx, %eax
19577-DST( movl %edx, 20(%edi) )
19578+DST( movl %edx, %es:20(%edi) )
19579
19580 SRC( movl 24(%esi), %ebx )
19581 SRC( movl 28(%esi), %edx )
19582 adcl %ebx, %eax
19583-DST( movl %ebx, 24(%edi) )
19584+DST( movl %ebx, %es:24(%edi) )
19585 adcl %edx, %eax
19586-DST( movl %edx, 28(%edi) )
19587+DST( movl %edx, %es:28(%edi) )
19588
19589 lea 32(%esi), %esi
19590 lea 32(%edi), %edi
19591@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19592 shrl $2, %edx # This clears CF
19593 SRC(3: movl (%esi), %ebx )
19594 adcl %ebx, %eax
19595-DST( movl %ebx, (%edi) )
19596+DST( movl %ebx, %es:(%edi) )
19597 lea 4(%esi), %esi
19598 lea 4(%edi), %edi
19599 dec %edx
19600@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19601 jb 5f
19602 SRC( movw (%esi), %cx )
19603 leal 2(%esi), %esi
19604-DST( movw %cx, (%edi) )
19605+DST( movw %cx, %es:(%edi) )
19606 leal 2(%edi), %edi
19607 je 6f
19608 shll $16,%ecx
19609 SRC(5: movb (%esi), %cl )
19610-DST( movb %cl, (%edi) )
19611+DST( movb %cl, %es:(%edi) )
19612 6: addl %ecx, %eax
19613 adcl $0, %eax
19614 7:
19615@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19616
19617 6001:
19618 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19619- movl $-EFAULT, (%ebx)
19620+ movl $-EFAULT, %ss:(%ebx)
19621
19622 # zero the complete destination - computing the rest
19623 # is too much work
19624@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19625
19626 6002:
19627 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19628- movl $-EFAULT,(%ebx)
19629+ movl $-EFAULT,%ss:(%ebx)
19630 jmp 5000b
19631
19632 .previous
19633
19634+ pushl_cfi %ss
19635+ popl_cfi %ds
19636+ pushl_cfi %ss
19637+ popl_cfi %es
19638 popl_cfi %ebx
19639 CFI_RESTORE ebx
19640 popl_cfi %esi
19641@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19642 popl_cfi %ecx # equivalent to addl $4,%esp
19643 ret
19644 CFI_ENDPROC
19645-ENDPROC(csum_partial_copy_generic)
19646+ENDPROC(csum_partial_copy_generic_to_user)
19647
19648 #else
19649
19650 /* Version for PentiumII/PPro */
19651
19652 #define ROUND1(x) \
19653+ nop; nop; nop; \
19654 SRC(movl x(%esi), %ebx ) ; \
19655 addl %ebx, %eax ; \
19656- DST(movl %ebx, x(%edi) ) ;
19657+ DST(movl %ebx, %es:x(%edi)) ;
19658
19659 #define ROUND(x) \
19660+ nop; nop; nop; \
19661 SRC(movl x(%esi), %ebx ) ; \
19662 adcl %ebx, %eax ; \
19663- DST(movl %ebx, x(%edi) ) ;
19664+ DST(movl %ebx, %es:x(%edi)) ;
19665
19666 #define ARGBASE 12
19667-
19668-ENTRY(csum_partial_copy_generic)
19669+
19670+ENTRY(csum_partial_copy_generic_to_user)
19671 CFI_STARTPROC
19672+
19673+#ifdef CONFIG_PAX_MEMORY_UDEREF
19674+ pushl_cfi %gs
19675+ popl_cfi %es
19676+ jmp csum_partial_copy_generic
19677+#endif
19678+
19679+ENTRY(csum_partial_copy_generic_from_user)
19680+
19681+#ifdef CONFIG_PAX_MEMORY_UDEREF
19682+ pushl_cfi %gs
19683+ popl_cfi %ds
19684+#endif
19685+
19686+ENTRY(csum_partial_copy_generic)
19687 pushl_cfi %ebx
19688 CFI_REL_OFFSET ebx, 0
19689 pushl_cfi %edi
19690@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19691 subl %ebx, %edi
19692 lea -1(%esi),%edx
19693 andl $-32,%edx
19694- lea 3f(%ebx,%ebx), %ebx
19695+ lea 3f(%ebx,%ebx,2), %ebx
19696 testl %esi, %esi
19697 jmp *%ebx
19698 1: addl $64,%esi
19699@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19700 jb 5f
19701 SRC( movw (%esi), %dx )
19702 leal 2(%esi), %esi
19703-DST( movw %dx, (%edi) )
19704+DST( movw %dx, %es:(%edi) )
19705 leal 2(%edi), %edi
19706 je 6f
19707 shll $16,%edx
19708 5:
19709 SRC( movb (%esi), %dl )
19710-DST( movb %dl, (%edi) )
19711+DST( movb %dl, %es:(%edi) )
19712 6: addl %edx, %eax
19713 adcl $0, %eax
19714 7:
19715 .section .fixup, "ax"
19716 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19717- movl $-EFAULT, (%ebx)
19718+ movl $-EFAULT, %ss:(%ebx)
19719 # zero the complete destination (computing the rest is too much work)
19720 movl ARGBASE+8(%esp),%edi # dst
19721 movl ARGBASE+12(%esp),%ecx # len
19722@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19723 rep; stosb
19724 jmp 7b
19725 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19726- movl $-EFAULT, (%ebx)
19727+ movl $-EFAULT, %ss:(%ebx)
19728 jmp 7b
19729 .previous
19730
19731+#ifdef CONFIG_PAX_MEMORY_UDEREF
19732+ pushl_cfi %ss
19733+ popl_cfi %ds
19734+ pushl_cfi %ss
19735+ popl_cfi %es
19736+#endif
19737+
19738 popl_cfi %esi
19739 CFI_RESTORE esi
19740 popl_cfi %edi
19741@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19742 CFI_RESTORE ebx
19743 ret
19744 CFI_ENDPROC
19745-ENDPROC(csum_partial_copy_generic)
19746+ENDPROC(csum_partial_copy_generic_to_user)
19747
19748 #undef ROUND
19749 #undef ROUND1
19750diff -urNp linux-2.6.39.2/arch/x86/lib/clear_page_64.S linux-2.6.39.2/arch/x86/lib/clear_page_64.S
19751--- linux-2.6.39.2/arch/x86/lib/clear_page_64.S 2011-05-19 00:06:34.000000000 -0400
19752+++ linux-2.6.39.2/arch/x86/lib/clear_page_64.S 2011-05-22 19:36:30.000000000 -0400
19753@@ -43,7 +43,7 @@ ENDPROC(clear_page)
19754
19755 #include <asm/cpufeature.h>
19756
19757- .section .altinstr_replacement,"ax"
19758+ .section .altinstr_replacement,"a"
19759 1: .byte 0xeb /* jmp <disp8> */
19760 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19761 2:
19762diff -urNp linux-2.6.39.2/arch/x86/lib/copy_page_64.S linux-2.6.39.2/arch/x86/lib/copy_page_64.S
19763--- linux-2.6.39.2/arch/x86/lib/copy_page_64.S 2011-05-19 00:06:34.000000000 -0400
19764+++ linux-2.6.39.2/arch/x86/lib/copy_page_64.S 2011-05-22 19:36:30.000000000 -0400
19765@@ -104,7 +104,7 @@ ENDPROC(copy_page)
19766
19767 #include <asm/cpufeature.h>
19768
19769- .section .altinstr_replacement,"ax"
19770+ .section .altinstr_replacement,"a"
19771 1: .byte 0xeb /* jmp <disp8> */
19772 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19773 2:
19774diff -urNp linux-2.6.39.2/arch/x86/lib/copy_user_64.S linux-2.6.39.2/arch/x86/lib/copy_user_64.S
19775--- linux-2.6.39.2/arch/x86/lib/copy_user_64.S 2011-06-03 00:04:13.000000000 -0400
19776+++ linux-2.6.39.2/arch/x86/lib/copy_user_64.S 2011-06-03 00:32:05.000000000 -0400
19777@@ -15,13 +15,14 @@
19778 #include <asm/asm-offsets.h>
19779 #include <asm/thread_info.h>
19780 #include <asm/cpufeature.h>
19781+#include <asm/pgtable.h>
19782
19783 .macro ALTERNATIVE_JUMP feature,orig,alt
19784 0:
19785 .byte 0xe9 /* 32bit jump */
19786 .long \orig-1f /* by default jump to orig */
19787 1:
19788- .section .altinstr_replacement,"ax"
19789+ .section .altinstr_replacement,"a"
19790 2: .byte 0xe9 /* near jump with 32bit immediate */
19791 .long \alt-1b /* offset */ /* or alternatively to alt */
19792 .previous
19793@@ -64,37 +65,13 @@
19794 #endif
19795 .endm
19796
19797-/* Standard copy_to_user with segment limit checking */
19798-ENTRY(_copy_to_user)
19799- CFI_STARTPROC
19800- GET_THREAD_INFO(%rax)
19801- movq %rdi,%rcx
19802- addq %rdx,%rcx
19803- jc bad_to_user
19804- cmpq TI_addr_limit(%rax),%rcx
19805- ja bad_to_user
19806- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19807- CFI_ENDPROC
19808-ENDPROC(_copy_to_user)
19809-
19810-/* Standard copy_from_user with segment limit checking */
19811-ENTRY(_copy_from_user)
19812- CFI_STARTPROC
19813- GET_THREAD_INFO(%rax)
19814- movq %rsi,%rcx
19815- addq %rdx,%rcx
19816- jc bad_from_user
19817- cmpq TI_addr_limit(%rax),%rcx
19818- ja bad_from_user
19819- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19820- CFI_ENDPROC
19821-ENDPROC(_copy_from_user)
19822-
19823 .section .fixup,"ax"
19824 /* must zero dest */
19825 ENTRY(bad_from_user)
19826 bad_from_user:
19827 CFI_STARTPROC
19828+ testl %edx,%edx
19829+ js bad_to_user
19830 movl %edx,%ecx
19831 xorl %eax,%eax
19832 rep
19833diff -urNp linux-2.6.39.2/arch/x86/lib/copy_user_nocache_64.S linux-2.6.39.2/arch/x86/lib/copy_user_nocache_64.S
19834--- linux-2.6.39.2/arch/x86/lib/copy_user_nocache_64.S 2011-05-19 00:06:34.000000000 -0400
19835+++ linux-2.6.39.2/arch/x86/lib/copy_user_nocache_64.S 2011-05-22 19:36:30.000000000 -0400
19836@@ -14,6 +14,7 @@
19837 #include <asm/current.h>
19838 #include <asm/asm-offsets.h>
19839 #include <asm/thread_info.h>
19840+#include <asm/pgtable.h>
19841
19842 .macro ALIGN_DESTINATION
19843 #ifdef FIX_ALIGNMENT
19844@@ -50,6 +51,15 @@
19845 */
19846 ENTRY(__copy_user_nocache)
19847 CFI_STARTPROC
19848+
19849+#ifdef CONFIG_PAX_MEMORY_UDEREF
19850+ mov $PAX_USER_SHADOW_BASE,%rcx
19851+ cmp %rcx,%rsi
19852+ jae 1f
19853+ add %rcx,%rsi
19854+1:
19855+#endif
19856+
19857 cmpl $8,%edx
19858 jb 20f /* less then 8 bytes, go to byte copy loop */
19859 ALIGN_DESTINATION
19860diff -urNp linux-2.6.39.2/arch/x86/lib/csum-wrappers_64.c linux-2.6.39.2/arch/x86/lib/csum-wrappers_64.c
19861--- linux-2.6.39.2/arch/x86/lib/csum-wrappers_64.c 2011-05-19 00:06:34.000000000 -0400
19862+++ linux-2.6.39.2/arch/x86/lib/csum-wrappers_64.c 2011-05-22 19:36:30.000000000 -0400
19863@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
19864 len -= 2;
19865 }
19866 }
19867+
19868+#ifdef CONFIG_PAX_MEMORY_UDEREF
19869+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19870+ src += PAX_USER_SHADOW_BASE;
19871+#endif
19872+
19873 isum = csum_partial_copy_generic((__force const void *)src,
19874 dst, len, isum, errp, NULL);
19875 if (unlikely(*errp))
19876@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
19877 }
19878
19879 *errp = 0;
19880+
19881+#ifdef CONFIG_PAX_MEMORY_UDEREF
19882+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19883+ dst += PAX_USER_SHADOW_BASE;
19884+#endif
19885+
19886 return csum_partial_copy_generic(src, (void __force *)dst,
19887 len, isum, NULL, errp);
19888 }
19889diff -urNp linux-2.6.39.2/arch/x86/lib/getuser.S linux-2.6.39.2/arch/x86/lib/getuser.S
19890--- linux-2.6.39.2/arch/x86/lib/getuser.S 2011-05-19 00:06:34.000000000 -0400
19891+++ linux-2.6.39.2/arch/x86/lib/getuser.S 2011-05-22 19:36:30.000000000 -0400
19892@@ -33,14 +33,35 @@
19893 #include <asm/asm-offsets.h>
19894 #include <asm/thread_info.h>
19895 #include <asm/asm.h>
19896+#include <asm/segment.h>
19897+#include <asm/pgtable.h>
19898+
19899+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19900+#define __copyuser_seg gs;
19901+#else
19902+#define __copyuser_seg
19903+#endif
19904
19905 .text
19906 ENTRY(__get_user_1)
19907 CFI_STARTPROC
19908+
19909+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19910 GET_THREAD_INFO(%_ASM_DX)
19911 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19912 jae bad_get_user
19913-1: movzb (%_ASM_AX),%edx
19914+
19915+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19916+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19917+ cmp %_ASM_DX,%_ASM_AX
19918+ jae 1234f
19919+ add %_ASM_DX,%_ASM_AX
19920+1234:
19921+#endif
19922+
19923+#endif
19924+
19925+1: __copyuser_seg movzb (%_ASM_AX),%edx
19926 xor %eax,%eax
19927 ret
19928 CFI_ENDPROC
19929@@ -49,11 +70,24 @@ ENDPROC(__get_user_1)
19930 ENTRY(__get_user_2)
19931 CFI_STARTPROC
19932 add $1,%_ASM_AX
19933+
19934+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19935 jc bad_get_user
19936 GET_THREAD_INFO(%_ASM_DX)
19937 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19938 jae bad_get_user
19939-2: movzwl -1(%_ASM_AX),%edx
19940+
19941+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19942+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19943+ cmp %_ASM_DX,%_ASM_AX
19944+ jae 1234f
19945+ add %_ASM_DX,%_ASM_AX
19946+1234:
19947+#endif
19948+
19949+#endif
19950+
19951+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19952 xor %eax,%eax
19953 ret
19954 CFI_ENDPROC
19955@@ -62,11 +96,24 @@ ENDPROC(__get_user_2)
19956 ENTRY(__get_user_4)
19957 CFI_STARTPROC
19958 add $3,%_ASM_AX
19959+
19960+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19961 jc bad_get_user
19962 GET_THREAD_INFO(%_ASM_DX)
19963 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19964 jae bad_get_user
19965-3: mov -3(%_ASM_AX),%edx
19966+
19967+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19968+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19969+ cmp %_ASM_DX,%_ASM_AX
19970+ jae 1234f
19971+ add %_ASM_DX,%_ASM_AX
19972+1234:
19973+#endif
19974+
19975+#endif
19976+
19977+3: __copyuser_seg mov -3(%_ASM_AX),%edx
19978 xor %eax,%eax
19979 ret
19980 CFI_ENDPROC
19981@@ -80,6 +127,15 @@ ENTRY(__get_user_8)
19982 GET_THREAD_INFO(%_ASM_DX)
19983 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19984 jae bad_get_user
19985+
19986+#ifdef CONFIG_PAX_MEMORY_UDEREF
19987+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19988+ cmp %_ASM_DX,%_ASM_AX
19989+ jae 1234f
19990+ add %_ASM_DX,%_ASM_AX
19991+1234:
19992+#endif
19993+
19994 4: movq -7(%_ASM_AX),%_ASM_DX
19995 xor %eax,%eax
19996 ret
19997diff -urNp linux-2.6.39.2/arch/x86/lib/insn.c linux-2.6.39.2/arch/x86/lib/insn.c
19998--- linux-2.6.39.2/arch/x86/lib/insn.c 2011-05-19 00:06:34.000000000 -0400
19999+++ linux-2.6.39.2/arch/x86/lib/insn.c 2011-05-22 19:36:30.000000000 -0400
20000@@ -21,6 +21,11 @@
20001 #include <linux/string.h>
20002 #include <asm/inat.h>
20003 #include <asm/insn.h>
20004+#ifdef __KERNEL__
20005+#include <asm/pgtable_types.h>
20006+#else
20007+#define ktla_ktva(addr) addr
20008+#endif
20009
20010 #define get_next(t, insn) \
20011 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
20012@@ -40,8 +45,8 @@
20013 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
20014 {
20015 memset(insn, 0, sizeof(*insn));
20016- insn->kaddr = kaddr;
20017- insn->next_byte = kaddr;
20018+ insn->kaddr = ktla_ktva(kaddr);
20019+ insn->next_byte = ktla_ktva(kaddr);
20020 insn->x86_64 = x86_64 ? 1 : 0;
20021 insn->opnd_bytes = 4;
20022 if (x86_64)
20023diff -urNp linux-2.6.39.2/arch/x86/lib/mmx_32.c linux-2.6.39.2/arch/x86/lib/mmx_32.c
20024--- linux-2.6.39.2/arch/x86/lib/mmx_32.c 2011-05-19 00:06:34.000000000 -0400
20025+++ linux-2.6.39.2/arch/x86/lib/mmx_32.c 2011-05-22 19:36:30.000000000 -0400
20026@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
20027 {
20028 void *p;
20029 int i;
20030+ unsigned long cr0;
20031
20032 if (unlikely(in_interrupt()))
20033 return __memcpy(to, from, len);
20034@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
20035 kernel_fpu_begin();
20036
20037 __asm__ __volatile__ (
20038- "1: prefetch (%0)\n" /* This set is 28 bytes */
20039- " prefetch 64(%0)\n"
20040- " prefetch 128(%0)\n"
20041- " prefetch 192(%0)\n"
20042- " prefetch 256(%0)\n"
20043+ "1: prefetch (%1)\n" /* This set is 28 bytes */
20044+ " prefetch 64(%1)\n"
20045+ " prefetch 128(%1)\n"
20046+ " prefetch 192(%1)\n"
20047+ " prefetch 256(%1)\n"
20048 "2: \n"
20049 ".section .fixup, \"ax\"\n"
20050- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20051+ "3: \n"
20052+
20053+#ifdef CONFIG_PAX_KERNEXEC
20054+ " movl %%cr0, %0\n"
20055+ " movl %0, %%eax\n"
20056+ " andl $0xFFFEFFFF, %%eax\n"
20057+ " movl %%eax, %%cr0\n"
20058+#endif
20059+
20060+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20061+
20062+#ifdef CONFIG_PAX_KERNEXEC
20063+ " movl %0, %%cr0\n"
20064+#endif
20065+
20066 " jmp 2b\n"
20067 ".previous\n"
20068 _ASM_EXTABLE(1b, 3b)
20069- : : "r" (from));
20070+ : "=&r" (cr0) : "r" (from) : "ax");
20071
20072 for ( ; i > 5; i--) {
20073 __asm__ __volatile__ (
20074- "1: prefetch 320(%0)\n"
20075- "2: movq (%0), %%mm0\n"
20076- " movq 8(%0), %%mm1\n"
20077- " movq 16(%0), %%mm2\n"
20078- " movq 24(%0), %%mm3\n"
20079- " movq %%mm0, (%1)\n"
20080- " movq %%mm1, 8(%1)\n"
20081- " movq %%mm2, 16(%1)\n"
20082- " movq %%mm3, 24(%1)\n"
20083- " movq 32(%0), %%mm0\n"
20084- " movq 40(%0), %%mm1\n"
20085- " movq 48(%0), %%mm2\n"
20086- " movq 56(%0), %%mm3\n"
20087- " movq %%mm0, 32(%1)\n"
20088- " movq %%mm1, 40(%1)\n"
20089- " movq %%mm2, 48(%1)\n"
20090- " movq %%mm3, 56(%1)\n"
20091+ "1: prefetch 320(%1)\n"
20092+ "2: movq (%1), %%mm0\n"
20093+ " movq 8(%1), %%mm1\n"
20094+ " movq 16(%1), %%mm2\n"
20095+ " movq 24(%1), %%mm3\n"
20096+ " movq %%mm0, (%2)\n"
20097+ " movq %%mm1, 8(%2)\n"
20098+ " movq %%mm2, 16(%2)\n"
20099+ " movq %%mm3, 24(%2)\n"
20100+ " movq 32(%1), %%mm0\n"
20101+ " movq 40(%1), %%mm1\n"
20102+ " movq 48(%1), %%mm2\n"
20103+ " movq 56(%1), %%mm3\n"
20104+ " movq %%mm0, 32(%2)\n"
20105+ " movq %%mm1, 40(%2)\n"
20106+ " movq %%mm2, 48(%2)\n"
20107+ " movq %%mm3, 56(%2)\n"
20108 ".section .fixup, \"ax\"\n"
20109- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20110+ "3:\n"
20111+
20112+#ifdef CONFIG_PAX_KERNEXEC
20113+ " movl %%cr0, %0\n"
20114+ " movl %0, %%eax\n"
20115+ " andl $0xFFFEFFFF, %%eax\n"
20116+ " movl %%eax, %%cr0\n"
20117+#endif
20118+
20119+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20120+
20121+#ifdef CONFIG_PAX_KERNEXEC
20122+ " movl %0, %%cr0\n"
20123+#endif
20124+
20125 " jmp 2b\n"
20126 ".previous\n"
20127 _ASM_EXTABLE(1b, 3b)
20128- : : "r" (from), "r" (to) : "memory");
20129+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20130
20131 from += 64;
20132 to += 64;
20133@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
20134 static void fast_copy_page(void *to, void *from)
20135 {
20136 int i;
20137+ unsigned long cr0;
20138
20139 kernel_fpu_begin();
20140
20141@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
20142 * but that is for later. -AV
20143 */
20144 __asm__ __volatile__(
20145- "1: prefetch (%0)\n"
20146- " prefetch 64(%0)\n"
20147- " prefetch 128(%0)\n"
20148- " prefetch 192(%0)\n"
20149- " prefetch 256(%0)\n"
20150+ "1: prefetch (%1)\n"
20151+ " prefetch 64(%1)\n"
20152+ " prefetch 128(%1)\n"
20153+ " prefetch 192(%1)\n"
20154+ " prefetch 256(%1)\n"
20155 "2: \n"
20156 ".section .fixup, \"ax\"\n"
20157- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20158+ "3: \n"
20159+
20160+#ifdef CONFIG_PAX_KERNEXEC
20161+ " movl %%cr0, %0\n"
20162+ " movl %0, %%eax\n"
20163+ " andl $0xFFFEFFFF, %%eax\n"
20164+ " movl %%eax, %%cr0\n"
20165+#endif
20166+
20167+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20168+
20169+#ifdef CONFIG_PAX_KERNEXEC
20170+ " movl %0, %%cr0\n"
20171+#endif
20172+
20173 " jmp 2b\n"
20174 ".previous\n"
20175- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20176+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20177
20178 for (i = 0; i < (4096-320)/64; i++) {
20179 __asm__ __volatile__ (
20180- "1: prefetch 320(%0)\n"
20181- "2: movq (%0), %%mm0\n"
20182- " movntq %%mm0, (%1)\n"
20183- " movq 8(%0), %%mm1\n"
20184- " movntq %%mm1, 8(%1)\n"
20185- " movq 16(%0), %%mm2\n"
20186- " movntq %%mm2, 16(%1)\n"
20187- " movq 24(%0), %%mm3\n"
20188- " movntq %%mm3, 24(%1)\n"
20189- " movq 32(%0), %%mm4\n"
20190- " movntq %%mm4, 32(%1)\n"
20191- " movq 40(%0), %%mm5\n"
20192- " movntq %%mm5, 40(%1)\n"
20193- " movq 48(%0), %%mm6\n"
20194- " movntq %%mm6, 48(%1)\n"
20195- " movq 56(%0), %%mm7\n"
20196- " movntq %%mm7, 56(%1)\n"
20197+ "1: prefetch 320(%1)\n"
20198+ "2: movq (%1), %%mm0\n"
20199+ " movntq %%mm0, (%2)\n"
20200+ " movq 8(%1), %%mm1\n"
20201+ " movntq %%mm1, 8(%2)\n"
20202+ " movq 16(%1), %%mm2\n"
20203+ " movntq %%mm2, 16(%2)\n"
20204+ " movq 24(%1), %%mm3\n"
20205+ " movntq %%mm3, 24(%2)\n"
20206+ " movq 32(%1), %%mm4\n"
20207+ " movntq %%mm4, 32(%2)\n"
20208+ " movq 40(%1), %%mm5\n"
20209+ " movntq %%mm5, 40(%2)\n"
20210+ " movq 48(%1), %%mm6\n"
20211+ " movntq %%mm6, 48(%2)\n"
20212+ " movq 56(%1), %%mm7\n"
20213+ " movntq %%mm7, 56(%2)\n"
20214 ".section .fixup, \"ax\"\n"
20215- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20216+ "3:\n"
20217+
20218+#ifdef CONFIG_PAX_KERNEXEC
20219+ " movl %%cr0, %0\n"
20220+ " movl %0, %%eax\n"
20221+ " andl $0xFFFEFFFF, %%eax\n"
20222+ " movl %%eax, %%cr0\n"
20223+#endif
20224+
20225+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20226+
20227+#ifdef CONFIG_PAX_KERNEXEC
20228+ " movl %0, %%cr0\n"
20229+#endif
20230+
20231 " jmp 2b\n"
20232 ".previous\n"
20233- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
20234+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20235
20236 from += 64;
20237 to += 64;
20238@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
20239 static void fast_copy_page(void *to, void *from)
20240 {
20241 int i;
20242+ unsigned long cr0;
20243
20244 kernel_fpu_begin();
20245
20246 __asm__ __volatile__ (
20247- "1: prefetch (%0)\n"
20248- " prefetch 64(%0)\n"
20249- " prefetch 128(%0)\n"
20250- " prefetch 192(%0)\n"
20251- " prefetch 256(%0)\n"
20252+ "1: prefetch (%1)\n"
20253+ " prefetch 64(%1)\n"
20254+ " prefetch 128(%1)\n"
20255+ " prefetch 192(%1)\n"
20256+ " prefetch 256(%1)\n"
20257 "2: \n"
20258 ".section .fixup, \"ax\"\n"
20259- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20260+ "3: \n"
20261+
20262+#ifdef CONFIG_PAX_KERNEXEC
20263+ " movl %%cr0, %0\n"
20264+ " movl %0, %%eax\n"
20265+ " andl $0xFFFEFFFF, %%eax\n"
20266+ " movl %%eax, %%cr0\n"
20267+#endif
20268+
20269+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20270+
20271+#ifdef CONFIG_PAX_KERNEXEC
20272+ " movl %0, %%cr0\n"
20273+#endif
20274+
20275 " jmp 2b\n"
20276 ".previous\n"
20277- _ASM_EXTABLE(1b, 3b) : : "r" (from));
20278+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20279
20280 for (i = 0; i < 4096/64; i++) {
20281 __asm__ __volatile__ (
20282- "1: prefetch 320(%0)\n"
20283- "2: movq (%0), %%mm0\n"
20284- " movq 8(%0), %%mm1\n"
20285- " movq 16(%0), %%mm2\n"
20286- " movq 24(%0), %%mm3\n"
20287- " movq %%mm0, (%1)\n"
20288- " movq %%mm1, 8(%1)\n"
20289- " movq %%mm2, 16(%1)\n"
20290- " movq %%mm3, 24(%1)\n"
20291- " movq 32(%0), %%mm0\n"
20292- " movq 40(%0), %%mm1\n"
20293- " movq 48(%0), %%mm2\n"
20294- " movq 56(%0), %%mm3\n"
20295- " movq %%mm0, 32(%1)\n"
20296- " movq %%mm1, 40(%1)\n"
20297- " movq %%mm2, 48(%1)\n"
20298- " movq %%mm3, 56(%1)\n"
20299+ "1: prefetch 320(%1)\n"
20300+ "2: movq (%1), %%mm0\n"
20301+ " movq 8(%1), %%mm1\n"
20302+ " movq 16(%1), %%mm2\n"
20303+ " movq 24(%1), %%mm3\n"
20304+ " movq %%mm0, (%2)\n"
20305+ " movq %%mm1, 8(%2)\n"
20306+ " movq %%mm2, 16(%2)\n"
20307+ " movq %%mm3, 24(%2)\n"
20308+ " movq 32(%1), %%mm0\n"
20309+ " movq 40(%1), %%mm1\n"
20310+ " movq 48(%1), %%mm2\n"
20311+ " movq 56(%1), %%mm3\n"
20312+ " movq %%mm0, 32(%2)\n"
20313+ " movq %%mm1, 40(%2)\n"
20314+ " movq %%mm2, 48(%2)\n"
20315+ " movq %%mm3, 56(%2)\n"
20316 ".section .fixup, \"ax\"\n"
20317- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20318+ "3:\n"
20319+
20320+#ifdef CONFIG_PAX_KERNEXEC
20321+ " movl %%cr0, %0\n"
20322+ " movl %0, %%eax\n"
20323+ " andl $0xFFFEFFFF, %%eax\n"
20324+ " movl %%eax, %%cr0\n"
20325+#endif
20326+
20327+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20328+
20329+#ifdef CONFIG_PAX_KERNEXEC
20330+ " movl %0, %%cr0\n"
20331+#endif
20332+
20333 " jmp 2b\n"
20334 ".previous\n"
20335 _ASM_EXTABLE(1b, 3b)
20336- : : "r" (from), "r" (to) : "memory");
20337+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20338
20339 from += 64;
20340 to += 64;
20341diff -urNp linux-2.6.39.2/arch/x86/lib/putuser.S linux-2.6.39.2/arch/x86/lib/putuser.S
20342--- linux-2.6.39.2/arch/x86/lib/putuser.S 2011-05-19 00:06:34.000000000 -0400
20343+++ linux-2.6.39.2/arch/x86/lib/putuser.S 2011-05-22 19:36:30.000000000 -0400
20344@@ -15,7 +15,8 @@
20345 #include <asm/thread_info.h>
20346 #include <asm/errno.h>
20347 #include <asm/asm.h>
20348-
20349+#include <asm/segment.h>
20350+#include <asm/pgtable.h>
20351
20352 /*
20353 * __put_user_X
20354@@ -29,52 +30,119 @@
20355 * as they get called from within inline assembly.
20356 */
20357
20358-#define ENTER CFI_STARTPROC ; \
20359- GET_THREAD_INFO(%_ASM_BX)
20360+#define ENTER CFI_STARTPROC
20361 #define EXIT ret ; \
20362 CFI_ENDPROC
20363
20364+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20365+#define _DEST %_ASM_CX,%_ASM_BX
20366+#else
20367+#define _DEST %_ASM_CX
20368+#endif
20369+
20370+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20371+#define __copyuser_seg gs;
20372+#else
20373+#define __copyuser_seg
20374+#endif
20375+
20376 .text
20377 ENTRY(__put_user_1)
20378 ENTER
20379+
20380+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20381+ GET_THREAD_INFO(%_ASM_BX)
20382 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20383 jae bad_put_user
20384-1: movb %al,(%_ASM_CX)
20385+
20386+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20387+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20388+ cmp %_ASM_BX,%_ASM_CX
20389+ jb 1234f
20390+ xor %ebx,%ebx
20391+1234:
20392+#endif
20393+
20394+#endif
20395+
20396+1: __copyuser_seg movb %al,(_DEST)
20397 xor %eax,%eax
20398 EXIT
20399 ENDPROC(__put_user_1)
20400
20401 ENTRY(__put_user_2)
20402 ENTER
20403+
20404+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20405+ GET_THREAD_INFO(%_ASM_BX)
20406 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20407 sub $1,%_ASM_BX
20408 cmp %_ASM_BX,%_ASM_CX
20409 jae bad_put_user
20410-2: movw %ax,(%_ASM_CX)
20411+
20412+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20413+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20414+ cmp %_ASM_BX,%_ASM_CX
20415+ jb 1234f
20416+ xor %ebx,%ebx
20417+1234:
20418+#endif
20419+
20420+#endif
20421+
20422+2: __copyuser_seg movw %ax,(_DEST)
20423 xor %eax,%eax
20424 EXIT
20425 ENDPROC(__put_user_2)
20426
20427 ENTRY(__put_user_4)
20428 ENTER
20429+
20430+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20431+ GET_THREAD_INFO(%_ASM_BX)
20432 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20433 sub $3,%_ASM_BX
20434 cmp %_ASM_BX,%_ASM_CX
20435 jae bad_put_user
20436-3: movl %eax,(%_ASM_CX)
20437+
20438+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20439+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20440+ cmp %_ASM_BX,%_ASM_CX
20441+ jb 1234f
20442+ xor %ebx,%ebx
20443+1234:
20444+#endif
20445+
20446+#endif
20447+
20448+3: __copyuser_seg movl %eax,(_DEST)
20449 xor %eax,%eax
20450 EXIT
20451 ENDPROC(__put_user_4)
20452
20453 ENTRY(__put_user_8)
20454 ENTER
20455+
20456+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20457+ GET_THREAD_INFO(%_ASM_BX)
20458 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20459 sub $7,%_ASM_BX
20460 cmp %_ASM_BX,%_ASM_CX
20461 jae bad_put_user
20462-4: mov %_ASM_AX,(%_ASM_CX)
20463+
20464+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20465+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20466+ cmp %_ASM_BX,%_ASM_CX
20467+ jb 1234f
20468+ xor %ebx,%ebx
20469+1234:
20470+#endif
20471+
20472+#endif
20473+
20474+4: __copyuser_seg mov %_ASM_AX,(_DEST)
20475 #ifdef CONFIG_X86_32
20476-5: movl %edx,4(%_ASM_CX)
20477+5: __copyuser_seg movl %edx,4(_DEST)
20478 #endif
20479 xor %eax,%eax
20480 EXIT
20481diff -urNp linux-2.6.39.2/arch/x86/lib/usercopy_32.c linux-2.6.39.2/arch/x86/lib/usercopy_32.c
20482--- linux-2.6.39.2/arch/x86/lib/usercopy_32.c 2011-05-19 00:06:34.000000000 -0400
20483+++ linux-2.6.39.2/arch/x86/lib/usercopy_32.c 2011-05-22 19:36:30.000000000 -0400
20484@@ -43,7 +43,7 @@ do { \
20485 __asm__ __volatile__( \
20486 " testl %1,%1\n" \
20487 " jz 2f\n" \
20488- "0: lodsb\n" \
20489+ "0: "__copyuser_seg"lodsb\n" \
20490 " stosb\n" \
20491 " testb %%al,%%al\n" \
20492 " jz 1f\n" \
20493@@ -128,10 +128,12 @@ do { \
20494 int __d0; \
20495 might_fault(); \
20496 __asm__ __volatile__( \
20497+ __COPYUSER_SET_ES \
20498 "0: rep; stosl\n" \
20499 " movl %2,%0\n" \
20500 "1: rep; stosb\n" \
20501 "2:\n" \
20502+ __COPYUSER_RESTORE_ES \
20503 ".section .fixup,\"ax\"\n" \
20504 "3: lea 0(%2,%0,4),%0\n" \
20505 " jmp 2b\n" \
20506@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
20507 might_fault();
20508
20509 __asm__ __volatile__(
20510+ __COPYUSER_SET_ES
20511 " testl %0, %0\n"
20512 " jz 3f\n"
20513 " andl %0,%%ecx\n"
20514@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
20515 " subl %%ecx,%0\n"
20516 " addl %0,%%eax\n"
20517 "1:\n"
20518+ __COPYUSER_RESTORE_ES
20519 ".section .fixup,\"ax\"\n"
20520 "2: xorl %%eax,%%eax\n"
20521 " jmp 1b\n"
20522@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20523
20524 #ifdef CONFIG_X86_INTEL_USERCOPY
20525 static unsigned long
20526-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20527+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20528 {
20529 int d0, d1;
20530 __asm__ __volatile__(
20531@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
20532 " .align 2,0x90\n"
20533 "3: movl 0(%4), %%eax\n"
20534 "4: movl 4(%4), %%edx\n"
20535- "5: movl %%eax, 0(%3)\n"
20536- "6: movl %%edx, 4(%3)\n"
20537+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20538+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20539 "7: movl 8(%4), %%eax\n"
20540 "8: movl 12(%4),%%edx\n"
20541- "9: movl %%eax, 8(%3)\n"
20542- "10: movl %%edx, 12(%3)\n"
20543+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20544+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20545 "11: movl 16(%4), %%eax\n"
20546 "12: movl 20(%4), %%edx\n"
20547- "13: movl %%eax, 16(%3)\n"
20548- "14: movl %%edx, 20(%3)\n"
20549+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20550+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20551 "15: movl 24(%4), %%eax\n"
20552 "16: movl 28(%4), %%edx\n"
20553- "17: movl %%eax, 24(%3)\n"
20554- "18: movl %%edx, 28(%3)\n"
20555+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20556+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20557 "19: movl 32(%4), %%eax\n"
20558 "20: movl 36(%4), %%edx\n"
20559- "21: movl %%eax, 32(%3)\n"
20560- "22: movl %%edx, 36(%3)\n"
20561+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20562+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20563 "23: movl 40(%4), %%eax\n"
20564 "24: movl 44(%4), %%edx\n"
20565- "25: movl %%eax, 40(%3)\n"
20566- "26: movl %%edx, 44(%3)\n"
20567+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20568+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20569 "27: movl 48(%4), %%eax\n"
20570 "28: movl 52(%4), %%edx\n"
20571- "29: movl %%eax, 48(%3)\n"
20572- "30: movl %%edx, 52(%3)\n"
20573+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20574+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20575 "31: movl 56(%4), %%eax\n"
20576 "32: movl 60(%4), %%edx\n"
20577- "33: movl %%eax, 56(%3)\n"
20578- "34: movl %%edx, 60(%3)\n"
20579+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20580+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20581 " addl $-64, %0\n"
20582 " addl $64, %4\n"
20583 " addl $64, %3\n"
20584@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
20585 " shrl $2, %0\n"
20586 " andl $3, %%eax\n"
20587 " cld\n"
20588+ __COPYUSER_SET_ES
20589 "99: rep; movsl\n"
20590 "36: movl %%eax, %0\n"
20591 "37: rep; movsb\n"
20592 "100:\n"
20593+ __COPYUSER_RESTORE_ES
20594+ ".section .fixup,\"ax\"\n"
20595+ "101: lea 0(%%eax,%0,4),%0\n"
20596+ " jmp 100b\n"
20597+ ".previous\n"
20598+ ".section __ex_table,\"a\"\n"
20599+ " .align 4\n"
20600+ " .long 1b,100b\n"
20601+ " .long 2b,100b\n"
20602+ " .long 3b,100b\n"
20603+ " .long 4b,100b\n"
20604+ " .long 5b,100b\n"
20605+ " .long 6b,100b\n"
20606+ " .long 7b,100b\n"
20607+ " .long 8b,100b\n"
20608+ " .long 9b,100b\n"
20609+ " .long 10b,100b\n"
20610+ " .long 11b,100b\n"
20611+ " .long 12b,100b\n"
20612+ " .long 13b,100b\n"
20613+ " .long 14b,100b\n"
20614+ " .long 15b,100b\n"
20615+ " .long 16b,100b\n"
20616+ " .long 17b,100b\n"
20617+ " .long 18b,100b\n"
20618+ " .long 19b,100b\n"
20619+ " .long 20b,100b\n"
20620+ " .long 21b,100b\n"
20621+ " .long 22b,100b\n"
20622+ " .long 23b,100b\n"
20623+ " .long 24b,100b\n"
20624+ " .long 25b,100b\n"
20625+ " .long 26b,100b\n"
20626+ " .long 27b,100b\n"
20627+ " .long 28b,100b\n"
20628+ " .long 29b,100b\n"
20629+ " .long 30b,100b\n"
20630+ " .long 31b,100b\n"
20631+ " .long 32b,100b\n"
20632+ " .long 33b,100b\n"
20633+ " .long 34b,100b\n"
20634+ " .long 35b,100b\n"
20635+ " .long 36b,100b\n"
20636+ " .long 37b,100b\n"
20637+ " .long 99b,101b\n"
20638+ ".previous"
20639+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
20640+ : "1"(to), "2"(from), "0"(size)
20641+ : "eax", "edx", "memory");
20642+ return size;
20643+}
20644+
20645+static unsigned long
20646+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20647+{
20648+ int d0, d1;
20649+ __asm__ __volatile__(
20650+ " .align 2,0x90\n"
20651+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20652+ " cmpl $67, %0\n"
20653+ " jbe 3f\n"
20654+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20655+ " .align 2,0x90\n"
20656+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20657+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20658+ "5: movl %%eax, 0(%3)\n"
20659+ "6: movl %%edx, 4(%3)\n"
20660+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20661+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20662+ "9: movl %%eax, 8(%3)\n"
20663+ "10: movl %%edx, 12(%3)\n"
20664+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20665+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20666+ "13: movl %%eax, 16(%3)\n"
20667+ "14: movl %%edx, 20(%3)\n"
20668+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20669+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20670+ "17: movl %%eax, 24(%3)\n"
20671+ "18: movl %%edx, 28(%3)\n"
20672+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20673+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20674+ "21: movl %%eax, 32(%3)\n"
20675+ "22: movl %%edx, 36(%3)\n"
20676+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20677+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20678+ "25: movl %%eax, 40(%3)\n"
20679+ "26: movl %%edx, 44(%3)\n"
20680+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20681+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20682+ "29: movl %%eax, 48(%3)\n"
20683+ "30: movl %%edx, 52(%3)\n"
20684+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20685+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20686+ "33: movl %%eax, 56(%3)\n"
20687+ "34: movl %%edx, 60(%3)\n"
20688+ " addl $-64, %0\n"
20689+ " addl $64, %4\n"
20690+ " addl $64, %3\n"
20691+ " cmpl $63, %0\n"
20692+ " ja 1b\n"
20693+ "35: movl %0, %%eax\n"
20694+ " shrl $2, %0\n"
20695+ " andl $3, %%eax\n"
20696+ " cld\n"
20697+ "99: rep; "__copyuser_seg" movsl\n"
20698+ "36: movl %%eax, %0\n"
20699+ "37: rep; "__copyuser_seg" movsb\n"
20700+ "100:\n"
20701 ".section .fixup,\"ax\"\n"
20702 "101: lea 0(%%eax,%0,4),%0\n"
20703 " jmp 100b\n"
20704@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
20705 int d0, d1;
20706 __asm__ __volatile__(
20707 " .align 2,0x90\n"
20708- "0: movl 32(%4), %%eax\n"
20709+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20710 " cmpl $67, %0\n"
20711 " jbe 2f\n"
20712- "1: movl 64(%4), %%eax\n"
20713+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20714 " .align 2,0x90\n"
20715- "2: movl 0(%4), %%eax\n"
20716- "21: movl 4(%4), %%edx\n"
20717+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20718+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20719 " movl %%eax, 0(%3)\n"
20720 " movl %%edx, 4(%3)\n"
20721- "3: movl 8(%4), %%eax\n"
20722- "31: movl 12(%4),%%edx\n"
20723+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20724+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20725 " movl %%eax, 8(%3)\n"
20726 " movl %%edx, 12(%3)\n"
20727- "4: movl 16(%4), %%eax\n"
20728- "41: movl 20(%4), %%edx\n"
20729+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20730+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20731 " movl %%eax, 16(%3)\n"
20732 " movl %%edx, 20(%3)\n"
20733- "10: movl 24(%4), %%eax\n"
20734- "51: movl 28(%4), %%edx\n"
20735+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20736+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20737 " movl %%eax, 24(%3)\n"
20738 " movl %%edx, 28(%3)\n"
20739- "11: movl 32(%4), %%eax\n"
20740- "61: movl 36(%4), %%edx\n"
20741+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20742+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20743 " movl %%eax, 32(%3)\n"
20744 " movl %%edx, 36(%3)\n"
20745- "12: movl 40(%4), %%eax\n"
20746- "71: movl 44(%4), %%edx\n"
20747+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20748+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20749 " movl %%eax, 40(%3)\n"
20750 " movl %%edx, 44(%3)\n"
20751- "13: movl 48(%4), %%eax\n"
20752- "81: movl 52(%4), %%edx\n"
20753+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20754+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20755 " movl %%eax, 48(%3)\n"
20756 " movl %%edx, 52(%3)\n"
20757- "14: movl 56(%4), %%eax\n"
20758- "91: movl 60(%4), %%edx\n"
20759+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20760+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20761 " movl %%eax, 56(%3)\n"
20762 " movl %%edx, 60(%3)\n"
20763 " addl $-64, %0\n"
20764@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
20765 " shrl $2, %0\n"
20766 " andl $3, %%eax\n"
20767 " cld\n"
20768- "6: rep; movsl\n"
20769+ "6: rep; "__copyuser_seg" movsl\n"
20770 " movl %%eax,%0\n"
20771- "7: rep; movsb\n"
20772+ "7: rep; "__copyuser_seg" movsb\n"
20773 "8:\n"
20774 ".section .fixup,\"ax\"\n"
20775 "9: lea 0(%%eax,%0,4),%0\n"
20776@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
20777
20778 __asm__ __volatile__(
20779 " .align 2,0x90\n"
20780- "0: movl 32(%4), %%eax\n"
20781+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20782 " cmpl $67, %0\n"
20783 " jbe 2f\n"
20784- "1: movl 64(%4), %%eax\n"
20785+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20786 " .align 2,0x90\n"
20787- "2: movl 0(%4), %%eax\n"
20788- "21: movl 4(%4), %%edx\n"
20789+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20790+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20791 " movnti %%eax, 0(%3)\n"
20792 " movnti %%edx, 4(%3)\n"
20793- "3: movl 8(%4), %%eax\n"
20794- "31: movl 12(%4),%%edx\n"
20795+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20796+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20797 " movnti %%eax, 8(%3)\n"
20798 " movnti %%edx, 12(%3)\n"
20799- "4: movl 16(%4), %%eax\n"
20800- "41: movl 20(%4), %%edx\n"
20801+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20802+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20803 " movnti %%eax, 16(%3)\n"
20804 " movnti %%edx, 20(%3)\n"
20805- "10: movl 24(%4), %%eax\n"
20806- "51: movl 28(%4), %%edx\n"
20807+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20808+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20809 " movnti %%eax, 24(%3)\n"
20810 " movnti %%edx, 28(%3)\n"
20811- "11: movl 32(%4), %%eax\n"
20812- "61: movl 36(%4), %%edx\n"
20813+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20814+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20815 " movnti %%eax, 32(%3)\n"
20816 " movnti %%edx, 36(%3)\n"
20817- "12: movl 40(%4), %%eax\n"
20818- "71: movl 44(%4), %%edx\n"
20819+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20820+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20821 " movnti %%eax, 40(%3)\n"
20822 " movnti %%edx, 44(%3)\n"
20823- "13: movl 48(%4), %%eax\n"
20824- "81: movl 52(%4), %%edx\n"
20825+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20826+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20827 " movnti %%eax, 48(%3)\n"
20828 " movnti %%edx, 52(%3)\n"
20829- "14: movl 56(%4), %%eax\n"
20830- "91: movl 60(%4), %%edx\n"
20831+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20832+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20833 " movnti %%eax, 56(%3)\n"
20834 " movnti %%edx, 60(%3)\n"
20835 " addl $-64, %0\n"
20836@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
20837 " shrl $2, %0\n"
20838 " andl $3, %%eax\n"
20839 " cld\n"
20840- "6: rep; movsl\n"
20841+ "6: rep; "__copyuser_seg" movsl\n"
20842 " movl %%eax,%0\n"
20843- "7: rep; movsb\n"
20844+ "7: rep; "__copyuser_seg" movsb\n"
20845 "8:\n"
20846 ".section .fixup,\"ax\"\n"
20847 "9: lea 0(%%eax,%0,4),%0\n"
20848@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
20849
20850 __asm__ __volatile__(
20851 " .align 2,0x90\n"
20852- "0: movl 32(%4), %%eax\n"
20853+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20854 " cmpl $67, %0\n"
20855 " jbe 2f\n"
20856- "1: movl 64(%4), %%eax\n"
20857+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20858 " .align 2,0x90\n"
20859- "2: movl 0(%4), %%eax\n"
20860- "21: movl 4(%4), %%edx\n"
20861+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20862+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20863 " movnti %%eax, 0(%3)\n"
20864 " movnti %%edx, 4(%3)\n"
20865- "3: movl 8(%4), %%eax\n"
20866- "31: movl 12(%4),%%edx\n"
20867+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20868+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20869 " movnti %%eax, 8(%3)\n"
20870 " movnti %%edx, 12(%3)\n"
20871- "4: movl 16(%4), %%eax\n"
20872- "41: movl 20(%4), %%edx\n"
20873+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20874+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20875 " movnti %%eax, 16(%3)\n"
20876 " movnti %%edx, 20(%3)\n"
20877- "10: movl 24(%4), %%eax\n"
20878- "51: movl 28(%4), %%edx\n"
20879+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20880+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20881 " movnti %%eax, 24(%3)\n"
20882 " movnti %%edx, 28(%3)\n"
20883- "11: movl 32(%4), %%eax\n"
20884- "61: movl 36(%4), %%edx\n"
20885+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20886+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20887 " movnti %%eax, 32(%3)\n"
20888 " movnti %%edx, 36(%3)\n"
20889- "12: movl 40(%4), %%eax\n"
20890- "71: movl 44(%4), %%edx\n"
20891+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20892+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20893 " movnti %%eax, 40(%3)\n"
20894 " movnti %%edx, 44(%3)\n"
20895- "13: movl 48(%4), %%eax\n"
20896- "81: movl 52(%4), %%edx\n"
20897+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20898+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20899 " movnti %%eax, 48(%3)\n"
20900 " movnti %%edx, 52(%3)\n"
20901- "14: movl 56(%4), %%eax\n"
20902- "91: movl 60(%4), %%edx\n"
20903+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20904+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20905 " movnti %%eax, 56(%3)\n"
20906 " movnti %%edx, 60(%3)\n"
20907 " addl $-64, %0\n"
20908@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
20909 " shrl $2, %0\n"
20910 " andl $3, %%eax\n"
20911 " cld\n"
20912- "6: rep; movsl\n"
20913+ "6: rep; "__copyuser_seg" movsl\n"
20914 " movl %%eax,%0\n"
20915- "7: rep; movsb\n"
20916+ "7: rep; "__copyuser_seg" movsb\n"
20917 "8:\n"
20918 ".section .fixup,\"ax\"\n"
20919 "9: lea 0(%%eax,%0,4),%0\n"
20920@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
20921 */
20922 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
20923 unsigned long size);
20924-unsigned long __copy_user_intel(void __user *to, const void *from,
20925+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
20926+ unsigned long size);
20927+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
20928 unsigned long size);
20929 unsigned long __copy_user_zeroing_intel_nocache(void *to,
20930 const void __user *from, unsigned long size);
20931 #endif /* CONFIG_X86_INTEL_USERCOPY */
20932
20933 /* Generic arbitrary sized copy. */
20934-#define __copy_user(to, from, size) \
20935+#define __copy_user(to, from, size, prefix, set, restore) \
20936 do { \
20937 int __d0, __d1, __d2; \
20938 __asm__ __volatile__( \
20939+ set \
20940 " cmp $7,%0\n" \
20941 " jbe 1f\n" \
20942 " movl %1,%0\n" \
20943 " negl %0\n" \
20944 " andl $7,%0\n" \
20945 " subl %0,%3\n" \
20946- "4: rep; movsb\n" \
20947+ "4: rep; "prefix"movsb\n" \
20948 " movl %3,%0\n" \
20949 " shrl $2,%0\n" \
20950 " andl $3,%3\n" \
20951 " .align 2,0x90\n" \
20952- "0: rep; movsl\n" \
20953+ "0: rep; "prefix"movsl\n" \
20954 " movl %3,%0\n" \
20955- "1: rep; movsb\n" \
20956+ "1: rep; "prefix"movsb\n" \
20957 "2:\n" \
20958+ restore \
20959 ".section .fixup,\"ax\"\n" \
20960 "5: addl %3,%0\n" \
20961 " jmp 2b\n" \
20962@@ -682,14 +799,14 @@ do { \
20963 " negl %0\n" \
20964 " andl $7,%0\n" \
20965 " subl %0,%3\n" \
20966- "4: rep; movsb\n" \
20967+ "4: rep; "__copyuser_seg"movsb\n" \
20968 " movl %3,%0\n" \
20969 " shrl $2,%0\n" \
20970 " andl $3,%3\n" \
20971 " .align 2,0x90\n" \
20972- "0: rep; movsl\n" \
20973+ "0: rep; "__copyuser_seg"movsl\n" \
20974 " movl %3,%0\n" \
20975- "1: rep; movsb\n" \
20976+ "1: rep; "__copyuser_seg"movsb\n" \
20977 "2:\n" \
20978 ".section .fixup,\"ax\"\n" \
20979 "5: addl %3,%0\n" \
20980@@ -775,9 +892,9 @@ survive:
20981 }
20982 #endif
20983 if (movsl_is_ok(to, from, n))
20984- __copy_user(to, from, n);
20985+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
20986 else
20987- n = __copy_user_intel(to, from, n);
20988+ n = __generic_copy_to_user_intel(to, from, n);
20989 return n;
20990 }
20991 EXPORT_SYMBOL(__copy_to_user_ll);
20992@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
20993 unsigned long n)
20994 {
20995 if (movsl_is_ok(to, from, n))
20996- __copy_user(to, from, n);
20997+ __copy_user(to, from, n, __copyuser_seg, "", "");
20998 else
20999- n = __copy_user_intel((void __user *)to,
21000- (const void *)from, n);
21001+ n = __generic_copy_from_user_intel(to, from, n);
21002 return n;
21003 }
21004 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
21005@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
21006 if (n > 64 && cpu_has_xmm2)
21007 n = __copy_user_intel_nocache(to, from, n);
21008 else
21009- __copy_user(to, from, n);
21010+ __copy_user(to, from, n, __copyuser_seg, "", "");
21011 #else
21012- __copy_user(to, from, n);
21013+ __copy_user(to, from, n, __copyuser_seg, "", "");
21014 #endif
21015 return n;
21016 }
21017 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
21018
21019-/**
21020- * copy_to_user: - Copy a block of data into user space.
21021- * @to: Destination address, in user space.
21022- * @from: Source address, in kernel space.
21023- * @n: Number of bytes to copy.
21024- *
21025- * Context: User context only. This function may sleep.
21026- *
21027- * Copy data from kernel space to user space.
21028- *
21029- * Returns number of bytes that could not be copied.
21030- * On success, this will be zero.
21031- */
21032-unsigned long
21033-copy_to_user(void __user *to, const void *from, unsigned long n)
21034+void copy_from_user_overflow(void)
21035 {
21036- if (access_ok(VERIFY_WRITE, to, n))
21037- n = __copy_to_user(to, from, n);
21038- return n;
21039+ WARN(1, "Buffer overflow detected!\n");
21040 }
21041-EXPORT_SYMBOL(copy_to_user);
21042+EXPORT_SYMBOL(copy_from_user_overflow);
21043
21044-/**
21045- * copy_from_user: - Copy a block of data from user space.
21046- * @to: Destination address, in kernel space.
21047- * @from: Source address, in user space.
21048- * @n: Number of bytes to copy.
21049- *
21050- * Context: User context only. This function may sleep.
21051- *
21052- * Copy data from user space to kernel space.
21053- *
21054- * Returns number of bytes that could not be copied.
21055- * On success, this will be zero.
21056- *
21057- * If some data could not be copied, this function will pad the copied
21058- * data to the requested size using zero bytes.
21059- */
21060-unsigned long
21061-_copy_from_user(void *to, const void __user *from, unsigned long n)
21062+void copy_to_user_overflow(void)
21063 {
21064- if (access_ok(VERIFY_READ, from, n))
21065- n = __copy_from_user(to, from, n);
21066- else
21067- memset(to, 0, n);
21068- return n;
21069+ WARN(1, "Buffer overflow detected!\n");
21070 }
21071-EXPORT_SYMBOL(_copy_from_user);
21072+EXPORT_SYMBOL(copy_to_user_overflow);
21073
21074-void copy_from_user_overflow(void)
21075+#ifdef CONFIG_PAX_MEMORY_UDEREF
21076+void __set_fs(mm_segment_t x)
21077 {
21078- WARN(1, "Buffer overflow detected!\n");
21079+ switch (x.seg) {
21080+ case 0:
21081+ loadsegment(gs, 0);
21082+ break;
21083+ case TASK_SIZE_MAX:
21084+ loadsegment(gs, __USER_DS);
21085+ break;
21086+ case -1UL:
21087+ loadsegment(gs, __KERNEL_DS);
21088+ break;
21089+ default:
21090+ BUG();
21091+ }
21092+ return;
21093 }
21094-EXPORT_SYMBOL(copy_from_user_overflow);
21095+EXPORT_SYMBOL(__set_fs);
21096+
21097+void set_fs(mm_segment_t x)
21098+{
21099+ current_thread_info()->addr_limit = x;
21100+ __set_fs(x);
21101+}
21102+EXPORT_SYMBOL(set_fs);
21103+#endif
21104diff -urNp linux-2.6.39.2/arch/x86/lib/usercopy_64.c linux-2.6.39.2/arch/x86/lib/usercopy_64.c
21105--- linux-2.6.39.2/arch/x86/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
21106+++ linux-2.6.39.2/arch/x86/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
21107@@ -42,6 +42,12 @@ long
21108 __strncpy_from_user(char *dst, const char __user *src, long count)
21109 {
21110 long res;
21111+
21112+#ifdef CONFIG_PAX_MEMORY_UDEREF
21113+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
21114+ src += PAX_USER_SHADOW_BASE;
21115+#endif
21116+
21117 __do_strncpy_from_user(dst, src, count, res);
21118 return res;
21119 }
21120@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
21121 {
21122 long __d0;
21123 might_fault();
21124+
21125+#ifdef CONFIG_PAX_MEMORY_UDEREF
21126+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
21127+ addr += PAX_USER_SHADOW_BASE;
21128+#endif
21129+
21130 /* no memory constraint because it doesn't change any memory gcc knows
21131 about */
21132 asm volatile(
21133@@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
21134
21135 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
21136 {
21137- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21138+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21139+
21140+#ifdef CONFIG_PAX_MEMORY_UDEREF
21141+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
21142+ to += PAX_USER_SHADOW_BASE;
21143+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
21144+ from += PAX_USER_SHADOW_BASE;
21145+#endif
21146+
21147 return copy_user_generic((__force void *)to, (__force void *)from, len);
21148- }
21149- return len;
21150+ }
21151+ return len;
21152 }
21153 EXPORT_SYMBOL(copy_in_user);
21154
21155diff -urNp linux-2.6.39.2/arch/x86/Makefile linux-2.6.39.2/arch/x86/Makefile
21156--- linux-2.6.39.2/arch/x86/Makefile 2011-05-19 00:06:34.000000000 -0400
21157+++ linux-2.6.39.2/arch/x86/Makefile 2011-05-22 19:36:30.000000000 -0400
21158@@ -195,3 +195,12 @@ define archhelp
21159 echo ' FDARGS="..." arguments for the booted kernel'
21160 echo ' FDINITRD=file initrd for the booted kernel'
21161 endef
21162+
21163+define OLD_LD
21164+
21165+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
21166+*** Please upgrade your binutils to 2.18 or newer
21167+endef
21168+
21169+archprepare:
21170+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
21171diff -urNp linux-2.6.39.2/arch/x86/mm/extable.c linux-2.6.39.2/arch/x86/mm/extable.c
21172--- linux-2.6.39.2/arch/x86/mm/extable.c 2011-05-19 00:06:34.000000000 -0400
21173+++ linux-2.6.39.2/arch/x86/mm/extable.c 2011-05-22 19:36:30.000000000 -0400
21174@@ -1,14 +1,71 @@
21175 #include <linux/module.h>
21176 #include <linux/spinlock.h>
21177+#include <linux/sort.h>
21178 #include <asm/uaccess.h>
21179+#include <asm/pgtable.h>
21180
21181+/*
21182+ * The exception table needs to be sorted so that the binary
21183+ * search that we use to find entries in it works properly.
21184+ * This is used both for the kernel exception table and for
21185+ * the exception tables of modules that get loaded.
21186+ */
21187+static int cmp_ex(const void *a, const void *b)
21188+{
21189+ const struct exception_table_entry *x = a, *y = b;
21190+
21191+ /* avoid overflow */
21192+ if (x->insn > y->insn)
21193+ return 1;
21194+ if (x->insn < y->insn)
21195+ return -1;
21196+ return 0;
21197+}
21198+
21199+static void swap_ex(void *a, void *b, int size)
21200+{
21201+ struct exception_table_entry t, *x = a, *y = b;
21202+
21203+ t = *x;
21204+
21205+ pax_open_kernel();
21206+ *x = *y;
21207+ *y = t;
21208+ pax_close_kernel();
21209+}
21210+
21211+void sort_extable(struct exception_table_entry *start,
21212+ struct exception_table_entry *finish)
21213+{
21214+ sort(start, finish - start, sizeof(struct exception_table_entry),
21215+ cmp_ex, swap_ex);
21216+}
21217+
21218+#ifdef CONFIG_MODULES
21219+/*
21220+ * If the exception table is sorted, any referring to the module init
21221+ * will be at the beginning or the end.
21222+ */
21223+void trim_init_extable(struct module *m)
21224+{
21225+ /*trim the beginning*/
21226+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
21227+ m->extable++;
21228+ m->num_exentries--;
21229+ }
21230+ /*trim the end*/
21231+ while (m->num_exentries &&
21232+ within_module_init(m->extable[m->num_exentries-1].insn, m))
21233+ m->num_exentries--;
21234+}
21235+#endif /* CONFIG_MODULES */
21236
21237 int fixup_exception(struct pt_regs *regs)
21238 {
21239 const struct exception_table_entry *fixup;
21240
21241 #ifdef CONFIG_PNPBIOS
21242- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
21243+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
21244 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
21245 extern u32 pnp_bios_is_utter_crap;
21246 pnp_bios_is_utter_crap = 1;
21247diff -urNp linux-2.6.39.2/arch/x86/mm/fault.c linux-2.6.39.2/arch/x86/mm/fault.c
21248--- linux-2.6.39.2/arch/x86/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
21249+++ linux-2.6.39.2/arch/x86/mm/fault.c 2011-06-06 17:34:04.000000000 -0400
21250@@ -12,10 +12,18 @@
21251 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
21252 #include <linux/perf_event.h> /* perf_sw_event */
21253 #include <linux/hugetlb.h> /* hstate_index_to_shift */
21254+#include <linux/unistd.h>
21255+#include <linux/compiler.h>
21256
21257 #include <asm/traps.h> /* dotraplinkage, ... */
21258 #include <asm/pgalloc.h> /* pgd_*(), ... */
21259 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
21260+#include <asm/vsyscall.h>
21261+#include <asm/tlbflush.h>
21262+
21263+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21264+#include <asm/stacktrace.h>
21265+#endif
21266
21267 /*
21268 * Page fault error code bits:
21269@@ -53,7 +61,7 @@ static inline int __kprobes notify_page_
21270 int ret = 0;
21271
21272 /* kprobe_running() needs smp_processor_id() */
21273- if (kprobes_built_in() && !user_mode_vm(regs)) {
21274+ if (kprobes_built_in() && !user_mode(regs)) {
21275 preempt_disable();
21276 if (kprobe_running() && kprobe_fault_handler(regs, 14))
21277 ret = 1;
21278@@ -114,7 +122,10 @@ check_prefetch_opcode(struct pt_regs *re
21279 return !instr_lo || (instr_lo>>1) == 1;
21280 case 0x00:
21281 /* Prefetch instruction is 0x0F0D or 0x0F18 */
21282- if (probe_kernel_address(instr, opcode))
21283+ if (user_mode(regs)) {
21284+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
21285+ return 0;
21286+ } else if (probe_kernel_address(instr, opcode))
21287 return 0;
21288
21289 *prefetch = (instr_lo == 0xF) &&
21290@@ -148,7 +159,10 @@ is_prefetch(struct pt_regs *regs, unsign
21291 while (instr < max_instr) {
21292 unsigned char opcode;
21293
21294- if (probe_kernel_address(instr, opcode))
21295+ if (user_mode(regs)) {
21296+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
21297+ break;
21298+ } else if (probe_kernel_address(instr, opcode))
21299 break;
21300
21301 instr++;
21302@@ -179,6 +193,30 @@ force_sig_info_fault(int si_signo, int s
21303 force_sig_info(si_signo, &info, tsk);
21304 }
21305
21306+#ifdef CONFIG_PAX_EMUTRAMP
21307+static int pax_handle_fetch_fault(struct pt_regs *regs);
21308+#endif
21309+
21310+#ifdef CONFIG_PAX_PAGEEXEC
21311+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
21312+{
21313+ pgd_t *pgd;
21314+ pud_t *pud;
21315+ pmd_t *pmd;
21316+
21317+ pgd = pgd_offset(mm, address);
21318+ if (!pgd_present(*pgd))
21319+ return NULL;
21320+ pud = pud_offset(pgd, address);
21321+ if (!pud_present(*pud))
21322+ return NULL;
21323+ pmd = pmd_offset(pud, address);
21324+ if (!pmd_present(*pmd))
21325+ return NULL;
21326+ return pmd;
21327+}
21328+#endif
21329+
21330 DEFINE_SPINLOCK(pgd_lock);
21331 LIST_HEAD(pgd_list);
21332
21333@@ -229,10 +267,22 @@ void vmalloc_sync_all(void)
21334 for (address = VMALLOC_START & PMD_MASK;
21335 address >= TASK_SIZE && address < FIXADDR_TOP;
21336 address += PMD_SIZE) {
21337+
21338+#ifdef CONFIG_PAX_PER_CPU_PGD
21339+ unsigned long cpu;
21340+#else
21341 struct page *page;
21342+#endif
21343
21344 spin_lock(&pgd_lock);
21345+
21346+#ifdef CONFIG_PAX_PER_CPU_PGD
21347+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21348+ pgd_t *pgd = get_cpu_pgd(cpu);
21349+ pmd_t *ret;
21350+#else
21351 list_for_each_entry(page, &pgd_list, lru) {
21352+ pgd_t *pgd = page_address(page);
21353 spinlock_t *pgt_lock;
21354 pmd_t *ret;
21355
21356@@ -240,8 +290,13 @@ void vmalloc_sync_all(void)
21357 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21358
21359 spin_lock(pgt_lock);
21360- ret = vmalloc_sync_one(page_address(page), address);
21361+#endif
21362+
21363+ ret = vmalloc_sync_one(pgd, address);
21364+
21365+#ifndef CONFIG_PAX_PER_CPU_PGD
21366 spin_unlock(pgt_lock);
21367+#endif
21368
21369 if (!ret)
21370 break;
21371@@ -275,6 +330,11 @@ static noinline __kprobes int vmalloc_fa
21372 * an interrupt in the middle of a task switch..
21373 */
21374 pgd_paddr = read_cr3();
21375+
21376+#ifdef CONFIG_PAX_PER_CPU_PGD
21377+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21378+#endif
21379+
21380 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21381 if (!pmd_k)
21382 return -1;
21383@@ -370,7 +430,14 @@ static noinline __kprobes int vmalloc_fa
21384 * happen within a race in page table update. In the later
21385 * case just flush:
21386 */
21387+
21388+#ifdef CONFIG_PAX_PER_CPU_PGD
21389+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21390+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21391+#else
21392 pgd = pgd_offset(current->active_mm, address);
21393+#endif
21394+
21395 pgd_ref = pgd_offset_k(address);
21396 if (pgd_none(*pgd_ref))
21397 return -1;
21398@@ -532,7 +599,7 @@ static int is_errata93(struct pt_regs *r
21399 static int is_errata100(struct pt_regs *regs, unsigned long address)
21400 {
21401 #ifdef CONFIG_X86_64
21402- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21403+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21404 return 1;
21405 #endif
21406 return 0;
21407@@ -559,7 +626,7 @@ static int is_f00f_bug(struct pt_regs *r
21408 }
21409
21410 static const char nx_warning[] = KERN_CRIT
21411-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21412+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21413
21414 static void
21415 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21416@@ -568,15 +635,26 @@ show_fault_oops(struct pt_regs *regs, un
21417 if (!oops_may_print())
21418 return;
21419
21420- if (error_code & PF_INSTR) {
21421+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21422 unsigned int level;
21423
21424 pte_t *pte = lookup_address(address, &level);
21425
21426 if (pte && pte_present(*pte) && !pte_exec(*pte))
21427- printk(nx_warning, current_uid());
21428+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21429 }
21430
21431+#ifdef CONFIG_PAX_KERNEXEC
21432+ if (init_mm.start_code <= address && address < init_mm.end_code) {
21433+ if (current->signal->curr_ip)
21434+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21435+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21436+ else
21437+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21438+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21439+ }
21440+#endif
21441+
21442 printk(KERN_ALERT "BUG: unable to handle kernel ");
21443 if (address < PAGE_SIZE)
21444 printk(KERN_CONT "NULL pointer dereference");
21445@@ -701,6 +779,68 @@ __bad_area_nosemaphore(struct pt_regs *r
21446 unsigned long address, int si_code)
21447 {
21448 struct task_struct *tsk = current;
21449+ struct mm_struct *mm = tsk->mm;
21450+
21451+#ifdef CONFIG_X86_64
21452+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
21453+ if (regs->ip == (unsigned long)vgettimeofday) {
21454+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
21455+ return;
21456+ } else if (regs->ip == (unsigned long)vtime) {
21457+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
21458+ return;
21459+ } else if (regs->ip == (unsigned long)vgetcpu) {
21460+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
21461+ return;
21462+ }
21463+ }
21464+#endif
21465+
21466+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21467+ if (mm && (error_code & PF_USER)) {
21468+ unsigned long ip = regs->ip;
21469+
21470+ if (v8086_mode(regs))
21471+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21472+
21473+ /*
21474+ * It's possible to have interrupts off here:
21475+ */
21476+ local_irq_enable();
21477+
21478+#ifdef CONFIG_PAX_PAGEEXEC
21479+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
21480+ (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
21481+
21482+#ifdef CONFIG_PAX_EMUTRAMP
21483+ switch (pax_handle_fetch_fault(regs)) {
21484+ case 2:
21485+ return;
21486+ }
21487+#endif
21488+
21489+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21490+ do_group_exit(SIGKILL);
21491+ }
21492+#endif
21493+
21494+#ifdef CONFIG_PAX_SEGMEXEC
21495+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
21496+
21497+#ifdef CONFIG_PAX_EMUTRAMP
21498+ switch (pax_handle_fetch_fault(regs)) {
21499+ case 2:
21500+ return;
21501+ }
21502+#endif
21503+
21504+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21505+ do_group_exit(SIGKILL);
21506+ }
21507+#endif
21508+
21509+ }
21510+#endif
21511
21512 /* User mode accesses just cause a SIGSEGV */
21513 if (error_code & PF_USER) {
21514@@ -855,6 +995,99 @@ static int spurious_fault_check(unsigned
21515 return 1;
21516 }
21517
21518+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21519+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21520+{
21521+ pte_t *pte;
21522+ pmd_t *pmd;
21523+ spinlock_t *ptl;
21524+ unsigned char pte_mask;
21525+
21526+ if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21527+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21528+ return 0;
21529+
21530+ /* PaX: it's our fault, let's handle it if we can */
21531+
21532+ /* PaX: take a look at read faults before acquiring any locks */
21533+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21534+ /* instruction fetch attempt from a protected page in user mode */
21535+ up_read(&mm->mmap_sem);
21536+
21537+#ifdef CONFIG_PAX_EMUTRAMP
21538+ switch (pax_handle_fetch_fault(regs)) {
21539+ case 2:
21540+ return 1;
21541+ }
21542+#endif
21543+
21544+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21545+ do_group_exit(SIGKILL);
21546+ }
21547+
21548+ pmd = pax_get_pmd(mm, address);
21549+ if (unlikely(!pmd))
21550+ return 0;
21551+
21552+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21553+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21554+ pte_unmap_unlock(pte, ptl);
21555+ return 0;
21556+ }
21557+
21558+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21559+ /* write attempt to a protected page in user mode */
21560+ pte_unmap_unlock(pte, ptl);
21561+ return 0;
21562+ }
21563+
21564+#ifdef CONFIG_SMP
21565+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21566+#else
21567+ if (likely(address > get_limit(regs->cs)))
21568+#endif
21569+ {
21570+ set_pte(pte, pte_mkread(*pte));
21571+ __flush_tlb_one(address);
21572+ pte_unmap_unlock(pte, ptl);
21573+ up_read(&mm->mmap_sem);
21574+ return 1;
21575+ }
21576+
21577+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21578+
21579+ /*
21580+ * PaX: fill DTLB with user rights and retry
21581+ */
21582+ __asm__ __volatile__ (
21583+ "orb %2,(%1)\n"
21584+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21585+/*
21586+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21587+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21588+ * page fault when examined during a TLB load attempt. this is true not only
21589+ * for PTEs holding a non-present entry but also present entries that will
21590+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21591+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21592+ * for our target pages since their PTEs are simply not in the TLBs at all.
21593+
21594+ * the best thing in omitting it is that we gain around 15-20% speed in the
21595+ * fast path of the page fault handler and can get rid of tracing since we
21596+ * can no longer flush unintended entries.
21597+ */
21598+ "invlpg (%0)\n"
21599+#endif
21600+ __copyuser_seg"testb $0,(%0)\n"
21601+ "xorb %3,(%1)\n"
21602+ :
21603+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21604+ : "memory", "cc");
21605+ pte_unmap_unlock(pte, ptl);
21606+ up_read(&mm->mmap_sem);
21607+ return 1;
21608+}
21609+#endif
21610+
21611 /*
21612 * Handle a spurious fault caused by a stale TLB entry.
21613 *
21614@@ -927,6 +1160,9 @@ int show_unhandled_signals = 1;
21615 static inline int
21616 access_error(unsigned long error_code, struct vm_area_struct *vma)
21617 {
21618+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21619+ return 1;
21620+
21621 if (error_code & PF_WRITE) {
21622 /* write, present and write, not present: */
21623 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21624@@ -960,19 +1196,33 @@ do_page_fault(struct pt_regs *regs, unsi
21625 {
21626 struct vm_area_struct *vma;
21627 struct task_struct *tsk;
21628- unsigned long address;
21629 struct mm_struct *mm;
21630 int fault;
21631 int write = error_code & PF_WRITE;
21632 unsigned int flags = FAULT_FLAG_ALLOW_RETRY |
21633 (write ? FAULT_FLAG_WRITE : 0);
21634
21635+ /* Get the faulting address: */
21636+ unsigned long address = read_cr2();
21637+
21638+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21639+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21640+ if (!search_exception_tables(regs->ip)) {
21641+ bad_area_nosemaphore(regs, error_code, address);
21642+ return;
21643+ }
21644+ if (address < PAX_USER_SHADOW_BASE) {
21645+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21646+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
21647+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21648+ } else
21649+ address -= PAX_USER_SHADOW_BASE;
21650+ }
21651+#endif
21652+
21653 tsk = current;
21654 mm = tsk->mm;
21655
21656- /* Get the faulting address: */
21657- address = read_cr2();
21658-
21659 /*
21660 * Detect and handle instructions that would cause a page fault for
21661 * both a tracked kernel page and a userspace page.
21662@@ -1032,7 +1282,7 @@ do_page_fault(struct pt_regs *regs, unsi
21663 * User-mode registers count as a user access even for any
21664 * potential system fault or CPU buglet:
21665 */
21666- if (user_mode_vm(regs)) {
21667+ if (user_mode(regs)) {
21668 local_irq_enable();
21669 error_code |= PF_USER;
21670 } else {
21671@@ -1087,6 +1337,11 @@ retry:
21672 might_sleep();
21673 }
21674
21675+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21676+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21677+ return;
21678+#endif
21679+
21680 vma = find_vma(mm, address);
21681 if (unlikely(!vma)) {
21682 bad_area(regs, error_code, address);
21683@@ -1098,18 +1353,24 @@ retry:
21684 bad_area(regs, error_code, address);
21685 return;
21686 }
21687- if (error_code & PF_USER) {
21688- /*
21689- * Accessing the stack below %sp is always a bug.
21690- * The large cushion allows instructions like enter
21691- * and pusha to work. ("enter $65535, $31" pushes
21692- * 32 pointers and then decrements %sp by 65535.)
21693- */
21694- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21695- bad_area(regs, error_code, address);
21696- return;
21697- }
21698+ /*
21699+ * Accessing the stack below %sp is always a bug.
21700+ * The large cushion allows instructions like enter
21701+ * and pusha to work. ("enter $65535, $31" pushes
21702+ * 32 pointers and then decrements %sp by 65535.)
21703+ */
21704+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21705+ bad_area(regs, error_code, address);
21706+ return;
21707 }
21708+
21709+#ifdef CONFIG_PAX_SEGMEXEC
21710+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21711+ bad_area(regs, error_code, address);
21712+ return;
21713+ }
21714+#endif
21715+
21716 if (unlikely(expand_stack(vma, address))) {
21717 bad_area(regs, error_code, address);
21718 return;
21719@@ -1164,3 +1425,199 @@ good_area:
21720
21721 up_read(&mm->mmap_sem);
21722 }
21723+
21724+#ifdef CONFIG_PAX_EMUTRAMP
21725+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21726+{
21727+ int err;
21728+
21729+ do { /* PaX: gcc trampoline emulation #1 */
21730+ unsigned char mov1, mov2;
21731+ unsigned short jmp;
21732+ unsigned int addr1, addr2;
21733+
21734+#ifdef CONFIG_X86_64
21735+ if ((regs->ip + 11) >> 32)
21736+ break;
21737+#endif
21738+
21739+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21740+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21741+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21742+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21743+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21744+
21745+ if (err)
21746+ break;
21747+
21748+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21749+ regs->cx = addr1;
21750+ regs->ax = addr2;
21751+ regs->ip = addr2;
21752+ return 2;
21753+ }
21754+ } while (0);
21755+
21756+ do { /* PaX: gcc trampoline emulation #2 */
21757+ unsigned char mov, jmp;
21758+ unsigned int addr1, addr2;
21759+
21760+#ifdef CONFIG_X86_64
21761+ if ((regs->ip + 9) >> 32)
21762+ break;
21763+#endif
21764+
21765+ err = get_user(mov, (unsigned char __user *)regs->ip);
21766+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21767+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21768+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21769+
21770+ if (err)
21771+ break;
21772+
21773+ if (mov == 0xB9 && jmp == 0xE9) {
21774+ regs->cx = addr1;
21775+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21776+ return 2;
21777+ }
21778+ } while (0);
21779+
21780+ return 1; /* PaX in action */
21781+}
21782+
21783+#ifdef CONFIG_X86_64
21784+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21785+{
21786+ int err;
21787+
21788+ do { /* PaX: gcc trampoline emulation #1 */
21789+ unsigned short mov1, mov2, jmp1;
21790+ unsigned char jmp2;
21791+ unsigned int addr1;
21792+ unsigned long addr2;
21793+
21794+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21795+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21796+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21797+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21798+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21799+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21800+
21801+ if (err)
21802+ break;
21803+
21804+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21805+ regs->r11 = addr1;
21806+ regs->r10 = addr2;
21807+ regs->ip = addr1;
21808+ return 2;
21809+ }
21810+ } while (0);
21811+
21812+ do { /* PaX: gcc trampoline emulation #2 */
21813+ unsigned short mov1, mov2, jmp1;
21814+ unsigned char jmp2;
21815+ unsigned long addr1, addr2;
21816+
21817+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21818+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21819+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21820+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21821+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21822+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21823+
21824+ if (err)
21825+ break;
21826+
21827+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21828+ regs->r11 = addr1;
21829+ regs->r10 = addr2;
21830+ regs->ip = addr1;
21831+ return 2;
21832+ }
21833+ } while (0);
21834+
21835+ return 1; /* PaX in action */
21836+}
21837+#endif
21838+
21839+/*
21840+ * PaX: decide what to do with offenders (regs->ip = fault address)
21841+ *
21842+ * returns 1 when task should be killed
21843+ * 2 when gcc trampoline was detected
21844+ */
21845+static int pax_handle_fetch_fault(struct pt_regs *regs)
21846+{
21847+ if (v8086_mode(regs))
21848+ return 1;
21849+
21850+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21851+ return 1;
21852+
21853+#ifdef CONFIG_X86_32
21854+ return pax_handle_fetch_fault_32(regs);
21855+#else
21856+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21857+ return pax_handle_fetch_fault_32(regs);
21858+ else
21859+ return pax_handle_fetch_fault_64(regs);
21860+#endif
21861+}
21862+#endif
21863+
21864+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21865+void pax_report_insns(void *pc, void *sp)
21866+{
21867+ long i;
21868+
21869+ printk(KERN_ERR "PAX: bytes at PC: ");
21870+ for (i = 0; i < 20; i++) {
21871+ unsigned char c;
21872+ if (get_user(c, (__force unsigned char __user *)pc+i))
21873+ printk(KERN_CONT "?? ");
21874+ else
21875+ printk(KERN_CONT "%02x ", c);
21876+ }
21877+ printk("\n");
21878+
21879+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
21880+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
21881+ unsigned long c;
21882+ if (get_user(c, (__force unsigned long __user *)sp+i))
21883+#ifdef CONFIG_X86_32
21884+ printk(KERN_CONT "???????? ");
21885+#else
21886+ printk(KERN_CONT "???????????????? ");
21887+#endif
21888+ else
21889+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
21890+ }
21891+ printk("\n");
21892+}
21893+#endif
21894+
21895+/**
21896+ * probe_kernel_write(): safely attempt to write to a location
21897+ * @dst: address to write to
21898+ * @src: pointer to the data that shall be written
21899+ * @size: size of the data chunk
21900+ *
21901+ * Safely write to address @dst from the buffer at @src. If a kernel fault
21902+ * happens, handle that and return -EFAULT.
21903+ */
21904+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
21905+{
21906+ long ret;
21907+ mm_segment_t old_fs = get_fs();
21908+
21909+ set_fs(KERNEL_DS);
21910+ pagefault_disable();
21911+ pax_open_kernel();
21912+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
21913+ pax_close_kernel();
21914+ pagefault_enable();
21915+ set_fs(old_fs);
21916+
21917+ return ret ? -EFAULT : 0;
21918+}
21919diff -urNp linux-2.6.39.2/arch/x86/mm/gup.c linux-2.6.39.2/arch/x86/mm/gup.c
21920--- linux-2.6.39.2/arch/x86/mm/gup.c 2011-05-19 00:06:34.000000000 -0400
21921+++ linux-2.6.39.2/arch/x86/mm/gup.c 2011-05-22 19:36:30.000000000 -0400
21922@@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long
21923 addr = start;
21924 len = (unsigned long) nr_pages << PAGE_SHIFT;
21925 end = start + len;
21926- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21927+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21928 (void __user *)start, len)))
21929 return 0;
21930
21931diff -urNp linux-2.6.39.2/arch/x86/mm/highmem_32.c linux-2.6.39.2/arch/x86/mm/highmem_32.c
21932--- linux-2.6.39.2/arch/x86/mm/highmem_32.c 2011-05-19 00:06:34.000000000 -0400
21933+++ linux-2.6.39.2/arch/x86/mm/highmem_32.c 2011-05-22 19:36:30.000000000 -0400
21934@@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
21935 idx = type + KM_TYPE_NR*smp_processor_id();
21936 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21937 BUG_ON(!pte_none(*(kmap_pte-idx)));
21938+
21939+ pax_open_kernel();
21940 set_pte(kmap_pte-idx, mk_pte(page, prot));
21941+ pax_close_kernel();
21942
21943 return (void *)vaddr;
21944 }
21945diff -urNp linux-2.6.39.2/arch/x86/mm/hugetlbpage.c linux-2.6.39.2/arch/x86/mm/hugetlbpage.c
21946--- linux-2.6.39.2/arch/x86/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
21947+++ linux-2.6.39.2/arch/x86/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
21948@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
21949 struct hstate *h = hstate_file(file);
21950 struct mm_struct *mm = current->mm;
21951 struct vm_area_struct *vma;
21952- unsigned long start_addr;
21953+ unsigned long start_addr, pax_task_size = TASK_SIZE;
21954+
21955+#ifdef CONFIG_PAX_SEGMEXEC
21956+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21957+ pax_task_size = SEGMEXEC_TASK_SIZE;
21958+#endif
21959+
21960+ pax_task_size -= PAGE_SIZE;
21961
21962 if (len > mm->cached_hole_size) {
21963- start_addr = mm->free_area_cache;
21964+ start_addr = mm->free_area_cache;
21965 } else {
21966- start_addr = TASK_UNMAPPED_BASE;
21967- mm->cached_hole_size = 0;
21968+ start_addr = mm->mmap_base;
21969+ mm->cached_hole_size = 0;
21970 }
21971
21972 full_search:
21973@@ -280,26 +287,27 @@ full_search:
21974
21975 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
21976 /* At this point: (!vma || addr < vma->vm_end). */
21977- if (TASK_SIZE - len < addr) {
21978+ if (pax_task_size - len < addr) {
21979 /*
21980 * Start a new search - just in case we missed
21981 * some holes.
21982 */
21983- if (start_addr != TASK_UNMAPPED_BASE) {
21984- start_addr = TASK_UNMAPPED_BASE;
21985+ if (start_addr != mm->mmap_base) {
21986+ start_addr = mm->mmap_base;
21987 mm->cached_hole_size = 0;
21988 goto full_search;
21989 }
21990 return -ENOMEM;
21991 }
21992- if (!vma || addr + len <= vma->vm_start) {
21993- mm->free_area_cache = addr + len;
21994- return addr;
21995- }
21996+ if (check_heap_stack_gap(vma, addr, len))
21997+ break;
21998 if (addr + mm->cached_hole_size < vma->vm_start)
21999 mm->cached_hole_size = vma->vm_start - addr;
22000 addr = ALIGN(vma->vm_end, huge_page_size(h));
22001 }
22002+
22003+ mm->free_area_cache = addr + len;
22004+ return addr;
22005 }
22006
22007 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22008@@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe
22009 {
22010 struct hstate *h = hstate_file(file);
22011 struct mm_struct *mm = current->mm;
22012- struct vm_area_struct *vma, *prev_vma;
22013- unsigned long base = mm->mmap_base, addr = addr0;
22014+ struct vm_area_struct *vma;
22015+ unsigned long base = mm->mmap_base, addr;
22016 unsigned long largest_hole = mm->cached_hole_size;
22017- int first_time = 1;
22018
22019 /* don't allow allocations above current base */
22020 if (mm->free_area_cache > base)
22021@@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe
22022 largest_hole = 0;
22023 mm->free_area_cache = base;
22024 }
22025-try_again:
22026+
22027 /* make sure it can fit in the remaining address space */
22028 if (mm->free_area_cache < len)
22029 goto fail;
22030
22031 /* either no address requested or can't fit in requested address hole */
22032- addr = (mm->free_area_cache - len) & huge_page_mask(h);
22033+ addr = (mm->free_area_cache - len);
22034 do {
22035+ addr &= huge_page_mask(h);
22036+ vma = find_vma(mm, addr);
22037 /*
22038 * Lookup failure means no vma is above this address,
22039 * i.e. return with success:
22040- */
22041- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
22042- return addr;
22043-
22044- /*
22045 * new region fits between prev_vma->vm_end and
22046 * vma->vm_start, use it:
22047 */
22048- if (addr + len <= vma->vm_start &&
22049- (!prev_vma || (addr >= prev_vma->vm_end))) {
22050+ if (check_heap_stack_gap(vma, addr, len)) {
22051 /* remember the address as a hint for next time */
22052- mm->cached_hole_size = largest_hole;
22053- return (mm->free_area_cache = addr);
22054- } else {
22055- /* pull free_area_cache down to the first hole */
22056- if (mm->free_area_cache == vma->vm_end) {
22057- mm->free_area_cache = vma->vm_start;
22058- mm->cached_hole_size = largest_hole;
22059- }
22060+ mm->cached_hole_size = largest_hole;
22061+ return (mm->free_area_cache = addr);
22062+ }
22063+ /* pull free_area_cache down to the first hole */
22064+ if (mm->free_area_cache == vma->vm_end) {
22065+ mm->free_area_cache = vma->vm_start;
22066+ mm->cached_hole_size = largest_hole;
22067 }
22068
22069 /* remember the largest hole we saw so far */
22070 if (addr + largest_hole < vma->vm_start)
22071- largest_hole = vma->vm_start - addr;
22072+ largest_hole = vma->vm_start - addr;
22073
22074 /* try just below the current vma->vm_start */
22075- addr = (vma->vm_start - len) & huge_page_mask(h);
22076- } while (len <= vma->vm_start);
22077+ addr = skip_heap_stack_gap(vma, len);
22078+ } while (!IS_ERR_VALUE(addr));
22079
22080 fail:
22081 /*
22082- * if hint left us with no space for the requested
22083- * mapping then try again:
22084- */
22085- if (first_time) {
22086- mm->free_area_cache = base;
22087- largest_hole = 0;
22088- first_time = 0;
22089- goto try_again;
22090- }
22091- /*
22092 * A failed mmap() very likely causes application failure,
22093 * so fall back to the bottom-up function here. This scenario
22094 * can happen with large stack limits and large mmap()
22095 * allocations.
22096 */
22097- mm->free_area_cache = TASK_UNMAPPED_BASE;
22098+
22099+#ifdef CONFIG_PAX_SEGMEXEC
22100+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22101+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
22102+ else
22103+#endif
22104+
22105+ mm->mmap_base = TASK_UNMAPPED_BASE;
22106+
22107+#ifdef CONFIG_PAX_RANDMMAP
22108+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22109+ mm->mmap_base += mm->delta_mmap;
22110+#endif
22111+
22112+ mm->free_area_cache = mm->mmap_base;
22113 mm->cached_hole_size = ~0UL;
22114 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
22115 len, pgoff, flags);
22116@@ -386,6 +392,7 @@ fail:
22117 /*
22118 * Restore the topdown base:
22119 */
22120+ mm->mmap_base = base;
22121 mm->free_area_cache = base;
22122 mm->cached_hole_size = ~0UL;
22123
22124@@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
22125 struct hstate *h = hstate_file(file);
22126 struct mm_struct *mm = current->mm;
22127 struct vm_area_struct *vma;
22128+ unsigned long pax_task_size = TASK_SIZE;
22129
22130 if (len & ~huge_page_mask(h))
22131 return -EINVAL;
22132- if (len > TASK_SIZE)
22133+
22134+#ifdef CONFIG_PAX_SEGMEXEC
22135+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22136+ pax_task_size = SEGMEXEC_TASK_SIZE;
22137+#endif
22138+
22139+ pax_task_size -= PAGE_SIZE;
22140+
22141+ if (len > pax_task_size)
22142 return -ENOMEM;
22143
22144 if (flags & MAP_FIXED) {
22145@@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
22146 if (addr) {
22147 addr = ALIGN(addr, huge_page_size(h));
22148 vma = find_vma(mm, addr);
22149- if (TASK_SIZE - len >= addr &&
22150- (!vma || addr + len <= vma->vm_start))
22151+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
22152 return addr;
22153 }
22154 if (mm->get_unmapped_area == arch_get_unmapped_area)
22155diff -urNp linux-2.6.39.2/arch/x86/mm/init_32.c linux-2.6.39.2/arch/x86/mm/init_32.c
22156--- linux-2.6.39.2/arch/x86/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
22157+++ linux-2.6.39.2/arch/x86/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
22158@@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
22159 }
22160
22161 /*
22162- * Creates a middle page table and puts a pointer to it in the
22163- * given global directory entry. This only returns the gd entry
22164- * in non-PAE compilation mode, since the middle layer is folded.
22165- */
22166-static pmd_t * __init one_md_table_init(pgd_t *pgd)
22167-{
22168- pud_t *pud;
22169- pmd_t *pmd_table;
22170-
22171-#ifdef CONFIG_X86_PAE
22172- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
22173- if (after_bootmem)
22174- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
22175- else
22176- pmd_table = (pmd_t *)alloc_low_page();
22177- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
22178- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
22179- pud = pud_offset(pgd, 0);
22180- BUG_ON(pmd_table != pmd_offset(pud, 0));
22181-
22182- return pmd_table;
22183- }
22184-#endif
22185- pud = pud_offset(pgd, 0);
22186- pmd_table = pmd_offset(pud, 0);
22187-
22188- return pmd_table;
22189-}
22190-
22191-/*
22192 * Create a page table and place a pointer to it in a middle page
22193 * directory entry:
22194 */
22195@@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini
22196 page_table = (pte_t *)alloc_low_page();
22197
22198 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
22199+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22200+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
22201+#else
22202 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
22203+#endif
22204 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
22205 }
22206
22207 return pte_offset_kernel(pmd, 0);
22208 }
22209
22210+static pmd_t * __init one_md_table_init(pgd_t *pgd)
22211+{
22212+ pud_t *pud;
22213+ pmd_t *pmd_table;
22214+
22215+ pud = pud_offset(pgd, 0);
22216+ pmd_table = pmd_offset(pud, 0);
22217+
22218+ return pmd_table;
22219+}
22220+
22221 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
22222 {
22223 int pgd_idx = pgd_index(vaddr);
22224@@ -203,6 +188,7 @@ page_table_range_init(unsigned long star
22225 int pgd_idx, pmd_idx;
22226 unsigned long vaddr;
22227 pgd_t *pgd;
22228+ pud_t *pud;
22229 pmd_t *pmd;
22230 pte_t *pte = NULL;
22231
22232@@ -212,8 +198,13 @@ page_table_range_init(unsigned long star
22233 pgd = pgd_base + pgd_idx;
22234
22235 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
22236- pmd = one_md_table_init(pgd);
22237- pmd = pmd + pmd_index(vaddr);
22238+ pud = pud_offset(pgd, vaddr);
22239+ pmd = pmd_offset(pud, vaddr);
22240+
22241+#ifdef CONFIG_X86_PAE
22242+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22243+#endif
22244+
22245 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
22246 pmd++, pmd_idx++) {
22247 pte = page_table_kmap_check(one_page_table_init(pmd),
22248@@ -225,11 +216,20 @@ page_table_range_init(unsigned long star
22249 }
22250 }
22251
22252-static inline int is_kernel_text(unsigned long addr)
22253+static inline int is_kernel_text(unsigned long start, unsigned long end)
22254 {
22255- if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
22256- return 1;
22257- return 0;
22258+ if ((start > ktla_ktva((unsigned long)_etext) ||
22259+ end <= ktla_ktva((unsigned long)_stext)) &&
22260+ (start > ktla_ktva((unsigned long)_einittext) ||
22261+ end <= ktla_ktva((unsigned long)_sinittext)) &&
22262+
22263+#ifdef CONFIG_ACPI_SLEEP
22264+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
22265+#endif
22266+
22267+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
22268+ return 0;
22269+ return 1;
22270 }
22271
22272 /*
22273@@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo
22274 unsigned long last_map_addr = end;
22275 unsigned long start_pfn, end_pfn;
22276 pgd_t *pgd_base = swapper_pg_dir;
22277- int pgd_idx, pmd_idx, pte_ofs;
22278+ unsigned int pgd_idx, pmd_idx, pte_ofs;
22279 unsigned long pfn;
22280 pgd_t *pgd;
22281+ pud_t *pud;
22282 pmd_t *pmd;
22283 pte_t *pte;
22284 unsigned pages_2m, pages_4k;
22285@@ -281,8 +282,13 @@ repeat:
22286 pfn = start_pfn;
22287 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22288 pgd = pgd_base + pgd_idx;
22289- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
22290- pmd = one_md_table_init(pgd);
22291+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
22292+ pud = pud_offset(pgd, 0);
22293+ pmd = pmd_offset(pud, 0);
22294+
22295+#ifdef CONFIG_X86_PAE
22296+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22297+#endif
22298
22299 if (pfn >= end_pfn)
22300 continue;
22301@@ -294,14 +300,13 @@ repeat:
22302 #endif
22303 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
22304 pmd++, pmd_idx++) {
22305- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
22306+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
22307
22308 /*
22309 * Map with big pages if possible, otherwise
22310 * create normal page tables:
22311 */
22312 if (use_pse) {
22313- unsigned int addr2;
22314 pgprot_t prot = PAGE_KERNEL_LARGE;
22315 /*
22316 * first pass will use the same initial
22317@@ -311,11 +316,7 @@ repeat:
22318 __pgprot(PTE_IDENT_ATTR |
22319 _PAGE_PSE);
22320
22321- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
22322- PAGE_OFFSET + PAGE_SIZE-1;
22323-
22324- if (is_kernel_text(addr) ||
22325- is_kernel_text(addr2))
22326+ if (is_kernel_text(address, address + PMD_SIZE))
22327 prot = PAGE_KERNEL_LARGE_EXEC;
22328
22329 pages_2m++;
22330@@ -332,7 +333,7 @@ repeat:
22331 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22332 pte += pte_ofs;
22333 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22334- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22335+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22336 pgprot_t prot = PAGE_KERNEL;
22337 /*
22338 * first pass will use the same initial
22339@@ -340,7 +341,7 @@ repeat:
22340 */
22341 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22342
22343- if (is_kernel_text(addr))
22344+ if (is_kernel_text(address, address + PAGE_SIZE))
22345 prot = PAGE_KERNEL_EXEC;
22346
22347 pages_4k++;
22348@@ -472,7 +473,7 @@ void __init native_pagetable_setup_start
22349
22350 pud = pud_offset(pgd, va);
22351 pmd = pmd_offset(pud, va);
22352- if (!pmd_present(*pmd))
22353+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22354 break;
22355
22356 pte = pte_offset_kernel(pmd, va);
22357@@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran
22358
22359 static void __init pagetable_init(void)
22360 {
22361- pgd_t *pgd_base = swapper_pg_dir;
22362-
22363- permanent_kmaps_init(pgd_base);
22364+ permanent_kmaps_init(swapper_pg_dir);
22365 }
22366
22367-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22368+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22369 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22370
22371 /* user-defined highmem size */
22372@@ -754,6 +753,12 @@ void __init mem_init(void)
22373
22374 pci_iommu_alloc();
22375
22376+#ifdef CONFIG_PAX_PER_CPU_PGD
22377+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22378+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22379+ KERNEL_PGD_PTRS);
22380+#endif
22381+
22382 #ifdef CONFIG_FLATMEM
22383 BUG_ON(!mem_map);
22384 #endif
22385@@ -771,7 +776,7 @@ void __init mem_init(void)
22386 set_highmem_pages_init();
22387
22388 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22389- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22390+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22391 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22392
22393 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22394@@ -812,10 +817,10 @@ void __init mem_init(void)
22395 ((unsigned long)&__init_end -
22396 (unsigned long)&__init_begin) >> 10,
22397
22398- (unsigned long)&_etext, (unsigned long)&_edata,
22399- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22400+ (unsigned long)&_sdata, (unsigned long)&_edata,
22401+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22402
22403- (unsigned long)&_text, (unsigned long)&_etext,
22404+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22405 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22406
22407 /*
22408@@ -893,6 +898,7 @@ void set_kernel_text_rw(void)
22409 if (!kernel_set_to_readonly)
22410 return;
22411
22412+ start = ktla_ktva(start);
22413 pr_debug("Set kernel text: %lx - %lx for read write\n",
22414 start, start+size);
22415
22416@@ -907,6 +913,7 @@ void set_kernel_text_ro(void)
22417 if (!kernel_set_to_readonly)
22418 return;
22419
22420+ start = ktla_ktva(start);
22421 pr_debug("Set kernel text: %lx - %lx for read only\n",
22422 start, start+size);
22423
22424@@ -935,6 +942,7 @@ void mark_rodata_ro(void)
22425 unsigned long start = PFN_ALIGN(_text);
22426 unsigned long size = PFN_ALIGN(_etext) - start;
22427
22428+ start = ktla_ktva(start);
22429 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22430 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22431 size >> 10);
22432diff -urNp linux-2.6.39.2/arch/x86/mm/init_64.c linux-2.6.39.2/arch/x86/mm/init_64.c
22433--- linux-2.6.39.2/arch/x86/mm/init_64.c 2011-05-19 00:06:34.000000000 -0400
22434+++ linux-2.6.39.2/arch/x86/mm/init_64.c 2011-05-22 19:36:30.000000000 -0400
22435@@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpa
22436 * around without checking the pgd every time.
22437 */
22438
22439-pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22440+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22441 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22442
22443 int force_personality32;
22444@@ -107,12 +107,22 @@ void sync_global_pgds(unsigned long star
22445
22446 for (address = start; address <= end; address += PGDIR_SIZE) {
22447 const pgd_t *pgd_ref = pgd_offset_k(address);
22448+
22449+#ifdef CONFIG_PAX_PER_CPU_PGD
22450+ unsigned long cpu;
22451+#else
22452 struct page *page;
22453+#endif
22454
22455 if (pgd_none(*pgd_ref))
22456 continue;
22457
22458 spin_lock(&pgd_lock);
22459+
22460+#ifdef CONFIG_PAX_PER_CPU_PGD
22461+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22462+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
22463+#else
22464 list_for_each_entry(page, &pgd_list, lru) {
22465 pgd_t *pgd;
22466 spinlock_t *pgt_lock;
22467@@ -121,6 +131,7 @@ void sync_global_pgds(unsigned long star
22468 /* the pgt_lock only for Xen */
22469 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22470 spin_lock(pgt_lock);
22471+#endif
22472
22473 if (pgd_none(*pgd))
22474 set_pgd(pgd, *pgd_ref);
22475@@ -128,7 +139,10 @@ void sync_global_pgds(unsigned long star
22476 BUG_ON(pgd_page_vaddr(*pgd)
22477 != pgd_page_vaddr(*pgd_ref));
22478
22479+#ifndef CONFIG_PAX_PER_CPU_PGD
22480 spin_unlock(pgt_lock);
22481+#endif
22482+
22483 }
22484 spin_unlock(&pgd_lock);
22485 }
22486@@ -202,7 +216,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
22487 pmd = fill_pmd(pud, vaddr);
22488 pte = fill_pte(pmd, vaddr);
22489
22490+ pax_open_kernel();
22491 set_pte(pte, new_pte);
22492+ pax_close_kernel();
22493
22494 /*
22495 * It's enough to flush this one mapping.
22496@@ -261,14 +277,12 @@ static void __init __init_extra_mapping(
22497 pgd = pgd_offset_k((unsigned long)__va(phys));
22498 if (pgd_none(*pgd)) {
22499 pud = (pud_t *) spp_getpage();
22500- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22501- _PAGE_USER));
22502+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22503 }
22504 pud = pud_offset(pgd, (unsigned long)__va(phys));
22505 if (pud_none(*pud)) {
22506 pmd = (pmd_t *) spp_getpage();
22507- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22508- _PAGE_USER));
22509+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22510 }
22511 pmd = pmd_offset(pud, phys);
22512 BUG_ON(!pmd_none(*pmd));
22513@@ -698,6 +712,12 @@ void __init mem_init(void)
22514
22515 pci_iommu_alloc();
22516
22517+#ifdef CONFIG_PAX_PER_CPU_PGD
22518+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22519+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22520+ KERNEL_PGD_PTRS);
22521+#endif
22522+
22523 /* clear_bss() already clear the empty_zero_page */
22524
22525 reservedpages = 0;
22526@@ -858,8 +878,8 @@ int kern_addr_valid(unsigned long addr)
22527 static struct vm_area_struct gate_vma = {
22528 .vm_start = VSYSCALL_START,
22529 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22530- .vm_page_prot = PAGE_READONLY_EXEC,
22531- .vm_flags = VM_READ | VM_EXEC
22532+ .vm_page_prot = PAGE_READONLY,
22533+ .vm_flags = VM_READ
22534 };
22535
22536 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22537@@ -893,7 +913,7 @@ int in_gate_area_no_mm(unsigned long add
22538
22539 const char *arch_vma_name(struct vm_area_struct *vma)
22540 {
22541- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22542+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22543 return "[vdso]";
22544 if (vma == &gate_vma)
22545 return "[vsyscall]";
22546diff -urNp linux-2.6.39.2/arch/x86/mm/init.c linux-2.6.39.2/arch/x86/mm/init.c
22547--- linux-2.6.39.2/arch/x86/mm/init.c 2011-05-19 00:06:34.000000000 -0400
22548+++ linux-2.6.39.2/arch/x86/mm/init.c 2011-06-07 19:41:11.000000000 -0400
22549@@ -33,7 +33,7 @@ int direct_gbpages
22550 static void __init find_early_table_space(unsigned long end, int use_pse,
22551 int use_gbpages)
22552 {
22553- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22554+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22555 phys_addr_t base;
22556
22557 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22558@@ -315,12 +315,34 @@ unsigned long __init_refok init_memory_m
22559 */
22560 int devmem_is_allowed(unsigned long pagenr)
22561 {
22562- if (pagenr <= 256)
22563+#ifdef CONFIG_GRKERNSEC_KMEM
22564+ /* allow BDA */
22565+ if (!pagenr)
22566+ return 1;
22567+ /* allow EBDA */
22568+ if ((0x9f000 >> PAGE_SHIFT) == pagenr)
22569+ return 1;
22570+#else
22571+ if (!pagenr)
22572+ return 1;
22573+#ifdef CONFIG_VM86
22574+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22575+ return 1;
22576+#endif
22577+#endif
22578+
22579+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22580 return 1;
22581+#ifdef CONFIG_GRKERNSEC_KMEM
22582+ /* throw out everything else below 1MB */
22583+ if (pagenr <= 256)
22584+ return 0;
22585+#endif
22586 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22587 return 0;
22588 if (!page_is_ram(pagenr))
22589 return 1;
22590+
22591 return 0;
22592 }
22593
22594@@ -375,6 +397,86 @@ void free_init_pages(char *what, unsigne
22595
22596 void free_initmem(void)
22597 {
22598+
22599+#ifdef CONFIG_PAX_KERNEXEC
22600+#ifdef CONFIG_X86_32
22601+ /* PaX: limit KERNEL_CS to actual size */
22602+ unsigned long addr, limit;
22603+ struct desc_struct d;
22604+ int cpu;
22605+
22606+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22607+ limit = (limit - 1UL) >> PAGE_SHIFT;
22608+
22609+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22610+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22611+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22612+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22613+ }
22614+
22615+ /* PaX: make KERNEL_CS read-only */
22616+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22617+ if (!paravirt_enabled())
22618+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22619+/*
22620+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22621+ pgd = pgd_offset_k(addr);
22622+ pud = pud_offset(pgd, addr);
22623+ pmd = pmd_offset(pud, addr);
22624+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22625+ }
22626+*/
22627+#ifdef CONFIG_X86_PAE
22628+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22629+/*
22630+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22631+ pgd = pgd_offset_k(addr);
22632+ pud = pud_offset(pgd, addr);
22633+ pmd = pmd_offset(pud, addr);
22634+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22635+ }
22636+*/
22637+#endif
22638+
22639+#ifdef CONFIG_MODULES
22640+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22641+#endif
22642+
22643+#else
22644+ pgd_t *pgd;
22645+ pud_t *pud;
22646+ pmd_t *pmd;
22647+ unsigned long addr, end;
22648+
22649+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22650+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22651+ pgd = pgd_offset_k(addr);
22652+ pud = pud_offset(pgd, addr);
22653+ pmd = pmd_offset(pud, addr);
22654+ if (!pmd_present(*pmd))
22655+ continue;
22656+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22657+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22658+ else
22659+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22660+ }
22661+
22662+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22663+ end = addr + KERNEL_IMAGE_SIZE;
22664+ for (; addr < end; addr += PMD_SIZE) {
22665+ pgd = pgd_offset_k(addr);
22666+ pud = pud_offset(pgd, addr);
22667+ pmd = pmd_offset(pud, addr);
22668+ if (!pmd_present(*pmd))
22669+ continue;
22670+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22671+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22672+ }
22673+#endif
22674+
22675+ flush_tlb_all();
22676+#endif
22677+
22678 free_init_pages("unused kernel memory",
22679 (unsigned long)(&__init_begin),
22680 (unsigned long)(&__init_end));
22681diff -urNp linux-2.6.39.2/arch/x86/mm/iomap_32.c linux-2.6.39.2/arch/x86/mm/iomap_32.c
22682--- linux-2.6.39.2/arch/x86/mm/iomap_32.c 2011-05-19 00:06:34.000000000 -0400
22683+++ linux-2.6.39.2/arch/x86/mm/iomap_32.c 2011-05-22 19:36:30.000000000 -0400
22684@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
22685 type = kmap_atomic_idx_push();
22686 idx = type + KM_TYPE_NR * smp_processor_id();
22687 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22688+
22689+ pax_open_kernel();
22690 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22691+ pax_close_kernel();
22692+
22693 arch_flush_lazy_mmu_mode();
22694
22695 return (void *)vaddr;
22696diff -urNp linux-2.6.39.2/arch/x86/mm/ioremap.c linux-2.6.39.2/arch/x86/mm/ioremap.c
22697--- linux-2.6.39.2/arch/x86/mm/ioremap.c 2011-05-19 00:06:34.000000000 -0400
22698+++ linux-2.6.39.2/arch/x86/mm/ioremap.c 2011-05-22 19:36:30.000000000 -0400
22699@@ -104,7 +104,7 @@ static void __iomem *__ioremap_caller(re
22700 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22701 int is_ram = page_is_ram(pfn);
22702
22703- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22704+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22705 return NULL;
22706 WARN_ON_ONCE(is_ram);
22707 }
22708@@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se
22709 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22710
22711 static __initdata int after_paging_init;
22712-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22713+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22714
22715 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22716 {
22717@@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22718 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22719
22720 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22721- memset(bm_pte, 0, sizeof(bm_pte));
22722- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22723+ pmd_populate_user(&init_mm, pmd, bm_pte);
22724
22725 /*
22726 * The boot-ioremap range spans multiple pmds, for which
22727diff -urNp linux-2.6.39.2/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.39.2/arch/x86/mm/kmemcheck/kmemcheck.c
22728--- linux-2.6.39.2/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-19 00:06:34.000000000 -0400
22729+++ linux-2.6.39.2/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-22 19:36:30.000000000 -0400
22730@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
22731 * memory (e.g. tracked pages)? For now, we need this to avoid
22732 * invoking kmemcheck for PnP BIOS calls.
22733 */
22734- if (regs->flags & X86_VM_MASK)
22735+ if (v8086_mode(regs))
22736 return false;
22737- if (regs->cs != __KERNEL_CS)
22738+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22739 return false;
22740
22741 pte = kmemcheck_pte_lookup(address);
22742diff -urNp linux-2.6.39.2/arch/x86/mm/mmap.c linux-2.6.39.2/arch/x86/mm/mmap.c
22743--- linux-2.6.39.2/arch/x86/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
22744+++ linux-2.6.39.2/arch/x86/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
22745@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
22746 * Leave an at least ~128 MB hole with possible stack randomization.
22747 */
22748 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22749-#define MAX_GAP (TASK_SIZE/6*5)
22750+#define MAX_GAP (pax_task_size/6*5)
22751
22752 /*
22753 * True on X86_32 or when emulating IA32 on X86_64
22754@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22755 return rnd << PAGE_SHIFT;
22756 }
22757
22758-static unsigned long mmap_base(void)
22759+static unsigned long mmap_base(struct mm_struct *mm)
22760 {
22761 unsigned long gap = rlimit(RLIMIT_STACK);
22762+ unsigned long pax_task_size = TASK_SIZE;
22763+
22764+#ifdef CONFIG_PAX_SEGMEXEC
22765+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22766+ pax_task_size = SEGMEXEC_TASK_SIZE;
22767+#endif
22768
22769 if (gap < MIN_GAP)
22770 gap = MIN_GAP;
22771 else if (gap > MAX_GAP)
22772 gap = MAX_GAP;
22773
22774- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22775+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22776 }
22777
22778 /*
22779 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22780 * does, but not when emulating X86_32
22781 */
22782-static unsigned long mmap_legacy_base(void)
22783+static unsigned long mmap_legacy_base(struct mm_struct *mm)
22784 {
22785- if (mmap_is_ia32())
22786+ if (mmap_is_ia32()) {
22787+
22788+#ifdef CONFIG_PAX_SEGMEXEC
22789+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22790+ return SEGMEXEC_TASK_UNMAPPED_BASE;
22791+ else
22792+#endif
22793+
22794 return TASK_UNMAPPED_BASE;
22795- else
22796+ } else
22797 return TASK_UNMAPPED_BASE + mmap_rnd();
22798 }
22799
22800@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
22801 void arch_pick_mmap_layout(struct mm_struct *mm)
22802 {
22803 if (mmap_is_legacy()) {
22804- mm->mmap_base = mmap_legacy_base();
22805+ mm->mmap_base = mmap_legacy_base(mm);
22806+
22807+#ifdef CONFIG_PAX_RANDMMAP
22808+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22809+ mm->mmap_base += mm->delta_mmap;
22810+#endif
22811+
22812 mm->get_unmapped_area = arch_get_unmapped_area;
22813 mm->unmap_area = arch_unmap_area;
22814 } else {
22815- mm->mmap_base = mmap_base();
22816+ mm->mmap_base = mmap_base(mm);
22817+
22818+#ifdef CONFIG_PAX_RANDMMAP
22819+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22820+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22821+#endif
22822+
22823 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22824 mm->unmap_area = arch_unmap_area_topdown;
22825 }
22826diff -urNp linux-2.6.39.2/arch/x86/mm/mmio-mod.c linux-2.6.39.2/arch/x86/mm/mmio-mod.c
22827--- linux-2.6.39.2/arch/x86/mm/mmio-mod.c 2011-05-19 00:06:34.000000000 -0400
22828+++ linux-2.6.39.2/arch/x86/mm/mmio-mod.c 2011-05-22 19:36:30.000000000 -0400
22829@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p,
22830 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
22831 void __iomem *addr)
22832 {
22833- static atomic_t next_id;
22834+ static atomic_unchecked_t next_id;
22835 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
22836 /* These are page-unaligned. */
22837 struct mmiotrace_map map = {
22838@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
22839 .private = trace
22840 },
22841 .phys = offset,
22842- .id = atomic_inc_return(&next_id)
22843+ .id = atomic_inc_return_unchecked(&next_id)
22844 };
22845 map.map_id = trace->id;
22846
22847diff -urNp linux-2.6.39.2/arch/x86/mm/numa_32.c linux-2.6.39.2/arch/x86/mm/numa_32.c
22848--- linux-2.6.39.2/arch/x86/mm/numa_32.c 2011-05-19 00:06:34.000000000 -0400
22849+++ linux-2.6.39.2/arch/x86/mm/numa_32.c 2011-05-22 19:36:30.000000000 -0400
22850@@ -99,7 +99,6 @@ unsigned long node_memmap_size_bytes(int
22851 }
22852 #endif
22853
22854-extern unsigned long find_max_low_pfn(void);
22855 extern unsigned long highend_pfn, highstart_pfn;
22856
22857 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
22858diff -urNp linux-2.6.39.2/arch/x86/mm/pageattr.c linux-2.6.39.2/arch/x86/mm/pageattr.c
22859--- linux-2.6.39.2/arch/x86/mm/pageattr.c 2011-05-19 00:06:34.000000000 -0400
22860+++ linux-2.6.39.2/arch/x86/mm/pageattr.c 2011-05-22 19:36:30.000000000 -0400
22861@@ -261,7 +261,7 @@ static inline pgprot_t static_protection
22862 */
22863 #ifdef CONFIG_PCI_BIOS
22864 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
22865- pgprot_val(forbidden) |= _PAGE_NX;
22866+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22867 #endif
22868
22869 /*
22870@@ -269,9 +269,10 @@ static inline pgprot_t static_protection
22871 * Does not cover __inittext since that is gone later on. On
22872 * 64bit we do not enforce !NX on the low mapping
22873 */
22874- if (within(address, (unsigned long)_text, (unsigned long)_etext))
22875- pgprot_val(forbidden) |= _PAGE_NX;
22876+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
22877+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22878
22879+#ifdef CONFIG_DEBUG_RODATA
22880 /*
22881 * The .rodata section needs to be read-only. Using the pfn
22882 * catches all aliases.
22883@@ -279,6 +280,7 @@ static inline pgprot_t static_protection
22884 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
22885 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
22886 pgprot_val(forbidden) |= _PAGE_RW;
22887+#endif
22888
22889 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
22890 /*
22891@@ -317,6 +319,13 @@ static inline pgprot_t static_protection
22892 }
22893 #endif
22894
22895+#ifdef CONFIG_PAX_KERNEXEC
22896+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
22897+ pgprot_val(forbidden) |= _PAGE_RW;
22898+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22899+ }
22900+#endif
22901+
22902 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
22903
22904 return prot;
22905@@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
22906 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
22907 {
22908 /* change init_mm */
22909+ pax_open_kernel();
22910 set_pte_atomic(kpte, pte);
22911+
22912 #ifdef CONFIG_X86_32
22913 if (!SHARED_KERNEL_PMD) {
22914+
22915+#ifdef CONFIG_PAX_PER_CPU_PGD
22916+ unsigned long cpu;
22917+#else
22918 struct page *page;
22919+#endif
22920
22921+#ifdef CONFIG_PAX_PER_CPU_PGD
22922+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22923+ pgd_t *pgd = get_cpu_pgd(cpu);
22924+#else
22925 list_for_each_entry(page, &pgd_list, lru) {
22926- pgd_t *pgd;
22927+ pgd_t *pgd = (pgd_t *)page_address(page);
22928+#endif
22929+
22930 pud_t *pud;
22931 pmd_t *pmd;
22932
22933- pgd = (pgd_t *)page_address(page) + pgd_index(address);
22934+ pgd += pgd_index(address);
22935 pud = pud_offset(pgd, address);
22936 pmd = pmd_offset(pud, address);
22937 set_pte_atomic((pte_t *)pmd, pte);
22938 }
22939 }
22940 #endif
22941+ pax_close_kernel();
22942 }
22943
22944 static int
22945diff -urNp linux-2.6.39.2/arch/x86/mm/pageattr-test.c linux-2.6.39.2/arch/x86/mm/pageattr-test.c
22946--- linux-2.6.39.2/arch/x86/mm/pageattr-test.c 2011-05-19 00:06:34.000000000 -0400
22947+++ linux-2.6.39.2/arch/x86/mm/pageattr-test.c 2011-05-22 19:36:30.000000000 -0400
22948@@ -36,7 +36,7 @@ enum {
22949
22950 static int pte_testbit(pte_t pte)
22951 {
22952- return pte_flags(pte) & _PAGE_UNUSED1;
22953+ return pte_flags(pte) & _PAGE_CPA_TEST;
22954 }
22955
22956 struct split_state {
22957diff -urNp linux-2.6.39.2/arch/x86/mm/pat.c linux-2.6.39.2/arch/x86/mm/pat.c
22958--- linux-2.6.39.2/arch/x86/mm/pat.c 2011-05-19 00:06:34.000000000 -0400
22959+++ linux-2.6.39.2/arch/x86/mm/pat.c 2011-05-22 19:36:30.000000000 -0400
22960@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
22961
22962 if (!entry) {
22963 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
22964- current->comm, current->pid, start, end);
22965+ current->comm, task_pid_nr(current), start, end);
22966 return -EINVAL;
22967 }
22968
22969@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig
22970 while (cursor < to) {
22971 if (!devmem_is_allowed(pfn)) {
22972 printk(KERN_INFO
22973- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
22974- current->comm, from, to);
22975+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
22976+ current->comm, from, to, cursor);
22977 return 0;
22978 }
22979 cursor += PAGE_SIZE;
22980@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un
22981 printk(KERN_INFO
22982 "%s:%d ioremap_change_attr failed %s "
22983 "for %Lx-%Lx\n",
22984- current->comm, current->pid,
22985+ current->comm, task_pid_nr(current),
22986 cattr_name(flags),
22987 base, (unsigned long long)(base + size));
22988 return -EINVAL;
22989@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr,
22990 if (want_flags != flags) {
22991 printk(KERN_WARNING
22992 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
22993- current->comm, current->pid,
22994+ current->comm, task_pid_nr(current),
22995 cattr_name(want_flags),
22996 (unsigned long long)paddr,
22997 (unsigned long long)(paddr + size),
22998@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr,
22999 free_memtype(paddr, paddr + size);
23000 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
23001 " for %Lx-%Lx, got %s\n",
23002- current->comm, current->pid,
23003+ current->comm, task_pid_nr(current),
23004 cattr_name(want_flags),
23005 (unsigned long long)paddr,
23006 (unsigned long long)(paddr + size),
23007diff -urNp linux-2.6.39.2/arch/x86/mm/pgtable_32.c linux-2.6.39.2/arch/x86/mm/pgtable_32.c
23008--- linux-2.6.39.2/arch/x86/mm/pgtable_32.c 2011-05-19 00:06:34.000000000 -0400
23009+++ linux-2.6.39.2/arch/x86/mm/pgtable_32.c 2011-05-22 19:36:30.000000000 -0400
23010@@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr,
23011 return;
23012 }
23013 pte = pte_offset_kernel(pmd, vaddr);
23014+
23015+ pax_open_kernel();
23016 if (pte_val(pteval))
23017 set_pte_at(&init_mm, vaddr, pte, pteval);
23018 else
23019 pte_clear(&init_mm, vaddr, pte);
23020+ pax_close_kernel();
23021
23022 /*
23023 * It's enough to flush this one mapping.
23024diff -urNp linux-2.6.39.2/arch/x86/mm/pgtable.c linux-2.6.39.2/arch/x86/mm/pgtable.c
23025--- linux-2.6.39.2/arch/x86/mm/pgtable.c 2011-05-19 00:06:34.000000000 -0400
23026+++ linux-2.6.39.2/arch/x86/mm/pgtable.c 2011-05-22 19:36:30.000000000 -0400
23027@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
23028 list_del(&page->lru);
23029 }
23030
23031-#define UNSHARED_PTRS_PER_PGD \
23032- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23033+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23034+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
23035
23036+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23037+{
23038+ while (count--)
23039+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
23040+}
23041+#endif
23042+
23043+#ifdef CONFIG_PAX_PER_CPU_PGD
23044+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23045+{
23046+ while (count--)
23047+
23048+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23049+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
23050+#else
23051+ *dst++ = *src++;
23052+#endif
23053
23054+}
23055+#endif
23056+
23057+#ifdef CONFIG_X86_64
23058+#define pxd_t pud_t
23059+#define pyd_t pgd_t
23060+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
23061+#define pxd_free(mm, pud) pud_free((mm), (pud))
23062+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
23063+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
23064+#define PYD_SIZE PGDIR_SIZE
23065+#else
23066+#define pxd_t pmd_t
23067+#define pyd_t pud_t
23068+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
23069+#define pxd_free(mm, pud) pmd_free((mm), (pud))
23070+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
23071+#define pyd_offset(mm ,address) pud_offset((mm), (address))
23072+#define PYD_SIZE PUD_SIZE
23073+#endif
23074+
23075+#ifdef CONFIG_PAX_PER_CPU_PGD
23076+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
23077+static inline void pgd_dtor(pgd_t *pgd) {}
23078+#else
23079 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
23080 {
23081 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
23082@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
23083 pgd_list_del(pgd);
23084 spin_unlock(&pgd_lock);
23085 }
23086+#endif
23087
23088 /*
23089 * List of all pgd's needed for non-PAE so it can invalidate entries
23090@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
23091 * -- wli
23092 */
23093
23094-#ifdef CONFIG_X86_PAE
23095+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
23096 /*
23097 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
23098 * updating the top-level pagetable entries to guarantee the
23099@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
23100 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
23101 * and initialize the kernel pmds here.
23102 */
23103-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
23104+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23105
23106 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23107 {
23108@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm,
23109 */
23110 flush_tlb_mm(mm);
23111 }
23112+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
23113+#define PREALLOCATED_PXDS USER_PGD_PTRS
23114 #else /* !CONFIG_X86_PAE */
23115
23116 /* No need to prepopulate any pagetable entries in non-PAE modes. */
23117-#define PREALLOCATED_PMDS 0
23118+#define PREALLOCATED_PXDS 0
23119
23120 #endif /* CONFIG_X86_PAE */
23121
23122-static void free_pmds(pmd_t *pmds[])
23123+static void free_pxds(pxd_t *pxds[])
23124 {
23125 int i;
23126
23127- for(i = 0; i < PREALLOCATED_PMDS; i++)
23128- if (pmds[i])
23129- free_page((unsigned long)pmds[i]);
23130+ for(i = 0; i < PREALLOCATED_PXDS; i++)
23131+ if (pxds[i])
23132+ free_page((unsigned long)pxds[i]);
23133 }
23134
23135-static int preallocate_pmds(pmd_t *pmds[])
23136+static int preallocate_pxds(pxd_t *pxds[])
23137 {
23138 int i;
23139 bool failed = false;
23140
23141- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23142- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
23143- if (pmd == NULL)
23144+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23145+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
23146+ if (pxd == NULL)
23147 failed = true;
23148- pmds[i] = pmd;
23149+ pxds[i] = pxd;
23150 }
23151
23152 if (failed) {
23153- free_pmds(pmds);
23154+ free_pxds(pxds);
23155 return -ENOMEM;
23156 }
23157
23158@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
23159 * preallocate which never got a corresponding vma will need to be
23160 * freed manually.
23161 */
23162-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
23163+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
23164 {
23165 int i;
23166
23167- for(i = 0; i < PREALLOCATED_PMDS; i++) {
23168+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
23169 pgd_t pgd = pgdp[i];
23170
23171 if (pgd_val(pgd) != 0) {
23172- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
23173+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
23174
23175- pgdp[i] = native_make_pgd(0);
23176+ set_pgd(pgdp + i, native_make_pgd(0));
23177
23178- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
23179- pmd_free(mm, pmd);
23180+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
23181+ pxd_free(mm, pxd);
23182 }
23183 }
23184 }
23185
23186-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
23187+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
23188 {
23189- pud_t *pud;
23190+ pyd_t *pyd;
23191 unsigned long addr;
23192 int i;
23193
23194- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
23195+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
23196 return;
23197
23198- pud = pud_offset(pgd, 0);
23199+#ifdef CONFIG_X86_64
23200+ pyd = pyd_offset(mm, 0L);
23201+#else
23202+ pyd = pyd_offset(pgd, 0L);
23203+#endif
23204
23205- for (addr = i = 0; i < PREALLOCATED_PMDS;
23206- i++, pud++, addr += PUD_SIZE) {
23207- pmd_t *pmd = pmds[i];
23208+ for (addr = i = 0; i < PREALLOCATED_PXDS;
23209+ i++, pyd++, addr += PYD_SIZE) {
23210+ pxd_t *pxd = pxds[i];
23211
23212 if (i >= KERNEL_PGD_BOUNDARY)
23213- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23214- sizeof(pmd_t) * PTRS_PER_PMD);
23215+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23216+ sizeof(pxd_t) * PTRS_PER_PMD);
23217
23218- pud_populate(mm, pud, pmd);
23219+ pyd_populate(mm, pyd, pxd);
23220 }
23221 }
23222
23223 pgd_t *pgd_alloc(struct mm_struct *mm)
23224 {
23225 pgd_t *pgd;
23226- pmd_t *pmds[PREALLOCATED_PMDS];
23227+ pxd_t *pxds[PREALLOCATED_PXDS];
23228
23229 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
23230
23231@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23232
23233 mm->pgd = pgd;
23234
23235- if (preallocate_pmds(pmds) != 0)
23236+ if (preallocate_pxds(pxds) != 0)
23237 goto out_free_pgd;
23238
23239 if (paravirt_pgd_alloc(mm) != 0)
23240- goto out_free_pmds;
23241+ goto out_free_pxds;
23242
23243 /*
23244 * Make sure that pre-populating the pmds is atomic with
23245@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23246 spin_lock(&pgd_lock);
23247
23248 pgd_ctor(mm, pgd);
23249- pgd_prepopulate_pmd(mm, pgd, pmds);
23250+ pgd_prepopulate_pxd(mm, pgd, pxds);
23251
23252 spin_unlock(&pgd_lock);
23253
23254 return pgd;
23255
23256-out_free_pmds:
23257- free_pmds(pmds);
23258+out_free_pxds:
23259+ free_pxds(pxds);
23260 out_free_pgd:
23261 free_page((unsigned long)pgd);
23262 out:
23263@@ -295,7 +344,7 @@ out:
23264
23265 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
23266 {
23267- pgd_mop_up_pmds(mm, pgd);
23268+ pgd_mop_up_pxds(mm, pgd);
23269 pgd_dtor(pgd);
23270 paravirt_pgd_free(mm, pgd);
23271 free_page((unsigned long)pgd);
23272diff -urNp linux-2.6.39.2/arch/x86/mm/setup_nx.c linux-2.6.39.2/arch/x86/mm/setup_nx.c
23273--- linux-2.6.39.2/arch/x86/mm/setup_nx.c 2011-05-19 00:06:34.000000000 -0400
23274+++ linux-2.6.39.2/arch/x86/mm/setup_nx.c 2011-05-22 19:36:30.000000000 -0400
23275@@ -5,8 +5,10 @@
23276 #include <asm/pgtable.h>
23277 #include <asm/proto.h>
23278
23279+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23280 static int disable_nx __cpuinitdata;
23281
23282+#ifndef CONFIG_PAX_PAGEEXEC
23283 /*
23284 * noexec = on|off
23285 *
23286@@ -28,12 +30,17 @@ static int __init noexec_setup(char *str
23287 return 0;
23288 }
23289 early_param("noexec", noexec_setup);
23290+#endif
23291+
23292+#endif
23293
23294 void __cpuinit x86_configure_nx(void)
23295 {
23296+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23297 if (cpu_has_nx && !disable_nx)
23298 __supported_pte_mask |= _PAGE_NX;
23299 else
23300+#endif
23301 __supported_pte_mask &= ~_PAGE_NX;
23302 }
23303
23304diff -urNp linux-2.6.39.2/arch/x86/mm/tlb.c linux-2.6.39.2/arch/x86/mm/tlb.c
23305--- linux-2.6.39.2/arch/x86/mm/tlb.c 2011-05-19 00:06:34.000000000 -0400
23306+++ linux-2.6.39.2/arch/x86/mm/tlb.c 2011-05-22 19:36:30.000000000 -0400
23307@@ -65,7 +65,11 @@ void leave_mm(int cpu)
23308 BUG();
23309 cpumask_clear_cpu(cpu,
23310 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23311+
23312+#ifndef CONFIG_PAX_PER_CPU_PGD
23313 load_cr3(swapper_pg_dir);
23314+#endif
23315+
23316 }
23317 EXPORT_SYMBOL_GPL(leave_mm);
23318
23319diff -urNp linux-2.6.39.2/arch/x86/oprofile/backtrace.c linux-2.6.39.2/arch/x86/oprofile/backtrace.c
23320--- linux-2.6.39.2/arch/x86/oprofile/backtrace.c 2011-05-19 00:06:34.000000000 -0400
23321+++ linux-2.6.39.2/arch/x86/oprofile/backtrace.c 2011-05-22 19:36:30.000000000 -0400
23322@@ -57,7 +57,7 @@ dump_user_backtrace_32(struct stack_fram
23323 struct stack_frame_ia32 *fp;
23324
23325 /* Also check accessibility of one struct frame_head beyond */
23326- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
23327+ if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
23328 return NULL;
23329 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
23330 return NULL;
23331@@ -123,7 +123,7 @@ x86_backtrace(struct pt_regs * const reg
23332 {
23333 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
23334
23335- if (!user_mode_vm(regs)) {
23336+ if (!user_mode(regs)) {
23337 unsigned long stack = kernel_stack_pointer(regs);
23338 if (depth)
23339 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23340diff -urNp linux-2.6.39.2/arch/x86/pci/ce4100.c linux-2.6.39.2/arch/x86/pci/ce4100.c
23341--- linux-2.6.39.2/arch/x86/pci/ce4100.c 2011-05-19 00:06:34.000000000 -0400
23342+++ linux-2.6.39.2/arch/x86/pci/ce4100.c 2011-05-22 19:36:30.000000000 -0400
23343@@ -302,7 +302,7 @@ static int ce4100_conf_write(unsigned in
23344 return pci_direct_conf1.write(seg, bus, devfn, reg, len, value);
23345 }
23346
23347-struct pci_raw_ops ce4100_pci_conf = {
23348+const struct pci_raw_ops ce4100_pci_conf = {
23349 .read = ce4100_conf_read,
23350 .write = ce4100_conf_write,
23351 };
23352diff -urNp linux-2.6.39.2/arch/x86/pci/common.c linux-2.6.39.2/arch/x86/pci/common.c
23353--- linux-2.6.39.2/arch/x86/pci/common.c 2011-05-19 00:06:34.000000000 -0400
23354+++ linux-2.6.39.2/arch/x86/pci/common.c 2011-05-22 19:36:30.000000000 -0400
23355@@ -33,8 +33,8 @@ int noioapicreroute = 1;
23356 int pcibios_last_bus = -1;
23357 unsigned long pirq_table_addr;
23358 struct pci_bus *pci_root_bus;
23359-struct pci_raw_ops *raw_pci_ops;
23360-struct pci_raw_ops *raw_pci_ext_ops;
23361+const struct pci_raw_ops *raw_pci_ops;
23362+const struct pci_raw_ops *raw_pci_ext_ops;
23363
23364 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
23365 int reg, int len, u32 *val)
23366diff -urNp linux-2.6.39.2/arch/x86/pci/direct.c linux-2.6.39.2/arch/x86/pci/direct.c
23367--- linux-2.6.39.2/arch/x86/pci/direct.c 2011-05-19 00:06:34.000000000 -0400
23368+++ linux-2.6.39.2/arch/x86/pci/direct.c 2011-05-22 19:36:30.000000000 -0400
23369@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
23370
23371 #undef PCI_CONF1_ADDRESS
23372
23373-struct pci_raw_ops pci_direct_conf1 = {
23374+const struct pci_raw_ops pci_direct_conf1 = {
23375 .read = pci_conf1_read,
23376 .write = pci_conf1_write,
23377 };
23378@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
23379
23380 #undef PCI_CONF2_ADDRESS
23381
23382-struct pci_raw_ops pci_direct_conf2 = {
23383+const struct pci_raw_ops pci_direct_conf2 = {
23384 .read = pci_conf2_read,
23385 .write = pci_conf2_write,
23386 };
23387@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
23388 * This should be close to trivial, but it isn't, because there are buggy
23389 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
23390 */
23391-static int __init pci_sanity_check(struct pci_raw_ops *o)
23392+static int __init pci_sanity_check(const struct pci_raw_ops *o)
23393 {
23394 u32 x = 0;
23395 int year, devfn;
23396diff -urNp linux-2.6.39.2/arch/x86/pci/fixup.c linux-2.6.39.2/arch/x86/pci/fixup.c
23397--- linux-2.6.39.2/arch/x86/pci/fixup.c 2011-05-19 00:06:34.000000000 -0400
23398+++ linux-2.6.39.2/arch/x86/pci/fixup.c 2011-05-22 19:36:30.000000000 -0400
23399@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
23400 DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
23401 },
23402 },
23403- { }
23404+ {}
23405 };
23406
23407 static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
23408diff -urNp linux-2.6.39.2/arch/x86/pci/mmconfig_32.c linux-2.6.39.2/arch/x86/pci/mmconfig_32.c
23409--- linux-2.6.39.2/arch/x86/pci/mmconfig_32.c 2011-05-19 00:06:34.000000000 -0400
23410+++ linux-2.6.39.2/arch/x86/pci/mmconfig_32.c 2011-05-22 19:36:30.000000000 -0400
23411@@ -117,7 +117,7 @@ static int pci_mmcfg_write(unsigned int
23412 return 0;
23413 }
23414
23415-static struct pci_raw_ops pci_mmcfg = {
23416+static const struct pci_raw_ops pci_mmcfg = {
23417 .read = pci_mmcfg_read,
23418 .write = pci_mmcfg_write,
23419 };
23420diff -urNp linux-2.6.39.2/arch/x86/pci/mmconfig_64.c linux-2.6.39.2/arch/x86/pci/mmconfig_64.c
23421--- linux-2.6.39.2/arch/x86/pci/mmconfig_64.c 2011-05-19 00:06:34.000000000 -0400
23422+++ linux-2.6.39.2/arch/x86/pci/mmconfig_64.c 2011-05-22 19:36:30.000000000 -0400
23423@@ -81,7 +81,7 @@ static int pci_mmcfg_write(unsigned int
23424 return 0;
23425 }
23426
23427-static struct pci_raw_ops pci_mmcfg = {
23428+static const struct pci_raw_ops pci_mmcfg = {
23429 .read = pci_mmcfg_read,
23430 .write = pci_mmcfg_write,
23431 };
23432diff -urNp linux-2.6.39.2/arch/x86/pci/mrst.c linux-2.6.39.2/arch/x86/pci/mrst.c
23433--- linux-2.6.39.2/arch/x86/pci/mrst.c 2011-05-19 00:06:34.000000000 -0400
23434+++ linux-2.6.39.2/arch/x86/pci/mrst.c 2011-05-22 19:36:30.000000000 -0400
23435@@ -218,7 +218,7 @@ static int mrst_pci_irq_enable(struct pc
23436 return 0;
23437 }
23438
23439-struct pci_ops pci_mrst_ops = {
23440+const struct pci_ops pci_mrst_ops = {
23441 .read = pci_read,
23442 .write = pci_write,
23443 };
23444diff -urNp linux-2.6.39.2/arch/x86/pci/numaq_32.c linux-2.6.39.2/arch/x86/pci/numaq_32.c
23445--- linux-2.6.39.2/arch/x86/pci/numaq_32.c 2011-05-19 00:06:34.000000000 -0400
23446+++ linux-2.6.39.2/arch/x86/pci/numaq_32.c 2011-05-22 19:36:30.000000000 -0400
23447@@ -108,7 +108,7 @@ static int pci_conf1_mq_write(unsigned i
23448
23449 #undef PCI_CONF1_MQ_ADDRESS
23450
23451-static struct pci_raw_ops pci_direct_conf1_mq = {
23452+static const struct pci_raw_ops pci_direct_conf1_mq = {
23453 .read = pci_conf1_mq_read,
23454 .write = pci_conf1_mq_write
23455 };
23456diff -urNp linux-2.6.39.2/arch/x86/pci/olpc.c linux-2.6.39.2/arch/x86/pci/olpc.c
23457--- linux-2.6.39.2/arch/x86/pci/olpc.c 2011-05-19 00:06:34.000000000 -0400
23458+++ linux-2.6.39.2/arch/x86/pci/olpc.c 2011-05-22 19:36:30.000000000 -0400
23459@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
23460 return 0;
23461 }
23462
23463-static struct pci_raw_ops pci_olpc_conf = {
23464+static const struct pci_raw_ops pci_olpc_conf = {
23465 .read = pci_olpc_read,
23466 .write = pci_olpc_write,
23467 };
23468diff -urNp linux-2.6.39.2/arch/x86/pci/pcbios.c linux-2.6.39.2/arch/x86/pci/pcbios.c
23469--- linux-2.6.39.2/arch/x86/pci/pcbios.c 2011-05-19 00:06:34.000000000 -0400
23470+++ linux-2.6.39.2/arch/x86/pci/pcbios.c 2011-05-22 19:36:30.000000000 -0400
23471@@ -79,50 +79,93 @@ union bios32 {
23472 static struct {
23473 unsigned long address;
23474 unsigned short segment;
23475-} bios32_indirect = { 0, __KERNEL_CS };
23476+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23477
23478 /*
23479 * Returns the entry point for the given service, NULL on error
23480 */
23481
23482-static unsigned long bios32_service(unsigned long service)
23483+static unsigned long __devinit bios32_service(unsigned long service)
23484 {
23485 unsigned char return_code; /* %al */
23486 unsigned long address; /* %ebx */
23487 unsigned long length; /* %ecx */
23488 unsigned long entry; /* %edx */
23489 unsigned long flags;
23490+ struct desc_struct d, *gdt;
23491
23492 local_irq_save(flags);
23493- __asm__("lcall *(%%edi); cld"
23494+
23495+ gdt = get_cpu_gdt_table(smp_processor_id());
23496+
23497+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23498+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23499+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23500+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23501+
23502+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23503 : "=a" (return_code),
23504 "=b" (address),
23505 "=c" (length),
23506 "=d" (entry)
23507 : "0" (service),
23508 "1" (0),
23509- "D" (&bios32_indirect));
23510+ "D" (&bios32_indirect),
23511+ "r"(__PCIBIOS_DS)
23512+ : "memory");
23513+
23514+ pax_open_kernel();
23515+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23516+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23517+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23518+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23519+ pax_close_kernel();
23520+
23521 local_irq_restore(flags);
23522
23523 switch (return_code) {
23524- case 0:
23525- return address + entry;
23526- case 0x80: /* Not present */
23527- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23528- return 0;
23529- default: /* Shouldn't happen */
23530- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23531- service, return_code);
23532+ case 0: {
23533+ int cpu;
23534+ unsigned char flags;
23535+
23536+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23537+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23538+ printk(KERN_WARNING "bios32_service: not valid\n");
23539 return 0;
23540+ }
23541+ address = address + PAGE_OFFSET;
23542+ length += 16UL; /* some BIOSs underreport this... */
23543+ flags = 4;
23544+ if (length >= 64*1024*1024) {
23545+ length >>= PAGE_SHIFT;
23546+ flags |= 8;
23547+ }
23548+
23549+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23550+ gdt = get_cpu_gdt_table(cpu);
23551+ pack_descriptor(&d, address, length, 0x9b, flags);
23552+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23553+ pack_descriptor(&d, address, length, 0x93, flags);
23554+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23555+ }
23556+ return entry;
23557+ }
23558+ case 0x80: /* Not present */
23559+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23560+ return 0;
23561+ default: /* Shouldn't happen */
23562+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23563+ service, return_code);
23564+ return 0;
23565 }
23566 }
23567
23568 static struct {
23569 unsigned long address;
23570 unsigned short segment;
23571-} pci_indirect = { 0, __KERNEL_CS };
23572+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23573
23574-static int pci_bios_present;
23575+static int pci_bios_present __read_only;
23576
23577 static int __devinit check_pcibios(void)
23578 {
23579@@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23580 unsigned long flags, pcibios_entry;
23581
23582 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23583- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23584+ pci_indirect.address = pcibios_entry;
23585
23586 local_irq_save(flags);
23587- __asm__(
23588- "lcall *(%%edi); cld\n\t"
23589+ __asm__("movw %w6, %%ds\n\t"
23590+ "lcall *%%ss:(%%edi); cld\n\t"
23591+ "push %%ss\n\t"
23592+ "pop %%ds\n\t"
23593 "jc 1f\n\t"
23594 "xor %%ah, %%ah\n"
23595 "1:"
23596@@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23597 "=b" (ebx),
23598 "=c" (ecx)
23599 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23600- "D" (&pci_indirect)
23601+ "D" (&pci_indirect),
23602+ "r" (__PCIBIOS_DS)
23603 : "memory");
23604 local_irq_restore(flags);
23605
23606@@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se
23607
23608 switch (len) {
23609 case 1:
23610- __asm__("lcall *(%%esi); cld\n\t"
23611+ __asm__("movw %w6, %%ds\n\t"
23612+ "lcall *%%ss:(%%esi); cld\n\t"
23613+ "push %%ss\n\t"
23614+ "pop %%ds\n\t"
23615 "jc 1f\n\t"
23616 "xor %%ah, %%ah\n"
23617 "1:"
23618@@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se
23619 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23620 "b" (bx),
23621 "D" ((long)reg),
23622- "S" (&pci_indirect));
23623+ "S" (&pci_indirect),
23624+ "r" (__PCIBIOS_DS));
23625 /*
23626 * Zero-extend the result beyond 8 bits, do not trust the
23627 * BIOS having done it:
23628@@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se
23629 *value &= 0xff;
23630 break;
23631 case 2:
23632- __asm__("lcall *(%%esi); cld\n\t"
23633+ __asm__("movw %w6, %%ds\n\t"
23634+ "lcall *%%ss:(%%esi); cld\n\t"
23635+ "push %%ss\n\t"
23636+ "pop %%ds\n\t"
23637 "jc 1f\n\t"
23638 "xor %%ah, %%ah\n"
23639 "1:"
23640@@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se
23641 : "1" (PCIBIOS_READ_CONFIG_WORD),
23642 "b" (bx),
23643 "D" ((long)reg),
23644- "S" (&pci_indirect));
23645+ "S" (&pci_indirect),
23646+ "r" (__PCIBIOS_DS));
23647 /*
23648 * Zero-extend the result beyond 16 bits, do not trust the
23649 * BIOS having done it:
23650@@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se
23651 *value &= 0xffff;
23652 break;
23653 case 4:
23654- __asm__("lcall *(%%esi); cld\n\t"
23655+ __asm__("movw %w6, %%ds\n\t"
23656+ "lcall *%%ss:(%%esi); cld\n\t"
23657+ "push %%ss\n\t"
23658+ "pop %%ds\n\t"
23659 "jc 1f\n\t"
23660 "xor %%ah, %%ah\n"
23661 "1:"
23662@@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se
23663 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23664 "b" (bx),
23665 "D" ((long)reg),
23666- "S" (&pci_indirect));
23667+ "S" (&pci_indirect),
23668+ "r" (__PCIBIOS_DS));
23669 break;
23670 }
23671
23672@@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s
23673
23674 switch (len) {
23675 case 1:
23676- __asm__("lcall *(%%esi); cld\n\t"
23677+ __asm__("movw %w6, %%ds\n\t"
23678+ "lcall *%%ss:(%%esi); cld\n\t"
23679+ "push %%ss\n\t"
23680+ "pop %%ds\n\t"
23681 "jc 1f\n\t"
23682 "xor %%ah, %%ah\n"
23683 "1:"
23684@@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s
23685 "c" (value),
23686 "b" (bx),
23687 "D" ((long)reg),
23688- "S" (&pci_indirect));
23689+ "S" (&pci_indirect),
23690+ "r" (__PCIBIOS_DS));
23691 break;
23692 case 2:
23693- __asm__("lcall *(%%esi); cld\n\t"
23694+ __asm__("movw %w6, %%ds\n\t"
23695+ "lcall *%%ss:(%%esi); cld\n\t"
23696+ "push %%ss\n\t"
23697+ "pop %%ds\n\t"
23698 "jc 1f\n\t"
23699 "xor %%ah, %%ah\n"
23700 "1:"
23701@@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s
23702 "c" (value),
23703 "b" (bx),
23704 "D" ((long)reg),
23705- "S" (&pci_indirect));
23706+ "S" (&pci_indirect),
23707+ "r" (__PCIBIOS_DS));
23708 break;
23709 case 4:
23710- __asm__("lcall *(%%esi); cld\n\t"
23711+ __asm__("movw %w6, %%ds\n\t"
23712+ "lcall *%%ss:(%%esi); cld\n\t"
23713+ "push %%ss\n\t"
23714+ "pop %%ds\n\t"
23715 "jc 1f\n\t"
23716 "xor %%ah, %%ah\n"
23717 "1:"
23718@@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s
23719 "c" (value),
23720 "b" (bx),
23721 "D" ((long)reg),
23722- "S" (&pci_indirect));
23723+ "S" (&pci_indirect),
23724+ "r" (__PCIBIOS_DS));
23725 break;
23726 }
23727
23728@@ -301,7 +371,7 @@ static int pci_bios_write(unsigned int s
23729 * Function table for BIOS32 access
23730 */
23731
23732-static struct pci_raw_ops pci_bios_access = {
23733+static const struct pci_raw_ops pci_bios_access = {
23734 .read = pci_bios_read,
23735 .write = pci_bios_write
23736 };
23737@@ -310,7 +380,7 @@ static struct pci_raw_ops pci_bios_acces
23738 * Try to find PCI BIOS.
23739 */
23740
23741-static struct pci_raw_ops * __devinit pci_find_bios(void)
23742+static const struct pci_raw_ops * __devinit pci_find_bios(void)
23743 {
23744 union bios32 *check;
23745 unsigned char sum;
23746@@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i
23747
23748 DBG("PCI: Fetching IRQ routing table... ");
23749 __asm__("push %%es\n\t"
23750+ "movw %w8, %%ds\n\t"
23751 "push %%ds\n\t"
23752 "pop %%es\n\t"
23753- "lcall *(%%esi); cld\n\t"
23754+ "lcall *%%ss:(%%esi); cld\n\t"
23755 "pop %%es\n\t"
23756+ "push %%ss\n\t"
23757+ "pop %%ds\n"
23758 "jc 1f\n\t"
23759 "xor %%ah, %%ah\n"
23760 "1:"
23761@@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i
23762 "1" (0),
23763 "D" ((long) &opt),
23764 "S" (&pci_indirect),
23765- "m" (opt)
23766+ "m" (opt),
23767+ "r" (__PCIBIOS_DS)
23768 : "memory");
23769 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
23770 if (ret & 0xff00)
23771@@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d
23772 {
23773 int ret;
23774
23775- __asm__("lcall *(%%esi); cld\n\t"
23776+ __asm__("movw %w5, %%ds\n\t"
23777+ "lcall *%%ss:(%%esi); cld\n\t"
23778+ "push %%ss\n\t"
23779+ "pop %%ds\n"
23780 "jc 1f\n\t"
23781 "xor %%ah, %%ah\n"
23782 "1:"
23783@@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d
23784 : "0" (PCIBIOS_SET_PCI_HW_INT),
23785 "b" ((dev->bus->number << 8) | dev->devfn),
23786 "c" ((irq << 8) | (pin + 10)),
23787- "S" (&pci_indirect));
23788+ "S" (&pci_indirect),
23789+ "r" (__PCIBIOS_DS));
23790 return !(ret & 0xff00);
23791 }
23792 EXPORT_SYMBOL(pcibios_set_irq_routing);
23793diff -urNp linux-2.6.39.2/arch/x86/pci/xen.c linux-2.6.39.2/arch/x86/pci/xen.c
23794--- linux-2.6.39.2/arch/x86/pci/xen.c 2011-05-19 00:06:34.000000000 -0400
23795+++ linux-2.6.39.2/arch/x86/pci/xen.c 2011-05-22 19:36:30.000000000 -0400
23796@@ -62,7 +62,7 @@ static int acpi_register_gsi_xen_hvm(str
23797 #include <linux/msi.h>
23798 #include <asm/msidef.h>
23799
23800-struct xen_pci_frontend_ops *xen_pci_frontend;
23801+const struct xen_pci_frontend_ops *xen_pci_frontend;
23802 EXPORT_SYMBOL_GPL(xen_pci_frontend);
23803
23804 #define XEN_PIRQ_MSI_DATA (MSI_DATA_TRIGGER_EDGE | \
23805diff -urNp linux-2.6.39.2/arch/x86/platform/efi/efi_32.c linux-2.6.39.2/arch/x86/platform/efi/efi_32.c
23806--- linux-2.6.39.2/arch/x86/platform/efi/efi_32.c 2011-05-19 00:06:34.000000000 -0400
23807+++ linux-2.6.39.2/arch/x86/platform/efi/efi_32.c 2011-05-22 19:36:30.000000000 -0400
23808@@ -38,70 +38,37 @@
23809 */
23810
23811 static unsigned long efi_rt_eflags;
23812-static pgd_t efi_bak_pg_dir_pointer[2];
23813+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
23814
23815-void efi_call_phys_prelog(void)
23816+void __init efi_call_phys_prelog(void)
23817 {
23818- unsigned long cr4;
23819- unsigned long temp;
23820 struct desc_ptr gdt_descr;
23821
23822 local_irq_save(efi_rt_eflags);
23823
23824- /*
23825- * If I don't have PAE, I should just duplicate two entries in page
23826- * directory. If I have PAE, I just need to duplicate one entry in
23827- * page directory.
23828- */
23829- cr4 = read_cr4_safe();
23830-
23831- if (cr4 & X86_CR4_PAE) {
23832- efi_bak_pg_dir_pointer[0].pgd =
23833- swapper_pg_dir[pgd_index(0)].pgd;
23834- swapper_pg_dir[0].pgd =
23835- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23836- } else {
23837- efi_bak_pg_dir_pointer[0].pgd =
23838- swapper_pg_dir[pgd_index(0)].pgd;
23839- efi_bak_pg_dir_pointer[1].pgd =
23840- swapper_pg_dir[pgd_index(0x400000)].pgd;
23841- swapper_pg_dir[pgd_index(0)].pgd =
23842- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23843- temp = PAGE_OFFSET + 0x400000;
23844- swapper_pg_dir[pgd_index(0x400000)].pgd =
23845- swapper_pg_dir[pgd_index(temp)].pgd;
23846- }
23847+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
23848+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
23849+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
23850
23851 /*
23852 * After the lock is released, the original page table is restored.
23853 */
23854 __flush_tlb_all();
23855
23856- gdt_descr.address = __pa(get_cpu_gdt_table(0));
23857+ gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
23858 gdt_descr.size = GDT_SIZE - 1;
23859 load_gdt(&gdt_descr);
23860 }
23861
23862-void efi_call_phys_epilog(void)
23863+void __init efi_call_phys_epilog(void)
23864 {
23865- unsigned long cr4;
23866 struct desc_ptr gdt_descr;
23867
23868- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
23869+ gdt_descr.address = get_cpu_gdt_table(0);
23870 gdt_descr.size = GDT_SIZE - 1;
23871 load_gdt(&gdt_descr);
23872
23873- cr4 = read_cr4_safe();
23874-
23875- if (cr4 & X86_CR4_PAE) {
23876- swapper_pg_dir[pgd_index(0)].pgd =
23877- efi_bak_pg_dir_pointer[0].pgd;
23878- } else {
23879- swapper_pg_dir[pgd_index(0)].pgd =
23880- efi_bak_pg_dir_pointer[0].pgd;
23881- swapper_pg_dir[pgd_index(0x400000)].pgd =
23882- efi_bak_pg_dir_pointer[1].pgd;
23883- }
23884+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
23885
23886 /*
23887 * After the lock is released, the original page table is restored.
23888diff -urNp linux-2.6.39.2/arch/x86/platform/efi/efi_stub_32.S linux-2.6.39.2/arch/x86/platform/efi/efi_stub_32.S
23889--- linux-2.6.39.2/arch/x86/platform/efi/efi_stub_32.S 2011-05-19 00:06:34.000000000 -0400
23890+++ linux-2.6.39.2/arch/x86/platform/efi/efi_stub_32.S 2011-05-22 19:36:30.000000000 -0400
23891@@ -6,6 +6,7 @@
23892 */
23893
23894 #include <linux/linkage.h>
23895+#include <linux/init.h>
23896 #include <asm/page_types.h>
23897
23898 /*
23899@@ -20,7 +21,7 @@
23900 * service functions will comply with gcc calling convention, too.
23901 */
23902
23903-.text
23904+__INIT
23905 ENTRY(efi_call_phys)
23906 /*
23907 * 0. The function can only be called in Linux kernel. So CS has been
23908@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
23909 * The mapping of lower virtual memory has been created in prelog and
23910 * epilog.
23911 */
23912- movl $1f, %edx
23913- subl $__PAGE_OFFSET, %edx
23914- jmp *%edx
23915+ jmp 1f-__PAGE_OFFSET
23916 1:
23917
23918 /*
23919@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
23920 * parameter 2, ..., param n. To make things easy, we save the return
23921 * address of efi_call_phys in a global variable.
23922 */
23923- popl %edx
23924- movl %edx, saved_return_addr
23925- /* get the function pointer into ECX*/
23926- popl %ecx
23927- movl %ecx, efi_rt_function_ptr
23928- movl $2f, %edx
23929- subl $__PAGE_OFFSET, %edx
23930- pushl %edx
23931+ popl (saved_return_addr)
23932+ popl (efi_rt_function_ptr)
23933
23934 /*
23935 * 3. Clear PG bit in %CR0.
23936@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
23937 /*
23938 * 5. Call the physical function.
23939 */
23940- jmp *%ecx
23941+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
23942
23943-2:
23944 /*
23945 * 6. After EFI runtime service returns, control will return to
23946 * following instruction. We'd better readjust stack pointer first.
23947@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
23948 movl %cr0, %edx
23949 orl $0x80000000, %edx
23950 movl %edx, %cr0
23951- jmp 1f
23952-1:
23953+
23954 /*
23955 * 8. Now restore the virtual mode from flat mode by
23956 * adding EIP with PAGE_OFFSET.
23957 */
23958- movl $1f, %edx
23959- jmp *%edx
23960+ jmp 1f+__PAGE_OFFSET
23961 1:
23962
23963 /*
23964 * 9. Balance the stack. And because EAX contain the return value,
23965 * we'd better not clobber it.
23966 */
23967- leal efi_rt_function_ptr, %edx
23968- movl (%edx), %ecx
23969- pushl %ecx
23970+ pushl (efi_rt_function_ptr)
23971
23972 /*
23973- * 10. Push the saved return address onto the stack and return.
23974+ * 10. Return to the saved return address.
23975 */
23976- leal saved_return_addr, %edx
23977- movl (%edx), %ecx
23978- pushl %ecx
23979- ret
23980+ jmpl *(saved_return_addr)
23981 ENDPROC(efi_call_phys)
23982 .previous
23983
23984-.data
23985+__INITDATA
23986 saved_return_addr:
23987 .long 0
23988 efi_rt_function_ptr:
23989diff -urNp linux-2.6.39.2/arch/x86/platform/olpc/olpc_dt.c linux-2.6.39.2/arch/x86/platform/olpc/olpc_dt.c
23990--- linux-2.6.39.2/arch/x86/platform/olpc/olpc_dt.c 2011-05-19 00:06:34.000000000 -0400
23991+++ linux-2.6.39.2/arch/x86/platform/olpc/olpc_dt.c 2011-05-22 19:36:30.000000000 -0400
23992@@ -154,7 +154,7 @@ void * __init prom_early_alloc(unsigned
23993 return res;
23994 }
23995
23996-static struct of_pdt_ops prom_olpc_ops __initdata = {
23997+static const struct of_pdt_ops prom_olpc_ops = {
23998 .nextprop = olpc_dt_nextprop,
23999 .getproplen = olpc_dt_getproplen,
24000 .getproperty = olpc_dt_getproperty,
24001diff -urNp linux-2.6.39.2/arch/x86/platform/uv/tlb_uv.c linux-2.6.39.2/arch/x86/platform/uv/tlb_uv.c
24002--- linux-2.6.39.2/arch/x86/platform/uv/tlb_uv.c 2011-05-19 00:06:34.000000000 -0400
24003+++ linux-2.6.39.2/arch/x86/platform/uv/tlb_uv.c 2011-05-22 19:36:30.000000000 -0400
24004@@ -342,6 +342,8 @@ static void uv_reset_with_ipi(struct bau
24005 cpumask_t mask;
24006 struct reset_args reset_args;
24007
24008+ pax_track_stack();
24009+
24010 reset_args.sender = sender;
24011
24012 cpus_clear(mask);
24013diff -urNp linux-2.6.39.2/arch/x86/power/cpu.c linux-2.6.39.2/arch/x86/power/cpu.c
24014--- linux-2.6.39.2/arch/x86/power/cpu.c 2011-05-19 00:06:34.000000000 -0400
24015+++ linux-2.6.39.2/arch/x86/power/cpu.c 2011-05-22 19:36:30.000000000 -0400
24016@@ -130,7 +130,7 @@ static void do_fpu_end(void)
24017 static void fix_processor_context(void)
24018 {
24019 int cpu = smp_processor_id();
24020- struct tss_struct *t = &per_cpu(init_tss, cpu);
24021+ struct tss_struct *t = init_tss + cpu;
24022
24023 set_tss_desc(cpu, t); /*
24024 * This just modifies memory; should not be
24025@@ -140,7 +140,9 @@ static void fix_processor_context(void)
24026 */
24027
24028 #ifdef CONFIG_X86_64
24029+ pax_open_kernel();
24030 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
24031+ pax_close_kernel();
24032
24033 syscall_init(); /* This sets MSR_*STAR and related */
24034 #endif
24035diff -urNp linux-2.6.39.2/arch/x86/vdso/Makefile linux-2.6.39.2/arch/x86/vdso/Makefile
24036--- linux-2.6.39.2/arch/x86/vdso/Makefile 2011-05-19 00:06:34.000000000 -0400
24037+++ linux-2.6.39.2/arch/x86/vdso/Makefile 2011-05-22 19:36:30.000000000 -0400
24038@@ -123,7 +123,7 @@ quiet_cmd_vdso = VDSO $@
24039 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
24040 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
24041
24042-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24043+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24044 GCOV_PROFILE := n
24045
24046 #
24047diff -urNp linux-2.6.39.2/arch/x86/vdso/vclock_gettime.c linux-2.6.39.2/arch/x86/vdso/vclock_gettime.c
24048--- linux-2.6.39.2/arch/x86/vdso/vclock_gettime.c 2011-05-19 00:06:34.000000000 -0400
24049+++ linux-2.6.39.2/arch/x86/vdso/vclock_gettime.c 2011-05-22 19:36:30.000000000 -0400
24050@@ -22,24 +22,48 @@
24051 #include <asm/hpet.h>
24052 #include <asm/unistd.h>
24053 #include <asm/io.h>
24054+#include <asm/fixmap.h>
24055 #include "vextern.h"
24056
24057 #define gtod vdso_vsyscall_gtod_data
24058
24059+notrace noinline long __vdso_fallback_time(long *t)
24060+{
24061+ long secs;
24062+ asm volatile("syscall"
24063+ : "=a" (secs)
24064+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
24065+ return secs;
24066+}
24067+
24068 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
24069 {
24070 long ret;
24071 asm("syscall" : "=a" (ret) :
24072- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
24073+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
24074 return ret;
24075 }
24076
24077+notrace static inline cycle_t __vdso_vread_hpet(void)
24078+{
24079+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
24080+}
24081+
24082+notrace static inline cycle_t __vdso_vread_tsc(void)
24083+{
24084+ cycle_t ret = (cycle_t)vget_cycles();
24085+
24086+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
24087+}
24088+
24089 notrace static inline long vgetns(void)
24090 {
24091 long v;
24092- cycles_t (*vread)(void);
24093- vread = gtod->clock.vread;
24094- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
24095+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
24096+ v = __vdso_vread_tsc();
24097+ else
24098+ v = __vdso_vread_hpet();
24099+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
24100 return (v * gtod->clock.mult) >> gtod->clock.shift;
24101 }
24102
24103@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
24104
24105 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
24106 {
24107- if (likely(gtod->sysctl_enabled))
24108+ if (likely(gtod->sysctl_enabled &&
24109+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
24110+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
24111 switch (clock) {
24112 case CLOCK_REALTIME:
24113 if (likely(gtod->clock.vread))
24114@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
24115 int clock_gettime(clockid_t, struct timespec *)
24116 __attribute__((weak, alias("__vdso_clock_gettime")));
24117
24118-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
24119+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
24120 {
24121 long ret;
24122- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
24123+ asm("syscall" : "=a" (ret) :
24124+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
24125+ return ret;
24126+}
24127+
24128+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
24129+{
24130+ if (likely(gtod->sysctl_enabled &&
24131+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
24132+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
24133+ {
24134 if (likely(tv != NULL)) {
24135 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
24136 offsetof(struct timespec, tv_nsec) ||
24137@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
24138 }
24139 return 0;
24140 }
24141- asm("syscall" : "=a" (ret) :
24142- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
24143- return ret;
24144+ return __vdso_fallback_gettimeofday(tv, tz);
24145 }
24146 int gettimeofday(struct timeval *, struct timezone *)
24147 __attribute__((weak, alias("__vdso_gettimeofday")));
24148diff -urNp linux-2.6.39.2/arch/x86/vdso/vdso32-setup.c linux-2.6.39.2/arch/x86/vdso/vdso32-setup.c
24149--- linux-2.6.39.2/arch/x86/vdso/vdso32-setup.c 2011-05-19 00:06:34.000000000 -0400
24150+++ linux-2.6.39.2/arch/x86/vdso/vdso32-setup.c 2011-05-22 19:36:30.000000000 -0400
24151@@ -25,6 +25,7 @@
24152 #include <asm/tlbflush.h>
24153 #include <asm/vdso.h>
24154 #include <asm/proto.h>
24155+#include <asm/mman.h>
24156
24157 enum {
24158 VDSO_DISABLED = 0,
24159@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
24160 void enable_sep_cpu(void)
24161 {
24162 int cpu = get_cpu();
24163- struct tss_struct *tss = &per_cpu(init_tss, cpu);
24164+ struct tss_struct *tss = init_tss + cpu;
24165
24166 if (!boot_cpu_has(X86_FEATURE_SEP)) {
24167 put_cpu();
24168@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
24169 gate_vma.vm_start = FIXADDR_USER_START;
24170 gate_vma.vm_end = FIXADDR_USER_END;
24171 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
24172- gate_vma.vm_page_prot = __P101;
24173+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
24174 /*
24175 * Make sure the vDSO gets into every core dump.
24176 * Dumping its contents makes post-mortem fully interpretable later
24177@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
24178 if (compat)
24179 addr = VDSO_HIGH_BASE;
24180 else {
24181- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
24182+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
24183 if (IS_ERR_VALUE(addr)) {
24184 ret = addr;
24185 goto up_fail;
24186 }
24187 }
24188
24189- current->mm->context.vdso = (void *)addr;
24190+ current->mm->context.vdso = addr;
24191
24192 if (compat_uses_vma || !compat) {
24193 /*
24194@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
24195 }
24196
24197 current_thread_info()->sysenter_return =
24198- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24199+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24200
24201 up_fail:
24202 if (ret)
24203- current->mm->context.vdso = NULL;
24204+ current->mm->context.vdso = 0;
24205
24206 up_write(&mm->mmap_sem);
24207
24208@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
24209
24210 const char *arch_vma_name(struct vm_area_struct *vma)
24211 {
24212- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
24213+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
24214 return "[vdso]";
24215+
24216+#ifdef CONFIG_PAX_SEGMEXEC
24217+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
24218+ return "[vdso]";
24219+#endif
24220+
24221 return NULL;
24222 }
24223
24224@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
24225 * Check to see if the corresponding task was created in compat vdso
24226 * mode.
24227 */
24228- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
24229+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
24230 return &gate_vma;
24231 return NULL;
24232 }
24233diff -urNp linux-2.6.39.2/arch/x86/vdso/vdso.lds.S linux-2.6.39.2/arch/x86/vdso/vdso.lds.S
24234--- linux-2.6.39.2/arch/x86/vdso/vdso.lds.S 2011-05-19 00:06:34.000000000 -0400
24235+++ linux-2.6.39.2/arch/x86/vdso/vdso.lds.S 2011-06-06 17:34:26.000000000 -0400
24236@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
24237 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
24238 #include "vextern.h"
24239 #undef VEXTERN
24240+
24241+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
24242+VEXTERN(fallback_gettimeofday)
24243+VEXTERN(fallback_time)
24244+VEXTERN(getcpu)
24245+#undef VEXTERN
24246diff -urNp linux-2.6.39.2/arch/x86/vdso/vextern.h linux-2.6.39.2/arch/x86/vdso/vextern.h
24247--- linux-2.6.39.2/arch/x86/vdso/vextern.h 2011-05-19 00:06:34.000000000 -0400
24248+++ linux-2.6.39.2/arch/x86/vdso/vextern.h 2011-05-22 19:36:30.000000000 -0400
24249@@ -11,6 +11,5 @@
24250 put into vextern.h and be referenced as a pointer with vdso prefix.
24251 The main kernel later fills in the values. */
24252
24253-VEXTERN(jiffies)
24254 VEXTERN(vgetcpu_mode)
24255 VEXTERN(vsyscall_gtod_data)
24256diff -urNp linux-2.6.39.2/arch/x86/vdso/vma.c linux-2.6.39.2/arch/x86/vdso/vma.c
24257--- linux-2.6.39.2/arch/x86/vdso/vma.c 2011-05-19 00:06:34.000000000 -0400
24258+++ linux-2.6.39.2/arch/x86/vdso/vma.c 2011-05-22 19:36:30.000000000 -0400
24259@@ -58,7 +58,7 @@ static int __init init_vdso_vars(void)
24260 if (!vbase)
24261 goto oom;
24262
24263- if (memcmp(vbase, "\177ELF", 4)) {
24264+ if (memcmp(vbase, ELFMAG, SELFMAG)) {
24265 printk("VDSO: I'm broken; not ELF\n");
24266 vdso_enabled = 0;
24267 }
24268@@ -118,7 +118,7 @@ int arch_setup_additional_pages(struct l
24269 goto up_fail;
24270 }
24271
24272- current->mm->context.vdso = (void *)addr;
24273+ current->mm->context.vdso = addr;
24274
24275 ret = install_special_mapping(mm, addr, vdso_size,
24276 VM_READ|VM_EXEC|
24277@@ -126,7 +126,7 @@ int arch_setup_additional_pages(struct l
24278 VM_ALWAYSDUMP,
24279 vdso_pages);
24280 if (ret) {
24281- current->mm->context.vdso = NULL;
24282+ current->mm->context.vdso = 0;
24283 goto up_fail;
24284 }
24285
24286@@ -134,10 +134,3 @@ up_fail:
24287 up_write(&mm->mmap_sem);
24288 return ret;
24289 }
24290-
24291-static __init int vdso_setup(char *s)
24292-{
24293- vdso_enabled = simple_strtoul(s, NULL, 0);
24294- return 0;
24295-}
24296-__setup("vdso=", vdso_setup);
24297diff -urNp linux-2.6.39.2/arch/x86/xen/enlighten.c linux-2.6.39.2/arch/x86/xen/enlighten.c
24298--- linux-2.6.39.2/arch/x86/xen/enlighten.c 2011-05-19 00:06:34.000000000 -0400
24299+++ linux-2.6.39.2/arch/x86/xen/enlighten.c 2011-05-22 19:36:30.000000000 -0400
24300@@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
24301
24302 struct shared_info xen_dummy_shared_info;
24303
24304-void *xen_initial_gdt;
24305-
24306 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
24307 __read_mostly int xen_have_vector_callback;
24308 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
24309@@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic
24310 #endif
24311 };
24312
24313-static void xen_reboot(int reason)
24314+static __noreturn void xen_reboot(int reason)
24315 {
24316 struct sched_shutdown r = { .reason = reason };
24317
24318@@ -1018,17 +1016,17 @@ static void xen_reboot(int reason)
24319 BUG();
24320 }
24321
24322-static void xen_restart(char *msg)
24323+static __noreturn void xen_restart(char *msg)
24324 {
24325 xen_reboot(SHUTDOWN_reboot);
24326 }
24327
24328-static void xen_emergency_restart(void)
24329+static __noreturn void xen_emergency_restart(void)
24330 {
24331 xen_reboot(SHUTDOWN_reboot);
24332 }
24333
24334-static void xen_machine_halt(void)
24335+static __noreturn void xen_machine_halt(void)
24336 {
24337 xen_reboot(SHUTDOWN_poweroff);
24338 }
24339@@ -1127,7 +1125,17 @@ asmlinkage void __init xen_start_kernel(
24340 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24341
24342 /* Work out if we support NX */
24343- x86_configure_nx();
24344+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24345+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24346+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24347+ unsigned l, h;
24348+
24349+ __supported_pte_mask |= _PAGE_NX;
24350+ rdmsr(MSR_EFER, l, h);
24351+ l |= EFER_NX;
24352+ wrmsr(MSR_EFER, l, h);
24353+ }
24354+#endif
24355
24356 xen_setup_features();
24357
24358@@ -1158,13 +1166,6 @@ asmlinkage void __init xen_start_kernel(
24359
24360 machine_ops = xen_machine_ops;
24361
24362- /*
24363- * The only reliable way to retain the initial address of the
24364- * percpu gdt_page is to remember it here, so we can go and
24365- * mark it RW later, when the initial percpu area is freed.
24366- */
24367- xen_initial_gdt = &per_cpu(gdt_page, 0);
24368-
24369 xen_smp_init();
24370
24371 #ifdef CONFIG_ACPI_NUMA
24372diff -urNp linux-2.6.39.2/arch/x86/xen/mmu.c linux-2.6.39.2/arch/x86/xen/mmu.c
24373--- linux-2.6.39.2/arch/x86/xen/mmu.c 2011-06-03 00:04:13.000000000 -0400
24374+++ linux-2.6.39.2/arch/x86/xen/mmu.c 2011-06-03 00:32:05.000000000 -0400
24375@@ -1791,6 +1791,8 @@ __init pgd_t *xen_setup_kernel_pagetable
24376 convert_pfn_mfn(init_level4_pgt);
24377 convert_pfn_mfn(level3_ident_pgt);
24378 convert_pfn_mfn(level3_kernel_pgt);
24379+ convert_pfn_mfn(level3_vmalloc_pgt);
24380+ convert_pfn_mfn(level3_vmemmap_pgt);
24381
24382 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24383 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24384@@ -1809,7 +1811,10 @@ __init pgd_t *xen_setup_kernel_pagetable
24385 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24386 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24387 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24388+ set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
24389+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24390 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24391+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24392 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24393 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24394
24395diff -urNp linux-2.6.39.2/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.39.2/arch/x86/xen/pci-swiotlb-xen.c
24396--- linux-2.6.39.2/arch/x86/xen/pci-swiotlb-xen.c 2011-05-19 00:06:34.000000000 -0400
24397+++ linux-2.6.39.2/arch/x86/xen/pci-swiotlb-xen.c 2011-05-22 19:36:30.000000000 -0400
24398@@ -10,7 +10,7 @@
24399
24400 int xen_swiotlb __read_mostly;
24401
24402-static struct dma_map_ops xen_swiotlb_dma_ops = {
24403+static const struct dma_map_ops xen_swiotlb_dma_ops = {
24404 .mapping_error = xen_swiotlb_dma_mapping_error,
24405 .alloc_coherent = xen_swiotlb_alloc_coherent,
24406 .free_coherent = xen_swiotlb_free_coherent,
24407diff -urNp linux-2.6.39.2/arch/x86/xen/smp.c linux-2.6.39.2/arch/x86/xen/smp.c
24408--- linux-2.6.39.2/arch/x86/xen/smp.c 2011-05-19 00:06:34.000000000 -0400
24409+++ linux-2.6.39.2/arch/x86/xen/smp.c 2011-05-22 19:36:30.000000000 -0400
24410@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
24411 {
24412 BUG_ON(smp_processor_id() != 0);
24413 native_smp_prepare_boot_cpu();
24414-
24415- /* We've switched to the "real" per-cpu gdt, so make sure the
24416- old memory can be recycled */
24417- make_lowmem_page_readwrite(xen_initial_gdt);
24418-
24419 xen_filter_cpu_maps();
24420 xen_setup_vcpu_info_placement();
24421 }
24422@@ -259,12 +254,12 @@ cpu_initialize_context(unsigned int cpu,
24423 gdt = get_cpu_gdt_table(cpu);
24424
24425 ctxt->flags = VGCF_IN_KERNEL;
24426- ctxt->user_regs.ds = __USER_DS;
24427- ctxt->user_regs.es = __USER_DS;
24428+ ctxt->user_regs.ds = __KERNEL_DS;
24429+ ctxt->user_regs.es = __KERNEL_DS;
24430 ctxt->user_regs.ss = __KERNEL_DS;
24431 #ifdef CONFIG_X86_32
24432 ctxt->user_regs.fs = __KERNEL_PERCPU;
24433- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24434+ savesegment(gs, ctxt->user_regs.gs);
24435 #else
24436 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24437 #endif
24438@@ -315,13 +310,12 @@ static int __cpuinit xen_cpu_up(unsigned
24439 int rc;
24440
24441 per_cpu(current_task, cpu) = idle;
24442+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24443 #ifdef CONFIG_X86_32
24444 irq_ctx_init(cpu);
24445 #else
24446 clear_tsk_thread_flag(idle, TIF_FORK);
24447- per_cpu(kernel_stack, cpu) =
24448- (unsigned long)task_stack_page(idle) -
24449- KERNEL_STACK_OFFSET + THREAD_SIZE;
24450+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24451 #endif
24452 xen_setup_runstate_info(cpu);
24453 xen_setup_timer(cpu);
24454diff -urNp linux-2.6.39.2/arch/x86/xen/xen-asm_32.S linux-2.6.39.2/arch/x86/xen/xen-asm_32.S
24455--- linux-2.6.39.2/arch/x86/xen/xen-asm_32.S 2011-05-19 00:06:34.000000000 -0400
24456+++ linux-2.6.39.2/arch/x86/xen/xen-asm_32.S 2011-05-22 19:36:30.000000000 -0400
24457@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24458 ESP_OFFSET=4 # bytes pushed onto stack
24459
24460 /*
24461- * Store vcpu_info pointer for easy access. Do it this way to
24462- * avoid having to reload %fs
24463+ * Store vcpu_info pointer for easy access.
24464 */
24465 #ifdef CONFIG_SMP
24466- GET_THREAD_INFO(%eax)
24467- movl TI_cpu(%eax), %eax
24468- movl __per_cpu_offset(,%eax,4), %eax
24469- mov xen_vcpu(%eax), %eax
24470+ push %fs
24471+ mov $(__KERNEL_PERCPU), %eax
24472+ mov %eax, %fs
24473+ mov PER_CPU_VAR(xen_vcpu), %eax
24474+ pop %fs
24475 #else
24476 movl xen_vcpu, %eax
24477 #endif
24478diff -urNp linux-2.6.39.2/arch/x86/xen/xen-head.S linux-2.6.39.2/arch/x86/xen/xen-head.S
24479--- linux-2.6.39.2/arch/x86/xen/xen-head.S 2011-05-19 00:06:34.000000000 -0400
24480+++ linux-2.6.39.2/arch/x86/xen/xen-head.S 2011-05-22 19:36:30.000000000 -0400
24481@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24482 #ifdef CONFIG_X86_32
24483 mov %esi,xen_start_info
24484 mov $init_thread_union+THREAD_SIZE,%esp
24485+#ifdef CONFIG_SMP
24486+ movl $cpu_gdt_table,%edi
24487+ movl $__per_cpu_load,%eax
24488+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24489+ rorl $16,%eax
24490+ movb %al,__KERNEL_PERCPU + 4(%edi)
24491+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24492+ movl $__per_cpu_end - 1,%eax
24493+ subl $__per_cpu_start,%eax
24494+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24495+#endif
24496 #else
24497 mov %rsi,xen_start_info
24498 mov $init_thread_union+THREAD_SIZE,%rsp
24499diff -urNp linux-2.6.39.2/arch/x86/xen/xen-ops.h linux-2.6.39.2/arch/x86/xen/xen-ops.h
24500--- linux-2.6.39.2/arch/x86/xen/xen-ops.h 2011-05-19 00:06:34.000000000 -0400
24501+++ linux-2.6.39.2/arch/x86/xen/xen-ops.h 2011-05-22 19:36:30.000000000 -0400
24502@@ -10,8 +10,6 @@
24503 extern const char xen_hypervisor_callback[];
24504 extern const char xen_failsafe_callback[];
24505
24506-extern void *xen_initial_gdt;
24507-
24508 struct trap_info;
24509 void xen_copy_trap_info(struct trap_info *traps);
24510
24511diff -urNp linux-2.6.39.2/block/blk-iopoll.c linux-2.6.39.2/block/blk-iopoll.c
24512--- linux-2.6.39.2/block/blk-iopoll.c 2011-05-19 00:06:34.000000000 -0400
24513+++ linux-2.6.39.2/block/blk-iopoll.c 2011-05-22 19:36:30.000000000 -0400
24514@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
24515 }
24516 EXPORT_SYMBOL(blk_iopoll_complete);
24517
24518-static void blk_iopoll_softirq(struct softirq_action *h)
24519+static void blk_iopoll_softirq(void)
24520 {
24521 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24522 int rearm = 0, budget = blk_iopoll_budget;
24523diff -urNp linux-2.6.39.2/block/blk-map.c linux-2.6.39.2/block/blk-map.c
24524--- linux-2.6.39.2/block/blk-map.c 2011-05-19 00:06:34.000000000 -0400
24525+++ linux-2.6.39.2/block/blk-map.c 2011-05-22 19:36:30.000000000 -0400
24526@@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
24527 if (!len || !kbuf)
24528 return -EINVAL;
24529
24530- do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24531+ do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24532 if (do_copy)
24533 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24534 else
24535diff -urNp linux-2.6.39.2/block/blk-softirq.c linux-2.6.39.2/block/blk-softirq.c
24536--- linux-2.6.39.2/block/blk-softirq.c 2011-05-19 00:06:34.000000000 -0400
24537+++ linux-2.6.39.2/block/blk-softirq.c 2011-05-22 19:36:30.000000000 -0400
24538@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
24539 * Softirq action handler - move entries to local list and loop over them
24540 * while passing them to the queue registered handler.
24541 */
24542-static void blk_done_softirq(struct softirq_action *h)
24543+static void blk_done_softirq(void)
24544 {
24545 struct list_head *cpu_list, local_list;
24546
24547diff -urNp linux-2.6.39.2/block/bsg.c linux-2.6.39.2/block/bsg.c
24548--- linux-2.6.39.2/block/bsg.c 2011-05-19 00:06:34.000000000 -0400
24549+++ linux-2.6.39.2/block/bsg.c 2011-05-22 19:36:30.000000000 -0400
24550@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
24551 struct sg_io_v4 *hdr, struct bsg_device *bd,
24552 fmode_t has_write_perm)
24553 {
24554+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24555+ unsigned char *cmdptr;
24556+
24557 if (hdr->request_len > BLK_MAX_CDB) {
24558 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24559 if (!rq->cmd)
24560 return -ENOMEM;
24561- }
24562+ cmdptr = rq->cmd;
24563+ } else
24564+ cmdptr = tmpcmd;
24565
24566- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
24567+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
24568 hdr->request_len))
24569 return -EFAULT;
24570
24571+ if (cmdptr != rq->cmd)
24572+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24573+
24574 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24575 if (blk_verify_command(rq->cmd, has_write_perm))
24576 return -EPERM;
24577diff -urNp linux-2.6.39.2/block/scsi_ioctl.c linux-2.6.39.2/block/scsi_ioctl.c
24578--- linux-2.6.39.2/block/scsi_ioctl.c 2011-05-19 00:06:34.000000000 -0400
24579+++ linux-2.6.39.2/block/scsi_ioctl.c 2011-05-22 19:36:30.000000000 -0400
24580@@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24581 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24582 struct sg_io_hdr *hdr, fmode_t mode)
24583 {
24584- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24585+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24586+ unsigned char *cmdptr;
24587+
24588+ if (rq->cmd != rq->__cmd)
24589+ cmdptr = rq->cmd;
24590+ else
24591+ cmdptr = tmpcmd;
24592+
24593+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24594 return -EFAULT;
24595+
24596+ if (cmdptr != rq->cmd)
24597+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24598+
24599 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24600 return -EPERM;
24601
24602@@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
24603 int err;
24604 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24605 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24606+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24607+ unsigned char *cmdptr;
24608
24609 if (!sic)
24610 return -EINVAL;
24611@@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
24612 */
24613 err = -EFAULT;
24614 rq->cmd_len = cmdlen;
24615- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24616+
24617+ if (rq->cmd != rq->__cmd)
24618+ cmdptr = rq->cmd;
24619+ else
24620+ cmdptr = tmpcmd;
24621+
24622+ if (copy_from_user(cmdptr, sic->data, cmdlen))
24623 goto error;
24624
24625+ if (rq->cmd != cmdptr)
24626+ memcpy(rq->cmd, cmdptr, cmdlen);
24627+
24628 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24629 goto error;
24630
24631diff -urNp linux-2.6.39.2/crypto/serpent.c linux-2.6.39.2/crypto/serpent.c
24632--- linux-2.6.39.2/crypto/serpent.c 2011-05-19 00:06:34.000000000 -0400
24633+++ linux-2.6.39.2/crypto/serpent.c 2011-05-22 19:36:30.000000000 -0400
24634@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
24635 u32 r0,r1,r2,r3,r4;
24636 int i;
24637
24638+ pax_track_stack();
24639+
24640 /* Copy key, add padding */
24641
24642 for (i = 0; i < keylen; ++i)
24643diff -urNp linux-2.6.39.2/Documentation/dontdiff linux-2.6.39.2/Documentation/dontdiff
24644--- linux-2.6.39.2/Documentation/dontdiff 2011-05-19 00:06:34.000000000 -0400
24645+++ linux-2.6.39.2/Documentation/dontdiff 2011-05-22 19:36:30.000000000 -0400
24646@@ -1,13 +1,16 @@
24647 *.a
24648 *.aux
24649 *.bin
24650+*.cis
24651 *.cpio
24652 *.csp
24653+*.dbg
24654 *.dsp
24655 *.dvi
24656 *.elf
24657 *.eps
24658 *.fw
24659+*.gcno
24660 *.gen.S
24661 *.gif
24662 *.grep
24663@@ -38,8 +41,10 @@
24664 *.tab.h
24665 *.tex
24666 *.ver
24667+*.vim
24668 *.xml
24669 *_MODULES
24670+*_reg_safe.h
24671 *_vga16.c
24672 *~
24673 *.9
24674@@ -49,11 +54,16 @@
24675 53c700_d.h
24676 CVS
24677 ChangeSet
24678+GPATH
24679+GRTAGS
24680+GSYMS
24681+GTAGS
24682 Image
24683 Kerntypes
24684 Module.markers
24685 Module.symvers
24686 PENDING
24687+PERF*
24688 SCCS
24689 System.map*
24690 TAGS
24691@@ -80,8 +90,11 @@ btfixupprep
24692 build
24693 bvmlinux
24694 bzImage*
24695+capability_names.h
24696 capflags.c
24697 classlist.h*
24698+clut_vga16.c
24699+common-cmds.h
24700 comp*.log
24701 compile.h*
24702 conf
24703@@ -106,16 +119,19 @@ fore200e_mkfirm
24704 fore200e_pca_fw.c*
24705 gconf
24706 gen-devlist
24707+gen-kdb_cmds.c
24708 gen_crc32table
24709 gen_init_cpio
24710 generated
24711 genheaders
24712 genksyms
24713 *_gray256.c
24714+hash
24715 ihex2fw
24716 ikconfig.h*
24717 inat-tables.c
24718 initramfs_data.cpio
24719+initramfs_data.cpio.bz2
24720 initramfs_data.cpio.gz
24721 initramfs_list
24722 int16.c
24723@@ -125,7 +141,6 @@ int32.c
24724 int4.c
24725 int8.c
24726 kallsyms
24727-kconfig
24728 keywords.c
24729 ksym.c*
24730 ksym.h*
24731@@ -149,7 +164,9 @@ mkboot
24732 mkbugboot
24733 mkcpustr
24734 mkdep
24735+mkpiggy
24736 mkprep
24737+mkregtable
24738 mktables
24739 mktree
24740 modpost
24741@@ -165,6 +182,7 @@ parse.h
24742 patches*
24743 pca200e.bin
24744 pca200e_ecd.bin2
24745+perf-archive
24746 piggy.gz
24747 piggyback
24748 piggy.S
24749@@ -180,7 +198,9 @@ r600_reg_safe.h
24750 raid6altivec*.c
24751 raid6int*.c
24752 raid6tables.c
24753+regdb.c
24754 relocs
24755+rlim_names.h
24756 rn50_reg_safe.h
24757 rs600_reg_safe.h
24758 rv515_reg_safe.h
24759@@ -189,6 +209,7 @@ setup
24760 setup.bin
24761 setup.elf
24762 sImage
24763+slabinfo
24764 sm_tbl*
24765 split-include
24766 syscalltab.h
24767@@ -213,13 +234,17 @@ version.h*
24768 vmlinux
24769 vmlinux-*
24770 vmlinux.aout
24771+vmlinux.bin.all
24772+vmlinux.bin.bz2
24773 vmlinux.lds
24774+vmlinux.relocs
24775 voffset.h
24776 vsyscall.lds
24777 vsyscall_32.lds
24778 wanxlfw.inc
24779 uImage
24780 unifdef
24781+utsrelease.h
24782 wakeup.bin
24783 wakeup.elf
24784 wakeup.lds
24785diff -urNp linux-2.6.39.2/Documentation/filesystems/configfs/configfs_example_macros.c linux-2.6.39.2/Documentation/filesystems/configfs/configfs_example_macros.c
24786--- linux-2.6.39.2/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-19 00:06:34.000000000 -0400
24787+++ linux-2.6.39.2/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-22 19:36:30.000000000 -0400
24788@@ -368,7 +368,7 @@ static struct configfs_item_operations g
24789 * Note that, since no extra work is required on ->drop_item(),
24790 * no ->drop_item() is provided.
24791 */
24792-static struct configfs_group_operations group_children_group_ops = {
24793+static const struct configfs_group_operations group_children_group_ops = {
24794 .make_group = group_children_make_group,
24795 };
24796
24797diff -urNp linux-2.6.39.2/Documentation/filesystems/sysfs.txt linux-2.6.39.2/Documentation/filesystems/sysfs.txt
24798--- linux-2.6.39.2/Documentation/filesystems/sysfs.txt 2011-05-19 00:06:34.000000000 -0400
24799+++ linux-2.6.39.2/Documentation/filesystems/sysfs.txt 2011-05-22 19:36:30.000000000 -0400
24800@@ -125,8 +125,8 @@ set of sysfs operations for forwarding r
24801 show and store methods of the attribute owners.
24802
24803 struct sysfs_ops {
24804- ssize_t (*show)(struct kobject *, struct attribute *, char *);
24805- ssize_t (*store)(struct kobject *, struct attribute *, const char *, size_t);
24806+ ssize_t (* const show)(struct kobject *, struct attribute *, char *);
24807+ ssize_t (* const store)(struct kobject *, struct attribute *, const char *, size_t);
24808 };
24809
24810 [ Subsystems should have already defined a struct kobj_type as a
24811diff -urNp linux-2.6.39.2/Documentation/kernel-parameters.txt linux-2.6.39.2/Documentation/kernel-parameters.txt
24812--- linux-2.6.39.2/Documentation/kernel-parameters.txt 2011-06-25 12:55:22.000000000 -0400
24813+++ linux-2.6.39.2/Documentation/kernel-parameters.txt 2011-06-25 13:00:25.000000000 -0400
24814@@ -1879,6 +1879,13 @@ bytes respectively. Such letter suffixes
24815 the specified number of seconds. This is to be used if
24816 your oopses keep scrolling off the screen.
24817
24818+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
24819+ virtualization environments that don't cope well with the
24820+ expand down segment used by UDEREF on X86-32 or the frequent
24821+ page table updates on X86-64.
24822+
24823+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
24824+
24825 pcbit= [HW,ISDN]
24826
24827 pcd. [PARIDE]
24828diff -urNp linux-2.6.39.2/drivers/acpi/acpi_ipmi.c linux-2.6.39.2/drivers/acpi/acpi_ipmi.c
24829--- linux-2.6.39.2/drivers/acpi/acpi_ipmi.c 2011-05-19 00:06:34.000000000 -0400
24830+++ linux-2.6.39.2/drivers/acpi/acpi_ipmi.c 2011-05-22 19:36:30.000000000 -0400
24831@@ -70,7 +70,7 @@ struct acpi_ipmi_device {
24832 struct ipmi_driver_data {
24833 struct list_head ipmi_devices;
24834 struct ipmi_smi_watcher bmc_events;
24835- struct ipmi_user_hndl ipmi_hndlrs;
24836+ const struct ipmi_user_hndl ipmi_hndlrs;
24837 struct mutex ipmi_lock;
24838 };
24839
24840diff -urNp linux-2.6.39.2/drivers/acpi/apei/cper.c linux-2.6.39.2/drivers/acpi/apei/cper.c
24841--- linux-2.6.39.2/drivers/acpi/apei/cper.c 2011-05-19 00:06:34.000000000 -0400
24842+++ linux-2.6.39.2/drivers/acpi/apei/cper.c 2011-05-22 19:36:30.000000000 -0400
24843@@ -38,12 +38,12 @@
24844 */
24845 u64 cper_next_record_id(void)
24846 {
24847- static atomic64_t seq;
24848+ static atomic64_unchecked_t seq;
24849
24850- if (!atomic64_read(&seq))
24851- atomic64_set(&seq, ((u64)get_seconds()) << 32);
24852+ if (!atomic64_read_unchecked(&seq))
24853+ atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24854
24855- return atomic64_inc_return(&seq);
24856+ return atomic64_inc_return_unchecked(&seq);
24857 }
24858 EXPORT_SYMBOL_GPL(cper_next_record_id);
24859
24860diff -urNp linux-2.6.39.2/drivers/acpi/battery.c linux-2.6.39.2/drivers/acpi/battery.c
24861--- linux-2.6.39.2/drivers/acpi/battery.c 2011-05-19 00:06:34.000000000 -0400
24862+++ linux-2.6.39.2/drivers/acpi/battery.c 2011-05-22 19:36:30.000000000 -0400
24863@@ -864,7 +864,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
24864 }
24865
24866 static struct battery_file {
24867- struct file_operations ops;
24868+ const struct file_operations ops;
24869 mode_t mode;
24870 const char *name;
24871 } acpi_battery_file[] = {
24872diff -urNp linux-2.6.39.2/drivers/acpi/dock.c linux-2.6.39.2/drivers/acpi/dock.c
24873--- linux-2.6.39.2/drivers/acpi/dock.c 2011-05-19 00:06:34.000000000 -0400
24874+++ linux-2.6.39.2/drivers/acpi/dock.c 2011-05-22 19:36:30.000000000 -0400
24875@@ -77,7 +77,7 @@ struct dock_dependent_device {
24876 struct list_head list;
24877 struct list_head hotplug_list;
24878 acpi_handle handle;
24879- struct acpi_dock_ops *ops;
24880+ const struct acpi_dock_ops *ops;
24881 void *context;
24882 };
24883
24884@@ -589,7 +589,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
24885 * the dock driver after _DCK is executed.
24886 */
24887 int
24888-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
24889+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
24890 void *context)
24891 {
24892 struct dock_dependent_device *dd;
24893diff -urNp linux-2.6.39.2/drivers/acpi/ec_sys.c linux-2.6.39.2/drivers/acpi/ec_sys.c
24894--- linux-2.6.39.2/drivers/acpi/ec_sys.c 2011-05-19 00:06:34.000000000 -0400
24895+++ linux-2.6.39.2/drivers/acpi/ec_sys.c 2011-05-22 19:36:30.000000000 -0400
24896@@ -92,7 +92,7 @@ static ssize_t acpi_ec_write_io(struct f
24897 return count;
24898 }
24899
24900-static struct file_operations acpi_ec_io_ops = {
24901+static const struct file_operations acpi_ec_io_ops = {
24902 .owner = THIS_MODULE,
24903 .open = acpi_ec_open_io,
24904 .read = acpi_ec_read_io,
24905diff -urNp linux-2.6.39.2/drivers/acpi/fan.c linux-2.6.39.2/drivers/acpi/fan.c
24906--- linux-2.6.39.2/drivers/acpi/fan.c 2011-05-19 00:06:34.000000000 -0400
24907+++ linux-2.6.39.2/drivers/acpi/fan.c 2011-05-22 19:36:30.000000000 -0400
24908@@ -110,7 +110,7 @@ fan_set_cur_state(struct thermal_cooling
24909 return result;
24910 }
24911
24912-static struct thermal_cooling_device_ops fan_cooling_ops = {
24913+static const struct thermal_cooling_device_ops fan_cooling_ops = {
24914 .get_max_state = fan_get_max_state,
24915 .get_cur_state = fan_get_cur_state,
24916 .set_cur_state = fan_set_cur_state,
24917diff -urNp linux-2.6.39.2/drivers/acpi/power_meter.c linux-2.6.39.2/drivers/acpi/power_meter.c
24918--- linux-2.6.39.2/drivers/acpi/power_meter.c 2011-05-19 00:06:34.000000000 -0400
24919+++ linux-2.6.39.2/drivers/acpi/power_meter.c 2011-05-22 19:36:30.000000000 -0400
24920@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
24921 return res;
24922
24923 temp /= 1000;
24924- if (temp < 0)
24925- return -EINVAL;
24926
24927 mutex_lock(&resource->lock);
24928 resource->trip[attr->index - 7] = temp;
24929diff -urNp linux-2.6.39.2/drivers/acpi/proc.c linux-2.6.39.2/drivers/acpi/proc.c
24930--- linux-2.6.39.2/drivers/acpi/proc.c 2011-05-19 00:06:34.000000000 -0400
24931+++ linux-2.6.39.2/drivers/acpi/proc.c 2011-05-22 19:36:30.000000000 -0400
24932@@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
24933 size_t count, loff_t * ppos)
24934 {
24935 struct list_head *node, *next;
24936- char strbuf[5];
24937- char str[5] = "";
24938- unsigned int len = count;
24939-
24940- if (len > 4)
24941- len = 4;
24942- if (len < 0)
24943- return -EFAULT;
24944+ char strbuf[5] = {0};
24945
24946- if (copy_from_user(strbuf, buffer, len))
24947+ if (count > 4)
24948+ count = 4;
24949+ if (copy_from_user(strbuf, buffer, count))
24950 return -EFAULT;
24951- strbuf[len] = '\0';
24952- sscanf(strbuf, "%s", str);
24953+ strbuf[count] = '\0';
24954
24955 mutex_lock(&acpi_device_lock);
24956 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
24957@@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f
24958 if (!dev->wakeup.flags.valid)
24959 continue;
24960
24961- if (!strncmp(dev->pnp.bus_id, str, 4)) {
24962+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
24963 if (device_can_wakeup(&dev->dev)) {
24964 bool enable = !device_may_wakeup(&dev->dev);
24965 device_set_wakeup_enable(&dev->dev, enable);
24966diff -urNp linux-2.6.39.2/drivers/acpi/processor_driver.c linux-2.6.39.2/drivers/acpi/processor_driver.c
24967--- linux-2.6.39.2/drivers/acpi/processor_driver.c 2011-05-19 00:06:34.000000000 -0400
24968+++ linux-2.6.39.2/drivers/acpi/processor_driver.c 2011-05-22 19:36:30.000000000 -0400
24969@@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
24970 return 0;
24971 #endif
24972
24973- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
24974+ BUG_ON(pr->id >= nr_cpu_ids);
24975
24976 /*
24977 * Buggy BIOS check
24978diff -urNp linux-2.6.39.2/drivers/acpi/processor_idle.c linux-2.6.39.2/drivers/acpi/processor_idle.c
24979--- linux-2.6.39.2/drivers/acpi/processor_idle.c 2011-05-19 00:06:34.000000000 -0400
24980+++ linux-2.6.39.2/drivers/acpi/processor_idle.c 2011-05-22 19:36:30.000000000 -0400
24981@@ -121,7 +121,7 @@ static struct dmi_system_id __cpuinitdat
24982 DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
24983 DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
24984 (void *)1},
24985- {},
24986+ {}
24987 };
24988
24989
24990diff -urNp linux-2.6.39.2/drivers/acpi/processor_thermal.c linux-2.6.39.2/drivers/acpi/processor_thermal.c
24991--- linux-2.6.39.2/drivers/acpi/processor_thermal.c 2011-05-19 00:06:34.000000000 -0400
24992+++ linux-2.6.39.2/drivers/acpi/processor_thermal.c 2011-05-22 19:36:30.000000000 -0400
24993@@ -244,7 +244,7 @@ processor_set_cur_state(struct thermal_c
24994 return result;
24995 }
24996
24997-struct thermal_cooling_device_ops processor_cooling_ops = {
24998+const struct thermal_cooling_device_ops processor_cooling_ops = {
24999 .get_max_state = processor_get_max_state,
25000 .get_cur_state = processor_get_cur_state,
25001 .set_cur_state = processor_set_cur_state,
25002diff -urNp linux-2.6.39.2/drivers/acpi/sysfs.c linux-2.6.39.2/drivers/acpi/sysfs.c
25003--- linux-2.6.39.2/drivers/acpi/sysfs.c 2011-05-19 00:06:34.000000000 -0400
25004+++ linux-2.6.39.2/drivers/acpi/sysfs.c 2011-05-22 19:36:30.000000000 -0400
25005@@ -149,12 +149,12 @@ static int param_get_debug_level(char *b
25006 return result;
25007 }
25008
25009-static struct kernel_param_ops param_ops_debug_layer = {
25010+static const struct kernel_param_ops param_ops_debug_layer = {
25011 .set = param_set_uint,
25012 .get = param_get_debug_layer,
25013 };
25014
25015-static struct kernel_param_ops param_ops_debug_level = {
25016+static const struct kernel_param_ops param_ops_debug_level = {
25017 .set = param_set_uint,
25018 .get = param_get_debug_level,
25019 };
25020diff -urNp linux-2.6.39.2/drivers/acpi/thermal.c linux-2.6.39.2/drivers/acpi/thermal.c
25021--- linux-2.6.39.2/drivers/acpi/thermal.c 2011-05-19 00:06:34.000000000 -0400
25022+++ linux-2.6.39.2/drivers/acpi/thermal.c 2011-05-22 19:36:30.000000000 -0400
25023@@ -812,7 +812,7 @@ acpi_thermal_unbind_cooling_device(struc
25024 thermal_zone_unbind_cooling_device);
25025 }
25026
25027-static struct thermal_zone_device_ops acpi_thermal_zone_ops = {
25028+static const struct thermal_zone_device_ops acpi_thermal_zone_ops = {
25029 .bind = acpi_thermal_bind_cooling_device,
25030 .unbind = acpi_thermal_unbind_cooling_device,
25031 .get_temp = thermal_get_temp,
25032diff -urNp linux-2.6.39.2/drivers/acpi/video.c linux-2.6.39.2/drivers/acpi/video.c
25033--- linux-2.6.39.2/drivers/acpi/video.c 2011-05-19 00:06:34.000000000 -0400
25034+++ linux-2.6.39.2/drivers/acpi/video.c 2011-05-22 19:36:30.000000000 -0400
25035@@ -308,7 +308,7 @@ video_set_cur_state(struct thermal_cooli
25036 return acpi_video_device_lcd_set_level(video, level);
25037 }
25038
25039-static struct thermal_cooling_device_ops video_cooling_ops = {
25040+static const struct thermal_cooling_device_ops video_cooling_ops = {
25041 .get_max_state = video_get_max_state,
25042 .get_cur_state = video_get_cur_state,
25043 .set_cur_state = video_set_cur_state,
25044diff -urNp linux-2.6.39.2/drivers/ata/acard-ahci.c linux-2.6.39.2/drivers/ata/acard-ahci.c
25045--- linux-2.6.39.2/drivers/ata/acard-ahci.c 2011-05-19 00:06:34.000000000 -0400
25046+++ linux-2.6.39.2/drivers/ata/acard-ahci.c 2011-05-22 19:36:30.000000000 -0400
25047@@ -87,7 +87,7 @@ static struct scsi_host_template acard_a
25048 AHCI_SHT("acard-ahci"),
25049 };
25050
25051-static struct ata_port_operations acard_ops = {
25052+static const struct ata_port_operations acard_ops = {
25053 .inherits = &ahci_ops,
25054 .qc_prep = acard_ahci_qc_prep,
25055 .qc_fill_rtf = acard_ahci_qc_fill_rtf,
25056diff -urNp linux-2.6.39.2/drivers/ata/ahci.c linux-2.6.39.2/drivers/ata/ahci.c
25057--- linux-2.6.39.2/drivers/ata/ahci.c 2011-05-19 00:06:34.000000000 -0400
25058+++ linux-2.6.39.2/drivers/ata/ahci.c 2011-05-22 19:36:30.000000000 -0400
25059@@ -94,17 +94,17 @@ static struct scsi_host_template ahci_sh
25060 AHCI_SHT("ahci"),
25061 };
25062
25063-static struct ata_port_operations ahci_vt8251_ops = {
25064+static const struct ata_port_operations ahci_vt8251_ops = {
25065 .inherits = &ahci_ops,
25066 .hardreset = ahci_vt8251_hardreset,
25067 };
25068
25069-static struct ata_port_operations ahci_p5wdh_ops = {
25070+static const struct ata_port_operations ahci_p5wdh_ops = {
25071 .inherits = &ahci_ops,
25072 .hardreset = ahci_p5wdh_hardreset,
25073 };
25074
25075-static struct ata_port_operations ahci_sb600_ops = {
25076+static const struct ata_port_operations ahci_sb600_ops = {
25077 .inherits = &ahci_ops,
25078 .softreset = ahci_sb600_softreset,
25079 .pmp_softreset = ahci_sb600_softreset,
25080diff -urNp linux-2.6.39.2/drivers/ata/ahci.h linux-2.6.39.2/drivers/ata/ahci.h
25081--- linux-2.6.39.2/drivers/ata/ahci.h 2011-05-19 00:06:34.000000000 -0400
25082+++ linux-2.6.39.2/drivers/ata/ahci.h 2011-05-22 19:36:30.000000000 -0400
25083@@ -311,7 +311,7 @@ extern struct device_attribute *ahci_sde
25084 .shost_attrs = ahci_shost_attrs, \
25085 .sdev_attrs = ahci_sdev_attrs
25086
25087-extern struct ata_port_operations ahci_ops;
25088+extern const struct ata_port_operations ahci_ops;
25089
25090 void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
25091 u32 opts);
25092diff -urNp linux-2.6.39.2/drivers/ata/ata_generic.c linux-2.6.39.2/drivers/ata/ata_generic.c
25093--- linux-2.6.39.2/drivers/ata/ata_generic.c 2011-05-19 00:06:34.000000000 -0400
25094+++ linux-2.6.39.2/drivers/ata/ata_generic.c 2011-05-22 19:36:30.000000000 -0400
25095@@ -101,7 +101,7 @@ static struct scsi_host_template generic
25096 ATA_BMDMA_SHT(DRV_NAME),
25097 };
25098
25099-static struct ata_port_operations generic_port_ops = {
25100+static const struct ata_port_operations generic_port_ops = {
25101 .inherits = &ata_bmdma_port_ops,
25102 .cable_detect = ata_cable_unknown,
25103 .set_mode = generic_set_mode,
25104diff -urNp linux-2.6.39.2/drivers/ata/ata_piix.c linux-2.6.39.2/drivers/ata/ata_piix.c
25105--- linux-2.6.39.2/drivers/ata/ata_piix.c 2011-05-19 00:06:34.000000000 -0400
25106+++ linux-2.6.39.2/drivers/ata/ata_piix.c 2011-05-22 19:36:30.000000000 -0400
25107@@ -335,12 +335,12 @@ static struct scsi_host_template piix_sh
25108 ATA_BMDMA_SHT(DRV_NAME),
25109 };
25110
25111-static struct ata_port_operations piix_sata_ops = {
25112+static const struct ata_port_operations piix_sata_ops = {
25113 .inherits = &ata_bmdma32_port_ops,
25114 .sff_irq_check = piix_irq_check,
25115 };
25116
25117-static struct ata_port_operations piix_pata_ops = {
25118+static const struct ata_port_operations piix_pata_ops = {
25119 .inherits = &piix_sata_ops,
25120 .cable_detect = ata_cable_40wire,
25121 .set_piomode = piix_set_piomode,
25122@@ -348,12 +348,12 @@ static struct ata_port_operations piix_p
25123 .prereset = piix_pata_prereset,
25124 };
25125
25126-static struct ata_port_operations piix_vmw_ops = {
25127+static const struct ata_port_operations piix_vmw_ops = {
25128 .inherits = &piix_pata_ops,
25129 .bmdma_status = piix_vmw_bmdma_status,
25130 };
25131
25132-static struct ata_port_operations ich_pata_ops = {
25133+static const struct ata_port_operations ich_pata_ops = {
25134 .inherits = &piix_pata_ops,
25135 .cable_detect = ich_pata_cable_detect,
25136 .set_dmamode = ich_set_dmamode,
25137@@ -369,7 +369,7 @@ static struct scsi_host_template piix_si
25138 .shost_attrs = piix_sidpr_shost_attrs,
25139 };
25140
25141-static struct ata_port_operations piix_sidpr_sata_ops = {
25142+static const struct ata_port_operations piix_sidpr_sata_ops = {
25143 .inherits = &piix_sata_ops,
25144 .hardreset = sata_std_hardreset,
25145 .scr_read = piix_sidpr_scr_read,
25146diff -urNp linux-2.6.39.2/drivers/ata/libahci.c linux-2.6.39.2/drivers/ata/libahci.c
25147--- linux-2.6.39.2/drivers/ata/libahci.c 2011-05-19 00:06:34.000000000 -0400
25148+++ linux-2.6.39.2/drivers/ata/libahci.c 2011-05-22 19:36:30.000000000 -0400
25149@@ -141,7 +141,7 @@ struct device_attribute *ahci_sdev_attrs
25150 };
25151 EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
25152
25153-struct ata_port_operations ahci_ops = {
25154+const struct ata_port_operations ahci_ops = {
25155 .inherits = &sata_pmp_port_ops,
25156
25157 .qc_defer = ahci_pmp_qc_defer,
25158diff -urNp linux-2.6.39.2/drivers/ata/libata-acpi.c linux-2.6.39.2/drivers/ata/libata-acpi.c
25159--- linux-2.6.39.2/drivers/ata/libata-acpi.c 2011-05-19 00:06:34.000000000 -0400
25160+++ linux-2.6.39.2/drivers/ata/libata-acpi.c 2011-05-22 19:36:30.000000000 -0400
25161@@ -218,12 +218,12 @@ static void ata_acpi_dev_uevent(acpi_han
25162 ata_acpi_uevent(dev->link->ap, dev, event);
25163 }
25164
25165-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
25166+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
25167 .handler = ata_acpi_dev_notify_dock,
25168 .uevent = ata_acpi_dev_uevent,
25169 };
25170
25171-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
25172+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
25173 .handler = ata_acpi_ap_notify_dock,
25174 .uevent = ata_acpi_ap_uevent,
25175 };
25176diff -urNp linux-2.6.39.2/drivers/ata/libata-core.c linux-2.6.39.2/drivers/ata/libata-core.c
25177--- linux-2.6.39.2/drivers/ata/libata-core.c 2011-05-19 00:06:34.000000000 -0400
25178+++ linux-2.6.39.2/drivers/ata/libata-core.c 2011-05-22 19:36:30.000000000 -0400
25179@@ -4747,7 +4747,7 @@ void ata_qc_free(struct ata_queued_cmd *
25180 struct ata_port *ap;
25181 unsigned int tag;
25182
25183- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25184+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25185 ap = qc->ap;
25186
25187 qc->flags = 0;
25188@@ -4763,7 +4763,7 @@ void __ata_qc_complete(struct ata_queued
25189 struct ata_port *ap;
25190 struct ata_link *link;
25191
25192- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25193+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25194 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
25195 ap = qc->ap;
25196 link = qc->dev->link;
25197@@ -5756,7 +5756,7 @@ static void ata_host_stop(struct device
25198 * LOCKING:
25199 * None.
25200 */
25201-static void ata_finalize_port_ops(struct ata_port_operations *ops)
25202+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
25203 {
25204 static DEFINE_SPINLOCK(lock);
25205 const struct ata_port_operations *cur;
25206@@ -5768,6 +5768,7 @@ static void ata_finalize_port_ops(struct
25207 return;
25208
25209 spin_lock(&lock);
25210+ pax_open_kernel();
25211
25212 for (cur = ops->inherits; cur; cur = cur->inherits) {
25213 void **inherit = (void **)cur;
25214@@ -5781,8 +5782,9 @@ static void ata_finalize_port_ops(struct
25215 if (IS_ERR(*pp))
25216 *pp = NULL;
25217
25218- ops->inherits = NULL;
25219+ ((struct ata_port_operations *)ops)->inherits = NULL;
25220
25221+ pax_close_kernel();
25222 spin_unlock(&lock);
25223 }
25224
25225@@ -5879,7 +5881,7 @@ int ata_host_start(struct ata_host *host
25226 */
25227 /* KILLME - the only user left is ipr */
25228 void ata_host_init(struct ata_host *host, struct device *dev,
25229- unsigned long flags, struct ata_port_operations *ops)
25230+ unsigned long flags, const struct ata_port_operations *ops)
25231 {
25232 spin_lock_init(&host->lock);
25233 mutex_init(&host->eh_mutex);
25234@@ -6583,7 +6585,7 @@ static void ata_dummy_error_handler(stru
25235 /* truly dummy */
25236 }
25237
25238-struct ata_port_operations ata_dummy_port_ops = {
25239+const struct ata_port_operations ata_dummy_port_ops = {
25240 .qc_prep = ata_noop_qc_prep,
25241 .qc_issue = ata_dummy_qc_issue,
25242 .error_handler = ata_dummy_error_handler,
25243diff -urNp linux-2.6.39.2/drivers/ata/libata-eh.c linux-2.6.39.2/drivers/ata/libata-eh.c
25244--- linux-2.6.39.2/drivers/ata/libata-eh.c 2011-05-19 00:06:34.000000000 -0400
25245+++ linux-2.6.39.2/drivers/ata/libata-eh.c 2011-05-22 19:36:30.000000000 -0400
25246@@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap)
25247 {
25248 struct ata_link *link;
25249
25250+ pax_track_stack();
25251+
25252 ata_for_each_link(link, ap, HOST_FIRST)
25253 ata_eh_link_report(link);
25254 }
25255@@ -3922,7 +3924,7 @@ void ata_do_eh(struct ata_port *ap, ata_
25256 */
25257 void ata_std_error_handler(struct ata_port *ap)
25258 {
25259- struct ata_port_operations *ops = ap->ops;
25260+ const struct ata_port_operations *ops = ap->ops;
25261 ata_reset_fn_t hardreset = ops->hardreset;
25262
25263 /* ignore built-in hardreset if SCR access is not available */
25264diff -urNp linux-2.6.39.2/drivers/ata/libata-pmp.c linux-2.6.39.2/drivers/ata/libata-pmp.c
25265--- linux-2.6.39.2/drivers/ata/libata-pmp.c 2011-05-19 00:06:34.000000000 -0400
25266+++ linux-2.6.39.2/drivers/ata/libata-pmp.c 2011-05-22 19:36:30.000000000 -0400
25267@@ -912,7 +912,7 @@ static int sata_pmp_handle_link_fail(str
25268 */
25269 static int sata_pmp_eh_recover(struct ata_port *ap)
25270 {
25271- struct ata_port_operations *ops = ap->ops;
25272+ const struct ata_port_operations *ops = ap->ops;
25273 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
25274 struct ata_link *pmp_link = &ap->link;
25275 struct ata_device *pmp_dev = pmp_link->device;
25276diff -urNp linux-2.6.39.2/drivers/ata/pata_acpi.c linux-2.6.39.2/drivers/ata/pata_acpi.c
25277--- linux-2.6.39.2/drivers/ata/pata_acpi.c 2011-05-19 00:06:34.000000000 -0400
25278+++ linux-2.6.39.2/drivers/ata/pata_acpi.c 2011-05-22 19:36:30.000000000 -0400
25279@@ -216,7 +216,7 @@ static struct scsi_host_template pacpi_s
25280 ATA_BMDMA_SHT(DRV_NAME),
25281 };
25282
25283-static struct ata_port_operations pacpi_ops = {
25284+static const struct ata_port_operations pacpi_ops = {
25285 .inherits = &ata_bmdma_port_ops,
25286 .qc_issue = pacpi_qc_issue,
25287 .cable_detect = pacpi_cable_detect,
25288diff -urNp linux-2.6.39.2/drivers/ata/pata_ali.c linux-2.6.39.2/drivers/ata/pata_ali.c
25289--- linux-2.6.39.2/drivers/ata/pata_ali.c 2011-05-19 00:06:34.000000000 -0400
25290+++ linux-2.6.39.2/drivers/ata/pata_ali.c 2011-05-22 19:36:30.000000000 -0400
25291@@ -363,7 +363,7 @@ static struct scsi_host_template ali_sht
25292 * Port operations for PIO only ALi
25293 */
25294
25295-static struct ata_port_operations ali_early_port_ops = {
25296+static const struct ata_port_operations ali_early_port_ops = {
25297 .inherits = &ata_sff_port_ops,
25298 .cable_detect = ata_cable_40wire,
25299 .set_piomode = ali_set_piomode,
25300@@ -380,7 +380,7 @@ static const struct ata_port_operations
25301 * Port operations for DMA capable ALi without cable
25302 * detect
25303 */
25304-static struct ata_port_operations ali_20_port_ops = {
25305+static const struct ata_port_operations ali_20_port_ops = {
25306 .inherits = &ali_dma_base_ops,
25307 .cable_detect = ata_cable_40wire,
25308 .mode_filter = ali_20_filter,
25309@@ -391,7 +391,7 @@ static struct ata_port_operations ali_20
25310 /*
25311 * Port operations for DMA capable ALi with cable detect
25312 */
25313-static struct ata_port_operations ali_c2_port_ops = {
25314+static const struct ata_port_operations ali_c2_port_ops = {
25315 .inherits = &ali_dma_base_ops,
25316 .check_atapi_dma = ali_check_atapi_dma,
25317 .cable_detect = ali_c2_cable_detect,
25318@@ -402,7 +402,7 @@ static struct ata_port_operations ali_c2
25319 /*
25320 * Port operations for DMA capable ALi with cable detect
25321 */
25322-static struct ata_port_operations ali_c4_port_ops = {
25323+static const struct ata_port_operations ali_c4_port_ops = {
25324 .inherits = &ali_dma_base_ops,
25325 .check_atapi_dma = ali_check_atapi_dma,
25326 .cable_detect = ali_c2_cable_detect,
25327@@ -412,7 +412,7 @@ static struct ata_port_operations ali_c4
25328 /*
25329 * Port operations for DMA capable ALi with cable detect and LBA48
25330 */
25331-static struct ata_port_operations ali_c5_port_ops = {
25332+static const struct ata_port_operations ali_c5_port_ops = {
25333 .inherits = &ali_dma_base_ops,
25334 .check_atapi_dma = ali_check_atapi_dma,
25335 .dev_config = ali_warn_atapi_dma,
25336diff -urNp linux-2.6.39.2/drivers/ata/pata_amd.c linux-2.6.39.2/drivers/ata/pata_amd.c
25337--- linux-2.6.39.2/drivers/ata/pata_amd.c 2011-05-19 00:06:34.000000000 -0400
25338+++ linux-2.6.39.2/drivers/ata/pata_amd.c 2011-05-22 19:36:31.000000000 -0400
25339@@ -397,28 +397,28 @@ static const struct ata_port_operations
25340 .prereset = amd_pre_reset,
25341 };
25342
25343-static struct ata_port_operations amd33_port_ops = {
25344+static const struct ata_port_operations amd33_port_ops = {
25345 .inherits = &amd_base_port_ops,
25346 .cable_detect = ata_cable_40wire,
25347 .set_piomode = amd33_set_piomode,
25348 .set_dmamode = amd33_set_dmamode,
25349 };
25350
25351-static struct ata_port_operations amd66_port_ops = {
25352+static const struct ata_port_operations amd66_port_ops = {
25353 .inherits = &amd_base_port_ops,
25354 .cable_detect = ata_cable_unknown,
25355 .set_piomode = amd66_set_piomode,
25356 .set_dmamode = amd66_set_dmamode,
25357 };
25358
25359-static struct ata_port_operations amd100_port_ops = {
25360+static const struct ata_port_operations amd100_port_ops = {
25361 .inherits = &amd_base_port_ops,
25362 .cable_detect = ata_cable_unknown,
25363 .set_piomode = amd100_set_piomode,
25364 .set_dmamode = amd100_set_dmamode,
25365 };
25366
25367-static struct ata_port_operations amd133_port_ops = {
25368+static const struct ata_port_operations amd133_port_ops = {
25369 .inherits = &amd_base_port_ops,
25370 .cable_detect = amd_cable_detect,
25371 .set_piomode = amd133_set_piomode,
25372@@ -433,13 +433,13 @@ static const struct ata_port_operations
25373 .host_stop = nv_host_stop,
25374 };
25375
25376-static struct ata_port_operations nv100_port_ops = {
25377+static const struct ata_port_operations nv100_port_ops = {
25378 .inherits = &nv_base_port_ops,
25379 .set_piomode = nv100_set_piomode,
25380 .set_dmamode = nv100_set_dmamode,
25381 };
25382
25383-static struct ata_port_operations nv133_port_ops = {
25384+static const struct ata_port_operations nv133_port_ops = {
25385 .inherits = &nv_base_port_ops,
25386 .set_piomode = nv133_set_piomode,
25387 .set_dmamode = nv133_set_dmamode,
25388diff -urNp linux-2.6.39.2/drivers/ata/pata_arasan_cf.c linux-2.6.39.2/drivers/ata/pata_arasan_cf.c
25389--- linux-2.6.39.2/drivers/ata/pata_arasan_cf.c 2011-05-19 00:06:34.000000000 -0400
25390+++ linux-2.6.39.2/drivers/ata/pata_arasan_cf.c 2011-05-22 19:36:31.000000000 -0400
25391@@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str
25392 /* Handle platform specific quirks */
25393 if (pdata->quirk) {
25394 if (pdata->quirk & CF_BROKEN_PIO) {
25395- ap->ops->set_piomode = NULL;
25396+ pax_open_kernel();
25397+ *(void**)&ap->ops->set_piomode = NULL;
25398+ pax_close_kernel();
25399 ap->pio_mask = 0;
25400 }
25401 if (pdata->quirk & CF_BROKEN_MWDMA)
25402diff -urNp linux-2.6.39.2/drivers/ata/pata_artop.c linux-2.6.39.2/drivers/ata/pata_artop.c
25403--- linux-2.6.39.2/drivers/ata/pata_artop.c 2011-05-19 00:06:34.000000000 -0400
25404+++ linux-2.6.39.2/drivers/ata/pata_artop.c 2011-05-22 19:36:31.000000000 -0400
25405@@ -312,7 +312,7 @@ static struct scsi_host_template artop_s
25406 ATA_BMDMA_SHT(DRV_NAME),
25407 };
25408
25409-static struct ata_port_operations artop6210_ops = {
25410+static const struct ata_port_operations artop6210_ops = {
25411 .inherits = &ata_bmdma_port_ops,
25412 .cable_detect = ata_cable_40wire,
25413 .set_piomode = artop6210_set_piomode,
25414@@ -321,7 +321,7 @@ static struct ata_port_operations artop6
25415 .qc_defer = artop6210_qc_defer,
25416 };
25417
25418-static struct ata_port_operations artop6260_ops = {
25419+static const struct ata_port_operations artop6260_ops = {
25420 .inherits = &ata_bmdma_port_ops,
25421 .cable_detect = artop6260_cable_detect,
25422 .set_piomode = artop6260_set_piomode,
25423diff -urNp linux-2.6.39.2/drivers/ata/pata_at32.c linux-2.6.39.2/drivers/ata/pata_at32.c
25424--- linux-2.6.39.2/drivers/ata/pata_at32.c 2011-05-19 00:06:34.000000000 -0400
25425+++ linux-2.6.39.2/drivers/ata/pata_at32.c 2011-05-22 19:36:31.000000000 -0400
25426@@ -173,7 +173,7 @@ static struct scsi_host_template at32_sh
25427 ATA_PIO_SHT(DRV_NAME),
25428 };
25429
25430-static struct ata_port_operations at32_port_ops = {
25431+static const struct ata_port_operations at32_port_ops = {
25432 .inherits = &ata_sff_port_ops,
25433 .cable_detect = ata_cable_40wire,
25434 .set_piomode = pata_at32_set_piomode,
25435diff -urNp linux-2.6.39.2/drivers/ata/pata_at91.c linux-2.6.39.2/drivers/ata/pata_at91.c
25436--- linux-2.6.39.2/drivers/ata/pata_at91.c 2011-05-19 00:06:34.000000000 -0400
25437+++ linux-2.6.39.2/drivers/ata/pata_at91.c 2011-05-22 19:36:31.000000000 -0400
25438@@ -212,7 +212,7 @@ static struct scsi_host_template pata_at
25439 ATA_PIO_SHT(DRV_NAME),
25440 };
25441
25442-static struct ata_port_operations pata_at91_port_ops = {
25443+static const struct ata_port_operations pata_at91_port_ops = {
25444 .inherits = &ata_sff_port_ops,
25445
25446 .sff_data_xfer = pata_at91_data_xfer_noirq,
25447diff -urNp linux-2.6.39.2/drivers/ata/pata_atiixp.c linux-2.6.39.2/drivers/ata/pata_atiixp.c
25448--- linux-2.6.39.2/drivers/ata/pata_atiixp.c 2011-05-19 00:06:34.000000000 -0400
25449+++ linux-2.6.39.2/drivers/ata/pata_atiixp.c 2011-05-22 19:36:31.000000000 -0400
25450@@ -214,7 +214,7 @@ static struct scsi_host_template atiixp_
25451 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25452 };
25453
25454-static struct ata_port_operations atiixp_port_ops = {
25455+static const struct ata_port_operations atiixp_port_ops = {
25456 .inherits = &ata_bmdma_port_ops,
25457
25458 .qc_prep = ata_bmdma_dumb_qc_prep,
25459diff -urNp linux-2.6.39.2/drivers/ata/pata_atp867x.c linux-2.6.39.2/drivers/ata/pata_atp867x.c
25460--- linux-2.6.39.2/drivers/ata/pata_atp867x.c 2011-05-19 00:06:34.000000000 -0400
25461+++ linux-2.6.39.2/drivers/ata/pata_atp867x.c 2011-05-22 19:36:31.000000000 -0400
25462@@ -275,7 +275,7 @@ static struct scsi_host_template atp867x
25463 ATA_BMDMA_SHT(DRV_NAME),
25464 };
25465
25466-static struct ata_port_operations atp867x_ops = {
25467+static const struct ata_port_operations atp867x_ops = {
25468 .inherits = &ata_bmdma_port_ops,
25469 .cable_detect = atp867x_cable_detect,
25470 .set_piomode = atp867x_set_piomode,
25471diff -urNp linux-2.6.39.2/drivers/ata/pata_bf54x.c linux-2.6.39.2/drivers/ata/pata_bf54x.c
25472--- linux-2.6.39.2/drivers/ata/pata_bf54x.c 2011-05-19 00:06:34.000000000 -0400
25473+++ linux-2.6.39.2/drivers/ata/pata_bf54x.c 2011-05-22 19:36:31.000000000 -0400
25474@@ -1420,7 +1420,7 @@ static struct scsi_host_template bfin_sh
25475 .dma_boundary = ATA_DMA_BOUNDARY,
25476 };
25477
25478-static struct ata_port_operations bfin_pata_ops = {
25479+static const struct ata_port_operations bfin_pata_ops = {
25480 .inherits = &ata_bmdma_port_ops,
25481
25482 .set_piomode = bfin_set_piomode,
25483diff -urNp linux-2.6.39.2/drivers/ata/pata_cmd640.c linux-2.6.39.2/drivers/ata/pata_cmd640.c
25484--- linux-2.6.39.2/drivers/ata/pata_cmd640.c 2011-05-19 00:06:34.000000000 -0400
25485+++ linux-2.6.39.2/drivers/ata/pata_cmd640.c 2011-05-22 19:36:31.000000000 -0400
25486@@ -176,7 +176,7 @@ static struct scsi_host_template cmd640_
25487 ATA_PIO_SHT(DRV_NAME),
25488 };
25489
25490-static struct ata_port_operations cmd640_port_ops = {
25491+static const struct ata_port_operations cmd640_port_ops = {
25492 .inherits = &ata_sff_port_ops,
25493 /* In theory xfer_noirq is not needed once we kill the prefetcher */
25494 .sff_data_xfer = ata_sff_data_xfer_noirq,
25495diff -urNp linux-2.6.39.2/drivers/ata/pata_cmd64x.c linux-2.6.39.2/drivers/ata/pata_cmd64x.c
25496--- linux-2.6.39.2/drivers/ata/pata_cmd64x.c 2011-06-03 00:04:13.000000000 -0400
25497+++ linux-2.6.39.2/drivers/ata/pata_cmd64x.c 2011-06-03 00:32:05.000000000 -0400
25498@@ -271,18 +271,18 @@ static const struct ata_port_operations
25499 .set_dmamode = cmd64x_set_dmamode,
25500 };
25501
25502-static struct ata_port_operations cmd64x_port_ops = {
25503+static const struct ata_port_operations cmd64x_port_ops = {
25504 .inherits = &cmd64x_base_ops,
25505 .cable_detect = ata_cable_40wire,
25506 };
25507
25508-static struct ata_port_operations cmd646r1_port_ops = {
25509+static const struct ata_port_operations cmd646r1_port_ops = {
25510 .inherits = &cmd64x_base_ops,
25511 .bmdma_stop = cmd646r1_bmdma_stop,
25512 .cable_detect = ata_cable_40wire,
25513 };
25514
25515-static struct ata_port_operations cmd648_port_ops = {
25516+static const struct ata_port_operations cmd648_port_ops = {
25517 .inherits = &cmd64x_base_ops,
25518 .bmdma_stop = cmd648_bmdma_stop,
25519 .cable_detect = cmd648_cable_detect,
25520diff -urNp linux-2.6.39.2/drivers/ata/pata_cs5520.c linux-2.6.39.2/drivers/ata/pata_cs5520.c
25521--- linux-2.6.39.2/drivers/ata/pata_cs5520.c 2011-05-19 00:06:34.000000000 -0400
25522+++ linux-2.6.39.2/drivers/ata/pata_cs5520.c 2011-05-22 19:36:31.000000000 -0400
25523@@ -108,7 +108,7 @@ static struct scsi_host_template cs5520_
25524 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25525 };
25526
25527-static struct ata_port_operations cs5520_port_ops = {
25528+static const struct ata_port_operations cs5520_port_ops = {
25529 .inherits = &ata_bmdma_port_ops,
25530 .qc_prep = ata_bmdma_dumb_qc_prep,
25531 .cable_detect = ata_cable_40wire,
25532diff -urNp linux-2.6.39.2/drivers/ata/pata_cs5530.c linux-2.6.39.2/drivers/ata/pata_cs5530.c
25533--- linux-2.6.39.2/drivers/ata/pata_cs5530.c 2011-05-19 00:06:34.000000000 -0400
25534+++ linux-2.6.39.2/drivers/ata/pata_cs5530.c 2011-05-22 19:36:31.000000000 -0400
25535@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
25536 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25537 };
25538
25539-static struct ata_port_operations cs5530_port_ops = {
25540+static const struct ata_port_operations cs5530_port_ops = {
25541 .inherits = &ata_bmdma_port_ops,
25542
25543 .qc_prep = ata_bmdma_dumb_qc_prep,
25544diff -urNp linux-2.6.39.2/drivers/ata/pata_cs5535.c linux-2.6.39.2/drivers/ata/pata_cs5535.c
25545--- linux-2.6.39.2/drivers/ata/pata_cs5535.c 2011-05-19 00:06:34.000000000 -0400
25546+++ linux-2.6.39.2/drivers/ata/pata_cs5535.c 2011-05-22 19:36:31.000000000 -0400
25547@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
25548 ATA_BMDMA_SHT(DRV_NAME),
25549 };
25550
25551-static struct ata_port_operations cs5535_port_ops = {
25552+static const struct ata_port_operations cs5535_port_ops = {
25553 .inherits = &ata_bmdma_port_ops,
25554 .cable_detect = cs5535_cable_detect,
25555 .set_piomode = cs5535_set_piomode,
25556diff -urNp linux-2.6.39.2/drivers/ata/pata_cs5536.c linux-2.6.39.2/drivers/ata/pata_cs5536.c
25557--- linux-2.6.39.2/drivers/ata/pata_cs5536.c 2011-05-19 00:06:34.000000000 -0400
25558+++ linux-2.6.39.2/drivers/ata/pata_cs5536.c 2011-05-22 19:36:31.000000000 -0400
25559@@ -233,7 +233,7 @@ static struct scsi_host_template cs5536_
25560 ATA_BMDMA_SHT(DRV_NAME),
25561 };
25562
25563-static struct ata_port_operations cs5536_port_ops = {
25564+static const struct ata_port_operations cs5536_port_ops = {
25565 .inherits = &ata_bmdma32_port_ops,
25566 .cable_detect = cs5536_cable_detect,
25567 .set_piomode = cs5536_set_piomode,
25568diff -urNp linux-2.6.39.2/drivers/ata/pata_cypress.c linux-2.6.39.2/drivers/ata/pata_cypress.c
25569--- linux-2.6.39.2/drivers/ata/pata_cypress.c 2011-05-19 00:06:34.000000000 -0400
25570+++ linux-2.6.39.2/drivers/ata/pata_cypress.c 2011-05-22 19:36:31.000000000 -0400
25571@@ -115,7 +115,7 @@ static struct scsi_host_template cy82c69
25572 ATA_BMDMA_SHT(DRV_NAME),
25573 };
25574
25575-static struct ata_port_operations cy82c693_port_ops = {
25576+static const struct ata_port_operations cy82c693_port_ops = {
25577 .inherits = &ata_bmdma_port_ops,
25578 .cable_detect = ata_cable_40wire,
25579 .set_piomode = cy82c693_set_piomode,
25580diff -urNp linux-2.6.39.2/drivers/ata/pata_efar.c linux-2.6.39.2/drivers/ata/pata_efar.c
25581--- linux-2.6.39.2/drivers/ata/pata_efar.c 2011-05-19 00:06:34.000000000 -0400
25582+++ linux-2.6.39.2/drivers/ata/pata_efar.c 2011-05-22 19:36:31.000000000 -0400
25583@@ -238,7 +238,7 @@ static struct scsi_host_template efar_sh
25584 ATA_BMDMA_SHT(DRV_NAME),
25585 };
25586
25587-static struct ata_port_operations efar_ops = {
25588+static const struct ata_port_operations efar_ops = {
25589 .inherits = &ata_bmdma_port_ops,
25590 .cable_detect = efar_cable_detect,
25591 .set_piomode = efar_set_piomode,
25592diff -urNp linux-2.6.39.2/drivers/ata/pata_hpt366.c linux-2.6.39.2/drivers/ata/pata_hpt366.c
25593--- linux-2.6.39.2/drivers/ata/pata_hpt366.c 2011-05-19 00:06:34.000000000 -0400
25594+++ linux-2.6.39.2/drivers/ata/pata_hpt366.c 2011-05-22 19:36:31.000000000 -0400
25595@@ -276,7 +276,7 @@ static struct scsi_host_template hpt36x_
25596 * Configuration for HPT366/68
25597 */
25598
25599-static struct ata_port_operations hpt366_port_ops = {
25600+static const struct ata_port_operations hpt366_port_ops = {
25601 .inherits = &ata_bmdma_port_ops,
25602 .cable_detect = hpt36x_cable_detect,
25603 .mode_filter = hpt366_filter,
25604diff -urNp linux-2.6.39.2/drivers/ata/pata_hpt37x.c linux-2.6.39.2/drivers/ata/pata_hpt37x.c
25605--- linux-2.6.39.2/drivers/ata/pata_hpt37x.c 2011-05-19 00:06:34.000000000 -0400
25606+++ linux-2.6.39.2/drivers/ata/pata_hpt37x.c 2011-05-22 19:36:31.000000000 -0400
25607@@ -589,7 +589,7 @@ static struct scsi_host_template hpt37x_
25608 * Configuration for HPT370
25609 */
25610
25611-static struct ata_port_operations hpt370_port_ops = {
25612+static const struct ata_port_operations hpt370_port_ops = {
25613 .inherits = &ata_bmdma_port_ops,
25614
25615 .bmdma_stop = hpt370_bmdma_stop,
25616@@ -605,7 +605,7 @@ static struct ata_port_operations hpt370
25617 * Configuration for HPT370A. Close to 370 but less filters
25618 */
25619
25620-static struct ata_port_operations hpt370a_port_ops = {
25621+static const struct ata_port_operations hpt370a_port_ops = {
25622 .inherits = &hpt370_port_ops,
25623 .mode_filter = hpt370a_filter,
25624 };
25625@@ -615,7 +615,7 @@ static struct ata_port_operations hpt370
25626 * mode setting functionality.
25627 */
25628
25629-static struct ata_port_operations hpt302_port_ops = {
25630+static const struct ata_port_operations hpt302_port_ops = {
25631 .inherits = &ata_bmdma_port_ops,
25632
25633 .bmdma_stop = hpt37x_bmdma_stop,
25634@@ -631,7 +631,7 @@ static struct ata_port_operations hpt302
25635 * but we have a mode filter.
25636 */
25637
25638-static struct ata_port_operations hpt372_port_ops = {
25639+static const struct ata_port_operations hpt372_port_ops = {
25640 .inherits = &hpt302_port_ops,
25641 .mode_filter = hpt372_filter,
25642 };
25643@@ -641,7 +641,7 @@ static struct ata_port_operations hpt372
25644 * but we have a different cable detection procedure for function 1.
25645 */
25646
25647-static struct ata_port_operations hpt374_fn1_port_ops = {
25648+static const struct ata_port_operations hpt374_fn1_port_ops = {
25649 .inherits = &hpt372_port_ops,
25650 .cable_detect = hpt374_fn1_cable_detect,
25651 };
25652diff -urNp linux-2.6.39.2/drivers/ata/pata_hpt3x2n.c linux-2.6.39.2/drivers/ata/pata_hpt3x2n.c
25653--- linux-2.6.39.2/drivers/ata/pata_hpt3x2n.c 2011-05-19 00:06:34.000000000 -0400
25654+++ linux-2.6.39.2/drivers/ata/pata_hpt3x2n.c 2011-05-22 19:36:31.000000000 -0400
25655@@ -350,7 +350,7 @@ static struct scsi_host_template hpt3x2n
25656 * Configuration for HPT302N/371N.
25657 */
25658
25659-static struct ata_port_operations hpt3xxn_port_ops = {
25660+static const struct ata_port_operations hpt3xxn_port_ops = {
25661 .inherits = &ata_bmdma_port_ops,
25662
25663 .bmdma_stop = hpt3x2n_bmdma_stop,
25664@@ -368,7 +368,7 @@ static struct ata_port_operations hpt3xx
25665 * Configuration for HPT372N. Same as 302N/371N but we have a mode filter.
25666 */
25667
25668-static struct ata_port_operations hpt372n_port_ops = {
25669+static const struct ata_port_operations hpt372n_port_ops = {
25670 .inherits = &hpt3xxn_port_ops,
25671 .mode_filter = &hpt372n_filter,
25672 };
25673diff -urNp linux-2.6.39.2/drivers/ata/pata_hpt3x3.c linux-2.6.39.2/drivers/ata/pata_hpt3x3.c
25674--- linux-2.6.39.2/drivers/ata/pata_hpt3x3.c 2011-05-19 00:06:34.000000000 -0400
25675+++ linux-2.6.39.2/drivers/ata/pata_hpt3x3.c 2011-05-22 19:36:31.000000000 -0400
25676@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
25677 ATA_BMDMA_SHT(DRV_NAME),
25678 };
25679
25680-static struct ata_port_operations hpt3x3_port_ops = {
25681+static const struct ata_port_operations hpt3x3_port_ops = {
25682 .inherits = &ata_bmdma_port_ops,
25683 .cable_detect = ata_cable_40wire,
25684 .set_piomode = hpt3x3_set_piomode,
25685diff -urNp linux-2.6.39.2/drivers/ata/pata_icside.c linux-2.6.39.2/drivers/ata/pata_icside.c
25686--- linux-2.6.39.2/drivers/ata/pata_icside.c 2011-05-19 00:06:34.000000000 -0400
25687+++ linux-2.6.39.2/drivers/ata/pata_icside.c 2011-05-22 19:36:31.000000000 -0400
25688@@ -320,7 +320,7 @@ static void pata_icside_postreset(struct
25689 }
25690 }
25691
25692-static struct ata_port_operations pata_icside_port_ops = {
25693+static const struct ata_port_operations pata_icside_port_ops = {
25694 .inherits = &ata_bmdma_port_ops,
25695 /* no need to build any PRD tables for DMA */
25696 .qc_prep = ata_noop_qc_prep,
25697diff -urNp linux-2.6.39.2/drivers/ata/pata_isapnp.c linux-2.6.39.2/drivers/ata/pata_isapnp.c
25698--- linux-2.6.39.2/drivers/ata/pata_isapnp.c 2011-05-19 00:06:34.000000000 -0400
25699+++ linux-2.6.39.2/drivers/ata/pata_isapnp.c 2011-05-22 19:36:31.000000000 -0400
25700@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
25701 ATA_PIO_SHT(DRV_NAME),
25702 };
25703
25704-static struct ata_port_operations isapnp_port_ops = {
25705+static const struct ata_port_operations isapnp_port_ops = {
25706 .inherits = &ata_sff_port_ops,
25707 .cable_detect = ata_cable_40wire,
25708 };
25709
25710-static struct ata_port_operations isapnp_noalt_port_ops = {
25711+static const struct ata_port_operations isapnp_noalt_port_ops = {
25712 .inherits = &ata_sff_port_ops,
25713 .cable_detect = ata_cable_40wire,
25714 /* No altstatus so we don't want to use the lost interrupt poll */
25715diff -urNp linux-2.6.39.2/drivers/ata/pata_it8213.c linux-2.6.39.2/drivers/ata/pata_it8213.c
25716--- linux-2.6.39.2/drivers/ata/pata_it8213.c 2011-05-19 00:06:34.000000000 -0400
25717+++ linux-2.6.39.2/drivers/ata/pata_it8213.c 2011-05-22 19:36:31.000000000 -0400
25718@@ -233,7 +233,7 @@ static struct scsi_host_template it8213_
25719 };
25720
25721
25722-static struct ata_port_operations it8213_ops = {
25723+static const struct ata_port_operations it8213_ops = {
25724 .inherits = &ata_bmdma_port_ops,
25725 .cable_detect = it8213_cable_detect,
25726 .set_piomode = it8213_set_piomode,
25727diff -urNp linux-2.6.39.2/drivers/ata/pata_it821x.c linux-2.6.39.2/drivers/ata/pata_it821x.c
25728--- linux-2.6.39.2/drivers/ata/pata_it821x.c 2011-05-19 00:06:34.000000000 -0400
25729+++ linux-2.6.39.2/drivers/ata/pata_it821x.c 2011-05-22 19:36:31.000000000 -0400
25730@@ -801,7 +801,7 @@ static struct scsi_host_template it821x_
25731 ATA_BMDMA_SHT(DRV_NAME),
25732 };
25733
25734-static struct ata_port_operations it821x_smart_port_ops = {
25735+static const struct ata_port_operations it821x_smart_port_ops = {
25736 .inherits = &ata_bmdma_port_ops,
25737
25738 .check_atapi_dma= it821x_check_atapi_dma,
25739@@ -815,7 +815,7 @@ static struct ata_port_operations it821x
25740 .port_start = it821x_port_start,
25741 };
25742
25743-static struct ata_port_operations it821x_passthru_port_ops = {
25744+static const struct ata_port_operations it821x_passthru_port_ops = {
25745 .inherits = &ata_bmdma_port_ops,
25746
25747 .check_atapi_dma= it821x_check_atapi_dma,
25748@@ -831,7 +831,7 @@ static struct ata_port_operations it821x
25749 .port_start = it821x_port_start,
25750 };
25751
25752-static struct ata_port_operations it821x_rdc_port_ops = {
25753+static const struct ata_port_operations it821x_rdc_port_ops = {
25754 .inherits = &ata_bmdma_port_ops,
25755
25756 .check_atapi_dma= it821x_check_atapi_dma,
25757diff -urNp linux-2.6.39.2/drivers/ata/pata_ixp4xx_cf.c linux-2.6.39.2/drivers/ata/pata_ixp4xx_cf.c
25758--- linux-2.6.39.2/drivers/ata/pata_ixp4xx_cf.c 2011-05-19 00:06:34.000000000 -0400
25759+++ linux-2.6.39.2/drivers/ata/pata_ixp4xx_cf.c 2011-05-22 19:36:31.000000000 -0400
25760@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
25761 ATA_PIO_SHT(DRV_NAME),
25762 };
25763
25764-static struct ata_port_operations ixp4xx_port_ops = {
25765+static const struct ata_port_operations ixp4xx_port_ops = {
25766 .inherits = &ata_sff_port_ops,
25767 .sff_data_xfer = ixp4xx_mmio_data_xfer,
25768 .cable_detect = ata_cable_40wire,
25769diff -urNp linux-2.6.39.2/drivers/ata/pata_jmicron.c linux-2.6.39.2/drivers/ata/pata_jmicron.c
25770--- linux-2.6.39.2/drivers/ata/pata_jmicron.c 2011-05-19 00:06:34.000000000 -0400
25771+++ linux-2.6.39.2/drivers/ata/pata_jmicron.c 2011-05-22 19:36:31.000000000 -0400
25772@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
25773 ATA_BMDMA_SHT(DRV_NAME),
25774 };
25775
25776-static struct ata_port_operations jmicron_ops = {
25777+static const struct ata_port_operations jmicron_ops = {
25778 .inherits = &ata_bmdma_port_ops,
25779 .prereset = jmicron_pre_reset,
25780 };
25781diff -urNp linux-2.6.39.2/drivers/ata/pata_legacy.c linux-2.6.39.2/drivers/ata/pata_legacy.c
25782--- linux-2.6.39.2/drivers/ata/pata_legacy.c 2011-05-19 00:06:34.000000000 -0400
25783+++ linux-2.6.39.2/drivers/ata/pata_legacy.c 2011-05-22 19:36:31.000000000 -0400
25784@@ -116,7 +116,7 @@ struct legacy_probe {
25785
25786 struct legacy_controller {
25787 const char *name;
25788- struct ata_port_operations *ops;
25789+ const struct ata_port_operations *ops;
25790 unsigned int pio_mask;
25791 unsigned int flags;
25792 unsigned int pflags;
25793@@ -239,12 +239,12 @@ static const struct ata_port_operations
25794 * pio_mask as well.
25795 */
25796
25797-static struct ata_port_operations simple_port_ops = {
25798+static const struct ata_port_operations simple_port_ops = {
25799 .inherits = &legacy_base_port_ops,
25800 .sff_data_xfer = ata_sff_data_xfer_noirq,
25801 };
25802
25803-static struct ata_port_operations legacy_port_ops = {
25804+static const struct ata_port_operations legacy_port_ops = {
25805 .inherits = &legacy_base_port_ops,
25806 .sff_data_xfer = ata_sff_data_xfer_noirq,
25807 .set_mode = legacy_set_mode,
25808@@ -340,7 +340,7 @@ static unsigned int pdc_data_xfer_vlb(st
25809 return buflen;
25810 }
25811
25812-static struct ata_port_operations pdc20230_port_ops = {
25813+static const struct ata_port_operations pdc20230_port_ops = {
25814 .inherits = &legacy_base_port_ops,
25815 .set_piomode = pdc20230_set_piomode,
25816 .sff_data_xfer = pdc_data_xfer_vlb,
25817@@ -373,7 +373,7 @@ static void ht6560a_set_piomode(struct a
25818 ioread8(ap->ioaddr.status_addr);
25819 }
25820
25821-static struct ata_port_operations ht6560a_port_ops = {
25822+static const struct ata_port_operations ht6560a_port_ops = {
25823 .inherits = &legacy_base_port_ops,
25824 .set_piomode = ht6560a_set_piomode,
25825 };
25826@@ -416,7 +416,7 @@ static void ht6560b_set_piomode(struct a
25827 ioread8(ap->ioaddr.status_addr);
25828 }
25829
25830-static struct ata_port_operations ht6560b_port_ops = {
25831+static const struct ata_port_operations ht6560b_port_ops = {
25832 .inherits = &legacy_base_port_ops,
25833 .set_piomode = ht6560b_set_piomode,
25834 };
25835@@ -515,7 +515,7 @@ static void opti82c611a_set_piomode(stru
25836 }
25837
25838
25839-static struct ata_port_operations opti82c611a_port_ops = {
25840+static const struct ata_port_operations opti82c611a_port_ops = {
25841 .inherits = &legacy_base_port_ops,
25842 .set_piomode = opti82c611a_set_piomode,
25843 };
25844@@ -625,7 +625,7 @@ static unsigned int opti82c46x_qc_issue(
25845 return ata_sff_qc_issue(qc);
25846 }
25847
25848-static struct ata_port_operations opti82c46x_port_ops = {
25849+static const struct ata_port_operations opti82c46x_port_ops = {
25850 .inherits = &legacy_base_port_ops,
25851 .set_piomode = opti82c46x_set_piomode,
25852 .qc_issue = opti82c46x_qc_issue,
25853@@ -787,20 +787,20 @@ static int qdi_port(struct platform_devi
25854 return 0;
25855 }
25856
25857-static struct ata_port_operations qdi6500_port_ops = {
25858+static const struct ata_port_operations qdi6500_port_ops = {
25859 .inherits = &legacy_base_port_ops,
25860 .set_piomode = qdi6500_set_piomode,
25861 .qc_issue = qdi_qc_issue,
25862 .sff_data_xfer = vlb32_data_xfer,
25863 };
25864
25865-static struct ata_port_operations qdi6580_port_ops = {
25866+static const struct ata_port_operations qdi6580_port_ops = {
25867 .inherits = &legacy_base_port_ops,
25868 .set_piomode = qdi6580_set_piomode,
25869 .sff_data_xfer = vlb32_data_xfer,
25870 };
25871
25872-static struct ata_port_operations qdi6580dp_port_ops = {
25873+static const struct ata_port_operations qdi6580dp_port_ops = {
25874 .inherits = &legacy_base_port_ops,
25875 .set_piomode = qdi6580dp_set_piomode,
25876 .qc_issue = qdi_qc_issue,
25877@@ -872,7 +872,7 @@ static int winbond_port(struct platform_
25878 return 0;
25879 }
25880
25881-static struct ata_port_operations winbond_port_ops = {
25882+static const struct ata_port_operations winbond_port_ops = {
25883 .inherits = &legacy_base_port_ops,
25884 .set_piomode = winbond_set_piomode,
25885 .sff_data_xfer = vlb32_data_xfer,
25886@@ -995,7 +995,7 @@ static __init int legacy_init_one(struct
25887 int pio_modes = controller->pio_mask;
25888 unsigned long io = probe->port;
25889 u32 mask = (1 << probe->slot);
25890- struct ata_port_operations *ops = controller->ops;
25891+ const struct ata_port_operations *ops = controller->ops;
25892 struct legacy_data *ld = &legacy_data[probe->slot];
25893 struct ata_host *host = NULL;
25894 struct ata_port *ap;
25895diff -urNp linux-2.6.39.2/drivers/ata/pata_macio.c linux-2.6.39.2/drivers/ata/pata_macio.c
25896--- linux-2.6.39.2/drivers/ata/pata_macio.c 2011-05-19 00:06:34.000000000 -0400
25897+++ linux-2.6.39.2/drivers/ata/pata_macio.c 2011-05-22 19:36:31.000000000 -0400
25898@@ -918,9 +918,8 @@ static struct scsi_host_template pata_ma
25899 .slave_configure = pata_macio_slave_config,
25900 };
25901
25902-static struct ata_port_operations pata_macio_ops = {
25903+static const struct ata_port_operations pata_macio_ops = {
25904 .inherits = &ata_bmdma_port_ops,
25905-
25906 .freeze = pata_macio_freeze,
25907 .set_piomode = pata_macio_set_timings,
25908 .set_dmamode = pata_macio_set_timings,
25909diff -urNp linux-2.6.39.2/drivers/ata/pata_marvell.c linux-2.6.39.2/drivers/ata/pata_marvell.c
25910--- linux-2.6.39.2/drivers/ata/pata_marvell.c 2011-05-19 00:06:34.000000000 -0400
25911+++ linux-2.6.39.2/drivers/ata/pata_marvell.c 2011-05-22 19:36:31.000000000 -0400
25912@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
25913 ATA_BMDMA_SHT(DRV_NAME),
25914 };
25915
25916-static struct ata_port_operations marvell_ops = {
25917+static const struct ata_port_operations marvell_ops = {
25918 .inherits = &ata_bmdma_port_ops,
25919 .cable_detect = marvell_cable_detect,
25920 .prereset = marvell_pre_reset,
25921diff -urNp linux-2.6.39.2/drivers/ata/pata_mpc52xx.c linux-2.6.39.2/drivers/ata/pata_mpc52xx.c
25922--- linux-2.6.39.2/drivers/ata/pata_mpc52xx.c 2011-05-19 00:06:34.000000000 -0400
25923+++ linux-2.6.39.2/drivers/ata/pata_mpc52xx.c 2011-05-22 19:36:31.000000000 -0400
25924@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
25925 ATA_PIO_SHT(DRV_NAME),
25926 };
25927
25928-static struct ata_port_operations mpc52xx_ata_port_ops = {
25929+static const struct ata_port_operations mpc52xx_ata_port_ops = {
25930 .inherits = &ata_bmdma_port_ops,
25931 .sff_dev_select = mpc52xx_ata_dev_select,
25932 .set_piomode = mpc52xx_ata_set_piomode,
25933diff -urNp linux-2.6.39.2/drivers/ata/pata_mpiix.c linux-2.6.39.2/drivers/ata/pata_mpiix.c
25934--- linux-2.6.39.2/drivers/ata/pata_mpiix.c 2011-05-19 00:06:34.000000000 -0400
25935+++ linux-2.6.39.2/drivers/ata/pata_mpiix.c 2011-05-22 19:36:31.000000000 -0400
25936@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
25937 ATA_PIO_SHT(DRV_NAME),
25938 };
25939
25940-static struct ata_port_operations mpiix_port_ops = {
25941+static const struct ata_port_operations mpiix_port_ops = {
25942 .inherits = &ata_sff_port_ops,
25943 .qc_issue = mpiix_qc_issue,
25944 .cable_detect = ata_cable_40wire,
25945diff -urNp linux-2.6.39.2/drivers/ata/pata_netcell.c linux-2.6.39.2/drivers/ata/pata_netcell.c
25946--- linux-2.6.39.2/drivers/ata/pata_netcell.c 2011-05-19 00:06:34.000000000 -0400
25947+++ linux-2.6.39.2/drivers/ata/pata_netcell.c 2011-05-22 19:36:31.000000000 -0400
25948@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
25949 ATA_BMDMA_SHT(DRV_NAME),
25950 };
25951
25952-static struct ata_port_operations netcell_ops = {
25953+static const struct ata_port_operations netcell_ops = {
25954 .inherits = &ata_bmdma_port_ops,
25955 .cable_detect = ata_cable_80wire,
25956 .read_id = netcell_read_id,
25957diff -urNp linux-2.6.39.2/drivers/ata/pata_ninja32.c linux-2.6.39.2/drivers/ata/pata_ninja32.c
25958--- linux-2.6.39.2/drivers/ata/pata_ninja32.c 2011-05-19 00:06:34.000000000 -0400
25959+++ linux-2.6.39.2/drivers/ata/pata_ninja32.c 2011-05-22 19:36:31.000000000 -0400
25960@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
25961 ATA_BMDMA_SHT(DRV_NAME),
25962 };
25963
25964-static struct ata_port_operations ninja32_port_ops = {
25965+static const struct ata_port_operations ninja32_port_ops = {
25966 .inherits = &ata_bmdma_port_ops,
25967 .sff_dev_select = ninja32_dev_select,
25968 .cable_detect = ata_cable_40wire,
25969diff -urNp linux-2.6.39.2/drivers/ata/pata_ns87410.c linux-2.6.39.2/drivers/ata/pata_ns87410.c
25970--- linux-2.6.39.2/drivers/ata/pata_ns87410.c 2011-05-19 00:06:34.000000000 -0400
25971+++ linux-2.6.39.2/drivers/ata/pata_ns87410.c 2011-05-22 19:36:31.000000000 -0400
25972@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
25973 ATA_PIO_SHT(DRV_NAME),
25974 };
25975
25976-static struct ata_port_operations ns87410_port_ops = {
25977+static const struct ata_port_operations ns87410_port_ops = {
25978 .inherits = &ata_sff_port_ops,
25979 .qc_issue = ns87410_qc_issue,
25980 .cable_detect = ata_cable_40wire,
25981diff -urNp linux-2.6.39.2/drivers/ata/pata_ns87415.c linux-2.6.39.2/drivers/ata/pata_ns87415.c
25982--- linux-2.6.39.2/drivers/ata/pata_ns87415.c 2011-05-19 00:06:34.000000000 -0400
25983+++ linux-2.6.39.2/drivers/ata/pata_ns87415.c 2011-05-22 19:36:31.000000000 -0400
25984@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
25985 }
25986 #endif /* 87560 SuperIO Support */
25987
25988-static struct ata_port_operations ns87415_pata_ops = {
25989+static const struct ata_port_operations ns87415_pata_ops = {
25990 .inherits = &ata_bmdma_port_ops,
25991
25992 .check_atapi_dma = ns87415_check_atapi_dma,
25993@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
25994 };
25995
25996 #if defined(CONFIG_SUPERIO)
25997-static struct ata_port_operations ns87560_pata_ops = {
25998+static const struct ata_port_operations ns87560_pata_ops = {
25999 .inherits = &ns87415_pata_ops,
26000 .sff_tf_read = ns87560_tf_read,
26001 .sff_check_status = ns87560_check_status,
26002diff -urNp linux-2.6.39.2/drivers/ata/pata_octeon_cf.c linux-2.6.39.2/drivers/ata/pata_octeon_cf.c
26003--- linux-2.6.39.2/drivers/ata/pata_octeon_cf.c 2011-05-19 00:06:34.000000000 -0400
26004+++ linux-2.6.39.2/drivers/ata/pata_octeon_cf.c 2011-05-22 19:36:31.000000000 -0400
26005@@ -780,7 +780,7 @@ static unsigned int octeon_cf_qc_issue(s
26006 return 0;
26007 }
26008
26009-static struct ata_port_operations octeon_cf_ops = {
26010+static struct ata_port_operations octeon_cf_ops = { /* cannot be const */
26011 .inherits = &ata_sff_port_ops,
26012 .check_atapi_dma = octeon_cf_check_atapi_dma,
26013 .qc_prep = ata_noop_qc_prep,
26014diff -urNp linux-2.6.39.2/drivers/ata/pata_oldpiix.c linux-2.6.39.2/drivers/ata/pata_oldpiix.c
26015--- linux-2.6.39.2/drivers/ata/pata_oldpiix.c 2011-05-19 00:06:34.000000000 -0400
26016+++ linux-2.6.39.2/drivers/ata/pata_oldpiix.c 2011-05-22 19:36:31.000000000 -0400
26017@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
26018 ATA_BMDMA_SHT(DRV_NAME),
26019 };
26020
26021-static struct ata_port_operations oldpiix_pata_ops = {
26022+static const struct ata_port_operations oldpiix_pata_ops = {
26023 .inherits = &ata_bmdma_port_ops,
26024 .qc_issue = oldpiix_qc_issue,
26025 .cable_detect = ata_cable_40wire,
26026diff -urNp linux-2.6.39.2/drivers/ata/pata_opti.c linux-2.6.39.2/drivers/ata/pata_opti.c
26027--- linux-2.6.39.2/drivers/ata/pata_opti.c 2011-05-19 00:06:34.000000000 -0400
26028+++ linux-2.6.39.2/drivers/ata/pata_opti.c 2011-05-22 19:36:31.000000000 -0400
26029@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
26030 ATA_PIO_SHT(DRV_NAME),
26031 };
26032
26033-static struct ata_port_operations opti_port_ops = {
26034+static const struct ata_port_operations opti_port_ops = {
26035 .inherits = &ata_sff_port_ops,
26036 .cable_detect = ata_cable_40wire,
26037 .set_piomode = opti_set_piomode,
26038diff -urNp linux-2.6.39.2/drivers/ata/pata_optidma.c linux-2.6.39.2/drivers/ata/pata_optidma.c
26039--- linux-2.6.39.2/drivers/ata/pata_optidma.c 2011-05-19 00:06:34.000000000 -0400
26040+++ linux-2.6.39.2/drivers/ata/pata_optidma.c 2011-05-22 19:36:31.000000000 -0400
26041@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
26042 ATA_BMDMA_SHT(DRV_NAME),
26043 };
26044
26045-static struct ata_port_operations optidma_port_ops = {
26046+static const struct ata_port_operations optidma_port_ops = {
26047 .inherits = &ata_bmdma_port_ops,
26048 .cable_detect = ata_cable_40wire,
26049 .set_piomode = optidma_set_pio_mode,
26050@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
26051 .prereset = optidma_pre_reset,
26052 };
26053
26054-static struct ata_port_operations optiplus_port_ops = {
26055+static const struct ata_port_operations optiplus_port_ops = {
26056 .inherits = &optidma_port_ops,
26057 .set_piomode = optiplus_set_pio_mode,
26058 .set_dmamode = optiplus_set_dma_mode,
26059diff -urNp linux-2.6.39.2/drivers/ata/pata_palmld.c linux-2.6.39.2/drivers/ata/pata_palmld.c
26060--- linux-2.6.39.2/drivers/ata/pata_palmld.c 2011-05-19 00:06:34.000000000 -0400
26061+++ linux-2.6.39.2/drivers/ata/pata_palmld.c 2011-05-22 19:36:31.000000000 -0400
26062@@ -42,7 +42,7 @@ static struct scsi_host_template palmld_
26063 ATA_PIO_SHT(DRV_NAME),
26064 };
26065
26066-static struct ata_port_operations palmld_port_ops = {
26067+static const struct ata_port_operations palmld_port_ops = {
26068 .inherits = &ata_sff_port_ops,
26069 .sff_data_xfer = ata_sff_data_xfer_noirq,
26070 .cable_detect = ata_cable_40wire,
26071diff -urNp linux-2.6.39.2/drivers/ata/pata_pcmcia.c linux-2.6.39.2/drivers/ata/pata_pcmcia.c
26072--- linux-2.6.39.2/drivers/ata/pata_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
26073+++ linux-2.6.39.2/drivers/ata/pata_pcmcia.c 2011-05-22 19:36:31.000000000 -0400
26074@@ -151,14 +151,14 @@ static struct scsi_host_template pcmcia_
26075 ATA_PIO_SHT(DRV_NAME),
26076 };
26077
26078-static struct ata_port_operations pcmcia_port_ops = {
26079+static const struct ata_port_operations pcmcia_port_ops = {
26080 .inherits = &ata_sff_port_ops,
26081 .sff_data_xfer = ata_sff_data_xfer_noirq,
26082 .cable_detect = ata_cable_40wire,
26083 .set_mode = pcmcia_set_mode,
26084 };
26085
26086-static struct ata_port_operations pcmcia_8bit_port_ops = {
26087+static const struct ata_port_operations pcmcia_8bit_port_ops = {
26088 .inherits = &ata_sff_port_ops,
26089 .sff_data_xfer = ata_data_xfer_8bit,
26090 .cable_detect = ata_cable_40wire,
26091@@ -205,7 +205,7 @@ static int pcmcia_init_one(struct pcmcia
26092 unsigned long io_base, ctl_base;
26093 void __iomem *io_addr, *ctl_addr;
26094 int n_ports = 1;
26095- struct ata_port_operations *ops = &pcmcia_port_ops;
26096+ const struct ata_port_operations *ops = &pcmcia_port_ops;
26097
26098 /* Set up attributes in order to probe card and get resources */
26099 pdev->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IO |
26100diff -urNp linux-2.6.39.2/drivers/ata/pata_pdc2027x.c linux-2.6.39.2/drivers/ata/pata_pdc2027x.c
26101--- linux-2.6.39.2/drivers/ata/pata_pdc2027x.c 2011-05-19 00:06:34.000000000 -0400
26102+++ linux-2.6.39.2/drivers/ata/pata_pdc2027x.c 2011-05-22 19:36:31.000000000 -0400
26103@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
26104 ATA_BMDMA_SHT(DRV_NAME),
26105 };
26106
26107-static struct ata_port_operations pdc2027x_pata100_ops = {
26108+static const struct ata_port_operations pdc2027x_pata100_ops = {
26109 .inherits = &ata_bmdma_port_ops,
26110 .check_atapi_dma = pdc2027x_check_atapi_dma,
26111 .cable_detect = pdc2027x_cable_detect,
26112 .prereset = pdc2027x_prereset,
26113 };
26114
26115-static struct ata_port_operations pdc2027x_pata133_ops = {
26116+static const struct ata_port_operations pdc2027x_pata133_ops = {
26117 .inherits = &pdc2027x_pata100_ops,
26118 .mode_filter = pdc2027x_mode_filter,
26119 .set_piomode = pdc2027x_set_piomode,
26120diff -urNp linux-2.6.39.2/drivers/ata/pata_pdc202xx_old.c linux-2.6.39.2/drivers/ata/pata_pdc202xx_old.c
26121--- linux-2.6.39.2/drivers/ata/pata_pdc202xx_old.c 2011-05-19 00:06:34.000000000 -0400
26122+++ linux-2.6.39.2/drivers/ata/pata_pdc202xx_old.c 2011-05-22 19:36:31.000000000 -0400
26123@@ -295,7 +295,7 @@ static struct scsi_host_template pdc202x
26124 ATA_BMDMA_SHT(DRV_NAME),
26125 };
26126
26127-static struct ata_port_operations pdc2024x_port_ops = {
26128+static const struct ata_port_operations pdc2024x_port_ops = {
26129 .inherits = &ata_bmdma_port_ops,
26130
26131 .cable_detect = ata_cable_40wire,
26132@@ -306,7 +306,7 @@ static struct ata_port_operations pdc202
26133 .sff_irq_check = pdc202xx_irq_check,
26134 };
26135
26136-static struct ata_port_operations pdc2026x_port_ops = {
26137+static const struct ata_port_operations pdc2026x_port_ops = {
26138 .inherits = &pdc2024x_port_ops,
26139
26140 .check_atapi_dma = pdc2026x_check_atapi_dma,
26141diff -urNp linux-2.6.39.2/drivers/ata/pata_piccolo.c linux-2.6.39.2/drivers/ata/pata_piccolo.c
26142--- linux-2.6.39.2/drivers/ata/pata_piccolo.c 2011-05-19 00:06:34.000000000 -0400
26143+++ linux-2.6.39.2/drivers/ata/pata_piccolo.c 2011-05-22 19:36:31.000000000 -0400
26144@@ -67,7 +67,7 @@ static struct scsi_host_template tosh_sh
26145 ATA_BMDMA_SHT(DRV_NAME),
26146 };
26147
26148-static struct ata_port_operations tosh_port_ops = {
26149+static const struct ata_port_operations tosh_port_ops = {
26150 .inherits = &ata_bmdma_port_ops,
26151 .cable_detect = ata_cable_unknown,
26152 .set_piomode = tosh_set_piomode,
26153diff -urNp linux-2.6.39.2/drivers/ata/pata_platform.c linux-2.6.39.2/drivers/ata/pata_platform.c
26154--- linux-2.6.39.2/drivers/ata/pata_platform.c 2011-05-19 00:06:34.000000000 -0400
26155+++ linux-2.6.39.2/drivers/ata/pata_platform.c 2011-05-22 19:36:31.000000000 -0400
26156@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
26157 ATA_PIO_SHT(DRV_NAME),
26158 };
26159
26160-static struct ata_port_operations pata_platform_port_ops = {
26161+static const struct ata_port_operations pata_platform_port_ops = {
26162 .inherits = &ata_sff_port_ops,
26163 .sff_data_xfer = ata_sff_data_xfer_noirq,
26164 .cable_detect = ata_cable_unknown,
26165diff -urNp linux-2.6.39.2/drivers/ata/pata_pxa.c linux-2.6.39.2/drivers/ata/pata_pxa.c
26166--- linux-2.6.39.2/drivers/ata/pata_pxa.c 2011-05-19 00:06:34.000000000 -0400
26167+++ linux-2.6.39.2/drivers/ata/pata_pxa.c 2011-05-22 19:36:31.000000000 -0400
26168@@ -198,7 +198,7 @@ static struct scsi_host_template pxa_ata
26169 ATA_BMDMA_SHT(DRV_NAME),
26170 };
26171
26172-static struct ata_port_operations pxa_ata_port_ops = {
26173+static const struct ata_port_operations pxa_ata_port_ops = {
26174 .inherits = &ata_bmdma_port_ops,
26175 .cable_detect = ata_cable_40wire,
26176
26177diff -urNp linux-2.6.39.2/drivers/ata/pata_qdi.c linux-2.6.39.2/drivers/ata/pata_qdi.c
26178--- linux-2.6.39.2/drivers/ata/pata_qdi.c 2011-05-19 00:06:34.000000000 -0400
26179+++ linux-2.6.39.2/drivers/ata/pata_qdi.c 2011-05-22 19:36:31.000000000 -0400
26180@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
26181 ATA_PIO_SHT(DRV_NAME),
26182 };
26183
26184-static struct ata_port_operations qdi6500_port_ops = {
26185+static const struct ata_port_operations qdi6500_port_ops = {
26186 .inherits = &ata_sff_port_ops,
26187 .qc_issue = qdi_qc_issue,
26188 .sff_data_xfer = qdi_data_xfer,
26189@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
26190 .set_piomode = qdi6500_set_piomode,
26191 };
26192
26193-static struct ata_port_operations qdi6580_port_ops = {
26194+static const struct ata_port_operations qdi6580_port_ops = {
26195 .inherits = &qdi6500_port_ops,
26196 .set_piomode = qdi6580_set_piomode,
26197 };
26198diff -urNp linux-2.6.39.2/drivers/ata/pata_radisys.c linux-2.6.39.2/drivers/ata/pata_radisys.c
26199--- linux-2.6.39.2/drivers/ata/pata_radisys.c 2011-05-19 00:06:34.000000000 -0400
26200+++ linux-2.6.39.2/drivers/ata/pata_radisys.c 2011-05-22 19:36:31.000000000 -0400
26201@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
26202 ATA_BMDMA_SHT(DRV_NAME),
26203 };
26204
26205-static struct ata_port_operations radisys_pata_ops = {
26206+static const struct ata_port_operations radisys_pata_ops = {
26207 .inherits = &ata_bmdma_port_ops,
26208 .qc_issue = radisys_qc_issue,
26209 .cable_detect = ata_cable_unknown,
26210diff -urNp linux-2.6.39.2/drivers/ata/pata_rb532_cf.c linux-2.6.39.2/drivers/ata/pata_rb532_cf.c
26211--- linux-2.6.39.2/drivers/ata/pata_rb532_cf.c 2011-05-19 00:06:34.000000000 -0400
26212+++ linux-2.6.39.2/drivers/ata/pata_rb532_cf.c 2011-05-22 19:36:31.000000000 -0400
26213@@ -69,7 +69,7 @@ static irqreturn_t rb532_pata_irq_handle
26214 return IRQ_HANDLED;
26215 }
26216
26217-static struct ata_port_operations rb532_pata_port_ops = {
26218+static const struct ata_port_operations rb532_pata_port_ops = {
26219 .inherits = &ata_sff_port_ops,
26220 .sff_data_xfer = ata_sff_data_xfer32,
26221 };
26222diff -urNp linux-2.6.39.2/drivers/ata/pata_rdc.c linux-2.6.39.2/drivers/ata/pata_rdc.c
26223--- linux-2.6.39.2/drivers/ata/pata_rdc.c 2011-05-19 00:06:34.000000000 -0400
26224+++ linux-2.6.39.2/drivers/ata/pata_rdc.c 2011-05-22 19:36:31.000000000 -0400
26225@@ -273,7 +273,7 @@ static void rdc_set_dmamode(struct ata_p
26226 pci_write_config_byte(dev, 0x48, udma_enable);
26227 }
26228
26229-static struct ata_port_operations rdc_pata_ops = {
26230+static const struct ata_port_operations rdc_pata_ops = {
26231 .inherits = &ata_bmdma32_port_ops,
26232 .cable_detect = rdc_pata_cable_detect,
26233 .set_piomode = rdc_set_piomode,
26234diff -urNp linux-2.6.39.2/drivers/ata/pata_rz1000.c linux-2.6.39.2/drivers/ata/pata_rz1000.c
26235--- linux-2.6.39.2/drivers/ata/pata_rz1000.c 2011-05-19 00:06:34.000000000 -0400
26236+++ linux-2.6.39.2/drivers/ata/pata_rz1000.c 2011-05-22 19:36:31.000000000 -0400
26237@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
26238 ATA_PIO_SHT(DRV_NAME),
26239 };
26240
26241-static struct ata_port_operations rz1000_port_ops = {
26242+static const struct ata_port_operations rz1000_port_ops = {
26243 .inherits = &ata_sff_port_ops,
26244 .cable_detect = ata_cable_40wire,
26245 .set_mode = rz1000_set_mode,
26246diff -urNp linux-2.6.39.2/drivers/ata/pata_samsung_cf.c linux-2.6.39.2/drivers/ata/pata_samsung_cf.c
26247--- linux-2.6.39.2/drivers/ata/pata_samsung_cf.c 2011-05-19 00:06:34.000000000 -0400
26248+++ linux-2.6.39.2/drivers/ata/pata_samsung_cf.c 2011-05-22 19:36:31.000000000 -0400
26249@@ -399,7 +399,7 @@ static struct scsi_host_template pata_s3
26250 ATA_PIO_SHT(DRV_NAME),
26251 };
26252
26253-static struct ata_port_operations pata_s3c_port_ops = {
26254+static const struct ata_port_operations pata_s3c_port_ops = {
26255 .inherits = &ata_sff_port_ops,
26256 .sff_check_status = pata_s3c_check_status,
26257 .sff_check_altstatus = pata_s3c_check_altstatus,
26258@@ -413,7 +413,7 @@ static struct ata_port_operations pata_s
26259 .set_piomode = pata_s3c_set_piomode,
26260 };
26261
26262-static struct ata_port_operations pata_s5p_port_ops = {
26263+static const struct ata_port_operations pata_s5p_port_ops = {
26264 .inherits = &ata_sff_port_ops,
26265 .set_piomode = pata_s3c_set_piomode,
26266 };
26267diff -urNp linux-2.6.39.2/drivers/ata/pata_sc1200.c linux-2.6.39.2/drivers/ata/pata_sc1200.c
26268--- linux-2.6.39.2/drivers/ata/pata_sc1200.c 2011-05-19 00:06:34.000000000 -0400
26269+++ linux-2.6.39.2/drivers/ata/pata_sc1200.c 2011-05-22 19:36:31.000000000 -0400
26270@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
26271 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
26272 };
26273
26274-static struct ata_port_operations sc1200_port_ops = {
26275+static const struct ata_port_operations sc1200_port_ops = {
26276 .inherits = &ata_bmdma_port_ops,
26277 .qc_prep = ata_bmdma_dumb_qc_prep,
26278 .qc_issue = sc1200_qc_issue,
26279diff -urNp linux-2.6.39.2/drivers/ata/pata_scc.c linux-2.6.39.2/drivers/ata/pata_scc.c
26280--- linux-2.6.39.2/drivers/ata/pata_scc.c 2011-05-19 00:06:34.000000000 -0400
26281+++ linux-2.6.39.2/drivers/ata/pata_scc.c 2011-05-22 19:36:31.000000000 -0400
26282@@ -926,7 +926,7 @@ static struct scsi_host_template scc_sht
26283 ATA_BMDMA_SHT(DRV_NAME),
26284 };
26285
26286-static struct ata_port_operations scc_pata_ops = {
26287+static const struct ata_port_operations scc_pata_ops = {
26288 .inherits = &ata_bmdma_port_ops,
26289
26290 .set_piomode = scc_set_piomode,
26291diff -urNp linux-2.6.39.2/drivers/ata/pata_sch.c linux-2.6.39.2/drivers/ata/pata_sch.c
26292--- linux-2.6.39.2/drivers/ata/pata_sch.c 2011-05-19 00:06:34.000000000 -0400
26293+++ linux-2.6.39.2/drivers/ata/pata_sch.c 2011-05-22 19:36:31.000000000 -0400
26294@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
26295 ATA_BMDMA_SHT(DRV_NAME),
26296 };
26297
26298-static struct ata_port_operations sch_pata_ops = {
26299+static const struct ata_port_operations sch_pata_ops = {
26300 .inherits = &ata_bmdma_port_ops,
26301 .cable_detect = ata_cable_unknown,
26302 .set_piomode = sch_set_piomode,
26303diff -urNp linux-2.6.39.2/drivers/ata/pata_serverworks.c linux-2.6.39.2/drivers/ata/pata_serverworks.c
26304--- linux-2.6.39.2/drivers/ata/pata_serverworks.c 2011-05-19 00:06:34.000000000 -0400
26305+++ linux-2.6.39.2/drivers/ata/pata_serverworks.c 2011-05-22 19:36:31.000000000 -0400
26306@@ -300,7 +300,7 @@ static struct scsi_host_template serverw
26307 ATA_BMDMA_SHT(DRV_NAME),
26308 };
26309
26310-static struct ata_port_operations serverworks_osb4_port_ops = {
26311+static const struct ata_port_operations serverworks_osb4_port_ops = {
26312 .inherits = &ata_bmdma_port_ops,
26313 .cable_detect = serverworks_cable_detect,
26314 .mode_filter = serverworks_osb4_filter,
26315@@ -308,7 +308,7 @@ static struct ata_port_operations server
26316 .set_dmamode = serverworks_set_dmamode,
26317 };
26318
26319-static struct ata_port_operations serverworks_csb_port_ops = {
26320+static const struct ata_port_operations serverworks_csb_port_ops = {
26321 .inherits = &serverworks_osb4_port_ops,
26322 .mode_filter = serverworks_csb_filter,
26323 };
26324diff -urNp linux-2.6.39.2/drivers/ata/pata_sil680.c linux-2.6.39.2/drivers/ata/pata_sil680.c
26325--- linux-2.6.39.2/drivers/ata/pata_sil680.c 2011-05-19 00:06:34.000000000 -0400
26326+++ linux-2.6.39.2/drivers/ata/pata_sil680.c 2011-05-22 19:36:31.000000000 -0400
26327@@ -225,8 +225,7 @@ static struct scsi_host_template sil680_
26328 ATA_BMDMA_SHT(DRV_NAME),
26329 };
26330
26331-
26332-static struct ata_port_operations sil680_port_ops = {
26333+static const struct ata_port_operations sil680_port_ops = {
26334 .inherits = &ata_bmdma32_port_ops,
26335 .sff_exec_command = sil680_sff_exec_command,
26336 .sff_irq_check = sil680_sff_irq_check,
26337diff -urNp linux-2.6.39.2/drivers/ata/pata_sis.c linux-2.6.39.2/drivers/ata/pata_sis.c
26338--- linux-2.6.39.2/drivers/ata/pata_sis.c 2011-05-19 00:06:34.000000000 -0400
26339+++ linux-2.6.39.2/drivers/ata/pata_sis.c 2011-05-22 19:36:31.000000000 -0400
26340@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
26341 ATA_BMDMA_SHT(DRV_NAME),
26342 };
26343
26344-static struct ata_port_operations sis_133_for_sata_ops = {
26345+static const struct ata_port_operations sis_133_for_sata_ops = {
26346 .inherits = &ata_bmdma_port_ops,
26347 .set_piomode = sis_133_set_piomode,
26348 .set_dmamode = sis_133_set_dmamode,
26349 .cable_detect = sis_133_cable_detect,
26350 };
26351
26352-static struct ata_port_operations sis_base_ops = {
26353+static const struct ata_port_operations sis_base_ops = {
26354 .inherits = &ata_bmdma_port_ops,
26355 .prereset = sis_pre_reset,
26356 };
26357
26358-static struct ata_port_operations sis_133_ops = {
26359+static const struct ata_port_operations sis_133_ops = {
26360 .inherits = &sis_base_ops,
26361 .set_piomode = sis_133_set_piomode,
26362 .set_dmamode = sis_133_set_dmamode,
26363 .cable_detect = sis_133_cable_detect,
26364 };
26365
26366-static struct ata_port_operations sis_133_early_ops = {
26367+static const struct ata_port_operations sis_133_early_ops = {
26368 .inherits = &sis_base_ops,
26369 .set_piomode = sis_100_set_piomode,
26370 .set_dmamode = sis_133_early_set_dmamode,
26371 .cable_detect = sis_66_cable_detect,
26372 };
26373
26374-static struct ata_port_operations sis_100_ops = {
26375+static const struct ata_port_operations sis_100_ops = {
26376 .inherits = &sis_base_ops,
26377 .set_piomode = sis_100_set_piomode,
26378 .set_dmamode = sis_100_set_dmamode,
26379 .cable_detect = sis_66_cable_detect,
26380 };
26381
26382-static struct ata_port_operations sis_66_ops = {
26383+static const struct ata_port_operations sis_66_ops = {
26384 .inherits = &sis_base_ops,
26385 .set_piomode = sis_old_set_piomode,
26386 .set_dmamode = sis_66_set_dmamode,
26387 .cable_detect = sis_66_cable_detect,
26388 };
26389
26390-static struct ata_port_operations sis_old_ops = {
26391+static const struct ata_port_operations sis_old_ops = {
26392 .inherits = &sis_base_ops,
26393 .set_piomode = sis_old_set_piomode,
26394 .set_dmamode = sis_old_set_dmamode,
26395diff -urNp linux-2.6.39.2/drivers/ata/pata_sl82c105.c linux-2.6.39.2/drivers/ata/pata_sl82c105.c
26396--- linux-2.6.39.2/drivers/ata/pata_sl82c105.c 2011-05-19 00:06:34.000000000 -0400
26397+++ linux-2.6.39.2/drivers/ata/pata_sl82c105.c 2011-05-22 19:36:31.000000000 -0400
26398@@ -241,7 +241,7 @@ static struct scsi_host_template sl82c10
26399 ATA_BMDMA_SHT(DRV_NAME),
26400 };
26401
26402-static struct ata_port_operations sl82c105_port_ops = {
26403+static const struct ata_port_operations sl82c105_port_ops = {
26404 .inherits = &ata_bmdma_port_ops,
26405 .qc_defer = sl82c105_qc_defer,
26406 .bmdma_start = sl82c105_bmdma_start,
26407diff -urNp linux-2.6.39.2/drivers/ata/pata_triflex.c linux-2.6.39.2/drivers/ata/pata_triflex.c
26408--- linux-2.6.39.2/drivers/ata/pata_triflex.c 2011-05-19 00:06:34.000000000 -0400
26409+++ linux-2.6.39.2/drivers/ata/pata_triflex.c 2011-05-22 19:36:31.000000000 -0400
26410@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
26411 ATA_BMDMA_SHT(DRV_NAME),
26412 };
26413
26414-static struct ata_port_operations triflex_port_ops = {
26415+static const struct ata_port_operations triflex_port_ops = {
26416 .inherits = &ata_bmdma_port_ops,
26417 .bmdma_start = triflex_bmdma_start,
26418 .bmdma_stop = triflex_bmdma_stop,
26419diff -urNp linux-2.6.39.2/drivers/ata/pata_via.c linux-2.6.39.2/drivers/ata/pata_via.c
26420--- linux-2.6.39.2/drivers/ata/pata_via.c 2011-05-19 00:06:34.000000000 -0400
26421+++ linux-2.6.39.2/drivers/ata/pata_via.c 2011-05-22 19:36:31.000000000 -0400
26422@@ -441,7 +441,7 @@ static struct scsi_host_template via_sht
26423 ATA_BMDMA_SHT(DRV_NAME),
26424 };
26425
26426-static struct ata_port_operations via_port_ops = {
26427+static const struct ata_port_operations via_port_ops = {
26428 .inherits = &ata_bmdma_port_ops,
26429 .cable_detect = via_cable_detect,
26430 .set_piomode = via_set_piomode,
26431@@ -452,7 +452,7 @@ static struct ata_port_operations via_po
26432 .mode_filter = via_mode_filter,
26433 };
26434
26435-static struct ata_port_operations via_port_ops_noirq = {
26436+static const struct ata_port_operations via_port_ops_noirq = {
26437 .inherits = &via_port_ops,
26438 .sff_data_xfer = ata_sff_data_xfer_noirq,
26439 };
26440diff -urNp linux-2.6.39.2/drivers/ata/pdc_adma.c linux-2.6.39.2/drivers/ata/pdc_adma.c
26441--- linux-2.6.39.2/drivers/ata/pdc_adma.c 2011-05-19 00:06:34.000000000 -0400
26442+++ linux-2.6.39.2/drivers/ata/pdc_adma.c 2011-05-22 19:36:31.000000000 -0400
26443@@ -146,7 +146,7 @@ static struct scsi_host_template adma_at
26444 .dma_boundary = ADMA_DMA_BOUNDARY,
26445 };
26446
26447-static struct ata_port_operations adma_ata_ops = {
26448+static const struct ata_port_operations adma_ata_ops = {
26449 .inherits = &ata_sff_port_ops,
26450
26451 .lost_interrupt = ATA_OP_NULL,
26452diff -urNp linux-2.6.39.2/drivers/ata/sata_dwc_460ex.c linux-2.6.39.2/drivers/ata/sata_dwc_460ex.c
26453--- linux-2.6.39.2/drivers/ata/sata_dwc_460ex.c 2011-05-19 00:06:34.000000000 -0400
26454+++ linux-2.6.39.2/drivers/ata/sata_dwc_460ex.c 2011-05-22 19:36:31.000000000 -0400
26455@@ -1598,7 +1598,7 @@ static struct scsi_host_template sata_dw
26456 .dma_boundary = ATA_DMA_BOUNDARY,
26457 };
26458
26459-static struct ata_port_operations sata_dwc_ops = {
26460+static const struct ata_port_operations sata_dwc_ops = {
26461 .inherits = &ata_sff_port_ops,
26462
26463 .error_handler = sata_dwc_error_handler,
26464diff -urNp linux-2.6.39.2/drivers/ata/sata_fsl.c linux-2.6.39.2/drivers/ata/sata_fsl.c
26465--- linux-2.6.39.2/drivers/ata/sata_fsl.c 2011-05-19 00:06:34.000000000 -0400
26466+++ linux-2.6.39.2/drivers/ata/sata_fsl.c 2011-05-22 19:36:31.000000000 -0400
26467@@ -1268,7 +1268,7 @@ static struct scsi_host_template sata_fs
26468 .dma_boundary = ATA_DMA_BOUNDARY,
26469 };
26470
26471-static struct ata_port_operations sata_fsl_ops = {
26472+static const struct ata_port_operations sata_fsl_ops = {
26473 .inherits = &sata_pmp_port_ops,
26474
26475 .qc_defer = ata_std_qc_defer,
26476diff -urNp linux-2.6.39.2/drivers/ata/sata_inic162x.c linux-2.6.39.2/drivers/ata/sata_inic162x.c
26477--- linux-2.6.39.2/drivers/ata/sata_inic162x.c 2011-05-19 00:06:34.000000000 -0400
26478+++ linux-2.6.39.2/drivers/ata/sata_inic162x.c 2011-05-22 19:36:31.000000000 -0400
26479@@ -705,7 +705,7 @@ static int inic_port_start(struct ata_po
26480 return 0;
26481 }
26482
26483-static struct ata_port_operations inic_port_ops = {
26484+static const struct ata_port_operations inic_port_ops = {
26485 .inherits = &sata_port_ops,
26486
26487 .check_atapi_dma = inic_check_atapi_dma,
26488diff -urNp linux-2.6.39.2/drivers/ata/sata_mv.c linux-2.6.39.2/drivers/ata/sata_mv.c
26489--- linux-2.6.39.2/drivers/ata/sata_mv.c 2011-05-19 00:06:34.000000000 -0400
26490+++ linux-2.6.39.2/drivers/ata/sata_mv.c 2011-05-22 19:36:31.000000000 -0400
26491@@ -662,7 +662,7 @@ static struct scsi_host_template mv6_sht
26492 .dma_boundary = MV_DMA_BOUNDARY,
26493 };
26494
26495-static struct ata_port_operations mv5_ops = {
26496+static const struct ata_port_operations mv5_ops = {
26497 .inherits = &ata_sff_port_ops,
26498
26499 .lost_interrupt = ATA_OP_NULL,
26500@@ -682,7 +682,7 @@ static struct ata_port_operations mv5_op
26501 .port_stop = mv_port_stop,
26502 };
26503
26504-static struct ata_port_operations mv6_ops = {
26505+static const struct ata_port_operations mv6_ops = {
26506 .inherits = &ata_bmdma_port_ops,
26507
26508 .lost_interrupt = ATA_OP_NULL,
26509@@ -716,7 +716,7 @@ static struct ata_port_operations mv6_op
26510 .port_stop = mv_port_stop,
26511 };
26512
26513-static struct ata_port_operations mv_iie_ops = {
26514+static const struct ata_port_operations mv_iie_ops = {
26515 .inherits = &mv6_ops,
26516 .dev_config = ATA_OP_NULL,
26517 .qc_prep = mv_qc_prep_iie,
26518diff -urNp linux-2.6.39.2/drivers/ata/sata_nv.c linux-2.6.39.2/drivers/ata/sata_nv.c
26519--- linux-2.6.39.2/drivers/ata/sata_nv.c 2011-05-19 00:06:34.000000000 -0400
26520+++ linux-2.6.39.2/drivers/ata/sata_nv.c 2011-05-22 19:36:31.000000000 -0400
26521@@ -465,7 +465,7 @@ static struct scsi_host_template nv_swnc
26522 * cases. Define nv_hardreset() which only kicks in for post-boot
26523 * probing and use it for all variants.
26524 */
26525-static struct ata_port_operations nv_generic_ops = {
26526+static const struct ata_port_operations nv_generic_ops = {
26527 .inherits = &ata_bmdma_port_ops,
26528 .lost_interrupt = ATA_OP_NULL,
26529 .scr_read = nv_scr_read,
26530@@ -473,20 +473,20 @@ static struct ata_port_operations nv_gen
26531 .hardreset = nv_hardreset,
26532 };
26533
26534-static struct ata_port_operations nv_nf2_ops = {
26535+static const struct ata_port_operations nv_nf2_ops = {
26536 .inherits = &nv_generic_ops,
26537 .freeze = nv_nf2_freeze,
26538 .thaw = nv_nf2_thaw,
26539 };
26540
26541-static struct ata_port_operations nv_ck804_ops = {
26542+static const struct ata_port_operations nv_ck804_ops = {
26543 .inherits = &nv_generic_ops,
26544 .freeze = nv_ck804_freeze,
26545 .thaw = nv_ck804_thaw,
26546 .host_stop = nv_ck804_host_stop,
26547 };
26548
26549-static struct ata_port_operations nv_adma_ops = {
26550+static const struct ata_port_operations nv_adma_ops = {
26551 .inherits = &nv_ck804_ops,
26552
26553 .check_atapi_dma = nv_adma_check_atapi_dma,
26554@@ -510,7 +510,7 @@ static struct ata_port_operations nv_adm
26555 .host_stop = nv_adma_host_stop,
26556 };
26557
26558-static struct ata_port_operations nv_swncq_ops = {
26559+static const struct ata_port_operations nv_swncq_ops = {
26560 .inherits = &nv_generic_ops,
26561
26562 .qc_defer = ata_std_qc_defer,
26563diff -urNp linux-2.6.39.2/drivers/ata/sata_promise.c linux-2.6.39.2/drivers/ata/sata_promise.c
26564--- linux-2.6.39.2/drivers/ata/sata_promise.c 2011-05-19 00:06:34.000000000 -0400
26565+++ linux-2.6.39.2/drivers/ata/sata_promise.c 2011-05-22 19:36:31.000000000 -0400
26566@@ -194,7 +194,7 @@ static const struct ata_port_operations
26567 .error_handler = pdc_error_handler,
26568 };
26569
26570-static struct ata_port_operations pdc_sata_ops = {
26571+static const struct ata_port_operations pdc_sata_ops = {
26572 .inherits = &pdc_common_ops,
26573 .cable_detect = pdc_sata_cable_detect,
26574 .freeze = pdc_sata_freeze,
26575@@ -207,14 +207,14 @@ static struct ata_port_operations pdc_sa
26576
26577 /* First-generation chips need a more restrictive ->check_atapi_dma op,
26578 and ->freeze/thaw that ignore the hotplug controls. */
26579-static struct ata_port_operations pdc_old_sata_ops = {
26580+static const struct ata_port_operations pdc_old_sata_ops = {
26581 .inherits = &pdc_sata_ops,
26582 .freeze = pdc_freeze,
26583 .thaw = pdc_thaw,
26584 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
26585 };
26586
26587-static struct ata_port_operations pdc_pata_ops = {
26588+static const struct ata_port_operations pdc_pata_ops = {
26589 .inherits = &pdc_common_ops,
26590 .cable_detect = pdc_pata_cable_detect,
26591 .freeze = pdc_freeze,
26592diff -urNp linux-2.6.39.2/drivers/ata/sata_qstor.c linux-2.6.39.2/drivers/ata/sata_qstor.c
26593--- linux-2.6.39.2/drivers/ata/sata_qstor.c 2011-05-19 00:06:34.000000000 -0400
26594+++ linux-2.6.39.2/drivers/ata/sata_qstor.c 2011-05-22 19:36:31.000000000 -0400
26595@@ -131,7 +131,7 @@ static struct scsi_host_template qs_ata_
26596 .dma_boundary = QS_DMA_BOUNDARY,
26597 };
26598
26599-static struct ata_port_operations qs_ata_ops = {
26600+static const struct ata_port_operations qs_ata_ops = {
26601 .inherits = &ata_sff_port_ops,
26602
26603 .check_atapi_dma = qs_check_atapi_dma,
26604diff -urNp linux-2.6.39.2/drivers/ata/sata_sil24.c linux-2.6.39.2/drivers/ata/sata_sil24.c
26605--- linux-2.6.39.2/drivers/ata/sata_sil24.c 2011-05-19 00:06:34.000000000 -0400
26606+++ linux-2.6.39.2/drivers/ata/sata_sil24.c 2011-05-22 19:36:31.000000000 -0400
26607@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
26608 .dma_boundary = ATA_DMA_BOUNDARY,
26609 };
26610
26611-static struct ata_port_operations sil24_ops = {
26612+static const struct ata_port_operations sil24_ops = {
26613 .inherits = &sata_pmp_port_ops,
26614
26615 .qc_defer = sil24_qc_defer,
26616diff -urNp linux-2.6.39.2/drivers/ata/sata_sil.c linux-2.6.39.2/drivers/ata/sata_sil.c
26617--- linux-2.6.39.2/drivers/ata/sata_sil.c 2011-05-19 00:06:34.000000000 -0400
26618+++ linux-2.6.39.2/drivers/ata/sata_sil.c 2011-05-22 19:36:31.000000000 -0400
26619@@ -181,7 +181,7 @@ static struct scsi_host_template sil_sht
26620 .sg_tablesize = ATA_MAX_PRD
26621 };
26622
26623-static struct ata_port_operations sil_ops = {
26624+static const struct ata_port_operations sil_ops = {
26625 .inherits = &ata_bmdma32_port_ops,
26626 .dev_config = sil_dev_config,
26627 .set_mode = sil_set_mode,
26628diff -urNp linux-2.6.39.2/drivers/ata/sata_sis.c linux-2.6.39.2/drivers/ata/sata_sis.c
26629--- linux-2.6.39.2/drivers/ata/sata_sis.c 2011-05-19 00:06:34.000000000 -0400
26630+++ linux-2.6.39.2/drivers/ata/sata_sis.c 2011-05-22 19:36:31.000000000 -0400
26631@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
26632 ATA_BMDMA_SHT(DRV_NAME),
26633 };
26634
26635-static struct ata_port_operations sis_ops = {
26636+static const struct ata_port_operations sis_ops = {
26637 .inherits = &ata_bmdma_port_ops,
26638 .scr_read = sis_scr_read,
26639 .scr_write = sis_scr_write,
26640diff -urNp linux-2.6.39.2/drivers/ata/sata_svw.c linux-2.6.39.2/drivers/ata/sata_svw.c
26641--- linux-2.6.39.2/drivers/ata/sata_svw.c 2011-05-19 00:06:34.000000000 -0400
26642+++ linux-2.6.39.2/drivers/ata/sata_svw.c 2011-05-22 19:36:31.000000000 -0400
26643@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
26644 };
26645
26646
26647-static struct ata_port_operations k2_sata_ops = {
26648+static const struct ata_port_operations k2_sata_ops = {
26649 .inherits = &ata_bmdma_port_ops,
26650 .sff_tf_load = k2_sata_tf_load,
26651 .sff_tf_read = k2_sata_tf_read,
26652diff -urNp linux-2.6.39.2/drivers/ata/sata_sx4.c linux-2.6.39.2/drivers/ata/sata_sx4.c
26653--- linux-2.6.39.2/drivers/ata/sata_sx4.c 2011-05-19 00:06:34.000000000 -0400
26654+++ linux-2.6.39.2/drivers/ata/sata_sx4.c 2011-05-22 19:36:31.000000000 -0400
26655@@ -249,7 +249,7 @@ static struct scsi_host_template pdc_sat
26656 };
26657
26658 /* TODO: inherit from base port_ops after converting to new EH */
26659-static struct ata_port_operations pdc_20621_ops = {
26660+static const struct ata_port_operations pdc_20621_ops = {
26661 .inherits = &ata_sff_port_ops,
26662
26663 .check_atapi_dma = pdc_check_atapi_dma,
26664diff -urNp linux-2.6.39.2/drivers/ata/sata_uli.c linux-2.6.39.2/drivers/ata/sata_uli.c
26665--- linux-2.6.39.2/drivers/ata/sata_uli.c 2011-05-19 00:06:34.000000000 -0400
26666+++ linux-2.6.39.2/drivers/ata/sata_uli.c 2011-05-22 19:36:31.000000000 -0400
26667@@ -80,7 +80,7 @@ static struct scsi_host_template uli_sht
26668 ATA_BMDMA_SHT(DRV_NAME),
26669 };
26670
26671-static struct ata_port_operations uli_ops = {
26672+static const struct ata_port_operations uli_ops = {
26673 .inherits = &ata_bmdma_port_ops,
26674 .scr_read = uli_scr_read,
26675 .scr_write = uli_scr_write,
26676diff -urNp linux-2.6.39.2/drivers/ata/sata_via.c linux-2.6.39.2/drivers/ata/sata_via.c
26677--- linux-2.6.39.2/drivers/ata/sata_via.c 2011-05-19 00:06:34.000000000 -0400
26678+++ linux-2.6.39.2/drivers/ata/sata_via.c 2011-05-22 19:36:31.000000000 -0400
26679@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
26680 ATA_BMDMA_SHT(DRV_NAME),
26681 };
26682
26683-static struct ata_port_operations svia_base_ops = {
26684+static const struct ata_port_operations svia_base_ops = {
26685 .inherits = &ata_bmdma_port_ops,
26686 .sff_tf_load = svia_tf_load,
26687 };
26688
26689-static struct ata_port_operations vt6420_sata_ops = {
26690+static const struct ata_port_operations vt6420_sata_ops = {
26691 .inherits = &svia_base_ops,
26692 .freeze = svia_noop_freeze,
26693 .prereset = vt6420_prereset,
26694 .bmdma_start = vt6420_bmdma_start,
26695 };
26696
26697-static struct ata_port_operations vt6421_pata_ops = {
26698+static const struct ata_port_operations vt6421_pata_ops = {
26699 .inherits = &svia_base_ops,
26700 .cable_detect = vt6421_pata_cable_detect,
26701 .set_piomode = vt6421_set_pio_mode,
26702 .set_dmamode = vt6421_set_dma_mode,
26703 };
26704
26705-static struct ata_port_operations vt6421_sata_ops = {
26706+static const struct ata_port_operations vt6421_sata_ops = {
26707 .inherits = &svia_base_ops,
26708 .scr_read = svia_scr_read,
26709 .scr_write = svia_scr_write,
26710 };
26711
26712-static struct ata_port_operations vt8251_ops = {
26713+static const struct ata_port_operations vt8251_ops = {
26714 .inherits = &svia_base_ops,
26715 .hardreset = sata_std_hardreset,
26716 .scr_read = vt8251_scr_read,
26717diff -urNp linux-2.6.39.2/drivers/ata/sata_vsc.c linux-2.6.39.2/drivers/ata/sata_vsc.c
26718--- linux-2.6.39.2/drivers/ata/sata_vsc.c 2011-05-19 00:06:34.000000000 -0400
26719+++ linux-2.6.39.2/drivers/ata/sata_vsc.c 2011-05-22 19:36:31.000000000 -0400
26720@@ -300,7 +300,7 @@ static struct scsi_host_template vsc_sat
26721 };
26722
26723
26724-static struct ata_port_operations vsc_sata_ops = {
26725+static const struct ata_port_operations vsc_sata_ops = {
26726 .inherits = &ata_bmdma_port_ops,
26727 /* The IRQ handling is not quite standard SFF behaviour so we
26728 cannot use the default lost interrupt handler */
26729diff -urNp linux-2.6.39.2/drivers/atm/adummy.c linux-2.6.39.2/drivers/atm/adummy.c
26730--- linux-2.6.39.2/drivers/atm/adummy.c 2011-05-19 00:06:34.000000000 -0400
26731+++ linux-2.6.39.2/drivers/atm/adummy.c 2011-05-22 19:36:31.000000000 -0400
26732@@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct
26733 vcc->pop(vcc, skb);
26734 else
26735 dev_kfree_skb_any(skb);
26736- atomic_inc(&vcc->stats->tx);
26737+ atomic_inc_unchecked(&vcc->stats->tx);
26738
26739 return 0;
26740 }
26741diff -urNp linux-2.6.39.2/drivers/atm/ambassador.c linux-2.6.39.2/drivers/atm/ambassador.c
26742--- linux-2.6.39.2/drivers/atm/ambassador.c 2011-05-19 00:06:34.000000000 -0400
26743+++ linux-2.6.39.2/drivers/atm/ambassador.c 2011-05-22 19:36:31.000000000 -0400
26744@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev,
26745 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
26746
26747 // VC layer stats
26748- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26749+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26750
26751 // free the descriptor
26752 kfree (tx_descr);
26753@@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev,
26754 dump_skb ("<<<", vc, skb);
26755
26756 // VC layer stats
26757- atomic_inc(&atm_vcc->stats->rx);
26758+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26759 __net_timestamp(skb);
26760 // end of our responsibility
26761 atm_vcc->push (atm_vcc, skb);
26762@@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev,
26763 } else {
26764 PRINTK (KERN_INFO, "dropped over-size frame");
26765 // should we count this?
26766- atomic_inc(&atm_vcc->stats->rx_drop);
26767+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26768 }
26769
26770 } else {
26771@@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at
26772 }
26773
26774 if (check_area (skb->data, skb->len)) {
26775- atomic_inc(&atm_vcc->stats->tx_err);
26776+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
26777 return -ENOMEM; // ?
26778 }
26779
26780diff -urNp linux-2.6.39.2/drivers/atm/atmtcp.c linux-2.6.39.2/drivers/atm/atmtcp.c
26781--- linux-2.6.39.2/drivers/atm/atmtcp.c 2011-05-19 00:06:34.000000000 -0400
26782+++ linux-2.6.39.2/drivers/atm/atmtcp.c 2011-05-22 19:36:31.000000000 -0400
26783@@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc
26784 if (vcc->pop) vcc->pop(vcc,skb);
26785 else dev_kfree_skb(skb);
26786 if (dev_data) return 0;
26787- atomic_inc(&vcc->stats->tx_err);
26788+ atomic_inc_unchecked(&vcc->stats->tx_err);
26789 return -ENOLINK;
26790 }
26791 size = skb->len+sizeof(struct atmtcp_hdr);
26792@@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc
26793 if (!new_skb) {
26794 if (vcc->pop) vcc->pop(vcc,skb);
26795 else dev_kfree_skb(skb);
26796- atomic_inc(&vcc->stats->tx_err);
26797+ atomic_inc_unchecked(&vcc->stats->tx_err);
26798 return -ENOBUFS;
26799 }
26800 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
26801@@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc
26802 if (vcc->pop) vcc->pop(vcc,skb);
26803 else dev_kfree_skb(skb);
26804 out_vcc->push(out_vcc,new_skb);
26805- atomic_inc(&vcc->stats->tx);
26806- atomic_inc(&out_vcc->stats->rx);
26807+ atomic_inc_unchecked(&vcc->stats->tx);
26808+ atomic_inc_unchecked(&out_vcc->stats->rx);
26809 return 0;
26810 }
26811
26812@@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc
26813 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
26814 read_unlock(&vcc_sklist_lock);
26815 if (!out_vcc) {
26816- atomic_inc(&vcc->stats->tx_err);
26817+ atomic_inc_unchecked(&vcc->stats->tx_err);
26818 goto done;
26819 }
26820 skb_pull(skb,sizeof(struct atmtcp_hdr));
26821@@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc
26822 __net_timestamp(new_skb);
26823 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
26824 out_vcc->push(out_vcc,new_skb);
26825- atomic_inc(&vcc->stats->tx);
26826- atomic_inc(&out_vcc->stats->rx);
26827+ atomic_inc_unchecked(&vcc->stats->tx);
26828+ atomic_inc_unchecked(&out_vcc->stats->rx);
26829 done:
26830 if (vcc->pop) vcc->pop(vcc,skb);
26831 else dev_kfree_skb(skb);
26832diff -urNp linux-2.6.39.2/drivers/atm/eni.c linux-2.6.39.2/drivers/atm/eni.c
26833--- linux-2.6.39.2/drivers/atm/eni.c 2011-05-19 00:06:34.000000000 -0400
26834+++ linux-2.6.39.2/drivers/atm/eni.c 2011-05-22 19:36:31.000000000 -0400
26835@@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
26836 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
26837 vcc->dev->number);
26838 length = 0;
26839- atomic_inc(&vcc->stats->rx_err);
26840+ atomic_inc_unchecked(&vcc->stats->rx_err);
26841 }
26842 else {
26843 length = ATM_CELL_SIZE-1; /* no HEC */
26844@@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26845 size);
26846 }
26847 eff = length = 0;
26848- atomic_inc(&vcc->stats->rx_err);
26849+ atomic_inc_unchecked(&vcc->stats->rx_err);
26850 }
26851 else {
26852 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
26853@@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26854 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
26855 vcc->dev->number,vcc->vci,length,size << 2,descr);
26856 length = eff = 0;
26857- atomic_inc(&vcc->stats->rx_err);
26858+ atomic_inc_unchecked(&vcc->stats->rx_err);
26859 }
26860 }
26861 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
26862@@ -771,7 +771,7 @@ rx_dequeued++;
26863 vcc->push(vcc,skb);
26864 pushed++;
26865 }
26866- atomic_inc(&vcc->stats->rx);
26867+ atomic_inc_unchecked(&vcc->stats->rx);
26868 }
26869 wake_up(&eni_dev->rx_wait);
26870 }
26871@@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d
26872 PCI_DMA_TODEVICE);
26873 if (vcc->pop) vcc->pop(vcc,skb);
26874 else dev_kfree_skb_irq(skb);
26875- atomic_inc(&vcc->stats->tx);
26876+ atomic_inc_unchecked(&vcc->stats->tx);
26877 wake_up(&eni_dev->tx_wait);
26878 dma_complete++;
26879 }
26880diff -urNp linux-2.6.39.2/drivers/atm/firestream.c linux-2.6.39.2/drivers/atm/firestream.c
26881--- linux-2.6.39.2/drivers/atm/firestream.c 2011-05-19 00:06:34.000000000 -0400
26882+++ linux-2.6.39.2/drivers/atm/firestream.c 2011-05-22 19:36:31.000000000 -0400
26883@@ -749,7 +749,7 @@ static void process_txdone_queue (struct
26884 }
26885 }
26886
26887- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26888+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26889
26890 fs_dprintk (FS_DEBUG_TXMEM, "i");
26891 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
26892@@ -816,7 +816,7 @@ static void process_incoming (struct fs_
26893 #endif
26894 skb_put (skb, qe->p1 & 0xffff);
26895 ATM_SKB(skb)->vcc = atm_vcc;
26896- atomic_inc(&atm_vcc->stats->rx);
26897+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26898 __net_timestamp(skb);
26899 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
26900 atm_vcc->push (atm_vcc, skb);
26901@@ -837,12 +837,12 @@ static void process_incoming (struct fs_
26902 kfree (pe);
26903 }
26904 if (atm_vcc)
26905- atomic_inc(&atm_vcc->stats->rx_drop);
26906+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26907 break;
26908 case 0x1f: /* Reassembly abort: no buffers. */
26909 /* Silently increment error counter. */
26910 if (atm_vcc)
26911- atomic_inc(&atm_vcc->stats->rx_drop);
26912+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26913 break;
26914 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
26915 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
26916diff -urNp linux-2.6.39.2/drivers/atm/fore200e.c linux-2.6.39.2/drivers/atm/fore200e.c
26917--- linux-2.6.39.2/drivers/atm/fore200e.c 2011-05-19 00:06:34.000000000 -0400
26918+++ linux-2.6.39.2/drivers/atm/fore200e.c 2011-05-22 19:36:31.000000000 -0400
26919@@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
26920 #endif
26921 /* check error condition */
26922 if (*entry->status & STATUS_ERROR)
26923- atomic_inc(&vcc->stats->tx_err);
26924+ atomic_inc_unchecked(&vcc->stats->tx_err);
26925 else
26926- atomic_inc(&vcc->stats->tx);
26927+ atomic_inc_unchecked(&vcc->stats->tx);
26928 }
26929 }
26930
26931@@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2
26932 if (skb == NULL) {
26933 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
26934
26935- atomic_inc(&vcc->stats->rx_drop);
26936+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26937 return -ENOMEM;
26938 }
26939
26940@@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2
26941
26942 dev_kfree_skb_any(skb);
26943
26944- atomic_inc(&vcc->stats->rx_drop);
26945+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26946 return -ENOMEM;
26947 }
26948
26949 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26950
26951 vcc->push(vcc, skb);
26952- atomic_inc(&vcc->stats->rx);
26953+ atomic_inc_unchecked(&vcc->stats->rx);
26954
26955 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26956
26957@@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200
26958 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
26959 fore200e->atm_dev->number,
26960 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
26961- atomic_inc(&vcc->stats->rx_err);
26962+ atomic_inc_unchecked(&vcc->stats->rx_err);
26963 }
26964 }
26965
26966@@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc
26967 goto retry_here;
26968 }
26969
26970- atomic_inc(&vcc->stats->tx_err);
26971+ atomic_inc_unchecked(&vcc->stats->tx_err);
26972
26973 fore200e->tx_sat++;
26974 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
26975diff -urNp linux-2.6.39.2/drivers/atm/he.c linux-2.6.39.2/drivers/atm/he.c
26976--- linux-2.6.39.2/drivers/atm/he.c 2011-05-19 00:06:34.000000000 -0400
26977+++ linux-2.6.39.2/drivers/atm/he.c 2011-05-22 19:36:31.000000000 -0400
26978@@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26979
26980 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
26981 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
26982- atomic_inc(&vcc->stats->rx_drop);
26983+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26984 goto return_host_buffers;
26985 }
26986
26987@@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26988 RBRQ_LEN_ERR(he_dev->rbrq_head)
26989 ? "LEN_ERR" : "",
26990 vcc->vpi, vcc->vci);
26991- atomic_inc(&vcc->stats->rx_err);
26992+ atomic_inc_unchecked(&vcc->stats->rx_err);
26993 goto return_host_buffers;
26994 }
26995
26996@@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26997 vcc->push(vcc, skb);
26998 spin_lock(&he_dev->global_lock);
26999
27000- atomic_inc(&vcc->stats->rx);
27001+ atomic_inc_unchecked(&vcc->stats->rx);
27002
27003 return_host_buffers:
27004 ++pdus_assembled;
27005@@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
27006 tpd->vcc->pop(tpd->vcc, tpd->skb);
27007 else
27008 dev_kfree_skb_any(tpd->skb);
27009- atomic_inc(&tpd->vcc->stats->tx_err);
27010+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
27011 }
27012 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
27013 return;
27014@@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27015 vcc->pop(vcc, skb);
27016 else
27017 dev_kfree_skb_any(skb);
27018- atomic_inc(&vcc->stats->tx_err);
27019+ atomic_inc_unchecked(&vcc->stats->tx_err);
27020 return -EINVAL;
27021 }
27022
27023@@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27024 vcc->pop(vcc, skb);
27025 else
27026 dev_kfree_skb_any(skb);
27027- atomic_inc(&vcc->stats->tx_err);
27028+ atomic_inc_unchecked(&vcc->stats->tx_err);
27029 return -EINVAL;
27030 }
27031 #endif
27032@@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27033 vcc->pop(vcc, skb);
27034 else
27035 dev_kfree_skb_any(skb);
27036- atomic_inc(&vcc->stats->tx_err);
27037+ atomic_inc_unchecked(&vcc->stats->tx_err);
27038 spin_unlock_irqrestore(&he_dev->global_lock, flags);
27039 return -ENOMEM;
27040 }
27041@@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27042 vcc->pop(vcc, skb);
27043 else
27044 dev_kfree_skb_any(skb);
27045- atomic_inc(&vcc->stats->tx_err);
27046+ atomic_inc_unchecked(&vcc->stats->tx_err);
27047 spin_unlock_irqrestore(&he_dev->global_lock, flags);
27048 return -ENOMEM;
27049 }
27050@@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27051 __enqueue_tpd(he_dev, tpd, cid);
27052 spin_unlock_irqrestore(&he_dev->global_lock, flags);
27053
27054- atomic_inc(&vcc->stats->tx);
27055+ atomic_inc_unchecked(&vcc->stats->tx);
27056
27057 return 0;
27058 }
27059diff -urNp linux-2.6.39.2/drivers/atm/horizon.c linux-2.6.39.2/drivers/atm/horizon.c
27060--- linux-2.6.39.2/drivers/atm/horizon.c 2011-05-19 00:06:34.000000000 -0400
27061+++ linux-2.6.39.2/drivers/atm/horizon.c 2011-05-22 19:36:31.000000000 -0400
27062@@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev,
27063 {
27064 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
27065 // VC layer stats
27066- atomic_inc(&vcc->stats->rx);
27067+ atomic_inc_unchecked(&vcc->stats->rx);
27068 __net_timestamp(skb);
27069 // end of our responsibility
27070 vcc->push (vcc, skb);
27071@@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const
27072 dev->tx_iovec = NULL;
27073
27074 // VC layer stats
27075- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27076+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27077
27078 // free the skb
27079 hrz_kfree_skb (skb);
27080diff -urNp linux-2.6.39.2/drivers/atm/idt77252.c linux-2.6.39.2/drivers/atm/idt77252.c
27081--- linux-2.6.39.2/drivers/atm/idt77252.c 2011-05-19 00:06:34.000000000 -0400
27082+++ linux-2.6.39.2/drivers/atm/idt77252.c 2011-05-22 19:36:31.000000000 -0400
27083@@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
27084 else
27085 dev_kfree_skb(skb);
27086
27087- atomic_inc(&vcc->stats->tx);
27088+ atomic_inc_unchecked(&vcc->stats->tx);
27089 }
27090
27091 atomic_dec(&scq->used);
27092@@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st
27093 if ((sb = dev_alloc_skb(64)) == NULL) {
27094 printk("%s: Can't allocate buffers for aal0.\n",
27095 card->name);
27096- atomic_add(i, &vcc->stats->rx_drop);
27097+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
27098 break;
27099 }
27100 if (!atm_charge(vcc, sb->truesize)) {
27101 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
27102 card->name);
27103- atomic_add(i - 1, &vcc->stats->rx_drop);
27104+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
27105 dev_kfree_skb(sb);
27106 break;
27107 }
27108@@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st
27109 ATM_SKB(sb)->vcc = vcc;
27110 __net_timestamp(sb);
27111 vcc->push(vcc, sb);
27112- atomic_inc(&vcc->stats->rx);
27113+ atomic_inc_unchecked(&vcc->stats->rx);
27114
27115 cell += ATM_CELL_PAYLOAD;
27116 }
27117@@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st
27118 "(CDC: %08x)\n",
27119 card->name, len, rpp->len, readl(SAR_REG_CDC));
27120 recycle_rx_pool_skb(card, rpp);
27121- atomic_inc(&vcc->stats->rx_err);
27122+ atomic_inc_unchecked(&vcc->stats->rx_err);
27123 return;
27124 }
27125 if (stat & SAR_RSQE_CRC) {
27126 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
27127 recycle_rx_pool_skb(card, rpp);
27128- atomic_inc(&vcc->stats->rx_err);
27129+ atomic_inc_unchecked(&vcc->stats->rx_err);
27130 return;
27131 }
27132 if (skb_queue_len(&rpp->queue) > 1) {
27133@@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st
27134 RXPRINTK("%s: Can't alloc RX skb.\n",
27135 card->name);
27136 recycle_rx_pool_skb(card, rpp);
27137- atomic_inc(&vcc->stats->rx_err);
27138+ atomic_inc_unchecked(&vcc->stats->rx_err);
27139 return;
27140 }
27141 if (!atm_charge(vcc, skb->truesize)) {
27142@@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st
27143 __net_timestamp(skb);
27144
27145 vcc->push(vcc, skb);
27146- atomic_inc(&vcc->stats->rx);
27147+ atomic_inc_unchecked(&vcc->stats->rx);
27148
27149 return;
27150 }
27151@@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st
27152 __net_timestamp(skb);
27153
27154 vcc->push(vcc, skb);
27155- atomic_inc(&vcc->stats->rx);
27156+ atomic_inc_unchecked(&vcc->stats->rx);
27157
27158 if (skb->truesize > SAR_FB_SIZE_3)
27159 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
27160@@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *car
27161 if (vcc->qos.aal != ATM_AAL0) {
27162 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
27163 card->name, vpi, vci);
27164- atomic_inc(&vcc->stats->rx_drop);
27165+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27166 goto drop;
27167 }
27168
27169 if ((sb = dev_alloc_skb(64)) == NULL) {
27170 printk("%s: Can't allocate buffers for AAL0.\n",
27171 card->name);
27172- atomic_inc(&vcc->stats->rx_err);
27173+ atomic_inc_unchecked(&vcc->stats->rx_err);
27174 goto drop;
27175 }
27176
27177@@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *car
27178 ATM_SKB(sb)->vcc = vcc;
27179 __net_timestamp(sb);
27180 vcc->push(vcc, sb);
27181- atomic_inc(&vcc->stats->rx);
27182+ atomic_inc_unchecked(&vcc->stats->rx);
27183
27184 drop:
27185 skb_pull(queue, 64);
27186@@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27187
27188 if (vc == NULL) {
27189 printk("%s: NULL connection in send().\n", card->name);
27190- atomic_inc(&vcc->stats->tx_err);
27191+ atomic_inc_unchecked(&vcc->stats->tx_err);
27192 dev_kfree_skb(skb);
27193 return -EINVAL;
27194 }
27195 if (!test_bit(VCF_TX, &vc->flags)) {
27196 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
27197- atomic_inc(&vcc->stats->tx_err);
27198+ atomic_inc_unchecked(&vcc->stats->tx_err);
27199 dev_kfree_skb(skb);
27200 return -EINVAL;
27201 }
27202@@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27203 break;
27204 default:
27205 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
27206- atomic_inc(&vcc->stats->tx_err);
27207+ atomic_inc_unchecked(&vcc->stats->tx_err);
27208 dev_kfree_skb(skb);
27209 return -EINVAL;
27210 }
27211
27212 if (skb_shinfo(skb)->nr_frags != 0) {
27213 printk("%s: No scatter-gather yet.\n", card->name);
27214- atomic_inc(&vcc->stats->tx_err);
27215+ atomic_inc_unchecked(&vcc->stats->tx_err);
27216 dev_kfree_skb(skb);
27217 return -EINVAL;
27218 }
27219@@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27220
27221 err = queue_skb(card, vc, skb, oam);
27222 if (err) {
27223- atomic_inc(&vcc->stats->tx_err);
27224+ atomic_inc_unchecked(&vcc->stats->tx_err);
27225 dev_kfree_skb(skb);
27226 return err;
27227 }
27228@@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
27229 skb = dev_alloc_skb(64);
27230 if (!skb) {
27231 printk("%s: Out of memory in send_oam().\n", card->name);
27232- atomic_inc(&vcc->stats->tx_err);
27233+ atomic_inc_unchecked(&vcc->stats->tx_err);
27234 return -ENOMEM;
27235 }
27236 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
27237diff -urNp linux-2.6.39.2/drivers/atm/iphase.c linux-2.6.39.2/drivers/atm/iphase.c
27238--- linux-2.6.39.2/drivers/atm/iphase.c 2011-05-19 00:06:34.000000000 -0400
27239+++ linux-2.6.39.2/drivers/atm/iphase.c 2011-05-22 19:36:31.000000000 -0400
27240@@ -1124,7 +1124,7 @@ static int rx_pkt(struct atm_dev *dev)
27241 status = (u_short) (buf_desc_ptr->desc_mode);
27242 if (status & (RX_CER | RX_PTE | RX_OFL))
27243 {
27244- atomic_inc(&vcc->stats->rx_err);
27245+ atomic_inc_unchecked(&vcc->stats->rx_err);
27246 IF_ERR(printk("IA: bad packet, dropping it");)
27247 if (status & RX_CER) {
27248 IF_ERR(printk(" cause: packet CRC error\n");)
27249@@ -1147,7 +1147,7 @@ static int rx_pkt(struct atm_dev *dev)
27250 len = dma_addr - buf_addr;
27251 if (len > iadev->rx_buf_sz) {
27252 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
27253- atomic_inc(&vcc->stats->rx_err);
27254+ atomic_inc_unchecked(&vcc->stats->rx_err);
27255 goto out_free_desc;
27256 }
27257
27258@@ -1297,7 +1297,7 @@ static void rx_dle_intr(struct atm_dev *
27259 ia_vcc = INPH_IA_VCC(vcc);
27260 if (ia_vcc == NULL)
27261 {
27262- atomic_inc(&vcc->stats->rx_err);
27263+ atomic_inc_unchecked(&vcc->stats->rx_err);
27264 dev_kfree_skb_any(skb);
27265 atm_return(vcc, atm_guess_pdu2truesize(len));
27266 goto INCR_DLE;
27267@@ -1309,7 +1309,7 @@ static void rx_dle_intr(struct atm_dev *
27268 if ((length > iadev->rx_buf_sz) || (length >
27269 (skb->len - sizeof(struct cpcs_trailer))))
27270 {
27271- atomic_inc(&vcc->stats->rx_err);
27272+ atomic_inc_unchecked(&vcc->stats->rx_err);
27273 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
27274 length, skb->len);)
27275 dev_kfree_skb_any(skb);
27276@@ -1325,7 +1325,7 @@ static void rx_dle_intr(struct atm_dev *
27277
27278 IF_RX(printk("rx_dle_intr: skb push");)
27279 vcc->push(vcc,skb);
27280- atomic_inc(&vcc->stats->rx);
27281+ atomic_inc_unchecked(&vcc->stats->rx);
27282 iadev->rx_pkt_cnt++;
27283 }
27284 INCR_DLE:
27285@@ -2807,15 +2807,15 @@ static int ia_ioctl(struct atm_dev *dev,
27286 {
27287 struct k_sonet_stats *stats;
27288 stats = &PRIV(_ia_dev[board])->sonet_stats;
27289- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
27290- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
27291- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
27292- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
27293- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
27294- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
27295- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
27296- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
27297- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
27298+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
27299+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
27300+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
27301+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
27302+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
27303+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
27304+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
27305+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
27306+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
27307 }
27308 ia_cmds.status = 0;
27309 break;
27310@@ -2920,7 +2920,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
27311 if ((desc == 0) || (desc > iadev->num_tx_desc))
27312 {
27313 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
27314- atomic_inc(&vcc->stats->tx);
27315+ atomic_inc_unchecked(&vcc->stats->tx);
27316 if (vcc->pop)
27317 vcc->pop(vcc, skb);
27318 else
27319@@ -3025,14 +3025,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
27320 ATM_DESC(skb) = vcc->vci;
27321 skb_queue_tail(&iadev->tx_dma_q, skb);
27322
27323- atomic_inc(&vcc->stats->tx);
27324+ atomic_inc_unchecked(&vcc->stats->tx);
27325 iadev->tx_pkt_cnt++;
27326 /* Increment transaction counter */
27327 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
27328
27329 #if 0
27330 /* add flow control logic */
27331- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
27332+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
27333 if (iavcc->vc_desc_cnt > 10) {
27334 vcc->tx_quota = vcc->tx_quota * 3 / 4;
27335 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
27336diff -urNp linux-2.6.39.2/drivers/atm/lanai.c linux-2.6.39.2/drivers/atm/lanai.c
27337--- linux-2.6.39.2/drivers/atm/lanai.c 2011-05-19 00:06:34.000000000 -0400
27338+++ linux-2.6.39.2/drivers/atm/lanai.c 2011-05-22 19:36:31.000000000 -0400
27339@@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
27340 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
27341 lanai_endtx(lanai, lvcc);
27342 lanai_free_skb(lvcc->tx.atmvcc, skb);
27343- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
27344+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
27345 }
27346
27347 /* Try to fill the buffer - don't call unless there is backlog */
27348@@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc
27349 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
27350 __net_timestamp(skb);
27351 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
27352- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
27353+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
27354 out:
27355 lvcc->rx.buf.ptr = end;
27356 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
27357@@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d
27358 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
27359 "vcc %d\n", lanai->number, (unsigned int) s, vci);
27360 lanai->stats.service_rxnotaal5++;
27361- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27362+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27363 return 0;
27364 }
27365 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
27366@@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d
27367 int bytes;
27368 read_unlock(&vcc_sklist_lock);
27369 DPRINTK("got trashed rx pdu on vci %d\n", vci);
27370- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27371+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27372 lvcc->stats.x.aal5.service_trash++;
27373 bytes = (SERVICE_GET_END(s) * 16) -
27374 (((unsigned long) lvcc->rx.buf.ptr) -
27375@@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d
27376 }
27377 if (s & SERVICE_STREAM) {
27378 read_unlock(&vcc_sklist_lock);
27379- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27380+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27381 lvcc->stats.x.aal5.service_stream++;
27382 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
27383 "PDU on VCI %d!\n", lanai->number, vci);
27384@@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d
27385 return 0;
27386 }
27387 DPRINTK("got rx crc error on vci %d\n", vci);
27388- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27389+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27390 lvcc->stats.x.aal5.service_rxcrc++;
27391 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
27392 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
27393diff -urNp linux-2.6.39.2/drivers/atm/nicstar.c linux-2.6.39.2/drivers/atm/nicstar.c
27394--- linux-2.6.39.2/drivers/atm/nicstar.c 2011-05-19 00:06:34.000000000 -0400
27395+++ linux-2.6.39.2/drivers/atm/nicstar.c 2011-05-22 19:36:31.000000000 -0400
27396@@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc,
27397 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
27398 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
27399 card->index);
27400- atomic_inc(&vcc->stats->tx_err);
27401+ atomic_inc_unchecked(&vcc->stats->tx_err);
27402 dev_kfree_skb_any(skb);
27403 return -EINVAL;
27404 }
27405@@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc,
27406 if (!vc->tx) {
27407 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
27408 card->index);
27409- atomic_inc(&vcc->stats->tx_err);
27410+ atomic_inc_unchecked(&vcc->stats->tx_err);
27411 dev_kfree_skb_any(skb);
27412 return -EINVAL;
27413 }
27414@@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc,
27415 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
27416 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
27417 card->index);
27418- atomic_inc(&vcc->stats->tx_err);
27419+ atomic_inc_unchecked(&vcc->stats->tx_err);
27420 dev_kfree_skb_any(skb);
27421 return -EINVAL;
27422 }
27423
27424 if (skb_shinfo(skb)->nr_frags != 0) {
27425 printk("nicstar%d: No scatter-gather yet.\n", card->index);
27426- atomic_inc(&vcc->stats->tx_err);
27427+ atomic_inc_unchecked(&vcc->stats->tx_err);
27428 dev_kfree_skb_any(skb);
27429 return -EINVAL;
27430 }
27431@@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc,
27432 }
27433
27434 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
27435- atomic_inc(&vcc->stats->tx_err);
27436+ atomic_inc_unchecked(&vcc->stats->tx_err);
27437 dev_kfree_skb_any(skb);
27438 return -EIO;
27439 }
27440- atomic_inc(&vcc->stats->tx);
27441+ atomic_inc_unchecked(&vcc->stats->tx);
27442
27443 return 0;
27444 }
27445@@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns
27446 printk
27447 ("nicstar%d: Can't allocate buffers for aal0.\n",
27448 card->index);
27449- atomic_add(i, &vcc->stats->rx_drop);
27450+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
27451 break;
27452 }
27453 if (!atm_charge(vcc, sb->truesize)) {
27454 RXPRINTK
27455 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
27456 card->index);
27457- atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27458+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27459 dev_kfree_skb_any(sb);
27460 break;
27461 }
27462@@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns
27463 ATM_SKB(sb)->vcc = vcc;
27464 __net_timestamp(sb);
27465 vcc->push(vcc, sb);
27466- atomic_inc(&vcc->stats->rx);
27467+ atomic_inc_unchecked(&vcc->stats->rx);
27468 cell += ATM_CELL_PAYLOAD;
27469 }
27470
27471@@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns
27472 if (iovb == NULL) {
27473 printk("nicstar%d: Out of iovec buffers.\n",
27474 card->index);
27475- atomic_inc(&vcc->stats->rx_drop);
27476+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27477 recycle_rx_buf(card, skb);
27478 return;
27479 }
27480@@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns
27481 small or large buffer itself. */
27482 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
27483 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
27484- atomic_inc(&vcc->stats->rx_err);
27485+ atomic_inc_unchecked(&vcc->stats->rx_err);
27486 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27487 NS_MAX_IOVECS);
27488 NS_PRV_IOVCNT(iovb) = 0;
27489@@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns
27490 ("nicstar%d: Expected a small buffer, and this is not one.\n",
27491 card->index);
27492 which_list(card, skb);
27493- atomic_inc(&vcc->stats->rx_err);
27494+ atomic_inc_unchecked(&vcc->stats->rx_err);
27495 recycle_rx_buf(card, skb);
27496 vc->rx_iov = NULL;
27497 recycle_iov_buf(card, iovb);
27498@@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns
27499 ("nicstar%d: Expected a large buffer, and this is not one.\n",
27500 card->index);
27501 which_list(card, skb);
27502- atomic_inc(&vcc->stats->rx_err);
27503+ atomic_inc_unchecked(&vcc->stats->rx_err);
27504 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27505 NS_PRV_IOVCNT(iovb));
27506 vc->rx_iov = NULL;
27507@@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns
27508 printk(" - PDU size mismatch.\n");
27509 else
27510 printk(".\n");
27511- atomic_inc(&vcc->stats->rx_err);
27512+ atomic_inc_unchecked(&vcc->stats->rx_err);
27513 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27514 NS_PRV_IOVCNT(iovb));
27515 vc->rx_iov = NULL;
27516@@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns
27517 /* skb points to a small buffer */
27518 if (!atm_charge(vcc, skb->truesize)) {
27519 push_rxbufs(card, skb);
27520- atomic_inc(&vcc->stats->rx_drop);
27521+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27522 } else {
27523 skb_put(skb, len);
27524 dequeue_sm_buf(card, skb);
27525@@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns
27526 ATM_SKB(skb)->vcc = vcc;
27527 __net_timestamp(skb);
27528 vcc->push(vcc, skb);
27529- atomic_inc(&vcc->stats->rx);
27530+ atomic_inc_unchecked(&vcc->stats->rx);
27531 }
27532 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
27533 struct sk_buff *sb;
27534@@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns
27535 if (len <= NS_SMBUFSIZE) {
27536 if (!atm_charge(vcc, sb->truesize)) {
27537 push_rxbufs(card, sb);
27538- atomic_inc(&vcc->stats->rx_drop);
27539+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27540 } else {
27541 skb_put(sb, len);
27542 dequeue_sm_buf(card, sb);
27543@@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns
27544 ATM_SKB(sb)->vcc = vcc;
27545 __net_timestamp(sb);
27546 vcc->push(vcc, sb);
27547- atomic_inc(&vcc->stats->rx);
27548+ atomic_inc_unchecked(&vcc->stats->rx);
27549 }
27550
27551 push_rxbufs(card, skb);
27552@@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns
27553
27554 if (!atm_charge(vcc, skb->truesize)) {
27555 push_rxbufs(card, skb);
27556- atomic_inc(&vcc->stats->rx_drop);
27557+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27558 } else {
27559 dequeue_lg_buf(card, skb);
27560 #ifdef NS_USE_DESTRUCTORS
27561@@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns
27562 ATM_SKB(skb)->vcc = vcc;
27563 __net_timestamp(skb);
27564 vcc->push(vcc, skb);
27565- atomic_inc(&vcc->stats->rx);
27566+ atomic_inc_unchecked(&vcc->stats->rx);
27567 }
27568
27569 push_rxbufs(card, sb);
27570@@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns
27571 printk
27572 ("nicstar%d: Out of huge buffers.\n",
27573 card->index);
27574- atomic_inc(&vcc->stats->rx_drop);
27575+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27576 recycle_iovec_rx_bufs(card,
27577 (struct iovec *)
27578 iovb->data,
27579@@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns
27580 card->hbpool.count++;
27581 } else
27582 dev_kfree_skb_any(hb);
27583- atomic_inc(&vcc->stats->rx_drop);
27584+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27585 } else {
27586 /* Copy the small buffer to the huge buffer */
27587 sb = (struct sk_buff *)iov->iov_base;
27588@@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns
27589 #endif /* NS_USE_DESTRUCTORS */
27590 __net_timestamp(hb);
27591 vcc->push(vcc, hb);
27592- atomic_inc(&vcc->stats->rx);
27593+ atomic_inc_unchecked(&vcc->stats->rx);
27594 }
27595 }
27596
27597diff -urNp linux-2.6.39.2/drivers/atm/solos-pci.c linux-2.6.39.2/drivers/atm/solos-pci.c
27598--- linux-2.6.39.2/drivers/atm/solos-pci.c 2011-05-19 00:06:34.000000000 -0400
27599+++ linux-2.6.39.2/drivers/atm/solos-pci.c 2011-05-22 19:36:31.000000000 -0400
27600@@ -715,7 +715,7 @@ void solos_bh(unsigned long card_arg)
27601 }
27602 atm_charge(vcc, skb->truesize);
27603 vcc->push(vcc, skb);
27604- atomic_inc(&vcc->stats->rx);
27605+ atomic_inc_unchecked(&vcc->stats->rx);
27606 break;
27607
27608 case PKT_STATUS:
27609@@ -900,6 +900,8 @@ static int print_buffer(struct sk_buff *
27610 char msg[500];
27611 char item[10];
27612
27613+ pax_track_stack();
27614+
27615 len = buf->len;
27616 for (i = 0; i < len; i++){
27617 if(i % 8 == 0)
27618@@ -1009,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
27619 vcc = SKB_CB(oldskb)->vcc;
27620
27621 if (vcc) {
27622- atomic_inc(&vcc->stats->tx);
27623+ atomic_inc_unchecked(&vcc->stats->tx);
27624 solos_pop(vcc, oldskb);
27625 } else
27626 dev_kfree_skb_irq(oldskb);
27627diff -urNp linux-2.6.39.2/drivers/atm/suni.c linux-2.6.39.2/drivers/atm/suni.c
27628--- linux-2.6.39.2/drivers/atm/suni.c 2011-05-19 00:06:34.000000000 -0400
27629+++ linux-2.6.39.2/drivers/atm/suni.c 2011-05-22 19:36:31.000000000 -0400
27630@@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
27631
27632
27633 #define ADD_LIMITED(s,v) \
27634- atomic_add((v),&stats->s); \
27635- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
27636+ atomic_add_unchecked((v),&stats->s); \
27637+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
27638
27639
27640 static void suni_hz(unsigned long from_timer)
27641diff -urNp linux-2.6.39.2/drivers/atm/uPD98402.c linux-2.6.39.2/drivers/atm/uPD98402.c
27642--- linux-2.6.39.2/drivers/atm/uPD98402.c 2011-05-19 00:06:34.000000000 -0400
27643+++ linux-2.6.39.2/drivers/atm/uPD98402.c 2011-05-22 19:36:31.000000000 -0400
27644@@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
27645 struct sonet_stats tmp;
27646 int error = 0;
27647
27648- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27649+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27650 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
27651 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
27652 if (zero && !error) {
27653@@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev
27654
27655
27656 #define ADD_LIMITED(s,v) \
27657- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
27658- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
27659- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27660+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
27661+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
27662+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27663
27664
27665 static void stat_event(struct atm_dev *dev)
27666@@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev
27667 if (reason & uPD98402_INT_PFM) stat_event(dev);
27668 if (reason & uPD98402_INT_PCO) {
27669 (void) GET(PCOCR); /* clear interrupt cause */
27670- atomic_add(GET(HECCT),
27671+ atomic_add_unchecked(GET(HECCT),
27672 &PRIV(dev)->sonet_stats.uncorr_hcs);
27673 }
27674 if ((reason & uPD98402_INT_RFO) &&
27675@@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev
27676 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
27677 uPD98402_INT_LOS),PIMR); /* enable them */
27678 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
27679- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27680- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
27681- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
27682+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27683+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
27684+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
27685 return 0;
27686 }
27687
27688diff -urNp linux-2.6.39.2/drivers/atm/zatm.c linux-2.6.39.2/drivers/atm/zatm.c
27689--- linux-2.6.39.2/drivers/atm/zatm.c 2011-05-19 00:06:34.000000000 -0400
27690+++ linux-2.6.39.2/drivers/atm/zatm.c 2011-05-22 19:36:31.000000000 -0400
27691@@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27692 }
27693 if (!size) {
27694 dev_kfree_skb_irq(skb);
27695- if (vcc) atomic_inc(&vcc->stats->rx_err);
27696+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
27697 continue;
27698 }
27699 if (!atm_charge(vcc,skb->truesize)) {
27700@@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27701 skb->len = size;
27702 ATM_SKB(skb)->vcc = vcc;
27703 vcc->push(vcc,skb);
27704- atomic_inc(&vcc->stats->rx);
27705+ atomic_inc_unchecked(&vcc->stats->rx);
27706 }
27707 zout(pos & 0xffff,MTA(mbx));
27708 #if 0 /* probably a stupid idea */
27709@@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
27710 skb_queue_head(&zatm_vcc->backlog,skb);
27711 break;
27712 }
27713- atomic_inc(&vcc->stats->tx);
27714+ atomic_inc_unchecked(&vcc->stats->tx);
27715 wake_up(&zatm_vcc->tx_wait);
27716 }
27717
27718diff -urNp linux-2.6.39.2/drivers/base/iommu.c linux-2.6.39.2/drivers/base/iommu.c
27719--- linux-2.6.39.2/drivers/base/iommu.c 2011-05-19 00:06:34.000000000 -0400
27720+++ linux-2.6.39.2/drivers/base/iommu.c 2011-05-22 19:36:31.000000000 -0400
27721@@ -23,9 +23,8 @@
27722 #include <linux/errno.h>
27723 #include <linux/iommu.h>
27724
27725-static struct iommu_ops *iommu_ops;
27726-
27727-void register_iommu(struct iommu_ops *ops)
27728+static const struct iommu_ops *iommu_ops;
27729+void register_iommu(const struct iommu_ops *ops)
27730 {
27731 if (iommu_ops)
27732 BUG();
27733diff -urNp linux-2.6.39.2/drivers/base/power/generic_ops.c linux-2.6.39.2/drivers/base/power/generic_ops.c
27734--- linux-2.6.39.2/drivers/base/power/generic_ops.c 2011-05-19 00:06:34.000000000 -0400
27735+++ linux-2.6.39.2/drivers/base/power/generic_ops.c 2011-05-22 19:36:31.000000000 -0400
27736@@ -215,7 +215,7 @@ int pm_generic_restore(struct device *de
27737 EXPORT_SYMBOL_GPL(pm_generic_restore);
27738 #endif /* CONFIG_PM_SLEEP */
27739
27740-struct dev_pm_ops generic_subsys_pm_ops = {
27741+const struct dev_pm_ops generic_subsys_pm_ops = {
27742 #ifdef CONFIG_PM_SLEEP
27743 .suspend = pm_generic_suspend,
27744 .resume = pm_generic_resume,
27745diff -urNp linux-2.6.39.2/drivers/base/power/wakeup.c linux-2.6.39.2/drivers/base/power/wakeup.c
27746--- linux-2.6.39.2/drivers/base/power/wakeup.c 2011-05-19 00:06:34.000000000 -0400
27747+++ linux-2.6.39.2/drivers/base/power/wakeup.c 2011-05-22 19:36:31.000000000 -0400
27748@@ -29,14 +29,14 @@ bool events_check_enabled;
27749 * They need to be modified together atomically, so it's better to use one
27750 * atomic variable to hold them both.
27751 */
27752-static atomic_t combined_event_count = ATOMIC_INIT(0);
27753+static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
27754
27755 #define IN_PROGRESS_BITS (sizeof(int) * 4)
27756 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
27757
27758 static void split_counters(unsigned int *cnt, unsigned int *inpr)
27759 {
27760- unsigned int comb = atomic_read(&combined_event_count);
27761+ unsigned int comb = atomic_read_unchecked(&combined_event_count);
27762
27763 *cnt = (comb >> IN_PROGRESS_BITS);
27764 *inpr = comb & MAX_IN_PROGRESS;
27765@@ -351,7 +351,7 @@ static void wakeup_source_activate(struc
27766 ws->last_time = ktime_get();
27767
27768 /* Increment the counter of events in progress. */
27769- atomic_inc(&combined_event_count);
27770+ atomic_inc_unchecked(&combined_event_count);
27771 }
27772
27773 /**
27774@@ -441,7 +441,7 @@ static void wakeup_source_deactivate(str
27775 * Increment the counter of registered wakeup events and decrement the
27776 * couter of wakeup events in progress simultaneously.
27777 */
27778- atomic_add(MAX_IN_PROGRESS, &combined_event_count);
27779+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
27780 }
27781
27782 /**
27783diff -urNp linux-2.6.39.2/drivers/block/cciss.c linux-2.6.39.2/drivers/block/cciss.c
27784--- linux-2.6.39.2/drivers/block/cciss.c 2011-05-19 00:06:34.000000000 -0400
27785+++ linux-2.6.39.2/drivers/block/cciss.c 2011-05-22 19:41:32.000000000 -0400
27786@@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_devic
27787 * product = Marketing Name for the board
27788 * access = Address of the struct of function pointers
27789 */
27790-static struct board_type products[] = {
27791+static const struct board_type products[] = {
27792 {0x40700E11, "Smart Array 5300", &SA5_access},
27793 {0x40800E11, "Smart Array 5i", &SA5B_access},
27794 {0x40820E11, "Smart Array 532", &SA5B_access},
27795@@ -1151,6 +1151,8 @@ static int cciss_ioctl32_passthru(struct
27796 int err;
27797 u32 cp;
27798
27799+ memset(&arg64, 0, sizeof(arg64));
27800+
27801 err = 0;
27802 err |=
27803 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
27804diff -urNp linux-2.6.39.2/drivers/block/cciss.h linux-2.6.39.2/drivers/block/cciss.h
27805--- linux-2.6.39.2/drivers/block/cciss.h 2011-05-19 00:06:34.000000000 -0400
27806+++ linux-2.6.39.2/drivers/block/cciss.h 2011-05-22 19:36:31.000000000 -0400
27807@@ -393,7 +393,7 @@ static bool SA5_performant_intr_pending(
27808 return register_value & SA5_OUTDB_STATUS_PERF_BIT;
27809 }
27810
27811-static struct access_method SA5_access = {
27812+static const struct access_method SA5_access = {
27813 SA5_submit_command,
27814 SA5_intr_mask,
27815 SA5_fifo_full,
27816@@ -401,7 +401,7 @@ static struct access_method SA5_access =
27817 SA5_completed,
27818 };
27819
27820-static struct access_method SA5B_access = {
27821+static const struct access_method SA5B_access = {
27822 SA5_submit_command,
27823 SA5B_intr_mask,
27824 SA5_fifo_full,
27825@@ -409,7 +409,7 @@ static struct access_method SA5B_access
27826 SA5_completed,
27827 };
27828
27829-static struct access_method SA5_performant_access = {
27830+static const struct access_method SA5_performant_access = {
27831 SA5_submit_command,
27832 SA5_performant_intr_mask,
27833 SA5_fifo_full,
27834@@ -420,7 +420,7 @@ static struct access_method SA5_performa
27835 struct board_type {
27836 __u32 board_id;
27837 char *product_name;
27838- struct access_method *access;
27839+ const struct access_method *access;
27840 int nr_cmds; /* Max cmds this kind of ctlr can handle. */
27841 };
27842
27843diff -urNp linux-2.6.39.2/drivers/block/cpqarray.c linux-2.6.39.2/drivers/block/cpqarray.c
27844--- linux-2.6.39.2/drivers/block/cpqarray.c 2011-05-19 00:06:34.000000000 -0400
27845+++ linux-2.6.39.2/drivers/block/cpqarray.c 2011-05-22 19:36:31.000000000 -0400
27846@@ -80,7 +80,7 @@ static int eisa[8];
27847 * product = Marketing Name for the board
27848 * access = Address of the struct of function pointers
27849 */
27850-static struct board_type products[] = {
27851+static const struct board_type products[] = {
27852 { 0x0040110E, "IDA", &smart1_access },
27853 { 0x0140110E, "IDA-2", &smart1_access },
27854 { 0x1040110E, "IAES", &smart1_access },
27855@@ -911,6 +911,8 @@ static void do_ida_request(struct reques
27856 struct scatterlist tmp_sg[SG_MAX];
27857 int i, dir, seg;
27858
27859+ pax_track_stack();
27860+
27861 queue_next:
27862 creq = blk_peek_request(q);
27863 if (!creq)
27864diff -urNp linux-2.6.39.2/drivers/block/cpqarray.h linux-2.6.39.2/drivers/block/cpqarray.h
27865--- linux-2.6.39.2/drivers/block/cpqarray.h 2011-05-19 00:06:34.000000000 -0400
27866+++ linux-2.6.39.2/drivers/block/cpqarray.h 2011-05-22 19:36:31.000000000 -0400
27867@@ -69,7 +69,7 @@ struct access_method {
27868 struct board_type {
27869 __u32 board_id;
27870 char *product_name;
27871- struct access_method *access;
27872+ const struct access_method *access;
27873 };
27874
27875 struct ctlr_info {
27876diff -urNp linux-2.6.39.2/drivers/block/DAC960.c linux-2.6.39.2/drivers/block/DAC960.c
27877--- linux-2.6.39.2/drivers/block/DAC960.c 2011-05-19 00:06:34.000000000 -0400
27878+++ linux-2.6.39.2/drivers/block/DAC960.c 2011-05-22 19:36:31.000000000 -0400
27879@@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur
27880 unsigned long flags;
27881 int Channel, TargetID;
27882
27883+ pax_track_stack();
27884+
27885 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
27886 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
27887 sizeof(DAC960_SCSI_Inquiry_T) +
27888diff -urNp linux-2.6.39.2/drivers/block/drbd/drbd_int.h linux-2.6.39.2/drivers/block/drbd/drbd_int.h
27889--- linux-2.6.39.2/drivers/block/drbd/drbd_int.h 2011-05-19 00:06:34.000000000 -0400
27890+++ linux-2.6.39.2/drivers/block/drbd/drbd_int.h 2011-05-22 19:36:31.000000000 -0400
27891@@ -736,7 +736,7 @@ struct drbd_request;
27892 struct drbd_epoch {
27893 struct list_head list;
27894 unsigned int barrier_nr;
27895- atomic_t epoch_size; /* increased on every request added. */
27896+ atomic_unchecked_t epoch_size; /* increased on every request added. */
27897 atomic_t active; /* increased on every req. added, and dec on every finished. */
27898 unsigned long flags;
27899 };
27900@@ -1108,7 +1108,7 @@ struct drbd_conf {
27901 void *int_dig_in;
27902 void *int_dig_vv;
27903 wait_queue_head_t seq_wait;
27904- atomic_t packet_seq;
27905+ atomic_unchecked_t packet_seq;
27906 unsigned int peer_seq;
27907 spinlock_t peer_seq_lock;
27908 unsigned int minor;
27909diff -urNp linux-2.6.39.2/drivers/block/drbd/drbd_main.c linux-2.6.39.2/drivers/block/drbd/drbd_main.c
27910--- linux-2.6.39.2/drivers/block/drbd/drbd_main.c 2011-05-19 00:06:34.000000000 -0400
27911+++ linux-2.6.39.2/drivers/block/drbd/drbd_main.c 2011-05-22 19:36:31.000000000 -0400
27912@@ -2387,7 +2387,7 @@ static int _drbd_send_ack(struct drbd_co
27913 p.sector = sector;
27914 p.block_id = block_id;
27915 p.blksize = blksize;
27916- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
27917+ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
27918
27919 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
27920 return false;
27921@@ -2686,7 +2686,7 @@ int drbd_send_dblock(struct drbd_conf *m
27922 p.sector = cpu_to_be64(req->sector);
27923 p.block_id = (unsigned long)req;
27924 p.seq_num = cpu_to_be32(req->seq_num =
27925- atomic_add_return(1, &mdev->packet_seq));
27926+ atomic_add_return_unchecked(1, &mdev->packet_seq));
27927
27928 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
27929
27930@@ -2971,7 +2971,7 @@ void drbd_init_set_defaults(struct drbd_
27931 atomic_set(&mdev->unacked_cnt, 0);
27932 atomic_set(&mdev->local_cnt, 0);
27933 atomic_set(&mdev->net_cnt, 0);
27934- atomic_set(&mdev->packet_seq, 0);
27935+ atomic_set_unchecked(&mdev->packet_seq, 0);
27936 atomic_set(&mdev->pp_in_use, 0);
27937 atomic_set(&mdev->pp_in_use_by_net, 0);
27938 atomic_set(&mdev->rs_sect_in, 0);
27939@@ -3051,8 +3051,8 @@ void drbd_mdev_cleanup(struct drbd_conf
27940 mdev->receiver.t_state);
27941
27942 /* no need to lock it, I'm the only thread alive */
27943- if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
27944- dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
27945+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
27946+ dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
27947 mdev->al_writ_cnt =
27948 mdev->bm_writ_cnt =
27949 mdev->read_cnt =
27950diff -urNp linux-2.6.39.2/drivers/block/drbd/drbd_nl.c linux-2.6.39.2/drivers/block/drbd/drbd_nl.c
27951--- linux-2.6.39.2/drivers/block/drbd/drbd_nl.c 2011-05-19 00:06:34.000000000 -0400
27952+++ linux-2.6.39.2/drivers/block/drbd/drbd_nl.c 2011-05-22 19:36:31.000000000 -0400
27953@@ -2298,7 +2298,7 @@ static void drbd_connector_callback(stru
27954 module_put(THIS_MODULE);
27955 }
27956
27957-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27958+static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27959
27960 static unsigned short *
27961 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
27962@@ -2369,7 +2369,7 @@ void drbd_bcast_state(struct drbd_conf *
27963 cn_reply->id.idx = CN_IDX_DRBD;
27964 cn_reply->id.val = CN_VAL_DRBD;
27965
27966- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27967+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27968 cn_reply->ack = 0; /* not used here. */
27969 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27970 (int)((char *)tl - (char *)reply->tag_list);
27971@@ -2401,7 +2401,7 @@ void drbd_bcast_ev_helper(struct drbd_co
27972 cn_reply->id.idx = CN_IDX_DRBD;
27973 cn_reply->id.val = CN_VAL_DRBD;
27974
27975- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27976+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27977 cn_reply->ack = 0; /* not used here. */
27978 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27979 (int)((char *)tl - (char *)reply->tag_list);
27980@@ -2479,7 +2479,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
27981 cn_reply->id.idx = CN_IDX_DRBD;
27982 cn_reply->id.val = CN_VAL_DRBD;
27983
27984- cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
27985+ cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
27986 cn_reply->ack = 0; // not used here.
27987 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27988 (int)((char*)tl - (char*)reply->tag_list);
27989@@ -2518,7 +2518,7 @@ void drbd_bcast_sync_progress(struct drb
27990 cn_reply->id.idx = CN_IDX_DRBD;
27991 cn_reply->id.val = CN_VAL_DRBD;
27992
27993- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27994+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27995 cn_reply->ack = 0; /* not used here. */
27996 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27997 (int)((char *)tl - (char *)reply->tag_list);
27998diff -urNp linux-2.6.39.2/drivers/block/drbd/drbd_receiver.c linux-2.6.39.2/drivers/block/drbd/drbd_receiver.c
27999--- linux-2.6.39.2/drivers/block/drbd/drbd_receiver.c 2011-05-19 00:06:34.000000000 -0400
28000+++ linux-2.6.39.2/drivers/block/drbd/drbd_receiver.c 2011-05-22 19:36:31.000000000 -0400
28001@@ -894,7 +894,7 @@ retry:
28002 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
28003 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
28004
28005- atomic_set(&mdev->packet_seq, 0);
28006+ atomic_set_unchecked(&mdev->packet_seq, 0);
28007 mdev->peer_seq = 0;
28008
28009 drbd_thread_start(&mdev->asender);
28010@@ -990,7 +990,7 @@ static enum finish_epoch drbd_may_finish
28011 do {
28012 next_epoch = NULL;
28013
28014- epoch_size = atomic_read(&epoch->epoch_size);
28015+ epoch_size = atomic_read_unchecked(&epoch->epoch_size);
28016
28017 switch (ev & ~EV_CLEANUP) {
28018 case EV_PUT:
28019@@ -1025,7 +1025,7 @@ static enum finish_epoch drbd_may_finish
28020 rv = FE_DESTROYED;
28021 } else {
28022 epoch->flags = 0;
28023- atomic_set(&epoch->epoch_size, 0);
28024+ atomic_set_unchecked(&epoch->epoch_size, 0);
28025 /* atomic_set(&epoch->active, 0); is already zero */
28026 if (rv == FE_STILL_LIVE)
28027 rv = FE_RECYCLED;
28028@@ -1196,14 +1196,14 @@ static int receive_Barrier(struct drbd_c
28029 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
28030 drbd_flush(mdev);
28031
28032- if (atomic_read(&mdev->current_epoch->epoch_size)) {
28033+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
28034 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
28035 if (epoch)
28036 break;
28037 }
28038
28039 epoch = mdev->current_epoch;
28040- wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
28041+ wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
28042
28043 D_ASSERT(atomic_read(&epoch->active) == 0);
28044 D_ASSERT(epoch->flags == 0);
28045@@ -1215,11 +1215,11 @@ static int receive_Barrier(struct drbd_c
28046 }
28047
28048 epoch->flags = 0;
28049- atomic_set(&epoch->epoch_size, 0);
28050+ atomic_set_unchecked(&epoch->epoch_size, 0);
28051 atomic_set(&epoch->active, 0);
28052
28053 spin_lock(&mdev->epoch_lock);
28054- if (atomic_read(&mdev->current_epoch->epoch_size)) {
28055+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
28056 list_add(&epoch->list, &mdev->current_epoch->list);
28057 mdev->current_epoch = epoch;
28058 mdev->epochs++;
28059@@ -1668,7 +1668,7 @@ static int receive_Data(struct drbd_conf
28060 spin_unlock(&mdev->peer_seq_lock);
28061
28062 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
28063- atomic_inc(&mdev->current_epoch->epoch_size);
28064+ atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
28065 return drbd_drain_block(mdev, data_size);
28066 }
28067
28068@@ -1694,7 +1694,7 @@ static int receive_Data(struct drbd_conf
28069
28070 spin_lock(&mdev->epoch_lock);
28071 e->epoch = mdev->current_epoch;
28072- atomic_inc(&e->epoch->epoch_size);
28073+ atomic_inc_unchecked(&e->epoch->epoch_size);
28074 atomic_inc(&e->epoch->active);
28075 spin_unlock(&mdev->epoch_lock);
28076
28077@@ -3905,7 +3905,7 @@ static void drbd_disconnect(struct drbd_
28078 D_ASSERT(list_empty(&mdev->done_ee));
28079
28080 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
28081- atomic_set(&mdev->current_epoch->epoch_size, 0);
28082+ atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
28083 D_ASSERT(list_empty(&mdev->current_epoch->list));
28084 }
28085
28086diff -urNp linux-2.6.39.2/drivers/block/nbd.c linux-2.6.39.2/drivers/block/nbd.c
28087--- linux-2.6.39.2/drivers/block/nbd.c 2011-06-25 12:55:22.000000000 -0400
28088+++ linux-2.6.39.2/drivers/block/nbd.c 2011-06-25 13:00:25.000000000 -0400
28089@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
28090 struct kvec iov;
28091 sigset_t blocked, oldset;
28092
28093+ pax_track_stack();
28094+
28095 if (unlikely(!sock)) {
28096 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
28097 lo->disk->disk_name, (send ? "send" : "recv"));
28098@@ -571,6 +573,8 @@ static void do_nbd_request(struct reques
28099 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
28100 unsigned int cmd, unsigned long arg)
28101 {
28102+ pax_track_stack();
28103+
28104 switch (cmd) {
28105 case NBD_DISCONNECT: {
28106 struct request sreq;
28107diff -urNp linux-2.6.39.2/drivers/block/smart1,2.h linux-2.6.39.2/drivers/block/smart1,2.h
28108--- linux-2.6.39.2/drivers/block/smart1,2.h 2011-05-19 00:06:34.000000000 -0400
28109+++ linux-2.6.39.2/drivers/block/smart1,2.h 2011-05-22 19:36:31.000000000 -0400
28110@@ -107,7 +107,7 @@ static unsigned long smart4_intr_pending
28111 return 0 ;
28112 }
28113
28114-static struct access_method smart4_access = {
28115+static const struct access_method smart4_access = {
28116 smart4_submit_command,
28117 smart4_intr_mask,
28118 smart4_fifo_full,
28119@@ -143,7 +143,7 @@ static unsigned long smart2_intr_pending
28120 return readl(h->vaddr + INTR_PENDING);
28121 }
28122
28123-static struct access_method smart2_access = {
28124+static const struct access_method smart2_access = {
28125 smart2_submit_command,
28126 smart2_intr_mask,
28127 smart2_fifo_full,
28128@@ -179,7 +179,7 @@ static unsigned long smart2e_intr_pendin
28129 return inl(h->io_mem_addr + INTR_PENDING);
28130 }
28131
28132-static struct access_method smart2e_access = {
28133+static const struct access_method smart2e_access = {
28134 smart2e_submit_command,
28135 smart2e_intr_mask,
28136 smart2e_fifo_full,
28137@@ -269,7 +269,7 @@ static unsigned long smart1_intr_pending
28138 return chan;
28139 }
28140
28141-static struct access_method smart1_access = {
28142+static const struct access_method smart1_access = {
28143 smart1_submit_command,
28144 smart1_intr_mask,
28145 smart1_fifo_full,
28146diff -urNp linux-2.6.39.2/drivers/block/xsysace.c linux-2.6.39.2/drivers/block/xsysace.c
28147--- linux-2.6.39.2/drivers/block/xsysace.c 2011-05-19 00:06:34.000000000 -0400
28148+++ linux-2.6.39.2/drivers/block/xsysace.c 2011-05-22 19:36:31.000000000 -0400
28149@@ -262,7 +262,7 @@ static void ace_dataout_8(struct ace_dev
28150 ace->data_ptr = src;
28151 }
28152
28153-static struct ace_reg_ops ace_reg_8_ops = {
28154+static const struct ace_reg_ops ace_reg_8_ops = {
28155 .in = ace_in_8,
28156 .out = ace_out_8,
28157 .datain = ace_datain_8,
28158@@ -327,14 +327,14 @@ static void ace_dataout_le16(struct ace_
28159 ace->data_ptr = src;
28160 }
28161
28162-static struct ace_reg_ops ace_reg_be16_ops = {
28163+static const struct ace_reg_ops ace_reg_be16_ops = {
28164 .in = ace_in_be16,
28165 .out = ace_out_be16,
28166 .datain = ace_datain_be16,
28167 .dataout = ace_dataout_be16,
28168 };
28169
28170-static struct ace_reg_ops ace_reg_le16_ops = {
28171+static const struct ace_reg_ops ace_reg_le16_ops = {
28172 .in = ace_in_le16,
28173 .out = ace_out_le16,
28174 .datain = ace_datain_le16,
28175diff -urNp linux-2.6.39.2/drivers/char/agp/frontend.c linux-2.6.39.2/drivers/char/agp/frontend.c
28176--- linux-2.6.39.2/drivers/char/agp/frontend.c 2011-05-19 00:06:34.000000000 -0400
28177+++ linux-2.6.39.2/drivers/char/agp/frontend.c 2011-05-22 19:36:31.000000000 -0400
28178@@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
28179 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
28180 return -EFAULT;
28181
28182- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
28183+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
28184 return -EFAULT;
28185
28186 client = agp_find_client_by_pid(reserve.pid);
28187diff -urNp linux-2.6.39.2/drivers/char/briq_panel.c linux-2.6.39.2/drivers/char/briq_panel.c
28188--- linux-2.6.39.2/drivers/char/briq_panel.c 2011-05-19 00:06:34.000000000 -0400
28189+++ linux-2.6.39.2/drivers/char/briq_panel.c 2011-05-22 19:41:32.000000000 -0400
28190@@ -9,6 +9,7 @@
28191 #include <linux/types.h>
28192 #include <linux/errno.h>
28193 #include <linux/tty.h>
28194+#include <linux/mutex.h>
28195 #include <linux/timer.h>
28196 #include <linux/kernel.h>
28197 #include <linux/wait.h>
28198@@ -34,6 +35,7 @@ static int vfd_is_open;
28199 static unsigned char vfd[40];
28200 static int vfd_cursor;
28201 static unsigned char ledpb, led;
28202+static DEFINE_MUTEX(vfd_mutex);
28203
28204 static void update_vfd(void)
28205 {
28206@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
28207 if (!vfd_is_open)
28208 return -EBUSY;
28209
28210+ mutex_lock(&vfd_mutex);
28211 for (;;) {
28212 char c;
28213 if (!indx)
28214 break;
28215- if (get_user(c, buf))
28216+ if (get_user(c, buf)) {
28217+ mutex_unlock(&vfd_mutex);
28218 return -EFAULT;
28219+ }
28220 if (esc) {
28221 set_led(c);
28222 esc = 0;
28223@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
28224 buf++;
28225 }
28226 update_vfd();
28227+ mutex_unlock(&vfd_mutex);
28228
28229 return len;
28230 }
28231diff -urNp linux-2.6.39.2/drivers/char/genrtc.c linux-2.6.39.2/drivers/char/genrtc.c
28232--- linux-2.6.39.2/drivers/char/genrtc.c 2011-05-19 00:06:34.000000000 -0400
28233+++ linux-2.6.39.2/drivers/char/genrtc.c 2011-05-22 19:41:32.000000000 -0400
28234@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
28235 switch (cmd) {
28236
28237 case RTC_PLL_GET:
28238+ memset(&pll, 0, sizeof(pll));
28239 if (get_rtc_pll(&pll))
28240 return -EINVAL;
28241 else
28242diff -urNp linux-2.6.39.2/drivers/char/hpet.c linux-2.6.39.2/drivers/char/hpet.c
28243--- linux-2.6.39.2/drivers/char/hpet.c 2011-05-19 00:06:34.000000000 -0400
28244+++ linux-2.6.39.2/drivers/char/hpet.c 2011-05-22 19:36:31.000000000 -0400
28245@@ -553,7 +553,7 @@ static inline unsigned long hpet_time_di
28246 }
28247
28248 static int
28249-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
28250+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
28251 struct hpet_info *info)
28252 {
28253 struct hpet_timer __iomem *timer;
28254diff -urNp linux-2.6.39.2/drivers/char/ipmi/ipmi_devintf.c linux-2.6.39.2/drivers/char/ipmi/ipmi_devintf.c
28255--- linux-2.6.39.2/drivers/char/ipmi/ipmi_devintf.c 2011-05-19 00:06:34.000000000 -0400
28256+++ linux-2.6.39.2/drivers/char/ipmi/ipmi_devintf.c 2011-05-22 19:36:31.000000000 -0400
28257@@ -109,8 +109,7 @@ static int ipmi_fasync(int fd, struct fi
28258 return (result);
28259 }
28260
28261-static struct ipmi_user_hndl ipmi_hndlrs =
28262-{
28263+static const struct ipmi_user_hndl ipmi_hndlrs = {
28264 .ipmi_recv_hndl = file_receive_handler,
28265 };
28266
28267diff -urNp linux-2.6.39.2/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.39.2/drivers/char/ipmi/ipmi_msghandler.c
28268--- linux-2.6.39.2/drivers/char/ipmi/ipmi_msghandler.c 2011-05-19 00:06:34.000000000 -0400
28269+++ linux-2.6.39.2/drivers/char/ipmi/ipmi_msghandler.c 2011-05-22 19:36:31.000000000 -0400
28270@@ -82,7 +82,7 @@ struct ipmi_user {
28271 struct kref refcount;
28272
28273 /* The upper layer that handles receive messages. */
28274- struct ipmi_user_hndl *handler;
28275+ const struct ipmi_user_hndl *handler;
28276 void *handler_data;
28277
28278 /* The interface this user is bound to. */
28279@@ -414,7 +414,7 @@ struct ipmi_smi {
28280 struct proc_dir_entry *proc_dir;
28281 char proc_dir_name[10];
28282
28283- atomic_t stats[IPMI_NUM_STATS];
28284+ atomic_unchecked_t stats[IPMI_NUM_STATS];
28285
28286 /*
28287 * run_to_completion duplicate of smb_info, smi_info
28288@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
28289
28290
28291 #define ipmi_inc_stat(intf, stat) \
28292- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
28293+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
28294 #define ipmi_get_stat(intf, stat) \
28295- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
28296+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
28297
28298 static int is_lan_addr(struct ipmi_addr *addr)
28299 {
28300@@ -875,7 +875,7 @@ static int intf_err_seq(ipmi_smi_t int
28301
28302
28303 int ipmi_create_user(unsigned int if_num,
28304- struct ipmi_user_hndl *handler,
28305+ const struct ipmi_user_hndl *handler,
28306 void *handler_data,
28307 ipmi_user_t *user)
28308 {
28309@@ -2844,7 +2844,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
28310 INIT_LIST_HEAD(&intf->cmd_rcvrs);
28311 init_waitqueue_head(&intf->waitq);
28312 for (i = 0; i < IPMI_NUM_STATS; i++)
28313- atomic_set(&intf->stats[i], 0);
28314+ atomic_set_unchecked(&intf->stats[i], 0);
28315
28316 intf->proc_dir = NULL;
28317
28318@@ -4196,6 +4196,8 @@ static void send_panic_events(char *str)
28319 struct ipmi_smi_msg smi_msg;
28320 struct ipmi_recv_msg recv_msg;
28321
28322+ pax_track_stack();
28323+
28324 si = (struct ipmi_system_interface_addr *) &addr;
28325 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
28326 si->channel = IPMI_BMC_CHANNEL;
28327diff -urNp linux-2.6.39.2/drivers/char/ipmi/ipmi_poweroff.c linux-2.6.39.2/drivers/char/ipmi/ipmi_poweroff.c
28328--- linux-2.6.39.2/drivers/char/ipmi/ipmi_poweroff.c 2011-05-19 00:06:34.000000000 -0400
28329+++ linux-2.6.39.2/drivers/char/ipmi/ipmi_poweroff.c 2011-05-22 19:36:31.000000000 -0400
28330@@ -133,7 +133,7 @@ static void receive_handler(struct ipmi_
28331 complete(comp);
28332 }
28333
28334-static struct ipmi_user_hndl ipmi_poweroff_handler = {
28335+static const struct ipmi_user_hndl ipmi_poweroff_handler = {
28336 .ipmi_recv_hndl = receive_handler
28337 };
28338
28339diff -urNp linux-2.6.39.2/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.39.2/drivers/char/ipmi/ipmi_si_intf.c
28340--- linux-2.6.39.2/drivers/char/ipmi/ipmi_si_intf.c 2011-05-19 00:06:34.000000000 -0400
28341+++ linux-2.6.39.2/drivers/char/ipmi/ipmi_si_intf.c 2011-05-22 19:36:31.000000000 -0400
28342@@ -276,7 +276,7 @@ struct smi_info {
28343 unsigned char slave_addr;
28344
28345 /* Counters and things for the proc filesystem. */
28346- atomic_t stats[SI_NUM_STATS];
28347+ atomic_unchecked_t stats[SI_NUM_STATS];
28348
28349 struct task_struct *thread;
28350
28351@@ -285,9 +285,9 @@ struct smi_info {
28352 };
28353
28354 #define smi_inc_stat(smi, stat) \
28355- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
28356+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
28357 #define smi_get_stat(smi, stat) \
28358- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
28359+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
28360
28361 #define SI_MAX_PARMS 4
28362
28363@@ -3198,7 +3198,7 @@ static int try_smi_init(struct smi_info
28364 atomic_set(&new_smi->req_events, 0);
28365 new_smi->run_to_completion = 0;
28366 for (i = 0; i < SI_NUM_STATS; i++)
28367- atomic_set(&new_smi->stats[i], 0);
28368+ atomic_set_unchecked(&new_smi->stats[i], 0);
28369
28370 new_smi->interrupt_disabled = 1;
28371 atomic_set(&new_smi->stop_operation, 0);
28372diff -urNp linux-2.6.39.2/drivers/char/ipmi/ipmi_watchdog.c linux-2.6.39.2/drivers/char/ipmi/ipmi_watchdog.c
28373--- linux-2.6.39.2/drivers/char/ipmi/ipmi_watchdog.c 2011-05-19 00:06:34.000000000 -0400
28374+++ linux-2.6.39.2/drivers/char/ipmi/ipmi_watchdog.c 2011-05-22 19:36:31.000000000 -0400
28375@@ -216,7 +216,7 @@ static int set_param_timeout(const char
28376 return rv;
28377 }
28378
28379-static struct kernel_param_ops param_ops_timeout = {
28380+static const struct kernel_param_ops param_ops_timeout = {
28381 .set = set_param_timeout,
28382 .get = param_get_int,
28383 };
28384@@ -278,14 +278,14 @@ static int set_param_wdog_ifnum(const ch
28385 return 0;
28386 }
28387
28388-static struct kernel_param_ops param_ops_wdog_ifnum = {
28389+static const struct kernel_param_ops param_ops_wdog_ifnum = {
28390 .set = set_param_wdog_ifnum,
28391 .get = param_get_int,
28392 };
28393
28394 #define param_check_wdog_ifnum param_check_int
28395
28396-static struct kernel_param_ops param_ops_str = {
28397+static const struct kernel_param_ops param_ops_str = {
28398 .set = set_param_str,
28399 .get = get_param_str,
28400 };
28401@@ -953,7 +953,7 @@ static void ipmi_wdog_pretimeout_handler
28402 pretimeout_since_last_heartbeat = 1;
28403 }
28404
28405-static struct ipmi_user_hndl ipmi_hndlrs = {
28406+static const struct ipmi_user_hndl ipmi_hndlrs = {
28407 .ipmi_recv_hndl = ipmi_wdog_msg_handler,
28408 .ipmi_watchdog_pretimeout = ipmi_wdog_pretimeout_handler
28409 };
28410diff -urNp linux-2.6.39.2/drivers/char/Kconfig linux-2.6.39.2/drivers/char/Kconfig
28411--- linux-2.6.39.2/drivers/char/Kconfig 2011-05-19 00:06:34.000000000 -0400
28412+++ linux-2.6.39.2/drivers/char/Kconfig 2011-05-22 19:41:37.000000000 -0400
28413@@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
28414
28415 config DEVKMEM
28416 bool "/dev/kmem virtual device support"
28417- default y
28418+ default n
28419+ depends on !GRKERNSEC_KMEM
28420 help
28421 Say Y here if you want to support the /dev/kmem device. The
28422 /dev/kmem device is rarely used, but can be used for certain
28423@@ -596,6 +597,7 @@ config DEVPORT
28424 bool
28425 depends on !M68K
28426 depends on ISA || PCI
28427+ depends on !GRKERNSEC_KMEM
28428 default y
28429
28430 source "drivers/s390/char/Kconfig"
28431diff -urNp linux-2.6.39.2/drivers/char/mem.c linux-2.6.39.2/drivers/char/mem.c
28432--- linux-2.6.39.2/drivers/char/mem.c 2011-05-19 00:06:34.000000000 -0400
28433+++ linux-2.6.39.2/drivers/char/mem.c 2011-05-22 19:41:37.000000000 -0400
28434@@ -18,6 +18,7 @@
28435 #include <linux/raw.h>
28436 #include <linux/tty.h>
28437 #include <linux/capability.h>
28438+#include <linux/security.h>
28439 #include <linux/ptrace.h>
28440 #include <linux/device.h>
28441 #include <linux/highmem.h>
28442@@ -34,6 +35,10 @@
28443 # include <linux/efi.h>
28444 #endif
28445
28446+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28447+extern struct file_operations grsec_fops;
28448+#endif
28449+
28450 static inline unsigned long size_inside_page(unsigned long start,
28451 unsigned long size)
28452 {
28453@@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig
28454
28455 while (cursor < to) {
28456 if (!devmem_is_allowed(pfn)) {
28457+#ifdef CONFIG_GRKERNSEC_KMEM
28458+ gr_handle_mem_readwrite(from, to);
28459+#else
28460 printk(KERN_INFO
28461 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
28462 current->comm, from, to);
28463+#endif
28464 return 0;
28465 }
28466 cursor += PAGE_SIZE;
28467@@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig
28468 }
28469 return 1;
28470 }
28471+#elif defined(CONFIG_GRKERNSEC_KMEM)
28472+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28473+{
28474+ return 0;
28475+}
28476 #else
28477 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28478 {
28479@@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil
28480
28481 while (count > 0) {
28482 unsigned long remaining;
28483+ char *temp;
28484
28485 sz = size_inside_page(p, count);
28486
28487@@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil
28488 if (!ptr)
28489 return -EFAULT;
28490
28491- remaining = copy_to_user(buf, ptr, sz);
28492+#ifdef CONFIG_PAX_USERCOPY
28493+ temp = kmalloc(sz, GFP_KERNEL);
28494+ if (!temp) {
28495+ unxlate_dev_mem_ptr(p, ptr);
28496+ return -ENOMEM;
28497+ }
28498+ memcpy(temp, ptr, sz);
28499+#else
28500+ temp = ptr;
28501+#endif
28502+
28503+ remaining = copy_to_user(buf, temp, sz);
28504+
28505+#ifdef CONFIG_PAX_USERCOPY
28506+ kfree(temp);
28507+#endif
28508+
28509 unxlate_dev_mem_ptr(p, ptr);
28510 if (remaining)
28511 return -EFAULT;
28512@@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi
28513 size_t count, loff_t *ppos)
28514 {
28515 unsigned long p = *ppos;
28516- ssize_t low_count, read, sz;
28517+ ssize_t low_count, read, sz, err = 0;
28518 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
28519- int err = 0;
28520
28521 read = 0;
28522 if (p < (unsigned long) high_memory) {
28523@@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi
28524 }
28525 #endif
28526 while (low_count > 0) {
28527+ char *temp;
28528+
28529 sz = size_inside_page(p, low_count);
28530
28531 /*
28532@@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi
28533 */
28534 kbuf = xlate_dev_kmem_ptr((char *)p);
28535
28536- if (copy_to_user(buf, kbuf, sz))
28537+#ifdef CONFIG_PAX_USERCOPY
28538+ temp = kmalloc(sz, GFP_KERNEL);
28539+ if (!temp)
28540+ return -ENOMEM;
28541+ memcpy(temp, kbuf, sz);
28542+#else
28543+ temp = kbuf;
28544+#endif
28545+
28546+ err = copy_to_user(buf, temp, sz);
28547+
28548+#ifdef CONFIG_PAX_USERCOPY
28549+ kfree(temp);
28550+#endif
28551+
28552+ if (err)
28553 return -EFAULT;
28554 buf += sz;
28555 p += sz;
28556@@ -854,6 +901,9 @@ static const struct memdev {
28557 #ifdef CONFIG_CRASH_DUMP
28558 [12] = { "oldmem", 0, &oldmem_fops, NULL },
28559 #endif
28560+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28561+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
28562+#endif
28563 };
28564
28565 static int memory_open(struct inode *inode, struct file *filp)
28566diff -urNp linux-2.6.39.2/drivers/char/mmtimer.c linux-2.6.39.2/drivers/char/mmtimer.c
28567--- linux-2.6.39.2/drivers/char/mmtimer.c 2011-05-19 00:06:34.000000000 -0400
28568+++ linux-2.6.39.2/drivers/char/mmtimer.c 2011-05-22 19:36:31.000000000 -0400
28569@@ -53,7 +53,7 @@ MODULE_LICENSE("GPL");
28570
28571 #define RTC_BITS 55 /* 55 bits for this implementation */
28572
28573-static struct k_clock sgi_clock;
28574+static const struct k_clock sgi_clock;
28575
28576 extern unsigned long sn_rtc_cycles_per_second;
28577
28578@@ -772,7 +772,7 @@ static int sgi_clock_getres(const clocki
28579 return 0;
28580 }
28581
28582-static struct k_clock sgi_clock = {
28583+static const struct k_clock sgi_clock = {
28584 .clock_set = sgi_clock_set,
28585 .clock_get = sgi_clock_get,
28586 .clock_getres = sgi_clock_getres,
28587diff -urNp linux-2.6.39.2/drivers/char/nvram.c linux-2.6.39.2/drivers/char/nvram.c
28588--- linux-2.6.39.2/drivers/char/nvram.c 2011-05-19 00:06:34.000000000 -0400
28589+++ linux-2.6.39.2/drivers/char/nvram.c 2011-05-22 19:36:31.000000000 -0400
28590@@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
28591
28592 spin_unlock_irq(&rtc_lock);
28593
28594- if (copy_to_user(buf, contents, tmp - contents))
28595+ if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
28596 return -EFAULT;
28597
28598 *ppos = i;
28599diff -urNp linux-2.6.39.2/drivers/char/random.c linux-2.6.39.2/drivers/char/random.c
28600--- linux-2.6.39.2/drivers/char/random.c 2011-05-19 00:06:34.000000000 -0400
28601+++ linux-2.6.39.2/drivers/char/random.c 2011-05-22 19:41:37.000000000 -0400
28602@@ -261,8 +261,13 @@
28603 /*
28604 * Configuration information
28605 */
28606+#ifdef CONFIG_GRKERNSEC_RANDNET
28607+#define INPUT_POOL_WORDS 512
28608+#define OUTPUT_POOL_WORDS 128
28609+#else
28610 #define INPUT_POOL_WORDS 128
28611 #define OUTPUT_POOL_WORDS 32
28612+#endif
28613 #define SEC_XFER_SIZE 512
28614 #define EXTRACT_SIZE 10
28615
28616@@ -300,10 +305,17 @@ static struct poolinfo {
28617 int poolwords;
28618 int tap1, tap2, tap3, tap4, tap5;
28619 } poolinfo_table[] = {
28620+#ifdef CONFIG_GRKERNSEC_RANDNET
28621+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
28622+ { 512, 411, 308, 208, 104, 1 },
28623+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
28624+ { 128, 103, 76, 51, 25, 1 },
28625+#else
28626 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
28627 { 128, 103, 76, 51, 25, 1 },
28628 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
28629 { 32, 26, 20, 14, 7, 1 },
28630+#endif
28631 #if 0
28632 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
28633 { 2048, 1638, 1231, 819, 411, 1 },
28634@@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru
28635
28636 extract_buf(r, tmp);
28637 i = min_t(int, nbytes, EXTRACT_SIZE);
28638- if (copy_to_user(buf, tmp, i)) {
28639+ if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
28640 ret = -EFAULT;
28641 break;
28642 }
28643@@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
28644 #include <linux/sysctl.h>
28645
28646 static int min_read_thresh = 8, min_write_thresh;
28647-static int max_read_thresh = INPUT_POOL_WORDS * 32;
28648+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
28649 static int max_write_thresh = INPUT_POOL_WORDS * 32;
28650 static char sysctl_bootid[16];
28651
28652diff -urNp linux-2.6.39.2/drivers/char/sonypi.c linux-2.6.39.2/drivers/char/sonypi.c
28653--- linux-2.6.39.2/drivers/char/sonypi.c 2011-05-19 00:06:34.000000000 -0400
28654+++ linux-2.6.39.2/drivers/char/sonypi.c 2011-05-22 19:36:31.000000000 -0400
28655@@ -55,6 +55,7 @@
28656 #include <asm/uaccess.h>
28657 #include <asm/io.h>
28658 #include <asm/system.h>
28659+#include <asm/local.h>
28660
28661 #include <linux/sonypi.h>
28662
28663@@ -491,7 +492,7 @@ static struct sonypi_device {
28664 spinlock_t fifo_lock;
28665 wait_queue_head_t fifo_proc_list;
28666 struct fasync_struct *fifo_async;
28667- int open_count;
28668+ local_t open_count;
28669 int model;
28670 struct input_dev *input_jog_dev;
28671 struct input_dev *input_key_dev;
28672@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
28673 static int sonypi_misc_release(struct inode *inode, struct file *file)
28674 {
28675 mutex_lock(&sonypi_device.lock);
28676- sonypi_device.open_count--;
28677+ local_dec(&sonypi_device.open_count);
28678 mutex_unlock(&sonypi_device.lock);
28679 return 0;
28680 }
28681@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
28682 {
28683 mutex_lock(&sonypi_device.lock);
28684 /* Flush input queue on first open */
28685- if (!sonypi_device.open_count)
28686+ if (!local_read(&sonypi_device.open_count))
28687 kfifo_reset(&sonypi_device.fifo);
28688- sonypi_device.open_count++;
28689+ local_inc(&sonypi_device.open_count);
28690 mutex_unlock(&sonypi_device.lock);
28691
28692 return 0;
28693diff -urNp linux-2.6.39.2/drivers/char/tpm/tpm_bios.c linux-2.6.39.2/drivers/char/tpm/tpm_bios.c
28694--- linux-2.6.39.2/drivers/char/tpm/tpm_bios.c 2011-05-19 00:06:34.000000000 -0400
28695+++ linux-2.6.39.2/drivers/char/tpm/tpm_bios.c 2011-05-22 19:36:31.000000000 -0400
28696@@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
28697 event = addr;
28698
28699 if ((event->event_type == 0 && event->event_size == 0) ||
28700- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
28701+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
28702 return NULL;
28703
28704 return addr;
28705@@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(
28706 return NULL;
28707
28708 if ((event->event_type == 0 && event->event_size == 0) ||
28709- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
28710+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
28711 return NULL;
28712
28713 (*pos)++;
28714@@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_
28715 int i;
28716
28717 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
28718- seq_putc(m, data[i]);
28719+ if (!seq_putc(m, data[i]))
28720+ return -EFAULT;
28721
28722 return 0;
28723 }
28724@@ -410,6 +411,11 @@ static int read_log(struct tpm_bios_log
28725 log->bios_event_log_end = log->bios_event_log + len;
28726
28727 virt = acpi_os_map_memory(start, len);
28728+ if (!virt) {
28729+ kfree(log->bios_event_log);
28730+ log->bios_event_log = NULL;
28731+ return -EFAULT;
28732+ }
28733
28734 memcpy(log->bios_event_log, virt, len);
28735
28736diff -urNp linux-2.6.39.2/drivers/char/tpm/tpm.c linux-2.6.39.2/drivers/char/tpm/tpm.c
28737--- linux-2.6.39.2/drivers/char/tpm/tpm.c 2011-05-19 00:06:34.000000000 -0400
28738+++ linux-2.6.39.2/drivers/char/tpm/tpm.c 2011-05-22 19:36:31.000000000 -0400
28739@@ -411,7 +411,7 @@ static ssize_t tpm_transmit(struct tpm_c
28740 chip->vendor.req_complete_val)
28741 goto out_recv;
28742
28743- if ((status == chip->vendor.req_canceled)) {
28744+ if (status == chip->vendor.req_canceled) {
28745 dev_err(chip->dev, "Operation Canceled\n");
28746 rc = -ECANCELED;
28747 goto out;
28748@@ -844,6 +844,8 @@ ssize_t tpm_show_pubek(struct device *de
28749
28750 struct tpm_chip *chip = dev_get_drvdata(dev);
28751
28752+ pax_track_stack();
28753+
28754 tpm_cmd.header.in = tpm_readpubek_header;
28755 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
28756 "attempting to read the PUBEK");
28757diff -urNp linux-2.6.39.2/drivers/char/ttyprintk.c linux-2.6.39.2/drivers/char/ttyprintk.c
28758--- linux-2.6.39.2/drivers/char/ttyprintk.c 2011-05-19 00:06:34.000000000 -0400
28759+++ linux-2.6.39.2/drivers/char/ttyprintk.c 2011-05-22 19:36:31.000000000 -0400
28760@@ -170,7 +170,7 @@ static const struct tty_operations ttypr
28761 .ioctl = tpk_ioctl,
28762 };
28763
28764-struct tty_port_operations null_ops = { };
28765+const struct tty_port_operations null_ops = { };
28766
28767 static struct tty_driver *ttyprintk_driver;
28768
28769diff -urNp linux-2.6.39.2/drivers/char/xilinx_hwicap/xilinx_hwicap.c linux-2.6.39.2/drivers/char/xilinx_hwicap/xilinx_hwicap.c
28770--- linux-2.6.39.2/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-19 00:06:34.000000000 -0400
28771+++ linux-2.6.39.2/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-22 19:36:31.000000000 -0400
28772@@ -678,14 +678,14 @@ static int __devinit hwicap_setup(struct
28773 return retval;
28774 }
28775
28776-static struct hwicap_driver_config buffer_icap_config = {
28777+static const struct hwicap_driver_config buffer_icap_config = {
28778 .get_configuration = buffer_icap_get_configuration,
28779 .set_configuration = buffer_icap_set_configuration,
28780 .get_status = buffer_icap_get_status,
28781 .reset = buffer_icap_reset,
28782 };
28783
28784-static struct hwicap_driver_config fifo_icap_config = {
28785+static const struct hwicap_driver_config fifo_icap_config = {
28786 .get_configuration = fifo_icap_get_configuration,
28787 .set_configuration = fifo_icap_set_configuration,
28788 .get_status = fifo_icap_get_status,
28789diff -urNp linux-2.6.39.2/drivers/crypto/hifn_795x.c linux-2.6.39.2/drivers/crypto/hifn_795x.c
28790--- linux-2.6.39.2/drivers/crypto/hifn_795x.c 2011-05-19 00:06:34.000000000 -0400
28791+++ linux-2.6.39.2/drivers/crypto/hifn_795x.c 2011-05-22 19:36:31.000000000 -0400
28792@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
28793 0xCA, 0x34, 0x2B, 0x2E};
28794 struct scatterlist sg;
28795
28796+ pax_track_stack();
28797+
28798 memset(src, 0, sizeof(src));
28799 memset(ctx.key, 0, sizeof(ctx.key));
28800
28801diff -urNp linux-2.6.39.2/drivers/crypto/padlock-aes.c linux-2.6.39.2/drivers/crypto/padlock-aes.c
28802--- linux-2.6.39.2/drivers/crypto/padlock-aes.c 2011-05-19 00:06:34.000000000 -0400
28803+++ linux-2.6.39.2/drivers/crypto/padlock-aes.c 2011-05-22 19:36:31.000000000 -0400
28804@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
28805 struct crypto_aes_ctx gen_aes;
28806 int cpu;
28807
28808+ pax_track_stack();
28809+
28810 if (key_len % 8) {
28811 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
28812 return -EINVAL;
28813diff -urNp linux-2.6.39.2/drivers/dca/dca-core.c linux-2.6.39.2/drivers/dca/dca-core.c
28814--- linux-2.6.39.2/drivers/dca/dca-core.c 2011-05-19 00:06:34.000000000 -0400
28815+++ linux-2.6.39.2/drivers/dca/dca-core.c 2011-05-22 19:36:31.000000000 -0400
28816@@ -325,7 +325,7 @@ EXPORT_SYMBOL_GPL(dca_get_tag);
28817 * @ops - pointer to struct of dca operation function pointers
28818 * @priv_size - size of extra mem to be added for provider's needs
28819 */
28820-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size)
28821+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size)
28822 {
28823 struct dca_provider *dca;
28824 int alloc_size;
28825diff -urNp linux-2.6.39.2/drivers/dma/ioat/dca.c linux-2.6.39.2/drivers/dma/ioat/dca.c
28826--- linux-2.6.39.2/drivers/dma/ioat/dca.c 2011-05-19 00:06:34.000000000 -0400
28827+++ linux-2.6.39.2/drivers/dma/ioat/dca.c 2011-05-22 19:36:31.000000000 -0400
28828@@ -234,7 +234,7 @@ static int ioat_dca_dev_managed(struct d
28829 return 0;
28830 }
28831
28832-static struct dca_ops ioat_dca_ops = {
28833+static const struct dca_ops ioat_dca_ops = {
28834 .add_requester = ioat_dca_add_requester,
28835 .remove_requester = ioat_dca_remove_requester,
28836 .get_tag = ioat_dca_get_tag,
28837@@ -384,7 +384,7 @@ static u8 ioat2_dca_get_tag(struct dca_p
28838 return tag;
28839 }
28840
28841-static struct dca_ops ioat2_dca_ops = {
28842+static const struct dca_ops ioat2_dca_ops = {
28843 .add_requester = ioat2_dca_add_requester,
28844 .remove_requester = ioat2_dca_remove_requester,
28845 .get_tag = ioat2_dca_get_tag,
28846@@ -579,7 +579,7 @@ static u8 ioat3_dca_get_tag(struct dca_p
28847 return tag;
28848 }
28849
28850-static struct dca_ops ioat3_dca_ops = {
28851+static const struct dca_ops ioat3_dca_ops = {
28852 .add_requester = ioat3_dca_add_requester,
28853 .remove_requester = ioat3_dca_remove_requester,
28854 .get_tag = ioat3_dca_get_tag,
28855diff -urNp linux-2.6.39.2/drivers/edac/amd64_edac.h linux-2.6.39.2/drivers/edac/amd64_edac.h
28856--- linux-2.6.39.2/drivers/edac/amd64_edac.h 2011-05-19 00:06:34.000000000 -0400
28857+++ linux-2.6.39.2/drivers/edac/amd64_edac.h 2011-05-22 19:36:31.000000000 -0400
28858@@ -333,7 +333,7 @@ struct chip_select {
28859 };
28860
28861 struct amd64_pvt {
28862- struct low_ops *ops;
28863+ const struct low_ops *ops;
28864
28865 /* pci_device handles which we utilize */
28866 struct pci_dev *F1, *F2, *F3;
28867@@ -443,7 +443,7 @@ struct low_ops {
28868 struct amd64_family_type {
28869 const char *ctl_name;
28870 u16 f1_id, f3_id;
28871- struct low_ops ops;
28872+ const struct low_ops ops;
28873 };
28874
28875 int __amd64_write_pci_cfg_dword(struct pci_dev *pdev, int offset,
28876diff -urNp linux-2.6.39.2/drivers/edac/edac_mc_sysfs.c linux-2.6.39.2/drivers/edac/edac_mc_sysfs.c
28877--- linux-2.6.39.2/drivers/edac/edac_mc_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28878+++ linux-2.6.39.2/drivers/edac/edac_mc_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28879@@ -760,7 +760,7 @@ static void edac_inst_grp_release(struct
28880 }
28881
28882 /* Intermediate show/store table */
28883-static struct sysfs_ops inst_grp_ops = {
28884+static const struct sysfs_ops inst_grp_ops = {
28885 .show = inst_grp_show,
28886 .store = inst_grp_store
28887 };
28888diff -urNp linux-2.6.39.2/drivers/edac/edac_pci_sysfs.c linux-2.6.39.2/drivers/edac/edac_pci_sysfs.c
28889--- linux-2.6.39.2/drivers/edac/edac_pci_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28890+++ linux-2.6.39.2/drivers/edac/edac_pci_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28891@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log
28892 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
28893 static int edac_pci_poll_msec = 1000; /* one second workq period */
28894
28895-static atomic_t pci_parity_count = ATOMIC_INIT(0);
28896-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
28897+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
28898+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
28899
28900 static struct kobject *edac_pci_top_main_kobj;
28901 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
28902@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
28903 edac_printk(KERN_CRIT, EDAC_PCI,
28904 "Signaled System Error on %s\n",
28905 pci_name(dev));
28906- atomic_inc(&pci_nonparity_count);
28907+ atomic_inc_unchecked(&pci_nonparity_count);
28908 }
28909
28910 if (status & (PCI_STATUS_PARITY)) {
28911@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
28912 "Master Data Parity Error on %s\n",
28913 pci_name(dev));
28914
28915- atomic_inc(&pci_parity_count);
28916+ atomic_inc_unchecked(&pci_parity_count);
28917 }
28918
28919 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28920@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
28921 "Detected Parity Error on %s\n",
28922 pci_name(dev));
28923
28924- atomic_inc(&pci_parity_count);
28925+ atomic_inc_unchecked(&pci_parity_count);
28926 }
28927 }
28928
28929@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
28930 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
28931 "Signaled System Error on %s\n",
28932 pci_name(dev));
28933- atomic_inc(&pci_nonparity_count);
28934+ atomic_inc_unchecked(&pci_nonparity_count);
28935 }
28936
28937 if (status & (PCI_STATUS_PARITY)) {
28938@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
28939 "Master Data Parity Error on "
28940 "%s\n", pci_name(dev));
28941
28942- atomic_inc(&pci_parity_count);
28943+ atomic_inc_unchecked(&pci_parity_count);
28944 }
28945
28946 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28947@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
28948 "Detected Parity Error on %s\n",
28949 pci_name(dev));
28950
28951- atomic_inc(&pci_parity_count);
28952+ atomic_inc_unchecked(&pci_parity_count);
28953 }
28954 }
28955 }
28956@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
28957 if (!check_pci_errors)
28958 return;
28959
28960- before_count = atomic_read(&pci_parity_count);
28961+ before_count = atomic_read_unchecked(&pci_parity_count);
28962
28963 /* scan all PCI devices looking for a Parity Error on devices and
28964 * bridges.
28965@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
28966 /* Only if operator has selected panic on PCI Error */
28967 if (edac_pci_get_panic_on_pe()) {
28968 /* If the count is different 'after' from 'before' */
28969- if (before_count != atomic_read(&pci_parity_count))
28970+ if (before_count != atomic_read_unchecked(&pci_parity_count))
28971 panic("EDAC: PCI Parity Error");
28972 }
28973 }
28974diff -urNp linux-2.6.39.2/drivers/firewire/core-cdev.c linux-2.6.39.2/drivers/firewire/core-cdev.c
28975--- linux-2.6.39.2/drivers/firewire/core-cdev.c 2011-05-19 00:06:34.000000000 -0400
28976+++ linux-2.6.39.2/drivers/firewire/core-cdev.c 2011-05-22 19:36:31.000000000 -0400
28977@@ -1312,8 +1312,7 @@ static int init_iso_resource(struct clie
28978 int ret;
28979
28980 if ((request->channels == 0 && request->bandwidth == 0) ||
28981- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
28982- request->bandwidth < 0)
28983+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
28984 return -EINVAL;
28985
28986 r = kmalloc(sizeof(*r), GFP_KERNEL);
28987diff -urNp linux-2.6.39.2/drivers/firewire/core-transaction.c linux-2.6.39.2/drivers/firewire/core-transaction.c
28988--- linux-2.6.39.2/drivers/firewire/core-transaction.c 2011-05-19 00:06:34.000000000 -0400
28989+++ linux-2.6.39.2/drivers/firewire/core-transaction.c 2011-05-22 19:36:31.000000000 -0400
28990@@ -36,6 +36,7 @@
28991 #include <linux/string.h>
28992 #include <linux/timer.h>
28993 #include <linux/types.h>
28994+#include <linux/sched.h>
28995
28996 #include <asm/byteorder.h>
28997
28998@@ -420,6 +421,8 @@ int fw_run_transaction(struct fw_card *c
28999 struct transaction_callback_data d;
29000 struct fw_transaction t;
29001
29002+ pax_track_stack();
29003+
29004 init_timer_on_stack(&t.split_timeout_timer);
29005 init_completion(&d.done);
29006 d.payload = payload;
29007diff -urNp linux-2.6.39.2/drivers/firmware/dmi_scan.c linux-2.6.39.2/drivers/firmware/dmi_scan.c
29008--- linux-2.6.39.2/drivers/firmware/dmi_scan.c 2011-05-19 00:06:34.000000000 -0400
29009+++ linux-2.6.39.2/drivers/firmware/dmi_scan.c 2011-05-22 19:36:31.000000000 -0400
29010@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
29011 }
29012 }
29013 else {
29014- /*
29015- * no iounmap() for that ioremap(); it would be a no-op, but
29016- * it's so early in setup that sucker gets confused into doing
29017- * what it shouldn't if we actually call it.
29018- */
29019 p = dmi_ioremap(0xF0000, 0x10000);
29020 if (p == NULL)
29021 goto error;
29022diff -urNp linux-2.6.39.2/drivers/gpio/vr41xx_giu.c linux-2.6.39.2/drivers/gpio/vr41xx_giu.c
29023--- linux-2.6.39.2/drivers/gpio/vr41xx_giu.c 2011-05-19 00:06:34.000000000 -0400
29024+++ linux-2.6.39.2/drivers/gpio/vr41xx_giu.c 2011-05-22 19:36:31.000000000 -0400
29025@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
29026 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
29027 maskl, pendl, maskh, pendh);
29028
29029- atomic_inc(&irq_err_count);
29030+ atomic_inc_unchecked(&irq_err_count);
29031
29032 return -EINVAL;
29033 }
29034diff -urNp linux-2.6.39.2/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.39.2/drivers/gpu/drm/drm_crtc_helper.c
29035--- linux-2.6.39.2/drivers/gpu/drm/drm_crtc_helper.c 2011-05-19 00:06:34.000000000 -0400
29036+++ linux-2.6.39.2/drivers/gpu/drm/drm_crtc_helper.c 2011-05-22 19:36:31.000000000 -0400
29037@@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
29038 struct drm_crtc *tmp;
29039 int crtc_mask = 1;
29040
29041- WARN(!crtc, "checking null crtc?\n");
29042+ BUG_ON(!crtc);
29043
29044 dev = crtc->dev;
29045
29046@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
29047 struct drm_encoder *encoder;
29048 bool ret = true;
29049
29050+ pax_track_stack();
29051+
29052 crtc->enabled = drm_helper_crtc_in_use(crtc);
29053 if (!crtc->enabled)
29054 return true;
29055diff -urNp linux-2.6.39.2/drivers/gpu/drm/drm_drv.c linux-2.6.39.2/drivers/gpu/drm/drm_drv.c
29056--- linux-2.6.39.2/drivers/gpu/drm/drm_drv.c 2011-05-19 00:06:34.000000000 -0400
29057+++ linux-2.6.39.2/drivers/gpu/drm/drm_drv.c 2011-05-22 19:36:31.000000000 -0400
29058@@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
29059
29060 dev = file_priv->minor->dev;
29061 atomic_inc(&dev->ioctl_count);
29062- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
29063+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
29064 ++file_priv->ioctl_count;
29065
29066 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
29067diff -urNp linux-2.6.39.2/drivers/gpu/drm/drm_fops.c linux-2.6.39.2/drivers/gpu/drm/drm_fops.c
29068--- linux-2.6.39.2/drivers/gpu/drm/drm_fops.c 2011-05-19 00:06:34.000000000 -0400
29069+++ linux-2.6.39.2/drivers/gpu/drm/drm_fops.c 2011-05-22 19:36:31.000000000 -0400
29070@@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
29071 }
29072
29073 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
29074- atomic_set(&dev->counts[i], 0);
29075+ atomic_set_unchecked(&dev->counts[i], 0);
29076
29077 dev->sigdata.lock = NULL;
29078
29079@@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct
29080
29081 retcode = drm_open_helper(inode, filp, dev);
29082 if (!retcode) {
29083- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
29084- if (!dev->open_count++)
29085+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
29086+ if (local_inc_return(&dev->open_count) == 1)
29087 retcode = drm_setup(dev);
29088 }
29089 if (!retcode) {
29090@@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
29091
29092 mutex_lock(&drm_global_mutex);
29093
29094- DRM_DEBUG("open_count = %d\n", dev->open_count);
29095+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
29096
29097 if (dev->driver->preclose)
29098 dev->driver->preclose(dev, file_priv);
29099@@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
29100 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
29101 task_pid_nr(current),
29102 (long)old_encode_dev(file_priv->minor->device),
29103- dev->open_count);
29104+ local_read(&dev->open_count));
29105
29106 /* if the master has gone away we can't do anything with the lock */
29107 if (file_priv->minor->master)
29108@@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str
29109 * End inline drm_release
29110 */
29111
29112- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
29113- if (!--dev->open_count) {
29114+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
29115+ if (local_dec_and_test(&dev->open_count)) {
29116 if (atomic_read(&dev->ioctl_count)) {
29117 DRM_ERROR("Device busy: %d\n",
29118 atomic_read(&dev->ioctl_count));
29119diff -urNp linux-2.6.39.2/drivers/gpu/drm/drm_global.c linux-2.6.39.2/drivers/gpu/drm/drm_global.c
29120--- linux-2.6.39.2/drivers/gpu/drm/drm_global.c 2011-05-19 00:06:34.000000000 -0400
29121+++ linux-2.6.39.2/drivers/gpu/drm/drm_global.c 2011-05-22 19:36:31.000000000 -0400
29122@@ -36,7 +36,7 @@
29123 struct drm_global_item {
29124 struct mutex mutex;
29125 void *object;
29126- int refcount;
29127+ atomic_t refcount;
29128 };
29129
29130 static struct drm_global_item glob[DRM_GLOBAL_NUM];
29131@@ -49,7 +49,7 @@ void drm_global_init(void)
29132 struct drm_global_item *item = &glob[i];
29133 mutex_init(&item->mutex);
29134 item->object = NULL;
29135- item->refcount = 0;
29136+ atomic_set(&item->refcount, 0);
29137 }
29138 }
29139
29140@@ -59,7 +59,7 @@ void drm_global_release(void)
29141 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
29142 struct drm_global_item *item = &glob[i];
29143 BUG_ON(item->object != NULL);
29144- BUG_ON(item->refcount != 0);
29145+ BUG_ON(atomic_read(&item->refcount) != 0);
29146 }
29147 }
29148
29149@@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa
29150 void *object;
29151
29152 mutex_lock(&item->mutex);
29153- if (item->refcount == 0) {
29154+ if (atomic_read(&item->refcount) == 0) {
29155 item->object = kzalloc(ref->size, GFP_KERNEL);
29156 if (unlikely(item->object == NULL)) {
29157 ret = -ENOMEM;
29158@@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa
29159 goto out_err;
29160
29161 }
29162- ++item->refcount;
29163+ atomic_inc(&item->refcount);
29164 ref->object = item->object;
29165 object = item->object;
29166 mutex_unlock(&item->mutex);
29167@@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl
29168 struct drm_global_item *item = &glob[ref->global_type];
29169
29170 mutex_lock(&item->mutex);
29171- BUG_ON(item->refcount == 0);
29172+ BUG_ON(atomic_read(&item->refcount) == 0);
29173 BUG_ON(ref->object != item->object);
29174- if (--item->refcount == 0) {
29175+ if (atomic_dec_and_test(&item->refcount)) {
29176 ref->release(ref);
29177 item->object = NULL;
29178 }
29179diff -urNp linux-2.6.39.2/drivers/gpu/drm/drm_info.c linux-2.6.39.2/drivers/gpu/drm/drm_info.c
29180--- linux-2.6.39.2/drivers/gpu/drm/drm_info.c 2011-05-19 00:06:34.000000000 -0400
29181+++ linux-2.6.39.2/drivers/gpu/drm/drm_info.c 2011-05-22 19:41:37.000000000 -0400
29182@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
29183 struct drm_local_map *map;
29184 struct drm_map_list *r_list;
29185
29186- /* Hardcoded from _DRM_FRAME_BUFFER,
29187- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
29188- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
29189- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
29190+ static const char * const types[] = {
29191+ [_DRM_FRAME_BUFFER] = "FB",
29192+ [_DRM_REGISTERS] = "REG",
29193+ [_DRM_SHM] = "SHM",
29194+ [_DRM_AGP] = "AGP",
29195+ [_DRM_SCATTER_GATHER] = "SG",
29196+ [_DRM_CONSISTENT] = "PCI",
29197+ [_DRM_GEM] = "GEM" };
29198 const char *type;
29199 int i;
29200
29201@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
29202 map = r_list->map;
29203 if (!map)
29204 continue;
29205- if (map->type < 0 || map->type > 5)
29206+ if (map->type >= ARRAY_SIZE(types))
29207 type = "??";
29208 else
29209 type = types[map->type];
29210@@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi
29211 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
29212 vma->vm_flags & VM_LOCKED ? 'l' : '-',
29213 vma->vm_flags & VM_IO ? 'i' : '-',
29214+#ifdef CONFIG_GRKERNSEC_HIDESYM
29215+ 0);
29216+#else
29217 vma->vm_pgoff);
29218+#endif
29219
29220 #if defined(__i386__)
29221 pgprot = pgprot_val(vma->vm_page_prot);
29222diff -urNp linux-2.6.39.2/drivers/gpu/drm/drm_ioctl.c linux-2.6.39.2/drivers/gpu/drm/drm_ioctl.c
29223--- linux-2.6.39.2/drivers/gpu/drm/drm_ioctl.c 2011-05-19 00:06:34.000000000 -0400
29224+++ linux-2.6.39.2/drivers/gpu/drm/drm_ioctl.c 2011-05-22 19:36:31.000000000 -0400
29225@@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev,
29226 stats->data[i].value =
29227 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
29228 else
29229- stats->data[i].value = atomic_read(&dev->counts[i]);
29230+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
29231 stats->data[i].type = dev->types[i];
29232 }
29233
29234diff -urNp linux-2.6.39.2/drivers/gpu/drm/drm_lock.c linux-2.6.39.2/drivers/gpu/drm/drm_lock.c
29235--- linux-2.6.39.2/drivers/gpu/drm/drm_lock.c 2011-05-19 00:06:34.000000000 -0400
29236+++ linux-2.6.39.2/drivers/gpu/drm/drm_lock.c 2011-05-22 19:36:31.000000000 -0400
29237@@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
29238 if (drm_lock_take(&master->lock, lock->context)) {
29239 master->lock.file_priv = file_priv;
29240 master->lock.lock_time = jiffies;
29241- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
29242+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
29243 break; /* Got lock */
29244 }
29245
29246@@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v
29247 return -EINVAL;
29248 }
29249
29250- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
29251+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
29252
29253 if (drm_lock_free(&master->lock, lock->context)) {
29254 /* FIXME: Should really bail out here. */
29255diff -urNp linux-2.6.39.2/drivers/gpu/drm/i810/i810_dma.c linux-2.6.39.2/drivers/gpu/drm/i810/i810_dma.c
29256--- linux-2.6.39.2/drivers/gpu/drm/i810/i810_dma.c 2011-05-19 00:06:34.000000000 -0400
29257+++ linux-2.6.39.2/drivers/gpu/drm/i810/i810_dma.c 2011-05-22 19:36:31.000000000 -0400
29258@@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de
29259 dma->buflist[vertex->idx],
29260 vertex->discard, vertex->used);
29261
29262- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
29263- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
29264+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
29265+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
29266 sarea_priv->last_enqueue = dev_priv->counter - 1;
29267 sarea_priv->last_dispatch = (int)hw_status[5];
29268
29269@@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device
29270 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
29271 mc->last_render);
29272
29273- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
29274- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
29275+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
29276+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
29277 sarea_priv->last_enqueue = dev_priv->counter - 1;
29278 sarea_priv->last_dispatch = (int)hw_status[5];
29279
29280diff -urNp linux-2.6.39.2/drivers/gpu/drm/i810/i810_drv.h linux-2.6.39.2/drivers/gpu/drm/i810/i810_drv.h
29281--- linux-2.6.39.2/drivers/gpu/drm/i810/i810_drv.h 2011-05-19 00:06:34.000000000 -0400
29282+++ linux-2.6.39.2/drivers/gpu/drm/i810/i810_drv.h 2011-05-22 19:36:31.000000000 -0400
29283@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
29284 int page_flipping;
29285
29286 wait_queue_head_t irq_queue;
29287- atomic_t irq_received;
29288- atomic_t irq_emitted;
29289+ atomic_unchecked_t irq_received;
29290+ atomic_unchecked_t irq_emitted;
29291
29292 int front_offset;
29293 } drm_i810_private_t;
29294diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7017.c
29295--- linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-19 00:06:34.000000000 -0400
29296+++ linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-22 19:36:31.000000000 -0400
29297@@ -390,7 +390,7 @@ static void ch7017_destroy(struct intel_
29298 }
29299 }
29300
29301-struct intel_dvo_dev_ops ch7017_ops = {
29302+const struct intel_dvo_dev_ops ch7017_ops = {
29303 .init = ch7017_init,
29304 .detect = ch7017_detect,
29305 .mode_valid = ch7017_mode_valid,
29306diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7xxx.c
29307--- linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-19 00:06:34.000000000 -0400
29308+++ linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-22 19:36:31.000000000 -0400
29309@@ -320,7 +320,7 @@ static void ch7xxx_destroy(struct intel_
29310 }
29311 }
29312
29313-struct intel_dvo_dev_ops ch7xxx_ops = {
29314+const struct intel_dvo_dev_ops ch7xxx_ops = {
29315 .init = ch7xxx_init,
29316 .detect = ch7xxx_detect,
29317 .mode_valid = ch7xxx_mode_valid,
29318diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/dvo.h linux-2.6.39.2/drivers/gpu/drm/i915/dvo.h
29319--- linux-2.6.39.2/drivers/gpu/drm/i915/dvo.h 2011-05-19 00:06:34.000000000 -0400
29320+++ linux-2.6.39.2/drivers/gpu/drm/i915/dvo.h 2011-05-22 19:36:31.000000000 -0400
29321@@ -122,23 +122,23 @@ struct intel_dvo_dev_ops {
29322 *
29323 * \return singly-linked list of modes or NULL if no modes found.
29324 */
29325- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
29326+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
29327
29328 /**
29329 * Clean up driver-specific bits of the output
29330 */
29331- void (*destroy) (struct intel_dvo_device *dvo);
29332+ void (* const destroy) (struct intel_dvo_device *dvo);
29333
29334 /**
29335 * Debugging hook to dump device registers to log file
29336 */
29337- void (*dump_regs)(struct intel_dvo_device *dvo);
29338+ void (* const dump_regs)(struct intel_dvo_device *dvo);
29339 };
29340
29341-extern struct intel_dvo_dev_ops sil164_ops;
29342-extern struct intel_dvo_dev_ops ch7xxx_ops;
29343-extern struct intel_dvo_dev_ops ivch_ops;
29344-extern struct intel_dvo_dev_ops tfp410_ops;
29345-extern struct intel_dvo_dev_ops ch7017_ops;
29346+extern const struct intel_dvo_dev_ops sil164_ops;
29347+extern const struct intel_dvo_dev_ops ch7xxx_ops;
29348+extern const struct intel_dvo_dev_ops ivch_ops;
29349+extern const struct intel_dvo_dev_ops tfp410_ops;
29350+extern const struct intel_dvo_dev_ops ch7017_ops;
29351
29352 #endif /* _INTEL_DVO_H */
29353diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ivch.c
29354--- linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-19 00:06:34.000000000 -0400
29355+++ linux-2.6.39.2/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-22 19:36:31.000000000 -0400
29356@@ -410,7 +410,7 @@ static void ivch_destroy(struct intel_dv
29357 }
29358 }
29359
29360-struct intel_dvo_dev_ops ivch_ops= {
29361+const struct intel_dvo_dev_ops ivch_ops= {
29362 .init = ivch_init,
29363 .dpms = ivch_dpms,
29364 .mode_valid = ivch_mode_valid,
29365diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.39.2/drivers/gpu/drm/i915/dvo_sil164.c
29366--- linux-2.6.39.2/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-19 00:06:34.000000000 -0400
29367+++ linux-2.6.39.2/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-22 19:36:31.000000000 -0400
29368@@ -252,7 +252,7 @@ static void sil164_destroy(struct intel_
29369 }
29370 }
29371
29372-struct intel_dvo_dev_ops sil164_ops = {
29373+const struct intel_dvo_dev_ops sil164_ops = {
29374 .init = sil164_init,
29375 .detect = sil164_detect,
29376 .mode_valid = sil164_mode_valid,
29377diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.39.2/drivers/gpu/drm/i915/dvo_tfp410.c
29378--- linux-2.6.39.2/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-19 00:06:34.000000000 -0400
29379+++ linux-2.6.39.2/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-22 19:36:31.000000000 -0400
29380@@ -293,7 +293,7 @@ static void tfp410_destroy(struct intel_
29381 }
29382 }
29383
29384-struct intel_dvo_dev_ops tfp410_ops = {
29385+const struct intel_dvo_dev_ops tfp410_ops = {
29386 .init = tfp410_init,
29387 .detect = tfp410_detect,
29388 .mode_valid = tfp410_mode_valid,
29389diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.39.2/drivers/gpu/drm/i915/i915_debugfs.c
29390--- linux-2.6.39.2/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-19 00:06:34.000000000 -0400
29391+++ linux-2.6.39.2/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-22 19:36:31.000000000 -0400
29392@@ -496,7 +496,7 @@ static int i915_interrupt_info(struct se
29393 I915_READ(GTIMR));
29394 }
29395 seq_printf(m, "Interrupts received: %d\n",
29396- atomic_read(&dev_priv->irq_received));
29397+ atomic_read_unchecked(&dev_priv->irq_received));
29398 for (i = 0; i < I915_NUM_RINGS; i++) {
29399 if (IS_GEN6(dev)) {
29400 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
29401diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/i915_dma.c linux-2.6.39.2/drivers/gpu/drm/i915/i915_dma.c
29402--- linux-2.6.39.2/drivers/gpu/drm/i915/i915_dma.c 2011-05-19 00:06:34.000000000 -0400
29403+++ linux-2.6.39.2/drivers/gpu/drm/i915/i915_dma.c 2011-05-22 19:36:31.000000000 -0400
29404@@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(s
29405 bool can_switch;
29406
29407 spin_lock(&dev->count_lock);
29408- can_switch = (dev->open_count == 0);
29409+ can_switch = (local_read(&dev->open_count) == 0);
29410 spin_unlock(&dev->count_lock);
29411 return can_switch;
29412 }
29413diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.c linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.c
29414--- linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.c 2011-05-19 00:06:34.000000000 -0400
29415+++ linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.c 2011-05-22 19:36:31.000000000 -0400
29416@@ -679,7 +679,7 @@ static const struct dev_pm_ops i915_pm_o
29417 .restore = i915_pm_resume,
29418 };
29419
29420-static struct vm_operations_struct i915_gem_vm_ops = {
29421+static const struct vm_operations_struct i915_gem_vm_ops = {
29422 .fault = i915_gem_fault,
29423 .open = drm_gem_vm_open,
29424 .close = drm_gem_vm_close,
29425diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.h linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.h
29426--- linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.h 2011-05-19 00:06:34.000000000 -0400
29427+++ linux-2.6.39.2/drivers/gpu/drm/i915/i915_drv.h 2011-05-22 19:36:31.000000000 -0400
29428@@ -287,7 +287,7 @@ typedef struct drm_i915_private {
29429 int current_page;
29430 int page_flipping;
29431
29432- atomic_t irq_received;
29433+ atomic_unchecked_t irq_received;
29434
29435 /* protects the irq masks */
29436 spinlock_t irq_lock;
29437@@ -848,7 +848,7 @@ struct drm_i915_gem_object {
29438 * will be page flipped away on the next vblank. When it
29439 * reaches 0, dev_priv->pending_flip_queue will be woken up.
29440 */
29441- atomic_t pending_flip;
29442+ atomic_unchecked_t pending_flip;
29443 };
29444
29445 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
29446@@ -1232,7 +1232,7 @@ extern int intel_setup_gmbus(struct drm_
29447 extern void intel_teardown_gmbus(struct drm_device *dev);
29448 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
29449 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
29450-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29451+static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29452 {
29453 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
29454 }
29455diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-2.6.39.2/drivers/gpu/drm/i915/i915_gem_execbuffer.c
29456--- linux-2.6.39.2/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-19 00:06:34.000000000 -0400
29457+++ linux-2.6.39.2/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-22 19:36:31.000000000 -0400
29458@@ -192,7 +192,7 @@ i915_gem_object_set_to_gpu_domain(struct
29459 i915_gem_release_mmap(obj);
29460
29461 if (obj->base.pending_write_domain)
29462- cd->flips |= atomic_read(&obj->pending_flip);
29463+ cd->flips |= atomic_read_unchecked(&obj->pending_flip);
29464
29465 /* The actual obj->write_domain will be updated with
29466 * pending_write_domain after we emit the accumulated flush for all
29467diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/i915_irq.c linux-2.6.39.2/drivers/gpu/drm/i915/i915_irq.c
29468--- linux-2.6.39.2/drivers/gpu/drm/i915/i915_irq.c 2011-05-19 00:06:34.000000000 -0400
29469+++ linux-2.6.39.2/drivers/gpu/drm/i915/i915_irq.c 2011-05-22 19:36:31.000000000 -0400
29470@@ -1101,7 +1101,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
29471 int ret = IRQ_NONE, pipe;
29472 bool blc_event = false;
29473
29474- atomic_inc(&dev_priv->irq_received);
29475+ atomic_inc_unchecked(&dev_priv->irq_received);
29476
29477 if (HAS_PCH_SPLIT(dev))
29478 return ironlake_irq_handler(dev);
29479@@ -1655,7 +1655,7 @@ void i915_driver_irq_preinstall(struct d
29480 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
29481 int pipe;
29482
29483- atomic_set(&dev_priv->irq_received, 0);
29484+ atomic_set_unchecked(&dev_priv->irq_received, 0);
29485
29486 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
29487 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
29488diff -urNp linux-2.6.39.2/drivers/gpu/drm/i915/intel_display.c linux-2.6.39.2/drivers/gpu/drm/i915/intel_display.c
29489--- linux-2.6.39.2/drivers/gpu/drm/i915/intel_display.c 2011-05-19 00:06:34.000000000 -0400
29490+++ linux-2.6.39.2/drivers/gpu/drm/i915/intel_display.c 2011-05-22 19:36:31.000000000 -0400
29491@@ -2244,7 +2244,7 @@ intel_pipe_set_base(struct drm_crtc *crt
29492
29493 wait_event(dev_priv->pending_flip_queue,
29494 atomic_read(&dev_priv->mm.wedged) ||
29495- atomic_read(&obj->pending_flip) == 0);
29496+ atomic_read_unchecked(&obj->pending_flip) == 0);
29497
29498 /* Big Hammer, we also need to ensure that any pending
29499 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
29500@@ -2712,7 +2712,7 @@ static void intel_crtc_wait_for_pending_
29501 obj = to_intel_framebuffer(crtc->fb)->obj;
29502 dev_priv = crtc->dev->dev_private;
29503 wait_event(dev_priv->pending_flip_queue,
29504- atomic_read(&obj->pending_flip) == 0);
29505+ atomic_read_unchecked(&obj->pending_flip) == 0);
29506 }
29507
29508 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
29509@@ -6016,7 +6016,7 @@ static void do_intel_finish_page_flip(st
29510
29511 atomic_clear_mask(1 << intel_crtc->plane,
29512 &obj->pending_flip.counter);
29513- if (atomic_read(&obj->pending_flip) == 0)
29514+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
29515 wake_up(&dev_priv->pending_flip_queue);
29516
29517 schedule_work(&work->work);
29518@@ -6145,7 +6145,7 @@ static int intel_crtc_page_flip(struct d
29519 /* Block clients from rendering to the new back buffer until
29520 * the flip occurs and the object is no longer visible.
29521 */
29522- atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29523+ atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29524
29525 switch (INTEL_INFO(dev)->gen) {
29526 case 2:
29527diff -urNp linux-2.6.39.2/drivers/gpu/drm/mga/mga_drv.h linux-2.6.39.2/drivers/gpu/drm/mga/mga_drv.h
29528--- linux-2.6.39.2/drivers/gpu/drm/mga/mga_drv.h 2011-05-19 00:06:34.000000000 -0400
29529+++ linux-2.6.39.2/drivers/gpu/drm/mga/mga_drv.h 2011-05-22 19:36:31.000000000 -0400
29530@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
29531 u32 clear_cmd;
29532 u32 maccess;
29533
29534- atomic_t vbl_received; /**< Number of vblanks received. */
29535+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
29536 wait_queue_head_t fence_queue;
29537- atomic_t last_fence_retired;
29538+ atomic_unchecked_t last_fence_retired;
29539 u32 next_fence_to_post;
29540
29541 unsigned int fb_cpp;
29542diff -urNp linux-2.6.39.2/drivers/gpu/drm/mga/mga_irq.c linux-2.6.39.2/drivers/gpu/drm/mga/mga_irq.c
29543--- linux-2.6.39.2/drivers/gpu/drm/mga/mga_irq.c 2011-05-19 00:06:34.000000000 -0400
29544+++ linux-2.6.39.2/drivers/gpu/drm/mga/mga_irq.c 2011-05-22 19:36:31.000000000 -0400
29545@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
29546 if (crtc != 0)
29547 return 0;
29548
29549- return atomic_read(&dev_priv->vbl_received);
29550+ return atomic_read_unchecked(&dev_priv->vbl_received);
29551 }
29552
29553
29554@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29555 /* VBLANK interrupt */
29556 if (status & MGA_VLINEPEN) {
29557 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
29558- atomic_inc(&dev_priv->vbl_received);
29559+ atomic_inc_unchecked(&dev_priv->vbl_received);
29560 drm_handle_vblank(dev, 0);
29561 handled = 1;
29562 }
29563@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29564 if ((prim_start & ~0x03) != (prim_end & ~0x03))
29565 MGA_WRITE(MGA_PRIMEND, prim_end);
29566
29567- atomic_inc(&dev_priv->last_fence_retired);
29568+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
29569 DRM_WAKEUP(&dev_priv->fence_queue);
29570 handled = 1;
29571 }
29572@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
29573 * using fences.
29574 */
29575 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
29576- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
29577+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
29578 - *sequence) <= (1 << 23)));
29579
29580 *sequence = cur_fence;
29581diff -urNp linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_acpi.c linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_acpi.c
29582--- linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-19 00:06:34.000000000 -0400
29583+++ linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-22 19:36:31.000000000 -0400
29584@@ -141,7 +141,7 @@ static int nouveau_dsm_get_client_id(str
29585 return VGA_SWITCHEROO_DIS;
29586 }
29587
29588-static struct vga_switcheroo_handler nouveau_dsm_handler = {
29589+static const struct vga_switcheroo_handler nouveau_dsm_handler = {
29590 .switchto = nouveau_dsm_switchto,
29591 .power_state = nouveau_dsm_power_state,
29592 .init = nouveau_dsm_init,
29593diff -urNp linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_drv.h
29594--- linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-19 00:06:34.000000000 -0400
29595+++ linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-06-07 18:07:24.000000000 -0400
29596@@ -228,7 +228,7 @@ struct nouveau_channel {
29597 struct list_head pending;
29598 uint32_t sequence;
29599 uint32_t sequence_ack;
29600- atomic_t last_sequence_irq;
29601+ atomic_unchecked_t last_sequence_irq;
29602 } fence;
29603
29604 /* DMA push buffer */
29605@@ -662,7 +662,7 @@ struct drm_nouveau_private {
29606 struct drm_global_reference mem_global_ref;
29607 struct ttm_bo_global_ref bo_global_ref;
29608 struct ttm_bo_device bdev;
29609- atomic_t validate_sequence;
29610+ atomic_unchecked_t validate_sequence;
29611 } ttm;
29612
29613 struct {
29614diff -urNp linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_fence.c linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_fence.c
29615--- linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-19 00:06:34.000000000 -0400
29616+++ linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-22 19:36:31.000000000 -0400
29617@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan
29618 if (USE_REFCNT(dev))
29619 sequence = nvchan_rd32(chan, 0x48);
29620 else
29621- sequence = atomic_read(&chan->fence.last_sequence_irq);
29622+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
29623
29624 if (chan->fence.sequence_ack == sequence)
29625 goto out;
29626@@ -553,7 +553,7 @@ nouveau_fence_channel_init(struct nouvea
29627 out_initialised:
29628 INIT_LIST_HEAD(&chan->fence.pending);
29629 spin_lock_init(&chan->fence.lock);
29630- atomic_set(&chan->fence.last_sequence_irq, 0);
29631+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
29632 return 0;
29633 }
29634
29635diff -urNp linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_gem.c linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_gem.c
29636--- linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-19 00:06:34.000000000 -0400
29637+++ linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-22 19:36:31.000000000 -0400
29638@@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch
29639 int trycnt = 0;
29640 int ret, i;
29641
29642- sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
29643+ sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
29644 retry:
29645 if (++trycnt > 100000) {
29646 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
29647diff -urNp linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_state.c
29648--- linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-19 00:06:34.000000000 -0400
29649+++ linux-2.6.39.2/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-22 19:36:31.000000000 -0400
29650@@ -583,7 +583,7 @@ static bool nouveau_switcheroo_can_switc
29651 bool can_switch;
29652
29653 spin_lock(&dev->count_lock);
29654- can_switch = (dev->open_count == 0);
29655+ can_switch = (local_read(&dev->open_count) == 0);
29656 spin_unlock(&dev->count_lock);
29657 return can_switch;
29658 }
29659diff -urNp linux-2.6.39.2/drivers/gpu/drm/nouveau/nv04_graph.c linux-2.6.39.2/drivers/gpu/drm/nouveau/nv04_graph.c
29660--- linux-2.6.39.2/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-19 00:06:34.000000000 -0400
29661+++ linux-2.6.39.2/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-22 19:36:31.000000000 -0400
29662@@ -552,7 +552,7 @@ static int
29663 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
29664 u32 class, u32 mthd, u32 data)
29665 {
29666- atomic_set(&chan->fence.last_sequence_irq, data);
29667+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
29668 return 0;
29669 }
29670
29671diff -urNp linux-2.6.39.2/drivers/gpu/drm/r128/r128_cce.c linux-2.6.39.2/drivers/gpu/drm/r128/r128_cce.c
29672--- linux-2.6.39.2/drivers/gpu/drm/r128/r128_cce.c 2011-05-19 00:06:34.000000000 -0400
29673+++ linux-2.6.39.2/drivers/gpu/drm/r128/r128_cce.c 2011-05-22 19:36:31.000000000 -0400
29674@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
29675
29676 /* GH: Simple idle check.
29677 */
29678- atomic_set(&dev_priv->idle_count, 0);
29679+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29680
29681 /* We don't support anything other than bus-mastering ring mode,
29682 * but the ring can be in either AGP or PCI space for the ring
29683diff -urNp linux-2.6.39.2/drivers/gpu/drm/r128/r128_drv.h linux-2.6.39.2/drivers/gpu/drm/r128/r128_drv.h
29684--- linux-2.6.39.2/drivers/gpu/drm/r128/r128_drv.h 2011-05-19 00:06:34.000000000 -0400
29685+++ linux-2.6.39.2/drivers/gpu/drm/r128/r128_drv.h 2011-05-22 19:36:31.000000000 -0400
29686@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
29687 int is_pci;
29688 unsigned long cce_buffers_offset;
29689
29690- atomic_t idle_count;
29691+ atomic_unchecked_t idle_count;
29692
29693 int page_flipping;
29694 int current_page;
29695 u32 crtc_offset;
29696 u32 crtc_offset_cntl;
29697
29698- atomic_t vbl_received;
29699+ atomic_unchecked_t vbl_received;
29700
29701 u32 color_fmt;
29702 unsigned int front_offset;
29703diff -urNp linux-2.6.39.2/drivers/gpu/drm/r128/r128_irq.c linux-2.6.39.2/drivers/gpu/drm/r128/r128_irq.c
29704--- linux-2.6.39.2/drivers/gpu/drm/r128/r128_irq.c 2011-05-19 00:06:34.000000000 -0400
29705+++ linux-2.6.39.2/drivers/gpu/drm/r128/r128_irq.c 2011-05-22 19:36:31.000000000 -0400
29706@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
29707 if (crtc != 0)
29708 return 0;
29709
29710- return atomic_read(&dev_priv->vbl_received);
29711+ return atomic_read_unchecked(&dev_priv->vbl_received);
29712 }
29713
29714 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
29715@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
29716 /* VBLANK interrupt */
29717 if (status & R128_CRTC_VBLANK_INT) {
29718 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
29719- atomic_inc(&dev_priv->vbl_received);
29720+ atomic_inc_unchecked(&dev_priv->vbl_received);
29721 drm_handle_vblank(dev, 0);
29722 return IRQ_HANDLED;
29723 }
29724diff -urNp linux-2.6.39.2/drivers/gpu/drm/r128/r128_state.c linux-2.6.39.2/drivers/gpu/drm/r128/r128_state.c
29725--- linux-2.6.39.2/drivers/gpu/drm/r128/r128_state.c 2011-05-19 00:06:34.000000000 -0400
29726+++ linux-2.6.39.2/drivers/gpu/drm/r128/r128_state.c 2011-05-22 19:36:31.000000000 -0400
29727@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
29728
29729 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
29730 {
29731- if (atomic_read(&dev_priv->idle_count) == 0)
29732+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
29733 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
29734 else
29735- atomic_set(&dev_priv->idle_count, 0);
29736+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29737 }
29738
29739 #endif
29740diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/atom.c linux-2.6.39.2/drivers/gpu/drm/radeon/atom.c
29741--- linux-2.6.39.2/drivers/gpu/drm/radeon/atom.c 2011-05-19 00:06:34.000000000 -0400
29742+++ linux-2.6.39.2/drivers/gpu/drm/radeon/atom.c 2011-05-22 19:36:31.000000000 -0400
29743@@ -1245,6 +1245,8 @@ struct atom_context *atom_parse(struct c
29744 char name[512];
29745 int i;
29746
29747+ pax_track_stack();
29748+
29749 ctx->card = card;
29750 ctx->bios = bios;
29751
29752diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.39.2/drivers/gpu/drm/radeon/mkregtable.c
29753--- linux-2.6.39.2/drivers/gpu/drm/radeon/mkregtable.c 2011-05-19 00:06:34.000000000 -0400
29754+++ linux-2.6.39.2/drivers/gpu/drm/radeon/mkregtable.c 2011-05-22 19:36:31.000000000 -0400
29755@@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
29756 regex_t mask_rex;
29757 regmatch_t match[4];
29758 char buf[1024];
29759- size_t end;
29760+ long end;
29761 int len;
29762 int done = 0;
29763 int r;
29764 unsigned o;
29765 struct offset *offset;
29766 char last_reg_s[10];
29767- int last_reg;
29768+ unsigned long last_reg;
29769
29770 if (regcomp
29771 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
29772diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atombios.c
29773--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-19 00:06:34.000000000 -0400
29774+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-22 19:36:31.000000000 -0400
29775@@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
29776 struct radeon_gpio_rec gpio;
29777 struct radeon_hpd hpd;
29778
29779+ pax_track_stack();
29780+
29781 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
29782 return false;
29783
29784diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atpx_handler.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atpx_handler.c
29785--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-19 00:06:34.000000000 -0400
29786+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-22 19:36:31.000000000 -0400
29787@@ -234,7 +234,7 @@ static int radeon_atpx_get_client_id(str
29788 return VGA_SWITCHEROO_DIS;
29789 }
29790
29791-static struct vga_switcheroo_handler radeon_atpx_handler = {
29792+static const struct vga_switcheroo_handler radeon_atpx_handler = {
29793 .switchto = radeon_atpx_switchto,
29794 .power_state = radeon_atpx_power_state,
29795 .init = radeon_atpx_init,
29796diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_device.c
29797--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_device.c 2011-06-25 12:55:22.000000000 -0400
29798+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_device.c 2011-06-25 13:00:25.000000000 -0400
29799@@ -674,7 +674,7 @@ static bool radeon_switcheroo_can_switch
29800 bool can_switch;
29801
29802 spin_lock(&dev->count_lock);
29803- can_switch = (dev->open_count == 0);
29804+ can_switch = (local_read(&dev->open_count) == 0);
29805 spin_unlock(&dev->count_lock);
29806 return can_switch;
29807 }
29808diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_display.c
29809--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_display.c 2011-05-19 00:06:34.000000000 -0400
29810+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_display.c 2011-05-22 19:36:31.000000000 -0400
29811@@ -934,6 +934,8 @@ void radeon_compute_pll_legacy(struct ra
29812 uint32_t post_div;
29813 u32 pll_out_min, pll_out_max;
29814
29815+ pax_track_stack();
29816+
29817 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
29818 freq = freq * 1000;
29819
29820diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_drv.h
29821--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-19 00:06:34.000000000 -0400
29822+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-22 19:36:31.000000000 -0400
29823@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
29824
29825 /* SW interrupt */
29826 wait_queue_head_t swi_queue;
29827- atomic_t swi_emitted;
29828+ atomic_unchecked_t swi_emitted;
29829 int vblank_crtc;
29830 uint32_t irq_enable_reg;
29831 uint32_t r500_disp_irq_reg;
29832diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_fence.c
29833--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-19 00:06:34.000000000 -0400
29834+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-22 19:36:31.000000000 -0400
29835@@ -49,7 +49,7 @@ int radeon_fence_emit(struct radeon_devi
29836 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
29837 return 0;
29838 }
29839- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
29840+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
29841 if (!rdev->cp.ready) {
29842 /* FIXME: cp is not running assume everythings is done right
29843 * away
29844@@ -352,7 +352,7 @@ int radeon_fence_driver_init(struct rade
29845 return r;
29846 }
29847 WREG32(rdev->fence_drv.scratch_reg, 0);
29848- atomic_set(&rdev->fence_drv.seq, 0);
29849+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
29850 INIT_LIST_HEAD(&rdev->fence_drv.created);
29851 INIT_LIST_HEAD(&rdev->fence_drv.emited);
29852 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
29853diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon.h linux-2.6.39.2/drivers/gpu/drm/radeon/radeon.h
29854--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon.h 2011-05-19 00:06:34.000000000 -0400
29855+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon.h 2011-05-22 19:36:31.000000000 -0400
29856@@ -189,7 +189,7 @@ extern int sumo_get_temp(struct radeon_d
29857 */
29858 struct radeon_fence_driver {
29859 uint32_t scratch_reg;
29860- atomic_t seq;
29861+ atomic_unchecked_t seq;
29862 uint32_t last_seq;
29863 unsigned long last_jiffies;
29864 unsigned long last_timeout;
29865diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ioc32.c
29866--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-19 00:06:34.000000000 -0400
29867+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-22 19:36:31.000000000 -0400
29868@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
29869 request = compat_alloc_user_space(sizeof(*request));
29870 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
29871 || __put_user(req32.param, &request->param)
29872- || __put_user((void __user *)(unsigned long)req32.value,
29873+ || __put_user((unsigned long)req32.value,
29874 &request->value))
29875 return -EFAULT;
29876
29877diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_irq.c
29878--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-19 00:06:34.000000000 -0400
29879+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-22 19:36:31.000000000 -0400
29880@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
29881 unsigned int ret;
29882 RING_LOCALS;
29883
29884- atomic_inc(&dev_priv->swi_emitted);
29885- ret = atomic_read(&dev_priv->swi_emitted);
29886+ atomic_inc_unchecked(&dev_priv->swi_emitted);
29887+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
29888
29889 BEGIN_RING(4);
29890 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
29891@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
29892 drm_radeon_private_t *dev_priv =
29893 (drm_radeon_private_t *) dev->dev_private;
29894
29895- atomic_set(&dev_priv->swi_emitted, 0);
29896+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
29897 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
29898
29899 dev->max_vblank_count = 0x001fffff;
29900diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_state.c
29901--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_state.c 2011-05-19 00:06:34.000000000 -0400
29902+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_state.c 2011-05-22 19:36:31.000000000 -0400
29903@@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
29904 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
29905 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
29906
29907- if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29908+ if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29909 sarea_priv->nbox * sizeof(depth_boxes[0])))
29910 return -EFAULT;
29911
29912@@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm
29913 {
29914 drm_radeon_private_t *dev_priv = dev->dev_private;
29915 drm_radeon_getparam_t *param = data;
29916- int value;
29917+ int value = 0;
29918
29919 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
29920
29921diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ttm.c
29922--- linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-19 00:06:34.000000000 -0400
29923+++ linux-2.6.39.2/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-22 19:36:31.000000000 -0400
29924@@ -603,8 +603,9 @@ void radeon_ttm_set_active_vram_size(str
29925 man->size = size >> PAGE_SHIFT;
29926 }
29927
29928-static struct vm_operations_struct radeon_ttm_vm_ops;
29929-static const struct vm_operations_struct *ttm_vm_ops = NULL;
29930+extern int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
29931+extern void ttm_bo_vm_open(struct vm_area_struct *vma);
29932+extern void ttm_bo_vm_close(struct vm_area_struct *vma);
29933
29934 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29935 {
29936@@ -612,17 +613,22 @@ static int radeon_ttm_fault(struct vm_ar
29937 struct radeon_device *rdev;
29938 int r;
29939
29940- bo = (struct ttm_buffer_object *)vma->vm_private_data;
29941- if (bo == NULL) {
29942+ bo = (struct ttm_buffer_object *)vma->vm_private_data;
29943+ if (!bo)
29944 return VM_FAULT_NOPAGE;
29945- }
29946 rdev = radeon_get_rdev(bo->bdev);
29947 mutex_lock(&rdev->vram_mutex);
29948- r = ttm_vm_ops->fault(vma, vmf);
29949+ r = ttm_bo_vm_fault(vma, vmf);
29950 mutex_unlock(&rdev->vram_mutex);
29951 return r;
29952 }
29953
29954+static const struct vm_operations_struct radeon_ttm_vm_ops = {
29955+ .fault = radeon_ttm_fault,
29956+ .open = ttm_bo_vm_open,
29957+ .close = ttm_bo_vm_close
29958+};
29959+
29960 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
29961 {
29962 struct drm_file *file_priv;
29963@@ -635,18 +641,11 @@ int radeon_mmap(struct file *filp, struc
29964
29965 file_priv = filp->private_data;
29966 rdev = file_priv->minor->dev->dev_private;
29967- if (rdev == NULL) {
29968+ if (!rdev)
29969 return -EINVAL;
29970- }
29971 r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
29972- if (unlikely(r != 0)) {
29973+ if (r)
29974 return r;
29975- }
29976- if (unlikely(ttm_vm_ops == NULL)) {
29977- ttm_vm_ops = vma->vm_ops;
29978- radeon_ttm_vm_ops = *ttm_vm_ops;
29979- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
29980- }
29981 vma->vm_ops = &radeon_ttm_vm_ops;
29982 return 0;
29983 }
29984diff -urNp linux-2.6.39.2/drivers/gpu/drm/radeon/rs690.c linux-2.6.39.2/drivers/gpu/drm/radeon/rs690.c
29985--- linux-2.6.39.2/drivers/gpu/drm/radeon/rs690.c 2011-05-19 00:06:34.000000000 -0400
29986+++ linux-2.6.39.2/drivers/gpu/drm/radeon/rs690.c 2011-05-22 19:36:31.000000000 -0400
29987@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
29988 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
29989 rdev->pm.sideport_bandwidth.full)
29990 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
29991- read_delay_latency.full = dfixed_const(370 * 800 * 1000);
29992+ read_delay_latency.full = dfixed_const(800 * 1000);
29993 read_delay_latency.full = dfixed_div(read_delay_latency,
29994 rdev->pm.igp_sideport_mclk);
29995+ a.full = dfixed_const(370);
29996+ read_delay_latency.full = dfixed_mul(read_delay_latency, a);
29997 } else {
29998 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
29999 rdev->pm.k8_bandwidth.full)
30000diff -urNp linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_bo_vm.c
30001--- linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-19 00:06:34.000000000 -0400
30002+++ linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-22 19:36:31.000000000 -0400
30003@@ -69,11 +69,11 @@ static struct ttm_buffer_object *ttm_bo_
30004 return best_bo;
30005 }
30006
30007-static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
30008+int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
30009 {
30010 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
30011 vma->vm_private_data;
30012- struct ttm_bo_device *bdev = bo->bdev;
30013+ struct ttm_bo_device *bdev;
30014 unsigned long page_offset;
30015 unsigned long page_last;
30016 unsigned long pfn;
30017@@ -83,8 +83,12 @@ static int ttm_bo_vm_fault(struct vm_are
30018 int i;
30019 unsigned long address = (unsigned long)vmf->virtual_address;
30020 int retval = VM_FAULT_NOPAGE;
30021- struct ttm_mem_type_manager *man =
30022- &bdev->man[bo->mem.mem_type];
30023+ struct ttm_mem_type_manager *man;
30024+
30025+ if (!bo)
30026+ return VM_FAULT_NOPAGE;
30027+ bdev = bo->bdev;
30028+ man = &bdev->man[bo->mem.mem_type];
30029
30030 /*
30031 * Work around locking order reversal in fault / nopfn
30032@@ -219,22 +223,25 @@ out_unlock:
30033 ttm_bo_unreserve(bo);
30034 return retval;
30035 }
30036+EXPORT_SYMBOL(ttm_bo_vm_fault);
30037
30038-static void ttm_bo_vm_open(struct vm_area_struct *vma)
30039+void ttm_bo_vm_open(struct vm_area_struct *vma)
30040 {
30041 struct ttm_buffer_object *bo =
30042 (struct ttm_buffer_object *)vma->vm_private_data;
30043
30044 (void)ttm_bo_reference(bo);
30045 }
30046+EXPORT_SYMBOL(ttm_bo_vm_open);
30047
30048-static void ttm_bo_vm_close(struct vm_area_struct *vma)
30049+void ttm_bo_vm_close(struct vm_area_struct *vma)
30050 {
30051 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)vma->vm_private_data;
30052
30053 ttm_bo_unref(&bo);
30054 vma->vm_private_data = NULL;
30055 }
30056+EXPORT_SYMBOL(ttm_bo_vm_close);
30057
30058 static const struct vm_operations_struct ttm_bo_vm_ops = {
30059 .fault = ttm_bo_vm_fault,
30060diff -urNp linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_page_alloc.c
30061--- linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-19 00:06:34.000000000 -0400
30062+++ linux-2.6.39.2/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-22 19:36:31.000000000 -0400
30063@@ -397,9 +397,9 @@ static int ttm_pool_get_num_unused_pages
30064 */
30065 static int ttm_pool_mm_shrink(struct shrinker *shrink, int shrink_pages, gfp_t gfp_mask)
30066 {
30067- static atomic_t start_pool = ATOMIC_INIT(0);
30068+ static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
30069 unsigned i;
30070- unsigned pool_offset = atomic_add_return(1, &start_pool);
30071+ unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
30072 struct ttm_page_pool *pool;
30073
30074 pool_offset = pool_offset % NUM_POOLS;
30075diff -urNp linux-2.6.39.2/drivers/gpu/drm/via/via_drv.h linux-2.6.39.2/drivers/gpu/drm/via/via_drv.h
30076--- linux-2.6.39.2/drivers/gpu/drm/via/via_drv.h 2011-05-19 00:06:34.000000000 -0400
30077+++ linux-2.6.39.2/drivers/gpu/drm/via/via_drv.h 2011-05-22 19:36:31.000000000 -0400
30078@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
30079 typedef uint32_t maskarray_t[5];
30080
30081 typedef struct drm_via_irq {
30082- atomic_t irq_received;
30083+ atomic_unchecked_t irq_received;
30084 uint32_t pending_mask;
30085 uint32_t enable_mask;
30086 wait_queue_head_t irq_queue;
30087@@ -75,7 +75,7 @@ typedef struct drm_via_private {
30088 struct timeval last_vblank;
30089 int last_vblank_valid;
30090 unsigned usec_per_vblank;
30091- atomic_t vbl_received;
30092+ atomic_unchecked_t vbl_received;
30093 drm_via_state_t hc_state;
30094 char pci_buf[VIA_PCI_BUF_SIZE];
30095 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
30096diff -urNp linux-2.6.39.2/drivers/gpu/drm/via/via_irq.c linux-2.6.39.2/drivers/gpu/drm/via/via_irq.c
30097--- linux-2.6.39.2/drivers/gpu/drm/via/via_irq.c 2011-05-19 00:06:34.000000000 -0400
30098+++ linux-2.6.39.2/drivers/gpu/drm/via/via_irq.c 2011-05-22 19:36:31.000000000 -0400
30099@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
30100 if (crtc != 0)
30101 return 0;
30102
30103- return atomic_read(&dev_priv->vbl_received);
30104+ return atomic_read_unchecked(&dev_priv->vbl_received);
30105 }
30106
30107 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
30108@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
30109
30110 status = VIA_READ(VIA_REG_INTERRUPT);
30111 if (status & VIA_IRQ_VBLANK_PENDING) {
30112- atomic_inc(&dev_priv->vbl_received);
30113- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
30114+ atomic_inc_unchecked(&dev_priv->vbl_received);
30115+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
30116 do_gettimeofday(&cur_vblank);
30117 if (dev_priv->last_vblank_valid) {
30118 dev_priv->usec_per_vblank =
30119@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
30120 dev_priv->last_vblank = cur_vblank;
30121 dev_priv->last_vblank_valid = 1;
30122 }
30123- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
30124+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
30125 DRM_DEBUG("US per vblank is: %u\n",
30126 dev_priv->usec_per_vblank);
30127 }
30128@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
30129
30130 for (i = 0; i < dev_priv->num_irqs; ++i) {
30131 if (status & cur_irq->pending_mask) {
30132- atomic_inc(&cur_irq->irq_received);
30133+ atomic_inc_unchecked(&cur_irq->irq_received);
30134 DRM_WAKEUP(&cur_irq->irq_queue);
30135 handled = 1;
30136 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
30137@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
30138 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
30139 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
30140 masks[irq][4]));
30141- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
30142+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
30143 } else {
30144 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
30145 (((cur_irq_sequence =
30146- atomic_read(&cur_irq->irq_received)) -
30147+ atomic_read_unchecked(&cur_irq->irq_received)) -
30148 *sequence) <= (1 << 23)));
30149 }
30150 *sequence = cur_irq_sequence;
30151@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
30152 }
30153
30154 for (i = 0; i < dev_priv->num_irqs; ++i) {
30155- atomic_set(&cur_irq->irq_received, 0);
30156+ atomic_set_unchecked(&cur_irq->irq_received, 0);
30157 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
30158 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
30159 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
30160@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
30161 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
30162 case VIA_IRQ_RELATIVE:
30163 irqwait->request.sequence +=
30164- atomic_read(&cur_irq->irq_received);
30165+ atomic_read_unchecked(&cur_irq->irq_received);
30166 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
30167 case VIA_IRQ_ABSOLUTE:
30168 break;
30169diff -urNp linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
30170--- linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-19 00:06:34.000000000 -0400
30171+++ linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-22 19:36:31.000000000 -0400
30172@@ -240,7 +240,7 @@ struct vmw_private {
30173 * Fencing and IRQs.
30174 */
30175
30176- atomic_t fence_seq;
30177+ atomic_unchecked_t fence_seq;
30178 wait_queue_head_t fence_queue;
30179 wait_queue_head_t fifo_queue;
30180 atomic_t fence_queue_waiters;
30181diff -urNp linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
30182--- linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-19 00:06:34.000000000 -0400
30183+++ linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-22 19:36:31.000000000 -0400
30184@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
30185 while (!vmw_lag_lt(queue, us)) {
30186 spin_lock(&queue->lock);
30187 if (list_empty(&queue->head))
30188- sequence = atomic_read(&dev_priv->fence_seq);
30189+ sequence = atomic_read_unchecked(&dev_priv->fence_seq);
30190 else {
30191 fence = list_first_entry(&queue->head,
30192 struct vmw_fence, head);
30193diff -urNp linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
30194--- linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-19 00:06:34.000000000 -0400
30195+++ linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-22 19:36:31.000000000 -0400
30196@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
30197 (unsigned int) min,
30198 (unsigned int) fifo->capabilities);
30199
30200- atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
30201+ atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
30202 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
30203 vmw_fence_queue_init(&fifo->fence_queue);
30204 return vmw_fifo_send_fence(dev_priv, &dummy);
30205@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
30206
30207 fm = vmw_fifo_reserve(dev_priv, bytes);
30208 if (unlikely(fm == NULL)) {
30209- *sequence = atomic_read(&dev_priv->fence_seq);
30210+ *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
30211 ret = -ENOMEM;
30212 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
30213 false, 3*HZ);
30214@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
30215 }
30216
30217 do {
30218- *sequence = atomic_add_return(1, &dev_priv->fence_seq);
30219+ *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
30220 } while (*sequence == 0);
30221
30222 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
30223@@ -534,7 +534,7 @@ static int vmw_fifo_vm_fault(struct vm_a
30224 return VM_FAULT_SIGBUS;
30225 }
30226
30227-static struct vm_operations_struct vmw_fifo_vm_ops = {
30228+static const struct vm_operations_struct vmw_fifo_vm_ops = {
30229 .fault = vmw_fifo_vm_fault,
30230 .open = NULL,
30231 .close = NULL
30232diff -urNp linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
30233--- linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-19 00:06:34.000000000 -0400
30234+++ linux-2.6.39.2/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-22 19:36:31.000000000 -0400
30235@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
30236 * emitted. Then the fence is stale and signaled.
30237 */
30238
30239- ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
30240+ ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
30241 > VMW_FENCE_WRAP);
30242
30243 return ret;
30244@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
30245
30246 if (fifo_idle)
30247 down_read(&fifo_state->rwsem);
30248- signal_seq = atomic_read(&dev_priv->fence_seq);
30249+ signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
30250 ret = 0;
30251
30252 for (;;) {
30253diff -urNp linux-2.6.39.2/drivers/gpu/vga/vga_switcheroo.c linux-2.6.39.2/drivers/gpu/vga/vga_switcheroo.c
30254--- linux-2.6.39.2/drivers/gpu/vga/vga_switcheroo.c 2011-05-19 00:06:34.000000000 -0400
30255+++ linux-2.6.39.2/drivers/gpu/vga/vga_switcheroo.c 2011-05-22 19:36:31.000000000 -0400
30256@@ -53,7 +53,7 @@ struct vgasr_priv {
30257 int registered_clients;
30258 struct vga_switcheroo_client clients[VGA_SWITCHEROO_MAX_CLIENTS];
30259
30260- struct vga_switcheroo_handler *handler;
30261+ const struct vga_switcheroo_handler *handler;
30262 };
30263
30264 static int vga_switcheroo_debugfs_init(struct vgasr_priv *priv);
30265@@ -62,7 +62,7 @@ static void vga_switcheroo_debugfs_fini(
30266 /* only one switcheroo per system */
30267 static struct vgasr_priv vgasr_priv;
30268
30269-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler)
30270+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler)
30271 {
30272 mutex_lock(&vgasr_mutex);
30273 if (vgasr_priv.handler) {
30274diff -urNp linux-2.6.39.2/drivers/hid/hid-core.c linux-2.6.39.2/drivers/hid/hid-core.c
30275--- linux-2.6.39.2/drivers/hid/hid-core.c 2011-05-19 00:06:34.000000000 -0400
30276+++ linux-2.6.39.2/drivers/hid/hid-core.c 2011-05-22 19:36:31.000000000 -0400
30277@@ -1888,7 +1888,7 @@ static bool hid_ignore(struct hid_device
30278
30279 int hid_add_device(struct hid_device *hdev)
30280 {
30281- static atomic_t id = ATOMIC_INIT(0);
30282+ static atomic_unchecked_t id = ATOMIC_INIT(0);
30283 int ret;
30284
30285 if (WARN_ON(hdev->status & HID_STAT_ADDED))
30286@@ -1903,7 +1903,7 @@ int hid_add_device(struct hid_device *hd
30287 /* XXX hack, any other cleaner solution after the driver core
30288 * is converted to allow more than 20 bytes as the device name? */
30289 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
30290- hdev->vendor, hdev->product, atomic_inc_return(&id));
30291+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
30292
30293 hid_debug_register(hdev, dev_name(&hdev->dev));
30294 ret = device_add(&hdev->dev);
30295diff -urNp linux-2.6.39.2/drivers/hid/hid-picolcd.c linux-2.6.39.2/drivers/hid/hid-picolcd.c
30296--- linux-2.6.39.2/drivers/hid/hid-picolcd.c 2011-05-19 00:06:34.000000000 -0400
30297+++ linux-2.6.39.2/drivers/hid/hid-picolcd.c 2011-05-22 19:36:31.000000000 -0400
30298@@ -1037,7 +1037,7 @@ static int picolcd_check_lcd_fb(struct l
30299 return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
30300 }
30301
30302-static struct lcd_ops picolcd_lcdops = {
30303+static const struct lcd_ops picolcd_lcdops = {
30304 .get_contrast = picolcd_get_contrast,
30305 .set_contrast = picolcd_set_contrast,
30306 .check_fb = picolcd_check_lcd_fb,
30307diff -urNp linux-2.6.39.2/drivers/hid/usbhid/hiddev.c linux-2.6.39.2/drivers/hid/usbhid/hiddev.c
30308--- linux-2.6.39.2/drivers/hid/usbhid/hiddev.c 2011-05-19 00:06:34.000000000 -0400
30309+++ linux-2.6.39.2/drivers/hid/usbhid/hiddev.c 2011-05-22 19:36:31.000000000 -0400
30310@@ -613,7 +613,7 @@ static long hiddev_ioctl(struct file *fi
30311 break;
30312
30313 case HIDIOCAPPLICATION:
30314- if (arg < 0 || arg >= hid->maxapplication)
30315+ if (arg >= hid->maxapplication)
30316 break;
30317
30318 for (i = 0; i < hid->maxcollection; i++)
30319diff -urNp linux-2.6.39.2/drivers/hwmon/ibmaem.c linux-2.6.39.2/drivers/hwmon/ibmaem.c
30320--- linux-2.6.39.2/drivers/hwmon/ibmaem.c 2011-05-19 00:06:34.000000000 -0400
30321+++ linux-2.6.39.2/drivers/hwmon/ibmaem.c 2011-05-22 19:36:31.000000000 -0400
30322@@ -238,7 +238,7 @@ struct aem_read_sensor_resp {
30323 struct aem_driver_data {
30324 struct list_head aem_devices;
30325 struct ipmi_smi_watcher bmc_events;
30326- struct ipmi_user_hndl ipmi_hndlrs;
30327+ const struct ipmi_user_hndl ipmi_hndlrs;
30328 };
30329
30330 static void aem_register_bmc(int iface, struct device *dev);
30331diff -urNp linux-2.6.39.2/drivers/hwmon/ibmpex.c linux-2.6.39.2/drivers/hwmon/ibmpex.c
30332--- linux-2.6.39.2/drivers/hwmon/ibmpex.c 2011-05-19 00:06:34.000000000 -0400
30333+++ linux-2.6.39.2/drivers/hwmon/ibmpex.c 2011-05-22 19:36:31.000000000 -0400
30334@@ -110,7 +110,7 @@ struct ibmpex_bmc_data {
30335 struct ibmpex_driver_data {
30336 struct list_head bmc_data;
30337 struct ipmi_smi_watcher bmc_events;
30338- struct ipmi_user_hndl ipmi_hndlrs;
30339+ const struct ipmi_user_hndl ipmi_hndlrs;
30340 };
30341
30342 static struct ibmpex_driver_data driver_data = {
30343diff -urNp linux-2.6.39.2/drivers/hwmon/sht15.c linux-2.6.39.2/drivers/hwmon/sht15.c
30344--- linux-2.6.39.2/drivers/hwmon/sht15.c 2011-05-19 00:06:34.000000000 -0400
30345+++ linux-2.6.39.2/drivers/hwmon/sht15.c 2011-05-22 19:36:31.000000000 -0400
30346@@ -113,7 +113,7 @@ struct sht15_data {
30347 int supply_uV;
30348 int supply_uV_valid;
30349 struct work_struct update_supply_work;
30350- atomic_t interrupt_handled;
30351+ atomic_unchecked_t interrupt_handled;
30352 };
30353
30354 /**
30355@@ -246,13 +246,13 @@ static inline int sht15_update_single_va
30356 return ret;
30357
30358 gpio_direction_input(data->pdata->gpio_data);
30359- atomic_set(&data->interrupt_handled, 0);
30360+ atomic_set_unchecked(&data->interrupt_handled, 0);
30361
30362 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30363 if (gpio_get_value(data->pdata->gpio_data) == 0) {
30364 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
30365 /* Only relevant if the interrupt hasn't occurred. */
30366- if (!atomic_read(&data->interrupt_handled))
30367+ if (!atomic_read_unchecked(&data->interrupt_handled))
30368 schedule_work(&data->read_work);
30369 }
30370 ret = wait_event_timeout(data->wait_queue,
30371@@ -399,7 +399,7 @@ static irqreturn_t sht15_interrupt_fired
30372 struct sht15_data *data = d;
30373 /* First disable the interrupt */
30374 disable_irq_nosync(irq);
30375- atomic_inc(&data->interrupt_handled);
30376+ atomic_inc_unchecked(&data->interrupt_handled);
30377 /* Then schedule a reading work struct */
30378 if (data->flag != SHT15_READING_NOTHING)
30379 schedule_work(&data->read_work);
30380@@ -450,11 +450,11 @@ static void sht15_bh_read_data(struct wo
30381 here as could have gone low in meantime so verify
30382 it hasn't!
30383 */
30384- atomic_set(&data->interrupt_handled, 0);
30385+ atomic_set_unchecked(&data->interrupt_handled, 0);
30386 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30387 /* If still not occurred or another handler has been scheduled */
30388 if (gpio_get_value(data->pdata->gpio_data)
30389- || atomic_read(&data->interrupt_handled))
30390+ || atomic_read_unchecked(&data->interrupt_handled))
30391 return;
30392 }
30393 /* Read the data back from the device */
30394diff -urNp linux-2.6.39.2/drivers/hwmon/w83791d.c linux-2.6.39.2/drivers/hwmon/w83791d.c
30395--- linux-2.6.39.2/drivers/hwmon/w83791d.c 2011-05-19 00:06:34.000000000 -0400
30396+++ linux-2.6.39.2/drivers/hwmon/w83791d.c 2011-05-22 19:36:31.000000000 -0400
30397@@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
30398 struct i2c_board_info *info);
30399 static int w83791d_remove(struct i2c_client *client);
30400
30401-static int w83791d_read(struct i2c_client *client, u8 register);
30402-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
30403+static int w83791d_read(struct i2c_client *client, u8 reg);
30404+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
30405 static struct w83791d_data *w83791d_update_device(struct device *dev);
30406
30407 #ifdef DEBUG
30408diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-at91.c linux-2.6.39.2/drivers/i2c/busses/i2c-at91.c
30409--- linux-2.6.39.2/drivers/i2c/busses/i2c-at91.c 2011-05-19 00:06:34.000000000 -0400
30410+++ linux-2.6.39.2/drivers/i2c/busses/i2c-at91.c 2011-05-22 19:36:31.000000000 -0400
30411@@ -181,7 +181,7 @@ static u32 at91_func(struct i2c_adapter
30412 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30413 }
30414
30415-static struct i2c_algorithm at91_algorithm = {
30416+static const struct i2c_algorithm at91_algorithm = {
30417 .master_xfer = at91_xfer,
30418 .functionality = at91_func,
30419 };
30420diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-bfin-twi.c linux-2.6.39.2/drivers/i2c/busses/i2c-bfin-twi.c
30421--- linux-2.6.39.2/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-19 00:06:34.000000000 -0400
30422+++ linux-2.6.39.2/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-22 19:36:31.000000000 -0400
30423@@ -599,7 +599,7 @@ static u32 bfin_twi_functionality(struct
30424 I2C_FUNC_I2C | I2C_FUNC_SMBUS_I2C_BLOCK;
30425 }
30426
30427-static struct i2c_algorithm bfin_twi_algorithm = {
30428+static const struct i2c_algorithm bfin_twi_algorithm = {
30429 .master_xfer = bfin_twi_master_xfer,
30430 .smbus_xfer = bfin_twi_smbus_xfer,
30431 .functionality = bfin_twi_functionality,
30432diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-davinci.c linux-2.6.39.2/drivers/i2c/busses/i2c-davinci.c
30433--- linux-2.6.39.2/drivers/i2c/busses/i2c-davinci.c 2011-05-19 00:06:34.000000000 -0400
30434+++ linux-2.6.39.2/drivers/i2c/busses/i2c-davinci.c 2011-05-22 19:36:31.000000000 -0400
30435@@ -630,7 +630,7 @@ static inline void i2c_davinci_cpufreq_d
30436 }
30437 #endif
30438
30439-static struct i2c_algorithm i2c_davinci_algo = {
30440+static const struct i2c_algorithm i2c_davinci_algo = {
30441 .master_xfer = i2c_davinci_xfer,
30442 .functionality = i2c_davinci_func,
30443 };
30444diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-designware.c linux-2.6.39.2/drivers/i2c/busses/i2c-designware.c
30445--- linux-2.6.39.2/drivers/i2c/busses/i2c-designware.c 2011-05-19 00:06:34.000000000 -0400
30446+++ linux-2.6.39.2/drivers/i2c/busses/i2c-designware.c 2011-05-22 19:36:31.000000000 -0400
30447@@ -689,7 +689,7 @@ tx_aborted:
30448 return IRQ_HANDLED;
30449 }
30450
30451-static struct i2c_algorithm i2c_dw_algo = {
30452+static const struct i2c_algorithm i2c_dw_algo = {
30453 .master_xfer = i2c_dw_xfer,
30454 .functionality = i2c_dw_func,
30455 };
30456diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-eg20t.c linux-2.6.39.2/drivers/i2c/busses/i2c-eg20t.c
30457--- linux-2.6.39.2/drivers/i2c/busses/i2c-eg20t.c 2011-05-19 00:06:34.000000000 -0400
30458+++ linux-2.6.39.2/drivers/i2c/busses/i2c-eg20t.c 2011-05-22 19:36:31.000000000 -0400
30459@@ -708,7 +708,7 @@ static u32 pch_i2c_func(struct i2c_adapt
30460 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_10BIT_ADDR;
30461 }
30462
30463-static struct i2c_algorithm pch_algorithm = {
30464+static const struct i2c_algorithm pch_algorithm = {
30465 .master_xfer = pch_i2c_xfer,
30466 .functionality = pch_i2c_func
30467 };
30468diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-imx.c linux-2.6.39.2/drivers/i2c/busses/i2c-imx.c
30469--- linux-2.6.39.2/drivers/i2c/busses/i2c-imx.c 2011-05-19 00:06:34.000000000 -0400
30470+++ linux-2.6.39.2/drivers/i2c/busses/i2c-imx.c 2011-05-22 19:36:31.000000000 -0400
30471@@ -457,7 +457,7 @@ static u32 i2c_imx_func(struct i2c_adapt
30472 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30473 }
30474
30475-static struct i2c_algorithm i2c_imx_algo = {
30476+static const struct i2c_algorithm i2c_imx_algo = {
30477 .master_xfer = i2c_imx_xfer,
30478 .functionality = i2c_imx_func,
30479 };
30480diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-intel-mid.c linux-2.6.39.2/drivers/i2c/busses/i2c-intel-mid.c
30481--- linux-2.6.39.2/drivers/i2c/busses/i2c-intel-mid.c 2011-05-19 00:06:34.000000000 -0400
30482+++ linux-2.6.39.2/drivers/i2c/busses/i2c-intel-mid.c 2011-05-22 19:36:31.000000000 -0400
30483@@ -917,7 +917,7 @@ err:
30484 return IRQ_HANDLED;
30485 }
30486
30487-static struct i2c_algorithm intel_mid_i2c_algorithm = {
30488+static const struct i2c_algorithm intel_mid_i2c_algorithm = {
30489 .master_xfer = intel_mid_i2c_xfer,
30490 .functionality = intel_mid_i2c_func,
30491 };
30492diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-nforce2.c linux-2.6.39.2/drivers/i2c/busses/i2c-nforce2.c
30493--- linux-2.6.39.2/drivers/i2c/busses/i2c-nforce2.c 2011-05-19 00:06:34.000000000 -0400
30494+++ linux-2.6.39.2/drivers/i2c/busses/i2c-nforce2.c 2011-05-22 19:36:31.000000000 -0400
30495@@ -303,7 +303,7 @@ static u32 nforce2_func(struct i2c_adapt
30496 I2C_FUNC_SMBUS_BLOCK_DATA : 0);
30497 }
30498
30499-static struct i2c_algorithm smbus_algorithm = {
30500+static const struct i2c_algorithm smbus_algorithm = {
30501 .smbus_xfer = nforce2_access,
30502 .functionality = nforce2_func,
30503 };
30504diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-pmcmsp.c linux-2.6.39.2/drivers/i2c/busses/i2c-pmcmsp.c
30505--- linux-2.6.39.2/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
30506+++ linux-2.6.39.2/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-22 19:36:31.000000000 -0400
30507@@ -615,7 +615,7 @@ static u32 pmcmsptwi_i2c_func(struct i2c
30508
30509 /* -- Initialization -- */
30510
30511-static struct i2c_algorithm pmcmsptwi_algo = {
30512+static const struct i2c_algorithm pmcmsptwi_algo = {
30513 .master_xfer = pmcmsptwi_master_xfer,
30514 .functionality = pmcmsptwi_i2c_func,
30515 };
30516diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-pnx.c linux-2.6.39.2/drivers/i2c/busses/i2c-pnx.c
30517--- linux-2.6.39.2/drivers/i2c/busses/i2c-pnx.c 2011-05-19 00:06:34.000000000 -0400
30518+++ linux-2.6.39.2/drivers/i2c/busses/i2c-pnx.c 2011-05-22 19:36:31.000000000 -0400
30519@@ -535,7 +535,7 @@ static u32 i2c_pnx_func(struct i2c_adapt
30520 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30521 }
30522
30523-static struct i2c_algorithm pnx_algorithm = {
30524+static const struct i2c_algorithm pnx_algorithm = {
30525 .master_xfer = i2c_pnx_xfer,
30526 .functionality = i2c_pnx_func,
30527 };
30528diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-puv3.c linux-2.6.39.2/drivers/i2c/busses/i2c-puv3.c
30529--- linux-2.6.39.2/drivers/i2c/busses/i2c-puv3.c 2011-05-19 00:06:34.000000000 -0400
30530+++ linux-2.6.39.2/drivers/i2c/busses/i2c-puv3.c 2011-05-22 19:36:31.000000000 -0400
30531@@ -176,7 +176,7 @@ static u32 puv3_i2c_func(struct i2c_adap
30532 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30533 }
30534
30535-static struct i2c_algorithm puv3_i2c_algorithm = {
30536+static const struct i2c_algorithm puv3_i2c_algorithm = {
30537 .master_xfer = puv3_i2c_xfer,
30538 .functionality = puv3_i2c_func,
30539 };
30540diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-s6000.c linux-2.6.39.2/drivers/i2c/busses/i2c-s6000.c
30541--- linux-2.6.39.2/drivers/i2c/busses/i2c-s6000.c 2011-05-19 00:06:34.000000000 -0400
30542+++ linux-2.6.39.2/drivers/i2c/busses/i2c-s6000.c 2011-05-22 19:36:31.000000000 -0400
30543@@ -243,7 +243,7 @@ static u32 s6i2c_functionality(struct i2
30544 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30545 }
30546
30547-static struct i2c_algorithm s6i2c_algorithm = {
30548+static const struct i2c_algorithm s6i2c_algorithm = {
30549 .master_xfer = s6i2c_master_xfer,
30550 .functionality = s6i2c_functionality,
30551 };
30552diff -urNp linux-2.6.39.2/drivers/i2c/busses/i2c-sh_mobile.c linux-2.6.39.2/drivers/i2c/busses/i2c-sh_mobile.c
30553--- linux-2.6.39.2/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-19 00:06:34.000000000 -0400
30554+++ linux-2.6.39.2/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-22 19:36:31.000000000 -0400
30555@@ -529,7 +529,7 @@ static u32 sh_mobile_i2c_func(struct i2c
30556 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30557 }
30558
30559-static struct i2c_algorithm sh_mobile_i2c_algorithm = {
30560+static const struct i2c_algorithm sh_mobile_i2c_algorithm = {
30561 .functionality = sh_mobile_i2c_func,
30562 .master_xfer = sh_mobile_i2c_xfer,
30563 };
30564diff -urNp linux-2.6.39.2/drivers/ide/ide-cd.c linux-2.6.39.2/drivers/ide/ide-cd.c
30565--- linux-2.6.39.2/drivers/ide/ide-cd.c 2011-06-03 00:04:14.000000000 -0400
30566+++ linux-2.6.39.2/drivers/ide/ide-cd.c 2011-06-03 00:32:05.000000000 -0400
30567@@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_
30568 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
30569 if ((unsigned long)buf & alignment
30570 || blk_rq_bytes(rq) & q->dma_pad_mask
30571- || object_is_on_stack(buf))
30572+ || object_starts_on_stack(buf))
30573 drive->dma = 0;
30574 }
30575 }
30576diff -urNp linux-2.6.39.2/drivers/ide/ide-floppy.c linux-2.6.39.2/drivers/ide/ide-floppy.c
30577--- linux-2.6.39.2/drivers/ide/ide-floppy.c 2011-05-19 00:06:34.000000000 -0400
30578+++ linux-2.6.39.2/drivers/ide/ide-floppy.c 2011-05-22 19:36:31.000000000 -0400
30579@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
30580 u8 pc_buf[256], header_len, desc_cnt;
30581 int i, rc = 1, blocks, length;
30582
30583+ pax_track_stack();
30584+
30585 ide_debug_log(IDE_DBG_FUNC, "enter");
30586
30587 drive->bios_cyl = 0;
30588diff -urNp linux-2.6.39.2/drivers/ide/it821x.c linux-2.6.39.2/drivers/ide/it821x.c
30589--- linux-2.6.39.2/drivers/ide/it821x.c 2011-05-19 00:06:34.000000000 -0400
30590+++ linux-2.6.39.2/drivers/ide/it821x.c 2011-05-22 19:36:31.000000000 -0400
30591@@ -508,7 +508,7 @@ static void it821x_quirkproc(ide_drive_t
30592
30593 }
30594
30595-static struct ide_dma_ops it821x_pass_through_dma_ops = {
30596+static const struct ide_dma_ops it821x_pass_through_dma_ops = {
30597 .dma_host_set = ide_dma_host_set,
30598 .dma_setup = ide_dma_setup,
30599 .dma_start = it821x_dma_start,
30600diff -urNp linux-2.6.39.2/drivers/ide/setup-pci.c linux-2.6.39.2/drivers/ide/setup-pci.c
30601--- linux-2.6.39.2/drivers/ide/setup-pci.c 2011-05-19 00:06:34.000000000 -0400
30602+++ linux-2.6.39.2/drivers/ide/setup-pci.c 2011-05-22 19:36:31.000000000 -0400
30603@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
30604 int ret, i, n_ports = dev2 ? 4 : 2;
30605 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
30606
30607+ pax_track_stack();
30608+
30609 for (i = 0; i < n_ports / 2; i++) {
30610 ret = ide_setup_pci_controller(pdev[i], d, !i);
30611 if (ret < 0)
30612diff -urNp linux-2.6.39.2/drivers/ide/trm290.c linux-2.6.39.2/drivers/ide/trm290.c
30613--- linux-2.6.39.2/drivers/ide/trm290.c 2011-05-19 00:06:34.000000000 -0400
30614+++ linux-2.6.39.2/drivers/ide/trm290.c 2011-05-22 19:36:31.000000000 -0400
30615@@ -314,7 +314,7 @@ static const struct ide_tp_ops trm290_tp
30616 .output_data = ide_output_data,
30617 };
30618
30619-static struct ide_dma_ops trm290_dma_ops = {
30620+static const struct ide_dma_ops trm290_dma_ops = {
30621 .dma_host_set = trm290_dma_host_set,
30622 .dma_setup = trm290_dma_setup,
30623 .dma_start = trm290_dma_start,
30624diff -urNp linux-2.6.39.2/drivers/infiniband/core/cm.c linux-2.6.39.2/drivers/infiniband/core/cm.c
30625--- linux-2.6.39.2/drivers/infiniband/core/cm.c 2011-05-19 00:06:34.000000000 -0400
30626+++ linux-2.6.39.2/drivers/infiniband/core/cm.c 2011-05-22 19:36:31.000000000 -0400
30627@@ -113,7 +113,7 @@ static char const counter_group_names[CM
30628
30629 struct cm_counter_group {
30630 struct kobject obj;
30631- atomic_long_t counter[CM_ATTR_COUNT];
30632+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
30633 };
30634
30635 struct cm_counter_attribute {
30636@@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm
30637 struct ib_mad_send_buf *msg = NULL;
30638 int ret;
30639
30640- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30641+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30642 counter[CM_REQ_COUNTER]);
30643
30644 /* Quick state check to discard duplicate REQs. */
30645@@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm
30646 if (!cm_id_priv)
30647 return;
30648
30649- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30650+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30651 counter[CM_REP_COUNTER]);
30652 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
30653 if (ret)
30654@@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work
30655 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
30656 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
30657 spin_unlock_irq(&cm_id_priv->lock);
30658- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30659+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30660 counter[CM_RTU_COUNTER]);
30661 goto out;
30662 }
30663@@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor
30664 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
30665 dreq_msg->local_comm_id);
30666 if (!cm_id_priv) {
30667- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30668+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30669 counter[CM_DREQ_COUNTER]);
30670 cm_issue_drep(work->port, work->mad_recv_wc);
30671 return -EINVAL;
30672@@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor
30673 case IB_CM_MRA_REP_RCVD:
30674 break;
30675 case IB_CM_TIMEWAIT:
30676- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30677+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30678 counter[CM_DREQ_COUNTER]);
30679 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30680 goto unlock;
30681@@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor
30682 cm_free_msg(msg);
30683 goto deref;
30684 case IB_CM_DREQ_RCVD:
30685- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30686+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30687 counter[CM_DREQ_COUNTER]);
30688 goto unlock;
30689 default:
30690@@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work
30691 ib_modify_mad(cm_id_priv->av.port->mad_agent,
30692 cm_id_priv->msg, timeout)) {
30693 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
30694- atomic_long_inc(&work->port->
30695+ atomic_long_inc_unchecked(&work->port->
30696 counter_group[CM_RECV_DUPLICATES].
30697 counter[CM_MRA_COUNTER]);
30698 goto out;
30699@@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work
30700 break;
30701 case IB_CM_MRA_REQ_RCVD:
30702 case IB_CM_MRA_REP_RCVD:
30703- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30704+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30705 counter[CM_MRA_COUNTER]);
30706 /* fall through */
30707 default:
30708@@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work
30709 case IB_CM_LAP_IDLE:
30710 break;
30711 case IB_CM_MRA_LAP_SENT:
30712- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30713+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30714 counter[CM_LAP_COUNTER]);
30715 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30716 goto unlock;
30717@@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work
30718 cm_free_msg(msg);
30719 goto deref;
30720 case IB_CM_LAP_RCVD:
30721- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30722+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30723 counter[CM_LAP_COUNTER]);
30724 goto unlock;
30725 default:
30726@@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm
30727 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
30728 if (cur_cm_id_priv) {
30729 spin_unlock_irq(&cm.lock);
30730- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30731+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30732 counter[CM_SIDR_REQ_COUNTER]);
30733 goto out; /* Duplicate message. */
30734 }
30735@@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma
30736 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
30737 msg->retries = 1;
30738
30739- atomic_long_add(1 + msg->retries,
30740+ atomic_long_add_unchecked(1 + msg->retries,
30741 &port->counter_group[CM_XMIT].counter[attr_index]);
30742 if (msg->retries)
30743- atomic_long_add(msg->retries,
30744+ atomic_long_add_unchecked(msg->retries,
30745 &port->counter_group[CM_XMIT_RETRIES].
30746 counter[attr_index]);
30747
30748@@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma
30749 }
30750
30751 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
30752- atomic_long_inc(&port->counter_group[CM_RECV].
30753+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
30754 counter[attr_id - CM_ATTR_ID_OFFSET]);
30755
30756 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
30757@@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko
30758 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
30759
30760 return sprintf(buf, "%ld\n",
30761- atomic_long_read(&group->counter[cm_attr->index]));
30762+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
30763 }
30764
30765 static const struct sysfs_ops cm_counter_ops = {
30766diff -urNp linux-2.6.39.2/drivers/infiniband/core/fmr_pool.c linux-2.6.39.2/drivers/infiniband/core/fmr_pool.c
30767--- linux-2.6.39.2/drivers/infiniband/core/fmr_pool.c 2011-05-19 00:06:34.000000000 -0400
30768+++ linux-2.6.39.2/drivers/infiniband/core/fmr_pool.c 2011-05-22 19:36:31.000000000 -0400
30769@@ -97,8 +97,8 @@ struct ib_fmr_pool {
30770
30771 struct task_struct *thread;
30772
30773- atomic_t req_ser;
30774- atomic_t flush_ser;
30775+ atomic_unchecked_t req_ser;
30776+ atomic_unchecked_t flush_ser;
30777
30778 wait_queue_head_t force_wait;
30779 };
30780@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
30781 struct ib_fmr_pool *pool = pool_ptr;
30782
30783 do {
30784- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30785+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30786 ib_fmr_batch_release(pool);
30787
30788- atomic_inc(&pool->flush_ser);
30789+ atomic_inc_unchecked(&pool->flush_ser);
30790 wake_up_interruptible(&pool->force_wait);
30791
30792 if (pool->flush_function)
30793@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
30794 }
30795
30796 set_current_state(TASK_INTERRUPTIBLE);
30797- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30798+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30799 !kthread_should_stop())
30800 schedule();
30801 __set_current_state(TASK_RUNNING);
30802@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
30803 pool->dirty_watermark = params->dirty_watermark;
30804 pool->dirty_len = 0;
30805 spin_lock_init(&pool->pool_lock);
30806- atomic_set(&pool->req_ser, 0);
30807- atomic_set(&pool->flush_ser, 0);
30808+ atomic_set_unchecked(&pool->req_ser, 0);
30809+ atomic_set_unchecked(&pool->flush_ser, 0);
30810 init_waitqueue_head(&pool->force_wait);
30811
30812 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30813@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
30814 }
30815 spin_unlock_irq(&pool->pool_lock);
30816
30817- serial = atomic_inc_return(&pool->req_ser);
30818+ serial = atomic_inc_return_unchecked(&pool->req_ser);
30819 wake_up_process(pool->thread);
30820
30821 if (wait_event_interruptible(pool->force_wait,
30822- atomic_read(&pool->flush_ser) - serial >= 0))
30823+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30824 return -EINTR;
30825
30826 return 0;
30827@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
30828 } else {
30829 list_add_tail(&fmr->list, &pool->dirty_list);
30830 if (++pool->dirty_len >= pool->dirty_watermark) {
30831- atomic_inc(&pool->req_ser);
30832+ atomic_inc_unchecked(&pool->req_ser);
30833 wake_up_process(pool->thread);
30834 }
30835 }
30836diff -urNp linux-2.6.39.2/drivers/infiniband/hw/cxgb4/mem.c linux-2.6.39.2/drivers/infiniband/hw/cxgb4/mem.c
30837--- linux-2.6.39.2/drivers/infiniband/hw/cxgb4/mem.c 2011-05-19 00:06:34.000000000 -0400
30838+++ linux-2.6.39.2/drivers/infiniband/hw/cxgb4/mem.c 2011-05-22 19:36:31.000000000 -0400
30839@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
30840 int err;
30841 struct fw_ri_tpte tpt;
30842 u32 stag_idx;
30843- static atomic_t key;
30844+ static atomic_unchecked_t key;
30845
30846 if (c4iw_fatal_error(rdev))
30847 return -EIO;
30848@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
30849 &rdev->resource.tpt_fifo_lock);
30850 if (!stag_idx)
30851 return -ENOMEM;
30852- *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30853+ *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30854 }
30855 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30856 __func__, stag_state, type, pdid, stag_idx);
30857diff -urNp linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_dma.c linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_dma.c
30858--- linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-19 00:06:34.000000000 -0400
30859+++ linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-22 19:36:31.000000000 -0400
30860@@ -175,7 +175,7 @@ static void ipath_dma_free_coherent(stru
30861 free_pages((unsigned long) cpu_addr, get_order(size));
30862 }
30863
30864-struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30865+const struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30866 ipath_mapping_error,
30867 ipath_dma_map_single,
30868 ipath_dma_unmap_single,
30869diff -urNp linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_fs.c
30870--- linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-19 00:06:34.000000000 -0400
30871+++ linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-22 19:36:31.000000000 -0400
30872@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
30873 struct infinipath_counters counters;
30874 struct ipath_devdata *dd;
30875
30876+ pax_track_stack();
30877+
30878 dd = file->f_path.dentry->d_inode->i_private;
30879 dd->ipath_f_read_counters(dd, &counters);
30880
30881diff -urNp linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_rc.c linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_rc.c
30882--- linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-19 00:06:34.000000000 -0400
30883+++ linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-22 19:36:31.000000000 -0400
30884@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30885 struct ib_atomic_eth *ateth;
30886 struct ipath_ack_entry *e;
30887 u64 vaddr;
30888- atomic64_t *maddr;
30889+ atomic64_unchecked_t *maddr;
30890 u64 sdata;
30891 u32 rkey;
30892 u8 next;
30893@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30894 IB_ACCESS_REMOTE_ATOMIC)))
30895 goto nack_acc_unlck;
30896 /* Perform atomic OP and save result. */
30897- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30898+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30899 sdata = be64_to_cpu(ateth->swap_data);
30900 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30901 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30902- (u64) atomic64_add_return(sdata, maddr) - sdata :
30903+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30904 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30905 be64_to_cpu(ateth->compare_data),
30906 sdata);
30907diff -urNp linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_ruc.c linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_ruc.c
30908--- linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-19 00:06:34.000000000 -0400
30909+++ linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-22 19:36:31.000000000 -0400
30910@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
30911 unsigned long flags;
30912 struct ib_wc wc;
30913 u64 sdata;
30914- atomic64_t *maddr;
30915+ atomic64_unchecked_t *maddr;
30916 enum ib_wc_status send_status;
30917
30918 /*
30919@@ -382,11 +382,11 @@ again:
30920 IB_ACCESS_REMOTE_ATOMIC)))
30921 goto acc_err;
30922 /* Perform atomic OP and save result. */
30923- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30924+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30925 sdata = wqe->wr.wr.atomic.compare_add;
30926 *(u64 *) sqp->s_sge.sge.vaddr =
30927 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30928- (u64) atomic64_add_return(sdata, maddr) - sdata :
30929+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30930 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30931 sdata, wqe->wr.wr.atomic.swap);
30932 goto send_comp;
30933diff -urNp linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_verbs.h linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_verbs.h
30934--- linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-19 00:06:34.000000000 -0400
30935+++ linux-2.6.39.2/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-22 19:36:31.000000000 -0400
30936@@ -931,6 +931,6 @@ extern unsigned int ib_ipath_max_srq_wrs
30937
30938 extern const u32 ib_ipath_rnr_table[];
30939
30940-extern struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30941+extern const struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30942
30943 #endif /* IPATH_VERBS_H */
30944diff -urNp linux-2.6.39.2/drivers/infiniband/hw/nes/nes.c linux-2.6.39.2/drivers/infiniband/hw/nes/nes.c
30945--- linux-2.6.39.2/drivers/infiniband/hw/nes/nes.c 2011-05-19 00:06:34.000000000 -0400
30946+++ linux-2.6.39.2/drivers/infiniband/hw/nes/nes.c 2011-05-22 19:36:31.000000000 -0400
30947@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
30948 LIST_HEAD(nes_adapter_list);
30949 static LIST_HEAD(nes_dev_list);
30950
30951-atomic_t qps_destroyed;
30952+atomic_unchecked_t qps_destroyed;
30953
30954 static unsigned int ee_flsh_adapter;
30955 static unsigned int sysfs_nonidx_addr;
30956@@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str
30957 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30958 struct nes_adapter *nesadapter = nesdev->nesadapter;
30959
30960- atomic_inc(&qps_destroyed);
30961+ atomic_inc_unchecked(&qps_destroyed);
30962
30963 /* Free the control structures */
30964
30965diff -urNp linux-2.6.39.2/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.39.2/drivers/infiniband/hw/nes/nes_cm.c
30966--- linux-2.6.39.2/drivers/infiniband/hw/nes/nes_cm.c 2011-05-19 00:06:34.000000000 -0400
30967+++ linux-2.6.39.2/drivers/infiniband/hw/nes/nes_cm.c 2011-05-22 19:36:31.000000000 -0400
30968@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30969 u32 cm_packets_retrans;
30970 u32 cm_packets_created;
30971 u32 cm_packets_received;
30972-atomic_t cm_listens_created;
30973-atomic_t cm_listens_destroyed;
30974+atomic_unchecked_t cm_listens_created;
30975+atomic_unchecked_t cm_listens_destroyed;
30976 u32 cm_backlog_drops;
30977-atomic_t cm_loopbacks;
30978-atomic_t cm_nodes_created;
30979-atomic_t cm_nodes_destroyed;
30980-atomic_t cm_accel_dropped_pkts;
30981-atomic_t cm_resets_recvd;
30982+atomic_unchecked_t cm_loopbacks;
30983+atomic_unchecked_t cm_nodes_created;
30984+atomic_unchecked_t cm_nodes_destroyed;
30985+atomic_unchecked_t cm_accel_dropped_pkts;
30986+atomic_unchecked_t cm_resets_recvd;
30987
30988 static inline int mini_cm_accelerated(struct nes_cm_core *,
30989 struct nes_cm_node *);
30990@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30991
30992 static struct nes_cm_core *g_cm_core;
30993
30994-atomic_t cm_connects;
30995-atomic_t cm_accepts;
30996-atomic_t cm_disconnects;
30997-atomic_t cm_closes;
30998-atomic_t cm_connecteds;
30999-atomic_t cm_connect_reqs;
31000-atomic_t cm_rejects;
31001+atomic_unchecked_t cm_connects;
31002+atomic_unchecked_t cm_accepts;
31003+atomic_unchecked_t cm_disconnects;
31004+atomic_unchecked_t cm_closes;
31005+atomic_unchecked_t cm_connecteds;
31006+atomic_unchecked_t cm_connect_reqs;
31007+atomic_unchecked_t cm_rejects;
31008
31009
31010 /**
31011@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
31012 kfree(listener);
31013 listener = NULL;
31014 ret = 0;
31015- atomic_inc(&cm_listens_destroyed);
31016+ atomic_inc_unchecked(&cm_listens_destroyed);
31017 } else {
31018 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
31019 }
31020@@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node(
31021 cm_node->rem_mac);
31022
31023 add_hte_node(cm_core, cm_node);
31024- atomic_inc(&cm_nodes_created);
31025+ atomic_inc_unchecked(&cm_nodes_created);
31026
31027 return cm_node;
31028 }
31029@@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm
31030 }
31031
31032 atomic_dec(&cm_core->node_cnt);
31033- atomic_inc(&cm_nodes_destroyed);
31034+ atomic_inc_unchecked(&cm_nodes_destroyed);
31035 nesqp = cm_node->nesqp;
31036 if (nesqp) {
31037 nesqp->cm_node = NULL;
31038@@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm
31039
31040 static void drop_packet(struct sk_buff *skb)
31041 {
31042- atomic_inc(&cm_accel_dropped_pkts);
31043+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
31044 dev_kfree_skb_any(skb);
31045 }
31046
31047@@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm
31048 {
31049
31050 int reset = 0; /* whether to send reset in case of err.. */
31051- atomic_inc(&cm_resets_recvd);
31052+ atomic_inc_unchecked(&cm_resets_recvd);
31053 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
31054 " refcnt=%d\n", cm_node, cm_node->state,
31055 atomic_read(&cm_node->ref_count));
31056@@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne
31057 rem_ref_cm_node(cm_node->cm_core, cm_node);
31058 return NULL;
31059 }
31060- atomic_inc(&cm_loopbacks);
31061+ atomic_inc_unchecked(&cm_loopbacks);
31062 loopbackremotenode->loopbackpartner = cm_node;
31063 loopbackremotenode->tcp_cntxt.rcv_wscale =
31064 NES_CM_DEFAULT_RCV_WND_SCALE;
31065@@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c
31066 add_ref_cm_node(cm_node);
31067 } else if (cm_node->state == NES_CM_STATE_TSA) {
31068 rem_ref_cm_node(cm_core, cm_node);
31069- atomic_inc(&cm_accel_dropped_pkts);
31070+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
31071 dev_kfree_skb_any(skb);
31072 break;
31073 }
31074@@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne
31075
31076 if ((cm_id) && (cm_id->event_handler)) {
31077 if (issue_disconn) {
31078- atomic_inc(&cm_disconnects);
31079+ atomic_inc_unchecked(&cm_disconnects);
31080 cm_event.event = IW_CM_EVENT_DISCONNECT;
31081 cm_event.status = disconn_status;
31082 cm_event.local_addr = cm_id->local_addr;
31083@@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne
31084 }
31085
31086 if (issue_close) {
31087- atomic_inc(&cm_closes);
31088+ atomic_inc_unchecked(&cm_closes);
31089 nes_disconnect(nesqp, 1);
31090
31091 cm_id->provider_data = nesqp;
31092@@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
31093
31094 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
31095 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
31096- atomic_inc(&cm_accepts);
31097+ atomic_inc_unchecked(&cm_accepts);
31098
31099 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
31100 netdev_refcnt_read(nesvnic->netdev));
31101@@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
31102
31103 struct nes_cm_core *cm_core;
31104
31105- atomic_inc(&cm_rejects);
31106+ atomic_inc_unchecked(&cm_rejects);
31107 cm_node = (struct nes_cm_node *) cm_id->provider_data;
31108 loopback = cm_node->loopbackpartner;
31109 cm_core = cm_node->cm_core;
31110@@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id,
31111 ntohl(cm_id->local_addr.sin_addr.s_addr),
31112 ntohs(cm_id->local_addr.sin_port));
31113
31114- atomic_inc(&cm_connects);
31115+ atomic_inc_unchecked(&cm_connects);
31116 nesqp->active_conn = 1;
31117
31118 /* cache the cm_id in the qp */
31119@@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c
31120 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
31121 return err;
31122 }
31123- atomic_inc(&cm_listens_created);
31124+ atomic_inc_unchecked(&cm_listens_created);
31125 }
31126
31127 cm_id->add_ref(cm_id);
31128@@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne
31129 if (nesqp->destroyed) {
31130 return;
31131 }
31132- atomic_inc(&cm_connecteds);
31133+ atomic_inc_unchecked(&cm_connecteds);
31134 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
31135 " local port 0x%04X. jiffies = %lu.\n",
31136 nesqp->hwqp.qp_id,
31137@@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm
31138
31139 cm_id->add_ref(cm_id);
31140 ret = cm_id->event_handler(cm_id, &cm_event);
31141- atomic_inc(&cm_closes);
31142+ atomic_inc_unchecked(&cm_closes);
31143 cm_event.event = IW_CM_EVENT_CLOSE;
31144 cm_event.status = IW_CM_EVENT_STATUS_OK;
31145 cm_event.provider_data = cm_id->provider_data;
31146@@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_
31147 return;
31148 cm_id = cm_node->cm_id;
31149
31150- atomic_inc(&cm_connect_reqs);
31151+ atomic_inc_unchecked(&cm_connect_reqs);
31152 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
31153 cm_node, cm_id, jiffies);
31154
31155@@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n
31156 return;
31157 cm_id = cm_node->cm_id;
31158
31159- atomic_inc(&cm_connect_reqs);
31160+ atomic_inc_unchecked(&cm_connect_reqs);
31161 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
31162 cm_node, cm_id, jiffies);
31163
31164diff -urNp linux-2.6.39.2/drivers/infiniband/hw/nes/nes.h linux-2.6.39.2/drivers/infiniband/hw/nes/nes.h
31165--- linux-2.6.39.2/drivers/infiniband/hw/nes/nes.h 2011-05-19 00:06:34.000000000 -0400
31166+++ linux-2.6.39.2/drivers/infiniband/hw/nes/nes.h 2011-05-22 19:36:31.000000000 -0400
31167@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
31168 extern unsigned int wqm_quanta;
31169 extern struct list_head nes_adapter_list;
31170
31171-extern atomic_t cm_connects;
31172-extern atomic_t cm_accepts;
31173-extern atomic_t cm_disconnects;
31174-extern atomic_t cm_closes;
31175-extern atomic_t cm_connecteds;
31176-extern atomic_t cm_connect_reqs;
31177-extern atomic_t cm_rejects;
31178-extern atomic_t mod_qp_timouts;
31179-extern atomic_t qps_created;
31180-extern atomic_t qps_destroyed;
31181-extern atomic_t sw_qps_destroyed;
31182+extern atomic_unchecked_t cm_connects;
31183+extern atomic_unchecked_t cm_accepts;
31184+extern atomic_unchecked_t cm_disconnects;
31185+extern atomic_unchecked_t cm_closes;
31186+extern atomic_unchecked_t cm_connecteds;
31187+extern atomic_unchecked_t cm_connect_reqs;
31188+extern atomic_unchecked_t cm_rejects;
31189+extern atomic_unchecked_t mod_qp_timouts;
31190+extern atomic_unchecked_t qps_created;
31191+extern atomic_unchecked_t qps_destroyed;
31192+extern atomic_unchecked_t sw_qps_destroyed;
31193 extern u32 mh_detected;
31194 extern u32 mh_pauses_sent;
31195 extern u32 cm_packets_sent;
31196@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
31197 extern u32 cm_packets_received;
31198 extern u32 cm_packets_dropped;
31199 extern u32 cm_packets_retrans;
31200-extern atomic_t cm_listens_created;
31201-extern atomic_t cm_listens_destroyed;
31202+extern atomic_unchecked_t cm_listens_created;
31203+extern atomic_unchecked_t cm_listens_destroyed;
31204 extern u32 cm_backlog_drops;
31205-extern atomic_t cm_loopbacks;
31206-extern atomic_t cm_nodes_created;
31207-extern atomic_t cm_nodes_destroyed;
31208-extern atomic_t cm_accel_dropped_pkts;
31209-extern atomic_t cm_resets_recvd;
31210+extern atomic_unchecked_t cm_loopbacks;
31211+extern atomic_unchecked_t cm_nodes_created;
31212+extern atomic_unchecked_t cm_nodes_destroyed;
31213+extern atomic_unchecked_t cm_accel_dropped_pkts;
31214+extern atomic_unchecked_t cm_resets_recvd;
31215
31216 extern u32 int_mod_timer_init;
31217 extern u32 int_mod_cq_depth_256;
31218diff -urNp linux-2.6.39.2/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.39.2/drivers/infiniband/hw/nes/nes_nic.c
31219--- linux-2.6.39.2/drivers/infiniband/hw/nes/nes_nic.c 2011-05-19 00:06:34.000000000 -0400
31220+++ linux-2.6.39.2/drivers/infiniband/hw/nes/nes_nic.c 2011-05-22 19:36:31.000000000 -0400
31221@@ -1302,31 +1302,31 @@ static void nes_netdev_get_ethtool_stats
31222 target_stat_values[++index] = mh_detected;
31223 target_stat_values[++index] = mh_pauses_sent;
31224 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
31225- target_stat_values[++index] = atomic_read(&cm_connects);
31226- target_stat_values[++index] = atomic_read(&cm_accepts);
31227- target_stat_values[++index] = atomic_read(&cm_disconnects);
31228- target_stat_values[++index] = atomic_read(&cm_connecteds);
31229- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
31230- target_stat_values[++index] = atomic_read(&cm_rejects);
31231- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
31232- target_stat_values[++index] = atomic_read(&qps_created);
31233- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
31234- target_stat_values[++index] = atomic_read(&qps_destroyed);
31235- target_stat_values[++index] = atomic_read(&cm_closes);
31236+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
31237+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
31238+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
31239+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
31240+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
31241+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
31242+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
31243+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
31244+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
31245+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
31246+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
31247 target_stat_values[++index] = cm_packets_sent;
31248 target_stat_values[++index] = cm_packets_bounced;
31249 target_stat_values[++index] = cm_packets_created;
31250 target_stat_values[++index] = cm_packets_received;
31251 target_stat_values[++index] = cm_packets_dropped;
31252 target_stat_values[++index] = cm_packets_retrans;
31253- target_stat_values[++index] = atomic_read(&cm_listens_created);
31254- target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
31255+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
31256+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
31257 target_stat_values[++index] = cm_backlog_drops;
31258- target_stat_values[++index] = atomic_read(&cm_loopbacks);
31259- target_stat_values[++index] = atomic_read(&cm_nodes_created);
31260- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
31261- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
31262- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
31263+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
31264+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
31265+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
31266+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
31267+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
31268 target_stat_values[++index] = nesadapter->free_4kpbl;
31269 target_stat_values[++index] = nesadapter->free_256pbl;
31270 target_stat_values[++index] = int_mod_timer_init;
31271diff -urNp linux-2.6.39.2/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.39.2/drivers/infiniband/hw/nes/nes_verbs.c
31272--- linux-2.6.39.2/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-19 00:06:34.000000000 -0400
31273+++ linux-2.6.39.2/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-22 19:36:31.000000000 -0400
31274@@ -46,9 +46,9 @@
31275
31276 #include <rdma/ib_umem.h>
31277
31278-atomic_t mod_qp_timouts;
31279-atomic_t qps_created;
31280-atomic_t sw_qps_destroyed;
31281+atomic_unchecked_t mod_qp_timouts;
31282+atomic_unchecked_t qps_created;
31283+atomic_unchecked_t sw_qps_destroyed;
31284
31285 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
31286
31287@@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
31288 if (init_attr->create_flags)
31289 return ERR_PTR(-EINVAL);
31290
31291- atomic_inc(&qps_created);
31292+ atomic_inc_unchecked(&qps_created);
31293 switch (init_attr->qp_type) {
31294 case IB_QPT_RC:
31295 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
31296@@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
31297 struct iw_cm_event cm_event;
31298 int ret;
31299
31300- atomic_inc(&sw_qps_destroyed);
31301+ atomic_inc_unchecked(&sw_qps_destroyed);
31302 nesqp->destroyed = 1;
31303
31304 /* Blow away the connection if it exists. */
31305diff -urNp linux-2.6.39.2/drivers/infiniband/hw/qib/qib.h linux-2.6.39.2/drivers/infiniband/hw/qib/qib.h
31306--- linux-2.6.39.2/drivers/infiniband/hw/qib/qib.h 2011-05-19 00:06:34.000000000 -0400
31307+++ linux-2.6.39.2/drivers/infiniband/hw/qib/qib.h 2011-05-22 19:36:31.000000000 -0400
31308@@ -51,6 +51,7 @@
31309 #include <linux/completion.h>
31310 #include <linux/kref.h>
31311 #include <linux/sched.h>
31312+#include <linux/slab.h>
31313
31314 #include "qib_common.h"
31315 #include "qib_verbs.h"
31316@@ -87,7 +88,7 @@ struct qlogic_ib_stats {
31317 };
31318
31319 extern struct qlogic_ib_stats qib_stats;
31320-extern struct pci_error_handlers qib_pci_err_handler;
31321+extern const struct pci_error_handlers qib_pci_err_handler;
31322 extern struct pci_driver qib_driver;
31323
31324 #define QIB_CHIP_SWVERSION QIB_CHIP_VERS_MAJ
31325diff -urNp linux-2.6.39.2/drivers/infiniband/hw/qib/qib_mmap.c linux-2.6.39.2/drivers/infiniband/hw/qib/qib_mmap.c
31326--- linux-2.6.39.2/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-19 00:06:34.000000000 -0400
31327+++ linux-2.6.39.2/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-22 19:36:31.000000000 -0400
31328@@ -75,7 +75,7 @@ static void qib_vma_close(struct vm_area
31329 kref_put(&ip->ref, qib_release_mmap_info);
31330 }
31331
31332-static struct vm_operations_struct qib_vm_ops = {
31333+static const struct vm_operations_struct qib_vm_ops = {
31334 .open = qib_vma_open,
31335 .close = qib_vma_close,
31336 };
31337diff -urNp linux-2.6.39.2/drivers/infiniband/hw/qib/qib_pcie.c linux-2.6.39.2/drivers/infiniband/hw/qib/qib_pcie.c
31338--- linux-2.6.39.2/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-19 00:06:34.000000000 -0400
31339+++ linux-2.6.39.2/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-22 19:36:31.000000000 -0400
31340@@ -735,7 +735,7 @@ qib_pci_resume(struct pci_dev *pdev)
31341 qib_init(dd, 1); /* same as re-init after reset */
31342 }
31343
31344-struct pci_error_handlers qib_pci_err_handler = {
31345+const struct pci_error_handlers qib_pci_err_handler = {
31346 .error_detected = qib_pci_error_detected,
31347 .mmio_enabled = qib_pci_mmio_enabled,
31348 .link_reset = qib_pci_link_reset,
31349diff -urNp linux-2.6.39.2/drivers/input/gameport/gameport.c linux-2.6.39.2/drivers/input/gameport/gameport.c
31350--- linux-2.6.39.2/drivers/input/gameport/gameport.c 2011-05-19 00:06:34.000000000 -0400
31351+++ linux-2.6.39.2/drivers/input/gameport/gameport.c 2011-05-22 19:36:31.000000000 -0400
31352@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
31353 */
31354 static void gameport_init_port(struct gameport *gameport)
31355 {
31356- static atomic_t gameport_no = ATOMIC_INIT(0);
31357+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
31358
31359 __module_get(THIS_MODULE);
31360
31361 mutex_init(&gameport->drv_mutex);
31362 device_initialize(&gameport->dev);
31363 dev_set_name(&gameport->dev, "gameport%lu",
31364- (unsigned long)atomic_inc_return(&gameport_no) - 1);
31365+ (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
31366 gameport->dev.bus = &gameport_bus;
31367 gameport->dev.release = gameport_release_port;
31368 if (gameport->parent)
31369diff -urNp linux-2.6.39.2/drivers/input/input.c linux-2.6.39.2/drivers/input/input.c
31370--- linux-2.6.39.2/drivers/input/input.c 2011-05-19 00:06:34.000000000 -0400
31371+++ linux-2.6.39.2/drivers/input/input.c 2011-05-22 19:36:31.000000000 -0400
31372@@ -1815,7 +1815,7 @@ static void input_cleanse_bitmasks(struc
31373 */
31374 int input_register_device(struct input_dev *dev)
31375 {
31376- static atomic_t input_no = ATOMIC_INIT(0);
31377+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
31378 struct input_handler *handler;
31379 const char *path;
31380 int error;
31381@@ -1852,7 +1852,7 @@ int input_register_device(struct input_d
31382 dev->setkeycode = input_default_setkeycode;
31383
31384 dev_set_name(&dev->dev, "input%ld",
31385- (unsigned long) atomic_inc_return(&input_no) - 1);
31386+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
31387
31388 error = device_add(&dev->dev);
31389 if (error)
31390diff -urNp linux-2.6.39.2/drivers/input/joystick/sidewinder.c linux-2.6.39.2/drivers/input/joystick/sidewinder.c
31391--- linux-2.6.39.2/drivers/input/joystick/sidewinder.c 2011-05-19 00:06:34.000000000 -0400
31392+++ linux-2.6.39.2/drivers/input/joystick/sidewinder.c 2011-05-22 19:36:31.000000000 -0400
31393@@ -30,6 +30,7 @@
31394 #include <linux/kernel.h>
31395 #include <linux/module.h>
31396 #include <linux/slab.h>
31397+#include <linux/sched.h>
31398 #include <linux/init.h>
31399 #include <linux/input.h>
31400 #include <linux/gameport.h>
31401@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
31402 unsigned char buf[SW_LENGTH];
31403 int i;
31404
31405+ pax_track_stack();
31406+
31407 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
31408
31409 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
31410diff -urNp linux-2.6.39.2/drivers/input/joystick/xpad.c linux-2.6.39.2/drivers/input/joystick/xpad.c
31411--- linux-2.6.39.2/drivers/input/joystick/xpad.c 2011-05-19 00:06:34.000000000 -0400
31412+++ linux-2.6.39.2/drivers/input/joystick/xpad.c 2011-05-22 19:36:31.000000000 -0400
31413@@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
31414
31415 static int xpad_led_probe(struct usb_xpad *xpad)
31416 {
31417- static atomic_t led_seq = ATOMIC_INIT(0);
31418+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
31419 long led_no;
31420 struct xpad_led *led;
31421 struct led_classdev *led_cdev;
31422@@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
31423 if (!led)
31424 return -ENOMEM;
31425
31426- led_no = (long)atomic_inc_return(&led_seq) - 1;
31427+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
31428
31429 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
31430 led->xpad = xpad;
31431diff -urNp linux-2.6.39.2/drivers/input/mousedev.c linux-2.6.39.2/drivers/input/mousedev.c
31432--- linux-2.6.39.2/drivers/input/mousedev.c 2011-05-19 00:06:34.000000000 -0400
31433+++ linux-2.6.39.2/drivers/input/mousedev.c 2011-05-22 19:36:31.000000000 -0400
31434@@ -764,7 +764,7 @@ static ssize_t mousedev_read(struct file
31435
31436 spin_unlock_irq(&client->packet_lock);
31437
31438- if (copy_to_user(buffer, data, count))
31439+ if (count > sizeof(data) || copy_to_user(buffer, data, count))
31440 return -EFAULT;
31441
31442 return count;
31443diff -urNp linux-2.6.39.2/drivers/input/serio/serio.c linux-2.6.39.2/drivers/input/serio/serio.c
31444--- linux-2.6.39.2/drivers/input/serio/serio.c 2011-05-19 00:06:34.000000000 -0400
31445+++ linux-2.6.39.2/drivers/input/serio/serio.c 2011-05-22 19:36:31.000000000 -0400
31446@@ -497,7 +497,7 @@ static void serio_release_port(struct de
31447 */
31448 static void serio_init_port(struct serio *serio)
31449 {
31450- static atomic_t serio_no = ATOMIC_INIT(0);
31451+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
31452
31453 __module_get(THIS_MODULE);
31454
31455@@ -508,7 +508,7 @@ static void serio_init_port(struct serio
31456 mutex_init(&serio->drv_mutex);
31457 device_initialize(&serio->dev);
31458 dev_set_name(&serio->dev, "serio%ld",
31459- (long)atomic_inc_return(&serio_no) - 1);
31460+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
31461 serio->dev.bus = &serio_bus;
31462 serio->dev.release = serio_release_port;
31463 serio->dev.groups = serio_device_attr_groups;
31464diff -urNp linux-2.6.39.2/drivers/isdn/capi/capi.c linux-2.6.39.2/drivers/isdn/capi/capi.c
31465--- linux-2.6.39.2/drivers/isdn/capi/capi.c 2011-05-19 00:06:34.000000000 -0400
31466+++ linux-2.6.39.2/drivers/isdn/capi/capi.c 2011-05-22 19:36:31.000000000 -0400
31467@@ -89,8 +89,8 @@ struct capiminor {
31468
31469 struct capi20_appl *ap;
31470 u32 ncci;
31471- atomic_t datahandle;
31472- atomic_t msgid;
31473+ atomic_unchecked_t datahandle;
31474+ atomic_unchecked_t msgid;
31475
31476 struct tty_port port;
31477 int ttyinstop;
31478@@ -414,7 +414,7 @@ gen_data_b3_resp_for(struct capiminor *m
31479 capimsg_setu16(s, 2, mp->ap->applid);
31480 capimsg_setu8 (s, 4, CAPI_DATA_B3);
31481 capimsg_setu8 (s, 5, CAPI_RESP);
31482- capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
31483+ capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
31484 capimsg_setu32(s, 8, mp->ncci);
31485 capimsg_setu16(s, 12, datahandle);
31486 }
31487@@ -547,14 +547,14 @@ static void handle_minor_send(struct cap
31488 mp->outbytes -= len;
31489 spin_unlock_bh(&mp->outlock);
31490
31491- datahandle = atomic_inc_return(&mp->datahandle);
31492+ datahandle = atomic_inc_return_unchecked(&mp->datahandle);
31493 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
31494 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31495 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31496 capimsg_setu16(skb->data, 2, mp->ap->applid);
31497 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
31498 capimsg_setu8 (skb->data, 5, CAPI_REQ);
31499- capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
31500+ capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
31501 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
31502 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
31503 capimsg_setu16(skb->data, 16, len); /* Data length */
31504diff -urNp linux-2.6.39.2/drivers/isdn/gigaset/common.c linux-2.6.39.2/drivers/isdn/gigaset/common.c
31505--- linux-2.6.39.2/drivers/isdn/gigaset/common.c 2011-05-19 00:06:34.000000000 -0400
31506+++ linux-2.6.39.2/drivers/isdn/gigaset/common.c 2011-05-22 19:36:31.000000000 -0400
31507@@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct
31508 cs->commands_pending = 0;
31509 cs->cur_at_seq = 0;
31510 cs->gotfwver = -1;
31511- cs->open_count = 0;
31512+ local_set(&cs->open_count, 0);
31513 cs->dev = NULL;
31514 cs->tty = NULL;
31515 cs->tty_dev = NULL;
31516diff -urNp linux-2.6.39.2/drivers/isdn/gigaset/gigaset.h linux-2.6.39.2/drivers/isdn/gigaset/gigaset.h
31517--- linux-2.6.39.2/drivers/isdn/gigaset/gigaset.h 2011-05-19 00:06:34.000000000 -0400
31518+++ linux-2.6.39.2/drivers/isdn/gigaset/gigaset.h 2011-05-22 19:36:31.000000000 -0400
31519@@ -35,6 +35,7 @@
31520 #include <linux/tty_driver.h>
31521 #include <linux/list.h>
31522 #include <asm/atomic.h>
31523+#include <asm/local.h>
31524
31525 #define GIG_VERSION {0, 5, 0, 0}
31526 #define GIG_COMPAT {0, 4, 0, 0}
31527@@ -433,7 +434,7 @@ struct cardstate {
31528 spinlock_t cmdlock;
31529 unsigned curlen, cmdbytes;
31530
31531- unsigned open_count;
31532+ local_t open_count;
31533 struct tty_struct *tty;
31534 struct tasklet_struct if_wake_tasklet;
31535 unsigned control_state;
31536diff -urNp linux-2.6.39.2/drivers/isdn/gigaset/interface.c linux-2.6.39.2/drivers/isdn/gigaset/interface.c
31537--- linux-2.6.39.2/drivers/isdn/gigaset/interface.c 2011-05-19 00:06:34.000000000 -0400
31538+++ linux-2.6.39.2/drivers/isdn/gigaset/interface.c 2011-05-22 19:36:31.000000000 -0400
31539@@ -160,9 +160,7 @@ static int if_open(struct tty_struct *tt
31540 return -ERESTARTSYS;
31541 tty->driver_data = cs;
31542
31543- ++cs->open_count;
31544-
31545- if (cs->open_count == 1) {
31546+ if (local_inc_return(&cs->open_count) == 1) {
31547 spin_lock_irqsave(&cs->lock, flags);
31548 cs->tty = tty;
31549 spin_unlock_irqrestore(&cs->lock, flags);
31550@@ -190,10 +188,10 @@ static void if_close(struct tty_struct *
31551
31552 if (!cs->connected)
31553 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31554- else if (!cs->open_count)
31555+ else if (!local_read(&cs->open_count))
31556 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31557 else {
31558- if (!--cs->open_count) {
31559+ if (!local_dec_return(&cs->open_count)) {
31560 spin_lock_irqsave(&cs->lock, flags);
31561 cs->tty = NULL;
31562 spin_unlock_irqrestore(&cs->lock, flags);
31563@@ -228,7 +226,7 @@ static int if_ioctl(struct tty_struct *t
31564 if (!cs->connected) {
31565 gig_dbg(DEBUG_IF, "not connected");
31566 retval = -ENODEV;
31567- } else if (!cs->open_count)
31568+ } else if (!local_read(&cs->open_count))
31569 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31570 else {
31571 retval = 0;
31572@@ -358,7 +356,7 @@ static int if_write(struct tty_struct *t
31573 retval = -ENODEV;
31574 goto done;
31575 }
31576- if (!cs->open_count) {
31577+ if (!local_read(&cs->open_count)) {
31578 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31579 retval = -ENODEV;
31580 goto done;
31581@@ -411,7 +409,7 @@ static int if_write_room(struct tty_stru
31582 if (!cs->connected) {
31583 gig_dbg(DEBUG_IF, "not connected");
31584 retval = -ENODEV;
31585- } else if (!cs->open_count)
31586+ } else if (!local_read(&cs->open_count))
31587 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31588 else if (cs->mstate != MS_LOCKED) {
31589 dev_warn(cs->dev, "can't write to unlocked device\n");
31590@@ -441,7 +439,7 @@ static int if_chars_in_buffer(struct tty
31591
31592 if (!cs->connected)
31593 gig_dbg(DEBUG_IF, "not connected");
31594- else if (!cs->open_count)
31595+ else if (!local_read(&cs->open_count))
31596 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31597 else if (cs->mstate != MS_LOCKED)
31598 dev_warn(cs->dev, "can't write to unlocked device\n");
31599@@ -469,7 +467,7 @@ static void if_throttle(struct tty_struc
31600
31601 if (!cs->connected)
31602 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31603- else if (!cs->open_count)
31604+ else if (!local_read(&cs->open_count))
31605 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31606 else
31607 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31608@@ -493,7 +491,7 @@ static void if_unthrottle(struct tty_str
31609
31610 if (!cs->connected)
31611 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31612- else if (!cs->open_count)
31613+ else if (!local_read(&cs->open_count))
31614 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31615 else
31616 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31617@@ -524,7 +522,7 @@ static void if_set_termios(struct tty_st
31618 goto out;
31619 }
31620
31621- if (!cs->open_count) {
31622+ if (!local_read(&cs->open_count)) {
31623 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31624 goto out;
31625 }
31626diff -urNp linux-2.6.39.2/drivers/isdn/hardware/avm/b1.c linux-2.6.39.2/drivers/isdn/hardware/avm/b1.c
31627--- linux-2.6.39.2/drivers/isdn/hardware/avm/b1.c 2011-05-19 00:06:34.000000000 -0400
31628+++ linux-2.6.39.2/drivers/isdn/hardware/avm/b1.c 2011-05-22 19:36:31.000000000 -0400
31629@@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
31630 }
31631 if (left) {
31632 if (t4file->user) {
31633- if (copy_from_user(buf, dp, left))
31634+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31635 return -EFAULT;
31636 } else {
31637 memcpy(buf, dp, left);
31638@@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo
31639 }
31640 if (left) {
31641 if (config->user) {
31642- if (copy_from_user(buf, dp, left))
31643+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31644 return -EFAULT;
31645 } else {
31646 memcpy(buf, dp, left);
31647diff -urNp linux-2.6.39.2/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.39.2/drivers/isdn/hardware/eicon/capidtmf.c
31648--- linux-2.6.39.2/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-19 00:06:34.000000000 -0400
31649+++ linux-2.6.39.2/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-22 19:36:31.000000000 -0400
31650@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
31651 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
31652 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
31653
31654+ pax_track_stack();
31655
31656 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
31657 {
31658diff -urNp linux-2.6.39.2/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.39.2/drivers/isdn/hardware/eicon/capifunc.c
31659--- linux-2.6.39.2/drivers/isdn/hardware/eicon/capifunc.c 2011-05-19 00:06:34.000000000 -0400
31660+++ linux-2.6.39.2/drivers/isdn/hardware/eicon/capifunc.c 2011-05-22 19:36:31.000000000 -0400
31661@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
31662 IDI_SYNC_REQ req;
31663 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31664
31665+ pax_track_stack();
31666+
31667 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31668
31669 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31670diff -urNp linux-2.6.39.2/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.39.2/drivers/isdn/hardware/eicon/diddfunc.c
31671--- linux-2.6.39.2/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-19 00:06:34.000000000 -0400
31672+++ linux-2.6.39.2/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-22 19:36:31.000000000 -0400
31673@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
31674 IDI_SYNC_REQ req;
31675 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31676
31677+ pax_track_stack();
31678+
31679 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31680
31681 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31682diff -urNp linux-2.6.39.2/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.39.2/drivers/isdn/hardware/eicon/divasfunc.c
31683--- linux-2.6.39.2/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-19 00:06:34.000000000 -0400
31684+++ linux-2.6.39.2/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-22 19:36:31.000000000 -0400
31685@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
31686 IDI_SYNC_REQ req;
31687 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31688
31689+ pax_track_stack();
31690+
31691 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31692
31693 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31694diff -urNp linux-2.6.39.2/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.39.2/drivers/isdn/hardware/eicon/idifunc.c
31695--- linux-2.6.39.2/drivers/isdn/hardware/eicon/idifunc.c 2011-05-19 00:06:34.000000000 -0400
31696+++ linux-2.6.39.2/drivers/isdn/hardware/eicon/idifunc.c 2011-05-22 19:36:31.000000000 -0400
31697@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
31698 IDI_SYNC_REQ req;
31699 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31700
31701+ pax_track_stack();
31702+
31703 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31704
31705 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31706diff -urNp linux-2.6.39.2/drivers/isdn/hardware/eicon/message.c linux-2.6.39.2/drivers/isdn/hardware/eicon/message.c
31707--- linux-2.6.39.2/drivers/isdn/hardware/eicon/message.c 2011-05-19 00:06:34.000000000 -0400
31708+++ linux-2.6.39.2/drivers/isdn/hardware/eicon/message.c 2011-05-22 19:36:31.000000000 -0400
31709@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
31710 dword d;
31711 word w;
31712
31713+ pax_track_stack();
31714+
31715 a = plci->adapter;
31716 Id = ((word)plci->Id<<8)|a->Id;
31717 PUT_WORD(&SS_Ind[4],0x0000);
31718@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
31719 word j, n, w;
31720 dword d;
31721
31722+ pax_track_stack();
31723+
31724
31725 for(i=0;i<8;i++) bp_parms[i].length = 0;
31726 for(i=0;i<2;i++) global_config[i].length = 0;
31727@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
31728 const byte llc3[] = {4,3,2,2,6,6,0};
31729 const byte header[] = {0,2,3,3,0,0,0};
31730
31731+ pax_track_stack();
31732+
31733 for(i=0;i<8;i++) bp_parms[i].length = 0;
31734 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
31735 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
31736@@ -14760,6 +14766,8 @@ static void group_optimization(DIVA_CAPI
31737 word appl_number_group_type[MAX_APPL];
31738 PLCI *auxplci;
31739
31740+ pax_track_stack();
31741+
31742 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
31743
31744 if(!a->group_optimization_enabled)
31745diff -urNp linux-2.6.39.2/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.39.2/drivers/isdn/hardware/eicon/mntfunc.c
31746--- linux-2.6.39.2/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-19 00:06:34.000000000 -0400
31747+++ linux-2.6.39.2/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-22 19:36:31.000000000 -0400
31748@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
31749 IDI_SYNC_REQ req;
31750 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31751
31752+ pax_track_stack();
31753+
31754 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31755
31756 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31757diff -urNp linux-2.6.39.2/drivers/isdn/i4l/isdn_common.c linux-2.6.39.2/drivers/isdn/i4l/isdn_common.c
31758--- linux-2.6.39.2/drivers/isdn/i4l/isdn_common.c 2011-05-19 00:06:34.000000000 -0400
31759+++ linux-2.6.39.2/drivers/isdn/i4l/isdn_common.c 2011-05-22 19:36:31.000000000 -0400
31760@@ -1292,6 +1292,8 @@ isdn_ioctl(struct file *file, uint cmd,
31761 } iocpar;
31762 void __user *argp = (void __user *)arg;
31763
31764+ pax_track_stack();
31765+
31766 #define name iocpar.name
31767 #define bname iocpar.bname
31768 #define iocts iocpar.iocts
31769diff -urNp linux-2.6.39.2/drivers/isdn/i4l/isdn_net.c linux-2.6.39.2/drivers/isdn/i4l/isdn_net.c
31770--- linux-2.6.39.2/drivers/isdn/i4l/isdn_net.c 2011-05-19 00:06:34.000000000 -0400
31771+++ linux-2.6.39.2/drivers/isdn/i4l/isdn_net.c 2011-05-22 19:36:31.000000000 -0400
31772@@ -400,7 +400,7 @@ isdn_net_stat_callback(int idx, isdn_ctr
31773 isdn_net_local *lp = p->local;
31774 #ifdef CONFIG_ISDN_X25
31775 struct concap_proto *cprot = lp->netdev->cprot;
31776- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31777+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31778 #endif
31779 switch (cmd) {
31780 case ISDN_STAT_BSENT:
31781@@ -831,7 +831,7 @@ isdn_net_hangup(struct net_device *d)
31782 isdn_ctrl cmd;
31783 #ifdef CONFIG_ISDN_X25
31784 struct concap_proto *cprot = lp->netdev->cprot;
31785- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31786+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31787 #endif
31788
31789 if (lp->flags & ISDN_NET_CONNECTED) {
31790diff -urNp linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.c linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.c
31791--- linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.c 2011-05-19 00:06:34.000000000 -0400
31792+++ linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.c 2011-05-22 19:36:31.000000000 -0400
31793@@ -52,7 +52,7 @@ static int isdn_x25iface_connect_ind( st
31794 static int isdn_x25iface_disconn_ind( struct concap_proto * );
31795
31796
31797-static struct concap_proto_ops ix25_pops = {
31798+static const struct concap_proto_ops ix25_pops = {
31799 &isdn_x25iface_proto_new,
31800 &isdn_x25iface_proto_del,
31801 &isdn_x25iface_proto_restart,
31802diff -urNp linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.h linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.h
31803--- linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.h 2011-05-19 00:06:34.000000000 -0400
31804+++ linux-2.6.39.2/drivers/isdn/i4l/isdn_x25iface.h 2011-05-22 19:36:31.000000000 -0400
31805@@ -23,7 +23,7 @@
31806 #include <linux/isdn.h>
31807 #include <linux/concap.h>
31808
31809-extern struct concap_proto_ops * isdn_x25iface_concap_proto_ops_pt;
31810+extern const struct concap_proto_ops *isdn_x25iface_concap_proto_ops_pt;
31811 extern struct concap_proto * isdn_x25iface_proto_new(void);
31812
31813
31814diff -urNp linux-2.6.39.2/drivers/isdn/icn/icn.c linux-2.6.39.2/drivers/isdn/icn/icn.c
31815--- linux-2.6.39.2/drivers/isdn/icn/icn.c 2011-05-19 00:06:34.000000000 -0400
31816+++ linux-2.6.39.2/drivers/isdn/icn/icn.c 2011-05-22 19:36:31.000000000 -0400
31817@@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
31818 if (count > len)
31819 count = len;
31820 if (user) {
31821- if (copy_from_user(msg, buf, count))
31822+ if (count > sizeof msg || copy_from_user(msg, buf, count))
31823 return -EFAULT;
31824 } else
31825 memcpy(msg, buf, count);
31826diff -urNp linux-2.6.39.2/drivers/lguest/core.c linux-2.6.39.2/drivers/lguest/core.c
31827--- linux-2.6.39.2/drivers/lguest/core.c 2011-05-19 00:06:34.000000000 -0400
31828+++ linux-2.6.39.2/drivers/lguest/core.c 2011-05-22 19:36:31.000000000 -0400
31829@@ -92,9 +92,17 @@ static __init int map_switcher(void)
31830 * it's worked so far. The end address needs +1 because __get_vm_area
31831 * allocates an extra guard page, so we need space for that.
31832 */
31833+
31834+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31835+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31836+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31837+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31838+#else
31839 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31840 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31841 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31842+#endif
31843+
31844 if (!switcher_vma) {
31845 err = -ENOMEM;
31846 printk("lguest: could not map switcher pages high\n");
31847@@ -119,7 +127,7 @@ static __init int map_switcher(void)
31848 * Now the Switcher is mapped at the right address, we can't fail!
31849 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
31850 */
31851- memcpy(switcher_vma->addr, start_switcher_text,
31852+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31853 end_switcher_text - start_switcher_text);
31854
31855 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31856diff -urNp linux-2.6.39.2/drivers/lguest/lguest_device.c linux-2.6.39.2/drivers/lguest/lguest_device.c
31857--- linux-2.6.39.2/drivers/lguest/lguest_device.c 2011-05-19 00:06:34.000000000 -0400
31858+++ linux-2.6.39.2/drivers/lguest/lguest_device.c 2011-05-22 19:36:31.000000000 -0400
31859@@ -374,7 +374,7 @@ error:
31860 }
31861
31862 /* The ops structure which hooks everything together. */
31863-static struct virtio_config_ops lguest_config_ops = {
31864+static const struct virtio_config_ops lguest_config_ops = {
31865 .get_features = lg_get_features,
31866 .finalize_features = lg_finalize_features,
31867 .get = lg_get,
31868diff -urNp linux-2.6.39.2/drivers/lguest/x86/core.c linux-2.6.39.2/drivers/lguest/x86/core.c
31869--- linux-2.6.39.2/drivers/lguest/x86/core.c 2011-05-19 00:06:34.000000000 -0400
31870+++ linux-2.6.39.2/drivers/lguest/x86/core.c 2011-05-22 19:36:31.000000000 -0400
31871@@ -59,7 +59,7 @@ static struct {
31872 /* Offset from where switcher.S was compiled to where we've copied it */
31873 static unsigned long switcher_offset(void)
31874 {
31875- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31876+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31877 }
31878
31879 /* This cpu's struct lguest_pages. */
31880@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
31881 * These copies are pretty cheap, so we do them unconditionally: */
31882 /* Save the current Host top-level page directory.
31883 */
31884+
31885+#ifdef CONFIG_PAX_PER_CPU_PGD
31886+ pages->state.host_cr3 = read_cr3();
31887+#else
31888 pages->state.host_cr3 = __pa(current->mm->pgd);
31889+#endif
31890+
31891 /*
31892 * Set up the Guest's page tables to see this CPU's pages (and no
31893 * other CPU's pages).
31894@@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void)
31895 * compiled-in switcher code and the high-mapped copy we just made.
31896 */
31897 for (i = 0; i < IDT_ENTRIES; i++)
31898- default_idt_entries[i] += switcher_offset();
31899+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31900
31901 /*
31902 * Set up the Switcher's per-cpu areas.
31903@@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void)
31904 * it will be undisturbed when we switch. To change %cs and jump we
31905 * need this structure to feed to Intel's "lcall" instruction.
31906 */
31907- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31908+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31909 lguest_entry.segment = LGUEST_CS;
31910
31911 /*
31912diff -urNp linux-2.6.39.2/drivers/lguest/x86/switcher_32.S linux-2.6.39.2/drivers/lguest/x86/switcher_32.S
31913--- linux-2.6.39.2/drivers/lguest/x86/switcher_32.S 2011-05-19 00:06:34.000000000 -0400
31914+++ linux-2.6.39.2/drivers/lguest/x86/switcher_32.S 2011-05-22 19:36:31.000000000 -0400
31915@@ -87,6 +87,7 @@
31916 #include <asm/page.h>
31917 #include <asm/segment.h>
31918 #include <asm/lguest.h>
31919+#include <asm/processor-flags.h>
31920
31921 // We mark the start of the code to copy
31922 // It's placed in .text tho it's never run here
31923@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31924 // Changes type when we load it: damn Intel!
31925 // For after we switch over our page tables
31926 // That entry will be read-only: we'd crash.
31927+
31928+#ifdef CONFIG_PAX_KERNEXEC
31929+ mov %cr0, %edx
31930+ xor $X86_CR0_WP, %edx
31931+ mov %edx, %cr0
31932+#endif
31933+
31934 movl $(GDT_ENTRY_TSS*8), %edx
31935 ltr %dx
31936
31937@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31938 // Let's clear it again for our return.
31939 // The GDT descriptor of the Host
31940 // Points to the table after two "size" bytes
31941- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31942+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31943 // Clear "used" from type field (byte 5, bit 2)
31944- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31945+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31946+
31947+#ifdef CONFIG_PAX_KERNEXEC
31948+ mov %cr0, %eax
31949+ xor $X86_CR0_WP, %eax
31950+ mov %eax, %cr0
31951+#endif
31952
31953 // Once our page table's switched, the Guest is live!
31954 // The Host fades as we run this final step.
31955@@ -295,13 +309,12 @@ deliver_to_host:
31956 // I consulted gcc, and it gave
31957 // These instructions, which I gladly credit:
31958 leal (%edx,%ebx,8), %eax
31959- movzwl (%eax),%edx
31960- movl 4(%eax), %eax
31961- xorw %ax, %ax
31962- orl %eax, %edx
31963+ movl 4(%eax), %edx
31964+ movw (%eax), %dx
31965 // Now the address of the handler's in %edx
31966 // We call it now: its "iret" drops us home.
31967- jmp *%edx
31968+ ljmp $__KERNEL_CS, $1f
31969+1: jmp *%edx
31970
31971 // Every interrupt can come to us here
31972 // But we must truly tell each apart.
31973diff -urNp linux-2.6.39.2/drivers/md/dm.c linux-2.6.39.2/drivers/md/dm.c
31974--- linux-2.6.39.2/drivers/md/dm.c 2011-05-19 00:06:34.000000000 -0400
31975+++ linux-2.6.39.2/drivers/md/dm.c 2011-05-22 19:36:31.000000000 -0400
31976@@ -162,9 +162,9 @@ struct mapped_device {
31977 /*
31978 * Event handling.
31979 */
31980- atomic_t event_nr;
31981+ atomic_unchecked_t event_nr;
31982 wait_queue_head_t eventq;
31983- atomic_t uevent_seq;
31984+ atomic_unchecked_t uevent_seq;
31985 struct list_head uevent_list;
31986 spinlock_t uevent_lock; /* Protect access to uevent_list */
31987
31988@@ -1836,8 +1836,8 @@ static struct mapped_device *alloc_dev(i
31989 rwlock_init(&md->map_lock);
31990 atomic_set(&md->holders, 1);
31991 atomic_set(&md->open_count, 0);
31992- atomic_set(&md->event_nr, 0);
31993- atomic_set(&md->uevent_seq, 0);
31994+ atomic_set_unchecked(&md->event_nr, 0);
31995+ atomic_set_unchecked(&md->uevent_seq, 0);
31996 INIT_LIST_HEAD(&md->uevent_list);
31997 spin_lock_init(&md->uevent_lock);
31998
31999@@ -1971,7 +1971,7 @@ static void event_callback(void *context
32000
32001 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
32002
32003- atomic_inc(&md->event_nr);
32004+ atomic_inc_unchecked(&md->event_nr);
32005 wake_up(&md->eventq);
32006 }
32007
32008@@ -2547,18 +2547,18 @@ int dm_kobject_uevent(struct mapped_devi
32009
32010 uint32_t dm_next_uevent_seq(struct mapped_device *md)
32011 {
32012- return atomic_add_return(1, &md->uevent_seq);
32013+ return atomic_add_return_unchecked(1, &md->uevent_seq);
32014 }
32015
32016 uint32_t dm_get_event_nr(struct mapped_device *md)
32017 {
32018- return atomic_read(&md->event_nr);
32019+ return atomic_read_unchecked(&md->event_nr);
32020 }
32021
32022 int dm_wait_event(struct mapped_device *md, int event_nr)
32023 {
32024 return wait_event_interruptible(md->eventq,
32025- (event_nr != atomic_read(&md->event_nr)));
32026+ (event_nr != atomic_read_unchecked(&md->event_nr)));
32027 }
32028
32029 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
32030diff -urNp linux-2.6.39.2/drivers/md/dm-crypt.c linux-2.6.39.2/drivers/md/dm-crypt.c
32031--- linux-2.6.39.2/drivers/md/dm-crypt.c 2011-05-19 00:06:34.000000000 -0400
32032+++ linux-2.6.39.2/drivers/md/dm-crypt.c 2011-05-22 19:36:31.000000000 -0400
32033@@ -138,7 +138,7 @@ struct crypt_config {
32034 char *cipher;
32035 char *cipher_string;
32036
32037- struct crypt_iv_operations *iv_gen_ops;
32038+ const struct crypt_iv_operations *iv_gen_ops;
32039 union {
32040 struct iv_essiv_private essiv;
32041 struct iv_benbi_private benbi;
32042@@ -620,15 +620,15 @@ static int crypt_iv_lmk_post(struct cryp
32043 return r;
32044 }
32045
32046-static struct crypt_iv_operations crypt_iv_plain_ops = {
32047+static const struct crypt_iv_operations crypt_iv_plain_ops = {
32048 .generator = crypt_iv_plain_gen
32049 };
32050
32051-static struct crypt_iv_operations crypt_iv_plain64_ops = {
32052+static const struct crypt_iv_operations crypt_iv_plain64_ops = {
32053 .generator = crypt_iv_plain64_gen
32054 };
32055
32056-static struct crypt_iv_operations crypt_iv_essiv_ops = {
32057+static const struct crypt_iv_operations crypt_iv_essiv_ops = {
32058 .ctr = crypt_iv_essiv_ctr,
32059 .dtr = crypt_iv_essiv_dtr,
32060 .init = crypt_iv_essiv_init,
32061@@ -636,17 +636,17 @@ static struct crypt_iv_operations crypt_
32062 .generator = crypt_iv_essiv_gen
32063 };
32064
32065-static struct crypt_iv_operations crypt_iv_benbi_ops = {
32066+static const struct crypt_iv_operations crypt_iv_benbi_ops = {
32067 .ctr = crypt_iv_benbi_ctr,
32068 .dtr = crypt_iv_benbi_dtr,
32069 .generator = crypt_iv_benbi_gen
32070 };
32071
32072-static struct crypt_iv_operations crypt_iv_null_ops = {
32073+static const struct crypt_iv_operations crypt_iv_null_ops = {
32074 .generator = crypt_iv_null_gen
32075 };
32076
32077-static struct crypt_iv_operations crypt_iv_lmk_ops = {
32078+static const struct crypt_iv_operations crypt_iv_lmk_ops = {
32079 .ctr = crypt_iv_lmk_ctr,
32080 .dtr = crypt_iv_lmk_dtr,
32081 .init = crypt_iv_lmk_init,
32082diff -urNp linux-2.6.39.2/drivers/md/dm-ioctl.c linux-2.6.39.2/drivers/md/dm-ioctl.c
32083--- linux-2.6.39.2/drivers/md/dm-ioctl.c 2011-05-19 00:06:34.000000000 -0400
32084+++ linux-2.6.39.2/drivers/md/dm-ioctl.c 2011-05-22 19:36:31.000000000 -0400
32085@@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str
32086 cmd == DM_LIST_VERSIONS_CMD)
32087 return 0;
32088
32089- if ((cmd == DM_DEV_CREATE_CMD)) {
32090+ if (cmd == DM_DEV_CREATE_CMD) {
32091 if (!*param->name) {
32092 DMWARN("name not supplied when creating device");
32093 return -EINVAL;
32094diff -urNp linux-2.6.39.2/drivers/md/dm-raid1.c linux-2.6.39.2/drivers/md/dm-raid1.c
32095--- linux-2.6.39.2/drivers/md/dm-raid1.c 2011-05-19 00:06:34.000000000 -0400
32096+++ linux-2.6.39.2/drivers/md/dm-raid1.c 2011-05-22 19:36:31.000000000 -0400
32097@@ -42,7 +42,7 @@ enum dm_raid1_error {
32098
32099 struct mirror {
32100 struct mirror_set *ms;
32101- atomic_t error_count;
32102+ atomic_unchecked_t error_count;
32103 unsigned long error_type;
32104 struct dm_dev *dev;
32105 sector_t offset;
32106@@ -187,7 +187,7 @@ static struct mirror *get_valid_mirror(s
32107 struct mirror *m;
32108
32109 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
32110- if (!atomic_read(&m->error_count))
32111+ if (!atomic_read_unchecked(&m->error_count))
32112 return m;
32113
32114 return NULL;
32115@@ -219,7 +219,7 @@ static void fail_mirror(struct mirror *m
32116 * simple way to tell if a device has encountered
32117 * errors.
32118 */
32119- atomic_inc(&m->error_count);
32120+ atomic_inc_unchecked(&m->error_count);
32121
32122 if (test_and_set_bit(error_type, &m->error_type))
32123 return;
32124@@ -410,7 +410,7 @@ static struct mirror *choose_mirror(stru
32125 struct mirror *m = get_default_mirror(ms);
32126
32127 do {
32128- if (likely(!atomic_read(&m->error_count)))
32129+ if (likely(!atomic_read_unchecked(&m->error_count)))
32130 return m;
32131
32132 if (m-- == ms->mirror)
32133@@ -424,7 +424,7 @@ static int default_ok(struct mirror *m)
32134 {
32135 struct mirror *default_mirror = get_default_mirror(m->ms);
32136
32137- return !atomic_read(&default_mirror->error_count);
32138+ return !atomic_read_unchecked(&default_mirror->error_count);
32139 }
32140
32141 static int mirror_available(struct mirror_set *ms, struct bio *bio)
32142@@ -561,7 +561,7 @@ static void do_reads(struct mirror_set *
32143 */
32144 if (likely(region_in_sync(ms, region, 1)))
32145 m = choose_mirror(ms, bio->bi_sector);
32146- else if (m && atomic_read(&m->error_count))
32147+ else if (m && atomic_read_unchecked(&m->error_count))
32148 m = NULL;
32149
32150 if (likely(m))
32151@@ -939,7 +939,7 @@ static int get_mirror(struct mirror_set
32152 }
32153
32154 ms->mirror[mirror].ms = ms;
32155- atomic_set(&(ms->mirror[mirror].error_count), 0);
32156+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
32157 ms->mirror[mirror].error_type = 0;
32158 ms->mirror[mirror].offset = offset;
32159
32160@@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ
32161 */
32162 static char device_status_char(struct mirror *m)
32163 {
32164- if (!atomic_read(&(m->error_count)))
32165+ if (!atomic_read_unchecked(&(m->error_count)))
32166 return 'A';
32167
32168 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
32169diff -urNp linux-2.6.39.2/drivers/md/dm-stripe.c linux-2.6.39.2/drivers/md/dm-stripe.c
32170--- linux-2.6.39.2/drivers/md/dm-stripe.c 2011-05-19 00:06:34.000000000 -0400
32171+++ linux-2.6.39.2/drivers/md/dm-stripe.c 2011-05-22 19:36:31.000000000 -0400
32172@@ -20,7 +20,7 @@ struct stripe {
32173 struct dm_dev *dev;
32174 sector_t physical_start;
32175
32176- atomic_t error_count;
32177+ atomic_unchecked_t error_count;
32178 };
32179
32180 struct stripe_c {
32181@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
32182 kfree(sc);
32183 return r;
32184 }
32185- atomic_set(&(sc->stripe[i].error_count), 0);
32186+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
32187 }
32188
32189 ti->private = sc;
32190@@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
32191 DMEMIT("%d ", sc->stripes);
32192 for (i = 0; i < sc->stripes; i++) {
32193 DMEMIT("%s ", sc->stripe[i].dev->name);
32194- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
32195+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
32196 'D' : 'A';
32197 }
32198 buffer[i] = '\0';
32199@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
32200 */
32201 for (i = 0; i < sc->stripes; i++)
32202 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
32203- atomic_inc(&(sc->stripe[i].error_count));
32204- if (atomic_read(&(sc->stripe[i].error_count)) <
32205+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
32206+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
32207 DM_IO_ERROR_THRESHOLD)
32208 schedule_work(&sc->trigger_event);
32209 }
32210diff -urNp linux-2.6.39.2/drivers/md/dm-table.c linux-2.6.39.2/drivers/md/dm-table.c
32211--- linux-2.6.39.2/drivers/md/dm-table.c 2011-06-03 00:04:14.000000000 -0400
32212+++ linux-2.6.39.2/drivers/md/dm-table.c 2011-06-03 00:32:05.000000000 -0400
32213@@ -390,7 +390,7 @@ static int device_area_is_invalid(struct
32214 if (!dev_size)
32215 return 0;
32216
32217- if ((start >= dev_size) || (start + len > dev_size)) {
32218+ if ((start >= dev_size) || (len > dev_size - start)) {
32219 DMWARN("%s: %s too small for target: "
32220 "start=%llu, len=%llu, dev_size=%llu",
32221 dm_device_name(ti->table->md), bdevname(bdev, b),
32222diff -urNp linux-2.6.39.2/drivers/md/md.c linux-2.6.39.2/drivers/md/md.c
32223--- linux-2.6.39.2/drivers/md/md.c 2011-06-25 12:55:22.000000000 -0400
32224+++ linux-2.6.39.2/drivers/md/md.c 2011-06-25 13:00:25.000000000 -0400
32225@@ -226,10 +226,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
32226 * start build, activate spare
32227 */
32228 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
32229-static atomic_t md_event_count;
32230+static atomic_unchecked_t md_event_count;
32231 void md_new_event(mddev_t *mddev)
32232 {
32233- atomic_inc(&md_event_count);
32234+ atomic_inc_unchecked(&md_event_count);
32235 wake_up(&md_event_waiters);
32236 }
32237 EXPORT_SYMBOL_GPL(md_new_event);
32238@@ -239,7 +239,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
32239 */
32240 static void md_new_event_inintr(mddev_t *mddev)
32241 {
32242- atomic_inc(&md_event_count);
32243+ atomic_inc_unchecked(&md_event_count);
32244 wake_up(&md_event_waiters);
32245 }
32246
32247@@ -1454,7 +1454,7 @@ static int super_1_load(mdk_rdev_t *rdev
32248
32249 rdev->preferred_minor = 0xffff;
32250 rdev->data_offset = le64_to_cpu(sb->data_offset);
32251- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
32252+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
32253
32254 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
32255 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
32256@@ -1632,7 +1632,7 @@ static void super_1_sync(mddev_t *mddev,
32257 else
32258 sb->resync_offset = cpu_to_le64(0);
32259
32260- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
32261+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
32262
32263 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
32264 sb->size = cpu_to_le64(mddev->dev_sectors);
32265@@ -2414,7 +2414,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
32266 static ssize_t
32267 errors_show(mdk_rdev_t *rdev, char *page)
32268 {
32269- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
32270+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
32271 }
32272
32273 static ssize_t
32274@@ -2423,7 +2423,7 @@ errors_store(mdk_rdev_t *rdev, const cha
32275 char *e;
32276 unsigned long n = simple_strtoul(buf, &e, 10);
32277 if (*buf && (*e == 0 || *e == '\n')) {
32278- atomic_set(&rdev->corrected_errors, n);
32279+ atomic_set_unchecked(&rdev->corrected_errors, n);
32280 return len;
32281 }
32282 return -EINVAL;
32283@@ -2779,8 +2779,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
32284 rdev->last_read_error.tv_sec = 0;
32285 rdev->last_read_error.tv_nsec = 0;
32286 atomic_set(&rdev->nr_pending, 0);
32287- atomic_set(&rdev->read_errors, 0);
32288- atomic_set(&rdev->corrected_errors, 0);
32289+ atomic_set_unchecked(&rdev->read_errors, 0);
32290+ atomic_set_unchecked(&rdev->corrected_errors, 0);
32291
32292 INIT_LIST_HEAD(&rdev->same_set);
32293 init_waitqueue_head(&rdev->blocked_wait);
32294@@ -6388,7 +6388,7 @@ static int md_seq_show(struct seq_file *
32295
32296 spin_unlock(&pers_lock);
32297 seq_printf(seq, "\n");
32298- mi->event = atomic_read(&md_event_count);
32299+ mi->event = atomic_read_unchecked(&md_event_count);
32300 return 0;
32301 }
32302 if (v == (void*)2) {
32303@@ -6477,7 +6477,7 @@ static int md_seq_show(struct seq_file *
32304 chunk_kb ? "KB" : "B");
32305 if (bitmap->file) {
32306 seq_printf(seq, ", file: ");
32307- seq_path(seq, &bitmap->file->f_path, " \t\n");
32308+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
32309 }
32310
32311 seq_printf(seq, "\n");
32312@@ -6511,7 +6511,7 @@ static int md_seq_open(struct inode *ino
32313 else {
32314 struct seq_file *p = file->private_data;
32315 p->private = mi;
32316- mi->event = atomic_read(&md_event_count);
32317+ mi->event = atomic_read_unchecked(&md_event_count);
32318 }
32319 return error;
32320 }
32321@@ -6527,7 +6527,7 @@ static unsigned int mdstat_poll(struct f
32322 /* always allow read */
32323 mask = POLLIN | POLLRDNORM;
32324
32325- if (mi->event != atomic_read(&md_event_count))
32326+ if (mi->event != atomic_read_unchecked(&md_event_count))
32327 mask |= POLLERR | POLLPRI;
32328 return mask;
32329 }
32330@@ -6571,7 +6571,7 @@ static int is_mddev_idle(mddev_t *mddev,
32331 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
32332 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
32333 (int)part_stat_read(&disk->part0, sectors[1]) -
32334- atomic_read(&disk->sync_io);
32335+ atomic_read_unchecked(&disk->sync_io);
32336 /* sync IO will cause sync_io to increase before the disk_stats
32337 * as sync_io is counted when a request starts, and
32338 * disk_stats is counted when it completes.
32339diff -urNp linux-2.6.39.2/drivers/md/md.h linux-2.6.39.2/drivers/md/md.h
32340--- linux-2.6.39.2/drivers/md/md.h 2011-05-19 00:06:34.000000000 -0400
32341+++ linux-2.6.39.2/drivers/md/md.h 2011-05-22 19:36:31.000000000 -0400
32342@@ -97,13 +97,13 @@ struct mdk_rdev_s
32343 * only maintained for arrays that
32344 * support hot removal
32345 */
32346- atomic_t read_errors; /* number of consecutive read errors that
32347+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
32348 * we have tried to ignore.
32349 */
32350 struct timespec last_read_error; /* monotonic time since our
32351 * last read error
32352 */
32353- atomic_t corrected_errors; /* number of corrected read errors,
32354+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
32355 * for reporting to userspace and storing
32356 * in superblock.
32357 */
32358@@ -342,7 +342,7 @@ static inline void rdev_dec_pending(mdk_
32359
32360 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
32361 {
32362- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32363+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32364 }
32365
32366 struct mdk_personality
32367diff -urNp linux-2.6.39.2/drivers/md/raid10.c linux-2.6.39.2/drivers/md/raid10.c
32368--- linux-2.6.39.2/drivers/md/raid10.c 2011-05-19 00:06:34.000000000 -0400
32369+++ linux-2.6.39.2/drivers/md/raid10.c 2011-05-22 19:36:31.000000000 -0400
32370@@ -1209,7 +1209,7 @@ static void end_sync_read(struct bio *bi
32371 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
32372 set_bit(R10BIO_Uptodate, &r10_bio->state);
32373 else {
32374- atomic_add(r10_bio->sectors,
32375+ atomic_add_unchecked(r10_bio->sectors,
32376 &conf->mirrors[d].rdev->corrected_errors);
32377 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
32378 md_error(r10_bio->mddev,
32379@@ -1417,7 +1417,7 @@ static void check_decay_read_errors(mdde
32380 {
32381 struct timespec cur_time_mon;
32382 unsigned long hours_since_last;
32383- unsigned int read_errors = atomic_read(&rdev->read_errors);
32384+ unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
32385
32386 ktime_get_ts(&cur_time_mon);
32387
32388@@ -1439,9 +1439,9 @@ static void check_decay_read_errors(mdde
32389 * overflowing the shift of read_errors by hours_since_last.
32390 */
32391 if (hours_since_last >= 8 * sizeof(read_errors))
32392- atomic_set(&rdev->read_errors, 0);
32393+ atomic_set_unchecked(&rdev->read_errors, 0);
32394 else
32395- atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
32396+ atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
32397 }
32398
32399 /*
32400@@ -1476,8 +1476,8 @@ static void fix_read_error(conf_t *conf,
32401 }
32402
32403 check_decay_read_errors(mddev, rdev);
32404- atomic_inc(&rdev->read_errors);
32405- cur_read_error_count = atomic_read(&rdev->read_errors);
32406+ atomic_inc_unchecked(&rdev->read_errors);
32407+ cur_read_error_count = atomic_read_unchecked(&rdev->read_errors);
32408 if (cur_read_error_count > max_read_errors) {
32409 rcu_read_unlock();
32410 printk(KERN_NOTICE
32411@@ -1550,7 +1550,7 @@ static void fix_read_error(conf_t *conf,
32412 test_bit(In_sync, &rdev->flags)) {
32413 atomic_inc(&rdev->nr_pending);
32414 rcu_read_unlock();
32415- atomic_add(s, &rdev->corrected_errors);
32416+ atomic_add_unchecked(s, &rdev->corrected_errors);
32417 if (sync_page_io(rdev,
32418 r10_bio->devs[sl].addr +
32419 sect,
32420diff -urNp linux-2.6.39.2/drivers/md/raid1.c linux-2.6.39.2/drivers/md/raid1.c
32421--- linux-2.6.39.2/drivers/md/raid1.c 2011-05-19 00:06:34.000000000 -0400
32422+++ linux-2.6.39.2/drivers/md/raid1.c 2011-05-22 19:36:31.000000000 -0400
32423@@ -1342,7 +1342,7 @@ static void sync_request_write(mddev_t *
32424 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
32425 continue;
32426 rdev = conf->mirrors[d].rdev;
32427- atomic_add(s, &rdev->corrected_errors);
32428+ atomic_add_unchecked(s, &rdev->corrected_errors);
32429 if (sync_page_io(rdev,
32430 sect,
32431 s<<9,
32432@@ -1488,7 +1488,7 @@ static void fix_read_error(conf_t *conf,
32433 /* Well, this device is dead */
32434 md_error(mddev, rdev);
32435 else {
32436- atomic_add(s, &rdev->corrected_errors);
32437+ atomic_add_unchecked(s, &rdev->corrected_errors);
32438 printk(KERN_INFO
32439 "md/raid1:%s: read error corrected "
32440 "(%d sectors at %llu on %s)\n",
32441diff -urNp linux-2.6.39.2/drivers/md/raid5.c linux-2.6.39.2/drivers/md/raid5.c
32442--- linux-2.6.39.2/drivers/md/raid5.c 2011-06-25 12:55:22.000000000 -0400
32443+++ linux-2.6.39.2/drivers/md/raid5.c 2011-06-25 13:01:13.000000000 -0400
32444@@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea
32445 bi->bi_next = NULL;
32446 if ((rw & WRITE) &&
32447 test_bit(R5_ReWrite, &sh->dev[i].flags))
32448- atomic_add(STRIPE_SECTORS,
32449+ atomic_add_unchecked(STRIPE_SECTORS,
32450 &rdev->corrected_errors);
32451 generic_make_request(bi);
32452 } else {
32453@@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc
32454 clear_bit(R5_ReadError, &sh->dev[i].flags);
32455 clear_bit(R5_ReWrite, &sh->dev[i].flags);
32456 }
32457- if (atomic_read(&conf->disks[i].rdev->read_errors))
32458- atomic_set(&conf->disks[i].rdev->read_errors, 0);
32459+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
32460+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
32461 } else {
32462 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
32463 int retry = 0;
32464 rdev = conf->disks[i].rdev;
32465
32466 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
32467- atomic_inc(&rdev->read_errors);
32468+ atomic_inc_unchecked(&rdev->read_errors);
32469 if (conf->mddev->degraded >= conf->max_degraded)
32470 printk_rl(KERN_WARNING
32471 "md/raid:%s: read error not correctable "
32472@@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc
32473 (unsigned long long)(sh->sector
32474 + rdev->data_offset),
32475 bdn);
32476- else if (atomic_read(&rdev->read_errors)
32477+ else if (atomic_read_unchecked(&rdev->read_errors)
32478 > conf->max_nr_stripes)
32479 printk(KERN_WARNING
32480 "md/raid:%s: Too many read errors, failing device %s.\n",
32481@@ -1947,6 +1947,7 @@ static sector_t compute_blocknr(struct s
32482 sector_t r_sector;
32483 struct stripe_head sh2;
32484
32485+ pax_track_stack();
32486
32487 chunk_offset = sector_div(new_sector, sectors_per_chunk);
32488 stripe = new_sector;
32489diff -urNp linux-2.6.39.2/drivers/media/common/saa7146_hlp.c linux-2.6.39.2/drivers/media/common/saa7146_hlp.c
32490--- linux-2.6.39.2/drivers/media/common/saa7146_hlp.c 2011-05-19 00:06:34.000000000 -0400
32491+++ linux-2.6.39.2/drivers/media/common/saa7146_hlp.c 2011-05-22 19:36:31.000000000 -0400
32492@@ -353,6 +353,8 @@ static void calculate_clipping_registers
32493
32494 int x[32], y[32], w[32], h[32];
32495
32496+ pax_track_stack();
32497+
32498 /* clear out memory */
32499 memset(&line_list[0], 0x00, sizeof(u32)*32);
32500 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
32501diff -urNp linux-2.6.39.2/drivers/media/common/saa7146_vbi.c linux-2.6.39.2/drivers/media/common/saa7146_vbi.c
32502--- linux-2.6.39.2/drivers/media/common/saa7146_vbi.c 2011-05-19 00:06:34.000000000 -0400
32503+++ linux-2.6.39.2/drivers/media/common/saa7146_vbi.c 2011-05-22 19:36:31.000000000 -0400
32504@@ -501,7 +501,7 @@ static ssize_t vbi_read(struct file *fil
32505 return ret;
32506 }
32507
32508-struct saa7146_use_ops saa7146_vbi_uops = {
32509+const struct saa7146_use_ops saa7146_vbi_uops = {
32510 .init = vbi_init,
32511 .open = vbi_open,
32512 .release = vbi_close,
32513diff -urNp linux-2.6.39.2/drivers/media/common/saa7146_video.c linux-2.6.39.2/drivers/media/common/saa7146_video.c
32514--- linux-2.6.39.2/drivers/media/common/saa7146_video.c 2011-05-19 00:06:34.000000000 -0400
32515+++ linux-2.6.39.2/drivers/media/common/saa7146_video.c 2011-05-22 19:36:31.000000000 -0400
32516@@ -1420,7 +1420,7 @@ out:
32517 return ret;
32518 }
32519
32520-struct saa7146_use_ops saa7146_video_uops = {
32521+const struct saa7146_use_ops saa7146_video_uops = {
32522 .init = video_init,
32523 .open = video_open,
32524 .release = video_close,
32525diff -urNp linux-2.6.39.2/drivers/media/dvb/dm1105/dm1105.c linux-2.6.39.2/drivers/media/dvb/dm1105/dm1105.c
32526--- linux-2.6.39.2/drivers/media/dvb/dm1105/dm1105.c 2011-05-19 00:06:34.000000000 -0400
32527+++ linux-2.6.39.2/drivers/media/dvb/dm1105/dm1105.c 2011-05-22 19:36:31.000000000 -0400
32528@@ -418,7 +418,7 @@ static u32 functionality(struct i2c_adap
32529 return I2C_FUNC_I2C;
32530 }
32531
32532-static struct i2c_algorithm dm1105_algo = {
32533+static const struct i2c_algorithm dm1105_algo = {
32534 .master_xfer = dm1105_i2c_xfer,
32535 .functionality = functionality,
32536 };
32537diff -urNp linux-2.6.39.2/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.39.2/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
32538--- linux-2.6.39.2/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-19 00:06:34.000000000 -0400
32539+++ linux-2.6.39.2/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-22 19:36:31.000000000 -0400
32540@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
32541 u8 buf[HOST_LINK_BUF_SIZE];
32542 int i;
32543
32544+ pax_track_stack();
32545+
32546 dprintk("%s\n", __func__);
32547
32548 /* check if we have space for a link buf in the rx_buffer */
32549@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
32550 unsigned long timeout;
32551 int written;
32552
32553+ pax_track_stack();
32554+
32555 dprintk("%s\n", __func__);
32556
32557 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
32558diff -urNp linux-2.6.39.2/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.39.2/drivers/media/dvb/dvb-core/dvbdev.c
32559--- linux-2.6.39.2/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-19 00:06:34.000000000 -0400
32560+++ linux-2.6.39.2/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-22 19:36:31.000000000 -0400
32561@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
32562 const struct dvb_device *template, void *priv, int type)
32563 {
32564 struct dvb_device *dvbdev;
32565- struct file_operations *dvbdevfops;
32566+ struct file_operations *dvbdevfops; /* cannot be const, see this function */
32567 struct device *clsdev;
32568 int minor;
32569 int id;
32570diff -urNp linux-2.6.39.2/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.39.2/drivers/media/dvb/dvb-usb/dib0700_core.c
32571--- linux-2.6.39.2/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-19 00:06:34.000000000 -0400
32572+++ linux-2.6.39.2/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-22 19:36:31.000000000 -0400
32573@@ -391,6 +391,8 @@ int dib0700_download_firmware(struct usb
32574
32575 u8 buf[260];
32576
32577+ pax_track_stack();
32578+
32579 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
32580 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
32581 hx.addr, hx.len, hx.chk);
32582diff -urNp linux-2.6.39.2/drivers/media/dvb/dvb-usb/lmedm04.c linux-2.6.39.2/drivers/media/dvb/dvb-usb/lmedm04.c
32583--- linux-2.6.39.2/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-19 00:06:34.000000000 -0400
32584+++ linux-2.6.39.2/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-22 19:36:31.000000000 -0400
32585@@ -663,6 +663,7 @@ static int lme2510_download_firmware(str
32586 packet_size = 0x31;
32587 len_in = 1;
32588
32589+ pax_track_stack();
32590
32591 info("FRM Starting Firmware Download");
32592
32593@@ -715,6 +716,8 @@ static void lme_coldreset(struct usb_dev
32594 int ret = 0, len_in;
32595 u8 data[512] = {0};
32596
32597+ pax_track_stack();
32598+
32599 data[0] = 0x0a;
32600 len_in = 1;
32601 info("FRM Firmware Cold Reset");
32602diff -urNp linux-2.6.39.2/drivers/media/dvb/frontends/dib7000p.c linux-2.6.39.2/drivers/media/dvb/frontends/dib7000p.c
32603--- linux-2.6.39.2/drivers/media/dvb/frontends/dib7000p.c 2011-06-03 00:04:14.000000000 -0400
32604+++ linux-2.6.39.2/drivers/media/dvb/frontends/dib7000p.c 2011-06-03 00:32:05.000000000 -0400
32605@@ -1945,7 +1945,7 @@ static u32 dib7000p_i2c_func(struct i2c_
32606 return I2C_FUNC_I2C;
32607 }
32608
32609-static struct i2c_algorithm dib7090_tuner_xfer_algo = {
32610+static const struct i2c_algorithm dib7090_tuner_xfer_algo = {
32611 .master_xfer = dib7090_tuner_xfer,
32612 .functionality = dib7000p_i2c_func,
32613 };
32614diff -urNp linux-2.6.39.2/drivers/media/dvb/frontends/dib9000.c linux-2.6.39.2/drivers/media/dvb/frontends/dib9000.c
32615--- linux-2.6.39.2/drivers/media/dvb/frontends/dib9000.c 2011-06-03 00:04:14.000000000 -0400
32616+++ linux-2.6.39.2/drivers/media/dvb/frontends/dib9000.c 2011-06-03 00:32:05.000000000 -0400
32617@@ -1676,12 +1676,12 @@ static u32 dib9000_i2c_func(struct i2c_a
32618 return I2C_FUNC_I2C;
32619 }
32620
32621-static struct i2c_algorithm dib9000_tuner_algo = {
32622+static const struct i2c_algorithm dib9000_tuner_algo = {
32623 .master_xfer = dib9000_tuner_xfer,
32624 .functionality = dib9000_i2c_func,
32625 };
32626
32627-static struct i2c_algorithm dib9000_component_bus_algo = {
32628+static const struct i2c_algorithm dib9000_component_bus_algo = {
32629 .master_xfer = dib9000_fw_component_bus_xfer,
32630 .functionality = dib9000_i2c_func,
32631 };
32632diff -urNp linux-2.6.39.2/drivers/media/dvb/frontends/dibx000_common.c linux-2.6.39.2/drivers/media/dvb/frontends/dibx000_common.c
32633--- linux-2.6.39.2/drivers/media/dvb/frontends/dibx000_common.c 2011-06-03 00:04:14.000000000 -0400
32634+++ linux-2.6.39.2/drivers/media/dvb/frontends/dibx000_common.c 2011-06-03 00:37:36.000000000 -0400
32635@@ -221,12 +221,12 @@ static int dibx000_i2c_master_xfer_gpio3
32636 return num;
32637 }
32638
32639-static struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32640+static const struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32641 .master_xfer = dibx000_i2c_master_xfer_gpio12,
32642 .functionality = dibx000_i2c_func,
32643 };
32644
32645-static struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32646+static const struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32647 .master_xfer = dibx000_i2c_master_xfer_gpio34,
32648 .functionality = dibx000_i2c_func,
32649 };
32650@@ -285,7 +285,7 @@ static int dibx000_i2c_gated_gpio67_xfer
32651 return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO;
32652 }
32653
32654-static struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32655+static const struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32656 .master_xfer = dibx000_i2c_gated_gpio67_xfer,
32657 .functionality = dibx000_i2c_func,
32658 };
32659@@ -322,7 +322,7 @@ static int dibx000_i2c_gated_tuner_xfer(
32660 return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO;
32661 }
32662
32663-static struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32664+static const struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32665 .master_xfer = dibx000_i2c_gated_tuner_xfer,
32666 .functionality = dibx000_i2c_func,
32667 };
32668@@ -375,7 +375,7 @@ void dibx000_reset_i2c_master(struct dib
32669 EXPORT_SYMBOL(dibx000_reset_i2c_master);
32670
32671 static int i2c_adapter_init(struct i2c_adapter *i2c_adap,
32672- struct i2c_algorithm *algo, const char *name,
32673+ const struct i2c_algorithm *algo, const char *name,
32674 struct dibx000_i2c_master *mst)
32675 {
32676 strncpy(i2c_adap->name, name, sizeof(i2c_adap->name));
32677diff -urNp linux-2.6.39.2/drivers/media/dvb/frontends/mb86a16.c linux-2.6.39.2/drivers/media/dvb/frontends/mb86a16.c
32678--- linux-2.6.39.2/drivers/media/dvb/frontends/mb86a16.c 2011-05-19 00:06:34.000000000 -0400
32679+++ linux-2.6.39.2/drivers/media/dvb/frontends/mb86a16.c 2011-05-22 19:36:31.000000000 -0400
32680@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
32681 int ret = -1;
32682 int sync;
32683
32684+ pax_track_stack();
32685+
32686 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
32687
32688 fcp = 3000;
32689diff -urNp linux-2.6.39.2/drivers/media/dvb/frontends/or51211.c linux-2.6.39.2/drivers/media/dvb/frontends/or51211.c
32690--- linux-2.6.39.2/drivers/media/dvb/frontends/or51211.c 2011-05-19 00:06:34.000000000 -0400
32691+++ linux-2.6.39.2/drivers/media/dvb/frontends/or51211.c 2011-05-22 19:36:31.000000000 -0400
32692@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
32693 u8 tudata[585];
32694 int i;
32695
32696+ pax_track_stack();
32697+
32698 dprintk("Firmware is %zd bytes\n",fw->size);
32699
32700 /* Get eprom data */
32701diff -urNp linux-2.6.39.2/drivers/media/dvb/frontends/s5h1420.c linux-2.6.39.2/drivers/media/dvb/frontends/s5h1420.c
32702--- linux-2.6.39.2/drivers/media/dvb/frontends/s5h1420.c 2011-05-19 00:06:34.000000000 -0400
32703+++ linux-2.6.39.2/drivers/media/dvb/frontends/s5h1420.c 2011-05-22 19:36:31.000000000 -0400
32704@@ -870,7 +870,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(
32705 return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
32706 }
32707
32708-static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32709+static const struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32710 .master_xfer = s5h1420_tuner_i2c_tuner_xfer,
32711 .functionality = s5h1420_tuner_i2c_func,
32712 };
32713diff -urNp linux-2.6.39.2/drivers/media/dvb/mantis/mantis_i2c.c linux-2.6.39.2/drivers/media/dvb/mantis/mantis_i2c.c
32714--- linux-2.6.39.2/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-19 00:06:34.000000000 -0400
32715+++ linux-2.6.39.2/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-22 19:36:31.000000000 -0400
32716@@ -212,7 +212,7 @@ static u32 mantis_i2c_func(struct i2c_ad
32717 return I2C_FUNC_SMBUS_EMUL;
32718 }
32719
32720-static struct i2c_algorithm mantis_algo = {
32721+static const struct i2c_algorithm mantis_algo = {
32722 .master_xfer = mantis_i2c_xfer,
32723 .functionality = mantis_i2c_func,
32724 };
32725diff -urNp linux-2.6.39.2/drivers/media/dvb/ttusb-dec/ttusb_dec.c linux-2.6.39.2/drivers/media/dvb/ttusb-dec/ttusb_dec.c
32726--- linux-2.6.39.2/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-19 00:06:34.000000000 -0400
32727+++ linux-2.6.39.2/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-22 19:36:31.000000000 -0400
32728@@ -1614,7 +1614,7 @@ static int fe_send_command(struct dvb_fr
32729 return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
32730 }
32731
32732-static struct ttusbdecfe_config fe_config = {
32733+static const struct ttusbdecfe_config fe_config = {
32734 .send_command = fe_send_command
32735 };
32736
32737diff -urNp linux-2.6.39.2/drivers/media/radio/radio-cadet.c linux-2.6.39.2/drivers/media/radio/radio-cadet.c
32738--- linux-2.6.39.2/drivers/media/radio/radio-cadet.c 2011-05-19 00:06:34.000000000 -0400
32739+++ linux-2.6.39.2/drivers/media/radio/radio-cadet.c 2011-05-22 19:36:31.000000000 -0400
32740@@ -349,7 +349,7 @@ static ssize_t cadet_read(struct file *f
32741 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
32742 mutex_unlock(&dev->lock);
32743
32744- if (copy_to_user(data, readbuf, i))
32745+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
32746 return -EFAULT;
32747 return i;
32748 }
32749diff -urNp linux-2.6.39.2/drivers/media/radio/radio-si4713.c linux-2.6.39.2/drivers/media/radio/radio-si4713.c
32750--- linux-2.6.39.2/drivers/media/radio/radio-si4713.c 2011-05-19 00:06:34.000000000 -0400
32751+++ linux-2.6.39.2/drivers/media/radio/radio-si4713.c 2011-05-22 19:36:31.000000000 -0400
32752@@ -231,7 +231,7 @@ static long radio_si4713_default(struct
32753 ioctl, cmd, arg);
32754 }
32755
32756-static struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32757+static const struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32758 .vidioc_enumaudout = radio_si4713_enumaudout,
32759 .vidioc_g_audout = radio_si4713_g_audout,
32760 .vidioc_s_audout = radio_si4713_s_audout,
32761diff -urNp linux-2.6.39.2/drivers/media/rc/ir-lirc-codec.c linux-2.6.39.2/drivers/media/rc/ir-lirc-codec.c
32762--- linux-2.6.39.2/drivers/media/rc/ir-lirc-codec.c 2011-05-19 00:06:34.000000000 -0400
32763+++ linux-2.6.39.2/drivers/media/rc/ir-lirc-codec.c 2011-05-22 19:36:31.000000000 -0400
32764@@ -277,7 +277,7 @@ static void ir_lirc_close(void *data)
32765 return;
32766 }
32767
32768-static struct file_operations lirc_fops = {
32769+static const struct file_operations lirc_fops = {
32770 .owner = THIS_MODULE,
32771 .write = ir_lirc_transmit_ir,
32772 .unlocked_ioctl = ir_lirc_ioctl,
32773diff -urNp linux-2.6.39.2/drivers/media/rc/lirc_dev.c linux-2.6.39.2/drivers/media/rc/lirc_dev.c
32774--- linux-2.6.39.2/drivers/media/rc/lirc_dev.c 2011-05-19 00:06:34.000000000 -0400
32775+++ linux-2.6.39.2/drivers/media/rc/lirc_dev.c 2011-05-22 19:36:31.000000000 -0400
32776@@ -151,7 +151,7 @@ static int lirc_thread(void *irctl)
32777 }
32778
32779
32780-static struct file_operations lirc_dev_fops = {
32781+static const struct file_operations lirc_dev_fops = {
32782 .owner = THIS_MODULE,
32783 .read = lirc_dev_fop_read,
32784 .write = lirc_dev_fop_write,
32785diff -urNp linux-2.6.39.2/drivers/media/rc/rc-main.c linux-2.6.39.2/drivers/media/rc/rc-main.c
32786--- linux-2.6.39.2/drivers/media/rc/rc-main.c 2011-05-19 00:06:34.000000000 -0400
32787+++ linux-2.6.39.2/drivers/media/rc/rc-main.c 2011-05-22 19:36:31.000000000 -0400
32788@@ -996,7 +996,7 @@ EXPORT_SYMBOL_GPL(rc_free_device);
32789
32790 int rc_register_device(struct rc_dev *dev)
32791 {
32792- static atomic_t devno = ATOMIC_INIT(0);
32793+ static atomic_unchecked_t devno = ATOMIC_INIT(0);
32794 struct rc_map *rc_map;
32795 const char *path;
32796 int rc;
32797@@ -1019,7 +1019,7 @@ int rc_register_device(struct rc_dev *de
32798 if (dev->close)
32799 dev->input_dev->close = ir_close;
32800
32801- dev->devno = (unsigned long)(atomic_inc_return(&devno) - 1);
32802+ dev->devno = (unsigned long)(atomic_inc_return_unchecked(&devno) - 1);
32803 dev_set_name(&dev->dev, "rc%ld", dev->devno);
32804 dev_set_drvdata(&dev->dev, dev);
32805 rc = device_add(&dev->dev);
32806diff -urNp linux-2.6.39.2/drivers/media/video/cafe_ccic.c linux-2.6.39.2/drivers/media/video/cafe_ccic.c
32807--- linux-2.6.39.2/drivers/media/video/cafe_ccic.c 2011-05-19 00:06:34.000000000 -0400
32808+++ linux-2.6.39.2/drivers/media/video/cafe_ccic.c 2011-05-22 19:36:31.000000000 -0400
32809@@ -520,7 +520,7 @@ static u32 cafe_smbus_func(struct i2c_ad
32810 I2C_FUNC_SMBUS_WRITE_BYTE_DATA;
32811 }
32812
32813-static struct i2c_algorithm cafe_smbus_algo = {
32814+static const struct i2c_algorithm cafe_smbus_algo = {
32815 .smbus_xfer = cafe_smbus_xfer,
32816 .functionality = cafe_smbus_func
32817 };
32818diff -urNp linux-2.6.39.2/drivers/media/video/cx18/cx18-alsa-pcm.c linux-2.6.39.2/drivers/media/video/cx18/cx18-alsa-pcm.c
32819--- linux-2.6.39.2/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-19 00:06:34.000000000 -0400
32820+++ linux-2.6.39.2/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-22 19:36:31.000000000 -0400
32821@@ -314,7 +314,7 @@ static struct page *snd_pcm_get_vmalloc_
32822 return vmalloc_to_page(pageptr);
32823 }
32824
32825-static struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32826+static const struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32827 .open = snd_cx18_pcm_capture_open,
32828 .close = snd_cx18_pcm_capture_close,
32829 .ioctl = snd_cx18_pcm_ioctl,
32830diff -urNp linux-2.6.39.2/drivers/media/video/cx18/cx18-driver.c linux-2.6.39.2/drivers/media/video/cx18/cx18-driver.c
32831--- linux-2.6.39.2/drivers/media/video/cx18/cx18-driver.c 2011-05-19 00:06:34.000000000 -0400
32832+++ linux-2.6.39.2/drivers/media/video/cx18/cx18-driver.c 2011-05-22 19:36:31.000000000 -0400
32833@@ -61,7 +61,7 @@ static struct pci_device_id cx18_pci_tbl
32834
32835 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
32836
32837-static atomic_t cx18_instance = ATOMIC_INIT(0);
32838+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
32839
32840 /* Parameter declarations */
32841 static int cardtype[CX18_MAX_CARDS];
32842@@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
32843 struct i2c_client c;
32844 u8 eedata[256];
32845
32846+ pax_track_stack();
32847+
32848 memset(&c, 0, sizeof(c));
32849 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
32850 c.adapter = &cx->i2c_adap[0];
32851@@ -892,7 +894,7 @@ static int __devinit cx18_probe(struct p
32852 struct cx18 *cx;
32853
32854 /* FIXME - module parameter arrays constrain max instances */
32855- i = atomic_inc_return(&cx18_instance) - 1;
32856+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
32857 if (i >= CX18_MAX_CARDS) {
32858 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
32859 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
32860diff -urNp linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-audio.c linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-audio.c
32861--- linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32862+++ linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32863@@ -613,7 +613,7 @@ static struct page *snd_pcm_get_vmalloc_
32864 return vmalloc_to_page(pageptr);
32865 }
32866
32867-static struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32868+static const struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32869 .open = snd_cx231xx_capture_open,
32870 .close = snd_cx231xx_pcm_close,
32871 .ioctl = snd_pcm_lib_ioctl,
32872diff -urNp linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-i2c.c linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-i2c.c
32873--- linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32874+++ linux-2.6.39.2/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32875@@ -435,7 +435,7 @@ static u32 functionality(struct i2c_adap
32876 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32877 }
32878
32879-static struct i2c_algorithm cx231xx_algo = {
32880+static const struct i2c_algorithm cx231xx_algo = {
32881 .master_xfer = cx231xx_i2c_xfer,
32882 .functionality = functionality,
32883 };
32884diff -urNp linux-2.6.39.2/drivers/media/video/cx23885/cx23885-input.c linux-2.6.39.2/drivers/media/video/cx23885/cx23885-input.c
32885--- linux-2.6.39.2/drivers/media/video/cx23885/cx23885-input.c 2011-05-19 00:06:34.000000000 -0400
32886+++ linux-2.6.39.2/drivers/media/video/cx23885/cx23885-input.c 2011-05-22 19:36:31.000000000 -0400
32887@@ -53,6 +53,8 @@ static void cx23885_input_process_measur
32888 bool handle = false;
32889 struct ir_raw_event ir_core_event[64];
32890
32891+ pax_track_stack();
32892+
32893 do {
32894 num = 0;
32895 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
32896diff -urNp linux-2.6.39.2/drivers/media/video/cx88/cx88-alsa.c linux-2.6.39.2/drivers/media/video/cx88/cx88-alsa.c
32897--- linux-2.6.39.2/drivers/media/video/cx88/cx88-alsa.c 2011-05-19 00:06:34.000000000 -0400
32898+++ linux-2.6.39.2/drivers/media/video/cx88/cx88-alsa.c 2011-05-22 19:36:31.000000000 -0400
32899@@ -519,7 +519,7 @@ static struct page *snd_cx88_page(struct
32900 /*
32901 * operators
32902 */
32903-static struct snd_pcm_ops snd_cx88_pcm_ops = {
32904+static const struct snd_pcm_ops snd_cx88_pcm_ops = {
32905 .open = snd_cx88_pcm_open,
32906 .close = snd_cx88_close,
32907 .ioctl = snd_pcm_lib_ioctl,
32908diff -urNp linux-2.6.39.2/drivers/media/video/davinci/ccdc_hw_device.h linux-2.6.39.2/drivers/media/video/davinci/ccdc_hw_device.h
32909--- linux-2.6.39.2/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-19 00:06:34.000000000 -0400
32910+++ linux-2.6.39.2/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-22 19:36:31.000000000 -0400
32911@@ -99,7 +99,7 @@ struct ccdc_hw_device {
32912 /* module owner */
32913 struct module *owner;
32914 /* hw ops */
32915- struct ccdc_hw_ops hw_ops;
32916+ const struct ccdc_hw_ops hw_ops;
32917 };
32918
32919 /* Used by CCDC module to register & unregister with vpfe capture driver */
32920diff -urNp linux-2.6.39.2/drivers/media/video/davinci/vpss.c linux-2.6.39.2/drivers/media/video/davinci/vpss.c
32921--- linux-2.6.39.2/drivers/media/video/davinci/vpss.c 2011-05-19 00:06:34.000000000 -0400
32922+++ linux-2.6.39.2/drivers/media/video/davinci/vpss.c 2011-05-22 19:36:31.000000000 -0400
32923@@ -103,7 +103,7 @@ struct vpss_oper_config {
32924 __iomem void *vpss_regs_base1;
32925 enum vpss_platform_type platform;
32926 spinlock_t vpss_lock;
32927- struct vpss_hw_ops hw_ops;
32928+ const struct vpss_hw_ops hw_ops;
32929 };
32930
32931 static struct vpss_oper_config oper_cfg;
32932diff -urNp linux-2.6.39.2/drivers/media/video/em28xx/em28xx-audio.c linux-2.6.39.2/drivers/media/video/em28xx/em28xx-audio.c
32933--- linux-2.6.39.2/drivers/media/video/em28xx/em28xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32934+++ linux-2.6.39.2/drivers/media/video/em28xx/em28xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32935@@ -432,7 +432,7 @@ static struct page *snd_pcm_get_vmalloc_
32936 return vmalloc_to_page(pageptr);
32937 }
32938
32939-static struct snd_pcm_ops snd_em28xx_pcm_capture = {
32940+static const struct snd_pcm_ops snd_em28xx_pcm_capture = {
32941 .open = snd_em28xx_capture_open,
32942 .close = snd_em28xx_pcm_close,
32943 .ioctl = snd_pcm_lib_ioctl,
32944diff -urNp linux-2.6.39.2/drivers/media/video/em28xx/em28xx-i2c.c linux-2.6.39.2/drivers/media/video/em28xx/em28xx-i2c.c
32945--- linux-2.6.39.2/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32946+++ linux-2.6.39.2/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32947@@ -451,7 +451,7 @@ static u32 functionality(struct i2c_adap
32948 return I2C_FUNC_SMBUS_EMUL;
32949 }
32950
32951-static struct i2c_algorithm em28xx_algo = {
32952+static const struct i2c_algorithm em28xx_algo = {
32953 .master_xfer = em28xx_i2c_xfer,
32954 .functionality = functionality,
32955 };
32956diff -urNp linux-2.6.39.2/drivers/media/video/hdpvr/hdpvr-i2c.c linux-2.6.39.2/drivers/media/video/hdpvr/hdpvr-i2c.c
32957--- linux-2.6.39.2/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-19 00:06:34.000000000 -0400
32958+++ linux-2.6.39.2/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-22 19:36:31.000000000 -0400
32959@@ -179,7 +179,7 @@ static u32 hdpvr_functionality(struct i2
32960 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
32961 }
32962
32963-static struct i2c_algorithm hdpvr_algo = {
32964+static const struct i2c_algorithm hdpvr_algo = {
32965 .master_xfer = hdpvr_transfer,
32966 .functionality = hdpvr_functionality,
32967 };
32968diff -urNp linux-2.6.39.2/drivers/media/video/imx074.c linux-2.6.39.2/drivers/media/video/imx074.c
32969--- linux-2.6.39.2/drivers/media/video/imx074.c 2011-05-19 00:06:34.000000000 -0400
32970+++ linux-2.6.39.2/drivers/media/video/imx074.c 2011-05-22 19:36:31.000000000 -0400
32971@@ -267,7 +267,7 @@ static int imx074_g_chip_ident(struct v4
32972 return 0;
32973 }
32974
32975-static struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32976+static const struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32977 .s_stream = imx074_s_stream,
32978 .s_mbus_fmt = imx074_s_fmt,
32979 .g_mbus_fmt = imx074_g_fmt,
32980@@ -277,7 +277,7 @@ static struct v4l2_subdev_video_ops imx0
32981 .cropcap = imx074_cropcap,
32982 };
32983
32984-static struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32985+static const struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32986 .g_chip_ident = imx074_g_chip_ident,
32987 };
32988
32989diff -urNp linux-2.6.39.2/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.39.2/drivers/media/video/ivtv/ivtv-driver.c
32990--- linux-2.6.39.2/drivers/media/video/ivtv/ivtv-driver.c 2011-05-19 00:06:34.000000000 -0400
32991+++ linux-2.6.39.2/drivers/media/video/ivtv/ivtv-driver.c 2011-05-22 19:36:31.000000000 -0400
32992@@ -80,7 +80,7 @@ static struct pci_device_id ivtv_pci_tbl
32993 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
32994
32995 /* ivtv instance counter */
32996-static atomic_t ivtv_instance = ATOMIC_INIT(0);
32997+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
32998
32999 /* Parameter declarations */
33000 static int cardtype[IVTV_MAX_CARDS];
33001diff -urNp linux-2.6.39.2/drivers/media/video/mt9m001.c linux-2.6.39.2/drivers/media/video/mt9m001.c
33002--- linux-2.6.39.2/drivers/media/video/mt9m001.c 2011-05-19 00:06:34.000000000 -0400
33003+++ linux-2.6.39.2/drivers/media/video/mt9m001.c 2011-05-22 19:36:31.000000000 -0400
33004@@ -691,7 +691,7 @@ static int mt9m001_g_skip_top_lines(stru
33005 return 0;
33006 }
33007
33008-static struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
33009+static const struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
33010 .g_ctrl = mt9m001_g_ctrl,
33011 .s_ctrl = mt9m001_s_ctrl,
33012 .g_chip_ident = mt9m001_g_chip_ident,
33013@@ -714,7 +714,7 @@ static int mt9m001_enum_fmt(struct v4l2_
33014 return 0;
33015 }
33016
33017-static struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
33018+static const struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
33019 .s_stream = mt9m001_s_stream,
33020 .s_mbus_fmt = mt9m001_s_fmt,
33021 .g_mbus_fmt = mt9m001_g_fmt,
33022@@ -725,7 +725,7 @@ static struct v4l2_subdev_video_ops mt9m
33023 .enum_mbus_fmt = mt9m001_enum_fmt,
33024 };
33025
33026-static struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
33027+static const struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
33028 .g_skip_top_lines = mt9m001_g_skip_top_lines,
33029 };
33030
33031diff -urNp linux-2.6.39.2/drivers/media/video/mt9t031.c linux-2.6.39.2/drivers/media/video/mt9t031.c
33032--- linux-2.6.39.2/drivers/media/video/mt9t031.c 2011-05-19 00:06:34.000000000 -0400
33033+++ linux-2.6.39.2/drivers/media/video/mt9t031.c 2011-05-22 19:36:31.000000000 -0400
33034@@ -725,7 +725,7 @@ static int mt9t031_runtime_resume(struct
33035 return 0;
33036 }
33037
33038-static struct dev_pm_ops mt9t031_dev_pm_ops = {
33039+static const struct dev_pm_ops mt9t031_dev_pm_ops = {
33040 .runtime_suspend = mt9t031_runtime_suspend,
33041 .runtime_resume = mt9t031_runtime_resume,
33042 };
33043@@ -788,7 +788,7 @@ static int mt9t031_g_skip_top_lines(stru
33044 return 0;
33045 }
33046
33047-static struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
33048+static const struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
33049 .g_ctrl = mt9t031_g_ctrl,
33050 .s_ctrl = mt9t031_s_ctrl,
33051 .g_chip_ident = mt9t031_g_chip_ident,
33052@@ -808,7 +808,7 @@ static int mt9t031_enum_fmt(struct v4l2_
33053 return 0;
33054 }
33055
33056-static struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
33057+static const struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
33058 .s_stream = mt9t031_s_stream,
33059 .s_mbus_fmt = mt9t031_s_fmt,
33060 .g_mbus_fmt = mt9t031_g_fmt,
33061@@ -819,7 +819,7 @@ static struct v4l2_subdev_video_ops mt9t
33062 .enum_mbus_fmt = mt9t031_enum_fmt,
33063 };
33064
33065-static struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
33066+static const struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
33067 .g_skip_top_lines = mt9t031_g_skip_top_lines,
33068 };
33069
33070diff -urNp linux-2.6.39.2/drivers/media/video/mt9v022.c linux-2.6.39.2/drivers/media/video/mt9v022.c
33071--- linux-2.6.39.2/drivers/media/video/mt9v022.c 2011-05-19 00:06:34.000000000 -0400
33072+++ linux-2.6.39.2/drivers/media/video/mt9v022.c 2011-05-22 19:36:31.000000000 -0400
33073@@ -825,7 +825,7 @@ static int mt9v022_g_skip_top_lines(stru
33074 return 0;
33075 }
33076
33077-static struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
33078+static const struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
33079 .g_ctrl = mt9v022_g_ctrl,
33080 .s_ctrl = mt9v022_s_ctrl,
33081 .g_chip_ident = mt9v022_g_chip_ident,
33082@@ -848,7 +848,7 @@ static int mt9v022_enum_fmt(struct v4l2_
33083 return 0;
33084 }
33085
33086-static struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
33087+static const struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
33088 .s_stream = mt9v022_s_stream,
33089 .s_mbus_fmt = mt9v022_s_fmt,
33090 .g_mbus_fmt = mt9v022_g_fmt,
33091@@ -859,7 +859,7 @@ static struct v4l2_subdev_video_ops mt9v
33092 .enum_mbus_fmt = mt9v022_enum_fmt,
33093 };
33094
33095-static struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
33096+static const struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
33097 .g_skip_top_lines = mt9v022_g_skip_top_lines,
33098 };
33099
33100diff -urNp linux-2.6.39.2/drivers/media/video/mx2_camera.c linux-2.6.39.2/drivers/media/video/mx2_camera.c
33101--- linux-2.6.39.2/drivers/media/video/mx2_camera.c 2011-05-19 00:06:34.000000000 -0400
33102+++ linux-2.6.39.2/drivers/media/video/mx2_camera.c 2011-05-22 19:36:31.000000000 -0400
33103@@ -668,7 +668,7 @@ static void mx2_videobuf_release(struct
33104 free_buffer(vq, buf);
33105 }
33106
33107-static struct videobuf_queue_ops mx2_videobuf_ops = {
33108+static const struct videobuf_queue_ops mx2_videobuf_ops = {
33109 .buf_setup = mx2_videobuf_setup,
33110 .buf_prepare = mx2_videobuf_prepare,
33111 .buf_queue = mx2_videobuf_queue,
33112diff -urNp linux-2.6.39.2/drivers/media/video/omap24xxcam.c linux-2.6.39.2/drivers/media/video/omap24xxcam.c
33113--- linux-2.6.39.2/drivers/media/video/omap24xxcam.c 2011-05-19 00:06:34.000000000 -0400
33114+++ linux-2.6.39.2/drivers/media/video/omap24xxcam.c 2011-05-22 19:36:31.000000000 -0400
33115@@ -403,7 +403,7 @@ static void omap24xxcam_vbq_complete(str
33116 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
33117
33118 do_gettimeofday(&vb->ts);
33119- vb->field_count = atomic_add_return(2, &fh->field_count);
33120+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
33121 if (csr & csr_error) {
33122 vb->state = VIDEOBUF_ERROR;
33123 if (!atomic_read(&fh->cam->in_reset)) {
33124diff -urNp linux-2.6.39.2/drivers/media/video/omap24xxcam.h linux-2.6.39.2/drivers/media/video/omap24xxcam.h
33125--- linux-2.6.39.2/drivers/media/video/omap24xxcam.h 2011-05-19 00:06:34.000000000 -0400
33126+++ linux-2.6.39.2/drivers/media/video/omap24xxcam.h 2011-05-22 19:36:31.000000000 -0400
33127@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
33128 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
33129 struct videobuf_queue vbq;
33130 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
33131- atomic_t field_count; /* field counter for videobuf_buffer */
33132+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
33133 /* accessing cam here doesn't need serialisation: it's constant */
33134 struct omap24xxcam_device *cam;
33135 };
33136diff -urNp linux-2.6.39.2/drivers/media/video/omap3isp/isp.h linux-2.6.39.2/drivers/media/video/omap3isp/isp.h
33137--- linux-2.6.39.2/drivers/media/video/omap3isp/isp.h 2011-05-19 00:06:34.000000000 -0400
33138+++ linux-2.6.39.2/drivers/media/video/omap3isp/isp.h 2011-05-22 19:36:31.000000000 -0400
33139@@ -290,7 +290,7 @@ struct isp_device {
33140
33141 struct iommu *iommu;
33142
33143- struct isp_platform_callback platform_cb;
33144+ const struct isp_platform_callback platform_cb;
33145 };
33146
33147 #define v4l2_dev_to_isp_device(dev) \
33148diff -urNp linux-2.6.39.2/drivers/media/video/ov2640.c linux-2.6.39.2/drivers/media/video/ov2640.c
33149--- linux-2.6.39.2/drivers/media/video/ov2640.c 2011-05-19 00:06:34.000000000 -0400
33150+++ linux-2.6.39.2/drivers/media/video/ov2640.c 2011-05-22 19:36:31.000000000 -0400
33151@@ -1080,7 +1080,7 @@ static struct soc_camera_ops ov2640_ops
33152 .num_controls = ARRAY_SIZE(ov2640_controls),
33153 };
33154
33155-static struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
33156+static const struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
33157 .g_ctrl = ov2640_g_ctrl,
33158 .s_ctrl = ov2640_s_ctrl,
33159 .g_chip_ident = ov2640_g_chip_ident,
33160@@ -1090,7 +1090,7 @@ static struct v4l2_subdev_core_ops ov264
33161 #endif
33162 };
33163
33164-static struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
33165+static const struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
33166 .s_stream = ov2640_s_stream,
33167 .g_mbus_fmt = ov2640_g_fmt,
33168 .s_mbus_fmt = ov2640_s_fmt,
33169diff -urNp linux-2.6.39.2/drivers/media/video/ov772x.c linux-2.6.39.2/drivers/media/video/ov772x.c
33170--- linux-2.6.39.2/drivers/media/video/ov772x.c 2011-05-19 00:06:34.000000000 -0400
33171+++ linux-2.6.39.2/drivers/media/video/ov772x.c 2011-05-22 19:36:31.000000000 -0400
33172@@ -1079,7 +1079,7 @@ static struct soc_camera_ops ov772x_ops
33173 .num_controls = ARRAY_SIZE(ov772x_controls),
33174 };
33175
33176-static struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
33177+static const struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
33178 .g_ctrl = ov772x_g_ctrl,
33179 .s_ctrl = ov772x_s_ctrl,
33180 .g_chip_ident = ov772x_g_chip_ident,
33181@@ -1099,7 +1099,7 @@ static int ov772x_enum_fmt(struct v4l2_s
33182 return 0;
33183 }
33184
33185-static struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
33186+static const struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
33187 .s_stream = ov772x_s_stream,
33188 .g_mbus_fmt = ov772x_g_fmt,
33189 .s_mbus_fmt = ov772x_s_fmt,
33190diff -urNp linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
33191--- linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-19 00:06:34.000000000 -0400
33192+++ linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-22 19:36:31.000000000 -0400
33193@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
33194 u8 *eeprom;
33195 struct tveeprom tvdata;
33196
33197+ pax_track_stack();
33198+
33199 memset(&tvdata,0,sizeof(tvdata));
33200
33201 eeprom = pvr2_eeprom_fetch(hdw);
33202diff -urNp linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
33203--- linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-19 00:06:34.000000000 -0400
33204+++ linux-2.6.39.2/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-22 19:36:31.000000000 -0400
33205@@ -527,7 +527,7 @@ static u32 pvr2_i2c_functionality(struct
33206 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
33207 }
33208
33209-static struct i2c_algorithm pvr2_i2c_algo_template = {
33210+static const struct i2c_algorithm pvr2_i2c_algo_template = {
33211 .master_xfer = pvr2_i2c_xfer,
33212 .functionality = pvr2_i2c_functionality,
33213 };
33214diff -urNp linux-2.6.39.2/drivers/media/video/rj54n1cb0c.c linux-2.6.39.2/drivers/media/video/rj54n1cb0c.c
33215--- linux-2.6.39.2/drivers/media/video/rj54n1cb0c.c 2011-05-19 00:06:34.000000000 -0400
33216+++ linux-2.6.39.2/drivers/media/video/rj54n1cb0c.c 2011-05-22 19:36:31.000000000 -0400
33217@@ -1327,7 +1327,7 @@ static int rj54n1_s_ctrl(struct v4l2_sub
33218 return 0;
33219 }
33220
33221-static struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
33222+static const struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
33223 .g_ctrl = rj54n1_g_ctrl,
33224 .s_ctrl = rj54n1_s_ctrl,
33225 .g_chip_ident = rj54n1_g_chip_ident,
33226@@ -1337,7 +1337,7 @@ static struct v4l2_subdev_core_ops rj54n
33227 #endif
33228 };
33229
33230-static struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
33231+static const struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
33232 .s_stream = rj54n1_s_stream,
33233 .s_mbus_fmt = rj54n1_s_fmt,
33234 .g_mbus_fmt = rj54n1_g_fmt,
33235diff -urNp linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-capture.c linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-capture.c
33236--- linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-19 00:06:34.000000000 -0400
33237+++ linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-22 19:36:31.000000000 -0400
33238@@ -376,7 +376,7 @@ static void fimc_unlock(struct vb2_queue
33239 mutex_unlock(&ctx->fimc_dev->lock);
33240 }
33241
33242-static struct vb2_ops fimc_capture_qops = {
33243+static const struct vb2_ops fimc_capture_qops = {
33244 .queue_setup = queue_setup,
33245 .buf_prepare = buffer_prepare,
33246 .buf_queue = buffer_queue,
33247diff -urNp linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-core.c linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-core.c
33248--- linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-19 00:06:34.000000000 -0400
33249+++ linux-2.6.39.2/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-22 19:36:31.000000000 -0400
33250@@ -768,7 +768,7 @@ static void fimc_unlock(struct vb2_queue
33251 mutex_unlock(&ctx->fimc_dev->lock);
33252 }
33253
33254-static struct vb2_ops fimc_qops = {
33255+static const struct vb2_ops fimc_qops = {
33256 .queue_setup = fimc_queue_setup,
33257 .buf_prepare = fimc_buf_prepare,
33258 .buf_queue = fimc_buf_queue,
33259diff -urNp linux-2.6.39.2/drivers/media/video/saa7134/saa6752hs.c linux-2.6.39.2/drivers/media/video/saa7134/saa6752hs.c
33260--- linux-2.6.39.2/drivers/media/video/saa7134/saa6752hs.c 2011-05-19 00:06:34.000000000 -0400
33261+++ linux-2.6.39.2/drivers/media/video/saa7134/saa6752hs.c 2011-05-22 19:36:31.000000000 -0400
33262@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
33263 unsigned char localPAT[256];
33264 unsigned char localPMT[256];
33265
33266+ pax_track_stack();
33267+
33268 /* Set video format - must be done first as it resets other settings */
33269 set_reg8(client, 0x41, h->video_format);
33270
33271diff -urNp linux-2.6.39.2/drivers/media/video/saa7134/saa7134-alsa.c linux-2.6.39.2/drivers/media/video/saa7134/saa7134-alsa.c
33272--- linux-2.6.39.2/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-19 00:06:34.000000000 -0400
33273+++ linux-2.6.39.2/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-22 19:36:31.000000000 -0400
33274@@ -808,7 +808,7 @@ static struct page *snd_card_saa7134_pag
33275 * ALSA capture callbacks definition
33276 */
33277
33278-static struct snd_pcm_ops snd_card_saa7134_capture_ops = {
33279+static const struct snd_pcm_ops snd_card_saa7134_capture_ops = {
33280 .open = snd_card_saa7134_capture_open,
33281 .close = snd_card_saa7134_capture_close,
33282 .ioctl = snd_pcm_lib_ioctl,
33283diff -urNp linux-2.6.39.2/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.39.2/drivers/media/video/saa7164/saa7164-cmd.c
33284--- linux-2.6.39.2/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-19 00:06:34.000000000 -0400
33285+++ linux-2.6.39.2/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-22 19:36:31.000000000 -0400
33286@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
33287 u8 tmp[512];
33288 dprintk(DBGLVL_CMD, "%s()\n", __func__);
33289
33290+ pax_track_stack();
33291+
33292 /* While any outstand message on the bus exists... */
33293 do {
33294
33295@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
33296 u8 tmp[512];
33297 dprintk(DBGLVL_CMD, "%s()\n", __func__);
33298
33299+ pax_track_stack();
33300+
33301 while (loop) {
33302
33303 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
33304diff -urNp linux-2.6.39.2/drivers/media/video/sh_mobile_csi2.c linux-2.6.39.2/drivers/media/video/sh_mobile_csi2.c
33305--- linux-2.6.39.2/drivers/media/video/sh_mobile_csi2.c 2011-05-19 00:06:34.000000000 -0400
33306+++ linux-2.6.39.2/drivers/media/video/sh_mobile_csi2.c 2011-05-22 19:36:31.000000000 -0400
33307@@ -127,12 +127,12 @@ static int sh_csi2_s_fmt(struct v4l2_sub
33308 return 0;
33309 }
33310
33311-static struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
33312+static const struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
33313 .s_mbus_fmt = sh_csi2_s_fmt,
33314 .try_mbus_fmt = sh_csi2_try_fmt,
33315 };
33316
33317-static struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
33318+static const struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
33319
33320 static struct v4l2_subdev_ops sh_csi2_subdev_ops = {
33321 .core = &sh_csi2_subdev_core_ops,
33322diff -urNp linux-2.6.39.2/drivers/media/video/soc_camera_platform.c linux-2.6.39.2/drivers/media/video/soc_camera_platform.c
33323--- linux-2.6.39.2/drivers/media/video/soc_camera_platform.c 2011-05-19 00:06:34.000000000 -0400
33324+++ linux-2.6.39.2/drivers/media/video/soc_camera_platform.c 2011-05-22 19:36:31.000000000 -0400
33325@@ -70,7 +70,7 @@ static int soc_camera_platform_fill_fmt(
33326 return 0;
33327 }
33328
33329-static struct v4l2_subdev_core_ops platform_subdev_core_ops;
33330+static const struct v4l2_subdev_core_ops platform_subdev_core_ops;
33331
33332 static int soc_camera_platform_enum_fmt(struct v4l2_subdev *sd, unsigned int index,
33333 enum v4l2_mbus_pixelcode *code)
33334@@ -115,7 +115,7 @@ static int soc_camera_platform_cropcap(s
33335 return 0;
33336 }
33337
33338-static struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33339+static const struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33340 .s_stream = soc_camera_platform_s_stream,
33341 .enum_mbus_fmt = soc_camera_platform_enum_fmt,
33342 .cropcap = soc_camera_platform_cropcap,
33343diff -urNp linux-2.6.39.2/drivers/media/video/tlg2300/pd-alsa.c linux-2.6.39.2/drivers/media/video/tlg2300/pd-alsa.c
33344--- linux-2.6.39.2/drivers/media/video/tlg2300/pd-alsa.c 2011-05-19 00:06:34.000000000 -0400
33345+++ linux-2.6.39.2/drivers/media/video/tlg2300/pd-alsa.c 2011-05-22 19:36:31.000000000 -0400
33346@@ -265,7 +265,7 @@ static struct page *snd_pcm_pd_get_page(
33347 return vmalloc_to_page(pageptr);
33348 }
33349
33350-static struct snd_pcm_ops pcm_capture_ops = {
33351+static const struct snd_pcm_ops pcm_capture_ops = {
33352 .open = snd_pd_capture_open,
33353 .close = snd_pd_pcm_close,
33354 .ioctl = snd_pcm_lib_ioctl,
33355diff -urNp linux-2.6.39.2/drivers/media/video/tw9910.c linux-2.6.39.2/drivers/media/video/tw9910.c
33356--- linux-2.6.39.2/drivers/media/video/tw9910.c 2011-05-19 00:06:34.000000000 -0400
33357+++ linux-2.6.39.2/drivers/media/video/tw9910.c 2011-05-22 19:36:31.000000000 -0400
33358@@ -894,7 +894,7 @@ static struct soc_camera_ops tw9910_ops
33359 .enum_input = tw9910_enum_input,
33360 };
33361
33362-static struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33363+static const struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33364 .g_chip_ident = tw9910_g_chip_ident,
33365 .s_std = tw9910_s_std,
33366 #ifdef CONFIG_VIDEO_ADV_DEBUG
33367@@ -913,7 +913,7 @@ static int tw9910_enum_fmt(struct v4l2_s
33368 return 0;
33369 }
33370
33371-static struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33372+static const struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33373 .s_stream = tw9910_s_stream,
33374 .g_mbus_fmt = tw9910_g_fmt,
33375 .s_mbus_fmt = tw9910_s_fmt,
33376diff -urNp linux-2.6.39.2/drivers/media/video/usbvision/usbvision-core.c linux-2.6.39.2/drivers/media/video/usbvision/usbvision-core.c
33377--- linux-2.6.39.2/drivers/media/video/usbvision/usbvision-core.c 2011-05-19 00:06:34.000000000 -0400
33378+++ linux-2.6.39.2/drivers/media/video/usbvision/usbvision-core.c 2011-05-22 19:36:31.000000000 -0400
33379@@ -799,6 +799,8 @@ static enum parse_state usbvision_parse_
33380 unsigned char rv, gv, bv;
33381 static unsigned char *Y, *U, *V;
33382
33383+ pax_track_stack();
33384+
33385 frame = usbvision->cur_frame;
33386 image_size = frame->frmwidth * frame->frmheight;
33387 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
33388diff -urNp linux-2.6.39.2/drivers/media/video/usbvision/usbvision-i2c.c linux-2.6.39.2/drivers/media/video/usbvision/usbvision-i2c.c
33389--- linux-2.6.39.2/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-19 00:06:34.000000000 -0400
33390+++ linux-2.6.39.2/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-22 19:36:31.000000000 -0400
33391@@ -189,7 +189,7 @@ static u32 functionality(struct i2c_adap
33392
33393 /* -----exported algorithm data: ------------------------------------- */
33394
33395-static struct i2c_algorithm usbvision_algo = {
33396+static const struct i2c_algorithm usbvision_algo = {
33397 .master_xfer = usbvision_i2c_xfer,
33398 .smbus_xfer = NULL,
33399 .functionality = functionality,
33400diff -urNp linux-2.6.39.2/drivers/media/video/v4l2-device.c linux-2.6.39.2/drivers/media/video/v4l2-device.c
33401--- linux-2.6.39.2/drivers/media/video/v4l2-device.c 2011-05-19 00:06:34.000000000 -0400
33402+++ linux-2.6.39.2/drivers/media/video/v4l2-device.c 2011-05-22 19:36:31.000000000 -0400
33403@@ -71,9 +71,9 @@ int v4l2_device_put(struct v4l2_device *
33404 EXPORT_SYMBOL_GPL(v4l2_device_put);
33405
33406 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
33407- atomic_t *instance)
33408+ atomic_unchecked_t *instance)
33409 {
33410- int num = atomic_inc_return(instance) - 1;
33411+ int num = atomic_inc_return_unchecked(instance) - 1;
33412 int len = strlen(basename);
33413
33414 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
33415diff -urNp linux-2.6.39.2/drivers/media/video/videobuf-dma-sg.c linux-2.6.39.2/drivers/media/video/videobuf-dma-sg.c
33416--- linux-2.6.39.2/drivers/media/video/videobuf-dma-sg.c 2011-05-19 00:06:34.000000000 -0400
33417+++ linux-2.6.39.2/drivers/media/video/videobuf-dma-sg.c 2011-05-22 19:36:31.000000000 -0400
33418@@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
33419 {
33420 struct videobuf_queue q;
33421
33422+ pax_track_stack();
33423+
33424 /* Required to make generic handler to call __videobuf_alloc */
33425 q.int_ops = &sg_ops;
33426
33427diff -urNp linux-2.6.39.2/drivers/message/fusion/mptbase.c linux-2.6.39.2/drivers/message/fusion/mptbase.c
33428--- linux-2.6.39.2/drivers/message/fusion/mptbase.c 2011-05-19 00:06:34.000000000 -0400
33429+++ linux-2.6.39.2/drivers/message/fusion/mptbase.c 2011-05-22 19:41:37.000000000 -0400
33430@@ -143,7 +143,7 @@ static int MptDriverClass[MPT_MAX_PRO
33431 static MPT_EVHANDLER MptEvHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33432 /* Reset handler lookup table */
33433 static MPT_RESETHANDLER MptResetHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33434-static struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33435+static const struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33436
33437 #ifdef CONFIG_PROC_FS
33438 static struct proc_dir_entry *mpt_proc_root_dir;
33439@@ -772,7 +772,7 @@ mpt_reset_deregister(u8 cb_idx)
33440 * @cb_idx: MPT protocol driver index
33441 */
33442 int
33443-mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33444+mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33445 {
33446 MPT_ADAPTER *ioc;
33447 const struct pci_device_id *id;
33448@@ -801,7 +801,7 @@ mpt_device_driver_register(struct mpt_pc
33449 void
33450 mpt_device_driver_deregister(u8 cb_idx)
33451 {
33452- struct mpt_pci_driver *dd_cbfunc;
33453+ const struct mpt_pci_driver *dd_cbfunc;
33454 MPT_ADAPTER *ioc;
33455
33456 if (!cb_idx || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
33457@@ -6683,8 +6683,13 @@ static int mpt_iocinfo_proc_show(struct
33458 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
33459 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
33460
33461+#ifdef CONFIG_GRKERNSEC_HIDESYM
33462+ seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
33463+#else
33464 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
33465 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
33466+#endif
33467+
33468 /*
33469 * Rounding UP to nearest 4-kB boundary here...
33470 */
33471diff -urNp linux-2.6.39.2/drivers/message/fusion/mptbase.h linux-2.6.39.2/drivers/message/fusion/mptbase.h
33472--- linux-2.6.39.2/drivers/message/fusion/mptbase.h 2011-05-19 00:06:34.000000000 -0400
33473+++ linux-2.6.39.2/drivers/message/fusion/mptbase.h 2011-05-22 19:36:31.000000000 -0400
33474@@ -908,7 +908,7 @@ extern int mpt_event_register(u8 cb_idx
33475 extern void mpt_event_deregister(u8 cb_idx);
33476 extern int mpt_reset_register(u8 cb_idx, MPT_RESETHANDLER reset_func);
33477 extern void mpt_reset_deregister(u8 cb_idx);
33478-extern int mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33479+extern int mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33480 extern void mpt_device_driver_deregister(u8 cb_idx);
33481 extern MPT_FRAME_HDR *mpt_get_msg_frame(u8 cb_idx, MPT_ADAPTER *ioc);
33482 extern void mpt_free_msg_frame(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf);
33483diff -urNp linux-2.6.39.2/drivers/message/fusion/mptctl.c linux-2.6.39.2/drivers/message/fusion/mptctl.c
33484--- linux-2.6.39.2/drivers/message/fusion/mptctl.c 2011-05-19 00:06:34.000000000 -0400
33485+++ linux-2.6.39.2/drivers/message/fusion/mptctl.c 2011-05-22 19:36:31.000000000 -0400
33486@@ -3000,7 +3000,7 @@ mptctl_remove(struct pci_dev *pdev)
33487 {
33488 }
33489
33490-static struct mpt_pci_driver mptctl_driver = {
33491+static const struct mpt_pci_driver mptctl_driver = {
33492 .probe = mptctl_probe,
33493 .remove = mptctl_remove,
33494 };
33495diff -urNp linux-2.6.39.2/drivers/message/fusion/mptsas.c linux-2.6.39.2/drivers/message/fusion/mptsas.c
33496--- linux-2.6.39.2/drivers/message/fusion/mptsas.c 2011-05-19 00:06:34.000000000 -0400
33497+++ linux-2.6.39.2/drivers/message/fusion/mptsas.c 2011-05-22 19:36:31.000000000 -0400
33498@@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
33499 return 0;
33500 }
33501
33502+static inline void
33503+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33504+{
33505+ if (phy_info->port_details) {
33506+ phy_info->port_details->rphy = rphy;
33507+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33508+ ioc->name, rphy));
33509+ }
33510+
33511+ if (rphy) {
33512+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33513+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33514+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33515+ ioc->name, rphy, rphy->dev.release));
33516+ }
33517+}
33518+
33519 /* no mutex */
33520 static void
33521 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
33522@@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
33523 return NULL;
33524 }
33525
33526-static inline void
33527-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33528-{
33529- if (phy_info->port_details) {
33530- phy_info->port_details->rphy = rphy;
33531- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33532- ioc->name, rphy));
33533- }
33534-
33535- if (rphy) {
33536- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33537- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33538- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33539- ioc->name, rphy, rphy->dev.release));
33540- }
33541-}
33542-
33543 static inline struct sas_port *
33544 mptsas_get_port(struct mptsas_phyinfo *phy_info)
33545 {
33546diff -urNp linux-2.6.39.2/drivers/message/fusion/mptscsih.c linux-2.6.39.2/drivers/message/fusion/mptscsih.c
33547--- linux-2.6.39.2/drivers/message/fusion/mptscsih.c 2011-05-19 00:06:34.000000000 -0400
33548+++ linux-2.6.39.2/drivers/message/fusion/mptscsih.c 2011-05-22 19:36:31.000000000 -0400
33549@@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
33550
33551 h = shost_priv(SChost);
33552
33553- if (h) {
33554- if (h->info_kbuf == NULL)
33555- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33556- return h->info_kbuf;
33557- h->info_kbuf[0] = '\0';
33558+ if (!h)
33559+ return NULL;
33560
33561- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33562- h->info_kbuf[size-1] = '\0';
33563- }
33564+ if (h->info_kbuf == NULL)
33565+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33566+ return h->info_kbuf;
33567+ h->info_kbuf[0] = '\0';
33568+
33569+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33570+ h->info_kbuf[size-1] = '\0';
33571
33572 return h->info_kbuf;
33573 }
33574diff -urNp linux-2.6.39.2/drivers/message/i2o/i2o_config.c linux-2.6.39.2/drivers/message/i2o/i2o_config.c
33575--- linux-2.6.39.2/drivers/message/i2o/i2o_config.c 2011-05-19 00:06:34.000000000 -0400
33576+++ linux-2.6.39.2/drivers/message/i2o/i2o_config.c 2011-05-22 19:36:31.000000000 -0400
33577@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
33578 struct i2o_message *msg;
33579 unsigned int iop;
33580
33581+ pax_track_stack();
33582+
33583 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
33584 return -EFAULT;
33585
33586diff -urNp linux-2.6.39.2/drivers/message/i2o/i2o_proc.c linux-2.6.39.2/drivers/message/i2o/i2o_proc.c
33587--- linux-2.6.39.2/drivers/message/i2o/i2o_proc.c 2011-05-19 00:06:34.000000000 -0400
33588+++ linux-2.6.39.2/drivers/message/i2o/i2o_proc.c 2011-05-22 19:36:31.000000000 -0400
33589@@ -255,13 +255,6 @@ static char *scsi_devices[] = {
33590 "Array Controller Device"
33591 };
33592
33593-static char *chtostr(u8 * chars, int n)
33594-{
33595- char tmp[256];
33596- tmp[0] = 0;
33597- return strncat(tmp, (char *)chars, n);
33598-}
33599-
33600 static int i2o_report_query_status(struct seq_file *seq, int block_status,
33601 char *group)
33602 {
33603@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct
33604
33605 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
33606 seq_printf(seq, "%-#8x", ddm_table.module_id);
33607- seq_printf(seq, "%-29s",
33608- chtostr(ddm_table.module_name_version, 28));
33609+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
33610 seq_printf(seq, "%9d ", ddm_table.data_size);
33611 seq_printf(seq, "%8d", ddm_table.code_size);
33612
33613@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s
33614
33615 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
33616 seq_printf(seq, "%-#8x", dst->module_id);
33617- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
33618- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
33619+ seq_printf(seq, "%-.28s", dst->module_name_version);
33620+ seq_printf(seq, "%-.8s", dst->date);
33621 seq_printf(seq, "%8d ", dst->module_size);
33622 seq_printf(seq, "%8d ", dst->mpb_size);
33623 seq_printf(seq, "0x%04x", dst->module_flags);
33624@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str
33625 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
33626 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
33627 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
33628- seq_printf(seq, "Vendor info : %s\n",
33629- chtostr((u8 *) (work32 + 2), 16));
33630- seq_printf(seq, "Product info : %s\n",
33631- chtostr((u8 *) (work32 + 6), 16));
33632- seq_printf(seq, "Description : %s\n",
33633- chtostr((u8 *) (work32 + 10), 16));
33634- seq_printf(seq, "Product rev. : %s\n",
33635- chtostr((u8 *) (work32 + 14), 8));
33636+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
33637+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
33638+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
33639+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
33640
33641 seq_printf(seq, "Serial number : ");
33642 print_serial_number(seq, (u8 *) (work32 + 16),
33643@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str
33644 }
33645
33646 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
33647- seq_printf(seq, "Module name : %s\n",
33648- chtostr(result.module_name, 24));
33649- seq_printf(seq, "Module revision : %s\n",
33650- chtostr(result.module_rev, 8));
33651+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
33652+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
33653
33654 seq_printf(seq, "Serial number : ");
33655 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
33656@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq
33657 return 0;
33658 }
33659
33660- seq_printf(seq, "Device name : %s\n",
33661- chtostr(result.device_name, 64));
33662- seq_printf(seq, "Service name : %s\n",
33663- chtostr(result.service_name, 64));
33664- seq_printf(seq, "Physical name : %s\n",
33665- chtostr(result.physical_location, 64));
33666- seq_printf(seq, "Instance number : %s\n",
33667- chtostr(result.instance_number, 4));
33668+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
33669+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
33670+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
33671+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
33672
33673 return 0;
33674 }
33675diff -urNp linux-2.6.39.2/drivers/message/i2o/iop.c linux-2.6.39.2/drivers/message/i2o/iop.c
33676--- linux-2.6.39.2/drivers/message/i2o/iop.c 2011-05-19 00:06:34.000000000 -0400
33677+++ linux-2.6.39.2/drivers/message/i2o/iop.c 2011-05-22 19:36:31.000000000 -0400
33678@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
33679
33680 spin_lock_irqsave(&c->context_list_lock, flags);
33681
33682- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
33683- atomic_inc(&c->context_list_counter);
33684+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
33685+ atomic_inc_unchecked(&c->context_list_counter);
33686
33687- entry->context = atomic_read(&c->context_list_counter);
33688+ entry->context = atomic_read_unchecked(&c->context_list_counter);
33689
33690 list_add(&entry->list, &c->context_list);
33691
33692@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
33693
33694 #if BITS_PER_LONG == 64
33695 spin_lock_init(&c->context_list_lock);
33696- atomic_set(&c->context_list_counter, 0);
33697+ atomic_set_unchecked(&c->context_list_counter, 0);
33698 INIT_LIST_HEAD(&c->context_list);
33699 #endif
33700
33701diff -urNp linux-2.6.39.2/drivers/mfd/ab3100-core.c linux-2.6.39.2/drivers/mfd/ab3100-core.c
33702--- linux-2.6.39.2/drivers/mfd/ab3100-core.c 2011-05-19 00:06:34.000000000 -0400
33703+++ linux-2.6.39.2/drivers/mfd/ab3100-core.c 2011-05-22 19:36:31.000000000 -0400
33704@@ -385,7 +385,7 @@ static int ab3100_event_registers_startu
33705 return 0;
33706 }
33707
33708-static struct abx500_ops ab3100_ops = {
33709+static const struct abx500_ops ab3100_ops = {
33710 .get_chip_id = ab3100_get_chip_id,
33711 .set_register = set_register_interruptible,
33712 .get_register = get_register_interruptible,
33713diff -urNp linux-2.6.39.2/drivers/mfd/ab3550-core.c linux-2.6.39.2/drivers/mfd/ab3550-core.c
33714--- linux-2.6.39.2/drivers/mfd/ab3550-core.c 2011-05-19 00:06:34.000000000 -0400
33715+++ linux-2.6.39.2/drivers/mfd/ab3550-core.c 2011-05-22 19:36:31.000000000 -0400
33716@@ -676,7 +676,7 @@ static int ab3550_startup_irq_enabled(st
33717 return val;
33718 }
33719
33720-static struct abx500_ops ab3550_ops = {
33721+static const struct abx500_ops ab3550_ops = {
33722 .get_chip_id = ab3550_get_chip_id,
33723 .get_register = ab3550_get_register_interruptible,
33724 .set_register = ab3550_set_register_interruptible,
33725diff -urNp linux-2.6.39.2/drivers/mfd/ab8500-core.c linux-2.6.39.2/drivers/mfd/ab8500-core.c
33726--- linux-2.6.39.2/drivers/mfd/ab8500-core.c 2011-05-19 00:06:34.000000000 -0400
33727+++ linux-2.6.39.2/drivers/mfd/ab8500-core.c 2011-05-22 19:36:31.000000000 -0400
33728@@ -223,7 +223,7 @@ static int ab8500_mask_and_set_register(
33729
33730 }
33731
33732-static struct abx500_ops ab8500_ops = {
33733+static const struct abx500_ops ab8500_ops = {
33734 .get_chip_id = ab8500_get_chip_id,
33735 .get_register = ab8500_get_register,
33736 .set_register = ab8500_set_register,
33737diff -urNp linux-2.6.39.2/drivers/mfd/abx500-core.c linux-2.6.39.2/drivers/mfd/abx500-core.c
33738--- linux-2.6.39.2/drivers/mfd/abx500-core.c 2011-05-19 00:06:34.000000000 -0400
33739+++ linux-2.6.39.2/drivers/mfd/abx500-core.c 2011-05-22 19:36:31.000000000 -0400
33740@@ -18,7 +18,7 @@ struct abx500_device_entry {
33741 struct device *dev;
33742 };
33743
33744-static void lookup_ops(struct device *dev, struct abx500_ops **ops)
33745+static void lookup_ops(struct device *dev, const struct abx500_ops **ops)
33746 {
33747 struct abx500_device_entry *dev_entry;
33748
33749@@ -31,7 +31,7 @@ static void lookup_ops(struct device *de
33750 }
33751 }
33752
33753-int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
33754+int abx500_register_ops(struct device *dev, const struct abx500_ops *ops)
33755 {
33756 struct abx500_device_entry *dev_entry;
33757
33758@@ -65,7 +65,7 @@ EXPORT_SYMBOL(abx500_remove_ops);
33759 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
33760 u8 value)
33761 {
33762- struct abx500_ops *ops;
33763+ const struct abx500_ops *ops;
33764
33765 lookup_ops(dev->parent, &ops);
33766 if ((ops != NULL) && (ops->set_register != NULL))
33767@@ -78,7 +78,7 @@ EXPORT_SYMBOL(abx500_set_register_interr
33768 int abx500_get_register_interruptible(struct device *dev, u8 bank, u8 reg,
33769 u8 *value)
33770 {
33771- struct abx500_ops *ops;
33772+ const struct abx500_ops *ops;
33773
33774 lookup_ops(dev->parent, &ops);
33775 if ((ops != NULL) && (ops->get_register != NULL))
33776@@ -91,7 +91,7 @@ EXPORT_SYMBOL(abx500_get_register_interr
33777 int abx500_get_register_page_interruptible(struct device *dev, u8 bank,
33778 u8 first_reg, u8 *regvals, u8 numregs)
33779 {
33780- struct abx500_ops *ops;
33781+ const struct abx500_ops *ops;
33782
33783 lookup_ops(dev->parent, &ops);
33784 if ((ops != NULL) && (ops->get_register_page != NULL))
33785@@ -105,7 +105,7 @@ EXPORT_SYMBOL(abx500_get_register_page_i
33786 int abx500_mask_and_set_register_interruptible(struct device *dev, u8 bank,
33787 u8 reg, u8 bitmask, u8 bitvalues)
33788 {
33789- struct abx500_ops *ops;
33790+ const struct abx500_ops *ops;
33791
33792 lookup_ops(dev->parent, &ops);
33793 if ((ops != NULL) && (ops->mask_and_set_register != NULL))
33794@@ -118,7 +118,7 @@ EXPORT_SYMBOL(abx500_mask_and_set_regist
33795
33796 int abx500_get_chip_id(struct device *dev)
33797 {
33798- struct abx500_ops *ops;
33799+ const struct abx500_ops *ops;
33800
33801 lookup_ops(dev->parent, &ops);
33802 if ((ops != NULL) && (ops->get_chip_id != NULL))
33803@@ -130,7 +130,7 @@ EXPORT_SYMBOL(abx500_get_chip_id);
33804
33805 int abx500_event_registers_startup_state_get(struct device *dev, u8 *event)
33806 {
33807- struct abx500_ops *ops;
33808+ const struct abx500_ops *ops;
33809
33810 lookup_ops(dev->parent, &ops);
33811 if ((ops != NULL) && (ops->event_registers_startup_state_get != NULL))
33812@@ -142,7 +142,7 @@ EXPORT_SYMBOL(abx500_event_registers_sta
33813
33814 int abx500_startup_irq_enabled(struct device *dev, unsigned int irq)
33815 {
33816- struct abx500_ops *ops;
33817+ const struct abx500_ops *ops;
33818
33819 lookup_ops(dev->parent, &ops);
33820 if ((ops != NULL) && (ops->startup_irq_enabled != NULL))
33821diff -urNp linux-2.6.39.2/drivers/mfd/janz-cmodio.c linux-2.6.39.2/drivers/mfd/janz-cmodio.c
33822--- linux-2.6.39.2/drivers/mfd/janz-cmodio.c 2011-05-19 00:06:34.000000000 -0400
33823+++ linux-2.6.39.2/drivers/mfd/janz-cmodio.c 2011-05-22 19:36:31.000000000 -0400
33824@@ -13,6 +13,7 @@
33825
33826 #include <linux/kernel.h>
33827 #include <linux/module.h>
33828+#include <linux/slab.h>
33829 #include <linux/init.h>
33830 #include <linux/pci.h>
33831 #include <linux/interrupt.h>
33832diff -urNp linux-2.6.39.2/drivers/mfd/mcp-sa11x0.c linux-2.6.39.2/drivers/mfd/mcp-sa11x0.c
33833--- linux-2.6.39.2/drivers/mfd/mcp-sa11x0.c 2011-05-19 00:06:34.000000000 -0400
33834+++ linux-2.6.39.2/drivers/mfd/mcp-sa11x0.c 2011-05-22 19:36:31.000000000 -0400
33835@@ -128,7 +128,7 @@ static void mcp_sa11x0_disable(struct mc
33836 /*
33837 * Our methods.
33838 */
33839-static struct mcp_ops mcp_sa11x0 = {
33840+static const struct mcp_ops mcp_sa11x0 = {
33841 .set_telecom_divisor = mcp_sa11x0_set_telecom_divisor,
33842 .set_audio_divisor = mcp_sa11x0_set_audio_divisor,
33843 .reg_write = mcp_sa11x0_write,
33844diff -urNp linux-2.6.39.2/drivers/mfd/wm8350-i2c.c linux-2.6.39.2/drivers/mfd/wm8350-i2c.c
33845--- linux-2.6.39.2/drivers/mfd/wm8350-i2c.c 2011-05-19 00:06:34.000000000 -0400
33846+++ linux-2.6.39.2/drivers/mfd/wm8350-i2c.c 2011-05-22 19:36:31.000000000 -0400
33847@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
33848 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
33849 int ret;
33850
33851+ pax_track_stack();
33852+
33853 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
33854 return -EINVAL;
33855
33856diff -urNp linux-2.6.39.2/drivers/misc/enclosure.c linux-2.6.39.2/drivers/misc/enclosure.c
33857--- linux-2.6.39.2/drivers/misc/enclosure.c 2011-05-19 00:06:34.000000000 -0400
33858+++ linux-2.6.39.2/drivers/misc/enclosure.c 2011-05-22 19:36:31.000000000 -0400
33859@@ -161,7 +161,7 @@ enclosure_register(struct device *dev, c
33860 }
33861 EXPORT_SYMBOL_GPL(enclosure_register);
33862
33863-static struct enclosure_component_callbacks enclosure_null_callbacks;
33864+static const struct enclosure_component_callbacks enclosure_null_callbacks;
33865
33866 /**
33867 * enclosure_unregister - remove an enclosure
33868diff -urNp linux-2.6.39.2/drivers/misc/kgdbts.c linux-2.6.39.2/drivers/misc/kgdbts.c
33869--- linux-2.6.39.2/drivers/misc/kgdbts.c 2011-05-19 00:06:34.000000000 -0400
33870+++ linux-2.6.39.2/drivers/misc/kgdbts.c 2011-05-22 19:36:31.000000000 -0400
33871@@ -118,7 +118,7 @@
33872 } while (0)
33873 #define MAX_CONFIG_LEN 40
33874
33875-static struct kgdb_io kgdbts_io_ops;
33876+static const struct kgdb_io kgdbts_io_ops;
33877 static char get_buf[BUFMAX];
33878 static int get_buf_cnt;
33879 static char put_buf[BUFMAX];
33880@@ -1103,7 +1103,7 @@ static void kgdbts_post_exp_handler(void
33881 module_put(THIS_MODULE);
33882 }
33883
33884-static struct kgdb_io kgdbts_io_ops = {
33885+static const struct kgdb_io kgdbts_io_ops = {
33886 .name = "kgdbts",
33887 .read_char = kgdbts_get_char,
33888 .write_char = kgdbts_put_char,
33889diff -urNp linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.c linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.c
33890--- linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-19 00:06:34.000000000 -0400
33891+++ linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-22 19:36:31.000000000 -0400
33892@@ -435,7 +435,7 @@ static irqreturn_t lis302dl_interrupt(in
33893 * the lid is closed. This leads to interrupts as soon as a little move
33894 * is done.
33895 */
33896- atomic_inc(&lis3_dev.count);
33897+ atomic_inc_unchecked(&lis3_dev.count);
33898
33899 wake_up_interruptible(&lis3_dev.misc_wait);
33900 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
33901@@ -518,7 +518,7 @@ static int lis3lv02d_misc_open(struct in
33902 if (lis3_dev.pm_dev)
33903 pm_runtime_get_sync(lis3_dev.pm_dev);
33904
33905- atomic_set(&lis3_dev.count, 0);
33906+ atomic_set_unchecked(&lis3_dev.count, 0);
33907 return 0;
33908 }
33909
33910@@ -545,7 +545,7 @@ static ssize_t lis3lv02d_misc_read(struc
33911 add_wait_queue(&lis3_dev.misc_wait, &wait);
33912 while (true) {
33913 set_current_state(TASK_INTERRUPTIBLE);
33914- data = atomic_xchg(&lis3_dev.count, 0);
33915+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
33916 if (data)
33917 break;
33918
33919@@ -583,7 +583,7 @@ out:
33920 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
33921 {
33922 poll_wait(file, &lis3_dev.misc_wait, wait);
33923- if (atomic_read(&lis3_dev.count))
33924+ if (atomic_read_unchecked(&lis3_dev.count))
33925 return POLLIN | POLLRDNORM;
33926 return 0;
33927 }
33928diff -urNp linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.h linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.h
33929--- linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-19 00:06:34.000000000 -0400
33930+++ linux-2.6.39.2/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-22 19:36:31.000000000 -0400
33931@@ -265,7 +265,7 @@ struct lis3lv02d {
33932 struct input_polled_dev *idev; /* input device */
33933 struct platform_device *pdev; /* platform device */
33934 struct regulator_bulk_data regulators[2];
33935- atomic_t count; /* interrupt count after last read */
33936+ atomic_unchecked_t count; /* interrupt count after last read */
33937 union axis_conversion ac; /* hw -> logical axis */
33938 int mapped_btns[3];
33939
33940diff -urNp linux-2.6.39.2/drivers/misc/sgi-gru/gruhandles.c linux-2.6.39.2/drivers/misc/sgi-gru/gruhandles.c
33941--- linux-2.6.39.2/drivers/misc/sgi-gru/gruhandles.c 2011-05-19 00:06:34.000000000 -0400
33942+++ linux-2.6.39.2/drivers/misc/sgi-gru/gruhandles.c 2011-05-22 19:36:31.000000000 -0400
33943@@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
33944 unsigned long nsec;
33945
33946 nsec = CLKS2NSEC(clks);
33947- atomic_long_inc(&mcs_op_statistics[op].count);
33948- atomic_long_add(nsec, &mcs_op_statistics[op].total);
33949+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
33950+ atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
33951 if (mcs_op_statistics[op].max < nsec)
33952 mcs_op_statistics[op].max = nsec;
33953 }
33954diff -urNp linux-2.6.39.2/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.39.2/drivers/misc/sgi-gru/gruprocfs.c
33955--- linux-2.6.39.2/drivers/misc/sgi-gru/gruprocfs.c 2011-05-19 00:06:34.000000000 -0400
33956+++ linux-2.6.39.2/drivers/misc/sgi-gru/gruprocfs.c 2011-05-22 19:36:31.000000000 -0400
33957@@ -32,9 +32,9 @@
33958
33959 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
33960
33961-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
33962+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
33963 {
33964- unsigned long val = atomic_long_read(v);
33965+ unsigned long val = atomic_long_read_unchecked(v);
33966
33967 seq_printf(s, "%16lu %s\n", val, id);
33968 }
33969@@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
33970
33971 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
33972 for (op = 0; op < mcsop_last; op++) {
33973- count = atomic_long_read(&mcs_op_statistics[op].count);
33974- total = atomic_long_read(&mcs_op_statistics[op].total);
33975+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
33976+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
33977 max = mcs_op_statistics[op].max;
33978 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
33979 count ? total / count : 0, max);
33980diff -urNp linux-2.6.39.2/drivers/misc/sgi-gru/grutables.h linux-2.6.39.2/drivers/misc/sgi-gru/grutables.h
33981--- linux-2.6.39.2/drivers/misc/sgi-gru/grutables.h 2011-05-19 00:06:34.000000000 -0400
33982+++ linux-2.6.39.2/drivers/misc/sgi-gru/grutables.h 2011-05-22 19:36:31.000000000 -0400
33983@@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
33984 * GRU statistics.
33985 */
33986 struct gru_stats_s {
33987- atomic_long_t vdata_alloc;
33988- atomic_long_t vdata_free;
33989- atomic_long_t gts_alloc;
33990- atomic_long_t gts_free;
33991- atomic_long_t gms_alloc;
33992- atomic_long_t gms_free;
33993- atomic_long_t gts_double_allocate;
33994- atomic_long_t assign_context;
33995- atomic_long_t assign_context_failed;
33996- atomic_long_t free_context;
33997- atomic_long_t load_user_context;
33998- atomic_long_t load_kernel_context;
33999- atomic_long_t lock_kernel_context;
34000- atomic_long_t unlock_kernel_context;
34001- atomic_long_t steal_user_context;
34002- atomic_long_t steal_kernel_context;
34003- atomic_long_t steal_context_failed;
34004- atomic_long_t nopfn;
34005- atomic_long_t asid_new;
34006- atomic_long_t asid_next;
34007- atomic_long_t asid_wrap;
34008- atomic_long_t asid_reuse;
34009- atomic_long_t intr;
34010- atomic_long_t intr_cbr;
34011- atomic_long_t intr_tfh;
34012- atomic_long_t intr_spurious;
34013- atomic_long_t intr_mm_lock_failed;
34014- atomic_long_t call_os;
34015- atomic_long_t call_os_wait_queue;
34016- atomic_long_t user_flush_tlb;
34017- atomic_long_t user_unload_context;
34018- atomic_long_t user_exception;
34019- atomic_long_t set_context_option;
34020- atomic_long_t check_context_retarget_intr;
34021- atomic_long_t check_context_unload;
34022- atomic_long_t tlb_dropin;
34023- atomic_long_t tlb_preload_page;
34024- atomic_long_t tlb_dropin_fail_no_asid;
34025- atomic_long_t tlb_dropin_fail_upm;
34026- atomic_long_t tlb_dropin_fail_invalid;
34027- atomic_long_t tlb_dropin_fail_range_active;
34028- atomic_long_t tlb_dropin_fail_idle;
34029- atomic_long_t tlb_dropin_fail_fmm;
34030- atomic_long_t tlb_dropin_fail_no_exception;
34031- atomic_long_t tfh_stale_on_fault;
34032- atomic_long_t mmu_invalidate_range;
34033- atomic_long_t mmu_invalidate_page;
34034- atomic_long_t flush_tlb;
34035- atomic_long_t flush_tlb_gru;
34036- atomic_long_t flush_tlb_gru_tgh;
34037- atomic_long_t flush_tlb_gru_zero_asid;
34038-
34039- atomic_long_t copy_gpa;
34040- atomic_long_t read_gpa;
34041-
34042- atomic_long_t mesq_receive;
34043- atomic_long_t mesq_receive_none;
34044- atomic_long_t mesq_send;
34045- atomic_long_t mesq_send_failed;
34046- atomic_long_t mesq_noop;
34047- atomic_long_t mesq_send_unexpected_error;
34048- atomic_long_t mesq_send_lb_overflow;
34049- atomic_long_t mesq_send_qlimit_reached;
34050- atomic_long_t mesq_send_amo_nacked;
34051- atomic_long_t mesq_send_put_nacked;
34052- atomic_long_t mesq_page_overflow;
34053- atomic_long_t mesq_qf_locked;
34054- atomic_long_t mesq_qf_noop_not_full;
34055- atomic_long_t mesq_qf_switch_head_failed;
34056- atomic_long_t mesq_qf_unexpected_error;
34057- atomic_long_t mesq_noop_unexpected_error;
34058- atomic_long_t mesq_noop_lb_overflow;
34059- atomic_long_t mesq_noop_qlimit_reached;
34060- atomic_long_t mesq_noop_amo_nacked;
34061- atomic_long_t mesq_noop_put_nacked;
34062- atomic_long_t mesq_noop_page_overflow;
34063+ atomic_long_unchecked_t vdata_alloc;
34064+ atomic_long_unchecked_t vdata_free;
34065+ atomic_long_unchecked_t gts_alloc;
34066+ atomic_long_unchecked_t gts_free;
34067+ atomic_long_unchecked_t gms_alloc;
34068+ atomic_long_unchecked_t gms_free;
34069+ atomic_long_unchecked_t gts_double_allocate;
34070+ atomic_long_unchecked_t assign_context;
34071+ atomic_long_unchecked_t assign_context_failed;
34072+ atomic_long_unchecked_t free_context;
34073+ atomic_long_unchecked_t load_user_context;
34074+ atomic_long_unchecked_t load_kernel_context;
34075+ atomic_long_unchecked_t lock_kernel_context;
34076+ atomic_long_unchecked_t unlock_kernel_context;
34077+ atomic_long_unchecked_t steal_user_context;
34078+ atomic_long_unchecked_t steal_kernel_context;
34079+ atomic_long_unchecked_t steal_context_failed;
34080+ atomic_long_unchecked_t nopfn;
34081+ atomic_long_unchecked_t asid_new;
34082+ atomic_long_unchecked_t asid_next;
34083+ atomic_long_unchecked_t asid_wrap;
34084+ atomic_long_unchecked_t asid_reuse;
34085+ atomic_long_unchecked_t intr;
34086+ atomic_long_unchecked_t intr_cbr;
34087+ atomic_long_unchecked_t intr_tfh;
34088+ atomic_long_unchecked_t intr_spurious;
34089+ atomic_long_unchecked_t intr_mm_lock_failed;
34090+ atomic_long_unchecked_t call_os;
34091+ atomic_long_unchecked_t call_os_wait_queue;
34092+ atomic_long_unchecked_t user_flush_tlb;
34093+ atomic_long_unchecked_t user_unload_context;
34094+ atomic_long_unchecked_t user_exception;
34095+ atomic_long_unchecked_t set_context_option;
34096+ atomic_long_unchecked_t check_context_retarget_intr;
34097+ atomic_long_unchecked_t check_context_unload;
34098+ atomic_long_unchecked_t tlb_dropin;
34099+ atomic_long_unchecked_t tlb_preload_page;
34100+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
34101+ atomic_long_unchecked_t tlb_dropin_fail_upm;
34102+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
34103+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
34104+ atomic_long_unchecked_t tlb_dropin_fail_idle;
34105+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
34106+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
34107+ atomic_long_unchecked_t tfh_stale_on_fault;
34108+ atomic_long_unchecked_t mmu_invalidate_range;
34109+ atomic_long_unchecked_t mmu_invalidate_page;
34110+ atomic_long_unchecked_t flush_tlb;
34111+ atomic_long_unchecked_t flush_tlb_gru;
34112+ atomic_long_unchecked_t flush_tlb_gru_tgh;
34113+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
34114+
34115+ atomic_long_unchecked_t copy_gpa;
34116+ atomic_long_unchecked_t read_gpa;
34117+
34118+ atomic_long_unchecked_t mesq_receive;
34119+ atomic_long_unchecked_t mesq_receive_none;
34120+ atomic_long_unchecked_t mesq_send;
34121+ atomic_long_unchecked_t mesq_send_failed;
34122+ atomic_long_unchecked_t mesq_noop;
34123+ atomic_long_unchecked_t mesq_send_unexpected_error;
34124+ atomic_long_unchecked_t mesq_send_lb_overflow;
34125+ atomic_long_unchecked_t mesq_send_qlimit_reached;
34126+ atomic_long_unchecked_t mesq_send_amo_nacked;
34127+ atomic_long_unchecked_t mesq_send_put_nacked;
34128+ atomic_long_unchecked_t mesq_page_overflow;
34129+ atomic_long_unchecked_t mesq_qf_locked;
34130+ atomic_long_unchecked_t mesq_qf_noop_not_full;
34131+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
34132+ atomic_long_unchecked_t mesq_qf_unexpected_error;
34133+ atomic_long_unchecked_t mesq_noop_unexpected_error;
34134+ atomic_long_unchecked_t mesq_noop_lb_overflow;
34135+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
34136+ atomic_long_unchecked_t mesq_noop_amo_nacked;
34137+ atomic_long_unchecked_t mesq_noop_put_nacked;
34138+ atomic_long_unchecked_t mesq_noop_page_overflow;
34139
34140 };
34141
34142@@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
34143 tghop_invalidate, mcsop_last};
34144
34145 struct mcs_op_statistic {
34146- atomic_long_t count;
34147- atomic_long_t total;
34148+ atomic_long_unchecked_t count;
34149+ atomic_long_unchecked_t total;
34150 unsigned long max;
34151 };
34152
34153@@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
34154
34155 #define STAT(id) do { \
34156 if (gru_options & OPT_STATS) \
34157- atomic_long_inc(&gru_stats.id); \
34158+ atomic_long_inc_unchecked(&gru_stats.id); \
34159 } while (0)
34160
34161 #ifdef CONFIG_SGI_GRU_DEBUG
34162diff -urNp linux-2.6.39.2/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.39.2/drivers/misc/sgi-xp/xpc_sn2.c
34163--- linux-2.6.39.2/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-19 00:06:34.000000000 -0400
34164+++ linux-2.6.39.2/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-22 19:36:31.000000000 -0400
34165@@ -2351,7 +2351,7 @@ xpc_received_payload_sn2(struct xpc_chan
34166 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
34167 }
34168
34169-static struct xpc_arch_operations xpc_arch_ops_sn2 = {
34170+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
34171 .setup_partitions = xpc_setup_partitions_sn2,
34172 .teardown_partitions = xpc_teardown_partitions_sn2,
34173 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
34174diff -urNp linux-2.6.39.2/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.39.2/drivers/misc/sgi-xp/xpc_uv.c
34175--- linux-2.6.39.2/drivers/misc/sgi-xp/xpc_uv.c 2011-05-19 00:06:34.000000000 -0400
34176+++ linux-2.6.39.2/drivers/misc/sgi-xp/xpc_uv.c 2011-05-22 19:36:31.000000000 -0400
34177@@ -1674,7 +1674,7 @@ xpc_received_payload_uv(struct xpc_chann
34178 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
34179 }
34180
34181-static struct xpc_arch_operations xpc_arch_ops_uv = {
34182+static const struct xpc_arch_operations xpc_arch_ops_uv = {
34183 .setup_partitions = xpc_setup_partitions_uv,
34184 .teardown_partitions = xpc_teardown_partitions_uv,
34185 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
34186diff -urNp linux-2.6.39.2/drivers/misc/spear13xx_pcie_gadget.c linux-2.6.39.2/drivers/misc/spear13xx_pcie_gadget.c
34187--- linux-2.6.39.2/drivers/misc/spear13xx_pcie_gadget.c 2011-05-19 00:06:34.000000000 -0400
34188+++ linux-2.6.39.2/drivers/misc/spear13xx_pcie_gadget.c 2011-05-22 19:36:31.000000000 -0400
34189@@ -644,7 +644,7 @@ static ssize_t pcie_gadget_target_attr_s
34190 return ret;
34191 }
34192
34193-static struct configfs_item_operations pcie_gadget_target_item_ops = {
34194+static const struct configfs_item_operations pcie_gadget_target_item_ops = {
34195 .show_attribute = pcie_gadget_target_attr_show,
34196 .store_attribute = pcie_gadget_target_attr_store,
34197 };
34198diff -urNp linux-2.6.39.2/drivers/mmc/host/davinci_mmc.c linux-2.6.39.2/drivers/mmc/host/davinci_mmc.c
34199--- linux-2.6.39.2/drivers/mmc/host/davinci_mmc.c 2011-05-19 00:06:34.000000000 -0400
34200+++ linux-2.6.39.2/drivers/mmc/host/davinci_mmc.c 2011-05-22 19:36:31.000000000 -0400
34201@@ -1133,7 +1133,7 @@ static void mmc_davinci_enable_sdio_irq(
34202 }
34203 }
34204
34205-static struct mmc_host_ops mmc_davinci_ops = {
34206+static const struct mmc_host_ops mmc_davinci_ops = {
34207 .request = mmc_davinci_request,
34208 .set_ios = mmc_davinci_set_ios,
34209 .get_cd = mmc_davinci_get_cd,
34210diff -urNp linux-2.6.39.2/drivers/mmc/host/dw_mmc.c linux-2.6.39.2/drivers/mmc/host/dw_mmc.c
34211--- linux-2.6.39.2/drivers/mmc/host/dw_mmc.c 2011-05-19 00:06:34.000000000 -0400
34212+++ linux-2.6.39.2/drivers/mmc/host/dw_mmc.c 2011-05-22 19:36:31.000000000 -0400
34213@@ -417,7 +417,7 @@ static int dw_mci_idmac_init(struct dw_m
34214 return 0;
34215 }
34216
34217-static struct dw_mci_dma_ops dw_mci_idmac_ops = {
34218+static const struct dw_mci_dma_ops dw_mci_idmac_ops = {
34219 .init = dw_mci_idmac_init,
34220 .start = dw_mci_idmac_start_dma,
34221 .stop = dw_mci_idmac_stop_dma,
34222diff -urNp linux-2.6.39.2/drivers/mmc/host/s3cmci.c linux-2.6.39.2/drivers/mmc/host/s3cmci.c
34223--- linux-2.6.39.2/drivers/mmc/host/s3cmci.c 2011-05-19 00:06:34.000000000 -0400
34224+++ linux-2.6.39.2/drivers/mmc/host/s3cmci.c 2011-05-22 19:36:31.000000000 -0400
34225@@ -1349,7 +1349,7 @@ static void s3cmci_enable_sdio_irq(struc
34226 s3cmci_check_sdio_irq(host);
34227 }
34228
34229-static struct mmc_host_ops s3cmci_ops = {
34230+static const struct mmc_host_ops s3cmci_ops = {
34231 .request = s3cmci_request,
34232 .set_ios = s3cmci_set_ios,
34233 .get_ro = s3cmci_get_ro,
34234diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-cns3xxx.c linux-2.6.39.2/drivers/mmc/host/sdhci-cns3xxx.c
34235--- linux-2.6.39.2/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-19 00:06:34.000000000 -0400
34236+++ linux-2.6.39.2/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-22 19:36:31.000000000 -0400
34237@@ -81,7 +81,7 @@ out:
34238 host->clock = clock;
34239 }
34240
34241-static struct sdhci_ops sdhci_cns3xxx_ops = {
34242+static const struct sdhci_ops sdhci_cns3xxx_ops = {
34243 .get_max_clock = sdhci_cns3xxx_get_max_clk,
34244 .set_clock = sdhci_cns3xxx_set_clock,
34245 };
34246diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-dove.c linux-2.6.39.2/drivers/mmc/host/sdhci-dove.c
34247--- linux-2.6.39.2/drivers/mmc/host/sdhci-dove.c 2011-05-19 00:06:34.000000000 -0400
34248+++ linux-2.6.39.2/drivers/mmc/host/sdhci-dove.c 2011-05-22 19:36:31.000000000 -0400
34249@@ -56,7 +56,7 @@ static u32 sdhci_dove_readl(struct sdhci
34250 return ret;
34251 }
34252
34253-static struct sdhci_ops sdhci_dove_ops = {
34254+static const struct sdhci_ops sdhci_dove_ops = {
34255 .read_w = sdhci_dove_readw,
34256 .read_l = sdhci_dove_readl,
34257 };
34258diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-esdhc-imx.c linux-2.6.39.2/drivers/mmc/host/sdhci-esdhc-imx.c
34259--- linux-2.6.39.2/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-19 00:06:34.000000000 -0400
34260+++ linux-2.6.39.2/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-22 19:36:31.000000000 -0400
34261@@ -201,7 +201,7 @@ static unsigned int esdhc_pltfm_get_ro(s
34262 return -ENOSYS;
34263 }
34264
34265-static struct sdhci_ops sdhci_esdhc_ops = {
34266+static const struct sdhci_ops sdhci_esdhc_ops = {
34267 .read_l = esdhc_readl_le,
34268 .read_w = esdhc_readw_le,
34269 .write_l = esdhc_writel_le,
34270diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-of.h linux-2.6.39.2/drivers/mmc/host/sdhci-of.h
34271--- linux-2.6.39.2/drivers/mmc/host/sdhci-of.h 2011-05-19 00:06:34.000000000 -0400
34272+++ linux-2.6.39.2/drivers/mmc/host/sdhci-of.h 2011-05-22 19:36:31.000000000 -0400
34273@@ -21,7 +21,7 @@
34274
34275 struct sdhci_of_data {
34276 unsigned int quirks;
34277- struct sdhci_ops ops;
34278+ const struct sdhci_ops ops;
34279 };
34280
34281 struct sdhci_of_host {
34282diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-pci.c linux-2.6.39.2/drivers/mmc/host/sdhci-pci.c
34283--- linux-2.6.39.2/drivers/mmc/host/sdhci-pci.c 2011-05-19 00:06:34.000000000 -0400
34284+++ linux-2.6.39.2/drivers/mmc/host/sdhci-pci.c 2011-05-22 19:36:31.000000000 -0400
34285@@ -786,7 +786,7 @@ static int sdhci_pci_enable_dma(struct s
34286 return 0;
34287 }
34288
34289-static struct sdhci_ops sdhci_pci_ops = {
34290+static const struct sdhci_ops sdhci_pci_ops = {
34291 .enable_dma = sdhci_pci_enable_dma,
34292 };
34293
34294diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-pltfm.c linux-2.6.39.2/drivers/mmc/host/sdhci-pltfm.c
34295--- linux-2.6.39.2/drivers/mmc/host/sdhci-pltfm.c 2011-05-19 00:06:34.000000000 -0400
34296+++ linux-2.6.39.2/drivers/mmc/host/sdhci-pltfm.c 2011-05-22 19:36:31.000000000 -0400
34297@@ -41,7 +41,7 @@
34298 * *
34299 \*****************************************************************************/
34300
34301-static struct sdhci_ops sdhci_pltfm_ops = {
34302+static const struct sdhci_ops sdhci_pltfm_ops = {
34303 };
34304
34305 /*****************************************************************************\
34306diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-pxa.c linux-2.6.39.2/drivers/mmc/host/sdhci-pxa.c
34307--- linux-2.6.39.2/drivers/mmc/host/sdhci-pxa.c 2011-05-19 00:06:34.000000000 -0400
34308+++ linux-2.6.39.2/drivers/mmc/host/sdhci-pxa.c 2011-05-22 19:36:31.000000000 -0400
34309@@ -69,7 +69,7 @@ static void set_clock(struct sdhci_host
34310 }
34311 }
34312
34313-static struct sdhci_ops sdhci_pxa_ops = {
34314+static const struct sdhci_ops sdhci_pxa_ops = {
34315 .set_clock = set_clock,
34316 };
34317
34318diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-s3c.c linux-2.6.39.2/drivers/mmc/host/sdhci-s3c.c
34319--- linux-2.6.39.2/drivers/mmc/host/sdhci-s3c.c 2011-05-19 00:06:34.000000000 -0400
34320+++ linux-2.6.39.2/drivers/mmc/host/sdhci-s3c.c 2011-05-22 19:36:31.000000000 -0400
34321@@ -309,7 +309,7 @@ static int sdhci_s3c_platform_8bit_width
34322 return 0;
34323 }
34324
34325-static struct sdhci_ops sdhci_s3c_ops = {
34326+static const struct sdhci_ops sdhci_s3c_ops = {
34327 .get_max_clock = sdhci_s3c_get_max_clk,
34328 .set_clock = sdhci_s3c_set_clock,
34329 .get_min_clock = sdhci_s3c_get_min_clock,
34330diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-spear.c linux-2.6.39.2/drivers/mmc/host/sdhci-spear.c
34331--- linux-2.6.39.2/drivers/mmc/host/sdhci-spear.c 2011-05-19 00:06:34.000000000 -0400
34332+++ linux-2.6.39.2/drivers/mmc/host/sdhci-spear.c 2011-05-22 19:36:31.000000000 -0400
34333@@ -32,7 +32,7 @@ struct spear_sdhci {
34334 };
34335
34336 /* sdhci ops */
34337-static struct sdhci_ops sdhci_pltfm_ops = {
34338+static const struct sdhci_ops sdhci_pltfm_ops = {
34339 /* Nothing to do for now. */
34340 };
34341
34342diff -urNp linux-2.6.39.2/drivers/mmc/host/sdhci-tegra.c linux-2.6.39.2/drivers/mmc/host/sdhci-tegra.c
34343--- linux-2.6.39.2/drivers/mmc/host/sdhci-tegra.c 2011-05-19 00:06:34.000000000 -0400
34344+++ linux-2.6.39.2/drivers/mmc/host/sdhci-tegra.c 2011-05-22 19:36:31.000000000 -0400
34345@@ -242,7 +242,7 @@ static void tegra_sdhci_pltfm_exit(struc
34346 clk_put(pltfm_host->clk);
34347 }
34348
34349-static struct sdhci_ops tegra_sdhci_ops = {
34350+static const struct sdhci_ops tegra_sdhci_ops = {
34351 .get_ro = tegra_sdhci_get_ro,
34352 .read_l = tegra_sdhci_readl,
34353 .read_w = tegra_sdhci_readw,
34354diff -urNp linux-2.6.39.2/drivers/mmc/host/sdricoh_cs.c linux-2.6.39.2/drivers/mmc/host/sdricoh_cs.c
34355--- linux-2.6.39.2/drivers/mmc/host/sdricoh_cs.c 2011-05-19 00:06:34.000000000 -0400
34356+++ linux-2.6.39.2/drivers/mmc/host/sdricoh_cs.c 2011-05-22 19:36:31.000000000 -0400
34357@@ -387,7 +387,7 @@ static int sdricoh_get_ro(struct mmc_hos
34358 return (status & STATUS_CARD_LOCKED);
34359 }
34360
34361-static struct mmc_host_ops sdricoh_ops = {
34362+static const struct mmc_host_ops sdricoh_ops = {
34363 .request = sdricoh_request,
34364 .set_ios = sdricoh_set_ios,
34365 .get_ro = sdricoh_get_ro,
34366diff -urNp linux-2.6.39.2/drivers/mmc/host/sh_mmcif.c linux-2.6.39.2/drivers/mmc/host/sh_mmcif.c
34367--- linux-2.6.39.2/drivers/mmc/host/sh_mmcif.c 2011-05-19 00:06:34.000000000 -0400
34368+++ linux-2.6.39.2/drivers/mmc/host/sh_mmcif.c 2011-05-22 19:36:31.000000000 -0400
34369@@ -872,7 +872,7 @@ static int sh_mmcif_get_cd(struct mmc_ho
34370 return p->get_cd(host->pd);
34371 }
34372
34373-static struct mmc_host_ops sh_mmcif_ops = {
34374+static const struct mmc_host_ops sh_mmcif_ops = {
34375 .request = sh_mmcif_request,
34376 .set_ios = sh_mmcif_set_ios,
34377 .get_cd = sh_mmcif_get_cd,
34378diff -urNp linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0001.c
34379--- linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-19 00:06:34.000000000 -0400
34380+++ linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-22 19:36:31.000000000 -0400
34381@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
34382 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
34383 unsigned long timeo = jiffies + HZ;
34384
34385+ pax_track_stack();
34386+
34387 /* Prevent setting state FL_SYNCING for chip in suspended state. */
34388 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
34389 goto sleep;
34390@@ -1657,6 +1659,8 @@ static int __xipram do_write_buffer(stru
34391 unsigned long initial_adr;
34392 int initial_len = len;
34393
34394+ pax_track_stack();
34395+
34396 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
34397 adr += chip->start;
34398 initial_adr = adr;
34399@@ -1875,6 +1879,8 @@ static int __xipram do_erase_oneblock(st
34400 int retries = 3;
34401 int ret;
34402
34403+ pax_track_stack();
34404+
34405 adr += chip->start;
34406
34407 retry:
34408diff -urNp linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0020.c
34409--- linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-19 00:06:34.000000000 -0400
34410+++ linux-2.6.39.2/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-22 19:36:31.000000000 -0400
34411@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
34412 unsigned long cmd_addr;
34413 struct cfi_private *cfi = map->fldrv_priv;
34414
34415+ pax_track_stack();
34416+
34417 adr += chip->start;
34418
34419 /* Ensure cmd read/writes are aligned. */
34420@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
34421 DECLARE_WAITQUEUE(wait, current);
34422 int wbufsize, z;
34423
34424+ pax_track_stack();
34425+
34426 /* M58LW064A requires bus alignment for buffer wriets -- saw */
34427 if (adr & (map_bankwidth(map)-1))
34428 return -EINVAL;
34429@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
34430 DECLARE_WAITQUEUE(wait, current);
34431 int ret = 0;
34432
34433+ pax_track_stack();
34434+
34435 adr += chip->start;
34436
34437 /* Let's determine this according to the interleave only once */
34438@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
34439 unsigned long timeo = jiffies + HZ;
34440 DECLARE_WAITQUEUE(wait, current);
34441
34442+ pax_track_stack();
34443+
34444 adr += chip->start;
34445
34446 /* Let's determine this according to the interleave only once */
34447@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
34448 unsigned long timeo = jiffies + HZ;
34449 DECLARE_WAITQUEUE(wait, current);
34450
34451+ pax_track_stack();
34452+
34453 adr += chip->start;
34454
34455 /* Let's determine this according to the interleave only once */
34456diff -urNp linux-2.6.39.2/drivers/mtd/devices/doc2000.c linux-2.6.39.2/drivers/mtd/devices/doc2000.c
34457--- linux-2.6.39.2/drivers/mtd/devices/doc2000.c 2011-05-19 00:06:34.000000000 -0400
34458+++ linux-2.6.39.2/drivers/mtd/devices/doc2000.c 2011-05-22 19:36:31.000000000 -0400
34459@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
34460
34461 /* The ECC will not be calculated correctly if less than 512 is written */
34462 /* DBB-
34463- if (len != 0x200 && eccbuf)
34464+ if (len != 0x200)
34465 printk(KERN_WARNING
34466 "ECC needs a full sector write (adr: %lx size %lx)\n",
34467 (long) to, (long) len);
34468diff -urNp linux-2.6.39.2/drivers/mtd/devices/doc2001.c linux-2.6.39.2/drivers/mtd/devices/doc2001.c
34469--- linux-2.6.39.2/drivers/mtd/devices/doc2001.c 2011-05-19 00:06:34.000000000 -0400
34470+++ linux-2.6.39.2/drivers/mtd/devices/doc2001.c 2011-05-22 19:36:31.000000000 -0400
34471@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
34472 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
34473
34474 /* Don't allow read past end of device */
34475- if (from >= this->totlen)
34476+ if (from >= this->totlen || !len)
34477 return -EINVAL;
34478
34479 /* Don't allow a single read to cross a 512-byte block boundary */
34480diff -urNp linux-2.6.39.2/drivers/mtd/ftl.c linux-2.6.39.2/drivers/mtd/ftl.c
34481--- linux-2.6.39.2/drivers/mtd/ftl.c 2011-05-19 00:06:34.000000000 -0400
34482+++ linux-2.6.39.2/drivers/mtd/ftl.c 2011-05-22 19:36:31.000000000 -0400
34483@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
34484 loff_t offset;
34485 uint16_t srcunitswap = cpu_to_le16(srcunit);
34486
34487+ pax_track_stack();
34488+
34489 eun = &part->EUNInfo[srcunit];
34490 xfer = &part->XferInfo[xferunit];
34491 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
34492diff -urNp linux-2.6.39.2/drivers/mtd/inftlcore.c linux-2.6.39.2/drivers/mtd/inftlcore.c
34493--- linux-2.6.39.2/drivers/mtd/inftlcore.c 2011-05-19 00:06:34.000000000 -0400
34494+++ linux-2.6.39.2/drivers/mtd/inftlcore.c 2011-05-22 19:36:31.000000000 -0400
34495@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
34496 struct inftl_oob oob;
34497 size_t retlen;
34498
34499+ pax_track_stack();
34500+
34501 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
34502 "pending=%d)\n", inftl, thisVUC, pendingblock);
34503
34504diff -urNp linux-2.6.39.2/drivers/mtd/inftlmount.c linux-2.6.39.2/drivers/mtd/inftlmount.c
34505--- linux-2.6.39.2/drivers/mtd/inftlmount.c 2011-05-19 00:06:34.000000000 -0400
34506+++ linux-2.6.39.2/drivers/mtd/inftlmount.c 2011-05-22 19:36:31.000000000 -0400
34507@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
34508 struct INFTLPartition *ip;
34509 size_t retlen;
34510
34511+ pax_track_stack();
34512+
34513 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
34514
34515 /*
34516diff -urNp linux-2.6.39.2/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.39.2/drivers/mtd/lpddr/qinfo_probe.c
34517--- linux-2.6.39.2/drivers/mtd/lpddr/qinfo_probe.c 2011-05-19 00:06:34.000000000 -0400
34518+++ linux-2.6.39.2/drivers/mtd/lpddr/qinfo_probe.c 2011-05-22 19:36:31.000000000 -0400
34519@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
34520 {
34521 map_word pfow_val[4];
34522
34523+ pax_track_stack();
34524+
34525 /* Check identification string */
34526 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
34527 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
34528diff -urNp linux-2.6.39.2/drivers/mtd/mtdchar.c linux-2.6.39.2/drivers/mtd/mtdchar.c
34529--- linux-2.6.39.2/drivers/mtd/mtdchar.c 2011-05-19 00:06:34.000000000 -0400
34530+++ linux-2.6.39.2/drivers/mtd/mtdchar.c 2011-05-22 19:36:31.000000000 -0400
34531@@ -560,6 +560,8 @@ static int mtd_ioctl(struct file *file,
34532 u_long size;
34533 struct mtd_info_user info;
34534
34535+ pax_track_stack();
34536+
34537 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
34538
34539 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
34540diff -urNp linux-2.6.39.2/drivers/mtd/nand/denali.c linux-2.6.39.2/drivers/mtd/nand/denali.c
34541--- linux-2.6.39.2/drivers/mtd/nand/denali.c 2011-05-19 00:06:34.000000000 -0400
34542+++ linux-2.6.39.2/drivers/mtd/nand/denali.c 2011-05-22 19:36:31.000000000 -0400
34543@@ -25,6 +25,7 @@
34544 #include <linux/pci.h>
34545 #include <linux/mtd/mtd.h>
34546 #include <linux/module.h>
34547+#include <linux/slab.h>
34548
34549 #include "denali.h"
34550
34551diff -urNp linux-2.6.39.2/drivers/mtd/nftlcore.c linux-2.6.39.2/drivers/mtd/nftlcore.c
34552--- linux-2.6.39.2/drivers/mtd/nftlcore.c 2011-05-19 00:06:34.000000000 -0400
34553+++ linux-2.6.39.2/drivers/mtd/nftlcore.c 2011-05-22 19:36:31.000000000 -0400
34554@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
34555 int inplace = 1;
34556 size_t retlen;
34557
34558+ pax_track_stack();
34559+
34560 memset(BlockMap, 0xff, sizeof(BlockMap));
34561 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
34562
34563diff -urNp linux-2.6.39.2/drivers/mtd/nftlmount.c linux-2.6.39.2/drivers/mtd/nftlmount.c
34564--- linux-2.6.39.2/drivers/mtd/nftlmount.c 2011-05-19 00:06:34.000000000 -0400
34565+++ linux-2.6.39.2/drivers/mtd/nftlmount.c 2011-05-22 19:36:31.000000000 -0400
34566@@ -24,6 +24,7 @@
34567 #include <asm/errno.h>
34568 #include <linux/delay.h>
34569 #include <linux/slab.h>
34570+#include <linux/sched.h>
34571 #include <linux/mtd/mtd.h>
34572 #include <linux/mtd/nand.h>
34573 #include <linux/mtd/nftl.h>
34574@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
34575 struct mtd_info *mtd = nftl->mbd.mtd;
34576 unsigned int i;
34577
34578+ pax_track_stack();
34579+
34580 /* Assume logical EraseSize == physical erasesize for starting the scan.
34581 We'll sort it out later if we find a MediaHeader which says otherwise */
34582 /* Actually, we won't. The new DiskOnChip driver has already scanned
34583diff -urNp linux-2.6.39.2/drivers/mtd/ubi/build.c linux-2.6.39.2/drivers/mtd/ubi/build.c
34584--- linux-2.6.39.2/drivers/mtd/ubi/build.c 2011-05-19 00:06:34.000000000 -0400
34585+++ linux-2.6.39.2/drivers/mtd/ubi/build.c 2011-05-22 19:36:31.000000000 -0400
34586@@ -1287,7 +1287,7 @@ module_exit(ubi_exit);
34587 static int __init bytes_str_to_int(const char *str)
34588 {
34589 char *endp;
34590- unsigned long result;
34591+ unsigned long result, scale = 1;
34592
34593 result = simple_strtoul(str, &endp, 0);
34594 if (str == endp || result >= INT_MAX) {
34595@@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const
34596
34597 switch (*endp) {
34598 case 'G':
34599- result *= 1024;
34600+ scale *= 1024;
34601 case 'M':
34602- result *= 1024;
34603+ scale *= 1024;
34604 case 'K':
34605- result *= 1024;
34606+ scale *= 1024;
34607 if (endp[1] == 'i' && endp[2] == 'B')
34608 endp += 2;
34609 case '\0':
34610@@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const
34611 return -EINVAL;
34612 }
34613
34614- return result;
34615+ if ((intoverflow_t)result*scale >= INT_MAX) {
34616+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
34617+ str);
34618+ return -EINVAL;
34619+ }
34620+
34621+ return result*scale;
34622 }
34623
34624 /**
34625diff -urNp linux-2.6.39.2/drivers/net/bcm63xx_enet.c linux-2.6.39.2/drivers/net/bcm63xx_enet.c
34626--- linux-2.6.39.2/drivers/net/bcm63xx_enet.c 2011-05-19 00:06:34.000000000 -0400
34627+++ linux-2.6.39.2/drivers/net/bcm63xx_enet.c 2011-05-22 19:36:31.000000000 -0400
34628@@ -1469,7 +1469,7 @@ static int bcm_enet_set_pauseparam(struc
34629 return 0;
34630 }
34631
34632-static struct ethtool_ops bcm_enet_ethtool_ops = {
34633+static const struct ethtool_ops bcm_enet_ethtool_ops = {
34634 .get_strings = bcm_enet_get_strings,
34635 .get_sset_count = bcm_enet_get_sset_count,
34636 .get_ethtool_stats = bcm_enet_get_ethtool_stats,
34637diff -urNp linux-2.6.39.2/drivers/net/bna/bnad_ethtool.c linux-2.6.39.2/drivers/net/bna/bnad_ethtool.c
34638--- linux-2.6.39.2/drivers/net/bna/bnad_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34639+++ linux-2.6.39.2/drivers/net/bna/bnad_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34640@@ -1242,7 +1242,7 @@ bnad_get_sset_count(struct net_device *n
34641 }
34642 }
34643
34644-static struct ethtool_ops bnad_ethtool_ops = {
34645+static const struct ethtool_ops bnad_ethtool_ops = {
34646 .get_settings = bnad_get_settings,
34647 .set_settings = bnad_set_settings,
34648 .get_drvinfo = bnad_get_drvinfo,
34649diff -urNp linux-2.6.39.2/drivers/net/bnx2.c linux-2.6.39.2/drivers/net/bnx2.c
34650--- linux-2.6.39.2/drivers/net/bnx2.c 2011-05-19 00:06:34.000000000 -0400
34651+++ linux-2.6.39.2/drivers/net/bnx2.c 2011-05-22 19:36:31.000000000 -0400
34652@@ -5828,6 +5828,8 @@ bnx2_test_nvram(struct bnx2 *bp)
34653 int rc = 0;
34654 u32 magic, csum;
34655
34656+ pax_track_stack();
34657+
34658 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
34659 goto test_nvram_done;
34660
34661diff -urNp linux-2.6.39.2/drivers/net/bnx2x/bnx2x_ethtool.c linux-2.6.39.2/drivers/net/bnx2x/bnx2x_ethtool.c
34662--- linux-2.6.39.2/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34663+++ linux-2.6.39.2/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34664@@ -1788,6 +1788,8 @@ static int bnx2x_test_nvram(struct bnx2x
34665 int i, rc;
34666 u32 magic, crc;
34667
34668+ pax_track_stack();
34669+
34670 if (BP_NOMCP(bp))
34671 return 0;
34672
34673diff -urNp linux-2.6.39.2/drivers/net/chelsio/pm3393.c linux-2.6.39.2/drivers/net/chelsio/pm3393.c
34674--- linux-2.6.39.2/drivers/net/chelsio/pm3393.c 2011-05-19 00:06:34.000000000 -0400
34675+++ linux-2.6.39.2/drivers/net/chelsio/pm3393.c 2011-05-22 19:36:31.000000000 -0400
34676@@ -571,7 +571,7 @@ static void pm3393_destroy(struct cmac *
34677 kfree(cmac);
34678 }
34679
34680-static struct cmac_ops pm3393_ops = {
34681+static const struct cmac_ops pm3393_ops = {
34682 .destroy = pm3393_destroy,
34683 .reset = pm3393_reset,
34684 .interrupt_enable = pm3393_interrupt_enable,
34685diff -urNp linux-2.6.39.2/drivers/net/chelsio/vsc7326.c linux-2.6.39.2/drivers/net/chelsio/vsc7326.c
34686--- linux-2.6.39.2/drivers/net/chelsio/vsc7326.c 2011-05-19 00:06:34.000000000 -0400
34687+++ linux-2.6.39.2/drivers/net/chelsio/vsc7326.c 2011-05-22 19:36:31.000000000 -0400
34688@@ -666,7 +666,7 @@ static void mac_destroy(struct cmac *mac
34689 kfree(mac);
34690 }
34691
34692-static struct cmac_ops vsc7326_ops = {
34693+static const struct cmac_ops vsc7326_ops = {
34694 .destroy = mac_destroy,
34695 .reset = mac_reset,
34696 .interrupt_handler = mac_intr_handler,
34697diff -urNp linux-2.6.39.2/drivers/net/cxgb4/cxgb4_main.c linux-2.6.39.2/drivers/net/cxgb4/cxgb4_main.c
34698--- linux-2.6.39.2/drivers/net/cxgb4/cxgb4_main.c 2011-05-19 00:06:34.000000000 -0400
34699+++ linux-2.6.39.2/drivers/net/cxgb4/cxgb4_main.c 2011-05-22 19:36:31.000000000 -0400
34700@@ -3428,6 +3428,8 @@ static int __devinit enable_msix(struct
34701 unsigned int nchan = adap->params.nports;
34702 struct msix_entry entries[MAX_INGQ + 1];
34703
34704+ pax_track_stack();
34705+
34706 for (i = 0; i < ARRAY_SIZE(entries); ++i)
34707 entries[i].entry = i;
34708
34709diff -urNp linux-2.6.39.2/drivers/net/cxgb4/t4_hw.c linux-2.6.39.2/drivers/net/cxgb4/t4_hw.c
34710--- linux-2.6.39.2/drivers/net/cxgb4/t4_hw.c 2011-05-19 00:06:34.000000000 -0400
34711+++ linux-2.6.39.2/drivers/net/cxgb4/t4_hw.c 2011-05-22 19:36:31.000000000 -0400
34712@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
34713 u8 vpd[VPD_LEN], csum;
34714 unsigned int vpdr_len, kw_offset, id_len;
34715
34716+ pax_track_stack();
34717+
34718 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
34719 if (ret < 0)
34720 return ret;
34721diff -urNp linux-2.6.39.2/drivers/net/cxgb4vf/cxgb4vf_main.c linux-2.6.39.2/drivers/net/cxgb4vf/cxgb4vf_main.c
34722--- linux-2.6.39.2/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-19 00:06:34.000000000 -0400
34723+++ linux-2.6.39.2/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-22 19:36:31.000000000 -0400
34724@@ -1572,7 +1572,7 @@ static int cxgb4vf_set_tso(struct net_de
34725 return 0;
34726 }
34727
34728-static struct ethtool_ops cxgb4vf_ethtool_ops = {
34729+static const struct ethtool_ops cxgb4vf_ethtool_ops = {
34730 .get_settings = cxgb4vf_get_settings,
34731 .get_drvinfo = cxgb4vf_get_drvinfo,
34732 .get_msglevel = cxgb4vf_get_msglevel,
34733diff -urNp linux-2.6.39.2/drivers/net/e1000e/82571.c linux-2.6.39.2/drivers/net/e1000e/82571.c
34734--- linux-2.6.39.2/drivers/net/e1000e/82571.c 2011-05-19 00:06:34.000000000 -0400
34735+++ linux-2.6.39.2/drivers/net/e1000e/82571.c 2011-05-22 19:36:31.000000000 -0400
34736@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
34737 {
34738 struct e1000_hw *hw = &adapter->hw;
34739 struct e1000_mac_info *mac = &hw->mac;
34740- struct e1000_mac_operations *func = &mac->ops;
34741+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34742 u32 swsm = 0;
34743 u32 swsm2 = 0;
34744 bool force_clear_smbi = false;
34745@@ -1930,7 +1930,7 @@ static void e1000_clear_hw_cntrs_82571(s
34746 er32(ICRXDMTC);
34747 }
34748
34749-static struct e1000_mac_operations e82571_mac_ops = {
34750+static const struct e1000_mac_operations e82571_mac_ops = {
34751 /* .check_mng_mode: mac type dependent */
34752 /* .check_for_link: media type dependent */
34753 .id_led_init = e1000e_id_led_init,
34754@@ -1952,7 +1952,7 @@ static struct e1000_mac_operations e8257
34755 .read_mac_addr = e1000_read_mac_addr_82571,
34756 };
34757
34758-static struct e1000_phy_operations e82_phy_ops_igp = {
34759+static const struct e1000_phy_operations e82_phy_ops_igp = {
34760 .acquire = e1000_get_hw_semaphore_82571,
34761 .check_polarity = e1000_check_polarity_igp,
34762 .check_reset_block = e1000e_check_reset_block_generic,
34763@@ -1970,7 +1970,7 @@ static struct e1000_phy_operations e82_p
34764 .cfg_on_link_up = NULL,
34765 };
34766
34767-static struct e1000_phy_operations e82_phy_ops_m88 = {
34768+static const struct e1000_phy_operations e82_phy_ops_m88 = {
34769 .acquire = e1000_get_hw_semaphore_82571,
34770 .check_polarity = e1000_check_polarity_m88,
34771 .check_reset_block = e1000e_check_reset_block_generic,
34772@@ -1988,7 +1988,7 @@ static struct e1000_phy_operations e82_p
34773 .cfg_on_link_up = NULL,
34774 };
34775
34776-static struct e1000_phy_operations e82_phy_ops_bm = {
34777+static const struct e1000_phy_operations e82_phy_ops_bm = {
34778 .acquire = e1000_get_hw_semaphore_82571,
34779 .check_polarity = e1000_check_polarity_m88,
34780 .check_reset_block = e1000e_check_reset_block_generic,
34781@@ -2006,7 +2006,7 @@ static struct e1000_phy_operations e82_p
34782 .cfg_on_link_up = NULL,
34783 };
34784
34785-static struct e1000_nvm_operations e82571_nvm_ops = {
34786+static const struct e1000_nvm_operations e82571_nvm_ops = {
34787 .acquire = e1000_acquire_nvm_82571,
34788 .read = e1000e_read_nvm_eerd,
34789 .release = e1000_release_nvm_82571,
34790diff -urNp linux-2.6.39.2/drivers/net/e1000e/e1000.h linux-2.6.39.2/drivers/net/e1000e/e1000.h
34791--- linux-2.6.39.2/drivers/net/e1000e/e1000.h 2011-05-19 00:06:34.000000000 -0400
34792+++ linux-2.6.39.2/drivers/net/e1000e/e1000.h 2011-05-22 19:36:31.000000000 -0400
34793@@ -409,9 +409,9 @@ struct e1000_info {
34794 u32 pba;
34795 u32 max_hw_frame_size;
34796 s32 (*get_variants)(struct e1000_adapter *);
34797- struct e1000_mac_operations *mac_ops;
34798- struct e1000_phy_operations *phy_ops;
34799- struct e1000_nvm_operations *nvm_ops;
34800+ const struct e1000_mac_operations *mac_ops;
34801+ const struct e1000_phy_operations *phy_ops;
34802+ const struct e1000_nvm_operations *nvm_ops;
34803 };
34804
34805 /* hardware capability, feature, and workaround flags */
34806diff -urNp linux-2.6.39.2/drivers/net/e1000e/es2lan.c linux-2.6.39.2/drivers/net/e1000e/es2lan.c
34807--- linux-2.6.39.2/drivers/net/e1000e/es2lan.c 2011-05-19 00:06:34.000000000 -0400
34808+++ linux-2.6.39.2/drivers/net/e1000e/es2lan.c 2011-05-22 19:36:31.000000000 -0400
34809@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
34810 {
34811 struct e1000_hw *hw = &adapter->hw;
34812 struct e1000_mac_info *mac = &hw->mac;
34813- struct e1000_mac_operations *func = &mac->ops;
34814+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34815
34816 /* Set media type */
34817 switch (adapter->pdev->device) {
34818@@ -1431,7 +1431,7 @@ static void e1000_clear_hw_cntrs_80003es
34819 er32(ICRXDMTC);
34820 }
34821
34822-static struct e1000_mac_operations es2_mac_ops = {
34823+static const struct e1000_mac_operations es2_mac_ops = {
34824 .read_mac_addr = e1000_read_mac_addr_80003es2lan,
34825 .id_led_init = e1000e_id_led_init,
34826 .check_mng_mode = e1000e_check_mng_mode_generic,
34827@@ -1453,7 +1453,7 @@ static struct e1000_mac_operations es2_m
34828 .setup_led = e1000e_setup_led_generic,
34829 };
34830
34831-static struct e1000_phy_operations es2_phy_ops = {
34832+static const struct e1000_phy_operations es2_phy_ops = {
34833 .acquire = e1000_acquire_phy_80003es2lan,
34834 .check_polarity = e1000_check_polarity_m88,
34835 .check_reset_block = e1000e_check_reset_block_generic,
34836@@ -1471,7 +1471,7 @@ static struct e1000_phy_operations es2_p
34837 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
34838 };
34839
34840-static struct e1000_nvm_operations es2_nvm_ops = {
34841+static const struct e1000_nvm_operations es2_nvm_ops = {
34842 .acquire = e1000_acquire_nvm_80003es2lan,
34843 .read = e1000e_read_nvm_eerd,
34844 .release = e1000_release_nvm_80003es2lan,
34845diff -urNp linux-2.6.39.2/drivers/net/e1000e/hw.h linux-2.6.39.2/drivers/net/e1000e/hw.h
34846--- linux-2.6.39.2/drivers/net/e1000e/hw.h 2011-05-19 00:06:34.000000000 -0400
34847+++ linux-2.6.39.2/drivers/net/e1000e/hw.h 2011-05-22 19:36:31.000000000 -0400
34848@@ -811,6 +811,7 @@ struct e1000_nvm_operations {
34849 };
34850
34851 struct e1000_mac_info {
34852+ /* cannot be const see e1000_init_mac_params_ich8lan */
34853 struct e1000_mac_operations ops;
34854 u8 addr[ETH_ALEN];
34855 u8 perm_addr[ETH_ALEN];
34856@@ -852,6 +853,7 @@ struct e1000_mac_info {
34857 };
34858
34859 struct e1000_phy_info {
34860+ /* Cannot be const see e1000_init_phy_params_82571() */
34861 struct e1000_phy_operations ops;
34862
34863 enum e1000_phy_type type;
34864@@ -886,6 +888,7 @@ struct e1000_phy_info {
34865 };
34866
34867 struct e1000_nvm_info {
34868+ /* cannot be const */
34869 struct e1000_nvm_operations ops;
34870
34871 enum e1000_nvm_type type;
34872diff -urNp linux-2.6.39.2/drivers/net/e1000e/ich8lan.c linux-2.6.39.2/drivers/net/e1000e/ich8lan.c
34873--- linux-2.6.39.2/drivers/net/e1000e/ich8lan.c 2011-05-19 00:06:34.000000000 -0400
34874+++ linux-2.6.39.2/drivers/net/e1000e/ich8lan.c 2011-05-22 19:36:31.000000000 -0400
34875@@ -3866,7 +3866,7 @@ static void e1000_clear_hw_cntrs_ich8lan
34876 }
34877 }
34878
34879-static struct e1000_mac_operations ich8_mac_ops = {
34880+static const struct e1000_mac_operations ich8_mac_ops = {
34881 .id_led_init = e1000e_id_led_init,
34882 /* check_mng_mode dependent on mac type */
34883 .check_for_link = e1000_check_for_copper_link_ich8lan,
34884@@ -3885,7 +3885,7 @@ static struct e1000_mac_operations ich8_
34885 /* id_led_init dependent on mac type */
34886 };
34887
34888-static struct e1000_phy_operations ich8_phy_ops = {
34889+static const struct e1000_phy_operations ich8_phy_ops = {
34890 .acquire = e1000_acquire_swflag_ich8lan,
34891 .check_reset_block = e1000_check_reset_block_ich8lan,
34892 .commit = NULL,
34893@@ -3899,7 +3899,7 @@ static struct e1000_phy_operations ich8_
34894 .write_reg = e1000e_write_phy_reg_igp,
34895 };
34896
34897-static struct e1000_nvm_operations ich8_nvm_ops = {
34898+static const struct e1000_nvm_operations ich8_nvm_ops = {
34899 .acquire = e1000_acquire_nvm_ich8lan,
34900 .read = e1000_read_nvm_ich8lan,
34901 .release = e1000_release_nvm_ich8lan,
34902diff -urNp linux-2.6.39.2/drivers/net/greth.c linux-2.6.39.2/drivers/net/greth.c
34903--- linux-2.6.39.2/drivers/net/greth.c 2011-05-19 00:06:34.000000000 -0400
34904+++ linux-2.6.39.2/drivers/net/greth.c 2011-05-22 19:36:31.000000000 -0400
34905@@ -1192,7 +1192,7 @@ static const struct ethtool_ops greth_et
34906 .get_link = ethtool_op_get_link,
34907 };
34908
34909-static struct net_device_ops greth_netdev_ops = {
34910+static const struct net_device_ops greth_netdev_ops = {
34911 .ndo_open = greth_open,
34912 .ndo_stop = greth_close,
34913 .ndo_start_xmit = greth_start_xmit,
34914diff -urNp linux-2.6.39.2/drivers/net/hamradio/6pack.c linux-2.6.39.2/drivers/net/hamradio/6pack.c
34915--- linux-2.6.39.2/drivers/net/hamradio/6pack.c 2011-05-19 00:06:34.000000000 -0400
34916+++ linux-2.6.39.2/drivers/net/hamradio/6pack.c 2011-05-22 19:36:31.000000000 -0400
34917@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
34918 unsigned char buf[512];
34919 int count1;
34920
34921+ pax_track_stack();
34922+
34923 if (!count)
34924 return;
34925
34926diff -urNp linux-2.6.39.2/drivers/net/ibm_newemac/phy.c linux-2.6.39.2/drivers/net/ibm_newemac/phy.c
34927--- linux-2.6.39.2/drivers/net/ibm_newemac/phy.c 2011-05-19 00:06:34.000000000 -0400
34928+++ linux-2.6.39.2/drivers/net/ibm_newemac/phy.c 2011-05-22 19:36:31.000000000 -0400
34929@@ -273,7 +273,7 @@ static int genmii_read_link(struct mii_p
34930 }
34931
34932 /* Generic implementation for most 10/100/1000 PHYs */
34933-static struct mii_phy_ops generic_phy_ops = {
34934+static const struct mii_phy_ops generic_phy_ops = {
34935 .setup_aneg = genmii_setup_aneg,
34936 .setup_forced = genmii_setup_forced,
34937 .poll_link = genmii_poll_link,
34938@@ -337,7 +337,7 @@ static int cis8201_init(struct mii_phy *
34939 return 0;
34940 }
34941
34942-static struct mii_phy_ops cis8201_phy_ops = {
34943+static const struct mii_phy_ops cis8201_phy_ops = {
34944 .init = cis8201_init,
34945 .setup_aneg = genmii_setup_aneg,
34946 .setup_forced = genmii_setup_forced,
34947@@ -417,7 +417,7 @@ static int et1011c_init(struct mii_phy *
34948 return 0;
34949 }
34950
34951-static struct mii_phy_ops et1011c_phy_ops = {
34952+static const struct mii_phy_ops et1011c_phy_ops = {
34953 .init = et1011c_init,
34954 .setup_aneg = genmii_setup_aneg,
34955 .setup_forced = genmii_setup_forced,
34956@@ -436,7 +436,7 @@ static struct mii_phy_def et1011c_phy_de
34957
34958
34959
34960-static struct mii_phy_ops m88e1111_phy_ops = {
34961+static const struct mii_phy_ops m88e1111_phy_ops = {
34962 .init = m88e1111_init,
34963 .setup_aneg = genmii_setup_aneg,
34964 .setup_forced = genmii_setup_forced,
34965@@ -452,7 +452,7 @@ static struct mii_phy_def m88e1111_phy_d
34966 .ops = &m88e1111_phy_ops,
34967 };
34968
34969-static struct mii_phy_ops m88e1112_phy_ops = {
34970+static const struct mii_phy_ops m88e1112_phy_ops = {
34971 .init = m88e1112_init,
34972 .setup_aneg = genmii_setup_aneg,
34973 .setup_forced = genmii_setup_forced,
34974diff -urNp linux-2.6.39.2/drivers/net/ibmveth.c linux-2.6.39.2/drivers/net/ibmveth.c
34975--- linux-2.6.39.2/drivers/net/ibmveth.c 2011-05-19 00:06:34.000000000 -0400
34976+++ linux-2.6.39.2/drivers/net/ibmveth.c 2011-05-22 19:36:31.000000000 -0400
34977@@ -1625,7 +1625,7 @@ static struct vio_device_id ibmveth_devi
34978 };
34979 MODULE_DEVICE_TABLE(vio, ibmveth_device_table);
34980
34981-static struct dev_pm_ops ibmveth_pm_ops = {
34982+static const struct dev_pm_ops ibmveth_pm_ops = {
34983 .resume = ibmveth_resume
34984 };
34985
34986diff -urNp linux-2.6.39.2/drivers/net/igb/e1000_82575.c linux-2.6.39.2/drivers/net/igb/e1000_82575.c
34987--- linux-2.6.39.2/drivers/net/igb/e1000_82575.c 2011-05-19 00:06:34.000000000 -0400
34988+++ linux-2.6.39.2/drivers/net/igb/e1000_82575.c 2011-05-22 19:36:31.000000000 -0400
34989@@ -2029,7 +2029,7 @@ out:
34990 return ret_val;
34991 }
34992
34993-static struct e1000_mac_operations e1000_mac_ops_82575 = {
34994+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
34995 .init_hw = igb_init_hw_82575,
34996 .check_for_link = igb_check_for_link_82575,
34997 .rar_set = igb_rar_set,
34998@@ -2037,13 +2037,13 @@ static struct e1000_mac_operations e1000
34999 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
35000 };
35001
35002-static struct e1000_phy_operations e1000_phy_ops_82575 = {
35003+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
35004 .acquire = igb_acquire_phy_82575,
35005 .get_cfg_done = igb_get_cfg_done_82575,
35006 .release = igb_release_phy_82575,
35007 };
35008
35009-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
35010+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
35011 .acquire = igb_acquire_nvm_82575,
35012 .read = igb_read_nvm_eerd,
35013 .release = igb_release_nvm_82575,
35014diff -urNp linux-2.6.39.2/drivers/net/igb/e1000_hw.h linux-2.6.39.2/drivers/net/igb/e1000_hw.h
35015--- linux-2.6.39.2/drivers/net/igb/e1000_hw.h 2011-05-19 00:06:34.000000000 -0400
35016+++ linux-2.6.39.2/drivers/net/igb/e1000_hw.h 2011-05-22 19:36:31.000000000 -0400
35017@@ -342,14 +342,15 @@ struct e1000_nvm_operations {
35018
35019 struct e1000_info {
35020 s32 (*get_invariants)(struct e1000_hw *);
35021- struct e1000_mac_operations *mac_ops;
35022- struct e1000_phy_operations *phy_ops;
35023- struct e1000_nvm_operations *nvm_ops;
35024+ const struct e1000_mac_operations *mac_ops;
35025+ const struct e1000_phy_operations *phy_ops;
35026+ const struct e1000_nvm_operations *nvm_ops;
35027 };
35028
35029 extern const struct e1000_info e1000_82575_info;
35030
35031 struct e1000_mac_info {
35032+ /* cannot be const see igb_get_invariants_82575() */
35033 struct e1000_mac_operations ops;
35034
35035 u8 addr[6];
35036@@ -388,6 +389,7 @@ struct e1000_mac_info {
35037 };
35038
35039 struct e1000_phy_info {
35040+ /* cannot be const see igb_get_invariants_82575() */
35041 struct e1000_phy_operations ops;
35042
35043 enum e1000_phy_type type;
35044@@ -423,6 +425,7 @@ struct e1000_phy_info {
35045 };
35046
35047 struct e1000_nvm_info {
35048+ /* cannot be const */
35049 struct e1000_nvm_operations ops;
35050 enum e1000_nvm_type type;
35051 enum e1000_nvm_override override;
35052diff -urNp linux-2.6.39.2/drivers/net/igbvf/vf.h linux-2.6.39.2/drivers/net/igbvf/vf.h
35053--- linux-2.6.39.2/drivers/net/igbvf/vf.h 2011-05-19 00:06:34.000000000 -0400
35054+++ linux-2.6.39.2/drivers/net/igbvf/vf.h 2011-05-22 19:36:31.000000000 -0400
35055@@ -191,6 +191,7 @@ struct e1000_mac_operations {
35056 };
35057
35058 struct e1000_mac_info {
35059+ /* cannot be const see e1000_init_mac_params_vf() */
35060 struct e1000_mac_operations ops;
35061 u8 addr[6];
35062 u8 perm_addr[6];
35063diff -urNp linux-2.6.39.2/drivers/net/irda/sh_irda.c linux-2.6.39.2/drivers/net/irda/sh_irda.c
35064--- linux-2.6.39.2/drivers/net/irda/sh_irda.c 2011-05-19 00:06:34.000000000 -0400
35065+++ linux-2.6.39.2/drivers/net/irda/sh_irda.c 2011-05-22 19:36:31.000000000 -0400
35066@@ -307,7 +307,7 @@ static int xir_fte(struct sh_irda_self *
35067 return 0;
35068 }
35069
35070-static struct sh_irda_xir_func xir_func = {
35071+static const struct sh_irda_xir_func xir_func = {
35072 .xir_fre = xir_fre,
35073 .xir_trov = xir_trov,
35074 .xir_9 = xir_9,
35075@@ -321,7 +321,7 @@ static struct sh_irda_xir_func xir_func
35076 *
35077 * MIR/FIR are not supported now
35078 *=====================================*/
35079-static struct sh_irda_xir_func mfir_func = {
35080+static const struct sh_irda_xir_func mfir_func = {
35081 .xir_fre = xir_fre,
35082 .xir_trov = xir_trov,
35083 .xir_9 = xir_9,
35084@@ -400,7 +400,7 @@ static int sir_fte(struct sh_irda_self *
35085 return 0;
35086 }
35087
35088-static struct sh_irda_xir_func sir_func = {
35089+static const struct sh_irda_xir_func sir_func = {
35090 .xir_fre = sir_fre,
35091 .xir_trov = sir_trov,
35092 .xir_9 = sir_tot,
35093@@ -411,7 +411,7 @@ static struct sh_irda_xir_func sir_func
35094 static void sh_irda_set_mode(struct sh_irda_self *self, enum sh_irda_mode mode)
35095 {
35096 struct device *dev = &self->ndev->dev;
35097- struct sh_irda_xir_func *func;
35098+ const struct sh_irda_xir_func *func;
35099 const char *name;
35100 u16 data;
35101
35102diff -urNp linux-2.6.39.2/drivers/net/ixgb/ixgb_main.c linux-2.6.39.2/drivers/net/ixgb/ixgb_main.c
35103--- linux-2.6.39.2/drivers/net/ixgb/ixgb_main.c 2011-05-19 00:06:34.000000000 -0400
35104+++ linux-2.6.39.2/drivers/net/ixgb/ixgb_main.c 2011-05-22 19:36:31.000000000 -0400
35105@@ -1069,6 +1069,8 @@ ixgb_set_multi(struct net_device *netdev
35106 u32 rctl;
35107 int i;
35108
35109+ pax_track_stack();
35110+
35111 /* Check for Promiscuous and All Multicast modes */
35112
35113 rctl = IXGB_READ_REG(hw, RCTL);
35114diff -urNp linux-2.6.39.2/drivers/net/ixgb/ixgb_param.c linux-2.6.39.2/drivers/net/ixgb/ixgb_param.c
35115--- linux-2.6.39.2/drivers/net/ixgb/ixgb_param.c 2011-05-19 00:06:34.000000000 -0400
35116+++ linux-2.6.39.2/drivers/net/ixgb/ixgb_param.c 2011-05-22 19:36:31.000000000 -0400
35117@@ -261,6 +261,9 @@ void __devinit
35118 ixgb_check_options(struct ixgb_adapter *adapter)
35119 {
35120 int bd = adapter->bd_number;
35121+
35122+ pax_track_stack();
35123+
35124 if (bd >= IXGB_MAX_NIC) {
35125 pr_notice("Warning: no configuration for board #%i\n", bd);
35126 pr_notice("Using defaults for all values\n");
35127diff -urNp linux-2.6.39.2/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.39.2/drivers/net/ixgbe/ixgbe_82599.c
35128--- linux-2.6.39.2/drivers/net/ixgbe/ixgbe_82599.c 2011-05-19 00:06:34.000000000 -0400
35129+++ linux-2.6.39.2/drivers/net/ixgbe/ixgbe_82599.c 2011-05-22 19:36:31.000000000 -0400
35130@@ -2099,7 +2099,7 @@ static struct ixgbe_phy_operations phy_o
35131 .check_overtemp = &ixgbe_tn_check_overtemp,
35132 };
35133
35134-struct ixgbe_info ixgbe_82599_info = {
35135+const struct ixgbe_info ixgbe_82599_info = {
35136 .mac = ixgbe_mac_82599EB,
35137 .get_invariants = &ixgbe_get_invariants_82599,
35138 .mac_ops = &mac_ops_82599,
35139diff -urNp linux-2.6.39.2/drivers/net/ixgbe/ixgbe.h linux-2.6.39.2/drivers/net/ixgbe/ixgbe.h
35140--- linux-2.6.39.2/drivers/net/ixgbe/ixgbe.h 2011-05-19 00:06:34.000000000 -0400
35141+++ linux-2.6.39.2/drivers/net/ixgbe/ixgbe.h 2011-05-22 19:36:31.000000000 -0400
35142@@ -493,8 +493,8 @@ enum ixgbe_boards {
35143 };
35144
35145 extern struct ixgbe_info ixgbe_82598_info;
35146-extern struct ixgbe_info ixgbe_82599_info;
35147-extern struct ixgbe_info ixgbe_X540_info;
35148+extern const struct ixgbe_info ixgbe_82599_info;
35149+extern const struct ixgbe_info ixgbe_X540_info;
35150 #ifdef CONFIG_IXGBE_DCB
35151 extern const struct dcbnl_rtnl_ops dcbnl_ops;
35152 extern int ixgbe_copy_dcb_cfg(struct ixgbe_dcb_config *src_dcb_cfg,
35153diff -urNp linux-2.6.39.2/drivers/net/ixgbe/ixgbe_x540.c linux-2.6.39.2/drivers/net/ixgbe/ixgbe_x540.c
35154--- linux-2.6.39.2/drivers/net/ixgbe/ixgbe_x540.c 2011-05-19 00:06:34.000000000 -0400
35155+++ linux-2.6.39.2/drivers/net/ixgbe/ixgbe_x540.c 2011-05-22 19:36:31.000000000 -0400
35156@@ -727,7 +727,7 @@ static struct ixgbe_phy_operations phy_o
35157 .check_overtemp = &ixgbe_tn_check_overtemp,
35158 };
35159
35160-struct ixgbe_info ixgbe_X540_info = {
35161+const struct ixgbe_info ixgbe_X540_info = {
35162 .mac = ixgbe_mac_X540,
35163 .get_invariants = &ixgbe_get_invariants_X540,
35164 .mac_ops = &mac_ops_X540,
35165diff -urNp linux-2.6.39.2/drivers/net/ixgbevf/ethtool.c linux-2.6.39.2/drivers/net/ixgbevf/ethtool.c
35166--- linux-2.6.39.2/drivers/net/ixgbevf/ethtool.c 2011-05-19 00:06:34.000000000 -0400
35167+++ linux-2.6.39.2/drivers/net/ixgbevf/ethtool.c 2011-05-22 19:36:31.000000000 -0400
35168@@ -709,7 +709,7 @@ static int ixgbevf_nway_reset(struct net
35169 return 0;
35170 }
35171
35172-static struct ethtool_ops ixgbevf_ethtool_ops = {
35173+static const struct ethtool_ops ixgbevf_ethtool_ops = {
35174 .get_settings = ixgbevf_get_settings,
35175 .get_drvinfo = ixgbevf_get_drvinfo,
35176 .get_regs_len = ixgbevf_get_regs_len,
35177diff -urNp linux-2.6.39.2/drivers/net/ixgbevf/ixgbevf.h linux-2.6.39.2/drivers/net/ixgbevf/ixgbevf.h
35178--- linux-2.6.39.2/drivers/net/ixgbevf/ixgbevf.h 2011-05-19 00:06:34.000000000 -0400
35179+++ linux-2.6.39.2/drivers/net/ixgbevf/ixgbevf.h 2011-05-22 19:36:31.000000000 -0400
35180@@ -279,7 +279,7 @@ enum ixgbevf_boards {
35181
35182 extern struct ixgbevf_info ixgbevf_82599_vf_info;
35183 extern struct ixgbevf_info ixgbevf_X540_vf_info;
35184-extern struct ixgbe_mac_operations ixgbevf_mbx_ops;
35185+extern const struct ixgbe_mac_operations ixgbevf_mbx_ops;
35186
35187 /* needed by ethtool.c */
35188 extern char ixgbevf_driver_name[];
35189diff -urNp linux-2.6.39.2/drivers/net/ixgbevf/vf.c linux-2.6.39.2/drivers/net/ixgbevf/vf.c
35190--- linux-2.6.39.2/drivers/net/ixgbevf/vf.c 2011-05-19 00:06:34.000000000 -0400
35191+++ linux-2.6.39.2/drivers/net/ixgbevf/vf.c 2011-05-22 19:36:31.000000000 -0400
35192@@ -368,7 +368,7 @@ static s32 ixgbevf_check_mac_link_vf(str
35193 return 0;
35194 }
35195
35196-static struct ixgbe_mac_operations ixgbevf_mac_ops = {
35197+static const struct ixgbe_mac_operations ixgbevf_mac_ops = {
35198 .init_hw = ixgbevf_init_hw_vf,
35199 .reset_hw = ixgbevf_reset_hw_vf,
35200 .start_hw = ixgbevf_start_hw_vf,
35201@@ -381,12 +381,12 @@ static struct ixgbe_mac_operations ixgbe
35202 .set_vfta = ixgbevf_set_vfta_vf,
35203 };
35204
35205-struct ixgbevf_info ixgbevf_82599_vf_info = {
35206+const struct ixgbevf_info ixgbevf_82599_vf_info = {
35207 .mac = ixgbe_mac_82599_vf,
35208 .mac_ops = &ixgbevf_mac_ops,
35209 };
35210
35211-struct ixgbevf_info ixgbevf_X540_vf_info = {
35212+const struct ixgbevf_info ixgbevf_X540_vf_info = {
35213 .mac = ixgbe_mac_X540_vf,
35214 .mac_ops = &ixgbevf_mac_ops,
35215 };
35216diff -urNp linux-2.6.39.2/drivers/net/ixgbevf/vf.h linux-2.6.39.2/drivers/net/ixgbevf/vf.h
35217--- linux-2.6.39.2/drivers/net/ixgbevf/vf.h 2011-05-19 00:06:34.000000000 -0400
35218+++ linux-2.6.39.2/drivers/net/ixgbevf/vf.h 2011-05-22 19:36:31.000000000 -0400
35219@@ -166,7 +166,7 @@ struct ixgbevf_hw_stats {
35220
35221 struct ixgbevf_info {
35222 enum ixgbe_mac_type mac;
35223- struct ixgbe_mac_operations *mac_ops;
35224+ const struct ixgbe_mac_operations *mac_ops;
35225 };
35226
35227 #endif /* __IXGBE_VF_H__ */
35228diff -urNp linux-2.6.39.2/drivers/net/ksz884x.c linux-2.6.39.2/drivers/net/ksz884x.c
35229--- linux-2.6.39.2/drivers/net/ksz884x.c 2011-05-19 00:06:34.000000000 -0400
35230+++ linux-2.6.39.2/drivers/net/ksz884x.c 2011-05-22 19:36:31.000000000 -0400
35231@@ -6536,6 +6536,8 @@ static void netdev_get_ethtool_stats(str
35232 int rc;
35233 u64 counter[TOTAL_PORT_COUNTER_NUM];
35234
35235+ pax_track_stack();
35236+
35237 mutex_lock(&hw_priv->lock);
35238 n = SWITCH_PORT_NUM;
35239 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
35240@@ -6637,7 +6639,7 @@ static int netdev_set_rx_csum(struct net
35241 return 0;
35242 }
35243
35244-static struct ethtool_ops netdev_ethtool_ops = {
35245+static const struct ethtool_ops netdev_ethtool_ops = {
35246 .get_settings = netdev_get_settings,
35247 .set_settings = netdev_set_settings,
35248 .nway_reset = netdev_nway_reset,
35249diff -urNp linux-2.6.39.2/drivers/net/mlx4/main.c linux-2.6.39.2/drivers/net/mlx4/main.c
35250--- linux-2.6.39.2/drivers/net/mlx4/main.c 2011-05-19 00:06:34.000000000 -0400
35251+++ linux-2.6.39.2/drivers/net/mlx4/main.c 2011-05-22 19:36:31.000000000 -0400
35252@@ -40,6 +40,7 @@
35253 #include <linux/dma-mapping.h>
35254 #include <linux/slab.h>
35255 #include <linux/io-mapping.h>
35256+#include <linux/sched.h>
35257
35258 #include <linux/mlx4/device.h>
35259 #include <linux/mlx4/doorbell.h>
35260@@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev
35261 u64 icm_size;
35262 int err;
35263
35264+ pax_track_stack();
35265+
35266 err = mlx4_QUERY_FW(dev);
35267 if (err) {
35268 if (err == -EACCES)
35269diff -urNp linux-2.6.39.2/drivers/net/netconsole.c linux-2.6.39.2/drivers/net/netconsole.c
35270--- linux-2.6.39.2/drivers/net/netconsole.c 2011-05-19 00:06:34.000000000 -0400
35271+++ linux-2.6.39.2/drivers/net/netconsole.c 2011-05-22 19:36:31.000000000 -0400
35272@@ -634,7 +634,7 @@ static void drop_netconsole_target(struc
35273 config_item_put(&nt->item);
35274 }
35275
35276-static struct configfs_group_operations netconsole_subsys_group_ops = {
35277+static const struct configfs_group_operations netconsole_subsys_group_ops = {
35278 .make_item = make_netconsole_target,
35279 .drop_item = drop_netconsole_target,
35280 };
35281diff -urNp linux-2.6.39.2/drivers/net/niu.c linux-2.6.39.2/drivers/net/niu.c
35282--- linux-2.6.39.2/drivers/net/niu.c 2011-05-19 00:06:34.000000000 -0400
35283+++ linux-2.6.39.2/drivers/net/niu.c 2011-05-22 19:36:31.000000000 -0400
35284@@ -9067,6 +9067,8 @@ static void __devinit niu_try_msix(struc
35285 int i, num_irqs, err;
35286 u8 first_ldg;
35287
35288+ pax_track_stack();
35289+
35290 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
35291 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
35292 ldg_num_map[i] = first_ldg + i;
35293diff -urNp linux-2.6.39.2/drivers/net/pcnet32.c linux-2.6.39.2/drivers/net/pcnet32.c
35294--- linux-2.6.39.2/drivers/net/pcnet32.c 2011-05-19 00:06:34.000000000 -0400
35295+++ linux-2.6.39.2/drivers/net/pcnet32.c 2011-05-22 19:36:31.000000000 -0400
35296@@ -82,7 +82,7 @@ static int cards_found;
35297 /*
35298 * VLB I/O addresses
35299 */
35300-static unsigned int pcnet32_portlist[] __initdata =
35301+static unsigned int pcnet32_portlist[] __devinitdata =
35302 { 0x300, 0x320, 0x340, 0x360, 0 };
35303
35304 static int pcnet32_debug;
35305@@ -379,7 +379,7 @@ static int pcnet32_wio_check(unsigned lo
35306 return inw(addr + PCNET32_WIO_RAP) == 88;
35307 }
35308
35309-static struct pcnet32_access pcnet32_wio = {
35310+static const struct pcnet32_access pcnet32_wio = {
35311 .read_csr = pcnet32_wio_read_csr,
35312 .write_csr = pcnet32_wio_write_csr,
35313 .read_bcr = pcnet32_wio_read_bcr,
35314@@ -434,7 +434,7 @@ static int pcnet32_dwio_check(unsigned l
35315 return (inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88;
35316 }
35317
35318-static struct pcnet32_access pcnet32_dwio = {
35319+static const struct pcnet32_access pcnet32_dwio = {
35320 .read_csr = pcnet32_dwio_read_csr,
35321 .write_csr = pcnet32_dwio_write_csr,
35322 .read_bcr = pcnet32_dwio_read_bcr,
35323@@ -1546,7 +1546,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35324 int chip_version;
35325 char *chipname;
35326 struct net_device *dev;
35327- struct pcnet32_access *a = NULL;
35328+ const struct pcnet32_access *a = NULL;
35329 u8 promaddr[6];
35330 int ret = -ENODEV;
35331
35332diff -urNp linux-2.6.39.2/drivers/net/ppp_generic.c linux-2.6.39.2/drivers/net/ppp_generic.c
35333--- linux-2.6.39.2/drivers/net/ppp_generic.c 2011-05-19 00:06:34.000000000 -0400
35334+++ linux-2.6.39.2/drivers/net/ppp_generic.c 2011-05-22 19:36:31.000000000 -0400
35335@@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st
35336 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
35337 struct ppp_stats stats;
35338 struct ppp_comp_stats cstats;
35339- char *vers;
35340
35341 switch (cmd) {
35342 case SIOCGPPPSTATS:
35343@@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st
35344 break;
35345
35346 case SIOCGPPPVER:
35347- vers = PPP_VERSION;
35348- if (copy_to_user(addr, vers, strlen(vers) + 1))
35349+ if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
35350 break;
35351 err = 0;
35352 break;
35353diff -urNp linux-2.6.39.2/drivers/net/qlcnic/qlcnic.h linux-2.6.39.2/drivers/net/qlcnic/qlcnic.h
35354--- linux-2.6.39.2/drivers/net/qlcnic/qlcnic.h 2011-05-19 00:06:34.000000000 -0400
35355+++ linux-2.6.39.2/drivers/net/qlcnic/qlcnic.h 2011-05-22 19:36:31.000000000 -0400
35356@@ -1037,7 +1037,7 @@ struct qlcnic_adapter {
35357 struct vlan_group *vlgrp;
35358 struct qlcnic_npar_info *npars;
35359 struct qlcnic_eswitch *eswitch;
35360- struct qlcnic_nic_template *nic_ops;
35361+ const struct qlcnic_nic_template *nic_ops;
35362
35363 struct qlcnic_adapter_stats stats;
35364
35365diff -urNp linux-2.6.39.2/drivers/net/qlcnic/qlcnic_main.c linux-2.6.39.2/drivers/net/qlcnic/qlcnic_main.c
35366--- linux-2.6.39.2/drivers/net/qlcnic/qlcnic_main.c 2011-05-19 00:06:34.000000000 -0400
35367+++ linux-2.6.39.2/drivers/net/qlcnic/qlcnic_main.c 2011-05-22 19:36:31.000000000 -0400
35368@@ -340,13 +340,13 @@ static const struct net_device_ops qlcni
35369 #endif
35370 };
35371
35372-static struct qlcnic_nic_template qlcnic_ops = {
35373+static const struct qlcnic_nic_template qlcnic_ops = {
35374 .config_bridged_mode = qlcnic_config_bridged_mode,
35375 .config_led = qlcnic_config_led,
35376 .start_firmware = qlcnic_start_firmware
35377 };
35378
35379-static struct qlcnic_nic_template qlcnic_vf_ops = {
35380+static const struct qlcnic_nic_template qlcnic_vf_ops = {
35381 .config_bridged_mode = qlcnicvf_config_bridged_mode,
35382 .config_led = qlcnicvf_config_led,
35383 .start_firmware = qlcnicvf_start_firmware
35384diff -urNp linux-2.6.39.2/drivers/net/qlge/qlge.h linux-2.6.39.2/drivers/net/qlge/qlge.h
35385--- linux-2.6.39.2/drivers/net/qlge/qlge.h 2011-05-19 00:06:34.000000000 -0400
35386+++ linux-2.6.39.2/drivers/net/qlge/qlge.h 2011-05-22 19:36:31.000000000 -0400
35387@@ -2134,7 +2134,7 @@ struct ql_adapter {
35388 struct delayed_work mpi_idc_work;
35389 struct delayed_work mpi_core_to_log;
35390 struct completion ide_completion;
35391- struct nic_operations *nic_ops;
35392+ const struct nic_operations *nic_ops;
35393 u16 device_id;
35394 struct timer_list timer;
35395 atomic_t lb_count;
35396diff -urNp linux-2.6.39.2/drivers/net/qlge/qlge_main.c linux-2.6.39.2/drivers/net/qlge/qlge_main.c
35397--- linux-2.6.39.2/drivers/net/qlge/qlge_main.c 2011-05-19 00:06:34.000000000 -0400
35398+++ linux-2.6.39.2/drivers/net/qlge/qlge_main.c 2011-05-22 19:36:31.000000000 -0400
35399@@ -4412,12 +4412,12 @@ error:
35400 rtnl_unlock();
35401 }
35402
35403-static struct nic_operations qla8012_nic_ops = {
35404+static const struct nic_operations qla8012_nic_ops = {
35405 .get_flash = ql_get_8012_flash_params,
35406 .port_initialize = ql_8012_port_initialize,
35407 };
35408
35409-static struct nic_operations qla8000_nic_ops = {
35410+static const struct nic_operations qla8000_nic_ops = {
35411 .get_flash = ql_get_8000_flash_params,
35412 .port_initialize = ql_8000_port_initialize,
35413 };
35414diff -urNp linux-2.6.39.2/drivers/net/sfc/falcon.c linux-2.6.39.2/drivers/net/sfc/falcon.c
35415--- linux-2.6.39.2/drivers/net/sfc/falcon.c 2011-05-19 00:06:34.000000000 -0400
35416+++ linux-2.6.39.2/drivers/net/sfc/falcon.c 2011-05-22 19:36:31.000000000 -0400
35417@@ -1703,7 +1703,7 @@ static int falcon_set_wol(struct efx_nic
35418 **************************************************************************
35419 */
35420
35421-struct efx_nic_type falcon_a1_nic_type = {
35422+const struct efx_nic_type falcon_a1_nic_type = {
35423 .probe = falcon_probe_nic,
35424 .remove = falcon_remove_nic,
35425 .init = falcon_init_nic,
35426@@ -1744,7 +1744,7 @@ struct efx_nic_type falcon_a1_nic_type =
35427 .reset_world_flags = ETH_RESET_IRQ,
35428 };
35429
35430-struct efx_nic_type falcon_b0_nic_type = {
35431+const struct efx_nic_type falcon_b0_nic_type = {
35432 .probe = falcon_probe_nic,
35433 .remove = falcon_remove_nic,
35434 .init = falcon_init_nic,
35435diff -urNp linux-2.6.39.2/drivers/net/sfc/mtd.c linux-2.6.39.2/drivers/net/sfc/mtd.c
35436--- linux-2.6.39.2/drivers/net/sfc/mtd.c 2011-05-19 00:06:34.000000000 -0400
35437+++ linux-2.6.39.2/drivers/net/sfc/mtd.c 2011-05-22 19:36:31.000000000 -0400
35438@@ -382,7 +382,7 @@ static int falcon_mtd_sync(struct mtd_in
35439 return rc;
35440 }
35441
35442-static struct efx_mtd_ops falcon_mtd_ops = {
35443+static const struct efx_mtd_ops falcon_mtd_ops = {
35444 .read = falcon_mtd_read,
35445 .erase = falcon_mtd_erase,
35446 .write = falcon_mtd_write,
35447@@ -560,7 +560,7 @@ static int siena_mtd_sync(struct mtd_inf
35448 return rc;
35449 }
35450
35451-static struct efx_mtd_ops siena_mtd_ops = {
35452+static const struct efx_mtd_ops siena_mtd_ops = {
35453 .read = siena_mtd_read,
35454 .erase = siena_mtd_erase,
35455 .write = siena_mtd_write,
35456diff -urNp linux-2.6.39.2/drivers/net/sfc/nic.h linux-2.6.39.2/drivers/net/sfc/nic.h
35457--- linux-2.6.39.2/drivers/net/sfc/nic.h 2011-05-19 00:06:34.000000000 -0400
35458+++ linux-2.6.39.2/drivers/net/sfc/nic.h 2011-05-22 19:36:31.000000000 -0400
35459@@ -152,9 +152,9 @@ struct siena_nic_data {
35460 int wol_filter_id;
35461 };
35462
35463-extern struct efx_nic_type falcon_a1_nic_type;
35464-extern struct efx_nic_type falcon_b0_nic_type;
35465-extern struct efx_nic_type siena_a0_nic_type;
35466+extern const struct efx_nic_type falcon_a1_nic_type;
35467+extern const struct efx_nic_type falcon_b0_nic_type;
35468+extern const struct efx_nic_type siena_a0_nic_type;
35469
35470 /**************************************************************************
35471 *
35472diff -urNp linux-2.6.39.2/drivers/net/sfc/siena.c linux-2.6.39.2/drivers/net/sfc/siena.c
35473--- linux-2.6.39.2/drivers/net/sfc/siena.c 2011-05-19 00:06:34.000000000 -0400
35474+++ linux-2.6.39.2/drivers/net/sfc/siena.c 2011-05-22 19:36:31.000000000 -0400
35475@@ -599,7 +599,7 @@ static void siena_init_wol(struct efx_ni
35476 **************************************************************************
35477 */
35478
35479-struct efx_nic_type siena_a0_nic_type = {
35480+const struct efx_nic_type siena_a0_nic_type = {
35481 .probe = siena_probe_nic,
35482 .remove = siena_remove_nic,
35483 .init = siena_init_nic,
35484diff -urNp linux-2.6.39.2/drivers/net/sh_eth.c linux-2.6.39.2/drivers/net/sh_eth.c
35485--- linux-2.6.39.2/drivers/net/sh_eth.c 2011-05-19 00:06:34.000000000 -0400
35486+++ linux-2.6.39.2/drivers/net/sh_eth.c 2011-05-22 19:36:31.000000000 -0400
35487@@ -1360,7 +1360,7 @@ static void sh_eth_get_strings(struct ne
35488 }
35489 }
35490
35491-static struct ethtool_ops sh_eth_ethtool_ops = {
35492+static const struct ethtool_ops sh_eth_ethtool_ops = {
35493 .get_settings = sh_eth_get_settings,
35494 .set_settings = sh_eth_set_settings,
35495 .nway_reset = sh_eth_nway_reset,
35496diff -urNp linux-2.6.39.2/drivers/net/stmmac/stmmac_ethtool.c linux-2.6.39.2/drivers/net/stmmac/stmmac_ethtool.c
35497--- linux-2.6.39.2/drivers/net/stmmac/stmmac_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35498+++ linux-2.6.39.2/drivers/net/stmmac/stmmac_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35499@@ -348,7 +348,7 @@ static int stmmac_set_wol(struct net_dev
35500 return 0;
35501 }
35502
35503-static struct ethtool_ops stmmac_ethtool_ops = {
35504+static const struct ethtool_ops stmmac_ethtool_ops = {
35505 .begin = stmmac_check_if_running,
35506 .get_drvinfo = stmmac_ethtool_getdrvinfo,
35507 .get_settings = stmmac_ethtool_getsettings,
35508diff -urNp linux-2.6.39.2/drivers/net/sungem_phy.c linux-2.6.39.2/drivers/net/sungem_phy.c
35509--- linux-2.6.39.2/drivers/net/sungem_phy.c 2011-05-19 00:06:34.000000000 -0400
35510+++ linux-2.6.39.2/drivers/net/sungem_phy.c 2011-05-22 19:36:31.000000000 -0400
35511@@ -886,7 +886,7 @@ static int marvell_read_link(struct mii_
35512 SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
35513
35514 /* Broadcom BCM 5201 */
35515-static struct mii_phy_ops bcm5201_phy_ops = {
35516+static const struct mii_phy_ops bcm5201_phy_ops = {
35517 .init = bcm5201_init,
35518 .suspend = bcm5201_suspend,
35519 .setup_aneg = genmii_setup_aneg,
35520@@ -905,7 +905,7 @@ static struct mii_phy_def bcm5201_phy_de
35521 };
35522
35523 /* Broadcom BCM 5221 */
35524-static struct mii_phy_ops bcm5221_phy_ops = {
35525+static const struct mii_phy_ops bcm5221_phy_ops = {
35526 .suspend = bcm5221_suspend,
35527 .init = bcm5221_init,
35528 .setup_aneg = genmii_setup_aneg,
35529@@ -924,7 +924,7 @@ static struct mii_phy_def bcm5221_phy_de
35530 };
35531
35532 /* Broadcom BCM 5241 */
35533-static struct mii_phy_ops bcm5241_phy_ops = {
35534+static const struct mii_phy_ops bcm5241_phy_ops = {
35535 .suspend = bcm5241_suspend,
35536 .init = bcm5241_init,
35537 .setup_aneg = genmii_setup_aneg,
35538@@ -942,7 +942,7 @@ static struct mii_phy_def bcm5241_phy_de
35539 };
35540
35541 /* Broadcom BCM 5400 */
35542-static struct mii_phy_ops bcm5400_phy_ops = {
35543+static const struct mii_phy_ops bcm5400_phy_ops = {
35544 .init = bcm5400_init,
35545 .suspend = bcm5400_suspend,
35546 .setup_aneg = bcm54xx_setup_aneg,
35547@@ -961,7 +961,7 @@ static struct mii_phy_def bcm5400_phy_de
35548 };
35549
35550 /* Broadcom BCM 5401 */
35551-static struct mii_phy_ops bcm5401_phy_ops = {
35552+static const struct mii_phy_ops bcm5401_phy_ops = {
35553 .init = bcm5401_init,
35554 .suspend = bcm5401_suspend,
35555 .setup_aneg = bcm54xx_setup_aneg,
35556@@ -980,7 +980,7 @@ static struct mii_phy_def bcm5401_phy_de
35557 };
35558
35559 /* Broadcom BCM 5411 */
35560-static struct mii_phy_ops bcm5411_phy_ops = {
35561+static const struct mii_phy_ops bcm5411_phy_ops = {
35562 .init = bcm5411_init,
35563 .suspend = generic_suspend,
35564 .setup_aneg = bcm54xx_setup_aneg,
35565@@ -999,7 +999,7 @@ static struct mii_phy_def bcm5411_phy_de
35566 };
35567
35568 /* Broadcom BCM 5421 */
35569-static struct mii_phy_ops bcm5421_phy_ops = {
35570+static const struct mii_phy_ops bcm5421_phy_ops = {
35571 .init = bcm5421_init,
35572 .suspend = generic_suspend,
35573 .setup_aneg = bcm54xx_setup_aneg,
35574@@ -1019,7 +1019,7 @@ static struct mii_phy_def bcm5421_phy_de
35575 };
35576
35577 /* Broadcom BCM 5421 built-in K2 */
35578-static struct mii_phy_ops bcm5421k2_phy_ops = {
35579+static const struct mii_phy_ops bcm5421k2_phy_ops = {
35580 .init = bcm5421_init,
35581 .suspend = generic_suspend,
35582 .setup_aneg = bcm54xx_setup_aneg,
35583@@ -1037,7 +1037,7 @@ static struct mii_phy_def bcm5421k2_phy_
35584 .ops = &bcm5421k2_phy_ops
35585 };
35586
35587-static struct mii_phy_ops bcm5461_phy_ops = {
35588+static const struct mii_phy_ops bcm5461_phy_ops = {
35589 .init = bcm5421_init,
35590 .suspend = generic_suspend,
35591 .setup_aneg = bcm54xx_setup_aneg,
35592@@ -1057,7 +1057,7 @@ static struct mii_phy_def bcm5461_phy_de
35593 };
35594
35595 /* Broadcom BCM 5462 built-in Vesta */
35596-static struct mii_phy_ops bcm5462V_phy_ops = {
35597+static const struct mii_phy_ops bcm5462V_phy_ops = {
35598 .init = bcm5421_init,
35599 .suspend = generic_suspend,
35600 .setup_aneg = bcm54xx_setup_aneg,
35601@@ -1076,7 +1076,7 @@ static struct mii_phy_def bcm5462V_phy_d
35602 };
35603
35604 /* Marvell 88E1101 amd 88E1111 */
35605-static struct mii_phy_ops marvell88e1101_phy_ops = {
35606+static const struct mii_phy_ops marvell88e1101_phy_ops = {
35607 .suspend = generic_suspend,
35608 .setup_aneg = marvell_setup_aneg,
35609 .setup_forced = marvell_setup_forced,
35610@@ -1084,7 +1084,7 @@ static struct mii_phy_ops marvell88e1101
35611 .read_link = marvell_read_link
35612 };
35613
35614-static struct mii_phy_ops marvell88e1111_phy_ops = {
35615+static const struct mii_phy_ops marvell88e1111_phy_ops = {
35616 .init = marvell88e1111_init,
35617 .suspend = generic_suspend,
35618 .setup_aneg = marvell_setup_aneg,
35619@@ -1122,7 +1122,7 @@ static struct mii_phy_def marvell88e1111
35620 };
35621
35622 /* Generic implementation for most 10/100 PHYs */
35623-static struct mii_phy_ops generic_phy_ops = {
35624+static const struct mii_phy_ops generic_phy_ops = {
35625 .setup_aneg = genmii_setup_aneg,
35626 .setup_forced = genmii_setup_forced,
35627 .poll_link = genmii_poll_link,
35628diff -urNp linux-2.6.39.2/drivers/net/tg3.h linux-2.6.39.2/drivers/net/tg3.h
35629--- linux-2.6.39.2/drivers/net/tg3.h 2011-05-19 00:06:34.000000000 -0400
35630+++ linux-2.6.39.2/drivers/net/tg3.h 2011-05-22 19:36:31.000000000 -0400
35631@@ -131,6 +131,7 @@
35632 #define CHIPREV_ID_5750_A0 0x4000
35633 #define CHIPREV_ID_5750_A1 0x4001
35634 #define CHIPREV_ID_5750_A3 0x4003
35635+#define CHIPREV_ID_5750_C1 0x4201
35636 #define CHIPREV_ID_5750_C2 0x4202
35637 #define CHIPREV_ID_5752_A0_HW 0x5000
35638 #define CHIPREV_ID_5752_A0 0x6000
35639diff -urNp linux-2.6.39.2/drivers/net/tile/tilepro.c linux-2.6.39.2/drivers/net/tile/tilepro.c
35640--- linux-2.6.39.2/drivers/net/tile/tilepro.c 2011-05-19 00:06:34.000000000 -0400
35641+++ linux-2.6.39.2/drivers/net/tile/tilepro.c 2011-05-22 19:36:31.000000000 -0400
35642@@ -2263,7 +2263,7 @@ static int tile_net_get_mac(struct net_d
35643 }
35644
35645
35646-static struct net_device_ops tile_net_ops = {
35647+static const struct net_device_ops tile_net_ops = {
35648 .ndo_open = tile_net_open,
35649 .ndo_stop = tile_net_stop,
35650 .ndo_start_xmit = tile_net_tx,
35651diff -urNp linux-2.6.39.2/drivers/net/tulip/de2104x.c linux-2.6.39.2/drivers/net/tulip/de2104x.c
35652--- linux-2.6.39.2/drivers/net/tulip/de2104x.c 2011-05-19 00:06:34.000000000 -0400
35653+++ linux-2.6.39.2/drivers/net/tulip/de2104x.c 2011-05-22 19:36:31.000000000 -0400
35654@@ -1817,6 +1817,8 @@ static void __devinit de21041_get_srom_i
35655 struct de_srom_info_leaf *il;
35656 void *bufp;
35657
35658+ pax_track_stack();
35659+
35660 /* download entire eeprom */
35661 for (i = 0; i < DE_EEPROM_WORDS; i++)
35662 ((__le16 *)ee_data)[i] =
35663diff -urNp linux-2.6.39.2/drivers/net/tulip/de4x5.c linux-2.6.39.2/drivers/net/tulip/de4x5.c
35664--- linux-2.6.39.2/drivers/net/tulip/de4x5.c 2011-05-19 00:06:34.000000000 -0400
35665+++ linux-2.6.39.2/drivers/net/tulip/de4x5.c 2011-05-22 19:36:31.000000000 -0400
35666@@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
35667 for (i=0; i<ETH_ALEN; i++) {
35668 tmp.addr[i] = dev->dev_addr[i];
35669 }
35670- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35671+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35672 break;
35673
35674 case DE4X5_SET_HWADDR: /* Set the hardware address */
35675@@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru
35676 spin_lock_irqsave(&lp->lock, flags);
35677 memcpy(&statbuf, &lp->pktStats, ioc->len);
35678 spin_unlock_irqrestore(&lp->lock, flags);
35679- if (copy_to_user(ioc->data, &statbuf, ioc->len))
35680+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
35681 return -EFAULT;
35682 break;
35683 }
35684diff -urNp linux-2.6.39.2/drivers/net/usb/asix.c linux-2.6.39.2/drivers/net/usb/asix.c
35685--- linux-2.6.39.2/drivers/net/usb/asix.c 2011-05-19 00:06:34.000000000 -0400
35686+++ linux-2.6.39.2/drivers/net/usb/asix.c 2011-05-22 19:36:31.000000000 -0400
35687@@ -1098,7 +1098,7 @@ out:
35688 return ret;
35689 }
35690
35691-static struct ethtool_ops ax88178_ethtool_ops = {
35692+static const struct ethtool_ops ax88178_ethtool_ops = {
35693 .get_drvinfo = asix_get_drvinfo,
35694 .get_link = asix_get_link,
35695 .get_msglevel = usbnet_get_msglevel,
35696diff -urNp linux-2.6.39.2/drivers/net/usb/cdc_ncm.c linux-2.6.39.2/drivers/net/usb/cdc_ncm.c
35697--- linux-2.6.39.2/drivers/net/usb/cdc_ncm.c 2011-06-25 12:55:22.000000000 -0400
35698+++ linux-2.6.39.2/drivers/net/usb/cdc_ncm.c 2011-06-25 13:00:26.000000000 -0400
35699@@ -141,7 +141,7 @@ struct cdc_ncm_ctx {
35700 static void cdc_ncm_tx_timeout(unsigned long arg);
35701 static const struct driver_info cdc_ncm_info;
35702 static struct usb_driver cdc_ncm_driver;
35703-static struct ethtool_ops cdc_ncm_ethtool_ops;
35704+static const struct ethtool_ops cdc_ncm_ethtool_ops;
35705
35706 static const struct usb_device_id cdc_devs[] = {
35707 { USB_INTERFACE_INFO(USB_CLASS_COMM,
35708@@ -1258,7 +1258,7 @@ static struct usb_driver cdc_ncm_driver
35709 .supports_autosuspend = 1,
35710 };
35711
35712-static struct ethtool_ops cdc_ncm_ethtool_ops = {
35713+static const struct ethtool_ops cdc_ncm_ethtool_ops = {
35714 .get_drvinfo = cdc_ncm_get_drvinfo,
35715 .get_link = usbnet_get_link,
35716 .get_msglevel = usbnet_get_msglevel,
35717diff -urNp linux-2.6.39.2/drivers/net/usb/hso.c linux-2.6.39.2/drivers/net/usb/hso.c
35718--- linux-2.6.39.2/drivers/net/usb/hso.c 2011-05-19 00:06:34.000000000 -0400
35719+++ linux-2.6.39.2/drivers/net/usb/hso.c 2011-05-22 19:36:31.000000000 -0400
35720@@ -71,7 +71,7 @@
35721 #include <asm/byteorder.h>
35722 #include <linux/serial_core.h>
35723 #include <linux/serial.h>
35724-
35725+#include <asm/local.h>
35726
35727 #define MOD_AUTHOR "Option Wireless"
35728 #define MOD_DESCRIPTION "USB High Speed Option driver"
35729@@ -257,7 +257,7 @@ struct hso_serial {
35730
35731 /* from usb_serial_port */
35732 struct tty_struct *tty;
35733- int open_count;
35734+ local_t open_count;
35735 spinlock_t serial_lock;
35736
35737 int (*write_data) (struct hso_serial *serial);
35738@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_
35739 struct urb *urb;
35740
35741 urb = serial->rx_urb[0];
35742- if (serial->open_count > 0) {
35743+ if (local_read(&serial->open_count) > 0) {
35744 count = put_rxbuf_data(urb, serial);
35745 if (count == -1)
35746 return;
35747@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal
35748 DUMP1(urb->transfer_buffer, urb->actual_length);
35749
35750 /* Anyone listening? */
35751- if (serial->open_count == 0)
35752+ if (local_read(&serial->open_count) == 0)
35753 return;
35754
35755 if (status == 0) {
35756@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
35757 spin_unlock_irq(&serial->serial_lock);
35758
35759 /* check for port already opened, if not set the termios */
35760- serial->open_count++;
35761- if (serial->open_count == 1) {
35762+ if (local_inc_return(&serial->open_count) == 1) {
35763 serial->rx_state = RX_IDLE;
35764 /* Force default termio settings */
35765 _hso_serial_set_termios(tty, NULL);
35766@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st
35767 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
35768 if (result) {
35769 hso_stop_serial_device(serial->parent);
35770- serial->open_count--;
35771+ local_dec(&serial->open_count);
35772 kref_put(&serial->parent->ref, hso_serial_ref_free);
35773 }
35774 } else {
35775@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_
35776
35777 /* reset the rts and dtr */
35778 /* do the actual close */
35779- serial->open_count--;
35780+ local_dec(&serial->open_count);
35781
35782- if (serial->open_count <= 0) {
35783- serial->open_count = 0;
35784+ if (local_read(&serial->open_count) <= 0) {
35785+ local_set(&serial->open_count, 0);
35786 spin_lock_irq(&serial->serial_lock);
35787 if (serial->tty == tty) {
35788 serial->tty->driver_data = NULL;
35789@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc
35790
35791 /* the actual setup */
35792 spin_lock_irqsave(&serial->serial_lock, flags);
35793- if (serial->open_count)
35794+ if (local_read(&serial->open_count))
35795 _hso_serial_set_termios(tty, old);
35796 else
35797 tty->termios = old;
35798@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur
35799 D1("Pending read interrupt on port %d\n", i);
35800 spin_lock(&serial->serial_lock);
35801 if (serial->rx_state == RX_IDLE &&
35802- serial->open_count > 0) {
35803+ local_read(&serial->open_count) > 0) {
35804 /* Setup and send a ctrl req read on
35805 * port i */
35806 if (!serial->rx_urb_filled[0]) {
35807@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
35808 /* Start all serial ports */
35809 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
35810 if (serial_table[i] && (serial_table[i]->interface == iface)) {
35811- if (dev2ser(serial_table[i])->open_count) {
35812+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
35813 result =
35814 hso_start_serial_device(serial_table[i], GFP_NOIO);
35815 hso_kick_transmit(dev2ser(serial_table[i]));
35816diff -urNp linux-2.6.39.2/drivers/net/usb/ipheth.c linux-2.6.39.2/drivers/net/usb/ipheth.c
35817--- linux-2.6.39.2/drivers/net/usb/ipheth.c 2011-05-19 00:06:34.000000000 -0400
35818+++ linux-2.6.39.2/drivers/net/usb/ipheth.c 2011-05-22 19:36:31.000000000 -0400
35819@@ -421,7 +421,7 @@ static u32 ipheth_ethtool_op_get_link(st
35820 return netif_carrier_ok(dev->net);
35821 }
35822
35823-static struct ethtool_ops ops = {
35824+static const struct ethtool_ops ops = {
35825 .get_link = ipheth_ethtool_op_get_link
35826 };
35827
35828diff -urNp linux-2.6.39.2/drivers/net/usb/sierra_net.c linux-2.6.39.2/drivers/net/usb/sierra_net.c
35829--- linux-2.6.39.2/drivers/net/usb/sierra_net.c 2011-05-19 00:06:34.000000000 -0400
35830+++ linux-2.6.39.2/drivers/net/usb/sierra_net.c 2011-05-22 19:36:31.000000000 -0400
35831@@ -618,7 +618,7 @@ static u32 sierra_net_get_link(struct ne
35832 return sierra_net_get_private(dev)->link_up && netif_running(net);
35833 }
35834
35835-static struct ethtool_ops sierra_net_ethtool_ops = {
35836+static const struct ethtool_ops sierra_net_ethtool_ops = {
35837 .get_drvinfo = sierra_net_get_drvinfo,
35838 .get_link = sierra_net_get_link,
35839 .get_msglevel = usbnet_get_msglevel,
35840diff -urNp linux-2.6.39.2/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.39.2/drivers/net/vmxnet3/vmxnet3_ethtool.c
35841--- linux-2.6.39.2/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35842+++ linux-2.6.39.2/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35843@@ -631,8 +631,7 @@ vmxnet3_set_rss_indir(struct net_device
35844 * Return with error code if any of the queue indices
35845 * is out of range
35846 */
35847- if (p->ring_index[i] < 0 ||
35848- p->ring_index[i] >= adapter->num_rx_queues)
35849+ if (p->ring_index[i] >= adapter->num_rx_queues)
35850 return -EINVAL;
35851 }
35852
35853diff -urNp linux-2.6.39.2/drivers/net/vxge/vxge-main.c linux-2.6.39.2/drivers/net/vxge/vxge-main.c
35854--- linux-2.6.39.2/drivers/net/vxge/vxge-main.c 2011-05-19 00:06:34.000000000 -0400
35855+++ linux-2.6.39.2/drivers/net/vxge/vxge-main.c 2011-05-22 19:36:31.000000000 -0400
35856@@ -97,6 +97,8 @@ static inline void VXGE_COMPLETE_VPATH_T
35857 struct sk_buff *completed[NR_SKB_COMPLETED];
35858 int more;
35859
35860+ pax_track_stack();
35861+
35862 do {
35863 more = 0;
35864 skb_ptr = completed;
35865@@ -1927,6 +1929,8 @@ static enum vxge_hw_status vxge_rth_conf
35866 u8 mtable[256] = {0}; /* CPU to vpath mapping */
35867 int index;
35868
35869+ pax_track_stack();
35870+
35871 /*
35872 * Filling
35873 * - itable with bucket numbers
35874diff -urNp linux-2.6.39.2/drivers/net/wan/cycx_x25.c linux-2.6.39.2/drivers/net/wan/cycx_x25.c
35875--- linux-2.6.39.2/drivers/net/wan/cycx_x25.c 2011-05-19 00:06:34.000000000 -0400
35876+++ linux-2.6.39.2/drivers/net/wan/cycx_x25.c 2011-05-22 19:36:31.000000000 -0400
35877@@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
35878 unsigned char hex[1024],
35879 * phex = hex;
35880
35881+ pax_track_stack();
35882+
35883 if (len >= (sizeof(hex) / 2))
35884 len = (sizeof(hex) / 2) - 1;
35885
35886diff -urNp linux-2.6.39.2/drivers/net/wan/lapbether.c linux-2.6.39.2/drivers/net/wan/lapbether.c
35887--- linux-2.6.39.2/drivers/net/wan/lapbether.c 2011-05-19 00:06:34.000000000 -0400
35888+++ linux-2.6.39.2/drivers/net/wan/lapbether.c 2011-05-22 19:36:31.000000000 -0400
35889@@ -259,7 +259,7 @@ static int lapbeth_set_mac_address(struc
35890 }
35891
35892
35893-static struct lapb_register_struct lapbeth_callbacks = {
35894+static const struct lapb_register_struct lapbeth_callbacks = {
35895 .connect_confirmation = lapbeth_connected,
35896 .connect_indication = lapbeth_connected,
35897 .disconnect_confirmation = lapbeth_disconnected,
35898diff -urNp linux-2.6.39.2/drivers/net/wan/x25_asy.c linux-2.6.39.2/drivers/net/wan/x25_asy.c
35899--- linux-2.6.39.2/drivers/net/wan/x25_asy.c 2011-05-19 00:06:34.000000000 -0400
35900+++ linux-2.6.39.2/drivers/net/wan/x25_asy.c 2011-05-22 19:36:31.000000000 -0400
35901@@ -434,7 +434,7 @@ static void x25_asy_disconnected(struct
35902 netif_rx(skb);
35903 }
35904
35905-static struct lapb_register_struct x25_asy_callbacks = {
35906+static const struct lapb_register_struct x25_asy_callbacks = {
35907 .connect_confirmation = x25_asy_connected,
35908 .connect_indication = x25_asy_connected,
35909 .disconnect_confirmation = x25_asy_disconnected,
35910diff -urNp linux-2.6.39.2/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.39.2/drivers/net/wimax/i2400m/usb-fw.c
35911--- linux-2.6.39.2/drivers/net/wimax/i2400m/usb-fw.c 2011-05-19 00:06:34.000000000 -0400
35912+++ linux-2.6.39.2/drivers/net/wimax/i2400m/usb-fw.c 2011-05-22 19:36:31.000000000 -0400
35913@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
35914 int do_autopm = 1;
35915 DECLARE_COMPLETION_ONSTACK(notif_completion);
35916
35917+ pax_track_stack();
35918+
35919 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
35920 i2400m, ack, ack_size);
35921 BUG_ON(_ack == i2400m->bm_ack_buf);
35922diff -urNp linux-2.6.39.2/drivers/net/wireless/airo.c linux-2.6.39.2/drivers/net/wireless/airo.c
35923--- linux-2.6.39.2/drivers/net/wireless/airo.c 2011-05-19 00:06:34.000000000 -0400
35924+++ linux-2.6.39.2/drivers/net/wireless/airo.c 2011-05-22 19:36:31.000000000 -0400
35925@@ -3001,6 +3001,8 @@ static void airo_process_scan_results (s
35926 BSSListElement * loop_net;
35927 BSSListElement * tmp_net;
35928
35929+ pax_track_stack();
35930+
35931 /* Blow away current list of scan results */
35932 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
35933 list_move_tail (&loop_net->list, &ai->network_free_list);
35934@@ -3792,6 +3794,8 @@ static u16 setup_card(struct airo_info *
35935 WepKeyRid wkr;
35936 int rc;
35937
35938+ pax_track_stack();
35939+
35940 memset( &mySsid, 0, sizeof( mySsid ) );
35941 kfree (ai->flash);
35942 ai->flash = NULL;
35943@@ -4760,6 +4764,8 @@ static int proc_stats_rid_open( struct i
35944 __le32 *vals = stats.vals;
35945 int len;
35946
35947+ pax_track_stack();
35948+
35949 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35950 return -ENOMEM;
35951 data = file->private_data;
35952@@ -5483,6 +5489,8 @@ static int proc_BSSList_open( struct ino
35953 /* If doLoseSync is not 1, we won't do a Lose Sync */
35954 int doLoseSync = -1;
35955
35956+ pax_track_stack();
35957+
35958 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35959 return -ENOMEM;
35960 data = file->private_data;
35961@@ -7190,6 +7198,8 @@ static int airo_get_aplist(struct net_de
35962 int i;
35963 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
35964
35965+ pax_track_stack();
35966+
35967 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
35968 if (!qual)
35969 return -ENOMEM;
35970@@ -7750,6 +7760,8 @@ static void airo_read_wireless_stats(str
35971 CapabilityRid cap_rid;
35972 __le32 *vals = stats_rid.vals;
35973
35974+ pax_track_stack();
35975+
35976 /* Get stats out of the card */
35977 clear_bit(JOB_WSTATS, &local->jobs);
35978 if (local->power.event) {
35979diff -urNp linux-2.6.39.2/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.39.2/drivers/net/wireless/ath/ath5k/debug.c
35980--- linux-2.6.39.2/drivers/net/wireless/ath/ath5k/debug.c 2011-05-19 00:06:34.000000000 -0400
35981+++ linux-2.6.39.2/drivers/net/wireless/ath/ath5k/debug.c 2011-05-22 19:36:31.000000000 -0400
35982@@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
35983 unsigned int v;
35984 u64 tsf;
35985
35986+ pax_track_stack();
35987+
35988 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
35989 len += snprintf(buf+len, sizeof(buf)-len,
35990 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
35991@@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi
35992 unsigned int len = 0;
35993 unsigned int i;
35994
35995+ pax_track_stack();
35996+
35997 len += snprintf(buf+len, sizeof(buf)-len,
35998 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
35999
36000@@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct
36001 unsigned int i;
36002 unsigned int v;
36003
36004+ pax_track_stack();
36005+
36006 len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
36007 sc->ah->ah_ant_mode);
36008 len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
36009@@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil
36010 unsigned int len = 0;
36011 u32 filt = ath5k_hw_get_rx_filter(sc->ah);
36012
36013+ pax_track_stack();
36014+
36015 len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
36016 sc->bssidmask);
36017 len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
36018@@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str
36019 unsigned int len = 0;
36020 int i;
36021
36022+ pax_track_stack();
36023+
36024 len += snprintf(buf+len, sizeof(buf)-len,
36025 "RX\n---------------------\n");
36026 len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
36027@@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file
36028 char buf[700];
36029 unsigned int len = 0;
36030
36031+ pax_track_stack();
36032+
36033 len += snprintf(buf+len, sizeof(buf)-len,
36034 "HW has PHY error counters:\t%s\n",
36035 sc->ah->ah_capabilities.cap_has_phyerr_counters ?
36036@@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi
36037 struct ath5k_buf *bf, *bf0;
36038 int i, n;
36039
36040+ pax_track_stack();
36041+
36042 len += snprintf(buf+len, sizeof(buf)-len,
36043 "available txbuffers: %d\n", sc->txbuf_len);
36044
36045diff -urNp linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_calib.c
36046--- linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-19 00:06:34.000000000 -0400
36047+++ linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-22 19:36:31.000000000 -0400
36048@@ -734,6 +734,8 @@ static void ar9003_hw_tx_iq_cal(struct a
36049 s32 i, j, ip, im, nmeasurement;
36050 u8 nchains = get_streams(common->tx_chainmask);
36051
36052+ pax_track_stack();
36053+
36054 for (ip = 0; ip < MPASS; ip++) {
36055 REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
36056 AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
36057@@ -856,6 +858,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
36058 int i, ip, im, j;
36059 int nmeasurement;
36060
36061+ pax_track_stack();
36062+
36063 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
36064 if (ah->txchainmask & (1 << i))
36065 num_chains++;
36066diff -urNp linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
36067--- linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-19 00:06:34.000000000 -0400
36068+++ linux-2.6.39.2/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-22 19:36:31.000000000 -0400
36069@@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
36070 int theta_low_bin = 0;
36071 int i;
36072
36073+ pax_track_stack();
36074+
36075 /* disregard any bin that contains <= 16 samples */
36076 thresh_accum_cnt = 16;
36077 scale_factor = 5;
36078diff -urNp linux-2.6.39.2/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.39.2/drivers/net/wireless/ath/ath9k/debug.c
36079--- linux-2.6.39.2/drivers/net/wireless/ath/ath9k/debug.c 2011-05-19 00:06:34.000000000 -0400
36080+++ linux-2.6.39.2/drivers/net/wireless/ath/ath9k/debug.c 2011-05-22 19:36:31.000000000 -0400
36081@@ -335,6 +335,8 @@ static ssize_t read_file_interrupt(struc
36082 char buf[512];
36083 unsigned int len = 0;
36084
36085+ pax_track_stack();
36086+
36087 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
36088 len += snprintf(buf + len, sizeof(buf) - len,
36089 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
36090@@ -422,6 +424,8 @@ static ssize_t read_file_wiphy(struct fi
36091 u8 addr[ETH_ALEN];
36092 u32 tmp;
36093
36094+ pax_track_stack();
36095+
36096 len += snprintf(buf + len, sizeof(buf) - len,
36097 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
36098 wiphy_name(sc->hw->wiphy),
36099diff -urNp linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc_drv_main.c linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc_drv_main.c
36100--- linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-19 00:06:34.000000000 -0400
36101+++ linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-22 19:36:31.000000000 -0400
36102@@ -737,6 +737,8 @@ static ssize_t read_file_tgt_stats(struc
36103 unsigned int len = 0;
36104 int ret = 0;
36105
36106+ pax_track_stack();
36107+
36108 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
36109
36110 WMI_CMD(WMI_TGT_STATS_CMDID);
36111@@ -782,6 +784,8 @@ static ssize_t read_file_xmit(struct fil
36112 char buf[512];
36113 unsigned int len = 0;
36114
36115+ pax_track_stack();
36116+
36117 len += snprintf(buf + len, sizeof(buf) - len,
36118 "%20s : %10u\n", "Buffers queued",
36119 priv->debug.tx_stats.buf_queued);
36120@@ -831,6 +835,8 @@ static ssize_t read_file_recv(struct fil
36121 char buf[512];
36122 unsigned int len = 0;
36123
36124+ pax_track_stack();
36125+
36126 len += snprintf(buf + len, sizeof(buf) - len,
36127 "%20s : %10u\n", "SKBs allocated",
36128 priv->debug.rx_stats.skb_allocated);
36129@@ -1816,7 +1822,7 @@ static void ath9k_htc_set_coverage_class
36130 mutex_unlock(&priv->mutex);
36131 }
36132
36133-struct ieee80211_ops ath9k_htc_ops = {
36134+const struct ieee80211_ops ath9k_htc_ops = {
36135 .tx = ath9k_htc_tx,
36136 .start = ath9k_htc_start,
36137 .stop = ath9k_htc_stop,
36138diff -urNp linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc.h linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc.h
36139--- linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc.h 2011-05-19 00:06:34.000000000 -0400
36140+++ linux-2.6.39.2/drivers/net/wireless/ath/ath9k/htc.h 2011-05-22 19:36:31.000000000 -0400
36141@@ -42,7 +42,7 @@
36142 #define TSF_TO_TU(_h, _l) \
36143 ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
36144
36145-extern struct ieee80211_ops ath9k_htc_ops;
36146+extern const struct ieee80211_ops ath9k_htc_ops;
36147 extern int htc_modparam_nohwcrypt;
36148
36149 enum htc_phymode {
36150diff -urNp linux-2.6.39.2/drivers/net/wireless/b43/debugfs.c linux-2.6.39.2/drivers/net/wireless/b43/debugfs.c
36151--- linux-2.6.39.2/drivers/net/wireless/b43/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36152+++ linux-2.6.39.2/drivers/net/wireless/b43/debugfs.c 2011-05-22 19:36:31.000000000 -0400
36153@@ -43,7 +43,7 @@ static struct dentry *rootdir;
36154 struct b43_debugfs_fops {
36155 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
36156 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
36157- struct file_operations fops;
36158+ const struct file_operations fops;
36159 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
36160 size_t file_struct_offset;
36161 };
36162diff -urNp linux-2.6.39.2/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.39.2/drivers/net/wireless/b43legacy/debugfs.c
36163--- linux-2.6.39.2/drivers/net/wireless/b43legacy/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36164+++ linux-2.6.39.2/drivers/net/wireless/b43legacy/debugfs.c 2011-05-22 19:36:31.000000000 -0400
36165@@ -44,7 +44,7 @@ static struct dentry *rootdir;
36166 struct b43legacy_debugfs_fops {
36167 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
36168 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
36169- struct file_operations fops;
36170+ const struct file_operations fops;
36171 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
36172 size_t file_struct_offset;
36173 /* Take wl->irq_lock before calling read/write? */
36174diff -urNp linux-2.6.39.2/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.39.2/drivers/net/wireless/ipw2x00/ipw2100.c
36175--- linux-2.6.39.2/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-19 00:06:34.000000000 -0400
36176+++ linux-2.6.39.2/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-22 19:36:31.000000000 -0400
36177@@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2
36178 int err;
36179 DECLARE_SSID_BUF(ssid);
36180
36181+ pax_track_stack();
36182+
36183 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
36184
36185 if (ssid_len)
36186@@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210
36187 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
36188 int err;
36189
36190+ pax_track_stack();
36191+
36192 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
36193 idx, keylen, len);
36194
36195diff -urNp linux-2.6.39.2/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.39.2/drivers/net/wireless/ipw2x00/libipw_rx.c
36196--- linux-2.6.39.2/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-19 00:06:34.000000000 -0400
36197+++ linux-2.6.39.2/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-22 19:36:31.000000000 -0400
36198@@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
36199 unsigned long flags;
36200 DECLARE_SSID_BUF(ssid);
36201
36202+ pax_track_stack();
36203+
36204 LIBIPW_DEBUG_SCAN("'%s' (%pM"
36205 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
36206 print_ssid(ssid, info_element->data, info_element->len),
36207diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-3945.c linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-3945.c
36208--- linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-19 00:06:34.000000000 -0400
36209+++ linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-22 19:36:31.000000000 -0400
36210@@ -2630,7 +2630,7 @@ static int iwl3945_load_bsm(struct iwl_p
36211 return 0;
36212 }
36213
36214-static struct iwl_hcmd_ops iwl3945_hcmd = {
36215+static const struct iwl_hcmd_ops iwl3945_hcmd = {
36216 .rxon_assoc = iwl3945_send_rxon_assoc,
36217 .commit_rxon = iwl3945_commit_rxon,
36218 };
36219@@ -2675,7 +2675,7 @@ static const struct iwl_legacy_ops iwl39
36220 .manage_ibss_station = iwl3945_manage_ibss_station,
36221 };
36222
36223-static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
36224+static const struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
36225 .get_hcmd_size = iwl3945_get_hcmd_size,
36226 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
36227 .request_scan = iwl3945_request_scan,
36228diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.c linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.c
36229--- linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-06-25 12:55:22.000000000 -0400
36230+++ linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-06-25 13:00:26.000000000 -0400
36231@@ -1902,7 +1902,7 @@ static void iwl4965_rx_handler_setup(str
36232 priv->rx_handlers[BEACON_NOTIFICATION] = iwl4965_rx_beacon_notif;
36233 }
36234
36235-static struct iwl_hcmd_ops iwl4965_hcmd = {
36236+static const struct iwl_hcmd_ops iwl4965_hcmd = {
36237 .rxon_assoc = iwl4965_send_rxon_assoc,
36238 .commit_rxon = iwl4965_commit_rxon,
36239 .set_rxon_chain = iwl4965_set_rxon_chain,
36240@@ -2054,7 +2054,7 @@ static void iwl4965_config_ap(struct iwl
36241 iwl4965_send_beacon_cmd(priv);
36242 }
36243
36244-static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
36245+static const struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
36246 .get_hcmd_size = iwl4965_get_hcmd_size,
36247 .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
36248 .request_scan = iwl4965_request_scan,
36249@@ -2112,7 +2112,7 @@ static const struct iwl_legacy_ops iwl49
36250 .update_bcast_stations = iwl4965_update_bcast_stations,
36251 };
36252
36253-struct ieee80211_ops iwl4965_hw_ops = {
36254+const struct ieee80211_ops iwl4965_hw_ops = {
36255 .tx = iwl4965_mac_tx,
36256 .start = iwl4965_mac_start,
36257 .stop = iwl4965_mac_stop,
36258diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.h linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.h
36259--- linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-19 00:06:34.000000000 -0400
36260+++ linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-22 19:36:32.000000000 -0400
36261@@ -70,7 +70,7 @@ extern struct iwl_cfg iwl4965_cfg;
36262
36263 extern struct iwl_mod_params iwl4965_mod_params;
36264
36265-extern struct ieee80211_ops iwl4965_hw_ops;
36266+extern const struct ieee80211_ops iwl4965_hw_ops;
36267
36268 /* tx queue */
36269 void iwl4965_free_tfds_in_queue(struct iwl_priv *priv,
36270diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-core.h linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-core.h
36271--- linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-core.h 2011-06-25 12:55:22.000000000 -0400
36272+++ linux-2.6.39.2/drivers/net/wireless/iwlegacy/iwl-core.h 2011-06-25 13:00:26.000000000 -0400
36273@@ -150,7 +150,7 @@ struct iwl_lib_ops {
36274 int (*set_channel_switch)(struct iwl_priv *priv,
36275 struct ieee80211_channel_switch *ch_switch);
36276 /* power management */
36277- struct iwl_apm_ops apm_ops;
36278+ const struct iwl_apm_ops apm_ops;
36279
36280 /* power */
36281 int (*send_tx_power) (struct iwl_priv *priv);
36282@@ -160,12 +160,12 @@ struct iwl_lib_ops {
36283 struct iwl_eeprom_ops eeprom_ops;
36284
36285 /* temperature */
36286- struct iwl_temp_ops temp_ops;
36287+ const struct iwl_temp_ops temp_ops;
36288 /* check for plcp health */
36289 bool (*check_plcp_health)(struct iwl_priv *priv,
36290 struct iwl_rx_packet *pkt);
36291
36292- struct iwl_debugfs_ops debugfs_ops;
36293+ const struct iwl_debugfs_ops debugfs_ops;
36294
36295 };
36296
36297diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-6000.c
36298--- linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-06-25 12:55:22.000000000 -0400
36299+++ linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-06-25 13:00:26.000000000 -0400
36300@@ -420,11 +420,11 @@ static struct iwl_lib_ops iwl6030_lib =
36301 }
36302 };
36303
36304-static struct iwl_nic_ops iwl6050_nic_ops = {
36305+static const struct iwl_nic_ops iwl6050_nic_ops = {
36306 .additional_nic_config = &iwl6050_additional_nic_config,
36307 };
36308
36309-static struct iwl_nic_ops iwl6150_nic_ops = {
36310+static const struct iwl_nic_ops iwl6150_nic_ops = {
36311 .additional_nic_config = &iwl6150_additional_nic_config,
36312 };
36313
36314diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn.h linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn.h
36315--- linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-19 00:06:34.000000000 -0400
36316+++ linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-22 19:36:32.000000000 -0400
36317@@ -109,9 +109,9 @@ extern struct iwl_cfg iwl230_bg_cfg;
36318 extern struct iwl_cfg iwl230_bgn_cfg;
36319
36320 extern struct iwl_mod_params iwlagn_mod_params;
36321-extern struct iwl_hcmd_ops iwlagn_hcmd;
36322-extern struct iwl_hcmd_ops iwlagn_bt_hcmd;
36323-extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36324+extern const struct iwl_hcmd_ops iwlagn_hcmd;
36325+extern const struct iwl_hcmd_ops iwlagn_bt_hcmd;
36326+extern const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36327
36328 extern struct ieee80211_ops iwlagn_hw_ops;
36329 extern struct ieee80211_ops iwl4965_hw_ops;
36330diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
36331--- linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-06-25 12:55:22.000000000 -0400
36332+++ linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-06-25 13:00:26.000000000 -0400
36333@@ -355,7 +355,7 @@ static int iwlagn_set_pan_params(struct
36334 return ret;
36335 }
36336
36337-struct iwl_hcmd_ops iwlagn_hcmd = {
36338+const struct iwl_hcmd_ops iwlagn_hcmd = {
36339 .rxon_assoc = iwlagn_send_rxon_assoc,
36340 .commit_rxon = iwlagn_commit_rxon,
36341 .set_rxon_chain = iwlagn_set_rxon_chain,
36342@@ -364,7 +364,7 @@ struct iwl_hcmd_ops iwlagn_hcmd = {
36343 .set_pan_params = iwlagn_set_pan_params,
36344 };
36345
36346-struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36347+const struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36348 .rxon_assoc = iwlagn_send_rxon_assoc,
36349 .commit_rxon = iwlagn_commit_rxon,
36350 .set_rxon_chain = iwlagn_set_rxon_chain,
36351@@ -373,7 +373,7 @@ struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36352 .set_pan_params = iwlagn_set_pan_params,
36353 };
36354
36355-struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36356+const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36357 .get_hcmd_size = iwlagn_get_hcmd_size,
36358 .build_addsta_hcmd = iwlagn_build_addsta_hcmd,
36359 .gain_computation = iwlagn_gain_computation,
36360diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
36361--- linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-19 00:06:34.000000000 -0400
36362+++ linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-22 19:36:32.000000000 -0400
36363@@ -883,6 +883,8 @@ static void rs_tx_status(void *priv_r, s
36364 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
36365 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
36366
36367+ pax_track_stack();
36368+
36369 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
36370
36371 /* Treat uninitialized rate scaling data same as non-existing. */
36372@@ -2894,6 +2896,8 @@ static void rs_fill_link_cmd(struct iwl_
36373 container_of(lq_sta, struct iwl_station_priv, lq_sta);
36374 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
36375
36376+ pax_track_stack();
36377+
36378 /* Override starting rate (index 0) if needed for debug purposes */
36379 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
36380
36381diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-core.h linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-core.h
36382--- linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-core.h 2011-06-25 12:55:22.000000000 -0400
36383+++ linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-core.h 2011-06-25 13:00:26.000000000 -0400
36384@@ -198,28 +198,25 @@ struct iwl_lib_ops {
36385 int (*set_channel_switch)(struct iwl_priv *priv,
36386 struct ieee80211_channel_switch *ch_switch);
36387 /* power management */
36388- struct iwl_apm_ops apm_ops;
36389+ const struct iwl_apm_ops apm_ops;
36390
36391 /* power */
36392 int (*send_tx_power) (struct iwl_priv *priv);
36393 void (*update_chain_flags)(struct iwl_priv *priv);
36394
36395 /* isr */
36396- struct iwl_isr_ops isr_ops;
36397+ const struct iwl_isr_ops isr_ops;
36398
36399 /* eeprom operations (as defined in iwl-eeprom.h) */
36400 struct iwl_eeprom_ops eeprom_ops;
36401
36402 /* temperature */
36403- struct iwl_temp_ops temp_ops;
36404+ const struct iwl_temp_ops temp_ops;
36405
36406 int (*txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36407 void (*dev_txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36408
36409- struct iwl_debugfs_ops debugfs_ops;
36410-
36411- /* thermal throttling */
36412- struct iwl_tt_ops tt_ops;
36413+ const struct iwl_debugfs_ops debugfs_ops;const struct iwl_tt_ops tt_ops;
36414 };
36415
36416 struct iwl_led_ops {
36417diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debugfs.c
36418--- linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-19 00:06:34.000000000 -0400
36419+++ linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-22 19:36:32.000000000 -0400
36420@@ -549,6 +549,8 @@ static ssize_t iwl_dbgfs_status_read(str
36421 int pos = 0;
36422 const size_t bufsz = sizeof(buf);
36423
36424+ pax_track_stack();
36425+
36426 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
36427 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
36428 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
36429@@ -681,6 +683,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
36430 char buf[256 * NUM_IWL_RXON_CTX];
36431 const size_t bufsz = sizeof(buf);
36432
36433+ pax_track_stack();
36434+
36435 for_each_context(priv, ctx) {
36436 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
36437 ctx->ctxid);
36438diff -urNp linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debug.h
36439--- linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-19 00:06:34.000000000 -0400
36440+++ linux-2.6.39.2/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-22 19:36:32.000000000 -0400
36441@@ -68,8 +68,8 @@ do {
36442 } while (0)
36443
36444 #else
36445-#define IWL_DEBUG(__priv, level, fmt, args...)
36446-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
36447+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
36448+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
36449 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
36450 const void *p, u32 len)
36451 {}
36452diff -urNp linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/cfg80211.c linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/cfg80211.c
36453--- linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
36454+++ linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
36455@@ -763,7 +763,7 @@ static int iwm_cfg80211_flush_pmksa(stru
36456 }
36457
36458
36459-static struct cfg80211_ops iwm_cfg80211_ops = {
36460+static const struct cfg80211_ops iwm_cfg80211_ops = {
36461 .change_virtual_intf = iwm_cfg80211_change_iface,
36462 .add_key = iwm_cfg80211_add_key,
36463 .get_key = iwm_cfg80211_get_key,
36464diff -urNp linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/debugfs.c
36465--- linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36466+++ linux-2.6.39.2/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36467@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
36468 int buf_len = 512;
36469 size_t len = 0;
36470
36471+ pax_track_stack();
36472+
36473 if (*ppos != 0)
36474 return 0;
36475 if (count < sizeof(buf))
36476diff -urNp linux-2.6.39.2/drivers/net/wireless/libertas/cfg.c linux-2.6.39.2/drivers/net/wireless/libertas/cfg.c
36477--- linux-2.6.39.2/drivers/net/wireless/libertas/cfg.c 2011-05-19 00:06:34.000000000 -0400
36478+++ linux-2.6.39.2/drivers/net/wireless/libertas/cfg.c 2011-05-22 19:36:32.000000000 -0400
36479@@ -2003,7 +2003,7 @@ static int lbs_leave_ibss(struct wiphy *
36480 * Initialization
36481 */
36482
36483-static struct cfg80211_ops lbs_cfg80211_ops = {
36484+static const struct cfg80211_ops lbs_cfg80211_ops = {
36485 .set_channel = lbs_cfg_set_channel,
36486 .scan = lbs_cfg_scan,
36487 .connect = lbs_cfg_connect,
36488diff -urNp linux-2.6.39.2/drivers/net/wireless/libertas/debugfs.c linux-2.6.39.2/drivers/net/wireless/libertas/debugfs.c
36489--- linux-2.6.39.2/drivers/net/wireless/libertas/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36490+++ linux-2.6.39.2/drivers/net/wireless/libertas/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36491@@ -702,7 +702,7 @@ out_unlock:
36492 struct lbs_debugfs_files {
36493 const char *name;
36494 int perm;
36495- struct file_operations fops;
36496+ const struct file_operations fops;
36497 };
36498
36499 static const struct lbs_debugfs_files debugfs_files[] = {
36500diff -urNp linux-2.6.39.2/drivers/net/wireless/rndis_wlan.c linux-2.6.39.2/drivers/net/wireless/rndis_wlan.c
36501--- linux-2.6.39.2/drivers/net/wireless/rndis_wlan.c 2011-05-19 00:06:34.000000000 -0400
36502+++ linux-2.6.39.2/drivers/net/wireless/rndis_wlan.c 2011-05-22 19:36:32.000000000 -0400
36503@@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
36504
36505 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
36506
36507- if (rts_threshold < 0 || rts_threshold > 2347)
36508+ if (rts_threshold > 2347)
36509 rts_threshold = 2347;
36510
36511 tmp = cpu_to_le32(rts_threshold);
36512diff -urNp linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.c linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.c
36513--- linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.c 2011-05-19 00:06:34.000000000 -0400
36514+++ linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.c 2011-05-22 19:36:32.000000000 -0400
36515@@ -1869,7 +1869,7 @@ int rtl_pci_resume(struct pci_dev *pdev)
36516 }
36517 EXPORT_SYMBOL(rtl_pci_resume);
36518
36519-struct rtl_intf_ops rtl_pci_ops = {
36520+const struct rtl_intf_ops rtl_pci_ops = {
36521 .adapter_start = rtl_pci_start,
36522 .adapter_stop = rtl_pci_stop,
36523 .adapter_tx = rtl_pci_tx,
36524diff -urNp linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.h linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.h
36525--- linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.h 2011-05-19 00:06:34.000000000 -0400
36526+++ linux-2.6.39.2/drivers/net/wireless/rtlwifi/pci.h 2011-05-22 19:36:32.000000000 -0400
36527@@ -234,7 +234,7 @@ struct rtl_pci_priv {
36528
36529 int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw);
36530
36531-extern struct rtl_intf_ops rtl_pci_ops;
36532+extern const struct rtl_intf_ops rtl_pci_ops;
36533
36534 int __devinit rtl_pci_probe(struct pci_dev *pdev,
36535 const struct pci_device_id *id);
36536diff -urNp linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
36537--- linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-19 00:06:34.000000000 -0400
36538+++ linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-22 19:36:32.000000000 -0400
36539@@ -827,6 +827,8 @@ static bool _rtl92c_phy_sw_chnl_step_by_
36540 u8 rfpath;
36541 u8 num_total_rfpath = rtlphy->num_total_rfpath;
36542
36543+ pax_track_stack();
36544+
36545 precommoncmdcnt = 0;
36546 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
36547 MAX_PRECMD_CNT,
36548diff -urNp linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
36549--- linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-19 00:06:34.000000000 -0400
36550+++ linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-22 19:36:32.000000000 -0400
36551@@ -96,7 +96,7 @@ void rtl92c_deinit_sw_vars(struct ieee80
36552 }
36553 }
36554
36555-static struct rtl_hal_ops rtl8192ce_hal_ops = {
36556+static const struct rtl_hal_ops rtl8192ce_hal_ops = {
36557 .init_sw_vars = rtl92c_init_sw_vars,
36558 .deinit_sw_vars = rtl92c_deinit_sw_vars,
36559 .read_eeprom_info = rtl92ce_read_eeprom_info,
36560@@ -151,7 +151,7 @@ static struct rtl_mod_params rtl92ce_mod
36561 .sw_crypto = 0,
36562 };
36563
36564-static struct rtl_hal_cfg rtl92ce_hal_cfg = {
36565+static const struct rtl_hal_cfg rtl92ce_hal_cfg = {
36566 .name = "rtl92c_pci",
36567 .fw_name = "rtlwifi/rtl8192cfw.bin",
36568 .ops = &rtl8192ce_hal_ops,
36569diff -urNp linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
36570--- linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-19 00:06:34.000000000 -0400
36571+++ linux-2.6.39.2/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-22 19:36:32.000000000 -0400
36572@@ -77,7 +77,7 @@ static void rtl92cu_deinit_sw_vars(struc
36573 }
36574 }
36575
36576-static struct rtl_hal_ops rtl8192cu_hal_ops = {
36577+static const struct rtl_hal_ops rtl8192cu_hal_ops = {
36578 .init_sw_vars = rtl92cu_init_sw_vars,
36579 .deinit_sw_vars = rtl92cu_deinit_sw_vars,
36580 .read_chip_version = rtl92c_read_chip_version,
36581@@ -147,7 +147,7 @@ static struct rtl_hal_usbint_cfg rtl92cu
36582 .usb_mq_to_hwq = rtl8192cu_mq_to_hwq,
36583 };
36584
36585-static struct rtl_hal_cfg rtl92cu_hal_cfg = {
36586+static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
36587 .name = "rtl92c_usb",
36588 .fw_name = "rtlwifi/rtl8192cufw.bin",
36589 .ops = &rtl8192cu_hal_ops,
36590diff -urNp linux-2.6.39.2/drivers/net/wireless/rtlwifi/usb.c linux-2.6.39.2/drivers/net/wireless/rtlwifi/usb.c
36591--- linux-2.6.39.2/drivers/net/wireless/rtlwifi/usb.c 2011-05-19 00:06:34.000000000 -0400
36592+++ linux-2.6.39.2/drivers/net/wireless/rtlwifi/usb.c 2011-05-22 19:36:32.000000000 -0400
36593@@ -913,7 +913,7 @@ static bool rtl_usb_tx_chk_waitq_insert(
36594 return false;
36595 }
36596
36597-static struct rtl_intf_ops rtl_usb_ops = {
36598+static const struct rtl_intf_ops rtl_usb_ops = {
36599 .adapter_start = rtl_usb_start,
36600 .adapter_stop = rtl_usb_stop,
36601 .adapter_tx = rtl_usb_tx,
36602diff -urNp linux-2.6.39.2/drivers/net/wireless/rtlwifi/wifi.h linux-2.6.39.2/drivers/net/wireless/rtlwifi/wifi.h
36603--- linux-2.6.39.2/drivers/net/wireless/rtlwifi/wifi.h 2011-05-19 00:06:34.000000000 -0400
36604+++ linux-2.6.39.2/drivers/net/wireless/rtlwifi/wifi.h 2011-05-22 19:36:32.000000000 -0400
36605@@ -1447,7 +1447,7 @@ struct rtl_hal_cfg {
36606 u8 bar_id;
36607 char *name;
36608 char *fw_name;
36609- struct rtl_hal_ops *ops;
36610+ const struct rtl_hal_ops *ops;
36611 struct rtl_mod_params *mod_params;
36612 struct rtl_hal_usbint_cfg *usb_interface_cfg;
36613
36614@@ -1533,7 +1533,7 @@ struct rtl_priv {
36615 *intf_ops : for diff interrface usb/pcie
36616 */
36617 struct rtl_hal_cfg *cfg;
36618- struct rtl_intf_ops *intf_ops;
36619+ const struct rtl_intf_ops *intf_ops;
36620
36621 /*this var will be set by set_bit,
36622 and was used to indicate status of
36623diff -urNp linux-2.6.39.2/drivers/net/wireless/wl12xx/spi.c linux-2.6.39.2/drivers/net/wireless/wl12xx/spi.c
36624--- linux-2.6.39.2/drivers/net/wireless/wl12xx/spi.c 2011-05-19 00:06:34.000000000 -0400
36625+++ linux-2.6.39.2/drivers/net/wireless/wl12xx/spi.c 2011-05-22 19:36:32.000000000 -0400
36626@@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct
36627 u32 chunk_len;
36628 int i;
36629
36630+ pax_track_stack();
36631+
36632 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
36633
36634 spi_message_init(&m);
36635diff -urNp linux-2.6.39.2/drivers/net/xen-netback/interface.c linux-2.6.39.2/drivers/net/xen-netback/interface.c
36636--- linux-2.6.39.2/drivers/net/xen-netback/interface.c 2011-05-19 00:06:34.000000000 -0400
36637+++ linux-2.6.39.2/drivers/net/xen-netback/interface.c 2011-05-22 19:36:32.000000000 -0400
36638@@ -273,7 +273,7 @@ static void xenvif_get_strings(struct ne
36639 }
36640 }
36641
36642-static struct ethtool_ops xenvif_ethtool_ops = {
36643+static const struct ethtool_ops xenvif_ethtool_ops = {
36644 .get_tx_csum = ethtool_op_get_tx_csum,
36645 .set_tx_csum = xenvif_set_tx_csum,
36646 .get_sg = ethtool_op_get_sg,
36647diff -urNp linux-2.6.39.2/drivers/net/xilinx_emaclite.c linux-2.6.39.2/drivers/net/xilinx_emaclite.c
36648--- linux-2.6.39.2/drivers/net/xilinx_emaclite.c 2011-05-19 00:06:34.000000000 -0400
36649+++ linux-2.6.39.2/drivers/net/xilinx_emaclite.c 2011-05-22 19:36:32.000000000 -0400
36650@@ -1085,7 +1085,7 @@ static bool get_bool(struct platform_dev
36651 }
36652 }
36653
36654-static struct net_device_ops xemaclite_netdev_ops;
36655+static const struct net_device_ops xemaclite_netdev_ops;
36656
36657 /**
36658 * xemaclite_of_probe - Probe method for the Emaclite device.
36659@@ -1264,7 +1264,7 @@ xemaclite_poll_controller(struct net_dev
36660 }
36661 #endif
36662
36663-static struct net_device_ops xemaclite_netdev_ops = {
36664+static const struct net_device_ops xemaclite_netdev_ops = {
36665 .ndo_open = xemaclite_open,
36666 .ndo_stop = xemaclite_close,
36667 .ndo_start_xmit = xemaclite_send,
36668diff -urNp linux-2.6.39.2/drivers/nfc/pn544.c linux-2.6.39.2/drivers/nfc/pn544.c
36669--- linux-2.6.39.2/drivers/nfc/pn544.c 2011-05-19 00:06:34.000000000 -0400
36670+++ linux-2.6.39.2/drivers/nfc/pn544.c 2011-05-22 19:36:32.000000000 -0400
36671@@ -89,7 +89,7 @@ static ssize_t pn544_test(struct device
36672
36673 static int pn544_enable(struct pn544_info *info, int mode)
36674 {
36675- struct pn544_nfc_platform_data *pdata;
36676+ const struct pn544_nfc_platform_data *pdata;
36677 struct i2c_client *client = info->i2c_dev;
36678
36679 int r;
36680@@ -118,7 +118,7 @@ static int pn544_enable(struct pn544_inf
36681
36682 static void pn544_disable(struct pn544_info *info)
36683 {
36684- struct pn544_nfc_platform_data *pdata;
36685+ const struct pn544_nfc_platform_data *pdata;
36686 struct i2c_client *client = info->i2c_dev;
36687
36688 pdata = client->dev.platform_data;
36689@@ -509,7 +509,7 @@ static long pn544_ioctl(struct file *fil
36690 struct pn544_info *info = container_of(file->private_data,
36691 struct pn544_info, miscdev);
36692 struct i2c_client *client = info->i2c_dev;
36693- struct pn544_nfc_platform_data *pdata;
36694+ const struct pn544_nfc_platform_data *pdata;
36695 unsigned int val;
36696 int r = 0;
36697
36698@@ -715,7 +715,7 @@ static int __devinit pn544_probe(struct
36699 const struct i2c_device_id *id)
36700 {
36701 struct pn544_info *info;
36702- struct pn544_nfc_platform_data *pdata;
36703+ const struct pn544_nfc_platform_data *pdata;
36704 int r = 0;
36705
36706 dev_dbg(&client->dev, "%s\n", __func__);
36707diff -urNp linux-2.6.39.2/drivers/of/pdt.c linux-2.6.39.2/drivers/of/pdt.c
36708--- linux-2.6.39.2/drivers/of/pdt.c 2011-05-19 00:06:34.000000000 -0400
36709+++ linux-2.6.39.2/drivers/of/pdt.c 2011-05-22 19:36:32.000000000 -0400
36710@@ -24,7 +24,7 @@
36711 #include <linux/of_pdt.h>
36712 #include <asm/prom.h>
36713
36714-static struct of_pdt_ops *of_pdt_prom_ops __initdata;
36715+static const struct of_pdt_ops *of_pdt_prom_ops;
36716
36717 void __initdata (*of_pdt_build_more)(struct device_node *dp,
36718 struct device_node ***nextp);
36719diff -urNp linux-2.6.39.2/drivers/oprofile/buffer_sync.c linux-2.6.39.2/drivers/oprofile/buffer_sync.c
36720--- linux-2.6.39.2/drivers/oprofile/buffer_sync.c 2011-06-25 12:55:22.000000000 -0400
36721+++ linux-2.6.39.2/drivers/oprofile/buffer_sync.c 2011-06-25 13:00:26.000000000 -0400
36722@@ -343,7 +343,7 @@ static void add_data(struct op_entry *en
36723 if (cookie == NO_COOKIE)
36724 offset = pc;
36725 if (cookie == INVALID_COOKIE) {
36726- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36727+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36728 offset = pc;
36729 }
36730 if (cookie != last_cookie) {
36731@@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct
36732 /* add userspace sample */
36733
36734 if (!mm) {
36735- atomic_inc(&oprofile_stats.sample_lost_no_mm);
36736+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
36737 return 0;
36738 }
36739
36740 cookie = lookup_dcookie(mm, s->eip, &offset);
36741
36742 if (cookie == INVALID_COOKIE) {
36743- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36744+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36745 return 0;
36746 }
36747
36748@@ -563,7 +563,7 @@ void sync_buffer(int cpu)
36749 /* ignore backtraces if failed to add a sample */
36750 if (state == sb_bt_start) {
36751 state = sb_bt_ignore;
36752- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
36753+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
36754 }
36755 }
36756 release_mm(mm);
36757diff -urNp linux-2.6.39.2/drivers/oprofile/event_buffer.c linux-2.6.39.2/drivers/oprofile/event_buffer.c
36758--- linux-2.6.39.2/drivers/oprofile/event_buffer.c 2011-05-19 00:06:34.000000000 -0400
36759+++ linux-2.6.39.2/drivers/oprofile/event_buffer.c 2011-05-22 19:36:32.000000000 -0400
36760@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
36761 }
36762
36763 if (buffer_pos == buffer_size) {
36764- atomic_inc(&oprofile_stats.event_lost_overflow);
36765+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
36766 return;
36767 }
36768
36769diff -urNp linux-2.6.39.2/drivers/oprofile/oprof.c linux-2.6.39.2/drivers/oprofile/oprof.c
36770--- linux-2.6.39.2/drivers/oprofile/oprof.c 2011-05-19 00:06:34.000000000 -0400
36771+++ linux-2.6.39.2/drivers/oprofile/oprof.c 2011-05-22 19:36:32.000000000 -0400
36772@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
36773 if (oprofile_ops.switch_events())
36774 return;
36775
36776- atomic_inc(&oprofile_stats.multiplex_counter);
36777+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
36778 start_switch_worker();
36779 }
36780
36781diff -urNp linux-2.6.39.2/drivers/oprofile/oprofilefs.c linux-2.6.39.2/drivers/oprofile/oprofilefs.c
36782--- linux-2.6.39.2/drivers/oprofile/oprofilefs.c 2011-05-19 00:06:34.000000000 -0400
36783+++ linux-2.6.39.2/drivers/oprofile/oprofilefs.c 2011-05-22 19:36:32.000000000 -0400
36784@@ -186,7 +186,7 @@ static const struct file_operations atom
36785
36786
36787 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
36788- char const *name, atomic_t *val)
36789+ char const *name, atomic_unchecked_t *val)
36790 {
36791 return __oprofilefs_create_file(sb, root, name,
36792 &atomic_ro_fops, 0444, val);
36793diff -urNp linux-2.6.39.2/drivers/oprofile/oprofile_stats.c linux-2.6.39.2/drivers/oprofile/oprofile_stats.c
36794--- linux-2.6.39.2/drivers/oprofile/oprofile_stats.c 2011-05-19 00:06:34.000000000 -0400
36795+++ linux-2.6.39.2/drivers/oprofile/oprofile_stats.c 2011-05-22 19:36:32.000000000 -0400
36796@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
36797 cpu_buf->sample_invalid_eip = 0;
36798 }
36799
36800- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
36801- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
36802- atomic_set(&oprofile_stats.event_lost_overflow, 0);
36803- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
36804- atomic_set(&oprofile_stats.multiplex_counter, 0);
36805+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
36806+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
36807+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
36808+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
36809+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
36810 }
36811
36812
36813diff -urNp linux-2.6.39.2/drivers/oprofile/oprofile_stats.h linux-2.6.39.2/drivers/oprofile/oprofile_stats.h
36814--- linux-2.6.39.2/drivers/oprofile/oprofile_stats.h 2011-05-19 00:06:34.000000000 -0400
36815+++ linux-2.6.39.2/drivers/oprofile/oprofile_stats.h 2011-05-22 19:36:32.000000000 -0400
36816@@ -13,11 +13,11 @@
36817 #include <asm/atomic.h>
36818
36819 struct oprofile_stat_struct {
36820- atomic_t sample_lost_no_mm;
36821- atomic_t sample_lost_no_mapping;
36822- atomic_t bt_lost_no_mapping;
36823- atomic_t event_lost_overflow;
36824- atomic_t multiplex_counter;
36825+ atomic_unchecked_t sample_lost_no_mm;
36826+ atomic_unchecked_t sample_lost_no_mapping;
36827+ atomic_unchecked_t bt_lost_no_mapping;
36828+ atomic_unchecked_t event_lost_overflow;
36829+ atomic_unchecked_t multiplex_counter;
36830 };
36831
36832 extern struct oprofile_stat_struct oprofile_stats;
36833diff -urNp linux-2.6.39.2/drivers/parisc/dino.c linux-2.6.39.2/drivers/parisc/dino.c
36834--- linux-2.6.39.2/drivers/parisc/dino.c 2011-05-19 00:06:34.000000000 -0400
36835+++ linux-2.6.39.2/drivers/parisc/dino.c 2011-05-22 19:36:32.000000000 -0400
36836@@ -238,7 +238,7 @@ static int dino_cfg_write(struct pci_bus
36837 return 0;
36838 }
36839
36840-static struct pci_ops dino_cfg_ops = {
36841+static const struct pci_ops dino_cfg_ops = {
36842 .read = dino_cfg_read,
36843 .write = dino_cfg_write,
36844 };
36845diff -urNp linux-2.6.39.2/drivers/parisc/lba_pci.c linux-2.6.39.2/drivers/parisc/lba_pci.c
36846--- linux-2.6.39.2/drivers/parisc/lba_pci.c 2011-05-19 00:06:34.000000000 -0400
36847+++ linux-2.6.39.2/drivers/parisc/lba_pci.c 2011-05-22 19:36:32.000000000 -0400
36848@@ -468,7 +468,7 @@ static int elroy_cfg_write(struct pci_bu
36849 }
36850
36851
36852-static struct pci_ops elroy_cfg_ops = {
36853+static const struct pci_ops elroy_cfg_ops = {
36854 .read = elroy_cfg_read,
36855 .write = elroy_cfg_write,
36856 };
36857@@ -541,7 +541,7 @@ static int mercury_cfg_write(struct pci_
36858 return 0;
36859 }
36860
36861-static struct pci_ops mercury_cfg_ops = {
36862+static const struct pci_ops mercury_cfg_ops = {
36863 .read = mercury_cfg_read,
36864 .write = mercury_cfg_write,
36865 };
36866@@ -1405,7 +1405,7 @@ lba_driver_probe(struct parisc_device *d
36867 {
36868 struct lba_device *lba_dev;
36869 struct pci_bus *lba_bus;
36870- struct pci_ops *cfg_ops;
36871+ const struct pci_ops *cfg_ops;
36872 u32 func_class;
36873 void *tmp_obj;
36874 char *version;
36875diff -urNp linux-2.6.39.2/drivers/parport/procfs.c linux-2.6.39.2/drivers/parport/procfs.c
36876--- linux-2.6.39.2/drivers/parport/procfs.c 2011-05-19 00:06:34.000000000 -0400
36877+++ linux-2.6.39.2/drivers/parport/procfs.c 2011-05-22 19:36:32.000000000 -0400
36878@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
36879
36880 *ppos += len;
36881
36882- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
36883+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
36884 }
36885
36886 #ifdef CONFIG_PARPORT_1284
36887@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
36888
36889 *ppos += len;
36890
36891- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
36892+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
36893 }
36894 #endif /* IEEE1284.3 support. */
36895
36896diff -urNp linux-2.6.39.2/drivers/pci/access.c linux-2.6.39.2/drivers/pci/access.c
36897--- linux-2.6.39.2/drivers/pci/access.c 2011-05-19 00:06:34.000000000 -0400
36898+++ linux-2.6.39.2/drivers/pci/access.c 2011-05-22 19:36:32.000000000 -0400
36899@@ -74,9 +74,9 @@ EXPORT_SYMBOL(pci_bus_write_config_dword
36900 *
36901 * Return previous raw operations
36902 */
36903-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops)
36904+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops)
36905 {
36906- struct pci_ops *old_ops;
36907+ const struct pci_ops *old_ops;
36908 unsigned long flags;
36909
36910 raw_spin_lock_irqsave(&pci_lock, flags);
36911diff -urNp linux-2.6.39.2/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.39.2/drivers/pci/hotplug/acpiphp_glue.c
36912--- linux-2.6.39.2/drivers/pci/hotplug/acpiphp_glue.c 2011-05-19 00:06:34.000000000 -0400
36913+++ linux-2.6.39.2/drivers/pci/hotplug/acpiphp_glue.c 2011-05-22 19:36:32.000000000 -0400
36914@@ -110,7 +110,7 @@ static int post_dock_fixups(struct notif
36915 }
36916
36917
36918-static struct acpi_dock_ops acpiphp_dock_ops = {
36919+static const struct acpi_dock_ops acpiphp_dock_ops = {
36920 .handler = handle_hotplug_event_func,
36921 };
36922
36923diff -urNp linux-2.6.39.2/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.39.2/drivers/pci/hotplug/cpqphp_nvram.c
36924--- linux-2.6.39.2/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-19 00:06:34.000000000 -0400
36925+++ linux-2.6.39.2/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-22 19:36:32.000000000 -0400
36926@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
36927
36928 void compaq_nvram_init (void __iomem *rom_start)
36929 {
36930+
36931+#ifndef CONFIG_PAX_KERNEXEC
36932 if (rom_start) {
36933 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
36934 }
36935+#endif
36936+
36937 dbg("int15 entry = %p\n", compaq_int15_entry_point);
36938
36939 /* initialize our int15 lock */
36940diff -urNp linux-2.6.39.2/drivers/pci/hotplug/shpchp.h linux-2.6.39.2/drivers/pci/hotplug/shpchp.h
36941--- linux-2.6.39.2/drivers/pci/hotplug/shpchp.h 2011-05-19 00:06:34.000000000 -0400
36942+++ linux-2.6.39.2/drivers/pci/hotplug/shpchp.h 2011-05-22 19:36:32.000000000 -0400
36943@@ -86,7 +86,7 @@ struct slot {
36944 u8 presence_save;
36945 u8 pwr_save;
36946 struct controller *ctrl;
36947- struct hpc_ops *hpc_ops;
36948+ const struct hpc_ops *hpc_ops;
36949 struct hotplug_slot *hotplug_slot;
36950 struct list_head slot_list;
36951 struct delayed_work work; /* work for button event */
36952@@ -107,7 +107,7 @@ struct controller {
36953 int slot_num_inc; /* 1 or -1 */
36954 struct pci_dev *pci_dev;
36955 struct list_head slot_list;
36956- struct hpc_ops *hpc_ops;
36957+ const struct hpc_ops *hpc_ops;
36958 wait_queue_head_t queue; /* sleep & wake process */
36959 u8 slot_device_offset;
36960 u32 pcix_misc2_reg; /* for amd pogo errata */
36961diff -urNp linux-2.6.39.2/drivers/pci/hotplug/shpchp_hpc.c linux-2.6.39.2/drivers/pci/hotplug/shpchp_hpc.c
36962--- linux-2.6.39.2/drivers/pci/hotplug/shpchp_hpc.c 2011-05-19 00:06:34.000000000 -0400
36963+++ linux-2.6.39.2/drivers/pci/hotplug/shpchp_hpc.c 2011-05-22 19:36:32.000000000 -0400
36964@@ -910,7 +910,7 @@ static int shpc_get_max_bus_speed(struct
36965 return retval;
36966 }
36967
36968-static struct hpc_ops shpchp_hpc_ops = {
36969+static const struct hpc_ops shpchp_hpc_ops = {
36970 .power_on_slot = hpc_power_on_slot,
36971 .slot_enable = hpc_slot_enable,
36972 .slot_disable = hpc_slot_disable,
36973diff -urNp linux-2.6.39.2/drivers/pci/intel-iommu.c linux-2.6.39.2/drivers/pci/intel-iommu.c
36974--- linux-2.6.39.2/drivers/pci/intel-iommu.c 2011-06-25 12:55:22.000000000 -0400
36975+++ linux-2.6.39.2/drivers/pci/intel-iommu.c 2011-06-25 13:00:26.000000000 -0400
36976@@ -393,7 +393,7 @@ static int intel_iommu_strict;
36977 static DEFINE_SPINLOCK(device_domain_lock);
36978 static LIST_HEAD(device_domain_list);
36979
36980-static struct iommu_ops intel_iommu_ops;
36981+static const struct iommu_ops intel_iommu_ops;
36982
36983 static int __init intel_iommu_setup(char *str)
36984 {
36985@@ -2964,7 +2964,7 @@ static int intel_mapping_error(struct de
36986 return !dma_addr;
36987 }
36988
36989-struct dma_map_ops intel_dma_ops = {
36990+const struct dma_map_ops intel_dma_ops = {
36991 .alloc_coherent = intel_alloc_coherent,
36992 .free_coherent = intel_free_coherent,
36993 .map_sg = intel_map_sg,
36994@@ -3761,7 +3761,7 @@ static int intel_iommu_domain_has_cap(st
36995 return 0;
36996 }
36997
36998-static struct iommu_ops intel_iommu_ops = {
36999+static const struct iommu_ops intel_iommu_ops = {
37000 .domain_init = intel_iommu_domain_init,
37001 .domain_destroy = intel_iommu_domain_destroy,
37002 .attach_dev = intel_iommu_attach_device,
37003diff -urNp linux-2.6.39.2/drivers/pci/pci-acpi.c linux-2.6.39.2/drivers/pci/pci-acpi.c
37004--- linux-2.6.39.2/drivers/pci/pci-acpi.c 2011-05-19 00:06:34.000000000 -0400
37005+++ linux-2.6.39.2/drivers/pci/pci-acpi.c 2011-05-22 19:36:32.000000000 -0400
37006@@ -332,7 +332,7 @@ static int acpi_pci_run_wake(struct pci_
37007 return 0;
37008 }
37009
37010-static struct pci_platform_pm_ops acpi_pci_platform_pm = {
37011+static const struct pci_platform_pm_ops acpi_pci_platform_pm = {
37012 .is_manageable = acpi_pci_power_manageable,
37013 .set_state = acpi_pci_set_power_state,
37014 .choose_state = acpi_pci_choose_state,
37015diff -urNp linux-2.6.39.2/drivers/pci/pci.c linux-2.6.39.2/drivers/pci/pci.c
37016--- linux-2.6.39.2/drivers/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
37017+++ linux-2.6.39.2/drivers/pci/pci.c 2011-05-22 19:36:32.000000000 -0400
37018@@ -480,9 +480,9 @@ pci_restore_bars(struct pci_dev *dev)
37019 pci_update_resource(dev, i);
37020 }
37021
37022-static struct pci_platform_pm_ops *pci_platform_pm;
37023+static const struct pci_platform_pm_ops *pci_platform_pm;
37024
37025-int pci_set_platform_pm(struct pci_platform_pm_ops *ops)
37026+int pci_set_platform_pm(const struct pci_platform_pm_ops *ops)
37027 {
37028 if (!ops->is_manageable || !ops->set_state || !ops->choose_state
37029 || !ops->sleep_wake || !ops->can_wakeup)
37030diff -urNp linux-2.6.39.2/drivers/pci/pcie/aer/aerdrv_core.c linux-2.6.39.2/drivers/pci/pcie/aer/aerdrv_core.c
37031--- linux-2.6.39.2/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-19 00:06:34.000000000 -0400
37032+++ linux-2.6.39.2/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-22 19:36:32.000000000 -0400
37033@@ -239,7 +239,7 @@ static bool find_source_device(struct pc
37034 static int report_error_detected(struct pci_dev *dev, void *data)
37035 {
37036 pci_ers_result_t vote;
37037- struct pci_error_handlers *err_handler;
37038+ const struct pci_error_handlers *err_handler;
37039 struct aer_broadcast_data *result_data;
37040 result_data = (struct aer_broadcast_data *) data;
37041
37042@@ -273,7 +273,7 @@ static int report_error_detected(struct
37043 static int report_mmio_enabled(struct pci_dev *dev, void *data)
37044 {
37045 pci_ers_result_t vote;
37046- struct pci_error_handlers *err_handler;
37047+ const struct pci_error_handlers *err_handler;
37048 struct aer_broadcast_data *result_data;
37049 result_data = (struct aer_broadcast_data *) data;
37050
37051@@ -291,7 +291,7 @@ static int report_mmio_enabled(struct pc
37052 static int report_slot_reset(struct pci_dev *dev, void *data)
37053 {
37054 pci_ers_result_t vote;
37055- struct pci_error_handlers *err_handler;
37056+ const struct pci_error_handlers *err_handler;
37057 struct aer_broadcast_data *result_data;
37058 result_data = (struct aer_broadcast_data *) data;
37059
37060@@ -308,7 +308,7 @@ static int report_slot_reset(struct pci_
37061
37062 static int report_resume(struct pci_dev *dev, void *data)
37063 {
37064- struct pci_error_handlers *err_handler;
37065+ const struct pci_error_handlers *err_handler;
37066
37067 dev->error_state = pci_channel_io_normal;
37068
37069diff -urNp linux-2.6.39.2/drivers/pci/pcie/aer/aer_inject.c linux-2.6.39.2/drivers/pci/pcie/aer/aer_inject.c
37070--- linux-2.6.39.2/drivers/pci/pcie/aer/aer_inject.c 2011-05-19 00:06:34.000000000 -0400
37071+++ linux-2.6.39.2/drivers/pci/pcie/aer/aer_inject.c 2011-05-22 19:36:32.000000000 -0400
37072@@ -64,7 +64,7 @@ struct aer_error {
37073 struct pci_bus_ops {
37074 struct list_head list;
37075 struct pci_bus *bus;
37076- struct pci_ops *ops;
37077+ const struct pci_ops *ops;
37078 };
37079
37080 static LIST_HEAD(einjected);
37081@@ -110,7 +110,7 @@ static struct aer_error *__find_aer_erro
37082 }
37083
37084 /* inject_lock must be held before calling */
37085-static struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
37086+static const struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
37087 {
37088 struct pci_bus_ops *bus_ops;
37089
37090@@ -187,7 +187,7 @@ static int pci_read_aer(struct pci_bus *
37091 u32 *sim;
37092 struct aer_error *err;
37093 unsigned long flags;
37094- struct pci_ops *ops;
37095+ const struct pci_ops *ops;
37096 int domain;
37097
37098 spin_lock_irqsave(&inject_lock, flags);
37099@@ -219,7 +219,7 @@ int pci_write_aer(struct pci_bus *bus, u
37100 struct aer_error *err;
37101 unsigned long flags;
37102 int rw1cs;
37103- struct pci_ops *ops;
37104+ const struct pci_ops *ops;
37105 int domain;
37106
37107 spin_lock_irqsave(&inject_lock, flags);
37108@@ -254,7 +254,7 @@ static struct pci_ops pci_ops_aer = {
37109
37110 static void pci_bus_ops_init(struct pci_bus_ops *bus_ops,
37111 struct pci_bus *bus,
37112- struct pci_ops *ops)
37113+ const struct pci_ops *ops)
37114 {
37115 INIT_LIST_HEAD(&bus_ops->list);
37116 bus_ops->bus = bus;
37117@@ -263,7 +263,7 @@ static void pci_bus_ops_init(struct pci_
37118
37119 static int pci_bus_set_aer_ops(struct pci_bus *bus)
37120 {
37121- struct pci_ops *ops;
37122+ const struct pci_ops *ops;
37123 struct pci_bus_ops *bus_ops;
37124 unsigned long flags;
37125
37126diff -urNp linux-2.6.39.2/drivers/pci/pcie/aspm.c linux-2.6.39.2/drivers/pci/pcie/aspm.c
37127--- linux-2.6.39.2/drivers/pci/pcie/aspm.c 2011-05-19 00:06:34.000000000 -0400
37128+++ linux-2.6.39.2/drivers/pci/pcie/aspm.c 2011-05-22 19:36:32.000000000 -0400
37129@@ -27,9 +27,9 @@
37130 #define MODULE_PARAM_PREFIX "pcie_aspm."
37131
37132 /* Note: those are not register definitions */
37133-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
37134-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
37135-#define ASPM_STATE_L1 (4) /* L1 state */
37136+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
37137+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
37138+#define ASPM_STATE_L1 (4U) /* L1 state */
37139 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
37140 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
37141
37142diff -urNp linux-2.6.39.2/drivers/pci/pci.h linux-2.6.39.2/drivers/pci/pci.h
37143--- linux-2.6.39.2/drivers/pci/pci.h 2011-05-19 00:06:34.000000000 -0400
37144+++ linux-2.6.39.2/drivers/pci/pci.h 2011-05-22 19:36:32.000000000 -0400
37145@@ -65,7 +65,7 @@ struct pci_platform_pm_ops {
37146 int (*run_wake)(struct pci_dev *dev, bool enable);
37147 };
37148
37149-extern int pci_set_platform_pm(struct pci_platform_pm_ops *ops);
37150+extern int pci_set_platform_pm(const struct pci_platform_pm_ops *ops);
37151 extern void pci_update_current_state(struct pci_dev *dev, pci_power_t state);
37152 extern void pci_disable_enabled_device(struct pci_dev *dev);
37153 extern int pci_finish_runtime_suspend(struct pci_dev *dev);
37154diff -urNp linux-2.6.39.2/drivers/pci/probe.c linux-2.6.39.2/drivers/pci/probe.c
37155--- linux-2.6.39.2/drivers/pci/probe.c 2011-05-19 00:06:34.000000000 -0400
37156+++ linux-2.6.39.2/drivers/pci/probe.c 2011-05-22 19:36:32.000000000 -0400
37157@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
37158 return ret;
37159 }
37160
37161-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
37162+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
37163 struct device_attribute *attr,
37164 char *buf)
37165 {
37166 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
37167 }
37168
37169-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
37170+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
37171 struct device_attribute *attr,
37172 char *buf)
37173 {
37174@@ -165,7 +165,7 @@ int __pci_read_base(struct pci_dev *dev,
37175 u32 l, sz, mask;
37176 u16 orig_cmd;
37177
37178- mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
37179+ mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
37180
37181 if (!dev->mmio_always_on) {
37182 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
37183@@ -1407,7 +1407,7 @@ unsigned int __devinit pci_scan_child_bu
37184 }
37185
37186 struct pci_bus * pci_create_bus(struct device *parent,
37187- int bus, struct pci_ops *ops, void *sysdata)
37188+ int bus, const struct pci_ops *ops, void *sysdata)
37189 {
37190 int error;
37191 struct pci_bus *b, *b2;
37192@@ -1483,7 +1483,7 @@ err_out:
37193 }
37194
37195 struct pci_bus * __devinit pci_scan_bus_parented(struct device *parent,
37196- int bus, struct pci_ops *ops, void *sysdata)
37197+ int bus, const struct pci_ops *ops, void *sysdata)
37198 {
37199 struct pci_bus *b;
37200
37201diff -urNp linux-2.6.39.2/drivers/pci/proc.c linux-2.6.39.2/drivers/pci/proc.c
37202--- linux-2.6.39.2/drivers/pci/proc.c 2011-05-19 00:06:34.000000000 -0400
37203+++ linux-2.6.39.2/drivers/pci/proc.c 2011-05-22 19:41:37.000000000 -0400
37204@@ -476,7 +476,16 @@ static const struct file_operations proc
37205 static int __init pci_proc_init(void)
37206 {
37207 struct pci_dev *dev = NULL;
37208+
37209+#ifdef CONFIG_GRKERNSEC_PROC_ADD
37210+#ifdef CONFIG_GRKERNSEC_PROC_USER
37211+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
37212+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
37213+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
37214+#endif
37215+#else
37216 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
37217+#endif
37218 proc_create("devices", 0, proc_bus_pci_dir,
37219 &proc_bus_pci_dev_operations);
37220 proc_initialized = 1;
37221diff -urNp linux-2.6.39.2/drivers/pci/xen-pcifront.c linux-2.6.39.2/drivers/pci/xen-pcifront.c
37222--- linux-2.6.39.2/drivers/pci/xen-pcifront.c 2011-05-19 00:06:34.000000000 -0400
37223+++ linux-2.6.39.2/drivers/pci/xen-pcifront.c 2011-05-22 19:36:32.000000000 -0400
37224@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
37225 struct pcifront_sd *sd = bus->sysdata;
37226 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37227
37228+ pax_track_stack();
37229+
37230 if (verbose_request)
37231 dev_info(&pdev->xdev->dev,
37232 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
37233@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
37234 struct pcifront_sd *sd = bus->sysdata;
37235 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37236
37237+ pax_track_stack();
37238+
37239 if (verbose_request)
37240 dev_info(&pdev->xdev->dev,
37241 "write dev=%04x:%02x:%02x.%01x - "
37242@@ -236,7 +240,7 @@ static int pcifront_bus_write(struct pci
37243 return errno_to_pcibios_err(do_pci_op(pdev, &op));
37244 }
37245
37246-struct pci_ops pcifront_bus_ops = {
37247+const struct pci_ops pcifront_bus_ops = {
37248 .read = pcifront_bus_read,
37249 .write = pcifront_bus_write,
37250 };
37251@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
37252 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37253 struct msi_desc *entry;
37254
37255+ pax_track_stack();
37256+
37257 if (nvec > SH_INFO_MAX_VEC) {
37258 dev_err(&dev->dev, "too much vector for pci frontend: %x."
37259 " Increase SH_INFO_MAX_VEC.\n", nvec);
37260@@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st
37261 struct pcifront_sd *sd = dev->bus->sysdata;
37262 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37263
37264+ pax_track_stack();
37265+
37266 err = do_pci_op(pdev, &op);
37267
37268 /* What should do for error ? */
37269@@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc
37270 struct pcifront_sd *sd = dev->bus->sysdata;
37271 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37272
37273+ pax_track_stack();
37274+
37275 err = do_pci_op(pdev, &op);
37276 if (likely(!err)) {
37277 vector[0] = op.value;
37278@@ -368,7 +378,7 @@ static void pci_frontend_disable_msi(str
37279 printk(KERN_DEBUG "get fake response frombackend\n");
37280 }
37281
37282-static struct xen_pci_frontend_ops pci_frontend_ops = {
37283+static const struct xen_pci_frontend_ops pci_frontend_ops = {
37284 .enable_msi = pci_frontend_enable_msi,
37285 .disable_msi = pci_frontend_disable_msi,
37286 .enable_msix = pci_frontend_enable_msix,
37287diff -urNp linux-2.6.39.2/drivers/pcmcia/at91_cf.c linux-2.6.39.2/drivers/pcmcia/at91_cf.c
37288--- linux-2.6.39.2/drivers/pcmcia/at91_cf.c 2011-05-19 00:06:34.000000000 -0400
37289+++ linux-2.6.39.2/drivers/pcmcia/at91_cf.c 2011-05-22 19:36:32.000000000 -0400
37290@@ -203,7 +203,7 @@ at91_cf_set_mem_map(struct pcmcia_socket
37291 return 0;
37292 }
37293
37294-static struct pccard_operations at91_cf_ops = {
37295+static const struct pccard_operations at91_cf_ops = {
37296 .init = at91_cf_ss_init,
37297 .suspend = at91_cf_ss_suspend,
37298 .get_status = at91_cf_get_status,
37299diff -urNp linux-2.6.39.2/drivers/pcmcia/bfin_cf_pcmcia.c linux-2.6.39.2/drivers/pcmcia/bfin_cf_pcmcia.c
37300--- linux-2.6.39.2/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37301+++ linux-2.6.39.2/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37302@@ -184,7 +184,7 @@ bfin_cf_set_mem_map(struct pcmcia_socket
37303 return 0;
37304 }
37305
37306-static struct pccard_operations bfin_cf_ops = {
37307+static const struct pccard_operations bfin_cf_ops = {
37308 .init = bfin_cf_ss_init,
37309 .suspend = bfin_cf_ss_suspend,
37310 .get_status = bfin_cf_get_status,
37311diff -urNp linux-2.6.39.2/drivers/pcmcia/db1xxx_ss.c linux-2.6.39.2/drivers/pcmcia/db1xxx_ss.c
37312--- linux-2.6.39.2/drivers/pcmcia/db1xxx_ss.c 2011-05-19 00:06:34.000000000 -0400
37313+++ linux-2.6.39.2/drivers/pcmcia/db1xxx_ss.c 2011-05-22 19:36:32.000000000 -0400
37314@@ -384,7 +384,7 @@ static int au1x00_pcmcia_set_mem_map(str
37315 return 0;
37316 }
37317
37318-static struct pccard_operations db1x_pcmcia_operations = {
37319+static const struct pccard_operations db1x_pcmcia_operations = {
37320 .init = db1x_pcmcia_sock_init,
37321 .suspend = db1x_pcmcia_sock_suspend,
37322 .get_status = db1x_pcmcia_get_status,
37323diff -urNp linux-2.6.39.2/drivers/pcmcia/electra_cf.c linux-2.6.39.2/drivers/pcmcia/electra_cf.c
37324--- linux-2.6.39.2/drivers/pcmcia/electra_cf.c 2011-05-19 00:06:34.000000000 -0400
37325+++ linux-2.6.39.2/drivers/pcmcia/electra_cf.c 2011-05-22 19:36:32.000000000 -0400
37326@@ -173,7 +173,7 @@ static int electra_cf_set_mem_map(struct
37327 return 0;
37328 }
37329
37330-static struct pccard_operations electra_cf_ops = {
37331+static const struct pccard_operations electra_cf_ops = {
37332 .init = electra_cf_ss_init,
37333 .get_status = electra_cf_get_status,
37334 .set_socket = electra_cf_set_socket,
37335diff -urNp linux-2.6.39.2/drivers/pcmcia/m32r_cfc.c linux-2.6.39.2/drivers/pcmcia/m32r_cfc.c
37336--- linux-2.6.39.2/drivers/pcmcia/m32r_cfc.c 2011-05-19 00:06:34.000000000 -0400
37337+++ linux-2.6.39.2/drivers/pcmcia/m32r_cfc.c 2011-05-22 19:36:32.000000000 -0400
37338@@ -674,7 +674,7 @@ static int pcc_init(struct pcmcia_socket
37339 return 0;
37340 }
37341
37342-static struct pccard_operations pcc_operations = {
37343+static const struct pccard_operations pcc_operations = {
37344 .init = pcc_init,
37345 .get_status = pcc_get_status,
37346 .set_socket = pcc_set_socket,
37347diff -urNp linux-2.6.39.2/drivers/pcmcia/m32r_pcc.c linux-2.6.39.2/drivers/pcmcia/m32r_pcc.c
37348--- linux-2.6.39.2/drivers/pcmcia/m32r_pcc.c 2011-05-19 00:06:34.000000000 -0400
37349+++ linux-2.6.39.2/drivers/pcmcia/m32r_pcc.c 2011-05-22 19:36:32.000000000 -0400
37350@@ -652,7 +652,7 @@ static int pcc_init(struct pcmcia_socket
37351 return 0;
37352 }
37353
37354-static struct pccard_operations pcc_operations = {
37355+static const struct pccard_operations pcc_operations = {
37356 .init = pcc_init,
37357 .get_status = pcc_get_status,
37358 .set_socket = pcc_set_socket,
37359diff -urNp linux-2.6.39.2/drivers/pcmcia/m8xx_pcmcia.c linux-2.6.39.2/drivers/pcmcia/m8xx_pcmcia.c
37360--- linux-2.6.39.2/drivers/pcmcia/m8xx_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37361+++ linux-2.6.39.2/drivers/pcmcia/m8xx_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37362@@ -1139,7 +1139,7 @@ static int m8xx_sock_suspend(struct pcmc
37363 return m8xx_set_socket(sock, &dead_socket);
37364 }
37365
37366-static struct pccard_operations m8xx_services = {
37367+static const struct pccard_operations m8xx_services = {
37368 .init = m8xx_sock_init,
37369 .suspend = m8xx_sock_suspend,
37370 .get_status = m8xx_get_status,
37371diff -urNp linux-2.6.39.2/drivers/pcmcia/omap_cf.c linux-2.6.39.2/drivers/pcmcia/omap_cf.c
37372--- linux-2.6.39.2/drivers/pcmcia/omap_cf.c 2011-05-19 00:06:34.000000000 -0400
37373+++ linux-2.6.39.2/drivers/pcmcia/omap_cf.c 2011-05-22 19:36:32.000000000 -0400
37374@@ -185,7 +185,7 @@ omap_cf_set_mem_map(struct pcmcia_socket
37375 return 0;
37376 }
37377
37378-static struct pccard_operations omap_cf_ops = {
37379+static const struct pccard_operations omap_cf_ops = {
37380 .init = omap_cf_ss_init,
37381 .suspend = omap_cf_ss_suspend,
37382 .get_status = omap_cf_get_status,
37383diff -urNp linux-2.6.39.2/drivers/pcmcia/rsrc_iodyn.c linux-2.6.39.2/drivers/pcmcia/rsrc_iodyn.c
37384--- linux-2.6.39.2/drivers/pcmcia/rsrc_iodyn.c 2011-05-19 00:06:34.000000000 -0400
37385+++ linux-2.6.39.2/drivers/pcmcia/rsrc_iodyn.c 2011-05-22 19:36:32.000000000 -0400
37386@@ -161,7 +161,7 @@ static int iodyn_find_io(struct pcmcia_s
37387 }
37388
37389
37390-struct pccard_resource_ops pccard_iodyn_ops = {
37391+const struct pccard_resource_ops pccard_iodyn_ops = {
37392 .validate_mem = NULL,
37393 .find_io = iodyn_find_io,
37394 .find_mem = NULL,
37395diff -urNp linux-2.6.39.2/drivers/pcmcia/rsrc_mgr.c linux-2.6.39.2/drivers/pcmcia/rsrc_mgr.c
37396--- linux-2.6.39.2/drivers/pcmcia/rsrc_mgr.c 2011-05-19 00:06:34.000000000 -0400
37397+++ linux-2.6.39.2/drivers/pcmcia/rsrc_mgr.c 2011-05-22 19:36:32.000000000 -0400
37398@@ -57,7 +57,7 @@ static int static_find_io(struct pcmcia_
37399 }
37400
37401
37402-struct pccard_resource_ops pccard_static_ops = {
37403+const struct pccard_resource_ops pccard_static_ops = {
37404 .validate_mem = NULL,
37405 .find_io = static_find_io,
37406 .find_mem = NULL,
37407diff -urNp linux-2.6.39.2/drivers/pcmcia/vrc4171_card.c linux-2.6.39.2/drivers/pcmcia/vrc4171_card.c
37408--- linux-2.6.39.2/drivers/pcmcia/vrc4171_card.c 2011-05-19 00:06:34.000000000 -0400
37409+++ linux-2.6.39.2/drivers/pcmcia/vrc4171_card.c 2011-05-22 19:36:32.000000000 -0400
37410@@ -479,7 +479,7 @@ static int pccard_set_mem_map(struct pcm
37411 return 0;
37412 }
37413
37414-static struct pccard_operations vrc4171_pccard_operations = {
37415+static const struct pccard_operations vrc4171_pccard_operations = {
37416 .init = pccard_init,
37417 .get_status = pccard_get_status,
37418 .set_socket = pccard_set_socket,
37419diff -urNp linux-2.6.39.2/drivers/pcmcia/vrc4173_cardu.c linux-2.6.39.2/drivers/pcmcia/vrc4173_cardu.c
37420--- linux-2.6.39.2/drivers/pcmcia/vrc4173_cardu.c 2011-05-19 00:06:34.000000000 -0400
37421+++ linux-2.6.39.2/drivers/pcmcia/vrc4173_cardu.c 2011-05-22 19:36:32.000000000 -0400
37422@@ -384,7 +384,7 @@ static void cardu_proc_setup(unsigned in
37423 {
37424 }
37425
37426-static struct pccard_operations cardu_operations = {
37427+static const struct pccard_operations cardu_operations = {
37428 .init = cardu_init,
37429 .register_callback = cardu_register_callback,
37430 .inquire_socket = cardu_inquire_socket,
37431diff -urNp linux-2.6.39.2/drivers/pcmcia/xxs1500_ss.c linux-2.6.39.2/drivers/pcmcia/xxs1500_ss.c
37432--- linux-2.6.39.2/drivers/pcmcia/xxs1500_ss.c 2011-05-19 00:06:34.000000000 -0400
37433+++ linux-2.6.39.2/drivers/pcmcia/xxs1500_ss.c 2011-05-22 19:36:32.000000000 -0400
37434@@ -196,7 +196,7 @@ static int au1x00_pcmcia_set_mem_map(str
37435 return 0;
37436 }
37437
37438-static struct pccard_operations xxs1500_pcmcia_operations = {
37439+static const struct pccard_operations xxs1500_pcmcia_operations = {
37440 .init = xxs1500_pcmcia_sock_init,
37441 .suspend = xxs1500_pcmcia_sock_suspend,
37442 .get_status = xxs1500_pcmcia_get_status,
37443diff -urNp linux-2.6.39.2/drivers/platform/x86/acerhdf.c linux-2.6.39.2/drivers/platform/x86/acerhdf.c
37444--- linux-2.6.39.2/drivers/platform/x86/acerhdf.c 2011-05-19 00:06:34.000000000 -0400
37445+++ linux-2.6.39.2/drivers/platform/x86/acerhdf.c 2011-05-22 19:36:32.000000000 -0400
37446@@ -406,7 +406,7 @@ static int acerhdf_get_crit_temp(struct
37447 }
37448
37449 /* bind callback functions to thermalzone */
37450-static struct thermal_zone_device_ops acerhdf_dev_ops = {
37451+static const struct thermal_zone_device_ops acerhdf_dev_ops = {
37452 .bind = acerhdf_bind,
37453 .unbind = acerhdf_unbind,
37454 .get_temp = acerhdf_get_ec_temp,
37455@@ -481,7 +481,7 @@ err_out:
37456 }
37457
37458 /* bind fan callbacks to fan device */
37459-static struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37460+static const struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37461 .get_max_state = acerhdf_get_max_state,
37462 .get_cur_state = acerhdf_get_cur_state,
37463 .set_cur_state = acerhdf_set_cur_state,
37464diff -urNp linux-2.6.39.2/drivers/platform/x86/ideapad-laptop.c linux-2.6.39.2/drivers/platform/x86/ideapad-laptop.c
37465--- linux-2.6.39.2/drivers/platform/x86/ideapad-laptop.c 2011-05-19 00:06:34.000000000 -0400
37466+++ linux-2.6.39.2/drivers/platform/x86/ideapad-laptop.c 2011-05-22 19:36:32.000000000 -0400
37467@@ -207,7 +207,7 @@ static int ideapad_rfk_set(void *data, b
37468 return write_ec_cmd(ideapad_handle, opcode, !blocked);
37469 }
37470
37471-static struct rfkill_ops ideapad_rfk_ops = {
37472+static const struct rfkill_ops ideapad_rfk_ops = {
37473 .set_block = ideapad_rfk_set,
37474 };
37475
37476diff -urNp linux-2.6.39.2/drivers/platform/x86/intel_menlow.c linux-2.6.39.2/drivers/platform/x86/intel_menlow.c
37477--- linux-2.6.39.2/drivers/platform/x86/intel_menlow.c 2011-05-19 00:06:34.000000000 -0400
37478+++ linux-2.6.39.2/drivers/platform/x86/intel_menlow.c 2011-05-22 19:36:32.000000000 -0400
37479@@ -143,7 +143,7 @@ static int memory_set_cur_bandwidth(stru
37480 return 0;
37481 }
37482
37483-static struct thermal_cooling_device_ops memory_cooling_ops = {
37484+static const struct thermal_cooling_device_ops memory_cooling_ops = {
37485 .get_max_state = memory_get_max_bandwidth,
37486 .get_cur_state = memory_get_cur_bandwidth,
37487 .set_cur_state = memory_set_cur_bandwidth,
37488diff -urNp linux-2.6.39.2/drivers/platform/x86/intel_mid_thermal.c linux-2.6.39.2/drivers/platform/x86/intel_mid_thermal.c
37489--- linux-2.6.39.2/drivers/platform/x86/intel_mid_thermal.c 2011-05-19 00:06:34.000000000 -0400
37490+++ linux-2.6.39.2/drivers/platform/x86/intel_mid_thermal.c 2011-05-22 19:36:32.000000000 -0400
37491@@ -458,7 +458,7 @@ static int read_curr_temp(struct thermal
37492 }
37493
37494 /* Can't be const */
37495-static struct thermal_zone_device_ops tzd_ops = {
37496+static const struct thermal_zone_device_ops tzd_ops = {
37497 .get_temp = read_curr_temp,
37498 };
37499
37500diff -urNp linux-2.6.39.2/drivers/platform/x86/samsung-laptop.c linux-2.6.39.2/drivers/platform/x86/samsung-laptop.c
37501--- linux-2.6.39.2/drivers/platform/x86/samsung-laptop.c 2011-05-19 00:06:34.000000000 -0400
37502+++ linux-2.6.39.2/drivers/platform/x86/samsung-laptop.c 2011-05-22 19:36:32.000000000 -0400
37503@@ -419,7 +419,7 @@ static int rfkill_set(void *data, bool b
37504 return 0;
37505 }
37506
37507-static struct rfkill_ops rfkill_ops = {
37508+static const struct rfkill_ops rfkill_ops = {
37509 .set_block = rfkill_set,
37510 };
37511
37512diff -urNp linux-2.6.39.2/drivers/pnp/pnpbios/bioscalls.c linux-2.6.39.2/drivers/pnp/pnpbios/bioscalls.c
37513--- linux-2.6.39.2/drivers/pnp/pnpbios/bioscalls.c 2011-05-19 00:06:34.000000000 -0400
37514+++ linux-2.6.39.2/drivers/pnp/pnpbios/bioscalls.c 2011-05-22 19:36:32.000000000 -0400
37515@@ -59,7 +59,7 @@ do { \
37516 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
37517 } while(0)
37518
37519-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
37520+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
37521 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
37522
37523 /*
37524@@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func
37525
37526 cpu = get_cpu();
37527 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
37528+
37529+ pax_open_kernel();
37530 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
37531+ pax_close_kernel();
37532
37533 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
37534 spin_lock_irqsave(&pnp_bios_lock, flags);
37535@@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func
37536 :"memory");
37537 spin_unlock_irqrestore(&pnp_bios_lock, flags);
37538
37539+ pax_open_kernel();
37540 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
37541+ pax_close_kernel();
37542+
37543 put_cpu();
37544
37545 /* If we get here and this is set then the PnP BIOS faulted on us. */
37546@@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n
37547 return status;
37548 }
37549
37550-void pnpbios_calls_init(union pnp_bios_install_struct *header)
37551+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
37552 {
37553 int i;
37554
37555@@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i
37556 pnp_bios_callpoint.offset = header->fields.pm16offset;
37557 pnp_bios_callpoint.segment = PNP_CS16;
37558
37559+ pax_open_kernel();
37560+
37561 for_each_possible_cpu(i) {
37562 struct desc_struct *gdt = get_cpu_gdt_table(i);
37563 if (!gdt)
37564@@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i
37565 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
37566 (unsigned long)__va(header->fields.pm16dseg));
37567 }
37568+
37569+ pax_close_kernel();
37570 }
37571diff -urNp linux-2.6.39.2/drivers/pnp/resource.c linux-2.6.39.2/drivers/pnp/resource.c
37572--- linux-2.6.39.2/drivers/pnp/resource.c 2011-05-19 00:06:34.000000000 -0400
37573+++ linux-2.6.39.2/drivers/pnp/resource.c 2011-05-22 19:36:32.000000000 -0400
37574@@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
37575 return 1;
37576
37577 /* check if the resource is valid */
37578- if (*irq < 0 || *irq > 15)
37579+ if (*irq > 15)
37580 return 0;
37581
37582 /* check if the resource is reserved */
37583@@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
37584 return 1;
37585
37586 /* check if the resource is valid */
37587- if (*dma < 0 || *dma == 4 || *dma > 7)
37588+ if (*dma == 4 || *dma > 7)
37589 return 0;
37590
37591 /* check if the resource is reserved */
37592diff -urNp linux-2.6.39.2/drivers/power/max8925_power.c linux-2.6.39.2/drivers/power/max8925_power.c
37593--- linux-2.6.39.2/drivers/power/max8925_power.c 2011-05-19 00:06:34.000000000 -0400
37594+++ linux-2.6.39.2/drivers/power/max8925_power.c 2011-05-22 19:36:32.000000000 -0400
37595@@ -426,7 +426,7 @@ static __devinit int max8925_power_probe
37596 {
37597 struct max8925_chip *chip = dev_get_drvdata(pdev->dev.parent);
37598 struct max8925_platform_data *max8925_pdata;
37599- struct max8925_power_pdata *pdata = NULL;
37600+ const struct max8925_power_pdata *pdata = NULL;
37601 struct max8925_power_info *info;
37602 int ret;
37603
37604diff -urNp linux-2.6.39.2/drivers/regulator/core.c linux-2.6.39.2/drivers/regulator/core.c
37605--- linux-2.6.39.2/drivers/regulator/core.c 2011-05-19 00:06:34.000000000 -0400
37606+++ linux-2.6.39.2/drivers/regulator/core.c 2011-05-22 19:36:32.000000000 -0400
37607@@ -2883,7 +2883,7 @@ core_initcall(regulator_init);
37608 static int __init regulator_init_complete(void)
37609 {
37610 struct regulator_dev *rdev;
37611- struct regulator_ops *ops;
37612+ const struct regulator_ops *ops;
37613 struct regulation_constraints *c;
37614 int enabled, ret;
37615
37616diff -urNp linux-2.6.39.2/drivers/rtc/rtc-at32ap700x.c linux-2.6.39.2/drivers/rtc/rtc-at32ap700x.c
37617--- linux-2.6.39.2/drivers/rtc/rtc-at32ap700x.c 2011-05-19 00:06:34.000000000 -0400
37618+++ linux-2.6.39.2/drivers/rtc/rtc-at32ap700x.c 2011-05-22 19:36:32.000000000 -0400
37619@@ -187,7 +187,7 @@ static irqreturn_t at32_rtc_interrupt(in
37620 return ret;
37621 }
37622
37623-static struct rtc_class_ops at32_rtc_ops = {
37624+static const struct rtc_class_ops at32_rtc_ops = {
37625 .read_time = at32_rtc_readtime,
37626 .set_time = at32_rtc_settime,
37627 .read_alarm = at32_rtc_readalarm,
37628diff -urNp linux-2.6.39.2/drivers/rtc/rtc-au1xxx.c linux-2.6.39.2/drivers/rtc/rtc-au1xxx.c
37629--- linux-2.6.39.2/drivers/rtc/rtc-au1xxx.c 2011-05-19 00:06:34.000000000 -0400
37630+++ linux-2.6.39.2/drivers/rtc/rtc-au1xxx.c 2011-05-22 19:36:32.000000000 -0400
37631@@ -57,7 +57,7 @@ static int au1xtoy_rtc_set_time(struct d
37632 return 0;
37633 }
37634
37635-static struct rtc_class_ops au1xtoy_rtc_ops = {
37636+static const struct rtc_class_ops au1xtoy_rtc_ops = {
37637 .read_time = au1xtoy_rtc_read_time,
37638 .set_time = au1xtoy_rtc_set_time,
37639 };
37640diff -urNp linux-2.6.39.2/drivers/rtc/rtc-bfin.c linux-2.6.39.2/drivers/rtc/rtc-bfin.c
37641--- linux-2.6.39.2/drivers/rtc/rtc-bfin.c 2011-05-19 00:06:34.000000000 -0400
37642+++ linux-2.6.39.2/drivers/rtc/rtc-bfin.c 2011-05-22 19:36:32.000000000 -0400
37643@@ -333,7 +333,7 @@ static int bfin_rtc_proc(struct device *
37644 #undef yesno
37645 }
37646
37647-static struct rtc_class_ops bfin_rtc_ops = {
37648+static const struct rtc_class_ops bfin_rtc_ops = {
37649 .read_time = bfin_rtc_read_time,
37650 .set_time = bfin_rtc_set_time,
37651 .read_alarm = bfin_rtc_read_alarm,
37652diff -urNp linux-2.6.39.2/drivers/rtc/rtc-coh901331.c linux-2.6.39.2/drivers/rtc/rtc-coh901331.c
37653--- linux-2.6.39.2/drivers/rtc/rtc-coh901331.c 2011-05-19 00:06:34.000000000 -0400
37654+++ linux-2.6.39.2/drivers/rtc/rtc-coh901331.c 2011-05-22 19:36:32.000000000 -0400
37655@@ -142,7 +142,7 @@ static int coh901331_alarm_irq_enable(st
37656 return 0;
37657 }
37658
37659-static struct rtc_class_ops coh901331_ops = {
37660+static const struct rtc_class_ops coh901331_ops = {
37661 .read_time = coh901331_read_time,
37662 .set_mmss = coh901331_set_mmss,
37663 .read_alarm = coh901331_read_alarm,
37664diff -urNp linux-2.6.39.2/drivers/rtc/rtc-davinci.c linux-2.6.39.2/drivers/rtc/rtc-davinci.c
37665--- linux-2.6.39.2/drivers/rtc/rtc-davinci.c 2011-05-19 00:06:34.000000000 -0400
37666+++ linux-2.6.39.2/drivers/rtc/rtc-davinci.c 2011-05-22 19:36:32.000000000 -0400
37667@@ -469,7 +469,7 @@ static int davinci_rtc_set_alarm(struct
37668 return 0;
37669 }
37670
37671-static struct rtc_class_ops davinci_rtc_ops = {
37672+static const struct rtc_class_ops davinci_rtc_ops = {
37673 .ioctl = davinci_rtc_ioctl,
37674 .read_time = davinci_rtc_read_time,
37675 .set_time = davinci_rtc_set_time,
37676diff -urNp linux-2.6.39.2/drivers/rtc/rtc-dev.c linux-2.6.39.2/drivers/rtc/rtc-dev.c
37677--- linux-2.6.39.2/drivers/rtc/rtc-dev.c 2011-05-19 00:06:34.000000000 -0400
37678+++ linux-2.6.39.2/drivers/rtc/rtc-dev.c 2011-05-22 19:41:37.000000000 -0400
37679@@ -14,6 +14,7 @@
37680 #include <linux/module.h>
37681 #include <linux/rtc.h>
37682 #include <linux/sched.h>
37683+#include <linux/grsecurity.h>
37684 #include "rtc-core.h"
37685
37686 static dev_t rtc_devt;
37687@@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f
37688 if (copy_from_user(&tm, uarg, sizeof(tm)))
37689 return -EFAULT;
37690
37691+ gr_log_timechange();
37692+
37693 return rtc_set_time(rtc, &tm);
37694
37695 case RTC_PIE_ON:
37696diff -urNp linux-2.6.39.2/drivers/rtc/rtc-dm355evm.c linux-2.6.39.2/drivers/rtc/rtc-dm355evm.c
37697--- linux-2.6.39.2/drivers/rtc/rtc-dm355evm.c 2011-05-19 00:06:34.000000000 -0400
37698+++ linux-2.6.39.2/drivers/rtc/rtc-dm355evm.c 2011-05-22 19:36:32.000000000 -0400
37699@@ -115,7 +115,7 @@ static int dm355evm_rtc_set_time(struct
37700 return 0;
37701 }
37702
37703-static struct rtc_class_ops dm355evm_rtc_ops = {
37704+static const struct rtc_class_ops dm355evm_rtc_ops = {
37705 .read_time = dm355evm_rtc_read_time,
37706 .set_time = dm355evm_rtc_set_time,
37707 };
37708diff -urNp linux-2.6.39.2/drivers/rtc/rtc-ds1302.c linux-2.6.39.2/drivers/rtc/rtc-ds1302.c
37709--- linux-2.6.39.2/drivers/rtc/rtc-ds1302.c 2011-05-19 00:06:34.000000000 -0400
37710+++ linux-2.6.39.2/drivers/rtc/rtc-ds1302.c 2011-05-22 19:36:32.000000000 -0400
37711@@ -199,7 +199,7 @@ static int ds1302_rtc_ioctl(struct devic
37712 return -ENOIOCTLCMD;
37713 }
37714
37715-static struct rtc_class_ops ds1302_rtc_ops = {
37716+static const struct rtc_class_ops ds1302_rtc_ops = {
37717 .read_time = ds1302_rtc_read_time,
37718 .set_time = ds1302_rtc_set_time,
37719 .ioctl = ds1302_rtc_ioctl,
37720diff -urNp linux-2.6.39.2/drivers/rtc/rtc-imxdi.c linux-2.6.39.2/drivers/rtc/rtc-imxdi.c
37721--- linux-2.6.39.2/drivers/rtc/rtc-imxdi.c 2011-05-19 00:06:34.000000000 -0400
37722+++ linux-2.6.39.2/drivers/rtc/rtc-imxdi.c 2011-05-22 19:36:32.000000000 -0400
37723@@ -290,7 +290,7 @@ static int dryice_rtc_set_alarm(struct d
37724 return 0;
37725 }
37726
37727-static struct rtc_class_ops dryice_rtc_ops = {
37728+static const struct rtc_class_ops dryice_rtc_ops = {
37729 .read_time = dryice_rtc_read_time,
37730 .set_mmss = dryice_rtc_set_mmss,
37731 .alarm_irq_enable = dryice_rtc_alarm_irq_enable,
37732diff -urNp linux-2.6.39.2/drivers/rtc/rtc-jz4740.c linux-2.6.39.2/drivers/rtc/rtc-jz4740.c
37733--- linux-2.6.39.2/drivers/rtc/rtc-jz4740.c 2011-05-19 00:06:34.000000000 -0400
37734+++ linux-2.6.39.2/drivers/rtc/rtc-jz4740.c 2011-05-22 19:36:32.000000000 -0400
37735@@ -174,7 +174,7 @@ static int jz4740_rtc_alarm_irq_enable(s
37736 return jz4740_rtc_ctrl_set_bits(rtc, JZ_RTC_CTRL_AF_IRQ, enable);
37737 }
37738
37739-static struct rtc_class_ops jz4740_rtc_ops = {
37740+static const struct rtc_class_ops jz4740_rtc_ops = {
37741 .read_time = jz4740_rtc_read_time,
37742 .set_mmss = jz4740_rtc_set_mmss,
37743 .read_alarm = jz4740_rtc_read_alarm,
37744diff -urNp linux-2.6.39.2/drivers/rtc/rtc-m41t80.c linux-2.6.39.2/drivers/rtc/rtc-m41t80.c
37745--- linux-2.6.39.2/drivers/rtc/rtc-m41t80.c 2011-05-19 00:06:34.000000000 -0400
37746+++ linux-2.6.39.2/drivers/rtc/rtc-m41t80.c 2011-05-22 19:36:32.000000000 -0400
37747@@ -354,7 +354,7 @@ static int m41t80_rtc_read_alarm(struct
37748 return 0;
37749 }
37750
37751-static struct rtc_class_ops m41t80_rtc_ops = {
37752+static const struct rtc_class_ops m41t80_rtc_ops = {
37753 .read_time = m41t80_rtc_read_time,
37754 .set_time = m41t80_rtc_set_time,
37755 .read_alarm = m41t80_rtc_read_alarm,
37756diff -urNp linux-2.6.39.2/drivers/rtc/rtc-mxc.c linux-2.6.39.2/drivers/rtc/rtc-mxc.c
37757--- linux-2.6.39.2/drivers/rtc/rtc-mxc.c 2011-05-19 00:06:34.000000000 -0400
37758+++ linux-2.6.39.2/drivers/rtc/rtc-mxc.c 2011-05-22 19:36:32.000000000 -0400
37759@@ -355,7 +355,7 @@ static int mxc_rtc_set_alarm(struct devi
37760 }
37761
37762 /* RTC layer */
37763-static struct rtc_class_ops mxc_rtc_ops = {
37764+static const struct rtc_class_ops mxc_rtc_ops = {
37765 .release = mxc_rtc_release,
37766 .read_time = mxc_rtc_read_time,
37767 .set_mmss = mxc_rtc_set_mmss,
37768diff -urNp linux-2.6.39.2/drivers/rtc/rtc-nuc900.c linux-2.6.39.2/drivers/rtc/rtc-nuc900.c
37769--- linux-2.6.39.2/drivers/rtc/rtc-nuc900.c 2011-05-19 00:06:34.000000000 -0400
37770+++ linux-2.6.39.2/drivers/rtc/rtc-nuc900.c 2011-05-22 19:36:32.000000000 -0400
37771@@ -214,7 +214,7 @@ static int nuc900_rtc_set_alarm(struct d
37772 return 0;
37773 }
37774
37775-static struct rtc_class_ops nuc900_rtc_ops = {
37776+static const struct rtc_class_ops nuc900_rtc_ops = {
37777 .read_time = nuc900_rtc_read_time,
37778 .set_time = nuc900_rtc_set_time,
37779 .read_alarm = nuc900_rtc_read_alarm,
37780diff -urNp linux-2.6.39.2/drivers/rtc/rtc-omap.c linux-2.6.39.2/drivers/rtc/rtc-omap.c
37781--- linux-2.6.39.2/drivers/rtc/rtc-omap.c 2011-05-19 00:06:34.000000000 -0400
37782+++ linux-2.6.39.2/drivers/rtc/rtc-omap.c 2011-05-22 19:36:32.000000000 -0400
37783@@ -274,7 +274,7 @@ static int omap_rtc_set_alarm(struct dev
37784 return 0;
37785 }
37786
37787-static struct rtc_class_ops omap_rtc_ops = {
37788+static const struct rtc_class_ops omap_rtc_ops = {
37789 .read_time = omap_rtc_read_time,
37790 .set_time = omap_rtc_set_time,
37791 .read_alarm = omap_rtc_read_alarm,
37792diff -urNp linux-2.6.39.2/drivers/rtc/rtc-pcf50633.c linux-2.6.39.2/drivers/rtc/rtc-pcf50633.c
37793--- linux-2.6.39.2/drivers/rtc/rtc-pcf50633.c 2011-05-19 00:06:34.000000000 -0400
37794+++ linux-2.6.39.2/drivers/rtc/rtc-pcf50633.c 2011-05-22 19:36:32.000000000 -0400
37795@@ -238,7 +238,7 @@ static int pcf50633_rtc_set_alarm(struct
37796 return ret;
37797 }
37798
37799-static struct rtc_class_ops pcf50633_rtc_ops = {
37800+static const struct rtc_class_ops pcf50633_rtc_ops = {
37801 .read_time = pcf50633_rtc_read_time,
37802 .set_time = pcf50633_rtc_set_time,
37803 .read_alarm = pcf50633_rtc_read_alarm,
37804diff -urNp linux-2.6.39.2/drivers/rtc/rtc-pl031.c linux-2.6.39.2/drivers/rtc/rtc-pl031.c
37805--- linux-2.6.39.2/drivers/rtc/rtc-pl031.c 2011-05-19 00:06:34.000000000 -0400
37806+++ linux-2.6.39.2/drivers/rtc/rtc-pl031.c 2011-05-22 19:36:32.000000000 -0400
37807@@ -374,7 +374,7 @@ err_req:
37808 }
37809
37810 /* Operations for the original ARM version */
37811-static struct rtc_class_ops arm_pl031_ops = {
37812+static const struct rtc_class_ops arm_pl031_ops = {
37813 .read_time = pl031_read_time,
37814 .set_time = pl031_set_time,
37815 .read_alarm = pl031_read_alarm,
37816@@ -383,7 +383,7 @@ static struct rtc_class_ops arm_pl031_op
37817 };
37818
37819 /* The First ST derivative */
37820-static struct rtc_class_ops stv1_pl031_ops = {
37821+static const struct rtc_class_ops stv1_pl031_ops = {
37822 .read_time = pl031_read_time,
37823 .set_time = pl031_set_time,
37824 .read_alarm = pl031_read_alarm,
37825@@ -392,7 +392,7 @@ static struct rtc_class_ops stv1_pl031_o
37826 };
37827
37828 /* And the second ST derivative */
37829-static struct rtc_class_ops stv2_pl031_ops = {
37830+static const struct rtc_class_ops stv2_pl031_ops = {
37831 .read_time = pl031_stv2_read_time,
37832 .set_time = pl031_stv2_set_time,
37833 .read_alarm = pl031_stv2_read_alarm,
37834diff -urNp linux-2.6.39.2/drivers/rtc/rtc-rx8025.c linux-2.6.39.2/drivers/rtc/rtc-rx8025.c
37835--- linux-2.6.39.2/drivers/rtc/rtc-rx8025.c 2011-05-19 00:06:34.000000000 -0400
37836+++ linux-2.6.39.2/drivers/rtc/rtc-rx8025.c 2011-05-22 19:36:32.000000000 -0400
37837@@ -424,7 +424,7 @@ static int rx8025_alarm_irq_enable(struc
37838 return 0;
37839 }
37840
37841-static struct rtc_class_ops rx8025_rtc_ops = {
37842+static const struct rtc_class_ops rx8025_rtc_ops = {
37843 .read_time = rx8025_get_time,
37844 .set_time = rx8025_set_time,
37845 .read_alarm = rx8025_read_alarm,
37846diff -urNp linux-2.6.39.2/drivers/rtc/rtc-sh.c linux-2.6.39.2/drivers/rtc/rtc-sh.c
37847--- linux-2.6.39.2/drivers/rtc/rtc-sh.c 2011-05-19 00:06:34.000000000 -0400
37848+++ linux-2.6.39.2/drivers/rtc/rtc-sh.c 2011-05-22 19:36:32.000000000 -0400
37849@@ -576,7 +576,7 @@ static int sh_rtc_set_alarm(struct devic
37850 return 0;
37851 }
37852
37853-static struct rtc_class_ops sh_rtc_ops = {
37854+static const struct rtc_class_ops sh_rtc_ops = {
37855 .read_time = sh_rtc_read_time,
37856 .set_time = sh_rtc_set_time,
37857 .read_alarm = sh_rtc_read_alarm,
37858diff -urNp linux-2.6.39.2/drivers/rtc/rtc-stmp3xxx.c linux-2.6.39.2/drivers/rtc/rtc-stmp3xxx.c
37859--- linux-2.6.39.2/drivers/rtc/rtc-stmp3xxx.c 2011-05-19 00:06:34.000000000 -0400
37860+++ linux-2.6.39.2/drivers/rtc/rtc-stmp3xxx.c 2011-05-22 19:36:32.000000000 -0400
37861@@ -133,7 +133,7 @@ static int stmp3xxx_rtc_set_alarm(struct
37862 return 0;
37863 }
37864
37865-static struct rtc_class_ops stmp3xxx_rtc_ops = {
37866+static const struct rtc_class_ops stmp3xxx_rtc_ops = {
37867 .alarm_irq_enable =
37868 stmp3xxx_alarm_irq_enable,
37869 .read_time = stmp3xxx_rtc_gettime,
37870diff -urNp linux-2.6.39.2/drivers/rtc/rtc-tegra.c linux-2.6.39.2/drivers/rtc/rtc-tegra.c
37871--- linux-2.6.39.2/drivers/rtc/rtc-tegra.c 2011-05-19 00:06:34.000000000 -0400
37872+++ linux-2.6.39.2/drivers/rtc/rtc-tegra.c 2011-05-22 19:36:32.000000000 -0400
37873@@ -294,7 +294,7 @@ static irqreturn_t tegra_rtc_irq_handler
37874 return IRQ_HANDLED;
37875 }
37876
37877-static struct rtc_class_ops tegra_rtc_ops = {
37878+static const struct rtc_class_ops tegra_rtc_ops = {
37879 .read_time = tegra_rtc_read_time,
37880 .set_time = tegra_rtc_set_time,
37881 .read_alarm = tegra_rtc_read_alarm,
37882diff -urNp linux-2.6.39.2/drivers/rtc/rtc-twl.c linux-2.6.39.2/drivers/rtc/rtc-twl.c
37883--- linux-2.6.39.2/drivers/rtc/rtc-twl.c 2011-05-19 00:06:34.000000000 -0400
37884+++ linux-2.6.39.2/drivers/rtc/rtc-twl.c 2011-05-22 19:36:32.000000000 -0400
37885@@ -415,7 +415,7 @@ out:
37886 return ret;
37887 }
37888
37889-static struct rtc_class_ops twl_rtc_ops = {
37890+static const struct rtc_class_ops twl_rtc_ops = {
37891 .read_time = twl_rtc_read_time,
37892 .set_time = twl_rtc_set_time,
37893 .read_alarm = twl_rtc_read_alarm,
37894diff -urNp linux-2.6.39.2/drivers/rtc/rtc-v3020.c linux-2.6.39.2/drivers/rtc/rtc-v3020.c
37895--- linux-2.6.39.2/drivers/rtc/rtc-v3020.c 2011-05-19 00:06:34.000000000 -0400
37896+++ linux-2.6.39.2/drivers/rtc/rtc-v3020.c 2011-05-22 19:36:32.000000000 -0400
37897@@ -62,7 +62,7 @@ struct v3020 {
37898 /* GPIO access */
37899 struct v3020_gpio *gpio;
37900
37901- struct v3020_chip_ops *ops;
37902+ const struct v3020_chip_ops *ops;
37903
37904 struct rtc_device *rtc;
37905 };
37906@@ -100,7 +100,7 @@ static unsigned char v3020_mmio_read_bit
37907 return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
37908 }
37909
37910-static struct v3020_chip_ops v3020_mmio_ops = {
37911+static const struct v3020_chip_ops v3020_mmio_ops = {
37912 .map_io = v3020_mmio_map,
37913 .unmap_io = v3020_mmio_unmap,
37914 .read_bit = v3020_mmio_read_bit,
37915@@ -177,7 +177,7 @@ static unsigned char v3020_gpio_read_bit
37916 return bit;
37917 }
37918
37919-static struct v3020_chip_ops v3020_gpio_ops = {
37920+static const struct v3020_chip_ops v3020_gpio_ops = {
37921 .map_io = v3020_gpio_map,
37922 .unmap_io = v3020_gpio_unmap,
37923 .read_bit = v3020_gpio_read_bit,
37924diff -urNp linux-2.6.39.2/drivers/s390/char/con3270.c linux-2.6.39.2/drivers/s390/char/con3270.c
37925--- linux-2.6.39.2/drivers/s390/char/con3270.c 2011-05-19 00:06:34.000000000 -0400
37926+++ linux-2.6.39.2/drivers/s390/char/con3270.c 2011-05-22 19:36:32.000000000 -0400
37927@@ -28,7 +28,7 @@
37928 #define CON3270_OUTPUT_BUFFER_SIZE 1024
37929 #define CON3270_STRING_PAGES 4
37930
37931-static struct raw3270_fn con3270_fn;
37932+static const struct raw3270_fn con3270_fn;
37933
37934 /*
37935 * Main 3270 console view data structure.
37936@@ -413,7 +413,7 @@ con3270_irq(struct con3270 *cp, struct r
37937 }
37938
37939 /* Console view to a 3270 device. */
37940-static struct raw3270_fn con3270_fn = {
37941+static const struct raw3270_fn con3270_fn = {
37942 .activate = con3270_activate,
37943 .deactivate = con3270_deactivate,
37944 .intv = (void *) con3270_irq
37945diff -urNp linux-2.6.39.2/drivers/s390/char/fs3270.c linux-2.6.39.2/drivers/s390/char/fs3270.c
37946--- linux-2.6.39.2/drivers/s390/char/fs3270.c 2011-05-19 00:06:34.000000000 -0400
37947+++ linux-2.6.39.2/drivers/s390/char/fs3270.c 2011-05-22 19:36:32.000000000 -0400
37948@@ -24,7 +24,7 @@
37949 #include "raw3270.h"
37950 #include "ctrlchar.h"
37951
37952-static struct raw3270_fn fs3270_fn;
37953+static const struct raw3270_fn fs3270_fn;
37954
37955 struct fs3270 {
37956 struct raw3270_view view;
37957@@ -413,7 +413,7 @@ fs3270_release(struct raw3270_view *view
37958 }
37959
37960 /* View to a 3270 device. Can be console, tty or fullscreen. */
37961-static struct raw3270_fn fs3270_fn = {
37962+static const struct raw3270_fn fs3270_fn = {
37963 .activate = fs3270_activate,
37964 .deactivate = fs3270_deactivate,
37965 .intv = (void *) fs3270_irq,
37966diff -urNp linux-2.6.39.2/drivers/s390/char/raw3270.c linux-2.6.39.2/drivers/s390/char/raw3270.c
37967--- linux-2.6.39.2/drivers/s390/char/raw3270.c 2011-05-19 00:06:34.000000000 -0400
37968+++ linux-2.6.39.2/drivers/s390/char/raw3270.c 2011-05-22 19:36:32.000000000 -0400
37969@@ -488,7 +488,7 @@ raw3270_init_irq(struct raw3270_view *vi
37970 return RAW3270_IO_DONE;
37971 }
37972
37973-static struct raw3270_fn raw3270_init_fn = {
37974+static const struct raw3270_fn raw3270_init_fn = {
37975 .intv = raw3270_init_irq
37976 };
37977
37978diff -urNp linux-2.6.39.2/drivers/s390/char/tty3270.c linux-2.6.39.2/drivers/s390/char/tty3270.c
37979--- linux-2.6.39.2/drivers/s390/char/tty3270.c 2011-05-19 00:06:34.000000000 -0400
37980+++ linux-2.6.39.2/drivers/s390/char/tty3270.c 2011-05-22 19:36:32.000000000 -0400
37981@@ -37,7 +37,7 @@
37982 struct tty_driver *tty3270_driver;
37983 static int tty3270_max_index;
37984
37985-static struct raw3270_fn tty3270_fn;
37986+static const struct raw3270_fn tty3270_fn;
37987
37988 struct tty3270_cell {
37989 unsigned char character;
37990@@ -834,7 +834,7 @@ tty3270_del_views(void)
37991 }
37992 }
37993
37994-static struct raw3270_fn tty3270_fn = {
37995+static const struct raw3270_fn tty3270_fn = {
37996 .activate = tty3270_activate,
37997 .deactivate = tty3270_deactivate,
37998 .intv = (void *) tty3270_irq,
37999diff -urNp linux-2.6.39.2/drivers/s390/cio/qdio_debug.c linux-2.6.39.2/drivers/s390/cio/qdio_debug.c
38000--- linux-2.6.39.2/drivers/s390/cio/qdio_debug.c 2011-05-19 00:06:34.000000000 -0400
38001+++ linux-2.6.39.2/drivers/s390/cio/qdio_debug.c 2011-05-22 19:36:32.000000000 -0400
38002@@ -225,7 +225,7 @@ static int qperf_seq_open(struct inode *
38003 filp->f_path.dentry->d_inode->i_private);
38004 }
38005
38006-static struct file_operations debugfs_perf_fops = {
38007+static const struct file_operations debugfs_perf_fops = {
38008 .owner = THIS_MODULE,
38009 .open = qperf_seq_open,
38010 .read = seq_read,
38011diff -urNp linux-2.6.39.2/drivers/s390/crypto/zcrypt_cex2a.c linux-2.6.39.2/drivers/s390/crypto/zcrypt_cex2a.c
38012--- linux-2.6.39.2/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-19 00:06:34.000000000 -0400
38013+++ linux-2.6.39.2/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-22 19:36:32.000000000 -0400
38014@@ -415,7 +415,7 @@ out_free:
38015 /**
38016 * The crypto operations for a CEX2A card.
38017 */
38018-static struct zcrypt_ops zcrypt_cex2a_ops = {
38019+static const struct zcrypt_ops zcrypt_cex2a_ops = {
38020 .rsa_modexpo = zcrypt_cex2a_modexpo,
38021 .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
38022 };
38023diff -urNp linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcica.c linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcica.c
38024--- linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcica.c 2011-05-19 00:06:34.000000000 -0400
38025+++ linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcica.c 2011-05-22 19:36:32.000000000 -0400
38026@@ -347,7 +347,7 @@ out_free:
38027 /**
38028 * The crypto operations for a PCICA card.
38029 */
38030-static struct zcrypt_ops zcrypt_pcica_ops = {
38031+static const struct zcrypt_ops zcrypt_pcica_ops = {
38032 .rsa_modexpo = zcrypt_pcica_modexpo,
38033 .rsa_modexpo_crt = zcrypt_pcica_modexpo_crt,
38034 };
38035diff -urNp linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcicc.c linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcicc.c
38036--- linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-19 00:06:34.000000000 -0400
38037+++ linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-22 19:36:32.000000000 -0400
38038@@ -553,7 +553,7 @@ out_free:
38039 /**
38040 * The crypto operations for a PCICC card.
38041 */
38042-static struct zcrypt_ops zcrypt_pcicc_ops = {
38043+static const struct zcrypt_ops zcrypt_pcicc_ops = {
38044 .rsa_modexpo = zcrypt_pcicc_modexpo,
38045 .rsa_modexpo_crt = zcrypt_pcicc_modexpo_crt,
38046 };
38047diff -urNp linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcixcc.c linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcixcc.c
38048--- linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-19 00:06:34.000000000 -0400
38049+++ linux-2.6.39.2/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-22 19:36:32.000000000 -0400
38050@@ -851,13 +851,13 @@ static long zcrypt_pcixcc_rng(struct zcr
38051 /**
38052 * The crypto operations for a PCIXCC/CEX2C card.
38053 */
38054-static struct zcrypt_ops zcrypt_pcixcc_ops = {
38055+static const struct zcrypt_ops zcrypt_pcixcc_ops = {
38056 .rsa_modexpo = zcrypt_pcixcc_modexpo,
38057 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
38058 .send_cprb = zcrypt_pcixcc_send_cprb,
38059 };
38060
38061-static struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
38062+static const struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
38063 .rsa_modexpo = zcrypt_pcixcc_modexpo,
38064 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
38065 .send_cprb = zcrypt_pcixcc_send_cprb,
38066diff -urNp linux-2.6.39.2/drivers/s390/kvm/kvm_virtio.c linux-2.6.39.2/drivers/s390/kvm/kvm_virtio.c
38067--- linux-2.6.39.2/drivers/s390/kvm/kvm_virtio.c 2011-05-19 00:06:34.000000000 -0400
38068+++ linux-2.6.39.2/drivers/s390/kvm/kvm_virtio.c 2011-05-22 19:36:32.000000000 -0400
38069@@ -266,7 +266,7 @@ error:
38070 /*
38071 * The config ops structure as defined by virtio config
38072 */
38073-static struct virtio_config_ops kvm_vq_configspace_ops = {
38074+static const struct virtio_config_ops kvm_vq_configspace_ops = {
38075 .get_features = kvm_get_features,
38076 .finalize_features = kvm_finalize_features,
38077 .get = kvm_get,
38078diff -urNp linux-2.6.39.2/drivers/s390/net/qeth_core.h linux-2.6.39.2/drivers/s390/net/qeth_core.h
38079--- linux-2.6.39.2/drivers/s390/net/qeth_core.h 2011-05-19 00:06:34.000000000 -0400
38080+++ linux-2.6.39.2/drivers/s390/net/qeth_core.h 2011-05-22 19:36:32.000000000 -0400
38081@@ -743,7 +743,7 @@ struct qeth_card {
38082 struct qeth_qdio_info qdio;
38083 struct qeth_perf_stats perf_stats;
38084 int read_or_write_problem;
38085- struct qeth_osn_info osn_info;
38086+ const struct qeth_osn_info osn_info;
38087 struct qeth_discipline discipline;
38088 atomic_t force_alloc_skb;
38089 struct service_level qeth_service_level;
38090diff -urNp linux-2.6.39.2/drivers/scsi/53c700.c linux-2.6.39.2/drivers/scsi/53c700.c
38091--- linux-2.6.39.2/drivers/scsi/53c700.c 2011-05-19 00:06:34.000000000 -0400
38092+++ linux-2.6.39.2/drivers/scsi/53c700.c 2011-05-22 19:36:32.000000000 -0400
38093@@ -2153,7 +2153,7 @@ EXPORT_SYMBOL(NCR_700_detect);
38094 EXPORT_SYMBOL(NCR_700_release);
38095 EXPORT_SYMBOL(NCR_700_intr);
38096
38097-static struct spi_function_template NCR_700_transport_functions = {
38098+static struct spi_function_template NCR_700_transport_functions = {
38099 .set_period = NCR_700_set_period,
38100 .show_period = 1,
38101 .set_offset = NCR_700_set_offset,
38102diff -urNp linux-2.6.39.2/drivers/scsi/aacraid/commctrl.c linux-2.6.39.2/drivers/scsi/aacraid/commctrl.c
38103--- linux-2.6.39.2/drivers/scsi/aacraid/commctrl.c 2011-05-19 00:06:34.000000000 -0400
38104+++ linux-2.6.39.2/drivers/scsi/aacraid/commctrl.c 2011-05-22 19:36:32.000000000 -0400
38105@@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d
38106 u32 actual_fibsize64, actual_fibsize = 0;
38107 int i;
38108
38109+ pax_track_stack();
38110
38111 if (dev->in_reset) {
38112 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
38113diff -urNp linux-2.6.39.2/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.39.2/drivers/scsi/aic94xx/aic94xx_init.c
38114--- linux-2.6.39.2/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-19 00:06:34.000000000 -0400
38115+++ linux-2.6.39.2/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-22 19:41:37.000000000 -0400
38116@@ -486,7 +486,7 @@ static ssize_t asd_show_update_bios(stru
38117 flash_error_table[i].reason);
38118 }
38119
38120-static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
38121+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
38122 asd_show_update_bios, asd_store_update_bios);
38123
38124 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
38125diff -urNp linux-2.6.39.2/drivers/scsi/bfa/bfa_core.c linux-2.6.39.2/drivers/scsi/bfa/bfa_core.c
38126--- linux-2.6.39.2/drivers/scsi/bfa/bfa_core.c 2011-05-19 00:06:34.000000000 -0400
38127+++ linux-2.6.39.2/drivers/scsi/bfa/bfa_core.c 2011-05-22 19:36:32.000000000 -0400
38128@@ -24,7 +24,7 @@ BFA_TRC_FILE(HAL, CORE);
38129 /*
38130 * BFA module list terminated by NULL
38131 */
38132-static struct bfa_module_s *hal_mods[] = {
38133+static const struct bfa_module_s *hal_mods[] = {
38134 &hal_mod_sgpg,
38135 &hal_mod_fcport,
38136 &hal_mod_fcxp,
38137diff -urNp linux-2.6.39.2/drivers/scsi/bfa/bfad.c linux-2.6.39.2/drivers/scsi/bfa/bfad.c
38138--- linux-2.6.39.2/drivers/scsi/bfa/bfad.c 2011-05-19 00:06:34.000000000 -0400
38139+++ linux-2.6.39.2/drivers/scsi/bfa/bfad.c 2011-05-22 19:36:32.000000000 -0400
38140@@ -1027,6 +1027,8 @@ bfad_start_ops(struct bfad_s *bfad) {
38141 struct bfad_vport_s *vport, *vport_new;
38142 struct bfa_fcs_driver_info_s driver_info;
38143
38144+ pax_track_stack();
38145+
38146 /* Fill the driver_info info to fcs*/
38147 memset(&driver_info, 0, sizeof(driver_info));
38148 strncpy(driver_info.version, BFAD_DRIVER_VERSION,
38149diff -urNp linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs.c linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs.c
38150--- linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs.c 2011-05-19 00:06:34.000000000 -0400
38151+++ linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs.c 2011-05-22 19:36:32.000000000 -0400
38152@@ -70,7 +70,7 @@ bfa_fcs_attach(struct bfa_fcs_s *fcs, st
38153 bfa_boolean_t min_cfg)
38154 {
38155 int i;
38156- struct bfa_fcs_mod_s *mod;
38157+ const struct bfa_fcs_mod_s *mod;
38158
38159 fcs->bfa = bfa;
38160 fcs->bfad = bfad;
38161@@ -93,7 +93,7 @@ void
38162 bfa_fcs_init(struct bfa_fcs_s *fcs)
38163 {
38164 int i, npbc_vports;
38165- struct bfa_fcs_mod_s *mod;
38166+ const struct bfa_fcs_mod_s *mod;
38167 struct bfi_pbc_vport_s pbc_vports[BFI_PBC_MAX_VPORTS];
38168
38169 for (i = 0; i < sizeof(fcs_modules) / sizeof(fcs_modules[0]); i++) {
38170@@ -140,7 +140,7 @@ bfa_fcs_driver_info_init(struct bfa_fcs_
38171 void
38172 bfa_fcs_exit(struct bfa_fcs_s *fcs)
38173 {
38174- struct bfa_fcs_mod_s *mod;
38175+ const struct bfa_fcs_mod_s *mod;
38176 int nmods, i;
38177
38178 bfa_wc_init(&fcs->wc, bfa_fcs_exit_comp, fcs);
38179diff -urNp linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_lport.c linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_lport.c
38180--- linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-19 00:06:34.000000000 -0400
38181+++ linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-22 19:36:32.000000000 -0400
38182@@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
38183 u16 len, count;
38184 u16 templen;
38185
38186+ pax_track_stack();
38187+
38188 /*
38189 * get hba attributes
38190 */
38191@@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
38192 u8 count = 0;
38193 u16 templen;
38194
38195+ pax_track_stack();
38196+
38197 /*
38198 * get port attributes
38199 */
38200diff -urNp linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_rport.c linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_rport.c
38201--- linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-19 00:06:34.000000000 -0400
38202+++ linux-2.6.39.2/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-22 19:36:32.000000000 -0400
38203@@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
38204 struct fc_rpsc_speed_info_s speeds;
38205 struct bfa_port_attr_s pport_attr;
38206
38207+ pax_track_stack();
38208+
38209 bfa_trc(port->fcs, rx_fchs->s_id);
38210 bfa_trc(port->fcs, rx_fchs->d_id);
38211
38212diff -urNp linux-2.6.39.2/drivers/scsi/bfa/bfa_modules.h linux-2.6.39.2/drivers/scsi/bfa/bfa_modules.h
38213--- linux-2.6.39.2/drivers/scsi/bfa/bfa_modules.h 2011-05-19 00:06:34.000000000 -0400
38214+++ linux-2.6.39.2/drivers/scsi/bfa/bfa_modules.h 2011-05-22 19:36:32.000000000 -0400
38215@@ -68,8 +68,8 @@ enum {
38216 static void bfa_ ## __mod ## _stop(struct bfa_s *bfa); \
38217 static void bfa_ ## __mod ## _iocdisable(struct bfa_s *bfa); \
38218 \
38219- extern struct bfa_module_s hal_mod_ ## __mod; \
38220- struct bfa_module_s hal_mod_ ## __mod = { \
38221+ extern const struct bfa_module_s hal_mod_ ## __mod; \
38222+ const struct bfa_module_s hal_mod_ ## __mod = { \
38223 bfa_ ## __mod ## _meminfo, \
38224 bfa_ ## __mod ## _attach, \
38225 bfa_ ## __mod ## _detach, \
38226@@ -116,12 +116,12 @@ struct bfa_s {
38227 };
38228
38229 extern bfa_boolean_t bfa_auto_recover;
38230-extern struct bfa_module_s hal_mod_sgpg;
38231-extern struct bfa_module_s hal_mod_fcport;
38232-extern struct bfa_module_s hal_mod_fcxp;
38233-extern struct bfa_module_s hal_mod_lps;
38234-extern struct bfa_module_s hal_mod_uf;
38235-extern struct bfa_module_s hal_mod_rport;
38236-extern struct bfa_module_s hal_mod_fcpim;
38237+extern const struct bfa_module_s hal_mod_sgpg;
38238+extern const struct bfa_module_s hal_mod_fcport;
38239+extern const struct bfa_module_s hal_mod_fcxp;
38240+extern const struct bfa_module_s hal_mod_lps;
38241+extern const struct bfa_module_s hal_mod_uf;
38242+extern const struct bfa_module_s hal_mod_rport;
38243+extern const struct bfa_module_s hal_mod_fcpim;
38244
38245 #endif /* __BFA_MODULES_H__ */
38246diff -urNp linux-2.6.39.2/drivers/scsi/BusLogic.c linux-2.6.39.2/drivers/scsi/BusLogic.c
38247--- linux-2.6.39.2/drivers/scsi/BusLogic.c 2011-05-19 00:06:34.000000000 -0400
38248+++ linux-2.6.39.2/drivers/scsi/BusLogic.c 2011-05-22 19:36:32.000000000 -0400
38249@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
38250 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
38251 *PrototypeHostAdapter)
38252 {
38253+ pax_track_stack();
38254+
38255 /*
38256 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
38257 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
38258diff -urNp linux-2.6.39.2/drivers/scsi/dpt_i2o.c linux-2.6.39.2/drivers/scsi/dpt_i2o.c
38259--- linux-2.6.39.2/drivers/scsi/dpt_i2o.c 2011-05-19 00:06:34.000000000 -0400
38260+++ linux-2.6.39.2/drivers/scsi/dpt_i2o.c 2011-05-22 19:36:32.000000000 -0400
38261@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
38262 dma_addr_t addr;
38263 ulong flags = 0;
38264
38265+ pax_track_stack();
38266+
38267 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
38268 // get user msg size in u32s
38269 if(get_user(size, &user_msg[0])){
38270@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
38271 s32 rcode;
38272 dma_addr_t addr;
38273
38274+ pax_track_stack();
38275+
38276 memset(msg, 0 , sizeof(msg));
38277 len = scsi_bufflen(cmd);
38278 direction = 0x00000000;
38279diff -urNp linux-2.6.39.2/drivers/scsi/eata.c linux-2.6.39.2/drivers/scsi/eata.c
38280--- linux-2.6.39.2/drivers/scsi/eata.c 2011-05-19 00:06:34.000000000 -0400
38281+++ linux-2.6.39.2/drivers/scsi/eata.c 2011-05-22 19:36:32.000000000 -0400
38282@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
38283 struct hostdata *ha;
38284 char name[16];
38285
38286+ pax_track_stack();
38287+
38288 sprintf(name, "%s%d", driver_name, j);
38289
38290 if (!request_region(port_base, REGION_SIZE, driver_name)) {
38291diff -urNp linux-2.6.39.2/drivers/scsi/esp_scsi.c linux-2.6.39.2/drivers/scsi/esp_scsi.c
38292--- linux-2.6.39.2/drivers/scsi/esp_scsi.c 2011-05-19 00:06:34.000000000 -0400
38293+++ linux-2.6.39.2/drivers/scsi/esp_scsi.c 2011-05-22 19:36:32.000000000 -0400
38294@@ -2680,7 +2680,7 @@ static void esp_set_width(struct scsi_ta
38295 tp->flags |= ESP_TGT_CHECK_NEGO;
38296 }
38297
38298-static struct spi_function_template esp_transport_ops = {
38299+static const struct spi_function_template esp_transport_ops = {
38300 .set_offset = esp_set_offset,
38301 .show_offset = 1,
38302 .set_period = esp_set_period,
38303diff -urNp linux-2.6.39.2/drivers/scsi/fcoe/fcoe.c linux-2.6.39.2/drivers/scsi/fcoe/fcoe.c
38304--- linux-2.6.39.2/drivers/scsi/fcoe/fcoe.c 2011-05-19 00:06:34.000000000 -0400
38305+++ linux-2.6.39.2/drivers/scsi/fcoe/fcoe.c 2011-05-22 19:36:32.000000000 -0400
38306@@ -138,7 +138,7 @@ static int fcoe_vport_disable(struct fc_
38307 static void fcoe_set_vport_symbolic_name(struct fc_vport *);
38308 static void fcoe_set_port_id(struct fc_lport *, u32, struct fc_frame *);
38309
38310-static struct libfc_function_template fcoe_libfc_fcn_templ = {
38311+static const struct libfc_function_template fcoe_libfc_fcn_templ = {
38312 .frame_send = fcoe_xmit,
38313 .ddp_setup = fcoe_ddp_setup,
38314 .ddp_done = fcoe_ddp_done,
38315diff -urNp linux-2.6.39.2/drivers/scsi/fcoe/fcoe_ctlr.c linux-2.6.39.2/drivers/scsi/fcoe/fcoe_ctlr.c
38316--- linux-2.6.39.2/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-19 00:06:34.000000000 -0400
38317+++ linux-2.6.39.2/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-22 19:36:32.000000000 -0400
38318@@ -1912,7 +1912,7 @@ static void fcoe_ctlr_vn_rport_callback(
38319 mutex_unlock(&fip->ctlr_mutex);
38320 }
38321
38322-static struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38323+static const struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38324 .event_callback = fcoe_ctlr_vn_rport_callback,
38325 };
38326
38327@@ -2458,6 +2458,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
38328 } buf;
38329 int rc;
38330
38331+ pax_track_stack();
38332+
38333 fiph = (struct fip_header *)skb->data;
38334 sub = fiph->fip_subcode;
38335
38336diff -urNp linux-2.6.39.2/drivers/scsi/fnic/fnic_main.c linux-2.6.39.2/drivers/scsi/fnic/fnic_main.c
38337--- linux-2.6.39.2/drivers/scsi/fnic/fnic_main.c 2011-05-19 00:06:34.000000000 -0400
38338+++ linux-2.6.39.2/drivers/scsi/fnic/fnic_main.c 2011-05-22 19:36:32.000000000 -0400
38339@@ -69,7 +69,7 @@ module_param(fnic_log_level, int, S_IRUG
38340 MODULE_PARM_DESC(fnic_log_level, "bit mask of fnic logging levels");
38341
38342
38343-static struct libfc_function_template fnic_transport_template = {
38344+static const struct libfc_function_template fnic_transport_template = {
38345 .frame_send = fnic_send,
38346 .lport_set_port_id = fnic_set_port_id,
38347 .fcp_abort_io = fnic_empty_scsi_cleanup,
38348diff -urNp linux-2.6.39.2/drivers/scsi/gdth.c linux-2.6.39.2/drivers/scsi/gdth.c
38349--- linux-2.6.39.2/drivers/scsi/gdth.c 2011-05-19 00:06:34.000000000 -0400
38350+++ linux-2.6.39.2/drivers/scsi/gdth.c 2011-05-22 19:36:32.000000000 -0400
38351@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
38352 unsigned long flags;
38353 gdth_ha_str *ha;
38354
38355+ pax_track_stack();
38356+
38357 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
38358 return -EFAULT;
38359 ha = gdth_find_ha(ldrv.ionode);
38360@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
38361 gdth_ha_str *ha;
38362 int rval;
38363
38364+ pax_track_stack();
38365+
38366 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
38367 res.number >= MAX_HDRIVES)
38368 return -EFAULT;
38369@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
38370 gdth_ha_str *ha;
38371 int rval;
38372
38373+ pax_track_stack();
38374+
38375 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
38376 return -EFAULT;
38377 ha = gdth_find_ha(gen.ionode);
38378@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
38379 int i;
38380 gdth_cmd_str gdtcmd;
38381 char cmnd[MAX_COMMAND_SIZE];
38382+
38383+ pax_track_stack();
38384+
38385 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
38386
38387 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
38388diff -urNp linux-2.6.39.2/drivers/scsi/gdth_proc.c linux-2.6.39.2/drivers/scsi/gdth_proc.c
38389--- linux-2.6.39.2/drivers/scsi/gdth_proc.c 2011-05-19 00:06:34.000000000 -0400
38390+++ linux-2.6.39.2/drivers/scsi/gdth_proc.c 2011-05-22 19:36:32.000000000 -0400
38391@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
38392 u64 paddr;
38393
38394 char cmnd[MAX_COMMAND_SIZE];
38395+
38396+ pax_track_stack();
38397+
38398 memset(cmnd, 0xff, 12);
38399 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
38400
38401@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
38402 gdth_hget_str *phg;
38403 char cmnd[MAX_COMMAND_SIZE];
38404
38405+ pax_track_stack();
38406+
38407 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
38408 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
38409 if (!gdtcmd || !estr)
38410diff -urNp linux-2.6.39.2/drivers/scsi/hosts.c linux-2.6.39.2/drivers/scsi/hosts.c
38411--- linux-2.6.39.2/drivers/scsi/hosts.c 2011-05-19 00:06:34.000000000 -0400
38412+++ linux-2.6.39.2/drivers/scsi/hosts.c 2011-05-22 19:36:32.000000000 -0400
38413@@ -42,7 +42,7 @@
38414 #include "scsi_logging.h"
38415
38416
38417-static atomic_t scsi_host_next_hn; /* host_no for next new host */
38418+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
38419
38420
38421 static void scsi_host_cls_release(struct device *dev)
38422@@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct
38423 * subtract one because we increment first then return, but we need to
38424 * know what the next host number was before increment
38425 */
38426- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
38427+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
38428 shost->dma_channel = 0xff;
38429
38430 /* These three are default values which can be overridden */
38431diff -urNp linux-2.6.39.2/drivers/scsi/hpsa.h linux-2.6.39.2/drivers/scsi/hpsa.h
38432--- linux-2.6.39.2/drivers/scsi/hpsa.h 2011-05-19 00:06:34.000000000 -0400
38433+++ linux-2.6.39.2/drivers/scsi/hpsa.h 2011-05-22 19:36:32.000000000 -0400
38434@@ -347,7 +347,7 @@ static struct access_method SA5_access =
38435 SA5_completed,
38436 };
38437
38438-static struct access_method SA5_performant_access = {
38439+static const struct access_method SA5_performant_access = {
38440 SA5_submit_command,
38441 SA5_performant_intr_mask,
38442 SA5_fifo_full,
38443diff -urNp linux-2.6.39.2/drivers/scsi/hptiop.c linux-2.6.39.2/drivers/scsi/hptiop.c
38444--- linux-2.6.39.2/drivers/scsi/hptiop.c 2011-05-19 00:06:34.000000000 -0400
38445+++ linux-2.6.39.2/drivers/scsi/hptiop.c 2011-05-22 19:36:32.000000000 -0400
38446@@ -1226,7 +1226,7 @@ static void hptiop_remove(struct pci_dev
38447 scsi_host_put(host);
38448 }
38449
38450-static struct hptiop_adapter_ops hptiop_itl_ops = {
38451+static const struct hptiop_adapter_ops hptiop_itl_ops = {
38452 .iop_wait_ready = iop_wait_ready_itl,
38453 .internal_memalloc = NULL,
38454 .internal_memfree = NULL,
38455@@ -1241,7 +1241,7 @@ static struct hptiop_adapter_ops hptiop_
38456 .post_req = hptiop_post_req_itl,
38457 };
38458
38459-static struct hptiop_adapter_ops hptiop_mv_ops = {
38460+static const struct hptiop_adapter_ops hptiop_mv_ops = {
38461 .iop_wait_ready = iop_wait_ready_mv,
38462 .internal_memalloc = hptiop_internal_memalloc_mv,
38463 .internal_memfree = hptiop_internal_memfree_mv,
38464diff -urNp linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvfc.c linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvfc.c
38465--- linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-19 00:06:34.000000000 -0400
38466+++ linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-22 19:36:32.000000000 -0400
38467@@ -4881,7 +4881,7 @@ static struct vio_device_id ibmvfc_devic
38468 };
38469 MODULE_DEVICE_TABLE(vio, ibmvfc_device_table);
38470
38471-static struct dev_pm_ops ibmvfc_pm_ops = {
38472+static const struct dev_pm_ops ibmvfc_pm_ops = {
38473 .resume = ibmvfc_resume
38474 };
38475
38476diff -urNp linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.c linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.c
38477--- linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-19 00:06:34.000000000 -0400
38478+++ linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-22 19:36:32.000000000 -0400
38479@@ -104,7 +104,7 @@ static struct scsi_transport_template *i
38480
38481 #define IBMVSCSI_VERSION "1.5.9"
38482
38483-static struct ibmvscsi_ops *ibmvscsi_ops;
38484+static const struct ibmvscsi_ops *ibmvscsi_ops;
38485
38486 MODULE_DESCRIPTION("IBM Virtual SCSI");
38487 MODULE_AUTHOR("Dave Boutcher");
38488@@ -2059,7 +2059,7 @@ static struct vio_device_id ibmvscsi_dev
38489 };
38490 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
38491
38492-static struct dev_pm_ops ibmvscsi_pm_ops = {
38493+static const struct dev_pm_ops ibmvscsi_pm_ops = {
38494 .resume = ibmvscsi_resume
38495 };
38496
38497@@ -2075,7 +2075,7 @@ static struct vio_driver ibmvscsi_driver
38498 }
38499 };
38500
38501-static struct srp_function_template ibmvscsi_transport_functions = {
38502+static const struct srp_function_template ibmvscsi_transport_functions = {
38503 };
38504
38505 int __init ibmvscsi_module_init(void)
38506diff -urNp linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.h linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.h
38507--- linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-19 00:06:34.000000000 -0400
38508+++ linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-22 19:36:32.000000000 -0400
38509@@ -127,7 +127,7 @@ struct ibmvscsi_ops {
38510 int (*resume) (struct ibmvscsi_host_data *hostdata);
38511 };
38512
38513-extern struct ibmvscsi_ops iseriesvscsi_ops;
38514-extern struct ibmvscsi_ops rpavscsi_ops;
38515+extern const struct ibmvscsi_ops iseriesvscsi_ops;
38516+extern const struct ibmvscsi_ops rpavscsi_ops;
38517
38518 #endif /* IBMVSCSI_H */
38519diff -urNp linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvstgt.c linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvstgt.c
38520--- linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-19 00:06:34.000000000 -0400
38521+++ linux-2.6.39.2/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-22 19:36:32.000000000 -0400
38522@@ -951,7 +951,7 @@ static int get_system_info(void)
38523 return 0;
38524 }
38525
38526-static struct srp_function_template ibmvstgt_transport_functions = {
38527+static const struct srp_function_template ibmvstgt_transport_functions = {
38528 .tsk_mgmt_response = ibmvstgt_tsk_mgmt_response,
38529 .it_nexus_response = ibmvstgt_it_nexus_response,
38530 };
38531diff -urNp linux-2.6.39.2/drivers/scsi/ibmvscsi/iseries_vscsi.c linux-2.6.39.2/drivers/scsi/ibmvscsi/iseries_vscsi.c
38532--- linux-2.6.39.2/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38533+++ linux-2.6.39.2/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38534@@ -163,7 +163,7 @@ static int iseriesvscsi_resume(struct ib
38535 return 0;
38536 }
38537
38538-struct ibmvscsi_ops iseriesvscsi_ops = {
38539+const struct ibmvscsi_ops iseriesvscsi_ops = {
38540 .init_crq_queue = iseriesvscsi_init_crq_queue,
38541 .release_crq_queue = iseriesvscsi_release_crq_queue,
38542 .reset_crq_queue = iseriesvscsi_reset_crq_queue,
38543diff -urNp linux-2.6.39.2/drivers/scsi/ibmvscsi/rpa_vscsi.c linux-2.6.39.2/drivers/scsi/ibmvscsi/rpa_vscsi.c
38544--- linux-2.6.39.2/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38545+++ linux-2.6.39.2/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38546@@ -358,7 +358,7 @@ static int rpavscsi_resume(struct ibmvsc
38547 return 0;
38548 }
38549
38550-struct ibmvscsi_ops rpavscsi_ops = {
38551+const struct ibmvscsi_ops rpavscsi_ops = {
38552 .init_crq_queue = rpavscsi_init_crq_queue,
38553 .release_crq_queue = rpavscsi_release_crq_queue,
38554 .reset_crq_queue = rpavscsi_reset_crq_queue,
38555diff -urNp linux-2.6.39.2/drivers/scsi/ipr.c linux-2.6.39.2/drivers/scsi/ipr.c
38556--- linux-2.6.39.2/drivers/scsi/ipr.c 2011-05-19 00:06:34.000000000 -0400
38557+++ linux-2.6.39.2/drivers/scsi/ipr.c 2011-05-22 19:36:32.000000000 -0400
38558@@ -6210,7 +6210,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
38559 return true;
38560 }
38561
38562-static struct ata_port_operations ipr_sata_ops = {
38563+static const struct ata_port_operations ipr_sata_ops = {
38564 .phy_reset = ipr_ata_phy_reset,
38565 .hardreset = ipr_sata_reset,
38566 .post_internal_cmd = ipr_ata_post_internal,
38567diff -urNp linux-2.6.39.2/drivers/scsi/libfc/fc_exch.c linux-2.6.39.2/drivers/scsi/libfc/fc_exch.c
38568--- linux-2.6.39.2/drivers/scsi/libfc/fc_exch.c 2011-05-19 00:06:34.000000000 -0400
38569+++ linux-2.6.39.2/drivers/scsi/libfc/fc_exch.c 2011-05-22 19:36:32.000000000 -0400
38570@@ -105,12 +105,12 @@ struct fc_exch_mgr {
38571 * all together if not used XXX
38572 */
38573 struct {
38574- atomic_t no_free_exch;
38575- atomic_t no_free_exch_xid;
38576- atomic_t xid_not_found;
38577- atomic_t xid_busy;
38578- atomic_t seq_not_found;
38579- atomic_t non_bls_resp;
38580+ atomic_unchecked_t no_free_exch;
38581+ atomic_unchecked_t no_free_exch_xid;
38582+ atomic_unchecked_t xid_not_found;
38583+ atomic_unchecked_t xid_busy;
38584+ atomic_unchecked_t seq_not_found;
38585+ atomic_unchecked_t non_bls_resp;
38586 } stats;
38587 };
38588
38589@@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc(
38590 /* allocate memory for exchange */
38591 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
38592 if (!ep) {
38593- atomic_inc(&mp->stats.no_free_exch);
38594+ atomic_inc_unchecked(&mp->stats.no_free_exch);
38595 goto out;
38596 }
38597 memset(ep, 0, sizeof(*ep));
38598@@ -761,7 +761,7 @@ out:
38599 return ep;
38600 err:
38601 spin_unlock_bh(&pool->lock);
38602- atomic_inc(&mp->stats.no_free_exch_xid);
38603+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
38604 mempool_free(ep, mp->ep_pool);
38605 return NULL;
38606 }
38607@@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38608 xid = ntohs(fh->fh_ox_id); /* we originated exch */
38609 ep = fc_exch_find(mp, xid);
38610 if (!ep) {
38611- atomic_inc(&mp->stats.xid_not_found);
38612+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38613 reject = FC_RJT_OX_ID;
38614 goto out;
38615 }
38616@@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38617 ep = fc_exch_find(mp, xid);
38618 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
38619 if (ep) {
38620- atomic_inc(&mp->stats.xid_busy);
38621+ atomic_inc_unchecked(&mp->stats.xid_busy);
38622 reject = FC_RJT_RX_ID;
38623 goto rel;
38624 }
38625@@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38626 }
38627 xid = ep->xid; /* get our XID */
38628 } else if (!ep) {
38629- atomic_inc(&mp->stats.xid_not_found);
38630+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38631 reject = FC_RJT_RX_ID; /* XID not found */
38632 goto out;
38633 }
38634@@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38635 } else {
38636 sp = &ep->seq;
38637 if (sp->id != fh->fh_seq_id) {
38638- atomic_inc(&mp->stats.seq_not_found);
38639+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38640 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
38641 goto rel;
38642 }
38643@@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct
38644
38645 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
38646 if (!ep) {
38647- atomic_inc(&mp->stats.xid_not_found);
38648+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38649 goto out;
38650 }
38651 if (ep->esb_stat & ESB_ST_COMPLETE) {
38652- atomic_inc(&mp->stats.xid_not_found);
38653+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38654 goto rel;
38655 }
38656 if (ep->rxid == FC_XID_UNKNOWN)
38657 ep->rxid = ntohs(fh->fh_rx_id);
38658 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
38659- atomic_inc(&mp->stats.xid_not_found);
38660+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38661 goto rel;
38662 }
38663 if (ep->did != ntoh24(fh->fh_s_id) &&
38664 ep->did != FC_FID_FLOGI) {
38665- atomic_inc(&mp->stats.xid_not_found);
38666+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38667 goto rel;
38668 }
38669 sof = fr_sof(fp);
38670@@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct
38671 sp->ssb_stat |= SSB_ST_RESP;
38672 sp->id = fh->fh_seq_id;
38673 } else if (sp->id != fh->fh_seq_id) {
38674- atomic_inc(&mp->stats.seq_not_found);
38675+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38676 goto rel;
38677 }
38678
38679@@ -1479,9 +1479,9 @@ static void fc_exch_recv_resp(struct fc_
38680 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
38681
38682 if (!sp)
38683- atomic_inc(&mp->stats.xid_not_found);
38684+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38685 else
38686- atomic_inc(&mp->stats.non_bls_resp);
38687+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
38688
38689 fc_frame_free(fp);
38690 }
38691diff -urNp linux-2.6.39.2/drivers/scsi/libfc/fc_lport.c linux-2.6.39.2/drivers/scsi/libfc/fc_lport.c
38692--- linux-2.6.39.2/drivers/scsi/libfc/fc_lport.c 2011-05-19 00:06:34.000000000 -0400
38693+++ linux-2.6.39.2/drivers/scsi/libfc/fc_lport.c 2011-05-22 19:36:32.000000000 -0400
38694@@ -1299,7 +1299,7 @@ static void fc_lport_enter_ns(struct fc_
38695 fc_lport_error(lport, fp);
38696 }
38697
38698-static struct fc_rport_operations fc_lport_rport_ops = {
38699+static const struct fc_rport_operations fc_lport_rport_ops = {
38700 .event_callback = fc_lport_rport_callback,
38701 };
38702
38703diff -urNp linux-2.6.39.2/drivers/scsi/libfc/fc_rport.c linux-2.6.39.2/drivers/scsi/libfc/fc_rport.c
38704--- linux-2.6.39.2/drivers/scsi/libfc/fc_rport.c 2011-05-19 00:06:34.000000000 -0400
38705+++ linux-2.6.39.2/drivers/scsi/libfc/fc_rport.c 2011-05-22 19:36:32.000000000 -0400
38706@@ -256,7 +256,7 @@ static void fc_rport_work(struct work_st
38707 struct fc_rport_libfc_priv *rpriv;
38708 enum fc_rport_event event;
38709 struct fc_lport *lport = rdata->local_port;
38710- struct fc_rport_operations *rport_ops;
38711+ const struct fc_rport_operations *rport_ops;
38712 struct fc_rport_identifiers ids;
38713 struct fc_rport *rport;
38714 struct fc4_prov *prov;
38715diff -urNp linux-2.6.39.2/drivers/scsi/libsas/sas_ata.c linux-2.6.39.2/drivers/scsi/libsas/sas_ata.c
38716--- linux-2.6.39.2/drivers/scsi/libsas/sas_ata.c 2011-05-19 00:06:34.000000000 -0400
38717+++ linux-2.6.39.2/drivers/scsi/libsas/sas_ata.c 2011-05-22 19:36:32.000000000 -0400
38718@@ -307,14 +307,14 @@ static void sas_ata_post_internal(struct
38719 }
38720 }
38721
38722-static struct ata_port_operations sas_sata_ops = {
38723+static const struct ata_port_operations sas_sata_ops = {
38724 .prereset = ata_std_prereset,
38725 .softreset = NULL,
38726 .hardreset = sas_ata_hard_reset,
38727 .postreset = ata_std_postreset,
38728 .error_handler = ata_std_error_handler,
38729 .post_internal_cmd = sas_ata_post_internal,
38730- .qc_defer = ata_std_qc_defer,
38731+ .qc_defer = ata_std_qc_defer,
38732 .qc_prep = ata_noop_qc_prep,
38733 .qc_issue = sas_ata_qc_issue,
38734 .qc_fill_rtf = sas_ata_qc_fill_rtf,
38735diff -urNp linux-2.6.39.2/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.39.2/drivers/scsi/lpfc/lpfc_debugfs.c
38736--- linux-2.6.39.2/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-19 00:06:34.000000000 -0400
38737+++ linux-2.6.39.2/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-22 19:36:32.000000000 -0400
38738@@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_
38739
38740 #include <linux/debugfs.h>
38741
38742-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38743+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38744 static unsigned long lpfc_debugfs_start_time = 0L;
38745
38746 /* iDiag */
38747@@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
38748 lpfc_debugfs_enable = 0;
38749
38750 len = 0;
38751- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
38752+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
38753 (lpfc_debugfs_max_disc_trc - 1);
38754 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
38755 dtp = vport->disc_trc + i;
38756@@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
38757 lpfc_debugfs_enable = 0;
38758
38759 len = 0;
38760- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
38761+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
38762 (lpfc_debugfs_max_slow_ring_trc - 1);
38763 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
38764 dtp = phba->slow_ring_trc + i;
38765@@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
38766 uint32_t *ptr;
38767 char buffer[1024];
38768
38769+ pax_track_stack();
38770+
38771 off = 0;
38772 spin_lock_irq(&phba->hbalock);
38773
38774@@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
38775 !vport || !vport->disc_trc)
38776 return;
38777
38778- index = atomic_inc_return(&vport->disc_trc_cnt) &
38779+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
38780 (lpfc_debugfs_max_disc_trc - 1);
38781 dtp = vport->disc_trc + index;
38782 dtp->fmt = fmt;
38783 dtp->data1 = data1;
38784 dtp->data2 = data2;
38785 dtp->data3 = data3;
38786- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38787+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38788 dtp->jif = jiffies;
38789 #endif
38790 return;
38791@@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
38792 !phba || !phba->slow_ring_trc)
38793 return;
38794
38795- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
38796+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
38797 (lpfc_debugfs_max_slow_ring_trc - 1);
38798 dtp = phba->slow_ring_trc + index;
38799 dtp->fmt = fmt;
38800 dtp->data1 = data1;
38801 dtp->data2 = data2;
38802 dtp->data3 = data3;
38803- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38804+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38805 dtp->jif = jiffies;
38806 #endif
38807 return;
38808@@ -2145,7 +2147,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38809 "slow_ring buffer\n");
38810 goto debug_failed;
38811 }
38812- atomic_set(&phba->slow_ring_trc_cnt, 0);
38813+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
38814 memset(phba->slow_ring_trc, 0,
38815 (sizeof(struct lpfc_debugfs_trc) *
38816 lpfc_debugfs_max_slow_ring_trc));
38817@@ -2191,7 +2193,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38818 "buffer\n");
38819 goto debug_failed;
38820 }
38821- atomic_set(&vport->disc_trc_cnt, 0);
38822+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
38823
38824 snprintf(name, sizeof(name), "discovery_trace");
38825 vport->debug_disc_trc =
38826diff -urNp linux-2.6.39.2/drivers/scsi/lpfc/lpfc.h linux-2.6.39.2/drivers/scsi/lpfc/lpfc.h
38827--- linux-2.6.39.2/drivers/scsi/lpfc/lpfc.h 2011-05-19 00:06:34.000000000 -0400
38828+++ linux-2.6.39.2/drivers/scsi/lpfc/lpfc.h 2011-05-22 19:36:32.000000000 -0400
38829@@ -419,7 +419,7 @@ struct lpfc_vport {
38830 struct dentry *debug_nodelist;
38831 struct dentry *vport_debugfs_root;
38832 struct lpfc_debugfs_trc *disc_trc;
38833- atomic_t disc_trc_cnt;
38834+ atomic_unchecked_t disc_trc_cnt;
38835 #endif
38836 uint8_t stat_data_enabled;
38837 uint8_t stat_data_blocked;
38838@@ -785,8 +785,8 @@ struct lpfc_hba {
38839 struct timer_list fabric_block_timer;
38840 unsigned long bit_flags;
38841 #define FABRIC_COMANDS_BLOCKED 0
38842- atomic_t num_rsrc_err;
38843- atomic_t num_cmd_success;
38844+ atomic_unchecked_t num_rsrc_err;
38845+ atomic_unchecked_t num_cmd_success;
38846 unsigned long last_rsrc_error_time;
38847 unsigned long last_ramp_down_time;
38848 unsigned long last_ramp_up_time;
38849@@ -800,7 +800,7 @@ struct lpfc_hba {
38850 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
38851 struct dentry *debug_slow_ring_trc;
38852 struct lpfc_debugfs_trc *slow_ring_trc;
38853- atomic_t slow_ring_trc_cnt;
38854+ atomic_unchecked_t slow_ring_trc_cnt;
38855 /* iDiag debugfs sub-directory */
38856 struct dentry *idiag_root;
38857 struct dentry *idiag_pci_cfg;
38858diff -urNp linux-2.6.39.2/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.39.2/drivers/scsi/lpfc/lpfc_scsi.c
38859--- linux-2.6.39.2/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-19 00:06:34.000000000 -0400
38860+++ linux-2.6.39.2/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-22 19:36:32.000000000 -0400
38861@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
38862 uint32_t evt_posted;
38863
38864 spin_lock_irqsave(&phba->hbalock, flags);
38865- atomic_inc(&phba->num_rsrc_err);
38866+ atomic_inc_unchecked(&phba->num_rsrc_err);
38867 phba->last_rsrc_error_time = jiffies;
38868
38869 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
38870@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
38871 unsigned long flags;
38872 struct lpfc_hba *phba = vport->phba;
38873 uint32_t evt_posted;
38874- atomic_inc(&phba->num_cmd_success);
38875+ atomic_inc_unchecked(&phba->num_cmd_success);
38876
38877 if (vport->cfg_lun_queue_depth <= queue_depth)
38878 return;
38879@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38880 unsigned long num_rsrc_err, num_cmd_success;
38881 int i;
38882
38883- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
38884- num_cmd_success = atomic_read(&phba->num_cmd_success);
38885+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
38886+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
38887
38888 vports = lpfc_create_vport_work_array(phba);
38889 if (vports != NULL)
38890@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38891 }
38892 }
38893 lpfc_destroy_vport_work_array(phba, vports);
38894- atomic_set(&phba->num_rsrc_err, 0);
38895- atomic_set(&phba->num_cmd_success, 0);
38896+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38897+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38898 }
38899
38900 /**
38901@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
38902 }
38903 }
38904 lpfc_destroy_vport_work_array(phba, vports);
38905- atomic_set(&phba->num_rsrc_err, 0);
38906- atomic_set(&phba->num_cmd_success, 0);
38907+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38908+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38909 }
38910
38911 /**
38912diff -urNp linux-2.6.39.2/drivers/scsi/mac_esp.c linux-2.6.39.2/drivers/scsi/mac_esp.c
38913--- linux-2.6.39.2/drivers/scsi/mac_esp.c 2011-05-19 00:06:34.000000000 -0400
38914+++ linux-2.6.39.2/drivers/scsi/mac_esp.c 2011-05-22 19:36:32.000000000 -0400
38915@@ -473,7 +473,7 @@ static irqreturn_t mac_scsi_esp_intr(int
38916 return IRQ_HANDLED;
38917 }
38918
38919-static struct esp_driver_ops mac_esp_ops = {
38920+static const struct esp_driver_ops mac_esp_ops = {
38921 .esp_write8 = mac_esp_write8,
38922 .esp_read8 = mac_esp_read8,
38923 .map_single = mac_esp_map_single,
38924diff -urNp linux-2.6.39.2/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.39.2/drivers/scsi/megaraid/megaraid_mbox.c
38925--- linux-2.6.39.2/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-19 00:06:34.000000000 -0400
38926+++ linux-2.6.39.2/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-22 19:36:32.000000000 -0400
38927@@ -3510,6 +3510,8 @@ megaraid_cmm_register(adapter_t *adapter
38928 int rval;
38929 int i;
38930
38931+ pax_track_stack();
38932+
38933 // Allocate memory for the base list of scb for management module.
38934 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
38935
38936diff -urNp linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_base.c linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_base.c
38937--- linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-19 00:06:34.000000000 -0400
38938+++ linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-22 19:36:32.000000000 -0400
38939@@ -366,7 +366,7 @@ megasas_check_reset_xscale(struct megasa
38940 return 0;
38941 }
38942
38943-static struct megasas_instance_template megasas_instance_template_xscale = {
38944+static const struct megasas_instance_template megasas_instance_template_xscale = {
38945
38946 .fire_cmd = megasas_fire_cmd_xscale,
38947 .enable_intr = megasas_enable_intr_xscale,
38948@@ -497,7 +497,7 @@ megasas_check_reset_ppc(struct megasas_i
38949 {
38950 return 0;
38951 }
38952-static struct megasas_instance_template megasas_instance_template_ppc = {
38953+static const struct megasas_instance_template megasas_instance_template_ppc = {
38954
38955 .fire_cmd = megasas_fire_cmd_ppc,
38956 .enable_intr = megasas_enable_intr_ppc,
38957@@ -623,7 +623,7 @@ megasas_check_reset_skinny(struct megasa
38958 return 0;
38959 }
38960
38961-static struct megasas_instance_template megasas_instance_template_skinny = {
38962+static const struct megasas_instance_template megasas_instance_template_skinny = {
38963
38964 .fire_cmd = megasas_fire_cmd_skinny,
38965 .enable_intr = megasas_enable_intr_skinny,
38966@@ -810,7 +810,7 @@ megasas_check_reset_gen2(struct megasas_
38967 return 0;
38968 }
38969
38970-static struct megasas_instance_template megasas_instance_template_gen2 = {
38971+static const struct megasas_instance_template megasas_instance_template_gen2 = {
38972
38973 .fire_cmd = megasas_fire_cmd_gen2,
38974 .enable_intr = megasas_enable_intr_gen2,
38975@@ -834,7 +834,7 @@ static struct megasas_instance_template
38976 /*
38977 * Template added for TB (Fusion)
38978 */
38979-extern struct megasas_instance_template megasas_instance_template_fusion;
38980+extern const struct megasas_instance_template megasas_instance_template_fusion;
38981
38982 /**
38983 * megasas_issue_polled - Issues a polling command
38984diff -urNp linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_fusion.c linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_fusion.c
38985--- linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-19 00:06:34.000000000 -0400
38986+++ linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-22 19:36:32.000000000 -0400
38987@@ -2236,7 +2236,7 @@ void megasas_fusion_ocr_wq(struct work_s
38988 megasas_reset_fusion(instance->host);
38989 }
38990
38991-struct megasas_instance_template megasas_instance_template_fusion = {
38992+const struct megasas_instance_template megasas_instance_template_fusion = {
38993 .fire_cmd = megasas_fire_cmd_fusion,
38994 .enable_intr = megasas_enable_intr_fusion,
38995 .disable_intr = megasas_disable_intr_fusion,
38996diff -urNp linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas.h linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas.h
38997--- linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas.h 2011-05-19 00:06:34.000000000 -0400
38998+++ linux-2.6.39.2/drivers/scsi/megaraid/megaraid_sas.h 2011-05-22 19:36:32.000000000 -0400
38999@@ -1330,7 +1330,7 @@ struct megasas_instance {
39000 atomic_t fw_outstanding;
39001 atomic_t fw_reset_no_pci_access;
39002
39003- struct megasas_instance_template *instancet;
39004+ const struct megasas_instance_template *instancet;
39005 struct tasklet_struct isr_tasklet;
39006 struct work_struct work_init;
39007
39008diff -urNp linux-2.6.39.2/drivers/scsi/ncr53c8xx.c linux-2.6.39.2/drivers/scsi/ncr53c8xx.c
39009--- linux-2.6.39.2/drivers/scsi/ncr53c8xx.c 2011-05-19 00:06:34.000000000 -0400
39010+++ linux-2.6.39.2/drivers/scsi/ncr53c8xx.c 2011-05-22 19:36:32.000000000 -0400
39011@@ -8606,7 +8606,7 @@ static void ncr53c8xx_get_signalling(str
39012 spi_signalling(shost) = type;
39013 }
39014
39015-static struct spi_function_template ncr53c8xx_transport_functions = {
39016+static struct spi_function_template ncr53c8xx_transport_functions = {
39017 .set_period = ncr53c8xx_set_period,
39018 .show_period = 1,
39019 .set_offset = ncr53c8xx_set_offset,
39020diff -urNp linux-2.6.39.2/drivers/scsi/osd/osd_initiator.c linux-2.6.39.2/drivers/scsi/osd/osd_initiator.c
39021--- linux-2.6.39.2/drivers/scsi/osd/osd_initiator.c 2011-05-19 00:06:34.000000000 -0400
39022+++ linux-2.6.39.2/drivers/scsi/osd/osd_initiator.c 2011-05-22 19:36:32.000000000 -0400
39023@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
39024 int nelem = ARRAY_SIZE(get_attrs), a = 0;
39025 int ret;
39026
39027+ pax_track_stack();
39028+
39029 or = osd_start_request(od, GFP_KERNEL);
39030 if (!or)
39031 return -ENOMEM;
39032diff -urNp linux-2.6.39.2/drivers/scsi/pmcraid.c linux-2.6.39.2/drivers/scsi/pmcraid.c
39033--- linux-2.6.39.2/drivers/scsi/pmcraid.c 2011-05-19 00:06:34.000000000 -0400
39034+++ linux-2.6.39.2/drivers/scsi/pmcraid.c 2011-05-22 19:36:32.000000000 -0400
39035@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
39036 res->scsi_dev = scsi_dev;
39037 scsi_dev->hostdata = res;
39038 res->change_detected = 0;
39039- atomic_set(&res->read_failures, 0);
39040- atomic_set(&res->write_failures, 0);
39041+ atomic_set_unchecked(&res->read_failures, 0);
39042+ atomic_set_unchecked(&res->write_failures, 0);
39043 rc = 0;
39044 }
39045 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
39046@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct
39047
39048 /* If this was a SCSI read/write command keep count of errors */
39049 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
39050- atomic_inc(&res->read_failures);
39051+ atomic_inc_unchecked(&res->read_failures);
39052 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
39053- atomic_inc(&res->write_failures);
39054+ atomic_inc_unchecked(&res->write_failures);
39055
39056 if (!RES_IS_GSCSI(res->cfg_entry) &&
39057 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
39058@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
39059 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
39060 * hrrq_id assigned here in queuecommand
39061 */
39062- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
39063+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
39064 pinstance->num_hrrq;
39065 cmd->cmd_done = pmcraid_io_done;
39066
39067@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
39068 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
39069 * hrrq_id assigned here in queuecommand
39070 */
39071- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
39072+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
39073 pinstance->num_hrrq;
39074
39075 if (request_size) {
39076@@ -4495,7 +4495,7 @@ static void pmcraid_worker_function(stru
39077
39078 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
39079 /* add resources only after host is added into system */
39080- if (!atomic_read(&pinstance->expose_resources))
39081+ if (!atomic_read_unchecked(&pinstance->expose_resources))
39082 return;
39083
39084 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
39085@@ -5329,8 +5329,8 @@ static int __devinit pmcraid_init_instan
39086 init_waitqueue_head(&pinstance->reset_wait_q);
39087
39088 atomic_set(&pinstance->outstanding_cmds, 0);
39089- atomic_set(&pinstance->last_message_id, 0);
39090- atomic_set(&pinstance->expose_resources, 0);
39091+ atomic_set_unchecked(&pinstance->last_message_id, 0);
39092+ atomic_set_unchecked(&pinstance->expose_resources, 0);
39093
39094 INIT_LIST_HEAD(&pinstance->free_res_q);
39095 INIT_LIST_HEAD(&pinstance->used_res_q);
39096@@ -6045,7 +6045,7 @@ static int __devinit pmcraid_probe(
39097 /* Schedule worker thread to handle CCN and take care of adding and
39098 * removing devices to OS
39099 */
39100- atomic_set(&pinstance->expose_resources, 1);
39101+ atomic_set_unchecked(&pinstance->expose_resources, 1);
39102 schedule_work(&pinstance->worker_q);
39103 return rc;
39104
39105diff -urNp linux-2.6.39.2/drivers/scsi/pmcraid.h linux-2.6.39.2/drivers/scsi/pmcraid.h
39106--- linux-2.6.39.2/drivers/scsi/pmcraid.h 2011-05-19 00:06:34.000000000 -0400
39107+++ linux-2.6.39.2/drivers/scsi/pmcraid.h 2011-05-22 19:36:32.000000000 -0400
39108@@ -750,7 +750,7 @@ struct pmcraid_instance {
39109 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
39110
39111 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
39112- atomic_t last_message_id;
39113+ atomic_unchecked_t last_message_id;
39114
39115 /* configuration table */
39116 struct pmcraid_config_table *cfg_table;
39117@@ -779,7 +779,7 @@ struct pmcraid_instance {
39118 atomic_t outstanding_cmds;
39119
39120 /* should add/delete resources to mid-layer now ?*/
39121- atomic_t expose_resources;
39122+ atomic_unchecked_t expose_resources;
39123
39124
39125
39126@@ -815,8 +815,8 @@ struct pmcraid_resource_entry {
39127 struct pmcraid_config_table_entry_ext cfg_entry_ext;
39128 };
39129 struct scsi_device *scsi_dev; /* Link scsi_device structure */
39130- atomic_t read_failures; /* count of failed READ commands */
39131- atomic_t write_failures; /* count of failed WRITE commands */
39132+ atomic_unchecked_t read_failures; /* count of failed READ commands */
39133+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
39134
39135 /* To indicate add/delete/modify during CCN */
39136 u8 change_detected;
39137diff -urNp linux-2.6.39.2/drivers/scsi/qla2xxx/qla_os.c linux-2.6.39.2/drivers/scsi/qla2xxx/qla_os.c
39138--- linux-2.6.39.2/drivers/scsi/qla2xxx/qla_os.c 2011-06-03 00:04:14.000000000 -0400
39139+++ linux-2.6.39.2/drivers/scsi/qla2xxx/qla_os.c 2011-06-03 00:32:06.000000000 -0400
39140@@ -4103,7 +4103,7 @@ static struct pci_driver qla2xxx_pci_dri
39141 .err_handler = &qla2xxx_err_handler,
39142 };
39143
39144-static struct file_operations apidev_fops = {
39145+static const struct file_operations apidev_fops = {
39146 .owner = THIS_MODULE,
39147 .llseek = noop_llseek,
39148 };
39149diff -urNp linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_def.h
39150--- linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_def.h 2011-05-19 00:06:34.000000000 -0400
39151+++ linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_def.h 2011-05-22 19:36:32.000000000 -0400
39152@@ -256,7 +256,7 @@ struct ddb_entry {
39153 atomic_t retry_relogin_timer; /* Min Time between relogins
39154 * (4000 only) */
39155 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
39156- atomic_t relogin_retry_count; /* Num of times relogin has been
39157+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
39158 * retried */
39159
39160 uint16_t port;
39161diff -urNp linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_init.c
39162--- linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_init.c 2011-05-19 00:06:34.000000000 -0400
39163+++ linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_init.c 2011-05-22 19:36:32.000000000 -0400
39164@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
39165 ddb_entry->fw_ddb_index = fw_ddb_index;
39166 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
39167 atomic_set(&ddb_entry->relogin_timer, 0);
39168- atomic_set(&ddb_entry->relogin_retry_count, 0);
39169+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
39170 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
39171 list_add_tail(&ddb_entry->list, &ha->ddb_list);
39172 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
39173@@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s
39174 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
39175 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
39176 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
39177- atomic_set(&ddb_entry->relogin_retry_count, 0);
39178+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
39179 atomic_set(&ddb_entry->relogin_timer, 0);
39180 clear_bit(DF_RELOGIN, &ddb_entry->flags);
39181 iscsi_unblock_session(ddb_entry->sess);
39182diff -urNp linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_os.c
39183--- linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_os.c 2011-05-19 00:06:34.000000000 -0400
39184+++ linux-2.6.39.2/drivers/scsi/qla4xxx/ql4_os.c 2011-05-22 19:36:32.000000000 -0400
39185@@ -802,13 +802,13 @@ static void qla4xxx_timer(struct scsi_ql
39186 ddb_entry->fw_ddb_device_state ==
39187 DDB_DS_SESSION_FAILED) {
39188 /* Reset retry relogin timer */
39189- atomic_inc(&ddb_entry->relogin_retry_count);
39190+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
39191 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
39192 " timed out-retrying"
39193 " relogin (%d)\n",
39194 ha->host_no,
39195 ddb_entry->fw_ddb_index,
39196- atomic_read(&ddb_entry->
39197+ atomic_read_unchecked(&ddb_entry->
39198 relogin_retry_count))
39199 );
39200 start_dpc++;
39201diff -urNp linux-2.6.39.2/drivers/scsi/scsi.c linux-2.6.39.2/drivers/scsi/scsi.c
39202--- linux-2.6.39.2/drivers/scsi/scsi.c 2011-05-19 00:06:34.000000000 -0400
39203+++ linux-2.6.39.2/drivers/scsi/scsi.c 2011-05-22 19:36:32.000000000 -0400
39204@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
39205 unsigned long timeout;
39206 int rtn = 0;
39207
39208- atomic_inc(&cmd->device->iorequest_cnt);
39209+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
39210
39211 /* check if the device is still usable */
39212 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
39213diff -urNp linux-2.6.39.2/drivers/scsi/scsi_debug.c linux-2.6.39.2/drivers/scsi/scsi_debug.c
39214--- linux-2.6.39.2/drivers/scsi/scsi_debug.c 2011-05-19 00:06:34.000000000 -0400
39215+++ linux-2.6.39.2/drivers/scsi/scsi_debug.c 2011-05-22 19:36:32.000000000 -0400
39216@@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_
39217 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
39218 unsigned char *cmd = (unsigned char *)scp->cmnd;
39219
39220+ pax_track_stack();
39221+
39222 if ((errsts = check_readiness(scp, 1, devip)))
39223 return errsts;
39224 memset(arr, 0, sizeof(arr));
39225@@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm
39226 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
39227 unsigned char *cmd = (unsigned char *)scp->cmnd;
39228
39229+ pax_track_stack();
39230+
39231 if ((errsts = check_readiness(scp, 1, devip)))
39232 return errsts;
39233 memset(arr, 0, sizeof(arr));
39234diff -urNp linux-2.6.39.2/drivers/scsi/scsi_lib.c linux-2.6.39.2/drivers/scsi/scsi_lib.c
39235--- linux-2.6.39.2/drivers/scsi/scsi_lib.c 2011-05-19 00:06:34.000000000 -0400
39236+++ linux-2.6.39.2/drivers/scsi/scsi_lib.c 2011-05-22 19:36:32.000000000 -0400
39237@@ -1410,7 +1410,7 @@ static void scsi_kill_request(struct req
39238 shost = sdev->host;
39239 scsi_init_cmd_errh(cmd);
39240 cmd->result = DID_NO_CONNECT << 16;
39241- atomic_inc(&cmd->device->iorequest_cnt);
39242+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
39243
39244 /*
39245 * SCSI request completion path will do scsi_device_unbusy(),
39246@@ -1436,9 +1436,9 @@ static void scsi_softirq_done(struct req
39247
39248 INIT_LIST_HEAD(&cmd->eh_entry);
39249
39250- atomic_inc(&cmd->device->iodone_cnt);
39251+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
39252 if (cmd->result)
39253- atomic_inc(&cmd->device->ioerr_cnt);
39254+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
39255
39256 disposition = scsi_decide_disposition(cmd);
39257 if (disposition != SUCCESS &&
39258diff -urNp linux-2.6.39.2/drivers/scsi/scsi_sysfs.c linux-2.6.39.2/drivers/scsi/scsi_sysfs.c
39259--- linux-2.6.39.2/drivers/scsi/scsi_sysfs.c 2011-06-25 12:55:22.000000000 -0400
39260+++ linux-2.6.39.2/drivers/scsi/scsi_sysfs.c 2011-06-25 13:00:26.000000000 -0400
39261@@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev,
39262 char *buf) \
39263 { \
39264 struct scsi_device *sdev = to_scsi_device(dev); \
39265- unsigned long long count = atomic_read(&sdev->field); \
39266+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
39267 return snprintf(buf, 20, "0x%llx\n", count); \
39268 } \
39269 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
39270diff -urNp linux-2.6.39.2/drivers/scsi/scsi_transport_fc.c linux-2.6.39.2/drivers/scsi/scsi_transport_fc.c
39271--- linux-2.6.39.2/drivers/scsi/scsi_transport_fc.c 2011-05-19 00:06:34.000000000 -0400
39272+++ linux-2.6.39.2/drivers/scsi/scsi_transport_fc.c 2011-05-22 19:36:32.000000000 -0400
39273@@ -485,7 +485,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
39274 * Netlink Infrastructure
39275 */
39276
39277-static atomic_t fc_event_seq;
39278+static atomic_unchecked_t fc_event_seq;
39279
39280 /**
39281 * fc_get_event_number - Obtain the next sequential FC event number
39282@@ -498,7 +498,7 @@ static atomic_t fc_event_seq;
39283 u32
39284 fc_get_event_number(void)
39285 {
39286- return atomic_add_return(1, &fc_event_seq);
39287+ return atomic_add_return_unchecked(1, &fc_event_seq);
39288 }
39289 EXPORT_SYMBOL(fc_get_event_number);
39290
39291@@ -646,7 +646,7 @@ static __init int fc_transport_init(void
39292 {
39293 int error;
39294
39295- atomic_set(&fc_event_seq, 0);
39296+ atomic_set_unchecked(&fc_event_seq, 0);
39297
39298 error = transport_class_register(&fc_host_class);
39299 if (error)
39300@@ -836,7 +836,7 @@ static int fc_str_to_dev_loss(const char
39301 char *cp;
39302
39303 *val = simple_strtoul(buf, &cp, 0);
39304- if ((*cp && (*cp != '\n')) || (*val < 0))
39305+ if (*cp && (*cp != '\n'))
39306 return -EINVAL;
39307 /*
39308 * Check for overflow; dev_loss_tmo is u32
39309diff -urNp linux-2.6.39.2/drivers/scsi/scsi_transport_iscsi.c linux-2.6.39.2/drivers/scsi/scsi_transport_iscsi.c
39310--- linux-2.6.39.2/drivers/scsi/scsi_transport_iscsi.c 2011-05-19 00:06:34.000000000 -0400
39311+++ linux-2.6.39.2/drivers/scsi/scsi_transport_iscsi.c 2011-05-22 19:36:32.000000000 -0400
39312@@ -83,7 +83,7 @@ struct iscsi_internal {
39313 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
39314 };
39315
39316-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
39317+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
39318 static struct workqueue_struct *iscsi_eh_timer_workq;
39319
39320 /*
39321@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
39322 int err;
39323
39324 ihost = shost->shost_data;
39325- session->sid = atomic_add_return(1, &iscsi_session_nr);
39326+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
39327
39328 if (id == ISCSI_MAX_TARGET) {
39329 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
39330@@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v
39331 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
39332 ISCSI_TRANSPORT_VERSION);
39333
39334- atomic_set(&iscsi_session_nr, 0);
39335+ atomic_set_unchecked(&iscsi_session_nr, 0);
39336
39337 err = class_register(&iscsi_transport_class);
39338 if (err)
39339diff -urNp linux-2.6.39.2/drivers/scsi/scsi_transport_srp.c linux-2.6.39.2/drivers/scsi/scsi_transport_srp.c
39340--- linux-2.6.39.2/drivers/scsi/scsi_transport_srp.c 2011-05-19 00:06:34.000000000 -0400
39341+++ linux-2.6.39.2/drivers/scsi/scsi_transport_srp.c 2011-05-22 19:36:32.000000000 -0400
39342@@ -33,7 +33,7 @@
39343 #include "scsi_transport_srp_internal.h"
39344
39345 struct srp_host_attrs {
39346- atomic_t next_port_id;
39347+ atomic_unchecked_t next_port_id;
39348 };
39349 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
39350
39351@@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
39352 struct Scsi_Host *shost = dev_to_shost(dev);
39353 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
39354
39355- atomic_set(&srp_host->next_port_id, 0);
39356+ atomic_set_unchecked(&srp_host->next_port_id, 0);
39357 return 0;
39358 }
39359
39360@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
39361 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
39362 rport->roles = ids->roles;
39363
39364- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
39365+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
39366 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
39367
39368 transport_setup_device(&rport->dev);
39369diff -urNp linux-2.6.39.2/drivers/scsi/sg.c linux-2.6.39.2/drivers/scsi/sg.c
39370--- linux-2.6.39.2/drivers/scsi/sg.c 2011-05-19 00:06:34.000000000 -0400
39371+++ linux-2.6.39.2/drivers/scsi/sg.c 2011-05-22 19:36:32.000000000 -0400
39372@@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
39373 const struct file_operations * fops;
39374 };
39375
39376-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
39377+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
39378 {"allow_dio", &adio_fops},
39379 {"debug", &debug_fops},
39380 {"def_reserved_size", &dressz_fops},
39381@@ -2325,7 +2325,7 @@ sg_proc_init(void)
39382 {
39383 int k, mask;
39384 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
39385- struct sg_proc_leaf * leaf;
39386+ const struct sg_proc_leaf * leaf;
39387
39388 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
39389 if (!sg_proc_sgp)
39390diff -urNp linux-2.6.39.2/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.39.2/drivers/scsi/sym53c8xx_2/sym_glue.c
39391--- linux-2.6.39.2/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-19 00:06:34.000000000 -0400
39392+++ linux-2.6.39.2/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-22 19:36:32.000000000 -0400
39393@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
39394 int do_iounmap = 0;
39395 int do_disable_device = 1;
39396
39397+ pax_track_stack();
39398+
39399 memset(&sym_dev, 0, sizeof(sym_dev));
39400 memset(&nvram, 0, sizeof(nvram));
39401 sym_dev.pdev = pdev;
39402diff -urNp linux-2.6.39.2/drivers/scsi/vmw_pvscsi.c linux-2.6.39.2/drivers/scsi/vmw_pvscsi.c
39403--- linux-2.6.39.2/drivers/scsi/vmw_pvscsi.c 2011-05-19 00:06:34.000000000 -0400
39404+++ linux-2.6.39.2/drivers/scsi/vmw_pvscsi.c 2011-05-22 19:36:32.000000000 -0400
39405@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
39406 dma_addr_t base;
39407 unsigned i;
39408
39409+ pax_track_stack();
39410+
39411 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
39412 cmd.reqRingNumPages = adapter->req_pages;
39413 cmd.cmpRingNumPages = adapter->cmp_pages;
39414diff -urNp linux-2.6.39.2/drivers/sh/clk/cpg.c linux-2.6.39.2/drivers/sh/clk/cpg.c
39415--- linux-2.6.39.2/drivers/sh/clk/cpg.c 2011-06-03 00:04:14.000000000 -0400
39416+++ linux-2.6.39.2/drivers/sh/clk/cpg.c 2011-06-03 00:32:06.000000000 -0400
39417@@ -26,7 +26,7 @@ static void sh_clk_mstp32_disable(struct
39418 clk->enable_reg);
39419 }
39420
39421-static struct clk_ops sh_clk_mstp32_clk_ops = {
39422+static const struct clk_ops sh_clk_mstp32_clk_ops = {
39423 .enable = sh_clk_mstp32_enable,
39424 .disable = sh_clk_mstp32_disable,
39425 .recalc = followparent_recalc,
39426@@ -150,7 +150,7 @@ static void sh_clk_div6_disable(struct c
39427 __raw_writel(value, clk->enable_reg);
39428 }
39429
39430-static struct clk_ops sh_clk_div6_clk_ops = {
39431+static const struct clk_ops sh_clk_div6_clk_ops = {
39432 .recalc = sh_clk_div6_recalc,
39433 .round_rate = sh_clk_div_round_rate,
39434 .set_rate = sh_clk_div6_set_rate,
39435@@ -158,7 +158,7 @@ static struct clk_ops sh_clk_div6_clk_op
39436 .disable = sh_clk_div6_disable,
39437 };
39438
39439-static struct clk_ops sh_clk_div6_reparent_clk_ops = {
39440+static const struct clk_ops sh_clk_div6_reparent_clk_ops = {
39441 .recalc = sh_clk_div6_recalc,
39442 .round_rate = sh_clk_div_round_rate,
39443 .set_rate = sh_clk_div6_set_rate,
39444@@ -282,13 +282,13 @@ static void sh_clk_div4_disable(struct c
39445 __raw_writel(__raw_readl(clk->enable_reg) | (1 << 8), clk->enable_reg);
39446 }
39447
39448-static struct clk_ops sh_clk_div4_clk_ops = {
39449+static const struct clk_ops sh_clk_div4_clk_ops = {
39450 .recalc = sh_clk_div4_recalc,
39451 .set_rate = sh_clk_div4_set_rate,
39452 .round_rate = sh_clk_div_round_rate,
39453 };
39454
39455-static struct clk_ops sh_clk_div4_enable_clk_ops = {
39456+static const struct clk_ops sh_clk_div4_enable_clk_ops = {
39457 .recalc = sh_clk_div4_recalc,
39458 .set_rate = sh_clk_div4_set_rate,
39459 .round_rate = sh_clk_div_round_rate,
39460@@ -296,7 +296,7 @@ static struct clk_ops sh_clk_div4_enable
39461 .disable = sh_clk_div4_disable,
39462 };
39463
39464-static struct clk_ops sh_clk_div4_reparent_clk_ops = {
39465+static const struct clk_ops sh_clk_div4_reparent_clk_ops = {
39466 .recalc = sh_clk_div4_recalc,
39467 .set_rate = sh_clk_div4_set_rate,
39468 .round_rate = sh_clk_div_round_rate,
39469diff -urNp linux-2.6.39.2/drivers/spi/dw_spi.h linux-2.6.39.2/drivers/spi/dw_spi.h
39470--- linux-2.6.39.2/drivers/spi/dw_spi.h 2011-05-19 00:06:34.000000000 -0400
39471+++ linux-2.6.39.2/drivers/spi/dw_spi.h 2011-05-22 19:36:32.000000000 -0400
39472@@ -151,7 +151,7 @@ struct dw_spi {
39473 int dma_chan_done;
39474 struct device *dma_dev;
39475 dma_addr_t dma_addr; /* phy address of the Data register */
39476- struct dw_spi_dma_ops *dma_ops;
39477+ const struct dw_spi_dma_ops *dma_ops;
39478 void *dma_priv; /* platform relate info */
39479 struct pci_dev *dmac;
39480
39481diff -urNp linux-2.6.39.2/drivers/spi/dw_spi_mid.c linux-2.6.39.2/drivers/spi/dw_spi_mid.c
39482--- linux-2.6.39.2/drivers/spi/dw_spi_mid.c 2011-05-19 00:06:34.000000000 -0400
39483+++ linux-2.6.39.2/drivers/spi/dw_spi_mid.c 2011-05-22 19:36:32.000000000 -0400
39484@@ -180,7 +180,7 @@ static int mid_spi_dma_transfer(struct d
39485 return 0;
39486 }
39487
39488-static struct dw_spi_dma_ops mid_dma_ops = {
39489+static const struct dw_spi_dma_ops mid_dma_ops = {
39490 .dma_init = mid_spi_dma_init,
39491 .dma_exit = mid_spi_dma_exit,
39492 .dma_transfer = mid_spi_dma_transfer,
39493diff -urNp linux-2.6.39.2/drivers/spi/spi.c linux-2.6.39.2/drivers/spi/spi.c
39494--- linux-2.6.39.2/drivers/spi/spi.c 2011-05-19 00:06:34.000000000 -0400
39495+++ linux-2.6.39.2/drivers/spi/spi.c 2011-05-22 19:36:32.000000000 -0400
39496@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
39497 EXPORT_SYMBOL_GPL(spi_bus_unlock);
39498
39499 /* portable code must never pass more than 32 bytes */
39500-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
39501+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
39502
39503 static u8 *buf;
39504
39505diff -urNp linux-2.6.39.2/drivers/ssb/driver_pcicore.c linux-2.6.39.2/drivers/ssb/driver_pcicore.c
39506--- linux-2.6.39.2/drivers/ssb/driver_pcicore.c 2011-05-19 00:06:34.000000000 -0400
39507+++ linux-2.6.39.2/drivers/ssb/driver_pcicore.c 2011-05-22 19:36:32.000000000 -0400
39508@@ -223,7 +223,7 @@ static int ssb_pcicore_write_config(stru
39509 return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
39510 }
39511
39512-static struct pci_ops ssb_pcicore_pciops = {
39513+static const struct pci_ops ssb_pcicore_pciops = {
39514 .read = ssb_pcicore_read_config,
39515 .write = ssb_pcicore_write_config,
39516 };
39517diff -urNp linux-2.6.39.2/drivers/staging/ath6kl/os/linux/cfg80211.c linux-2.6.39.2/drivers/staging/ath6kl/os/linux/cfg80211.c
39518--- linux-2.6.39.2/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39519+++ linux-2.6.39.2/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39520@@ -1391,8 +1391,7 @@ u32 cipher_suites[] = {
39521 WLAN_CIPHER_SUITE_CCMP,
39522 };
39523
39524-static struct
39525-cfg80211_ops ar6k_cfg80211_ops = {
39526+static const struct cfg80211_ops ar6k_cfg80211_ops = {
39527 .change_virtual_intf = ar6k_cfg80211_change_iface,
39528 .add_virtual_intf = ar6k_cfg80211_add_virtual_intf,
39529 .del_virtual_intf = ar6k_cfg80211_del_virtual_intf,
39530diff -urNp linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
39531--- linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-19 00:06:34.000000000 -0400
39532+++ linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-22 19:36:32.000000000 -0400
39533@@ -857,14 +857,14 @@ static void dhd_op_if(dhd_if_t *ifp)
39534 free_netdev(ifp->net);
39535 }
39536 /* Allocate etherdev, including space for private structure */
39537- ifp->net = alloc_etherdev(sizeof(dhd));
39538+ ifp->net = alloc_etherdev(sizeof(*dhd));
39539 if (!ifp->net) {
39540 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39541 ret = -ENOMEM;
39542 }
39543 if (ret == 0) {
39544 strcpy(ifp->net->name, ifp->name);
39545- memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
39546+ memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
39547 err = dhd_net_attach(&dhd->pub, ifp->idx);
39548 if (err != 0) {
39549 DHD_ERROR(("%s: dhd_net_attach failed, "
39550@@ -1500,7 +1500,7 @@ static void dhd_ethtool_get_drvinfo(stru
39551 sprintf(info->bus_info, "%s", dev_name(&wl_cfg80211_get_sdio_func()->dev));
39552 }
39553
39554-struct ethtool_ops dhd_ethtool_ops = {
39555+const struct ethtool_ops dhd_ethtool_ops = {
39556 .get_drvinfo = dhd_ethtool_get_drvinfo
39557 };
39558
39559@@ -1923,7 +1923,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39560 strcpy(nv_path, nvram_path);
39561
39562 /* Allocate etherdev, including space for private structure */
39563- net = alloc_etherdev(sizeof(dhd));
39564+ net = alloc_etherdev(sizeof(*dhd));
39565 if (!net) {
39566 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39567 goto fail;
39568@@ -1939,7 +1939,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39569 /*
39570 * Save the dhd_info into the priv
39571 */
39572- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39573+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39574
39575 /* Set network interface name if it was provided as module parameter */
39576 if (iface_name[0]) {
39577@@ -2056,7 +2056,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39578 /*
39579 * Save the dhd_info into the priv
39580 */
39581- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39582+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39583
39584 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
39585 g_bus = bus;
39586@@ -2206,7 +2206,7 @@ dhd_iovar(dhd_pub_t *pub, int ifidx, cha
39587 return ret;
39588 }
39589
39590-static struct net_device_ops dhd_ops_pri = {
39591+static const struct net_device_ops dhd_ops_pri = {
39592 .ndo_open = dhd_open,
39593 .ndo_stop = dhd_stop,
39594 .ndo_get_stats = dhd_get_stats,
39595diff -urNp linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
39596--- linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39597+++ linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39598@@ -2109,7 +2109,7 @@ wl_cfg80211_flush_pmksa(struct wiphy *wi
39599
39600 }
39601
39602-static struct cfg80211_ops wl_cfg80211_ops = {
39603+static const struct cfg80211_ops wl_cfg80211_ops = {
39604 .change_virtual_intf = wl_cfg80211_change_iface,
39605 .scan = wl_cfg80211_scan,
39606 .set_wiphy_params = wl_cfg80211_set_wiphy_params,
39607diff -urNp linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c
39608--- linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-19 00:06:34.000000000 -0400
39609+++ linux-2.6.39.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-22 19:36:32.000000000 -0400
39610@@ -495,7 +495,7 @@ wl_iw_get_range(struct net_device *dev,
39611 list = (wl_u32_list_t *) channels;
39612
39613 dwrq->length = sizeof(struct iw_range);
39614- memset(range, 0, sizeof(range));
39615+ memset(range, 0, sizeof(*range));
39616
39617 range->min_nwid = range->max_nwid = 0;
39618
39619diff -urNp linux-2.6.39.2/drivers/staging/comedi/comedi_fops.c linux-2.6.39.2/drivers/staging/comedi/comedi_fops.c
39620--- linux-2.6.39.2/drivers/staging/comedi/comedi_fops.c 2011-05-19 00:06:34.000000000 -0400
39621+++ linux-2.6.39.2/drivers/staging/comedi/comedi_fops.c 2011-05-22 19:36:32.000000000 -0400
39622@@ -1445,7 +1445,7 @@ static void comedi_unmap(struct vm_area_
39623 mutex_unlock(&dev->mutex);
39624 }
39625
39626-static struct vm_operations_struct comedi_vm_ops = {
39627+static const struct vm_operations_struct comedi_vm_ops = {
39628 .close = comedi_unmap,
39629 };
39630
39631diff -urNp linux-2.6.39.2/drivers/staging/cx25821/cx25821-alsa.c linux-2.6.39.2/drivers/staging/cx25821/cx25821-alsa.c
39632--- linux-2.6.39.2/drivers/staging/cx25821/cx25821-alsa.c 2011-05-19 00:06:34.000000000 -0400
39633+++ linux-2.6.39.2/drivers/staging/cx25821/cx25821-alsa.c 2011-05-22 19:36:32.000000000 -0400
39634@@ -586,7 +586,7 @@ static struct page *snd_cx25821_page(str
39635 /*
39636 * operators
39637 */
39638-static struct snd_pcm_ops snd_cx25821_pcm_ops = {
39639+static const struct snd_pcm_ops snd_cx25821_pcm_ops = {
39640 .open = snd_cx25821_pcm_open,
39641 .close = snd_cx25821_close,
39642 .ioctl = snd_pcm_lib_ioctl,
39643diff -urNp linux-2.6.39.2/drivers/staging/cx25821/cx25821-i2c.c linux-2.6.39.2/drivers/staging/cx25821/cx25821-i2c.c
39644--- linux-2.6.39.2/drivers/staging/cx25821/cx25821-i2c.c 2011-05-19 00:06:34.000000000 -0400
39645+++ linux-2.6.39.2/drivers/staging/cx25821/cx25821-i2c.c 2011-05-22 19:36:32.000000000 -0400
39646@@ -282,7 +282,7 @@ static u32 cx25821_functionality(struct
39647 I2C_FUNC_SMBUS_READ_WORD_DATA | I2C_FUNC_SMBUS_WRITE_WORD_DATA;
39648 }
39649
39650-static struct i2c_algorithm cx25821_i2c_algo_template = {
39651+static const struct i2c_algorithm cx25821_i2c_algo_template = {
39652 .master_xfer = i2c_xfer,
39653 .functionality = cx25821_functionality,
39654 #ifdef NEED_ALGO_CONTROL
39655diff -urNp linux-2.6.39.2/drivers/staging/et131x/et1310_tx.c linux-2.6.39.2/drivers/staging/et131x/et1310_tx.c
39656--- linux-2.6.39.2/drivers/staging/et131x/et1310_tx.c 2011-05-19 00:06:34.000000000 -0400
39657+++ linux-2.6.39.2/drivers/staging/et131x/et1310_tx.c 2011-05-22 19:36:32.000000000 -0400
39658@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
39659 struct net_device_stats *stats = &etdev->net_stats;
39660
39661 if (tcb->flags & fMP_DEST_BROAD)
39662- atomic_inc(&etdev->Stats.brdcstxmt);
39663+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
39664 else if (tcb->flags & fMP_DEST_MULTI)
39665- atomic_inc(&etdev->Stats.multixmt);
39666+ atomic_inc_unchecked(&etdev->Stats.multixmt);
39667 else
39668- atomic_inc(&etdev->Stats.unixmt);
39669+ atomic_inc_unchecked(&etdev->Stats.unixmt);
39670
39671 if (tcb->skb) {
39672 stats->tx_bytes += tcb->skb->len;
39673diff -urNp linux-2.6.39.2/drivers/staging/et131x/et131x_adapter.h linux-2.6.39.2/drivers/staging/et131x/et131x_adapter.h
39674--- linux-2.6.39.2/drivers/staging/et131x/et131x_adapter.h 2011-05-19 00:06:34.000000000 -0400
39675+++ linux-2.6.39.2/drivers/staging/et131x/et131x_adapter.h 2011-05-22 19:36:32.000000000 -0400
39676@@ -110,11 +110,11 @@ typedef struct _ce_stats_t {
39677 * operations
39678 */
39679 u32 unircv; /* # multicast packets received */
39680- atomic_t unixmt; /* # multicast packets for Tx */
39681+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
39682 u32 multircv; /* # multicast packets received */
39683- atomic_t multixmt; /* # multicast packets for Tx */
39684+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
39685 u32 brdcstrcv; /* # broadcast packets received */
39686- atomic_t brdcstxmt; /* # broadcast packets for Tx */
39687+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
39688 u32 norcvbuf; /* # Rx packets discarded */
39689 u32 noxmtbuf; /* # Tx packets discarded */
39690
39691diff -urNp linux-2.6.39.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux-2.6.39.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
39692--- linux-2.6.39.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-19 00:06:34.000000000 -0400
39693+++ linux-2.6.39.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-22 19:36:32.000000000 -0400
39694@@ -55,7 +55,7 @@ int numofmsgbuf = 0;
39695 //
39696 // Table of entry-point routines for char device
39697 //
39698-static struct file_operations ft1000fops =
39699+static const struct file_operations ft1000fops =
39700 {
39701 .unlocked_ioctl = ft1000_ioctl,
39702 .poll = ft1000_poll_dev,
39703diff -urNp linux-2.6.39.2/drivers/staging/generic_serial/rio/rio_linux.c linux-2.6.39.2/drivers/staging/generic_serial/rio/rio_linux.c
39704--- linux-2.6.39.2/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-19 00:06:34.000000000 -0400
39705+++ linux-2.6.39.2/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-22 19:36:32.000000000 -0400
39706@@ -221,7 +221,7 @@ module_param(rio_poll, int, 0);
39707 module_param(rio_debug, int, 0644);
39708 module_param(rio_irqmask, long, 0);
39709
39710-static struct real_driver rio_real_driver = {
39711+static const struct real_driver rio_real_driver = {
39712 rio_disable_tx_interrupts,
39713 rio_enable_tx_interrupts,
39714 rio_disable_rx_interrupts,
39715diff -urNp linux-2.6.39.2/drivers/staging/generic_serial/ser_a2232.c linux-2.6.39.2/drivers/staging/generic_serial/ser_a2232.c
39716--- linux-2.6.39.2/drivers/staging/generic_serial/ser_a2232.c 2011-05-19 00:06:34.000000000 -0400
39717+++ linux-2.6.39.2/drivers/staging/generic_serial/ser_a2232.c 2011-05-22 19:36:32.000000000 -0400
39718@@ -144,7 +144,7 @@ static int a2232_open(struct tty_struct
39719 /*---------------------------------------------------------------------------
39720 * Interface from generic_serial.c back here
39721 *--------------------------------------------------------------------------*/
39722-static struct real_driver a2232_real_driver = {
39723+static const struct real_driver a2232_real_driver = {
39724 a2232_disable_tx_interrupts,
39725 a2232_enable_tx_interrupts,
39726 a2232_disable_rx_interrupts,
39727diff -urNp linux-2.6.39.2/drivers/staging/generic_serial/sx.c linux-2.6.39.2/drivers/staging/generic_serial/sx.c
39728--- linux-2.6.39.2/drivers/staging/generic_serial/sx.c 2011-05-19 00:06:34.000000000 -0400
39729+++ linux-2.6.39.2/drivers/staging/generic_serial/sx.c 2011-05-22 19:36:32.000000000 -0400
39730@@ -355,7 +355,7 @@ module_param(sx_irqmask, int, 0);
39731
39732 MODULE_LICENSE("GPL");
39733
39734-static struct real_driver sx_real_driver = {
39735+static const struct real_driver sx_real_driver = {
39736 sx_disable_tx_interrupts,
39737 sx_enable_tx_interrupts,
39738 sx_disable_rx_interrupts,
39739diff -urNp linux-2.6.39.2/drivers/staging/generic_serial/vme_scc.c linux-2.6.39.2/drivers/staging/generic_serial/vme_scc.c
39740--- linux-2.6.39.2/drivers/staging/generic_serial/vme_scc.c 2011-05-19 00:06:34.000000000 -0400
39741+++ linux-2.6.39.2/drivers/staging/generic_serial/vme_scc.c 2011-05-22 19:36:32.000000000 -0400
39742@@ -94,7 +94,7 @@ static struct scc_port scc_ports[2];
39743 * Interface from generic_serial.c back here
39744 *--------------------------------------------------------------------------*/
39745
39746-static struct real_driver scc_real_driver = {
39747+static const struct real_driver scc_real_driver = {
39748 scc_disable_tx_interrupts,
39749 scc_enable_tx_interrupts,
39750 scc_disable_rx_interrupts,
39751diff -urNp linux-2.6.39.2/drivers/staging/gma500/psb_fb.c linux-2.6.39.2/drivers/staging/gma500/psb_fb.c
39752--- linux-2.6.39.2/drivers/staging/gma500/psb_fb.c 2011-06-25 12:55:22.000000000 -0400
39753+++ linux-2.6.39.2/drivers/staging/gma500/psb_fb.c 2011-06-25 13:00:26.000000000 -0400
39754@@ -230,7 +230,7 @@ static void psbfb_vm_close(struct vm_are
39755 DRM_DEBUG("vm_close\n");
39756 }
39757
39758-static struct vm_operations_struct psbfb_vm_ops = {
39759+static const struct vm_operations_struct psbfb_vm_ops = {
39760 .fault = psbfb_vm_fault,
39761 .open = psbfb_vm_open,
39762 .close = psbfb_vm_close
39763diff -urNp linux-2.6.39.2/drivers/staging/go7007/go7007-i2c.c linux-2.6.39.2/drivers/staging/go7007/go7007-i2c.c
39764--- linux-2.6.39.2/drivers/staging/go7007/go7007-i2c.c 2011-05-19 00:06:34.000000000 -0400
39765+++ linux-2.6.39.2/drivers/staging/go7007/go7007-i2c.c 2011-05-22 19:36:32.000000000 -0400
39766@@ -198,7 +198,7 @@ static u32 go7007_functionality(struct i
39767 return I2C_FUNC_SMBUS_BYTE_DATA;
39768 }
39769
39770-static struct i2c_algorithm go7007_algo = {
39771+static const struct i2c_algorithm go7007_algo = {
39772 .smbus_xfer = go7007_smbus_xfer,
39773 .master_xfer = go7007_i2c_master_xfer,
39774 .functionality = go7007_functionality,
39775diff -urNp linux-2.6.39.2/drivers/staging/go7007/go7007-usb.c linux-2.6.39.2/drivers/staging/go7007/go7007-usb.c
39776--- linux-2.6.39.2/drivers/staging/go7007/go7007-usb.c 2011-05-19 00:06:34.000000000 -0400
39777+++ linux-2.6.39.2/drivers/staging/go7007/go7007-usb.c 2011-05-22 19:36:32.000000000 -0400
39778@@ -849,7 +849,7 @@ static int go7007_usb_send_firmware(stru
39779 &transferred, timeout);
39780 }
39781
39782-static struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39783+static const struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39784 .interface_reset = go7007_usb_interface_reset,
39785 .write_interrupt = go7007_usb_ezusb_write_interrupt,
39786 .read_interrupt = go7007_usb_read_interrupt,
39787@@ -858,7 +858,7 @@ static struct go7007_hpi_ops go7007_usb_
39788 .send_firmware = go7007_usb_send_firmware,
39789 };
39790
39791-static struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39792+static const struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39793 .interface_reset = go7007_usb_interface_reset,
39794 .write_interrupt = go7007_usb_onboard_write_interrupt,
39795 .read_interrupt = go7007_usb_read_interrupt,
39796@@ -950,7 +950,7 @@ static u32 go7007_usb_functionality(stru
39797 return (I2C_FUNC_SMBUS_EMUL) & ~I2C_FUNC_SMBUS_QUICK;
39798 }
39799
39800-static struct i2c_algorithm go7007_usb_algo = {
39801+static const struct i2c_algorithm go7007_usb_algo = {
39802 .master_xfer = go7007_usb_i2c_master_xfer,
39803 .functionality = go7007_usb_functionality,
39804 };
39805diff -urNp linux-2.6.39.2/drivers/staging/go7007/go7007-v4l2.c linux-2.6.39.2/drivers/staging/go7007/go7007-v4l2.c
39806--- linux-2.6.39.2/drivers/staging/go7007/go7007-v4l2.c 2011-05-19 00:06:34.000000000 -0400
39807+++ linux-2.6.39.2/drivers/staging/go7007/go7007-v4l2.c 2011-05-22 19:36:32.000000000 -0400
39808@@ -1672,7 +1672,7 @@ static int go7007_vm_fault(struct vm_are
39809 return 0;
39810 }
39811
39812-static struct vm_operations_struct go7007_vm_ops = {
39813+static const struct vm_operations_struct go7007_vm_ops = {
39814 .open = go7007_vm_open,
39815 .close = go7007_vm_close,
39816 .fault = go7007_vm_fault,
39817diff -urNp linux-2.6.39.2/drivers/staging/go7007/saa7134-go7007.c linux-2.6.39.2/drivers/staging/go7007/saa7134-go7007.c
39818--- linux-2.6.39.2/drivers/staging/go7007/saa7134-go7007.c 2011-05-19 00:06:34.000000000 -0400
39819+++ linux-2.6.39.2/drivers/staging/go7007/saa7134-go7007.c 2011-05-22 19:36:32.000000000 -0400
39820@@ -421,7 +421,7 @@ static int saa7134_go7007_send_command(s
39821
39822 }
39823
39824-static struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39825+static const struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39826 .interface_reset = saa7134_go7007_interface_reset,
39827 .write_interrupt = saa7134_go7007_write_interrupt,
39828 .read_interrupt = saa7134_go7007_read_interrupt,
39829diff -urNp linux-2.6.39.2/drivers/staging/go7007/snd-go7007.c linux-2.6.39.2/drivers/staging/go7007/snd-go7007.c
39830--- linux-2.6.39.2/drivers/staging/go7007/snd-go7007.c 2011-05-19 00:06:34.000000000 -0400
39831+++ linux-2.6.39.2/drivers/staging/go7007/snd-go7007.c 2011-05-22 19:36:32.000000000 -0400
39832@@ -204,7 +204,7 @@ static struct page *go7007_snd_pcm_page(
39833 return vmalloc_to_page(substream->runtime->dma_area + offset);
39834 }
39835
39836-static struct snd_pcm_ops go7007_snd_capture_ops = {
39837+static const struct snd_pcm_ops go7007_snd_capture_ops = {
39838 .open = go7007_snd_capture_open,
39839 .close = go7007_snd_capture_close,
39840 .ioctl = snd_pcm_lib_ioctl,
39841@@ -227,7 +227,7 @@ static int go7007_snd_free(struct snd_de
39842 return 0;
39843 }
39844
39845-static struct snd_device_ops go7007_snd_device_ops = {
39846+static const struct snd_device_ops go7007_snd_device_ops = {
39847 .dev_free = go7007_snd_free,
39848 };
39849
39850diff -urNp linux-2.6.39.2/drivers/staging/hv/channel.c linux-2.6.39.2/drivers/staging/hv/channel.c
39851--- linux-2.6.39.2/drivers/staging/hv/channel.c 2011-05-19 00:06:34.000000000 -0400
39852+++ linux-2.6.39.2/drivers/staging/hv/channel.c 2011-05-22 19:36:32.000000000 -0400
39853@@ -509,8 +509,8 @@ int vmbus_establish_gpadl(struct vmbus_c
39854 unsigned long flags;
39855 int ret = 0;
39856
39857- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
39858- atomic_inc(&vmbus_connection.next_gpadl_handle);
39859+ next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
39860+ atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
39861
39862 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
39863 if (ret)
39864diff -urNp linux-2.6.39.2/drivers/staging/hv/hv.c linux-2.6.39.2/drivers/staging/hv/hv.c
39865--- linux-2.6.39.2/drivers/staging/hv/hv.c 2011-05-19 00:06:34.000000000 -0400
39866+++ linux-2.6.39.2/drivers/staging/hv/hv.c 2011-05-22 19:36:32.000000000 -0400
39867@@ -163,7 +163,7 @@ static u64 do_hypercall(u64 control, voi
39868 u64 output_address = (output) ? virt_to_phys(output) : 0;
39869 u32 output_address_hi = output_address >> 32;
39870 u32 output_address_lo = output_address & 0xFFFFFFFF;
39871- volatile void *hypercall_page = hv_context.hypercall_page;
39872+ volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
39873
39874 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
39875 control, input, output);
39876diff -urNp linux-2.6.39.2/drivers/staging/hv/rndis_filter.c linux-2.6.39.2/drivers/staging/hv/rndis_filter.c
39877--- linux-2.6.39.2/drivers/staging/hv/rndis_filter.c 2011-05-19 00:06:34.000000000 -0400
39878+++ linux-2.6.39.2/drivers/staging/hv/rndis_filter.c 2011-05-22 19:36:32.000000000 -0400
39879@@ -49,7 +49,7 @@ struct rndis_device {
39880
39881 enum rndis_device_state state;
39882 u32 link_stat;
39883- atomic_t new_req_id;
39884+ atomic_unchecked_t new_req_id;
39885
39886 spinlock_t request_lock;
39887 struct list_head req_list;
39888@@ -144,7 +144,7 @@ static struct rndis_request *get_rndis_r
39889 * template
39890 */
39891 set = &rndis_msg->msg.set_req;
39892- set->req_id = atomic_inc_return(&dev->new_req_id);
39893+ set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39894
39895 /* Add to the request list */
39896 spin_lock_irqsave(&dev->request_lock, flags);
39897@@ -709,7 +709,7 @@ static void rndis_filter_halt_device(str
39898
39899 /* Setup the rndis set */
39900 halt = &request->request_msg.msg.halt_req;
39901- halt->req_id = atomic_inc_return(&dev->new_req_id);
39902+ halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39903
39904 /* Ignore return since this msg is optional. */
39905 rndis_filter_send_request(dev, request);
39906diff -urNp linux-2.6.39.2/drivers/staging/hv/vmbus_drv.c linux-2.6.39.2/drivers/staging/hv/vmbus_drv.c
39907--- linux-2.6.39.2/drivers/staging/hv/vmbus_drv.c 2011-05-19 00:06:34.000000000 -0400
39908+++ linux-2.6.39.2/drivers/staging/hv/vmbus_drv.c 2011-05-22 19:36:32.000000000 -0400
39909@@ -661,14 +661,14 @@ int vmbus_child_device_register(struct h
39910 {
39911 int ret = 0;
39912
39913- static atomic_t device_num = ATOMIC_INIT(0);
39914+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
39915
39916 DPRINT_DBG(VMBUS_DRV, "child device (%p) registering",
39917 child_device_obj);
39918
39919 /* Set the device name. Otherwise, device_register() will fail. */
39920 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
39921- atomic_inc_return(&device_num));
39922+ atomic_inc_return_unchecked(&device_num));
39923
39924 /* The new device belongs to this bus */
39925 child_device_obj->device.bus = &vmbus_drv.bus; /* device->dev.bus; */
39926diff -urNp linux-2.6.39.2/drivers/staging/hv/vmbus_private.h linux-2.6.39.2/drivers/staging/hv/vmbus_private.h
39927--- linux-2.6.39.2/drivers/staging/hv/vmbus_private.h 2011-05-19 00:06:34.000000000 -0400
39928+++ linux-2.6.39.2/drivers/staging/hv/vmbus_private.h 2011-05-22 19:36:32.000000000 -0400
39929@@ -58,7 +58,7 @@ enum vmbus_connect_state {
39930 struct vmbus_connection {
39931 enum vmbus_connect_state conn_state;
39932
39933- atomic_t next_gpadl_handle;
39934+ atomic_unchecked_t next_gpadl_handle;
39935
39936 /*
39937 * Represents channel interrupts. Each bit position represents a
39938diff -urNp linux-2.6.39.2/drivers/staging/iio/ring_generic.h linux-2.6.39.2/drivers/staging/iio/ring_generic.h
39939--- linux-2.6.39.2/drivers/staging/iio/ring_generic.h 2011-05-19 00:06:34.000000000 -0400
39940+++ linux-2.6.39.2/drivers/staging/iio/ring_generic.h 2011-05-25 16:55:27.000000000 -0400
39941@@ -134,7 +134,7 @@ struct iio_ring_buffer {
39942 struct iio_handler access_handler;
39943 struct iio_event_interface ev_int;
39944 struct iio_shared_ev_pointer shared_ev_pointer;
39945- struct iio_ring_access_funcs access;
39946+ struct iio_ring_access_funcs access;
39947 int (*preenable)(struct iio_dev *);
39948 int (*postenable)(struct iio_dev *);
39949 int (*predisable)(struct iio_dev *);
39950diff -urNp linux-2.6.39.2/drivers/staging/intel_sst/intelmid_ctrl.c linux-2.6.39.2/drivers/staging/intel_sst/intelmid_ctrl.c
39951--- linux-2.6.39.2/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-19 00:06:34.000000000 -0400
39952+++ linux-2.6.39.2/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-22 19:36:32.000000000 -0400
39953@@ -494,7 +494,7 @@ static int snd_intelmad_device_set(struc
39954 struct snd_intelmad *intelmaddata;
39955 struct snd_pmic_ops *scard_ops;
39956 int ret_val = 0, vendor, status;
39957- struct intel_sst_pcm_control *pcm_control;
39958+ const struct intel_sst_pcm_control *pcm_control;
39959
39960 pr_debug("snd_intelmad_device_set called\n");
39961
39962diff -urNp linux-2.6.39.2/drivers/staging/intel_sst/intel_sst_drv_interface.c linux-2.6.39.2/drivers/staging/intel_sst/intel_sst_drv_interface.c
39963--- linux-2.6.39.2/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-19 00:06:34.000000000 -0400
39964+++ linux-2.6.39.2/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-22 19:36:32.000000000 -0400
39965@@ -470,7 +470,7 @@ int sst_device_control(int cmd, void *ar
39966 }
39967
39968
39969-struct intel_sst_pcm_control pcm_ops = {
39970+const struct intel_sst_pcm_control pcm_ops = {
39971 .open = sst_open_pcm_stream,
39972 .device_control = sst_device_control,
39973 .close = sst_close_pcm_stream,
39974diff -urNp linux-2.6.39.2/drivers/staging/line6/capture.c linux-2.6.39.2/drivers/staging/line6/capture.c
39975--- linux-2.6.39.2/drivers/staging/line6/capture.c 2011-05-19 00:06:34.000000000 -0400
39976+++ linux-2.6.39.2/drivers/staging/line6/capture.c 2011-05-22 19:36:32.000000000 -0400
39977@@ -378,7 +378,7 @@ snd_line6_capture_pointer(struct snd_pcm
39978 }
39979
39980 /* capture operators */
39981-struct snd_pcm_ops snd_line6_capture_ops = {
39982+const struct snd_pcm_ops snd_line6_capture_ops = {
39983 .open = snd_line6_capture_open,
39984 .close = snd_line6_capture_close,
39985 .ioctl = snd_pcm_lib_ioctl,
39986diff -urNp linux-2.6.39.2/drivers/staging/line6/capture.h linux-2.6.39.2/drivers/staging/line6/capture.h
39987--- linux-2.6.39.2/drivers/staging/line6/capture.h 2011-05-19 00:06:34.000000000 -0400
39988+++ linux-2.6.39.2/drivers/staging/line6/capture.h 2011-05-22 19:36:32.000000000 -0400
39989@@ -17,7 +17,7 @@
39990 #include "driver.h"
39991 #include "pcm.h"
39992
39993-extern struct snd_pcm_ops snd_line6_capture_ops;
39994+extern const struct snd_pcm_ops snd_line6_capture_ops;
39995
39996 extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
39997 int fsize);
39998diff -urNp linux-2.6.39.2/drivers/staging/line6/midi.c linux-2.6.39.2/drivers/staging/line6/midi.c
39999--- linux-2.6.39.2/drivers/staging/line6/midi.c 2011-05-19 00:06:34.000000000 -0400
40000+++ linux-2.6.39.2/drivers/staging/line6/midi.c 2011-05-22 19:36:32.000000000 -0400
40001@@ -239,14 +239,14 @@ static void line6_midi_input_trigger(str
40002 line6->line6midi->substream_receive = 0;
40003 }
40004
40005-static struct snd_rawmidi_ops line6_midi_output_ops = {
40006+static const struct snd_rawmidi_ops line6_midi_output_ops = {
40007 .open = line6_midi_output_open,
40008 .close = line6_midi_output_close,
40009 .trigger = line6_midi_output_trigger,
40010 .drain = line6_midi_output_drain,
40011 };
40012
40013-static struct snd_rawmidi_ops line6_midi_input_ops = {
40014+static const struct snd_rawmidi_ops line6_midi_input_ops = {
40015 .open = line6_midi_input_open,
40016 .close = line6_midi_input_close,
40017 .trigger = line6_midi_input_trigger,
40018@@ -373,7 +373,7 @@ static int snd_line6_midi_free(struct sn
40019 */
40020 int line6_init_midi(struct usb_line6 *line6)
40021 {
40022- static struct snd_device_ops midi_ops = {
40023+ static const struct snd_device_ops midi_ops = {
40024 .dev_free = snd_line6_midi_free,
40025 };
40026
40027diff -urNp linux-2.6.39.2/drivers/staging/line6/pcm.c linux-2.6.39.2/drivers/staging/line6/pcm.c
40028--- linux-2.6.39.2/drivers/staging/line6/pcm.c 2011-05-19 00:06:34.000000000 -0400
40029+++ linux-2.6.39.2/drivers/staging/line6/pcm.c 2011-05-22 19:36:32.000000000 -0400
40030@@ -384,7 +384,7 @@ void line6_pcm_disconnect(struct snd_lin
40031 int line6_init_pcm(struct usb_line6 *line6,
40032 struct line6_pcm_properties *properties)
40033 {
40034- static struct snd_device_ops pcm_ops = {
40035+ static const struct snd_device_ops pcm_ops = {
40036 .dev_free = snd_line6_pcm_free,
40037 };
40038
40039diff -urNp linux-2.6.39.2/drivers/staging/line6/playback.c linux-2.6.39.2/drivers/staging/line6/playback.c
40040--- linux-2.6.39.2/drivers/staging/line6/playback.c 2011-05-19 00:06:34.000000000 -0400
40041+++ linux-2.6.39.2/drivers/staging/line6/playback.c 2011-05-22 19:36:32.000000000 -0400
40042@@ -536,7 +536,7 @@ snd_line6_playback_pointer(struct snd_pc
40043 }
40044
40045 /* playback operators */
40046-struct snd_pcm_ops snd_line6_playback_ops = {
40047+const struct snd_pcm_ops snd_line6_playback_ops = {
40048 .open = snd_line6_playback_open,
40049 .close = snd_line6_playback_close,
40050 .ioctl = snd_pcm_lib_ioctl,
40051diff -urNp linux-2.6.39.2/drivers/staging/line6/playback.h linux-2.6.39.2/drivers/staging/line6/playback.h
40052--- linux-2.6.39.2/drivers/staging/line6/playback.h 2011-05-19 00:06:34.000000000 -0400
40053+++ linux-2.6.39.2/drivers/staging/line6/playback.h 2011-05-22 19:36:32.000000000 -0400
40054@@ -27,7 +27,7 @@
40055 */
40056 #define USE_CLEAR_BUFFER_WORKAROUND 1
40057
40058-extern struct snd_pcm_ops snd_line6_playback_ops;
40059+extern const struct snd_pcm_ops snd_line6_playback_ops;
40060
40061 extern int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm);
40062 extern int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm);
40063diff -urNp linux-2.6.39.2/drivers/staging/msm/staging-devices.c linux-2.6.39.2/drivers/staging/msm/staging-devices.c
40064--- linux-2.6.39.2/drivers/staging/msm/staging-devices.c 2011-05-19 00:06:34.000000000 -0400
40065+++ linux-2.6.39.2/drivers/staging/msm/staging-devices.c 2011-05-22 19:36:32.000000000 -0400
40066@@ -211,7 +211,7 @@ static int msm_fb_lcdc_gpio_config(int o
40067 }
40068
40069
40070-static struct lcdc_platform_data lcdc_pdata = {
40071+static const struct lcdc_platform_data lcdc_pdata = {
40072 .lcdc_gpio_config = msm_fb_lcdc_gpio_config,
40073 };
40074
40075diff -urNp linux-2.6.39.2/drivers/staging/octeon/ethernet.c linux-2.6.39.2/drivers/staging/octeon/ethernet.c
40076--- linux-2.6.39.2/drivers/staging/octeon/ethernet.c 2011-05-19 00:06:34.000000000 -0400
40077+++ linux-2.6.39.2/drivers/staging/octeon/ethernet.c 2011-05-22 19:36:32.000000000 -0400
40078@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
40079 * since the RX tasklet also increments it.
40080 */
40081 #ifdef CONFIG_64BIT
40082- atomic64_add(rx_status.dropped_packets,
40083- (atomic64_t *)&priv->stats.rx_dropped);
40084+ atomic64_add_unchecked(rx_status.dropped_packets,
40085+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
40086 #else
40087- atomic_add(rx_status.dropped_packets,
40088- (atomic_t *)&priv->stats.rx_dropped);
40089+ atomic_add_unchecked(rx_status.dropped_packets,
40090+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
40091 #endif
40092 }
40093
40094diff -urNp linux-2.6.39.2/drivers/staging/octeon/ethernet-rx.c linux-2.6.39.2/drivers/staging/octeon/ethernet-rx.c
40095--- linux-2.6.39.2/drivers/staging/octeon/ethernet-rx.c 2011-05-19 00:06:34.000000000 -0400
40096+++ linux-2.6.39.2/drivers/staging/octeon/ethernet-rx.c 2011-05-22 19:36:32.000000000 -0400
40097@@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
40098 /* Increment RX stats for virtual ports */
40099 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
40100 #ifdef CONFIG_64BIT
40101- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
40102- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
40103+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
40104+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
40105 #else
40106- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
40107- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
40108+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
40109+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
40110 #endif
40111 }
40112 netif_receive_skb(skb);
40113@@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
40114 dev->name);
40115 */
40116 #ifdef CONFIG_64BIT
40117- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
40118+ atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
40119 #else
40120- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
40121+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
40122 #endif
40123 dev_kfree_skb_irq(skb);
40124 }
40125diff -urNp linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.c linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.c
40126--- linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-19 00:06:34.000000000 -0400
40127+++ linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-22 19:36:32.000000000 -0400
40128@@ -43,7 +43,7 @@ module_param(noinit, int, 0444);
40129 static int useaa = 1;
40130 module_param(useaa, int, 0444);
40131
40132-static struct dcon_platform_data *pdata;
40133+static const struct dcon_platform_data *pdata;
40134
40135 /* I2C structures */
40136
40137diff -urNp linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.h linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.h
40138--- linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-19 00:06:34.000000000 -0400
40139+++ linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-22 19:36:32.000000000 -0400
40140@@ -92,11 +92,11 @@ struct dcon_platform_data {
40141 extern irqreturn_t dcon_interrupt(int irq, void *id);
40142
40143 #ifdef CONFIG_FB_OLPC_DCON_1
40144-extern struct dcon_platform_data dcon_pdata_xo_1;
40145+extern const struct dcon_platform_data dcon_pdata_xo_1;
40146 #endif
40147
40148 #ifdef CONFIG_FB_OLPC_DCON_1_5
40149-extern struct dcon_platform_data dcon_pdata_xo_1_5;
40150+extern const struct dcon_platform_data dcon_pdata_xo_1_5;
40151 #endif
40152
40153 #endif
40154diff -urNp linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c
40155--- linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-19 00:06:34.000000000 -0400
40156+++ linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-22 19:36:32.000000000 -0400
40157@@ -185,7 +185,7 @@ static u8 dcon_read_status_xo_1_5(void)
40158 return status;
40159 }
40160
40161-struct dcon_platform_data dcon_pdata_xo_1_5 = {
40162+const struct dcon_platform_data dcon_pdata_xo_1_5 = {
40163 .init = dcon_init_xo_1_5,
40164 .bus_stabilize_wiggle = dcon_wiggle_xo_1_5,
40165 .set_dconload = dcon_set_dconload_xo_1_5,
40166diff -urNp linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
40167--- linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-19 00:06:34.000000000 -0400
40168+++ linux-2.6.39.2/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-22 19:36:32.000000000 -0400
40169@@ -196,7 +196,7 @@ static u8 dcon_read_status_xo_1(void)
40170 return status;
40171 }
40172
40173-struct dcon_platform_data dcon_pdata_xo_1 = {
40174+const struct dcon_platform_data dcon_pdata_xo_1 = {
40175 .init = dcon_init_xo_1,
40176 .bus_stabilize_wiggle = dcon_wiggle_xo_1,
40177 .set_dconload = dcon_set_dconload_1,
40178diff -urNp linux-2.6.39.2/drivers/staging/phison/phison.c linux-2.6.39.2/drivers/staging/phison/phison.c
40179--- linux-2.6.39.2/drivers/staging/phison/phison.c 2011-05-19 00:06:34.000000000 -0400
40180+++ linux-2.6.39.2/drivers/staging/phison/phison.c 2011-05-22 19:36:32.000000000 -0400
40181@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
40182 ATA_BMDMA_SHT(DRV_NAME),
40183 };
40184
40185-static struct ata_port_operations phison_ops = {
40186+static const struct ata_port_operations phison_ops = {
40187 .inherits = &ata_bmdma_port_ops,
40188 .prereset = phison_pre_reset,
40189 };
40190diff -urNp linux-2.6.39.2/drivers/staging/pohmelfs/inode.c linux-2.6.39.2/drivers/staging/pohmelfs/inode.c
40191--- linux-2.6.39.2/drivers/staging/pohmelfs/inode.c 2011-05-19 00:06:34.000000000 -0400
40192+++ linux-2.6.39.2/drivers/staging/pohmelfs/inode.c 2011-05-22 19:36:32.000000000 -0400
40193@@ -1855,7 +1855,7 @@ static int pohmelfs_fill_super(struct su
40194 mutex_init(&psb->mcache_lock);
40195 psb->mcache_root = RB_ROOT;
40196 psb->mcache_timeout = msecs_to_jiffies(5000);
40197- atomic_long_set(&psb->mcache_gen, 0);
40198+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
40199
40200 psb->trans_max_pages = 100;
40201
40202@@ -1870,7 +1870,7 @@ static int pohmelfs_fill_super(struct su
40203 INIT_LIST_HEAD(&psb->crypto_ready_list);
40204 INIT_LIST_HEAD(&psb->crypto_active_list);
40205
40206- atomic_set(&psb->trans_gen, 1);
40207+ atomic_set_unchecked(&psb->trans_gen, 1);
40208 atomic_long_set(&psb->total_inodes, 0);
40209
40210 mutex_init(&psb->state_lock);
40211diff -urNp linux-2.6.39.2/drivers/staging/pohmelfs/mcache.c linux-2.6.39.2/drivers/staging/pohmelfs/mcache.c
40212--- linux-2.6.39.2/drivers/staging/pohmelfs/mcache.c 2011-05-19 00:06:34.000000000 -0400
40213+++ linux-2.6.39.2/drivers/staging/pohmelfs/mcache.c 2011-05-22 19:36:32.000000000 -0400
40214@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
40215 m->data = data;
40216 m->start = start;
40217 m->size = size;
40218- m->gen = atomic_long_inc_return(&psb->mcache_gen);
40219+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
40220
40221 mutex_lock(&psb->mcache_lock);
40222 err = pohmelfs_mcache_insert(psb, m);
40223diff -urNp linux-2.6.39.2/drivers/staging/pohmelfs/netfs.h linux-2.6.39.2/drivers/staging/pohmelfs/netfs.h
40224--- linux-2.6.39.2/drivers/staging/pohmelfs/netfs.h 2011-05-19 00:06:34.000000000 -0400
40225+++ linux-2.6.39.2/drivers/staging/pohmelfs/netfs.h 2011-05-22 19:36:32.000000000 -0400
40226@@ -571,14 +571,14 @@ struct pohmelfs_config;
40227 struct pohmelfs_sb {
40228 struct rb_root mcache_root;
40229 struct mutex mcache_lock;
40230- atomic_long_t mcache_gen;
40231+ atomic_long_unchecked_t mcache_gen;
40232 unsigned long mcache_timeout;
40233
40234 unsigned int idx;
40235
40236 unsigned int trans_retries;
40237
40238- atomic_t trans_gen;
40239+ atomic_unchecked_t trans_gen;
40240
40241 unsigned int crypto_attached_size;
40242 unsigned int crypto_align_size;
40243diff -urNp linux-2.6.39.2/drivers/staging/pohmelfs/trans.c linux-2.6.39.2/drivers/staging/pohmelfs/trans.c
40244--- linux-2.6.39.2/drivers/staging/pohmelfs/trans.c 2011-05-19 00:06:34.000000000 -0400
40245+++ linux-2.6.39.2/drivers/staging/pohmelfs/trans.c 2011-05-22 19:36:32.000000000 -0400
40246@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
40247 int err;
40248 struct netfs_cmd *cmd = t->iovec.iov_base;
40249
40250- t->gen = atomic_inc_return(&psb->trans_gen);
40251+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
40252
40253 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
40254 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
40255diff -urNp linux-2.6.39.2/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.39.2/drivers/staging/rtl8192u/ieee80211/proc.c
40256--- linux-2.6.39.2/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-19 00:06:34.000000000 -0400
40257+++ linux-2.6.39.2/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-22 19:36:32.000000000 -0400
40258@@ -87,7 +87,7 @@ static int c_show(struct seq_file *m, vo
40259 return 0;
40260 }
40261
40262-static struct seq_operations crypto_seq_ops = {
40263+static const struct seq_operations crypto_seq_ops = {
40264 .start = c_start,
40265 .next = c_next,
40266 .stop = c_stop,
40267@@ -99,7 +99,7 @@ static int crypto_info_open(struct inode
40268 return seq_open(file, &crypto_seq_ops);
40269 }
40270
40271-static struct file_operations proc_crypto_ops = {
40272+static const struct file_operations proc_crypto_ops = {
40273 .open = crypto_info_open,
40274 .read = seq_read,
40275 .llseek = seq_lseek,
40276diff -urNp linux-2.6.39.2/drivers/staging/rtl8712/rtl871x_io.h linux-2.6.39.2/drivers/staging/rtl8712/rtl871x_io.h
40277--- linux-2.6.39.2/drivers/staging/rtl8712/rtl871x_io.h 2011-05-19 00:06:34.000000000 -0400
40278+++ linux-2.6.39.2/drivers/staging/rtl8712/rtl871x_io.h 2011-05-22 19:36:32.000000000 -0400
40279@@ -107,7 +107,7 @@ struct intf_hdl {
40280 void (*intf_hdl_unload)(u8 *priv);
40281 void (*intf_hdl_open)(u8 *priv);
40282 void (*intf_hdl_close)(u8 *priv);
40283- struct _io_ops io_ops;
40284+ const struct _io_ops io_ops;
40285 };
40286
40287 struct reg_protocol_rd {
40288diff -urNp linux-2.6.39.2/drivers/staging/solo6x10/g723.c linux-2.6.39.2/drivers/staging/solo6x10/g723.c
40289--- linux-2.6.39.2/drivers/staging/solo6x10/g723.c 2011-05-19 00:06:34.000000000 -0400
40290+++ linux-2.6.39.2/drivers/staging/solo6x10/g723.c 2011-05-22 19:36:32.000000000 -0400
40291@@ -237,7 +237,7 @@ static int snd_solo_pcm_copy(struct snd_
40292 return 0;
40293 }
40294
40295-static struct snd_pcm_ops snd_solo_pcm_ops = {
40296+static const struct snd_pcm_ops snd_solo_pcm_ops = {
40297 .open = snd_solo_pcm_open,
40298 .close = snd_solo_pcm_close,
40299 .ioctl = snd_pcm_lib_ioctl,
40300@@ -334,7 +334,7 @@ static int solo_snd_pcm_init(struct solo
40301
40302 int solo_g723_init(struct solo_dev *solo_dev)
40303 {
40304- static struct snd_device_ops ops = { NULL };
40305+ static const struct snd_device_ops ops = { NULL };
40306 struct snd_card *card;
40307 struct snd_kcontrol_new kctl;
40308 char name[32];
40309diff -urNp linux-2.6.39.2/drivers/staging/spectra/ffsport.c linux-2.6.39.2/drivers/staging/spectra/ffsport.c
40310--- linux-2.6.39.2/drivers/staging/spectra/ffsport.c 2011-05-19 00:06:34.000000000 -0400
40311+++ linux-2.6.39.2/drivers/staging/spectra/ffsport.c 2011-05-22 19:36:32.000000000 -0400
40312@@ -604,7 +604,7 @@ int GLOB_SBD_unlocked_ioctl(struct block
40313 return ret;
40314 }
40315
40316-static struct block_device_operations GLOB_SBD_ops = {
40317+static const struct block_device_operations GLOB_SBD_ops = {
40318 .owner = THIS_MODULE,
40319 .open = GLOB_SBD_open,
40320 .release = GLOB_SBD_release,
40321diff -urNp linux-2.6.39.2/drivers/staging/tm6000/tm6000-alsa.c linux-2.6.39.2/drivers/staging/tm6000/tm6000-alsa.c
40322--- linux-2.6.39.2/drivers/staging/tm6000/tm6000-alsa.c 2011-05-19 00:06:34.000000000 -0400
40323+++ linux-2.6.39.2/drivers/staging/tm6000/tm6000-alsa.c 2011-05-22 19:36:32.000000000 -0400
40324@@ -380,7 +380,7 @@ static snd_pcm_uframes_t snd_tm6000_poin
40325 /*
40326 * operators
40327 */
40328-static struct snd_pcm_ops snd_tm6000_pcm_ops = {
40329+static const struct snd_pcm_ops snd_tm6000_pcm_ops = {
40330 .open = snd_tm6000_pcm_open,
40331 .close = snd_tm6000_close,
40332 .ioctl = snd_pcm_lib_ioctl,
40333diff -urNp linux-2.6.39.2/drivers/staging/tty/istallion.c linux-2.6.39.2/drivers/staging/tty/istallion.c
40334--- linux-2.6.39.2/drivers/staging/tty/istallion.c 2011-05-19 00:06:34.000000000 -0400
40335+++ linux-2.6.39.2/drivers/staging/tty/istallion.c 2011-05-22 20:49:07.000000000 -0400
40336@@ -186,7 +186,6 @@ static struct ktermios stli_deftermios
40337 * re-used for each stats call.
40338 */
40339 static comstats_t stli_comstats;
40340-static combrd_t stli_brdstats;
40341 static struct asystats stli_cdkstats;
40342
40343 /*****************************************************************************/
40344@@ -4003,6 +4002,7 @@ out:
40345
40346 static int stli_getbrdstats(combrd_t __user *bp)
40347 {
40348+ combrd_t stli_brdstats;
40349 struct stlibrd *brdp;
40350 unsigned int i;
40351
40352@@ -4226,6 +4226,8 @@ static int stli_getportstruct(struct stl
40353 struct stliport stli_dummyport;
40354 struct stliport *portp;
40355
40356+ pax_track_stack();
40357+
40358 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
40359 return -EFAULT;
40360 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
40361@@ -4248,6 +4250,8 @@ static int stli_getbrdstruct(struct stli
40362 struct stlibrd stli_dummybrd;
40363 struct stlibrd *brdp;
40364
40365+ pax_track_stack();
40366+
40367 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
40368 return -EFAULT;
40369 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
40370diff -urNp linux-2.6.39.2/drivers/staging/tty/stallion.c linux-2.6.39.2/drivers/staging/tty/stallion.c
40371--- linux-2.6.39.2/drivers/staging/tty/stallion.c 2011-05-19 00:06:34.000000000 -0400
40372+++ linux-2.6.39.2/drivers/staging/tty/stallion.c 2011-05-22 19:36:32.000000000 -0400
40373@@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp
40374 struct stlport stl_dummyport;
40375 struct stlport *portp;
40376
40377+ pax_track_stack();
40378+
40379 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
40380 return -EFAULT;
40381 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
40382diff -urNp linux-2.6.39.2/drivers/staging/usbip/vhci.h linux-2.6.39.2/drivers/staging/usbip/vhci.h
40383--- linux-2.6.39.2/drivers/staging/usbip/vhci.h 2011-05-19 00:06:34.000000000 -0400
40384+++ linux-2.6.39.2/drivers/staging/usbip/vhci.h 2011-05-22 19:36:32.000000000 -0400
40385@@ -92,7 +92,7 @@ struct vhci_hcd {
40386 unsigned resuming:1;
40387 unsigned long re_timeout;
40388
40389- atomic_t seqnum;
40390+ atomic_unchecked_t seqnum;
40391
40392 /*
40393 * NOTE:
40394diff -urNp linux-2.6.39.2/drivers/staging/usbip/vhci_hcd.c linux-2.6.39.2/drivers/staging/usbip/vhci_hcd.c
40395--- linux-2.6.39.2/drivers/staging/usbip/vhci_hcd.c 2011-05-19 00:06:34.000000000 -0400
40396+++ linux-2.6.39.2/drivers/staging/usbip/vhci_hcd.c 2011-05-22 19:36:32.000000000 -0400
40397@@ -536,7 +536,7 @@ static void vhci_tx_urb(struct urb *urb)
40398 return;
40399 }
40400
40401- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
40402+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40403 if (priv->seqnum == 0xffff)
40404 usbip_uinfo("seqnum max\n");
40405
40406@@ -795,7 +795,7 @@ static int vhci_urb_dequeue(struct usb_h
40407 return -ENOMEM;
40408 }
40409
40410- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
40411+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40412 if (unlink->seqnum == 0xffff)
40413 usbip_uinfo("seqnum max\n");
40414
40415@@ -992,7 +992,7 @@ static int vhci_start(struct usb_hcd *hc
40416 vdev->rhport = rhport;
40417 }
40418
40419- atomic_set(&vhci->seqnum, 0);
40420+ atomic_set_unchecked(&vhci->seqnum, 0);
40421 spin_lock_init(&vhci->lock);
40422
40423
40424diff -urNp linux-2.6.39.2/drivers/staging/usbip/vhci_rx.c linux-2.6.39.2/drivers/staging/usbip/vhci_rx.c
40425--- linux-2.6.39.2/drivers/staging/usbip/vhci_rx.c 2011-05-19 00:06:34.000000000 -0400
40426+++ linux-2.6.39.2/drivers/staging/usbip/vhci_rx.c 2011-05-22 19:36:32.000000000 -0400
40427@@ -81,7 +81,7 @@ static void vhci_recv_ret_submit(struct
40428 usbip_uerr("cannot find a urb of seqnum %u\n",
40429 pdu->base.seqnum);
40430 usbip_uinfo("max seqnum %d\n",
40431- atomic_read(&the_controller->seqnum));
40432+ atomic_read_unchecked(&the_controller->seqnum));
40433 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
40434 return;
40435 }
40436diff -urNp linux-2.6.39.2/drivers/staging/vme/devices/vme_user.c linux-2.6.39.2/drivers/staging/vme/devices/vme_user.c
40437--- linux-2.6.39.2/drivers/staging/vme/devices/vme_user.c 2011-05-19 00:06:34.000000000 -0400
40438+++ linux-2.6.39.2/drivers/staging/vme/devices/vme_user.c 2011-05-22 19:36:32.000000000 -0400
40439@@ -138,7 +138,7 @@ static long vme_user_unlocked_ioctl(stru
40440 static int __devinit vme_user_probe(struct device *, int, int);
40441 static int __devexit vme_user_remove(struct device *, int, int);
40442
40443-static struct file_operations vme_user_fops = {
40444+static const struct file_operations vme_user_fops = {
40445 .open = vme_user_open,
40446 .release = vme_user_release,
40447 .read = vme_user_read,
40448diff -urNp linux-2.6.39.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c linux-2.6.39.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c
40449--- linux-2.6.39.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-19 00:06:34.000000000 -0400
40450+++ linux-2.6.39.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-22 19:36:32.000000000 -0400
40451@@ -426,7 +426,7 @@ int cyasblkdev_revalidate_disk(struct ge
40452
40453
40454 /*standard block device driver interface */
40455-static struct block_device_operations cyasblkdev_bdops = {
40456+static const struct block_device_operations cyasblkdev_bdops = {
40457 .open = cyasblkdev_blk_open,
40458 .release = cyasblkdev_blk_release,
40459 .ioctl = cyasblkdev_blk_ioctl,
40460diff -urNp linux-2.6.39.2/drivers/staging/wlags49_h2/wl_netdev.c linux-2.6.39.2/drivers/staging/wlags49_h2/wl_netdev.c
40461--- linux-2.6.39.2/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-19 00:06:34.000000000 -0400
40462+++ linux-2.6.39.2/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-22 19:36:32.000000000 -0400
40463@@ -474,7 +474,7 @@ static void wl_get_drvinfo(struct net_de
40464 }
40465 } // wl_get_drvinfo
40466
40467-static struct ethtool_ops wl_ethtool_ops = {
40468+static const struct ethtool_ops wl_ethtool_ops = {
40469 .get_drvinfo = wl_get_drvinfo,
40470 .get_link = ethtool_op_get_link,
40471 };
40472diff -urNp linux-2.6.39.2/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.39.2/drivers/staging/wlan-ng/hfa384x_usb.c
40473--- linux-2.6.39.2/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-19 00:06:34.000000000 -0400
40474+++ linux-2.6.39.2/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-22 19:36:32.000000000 -0400
40475@@ -671,7 +671,7 @@ struct usbctlx_cmd_completor {
40476 hfa384x_cmdresult_t *result;
40477 };
40478
40479-static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
40480+static inline int usbctlx_cmd_completor_fn(const struct usbctlx_completor *head)
40481 {
40482 struct usbctlx_cmd_completor *complete;
40483
40484@@ -705,7 +705,7 @@ struct usbctlx_rrid_completor {
40485 unsigned int riddatalen;
40486 };
40487
40488-static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
40489+static int usbctlx_rrid_completor_fn(const struct usbctlx_completor *head)
40490 {
40491 struct usbctlx_rrid_completor *complete;
40492 hfa384x_rridresult_t rridresult;
40493@@ -768,7 +768,7 @@ struct usbctlx_rmem_completor {
40494 };
40495 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
40496
40497-static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
40498+static int usbctlx_rmem_completor_fn(const struct usbctlx_completor *head)
40499 {
40500 usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t *) head;
40501
40502diff -urNp linux-2.6.39.2/drivers/staging/zcache/tmem.c linux-2.6.39.2/drivers/staging/zcache/tmem.c
40503--- linux-2.6.39.2/drivers/staging/zcache/tmem.c 2011-05-19 00:06:34.000000000 -0400
40504+++ linux-2.6.39.2/drivers/staging/zcache/tmem.c 2011-05-22 19:36:32.000000000 -0400
40505@@ -39,7 +39,7 @@
40506 * A tmem host implementation must use this function to register callbacks
40507 * for memory allocation.
40508 */
40509-static struct tmem_hostops tmem_hostops;
40510+static const struct tmem_hostops tmem_hostops;
40511
40512 static void tmem_objnode_tree_init(void);
40513
40514@@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h
40515 * A tmem host implementation must use this function to register
40516 * callbacks for a page-accessible memory (PAM) implementation
40517 */
40518-static struct tmem_pamops tmem_pamops;
40519+static const struct tmem_pamops tmem_pamops;
40520
40521 void tmem_register_pamops(struct tmem_pamops *m)
40522 {
40523diff -urNp linux-2.6.39.2/drivers/staging/zcache/zcache.c linux-2.6.39.2/drivers/staging/zcache/zcache.c
40524--- linux-2.6.39.2/drivers/staging/zcache/zcache.c 2011-05-19 00:06:34.000000000 -0400
40525+++ linux-2.6.39.2/drivers/staging/zcache/zcache.c 2011-05-22 19:36:32.000000000 -0400
40526@@ -882,7 +882,7 @@ static void zcache_obj_free(struct tmem_
40527 kmem_cache_free(zcache_obj_cache, obj);
40528 }
40529
40530-static struct tmem_hostops zcache_hostops = {
40531+static const struct tmem_hostops zcache_hostops = {
40532 .obj_alloc = zcache_obj_alloc,
40533 .obj_free = zcache_obj_free,
40534 .objnode_alloc = zcache_objnode_alloc,
40535@@ -987,7 +987,7 @@ static void zcache_pampd_free(void *pamp
40536 }
40537 }
40538
40539-static struct tmem_pamops zcache_pamops = {
40540+static const struct tmem_pamops zcache_pamops = {
40541 .create = zcache_pampd_create,
40542 .get_data = zcache_pampd_get_data,
40543 .free = zcache_pampd_free,
40544diff -urNp linux-2.6.39.2/drivers/target/target_core_alua.c linux-2.6.39.2/drivers/target/target_core_alua.c
40545--- linux-2.6.39.2/drivers/target/target_core_alua.c 2011-05-19 00:06:34.000000000 -0400
40546+++ linux-2.6.39.2/drivers/target/target_core_alua.c 2011-05-22 19:36:32.000000000 -0400
40547@@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_
40548 char path[ALUA_METADATA_PATH_LEN];
40549 int len;
40550
40551+ pax_track_stack();
40552+
40553 memset(path, 0, ALUA_METADATA_PATH_LEN);
40554
40555 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
40556@@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar
40557 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
40558 int len;
40559
40560+ pax_track_stack();
40561+
40562 memset(path, 0, ALUA_METADATA_PATH_LEN);
40563 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
40564
40565diff -urNp linux-2.6.39.2/drivers/target/target_core_cdb.c linux-2.6.39.2/drivers/target/target_core_cdb.c
40566--- linux-2.6.39.2/drivers/target/target_core_cdb.c 2011-05-19 00:06:34.000000000 -0400
40567+++ linux-2.6.39.2/drivers/target/target_core_cdb.c 2011-05-22 19:36:32.000000000 -0400
40568@@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
40569 int length = 0;
40570 unsigned char buf[SE_MODE_PAGE_BUF];
40571
40572+ pax_track_stack();
40573+
40574 memset(buf, 0, SE_MODE_PAGE_BUF);
40575
40576 switch (cdb[2] & 0x3f) {
40577diff -urNp linux-2.6.39.2/drivers/target/target_core_configfs.c linux-2.6.39.2/drivers/target/target_core_configfs.c
40578--- linux-2.6.39.2/drivers/target/target_core_configfs.c 2011-05-19 00:06:34.000000000 -0400
40579+++ linux-2.6.39.2/drivers/target/target_core_configfs.c 2011-05-22 19:36:32.000000000 -0400
40580@@ -1280,6 +1280,8 @@ static ssize_t target_core_dev_pr_show_a
40581 ssize_t len = 0;
40582 int reg_count = 0, prf_isid;
40583
40584+ pax_track_stack();
40585+
40586 if (!(su_dev->se_dev_ptr))
40587 return -ENODEV;
40588
40589@@ -2682,7 +2684,7 @@ static void target_core_alua_drop_tg_pt_
40590 config_item_put(item);
40591 }
40592
40593-static struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40594+static const struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40595 .make_group = &target_core_alua_create_tg_pt_gp,
40596 .drop_item = &target_core_alua_drop_tg_pt_gp,
40597 };
40598@@ -2726,7 +2728,7 @@ static void target_core_stat_rmdir(
40599 return;
40600 }
40601
40602-static struct configfs_group_operations target_core_stat_group_ops = {
40603+static const struct configfs_group_operations target_core_stat_group_ops = {
40604 .make_group = &target_core_stat_mkdir,
40605 .drop_item = &target_core_stat_rmdir,
40606 };
40607@@ -2939,7 +2941,7 @@ static void target_core_drop_subdev(
40608 mutex_unlock(&hba->hba_access_mutex);
40609 }
40610
40611-static struct configfs_group_operations target_core_hba_group_ops = {
40612+static const struct configfs_group_operations target_core_hba_group_ops = {
40613 .make_group = target_core_make_subdev,
40614 .drop_item = target_core_drop_subdev,
40615 };
40616@@ -3117,7 +3119,7 @@ static void target_core_call_delhbafromt
40617 config_item_put(item);
40618 }
40619
40620-static struct configfs_group_operations target_core_group_ops = {
40621+static const struct configfs_group_operations target_core_group_ops = {
40622 .make_group = target_core_call_addhbatotarget,
40623 .drop_item = target_core_call_delhbafromtarget,
40624 };
40625diff -urNp linux-2.6.39.2/drivers/target/target_core_fabric_configfs.c linux-2.6.39.2/drivers/target/target_core_fabric_configfs.c
40626--- linux-2.6.39.2/drivers/target/target_core_fabric_configfs.c 2011-05-19 00:06:34.000000000 -0400
40627+++ linux-2.6.39.2/drivers/target/target_core_fabric_configfs.c 2011-05-22 19:36:32.000000000 -0400
40628@@ -1174,7 +1174,7 @@ static void target_fabric_drop_wwn(
40629 config_item_put(item);
40630 }
40631
40632-static struct configfs_group_operations target_fabric_wwn_group_ops = {
40633+static const struct configfs_group_operations target_fabric_wwn_group_ops = {
40634 .make_group = target_fabric_make_wwn,
40635 .drop_item = target_fabric_drop_wwn,
40636 };
40637diff -urNp linux-2.6.39.2/drivers/target/target_core_pr.c linux-2.6.39.2/drivers/target/target_core_pr.c
40638--- linux-2.6.39.2/drivers/target/target_core_pr.c 2011-05-19 00:06:34.000000000 -0400
40639+++ linux-2.6.39.2/drivers/target/target_core_pr.c 2011-05-22 19:36:32.000000000 -0400
40640@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
40641 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
40642 u16 tpgt;
40643
40644+ pax_track_stack();
40645+
40646 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
40647 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
40648 /*
40649@@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
40650 ssize_t len = 0;
40651 int reg_count = 0;
40652
40653+ pax_track_stack();
40654+
40655 memset(buf, 0, pr_aptpl_buf_len);
40656 /*
40657 * Called to clear metadata once APTPL has been deactivated.
40658@@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
40659 char path[512];
40660 int ret;
40661
40662+ pax_track_stack();
40663+
40664 memset(iov, 0, sizeof(struct iovec));
40665 memset(path, 0, 512);
40666
40667diff -urNp linux-2.6.39.2/drivers/target/target_core_tmr.c linux-2.6.39.2/drivers/target/target_core_tmr.c
40668--- linux-2.6.39.2/drivers/target/target_core_tmr.c 2011-06-03 00:04:14.000000000 -0400
40669+++ linux-2.6.39.2/drivers/target/target_core_tmr.c 2011-06-03 00:32:07.000000000 -0400
40670@@ -263,7 +263,7 @@ int core_tmr_lun_reset(
40671 CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
40672 T_TASK(cmd)->t_task_cdbs,
40673 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40674- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40675+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40676 atomic_read(&T_TASK(cmd)->t_transport_active),
40677 atomic_read(&T_TASK(cmd)->t_transport_stop),
40678 atomic_read(&T_TASK(cmd)->t_transport_sent));
40679@@ -305,7 +305,7 @@ int core_tmr_lun_reset(
40680 DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
40681 " task: %p, t_fe_count: %d dev: %p\n", task,
40682 fe_count, dev);
40683- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40684+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40685 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
40686 flags);
40687 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40688@@ -315,7 +315,7 @@ int core_tmr_lun_reset(
40689 }
40690 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
40691 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
40692- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40693+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40694 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
40695 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40696
40697diff -urNp linux-2.6.39.2/drivers/target/target_core_transport.c linux-2.6.39.2/drivers/target/target_core_transport.c
40698--- linux-2.6.39.2/drivers/target/target_core_transport.c 2011-06-03 00:04:14.000000000 -0400
40699+++ linux-2.6.39.2/drivers/target/target_core_transport.c 2011-06-03 00:32:07.000000000 -0400
40700@@ -1681,7 +1681,7 @@ struct se_device *transport_add_device_t
40701
40702 dev->queue_depth = dev_limits->queue_depth;
40703 atomic_set(&dev->depth_left, dev->queue_depth);
40704- atomic_set(&dev->dev_ordered_id, 0);
40705+ atomic_set_unchecked(&dev->dev_ordered_id, 0);
40706
40707 se_dev_set_default_attribs(dev, dev_limits);
40708
40709@@ -1882,7 +1882,7 @@ static int transport_check_alloc_task_at
40710 * Used to determine when ORDERED commands should go from
40711 * Dormant to Active status.
40712 */
40713- cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
40714+ cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
40715 smp_mb__after_atomic_inc();
40716 DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
40717 cmd->se_ordered_id, cmd->sam_task_attr,
40718@@ -2169,7 +2169,7 @@ static void transport_generic_request_fa
40719 " t_transport_active: %d t_transport_stop: %d"
40720 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
40721 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40722- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40723+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40724 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
40725 atomic_read(&T_TASK(cmd)->t_transport_active),
40726 atomic_read(&T_TASK(cmd)->t_transport_stop),
40727@@ -2673,9 +2673,9 @@ check_depth:
40728 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
40729 atomic_set(&task->task_active, 1);
40730 atomic_set(&task->task_sent, 1);
40731- atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
40732+ atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
40733
40734- if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
40735+ if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
40736 T_TASK(cmd)->t_task_cdbs)
40737 atomic_set(&cmd->transport_sent, 1);
40738
40739@@ -5568,7 +5568,7 @@ static void transport_generic_wait_for_t
40740 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
40741 }
40742 if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
40743- atomic_read(&T_TASK(cmd)->t_transport_aborted))
40744+ atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
40745 goto remove;
40746
40747 atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
40748@@ -5797,7 +5797,7 @@ int transport_check_aborted_status(struc
40749 {
40750 int ret = 0;
40751
40752- if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
40753+ if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
40754 if (!(send_status) ||
40755 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
40756 return 1;
40757@@ -5825,7 +5825,7 @@ void transport_send_task_abort(struct se
40758 */
40759 if (cmd->data_direction == DMA_TO_DEVICE) {
40760 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
40761- atomic_inc(&T_TASK(cmd)->t_transport_aborted);
40762+ atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
40763 smp_mb__after_atomic_inc();
40764 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
40765 transport_new_cmd_failure(cmd);
40766@@ -5949,7 +5949,7 @@ static void transport_processing_shutdow
40767 CMD_TFO(cmd)->get_task_tag(cmd),
40768 T_TASK(cmd)->t_task_cdbs,
40769 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40770- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40771+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40772 atomic_read(&T_TASK(cmd)->t_transport_active),
40773 atomic_read(&T_TASK(cmd)->t_transport_stop),
40774 atomic_read(&T_TASK(cmd)->t_transport_sent));
40775diff -urNp linux-2.6.39.2/drivers/telephony/ixj.c linux-2.6.39.2/drivers/telephony/ixj.c
40776--- linux-2.6.39.2/drivers/telephony/ixj.c 2011-05-19 00:06:34.000000000 -0400
40777+++ linux-2.6.39.2/drivers/telephony/ixj.c 2011-05-22 19:36:32.000000000 -0400
40778@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
40779 bool mContinue;
40780 char *pIn, *pOut;
40781
40782+ pax_track_stack();
40783+
40784 if (!SCI_Prepare(j))
40785 return 0;
40786
40787diff -urNp linux-2.6.39.2/drivers/tty/hvc/hvc_console.h linux-2.6.39.2/drivers/tty/hvc/hvc_console.h
40788--- linux-2.6.39.2/drivers/tty/hvc/hvc_console.h 2011-05-19 00:06:34.000000000 -0400
40789+++ linux-2.6.39.2/drivers/tty/hvc/hvc_console.h 2011-05-22 19:36:32.000000000 -0400
40790@@ -82,6 +82,7 @@ extern int hvc_instantiate(uint32_t vter
40791 /* register a vterm for hvc tty operation (module_init or hotplug add) */
40792 extern struct hvc_struct * hvc_alloc(uint32_t vtermno, int data,
40793 const struct hv_ops *ops, int outbuf_size);
40794+
40795 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
40796 extern int hvc_remove(struct hvc_struct *hp);
40797
40798diff -urNp linux-2.6.39.2/drivers/tty/hvc/hvc_iucv.c linux-2.6.39.2/drivers/tty/hvc/hvc_iucv.c
40799--- linux-2.6.39.2/drivers/tty/hvc/hvc_iucv.c 2011-05-19 00:06:34.000000000 -0400
40800+++ linux-2.6.39.2/drivers/tty/hvc/hvc_iucv.c 2011-05-22 19:36:32.000000000 -0400
40801@@ -1203,7 +1203,7 @@ static int param_get_vmidfilter(char *bu
40802
40803 #define param_check_vmidfilter(name, p) __param_check(name, p, void)
40804
40805-static struct kernel_param_ops param_ops_vmidfilter = {
40806+static const struct kernel_param_ops param_ops_vmidfilter = {
40807 .set = param_set_vmidfilter,
40808 .get = param_get_vmidfilter,
40809 };
40810diff -urNp linux-2.6.39.2/drivers/tty/hvc/hvcs.c linux-2.6.39.2/drivers/tty/hvc/hvcs.c
40811--- linux-2.6.39.2/drivers/tty/hvc/hvcs.c 2011-05-19 00:06:34.000000000 -0400
40812+++ linux-2.6.39.2/drivers/tty/hvc/hvcs.c 2011-05-22 19:36:32.000000000 -0400
40813@@ -83,6 +83,7 @@
40814 #include <asm/hvcserver.h>
40815 #include <asm/uaccess.h>
40816 #include <asm/vio.h>
40817+#include <asm/local.h>
40818
40819 /*
40820 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
40821@@ -270,7 +271,7 @@ struct hvcs_struct {
40822 unsigned int index;
40823
40824 struct tty_struct *tty;
40825- int open_count;
40826+ local_t open_count;
40827
40828 /*
40829 * Used to tell the driver kernel_thread what operations need to take
40830@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st
40831
40832 spin_lock_irqsave(&hvcsd->lock, flags);
40833
40834- if (hvcsd->open_count > 0) {
40835+ if (local_read(&hvcsd->open_count) > 0) {
40836 spin_unlock_irqrestore(&hvcsd->lock, flags);
40837 printk(KERN_INFO "HVCS: vterm state unchanged. "
40838 "The hvcs device node is still in use.\n");
40839@@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *
40840 if ((retval = hvcs_partner_connect(hvcsd)))
40841 goto error_release;
40842
40843- hvcsd->open_count = 1;
40844+ local_set(&hvcsd->open_count, 1);
40845 hvcsd->tty = tty;
40846 tty->driver_data = hvcsd;
40847
40848@@ -1179,7 +1180,7 @@ fast_open:
40849
40850 spin_lock_irqsave(&hvcsd->lock, flags);
40851 kref_get(&hvcsd->kref);
40852- hvcsd->open_count++;
40853+ local_inc(&hvcsd->open_count);
40854 hvcsd->todo_mask |= HVCS_SCHED_READ;
40855 spin_unlock_irqrestore(&hvcsd->lock, flags);
40856
40857@@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct
40858 hvcsd = tty->driver_data;
40859
40860 spin_lock_irqsave(&hvcsd->lock, flags);
40861- if (--hvcsd->open_count == 0) {
40862+ if (local_dec_and_test(&hvcsd->open_count)) {
40863
40864 vio_disable_interrupts(hvcsd->vdev);
40865
40866@@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct
40867 free_irq(irq, hvcsd);
40868 kref_put(&hvcsd->kref, destroy_hvcs_struct);
40869 return;
40870- } else if (hvcsd->open_count < 0) {
40871+ } else if (local_read(&hvcsd->open_count) < 0) {
40872 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
40873 " is missmanaged.\n",
40874- hvcsd->vdev->unit_address, hvcsd->open_count);
40875+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
40876 }
40877
40878 spin_unlock_irqrestore(&hvcsd->lock, flags);
40879@@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc
40880
40881 spin_lock_irqsave(&hvcsd->lock, flags);
40882 /* Preserve this so that we know how many kref refs to put */
40883- temp_open_count = hvcsd->open_count;
40884+ temp_open_count = local_read(&hvcsd->open_count);
40885
40886 /*
40887 * Don't kref put inside the spinlock because the destruction
40888@@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc
40889 hvcsd->tty->driver_data = NULL;
40890 hvcsd->tty = NULL;
40891
40892- hvcsd->open_count = 0;
40893+ local_set(&hvcsd->open_count, 0);
40894
40895 /* This will drop any buffered data on the floor which is OK in a hangup
40896 * scenario. */
40897@@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct
40898 * the middle of a write operation? This is a crummy place to do this
40899 * but we want to keep it all in the spinlock.
40900 */
40901- if (hvcsd->open_count <= 0) {
40902+ if (local_read(&hvcsd->open_count) <= 0) {
40903 spin_unlock_irqrestore(&hvcsd->lock, flags);
40904 return -ENODEV;
40905 }
40906@@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st
40907 {
40908 struct hvcs_struct *hvcsd = tty->driver_data;
40909
40910- if (!hvcsd || hvcsd->open_count <= 0)
40911+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
40912 return 0;
40913
40914 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
40915diff -urNp linux-2.6.39.2/drivers/tty/hvc/hvc_xen.c linux-2.6.39.2/drivers/tty/hvc/hvc_xen.c
40916--- linux-2.6.39.2/drivers/tty/hvc/hvc_xen.c 2011-05-19 00:06:34.000000000 -0400
40917+++ linux-2.6.39.2/drivers/tty/hvc/hvc_xen.c 2011-05-22 19:36:32.000000000 -0400
40918@@ -123,7 +123,7 @@ static int domU_read_console(uint32_t vt
40919 return recv;
40920 }
40921
40922-static struct hv_ops domU_hvc_ops = {
40923+static const struct hv_ops domU_hvc_ops = {
40924 .get_chars = domU_read_console,
40925 .put_chars = domU_write_console,
40926 .notifier_add = notifier_add_irq,
40927@@ -149,7 +149,7 @@ static int dom0_write_console(uint32_t v
40928 return len;
40929 }
40930
40931-static struct hv_ops dom0_hvc_ops = {
40932+static const struct hv_ops dom0_hvc_ops = {
40933 .get_chars = dom0_read_console,
40934 .put_chars = dom0_write_console,
40935 .notifier_add = notifier_add_irq,
40936@@ -160,7 +160,7 @@ static struct hv_ops dom0_hvc_ops = {
40937 static int __init xen_hvc_init(void)
40938 {
40939 struct hvc_struct *hp;
40940- struct hv_ops *ops;
40941+ const struct hv_ops *ops;
40942
40943 if (!xen_pv_domain())
40944 return -ENODEV;
40945@@ -205,7 +205,7 @@ static void __exit xen_hvc_fini(void)
40946
40947 static int xen_cons_init(void)
40948 {
40949- struct hv_ops *ops;
40950+ const struct hv_ops *ops;
40951
40952 if (!xen_pv_domain())
40953 return 0;
40954diff -urNp linux-2.6.39.2/drivers/tty/ipwireless/tty.c linux-2.6.39.2/drivers/tty/ipwireless/tty.c
40955--- linux-2.6.39.2/drivers/tty/ipwireless/tty.c 2011-05-19 00:06:34.000000000 -0400
40956+++ linux-2.6.39.2/drivers/tty/ipwireless/tty.c 2011-05-22 19:36:32.000000000 -0400
40957@@ -29,6 +29,7 @@
40958 #include <linux/tty_driver.h>
40959 #include <linux/tty_flip.h>
40960 #include <linux/uaccess.h>
40961+#include <asm/local.h>
40962
40963 #include "tty.h"
40964 #include "network.h"
40965@@ -51,7 +52,7 @@ struct ipw_tty {
40966 int tty_type;
40967 struct ipw_network *network;
40968 struct tty_struct *linux_tty;
40969- int open_count;
40970+ local_t open_count;
40971 unsigned int control_lines;
40972 struct mutex ipw_tty_mutex;
40973 int tx_bytes_queued;
40974@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
40975 mutex_unlock(&tty->ipw_tty_mutex);
40976 return -ENODEV;
40977 }
40978- if (tty->open_count == 0)
40979+ if (local_read(&tty->open_count) == 0)
40980 tty->tx_bytes_queued = 0;
40981
40982- tty->open_count++;
40983+ local_inc(&tty->open_count);
40984
40985 tty->linux_tty = linux_tty;
40986 linux_tty->driver_data = tty;
40987@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
40988
40989 static void do_ipw_close(struct ipw_tty *tty)
40990 {
40991- tty->open_count--;
40992-
40993- if (tty->open_count == 0) {
40994+ if (local_dec_return(&tty->open_count) == 0) {
40995 struct tty_struct *linux_tty = tty->linux_tty;
40996
40997 if (linux_tty != NULL) {
40998@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
40999 return;
41000
41001 mutex_lock(&tty->ipw_tty_mutex);
41002- if (tty->open_count == 0) {
41003+ if (local_read(&tty->open_count) == 0) {
41004 mutex_unlock(&tty->ipw_tty_mutex);
41005 return;
41006 }
41007@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
41008 return;
41009 }
41010
41011- if (!tty->open_count) {
41012+ if (!local_read(&tty->open_count)) {
41013 mutex_unlock(&tty->ipw_tty_mutex);
41014 return;
41015 }
41016@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
41017 return -ENODEV;
41018
41019 mutex_lock(&tty->ipw_tty_mutex);
41020- if (!tty->open_count) {
41021+ if (!local_read(&tty->open_count)) {
41022 mutex_unlock(&tty->ipw_tty_mutex);
41023 return -EINVAL;
41024 }
41025@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
41026 if (!tty)
41027 return -ENODEV;
41028
41029- if (!tty->open_count)
41030+ if (!local_read(&tty->open_count))
41031 return -EINVAL;
41032
41033 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
41034@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
41035 if (!tty)
41036 return 0;
41037
41038- if (!tty->open_count)
41039+ if (!local_read(&tty->open_count))
41040 return 0;
41041
41042 return tty->tx_bytes_queued;
41043@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
41044 if (!tty)
41045 return -ENODEV;
41046
41047- if (!tty->open_count)
41048+ if (!local_read(&tty->open_count))
41049 return -EINVAL;
41050
41051 return get_control_lines(tty);
41052@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
41053 if (!tty)
41054 return -ENODEV;
41055
41056- if (!tty->open_count)
41057+ if (!local_read(&tty->open_count))
41058 return -EINVAL;
41059
41060 return set_control_lines(tty, set, clear);
41061@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
41062 if (!tty)
41063 return -ENODEV;
41064
41065- if (!tty->open_count)
41066+ if (!local_read(&tty->open_count))
41067 return -EINVAL;
41068
41069 /* FIXME: Exactly how is the tty object locked here .. */
41070@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty
41071 against a parallel ioctl etc */
41072 mutex_lock(&ttyj->ipw_tty_mutex);
41073 }
41074- while (ttyj->open_count)
41075+ while (local_read(&ttyj->open_count))
41076 do_ipw_close(ttyj);
41077 ipwireless_disassociate_network_ttys(network,
41078 ttyj->channel_idx);
41079diff -urNp linux-2.6.39.2/drivers/tty/mxser.c linux-2.6.39.2/drivers/tty/mxser.c
41080--- linux-2.6.39.2/drivers/tty/mxser.c 2011-05-19 00:06:34.000000000 -0400
41081+++ linux-2.6.39.2/drivers/tty/mxser.c 2011-05-22 19:36:32.000000000 -0400
41082@@ -2340,7 +2340,7 @@ static const struct tty_operations mxser
41083 .get_icount = mxser_get_icount,
41084 };
41085
41086-struct tty_port_operations mxser_port_ops = {
41087+const struct tty_port_operations mxser_port_ops = {
41088 .carrier_raised = mxser_carrier_raised,
41089 .dtr_rts = mxser_dtr_rts,
41090 .activate = mxser_activate,
41091diff -urNp linux-2.6.39.2/drivers/tty/n_gsm.c linux-2.6.39.2/drivers/tty/n_gsm.c
41092--- linux-2.6.39.2/drivers/tty/n_gsm.c 2011-05-19 00:06:34.000000000 -0400
41093+++ linux-2.6.39.2/drivers/tty/n_gsm.c 2011-05-22 19:36:32.000000000 -0400
41094@@ -1588,7 +1588,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
41095 return NULL;
41096 spin_lock_init(&dlci->lock);
41097 dlci->fifo = &dlci->_fifo;
41098- if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
41099+ if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
41100 kfree(dlci);
41101 return NULL;
41102 }
41103diff -urNp linux-2.6.39.2/drivers/tty/n_tty.c linux-2.6.39.2/drivers/tty/n_tty.c
41104--- linux-2.6.39.2/drivers/tty/n_tty.c 2011-05-19 00:06:34.000000000 -0400
41105+++ linux-2.6.39.2/drivers/tty/n_tty.c 2011-05-22 19:36:32.000000000 -0400
41106@@ -2122,6 +2122,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
41107 {
41108 *ops = tty_ldisc_N_TTY;
41109 ops->owner = NULL;
41110- ops->refcount = ops->flags = 0;
41111+ atomic_set(&ops->refcount, 0);
41112+ ops->flags = 0;
41113 }
41114 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
41115diff -urNp linux-2.6.39.2/drivers/tty/pty.c linux-2.6.39.2/drivers/tty/pty.c
41116--- linux-2.6.39.2/drivers/tty/pty.c 2011-05-19 00:06:34.000000000 -0400
41117+++ linux-2.6.39.2/drivers/tty/pty.c 2011-05-22 19:36:32.000000000 -0400
41118@@ -699,7 +699,18 @@ out:
41119 return retval;
41120 }
41121
41122-static struct file_operations ptmx_fops;
41123+static const struct file_operations ptmx_fops = {
41124+ .llseek = no_llseek,
41125+ .read = tty_read,
41126+ .write = tty_write,
41127+ .poll = tty_poll,
41128+ .unlocked_ioctl = tty_ioctl,
41129+ .compat_ioctl = tty_compat_ioctl,
41130+ .open = ptmx_open,
41131+ .release = tty_release,
41132+ .fasync = tty_fasync,
41133+};
41134+
41135
41136 static void __init unix98_pty_init(void)
41137 {
41138@@ -752,10 +763,6 @@ static void __init unix98_pty_init(void)
41139
41140 register_sysctl_table(pty_root_table);
41141
41142- /* Now create the /dev/ptmx special device */
41143- tty_default_fops(&ptmx_fops);
41144- ptmx_fops.open = ptmx_open;
41145-
41146 cdev_init(&ptmx_cdev, &ptmx_fops);
41147 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
41148 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
41149diff -urNp linux-2.6.39.2/drivers/tty/rocket.c linux-2.6.39.2/drivers/tty/rocket.c
41150--- linux-2.6.39.2/drivers/tty/rocket.c 2011-05-19 00:06:34.000000000 -0400
41151+++ linux-2.6.39.2/drivers/tty/rocket.c 2011-05-22 19:36:32.000000000 -0400
41152@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
41153 struct rocket_ports tmp;
41154 int board;
41155
41156+ pax_track_stack();
41157+
41158 if (!retports)
41159 return -EFAULT;
41160 memset(&tmp, 0, sizeof (tmp));
41161diff -urNp linux-2.6.39.2/drivers/tty/serial/21285.c linux-2.6.39.2/drivers/tty/serial/21285.c
41162--- linux-2.6.39.2/drivers/tty/serial/21285.c 2011-05-19 00:06:34.000000000 -0400
41163+++ linux-2.6.39.2/drivers/tty/serial/21285.c 2011-05-22 19:36:32.000000000 -0400
41164@@ -340,7 +340,7 @@ static int serial21285_verify_port(struc
41165 return ret;
41166 }
41167
41168-static struct uart_ops serial21285_ops = {
41169+static const struct uart_ops serial21285_ops = {
41170 .tx_empty = serial21285_tx_empty,
41171 .get_mctrl = serial21285_get_mctrl,
41172 .set_mctrl = serial21285_set_mctrl,
41173diff -urNp linux-2.6.39.2/drivers/tty/serial/8250.c linux-2.6.39.2/drivers/tty/serial/8250.c
41174--- linux-2.6.39.2/drivers/tty/serial/8250.c 2011-05-19 00:06:34.000000000 -0400
41175+++ linux-2.6.39.2/drivers/tty/serial/8250.c 2011-05-22 19:36:32.000000000 -0400
41176@@ -2708,7 +2708,7 @@ serial8250_type(struct uart_port *port)
41177 return uart_config[type].name;
41178 }
41179
41180-static struct uart_ops serial8250_pops = {
41181+static const struct uart_ops serial8250_pops = {
41182 .tx_empty = serial8250_tx_empty,
41183 .set_mctrl = serial8250_set_mctrl,
41184 .get_mctrl = serial8250_get_mctrl,
41185diff -urNp linux-2.6.39.2/drivers/tty/serial/altera_jtaguart.c linux-2.6.39.2/drivers/tty/serial/altera_jtaguart.c
41186--- linux-2.6.39.2/drivers/tty/serial/altera_jtaguart.c 2011-05-19 00:06:34.000000000 -0400
41187+++ linux-2.6.39.2/drivers/tty/serial/altera_jtaguart.c 2011-05-22 19:36:32.000000000 -0400
41188@@ -281,7 +281,7 @@ static int altera_jtaguart_verify_port(s
41189 /*
41190 * Define the basic serial functions we support.
41191 */
41192-static struct uart_ops altera_jtaguart_ops = {
41193+static const struct uart_ops altera_jtaguart_ops = {
41194 .tx_empty = altera_jtaguart_tx_empty,
41195 .get_mctrl = altera_jtaguart_get_mctrl,
41196 .set_mctrl = altera_jtaguart_set_mctrl,
41197diff -urNp linux-2.6.39.2/drivers/tty/serial/altera_uart.c linux-2.6.39.2/drivers/tty/serial/altera_uart.c
41198--- linux-2.6.39.2/drivers/tty/serial/altera_uart.c 2011-05-19 00:06:34.000000000 -0400
41199+++ linux-2.6.39.2/drivers/tty/serial/altera_uart.c 2011-05-22 19:36:32.000000000 -0400
41200@@ -380,7 +380,7 @@ static int altera_uart_verify_port(struc
41201 /*
41202 * Define the basic serial functions we support.
41203 */
41204-static struct uart_ops altera_uart_ops = {
41205+static const struct uart_ops altera_uart_ops = {
41206 .tx_empty = altera_uart_tx_empty,
41207 .get_mctrl = altera_uart_get_mctrl,
41208 .set_mctrl = altera_uart_set_mctrl,
41209diff -urNp linux-2.6.39.2/drivers/tty/serial/amba-pl010.c linux-2.6.39.2/drivers/tty/serial/amba-pl010.c
41210--- linux-2.6.39.2/drivers/tty/serial/amba-pl010.c 2011-05-19 00:06:34.000000000 -0400
41211+++ linux-2.6.39.2/drivers/tty/serial/amba-pl010.c 2011-05-22 19:36:32.000000000 -0400
41212@@ -529,7 +529,7 @@ static int pl010_verify_port(struct uart
41213 return ret;
41214 }
41215
41216-static struct uart_ops amba_pl010_pops = {
41217+static const struct uart_ops amba_pl010_pops = {
41218 .tx_empty = pl010_tx_empty,
41219 .set_mctrl = pl010_set_mctrl,
41220 .get_mctrl = pl010_get_mctrl,
41221diff -urNp linux-2.6.39.2/drivers/tty/serial/amba-pl011.c linux-2.6.39.2/drivers/tty/serial/amba-pl011.c
41222--- linux-2.6.39.2/drivers/tty/serial/amba-pl011.c 2011-05-19 00:06:34.000000000 -0400
41223+++ linux-2.6.39.2/drivers/tty/serial/amba-pl011.c 2011-05-22 19:36:32.000000000 -0400
41224@@ -1581,7 +1581,7 @@ static int pl010_verify_port(struct uart
41225 return ret;
41226 }
41227
41228-static struct uart_ops amba_pl011_pops = {
41229+static const struct uart_ops amba_pl011_pops = {
41230 .tx_empty = pl01x_tx_empty,
41231 .set_mctrl = pl011_set_mctrl,
41232 .get_mctrl = pl01x_get_mctrl,
41233diff -urNp linux-2.6.39.2/drivers/tty/serial/apbuart.c linux-2.6.39.2/drivers/tty/serial/apbuart.c
41234--- linux-2.6.39.2/drivers/tty/serial/apbuart.c 2011-05-19 00:06:34.000000000 -0400
41235+++ linux-2.6.39.2/drivers/tty/serial/apbuart.c 2011-05-22 19:36:32.000000000 -0400
41236@@ -328,7 +328,7 @@ static int apbuart_verify_port(struct ua
41237 return ret;
41238 }
41239
41240-static struct uart_ops grlib_apbuart_ops = {
41241+static const struct uart_ops grlib_apbuart_ops = {
41242 .tx_empty = apbuart_tx_empty,
41243 .set_mctrl = apbuart_set_mctrl,
41244 .get_mctrl = apbuart_get_mctrl,
41245diff -urNp linux-2.6.39.2/drivers/tty/serial/atmel_serial.c linux-2.6.39.2/drivers/tty/serial/atmel_serial.c
41246--- linux-2.6.39.2/drivers/tty/serial/atmel_serial.c 2011-05-19 00:06:34.000000000 -0400
41247+++ linux-2.6.39.2/drivers/tty/serial/atmel_serial.c 2011-05-22 19:36:32.000000000 -0400
41248@@ -1382,7 +1382,7 @@ atmel_ioctl(struct uart_port *port, unsi
41249
41250
41251
41252-static struct uart_ops atmel_pops = {
41253+static const struct uart_ops atmel_pops = {
41254 .tx_empty = atmel_tx_empty,
41255 .set_mctrl = atmel_set_mctrl,
41256 .get_mctrl = atmel_get_mctrl,
41257diff -urNp linux-2.6.39.2/drivers/tty/serial/bcm63xx_uart.c linux-2.6.39.2/drivers/tty/serial/bcm63xx_uart.c
41258--- linux-2.6.39.2/drivers/tty/serial/bcm63xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41259+++ linux-2.6.39.2/drivers/tty/serial/bcm63xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41260@@ -636,7 +636,7 @@ static int bcm_uart_verify_port(struct u
41261 }
41262
41263 /* serial core callbacks */
41264-static struct uart_ops bcm_uart_ops = {
41265+static const struct uart_ops bcm_uart_ops = {
41266 .tx_empty = bcm_uart_tx_empty,
41267 .get_mctrl = bcm_uart_get_mctrl,
41268 .set_mctrl = bcm_uart_set_mctrl,
41269diff -urNp linux-2.6.39.2/drivers/tty/serial/bfin_5xx.c linux-2.6.39.2/drivers/tty/serial/bfin_5xx.c
41270--- linux-2.6.39.2/drivers/tty/serial/bfin_5xx.c 2011-05-19 00:06:34.000000000 -0400
41271+++ linux-2.6.39.2/drivers/tty/serial/bfin_5xx.c 2011-05-22 19:36:32.000000000 -0400
41272@@ -1036,7 +1036,7 @@ static int bfin_kgdboc_port_startup(stru
41273 }
41274 #endif
41275
41276-static struct uart_ops bfin_serial_pops = {
41277+static const struct uart_ops bfin_serial_pops = {
41278 .tx_empty = bfin_serial_tx_empty,
41279 .set_mctrl = bfin_serial_set_mctrl,
41280 .get_mctrl = bfin_serial_get_mctrl,
41281diff -urNp linux-2.6.39.2/drivers/tty/serial/bfin_sport_uart.c linux-2.6.39.2/drivers/tty/serial/bfin_sport_uart.c
41282--- linux-2.6.39.2/drivers/tty/serial/bfin_sport_uart.c 2011-05-19 00:06:34.000000000 -0400
41283+++ linux-2.6.39.2/drivers/tty/serial/bfin_sport_uart.c 2011-05-22 19:36:32.000000000 -0400
41284@@ -571,7 +571,7 @@ static void sport_set_termios(struct uar
41285 spin_unlock_irqrestore(&up->port.lock, flags);
41286 }
41287
41288-struct uart_ops sport_uart_ops = {
41289+const struct uart_ops sport_uart_ops = {
41290 .tx_empty = sport_tx_empty,
41291 .set_mctrl = sport_set_mctrl,
41292 .get_mctrl = sport_get_mctrl,
41293diff -urNp linux-2.6.39.2/drivers/tty/serial/clps711x.c linux-2.6.39.2/drivers/tty/serial/clps711x.c
41294--- linux-2.6.39.2/drivers/tty/serial/clps711x.c 2011-05-19 00:06:34.000000000 -0400
41295+++ linux-2.6.39.2/drivers/tty/serial/clps711x.c 2011-05-22 19:36:32.000000000 -0400
41296@@ -380,7 +380,7 @@ static int clps711xuart_request_port(str
41297 return 0;
41298 }
41299
41300-static struct uart_ops clps711x_pops = {
41301+static const struct uart_ops clps711x_pops = {
41302 .tx_empty = clps711xuart_tx_empty,
41303 .set_mctrl = clps711xuart_set_mctrl_null,
41304 .get_mctrl = clps711xuart_get_mctrl,
41305diff -urNp linux-2.6.39.2/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-2.6.39.2/drivers/tty/serial/cpm_uart/cpm_uart_core.c
41306--- linux-2.6.39.2/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-19 00:06:34.000000000 -0400
41307+++ linux-2.6.39.2/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-22 19:36:32.000000000 -0400
41308@@ -1099,7 +1099,7 @@ static void cpm_put_poll_char(struct uar
41309 }
41310 #endif /* CONFIG_CONSOLE_POLL */
41311
41312-static struct uart_ops cpm_uart_pops = {
41313+static const struct uart_ops cpm_uart_pops = {
41314 .tx_empty = cpm_uart_tx_empty,
41315 .set_mctrl = cpm_uart_set_mctrl,
41316 .get_mctrl = cpm_uart_get_mctrl,
41317diff -urNp linux-2.6.39.2/drivers/tty/serial/dz.c linux-2.6.39.2/drivers/tty/serial/dz.c
41318--- linux-2.6.39.2/drivers/tty/serial/dz.c 2011-05-19 00:06:34.000000000 -0400
41319+++ linux-2.6.39.2/drivers/tty/serial/dz.c 2011-05-22 19:36:32.000000000 -0400
41320@@ -746,7 +746,7 @@ static int dz_verify_port(struct uart_po
41321 return ret;
41322 }
41323
41324-static struct uart_ops dz_ops = {
41325+static const struct uart_ops dz_ops = {
41326 .tx_empty = dz_tx_empty,
41327 .get_mctrl = dz_get_mctrl,
41328 .set_mctrl = dz_set_mctrl,
41329diff -urNp linux-2.6.39.2/drivers/tty/serial/imx.c linux-2.6.39.2/drivers/tty/serial/imx.c
41330--- linux-2.6.39.2/drivers/tty/serial/imx.c 2011-05-19 00:06:34.000000000 -0400
41331+++ linux-2.6.39.2/drivers/tty/serial/imx.c 2011-05-22 19:36:32.000000000 -0400
41332@@ -1018,7 +1018,7 @@ imx_verify_port(struct uart_port *port,
41333 return ret;
41334 }
41335
41336-static struct uart_ops imx_pops = {
41337+static const struct uart_ops imx_pops = {
41338 .tx_empty = imx_tx_empty,
41339 .set_mctrl = imx_set_mctrl,
41340 .get_mctrl = imx_get_mctrl,
41341diff -urNp linux-2.6.39.2/drivers/tty/serial/ioc3_serial.c linux-2.6.39.2/drivers/tty/serial/ioc3_serial.c
41342--- linux-2.6.39.2/drivers/tty/serial/ioc3_serial.c 2011-05-19 00:06:34.000000000 -0400
41343+++ linux-2.6.39.2/drivers/tty/serial/ioc3_serial.c 2011-05-22 19:36:32.000000000 -0400
41344@@ -1874,7 +1874,7 @@ static int ic3_request_port(struct uart_
41345 }
41346
41347 /* Associate the uart functions above - given to serial core */
41348-static struct uart_ops ioc3_ops = {
41349+static const struct uart_ops ioc3_ops = {
41350 .tx_empty = ic3_tx_empty,
41351 .set_mctrl = ic3_set_mctrl,
41352 .get_mctrl = ic3_get_mctrl,
41353diff -urNp linux-2.6.39.2/drivers/tty/serial/ioc4_serial.c linux-2.6.39.2/drivers/tty/serial/ioc4_serial.c
41354--- linux-2.6.39.2/drivers/tty/serial/ioc4_serial.c 2011-05-19 00:06:34.000000000 -0400
41355+++ linux-2.6.39.2/drivers/tty/serial/ioc4_serial.c 2011-05-22 19:36:32.000000000 -0400
41356@@ -2593,7 +2593,7 @@ static int ic4_request_port(struct uart_
41357
41358 /* Associate the uart functions above - given to serial core */
41359
41360-static struct uart_ops ioc4_ops = {
41361+static const struct uart_ops ioc4_ops = {
41362 .tx_empty = ic4_tx_empty,
41363 .set_mctrl = ic4_set_mctrl,
41364 .get_mctrl = ic4_get_mctrl,
41365diff -urNp linux-2.6.39.2/drivers/tty/serial/ip22zilog.c linux-2.6.39.2/drivers/tty/serial/ip22zilog.c
41366--- linux-2.6.39.2/drivers/tty/serial/ip22zilog.c 2011-05-19 00:06:34.000000000 -0400
41367+++ linux-2.6.39.2/drivers/tty/serial/ip22zilog.c 2011-05-22 19:36:32.000000000 -0400
41368@@ -928,7 +928,7 @@ static int ip22zilog_verify_port(struct
41369 return -EINVAL;
41370 }
41371
41372-static struct uart_ops ip22zilog_pops = {
41373+static const struct uart_ops ip22zilog_pops = {
41374 .tx_empty = ip22zilog_tx_empty,
41375 .set_mctrl = ip22zilog_set_mctrl,
41376 .get_mctrl = ip22zilog_get_mctrl,
41377diff -urNp linux-2.6.39.2/drivers/tty/serial/kgdboc.c linux-2.6.39.2/drivers/tty/serial/kgdboc.c
41378--- linux-2.6.39.2/drivers/tty/serial/kgdboc.c 2011-05-19 00:06:34.000000000 -0400
41379+++ linux-2.6.39.2/drivers/tty/serial/kgdboc.c 2011-05-22 19:36:32.000000000 -0400
41380@@ -22,7 +22,7 @@
41381
41382 #define MAX_CONFIG_LEN 40
41383
41384-static struct kgdb_io kgdboc_io_ops;
41385+static struct kgdb_io kgdboc_io_ops; /* cannot be const, see configure_kgdboc() */
41386
41387 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
41388 static int configured = -1;
41389@@ -293,7 +293,7 @@ static void kgdboc_post_exp_handler(void
41390 kgdboc_restore_input();
41391 }
41392
41393-static struct kgdb_io kgdboc_io_ops = {
41394+static struct kgdb_io kgdboc_io_ops = { /* cannot be const, see configure_kgdboc() */
41395 .name = "kgdboc",
41396 .read_char = kgdboc_get_char,
41397 .write_char = kgdboc_put_char,
41398diff -urNp linux-2.6.39.2/drivers/tty/serial/m32r_sio.c linux-2.6.39.2/drivers/tty/serial/m32r_sio.c
41399--- linux-2.6.39.2/drivers/tty/serial/m32r_sio.c 2011-05-19 00:06:34.000000000 -0400
41400+++ linux-2.6.39.2/drivers/tty/serial/m32r_sio.c 2011-05-22 19:36:32.000000000 -0400
41401@@ -939,7 +939,7 @@ m32r_sio_type(struct uart_port *port)
41402 return uart_config[type].name;
41403 }
41404
41405-static struct uart_ops m32r_sio_pops = {
41406+static const struct uart_ops m32r_sio_pops = {
41407 .tx_empty = m32r_sio_tx_empty,
41408 .set_mctrl = m32r_sio_set_mctrl,
41409 .get_mctrl = m32r_sio_get_mctrl,
41410diff -urNp linux-2.6.39.2/drivers/tty/serial/max3100.c linux-2.6.39.2/drivers/tty/serial/max3100.c
41411--- linux-2.6.39.2/drivers/tty/serial/max3100.c 2011-05-19 00:06:34.000000000 -0400
41412+++ linux-2.6.39.2/drivers/tty/serial/max3100.c 2011-05-22 19:36:32.000000000 -0400
41413@@ -710,7 +710,7 @@ static void max3100_break_ctl(struct uar
41414 dev_dbg(&s->spi->dev, "%s\n", __func__);
41415 }
41416
41417-static struct uart_ops max3100_ops = {
41418+static const struct uart_ops max3100_ops = {
41419 .tx_empty = max3100_tx_empty,
41420 .set_mctrl = max3100_set_mctrl,
41421 .get_mctrl = max3100_get_mctrl,
41422diff -urNp linux-2.6.39.2/drivers/tty/serial/max3107.c linux-2.6.39.2/drivers/tty/serial/max3107.c
41423--- linux-2.6.39.2/drivers/tty/serial/max3107.c 2011-05-19 00:06:34.000000000 -0400
41424+++ linux-2.6.39.2/drivers/tty/serial/max3107.c 2011-05-22 19:36:32.000000000 -0400
41425@@ -910,7 +910,7 @@ static void max3107_break_ctl(struct uar
41426
41427
41428 /* Port functions */
41429-static struct uart_ops max3107_ops = {
41430+static const struct uart_ops max3107_ops = {
41431 .tx_empty = max3107_tx_empty,
41432 .set_mctrl = max3107_set_mctrl,
41433 .get_mctrl = max3107_get_mctrl,
41434diff -urNp linux-2.6.39.2/drivers/tty/serial/mfd.c linux-2.6.39.2/drivers/tty/serial/mfd.c
41435--- linux-2.6.39.2/drivers/tty/serial/mfd.c 2011-05-19 00:06:34.000000000 -0400
41436+++ linux-2.6.39.2/drivers/tty/serial/mfd.c 2011-05-22 19:36:32.000000000 -0400
41437@@ -1178,7 +1178,7 @@ static struct console serial_hsu_console
41438 };
41439 #endif
41440
41441-struct uart_ops serial_hsu_pops = {
41442+const struct uart_ops serial_hsu_pops = {
41443 .tx_empty = serial_hsu_tx_empty,
41444 .set_mctrl = serial_hsu_set_mctrl,
41445 .get_mctrl = serial_hsu_get_mctrl,
41446diff -urNp linux-2.6.39.2/drivers/tty/serial/mpc52xx_uart.c linux-2.6.39.2/drivers/tty/serial/mpc52xx_uart.c
41447--- linux-2.6.39.2/drivers/tty/serial/mpc52xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41448+++ linux-2.6.39.2/drivers/tty/serial/mpc52xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41449@@ -283,7 +283,7 @@ static irqreturn_t mpc52xx_psc_handle_ir
41450 return mpc5xxx_uart_process_int(port);
41451 }
41452
41453-static struct psc_ops mpc52xx_psc_ops = {
41454+static const struct psc_ops mpc52xx_psc_ops = {
41455 .fifo_init = mpc52xx_psc_fifo_init,
41456 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41457 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41458@@ -304,7 +304,7 @@ static struct psc_ops mpc52xx_psc_ops =
41459 .handle_irq = mpc52xx_psc_handle_irq,
41460 };
41461
41462-static struct psc_ops mpc5200b_psc_ops = {
41463+static const struct psc_ops mpc5200b_psc_ops = {
41464 .fifo_init = mpc52xx_psc_fifo_init,
41465 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41466 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41467@@ -571,7 +571,7 @@ static void mpc512x_psc_get_irq(struct u
41468 port->irq = psc_fifoc_irq;
41469 }
41470
41471-static struct psc_ops mpc512x_psc_ops = {
41472+static const struct psc_ops mpc512x_psc_ops = {
41473 .fifo_init = mpc512x_psc_fifo_init,
41474 .raw_rx_rdy = mpc512x_psc_raw_rx_rdy,
41475 .raw_tx_rdy = mpc512x_psc_raw_tx_rdy,
41476@@ -596,7 +596,7 @@ static struct psc_ops mpc512x_psc_ops =
41477 };
41478 #endif
41479
41480-static struct psc_ops *psc_ops;
41481+static const struct psc_ops *psc_ops;
41482
41483 /* ======================================================================== */
41484 /* UART operations */
41485@@ -905,7 +905,7 @@ mpc52xx_uart_verify_port(struct uart_por
41486 }
41487
41488
41489-static struct uart_ops mpc52xx_uart_ops = {
41490+static const struct uart_ops mpc52xx_uart_ops = {
41491 .tx_empty = mpc52xx_uart_tx_empty,
41492 .set_mctrl = mpc52xx_uart_set_mctrl,
41493 .get_mctrl = mpc52xx_uart_get_mctrl,
41494diff -urNp linux-2.6.39.2/drivers/tty/serial/mpsc.c linux-2.6.39.2/drivers/tty/serial/mpsc.c
41495--- linux-2.6.39.2/drivers/tty/serial/mpsc.c 2011-05-19 00:06:34.000000000 -0400
41496+++ linux-2.6.39.2/drivers/tty/serial/mpsc.c 2011-05-22 19:36:32.000000000 -0400
41497@@ -1663,7 +1663,7 @@ static void mpsc_put_poll_char(struct ua
41498 }
41499 #endif
41500
41501-static struct uart_ops mpsc_pops = {
41502+static const struct uart_ops mpsc_pops = {
41503 .tx_empty = mpsc_tx_empty,
41504 .set_mctrl = mpsc_set_mctrl,
41505 .get_mctrl = mpsc_get_mctrl,
41506diff -urNp linux-2.6.39.2/drivers/tty/serial/mrst_max3110.c linux-2.6.39.2/drivers/tty/serial/mrst_max3110.c
41507--- linux-2.6.39.2/drivers/tty/serial/mrst_max3110.c 2011-05-19 00:06:34.000000000 -0400
41508+++ linux-2.6.39.2/drivers/tty/serial/mrst_max3110.c 2011-05-22 19:36:32.000000000 -0400
41509@@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
41510 int loop = 1, num, total = 0;
41511 u8 recv_buf[512], *pbuf;
41512
41513+ pax_track_stack();
41514+
41515 pbuf = recv_buf;
41516 do {
41517 num = max3110_read_multi(max, pbuf);
41518@@ -726,7 +728,7 @@ static void serial_m3110_enable_ms(struc
41519 {
41520 }
41521
41522-struct uart_ops serial_m3110_ops = {
41523+const struct uart_ops serial_m3110_ops = {
41524 .tx_empty = serial_m3110_tx_empty,
41525 .set_mctrl = serial_m3110_set_mctrl,
41526 .get_mctrl = serial_m3110_get_mctrl,
41527diff -urNp linux-2.6.39.2/drivers/tty/serial/msm_serial.c linux-2.6.39.2/drivers/tty/serial/msm_serial.c
41528--- linux-2.6.39.2/drivers/tty/serial/msm_serial.c 2011-05-19 00:06:34.000000000 -0400
41529+++ linux-2.6.39.2/drivers/tty/serial/msm_serial.c 2011-05-22 19:36:32.000000000 -0400
41530@@ -702,7 +702,7 @@ static void msm_power(struct uart_port *
41531 }
41532 }
41533
41534-static struct uart_ops msm_uart_pops = {
41535+static const struct uart_ops msm_uart_pops = {
41536 .tx_empty = msm_tx_empty,
41537 .set_mctrl = msm_set_mctrl,
41538 .get_mctrl = msm_get_mctrl,
41539diff -urNp linux-2.6.39.2/drivers/tty/serial/msm_serial_hs.c linux-2.6.39.2/drivers/tty/serial/msm_serial_hs.c
41540--- linux-2.6.39.2/drivers/tty/serial/msm_serial_hs.c 2011-05-19 00:06:34.000000000 -0400
41541+++ linux-2.6.39.2/drivers/tty/serial/msm_serial_hs.c 2011-05-22 19:36:32.000000000 -0400
41542@@ -360,7 +360,7 @@ struct msm_hs_port {
41543 static struct msm_hs_port q_uart_port[UARTDM_NR];
41544 static struct platform_driver msm_serial_hs_platform_driver;
41545 static struct uart_driver msm_hs_driver;
41546-static struct uart_ops msm_hs_ops;
41547+static const struct uart_ops msm_hs_ops;
41548 static struct workqueue_struct *msm_hs_workqueue;
41549
41550 #define UARTDM_TO_MSM(uart_port) \
41551@@ -1856,7 +1856,7 @@ static struct uart_driver msm_hs_driver
41552 .cons = 0,
41553 };
41554
41555-static struct uart_ops msm_hs_ops = {
41556+static const struct uart_ops msm_hs_ops = {
41557 .tx_empty = msm_hs_tx_empty,
41558 .set_mctrl = msm_hs_set_mctrl_locked,
41559 .get_mctrl = msm_hs_get_mctrl_locked,
41560diff -urNp linux-2.6.39.2/drivers/tty/serial/mux.c linux-2.6.39.2/drivers/tty/serial/mux.c
41561--- linux-2.6.39.2/drivers/tty/serial/mux.c 2011-05-19 00:06:34.000000000 -0400
41562+++ linux-2.6.39.2/drivers/tty/serial/mux.c 2011-05-22 19:36:32.000000000 -0400
41563@@ -442,7 +442,7 @@ static struct console mux_console = {
41564 #define MUX_CONSOLE NULL
41565 #endif
41566
41567-static struct uart_ops mux_pops = {
41568+static const struct uart_ops mux_pops = {
41569 .tx_empty = mux_tx_empty,
41570 .set_mctrl = mux_set_mctrl,
41571 .get_mctrl = mux_get_mctrl,
41572diff -urNp linux-2.6.39.2/drivers/tty/serial/mxs-auart.c linux-2.6.39.2/drivers/tty/serial/mxs-auart.c
41573--- linux-2.6.39.2/drivers/tty/serial/mxs-auart.c 2011-05-19 00:06:34.000000000 -0400
41574+++ linux-2.6.39.2/drivers/tty/serial/mxs-auart.c 2011-05-22 19:36:32.000000000 -0400
41575@@ -499,7 +499,7 @@ static void mxs_auart_enable_ms(struct u
41576 /* just empty */
41577 }
41578
41579-static struct uart_ops mxs_auart_ops = {
41580+static const struct uart_ops mxs_auart_ops = {
41581 .tx_empty = mxs_auart_tx_empty,
41582 .start_tx = mxs_auart_start_tx,
41583 .stop_tx = mxs_auart_stop_tx,
41584diff -urNp linux-2.6.39.2/drivers/tty/serial/netx-serial.c linux-2.6.39.2/drivers/tty/serial/netx-serial.c
41585--- linux-2.6.39.2/drivers/tty/serial/netx-serial.c 2011-05-19 00:06:34.000000000 -0400
41586+++ linux-2.6.39.2/drivers/tty/serial/netx-serial.c 2011-05-22 19:36:32.000000000 -0400
41587@@ -464,7 +464,7 @@ netx_verify_port(struct uart_port *port,
41588 return ret;
41589 }
41590
41591-static struct uart_ops netx_pops = {
41592+static const struct uart_ops netx_pops = {
41593 .tx_empty = netx_tx_empty,
41594 .set_mctrl = netx_set_mctrl,
41595 .get_mctrl = netx_get_mctrl,
41596diff -urNp linux-2.6.39.2/drivers/tty/serial/nwpserial.c linux-2.6.39.2/drivers/tty/serial/nwpserial.c
41597--- linux-2.6.39.2/drivers/tty/serial/nwpserial.c 2011-05-19 00:06:34.000000000 -0400
41598+++ linux-2.6.39.2/drivers/tty/serial/nwpserial.c 2011-05-22 19:36:32.000000000 -0400
41599@@ -303,7 +303,7 @@ static unsigned int nwpserial_tx_empty(s
41600 return ret & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
41601 }
41602
41603-static struct uart_ops nwpserial_pops = {
41604+static const struct uart_ops nwpserial_pops = {
41605 .tx_empty = nwpserial_tx_empty,
41606 .set_mctrl = nwpserial_set_mctrl,
41607 .get_mctrl = nwpserial_get_mctrl,
41608diff -urNp linux-2.6.39.2/drivers/tty/serial/omap-serial.c linux-2.6.39.2/drivers/tty/serial/omap-serial.c
41609--- linux-2.6.39.2/drivers/tty/serial/omap-serial.c 2011-05-19 00:06:34.000000000 -0400
41610+++ linux-2.6.39.2/drivers/tty/serial/omap-serial.c 2011-05-22 19:36:32.000000000 -0400
41611@@ -1029,7 +1029,7 @@ static inline void serial_omap_add_conso
41612
41613 #endif
41614
41615-static struct uart_ops serial_omap_pops = {
41616+static const struct uart_ops serial_omap_pops = {
41617 .tx_empty = serial_omap_tx_empty,
41618 .set_mctrl = serial_omap_set_mctrl,
41619 .get_mctrl = serial_omap_get_mctrl,
41620diff -urNp linux-2.6.39.2/drivers/tty/serial/pch_uart.c linux-2.6.39.2/drivers/tty/serial/pch_uart.c
41621--- linux-2.6.39.2/drivers/tty/serial/pch_uart.c 2011-05-19 00:06:34.000000000 -0400
41622+++ linux-2.6.39.2/drivers/tty/serial/pch_uart.c 2011-05-22 19:36:32.000000000 -0400
41623@@ -1351,7 +1351,7 @@ static int pch_uart_verify_port(struct u
41624 return 0;
41625 }
41626
41627-static struct uart_ops pch_uart_ops = {
41628+static const struct uart_ops pch_uart_ops = {
41629 .tx_empty = pch_uart_tx_empty,
41630 .set_mctrl = pch_uart_set_mctrl,
41631 .get_mctrl = pch_uart_get_mctrl,
41632diff -urNp linux-2.6.39.2/drivers/tty/serial/pmac_zilog.c linux-2.6.39.2/drivers/tty/serial/pmac_zilog.c
41633--- linux-2.6.39.2/drivers/tty/serial/pmac_zilog.c 2011-05-19 00:06:34.000000000 -0400
41634+++ linux-2.6.39.2/drivers/tty/serial/pmac_zilog.c 2011-05-22 19:36:32.000000000 -0400
41635@@ -1427,7 +1427,7 @@ static void pmz_poll_put_char(struct uar
41636
41637 #endif /* CONFIG_CONSOLE_POLL */
41638
41639-static struct uart_ops pmz_pops = {
41640+static const struct uart_ops pmz_pops = {
41641 .tx_empty = pmz_tx_empty,
41642 .set_mctrl = pmz_set_mctrl,
41643 .get_mctrl = pmz_get_mctrl,
41644diff -urNp linux-2.6.39.2/drivers/tty/serial/pnx8xxx_uart.c linux-2.6.39.2/drivers/tty/serial/pnx8xxx_uart.c
41645--- linux-2.6.39.2/drivers/tty/serial/pnx8xxx_uart.c 2011-05-19 00:06:34.000000000 -0400
41646+++ linux-2.6.39.2/drivers/tty/serial/pnx8xxx_uart.c 2011-05-22 19:36:32.000000000 -0400
41647@@ -614,7 +614,7 @@ pnx8xxx_verify_port(struct uart_port *po
41648 return ret;
41649 }
41650
41651-static struct uart_ops pnx8xxx_pops = {
41652+static const struct uart_ops pnx8xxx_pops = {
41653 .tx_empty = pnx8xxx_tx_empty,
41654 .set_mctrl = pnx8xxx_set_mctrl,
41655 .get_mctrl = pnx8xxx_get_mctrl,
41656diff -urNp linux-2.6.39.2/drivers/tty/serial/pxa.c linux-2.6.39.2/drivers/tty/serial/pxa.c
41657--- linux-2.6.39.2/drivers/tty/serial/pxa.c 2011-05-19 00:06:34.000000000 -0400
41658+++ linux-2.6.39.2/drivers/tty/serial/pxa.c 2011-05-22 19:36:32.000000000 -0400
41659@@ -706,7 +706,7 @@ static struct console serial_pxa_console
41660 #define PXA_CONSOLE NULL
41661 #endif
41662
41663-struct uart_ops serial_pxa_pops = {
41664+const struct uart_ops serial_pxa_pops = {
41665 .tx_empty = serial_pxa_tx_empty,
41666 .set_mctrl = serial_pxa_set_mctrl,
41667 .get_mctrl = serial_pxa_get_mctrl,
41668diff -urNp linux-2.6.39.2/drivers/tty/serial/sa1100.c linux-2.6.39.2/drivers/tty/serial/sa1100.c
41669--- linux-2.6.39.2/drivers/tty/serial/sa1100.c 2011-05-19 00:06:34.000000000 -0400
41670+++ linux-2.6.39.2/drivers/tty/serial/sa1100.c 2011-05-22 19:36:32.000000000 -0400
41671@@ -577,7 +577,7 @@ sa1100_verify_port(struct uart_port *por
41672 return ret;
41673 }
41674
41675-static struct uart_ops sa1100_pops = {
41676+static const struct uart_ops sa1100_pops = {
41677 .tx_empty = sa1100_tx_empty,
41678 .set_mctrl = sa1100_set_mctrl,
41679 .get_mctrl = sa1100_get_mctrl,
41680diff -urNp linux-2.6.39.2/drivers/tty/serial/samsung.c linux-2.6.39.2/drivers/tty/serial/samsung.c
41681--- linux-2.6.39.2/drivers/tty/serial/samsung.c 2011-05-19 00:06:34.000000000 -0400
41682+++ linux-2.6.39.2/drivers/tty/serial/samsung.c 2011-05-22 19:36:32.000000000 -0400
41683@@ -860,7 +860,7 @@ static struct console s3c24xx_serial_con
41684 #define S3C24XX_SERIAL_CONSOLE NULL
41685 #endif
41686
41687-static struct uart_ops s3c24xx_serial_ops = {
41688+static const struct uart_ops s3c24xx_serial_ops = {
41689 .pm = s3c24xx_serial_pm,
41690 .tx_empty = s3c24xx_serial_tx_empty,
41691 .get_mctrl = s3c24xx_serial_get_mctrl,
41692diff -urNp linux-2.6.39.2/drivers/tty/serial/sc26xx.c linux-2.6.39.2/drivers/tty/serial/sc26xx.c
41693--- linux-2.6.39.2/drivers/tty/serial/sc26xx.c 2011-05-19 00:06:34.000000000 -0400
41694+++ linux-2.6.39.2/drivers/tty/serial/sc26xx.c 2011-05-22 19:36:32.000000000 -0400
41695@@ -515,7 +515,7 @@ static int sc26xx_verify_port(struct uar
41696 return -EINVAL;
41697 }
41698
41699-static struct uart_ops sc26xx_ops = {
41700+static const struct uart_ops sc26xx_ops = {
41701 .tx_empty = sc26xx_tx_empty,
41702 .set_mctrl = sc26xx_set_mctrl,
41703 .get_mctrl = sc26xx_get_mctrl,
41704diff -urNp linux-2.6.39.2/drivers/tty/serial/serial_ks8695.c linux-2.6.39.2/drivers/tty/serial/serial_ks8695.c
41705--- linux-2.6.39.2/drivers/tty/serial/serial_ks8695.c 2011-05-19 00:06:34.000000000 -0400
41706+++ linux-2.6.39.2/drivers/tty/serial/serial_ks8695.c 2011-05-22 19:36:32.000000000 -0400
41707@@ -528,7 +528,7 @@ static int ks8695uart_verify_port(struct
41708 return ret;
41709 }
41710
41711-static struct uart_ops ks8695uart_pops = {
41712+static const struct uart_ops ks8695uart_pops = {
41713 .tx_empty = ks8695uart_tx_empty,
41714 .set_mctrl = ks8695uart_set_mctrl,
41715 .get_mctrl = ks8695uart_get_mctrl,
41716diff -urNp linux-2.6.39.2/drivers/tty/serial/serial_txx9.c linux-2.6.39.2/drivers/tty/serial/serial_txx9.c
41717--- linux-2.6.39.2/drivers/tty/serial/serial_txx9.c 2011-05-19 00:06:34.000000000 -0400
41718+++ linux-2.6.39.2/drivers/tty/serial/serial_txx9.c 2011-05-22 19:36:32.000000000 -0400
41719@@ -857,7 +857,7 @@ serial_txx9_type(struct uart_port *port)
41720 return "txx9";
41721 }
41722
41723-static struct uart_ops serial_txx9_pops = {
41724+static const struct uart_ops serial_txx9_pops = {
41725 .tx_empty = serial_txx9_tx_empty,
41726 .set_mctrl = serial_txx9_set_mctrl,
41727 .get_mctrl = serial_txx9_get_mctrl,
41728diff -urNp linux-2.6.39.2/drivers/tty/serial/sn_console.c linux-2.6.39.2/drivers/tty/serial/sn_console.c
41729--- linux-2.6.39.2/drivers/tty/serial/sn_console.c 2011-05-19 00:06:34.000000000 -0400
41730+++ linux-2.6.39.2/drivers/tty/serial/sn_console.c 2011-05-22 19:36:32.000000000 -0400
41731@@ -388,7 +388,7 @@ static void snp_config_port(struct uart_
41732
41733 /* Associate the uart functions above - given to serial core */
41734
41735-static struct uart_ops sn_console_ops = {
41736+static const struct uart_ops sn_console_ops = {
41737 .tx_empty = snp_tx_empty,
41738 .set_mctrl = snp_set_mctrl,
41739 .get_mctrl = snp_get_mctrl,
41740diff -urNp linux-2.6.39.2/drivers/tty/serial/sunhv.c linux-2.6.39.2/drivers/tty/serial/sunhv.c
41741--- linux-2.6.39.2/drivers/tty/serial/sunhv.c 2011-05-19 00:06:34.000000000 -0400
41742+++ linux-2.6.39.2/drivers/tty/serial/sunhv.c 2011-05-22 19:36:32.000000000 -0400
41743@@ -168,12 +168,12 @@ struct sunhv_ops {
41744 int (*receive_chars)(struct uart_port *port, struct tty_struct *tty);
41745 };
41746
41747-static struct sunhv_ops bychar_ops = {
41748+static const struct sunhv_ops bychar_ops = {
41749 .transmit_chars = transmit_chars_putchar,
41750 .receive_chars = receive_chars_getchar,
41751 };
41752
41753-static struct sunhv_ops bywrite_ops = {
41754+static const struct sunhv_ops bywrite_ops = {
41755 .transmit_chars = transmit_chars_write,
41756 .receive_chars = receive_chars_read,
41757 };
41758@@ -370,7 +370,7 @@ static int sunhv_verify_port(struct uart
41759 return -EINVAL;
41760 }
41761
41762-static struct uart_ops sunhv_pops = {
41763+static const struct uart_ops sunhv_pops = {
41764 .tx_empty = sunhv_tx_empty,
41765 .set_mctrl = sunhv_set_mctrl,
41766 .get_mctrl = sunhv_get_mctrl,
41767diff -urNp linux-2.6.39.2/drivers/tty/serial/sunsab.c linux-2.6.39.2/drivers/tty/serial/sunsab.c
41768--- linux-2.6.39.2/drivers/tty/serial/sunsab.c 2011-05-19 00:06:34.000000000 -0400
41769+++ linux-2.6.39.2/drivers/tty/serial/sunsab.c 2011-05-22 19:36:32.000000000 -0400
41770@@ -804,7 +804,7 @@ static int sunsab_verify_port(struct uar
41771 return -EINVAL;
41772 }
41773
41774-static struct uart_ops sunsab_pops = {
41775+static const struct uart_ops sunsab_pops = {
41776 .tx_empty = sunsab_tx_empty,
41777 .set_mctrl = sunsab_set_mctrl,
41778 .get_mctrl = sunsab_get_mctrl,
41779diff -urNp linux-2.6.39.2/drivers/tty/serial/sunsu.c linux-2.6.39.2/drivers/tty/serial/sunsu.c
41780--- linux-2.6.39.2/drivers/tty/serial/sunsu.c 2011-05-19 00:06:34.000000000 -0400
41781+++ linux-2.6.39.2/drivers/tty/serial/sunsu.c 2011-05-22 19:36:32.000000000 -0400
41782@@ -946,7 +946,7 @@ sunsu_type(struct uart_port *port)
41783 return uart_config[type].name;
41784 }
41785
41786-static struct uart_ops sunsu_pops = {
41787+static const struct uart_ops sunsu_pops = {
41788 .tx_empty = sunsu_tx_empty,
41789 .set_mctrl = sunsu_set_mctrl,
41790 .get_mctrl = sunsu_get_mctrl,
41791diff -urNp linux-2.6.39.2/drivers/tty/serial/sunzilog.c linux-2.6.39.2/drivers/tty/serial/sunzilog.c
41792--- linux-2.6.39.2/drivers/tty/serial/sunzilog.c 2011-05-19 00:06:34.000000000 -0400
41793+++ linux-2.6.39.2/drivers/tty/serial/sunzilog.c 2011-05-22 19:36:32.000000000 -0400
41794@@ -1042,7 +1042,7 @@ static void sunzilog_put_poll_char(struc
41795 }
41796 #endif /* CONFIG_CONSOLE_POLL */
41797
41798-static struct uart_ops sunzilog_pops = {
41799+static const struct uart_ops sunzilog_pops = {
41800 .tx_empty = sunzilog_tx_empty,
41801 .set_mctrl = sunzilog_set_mctrl,
41802 .get_mctrl = sunzilog_get_mctrl,
41803diff -urNp linux-2.6.39.2/drivers/tty/serial/timbuart.c linux-2.6.39.2/drivers/tty/serial/timbuart.c
41804--- linux-2.6.39.2/drivers/tty/serial/timbuart.c 2011-05-19 00:06:34.000000000 -0400
41805+++ linux-2.6.39.2/drivers/tty/serial/timbuart.c 2011-05-22 19:36:32.000000000 -0400
41806@@ -394,7 +394,7 @@ static int timbuart_verify_port(struct u
41807 return -EINVAL;
41808 }
41809
41810-static struct uart_ops timbuart_ops = {
41811+static const struct uart_ops timbuart_ops = {
41812 .tx_empty = timbuart_tx_empty,
41813 .set_mctrl = timbuart_set_mctrl,
41814 .get_mctrl = timbuart_get_mctrl,
41815diff -urNp linux-2.6.39.2/drivers/tty/serial/uartlite.c linux-2.6.39.2/drivers/tty/serial/uartlite.c
41816--- linux-2.6.39.2/drivers/tty/serial/uartlite.c 2011-05-19 00:06:34.000000000 -0400
41817+++ linux-2.6.39.2/drivers/tty/serial/uartlite.c 2011-05-22 19:36:32.000000000 -0400
41818@@ -331,7 +331,7 @@ static void ulite_put_poll_char(struct u
41819 }
41820 #endif
41821
41822-static struct uart_ops ulite_ops = {
41823+static const struct uart_ops ulite_ops = {
41824 .tx_empty = ulite_tx_empty,
41825 .set_mctrl = ulite_set_mctrl,
41826 .get_mctrl = ulite_get_mctrl,
41827diff -urNp linux-2.6.39.2/drivers/tty/serial/ucc_uart.c linux-2.6.39.2/drivers/tty/serial/ucc_uart.c
41828--- linux-2.6.39.2/drivers/tty/serial/ucc_uart.c 2011-05-19 00:06:34.000000000 -0400
41829+++ linux-2.6.39.2/drivers/tty/serial/ucc_uart.c 2011-05-22 19:36:32.000000000 -0400
41830@@ -1088,7 +1088,7 @@ static int qe_uart_verify_port(struct ua
41831 *
41832 * Details on these functions can be found in Documentation/serial/driver
41833 */
41834-static struct uart_ops qe_uart_pops = {
41835+static const struct uart_ops qe_uart_pops = {
41836 .tx_empty = qe_uart_tx_empty,
41837 .set_mctrl = qe_uart_set_mctrl,
41838 .get_mctrl = qe_uart_get_mctrl,
41839diff -urNp linux-2.6.39.2/drivers/tty/serial/vr41xx_siu.c linux-2.6.39.2/drivers/tty/serial/vr41xx_siu.c
41840--- linux-2.6.39.2/drivers/tty/serial/vr41xx_siu.c 2011-05-19 00:06:34.000000000 -0400
41841+++ linux-2.6.39.2/drivers/tty/serial/vr41xx_siu.c 2011-05-22 19:36:32.000000000 -0400
41842@@ -683,7 +683,7 @@ static int siu_verify_port(struct uart_p
41843 return 0;
41844 }
41845
41846-static struct uart_ops siu_uart_ops = {
41847+static const struct uart_ops siu_uart_ops = {
41848 .tx_empty = siu_tx_empty,
41849 .set_mctrl = siu_set_mctrl,
41850 .get_mctrl = siu_get_mctrl,
41851diff -urNp linux-2.6.39.2/drivers/tty/serial/vt8500_serial.c linux-2.6.39.2/drivers/tty/serial/vt8500_serial.c
41852--- linux-2.6.39.2/drivers/tty/serial/vt8500_serial.c 2011-05-19 00:06:34.000000000 -0400
41853+++ linux-2.6.39.2/drivers/tty/serial/vt8500_serial.c 2011-05-22 19:36:32.000000000 -0400
41854@@ -519,7 +519,7 @@ static struct console vt8500_console = {
41855 #define VT8500_CONSOLE NULL
41856 #endif
41857
41858-static struct uart_ops vt8500_uart_pops = {
41859+static const struct uart_ops vt8500_uart_pops = {
41860 .tx_empty = vt8500_tx_empty,
41861 .set_mctrl = vt8500_set_mctrl,
41862 .get_mctrl = vt8500_get_mctrl,
41863diff -urNp linux-2.6.39.2/drivers/tty/serial/zs.c linux-2.6.39.2/drivers/tty/serial/zs.c
41864--- linux-2.6.39.2/drivers/tty/serial/zs.c 2011-05-19 00:06:34.000000000 -0400
41865+++ linux-2.6.39.2/drivers/tty/serial/zs.c 2011-05-22 19:36:32.000000000 -0400
41866@@ -1044,7 +1044,7 @@ static int zs_verify_port(struct uart_po
41867 }
41868
41869
41870-static struct uart_ops zs_ops = {
41871+static const struct uart_ops zs_ops = {
41872 .tx_empty = zs_tx_empty,
41873 .set_mctrl = zs_set_mctrl,
41874 .get_mctrl = zs_get_mctrl,
41875diff -urNp linux-2.6.39.2/drivers/tty/tty_io.c linux-2.6.39.2/drivers/tty/tty_io.c
41876--- linux-2.6.39.2/drivers/tty/tty_io.c 2011-05-19 00:06:34.000000000 -0400
41877+++ linux-2.6.39.2/drivers/tty/tty_io.c 2011-05-22 19:36:32.000000000 -0400
41878@@ -139,21 +139,11 @@ EXPORT_SYMBOL(tty_mutex);
41879 /* Spinlock to protect the tty->tty_files list */
41880 DEFINE_SPINLOCK(tty_files_lock);
41881
41882-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
41883-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
41884 ssize_t redirected_tty_write(struct file *, const char __user *,
41885 size_t, loff_t *);
41886-static unsigned int tty_poll(struct file *, poll_table *);
41887 static int tty_open(struct inode *, struct file *);
41888 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
41889-#ifdef CONFIG_COMPAT
41890-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41891- unsigned long arg);
41892-#else
41893-#define tty_compat_ioctl NULL
41894-#endif
41895 static int __tty_fasync(int fd, struct file *filp, int on);
41896-static int tty_fasync(int fd, struct file *filp, int on);
41897 static void release_tty(struct tty_struct *tty, int idx);
41898 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41899 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41900@@ -937,7 +927,7 @@ EXPORT_SYMBOL(start_tty);
41901 * read calls may be outstanding in parallel.
41902 */
41903
41904-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41905+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41906 loff_t *ppos)
41907 {
41908 int i;
41909@@ -963,6 +953,8 @@ static ssize_t tty_read(struct file *fil
41910 return i;
41911 }
41912
41913+EXPORT_SYMBOL(tty_read);
41914+
41915 void tty_write_unlock(struct tty_struct *tty)
41916 {
41917 mutex_unlock(&tty->atomic_write_lock);
41918@@ -1112,7 +1104,7 @@ void tty_write_message(struct tty_struct
41919 * write method will not be invoked in parallel for each device.
41920 */
41921
41922-static ssize_t tty_write(struct file *file, const char __user *buf,
41923+ssize_t tty_write(struct file *file, const char __user *buf,
41924 size_t count, loff_t *ppos)
41925 {
41926 struct inode *inode = file->f_path.dentry->d_inode;
41927@@ -1138,6 +1130,8 @@ static ssize_t tty_write(struct file *fi
41928 return ret;
41929 }
41930
41931+EXPORT_SYMBOL(tty_write);
41932+
41933 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
41934 size_t count, loff_t *ppos)
41935 {
41936@@ -1777,6 +1771,8 @@ int tty_release(struct inode *inode, str
41937 return 0;
41938 }
41939
41940+EXPORT_SYMBOL(tty_release);
41941+
41942 /**
41943 * tty_open - open a tty device
41944 * @inode: inode of device file
41945@@ -1968,7 +1964,7 @@ got_driver:
41946 * may be re-entered freely by other callers.
41947 */
41948
41949-static unsigned int tty_poll(struct file *filp, poll_table *wait)
41950+unsigned int tty_poll(struct file *filp, poll_table *wait)
41951 {
41952 struct tty_struct *tty = file_tty(filp);
41953 struct tty_ldisc *ld;
41954@@ -1984,6 +1980,8 @@ static unsigned int tty_poll(struct file
41955 return ret;
41956 }
41957
41958+EXPORT_SYMBOL(tty_poll);
41959+
41960 static int __tty_fasync(int fd, struct file *filp, int on)
41961 {
41962 struct tty_struct *tty = file_tty(filp);
41963@@ -2025,7 +2023,7 @@ out:
41964 return retval;
41965 }
41966
41967-static int tty_fasync(int fd, struct file *filp, int on)
41968+int tty_fasync(int fd, struct file *filp, int on)
41969 {
41970 int retval;
41971 tty_lock();
41972@@ -2034,6 +2032,8 @@ static int tty_fasync(int fd, struct fil
41973 return retval;
41974 }
41975
41976+EXPORT_SYMBOL(tty_fasync);
41977+
41978 /**
41979 * tiocsti - fake input character
41980 * @tty: tty to fake input into
41981@@ -2695,8 +2695,10 @@ long tty_ioctl(struct file *file, unsign
41982 return retval;
41983 }
41984
41985+EXPORT_SYMBOL(tty_ioctl);
41986+
41987 #ifdef CONFIG_COMPAT
41988-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41989+long tty_compat_ioctl(struct file *file, unsigned int cmd,
41990 unsigned long arg)
41991 {
41992 struct inode *inode = file->f_dentry->d_inode;
41993@@ -2720,6 +2722,9 @@ static long tty_compat_ioctl(struct file
41994
41995 return retval;
41996 }
41997+
41998+EXPORT_SYMBOL(tty_compat_ioctl);
41999+
42000 #endif
42001
42002 /*
42003@@ -3198,11 +3203,6 @@ struct tty_struct *get_current_tty(void)
42004 }
42005 EXPORT_SYMBOL_GPL(get_current_tty);
42006
42007-void tty_default_fops(struct file_operations *fops)
42008-{
42009- *fops = tty_fops;
42010-}
42011-
42012 /*
42013 * Initialize the console device. This is called *early*, so
42014 * we can't necessarily depend on lots of kernel help here.
42015diff -urNp linux-2.6.39.2/drivers/tty/tty_ldisc.c linux-2.6.39.2/drivers/tty/tty_ldisc.c
42016--- linux-2.6.39.2/drivers/tty/tty_ldisc.c 2011-05-19 00:06:34.000000000 -0400
42017+++ linux-2.6.39.2/drivers/tty/tty_ldisc.c 2011-05-22 19:36:32.000000000 -0400
42018@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
42019 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
42020 struct tty_ldisc_ops *ldo = ld->ops;
42021
42022- ldo->refcount--;
42023+ atomic_dec(&ldo->refcount);
42024 module_put(ldo->owner);
42025 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
42026
42027@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
42028 spin_lock_irqsave(&tty_ldisc_lock, flags);
42029 tty_ldiscs[disc] = new_ldisc;
42030 new_ldisc->num = disc;
42031- new_ldisc->refcount = 0;
42032+ atomic_set(&new_ldisc->refcount, 0);
42033 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
42034
42035 return ret;
42036@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
42037 return -EINVAL;
42038
42039 spin_lock_irqsave(&tty_ldisc_lock, flags);
42040- if (tty_ldiscs[disc]->refcount)
42041+ if (atomic_read(&tty_ldiscs[disc]->refcount))
42042 ret = -EBUSY;
42043 else
42044 tty_ldiscs[disc] = NULL;
42045@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
42046 if (ldops) {
42047 ret = ERR_PTR(-EAGAIN);
42048 if (try_module_get(ldops->owner)) {
42049- ldops->refcount++;
42050+ atomic_inc(&ldops->refcount);
42051 ret = ldops;
42052 }
42053 }
42054@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
42055 unsigned long flags;
42056
42057 spin_lock_irqsave(&tty_ldisc_lock, flags);
42058- ldops->refcount--;
42059+ atomic_dec(&ldops->refcount);
42060 module_put(ldops->owner);
42061 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
42062 }
42063diff -urNp linux-2.6.39.2/drivers/tty/vt/keyboard.c linux-2.6.39.2/drivers/tty/vt/keyboard.c
42064--- linux-2.6.39.2/drivers/tty/vt/keyboard.c 2011-05-19 00:06:34.000000000 -0400
42065+++ linux-2.6.39.2/drivers/tty/vt/keyboard.c 2011-05-22 20:32:43.000000000 -0400
42066@@ -658,6 +658,16 @@ static void k_spec(struct vc_data *vc, u
42067 kbd->kbdmode == VC_OFF) &&
42068 value != KVAL(K_SAK))
42069 return; /* SAK is allowed even in raw mode */
42070+
42071+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
42072+ {
42073+ void *func = fn_handler[value];
42074+ if (func == fn_show_state || func == fn_show_ptregs ||
42075+ func == fn_show_mem)
42076+ return;
42077+ }
42078+#endif
42079+
42080 fn_handler[value](vc);
42081 }
42082
42083diff -urNp linux-2.6.39.2/drivers/tty/vt/vt.c linux-2.6.39.2/drivers/tty/vt/vt.c
42084--- linux-2.6.39.2/drivers/tty/vt/vt.c 2011-05-19 00:06:34.000000000 -0400
42085+++ linux-2.6.39.2/drivers/tty/vt/vt.c 2011-05-22 19:36:32.000000000 -0400
42086@@ -261,7 +261,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
42087
42088 static void notify_write(struct vc_data *vc, unsigned int unicode)
42089 {
42090- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
42091+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
42092 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
42093 }
42094
42095diff -urNp linux-2.6.39.2/drivers/tty/vt/vt_ioctl.c linux-2.6.39.2/drivers/tty/vt/vt_ioctl.c
42096--- linux-2.6.39.2/drivers/tty/vt/vt_ioctl.c 2011-05-19 00:06:34.000000000 -0400
42097+++ linux-2.6.39.2/drivers/tty/vt/vt_ioctl.c 2011-05-22 19:41:37.000000000 -0400
42098@@ -209,9 +209,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
42099 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
42100 return -EFAULT;
42101
42102- if (!capable(CAP_SYS_TTY_CONFIG))
42103- perm = 0;
42104-
42105 switch (cmd) {
42106 case KDGKBENT:
42107 key_map = key_maps[s];
42108@@ -223,6 +220,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
42109 val = (i ? K_HOLE : K_NOSUCHMAP);
42110 return put_user(val, &user_kbe->kb_value);
42111 case KDSKBENT:
42112+ if (!capable(CAP_SYS_TTY_CONFIG))
42113+ perm = 0;
42114+
42115 if (!perm)
42116 return -EPERM;
42117 if (!i && v == K_NOSUCHMAP) {
42118@@ -324,9 +324,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
42119 int i, j, k;
42120 int ret;
42121
42122- if (!capable(CAP_SYS_TTY_CONFIG))
42123- perm = 0;
42124-
42125 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
42126 if (!kbs) {
42127 ret = -ENOMEM;
42128@@ -360,6 +357,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
42129 kfree(kbs);
42130 return ((p && *p) ? -EOVERFLOW : 0);
42131 case KDSKBSENT:
42132+ if (!capable(CAP_SYS_TTY_CONFIG))
42133+ perm = 0;
42134+
42135 if (!perm) {
42136 ret = -EPERM;
42137 goto reterr;
42138diff -urNp linux-2.6.39.2/drivers/uio/uio.c linux-2.6.39.2/drivers/uio/uio.c
42139--- linux-2.6.39.2/drivers/uio/uio.c 2011-05-19 00:06:34.000000000 -0400
42140+++ linux-2.6.39.2/drivers/uio/uio.c 2011-05-22 19:36:32.000000000 -0400
42141@@ -25,6 +25,7 @@
42142 #include <linux/kobject.h>
42143 #include <linux/cdev.h>
42144 #include <linux/uio_driver.h>
42145+#include <asm/local.h>
42146
42147 #define UIO_MAX_DEVICES (1U << MINORBITS)
42148
42149@@ -32,10 +33,10 @@ struct uio_device {
42150 struct module *owner;
42151 struct device *dev;
42152 int minor;
42153- atomic_t event;
42154+ atomic_unchecked_t event;
42155 struct fasync_struct *async_queue;
42156 wait_queue_head_t wait;
42157- int vma_count;
42158+ local_t vma_count;
42159 struct uio_info *info;
42160 struct kobject *map_dir;
42161 struct kobject *portio_dir;
42162@@ -242,7 +243,7 @@ static ssize_t show_event(struct device
42163 struct device_attribute *attr, char *buf)
42164 {
42165 struct uio_device *idev = dev_get_drvdata(dev);
42166- return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
42167+ return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
42168 }
42169
42170 static struct device_attribute uio_class_attributes[] = {
42171@@ -402,7 +403,7 @@ void uio_event_notify(struct uio_info *i
42172 {
42173 struct uio_device *idev = info->uio_dev;
42174
42175- atomic_inc(&idev->event);
42176+ atomic_inc_unchecked(&idev->event);
42177 wake_up_interruptible(&idev->wait);
42178 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
42179 }
42180@@ -455,7 +456,7 @@ static int uio_open(struct inode *inode,
42181 }
42182
42183 listener->dev = idev;
42184- listener->event_count = atomic_read(&idev->event);
42185+ listener->event_count = atomic_read_unchecked(&idev->event);
42186 filep->private_data = listener;
42187
42188 if (idev->info->open) {
42189@@ -506,7 +507,7 @@ static unsigned int uio_poll(struct file
42190 return -EIO;
42191
42192 poll_wait(filep, &idev->wait, wait);
42193- if (listener->event_count != atomic_read(&idev->event))
42194+ if (listener->event_count != atomic_read_unchecked(&idev->event))
42195 return POLLIN | POLLRDNORM;
42196 return 0;
42197 }
42198@@ -531,7 +532,7 @@ static ssize_t uio_read(struct file *fil
42199 do {
42200 set_current_state(TASK_INTERRUPTIBLE);
42201
42202- event_count = atomic_read(&idev->event);
42203+ event_count = atomic_read_unchecked(&idev->event);
42204 if (event_count != listener->event_count) {
42205 if (copy_to_user(buf, &event_count, count))
42206 retval = -EFAULT;
42207@@ -602,13 +603,13 @@ static int uio_find_mem_index(struct vm_
42208 static void uio_vma_open(struct vm_area_struct *vma)
42209 {
42210 struct uio_device *idev = vma->vm_private_data;
42211- idev->vma_count++;
42212+ local_inc(&idev->vma_count);
42213 }
42214
42215 static void uio_vma_close(struct vm_area_struct *vma)
42216 {
42217 struct uio_device *idev = vma->vm_private_data;
42218- idev->vma_count--;
42219+ local_dec(&idev->vma_count);
42220 }
42221
42222 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
42223@@ -819,7 +820,7 @@ int __uio_register_device(struct module
42224 idev->owner = owner;
42225 idev->info = info;
42226 init_waitqueue_head(&idev->wait);
42227- atomic_set(&idev->event, 0);
42228+ atomic_set_unchecked(&idev->event, 0);
42229
42230 ret = uio_get_minor(idev);
42231 if (ret)
42232diff -urNp linux-2.6.39.2/drivers/usb/atm/cxacru.c linux-2.6.39.2/drivers/usb/atm/cxacru.c
42233--- linux-2.6.39.2/drivers/usb/atm/cxacru.c 2011-05-19 00:06:34.000000000 -0400
42234+++ linux-2.6.39.2/drivers/usb/atm/cxacru.c 2011-05-22 19:36:32.000000000 -0400
42235@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
42236 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
42237 if (ret < 2)
42238 return -EINVAL;
42239- if (index < 0 || index > 0x7f)
42240+ if (index > 0x7f)
42241 return -EINVAL;
42242 pos += tmp;
42243
42244diff -urNp linux-2.6.39.2/drivers/usb/atm/usbatm.c linux-2.6.39.2/drivers/usb/atm/usbatm.c
42245--- linux-2.6.39.2/drivers/usb/atm/usbatm.c 2011-05-19 00:06:34.000000000 -0400
42246+++ linux-2.6.39.2/drivers/usb/atm/usbatm.c 2011-05-22 19:36:32.000000000 -0400
42247@@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
42248 if (printk_ratelimit())
42249 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
42250 __func__, vpi, vci);
42251- atomic_inc(&vcc->stats->rx_err);
42252+ atomic_inc_unchecked(&vcc->stats->rx_err);
42253 return;
42254 }
42255
42256@@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru
42257 if (length > ATM_MAX_AAL5_PDU) {
42258 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
42259 __func__, length, vcc);
42260- atomic_inc(&vcc->stats->rx_err);
42261+ atomic_inc_unchecked(&vcc->stats->rx_err);
42262 goto out;
42263 }
42264
42265@@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru
42266 if (sarb->len < pdu_length) {
42267 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
42268 __func__, pdu_length, sarb->len, vcc);
42269- atomic_inc(&vcc->stats->rx_err);
42270+ atomic_inc_unchecked(&vcc->stats->rx_err);
42271 goto out;
42272 }
42273
42274 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
42275 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
42276 __func__, vcc);
42277- atomic_inc(&vcc->stats->rx_err);
42278+ atomic_inc_unchecked(&vcc->stats->rx_err);
42279 goto out;
42280 }
42281
42282@@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru
42283 if (printk_ratelimit())
42284 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
42285 __func__, length);
42286- atomic_inc(&vcc->stats->rx_drop);
42287+ atomic_inc_unchecked(&vcc->stats->rx_drop);
42288 goto out;
42289 }
42290
42291@@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru
42292
42293 vcc->push(vcc, skb);
42294
42295- atomic_inc(&vcc->stats->rx);
42296+ atomic_inc_unchecked(&vcc->stats->rx);
42297 out:
42298 skb_trim(sarb, 0);
42299 }
42300@@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l
42301 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
42302
42303 usbatm_pop(vcc, skb);
42304- atomic_inc(&vcc->stats->tx);
42305+ atomic_inc_unchecked(&vcc->stats->tx);
42306
42307 skb = skb_dequeue(&instance->sndqueue);
42308 }
42309@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a
42310 if (!left--)
42311 return sprintf(page,
42312 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
42313- atomic_read(&atm_dev->stats.aal5.tx),
42314- atomic_read(&atm_dev->stats.aal5.tx_err),
42315- atomic_read(&atm_dev->stats.aal5.rx),
42316- atomic_read(&atm_dev->stats.aal5.rx_err),
42317- atomic_read(&atm_dev->stats.aal5.rx_drop));
42318+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
42319+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
42320+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
42321+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
42322+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
42323
42324 if (!left--) {
42325 if (instance->disconnected)
42326diff -urNp linux-2.6.39.2/drivers/usb/core/devices.c linux-2.6.39.2/drivers/usb/core/devices.c
42327--- linux-2.6.39.2/drivers/usb/core/devices.c 2011-05-19 00:06:34.000000000 -0400
42328+++ linux-2.6.39.2/drivers/usb/core/devices.c 2011-05-22 19:36:32.000000000 -0400
42329@@ -126,7 +126,7 @@ static const char *format_endpt =
42330 * time it gets called.
42331 */
42332 static struct device_connect_event {
42333- atomic_t count;
42334+ atomic_unchecked_t count;
42335 wait_queue_head_t wait;
42336 } device_event = {
42337 .count = ATOMIC_INIT(1),
42338@@ -164,7 +164,7 @@ static const struct class_info clas_info
42339
42340 void usbfs_conn_disc_event(void)
42341 {
42342- atomic_add(2, &device_event.count);
42343+ atomic_add_unchecked(2, &device_event.count);
42344 wake_up(&device_event.wait);
42345 }
42346
42347@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
42348
42349 poll_wait(file, &device_event.wait, wait);
42350
42351- event_count = atomic_read(&device_event.count);
42352+ event_count = atomic_read_unchecked(&device_event.count);
42353 if (file->f_version != event_count) {
42354 file->f_version = event_count;
42355 return POLLIN | POLLRDNORM;
42356diff -urNp linux-2.6.39.2/drivers/usb/core/hcd.c linux-2.6.39.2/drivers/usb/core/hcd.c
42357--- linux-2.6.39.2/drivers/usb/core/hcd.c 2011-06-03 00:04:14.000000000 -0400
42358+++ linux-2.6.39.2/drivers/usb/core/hcd.c 2011-06-03 00:32:07.000000000 -0400
42359@@ -2574,7 +2574,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
42360
42361 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
42362
42363-struct usb_mon_operations *mon_ops;
42364+const struct usb_mon_operations *mon_ops;
42365
42366 /*
42367 * The registration is unlocked.
42368@@ -2584,7 +2584,7 @@ struct usb_mon_operations *mon_ops;
42369 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
42370 */
42371
42372-int usb_mon_register (struct usb_mon_operations *ops)
42373+int usb_mon_register (const struct usb_mon_operations *ops)
42374 {
42375
42376 if (mon_ops)
42377diff -urNp linux-2.6.39.2/drivers/usb/core/message.c linux-2.6.39.2/drivers/usb/core/message.c
42378--- linux-2.6.39.2/drivers/usb/core/message.c 2011-05-19 00:06:34.000000000 -0400
42379+++ linux-2.6.39.2/drivers/usb/core/message.c 2011-05-22 19:36:32.000000000 -0400
42380@@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
42381 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
42382 if (buf) {
42383 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
42384- if (len > 0) {
42385- smallbuf = kmalloc(++len, GFP_NOIO);
42386+ if (len++ > 0) {
42387+ smallbuf = kmalloc(len, GFP_NOIO);
42388 if (!smallbuf)
42389 return buf;
42390 memcpy(smallbuf, buf, len);
42391diff -urNp linux-2.6.39.2/drivers/usb/early/ehci-dbgp.c linux-2.6.39.2/drivers/usb/early/ehci-dbgp.c
42392--- linux-2.6.39.2/drivers/usb/early/ehci-dbgp.c 2011-05-19 00:06:34.000000000 -0400
42393+++ linux-2.6.39.2/drivers/usb/early/ehci-dbgp.c 2011-05-22 19:36:32.000000000 -0400
42394@@ -96,7 +96,7 @@ static inline u32 dbgp_len_update(u32 x,
42395 }
42396
42397 #ifdef CONFIG_KGDB
42398-static struct kgdb_io kgdbdbgp_io_ops;
42399+static struct kgdb_io kgdbdbgp_io_ops; /* cannot be const, see kgdbdbgp_parse_config */
42400 #define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
42401 #else
42402 #define dbgp_kgdb_mode (0)
42403@@ -1026,7 +1026,7 @@ static void kgdbdbgp_write_char(u8 chr)
42404 early_dbgp_write(NULL, &chr, 1);
42405 }
42406
42407-static struct kgdb_io kgdbdbgp_io_ops = {
42408+static struct kgdb_io kgdbdbgp_io_ops = { /* cannot be const, see kgdbdbgp_parse_config() */
42409 .name = "kgdbdbgp",
42410 .read_char = kgdbdbgp_read_char,
42411 .write_char = kgdbdbgp_write_char,
42412diff -urNp linux-2.6.39.2/drivers/usb/gadget/fsl_qe_udc.c linux-2.6.39.2/drivers/usb/gadget/fsl_qe_udc.c
42413--- linux-2.6.39.2/drivers/usb/gadget/fsl_qe_udc.c 2011-05-19 00:06:34.000000000 -0400
42414+++ linux-2.6.39.2/drivers/usb/gadget/fsl_qe_udc.c 2011-05-22 19:36:32.000000000 -0400
42415@@ -1859,7 +1859,7 @@ out:
42416 return status;
42417 }
42418
42419-static struct usb_ep_ops qe_ep_ops = {
42420+static const struct usb_ep_ops qe_ep_ops = {
42421 .enable = qe_ep_enable,
42422 .disable = qe_ep_disable,
42423
42424@@ -1928,7 +1928,7 @@ static int qe_pullup(struct usb_gadget *
42425 }
42426
42427 /* defined in usb_gadget.h */
42428-static struct usb_gadget_ops qe_gadget_ops = {
42429+static const struct usb_gadget_ops qe_gadget_ops = {
42430 .get_frame = qe_get_frame,
42431 .wakeup = qe_wakeup,
42432 /* .set_selfpowered = qe_set_selfpowered,*/ /* always selfpowered */
42433diff -urNp linux-2.6.39.2/drivers/usb/gadget/fsl_udc_core.c linux-2.6.39.2/drivers/usb/gadget/fsl_udc_core.c
42434--- linux-2.6.39.2/drivers/usb/gadget/fsl_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42435+++ linux-2.6.39.2/drivers/usb/gadget/fsl_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42436@@ -1003,7 +1003,7 @@ static void fsl_ep_fifo_flush(struct usb
42437 } while (fsl_readl(&dr_regs->endptstatus) & bits);
42438 }
42439
42440-static struct usb_ep_ops fsl_ep_ops = {
42441+static const struct usb_ep_ops fsl_ep_ops = {
42442 .enable = fsl_ep_enable,
42443 .disable = fsl_ep_disable,
42444
42445@@ -1114,7 +1114,7 @@ static int fsl_pullup(struct usb_gadget
42446 }
42447
42448 /* defined in gadget.h */
42449-static struct usb_gadget_ops fsl_gadget_ops = {
42450+static const struct usb_gadget_ops fsl_gadget_ops = {
42451 .get_frame = fsl_get_frame,
42452 .wakeup = fsl_wakeup,
42453 /* .set_selfpowered = fsl_set_selfpowered, */ /* Always selfpowered */
42454diff -urNp linux-2.6.39.2/drivers/usb/gadget/fusb300_udc.c linux-2.6.39.2/drivers/usb/gadget/fusb300_udc.c
42455--- linux-2.6.39.2/drivers/usb/gadget/fusb300_udc.c 2011-05-19 00:06:34.000000000 -0400
42456+++ linux-2.6.39.2/drivers/usb/gadget/fusb300_udc.c 2011-05-22 19:36:32.000000000 -0400
42457@@ -527,7 +527,7 @@ static void fusb300_fifo_flush(struct us
42458 {
42459 }
42460
42461-static struct usb_ep_ops fusb300_ep_ops = {
42462+static const struct usb_ep_ops fusb300_ep_ops = {
42463 .enable = fusb300_enable,
42464 .disable = fusb300_disable,
42465
42466@@ -1570,7 +1570,7 @@ static int fusb300_udc_pullup(struct usb
42467 return 0;
42468 }
42469
42470-static struct usb_gadget_ops fusb300_gadget_ops = {
42471+static const struct usb_gadget_ops fusb300_gadget_ops = {
42472 .pullup = fusb300_udc_pullup,
42473 };
42474
42475diff -urNp linux-2.6.39.2/drivers/usb/gadget/goku_udc.c linux-2.6.39.2/drivers/usb/gadget/goku_udc.c
42476--- linux-2.6.39.2/drivers/usb/gadget/goku_udc.c 2011-05-19 00:06:34.000000000 -0400
42477+++ linux-2.6.39.2/drivers/usb/gadget/goku_udc.c 2011-05-22 19:36:32.000000000 -0400
42478@@ -973,7 +973,7 @@ static void goku_fifo_flush(struct usb_e
42479 command(regs, COMMAND_FIFO_CLEAR, ep->num);
42480 }
42481
42482-static struct usb_ep_ops goku_ep_ops = {
42483+static const struct usb_ep_ops goku_ep_ops = {
42484 .enable = goku_ep_enable,
42485 .disable = goku_ep_disable,
42486
42487diff -urNp linux-2.6.39.2/drivers/usb/gadget/imx_udc.c linux-2.6.39.2/drivers/usb/gadget/imx_udc.c
42488--- linux-2.6.39.2/drivers/usb/gadget/imx_udc.c 2011-05-19 00:06:34.000000000 -0400
42489+++ linux-2.6.39.2/drivers/usb/gadget/imx_udc.c 2011-05-22 19:36:32.000000000 -0400
42490@@ -937,7 +937,7 @@ static void imx_ep_fifo_flush(struct usb
42491 local_irq_restore(flags);
42492 }
42493
42494-static struct usb_ep_ops imx_ep_ops = {
42495+static const struct usb_ep_ops imx_ep_ops = {
42496 .enable = imx_ep_enable,
42497 .disable = imx_ep_disable,
42498
42499diff -urNp linux-2.6.39.2/drivers/usb/gadget/m66592-udc.c linux-2.6.39.2/drivers/usb/gadget/m66592-udc.c
42500--- linux-2.6.39.2/drivers/usb/gadget/m66592-udc.c 2011-05-19 00:06:34.000000000 -0400
42501+++ linux-2.6.39.2/drivers/usb/gadget/m66592-udc.c 2011-05-22 19:36:32.000000000 -0400
42502@@ -1437,7 +1437,7 @@ static void m66592_fifo_flush(struct usb
42503 spin_unlock_irqrestore(&ep->m66592->lock, flags);
42504 }
42505
42506-static struct usb_ep_ops m66592_ep_ops = {
42507+static const struct usb_ep_ops m66592_ep_ops = {
42508 .enable = m66592_enable,
42509 .disable = m66592_disable,
42510
42511@@ -1542,7 +1542,7 @@ static int m66592_get_frame(struct usb_g
42512 return m66592_read(m66592, M66592_FRMNUM) & 0x03FF;
42513 }
42514
42515-static struct usb_gadget_ops m66592_gadget_ops = {
42516+static const struct usb_gadget_ops m66592_gadget_ops = {
42517 .get_frame = m66592_get_frame,
42518 };
42519
42520diff -urNp linux-2.6.39.2/drivers/usb/gadget/mv_udc_core.c linux-2.6.39.2/drivers/usb/gadget/mv_udc_core.c
42521--- linux-2.6.39.2/drivers/usb/gadget/mv_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42522+++ linux-2.6.39.2/drivers/usb/gadget/mv_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42523@@ -972,7 +972,7 @@ static int mv_ep_set_wedge(struct usb_ep
42524 return mv_ep_set_halt_wedge(_ep, 1, 1);
42525 }
42526
42527-static struct usb_ep_ops mv_ep_ops = {
42528+static const struct usb_ep_ops mv_ep_ops = {
42529 .enable = mv_ep_enable,
42530 .disable = mv_ep_disable,
42531
42532diff -urNp linux-2.6.39.2/drivers/usb/gadget/omap_udc.c linux-2.6.39.2/drivers/usb/gadget/omap_udc.c
42533--- linux-2.6.39.2/drivers/usb/gadget/omap_udc.c 2011-05-19 00:06:34.000000000 -0400
42534+++ linux-2.6.39.2/drivers/usb/gadget/omap_udc.c 2011-05-22 19:36:32.000000000 -0400
42535@@ -1177,7 +1177,7 @@ done:
42536 return status;
42537 }
42538
42539-static struct usb_ep_ops omap_ep_ops = {
42540+static const struct usb_ep_ops omap_ep_ops = {
42541 .enable = omap_ep_enable,
42542 .disable = omap_ep_disable,
42543
42544@@ -1374,7 +1374,7 @@ static int omap_pullup(struct usb_gadget
42545 return 0;
42546 }
42547
42548-static struct usb_gadget_ops omap_gadget_ops = {
42549+static const struct usb_gadget_ops omap_gadget_ops = {
42550 .get_frame = omap_get_frame,
42551 .wakeup = omap_wakeup,
42552 .set_selfpowered = omap_set_selfpowered,
42553diff -urNp linux-2.6.39.2/drivers/usb/gadget/pxa25x_udc.c linux-2.6.39.2/drivers/usb/gadget/pxa25x_udc.c
42554--- linux-2.6.39.2/drivers/usb/gadget/pxa25x_udc.c 2011-05-19 00:06:34.000000000 -0400
42555+++ linux-2.6.39.2/drivers/usb/gadget/pxa25x_udc.c 2011-05-22 19:36:32.000000000 -0400
42556@@ -896,7 +896,7 @@ static void pxa25x_ep_fifo_flush(struct
42557 }
42558
42559
42560-static struct usb_ep_ops pxa25x_ep_ops = {
42561+static const struct usb_ep_ops pxa25x_ep_ops = {
42562 .enable = pxa25x_ep_enable,
42563 .disable = pxa25x_ep_disable,
42564
42565diff -urNp linux-2.6.39.2/drivers/usb/gadget/pxa27x_udc.c linux-2.6.39.2/drivers/usb/gadget/pxa27x_udc.c
42566--- linux-2.6.39.2/drivers/usb/gadget/pxa27x_udc.c 2011-05-19 00:06:34.000000000 -0400
42567+++ linux-2.6.39.2/drivers/usb/gadget/pxa27x_udc.c 2011-05-22 19:36:32.000000000 -0400
42568@@ -1491,7 +1491,7 @@ static int pxa_ep_disable(struct usb_ep
42569 return 0;
42570 }
42571
42572-static struct usb_ep_ops pxa_ep_ops = {
42573+static const struct usb_ep_ops pxa_ep_ops = {
42574 .enable = pxa_ep_enable,
42575 .disable = pxa_ep_disable,
42576
42577diff -urNp linux-2.6.39.2/drivers/usb/gadget/r8a66597-udc.c linux-2.6.39.2/drivers/usb/gadget/r8a66597-udc.c
42578--- linux-2.6.39.2/drivers/usb/gadget/r8a66597-udc.c 2011-05-19 00:06:34.000000000 -0400
42579+++ linux-2.6.39.2/drivers/usb/gadget/r8a66597-udc.c 2011-05-22 19:36:32.000000000 -0400
42580@@ -1392,7 +1392,7 @@ static void r8a66597_fifo_flush(struct u
42581 spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
42582 }
42583
42584-static struct usb_ep_ops r8a66597_ep_ops = {
42585+static const struct usb_ep_ops r8a66597_ep_ops = {
42586 .enable = r8a66597_enable,
42587 .disable = r8a66597_disable,
42588
42589@@ -1497,7 +1497,7 @@ static int r8a66597_get_frame(struct usb
42590 return r8a66597_read(r8a66597, FRMNUM) & 0x03FF;
42591 }
42592
42593-static struct usb_gadget_ops r8a66597_gadget_ops = {
42594+static const struct usb_gadget_ops r8a66597_gadget_ops = {
42595 .get_frame = r8a66597_get_frame,
42596 };
42597
42598diff -urNp linux-2.6.39.2/drivers/usb/gadget/s3c-hsotg.c linux-2.6.39.2/drivers/usb/gadget/s3c-hsotg.c
42599--- linux-2.6.39.2/drivers/usb/gadget/s3c-hsotg.c 2011-05-19 00:06:34.000000000 -0400
42600+++ linux-2.6.39.2/drivers/usb/gadget/s3c-hsotg.c 2011-05-22 19:36:32.000000000 -0400
42601@@ -2461,7 +2461,7 @@ static int s3c_hsotg_ep_sethalt(struct u
42602 return 0;
42603 }
42604
42605-static struct usb_ep_ops s3c_hsotg_ep_ops = {
42606+static const struct usb_ep_ops s3c_hsotg_ep_ops = {
42607 .enable = s3c_hsotg_ep_enable,
42608 .disable = s3c_hsotg_ep_disable,
42609 .alloc_request = s3c_hsotg_ep_alloc_request,
42610@@ -2725,7 +2725,7 @@ static int s3c_hsotg_gadget_getframe(str
42611 return s3c_hsotg_read_frameno(to_hsotg(gadget));
42612 }
42613
42614-static struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42615+static const struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42616 .get_frame = s3c_hsotg_gadget_getframe,
42617 };
42618
42619diff -urNp linux-2.6.39.2/drivers/usb/gadget/uvc_queue.c linux-2.6.39.2/drivers/usb/gadget/uvc_queue.c
42620--- linux-2.6.39.2/drivers/usb/gadget/uvc_queue.c 2011-05-19 00:06:34.000000000 -0400
42621+++ linux-2.6.39.2/drivers/usb/gadget/uvc_queue.c 2011-05-22 19:36:32.000000000 -0400
42622@@ -400,7 +400,7 @@ static void uvc_vm_close(struct vm_area_
42623 buffer->vma_use_count--;
42624 }
42625
42626-static struct vm_operations_struct uvc_vm_ops = {
42627+static const struct vm_operations_struct uvc_vm_ops = {
42628 .open = uvc_vm_open,
42629 .close = uvc_vm_close,
42630 };
42631diff -urNp linux-2.6.39.2/drivers/usb/host/ehci-fsl.c linux-2.6.39.2/drivers/usb/host/ehci-fsl.c
42632--- linux-2.6.39.2/drivers/usb/host/ehci-fsl.c 2011-05-19 00:06:34.000000000 -0400
42633+++ linux-2.6.39.2/drivers/usb/host/ehci-fsl.c 2011-05-22 19:36:32.000000000 -0400
42634@@ -380,7 +380,7 @@ static int ehci_fsl_drv_restore(struct d
42635 return 0;
42636 }
42637
42638-static struct dev_pm_ops ehci_fsl_pm_ops = {
42639+static const struct dev_pm_ops ehci_fsl_pm_ops = {
42640 .suspend = ehci_fsl_drv_suspend,
42641 .resume = ehci_fsl_drv_resume,
42642 .restore = ehci_fsl_drv_restore,
42643diff -urNp linux-2.6.39.2/drivers/usb/host/xhci-mem.c linux-2.6.39.2/drivers/usb/host/xhci-mem.c
42644--- linux-2.6.39.2/drivers/usb/host/xhci-mem.c 2011-06-25 12:55:23.000000000 -0400
42645+++ linux-2.6.39.2/drivers/usb/host/xhci-mem.c 2011-06-25 13:00:26.000000000 -0400
42646@@ -1680,6 +1680,8 @@ static int xhci_check_trb_in_td_math(str
42647 unsigned int num_tests;
42648 int i, ret;
42649
42650+ pax_track_stack();
42651+
42652 num_tests = ARRAY_SIZE(simple_test_vector);
42653 for (i = 0; i < num_tests; i++) {
42654 ret = xhci_test_trb_in_td(xhci,
42655diff -urNp linux-2.6.39.2/drivers/usb/mon/mon_main.c linux-2.6.39.2/drivers/usb/mon/mon_main.c
42656--- linux-2.6.39.2/drivers/usb/mon/mon_main.c 2011-05-19 00:06:34.000000000 -0400
42657+++ linux-2.6.39.2/drivers/usb/mon/mon_main.c 2011-05-22 19:36:32.000000000 -0400
42658@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
42659 /*
42660 * Ops
42661 */
42662-static struct usb_mon_operations mon_ops_0 = {
42663+static const struct usb_mon_operations mon_ops_0 = {
42664 .urb_submit = mon_submit,
42665 .urb_submit_error = mon_submit_error,
42666 .urb_complete = mon_complete,
42667diff -urNp linux-2.6.39.2/drivers/usb/musb/cppi_dma.h linux-2.6.39.2/drivers/usb/musb/cppi_dma.h
42668--- linux-2.6.39.2/drivers/usb/musb/cppi_dma.h 2011-05-19 00:06:34.000000000 -0400
42669+++ linux-2.6.39.2/drivers/usb/musb/cppi_dma.h 2011-05-22 19:36:32.000000000 -0400
42670@@ -113,7 +113,7 @@ struct cppi_channel {
42671
42672 /* CPPI DMA controller object */
42673 struct cppi {
42674- struct dma_controller controller;
42675+ const struct dma_controller controller;
42676 struct musb *musb;
42677 void __iomem *mregs; /* Mentor regs */
42678 void __iomem *tibase; /* TI/CPPI regs */
42679diff -urNp linux-2.6.39.2/drivers/usb/otg/msm_otg.c linux-2.6.39.2/drivers/usb/otg/msm_otg.c
42680--- linux-2.6.39.2/drivers/usb/otg/msm_otg.c 2011-05-19 00:06:34.000000000 -0400
42681+++ linux-2.6.39.2/drivers/usb/otg/msm_otg.c 2011-05-22 19:36:32.000000000 -0400
42682@@ -95,7 +95,7 @@ static int ulpi_write(struct otg_transce
42683 return 0;
42684 }
42685
42686-static struct otg_io_access_ops msm_otg_io_ops = {
42687+static const struct otg_io_access_ops msm_otg_io_ops = {
42688 .read = ulpi_read,
42689 .write = ulpi_write,
42690 };
42691diff -urNp linux-2.6.39.2/drivers/usb/otg/ulpi_viewport.c linux-2.6.39.2/drivers/usb/otg/ulpi_viewport.c
42692--- linux-2.6.39.2/drivers/usb/otg/ulpi_viewport.c 2011-05-19 00:06:34.000000000 -0400
42693+++ linux-2.6.39.2/drivers/usb/otg/ulpi_viewport.c 2011-05-22 19:36:32.000000000 -0400
42694@@ -74,7 +74,7 @@ static int ulpi_viewport_write(struct ot
42695 return ulpi_viewport_wait(view, ULPI_VIEW_RUN);
42696 }
42697
42698-struct otg_io_access_ops ulpi_viewport_access_ops = {
42699+const struct otg_io_access_ops ulpi_viewport_access_ops = {
42700 .read = ulpi_viewport_read,
42701 .write = ulpi_viewport_write,
42702 };
42703diff -urNp linux-2.6.39.2/drivers/usb/serial/ftdi_sio.c linux-2.6.39.2/drivers/usb/serial/ftdi_sio.c
42704--- linux-2.6.39.2/drivers/usb/serial/ftdi_sio.c 2011-06-25 12:55:23.000000000 -0400
42705+++ linux-2.6.39.2/drivers/usb/serial/ftdi_sio.c 2011-06-25 13:00:26.000000000 -0400
42706@@ -104,27 +104,27 @@ static int ftdi_stmclite_probe(struct
42707 static void ftdi_USB_UIRT_setup(struct ftdi_private *priv);
42708 static void ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
42709
42710-static struct ftdi_sio_quirk ftdi_jtag_quirk = {
42711+static const struct ftdi_sio_quirk ftdi_jtag_quirk = {
42712 .probe = ftdi_jtag_probe,
42713 };
42714
42715-static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42716+static const struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42717 .probe = ftdi_mtxorb_hack_setup,
42718 };
42719
42720-static struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42721+static const struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42722 .probe = ftdi_NDI_device_setup,
42723 };
42724
42725-static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42726+static const struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42727 .port_probe = ftdi_USB_UIRT_setup,
42728 };
42729
42730-static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42731+static const struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42732 .port_probe = ftdi_HE_TIRA1_setup,
42733 };
42734
42735-static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42736+static const struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42737 .probe = ftdi_stmclite_probe,
42738 };
42739
42740diff -urNp linux-2.6.39.2/drivers/usb/wusbcore/wa-hc.h linux-2.6.39.2/drivers/usb/wusbcore/wa-hc.h
42741--- linux-2.6.39.2/drivers/usb/wusbcore/wa-hc.h 2011-05-19 00:06:34.000000000 -0400
42742+++ linux-2.6.39.2/drivers/usb/wusbcore/wa-hc.h 2011-05-22 19:36:32.000000000 -0400
42743@@ -192,7 +192,7 @@ struct wahc {
42744 struct list_head xfer_delayed_list;
42745 spinlock_t xfer_list_lock;
42746 struct work_struct xfer_work;
42747- atomic_t xfer_id_count;
42748+ atomic_unchecked_t xfer_id_count;
42749 };
42750
42751
42752@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
42753 INIT_LIST_HEAD(&wa->xfer_delayed_list);
42754 spin_lock_init(&wa->xfer_list_lock);
42755 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
42756- atomic_set(&wa->xfer_id_count, 1);
42757+ atomic_set_unchecked(&wa->xfer_id_count, 1);
42758 }
42759
42760 /**
42761diff -urNp linux-2.6.39.2/drivers/usb/wusbcore/wa-xfer.c linux-2.6.39.2/drivers/usb/wusbcore/wa-xfer.c
42762--- linux-2.6.39.2/drivers/usb/wusbcore/wa-xfer.c 2011-05-19 00:06:34.000000000 -0400
42763+++ linux-2.6.39.2/drivers/usb/wusbcore/wa-xfer.c 2011-05-22 19:36:32.000000000 -0400
42764@@ -294,7 +294,7 @@ out:
42765 */
42766 static void wa_xfer_id_init(struct wa_xfer *xfer)
42767 {
42768- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
42769+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
42770 }
42771
42772 /*
42773diff -urNp linux-2.6.39.2/drivers/vhost/vhost.c linux-2.6.39.2/drivers/vhost/vhost.c
42774--- linux-2.6.39.2/drivers/vhost/vhost.c 2011-05-19 00:06:34.000000000 -0400
42775+++ linux-2.6.39.2/drivers/vhost/vhost.c 2011-05-22 19:36:32.000000000 -0400
42776@@ -580,7 +580,7 @@ static int init_used(struct vhost_virtqu
42777 return get_user(vq->last_used_idx, &used->idx);
42778 }
42779
42780-static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
42781+static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
42782 {
42783 struct file *eventfp, *filep = NULL,
42784 *pollstart = NULL, *pollstop = NULL;
42785diff -urNp linux-2.6.39.2/drivers/video/backlight/corgi_lcd.c linux-2.6.39.2/drivers/video/backlight/corgi_lcd.c
42786--- linux-2.6.39.2/drivers/video/backlight/corgi_lcd.c 2011-05-19 00:06:34.000000000 -0400
42787+++ linux-2.6.39.2/drivers/video/backlight/corgi_lcd.c 2011-05-22 19:36:32.000000000 -0400
42788@@ -383,7 +383,7 @@ static int corgi_lcd_get_power(struct lc
42789 return lcd->power;
42790 }
42791
42792-static struct lcd_ops corgi_lcd_ops = {
42793+static const struct lcd_ops corgi_lcd_ops = {
42794 .get_power = corgi_lcd_get_power,
42795 .set_power = corgi_lcd_set_power,
42796 .set_mode = corgi_lcd_set_mode,
42797diff -urNp linux-2.6.39.2/drivers/video/backlight/cr_bllcd.c linux-2.6.39.2/drivers/video/backlight/cr_bllcd.c
42798--- linux-2.6.39.2/drivers/video/backlight/cr_bllcd.c 2011-05-19 00:06:34.000000000 -0400
42799+++ linux-2.6.39.2/drivers/video/backlight/cr_bllcd.c 2011-05-22 19:36:32.000000000 -0400
42800@@ -165,7 +165,7 @@ static int cr_lcd_set_power(struct lcd_d
42801 return 0;
42802 }
42803
42804-static struct lcd_ops cr_lcd_ops = {
42805+static const struct lcd_ops cr_lcd_ops = {
42806 .set_power = cr_lcd_set_power,
42807 };
42808
42809diff -urNp linux-2.6.39.2/drivers/video/backlight/ili9320.c linux-2.6.39.2/drivers/video/backlight/ili9320.c
42810--- linux-2.6.39.2/drivers/video/backlight/ili9320.c 2011-05-19 00:06:34.000000000 -0400
42811+++ linux-2.6.39.2/drivers/video/backlight/ili9320.c 2011-05-22 19:36:32.000000000 -0400
42812@@ -166,7 +166,7 @@ static int ili9320_get_power(struct lcd_
42813 return lcd->power;
42814 }
42815
42816-static struct lcd_ops ili9320_ops = {
42817+static const struct lcd_ops ili9320_ops = {
42818 .get_power = ili9320_get_power,
42819 .set_power = ili9320_set_power,
42820 };
42821diff -urNp linux-2.6.39.2/drivers/video/backlight/jornada720_lcd.c linux-2.6.39.2/drivers/video/backlight/jornada720_lcd.c
42822--- linux-2.6.39.2/drivers/video/backlight/jornada720_lcd.c 2011-05-19 00:06:34.000000000 -0400
42823+++ linux-2.6.39.2/drivers/video/backlight/jornada720_lcd.c 2011-05-22 19:36:32.000000000 -0400
42824@@ -87,7 +87,7 @@ static int jornada_lcd_set_power(struct
42825 return 0;
42826 }
42827
42828-static struct lcd_ops jornada_lcd_props = {
42829+static const struct lcd_ops jornada_lcd_props = {
42830 .get_contrast = jornada_lcd_get_contrast,
42831 .set_contrast = jornada_lcd_set_contrast,
42832 .get_power = jornada_lcd_get_power,
42833diff -urNp linux-2.6.39.2/drivers/video/backlight/l4f00242t03.c linux-2.6.39.2/drivers/video/backlight/l4f00242t03.c
42834--- linux-2.6.39.2/drivers/video/backlight/l4f00242t03.c 2011-05-19 00:06:34.000000000 -0400
42835+++ linux-2.6.39.2/drivers/video/backlight/l4f00242t03.c 2011-05-22 19:36:32.000000000 -0400
42836@@ -149,7 +149,7 @@ static int l4f00242t03_lcd_power_set(str
42837 return 0;
42838 }
42839
42840-static struct lcd_ops l4f_ops = {
42841+static const struct lcd_ops l4f_ops = {
42842 .set_power = l4f00242t03_lcd_power_set,
42843 .get_power = l4f00242t03_lcd_power_get,
42844 };
42845diff -urNp linux-2.6.39.2/drivers/video/backlight/lcd.c linux-2.6.39.2/drivers/video/backlight/lcd.c
42846--- linux-2.6.39.2/drivers/video/backlight/lcd.c 2011-05-19 00:06:34.000000000 -0400
42847+++ linux-2.6.39.2/drivers/video/backlight/lcd.c 2011-05-22 19:36:32.000000000 -0400
42848@@ -192,7 +192,7 @@ static struct device_attribute lcd_devic
42849 * or a pointer to the newly allocated device.
42850 */
42851 struct lcd_device *lcd_device_register(const char *name, struct device *parent,
42852- void *devdata, struct lcd_ops *ops)
42853+ void *devdata, const struct lcd_ops *ops)
42854 {
42855 struct lcd_device *new_ld;
42856 int rc;
42857diff -urNp linux-2.6.39.2/drivers/video/backlight/ld9040.c linux-2.6.39.2/drivers/video/backlight/ld9040.c
42858--- linux-2.6.39.2/drivers/video/backlight/ld9040.c 2011-05-19 00:06:34.000000000 -0400
42859+++ linux-2.6.39.2/drivers/video/backlight/ld9040.c 2011-05-22 19:36:32.000000000 -0400
42860@@ -651,7 +651,7 @@ static int ld9040_set_brightness(struct
42861 return ret;
42862 }
42863
42864-static struct lcd_ops ld9040_lcd_ops = {
42865+static const struct lcd_ops ld9040_lcd_ops = {
42866 .set_power = ld9040_set_power,
42867 .get_power = ld9040_get_power,
42868 };
42869diff -urNp linux-2.6.39.2/drivers/video/backlight/lms283gf05.c linux-2.6.39.2/drivers/video/backlight/lms283gf05.c
42870--- linux-2.6.39.2/drivers/video/backlight/lms283gf05.c 2011-05-19 00:06:34.000000000 -0400
42871+++ linux-2.6.39.2/drivers/video/backlight/lms283gf05.c 2011-05-22 19:36:32.000000000 -0400
42872@@ -144,7 +144,7 @@ static int lms283gf05_power_set(struct l
42873 return 0;
42874 }
42875
42876-static struct lcd_ops lms_ops = {
42877+static const struct lcd_ops lms_ops = {
42878 .set_power = lms283gf05_power_set,
42879 .get_power = NULL,
42880 };
42881diff -urNp linux-2.6.39.2/drivers/video/backlight/ltv350qv.c linux-2.6.39.2/drivers/video/backlight/ltv350qv.c
42882--- linux-2.6.39.2/drivers/video/backlight/ltv350qv.c 2011-05-19 00:06:34.000000000 -0400
42883+++ linux-2.6.39.2/drivers/video/backlight/ltv350qv.c 2011-05-22 19:36:32.000000000 -0400
42884@@ -221,7 +221,7 @@ static int ltv350qv_get_power(struct lcd
42885 return lcd->power;
42886 }
42887
42888-static struct lcd_ops ltv_ops = {
42889+static const struct lcd_ops ltv_ops = {
42890 .get_power = ltv350qv_get_power,
42891 .set_power = ltv350qv_set_power,
42892 };
42893diff -urNp linux-2.6.39.2/drivers/video/backlight/platform_lcd.c linux-2.6.39.2/drivers/video/backlight/platform_lcd.c
42894--- linux-2.6.39.2/drivers/video/backlight/platform_lcd.c 2011-05-19 00:06:34.000000000 -0400
42895+++ linux-2.6.39.2/drivers/video/backlight/platform_lcd.c 2011-05-22 19:36:32.000000000 -0400
42896@@ -66,7 +66,7 @@ static int platform_lcd_match(struct lcd
42897 return plcd->us->parent == info->device;
42898 }
42899
42900-static struct lcd_ops platform_lcd_ops = {
42901+static const struct lcd_ops platform_lcd_ops = {
42902 .get_power = platform_lcd_get_power,
42903 .set_power = platform_lcd_set_power,
42904 .check_fb = platform_lcd_match,
42905diff -urNp linux-2.6.39.2/drivers/video/backlight/s6e63m0.c linux-2.6.39.2/drivers/video/backlight/s6e63m0.c
42906--- linux-2.6.39.2/drivers/video/backlight/s6e63m0.c 2011-05-19 00:06:34.000000000 -0400
42907+++ linux-2.6.39.2/drivers/video/backlight/s6e63m0.c 2011-05-22 19:36:32.000000000 -0400
42908@@ -644,7 +644,7 @@ static int s6e63m0_set_brightness(struct
42909 return ret;
42910 }
42911
42912-static struct lcd_ops s6e63m0_lcd_ops = {
42913+static const struct lcd_ops s6e63m0_lcd_ops = {
42914 .set_power = s6e63m0_set_power,
42915 .get_power = s6e63m0_get_power,
42916 };
42917diff -urNp linux-2.6.39.2/drivers/video/backlight/tdo24m.c linux-2.6.39.2/drivers/video/backlight/tdo24m.c
42918--- linux-2.6.39.2/drivers/video/backlight/tdo24m.c 2011-05-19 00:06:34.000000000 -0400
42919+++ linux-2.6.39.2/drivers/video/backlight/tdo24m.c 2011-05-22 19:36:32.000000000 -0400
42920@@ -322,7 +322,7 @@ static int tdo24m_set_mode(struct lcd_de
42921 return lcd->adj_mode(lcd, mode);
42922 }
42923
42924-static struct lcd_ops tdo24m_ops = {
42925+static const struct lcd_ops tdo24m_ops = {
42926 .get_power = tdo24m_get_power,
42927 .set_power = tdo24m_set_power,
42928 .set_mode = tdo24m_set_mode,
42929diff -urNp linux-2.6.39.2/drivers/video/backlight/tosa_lcd.c linux-2.6.39.2/drivers/video/backlight/tosa_lcd.c
42930--- linux-2.6.39.2/drivers/video/backlight/tosa_lcd.c 2011-05-19 00:06:34.000000000 -0400
42931+++ linux-2.6.39.2/drivers/video/backlight/tosa_lcd.c 2011-05-22 19:36:32.000000000 -0400
42932@@ -163,7 +163,7 @@ static int tosa_lcd_set_mode(struct lcd_
42933 return 0;
42934 }
42935
42936-static struct lcd_ops tosa_lcd_ops = {
42937+static const struct lcd_ops tosa_lcd_ops = {
42938 .set_power = tosa_lcd_set_power,
42939 .get_power = tosa_lcd_get_power,
42940 .set_mode = tosa_lcd_set_mode,
42941diff -urNp linux-2.6.39.2/drivers/video/bf537-lq035.c linux-2.6.39.2/drivers/video/bf537-lq035.c
42942--- linux-2.6.39.2/drivers/video/bf537-lq035.c 2011-05-19 00:06:34.000000000 -0400
42943+++ linux-2.6.39.2/drivers/video/bf537-lq035.c 2011-05-22 19:36:32.000000000 -0400
42944@@ -682,7 +682,7 @@ static int bfin_lcd_check_fb(struct lcd_
42945 return 0;
42946 }
42947
42948-static struct lcd_ops bfin_lcd_ops = {
42949+static const struct lcd_ops bfin_lcd_ops = {
42950 .get_power = bfin_lcd_get_power,
42951 .set_power = bfin_lcd_set_power,
42952 .get_contrast = bfin_lcd_get_contrast,
42953diff -urNp linux-2.6.39.2/drivers/video/bf54x-lq043fb.c linux-2.6.39.2/drivers/video/bf54x-lq043fb.c
42954--- linux-2.6.39.2/drivers/video/bf54x-lq043fb.c 2011-05-19 00:06:34.000000000 -0400
42955+++ linux-2.6.39.2/drivers/video/bf54x-lq043fb.c 2011-05-22 19:36:32.000000000 -0400
42956@@ -467,7 +467,7 @@ static int bfin_lcd_check_fb(struct lcd_
42957 return 0;
42958 }
42959
42960-static struct lcd_ops bfin_lcd_ops = {
42961+static const struct lcd_ops bfin_lcd_ops = {
42962 .get_power = bfin_lcd_get_power,
42963 .set_power = bfin_lcd_set_power,
42964 .get_contrast = bfin_lcd_get_contrast,
42965diff -urNp linux-2.6.39.2/drivers/video/bfin-t350mcqb-fb.c linux-2.6.39.2/drivers/video/bfin-t350mcqb-fb.c
42966--- linux-2.6.39.2/drivers/video/bfin-t350mcqb-fb.c 2011-05-19 00:06:34.000000000 -0400
42967+++ linux-2.6.39.2/drivers/video/bfin-t350mcqb-fb.c 2011-05-22 19:36:32.000000000 -0400
42968@@ -387,7 +387,7 @@ static int bfin_lcd_check_fb(struct lcd_
42969 return 0;
42970 }
42971
42972-static struct lcd_ops bfin_lcd_ops = {
42973+static const struct lcd_ops bfin_lcd_ops = {
42974 .get_power = bfin_lcd_get_power,
42975 .set_power = bfin_lcd_set_power,
42976 .get_contrast = bfin_lcd_get_contrast,
42977diff -urNp linux-2.6.39.2/drivers/video/fbcmap.c linux-2.6.39.2/drivers/video/fbcmap.c
42978--- linux-2.6.39.2/drivers/video/fbcmap.c 2011-05-19 00:06:34.000000000 -0400
42979+++ linux-2.6.39.2/drivers/video/fbcmap.c 2011-05-22 19:36:32.000000000 -0400
42980@@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
42981 rc = -ENODEV;
42982 goto out;
42983 }
42984- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
42985- !info->fbops->fb_setcmap)) {
42986+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
42987 rc = -EINVAL;
42988 goto out1;
42989 }
42990diff -urNp linux-2.6.39.2/drivers/video/fbmem.c linux-2.6.39.2/drivers/video/fbmem.c
42991--- linux-2.6.39.2/drivers/video/fbmem.c 2011-05-19 00:06:34.000000000 -0400
42992+++ linux-2.6.39.2/drivers/video/fbmem.c 2011-05-22 19:36:32.000000000 -0400
42993@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in
42994 image->dx += image->width + 8;
42995 }
42996 } else if (rotate == FB_ROTATE_UD) {
42997- for (x = 0; x < num && image->dx >= 0; x++) {
42998+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
42999 info->fbops->fb_imageblit(info, image);
43000 image->dx -= image->width + 8;
43001 }
43002@@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in
43003 image->dy += image->height + 8;
43004 }
43005 } else if (rotate == FB_ROTATE_CCW) {
43006- for (x = 0; x < num && image->dy >= 0; x++) {
43007+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
43008 info->fbops->fb_imageblit(info, image);
43009 image->dy -= image->height + 8;
43010 }
43011@@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct
43012 int flags = info->flags;
43013 int ret = 0;
43014
43015+ pax_track_stack();
43016+
43017 if (var->activate & FB_ACTIVATE_INV_MODE) {
43018 struct fb_videomode mode1, mode2;
43019
43020@@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *
43021 void __user *argp = (void __user *)arg;
43022 long ret = 0;
43023
43024+ pax_track_stack();
43025+
43026 switch (cmd) {
43027 case FBIOGET_VSCREENINFO:
43028 if (!lock_fb_info(info))
43029@@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *
43030 return -EFAULT;
43031 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
43032 return -EINVAL;
43033- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
43034+ if (con2fb.framebuffer >= FB_MAX)
43035 return -EINVAL;
43036 if (!registered_fb[con2fb.framebuffer])
43037 request_module("fb%d", con2fb.framebuffer);
43038diff -urNp linux-2.6.39.2/drivers/video/geode/display_gx1.c linux-2.6.39.2/drivers/video/geode/display_gx1.c
43039--- linux-2.6.39.2/drivers/video/geode/display_gx1.c 2011-05-19 00:06:34.000000000 -0400
43040+++ linux-2.6.39.2/drivers/video/geode/display_gx1.c 2011-05-22 19:36:32.000000000 -0400
43041@@ -208,7 +208,7 @@ static void gx1_set_hw_palette_reg(struc
43042 writel(val, par->dc_regs + DC_PAL_DATA);
43043 }
43044
43045-struct geode_dc_ops gx1_dc_ops = {
43046+const struct geode_dc_ops gx1_dc_ops = {
43047 .set_mode = gx1_set_mode,
43048 .set_palette_reg = gx1_set_hw_palette_reg,
43049 };
43050diff -urNp linux-2.6.39.2/drivers/video/geode/display_gx1.h linux-2.6.39.2/drivers/video/geode/display_gx1.h
43051--- linux-2.6.39.2/drivers/video/geode/display_gx1.h 2011-05-19 00:06:34.000000000 -0400
43052+++ linux-2.6.39.2/drivers/video/geode/display_gx1.h 2011-05-22 19:36:32.000000000 -0400
43053@@ -18,7 +18,7 @@
43054 unsigned gx1_gx_base(void);
43055 int gx1_frame_buffer_size(void);
43056
43057-extern struct geode_dc_ops gx1_dc_ops;
43058+extern const struct geode_dc_ops gx1_dc_ops;
43059
43060 /* GX1 configuration I/O registers */
43061
43062diff -urNp linux-2.6.39.2/drivers/video/geode/geodefb.h linux-2.6.39.2/drivers/video/geode/geodefb.h
43063--- linux-2.6.39.2/drivers/video/geode/geodefb.h 2011-05-19 00:06:34.000000000 -0400
43064+++ linux-2.6.39.2/drivers/video/geode/geodefb.h 2011-05-22 19:36:32.000000000 -0400
43065@@ -31,8 +31,8 @@ struct geodefb_par {
43066 int panel_y;
43067 void __iomem *dc_regs;
43068 void __iomem *vid_regs;
43069- struct geode_dc_ops *dc_ops;
43070- struct geode_vid_ops *vid_ops;
43071+ const struct geode_dc_ops *dc_ops;
43072+ const struct geode_vid_ops *vid_ops;
43073 };
43074
43075 #endif /* !__GEODEFB_H__ */
43076diff -urNp linux-2.6.39.2/drivers/video/geode/video_cs5530.c linux-2.6.39.2/drivers/video/geode/video_cs5530.c
43077--- linux-2.6.39.2/drivers/video/geode/video_cs5530.c 2011-05-19 00:06:34.000000000 -0400
43078+++ linux-2.6.39.2/drivers/video/geode/video_cs5530.c 2011-05-22 19:36:32.000000000 -0400
43079@@ -186,7 +186,7 @@ static int cs5530_blank_display(struct f
43080 return 0;
43081 }
43082
43083-struct geode_vid_ops cs5530_vid_ops = {
43084+const struct geode_vid_ops cs5530_vid_ops = {
43085 .set_dclk = cs5530_set_dclk_frequency,
43086 .configure_display = cs5530_configure_display,
43087 .blank_display = cs5530_blank_display,
43088diff -urNp linux-2.6.39.2/drivers/video/geode/video_cs5530.h linux-2.6.39.2/drivers/video/geode/video_cs5530.h
43089--- linux-2.6.39.2/drivers/video/geode/video_cs5530.h 2011-05-19 00:06:34.000000000 -0400
43090+++ linux-2.6.39.2/drivers/video/geode/video_cs5530.h 2011-05-22 19:36:32.000000000 -0400
43091@@ -15,7 +15,7 @@
43092 #ifndef __VIDEO_CS5530_H__
43093 #define __VIDEO_CS5530_H__
43094
43095-extern struct geode_vid_ops cs5530_vid_ops;
43096+extern const struct geode_vid_ops cs5530_vid_ops;
43097
43098 /* CS5530 Video device registers */
43099
43100diff -urNp linux-2.6.39.2/drivers/video/i810/i810_accel.c linux-2.6.39.2/drivers/video/i810/i810_accel.c
43101--- linux-2.6.39.2/drivers/video/i810/i810_accel.c 2011-05-19 00:06:34.000000000 -0400
43102+++ linux-2.6.39.2/drivers/video/i810/i810_accel.c 2011-05-22 19:36:32.000000000 -0400
43103@@ -73,6 +73,7 @@ static inline int wait_for_space(struct
43104 }
43105 }
43106 printk("ringbuffer lockup!!!\n");
43107+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
43108 i810_report_error(mmio);
43109 par->dev_flags |= LOCKUP;
43110 info->pixmap.scan_align = 1;
43111diff -urNp linux-2.6.39.2/drivers/video/matrox/matroxfb_base.c linux-2.6.39.2/drivers/video/matrox/matroxfb_base.c
43112--- linux-2.6.39.2/drivers/video/matrox/matroxfb_base.c 2011-05-19 00:06:34.000000000 -0400
43113+++ linux-2.6.39.2/drivers/video/matrox/matroxfb_base.c 2011-05-22 19:36:32.000000000 -0400
43114@@ -1232,7 +1232,7 @@ static struct fb_ops matroxfb_ops = {
43115 #define RSText 0x7
43116 #define RSText8 0x8
43117 /* 9-F */
43118-static struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
43119+static const struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
43120 { { 0, 8, 0}, { 0, 8, 0}, { 0, 8, 0}, { 0, 0, 0}, 8 },
43121 { { 10, 5, 0}, { 5, 5, 0}, { 0, 5, 0}, { 15, 1, 0}, 16 },
43122 { { 11, 5, 0}, { 5, 6, 0}, { 0, 5, 0}, { 0, 0, 0}, 16 },
43123diff -urNp linux-2.6.39.2/drivers/video/omap/lcd_ams_delta.c linux-2.6.39.2/drivers/video/omap/lcd_ams_delta.c
43124--- linux-2.6.39.2/drivers/video/omap/lcd_ams_delta.c 2011-05-19 00:06:34.000000000 -0400
43125+++ linux-2.6.39.2/drivers/video/omap/lcd_ams_delta.c 2011-05-22 19:36:32.000000000 -0400
43126@@ -87,7 +87,7 @@ static int ams_delta_lcd_get_contrast(st
43127 return ams_delta_lcd & AMS_DELTA_MAX_CONTRAST;
43128 }
43129
43130-static struct lcd_ops ams_delta_lcd_ops = {
43131+static const struct lcd_ops ams_delta_lcd_ops = {
43132 .get_power = ams_delta_lcd_get_power,
43133 .set_power = ams_delta_lcd_set_power,
43134 .get_contrast = ams_delta_lcd_get_contrast,
43135diff -urNp linux-2.6.39.2/drivers/video/pxa3xx-gcu.c linux-2.6.39.2/drivers/video/pxa3xx-gcu.c
43136--- linux-2.6.39.2/drivers/video/pxa3xx-gcu.c 2011-05-19 00:06:34.000000000 -0400
43137+++ linux-2.6.39.2/drivers/video/pxa3xx-gcu.c 2011-05-22 19:36:32.000000000 -0400
43138@@ -103,7 +103,7 @@ struct pxa3xx_gcu_priv {
43139 dma_addr_t shared_phys;
43140 struct resource *resource_mem;
43141 struct miscdevice misc_dev;
43142- struct file_operations misc_fops;
43143+ const struct file_operations misc_fops;
43144 wait_queue_head_t wait_idle;
43145 wait_queue_head_t wait_free;
43146 spinlock_t spinlock;
43147diff -urNp linux-2.6.39.2/drivers/video/sh_mobile_lcdcfb.c linux-2.6.39.2/drivers/video/sh_mobile_lcdcfb.c
43148--- linux-2.6.39.2/drivers/video/sh_mobile_lcdcfb.c 2011-05-19 00:06:34.000000000 -0400
43149+++ linux-2.6.39.2/drivers/video/sh_mobile_lcdcfb.c 2011-05-22 19:36:32.000000000 -0400
43150@@ -245,7 +245,7 @@ static unsigned long lcdc_sys_read_data(
43151 return lcdc_read(ch->lcdc, _LDDRDR) & 0x3ffff;
43152 }
43153
43154-struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
43155+const struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
43156 lcdc_sys_write_index,
43157 lcdc_sys_write_data,
43158 lcdc_sys_read_data,
43159diff -urNp linux-2.6.39.2/drivers/video/udlfb.c linux-2.6.39.2/drivers/video/udlfb.c
43160--- linux-2.6.39.2/drivers/video/udlfb.c 2011-05-19 00:06:34.000000000 -0400
43161+++ linux-2.6.39.2/drivers/video/udlfb.c 2011-05-22 19:36:32.000000000 -0400
43162@@ -584,11 +584,11 @@ int dlfb_handle_damage(struct dlfb_data
43163 dlfb_urb_completion(urb);
43164
43165 error:
43166- atomic_add(bytes_sent, &dev->bytes_sent);
43167- atomic_add(bytes_identical, &dev->bytes_identical);
43168- atomic_add(width*height*2, &dev->bytes_rendered);
43169+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
43170+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
43171+ atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
43172 end_cycles = get_cycles();
43173- atomic_add(((unsigned int) ((end_cycles - start_cycles)
43174+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
43175 >> 10)), /* Kcycles */
43176 &dev->cpu_kcycles_used);
43177
43178@@ -709,11 +709,11 @@ static void dlfb_dpy_deferred_io(struct
43179 dlfb_urb_completion(urb);
43180
43181 error:
43182- atomic_add(bytes_sent, &dev->bytes_sent);
43183- atomic_add(bytes_identical, &dev->bytes_identical);
43184- atomic_add(bytes_rendered, &dev->bytes_rendered);
43185+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
43186+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
43187+ atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
43188 end_cycles = get_cycles();
43189- atomic_add(((unsigned int) ((end_cycles - start_cycles)
43190+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
43191 >> 10)), /* Kcycles */
43192 &dev->cpu_kcycles_used);
43193 }
43194@@ -1301,7 +1301,7 @@ static ssize_t metrics_bytes_rendered_sh
43195 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43196 struct dlfb_data *dev = fb_info->par;
43197 return snprintf(buf, PAGE_SIZE, "%u\n",
43198- atomic_read(&dev->bytes_rendered));
43199+ atomic_read_unchecked(&dev->bytes_rendered));
43200 }
43201
43202 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
43203@@ -1309,7 +1309,7 @@ static ssize_t metrics_bytes_identical_s
43204 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43205 struct dlfb_data *dev = fb_info->par;
43206 return snprintf(buf, PAGE_SIZE, "%u\n",
43207- atomic_read(&dev->bytes_identical));
43208+ atomic_read_unchecked(&dev->bytes_identical));
43209 }
43210
43211 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
43212@@ -1317,7 +1317,7 @@ static ssize_t metrics_bytes_sent_show(s
43213 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43214 struct dlfb_data *dev = fb_info->par;
43215 return snprintf(buf, PAGE_SIZE, "%u\n",
43216- atomic_read(&dev->bytes_sent));
43217+ atomic_read_unchecked(&dev->bytes_sent));
43218 }
43219
43220 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
43221@@ -1325,7 +1325,7 @@ static ssize_t metrics_cpu_kcycles_used_
43222 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43223 struct dlfb_data *dev = fb_info->par;
43224 return snprintf(buf, PAGE_SIZE, "%u\n",
43225- atomic_read(&dev->cpu_kcycles_used));
43226+ atomic_read_unchecked(&dev->cpu_kcycles_used));
43227 }
43228
43229 static ssize_t edid_show(
43230@@ -1382,10 +1382,10 @@ static ssize_t metrics_reset_store(struc
43231 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43232 struct dlfb_data *dev = fb_info->par;
43233
43234- atomic_set(&dev->bytes_rendered, 0);
43235- atomic_set(&dev->bytes_identical, 0);
43236- atomic_set(&dev->bytes_sent, 0);
43237- atomic_set(&dev->cpu_kcycles_used, 0);
43238+ atomic_set_unchecked(&dev->bytes_rendered, 0);
43239+ atomic_set_unchecked(&dev->bytes_identical, 0);
43240+ atomic_set_unchecked(&dev->bytes_sent, 0);
43241+ atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
43242
43243 return count;
43244 }
43245diff -urNp linux-2.6.39.2/drivers/video/uvesafb.c linux-2.6.39.2/drivers/video/uvesafb.c
43246--- linux-2.6.39.2/drivers/video/uvesafb.c 2011-05-19 00:06:34.000000000 -0400
43247+++ linux-2.6.39.2/drivers/video/uvesafb.c 2011-05-22 19:36:32.000000000 -0400
43248@@ -19,6 +19,7 @@
43249 #include <linux/io.h>
43250 #include <linux/mutex.h>
43251 #include <linux/slab.h>
43252+#include <linux/moduleloader.h>
43253 #include <video/edid.h>
43254 #include <video/uvesafb.h>
43255 #ifdef CONFIG_X86
43256@@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
43257 NULL,
43258 };
43259
43260- return call_usermodehelper(v86d_path, argv, envp, 1);
43261+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
43262 }
43263
43264 /*
43265@@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(
43266 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
43267 par->pmi_setpal = par->ypan = 0;
43268 } else {
43269+
43270+#ifdef CONFIG_PAX_KERNEXEC
43271+#ifdef CONFIG_MODULES
43272+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
43273+#endif
43274+ if (!par->pmi_code) {
43275+ par->pmi_setpal = par->ypan = 0;
43276+ return 0;
43277+ }
43278+#endif
43279+
43280 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
43281 + task->t.regs.edi);
43282+
43283+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43284+ pax_open_kernel();
43285+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
43286+ pax_close_kernel();
43287+
43288+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
43289+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
43290+#else
43291 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
43292 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
43293+#endif
43294+
43295 printk(KERN_INFO "uvesafb: protected mode interface info at "
43296 "%04x:%04x\n",
43297 (u16)task->t.regs.es, (u16)task->t.regs.edi);
43298@@ -1821,6 +1844,11 @@ out:
43299 if (par->vbe_modes)
43300 kfree(par->vbe_modes);
43301
43302+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43303+ if (par->pmi_code)
43304+ module_free_exec(NULL, par->pmi_code);
43305+#endif
43306+
43307 framebuffer_release(info);
43308 return err;
43309 }
43310@@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor
43311 kfree(par->vbe_state_orig);
43312 if (par->vbe_state_saved)
43313 kfree(par->vbe_state_saved);
43314+
43315+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43316+ if (par->pmi_code)
43317+ module_free_exec(NULL, par->pmi_code);
43318+#endif
43319+
43320 }
43321
43322 framebuffer_release(info);
43323@@ -2013,7 +2047,7 @@ static int param_set_scroll(const char *
43324
43325 return 0;
43326 }
43327-static struct kernel_param_ops param_ops_scroll = {
43328+static const struct kernel_param_ops param_ops_scroll = {
43329 .set = param_set_scroll,
43330 };
43331 #define param_check_scroll(name, p) __param_check(name, p, void)
43332diff -urNp linux-2.6.39.2/drivers/video/vesafb.c linux-2.6.39.2/drivers/video/vesafb.c
43333--- linux-2.6.39.2/drivers/video/vesafb.c 2011-05-19 00:06:34.000000000 -0400
43334+++ linux-2.6.39.2/drivers/video/vesafb.c 2011-05-22 19:36:32.000000000 -0400
43335@@ -9,6 +9,7 @@
43336 */
43337
43338 #include <linux/module.h>
43339+#include <linux/moduleloader.h>
43340 #include <linux/kernel.h>
43341 #include <linux/errno.h>
43342 #include <linux/string.h>
43343@@ -52,8 +53,8 @@ static int vram_remap __initdata; /*
43344 static int vram_total __initdata; /* Set total amount of memory */
43345 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
43346 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
43347-static void (*pmi_start)(void) __read_mostly;
43348-static void (*pmi_pal) (void) __read_mostly;
43349+static void (*pmi_start)(void) __read_only;
43350+static void (*pmi_pal) (void) __read_only;
43351 static int depth __read_mostly;
43352 static int vga_compat __read_mostly;
43353 /* --------------------------------------------------------------------- */
43354@@ -232,6 +233,7 @@ static int __init vesafb_probe(struct pl
43355 unsigned int size_vmode;
43356 unsigned int size_remap;
43357 unsigned int size_total;
43358+ void *pmi_code = NULL;
43359
43360 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
43361 return -ENODEV;
43362@@ -274,10 +276,6 @@ static int __init vesafb_probe(struct pl
43363 size_remap = size_total;
43364 vesafb_fix.smem_len = size_remap;
43365
43366-#ifndef __i386__
43367- screen_info.vesapm_seg = 0;
43368-#endif
43369-
43370 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
43371 printk(KERN_WARNING
43372 "vesafb: cannot reserve video memory at 0x%lx\n",
43373@@ -306,9 +304,21 @@ static int __init vesafb_probe(struct pl
43374 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
43375 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
43376
43377+#ifdef __i386__
43378+
43379+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43380+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
43381+ if (!pmi_code)
43382+#elif !defined(CONFIG_PAX_KERNEXEC)
43383+ if (0)
43384+#endif
43385+
43386+#endif
43387+ screen_info.vesapm_seg = 0;
43388+
43389 if (screen_info.vesapm_seg) {
43390- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
43391- screen_info.vesapm_seg,screen_info.vesapm_off);
43392+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
43393+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
43394 }
43395
43396 if (screen_info.vesapm_seg < 0xc000)
43397@@ -316,9 +326,25 @@ static int __init vesafb_probe(struct pl
43398
43399 if (ypan || pmi_setpal) {
43400 unsigned short *pmi_base;
43401- pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43402- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
43403- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
43404+
43405+ pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43406+
43407+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43408+ pax_open_kernel();
43409+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
43410+#else
43411+ pmi_code = pmi_base;
43412+#endif
43413+
43414+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
43415+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
43416+
43417+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43418+ pmi_start = ktva_ktla(pmi_start);
43419+ pmi_pal = ktva_ktla(pmi_pal);
43420+ pax_close_kernel();
43421+#endif
43422+
43423 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
43424 if (pmi_base[3]) {
43425 printk(KERN_INFO "vesafb: pmi: ports = ");
43426@@ -487,6 +513,11 @@ static int __init vesafb_probe(struct pl
43427 info->node, info->fix.id);
43428 return 0;
43429 err:
43430+
43431+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43432+ module_free_exec(NULL, pmi_code);
43433+#endif
43434+
43435 if (info->screen_base)
43436 iounmap(info->screen_base);
43437 framebuffer_release(info);
43438diff -urNp linux-2.6.39.2/drivers/virtio/virtio_balloon.c linux-2.6.39.2/drivers/virtio/virtio_balloon.c
43439--- linux-2.6.39.2/drivers/virtio/virtio_balloon.c 2011-05-19 00:06:34.000000000 -0400
43440+++ linux-2.6.39.2/drivers/virtio/virtio_balloon.c 2011-05-22 19:36:32.000000000 -0400
43441@@ -176,6 +176,8 @@ static void update_balloon_stats(struct
43442 struct sysinfo i;
43443 int idx = 0;
43444
43445+ pax_track_stack();
43446+
43447 all_vm_events(events);
43448 si_meminfo(&i);
43449
43450diff -urNp linux-2.6.39.2/drivers/xen/gntalloc.c linux-2.6.39.2/drivers/xen/gntalloc.c
43451--- linux-2.6.39.2/drivers/xen/gntalloc.c 2011-05-19 00:06:34.000000000 -0400
43452+++ linux-2.6.39.2/drivers/xen/gntalloc.c 2011-05-22 19:36:32.000000000 -0400
43453@@ -440,7 +440,7 @@ static void gntalloc_vma_close(struct vm
43454 spin_unlock(&gref_lock);
43455 }
43456
43457-static struct vm_operations_struct gntalloc_vmops = {
43458+static const struct vm_operations_struct gntalloc_vmops = {
43459 .close = gntalloc_vma_close,
43460 };
43461
43462diff -urNp linux-2.6.39.2/drivers/xen/gntdev.c linux-2.6.39.2/drivers/xen/gntdev.c
43463--- linux-2.6.39.2/drivers/xen/gntdev.c 2011-05-19 00:06:34.000000000 -0400
43464+++ linux-2.6.39.2/drivers/xen/gntdev.c 2011-05-22 19:36:32.000000000 -0400
43465@@ -340,7 +340,7 @@ static void gntdev_vma_close(struct vm_a
43466 gntdev_put_map(map);
43467 }
43468
43469-static struct vm_operations_struct gntdev_vmops = {
43470+static const struct vm_operations_struct gntdev_vmops = {
43471 .close = gntdev_vma_close,
43472 };
43473
43474@@ -404,7 +404,7 @@ static void mn_release(struct mmu_notifi
43475 spin_unlock(&priv->lock);
43476 }
43477
43478-struct mmu_notifier_ops gntdev_mmu_ops = {
43479+const struct mmu_notifier_ops gntdev_mmu_ops = {
43480 .release = mn_release,
43481 .invalidate_page = mn_invl_page,
43482 .invalidate_range_start = mn_invl_range_start,
43483diff -urNp linux-2.6.39.2/drivers/xen/xenfs/privcmd.c linux-2.6.39.2/drivers/xen/xenfs/privcmd.c
43484--- linux-2.6.39.2/drivers/xen/xenfs/privcmd.c 2011-05-19 00:06:34.000000000 -0400
43485+++ linux-2.6.39.2/drivers/xen/xenfs/privcmd.c 2011-05-22 19:36:32.000000000 -0400
43486@@ -268,7 +268,7 @@ static int mmap_return_errors(void *data
43487 return put_user(*mfnp, st->user++);
43488 }
43489
43490-static struct vm_operations_struct privcmd_vm_ops;
43491+static const struct vm_operations_struct privcmd_vm_ops;
43492
43493 static long privcmd_ioctl_mmap_batch(void __user *udata)
43494 {
43495@@ -369,7 +369,7 @@ static int privcmd_fault(struct vm_area_
43496 return VM_FAULT_SIGBUS;
43497 }
43498
43499-static struct vm_operations_struct privcmd_vm_ops = {
43500+static const struct vm_operations_struct privcmd_vm_ops = {
43501 .fault = privcmd_fault
43502 };
43503
43504diff -urNp linux-2.6.39.2/fs/9p/vfs_inode.c linux-2.6.39.2/fs/9p/vfs_inode.c
43505--- linux-2.6.39.2/fs/9p/vfs_inode.c 2011-05-19 00:06:34.000000000 -0400
43506+++ linux-2.6.39.2/fs/9p/vfs_inode.c 2011-05-22 19:36:32.000000000 -0400
43507@@ -1210,7 +1210,7 @@ static void *v9fs_vfs_follow_link(struct
43508 void
43509 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43510 {
43511- char *s = nd_get_link(nd);
43512+ const char *s = nd_get_link(nd);
43513
43514 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
43515 IS_ERR(s) ? "<error>" : s);
43516diff -urNp linux-2.6.39.2/fs/aio.c linux-2.6.39.2/fs/aio.c
43517--- linux-2.6.39.2/fs/aio.c 2011-05-19 00:06:34.000000000 -0400
43518+++ linux-2.6.39.2/fs/aio.c 2011-06-03 01:00:34.000000000 -0400
43519@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx
43520 size += sizeof(struct io_event) * nr_events;
43521 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
43522
43523- if (nr_pages < 0)
43524+ if (nr_pages <= 0)
43525 return -EINVAL;
43526
43527 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
43528@@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct
43529 struct aio_timeout to;
43530 int retry = 0;
43531
43532+ pax_track_stack();
43533+
43534 /* needed to zero any padding within an entry (there shouldn't be
43535 * any, but C is fun!
43536 */
43537@@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *i
43538 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
43539 {
43540 ssize_t ret;
43541+ struct iovec iovstack;
43542
43543 #ifdef CONFIG_COMPAT
43544 if (compat)
43545 ret = compat_rw_copy_check_uvector(type,
43546 (struct compat_iovec __user *)kiocb->ki_buf,
43547- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
43548+ kiocb->ki_nbytes, 1, &iovstack,
43549 &kiocb->ki_iovec);
43550 else
43551 #endif
43552 ret = rw_copy_check_uvector(type,
43553 (struct iovec __user *)kiocb->ki_buf,
43554- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
43555+ kiocb->ki_nbytes, 1, &iovstack,
43556 &kiocb->ki_iovec);
43557 if (ret < 0)
43558 goto out;
43559
43560+ if (kiocb->ki_iovec == &iovstack) {
43561+ kiocb->ki_inline_vec = iovstack;
43562+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
43563+ }
43564 kiocb->ki_nr_segs = kiocb->ki_nbytes;
43565 kiocb->ki_cur_seg = 0;
43566 /* ki_nbytes/left now reflect bytes instead of segs */
43567diff -urNp linux-2.6.39.2/fs/attr.c linux-2.6.39.2/fs/attr.c
43568--- linux-2.6.39.2/fs/attr.c 2011-05-19 00:06:34.000000000 -0400
43569+++ linux-2.6.39.2/fs/attr.c 2011-05-22 19:41:37.000000000 -0400
43570@@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode
43571 unsigned long limit;
43572
43573 limit = rlimit(RLIMIT_FSIZE);
43574+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
43575 if (limit != RLIM_INFINITY && offset > limit)
43576 goto out_sig;
43577 if (offset > inode->i_sb->s_maxbytes)
43578diff -urNp linux-2.6.39.2/fs/befs/linuxvfs.c linux-2.6.39.2/fs/befs/linuxvfs.c
43579--- linux-2.6.39.2/fs/befs/linuxvfs.c 2011-05-19 00:06:34.000000000 -0400
43580+++ linux-2.6.39.2/fs/befs/linuxvfs.c 2011-05-22 19:36:32.000000000 -0400
43581@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
43582 {
43583 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
43584 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
43585- char *link = nd_get_link(nd);
43586+ const char *link = nd_get_link(nd);
43587 if (!IS_ERR(link))
43588 kfree(link);
43589 }
43590diff -urNp linux-2.6.39.2/fs/binfmt_aout.c linux-2.6.39.2/fs/binfmt_aout.c
43591--- linux-2.6.39.2/fs/binfmt_aout.c 2011-05-19 00:06:34.000000000 -0400
43592+++ linux-2.6.39.2/fs/binfmt_aout.c 2011-05-22 19:41:37.000000000 -0400
43593@@ -16,6 +16,7 @@
43594 #include <linux/string.h>
43595 #include <linux/fs.h>
43596 #include <linux/file.h>
43597+#include <linux/security.h>
43598 #include <linux/stat.h>
43599 #include <linux/fcntl.h>
43600 #include <linux/ptrace.h>
43601@@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum
43602 #endif
43603 # define START_STACK(u) ((void __user *)u.start_stack)
43604
43605+ memset(&dump, 0, sizeof(dump));
43606+
43607 fs = get_fs();
43608 set_fs(KERNEL_DS);
43609 has_dumped = 1;
43610@@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum
43611
43612 /* If the size of the dump file exceeds the rlimit, then see what would happen
43613 if we wrote the stack, but not the data area. */
43614+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
43615 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
43616 dump.u_dsize = 0;
43617
43618 /* Make sure we have enough room to write the stack and data areas. */
43619+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
43620 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
43621 dump.u_ssize = 0;
43622
43623@@ -234,6 +239,8 @@ static int load_aout_binary(struct linux
43624 rlim = rlimit(RLIMIT_DATA);
43625 if (rlim >= RLIM_INFINITY)
43626 rlim = ~0;
43627+
43628+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
43629 if (ex.a_data + ex.a_bss > rlim)
43630 return -ENOMEM;
43631
43632@@ -262,6 +269,27 @@ static int load_aout_binary(struct linux
43633 install_exec_creds(bprm);
43634 current->flags &= ~PF_FORKNOEXEC;
43635
43636+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43637+ current->mm->pax_flags = 0UL;
43638+#endif
43639+
43640+#ifdef CONFIG_PAX_PAGEEXEC
43641+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
43642+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
43643+
43644+#ifdef CONFIG_PAX_EMUTRAMP
43645+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
43646+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
43647+#endif
43648+
43649+#ifdef CONFIG_PAX_MPROTECT
43650+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
43651+ current->mm->pax_flags |= MF_PAX_MPROTECT;
43652+#endif
43653+
43654+ }
43655+#endif
43656+
43657 if (N_MAGIC(ex) == OMAGIC) {
43658 unsigned long text_addr, map_size;
43659 loff_t pos;
43660@@ -334,7 +362,7 @@ static int load_aout_binary(struct linux
43661
43662 down_write(&current->mm->mmap_sem);
43663 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
43664- PROT_READ | PROT_WRITE | PROT_EXEC,
43665+ PROT_READ | PROT_WRITE,
43666 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
43667 fd_offset + ex.a_text);
43668 up_write(&current->mm->mmap_sem);
43669diff -urNp linux-2.6.39.2/fs/binfmt_elf.c linux-2.6.39.2/fs/binfmt_elf.c
43670--- linux-2.6.39.2/fs/binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
43671+++ linux-2.6.39.2/fs/binfmt_elf.c 2011-05-22 19:41:37.000000000 -0400
43672@@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
43673 #define elf_core_dump NULL
43674 #endif
43675
43676+#ifdef CONFIG_PAX_MPROTECT
43677+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
43678+#endif
43679+
43680 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
43681 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
43682 #else
43683@@ -70,6 +74,11 @@ static struct linux_binfmt elf_format =
43684 .load_binary = load_elf_binary,
43685 .load_shlib = load_elf_library,
43686 .core_dump = elf_core_dump,
43687+
43688+#ifdef CONFIG_PAX_MPROTECT
43689+ .handle_mprotect= elf_handle_mprotect,
43690+#endif
43691+
43692 .min_coredump = ELF_EXEC_PAGESIZE,
43693 };
43694
43695@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
43696
43697 static int set_brk(unsigned long start, unsigned long end)
43698 {
43699+ unsigned long e = end;
43700+
43701 start = ELF_PAGEALIGN(start);
43702 end = ELF_PAGEALIGN(end);
43703 if (end > start) {
43704@@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
43705 if (BAD_ADDR(addr))
43706 return addr;
43707 }
43708- current->mm->start_brk = current->mm->brk = end;
43709+ current->mm->start_brk = current->mm->brk = e;
43710 return 0;
43711 }
43712
43713@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
43714 elf_addr_t __user *u_rand_bytes;
43715 const char *k_platform = ELF_PLATFORM;
43716 const char *k_base_platform = ELF_BASE_PLATFORM;
43717- unsigned char k_rand_bytes[16];
43718+ u32 k_rand_bytes[4];
43719 int items;
43720 elf_addr_t *elf_info;
43721 int ei_index = 0;
43722 const struct cred *cred = current_cred();
43723 struct vm_area_struct *vma;
43724+ unsigned long saved_auxv[AT_VECTOR_SIZE];
43725+
43726+ pax_track_stack();
43727
43728 /*
43729 * In some cases (e.g. Hyper-Threading), we want to avoid L1
43730@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
43731 * Generate 16 random bytes for userspace PRNG seeding.
43732 */
43733 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
43734- u_rand_bytes = (elf_addr_t __user *)
43735- STACK_ALLOC(p, sizeof(k_rand_bytes));
43736+ srandom32(k_rand_bytes[0] ^ random32());
43737+ srandom32(k_rand_bytes[1] ^ random32());
43738+ srandom32(k_rand_bytes[2] ^ random32());
43739+ srandom32(k_rand_bytes[3] ^ random32());
43740+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
43741+ u_rand_bytes = (elf_addr_t __user *) p;
43742 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
43743 return -EFAULT;
43744
43745@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
43746 return -EFAULT;
43747 current->mm->env_end = p;
43748
43749+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
43750+
43751 /* Put the elf_info on the stack in the right place. */
43752 sp = (elf_addr_t __user *)envp + 1;
43753- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
43754+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
43755 return -EFAULT;
43756 return 0;
43757 }
43758@@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
43759 {
43760 struct elf_phdr *elf_phdata;
43761 struct elf_phdr *eppnt;
43762- unsigned long load_addr = 0;
43763+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
43764 int load_addr_set = 0;
43765 unsigned long last_bss = 0, elf_bss = 0;
43766- unsigned long error = ~0UL;
43767+ unsigned long error = -EINVAL;
43768 unsigned long total_size;
43769 int retval, i, size;
43770
43771@@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
43772 goto out_close;
43773 }
43774
43775+#ifdef CONFIG_PAX_SEGMEXEC
43776+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
43777+ pax_task_size = SEGMEXEC_TASK_SIZE;
43778+#endif
43779+
43780 eppnt = elf_phdata;
43781 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
43782 if (eppnt->p_type == PT_LOAD) {
43783@@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
43784 k = load_addr + eppnt->p_vaddr;
43785 if (BAD_ADDR(k) ||
43786 eppnt->p_filesz > eppnt->p_memsz ||
43787- eppnt->p_memsz > TASK_SIZE ||
43788- TASK_SIZE - eppnt->p_memsz < k) {
43789+ eppnt->p_memsz > pax_task_size ||
43790+ pax_task_size - eppnt->p_memsz < k) {
43791 error = -ENOMEM;
43792 goto out_close;
43793 }
43794@@ -528,6 +553,193 @@ out:
43795 return error;
43796 }
43797
43798+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
43799+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
43800+{
43801+ unsigned long pax_flags = 0UL;
43802+
43803+#ifdef CONFIG_PAX_PAGEEXEC
43804+ if (elf_phdata->p_flags & PF_PAGEEXEC)
43805+ pax_flags |= MF_PAX_PAGEEXEC;
43806+#endif
43807+
43808+#ifdef CONFIG_PAX_SEGMEXEC
43809+ if (elf_phdata->p_flags & PF_SEGMEXEC)
43810+ pax_flags |= MF_PAX_SEGMEXEC;
43811+#endif
43812+
43813+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43814+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43815+ if ((__supported_pte_mask & _PAGE_NX))
43816+ pax_flags &= ~MF_PAX_SEGMEXEC;
43817+ else
43818+ pax_flags &= ~MF_PAX_PAGEEXEC;
43819+ }
43820+#endif
43821+
43822+#ifdef CONFIG_PAX_EMUTRAMP
43823+ if (elf_phdata->p_flags & PF_EMUTRAMP)
43824+ pax_flags |= MF_PAX_EMUTRAMP;
43825+#endif
43826+
43827+#ifdef CONFIG_PAX_MPROTECT
43828+ if (elf_phdata->p_flags & PF_MPROTECT)
43829+ pax_flags |= MF_PAX_MPROTECT;
43830+#endif
43831+
43832+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43833+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
43834+ pax_flags |= MF_PAX_RANDMMAP;
43835+#endif
43836+
43837+ return pax_flags;
43838+}
43839+#endif
43840+
43841+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43842+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
43843+{
43844+ unsigned long pax_flags = 0UL;
43845+
43846+#ifdef CONFIG_PAX_PAGEEXEC
43847+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
43848+ pax_flags |= MF_PAX_PAGEEXEC;
43849+#endif
43850+
43851+#ifdef CONFIG_PAX_SEGMEXEC
43852+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
43853+ pax_flags |= MF_PAX_SEGMEXEC;
43854+#endif
43855+
43856+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43857+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43858+ if ((__supported_pte_mask & _PAGE_NX))
43859+ pax_flags &= ~MF_PAX_SEGMEXEC;
43860+ else
43861+ pax_flags &= ~MF_PAX_PAGEEXEC;
43862+ }
43863+#endif
43864+
43865+#ifdef CONFIG_PAX_EMUTRAMP
43866+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
43867+ pax_flags |= MF_PAX_EMUTRAMP;
43868+#endif
43869+
43870+#ifdef CONFIG_PAX_MPROTECT
43871+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
43872+ pax_flags |= MF_PAX_MPROTECT;
43873+#endif
43874+
43875+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43876+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
43877+ pax_flags |= MF_PAX_RANDMMAP;
43878+#endif
43879+
43880+ return pax_flags;
43881+}
43882+#endif
43883+
43884+#ifdef CONFIG_PAX_EI_PAX
43885+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
43886+{
43887+ unsigned long pax_flags = 0UL;
43888+
43889+#ifdef CONFIG_PAX_PAGEEXEC
43890+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
43891+ pax_flags |= MF_PAX_PAGEEXEC;
43892+#endif
43893+
43894+#ifdef CONFIG_PAX_SEGMEXEC
43895+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
43896+ pax_flags |= MF_PAX_SEGMEXEC;
43897+#endif
43898+
43899+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43900+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43901+ if ((__supported_pte_mask & _PAGE_NX))
43902+ pax_flags &= ~MF_PAX_SEGMEXEC;
43903+ else
43904+ pax_flags &= ~MF_PAX_PAGEEXEC;
43905+ }
43906+#endif
43907+
43908+#ifdef CONFIG_PAX_EMUTRAMP
43909+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
43910+ pax_flags |= MF_PAX_EMUTRAMP;
43911+#endif
43912+
43913+#ifdef CONFIG_PAX_MPROTECT
43914+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
43915+ pax_flags |= MF_PAX_MPROTECT;
43916+#endif
43917+
43918+#ifdef CONFIG_PAX_ASLR
43919+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
43920+ pax_flags |= MF_PAX_RANDMMAP;
43921+#endif
43922+
43923+ return pax_flags;
43924+}
43925+#endif
43926+
43927+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43928+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
43929+{
43930+ unsigned long pax_flags = 0UL;
43931+
43932+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43933+ unsigned long i;
43934+ int found_flags = 0;
43935+#endif
43936+
43937+#ifdef CONFIG_PAX_EI_PAX
43938+ pax_flags = pax_parse_ei_pax(elf_ex);
43939+#endif
43940+
43941+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43942+ for (i = 0UL; i < elf_ex->e_phnum; i++)
43943+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
43944+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
43945+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
43946+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
43947+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
43948+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
43949+ return -EINVAL;
43950+
43951+#ifdef CONFIG_PAX_SOFTMODE
43952+ if (pax_softmode)
43953+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
43954+ else
43955+#endif
43956+
43957+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
43958+ found_flags = 1;
43959+ break;
43960+ }
43961+#endif
43962+
43963+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
43964+ if (found_flags == 0) {
43965+ struct elf_phdr phdr;
43966+ memset(&phdr, 0, sizeof(phdr));
43967+ phdr.p_flags = PF_NOEMUTRAMP;
43968+#ifdef CONFIG_PAX_SOFTMODE
43969+ if (pax_softmode)
43970+ pax_flags = pax_parse_softmode(&phdr);
43971+ else
43972+#endif
43973+ pax_flags = pax_parse_hardmode(&phdr);
43974+ }
43975+#endif
43976+
43977+ if (0 > pax_check_flags(&pax_flags))
43978+ return -EINVAL;
43979+
43980+ current->mm->pax_flags = pax_flags;
43981+ return 0;
43982+}
43983+#endif
43984+
43985 /*
43986 * These are the functions used to load ELF style executables and shared
43987 * libraries. There is no binary dependent code anywhere else.
43988@@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
43989 {
43990 unsigned int random_variable = 0;
43991
43992+#ifdef CONFIG_PAX_RANDUSTACK
43993+ if (randomize_va_space)
43994+ return stack_top - current->mm->delta_stack;
43995+#endif
43996+
43997 if ((current->flags & PF_RANDOMIZE) &&
43998 !(current->personality & ADDR_NO_RANDOMIZE)) {
43999 random_variable = get_random_int() & STACK_RND_MASK;
44000@@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
44001 unsigned long load_addr = 0, load_bias = 0;
44002 int load_addr_set = 0;
44003 char * elf_interpreter = NULL;
44004- unsigned long error;
44005+ unsigned long error = 0;
44006 struct elf_phdr *elf_ppnt, *elf_phdata;
44007 unsigned long elf_bss, elf_brk;
44008 int retval, i;
44009@@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
44010 unsigned long start_code, end_code, start_data, end_data;
44011 unsigned long reloc_func_desc __maybe_unused = 0;
44012 int executable_stack = EXSTACK_DEFAULT;
44013- unsigned long def_flags = 0;
44014 struct {
44015 struct elfhdr elf_ex;
44016 struct elfhdr interp_elf_ex;
44017 } *loc;
44018+ unsigned long pax_task_size = TASK_SIZE;
44019
44020 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
44021 if (!loc) {
44022@@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
44023
44024 /* OK, This is the point of no return */
44025 current->flags &= ~PF_FORKNOEXEC;
44026- current->mm->def_flags = def_flags;
44027+
44028+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
44029+ current->mm->pax_flags = 0UL;
44030+#endif
44031+
44032+#ifdef CONFIG_PAX_DLRESOLVE
44033+ current->mm->call_dl_resolve = 0UL;
44034+#endif
44035+
44036+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
44037+ current->mm->call_syscall = 0UL;
44038+#endif
44039+
44040+#ifdef CONFIG_PAX_ASLR
44041+ current->mm->delta_mmap = 0UL;
44042+ current->mm->delta_stack = 0UL;
44043+#endif
44044+
44045+ current->mm->def_flags = 0;
44046+
44047+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
44048+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
44049+ send_sig(SIGKILL, current, 0);
44050+ goto out_free_dentry;
44051+ }
44052+#endif
44053+
44054+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
44055+ pax_set_initial_flags(bprm);
44056+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
44057+ if (pax_set_initial_flags_func)
44058+ (pax_set_initial_flags_func)(bprm);
44059+#endif
44060+
44061+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
44062+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
44063+ current->mm->context.user_cs_limit = PAGE_SIZE;
44064+ current->mm->def_flags |= VM_PAGEEXEC;
44065+ }
44066+#endif
44067+
44068+#ifdef CONFIG_PAX_SEGMEXEC
44069+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
44070+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
44071+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
44072+ pax_task_size = SEGMEXEC_TASK_SIZE;
44073+ current->mm->def_flags |= VM_NOHUGEPAGE;
44074+ }
44075+#endif
44076+
44077+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
44078+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44079+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
44080+ put_cpu();
44081+ }
44082+#endif
44083
44084 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
44085 may depend on the personality. */
44086 SET_PERSONALITY(loc->elf_ex);
44087+
44088+#ifdef CONFIG_PAX_ASLR
44089+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
44090+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
44091+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
44092+ }
44093+#endif
44094+
44095+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44096+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44097+ executable_stack = EXSTACK_DISABLE_X;
44098+ current->personality &= ~READ_IMPLIES_EXEC;
44099+ } else
44100+#endif
44101+
44102 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
44103 current->personality |= READ_IMPLIES_EXEC;
44104
44105@@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_
44106 #else
44107 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
44108 #endif
44109+
44110+#ifdef CONFIG_PAX_RANDMMAP
44111+ /* PaX: randomize base address at the default exe base if requested */
44112+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
44113+#ifdef CONFIG_SPARC64
44114+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
44115+#else
44116+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
44117+#endif
44118+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
44119+ elf_flags |= MAP_FIXED;
44120+ }
44121+#endif
44122+
44123 }
44124
44125 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
44126@@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_
44127 * allowed task size. Note that p_filesz must always be
44128 * <= p_memsz so it is only necessary to check p_memsz.
44129 */
44130- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
44131- elf_ppnt->p_memsz > TASK_SIZE ||
44132- TASK_SIZE - elf_ppnt->p_memsz < k) {
44133+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
44134+ elf_ppnt->p_memsz > pax_task_size ||
44135+ pax_task_size - elf_ppnt->p_memsz < k) {
44136 /* set_brk can never work. Avoid overflows. */
44137 send_sig(SIGKILL, current, 0);
44138 retval = -EINVAL;
44139@@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_
44140 start_data += load_bias;
44141 end_data += load_bias;
44142
44143+#ifdef CONFIG_PAX_RANDMMAP
44144+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
44145+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
44146+#endif
44147+
44148 /* Calling set_brk effectively mmaps the pages that we need
44149 * for the bss and break sections. We must do this before
44150 * mapping in the interpreter, to make sure it doesn't wind
44151@@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_
44152 goto out_free_dentry;
44153 }
44154 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
44155- send_sig(SIGSEGV, current, 0);
44156- retval = -EFAULT; /* Nobody gets to see this, but.. */
44157- goto out_free_dentry;
44158+ /*
44159+ * This bss-zeroing can fail if the ELF
44160+ * file specifies odd protections. So
44161+ * we don't check the return value
44162+ */
44163 }
44164
44165 if (elf_interpreter) {
44166@@ -1090,7 +1398,7 @@ out:
44167 * Decide what to dump of a segment, part, all or none.
44168 */
44169 static unsigned long vma_dump_size(struct vm_area_struct *vma,
44170- unsigned long mm_flags)
44171+ unsigned long mm_flags, long signr)
44172 {
44173 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
44174
44175@@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc
44176 if (vma->vm_file == NULL)
44177 return 0;
44178
44179- if (FILTER(MAPPED_PRIVATE))
44180+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
44181 goto whole;
44182
44183 /*
44184@@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf
44185 {
44186 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
44187 int i = 0;
44188- do
44189+ do {
44190 i += 2;
44191- while (auxv[i - 2] != AT_NULL);
44192+ } while (auxv[i - 2] != AT_NULL);
44193 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
44194 }
44195
44196@@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh
44197 }
44198
44199 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
44200- unsigned long mm_flags)
44201+ struct coredump_params *cprm)
44202 {
44203 struct vm_area_struct *vma;
44204 size_t size = 0;
44205
44206 for (vma = first_vma(current, gate_vma); vma != NULL;
44207 vma = next_vma(vma, gate_vma))
44208- size += vma_dump_size(vma, mm_flags);
44209+ size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
44210 return size;
44211 }
44212
44213@@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump
44214
44215 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
44216
44217- offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
44218+ offset += elf_core_vma_data_size(gate_vma, cprm);
44219 offset += elf_core_extra_data_size();
44220 e_shoff = offset;
44221
44222@@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump
44223 offset = dataoff;
44224
44225 size += sizeof(*elf);
44226+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
44227 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
44228 goto end_coredump;
44229
44230 size += sizeof(*phdr4note);
44231+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
44232 if (size > cprm->limit
44233 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
44234 goto end_coredump;
44235@@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump
44236 phdr.p_offset = offset;
44237 phdr.p_vaddr = vma->vm_start;
44238 phdr.p_paddr = 0;
44239- phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
44240+ phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
44241 phdr.p_memsz = vma->vm_end - vma->vm_start;
44242 offset += phdr.p_filesz;
44243 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
44244@@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump
44245 phdr.p_align = ELF_EXEC_PAGESIZE;
44246
44247 size += sizeof(phdr);
44248+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
44249 if (size > cprm->limit
44250 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
44251 goto end_coredump;
44252@@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump
44253 unsigned long addr;
44254 unsigned long end;
44255
44256- end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
44257+ end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
44258
44259 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
44260 struct page *page;
44261@@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump
44262 page = get_dump_page(addr);
44263 if (page) {
44264 void *kaddr = kmap(page);
44265+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
44266 stop = ((size += PAGE_SIZE) > cprm->limit) ||
44267 !dump_write(cprm->file, kaddr,
44268 PAGE_SIZE);
44269@@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump
44270
44271 if (e_phnum == PN_XNUM) {
44272 size += sizeof(*shdr4extnum);
44273+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
44274 if (size > cprm->limit
44275 || !dump_write(cprm->file, shdr4extnum,
44276 sizeof(*shdr4extnum)))
44277@@ -2067,6 +2380,97 @@ out:
44278
44279 #endif /* CONFIG_ELF_CORE */
44280
44281+#ifdef CONFIG_PAX_MPROTECT
44282+/* PaX: non-PIC ELF libraries need relocations on their executable segments
44283+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
44284+ * we'll remove VM_MAYWRITE for good on RELRO segments.
44285+ *
44286+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
44287+ * basis because we want to allow the common case and not the special ones.
44288+ */
44289+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
44290+{
44291+ struct elfhdr elf_h;
44292+ struct elf_phdr elf_p;
44293+ unsigned long i;
44294+ unsigned long oldflags;
44295+ bool is_textrel_rw, is_textrel_rx, is_relro;
44296+
44297+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
44298+ return;
44299+
44300+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
44301+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
44302+
44303+#ifdef CONFIG_PAX_ELFRELOCS
44304+ /* possible TEXTREL */
44305+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
44306+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
44307+#else
44308+ is_textrel_rw = false;
44309+ is_textrel_rx = false;
44310+#endif
44311+
44312+ /* possible RELRO */
44313+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
44314+
44315+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
44316+ return;
44317+
44318+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
44319+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
44320+
44321+#ifdef CONFIG_PAX_ETEXECRELOCS
44322+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44323+#else
44324+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
44325+#endif
44326+
44327+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44328+ !elf_check_arch(&elf_h) ||
44329+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
44330+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
44331+ return;
44332+
44333+ for (i = 0UL; i < elf_h.e_phnum; i++) {
44334+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
44335+ return;
44336+ switch (elf_p.p_type) {
44337+ case PT_DYNAMIC:
44338+ if (!is_textrel_rw && !is_textrel_rx)
44339+ continue;
44340+ i = 0UL;
44341+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
44342+ elf_dyn dyn;
44343+
44344+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
44345+ return;
44346+ if (dyn.d_tag == DT_NULL)
44347+ return;
44348+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
44349+ gr_log_textrel(vma);
44350+ if (is_textrel_rw)
44351+ vma->vm_flags |= VM_MAYWRITE;
44352+ else
44353+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
44354+ vma->vm_flags &= ~VM_MAYWRITE;
44355+ return;
44356+ }
44357+ i++;
44358+ }
44359+ return;
44360+
44361+ case PT_GNU_RELRO:
44362+ if (!is_relro)
44363+ continue;
44364+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
44365+ vma->vm_flags &= ~VM_MAYWRITE;
44366+ return;
44367+ }
44368+ }
44369+}
44370+#endif
44371+
44372 static int __init init_elf_binfmt(void)
44373 {
44374 return register_binfmt(&elf_format);
44375diff -urNp linux-2.6.39.2/fs/binfmt_flat.c linux-2.6.39.2/fs/binfmt_flat.c
44376--- linux-2.6.39.2/fs/binfmt_flat.c 2011-05-19 00:06:34.000000000 -0400
44377+++ linux-2.6.39.2/fs/binfmt_flat.c 2011-05-22 19:36:32.000000000 -0400
44378@@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
44379 realdatastart = (unsigned long) -ENOMEM;
44380 printk("Unable to allocate RAM for process data, errno %d\n",
44381 (int)-realdatastart);
44382+ down_write(&current->mm->mmap_sem);
44383 do_munmap(current->mm, textpos, text_len);
44384+ up_write(&current->mm->mmap_sem);
44385 ret = realdatastart;
44386 goto err;
44387 }
44388@@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b
44389 }
44390 if (IS_ERR_VALUE(result)) {
44391 printk("Unable to read data+bss, errno %d\n", (int)-result);
44392+ down_write(&current->mm->mmap_sem);
44393 do_munmap(current->mm, textpos, text_len);
44394 do_munmap(current->mm, realdatastart, len);
44395+ up_write(&current->mm->mmap_sem);
44396 ret = result;
44397 goto err;
44398 }
44399@@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b
44400 }
44401 if (IS_ERR_VALUE(result)) {
44402 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
44403+ down_write(&current->mm->mmap_sem);
44404 do_munmap(current->mm, textpos, text_len + data_len + extra +
44405 MAX_SHARED_LIBS * sizeof(unsigned long));
44406+ up_write(&current->mm->mmap_sem);
44407 ret = result;
44408 goto err;
44409 }
44410diff -urNp linux-2.6.39.2/fs/bio.c linux-2.6.39.2/fs/bio.c
44411--- linux-2.6.39.2/fs/bio.c 2011-05-19 00:06:34.000000000 -0400
44412+++ linux-2.6.39.2/fs/bio.c 2011-05-22 19:36:32.000000000 -0400
44413@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
44414 const int read = bio_data_dir(bio) == READ;
44415 struct bio_map_data *bmd = bio->bi_private;
44416 int i;
44417- char *p = bmd->sgvecs[0].iov_base;
44418+ char *p = (__force char *)bmd->sgvecs[0].iov_base;
44419
44420 __bio_for_each_segment(bvec, bio, i, 0) {
44421 char *addr = page_address(bvec->bv_page);
44422diff -urNp linux-2.6.39.2/fs/block_dev.c linux-2.6.39.2/fs/block_dev.c
44423--- linux-2.6.39.2/fs/block_dev.c 2011-06-25 12:55:23.000000000 -0400
44424+++ linux-2.6.39.2/fs/block_dev.c 2011-06-06 19:57:05.000000000 -0400
44425@@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de
44426 else if (bdev->bd_contains == bdev)
44427 return true; /* is a whole device which isn't held */
44428
44429- else if (whole->bd_holder == bd_may_claim)
44430+ else if (whole->bd_holder == (void *)bd_may_claim)
44431 return true; /* is a partition of a device that is being partitioned */
44432 else if (whole->bd_holder != NULL)
44433 return false; /* is a partition of a held device */
44434diff -urNp linux-2.6.39.2/fs/btrfs/compression.c linux-2.6.39.2/fs/btrfs/compression.c
44435--- linux-2.6.39.2/fs/btrfs/compression.c 2011-05-19 00:06:34.000000000 -0400
44436+++ linux-2.6.39.2/fs/btrfs/compression.c 2011-05-22 19:36:32.000000000 -0400
44437@@ -719,7 +719,7 @@ static int comp_num_workspace[BTRFS_COMP
44438 static atomic_t comp_alloc_workspace[BTRFS_COMPRESS_TYPES];
44439 static wait_queue_head_t comp_workspace_wait[BTRFS_COMPRESS_TYPES];
44440
44441-struct btrfs_compress_op *btrfs_compress_op[] = {
44442+const struct btrfs_compress_op *btrfs_compress_op[] = {
44443 &btrfs_zlib_compress,
44444 &btrfs_lzo_compress,
44445 };
44446diff -urNp linux-2.6.39.2/fs/btrfs/compression.h linux-2.6.39.2/fs/btrfs/compression.h
44447--- linux-2.6.39.2/fs/btrfs/compression.h 2011-05-19 00:06:34.000000000 -0400
44448+++ linux-2.6.39.2/fs/btrfs/compression.h 2011-05-22 19:36:32.000000000 -0400
44449@@ -77,7 +77,7 @@ struct btrfs_compress_op {
44450 size_t srclen, size_t destlen);
44451 };
44452
44453-extern struct btrfs_compress_op btrfs_zlib_compress;
44454-extern struct btrfs_compress_op btrfs_lzo_compress;
44455+extern const struct btrfs_compress_op btrfs_zlib_compress;
44456+extern const struct btrfs_compress_op btrfs_lzo_compress;
44457
44458 #endif
44459diff -urNp linux-2.6.39.2/fs/btrfs/ctree.c linux-2.6.39.2/fs/btrfs/ctree.c
44460--- linux-2.6.39.2/fs/btrfs/ctree.c 2011-05-19 00:06:34.000000000 -0400
44461+++ linux-2.6.39.2/fs/btrfs/ctree.c 2011-05-22 19:36:32.000000000 -0400
44462@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
44463 free_extent_buffer(buf);
44464 add_root_to_dirty_list(root);
44465 } else {
44466- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
44467- parent_start = parent->start;
44468- else
44469+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
44470+ if (parent)
44471+ parent_start = parent->start;
44472+ else
44473+ parent_start = 0;
44474+ } else
44475 parent_start = 0;
44476
44477 WARN_ON(trans->transid != btrfs_header_generation(parent));
44478@@ -3647,7 +3650,6 @@ setup_items_for_insert(struct btrfs_tran
44479
44480 ret = 0;
44481 if (slot == 0) {
44482- struct btrfs_disk_key disk_key;
44483 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
44484 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
44485 }
44486diff -urNp linux-2.6.39.2/fs/btrfs/disk-io.c linux-2.6.39.2/fs/btrfs/disk-io.c
44487--- linux-2.6.39.2/fs/btrfs/disk-io.c 2011-05-19 00:06:34.000000000 -0400
44488+++ linux-2.6.39.2/fs/btrfs/disk-io.c 2011-05-22 19:36:32.000000000 -0400
44489@@ -42,7 +42,7 @@
44490 #include "tree-log.h"
44491 #include "free-space-cache.h"
44492
44493-static struct extent_io_ops btree_extent_io_ops;
44494+static const struct extent_io_ops btree_extent_io_ops;
44495 static void end_workqueue_fn(struct btrfs_work *work);
44496 static void free_fs_root(struct btrfs_root *root);
44497 static void btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
44498@@ -3070,7 +3070,7 @@ static int btrfs_cleanup_transaction(str
44499 return 0;
44500 }
44501
44502-static struct extent_io_ops btree_extent_io_ops = {
44503+static const struct extent_io_ops btree_extent_io_ops = {
44504 .write_cache_pages_lock_hook = btree_lock_page_hook,
44505 .readpage_end_io_hook = btree_readpage_end_io_hook,
44506 .submit_bio_hook = btree_submit_bio_hook,
44507diff -urNp linux-2.6.39.2/fs/btrfs/extent_io.h linux-2.6.39.2/fs/btrfs/extent_io.h
44508--- linux-2.6.39.2/fs/btrfs/extent_io.h 2011-05-19 00:06:34.000000000 -0400
44509+++ linux-2.6.39.2/fs/btrfs/extent_io.h 2011-05-22 19:36:32.000000000 -0400
44510@@ -56,36 +56,36 @@ typedef int (extent_submit_bio_hook_t)(s
44511 struct bio *bio, int mirror_num,
44512 unsigned long bio_flags, u64 bio_offset);
44513 struct extent_io_ops {
44514- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
44515+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
44516 u64 start, u64 end, int *page_started,
44517 unsigned long *nr_written);
44518- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
44519- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
44520+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
44521+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
44522 extent_submit_bio_hook_t *submit_bio_hook;
44523- int (*merge_bio_hook)(struct page *page, unsigned long offset,
44524+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
44525 size_t size, struct bio *bio,
44526 unsigned long bio_flags);
44527- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
44528- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
44529+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
44530+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
44531 u64 start, u64 end,
44532 struct extent_state *state);
44533- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
44534+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
44535 u64 start, u64 end,
44536 struct extent_state *state);
44537- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44538+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44539 struct extent_state *state);
44540- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44541+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44542 struct extent_state *state, int uptodate);
44543- int (*set_bit_hook)(struct inode *inode, struct extent_state *state,
44544+ int (* const set_bit_hook)(struct inode *inode, struct extent_state *state,
44545 int *bits);
44546- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
44547+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
44548 int *bits);
44549- int (*merge_extent_hook)(struct inode *inode,
44550+ int (* const merge_extent_hook)(struct inode *inode,
44551 struct extent_state *new,
44552 struct extent_state *other);
44553- int (*split_extent_hook)(struct inode *inode,
44554+ int (* const split_extent_hook)(struct inode *inode,
44555 struct extent_state *orig, u64 split);
44556- int (*write_cache_pages_lock_hook)(struct page *page);
44557+ int (* const write_cache_pages_lock_hook)(struct page *page);
44558 };
44559
44560 struct extent_io_tree {
44561@@ -95,7 +95,7 @@ struct extent_io_tree {
44562 u64 dirty_bytes;
44563 spinlock_t lock;
44564 spinlock_t buffer_lock;
44565- struct extent_io_ops *ops;
44566+ const struct extent_io_ops *ops;
44567 };
44568
44569 struct extent_state {
44570diff -urNp linux-2.6.39.2/fs/btrfs/free-space-cache.c linux-2.6.39.2/fs/btrfs/free-space-cache.c
44571--- linux-2.6.39.2/fs/btrfs/free-space-cache.c 2011-05-19 00:06:34.000000000 -0400
44572+++ linux-2.6.39.2/fs/btrfs/free-space-cache.c 2011-05-22 19:36:32.000000000 -0400
44573@@ -1910,8 +1910,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44574 while(1) {
44575 if (entry->bytes < bytes ||
44576 (!entry->bitmap && entry->offset < min_start)) {
44577- struct rb_node *node;
44578-
44579 node = rb_next(&entry->offset_index);
44580 if (!node)
44581 break;
44582@@ -1925,7 +1923,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44583 cluster, entry, bytes,
44584 min_start);
44585 if (ret == 0) {
44586- struct rb_node *node;
44587 node = rb_next(&entry->offset_index);
44588 if (!node)
44589 break;
44590diff -urNp linux-2.6.39.2/fs/btrfs/inode.c linux-2.6.39.2/fs/btrfs/inode.c
44591--- linux-2.6.39.2/fs/btrfs/inode.c 2011-05-19 00:06:34.000000000 -0400
44592+++ linux-2.6.39.2/fs/btrfs/inode.c 2011-05-22 20:42:42.000000000 -0400
44593@@ -65,7 +65,7 @@ static const struct inode_operations btr
44594 static const struct address_space_operations btrfs_aops;
44595 static const struct address_space_operations btrfs_symlink_aops;
44596 static const struct file_operations btrfs_dir_file_operations;
44597-static struct extent_io_ops btrfs_extent_io_ops;
44598+static const struct extent_io_ops btrfs_extent_io_ops;
44599
44600 static struct kmem_cache *btrfs_inode_cachep;
44601 struct kmem_cache *btrfs_trans_handle_cachep;
44602@@ -6947,7 +6947,7 @@ fail:
44603 return -ENOMEM;
44604 }
44605
44606-static int btrfs_getattr(struct vfsmount *mnt,
44607+int btrfs_getattr(struct vfsmount *mnt,
44608 struct dentry *dentry, struct kstat *stat)
44609 {
44610 struct inode *inode = dentry->d_inode;
44611@@ -6959,6 +6959,14 @@ static int btrfs_getattr(struct vfsmount
44612 return 0;
44613 }
44614
44615+EXPORT_SYMBOL(btrfs_getattr);
44616+
44617+dev_t get_btrfs_dev_from_inode(struct inode *inode)
44618+{
44619+ return BTRFS_I(inode)->root->anon_super.s_dev;
44620+}
44621+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
44622+
44623 /*
44624 * If a file is moved, it will inherit the cow and compression flags of the new
44625 * directory.
44626@@ -7488,7 +7496,7 @@ static const struct file_operations btrf
44627 .fsync = btrfs_sync_file,
44628 };
44629
44630-static struct extent_io_ops btrfs_extent_io_ops = {
44631+static const struct extent_io_ops btrfs_extent_io_ops = {
44632 .fill_delalloc = run_delalloc_range,
44633 .submit_bio_hook = btrfs_submit_bio_hook,
44634 .merge_bio_hook = btrfs_merge_bio_hook,
44635diff -urNp linux-2.6.39.2/fs/btrfs/ioctl.c linux-2.6.39.2/fs/btrfs/ioctl.c
44636--- linux-2.6.39.2/fs/btrfs/ioctl.c 2011-05-19 00:06:34.000000000 -0400
44637+++ linux-2.6.39.2/fs/btrfs/ioctl.c 2011-05-22 19:41:37.000000000 -0400
44638@@ -2361,9 +2361,12 @@ long btrfs_ioctl_space_info(struct btrfs
44639 for (i = 0; i < num_types; i++) {
44640 struct btrfs_space_info *tmp;
44641
44642+ /* Don't copy in more than we allocated */
44643 if (!slot_count)
44644 break;
44645
44646+ slot_count--;
44647+
44648 info = NULL;
44649 rcu_read_lock();
44650 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
44651@@ -2385,10 +2388,7 @@ long btrfs_ioctl_space_info(struct btrfs
44652 memcpy(dest, &space, sizeof(space));
44653 dest++;
44654 space_args.total_spaces++;
44655- slot_count--;
44656 }
44657- if (!slot_count)
44658- break;
44659 }
44660 up_read(&info->groups_sem);
44661 }
44662diff -urNp linux-2.6.39.2/fs/btrfs/lzo.c linux-2.6.39.2/fs/btrfs/lzo.c
44663--- linux-2.6.39.2/fs/btrfs/lzo.c 2011-05-19 00:06:34.000000000 -0400
44664+++ linux-2.6.39.2/fs/btrfs/lzo.c 2011-05-22 19:36:32.000000000 -0400
44665@@ -418,7 +418,7 @@ out:
44666 return ret;
44667 }
44668
44669-struct btrfs_compress_op btrfs_lzo_compress = {
44670+const struct btrfs_compress_op btrfs_lzo_compress = {
44671 .alloc_workspace = lzo_alloc_workspace,
44672 .free_workspace = lzo_free_workspace,
44673 .compress_pages = lzo_compress_pages,
44674diff -urNp linux-2.6.39.2/fs/btrfs/relocation.c linux-2.6.39.2/fs/btrfs/relocation.c
44675--- linux-2.6.39.2/fs/btrfs/relocation.c 2011-05-19 00:06:34.000000000 -0400
44676+++ linux-2.6.39.2/fs/btrfs/relocation.c 2011-05-22 19:36:32.000000000 -0400
44677@@ -1239,7 +1239,7 @@ static int __update_reloc_root(struct bt
44678 }
44679 spin_unlock(&rc->reloc_root_tree.lock);
44680
44681- BUG_ON((struct btrfs_root *)node->data != root);
44682+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
44683
44684 if (!del) {
44685 spin_lock(&rc->reloc_root_tree.lock);
44686diff -urNp linux-2.6.39.2/fs/btrfs/zlib.c linux-2.6.39.2/fs/btrfs/zlib.c
44687--- linux-2.6.39.2/fs/btrfs/zlib.c 2011-05-19 00:06:34.000000000 -0400
44688+++ linux-2.6.39.2/fs/btrfs/zlib.c 2011-05-22 19:36:32.000000000 -0400
44689@@ -390,7 +390,7 @@ next:
44690 return ret;
44691 }
44692
44693-struct btrfs_compress_op btrfs_zlib_compress = {
44694+const struct btrfs_compress_op btrfs_zlib_compress = {
44695 .alloc_workspace = zlib_alloc_workspace,
44696 .free_workspace = zlib_free_workspace,
44697 .compress_pages = zlib_compress_pages,
44698diff -urNp linux-2.6.39.2/fs/cachefiles/bind.c linux-2.6.39.2/fs/cachefiles/bind.c
44699--- linux-2.6.39.2/fs/cachefiles/bind.c 2011-05-19 00:06:34.000000000 -0400
44700+++ linux-2.6.39.2/fs/cachefiles/bind.c 2011-05-22 19:36:32.000000000 -0400
44701@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
44702 args);
44703
44704 /* start by checking things over */
44705- ASSERT(cache->fstop_percent >= 0 &&
44706- cache->fstop_percent < cache->fcull_percent &&
44707+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
44708 cache->fcull_percent < cache->frun_percent &&
44709 cache->frun_percent < 100);
44710
44711- ASSERT(cache->bstop_percent >= 0 &&
44712- cache->bstop_percent < cache->bcull_percent &&
44713+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
44714 cache->bcull_percent < cache->brun_percent &&
44715 cache->brun_percent < 100);
44716
44717diff -urNp linux-2.6.39.2/fs/cachefiles/daemon.c linux-2.6.39.2/fs/cachefiles/daemon.c
44718--- linux-2.6.39.2/fs/cachefiles/daemon.c 2011-05-19 00:06:34.000000000 -0400
44719+++ linux-2.6.39.2/fs/cachefiles/daemon.c 2011-05-22 19:36:32.000000000 -0400
44720@@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
44721 if (n > buflen)
44722 return -EMSGSIZE;
44723
44724- if (copy_to_user(_buffer, buffer, n) != 0)
44725+ if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
44726 return -EFAULT;
44727
44728 return n;
44729@@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s
44730 if (test_bit(CACHEFILES_DEAD, &cache->flags))
44731 return -EIO;
44732
44733- if (datalen < 0 || datalen > PAGE_SIZE - 1)
44734+ if (datalen > PAGE_SIZE - 1)
44735 return -EOPNOTSUPP;
44736
44737 /* drag the command string into the kernel so we can parse it */
44738@@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc
44739 if (args[0] != '%' || args[1] != '\0')
44740 return -EINVAL;
44741
44742- if (fstop < 0 || fstop >= cache->fcull_percent)
44743+ if (fstop >= cache->fcull_percent)
44744 return cachefiles_daemon_range_error(cache, args);
44745
44746 cache->fstop_percent = fstop;
44747@@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc
44748 if (args[0] != '%' || args[1] != '\0')
44749 return -EINVAL;
44750
44751- if (bstop < 0 || bstop >= cache->bcull_percent)
44752+ if (bstop >= cache->bcull_percent)
44753 return cachefiles_daemon_range_error(cache, args);
44754
44755 cache->bstop_percent = bstop;
44756diff -urNp linux-2.6.39.2/fs/cachefiles/internal.h linux-2.6.39.2/fs/cachefiles/internal.h
44757--- linux-2.6.39.2/fs/cachefiles/internal.h 2011-05-19 00:06:34.000000000 -0400
44758+++ linux-2.6.39.2/fs/cachefiles/internal.h 2011-05-22 19:36:32.000000000 -0400
44759@@ -57,7 +57,7 @@ struct cachefiles_cache {
44760 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
44761 struct rb_root active_nodes; /* active nodes (can't be culled) */
44762 rwlock_t active_lock; /* lock for active_nodes */
44763- atomic_t gravecounter; /* graveyard uniquifier */
44764+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
44765 unsigned frun_percent; /* when to stop culling (% files) */
44766 unsigned fcull_percent; /* when to start culling (% files) */
44767 unsigned fstop_percent; /* when to stop allocating (% files) */
44768@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
44769 * proc.c
44770 */
44771 #ifdef CONFIG_CACHEFILES_HISTOGRAM
44772-extern atomic_t cachefiles_lookup_histogram[HZ];
44773-extern atomic_t cachefiles_mkdir_histogram[HZ];
44774-extern atomic_t cachefiles_create_histogram[HZ];
44775+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44776+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44777+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
44778
44779 extern int __init cachefiles_proc_init(void);
44780 extern void cachefiles_proc_cleanup(void);
44781 static inline
44782-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
44783+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
44784 {
44785 unsigned long jif = jiffies - start_jif;
44786 if (jif >= HZ)
44787 jif = HZ - 1;
44788- atomic_inc(&histogram[jif]);
44789+ atomic_inc_unchecked(&histogram[jif]);
44790 }
44791
44792 #else
44793diff -urNp linux-2.6.39.2/fs/cachefiles/namei.c linux-2.6.39.2/fs/cachefiles/namei.c
44794--- linux-2.6.39.2/fs/cachefiles/namei.c 2011-05-19 00:06:34.000000000 -0400
44795+++ linux-2.6.39.2/fs/cachefiles/namei.c 2011-05-22 19:36:32.000000000 -0400
44796@@ -318,7 +318,7 @@ try_again:
44797 /* first step is to make up a grave dentry in the graveyard */
44798 sprintf(nbuffer, "%08x%08x",
44799 (uint32_t) get_seconds(),
44800- (uint32_t) atomic_inc_return(&cache->gravecounter));
44801+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
44802
44803 /* do the multiway lock magic */
44804 trap = lock_rename(cache->graveyard, dir);
44805diff -urNp linux-2.6.39.2/fs/cachefiles/proc.c linux-2.6.39.2/fs/cachefiles/proc.c
44806--- linux-2.6.39.2/fs/cachefiles/proc.c 2011-05-19 00:06:34.000000000 -0400
44807+++ linux-2.6.39.2/fs/cachefiles/proc.c 2011-05-22 19:36:32.000000000 -0400
44808@@ -14,9 +14,9 @@
44809 #include <linux/seq_file.h>
44810 #include "internal.h"
44811
44812-atomic_t cachefiles_lookup_histogram[HZ];
44813-atomic_t cachefiles_mkdir_histogram[HZ];
44814-atomic_t cachefiles_create_histogram[HZ];
44815+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44816+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44817+atomic_unchecked_t cachefiles_create_histogram[HZ];
44818
44819 /*
44820 * display the latency histogram
44821@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
44822 return 0;
44823 default:
44824 index = (unsigned long) v - 3;
44825- x = atomic_read(&cachefiles_lookup_histogram[index]);
44826- y = atomic_read(&cachefiles_mkdir_histogram[index]);
44827- z = atomic_read(&cachefiles_create_histogram[index]);
44828+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
44829+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
44830+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
44831 if (x == 0 && y == 0 && z == 0)
44832 return 0;
44833
44834diff -urNp linux-2.6.39.2/fs/cachefiles/rdwr.c linux-2.6.39.2/fs/cachefiles/rdwr.c
44835--- linux-2.6.39.2/fs/cachefiles/rdwr.c 2011-05-19 00:06:34.000000000 -0400
44836+++ linux-2.6.39.2/fs/cachefiles/rdwr.c 2011-05-22 19:36:32.000000000 -0400
44837@@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
44838 old_fs = get_fs();
44839 set_fs(KERNEL_DS);
44840 ret = file->f_op->write(
44841- file, (const void __user *) data, len, &pos);
44842+ file, (__force const void __user *) data, len, &pos);
44843 set_fs(old_fs);
44844 kunmap(page);
44845 if (ret != len)
44846diff -urNp linux-2.6.39.2/fs/ceph/addr.c linux-2.6.39.2/fs/ceph/addr.c
44847--- linux-2.6.39.2/fs/ceph/addr.c 2011-05-19 00:06:34.000000000 -0400
44848+++ linux-2.6.39.2/fs/ceph/addr.c 2011-05-22 19:36:32.000000000 -0400
44849@@ -1164,7 +1164,7 @@ out:
44850 return ret;
44851 }
44852
44853-static struct vm_operations_struct ceph_vmops = {
44854+static const struct vm_operations_struct ceph_vmops = {
44855 .fault = filemap_fault,
44856 .page_mkwrite = ceph_page_mkwrite,
44857 };
44858diff -urNp linux-2.6.39.2/fs/ceph/dir.c linux-2.6.39.2/fs/ceph/dir.c
44859--- linux-2.6.39.2/fs/ceph/dir.c 2011-05-19 00:06:34.000000000 -0400
44860+++ linux-2.6.39.2/fs/ceph/dir.c 2011-05-22 19:36:32.000000000 -0400
44861@@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
44862 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
44863 struct ceph_mds_client *mdsc = fsc->mdsc;
44864 unsigned frag = fpos_frag(filp->f_pos);
44865- int off = fpos_off(filp->f_pos);
44866+ unsigned int off = fpos_off(filp->f_pos);
44867 int err;
44868 u32 ftype;
44869 struct ceph_mds_reply_info_parsed *rinfo;
44870@@ -360,7 +360,7 @@ more:
44871 rinfo = &fi->last_readdir->r_reply_info;
44872 dout("readdir frag %x num %d off %d chunkoff %d\n", frag,
44873 rinfo->dir_nr, off, fi->offset);
44874- while (off - fi->offset >= 0 && off - fi->offset < rinfo->dir_nr) {
44875+ while (off >= fi->offset && off - fi->offset < rinfo->dir_nr) {
44876 u64 pos = ceph_make_fpos(frag, off);
44877 struct ceph_mds_reply_inode *in =
44878 rinfo->dir_in[off - fi->offset].in;
44879diff -urNp linux-2.6.39.2/fs/cifs/cifs_debug.c linux-2.6.39.2/fs/cifs/cifs_debug.c
44880--- linux-2.6.39.2/fs/cifs/cifs_debug.c 2011-05-19 00:06:34.000000000 -0400
44881+++ linux-2.6.39.2/fs/cifs/cifs_debug.c 2011-05-22 19:36:32.000000000 -0400
44882@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
44883 tcon = list_entry(tmp3,
44884 struct cifsTconInfo,
44885 tcon_list);
44886- atomic_set(&tcon->num_smbs_sent, 0);
44887- atomic_set(&tcon->num_writes, 0);
44888- atomic_set(&tcon->num_reads, 0);
44889- atomic_set(&tcon->num_oplock_brks, 0);
44890- atomic_set(&tcon->num_opens, 0);
44891- atomic_set(&tcon->num_posixopens, 0);
44892- atomic_set(&tcon->num_posixmkdirs, 0);
44893- atomic_set(&tcon->num_closes, 0);
44894- atomic_set(&tcon->num_deletes, 0);
44895- atomic_set(&tcon->num_mkdirs, 0);
44896- atomic_set(&tcon->num_rmdirs, 0);
44897- atomic_set(&tcon->num_renames, 0);
44898- atomic_set(&tcon->num_t2renames, 0);
44899- atomic_set(&tcon->num_ffirst, 0);
44900- atomic_set(&tcon->num_fnext, 0);
44901- atomic_set(&tcon->num_fclose, 0);
44902- atomic_set(&tcon->num_hardlinks, 0);
44903- atomic_set(&tcon->num_symlinks, 0);
44904- atomic_set(&tcon->num_locks, 0);
44905+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
44906+ atomic_set_unchecked(&tcon->num_writes, 0);
44907+ atomic_set_unchecked(&tcon->num_reads, 0);
44908+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
44909+ atomic_set_unchecked(&tcon->num_opens, 0);
44910+ atomic_set_unchecked(&tcon->num_posixopens, 0);
44911+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
44912+ atomic_set_unchecked(&tcon->num_closes, 0);
44913+ atomic_set_unchecked(&tcon->num_deletes, 0);
44914+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
44915+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
44916+ atomic_set_unchecked(&tcon->num_renames, 0);
44917+ atomic_set_unchecked(&tcon->num_t2renames, 0);
44918+ atomic_set_unchecked(&tcon->num_ffirst, 0);
44919+ atomic_set_unchecked(&tcon->num_fnext, 0);
44920+ atomic_set_unchecked(&tcon->num_fclose, 0);
44921+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
44922+ atomic_set_unchecked(&tcon->num_symlinks, 0);
44923+ atomic_set_unchecked(&tcon->num_locks, 0);
44924 }
44925 }
44926 }
44927@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
44928 if (tcon->need_reconnect)
44929 seq_puts(m, "\tDISCONNECTED ");
44930 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
44931- atomic_read(&tcon->num_smbs_sent),
44932- atomic_read(&tcon->num_oplock_brks));
44933+ atomic_read_unchecked(&tcon->num_smbs_sent),
44934+ atomic_read_unchecked(&tcon->num_oplock_brks));
44935 seq_printf(m, "\nReads: %d Bytes: %lld",
44936- atomic_read(&tcon->num_reads),
44937+ atomic_read_unchecked(&tcon->num_reads),
44938 (long long)(tcon->bytes_read));
44939 seq_printf(m, "\nWrites: %d Bytes: %lld",
44940- atomic_read(&tcon->num_writes),
44941+ atomic_read_unchecked(&tcon->num_writes),
44942 (long long)(tcon->bytes_written));
44943 seq_printf(m, "\nFlushes: %d",
44944- atomic_read(&tcon->num_flushes));
44945+ atomic_read_unchecked(&tcon->num_flushes));
44946 seq_printf(m, "\nLocks: %d HardLinks: %d "
44947 "Symlinks: %d",
44948- atomic_read(&tcon->num_locks),
44949- atomic_read(&tcon->num_hardlinks),
44950- atomic_read(&tcon->num_symlinks));
44951+ atomic_read_unchecked(&tcon->num_locks),
44952+ atomic_read_unchecked(&tcon->num_hardlinks),
44953+ atomic_read_unchecked(&tcon->num_symlinks));
44954 seq_printf(m, "\nOpens: %d Closes: %d "
44955 "Deletes: %d",
44956- atomic_read(&tcon->num_opens),
44957- atomic_read(&tcon->num_closes),
44958- atomic_read(&tcon->num_deletes));
44959+ atomic_read_unchecked(&tcon->num_opens),
44960+ atomic_read_unchecked(&tcon->num_closes),
44961+ atomic_read_unchecked(&tcon->num_deletes));
44962 seq_printf(m, "\nPosix Opens: %d "
44963 "Posix Mkdirs: %d",
44964- atomic_read(&tcon->num_posixopens),
44965- atomic_read(&tcon->num_posixmkdirs));
44966+ atomic_read_unchecked(&tcon->num_posixopens),
44967+ atomic_read_unchecked(&tcon->num_posixmkdirs));
44968 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
44969- atomic_read(&tcon->num_mkdirs),
44970- atomic_read(&tcon->num_rmdirs));
44971+ atomic_read_unchecked(&tcon->num_mkdirs),
44972+ atomic_read_unchecked(&tcon->num_rmdirs));
44973 seq_printf(m, "\nRenames: %d T2 Renames %d",
44974- atomic_read(&tcon->num_renames),
44975- atomic_read(&tcon->num_t2renames));
44976+ atomic_read_unchecked(&tcon->num_renames),
44977+ atomic_read_unchecked(&tcon->num_t2renames));
44978 seq_printf(m, "\nFindFirst: %d FNext %d "
44979 "FClose %d",
44980- atomic_read(&tcon->num_ffirst),
44981- atomic_read(&tcon->num_fnext),
44982- atomic_read(&tcon->num_fclose));
44983+ atomic_read_unchecked(&tcon->num_ffirst),
44984+ atomic_read_unchecked(&tcon->num_fnext),
44985+ atomic_read_unchecked(&tcon->num_fclose));
44986 }
44987 }
44988 }
44989diff -urNp linux-2.6.39.2/fs/cifs/cifsglob.h linux-2.6.39.2/fs/cifs/cifsglob.h
44990--- linux-2.6.39.2/fs/cifs/cifsglob.h 2011-05-19 00:06:34.000000000 -0400
44991+++ linux-2.6.39.2/fs/cifs/cifsglob.h 2011-05-22 19:36:32.000000000 -0400
44992@@ -305,28 +305,28 @@ struct cifsTconInfo {
44993 __u16 Flags; /* optional support bits */
44994 enum statusEnum tidStatus;
44995 #ifdef CONFIG_CIFS_STATS
44996- atomic_t num_smbs_sent;
44997- atomic_t num_writes;
44998- atomic_t num_reads;
44999- atomic_t num_flushes;
45000- atomic_t num_oplock_brks;
45001- atomic_t num_opens;
45002- atomic_t num_closes;
45003- atomic_t num_deletes;
45004- atomic_t num_mkdirs;
45005- atomic_t num_posixopens;
45006- atomic_t num_posixmkdirs;
45007- atomic_t num_rmdirs;
45008- atomic_t num_renames;
45009- atomic_t num_t2renames;
45010- atomic_t num_ffirst;
45011- atomic_t num_fnext;
45012- atomic_t num_fclose;
45013- atomic_t num_hardlinks;
45014- atomic_t num_symlinks;
45015- atomic_t num_locks;
45016- atomic_t num_acl_get;
45017- atomic_t num_acl_set;
45018+ atomic_unchecked_t num_smbs_sent;
45019+ atomic_unchecked_t num_writes;
45020+ atomic_unchecked_t num_reads;
45021+ atomic_unchecked_t num_flushes;
45022+ atomic_unchecked_t num_oplock_brks;
45023+ atomic_unchecked_t num_opens;
45024+ atomic_unchecked_t num_closes;
45025+ atomic_unchecked_t num_deletes;
45026+ atomic_unchecked_t num_mkdirs;
45027+ atomic_unchecked_t num_posixopens;
45028+ atomic_unchecked_t num_posixmkdirs;
45029+ atomic_unchecked_t num_rmdirs;
45030+ atomic_unchecked_t num_renames;
45031+ atomic_unchecked_t num_t2renames;
45032+ atomic_unchecked_t num_ffirst;
45033+ atomic_unchecked_t num_fnext;
45034+ atomic_unchecked_t num_fclose;
45035+ atomic_unchecked_t num_hardlinks;
45036+ atomic_unchecked_t num_symlinks;
45037+ atomic_unchecked_t num_locks;
45038+ atomic_unchecked_t num_acl_get;
45039+ atomic_unchecked_t num_acl_set;
45040 #ifdef CONFIG_CIFS_STATS2
45041 unsigned long long time_writes;
45042 unsigned long long time_reads;
45043@@ -509,7 +509,7 @@ static inline char CIFS_DIR_SEP(const st
45044 }
45045
45046 #ifdef CONFIG_CIFS_STATS
45047-#define cifs_stats_inc atomic_inc
45048+#define cifs_stats_inc atomic_inc_unchecked
45049
45050 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
45051 unsigned int bytes)
45052diff -urNp linux-2.6.39.2/fs/cifs/link.c linux-2.6.39.2/fs/cifs/link.c
45053--- linux-2.6.39.2/fs/cifs/link.c 2011-05-19 00:06:34.000000000 -0400
45054+++ linux-2.6.39.2/fs/cifs/link.c 2011-05-22 19:36:32.000000000 -0400
45055@@ -577,7 +577,7 @@ symlink_exit:
45056
45057 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
45058 {
45059- char *p = nd_get_link(nd);
45060+ const char *p = nd_get_link(nd);
45061 if (!IS_ERR(p))
45062 kfree(p);
45063 }
45064diff -urNp linux-2.6.39.2/fs/coda/cache.c linux-2.6.39.2/fs/coda/cache.c
45065--- linux-2.6.39.2/fs/coda/cache.c 2011-05-19 00:06:34.000000000 -0400
45066+++ linux-2.6.39.2/fs/coda/cache.c 2011-05-22 19:36:32.000000000 -0400
45067@@ -24,7 +24,7 @@
45068 #include "coda_linux.h"
45069 #include "coda_cache.h"
45070
45071-static atomic_t permission_epoch = ATOMIC_INIT(0);
45072+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
45073
45074 /* replace or extend an acl cache hit */
45075 void coda_cache_enter(struct inode *inode, int mask)
45076@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
45077 struct coda_inode_info *cii = ITOC(inode);
45078
45079 spin_lock(&cii->c_lock);
45080- cii->c_cached_epoch = atomic_read(&permission_epoch);
45081+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
45082 if (cii->c_uid != current_fsuid()) {
45083 cii->c_uid = current_fsuid();
45084 cii->c_cached_perm = mask;
45085@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
45086 {
45087 struct coda_inode_info *cii = ITOC(inode);
45088 spin_lock(&cii->c_lock);
45089- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
45090+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
45091 spin_unlock(&cii->c_lock);
45092 }
45093
45094 /* remove all acl caches */
45095 void coda_cache_clear_all(struct super_block *sb)
45096 {
45097- atomic_inc(&permission_epoch);
45098+ atomic_inc_unchecked(&permission_epoch);
45099 }
45100
45101
45102@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
45103 spin_lock(&cii->c_lock);
45104 hit = (mask & cii->c_cached_perm) == mask &&
45105 cii->c_uid == current_fsuid() &&
45106- cii->c_cached_epoch == atomic_read(&permission_epoch);
45107+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
45108 spin_unlock(&cii->c_lock);
45109
45110 return hit;
45111diff -urNp linux-2.6.39.2/fs/compat_binfmt_elf.c linux-2.6.39.2/fs/compat_binfmt_elf.c
45112--- linux-2.6.39.2/fs/compat_binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
45113+++ linux-2.6.39.2/fs/compat_binfmt_elf.c 2011-05-22 19:36:32.000000000 -0400
45114@@ -30,11 +30,13 @@
45115 #undef elf_phdr
45116 #undef elf_shdr
45117 #undef elf_note
45118+#undef elf_dyn
45119 #undef elf_addr_t
45120 #define elfhdr elf32_hdr
45121 #define elf_phdr elf32_phdr
45122 #define elf_shdr elf32_shdr
45123 #define elf_note elf32_note
45124+#define elf_dyn Elf32_Dyn
45125 #define elf_addr_t Elf32_Addr
45126
45127 /*
45128diff -urNp linux-2.6.39.2/fs/compat.c linux-2.6.39.2/fs/compat.c
45129--- linux-2.6.39.2/fs/compat.c 2011-05-19 00:06:34.000000000 -0400
45130+++ linux-2.6.39.2/fs/compat.c 2011-05-22 19:41:37.000000000 -0400
45131@@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int
45132 goto out;
45133
45134 ret = -EINVAL;
45135- if (nr_segs > UIO_MAXIOV || nr_segs < 0)
45136+ if (nr_segs > UIO_MAXIOV)
45137 goto out;
45138 if (nr_segs > fast_segs) {
45139 ret = -ENOMEM;
45140@@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
45141
45142 struct compat_readdir_callback {
45143 struct compat_old_linux_dirent __user *dirent;
45144+ struct file * file;
45145 int result;
45146 };
45147
45148@@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf
45149 buf->result = -EOVERFLOW;
45150 return -EOVERFLOW;
45151 }
45152+
45153+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45154+ return 0;
45155+
45156 buf->result++;
45157 dirent = buf->dirent;
45158 if (!access_ok(VERIFY_WRITE, dirent,
45159@@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u
45160
45161 buf.result = 0;
45162 buf.dirent = dirent;
45163+ buf.file = file;
45164
45165 error = vfs_readdir(file, compat_fillonedir, &buf);
45166 if (buf.result)
45167@@ -917,6 +923,7 @@ struct compat_linux_dirent {
45168 struct compat_getdents_callback {
45169 struct compat_linux_dirent __user *current_dir;
45170 struct compat_linux_dirent __user *previous;
45171+ struct file * file;
45172 int count;
45173 int error;
45174 };
45175@@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c
45176 buf->error = -EOVERFLOW;
45177 return -EOVERFLOW;
45178 }
45179+
45180+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45181+ return 0;
45182+
45183 dirent = buf->previous;
45184 if (dirent) {
45185 if (__put_user(offset, &dirent->d_off))
45186@@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi
45187 buf.previous = NULL;
45188 buf.count = count;
45189 buf.error = 0;
45190+ buf.file = file;
45191
45192 error = vfs_readdir(file, compat_filldir, &buf);
45193 if (error >= 0)
45194@@ -1006,6 +1018,7 @@ out:
45195 struct compat_getdents_callback64 {
45196 struct linux_dirent64 __user *current_dir;
45197 struct linux_dirent64 __user *previous;
45198+ struct file * file;
45199 int count;
45200 int error;
45201 };
45202@@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf
45203 buf->error = -EINVAL; /* only used if we fail.. */
45204 if (reclen > buf->count)
45205 return -EINVAL;
45206+
45207+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45208+ return 0;
45209+
45210 dirent = buf->previous;
45211
45212 if (dirent) {
45213@@ -1073,6 +1090,7 @@ asmlinkage long compat_sys_getdents64(un
45214 buf.previous = NULL;
45215 buf.count = count;
45216 buf.error = 0;
45217+ buf.file = file;
45218
45219 error = vfs_readdir(file, compat_filldir64, &buf);
45220 if (error >= 0)
45221@@ -1436,6 +1454,11 @@ int compat_do_execve(char * filename,
45222 compat_uptr_t __user *envp,
45223 struct pt_regs * regs)
45224 {
45225+#ifdef CONFIG_GRKERNSEC
45226+ struct file *old_exec_file;
45227+ struct acl_subject_label *old_acl;
45228+ struct rlimit old_rlim[RLIM_NLIMITS];
45229+#endif
45230 struct linux_binprm *bprm;
45231 struct file *file;
45232 struct files_struct *displaced;
45233@@ -1472,6 +1495,19 @@ int compat_do_execve(char * filename,
45234 bprm->filename = filename;
45235 bprm->interp = filename;
45236
45237+ if (gr_process_user_ban()) {
45238+ retval = -EPERM;
45239+ goto out_file;
45240+ }
45241+
45242+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45243+ retval = -EAGAIN;
45244+ if (gr_handle_nproc())
45245+ goto out_file;
45246+ retval = -EACCES;
45247+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
45248+ goto out_file;
45249+
45250 retval = bprm_mm_init(bprm);
45251 if (retval)
45252 goto out_file;
45253@@ -1501,9 +1537,40 @@ int compat_do_execve(char * filename,
45254 if (retval < 0)
45255 goto out;
45256
45257+ if (!gr_tpe_allow(file)) {
45258+ retval = -EACCES;
45259+ goto out;
45260+ }
45261+
45262+ if (gr_check_crash_exec(file)) {
45263+ retval = -EACCES;
45264+ goto out;
45265+ }
45266+
45267+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45268+
45269+ gr_handle_exec_args_compat(bprm, argv);
45270+
45271+#ifdef CONFIG_GRKERNSEC
45272+ old_acl = current->acl;
45273+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45274+ old_exec_file = current->exec_file;
45275+ get_file(file);
45276+ current->exec_file = file;
45277+#endif
45278+
45279+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45280+ bprm->unsafe & LSM_UNSAFE_SHARE);
45281+ if (retval < 0)
45282+ goto out_fail;
45283+
45284 retval = search_binary_handler(bprm, regs);
45285 if (retval < 0)
45286- goto out;
45287+ goto out_fail;
45288+#ifdef CONFIG_GRKERNSEC
45289+ if (old_exec_file)
45290+ fput(old_exec_file);
45291+#endif
45292
45293 /* execve succeeded */
45294 current->fs->in_exec = 0;
45295@@ -1514,6 +1581,14 @@ int compat_do_execve(char * filename,
45296 put_files_struct(displaced);
45297 return retval;
45298
45299+out_fail:
45300+#ifdef CONFIG_GRKERNSEC
45301+ current->acl = old_acl;
45302+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45303+ fput(current->exec_file);
45304+ current->exec_file = old_exec_file;
45305+#endif
45306+
45307 out:
45308 if (bprm->mm) {
45309 acct_arg_size(bprm, 0);
45310@@ -1681,6 +1756,8 @@ int compat_core_sys_select(int n, compat
45311 struct fdtable *fdt;
45312 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
45313
45314+ pax_track_stack();
45315+
45316 if (n < 0)
45317 goto out_nofds;
45318
45319diff -urNp linux-2.6.39.2/fs/compat_ioctl.c linux-2.6.39.2/fs/compat_ioctl.c
45320--- linux-2.6.39.2/fs/compat_ioctl.c 2011-05-19 00:06:34.000000000 -0400
45321+++ linux-2.6.39.2/fs/compat_ioctl.c 2011-05-22 19:36:32.000000000 -0400
45322@@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
45323
45324 err = get_user(palp, &up->palette);
45325 err |= get_user(length, &up->length);
45326+ if (err)
45327+ return -EFAULT;
45328
45329 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
45330 err = put_user(compat_ptr(palp), &up_native->palette);
45331@@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne
45332 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
45333 {
45334 unsigned int a, b;
45335- a = *(unsigned int *)p;
45336- b = *(unsigned int *)q;
45337+ a = *(const unsigned int *)p;
45338+ b = *(const unsigned int *)q;
45339 if (a > b)
45340 return 1;
45341 if (a < b)
45342diff -urNp linux-2.6.39.2/fs/configfs/dir.c linux-2.6.39.2/fs/configfs/dir.c
45343--- linux-2.6.39.2/fs/configfs/dir.c 2011-05-19 00:06:34.000000000 -0400
45344+++ linux-2.6.39.2/fs/configfs/dir.c 2011-05-22 19:36:32.000000000 -0400
45345@@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file
45346 }
45347 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
45348 struct configfs_dirent *next;
45349- const char * name;
45350+ const unsigned char * name;
45351+ char d_name[sizeof(next->s_dentry->d_iname)];
45352 int len;
45353 struct inode *inode = NULL;
45354
45355@@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file
45356 continue;
45357
45358 name = configfs_get_name(next);
45359- len = strlen(name);
45360+ if (next->s_dentry && name == next->s_dentry->d_iname) {
45361+ len = next->s_dentry->d_name.len;
45362+ memcpy(d_name, name, len);
45363+ name = d_name;
45364+ } else
45365+ len = strlen(name);
45366
45367 /*
45368 * We'll have a dentry and an inode for
45369diff -urNp linux-2.6.39.2/fs/configfs/file.c linux-2.6.39.2/fs/configfs/file.c
45370--- linux-2.6.39.2/fs/configfs/file.c 2011-05-19 00:06:34.000000000 -0400
45371+++ linux-2.6.39.2/fs/configfs/file.c 2011-05-22 19:36:32.000000000 -0400
45372@@ -215,7 +215,7 @@ static int check_perm(struct inode * ino
45373 struct config_item *item = configfs_get_config_item(file->f_path.dentry->d_parent);
45374 struct configfs_attribute * attr = to_attr(file->f_path.dentry);
45375 struct configfs_buffer * buffer;
45376- struct configfs_item_operations * ops = NULL;
45377+ struct configfs_item_operations *ops = NULL;
45378 int error = 0;
45379
45380 if (!item || !attr)
45381diff -urNp linux-2.6.39.2/fs/configfs/item.c linux-2.6.39.2/fs/configfs/item.c
45382--- linux-2.6.39.2/fs/configfs/item.c 2011-05-19 00:06:34.000000000 -0400
45383+++ linux-2.6.39.2/fs/configfs/item.c 2011-05-22 19:36:32.000000000 -0400
45384@@ -123,7 +123,7 @@ void config_item_init_type_name(struct c
45385 EXPORT_SYMBOL(config_item_init_type_name);
45386
45387 void config_group_init_type_name(struct config_group *group, const char *name,
45388- struct config_item_type *type)
45389+ struct config_item_type *type)
45390 {
45391 config_item_set_name(&group->cg_item, name);
45392 group->cg_item.ci_type = type;
45393diff -urNp linux-2.6.39.2/fs/dcache.c linux-2.6.39.2/fs/dcache.c
45394--- linux-2.6.39.2/fs/dcache.c 2011-05-19 00:06:34.000000000 -0400
45395+++ linux-2.6.39.2/fs/dcache.c 2011-05-22 19:36:32.000000000 -0400
45396@@ -3069,7 +3069,7 @@ void __init vfs_caches_init(unsigned lon
45397 mempages -= reserve;
45398
45399 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
45400- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
45401+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
45402
45403 dcache_init();
45404 inode_init();
45405diff -urNp linux-2.6.39.2/fs/dlm/lockspace.c linux-2.6.39.2/fs/dlm/lockspace.c
45406--- linux-2.6.39.2/fs/dlm/lockspace.c 2011-05-19 00:06:34.000000000 -0400
45407+++ linux-2.6.39.2/fs/dlm/lockspace.c 2011-05-22 19:36:32.000000000 -0400
45408@@ -200,7 +200,7 @@ static int dlm_uevent(struct kset *kset,
45409 return 0;
45410 }
45411
45412-static struct kset_uevent_ops dlm_uevent_ops = {
45413+static const struct kset_uevent_ops dlm_uevent_ops = {
45414 .uevent = dlm_uevent,
45415 };
45416
45417diff -urNp linux-2.6.39.2/fs/ecryptfs/inode.c linux-2.6.39.2/fs/ecryptfs/inode.c
45418--- linux-2.6.39.2/fs/ecryptfs/inode.c 2011-06-03 00:04:14.000000000 -0400
45419+++ linux-2.6.39.2/fs/ecryptfs/inode.c 2011-06-03 00:32:07.000000000 -0400
45420@@ -623,7 +623,7 @@ static int ecryptfs_readlink_lower(struc
45421 old_fs = get_fs();
45422 set_fs(get_ds());
45423 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
45424- (char __user *)lower_buf,
45425+ (__force char __user *)lower_buf,
45426 lower_bufsiz);
45427 set_fs(old_fs);
45428 if (rc < 0)
45429@@ -669,7 +669,7 @@ static void *ecryptfs_follow_link(struct
45430 }
45431 old_fs = get_fs();
45432 set_fs(get_ds());
45433- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
45434+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
45435 set_fs(old_fs);
45436 if (rc < 0) {
45437 kfree(buf);
45438@@ -684,7 +684,7 @@ out:
45439 static void
45440 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
45441 {
45442- char *buf = nd_get_link(nd);
45443+ const char *buf = nd_get_link(nd);
45444 if (!IS_ERR(buf)) {
45445 /* Free the char* */
45446 kfree(buf);
45447diff -urNp linux-2.6.39.2/fs/ecryptfs/miscdev.c linux-2.6.39.2/fs/ecryptfs/miscdev.c
45448--- linux-2.6.39.2/fs/ecryptfs/miscdev.c 2011-05-19 00:06:34.000000000 -0400
45449+++ linux-2.6.39.2/fs/ecryptfs/miscdev.c 2011-05-22 19:36:32.000000000 -0400
45450@@ -328,7 +328,7 @@ check_list:
45451 goto out_unlock_msg_ctx;
45452 i = 5;
45453 if (msg_ctx->msg) {
45454- if (copy_to_user(&buf[i], packet_length, packet_length_size))
45455+ if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
45456 goto out_unlock_msg_ctx;
45457 i += packet_length_size;
45458 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
45459diff -urNp linux-2.6.39.2/fs/exec.c linux-2.6.39.2/fs/exec.c
45460--- linux-2.6.39.2/fs/exec.c 2011-06-25 12:55:23.000000000 -0400
45461+++ linux-2.6.39.2/fs/exec.c 2011-06-25 13:00:28.000000000 -0400
45462@@ -55,12 +55,24 @@
45463 #include <linux/fs_struct.h>
45464 #include <linux/pipe_fs_i.h>
45465 #include <linux/oom.h>
45466+#include <linux/random.h>
45467+#include <linux/seq_file.h>
45468+
45469+#ifdef CONFIG_PAX_REFCOUNT
45470+#include <linux/kallsyms.h>
45471+#include <linux/kdebug.h>
45472+#endif
45473
45474 #include <asm/uaccess.h>
45475 #include <asm/mmu_context.h>
45476 #include <asm/tlb.h>
45477 #include "internal.h"
45478
45479+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
45480+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
45481+EXPORT_SYMBOL(pax_set_initial_flags_func);
45482+#endif
45483+
45484 int core_uses_pid;
45485 char core_pattern[CORENAME_MAX_SIZE] = "core";
45486 unsigned int core_pipe_limit;
45487@@ -70,7 +82,7 @@ struct core_name {
45488 char *corename;
45489 int used, size;
45490 };
45491-static atomic_t call_count = ATOMIC_INIT(1);
45492+static atomic_unchecked_t call_count = ATOMIC_INIT(1);
45493
45494 /* The maximal length of core_pattern is also specified in sysctl.c */
45495
45496@@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use
45497 char *tmp = getname(library);
45498 int error = PTR_ERR(tmp);
45499 static const struct open_flags uselib_flags = {
45500- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45501+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45502 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
45503 .intent = LOOKUP_OPEN
45504 };
45505@@ -190,18 +202,10 @@ struct page *get_arg_page(struct linux_b
45506 int write)
45507 {
45508 struct page *page;
45509- int ret;
45510
45511-#ifdef CONFIG_STACK_GROWSUP
45512- if (write) {
45513- ret = expand_stack_downwards(bprm->vma, pos);
45514- if (ret < 0)
45515- return NULL;
45516- }
45517-#endif
45518- ret = get_user_pages(current, bprm->mm, pos,
45519- 1, write, 1, &page, NULL);
45520- if (ret <= 0)
45521+ if (0 > expand_stack_downwards(bprm->vma, pos))
45522+ return NULL;
45523+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
45524 return NULL;
45525
45526 if (write) {
45527@@ -276,6 +280,11 @@ static int __bprm_mm_init(struct linux_b
45528 vma->vm_end = STACK_TOP_MAX;
45529 vma->vm_start = vma->vm_end - PAGE_SIZE;
45530 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
45531+
45532+#ifdef CONFIG_PAX_SEGMEXEC
45533+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
45534+#endif
45535+
45536 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
45537 INIT_LIST_HEAD(&vma->anon_vma_chain);
45538
45539@@ -290,6 +299,12 @@ static int __bprm_mm_init(struct linux_b
45540 mm->stack_vm = mm->total_vm = 1;
45541 up_write(&mm->mmap_sem);
45542 bprm->p = vma->vm_end - sizeof(void *);
45543+
45544+#ifdef CONFIG_PAX_RANDUSTACK
45545+ if (randomize_va_space)
45546+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
45547+#endif
45548+
45549 return 0;
45550 err:
45551 up_write(&mm->mmap_sem);
45552@@ -525,7 +540,7 @@ int copy_strings_kernel(int argc, const
45553 int r;
45554 mm_segment_t oldfs = get_fs();
45555 set_fs(KERNEL_DS);
45556- r = copy_strings(argc, (const char __user *const __user *)argv, bprm);
45557+ r = copy_strings(argc, (__force const char __user *const __user *)argv, bprm);
45558 set_fs(oldfs);
45559 return r;
45560 }
45561@@ -555,7 +570,8 @@ static int shift_arg_pages(struct vm_are
45562 unsigned long new_end = old_end - shift;
45563 struct mmu_gather *tlb;
45564
45565- BUG_ON(new_start > new_end);
45566+ if (new_start >= new_end || new_start < mmap_min_addr)
45567+ return -ENOMEM;
45568
45569 /*
45570 * ensure there are no vmas between where we want to go
45571@@ -564,6 +580,10 @@ static int shift_arg_pages(struct vm_are
45572 if (vma != find_vma(mm, new_start))
45573 return -EFAULT;
45574
45575+#ifdef CONFIG_PAX_SEGMEXEC
45576+ BUG_ON(pax_find_mirror_vma(vma));
45577+#endif
45578+
45579 /*
45580 * cover the whole range: [new_start, old_end)
45581 */
45582@@ -644,10 +664,6 @@ int setup_arg_pages(struct linux_binprm
45583 stack_top = arch_align_stack(stack_top);
45584 stack_top = PAGE_ALIGN(stack_top);
45585
45586- if (unlikely(stack_top < mmap_min_addr) ||
45587- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
45588- return -ENOMEM;
45589-
45590 stack_shift = vma->vm_end - stack_top;
45591
45592 bprm->p -= stack_shift;
45593@@ -659,8 +675,28 @@ int setup_arg_pages(struct linux_binprm
45594 bprm->exec -= stack_shift;
45595
45596 down_write(&mm->mmap_sem);
45597+
45598+ /* Move stack pages down in memory. */
45599+ if (stack_shift) {
45600+ ret = shift_arg_pages(vma, stack_shift);
45601+ if (ret)
45602+ goto out_unlock;
45603+ }
45604+
45605 vm_flags = VM_STACK_FLAGS;
45606
45607+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45608+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
45609+ vm_flags &= ~VM_EXEC;
45610+
45611+#ifdef CONFIG_PAX_MPROTECT
45612+ if (mm->pax_flags & MF_PAX_MPROTECT)
45613+ vm_flags &= ~VM_MAYEXEC;
45614+#endif
45615+
45616+ }
45617+#endif
45618+
45619 /*
45620 * Adjust stack execute permissions; explicitly enable for
45621 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
45622@@ -679,13 +715,6 @@ int setup_arg_pages(struct linux_binprm
45623 goto out_unlock;
45624 BUG_ON(prev != vma);
45625
45626- /* Move stack pages down in memory. */
45627- if (stack_shift) {
45628- ret = shift_arg_pages(vma, stack_shift);
45629- if (ret)
45630- goto out_unlock;
45631- }
45632-
45633 /* mprotect_fixup is overkill to remove the temporary stack flags */
45634 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
45635
45636@@ -725,7 +754,7 @@ struct file *open_exec(const char *name)
45637 struct file *file;
45638 int err;
45639 static const struct open_flags open_exec_flags = {
45640- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45641+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45642 .acc_mode = MAY_EXEC | MAY_OPEN,
45643 .intent = LOOKUP_OPEN
45644 };
45645@@ -766,7 +795,7 @@ int kernel_read(struct file *file, loff_
45646 old_fs = get_fs();
45647 set_fs(get_ds());
45648 /* The cast to a user pointer is valid due to the set_fs() */
45649- result = vfs_read(file, (void __user *)addr, count, &pos);
45650+ result = vfs_read(file, (__force void __user *)addr, count, &pos);
45651 set_fs(old_fs);
45652 return result;
45653 }
45654@@ -1189,7 +1218,7 @@ int check_unsafe_exec(struct linux_binpr
45655 }
45656 rcu_read_unlock();
45657
45658- if (p->fs->users > n_fs) {
45659+ if (atomic_read(&p->fs->users) > n_fs) {
45660 bprm->unsafe |= LSM_UNSAFE_SHARE;
45661 } else {
45662 res = -EAGAIN;
45663@@ -1381,6 +1410,11 @@ int do_execve(const char * filename,
45664 const char __user *const __user *envp,
45665 struct pt_regs * regs)
45666 {
45667+#ifdef CONFIG_GRKERNSEC
45668+ struct file *old_exec_file;
45669+ struct acl_subject_label *old_acl;
45670+ struct rlimit old_rlim[RLIM_NLIMITS];
45671+#endif
45672 struct linux_binprm *bprm;
45673 struct file *file;
45674 struct files_struct *displaced;
45675@@ -1417,6 +1451,23 @@ int do_execve(const char * filename,
45676 bprm->filename = filename;
45677 bprm->interp = filename;
45678
45679+ if (gr_process_user_ban()) {
45680+ retval = -EPERM;
45681+ goto out_file;
45682+ }
45683+
45684+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45685+
45686+ if (gr_handle_nproc()) {
45687+ retval = -EAGAIN;
45688+ goto out_file;
45689+ }
45690+
45691+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
45692+ retval = -EACCES;
45693+ goto out_file;
45694+ }
45695+
45696 retval = bprm_mm_init(bprm);
45697 if (retval)
45698 goto out_file;
45699@@ -1446,9 +1497,40 @@ int do_execve(const char * filename,
45700 if (retval < 0)
45701 goto out;
45702
45703+ if (!gr_tpe_allow(file)) {
45704+ retval = -EACCES;
45705+ goto out;
45706+ }
45707+
45708+ if (gr_check_crash_exec(file)) {
45709+ retval = -EACCES;
45710+ goto out;
45711+ }
45712+
45713+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45714+
45715+ gr_handle_exec_args(bprm, argv);
45716+
45717+#ifdef CONFIG_GRKERNSEC
45718+ old_acl = current->acl;
45719+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45720+ old_exec_file = current->exec_file;
45721+ get_file(file);
45722+ current->exec_file = file;
45723+#endif
45724+
45725+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45726+ bprm->unsafe & LSM_UNSAFE_SHARE);
45727+ if (retval < 0)
45728+ goto out_fail;
45729+
45730 retval = search_binary_handler(bprm,regs);
45731 if (retval < 0)
45732- goto out;
45733+ goto out_fail;
45734+#ifdef CONFIG_GRKERNSEC
45735+ if (old_exec_file)
45736+ fput(old_exec_file);
45737+#endif
45738
45739 /* execve succeeded */
45740 current->fs->in_exec = 0;
45741@@ -1459,6 +1541,14 @@ int do_execve(const char * filename,
45742 put_files_struct(displaced);
45743 return retval;
45744
45745+out_fail:
45746+#ifdef CONFIG_GRKERNSEC
45747+ current->acl = old_acl;
45748+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45749+ fput(current->exec_file);
45750+ current->exec_file = old_exec_file;
45751+#endif
45752+
45753 out:
45754 if (bprm->mm) {
45755 acct_arg_size(bprm, 0);
45756@@ -1504,7 +1594,7 @@ static int expand_corename(struct core_n
45757 {
45758 char *old_corename = cn->corename;
45759
45760- cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
45761+ cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
45762 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
45763
45764 if (!cn->corename) {
45765@@ -1557,7 +1647,7 @@ static int format_corename(struct core_n
45766 int pid_in_pattern = 0;
45767 int err = 0;
45768
45769- cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
45770+ cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
45771 cn->corename = kmalloc(cn->size, GFP_KERNEL);
45772 cn->used = 0;
45773
45774@@ -1645,6 +1735,219 @@ out:
45775 return ispipe;
45776 }
45777
45778+int pax_check_flags(unsigned long *flags)
45779+{
45780+ int retval = 0;
45781+
45782+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
45783+ if (*flags & MF_PAX_SEGMEXEC)
45784+ {
45785+ *flags &= ~MF_PAX_SEGMEXEC;
45786+ retval = -EINVAL;
45787+ }
45788+#endif
45789+
45790+ if ((*flags & MF_PAX_PAGEEXEC)
45791+
45792+#ifdef CONFIG_PAX_PAGEEXEC
45793+ && (*flags & MF_PAX_SEGMEXEC)
45794+#endif
45795+
45796+ )
45797+ {
45798+ *flags &= ~MF_PAX_PAGEEXEC;
45799+ retval = -EINVAL;
45800+ }
45801+
45802+ if ((*flags & MF_PAX_MPROTECT)
45803+
45804+#ifdef CONFIG_PAX_MPROTECT
45805+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45806+#endif
45807+
45808+ )
45809+ {
45810+ *flags &= ~MF_PAX_MPROTECT;
45811+ retval = -EINVAL;
45812+ }
45813+
45814+ if ((*flags & MF_PAX_EMUTRAMP)
45815+
45816+#ifdef CONFIG_PAX_EMUTRAMP
45817+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45818+#endif
45819+
45820+ )
45821+ {
45822+ *flags &= ~MF_PAX_EMUTRAMP;
45823+ retval = -EINVAL;
45824+ }
45825+
45826+ return retval;
45827+}
45828+
45829+EXPORT_SYMBOL(pax_check_flags);
45830+
45831+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45832+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
45833+{
45834+ struct task_struct *tsk = current;
45835+ struct mm_struct *mm = current->mm;
45836+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
45837+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
45838+ char *path_exec = NULL;
45839+ char *path_fault = NULL;
45840+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
45841+
45842+ if (buffer_exec && buffer_fault) {
45843+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
45844+
45845+ down_read(&mm->mmap_sem);
45846+ vma = mm->mmap;
45847+ while (vma && (!vma_exec || !vma_fault)) {
45848+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
45849+ vma_exec = vma;
45850+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
45851+ vma_fault = vma;
45852+ vma = vma->vm_next;
45853+ }
45854+ if (vma_exec) {
45855+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
45856+ if (IS_ERR(path_exec))
45857+ path_exec = "<path too long>";
45858+ else {
45859+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
45860+ if (path_exec) {
45861+ *path_exec = 0;
45862+ path_exec = buffer_exec;
45863+ } else
45864+ path_exec = "<path too long>";
45865+ }
45866+ }
45867+ if (vma_fault) {
45868+ start = vma_fault->vm_start;
45869+ end = vma_fault->vm_end;
45870+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
45871+ if (vma_fault->vm_file) {
45872+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
45873+ if (IS_ERR(path_fault))
45874+ path_fault = "<path too long>";
45875+ else {
45876+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
45877+ if (path_fault) {
45878+ *path_fault = 0;
45879+ path_fault = buffer_fault;
45880+ } else
45881+ path_fault = "<path too long>";
45882+ }
45883+ } else
45884+ path_fault = "<anonymous mapping>";
45885+ }
45886+ up_read(&mm->mmap_sem);
45887+ }
45888+ if (tsk->signal->curr_ip)
45889+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
45890+ else
45891+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
45892+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
45893+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
45894+ task_uid(tsk), task_euid(tsk), pc, sp);
45895+ free_page((unsigned long)buffer_exec);
45896+ free_page((unsigned long)buffer_fault);
45897+ pax_report_insns(pc, sp);
45898+ do_coredump(SIGKILL, SIGKILL, regs);
45899+}
45900+#endif
45901+
45902+#ifdef CONFIG_PAX_REFCOUNT
45903+void pax_report_refcount_overflow(struct pt_regs *regs)
45904+{
45905+ if (current->signal->curr_ip)
45906+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45907+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
45908+ else
45909+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45910+ current->comm, task_pid_nr(current), current_uid(), current_euid());
45911+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
45912+ show_regs(regs);
45913+ force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
45914+}
45915+#endif
45916+
45917+#ifdef CONFIG_PAX_USERCOPY
45918+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
45919+int object_is_on_stack(const void *obj, unsigned long len)
45920+{
45921+ const void * const stack = task_stack_page(current);
45922+ const void * const stackend = stack + THREAD_SIZE;
45923+
45924+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45925+ const void *frame = NULL;
45926+ const void *oldframe;
45927+#endif
45928+
45929+ if (obj + len < obj)
45930+ return -1;
45931+
45932+ if (obj + len <= stack || stackend <= obj)
45933+ return 0;
45934+
45935+ if (obj < stack || stackend < obj + len)
45936+ return -1;
45937+
45938+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45939+ oldframe = __builtin_frame_address(1);
45940+ if (oldframe)
45941+ frame = __builtin_frame_address(2);
45942+ /*
45943+ low ----------------------------------------------> high
45944+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
45945+ ^----------------^
45946+ allow copies only within here
45947+ */
45948+ while (stack <= frame && frame < stackend) {
45949+ /* if obj + len extends past the last frame, this
45950+ check won't pass and the next frame will be 0,
45951+ causing us to bail out and correctly report
45952+ the copy as invalid
45953+ */
45954+ if (obj + len <= frame)
45955+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
45956+ oldframe = frame;
45957+ frame = *(const void * const *)frame;
45958+ }
45959+ return -1;
45960+#else
45961+ return 1;
45962+#endif
45963+}
45964+
45965+
45966+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
45967+{
45968+ if (current->signal->curr_ip)
45969+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45970+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45971+ else
45972+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45973+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45974+ dump_stack();
45975+ gr_handle_kernel_exploit();
45976+ do_group_exit(SIGKILL);
45977+}
45978+#endif
45979+
45980+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
45981+void pax_track_stack(void)
45982+{
45983+ unsigned long sp = (unsigned long)&sp;
45984+ if (sp < current_thread_info()->lowest_stack &&
45985+ sp > (unsigned long)task_stack_page(current))
45986+ current_thread_info()->lowest_stack = sp;
45987+}
45988+EXPORT_SYMBOL(pax_track_stack);
45989+#endif
45990+
45991 static int zap_process(struct task_struct *start, int exit_code)
45992 {
45993 struct task_struct *t;
45994@@ -1855,17 +2158,17 @@ static void wait_for_dump_helpers(struct
45995 pipe = file->f_path.dentry->d_inode->i_pipe;
45996
45997 pipe_lock(pipe);
45998- pipe->readers++;
45999- pipe->writers--;
46000+ atomic_inc(&pipe->readers);
46001+ atomic_dec(&pipe->writers);
46002
46003- while ((pipe->readers > 1) && (!signal_pending(current))) {
46004+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
46005 wake_up_interruptible_sync(&pipe->wait);
46006 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
46007 pipe_wait(pipe);
46008 }
46009
46010- pipe->readers--;
46011- pipe->writers++;
46012+ atomic_dec(&pipe->readers);
46013+ atomic_inc(&pipe->writers);
46014 pipe_unlock(pipe);
46015
46016 }
46017@@ -1926,7 +2229,7 @@ void do_coredump(long signr, int exit_co
46018 int retval = 0;
46019 int flag = 0;
46020 int ispipe;
46021- static atomic_t core_dump_count = ATOMIC_INIT(0);
46022+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
46023 struct coredump_params cprm = {
46024 .signr = signr,
46025 .regs = regs,
46026@@ -1941,6 +2244,9 @@ void do_coredump(long signr, int exit_co
46027
46028 audit_core_dumps(signr);
46029
46030+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
46031+ gr_handle_brute_attach(current, cprm.mm_flags);
46032+
46033 binfmt = mm->binfmt;
46034 if (!binfmt || !binfmt->core_dump)
46035 goto fail;
46036@@ -1981,6 +2287,8 @@ void do_coredump(long signr, int exit_co
46037 goto fail_corename;
46038 }
46039
46040+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
46041+
46042 if (ispipe) {
46043 int dump_count;
46044 char **helper_argv;
46045@@ -2008,7 +2316,7 @@ void do_coredump(long signr, int exit_co
46046 }
46047 cprm.limit = RLIM_INFINITY;
46048
46049- dump_count = atomic_inc_return(&core_dump_count);
46050+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
46051 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
46052 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
46053 task_tgid_vnr(current), current->comm);
46054@@ -2078,7 +2386,7 @@ close_fail:
46055 filp_close(cprm.file, NULL);
46056 fail_dropcount:
46057 if (ispipe)
46058- atomic_dec(&core_dump_count);
46059+ atomic_dec_unchecked(&core_dump_count);
46060 fail_unlock:
46061 kfree(cn.corename);
46062 fail_corename:
46063diff -urNp linux-2.6.39.2/fs/ext2/balloc.c linux-2.6.39.2/fs/ext2/balloc.c
46064--- linux-2.6.39.2/fs/ext2/balloc.c 2011-05-19 00:06:34.000000000 -0400
46065+++ linux-2.6.39.2/fs/ext2/balloc.c 2011-05-22 19:41:37.000000000 -0400
46066@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
46067
46068 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
46069 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
46070- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
46071+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
46072 sbi->s_resuid != current_fsuid() &&
46073 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
46074 return 0;
46075diff -urNp linux-2.6.39.2/fs/ext3/balloc.c linux-2.6.39.2/fs/ext3/balloc.c
46076--- linux-2.6.39.2/fs/ext3/balloc.c 2011-05-19 00:06:34.000000000 -0400
46077+++ linux-2.6.39.2/fs/ext3/balloc.c 2011-05-22 19:41:37.000000000 -0400
46078@@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
46079
46080 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
46081 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
46082- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
46083+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
46084 sbi->s_resuid != current_fsuid() &&
46085 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
46086 return 0;
46087diff -urNp linux-2.6.39.2/fs/ext4/balloc.c linux-2.6.39.2/fs/ext4/balloc.c
46088--- linux-2.6.39.2/fs/ext4/balloc.c 2011-05-19 00:06:34.000000000 -0400
46089+++ linux-2.6.39.2/fs/ext4/balloc.c 2011-05-22 19:41:37.000000000 -0400
46090@@ -522,7 +522,7 @@ static int ext4_has_free_blocks(struct e
46091 /* Hm, nope. Are (enough) root reserved blocks available? */
46092 if (sbi->s_resuid == current_fsuid() ||
46093 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
46094- capable(CAP_SYS_RESOURCE)) {
46095+ capable_nolog(CAP_SYS_RESOURCE)) {
46096 if (free_blocks >= (nblocks + dirty_blocks))
46097 return 1;
46098 }
46099diff -urNp linux-2.6.39.2/fs/ext4/ext4.h linux-2.6.39.2/fs/ext4/ext4.h
46100--- linux-2.6.39.2/fs/ext4/ext4.h 2011-06-03 00:04:14.000000000 -0400
46101+++ linux-2.6.39.2/fs/ext4/ext4.h 2011-06-03 00:32:07.000000000 -0400
46102@@ -1166,19 +1166,19 @@ struct ext4_sb_info {
46103 unsigned long s_mb_last_start;
46104
46105 /* stats for buddy allocator */
46106- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
46107- atomic_t s_bal_success; /* we found long enough chunks */
46108- atomic_t s_bal_allocated; /* in blocks */
46109- atomic_t s_bal_ex_scanned; /* total extents scanned */
46110- atomic_t s_bal_goals; /* goal hits */
46111- atomic_t s_bal_breaks; /* too long searches */
46112- atomic_t s_bal_2orders; /* 2^order hits */
46113+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
46114+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
46115+ atomic_unchecked_t s_bal_allocated; /* in blocks */
46116+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
46117+ atomic_unchecked_t s_bal_goals; /* goal hits */
46118+ atomic_unchecked_t s_bal_breaks; /* too long searches */
46119+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
46120 spinlock_t s_bal_lock;
46121 unsigned long s_mb_buddies_generated;
46122 unsigned long long s_mb_generation_time;
46123- atomic_t s_mb_lost_chunks;
46124- atomic_t s_mb_preallocated;
46125- atomic_t s_mb_discarded;
46126+ atomic_unchecked_t s_mb_lost_chunks;
46127+ atomic_unchecked_t s_mb_preallocated;
46128+ atomic_unchecked_t s_mb_discarded;
46129 atomic_t s_lock_busy;
46130
46131 /* locality groups */
46132diff -urNp linux-2.6.39.2/fs/ext4/mballoc.c linux-2.6.39.2/fs/ext4/mballoc.c
46133--- linux-2.6.39.2/fs/ext4/mballoc.c 2011-06-03 00:04:14.000000000 -0400
46134+++ linux-2.6.39.2/fs/ext4/mballoc.c 2011-06-03 00:32:07.000000000 -0400
46135@@ -1853,7 +1853,7 @@ void ext4_mb_simple_scan_group(struct ex
46136 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
46137
46138 if (EXT4_SB(sb)->s_mb_stats)
46139- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
46140+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
46141
46142 break;
46143 }
46144@@ -2147,7 +2147,7 @@ repeat:
46145 ac->ac_status = AC_STATUS_CONTINUE;
46146 ac->ac_flags |= EXT4_MB_HINT_FIRST;
46147 cr = 3;
46148- atomic_inc(&sbi->s_mb_lost_chunks);
46149+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
46150 goto repeat;
46151 }
46152 }
46153@@ -2190,6 +2190,8 @@ static int ext4_mb_seq_groups_show(struc
46154 ext4_grpblk_t counters[16];
46155 } sg;
46156
46157+ pax_track_stack();
46158+
46159 group--;
46160 if (group == 0)
46161 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
46162@@ -2613,25 +2615,25 @@ int ext4_mb_release(struct super_block *
46163 if (sbi->s_mb_stats) {
46164 printk(KERN_INFO
46165 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
46166- atomic_read(&sbi->s_bal_allocated),
46167- atomic_read(&sbi->s_bal_reqs),
46168- atomic_read(&sbi->s_bal_success));
46169+ atomic_read_unchecked(&sbi->s_bal_allocated),
46170+ atomic_read_unchecked(&sbi->s_bal_reqs),
46171+ atomic_read_unchecked(&sbi->s_bal_success));
46172 printk(KERN_INFO
46173 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
46174 "%u 2^N hits, %u breaks, %u lost\n",
46175- atomic_read(&sbi->s_bal_ex_scanned),
46176- atomic_read(&sbi->s_bal_goals),
46177- atomic_read(&sbi->s_bal_2orders),
46178- atomic_read(&sbi->s_bal_breaks),
46179- atomic_read(&sbi->s_mb_lost_chunks));
46180+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
46181+ atomic_read_unchecked(&sbi->s_bal_goals),
46182+ atomic_read_unchecked(&sbi->s_bal_2orders),
46183+ atomic_read_unchecked(&sbi->s_bal_breaks),
46184+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
46185 printk(KERN_INFO
46186 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
46187 sbi->s_mb_buddies_generated++,
46188 sbi->s_mb_generation_time);
46189 printk(KERN_INFO
46190 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
46191- atomic_read(&sbi->s_mb_preallocated),
46192- atomic_read(&sbi->s_mb_discarded));
46193+ atomic_read_unchecked(&sbi->s_mb_preallocated),
46194+ atomic_read_unchecked(&sbi->s_mb_discarded));
46195 }
46196
46197 free_percpu(sbi->s_locality_groups);
46198@@ -3107,16 +3109,16 @@ static void ext4_mb_collect_stats(struct
46199 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
46200
46201 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
46202- atomic_inc(&sbi->s_bal_reqs);
46203- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
46204+ atomic_inc_unchecked(&sbi->s_bal_reqs);
46205+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
46206 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
46207- atomic_inc(&sbi->s_bal_success);
46208- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
46209+ atomic_inc_unchecked(&sbi->s_bal_success);
46210+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
46211 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
46212 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
46213- atomic_inc(&sbi->s_bal_goals);
46214+ atomic_inc_unchecked(&sbi->s_bal_goals);
46215 if (ac->ac_found > sbi->s_mb_max_to_scan)
46216- atomic_inc(&sbi->s_bal_breaks);
46217+ atomic_inc_unchecked(&sbi->s_bal_breaks);
46218 }
46219
46220 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
46221@@ -3514,7 +3516,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
46222 trace_ext4_mb_new_inode_pa(ac, pa);
46223
46224 ext4_mb_use_inode_pa(ac, pa);
46225- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46226+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46227
46228 ei = EXT4_I(ac->ac_inode);
46229 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
46230@@ -3574,7 +3576,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
46231 trace_ext4_mb_new_group_pa(ac, pa);
46232
46233 ext4_mb_use_group_pa(ac, pa);
46234- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46235+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46236
46237 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
46238 lg = ac->ac_lg;
46239@@ -3661,7 +3663,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
46240 * from the bitmap and continue.
46241 */
46242 }
46243- atomic_add(free, &sbi->s_mb_discarded);
46244+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
46245
46246 return err;
46247 }
46248@@ -3679,7 +3681,7 @@ ext4_mb_release_group_pa(struct ext4_bud
46249 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
46250 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
46251 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
46252- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46253+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46254 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
46255
46256 return 0;
46257diff -urNp linux-2.6.39.2/fs/fcntl.c linux-2.6.39.2/fs/fcntl.c
46258--- linux-2.6.39.2/fs/fcntl.c 2011-05-19 00:06:34.000000000 -0400
46259+++ linux-2.6.39.2/fs/fcntl.c 2011-05-22 20:45:50.000000000 -0400
46260@@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
46261 if (err)
46262 return err;
46263
46264+ if (gr_handle_chroot_fowner(pid, type))
46265+ return -ENOENT;
46266+ if (gr_check_protected_task_fowner(pid, type))
46267+ return -EACCES;
46268+
46269 f_modown(filp, pid, type, force);
46270 return 0;
46271 }
46272@@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in
46273 switch (cmd) {
46274 case F_DUPFD:
46275 case F_DUPFD_CLOEXEC:
46276+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
46277 if (arg >= rlimit(RLIMIT_NOFILE))
46278 break;
46279 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
46280@@ -835,14 +841,14 @@ static int __init fcntl_init(void)
46281 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
46282 * is defined as O_NONBLOCK on some platforms and not on others.
46283 */
46284- BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
46285+ BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
46286 O_RDONLY | O_WRONLY | O_RDWR |
46287 O_CREAT | O_EXCL | O_NOCTTY |
46288 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
46289 __O_SYNC | O_DSYNC | FASYNC |
46290 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
46291 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
46292- __FMODE_EXEC | O_PATH
46293+ __FMODE_EXEC | O_PATH | FMODE_GREXEC
46294 ));
46295
46296 fasync_cache = kmem_cache_create("fasync_cache",
46297diff -urNp linux-2.6.39.2/fs/fifo.c linux-2.6.39.2/fs/fifo.c
46298--- linux-2.6.39.2/fs/fifo.c 2011-05-19 00:06:34.000000000 -0400
46299+++ linux-2.6.39.2/fs/fifo.c 2011-05-22 19:36:32.000000000 -0400
46300@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
46301 */
46302 filp->f_op = &read_pipefifo_fops;
46303 pipe->r_counter++;
46304- if (pipe->readers++ == 0)
46305+ if (atomic_inc_return(&pipe->readers) == 1)
46306 wake_up_partner(inode);
46307
46308- if (!pipe->writers) {
46309+ if (!atomic_read(&pipe->writers)) {
46310 if ((filp->f_flags & O_NONBLOCK)) {
46311 /* suppress POLLHUP until we have
46312 * seen a writer */
46313@@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode
46314 * errno=ENXIO when there is no process reading the FIFO.
46315 */
46316 ret = -ENXIO;
46317- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
46318+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
46319 goto err;
46320
46321 filp->f_op = &write_pipefifo_fops;
46322 pipe->w_counter++;
46323- if (!pipe->writers++)
46324+ if (atomic_inc_return(&pipe->writers) == 1)
46325 wake_up_partner(inode);
46326
46327- if (!pipe->readers) {
46328+ if (!atomic_read(&pipe->readers)) {
46329 wait_for_partner(inode, &pipe->r_counter);
46330 if (signal_pending(current))
46331 goto err_wr;
46332@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode
46333 */
46334 filp->f_op = &rdwr_pipefifo_fops;
46335
46336- pipe->readers++;
46337- pipe->writers++;
46338+ atomic_inc(&pipe->readers);
46339+ atomic_inc(&pipe->writers);
46340 pipe->r_counter++;
46341 pipe->w_counter++;
46342- if (pipe->readers == 1 || pipe->writers == 1)
46343+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
46344 wake_up_partner(inode);
46345 break;
46346
46347@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode
46348 return 0;
46349
46350 err_rd:
46351- if (!--pipe->readers)
46352+ if (atomic_dec_and_test(&pipe->readers))
46353 wake_up_interruptible(&pipe->wait);
46354 ret = -ERESTARTSYS;
46355 goto err;
46356
46357 err_wr:
46358- if (!--pipe->writers)
46359+ if (atomic_dec_and_test(&pipe->writers))
46360 wake_up_interruptible(&pipe->wait);
46361 ret = -ERESTARTSYS;
46362 goto err;
46363
46364 err:
46365- if (!pipe->readers && !pipe->writers)
46366+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
46367 free_pipe_info(inode);
46368
46369 err_nocleanup:
46370diff -urNp linux-2.6.39.2/fs/file.c linux-2.6.39.2/fs/file.c
46371--- linux-2.6.39.2/fs/file.c 2011-05-19 00:06:34.000000000 -0400
46372+++ linux-2.6.39.2/fs/file.c 2011-05-22 19:41:37.000000000 -0400
46373@@ -15,6 +15,7 @@
46374 #include <linux/slab.h>
46375 #include <linux/vmalloc.h>
46376 #include <linux/file.h>
46377+#include <linux/security.h>
46378 #include <linux/fdtable.h>
46379 #include <linux/bitops.h>
46380 #include <linux/interrupt.h>
46381@@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
46382 * N.B. For clone tasks sharing a files structure, this test
46383 * will limit the total number of files that can be opened.
46384 */
46385+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
46386 if (nr >= rlimit(RLIMIT_NOFILE))
46387 return -EMFILE;
46388
46389diff -urNp linux-2.6.39.2/fs/filesystems.c linux-2.6.39.2/fs/filesystems.c
46390--- linux-2.6.39.2/fs/filesystems.c 2011-05-19 00:06:34.000000000 -0400
46391+++ linux-2.6.39.2/fs/filesystems.c 2011-05-22 19:41:37.000000000 -0400
46392@@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con
46393 int len = dot ? dot - name : strlen(name);
46394
46395 fs = __get_fs_type(name, len);
46396+
46397+#ifdef CONFIG_GRKERNSEC_MODHARDEN
46398+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
46399+#else
46400 if (!fs && (request_module("%.*s", len, name) == 0))
46401+#endif
46402 fs = __get_fs_type(name, len);
46403
46404 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
46405diff -urNp linux-2.6.39.2/fs/fscache/cookie.c linux-2.6.39.2/fs/fscache/cookie.c
46406--- linux-2.6.39.2/fs/fscache/cookie.c 2011-05-19 00:06:34.000000000 -0400
46407+++ linux-2.6.39.2/fs/fscache/cookie.c 2011-05-22 19:36:32.000000000 -0400
46408@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
46409 parent ? (char *) parent->def->name : "<no-parent>",
46410 def->name, netfs_data);
46411
46412- fscache_stat(&fscache_n_acquires);
46413+ fscache_stat_unchecked(&fscache_n_acquires);
46414
46415 /* if there's no parent cookie, then we don't create one here either */
46416 if (!parent) {
46417- fscache_stat(&fscache_n_acquires_null);
46418+ fscache_stat_unchecked(&fscache_n_acquires_null);
46419 _leave(" [no parent]");
46420 return NULL;
46421 }
46422@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
46423 /* allocate and initialise a cookie */
46424 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
46425 if (!cookie) {
46426- fscache_stat(&fscache_n_acquires_oom);
46427+ fscache_stat_unchecked(&fscache_n_acquires_oom);
46428 _leave(" [ENOMEM]");
46429 return NULL;
46430 }
46431@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
46432
46433 switch (cookie->def->type) {
46434 case FSCACHE_COOKIE_TYPE_INDEX:
46435- fscache_stat(&fscache_n_cookie_index);
46436+ fscache_stat_unchecked(&fscache_n_cookie_index);
46437 break;
46438 case FSCACHE_COOKIE_TYPE_DATAFILE:
46439- fscache_stat(&fscache_n_cookie_data);
46440+ fscache_stat_unchecked(&fscache_n_cookie_data);
46441 break;
46442 default:
46443- fscache_stat(&fscache_n_cookie_special);
46444+ fscache_stat_unchecked(&fscache_n_cookie_special);
46445 break;
46446 }
46447
46448@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
46449 if (fscache_acquire_non_index_cookie(cookie) < 0) {
46450 atomic_dec(&parent->n_children);
46451 __fscache_cookie_put(cookie);
46452- fscache_stat(&fscache_n_acquires_nobufs);
46453+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
46454 _leave(" = NULL");
46455 return NULL;
46456 }
46457 }
46458
46459- fscache_stat(&fscache_n_acquires_ok);
46460+ fscache_stat_unchecked(&fscache_n_acquires_ok);
46461 _leave(" = %p", cookie);
46462 return cookie;
46463 }
46464@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
46465 cache = fscache_select_cache_for_object(cookie->parent);
46466 if (!cache) {
46467 up_read(&fscache_addremove_sem);
46468- fscache_stat(&fscache_n_acquires_no_cache);
46469+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
46470 _leave(" = -ENOMEDIUM [no cache]");
46471 return -ENOMEDIUM;
46472 }
46473@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
46474 object = cache->ops->alloc_object(cache, cookie);
46475 fscache_stat_d(&fscache_n_cop_alloc_object);
46476 if (IS_ERR(object)) {
46477- fscache_stat(&fscache_n_object_no_alloc);
46478+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
46479 ret = PTR_ERR(object);
46480 goto error;
46481 }
46482
46483- fscache_stat(&fscache_n_object_alloc);
46484+ fscache_stat_unchecked(&fscache_n_object_alloc);
46485
46486 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
46487
46488@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
46489 struct fscache_object *object;
46490 struct hlist_node *_p;
46491
46492- fscache_stat(&fscache_n_updates);
46493+ fscache_stat_unchecked(&fscache_n_updates);
46494
46495 if (!cookie) {
46496- fscache_stat(&fscache_n_updates_null);
46497+ fscache_stat_unchecked(&fscache_n_updates_null);
46498 _leave(" [no cookie]");
46499 return;
46500 }
46501@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
46502 struct fscache_object *object;
46503 unsigned long event;
46504
46505- fscache_stat(&fscache_n_relinquishes);
46506+ fscache_stat_unchecked(&fscache_n_relinquishes);
46507 if (retire)
46508- fscache_stat(&fscache_n_relinquishes_retire);
46509+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
46510
46511 if (!cookie) {
46512- fscache_stat(&fscache_n_relinquishes_null);
46513+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
46514 _leave(" [no cookie]");
46515 return;
46516 }
46517@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
46518
46519 /* wait for the cookie to finish being instantiated (or to fail) */
46520 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
46521- fscache_stat(&fscache_n_relinquishes_waitcrt);
46522+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
46523 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
46524 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
46525 }
46526diff -urNp linux-2.6.39.2/fs/fscache/internal.h linux-2.6.39.2/fs/fscache/internal.h
46527--- linux-2.6.39.2/fs/fscache/internal.h 2011-05-19 00:06:34.000000000 -0400
46528+++ linux-2.6.39.2/fs/fscache/internal.h 2011-05-22 19:36:32.000000000 -0400
46529@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
46530 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
46531 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
46532
46533-extern atomic_t fscache_n_op_pend;
46534-extern atomic_t fscache_n_op_run;
46535-extern atomic_t fscache_n_op_enqueue;
46536-extern atomic_t fscache_n_op_deferred_release;
46537-extern atomic_t fscache_n_op_release;
46538-extern atomic_t fscache_n_op_gc;
46539-extern atomic_t fscache_n_op_cancelled;
46540-extern atomic_t fscache_n_op_rejected;
46541-
46542-extern atomic_t fscache_n_attr_changed;
46543-extern atomic_t fscache_n_attr_changed_ok;
46544-extern atomic_t fscache_n_attr_changed_nobufs;
46545-extern atomic_t fscache_n_attr_changed_nomem;
46546-extern atomic_t fscache_n_attr_changed_calls;
46547-
46548-extern atomic_t fscache_n_allocs;
46549-extern atomic_t fscache_n_allocs_ok;
46550-extern atomic_t fscache_n_allocs_wait;
46551-extern atomic_t fscache_n_allocs_nobufs;
46552-extern atomic_t fscache_n_allocs_intr;
46553-extern atomic_t fscache_n_allocs_object_dead;
46554-extern atomic_t fscache_n_alloc_ops;
46555-extern atomic_t fscache_n_alloc_op_waits;
46556-
46557-extern atomic_t fscache_n_retrievals;
46558-extern atomic_t fscache_n_retrievals_ok;
46559-extern atomic_t fscache_n_retrievals_wait;
46560-extern atomic_t fscache_n_retrievals_nodata;
46561-extern atomic_t fscache_n_retrievals_nobufs;
46562-extern atomic_t fscache_n_retrievals_intr;
46563-extern atomic_t fscache_n_retrievals_nomem;
46564-extern atomic_t fscache_n_retrievals_object_dead;
46565-extern atomic_t fscache_n_retrieval_ops;
46566-extern atomic_t fscache_n_retrieval_op_waits;
46567-
46568-extern atomic_t fscache_n_stores;
46569-extern atomic_t fscache_n_stores_ok;
46570-extern atomic_t fscache_n_stores_again;
46571-extern atomic_t fscache_n_stores_nobufs;
46572-extern atomic_t fscache_n_stores_oom;
46573-extern atomic_t fscache_n_store_ops;
46574-extern atomic_t fscache_n_store_calls;
46575-extern atomic_t fscache_n_store_pages;
46576-extern atomic_t fscache_n_store_radix_deletes;
46577-extern atomic_t fscache_n_store_pages_over_limit;
46578-
46579-extern atomic_t fscache_n_store_vmscan_not_storing;
46580-extern atomic_t fscache_n_store_vmscan_gone;
46581-extern atomic_t fscache_n_store_vmscan_busy;
46582-extern atomic_t fscache_n_store_vmscan_cancelled;
46583-
46584-extern atomic_t fscache_n_marks;
46585-extern atomic_t fscache_n_uncaches;
46586-
46587-extern atomic_t fscache_n_acquires;
46588-extern atomic_t fscache_n_acquires_null;
46589-extern atomic_t fscache_n_acquires_no_cache;
46590-extern atomic_t fscache_n_acquires_ok;
46591-extern atomic_t fscache_n_acquires_nobufs;
46592-extern atomic_t fscache_n_acquires_oom;
46593-
46594-extern atomic_t fscache_n_updates;
46595-extern atomic_t fscache_n_updates_null;
46596-extern atomic_t fscache_n_updates_run;
46597-
46598-extern atomic_t fscache_n_relinquishes;
46599-extern atomic_t fscache_n_relinquishes_null;
46600-extern atomic_t fscache_n_relinquishes_waitcrt;
46601-extern atomic_t fscache_n_relinquishes_retire;
46602-
46603-extern atomic_t fscache_n_cookie_index;
46604-extern atomic_t fscache_n_cookie_data;
46605-extern atomic_t fscache_n_cookie_special;
46606-
46607-extern atomic_t fscache_n_object_alloc;
46608-extern atomic_t fscache_n_object_no_alloc;
46609-extern atomic_t fscache_n_object_lookups;
46610-extern atomic_t fscache_n_object_lookups_negative;
46611-extern atomic_t fscache_n_object_lookups_positive;
46612-extern atomic_t fscache_n_object_lookups_timed_out;
46613-extern atomic_t fscache_n_object_created;
46614-extern atomic_t fscache_n_object_avail;
46615-extern atomic_t fscache_n_object_dead;
46616-
46617-extern atomic_t fscache_n_checkaux_none;
46618-extern atomic_t fscache_n_checkaux_okay;
46619-extern atomic_t fscache_n_checkaux_update;
46620-extern atomic_t fscache_n_checkaux_obsolete;
46621+extern atomic_unchecked_t fscache_n_op_pend;
46622+extern atomic_unchecked_t fscache_n_op_run;
46623+extern atomic_unchecked_t fscache_n_op_enqueue;
46624+extern atomic_unchecked_t fscache_n_op_deferred_release;
46625+extern atomic_unchecked_t fscache_n_op_release;
46626+extern atomic_unchecked_t fscache_n_op_gc;
46627+extern atomic_unchecked_t fscache_n_op_cancelled;
46628+extern atomic_unchecked_t fscache_n_op_rejected;
46629+
46630+extern atomic_unchecked_t fscache_n_attr_changed;
46631+extern atomic_unchecked_t fscache_n_attr_changed_ok;
46632+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
46633+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
46634+extern atomic_unchecked_t fscache_n_attr_changed_calls;
46635+
46636+extern atomic_unchecked_t fscache_n_allocs;
46637+extern atomic_unchecked_t fscache_n_allocs_ok;
46638+extern atomic_unchecked_t fscache_n_allocs_wait;
46639+extern atomic_unchecked_t fscache_n_allocs_nobufs;
46640+extern atomic_unchecked_t fscache_n_allocs_intr;
46641+extern atomic_unchecked_t fscache_n_allocs_object_dead;
46642+extern atomic_unchecked_t fscache_n_alloc_ops;
46643+extern atomic_unchecked_t fscache_n_alloc_op_waits;
46644+
46645+extern atomic_unchecked_t fscache_n_retrievals;
46646+extern atomic_unchecked_t fscache_n_retrievals_ok;
46647+extern atomic_unchecked_t fscache_n_retrievals_wait;
46648+extern atomic_unchecked_t fscache_n_retrievals_nodata;
46649+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
46650+extern atomic_unchecked_t fscache_n_retrievals_intr;
46651+extern atomic_unchecked_t fscache_n_retrievals_nomem;
46652+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
46653+extern atomic_unchecked_t fscache_n_retrieval_ops;
46654+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
46655+
46656+extern atomic_unchecked_t fscache_n_stores;
46657+extern atomic_unchecked_t fscache_n_stores_ok;
46658+extern atomic_unchecked_t fscache_n_stores_again;
46659+extern atomic_unchecked_t fscache_n_stores_nobufs;
46660+extern atomic_unchecked_t fscache_n_stores_oom;
46661+extern atomic_unchecked_t fscache_n_store_ops;
46662+extern atomic_unchecked_t fscache_n_store_calls;
46663+extern atomic_unchecked_t fscache_n_store_pages;
46664+extern atomic_unchecked_t fscache_n_store_radix_deletes;
46665+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
46666+
46667+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46668+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
46669+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
46670+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46671+
46672+extern atomic_unchecked_t fscache_n_marks;
46673+extern atomic_unchecked_t fscache_n_uncaches;
46674+
46675+extern atomic_unchecked_t fscache_n_acquires;
46676+extern atomic_unchecked_t fscache_n_acquires_null;
46677+extern atomic_unchecked_t fscache_n_acquires_no_cache;
46678+extern atomic_unchecked_t fscache_n_acquires_ok;
46679+extern atomic_unchecked_t fscache_n_acquires_nobufs;
46680+extern atomic_unchecked_t fscache_n_acquires_oom;
46681+
46682+extern atomic_unchecked_t fscache_n_updates;
46683+extern atomic_unchecked_t fscache_n_updates_null;
46684+extern atomic_unchecked_t fscache_n_updates_run;
46685+
46686+extern atomic_unchecked_t fscache_n_relinquishes;
46687+extern atomic_unchecked_t fscache_n_relinquishes_null;
46688+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46689+extern atomic_unchecked_t fscache_n_relinquishes_retire;
46690+
46691+extern atomic_unchecked_t fscache_n_cookie_index;
46692+extern atomic_unchecked_t fscache_n_cookie_data;
46693+extern atomic_unchecked_t fscache_n_cookie_special;
46694+
46695+extern atomic_unchecked_t fscache_n_object_alloc;
46696+extern atomic_unchecked_t fscache_n_object_no_alloc;
46697+extern atomic_unchecked_t fscache_n_object_lookups;
46698+extern atomic_unchecked_t fscache_n_object_lookups_negative;
46699+extern atomic_unchecked_t fscache_n_object_lookups_positive;
46700+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
46701+extern atomic_unchecked_t fscache_n_object_created;
46702+extern atomic_unchecked_t fscache_n_object_avail;
46703+extern atomic_unchecked_t fscache_n_object_dead;
46704+
46705+extern atomic_unchecked_t fscache_n_checkaux_none;
46706+extern atomic_unchecked_t fscache_n_checkaux_okay;
46707+extern atomic_unchecked_t fscache_n_checkaux_update;
46708+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
46709
46710 extern atomic_t fscache_n_cop_alloc_object;
46711 extern atomic_t fscache_n_cop_lookup_object;
46712@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
46713 atomic_inc(stat);
46714 }
46715
46716+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
46717+{
46718+ atomic_inc_unchecked(stat);
46719+}
46720+
46721 static inline void fscache_stat_d(atomic_t *stat)
46722 {
46723 atomic_dec(stat);
46724@@ -267,6 +272,7 @@ extern const struct file_operations fsca
46725
46726 #define __fscache_stat(stat) (NULL)
46727 #define fscache_stat(stat) do {} while (0)
46728+#define fscache_stat_unchecked(stat) do {} while (0)
46729 #define fscache_stat_d(stat) do {} while (0)
46730 #endif
46731
46732diff -urNp linux-2.6.39.2/fs/fscache/object.c linux-2.6.39.2/fs/fscache/object.c
46733--- linux-2.6.39.2/fs/fscache/object.c 2011-05-19 00:06:34.000000000 -0400
46734+++ linux-2.6.39.2/fs/fscache/object.c 2011-05-22 19:36:32.000000000 -0400
46735@@ -128,7 +128,7 @@ static void fscache_object_state_machine
46736 /* update the object metadata on disk */
46737 case FSCACHE_OBJECT_UPDATING:
46738 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
46739- fscache_stat(&fscache_n_updates_run);
46740+ fscache_stat_unchecked(&fscache_n_updates_run);
46741 fscache_stat(&fscache_n_cop_update_object);
46742 object->cache->ops->update_object(object);
46743 fscache_stat_d(&fscache_n_cop_update_object);
46744@@ -217,7 +217,7 @@ static void fscache_object_state_machine
46745 spin_lock(&object->lock);
46746 object->state = FSCACHE_OBJECT_DEAD;
46747 spin_unlock(&object->lock);
46748- fscache_stat(&fscache_n_object_dead);
46749+ fscache_stat_unchecked(&fscache_n_object_dead);
46750 goto terminal_transit;
46751
46752 /* handle the parent cache of this object being withdrawn from
46753@@ -232,7 +232,7 @@ static void fscache_object_state_machine
46754 spin_lock(&object->lock);
46755 object->state = FSCACHE_OBJECT_DEAD;
46756 spin_unlock(&object->lock);
46757- fscache_stat(&fscache_n_object_dead);
46758+ fscache_stat_unchecked(&fscache_n_object_dead);
46759 goto terminal_transit;
46760
46761 /* complain about the object being woken up once it is
46762@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
46763 parent->cookie->def->name, cookie->def->name,
46764 object->cache->tag->name);
46765
46766- fscache_stat(&fscache_n_object_lookups);
46767+ fscache_stat_unchecked(&fscache_n_object_lookups);
46768 fscache_stat(&fscache_n_cop_lookup_object);
46769 ret = object->cache->ops->lookup_object(object);
46770 fscache_stat_d(&fscache_n_cop_lookup_object);
46771@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
46772 if (ret == -ETIMEDOUT) {
46773 /* probably stuck behind another object, so move this one to
46774 * the back of the queue */
46775- fscache_stat(&fscache_n_object_lookups_timed_out);
46776+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
46777 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46778 }
46779
46780@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
46781
46782 spin_lock(&object->lock);
46783 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46784- fscache_stat(&fscache_n_object_lookups_negative);
46785+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
46786
46787 /* transit here to allow write requests to begin stacking up
46788 * and read requests to begin returning ENODATA */
46789@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
46790 * result, in which case there may be data available */
46791 spin_lock(&object->lock);
46792 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46793- fscache_stat(&fscache_n_object_lookups_positive);
46794+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
46795
46796 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
46797
46798@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
46799 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46800 } else {
46801 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
46802- fscache_stat(&fscache_n_object_created);
46803+ fscache_stat_unchecked(&fscache_n_object_created);
46804
46805 object->state = FSCACHE_OBJECT_AVAILABLE;
46806 spin_unlock(&object->lock);
46807@@ -602,7 +602,7 @@ static void fscache_object_available(str
46808 fscache_enqueue_dependents(object);
46809
46810 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
46811- fscache_stat(&fscache_n_object_avail);
46812+ fscache_stat_unchecked(&fscache_n_object_avail);
46813
46814 _leave("");
46815 }
46816@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
46817 enum fscache_checkaux result;
46818
46819 if (!object->cookie->def->check_aux) {
46820- fscache_stat(&fscache_n_checkaux_none);
46821+ fscache_stat_unchecked(&fscache_n_checkaux_none);
46822 return FSCACHE_CHECKAUX_OKAY;
46823 }
46824
46825@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
46826 switch (result) {
46827 /* entry okay as is */
46828 case FSCACHE_CHECKAUX_OKAY:
46829- fscache_stat(&fscache_n_checkaux_okay);
46830+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
46831 break;
46832
46833 /* entry requires update */
46834 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
46835- fscache_stat(&fscache_n_checkaux_update);
46836+ fscache_stat_unchecked(&fscache_n_checkaux_update);
46837 break;
46838
46839 /* entry requires deletion */
46840 case FSCACHE_CHECKAUX_OBSOLETE:
46841- fscache_stat(&fscache_n_checkaux_obsolete);
46842+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
46843 break;
46844
46845 default:
46846diff -urNp linux-2.6.39.2/fs/fscache/operation.c linux-2.6.39.2/fs/fscache/operation.c
46847--- linux-2.6.39.2/fs/fscache/operation.c 2011-05-19 00:06:34.000000000 -0400
46848+++ linux-2.6.39.2/fs/fscache/operation.c 2011-05-22 19:36:32.000000000 -0400
46849@@ -17,7 +17,7 @@
46850 #include <linux/slab.h>
46851 #include "internal.h"
46852
46853-atomic_t fscache_op_debug_id;
46854+atomic_unchecked_t fscache_op_debug_id;
46855 EXPORT_SYMBOL(fscache_op_debug_id);
46856
46857 /**
46858@@ -40,7 +40,7 @@ void fscache_enqueue_operation(struct fs
46859 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
46860 ASSERTCMP(atomic_read(&op->usage), >, 0);
46861
46862- fscache_stat(&fscache_n_op_enqueue);
46863+ fscache_stat_unchecked(&fscache_n_op_enqueue);
46864 switch (op->flags & FSCACHE_OP_TYPE) {
46865 case FSCACHE_OP_ASYNC:
46866 _debug("queue async");
46867@@ -73,7 +73,7 @@ static void fscache_run_op(struct fscach
46868 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
46869 if (op->processor)
46870 fscache_enqueue_operation(op);
46871- fscache_stat(&fscache_n_op_run);
46872+ fscache_stat_unchecked(&fscache_n_op_run);
46873 }
46874
46875 /*
46876@@ -104,11 +104,11 @@ int fscache_submit_exclusive_op(struct f
46877 if (object->n_ops > 1) {
46878 atomic_inc(&op->usage);
46879 list_add_tail(&op->pend_link, &object->pending_ops);
46880- fscache_stat(&fscache_n_op_pend);
46881+ fscache_stat_unchecked(&fscache_n_op_pend);
46882 } else if (!list_empty(&object->pending_ops)) {
46883 atomic_inc(&op->usage);
46884 list_add_tail(&op->pend_link, &object->pending_ops);
46885- fscache_stat(&fscache_n_op_pend);
46886+ fscache_stat_unchecked(&fscache_n_op_pend);
46887 fscache_start_operations(object);
46888 } else {
46889 ASSERTCMP(object->n_in_progress, ==, 0);
46890@@ -124,7 +124,7 @@ int fscache_submit_exclusive_op(struct f
46891 object->n_exclusive++; /* reads and writes must wait */
46892 atomic_inc(&op->usage);
46893 list_add_tail(&op->pend_link, &object->pending_ops);
46894- fscache_stat(&fscache_n_op_pend);
46895+ fscache_stat_unchecked(&fscache_n_op_pend);
46896 ret = 0;
46897 } else {
46898 /* not allowed to submit ops in any other state */
46899@@ -211,11 +211,11 @@ int fscache_submit_op(struct fscache_obj
46900 if (object->n_exclusive > 0) {
46901 atomic_inc(&op->usage);
46902 list_add_tail(&op->pend_link, &object->pending_ops);
46903- fscache_stat(&fscache_n_op_pend);
46904+ fscache_stat_unchecked(&fscache_n_op_pend);
46905 } else if (!list_empty(&object->pending_ops)) {
46906 atomic_inc(&op->usage);
46907 list_add_tail(&op->pend_link, &object->pending_ops);
46908- fscache_stat(&fscache_n_op_pend);
46909+ fscache_stat_unchecked(&fscache_n_op_pend);
46910 fscache_start_operations(object);
46911 } else {
46912 ASSERTCMP(object->n_exclusive, ==, 0);
46913@@ -227,12 +227,12 @@ int fscache_submit_op(struct fscache_obj
46914 object->n_ops++;
46915 atomic_inc(&op->usage);
46916 list_add_tail(&op->pend_link, &object->pending_ops);
46917- fscache_stat(&fscache_n_op_pend);
46918+ fscache_stat_unchecked(&fscache_n_op_pend);
46919 ret = 0;
46920 } else if (object->state == FSCACHE_OBJECT_DYING ||
46921 object->state == FSCACHE_OBJECT_LC_DYING ||
46922 object->state == FSCACHE_OBJECT_WITHDRAWING) {
46923- fscache_stat(&fscache_n_op_rejected);
46924+ fscache_stat_unchecked(&fscache_n_op_rejected);
46925 ret = -ENOBUFS;
46926 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
46927 fscache_report_unexpected_submission(object, op, ostate);
46928@@ -302,7 +302,7 @@ int fscache_cancel_op(struct fscache_ope
46929
46930 ret = -EBUSY;
46931 if (!list_empty(&op->pend_link)) {
46932- fscache_stat(&fscache_n_op_cancelled);
46933+ fscache_stat_unchecked(&fscache_n_op_cancelled);
46934 list_del_init(&op->pend_link);
46935 object->n_ops--;
46936 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
46937@@ -341,7 +341,7 @@ void fscache_put_operation(struct fscach
46938 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
46939 BUG();
46940
46941- fscache_stat(&fscache_n_op_release);
46942+ fscache_stat_unchecked(&fscache_n_op_release);
46943
46944 if (op->release) {
46945 op->release(op);
46946@@ -358,7 +358,7 @@ void fscache_put_operation(struct fscach
46947 * lock, and defer it otherwise */
46948 if (!spin_trylock(&object->lock)) {
46949 _debug("defer put");
46950- fscache_stat(&fscache_n_op_deferred_release);
46951+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
46952
46953 cache = object->cache;
46954 spin_lock(&cache->op_gc_list_lock);
46955@@ -420,7 +420,7 @@ void fscache_operation_gc(struct work_st
46956
46957 _debug("GC DEFERRED REL OBJ%x OP%x",
46958 object->debug_id, op->debug_id);
46959- fscache_stat(&fscache_n_op_gc);
46960+ fscache_stat_unchecked(&fscache_n_op_gc);
46961
46962 ASSERTCMP(atomic_read(&op->usage), ==, 0);
46963
46964diff -urNp linux-2.6.39.2/fs/fscache/page.c linux-2.6.39.2/fs/fscache/page.c
46965--- linux-2.6.39.2/fs/fscache/page.c 2011-05-19 00:06:34.000000000 -0400
46966+++ linux-2.6.39.2/fs/fscache/page.c 2011-05-22 19:36:32.000000000 -0400
46967@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
46968 val = radix_tree_lookup(&cookie->stores, page->index);
46969 if (!val) {
46970 rcu_read_unlock();
46971- fscache_stat(&fscache_n_store_vmscan_not_storing);
46972+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
46973 __fscache_uncache_page(cookie, page);
46974 return true;
46975 }
46976@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
46977 spin_unlock(&cookie->stores_lock);
46978
46979 if (xpage) {
46980- fscache_stat(&fscache_n_store_vmscan_cancelled);
46981- fscache_stat(&fscache_n_store_radix_deletes);
46982+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
46983+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46984 ASSERTCMP(xpage, ==, page);
46985 } else {
46986- fscache_stat(&fscache_n_store_vmscan_gone);
46987+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
46988 }
46989
46990 wake_up_bit(&cookie->flags, 0);
46991@@ -107,7 +107,7 @@ page_busy:
46992 /* we might want to wait here, but that could deadlock the allocator as
46993 * the work threads writing to the cache may all end up sleeping
46994 * on memory allocation */
46995- fscache_stat(&fscache_n_store_vmscan_busy);
46996+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
46997 return false;
46998 }
46999 EXPORT_SYMBOL(__fscache_maybe_release_page);
47000@@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
47001 FSCACHE_COOKIE_STORING_TAG);
47002 if (!radix_tree_tag_get(&cookie->stores, page->index,
47003 FSCACHE_COOKIE_PENDING_TAG)) {
47004- fscache_stat(&fscache_n_store_radix_deletes);
47005+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
47006 xpage = radix_tree_delete(&cookie->stores, page->index);
47007 }
47008 spin_unlock(&cookie->stores_lock);
47009@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
47010
47011 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
47012
47013- fscache_stat(&fscache_n_attr_changed_calls);
47014+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
47015
47016 if (fscache_object_is_active(object)) {
47017 fscache_set_op_state(op, "CallFS");
47018@@ -179,11 +179,11 @@ int __fscache_attr_changed(struct fscach
47019
47020 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47021
47022- fscache_stat(&fscache_n_attr_changed);
47023+ fscache_stat_unchecked(&fscache_n_attr_changed);
47024
47025 op = kzalloc(sizeof(*op), GFP_KERNEL);
47026 if (!op) {
47027- fscache_stat(&fscache_n_attr_changed_nomem);
47028+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
47029 _leave(" = -ENOMEM");
47030 return -ENOMEM;
47031 }
47032@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
47033 if (fscache_submit_exclusive_op(object, op) < 0)
47034 goto nobufs;
47035 spin_unlock(&cookie->lock);
47036- fscache_stat(&fscache_n_attr_changed_ok);
47037+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
47038 fscache_put_operation(op);
47039 _leave(" = 0");
47040 return 0;
47041@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
47042 nobufs:
47043 spin_unlock(&cookie->lock);
47044 kfree(op);
47045- fscache_stat(&fscache_n_attr_changed_nobufs);
47046+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
47047 _leave(" = %d", -ENOBUFS);
47048 return -ENOBUFS;
47049 }
47050@@ -246,7 +246,7 @@ static struct fscache_retrieval *fscache
47051 /* allocate a retrieval operation and attempt to submit it */
47052 op = kzalloc(sizeof(*op), GFP_NOIO);
47053 if (!op) {
47054- fscache_stat(&fscache_n_retrievals_nomem);
47055+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
47056 return NULL;
47057 }
47058
47059@@ -275,13 +275,13 @@ static int fscache_wait_for_deferred_loo
47060 return 0;
47061 }
47062
47063- fscache_stat(&fscache_n_retrievals_wait);
47064+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
47065
47066 jif = jiffies;
47067 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
47068 fscache_wait_bit_interruptible,
47069 TASK_INTERRUPTIBLE) != 0) {
47070- fscache_stat(&fscache_n_retrievals_intr);
47071+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
47072 _leave(" = -ERESTARTSYS");
47073 return -ERESTARTSYS;
47074 }
47075@@ -299,8 +299,8 @@ static int fscache_wait_for_deferred_loo
47076 */
47077 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
47078 struct fscache_retrieval *op,
47079- atomic_t *stat_op_waits,
47080- atomic_t *stat_object_dead)
47081+ atomic_unchecked_t *stat_op_waits,
47082+ atomic_unchecked_t *stat_object_dead)
47083 {
47084 int ret;
47085
47086@@ -308,7 +308,7 @@ static int fscache_wait_for_retrieval_ac
47087 goto check_if_dead;
47088
47089 _debug(">>> WT");
47090- fscache_stat(stat_op_waits);
47091+ fscache_stat_unchecked(stat_op_waits);
47092 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
47093 fscache_wait_bit_interruptible,
47094 TASK_INTERRUPTIBLE) < 0) {
47095@@ -325,7 +325,7 @@ static int fscache_wait_for_retrieval_ac
47096
47097 check_if_dead:
47098 if (unlikely(fscache_object_is_dead(object))) {
47099- fscache_stat(stat_object_dead);
47100+ fscache_stat_unchecked(stat_object_dead);
47101 return -ENOBUFS;
47102 }
47103 return 0;
47104@@ -352,7 +352,7 @@ int __fscache_read_or_alloc_page(struct
47105
47106 _enter("%p,%p,,,", cookie, page);
47107
47108- fscache_stat(&fscache_n_retrievals);
47109+ fscache_stat_unchecked(&fscache_n_retrievals);
47110
47111 if (hlist_empty(&cookie->backing_objects))
47112 goto nobufs;
47113@@ -386,7 +386,7 @@ int __fscache_read_or_alloc_page(struct
47114 goto nobufs_unlock;
47115 spin_unlock(&cookie->lock);
47116
47117- fscache_stat(&fscache_n_retrieval_ops);
47118+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
47119
47120 /* pin the netfs read context in case we need to do the actual netfs
47121 * read because we've encountered a cache read failure */
47122@@ -416,15 +416,15 @@ int __fscache_read_or_alloc_page(struct
47123
47124 error:
47125 if (ret == -ENOMEM)
47126- fscache_stat(&fscache_n_retrievals_nomem);
47127+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
47128 else if (ret == -ERESTARTSYS)
47129- fscache_stat(&fscache_n_retrievals_intr);
47130+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
47131 else if (ret == -ENODATA)
47132- fscache_stat(&fscache_n_retrievals_nodata);
47133+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
47134 else if (ret < 0)
47135- fscache_stat(&fscache_n_retrievals_nobufs);
47136+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47137 else
47138- fscache_stat(&fscache_n_retrievals_ok);
47139+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
47140
47141 fscache_put_retrieval(op);
47142 _leave(" = %d", ret);
47143@@ -434,7 +434,7 @@ nobufs_unlock:
47144 spin_unlock(&cookie->lock);
47145 kfree(op);
47146 nobufs:
47147- fscache_stat(&fscache_n_retrievals_nobufs);
47148+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47149 _leave(" = -ENOBUFS");
47150 return -ENOBUFS;
47151 }
47152@@ -472,7 +472,7 @@ int __fscache_read_or_alloc_pages(struct
47153
47154 _enter("%p,,%d,,,", cookie, *nr_pages);
47155
47156- fscache_stat(&fscache_n_retrievals);
47157+ fscache_stat_unchecked(&fscache_n_retrievals);
47158
47159 if (hlist_empty(&cookie->backing_objects))
47160 goto nobufs;
47161@@ -503,7 +503,7 @@ int __fscache_read_or_alloc_pages(struct
47162 goto nobufs_unlock;
47163 spin_unlock(&cookie->lock);
47164
47165- fscache_stat(&fscache_n_retrieval_ops);
47166+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
47167
47168 /* pin the netfs read context in case we need to do the actual netfs
47169 * read because we've encountered a cache read failure */
47170@@ -533,15 +533,15 @@ int __fscache_read_or_alloc_pages(struct
47171
47172 error:
47173 if (ret == -ENOMEM)
47174- fscache_stat(&fscache_n_retrievals_nomem);
47175+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
47176 else if (ret == -ERESTARTSYS)
47177- fscache_stat(&fscache_n_retrievals_intr);
47178+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
47179 else if (ret == -ENODATA)
47180- fscache_stat(&fscache_n_retrievals_nodata);
47181+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
47182 else if (ret < 0)
47183- fscache_stat(&fscache_n_retrievals_nobufs);
47184+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47185 else
47186- fscache_stat(&fscache_n_retrievals_ok);
47187+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
47188
47189 fscache_put_retrieval(op);
47190 _leave(" = %d", ret);
47191@@ -551,7 +551,7 @@ nobufs_unlock:
47192 spin_unlock(&cookie->lock);
47193 kfree(op);
47194 nobufs:
47195- fscache_stat(&fscache_n_retrievals_nobufs);
47196+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47197 _leave(" = -ENOBUFS");
47198 return -ENOBUFS;
47199 }
47200@@ -575,7 +575,7 @@ int __fscache_alloc_page(struct fscache_
47201
47202 _enter("%p,%p,,,", cookie, page);
47203
47204- fscache_stat(&fscache_n_allocs);
47205+ fscache_stat_unchecked(&fscache_n_allocs);
47206
47207 if (hlist_empty(&cookie->backing_objects))
47208 goto nobufs;
47209@@ -602,7 +602,7 @@ int __fscache_alloc_page(struct fscache_
47210 goto nobufs_unlock;
47211 spin_unlock(&cookie->lock);
47212
47213- fscache_stat(&fscache_n_alloc_ops);
47214+ fscache_stat_unchecked(&fscache_n_alloc_ops);
47215
47216 ret = fscache_wait_for_retrieval_activation(
47217 object, op,
47218@@ -618,11 +618,11 @@ int __fscache_alloc_page(struct fscache_
47219
47220 error:
47221 if (ret == -ERESTARTSYS)
47222- fscache_stat(&fscache_n_allocs_intr);
47223+ fscache_stat_unchecked(&fscache_n_allocs_intr);
47224 else if (ret < 0)
47225- fscache_stat(&fscache_n_allocs_nobufs);
47226+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
47227 else
47228- fscache_stat(&fscache_n_allocs_ok);
47229+ fscache_stat_unchecked(&fscache_n_allocs_ok);
47230
47231 fscache_put_retrieval(op);
47232 _leave(" = %d", ret);
47233@@ -632,7 +632,7 @@ nobufs_unlock:
47234 spin_unlock(&cookie->lock);
47235 kfree(op);
47236 nobufs:
47237- fscache_stat(&fscache_n_allocs_nobufs);
47238+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
47239 _leave(" = -ENOBUFS");
47240 return -ENOBUFS;
47241 }
47242@@ -675,7 +675,7 @@ static void fscache_write_op(struct fsca
47243
47244 spin_lock(&cookie->stores_lock);
47245
47246- fscache_stat(&fscache_n_store_calls);
47247+ fscache_stat_unchecked(&fscache_n_store_calls);
47248
47249 /* find a page to store */
47250 page = NULL;
47251@@ -686,7 +686,7 @@ static void fscache_write_op(struct fsca
47252 page = results[0];
47253 _debug("gang %d [%lx]", n, page->index);
47254 if (page->index > op->store_limit) {
47255- fscache_stat(&fscache_n_store_pages_over_limit);
47256+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
47257 goto superseded;
47258 }
47259
47260@@ -699,7 +699,7 @@ static void fscache_write_op(struct fsca
47261 spin_unlock(&object->lock);
47262
47263 fscache_set_op_state(&op->op, "Store");
47264- fscache_stat(&fscache_n_store_pages);
47265+ fscache_stat_unchecked(&fscache_n_store_pages);
47266 fscache_stat(&fscache_n_cop_write_page);
47267 ret = object->cache->ops->write_page(op, page);
47268 fscache_stat_d(&fscache_n_cop_write_page);
47269@@ -769,7 +769,7 @@ int __fscache_write_page(struct fscache_
47270 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47271 ASSERT(PageFsCache(page));
47272
47273- fscache_stat(&fscache_n_stores);
47274+ fscache_stat_unchecked(&fscache_n_stores);
47275
47276 op = kzalloc(sizeof(*op), GFP_NOIO);
47277 if (!op)
47278@@ -821,7 +821,7 @@ int __fscache_write_page(struct fscache_
47279 spin_unlock(&cookie->stores_lock);
47280 spin_unlock(&object->lock);
47281
47282- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
47283+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
47284 op->store_limit = object->store_limit;
47285
47286 if (fscache_submit_op(object, &op->op) < 0)
47287@@ -829,8 +829,8 @@ int __fscache_write_page(struct fscache_
47288
47289 spin_unlock(&cookie->lock);
47290 radix_tree_preload_end();
47291- fscache_stat(&fscache_n_store_ops);
47292- fscache_stat(&fscache_n_stores_ok);
47293+ fscache_stat_unchecked(&fscache_n_store_ops);
47294+ fscache_stat_unchecked(&fscache_n_stores_ok);
47295
47296 /* the work queue now carries its own ref on the object */
47297 fscache_put_operation(&op->op);
47298@@ -838,14 +838,14 @@ int __fscache_write_page(struct fscache_
47299 return 0;
47300
47301 already_queued:
47302- fscache_stat(&fscache_n_stores_again);
47303+ fscache_stat_unchecked(&fscache_n_stores_again);
47304 already_pending:
47305 spin_unlock(&cookie->stores_lock);
47306 spin_unlock(&object->lock);
47307 spin_unlock(&cookie->lock);
47308 radix_tree_preload_end();
47309 kfree(op);
47310- fscache_stat(&fscache_n_stores_ok);
47311+ fscache_stat_unchecked(&fscache_n_stores_ok);
47312 _leave(" = 0");
47313 return 0;
47314
47315@@ -864,14 +864,14 @@ nobufs:
47316 spin_unlock(&cookie->lock);
47317 radix_tree_preload_end();
47318 kfree(op);
47319- fscache_stat(&fscache_n_stores_nobufs);
47320+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
47321 _leave(" = -ENOBUFS");
47322 return -ENOBUFS;
47323
47324 nomem_free:
47325 kfree(op);
47326 nomem:
47327- fscache_stat(&fscache_n_stores_oom);
47328+ fscache_stat_unchecked(&fscache_n_stores_oom);
47329 _leave(" = -ENOMEM");
47330 return -ENOMEM;
47331 }
47332@@ -889,7 +889,7 @@ void __fscache_uncache_page(struct fscac
47333 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47334 ASSERTCMP(page, !=, NULL);
47335
47336- fscache_stat(&fscache_n_uncaches);
47337+ fscache_stat_unchecked(&fscache_n_uncaches);
47338
47339 /* cache withdrawal may beat us to it */
47340 if (!PageFsCache(page))
47341@@ -942,7 +942,7 @@ void fscache_mark_pages_cached(struct fs
47342 unsigned long loop;
47343
47344 #ifdef CONFIG_FSCACHE_STATS
47345- atomic_add(pagevec->nr, &fscache_n_marks);
47346+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
47347 #endif
47348
47349 for (loop = 0; loop < pagevec->nr; loop++) {
47350diff -urNp linux-2.6.39.2/fs/fscache/stats.c linux-2.6.39.2/fs/fscache/stats.c
47351--- linux-2.6.39.2/fs/fscache/stats.c 2011-05-19 00:06:34.000000000 -0400
47352+++ linux-2.6.39.2/fs/fscache/stats.c 2011-05-22 19:36:32.000000000 -0400
47353@@ -18,95 +18,95 @@
47354 /*
47355 * operation counters
47356 */
47357-atomic_t fscache_n_op_pend;
47358-atomic_t fscache_n_op_run;
47359-atomic_t fscache_n_op_enqueue;
47360-atomic_t fscache_n_op_requeue;
47361-atomic_t fscache_n_op_deferred_release;
47362-atomic_t fscache_n_op_release;
47363-atomic_t fscache_n_op_gc;
47364-atomic_t fscache_n_op_cancelled;
47365-atomic_t fscache_n_op_rejected;
47366-
47367-atomic_t fscache_n_attr_changed;
47368-atomic_t fscache_n_attr_changed_ok;
47369-atomic_t fscache_n_attr_changed_nobufs;
47370-atomic_t fscache_n_attr_changed_nomem;
47371-atomic_t fscache_n_attr_changed_calls;
47372-
47373-atomic_t fscache_n_allocs;
47374-atomic_t fscache_n_allocs_ok;
47375-atomic_t fscache_n_allocs_wait;
47376-atomic_t fscache_n_allocs_nobufs;
47377-atomic_t fscache_n_allocs_intr;
47378-atomic_t fscache_n_allocs_object_dead;
47379-atomic_t fscache_n_alloc_ops;
47380-atomic_t fscache_n_alloc_op_waits;
47381-
47382-atomic_t fscache_n_retrievals;
47383-atomic_t fscache_n_retrievals_ok;
47384-atomic_t fscache_n_retrievals_wait;
47385-atomic_t fscache_n_retrievals_nodata;
47386-atomic_t fscache_n_retrievals_nobufs;
47387-atomic_t fscache_n_retrievals_intr;
47388-atomic_t fscache_n_retrievals_nomem;
47389-atomic_t fscache_n_retrievals_object_dead;
47390-atomic_t fscache_n_retrieval_ops;
47391-atomic_t fscache_n_retrieval_op_waits;
47392-
47393-atomic_t fscache_n_stores;
47394-atomic_t fscache_n_stores_ok;
47395-atomic_t fscache_n_stores_again;
47396-atomic_t fscache_n_stores_nobufs;
47397-atomic_t fscache_n_stores_oom;
47398-atomic_t fscache_n_store_ops;
47399-atomic_t fscache_n_store_calls;
47400-atomic_t fscache_n_store_pages;
47401-atomic_t fscache_n_store_radix_deletes;
47402-atomic_t fscache_n_store_pages_over_limit;
47403-
47404-atomic_t fscache_n_store_vmscan_not_storing;
47405-atomic_t fscache_n_store_vmscan_gone;
47406-atomic_t fscache_n_store_vmscan_busy;
47407-atomic_t fscache_n_store_vmscan_cancelled;
47408-
47409-atomic_t fscache_n_marks;
47410-atomic_t fscache_n_uncaches;
47411-
47412-atomic_t fscache_n_acquires;
47413-atomic_t fscache_n_acquires_null;
47414-atomic_t fscache_n_acquires_no_cache;
47415-atomic_t fscache_n_acquires_ok;
47416-atomic_t fscache_n_acquires_nobufs;
47417-atomic_t fscache_n_acquires_oom;
47418-
47419-atomic_t fscache_n_updates;
47420-atomic_t fscache_n_updates_null;
47421-atomic_t fscache_n_updates_run;
47422-
47423-atomic_t fscache_n_relinquishes;
47424-atomic_t fscache_n_relinquishes_null;
47425-atomic_t fscache_n_relinquishes_waitcrt;
47426-atomic_t fscache_n_relinquishes_retire;
47427-
47428-atomic_t fscache_n_cookie_index;
47429-atomic_t fscache_n_cookie_data;
47430-atomic_t fscache_n_cookie_special;
47431-
47432-atomic_t fscache_n_object_alloc;
47433-atomic_t fscache_n_object_no_alloc;
47434-atomic_t fscache_n_object_lookups;
47435-atomic_t fscache_n_object_lookups_negative;
47436-atomic_t fscache_n_object_lookups_positive;
47437-atomic_t fscache_n_object_lookups_timed_out;
47438-atomic_t fscache_n_object_created;
47439-atomic_t fscache_n_object_avail;
47440-atomic_t fscache_n_object_dead;
47441-
47442-atomic_t fscache_n_checkaux_none;
47443-atomic_t fscache_n_checkaux_okay;
47444-atomic_t fscache_n_checkaux_update;
47445-atomic_t fscache_n_checkaux_obsolete;
47446+atomic_unchecked_t fscache_n_op_pend;
47447+atomic_unchecked_t fscache_n_op_run;
47448+atomic_unchecked_t fscache_n_op_enqueue;
47449+atomic_unchecked_t fscache_n_op_requeue;
47450+atomic_unchecked_t fscache_n_op_deferred_release;
47451+atomic_unchecked_t fscache_n_op_release;
47452+atomic_unchecked_t fscache_n_op_gc;
47453+atomic_unchecked_t fscache_n_op_cancelled;
47454+atomic_unchecked_t fscache_n_op_rejected;
47455+
47456+atomic_unchecked_t fscache_n_attr_changed;
47457+atomic_unchecked_t fscache_n_attr_changed_ok;
47458+atomic_unchecked_t fscache_n_attr_changed_nobufs;
47459+atomic_unchecked_t fscache_n_attr_changed_nomem;
47460+atomic_unchecked_t fscache_n_attr_changed_calls;
47461+
47462+atomic_unchecked_t fscache_n_allocs;
47463+atomic_unchecked_t fscache_n_allocs_ok;
47464+atomic_unchecked_t fscache_n_allocs_wait;
47465+atomic_unchecked_t fscache_n_allocs_nobufs;
47466+atomic_unchecked_t fscache_n_allocs_intr;
47467+atomic_unchecked_t fscache_n_allocs_object_dead;
47468+atomic_unchecked_t fscache_n_alloc_ops;
47469+atomic_unchecked_t fscache_n_alloc_op_waits;
47470+
47471+atomic_unchecked_t fscache_n_retrievals;
47472+atomic_unchecked_t fscache_n_retrievals_ok;
47473+atomic_unchecked_t fscache_n_retrievals_wait;
47474+atomic_unchecked_t fscache_n_retrievals_nodata;
47475+atomic_unchecked_t fscache_n_retrievals_nobufs;
47476+atomic_unchecked_t fscache_n_retrievals_intr;
47477+atomic_unchecked_t fscache_n_retrievals_nomem;
47478+atomic_unchecked_t fscache_n_retrievals_object_dead;
47479+atomic_unchecked_t fscache_n_retrieval_ops;
47480+atomic_unchecked_t fscache_n_retrieval_op_waits;
47481+
47482+atomic_unchecked_t fscache_n_stores;
47483+atomic_unchecked_t fscache_n_stores_ok;
47484+atomic_unchecked_t fscache_n_stores_again;
47485+atomic_unchecked_t fscache_n_stores_nobufs;
47486+atomic_unchecked_t fscache_n_stores_oom;
47487+atomic_unchecked_t fscache_n_store_ops;
47488+atomic_unchecked_t fscache_n_store_calls;
47489+atomic_unchecked_t fscache_n_store_pages;
47490+atomic_unchecked_t fscache_n_store_radix_deletes;
47491+atomic_unchecked_t fscache_n_store_pages_over_limit;
47492+
47493+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
47494+atomic_unchecked_t fscache_n_store_vmscan_gone;
47495+atomic_unchecked_t fscache_n_store_vmscan_busy;
47496+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
47497+
47498+atomic_unchecked_t fscache_n_marks;
47499+atomic_unchecked_t fscache_n_uncaches;
47500+
47501+atomic_unchecked_t fscache_n_acquires;
47502+atomic_unchecked_t fscache_n_acquires_null;
47503+atomic_unchecked_t fscache_n_acquires_no_cache;
47504+atomic_unchecked_t fscache_n_acquires_ok;
47505+atomic_unchecked_t fscache_n_acquires_nobufs;
47506+atomic_unchecked_t fscache_n_acquires_oom;
47507+
47508+atomic_unchecked_t fscache_n_updates;
47509+atomic_unchecked_t fscache_n_updates_null;
47510+atomic_unchecked_t fscache_n_updates_run;
47511+
47512+atomic_unchecked_t fscache_n_relinquishes;
47513+atomic_unchecked_t fscache_n_relinquishes_null;
47514+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
47515+atomic_unchecked_t fscache_n_relinquishes_retire;
47516+
47517+atomic_unchecked_t fscache_n_cookie_index;
47518+atomic_unchecked_t fscache_n_cookie_data;
47519+atomic_unchecked_t fscache_n_cookie_special;
47520+
47521+atomic_unchecked_t fscache_n_object_alloc;
47522+atomic_unchecked_t fscache_n_object_no_alloc;
47523+atomic_unchecked_t fscache_n_object_lookups;
47524+atomic_unchecked_t fscache_n_object_lookups_negative;
47525+atomic_unchecked_t fscache_n_object_lookups_positive;
47526+atomic_unchecked_t fscache_n_object_lookups_timed_out;
47527+atomic_unchecked_t fscache_n_object_created;
47528+atomic_unchecked_t fscache_n_object_avail;
47529+atomic_unchecked_t fscache_n_object_dead;
47530+
47531+atomic_unchecked_t fscache_n_checkaux_none;
47532+atomic_unchecked_t fscache_n_checkaux_okay;
47533+atomic_unchecked_t fscache_n_checkaux_update;
47534+atomic_unchecked_t fscache_n_checkaux_obsolete;
47535
47536 atomic_t fscache_n_cop_alloc_object;
47537 atomic_t fscache_n_cop_lookup_object;
47538@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
47539 seq_puts(m, "FS-Cache statistics\n");
47540
47541 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
47542- atomic_read(&fscache_n_cookie_index),
47543- atomic_read(&fscache_n_cookie_data),
47544- atomic_read(&fscache_n_cookie_special));
47545+ atomic_read_unchecked(&fscache_n_cookie_index),
47546+ atomic_read_unchecked(&fscache_n_cookie_data),
47547+ atomic_read_unchecked(&fscache_n_cookie_special));
47548
47549 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
47550- atomic_read(&fscache_n_object_alloc),
47551- atomic_read(&fscache_n_object_no_alloc),
47552- atomic_read(&fscache_n_object_avail),
47553- atomic_read(&fscache_n_object_dead));
47554+ atomic_read_unchecked(&fscache_n_object_alloc),
47555+ atomic_read_unchecked(&fscache_n_object_no_alloc),
47556+ atomic_read_unchecked(&fscache_n_object_avail),
47557+ atomic_read_unchecked(&fscache_n_object_dead));
47558 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
47559- atomic_read(&fscache_n_checkaux_none),
47560- atomic_read(&fscache_n_checkaux_okay),
47561- atomic_read(&fscache_n_checkaux_update),
47562- atomic_read(&fscache_n_checkaux_obsolete));
47563+ atomic_read_unchecked(&fscache_n_checkaux_none),
47564+ atomic_read_unchecked(&fscache_n_checkaux_okay),
47565+ atomic_read_unchecked(&fscache_n_checkaux_update),
47566+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
47567
47568 seq_printf(m, "Pages : mrk=%u unc=%u\n",
47569- atomic_read(&fscache_n_marks),
47570- atomic_read(&fscache_n_uncaches));
47571+ atomic_read_unchecked(&fscache_n_marks),
47572+ atomic_read_unchecked(&fscache_n_uncaches));
47573
47574 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
47575 " oom=%u\n",
47576- atomic_read(&fscache_n_acquires),
47577- atomic_read(&fscache_n_acquires_null),
47578- atomic_read(&fscache_n_acquires_no_cache),
47579- atomic_read(&fscache_n_acquires_ok),
47580- atomic_read(&fscache_n_acquires_nobufs),
47581- atomic_read(&fscache_n_acquires_oom));
47582+ atomic_read_unchecked(&fscache_n_acquires),
47583+ atomic_read_unchecked(&fscache_n_acquires_null),
47584+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
47585+ atomic_read_unchecked(&fscache_n_acquires_ok),
47586+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
47587+ atomic_read_unchecked(&fscache_n_acquires_oom));
47588
47589 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
47590- atomic_read(&fscache_n_object_lookups),
47591- atomic_read(&fscache_n_object_lookups_negative),
47592- atomic_read(&fscache_n_object_lookups_positive),
47593- atomic_read(&fscache_n_object_created),
47594- atomic_read(&fscache_n_object_lookups_timed_out));
47595+ atomic_read_unchecked(&fscache_n_object_lookups),
47596+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
47597+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
47598+ atomic_read_unchecked(&fscache_n_object_created),
47599+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
47600
47601 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
47602- atomic_read(&fscache_n_updates),
47603- atomic_read(&fscache_n_updates_null),
47604- atomic_read(&fscache_n_updates_run));
47605+ atomic_read_unchecked(&fscache_n_updates),
47606+ atomic_read_unchecked(&fscache_n_updates_null),
47607+ atomic_read_unchecked(&fscache_n_updates_run));
47608
47609 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
47610- atomic_read(&fscache_n_relinquishes),
47611- atomic_read(&fscache_n_relinquishes_null),
47612- atomic_read(&fscache_n_relinquishes_waitcrt),
47613- atomic_read(&fscache_n_relinquishes_retire));
47614+ atomic_read_unchecked(&fscache_n_relinquishes),
47615+ atomic_read_unchecked(&fscache_n_relinquishes_null),
47616+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
47617+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
47618
47619 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
47620- atomic_read(&fscache_n_attr_changed),
47621- atomic_read(&fscache_n_attr_changed_ok),
47622- atomic_read(&fscache_n_attr_changed_nobufs),
47623- atomic_read(&fscache_n_attr_changed_nomem),
47624- atomic_read(&fscache_n_attr_changed_calls));
47625+ atomic_read_unchecked(&fscache_n_attr_changed),
47626+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
47627+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
47628+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
47629+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
47630
47631 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
47632- atomic_read(&fscache_n_allocs),
47633- atomic_read(&fscache_n_allocs_ok),
47634- atomic_read(&fscache_n_allocs_wait),
47635- atomic_read(&fscache_n_allocs_nobufs),
47636- atomic_read(&fscache_n_allocs_intr));
47637+ atomic_read_unchecked(&fscache_n_allocs),
47638+ atomic_read_unchecked(&fscache_n_allocs_ok),
47639+ atomic_read_unchecked(&fscache_n_allocs_wait),
47640+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
47641+ atomic_read_unchecked(&fscache_n_allocs_intr));
47642 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
47643- atomic_read(&fscache_n_alloc_ops),
47644- atomic_read(&fscache_n_alloc_op_waits),
47645- atomic_read(&fscache_n_allocs_object_dead));
47646+ atomic_read_unchecked(&fscache_n_alloc_ops),
47647+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
47648+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
47649
47650 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
47651 " int=%u oom=%u\n",
47652- atomic_read(&fscache_n_retrievals),
47653- atomic_read(&fscache_n_retrievals_ok),
47654- atomic_read(&fscache_n_retrievals_wait),
47655- atomic_read(&fscache_n_retrievals_nodata),
47656- atomic_read(&fscache_n_retrievals_nobufs),
47657- atomic_read(&fscache_n_retrievals_intr),
47658- atomic_read(&fscache_n_retrievals_nomem));
47659+ atomic_read_unchecked(&fscache_n_retrievals),
47660+ atomic_read_unchecked(&fscache_n_retrievals_ok),
47661+ atomic_read_unchecked(&fscache_n_retrievals_wait),
47662+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
47663+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
47664+ atomic_read_unchecked(&fscache_n_retrievals_intr),
47665+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
47666 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
47667- atomic_read(&fscache_n_retrieval_ops),
47668- atomic_read(&fscache_n_retrieval_op_waits),
47669- atomic_read(&fscache_n_retrievals_object_dead));
47670+ atomic_read_unchecked(&fscache_n_retrieval_ops),
47671+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
47672+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
47673
47674 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
47675- atomic_read(&fscache_n_stores),
47676- atomic_read(&fscache_n_stores_ok),
47677- atomic_read(&fscache_n_stores_again),
47678- atomic_read(&fscache_n_stores_nobufs),
47679- atomic_read(&fscache_n_stores_oom));
47680+ atomic_read_unchecked(&fscache_n_stores),
47681+ atomic_read_unchecked(&fscache_n_stores_ok),
47682+ atomic_read_unchecked(&fscache_n_stores_again),
47683+ atomic_read_unchecked(&fscache_n_stores_nobufs),
47684+ atomic_read_unchecked(&fscache_n_stores_oom));
47685 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
47686- atomic_read(&fscache_n_store_ops),
47687- atomic_read(&fscache_n_store_calls),
47688- atomic_read(&fscache_n_store_pages),
47689- atomic_read(&fscache_n_store_radix_deletes),
47690- atomic_read(&fscache_n_store_pages_over_limit));
47691+ atomic_read_unchecked(&fscache_n_store_ops),
47692+ atomic_read_unchecked(&fscache_n_store_calls),
47693+ atomic_read_unchecked(&fscache_n_store_pages),
47694+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
47695+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
47696
47697 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
47698- atomic_read(&fscache_n_store_vmscan_not_storing),
47699- atomic_read(&fscache_n_store_vmscan_gone),
47700- atomic_read(&fscache_n_store_vmscan_busy),
47701- atomic_read(&fscache_n_store_vmscan_cancelled));
47702+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
47703+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
47704+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
47705+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
47706
47707 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
47708- atomic_read(&fscache_n_op_pend),
47709- atomic_read(&fscache_n_op_run),
47710- atomic_read(&fscache_n_op_enqueue),
47711- atomic_read(&fscache_n_op_cancelled),
47712- atomic_read(&fscache_n_op_rejected));
47713+ atomic_read_unchecked(&fscache_n_op_pend),
47714+ atomic_read_unchecked(&fscache_n_op_run),
47715+ atomic_read_unchecked(&fscache_n_op_enqueue),
47716+ atomic_read_unchecked(&fscache_n_op_cancelled),
47717+ atomic_read_unchecked(&fscache_n_op_rejected));
47718 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
47719- atomic_read(&fscache_n_op_deferred_release),
47720- atomic_read(&fscache_n_op_release),
47721- atomic_read(&fscache_n_op_gc));
47722+ atomic_read_unchecked(&fscache_n_op_deferred_release),
47723+ atomic_read_unchecked(&fscache_n_op_release),
47724+ atomic_read_unchecked(&fscache_n_op_gc));
47725
47726 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
47727 atomic_read(&fscache_n_cop_alloc_object),
47728diff -urNp linux-2.6.39.2/fs/fs_struct.c linux-2.6.39.2/fs/fs_struct.c
47729--- linux-2.6.39.2/fs/fs_struct.c 2011-05-19 00:06:34.000000000 -0400
47730+++ linux-2.6.39.2/fs/fs_struct.c 2011-05-22 19:41:37.000000000 -0400
47731@@ -4,6 +4,7 @@
47732 #include <linux/path.h>
47733 #include <linux/slab.h>
47734 #include <linux/fs_struct.h>
47735+#include <linux/grsecurity.h>
47736 #include "internal.h"
47737
47738 static inline void path_get_longterm(struct path *path)
47739@@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s
47740 old_root = fs->root;
47741 fs->root = *path;
47742 path_get_longterm(path);
47743+ gr_set_chroot_entries(current, path);
47744 write_seqcount_end(&fs->seq);
47745 spin_unlock(&fs->lock);
47746 if (old_root.dentry)
47747@@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo
47748 && fs->root.mnt == old_root->mnt) {
47749 path_get_longterm(new_root);
47750 fs->root = *new_root;
47751+ gr_set_chroot_entries(p, new_root);
47752 count++;
47753 }
47754 if (fs->pwd.dentry == old_root->dentry
47755@@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
47756 spin_lock(&fs->lock);
47757 write_seqcount_begin(&fs->seq);
47758 tsk->fs = NULL;
47759- kill = !--fs->users;
47760+ gr_clear_chroot_entries(tsk);
47761+ kill = !atomic_dec_return(&fs->users);
47762 write_seqcount_end(&fs->seq);
47763 spin_unlock(&fs->lock);
47764 task_unlock(tsk);
47765@@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct
47766 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
47767 /* We don't need to lock fs - think why ;-) */
47768 if (fs) {
47769- fs->users = 1;
47770+ atomic_set(&fs->users, 1);
47771 fs->in_exec = 0;
47772 spin_lock_init(&fs->lock);
47773 seqcount_init(&fs->seq);
47774@@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct
47775 spin_lock(&old->lock);
47776 fs->root = old->root;
47777 path_get_longterm(&fs->root);
47778+ /* instead of calling gr_set_chroot_entries here,
47779+ we call it from every caller of this function
47780+ */
47781 fs->pwd = old->pwd;
47782 path_get_longterm(&fs->pwd);
47783 spin_unlock(&old->lock);
47784@@ -150,8 +157,9 @@ int unshare_fs_struct(void)
47785
47786 task_lock(current);
47787 spin_lock(&fs->lock);
47788- kill = !--fs->users;
47789+ kill = !atomic_dec_return(&fs->users);
47790 current->fs = new_fs;
47791+ gr_set_chroot_entries(current, &new_fs->root);
47792 spin_unlock(&fs->lock);
47793 task_unlock(current);
47794
47795@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
47796
47797 /* to be mentioned only in INIT_TASK */
47798 struct fs_struct init_fs = {
47799- .users = 1,
47800+ .users = ATOMIC_INIT(1),
47801 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
47802 .seq = SEQCNT_ZERO,
47803 .umask = 0022,
47804@@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
47805 task_lock(current);
47806
47807 spin_lock(&init_fs.lock);
47808- init_fs.users++;
47809+ atomic_inc(&init_fs.users);
47810 spin_unlock(&init_fs.lock);
47811
47812 spin_lock(&fs->lock);
47813 current->fs = &init_fs;
47814- kill = !--fs->users;
47815+ gr_set_chroot_entries(current, &current->fs->root);
47816+ kill = !atomic_dec_return(&fs->users);
47817 spin_unlock(&fs->lock);
47818
47819 task_unlock(current);
47820diff -urNp linux-2.6.39.2/fs/fuse/cuse.c linux-2.6.39.2/fs/fuse/cuse.c
47821--- linux-2.6.39.2/fs/fuse/cuse.c 2011-05-19 00:06:34.000000000 -0400
47822+++ linux-2.6.39.2/fs/fuse/cuse.c 2011-05-22 19:36:32.000000000 -0400
47823@@ -538,8 +538,18 @@ static int cuse_channel_release(struct i
47824 return rc;
47825 }
47826
47827-static struct file_operations cuse_channel_fops; /* initialized during init */
47828-
47829+static const struct file_operations cuse_channel_fops = { /* initialized during init */
47830+ .owner = THIS_MODULE,
47831+ .llseek = no_llseek,
47832+ .read = do_sync_read,
47833+ .aio_read = fuse_dev_read,
47834+ .write = do_sync_write,
47835+ .aio_write = fuse_dev_write,
47836+ .poll = fuse_dev_poll,
47837+ .open = cuse_channel_open,
47838+ .release = cuse_channel_release,
47839+ .fasync = fuse_dev_fasync,
47840+};
47841
47842 /**************************************************************************
47843 * Misc stuff and module initializatiion
47844@@ -585,12 +595,6 @@ static int __init cuse_init(void)
47845 for (i = 0; i < CUSE_CONNTBL_LEN; i++)
47846 INIT_LIST_HEAD(&cuse_conntbl[i]);
47847
47848- /* inherit and extend fuse_dev_operations */
47849- cuse_channel_fops = fuse_dev_operations;
47850- cuse_channel_fops.owner = THIS_MODULE;
47851- cuse_channel_fops.open = cuse_channel_open;
47852- cuse_channel_fops.release = cuse_channel_release;
47853-
47854 cuse_class = class_create(THIS_MODULE, "cuse");
47855 if (IS_ERR(cuse_class))
47856 return PTR_ERR(cuse_class);
47857diff -urNp linux-2.6.39.2/fs/fuse/dev.c linux-2.6.39.2/fs/fuse/dev.c
47858--- linux-2.6.39.2/fs/fuse/dev.c 2011-05-19 00:06:34.000000000 -0400
47859+++ linux-2.6.39.2/fs/fuse/dev.c 2011-05-22 19:36:32.000000000 -0400
47860@@ -1181,7 +1181,7 @@ static ssize_t fuse_dev_do_read(struct f
47861 return err;
47862 }
47863
47864-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47865+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47866 unsigned long nr_segs, loff_t pos)
47867 {
47868 struct fuse_copy_state cs;
47869@@ -1195,6 +1195,8 @@ static ssize_t fuse_dev_read(struct kioc
47870 return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
47871 }
47872
47873+EXPORT_SYMBOL_GPL(fuse_dev_read);
47874+
47875 static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
47876 struct pipe_buffer *buf)
47877 {
47878@@ -1238,7 +1240,7 @@ static ssize_t fuse_dev_splice_read(stru
47879 ret = 0;
47880 pipe_lock(pipe);
47881
47882- if (!pipe->readers) {
47883+ if (!atomic_read(&pipe->readers)) {
47884 send_sig(SIGPIPE, current, 0);
47885 if (!ret)
47886 ret = -EPIPE;
47887@@ -1731,7 +1733,7 @@ static ssize_t fuse_dev_do_write(struct
47888 return err;
47889 }
47890
47891-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47892+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47893 unsigned long nr_segs, loff_t pos)
47894 {
47895 struct fuse_copy_state cs;
47896@@ -1744,6 +1746,8 @@ static ssize_t fuse_dev_write(struct kio
47897 return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
47898 }
47899
47900+EXPORT_SYMBOL_GPL(fuse_dev_write);
47901+
47902 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
47903 struct file *out, loff_t *ppos,
47904 size_t len, unsigned int flags)
47905@@ -1822,7 +1826,7 @@ out:
47906 return ret;
47907 }
47908
47909-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47910+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47911 {
47912 unsigned mask = POLLOUT | POLLWRNORM;
47913 struct fuse_conn *fc = fuse_get_conn(file);
47914@@ -1841,6 +1845,8 @@ static unsigned fuse_dev_poll(struct fil
47915 return mask;
47916 }
47917
47918+EXPORT_SYMBOL_GPL(fuse_dev_poll);
47919+
47920 /*
47921 * Abort all requests on the given list (pending or processing)
47922 *
47923@@ -1977,7 +1983,7 @@ int fuse_dev_release(struct inode *inode
47924 }
47925 EXPORT_SYMBOL_GPL(fuse_dev_release);
47926
47927-static int fuse_dev_fasync(int fd, struct file *file, int on)
47928+int fuse_dev_fasync(int fd, struct file *file, int on)
47929 {
47930 struct fuse_conn *fc = fuse_get_conn(file);
47931 if (!fc)
47932@@ -1987,6 +1993,8 @@ static int fuse_dev_fasync(int fd, struc
47933 return fasync_helper(fd, file, on, &fc->fasync);
47934 }
47935
47936+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
47937+
47938 const struct file_operations fuse_dev_operations = {
47939 .owner = THIS_MODULE,
47940 .llseek = no_llseek,
47941diff -urNp linux-2.6.39.2/fs/fuse/dir.c linux-2.6.39.2/fs/fuse/dir.c
47942--- linux-2.6.39.2/fs/fuse/dir.c 2011-05-19 00:06:34.000000000 -0400
47943+++ linux-2.6.39.2/fs/fuse/dir.c 2011-05-22 19:36:32.000000000 -0400
47944@@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *de
47945 return link;
47946 }
47947
47948-static void free_link(char *link)
47949+static void free_link(const char *link)
47950 {
47951 if (!IS_ERR(link))
47952 free_page((unsigned long) link);
47953diff -urNp linux-2.6.39.2/fs/fuse/fuse_i.h linux-2.6.39.2/fs/fuse/fuse_i.h
47954--- linux-2.6.39.2/fs/fuse/fuse_i.h 2011-05-19 00:06:34.000000000 -0400
47955+++ linux-2.6.39.2/fs/fuse/fuse_i.h 2011-05-22 19:36:32.000000000 -0400
47956@@ -540,6 +540,16 @@ extern const struct file_operations fuse
47957
47958 extern const struct dentry_operations fuse_dentry_operations;
47959
47960+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47961+ unsigned long nr_segs, loff_t pos);
47962+
47963+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47964+ unsigned long nr_segs, loff_t pos);
47965+
47966+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
47967+
47968+extern int fuse_dev_fasync(int fd, struct file *file, int on);
47969+
47970 /**
47971 * Inode to nodeid comparison.
47972 */
47973diff -urNp linux-2.6.39.2/fs/gfs2/ops_inode.c linux-2.6.39.2/fs/gfs2/ops_inode.c
47974--- linux-2.6.39.2/fs/gfs2/ops_inode.c 2011-05-19 00:06:34.000000000 -0400
47975+++ linux-2.6.39.2/fs/gfs2/ops_inode.c 2011-05-22 19:36:32.000000000 -0400
47976@@ -740,6 +740,8 @@ static int gfs2_rename(struct inode *odi
47977 unsigned int x;
47978 int error;
47979
47980+ pax_track_stack();
47981+
47982 if (ndentry->d_inode) {
47983 nip = GFS2_I(ndentry->d_inode);
47984 if (ip == nip)
47985@@ -1019,7 +1021,7 @@ out:
47986
47987 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
47988 {
47989- char *s = nd_get_link(nd);
47990+ const char *s = nd_get_link(nd);
47991 if (!IS_ERR(s))
47992 kfree(s);
47993 }
47994diff -urNp linux-2.6.39.2/fs/hfsplus/catalog.c linux-2.6.39.2/fs/hfsplus/catalog.c
47995--- linux-2.6.39.2/fs/hfsplus/catalog.c 2011-05-19 00:06:34.000000000 -0400
47996+++ linux-2.6.39.2/fs/hfsplus/catalog.c 2011-05-22 19:36:32.000000000 -0400
47997@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block
47998 int err;
47999 u16 type;
48000
48001+ pax_track_stack();
48002+
48003 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
48004 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
48005 if (err)
48006@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct
48007 int entry_size;
48008 int err;
48009
48010+ pax_track_stack();
48011+
48012 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
48013 str->name, cnid, inode->i_nlink);
48014 hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
48015@@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
48016 int entry_size, type;
48017 int err = 0;
48018
48019+ pax_track_stack();
48020+
48021 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
48022 cnid, src_dir->i_ino, src_name->name,
48023 dst_dir->i_ino, dst_name->name);
48024diff -urNp linux-2.6.39.2/fs/hfsplus/dir.c linux-2.6.39.2/fs/hfsplus/dir.c
48025--- linux-2.6.39.2/fs/hfsplus/dir.c 2011-05-19 00:06:34.000000000 -0400
48026+++ linux-2.6.39.2/fs/hfsplus/dir.c 2011-05-22 19:36:32.000000000 -0400
48027@@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
48028 struct hfsplus_readdir_data *rd;
48029 u16 type;
48030
48031+ pax_track_stack();
48032+
48033 if (filp->f_pos >= inode->i_size)
48034 return 0;
48035
48036diff -urNp linux-2.6.39.2/fs/hfsplus/inode.c linux-2.6.39.2/fs/hfsplus/inode.c
48037--- linux-2.6.39.2/fs/hfsplus/inode.c 2011-05-19 00:06:34.000000000 -0400
48038+++ linux-2.6.39.2/fs/hfsplus/inode.c 2011-05-22 19:36:32.000000000 -0400
48039@@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode
48040 int res = 0;
48041 u16 type;
48042
48043+ pax_track_stack();
48044+
48045 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
48046
48047 HFSPLUS_I(inode)->linkid = 0;
48048@@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode
48049 struct hfs_find_data fd;
48050 hfsplus_cat_entry entry;
48051
48052+ pax_track_stack();
48053+
48054 if (HFSPLUS_IS_RSRC(inode))
48055 main_inode = HFSPLUS_I(inode)->rsrc_inode;
48056
48057diff -urNp linux-2.6.39.2/fs/hfsplus/ioctl.c linux-2.6.39.2/fs/hfsplus/ioctl.c
48058--- linux-2.6.39.2/fs/hfsplus/ioctl.c 2011-05-19 00:06:34.000000000 -0400
48059+++ linux-2.6.39.2/fs/hfsplus/ioctl.c 2011-05-22 19:36:32.000000000 -0400
48060@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
48061 struct hfsplus_cat_file *file;
48062 int res;
48063
48064+ pax_track_stack();
48065+
48066 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
48067 return -EOPNOTSUPP;
48068
48069@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
48070 struct hfsplus_cat_file *file;
48071 ssize_t res = 0;
48072
48073+ pax_track_stack();
48074+
48075 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
48076 return -EOPNOTSUPP;
48077
48078diff -urNp linux-2.6.39.2/fs/hfsplus/super.c linux-2.6.39.2/fs/hfsplus/super.c
48079--- linux-2.6.39.2/fs/hfsplus/super.c 2011-05-19 00:06:34.000000000 -0400
48080+++ linux-2.6.39.2/fs/hfsplus/super.c 2011-05-22 19:36:32.000000000 -0400
48081@@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
48082 struct nls_table *nls = NULL;
48083 int err;
48084
48085+ pax_track_stack();
48086+
48087 err = -EINVAL;
48088 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
48089 if (!sbi)
48090diff -urNp linux-2.6.39.2/fs/hugetlbfs/inode.c linux-2.6.39.2/fs/hugetlbfs/inode.c
48091--- linux-2.6.39.2/fs/hugetlbfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48092+++ linux-2.6.39.2/fs/hugetlbfs/inode.c 2011-05-22 19:41:37.000000000 -0400
48093@@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs
48094 .kill_sb = kill_litter_super,
48095 };
48096
48097-static struct vfsmount *hugetlbfs_vfsmount;
48098+struct vfsmount *hugetlbfs_vfsmount;
48099
48100 static int can_do_hugetlb_shm(void)
48101 {
48102diff -urNp linux-2.6.39.2/fs/inode.c linux-2.6.39.2/fs/inode.c
48103--- linux-2.6.39.2/fs/inode.c 2011-05-19 00:06:34.000000000 -0400
48104+++ linux-2.6.39.2/fs/inode.c 2011-05-22 19:36:32.000000000 -0400
48105@@ -862,8 +862,8 @@ unsigned int get_next_ino(void)
48106
48107 #ifdef CONFIG_SMP
48108 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
48109- static atomic_t shared_last_ino;
48110- int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
48111+ static atomic_unchecked_t shared_last_ino;
48112+ int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
48113
48114 res = next - LAST_INO_BATCH;
48115 }
48116diff -urNp linux-2.6.39.2/fs/jbd/checkpoint.c linux-2.6.39.2/fs/jbd/checkpoint.c
48117--- linux-2.6.39.2/fs/jbd/checkpoint.c 2011-05-19 00:06:34.000000000 -0400
48118+++ linux-2.6.39.2/fs/jbd/checkpoint.c 2011-05-22 19:36:32.000000000 -0400
48119@@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
48120 tid_t this_tid;
48121 int result;
48122
48123+ pax_track_stack();
48124+
48125 jbd_debug(1, "Start checkpoint\n");
48126
48127 /*
48128diff -urNp linux-2.6.39.2/fs/jffs2/compr_rtime.c linux-2.6.39.2/fs/jffs2/compr_rtime.c
48129--- linux-2.6.39.2/fs/jffs2/compr_rtime.c 2011-05-19 00:06:34.000000000 -0400
48130+++ linux-2.6.39.2/fs/jffs2/compr_rtime.c 2011-05-22 19:36:32.000000000 -0400
48131@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
48132 int outpos = 0;
48133 int pos=0;
48134
48135+ pax_track_stack();
48136+
48137 memset(positions,0,sizeof(positions));
48138
48139 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
48140@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
48141 int outpos = 0;
48142 int pos=0;
48143
48144+ pax_track_stack();
48145+
48146 memset(positions,0,sizeof(positions));
48147
48148 while (outpos<destlen) {
48149diff -urNp linux-2.6.39.2/fs/jffs2/compr_rubin.c linux-2.6.39.2/fs/jffs2/compr_rubin.c
48150--- linux-2.6.39.2/fs/jffs2/compr_rubin.c 2011-05-19 00:06:34.000000000 -0400
48151+++ linux-2.6.39.2/fs/jffs2/compr_rubin.c 2011-05-22 19:36:32.000000000 -0400
48152@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
48153 int ret;
48154 uint32_t mysrclen, mydstlen;
48155
48156+ pax_track_stack();
48157+
48158 mysrclen = *sourcelen;
48159 mydstlen = *dstlen - 8;
48160
48161diff -urNp linux-2.6.39.2/fs/jffs2/erase.c linux-2.6.39.2/fs/jffs2/erase.c
48162--- linux-2.6.39.2/fs/jffs2/erase.c 2011-05-19 00:06:34.000000000 -0400
48163+++ linux-2.6.39.2/fs/jffs2/erase.c 2011-05-22 19:36:32.000000000 -0400
48164@@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
48165 struct jffs2_unknown_node marker = {
48166 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
48167 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
48168- .totlen = cpu_to_je32(c->cleanmarker_size)
48169+ .totlen = cpu_to_je32(c->cleanmarker_size),
48170+ .hdr_crc = cpu_to_je32(0)
48171 };
48172
48173 jffs2_prealloc_raw_node_refs(c, jeb, 1);
48174diff -urNp linux-2.6.39.2/fs/jffs2/wbuf.c linux-2.6.39.2/fs/jffs2/wbuf.c
48175--- linux-2.6.39.2/fs/jffs2/wbuf.c 2011-05-19 00:06:34.000000000 -0400
48176+++ linux-2.6.39.2/fs/jffs2/wbuf.c 2011-05-22 19:36:32.000000000 -0400
48177@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
48178 {
48179 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
48180 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
48181- .totlen = constant_cpu_to_je32(8)
48182+ .totlen = constant_cpu_to_je32(8),
48183+ .hdr_crc = constant_cpu_to_je32(0)
48184 };
48185
48186 /*
48187diff -urNp linux-2.6.39.2/fs/jffs2/xattr.c linux-2.6.39.2/fs/jffs2/xattr.c
48188--- linux-2.6.39.2/fs/jffs2/xattr.c 2011-05-19 00:06:34.000000000 -0400
48189+++ linux-2.6.39.2/fs/jffs2/xattr.c 2011-05-22 19:36:32.000000000 -0400
48190@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
48191
48192 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
48193
48194+ pax_track_stack();
48195+
48196 /* Phase.1 : Merge same xref */
48197 for (i=0; i < XREF_TMPHASH_SIZE; i++)
48198 xref_tmphash[i] = NULL;
48199diff -urNp linux-2.6.39.2/fs/jfs/super.c linux-2.6.39.2/fs/jfs/super.c
48200--- linux-2.6.39.2/fs/jfs/super.c 2011-05-19 00:06:34.000000000 -0400
48201+++ linux-2.6.39.2/fs/jfs/super.c 2011-06-07 18:07:24.000000000 -0400
48202@@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
48203
48204 jfs_inode_cachep =
48205 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
48206- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
48207+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
48208 init_once);
48209 if (jfs_inode_cachep == NULL)
48210 return -ENOMEM;
48211diff -urNp linux-2.6.39.2/fs/Kconfig.binfmt linux-2.6.39.2/fs/Kconfig.binfmt
48212--- linux-2.6.39.2/fs/Kconfig.binfmt 2011-05-19 00:06:34.000000000 -0400
48213+++ linux-2.6.39.2/fs/Kconfig.binfmt 2011-05-22 19:36:32.000000000 -0400
48214@@ -86,7 +86,7 @@ config HAVE_AOUT
48215
48216 config BINFMT_AOUT
48217 tristate "Kernel support for a.out and ECOFF binaries"
48218- depends on HAVE_AOUT
48219+ depends on HAVE_AOUT && BROKEN
48220 ---help---
48221 A.out (Assembler.OUTput) is a set of formats for libraries and
48222 executables used in the earliest versions of UNIX. Linux used
48223diff -urNp linux-2.6.39.2/fs/libfs.c linux-2.6.39.2/fs/libfs.c
48224--- linux-2.6.39.2/fs/libfs.c 2011-05-19 00:06:34.000000000 -0400
48225+++ linux-2.6.39.2/fs/libfs.c 2011-05-22 19:36:32.000000000 -0400
48226@@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
48227
48228 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
48229 struct dentry *next;
48230+ char d_name[sizeof(next->d_iname)];
48231+ const unsigned char *name;
48232+
48233 next = list_entry(p, struct dentry, d_u.d_child);
48234 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
48235 if (!simple_positive(next)) {
48236@@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
48237
48238 spin_unlock(&next->d_lock);
48239 spin_unlock(&dentry->d_lock);
48240- if (filldir(dirent, next->d_name.name,
48241+ name = next->d_name.name;
48242+ if (name == next->d_iname) {
48243+ memcpy(d_name, name, next->d_name.len);
48244+ name = d_name;
48245+ }
48246+ if (filldir(dirent, name,
48247 next->d_name.len, filp->f_pos,
48248 next->d_inode->i_ino,
48249 dt_type(next->d_inode)) < 0)
48250diff -urNp linux-2.6.39.2/fs/lockd/clntproc.c linux-2.6.39.2/fs/lockd/clntproc.c
48251--- linux-2.6.39.2/fs/lockd/clntproc.c 2011-05-19 00:06:34.000000000 -0400
48252+++ linux-2.6.39.2/fs/lockd/clntproc.c 2011-05-22 19:36:32.000000000 -0400
48253@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
48254 /*
48255 * Cookie counter for NLM requests
48256 */
48257-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
48258+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
48259
48260 void nlmclnt_next_cookie(struct nlm_cookie *c)
48261 {
48262- u32 cookie = atomic_inc_return(&nlm_cookie);
48263+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
48264
48265 memcpy(c->data, &cookie, 4);
48266 c->len=4;
48267@@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
48268 struct nlm_rqst reqst, *req;
48269 int status;
48270
48271+ pax_track_stack();
48272+
48273 req = &reqst;
48274 memset(req, 0, sizeof(*req));
48275 locks_init_lock(&req->a_args.lock.fl);
48276diff -urNp linux-2.6.39.2/fs/lockd/svc.c linux-2.6.39.2/fs/lockd/svc.c
48277--- linux-2.6.39.2/fs/lockd/svc.c 2011-05-19 00:06:34.000000000 -0400
48278+++ linux-2.6.39.2/fs/lockd/svc.c 2011-05-22 19:36:32.000000000 -0400
48279@@ -41,7 +41,7 @@
48280
48281 static struct svc_program nlmsvc_program;
48282
48283-struct nlmsvc_binding * nlmsvc_ops;
48284+const struct nlmsvc_binding * nlmsvc_ops;
48285 EXPORT_SYMBOL_GPL(nlmsvc_ops);
48286
48287 static DEFINE_MUTEX(nlmsvc_mutex);
48288diff -urNp linux-2.6.39.2/fs/locks.c linux-2.6.39.2/fs/locks.c
48289--- linux-2.6.39.2/fs/locks.c 2011-05-19 00:06:34.000000000 -0400
48290+++ linux-2.6.39.2/fs/locks.c 2011-05-22 19:36:32.000000000 -0400
48291@@ -2033,16 +2033,16 @@ void locks_remove_flock(struct file *fil
48292 return;
48293
48294 if (filp->f_op && filp->f_op->flock) {
48295- struct file_lock fl = {
48296+ struct file_lock flock = {
48297 .fl_pid = current->tgid,
48298 .fl_file = filp,
48299 .fl_flags = FL_FLOCK,
48300 .fl_type = F_UNLCK,
48301 .fl_end = OFFSET_MAX,
48302 };
48303- filp->f_op->flock(filp, F_SETLKW, &fl);
48304- if (fl.fl_ops && fl.fl_ops->fl_release_private)
48305- fl.fl_ops->fl_release_private(&fl);
48306+ filp->f_op->flock(filp, F_SETLKW, &flock);
48307+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
48308+ flock.fl_ops->fl_release_private(&flock);
48309 }
48310
48311 lock_flocks();
48312diff -urNp linux-2.6.39.2/fs/logfs/super.c linux-2.6.39.2/fs/logfs/super.c
48313--- linux-2.6.39.2/fs/logfs/super.c 2011-05-19 00:06:34.000000000 -0400
48314+++ linux-2.6.39.2/fs/logfs/super.c 2011-05-22 19:36:32.000000000 -0400
48315@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
48316 struct logfs_disk_super _ds1, *ds1 = &_ds1;
48317 int err, valid0, valid1;
48318
48319+ pax_track_stack();
48320+
48321 /* read first superblock */
48322 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
48323 if (err)
48324diff -urNp linux-2.6.39.2/fs/namei.c linux-2.6.39.2/fs/namei.c
48325--- linux-2.6.39.2/fs/namei.c 2011-06-03 00:04:14.000000000 -0400
48326+++ linux-2.6.39.2/fs/namei.c 2011-06-03 00:32:07.000000000 -0400
48327@@ -237,20 +237,30 @@ int generic_permission(struct inode *ino
48328 return ret;
48329
48330 /*
48331- * Read/write DACs are always overridable.
48332- * Executable DACs are overridable if at least one exec bit is set.
48333+ * Searching includes executable on directories, else just read.
48334 */
48335- if (!(mask & MAY_EXEC) || execute_ok(inode))
48336- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48337+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48338+ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
48339+#ifdef CONFIG_GRKERNSEC
48340+ if (flags & IPERM_FLAG_RCU)
48341+ return -ECHILD;
48342+#endif
48343+ if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48344 return 0;
48345+ }
48346
48347 /*
48348- * Searching includes executable on directories, else just read.
48349+ * Read/write DACs are always overridable.
48350+ * Executable DACs are overridable if at least one exec bit is set.
48351 */
48352- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48353- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
48354- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48355+ if (!(mask & MAY_EXEC) || execute_ok(inode)) {
48356+#ifdef CONFIG_GRKERNSEC
48357+ if (flags & IPERM_FLAG_RCU)
48358+ return -ECHILD;
48359+#endif
48360+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48361 return 0;
48362+ }
48363
48364 return -EACCES;
48365 }
48366@@ -626,6 +636,9 @@ static inline int handle_reval_path(stru
48367 struct dentry *dentry = nd->path.dentry;
48368 int status;
48369
48370+ if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
48371+ return -ENOENT;
48372+
48373 if (likely(!(nd->flags & LOOKUP_JUMPED)))
48374 return 0;
48375
48376@@ -671,9 +684,16 @@ static inline int exec_permission(struct
48377 if (ret == -ECHILD)
48378 return ret;
48379
48380- if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
48381- ns_capable(ns, CAP_DAC_READ_SEARCH))
48382+ if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE))
48383 goto ok;
48384+ else {
48385+#ifdef CONFIG_GRKERNSEC
48386+ if (flags & IPERM_FLAG_RCU)
48387+ return -ECHILD;
48388+#endif
48389+ if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE))
48390+ goto ok;
48391+ }
48392
48393 return ret;
48394 ok:
48395@@ -781,11 +801,19 @@ follow_link(struct path *link, struct na
48396 return error;
48397 }
48398
48399+ if (gr_handle_follow_link(dentry->d_parent->d_inode,
48400+ dentry->d_inode, dentry, nd->path.mnt)) {
48401+ error = -EACCES;
48402+ *p = ERR_PTR(error); /* no ->put_link(), please */
48403+ path_put(&nd->path);
48404+ return error;
48405+ }
48406+
48407 nd->last_type = LAST_BIND;
48408 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
48409 error = PTR_ERR(*p);
48410 if (!IS_ERR(*p)) {
48411- char *s = nd_get_link(nd);
48412+ const char *s = nd_get_link(nd);
48413 error = 0;
48414 if (s)
48415 error = __vfs_follow_link(nd, s);
48416@@ -1697,6 +1725,9 @@ static int do_path_lookup(int dfd, const
48417 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
48418
48419 if (likely(!retval)) {
48420+ if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
48421+ return -ENOENT;
48422+
48423 if (unlikely(!audit_dummy_context())) {
48424 if (nd->path.dentry && nd->inode)
48425 audit_inode(name, nd->path.dentry);
48426@@ -2007,6 +2038,30 @@ int vfs_create(struct inode *dir, struct
48427 return error;
48428 }
48429
48430+/*
48431+ * Note that while the flag value (low two bits) for sys_open means:
48432+ * 00 - read-only
48433+ * 01 - write-only
48434+ * 10 - read-write
48435+ * 11 - special
48436+ * it is changed into
48437+ * 00 - no permissions needed
48438+ * 01 - read-permission
48439+ * 10 - write-permission
48440+ * 11 - read-write
48441+ * for the internal routines (ie open_namei()/follow_link() etc)
48442+ * This is more logical, and also allows the 00 "no perm needed"
48443+ * to be used for symlinks (where the permissions are checked
48444+ * later).
48445+ *
48446+*/
48447+static inline int open_to_namei_flags(int flag)
48448+{
48449+ if ((flag+1) & O_ACCMODE)
48450+ flag++;
48451+ return flag;
48452+}
48453+
48454 static int may_open(struct path *path, int acc_mode, int flag)
48455 {
48456 struct dentry *dentry = path->dentry;
48457@@ -2059,7 +2114,27 @@ static int may_open(struct path *path, i
48458 /*
48459 * Ensure there are no outstanding leases on the file.
48460 */
48461- return break_lease(inode, flag);
48462+ error = break_lease(inode, flag);
48463+
48464+ if (error)
48465+ return error;
48466+
48467+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
48468+ error = -EPERM;
48469+ goto exit;
48470+ }
48471+
48472+ if (gr_handle_rawio(inode)) {
48473+ error = -EPERM;
48474+ goto exit;
48475+ }
48476+
48477+ if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) {
48478+ error = -EACCES;
48479+ goto exit;
48480+ }
48481+exit:
48482+ return error;
48483 }
48484
48485 static int handle_truncate(struct file *filp)
48486@@ -2085,30 +2160,6 @@ static int handle_truncate(struct file *
48487 }
48488
48489 /*
48490- * Note that while the flag value (low two bits) for sys_open means:
48491- * 00 - read-only
48492- * 01 - write-only
48493- * 10 - read-write
48494- * 11 - special
48495- * it is changed into
48496- * 00 - no permissions needed
48497- * 01 - read-permission
48498- * 10 - write-permission
48499- * 11 - read-write
48500- * for the internal routines (ie open_namei()/follow_link() etc)
48501- * This is more logical, and also allows the 00 "no perm needed"
48502- * to be used for symlinks (where the permissions are checked
48503- * later).
48504- *
48505-*/
48506-static inline int open_to_namei_flags(int flag)
48507-{
48508- if ((flag+1) & O_ACCMODE)
48509- flag++;
48510- return flag;
48511-}
48512-
48513-/*
48514 * Handle the last step of open()
48515 */
48516 static struct file *do_last(struct nameidata *nd, struct path *path,
48517@@ -2117,6 +2168,7 @@ static struct file *do_last(struct namei
48518 struct dentry *dir = nd->path.dentry;
48519 struct dentry *dentry;
48520 int open_flag = op->open_flag;
48521+ int flag = open_to_namei_flags(open_flag);
48522 int will_truncate = open_flag & O_TRUNC;
48523 int want_write = 0;
48524 int acc_mode = op->acc_mode;
48525@@ -2212,6 +2264,12 @@ static struct file *do_last(struct namei
48526 /* Negative dentry, just create the file */
48527 if (!dentry->d_inode) {
48528 int mode = op->mode;
48529+
48530+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) {
48531+ error = -EACCES;
48532+ goto exit_mutex_unlock;
48533+ }
48534+
48535 if (!IS_POSIXACL(dir->d_inode))
48536 mode &= ~current_umask();
48537 /*
48538@@ -2235,6 +2293,8 @@ static struct file *do_last(struct namei
48539 error = vfs_create(dir->d_inode, dentry, mode, nd);
48540 if (error)
48541 goto exit_mutex_unlock;
48542+ else
48543+ gr_handle_create(path->dentry, path->mnt);
48544 mutex_unlock(&dir->d_inode->i_mutex);
48545 dput(nd->path.dentry);
48546 nd->path.dentry = dentry;
48547@@ -2244,6 +2304,14 @@ static struct file *do_last(struct namei
48548 /*
48549 * It already exists.
48550 */
48551+
48552+ /* only check if O_CREAT is specified, all other checks need to go
48553+ into may_open */
48554+ if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) {
48555+ error = -EACCES;
48556+ goto exit_mutex_unlock;
48557+ }
48558+
48559 mutex_unlock(&dir->d_inode->i_mutex);
48560 audit_inode(pathname, path->dentry);
48561
48562@@ -2530,6 +2598,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48563 error = may_mknod(mode);
48564 if (error)
48565 goto out_dput;
48566+
48567+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
48568+ error = -EPERM;
48569+ goto out_dput;
48570+ }
48571+
48572+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
48573+ error = -EACCES;
48574+ goto out_dput;
48575+ }
48576+
48577 error = mnt_want_write(nd.path.mnt);
48578 if (error)
48579 goto out_dput;
48580@@ -2550,6 +2629,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48581 }
48582 out_drop_write:
48583 mnt_drop_write(nd.path.mnt);
48584+
48585+ if (!error)
48586+ gr_handle_create(dentry, nd.path.mnt);
48587 out_dput:
48588 dput(dentry);
48589 out_unlock:
48590@@ -2602,6 +2684,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48591 if (IS_ERR(dentry))
48592 goto out_unlock;
48593
48594+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
48595+ error = -EACCES;
48596+ goto out_dput;
48597+ }
48598+
48599 if (!IS_POSIXACL(nd.path.dentry->d_inode))
48600 mode &= ~current_umask();
48601 error = mnt_want_write(nd.path.mnt);
48602@@ -2613,6 +2700,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48603 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
48604 out_drop_write:
48605 mnt_drop_write(nd.path.mnt);
48606+
48607+ if (!error)
48608+ gr_handle_create(dentry, nd.path.mnt);
48609+
48610 out_dput:
48611 dput(dentry);
48612 out_unlock:
48613@@ -2692,6 +2783,8 @@ static long do_rmdir(int dfd, const char
48614 char * name;
48615 struct dentry *dentry;
48616 struct nameidata nd;
48617+ ino_t saved_ino = 0;
48618+ dev_t saved_dev = 0;
48619
48620 error = user_path_parent(dfd, pathname, &nd, &name);
48621 if (error)
48622@@ -2716,6 +2809,19 @@ static long do_rmdir(int dfd, const char
48623 error = PTR_ERR(dentry);
48624 if (IS_ERR(dentry))
48625 goto exit2;
48626+
48627+ if (dentry->d_inode != NULL) {
48628+ if (dentry->d_inode->i_nlink <= 1) {
48629+ saved_ino = dentry->d_inode->i_ino;
48630+ saved_dev = gr_get_dev_from_dentry(dentry);
48631+ }
48632+
48633+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
48634+ error = -EACCES;
48635+ goto exit3;
48636+ }
48637+ }
48638+
48639 error = mnt_want_write(nd.path.mnt);
48640 if (error)
48641 goto exit3;
48642@@ -2723,6 +2829,8 @@ static long do_rmdir(int dfd, const char
48643 if (error)
48644 goto exit4;
48645 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
48646+ if (!error && (saved_dev || saved_ino))
48647+ gr_handle_delete(saved_ino, saved_dev);
48648 exit4:
48649 mnt_drop_write(nd.path.mnt);
48650 exit3:
48651@@ -2785,6 +2893,8 @@ static long do_unlinkat(int dfd, const c
48652 struct dentry *dentry;
48653 struct nameidata nd;
48654 struct inode *inode = NULL;
48655+ ino_t saved_ino = 0;
48656+ dev_t saved_dev = 0;
48657
48658 error = user_path_parent(dfd, pathname, &nd, &name);
48659 if (error)
48660@@ -2804,8 +2914,17 @@ static long do_unlinkat(int dfd, const c
48661 if (nd.last.name[nd.last.len])
48662 goto slashes;
48663 inode = dentry->d_inode;
48664- if (inode)
48665+ if (inode) {
48666 ihold(inode);
48667+ if (inode->i_nlink <= 1) {
48668+ saved_ino = inode->i_ino;
48669+ saved_dev = gr_get_dev_from_dentry(dentry);
48670+ }
48671+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
48672+ error = -EACCES;
48673+ goto exit2;
48674+ }
48675+ }
48676 error = mnt_want_write(nd.path.mnt);
48677 if (error)
48678 goto exit2;
48679@@ -2813,6 +2932,8 @@ static long do_unlinkat(int dfd, const c
48680 if (error)
48681 goto exit3;
48682 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
48683+ if (!error && (saved_ino || saved_dev))
48684+ gr_handle_delete(saved_ino, saved_dev);
48685 exit3:
48686 mnt_drop_write(nd.path.mnt);
48687 exit2:
48688@@ -2890,6 +3011,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
48689 if (IS_ERR(dentry))
48690 goto out_unlock;
48691
48692+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
48693+ error = -EACCES;
48694+ goto out_dput;
48695+ }
48696+
48697 error = mnt_want_write(nd.path.mnt);
48698 if (error)
48699 goto out_dput;
48700@@ -2897,6 +3023,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
48701 if (error)
48702 goto out_drop_write;
48703 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
48704+ if (!error)
48705+ gr_handle_create(dentry, nd.path.mnt);
48706 out_drop_write:
48707 mnt_drop_write(nd.path.mnt);
48708 out_dput:
48709@@ -3005,6 +3133,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48710 error = PTR_ERR(new_dentry);
48711 if (IS_ERR(new_dentry))
48712 goto out_unlock;
48713+
48714+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
48715+ old_path.dentry->d_inode,
48716+ old_path.dentry->d_inode->i_mode, to)) {
48717+ error = -EACCES;
48718+ goto out_dput;
48719+ }
48720+
48721+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
48722+ old_path.dentry, old_path.mnt, to)) {
48723+ error = -EACCES;
48724+ goto out_dput;
48725+ }
48726+
48727 error = mnt_want_write(nd.path.mnt);
48728 if (error)
48729 goto out_dput;
48730@@ -3012,6 +3154,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48731 if (error)
48732 goto out_drop_write;
48733 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
48734+ if (!error)
48735+ gr_handle_create(new_dentry, nd.path.mnt);
48736 out_drop_write:
48737 mnt_drop_write(nd.path.mnt);
48738 out_dput:
48739@@ -3189,6 +3333,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48740 char *to;
48741 int error;
48742
48743+ pax_track_stack();
48744+
48745 error = user_path_parent(olddfd, oldname, &oldnd, &from);
48746 if (error)
48747 goto exit;
48748@@ -3245,6 +3391,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48749 if (new_dentry == trap)
48750 goto exit5;
48751
48752+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
48753+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
48754+ to);
48755+ if (error)
48756+ goto exit5;
48757+
48758 error = mnt_want_write(oldnd.path.mnt);
48759 if (error)
48760 goto exit5;
48761@@ -3254,6 +3406,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48762 goto exit6;
48763 error = vfs_rename(old_dir->d_inode, old_dentry,
48764 new_dir->d_inode, new_dentry);
48765+ if (!error)
48766+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
48767+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
48768 exit6:
48769 mnt_drop_write(oldnd.path.mnt);
48770 exit5:
48771@@ -3279,6 +3434,8 @@ SYSCALL_DEFINE2(rename, const char __use
48772
48773 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
48774 {
48775+ char tmpbuf[64];
48776+ const char *newlink;
48777 int len;
48778
48779 len = PTR_ERR(link);
48780@@ -3288,7 +3445,14 @@ int vfs_readlink(struct dentry *dentry,
48781 len = strlen(link);
48782 if (len > (unsigned) buflen)
48783 len = buflen;
48784- if (copy_to_user(buffer, link, len))
48785+
48786+ if (len < sizeof(tmpbuf)) {
48787+ memcpy(tmpbuf, link, len);
48788+ newlink = tmpbuf;
48789+ } else
48790+ newlink = link;
48791+
48792+ if (copy_to_user(buffer, newlink, len))
48793 len = -EFAULT;
48794 out:
48795 return len;
48796diff -urNp linux-2.6.39.2/fs/namespace.c linux-2.6.39.2/fs/namespace.c
48797--- linux-2.6.39.2/fs/namespace.c 2011-05-19 00:06:34.000000000 -0400
48798+++ linux-2.6.39.2/fs/namespace.c 2011-05-22 20:43:58.000000000 -0400
48799@@ -1328,6 +1328,9 @@ static int do_umount(struct vfsmount *mn
48800 if (!(sb->s_flags & MS_RDONLY))
48801 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
48802 up_write(&sb->s_umount);
48803+
48804+ gr_log_remount(mnt->mnt_devname, retval);
48805+
48806 return retval;
48807 }
48808
48809@@ -1347,6 +1350,9 @@ static int do_umount(struct vfsmount *mn
48810 br_write_unlock(vfsmount_lock);
48811 up_write(&namespace_sem);
48812 release_mounts(&umount_list);
48813+
48814+ gr_log_unmount(mnt->mnt_devname, retval);
48815+
48816 return retval;
48817 }
48818
48819@@ -2338,6 +2344,16 @@ long do_mount(char *dev_name, char *dir_
48820 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
48821 MS_STRICTATIME);
48822
48823+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
48824+ retval = -EPERM;
48825+ goto dput_out;
48826+ }
48827+
48828+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
48829+ retval = -EPERM;
48830+ goto dput_out;
48831+ }
48832+
48833 if (flags & MS_REMOUNT)
48834 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
48835 data_page);
48836@@ -2352,6 +2368,9 @@ long do_mount(char *dev_name, char *dir_
48837 dev_name, data_page);
48838 dput_out:
48839 path_put(&path);
48840+
48841+ gr_log_mount(dev_name, dir_name, retval);
48842+
48843 return retval;
48844 }
48845
48846@@ -2575,6 +2594,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
48847 if (error)
48848 goto out2;
48849
48850+ if (gr_handle_chroot_pivot()) {
48851+ error = -EPERM;
48852+ goto out2;
48853+ }
48854+
48855 get_fs_root(current->fs, &root);
48856 error = lock_mount(&old);
48857 if (error)
48858diff -urNp linux-2.6.39.2/fs/ncpfs/dir.c linux-2.6.39.2/fs/ncpfs/dir.c
48859--- linux-2.6.39.2/fs/ncpfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48860+++ linux-2.6.39.2/fs/ncpfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48861@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
48862 int res, val = 0, len;
48863 __u8 __name[NCP_MAXPATHLEN + 1];
48864
48865+ pax_track_stack();
48866+
48867 if (dentry == dentry->d_sb->s_root)
48868 return 1;
48869
48870@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct
48871 int error, res, len;
48872 __u8 __name[NCP_MAXPATHLEN + 1];
48873
48874+ pax_track_stack();
48875+
48876 error = -EIO;
48877 if (!ncp_conn_valid(server))
48878 goto finished;
48879@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
48880 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
48881 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
48882
48883+ pax_track_stack();
48884+
48885 ncp_age_dentry(server, dentry);
48886 len = sizeof(__name);
48887 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
48888@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir,
48889 int error, len;
48890 __u8 __name[NCP_MAXPATHLEN + 1];
48891
48892+ pax_track_stack();
48893+
48894 DPRINTK("ncp_mkdir: making %s/%s\n",
48895 dentry->d_parent->d_name.name, dentry->d_name.name);
48896
48897@@ -1135,6 +1143,8 @@ static int ncp_rename(struct inode *old_
48898 int old_len, new_len;
48899 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
48900
48901+ pax_track_stack();
48902+
48903 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
48904 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
48905 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
48906diff -urNp linux-2.6.39.2/fs/ncpfs/inode.c linux-2.6.39.2/fs/ncpfs/inode.c
48907--- linux-2.6.39.2/fs/ncpfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48908+++ linux-2.6.39.2/fs/ncpfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48909@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
48910 #endif
48911 struct ncp_entry_info finfo;
48912
48913+ pax_track_stack();
48914+
48915 data.wdog_pid = NULL;
48916 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
48917 if (!server)
48918diff -urNp linux-2.6.39.2/fs/nfs/inode.c linux-2.6.39.2/fs/nfs/inode.c
48919--- linux-2.6.39.2/fs/nfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48920+++ linux-2.6.39.2/fs/nfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48921@@ -999,16 +999,16 @@ static int nfs_size_need_update(const st
48922 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
48923 }
48924
48925-static atomic_long_t nfs_attr_generation_counter;
48926+static atomic_long_unchecked_t nfs_attr_generation_counter;
48927
48928 static unsigned long nfs_read_attr_generation_counter(void)
48929 {
48930- return atomic_long_read(&nfs_attr_generation_counter);
48931+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
48932 }
48933
48934 unsigned long nfs_inc_attr_generation_counter(void)
48935 {
48936- return atomic_long_inc_return(&nfs_attr_generation_counter);
48937+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
48938 }
48939
48940 void nfs_fattr_init(struct nfs_fattr *fattr)
48941diff -urNp linux-2.6.39.2/fs/nfs/nfs4proc.c linux-2.6.39.2/fs/nfs/nfs4proc.c
48942--- linux-2.6.39.2/fs/nfs/nfs4proc.c 2011-06-03 00:04:14.000000000 -0400
48943+++ linux-2.6.39.2/fs/nfs/nfs4proc.c 2011-06-03 00:32:07.000000000 -0400
48944@@ -5845,14 +5845,14 @@ struct nfs4_state_recovery_ops nfs41_nog
48945 };
48946 #endif /* CONFIG_NFS_V4_1 */
48947
48948-struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48949+const struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48950 .sched_state_renewal = nfs4_proc_async_renew,
48951 .get_state_renewal_cred_locked = nfs4_get_renew_cred_locked,
48952 .renew_lease = nfs4_proc_renew,
48953 };
48954
48955 #if defined(CONFIG_NFS_V4_1)
48956-struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48957+const struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48958 .sched_state_renewal = nfs41_proc_async_sequence,
48959 .get_state_renewal_cred_locked = nfs4_get_machine_cred_locked,
48960 .renew_lease = nfs4_proc_sequence,
48961diff -urNp linux-2.6.39.2/fs/nfsd/lockd.c linux-2.6.39.2/fs/nfsd/lockd.c
48962--- linux-2.6.39.2/fs/nfsd/lockd.c 2011-05-19 00:06:34.000000000 -0400
48963+++ linux-2.6.39.2/fs/nfsd/lockd.c 2011-05-22 19:36:32.000000000 -0400
48964@@ -60,7 +60,7 @@ nlm_fclose(struct file *filp)
48965 fput(filp);
48966 }
48967
48968-static struct nlmsvc_binding nfsd_nlm_ops = {
48969+static const struct nlmsvc_binding nfsd_nlm_ops = {
48970 .fopen = nlm_fopen, /* open file for locking */
48971 .fclose = nlm_fclose, /* close file */
48972 };
48973diff -urNp linux-2.6.39.2/fs/nfsd/nfs4state.c linux-2.6.39.2/fs/nfsd/nfs4state.c
48974--- linux-2.6.39.2/fs/nfsd/nfs4state.c 2011-05-19 00:06:34.000000000 -0400
48975+++ linux-2.6.39.2/fs/nfsd/nfs4state.c 2011-05-22 19:36:32.000000000 -0400
48976@@ -3784,6 +3784,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
48977 unsigned int strhashval;
48978 int err;
48979
48980+ pax_track_stack();
48981+
48982 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
48983 (long long) lock->lk_offset,
48984 (long long) lock->lk_length);
48985diff -urNp linux-2.6.39.2/fs/nfsd/nfs4xdr.c linux-2.6.39.2/fs/nfsd/nfs4xdr.c
48986--- linux-2.6.39.2/fs/nfsd/nfs4xdr.c 2011-05-19 00:06:34.000000000 -0400
48987+++ linux-2.6.39.2/fs/nfsd/nfs4xdr.c 2011-05-22 19:36:32.000000000 -0400
48988@@ -1793,6 +1793,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
48989 .dentry = dentry,
48990 };
48991
48992+ pax_track_stack();
48993+
48994 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
48995 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
48996 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
48997diff -urNp linux-2.6.39.2/fs/nfsd/nfsctl.c linux-2.6.39.2/fs/nfsd/nfsctl.c
48998--- linux-2.6.39.2/fs/nfsd/nfsctl.c 2011-05-19 00:06:34.000000000 -0400
48999+++ linux-2.6.39.2/fs/nfsd/nfsctl.c 2011-05-22 19:36:32.000000000 -0400
49000@@ -182,7 +182,7 @@ static int export_features_open(struct i
49001 return single_open(file, export_features_show, NULL);
49002 }
49003
49004-static struct file_operations export_features_operations = {
49005+static const struct file_operations export_features_operations = {
49006 .open = export_features_open,
49007 .read = seq_read,
49008 .llseek = seq_lseek,
49009diff -urNp linux-2.6.39.2/fs/nfsd/vfs.c linux-2.6.39.2/fs/nfsd/vfs.c
49010--- linux-2.6.39.2/fs/nfsd/vfs.c 2011-05-19 00:06:34.000000000 -0400
49011+++ linux-2.6.39.2/fs/nfsd/vfs.c 2011-05-22 19:36:32.000000000 -0400
49012@@ -898,7 +898,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
49013 } else {
49014 oldfs = get_fs();
49015 set_fs(KERNEL_DS);
49016- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
49017+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
49018 set_fs(oldfs);
49019 }
49020
49021@@ -1002,7 +1002,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
49022
49023 /* Write the data. */
49024 oldfs = get_fs(); set_fs(KERNEL_DS);
49025- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
49026+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
49027 set_fs(oldfs);
49028 if (host_err < 0)
49029 goto out_nfserr;
49030@@ -1525,7 +1525,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
49031 */
49032
49033 oldfs = get_fs(); set_fs(KERNEL_DS);
49034- host_err = inode->i_op->readlink(dentry, buf, *lenp);
49035+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
49036 set_fs(oldfs);
49037
49038 if (host_err < 0)
49039diff -urNp linux-2.6.39.2/fs/nilfs2/segment.c linux-2.6.39.2/fs/nilfs2/segment.c
49040--- linux-2.6.39.2/fs/nilfs2/segment.c 2011-05-19 00:06:34.000000000 -0400
49041+++ linux-2.6.39.2/fs/nilfs2/segment.c 2011-05-22 19:36:32.000000000 -0400
49042@@ -555,7 +555,7 @@ static void nilfs_write_file_node_binfo(
49043 *vblocknr = binfo->bi_v.bi_vblocknr;
49044 }
49045
49046-static struct nilfs_sc_operations nilfs_sc_file_ops = {
49047+static const struct nilfs_sc_operations nilfs_sc_file_ops = {
49048 .collect_data = nilfs_collect_file_data,
49049 .collect_node = nilfs_collect_file_node,
49050 .collect_bmap = nilfs_collect_file_bmap,
49051@@ -604,7 +604,7 @@ static void nilfs_write_dat_node_binfo(s
49052 *binfo_dat = binfo->bi_dat;
49053 }
49054
49055-static struct nilfs_sc_operations nilfs_sc_dat_ops = {
49056+static const struct nilfs_sc_operations nilfs_sc_dat_ops = {
49057 .collect_data = nilfs_collect_dat_data,
49058 .collect_node = nilfs_collect_file_node,
49059 .collect_bmap = nilfs_collect_dat_bmap,
49060@@ -612,7 +612,7 @@ static struct nilfs_sc_operations nilfs_
49061 .write_node_binfo = nilfs_write_dat_node_binfo,
49062 };
49063
49064-static struct nilfs_sc_operations nilfs_sc_dsync_ops = {
49065+static const struct nilfs_sc_operations nilfs_sc_dsync_ops = {
49066 .collect_data = nilfs_collect_file_data,
49067 .collect_node = NULL,
49068 .collect_bmap = NULL,
49069@@ -971,7 +971,7 @@ static size_t nilfs_segctor_buffer_rest(
49070
49071 static int nilfs_segctor_scan_file(struct nilfs_sc_info *sci,
49072 struct inode *inode,
49073- struct nilfs_sc_operations *sc_ops)
49074+ const struct nilfs_sc_operations *sc_ops)
49075 {
49076 LIST_HEAD(data_buffers);
49077 LIST_HEAD(node_buffers);
49078@@ -1475,7 +1475,7 @@ nilfs_segctor_update_payload_blocknr(str
49079 sector_t blocknr;
49080 unsigned long nfinfo = segbuf->sb_sum.nfinfo;
49081 unsigned long nblocks = 0, ndatablk = 0;
49082- struct nilfs_sc_operations *sc_op = NULL;
49083+ const struct nilfs_sc_operations *sc_op = NULL;
49084 struct nilfs_segsum_pointer ssp;
49085 struct nilfs_finfo *finfo = NULL;
49086 union nilfs_binfo binfo;
49087diff -urNp linux-2.6.39.2/fs/notify/dnotify/dnotify.c linux-2.6.39.2/fs/notify/dnotify/dnotify.c
49088--- linux-2.6.39.2/fs/notify/dnotify/dnotify.c 2011-05-19 00:06:34.000000000 -0400
49089+++ linux-2.6.39.2/fs/notify/dnotify/dnotify.c 2011-05-22 19:36:32.000000000 -0400
49090@@ -151,7 +151,7 @@ static void dnotify_free_mark(struct fsn
49091 kmem_cache_free(dnotify_mark_cache, dn_mark);
49092 }
49093
49094-static struct fsnotify_ops dnotify_fsnotify_ops = {
49095+static const struct fsnotify_ops dnotify_fsnotify_ops = {
49096 .handle_event = dnotify_handle_event,
49097 .should_send_event = dnotify_should_send_event,
49098 .free_group_priv = NULL,
49099diff -urNp linux-2.6.39.2/fs/notify/notification.c linux-2.6.39.2/fs/notify/notification.c
49100--- linux-2.6.39.2/fs/notify/notification.c 2011-05-19 00:06:34.000000000 -0400
49101+++ linux-2.6.39.2/fs/notify/notification.c 2011-05-22 19:36:32.000000000 -0400
49102@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
49103 * get set to 0 so it will never get 'freed'
49104 */
49105 static struct fsnotify_event *q_overflow_event;
49106-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
49107+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
49108
49109 /**
49110 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
49111@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
49112 */
49113 u32 fsnotify_get_cookie(void)
49114 {
49115- return atomic_inc_return(&fsnotify_sync_cookie);
49116+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
49117 }
49118 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
49119
49120diff -urNp linux-2.6.39.2/fs/ntfs/dir.c linux-2.6.39.2/fs/ntfs/dir.c
49121--- linux-2.6.39.2/fs/ntfs/dir.c 2011-05-19 00:06:34.000000000 -0400
49122+++ linux-2.6.39.2/fs/ntfs/dir.c 2011-05-22 19:36:32.000000000 -0400
49123@@ -1329,7 +1329,7 @@ find_next_index_buffer:
49124 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
49125 ~(s64)(ndir->itype.index.block_size - 1)));
49126 /* Bounds checks. */
49127- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
49128+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
49129 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
49130 "inode 0x%lx or driver bug.", vdir->i_ino);
49131 goto err_out;
49132diff -urNp linux-2.6.39.2/fs/ntfs/file.c linux-2.6.39.2/fs/ntfs/file.c
49133--- linux-2.6.39.2/fs/ntfs/file.c 2011-05-19 00:06:34.000000000 -0400
49134+++ linux-2.6.39.2/fs/ntfs/file.c 2011-05-22 19:36:32.000000000 -0400
49135@@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
49136 #endif /* NTFS_RW */
49137 };
49138
49139-const struct file_operations ntfs_empty_file_ops = {};
49140+const struct file_operations ntfs_empty_file_ops __read_only;
49141
49142-const struct inode_operations ntfs_empty_inode_ops = {};
49143+const struct inode_operations ntfs_empty_inode_ops __read_only;
49144diff -urNp linux-2.6.39.2/fs/ocfs2/cluster/heartbeat.c linux-2.6.39.2/fs/ocfs2/cluster/heartbeat.c
49145--- linux-2.6.39.2/fs/ocfs2/cluster/heartbeat.c 2011-05-19 00:06:34.000000000 -0400
49146+++ linux-2.6.39.2/fs/ocfs2/cluster/heartbeat.c 2011-05-22 19:36:32.000000000 -0400
49147@@ -2261,7 +2261,7 @@ static struct configfs_item_operations o
49148 .store_attribute = o2hb_heartbeat_group_store,
49149 };
49150
49151-static struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
49152+static const struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
49153 .make_item = o2hb_heartbeat_group_make_item,
49154 .drop_item = o2hb_heartbeat_group_drop_item,
49155 };
49156diff -urNp linux-2.6.39.2/fs/ocfs2/cluster/nodemanager.c linux-2.6.39.2/fs/ocfs2/cluster/nodemanager.c
49157--- linux-2.6.39.2/fs/ocfs2/cluster/nodemanager.c 2011-05-19 00:06:34.000000000 -0400
49158+++ linux-2.6.39.2/fs/ocfs2/cluster/nodemanager.c 2011-05-22 19:36:32.000000000 -0400
49159@@ -752,7 +752,7 @@ static void o2nm_node_group_drop_item(st
49160 config_item_put(item);
49161 }
49162
49163-static struct configfs_group_operations o2nm_node_group_group_ops = {
49164+static const struct configfs_group_operations o2nm_node_group_group_ops = {
49165 .make_item = o2nm_node_group_make_item,
49166 .drop_item = o2nm_node_group_drop_item,
49167 };
49168@@ -869,7 +869,7 @@ static void o2nm_cluster_group_drop_item
49169 config_item_put(item);
49170 }
49171
49172-static struct configfs_group_operations o2nm_cluster_group_group_ops = {
49173+static const struct configfs_group_operations o2nm_cluster_group_group_ops = {
49174 .make_group = o2nm_cluster_group_make_group,
49175 .drop_item = o2nm_cluster_group_drop_item,
49176 };
49177diff -urNp linux-2.6.39.2/fs/ocfs2/localalloc.c linux-2.6.39.2/fs/ocfs2/localalloc.c
49178--- linux-2.6.39.2/fs/ocfs2/localalloc.c 2011-05-19 00:06:34.000000000 -0400
49179+++ linux-2.6.39.2/fs/ocfs2/localalloc.c 2011-05-22 19:36:32.000000000 -0400
49180@@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo
49181 goto bail;
49182 }
49183
49184- atomic_inc(&osb->alloc_stats.moves);
49185+ atomic_inc_unchecked(&osb->alloc_stats.moves);
49186
49187 bail:
49188 if (handle)
49189diff -urNp linux-2.6.39.2/fs/ocfs2/namei.c linux-2.6.39.2/fs/ocfs2/namei.c
49190--- linux-2.6.39.2/fs/ocfs2/namei.c 2011-05-19 00:06:34.000000000 -0400
49191+++ linux-2.6.39.2/fs/ocfs2/namei.c 2011-05-22 19:36:32.000000000 -0400
49192@@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol
49193 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
49194 struct ocfs2_dir_lookup_result target_insert = { NULL, };
49195
49196+ pax_track_stack();
49197+
49198 /* At some point it might be nice to break this function up a
49199 * bit. */
49200
49201diff -urNp linux-2.6.39.2/fs/ocfs2/ocfs2.h linux-2.6.39.2/fs/ocfs2/ocfs2.h
49202--- linux-2.6.39.2/fs/ocfs2/ocfs2.h 2011-05-19 00:06:34.000000000 -0400
49203+++ linux-2.6.39.2/fs/ocfs2/ocfs2.h 2011-05-22 19:36:32.000000000 -0400
49204@@ -235,11 +235,11 @@ enum ocfs2_vol_state
49205
49206 struct ocfs2_alloc_stats
49207 {
49208- atomic_t moves;
49209- atomic_t local_data;
49210- atomic_t bitmap_data;
49211- atomic_t bg_allocs;
49212- atomic_t bg_extends;
49213+ atomic_unchecked_t moves;
49214+ atomic_unchecked_t local_data;
49215+ atomic_unchecked_t bitmap_data;
49216+ atomic_unchecked_t bg_allocs;
49217+ atomic_unchecked_t bg_extends;
49218 };
49219
49220 enum ocfs2_local_alloc_state
49221diff -urNp linux-2.6.39.2/fs/ocfs2/stackglue.h linux-2.6.39.2/fs/ocfs2/stackglue.h
49222--- linux-2.6.39.2/fs/ocfs2/stackglue.h 2011-05-19 00:06:34.000000000 -0400
49223+++ linux-2.6.39.2/fs/ocfs2/stackglue.h 2011-05-22 19:36:32.000000000 -0400
49224@@ -221,13 +221,13 @@ struct ocfs2_stack_operations {
49225 };
49226
49227 /*
49228- * Each stack plugin must describe itself by registering a
49229+ * Each stack plugin must describe itself by registerin const g a
49230 * ocfs2_stack_plugin structure. This is only seen by stackglue and the
49231 * stack driver.
49232 */
49233 struct ocfs2_stack_plugin {
49234 char *sp_name;
49235- struct ocfs2_stack_operations *sp_ops;
49236+ const struct ocfs2_stack_operations *sp_ops;
49237 struct module *sp_owner;
49238
49239 /* These are managed by the stackglue code. */
49240diff -urNp linux-2.6.39.2/fs/ocfs2/stack_o2cb.c linux-2.6.39.2/fs/ocfs2/stack_o2cb.c
49241--- linux-2.6.39.2/fs/ocfs2/stack_o2cb.c 2011-05-19 00:06:34.000000000 -0400
49242+++ linux-2.6.39.2/fs/ocfs2/stack_o2cb.c 2011-06-07 18:07:24.000000000 -0400
49243@@ -358,7 +358,7 @@ static int o2cb_cluster_this_node(unsign
49244 return 0;
49245 }
49246
49247-static struct ocfs2_stack_operations o2cb_stack_ops = {
49248+static const struct ocfs2_stack_operations o2cb_stack_ops = {
49249 .connect = o2cb_cluster_connect,
49250 .disconnect = o2cb_cluster_disconnect,
49251 .this_node = o2cb_cluster_this_node,
49252diff -urNp linux-2.6.39.2/fs/ocfs2/stack_user.c linux-2.6.39.2/fs/ocfs2/stack_user.c
49253--- linux-2.6.39.2/fs/ocfs2/stack_user.c 2011-05-19 00:06:34.000000000 -0400
49254+++ linux-2.6.39.2/fs/ocfs2/stack_user.c 2011-05-22 19:36:32.000000000 -0400
49255@@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_m
49256 long major, minor;
49257 char *ptr = NULL;
49258 struct ocfs2_control_private *p = file->private_data;
49259- struct ocfs2_protocol_version *max =
49260+ const struct ocfs2_protocol_version *max =
49261 &ocfs2_user_plugin.sp_max_proto;
49262
49263 if (ocfs2_control_get_handshake_state(file) !=
49264@@ -861,7 +861,7 @@ static int user_cluster_this_node(unsign
49265 return 0;
49266 }
49267
49268-static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
49269+static const struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
49270 .connect = user_cluster_connect,
49271 .disconnect = user_cluster_disconnect,
49272 .this_node = user_cluster_this_node,
49273diff -urNp linux-2.6.39.2/fs/ocfs2/suballoc.c linux-2.6.39.2/fs/ocfs2/suballoc.c
49274--- linux-2.6.39.2/fs/ocfs2/suballoc.c 2011-05-19 00:06:34.000000000 -0400
49275+++ linux-2.6.39.2/fs/ocfs2/suballoc.c 2011-05-22 19:36:32.000000000 -0400
49276@@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s
49277 mlog_errno(status);
49278 goto bail;
49279 }
49280- atomic_inc(&osb->alloc_stats.bg_extends);
49281+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
49282
49283 /* You should never ask for this much metadata */
49284 BUG_ON(bits_wanted >
49285@@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl
49286 mlog_errno(status);
49287 goto bail;
49288 }
49289- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49290+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49291
49292 *suballoc_loc = res.sr_bg_blkno;
49293 *suballoc_bit_start = res.sr_bit_offset;
49294@@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
49295 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
49296 res->sr_bits);
49297
49298- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49299+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49300
49301 BUG_ON(res->sr_bits != 1);
49302
49303@@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand
49304 mlog_errno(status);
49305 goto bail;
49306 }
49307- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49308+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49309
49310 BUG_ON(res.sr_bits != 1);
49311
49312@@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han
49313 cluster_start,
49314 num_clusters);
49315 if (!status)
49316- atomic_inc(&osb->alloc_stats.local_data);
49317+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
49318 } else {
49319 if (min_clusters > (osb->bitmap_cpg - 1)) {
49320 /* The only paths asking for contiguousness
49321@@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han
49322 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
49323 res.sr_bg_blkno,
49324 res.sr_bit_offset);
49325- atomic_inc(&osb->alloc_stats.bitmap_data);
49326+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
49327 *num_clusters = res.sr_bits;
49328 }
49329 }
49330diff -urNp linux-2.6.39.2/fs/ocfs2/super.c linux-2.6.39.2/fs/ocfs2/super.c
49331--- linux-2.6.39.2/fs/ocfs2/super.c 2011-05-19 00:06:34.000000000 -0400
49332+++ linux-2.6.39.2/fs/ocfs2/super.c 2011-05-22 19:36:32.000000000 -0400
49333@@ -299,11 +299,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
49334 "%10s => GlobalAllocs: %d LocalAllocs: %d "
49335 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
49336 "Stats",
49337- atomic_read(&osb->alloc_stats.bitmap_data),
49338- atomic_read(&osb->alloc_stats.local_data),
49339- atomic_read(&osb->alloc_stats.bg_allocs),
49340- atomic_read(&osb->alloc_stats.moves),
49341- atomic_read(&osb->alloc_stats.bg_extends));
49342+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
49343+ atomic_read_unchecked(&osb->alloc_stats.local_data),
49344+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
49345+ atomic_read_unchecked(&osb->alloc_stats.moves),
49346+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
49347
49348 out += snprintf(buf + out, len - out,
49349 "%10s => State: %u Descriptor: %llu Size: %u bits "
49350@@ -2111,11 +2111,11 @@ static int ocfs2_initialize_super(struct
49351 spin_lock_init(&osb->osb_xattr_lock);
49352 ocfs2_init_steal_slots(osb);
49353
49354- atomic_set(&osb->alloc_stats.moves, 0);
49355- atomic_set(&osb->alloc_stats.local_data, 0);
49356- atomic_set(&osb->alloc_stats.bitmap_data, 0);
49357- atomic_set(&osb->alloc_stats.bg_allocs, 0);
49358- atomic_set(&osb->alloc_stats.bg_extends, 0);
49359+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
49360+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
49361+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
49362+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
49363+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
49364
49365 /* Copy the blockcheck stats from the superblock probe */
49366 osb->osb_ecc_stats = *stats;
49367diff -urNp linux-2.6.39.2/fs/ocfs2/symlink.c linux-2.6.39.2/fs/ocfs2/symlink.c
49368--- linux-2.6.39.2/fs/ocfs2/symlink.c 2011-05-19 00:06:34.000000000 -0400
49369+++ linux-2.6.39.2/fs/ocfs2/symlink.c 2011-05-22 19:36:32.000000000 -0400
49370@@ -142,7 +142,7 @@ bail:
49371
49372 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49373 {
49374- char *link = nd_get_link(nd);
49375+ const char *link = nd_get_link(nd);
49376 if (!IS_ERR(link))
49377 kfree(link);
49378 }
49379diff -urNp linux-2.6.39.2/fs/open.c linux-2.6.39.2/fs/open.c
49380--- linux-2.6.39.2/fs/open.c 2011-05-19 00:06:34.000000000 -0400
49381+++ linux-2.6.39.2/fs/open.c 2011-05-22 20:46:51.000000000 -0400
49382@@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
49383 error = locks_verify_truncate(inode, NULL, length);
49384 if (!error)
49385 error = security_path_truncate(&path);
49386+
49387+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
49388+ error = -EACCES;
49389+
49390 if (!error)
49391 error = do_truncate(path.dentry, length, 0, NULL);
49392
49393@@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
49394 if (__mnt_is_readonly(path.mnt))
49395 res = -EROFS;
49396
49397+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
49398+ res = -EACCES;
49399+
49400 out_path_release:
49401 path_put(&path);
49402 out:
49403@@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user
49404 if (error)
49405 goto dput_and_out;
49406
49407+ gr_log_chdir(path.dentry, path.mnt);
49408+
49409 set_fs_pwd(current->fs, &path);
49410
49411 dput_and_out:
49412@@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
49413 goto out_putf;
49414
49415 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
49416+
49417+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
49418+ error = -EPERM;
49419+
49420+ if (!error)
49421+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
49422+
49423 if (!error)
49424 set_fs_pwd(current->fs, &file->f_path);
49425 out_putf:
49426@@ -438,7 +454,18 @@ SYSCALL_DEFINE1(chroot, const char __use
49427 if (error)
49428 goto dput_and_out;
49429
49430+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
49431+ goto dput_and_out;
49432+
49433+ if (gr_handle_chroot_caps(&path)) {
49434+ error = -ENOMEM;
49435+ goto dput_and_out;
49436+ }
49437+
49438 set_fs_root(current->fs, &path);
49439+
49440+ gr_handle_chroot_chdir(&path);
49441+
49442 error = 0;
49443 dput_and_out:
49444 path_put(&path);
49445@@ -466,12 +493,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
49446 err = mnt_want_write_file(file);
49447 if (err)
49448 goto out_putf;
49449+
49450 mutex_lock(&inode->i_mutex);
49451+
49452+ if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
49453+ err = -EACCES;
49454+ goto out_unlock;
49455+ }
49456+
49457 err = security_path_chmod(dentry, file->f_vfsmnt, mode);
49458 if (err)
49459 goto out_unlock;
49460 if (mode == (mode_t) -1)
49461 mode = inode->i_mode;
49462+
49463+ if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
49464+ err = -EACCES;
49465+ goto out_unlock;
49466+ }
49467+
49468 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49469 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49470 err = notify_change(dentry, &newattrs);
49471@@ -499,12 +539,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
49472 error = mnt_want_write(path.mnt);
49473 if (error)
49474 goto dput_and_out;
49475+
49476 mutex_lock(&inode->i_mutex);
49477+
49478+ if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
49479+ error = -EACCES;
49480+ goto out_unlock;
49481+ }
49482+
49483 error = security_path_chmod(path.dentry, path.mnt, mode);
49484 if (error)
49485 goto out_unlock;
49486 if (mode == (mode_t) -1)
49487 mode = inode->i_mode;
49488+
49489+ if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
49490+ error = -EACCES;
49491+ goto out_unlock;
49492+ }
49493+
49494 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49495 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49496 error = notify_change(path.dentry, &newattrs);
49497@@ -528,6 +581,9 @@ static int chown_common(struct path *pat
49498 int error;
49499 struct iattr newattrs;
49500
49501+ if (!gr_acl_handle_chown(path->dentry, path->mnt))
49502+ return -EACCES;
49503+
49504 newattrs.ia_valid = ATTR_CTIME;
49505 if (user != (uid_t) -1) {
49506 newattrs.ia_valid |= ATTR_UID;
49507@@ -998,7 +1054,10 @@ long do_sys_open(int dfd, const char __u
49508 if (!IS_ERR(tmp)) {
49509 fd = get_unused_fd_flags(flags);
49510 if (fd >= 0) {
49511- struct file *f = do_filp_open(dfd, tmp, &op, lookup);
49512+ struct file *f;
49513+ /* don't allow to be set by userland */
49514+ flags &= ~FMODE_GREXEC;
49515+ f = do_filp_open(dfd, tmp, &op, lookup);
49516 if (IS_ERR(f)) {
49517 put_unused_fd(fd);
49518 fd = PTR_ERR(f);
49519diff -urNp linux-2.6.39.2/fs/partitions/ldm.c linux-2.6.39.2/fs/partitions/ldm.c
49520--- linux-2.6.39.2/fs/partitions/ldm.c 2011-06-03 00:04:14.000000000 -0400
49521+++ linux-2.6.39.2/fs/partitions/ldm.c 2011-06-03 00:32:07.000000000 -0400
49522@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
49523 ldm_error ("A VBLK claims to have %d parts.", num);
49524 return false;
49525 }
49526+
49527 if (rec >= num) {
49528 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
49529 return false;
49530@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
49531 goto found;
49532 }
49533
49534- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
49535+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
49536 if (!f) {
49537 ldm_crit ("Out of memory.");
49538 return false;
49539diff -urNp linux-2.6.39.2/fs/pipe.c linux-2.6.39.2/fs/pipe.c
49540--- linux-2.6.39.2/fs/pipe.c 2011-05-19 00:06:34.000000000 -0400
49541+++ linux-2.6.39.2/fs/pipe.c 2011-05-22 19:41:37.000000000 -0400
49542@@ -420,9 +420,9 @@ redo:
49543 }
49544 if (bufs) /* More to do? */
49545 continue;
49546- if (!pipe->writers)
49547+ if (!atomic_read(&pipe->writers))
49548 break;
49549- if (!pipe->waiting_writers) {
49550+ if (!atomic_read(&pipe->waiting_writers)) {
49551 /* syscall merging: Usually we must not sleep
49552 * if O_NONBLOCK is set, or if we got some data.
49553 * But if a writer sleeps in kernel space, then
49554@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str
49555 mutex_lock(&inode->i_mutex);
49556 pipe = inode->i_pipe;
49557
49558- if (!pipe->readers) {
49559+ if (!atomic_read(&pipe->readers)) {
49560 send_sig(SIGPIPE, current, 0);
49561 ret = -EPIPE;
49562 goto out;
49563@@ -530,7 +530,7 @@ redo1:
49564 for (;;) {
49565 int bufs;
49566
49567- if (!pipe->readers) {
49568+ if (!atomic_read(&pipe->readers)) {
49569 send_sig(SIGPIPE, current, 0);
49570 if (!ret)
49571 ret = -EPIPE;
49572@@ -616,9 +616,9 @@ redo2:
49573 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
49574 do_wakeup = 0;
49575 }
49576- pipe->waiting_writers++;
49577+ atomic_inc(&pipe->waiting_writers);
49578 pipe_wait(pipe);
49579- pipe->waiting_writers--;
49580+ atomic_dec(&pipe->waiting_writers);
49581 }
49582 out:
49583 mutex_unlock(&inode->i_mutex);
49584@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table
49585 mask = 0;
49586 if (filp->f_mode & FMODE_READ) {
49587 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
49588- if (!pipe->writers && filp->f_version != pipe->w_counter)
49589+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
49590 mask |= POLLHUP;
49591 }
49592
49593@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table
49594 * Most Unices do not set POLLERR for FIFOs but on Linux they
49595 * behave exactly like pipes for poll().
49596 */
49597- if (!pipe->readers)
49598+ if (!atomic_read(&pipe->readers))
49599 mask |= POLLERR;
49600 }
49601
49602@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de
49603
49604 mutex_lock(&inode->i_mutex);
49605 pipe = inode->i_pipe;
49606- pipe->readers -= decr;
49607- pipe->writers -= decw;
49608+ atomic_sub(decr, &pipe->readers);
49609+ atomic_sub(decw, &pipe->writers);
49610
49611- if (!pipe->readers && !pipe->writers) {
49612+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
49613 free_pipe_info(inode);
49614 } else {
49615 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
49616@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru
49617
49618 if (inode->i_pipe) {
49619 ret = 0;
49620- inode->i_pipe->readers++;
49621+ atomic_inc(&inode->i_pipe->readers);
49622 }
49623
49624 mutex_unlock(&inode->i_mutex);
49625@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str
49626
49627 if (inode->i_pipe) {
49628 ret = 0;
49629- inode->i_pipe->writers++;
49630+ atomic_inc(&inode->i_pipe->writers);
49631 }
49632
49633 mutex_unlock(&inode->i_mutex);
49634@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru
49635 if (inode->i_pipe) {
49636 ret = 0;
49637 if (filp->f_mode & FMODE_READ)
49638- inode->i_pipe->readers++;
49639+ atomic_inc(&inode->i_pipe->readers);
49640 if (filp->f_mode & FMODE_WRITE)
49641- inode->i_pipe->writers++;
49642+ atomic_inc(&inode->i_pipe->writers);
49643 }
49644
49645 mutex_unlock(&inode->i_mutex);
49646@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
49647 inode->i_pipe = NULL;
49648 }
49649
49650-static struct vfsmount *pipe_mnt __read_mostly;
49651+struct vfsmount *pipe_mnt __read_mostly;
49652
49653 /*
49654 * pipefs_dname() is called from d_path().
49655@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi
49656 goto fail_iput;
49657 inode->i_pipe = pipe;
49658
49659- pipe->readers = pipe->writers = 1;
49660+ atomic_set(&pipe->readers, 1);
49661+ atomic_set(&pipe->writers, 1);
49662 inode->i_fop = &rdwr_pipefifo_fops;
49663
49664 /*
49665diff -urNp linux-2.6.39.2/fs/proc/array.c linux-2.6.39.2/fs/proc/array.c
49666--- linux-2.6.39.2/fs/proc/array.c 2011-05-19 00:06:34.000000000 -0400
49667+++ linux-2.6.39.2/fs/proc/array.c 2011-05-22 19:41:37.000000000 -0400
49668@@ -60,6 +60,7 @@
49669 #include <linux/tty.h>
49670 #include <linux/string.h>
49671 #include <linux/mman.h>
49672+#include <linux/grsecurity.h>
49673 #include <linux/proc_fs.h>
49674 #include <linux/ioport.h>
49675 #include <linux/uaccess.h>
49676@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq
49677 seq_putc(m, '\n');
49678 }
49679
49680+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49681+static inline void task_pax(struct seq_file *m, struct task_struct *p)
49682+{
49683+ if (p->mm)
49684+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
49685+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
49686+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
49687+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
49688+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
49689+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
49690+ else
49691+ seq_printf(m, "PaX:\t-----\n");
49692+}
49693+#endif
49694+
49695 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
49696 struct pid *pid, struct task_struct *task)
49697 {
49698@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m,
49699 task_cpus_allowed(m, task);
49700 cpuset_task_status_allowed(m, task);
49701 task_context_switch_counts(m, task);
49702+
49703+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49704+ task_pax(m, task);
49705+#endif
49706+
49707+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
49708+ task_grsec_rbac(m, task);
49709+#endif
49710+
49711 return 0;
49712 }
49713
49714+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49715+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49716+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49717+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49718+#endif
49719+
49720 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
49721 struct pid *pid, struct task_struct *task, int whole)
49722 {
49723@@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file
49724 cputime_t cutime, cstime, utime, stime;
49725 cputime_t cgtime, gtime;
49726 unsigned long rsslim = 0;
49727- char tcomm[sizeof(task->comm)];
49728+ char tcomm[sizeof(task->comm)] = { 0 };
49729 unsigned long flags;
49730
49731+ pax_track_stack();
49732+
49733 state = *get_task_state(task);
49734 vsize = eip = esp = 0;
49735 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
49736@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file
49737 gtime = task->gtime;
49738 }
49739
49740+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49741+ if (PAX_RAND_FLAGS(mm)) {
49742+ eip = 0;
49743+ esp = 0;
49744+ wchan = 0;
49745+ }
49746+#endif
49747+#ifdef CONFIG_GRKERNSEC_HIDESYM
49748+ wchan = 0;
49749+ eip =0;
49750+ esp =0;
49751+#endif
49752+
49753 /* scale priority and nice values from timeslices to -20..20 */
49754 /* to make it look like a "normal" Unix priority/nice value */
49755 priority = task_prio(task);
49756@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file
49757 vsize,
49758 mm ? get_mm_rss(mm) : 0,
49759 rsslim,
49760+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49761+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
49762+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
49763+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
49764+#else
49765 mm ? (permitted ? mm->start_code : 1) : 0,
49766 mm ? (permitted ? mm->end_code : 1) : 0,
49767 (permitted && mm) ? mm->start_stack : 0,
49768+#endif
49769 esp,
49770 eip,
49771 /* The signal information here is obsolete.
49772@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
49773
49774 return 0;
49775 }
49776+
49777+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49778+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
49779+{
49780+ u32 curr_ip = 0;
49781+ unsigned long flags;
49782+
49783+ if (lock_task_sighand(task, &flags)) {
49784+ curr_ip = task->signal->curr_ip;
49785+ unlock_task_sighand(task, &flags);
49786+ }
49787+
49788+ return sprintf(buffer, "%pI4\n", &curr_ip);
49789+}
49790+#endif
49791diff -urNp linux-2.6.39.2/fs/proc/base.c linux-2.6.39.2/fs/proc/base.c
49792--- linux-2.6.39.2/fs/proc/base.c 2011-05-19 00:06:34.000000000 -0400
49793+++ linux-2.6.39.2/fs/proc/base.c 2011-06-04 21:20:04.000000000 -0400
49794@@ -104,6 +104,22 @@ struct pid_entry {
49795 union proc_op op;
49796 };
49797
49798+struct getdents_callback {
49799+ struct linux_dirent __user * current_dir;
49800+ struct linux_dirent __user * previous;
49801+ struct file * file;
49802+ int count;
49803+ int error;
49804+};
49805+
49806+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
49807+ loff_t offset, u64 ino, unsigned int d_type)
49808+{
49809+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
49810+ buf->error = -EINVAL;
49811+ return 0;
49812+}
49813+
49814 #define NOD(NAME, MODE, IOP, FOP, OP) { \
49815 .name = (NAME), \
49816 .len = sizeof(NAME) - 1, \
49817@@ -206,6 +222,9 @@ static struct mm_struct *__check_mem_per
49818 if (task == current)
49819 return mm;
49820
49821+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
49822+ return ERR_PTR(-EPERM);
49823+
49824 /*
49825 * If current is actively ptrace'ing, and would also be
49826 * permitted to freshly attach with ptrace now, permit it.
49827@@ -279,6 +298,9 @@ static int proc_pid_cmdline(struct task_
49828 if (!mm->arg_end)
49829 goto out_mm; /* Shh! No looking before we're done */
49830
49831+ if (gr_acl_handle_procpidmem(task))
49832+ goto out_mm;
49833+
49834 len = mm->arg_end - mm->arg_start;
49835
49836 if (len > PAGE_SIZE)
49837@@ -306,12 +328,28 @@ out:
49838 return res;
49839 }
49840
49841+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49842+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49843+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49844+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49845+#endif
49846+
49847 static int proc_pid_auxv(struct task_struct *task, char *buffer)
49848 {
49849 struct mm_struct *mm = mm_for_maps(task);
49850 int res = PTR_ERR(mm);
49851 if (mm && !IS_ERR(mm)) {
49852 unsigned int nwords = 0;
49853+
49854+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49855+ /* allow if we're currently ptracing this task */
49856+ if (PAX_RAND_FLAGS(mm) &&
49857+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
49858+ mmput(mm);
49859+ return res;
49860+ }
49861+#endif
49862+
49863 do {
49864 nwords += 2;
49865 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
49866@@ -325,7 +363,7 @@ static int proc_pid_auxv(struct task_str
49867 }
49868
49869
49870-#ifdef CONFIG_KALLSYMS
49871+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49872 /*
49873 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
49874 * Returns the resolved symbol. If that fails, simply return the address.
49875@@ -364,7 +402,7 @@ static void unlock_trace(struct task_str
49876 mutex_unlock(&task->signal->cred_guard_mutex);
49877 }
49878
49879-#ifdef CONFIG_STACKTRACE
49880+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49881
49882 #define MAX_STACK_TRACE_DEPTH 64
49883
49884@@ -555,7 +593,7 @@ static int proc_pid_limits(struct task_s
49885 return count;
49886 }
49887
49888-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49889+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49890 static int proc_pid_syscall(struct task_struct *task, char *buffer)
49891 {
49892 long nr;
49893@@ -584,7 +622,7 @@ static int proc_pid_syscall(struct task_
49894 /************************************************************************/
49895
49896 /* permission checks */
49897-static int proc_fd_access_allowed(struct inode *inode)
49898+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
49899 {
49900 struct task_struct *task;
49901 int allowed = 0;
49902@@ -594,7 +632,10 @@ static int proc_fd_access_allowed(struct
49903 */
49904 task = get_proc_task(inode);
49905 if (task) {
49906- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49907+ if (log)
49908+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
49909+ else
49910+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49911 put_task_struct(task);
49912 }
49913 return allowed;
49914@@ -973,6 +1014,9 @@ static ssize_t environ_read(struct file
49915 if (!task)
49916 goto out_no_task;
49917
49918+ if (gr_acl_handle_procpidmem(task))
49919+ goto out;
49920+
49921 ret = -ENOMEM;
49922 page = (char *)__get_free_page(GFP_TEMPORARY);
49923 if (!page)
49924@@ -1660,7 +1704,7 @@ static void *proc_pid_follow_link(struct
49925 path_put(&nd->path);
49926
49927 /* Are we allowed to snoop on the tasks file descriptors? */
49928- if (!proc_fd_access_allowed(inode))
49929+ if (!proc_fd_access_allowed(inode,0))
49930 goto out;
49931
49932 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
49933@@ -1699,8 +1743,18 @@ static int proc_pid_readlink(struct dent
49934 struct path path;
49935
49936 /* Are we allowed to snoop on the tasks file descriptors? */
49937- if (!proc_fd_access_allowed(inode))
49938- goto out;
49939+ /* logging this is needed for learning on chromium to work properly,
49940+ but we don't want to flood the logs from 'ps' which does a readlink
49941+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
49942+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
49943+ */
49944+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
49945+ if (!proc_fd_access_allowed(inode,0))
49946+ goto out;
49947+ } else {
49948+ if (!proc_fd_access_allowed(inode,1))
49949+ goto out;
49950+ }
49951
49952 error = PROC_I(inode)->op.proc_get_link(inode, &path);
49953 if (error)
49954@@ -1766,7 +1820,11 @@ static struct inode *proc_pid_make_inode
49955 rcu_read_lock();
49956 cred = __task_cred(task);
49957 inode->i_uid = cred->euid;
49958+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49959+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49960+#else
49961 inode->i_gid = cred->egid;
49962+#endif
49963 rcu_read_unlock();
49964 }
49965 security_task_to_inode(task, inode);
49966@@ -1784,6 +1842,9 @@ static int pid_getattr(struct vfsmount *
49967 struct inode *inode = dentry->d_inode;
49968 struct task_struct *task;
49969 const struct cred *cred;
49970+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49971+ const struct cred *tmpcred = current_cred();
49972+#endif
49973
49974 generic_fillattr(inode, stat);
49975
49976@@ -1791,13 +1852,41 @@ static int pid_getattr(struct vfsmount *
49977 stat->uid = 0;
49978 stat->gid = 0;
49979 task = pid_task(proc_pid(inode), PIDTYPE_PID);
49980+
49981+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
49982+ rcu_read_unlock();
49983+ return -ENOENT;
49984+ }
49985+
49986 if (task) {
49987+ cred = __task_cred(task);
49988+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49989+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
49990+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49991+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49992+#endif
49993+ ) {
49994+#endif
49995 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49996+#ifdef CONFIG_GRKERNSEC_PROC_USER
49997+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49998+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49999+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
50000+#endif
50001 task_dumpable(task)) {
50002- cred = __task_cred(task);
50003 stat->uid = cred->euid;
50004+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50005+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
50006+#else
50007 stat->gid = cred->egid;
50008+#endif
50009 }
50010+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50011+ } else {
50012+ rcu_read_unlock();
50013+ return -ENOENT;
50014+ }
50015+#endif
50016 }
50017 rcu_read_unlock();
50018 return 0;
50019@@ -1834,11 +1923,20 @@ static int pid_revalidate(struct dentry
50020
50021 if (task) {
50022 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
50023+#ifdef CONFIG_GRKERNSEC_PROC_USER
50024+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
50025+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50026+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
50027+#endif
50028 task_dumpable(task)) {
50029 rcu_read_lock();
50030 cred = __task_cred(task);
50031 inode->i_uid = cred->euid;
50032+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50033+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50034+#else
50035 inode->i_gid = cred->egid;
50036+#endif
50037 rcu_read_unlock();
50038 } else {
50039 inode->i_uid = 0;
50040@@ -1959,7 +2057,8 @@ static int proc_fd_info(struct inode *in
50041 int fd = proc_fd(inode);
50042
50043 if (task) {
50044- files = get_files_struct(task);
50045+ if (!gr_acl_handle_procpidmem(task))
50046+ files = get_files_struct(task);
50047 put_task_struct(task);
50048 }
50049 if (files) {
50050@@ -2219,15 +2318,25 @@ static const struct file_operations proc
50051 */
50052 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
50053 {
50054+ struct task_struct *task;
50055 int rv;
50056
50057 if (flags & IPERM_FLAG_RCU)
50058 return -ECHILD;
50059 rv = generic_permission(inode, mask, flags, NULL);
50060- if (rv == 0)
50061- return 0;
50062+
50063 if (task_pid(current) == proc_pid(inode))
50064 rv = 0;
50065+
50066+ task = get_proc_task(inode);
50067+ if (task == NULL)
50068+ return rv;
50069+
50070+ if (gr_acl_handle_procpidmem(task))
50071+ rv = -EACCES;
50072+
50073+ put_task_struct(task);
50074+
50075 return rv;
50076 }
50077
50078@@ -2337,6 +2446,9 @@ static struct dentry *proc_pident_lookup
50079 if (!task)
50080 goto out_no_task;
50081
50082+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
50083+ goto out;
50084+
50085 /*
50086 * Yes, it does not scale. And it should not. Don't add
50087 * new entries into /proc/<tgid>/ without very good reasons.
50088@@ -2381,6 +2493,9 @@ static int proc_pident_readdir(struct fi
50089 if (!task)
50090 goto out_no_task;
50091
50092+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
50093+ goto out;
50094+
50095 ret = 0;
50096 i = filp->f_pos;
50097 switch (i) {
50098@@ -2651,7 +2766,7 @@ static void *proc_self_follow_link(struc
50099 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
50100 void *cookie)
50101 {
50102- char *s = nd_get_link(nd);
50103+ const char *s = nd_get_link(nd);
50104 if (!IS_ERR(s))
50105 __putname(s);
50106 }
50107@@ -2835,7 +2950,7 @@ static const struct pid_entry tgid_base_
50108 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
50109 #endif
50110 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
50111-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
50112+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
50113 INF("syscall", S_IRUGO, proc_pid_syscall),
50114 #endif
50115 INF("cmdline", S_IRUGO, proc_pid_cmdline),
50116@@ -2860,10 +2975,10 @@ static const struct pid_entry tgid_base_
50117 #ifdef CONFIG_SECURITY
50118 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
50119 #endif
50120-#ifdef CONFIG_KALLSYMS
50121+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50122 INF("wchan", S_IRUGO, proc_pid_wchan),
50123 #endif
50124-#ifdef CONFIG_STACKTRACE
50125+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50126 ONE("stack", S_IRUGO, proc_pid_stack),
50127 #endif
50128 #ifdef CONFIG_SCHEDSTATS
50129@@ -2894,6 +3009,9 @@ static const struct pid_entry tgid_base_
50130 #ifdef CONFIG_TASK_IO_ACCOUNTING
50131 INF("io", S_IRUGO, proc_tgid_io_accounting),
50132 #endif
50133+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
50134+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
50135+#endif
50136 };
50137
50138 static int proc_tgid_base_readdir(struct file * filp,
50139@@ -3019,7 +3137,14 @@ static struct dentry *proc_pid_instantia
50140 if (!inode)
50141 goto out;
50142
50143+#ifdef CONFIG_GRKERNSEC_PROC_USER
50144+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
50145+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50146+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50147+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
50148+#else
50149 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
50150+#endif
50151 inode->i_op = &proc_tgid_base_inode_operations;
50152 inode->i_fop = &proc_tgid_base_operations;
50153 inode->i_flags|=S_IMMUTABLE;
50154@@ -3061,7 +3186,11 @@ struct dentry *proc_pid_lookup(struct in
50155 if (!task)
50156 goto out;
50157
50158+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
50159+ goto out_put_task;
50160+
50161 result = proc_pid_instantiate(dir, dentry, task, NULL);
50162+out_put_task:
50163 put_task_struct(task);
50164 out:
50165 return result;
50166@@ -3126,6 +3255,11 @@ int proc_pid_readdir(struct file * filp,
50167 {
50168 unsigned int nr;
50169 struct task_struct *reaper;
50170+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50171+ const struct cred *tmpcred = current_cred();
50172+ const struct cred *itercred;
50173+#endif
50174+ filldir_t __filldir = filldir;
50175 struct tgid_iter iter;
50176 struct pid_namespace *ns;
50177
50178@@ -3149,8 +3283,27 @@ int proc_pid_readdir(struct file * filp,
50179 for (iter = next_tgid(ns, iter);
50180 iter.task;
50181 iter.tgid += 1, iter = next_tgid(ns, iter)) {
50182+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50183+ rcu_read_lock();
50184+ itercred = __task_cred(iter.task);
50185+#endif
50186+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
50187+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50188+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
50189+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50190+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
50191+#endif
50192+ )
50193+#endif
50194+ )
50195+ __filldir = &gr_fake_filldir;
50196+ else
50197+ __filldir = filldir;
50198+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50199+ rcu_read_unlock();
50200+#endif
50201 filp->f_pos = iter.tgid + TGID_OFFSET;
50202- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
50203+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
50204 put_task_struct(iter.task);
50205 goto out;
50206 }
50207@@ -3177,7 +3330,7 @@ static const struct pid_entry tid_base_s
50208 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
50209 #endif
50210 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
50211-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
50212+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
50213 INF("syscall", S_IRUGO, proc_pid_syscall),
50214 #endif
50215 INF("cmdline", S_IRUGO, proc_pid_cmdline),
50216@@ -3201,10 +3354,10 @@ static const struct pid_entry tid_base_s
50217 #ifdef CONFIG_SECURITY
50218 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
50219 #endif
50220-#ifdef CONFIG_KALLSYMS
50221+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50222 INF("wchan", S_IRUGO, proc_pid_wchan),
50223 #endif
50224-#ifdef CONFIG_STACKTRACE
50225+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50226 ONE("stack", S_IRUGO, proc_pid_stack),
50227 #endif
50228 #ifdef CONFIG_SCHEDSTATS
50229diff -urNp linux-2.6.39.2/fs/proc/cmdline.c linux-2.6.39.2/fs/proc/cmdline.c
50230--- linux-2.6.39.2/fs/proc/cmdline.c 2011-05-19 00:06:34.000000000 -0400
50231+++ linux-2.6.39.2/fs/proc/cmdline.c 2011-05-22 19:41:37.000000000 -0400
50232@@ -23,7 +23,11 @@ static const struct file_operations cmdl
50233
50234 static int __init proc_cmdline_init(void)
50235 {
50236+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50237+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
50238+#else
50239 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
50240+#endif
50241 return 0;
50242 }
50243 module_init(proc_cmdline_init);
50244diff -urNp linux-2.6.39.2/fs/proc/devices.c linux-2.6.39.2/fs/proc/devices.c
50245--- linux-2.6.39.2/fs/proc/devices.c 2011-05-19 00:06:34.000000000 -0400
50246+++ linux-2.6.39.2/fs/proc/devices.c 2011-05-22 19:41:37.000000000 -0400
50247@@ -64,7 +64,11 @@ static const struct file_operations proc
50248
50249 static int __init proc_devices_init(void)
50250 {
50251+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50252+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
50253+#else
50254 proc_create("devices", 0, NULL, &proc_devinfo_operations);
50255+#endif
50256 return 0;
50257 }
50258 module_init(proc_devices_init);
50259diff -urNp linux-2.6.39.2/fs/proc/inode.c linux-2.6.39.2/fs/proc/inode.c
50260--- linux-2.6.39.2/fs/proc/inode.c 2011-05-19 00:06:34.000000000 -0400
50261+++ linux-2.6.39.2/fs/proc/inode.c 2011-05-22 19:41:37.000000000 -0400
50262@@ -433,7 +433,11 @@ struct inode *proc_get_inode(struct supe
50263 if (de->mode) {
50264 inode->i_mode = de->mode;
50265 inode->i_uid = de->uid;
50266+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50267+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50268+#else
50269 inode->i_gid = de->gid;
50270+#endif
50271 }
50272 if (de->size)
50273 inode->i_size = de->size;
50274diff -urNp linux-2.6.39.2/fs/proc/internal.h linux-2.6.39.2/fs/proc/internal.h
50275--- linux-2.6.39.2/fs/proc/internal.h 2011-05-19 00:06:34.000000000 -0400
50276+++ linux-2.6.39.2/fs/proc/internal.h 2011-05-22 19:41:37.000000000 -0400
50277@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
50278 struct pid *pid, struct task_struct *task);
50279 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
50280 struct pid *pid, struct task_struct *task);
50281+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
50282+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
50283+#endif
50284 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
50285
50286 extern const struct file_operations proc_maps_operations;
50287diff -urNp linux-2.6.39.2/fs/proc/Kconfig linux-2.6.39.2/fs/proc/Kconfig
50288--- linux-2.6.39.2/fs/proc/Kconfig 2011-05-19 00:06:34.000000000 -0400
50289+++ linux-2.6.39.2/fs/proc/Kconfig 2011-05-22 19:41:37.000000000 -0400
50290@@ -30,12 +30,12 @@ config PROC_FS
50291
50292 config PROC_KCORE
50293 bool "/proc/kcore support" if !ARM
50294- depends on PROC_FS && MMU
50295+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
50296
50297 config PROC_VMCORE
50298 bool "/proc/vmcore support"
50299- depends on PROC_FS && CRASH_DUMP
50300- default y
50301+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
50302+ default n
50303 help
50304 Exports the dump image of crashed kernel in ELF format.
50305
50306@@ -59,8 +59,8 @@ config PROC_SYSCTL
50307 limited in memory.
50308
50309 config PROC_PAGE_MONITOR
50310- default y
50311- depends on PROC_FS && MMU
50312+ default n
50313+ depends on PROC_FS && MMU && !GRKERNSEC
50314 bool "Enable /proc page monitoring" if EXPERT
50315 help
50316 Various /proc files exist to monitor process memory utilization:
50317diff -urNp linux-2.6.39.2/fs/proc/kcore.c linux-2.6.39.2/fs/proc/kcore.c
50318--- linux-2.6.39.2/fs/proc/kcore.c 2011-05-19 00:06:34.000000000 -0400
50319+++ linux-2.6.39.2/fs/proc/kcore.c 2011-05-22 19:41:37.000000000 -0400
50320@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
50321 off_t offset = 0;
50322 struct kcore_list *m;
50323
50324+ pax_track_stack();
50325+
50326 /* setup ELF header */
50327 elf = (struct elfhdr *) bufp;
50328 bufp += sizeof(struct elfhdr);
50329@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
50330 * the addresses in the elf_phdr on our list.
50331 */
50332 start = kc_offset_to_vaddr(*fpos - elf_buflen);
50333- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
50334+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
50335+ if (tsz > buflen)
50336 tsz = buflen;
50337-
50338+
50339 while (buflen) {
50340 struct kcore_list *m;
50341
50342@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
50343 kfree(elf_buf);
50344 } else {
50345 if (kern_addr_valid(start)) {
50346- unsigned long n;
50347+ char *elf_buf;
50348+ mm_segment_t oldfs;
50349
50350- n = copy_to_user(buffer, (char *)start, tsz);
50351- /*
50352- * We cannot distingush between fault on source
50353- * and fault on destination. When this happens
50354- * we clear too and hope it will trigger the
50355- * EFAULT again.
50356- */
50357- if (n) {
50358- if (clear_user(buffer + tsz - n,
50359- n))
50360+ elf_buf = kmalloc(tsz, GFP_KERNEL);
50361+ if (!elf_buf)
50362+ return -ENOMEM;
50363+ oldfs = get_fs();
50364+ set_fs(KERNEL_DS);
50365+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
50366+ set_fs(oldfs);
50367+ if (copy_to_user(buffer, elf_buf, tsz)) {
50368+ kfree(elf_buf);
50369 return -EFAULT;
50370+ }
50371 }
50372+ set_fs(oldfs);
50373+ kfree(elf_buf);
50374 } else {
50375 if (clear_user(buffer, tsz))
50376 return -EFAULT;
50377@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
50378
50379 static int open_kcore(struct inode *inode, struct file *filp)
50380 {
50381+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
50382+ return -EPERM;
50383+#endif
50384 if (!capable(CAP_SYS_RAWIO))
50385 return -EPERM;
50386 if (kcore_need_update)
50387diff -urNp linux-2.6.39.2/fs/proc/meminfo.c linux-2.6.39.2/fs/proc/meminfo.c
50388--- linux-2.6.39.2/fs/proc/meminfo.c 2011-05-19 00:06:34.000000000 -0400
50389+++ linux-2.6.39.2/fs/proc/meminfo.c 2011-05-22 19:36:32.000000000 -0400
50390@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
50391 unsigned long pages[NR_LRU_LISTS];
50392 int lru;
50393
50394+ pax_track_stack();
50395+
50396 /*
50397 * display in kilobytes.
50398 */
50399@@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
50400 vmi.used >> 10,
50401 vmi.largest_chunk >> 10
50402 #ifdef CONFIG_MEMORY_FAILURE
50403- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
50404+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
50405 #endif
50406 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
50407 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
50408diff -urNp linux-2.6.39.2/fs/proc/nommu.c linux-2.6.39.2/fs/proc/nommu.c
50409--- linux-2.6.39.2/fs/proc/nommu.c 2011-05-19 00:06:34.000000000 -0400
50410+++ linux-2.6.39.2/fs/proc/nommu.c 2011-05-22 19:36:32.000000000 -0400
50411@@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
50412 if (len < 1)
50413 len = 1;
50414 seq_printf(m, "%*c", len, ' ');
50415- seq_path(m, &file->f_path, "");
50416+ seq_path(m, &file->f_path, "\n\\");
50417 }
50418
50419 seq_putc(m, '\n');
50420diff -urNp linux-2.6.39.2/fs/proc/proc_net.c linux-2.6.39.2/fs/proc/proc_net.c
50421--- linux-2.6.39.2/fs/proc/proc_net.c 2011-05-19 00:06:34.000000000 -0400
50422+++ linux-2.6.39.2/fs/proc/proc_net.c 2011-05-22 19:41:37.000000000 -0400
50423@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
50424 struct task_struct *task;
50425 struct nsproxy *ns;
50426 struct net *net = NULL;
50427+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50428+ const struct cred *cred = current_cred();
50429+#endif
50430+
50431+#ifdef CONFIG_GRKERNSEC_PROC_USER
50432+ if (cred->fsuid)
50433+ return net;
50434+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50435+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
50436+ return net;
50437+#endif
50438
50439 rcu_read_lock();
50440 task = pid_task(proc_pid(dir), PIDTYPE_PID);
50441diff -urNp linux-2.6.39.2/fs/proc/proc_sysctl.c linux-2.6.39.2/fs/proc/proc_sysctl.c
50442--- linux-2.6.39.2/fs/proc/proc_sysctl.c 2011-05-19 00:06:34.000000000 -0400
50443+++ linux-2.6.39.2/fs/proc/proc_sysctl.c 2011-05-22 19:41:37.000000000 -0400
50444@@ -8,6 +8,8 @@
50445 #include <linux/namei.h>
50446 #include "internal.h"
50447
50448+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
50449+
50450 static const struct dentry_operations proc_sys_dentry_operations;
50451 static const struct file_operations proc_sys_file_operations;
50452 static const struct inode_operations proc_sys_inode_operations;
50453@@ -111,6 +113,9 @@ static struct dentry *proc_sys_lookup(st
50454 if (!p)
50455 goto out;
50456
50457+ if (gr_handle_sysctl(p, MAY_EXEC))
50458+ goto out;
50459+
50460 err = ERR_PTR(-ENOMEM);
50461 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
50462 if (h)
50463@@ -230,6 +235,9 @@ static int scan(struct ctl_table_header
50464 if (*pos < file->f_pos)
50465 continue;
50466
50467+ if (gr_handle_sysctl(table, 0))
50468+ continue;
50469+
50470 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
50471 if (res)
50472 return res;
50473@@ -358,6 +366,9 @@ static int proc_sys_getattr(struct vfsmo
50474 if (IS_ERR(head))
50475 return PTR_ERR(head);
50476
50477+ if (table && gr_handle_sysctl(table, MAY_EXEC))
50478+ return -ENOENT;
50479+
50480 generic_fillattr(inode, stat);
50481 if (table)
50482 stat->mode = (stat->mode & S_IFMT) | table->mode;
50483diff -urNp linux-2.6.39.2/fs/proc/root.c linux-2.6.39.2/fs/proc/root.c
50484--- linux-2.6.39.2/fs/proc/root.c 2011-05-19 00:06:34.000000000 -0400
50485+++ linux-2.6.39.2/fs/proc/root.c 2011-05-22 19:41:37.000000000 -0400
50486@@ -122,7 +122,15 @@ void __init proc_root_init(void)
50487 #ifdef CONFIG_PROC_DEVICETREE
50488 proc_device_tree_init();
50489 #endif
50490+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50491+#ifdef CONFIG_GRKERNSEC_PROC_USER
50492+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
50493+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50494+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
50495+#endif
50496+#else
50497 proc_mkdir("bus", NULL);
50498+#endif
50499 proc_sys_init();
50500 }
50501
50502diff -urNp linux-2.6.39.2/fs/proc/task_mmu.c linux-2.6.39.2/fs/proc/task_mmu.c
50503--- linux-2.6.39.2/fs/proc/task_mmu.c 2011-05-19 00:06:34.000000000 -0400
50504+++ linux-2.6.39.2/fs/proc/task_mmu.c 2011-05-22 22:43:29.000000000 -0400
50505@@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct
50506 "VmExe:\t%8lu kB\n"
50507 "VmLib:\t%8lu kB\n"
50508 "VmPTE:\t%8lu kB\n"
50509- "VmSwap:\t%8lu kB\n",
50510- hiwater_vm << (PAGE_SHIFT-10),
50511+ "VmSwap:\t%8lu kB\n"
50512+
50513+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50514+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
50515+#endif
50516+
50517+ ,hiwater_vm << (PAGE_SHIFT-10),
50518 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
50519 mm->locked_vm << (PAGE_SHIFT-10),
50520 hiwater_rss << (PAGE_SHIFT-10),
50521@@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct
50522 data << (PAGE_SHIFT-10),
50523 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
50524 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
50525- swap << (PAGE_SHIFT-10));
50526+ swap << (PAGE_SHIFT-10)
50527+
50528+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50529+ , mm->context.user_cs_base, mm->context.user_cs_limit
50530+#endif
50531+
50532+ );
50533 }
50534
50535 unsigned long task_vsize(struct mm_struct *mm)
50536@@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in
50537 return ret;
50538 }
50539
50540+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50541+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
50542+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
50543+ _mm->pax_flags & MF_PAX_SEGMEXEC))
50544+#endif
50545+
50546 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
50547 {
50548 struct mm_struct *mm = vma->vm_mm;
50549@@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file
50550 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
50551 }
50552
50553- /* We don't show the stack guard page in /proc/maps */
50554+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50555+ start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
50556+ end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
50557+#else
50558 start = vma->vm_start;
50559- if (stack_guard_page_start(vma, start))
50560- start += PAGE_SIZE;
50561 end = vma->vm_end;
50562- if (stack_guard_page_end(vma, end))
50563- end -= PAGE_SIZE;
50564+#endif
50565
50566 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
50567 start,
50568@@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file
50569 flags & VM_WRITE ? 'w' : '-',
50570 flags & VM_EXEC ? 'x' : '-',
50571 flags & VM_MAYSHARE ? 's' : 'p',
50572+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50573+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
50574+#else
50575 pgoff,
50576+#endif
50577 MAJOR(dev), MINOR(dev), ino, &len);
50578
50579 /*
50580@@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file
50581 */
50582 if (file) {
50583 pad_len_spaces(m, len);
50584- seq_path(m, &file->f_path, "\n");
50585+ seq_path(m, &file->f_path, "\n\\");
50586 } else {
50587 const char *name = arch_vma_name(vma);
50588 if (!name) {
50589@@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file
50590 if (vma->vm_start <= mm->brk &&
50591 vma->vm_end >= mm->start_brk) {
50592 name = "[heap]";
50593- } else if (vma->vm_start <= mm->start_stack &&
50594- vma->vm_end >= mm->start_stack) {
50595+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
50596+ (vma->vm_start <= mm->start_stack &&
50597+ vma->vm_end >= mm->start_stack)) {
50598 name = "[stack]";
50599 }
50600 } else {
50601@@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m,
50602 };
50603
50604 memset(&mss, 0, sizeof mss);
50605- mss.vma = vma;
50606- /* mmap_sem is held in m_start */
50607- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50608- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50609-
50610+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50611+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
50612+#endif
50613+ mss.vma = vma;
50614+ /* mmap_sem is held in m_start */
50615+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50616+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50617+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50618+ }
50619+#endif
50620 show_map_vma(m, vma);
50621
50622 seq_printf(m,
50623@@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m,
50624 "KernelPageSize: %8lu kB\n"
50625 "MMUPageSize: %8lu kB\n"
50626 "Locked: %8lu kB\n",
50627+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50628+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
50629+#else
50630 (vma->vm_end - vma->vm_start) >> 10,
50631+#endif
50632 mss.resident >> 10,
50633 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
50634 mss.shared_clean >> 10,
50635diff -urNp linux-2.6.39.2/fs/proc/task_nommu.c linux-2.6.39.2/fs/proc/task_nommu.c
50636--- linux-2.6.39.2/fs/proc/task_nommu.c 2011-05-19 00:06:34.000000000 -0400
50637+++ linux-2.6.39.2/fs/proc/task_nommu.c 2011-05-22 19:36:32.000000000 -0400
50638@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
50639 else
50640 bytes += kobjsize(mm);
50641
50642- if (current->fs && current->fs->users > 1)
50643+ if (current->fs && atomic_read(&current->fs->users) > 1)
50644 sbytes += kobjsize(current->fs);
50645 else
50646 bytes += kobjsize(current->fs);
50647@@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil
50648
50649 if (file) {
50650 pad_len_spaces(m, len);
50651- seq_path(m, &file->f_path, "");
50652+ seq_path(m, &file->f_path, "\n\\");
50653 } else if (mm) {
50654 if (vma->vm_start <= mm->start_stack &&
50655 vma->vm_end >= mm->start_stack) {
50656diff -urNp linux-2.6.39.2/fs/quota/netlink.c linux-2.6.39.2/fs/quota/netlink.c
50657--- linux-2.6.39.2/fs/quota/netlink.c 2011-05-19 00:06:34.000000000 -0400
50658+++ linux-2.6.39.2/fs/quota/netlink.c 2011-05-22 19:36:32.000000000 -0400
50659@@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
50660 void quota_send_warning(short type, unsigned int id, dev_t dev,
50661 const char warntype)
50662 {
50663- static atomic_t seq;
50664+ static atomic_unchecked_t seq;
50665 struct sk_buff *skb;
50666 void *msg_head;
50667 int ret;
50668@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
50669 "VFS: Not enough memory to send quota warning.\n");
50670 return;
50671 }
50672- msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
50673+ msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
50674 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
50675 if (!msg_head) {
50676 printk(KERN_ERR
50677diff -urNp linux-2.6.39.2/fs/readdir.c linux-2.6.39.2/fs/readdir.c
50678--- linux-2.6.39.2/fs/readdir.c 2011-05-19 00:06:34.000000000 -0400
50679+++ linux-2.6.39.2/fs/readdir.c 2011-05-22 19:41:42.000000000 -0400
50680@@ -17,6 +17,7 @@
50681 #include <linux/security.h>
50682 #include <linux/syscalls.h>
50683 #include <linux/unistd.h>
50684+#include <linux/namei.h>
50685
50686 #include <asm/uaccess.h>
50687
50688@@ -67,6 +68,7 @@ struct old_linux_dirent {
50689
50690 struct readdir_callback {
50691 struct old_linux_dirent __user * dirent;
50692+ struct file * file;
50693 int result;
50694 };
50695
50696@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
50697 buf->result = -EOVERFLOW;
50698 return -EOVERFLOW;
50699 }
50700+
50701+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50702+ return 0;
50703+
50704 buf->result++;
50705 dirent = buf->dirent;
50706 if (!access_ok(VERIFY_WRITE, dirent,
50707@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
50708
50709 buf.result = 0;
50710 buf.dirent = dirent;
50711+ buf.file = file;
50712
50713 error = vfs_readdir(file, fillonedir, &buf);
50714 if (buf.result)
50715@@ -142,6 +149,7 @@ struct linux_dirent {
50716 struct getdents_callback {
50717 struct linux_dirent __user * current_dir;
50718 struct linux_dirent __user * previous;
50719+ struct file * file;
50720 int count;
50721 int error;
50722 };
50723@@ -163,6 +171,10 @@ static int filldir(void * __buf, const c
50724 buf->error = -EOVERFLOW;
50725 return -EOVERFLOW;
50726 }
50727+
50728+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50729+ return 0;
50730+
50731 dirent = buf->previous;
50732 if (dirent) {
50733 if (__put_user(offset, &dirent->d_off))
50734@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
50735 buf.previous = NULL;
50736 buf.count = count;
50737 buf.error = 0;
50738+ buf.file = file;
50739
50740 error = vfs_readdir(file, filldir, &buf);
50741 if (error >= 0)
50742@@ -229,6 +242,7 @@ out:
50743 struct getdents_callback64 {
50744 struct linux_dirent64 __user * current_dir;
50745 struct linux_dirent64 __user * previous;
50746+ struct file *file;
50747 int count;
50748 int error;
50749 };
50750@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const
50751 buf->error = -EINVAL; /* only used if we fail.. */
50752 if (reclen > buf->count)
50753 return -EINVAL;
50754+
50755+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50756+ return 0;
50757+
50758 dirent = buf->previous;
50759 if (dirent) {
50760 if (__put_user(offset, &dirent->d_off))
50761@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
50762
50763 buf.current_dir = dirent;
50764 buf.previous = NULL;
50765+ buf.file = file;
50766 buf.count = count;
50767 buf.error = 0;
50768
50769diff -urNp linux-2.6.39.2/fs/reiserfs/dir.c linux-2.6.39.2/fs/reiserfs/dir.c
50770--- linux-2.6.39.2/fs/reiserfs/dir.c 2011-05-19 00:06:34.000000000 -0400
50771+++ linux-2.6.39.2/fs/reiserfs/dir.c 2011-05-22 19:36:32.000000000 -0400
50772@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
50773 struct reiserfs_dir_entry de;
50774 int ret = 0;
50775
50776+ pax_track_stack();
50777+
50778 reiserfs_write_lock(inode->i_sb);
50779
50780 reiserfs_check_lock_depth(inode->i_sb, "readdir");
50781diff -urNp linux-2.6.39.2/fs/reiserfs/do_balan.c linux-2.6.39.2/fs/reiserfs/do_balan.c
50782--- linux-2.6.39.2/fs/reiserfs/do_balan.c 2011-05-19 00:06:34.000000000 -0400
50783+++ linux-2.6.39.2/fs/reiserfs/do_balan.c 2011-05-22 19:36:32.000000000 -0400
50784@@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
50785 return;
50786 }
50787
50788- atomic_inc(&(fs_generation(tb->tb_sb)));
50789+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
50790 do_balance_starts(tb);
50791
50792 /* balance leaf returns 0 except if combining L R and S into
50793diff -urNp linux-2.6.39.2/fs/reiserfs/item_ops.c linux-2.6.39.2/fs/reiserfs/item_ops.c
50794--- linux-2.6.39.2/fs/reiserfs/item_ops.c 2011-05-19 00:06:34.000000000 -0400
50795+++ linux-2.6.39.2/fs/reiserfs/item_ops.c 2011-05-22 19:36:32.000000000 -0400
50796@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
50797 vi->vi_index, vi->vi_type, vi->vi_ih);
50798 }
50799
50800-static struct item_operations stat_data_ops = {
50801+static const struct item_operations stat_data_ops = {
50802 .bytes_number = sd_bytes_number,
50803 .decrement_key = sd_decrement_key,
50804 .is_left_mergeable = sd_is_left_mergeable,
50805@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
50806 vi->vi_index, vi->vi_type, vi->vi_ih);
50807 }
50808
50809-static struct item_operations direct_ops = {
50810+static const struct item_operations direct_ops = {
50811 .bytes_number = direct_bytes_number,
50812 .decrement_key = direct_decrement_key,
50813 .is_left_mergeable = direct_is_left_mergeable,
50814@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
50815 vi->vi_index, vi->vi_type, vi->vi_ih);
50816 }
50817
50818-static struct item_operations indirect_ops = {
50819+static const struct item_operations indirect_ops = {
50820 .bytes_number = indirect_bytes_number,
50821 .decrement_key = indirect_decrement_key,
50822 .is_left_mergeable = indirect_is_left_mergeable,
50823@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
50824 printk("\n");
50825 }
50826
50827-static struct item_operations direntry_ops = {
50828+static const struct item_operations direntry_ops = {
50829 .bytes_number = direntry_bytes_number,
50830 .decrement_key = direntry_decrement_key,
50831 .is_left_mergeable = direntry_is_left_mergeable,
50832@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
50833 "Invalid item type observed, run fsck ASAP");
50834 }
50835
50836-static struct item_operations errcatch_ops = {
50837+static const struct item_operations errcatch_ops = {
50838 errcatch_bytes_number,
50839 errcatch_decrement_key,
50840 errcatch_is_left_mergeable,
50841@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
50842 #error Item types must use disk-format assigned values.
50843 #endif
50844
50845-struct item_operations *item_ops[TYPE_ANY + 1] = {
50846+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
50847 &stat_data_ops,
50848 &indirect_ops,
50849 &direct_ops,
50850diff -urNp linux-2.6.39.2/fs/reiserfs/journal.c linux-2.6.39.2/fs/reiserfs/journal.c
50851--- linux-2.6.39.2/fs/reiserfs/journal.c 2011-05-19 00:06:34.000000000 -0400
50852+++ linux-2.6.39.2/fs/reiserfs/journal.c 2011-05-22 19:36:32.000000000 -0400
50853@@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
50854 struct buffer_head *bh;
50855 int i, j;
50856
50857+ pax_track_stack();
50858+
50859 bh = __getblk(dev, block, bufsize);
50860 if (buffer_uptodate(bh))
50861 return (bh);
50862diff -urNp linux-2.6.39.2/fs/reiserfs/namei.c linux-2.6.39.2/fs/reiserfs/namei.c
50863--- linux-2.6.39.2/fs/reiserfs/namei.c 2011-05-19 00:06:34.000000000 -0400
50864+++ linux-2.6.39.2/fs/reiserfs/namei.c 2011-05-22 19:36:32.000000000 -0400
50865@@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode
50866 unsigned long savelink = 1;
50867 struct timespec ctime;
50868
50869+ pax_track_stack();
50870+
50871 /* three balancings: (1) old name removal, (2) new name insertion
50872 and (3) maybe "save" link insertion
50873 stat data updates: (1) old directory,
50874diff -urNp linux-2.6.39.2/fs/reiserfs/procfs.c linux-2.6.39.2/fs/reiserfs/procfs.c
50875--- linux-2.6.39.2/fs/reiserfs/procfs.c 2011-05-19 00:06:34.000000000 -0400
50876+++ linux-2.6.39.2/fs/reiserfs/procfs.c 2011-05-22 19:36:32.000000000 -0400
50877@@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
50878 "SMALL_TAILS " : "NO_TAILS ",
50879 replay_only(sb) ? "REPLAY_ONLY " : "",
50880 convert_reiserfs(sb) ? "CONV " : "",
50881- atomic_read(&r->s_generation_counter),
50882+ atomic_read_unchecked(&r->s_generation_counter),
50883 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
50884 SF(s_do_balance), SF(s_unneeded_left_neighbor),
50885 SF(s_good_search_by_key_reada), SF(s_bmaps),
50886@@ -299,6 +299,8 @@ static int show_journal(struct seq_file
50887 struct journal_params *jp = &rs->s_v1.s_journal;
50888 char b[BDEVNAME_SIZE];
50889
50890+ pax_track_stack();
50891+
50892 seq_printf(m, /* on-disk fields */
50893 "jp_journal_1st_block: \t%i\n"
50894 "jp_journal_dev: \t%s[%x]\n"
50895diff -urNp linux-2.6.39.2/fs/reiserfs/stree.c linux-2.6.39.2/fs/reiserfs/stree.c
50896--- linux-2.6.39.2/fs/reiserfs/stree.c 2011-05-19 00:06:34.000000000 -0400
50897+++ linux-2.6.39.2/fs/reiserfs/stree.c 2011-05-22 19:36:32.000000000 -0400
50898@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
50899 int iter = 0;
50900 #endif
50901
50902+ pax_track_stack();
50903+
50904 BUG_ON(!th->t_trans_id);
50905
50906 init_tb_struct(th, &s_del_balance, sb, path,
50907@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
50908 int retval;
50909 int quota_cut_bytes = 0;
50910
50911+ pax_track_stack();
50912+
50913 BUG_ON(!th->t_trans_id);
50914
50915 le_key2cpu_key(&cpu_key, key);
50916@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
50917 int quota_cut_bytes;
50918 loff_t tail_pos = 0;
50919
50920+ pax_track_stack();
50921+
50922 BUG_ON(!th->t_trans_id);
50923
50924 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
50925@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
50926 int retval;
50927 int fs_gen;
50928
50929+ pax_track_stack();
50930+
50931 BUG_ON(!th->t_trans_id);
50932
50933 fs_gen = get_generation(inode->i_sb);
50934@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
50935 int fs_gen = 0;
50936 int quota_bytes = 0;
50937
50938+ pax_track_stack();
50939+
50940 BUG_ON(!th->t_trans_id);
50941
50942 if (inode) { /* Do we count quotas for item? */
50943diff -urNp linux-2.6.39.2/fs/reiserfs/super.c linux-2.6.39.2/fs/reiserfs/super.c
50944--- linux-2.6.39.2/fs/reiserfs/super.c 2011-05-19 00:06:34.000000000 -0400
50945+++ linux-2.6.39.2/fs/reiserfs/super.c 2011-05-22 19:36:32.000000000 -0400
50946@@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
50947 {.option_name = NULL}
50948 };
50949
50950+ pax_track_stack();
50951+
50952 *blocks = 0;
50953 if (!options || !*options)
50954 /* use default configuration: create tails, journaling on, no
50955diff -urNp linux-2.6.39.2/fs/select.c linux-2.6.39.2/fs/select.c
50956--- linux-2.6.39.2/fs/select.c 2011-05-19 00:06:34.000000000 -0400
50957+++ linux-2.6.39.2/fs/select.c 2011-05-22 19:41:42.000000000 -0400
50958@@ -20,6 +20,7 @@
50959 #include <linux/module.h>
50960 #include <linux/slab.h>
50961 #include <linux/poll.h>
50962+#include <linux/security.h>
50963 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
50964 #include <linux/file.h>
50965 #include <linux/fdtable.h>
50966@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
50967 int retval, i, timed_out = 0;
50968 unsigned long slack = 0;
50969
50970+ pax_track_stack();
50971+
50972 rcu_read_lock();
50973 retval = max_select_fd(n, fds);
50974 rcu_read_unlock();
50975@@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user
50976 /* Allocate small arguments on the stack to save memory and be faster */
50977 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
50978
50979+ pax_track_stack();
50980+
50981 ret = -EINVAL;
50982 if (n < 0)
50983 goto out_nofds;
50984@@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf
50985 struct poll_list *walk = head;
50986 unsigned long todo = nfds;
50987
50988+ pax_track_stack();
50989+
50990+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
50991 if (nfds > rlimit(RLIMIT_NOFILE))
50992 return -EINVAL;
50993
50994diff -urNp linux-2.6.39.2/fs/seq_file.c linux-2.6.39.2/fs/seq_file.c
50995--- linux-2.6.39.2/fs/seq_file.c 2011-05-19 00:06:34.000000000 -0400
50996+++ linux-2.6.39.2/fs/seq_file.c 2011-05-22 19:36:32.000000000 -0400
50997@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
50998 return 0;
50999 }
51000 if (!m->buf) {
51001- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
51002+ m->size = PAGE_SIZE;
51003+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
51004 if (!m->buf)
51005 return -ENOMEM;
51006 }
51007@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
51008 Eoverflow:
51009 m->op->stop(m, p);
51010 kfree(m->buf);
51011- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
51012+ m->size <<= 1;
51013+ m->buf = kmalloc(m->size, GFP_KERNEL);
51014 return !m->buf ? -ENOMEM : -EAGAIN;
51015 }
51016
51017@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
51018 m->version = file->f_version;
51019 /* grab buffer if we didn't have one */
51020 if (!m->buf) {
51021- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
51022+ m->size = PAGE_SIZE;
51023+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
51024 if (!m->buf)
51025 goto Enomem;
51026 }
51027@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
51028 goto Fill;
51029 m->op->stop(m, p);
51030 kfree(m->buf);
51031- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
51032+ m->size <<= 1;
51033+ m->buf = kmalloc(m->size, GFP_KERNEL);
51034 if (!m->buf)
51035 goto Enomem;
51036 m->count = 0;
51037diff -urNp linux-2.6.39.2/fs/splice.c linux-2.6.39.2/fs/splice.c
51038--- linux-2.6.39.2/fs/splice.c 2011-05-19 00:06:34.000000000 -0400
51039+++ linux-2.6.39.2/fs/splice.c 2011-05-22 19:36:32.000000000 -0400
51040@@ -186,7 +186,7 @@ ssize_t splice_to_pipe(struct pipe_inode
51041 pipe_lock(pipe);
51042
51043 for (;;) {
51044- if (!pipe->readers) {
51045+ if (!atomic_read(&pipe->readers)) {
51046 send_sig(SIGPIPE, current, 0);
51047 if (!ret)
51048 ret = -EPIPE;
51049@@ -240,9 +240,9 @@ ssize_t splice_to_pipe(struct pipe_inode
51050 do_wakeup = 0;
51051 }
51052
51053- pipe->waiting_writers++;
51054+ atomic_inc(&pipe->waiting_writers);
51055 pipe_wait(pipe);
51056- pipe->waiting_writers--;
51057+ atomic_dec(&pipe->waiting_writers);
51058 }
51059
51060 pipe_unlock(pipe);
51061@@ -316,6 +316,8 @@ __generic_file_splice_read(struct file *
51062 .spd_release = spd_release_page,
51063 };
51064
51065+ pax_track_stack();
51066+
51067 if (splice_grow_spd(pipe, &spd))
51068 return -ENOMEM;
51069
51070@@ -556,7 +558,7 @@ static ssize_t kernel_readv(struct file
51071 old_fs = get_fs();
51072 set_fs(get_ds());
51073 /* The cast to a user pointer is valid due to the set_fs() */
51074- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
51075+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
51076 set_fs(old_fs);
51077
51078 return res;
51079@@ -571,7 +573,7 @@ static ssize_t kernel_write(struct file
51080 old_fs = get_fs();
51081 set_fs(get_ds());
51082 /* The cast to a user pointer is valid due to the set_fs() */
51083- res = vfs_write(file, (const char __user *)buf, count, &pos);
51084+ res = vfs_write(file, (__force const char __user *)buf, count, &pos);
51085 set_fs(old_fs);
51086
51087 return res;
51088@@ -599,6 +601,8 @@ ssize_t default_file_splice_read(struct
51089 .spd_release = spd_release_page,
51090 };
51091
51092+ pax_track_stack();
51093+
51094 if (splice_grow_spd(pipe, &spd))
51095 return -ENOMEM;
51096
51097@@ -622,7 +626,7 @@ ssize_t default_file_splice_read(struct
51098 goto err;
51099
51100 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
51101- vec[i].iov_base = (void __user *) page_address(page);
51102+ vec[i].iov_base = (__force void __user *) page_address(page);
51103 vec[i].iov_len = this_len;
51104 spd.pages[i] = page;
51105 spd.nr_pages++;
51106@@ -842,10 +846,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
51107 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
51108 {
51109 while (!pipe->nrbufs) {
51110- if (!pipe->writers)
51111+ if (!atomic_read(&pipe->writers))
51112 return 0;
51113
51114- if (!pipe->waiting_writers && sd->num_spliced)
51115+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
51116 return 0;
51117
51118 if (sd->flags & SPLICE_F_NONBLOCK)
51119@@ -1178,7 +1182,7 @@ ssize_t splice_direct_to_actor(struct fi
51120 * out of the pipe right after the splice_to_pipe(). So set
51121 * PIPE_READERS appropriately.
51122 */
51123- pipe->readers = 1;
51124+ atomic_set(&pipe->readers, 1);
51125
51126 current->splice_pipe = pipe;
51127 }
51128@@ -1615,6 +1619,8 @@ static long vmsplice_to_pipe(struct file
51129 };
51130 long ret;
51131
51132+ pax_track_stack();
51133+
51134 pipe = get_pipe_info(file);
51135 if (!pipe)
51136 return -EBADF;
51137@@ -1730,9 +1736,9 @@ static int ipipe_prep(struct pipe_inode_
51138 ret = -ERESTARTSYS;
51139 break;
51140 }
51141- if (!pipe->writers)
51142+ if (!atomic_read(&pipe->writers))
51143 break;
51144- if (!pipe->waiting_writers) {
51145+ if (!atomic_read(&pipe->waiting_writers)) {
51146 if (flags & SPLICE_F_NONBLOCK) {
51147 ret = -EAGAIN;
51148 break;
51149@@ -1764,7 +1770,7 @@ static int opipe_prep(struct pipe_inode_
51150 pipe_lock(pipe);
51151
51152 while (pipe->nrbufs >= pipe->buffers) {
51153- if (!pipe->readers) {
51154+ if (!atomic_read(&pipe->readers)) {
51155 send_sig(SIGPIPE, current, 0);
51156 ret = -EPIPE;
51157 break;
51158@@ -1777,9 +1783,9 @@ static int opipe_prep(struct pipe_inode_
51159 ret = -ERESTARTSYS;
51160 break;
51161 }
51162- pipe->waiting_writers++;
51163+ atomic_inc(&pipe->waiting_writers);
51164 pipe_wait(pipe);
51165- pipe->waiting_writers--;
51166+ atomic_dec(&pipe->waiting_writers);
51167 }
51168
51169 pipe_unlock(pipe);
51170@@ -1815,14 +1821,14 @@ retry:
51171 pipe_double_lock(ipipe, opipe);
51172
51173 do {
51174- if (!opipe->readers) {
51175+ if (!atomic_read(&opipe->readers)) {
51176 send_sig(SIGPIPE, current, 0);
51177 if (!ret)
51178 ret = -EPIPE;
51179 break;
51180 }
51181
51182- if (!ipipe->nrbufs && !ipipe->writers)
51183+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
51184 break;
51185
51186 /*
51187@@ -1922,7 +1928,7 @@ static int link_pipe(struct pipe_inode_i
51188 pipe_double_lock(ipipe, opipe);
51189
51190 do {
51191- if (!opipe->readers) {
51192+ if (!atomic_read(&opipe->readers)) {
51193 send_sig(SIGPIPE, current, 0);
51194 if (!ret)
51195 ret = -EPIPE;
51196@@ -1967,7 +1973,7 @@ static int link_pipe(struct pipe_inode_i
51197 * return EAGAIN if we have the potential of some data in the
51198 * future, otherwise just return 0
51199 */
51200- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
51201+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
51202 ret = -EAGAIN;
51203
51204 pipe_unlock(ipipe);
51205diff -urNp linux-2.6.39.2/fs/sysfs/file.c linux-2.6.39.2/fs/sysfs/file.c
51206--- linux-2.6.39.2/fs/sysfs/file.c 2011-05-19 00:06:34.000000000 -0400
51207+++ linux-2.6.39.2/fs/sysfs/file.c 2011-05-22 19:36:32.000000000 -0400
51208@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
51209
51210 struct sysfs_open_dirent {
51211 atomic_t refcnt;
51212- atomic_t event;
51213+ atomic_unchecked_t event;
51214 wait_queue_head_t poll;
51215 struct list_head buffers; /* goes through sysfs_buffer.list */
51216 };
51217@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
51218 if (!sysfs_get_active(attr_sd))
51219 return -ENODEV;
51220
51221- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
51222+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
51223 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
51224
51225 sysfs_put_active(attr_sd);
51226@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
51227 return -ENOMEM;
51228
51229 atomic_set(&new_od->refcnt, 0);
51230- atomic_set(&new_od->event, 1);
51231+ atomic_set_unchecked(&new_od->event, 1);
51232 init_waitqueue_head(&new_od->poll);
51233 INIT_LIST_HEAD(&new_od->buffers);
51234 goto retry;
51235@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
51236
51237 sysfs_put_active(attr_sd);
51238
51239- if (buffer->event != atomic_read(&od->event))
51240+ if (buffer->event != atomic_read_unchecked(&od->event))
51241 goto trigger;
51242
51243 return DEFAULT_POLLMASK;
51244@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
51245
51246 od = sd->s_attr.open;
51247 if (od) {
51248- atomic_inc(&od->event);
51249+ atomic_inc_unchecked(&od->event);
51250 wake_up_interruptible(&od->poll);
51251 }
51252
51253diff -urNp linux-2.6.39.2/fs/sysfs/mount.c linux-2.6.39.2/fs/sysfs/mount.c
51254--- linux-2.6.39.2/fs/sysfs/mount.c 2011-05-19 00:06:34.000000000 -0400
51255+++ linux-2.6.39.2/fs/sysfs/mount.c 2011-05-22 19:41:42.000000000 -0400
51256@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
51257 .s_name = "",
51258 .s_count = ATOMIC_INIT(1),
51259 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
51260+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
51261+ .s_mode = S_IFDIR | S_IRWXU,
51262+#else
51263 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
51264+#endif
51265 .s_ino = 1,
51266 };
51267
51268diff -urNp linux-2.6.39.2/fs/sysfs/symlink.c linux-2.6.39.2/fs/sysfs/symlink.c
51269--- linux-2.6.39.2/fs/sysfs/symlink.c 2011-05-19 00:06:34.000000000 -0400
51270+++ linux-2.6.39.2/fs/sysfs/symlink.c 2011-05-22 19:36:32.000000000 -0400
51271@@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
51272
51273 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
51274 {
51275- char *page = nd_get_link(nd);
51276+ const char *page = nd_get_link(nd);
51277 if (!IS_ERR(page))
51278 free_page((unsigned long)page);
51279 }
51280diff -urNp linux-2.6.39.2/fs/udf/inode.c linux-2.6.39.2/fs/udf/inode.c
51281--- linux-2.6.39.2/fs/udf/inode.c 2011-05-19 00:06:34.000000000 -0400
51282+++ linux-2.6.39.2/fs/udf/inode.c 2011-05-22 19:36:32.000000000 -0400
51283@@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(
51284 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
51285 int lastblock = 0;
51286
51287+ pax_track_stack();
51288+
51289 prev_epos.offset = udf_file_entry_alloc_offset(inode);
51290 prev_epos.block = iinfo->i_location;
51291 prev_epos.bh = NULL;
51292diff -urNp linux-2.6.39.2/fs/udf/misc.c linux-2.6.39.2/fs/udf/misc.c
51293--- linux-2.6.39.2/fs/udf/misc.c 2011-05-19 00:06:34.000000000 -0400
51294+++ linux-2.6.39.2/fs/udf/misc.c 2011-05-22 19:36:32.000000000 -0400
51295@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
51296
51297 u8 udf_tag_checksum(const struct tag *t)
51298 {
51299- u8 *data = (u8 *)t;
51300+ const u8 *data = (const u8 *)t;
51301 u8 checksum = 0;
51302 int i;
51303 for (i = 0; i < sizeof(struct tag); ++i)
51304diff -urNp linux-2.6.39.2/fs/utimes.c linux-2.6.39.2/fs/utimes.c
51305--- linux-2.6.39.2/fs/utimes.c 2011-05-19 00:06:34.000000000 -0400
51306+++ linux-2.6.39.2/fs/utimes.c 2011-05-22 19:41:42.000000000 -0400
51307@@ -1,6 +1,7 @@
51308 #include <linux/compiler.h>
51309 #include <linux/file.h>
51310 #include <linux/fs.h>
51311+#include <linux/security.h>
51312 #include <linux/linkage.h>
51313 #include <linux/mount.h>
51314 #include <linux/namei.h>
51315@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
51316 goto mnt_drop_write_and_out;
51317 }
51318 }
51319+
51320+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
51321+ error = -EACCES;
51322+ goto mnt_drop_write_and_out;
51323+ }
51324+
51325 mutex_lock(&inode->i_mutex);
51326 error = notify_change(path->dentry, &newattrs);
51327 mutex_unlock(&inode->i_mutex);
51328diff -urNp linux-2.6.39.2/fs/xattr_acl.c linux-2.6.39.2/fs/xattr_acl.c
51329--- linux-2.6.39.2/fs/xattr_acl.c 2011-05-19 00:06:34.000000000 -0400
51330+++ linux-2.6.39.2/fs/xattr_acl.c 2011-05-22 19:36:32.000000000 -0400
51331@@ -17,8 +17,8 @@
51332 struct posix_acl *
51333 posix_acl_from_xattr(const void *value, size_t size)
51334 {
51335- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
51336- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
51337+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
51338+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
51339 int count;
51340 struct posix_acl *acl;
51341 struct posix_acl_entry *acl_e;
51342diff -urNp linux-2.6.39.2/fs/xattr.c linux-2.6.39.2/fs/xattr.c
51343--- linux-2.6.39.2/fs/xattr.c 2011-05-19 00:06:34.000000000 -0400
51344+++ linux-2.6.39.2/fs/xattr.c 2011-05-22 19:41:42.000000000 -0400
51345@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
51346 * Extended attribute SET operations
51347 */
51348 static long
51349-setxattr(struct dentry *d, const char __user *name, const void __user *value,
51350+setxattr(struct path *path, const char __user *name, const void __user *value,
51351 size_t size, int flags)
51352 {
51353 int error;
51354@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
51355 return PTR_ERR(kvalue);
51356 }
51357
51358- error = vfs_setxattr(d, kname, kvalue, size, flags);
51359+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
51360+ error = -EACCES;
51361+ goto out;
51362+ }
51363+
51364+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
51365+out:
51366 kfree(kvalue);
51367 return error;
51368 }
51369@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
51370 return error;
51371 error = mnt_want_write(path.mnt);
51372 if (!error) {
51373- error = setxattr(path.dentry, name, value, size, flags);
51374+ error = setxattr(&path, name, value, size, flags);
51375 mnt_drop_write(path.mnt);
51376 }
51377 path_put(&path);
51378@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
51379 return error;
51380 error = mnt_want_write(path.mnt);
51381 if (!error) {
51382- error = setxattr(path.dentry, name, value, size, flags);
51383+ error = setxattr(&path, name, value, size, flags);
51384 mnt_drop_write(path.mnt);
51385 }
51386 path_put(&path);
51387@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
51388 const void __user *,value, size_t, size, int, flags)
51389 {
51390 struct file *f;
51391- struct dentry *dentry;
51392 int error = -EBADF;
51393
51394 f = fget(fd);
51395 if (!f)
51396 return error;
51397- dentry = f->f_path.dentry;
51398- audit_inode(NULL, dentry);
51399+ audit_inode(NULL, f->f_path.dentry);
51400 error = mnt_want_write_file(f);
51401 if (!error) {
51402- error = setxattr(dentry, name, value, size, flags);
51403+ error = setxattr(&f->f_path, name, value, size, flags);
51404 mnt_drop_write(f->f_path.mnt);
51405 }
51406 fput(f);
51407diff -urNp linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl32.c
51408--- linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-19 00:06:34.000000000 -0400
51409+++ linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-22 19:41:42.000000000 -0400
51410@@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
51411 xfs_fsop_geom_t fsgeo;
51412 int error;
51413
51414+ memset(&fsgeo, 0, sizeof(fsgeo));
51415 error = xfs_fs_geometry(mp, &fsgeo, 3);
51416 if (error)
51417 return -error;
51418diff -urNp linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl.c
51419--- linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-19 00:06:34.000000000 -0400
51420+++ linux-2.6.39.2/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-22 19:36:32.000000000 -0400
51421@@ -128,7 +128,7 @@ xfs_find_handle(
51422 }
51423
51424 error = -EFAULT;
51425- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
51426+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
51427 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
51428 goto out_put;
51429
51430diff -urNp linux-2.6.39.2/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.39.2/fs/xfs/linux-2.6/xfs_iops.c
51431--- linux-2.6.39.2/fs/xfs/linux-2.6/xfs_iops.c 2011-05-19 00:06:34.000000000 -0400
51432+++ linux-2.6.39.2/fs/xfs/linux-2.6/xfs_iops.c 2011-05-22 19:36:32.000000000 -0400
51433@@ -437,7 +437,7 @@ xfs_vn_put_link(
51434 struct nameidata *nd,
51435 void *p)
51436 {
51437- char *s = nd_get_link(nd);
51438+ const char *s = nd_get_link(nd);
51439
51440 if (!IS_ERR(s))
51441 kfree(s);
51442diff -urNp linux-2.6.39.2/fs/xfs/xfs_bmap.c linux-2.6.39.2/fs/xfs/xfs_bmap.c
51443--- linux-2.6.39.2/fs/xfs/xfs_bmap.c 2011-05-19 00:06:34.000000000 -0400
51444+++ linux-2.6.39.2/fs/xfs/xfs_bmap.c 2011-05-22 19:36:32.000000000 -0400
51445@@ -287,7 +287,7 @@ xfs_bmap_validate_ret(
51446 int nmap,
51447 int ret_nmap);
51448 #else
51449-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
51450+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
51451 #endif /* DEBUG */
51452
51453 STATIC int
51454diff -urNp linux-2.6.39.2/fs/xfs/xfs_dir2.c linux-2.6.39.2/fs/xfs/xfs_dir2.c
51455--- linux-2.6.39.2/fs/xfs/xfs_dir2.c 2011-05-19 00:06:34.000000000 -0400
51456+++ linux-2.6.39.2/fs/xfs/xfs_dir2.c 2011-05-22 19:36:32.000000000 -0400
51457@@ -85,7 +85,7 @@ xfs_ascii_ci_compname(
51458 return result;
51459 }
51460
51461-static struct xfs_nameops xfs_ascii_ci_nameops = {
51462+static const struct xfs_nameops xfs_ascii_ci_nameops = {
51463 .hashname = xfs_ascii_ci_hashname,
51464 .compname = xfs_ascii_ci_compname,
51465 };
51466diff -urNp linux-2.6.39.2/fs/xfs/xfs_dir2_sf.c linux-2.6.39.2/fs/xfs/xfs_dir2_sf.c
51467--- linux-2.6.39.2/fs/xfs/xfs_dir2_sf.c 2011-05-19 00:06:34.000000000 -0400
51468+++ linux-2.6.39.2/fs/xfs/xfs_dir2_sf.c 2011-05-22 19:36:32.000000000 -0400
51469@@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
51470 }
51471
51472 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
51473- if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51474+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
51475+ char name[sfep->namelen];
51476+ memcpy(name, sfep->name, sfep->namelen);
51477+ if (filldir(dirent, name, sfep->namelen,
51478+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
51479+ *offset = off & 0x7fffffff;
51480+ return 0;
51481+ }
51482+ } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51483 off & 0x7fffffff, ino, DT_UNKNOWN)) {
51484 *offset = off & 0x7fffffff;
51485 return 0;
51486diff -urNp linux-2.6.39.2/grsecurity/gracl_alloc.c linux-2.6.39.2/grsecurity/gracl_alloc.c
51487--- linux-2.6.39.2/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
51488+++ linux-2.6.39.2/grsecurity/gracl_alloc.c 2011-05-22 19:41:42.000000000 -0400
51489@@ -0,0 +1,105 @@
51490+#include <linux/kernel.h>
51491+#include <linux/mm.h>
51492+#include <linux/slab.h>
51493+#include <linux/vmalloc.h>
51494+#include <linux/gracl.h>
51495+#include <linux/grsecurity.h>
51496+
51497+static unsigned long alloc_stack_next = 1;
51498+static unsigned long alloc_stack_size = 1;
51499+static void **alloc_stack;
51500+
51501+static __inline__ int
51502+alloc_pop(void)
51503+{
51504+ if (alloc_stack_next == 1)
51505+ return 0;
51506+
51507+ kfree(alloc_stack[alloc_stack_next - 2]);
51508+
51509+ alloc_stack_next--;
51510+
51511+ return 1;
51512+}
51513+
51514+static __inline__ int
51515+alloc_push(void *buf)
51516+{
51517+ if (alloc_stack_next >= alloc_stack_size)
51518+ return 1;
51519+
51520+ alloc_stack[alloc_stack_next - 1] = buf;
51521+
51522+ alloc_stack_next++;
51523+
51524+ return 0;
51525+}
51526+
51527+void *
51528+acl_alloc(unsigned long len)
51529+{
51530+ void *ret = NULL;
51531+
51532+ if (!len || len > PAGE_SIZE)
51533+ goto out;
51534+
51535+ ret = kmalloc(len, GFP_KERNEL);
51536+
51537+ if (ret) {
51538+ if (alloc_push(ret)) {
51539+ kfree(ret);
51540+ ret = NULL;
51541+ }
51542+ }
51543+
51544+out:
51545+ return ret;
51546+}
51547+
51548+void *
51549+acl_alloc_num(unsigned long num, unsigned long len)
51550+{
51551+ if (!len || (num > (PAGE_SIZE / len)))
51552+ return NULL;
51553+
51554+ return acl_alloc(num * len);
51555+}
51556+
51557+void
51558+acl_free_all(void)
51559+{
51560+ if (gr_acl_is_enabled() || !alloc_stack)
51561+ return;
51562+
51563+ while (alloc_pop()) ;
51564+
51565+ if (alloc_stack) {
51566+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
51567+ kfree(alloc_stack);
51568+ else
51569+ vfree(alloc_stack);
51570+ }
51571+
51572+ alloc_stack = NULL;
51573+ alloc_stack_size = 1;
51574+ alloc_stack_next = 1;
51575+
51576+ return;
51577+}
51578+
51579+int
51580+acl_alloc_stack_init(unsigned long size)
51581+{
51582+ if ((size * sizeof (void *)) <= PAGE_SIZE)
51583+ alloc_stack =
51584+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
51585+ else
51586+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
51587+
51588+ alloc_stack_size = size;
51589+
51590+ if (!alloc_stack)
51591+ return 0;
51592+ else
51593+ return 1;
51594+}
51595diff -urNp linux-2.6.39.2/grsecurity/gracl.c linux-2.6.39.2/grsecurity/gracl.c
51596--- linux-2.6.39.2/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
51597+++ linux-2.6.39.2/grsecurity/gracl.c 2011-06-11 16:26:18.000000000 -0400
51598@@ -0,0 +1,4109 @@
51599+#include <linux/kernel.h>
51600+#include <linux/module.h>
51601+#include <linux/sched.h>
51602+#include <linux/mm.h>
51603+#include <linux/file.h>
51604+#include <linux/fs.h>
51605+#include <linux/namei.h>
51606+#include <linux/mount.h>
51607+#include <linux/tty.h>
51608+#include <linux/proc_fs.h>
51609+#include <linux/lglock.h>
51610+#include <linux/slab.h>
51611+#include <linux/vmalloc.h>
51612+#include <linux/types.h>
51613+#include <linux/sysctl.h>
51614+#include <linux/netdevice.h>
51615+#include <linux/ptrace.h>
51616+#include <linux/gracl.h>
51617+#include <linux/gralloc.h>
51618+#include <linux/grsecurity.h>
51619+#include <linux/grinternal.h>
51620+#include <linux/pid_namespace.h>
51621+#include <linux/fdtable.h>
51622+#include <linux/percpu.h>
51623+
51624+#include <asm/uaccess.h>
51625+#include <asm/errno.h>
51626+#include <asm/mman.h>
51627+
51628+static struct acl_role_db acl_role_set;
51629+static struct name_db name_set;
51630+static struct inodev_db inodev_set;
51631+
51632+/* for keeping track of userspace pointers used for subjects, so we
51633+ can share references in the kernel as well
51634+*/
51635+
51636+static struct path real_root;
51637+
51638+static struct acl_subj_map_db subj_map_set;
51639+
51640+static struct acl_role_label *default_role;
51641+
51642+static struct acl_role_label *role_list;
51643+
51644+static u16 acl_sp_role_value;
51645+
51646+extern char *gr_shared_page[4];
51647+static DEFINE_MUTEX(gr_dev_mutex);
51648+DEFINE_RWLOCK(gr_inode_lock);
51649+
51650+struct gr_arg *gr_usermode;
51651+
51652+static unsigned int gr_status __read_only = GR_STATUS_INIT;
51653+
51654+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
51655+extern void gr_clear_learn_entries(void);
51656+
51657+#ifdef CONFIG_GRKERNSEC_RESLOG
51658+extern void gr_log_resource(const struct task_struct *task,
51659+ const int res, const unsigned long wanted, const int gt);
51660+#endif
51661+
51662+unsigned char *gr_system_salt;
51663+unsigned char *gr_system_sum;
51664+
51665+static struct sprole_pw **acl_special_roles = NULL;
51666+static __u16 num_sprole_pws = 0;
51667+
51668+static struct acl_role_label *kernel_role = NULL;
51669+
51670+static unsigned int gr_auth_attempts = 0;
51671+static unsigned long gr_auth_expires = 0UL;
51672+
51673+#ifdef CONFIG_NET
51674+extern struct vfsmount *sock_mnt;
51675+#endif
51676+
51677+extern struct vfsmount *pipe_mnt;
51678+extern struct vfsmount *shm_mnt;
51679+#ifdef CONFIG_HUGETLBFS
51680+extern struct vfsmount *hugetlbfs_vfsmount;
51681+#endif
51682+
51683+static struct acl_object_label *fakefs_obj_rw;
51684+static struct acl_object_label *fakefs_obj_rwx;
51685+
51686+extern int gr_init_uidset(void);
51687+extern void gr_free_uidset(void);
51688+extern void gr_remove_uid(uid_t uid);
51689+extern int gr_find_uid(uid_t uid);
51690+
51691+DECLARE_BRLOCK(vfsmount_lock);
51692+
51693+__inline__ int
51694+gr_acl_is_enabled(void)
51695+{
51696+ return (gr_status & GR_READY);
51697+}
51698+
51699+#ifdef CONFIG_BTRFS_FS
51700+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
51701+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
51702+#endif
51703+
51704+static inline dev_t __get_dev(const struct dentry *dentry)
51705+{
51706+#ifdef CONFIG_BTRFS_FS
51707+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
51708+ return get_btrfs_dev_from_inode(dentry->d_inode);
51709+ else
51710+#endif
51711+ return dentry->d_inode->i_sb->s_dev;
51712+}
51713+
51714+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
51715+{
51716+ return __get_dev(dentry);
51717+}
51718+
51719+static char gr_task_roletype_to_char(struct task_struct *task)
51720+{
51721+ switch (task->role->roletype &
51722+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
51723+ GR_ROLE_SPECIAL)) {
51724+ case GR_ROLE_DEFAULT:
51725+ return 'D';
51726+ case GR_ROLE_USER:
51727+ return 'U';
51728+ case GR_ROLE_GROUP:
51729+ return 'G';
51730+ case GR_ROLE_SPECIAL:
51731+ return 'S';
51732+ }
51733+
51734+ return 'X';
51735+}
51736+
51737+char gr_roletype_to_char(void)
51738+{
51739+ return gr_task_roletype_to_char(current);
51740+}
51741+
51742+__inline__ int
51743+gr_acl_tpe_check(void)
51744+{
51745+ if (unlikely(!(gr_status & GR_READY)))
51746+ return 0;
51747+ if (current->role->roletype & GR_ROLE_TPE)
51748+ return 1;
51749+ else
51750+ return 0;
51751+}
51752+
51753+int
51754+gr_handle_rawio(const struct inode *inode)
51755+{
51756+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
51757+ if (inode && S_ISBLK(inode->i_mode) &&
51758+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
51759+ !capable(CAP_SYS_RAWIO))
51760+ return 1;
51761+#endif
51762+ return 0;
51763+}
51764+
51765+static int
51766+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
51767+{
51768+ if (likely(lena != lenb))
51769+ return 0;
51770+
51771+ return !memcmp(a, b, lena);
51772+}
51773+
51774+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
51775+{
51776+ *buflen -= namelen;
51777+ if (*buflen < 0)
51778+ return -ENAMETOOLONG;
51779+ *buffer -= namelen;
51780+ memcpy(*buffer, str, namelen);
51781+ return 0;
51782+}
51783+
51784+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
51785+{
51786+ return prepend(buffer, buflen, name->name, name->len);
51787+}
51788+
51789+static int prepend_path(const struct path *path, struct path *root,
51790+ char **buffer, int *buflen)
51791+{
51792+ struct dentry *dentry = path->dentry;
51793+ struct vfsmount *vfsmnt = path->mnt;
51794+ bool slash = false;
51795+ int error = 0;
51796+
51797+ while (dentry != root->dentry || vfsmnt != root->mnt) {
51798+ struct dentry * parent;
51799+
51800+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
51801+ /* Global root? */
51802+ if (vfsmnt->mnt_parent == vfsmnt) {
51803+ goto out;
51804+ }
51805+ dentry = vfsmnt->mnt_mountpoint;
51806+ vfsmnt = vfsmnt->mnt_parent;
51807+ continue;
51808+ }
51809+ parent = dentry->d_parent;
51810+ prefetch(parent);
51811+ spin_lock(&dentry->d_lock);
51812+ error = prepend_name(buffer, buflen, &dentry->d_name);
51813+ spin_unlock(&dentry->d_lock);
51814+ if (!error)
51815+ error = prepend(buffer, buflen, "/", 1);
51816+ if (error)
51817+ break;
51818+
51819+ slash = true;
51820+ dentry = parent;
51821+ }
51822+
51823+out:
51824+ if (!error && !slash)
51825+ error = prepend(buffer, buflen, "/", 1);
51826+
51827+ return error;
51828+}
51829+
51830+/* this must be called with vfsmount_lock and rename_lock held */
51831+
51832+static char *__our_d_path(const struct path *path, struct path *root,
51833+ char *buf, int buflen)
51834+{
51835+ char *res = buf + buflen;
51836+ int error;
51837+
51838+ prepend(&res, &buflen, "\0", 1);
51839+ error = prepend_path(path, root, &res, &buflen);
51840+ if (error)
51841+ return ERR_PTR(error);
51842+
51843+ return res;
51844+}
51845+
51846+static char *
51847+gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
51848+{
51849+ char *retval;
51850+
51851+ retval = __our_d_path(path, root, buf, buflen);
51852+ if (unlikely(IS_ERR(retval)))
51853+ retval = strcpy(buf, "<path too long>");
51854+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
51855+ retval[1] = '\0';
51856+
51857+ return retval;
51858+}
51859+
51860+static char *
51861+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51862+ char *buf, int buflen)
51863+{
51864+ struct path path;
51865+ char *res;
51866+
51867+ path.dentry = (struct dentry *)dentry;
51868+ path.mnt = (struct vfsmount *)vfsmnt;
51869+
51870+ /* we can use real_root.dentry, real_root.mnt, because this is only called
51871+ by the RBAC system */
51872+ res = gen_full_path(&path, &real_root, buf, buflen);
51873+
51874+ return res;
51875+}
51876+
51877+static char *
51878+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51879+ char *buf, int buflen)
51880+{
51881+ char *res;
51882+ struct path path;
51883+ struct path root;
51884+ struct task_struct *reaper = &init_task;
51885+
51886+ path.dentry = (struct dentry *)dentry;
51887+ path.mnt = (struct vfsmount *)vfsmnt;
51888+
51889+ /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51890+ get_fs_root(reaper->fs, &root);
51891+
51892+ write_seqlock(&rename_lock);
51893+ br_read_lock(vfsmount_lock);
51894+ res = gen_full_path(&path, &root, buf, buflen);
51895+ br_read_unlock(vfsmount_lock);
51896+ write_sequnlock(&rename_lock);
51897+
51898+ path_put(&root);
51899+ return res;
51900+}
51901+
51902+static char *
51903+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51904+{
51905+ char *ret;
51906+ write_seqlock(&rename_lock);
51907+ br_read_lock(vfsmount_lock);
51908+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51909+ PAGE_SIZE);
51910+ br_read_unlock(vfsmount_lock);
51911+ write_sequnlock(&rename_lock);
51912+ return ret;
51913+}
51914+
51915+char *
51916+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51917+{
51918+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51919+ PAGE_SIZE);
51920+}
51921+
51922+char *
51923+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51924+{
51925+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51926+ PAGE_SIZE);
51927+}
51928+
51929+char *
51930+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51931+{
51932+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51933+ PAGE_SIZE);
51934+}
51935+
51936+char *
51937+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51938+{
51939+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51940+ PAGE_SIZE);
51941+}
51942+
51943+char *
51944+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51945+{
51946+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51947+ PAGE_SIZE);
51948+}
51949+
51950+__inline__ __u32
51951+to_gr_audit(const __u32 reqmode)
51952+{
51953+ /* masks off auditable permission flags, then shifts them to create
51954+ auditing flags, and adds the special case of append auditing if
51955+ we're requesting write */
51956+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51957+}
51958+
51959+struct acl_subject_label *
51960+lookup_subject_map(const struct acl_subject_label *userp)
51961+{
51962+ unsigned int index = shash(userp, subj_map_set.s_size);
51963+ struct subject_map *match;
51964+
51965+ match = subj_map_set.s_hash[index];
51966+
51967+ while (match && match->user != userp)
51968+ match = match->next;
51969+
51970+ if (match != NULL)
51971+ return match->kernel;
51972+ else
51973+ return NULL;
51974+}
51975+
51976+static void
51977+insert_subj_map_entry(struct subject_map *subjmap)
51978+{
51979+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51980+ struct subject_map **curr;
51981+
51982+ subjmap->prev = NULL;
51983+
51984+ curr = &subj_map_set.s_hash[index];
51985+ if (*curr != NULL)
51986+ (*curr)->prev = subjmap;
51987+
51988+ subjmap->next = *curr;
51989+ *curr = subjmap;
51990+
51991+ return;
51992+}
51993+
51994+static struct acl_role_label *
51995+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51996+ const gid_t gid)
51997+{
51998+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51999+ struct acl_role_label *match;
52000+ struct role_allowed_ip *ipp;
52001+ unsigned int x;
52002+ u32 curr_ip = task->signal->curr_ip;
52003+
52004+ task->signal->saved_ip = curr_ip;
52005+
52006+ match = acl_role_set.r_hash[index];
52007+
52008+ while (match) {
52009+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
52010+ for (x = 0; x < match->domain_child_num; x++) {
52011+ if (match->domain_children[x] == uid)
52012+ goto found;
52013+ }
52014+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
52015+ break;
52016+ match = match->next;
52017+ }
52018+found:
52019+ if (match == NULL) {
52020+ try_group:
52021+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
52022+ match = acl_role_set.r_hash[index];
52023+
52024+ while (match) {
52025+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
52026+ for (x = 0; x < match->domain_child_num; x++) {
52027+ if (match->domain_children[x] == gid)
52028+ goto found2;
52029+ }
52030+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
52031+ break;
52032+ match = match->next;
52033+ }
52034+found2:
52035+ if (match == NULL)
52036+ match = default_role;
52037+ if (match->allowed_ips == NULL)
52038+ return match;
52039+ else {
52040+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
52041+ if (likely
52042+ ((ntohl(curr_ip) & ipp->netmask) ==
52043+ (ntohl(ipp->addr) & ipp->netmask)))
52044+ return match;
52045+ }
52046+ match = default_role;
52047+ }
52048+ } else if (match->allowed_ips == NULL) {
52049+ return match;
52050+ } else {
52051+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
52052+ if (likely
52053+ ((ntohl(curr_ip) & ipp->netmask) ==
52054+ (ntohl(ipp->addr) & ipp->netmask)))
52055+ return match;
52056+ }
52057+ goto try_group;
52058+ }
52059+
52060+ return match;
52061+}
52062+
52063+struct acl_subject_label *
52064+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
52065+ const struct acl_role_label *role)
52066+{
52067+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
52068+ struct acl_subject_label *match;
52069+
52070+ match = role->subj_hash[index];
52071+
52072+ while (match && (match->inode != ino || match->device != dev ||
52073+ (match->mode & GR_DELETED))) {
52074+ match = match->next;
52075+ }
52076+
52077+ if (match && !(match->mode & GR_DELETED))
52078+ return match;
52079+ else
52080+ return NULL;
52081+}
52082+
52083+struct acl_subject_label *
52084+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
52085+ const struct acl_role_label *role)
52086+{
52087+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
52088+ struct acl_subject_label *match;
52089+
52090+ match = role->subj_hash[index];
52091+
52092+ while (match && (match->inode != ino || match->device != dev ||
52093+ !(match->mode & GR_DELETED))) {
52094+ match = match->next;
52095+ }
52096+
52097+ if (match && (match->mode & GR_DELETED))
52098+ return match;
52099+ else
52100+ return NULL;
52101+}
52102+
52103+static struct acl_object_label *
52104+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
52105+ const struct acl_subject_label *subj)
52106+{
52107+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
52108+ struct acl_object_label *match;
52109+
52110+ match = subj->obj_hash[index];
52111+
52112+ while (match && (match->inode != ino || match->device != dev ||
52113+ (match->mode & GR_DELETED))) {
52114+ match = match->next;
52115+ }
52116+
52117+ if (match && !(match->mode & GR_DELETED))
52118+ return match;
52119+ else
52120+ return NULL;
52121+}
52122+
52123+static struct acl_object_label *
52124+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
52125+ const struct acl_subject_label *subj)
52126+{
52127+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
52128+ struct acl_object_label *match;
52129+
52130+ match = subj->obj_hash[index];
52131+
52132+ while (match && (match->inode != ino || match->device != dev ||
52133+ !(match->mode & GR_DELETED))) {
52134+ match = match->next;
52135+ }
52136+
52137+ if (match && (match->mode & GR_DELETED))
52138+ return match;
52139+
52140+ match = subj->obj_hash[index];
52141+
52142+ while (match && (match->inode != ino || match->device != dev ||
52143+ (match->mode & GR_DELETED))) {
52144+ match = match->next;
52145+ }
52146+
52147+ if (match && !(match->mode & GR_DELETED))
52148+ return match;
52149+ else
52150+ return NULL;
52151+}
52152+
52153+static struct name_entry *
52154+lookup_name_entry(const char *name)
52155+{
52156+ unsigned int len = strlen(name);
52157+ unsigned int key = full_name_hash(name, len);
52158+ unsigned int index = key % name_set.n_size;
52159+ struct name_entry *match;
52160+
52161+ match = name_set.n_hash[index];
52162+
52163+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
52164+ match = match->next;
52165+
52166+ return match;
52167+}
52168+
52169+static struct name_entry *
52170+lookup_name_entry_create(const char *name)
52171+{
52172+ unsigned int len = strlen(name);
52173+ unsigned int key = full_name_hash(name, len);
52174+ unsigned int index = key % name_set.n_size;
52175+ struct name_entry *match;
52176+
52177+ match = name_set.n_hash[index];
52178+
52179+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52180+ !match->deleted))
52181+ match = match->next;
52182+
52183+ if (match && match->deleted)
52184+ return match;
52185+
52186+ match = name_set.n_hash[index];
52187+
52188+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52189+ match->deleted))
52190+ match = match->next;
52191+
52192+ if (match && !match->deleted)
52193+ return match;
52194+ else
52195+ return NULL;
52196+}
52197+
52198+static struct inodev_entry *
52199+lookup_inodev_entry(const ino_t ino, const dev_t dev)
52200+{
52201+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
52202+ struct inodev_entry *match;
52203+
52204+ match = inodev_set.i_hash[index];
52205+
52206+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
52207+ match = match->next;
52208+
52209+ return match;
52210+}
52211+
52212+static void
52213+insert_inodev_entry(struct inodev_entry *entry)
52214+{
52215+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
52216+ inodev_set.i_size);
52217+ struct inodev_entry **curr;
52218+
52219+ entry->prev = NULL;
52220+
52221+ curr = &inodev_set.i_hash[index];
52222+ if (*curr != NULL)
52223+ (*curr)->prev = entry;
52224+
52225+ entry->next = *curr;
52226+ *curr = entry;
52227+
52228+ return;
52229+}
52230+
52231+static void
52232+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
52233+{
52234+ unsigned int index =
52235+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
52236+ struct acl_role_label **curr;
52237+ struct acl_role_label *tmp;
52238+
52239+ curr = &acl_role_set.r_hash[index];
52240+
52241+ /* if role was already inserted due to domains and already has
52242+ a role in the same bucket as it attached, then we need to
52243+ combine these two buckets
52244+ */
52245+ if (role->next) {
52246+ tmp = role->next;
52247+ while (tmp->next)
52248+ tmp = tmp->next;
52249+ tmp->next = *curr;
52250+ } else
52251+ role->next = *curr;
52252+ *curr = role;
52253+
52254+ return;
52255+}
52256+
52257+static void
52258+insert_acl_role_label(struct acl_role_label *role)
52259+{
52260+ int i;
52261+
52262+ if (role_list == NULL) {
52263+ role_list = role;
52264+ role->prev = NULL;
52265+ } else {
52266+ role->prev = role_list;
52267+ role_list = role;
52268+ }
52269+
52270+ /* used for hash chains */
52271+ role->next = NULL;
52272+
52273+ if (role->roletype & GR_ROLE_DOMAIN) {
52274+ for (i = 0; i < role->domain_child_num; i++)
52275+ __insert_acl_role_label(role, role->domain_children[i]);
52276+ } else
52277+ __insert_acl_role_label(role, role->uidgid);
52278+}
52279+
52280+static int
52281+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
52282+{
52283+ struct name_entry **curr, *nentry;
52284+ struct inodev_entry *ientry;
52285+ unsigned int len = strlen(name);
52286+ unsigned int key = full_name_hash(name, len);
52287+ unsigned int index = key % name_set.n_size;
52288+
52289+ curr = &name_set.n_hash[index];
52290+
52291+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
52292+ curr = &((*curr)->next);
52293+
52294+ if (*curr != NULL)
52295+ return 1;
52296+
52297+ nentry = acl_alloc(sizeof (struct name_entry));
52298+ if (nentry == NULL)
52299+ return 0;
52300+ ientry = acl_alloc(sizeof (struct inodev_entry));
52301+ if (ientry == NULL)
52302+ return 0;
52303+ ientry->nentry = nentry;
52304+
52305+ nentry->key = key;
52306+ nentry->name = name;
52307+ nentry->inode = inode;
52308+ nentry->device = device;
52309+ nentry->len = len;
52310+ nentry->deleted = deleted;
52311+
52312+ nentry->prev = NULL;
52313+ curr = &name_set.n_hash[index];
52314+ if (*curr != NULL)
52315+ (*curr)->prev = nentry;
52316+ nentry->next = *curr;
52317+ *curr = nentry;
52318+
52319+ /* insert us into the table searchable by inode/dev */
52320+ insert_inodev_entry(ientry);
52321+
52322+ return 1;
52323+}
52324+
52325+static void
52326+insert_acl_obj_label(struct acl_object_label *obj,
52327+ struct acl_subject_label *subj)
52328+{
52329+ unsigned int index =
52330+ fhash(obj->inode, obj->device, subj->obj_hash_size);
52331+ struct acl_object_label **curr;
52332+
52333+
52334+ obj->prev = NULL;
52335+
52336+ curr = &subj->obj_hash[index];
52337+ if (*curr != NULL)
52338+ (*curr)->prev = obj;
52339+
52340+ obj->next = *curr;
52341+ *curr = obj;
52342+
52343+ return;
52344+}
52345+
52346+static void
52347+insert_acl_subj_label(struct acl_subject_label *obj,
52348+ struct acl_role_label *role)
52349+{
52350+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
52351+ struct acl_subject_label **curr;
52352+
52353+ obj->prev = NULL;
52354+
52355+ curr = &role->subj_hash[index];
52356+ if (*curr != NULL)
52357+ (*curr)->prev = obj;
52358+
52359+ obj->next = *curr;
52360+ *curr = obj;
52361+
52362+ return;
52363+}
52364+
52365+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
52366+
52367+static void *
52368+create_table(__u32 * len, int elementsize)
52369+{
52370+ unsigned int table_sizes[] = {
52371+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
52372+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
52373+ 4194301, 8388593, 16777213, 33554393, 67108859
52374+ };
52375+ void *newtable = NULL;
52376+ unsigned int pwr = 0;
52377+
52378+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
52379+ table_sizes[pwr] <= *len)
52380+ pwr++;
52381+
52382+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
52383+ return newtable;
52384+
52385+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
52386+ newtable =
52387+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
52388+ else
52389+ newtable = vmalloc(table_sizes[pwr] * elementsize);
52390+
52391+ *len = table_sizes[pwr];
52392+
52393+ return newtable;
52394+}
52395+
52396+static int
52397+init_variables(const struct gr_arg *arg)
52398+{
52399+ struct task_struct *reaper = &init_task;
52400+ unsigned int stacksize;
52401+
52402+ subj_map_set.s_size = arg->role_db.num_subjects;
52403+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
52404+ name_set.n_size = arg->role_db.num_objects;
52405+ inodev_set.i_size = arg->role_db.num_objects;
52406+
52407+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
52408+ !name_set.n_size || !inodev_set.i_size)
52409+ return 1;
52410+
52411+ if (!gr_init_uidset())
52412+ return 1;
52413+
52414+ /* set up the stack that holds allocation info */
52415+
52416+ stacksize = arg->role_db.num_pointers + 5;
52417+
52418+ if (!acl_alloc_stack_init(stacksize))
52419+ return 1;
52420+
52421+ /* grab reference for the real root dentry and vfsmount */
52422+ get_fs_root(reaper->fs, &real_root);
52423+
52424+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52425+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
52426+#endif
52427+
52428+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
52429+ if (fakefs_obj_rw == NULL)
52430+ return 1;
52431+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
52432+
52433+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
52434+ if (fakefs_obj_rwx == NULL)
52435+ return 1;
52436+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
52437+
52438+ subj_map_set.s_hash =
52439+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
52440+ acl_role_set.r_hash =
52441+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
52442+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
52443+ inodev_set.i_hash =
52444+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
52445+
52446+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
52447+ !name_set.n_hash || !inodev_set.i_hash)
52448+ return 1;
52449+
52450+ memset(subj_map_set.s_hash, 0,
52451+ sizeof(struct subject_map *) * subj_map_set.s_size);
52452+ memset(acl_role_set.r_hash, 0,
52453+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
52454+ memset(name_set.n_hash, 0,
52455+ sizeof (struct name_entry *) * name_set.n_size);
52456+ memset(inodev_set.i_hash, 0,
52457+ sizeof (struct inodev_entry *) * inodev_set.i_size);
52458+
52459+ return 0;
52460+}
52461+
52462+/* free information not needed after startup
52463+ currently contains user->kernel pointer mappings for subjects
52464+*/
52465+
52466+static void
52467+free_init_variables(void)
52468+{
52469+ __u32 i;
52470+
52471+ if (subj_map_set.s_hash) {
52472+ for (i = 0; i < subj_map_set.s_size; i++) {
52473+ if (subj_map_set.s_hash[i]) {
52474+ kfree(subj_map_set.s_hash[i]);
52475+ subj_map_set.s_hash[i] = NULL;
52476+ }
52477+ }
52478+
52479+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
52480+ PAGE_SIZE)
52481+ kfree(subj_map_set.s_hash);
52482+ else
52483+ vfree(subj_map_set.s_hash);
52484+ }
52485+
52486+ return;
52487+}
52488+
52489+static void
52490+free_variables(void)
52491+{
52492+ struct acl_subject_label *s;
52493+ struct acl_role_label *r;
52494+ struct task_struct *task, *task2;
52495+ unsigned int x;
52496+
52497+ gr_clear_learn_entries();
52498+
52499+ read_lock(&tasklist_lock);
52500+ do_each_thread(task2, task) {
52501+ task->acl_sp_role = 0;
52502+ task->acl_role_id = 0;
52503+ task->acl = NULL;
52504+ task->role = NULL;
52505+ } while_each_thread(task2, task);
52506+ read_unlock(&tasklist_lock);
52507+
52508+ /* release the reference to the real root dentry and vfsmount */
52509+ path_put(&real_root);
52510+
52511+ /* free all object hash tables */
52512+
52513+ FOR_EACH_ROLE_START(r)
52514+ if (r->subj_hash == NULL)
52515+ goto next_role;
52516+ FOR_EACH_SUBJECT_START(r, s, x)
52517+ if (s->obj_hash == NULL)
52518+ break;
52519+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52520+ kfree(s->obj_hash);
52521+ else
52522+ vfree(s->obj_hash);
52523+ FOR_EACH_SUBJECT_END(s, x)
52524+ FOR_EACH_NESTED_SUBJECT_START(r, s)
52525+ if (s->obj_hash == NULL)
52526+ break;
52527+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52528+ kfree(s->obj_hash);
52529+ else
52530+ vfree(s->obj_hash);
52531+ FOR_EACH_NESTED_SUBJECT_END(s)
52532+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
52533+ kfree(r->subj_hash);
52534+ else
52535+ vfree(r->subj_hash);
52536+ r->subj_hash = NULL;
52537+next_role:
52538+ FOR_EACH_ROLE_END(r)
52539+
52540+ acl_free_all();
52541+
52542+ if (acl_role_set.r_hash) {
52543+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
52544+ PAGE_SIZE)
52545+ kfree(acl_role_set.r_hash);
52546+ else
52547+ vfree(acl_role_set.r_hash);
52548+ }
52549+ if (name_set.n_hash) {
52550+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
52551+ PAGE_SIZE)
52552+ kfree(name_set.n_hash);
52553+ else
52554+ vfree(name_set.n_hash);
52555+ }
52556+
52557+ if (inodev_set.i_hash) {
52558+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
52559+ PAGE_SIZE)
52560+ kfree(inodev_set.i_hash);
52561+ else
52562+ vfree(inodev_set.i_hash);
52563+ }
52564+
52565+ gr_free_uidset();
52566+
52567+ memset(&name_set, 0, sizeof (struct name_db));
52568+ memset(&inodev_set, 0, sizeof (struct inodev_db));
52569+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
52570+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
52571+
52572+ default_role = NULL;
52573+ role_list = NULL;
52574+
52575+ return;
52576+}
52577+
52578+static __u32
52579+count_user_objs(struct acl_object_label *userp)
52580+{
52581+ struct acl_object_label o_tmp;
52582+ __u32 num = 0;
52583+
52584+ while (userp) {
52585+ if (copy_from_user(&o_tmp, userp,
52586+ sizeof (struct acl_object_label)))
52587+ break;
52588+
52589+ userp = o_tmp.prev;
52590+ num++;
52591+ }
52592+
52593+ return num;
52594+}
52595+
52596+static struct acl_subject_label *
52597+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
52598+
52599+static int
52600+copy_user_glob(struct acl_object_label *obj)
52601+{
52602+ struct acl_object_label *g_tmp, **guser;
52603+ unsigned int len;
52604+ char *tmp;
52605+
52606+ if (obj->globbed == NULL)
52607+ return 0;
52608+
52609+ guser = &obj->globbed;
52610+ while (*guser) {
52611+ g_tmp = (struct acl_object_label *)
52612+ acl_alloc(sizeof (struct acl_object_label));
52613+ if (g_tmp == NULL)
52614+ return -ENOMEM;
52615+
52616+ if (copy_from_user(g_tmp, *guser,
52617+ sizeof (struct acl_object_label)))
52618+ return -EFAULT;
52619+
52620+ len = strnlen_user(g_tmp->filename, PATH_MAX);
52621+
52622+ if (!len || len >= PATH_MAX)
52623+ return -EINVAL;
52624+
52625+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52626+ return -ENOMEM;
52627+
52628+ if (copy_from_user(tmp, g_tmp->filename, len))
52629+ return -EFAULT;
52630+ tmp[len-1] = '\0';
52631+ g_tmp->filename = tmp;
52632+
52633+ *guser = g_tmp;
52634+ guser = &(g_tmp->next);
52635+ }
52636+
52637+ return 0;
52638+}
52639+
52640+static int
52641+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
52642+ struct acl_role_label *role)
52643+{
52644+ struct acl_object_label *o_tmp;
52645+ unsigned int len;
52646+ int ret;
52647+ char *tmp;
52648+
52649+ while (userp) {
52650+ if ((o_tmp = (struct acl_object_label *)
52651+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
52652+ return -ENOMEM;
52653+
52654+ if (copy_from_user(o_tmp, userp,
52655+ sizeof (struct acl_object_label)))
52656+ return -EFAULT;
52657+
52658+ userp = o_tmp->prev;
52659+
52660+ len = strnlen_user(o_tmp->filename, PATH_MAX);
52661+
52662+ if (!len || len >= PATH_MAX)
52663+ return -EINVAL;
52664+
52665+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52666+ return -ENOMEM;
52667+
52668+ if (copy_from_user(tmp, o_tmp->filename, len))
52669+ return -EFAULT;
52670+ tmp[len-1] = '\0';
52671+ o_tmp->filename = tmp;
52672+
52673+ insert_acl_obj_label(o_tmp, subj);
52674+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
52675+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
52676+ return -ENOMEM;
52677+
52678+ ret = copy_user_glob(o_tmp);
52679+ if (ret)
52680+ return ret;
52681+
52682+ if (o_tmp->nested) {
52683+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
52684+ if (IS_ERR(o_tmp->nested))
52685+ return PTR_ERR(o_tmp->nested);
52686+
52687+ /* insert into nested subject list */
52688+ o_tmp->nested->next = role->hash->first;
52689+ role->hash->first = o_tmp->nested;
52690+ }
52691+ }
52692+
52693+ return 0;
52694+}
52695+
52696+static __u32
52697+count_user_subjs(struct acl_subject_label *userp)
52698+{
52699+ struct acl_subject_label s_tmp;
52700+ __u32 num = 0;
52701+
52702+ while (userp) {
52703+ if (copy_from_user(&s_tmp, userp,
52704+ sizeof (struct acl_subject_label)))
52705+ break;
52706+
52707+ userp = s_tmp.prev;
52708+ /* do not count nested subjects against this count, since
52709+ they are not included in the hash table, but are
52710+ attached to objects. We have already counted
52711+ the subjects in userspace for the allocation
52712+ stack
52713+ */
52714+ if (!(s_tmp.mode & GR_NESTED))
52715+ num++;
52716+ }
52717+
52718+ return num;
52719+}
52720+
52721+static int
52722+copy_user_allowedips(struct acl_role_label *rolep)
52723+{
52724+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
52725+
52726+ ruserip = rolep->allowed_ips;
52727+
52728+ while (ruserip) {
52729+ rlast = rtmp;
52730+
52731+ if ((rtmp = (struct role_allowed_ip *)
52732+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
52733+ return -ENOMEM;
52734+
52735+ if (copy_from_user(rtmp, ruserip,
52736+ sizeof (struct role_allowed_ip)))
52737+ return -EFAULT;
52738+
52739+ ruserip = rtmp->prev;
52740+
52741+ if (!rlast) {
52742+ rtmp->prev = NULL;
52743+ rolep->allowed_ips = rtmp;
52744+ } else {
52745+ rlast->next = rtmp;
52746+ rtmp->prev = rlast;
52747+ }
52748+
52749+ if (!ruserip)
52750+ rtmp->next = NULL;
52751+ }
52752+
52753+ return 0;
52754+}
52755+
52756+static int
52757+copy_user_transitions(struct acl_role_label *rolep)
52758+{
52759+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
52760+
52761+ unsigned int len;
52762+ char *tmp;
52763+
52764+ rusertp = rolep->transitions;
52765+
52766+ while (rusertp) {
52767+ rlast = rtmp;
52768+
52769+ if ((rtmp = (struct role_transition *)
52770+ acl_alloc(sizeof (struct role_transition))) == NULL)
52771+ return -ENOMEM;
52772+
52773+ if (copy_from_user(rtmp, rusertp,
52774+ sizeof (struct role_transition)))
52775+ return -EFAULT;
52776+
52777+ rusertp = rtmp->prev;
52778+
52779+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
52780+
52781+ if (!len || len >= GR_SPROLE_LEN)
52782+ return -EINVAL;
52783+
52784+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52785+ return -ENOMEM;
52786+
52787+ if (copy_from_user(tmp, rtmp->rolename, len))
52788+ return -EFAULT;
52789+ tmp[len-1] = '\0';
52790+ rtmp->rolename = tmp;
52791+
52792+ if (!rlast) {
52793+ rtmp->prev = NULL;
52794+ rolep->transitions = rtmp;
52795+ } else {
52796+ rlast->next = rtmp;
52797+ rtmp->prev = rlast;
52798+ }
52799+
52800+ if (!rusertp)
52801+ rtmp->next = NULL;
52802+ }
52803+
52804+ return 0;
52805+}
52806+
52807+static struct acl_subject_label *
52808+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
52809+{
52810+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
52811+ unsigned int len;
52812+ char *tmp;
52813+ __u32 num_objs;
52814+ struct acl_ip_label **i_tmp, *i_utmp2;
52815+ struct gr_hash_struct ghash;
52816+ struct subject_map *subjmap;
52817+ unsigned int i_num;
52818+ int err;
52819+
52820+ s_tmp = lookup_subject_map(userp);
52821+
52822+ /* we've already copied this subject into the kernel, just return
52823+ the reference to it, and don't copy it over again
52824+ */
52825+ if (s_tmp)
52826+ return(s_tmp);
52827+
52828+ if ((s_tmp = (struct acl_subject_label *)
52829+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
52830+ return ERR_PTR(-ENOMEM);
52831+
52832+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
52833+ if (subjmap == NULL)
52834+ return ERR_PTR(-ENOMEM);
52835+
52836+ subjmap->user = userp;
52837+ subjmap->kernel = s_tmp;
52838+ insert_subj_map_entry(subjmap);
52839+
52840+ if (copy_from_user(s_tmp, userp,
52841+ sizeof (struct acl_subject_label)))
52842+ return ERR_PTR(-EFAULT);
52843+
52844+ len = strnlen_user(s_tmp->filename, PATH_MAX);
52845+
52846+ if (!len || len >= PATH_MAX)
52847+ return ERR_PTR(-EINVAL);
52848+
52849+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52850+ return ERR_PTR(-ENOMEM);
52851+
52852+ if (copy_from_user(tmp, s_tmp->filename, len))
52853+ return ERR_PTR(-EFAULT);
52854+ tmp[len-1] = '\0';
52855+ s_tmp->filename = tmp;
52856+
52857+ if (!strcmp(s_tmp->filename, "/"))
52858+ role->root_label = s_tmp;
52859+
52860+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52861+ return ERR_PTR(-EFAULT);
52862+
52863+ /* copy user and group transition tables */
52864+
52865+ if (s_tmp->user_trans_num) {
52866+ uid_t *uidlist;
52867+
52868+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52869+ if (uidlist == NULL)
52870+ return ERR_PTR(-ENOMEM);
52871+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52872+ return ERR_PTR(-EFAULT);
52873+
52874+ s_tmp->user_transitions = uidlist;
52875+ }
52876+
52877+ if (s_tmp->group_trans_num) {
52878+ gid_t *gidlist;
52879+
52880+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52881+ if (gidlist == NULL)
52882+ return ERR_PTR(-ENOMEM);
52883+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52884+ return ERR_PTR(-EFAULT);
52885+
52886+ s_tmp->group_transitions = gidlist;
52887+ }
52888+
52889+ /* set up object hash table */
52890+ num_objs = count_user_objs(ghash.first);
52891+
52892+ s_tmp->obj_hash_size = num_objs;
52893+ s_tmp->obj_hash =
52894+ (struct acl_object_label **)
52895+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52896+
52897+ if (!s_tmp->obj_hash)
52898+ return ERR_PTR(-ENOMEM);
52899+
52900+ memset(s_tmp->obj_hash, 0,
52901+ s_tmp->obj_hash_size *
52902+ sizeof (struct acl_object_label *));
52903+
52904+ /* add in objects */
52905+ err = copy_user_objs(ghash.first, s_tmp, role);
52906+
52907+ if (err)
52908+ return ERR_PTR(err);
52909+
52910+ /* set pointer for parent subject */
52911+ if (s_tmp->parent_subject) {
52912+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52913+
52914+ if (IS_ERR(s_tmp2))
52915+ return s_tmp2;
52916+
52917+ s_tmp->parent_subject = s_tmp2;
52918+ }
52919+
52920+ /* add in ip acls */
52921+
52922+ if (!s_tmp->ip_num) {
52923+ s_tmp->ips = NULL;
52924+ goto insert;
52925+ }
52926+
52927+ i_tmp =
52928+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52929+ sizeof (struct acl_ip_label *));
52930+
52931+ if (!i_tmp)
52932+ return ERR_PTR(-ENOMEM);
52933+
52934+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52935+ *(i_tmp + i_num) =
52936+ (struct acl_ip_label *)
52937+ acl_alloc(sizeof (struct acl_ip_label));
52938+ if (!*(i_tmp + i_num))
52939+ return ERR_PTR(-ENOMEM);
52940+
52941+ if (copy_from_user
52942+ (&i_utmp2, s_tmp->ips + i_num,
52943+ sizeof (struct acl_ip_label *)))
52944+ return ERR_PTR(-EFAULT);
52945+
52946+ if (copy_from_user
52947+ (*(i_tmp + i_num), i_utmp2,
52948+ sizeof (struct acl_ip_label)))
52949+ return ERR_PTR(-EFAULT);
52950+
52951+ if ((*(i_tmp + i_num))->iface == NULL)
52952+ continue;
52953+
52954+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52955+ if (!len || len >= IFNAMSIZ)
52956+ return ERR_PTR(-EINVAL);
52957+ tmp = acl_alloc(len);
52958+ if (tmp == NULL)
52959+ return ERR_PTR(-ENOMEM);
52960+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52961+ return ERR_PTR(-EFAULT);
52962+ (*(i_tmp + i_num))->iface = tmp;
52963+ }
52964+
52965+ s_tmp->ips = i_tmp;
52966+
52967+insert:
52968+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52969+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52970+ return ERR_PTR(-ENOMEM);
52971+
52972+ return s_tmp;
52973+}
52974+
52975+static int
52976+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52977+{
52978+ struct acl_subject_label s_pre;
52979+ struct acl_subject_label * ret;
52980+ int err;
52981+
52982+ while (userp) {
52983+ if (copy_from_user(&s_pre, userp,
52984+ sizeof (struct acl_subject_label)))
52985+ return -EFAULT;
52986+
52987+ /* do not add nested subjects here, add
52988+ while parsing objects
52989+ */
52990+
52991+ if (s_pre.mode & GR_NESTED) {
52992+ userp = s_pre.prev;
52993+ continue;
52994+ }
52995+
52996+ ret = do_copy_user_subj(userp, role);
52997+
52998+ err = PTR_ERR(ret);
52999+ if (IS_ERR(ret))
53000+ return err;
53001+
53002+ insert_acl_subj_label(ret, role);
53003+
53004+ userp = s_pre.prev;
53005+ }
53006+
53007+ return 0;
53008+}
53009+
53010+static int
53011+copy_user_acl(struct gr_arg *arg)
53012+{
53013+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
53014+ struct sprole_pw *sptmp;
53015+ struct gr_hash_struct *ghash;
53016+ uid_t *domainlist;
53017+ unsigned int r_num;
53018+ unsigned int len;
53019+ char *tmp;
53020+ int err = 0;
53021+ __u16 i;
53022+ __u32 num_subjs;
53023+
53024+ /* we need a default and kernel role */
53025+ if (arg->role_db.num_roles < 2)
53026+ return -EINVAL;
53027+
53028+ /* copy special role authentication info from userspace */
53029+
53030+ num_sprole_pws = arg->num_sprole_pws;
53031+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
53032+
53033+ if (!acl_special_roles) {
53034+ err = -ENOMEM;
53035+ goto cleanup;
53036+ }
53037+
53038+ for (i = 0; i < num_sprole_pws; i++) {
53039+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
53040+ if (!sptmp) {
53041+ err = -ENOMEM;
53042+ goto cleanup;
53043+ }
53044+ if (copy_from_user(sptmp, arg->sprole_pws + i,
53045+ sizeof (struct sprole_pw))) {
53046+ err = -EFAULT;
53047+ goto cleanup;
53048+ }
53049+
53050+ len =
53051+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
53052+
53053+ if (!len || len >= GR_SPROLE_LEN) {
53054+ err = -EINVAL;
53055+ goto cleanup;
53056+ }
53057+
53058+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
53059+ err = -ENOMEM;
53060+ goto cleanup;
53061+ }
53062+
53063+ if (copy_from_user(tmp, sptmp->rolename, len)) {
53064+ err = -EFAULT;
53065+ goto cleanup;
53066+ }
53067+ tmp[len-1] = '\0';
53068+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53069+ printk(KERN_ALERT "Copying special role %s\n", tmp);
53070+#endif
53071+ sptmp->rolename = tmp;
53072+ acl_special_roles[i] = sptmp;
53073+ }
53074+
53075+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
53076+
53077+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
53078+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
53079+
53080+ if (!r_tmp) {
53081+ err = -ENOMEM;
53082+ goto cleanup;
53083+ }
53084+
53085+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
53086+ sizeof (struct acl_role_label *))) {
53087+ err = -EFAULT;
53088+ goto cleanup;
53089+ }
53090+
53091+ if (copy_from_user(r_tmp, r_utmp2,
53092+ sizeof (struct acl_role_label))) {
53093+ err = -EFAULT;
53094+ goto cleanup;
53095+ }
53096+
53097+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
53098+
53099+ if (!len || len >= PATH_MAX) {
53100+ err = -EINVAL;
53101+ goto cleanup;
53102+ }
53103+
53104+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
53105+ err = -ENOMEM;
53106+ goto cleanup;
53107+ }
53108+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
53109+ err = -EFAULT;
53110+ goto cleanup;
53111+ }
53112+ tmp[len-1] = '\0';
53113+ r_tmp->rolename = tmp;
53114+
53115+ if (!strcmp(r_tmp->rolename, "default")
53116+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
53117+ default_role = r_tmp;
53118+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
53119+ kernel_role = r_tmp;
53120+ }
53121+
53122+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
53123+ err = -ENOMEM;
53124+ goto cleanup;
53125+ }
53126+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
53127+ err = -EFAULT;
53128+ goto cleanup;
53129+ }
53130+
53131+ r_tmp->hash = ghash;
53132+
53133+ num_subjs = count_user_subjs(r_tmp->hash->first);
53134+
53135+ r_tmp->subj_hash_size = num_subjs;
53136+ r_tmp->subj_hash =
53137+ (struct acl_subject_label **)
53138+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
53139+
53140+ if (!r_tmp->subj_hash) {
53141+ err = -ENOMEM;
53142+ goto cleanup;
53143+ }
53144+
53145+ err = copy_user_allowedips(r_tmp);
53146+ if (err)
53147+ goto cleanup;
53148+
53149+ /* copy domain info */
53150+ if (r_tmp->domain_children != NULL) {
53151+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
53152+ if (domainlist == NULL) {
53153+ err = -ENOMEM;
53154+ goto cleanup;
53155+ }
53156+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
53157+ err = -EFAULT;
53158+ goto cleanup;
53159+ }
53160+ r_tmp->domain_children = domainlist;
53161+ }
53162+
53163+ err = copy_user_transitions(r_tmp);
53164+ if (err)
53165+ goto cleanup;
53166+
53167+ memset(r_tmp->subj_hash, 0,
53168+ r_tmp->subj_hash_size *
53169+ sizeof (struct acl_subject_label *));
53170+
53171+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
53172+
53173+ if (err)
53174+ goto cleanup;
53175+
53176+ /* set nested subject list to null */
53177+ r_tmp->hash->first = NULL;
53178+
53179+ insert_acl_role_label(r_tmp);
53180+ }
53181+
53182+ goto return_err;
53183+ cleanup:
53184+ free_variables();
53185+ return_err:
53186+ return err;
53187+
53188+}
53189+
53190+static int
53191+gracl_init(struct gr_arg *args)
53192+{
53193+ int error = 0;
53194+
53195+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
53196+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
53197+
53198+ if (init_variables(args)) {
53199+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
53200+ error = -ENOMEM;
53201+ free_variables();
53202+ goto out;
53203+ }
53204+
53205+ error = copy_user_acl(args);
53206+ free_init_variables();
53207+ if (error) {
53208+ free_variables();
53209+ goto out;
53210+ }
53211+
53212+ if ((error = gr_set_acls(0))) {
53213+ free_variables();
53214+ goto out;
53215+ }
53216+
53217+ pax_open_kernel();
53218+ gr_status |= GR_READY;
53219+ pax_close_kernel();
53220+
53221+ out:
53222+ return error;
53223+}
53224+
53225+/* derived from glibc fnmatch() 0: match, 1: no match*/
53226+
53227+static int
53228+glob_match(const char *p, const char *n)
53229+{
53230+ char c;
53231+
53232+ while ((c = *p++) != '\0') {
53233+ switch (c) {
53234+ case '?':
53235+ if (*n == '\0')
53236+ return 1;
53237+ else if (*n == '/')
53238+ return 1;
53239+ break;
53240+ case '\\':
53241+ if (*n != c)
53242+ return 1;
53243+ break;
53244+ case '*':
53245+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
53246+ if (*n == '/')
53247+ return 1;
53248+ else if (c == '?') {
53249+ if (*n == '\0')
53250+ return 1;
53251+ else
53252+ ++n;
53253+ }
53254+ }
53255+ if (c == '\0') {
53256+ return 0;
53257+ } else {
53258+ const char *endp;
53259+
53260+ if ((endp = strchr(n, '/')) == NULL)
53261+ endp = n + strlen(n);
53262+
53263+ if (c == '[') {
53264+ for (--p; n < endp; ++n)
53265+ if (!glob_match(p, n))
53266+ return 0;
53267+ } else if (c == '/') {
53268+ while (*n != '\0' && *n != '/')
53269+ ++n;
53270+ if (*n == '/' && !glob_match(p, n + 1))
53271+ return 0;
53272+ } else {
53273+ for (--p; n < endp; ++n)
53274+ if (*n == c && !glob_match(p, n))
53275+ return 0;
53276+ }
53277+
53278+ return 1;
53279+ }
53280+ case '[':
53281+ {
53282+ int not;
53283+ char cold;
53284+
53285+ if (*n == '\0' || *n == '/')
53286+ return 1;
53287+
53288+ not = (*p == '!' || *p == '^');
53289+ if (not)
53290+ ++p;
53291+
53292+ c = *p++;
53293+ for (;;) {
53294+ unsigned char fn = (unsigned char)*n;
53295+
53296+ if (c == '\0')
53297+ return 1;
53298+ else {
53299+ if (c == fn)
53300+ goto matched;
53301+ cold = c;
53302+ c = *p++;
53303+
53304+ if (c == '-' && *p != ']') {
53305+ unsigned char cend = *p++;
53306+
53307+ if (cend == '\0')
53308+ return 1;
53309+
53310+ if (cold <= fn && fn <= cend)
53311+ goto matched;
53312+
53313+ c = *p++;
53314+ }
53315+ }
53316+
53317+ if (c == ']')
53318+ break;
53319+ }
53320+ if (!not)
53321+ return 1;
53322+ break;
53323+ matched:
53324+ while (c != ']') {
53325+ if (c == '\0')
53326+ return 1;
53327+
53328+ c = *p++;
53329+ }
53330+ if (not)
53331+ return 1;
53332+ }
53333+ break;
53334+ default:
53335+ if (c != *n)
53336+ return 1;
53337+ }
53338+
53339+ ++n;
53340+ }
53341+
53342+ if (*n == '\0')
53343+ return 0;
53344+
53345+ if (*n == '/')
53346+ return 0;
53347+
53348+ return 1;
53349+}
53350+
53351+static struct acl_object_label *
53352+chk_glob_label(struct acl_object_label *globbed,
53353+ struct dentry *dentry, struct vfsmount *mnt, char **path)
53354+{
53355+ struct acl_object_label *tmp;
53356+
53357+ if (*path == NULL)
53358+ *path = gr_to_filename_nolock(dentry, mnt);
53359+
53360+ tmp = globbed;
53361+
53362+ while (tmp) {
53363+ if (!glob_match(tmp->filename, *path))
53364+ return tmp;
53365+ tmp = tmp->next;
53366+ }
53367+
53368+ return NULL;
53369+}
53370+
53371+static struct acl_object_label *
53372+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53373+ const ino_t curr_ino, const dev_t curr_dev,
53374+ const struct acl_subject_label *subj, char **path, const int checkglob)
53375+{
53376+ struct acl_subject_label *tmpsubj;
53377+ struct acl_object_label *retval;
53378+ struct acl_object_label *retval2;
53379+
53380+ tmpsubj = (struct acl_subject_label *) subj;
53381+ read_lock(&gr_inode_lock);
53382+ do {
53383+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
53384+ if (retval) {
53385+ if (checkglob && retval->globbed) {
53386+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
53387+ (struct vfsmount *)orig_mnt, path);
53388+ if (retval2)
53389+ retval = retval2;
53390+ }
53391+ break;
53392+ }
53393+ } while ((tmpsubj = tmpsubj->parent_subject));
53394+ read_unlock(&gr_inode_lock);
53395+
53396+ return retval;
53397+}
53398+
53399+static __inline__ struct acl_object_label *
53400+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53401+ struct dentry *curr_dentry,
53402+ const struct acl_subject_label *subj, char **path, const int checkglob)
53403+{
53404+ int newglob = checkglob;
53405+ ino_t inode;
53406+ dev_t device;
53407+
53408+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
53409+ as we don't want a / * rule to match instead of the / object
53410+ don't do this for create lookups that call this function though, since they're looking up
53411+ on the parent and thus need globbing checks on all paths
53412+ */
53413+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
53414+ newglob = GR_NO_GLOB;
53415+
53416+ spin_lock(&curr_dentry->d_lock);
53417+ inode = curr_dentry->d_inode->i_ino;
53418+ device = __get_dev(curr_dentry);
53419+ spin_unlock(&curr_dentry->d_lock);
53420+
53421+ return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
53422+}
53423+
53424+static struct acl_object_label *
53425+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53426+ const struct acl_subject_label *subj, char *path, const int checkglob)
53427+{
53428+ struct dentry *dentry = (struct dentry *) l_dentry;
53429+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53430+ struct acl_object_label *retval;
53431+ struct dentry *parent;
53432+
53433+ write_seqlock(&rename_lock);
53434+ br_read_lock(vfsmount_lock);
53435+
53436+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
53437+#ifdef CONFIG_NET
53438+ mnt == sock_mnt ||
53439+#endif
53440+#ifdef CONFIG_HUGETLBFS
53441+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
53442+#endif
53443+ /* ignore Eric Biederman */
53444+ IS_PRIVATE(l_dentry->d_inode))) {
53445+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
53446+ goto out;
53447+ }
53448+
53449+ for (;;) {
53450+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53451+ break;
53452+
53453+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53454+ if (mnt->mnt_parent == mnt)
53455+ break;
53456+
53457+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53458+ if (retval != NULL)
53459+ goto out;
53460+
53461+ dentry = mnt->mnt_mountpoint;
53462+ mnt = mnt->mnt_parent;
53463+ continue;
53464+ }
53465+
53466+ parent = dentry->d_parent;
53467+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53468+ if (retval != NULL)
53469+ goto out;
53470+
53471+ dentry = parent;
53472+ }
53473+
53474+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53475+
53476+ /* real_root is pinned so we don't have to hold a reference */
53477+ if (retval == NULL)
53478+ retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
53479+out:
53480+ br_read_unlock(vfsmount_lock);
53481+ write_sequnlock(&rename_lock);
53482+
53483+ BUG_ON(retval == NULL);
53484+
53485+ return retval;
53486+}
53487+
53488+static __inline__ struct acl_object_label *
53489+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53490+ const struct acl_subject_label *subj)
53491+{
53492+ char *path = NULL;
53493+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
53494+}
53495+
53496+static __inline__ struct acl_object_label *
53497+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53498+ const struct acl_subject_label *subj)
53499+{
53500+ char *path = NULL;
53501+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
53502+}
53503+
53504+static __inline__ struct acl_object_label *
53505+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53506+ const struct acl_subject_label *subj, char *path)
53507+{
53508+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
53509+}
53510+
53511+static struct acl_subject_label *
53512+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53513+ const struct acl_role_label *role)
53514+{
53515+ struct dentry *dentry = (struct dentry *) l_dentry;
53516+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53517+ struct acl_subject_label *retval;
53518+ struct dentry *parent;
53519+
53520+ write_seqlock(&rename_lock);
53521+ br_read_lock(vfsmount_lock);
53522+
53523+ for (;;) {
53524+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53525+ break;
53526+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53527+ if (mnt->mnt_parent == mnt)
53528+ break;
53529+
53530+ spin_lock(&dentry->d_lock);
53531+ read_lock(&gr_inode_lock);
53532+ retval =
53533+ lookup_acl_subj_label(dentry->d_inode->i_ino,
53534+ __get_dev(dentry), role);
53535+ read_unlock(&gr_inode_lock);
53536+ spin_unlock(&dentry->d_lock);
53537+ if (retval != NULL)
53538+ goto out;
53539+
53540+ dentry = mnt->mnt_mountpoint;
53541+ mnt = mnt->mnt_parent;
53542+ continue;
53543+ }
53544+
53545+ spin_lock(&dentry->d_lock);
53546+ read_lock(&gr_inode_lock);
53547+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53548+ __get_dev(dentry), role);
53549+ read_unlock(&gr_inode_lock);
53550+ parent = dentry->d_parent;
53551+ spin_unlock(&dentry->d_lock);
53552+
53553+ if (retval != NULL)
53554+ goto out;
53555+
53556+ dentry = parent;
53557+ }
53558+
53559+ spin_lock(&dentry->d_lock);
53560+ read_lock(&gr_inode_lock);
53561+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53562+ __get_dev(dentry), role);
53563+ read_unlock(&gr_inode_lock);
53564+ spin_unlock(&dentry->d_lock);
53565+
53566+ if (unlikely(retval == NULL)) {
53567+ /* real_root is pinned, we don't need to hold a reference */
53568+ read_lock(&gr_inode_lock);
53569+ retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
53570+ __get_dev(real_root.dentry), role);
53571+ read_unlock(&gr_inode_lock);
53572+ }
53573+out:
53574+ br_read_unlock(vfsmount_lock);
53575+ write_sequnlock(&rename_lock);
53576+
53577+ BUG_ON(retval == NULL);
53578+
53579+ return retval;
53580+}
53581+
53582+static void
53583+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
53584+{
53585+ struct task_struct *task = current;
53586+ const struct cred *cred = current_cred();
53587+
53588+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53589+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53590+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53591+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
53592+
53593+ return;
53594+}
53595+
53596+static void
53597+gr_log_learn_sysctl(const char *path, const __u32 mode)
53598+{
53599+ struct task_struct *task = current;
53600+ const struct cred *cred = current_cred();
53601+
53602+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53603+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53604+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53605+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
53606+
53607+ return;
53608+}
53609+
53610+static void
53611+gr_log_learn_id_change(const char type, const unsigned int real,
53612+ const unsigned int effective, const unsigned int fs)
53613+{
53614+ struct task_struct *task = current;
53615+ const struct cred *cred = current_cred();
53616+
53617+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
53618+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53619+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53620+ type, real, effective, fs, &task->signal->saved_ip);
53621+
53622+ return;
53623+}
53624+
53625+__u32
53626+gr_check_link(const struct dentry * new_dentry,
53627+ const struct dentry * parent_dentry,
53628+ const struct vfsmount * parent_mnt,
53629+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
53630+{
53631+ struct acl_object_label *obj;
53632+ __u32 oldmode, newmode;
53633+ __u32 needmode;
53634+
53635+ if (unlikely(!(gr_status & GR_READY)))
53636+ return (GR_CREATE | GR_LINK);
53637+
53638+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
53639+ oldmode = obj->mode;
53640+
53641+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53642+ oldmode |= (GR_CREATE | GR_LINK);
53643+
53644+ needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
53645+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53646+ needmode |= GR_SETID | GR_AUDIT_SETID;
53647+
53648+ newmode =
53649+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
53650+ oldmode | needmode);
53651+
53652+ needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
53653+ GR_SETID | GR_READ | GR_FIND | GR_DELETE |
53654+ GR_INHERIT | GR_AUDIT_INHERIT);
53655+
53656+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
53657+ goto bad;
53658+
53659+ if ((oldmode & needmode) != needmode)
53660+ goto bad;
53661+
53662+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
53663+ if ((newmode & needmode) != needmode)
53664+ goto bad;
53665+
53666+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
53667+ return newmode;
53668+bad:
53669+ needmode = oldmode;
53670+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53671+ needmode |= GR_SETID;
53672+
53673+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53674+ gr_log_learn(old_dentry, old_mnt, needmode);
53675+ return (GR_CREATE | GR_LINK);
53676+ } else if (newmode & GR_SUPPRESS)
53677+ return GR_SUPPRESS;
53678+ else
53679+ return 0;
53680+}
53681+
53682+__u32
53683+gr_search_file(const struct dentry * dentry, const __u32 mode,
53684+ const struct vfsmount * mnt)
53685+{
53686+ __u32 retval = mode;
53687+ struct acl_subject_label *curracl;
53688+ struct acl_object_label *currobj;
53689+
53690+ if (unlikely(!(gr_status & GR_READY)))
53691+ return (mode & ~GR_AUDITS);
53692+
53693+ curracl = current->acl;
53694+
53695+ currobj = chk_obj_label(dentry, mnt, curracl);
53696+ retval = currobj->mode & mode;
53697+
53698+ /* if we're opening a specified transfer file for writing
53699+ (e.g. /dev/initctl), then transfer our role to init
53700+ */
53701+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
53702+ current->role->roletype & GR_ROLE_PERSIST)) {
53703+ struct task_struct *task = init_pid_ns.child_reaper;
53704+
53705+ if (task->role != current->role) {
53706+ task->acl_sp_role = 0;
53707+ task->acl_role_id = current->acl_role_id;
53708+ task->role = current->role;
53709+ rcu_read_lock();
53710+ read_lock(&grsec_exec_file_lock);
53711+ gr_apply_subject_to_task(task);
53712+ read_unlock(&grsec_exec_file_lock);
53713+ rcu_read_unlock();
53714+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
53715+ }
53716+ }
53717+
53718+ if (unlikely
53719+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
53720+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
53721+ __u32 new_mode = mode;
53722+
53723+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53724+
53725+ retval = new_mode;
53726+
53727+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
53728+ new_mode |= GR_INHERIT;
53729+
53730+ if (!(mode & GR_NOLEARN))
53731+ gr_log_learn(dentry, mnt, new_mode);
53732+ }
53733+
53734+ return retval;
53735+}
53736+
53737+__u32
53738+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
53739+ const struct vfsmount * mnt, const __u32 mode)
53740+{
53741+ struct name_entry *match;
53742+ struct acl_object_label *matchpo;
53743+ struct acl_subject_label *curracl;
53744+ char *path;
53745+ __u32 retval;
53746+
53747+ if (unlikely(!(gr_status & GR_READY)))
53748+ return (mode & ~GR_AUDITS);
53749+
53750+ preempt_disable();
53751+ path = gr_to_filename_rbac(new_dentry, mnt);
53752+ match = lookup_name_entry_create(path);
53753+
53754+ if (!match)
53755+ goto check_parent;
53756+
53757+ curracl = current->acl;
53758+
53759+ read_lock(&gr_inode_lock);
53760+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
53761+ read_unlock(&gr_inode_lock);
53762+
53763+ if (matchpo) {
53764+ if ((matchpo->mode & mode) !=
53765+ (mode & ~(GR_AUDITS | GR_SUPPRESS))
53766+ && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53767+ __u32 new_mode = mode;
53768+
53769+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53770+
53771+ gr_log_learn(new_dentry, mnt, new_mode);
53772+
53773+ preempt_enable();
53774+ return new_mode;
53775+ }
53776+ preempt_enable();
53777+ return (matchpo->mode & mode);
53778+ }
53779+
53780+ check_parent:
53781+ curracl = current->acl;
53782+
53783+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
53784+ retval = matchpo->mode & mode;
53785+
53786+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
53787+ && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53788+ __u32 new_mode = mode;
53789+
53790+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53791+
53792+ gr_log_learn(new_dentry, mnt, new_mode);
53793+ preempt_enable();
53794+ return new_mode;
53795+ }
53796+
53797+ preempt_enable();
53798+ return retval;
53799+}
53800+
53801+int
53802+gr_check_hidden_task(const struct task_struct *task)
53803+{
53804+ if (unlikely(!(gr_status & GR_READY)))
53805+ return 0;
53806+
53807+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
53808+ return 1;
53809+
53810+ return 0;
53811+}
53812+
53813+int
53814+gr_check_protected_task(const struct task_struct *task)
53815+{
53816+ if (unlikely(!(gr_status & GR_READY) || !task))
53817+ return 0;
53818+
53819+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53820+ task->acl != current->acl)
53821+ return 1;
53822+
53823+ return 0;
53824+}
53825+
53826+int
53827+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53828+{
53829+ struct task_struct *p;
53830+ int ret = 0;
53831+
53832+ if (unlikely(!(gr_status & GR_READY) || !pid))
53833+ return ret;
53834+
53835+ read_lock(&tasklist_lock);
53836+ do_each_pid_task(pid, type, p) {
53837+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53838+ p->acl != current->acl) {
53839+ ret = 1;
53840+ goto out;
53841+ }
53842+ } while_each_pid_task(pid, type, p);
53843+out:
53844+ read_unlock(&tasklist_lock);
53845+
53846+ return ret;
53847+}
53848+
53849+void
53850+gr_copy_label(struct task_struct *tsk)
53851+{
53852+ tsk->signal->used_accept = 0;
53853+ tsk->acl_sp_role = 0;
53854+ tsk->acl_role_id = current->acl_role_id;
53855+ tsk->acl = current->acl;
53856+ tsk->role = current->role;
53857+ tsk->signal->curr_ip = current->signal->curr_ip;
53858+ tsk->signal->saved_ip = current->signal->saved_ip;
53859+ if (current->exec_file)
53860+ get_file(current->exec_file);
53861+ tsk->exec_file = current->exec_file;
53862+ tsk->is_writable = current->is_writable;
53863+ if (unlikely(current->signal->used_accept)) {
53864+ current->signal->curr_ip = 0;
53865+ current->signal->saved_ip = 0;
53866+ }
53867+
53868+ return;
53869+}
53870+
53871+static void
53872+gr_set_proc_res(struct task_struct *task)
53873+{
53874+ struct acl_subject_label *proc;
53875+ unsigned short i;
53876+
53877+ proc = task->acl;
53878+
53879+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53880+ return;
53881+
53882+ for (i = 0; i < RLIM_NLIMITS; i++) {
53883+ if (!(proc->resmask & (1 << i)))
53884+ continue;
53885+
53886+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53887+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53888+ }
53889+
53890+ return;
53891+}
53892+
53893+extern int __gr_process_user_ban(struct user_struct *user);
53894+
53895+int
53896+gr_check_user_change(int real, int effective, int fs)
53897+{
53898+ unsigned int i;
53899+ __u16 num;
53900+ uid_t *uidlist;
53901+ int curuid;
53902+ int realok = 0;
53903+ int effectiveok = 0;
53904+ int fsok = 0;
53905+
53906+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53907+ struct user_struct *user;
53908+
53909+ if (real == -1)
53910+ goto skipit;
53911+
53912+ user = find_user(real);
53913+ if (user == NULL)
53914+ goto skipit;
53915+
53916+ if (__gr_process_user_ban(user)) {
53917+ /* for find_user */
53918+ free_uid(user);
53919+ return 1;
53920+ }
53921+
53922+ /* for find_user */
53923+ free_uid(user);
53924+
53925+skipit:
53926+#endif
53927+
53928+ if (unlikely(!(gr_status & GR_READY)))
53929+ return 0;
53930+
53931+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53932+ gr_log_learn_id_change('u', real, effective, fs);
53933+
53934+ num = current->acl->user_trans_num;
53935+ uidlist = current->acl->user_transitions;
53936+
53937+ if (uidlist == NULL)
53938+ return 0;
53939+
53940+ if (real == -1)
53941+ realok = 1;
53942+ if (effective == -1)
53943+ effectiveok = 1;
53944+ if (fs == -1)
53945+ fsok = 1;
53946+
53947+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
53948+ for (i = 0; i < num; i++) {
53949+ curuid = (int)uidlist[i];
53950+ if (real == curuid)
53951+ realok = 1;
53952+ if (effective == curuid)
53953+ effectiveok = 1;
53954+ if (fs == curuid)
53955+ fsok = 1;
53956+ }
53957+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
53958+ for (i = 0; i < num; i++) {
53959+ curuid = (int)uidlist[i];
53960+ if (real == curuid)
53961+ break;
53962+ if (effective == curuid)
53963+ break;
53964+ if (fs == curuid)
53965+ break;
53966+ }
53967+ /* not in deny list */
53968+ if (i == num) {
53969+ realok = 1;
53970+ effectiveok = 1;
53971+ fsok = 1;
53972+ }
53973+ }
53974+
53975+ if (realok && effectiveok && fsok)
53976+ return 0;
53977+ else {
53978+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53979+ return 1;
53980+ }
53981+}
53982+
53983+int
53984+gr_check_group_change(int real, int effective, int fs)
53985+{
53986+ unsigned int i;
53987+ __u16 num;
53988+ gid_t *gidlist;
53989+ int curgid;
53990+ int realok = 0;
53991+ int effectiveok = 0;
53992+ int fsok = 0;
53993+
53994+ if (unlikely(!(gr_status & GR_READY)))
53995+ return 0;
53996+
53997+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53998+ gr_log_learn_id_change('g', real, effective, fs);
53999+
54000+ num = current->acl->group_trans_num;
54001+ gidlist = current->acl->group_transitions;
54002+
54003+ if (gidlist == NULL)
54004+ return 0;
54005+
54006+ if (real == -1)
54007+ realok = 1;
54008+ if (effective == -1)
54009+ effectiveok = 1;
54010+ if (fs == -1)
54011+ fsok = 1;
54012+
54013+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
54014+ for (i = 0; i < num; i++) {
54015+ curgid = (int)gidlist[i];
54016+ if (real == curgid)
54017+ realok = 1;
54018+ if (effective == curgid)
54019+ effectiveok = 1;
54020+ if (fs == curgid)
54021+ fsok = 1;
54022+ }
54023+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
54024+ for (i = 0; i < num; i++) {
54025+ curgid = (int)gidlist[i];
54026+ if (real == curgid)
54027+ break;
54028+ if (effective == curgid)
54029+ break;
54030+ if (fs == curgid)
54031+ break;
54032+ }
54033+ /* not in deny list */
54034+ if (i == num) {
54035+ realok = 1;
54036+ effectiveok = 1;
54037+ fsok = 1;
54038+ }
54039+ }
54040+
54041+ if (realok && effectiveok && fsok)
54042+ return 0;
54043+ else {
54044+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
54045+ return 1;
54046+ }
54047+}
54048+
54049+void
54050+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
54051+{
54052+ struct acl_role_label *role = task->role;
54053+ struct acl_subject_label *subj = NULL;
54054+ struct acl_object_label *obj;
54055+ struct file *filp;
54056+
54057+ if (unlikely(!(gr_status & GR_READY)))
54058+ return;
54059+
54060+ filp = task->exec_file;
54061+
54062+ /* kernel process, we'll give them the kernel role */
54063+ if (unlikely(!filp)) {
54064+ task->role = kernel_role;
54065+ task->acl = kernel_role->root_label;
54066+ return;
54067+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
54068+ role = lookup_acl_role_label(task, uid, gid);
54069+
54070+ /* perform subject lookup in possibly new role
54071+ we can use this result below in the case where role == task->role
54072+ */
54073+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
54074+
54075+ /* if we changed uid/gid, but result in the same role
54076+ and are using inheritance, don't lose the inherited subject
54077+ if current subject is other than what normal lookup
54078+ would result in, we arrived via inheritance, don't
54079+ lose subject
54080+ */
54081+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
54082+ (subj == task->acl)))
54083+ task->acl = subj;
54084+
54085+ task->role = role;
54086+
54087+ task->is_writable = 0;
54088+
54089+ /* ignore additional mmap checks for processes that are writable
54090+ by the default ACL */
54091+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54092+ if (unlikely(obj->mode & GR_WRITE))
54093+ task->is_writable = 1;
54094+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54095+ if (unlikely(obj->mode & GR_WRITE))
54096+ task->is_writable = 1;
54097+
54098+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54099+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54100+#endif
54101+
54102+ gr_set_proc_res(task);
54103+
54104+ return;
54105+}
54106+
54107+int
54108+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
54109+ const int unsafe_share)
54110+{
54111+ struct task_struct *task = current;
54112+ struct acl_subject_label *newacl;
54113+ struct acl_object_label *obj;
54114+ __u32 retmode;
54115+
54116+ if (unlikely(!(gr_status & GR_READY)))
54117+ return 0;
54118+
54119+ newacl = chk_subj_label(dentry, mnt, task->role);
54120+
54121+ task_lock(task);
54122+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
54123+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
54124+ !(task->role->roletype & GR_ROLE_GOD) &&
54125+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
54126+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
54127+ task_unlock(task);
54128+ if (unsafe_share)
54129+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
54130+ else
54131+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
54132+ return -EACCES;
54133+ }
54134+ task_unlock(task);
54135+
54136+ obj = chk_obj_label(dentry, mnt, task->acl);
54137+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
54138+
54139+ if (!(task->acl->mode & GR_INHERITLEARN) &&
54140+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
54141+ if (obj->nested)
54142+ task->acl = obj->nested;
54143+ else
54144+ task->acl = newacl;
54145+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
54146+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
54147+
54148+ task->is_writable = 0;
54149+
54150+ /* ignore additional mmap checks for processes that are writable
54151+ by the default ACL */
54152+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
54153+ if (unlikely(obj->mode & GR_WRITE))
54154+ task->is_writable = 1;
54155+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
54156+ if (unlikely(obj->mode & GR_WRITE))
54157+ task->is_writable = 1;
54158+
54159+ gr_set_proc_res(task);
54160+
54161+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54162+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54163+#endif
54164+ return 0;
54165+}
54166+
54167+/* always called with valid inodev ptr */
54168+static void
54169+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
54170+{
54171+ struct acl_object_label *matchpo;
54172+ struct acl_subject_label *matchps;
54173+ struct acl_subject_label *subj;
54174+ struct acl_role_label *role;
54175+ unsigned int x;
54176+
54177+ FOR_EACH_ROLE_START(role)
54178+ FOR_EACH_SUBJECT_START(role, subj, x)
54179+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
54180+ matchpo->mode |= GR_DELETED;
54181+ FOR_EACH_SUBJECT_END(subj,x)
54182+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
54183+ if (subj->inode == ino && subj->device == dev)
54184+ subj->mode |= GR_DELETED;
54185+ FOR_EACH_NESTED_SUBJECT_END(subj)
54186+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
54187+ matchps->mode |= GR_DELETED;
54188+ FOR_EACH_ROLE_END(role)
54189+
54190+ inodev->nentry->deleted = 1;
54191+
54192+ return;
54193+}
54194+
54195+void
54196+gr_handle_delete(const ino_t ino, const dev_t dev)
54197+{
54198+ struct inodev_entry *inodev;
54199+
54200+ if (unlikely(!(gr_status & GR_READY)))
54201+ return;
54202+
54203+ write_lock(&gr_inode_lock);
54204+ inodev = lookup_inodev_entry(ino, dev);
54205+ if (inodev != NULL)
54206+ do_handle_delete(inodev, ino, dev);
54207+ write_unlock(&gr_inode_lock);
54208+
54209+ return;
54210+}
54211+
54212+static void
54213+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
54214+ const ino_t newinode, const dev_t newdevice,
54215+ struct acl_subject_label *subj)
54216+{
54217+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
54218+ struct acl_object_label *match;
54219+
54220+ match = subj->obj_hash[index];
54221+
54222+ while (match && (match->inode != oldinode ||
54223+ match->device != olddevice ||
54224+ !(match->mode & GR_DELETED)))
54225+ match = match->next;
54226+
54227+ if (match && (match->inode == oldinode)
54228+ && (match->device == olddevice)
54229+ && (match->mode & GR_DELETED)) {
54230+ if (match->prev == NULL) {
54231+ subj->obj_hash[index] = match->next;
54232+ if (match->next != NULL)
54233+ match->next->prev = NULL;
54234+ } else {
54235+ match->prev->next = match->next;
54236+ if (match->next != NULL)
54237+ match->next->prev = match->prev;
54238+ }
54239+ match->prev = NULL;
54240+ match->next = NULL;
54241+ match->inode = newinode;
54242+ match->device = newdevice;
54243+ match->mode &= ~GR_DELETED;
54244+
54245+ insert_acl_obj_label(match, subj);
54246+ }
54247+
54248+ return;
54249+}
54250+
54251+static void
54252+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
54253+ const ino_t newinode, const dev_t newdevice,
54254+ struct acl_role_label *role)
54255+{
54256+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
54257+ struct acl_subject_label *match;
54258+
54259+ match = role->subj_hash[index];
54260+
54261+ while (match && (match->inode != oldinode ||
54262+ match->device != olddevice ||
54263+ !(match->mode & GR_DELETED)))
54264+ match = match->next;
54265+
54266+ if (match && (match->inode == oldinode)
54267+ && (match->device == olddevice)
54268+ && (match->mode & GR_DELETED)) {
54269+ if (match->prev == NULL) {
54270+ role->subj_hash[index] = match->next;
54271+ if (match->next != NULL)
54272+ match->next->prev = NULL;
54273+ } else {
54274+ match->prev->next = match->next;
54275+ if (match->next != NULL)
54276+ match->next->prev = match->prev;
54277+ }
54278+ match->prev = NULL;
54279+ match->next = NULL;
54280+ match->inode = newinode;
54281+ match->device = newdevice;
54282+ match->mode &= ~GR_DELETED;
54283+
54284+ insert_acl_subj_label(match, role);
54285+ }
54286+
54287+ return;
54288+}
54289+
54290+static void
54291+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
54292+ const ino_t newinode, const dev_t newdevice)
54293+{
54294+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
54295+ struct inodev_entry *match;
54296+
54297+ match = inodev_set.i_hash[index];
54298+
54299+ while (match && (match->nentry->inode != oldinode ||
54300+ match->nentry->device != olddevice || !match->nentry->deleted))
54301+ match = match->next;
54302+
54303+ if (match && (match->nentry->inode == oldinode)
54304+ && (match->nentry->device == olddevice) &&
54305+ match->nentry->deleted) {
54306+ if (match->prev == NULL) {
54307+ inodev_set.i_hash[index] = match->next;
54308+ if (match->next != NULL)
54309+ match->next->prev = NULL;
54310+ } else {
54311+ match->prev->next = match->next;
54312+ if (match->next != NULL)
54313+ match->next->prev = match->prev;
54314+ }
54315+ match->prev = NULL;
54316+ match->next = NULL;
54317+ match->nentry->inode = newinode;
54318+ match->nentry->device = newdevice;
54319+ match->nentry->deleted = 0;
54320+
54321+ insert_inodev_entry(match);
54322+ }
54323+
54324+ return;
54325+}
54326+
54327+static void
54328+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
54329+ const struct vfsmount *mnt)
54330+{
54331+ struct acl_subject_label *subj;
54332+ struct acl_role_label *role;
54333+ unsigned int x;
54334+ ino_t ino = dentry->d_inode->i_ino;
54335+ dev_t dev = __get_dev(dentry);
54336+
54337+ FOR_EACH_ROLE_START(role)
54338+ update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
54339+
54340+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
54341+ if ((subj->inode == ino) && (subj->device == dev)) {
54342+ subj->inode = ino;
54343+ subj->device = dev;
54344+ }
54345+ FOR_EACH_NESTED_SUBJECT_END(subj)
54346+ FOR_EACH_SUBJECT_START(role, subj, x)
54347+ update_acl_obj_label(matchn->inode, matchn->device,
54348+ ino, dev, subj);
54349+ FOR_EACH_SUBJECT_END(subj,x)
54350+ FOR_EACH_ROLE_END(role)
54351+
54352+ update_inodev_entry(matchn->inode, matchn->device, ino, dev);
54353+
54354+ return;
54355+}
54356+
54357+void
54358+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
54359+{
54360+ struct name_entry *matchn;
54361+
54362+ if (unlikely(!(gr_status & GR_READY)))
54363+ return;
54364+
54365+ preempt_disable();
54366+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
54367+
54368+ if (unlikely((unsigned long)matchn)) {
54369+ write_lock(&gr_inode_lock);
54370+ do_handle_create(matchn, dentry, mnt);
54371+ write_unlock(&gr_inode_lock);
54372+ }
54373+ preempt_enable();
54374+
54375+ return;
54376+}
54377+
54378+void
54379+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
54380+ struct dentry *old_dentry,
54381+ struct dentry *new_dentry,
54382+ struct vfsmount *mnt, const __u8 replace)
54383+{
54384+ struct name_entry *matchn;
54385+ struct inodev_entry *inodev;
54386+ ino_t old_ino = old_dentry->d_inode->i_ino;
54387+ dev_t old_dev = __get_dev(old_dentry);
54388+
54389+ /* vfs_rename swaps the name and parent link for old_dentry and
54390+ new_dentry
54391+ at this point, old_dentry has the new name, parent link, and inode
54392+ for the renamed file
54393+ if a file is being replaced by a rename, new_dentry has the inode
54394+ and name for the replaced file
54395+ */
54396+
54397+ if (unlikely(!(gr_status & GR_READY)))
54398+ return;
54399+
54400+ preempt_disable();
54401+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
54402+
54403+ /* we wouldn't have to check d_inode if it weren't for
54404+ NFS silly-renaming
54405+ */
54406+
54407+ write_lock(&gr_inode_lock);
54408+ if (unlikely(replace && new_dentry->d_inode)) {
54409+ ino_t new_ino = new_dentry->d_inode->i_ino;
54410+ dev_t new_dev = __get_dev(new_dentry);
54411+
54412+ inodev = lookup_inodev_entry(new_ino, new_dev);
54413+ if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
54414+ do_handle_delete(inodev, new_ino, new_dev);
54415+ }
54416+
54417+ inodev = lookup_inodev_entry(old_ino, old_dev);
54418+ if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
54419+ do_handle_delete(inodev, old_ino, old_dev);
54420+
54421+ if (unlikely((unsigned long)matchn))
54422+ do_handle_create(matchn, old_dentry, mnt);
54423+
54424+ write_unlock(&gr_inode_lock);
54425+ preempt_enable();
54426+
54427+ return;
54428+}
54429+
54430+static int
54431+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
54432+ unsigned char **sum)
54433+{
54434+ struct acl_role_label *r;
54435+ struct role_allowed_ip *ipp;
54436+ struct role_transition *trans;
54437+ unsigned int i;
54438+ int found = 0;
54439+ u32 curr_ip = current->signal->curr_ip;
54440+
54441+ current->signal->saved_ip = curr_ip;
54442+
54443+ /* check transition table */
54444+
54445+ for (trans = current->role->transitions; trans; trans = trans->next) {
54446+ if (!strcmp(rolename, trans->rolename)) {
54447+ found = 1;
54448+ break;
54449+ }
54450+ }
54451+
54452+ if (!found)
54453+ return 0;
54454+
54455+ /* handle special roles that do not require authentication
54456+ and check ip */
54457+
54458+ FOR_EACH_ROLE_START(r)
54459+ if (!strcmp(rolename, r->rolename) &&
54460+ (r->roletype & GR_ROLE_SPECIAL)) {
54461+ found = 0;
54462+ if (r->allowed_ips != NULL) {
54463+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
54464+ if ((ntohl(curr_ip) & ipp->netmask) ==
54465+ (ntohl(ipp->addr) & ipp->netmask))
54466+ found = 1;
54467+ }
54468+ } else
54469+ found = 2;
54470+ if (!found)
54471+ return 0;
54472+
54473+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
54474+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
54475+ *salt = NULL;
54476+ *sum = NULL;
54477+ return 1;
54478+ }
54479+ }
54480+ FOR_EACH_ROLE_END(r)
54481+
54482+ for (i = 0; i < num_sprole_pws; i++) {
54483+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
54484+ *salt = acl_special_roles[i]->salt;
54485+ *sum = acl_special_roles[i]->sum;
54486+ return 1;
54487+ }
54488+ }
54489+
54490+ return 0;
54491+}
54492+
54493+static void
54494+assign_special_role(char *rolename)
54495+{
54496+ struct acl_object_label *obj;
54497+ struct acl_role_label *r;
54498+ struct acl_role_label *assigned = NULL;
54499+ struct task_struct *tsk;
54500+ struct file *filp;
54501+
54502+ FOR_EACH_ROLE_START(r)
54503+ if (!strcmp(rolename, r->rolename) &&
54504+ (r->roletype & GR_ROLE_SPECIAL)) {
54505+ assigned = r;
54506+ break;
54507+ }
54508+ FOR_EACH_ROLE_END(r)
54509+
54510+ if (!assigned)
54511+ return;
54512+
54513+ read_lock(&tasklist_lock);
54514+ read_lock(&grsec_exec_file_lock);
54515+
54516+ tsk = current->real_parent;
54517+ if (tsk == NULL)
54518+ goto out_unlock;
54519+
54520+ filp = tsk->exec_file;
54521+ if (filp == NULL)
54522+ goto out_unlock;
54523+
54524+ tsk->is_writable = 0;
54525+
54526+ tsk->acl_sp_role = 1;
54527+ tsk->acl_role_id = ++acl_sp_role_value;
54528+ tsk->role = assigned;
54529+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
54530+
54531+ /* ignore additional mmap checks for processes that are writable
54532+ by the default ACL */
54533+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54534+ if (unlikely(obj->mode & GR_WRITE))
54535+ tsk->is_writable = 1;
54536+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
54537+ if (unlikely(obj->mode & GR_WRITE))
54538+ tsk->is_writable = 1;
54539+
54540+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54541+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
54542+#endif
54543+
54544+out_unlock:
54545+ read_unlock(&grsec_exec_file_lock);
54546+ read_unlock(&tasklist_lock);
54547+ return;
54548+}
54549+
54550+int gr_check_secure_terminal(struct task_struct *task)
54551+{
54552+ struct task_struct *p, *p2, *p3;
54553+ struct files_struct *files;
54554+ struct fdtable *fdt;
54555+ struct file *our_file = NULL, *file;
54556+ int i;
54557+
54558+ if (task->signal->tty == NULL)
54559+ return 1;
54560+
54561+ files = get_files_struct(task);
54562+ if (files != NULL) {
54563+ rcu_read_lock();
54564+ fdt = files_fdtable(files);
54565+ for (i=0; i < fdt->max_fds; i++) {
54566+ file = fcheck_files(files, i);
54567+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
54568+ get_file(file);
54569+ our_file = file;
54570+ }
54571+ }
54572+ rcu_read_unlock();
54573+ put_files_struct(files);
54574+ }
54575+
54576+ if (our_file == NULL)
54577+ return 1;
54578+
54579+ read_lock(&tasklist_lock);
54580+ do_each_thread(p2, p) {
54581+ files = get_files_struct(p);
54582+ if (files == NULL ||
54583+ (p->signal && p->signal->tty == task->signal->tty)) {
54584+ if (files != NULL)
54585+ put_files_struct(files);
54586+ continue;
54587+ }
54588+ rcu_read_lock();
54589+ fdt = files_fdtable(files);
54590+ for (i=0; i < fdt->max_fds; i++) {
54591+ file = fcheck_files(files, i);
54592+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
54593+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
54594+ p3 = task;
54595+ while (p3->pid > 0) {
54596+ if (p3 == p)
54597+ break;
54598+ p3 = p3->real_parent;
54599+ }
54600+ if (p3 == p)
54601+ break;
54602+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
54603+ gr_handle_alertkill(p);
54604+ rcu_read_unlock();
54605+ put_files_struct(files);
54606+ read_unlock(&tasklist_lock);
54607+ fput(our_file);
54608+ return 0;
54609+ }
54610+ }
54611+ rcu_read_unlock();
54612+ put_files_struct(files);
54613+ } while_each_thread(p2, p);
54614+ read_unlock(&tasklist_lock);
54615+
54616+ fput(our_file);
54617+ return 1;
54618+}
54619+
54620+ssize_t
54621+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
54622+{
54623+ struct gr_arg_wrapper uwrap;
54624+ unsigned char *sprole_salt = NULL;
54625+ unsigned char *sprole_sum = NULL;
54626+ int error = sizeof (struct gr_arg_wrapper);
54627+ int error2 = 0;
54628+
54629+ mutex_lock(&gr_dev_mutex);
54630+
54631+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
54632+ error = -EPERM;
54633+ goto out;
54634+ }
54635+
54636+ if (count != sizeof (struct gr_arg_wrapper)) {
54637+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
54638+ error = -EINVAL;
54639+ goto out;
54640+ }
54641+
54642+
54643+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
54644+ gr_auth_expires = 0;
54645+ gr_auth_attempts = 0;
54646+ }
54647+
54648+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
54649+ error = -EFAULT;
54650+ goto out;
54651+ }
54652+
54653+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
54654+ error = -EINVAL;
54655+ goto out;
54656+ }
54657+
54658+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
54659+ error = -EFAULT;
54660+ goto out;
54661+ }
54662+
54663+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54664+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54665+ time_after(gr_auth_expires, get_seconds())) {
54666+ error = -EBUSY;
54667+ goto out;
54668+ }
54669+
54670+ /* if non-root trying to do anything other than use a special role,
54671+ do not attempt authentication, do not count towards authentication
54672+ locking
54673+ */
54674+
54675+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
54676+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54677+ current_uid()) {
54678+ error = -EPERM;
54679+ goto out;
54680+ }
54681+
54682+ /* ensure pw and special role name are null terminated */
54683+
54684+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
54685+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
54686+
54687+ /* Okay.
54688+ * We have our enough of the argument structure..(we have yet
54689+ * to copy_from_user the tables themselves) . Copy the tables
54690+ * only if we need them, i.e. for loading operations. */
54691+
54692+ switch (gr_usermode->mode) {
54693+ case GR_STATUS:
54694+ if (gr_status & GR_READY) {
54695+ error = 1;
54696+ if (!gr_check_secure_terminal(current))
54697+ error = 3;
54698+ } else
54699+ error = 2;
54700+ goto out;
54701+ case GR_SHUTDOWN:
54702+ if ((gr_status & GR_READY)
54703+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54704+ pax_open_kernel();
54705+ gr_status &= ~GR_READY;
54706+ pax_close_kernel();
54707+
54708+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
54709+ free_variables();
54710+ memset(gr_usermode, 0, sizeof (struct gr_arg));
54711+ memset(gr_system_salt, 0, GR_SALT_LEN);
54712+ memset(gr_system_sum, 0, GR_SHA_LEN);
54713+ } else if (gr_status & GR_READY) {
54714+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
54715+ error = -EPERM;
54716+ } else {
54717+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
54718+ error = -EAGAIN;
54719+ }
54720+ break;
54721+ case GR_ENABLE:
54722+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
54723+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
54724+ else {
54725+ if (gr_status & GR_READY)
54726+ error = -EAGAIN;
54727+ else
54728+ error = error2;
54729+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
54730+ }
54731+ break;
54732+ case GR_RELOAD:
54733+ if (!(gr_status & GR_READY)) {
54734+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
54735+ error = -EAGAIN;
54736+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54737+ preempt_disable();
54738+
54739+ pax_open_kernel();
54740+ gr_status &= ~GR_READY;
54741+ pax_close_kernel();
54742+
54743+ free_variables();
54744+ if (!(error2 = gracl_init(gr_usermode))) {
54745+ preempt_enable();
54746+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
54747+ } else {
54748+ preempt_enable();
54749+ error = error2;
54750+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54751+ }
54752+ } else {
54753+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54754+ error = -EPERM;
54755+ }
54756+ break;
54757+ case GR_SEGVMOD:
54758+ if (unlikely(!(gr_status & GR_READY))) {
54759+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
54760+ error = -EAGAIN;
54761+ break;
54762+ }
54763+
54764+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54765+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
54766+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
54767+ struct acl_subject_label *segvacl;
54768+ segvacl =
54769+ lookup_acl_subj_label(gr_usermode->segv_inode,
54770+ gr_usermode->segv_device,
54771+ current->role);
54772+ if (segvacl) {
54773+ segvacl->crashes = 0;
54774+ segvacl->expires = 0;
54775+ }
54776+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
54777+ gr_remove_uid(gr_usermode->segv_uid);
54778+ }
54779+ } else {
54780+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
54781+ error = -EPERM;
54782+ }
54783+ break;
54784+ case GR_SPROLE:
54785+ case GR_SPROLEPAM:
54786+ if (unlikely(!(gr_status & GR_READY))) {
54787+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
54788+ error = -EAGAIN;
54789+ break;
54790+ }
54791+
54792+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
54793+ current->role->expires = 0;
54794+ current->role->auth_attempts = 0;
54795+ }
54796+
54797+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54798+ time_after(current->role->expires, get_seconds())) {
54799+ error = -EBUSY;
54800+ goto out;
54801+ }
54802+
54803+ if (lookup_special_role_auth
54804+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
54805+ && ((!sprole_salt && !sprole_sum)
54806+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
54807+ char *p = "";
54808+ assign_special_role(gr_usermode->sp_role);
54809+ read_lock(&tasklist_lock);
54810+ if (current->real_parent)
54811+ p = current->real_parent->role->rolename;
54812+ read_unlock(&tasklist_lock);
54813+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
54814+ p, acl_sp_role_value);
54815+ } else {
54816+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
54817+ error = -EPERM;
54818+ if(!(current->role->auth_attempts++))
54819+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54820+
54821+ goto out;
54822+ }
54823+ break;
54824+ case GR_UNSPROLE:
54825+ if (unlikely(!(gr_status & GR_READY))) {
54826+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54827+ error = -EAGAIN;
54828+ break;
54829+ }
54830+
54831+ if (current->role->roletype & GR_ROLE_SPECIAL) {
54832+ char *p = "";
54833+ int i = 0;
54834+
54835+ read_lock(&tasklist_lock);
54836+ if (current->real_parent) {
54837+ p = current->real_parent->role->rolename;
54838+ i = current->real_parent->acl_role_id;
54839+ }
54840+ read_unlock(&tasklist_lock);
54841+
54842+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54843+ gr_set_acls(1);
54844+ } else {
54845+ error = -EPERM;
54846+ goto out;
54847+ }
54848+ break;
54849+ default:
54850+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54851+ error = -EINVAL;
54852+ break;
54853+ }
54854+
54855+ if (error != -EPERM)
54856+ goto out;
54857+
54858+ if(!(gr_auth_attempts++))
54859+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54860+
54861+ out:
54862+ mutex_unlock(&gr_dev_mutex);
54863+ return error;
54864+}
54865+
54866+/* must be called with
54867+ rcu_read_lock();
54868+ read_lock(&tasklist_lock);
54869+ read_lock(&grsec_exec_file_lock);
54870+*/
54871+int gr_apply_subject_to_task(struct task_struct *task)
54872+{
54873+ struct acl_object_label *obj;
54874+ char *tmpname;
54875+ struct acl_subject_label *tmpsubj;
54876+ struct file *filp;
54877+ struct name_entry *nmatch;
54878+
54879+ filp = task->exec_file;
54880+ if (filp == NULL)
54881+ return 0;
54882+
54883+ /* the following is to apply the correct subject
54884+ on binaries running when the RBAC system
54885+ is enabled, when the binaries have been
54886+ replaced or deleted since their execution
54887+ -----
54888+ when the RBAC system starts, the inode/dev
54889+ from exec_file will be one the RBAC system
54890+ is unaware of. It only knows the inode/dev
54891+ of the present file on disk, or the absence
54892+ of it.
54893+ */
54894+ preempt_disable();
54895+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54896+
54897+ nmatch = lookup_name_entry(tmpname);
54898+ preempt_enable();
54899+ tmpsubj = NULL;
54900+ if (nmatch) {
54901+ if (nmatch->deleted)
54902+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54903+ else
54904+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54905+ if (tmpsubj != NULL)
54906+ task->acl = tmpsubj;
54907+ }
54908+ if (tmpsubj == NULL)
54909+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54910+ task->role);
54911+ if (task->acl) {
54912+ struct acl_subject_label *curr;
54913+ curr = task->acl;
54914+
54915+ task->is_writable = 0;
54916+ /* ignore additional mmap checks for processes that are writable
54917+ by the default ACL */
54918+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54919+ if (unlikely(obj->mode & GR_WRITE))
54920+ task->is_writable = 1;
54921+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54922+ if (unlikely(obj->mode & GR_WRITE))
54923+ task->is_writable = 1;
54924+
54925+ gr_set_proc_res(task);
54926+
54927+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54928+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54929+#endif
54930+ } else {
54931+ return 1;
54932+ }
54933+
54934+ return 0;
54935+}
54936+
54937+int
54938+gr_set_acls(const int type)
54939+{
54940+ struct task_struct *task, *task2;
54941+ struct acl_role_label *role = current->role;
54942+ __u16 acl_role_id = current->acl_role_id;
54943+ const struct cred *cred;
54944+ int ret;
54945+
54946+ rcu_read_lock();
54947+ read_lock(&tasklist_lock);
54948+ read_lock(&grsec_exec_file_lock);
54949+ do_each_thread(task2, task) {
54950+ /* check to see if we're called from the exit handler,
54951+ if so, only replace ACLs that have inherited the admin
54952+ ACL */
54953+
54954+ if (type && (task->role != role ||
54955+ task->acl_role_id != acl_role_id))
54956+ continue;
54957+
54958+ task->acl_role_id = 0;
54959+ task->acl_sp_role = 0;
54960+
54961+ if (task->exec_file) {
54962+ cred = __task_cred(task);
54963+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54964+ ret = gr_apply_subject_to_task(task);
54965+ if (ret) {
54966+ read_unlock(&grsec_exec_file_lock);
54967+ read_unlock(&tasklist_lock);
54968+ rcu_read_unlock();
54969+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54970+ return ret;
54971+ }
54972+ } else {
54973+ // it's a kernel process
54974+ task->role = kernel_role;
54975+ task->acl = kernel_role->root_label;
54976+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54977+ task->acl->mode &= ~GR_PROCFIND;
54978+#endif
54979+ }
54980+ } while_each_thread(task2, task);
54981+ read_unlock(&grsec_exec_file_lock);
54982+ read_unlock(&tasklist_lock);
54983+ rcu_read_unlock();
54984+
54985+ return 0;
54986+}
54987+
54988+void
54989+gr_learn_resource(const struct task_struct *task,
54990+ const int res, const unsigned long wanted, const int gt)
54991+{
54992+ struct acl_subject_label *acl;
54993+ const struct cred *cred;
54994+
54995+ if (unlikely((gr_status & GR_READY) &&
54996+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54997+ goto skip_reslog;
54998+
54999+#ifdef CONFIG_GRKERNSEC_RESLOG
55000+ gr_log_resource(task, res, wanted, gt);
55001+#endif
55002+ skip_reslog:
55003+
55004+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
55005+ return;
55006+
55007+ acl = task->acl;
55008+
55009+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
55010+ !(acl->resmask & (1 << (unsigned short) res))))
55011+ return;
55012+
55013+ if (wanted >= acl->res[res].rlim_cur) {
55014+ unsigned long res_add;
55015+
55016+ res_add = wanted;
55017+ switch (res) {
55018+ case RLIMIT_CPU:
55019+ res_add += GR_RLIM_CPU_BUMP;
55020+ break;
55021+ case RLIMIT_FSIZE:
55022+ res_add += GR_RLIM_FSIZE_BUMP;
55023+ break;
55024+ case RLIMIT_DATA:
55025+ res_add += GR_RLIM_DATA_BUMP;
55026+ break;
55027+ case RLIMIT_STACK:
55028+ res_add += GR_RLIM_STACK_BUMP;
55029+ break;
55030+ case RLIMIT_CORE:
55031+ res_add += GR_RLIM_CORE_BUMP;
55032+ break;
55033+ case RLIMIT_RSS:
55034+ res_add += GR_RLIM_RSS_BUMP;
55035+ break;
55036+ case RLIMIT_NPROC:
55037+ res_add += GR_RLIM_NPROC_BUMP;
55038+ break;
55039+ case RLIMIT_NOFILE:
55040+ res_add += GR_RLIM_NOFILE_BUMP;
55041+ break;
55042+ case RLIMIT_MEMLOCK:
55043+ res_add += GR_RLIM_MEMLOCK_BUMP;
55044+ break;
55045+ case RLIMIT_AS:
55046+ res_add += GR_RLIM_AS_BUMP;
55047+ break;
55048+ case RLIMIT_LOCKS:
55049+ res_add += GR_RLIM_LOCKS_BUMP;
55050+ break;
55051+ case RLIMIT_SIGPENDING:
55052+ res_add += GR_RLIM_SIGPENDING_BUMP;
55053+ break;
55054+ case RLIMIT_MSGQUEUE:
55055+ res_add += GR_RLIM_MSGQUEUE_BUMP;
55056+ break;
55057+ case RLIMIT_NICE:
55058+ res_add += GR_RLIM_NICE_BUMP;
55059+ break;
55060+ case RLIMIT_RTPRIO:
55061+ res_add += GR_RLIM_RTPRIO_BUMP;
55062+ break;
55063+ case RLIMIT_RTTIME:
55064+ res_add += GR_RLIM_RTTIME_BUMP;
55065+ break;
55066+ }
55067+
55068+ acl->res[res].rlim_cur = res_add;
55069+
55070+ if (wanted > acl->res[res].rlim_max)
55071+ acl->res[res].rlim_max = res_add;
55072+
55073+ /* only log the subject filename, since resource logging is supported for
55074+ single-subject learning only */
55075+ rcu_read_lock();
55076+ cred = __task_cred(task);
55077+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55078+ task->role->roletype, cred->uid, cred->gid, acl->filename,
55079+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
55080+ "", (unsigned long) res, &task->signal->saved_ip);
55081+ rcu_read_unlock();
55082+ }
55083+
55084+ return;
55085+}
55086+
55087+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
55088+void
55089+pax_set_initial_flags(struct linux_binprm *bprm)
55090+{
55091+ struct task_struct *task = current;
55092+ struct acl_subject_label *proc;
55093+ unsigned long flags;
55094+
55095+ if (unlikely(!(gr_status & GR_READY)))
55096+ return;
55097+
55098+ flags = pax_get_flags(task);
55099+
55100+ proc = task->acl;
55101+
55102+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
55103+ flags &= ~MF_PAX_PAGEEXEC;
55104+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
55105+ flags &= ~MF_PAX_SEGMEXEC;
55106+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
55107+ flags &= ~MF_PAX_RANDMMAP;
55108+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
55109+ flags &= ~MF_PAX_EMUTRAMP;
55110+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
55111+ flags &= ~MF_PAX_MPROTECT;
55112+
55113+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
55114+ flags |= MF_PAX_PAGEEXEC;
55115+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
55116+ flags |= MF_PAX_SEGMEXEC;
55117+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
55118+ flags |= MF_PAX_RANDMMAP;
55119+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
55120+ flags |= MF_PAX_EMUTRAMP;
55121+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
55122+ flags |= MF_PAX_MPROTECT;
55123+
55124+ pax_set_flags(task, flags);
55125+
55126+ return;
55127+}
55128+#endif
55129+
55130+#ifdef CONFIG_SYSCTL
55131+/* Eric Biederman likes breaking userland ABI and every inode-based security
55132+ system to save 35kb of memory */
55133+
55134+/* we modify the passed in filename, but adjust it back before returning */
55135+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
55136+{
55137+ struct name_entry *nmatch;
55138+ char *p, *lastp = NULL;
55139+ struct acl_object_label *obj = NULL, *tmp;
55140+ struct acl_subject_label *tmpsubj;
55141+ char c = '\0';
55142+
55143+ read_lock(&gr_inode_lock);
55144+
55145+ p = name + len - 1;
55146+ do {
55147+ nmatch = lookup_name_entry(name);
55148+ if (lastp != NULL)
55149+ *lastp = c;
55150+
55151+ if (nmatch == NULL)
55152+ goto next_component;
55153+ tmpsubj = current->acl;
55154+ do {
55155+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
55156+ if (obj != NULL) {
55157+ tmp = obj->globbed;
55158+ while (tmp) {
55159+ if (!glob_match(tmp->filename, name)) {
55160+ obj = tmp;
55161+ goto found_obj;
55162+ }
55163+ tmp = tmp->next;
55164+ }
55165+ goto found_obj;
55166+ }
55167+ } while ((tmpsubj = tmpsubj->parent_subject));
55168+next_component:
55169+ /* end case */
55170+ if (p == name)
55171+ break;
55172+
55173+ while (*p != '/')
55174+ p--;
55175+ if (p == name)
55176+ lastp = p + 1;
55177+ else {
55178+ lastp = p;
55179+ p--;
55180+ }
55181+ c = *lastp;
55182+ *lastp = '\0';
55183+ } while (1);
55184+found_obj:
55185+ read_unlock(&gr_inode_lock);
55186+ /* obj returned will always be non-null */
55187+ return obj;
55188+}
55189+
55190+/* returns 0 when allowing, non-zero on error
55191+ op of 0 is used for readdir, so we don't log the names of hidden files
55192+*/
55193+__u32
55194+gr_handle_sysctl(const struct ctl_table *table, const int op)
55195+{
55196+ struct ctl_table *tmp;
55197+ const char *proc_sys = "/proc/sys";
55198+ char *path;
55199+ struct acl_object_label *obj;
55200+ unsigned short len = 0, pos = 0, depth = 0, i;
55201+ __u32 err = 0;
55202+ __u32 mode = 0;
55203+
55204+ if (unlikely(!(gr_status & GR_READY)))
55205+ return 0;
55206+
55207+ /* for now, ignore operations on non-sysctl entries if it's not a
55208+ readdir*/
55209+ if (table->child != NULL && op != 0)
55210+ return 0;
55211+
55212+ mode |= GR_FIND;
55213+ /* it's only a read if it's an entry, read on dirs is for readdir */
55214+ if (op & MAY_READ)
55215+ mode |= GR_READ;
55216+ if (op & MAY_WRITE)
55217+ mode |= GR_WRITE;
55218+
55219+ preempt_disable();
55220+
55221+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
55222+
55223+ /* it's only a read/write if it's an actual entry, not a dir
55224+ (which are opened for readdir)
55225+ */
55226+
55227+ /* convert the requested sysctl entry into a pathname */
55228+
55229+ for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55230+ len += strlen(tmp->procname);
55231+ len++;
55232+ depth++;
55233+ }
55234+
55235+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
55236+ /* deny */
55237+ goto out;
55238+ }
55239+
55240+ memset(path, 0, PAGE_SIZE);
55241+
55242+ memcpy(path, proc_sys, strlen(proc_sys));
55243+
55244+ pos += strlen(proc_sys);
55245+
55246+ for (; depth > 0; depth--) {
55247+ path[pos] = '/';
55248+ pos++;
55249+ for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55250+ if (depth == i) {
55251+ memcpy(path + pos, tmp->procname,
55252+ strlen(tmp->procname));
55253+ pos += strlen(tmp->procname);
55254+ }
55255+ i++;
55256+ }
55257+ }
55258+
55259+ obj = gr_lookup_by_name(path, pos);
55260+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
55261+
55262+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
55263+ ((err & mode) != mode))) {
55264+ __u32 new_mode = mode;
55265+
55266+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
55267+
55268+ err = 0;
55269+ gr_log_learn_sysctl(path, new_mode);
55270+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
55271+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
55272+ err = -ENOENT;
55273+ } else if (!(err & GR_FIND)) {
55274+ err = -ENOENT;
55275+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
55276+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
55277+ path, (mode & GR_READ) ? " reading" : "",
55278+ (mode & GR_WRITE) ? " writing" : "");
55279+ err = -EACCES;
55280+ } else if ((err & mode) != mode) {
55281+ err = -EACCES;
55282+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
55283+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
55284+ path, (mode & GR_READ) ? " reading" : "",
55285+ (mode & GR_WRITE) ? " writing" : "");
55286+ err = 0;
55287+ } else
55288+ err = 0;
55289+
55290+ out:
55291+ preempt_enable();
55292+
55293+ return err;
55294+}
55295+#endif
55296+
55297+int
55298+gr_handle_proc_ptrace(struct task_struct *task)
55299+{
55300+ struct file *filp;
55301+ struct task_struct *tmp = task;
55302+ struct task_struct *curtemp = current;
55303+ __u32 retmode;
55304+
55305+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55306+ if (unlikely(!(gr_status & GR_READY)))
55307+ return 0;
55308+#endif
55309+
55310+ read_lock(&tasklist_lock);
55311+ read_lock(&grsec_exec_file_lock);
55312+ filp = task->exec_file;
55313+
55314+ while (tmp->pid > 0) {
55315+ if (tmp == curtemp)
55316+ break;
55317+ tmp = tmp->real_parent;
55318+ }
55319+
55320+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55321+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
55322+ read_unlock(&grsec_exec_file_lock);
55323+ read_unlock(&tasklist_lock);
55324+ return 1;
55325+ }
55326+
55327+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55328+ if (!(gr_status & GR_READY)) {
55329+ read_unlock(&grsec_exec_file_lock);
55330+ read_unlock(&tasklist_lock);
55331+ return 0;
55332+ }
55333+#endif
55334+
55335+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
55336+ read_unlock(&grsec_exec_file_lock);
55337+ read_unlock(&tasklist_lock);
55338+
55339+ if (retmode & GR_NOPTRACE)
55340+ return 1;
55341+
55342+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
55343+ && (current->acl != task->acl || (current->acl != current->role->root_label
55344+ && current->pid != task->pid)))
55345+ return 1;
55346+
55347+ return 0;
55348+}
55349+
55350+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
55351+{
55352+ if (unlikely(!(gr_status & GR_READY)))
55353+ return;
55354+
55355+ if (!(current->role->roletype & GR_ROLE_GOD))
55356+ return;
55357+
55358+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
55359+ p->role->rolename, gr_task_roletype_to_char(p),
55360+ p->acl->filename);
55361+}
55362+
55363+int
55364+gr_handle_ptrace(struct task_struct *task, const long request)
55365+{
55366+ struct task_struct *tmp = task;
55367+ struct task_struct *curtemp = current;
55368+ __u32 retmode;
55369+
55370+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55371+ if (unlikely(!(gr_status & GR_READY)))
55372+ return 0;
55373+#endif
55374+
55375+ read_lock(&tasklist_lock);
55376+ while (tmp->pid > 0) {
55377+ if (tmp == curtemp)
55378+ break;
55379+ tmp = tmp->real_parent;
55380+ }
55381+
55382+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55383+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
55384+ read_unlock(&tasklist_lock);
55385+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55386+ return 1;
55387+ }
55388+ read_unlock(&tasklist_lock);
55389+
55390+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55391+ if (!(gr_status & GR_READY))
55392+ return 0;
55393+#endif
55394+
55395+ read_lock(&grsec_exec_file_lock);
55396+ if (unlikely(!task->exec_file)) {
55397+ read_unlock(&grsec_exec_file_lock);
55398+ return 0;
55399+ }
55400+
55401+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
55402+ read_unlock(&grsec_exec_file_lock);
55403+
55404+ if (retmode & GR_NOPTRACE) {
55405+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55406+ return 1;
55407+ }
55408+
55409+ if (retmode & GR_PTRACERD) {
55410+ switch (request) {
55411+ case PTRACE_POKETEXT:
55412+ case PTRACE_POKEDATA:
55413+ case PTRACE_POKEUSR:
55414+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
55415+ case PTRACE_SETREGS:
55416+ case PTRACE_SETFPREGS:
55417+#endif
55418+#ifdef CONFIG_X86
55419+ case PTRACE_SETFPXREGS:
55420+#endif
55421+#ifdef CONFIG_ALTIVEC
55422+ case PTRACE_SETVRREGS:
55423+#endif
55424+ return 1;
55425+ default:
55426+ return 0;
55427+ }
55428+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
55429+ !(current->role->roletype & GR_ROLE_GOD) &&
55430+ (current->acl != task->acl)) {
55431+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55432+ return 1;
55433+ }
55434+
55435+ return 0;
55436+}
55437+
55438+static int is_writable_mmap(const struct file *filp)
55439+{
55440+ struct task_struct *task = current;
55441+ struct acl_object_label *obj, *obj2;
55442+
55443+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
55444+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
55445+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55446+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
55447+ task->role->root_label);
55448+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
55449+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
55450+ return 1;
55451+ }
55452+ }
55453+ return 0;
55454+}
55455+
55456+int
55457+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
55458+{
55459+ __u32 mode;
55460+
55461+ if (unlikely(!file || !(prot & PROT_EXEC)))
55462+ return 1;
55463+
55464+ if (is_writable_mmap(file))
55465+ return 0;
55466+
55467+ mode =
55468+ gr_search_file(file->f_path.dentry,
55469+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55470+ file->f_path.mnt);
55471+
55472+ if (!gr_tpe_allow(file))
55473+ return 0;
55474+
55475+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55476+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55477+ return 0;
55478+ } else if (unlikely(!(mode & GR_EXEC))) {
55479+ return 0;
55480+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55481+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55482+ return 1;
55483+ }
55484+
55485+ return 1;
55486+}
55487+
55488+int
55489+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55490+{
55491+ __u32 mode;
55492+
55493+ if (unlikely(!file || !(prot & PROT_EXEC)))
55494+ return 1;
55495+
55496+ if (is_writable_mmap(file))
55497+ return 0;
55498+
55499+ mode =
55500+ gr_search_file(file->f_path.dentry,
55501+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55502+ file->f_path.mnt);
55503+
55504+ if (!gr_tpe_allow(file))
55505+ return 0;
55506+
55507+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55508+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55509+ return 0;
55510+ } else if (unlikely(!(mode & GR_EXEC))) {
55511+ return 0;
55512+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55513+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55514+ return 1;
55515+ }
55516+
55517+ return 1;
55518+}
55519+
55520+void
55521+gr_acl_handle_psacct(struct task_struct *task, const long code)
55522+{
55523+ unsigned long runtime;
55524+ unsigned long cputime;
55525+ unsigned int wday, cday;
55526+ __u8 whr, chr;
55527+ __u8 wmin, cmin;
55528+ __u8 wsec, csec;
55529+ struct timespec timeval;
55530+
55531+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
55532+ !(task->acl->mode & GR_PROCACCT)))
55533+ return;
55534+
55535+ do_posix_clock_monotonic_gettime(&timeval);
55536+ runtime = timeval.tv_sec - task->start_time.tv_sec;
55537+ wday = runtime / (3600 * 24);
55538+ runtime -= wday * (3600 * 24);
55539+ whr = runtime / 3600;
55540+ runtime -= whr * 3600;
55541+ wmin = runtime / 60;
55542+ runtime -= wmin * 60;
55543+ wsec = runtime;
55544+
55545+ cputime = (task->utime + task->stime) / HZ;
55546+ cday = cputime / (3600 * 24);
55547+ cputime -= cday * (3600 * 24);
55548+ chr = cputime / 3600;
55549+ cputime -= chr * 3600;
55550+ cmin = cputime / 60;
55551+ cputime -= cmin * 60;
55552+ csec = cputime;
55553+
55554+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
55555+
55556+ return;
55557+}
55558+
55559+void gr_set_kernel_label(struct task_struct *task)
55560+{
55561+ if (gr_status & GR_READY) {
55562+ task->role = kernel_role;
55563+ task->acl = kernel_role->root_label;
55564+ }
55565+ return;
55566+}
55567+
55568+#ifdef CONFIG_TASKSTATS
55569+int gr_is_taskstats_denied(int pid)
55570+{
55571+ struct task_struct *task;
55572+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55573+ const struct cred *cred;
55574+#endif
55575+ int ret = 0;
55576+
55577+ /* restrict taskstats viewing to un-chrooted root users
55578+ who have the 'view' subject flag if the RBAC system is enabled
55579+ */
55580+
55581+ rcu_read_lock();
55582+ read_lock(&tasklist_lock);
55583+ task = find_task_by_vpid(pid);
55584+ if (task) {
55585+#ifdef CONFIG_GRKERNSEC_CHROOT
55586+ if (proc_is_chrooted(task))
55587+ ret = -EACCES;
55588+#endif
55589+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55590+ cred = __task_cred(task);
55591+#ifdef CONFIG_GRKERNSEC_PROC_USER
55592+ if (cred->uid != 0)
55593+ ret = -EACCES;
55594+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55595+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
55596+ ret = -EACCES;
55597+#endif
55598+#endif
55599+ if (gr_status & GR_READY) {
55600+ if (!(task->acl->mode & GR_VIEW))
55601+ ret = -EACCES;
55602+ }
55603+ } else
55604+ ret = -ENOENT;
55605+
55606+ read_unlock(&tasklist_lock);
55607+ rcu_read_unlock();
55608+
55609+ return ret;
55610+}
55611+#endif
55612+
55613+/* AUXV entries are filled via a descendant of search_binary_handler
55614+ after we've already applied the subject for the target
55615+*/
55616+int gr_acl_enable_at_secure(void)
55617+{
55618+ if (unlikely(!(gr_status & GR_READY)))
55619+ return 0;
55620+
55621+ if (current->acl->mode & GR_ATSECURE)
55622+ return 1;
55623+
55624+ return 0;
55625+}
55626+
55627+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
55628+{
55629+ struct task_struct *task = current;
55630+ struct dentry *dentry = file->f_path.dentry;
55631+ struct vfsmount *mnt = file->f_path.mnt;
55632+ struct acl_object_label *obj, *tmp;
55633+ struct acl_subject_label *subj;
55634+ unsigned int bufsize;
55635+ int is_not_root;
55636+ char *path;
55637+ dev_t dev = __get_dev(dentry);
55638+
55639+ if (unlikely(!(gr_status & GR_READY)))
55640+ return 1;
55641+
55642+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
55643+ return 1;
55644+
55645+ /* ignore Eric Biederman */
55646+ if (IS_PRIVATE(dentry->d_inode))
55647+ return 1;
55648+
55649+ subj = task->acl;
55650+ do {
55651+ obj = lookup_acl_obj_label(ino, dev, subj);
55652+ if (obj != NULL)
55653+ return (obj->mode & GR_FIND) ? 1 : 0;
55654+ } while ((subj = subj->parent_subject));
55655+
55656+ /* this is purely an optimization since we're looking for an object
55657+ for the directory we're doing a readdir on
55658+ if it's possible for any globbed object to match the entry we're
55659+ filling into the directory, then the object we find here will be
55660+ an anchor point with attached globbed objects
55661+ */
55662+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
55663+ if (obj->globbed == NULL)
55664+ return (obj->mode & GR_FIND) ? 1 : 0;
55665+
55666+ is_not_root = ((obj->filename[0] == '/') &&
55667+ (obj->filename[1] == '\0')) ? 0 : 1;
55668+ bufsize = PAGE_SIZE - namelen - is_not_root;
55669+
55670+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
55671+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
55672+ return 1;
55673+
55674+ preempt_disable();
55675+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
55676+ bufsize);
55677+
55678+ bufsize = strlen(path);
55679+
55680+ /* if base is "/", don't append an additional slash */
55681+ if (is_not_root)
55682+ *(path + bufsize) = '/';
55683+ memcpy(path + bufsize + is_not_root, name, namelen);
55684+ *(path + bufsize + namelen + is_not_root) = '\0';
55685+
55686+ tmp = obj->globbed;
55687+ while (tmp) {
55688+ if (!glob_match(tmp->filename, path)) {
55689+ preempt_enable();
55690+ return (tmp->mode & GR_FIND) ? 1 : 0;
55691+ }
55692+ tmp = tmp->next;
55693+ }
55694+ preempt_enable();
55695+ return (obj->mode & GR_FIND) ? 1 : 0;
55696+}
55697+
55698+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
55699+EXPORT_SYMBOL(gr_acl_is_enabled);
55700+#endif
55701+EXPORT_SYMBOL(gr_learn_resource);
55702+EXPORT_SYMBOL(gr_set_kernel_label);
55703+#ifdef CONFIG_SECURITY
55704+EXPORT_SYMBOL(gr_check_user_change);
55705+EXPORT_SYMBOL(gr_check_group_change);
55706+#endif
55707+
55708diff -urNp linux-2.6.39.2/grsecurity/gracl_cap.c linux-2.6.39.2/grsecurity/gracl_cap.c
55709--- linux-2.6.39.2/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
55710+++ linux-2.6.39.2/grsecurity/gracl_cap.c 2011-05-22 19:41:42.000000000 -0400
55711@@ -0,0 +1,139 @@
55712+#include <linux/kernel.h>
55713+#include <linux/module.h>
55714+#include <linux/sched.h>
55715+#include <linux/gracl.h>
55716+#include <linux/grsecurity.h>
55717+#include <linux/grinternal.h>
55718+
55719+static const char *captab_log[] = {
55720+ "CAP_CHOWN",
55721+ "CAP_DAC_OVERRIDE",
55722+ "CAP_DAC_READ_SEARCH",
55723+ "CAP_FOWNER",
55724+ "CAP_FSETID",
55725+ "CAP_KILL",
55726+ "CAP_SETGID",
55727+ "CAP_SETUID",
55728+ "CAP_SETPCAP",
55729+ "CAP_LINUX_IMMUTABLE",
55730+ "CAP_NET_BIND_SERVICE",
55731+ "CAP_NET_BROADCAST",
55732+ "CAP_NET_ADMIN",
55733+ "CAP_NET_RAW",
55734+ "CAP_IPC_LOCK",
55735+ "CAP_IPC_OWNER",
55736+ "CAP_SYS_MODULE",
55737+ "CAP_SYS_RAWIO",
55738+ "CAP_SYS_CHROOT",
55739+ "CAP_SYS_PTRACE",
55740+ "CAP_SYS_PACCT",
55741+ "CAP_SYS_ADMIN",
55742+ "CAP_SYS_BOOT",
55743+ "CAP_SYS_NICE",
55744+ "CAP_SYS_RESOURCE",
55745+ "CAP_SYS_TIME",
55746+ "CAP_SYS_TTY_CONFIG",
55747+ "CAP_MKNOD",
55748+ "CAP_LEASE",
55749+ "CAP_AUDIT_WRITE",
55750+ "CAP_AUDIT_CONTROL",
55751+ "CAP_SETFCAP",
55752+ "CAP_MAC_OVERRIDE",
55753+ "CAP_MAC_ADMIN",
55754+ "CAP_SYSLOG"
55755+};
55756+
55757+EXPORT_SYMBOL(gr_is_capable);
55758+EXPORT_SYMBOL(gr_is_capable_nolog);
55759+
55760+int
55761+gr_is_capable(const int cap)
55762+{
55763+ struct task_struct *task = current;
55764+ const struct cred *cred = current_cred();
55765+ struct acl_subject_label *curracl;
55766+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55767+ kernel_cap_t cap_audit = __cap_empty_set;
55768+
55769+ if (!gr_acl_is_enabled())
55770+ return 1;
55771+
55772+ curracl = task->acl;
55773+
55774+ cap_drop = curracl->cap_lower;
55775+ cap_mask = curracl->cap_mask;
55776+ cap_audit = curracl->cap_invert_audit;
55777+
55778+ while ((curracl = curracl->parent_subject)) {
55779+ /* if the cap isn't specified in the current computed mask but is specified in the
55780+ current level subject, and is lowered in the current level subject, then add
55781+ it to the set of dropped capabilities
55782+ otherwise, add the current level subject's mask to the current computed mask
55783+ */
55784+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55785+ cap_raise(cap_mask, cap);
55786+ if (cap_raised(curracl->cap_lower, cap))
55787+ cap_raise(cap_drop, cap);
55788+ if (cap_raised(curracl->cap_invert_audit, cap))
55789+ cap_raise(cap_audit, cap);
55790+ }
55791+ }
55792+
55793+ if (!cap_raised(cap_drop, cap)) {
55794+ if (cap_raised(cap_audit, cap))
55795+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55796+ return 1;
55797+ }
55798+
55799+ curracl = task->acl;
55800+
55801+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55802+ && cap_raised(cred->cap_effective, cap)) {
55803+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55804+ task->role->roletype, cred->uid,
55805+ cred->gid, task->exec_file ?
55806+ gr_to_filename(task->exec_file->f_path.dentry,
55807+ task->exec_file->f_path.mnt) : curracl->filename,
55808+ curracl->filename, 0UL,
55809+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55810+ return 1;
55811+ }
55812+
55813+ if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55814+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55815+ return 0;
55816+}
55817+
55818+int
55819+gr_is_capable_nolog(const int cap)
55820+{
55821+ struct acl_subject_label *curracl;
55822+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55823+
55824+ if (!gr_acl_is_enabled())
55825+ return 1;
55826+
55827+ curracl = current->acl;
55828+
55829+ cap_drop = curracl->cap_lower;
55830+ cap_mask = curracl->cap_mask;
55831+
55832+ while ((curracl = curracl->parent_subject)) {
55833+ /* if the cap isn't specified in the current computed mask but is specified in the
55834+ current level subject, and is lowered in the current level subject, then add
55835+ it to the set of dropped capabilities
55836+ otherwise, add the current level subject's mask to the current computed mask
55837+ */
55838+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55839+ cap_raise(cap_mask, cap);
55840+ if (cap_raised(curracl->cap_lower, cap))
55841+ cap_raise(cap_drop, cap);
55842+ }
55843+ }
55844+
55845+ if (!cap_raised(cap_drop, cap))
55846+ return 1;
55847+
55848+ return 0;
55849+}
55850+
55851diff -urNp linux-2.6.39.2/grsecurity/gracl_fs.c linux-2.6.39.2/grsecurity/gracl_fs.c
55852--- linux-2.6.39.2/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
55853+++ linux-2.6.39.2/grsecurity/gracl_fs.c 2011-05-22 19:41:42.000000000 -0400
55854@@ -0,0 +1,431 @@
55855+#include <linux/kernel.h>
55856+#include <linux/sched.h>
55857+#include <linux/types.h>
55858+#include <linux/fs.h>
55859+#include <linux/file.h>
55860+#include <linux/stat.h>
55861+#include <linux/grsecurity.h>
55862+#include <linux/grinternal.h>
55863+#include <linux/gracl.h>
55864+
55865+__u32
55866+gr_acl_handle_hidden_file(const struct dentry * dentry,
55867+ const struct vfsmount * mnt)
55868+{
55869+ __u32 mode;
55870+
55871+ if (unlikely(!dentry->d_inode))
55872+ return GR_FIND;
55873+
55874+ mode =
55875+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55876+
55877+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55878+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55879+ return mode;
55880+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55881+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55882+ return 0;
55883+ } else if (unlikely(!(mode & GR_FIND)))
55884+ return 0;
55885+
55886+ return GR_FIND;
55887+}
55888+
55889+__u32
55890+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55891+ const int fmode)
55892+{
55893+ __u32 reqmode = GR_FIND;
55894+ __u32 mode;
55895+
55896+ if (unlikely(!dentry->d_inode))
55897+ return reqmode;
55898+
55899+ if (unlikely(fmode & O_APPEND))
55900+ reqmode |= GR_APPEND;
55901+ else if (unlikely(fmode & FMODE_WRITE))
55902+ reqmode |= GR_WRITE;
55903+ if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55904+ reqmode |= GR_READ;
55905+ if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC))
55906+ reqmode &= ~GR_READ;
55907+ mode =
55908+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55909+ mnt);
55910+
55911+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55912+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55913+ reqmode & GR_READ ? " reading" : "",
55914+ reqmode & GR_WRITE ? " writing" : reqmode &
55915+ GR_APPEND ? " appending" : "");
55916+ return reqmode;
55917+ } else
55918+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55919+ {
55920+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55921+ reqmode & GR_READ ? " reading" : "",
55922+ reqmode & GR_WRITE ? " writing" : reqmode &
55923+ GR_APPEND ? " appending" : "");
55924+ return 0;
55925+ } else if (unlikely((mode & reqmode) != reqmode))
55926+ return 0;
55927+
55928+ return reqmode;
55929+}
55930+
55931+__u32
55932+gr_acl_handle_creat(const struct dentry * dentry,
55933+ const struct dentry * p_dentry,
55934+ const struct vfsmount * p_mnt, const int fmode,
55935+ const int imode)
55936+{
55937+ __u32 reqmode = GR_WRITE | GR_CREATE;
55938+ __u32 mode;
55939+
55940+ if (unlikely(fmode & O_APPEND))
55941+ reqmode |= GR_APPEND;
55942+ if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55943+ reqmode |= GR_READ;
55944+ if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
55945+ reqmode |= GR_SETID;
55946+
55947+ mode =
55948+ gr_check_create(dentry, p_dentry, p_mnt,
55949+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55950+
55951+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55952+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55953+ reqmode & GR_READ ? " reading" : "",
55954+ reqmode & GR_WRITE ? " writing" : reqmode &
55955+ GR_APPEND ? " appending" : "");
55956+ return reqmode;
55957+ } else
55958+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55959+ {
55960+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55961+ reqmode & GR_READ ? " reading" : "",
55962+ reqmode & GR_WRITE ? " writing" : reqmode &
55963+ GR_APPEND ? " appending" : "");
55964+ return 0;
55965+ } else if (unlikely((mode & reqmode) != reqmode))
55966+ return 0;
55967+
55968+ return reqmode;
55969+}
55970+
55971+__u32
55972+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55973+ const int fmode)
55974+{
55975+ __u32 mode, reqmode = GR_FIND;
55976+
55977+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55978+ reqmode |= GR_EXEC;
55979+ if (fmode & S_IWOTH)
55980+ reqmode |= GR_WRITE;
55981+ if (fmode & S_IROTH)
55982+ reqmode |= GR_READ;
55983+
55984+ mode =
55985+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55986+ mnt);
55987+
55988+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55989+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55990+ reqmode & GR_READ ? " reading" : "",
55991+ reqmode & GR_WRITE ? " writing" : "",
55992+ reqmode & GR_EXEC ? " executing" : "");
55993+ return reqmode;
55994+ } else
55995+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55996+ {
55997+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55998+ reqmode & GR_READ ? " reading" : "",
55999+ reqmode & GR_WRITE ? " writing" : "",
56000+ reqmode & GR_EXEC ? " executing" : "");
56001+ return 0;
56002+ } else if (unlikely((mode & reqmode) != reqmode))
56003+ return 0;
56004+
56005+ return reqmode;
56006+}
56007+
56008+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
56009+{
56010+ __u32 mode;
56011+
56012+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
56013+
56014+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
56015+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
56016+ return mode;
56017+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
56018+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
56019+ return 0;
56020+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
56021+ return 0;
56022+
56023+ return (reqmode);
56024+}
56025+
56026+__u32
56027+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
56028+{
56029+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
56030+}
56031+
56032+__u32
56033+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
56034+{
56035+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
56036+}
56037+
56038+__u32
56039+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
56040+{
56041+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
56042+}
56043+
56044+__u32
56045+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
56046+{
56047+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
56048+}
56049+
56050+__u32
56051+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
56052+ mode_t mode)
56053+{
56054+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
56055+ return 1;
56056+
56057+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
56058+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
56059+ GR_FCHMOD_ACL_MSG);
56060+ } else {
56061+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
56062+ }
56063+}
56064+
56065+__u32
56066+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
56067+ mode_t mode)
56068+{
56069+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
56070+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
56071+ GR_CHMOD_ACL_MSG);
56072+ } else {
56073+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
56074+ }
56075+}
56076+
56077+__u32
56078+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
56079+{
56080+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
56081+}
56082+
56083+__u32
56084+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
56085+{
56086+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
56087+}
56088+
56089+__u32
56090+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
56091+{
56092+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
56093+}
56094+
56095+__u32
56096+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
56097+{
56098+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
56099+ GR_UNIXCONNECT_ACL_MSG);
56100+}
56101+
56102+/* hardlinks require at minimum create permission,
56103+ any additional privilege required is based on the
56104+ privilege of the file being linked to
56105+*/
56106+__u32
56107+gr_acl_handle_link(const struct dentry * new_dentry,
56108+ const struct dentry * parent_dentry,
56109+ const struct vfsmount * parent_mnt,
56110+ const struct dentry * old_dentry,
56111+ const struct vfsmount * old_mnt, const char *to)
56112+{
56113+ __u32 mode;
56114+ __u32 needmode = GR_CREATE | GR_LINK;
56115+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
56116+
56117+ mode =
56118+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
56119+ old_mnt);
56120+
56121+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
56122+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
56123+ return mode;
56124+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
56125+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
56126+ return 0;
56127+ } else if (unlikely((mode & needmode) != needmode))
56128+ return 0;
56129+
56130+ return 1;
56131+}
56132+
56133+__u32
56134+gr_acl_handle_symlink(const struct dentry * new_dentry,
56135+ const struct dentry * parent_dentry,
56136+ const struct vfsmount * parent_mnt, const char *from)
56137+{
56138+ __u32 needmode = GR_WRITE | GR_CREATE;
56139+ __u32 mode;
56140+
56141+ mode =
56142+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
56143+ GR_CREATE | GR_AUDIT_CREATE |
56144+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
56145+
56146+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
56147+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
56148+ return mode;
56149+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
56150+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
56151+ return 0;
56152+ } else if (unlikely((mode & needmode) != needmode))
56153+ return 0;
56154+
56155+ return (GR_WRITE | GR_CREATE);
56156+}
56157+
56158+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
56159+{
56160+ __u32 mode;
56161+
56162+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
56163+
56164+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
56165+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
56166+ return mode;
56167+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
56168+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
56169+ return 0;
56170+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
56171+ return 0;
56172+
56173+ return (reqmode);
56174+}
56175+
56176+__u32
56177+gr_acl_handle_mknod(const struct dentry * new_dentry,
56178+ const struct dentry * parent_dentry,
56179+ const struct vfsmount * parent_mnt,
56180+ const int mode)
56181+{
56182+ __u32 reqmode = GR_WRITE | GR_CREATE;
56183+ if (unlikely(mode & (S_ISUID | S_ISGID)))
56184+ reqmode |= GR_SETID;
56185+
56186+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56187+ reqmode, GR_MKNOD_ACL_MSG);
56188+}
56189+
56190+__u32
56191+gr_acl_handle_mkdir(const struct dentry *new_dentry,
56192+ const struct dentry *parent_dentry,
56193+ const struct vfsmount *parent_mnt)
56194+{
56195+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56196+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
56197+}
56198+
56199+#define RENAME_CHECK_SUCCESS(old, new) \
56200+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
56201+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
56202+
56203+int
56204+gr_acl_handle_rename(struct dentry *new_dentry,
56205+ struct dentry *parent_dentry,
56206+ const struct vfsmount *parent_mnt,
56207+ struct dentry *old_dentry,
56208+ struct inode *old_parent_inode,
56209+ struct vfsmount *old_mnt, const char *newname)
56210+{
56211+ __u32 comp1, comp2;
56212+ int error = 0;
56213+
56214+ if (unlikely(!gr_acl_is_enabled()))
56215+ return 0;
56216+
56217+ if (!new_dentry->d_inode) {
56218+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
56219+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
56220+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
56221+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
56222+ GR_DELETE | GR_AUDIT_DELETE |
56223+ GR_AUDIT_READ | GR_AUDIT_WRITE |
56224+ GR_SUPPRESS, old_mnt);
56225+ } else {
56226+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
56227+ GR_CREATE | GR_DELETE |
56228+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
56229+ GR_AUDIT_READ | GR_AUDIT_WRITE |
56230+ GR_SUPPRESS, parent_mnt);
56231+ comp2 =
56232+ gr_search_file(old_dentry,
56233+ GR_READ | GR_WRITE | GR_AUDIT_READ |
56234+ GR_DELETE | GR_AUDIT_DELETE |
56235+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
56236+ }
56237+
56238+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
56239+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
56240+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56241+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
56242+ && !(comp2 & GR_SUPPRESS)) {
56243+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56244+ error = -EACCES;
56245+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
56246+ error = -EACCES;
56247+
56248+ return error;
56249+}
56250+
56251+void
56252+gr_acl_handle_exit(void)
56253+{
56254+ u16 id;
56255+ char *rolename;
56256+ struct file *exec_file;
56257+
56258+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
56259+ !(current->role->roletype & GR_ROLE_PERSIST))) {
56260+ id = current->acl_role_id;
56261+ rolename = current->role->rolename;
56262+ gr_set_acls(1);
56263+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
56264+ }
56265+
56266+ write_lock(&grsec_exec_file_lock);
56267+ exec_file = current->exec_file;
56268+ current->exec_file = NULL;
56269+ write_unlock(&grsec_exec_file_lock);
56270+
56271+ if (exec_file)
56272+ fput(exec_file);
56273+}
56274+
56275+int
56276+gr_acl_handle_procpidmem(const struct task_struct *task)
56277+{
56278+ if (unlikely(!gr_acl_is_enabled()))
56279+ return 0;
56280+
56281+ if (task != current && task->acl->mode & GR_PROTPROCFD)
56282+ return -EACCES;
56283+
56284+ return 0;
56285+}
56286diff -urNp linux-2.6.39.2/grsecurity/gracl_ip.c linux-2.6.39.2/grsecurity/gracl_ip.c
56287--- linux-2.6.39.2/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
56288+++ linux-2.6.39.2/grsecurity/gracl_ip.c 2011-05-22 22:47:31.000000000 -0400
56289@@ -0,0 +1,381 @@
56290+#include <linux/kernel.h>
56291+#include <asm/uaccess.h>
56292+#include <asm/errno.h>
56293+#include <net/sock.h>
56294+#include <linux/file.h>
56295+#include <linux/fs.h>
56296+#include <linux/net.h>
56297+#include <linux/in.h>
56298+#include <linux/skbuff.h>
56299+#include <linux/ip.h>
56300+#include <linux/udp.h>
56301+#include <linux/types.h>
56302+#include <linux/sched.h>
56303+#include <linux/netdevice.h>
56304+#include <linux/inetdevice.h>
56305+#include <linux/gracl.h>
56306+#include <linux/grsecurity.h>
56307+#include <linux/grinternal.h>
56308+
56309+#define GR_BIND 0x01
56310+#define GR_CONNECT 0x02
56311+#define GR_INVERT 0x04
56312+#define GR_BINDOVERRIDE 0x08
56313+#define GR_CONNECTOVERRIDE 0x10
56314+#define GR_SOCK_FAMILY 0x20
56315+
56316+static const char * gr_protocols[IPPROTO_MAX] = {
56317+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
56318+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
56319+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
56320+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
56321+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
56322+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
56323+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
56324+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
56325+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
56326+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
56327+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
56328+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
56329+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
56330+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
56331+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
56332+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
56333+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
56334+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
56335+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
56336+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
56337+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
56338+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
56339+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
56340+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
56341+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
56342+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
56343+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
56344+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
56345+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
56346+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
56347+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
56348+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
56349+ };
56350+
56351+static const char * gr_socktypes[SOCK_MAX] = {
56352+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
56353+ "unknown:7", "unknown:8", "unknown:9", "packet"
56354+ };
56355+
56356+static const char * gr_sockfamilies[AF_MAX+1] = {
56357+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
56358+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
56359+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
56360+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
56361+ };
56362+
56363+const char *
56364+gr_proto_to_name(unsigned char proto)
56365+{
56366+ return gr_protocols[proto];
56367+}
56368+
56369+const char *
56370+gr_socktype_to_name(unsigned char type)
56371+{
56372+ return gr_socktypes[type];
56373+}
56374+
56375+const char *
56376+gr_sockfamily_to_name(unsigned char family)
56377+{
56378+ return gr_sockfamilies[family];
56379+}
56380+
56381+int
56382+gr_search_socket(const int domain, const int type, const int protocol)
56383+{
56384+ struct acl_subject_label *curr;
56385+ const struct cred *cred = current_cred();
56386+
56387+ if (unlikely(!gr_acl_is_enabled()))
56388+ goto exit;
56389+
56390+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
56391+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
56392+ goto exit; // let the kernel handle it
56393+
56394+ curr = current->acl;
56395+
56396+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
56397+ /* the family is allowed, if this is PF_INET allow it only if
56398+ the extra sock type/protocol checks pass */
56399+ if (domain == PF_INET)
56400+ goto inet_check;
56401+ goto exit;
56402+ } else {
56403+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56404+ __u32 fakeip = 0;
56405+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56406+ current->role->roletype, cred->uid,
56407+ cred->gid, current->exec_file ?
56408+ gr_to_filename(current->exec_file->f_path.dentry,
56409+ current->exec_file->f_path.mnt) :
56410+ curr->filename, curr->filename,
56411+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
56412+ &current->signal->saved_ip);
56413+ goto exit;
56414+ }
56415+ goto exit_fail;
56416+ }
56417+
56418+inet_check:
56419+ /* the rest of this checking is for IPv4 only */
56420+ if (!curr->ips)
56421+ goto exit;
56422+
56423+ if ((curr->ip_type & (1 << type)) &&
56424+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
56425+ goto exit;
56426+
56427+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56428+ /* we don't place acls on raw sockets , and sometimes
56429+ dgram/ip sockets are opened for ioctl and not
56430+ bind/connect, so we'll fake a bind learn log */
56431+ if (type == SOCK_RAW || type == SOCK_PACKET) {
56432+ __u32 fakeip = 0;
56433+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56434+ current->role->roletype, cred->uid,
56435+ cred->gid, current->exec_file ?
56436+ gr_to_filename(current->exec_file->f_path.dentry,
56437+ current->exec_file->f_path.mnt) :
56438+ curr->filename, curr->filename,
56439+ &fakeip, 0, type,
56440+ protocol, GR_CONNECT, &current->signal->saved_ip);
56441+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
56442+ __u32 fakeip = 0;
56443+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56444+ current->role->roletype, cred->uid,
56445+ cred->gid, current->exec_file ?
56446+ gr_to_filename(current->exec_file->f_path.dentry,
56447+ current->exec_file->f_path.mnt) :
56448+ curr->filename, curr->filename,
56449+ &fakeip, 0, type,
56450+ protocol, GR_BIND, &current->signal->saved_ip);
56451+ }
56452+ /* we'll log when they use connect or bind */
56453+ goto exit;
56454+ }
56455+
56456+exit_fail:
56457+ if (domain == PF_INET)
56458+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
56459+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
56460+ else
56461+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
56462+ gr_socktype_to_name(type), protocol);
56463+
56464+ return 0;
56465+exit:
56466+ return 1;
56467+}
56468+
56469+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
56470+{
56471+ if ((ip->mode & mode) &&
56472+ (ip_port >= ip->low) &&
56473+ (ip_port <= ip->high) &&
56474+ ((ntohl(ip_addr) & our_netmask) ==
56475+ (ntohl(our_addr) & our_netmask))
56476+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
56477+ && (ip->type & (1 << type))) {
56478+ if (ip->mode & GR_INVERT)
56479+ return 2; // specifically denied
56480+ else
56481+ return 1; // allowed
56482+ }
56483+
56484+ return 0; // not specifically allowed, may continue parsing
56485+}
56486+
56487+static int
56488+gr_search_connectbind(const int full_mode, struct sock *sk,
56489+ struct sockaddr_in *addr, const int type)
56490+{
56491+ char iface[IFNAMSIZ] = {0};
56492+ struct acl_subject_label *curr;
56493+ struct acl_ip_label *ip;
56494+ struct inet_sock *isk;
56495+ struct net_device *dev;
56496+ struct in_device *idev;
56497+ unsigned long i;
56498+ int ret;
56499+ int mode = full_mode & (GR_BIND | GR_CONNECT);
56500+ __u32 ip_addr = 0;
56501+ __u32 our_addr;
56502+ __u32 our_netmask;
56503+ char *p;
56504+ __u16 ip_port = 0;
56505+ const struct cred *cred = current_cred();
56506+
56507+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
56508+ return 0;
56509+
56510+ curr = current->acl;
56511+ isk = inet_sk(sk);
56512+
56513+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
56514+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
56515+ addr->sin_addr.s_addr = curr->inaddr_any_override;
56516+ if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
56517+ struct sockaddr_in saddr;
56518+ int err;
56519+
56520+ saddr.sin_family = AF_INET;
56521+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
56522+ saddr.sin_port = isk->inet_sport;
56523+
56524+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56525+ if (err)
56526+ return err;
56527+
56528+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56529+ if (err)
56530+ return err;
56531+ }
56532+
56533+ if (!curr->ips)
56534+ return 0;
56535+
56536+ ip_addr = addr->sin_addr.s_addr;
56537+ ip_port = ntohs(addr->sin_port);
56538+
56539+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56540+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56541+ current->role->roletype, cred->uid,
56542+ cred->gid, current->exec_file ?
56543+ gr_to_filename(current->exec_file->f_path.dentry,
56544+ current->exec_file->f_path.mnt) :
56545+ curr->filename, curr->filename,
56546+ &ip_addr, ip_port, type,
56547+ sk->sk_protocol, mode, &current->signal->saved_ip);
56548+ return 0;
56549+ }
56550+
56551+ for (i = 0; i < curr->ip_num; i++) {
56552+ ip = *(curr->ips + i);
56553+ if (ip->iface != NULL) {
56554+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
56555+ p = strchr(iface, ':');
56556+ if (p != NULL)
56557+ *p = '\0';
56558+ dev = dev_get_by_name(sock_net(sk), iface);
56559+ if (dev == NULL)
56560+ continue;
56561+ idev = in_dev_get(dev);
56562+ if (idev == NULL) {
56563+ dev_put(dev);
56564+ continue;
56565+ }
56566+ rcu_read_lock();
56567+ for_ifa(idev) {
56568+ if (!strcmp(ip->iface, ifa->ifa_label)) {
56569+ our_addr = ifa->ifa_address;
56570+ our_netmask = 0xffffffff;
56571+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56572+ if (ret == 1) {
56573+ rcu_read_unlock();
56574+ in_dev_put(idev);
56575+ dev_put(dev);
56576+ return 0;
56577+ } else if (ret == 2) {
56578+ rcu_read_unlock();
56579+ in_dev_put(idev);
56580+ dev_put(dev);
56581+ goto denied;
56582+ }
56583+ }
56584+ } endfor_ifa(idev);
56585+ rcu_read_unlock();
56586+ in_dev_put(idev);
56587+ dev_put(dev);
56588+ } else {
56589+ our_addr = ip->addr;
56590+ our_netmask = ip->netmask;
56591+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56592+ if (ret == 1)
56593+ return 0;
56594+ else if (ret == 2)
56595+ goto denied;
56596+ }
56597+ }
56598+
56599+denied:
56600+ if (mode == GR_BIND)
56601+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56602+ else if (mode == GR_CONNECT)
56603+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56604+
56605+ return -EACCES;
56606+}
56607+
56608+int
56609+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
56610+{
56611+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
56612+}
56613+
56614+int
56615+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
56616+{
56617+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
56618+}
56619+
56620+int gr_search_listen(struct socket *sock)
56621+{
56622+ struct sock *sk = sock->sk;
56623+ struct sockaddr_in addr;
56624+
56625+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56626+ addr.sin_port = inet_sk(sk)->inet_sport;
56627+
56628+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56629+}
56630+
56631+int gr_search_accept(struct socket *sock)
56632+{
56633+ struct sock *sk = sock->sk;
56634+ struct sockaddr_in addr;
56635+
56636+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56637+ addr.sin_port = inet_sk(sk)->inet_sport;
56638+
56639+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56640+}
56641+
56642+int
56643+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
56644+{
56645+ if (addr)
56646+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
56647+ else {
56648+ struct sockaddr_in sin;
56649+ const struct inet_sock *inet = inet_sk(sk);
56650+
56651+ sin.sin_addr.s_addr = inet->inet_daddr;
56652+ sin.sin_port = inet->inet_dport;
56653+
56654+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56655+ }
56656+}
56657+
56658+int
56659+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
56660+{
56661+ struct sockaddr_in sin;
56662+
56663+ if (unlikely(skb->len < sizeof (struct udphdr)))
56664+ return 0; // skip this packet
56665+
56666+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
56667+ sin.sin_port = udp_hdr(skb)->source;
56668+
56669+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56670+}
56671diff -urNp linux-2.6.39.2/grsecurity/gracl_learn.c linux-2.6.39.2/grsecurity/gracl_learn.c
56672--- linux-2.6.39.2/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
56673+++ linux-2.6.39.2/grsecurity/gracl_learn.c 2011-05-22 22:47:45.000000000 -0400
56674@@ -0,0 +1,210 @@
56675+#include <linux/kernel.h>
56676+#include <linux/mm.h>
56677+#include <linux/sched.h>
56678+#include <linux/poll.h>
56679+#include <linux/string.h>
56680+#include <linux/file.h>
56681+#include <linux/types.h>
56682+#include <linux/vmalloc.h>
56683+#include <linux/grinternal.h>
56684+
56685+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
56686+ size_t count, loff_t *ppos);
56687+extern int gr_acl_is_enabled(void);
56688+
56689+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
56690+static int gr_learn_attached;
56691+
56692+/* use a 512k buffer */
56693+#define LEARN_BUFFER_SIZE (512 * 1024)
56694+
56695+static DEFINE_SPINLOCK(gr_learn_lock);
56696+static DEFINE_MUTEX(gr_learn_user_mutex);
56697+
56698+/* we need to maintain two buffers, so that the kernel context of grlearn
56699+ uses a semaphore around the userspace copying, and the other kernel contexts
56700+ use a spinlock when copying into the buffer, since they cannot sleep
56701+*/
56702+static char *learn_buffer;
56703+static char *learn_buffer_user;
56704+static int learn_buffer_len;
56705+static int learn_buffer_user_len;
56706+
56707+static ssize_t
56708+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
56709+{
56710+ DECLARE_WAITQUEUE(wait, current);
56711+ ssize_t retval = 0;
56712+
56713+ add_wait_queue(&learn_wait, &wait);
56714+ set_current_state(TASK_INTERRUPTIBLE);
56715+ do {
56716+ mutex_lock(&gr_learn_user_mutex);
56717+ spin_lock(&gr_learn_lock);
56718+ if (learn_buffer_len)
56719+ break;
56720+ spin_unlock(&gr_learn_lock);
56721+ mutex_unlock(&gr_learn_user_mutex);
56722+ if (file->f_flags & O_NONBLOCK) {
56723+ retval = -EAGAIN;
56724+ goto out;
56725+ }
56726+ if (signal_pending(current)) {
56727+ retval = -ERESTARTSYS;
56728+ goto out;
56729+ }
56730+
56731+ schedule();
56732+ } while (1);
56733+
56734+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
56735+ learn_buffer_user_len = learn_buffer_len;
56736+ retval = learn_buffer_len;
56737+ learn_buffer_len = 0;
56738+
56739+ spin_unlock(&gr_learn_lock);
56740+
56741+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
56742+ retval = -EFAULT;
56743+
56744+ mutex_unlock(&gr_learn_user_mutex);
56745+out:
56746+ set_current_state(TASK_RUNNING);
56747+ remove_wait_queue(&learn_wait, &wait);
56748+ return retval;
56749+}
56750+
56751+static unsigned int
56752+poll_learn(struct file * file, poll_table * wait)
56753+{
56754+ poll_wait(file, &learn_wait, wait);
56755+
56756+ if (learn_buffer_len)
56757+ return (POLLIN | POLLRDNORM);
56758+
56759+ return 0;
56760+}
56761+
56762+void
56763+gr_clear_learn_entries(void)
56764+{
56765+ char *tmp;
56766+
56767+ mutex_lock(&gr_learn_user_mutex);
56768+ if (learn_buffer != NULL) {
56769+ spin_lock(&gr_learn_lock);
56770+ tmp = learn_buffer;
56771+ learn_buffer = NULL;
56772+ spin_unlock(&gr_learn_lock);
56773+ vfree(learn_buffer);
56774+ }
56775+ if (learn_buffer_user != NULL) {
56776+ vfree(learn_buffer_user);
56777+ learn_buffer_user = NULL;
56778+ }
56779+ learn_buffer_len = 0;
56780+ mutex_unlock(&gr_learn_user_mutex);
56781+
56782+ return;
56783+}
56784+
56785+void
56786+gr_add_learn_entry(const char *fmt, ...)
56787+{
56788+ va_list args;
56789+ unsigned int len;
56790+
56791+ if (!gr_learn_attached)
56792+ return;
56793+
56794+ spin_lock(&gr_learn_lock);
56795+
56796+ /* leave a gap at the end so we know when it's "full" but don't have to
56797+ compute the exact length of the string we're trying to append
56798+ */
56799+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56800+ spin_unlock(&gr_learn_lock);
56801+ wake_up_interruptible(&learn_wait);
56802+ return;
56803+ }
56804+ if (learn_buffer == NULL) {
56805+ spin_unlock(&gr_learn_lock);
56806+ return;
56807+ }
56808+
56809+ va_start(args, fmt);
56810+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56811+ va_end(args);
56812+
56813+ learn_buffer_len += len + 1;
56814+
56815+ spin_unlock(&gr_learn_lock);
56816+ wake_up_interruptible(&learn_wait);
56817+
56818+ return;
56819+}
56820+
56821+static int
56822+open_learn(struct inode *inode, struct file *file)
56823+{
56824+ if (file->f_mode & FMODE_READ && gr_learn_attached)
56825+ return -EBUSY;
56826+ if (file->f_mode & FMODE_READ) {
56827+ int retval = 0;
56828+ mutex_lock(&gr_learn_user_mutex);
56829+ if (learn_buffer == NULL)
56830+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56831+ if (learn_buffer_user == NULL)
56832+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56833+ if (learn_buffer == NULL) {
56834+ retval = -ENOMEM;
56835+ goto out_error;
56836+ }
56837+ if (learn_buffer_user == NULL) {
56838+ retval = -ENOMEM;
56839+ goto out_error;
56840+ }
56841+ learn_buffer_len = 0;
56842+ learn_buffer_user_len = 0;
56843+ gr_learn_attached = 1;
56844+out_error:
56845+ mutex_unlock(&gr_learn_user_mutex);
56846+ return retval;
56847+ }
56848+ return 0;
56849+}
56850+
56851+static int
56852+close_learn(struct inode *inode, struct file *file)
56853+{
56854+ char *tmp;
56855+
56856+ if (file->f_mode & FMODE_READ) {
56857+ mutex_lock(&gr_learn_user_mutex);
56858+ if (learn_buffer != NULL) {
56859+ spin_lock(&gr_learn_lock);
56860+ tmp = learn_buffer;
56861+ learn_buffer = NULL;
56862+ spin_unlock(&gr_learn_lock);
56863+ vfree(tmp);
56864+ }
56865+ if (learn_buffer_user != NULL) {
56866+ vfree(learn_buffer_user);
56867+ learn_buffer_user = NULL;
56868+ }
56869+ learn_buffer_len = 0;
56870+ learn_buffer_user_len = 0;
56871+ gr_learn_attached = 0;
56872+ mutex_unlock(&gr_learn_user_mutex);
56873+ }
56874+
56875+ return 0;
56876+}
56877+
56878+const struct file_operations grsec_fops = {
56879+ .read = read_learn,
56880+ .write = write_grsec_handler,
56881+ .open = open_learn,
56882+ .release = close_learn,
56883+ .poll = poll_learn,
56884+};
56885diff -urNp linux-2.6.39.2/grsecurity/gracl_res.c linux-2.6.39.2/grsecurity/gracl_res.c
56886--- linux-2.6.39.2/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
56887+++ linux-2.6.39.2/grsecurity/gracl_res.c 2011-05-22 19:41:42.000000000 -0400
56888@@ -0,0 +1,68 @@
56889+#include <linux/kernel.h>
56890+#include <linux/sched.h>
56891+#include <linux/gracl.h>
56892+#include <linux/grinternal.h>
56893+
56894+static const char *restab_log[] = {
56895+ [RLIMIT_CPU] = "RLIMIT_CPU",
56896+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56897+ [RLIMIT_DATA] = "RLIMIT_DATA",
56898+ [RLIMIT_STACK] = "RLIMIT_STACK",
56899+ [RLIMIT_CORE] = "RLIMIT_CORE",
56900+ [RLIMIT_RSS] = "RLIMIT_RSS",
56901+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
56902+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56903+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56904+ [RLIMIT_AS] = "RLIMIT_AS",
56905+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56906+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56907+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56908+ [RLIMIT_NICE] = "RLIMIT_NICE",
56909+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56910+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56911+ [GR_CRASH_RES] = "RLIMIT_CRASH"
56912+};
56913+
56914+void
56915+gr_log_resource(const struct task_struct *task,
56916+ const int res, const unsigned long wanted, const int gt)
56917+{
56918+ const struct cred *cred;
56919+ unsigned long rlim;
56920+
56921+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
56922+ return;
56923+
56924+ // not yet supported resource
56925+ if (unlikely(!restab_log[res]))
56926+ return;
56927+
56928+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56929+ rlim = task_rlimit_max(task, res);
56930+ else
56931+ rlim = task_rlimit(task, res);
56932+
56933+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56934+ return;
56935+
56936+ rcu_read_lock();
56937+ cred = __task_cred(task);
56938+
56939+ if (res == RLIMIT_NPROC &&
56940+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56941+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56942+ goto out_rcu_unlock;
56943+ else if (res == RLIMIT_MEMLOCK &&
56944+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56945+ goto out_rcu_unlock;
56946+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56947+ goto out_rcu_unlock;
56948+ rcu_read_unlock();
56949+
56950+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56951+
56952+ return;
56953+out_rcu_unlock:
56954+ rcu_read_unlock();
56955+ return;
56956+}
56957diff -urNp linux-2.6.39.2/grsecurity/gracl_segv.c linux-2.6.39.2/grsecurity/gracl_segv.c
56958--- linux-2.6.39.2/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
56959+++ linux-2.6.39.2/grsecurity/gracl_segv.c 2011-05-22 22:47:39.000000000 -0400
56960@@ -0,0 +1,299 @@
56961+#include <linux/kernel.h>
56962+#include <linux/mm.h>
56963+#include <asm/uaccess.h>
56964+#include <asm/errno.h>
56965+#include <asm/mman.h>
56966+#include <net/sock.h>
56967+#include <linux/file.h>
56968+#include <linux/fs.h>
56969+#include <linux/net.h>
56970+#include <linux/in.h>
56971+#include <linux/slab.h>
56972+#include <linux/types.h>
56973+#include <linux/sched.h>
56974+#include <linux/timer.h>
56975+#include <linux/gracl.h>
56976+#include <linux/grsecurity.h>
56977+#include <linux/grinternal.h>
56978+
56979+static struct crash_uid *uid_set;
56980+static unsigned short uid_used;
56981+static DEFINE_SPINLOCK(gr_uid_lock);
56982+extern rwlock_t gr_inode_lock;
56983+extern struct acl_subject_label *
56984+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56985+ struct acl_role_label *role);
56986+
56987+#ifdef CONFIG_BTRFS_FS
56988+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56989+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56990+#endif
56991+
56992+static inline dev_t __get_dev(const struct dentry *dentry)
56993+{
56994+#ifdef CONFIG_BTRFS_FS
56995+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56996+ return get_btrfs_dev_from_inode(dentry->d_inode);
56997+ else
56998+#endif
56999+ return dentry->d_inode->i_sb->s_dev;
57000+}
57001+
57002+int
57003+gr_init_uidset(void)
57004+{
57005+ uid_set =
57006+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
57007+ uid_used = 0;
57008+
57009+ return uid_set ? 1 : 0;
57010+}
57011+
57012+void
57013+gr_free_uidset(void)
57014+{
57015+ if (uid_set)
57016+ kfree(uid_set);
57017+
57018+ return;
57019+}
57020+
57021+int
57022+gr_find_uid(const uid_t uid)
57023+{
57024+ struct crash_uid *tmp = uid_set;
57025+ uid_t buid;
57026+ int low = 0, high = uid_used - 1, mid;
57027+
57028+ while (high >= low) {
57029+ mid = (low + high) >> 1;
57030+ buid = tmp[mid].uid;
57031+ if (buid == uid)
57032+ return mid;
57033+ if (buid > uid)
57034+ high = mid - 1;
57035+ if (buid < uid)
57036+ low = mid + 1;
57037+ }
57038+
57039+ return -1;
57040+}
57041+
57042+static __inline__ void
57043+gr_insertsort(void)
57044+{
57045+ unsigned short i, j;
57046+ struct crash_uid index;
57047+
57048+ for (i = 1; i < uid_used; i++) {
57049+ index = uid_set[i];
57050+ j = i;
57051+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
57052+ uid_set[j] = uid_set[j - 1];
57053+ j--;
57054+ }
57055+ uid_set[j] = index;
57056+ }
57057+
57058+ return;
57059+}
57060+
57061+static __inline__ void
57062+gr_insert_uid(const uid_t uid, const unsigned long expires)
57063+{
57064+ int loc;
57065+
57066+ if (uid_used == GR_UIDTABLE_MAX)
57067+ return;
57068+
57069+ loc = gr_find_uid(uid);
57070+
57071+ if (loc >= 0) {
57072+ uid_set[loc].expires = expires;
57073+ return;
57074+ }
57075+
57076+ uid_set[uid_used].uid = uid;
57077+ uid_set[uid_used].expires = expires;
57078+ uid_used++;
57079+
57080+ gr_insertsort();
57081+
57082+ return;
57083+}
57084+
57085+void
57086+gr_remove_uid(const unsigned short loc)
57087+{
57088+ unsigned short i;
57089+
57090+ for (i = loc + 1; i < uid_used; i++)
57091+ uid_set[i - 1] = uid_set[i];
57092+
57093+ uid_used--;
57094+
57095+ return;
57096+}
57097+
57098+int
57099+gr_check_crash_uid(const uid_t uid)
57100+{
57101+ int loc;
57102+ int ret = 0;
57103+
57104+ if (unlikely(!gr_acl_is_enabled()))
57105+ return 0;
57106+
57107+ spin_lock(&gr_uid_lock);
57108+ loc = gr_find_uid(uid);
57109+
57110+ if (loc < 0)
57111+ goto out_unlock;
57112+
57113+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
57114+ gr_remove_uid(loc);
57115+ else
57116+ ret = 1;
57117+
57118+out_unlock:
57119+ spin_unlock(&gr_uid_lock);
57120+ return ret;
57121+}
57122+
57123+static __inline__ int
57124+proc_is_setxid(const struct cred *cred)
57125+{
57126+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
57127+ cred->uid != cred->fsuid)
57128+ return 1;
57129+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
57130+ cred->gid != cred->fsgid)
57131+ return 1;
57132+
57133+ return 0;
57134+}
57135+
57136+extern int gr_fake_force_sig(int sig, struct task_struct *t);
57137+
57138+void
57139+gr_handle_crash(struct task_struct *task, const int sig)
57140+{
57141+ struct acl_subject_label *curr;
57142+ struct acl_subject_label *curr2;
57143+ struct task_struct *tsk, *tsk2;
57144+ const struct cred *cred;
57145+ const struct cred *cred2;
57146+
57147+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
57148+ return;
57149+
57150+ if (unlikely(!gr_acl_is_enabled()))
57151+ return;
57152+
57153+ curr = task->acl;
57154+
57155+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
57156+ return;
57157+
57158+ if (time_before_eq(curr->expires, get_seconds())) {
57159+ curr->expires = 0;
57160+ curr->crashes = 0;
57161+ }
57162+
57163+ curr->crashes++;
57164+
57165+ if (!curr->expires)
57166+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
57167+
57168+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57169+ time_after(curr->expires, get_seconds())) {
57170+ rcu_read_lock();
57171+ cred = __task_cred(task);
57172+ if (cred->uid && proc_is_setxid(cred)) {
57173+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57174+ spin_lock(&gr_uid_lock);
57175+ gr_insert_uid(cred->uid, curr->expires);
57176+ spin_unlock(&gr_uid_lock);
57177+ curr->expires = 0;
57178+ curr->crashes = 0;
57179+ read_lock(&tasklist_lock);
57180+ do_each_thread(tsk2, tsk) {
57181+ cred2 = __task_cred(tsk);
57182+ if (tsk != task && cred2->uid == cred->uid)
57183+ gr_fake_force_sig(SIGKILL, tsk);
57184+ } while_each_thread(tsk2, tsk);
57185+ read_unlock(&tasklist_lock);
57186+ } else {
57187+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57188+ read_lock(&tasklist_lock);
57189+ do_each_thread(tsk2, tsk) {
57190+ if (likely(tsk != task)) {
57191+ curr2 = tsk->acl;
57192+
57193+ if (curr2->device == curr->device &&
57194+ curr2->inode == curr->inode)
57195+ gr_fake_force_sig(SIGKILL, tsk);
57196+ }
57197+ } while_each_thread(tsk2, tsk);
57198+ read_unlock(&tasklist_lock);
57199+ }
57200+ rcu_read_unlock();
57201+ }
57202+
57203+ return;
57204+}
57205+
57206+int
57207+gr_check_crash_exec(const struct file *filp)
57208+{
57209+ struct acl_subject_label *curr;
57210+
57211+ if (unlikely(!gr_acl_is_enabled()))
57212+ return 0;
57213+
57214+ read_lock(&gr_inode_lock);
57215+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
57216+ __get_dev(filp->f_path.dentry),
57217+ current->role);
57218+ read_unlock(&gr_inode_lock);
57219+
57220+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
57221+ (!curr->crashes && !curr->expires))
57222+ return 0;
57223+
57224+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57225+ time_after(curr->expires, get_seconds()))
57226+ return 1;
57227+ else if (time_before_eq(curr->expires, get_seconds())) {
57228+ curr->crashes = 0;
57229+ curr->expires = 0;
57230+ }
57231+
57232+ return 0;
57233+}
57234+
57235+void
57236+gr_handle_alertkill(struct task_struct *task)
57237+{
57238+ struct acl_subject_label *curracl;
57239+ __u32 curr_ip;
57240+ struct task_struct *p, *p2;
57241+
57242+ if (unlikely(!gr_acl_is_enabled()))
57243+ return;
57244+
57245+ curracl = task->acl;
57246+ curr_ip = task->signal->curr_ip;
57247+
57248+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
57249+ read_lock(&tasklist_lock);
57250+ do_each_thread(p2, p) {
57251+ if (p->signal->curr_ip == curr_ip)
57252+ gr_fake_force_sig(SIGKILL, p);
57253+ } while_each_thread(p2, p);
57254+ read_unlock(&tasklist_lock);
57255+ } else if (curracl->mode & GR_KILLPROC)
57256+ gr_fake_force_sig(SIGKILL, task);
57257+
57258+ return;
57259+}
57260diff -urNp linux-2.6.39.2/grsecurity/gracl_shm.c linux-2.6.39.2/grsecurity/gracl_shm.c
57261--- linux-2.6.39.2/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
57262+++ linux-2.6.39.2/grsecurity/gracl_shm.c 2011-05-22 19:41:42.000000000 -0400
57263@@ -0,0 +1,40 @@
57264+#include <linux/kernel.h>
57265+#include <linux/mm.h>
57266+#include <linux/sched.h>
57267+#include <linux/file.h>
57268+#include <linux/ipc.h>
57269+#include <linux/gracl.h>
57270+#include <linux/grsecurity.h>
57271+#include <linux/grinternal.h>
57272+
57273+int
57274+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57275+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57276+{
57277+ struct task_struct *task;
57278+
57279+ if (!gr_acl_is_enabled())
57280+ return 1;
57281+
57282+ rcu_read_lock();
57283+ read_lock(&tasklist_lock);
57284+
57285+ task = find_task_by_vpid(shm_cprid);
57286+
57287+ if (unlikely(!task))
57288+ task = find_task_by_vpid(shm_lapid);
57289+
57290+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
57291+ (task->pid == shm_lapid)) &&
57292+ (task->acl->mode & GR_PROTSHM) &&
57293+ (task->acl != current->acl))) {
57294+ read_unlock(&tasklist_lock);
57295+ rcu_read_unlock();
57296+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
57297+ return 0;
57298+ }
57299+ read_unlock(&tasklist_lock);
57300+ rcu_read_unlock();
57301+
57302+ return 1;
57303+}
57304diff -urNp linux-2.6.39.2/grsecurity/grsec_chdir.c linux-2.6.39.2/grsecurity/grsec_chdir.c
57305--- linux-2.6.39.2/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
57306+++ linux-2.6.39.2/grsecurity/grsec_chdir.c 2011-05-22 19:41:42.000000000 -0400
57307@@ -0,0 +1,19 @@
57308+#include <linux/kernel.h>
57309+#include <linux/sched.h>
57310+#include <linux/fs.h>
57311+#include <linux/file.h>
57312+#include <linux/grsecurity.h>
57313+#include <linux/grinternal.h>
57314+
57315+void
57316+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
57317+{
57318+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57319+ if ((grsec_enable_chdir && grsec_enable_group &&
57320+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
57321+ !grsec_enable_group)) {
57322+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
57323+ }
57324+#endif
57325+ return;
57326+}
57327diff -urNp linux-2.6.39.2/grsecurity/grsec_chroot.c linux-2.6.39.2/grsecurity/grsec_chroot.c
57328--- linux-2.6.39.2/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
57329+++ linux-2.6.39.2/grsecurity/grsec_chroot.c 2011-06-20 19:44:48.000000000 -0400
57330@@ -0,0 +1,355 @@
57331+#include <linux/kernel.h>
57332+#include <linux/module.h>
57333+#include <linux/sched.h>
57334+#include <linux/file.h>
57335+#include <linux/fs.h>
57336+#include <linux/mount.h>
57337+#include <linux/types.h>
57338+#include <linux/pid_namespace.h>
57339+#include <linux/grsecurity.h>
57340+#include <linux/grinternal.h>
57341+
57342+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
57343+{
57344+#ifdef CONFIG_GRKERNSEC
57345+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
57346+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
57347+ task->gr_is_chrooted = 1;
57348+ else
57349+ task->gr_is_chrooted = 0;
57350+
57351+ task->gr_chroot_dentry = path->dentry;
57352+#endif
57353+ return;
57354+}
57355+
57356+void gr_clear_chroot_entries(struct task_struct *task)
57357+{
57358+#ifdef CONFIG_GRKERNSEC
57359+ task->gr_is_chrooted = 0;
57360+ task->gr_chroot_dentry = NULL;
57361+#endif
57362+ return;
57363+}
57364+
57365+int
57366+gr_handle_chroot_unix(struct pid *pid)
57367+{
57368+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57369+ struct task_struct *p;
57370+
57371+ if (unlikely(!grsec_enable_chroot_unix))
57372+ return 1;
57373+
57374+ if (likely(!proc_is_chrooted(current)))
57375+ return 1;
57376+
57377+ rcu_read_lock();
57378+ read_lock(&tasklist_lock);
57379+ p = pid_task(pid, PIDTYPE_PID);
57380+ if (unlikely(p && !have_same_root(current, p))) {
57381+ read_unlock(&tasklist_lock);
57382+ rcu_read_unlock();
57383+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
57384+ return 0;
57385+ }
57386+ read_unlock(&tasklist_lock);
57387+ rcu_read_unlock();
57388+#endif
57389+ return 1;
57390+}
57391+
57392+int
57393+gr_handle_chroot_nice(void)
57394+{
57395+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57396+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
57397+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
57398+ return -EPERM;
57399+ }
57400+#endif
57401+ return 0;
57402+}
57403+
57404+int
57405+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
57406+{
57407+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57408+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
57409+ && proc_is_chrooted(current)) {
57410+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
57411+ return -EACCES;
57412+ }
57413+#endif
57414+ return 0;
57415+}
57416+
57417+int
57418+gr_handle_chroot_rawio(const struct inode *inode)
57419+{
57420+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57421+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
57422+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
57423+ return 1;
57424+#endif
57425+ return 0;
57426+}
57427+
57428+int
57429+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
57430+{
57431+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57432+ struct task_struct *p;
57433+ int ret = 0;
57434+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
57435+ return ret;
57436+
57437+ read_lock(&tasklist_lock);
57438+ do_each_pid_task(pid, type, p) {
57439+ if (!have_same_root(current, p)) {
57440+ ret = 1;
57441+ goto out;
57442+ }
57443+ } while_each_pid_task(pid, type, p);
57444+out:
57445+ read_unlock(&tasklist_lock);
57446+ return ret;
57447+#endif
57448+ return 0;
57449+}
57450+
57451+int
57452+gr_pid_is_chrooted(struct task_struct *p)
57453+{
57454+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57455+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
57456+ return 0;
57457+
57458+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
57459+ !have_same_root(current, p)) {
57460+ return 1;
57461+ }
57462+#endif
57463+ return 0;
57464+}
57465+
57466+EXPORT_SYMBOL(gr_pid_is_chrooted);
57467+
57468+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
57469+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
57470+{
57471+ struct path path, currentroot;
57472+ int ret = 0;
57473+
57474+ path.dentry = (struct dentry *)u_dentry;
57475+ path.mnt = (struct vfsmount *)u_mnt;
57476+ get_fs_root(current->fs, &currentroot);
57477+ if (path_is_under(&path, &currentroot))
57478+ ret = 1;
57479+ path_put(&currentroot);
57480+
57481+ return ret;
57482+}
57483+#endif
57484+
57485+int
57486+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
57487+{
57488+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57489+ if (!grsec_enable_chroot_fchdir)
57490+ return 1;
57491+
57492+ if (!proc_is_chrooted(current))
57493+ return 1;
57494+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
57495+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
57496+ return 0;
57497+ }
57498+#endif
57499+ return 1;
57500+}
57501+
57502+int
57503+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57504+ const time_t shm_createtime)
57505+{
57506+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57507+ struct pid *pid = NULL;
57508+ time_t starttime;
57509+
57510+ if (unlikely(!grsec_enable_chroot_shmat))
57511+ return 1;
57512+
57513+ if (likely(!proc_is_chrooted(current)))
57514+ return 1;
57515+
57516+ rcu_read_lock();
57517+ read_lock(&tasklist_lock);
57518+
57519+ pid = find_vpid(shm_cprid);
57520+ if (pid) {
57521+ struct task_struct *p;
57522+ p = pid_task(pid, PIDTYPE_PID);
57523+ if (p == NULL)
57524+ goto unlock;
57525+ starttime = p->start_time.tv_sec;
57526+ if (unlikely(!have_same_root(current, p) &&
57527+ time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
57528+ read_unlock(&tasklist_lock);
57529+ rcu_read_unlock();
57530+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57531+ return 0;
57532+ }
57533+ } else {
57534+ pid = find_vpid(shm_lapid);
57535+ if (pid) {
57536+ struct task_struct *p;
57537+ p = pid_task(pid, PIDTYPE_PID);
57538+ if (p == NULL)
57539+ goto unlock;
57540+ if (unlikely(!have_same_root(current, p))) {
57541+ read_unlock(&tasklist_lock);
57542+ rcu_read_unlock();
57543+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57544+ return 0;
57545+ }
57546+ }
57547+ }
57548+unlock:
57549+ read_unlock(&tasklist_lock);
57550+ rcu_read_unlock();
57551+#endif
57552+ return 1;
57553+}
57554+
57555+void
57556+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
57557+{
57558+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57559+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
57560+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
57561+#endif
57562+ return;
57563+}
57564+
57565+int
57566+gr_handle_chroot_mknod(const struct dentry *dentry,
57567+ const struct vfsmount *mnt, const int mode)
57568+{
57569+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57570+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
57571+ proc_is_chrooted(current)) {
57572+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
57573+ return -EPERM;
57574+ }
57575+#endif
57576+ return 0;
57577+}
57578+
57579+int
57580+gr_handle_chroot_mount(const struct dentry *dentry,
57581+ const struct vfsmount *mnt, const char *dev_name)
57582+{
57583+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57584+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
57585+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
57586+ return -EPERM;
57587+ }
57588+#endif
57589+ return 0;
57590+}
57591+
57592+int
57593+gr_handle_chroot_pivot(void)
57594+{
57595+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57596+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
57597+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
57598+ return -EPERM;
57599+ }
57600+#endif
57601+ return 0;
57602+}
57603+
57604+int
57605+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
57606+{
57607+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57608+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
57609+ !gr_is_outside_chroot(dentry, mnt)) {
57610+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
57611+ return -EPERM;
57612+ }
57613+#endif
57614+ return 0;
57615+}
57616+
57617+int
57618+gr_handle_chroot_caps(struct path *path)
57619+{
57620+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57621+ if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
57622+ (init_task.fs->root.dentry != path->dentry) &&
57623+ (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
57624+
57625+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57626+ const struct cred *old = current_cred();
57627+ struct cred *new = prepare_creds();
57628+ if (new == NULL)
57629+ return 1;
57630+
57631+ new->cap_permitted = cap_drop(old->cap_permitted,
57632+ chroot_caps);
57633+ new->cap_inheritable = cap_drop(old->cap_inheritable,
57634+ chroot_caps);
57635+ new->cap_effective = cap_drop(old->cap_effective,
57636+ chroot_caps);
57637+
57638+ commit_creds(new);
57639+
57640+ return 0;
57641+ }
57642+#endif
57643+ return 0;
57644+}
57645+
57646+int
57647+gr_handle_chroot_sysctl(const int op)
57648+{
57649+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57650+ if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
57651+ proc_is_chrooted(current))
57652+ return -EACCES;
57653+#endif
57654+ return 0;
57655+}
57656+
57657+void
57658+gr_handle_chroot_chdir(struct path *path)
57659+{
57660+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57661+ if (grsec_enable_chroot_chdir)
57662+ set_fs_pwd(current->fs, path);
57663+#endif
57664+ return;
57665+}
57666+
57667+int
57668+gr_handle_chroot_chmod(const struct dentry *dentry,
57669+ const struct vfsmount *mnt, const int mode)
57670+{
57671+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57672+ /* allow chmod +s on directories, but not files */
57673+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
57674+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
57675+ proc_is_chrooted(current)) {
57676+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
57677+ return -EPERM;
57678+ }
57679+#endif
57680+ return 0;
57681+}
57682+
57683+#ifdef CONFIG_SECURITY
57684+EXPORT_SYMBOL(gr_handle_chroot_caps);
57685+#endif
57686diff -urNp linux-2.6.39.2/grsecurity/grsec_disabled.c linux-2.6.39.2/grsecurity/grsec_disabled.c
57687--- linux-2.6.39.2/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
57688+++ linux-2.6.39.2/grsecurity/grsec_disabled.c 2011-05-22 19:41:42.000000000 -0400
57689@@ -0,0 +1,447 @@
57690+#include <linux/kernel.h>
57691+#include <linux/module.h>
57692+#include <linux/sched.h>
57693+#include <linux/file.h>
57694+#include <linux/fs.h>
57695+#include <linux/kdev_t.h>
57696+#include <linux/net.h>
57697+#include <linux/in.h>
57698+#include <linux/ip.h>
57699+#include <linux/skbuff.h>
57700+#include <linux/sysctl.h>
57701+
57702+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57703+void
57704+pax_set_initial_flags(struct linux_binprm *bprm)
57705+{
57706+ return;
57707+}
57708+#endif
57709+
57710+#ifdef CONFIG_SYSCTL
57711+__u32
57712+gr_handle_sysctl(const struct ctl_table * table, const int op)
57713+{
57714+ return 0;
57715+}
57716+#endif
57717+
57718+#ifdef CONFIG_TASKSTATS
57719+int gr_is_taskstats_denied(int pid)
57720+{
57721+ return 0;
57722+}
57723+#endif
57724+
57725+int
57726+gr_acl_is_enabled(void)
57727+{
57728+ return 0;
57729+}
57730+
57731+int
57732+gr_handle_rawio(const struct inode *inode)
57733+{
57734+ return 0;
57735+}
57736+
57737+void
57738+gr_acl_handle_psacct(struct task_struct *task, const long code)
57739+{
57740+ return;
57741+}
57742+
57743+int
57744+gr_handle_ptrace(struct task_struct *task, const long request)
57745+{
57746+ return 0;
57747+}
57748+
57749+int
57750+gr_handle_proc_ptrace(struct task_struct *task)
57751+{
57752+ return 0;
57753+}
57754+
57755+void
57756+gr_learn_resource(const struct task_struct *task,
57757+ const int res, const unsigned long wanted, const int gt)
57758+{
57759+ return;
57760+}
57761+
57762+int
57763+gr_set_acls(const int type)
57764+{
57765+ return 0;
57766+}
57767+
57768+int
57769+gr_check_hidden_task(const struct task_struct *tsk)
57770+{
57771+ return 0;
57772+}
57773+
57774+int
57775+gr_check_protected_task(const struct task_struct *task)
57776+{
57777+ return 0;
57778+}
57779+
57780+int
57781+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57782+{
57783+ return 0;
57784+}
57785+
57786+void
57787+gr_copy_label(struct task_struct *tsk)
57788+{
57789+ return;
57790+}
57791+
57792+void
57793+gr_set_pax_flags(struct task_struct *task)
57794+{
57795+ return;
57796+}
57797+
57798+int
57799+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57800+ const int unsafe_share)
57801+{
57802+ return 0;
57803+}
57804+
57805+void
57806+gr_handle_delete(const ino_t ino, const dev_t dev)
57807+{
57808+ return;
57809+}
57810+
57811+void
57812+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57813+{
57814+ return;
57815+}
57816+
57817+void
57818+gr_handle_crash(struct task_struct *task, const int sig)
57819+{
57820+ return;
57821+}
57822+
57823+int
57824+gr_check_crash_exec(const struct file *filp)
57825+{
57826+ return 0;
57827+}
57828+
57829+int
57830+gr_check_crash_uid(const uid_t uid)
57831+{
57832+ return 0;
57833+}
57834+
57835+void
57836+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57837+ struct dentry *old_dentry,
57838+ struct dentry *new_dentry,
57839+ struct vfsmount *mnt, const __u8 replace)
57840+{
57841+ return;
57842+}
57843+
57844+int
57845+gr_search_socket(const int family, const int type, const int protocol)
57846+{
57847+ return 1;
57848+}
57849+
57850+int
57851+gr_search_connectbind(const int mode, const struct socket *sock,
57852+ const struct sockaddr_in *addr)
57853+{
57854+ return 0;
57855+}
57856+
57857+int
57858+gr_is_capable(const int cap)
57859+{
57860+ return 1;
57861+}
57862+
57863+int
57864+gr_is_capable_nolog(const int cap)
57865+{
57866+ return 1;
57867+}
57868+
57869+void
57870+gr_handle_alertkill(struct task_struct *task)
57871+{
57872+ return;
57873+}
57874+
57875+__u32
57876+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57877+{
57878+ return 1;
57879+}
57880+
57881+__u32
57882+gr_acl_handle_hidden_file(const struct dentry * dentry,
57883+ const struct vfsmount * mnt)
57884+{
57885+ return 1;
57886+}
57887+
57888+__u32
57889+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57890+ const int fmode)
57891+{
57892+ return 1;
57893+}
57894+
57895+__u32
57896+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57897+{
57898+ return 1;
57899+}
57900+
57901+__u32
57902+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57903+{
57904+ return 1;
57905+}
57906+
57907+int
57908+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57909+ unsigned int *vm_flags)
57910+{
57911+ return 1;
57912+}
57913+
57914+__u32
57915+gr_acl_handle_truncate(const struct dentry * dentry,
57916+ const struct vfsmount * mnt)
57917+{
57918+ return 1;
57919+}
57920+
57921+__u32
57922+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57923+{
57924+ return 1;
57925+}
57926+
57927+__u32
57928+gr_acl_handle_access(const struct dentry * dentry,
57929+ const struct vfsmount * mnt, const int fmode)
57930+{
57931+ return 1;
57932+}
57933+
57934+__u32
57935+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57936+ mode_t mode)
57937+{
57938+ return 1;
57939+}
57940+
57941+__u32
57942+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57943+ mode_t mode)
57944+{
57945+ return 1;
57946+}
57947+
57948+__u32
57949+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57950+{
57951+ return 1;
57952+}
57953+
57954+__u32
57955+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57956+{
57957+ return 1;
57958+}
57959+
57960+void
57961+grsecurity_init(void)
57962+{
57963+ return;
57964+}
57965+
57966+__u32
57967+gr_acl_handle_mknod(const struct dentry * new_dentry,
57968+ const struct dentry * parent_dentry,
57969+ const struct vfsmount * parent_mnt,
57970+ const int mode)
57971+{
57972+ return 1;
57973+}
57974+
57975+__u32
57976+gr_acl_handle_mkdir(const struct dentry * new_dentry,
57977+ const struct dentry * parent_dentry,
57978+ const struct vfsmount * parent_mnt)
57979+{
57980+ return 1;
57981+}
57982+
57983+__u32
57984+gr_acl_handle_symlink(const struct dentry * new_dentry,
57985+ const struct dentry * parent_dentry,
57986+ const struct vfsmount * parent_mnt, const char *from)
57987+{
57988+ return 1;
57989+}
57990+
57991+__u32
57992+gr_acl_handle_link(const struct dentry * new_dentry,
57993+ const struct dentry * parent_dentry,
57994+ const struct vfsmount * parent_mnt,
57995+ const struct dentry * old_dentry,
57996+ const struct vfsmount * old_mnt, const char *to)
57997+{
57998+ return 1;
57999+}
58000+
58001+int
58002+gr_acl_handle_rename(const struct dentry *new_dentry,
58003+ const struct dentry *parent_dentry,
58004+ const struct vfsmount *parent_mnt,
58005+ const struct dentry *old_dentry,
58006+ const struct inode *old_parent_inode,
58007+ const struct vfsmount *old_mnt, const char *newname)
58008+{
58009+ return 0;
58010+}
58011+
58012+int
58013+gr_acl_handle_filldir(const struct file *file, const char *name,
58014+ const int namelen, const ino_t ino)
58015+{
58016+ return 1;
58017+}
58018+
58019+int
58020+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
58021+ const time_t shm_createtime, const uid_t cuid, const int shmid)
58022+{
58023+ return 1;
58024+}
58025+
58026+int
58027+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
58028+{
58029+ return 0;
58030+}
58031+
58032+int
58033+gr_search_accept(const struct socket *sock)
58034+{
58035+ return 0;
58036+}
58037+
58038+int
58039+gr_search_listen(const struct socket *sock)
58040+{
58041+ return 0;
58042+}
58043+
58044+int
58045+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
58046+{
58047+ return 0;
58048+}
58049+
58050+__u32
58051+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
58052+{
58053+ return 1;
58054+}
58055+
58056+__u32
58057+gr_acl_handle_creat(const struct dentry * dentry,
58058+ const struct dentry * p_dentry,
58059+ const struct vfsmount * p_mnt, const int fmode,
58060+ const int imode)
58061+{
58062+ return 1;
58063+}
58064+
58065+void
58066+gr_acl_handle_exit(void)
58067+{
58068+ return;
58069+}
58070+
58071+int
58072+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
58073+{
58074+ return 1;
58075+}
58076+
58077+void
58078+gr_set_role_label(const uid_t uid, const gid_t gid)
58079+{
58080+ return;
58081+}
58082+
58083+int
58084+gr_acl_handle_procpidmem(const struct task_struct *task)
58085+{
58086+ return 0;
58087+}
58088+
58089+int
58090+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
58091+{
58092+ return 0;
58093+}
58094+
58095+int
58096+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
58097+{
58098+ return 0;
58099+}
58100+
58101+void
58102+gr_set_kernel_label(struct task_struct *task)
58103+{
58104+ return;
58105+}
58106+
58107+int
58108+gr_check_user_change(int real, int effective, int fs)
58109+{
58110+ return 0;
58111+}
58112+
58113+int
58114+gr_check_group_change(int real, int effective, int fs)
58115+{
58116+ return 0;
58117+}
58118+
58119+int gr_acl_enable_at_secure(void)
58120+{
58121+ return 0;
58122+}
58123+
58124+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
58125+{
58126+ return dentry->d_inode->i_sb->s_dev;
58127+}
58128+
58129+EXPORT_SYMBOL(gr_is_capable);
58130+EXPORT_SYMBOL(gr_is_capable_nolog);
58131+EXPORT_SYMBOL(gr_learn_resource);
58132+EXPORT_SYMBOL(gr_set_kernel_label);
58133+#ifdef CONFIG_SECURITY
58134+EXPORT_SYMBOL(gr_check_user_change);
58135+EXPORT_SYMBOL(gr_check_group_change);
58136+#endif
58137diff -urNp linux-2.6.39.2/grsecurity/grsec_exec.c linux-2.6.39.2/grsecurity/grsec_exec.c
58138--- linux-2.6.39.2/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
58139+++ linux-2.6.39.2/grsecurity/grsec_exec.c 2011-05-22 22:41:29.000000000 -0400
58140@@ -0,0 +1,146 @@
58141+#include <linux/kernel.h>
58142+#include <linux/sched.h>
58143+#include <linux/file.h>
58144+#include <linux/binfmts.h>
58145+#include <linux/fs.h>
58146+#include <linux/types.h>
58147+#include <linux/grdefs.h>
58148+#include <linux/grinternal.h>
58149+#include <linux/capability.h>
58150+#include <linux/compat.h>
58151+
58152+#include <asm/uaccess.h>
58153+
58154+#ifdef CONFIG_GRKERNSEC_EXECLOG
58155+static char gr_exec_arg_buf[132];
58156+static DEFINE_MUTEX(gr_exec_arg_mutex);
58157+#endif
58158+
58159+int
58160+gr_handle_nproc(void)
58161+{
58162+#ifdef CONFIG_GRKERNSEC_EXECVE
58163+ const struct cred *cred = current_cred();
58164+ if (grsec_enable_execve && cred->user &&
58165+ (atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) &&
58166+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
58167+ gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
58168+ return -EAGAIN;
58169+ }
58170+#endif
58171+ return 0;
58172+}
58173+
58174+void
58175+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
58176+{
58177+#ifdef CONFIG_GRKERNSEC_EXECLOG
58178+ char *grarg = gr_exec_arg_buf;
58179+ unsigned int i, x, execlen = 0;
58180+ char c;
58181+
58182+ if (!((grsec_enable_execlog && grsec_enable_group &&
58183+ in_group_p(grsec_audit_gid))
58184+ || (grsec_enable_execlog && !grsec_enable_group)))
58185+ return;
58186+
58187+ mutex_lock(&gr_exec_arg_mutex);
58188+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
58189+
58190+ if (unlikely(argv == NULL))
58191+ goto log;
58192+
58193+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
58194+ const char __user *p;
58195+ unsigned int len;
58196+
58197+ if (copy_from_user(&p, argv + i, sizeof(p)))
58198+ goto log;
58199+ if (!p)
58200+ goto log;
58201+ len = strnlen_user(p, 128 - execlen);
58202+ if (len > 128 - execlen)
58203+ len = 128 - execlen;
58204+ else if (len > 0)
58205+ len--;
58206+ if (copy_from_user(grarg + execlen, p, len))
58207+ goto log;
58208+
58209+ /* rewrite unprintable characters */
58210+ for (x = 0; x < len; x++) {
58211+ c = *(grarg + execlen + x);
58212+ if (c < 32 || c > 126)
58213+ *(grarg + execlen + x) = ' ';
58214+ }
58215+
58216+ execlen += len;
58217+ *(grarg + execlen) = ' ';
58218+ *(grarg + execlen + 1) = '\0';
58219+ execlen++;
58220+ }
58221+
58222+ log:
58223+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58224+ bprm->file->f_path.mnt, grarg);
58225+ mutex_unlock(&gr_exec_arg_mutex);
58226+#endif
58227+ return;
58228+}
58229+
58230+#ifdef CONFIG_COMPAT
58231+void
58232+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
58233+{
58234+#ifdef CONFIG_GRKERNSEC_EXECLOG
58235+ char *grarg = gr_exec_arg_buf;
58236+ unsigned int i, x, execlen = 0;
58237+ char c;
58238+
58239+ if (!((grsec_enable_execlog && grsec_enable_group &&
58240+ in_group_p(grsec_audit_gid))
58241+ || (grsec_enable_execlog && !grsec_enable_group)))
58242+ return;
58243+
58244+ mutex_lock(&gr_exec_arg_mutex);
58245+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
58246+
58247+ if (unlikely(argv == NULL))
58248+ goto log;
58249+
58250+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
58251+ compat_uptr_t p;
58252+ unsigned int len;
58253+
58254+ if (get_user(p, argv + i))
58255+ goto log;
58256+ len = strnlen_user(compat_ptr(p), 128 - execlen);
58257+ if (len > 128 - execlen)
58258+ len = 128 - execlen;
58259+ else if (len > 0)
58260+ len--;
58261+ else
58262+ goto log;
58263+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
58264+ goto log;
58265+
58266+ /* rewrite unprintable characters */
58267+ for (x = 0; x < len; x++) {
58268+ c = *(grarg + execlen + x);
58269+ if (c < 32 || c > 126)
58270+ *(grarg + execlen + x) = ' ';
58271+ }
58272+
58273+ execlen += len;
58274+ *(grarg + execlen) = ' ';
58275+ *(grarg + execlen + 1) = '\0';
58276+ execlen++;
58277+ }
58278+
58279+ log:
58280+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58281+ bprm->file->f_path.mnt, grarg);
58282+ mutex_unlock(&gr_exec_arg_mutex);
58283+#endif
58284+ return;
58285+}
58286+#endif
58287diff -urNp linux-2.6.39.2/grsecurity/grsec_fifo.c linux-2.6.39.2/grsecurity/grsec_fifo.c
58288--- linux-2.6.39.2/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
58289+++ linux-2.6.39.2/grsecurity/grsec_fifo.c 2011-05-22 19:41:42.000000000 -0400
58290@@ -0,0 +1,24 @@
58291+#include <linux/kernel.h>
58292+#include <linux/sched.h>
58293+#include <linux/fs.h>
58294+#include <linux/file.h>
58295+#include <linux/grinternal.h>
58296+
58297+int
58298+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
58299+ const struct dentry *dir, const int flag, const int acc_mode)
58300+{
58301+#ifdef CONFIG_GRKERNSEC_FIFO
58302+ const struct cred *cred = current_cred();
58303+
58304+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
58305+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
58306+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
58307+ (cred->fsuid != dentry->d_inode->i_uid)) {
58308+ if (!inode_permission(dentry->d_inode, acc_mode))
58309+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
58310+ return -EACCES;
58311+ }
58312+#endif
58313+ return 0;
58314+}
58315diff -urNp linux-2.6.39.2/grsecurity/grsec_fork.c linux-2.6.39.2/grsecurity/grsec_fork.c
58316--- linux-2.6.39.2/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
58317+++ linux-2.6.39.2/grsecurity/grsec_fork.c 2011-05-22 19:41:42.000000000 -0400
58318@@ -0,0 +1,23 @@
58319+#include <linux/kernel.h>
58320+#include <linux/sched.h>
58321+#include <linux/grsecurity.h>
58322+#include <linux/grinternal.h>
58323+#include <linux/errno.h>
58324+
58325+void
58326+gr_log_forkfail(const int retval)
58327+{
58328+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58329+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
58330+ switch (retval) {
58331+ case -EAGAIN:
58332+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
58333+ break;
58334+ case -ENOMEM:
58335+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
58336+ break;
58337+ }
58338+ }
58339+#endif
58340+ return;
58341+}
58342diff -urNp linux-2.6.39.2/grsecurity/grsec_init.c linux-2.6.39.2/grsecurity/grsec_init.c
58343--- linux-2.6.39.2/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
58344+++ linux-2.6.39.2/grsecurity/grsec_init.c 2011-06-29 19:35:59.000000000 -0400
58345@@ -0,0 +1,273 @@
58346+#include <linux/kernel.h>
58347+#include <linux/sched.h>
58348+#include <linux/mm.h>
58349+#include <linux/gracl.h>
58350+#include <linux/slab.h>
58351+#include <linux/vmalloc.h>
58352+#include <linux/percpu.h>
58353+#include <linux/module.h>
58354+
58355+int grsec_enable_brute;
58356+int grsec_enable_link;
58357+int grsec_enable_dmesg;
58358+int grsec_enable_harden_ptrace;
58359+int grsec_enable_fifo;
58360+int grsec_enable_execve;
58361+int grsec_enable_execlog;
58362+int grsec_enable_signal;
58363+int grsec_enable_forkfail;
58364+int grsec_enable_audit_ptrace;
58365+int grsec_enable_time;
58366+int grsec_enable_audit_textrel;
58367+int grsec_enable_group;
58368+int grsec_audit_gid;
58369+int grsec_enable_chdir;
58370+int grsec_enable_mount;
58371+int grsec_enable_rofs;
58372+int grsec_enable_chroot_findtask;
58373+int grsec_enable_chroot_mount;
58374+int grsec_enable_chroot_shmat;
58375+int grsec_enable_chroot_fchdir;
58376+int grsec_enable_chroot_double;
58377+int grsec_enable_chroot_pivot;
58378+int grsec_enable_chroot_chdir;
58379+int grsec_enable_chroot_chmod;
58380+int grsec_enable_chroot_mknod;
58381+int grsec_enable_chroot_nice;
58382+int grsec_enable_chroot_execlog;
58383+int grsec_enable_chroot_caps;
58384+int grsec_enable_chroot_sysctl;
58385+int grsec_enable_chroot_unix;
58386+int grsec_enable_tpe;
58387+int grsec_tpe_gid;
58388+int grsec_enable_blackhole;
58389+#ifdef CONFIG_IPV6_MODULE
58390+EXPORT_SYMBOL(grsec_enable_blackhole);
58391+#endif
58392+int grsec_lastack_retries;
58393+int grsec_enable_tpe_all;
58394+int grsec_enable_tpe_invert;
58395+int grsec_enable_socket_all;
58396+int grsec_socket_all_gid;
58397+int grsec_enable_socket_client;
58398+int grsec_socket_client_gid;
58399+int grsec_enable_socket_server;
58400+int grsec_socket_server_gid;
58401+int grsec_resource_logging;
58402+int grsec_disable_privio;
58403+int grsec_enable_log_rwxmaps;
58404+int grsec_lock;
58405+
58406+DEFINE_SPINLOCK(grsec_alert_lock);
58407+unsigned long grsec_alert_wtime = 0;
58408+unsigned long grsec_alert_fyet = 0;
58409+
58410+DEFINE_SPINLOCK(grsec_audit_lock);
58411+
58412+DEFINE_RWLOCK(grsec_exec_file_lock);
58413+
58414+char *gr_shared_page[4];
58415+
58416+char *gr_alert_log_fmt;
58417+char *gr_audit_log_fmt;
58418+char *gr_alert_log_buf;
58419+char *gr_audit_log_buf;
58420+
58421+extern struct gr_arg *gr_usermode;
58422+extern unsigned char *gr_system_salt;
58423+extern unsigned char *gr_system_sum;
58424+
58425+void __init
58426+grsecurity_init(void)
58427+{
58428+ int j;
58429+ /* create the per-cpu shared pages */
58430+
58431+#ifdef CONFIG_X86
58432+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
58433+#endif
58434+
58435+ for (j = 0; j < 4; j++) {
58436+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
58437+ if (gr_shared_page[j] == NULL) {
58438+ panic("Unable to allocate grsecurity shared page");
58439+ return;
58440+ }
58441+ }
58442+
58443+ /* allocate log buffers */
58444+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
58445+ if (!gr_alert_log_fmt) {
58446+ panic("Unable to allocate grsecurity alert log format buffer");
58447+ return;
58448+ }
58449+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
58450+ if (!gr_audit_log_fmt) {
58451+ panic("Unable to allocate grsecurity audit log format buffer");
58452+ return;
58453+ }
58454+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58455+ if (!gr_alert_log_buf) {
58456+ panic("Unable to allocate grsecurity alert log buffer");
58457+ return;
58458+ }
58459+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58460+ if (!gr_audit_log_buf) {
58461+ panic("Unable to allocate grsecurity audit log buffer");
58462+ return;
58463+ }
58464+
58465+ /* allocate memory for authentication structure */
58466+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
58467+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
58468+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
58469+
58470+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
58471+ panic("Unable to allocate grsecurity authentication structure");
58472+ return;
58473+ }
58474+
58475+
58476+#ifdef CONFIG_GRKERNSEC_IO
58477+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
58478+ grsec_disable_privio = 1;
58479+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58480+ grsec_disable_privio = 1;
58481+#else
58482+ grsec_disable_privio = 0;
58483+#endif
58484+#endif
58485+
58486+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58487+ /* for backward compatibility, tpe_invert always defaults to on if
58488+ enabled in the kernel
58489+ */
58490+ grsec_enable_tpe_invert = 1;
58491+#endif
58492+
58493+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58494+#ifndef CONFIG_GRKERNSEC_SYSCTL
58495+ grsec_lock = 1;
58496+#endif
58497+
58498+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58499+ grsec_enable_audit_textrel = 1;
58500+#endif
58501+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58502+ grsec_enable_log_rwxmaps = 1;
58503+#endif
58504+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
58505+ grsec_enable_group = 1;
58506+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
58507+#endif
58508+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
58509+ grsec_enable_chdir = 1;
58510+#endif
58511+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
58512+ grsec_enable_harden_ptrace = 1;
58513+#endif
58514+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58515+ grsec_enable_mount = 1;
58516+#endif
58517+#ifdef CONFIG_GRKERNSEC_LINK
58518+ grsec_enable_link = 1;
58519+#endif
58520+#ifdef CONFIG_GRKERNSEC_BRUTE
58521+ grsec_enable_brute = 1;
58522+#endif
58523+#ifdef CONFIG_GRKERNSEC_DMESG
58524+ grsec_enable_dmesg = 1;
58525+#endif
58526+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58527+ grsec_enable_blackhole = 1;
58528+ grsec_lastack_retries = 4;
58529+#endif
58530+#ifdef CONFIG_GRKERNSEC_FIFO
58531+ grsec_enable_fifo = 1;
58532+#endif
58533+#ifdef CONFIG_GRKERNSEC_EXECVE
58534+ grsec_enable_execve = 1;
58535+#endif
58536+#ifdef CONFIG_GRKERNSEC_EXECLOG
58537+ grsec_enable_execlog = 1;
58538+#endif
58539+#ifdef CONFIG_GRKERNSEC_SIGNAL
58540+ grsec_enable_signal = 1;
58541+#endif
58542+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58543+ grsec_enable_forkfail = 1;
58544+#endif
58545+#ifdef CONFIG_GRKERNSEC_TIME
58546+ grsec_enable_time = 1;
58547+#endif
58548+#ifdef CONFIG_GRKERNSEC_RESLOG
58549+ grsec_resource_logging = 1;
58550+#endif
58551+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58552+ grsec_enable_chroot_findtask = 1;
58553+#endif
58554+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58555+ grsec_enable_chroot_unix = 1;
58556+#endif
58557+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58558+ grsec_enable_chroot_mount = 1;
58559+#endif
58560+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58561+ grsec_enable_chroot_fchdir = 1;
58562+#endif
58563+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58564+ grsec_enable_chroot_shmat = 1;
58565+#endif
58566+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58567+ grsec_enable_audit_ptrace = 1;
58568+#endif
58569+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58570+ grsec_enable_chroot_double = 1;
58571+#endif
58572+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58573+ grsec_enable_chroot_pivot = 1;
58574+#endif
58575+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58576+ grsec_enable_chroot_chdir = 1;
58577+#endif
58578+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58579+ grsec_enable_chroot_chmod = 1;
58580+#endif
58581+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58582+ grsec_enable_chroot_mknod = 1;
58583+#endif
58584+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58585+ grsec_enable_chroot_nice = 1;
58586+#endif
58587+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58588+ grsec_enable_chroot_execlog = 1;
58589+#endif
58590+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58591+ grsec_enable_chroot_caps = 1;
58592+#endif
58593+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58594+ grsec_enable_chroot_sysctl = 1;
58595+#endif
58596+#ifdef CONFIG_GRKERNSEC_TPE
58597+ grsec_enable_tpe = 1;
58598+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
58599+#ifdef CONFIG_GRKERNSEC_TPE_ALL
58600+ grsec_enable_tpe_all = 1;
58601+#endif
58602+#endif
58603+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58604+ grsec_enable_socket_all = 1;
58605+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
58606+#endif
58607+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58608+ grsec_enable_socket_client = 1;
58609+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
58610+#endif
58611+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58612+ grsec_enable_socket_server = 1;
58613+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
58614+#endif
58615+#endif
58616+
58617+ return;
58618+}
58619diff -urNp linux-2.6.39.2/grsecurity/grsec_link.c linux-2.6.39.2/grsecurity/grsec_link.c
58620--- linux-2.6.39.2/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
58621+++ linux-2.6.39.2/grsecurity/grsec_link.c 2011-05-22 19:41:42.000000000 -0400
58622@@ -0,0 +1,43 @@
58623+#include <linux/kernel.h>
58624+#include <linux/sched.h>
58625+#include <linux/fs.h>
58626+#include <linux/file.h>
58627+#include <linux/grinternal.h>
58628+
58629+int
58630+gr_handle_follow_link(const struct inode *parent,
58631+ const struct inode *inode,
58632+ const struct dentry *dentry, const struct vfsmount *mnt)
58633+{
58634+#ifdef CONFIG_GRKERNSEC_LINK
58635+ const struct cred *cred = current_cred();
58636+
58637+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
58638+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
58639+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
58640+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
58641+ return -EACCES;
58642+ }
58643+#endif
58644+ return 0;
58645+}
58646+
58647+int
58648+gr_handle_hardlink(const struct dentry *dentry,
58649+ const struct vfsmount *mnt,
58650+ struct inode *inode, const int mode, const char *to)
58651+{
58652+#ifdef CONFIG_GRKERNSEC_LINK
58653+ const struct cred *cred = current_cred();
58654+
58655+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
58656+ (!S_ISREG(mode) || (mode & S_ISUID) ||
58657+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
58658+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
58659+ !capable(CAP_FOWNER) && cred->uid) {
58660+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
58661+ return -EPERM;
58662+ }
58663+#endif
58664+ return 0;
58665+}
58666diff -urNp linux-2.6.39.2/grsecurity/grsec_log.c linux-2.6.39.2/grsecurity/grsec_log.c
58667--- linux-2.6.39.2/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
58668+++ linux-2.6.39.2/grsecurity/grsec_log.c 2011-05-22 19:41:42.000000000 -0400
58669@@ -0,0 +1,310 @@
58670+#include <linux/kernel.h>
58671+#include <linux/sched.h>
58672+#include <linux/file.h>
58673+#include <linux/tty.h>
58674+#include <linux/fs.h>
58675+#include <linux/grinternal.h>
58676+
58677+#ifdef CONFIG_TREE_PREEMPT_RCU
58678+#define DISABLE_PREEMPT() preempt_disable()
58679+#define ENABLE_PREEMPT() preempt_enable()
58680+#else
58681+#define DISABLE_PREEMPT()
58682+#define ENABLE_PREEMPT()
58683+#endif
58684+
58685+#define BEGIN_LOCKS(x) \
58686+ DISABLE_PREEMPT(); \
58687+ rcu_read_lock(); \
58688+ read_lock(&tasklist_lock); \
58689+ read_lock(&grsec_exec_file_lock); \
58690+ if (x != GR_DO_AUDIT) \
58691+ spin_lock(&grsec_alert_lock); \
58692+ else \
58693+ spin_lock(&grsec_audit_lock)
58694+
58695+#define END_LOCKS(x) \
58696+ if (x != GR_DO_AUDIT) \
58697+ spin_unlock(&grsec_alert_lock); \
58698+ else \
58699+ spin_unlock(&grsec_audit_lock); \
58700+ read_unlock(&grsec_exec_file_lock); \
58701+ read_unlock(&tasklist_lock); \
58702+ rcu_read_unlock(); \
58703+ ENABLE_PREEMPT(); \
58704+ if (x == GR_DONT_AUDIT) \
58705+ gr_handle_alertkill(current)
58706+
58707+enum {
58708+ FLOODING,
58709+ NO_FLOODING
58710+};
58711+
58712+extern char *gr_alert_log_fmt;
58713+extern char *gr_audit_log_fmt;
58714+extern char *gr_alert_log_buf;
58715+extern char *gr_audit_log_buf;
58716+
58717+static int gr_log_start(int audit)
58718+{
58719+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
58720+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
58721+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58722+
58723+ if (audit == GR_DO_AUDIT)
58724+ goto set_fmt;
58725+
58726+ if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
58727+ grsec_alert_wtime = jiffies;
58728+ grsec_alert_fyet = 0;
58729+ } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
58730+ grsec_alert_fyet++;
58731+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
58732+ grsec_alert_wtime = jiffies;
58733+ grsec_alert_fyet++;
58734+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58735+ return FLOODING;
58736+ } else return FLOODING;
58737+
58738+set_fmt:
58739+ memset(buf, 0, PAGE_SIZE);
58740+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
58741+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58742+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58743+ } else if (current->signal->curr_ip) {
58744+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58745+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58746+ } else if (gr_acl_is_enabled()) {
58747+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58748+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58749+ } else {
58750+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
58751+ strcpy(buf, fmt);
58752+ }
58753+
58754+ return NO_FLOODING;
58755+}
58756+
58757+static void gr_log_middle(int audit, const char *msg, va_list ap)
58758+ __attribute__ ((format (printf, 2, 0)));
58759+
58760+static void gr_log_middle(int audit, const char *msg, va_list ap)
58761+{
58762+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58763+ unsigned int len = strlen(buf);
58764+
58765+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58766+
58767+ return;
58768+}
58769+
58770+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58771+ __attribute__ ((format (printf, 2, 3)));
58772+
58773+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58774+{
58775+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58776+ unsigned int len = strlen(buf);
58777+ va_list ap;
58778+
58779+ va_start(ap, msg);
58780+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58781+ va_end(ap);
58782+
58783+ return;
58784+}
58785+
58786+static void gr_log_end(int audit)
58787+{
58788+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58789+ unsigned int len = strlen(buf);
58790+
58791+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58792+ printk("%s\n", buf);
58793+
58794+ return;
58795+}
58796+
58797+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58798+{
58799+ int logtype;
58800+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58801+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58802+ void *voidptr = NULL;
58803+ int num1 = 0, num2 = 0;
58804+ unsigned long ulong1 = 0, ulong2 = 0;
58805+ struct dentry *dentry = NULL;
58806+ struct vfsmount *mnt = NULL;
58807+ struct file *file = NULL;
58808+ struct task_struct *task = NULL;
58809+ const struct cred *cred, *pcred;
58810+ va_list ap;
58811+
58812+ BEGIN_LOCKS(audit);
58813+ logtype = gr_log_start(audit);
58814+ if (logtype == FLOODING) {
58815+ END_LOCKS(audit);
58816+ return;
58817+ }
58818+ va_start(ap, argtypes);
58819+ switch (argtypes) {
58820+ case GR_TTYSNIFF:
58821+ task = va_arg(ap, struct task_struct *);
58822+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58823+ break;
58824+ case GR_SYSCTL_HIDDEN:
58825+ str1 = va_arg(ap, char *);
58826+ gr_log_middle_varargs(audit, msg, result, str1);
58827+ break;
58828+ case GR_RBAC:
58829+ dentry = va_arg(ap, struct dentry *);
58830+ mnt = va_arg(ap, struct vfsmount *);
58831+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58832+ break;
58833+ case GR_RBAC_STR:
58834+ dentry = va_arg(ap, struct dentry *);
58835+ mnt = va_arg(ap, struct vfsmount *);
58836+ str1 = va_arg(ap, char *);
58837+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58838+ break;
58839+ case GR_STR_RBAC:
58840+ str1 = va_arg(ap, char *);
58841+ dentry = va_arg(ap, struct dentry *);
58842+ mnt = va_arg(ap, struct vfsmount *);
58843+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58844+ break;
58845+ case GR_RBAC_MODE2:
58846+ dentry = va_arg(ap, struct dentry *);
58847+ mnt = va_arg(ap, struct vfsmount *);
58848+ str1 = va_arg(ap, char *);
58849+ str2 = va_arg(ap, char *);
58850+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58851+ break;
58852+ case GR_RBAC_MODE3:
58853+ dentry = va_arg(ap, struct dentry *);
58854+ mnt = va_arg(ap, struct vfsmount *);
58855+ str1 = va_arg(ap, char *);
58856+ str2 = va_arg(ap, char *);
58857+ str3 = va_arg(ap, char *);
58858+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58859+ break;
58860+ case GR_FILENAME:
58861+ dentry = va_arg(ap, struct dentry *);
58862+ mnt = va_arg(ap, struct vfsmount *);
58863+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58864+ break;
58865+ case GR_STR_FILENAME:
58866+ str1 = va_arg(ap, char *);
58867+ dentry = va_arg(ap, struct dentry *);
58868+ mnt = va_arg(ap, struct vfsmount *);
58869+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58870+ break;
58871+ case GR_FILENAME_STR:
58872+ dentry = va_arg(ap, struct dentry *);
58873+ mnt = va_arg(ap, struct vfsmount *);
58874+ str1 = va_arg(ap, char *);
58875+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58876+ break;
58877+ case GR_FILENAME_TWO_INT:
58878+ dentry = va_arg(ap, struct dentry *);
58879+ mnt = va_arg(ap, struct vfsmount *);
58880+ num1 = va_arg(ap, int);
58881+ num2 = va_arg(ap, int);
58882+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58883+ break;
58884+ case GR_FILENAME_TWO_INT_STR:
58885+ dentry = va_arg(ap, struct dentry *);
58886+ mnt = va_arg(ap, struct vfsmount *);
58887+ num1 = va_arg(ap, int);
58888+ num2 = va_arg(ap, int);
58889+ str1 = va_arg(ap, char *);
58890+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58891+ break;
58892+ case GR_TEXTREL:
58893+ file = va_arg(ap, struct file *);
58894+ ulong1 = va_arg(ap, unsigned long);
58895+ ulong2 = va_arg(ap, unsigned long);
58896+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58897+ break;
58898+ case GR_PTRACE:
58899+ task = va_arg(ap, struct task_struct *);
58900+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58901+ break;
58902+ case GR_RESOURCE:
58903+ task = va_arg(ap, struct task_struct *);
58904+ cred = __task_cred(task);
58905+ pcred = __task_cred(task->real_parent);
58906+ ulong1 = va_arg(ap, unsigned long);
58907+ str1 = va_arg(ap, char *);
58908+ ulong2 = va_arg(ap, unsigned long);
58909+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58910+ break;
58911+ case GR_CAP:
58912+ task = va_arg(ap, struct task_struct *);
58913+ cred = __task_cred(task);
58914+ pcred = __task_cred(task->real_parent);
58915+ str1 = va_arg(ap, char *);
58916+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58917+ break;
58918+ case GR_SIG:
58919+ str1 = va_arg(ap, char *);
58920+ voidptr = va_arg(ap, void *);
58921+ gr_log_middle_varargs(audit, msg, str1, voidptr);
58922+ break;
58923+ case GR_SIG2:
58924+ task = va_arg(ap, struct task_struct *);
58925+ cred = __task_cred(task);
58926+ pcred = __task_cred(task->real_parent);
58927+ num1 = va_arg(ap, int);
58928+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58929+ break;
58930+ case GR_CRASH1:
58931+ task = va_arg(ap, struct task_struct *);
58932+ cred = __task_cred(task);
58933+ pcred = __task_cred(task->real_parent);
58934+ ulong1 = va_arg(ap, unsigned long);
58935+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58936+ break;
58937+ case GR_CRASH2:
58938+ task = va_arg(ap, struct task_struct *);
58939+ cred = __task_cred(task);
58940+ pcred = __task_cred(task->real_parent);
58941+ ulong1 = va_arg(ap, unsigned long);
58942+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58943+ break;
58944+ case GR_RWXMAP:
58945+ file = va_arg(ap, struct file *);
58946+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58947+ break;
58948+ case GR_PSACCT:
58949+ {
58950+ unsigned int wday, cday;
58951+ __u8 whr, chr;
58952+ __u8 wmin, cmin;
58953+ __u8 wsec, csec;
58954+ char cur_tty[64] = { 0 };
58955+ char parent_tty[64] = { 0 };
58956+
58957+ task = va_arg(ap, struct task_struct *);
58958+ wday = va_arg(ap, unsigned int);
58959+ cday = va_arg(ap, unsigned int);
58960+ whr = va_arg(ap, int);
58961+ chr = va_arg(ap, int);
58962+ wmin = va_arg(ap, int);
58963+ cmin = va_arg(ap, int);
58964+ wsec = va_arg(ap, int);
58965+ csec = va_arg(ap, int);
58966+ ulong1 = va_arg(ap, unsigned long);
58967+ cred = __task_cred(task);
58968+ pcred = __task_cred(task->real_parent);
58969+
58970+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58971+ }
58972+ break;
58973+ default:
58974+ gr_log_middle(audit, msg, ap);
58975+ }
58976+ va_end(ap);
58977+ gr_log_end(audit);
58978+ END_LOCKS(audit);
58979+}
58980diff -urNp linux-2.6.39.2/grsecurity/grsec_mem.c linux-2.6.39.2/grsecurity/grsec_mem.c
58981--- linux-2.6.39.2/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
58982+++ linux-2.6.39.2/grsecurity/grsec_mem.c 2011-05-22 19:41:42.000000000 -0400
58983@@ -0,0 +1,33 @@
58984+#include <linux/kernel.h>
58985+#include <linux/sched.h>
58986+#include <linux/mm.h>
58987+#include <linux/mman.h>
58988+#include <linux/grinternal.h>
58989+
58990+void
58991+gr_handle_ioperm(void)
58992+{
58993+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58994+ return;
58995+}
58996+
58997+void
58998+gr_handle_iopl(void)
58999+{
59000+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
59001+ return;
59002+}
59003+
59004+void
59005+gr_handle_mem_readwrite(u64 from, u64 to)
59006+{
59007+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
59008+ return;
59009+}
59010+
59011+void
59012+gr_handle_vm86(void)
59013+{
59014+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
59015+ return;
59016+}
59017diff -urNp linux-2.6.39.2/grsecurity/grsec_mount.c linux-2.6.39.2/grsecurity/grsec_mount.c
59018--- linux-2.6.39.2/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
59019+++ linux-2.6.39.2/grsecurity/grsec_mount.c 2011-06-20 19:46:18.000000000 -0400
59020@@ -0,0 +1,62 @@
59021+#include <linux/kernel.h>
59022+#include <linux/sched.h>
59023+#include <linux/mount.h>
59024+#include <linux/grsecurity.h>
59025+#include <linux/grinternal.h>
59026+
59027+void
59028+gr_log_remount(const char *devname, const int retval)
59029+{
59030+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59031+ if (grsec_enable_mount && (retval >= 0))
59032+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
59033+#endif
59034+ return;
59035+}
59036+
59037+void
59038+gr_log_unmount(const char *devname, const int retval)
59039+{
59040+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59041+ if (grsec_enable_mount && (retval >= 0))
59042+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
59043+#endif
59044+ return;
59045+}
59046+
59047+void
59048+gr_log_mount(const char *from, const char *to, const int retval)
59049+{
59050+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59051+ if (grsec_enable_mount && (retval >= 0))
59052+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
59053+#endif
59054+ return;
59055+}
59056+
59057+int
59058+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
59059+{
59060+#ifdef CONFIG_GRKERNSEC_ROFS
59061+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
59062+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
59063+ return -EPERM;
59064+ } else
59065+ return 0;
59066+#endif
59067+ return 0;
59068+}
59069+
59070+int
59071+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
59072+{
59073+#ifdef CONFIG_GRKERNSEC_ROFS
59074+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
59075+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
59076+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
59077+ return -EPERM;
59078+ } else
59079+ return 0;
59080+#endif
59081+ return 0;
59082+}
59083diff -urNp linux-2.6.39.2/grsecurity/grsec_pax.c linux-2.6.39.2/grsecurity/grsec_pax.c
59084--- linux-2.6.39.2/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
59085+++ linux-2.6.39.2/grsecurity/grsec_pax.c 2011-05-22 19:41:42.000000000 -0400
59086@@ -0,0 +1,36 @@
59087+#include <linux/kernel.h>
59088+#include <linux/sched.h>
59089+#include <linux/mm.h>
59090+#include <linux/file.h>
59091+#include <linux/grinternal.h>
59092+#include <linux/grsecurity.h>
59093+
59094+void
59095+gr_log_textrel(struct vm_area_struct * vma)
59096+{
59097+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59098+ if (grsec_enable_audit_textrel)
59099+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
59100+#endif
59101+ return;
59102+}
59103+
59104+void
59105+gr_log_rwxmmap(struct file *file)
59106+{
59107+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59108+ if (grsec_enable_log_rwxmaps)
59109+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
59110+#endif
59111+ return;
59112+}
59113+
59114+void
59115+gr_log_rwxmprotect(struct file *file)
59116+{
59117+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59118+ if (grsec_enable_log_rwxmaps)
59119+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
59120+#endif
59121+ return;
59122+}
59123diff -urNp linux-2.6.39.2/grsecurity/grsec_ptrace.c linux-2.6.39.2/grsecurity/grsec_ptrace.c
59124--- linux-2.6.39.2/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
59125+++ linux-2.6.39.2/grsecurity/grsec_ptrace.c 2011-05-22 19:41:42.000000000 -0400
59126@@ -0,0 +1,14 @@
59127+#include <linux/kernel.h>
59128+#include <linux/sched.h>
59129+#include <linux/grinternal.h>
59130+#include <linux/grsecurity.h>
59131+
59132+void
59133+gr_audit_ptrace(struct task_struct *task)
59134+{
59135+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59136+ if (grsec_enable_audit_ptrace)
59137+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
59138+#endif
59139+ return;
59140+}
59141diff -urNp linux-2.6.39.2/grsecurity/grsec_sig.c linux-2.6.39.2/grsecurity/grsec_sig.c
59142--- linux-2.6.39.2/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
59143+++ linux-2.6.39.2/grsecurity/grsec_sig.c 2011-06-29 19:40:46.000000000 -0400
59144@@ -0,0 +1,206 @@
59145+#include <linux/kernel.h>
59146+#include <linux/sched.h>
59147+#include <linux/delay.h>
59148+#include <linux/grsecurity.h>
59149+#include <linux/grinternal.h>
59150+#include <linux/hardirq.h>
59151+
59152+char *signames[] = {
59153+ [SIGSEGV] = "Segmentation fault",
59154+ [SIGILL] = "Illegal instruction",
59155+ [SIGABRT] = "Abort",
59156+ [SIGBUS] = "Invalid alignment/Bus error"
59157+};
59158+
59159+void
59160+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
59161+{
59162+#ifdef CONFIG_GRKERNSEC_SIGNAL
59163+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
59164+ (sig == SIGABRT) || (sig == SIGBUS))) {
59165+ if (t->pid == current->pid) {
59166+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
59167+ } else {
59168+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
59169+ }
59170+ }
59171+#endif
59172+ return;
59173+}
59174+
59175+int
59176+gr_handle_signal(const struct task_struct *p, const int sig)
59177+{
59178+#ifdef CONFIG_GRKERNSEC
59179+ if (current->pid > 1 && gr_check_protected_task(p)) {
59180+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
59181+ return -EPERM;
59182+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
59183+ return -EPERM;
59184+ }
59185+#endif
59186+ return 0;
59187+}
59188+
59189+#ifdef CONFIG_GRKERNSEC
59190+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
59191+
59192+int gr_fake_force_sig(int sig, struct task_struct *t)
59193+{
59194+ unsigned long int flags;
59195+ int ret, blocked, ignored;
59196+ struct k_sigaction *action;
59197+
59198+ spin_lock_irqsave(&t->sighand->siglock, flags);
59199+ action = &t->sighand->action[sig-1];
59200+ ignored = action->sa.sa_handler == SIG_IGN;
59201+ blocked = sigismember(&t->blocked, sig);
59202+ if (blocked || ignored) {
59203+ action->sa.sa_handler = SIG_DFL;
59204+ if (blocked) {
59205+ sigdelset(&t->blocked, sig);
59206+ recalc_sigpending_and_wake(t);
59207+ }
59208+ }
59209+ if (action->sa.sa_handler == SIG_DFL)
59210+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
59211+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
59212+
59213+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
59214+
59215+ return ret;
59216+}
59217+#endif
59218+
59219+#ifdef CONFIG_GRKERNSEC_BRUTE
59220+#define GR_USER_BAN_TIME (15 * 60)
59221+
59222+static int __get_dumpable(unsigned long mm_flags)
59223+{
59224+ int ret;
59225+
59226+ ret = mm_flags & MMF_DUMPABLE_MASK;
59227+ return (ret >= 2) ? 2 : ret;
59228+}
59229+#endif
59230+
59231+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
59232+{
59233+#ifdef CONFIG_GRKERNSEC_BRUTE
59234+ uid_t uid = 0;
59235+
59236+ if (!grsec_enable_brute)
59237+ return;
59238+
59239+ rcu_read_lock();
59240+ read_lock(&tasklist_lock);
59241+ read_lock(&grsec_exec_file_lock);
59242+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
59243+ p->real_parent->brute = 1;
59244+ else {
59245+ const struct cred *cred = __task_cred(p), *cred2;
59246+ struct task_struct *tsk, *tsk2;
59247+
59248+ if (!__get_dumpable(mm_flags) && cred->uid) {
59249+ struct user_struct *user;
59250+
59251+ uid = cred->uid;
59252+
59253+ /* this is put upon execution past expiration */
59254+ user = find_user(uid);
59255+ if (user == NULL)
59256+ goto unlock;
59257+ user->banned = 1;
59258+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
59259+ if (user->ban_expires == ~0UL)
59260+ user->ban_expires--;
59261+
59262+ do_each_thread(tsk2, tsk) {
59263+ cred2 = __task_cred(tsk);
59264+ if (tsk != p && cred2->uid == uid)
59265+ gr_fake_force_sig(SIGKILL, tsk);
59266+ } while_each_thread(tsk2, tsk);
59267+ }
59268+ }
59269+unlock:
59270+ read_unlock(&grsec_exec_file_lock);
59271+ read_unlock(&tasklist_lock);
59272+ rcu_read_unlock();
59273+
59274+ if (uid)
59275+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
59276+
59277+#endif
59278+ return;
59279+}
59280+
59281+void gr_handle_brute_check(void)
59282+{
59283+#ifdef CONFIG_GRKERNSEC_BRUTE
59284+ if (current->brute)
59285+ msleep(30 * 1000);
59286+#endif
59287+ return;
59288+}
59289+
59290+void gr_handle_kernel_exploit(void)
59291+{
59292+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
59293+ const struct cred *cred;
59294+ struct task_struct *tsk, *tsk2;
59295+ struct user_struct *user;
59296+ uid_t uid;
59297+
59298+ if (in_irq() || in_serving_softirq() || in_nmi())
59299+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
59300+
59301+ uid = current_uid();
59302+
59303+ if (uid == 0)
59304+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
59305+ else {
59306+ /* kill all the processes of this user, hold a reference
59307+ to their creds struct, and prevent them from creating
59308+ another process until system reset
59309+ */
59310+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
59311+ /* we intentionally leak this ref */
59312+ user = get_uid(current->cred->user);
59313+ if (user) {
59314+ user->banned = 1;
59315+ user->ban_expires = ~0UL;
59316+ }
59317+
59318+ read_lock(&tasklist_lock);
59319+ do_each_thread(tsk2, tsk) {
59320+ cred = __task_cred(tsk);
59321+ if (cred->uid == uid)
59322+ gr_fake_force_sig(SIGKILL, tsk);
59323+ } while_each_thread(tsk2, tsk);
59324+ read_unlock(&tasklist_lock);
59325+ }
59326+#endif
59327+}
59328+
59329+int __gr_process_user_ban(struct user_struct *user)
59330+{
59331+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59332+ if (unlikely(user->banned)) {
59333+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
59334+ user->banned = 0;
59335+ user->ban_expires = 0;
59336+ free_uid(user);
59337+ } else
59338+ return -EPERM;
59339+ }
59340+#endif
59341+ return 0;
59342+}
59343+
59344+int gr_process_user_ban(void)
59345+{
59346+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59347+ return __gr_process_user_ban(current->cred->user);
59348+#endif
59349+ return 0;
59350+}
59351diff -urNp linux-2.6.39.2/grsecurity/grsec_sock.c linux-2.6.39.2/grsecurity/grsec_sock.c
59352--- linux-2.6.39.2/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
59353+++ linux-2.6.39.2/grsecurity/grsec_sock.c 2011-05-22 20:29:21.000000000 -0400
59354@@ -0,0 +1,244 @@
59355+#include <linux/kernel.h>
59356+#include <linux/module.h>
59357+#include <linux/sched.h>
59358+#include <linux/file.h>
59359+#include <linux/net.h>
59360+#include <linux/in.h>
59361+#include <linux/ip.h>
59362+#include <net/sock.h>
59363+#include <net/inet_sock.h>
59364+#include <linux/grsecurity.h>
59365+#include <linux/grinternal.h>
59366+#include <linux/gracl.h>
59367+
59368+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
59369+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
59370+
59371+EXPORT_SYMBOL(gr_search_udp_recvmsg);
59372+EXPORT_SYMBOL(gr_search_udp_sendmsg);
59373+
59374+#ifdef CONFIG_UNIX_MODULE
59375+EXPORT_SYMBOL(gr_acl_handle_unix);
59376+EXPORT_SYMBOL(gr_acl_handle_mknod);
59377+EXPORT_SYMBOL(gr_handle_chroot_unix);
59378+EXPORT_SYMBOL(gr_handle_create);
59379+#endif
59380+
59381+#ifdef CONFIG_GRKERNSEC
59382+#define gr_conn_table_size 32749
59383+struct conn_table_entry {
59384+ struct conn_table_entry *next;
59385+ struct signal_struct *sig;
59386+};
59387+
59388+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
59389+DEFINE_SPINLOCK(gr_conn_table_lock);
59390+
59391+extern const char * gr_socktype_to_name(unsigned char type);
59392+extern const char * gr_proto_to_name(unsigned char proto);
59393+extern const char * gr_sockfamily_to_name(unsigned char family);
59394+
59395+static __inline__ int
59396+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
59397+{
59398+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
59399+}
59400+
59401+static __inline__ int
59402+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
59403+ __u16 sport, __u16 dport)
59404+{
59405+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
59406+ sig->gr_sport == sport && sig->gr_dport == dport))
59407+ return 1;
59408+ else
59409+ return 0;
59410+}
59411+
59412+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
59413+{
59414+ struct conn_table_entry **match;
59415+ unsigned int index;
59416+
59417+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59418+ sig->gr_sport, sig->gr_dport,
59419+ gr_conn_table_size);
59420+
59421+ newent->sig = sig;
59422+
59423+ match = &gr_conn_table[index];
59424+ newent->next = *match;
59425+ *match = newent;
59426+
59427+ return;
59428+}
59429+
59430+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
59431+{
59432+ struct conn_table_entry *match, *last = NULL;
59433+ unsigned int index;
59434+
59435+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59436+ sig->gr_sport, sig->gr_dport,
59437+ gr_conn_table_size);
59438+
59439+ match = gr_conn_table[index];
59440+ while (match && !conn_match(match->sig,
59441+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
59442+ sig->gr_dport)) {
59443+ last = match;
59444+ match = match->next;
59445+ }
59446+
59447+ if (match) {
59448+ if (last)
59449+ last->next = match->next;
59450+ else
59451+ gr_conn_table[index] = NULL;
59452+ kfree(match);
59453+ }
59454+
59455+ return;
59456+}
59457+
59458+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
59459+ __u16 sport, __u16 dport)
59460+{
59461+ struct conn_table_entry *match;
59462+ unsigned int index;
59463+
59464+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
59465+
59466+ match = gr_conn_table[index];
59467+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
59468+ match = match->next;
59469+
59470+ if (match)
59471+ return match->sig;
59472+ else
59473+ return NULL;
59474+}
59475+
59476+#endif
59477+
59478+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
59479+{
59480+#ifdef CONFIG_GRKERNSEC
59481+ struct signal_struct *sig = task->signal;
59482+ struct conn_table_entry *newent;
59483+
59484+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
59485+ if (newent == NULL)
59486+ return;
59487+ /* no bh lock needed since we are called with bh disabled */
59488+ spin_lock(&gr_conn_table_lock);
59489+ gr_del_task_from_ip_table_nolock(sig);
59490+ sig->gr_saddr = inet->inet_rcv_saddr;
59491+ sig->gr_daddr = inet->inet_daddr;
59492+ sig->gr_sport = inet->inet_sport;
59493+ sig->gr_dport = inet->inet_dport;
59494+ gr_add_to_task_ip_table_nolock(sig, newent);
59495+ spin_unlock(&gr_conn_table_lock);
59496+#endif
59497+ return;
59498+}
59499+
59500+void gr_del_task_from_ip_table(struct task_struct *task)
59501+{
59502+#ifdef CONFIG_GRKERNSEC
59503+ spin_lock_bh(&gr_conn_table_lock);
59504+ gr_del_task_from_ip_table_nolock(task->signal);
59505+ spin_unlock_bh(&gr_conn_table_lock);
59506+#endif
59507+ return;
59508+}
59509+
59510+void
59511+gr_attach_curr_ip(const struct sock *sk)
59512+{
59513+#ifdef CONFIG_GRKERNSEC
59514+ struct signal_struct *p, *set;
59515+ const struct inet_sock *inet = inet_sk(sk);
59516+
59517+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
59518+ return;
59519+
59520+ set = current->signal;
59521+
59522+ spin_lock_bh(&gr_conn_table_lock);
59523+ p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
59524+ inet->inet_dport, inet->inet_sport);
59525+ if (unlikely(p != NULL)) {
59526+ set->curr_ip = p->curr_ip;
59527+ set->used_accept = 1;
59528+ gr_del_task_from_ip_table_nolock(p);
59529+ spin_unlock_bh(&gr_conn_table_lock);
59530+ return;
59531+ }
59532+ spin_unlock_bh(&gr_conn_table_lock);
59533+
59534+ set->curr_ip = inet->inet_daddr;
59535+ set->used_accept = 1;
59536+#endif
59537+ return;
59538+}
59539+
59540+int
59541+gr_handle_sock_all(const int family, const int type, const int protocol)
59542+{
59543+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59544+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
59545+ (family != AF_UNIX)) {
59546+ if (family == AF_INET)
59547+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
59548+ else
59549+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
59550+ return -EACCES;
59551+ }
59552+#endif
59553+ return 0;
59554+}
59555+
59556+int
59557+gr_handle_sock_server(const struct sockaddr *sck)
59558+{
59559+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59560+ if (grsec_enable_socket_server &&
59561+ in_group_p(grsec_socket_server_gid) &&
59562+ sck && (sck->sa_family != AF_UNIX) &&
59563+ (sck->sa_family != AF_LOCAL)) {
59564+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59565+ return -EACCES;
59566+ }
59567+#endif
59568+ return 0;
59569+}
59570+
59571+int
59572+gr_handle_sock_server_other(const struct sock *sck)
59573+{
59574+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59575+ if (grsec_enable_socket_server &&
59576+ in_group_p(grsec_socket_server_gid) &&
59577+ sck && (sck->sk_family != AF_UNIX) &&
59578+ (sck->sk_family != AF_LOCAL)) {
59579+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59580+ return -EACCES;
59581+ }
59582+#endif
59583+ return 0;
59584+}
59585+
59586+int
59587+gr_handle_sock_client(const struct sockaddr *sck)
59588+{
59589+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59590+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
59591+ sck && (sck->sa_family != AF_UNIX) &&
59592+ (sck->sa_family != AF_LOCAL)) {
59593+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
59594+ return -EACCES;
59595+ }
59596+#endif
59597+ return 0;
59598+}
59599diff -urNp linux-2.6.39.2/grsecurity/grsec_sysctl.c linux-2.6.39.2/grsecurity/grsec_sysctl.c
59600--- linux-2.6.39.2/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
59601+++ linux-2.6.39.2/grsecurity/grsec_sysctl.c 2011-06-29 19:38:04.000000000 -0400
59602@@ -0,0 +1,442 @@
59603+#include <linux/kernel.h>
59604+#include <linux/sched.h>
59605+#include <linux/sysctl.h>
59606+#include <linux/grsecurity.h>
59607+#include <linux/grinternal.h>
59608+
59609+int
59610+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
59611+{
59612+#ifdef CONFIG_GRKERNSEC_SYSCTL
59613+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
59614+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
59615+ return -EACCES;
59616+ }
59617+#endif
59618+ return 0;
59619+}
59620+
59621+#ifdef CONFIG_GRKERNSEC_ROFS
59622+static int __maybe_unused one = 1;
59623+#endif
59624+
59625+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
59626+struct ctl_table grsecurity_table[] = {
59627+#ifdef CONFIG_GRKERNSEC_SYSCTL
59628+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
59629+#ifdef CONFIG_GRKERNSEC_IO
59630+ {
59631+ .procname = "disable_priv_io",
59632+ .data = &grsec_disable_privio,
59633+ .maxlen = sizeof(int),
59634+ .mode = 0600,
59635+ .proc_handler = &proc_dointvec,
59636+ },
59637+#endif
59638+#endif
59639+#ifdef CONFIG_GRKERNSEC_LINK
59640+ {
59641+ .procname = "linking_restrictions",
59642+ .data = &grsec_enable_link,
59643+ .maxlen = sizeof(int),
59644+ .mode = 0600,
59645+ .proc_handler = &proc_dointvec,
59646+ },
59647+#endif
59648+#ifdef CONFIG_GRKERNSEC_BRUTE
59649+ {
59650+ .procname = "deter_bruteforce",
59651+ .data = &grsec_enable_brute,
59652+ .maxlen = sizeof(int),
59653+ .mode = 0600,
59654+ .proc_handler = &proc_dointvec,
59655+ },
59656+#endif
59657+#ifdef CONFIG_GRKERNSEC_FIFO
59658+ {
59659+ .procname = "fifo_restrictions",
59660+ .data = &grsec_enable_fifo,
59661+ .maxlen = sizeof(int),
59662+ .mode = 0600,
59663+ .proc_handler = &proc_dointvec,
59664+ },
59665+#endif
59666+#ifdef CONFIG_GRKERNSEC_EXECVE
59667+ {
59668+ .procname = "execve_limiting",
59669+ .data = &grsec_enable_execve,
59670+ .maxlen = sizeof(int),
59671+ .mode = 0600,
59672+ .proc_handler = &proc_dointvec,
59673+ },
59674+#endif
59675+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59676+ {
59677+ .procname = "ip_blackhole",
59678+ .data = &grsec_enable_blackhole,
59679+ .maxlen = sizeof(int),
59680+ .mode = 0600,
59681+ .proc_handler = &proc_dointvec,
59682+ },
59683+ {
59684+ .procname = "lastack_retries",
59685+ .data = &grsec_lastack_retries,
59686+ .maxlen = sizeof(int),
59687+ .mode = 0600,
59688+ .proc_handler = &proc_dointvec,
59689+ },
59690+#endif
59691+#ifdef CONFIG_GRKERNSEC_EXECLOG
59692+ {
59693+ .procname = "exec_logging",
59694+ .data = &grsec_enable_execlog,
59695+ .maxlen = sizeof(int),
59696+ .mode = 0600,
59697+ .proc_handler = &proc_dointvec,
59698+ },
59699+#endif
59700+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59701+ {
59702+ .procname = "rwxmap_logging",
59703+ .data = &grsec_enable_log_rwxmaps,
59704+ .maxlen = sizeof(int),
59705+ .mode = 0600,
59706+ .proc_handler = &proc_dointvec,
59707+ },
59708+#endif
59709+#ifdef CONFIG_GRKERNSEC_SIGNAL
59710+ {
59711+ .procname = "signal_logging",
59712+ .data = &grsec_enable_signal,
59713+ .maxlen = sizeof(int),
59714+ .mode = 0600,
59715+ .proc_handler = &proc_dointvec,
59716+ },
59717+#endif
59718+#ifdef CONFIG_GRKERNSEC_FORKFAIL
59719+ {
59720+ .procname = "forkfail_logging",
59721+ .data = &grsec_enable_forkfail,
59722+ .maxlen = sizeof(int),
59723+ .mode = 0600,
59724+ .proc_handler = &proc_dointvec,
59725+ },
59726+#endif
59727+#ifdef CONFIG_GRKERNSEC_TIME
59728+ {
59729+ .procname = "timechange_logging",
59730+ .data = &grsec_enable_time,
59731+ .maxlen = sizeof(int),
59732+ .mode = 0600,
59733+ .proc_handler = &proc_dointvec,
59734+ },
59735+#endif
59736+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59737+ {
59738+ .procname = "chroot_deny_shmat",
59739+ .data = &grsec_enable_chroot_shmat,
59740+ .maxlen = sizeof(int),
59741+ .mode = 0600,
59742+ .proc_handler = &proc_dointvec,
59743+ },
59744+#endif
59745+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59746+ {
59747+ .procname = "chroot_deny_unix",
59748+ .data = &grsec_enable_chroot_unix,
59749+ .maxlen = sizeof(int),
59750+ .mode = 0600,
59751+ .proc_handler = &proc_dointvec,
59752+ },
59753+#endif
59754+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59755+ {
59756+ .procname = "chroot_deny_mount",
59757+ .data = &grsec_enable_chroot_mount,
59758+ .maxlen = sizeof(int),
59759+ .mode = 0600,
59760+ .proc_handler = &proc_dointvec,
59761+ },
59762+#endif
59763+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59764+ {
59765+ .procname = "chroot_deny_fchdir",
59766+ .data = &grsec_enable_chroot_fchdir,
59767+ .maxlen = sizeof(int),
59768+ .mode = 0600,
59769+ .proc_handler = &proc_dointvec,
59770+ },
59771+#endif
59772+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59773+ {
59774+ .procname = "chroot_deny_chroot",
59775+ .data = &grsec_enable_chroot_double,
59776+ .maxlen = sizeof(int),
59777+ .mode = 0600,
59778+ .proc_handler = &proc_dointvec,
59779+ },
59780+#endif
59781+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59782+ {
59783+ .procname = "chroot_deny_pivot",
59784+ .data = &grsec_enable_chroot_pivot,
59785+ .maxlen = sizeof(int),
59786+ .mode = 0600,
59787+ .proc_handler = &proc_dointvec,
59788+ },
59789+#endif
59790+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59791+ {
59792+ .procname = "chroot_enforce_chdir",
59793+ .data = &grsec_enable_chroot_chdir,
59794+ .maxlen = sizeof(int),
59795+ .mode = 0600,
59796+ .proc_handler = &proc_dointvec,
59797+ },
59798+#endif
59799+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59800+ {
59801+ .procname = "chroot_deny_chmod",
59802+ .data = &grsec_enable_chroot_chmod,
59803+ .maxlen = sizeof(int),
59804+ .mode = 0600,
59805+ .proc_handler = &proc_dointvec,
59806+ },
59807+#endif
59808+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59809+ {
59810+ .procname = "chroot_deny_mknod",
59811+ .data = &grsec_enable_chroot_mknod,
59812+ .maxlen = sizeof(int),
59813+ .mode = 0600,
59814+ .proc_handler = &proc_dointvec,
59815+ },
59816+#endif
59817+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59818+ {
59819+ .procname = "chroot_restrict_nice",
59820+ .data = &grsec_enable_chroot_nice,
59821+ .maxlen = sizeof(int),
59822+ .mode = 0600,
59823+ .proc_handler = &proc_dointvec,
59824+ },
59825+#endif
59826+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59827+ {
59828+ .procname = "chroot_execlog",
59829+ .data = &grsec_enable_chroot_execlog,
59830+ .maxlen = sizeof(int),
59831+ .mode = 0600,
59832+ .proc_handler = &proc_dointvec,
59833+ },
59834+#endif
59835+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59836+ {
59837+ .procname = "chroot_caps",
59838+ .data = &grsec_enable_chroot_caps,
59839+ .maxlen = sizeof(int),
59840+ .mode = 0600,
59841+ .proc_handler = &proc_dointvec,
59842+ },
59843+#endif
59844+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59845+ {
59846+ .procname = "chroot_deny_sysctl",
59847+ .data = &grsec_enable_chroot_sysctl,
59848+ .maxlen = sizeof(int),
59849+ .mode = 0600,
59850+ .proc_handler = &proc_dointvec,
59851+ },
59852+#endif
59853+#ifdef CONFIG_GRKERNSEC_TPE
59854+ {
59855+ .procname = "tpe",
59856+ .data = &grsec_enable_tpe,
59857+ .maxlen = sizeof(int),
59858+ .mode = 0600,
59859+ .proc_handler = &proc_dointvec,
59860+ },
59861+ {
59862+ .procname = "tpe_gid",
59863+ .data = &grsec_tpe_gid,
59864+ .maxlen = sizeof(int),
59865+ .mode = 0600,
59866+ .proc_handler = &proc_dointvec,
59867+ },
59868+#endif
59869+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59870+ {
59871+ .procname = "tpe_invert",
59872+ .data = &grsec_enable_tpe_invert,
59873+ .maxlen = sizeof(int),
59874+ .mode = 0600,
59875+ .proc_handler = &proc_dointvec,
59876+ },
59877+#endif
59878+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59879+ {
59880+ .procname = "tpe_restrict_all",
59881+ .data = &grsec_enable_tpe_all,
59882+ .maxlen = sizeof(int),
59883+ .mode = 0600,
59884+ .proc_handler = &proc_dointvec,
59885+ },
59886+#endif
59887+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59888+ {
59889+ .procname = "socket_all",
59890+ .data = &grsec_enable_socket_all,
59891+ .maxlen = sizeof(int),
59892+ .mode = 0600,
59893+ .proc_handler = &proc_dointvec,
59894+ },
59895+ {
59896+ .procname = "socket_all_gid",
59897+ .data = &grsec_socket_all_gid,
59898+ .maxlen = sizeof(int),
59899+ .mode = 0600,
59900+ .proc_handler = &proc_dointvec,
59901+ },
59902+#endif
59903+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59904+ {
59905+ .procname = "socket_client",
59906+ .data = &grsec_enable_socket_client,
59907+ .maxlen = sizeof(int),
59908+ .mode = 0600,
59909+ .proc_handler = &proc_dointvec,
59910+ },
59911+ {
59912+ .procname = "socket_client_gid",
59913+ .data = &grsec_socket_client_gid,
59914+ .maxlen = sizeof(int),
59915+ .mode = 0600,
59916+ .proc_handler = &proc_dointvec,
59917+ },
59918+#endif
59919+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59920+ {
59921+ .procname = "socket_server",
59922+ .data = &grsec_enable_socket_server,
59923+ .maxlen = sizeof(int),
59924+ .mode = 0600,
59925+ .proc_handler = &proc_dointvec,
59926+ },
59927+ {
59928+ .procname = "socket_server_gid",
59929+ .data = &grsec_socket_server_gid,
59930+ .maxlen = sizeof(int),
59931+ .mode = 0600,
59932+ .proc_handler = &proc_dointvec,
59933+ },
59934+#endif
59935+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59936+ {
59937+ .procname = "audit_group",
59938+ .data = &grsec_enable_group,
59939+ .maxlen = sizeof(int),
59940+ .mode = 0600,
59941+ .proc_handler = &proc_dointvec,
59942+ },
59943+ {
59944+ .procname = "audit_gid",
59945+ .data = &grsec_audit_gid,
59946+ .maxlen = sizeof(int),
59947+ .mode = 0600,
59948+ .proc_handler = &proc_dointvec,
59949+ },
59950+#endif
59951+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59952+ {
59953+ .procname = "audit_chdir",
59954+ .data = &grsec_enable_chdir,
59955+ .maxlen = sizeof(int),
59956+ .mode = 0600,
59957+ .proc_handler = &proc_dointvec,
59958+ },
59959+#endif
59960+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59961+ {
59962+ .procname = "audit_mount",
59963+ .data = &grsec_enable_mount,
59964+ .maxlen = sizeof(int),
59965+ .mode = 0600,
59966+ .proc_handler = &proc_dointvec,
59967+ },
59968+#endif
59969+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59970+ {
59971+ .procname = "audit_textrel",
59972+ .data = &grsec_enable_audit_textrel,
59973+ .maxlen = sizeof(int),
59974+ .mode = 0600,
59975+ .proc_handler = &proc_dointvec,
59976+ },
59977+#endif
59978+#ifdef CONFIG_GRKERNSEC_DMESG
59979+ {
59980+ .procname = "dmesg",
59981+ .data = &grsec_enable_dmesg,
59982+ .maxlen = sizeof(int),
59983+ .mode = 0600,
59984+ .proc_handler = &proc_dointvec,
59985+ },
59986+#endif
59987+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59988+ {
59989+ .procname = "chroot_findtask",
59990+ .data = &grsec_enable_chroot_findtask,
59991+ .maxlen = sizeof(int),
59992+ .mode = 0600,
59993+ .proc_handler = &proc_dointvec,
59994+ },
59995+#endif
59996+#ifdef CONFIG_GRKERNSEC_RESLOG
59997+ {
59998+ .procname = "resource_logging",
59999+ .data = &grsec_resource_logging,
60000+ .maxlen = sizeof(int),
60001+ .mode = 0600,
60002+ .proc_handler = &proc_dointvec,
60003+ },
60004+#endif
60005+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
60006+ {
60007+ .procname = "audit_ptrace",
60008+ .data = &grsec_enable_audit_ptrace,
60009+ .maxlen = sizeof(int),
60010+ .mode = 0600,
60011+ .proc_handler = &proc_dointvec,
60012+ },
60013+#endif
60014+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
60015+ {
60016+ .procname = "harden_ptrace",
60017+ .data = &grsec_enable_harden_ptrace,
60018+ .maxlen = sizeof(int),
60019+ .mode = 0600,
60020+ .proc_handler = &proc_dointvec,
60021+ },
60022+#endif
60023+ {
60024+ .procname = "grsec_lock",
60025+ .data = &grsec_lock,
60026+ .maxlen = sizeof(int),
60027+ .mode = 0600,
60028+ .proc_handler = &proc_dointvec,
60029+ },
60030+#endif
60031+#ifdef CONFIG_GRKERNSEC_ROFS
60032+ {
60033+ .procname = "romount_protect",
60034+ .data = &grsec_enable_rofs,
60035+ .maxlen = sizeof(int),
60036+ .mode = 0600,
60037+ .proc_handler = &proc_dointvec_minmax,
60038+ .extra1 = &one,
60039+ .extra2 = &one,
60040+ },
60041+#endif
60042+ { }
60043+};
60044+#endif
60045diff -urNp linux-2.6.39.2/grsecurity/grsec_time.c linux-2.6.39.2/grsecurity/grsec_time.c
60046--- linux-2.6.39.2/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
60047+++ linux-2.6.39.2/grsecurity/grsec_time.c 2011-05-22 19:41:42.000000000 -0400
60048@@ -0,0 +1,16 @@
60049+#include <linux/kernel.h>
60050+#include <linux/sched.h>
60051+#include <linux/grinternal.h>
60052+#include <linux/module.h>
60053+
60054+void
60055+gr_log_timechange(void)
60056+{
60057+#ifdef CONFIG_GRKERNSEC_TIME
60058+ if (grsec_enable_time)
60059+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
60060+#endif
60061+ return;
60062+}
60063+
60064+EXPORT_SYMBOL(gr_log_timechange);
60065diff -urNp linux-2.6.39.2/grsecurity/grsec_tpe.c linux-2.6.39.2/grsecurity/grsec_tpe.c
60066--- linux-2.6.39.2/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
60067+++ linux-2.6.39.2/grsecurity/grsec_tpe.c 2011-05-22 19:41:42.000000000 -0400
60068@@ -0,0 +1,39 @@
60069+#include <linux/kernel.h>
60070+#include <linux/sched.h>
60071+#include <linux/file.h>
60072+#include <linux/fs.h>
60073+#include <linux/grinternal.h>
60074+
60075+extern int gr_acl_tpe_check(void);
60076+
60077+int
60078+gr_tpe_allow(const struct file *file)
60079+{
60080+#ifdef CONFIG_GRKERNSEC
60081+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
60082+ const struct cred *cred = current_cred();
60083+
60084+ if (cred->uid && ((grsec_enable_tpe &&
60085+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
60086+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
60087+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
60088+#else
60089+ in_group_p(grsec_tpe_gid)
60090+#endif
60091+ ) || gr_acl_tpe_check()) &&
60092+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
60093+ (inode->i_mode & S_IWOTH))))) {
60094+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
60095+ return 0;
60096+ }
60097+#ifdef CONFIG_GRKERNSEC_TPE_ALL
60098+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
60099+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
60100+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
60101+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
60102+ return 0;
60103+ }
60104+#endif
60105+#endif
60106+ return 1;
60107+}
60108diff -urNp linux-2.6.39.2/grsecurity/grsum.c linux-2.6.39.2/grsecurity/grsum.c
60109--- linux-2.6.39.2/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
60110+++ linux-2.6.39.2/grsecurity/grsum.c 2011-05-22 19:41:42.000000000 -0400
60111@@ -0,0 +1,61 @@
60112+#include <linux/err.h>
60113+#include <linux/kernel.h>
60114+#include <linux/sched.h>
60115+#include <linux/mm.h>
60116+#include <linux/scatterlist.h>
60117+#include <linux/crypto.h>
60118+#include <linux/gracl.h>
60119+
60120+
60121+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
60122+#error "crypto and sha256 must be built into the kernel"
60123+#endif
60124+
60125+int
60126+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
60127+{
60128+ char *p;
60129+ struct crypto_hash *tfm;
60130+ struct hash_desc desc;
60131+ struct scatterlist sg;
60132+ unsigned char temp_sum[GR_SHA_LEN];
60133+ volatile int retval = 0;
60134+ volatile int dummy = 0;
60135+ unsigned int i;
60136+
60137+ sg_init_table(&sg, 1);
60138+
60139+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
60140+ if (IS_ERR(tfm)) {
60141+ /* should never happen, since sha256 should be built in */
60142+ return 1;
60143+ }
60144+
60145+ desc.tfm = tfm;
60146+ desc.flags = 0;
60147+
60148+ crypto_hash_init(&desc);
60149+
60150+ p = salt;
60151+ sg_set_buf(&sg, p, GR_SALT_LEN);
60152+ crypto_hash_update(&desc, &sg, sg.length);
60153+
60154+ p = entry->pw;
60155+ sg_set_buf(&sg, p, strlen(p));
60156+
60157+ crypto_hash_update(&desc, &sg, sg.length);
60158+
60159+ crypto_hash_final(&desc, temp_sum);
60160+
60161+ memset(entry->pw, 0, GR_PW_LEN);
60162+
60163+ for (i = 0; i < GR_SHA_LEN; i++)
60164+ if (sum[i] != temp_sum[i])
60165+ retval = 1;
60166+ else
60167+ dummy = 1; // waste a cycle
60168+
60169+ crypto_free_hash(tfm);
60170+
60171+ return retval;
60172+}
60173diff -urNp linux-2.6.39.2/grsecurity/Kconfig linux-2.6.39.2/grsecurity/Kconfig
60174--- linux-2.6.39.2/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
60175+++ linux-2.6.39.2/grsecurity/Kconfig 2011-06-29 20:57:06.000000000 -0400
60176@@ -0,0 +1,1048 @@
60177+#
60178+# grecurity configuration
60179+#
60180+
60181+menu "Grsecurity"
60182+
60183+config GRKERNSEC
60184+ bool "Grsecurity"
60185+ select CRYPTO
60186+ select CRYPTO_SHA256
60187+ help
60188+ If you say Y here, you will be able to configure many features
60189+ that will enhance the security of your system. It is highly
60190+ recommended that you say Y here and read through the help
60191+ for each option so that you fully understand the features and
60192+ can evaluate their usefulness for your machine.
60193+
60194+choice
60195+ prompt "Security Level"
60196+ depends on GRKERNSEC
60197+ default GRKERNSEC_CUSTOM
60198+
60199+config GRKERNSEC_LOW
60200+ bool "Low"
60201+ select GRKERNSEC_LINK
60202+ select GRKERNSEC_FIFO
60203+ select GRKERNSEC_EXECVE
60204+ select GRKERNSEC_RANDNET
60205+ select GRKERNSEC_DMESG
60206+ select GRKERNSEC_CHROOT
60207+ select GRKERNSEC_CHROOT_CHDIR
60208+
60209+ help
60210+ If you choose this option, several of the grsecurity options will
60211+ be enabled that will give you greater protection against a number
60212+ of attacks, while assuring that none of your software will have any
60213+ conflicts with the additional security measures. If you run a lot
60214+ of unusual software, or you are having problems with the higher
60215+ security levels, you should say Y here. With this option, the
60216+ following features are enabled:
60217+
60218+ - Linking restrictions
60219+ - FIFO restrictions
60220+ - Enforcing RLIMIT_NPROC on execve
60221+ - Restricted dmesg
60222+ - Enforced chdir("/") on chroot
60223+ - Runtime module disabling
60224+
60225+config GRKERNSEC_MEDIUM
60226+ bool "Medium"
60227+ select PAX
60228+ select PAX_EI_PAX
60229+ select PAX_PT_PAX_FLAGS
60230+ select PAX_HAVE_ACL_FLAGS
60231+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
60232+ select GRKERNSEC_CHROOT
60233+ select GRKERNSEC_CHROOT_SYSCTL
60234+ select GRKERNSEC_LINK
60235+ select GRKERNSEC_FIFO
60236+ select GRKERNSEC_EXECVE
60237+ select GRKERNSEC_DMESG
60238+ select GRKERNSEC_RANDNET
60239+ select GRKERNSEC_FORKFAIL
60240+ select GRKERNSEC_TIME
60241+ select GRKERNSEC_SIGNAL
60242+ select GRKERNSEC_CHROOT
60243+ select GRKERNSEC_CHROOT_UNIX
60244+ select GRKERNSEC_CHROOT_MOUNT
60245+ select GRKERNSEC_CHROOT_PIVOT
60246+ select GRKERNSEC_CHROOT_DOUBLE
60247+ select GRKERNSEC_CHROOT_CHDIR
60248+ select GRKERNSEC_CHROOT_MKNOD
60249+ select GRKERNSEC_PROC
60250+ select GRKERNSEC_PROC_USERGROUP
60251+ select PAX_RANDUSTACK
60252+ select PAX_ASLR
60253+ select PAX_RANDMMAP
60254+ select PAX_REFCOUNT if (X86 || SPARC64)
60255+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB))
60256+
60257+ help
60258+ If you say Y here, several features in addition to those included
60259+ in the low additional security level will be enabled. These
60260+ features provide even more security to your system, though in rare
60261+ cases they may be incompatible with very old or poorly written
60262+ software. If you enable this option, make sure that your auth
60263+ service (identd) is running as gid 1001. With this option,
60264+ the following features (in addition to those provided in the
60265+ low additional security level) will be enabled:
60266+
60267+ - Failed fork logging
60268+ - Time change logging
60269+ - Signal logging
60270+ - Deny mounts in chroot
60271+ - Deny double chrooting
60272+ - Deny sysctl writes in chroot
60273+ - Deny mknod in chroot
60274+ - Deny access to abstract AF_UNIX sockets out of chroot
60275+ - Deny pivot_root in chroot
60276+ - Denied writes of /dev/kmem, /dev/mem, and /dev/port
60277+ - /proc restrictions with special GID set to 10 (usually wheel)
60278+ - Address Space Layout Randomization (ASLR)
60279+ - Prevent exploitation of most refcount overflows
60280+ - Bounds checking of copying between the kernel and userland
60281+
60282+config GRKERNSEC_HIGH
60283+ bool "High"
60284+ select GRKERNSEC_LINK
60285+ select GRKERNSEC_FIFO
60286+ select GRKERNSEC_EXECVE
60287+ select GRKERNSEC_DMESG
60288+ select GRKERNSEC_FORKFAIL
60289+ select GRKERNSEC_TIME
60290+ select GRKERNSEC_SIGNAL
60291+ select GRKERNSEC_CHROOT
60292+ select GRKERNSEC_CHROOT_SHMAT
60293+ select GRKERNSEC_CHROOT_UNIX
60294+ select GRKERNSEC_CHROOT_MOUNT
60295+ select GRKERNSEC_CHROOT_FCHDIR
60296+ select GRKERNSEC_CHROOT_PIVOT
60297+ select GRKERNSEC_CHROOT_DOUBLE
60298+ select GRKERNSEC_CHROOT_CHDIR
60299+ select GRKERNSEC_CHROOT_MKNOD
60300+ select GRKERNSEC_CHROOT_CAPS
60301+ select GRKERNSEC_CHROOT_SYSCTL
60302+ select GRKERNSEC_CHROOT_FINDTASK
60303+ select GRKERNSEC_SYSFS_RESTRICT
60304+ select GRKERNSEC_PROC
60305+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
60306+ select GRKERNSEC_HIDESYM
60307+ select GRKERNSEC_BRUTE
60308+ select GRKERNSEC_PROC_USERGROUP
60309+ select GRKERNSEC_KMEM
60310+ select GRKERNSEC_RESLOG
60311+ select GRKERNSEC_RANDNET
60312+ select GRKERNSEC_PROC_ADD
60313+ select GRKERNSEC_CHROOT_CHMOD
60314+ select GRKERNSEC_CHROOT_NICE
60315+ select GRKERNSEC_AUDIT_MOUNT
60316+ select GRKERNSEC_MODHARDEN if (MODULES)
60317+ select GRKERNSEC_HARDEN_PTRACE
60318+ select GRKERNSEC_VM86 if (X86_32)
60319+ select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
60320+ select PAX
60321+ select PAX_RANDUSTACK
60322+ select PAX_ASLR
60323+ select PAX_RANDMMAP
60324+ select PAX_NOEXEC
60325+ select PAX_MPROTECT
60326+ select PAX_EI_PAX
60327+ select PAX_PT_PAX_FLAGS
60328+ select PAX_HAVE_ACL_FLAGS
60329+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
60330+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
60331+ select PAX_RANDKSTACK if (X86_TSC && X86)
60332+ select PAX_SEGMEXEC if (X86_32)
60333+ select PAX_PAGEEXEC
60334+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
60335+ select PAX_EMUTRAMP if (PARISC)
60336+ select PAX_EMUSIGRT if (PARISC)
60337+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
60338+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
60339+ select PAX_REFCOUNT if (X86 || SPARC64)
60340+ select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB))
60341+ help
60342+ If you say Y here, many of the features of grsecurity will be
60343+ enabled, which will protect you against many kinds of attacks
60344+ against your system. The heightened security comes at a cost
60345+ of an increased chance of incompatibilities with rare software
60346+ on your machine. Since this security level enables PaX, you should
60347+ view <http://pax.grsecurity.net> and read about the PaX
60348+ project. While you are there, download chpax and run it on
60349+ binaries that cause problems with PaX. Also remember that
60350+ since the /proc restrictions are enabled, you must run your
60351+ identd as gid 1001. This security level enables the following
60352+ features in addition to those listed in the low and medium
60353+ security levels:
60354+
60355+ - Additional /proc restrictions
60356+ - Chmod restrictions in chroot
60357+ - No signals, ptrace, or viewing of processes outside of chroot
60358+ - Capability restrictions in chroot
60359+ - Deny fchdir out of chroot
60360+ - Priority restrictions in chroot
60361+ - Segmentation-based implementation of PaX
60362+ - Mprotect restrictions
60363+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
60364+ - Kernel stack randomization
60365+ - Mount/unmount/remount logging
60366+ - Kernel symbol hiding
60367+ - Prevention of memory exhaustion-based exploits
60368+ - Hardening of module auto-loading
60369+ - Ptrace restrictions
60370+ - Restricted vm86 mode
60371+ - Restricted sysfs/debugfs
60372+ - Active kernel exploit response
60373+
60374+config GRKERNSEC_CUSTOM
60375+ bool "Custom"
60376+ help
60377+ If you say Y here, you will be able to configure every grsecurity
60378+ option, which allows you to enable many more features that aren't
60379+ covered in the basic security levels. These additional features
60380+ include TPE, socket restrictions, and the sysctl system for
60381+ grsecurity. It is advised that you read through the help for
60382+ each option to determine its usefulness in your situation.
60383+
60384+endchoice
60385+
60386+menu "Address Space Protection"
60387+depends on GRKERNSEC
60388+
60389+config GRKERNSEC_KMEM
60390+ bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
60391+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
60392+ help
60393+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
60394+ be written to via mmap or otherwise to modify the running kernel.
60395+ /dev/port will also not be allowed to be opened. If you have module
60396+ support disabled, enabling this will close up four ways that are
60397+ currently used to insert malicious code into the running kernel.
60398+ Even with all these features enabled, we still highly recommend that
60399+ you use the RBAC system, as it is still possible for an attacker to
60400+ modify the running kernel through privileged I/O granted by ioperm/iopl.
60401+ If you are not using XFree86, you may be able to stop this additional
60402+ case by enabling the 'Disable privileged I/O' option. Though nothing
60403+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
60404+ but only to video memory, which is the only writing we allow in this
60405+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
60406+ not be allowed to mprotect it with PROT_WRITE later.
60407+ It is highly recommended that you say Y here if you meet all the
60408+ conditions above.
60409+
60410+config GRKERNSEC_VM86
60411+ bool "Restrict VM86 mode"
60412+ depends on X86_32
60413+
60414+ help
60415+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
60416+ make use of a special execution mode on 32bit x86 processors called
60417+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
60418+ video cards and will still work with this option enabled. The purpose
60419+ of the option is to prevent exploitation of emulation errors in
60420+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
60421+ Nearly all users should be able to enable this option.
60422+
60423+config GRKERNSEC_IO
60424+ bool "Disable privileged I/O"
60425+ depends on X86
60426+ select RTC_CLASS
60427+ select RTC_INTF_DEV
60428+ select RTC_DRV_CMOS
60429+
60430+ help
60431+ If you say Y here, all ioperm and iopl calls will return an error.
60432+ Ioperm and iopl can be used to modify the running kernel.
60433+ Unfortunately, some programs need this access to operate properly,
60434+ the most notable of which are XFree86 and hwclock. hwclock can be
60435+ remedied by having RTC support in the kernel, so real-time
60436+ clock support is enabled if this option is enabled, to ensure
60437+ that hwclock operates correctly. XFree86 still will not
60438+ operate correctly with this option enabled, so DO NOT CHOOSE Y
60439+ IF YOU USE XFree86. If you use XFree86 and you still want to
60440+ protect your kernel against modification, use the RBAC system.
60441+
60442+config GRKERNSEC_PROC_MEMMAP
60443+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
60444+ default y if (PAX_NOEXEC || PAX_ASLR)
60445+ depends on PAX_NOEXEC || PAX_ASLR
60446+ help
60447+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
60448+ give no information about the addresses of its mappings if
60449+ PaX features that rely on random addresses are enabled on the task.
60450+ If you use PaX it is greatly recommended that you say Y here as it
60451+ closes up a hole that makes the full ASLR useless for suid
60452+ binaries.
60453+
60454+config GRKERNSEC_BRUTE
60455+ bool "Deter exploit bruteforcing"
60456+ help
60457+ If you say Y here, attempts to bruteforce exploits against forking
60458+ daemons such as apache or sshd, as well as against suid/sgid binaries
60459+ will be deterred. When a child of a forking daemon is killed by PaX
60460+ or crashes due to an illegal instruction or other suspicious signal,
60461+ the parent process will be delayed 30 seconds upon every subsequent
60462+ fork until the administrator is able to assess the situation and
60463+ restart the daemon.
60464+ In the suid/sgid case, the attempt is logged, the user has all their
60465+ processes terminated, and they are prevented from executing any further
60466+ processes for 15 minutes.
60467+ It is recommended that you also enable signal logging in the auditing
60468+ section so that logs are generated when a process triggers a suspicious
60469+ signal.
60470+ If the sysctl option is enabled, a sysctl option with name
60471+ "deter_bruteforce" is created.
60472+
60473+
60474+config GRKERNSEC_MODHARDEN
60475+ bool "Harden module auto-loading"
60476+ depends on MODULES
60477+ help
60478+ If you say Y here, module auto-loading in response to use of some
60479+ feature implemented by an unloaded module will be restricted to
60480+ root users. Enabling this option helps defend against attacks
60481+ by unprivileged users who abuse the auto-loading behavior to
60482+ cause a vulnerable module to load that is then exploited.
60483+
60484+ If this option prevents a legitimate use of auto-loading for a
60485+ non-root user, the administrator can execute modprobe manually
60486+ with the exact name of the module mentioned in the alert log.
60487+ Alternatively, the administrator can add the module to the list
60488+ of modules loaded at boot by modifying init scripts.
60489+
60490+ Modification of init scripts will most likely be needed on
60491+ Ubuntu servers with encrypted home directory support enabled,
60492+ as the first non-root user logging in will cause the ecb(aes),
60493+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
60494+
60495+config GRKERNSEC_HIDESYM
60496+ bool "Hide kernel symbols"
60497+ help
60498+ If you say Y here, getting information on loaded modules, and
60499+ displaying all kernel symbols through a syscall will be restricted
60500+ to users with CAP_SYS_MODULE. For software compatibility reasons,
60501+ /proc/kallsyms will be restricted to the root user. The RBAC
60502+ system can hide that entry even from root.
60503+
60504+ This option also prevents leaking of kernel addresses through
60505+ several /proc entries.
60506+
60507+ Note that this option is only effective provided the following
60508+ conditions are met:
60509+ 1) The kernel using grsecurity is not precompiled by some distribution
60510+ 2) You have also enabled GRKERNSEC_DMESG
60511+ 3) You are using the RBAC system and hiding other files such as your
60512+ kernel image and System.map. Alternatively, enabling this option
60513+ causes the permissions on /boot, /lib/modules, and the kernel
60514+ source directory to change at compile time to prevent
60515+ reading by non-root users.
60516+ If the above conditions are met, this option will aid in providing a
60517+ useful protection against local kernel exploitation of overflows
60518+ and arbitrary read/write vulnerabilities.
60519+
60520+config GRKERNSEC_KERN_LOCKOUT
60521+ bool "Active kernel exploit response"
60522+ depends on X86 || ARM || PPC || SPARC
60523+ help
60524+ If you say Y here, when a PaX alert is triggered due to suspicious
60525+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
60526+ or an OOPs occurs due to bad memory accesses, instead of just
60527+ terminating the offending process (and potentially allowing
60528+ a subsequent exploit from the same user), we will take one of two
60529+ actions:
60530+ If the user was root, we will panic the system
60531+ If the user was non-root, we will log the attempt, terminate
60532+ all processes owned by the user, then prevent them from creating
60533+ any new processes until the system is restarted
60534+ This deters repeated kernel exploitation/bruteforcing attempts
60535+ and is useful for later forensics.
60536+
60537+endmenu
60538+menu "Role Based Access Control Options"
60539+depends on GRKERNSEC
60540+
60541+config GRKERNSEC_RBAC_DEBUG
60542+ bool
60543+
60544+config GRKERNSEC_NO_RBAC
60545+ bool "Disable RBAC system"
60546+ help
60547+ If you say Y here, the /dev/grsec device will be removed from the kernel,
60548+ preventing the RBAC system from being enabled. You should only say Y
60549+ here if you have no intention of using the RBAC system, so as to prevent
60550+ an attacker with root access from misusing the RBAC system to hide files
60551+ and processes when loadable module support and /dev/[k]mem have been
60552+ locked down.
60553+
60554+config GRKERNSEC_ACL_HIDEKERN
60555+ bool "Hide kernel processes"
60556+ help
60557+ If you say Y here, all kernel threads will be hidden to all
60558+ processes but those whose subject has the "view hidden processes"
60559+ flag.
60560+
60561+config GRKERNSEC_ACL_MAXTRIES
60562+ int "Maximum tries before password lockout"
60563+ default 3
60564+ help
60565+ This option enforces the maximum number of times a user can attempt
60566+ to authorize themselves with the grsecurity RBAC system before being
60567+ denied the ability to attempt authorization again for a specified time.
60568+ The lower the number, the harder it will be to brute-force a password.
60569+
60570+config GRKERNSEC_ACL_TIMEOUT
60571+ int "Time to wait after max password tries, in seconds"
60572+ default 30
60573+ help
60574+ This option specifies the time the user must wait after attempting to
60575+ authorize to the RBAC system with the maximum number of invalid
60576+ passwords. The higher the number, the harder it will be to brute-force
60577+ a password.
60578+
60579+endmenu
60580+menu "Filesystem Protections"
60581+depends on GRKERNSEC
60582+
60583+config GRKERNSEC_PROC
60584+ bool "Proc restrictions"
60585+ help
60586+ If you say Y here, the permissions of the /proc filesystem
60587+ will be altered to enhance system security and privacy. You MUST
60588+ choose either a user only restriction or a user and group restriction.
60589+ Depending upon the option you choose, you can either restrict users to
60590+ see only the processes they themselves run, or choose a group that can
60591+ view all processes and files normally restricted to root if you choose
60592+ the "restrict to user only" option. NOTE: If you're running identd as
60593+ a non-root user, you will have to run it as the group you specify here.
60594+
60595+config GRKERNSEC_PROC_USER
60596+ bool "Restrict /proc to user only"
60597+ depends on GRKERNSEC_PROC
60598+ help
60599+ If you say Y here, non-root users will only be able to view their own
60600+ processes, and restricts them from viewing network-related information,
60601+ and viewing kernel symbol and module information.
60602+
60603+config GRKERNSEC_PROC_USERGROUP
60604+ bool "Allow special group"
60605+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
60606+ help
60607+ If you say Y here, you will be able to select a group that will be
60608+ able to view all processes and network-related information. If you've
60609+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
60610+ remain hidden. This option is useful if you want to run identd as
60611+ a non-root user.
60612+
60613+config GRKERNSEC_PROC_GID
60614+ int "GID for special group"
60615+ depends on GRKERNSEC_PROC_USERGROUP
60616+ default 1001
60617+
60618+config GRKERNSEC_PROC_ADD
60619+ bool "Additional restrictions"
60620+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
60621+ help
60622+ If you say Y here, additional restrictions will be placed on
60623+ /proc that keep normal users from viewing device information and
60624+ slabinfo information that could be useful for exploits.
60625+
60626+config GRKERNSEC_LINK
60627+ bool "Linking restrictions"
60628+ help
60629+ If you say Y here, /tmp race exploits will be prevented, since users
60630+ will no longer be able to follow symlinks owned by other users in
60631+ world-writable +t directories (e.g. /tmp), unless the owner of the
60632+ symlink is the owner of the directory. users will also not be
60633+ able to hardlink to files they do not own. If the sysctl option is
60634+ enabled, a sysctl option with name "linking_restrictions" is created.
60635+
60636+config GRKERNSEC_FIFO
60637+ bool "FIFO restrictions"
60638+ help
60639+ If you say Y here, users will not be able to write to FIFOs they don't
60640+ own in world-writable +t directories (e.g. /tmp), unless the owner of
60641+ the FIFO is the same owner of the directory it's held in. If the sysctl
60642+ option is enabled, a sysctl option with name "fifo_restrictions" is
60643+ created.
60644+
60645+config GRKERNSEC_SYSFS_RESTRICT
60646+ bool "Sysfs/debugfs restriction"
60647+ depends on SYSFS
60648+ help
60649+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
60650+ any filesystem normally mounted under it (e.g. debugfs) will only
60651+ be accessible by root. These filesystems generally provide access
60652+ to hardware and debug information that isn't appropriate for unprivileged
60653+ users of the system. Sysfs and debugfs have also become a large source
60654+ of new vulnerabilities, ranging from infoleaks to local compromise.
60655+ There has been very little oversight with an eye toward security involved
60656+ in adding new exporters of information to these filesystems, so their
60657+ use is discouraged.
60658+ This option is equivalent to a chmod 0700 of the mount paths.
60659+
60660+config GRKERNSEC_ROFS
60661+ bool "Runtime read-only mount protection"
60662+ help
60663+ If you say Y here, a sysctl option with name "romount_protect" will
60664+ be created. By setting this option to 1 at runtime, filesystems
60665+ will be protected in the following ways:
60666+ * No new writable mounts will be allowed
60667+ * Existing read-only mounts won't be able to be remounted read/write
60668+ * Write operations will be denied on all block devices
60669+ This option acts independently of grsec_lock: once it is set to 1,
60670+ it cannot be turned off. Therefore, please be mindful of the resulting
60671+ behavior if this option is enabled in an init script on a read-only
60672+ filesystem. This feature is mainly intended for secure embedded systems.
60673+
60674+config GRKERNSEC_CHROOT
60675+ bool "Chroot jail restrictions"
60676+ help
60677+ If you say Y here, you will be able to choose several options that will
60678+ make breaking out of a chrooted jail much more difficult. If you
60679+ encounter no software incompatibilities with the following options, it
60680+ is recommended that you enable each one.
60681+
60682+config GRKERNSEC_CHROOT_MOUNT
60683+ bool "Deny mounts"
60684+ depends on GRKERNSEC_CHROOT
60685+ help
60686+ If you say Y here, processes inside a chroot will not be able to
60687+ mount or remount filesystems. If the sysctl option is enabled, a
60688+ sysctl option with name "chroot_deny_mount" is created.
60689+
60690+config GRKERNSEC_CHROOT_DOUBLE
60691+ bool "Deny double-chroots"
60692+ depends on GRKERNSEC_CHROOT
60693+ help
60694+ If you say Y here, processes inside a chroot will not be able to chroot
60695+ again outside the chroot. This is a widely used method of breaking
60696+ out of a chroot jail and should not be allowed. If the sysctl
60697+ option is enabled, a sysctl option with name
60698+ "chroot_deny_chroot" is created.
60699+
60700+config GRKERNSEC_CHROOT_PIVOT
60701+ bool "Deny pivot_root in chroot"
60702+ depends on GRKERNSEC_CHROOT
60703+ help
60704+ If you say Y here, processes inside a chroot will not be able to use
60705+ a function called pivot_root() that was introduced in Linux 2.3.41. It
60706+ works similar to chroot in that it changes the root filesystem. This
60707+ function could be misused in a chrooted process to attempt to break out
60708+ of the chroot, and therefore should not be allowed. If the sysctl
60709+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
60710+ created.
60711+
60712+config GRKERNSEC_CHROOT_CHDIR
60713+ bool "Enforce chdir(\"/\") on all chroots"
60714+ depends on GRKERNSEC_CHROOT
60715+ help
60716+ If you say Y here, the current working directory of all newly-chrooted
60717+ applications will be set to the the root directory of the chroot.
60718+ The man page on chroot(2) states:
60719+ Note that this call does not change the current working
60720+ directory, so that `.' can be outside the tree rooted at
60721+ `/'. In particular, the super-user can escape from a
60722+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
60723+
60724+ It is recommended that you say Y here, since it's not known to break
60725+ any software. If the sysctl option is enabled, a sysctl option with
60726+ name "chroot_enforce_chdir" is created.
60727+
60728+config GRKERNSEC_CHROOT_CHMOD
60729+ bool "Deny (f)chmod +s"
60730+ depends on GRKERNSEC_CHROOT
60731+ help
60732+ If you say Y here, processes inside a chroot will not be able to chmod
60733+ or fchmod files to make them have suid or sgid bits. This protects
60734+ against another published method of breaking a chroot. If the sysctl
60735+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
60736+ created.
60737+
60738+config GRKERNSEC_CHROOT_FCHDIR
60739+ bool "Deny fchdir out of chroot"
60740+ depends on GRKERNSEC_CHROOT
60741+ help
60742+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
60743+ to a file descriptor of the chrooting process that points to a directory
60744+ outside the filesystem will be stopped. If the sysctl option
60745+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
60746+
60747+config GRKERNSEC_CHROOT_MKNOD
60748+ bool "Deny mknod"
60749+ depends on GRKERNSEC_CHROOT
60750+ help
60751+ If you say Y here, processes inside a chroot will not be allowed to
60752+ mknod. The problem with using mknod inside a chroot is that it
60753+ would allow an attacker to create a device entry that is the same
60754+ as one on the physical root of your system, which could range from
60755+ anything from the console device to a device for your harddrive (which
60756+ they could then use to wipe the drive or steal data). It is recommended
60757+ that you say Y here, unless you run into software incompatibilities.
60758+ If the sysctl option is enabled, a sysctl option with name
60759+ "chroot_deny_mknod" is created.
60760+
60761+config GRKERNSEC_CHROOT_SHMAT
60762+ bool "Deny shmat() out of chroot"
60763+ depends on GRKERNSEC_CHROOT
60764+ help
60765+ If you say Y here, processes inside a chroot will not be able to attach
60766+ to shared memory segments that were created outside of the chroot jail.
60767+ It is recommended that you say Y here. If the sysctl option is enabled,
60768+ a sysctl option with name "chroot_deny_shmat" is created.
60769+
60770+config GRKERNSEC_CHROOT_UNIX
60771+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
60772+ depends on GRKERNSEC_CHROOT
60773+ help
60774+ If you say Y here, processes inside a chroot will not be able to
60775+ connect to abstract (meaning not belonging to a filesystem) Unix
60776+ domain sockets that were bound outside of a chroot. It is recommended
60777+ that you say Y here. If the sysctl option is enabled, a sysctl option
60778+ with name "chroot_deny_unix" is created.
60779+
60780+config GRKERNSEC_CHROOT_FINDTASK
60781+ bool "Protect outside processes"
60782+ depends on GRKERNSEC_CHROOT
60783+ help
60784+ If you say Y here, processes inside a chroot will not be able to
60785+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
60786+ getsid, or view any process outside of the chroot. If the sysctl
60787+ option is enabled, a sysctl option with name "chroot_findtask" is
60788+ created.
60789+
60790+config GRKERNSEC_CHROOT_NICE
60791+ bool "Restrict priority changes"
60792+ depends on GRKERNSEC_CHROOT
60793+ help
60794+ If you say Y here, processes inside a chroot will not be able to raise
60795+ the priority of processes in the chroot, or alter the priority of
60796+ processes outside the chroot. This provides more security than simply
60797+ removing CAP_SYS_NICE from the process' capability set. If the
60798+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
60799+ is created.
60800+
60801+config GRKERNSEC_CHROOT_SYSCTL
60802+ bool "Deny sysctl writes"
60803+ depends on GRKERNSEC_CHROOT
60804+ help
60805+ If you say Y here, an attacker in a chroot will not be able to
60806+ write to sysctl entries, either by sysctl(2) or through a /proc
60807+ interface. It is strongly recommended that you say Y here. If the
60808+ sysctl option is enabled, a sysctl option with name
60809+ "chroot_deny_sysctl" is created.
60810+
60811+config GRKERNSEC_CHROOT_CAPS
60812+ bool "Capability restrictions"
60813+ depends on GRKERNSEC_CHROOT
60814+ help
60815+ If you say Y here, the capabilities on all root processes within a
60816+ chroot jail will be lowered to stop module insertion, raw i/o,
60817+ system and net admin tasks, rebooting the system, modifying immutable
60818+ files, modifying IPC owned by another, and changing the system time.
60819+ This is left an option because it can break some apps. Disable this
60820+ if your chrooted apps are having problems performing those kinds of
60821+ tasks. If the sysctl option is enabled, a sysctl option with
60822+ name "chroot_caps" is created.
60823+
60824+endmenu
60825+menu "Kernel Auditing"
60826+depends on GRKERNSEC
60827+
60828+config GRKERNSEC_AUDIT_GROUP
60829+ bool "Single group for auditing"
60830+ help
60831+ If you say Y here, the exec, chdir, and (un)mount logging features
60832+ will only operate on a group you specify. This option is recommended
60833+ if you only want to watch certain users instead of having a large
60834+ amount of logs from the entire system. If the sysctl option is enabled,
60835+ a sysctl option with name "audit_group" is created.
60836+
60837+config GRKERNSEC_AUDIT_GID
60838+ int "GID for auditing"
60839+ depends on GRKERNSEC_AUDIT_GROUP
60840+ default 1007
60841+
60842+config GRKERNSEC_EXECLOG
60843+ bool "Exec logging"
60844+ help
60845+ If you say Y here, all execve() calls will be logged (since the
60846+ other exec*() calls are frontends to execve(), all execution
60847+ will be logged). Useful for shell-servers that like to keep track
60848+ of their users. If the sysctl option is enabled, a sysctl option with
60849+ name "exec_logging" is created.
60850+ WARNING: This option when enabled will produce a LOT of logs, especially
60851+ on an active system.
60852+
60853+config GRKERNSEC_RESLOG
60854+ bool "Resource logging"
60855+ help
60856+ If you say Y here, all attempts to overstep resource limits will
60857+ be logged with the resource name, the requested size, and the current
60858+ limit. It is highly recommended that you say Y here. If the sysctl
60859+ option is enabled, a sysctl option with name "resource_logging" is
60860+ created. If the RBAC system is enabled, the sysctl value is ignored.
60861+
60862+config GRKERNSEC_CHROOT_EXECLOG
60863+ bool "Log execs within chroot"
60864+ help
60865+ If you say Y here, all executions inside a chroot jail will be logged
60866+ to syslog. This can cause a large amount of logs if certain
60867+ applications (eg. djb's daemontools) are installed on the system, and
60868+ is therefore left as an option. If the sysctl option is enabled, a
60869+ sysctl option with name "chroot_execlog" is created.
60870+
60871+config GRKERNSEC_AUDIT_PTRACE
60872+ bool "Ptrace logging"
60873+ help
60874+ If you say Y here, all attempts to attach to a process via ptrace
60875+ will be logged. If the sysctl option is enabled, a sysctl option
60876+ with name "audit_ptrace" is created.
60877+
60878+config GRKERNSEC_AUDIT_CHDIR
60879+ bool "Chdir logging"
60880+ help
60881+ If you say Y here, all chdir() calls will be logged. If the sysctl
60882+ option is enabled, a sysctl option with name "audit_chdir" is created.
60883+
60884+config GRKERNSEC_AUDIT_MOUNT
60885+ bool "(Un)Mount logging"
60886+ help
60887+ If you say Y here, all mounts and unmounts will be logged. If the
60888+ sysctl option is enabled, a sysctl option with name "audit_mount" is
60889+ created.
60890+
60891+config GRKERNSEC_SIGNAL
60892+ bool "Signal logging"
60893+ help
60894+ If you say Y here, certain important signals will be logged, such as
60895+ SIGSEGV, which will as a result inform you of when a error in a program
60896+ occurred, which in some cases could mean a possible exploit attempt.
60897+ If the sysctl option is enabled, a sysctl option with name
60898+ "signal_logging" is created.
60899+
60900+config GRKERNSEC_FORKFAIL
60901+ bool "Fork failure logging"
60902+ help
60903+ If you say Y here, all failed fork() attempts will be logged.
60904+ This could suggest a fork bomb, or someone attempting to overstep
60905+ their process limit. If the sysctl option is enabled, a sysctl option
60906+ with name "forkfail_logging" is created.
60907+
60908+config GRKERNSEC_TIME
60909+ bool "Time change logging"
60910+ help
60911+ If you say Y here, any changes of the system clock will be logged.
60912+ If the sysctl option is enabled, a sysctl option with name
60913+ "timechange_logging" is created.
60914+
60915+config GRKERNSEC_PROC_IPADDR
60916+ bool "/proc/<pid>/ipaddr support"
60917+ help
60918+ If you say Y here, a new entry will be added to each /proc/<pid>
60919+ directory that contains the IP address of the person using the task.
60920+ The IP is carried across local TCP and AF_UNIX stream sockets.
60921+ This information can be useful for IDS/IPSes to perform remote response
60922+ to a local attack. The entry is readable by only the owner of the
60923+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
60924+ the RBAC system), and thus does not create privacy concerns.
60925+
60926+config GRKERNSEC_RWXMAP_LOG
60927+ bool 'Denied RWX mmap/mprotect logging'
60928+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
60929+ help
60930+ If you say Y here, calls to mmap() and mprotect() with explicit
60931+ usage of PROT_WRITE and PROT_EXEC together will be logged when
60932+ denied by the PAX_MPROTECT feature. If the sysctl option is
60933+ enabled, a sysctl option with name "rwxmap_logging" is created.
60934+
60935+config GRKERNSEC_AUDIT_TEXTREL
60936+ bool 'ELF text relocations logging (READ HELP)'
60937+ depends on PAX_MPROTECT
60938+ help
60939+ If you say Y here, text relocations will be logged with the filename
60940+ of the offending library or binary. The purpose of the feature is
60941+ to help Linux distribution developers get rid of libraries and
60942+ binaries that need text relocations which hinder the future progress
60943+ of PaX. Only Linux distribution developers should say Y here, and
60944+ never on a production machine, as this option creates an information
60945+ leak that could aid an attacker in defeating the randomization of
60946+ a single memory region. If the sysctl option is enabled, a sysctl
60947+ option with name "audit_textrel" is created.
60948+
60949+endmenu
60950+
60951+menu "Executable Protections"
60952+depends on GRKERNSEC
60953+
60954+config GRKERNSEC_EXECVE
60955+ bool "Enforce RLIMIT_NPROC on execs"
60956+ help
60957+ If you say Y here, users with a resource limit on processes will
60958+ have the value checked during execve() calls. The current system
60959+ only checks the system limit during fork() calls. If the sysctl option
60960+ is enabled, a sysctl option with name "execve_limiting" is created.
60961+
60962+config GRKERNSEC_DMESG
60963+ bool "Dmesg(8) restriction"
60964+ help
60965+ If you say Y here, non-root users will not be able to use dmesg(8)
60966+ to view up to the last 4kb of messages in the kernel's log buffer.
60967+ The kernel's log buffer often contains kernel addresses and other
60968+ identifying information useful to an attacker in fingerprinting a
60969+ system for a targeted exploit.
60970+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
60971+ created.
60972+
60973+config GRKERNSEC_HARDEN_PTRACE
60974+ bool "Deter ptrace-based process snooping"
60975+ help
60976+ If you say Y here, TTY sniffers and other malicious monitoring
60977+ programs implemented through ptrace will be defeated. If you
60978+ have been using the RBAC system, this option has already been
60979+ enabled for several years for all users, with the ability to make
60980+ fine-grained exceptions.
60981+
60982+ This option only affects the ability of non-root users to ptrace
60983+ processes that are not a descendent of the ptracing process.
60984+ This means that strace ./binary and gdb ./binary will still work,
60985+ but attaching to arbitrary processes will not. If the sysctl
60986+ option is enabled, a sysctl option with name "harden_ptrace" is
60987+ created.
60988+
60989+config GRKERNSEC_TPE
60990+ bool "Trusted Path Execution (TPE)"
60991+ help
60992+ If you say Y here, you will be able to choose a gid to add to the
60993+ supplementary groups of users you want to mark as "untrusted."
60994+ These users will not be able to execute any files that are not in
60995+ root-owned directories writable only by root. If the sysctl option
60996+ is enabled, a sysctl option with name "tpe" is created.
60997+
60998+config GRKERNSEC_TPE_ALL
60999+ bool "Partially restrict all non-root users"
61000+ depends on GRKERNSEC_TPE
61001+ help
61002+ If you say Y here, all non-root users will be covered under
61003+ a weaker TPE restriction. This is separate from, and in addition to,
61004+ the main TPE options that you have selected elsewhere. Thus, if a
61005+ "trusted" GID is chosen, this restriction applies to even that GID.
61006+ Under this restriction, all non-root users will only be allowed to
61007+ execute files in directories they own that are not group or
61008+ world-writable, or in directories owned by root and writable only by
61009+ root. If the sysctl option is enabled, a sysctl option with name
61010+ "tpe_restrict_all" is created.
61011+
61012+config GRKERNSEC_TPE_INVERT
61013+ bool "Invert GID option"
61014+ depends on GRKERNSEC_TPE
61015+ help
61016+ If you say Y here, the group you specify in the TPE configuration will
61017+ decide what group TPE restrictions will be *disabled* for. This
61018+ option is useful if you want TPE restrictions to be applied to most
61019+ users on the system. If the sysctl option is enabled, a sysctl option
61020+ with name "tpe_invert" is created. Unlike other sysctl options, this
61021+ entry will default to on for backward-compatibility.
61022+
61023+config GRKERNSEC_TPE_GID
61024+ int "GID for untrusted users"
61025+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
61026+ default 1005
61027+ help
61028+ Setting this GID determines what group TPE restrictions will be
61029+ *enabled* for. If the sysctl option is enabled, a sysctl option
61030+ with name "tpe_gid" is created.
61031+
61032+config GRKERNSEC_TPE_GID
61033+ int "GID for trusted users"
61034+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
61035+ default 1005
61036+ help
61037+ Setting this GID determines what group TPE restrictions will be
61038+ *disabled* for. If the sysctl option is enabled, a sysctl option
61039+ with name "tpe_gid" is created.
61040+
61041+endmenu
61042+menu "Network Protections"
61043+depends on GRKERNSEC
61044+
61045+config GRKERNSEC_RANDNET
61046+ bool "Larger entropy pools"
61047+ help
61048+ If you say Y here, the entropy pools used for many features of Linux
61049+ and grsecurity will be doubled in size. Since several grsecurity
61050+ features use additional randomness, it is recommended that you say Y
61051+ here. Saying Y here has a similar effect as modifying
61052+ /proc/sys/kernel/random/poolsize.
61053+
61054+config GRKERNSEC_BLACKHOLE
61055+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
61056+ help
61057+ If you say Y here, neither TCP resets nor ICMP
61058+ destination-unreachable packets will be sent in response to packets
61059+ sent to ports for which no associated listening process exists.
61060+ This feature supports both IPV4 and IPV6 and exempts the
61061+ loopback interface from blackholing. Enabling this feature
61062+ makes a host more resilient to DoS attacks and reduces network
61063+ visibility against scanners.
61064+
61065+ The blackhole feature as-implemented is equivalent to the FreeBSD
61066+ blackhole feature, as it prevents RST responses to all packets, not
61067+ just SYNs. Under most application behavior this causes no
61068+ problems, but applications (like haproxy) may not close certain
61069+ connections in a way that cleanly terminates them on the remote
61070+ end, leaving the remote host in LAST_ACK state. Because of this
61071+ side-effect and to prevent intentional LAST_ACK DoSes, this
61072+ feature also adds automatic mitigation against such attacks.
61073+ The mitigation drastically reduces the amount of time a socket
61074+ can spend in LAST_ACK state. If you're using haproxy and not
61075+ all servers it connects to have this option enabled, consider
61076+ disabling this feature on the haproxy host.
61077+
61078+ If the sysctl option is enabled, two sysctl options with names
61079+ "ip_blackhole" and "lastack_retries" will be created.
61080+ While "ip_blackhole" takes the standard zero/non-zero on/off
61081+ toggle, "lastack_retries" uses the same kinds of values as
61082+ "tcp_retries1" and "tcp_retries2". The default value of 4
61083+ prevents a socket from lasting more than 45 seconds in LAST_ACK
61084+ state.
61085+
61086+config GRKERNSEC_SOCKET
61087+ bool "Socket restrictions"
61088+ help
61089+ If you say Y here, you will be able to choose from several options.
61090+ If you assign a GID on your system and add it to the supplementary
61091+ groups of users you want to restrict socket access to, this patch
61092+ will perform up to three things, based on the option(s) you choose.
61093+
61094+config GRKERNSEC_SOCKET_ALL
61095+ bool "Deny any sockets to group"
61096+ depends on GRKERNSEC_SOCKET
61097+ help
61098+ If you say Y here, you will be able to choose a GID of whose users will
61099+ be unable to connect to other hosts from your machine or run server
61100+ applications from your machine. If the sysctl option is enabled, a
61101+ sysctl option with name "socket_all" is created.
61102+
61103+config GRKERNSEC_SOCKET_ALL_GID
61104+ int "GID to deny all sockets for"
61105+ depends on GRKERNSEC_SOCKET_ALL
61106+ default 1004
61107+ help
61108+ Here you can choose the GID to disable socket access for. Remember to
61109+ add the users you want socket access disabled for to the GID
61110+ specified here. If the sysctl option is enabled, a sysctl option
61111+ with name "socket_all_gid" is created.
61112+
61113+config GRKERNSEC_SOCKET_CLIENT
61114+ bool "Deny client sockets to group"
61115+ depends on GRKERNSEC_SOCKET
61116+ help
61117+ If you say Y here, you will be able to choose a GID of whose users will
61118+ be unable to connect to other hosts from your machine, but will be
61119+ able to run servers. If this option is enabled, all users in the group
61120+ you specify will have to use passive mode when initiating ftp transfers
61121+ from the shell on your machine. If the sysctl option is enabled, a
61122+ sysctl option with name "socket_client" is created.
61123+
61124+config GRKERNSEC_SOCKET_CLIENT_GID
61125+ int "GID to deny client sockets for"
61126+ depends on GRKERNSEC_SOCKET_CLIENT
61127+ default 1003
61128+ help
61129+ Here you can choose the GID to disable client socket access for.
61130+ Remember to add the users you want client socket access disabled for to
61131+ the GID specified here. If the sysctl option is enabled, a sysctl
61132+ option with name "socket_client_gid" is created.
61133+
61134+config GRKERNSEC_SOCKET_SERVER
61135+ bool "Deny server sockets to group"
61136+ depends on GRKERNSEC_SOCKET
61137+ help
61138+ If you say Y here, you will be able to choose a GID of whose users will
61139+ be unable to run server applications from your machine. If the sysctl
61140+ option is enabled, a sysctl option with name "socket_server" is created.
61141+
61142+config GRKERNSEC_SOCKET_SERVER_GID
61143+ int "GID to deny server sockets for"
61144+ depends on GRKERNSEC_SOCKET_SERVER
61145+ default 1002
61146+ help
61147+ Here you can choose the GID to disable server socket access for.
61148+ Remember to add the users you want server socket access disabled for to
61149+ the GID specified here. If the sysctl option is enabled, a sysctl
61150+ option with name "socket_server_gid" is created.
61151+
61152+endmenu
61153+menu "Sysctl support"
61154+depends on GRKERNSEC && SYSCTL
61155+
61156+config GRKERNSEC_SYSCTL
61157+ bool "Sysctl support"
61158+ help
61159+ If you say Y here, you will be able to change the options that
61160+ grsecurity runs with at bootup, without having to recompile your
61161+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
61162+ to enable (1) or disable (0) various features. All the sysctl entries
61163+ are mutable until the "grsec_lock" entry is set to a non-zero value.
61164+ All features enabled in the kernel configuration are disabled at boot
61165+ if you do not say Y to the "Turn on features by default" option.
61166+ All options should be set at startup, and the grsec_lock entry should
61167+ be set to a non-zero value after all the options are set.
61168+ *THIS IS EXTREMELY IMPORTANT*
61169+
61170+config GRKERNSEC_SYSCTL_DISTRO
61171+ bool "Extra sysctl support for distro makers (READ HELP)"
61172+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
61173+ help
61174+ If you say Y here, additional sysctl options will be created
61175+ for features that affect processes running as root. Therefore,
61176+ it is critical when using this option that the grsec_lock entry be
61177+ enabled after boot. Only distros with prebuilt kernel packages
61178+ with this option enabled that can ensure grsec_lock is enabled
61179+ after boot should use this option.
61180+ *Failure to set grsec_lock after boot makes all grsec features
61181+ this option covers useless*
61182+
61183+ Currently this option creates the following sysctl entries:
61184+ "Disable Privileged I/O": "disable_priv_io"
61185+
61186+config GRKERNSEC_SYSCTL_ON
61187+ bool "Turn on features by default"
61188+ depends on GRKERNSEC_SYSCTL
61189+ help
61190+ If you say Y here, instead of having all features enabled in the
61191+ kernel configuration disabled at boot time, the features will be
61192+ enabled at boot time. It is recommended you say Y here unless
61193+ there is some reason you would want all sysctl-tunable features to
61194+ be disabled by default. As mentioned elsewhere, it is important
61195+ to enable the grsec_lock entry once you have finished modifying
61196+ the sysctl entries.
61197+
61198+endmenu
61199+menu "Logging Options"
61200+depends on GRKERNSEC
61201+
61202+config GRKERNSEC_FLOODTIME
61203+ int "Seconds in between log messages (minimum)"
61204+ default 10
61205+ help
61206+ This option allows you to enforce the number of seconds between
61207+ grsecurity log messages. The default should be suitable for most
61208+ people, however, if you choose to change it, choose a value small enough
61209+ to allow informative logs to be produced, but large enough to
61210+ prevent flooding.
61211+
61212+config GRKERNSEC_FLOODBURST
61213+ int "Number of messages in a burst (maximum)"
61214+ default 4
61215+ help
61216+ This option allows you to choose the maximum number of messages allowed
61217+ within the flood time interval you chose in a separate option. The
61218+ default should be suitable for most people, however if you find that
61219+ many of your logs are being interpreted as flooding, you may want to
61220+ raise this value.
61221+
61222+endmenu
61223+
61224+endmenu
61225diff -urNp linux-2.6.39.2/grsecurity/Makefile linux-2.6.39.2/grsecurity/Makefile
61226--- linux-2.6.39.2/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
61227+++ linux-2.6.39.2/grsecurity/Makefile 2011-05-24 20:26:54.000000000 -0400
61228@@ -0,0 +1,33 @@
61229+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
61230+# during 2001-2009 it has been completely redesigned by Brad Spengler
61231+# into an RBAC system
61232+#
61233+# All code in this directory and various hooks inserted throughout the kernel
61234+# are copyright Brad Spengler - Open Source Security, Inc., and released
61235+# under the GPL v2 or higher
61236+
61237+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
61238+ grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
61239+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
61240+
61241+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
61242+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
61243+ gracl_learn.o grsec_log.o
61244+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
61245+
61246+ifdef CONFIG_NET
61247+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
61248+endif
61249+
61250+ifndef CONFIG_GRKERNSEC
61251+obj-y += grsec_disabled.o
61252+endif
61253+
61254+ifdef CONFIG_GRKERNSEC_HIDESYM
61255+extra-y := grsec_hidesym.o
61256+$(obj)/grsec_hidesym.o:
61257+ @-chmod -f 500 /boot
61258+ @-chmod -f 500 /lib/modules
61259+ @-chmod -f 700 .
61260+ @echo ' grsec: protected kernel image paths'
61261+endif
61262diff -urNp linux-2.6.39.2/include/acpi/acpi_drivers.h linux-2.6.39.2/include/acpi/acpi_drivers.h
61263--- linux-2.6.39.2/include/acpi/acpi_drivers.h 2011-05-19 00:06:34.000000000 -0400
61264+++ linux-2.6.39.2/include/acpi/acpi_drivers.h 2011-05-22 19:36:32.000000000 -0400
61265@@ -119,8 +119,8 @@ void pci_acpi_crs_quirks(void);
61266 Dock Station
61267 -------------------------------------------------------------------------- */
61268 struct acpi_dock_ops {
61269- acpi_notify_handler handler;
61270- acpi_notify_handler uevent;
61271+ const acpi_notify_handler handler;
61272+ const acpi_notify_handler uevent;
61273 };
61274
61275 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
61276@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
61277 extern int register_dock_notifier(struct notifier_block *nb);
61278 extern void unregister_dock_notifier(struct notifier_block *nb);
61279 extern int register_hotplug_dock_device(acpi_handle handle,
61280- struct acpi_dock_ops *ops,
61281+ const struct acpi_dock_ops *ops,
61282 void *context);
61283 extern void unregister_hotplug_dock_device(acpi_handle handle);
61284 #else
61285@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
61286 {
61287 }
61288 static inline int register_hotplug_dock_device(acpi_handle handle,
61289- struct acpi_dock_ops *ops,
61290+ const struct acpi_dock_ops *ops,
61291 void *context)
61292 {
61293 return -ENODEV;
61294diff -urNp linux-2.6.39.2/include/acpi/processor.h linux-2.6.39.2/include/acpi/processor.h
61295--- linux-2.6.39.2/include/acpi/processor.h 2011-05-19 00:06:34.000000000 -0400
61296+++ linux-2.6.39.2/include/acpi/processor.h 2011-05-22 19:36:32.000000000 -0400
61297@@ -344,7 +344,7 @@ extern struct cpuidle_driver acpi_idle_d
61298
61299 /* in processor_thermal.c */
61300 int acpi_processor_get_limit_info(struct acpi_processor *pr);
61301-extern struct thermal_cooling_device_ops processor_cooling_ops;
61302+extern const struct thermal_cooling_device_ops processor_cooling_ops;
61303 #ifdef CONFIG_CPU_FREQ
61304 void acpi_thermal_cpufreq_init(void);
61305 void acpi_thermal_cpufreq_exit(void);
61306diff -urNp linux-2.6.39.2/include/asm-generic/atomic-long.h linux-2.6.39.2/include/asm-generic/atomic-long.h
61307--- linux-2.6.39.2/include/asm-generic/atomic-long.h 2011-05-19 00:06:34.000000000 -0400
61308+++ linux-2.6.39.2/include/asm-generic/atomic-long.h 2011-05-22 19:36:32.000000000 -0400
61309@@ -22,6 +22,12 @@
61310
61311 typedef atomic64_t atomic_long_t;
61312
61313+#ifdef CONFIG_PAX_REFCOUNT
61314+typedef atomic64_unchecked_t atomic_long_unchecked_t;
61315+#else
61316+typedef atomic64_t atomic_long_unchecked_t;
61317+#endif
61318+
61319 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
61320
61321 static inline long atomic_long_read(atomic_long_t *l)
61322@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
61323 return (long)atomic64_read(v);
61324 }
61325
61326+#ifdef CONFIG_PAX_REFCOUNT
61327+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61328+{
61329+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61330+
61331+ return (long)atomic64_read_unchecked(v);
61332+}
61333+#endif
61334+
61335 static inline void atomic_long_set(atomic_long_t *l, long i)
61336 {
61337 atomic64_t *v = (atomic64_t *)l;
61338@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
61339 atomic64_set(v, i);
61340 }
61341
61342+#ifdef CONFIG_PAX_REFCOUNT
61343+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61344+{
61345+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61346+
61347+ atomic64_set_unchecked(v, i);
61348+}
61349+#endif
61350+
61351 static inline void atomic_long_inc(atomic_long_t *l)
61352 {
61353 atomic64_t *v = (atomic64_t *)l;
61354@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
61355 atomic64_inc(v);
61356 }
61357
61358+#ifdef CONFIG_PAX_REFCOUNT
61359+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61360+{
61361+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61362+
61363+ atomic64_inc_unchecked(v);
61364+}
61365+#endif
61366+
61367 static inline void atomic_long_dec(atomic_long_t *l)
61368 {
61369 atomic64_t *v = (atomic64_t *)l;
61370@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
61371 atomic64_dec(v);
61372 }
61373
61374+#ifdef CONFIG_PAX_REFCOUNT
61375+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61376+{
61377+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61378+
61379+ atomic64_dec_unchecked(v);
61380+}
61381+#endif
61382+
61383 static inline void atomic_long_add(long i, atomic_long_t *l)
61384 {
61385 atomic64_t *v = (atomic64_t *)l;
61386@@ -59,6 +101,15 @@ static inline void atomic_long_add(long
61387 atomic64_add(i, v);
61388 }
61389
61390+#ifdef CONFIG_PAX_REFCOUNT
61391+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61392+{
61393+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61394+
61395+ atomic64_add_unchecked(i, v);
61396+}
61397+#endif
61398+
61399 static inline void atomic_long_sub(long i, atomic_long_t *l)
61400 {
61401 atomic64_t *v = (atomic64_t *)l;
61402@@ -66,6 +117,15 @@ static inline void atomic_long_sub(long
61403 atomic64_sub(i, v);
61404 }
61405
61406+#ifdef CONFIG_PAX_REFCOUNT
61407+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61408+{
61409+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61410+
61411+ atomic64_sub_unchecked(i, v);
61412+}
61413+#endif
61414+
61415 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61416 {
61417 atomic64_t *v = (atomic64_t *)l;
61418@@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur
61419 return (long)atomic64_inc_return(v);
61420 }
61421
61422+#ifdef CONFIG_PAX_REFCOUNT
61423+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61424+{
61425+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61426+
61427+ return (long)atomic64_inc_return_unchecked(v);
61428+}
61429+#endif
61430+
61431 static inline long atomic_long_dec_return(atomic_long_t *l)
61432 {
61433 atomic64_t *v = (atomic64_t *)l;
61434@@ -140,6 +209,12 @@ static inline long atomic_long_add_unles
61435
61436 typedef atomic_t atomic_long_t;
61437
61438+#ifdef CONFIG_PAX_REFCOUNT
61439+typedef atomic_unchecked_t atomic_long_unchecked_t;
61440+#else
61441+typedef atomic_t atomic_long_unchecked_t;
61442+#endif
61443+
61444 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
61445 static inline long atomic_long_read(atomic_long_t *l)
61446 {
61447@@ -148,6 +223,15 @@ static inline long atomic_long_read(atom
61448 return (long)atomic_read(v);
61449 }
61450
61451+#ifdef CONFIG_PAX_REFCOUNT
61452+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61453+{
61454+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61455+
61456+ return (long)atomic_read_unchecked(v);
61457+}
61458+#endif
61459+
61460 static inline void atomic_long_set(atomic_long_t *l, long i)
61461 {
61462 atomic_t *v = (atomic_t *)l;
61463@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi
61464 atomic_set(v, i);
61465 }
61466
61467+#ifdef CONFIG_PAX_REFCOUNT
61468+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61469+{
61470+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61471+
61472+ atomic_set_unchecked(v, i);
61473+}
61474+#endif
61475+
61476 static inline void atomic_long_inc(atomic_long_t *l)
61477 {
61478 atomic_t *v = (atomic_t *)l;
61479@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi
61480 atomic_inc(v);
61481 }
61482
61483+#ifdef CONFIG_PAX_REFCOUNT
61484+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61485+{
61486+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61487+
61488+ atomic_inc_unchecked(v);
61489+}
61490+#endif
61491+
61492 static inline void atomic_long_dec(atomic_long_t *l)
61493 {
61494 atomic_t *v = (atomic_t *)l;
61495@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi
61496 atomic_dec(v);
61497 }
61498
61499+#ifdef CONFIG_PAX_REFCOUNT
61500+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61501+{
61502+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61503+
61504+ atomic_dec_unchecked(v);
61505+}
61506+#endif
61507+
61508 static inline void atomic_long_add(long i, atomic_long_t *l)
61509 {
61510 atomic_t *v = (atomic_t *)l;
61511@@ -176,6 +287,15 @@ static inline void atomic_long_add(long
61512 atomic_add(i, v);
61513 }
61514
61515+#ifdef CONFIG_PAX_REFCOUNT
61516+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61517+{
61518+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61519+
61520+ atomic_add_unchecked(i, v);
61521+}
61522+#endif
61523+
61524 static inline void atomic_long_sub(long i, atomic_long_t *l)
61525 {
61526 atomic_t *v = (atomic_t *)l;
61527@@ -183,6 +303,15 @@ static inline void atomic_long_sub(long
61528 atomic_sub(i, v);
61529 }
61530
61531+#ifdef CONFIG_PAX_REFCOUNT
61532+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61533+{
61534+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61535+
61536+ atomic_sub_unchecked(i, v);
61537+}
61538+#endif
61539+
61540 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61541 {
61542 atomic_t *v = (atomic_t *)l;
61543@@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur
61544 return (long)atomic_inc_return(v);
61545 }
61546
61547+#ifdef CONFIG_PAX_REFCOUNT
61548+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61549+{
61550+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61551+
61552+ return (long)atomic_inc_return_unchecked(v);
61553+}
61554+#endif
61555+
61556 static inline long atomic_long_dec_return(atomic_long_t *l)
61557 {
61558 atomic_t *v = (atomic_t *)l;
61559@@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
61560
61561 #endif /* BITS_PER_LONG == 64 */
61562
61563+#ifdef CONFIG_PAX_REFCOUNT
61564+static inline void pax_refcount_needs_these_functions(void)
61565+{
61566+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
61567+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
61568+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
61569+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
61570+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
61571+ atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
61572+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
61573+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
61574+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
61575+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
61576+ atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
61577+
61578+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
61579+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
61580+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
61581+ atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
61582+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
61583+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
61584+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
61585+}
61586+#else
61587+#define atomic_read_unchecked(v) atomic_read(v)
61588+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
61589+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
61590+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
61591+#define atomic_inc_unchecked(v) atomic_inc(v)
61592+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
61593+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
61594+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
61595+#define atomic_dec_unchecked(v) atomic_dec(v)
61596+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
61597+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
61598+
61599+#define atomic_long_read_unchecked(v) atomic_long_read(v)
61600+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
61601+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
61602+#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
61603+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
61604+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
61605+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
61606+#endif
61607+
61608 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
61609diff -urNp linux-2.6.39.2/include/asm-generic/cache.h linux-2.6.39.2/include/asm-generic/cache.h
61610--- linux-2.6.39.2/include/asm-generic/cache.h 2011-05-19 00:06:34.000000000 -0400
61611+++ linux-2.6.39.2/include/asm-generic/cache.h 2011-05-22 19:36:32.000000000 -0400
61612@@ -6,7 +6,7 @@
61613 * cache lines need to provide their own cache.h.
61614 */
61615
61616-#define L1_CACHE_SHIFT 5
61617-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
61618+#define L1_CACHE_SHIFT 5U
61619+#define L1_CACHE_BYTES (1U << L1_CACHE_SHIFT)
61620
61621 #endif /* __ASM_GENERIC_CACHE_H */
61622diff -urNp linux-2.6.39.2/include/asm-generic/dma-mapping-common.h linux-2.6.39.2/include/asm-generic/dma-mapping-common.h
61623--- linux-2.6.39.2/include/asm-generic/dma-mapping-common.h 2011-05-19 00:06:34.000000000 -0400
61624+++ linux-2.6.39.2/include/asm-generic/dma-mapping-common.h 2011-05-22 19:36:32.000000000 -0400
61625@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
61626 enum dma_data_direction dir,
61627 struct dma_attrs *attrs)
61628 {
61629- struct dma_map_ops *ops = get_dma_ops(dev);
61630+ const struct dma_map_ops *ops = get_dma_ops(dev);
61631 dma_addr_t addr;
61632
61633 kmemcheck_mark_initialized(ptr, size);
61634@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
61635 enum dma_data_direction dir,
61636 struct dma_attrs *attrs)
61637 {
61638- struct dma_map_ops *ops = get_dma_ops(dev);
61639+ const struct dma_map_ops *ops = get_dma_ops(dev);
61640
61641 BUG_ON(!valid_dma_direction(dir));
61642 if (ops->unmap_page)
61643@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
61644 int nents, enum dma_data_direction dir,
61645 struct dma_attrs *attrs)
61646 {
61647- struct dma_map_ops *ops = get_dma_ops(dev);
61648+ const struct dma_map_ops *ops = get_dma_ops(dev);
61649 int i, ents;
61650 struct scatterlist *s;
61651
61652@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
61653 int nents, enum dma_data_direction dir,
61654 struct dma_attrs *attrs)
61655 {
61656- struct dma_map_ops *ops = get_dma_ops(dev);
61657+ const struct dma_map_ops *ops = get_dma_ops(dev);
61658
61659 BUG_ON(!valid_dma_direction(dir));
61660 debug_dma_unmap_sg(dev, sg, nents, dir);
61661@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
61662 size_t offset, size_t size,
61663 enum dma_data_direction dir)
61664 {
61665- struct dma_map_ops *ops = get_dma_ops(dev);
61666+ const struct dma_map_ops *ops = get_dma_ops(dev);
61667 dma_addr_t addr;
61668
61669 kmemcheck_mark_initialized(page_address(page) + offset, size);
61670@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
61671 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
61672 size_t size, enum dma_data_direction dir)
61673 {
61674- struct dma_map_ops *ops = get_dma_ops(dev);
61675+ const struct dma_map_ops *ops = get_dma_ops(dev);
61676
61677 BUG_ON(!valid_dma_direction(dir));
61678 if (ops->unmap_page)
61679@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
61680 size_t size,
61681 enum dma_data_direction dir)
61682 {
61683- struct dma_map_ops *ops = get_dma_ops(dev);
61684+ const struct dma_map_ops *ops = get_dma_ops(dev);
61685
61686 BUG_ON(!valid_dma_direction(dir));
61687 if (ops->sync_single_for_cpu)
61688@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
61689 dma_addr_t addr, size_t size,
61690 enum dma_data_direction dir)
61691 {
61692- struct dma_map_ops *ops = get_dma_ops(dev);
61693+ const struct dma_map_ops *ops = get_dma_ops(dev);
61694
61695 BUG_ON(!valid_dma_direction(dir));
61696 if (ops->sync_single_for_device)
61697@@ -139,7 +139,7 @@ static inline void
61698 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
61699 int nelems, enum dma_data_direction dir)
61700 {
61701- struct dma_map_ops *ops = get_dma_ops(dev);
61702+ const struct dma_map_ops *ops = get_dma_ops(dev);
61703
61704 BUG_ON(!valid_dma_direction(dir));
61705 if (ops->sync_sg_for_cpu)
61706@@ -151,7 +151,7 @@ static inline void
61707 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
61708 int nelems, enum dma_data_direction dir)
61709 {
61710- struct dma_map_ops *ops = get_dma_ops(dev);
61711+ const struct dma_map_ops *ops = get_dma_ops(dev);
61712
61713 BUG_ON(!valid_dma_direction(dir));
61714 if (ops->sync_sg_for_device)
61715diff -urNp linux-2.6.39.2/include/asm-generic/int-l64.h linux-2.6.39.2/include/asm-generic/int-l64.h
61716--- linux-2.6.39.2/include/asm-generic/int-l64.h 2011-05-19 00:06:34.000000000 -0400
61717+++ linux-2.6.39.2/include/asm-generic/int-l64.h 2011-05-22 19:36:32.000000000 -0400
61718@@ -46,6 +46,8 @@ typedef unsigned int u32;
61719 typedef signed long s64;
61720 typedef unsigned long u64;
61721
61722+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
61723+
61724 #define S8_C(x) x
61725 #define U8_C(x) x ## U
61726 #define S16_C(x) x
61727diff -urNp linux-2.6.39.2/include/asm-generic/int-ll64.h linux-2.6.39.2/include/asm-generic/int-ll64.h
61728--- linux-2.6.39.2/include/asm-generic/int-ll64.h 2011-05-19 00:06:34.000000000 -0400
61729+++ linux-2.6.39.2/include/asm-generic/int-ll64.h 2011-05-22 19:36:32.000000000 -0400
61730@@ -51,6 +51,8 @@ typedef unsigned int u32;
61731 typedef signed long long s64;
61732 typedef unsigned long long u64;
61733
61734+typedef unsigned long long intoverflow_t;
61735+
61736 #define S8_C(x) x
61737 #define U8_C(x) x ## U
61738 #define S16_C(x) x
61739diff -urNp linux-2.6.39.2/include/asm-generic/kmap_types.h linux-2.6.39.2/include/asm-generic/kmap_types.h
61740--- linux-2.6.39.2/include/asm-generic/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
61741+++ linux-2.6.39.2/include/asm-generic/kmap_types.h 2011-05-22 19:36:32.000000000 -0400
61742@@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
61743 KMAP_D(17) KM_NMI,
61744 KMAP_D(18) KM_NMI_PTE,
61745 KMAP_D(19) KM_KDB,
61746+KMAP_D(20) KM_CLEARPAGE,
61747 /*
61748 * Remember to update debug_kmap_atomic() when adding new kmap types!
61749 */
61750-KMAP_D(20) KM_TYPE_NR
61751+KMAP_D(21) KM_TYPE_NR
61752 };
61753
61754 #undef KMAP_D
61755diff -urNp linux-2.6.39.2/include/asm-generic/pgtable.h linux-2.6.39.2/include/asm-generic/pgtable.h
61756--- linux-2.6.39.2/include/asm-generic/pgtable.h 2011-05-19 00:06:34.000000000 -0400
61757+++ linux-2.6.39.2/include/asm-generic/pgtable.h 2011-05-22 19:36:32.000000000 -0400
61758@@ -447,6 +447,14 @@ static inline int pmd_write(pmd_t pmd)
61759 #endif /* __HAVE_ARCH_PMD_WRITE */
61760 #endif
61761
61762+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
61763+static inline unsigned long pax_open_kernel(void) { return 0; }
61764+#endif
61765+
61766+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
61767+static inline unsigned long pax_close_kernel(void) { return 0; }
61768+#endif
61769+
61770 #endif /* !__ASSEMBLY__ */
61771
61772 #endif /* _ASM_GENERIC_PGTABLE_H */
61773diff -urNp linux-2.6.39.2/include/asm-generic/pgtable-nopmd.h linux-2.6.39.2/include/asm-generic/pgtable-nopmd.h
61774--- linux-2.6.39.2/include/asm-generic/pgtable-nopmd.h 2011-05-19 00:06:34.000000000 -0400
61775+++ linux-2.6.39.2/include/asm-generic/pgtable-nopmd.h 2011-05-22 19:36:32.000000000 -0400
61776@@ -1,14 +1,19 @@
61777 #ifndef _PGTABLE_NOPMD_H
61778 #define _PGTABLE_NOPMD_H
61779
61780-#ifndef __ASSEMBLY__
61781-
61782 #include <asm-generic/pgtable-nopud.h>
61783
61784-struct mm_struct;
61785-
61786 #define __PAGETABLE_PMD_FOLDED
61787
61788+#define PMD_SHIFT PUD_SHIFT
61789+#define PTRS_PER_PMD 1
61790+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
61791+#define PMD_MASK (~(PMD_SIZE-1))
61792+
61793+#ifndef __ASSEMBLY__
61794+
61795+struct mm_struct;
61796+
61797 /*
61798 * Having the pmd type consist of a pud gets the size right, and allows
61799 * us to conceptually access the pud entry that this pmd is folded into
61800@@ -16,11 +21,6 @@ struct mm_struct;
61801 */
61802 typedef struct { pud_t pud; } pmd_t;
61803
61804-#define PMD_SHIFT PUD_SHIFT
61805-#define PTRS_PER_PMD 1
61806-#define PMD_SIZE (1UL << PMD_SHIFT)
61807-#define PMD_MASK (~(PMD_SIZE-1))
61808-
61809 /*
61810 * The "pud_xxx()" functions here are trivial for a folded two-level
61811 * setup: the pmd is never bad, and a pmd always exists (as it's folded
61812diff -urNp linux-2.6.39.2/include/asm-generic/pgtable-nopud.h linux-2.6.39.2/include/asm-generic/pgtable-nopud.h
61813--- linux-2.6.39.2/include/asm-generic/pgtable-nopud.h 2011-05-19 00:06:34.000000000 -0400
61814+++ linux-2.6.39.2/include/asm-generic/pgtable-nopud.h 2011-05-22 19:36:32.000000000 -0400
61815@@ -1,10 +1,15 @@
61816 #ifndef _PGTABLE_NOPUD_H
61817 #define _PGTABLE_NOPUD_H
61818
61819-#ifndef __ASSEMBLY__
61820-
61821 #define __PAGETABLE_PUD_FOLDED
61822
61823+#define PUD_SHIFT PGDIR_SHIFT
61824+#define PTRS_PER_PUD 1
61825+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
61826+#define PUD_MASK (~(PUD_SIZE-1))
61827+
61828+#ifndef __ASSEMBLY__
61829+
61830 /*
61831 * Having the pud type consist of a pgd gets the size right, and allows
61832 * us to conceptually access the pgd entry that this pud is folded into
61833@@ -12,11 +17,6 @@
61834 */
61835 typedef struct { pgd_t pgd; } pud_t;
61836
61837-#define PUD_SHIFT PGDIR_SHIFT
61838-#define PTRS_PER_PUD 1
61839-#define PUD_SIZE (1UL << PUD_SHIFT)
61840-#define PUD_MASK (~(PUD_SIZE-1))
61841-
61842 /*
61843 * The "pgd_xxx()" functions here are trivial for a folded two-level
61844 * setup: the pud is never bad, and a pud always exists (as it's folded
61845diff -urNp linux-2.6.39.2/include/asm-generic/vmlinux.lds.h linux-2.6.39.2/include/asm-generic/vmlinux.lds.h
61846--- linux-2.6.39.2/include/asm-generic/vmlinux.lds.h 2011-05-19 00:06:34.000000000 -0400
61847+++ linux-2.6.39.2/include/asm-generic/vmlinux.lds.h 2011-05-22 19:36:32.000000000 -0400
61848@@ -213,6 +213,7 @@
61849 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
61850 VMLINUX_SYMBOL(__start_rodata) = .; \
61851 *(.rodata) *(.rodata.*) \
61852+ *(.data..read_only) \
61853 *(__vermagic) /* Kernel version magic */ \
61854 . = ALIGN(8); \
61855 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
61856@@ -707,14 +708,15 @@
61857 * section in the linker script will go there too. @phdr should have
61858 * a leading colon.
61859 *
61860- * Note that this macros defines __per_cpu_load as an absolute symbol.
61861+ * Note that this macros defines per_cpu_load as an absolute symbol.
61862 * If there is no need to put the percpu section at a predetermined
61863 * address, use PERCPU().
61864 */
61865 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
61866- VMLINUX_SYMBOL(__per_cpu_load) = .; \
61867- .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
61868+ per_cpu_load = .; \
61869+ .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
61870 - LOAD_OFFSET) { \
61871+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
61872 VMLINUX_SYMBOL(__per_cpu_start) = .; \
61873 *(.data..percpu..first) \
61874 . = ALIGN(PAGE_SIZE); \
61875@@ -726,7 +728,7 @@
61876 *(.data..percpu..shared_aligned) \
61877 VMLINUX_SYMBOL(__per_cpu_end) = .; \
61878 } phdr \
61879- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
61880+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
61881
61882 /**
61883 * PERCPU - define output section for percpu area, simple version
61884diff -urNp linux-2.6.39.2/include/drm/drmP.h linux-2.6.39.2/include/drm/drmP.h
61885--- linux-2.6.39.2/include/drm/drmP.h 2011-05-19 00:06:34.000000000 -0400
61886+++ linux-2.6.39.2/include/drm/drmP.h 2011-05-22 19:41:42.000000000 -0400
61887@@ -73,6 +73,7 @@
61888 #include <linux/workqueue.h>
61889 #include <linux/poll.h>
61890 #include <asm/pgalloc.h>
61891+#include <asm/local.h>
61892 #include "drm.h"
61893
61894 #include <linux/idr.h>
61895@@ -908,7 +909,7 @@ struct drm_driver {
61896 uint32_t handle);
61897
61898 /* Driver private ops for this object */
61899- struct vm_operations_struct *gem_vm_ops;
61900+ const struct vm_operations_struct *gem_vm_ops;
61901
61902 int major;
61903 int minor;
61904@@ -1023,7 +1024,7 @@ struct drm_device {
61905
61906 /** \name Usage Counters */
61907 /*@{ */
61908- int open_count; /**< Outstanding files open */
61909+ local_t open_count; /**< Outstanding files open */
61910 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
61911 atomic_t vma_count; /**< Outstanding vma areas open */
61912 int buf_use; /**< Buffers in use -- cannot alloc */
61913@@ -1034,7 +1035,7 @@ struct drm_device {
61914 /*@{ */
61915 unsigned long counters;
61916 enum drm_stat_type types[15];
61917- atomic_t counts[15];
61918+ atomic_unchecked_t counts[15];
61919 /*@} */
61920
61921 struct list_head filelist;
61922diff -urNp linux-2.6.39.2/include/linux/a.out.h linux-2.6.39.2/include/linux/a.out.h
61923--- linux-2.6.39.2/include/linux/a.out.h 2011-05-19 00:06:34.000000000 -0400
61924+++ linux-2.6.39.2/include/linux/a.out.h 2011-05-22 19:36:32.000000000 -0400
61925@@ -39,6 +39,14 @@ enum machine_type {
61926 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
61927 };
61928
61929+/* Constants for the N_FLAGS field */
61930+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61931+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
61932+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
61933+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
61934+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61935+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61936+
61937 #if !defined (N_MAGIC)
61938 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
61939 #endif
61940diff -urNp linux-2.6.39.2/include/linux/atmdev.h linux-2.6.39.2/include/linux/atmdev.h
61941--- linux-2.6.39.2/include/linux/atmdev.h 2011-05-19 00:06:34.000000000 -0400
61942+++ linux-2.6.39.2/include/linux/atmdev.h 2011-05-22 19:36:32.000000000 -0400
61943@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
61944 #endif
61945
61946 struct k_atm_aal_stats {
61947-#define __HANDLE_ITEM(i) atomic_t i
61948+#define __HANDLE_ITEM(i) atomic_unchecked_t i
61949 __AAL_STAT_ITEMS
61950 #undef __HANDLE_ITEM
61951 };
61952diff -urNp linux-2.6.39.2/include/linux/binfmts.h linux-2.6.39.2/include/linux/binfmts.h
61953--- linux-2.6.39.2/include/linux/binfmts.h 2011-05-19 00:06:34.000000000 -0400
61954+++ linux-2.6.39.2/include/linux/binfmts.h 2011-05-22 19:36:32.000000000 -0400
61955@@ -92,6 +92,7 @@ struct linux_binfmt {
61956 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
61957 int (*load_shlib)(struct file *);
61958 int (*core_dump)(struct coredump_params *cprm);
61959+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
61960 unsigned long min_coredump; /* minimal dump size */
61961 };
61962
61963diff -urNp linux-2.6.39.2/include/linux/blkdev.h linux-2.6.39.2/include/linux/blkdev.h
61964--- linux-2.6.39.2/include/linux/blkdev.h 2011-06-03 00:04:14.000000000 -0400
61965+++ linux-2.6.39.2/include/linux/blkdev.h 2011-06-03 00:32:08.000000000 -0400
61966@@ -1292,22 +1292,22 @@ queue_max_integrity_segments(struct requ
61967 #endif /* CONFIG_BLK_DEV_INTEGRITY */
61968
61969 struct block_device_operations {
61970- int (*open) (struct block_device *, fmode_t);
61971- int (*release) (struct gendisk *, fmode_t);
61972- int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61973- int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61974- int (*direct_access) (struct block_device *, sector_t,
61975+ int (* const open) (struct block_device *, fmode_t);
61976+ int (* const release) (struct gendisk *, fmode_t);
61977+ int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61978+ int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61979+ int (* const direct_access) (struct block_device *, sector_t,
61980 void **, unsigned long *);
61981- unsigned int (*check_events) (struct gendisk *disk,
61982+ unsigned int (* const check_events) (struct gendisk *disk,
61983 unsigned int clearing);
61984 /* ->media_changed() is DEPRECATED, use ->check_events() instead */
61985- int (*media_changed) (struct gendisk *);
61986- void (*unlock_native_capacity) (struct gendisk *);
61987- int (*revalidate_disk) (struct gendisk *);
61988- int (*getgeo)(struct block_device *, struct hd_geometry *);
61989+ int (* const media_changed) (struct gendisk *);
61990+ void (* const unlock_native_capacity) (struct gendisk *);
61991+ int (* const revalidate_disk) (struct gendisk *);
61992+ int (* const getgeo)(struct block_device *, struct hd_geometry *);
61993 /* this callback is with swap_lock and sometimes page table lock held */
61994- void (*swap_slot_free_notify) (struct block_device *, unsigned long);
61995- struct module *owner;
61996+ void (* const swap_slot_free_notify) (struct block_device *, unsigned long);
61997+ struct module * const owner;
61998 };
61999
62000 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
62001diff -urNp linux-2.6.39.2/include/linux/blktrace_api.h linux-2.6.39.2/include/linux/blktrace_api.h
62002--- linux-2.6.39.2/include/linux/blktrace_api.h 2011-05-19 00:06:34.000000000 -0400
62003+++ linux-2.6.39.2/include/linux/blktrace_api.h 2011-05-22 19:36:32.000000000 -0400
62004@@ -161,7 +161,7 @@ struct blk_trace {
62005 struct dentry *dir;
62006 struct dentry *dropped_file;
62007 struct dentry *msg_file;
62008- atomic_t dropped;
62009+ atomic_unchecked_t dropped;
62010 };
62011
62012 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
62013diff -urNp linux-2.6.39.2/include/linux/byteorder/little_endian.h linux-2.6.39.2/include/linux/byteorder/little_endian.h
62014--- linux-2.6.39.2/include/linux/byteorder/little_endian.h 2011-05-19 00:06:34.000000000 -0400
62015+++ linux-2.6.39.2/include/linux/byteorder/little_endian.h 2011-05-22 19:36:32.000000000 -0400
62016@@ -42,51 +42,51 @@
62017
62018 static inline __le64 __cpu_to_le64p(const __u64 *p)
62019 {
62020- return (__force __le64)*p;
62021+ return (__force const __le64)*p;
62022 }
62023 static inline __u64 __le64_to_cpup(const __le64 *p)
62024 {
62025- return (__force __u64)*p;
62026+ return (__force const __u64)*p;
62027 }
62028 static inline __le32 __cpu_to_le32p(const __u32 *p)
62029 {
62030- return (__force __le32)*p;
62031+ return (__force const __le32)*p;
62032 }
62033 static inline __u32 __le32_to_cpup(const __le32 *p)
62034 {
62035- return (__force __u32)*p;
62036+ return (__force const __u32)*p;
62037 }
62038 static inline __le16 __cpu_to_le16p(const __u16 *p)
62039 {
62040- return (__force __le16)*p;
62041+ return (__force const __le16)*p;
62042 }
62043 static inline __u16 __le16_to_cpup(const __le16 *p)
62044 {
62045- return (__force __u16)*p;
62046+ return (__force const __u16)*p;
62047 }
62048 static inline __be64 __cpu_to_be64p(const __u64 *p)
62049 {
62050- return (__force __be64)__swab64p(p);
62051+ return (__force const __be64)__swab64p(p);
62052 }
62053 static inline __u64 __be64_to_cpup(const __be64 *p)
62054 {
62055- return __swab64p((__u64 *)p);
62056+ return __swab64p((const __u64 *)p);
62057 }
62058 static inline __be32 __cpu_to_be32p(const __u32 *p)
62059 {
62060- return (__force __be32)__swab32p(p);
62061+ return (__force const __be32)__swab32p(p);
62062 }
62063 static inline __u32 __be32_to_cpup(const __be32 *p)
62064 {
62065- return __swab32p((__u32 *)p);
62066+ return __swab32p((const __u32 *)p);
62067 }
62068 static inline __be16 __cpu_to_be16p(const __u16 *p)
62069 {
62070- return (__force __be16)__swab16p(p);
62071+ return (__force const __be16)__swab16p(p);
62072 }
62073 static inline __u16 __be16_to_cpup(const __be16 *p)
62074 {
62075- return __swab16p((__u16 *)p);
62076+ return __swab16p((const __u16 *)p);
62077 }
62078 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
62079 #define __le64_to_cpus(x) do { (void)(x); } while (0)
62080diff -urNp linux-2.6.39.2/include/linux/cache.h linux-2.6.39.2/include/linux/cache.h
62081--- linux-2.6.39.2/include/linux/cache.h 2011-05-19 00:06:34.000000000 -0400
62082+++ linux-2.6.39.2/include/linux/cache.h 2011-05-22 19:36:32.000000000 -0400
62083@@ -16,6 +16,10 @@
62084 #define __read_mostly
62085 #endif
62086
62087+#ifndef __read_only
62088+#define __read_only __read_mostly
62089+#endif
62090+
62091 #ifndef ____cacheline_aligned
62092 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
62093 #endif
62094diff -urNp linux-2.6.39.2/include/linux/capability.h linux-2.6.39.2/include/linux/capability.h
62095--- linux-2.6.39.2/include/linux/capability.h 2011-05-19 00:06:34.000000000 -0400
62096+++ linux-2.6.39.2/include/linux/capability.h 2011-05-22 21:02:47.000000000 -0400
62097@@ -547,6 +547,9 @@ extern bool capable(int cap);
62098 extern bool ns_capable(struct user_namespace *ns, int cap);
62099 extern bool task_ns_capable(struct task_struct *t, int cap);
62100 extern bool nsown_capable(int cap);
62101+extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
62102+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
62103+extern bool capable_nolog(int cap);
62104
62105 /* audit system wants to get cap info from files as well */
62106 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
62107diff -urNp linux-2.6.39.2/include/linux/compiler-gcc4.h linux-2.6.39.2/include/linux/compiler-gcc4.h
62108--- linux-2.6.39.2/include/linux/compiler-gcc4.h 2011-05-19 00:06:34.000000000 -0400
62109+++ linux-2.6.39.2/include/linux/compiler-gcc4.h 2011-05-22 19:36:32.000000000 -0400
62110@@ -46,6 +46,11 @@
62111 #define __noclone __attribute__((__noclone__))
62112
62113 #endif
62114+
62115+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
62116+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
62117+#define __bos0(ptr) __bos((ptr), 0)
62118+#define __bos1(ptr) __bos((ptr), 1)
62119 #endif
62120
62121 #if __GNUC_MINOR__ > 0
62122diff -urNp linux-2.6.39.2/include/linux/compiler.h linux-2.6.39.2/include/linux/compiler.h
62123--- linux-2.6.39.2/include/linux/compiler.h 2011-05-19 00:06:34.000000000 -0400
62124+++ linux-2.6.39.2/include/linux/compiler.h 2011-05-22 19:36:32.000000000 -0400
62125@@ -273,6 +273,22 @@ void ftrace_likely_update(struct ftrace_
62126 #define __cold
62127 #endif
62128
62129+#ifndef __alloc_size
62130+#define __alloc_size
62131+#endif
62132+
62133+#ifndef __bos
62134+#define __bos
62135+#endif
62136+
62137+#ifndef __bos0
62138+#define __bos0
62139+#endif
62140+
62141+#ifndef __bos1
62142+#define __bos1
62143+#endif
62144+
62145 /* Simple shorthand for a section definition */
62146 #ifndef __section
62147 # define __section(S) __attribute__ ((__section__(#S)))
62148@@ -306,6 +322,7 @@ void ftrace_likely_update(struct ftrace_
62149 * use is to mediate communication between process-level code and irq/NMI
62150 * handlers, all running on the same CPU.
62151 */
62152-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
62153+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
62154+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
62155
62156 #endif /* __LINUX_COMPILER_H */
62157diff -urNp linux-2.6.39.2/include/linux/concap.h linux-2.6.39.2/include/linux/concap.h
62158--- linux-2.6.39.2/include/linux/concap.h 2011-05-19 00:06:34.000000000 -0400
62159+++ linux-2.6.39.2/include/linux/concap.h 2011-05-22 19:36:32.000000000 -0400
62160@@ -30,7 +30,7 @@ struct concap_device_ops;
62161 struct concap_proto{
62162 struct net_device *net_dev; /* net device using our service */
62163 struct concap_device_ops *dops; /* callbacks provided by device */
62164- struct concap_proto_ops *pops; /* callbacks provided by us */
62165+ const struct concap_proto_ops *pops; /* callbacks provided by us */
62166 spinlock_t lock;
62167 int flags;
62168 void *proto_data; /* protocol specific private data, to
62169diff -urNp linux-2.6.39.2/include/linux/configfs.h linux-2.6.39.2/include/linux/configfs.h
62170--- linux-2.6.39.2/include/linux/configfs.h 2011-05-19 00:06:34.000000000 -0400
62171+++ linux-2.6.39.2/include/linux/configfs.h 2011-05-22 19:36:32.000000000 -0400
62172@@ -82,7 +82,7 @@ extern void config_item_put(struct confi
62173 struct config_item_type {
62174 struct module *ct_owner;
62175 struct configfs_item_operations *ct_item_ops;
62176- struct configfs_group_operations *ct_group_ops;
62177+ const struct configfs_group_operations *ct_group_ops;
62178 struct configfs_attribute **ct_attrs;
62179 };
62180
62181diff -urNp linux-2.6.39.2/include/linux/cpuset.h linux-2.6.39.2/include/linux/cpuset.h
62182--- linux-2.6.39.2/include/linux/cpuset.h 2011-05-19 00:06:34.000000000 -0400
62183+++ linux-2.6.39.2/include/linux/cpuset.h 2011-05-22 19:36:32.000000000 -0400
62184@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
62185 * nodemask.
62186 */
62187 smp_mb();
62188- --ACCESS_ONCE(current->mems_allowed_change_disable);
62189+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
62190 }
62191
62192 static inline void set_mems_allowed(nodemask_t nodemask)
62193diff -urNp linux-2.6.39.2/include/linux/dca.h linux-2.6.39.2/include/linux/dca.h
62194--- linux-2.6.39.2/include/linux/dca.h 2011-05-19 00:06:34.000000000 -0400
62195+++ linux-2.6.39.2/include/linux/dca.h 2011-05-22 19:36:32.000000000 -0400
62196@@ -34,7 +34,7 @@ void dca_unregister_notify(struct notifi
62197
62198 struct dca_provider {
62199 struct list_head node;
62200- struct dca_ops *ops;
62201+ const struct dca_ops *ops;
62202 struct device *cd;
62203 int id;
62204 };
62205@@ -53,7 +53,7 @@ struct dca_ops {
62206 int (*dev_managed) (struct dca_provider *, struct device *);
62207 };
62208
62209-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size);
62210+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size);
62211 void free_dca_provider(struct dca_provider *dca);
62212 int register_dca_provider(struct dca_provider *dca, struct device *dev);
62213 void unregister_dca_provider(struct dca_provider *dca, struct device *dev);
62214diff -urNp linux-2.6.39.2/include/linux/decompress/mm.h linux-2.6.39.2/include/linux/decompress/mm.h
62215--- linux-2.6.39.2/include/linux/decompress/mm.h 2011-05-19 00:06:34.000000000 -0400
62216+++ linux-2.6.39.2/include/linux/decompress/mm.h 2011-05-22 19:36:33.000000000 -0400
62217@@ -77,7 +77,7 @@ static void free(void *where)
62218 * warnings when not needed (indeed large_malloc / large_free are not
62219 * needed by inflate */
62220
62221-#define malloc(a) kmalloc(a, GFP_KERNEL)
62222+#define malloc(a) kmalloc((a), GFP_KERNEL)
62223 #define free(a) kfree(a)
62224
62225 #define large_malloc(a) vmalloc(a)
62226diff -urNp linux-2.6.39.2/include/linux/dma-mapping.h linux-2.6.39.2/include/linux/dma-mapping.h
62227--- linux-2.6.39.2/include/linux/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
62228+++ linux-2.6.39.2/include/linux/dma-mapping.h 2011-05-22 19:36:33.000000000 -0400
62229@@ -16,40 +16,40 @@ enum dma_data_direction {
62230 };
62231
62232 struct dma_map_ops {
62233- void* (*alloc_coherent)(struct device *dev, size_t size,
62234+ void* (* const alloc_coherent)(struct device *dev, size_t size,
62235 dma_addr_t *dma_handle, gfp_t gfp);
62236- void (*free_coherent)(struct device *dev, size_t size,
62237+ void (* const free_coherent)(struct device *dev, size_t size,
62238 void *vaddr, dma_addr_t dma_handle);
62239- dma_addr_t (*map_page)(struct device *dev, struct page *page,
62240+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
62241 unsigned long offset, size_t size,
62242 enum dma_data_direction dir,
62243 struct dma_attrs *attrs);
62244- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
62245+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
62246 size_t size, enum dma_data_direction dir,
62247 struct dma_attrs *attrs);
62248- int (*map_sg)(struct device *dev, struct scatterlist *sg,
62249+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
62250 int nents, enum dma_data_direction dir,
62251 struct dma_attrs *attrs);
62252- void (*unmap_sg)(struct device *dev,
62253+ void (* const unmap_sg)(struct device *dev,
62254 struct scatterlist *sg, int nents,
62255 enum dma_data_direction dir,
62256 struct dma_attrs *attrs);
62257- void (*sync_single_for_cpu)(struct device *dev,
62258+ void (* const sync_single_for_cpu)(struct device *dev,
62259 dma_addr_t dma_handle, size_t size,
62260 enum dma_data_direction dir);
62261- void (*sync_single_for_device)(struct device *dev,
62262+ void (* const sync_single_for_device)(struct device *dev,
62263 dma_addr_t dma_handle, size_t size,
62264 enum dma_data_direction dir);
62265- void (*sync_sg_for_cpu)(struct device *dev,
62266+ void (* const sync_sg_for_cpu)(struct device *dev,
62267 struct scatterlist *sg, int nents,
62268 enum dma_data_direction dir);
62269- void (*sync_sg_for_device)(struct device *dev,
62270+ void (* const sync_sg_for_device)(struct device *dev,
62271 struct scatterlist *sg, int nents,
62272 enum dma_data_direction dir);
62273- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
62274- int (*dma_supported)(struct device *dev, u64 mask);
62275- int (*set_dma_mask)(struct device *dev, u64 mask);
62276- int is_phys;
62277+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
62278+ int (* const dma_supported)(struct device *dev, u64 mask);
62279+ int (* set_dma_mask)(struct device *dev, u64 mask);
62280+ const int is_phys;
62281 };
62282
62283 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
62284diff -urNp linux-2.6.39.2/include/linux/elf.h linux-2.6.39.2/include/linux/elf.h
62285--- linux-2.6.39.2/include/linux/elf.h 2011-05-19 00:06:34.000000000 -0400
62286+++ linux-2.6.39.2/include/linux/elf.h 2011-05-22 19:36:33.000000000 -0400
62287@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
62288 #define PT_GNU_EH_FRAME 0x6474e550
62289
62290 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
62291+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
62292+
62293+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
62294+
62295+/* Constants for the e_flags field */
62296+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
62297+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
62298+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
62299+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
62300+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
62301+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
62302
62303 /*
62304 * Extended Numbering
62305@@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
62306 #define DT_DEBUG 21
62307 #define DT_TEXTREL 22
62308 #define DT_JMPREL 23
62309+#define DT_FLAGS 30
62310+ #define DF_TEXTREL 0x00000004
62311 #define DT_ENCODING 32
62312 #define OLD_DT_LOOS 0x60000000
62313 #define DT_LOOS 0x6000000d
62314@@ -252,6 +265,19 @@ typedef struct elf64_hdr {
62315 #define PF_W 0x2
62316 #define PF_X 0x1
62317
62318+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
62319+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
62320+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
62321+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
62322+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
62323+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
62324+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
62325+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
62326+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
62327+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
62328+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
62329+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
62330+
62331 typedef struct elf32_phdr{
62332 Elf32_Word p_type;
62333 Elf32_Off p_offset;
62334@@ -344,6 +370,8 @@ typedef struct elf64_shdr {
62335 #define EI_OSABI 7
62336 #define EI_PAD 8
62337
62338+#define EI_PAX 14
62339+
62340 #define ELFMAG0 0x7f /* EI_MAG */
62341 #define ELFMAG1 'E'
62342 #define ELFMAG2 'L'
62343@@ -421,6 +449,7 @@ extern Elf32_Dyn _DYNAMIC [];
62344 #define elf_note elf32_note
62345 #define elf_addr_t Elf32_Off
62346 #define Elf_Half Elf32_Half
62347+#define elf_dyn Elf32_Dyn
62348
62349 #else
62350
62351@@ -431,6 +460,7 @@ extern Elf64_Dyn _DYNAMIC [];
62352 #define elf_note elf64_note
62353 #define elf_addr_t Elf64_Off
62354 #define Elf_Half Elf64_Half
62355+#define elf_dyn Elf64_Dyn
62356
62357 #endif
62358
62359diff -urNp linux-2.6.39.2/include/linux/enclosure.h linux-2.6.39.2/include/linux/enclosure.h
62360--- linux-2.6.39.2/include/linux/enclosure.h 2011-05-19 00:06:34.000000000 -0400
62361+++ linux-2.6.39.2/include/linux/enclosure.h 2011-05-22 19:36:33.000000000 -0400
62362@@ -98,7 +98,7 @@ struct enclosure_device {
62363 void *scratch;
62364 struct list_head node;
62365 struct device edev;
62366- struct enclosure_component_callbacks *cb;
62367+ const struct enclosure_component_callbacks *cb;
62368 int components;
62369 struct enclosure_component component[0];
62370 };
62371diff -urNp linux-2.6.39.2/include/linux/fscache-cache.h linux-2.6.39.2/include/linux/fscache-cache.h
62372--- linux-2.6.39.2/include/linux/fscache-cache.h 2011-05-19 00:06:34.000000000 -0400
62373+++ linux-2.6.39.2/include/linux/fscache-cache.h 2011-05-22 19:36:33.000000000 -0400
62374@@ -113,7 +113,7 @@ struct fscache_operation {
62375 #endif
62376 };
62377
62378-extern atomic_t fscache_op_debug_id;
62379+extern atomic_unchecked_t fscache_op_debug_id;
62380 extern void fscache_op_work_func(struct work_struct *work);
62381
62382 extern void fscache_enqueue_operation(struct fscache_operation *);
62383@@ -133,7 +133,7 @@ static inline void fscache_operation_ini
62384 {
62385 INIT_WORK(&op->work, fscache_op_work_func);
62386 atomic_set(&op->usage, 1);
62387- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
62388+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
62389 op->processor = processor;
62390 op->release = release;
62391 INIT_LIST_HEAD(&op->pend_link);
62392diff -urNp linux-2.6.39.2/include/linux/fs.h linux-2.6.39.2/include/linux/fs.h
62393--- linux-2.6.39.2/include/linux/fs.h 2011-05-19 00:06:34.000000000 -0400
62394+++ linux-2.6.39.2/include/linux/fs.h 2011-05-22 19:41:42.000000000 -0400
62395@@ -108,6 +108,11 @@ struct inodes_stat_t {
62396 /* File was opened by fanotify and shouldn't generate fanotify events */
62397 #define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
62398
62399+/* Hack for grsec so as not to require read permission simply to execute
62400+ * a binary
62401+ */
62402+#define FMODE_GREXEC ((__force fmode_t)0x2000000)
62403+
62404 /*
62405 * The below are the various read and write types that we support. Some of
62406 * them include behavioral modifiers that send information down to the
62407@@ -575,41 +580,41 @@ typedef int (*read_actor_t)(read_descrip
62408 unsigned long, unsigned long);
62409
62410 struct address_space_operations {
62411- int (*writepage)(struct page *page, struct writeback_control *wbc);
62412- int (*readpage)(struct file *, struct page *);
62413+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
62414+ int (* const readpage)(struct file *, struct page *);
62415
62416 /* Write back some dirty pages from this mapping. */
62417- int (*writepages)(struct address_space *, struct writeback_control *);
62418+ int (* const writepages)(struct address_space *, struct writeback_control *);
62419
62420 /* Set a page dirty. Return true if this dirtied it */
62421- int (*set_page_dirty)(struct page *page);
62422+ int (* const set_page_dirty)(struct page *page);
62423
62424- int (*readpages)(struct file *filp, struct address_space *mapping,
62425+ int (* const readpages)(struct file *filp, struct address_space *mapping,
62426 struct list_head *pages, unsigned nr_pages);
62427
62428- int (*write_begin)(struct file *, struct address_space *mapping,
62429+ int (* const write_begin)(struct file *, struct address_space *mapping,
62430 loff_t pos, unsigned len, unsigned flags,
62431 struct page **pagep, void **fsdata);
62432- int (*write_end)(struct file *, struct address_space *mapping,
62433+ int (* const write_end)(struct file *, struct address_space *mapping,
62434 loff_t pos, unsigned len, unsigned copied,
62435 struct page *page, void *fsdata);
62436
62437 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
62438- sector_t (*bmap)(struct address_space *, sector_t);
62439- void (*invalidatepage) (struct page *, unsigned long);
62440- int (*releasepage) (struct page *, gfp_t);
62441- void (*freepage)(struct page *);
62442- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
62443+ sector_t (* const bmap)(struct address_space *, sector_t);
62444+ void (* const invalidatepage) (struct page *, unsigned long);
62445+ int (* const releasepage) (struct page *, gfp_t);
62446+ void (* const freepage)(struct page *);
62447+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
62448 loff_t offset, unsigned long nr_segs);
62449- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
62450+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
62451 void **, unsigned long *);
62452 /* migrate the contents of a page to the specified target */
62453- int (*migratepage) (struct address_space *,
62454+ int (* const migratepage) (struct address_space *,
62455 struct page *, struct page *);
62456- int (*launder_page) (struct page *);
62457- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
62458+ int (* const launder_page) (struct page *);
62459+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
62460 unsigned long);
62461- int (*error_remove_page)(struct address_space *, struct page *);
62462+ int (* const error_remove_page)(struct address_space *, struct page *);
62463 };
62464
62465 extern const struct address_space_operations empty_aops;
62466@@ -1060,17 +1065,17 @@ static inline int file_check_writeable(s
62467 typedef struct files_struct *fl_owner_t;
62468
62469 struct file_lock_operations {
62470- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
62471- void (*fl_release_private)(struct file_lock *);
62472+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
62473+ void (* const fl_release_private)(struct file_lock *);
62474 };
62475
62476 struct lock_manager_operations {
62477- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
62478- void (*fl_notify)(struct file_lock *); /* unblock callback */
62479- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
62480- void (*fl_release_private)(struct file_lock *);
62481- void (*fl_break)(struct file_lock *);
62482- int (*fl_change)(struct file_lock **, int);
62483+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
62484+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
62485+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
62486+ void (* const fl_release_private)(struct file_lock *);
62487+ void (* const fl_break)(struct file_lock *);
62488+ int (* const fl_change)(struct file_lock **, int);
62489 };
62490
62491 struct lock_manager {
62492@@ -1611,31 +1616,31 @@ extern ssize_t vfs_writev(struct file *,
62493 unsigned long, loff_t *);
62494
62495 struct super_operations {
62496- struct inode *(*alloc_inode)(struct super_block *sb);
62497- void (*destroy_inode)(struct inode *);
62498+ struct inode *(* const alloc_inode)(struct super_block *sb);
62499+ void (* const destroy_inode)(struct inode *);
62500
62501- void (*dirty_inode) (struct inode *);
62502- int (*write_inode) (struct inode *, struct writeback_control *wbc);
62503- int (*drop_inode) (struct inode *);
62504- void (*evict_inode) (struct inode *);
62505- void (*put_super) (struct super_block *);
62506- void (*write_super) (struct super_block *);
62507- int (*sync_fs)(struct super_block *sb, int wait);
62508- int (*freeze_fs) (struct super_block *);
62509- int (*unfreeze_fs) (struct super_block *);
62510- int (*statfs) (struct dentry *, struct kstatfs *);
62511- int (*remount_fs) (struct super_block *, int *, char *);
62512- void (*umount_begin) (struct super_block *);
62513-
62514- int (*show_options)(struct seq_file *, struct vfsmount *);
62515- int (*show_devname)(struct seq_file *, struct vfsmount *);
62516- int (*show_path)(struct seq_file *, struct vfsmount *);
62517- int (*show_stats)(struct seq_file *, struct vfsmount *);
62518+ void (* const dirty_inode) (struct inode *);
62519+ int (* const write_inode) (struct inode *, struct writeback_control *wbc);
62520+ int (* const drop_inode) (struct inode *);
62521+ void (* const evict_inode) (struct inode *);
62522+ void (* const put_super) (struct super_block *);
62523+ void (* const write_super) (struct super_block *);
62524+ int (* const sync_fs)(struct super_block *sb, int wait);
62525+ int (* const freeze_fs) (struct super_block *);
62526+ int (* const unfreeze_fs) (struct super_block *);
62527+ int (* const statfs) (struct dentry *, struct kstatfs *);
62528+ int (* const remount_fs) (struct super_block *, int *, char *);
62529+ void (* const umount_begin) (struct super_block *);
62530+
62531+ int (* const show_options)(struct seq_file *, struct vfsmount *);
62532+ int (* const show_devname)(struct seq_file *, struct vfsmount *);
62533+ int (* const show_path)(struct seq_file *, struct vfsmount *);
62534+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
62535 #ifdef CONFIG_QUOTA
62536- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
62537- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62538+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
62539+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62540 #endif
62541- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62542+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62543 };
62544
62545 /*
62546diff -urNp linux-2.6.39.2/include/linux/fs_struct.h linux-2.6.39.2/include/linux/fs_struct.h
62547--- linux-2.6.39.2/include/linux/fs_struct.h 2011-05-19 00:06:34.000000000 -0400
62548+++ linux-2.6.39.2/include/linux/fs_struct.h 2011-05-22 19:36:33.000000000 -0400
62549@@ -6,7 +6,7 @@
62550 #include <linux/seqlock.h>
62551
62552 struct fs_struct {
62553- int users;
62554+ atomic_t users;
62555 spinlock_t lock;
62556 seqcount_t seq;
62557 int umask;
62558diff -urNp linux-2.6.39.2/include/linux/ftrace_event.h linux-2.6.39.2/include/linux/ftrace_event.h
62559--- linux-2.6.39.2/include/linux/ftrace_event.h 2011-05-19 00:06:34.000000000 -0400
62560+++ linux-2.6.39.2/include/linux/ftrace_event.h 2011-05-22 19:36:33.000000000 -0400
62561@@ -235,7 +235,7 @@ extern int trace_define_field(struct ftr
62562 extern int trace_add_event_call(struct ftrace_event_call *call);
62563 extern void trace_remove_event_call(struct ftrace_event_call *call);
62564
62565-#define is_signed_type(type) (((type)(-1)) < 0)
62566+#define is_signed_type(type) (((type)(-1)) < (type)1)
62567
62568 int trace_set_clr_event(const char *system, const char *event, int set);
62569
62570diff -urNp linux-2.6.39.2/include/linux/ftrace.h linux-2.6.39.2/include/linux/ftrace.h
62571--- linux-2.6.39.2/include/linux/ftrace.h 2011-05-19 00:06:34.000000000 -0400
62572+++ linux-2.6.39.2/include/linux/ftrace.h 2011-05-22 19:36:33.000000000 -0400
62573@@ -140,7 +140,7 @@ extern void
62574 unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
62575 void *data);
62576 extern void
62577-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops);
62578+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops);
62579 extern void unregister_ftrace_function_probe_all(char *glob);
62580
62581 extern int ftrace_text_reserved(void *start, void *end);
62582diff -urNp linux-2.6.39.2/include/linux/genhd.h linux-2.6.39.2/include/linux/genhd.h
62583--- linux-2.6.39.2/include/linux/genhd.h 2011-06-03 00:04:14.000000000 -0400
62584+++ linux-2.6.39.2/include/linux/genhd.h 2011-06-03 00:32:08.000000000 -0400
62585@@ -184,7 +184,7 @@ struct gendisk {
62586 struct kobject *slave_dir;
62587
62588 struct timer_rand_state *random;
62589- atomic_t sync_io; /* RAID */
62590+ atomic_unchecked_t sync_io; /* RAID */
62591 struct disk_events *ev;
62592 #ifdef CONFIG_BLK_DEV_INTEGRITY
62593 struct blk_integrity *integrity;
62594diff -urNp linux-2.6.39.2/include/linux/gracl.h linux-2.6.39.2/include/linux/gracl.h
62595--- linux-2.6.39.2/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
62596+++ linux-2.6.39.2/include/linux/gracl.h 2011-05-22 19:41:42.000000000 -0400
62597@@ -0,0 +1,317 @@
62598+#ifndef GR_ACL_H
62599+#define GR_ACL_H
62600+
62601+#include <linux/grdefs.h>
62602+#include <linux/resource.h>
62603+#include <linux/capability.h>
62604+#include <linux/dcache.h>
62605+#include <asm/resource.h>
62606+
62607+/* Major status information */
62608+
62609+#define GR_VERSION "grsecurity 2.2.2"
62610+#define GRSECURITY_VERSION 0x2202
62611+
62612+enum {
62613+ GR_SHUTDOWN = 0,
62614+ GR_ENABLE = 1,
62615+ GR_SPROLE = 2,
62616+ GR_RELOAD = 3,
62617+ GR_SEGVMOD = 4,
62618+ GR_STATUS = 5,
62619+ GR_UNSPROLE = 6,
62620+ GR_PASSSET = 7,
62621+ GR_SPROLEPAM = 8,
62622+};
62623+
62624+/* Password setup definitions
62625+ * kernel/grhash.c */
62626+enum {
62627+ GR_PW_LEN = 128,
62628+ GR_SALT_LEN = 16,
62629+ GR_SHA_LEN = 32,
62630+};
62631+
62632+enum {
62633+ GR_SPROLE_LEN = 64,
62634+};
62635+
62636+enum {
62637+ GR_NO_GLOB = 0,
62638+ GR_REG_GLOB,
62639+ GR_CREATE_GLOB
62640+};
62641+
62642+#define GR_NLIMITS 32
62643+
62644+/* Begin Data Structures */
62645+
62646+struct sprole_pw {
62647+ unsigned char *rolename;
62648+ unsigned char salt[GR_SALT_LEN];
62649+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
62650+};
62651+
62652+struct name_entry {
62653+ __u32 key;
62654+ ino_t inode;
62655+ dev_t device;
62656+ char *name;
62657+ __u16 len;
62658+ __u8 deleted;
62659+ struct name_entry *prev;
62660+ struct name_entry *next;
62661+};
62662+
62663+struct inodev_entry {
62664+ struct name_entry *nentry;
62665+ struct inodev_entry *prev;
62666+ struct inodev_entry *next;
62667+};
62668+
62669+struct acl_role_db {
62670+ struct acl_role_label **r_hash;
62671+ __u32 r_size;
62672+};
62673+
62674+struct inodev_db {
62675+ struct inodev_entry **i_hash;
62676+ __u32 i_size;
62677+};
62678+
62679+struct name_db {
62680+ struct name_entry **n_hash;
62681+ __u32 n_size;
62682+};
62683+
62684+struct crash_uid {
62685+ uid_t uid;
62686+ unsigned long expires;
62687+};
62688+
62689+struct gr_hash_struct {
62690+ void **table;
62691+ void **nametable;
62692+ void *first;
62693+ __u32 table_size;
62694+ __u32 used_size;
62695+ int type;
62696+};
62697+
62698+/* Userspace Grsecurity ACL data structures */
62699+
62700+struct acl_subject_label {
62701+ char *filename;
62702+ ino_t inode;
62703+ dev_t device;
62704+ __u32 mode;
62705+ kernel_cap_t cap_mask;
62706+ kernel_cap_t cap_lower;
62707+ kernel_cap_t cap_invert_audit;
62708+
62709+ struct rlimit res[GR_NLIMITS];
62710+ __u32 resmask;
62711+
62712+ __u8 user_trans_type;
62713+ __u8 group_trans_type;
62714+ uid_t *user_transitions;
62715+ gid_t *group_transitions;
62716+ __u16 user_trans_num;
62717+ __u16 group_trans_num;
62718+
62719+ __u32 sock_families[2];
62720+ __u32 ip_proto[8];
62721+ __u32 ip_type;
62722+ struct acl_ip_label **ips;
62723+ __u32 ip_num;
62724+ __u32 inaddr_any_override;
62725+
62726+ __u32 crashes;
62727+ unsigned long expires;
62728+
62729+ struct acl_subject_label *parent_subject;
62730+ struct gr_hash_struct *hash;
62731+ struct acl_subject_label *prev;
62732+ struct acl_subject_label *next;
62733+
62734+ struct acl_object_label **obj_hash;
62735+ __u32 obj_hash_size;
62736+ __u16 pax_flags;
62737+};
62738+
62739+struct role_allowed_ip {
62740+ __u32 addr;
62741+ __u32 netmask;
62742+
62743+ struct role_allowed_ip *prev;
62744+ struct role_allowed_ip *next;
62745+};
62746+
62747+struct role_transition {
62748+ char *rolename;
62749+
62750+ struct role_transition *prev;
62751+ struct role_transition *next;
62752+};
62753+
62754+struct acl_role_label {
62755+ char *rolename;
62756+ uid_t uidgid;
62757+ __u16 roletype;
62758+
62759+ __u16 auth_attempts;
62760+ unsigned long expires;
62761+
62762+ struct acl_subject_label *root_label;
62763+ struct gr_hash_struct *hash;
62764+
62765+ struct acl_role_label *prev;
62766+ struct acl_role_label *next;
62767+
62768+ struct role_transition *transitions;
62769+ struct role_allowed_ip *allowed_ips;
62770+ uid_t *domain_children;
62771+ __u16 domain_child_num;
62772+
62773+ struct acl_subject_label **subj_hash;
62774+ __u32 subj_hash_size;
62775+};
62776+
62777+struct user_acl_role_db {
62778+ struct acl_role_label **r_table;
62779+ __u32 num_pointers; /* Number of allocations to track */
62780+ __u32 num_roles; /* Number of roles */
62781+ __u32 num_domain_children; /* Number of domain children */
62782+ __u32 num_subjects; /* Number of subjects */
62783+ __u32 num_objects; /* Number of objects */
62784+};
62785+
62786+struct acl_object_label {
62787+ char *filename;
62788+ ino_t inode;
62789+ dev_t device;
62790+ __u32 mode;
62791+
62792+ struct acl_subject_label *nested;
62793+ struct acl_object_label *globbed;
62794+
62795+ /* next two structures not used */
62796+
62797+ struct acl_object_label *prev;
62798+ struct acl_object_label *next;
62799+};
62800+
62801+struct acl_ip_label {
62802+ char *iface;
62803+ __u32 addr;
62804+ __u32 netmask;
62805+ __u16 low, high;
62806+ __u8 mode;
62807+ __u32 type;
62808+ __u32 proto[8];
62809+
62810+ /* next two structures not used */
62811+
62812+ struct acl_ip_label *prev;
62813+ struct acl_ip_label *next;
62814+};
62815+
62816+struct gr_arg {
62817+ struct user_acl_role_db role_db;
62818+ unsigned char pw[GR_PW_LEN];
62819+ unsigned char salt[GR_SALT_LEN];
62820+ unsigned char sum[GR_SHA_LEN];
62821+ unsigned char sp_role[GR_SPROLE_LEN];
62822+ struct sprole_pw *sprole_pws;
62823+ dev_t segv_device;
62824+ ino_t segv_inode;
62825+ uid_t segv_uid;
62826+ __u16 num_sprole_pws;
62827+ __u16 mode;
62828+};
62829+
62830+struct gr_arg_wrapper {
62831+ struct gr_arg *arg;
62832+ __u32 version;
62833+ __u32 size;
62834+};
62835+
62836+struct subject_map {
62837+ struct acl_subject_label *user;
62838+ struct acl_subject_label *kernel;
62839+ struct subject_map *prev;
62840+ struct subject_map *next;
62841+};
62842+
62843+struct acl_subj_map_db {
62844+ struct subject_map **s_hash;
62845+ __u32 s_size;
62846+};
62847+
62848+/* End Data Structures Section */
62849+
62850+/* Hash functions generated by empirical testing by Brad Spengler
62851+ Makes good use of the low bits of the inode. Generally 0-1 times
62852+ in loop for successful match. 0-3 for unsuccessful match.
62853+ Shift/add algorithm with modulus of table size and an XOR*/
62854+
62855+static __inline__ unsigned int
62856+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
62857+{
62858+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
62859+}
62860+
62861+ static __inline__ unsigned int
62862+shash(const struct acl_subject_label *userp, const unsigned int sz)
62863+{
62864+ return ((const unsigned long)userp % sz);
62865+}
62866+
62867+static __inline__ unsigned int
62868+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
62869+{
62870+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
62871+}
62872+
62873+static __inline__ unsigned int
62874+nhash(const char *name, const __u16 len, const unsigned int sz)
62875+{
62876+ return full_name_hash((const unsigned char *)name, len) % sz;
62877+}
62878+
62879+#define FOR_EACH_ROLE_START(role) \
62880+ role = role_list; \
62881+ while (role) {
62882+
62883+#define FOR_EACH_ROLE_END(role) \
62884+ role = role->prev; \
62885+ }
62886+
62887+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
62888+ subj = NULL; \
62889+ iter = 0; \
62890+ while (iter < role->subj_hash_size) { \
62891+ if (subj == NULL) \
62892+ subj = role->subj_hash[iter]; \
62893+ if (subj == NULL) { \
62894+ iter++; \
62895+ continue; \
62896+ }
62897+
62898+#define FOR_EACH_SUBJECT_END(subj,iter) \
62899+ subj = subj->next; \
62900+ if (subj == NULL) \
62901+ iter++; \
62902+ }
62903+
62904+
62905+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
62906+ subj = role->hash->first; \
62907+ while (subj != NULL) {
62908+
62909+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
62910+ subj = subj->next; \
62911+ }
62912+
62913+#endif
62914+
62915diff -urNp linux-2.6.39.2/include/linux/gralloc.h linux-2.6.39.2/include/linux/gralloc.h
62916--- linux-2.6.39.2/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
62917+++ linux-2.6.39.2/include/linux/gralloc.h 2011-05-22 19:41:42.000000000 -0400
62918@@ -0,0 +1,9 @@
62919+#ifndef __GRALLOC_H
62920+#define __GRALLOC_H
62921+
62922+void acl_free_all(void);
62923+int acl_alloc_stack_init(unsigned long size);
62924+void *acl_alloc(unsigned long len);
62925+void *acl_alloc_num(unsigned long num, unsigned long len);
62926+
62927+#endif
62928diff -urNp linux-2.6.39.2/include/linux/grdefs.h linux-2.6.39.2/include/linux/grdefs.h
62929--- linux-2.6.39.2/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
62930+++ linux-2.6.39.2/include/linux/grdefs.h 2011-06-11 16:24:51.000000000 -0400
62931@@ -0,0 +1,140 @@
62932+#ifndef GRDEFS_H
62933+#define GRDEFS_H
62934+
62935+/* Begin grsecurity status declarations */
62936+
62937+enum {
62938+ GR_READY = 0x01,
62939+ GR_STATUS_INIT = 0x00 // disabled state
62940+};
62941+
62942+/* Begin ACL declarations */
62943+
62944+/* Role flags */
62945+
62946+enum {
62947+ GR_ROLE_USER = 0x0001,
62948+ GR_ROLE_GROUP = 0x0002,
62949+ GR_ROLE_DEFAULT = 0x0004,
62950+ GR_ROLE_SPECIAL = 0x0008,
62951+ GR_ROLE_AUTH = 0x0010,
62952+ GR_ROLE_NOPW = 0x0020,
62953+ GR_ROLE_GOD = 0x0040,
62954+ GR_ROLE_LEARN = 0x0080,
62955+ GR_ROLE_TPE = 0x0100,
62956+ GR_ROLE_DOMAIN = 0x0200,
62957+ GR_ROLE_PAM = 0x0400,
62958+ GR_ROLE_PERSIST = 0x0800
62959+};
62960+
62961+/* ACL Subject and Object mode flags */
62962+enum {
62963+ GR_DELETED = 0x80000000
62964+};
62965+
62966+/* ACL Object-only mode flags */
62967+enum {
62968+ GR_READ = 0x00000001,
62969+ GR_APPEND = 0x00000002,
62970+ GR_WRITE = 0x00000004,
62971+ GR_EXEC = 0x00000008,
62972+ GR_FIND = 0x00000010,
62973+ GR_INHERIT = 0x00000020,
62974+ GR_SETID = 0x00000040,
62975+ GR_CREATE = 0x00000080,
62976+ GR_DELETE = 0x00000100,
62977+ GR_LINK = 0x00000200,
62978+ GR_AUDIT_READ = 0x00000400,
62979+ GR_AUDIT_APPEND = 0x00000800,
62980+ GR_AUDIT_WRITE = 0x00001000,
62981+ GR_AUDIT_EXEC = 0x00002000,
62982+ GR_AUDIT_FIND = 0x00004000,
62983+ GR_AUDIT_INHERIT= 0x00008000,
62984+ GR_AUDIT_SETID = 0x00010000,
62985+ GR_AUDIT_CREATE = 0x00020000,
62986+ GR_AUDIT_DELETE = 0x00040000,
62987+ GR_AUDIT_LINK = 0x00080000,
62988+ GR_PTRACERD = 0x00100000,
62989+ GR_NOPTRACE = 0x00200000,
62990+ GR_SUPPRESS = 0x00400000,
62991+ GR_NOLEARN = 0x00800000,
62992+ GR_INIT_TRANSFER= 0x01000000
62993+};
62994+
62995+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
62996+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
62997+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
62998+
62999+/* ACL subject-only mode flags */
63000+enum {
63001+ GR_KILL = 0x00000001,
63002+ GR_VIEW = 0x00000002,
63003+ GR_PROTECTED = 0x00000004,
63004+ GR_LEARN = 0x00000008,
63005+ GR_OVERRIDE = 0x00000010,
63006+ /* just a placeholder, this mode is only used in userspace */
63007+ GR_DUMMY = 0x00000020,
63008+ GR_PROTSHM = 0x00000040,
63009+ GR_KILLPROC = 0x00000080,
63010+ GR_KILLIPPROC = 0x00000100,
63011+ /* just a placeholder, this mode is only used in userspace */
63012+ GR_NOTROJAN = 0x00000200,
63013+ GR_PROTPROCFD = 0x00000400,
63014+ GR_PROCACCT = 0x00000800,
63015+ GR_RELAXPTRACE = 0x00001000,
63016+ GR_NESTED = 0x00002000,
63017+ GR_INHERITLEARN = 0x00004000,
63018+ GR_PROCFIND = 0x00008000,
63019+ GR_POVERRIDE = 0x00010000,
63020+ GR_KERNELAUTH = 0x00020000,
63021+ GR_ATSECURE = 0x00040000,
63022+ GR_SHMEXEC = 0x00080000
63023+};
63024+
63025+enum {
63026+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
63027+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
63028+ GR_PAX_ENABLE_MPROTECT = 0x0004,
63029+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
63030+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
63031+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
63032+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
63033+ GR_PAX_DISABLE_MPROTECT = 0x0400,
63034+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
63035+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
63036+};
63037+
63038+enum {
63039+ GR_ID_USER = 0x01,
63040+ GR_ID_GROUP = 0x02,
63041+};
63042+
63043+enum {
63044+ GR_ID_ALLOW = 0x01,
63045+ GR_ID_DENY = 0x02,
63046+};
63047+
63048+#define GR_CRASH_RES 31
63049+#define GR_UIDTABLE_MAX 500
63050+
63051+/* begin resource learning section */
63052+enum {
63053+ GR_RLIM_CPU_BUMP = 60,
63054+ GR_RLIM_FSIZE_BUMP = 50000,
63055+ GR_RLIM_DATA_BUMP = 10000,
63056+ GR_RLIM_STACK_BUMP = 1000,
63057+ GR_RLIM_CORE_BUMP = 10000,
63058+ GR_RLIM_RSS_BUMP = 500000,
63059+ GR_RLIM_NPROC_BUMP = 1,
63060+ GR_RLIM_NOFILE_BUMP = 5,
63061+ GR_RLIM_MEMLOCK_BUMP = 50000,
63062+ GR_RLIM_AS_BUMP = 500000,
63063+ GR_RLIM_LOCKS_BUMP = 2,
63064+ GR_RLIM_SIGPENDING_BUMP = 5,
63065+ GR_RLIM_MSGQUEUE_BUMP = 10000,
63066+ GR_RLIM_NICE_BUMP = 1,
63067+ GR_RLIM_RTPRIO_BUMP = 1,
63068+ GR_RLIM_RTTIME_BUMP = 1000000
63069+};
63070+
63071+#endif
63072diff -urNp linux-2.6.39.2/include/linux/grinternal.h linux-2.6.39.2/include/linux/grinternal.h
63073--- linux-2.6.39.2/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
63074+++ linux-2.6.39.2/include/linux/grinternal.h 2011-06-29 19:41:29.000000000 -0400
63075@@ -0,0 +1,220 @@
63076+#ifndef __GRINTERNAL_H
63077+#define __GRINTERNAL_H
63078+
63079+#ifdef CONFIG_GRKERNSEC
63080+
63081+#include <linux/fs.h>
63082+#include <linux/mnt_namespace.h>
63083+#include <linux/nsproxy.h>
63084+#include <linux/gracl.h>
63085+#include <linux/grdefs.h>
63086+#include <linux/grmsg.h>
63087+
63088+void gr_add_learn_entry(const char *fmt, ...)
63089+ __attribute__ ((format (printf, 1, 2)));
63090+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
63091+ const struct vfsmount *mnt);
63092+__u32 gr_check_create(const struct dentry *new_dentry,
63093+ const struct dentry *parent,
63094+ const struct vfsmount *mnt, const __u32 mode);
63095+int gr_check_protected_task(const struct task_struct *task);
63096+__u32 to_gr_audit(const __u32 reqmode);
63097+int gr_set_acls(const int type);
63098+int gr_apply_subject_to_task(struct task_struct *task);
63099+int gr_acl_is_enabled(void);
63100+char gr_roletype_to_char(void);
63101+
63102+void gr_handle_alertkill(struct task_struct *task);
63103+char *gr_to_filename(const struct dentry *dentry,
63104+ const struct vfsmount *mnt);
63105+char *gr_to_filename1(const struct dentry *dentry,
63106+ const struct vfsmount *mnt);
63107+char *gr_to_filename2(const struct dentry *dentry,
63108+ const struct vfsmount *mnt);
63109+char *gr_to_filename3(const struct dentry *dentry,
63110+ const struct vfsmount *mnt);
63111+
63112+extern int grsec_enable_harden_ptrace;
63113+extern int grsec_enable_link;
63114+extern int grsec_enable_fifo;
63115+extern int grsec_enable_execve;
63116+extern int grsec_enable_shm;
63117+extern int grsec_enable_execlog;
63118+extern int grsec_enable_signal;
63119+extern int grsec_enable_audit_ptrace;
63120+extern int grsec_enable_forkfail;
63121+extern int grsec_enable_time;
63122+extern int grsec_enable_rofs;
63123+extern int grsec_enable_chroot_shmat;
63124+extern int grsec_enable_chroot_findtask;
63125+extern int grsec_enable_chroot_mount;
63126+extern int grsec_enable_chroot_double;
63127+extern int grsec_enable_chroot_pivot;
63128+extern int grsec_enable_chroot_chdir;
63129+extern int grsec_enable_chroot_chmod;
63130+extern int grsec_enable_chroot_mknod;
63131+extern int grsec_enable_chroot_fchdir;
63132+extern int grsec_enable_chroot_nice;
63133+extern int grsec_enable_chroot_execlog;
63134+extern int grsec_enable_chroot_caps;
63135+extern int grsec_enable_chroot_sysctl;
63136+extern int grsec_enable_chroot_unix;
63137+extern int grsec_enable_tpe;
63138+extern int grsec_tpe_gid;
63139+extern int grsec_enable_tpe_all;
63140+extern int grsec_enable_tpe_invert;
63141+extern int grsec_enable_socket_all;
63142+extern int grsec_socket_all_gid;
63143+extern int grsec_enable_socket_client;
63144+extern int grsec_socket_client_gid;
63145+extern int grsec_enable_socket_server;
63146+extern int grsec_socket_server_gid;
63147+extern int grsec_audit_gid;
63148+extern int grsec_enable_group;
63149+extern int grsec_enable_audit_textrel;
63150+extern int grsec_enable_log_rwxmaps;
63151+extern int grsec_enable_mount;
63152+extern int grsec_enable_chdir;
63153+extern int grsec_resource_logging;
63154+extern int grsec_enable_blackhole;
63155+extern int grsec_lastack_retries;
63156+extern int grsec_enable_brute;
63157+extern int grsec_lock;
63158+
63159+extern spinlock_t grsec_alert_lock;
63160+extern unsigned long grsec_alert_wtime;
63161+extern unsigned long grsec_alert_fyet;
63162+
63163+extern spinlock_t grsec_audit_lock;
63164+
63165+extern rwlock_t grsec_exec_file_lock;
63166+
63167+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
63168+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
63169+ (tsk)->exec_file->f_vfsmnt) : "/")
63170+
63171+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
63172+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
63173+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
63174+
63175+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
63176+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
63177+ (tsk)->exec_file->f_vfsmnt) : "/")
63178+
63179+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
63180+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
63181+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
63182+
63183+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
63184+
63185+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
63186+
63187+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
63188+ (task)->pid, (cred)->uid, \
63189+ (cred)->euid, (cred)->gid, (cred)->egid, \
63190+ gr_parent_task_fullpath(task), \
63191+ (task)->real_parent->comm, (task)->real_parent->pid, \
63192+ (pcred)->uid, (pcred)->euid, \
63193+ (pcred)->gid, (pcred)->egid
63194+
63195+#define GR_CHROOT_CAPS {{ \
63196+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
63197+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
63198+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
63199+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
63200+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
63201+ CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
63202+
63203+#define security_learn(normal_msg,args...) \
63204+({ \
63205+ read_lock(&grsec_exec_file_lock); \
63206+ gr_add_learn_entry(normal_msg "\n", ## args); \
63207+ read_unlock(&grsec_exec_file_lock); \
63208+})
63209+
63210+enum {
63211+ GR_DO_AUDIT,
63212+ GR_DONT_AUDIT,
63213+ /* used for non-audit messages that we shouldn't kill the task on */
63214+ GR_DONT_AUDIT_GOOD
63215+};
63216+
63217+enum {
63218+ GR_TTYSNIFF,
63219+ GR_RBAC,
63220+ GR_RBAC_STR,
63221+ GR_STR_RBAC,
63222+ GR_RBAC_MODE2,
63223+ GR_RBAC_MODE3,
63224+ GR_FILENAME,
63225+ GR_SYSCTL_HIDDEN,
63226+ GR_NOARGS,
63227+ GR_ONE_INT,
63228+ GR_ONE_INT_TWO_STR,
63229+ GR_ONE_STR,
63230+ GR_STR_INT,
63231+ GR_TWO_STR_INT,
63232+ GR_TWO_INT,
63233+ GR_TWO_U64,
63234+ GR_THREE_INT,
63235+ GR_FIVE_INT_TWO_STR,
63236+ GR_TWO_STR,
63237+ GR_THREE_STR,
63238+ GR_FOUR_STR,
63239+ GR_STR_FILENAME,
63240+ GR_FILENAME_STR,
63241+ GR_FILENAME_TWO_INT,
63242+ GR_FILENAME_TWO_INT_STR,
63243+ GR_TEXTREL,
63244+ GR_PTRACE,
63245+ GR_RESOURCE,
63246+ GR_CAP,
63247+ GR_SIG,
63248+ GR_SIG2,
63249+ GR_CRASH1,
63250+ GR_CRASH2,
63251+ GR_PSACCT,
63252+ GR_RWXMAP
63253+};
63254+
63255+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
63256+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
63257+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
63258+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
63259+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
63260+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
63261+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
63262+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
63263+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
63264+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
63265+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
63266+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
63267+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
63268+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
63269+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
63270+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
63271+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
63272+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
63273+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
63274+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
63275+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
63276+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
63277+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
63278+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
63279+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
63280+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
63281+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
63282+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
63283+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
63284+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
63285+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
63286+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
63287+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
63288+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
63289+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
63290+
63291+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
63292+
63293+#endif
63294+
63295+#endif
63296diff -urNp linux-2.6.39.2/include/linux/grmsg.h linux-2.6.39.2/include/linux/grmsg.h
63297--- linux-2.6.39.2/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
63298+++ linux-2.6.39.2/include/linux/grmsg.h 2011-05-22 19:41:42.000000000 -0400
63299@@ -0,0 +1,108 @@
63300+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
63301+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
63302+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
63303+#define GR_STOPMOD_MSG "denied modification of module state by "
63304+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
63305+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
63306+#define GR_IOPERM_MSG "denied use of ioperm() by "
63307+#define GR_IOPL_MSG "denied use of iopl() by "
63308+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
63309+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
63310+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
63311+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
63312+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
63313+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
63314+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
63315+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
63316+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
63317+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
63318+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
63319+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
63320+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
63321+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
63322+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
63323+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
63324+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
63325+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
63326+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
63327+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
63328+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
63329+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
63330+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
63331+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
63332+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
63333+#define GR_NPROC_MSG "denied overstep of process limit by "
63334+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
63335+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
63336+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
63337+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
63338+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
63339+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
63340+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
63341+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
63342+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
63343+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
63344+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
63345+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
63346+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
63347+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
63348+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
63349+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
63350+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
63351+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
63352+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
63353+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
63354+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
63355+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
63356+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
63357+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
63358+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
63359+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
63360+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
63361+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
63362+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
63363+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
63364+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
63365+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
63366+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
63367+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
63368+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
63369+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
63370+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
63371+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
63372+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
63373+#define GR_FAILFORK_MSG "failed fork with errno %s by "
63374+#define GR_NICE_CHROOT_MSG "denied priority change by "
63375+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
63376+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
63377+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
63378+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
63379+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
63380+#define GR_TIME_MSG "time set by "
63381+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
63382+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
63383+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
63384+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
63385+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
63386+#define GR_BIND_MSG "denied bind() by "
63387+#define GR_CONNECT_MSG "denied connect() by "
63388+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
63389+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
63390+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
63391+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
63392+#define GR_CAP_ACL_MSG "use of %s denied for "
63393+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
63394+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
63395+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
63396+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
63397+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
63398+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
63399+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
63400+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
63401+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
63402+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
63403+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
63404+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
63405+#define GR_VM86_MSG "denied use of vm86 by "
63406+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
63407+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
63408diff -urNp linux-2.6.39.2/include/linux/grsecurity.h linux-2.6.39.2/include/linux/grsecurity.h
63409--- linux-2.6.39.2/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
63410+++ linux-2.6.39.2/include/linux/grsecurity.h 2011-05-22 19:41:42.000000000 -0400
63411@@ -0,0 +1,212 @@
63412+#ifndef GR_SECURITY_H
63413+#define GR_SECURITY_H
63414+#include <linux/fs.h>
63415+#include <linux/fs_struct.h>
63416+#include <linux/binfmts.h>
63417+#include <linux/gracl.h>
63418+#include <linux/compat.h>
63419+
63420+/* notify of brain-dead configs */
63421+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
63422+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
63423+#endif
63424+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63425+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63426+#endif
63427+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63428+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63429+#endif
63430+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
63431+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
63432+#endif
63433+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
63434+#error "CONFIG_PAX enabled, but no PaX options are enabled."
63435+#endif
63436+
63437+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
63438+void gr_handle_brute_check(void);
63439+void gr_handle_kernel_exploit(void);
63440+int gr_process_user_ban(void);
63441+
63442+char gr_roletype_to_char(void);
63443+
63444+int gr_acl_enable_at_secure(void);
63445+
63446+int gr_check_user_change(int real, int effective, int fs);
63447+int gr_check_group_change(int real, int effective, int fs);
63448+
63449+void gr_del_task_from_ip_table(struct task_struct *p);
63450+
63451+int gr_pid_is_chrooted(struct task_struct *p);
63452+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
63453+int gr_handle_chroot_nice(void);
63454+int gr_handle_chroot_sysctl(const int op);
63455+int gr_handle_chroot_setpriority(struct task_struct *p,
63456+ const int niceval);
63457+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
63458+int gr_handle_chroot_chroot(const struct dentry *dentry,
63459+ const struct vfsmount *mnt);
63460+int gr_handle_chroot_caps(struct path *path);
63461+void gr_handle_chroot_chdir(struct path *path);
63462+int gr_handle_chroot_chmod(const struct dentry *dentry,
63463+ const struct vfsmount *mnt, const int mode);
63464+int gr_handle_chroot_mknod(const struct dentry *dentry,
63465+ const struct vfsmount *mnt, const int mode);
63466+int gr_handle_chroot_mount(const struct dentry *dentry,
63467+ const struct vfsmount *mnt,
63468+ const char *dev_name);
63469+int gr_handle_chroot_pivot(void);
63470+int gr_handle_chroot_unix(struct pid *pid);
63471+
63472+int gr_handle_rawio(const struct inode *inode);
63473+int gr_handle_nproc(void);
63474+
63475+void gr_handle_ioperm(void);
63476+void gr_handle_iopl(void);
63477+
63478+int gr_tpe_allow(const struct file *file);
63479+
63480+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
63481+void gr_clear_chroot_entries(struct task_struct *task);
63482+
63483+void gr_log_forkfail(const int retval);
63484+void gr_log_timechange(void);
63485+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
63486+void gr_log_chdir(const struct dentry *dentry,
63487+ const struct vfsmount *mnt);
63488+void gr_log_chroot_exec(const struct dentry *dentry,
63489+ const struct vfsmount *mnt);
63490+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
63491+#ifdef CONFIG_COMPAT
63492+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
63493+#endif
63494+void gr_log_remount(const char *devname, const int retval);
63495+void gr_log_unmount(const char *devname, const int retval);
63496+void gr_log_mount(const char *from, const char *to, const int retval);
63497+void gr_log_textrel(struct vm_area_struct *vma);
63498+void gr_log_rwxmmap(struct file *file);
63499+void gr_log_rwxmprotect(struct file *file);
63500+
63501+int gr_handle_follow_link(const struct inode *parent,
63502+ const struct inode *inode,
63503+ const struct dentry *dentry,
63504+ const struct vfsmount *mnt);
63505+int gr_handle_fifo(const struct dentry *dentry,
63506+ const struct vfsmount *mnt,
63507+ const struct dentry *dir, const int flag,
63508+ const int acc_mode);
63509+int gr_handle_hardlink(const struct dentry *dentry,
63510+ const struct vfsmount *mnt,
63511+ struct inode *inode,
63512+ const int mode, const char *to);
63513+
63514+int gr_is_capable(const int cap);
63515+int gr_is_capable_nolog(const int cap);
63516+void gr_learn_resource(const struct task_struct *task, const int limit,
63517+ const unsigned long wanted, const int gt);
63518+void gr_copy_label(struct task_struct *tsk);
63519+void gr_handle_crash(struct task_struct *task, const int sig);
63520+int gr_handle_signal(const struct task_struct *p, const int sig);
63521+int gr_check_crash_uid(const uid_t uid);
63522+int gr_check_protected_task(const struct task_struct *task);
63523+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
63524+int gr_acl_handle_mmap(const struct file *file,
63525+ const unsigned long prot);
63526+int gr_acl_handle_mprotect(const struct file *file,
63527+ const unsigned long prot);
63528+int gr_check_hidden_task(const struct task_struct *tsk);
63529+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
63530+ const struct vfsmount *mnt);
63531+__u32 gr_acl_handle_utime(const struct dentry *dentry,
63532+ const struct vfsmount *mnt);
63533+__u32 gr_acl_handle_access(const struct dentry *dentry,
63534+ const struct vfsmount *mnt, const int fmode);
63535+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
63536+ const struct vfsmount *mnt, mode_t mode);
63537+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
63538+ const struct vfsmount *mnt, mode_t mode);
63539+__u32 gr_acl_handle_chown(const struct dentry *dentry,
63540+ const struct vfsmount *mnt);
63541+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
63542+ const struct vfsmount *mnt);
63543+int gr_handle_ptrace(struct task_struct *task, const long request);
63544+int gr_handle_proc_ptrace(struct task_struct *task);
63545+__u32 gr_acl_handle_execve(const struct dentry *dentry,
63546+ const struct vfsmount *mnt);
63547+int gr_check_crash_exec(const struct file *filp);
63548+int gr_acl_is_enabled(void);
63549+void gr_set_kernel_label(struct task_struct *task);
63550+void gr_set_role_label(struct task_struct *task, const uid_t uid,
63551+ const gid_t gid);
63552+int gr_set_proc_label(const struct dentry *dentry,
63553+ const struct vfsmount *mnt,
63554+ const int unsafe_share);
63555+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
63556+ const struct vfsmount *mnt);
63557+__u32 gr_acl_handle_open(const struct dentry *dentry,
63558+ const struct vfsmount *mnt, const int fmode);
63559+__u32 gr_acl_handle_creat(const struct dentry *dentry,
63560+ const struct dentry *p_dentry,
63561+ const struct vfsmount *p_mnt, const int fmode,
63562+ const int imode);
63563+void gr_handle_create(const struct dentry *dentry,
63564+ const struct vfsmount *mnt);
63565+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
63566+ const struct dentry *parent_dentry,
63567+ const struct vfsmount *parent_mnt,
63568+ const int mode);
63569+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
63570+ const struct dentry *parent_dentry,
63571+ const struct vfsmount *parent_mnt);
63572+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
63573+ const struct vfsmount *mnt);
63574+void gr_handle_delete(const ino_t ino, const dev_t dev);
63575+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
63576+ const struct vfsmount *mnt);
63577+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
63578+ const struct dentry *parent_dentry,
63579+ const struct vfsmount *parent_mnt,
63580+ const char *from);
63581+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
63582+ const struct dentry *parent_dentry,
63583+ const struct vfsmount *parent_mnt,
63584+ const struct dentry *old_dentry,
63585+ const struct vfsmount *old_mnt, const char *to);
63586+int gr_acl_handle_rename(struct dentry *new_dentry,
63587+ struct dentry *parent_dentry,
63588+ const struct vfsmount *parent_mnt,
63589+ struct dentry *old_dentry,
63590+ struct inode *old_parent_inode,
63591+ struct vfsmount *old_mnt, const char *newname);
63592+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
63593+ struct dentry *old_dentry,
63594+ struct dentry *new_dentry,
63595+ struct vfsmount *mnt, const __u8 replace);
63596+__u32 gr_check_link(const struct dentry *new_dentry,
63597+ const struct dentry *parent_dentry,
63598+ const struct vfsmount *parent_mnt,
63599+ const struct dentry *old_dentry,
63600+ const struct vfsmount *old_mnt);
63601+int gr_acl_handle_filldir(const struct file *file, const char *name,
63602+ const unsigned int namelen, const ino_t ino);
63603+
63604+__u32 gr_acl_handle_unix(const struct dentry *dentry,
63605+ const struct vfsmount *mnt);
63606+void gr_acl_handle_exit(void);
63607+void gr_acl_handle_psacct(struct task_struct *task, const long code);
63608+int gr_acl_handle_procpidmem(const struct task_struct *task);
63609+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
63610+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
63611+void gr_audit_ptrace(struct task_struct *task);
63612+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
63613+
63614+#ifdef CONFIG_GRKERNSEC
63615+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
63616+void gr_handle_vm86(void);
63617+void gr_handle_mem_readwrite(u64 from, u64 to);
63618+
63619+extern int grsec_enable_dmesg;
63620+extern int grsec_disable_privio;
63621+#endif
63622+
63623+#endif
63624diff -urNp linux-2.6.39.2/include/linux/grsock.h linux-2.6.39.2/include/linux/grsock.h
63625--- linux-2.6.39.2/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
63626+++ linux-2.6.39.2/include/linux/grsock.h 2011-05-22 19:41:42.000000000 -0400
63627@@ -0,0 +1,19 @@
63628+#ifndef __GRSOCK_H
63629+#define __GRSOCK_H
63630+
63631+extern void gr_attach_curr_ip(const struct sock *sk);
63632+extern int gr_handle_sock_all(const int family, const int type,
63633+ const int protocol);
63634+extern int gr_handle_sock_server(const struct sockaddr *sck);
63635+extern int gr_handle_sock_server_other(const struct sock *sck);
63636+extern int gr_handle_sock_client(const struct sockaddr *sck);
63637+extern int gr_search_connect(struct socket * sock,
63638+ struct sockaddr_in * addr);
63639+extern int gr_search_bind(struct socket * sock,
63640+ struct sockaddr_in * addr);
63641+extern int gr_search_listen(struct socket * sock);
63642+extern int gr_search_accept(struct socket * sock);
63643+extern int gr_search_socket(const int domain, const int type,
63644+ const int protocol);
63645+
63646+#endif
63647diff -urNp linux-2.6.39.2/include/linux/highmem.h linux-2.6.39.2/include/linux/highmem.h
63648--- linux-2.6.39.2/include/linux/highmem.h 2011-05-19 00:06:34.000000000 -0400
63649+++ linux-2.6.39.2/include/linux/highmem.h 2011-05-22 19:36:33.000000000 -0400
63650@@ -185,6 +185,18 @@ static inline void clear_highpage(struct
63651 kunmap_atomic(kaddr, KM_USER0);
63652 }
63653
63654+static inline void sanitize_highpage(struct page *page)
63655+{
63656+ void *kaddr;
63657+ unsigned long flags;
63658+
63659+ local_irq_save(flags);
63660+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
63661+ clear_page(kaddr);
63662+ kunmap_atomic(kaddr, KM_CLEARPAGE);
63663+ local_irq_restore(flags);
63664+}
63665+
63666 static inline void zero_user_segments(struct page *page,
63667 unsigned start1, unsigned end1,
63668 unsigned start2, unsigned end2)
63669diff -urNp linux-2.6.39.2/include/linux/i2o.h linux-2.6.39.2/include/linux/i2o.h
63670--- linux-2.6.39.2/include/linux/i2o.h 2011-05-19 00:06:34.000000000 -0400
63671+++ linux-2.6.39.2/include/linux/i2o.h 2011-05-22 19:36:33.000000000 -0400
63672@@ -564,7 +564,7 @@ struct i2o_controller {
63673 struct i2o_device *exec; /* Executive */
63674 #if BITS_PER_LONG == 64
63675 spinlock_t context_list_lock; /* lock for context_list */
63676- atomic_t context_list_counter; /* needed for unique contexts */
63677+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
63678 struct list_head context_list; /* list of context id's
63679 and pointers */
63680 #endif
63681diff -urNp linux-2.6.39.2/include/linux/if_phonet.h linux-2.6.39.2/include/linux/if_phonet.h
63682--- linux-2.6.39.2/include/linux/if_phonet.h 2011-05-19 00:06:34.000000000 -0400
63683+++ linux-2.6.39.2/include/linux/if_phonet.h 2011-05-22 19:36:33.000000000 -0400
63684@@ -13,7 +13,7 @@
63685 #define PHONET_DEV_MTU PHONET_MAX_MTU
63686
63687 #ifdef __KERNEL__
63688-extern struct header_ops phonet_header_ops;
63689+extern const struct header_ops phonet_header_ops;
63690 #endif
63691
63692 #endif
63693diff -urNp linux-2.6.39.2/include/linux/init.h linux-2.6.39.2/include/linux/init.h
63694--- linux-2.6.39.2/include/linux/init.h 2011-05-19 00:06:34.000000000 -0400
63695+++ linux-2.6.39.2/include/linux/init.h 2011-05-22 19:36:33.000000000 -0400
63696@@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
63697
63698 /* Each module must use one module_init(). */
63699 #define module_init(initfn) \
63700- static inline initcall_t __inittest(void) \
63701+ static inline __used initcall_t __inittest(void) \
63702 { return initfn; } \
63703 int init_module(void) __attribute__((alias(#initfn)));
63704
63705 /* This is only required if you want to be unloadable. */
63706 #define module_exit(exitfn) \
63707- static inline exitcall_t __exittest(void) \
63708+ static inline __used exitcall_t __exittest(void) \
63709 { return exitfn; } \
63710 void cleanup_module(void) __attribute__((alias(#exitfn)));
63711
63712diff -urNp linux-2.6.39.2/include/linux/init_task.h linux-2.6.39.2/include/linux/init_task.h
63713--- linux-2.6.39.2/include/linux/init_task.h 2011-05-19 00:06:34.000000000 -0400
63714+++ linux-2.6.39.2/include/linux/init_task.h 2011-05-22 19:36:33.000000000 -0400
63715@@ -83,6 +83,12 @@ extern struct group_info init_groups;
63716 #define INIT_IDS
63717 #endif
63718
63719+#ifdef CONFIG_X86
63720+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
63721+#else
63722+#define INIT_TASK_THREAD_INFO
63723+#endif
63724+
63725 /*
63726 * Because of the reduced scope of CAP_SETPCAP when filesystem
63727 * capabilities are in effect, it is safe to allow CAP_SETPCAP to
63728@@ -163,6 +169,7 @@ extern struct cred init_cred;
63729 RCU_INIT_POINTER(.cred, &init_cred), \
63730 .comm = "swapper", \
63731 .thread = INIT_THREAD, \
63732+ INIT_TASK_THREAD_INFO \
63733 .fs = &init_fs, \
63734 .files = &init_files, \
63735 .signal = &init_signals, \
63736diff -urNp linux-2.6.39.2/include/linux/interrupt.h linux-2.6.39.2/include/linux/interrupt.h
63737--- linux-2.6.39.2/include/linux/interrupt.h 2011-05-19 00:06:34.000000000 -0400
63738+++ linux-2.6.39.2/include/linux/interrupt.h 2011-05-22 19:36:33.000000000 -0400
63739@@ -422,7 +422,7 @@ enum
63740 /* map softirq index to softirq name. update 'softirq_to_name' in
63741 * kernel/softirq.c when adding a new softirq.
63742 */
63743-extern char *softirq_to_name[NR_SOFTIRQS];
63744+extern const char * const softirq_to_name[NR_SOFTIRQS];
63745
63746 /* softirq mask and active fields moved to irq_cpustat_t in
63747 * asm/hardirq.h to get better cache usage. KAO
63748@@ -430,12 +430,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
63749
63750 struct softirq_action
63751 {
63752- void (*action)(struct softirq_action *);
63753+ void (*action)(void);
63754 };
63755
63756 asmlinkage void do_softirq(void);
63757 asmlinkage void __do_softirq(void);
63758-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
63759+extern void open_softirq(int nr, void (*action)(void));
63760 extern void softirq_init(void);
63761 static inline void __raise_softirq_irqoff(unsigned int nr)
63762 {
63763diff -urNp linux-2.6.39.2/include/linux/iommu.h linux-2.6.39.2/include/linux/iommu.h
63764--- linux-2.6.39.2/include/linux/iommu.h 2011-05-19 00:06:34.000000000 -0400
63765+++ linux-2.6.39.2/include/linux/iommu.h 2011-05-22 19:36:33.000000000 -0400
63766@@ -49,7 +49,7 @@ struct iommu_ops {
63767
63768 #ifdef CONFIG_IOMMU_API
63769
63770-extern void register_iommu(struct iommu_ops *ops);
63771+extern void register_iommu(const struct iommu_ops *ops);
63772 extern bool iommu_found(void);
63773 extern struct iommu_domain *iommu_domain_alloc(void);
63774 extern void iommu_domain_free(struct iommu_domain *domain);
63775diff -urNp linux-2.6.39.2/include/linux/ipmi.h linux-2.6.39.2/include/linux/ipmi.h
63776--- linux-2.6.39.2/include/linux/ipmi.h 2011-05-19 00:06:34.000000000 -0400
63777+++ linux-2.6.39.2/include/linux/ipmi.h 2011-05-22 19:36:33.000000000 -0400
63778@@ -282,7 +282,7 @@ struct ipmi_user_hndl {
63779
63780 /* Create a new user of the IPMI layer on the given interface number. */
63781 int ipmi_create_user(unsigned int if_num,
63782- struct ipmi_user_hndl *handler,
63783+ const struct ipmi_user_hndl *handler,
63784 void *handler_data,
63785 ipmi_user_t *user);
63786
63787diff -urNp linux-2.6.39.2/include/linux/kallsyms.h linux-2.6.39.2/include/linux/kallsyms.h
63788--- linux-2.6.39.2/include/linux/kallsyms.h 2011-05-19 00:06:34.000000000 -0400
63789+++ linux-2.6.39.2/include/linux/kallsyms.h 2011-05-22 22:52:54.000000000 -0400
63790@@ -15,7 +15,8 @@
63791
63792 struct module;
63793
63794-#ifdef CONFIG_KALLSYMS
63795+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
63796+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63797 /* Lookup the address for a symbol. Returns 0 if not found. */
63798 unsigned long kallsyms_lookup_name(const char *name);
63799
63800@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un
63801 /* Stupid that this does nothing, but I didn't create this mess. */
63802 #define __print_symbol(fmt, addr)
63803 #endif /*CONFIG_KALLSYMS*/
63804+#else /* when included by kallsyms.c, vsnprintf.c, or
63805+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
63806+extern void __print_symbol(const char *fmt, unsigned long address);
63807+extern int sprint_backtrace(char *buffer, unsigned long address);
63808+extern int sprint_symbol(char *buffer, unsigned long address);
63809+const char *kallsyms_lookup(unsigned long addr,
63810+ unsigned long *symbolsize,
63811+ unsigned long *offset,
63812+ char **modname, char *namebuf);
63813+#endif
63814
63815 /* This macro allows us to keep printk typechecking */
63816 static void __check_printsym_format(const char *fmt, ...)
63817diff -urNp linux-2.6.39.2/include/linux/kgdb.h linux-2.6.39.2/include/linux/kgdb.h
63818--- linux-2.6.39.2/include/linux/kgdb.h 2011-05-19 00:06:34.000000000 -0400
63819+++ linux-2.6.39.2/include/linux/kgdb.h 2011-05-22 19:36:33.000000000 -0400
63820@@ -53,7 +53,7 @@ extern int kgdb_connected;
63821 extern int kgdb_io_module_registered;
63822
63823 extern atomic_t kgdb_setting_breakpoint;
63824-extern atomic_t kgdb_cpu_doing_single_step;
63825+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
63826
63827 extern struct task_struct *kgdb_usethread;
63828 extern struct task_struct *kgdb_contthread;
63829@@ -269,22 +269,22 @@ struct kgdb_arch {
63830 */
63831 struct kgdb_io {
63832 const char *name;
63833- int (*read_char) (void);
63834- void (*write_char) (u8);
63835- void (*flush) (void);
63836- int (*init) (void);
63837- void (*pre_exception) (void);
63838- void (*post_exception) (void);
63839+ int (* const read_char) (void);
63840+ void (* const write_char) (u8);
63841+ void (* const flush) (void);
63842+ int (* const init) (void);
63843+ void (* const pre_exception) (void);
63844+ void (* const post_exception) (void);
63845 int is_console;
63846 };
63847
63848-extern struct kgdb_arch arch_kgdb_ops;
63849+extern const struct kgdb_arch arch_kgdb_ops;
63850
63851 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
63852
63853-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
63854-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
63855-extern struct kgdb_io *dbg_io_ops;
63856+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
63857+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
63858+extern const struct kgdb_io *dbg_io_ops;
63859
63860 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
63861 extern char *kgdb_mem2hex(char *mem, char *buf, int count);
63862diff -urNp linux-2.6.39.2/include/linux/kmod.h linux-2.6.39.2/include/linux/kmod.h
63863--- linux-2.6.39.2/include/linux/kmod.h 2011-05-19 00:06:34.000000000 -0400
63864+++ linux-2.6.39.2/include/linux/kmod.h 2011-05-22 19:41:42.000000000 -0400
63865@@ -33,6 +33,8 @@ extern char modprobe_path[]; /* for sysc
63866 * usually useless though. */
63867 extern int __request_module(bool wait, const char *name, ...) \
63868 __attribute__((format(printf, 2, 3)));
63869+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
63870+ __attribute__((format(printf, 3, 4)));
63871 #define request_module(mod...) __request_module(true, mod)
63872 #define request_module_nowait(mod...) __request_module(false, mod)
63873 #define try_then_request_module(x, mod...) \
63874diff -urNp linux-2.6.39.2/include/linux/kvm_host.h linux-2.6.39.2/include/linux/kvm_host.h
63875--- linux-2.6.39.2/include/linux/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
63876+++ linux-2.6.39.2/include/linux/kvm_host.h 2011-05-22 19:36:33.000000000 -0400
63877@@ -302,7 +302,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
63878 void vcpu_load(struct kvm_vcpu *vcpu);
63879 void vcpu_put(struct kvm_vcpu *vcpu);
63880
63881-int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63882+int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63883 struct module *module);
63884 void kvm_exit(void);
63885
63886@@ -442,7 +442,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
63887 struct kvm_guest_debug *dbg);
63888 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
63889
63890-int kvm_arch_init(void *opaque);
63891+int kvm_arch_init(const void *opaque);
63892 void kvm_arch_exit(void);
63893
63894 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
63895diff -urNp linux-2.6.39.2/include/linux/lapb.h linux-2.6.39.2/include/linux/lapb.h
63896--- linux-2.6.39.2/include/linux/lapb.h 2011-05-19 00:06:34.000000000 -0400
63897+++ linux-2.6.39.2/include/linux/lapb.h 2011-05-22 19:36:33.000000000 -0400
63898@@ -44,7 +44,7 @@ struct lapb_parms_struct {
63899 unsigned int mode;
63900 };
63901
63902-extern int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks);
63903+extern int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks);
63904 extern int lapb_unregister(struct net_device *dev);
63905 extern int lapb_getparms(struct net_device *dev, struct lapb_parms_struct *parms);
63906 extern int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms);
63907diff -urNp linux-2.6.39.2/include/linux/lcd.h linux-2.6.39.2/include/linux/lcd.h
63908--- linux-2.6.39.2/include/linux/lcd.h 2011-05-19 00:06:34.000000000 -0400
63909+++ linux-2.6.39.2/include/linux/lcd.h 2011-05-22 19:36:33.000000000 -0400
63910@@ -60,7 +60,7 @@ struct lcd_device {
63911 points to something in the body of that driver, it is also invalid. */
63912 struct mutex ops_lock;
63913 /* If this is NULL, the backing module is unloaded */
63914- struct lcd_ops *ops;
63915+ const struct lcd_ops *ops;
63916 /* Serialise access to set_power method */
63917 struct mutex update_lock;
63918 /* The framebuffer notifier block */
63919@@ -101,7 +101,7 @@ static inline void lcd_set_power(struct
63920 }
63921
63922 extern struct lcd_device *lcd_device_register(const char *name,
63923- struct device *parent, void *devdata, struct lcd_ops *ops);
63924+ struct device *parent, void *devdata, const struct lcd_ops *ops);
63925 extern void lcd_device_unregister(struct lcd_device *ld);
63926
63927 #define to_lcd_device(obj) container_of(obj, struct lcd_device, dev)
63928diff -urNp linux-2.6.39.2/include/linux/libata.h linux-2.6.39.2/include/linux/libata.h
63929--- linux-2.6.39.2/include/linux/libata.h 2011-05-19 00:06:34.000000000 -0400
63930+++ linux-2.6.39.2/include/linux/libata.h 2011-05-22 19:36:33.000000000 -0400
63931@@ -524,11 +524,11 @@ struct ata_ioports {
63932
63933 struct ata_host {
63934 spinlock_t lock;
63935- struct device *dev;
63936+ struct device *dev;
63937 void __iomem * const *iomap;
63938 unsigned int n_ports;
63939 void *private_data;
63940- struct ata_port_operations *ops;
63941+ const struct ata_port_operations *ops;
63942 unsigned long flags;
63943
63944 struct mutex eh_mutex;
63945@@ -719,7 +719,7 @@ struct ata_link {
63946
63947 struct ata_port {
63948 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
63949- struct ata_port_operations *ops;
63950+ const struct ata_port_operations *ops;
63951 spinlock_t *lock;
63952 /* Flags owned by the EH context. Only EH should touch these once the
63953 port is active */
63954@@ -907,7 +907,7 @@ struct ata_port_info {
63955 unsigned long pio_mask;
63956 unsigned long mwdma_mask;
63957 unsigned long udma_mask;
63958- struct ata_port_operations *port_ops;
63959+ const struct ata_port_operations *port_ops;
63960 void *private_data;
63961 };
63962
63963@@ -931,7 +931,7 @@ extern const unsigned long sata_deb_timi
63964 extern const unsigned long sata_deb_timing_hotplug[];
63965 extern const unsigned long sata_deb_timing_long[];
63966
63967-extern struct ata_port_operations ata_dummy_port_ops;
63968+extern const struct ata_port_operations ata_dummy_port_ops;
63969 extern const struct ata_port_info ata_dummy_port_info;
63970
63971 static inline const unsigned long *
63972@@ -977,7 +977,7 @@ extern int ata_host_activate(struct ata_
63973 struct scsi_host_template *sht);
63974 extern void ata_host_detach(struct ata_host *host);
63975 extern void ata_host_init(struct ata_host *, struct device *,
63976- unsigned long, struct ata_port_operations *);
63977+ unsigned long, const struct ata_port_operations *);
63978 extern int ata_scsi_detect(struct scsi_host_template *sht);
63979 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
63980 extern int ata_scsi_queuecmd(struct Scsi_Host *h, struct scsi_cmnd *cmd);
63981diff -urNp linux-2.6.39.2/include/linux/lockd/bind.h linux-2.6.39.2/include/linux/lockd/bind.h
63982--- linux-2.6.39.2/include/linux/lockd/bind.h 2011-05-19 00:06:34.000000000 -0400
63983+++ linux-2.6.39.2/include/linux/lockd/bind.h 2011-05-22 19:36:33.000000000 -0400
63984@@ -23,13 +23,13 @@ struct svc_rqst;
63985 * This is the set of functions for lockd->nfsd communication
63986 */
63987 struct nlmsvc_binding {
63988- __be32 (*fopen)(struct svc_rqst *,
63989+ __be32 (* const fopen)(struct svc_rqst *,
63990 struct nfs_fh *,
63991 struct file **);
63992- void (*fclose)(struct file *);
63993+ void (* const fclose)(struct file *);
63994 };
63995
63996-extern struct nlmsvc_binding * nlmsvc_ops;
63997+extern const struct nlmsvc_binding * nlmsvc_ops;
63998
63999 /*
64000 * Similar to nfs_client_initdata, but without the NFS-specific
64001diff -urNp linux-2.6.39.2/include/linux/mfd/abx500.h linux-2.6.39.2/include/linux/mfd/abx500.h
64002--- linux-2.6.39.2/include/linux/mfd/abx500.h 2011-05-19 00:06:34.000000000 -0400
64003+++ linux-2.6.39.2/include/linux/mfd/abx500.h 2011-05-22 19:36:33.000000000 -0400
64004@@ -227,6 +227,6 @@ struct abx500_ops {
64005 int (*startup_irq_enabled) (struct device *, unsigned int);
64006 };
64007
64008-int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
64009+int abx500_register_ops(struct device *core_dev, const struct abx500_ops *ops);
64010 void abx500_remove_ops(struct device *dev);
64011 #endif
64012diff -urNp linux-2.6.39.2/include/linux/mm.h linux-2.6.39.2/include/linux/mm.h
64013--- linux-2.6.39.2/include/linux/mm.h 2011-05-19 00:06:34.000000000 -0400
64014+++ linux-2.6.39.2/include/linux/mm.h 2011-05-22 19:36:33.000000000 -0400
64015@@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void
64016
64017 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
64018 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
64019+
64020+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
64021+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
64022+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
64023+#else
64024 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
64025+#endif
64026+
64027 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
64028 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
64029
64030@@ -1010,34 +1017,6 @@ int set_page_dirty(struct page *page);
64031 int set_page_dirty_lock(struct page *page);
64032 int clear_page_dirty_for_io(struct page *page);
64033
64034-/* Is the vma a continuation of the stack vma above it? */
64035-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
64036-{
64037- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
64038-}
64039-
64040-static inline int stack_guard_page_start(struct vm_area_struct *vma,
64041- unsigned long addr)
64042-{
64043- return (vma->vm_flags & VM_GROWSDOWN) &&
64044- (vma->vm_start == addr) &&
64045- !vma_growsdown(vma->vm_prev, addr);
64046-}
64047-
64048-/* Is the vma a continuation of the stack vma below it? */
64049-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
64050-{
64051- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
64052-}
64053-
64054-static inline int stack_guard_page_end(struct vm_area_struct *vma,
64055- unsigned long addr)
64056-{
64057- return (vma->vm_flags & VM_GROWSUP) &&
64058- (vma->vm_end == addr) &&
64059- !vma_growsup(vma->vm_next, addr);
64060-}
64061-
64062 extern unsigned long move_page_tables(struct vm_area_struct *vma,
64063 unsigned long old_addr, struct vm_area_struct *new_vma,
64064 unsigned long new_addr, unsigned long len);
64065@@ -1189,6 +1168,15 @@ struct shrinker {
64066 extern void register_shrinker(struct shrinker *);
64067 extern void unregister_shrinker(struct shrinker *);
64068
64069+#ifdef CONFIG_MMU
64070+pgprot_t vm_get_page_prot(unsigned long vm_flags);
64071+#else
64072+static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
64073+{
64074+ return __pgprot(0);
64075+}
64076+#endif
64077+
64078 int vma_wants_writenotify(struct vm_area_struct *vma);
64079
64080 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
64081@@ -1476,6 +1464,7 @@ out:
64082 }
64083
64084 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
64085+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
64086
64087 extern unsigned long do_brk(unsigned long, unsigned long);
64088
64089@@ -1532,6 +1521,10 @@ extern struct vm_area_struct * find_vma(
64090 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
64091 struct vm_area_struct **pprev);
64092
64093+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
64094+extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
64095+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
64096+
64097 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
64098 NULL if none. Assume start_addr < end_addr. */
64099 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
64100@@ -1548,15 +1541,6 @@ static inline unsigned long vma_pages(st
64101 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
64102 }
64103
64104-#ifdef CONFIG_MMU
64105-pgprot_t vm_get_page_prot(unsigned long vm_flags);
64106-#else
64107-static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
64108-{
64109- return __pgprot(0);
64110-}
64111-#endif
64112-
64113 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
64114 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
64115 unsigned long pfn, unsigned long size, pgprot_t);
64116@@ -1668,7 +1652,7 @@ extern int unpoison_memory(unsigned long
64117 extern int sysctl_memory_failure_early_kill;
64118 extern int sysctl_memory_failure_recovery;
64119 extern void shake_page(struct page *p, int access);
64120-extern atomic_long_t mce_bad_pages;
64121+extern atomic_long_unchecked_t mce_bad_pages;
64122 extern int soft_offline_page(struct page *page, int flags);
64123
64124 extern void dump_page(struct page *page);
64125@@ -1682,5 +1666,11 @@ extern void copy_user_huge_page(struct p
64126 unsigned int pages_per_huge_page);
64127 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
64128
64129+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
64130+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
64131+#else
64132+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
64133+#endif
64134+
64135 #endif /* __KERNEL__ */
64136 #endif /* _LINUX_MM_H */
64137diff -urNp linux-2.6.39.2/include/linux/mm_types.h linux-2.6.39.2/include/linux/mm_types.h
64138--- linux-2.6.39.2/include/linux/mm_types.h 2011-05-19 00:06:34.000000000 -0400
64139+++ linux-2.6.39.2/include/linux/mm_types.h 2011-05-22 19:36:33.000000000 -0400
64140@@ -183,6 +183,8 @@ struct vm_area_struct {
64141 #ifdef CONFIG_NUMA
64142 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
64143 #endif
64144+
64145+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
64146 };
64147
64148 struct core_thread {
64149@@ -317,6 +319,24 @@ struct mm_struct {
64150 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
64151 pgtable_t pmd_huge_pte; /* protected by page_table_lock */
64152 #endif
64153+
64154+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
64155+ unsigned long pax_flags;
64156+#endif
64157+
64158+#ifdef CONFIG_PAX_DLRESOLVE
64159+ unsigned long call_dl_resolve;
64160+#endif
64161+
64162+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
64163+ unsigned long call_syscall;
64164+#endif
64165+
64166+#ifdef CONFIG_PAX_ASLR
64167+ unsigned long delta_mmap; /* randomized offset */
64168+ unsigned long delta_stack; /* randomized offset */
64169+#endif
64170+
64171 };
64172
64173 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
64174diff -urNp linux-2.6.39.2/include/linux/mmu_notifier.h linux-2.6.39.2/include/linux/mmu_notifier.h
64175--- linux-2.6.39.2/include/linux/mmu_notifier.h 2011-05-19 00:06:34.000000000 -0400
64176+++ linux-2.6.39.2/include/linux/mmu_notifier.h 2011-05-22 19:36:33.000000000 -0400
64177@@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
64178 */
64179 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
64180 ({ \
64181- pte_t __pte; \
64182+ pte_t ___pte; \
64183 struct vm_area_struct *___vma = __vma; \
64184 unsigned long ___address = __address; \
64185- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
64186+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
64187 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
64188- __pte; \
64189+ ___pte; \
64190 })
64191
64192 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
64193diff -urNp linux-2.6.39.2/include/linux/mmzone.h linux-2.6.39.2/include/linux/mmzone.h
64194--- linux-2.6.39.2/include/linux/mmzone.h 2011-05-19 00:06:34.000000000 -0400
64195+++ linux-2.6.39.2/include/linux/mmzone.h 2011-05-22 19:36:33.000000000 -0400
64196@@ -355,7 +355,7 @@ struct zone {
64197 unsigned long flags; /* zone flags, see below */
64198
64199 /* Zone statistics */
64200- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64201+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64202
64203 /*
64204 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
64205diff -urNp linux-2.6.39.2/include/linux/mod_devicetable.h linux-2.6.39.2/include/linux/mod_devicetable.h
64206--- linux-2.6.39.2/include/linux/mod_devicetable.h 2011-05-19 00:06:34.000000000 -0400
64207+++ linux-2.6.39.2/include/linux/mod_devicetable.h 2011-05-22 19:36:33.000000000 -0400
64208@@ -12,7 +12,7 @@
64209 typedef unsigned long kernel_ulong_t;
64210 #endif
64211
64212-#define PCI_ANY_ID (~0)
64213+#define PCI_ANY_ID ((__u16)~0)
64214
64215 struct pci_device_id {
64216 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
64217@@ -131,7 +131,7 @@ struct usb_device_id {
64218 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
64219 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
64220
64221-#define HID_ANY_ID (~0)
64222+#define HID_ANY_ID (~0U)
64223
64224 struct hid_device_id {
64225 __u16 bus;
64226diff -urNp linux-2.6.39.2/include/linux/module.h linux-2.6.39.2/include/linux/module.h
64227--- linux-2.6.39.2/include/linux/module.h 2011-05-19 00:06:34.000000000 -0400
64228+++ linux-2.6.39.2/include/linux/module.h 2011-05-22 19:36:33.000000000 -0400
64229@@ -324,19 +324,16 @@ struct module
64230 int (*init)(void);
64231
64232 /* If this is non-NULL, vfree after init() returns */
64233- void *module_init;
64234+ void *module_init_rx, *module_init_rw;
64235
64236 /* Here is the actual code + data, vfree'd on unload. */
64237- void *module_core;
64238+ void *module_core_rx, *module_core_rw;
64239
64240 /* Here are the sizes of the init and core sections */
64241- unsigned int init_size, core_size;
64242+ unsigned int init_size_rw, core_size_rw;
64243
64244 /* The size of the executable code in each section. */
64245- unsigned int init_text_size, core_text_size;
64246-
64247- /* Size of RO sections of the module (text+rodata) */
64248- unsigned int init_ro_size, core_ro_size;
64249+ unsigned int init_size_rx, core_size_rx;
64250
64251 /* Arch-specific module values */
64252 struct mod_arch_specific arch;
64253@@ -441,16 +438,46 @@ bool is_module_address(unsigned long add
64254 bool is_module_percpu_address(unsigned long addr);
64255 bool is_module_text_address(unsigned long addr);
64256
64257+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
64258+{
64259+
64260+#ifdef CONFIG_PAX_KERNEXEC
64261+ if (ktla_ktva(addr) >= (unsigned long)start &&
64262+ ktla_ktva(addr) < (unsigned long)start + size)
64263+ return 1;
64264+#endif
64265+
64266+ return ((void *)addr >= start && (void *)addr < start + size);
64267+}
64268+
64269+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
64270+{
64271+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
64272+}
64273+
64274+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
64275+{
64276+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
64277+}
64278+
64279+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
64280+{
64281+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
64282+}
64283+
64284+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
64285+{
64286+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
64287+}
64288+
64289 static inline int within_module_core(unsigned long addr, struct module *mod)
64290 {
64291- return (unsigned long)mod->module_core <= addr &&
64292- addr < (unsigned long)mod->module_core + mod->core_size;
64293+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
64294 }
64295
64296 static inline int within_module_init(unsigned long addr, struct module *mod)
64297 {
64298- return (unsigned long)mod->module_init <= addr &&
64299- addr < (unsigned long)mod->module_init + mod->init_size;
64300+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
64301 }
64302
64303 /* Search for module by name: must hold module_mutex. */
64304diff -urNp linux-2.6.39.2/include/linux/moduleloader.h linux-2.6.39.2/include/linux/moduleloader.h
64305--- linux-2.6.39.2/include/linux/moduleloader.h 2011-05-19 00:06:34.000000000 -0400
64306+++ linux-2.6.39.2/include/linux/moduleloader.h 2011-05-22 19:36:33.000000000 -0400
64307@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
64308 sections. Returns NULL on failure. */
64309 void *module_alloc(unsigned long size);
64310
64311+#ifdef CONFIG_PAX_KERNEXEC
64312+void *module_alloc_exec(unsigned long size);
64313+#else
64314+#define module_alloc_exec(x) module_alloc(x)
64315+#endif
64316+
64317 /* Free memory returned from module_alloc. */
64318 void module_free(struct module *mod, void *module_region);
64319
64320+#ifdef CONFIG_PAX_KERNEXEC
64321+void module_free_exec(struct module *mod, void *module_region);
64322+#else
64323+#define module_free_exec(x, y) module_free((x), (y))
64324+#endif
64325+
64326 /* Apply the given relocation to the (simplified) ELF. Return -error
64327 or 0. */
64328 int apply_relocate(Elf_Shdr *sechdrs,
64329diff -urNp linux-2.6.39.2/include/linux/moduleparam.h linux-2.6.39.2/include/linux/moduleparam.h
64330--- linux-2.6.39.2/include/linux/moduleparam.h 2011-05-19 00:06:34.000000000 -0400
64331+++ linux-2.6.39.2/include/linux/moduleparam.h 2011-05-22 19:36:33.000000000 -0400
64332@@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
64333 * @len is usually just sizeof(string).
64334 */
64335 #define module_param_string(name, string, len, perm) \
64336- static const struct kparam_string __param_string_##name \
64337+ static const struct kparam_string __param_string_##name __used \
64338 = { len, string }; \
64339 __module_param_call(MODULE_PARAM_PREFIX, name, \
64340 &param_ops_string, \
64341@@ -285,48 +285,48 @@ static inline void destroy_params(const
64342 #define __param_check(name, p, type) \
64343 static inline type *__check_##name(void) { return(p); }
64344
64345-extern struct kernel_param_ops param_ops_byte;
64346+extern const struct kernel_param_ops param_ops_byte;
64347 extern int param_set_byte(const char *val, const struct kernel_param *kp);
64348 extern int param_get_byte(char *buffer, const struct kernel_param *kp);
64349 #define param_check_byte(name, p) __param_check(name, p, unsigned char)
64350
64351-extern struct kernel_param_ops param_ops_short;
64352+extern const struct kernel_param_ops param_ops_short;
64353 extern int param_set_short(const char *val, const struct kernel_param *kp);
64354 extern int param_get_short(char *buffer, const struct kernel_param *kp);
64355 #define param_check_short(name, p) __param_check(name, p, short)
64356
64357-extern struct kernel_param_ops param_ops_ushort;
64358+extern const struct kernel_param_ops param_ops_ushort;
64359 extern int param_set_ushort(const char *val, const struct kernel_param *kp);
64360 extern int param_get_ushort(char *buffer, const struct kernel_param *kp);
64361 #define param_check_ushort(name, p) __param_check(name, p, unsigned short)
64362
64363-extern struct kernel_param_ops param_ops_int;
64364+extern const struct kernel_param_ops param_ops_int;
64365 extern int param_set_int(const char *val, const struct kernel_param *kp);
64366 extern int param_get_int(char *buffer, const struct kernel_param *kp);
64367 #define param_check_int(name, p) __param_check(name, p, int)
64368
64369-extern struct kernel_param_ops param_ops_uint;
64370+extern const struct kernel_param_ops param_ops_uint;
64371 extern int param_set_uint(const char *val, const struct kernel_param *kp);
64372 extern int param_get_uint(char *buffer, const struct kernel_param *kp);
64373 #define param_check_uint(name, p) __param_check(name, p, unsigned int)
64374
64375-extern struct kernel_param_ops param_ops_long;
64376+extern const struct kernel_param_ops param_ops_long;
64377 extern int param_set_long(const char *val, const struct kernel_param *kp);
64378 extern int param_get_long(char *buffer, const struct kernel_param *kp);
64379 #define param_check_long(name, p) __param_check(name, p, long)
64380
64381-extern struct kernel_param_ops param_ops_ulong;
64382+extern const struct kernel_param_ops param_ops_ulong;
64383 extern int param_set_ulong(const char *val, const struct kernel_param *kp);
64384 extern int param_get_ulong(char *buffer, const struct kernel_param *kp);
64385 #define param_check_ulong(name, p) __param_check(name, p, unsigned long)
64386
64387-extern struct kernel_param_ops param_ops_charp;
64388+extern const struct kernel_param_ops param_ops_charp;
64389 extern int param_set_charp(const char *val, const struct kernel_param *kp);
64390 extern int param_get_charp(char *buffer, const struct kernel_param *kp);
64391 #define param_check_charp(name, p) __param_check(name, p, char *)
64392
64393 /* For historical reasons "bool" parameters can be (unsigned) "int". */
64394-extern struct kernel_param_ops param_ops_bool;
64395+extern const struct kernel_param_ops param_ops_bool;
64396 extern int param_set_bool(const char *val, const struct kernel_param *kp);
64397 extern int param_get_bool(char *buffer, const struct kernel_param *kp);
64398 #define param_check_bool(name, p) \
64399@@ -337,7 +337,7 @@ extern int param_get_bool(char *buffer,
64400 !__same_type((p), int *)); \
64401 }
64402
64403-extern struct kernel_param_ops param_ops_invbool;
64404+extern const struct kernel_param_ops param_ops_invbool;
64405 extern int param_set_invbool(const char *val, const struct kernel_param *kp);
64406 extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
64407 #define param_check_invbool(name, p) __param_check(name, p, bool)
64408@@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe
64409 * module_param_named() for why this might be necessary.
64410 */
64411 #define module_param_array_named(name, array, type, nump, perm) \
64412- static const struct kparam_array __param_arr_##name \
64413+ static const struct kparam_array __param_arr_##name __used \
64414 = { ARRAY_SIZE(array), nump, &param_ops_##type, \
64415 sizeof(array[0]), array }; \
64416 __module_param_call(MODULE_PARAM_PREFIX, name, \
64417@@ -379,9 +379,9 @@ extern int param_get_invbool(char *buffe
64418 __same_type(array[0], bool), perm); \
64419 __MODULE_PARM_TYPE(name, "array of " #type)
64420
64421-extern struct kernel_param_ops param_array_ops;
64422+extern const struct kernel_param_ops param_array_ops;
64423
64424-extern struct kernel_param_ops param_ops_string;
64425+extern const struct kernel_param_ops param_ops_string;
64426 extern int param_set_copystring(const char *val, const struct kernel_param *);
64427 extern int param_get_string(char *buffer, const struct kernel_param *kp);
64428
64429diff -urNp linux-2.6.39.2/include/linux/mutex.h linux-2.6.39.2/include/linux/mutex.h
64430--- linux-2.6.39.2/include/linux/mutex.h 2011-05-19 00:06:34.000000000 -0400
64431+++ linux-2.6.39.2/include/linux/mutex.h 2011-05-22 19:36:33.000000000 -0400
64432@@ -51,7 +51,7 @@ struct mutex {
64433 spinlock_t wait_lock;
64434 struct list_head wait_list;
64435 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
64436- struct thread_info *owner;
64437+ struct task_struct *owner;
64438 #endif
64439 #ifdef CONFIG_DEBUG_MUTEXES
64440 const char *name;
64441diff -urNp linux-2.6.39.2/include/linux/namei.h linux-2.6.39.2/include/linux/namei.h
64442--- linux-2.6.39.2/include/linux/namei.h 2011-05-19 00:06:34.000000000 -0400
64443+++ linux-2.6.39.2/include/linux/namei.h 2011-05-22 19:36:33.000000000 -0400
64444@@ -24,7 +24,7 @@ struct nameidata {
64445 unsigned seq;
64446 int last_type;
64447 unsigned depth;
64448- char *saved_names[MAX_NESTED_LINKS + 1];
64449+ const char *saved_names[MAX_NESTED_LINKS + 1];
64450
64451 /* Intent data */
64452 union {
64453@@ -91,12 +91,12 @@ extern int follow_up(struct path *);
64454 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
64455 extern void unlock_rename(struct dentry *, struct dentry *);
64456
64457-static inline void nd_set_link(struct nameidata *nd, char *path)
64458+static inline void nd_set_link(struct nameidata *nd, const char *path)
64459 {
64460 nd->saved_names[nd->depth] = path;
64461 }
64462
64463-static inline char *nd_get_link(struct nameidata *nd)
64464+static inline const char *nd_get_link(const struct nameidata *nd)
64465 {
64466 return nd->saved_names[nd->depth];
64467 }
64468diff -urNp linux-2.6.39.2/include/linux/netfilter/xt_gradm.h linux-2.6.39.2/include/linux/netfilter/xt_gradm.h
64469--- linux-2.6.39.2/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
64470+++ linux-2.6.39.2/include/linux/netfilter/xt_gradm.h 2011-05-22 19:41:42.000000000 -0400
64471@@ -0,0 +1,9 @@
64472+#ifndef _LINUX_NETFILTER_XT_GRADM_H
64473+#define _LINUX_NETFILTER_XT_GRADM_H 1
64474+
64475+struct xt_gradm_mtinfo {
64476+ __u16 flags;
64477+ __u16 invflags;
64478+};
64479+
64480+#endif
64481diff -urNp linux-2.6.39.2/include/linux/oprofile.h linux-2.6.39.2/include/linux/oprofile.h
64482--- linux-2.6.39.2/include/linux/oprofile.h 2011-05-19 00:06:34.000000000 -0400
64483+++ linux-2.6.39.2/include/linux/oprofile.h 2011-05-22 19:36:33.000000000 -0400
64484@@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super
64485 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
64486 char const * name, ulong * val);
64487
64488-/** Create a file for read-only access to an atomic_t. */
64489+/** Create a file for read-only access to an atomic_unchecked_t. */
64490 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
64491- char const * name, atomic_t * val);
64492+ char const * name, atomic_unchecked_t * val);
64493
64494 /** create a directory */
64495 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
64496diff -urNp linux-2.6.39.2/include/linux/padata.h linux-2.6.39.2/include/linux/padata.h
64497--- linux-2.6.39.2/include/linux/padata.h 2011-05-19 00:06:34.000000000 -0400
64498+++ linux-2.6.39.2/include/linux/padata.h 2011-05-22 19:36:33.000000000 -0400
64499@@ -129,7 +129,7 @@ struct parallel_data {
64500 struct padata_instance *pinst;
64501 struct padata_parallel_queue __percpu *pqueue;
64502 struct padata_serial_queue __percpu *squeue;
64503- atomic_t seq_nr;
64504+ atomic_unchecked_t seq_nr;
64505 atomic_t reorder_objects;
64506 atomic_t refcnt;
64507 unsigned int max_seq_nr;
64508diff -urNp linux-2.6.39.2/include/linux/pci.h linux-2.6.39.2/include/linux/pci.h
64509--- linux-2.6.39.2/include/linux/pci.h 2011-05-19 00:06:34.000000000 -0400
64510+++ linux-2.6.39.2/include/linux/pci.h 2011-05-22 19:36:33.000000000 -0400
64511@@ -411,7 +411,7 @@ struct pci_bus {
64512 struct resource *resource[PCI_BRIDGE_RESOURCE_NUM];
64513 struct list_head resources; /* address space routed to this bus */
64514
64515- struct pci_ops *ops; /* configuration access functions */
64516+ const struct pci_ops *ops; /* configuration access functions */
64517 void *sysdata; /* hook for sys-specific extension */
64518 struct proc_dir_entry *procdir; /* directory entry in /proc/bus/pci */
64519
64520@@ -550,7 +550,7 @@ struct pci_driver {
64521 int (*resume_early) (struct pci_dev *dev);
64522 int (*resume) (struct pci_dev *dev); /* Device woken up */
64523 void (*shutdown) (struct pci_dev *dev);
64524- struct pci_error_handlers *err_handler;
64525+ const struct pci_error_handlers *err_handler;
64526 struct device_driver driver;
64527 struct pci_dynids dynids;
64528 };
64529@@ -639,7 +639,7 @@ void pcibios_scan_specific_bus(int busn)
64530 extern struct pci_bus *pci_find_bus(int domain, int busnr);
64531 void pci_bus_add_devices(const struct pci_bus *bus);
64532 struct pci_bus *pci_scan_bus_parented(struct device *parent, int bus,
64533- struct pci_ops *ops, void *sysdata);
64534+ const struct pci_ops *ops, void *sysdata);
64535 static inline struct pci_bus * __devinit pci_scan_bus(int bus, struct pci_ops *ops,
64536 void *sysdata)
64537 {
64538@@ -650,7 +650,7 @@ static inline struct pci_bus * __devinit
64539 return root_bus;
64540 }
64541 struct pci_bus *pci_create_bus(struct device *parent, int bus,
64542- struct pci_ops *ops, void *sysdata);
64543+ const struct pci_ops *ops, void *sysdata);
64544 struct pci_bus *pci_add_new_bus(struct pci_bus *parent, struct pci_dev *dev,
64545 int busnr);
64546 void pcie_update_link_speed(struct pci_bus *bus, u16 link_status);
64547@@ -727,7 +727,7 @@ int pci_bus_write_config_word(struct pci
64548 int where, u16 val);
64549 int pci_bus_write_config_dword(struct pci_bus *bus, unsigned int devfn,
64550 int where, u32 val);
64551-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops);
64552+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops);
64553
64554 static inline int pci_read_config_byte(struct pci_dev *dev, int where, u8 *val)
64555 {
64556diff -urNp linux-2.6.39.2/include/linux/perf_event.h linux-2.6.39.2/include/linux/perf_event.h
64557--- linux-2.6.39.2/include/linux/perf_event.h 2011-05-19 00:06:34.000000000 -0400
64558+++ linux-2.6.39.2/include/linux/perf_event.h 2011-05-22 19:36:33.000000000 -0400
64559@@ -759,8 +759,8 @@ struct perf_event {
64560
64561 enum perf_event_active_state state;
64562 unsigned int attach_state;
64563- local64_t count;
64564- atomic64_t child_count;
64565+ local64_t count; /* PaX: fix it one day */
64566+ atomic64_unchecked_t child_count;
64567
64568 /*
64569 * These are the total time in nanoseconds that the event
64570@@ -811,8 +811,8 @@ struct perf_event {
64571 * These accumulate total time (in nanoseconds) that children
64572 * events have been enabled and running, respectively.
64573 */
64574- atomic64_t child_total_time_enabled;
64575- atomic64_t child_total_time_running;
64576+ atomic64_unchecked_t child_total_time_enabled;
64577+ atomic64_unchecked_t child_total_time_running;
64578
64579 /*
64580 * Protect attach/detach and child_list:
64581@@ -1090,9 +1090,9 @@ void perf_event_task_sched_out(struct ta
64582 }
64583
64584 extern void perf_event_mmap(struct vm_area_struct *vma);
64585-extern struct perf_guest_info_callbacks *perf_guest_cbs;
64586-extern int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64587-extern int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64588+extern const struct perf_guest_info_callbacks *perf_guest_cbs;
64589+extern int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64590+extern int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64591
64592 extern void perf_event_comm(struct task_struct *tsk);
64593 extern void perf_event_fork(struct task_struct *tsk);
64594diff -urNp linux-2.6.39.2/include/linux/pipe_fs_i.h linux-2.6.39.2/include/linux/pipe_fs_i.h
64595--- linux-2.6.39.2/include/linux/pipe_fs_i.h 2011-05-19 00:06:34.000000000 -0400
64596+++ linux-2.6.39.2/include/linux/pipe_fs_i.h 2011-05-22 19:36:33.000000000 -0400
64597@@ -46,9 +46,9 @@ struct pipe_buffer {
64598 struct pipe_inode_info {
64599 wait_queue_head_t wait;
64600 unsigned int nrbufs, curbuf, buffers;
64601- unsigned int readers;
64602- unsigned int writers;
64603- unsigned int waiting_writers;
64604+ atomic_t readers;
64605+ atomic_t writers;
64606+ atomic_t waiting_writers;
64607 unsigned int r_counter;
64608 unsigned int w_counter;
64609 struct page *tmp_page;
64610diff -urNp linux-2.6.39.2/include/linux/pm.h linux-2.6.39.2/include/linux/pm.h
64611--- linux-2.6.39.2/include/linux/pm.h 2011-05-19 00:06:34.000000000 -0400
64612+++ linux-2.6.39.2/include/linux/pm.h 2011-05-22 19:36:33.000000000 -0400
64613@@ -268,7 +268,7 @@ const struct dev_pm_ops name = { \
64614 * runtime PM, make the pm member point to generic_subsys_pm_ops.
64615 */
64616 #ifdef CONFIG_PM
64617-extern struct dev_pm_ops generic_subsys_pm_ops;
64618+extern const struct dev_pm_ops generic_subsys_pm_ops;
64619 #define GENERIC_SUBSYS_PM_OPS (&generic_subsys_pm_ops)
64620 #else
64621 #define GENERIC_SUBSYS_PM_OPS NULL
64622@@ -471,7 +471,7 @@ extern void update_pm_runtime_accounting
64623 * subsystem-level and driver-level callbacks.
64624 */
64625 struct dev_power_domain {
64626- struct dev_pm_ops ops;
64627+ const struct dev_pm_ops ops;
64628 };
64629
64630 /*
64631diff -urNp linux-2.6.39.2/include/linux/pm_runtime.h linux-2.6.39.2/include/linux/pm_runtime.h
64632--- linux-2.6.39.2/include/linux/pm_runtime.h 2011-05-19 00:06:34.000000000 -0400
64633+++ linux-2.6.39.2/include/linux/pm_runtime.h 2011-05-22 19:36:33.000000000 -0400
64634@@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_
64635
64636 static inline void pm_runtime_mark_last_busy(struct device *dev)
64637 {
64638- ACCESS_ONCE(dev->power.last_busy) = jiffies;
64639+ ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
64640 }
64641
64642 #else /* !CONFIG_PM_RUNTIME */
64643diff -urNp linux-2.6.39.2/include/linux/poison.h linux-2.6.39.2/include/linux/poison.h
64644--- linux-2.6.39.2/include/linux/poison.h 2011-05-19 00:06:34.000000000 -0400
64645+++ linux-2.6.39.2/include/linux/poison.h 2011-05-22 19:36:33.000000000 -0400
64646@@ -19,8 +19,8 @@
64647 * under normal circumstances, used to verify that nobody uses
64648 * non-initialized list entries.
64649 */
64650-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
64651-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
64652+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
64653+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
64654
64655 /********** include/linux/timer.h **********/
64656 /*
64657diff -urNp linux-2.6.39.2/include/linux/posix-timers.h linux-2.6.39.2/include/linux/posix-timers.h
64658--- linux-2.6.39.2/include/linux/posix-timers.h 2011-05-19 00:06:34.000000000 -0400
64659+++ linux-2.6.39.2/include/linux/posix-timers.h 2011-05-22 19:36:33.000000000 -0400
64660@@ -102,10 +102,10 @@ struct k_clock {
64661 struct itimerspec * cur_setting);
64662 };
64663
64664-extern struct k_clock clock_posix_cpu;
64665-extern struct k_clock clock_posix_dynamic;
64666+extern const struct k_clock clock_posix_cpu;
64667+extern const struct k_clock clock_posix_dynamic;
64668
64669-void posix_timers_register_clock(const clockid_t clock_id, struct k_clock *new_clock);
64670+void posix_timers_register_clock(const clockid_t clock_id, const struct k_clock *new_clock);
64671
64672 /* function to call to trigger timer event */
64673 int posix_timer_event(struct k_itimer *timr, int si_private);
64674diff -urNp linux-2.6.39.2/include/linux/proc_fs.h linux-2.6.39.2/include/linux/proc_fs.h
64675--- linux-2.6.39.2/include/linux/proc_fs.h 2011-05-19 00:06:34.000000000 -0400
64676+++ linux-2.6.39.2/include/linux/proc_fs.h 2011-05-22 19:41:42.000000000 -0400
64677@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
64678 return proc_create_data(name, mode, parent, proc_fops, NULL);
64679 }
64680
64681+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
64682+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
64683+{
64684+#ifdef CONFIG_GRKERNSEC_PROC_USER
64685+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
64686+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64687+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
64688+#else
64689+ return proc_create_data(name, mode, parent, proc_fops, NULL);
64690+#endif
64691+}
64692+
64693+
64694 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
64695 mode_t mode, struct proc_dir_entry *base,
64696 read_proc_t *read_proc, void * data)
64697diff -urNp linux-2.6.39.2/include/linux/ptrace.h linux-2.6.39.2/include/linux/ptrace.h
64698--- linux-2.6.39.2/include/linux/ptrace.h 2011-05-19 00:06:34.000000000 -0400
64699+++ linux-2.6.39.2/include/linux/ptrace.h 2011-05-22 19:41:42.000000000 -0400
64700@@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
64701 extern void exit_ptrace(struct task_struct *tracer);
64702 #define PTRACE_MODE_READ 1
64703 #define PTRACE_MODE_ATTACH 2
64704-/* Returns 0 on success, -errno on denial. */
64705-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
64706 /* Returns true on success, false on denial. */
64707 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
64708+/* Returns true on success, false on denial. */
64709+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
64710
64711 static inline int ptrace_reparented(struct task_struct *child)
64712 {
64713diff -urNp linux-2.6.39.2/include/linux/random.h linux-2.6.39.2/include/linux/random.h
64714--- linux-2.6.39.2/include/linux/random.h 2011-05-19 00:06:34.000000000 -0400
64715+++ linux-2.6.39.2/include/linux/random.h 2011-05-22 19:36:33.000000000 -0400
64716@@ -80,12 +80,17 @@ void srandom32(u32 seed);
64717
64718 u32 prandom32(struct rnd_state *);
64719
64720+static inline unsigned long pax_get_random_long(void)
64721+{
64722+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
64723+}
64724+
64725 /*
64726 * Handle minimum values for seeds
64727 */
64728 static inline u32 __seed(u32 x, u32 m)
64729 {
64730- return (x < m) ? x + m : x;
64731+ return (x <= m) ? x + m + 1 : x;
64732 }
64733
64734 /**
64735diff -urNp linux-2.6.39.2/include/linux/reboot.h linux-2.6.39.2/include/linux/reboot.h
64736--- linux-2.6.39.2/include/linux/reboot.h 2011-05-19 00:06:34.000000000 -0400
64737+++ linux-2.6.39.2/include/linux/reboot.h 2011-05-22 19:36:33.000000000 -0400
64738@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
64739 * Architecture-specific implementations of sys_reboot commands.
64740 */
64741
64742-extern void machine_restart(char *cmd);
64743-extern void machine_halt(void);
64744-extern void machine_power_off(void);
64745+extern void machine_restart(char *cmd) __noreturn;
64746+extern void machine_halt(void) __noreturn;
64747+extern void machine_power_off(void) __noreturn;
64748
64749 extern void machine_shutdown(void);
64750 struct pt_regs;
64751@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
64752 */
64753
64754 extern void kernel_restart_prepare(char *cmd);
64755-extern void kernel_restart(char *cmd);
64756-extern void kernel_halt(void);
64757-extern void kernel_power_off(void);
64758+extern void kernel_restart(char *cmd) __noreturn;
64759+extern void kernel_halt(void) __noreturn;
64760+extern void kernel_power_off(void) __noreturn;
64761
64762 extern int C_A_D; /* for sysctl */
64763 void ctrl_alt_del(void);
64764@@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
64765 * Emergency restart, callable from an interrupt handler.
64766 */
64767
64768-extern void emergency_restart(void);
64769+extern void emergency_restart(void) __noreturn;
64770 #include <asm/emergency-restart.h>
64771
64772 #endif
64773diff -urNp linux-2.6.39.2/include/linux/reiserfs_fs.h linux-2.6.39.2/include/linux/reiserfs_fs.h
64774--- linux-2.6.39.2/include/linux/reiserfs_fs.h 2011-05-19 00:06:34.000000000 -0400
64775+++ linux-2.6.39.2/include/linux/reiserfs_fs.h 2011-05-22 19:36:33.000000000 -0400
64776@@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset
64777 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
64778
64779 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
64780-#define get_generation(s) atomic_read (&fs_generation(s))
64781+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
64782 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
64783 #define __fs_changed(gen,s) (gen != get_generation (s))
64784 #define fs_changed(gen,s) \
64785@@ -1618,24 +1618,24 @@ static inline struct super_block *sb_fro
64786 */
64787
64788 struct item_operations {
64789- int (*bytes_number) (struct item_head * ih, int block_size);
64790- void (*decrement_key) (struct cpu_key *);
64791- int (*is_left_mergeable) (struct reiserfs_key * ih,
64792+ int (* const bytes_number) (struct item_head * ih, int block_size);
64793+ void (* const decrement_key) (struct cpu_key *);
64794+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
64795 unsigned long bsize);
64796- void (*print_item) (struct item_head *, char *item);
64797- void (*check_item) (struct item_head *, char *item);
64798+ void (* const print_item) (struct item_head *, char *item);
64799+ void (* const check_item) (struct item_head *, char *item);
64800
64801- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64802+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64803 int is_affected, int insert_size);
64804- int (*check_left) (struct virtual_item * vi, int free,
64805+ int (* const check_left) (struct virtual_item * vi, int free,
64806 int start_skip, int end_skip);
64807- int (*check_right) (struct virtual_item * vi, int free);
64808- int (*part_size) (struct virtual_item * vi, int from, int to);
64809- int (*unit_num) (struct virtual_item * vi);
64810- void (*print_vi) (struct virtual_item * vi);
64811+ int (* const check_right) (struct virtual_item * vi, int free);
64812+ int (* const part_size) (struct virtual_item * vi, int from, int to);
64813+ int (* const unit_num) (struct virtual_item * vi);
64814+ void (* const print_vi) (struct virtual_item * vi);
64815 };
64816
64817-extern struct item_operations *item_ops[TYPE_ANY + 1];
64818+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
64819
64820 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
64821 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
64822diff -urNp linux-2.6.39.2/include/linux/reiserfs_fs_sb.h linux-2.6.39.2/include/linux/reiserfs_fs_sb.h
64823--- linux-2.6.39.2/include/linux/reiserfs_fs_sb.h 2011-05-19 00:06:34.000000000 -0400
64824+++ linux-2.6.39.2/include/linux/reiserfs_fs_sb.h 2011-05-22 19:36:33.000000000 -0400
64825@@ -386,7 +386,7 @@ struct reiserfs_sb_info {
64826 /* Comment? -Hans */
64827 wait_queue_head_t s_wait;
64828 /* To be obsoleted soon by per buffer seals.. -Hans */
64829- atomic_t s_generation_counter; // increased by one every time the
64830+ atomic_unchecked_t s_generation_counter; // increased by one every time the
64831 // tree gets re-balanced
64832 unsigned long s_properties; /* File system properties. Currently holds
64833 on-disk FS format */
64834diff -urNp linux-2.6.39.2/include/linux/rmap.h linux-2.6.39.2/include/linux/rmap.h
64835--- linux-2.6.39.2/include/linux/rmap.h 2011-05-19 00:06:34.000000000 -0400
64836+++ linux-2.6.39.2/include/linux/rmap.h 2011-05-22 19:36:33.000000000 -0400
64837@@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc
64838 void anon_vma_init(void); /* create anon_vma_cachep */
64839 int anon_vma_prepare(struct vm_area_struct *);
64840 void unlink_anon_vmas(struct vm_area_struct *);
64841-int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
64842-int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
64843+int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
64844+int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
64845 void __anon_vma_link(struct vm_area_struct *);
64846
64847 static inline void anon_vma_merge(struct vm_area_struct *vma,
64848diff -urNp linux-2.6.39.2/include/linux/sched.h linux-2.6.39.2/include/linux/sched.h
64849--- linux-2.6.39.2/include/linux/sched.h 2011-05-19 00:06:34.000000000 -0400
64850+++ linux-2.6.39.2/include/linux/sched.h 2011-06-03 23:34:26.000000000 -0400
64851@@ -100,6 +100,7 @@ struct bio_list;
64852 struct fs_struct;
64853 struct perf_event_context;
64854 struct blk_plug;
64855+struct linux_binprm;
64856
64857 /*
64858 * List of flags we want to share for kernel threads,
64859@@ -360,7 +361,7 @@ extern signed long schedule_timeout_inte
64860 extern signed long schedule_timeout_killable(signed long timeout);
64861 extern signed long schedule_timeout_uninterruptible(signed long timeout);
64862 asmlinkage void schedule(void);
64863-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
64864+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
64865
64866 struct nsproxy;
64867 struct user_namespace;
64868@@ -381,10 +382,13 @@ struct user_namespace;
64869 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
64870
64871 extern int sysctl_max_map_count;
64872+extern unsigned long sysctl_heap_stack_gap;
64873
64874 #include <linux/aio.h>
64875
64876 #ifdef CONFIG_MMU
64877+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
64878+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
64879 extern void arch_pick_mmap_layout(struct mm_struct *mm);
64880 extern unsigned long
64881 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
64882@@ -629,6 +633,17 @@ struct signal_struct {
64883 #ifdef CONFIG_TASKSTATS
64884 struct taskstats *stats;
64885 #endif
64886+
64887+#ifdef CONFIG_GRKERNSEC
64888+ u32 curr_ip;
64889+ u32 saved_ip;
64890+ u32 gr_saddr;
64891+ u32 gr_daddr;
64892+ u16 gr_sport;
64893+ u16 gr_dport;
64894+ u8 used_accept:1;
64895+#endif
64896+
64897 #ifdef CONFIG_AUDIT
64898 unsigned audit_tty;
64899 struct tty_audit_buf *tty_audit_buf;
64900@@ -701,6 +716,11 @@ struct user_struct {
64901 struct key *session_keyring; /* UID's default session keyring */
64902 #endif
64903
64904+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
64905+ unsigned int banned;
64906+ unsigned long ban_expires;
64907+#endif
64908+
64909 /* Hash table maintenance information */
64910 struct hlist_node uidhash_node;
64911 uid_t uid;
64912@@ -1310,8 +1330,8 @@ struct task_struct {
64913 struct list_head thread_group;
64914
64915 struct completion *vfork_done; /* for vfork() */
64916- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
64917- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64918+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
64919+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64920
64921 cputime_t utime, stime, utimescaled, stimescaled;
64922 cputime_t gtime;
64923@@ -1327,13 +1347,6 @@ struct task_struct {
64924 struct task_cputime cputime_expires;
64925 struct list_head cpu_timers[3];
64926
64927-/* process credentials */
64928- const struct cred __rcu *real_cred; /* objective and real subjective task
64929- * credentials (COW) */
64930- const struct cred __rcu *cred; /* effective (overridable) subjective task
64931- * credentials (COW) */
64932- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64933-
64934 char comm[TASK_COMM_LEN]; /* executable name excluding path
64935 - access with [gs]et_task_comm (which lock
64936 it with task_lock())
64937@@ -1350,8 +1363,16 @@ struct task_struct {
64938 #endif
64939 /* CPU-specific state of this task */
64940 struct thread_struct thread;
64941+/* thread_info moved to task_struct */
64942+#ifdef CONFIG_X86
64943+ struct thread_info tinfo;
64944+#endif
64945 /* filesystem information */
64946 struct fs_struct *fs;
64947+
64948+ const struct cred __rcu *cred; /* effective (overridable) subjective task
64949+ * credentials (COW) */
64950+
64951 /* open file information */
64952 struct files_struct *files;
64953 /* namespaces */
64954@@ -1398,6 +1419,11 @@ struct task_struct {
64955 struct rt_mutex_waiter *pi_blocked_on;
64956 #endif
64957
64958+/* process credentials */
64959+ const struct cred __rcu *real_cred; /* objective and real subjective task
64960+ * credentials (COW) */
64961+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64962+
64963 #ifdef CONFIG_DEBUG_MUTEXES
64964 /* mutex deadlock detection */
64965 struct mutex_waiter *blocked_on;
64966@@ -1508,6 +1534,21 @@ struct task_struct {
64967 unsigned long default_timer_slack_ns;
64968
64969 struct list_head *scm_work_list;
64970+
64971+#ifdef CONFIG_GRKERNSEC
64972+ /* grsecurity */
64973+ struct dentry *gr_chroot_dentry;
64974+ struct acl_subject_label *acl;
64975+ struct acl_role_label *role;
64976+ struct file *exec_file;
64977+ u16 acl_role_id;
64978+ /* is this the task that authenticated to the special role */
64979+ u8 acl_sp_role;
64980+ u8 is_writable;
64981+ u8 brute;
64982+ u8 gr_is_chrooted;
64983+#endif
64984+
64985 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
64986 /* Index of current stored address in ret_stack */
64987 int curr_ret_stack;
64988@@ -1542,6 +1583,57 @@ struct task_struct {
64989 #endif
64990 };
64991
64992+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
64993+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
64994+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
64995+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
64996+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
64997+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
64998+
64999+#ifdef CONFIG_PAX_SOFTMODE
65000+extern unsigned int pax_softmode;
65001+#endif
65002+
65003+extern int pax_check_flags(unsigned long *);
65004+
65005+/* if tsk != current then task_lock must be held on it */
65006+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
65007+static inline unsigned long pax_get_flags(struct task_struct *tsk)
65008+{
65009+ if (likely(tsk->mm))
65010+ return tsk->mm->pax_flags;
65011+ else
65012+ return 0UL;
65013+}
65014+
65015+/* if tsk != current then task_lock must be held on it */
65016+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
65017+{
65018+ if (likely(tsk->mm)) {
65019+ tsk->mm->pax_flags = flags;
65020+ return 0;
65021+ }
65022+ return -EINVAL;
65023+}
65024+#endif
65025+
65026+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
65027+extern void pax_set_initial_flags(struct linux_binprm *bprm);
65028+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
65029+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
65030+#endif
65031+
65032+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
65033+void pax_report_insns(void *pc, void *sp);
65034+void pax_report_refcount_overflow(struct pt_regs *regs);
65035+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
65036+
65037+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
65038+extern void pax_track_stack(void);
65039+#else
65040+static inline void pax_track_stack(void) {}
65041+#endif
65042+
65043 /* Future-safe accessor for struct task_struct's cpus_allowed. */
65044 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
65045
65046@@ -2009,7 +2101,9 @@ void yield(void);
65047 extern struct exec_domain default_exec_domain;
65048
65049 union thread_union {
65050+#ifndef CONFIG_X86
65051 struct thread_info thread_info;
65052+#endif
65053 unsigned long stack[THREAD_SIZE/sizeof(long)];
65054 };
65055
65056@@ -2179,7 +2273,7 @@ extern void __cleanup_sighand(struct sig
65057 extern void exit_itimers(struct signal_struct *);
65058 extern void flush_itimer_signals(void);
65059
65060-extern NORET_TYPE void do_group_exit(int);
65061+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
65062
65063 extern void daemonize(const char *, ...);
65064 extern int allow_signal(int);
65065@@ -2320,13 +2414,17 @@ static inline unsigned long *end_of_stac
65066
65067 #endif
65068
65069-static inline int object_is_on_stack(void *obj)
65070+static inline int object_starts_on_stack(void *obj)
65071 {
65072- void *stack = task_stack_page(current);
65073+ const void *stack = task_stack_page(current);
65074
65075 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
65076 }
65077
65078+#ifdef CONFIG_PAX_USERCOPY
65079+extern int object_is_on_stack(const void *obj, unsigned long len);
65080+#endif
65081+
65082 extern void thread_info_cache_init(void);
65083
65084 #ifdef CONFIG_DEBUG_STACK_USAGE
65085diff -urNp linux-2.6.39.2/include/linux/screen_info.h linux-2.6.39.2/include/linux/screen_info.h
65086--- linux-2.6.39.2/include/linux/screen_info.h 2011-05-19 00:06:34.000000000 -0400
65087+++ linux-2.6.39.2/include/linux/screen_info.h 2011-05-22 19:36:33.000000000 -0400
65088@@ -43,7 +43,8 @@ struct screen_info {
65089 __u16 pages; /* 0x32 */
65090 __u16 vesa_attributes; /* 0x34 */
65091 __u32 capabilities; /* 0x36 */
65092- __u8 _reserved[6]; /* 0x3a */
65093+ __u16 vesapm_size; /* 0x3a */
65094+ __u8 _reserved[4]; /* 0x3c */
65095 } __attribute__((packed));
65096
65097 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
65098diff -urNp linux-2.6.39.2/include/linux/security.h linux-2.6.39.2/include/linux/security.h
65099--- linux-2.6.39.2/include/linux/security.h 2011-05-19 00:06:34.000000000 -0400
65100+++ linux-2.6.39.2/include/linux/security.h 2011-05-22 19:41:42.000000000 -0400
65101@@ -36,6 +36,7 @@
65102 #include <linux/key.h>
65103 #include <linux/xfrm.h>
65104 #include <linux/slab.h>
65105+#include <linux/grsecurity.h>
65106 #include <net/flow.h>
65107
65108 /* Maximum number of letters for an LSM name string */
65109diff -urNp linux-2.6.39.2/include/linux/shm.h linux-2.6.39.2/include/linux/shm.h
65110--- linux-2.6.39.2/include/linux/shm.h 2011-05-19 00:06:34.000000000 -0400
65111+++ linux-2.6.39.2/include/linux/shm.h 2011-05-22 19:41:42.000000000 -0400
65112@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
65113 pid_t shm_cprid;
65114 pid_t shm_lprid;
65115 struct user_struct *mlock_user;
65116+#ifdef CONFIG_GRKERNSEC
65117+ time_t shm_createtime;
65118+ pid_t shm_lapid;
65119+#endif
65120 };
65121
65122 /* shm_mode upper byte flags */
65123diff -urNp linux-2.6.39.2/include/linux/skbuff.h linux-2.6.39.2/include/linux/skbuff.h
65124--- linux-2.6.39.2/include/linux/skbuff.h 2011-05-19 00:06:34.000000000 -0400
65125+++ linux-2.6.39.2/include/linux/skbuff.h 2011-05-22 19:36:33.000000000 -0400
65126@@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp
65127 */
65128 static inline int skb_queue_empty(const struct sk_buff_head *list)
65129 {
65130- return list->next == (struct sk_buff *)list;
65131+ return list->next == (const struct sk_buff *)list;
65132 }
65133
65134 /**
65135@@ -605,7 +605,7 @@ static inline int skb_queue_empty(const
65136 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
65137 const struct sk_buff *skb)
65138 {
65139- return skb->next == (struct sk_buff *)list;
65140+ return skb->next == (const struct sk_buff *)list;
65141 }
65142
65143 /**
65144@@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con
65145 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
65146 const struct sk_buff *skb)
65147 {
65148- return skb->prev == (struct sk_buff *)list;
65149+ return skb->prev == (const struct sk_buff *)list;
65150 }
65151
65152 /**
65153@@ -1435,7 +1435,7 @@ static inline int pskb_network_may_pull(
65154 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
65155 */
65156 #ifndef NET_SKB_PAD
65157-#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
65158+#define NET_SKB_PAD max(_AC(32,U), L1_CACHE_BYTES)
65159 #endif
65160
65161 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
65162diff -urNp linux-2.6.39.2/include/linux/slab_def.h linux-2.6.39.2/include/linux/slab_def.h
65163--- linux-2.6.39.2/include/linux/slab_def.h 2011-05-19 00:06:34.000000000 -0400
65164+++ linux-2.6.39.2/include/linux/slab_def.h 2011-05-22 19:36:33.000000000 -0400
65165@@ -96,10 +96,10 @@ struct kmem_cache {
65166 unsigned long node_allocs;
65167 unsigned long node_frees;
65168 unsigned long node_overflow;
65169- atomic_t allochit;
65170- atomic_t allocmiss;
65171- atomic_t freehit;
65172- atomic_t freemiss;
65173+ atomic_unchecked_t allochit;
65174+ atomic_unchecked_t allocmiss;
65175+ atomic_unchecked_t freehit;
65176+ atomic_unchecked_t freemiss;
65177
65178 /*
65179 * If debugging is enabled, then the allocator can add additional
65180diff -urNp linux-2.6.39.2/include/linux/slab.h linux-2.6.39.2/include/linux/slab.h
65181--- linux-2.6.39.2/include/linux/slab.h 2011-05-19 00:06:34.000000000 -0400
65182+++ linux-2.6.39.2/include/linux/slab.h 2011-05-23 17:07:00.000000000 -0400
65183@@ -11,12 +11,20 @@
65184
65185 #include <linux/gfp.h>
65186 #include <linux/types.h>
65187+#include <linux/err.h>
65188
65189 /*
65190 * Flags to pass to kmem_cache_create().
65191 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
65192 */
65193 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
65194+
65195+#ifdef CONFIG_PAX_USERCOPY
65196+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
65197+#else
65198+#define SLAB_USERCOPY 0x00000000UL
65199+#endif
65200+
65201 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
65202 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
65203 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
65204@@ -87,10 +95,13 @@
65205 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
65206 * Both make kfree a no-op.
65207 */
65208-#define ZERO_SIZE_PTR ((void *)16)
65209+#define ZERO_SIZE_PTR \
65210+({ \
65211+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
65212+ (void *)(-MAX_ERRNO-1L); \
65213+})
65214
65215-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
65216- (unsigned long)ZERO_SIZE_PTR)
65217+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
65218
65219 /*
65220 * struct kmem_cache related prototypes
65221@@ -141,6 +152,7 @@ void * __must_check krealloc(const void
65222 void kfree(const void *);
65223 void kzfree(const void *);
65224 size_t ksize(const void *);
65225+void check_object_size(const void *ptr, unsigned long n, bool to);
65226
65227 /*
65228 * Allocator specific definitions. These are mainly used to establish optimized
65229@@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t
65230
65231 void __init kmem_cache_init_late(void);
65232
65233+#define kmalloc(x, y) \
65234+({ \
65235+ void *___retval; \
65236+ intoverflow_t ___x = (intoverflow_t)x; \
65237+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
65238+ ___retval = NULL; \
65239+ else \
65240+ ___retval = kmalloc((size_t)___x, (y)); \
65241+ ___retval; \
65242+})
65243+
65244+#define kmalloc_node(x, y, z) \
65245+({ \
65246+ void *___retval; \
65247+ intoverflow_t ___x = (intoverflow_t)x; \
65248+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
65249+ ___retval = NULL; \
65250+ else \
65251+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
65252+ ___retval; \
65253+})
65254+
65255+#define kzalloc(x, y) \
65256+({ \
65257+ void *___retval; \
65258+ intoverflow_t ___x = (intoverflow_t)x; \
65259+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
65260+ ___retval = NULL; \
65261+ else \
65262+ ___retval = kzalloc((size_t)___x, (y)); \
65263+ ___retval; \
65264+})
65265+
65266+#define __krealloc(x, y, z) \
65267+({ \
65268+ void *___retval; \
65269+ intoverflow_t ___y = (intoverflow_t)y; \
65270+ if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
65271+ ___retval = NULL; \
65272+ else \
65273+ ___retval = __krealloc((x), (size_t)___y, (z)); \
65274+ ___retval; \
65275+})
65276+
65277+#define krealloc(x, y, z) \
65278+({ \
65279+ void *___retval; \
65280+ intoverflow_t ___y = (intoverflow_t)y; \
65281+ if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
65282+ ___retval = NULL; \
65283+ else \
65284+ ___retval = krealloc((x), (size_t)___y, (z)); \
65285+ ___retval; \
65286+})
65287+
65288 #endif /* _LINUX_SLAB_H */
65289diff -urNp linux-2.6.39.2/include/linux/slub_def.h linux-2.6.39.2/include/linux/slub_def.h
65290--- linux-2.6.39.2/include/linux/slub_def.h 2011-05-19 00:06:34.000000000 -0400
65291+++ linux-2.6.39.2/include/linux/slub_def.h 2011-05-22 19:36:33.000000000 -0400
65292@@ -84,7 +84,7 @@ struct kmem_cache {
65293 struct kmem_cache_order_objects max;
65294 struct kmem_cache_order_objects min;
65295 gfp_t allocflags; /* gfp flags to use on each alloc */
65296- int refcount; /* Refcount for slab cache destroy */
65297+ atomic_t refcount; /* Refcount for slab cache destroy */
65298 void (*ctor)(void *);
65299 int inuse; /* Offset to metadata */
65300 int align; /* Alignment */
65301diff -urNp linux-2.6.39.2/include/linux/sonet.h linux-2.6.39.2/include/linux/sonet.h
65302--- linux-2.6.39.2/include/linux/sonet.h 2011-05-19 00:06:34.000000000 -0400
65303+++ linux-2.6.39.2/include/linux/sonet.h 2011-05-22 19:36:33.000000000 -0400
65304@@ -61,7 +61,7 @@ struct sonet_stats {
65305 #include <asm/atomic.h>
65306
65307 struct k_sonet_stats {
65308-#define __HANDLE_ITEM(i) atomic_t i
65309+#define __HANDLE_ITEM(i) atomic_unchecked_t i
65310 __SONET_ITEMS
65311 #undef __HANDLE_ITEM
65312 };
65313diff -urNp linux-2.6.39.2/include/linux/ssb/ssb_driver_gige.h linux-2.6.39.2/include/linux/ssb/ssb_driver_gige.h
65314--- linux-2.6.39.2/include/linux/ssb/ssb_driver_gige.h 2011-05-19 00:06:34.000000000 -0400
65315+++ linux-2.6.39.2/include/linux/ssb/ssb_driver_gige.h 2011-05-22 19:36:33.000000000 -0400
65316@@ -44,7 +44,7 @@ struct ssb_gige {
65317
65318 /* The PCI controller device. */
65319 struct pci_controller pci_controller;
65320- struct pci_ops pci_ops;
65321+ const struct pci_ops pci_ops;
65322 struct resource mem_resource;
65323 struct resource io_resource;
65324 };
65325diff -urNp linux-2.6.39.2/include/linux/sunrpc/clnt.h linux-2.6.39.2/include/linux/sunrpc/clnt.h
65326--- linux-2.6.39.2/include/linux/sunrpc/clnt.h 2011-05-19 00:06:34.000000000 -0400
65327+++ linux-2.6.39.2/include/linux/sunrpc/clnt.h 2011-05-22 19:36:33.000000000 -0400
65328@@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por
65329 {
65330 switch (sap->sa_family) {
65331 case AF_INET:
65332- return ntohs(((struct sockaddr_in *)sap)->sin_port);
65333+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
65334 case AF_INET6:
65335- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
65336+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
65337 }
65338 return 0;
65339 }
65340@@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const
65341 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
65342 const struct sockaddr *src)
65343 {
65344- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
65345+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
65346 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
65347
65348 dsin->sin_family = ssin->sin_family;
65349@@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const
65350 if (sa->sa_family != AF_INET6)
65351 return 0;
65352
65353- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
65354+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
65355 }
65356
65357 #endif /* __KERNEL__ */
65358diff -urNp linux-2.6.39.2/include/linux/sunrpc/svc_rdma.h linux-2.6.39.2/include/linux/sunrpc/svc_rdma.h
65359--- linux-2.6.39.2/include/linux/sunrpc/svc_rdma.h 2011-05-19 00:06:34.000000000 -0400
65360+++ linux-2.6.39.2/include/linux/sunrpc/svc_rdma.h 2011-05-22 19:36:33.000000000 -0400
65361@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
65362 extern unsigned int svcrdma_max_requests;
65363 extern unsigned int svcrdma_max_req_size;
65364
65365-extern atomic_t rdma_stat_recv;
65366-extern atomic_t rdma_stat_read;
65367-extern atomic_t rdma_stat_write;
65368-extern atomic_t rdma_stat_sq_starve;
65369-extern atomic_t rdma_stat_rq_starve;
65370-extern atomic_t rdma_stat_rq_poll;
65371-extern atomic_t rdma_stat_rq_prod;
65372-extern atomic_t rdma_stat_sq_poll;
65373-extern atomic_t rdma_stat_sq_prod;
65374+extern atomic_unchecked_t rdma_stat_recv;
65375+extern atomic_unchecked_t rdma_stat_read;
65376+extern atomic_unchecked_t rdma_stat_write;
65377+extern atomic_unchecked_t rdma_stat_sq_starve;
65378+extern atomic_unchecked_t rdma_stat_rq_starve;
65379+extern atomic_unchecked_t rdma_stat_rq_poll;
65380+extern atomic_unchecked_t rdma_stat_rq_prod;
65381+extern atomic_unchecked_t rdma_stat_sq_poll;
65382+extern atomic_unchecked_t rdma_stat_sq_prod;
65383
65384 #define RPCRDMA_VERSION 1
65385
65386diff -urNp linux-2.6.39.2/include/linux/suspend.h linux-2.6.39.2/include/linux/suspend.h
65387--- linux-2.6.39.2/include/linux/suspend.h 2011-05-19 00:06:34.000000000 -0400
65388+++ linux-2.6.39.2/include/linux/suspend.h 2011-05-22 19:36:33.000000000 -0400
65389@@ -106,15 +106,15 @@ typedef int __bitwise suspend_state_t;
65390 * which require special recovery actions in that situation.
65391 */
65392 struct platform_suspend_ops {
65393- int (*valid)(suspend_state_t state);
65394- int (*begin)(suspend_state_t state);
65395- int (*prepare)(void);
65396- int (*prepare_late)(void);
65397- int (*enter)(suspend_state_t state);
65398- void (*wake)(void);
65399- void (*finish)(void);
65400- void (*end)(void);
65401- void (*recover)(void);
65402+ int (* const valid)(suspend_state_t state);
65403+ int (* const begin)(suspend_state_t state);
65404+ int (* const prepare)(void);
65405+ int (* const prepare_late)(void);
65406+ int (* const enter)(suspend_state_t state);
65407+ void (* const wake)(void);
65408+ void (* const finish)(void);
65409+ void (* const end)(void);
65410+ void (* const recover)(void);
65411 };
65412
65413 #ifdef CONFIG_SUSPEND
65414@@ -217,16 +217,16 @@ extern void mark_free_pages(struct zone
65415 * platforms which require special recovery actions in that situation.
65416 */
65417 struct platform_hibernation_ops {
65418- int (*begin)(void);
65419- void (*end)(void);
65420- int (*pre_snapshot)(void);
65421- void (*finish)(void);
65422- int (*prepare)(void);
65423- int (*enter)(void);
65424- void (*leave)(void);
65425- int (*pre_restore)(void);
65426- void (*restore_cleanup)(void);
65427- void (*recover)(void);
65428+ int (* const begin)(void);
65429+ void (* const end)(void);
65430+ int (* const pre_snapshot)(void);
65431+ void (* const finish)(void);
65432+ int (* const prepare)(void);
65433+ int (* const enter)(void);
65434+ void (* const leave)(void);
65435+ int (* const pre_restore)(void);
65436+ void (* const restore_cleanup)(void);
65437+ void (* const recover)(void);
65438 };
65439
65440 #ifdef CONFIG_HIBERNATION
65441diff -urNp linux-2.6.39.2/include/linux/sysctl.h linux-2.6.39.2/include/linux/sysctl.h
65442--- linux-2.6.39.2/include/linux/sysctl.h 2011-05-19 00:06:34.000000000 -0400
65443+++ linux-2.6.39.2/include/linux/sysctl.h 2011-05-22 19:41:42.000000000 -0400
65444@@ -155,7 +155,11 @@ enum
65445 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
65446 };
65447
65448-
65449+#ifdef CONFIG_PAX_SOFTMODE
65450+enum {
65451+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
65452+};
65453+#endif
65454
65455 /* CTL_VM names: */
65456 enum
65457@@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab
65458
65459 extern int proc_dostring(struct ctl_table *, int,
65460 void __user *, size_t *, loff_t *);
65461+extern int proc_dostring_modpriv(struct ctl_table *, int,
65462+ void __user *, size_t *, loff_t *);
65463 extern int proc_dointvec(struct ctl_table *, int,
65464 void __user *, size_t *, loff_t *);
65465 extern int proc_dointvec_minmax(struct ctl_table *, int,
65466diff -urNp linux-2.6.39.2/include/linux/sysfs.h linux-2.6.39.2/include/linux/sysfs.h
65467--- linux-2.6.39.2/include/linux/sysfs.h 2011-05-19 00:06:34.000000000 -0400
65468+++ linux-2.6.39.2/include/linux/sysfs.h 2011-05-22 19:36:33.000000000 -0400
65469@@ -110,8 +110,8 @@ struct bin_attribute {
65470 #define sysfs_bin_attr_init(bin_attr) sysfs_attr_init(&(bin_attr)->attr)
65471
65472 struct sysfs_ops {
65473- ssize_t (*show)(struct kobject *, struct attribute *,char *);
65474- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
65475+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
65476+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
65477 };
65478
65479 struct sysfs_dirent;
65480diff -urNp linux-2.6.39.2/include/linux/tty.h linux-2.6.39.2/include/linux/tty.h
65481--- linux-2.6.39.2/include/linux/tty.h 2011-05-19 00:06:34.000000000 -0400
65482+++ linux-2.6.39.2/include/linux/tty.h 2011-05-22 19:36:33.000000000 -0400
65483@@ -13,6 +13,7 @@
65484 #include <linux/tty_driver.h>
65485 #include <linux/tty_ldisc.h>
65486 #include <linux/mutex.h>
65487+#include <linux/poll.h>
65488
65489 #include <asm/system.h>
65490
65491@@ -466,7 +467,6 @@ extern int tty_perform_flush(struct tty_
65492 extern dev_t tty_devnum(struct tty_struct *tty);
65493 extern void proc_clear_tty(struct task_struct *p);
65494 extern struct tty_struct *get_current_tty(void);
65495-extern void tty_default_fops(struct file_operations *fops);
65496 extern struct tty_struct *alloc_tty_struct(void);
65497 extern int tty_add_file(struct tty_struct *tty, struct file *file);
65498 extern void free_tty_struct(struct tty_struct *tty);
65499@@ -529,6 +529,18 @@ extern void tty_ldisc_begin(void);
65500 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
65501 extern void tty_ldisc_enable(struct tty_struct *tty);
65502
65503+/* tty_io.c */
65504+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
65505+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
65506+extern unsigned int tty_poll(struct file *, poll_table *);
65507+#ifdef CONFIG_COMPAT
65508+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
65509+ unsigned long arg);
65510+#else
65511+#define tty_compat_ioctl NULL
65512+#endif
65513+extern int tty_release(struct inode *, struct file *);
65514+extern int tty_fasync(int fd, struct file *filp, int on);
65515
65516 /* n_tty.c */
65517 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
65518diff -urNp linux-2.6.39.2/include/linux/tty_ldisc.h linux-2.6.39.2/include/linux/tty_ldisc.h
65519--- linux-2.6.39.2/include/linux/tty_ldisc.h 2011-05-19 00:06:34.000000000 -0400
65520+++ linux-2.6.39.2/include/linux/tty_ldisc.h 2011-05-22 19:36:33.000000000 -0400
65521@@ -148,7 +148,7 @@ struct tty_ldisc_ops {
65522
65523 struct module *owner;
65524
65525- int refcount;
65526+ atomic_t refcount;
65527 };
65528
65529 struct tty_ldisc {
65530diff -urNp linux-2.6.39.2/include/linux/types.h linux-2.6.39.2/include/linux/types.h
65531--- linux-2.6.39.2/include/linux/types.h 2011-05-19 00:06:34.000000000 -0400
65532+++ linux-2.6.39.2/include/linux/types.h 2011-05-22 19:36:33.000000000 -0400
65533@@ -213,10 +213,26 @@ typedef struct {
65534 int counter;
65535 } atomic_t;
65536
65537+#ifdef CONFIG_PAX_REFCOUNT
65538+typedef struct {
65539+ int counter;
65540+} atomic_unchecked_t;
65541+#else
65542+typedef atomic_t atomic_unchecked_t;
65543+#endif
65544+
65545 #ifdef CONFIG_64BIT
65546 typedef struct {
65547 long counter;
65548 } atomic64_t;
65549+
65550+#ifdef CONFIG_PAX_REFCOUNT
65551+typedef struct {
65552+ long counter;
65553+} atomic64_unchecked_t;
65554+#else
65555+typedef atomic64_t atomic64_unchecked_t;
65556+#endif
65557 #endif
65558
65559 struct list_head {
65560diff -urNp linux-2.6.39.2/include/linux/uaccess.h linux-2.6.39.2/include/linux/uaccess.h
65561--- linux-2.6.39.2/include/linux/uaccess.h 2011-05-19 00:06:34.000000000 -0400
65562+++ linux-2.6.39.2/include/linux/uaccess.h 2011-05-22 19:36:33.000000000 -0400
65563@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
65564 long ret; \
65565 mm_segment_t old_fs = get_fs(); \
65566 \
65567- set_fs(KERNEL_DS); \
65568 pagefault_disable(); \
65569+ set_fs(KERNEL_DS); \
65570 ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
65571- pagefault_enable(); \
65572 set_fs(old_fs); \
65573+ pagefault_enable(); \
65574 ret; \
65575 })
65576
65577@@ -93,8 +93,8 @@ static inline unsigned long __copy_from_
65578 * Safely read from address @src to the buffer at @dst. If a kernel fault
65579 * happens, handle that and return -EFAULT.
65580 */
65581-extern long probe_kernel_read(void *dst, void *src, size_t size);
65582-extern long __probe_kernel_read(void *dst, void *src, size_t size);
65583+extern long probe_kernel_read(void *dst, const void *src, size_t size);
65584+extern long __probe_kernel_read(void *dst, const void *src, size_t size);
65585
65586 /*
65587 * probe_kernel_write(): safely attempt to write to a location
65588@@ -105,7 +105,7 @@ extern long __probe_kernel_read(void *ds
65589 * Safely write to address @dst from the buffer at @src. If a kernel fault
65590 * happens, handle that and return -EFAULT.
65591 */
65592-extern long notrace probe_kernel_write(void *dst, void *src, size_t size);
65593-extern long notrace __probe_kernel_write(void *dst, void *src, size_t size);
65594+extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
65595+extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
65596
65597 #endif /* __LINUX_UACCESS_H__ */
65598diff -urNp linux-2.6.39.2/include/linux/unaligned/access_ok.h linux-2.6.39.2/include/linux/unaligned/access_ok.h
65599--- linux-2.6.39.2/include/linux/unaligned/access_ok.h 2011-05-19 00:06:34.000000000 -0400
65600+++ linux-2.6.39.2/include/linux/unaligned/access_ok.h 2011-05-22 19:36:33.000000000 -0400
65601@@ -6,32 +6,32 @@
65602
65603 static inline u16 get_unaligned_le16(const void *p)
65604 {
65605- return le16_to_cpup((__le16 *)p);
65606+ return le16_to_cpup((const __le16 *)p);
65607 }
65608
65609 static inline u32 get_unaligned_le32(const void *p)
65610 {
65611- return le32_to_cpup((__le32 *)p);
65612+ return le32_to_cpup((const __le32 *)p);
65613 }
65614
65615 static inline u64 get_unaligned_le64(const void *p)
65616 {
65617- return le64_to_cpup((__le64 *)p);
65618+ return le64_to_cpup((const __le64 *)p);
65619 }
65620
65621 static inline u16 get_unaligned_be16(const void *p)
65622 {
65623- return be16_to_cpup((__be16 *)p);
65624+ return be16_to_cpup((const __be16 *)p);
65625 }
65626
65627 static inline u32 get_unaligned_be32(const void *p)
65628 {
65629- return be32_to_cpup((__be32 *)p);
65630+ return be32_to_cpup((const __be32 *)p);
65631 }
65632
65633 static inline u64 get_unaligned_be64(const void *p)
65634 {
65635- return be64_to_cpup((__be64 *)p);
65636+ return be64_to_cpup((const __be64 *)p);
65637 }
65638
65639 static inline void put_unaligned_le16(u16 val, void *p)
65640diff -urNp linux-2.6.39.2/include/linux/usb/hcd.h linux-2.6.39.2/include/linux/usb/hcd.h
65641--- linux-2.6.39.2/include/linux/usb/hcd.h 2011-05-19 00:06:34.000000000 -0400
65642+++ linux-2.6.39.2/include/linux/usb/hcd.h 2011-05-22 19:36:33.000000000 -0400
65643@@ -615,7 +615,7 @@ struct usb_mon_operations {
65644 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
65645 };
65646
65647-extern struct usb_mon_operations *mon_ops;
65648+extern const struct usb_mon_operations *mon_ops;
65649
65650 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
65651 {
65652@@ -637,7 +637,7 @@ static inline void usbmon_urb_complete(s
65653 (*mon_ops->urb_complete)(bus, urb, status);
65654 }
65655
65656-int usb_mon_register(struct usb_mon_operations *ops);
65657+int usb_mon_register(const struct usb_mon_operations *ops);
65658 void usb_mon_deregister(void);
65659
65660 #else
65661diff -urNp linux-2.6.39.2/include/linux/usb/intel_mid_otg.h linux-2.6.39.2/include/linux/usb/intel_mid_otg.h
65662--- linux-2.6.39.2/include/linux/usb/intel_mid_otg.h 2011-05-19 00:06:34.000000000 -0400
65663+++ linux-2.6.39.2/include/linux/usb/intel_mid_otg.h 2011-05-22 19:36:33.000000000 -0400
65664@@ -115,7 +115,7 @@ struct intel_mid_otg_xceiv {
65665 void __iomem *base;
65666
65667 /* ops to access ulpi */
65668- struct iotg_ulpi_access_ops ulpi_ops;
65669+ const struct iotg_ulpi_access_ops ulpi_ops;
65670
65671 /* atomic notifier for interrupt context */
65672 struct atomic_notifier_head iotg_notifier;
65673diff -urNp linux-2.6.39.2/include/linux/usb/ulpi.h linux-2.6.39.2/include/linux/usb/ulpi.h
65674--- linux-2.6.39.2/include/linux/usb/ulpi.h 2011-05-19 00:06:34.000000000 -0400
65675+++ linux-2.6.39.2/include/linux/usb/ulpi.h 2011-05-22 19:36:33.000000000 -0400
65676@@ -186,7 +186,7 @@ struct otg_transceiver *otg_ulpi_create(
65677
65678 #ifdef CONFIG_USB_ULPI_VIEWPORT
65679 /* access ops for controllers with a viewport register */
65680-extern struct otg_io_access_ops ulpi_viewport_access_ops;
65681+extern const struct otg_io_access_ops ulpi_viewport_access_ops;
65682 #endif
65683
65684 #endif /* __LINUX_USB_ULPI_H */
65685diff -urNp linux-2.6.39.2/include/linux/vga_switcheroo.h linux-2.6.39.2/include/linux/vga_switcheroo.h
65686--- linux-2.6.39.2/include/linux/vga_switcheroo.h 2011-05-19 00:06:34.000000000 -0400
65687+++ linux-2.6.39.2/include/linux/vga_switcheroo.h 2011-05-22 19:36:33.000000000 -0400
65688@@ -39,7 +39,7 @@ int vga_switcheroo_register_client(struc
65689 void vga_switcheroo_client_fb_set(struct pci_dev *dev,
65690 struct fb_info *info);
65691
65692-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler);
65693+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler);
65694 void vga_switcheroo_unregister_handler(void);
65695
65696 int vga_switcheroo_process_delayed_switch(void);
65697@@ -52,7 +52,7 @@ static inline int vga_switcheroo_registe
65698 void (*reprobe)(struct pci_dev *dev),
65699 bool (*can_switch)(struct pci_dev *dev)) { return 0; }
65700 static inline void vga_switcheroo_client_fb_set(struct pci_dev *dev, struct fb_info *info) {}
65701-static inline int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler) { return 0; }
65702+static inline int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler) { return 0; }
65703 static inline void vga_switcheroo_unregister_handler(void) {}
65704 static inline int vga_switcheroo_process_delayed_switch(void) { return 0; }
65705
65706diff -urNp linux-2.6.39.2/include/linux/virtio.h linux-2.6.39.2/include/linux/virtio.h
65707--- linux-2.6.39.2/include/linux/virtio.h 2011-05-19 00:06:34.000000000 -0400
65708+++ linux-2.6.39.2/include/linux/virtio.h 2011-05-22 19:36:33.000000000 -0400
65709@@ -102,7 +102,7 @@ struct virtio_device {
65710 int index;
65711 struct device dev;
65712 struct virtio_device_id id;
65713- struct virtio_config_ops *config;
65714+ const struct virtio_config_ops *config;
65715 struct list_head vqs;
65716 /* Note that this is a Linux set_bit-style bitmap. */
65717 unsigned long features[1];
65718diff -urNp linux-2.6.39.2/include/linux/vmalloc.h linux-2.6.39.2/include/linux/vmalloc.h
65719--- linux-2.6.39.2/include/linux/vmalloc.h 2011-05-19 00:06:34.000000000 -0400
65720+++ linux-2.6.39.2/include/linux/vmalloc.h 2011-05-22 19:36:33.000000000 -0400
65721@@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
65722 #define VM_MAP 0x00000004 /* vmap()ed pages */
65723 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
65724 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
65725+
65726+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
65727+#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
65728+#endif
65729+
65730 /* bits [20..32] reserved for arch specific ioremap internals */
65731
65732 /*
65733@@ -155,4 +160,103 @@ pcpu_free_vm_areas(struct vm_struct **vm
65734 # endif
65735 #endif
65736
65737+#define vmalloc(x) \
65738+({ \
65739+ void *___retval; \
65740+ intoverflow_t ___x = (intoverflow_t)x; \
65741+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
65742+ ___retval = NULL; \
65743+ else \
65744+ ___retval = vmalloc((unsigned long)___x); \
65745+ ___retval; \
65746+})
65747+
65748+#define vzalloc(x) \
65749+({ \
65750+ void *___retval; \
65751+ intoverflow_t ___x = (intoverflow_t)x; \
65752+ if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
65753+ ___retval = NULL; \
65754+ else \
65755+ ___retval = vzalloc((unsigned long)___x); \
65756+ ___retval; \
65757+})
65758+
65759+#define __vmalloc(x, y, z) \
65760+({ \
65761+ void *___retval; \
65762+ intoverflow_t ___x = (intoverflow_t)x; \
65763+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
65764+ ___retval = NULL; \
65765+ else \
65766+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
65767+ ___retval; \
65768+})
65769+
65770+#define vmalloc_user(x) \
65771+({ \
65772+ void *___retval; \
65773+ intoverflow_t ___x = (intoverflow_t)x; \
65774+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
65775+ ___retval = NULL; \
65776+ else \
65777+ ___retval = vmalloc_user((unsigned long)___x); \
65778+ ___retval; \
65779+})
65780+
65781+#define vmalloc_exec(x) \
65782+({ \
65783+ void *___retval; \
65784+ intoverflow_t ___x = (intoverflow_t)x; \
65785+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
65786+ ___retval = NULL; \
65787+ else \
65788+ ___retval = vmalloc_exec((unsigned long)___x); \
65789+ ___retval; \
65790+})
65791+
65792+#define vmalloc_node(x, y) \
65793+({ \
65794+ void *___retval; \
65795+ intoverflow_t ___x = (intoverflow_t)x; \
65796+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
65797+ ___retval = NULL; \
65798+ else \
65799+ ___retval = vmalloc_node((unsigned long)___x, (y));\
65800+ ___retval; \
65801+})
65802+
65803+#define vzalloc_node(x, y) \
65804+({ \
65805+ void *___retval; \
65806+ intoverflow_t ___x = (intoverflow_t)x; \
65807+ if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
65808+ ___retval = NULL; \
65809+ else \
65810+ ___retval = vzalloc_node((unsigned long)___x, (y));\
65811+ ___retval; \
65812+})
65813+
65814+#define vmalloc_32(x) \
65815+({ \
65816+ void *___retval; \
65817+ intoverflow_t ___x = (intoverflow_t)x; \
65818+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
65819+ ___retval = NULL; \
65820+ else \
65821+ ___retval = vmalloc_32((unsigned long)___x); \
65822+ ___retval; \
65823+})
65824+
65825+#define vmalloc_32_user(x) \
65826+({ \
65827+void *___retval; \
65828+ intoverflow_t ___x = (intoverflow_t)x; \
65829+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
65830+ ___retval = NULL; \
65831+ else \
65832+ ___retval = vmalloc_32_user((unsigned long)___x);\
65833+ ___retval; \
65834+})
65835+
65836 #endif /* _LINUX_VMALLOC_H */
65837diff -urNp linux-2.6.39.2/include/linux/vmstat.h linux-2.6.39.2/include/linux/vmstat.h
65838--- linux-2.6.39.2/include/linux/vmstat.h 2011-05-19 00:06:34.000000000 -0400
65839+++ linux-2.6.39.2/include/linux/vmstat.h 2011-05-22 19:36:33.000000000 -0400
65840@@ -147,18 +147,18 @@ static inline void vm_events_fold_cpu(in
65841 /*
65842 * Zone based page accounting with per cpu differentials.
65843 */
65844-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65845+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65846
65847 static inline void zone_page_state_add(long x, struct zone *zone,
65848 enum zone_stat_item item)
65849 {
65850- atomic_long_add(x, &zone->vm_stat[item]);
65851- atomic_long_add(x, &vm_stat[item]);
65852+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
65853+ atomic_long_add_unchecked(x, &vm_stat[item]);
65854 }
65855
65856 static inline unsigned long global_page_state(enum zone_stat_item item)
65857 {
65858- long x = atomic_long_read(&vm_stat[item]);
65859+ long x = atomic_long_read_unchecked(&vm_stat[item]);
65860 #ifdef CONFIG_SMP
65861 if (x < 0)
65862 x = 0;
65863@@ -169,7 +169,7 @@ static inline unsigned long global_page_
65864 static inline unsigned long zone_page_state(struct zone *zone,
65865 enum zone_stat_item item)
65866 {
65867- long x = atomic_long_read(&zone->vm_stat[item]);
65868+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65869 #ifdef CONFIG_SMP
65870 if (x < 0)
65871 x = 0;
65872@@ -186,7 +186,7 @@ static inline unsigned long zone_page_st
65873 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
65874 enum zone_stat_item item)
65875 {
65876- long x = atomic_long_read(&zone->vm_stat[item]);
65877+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65878
65879 #ifdef CONFIG_SMP
65880 int cpu;
65881@@ -280,8 +280,8 @@ static inline void __mod_zone_page_state
65882
65883 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
65884 {
65885- atomic_long_inc(&zone->vm_stat[item]);
65886- atomic_long_inc(&vm_stat[item]);
65887+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
65888+ atomic_long_inc_unchecked(&vm_stat[item]);
65889 }
65890
65891 static inline void __inc_zone_page_state(struct page *page,
65892@@ -292,8 +292,8 @@ static inline void __inc_zone_page_state
65893
65894 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
65895 {
65896- atomic_long_dec(&zone->vm_stat[item]);
65897- atomic_long_dec(&vm_stat[item]);
65898+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
65899+ atomic_long_dec_unchecked(&vm_stat[item]);
65900 }
65901
65902 static inline void __dec_zone_page_state(struct page *page,
65903diff -urNp linux-2.6.39.2/include/media/saa7146_vv.h linux-2.6.39.2/include/media/saa7146_vv.h
65904--- linux-2.6.39.2/include/media/saa7146_vv.h 2011-05-19 00:06:34.000000000 -0400
65905+++ linux-2.6.39.2/include/media/saa7146_vv.h 2011-05-22 19:36:33.000000000 -0400
65906@@ -202,13 +202,13 @@ void saa7146_set_gpio(struct saa7146_dev
65907
65908 /* from saa7146_video.c */
65909 extern const struct v4l2_ioctl_ops saa7146_video_ioctl_ops;
65910-extern struct saa7146_use_ops saa7146_video_uops;
65911+extern const struct saa7146_use_ops saa7146_video_uops;
65912 int saa7146_start_preview(struct saa7146_fh *fh);
65913 int saa7146_stop_preview(struct saa7146_fh *fh);
65914 long saa7146_video_do_ioctl(struct file *file, unsigned int cmd, void *arg);
65915
65916 /* from saa7146_vbi.c */
65917-extern struct saa7146_use_ops saa7146_vbi_uops;
65918+extern const struct saa7146_use_ops saa7146_vbi_uops;
65919
65920 /* resource management functions */
65921 int saa7146_res_get(struct saa7146_fh *fh, unsigned int bit);
65922diff -urNp linux-2.6.39.2/include/media/v4l2-device.h linux-2.6.39.2/include/media/v4l2-device.h
65923--- linux-2.6.39.2/include/media/v4l2-device.h 2011-05-19 00:06:34.000000000 -0400
65924+++ linux-2.6.39.2/include/media/v4l2-device.h 2011-05-22 19:36:33.000000000 -0400
65925@@ -95,7 +95,7 @@ int __must_check v4l2_device_register(st
65926 this function returns 0. If the name ends with a digit (e.g. cx18),
65927 then the name will be set to cx18-0 since cx180 looks really odd. */
65928 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
65929- atomic_t *instance);
65930+ atomic_unchecked_t *instance);
65931
65932 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
65933 Since the parent disappears this ensures that v4l2_dev doesn't have an
65934diff -urNp linux-2.6.39.2/include/net/caif/cfctrl.h linux-2.6.39.2/include/net/caif/cfctrl.h
65935--- linux-2.6.39.2/include/net/caif/cfctrl.h 2011-05-19 00:06:34.000000000 -0400
65936+++ linux-2.6.39.2/include/net/caif/cfctrl.h 2011-05-22 19:36:33.000000000 -0400
65937@@ -101,8 +101,8 @@ struct cfctrl_request_info {
65938 struct cfctrl {
65939 struct cfsrvl serv;
65940 struct cfctrl_rsp res;
65941- atomic_t req_seq_no;
65942- atomic_t rsp_seq_no;
65943+ atomic_unchecked_t req_seq_no;
65944+ atomic_unchecked_t rsp_seq_no;
65945 struct list_head list;
65946 /* Protects from simultaneous access to first_req list */
65947 spinlock_t info_list_lock;
65948diff -urNp linux-2.6.39.2/include/net/flow.h linux-2.6.39.2/include/net/flow.h
65949--- linux-2.6.39.2/include/net/flow.h 2011-05-19 00:06:34.000000000 -0400
65950+++ linux-2.6.39.2/include/net/flow.h 2011-05-22 19:36:33.000000000 -0400
65951@@ -167,6 +167,6 @@ extern struct flow_cache_object *flow_ca
65952 u8 dir, flow_resolve_t resolver, void *ctx);
65953
65954 extern void flow_cache_flush(void);
65955-extern atomic_t flow_cache_genid;
65956+extern atomic_unchecked_t flow_cache_genid;
65957
65958 #endif
65959diff -urNp linux-2.6.39.2/include/net/inetpeer.h linux-2.6.39.2/include/net/inetpeer.h
65960--- linux-2.6.39.2/include/net/inetpeer.h 2011-05-19 00:06:34.000000000 -0400
65961+++ linux-2.6.39.2/include/net/inetpeer.h 2011-05-22 19:36:33.000000000 -0400
65962@@ -43,8 +43,8 @@ struct inet_peer {
65963 */
65964 union {
65965 struct {
65966- atomic_t rid; /* Frag reception counter */
65967- atomic_t ip_id_count; /* IP ID for the next packet */
65968+ atomic_unchecked_t rid; /* Frag reception counter */
65969+ atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
65970 __u32 tcp_ts;
65971 __u32 tcp_ts_stamp;
65972 u32 metrics[RTAX_MAX];
65973@@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in
65974 {
65975 more++;
65976 inet_peer_refcheck(p);
65977- return atomic_add_return(more, &p->ip_id_count) - more;
65978+ return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
65979 }
65980
65981 #endif /* _NET_INETPEER_H */
65982diff -urNp linux-2.6.39.2/include/net/ip_fib.h linux-2.6.39.2/include/net/ip_fib.h
65983--- linux-2.6.39.2/include/net/ip_fib.h 2011-05-19 00:06:34.000000000 -0400
65984+++ linux-2.6.39.2/include/net/ip_fib.h 2011-05-22 19:36:33.000000000 -0400
65985@@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s
65986
65987 #define FIB_RES_SADDR(net, res) \
65988 ((FIB_RES_NH(res).nh_saddr_genid == \
65989- atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
65990+ atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
65991 FIB_RES_NH(res).nh_saddr : \
65992 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
65993 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
65994diff -urNp linux-2.6.39.2/include/net/ip_vs.h linux-2.6.39.2/include/net/ip_vs.h
65995--- linux-2.6.39.2/include/net/ip_vs.h 2011-05-19 00:06:34.000000000 -0400
65996+++ linux-2.6.39.2/include/net/ip_vs.h 2011-05-22 19:36:33.000000000 -0400
65997@@ -512,7 +512,7 @@ struct ip_vs_conn {
65998 struct ip_vs_conn *control; /* Master control connection */
65999 atomic_t n_control; /* Number of controlled ones */
66000 struct ip_vs_dest *dest; /* real server */
66001- atomic_t in_pkts; /* incoming packet counter */
66002+ atomic_unchecked_t in_pkts; /* incoming packet counter */
66003
66004 /* packet transmitter for different forwarding methods. If it
66005 mangles the packet, it must return NF_DROP or better NF_STOLEN,
66006@@ -650,7 +650,7 @@ struct ip_vs_dest {
66007 __be16 port; /* port number of the server */
66008 union nf_inet_addr addr; /* IP address of the server */
66009 volatile unsigned flags; /* dest status flags */
66010- atomic_t conn_flags; /* flags to copy to conn */
66011+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
66012 atomic_t weight; /* server weight */
66013
66014 atomic_t refcnt; /* reference counter */
66015diff -urNp linux-2.6.39.2/include/net/irda/ircomm_tty.h linux-2.6.39.2/include/net/irda/ircomm_tty.h
66016--- linux-2.6.39.2/include/net/irda/ircomm_tty.h 2011-05-19 00:06:34.000000000 -0400
66017+++ linux-2.6.39.2/include/net/irda/ircomm_tty.h 2011-05-22 19:36:33.000000000 -0400
66018@@ -35,6 +35,7 @@
66019 #include <linux/termios.h>
66020 #include <linux/timer.h>
66021 #include <linux/tty.h> /* struct tty_struct */
66022+#include <asm/local.h>
66023
66024 #include <net/irda/irias_object.h>
66025 #include <net/irda/ircomm_core.h>
66026@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
66027 unsigned short close_delay;
66028 unsigned short closing_wait; /* time to wait before closing */
66029
66030- int open_count;
66031- int blocked_open; /* # of blocked opens */
66032+ local_t open_count;
66033+ local_t blocked_open; /* # of blocked opens */
66034
66035 /* Protect concurent access to :
66036 * o self->open_count
66037diff -urNp linux-2.6.39.2/include/net/iucv/af_iucv.h linux-2.6.39.2/include/net/iucv/af_iucv.h
66038--- linux-2.6.39.2/include/net/iucv/af_iucv.h 2011-05-19 00:06:34.000000000 -0400
66039+++ linux-2.6.39.2/include/net/iucv/af_iucv.h 2011-05-22 19:36:33.000000000 -0400
66040@@ -87,7 +87,7 @@ struct iucv_sock {
66041 struct iucv_sock_list {
66042 struct hlist_head head;
66043 rwlock_t lock;
66044- atomic_t autobind_name;
66045+ atomic_unchecked_t autobind_name;
66046 };
66047
66048 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
66049diff -urNp linux-2.6.39.2/include/net/neighbour.h linux-2.6.39.2/include/net/neighbour.h
66050--- linux-2.6.39.2/include/net/neighbour.h 2011-05-19 00:06:34.000000000 -0400
66051+++ linux-2.6.39.2/include/net/neighbour.h 2011-05-22 19:36:33.000000000 -0400
66052@@ -118,12 +118,12 @@ struct neighbour {
66053
66054 struct neigh_ops {
66055 int family;
66056- void (*solicit)(struct neighbour *, struct sk_buff*);
66057- void (*error_report)(struct neighbour *, struct sk_buff*);
66058- int (*output)(struct sk_buff*);
66059- int (*connected_output)(struct sk_buff*);
66060- int (*hh_output)(struct sk_buff*);
66061- int (*queue_xmit)(struct sk_buff*);
66062+ void (* const solicit)(struct neighbour *, struct sk_buff*);
66063+ void (* const error_report)(struct neighbour *, struct sk_buff*);
66064+ int (* const output)(struct sk_buff*);
66065+ int (* const connected_output)(struct sk_buff*);
66066+ int (* const hh_output)(struct sk_buff*);
66067+ int (* const queue_xmit)(struct sk_buff*);
66068 };
66069
66070 struct pneigh_entry {
66071diff -urNp linux-2.6.39.2/include/net/netfilter/nf_conntrack_ecache.h linux-2.6.39.2/include/net/netfilter/nf_conntrack_ecache.h
66072--- linux-2.6.39.2/include/net/netfilter/nf_conntrack_ecache.h 2011-05-19 00:06:34.000000000 -0400
66073+++ linux-2.6.39.2/include/net/netfilter/nf_conntrack_ecache.h 2011-05-22 19:36:33.000000000 -0400
66074@@ -95,7 +95,7 @@ nf_conntrack_eventmask_report(unsigned i
66075 int report)
66076 {
66077 int ret = 0;
66078- struct nf_ct_event_notifier *notify;
66079+ const struct nf_ct_event_notifier *notify;
66080 struct nf_conntrack_ecache *e;
66081
66082 rcu_read_lock();
66083@@ -174,7 +174,7 @@ nf_ct_expect_event_report(enum ip_conntr
66084 u32 pid,
66085 int report)
66086 {
66087- struct nf_exp_event_notifier *notify;
66088+ const struct nf_exp_event_notifier *notify;
66089 struct nf_conntrack_ecache *e;
66090
66091 rcu_read_lock();
66092diff -urNp linux-2.6.39.2/include/net/netlink.h linux-2.6.39.2/include/net/netlink.h
66093--- linux-2.6.39.2/include/net/netlink.h 2011-05-19 00:06:34.000000000 -0400
66094+++ linux-2.6.39.2/include/net/netlink.h 2011-05-22 19:36:33.000000000 -0400
66095@@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
66096 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
66097 {
66098 if (mark)
66099- skb_trim(skb, (unsigned char *) mark - skb->data);
66100+ skb_trim(skb, (const unsigned char *) mark - skb->data);
66101 }
66102
66103 /**
66104diff -urNp linux-2.6.39.2/include/net/netns/ipv4.h linux-2.6.39.2/include/net/netns/ipv4.h
66105--- linux-2.6.39.2/include/net/netns/ipv4.h 2011-05-19 00:06:34.000000000 -0400
66106+++ linux-2.6.39.2/include/net/netns/ipv4.h 2011-05-22 19:36:33.000000000 -0400
66107@@ -54,8 +54,8 @@ struct netns_ipv4 {
66108 int sysctl_rt_cache_rebuild_count;
66109 int current_rt_cache_rebuild_count;
66110
66111- atomic_t rt_genid;
66112- atomic_t dev_addr_genid;
66113+ atomic_unchecked_t rt_genid;
66114+ atomic_unchecked_t dev_addr_genid;
66115
66116 #ifdef CONFIG_IP_MROUTE
66117 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
66118diff -urNp linux-2.6.39.2/include/net/sctp/sctp.h linux-2.6.39.2/include/net/sctp/sctp.h
66119--- linux-2.6.39.2/include/net/sctp/sctp.h 2011-05-19 00:06:34.000000000 -0400
66120+++ linux-2.6.39.2/include/net/sctp/sctp.h 2011-05-22 19:36:33.000000000 -0400
66121@@ -316,9 +316,9 @@ do { \
66122
66123 #else /* SCTP_DEBUG */
66124
66125-#define SCTP_DEBUG_PRINTK(whatever...)
66126-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
66127-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
66128+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
66129+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
66130+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
66131 #define SCTP_ENABLE_DEBUG
66132 #define SCTP_DISABLE_DEBUG
66133 #define SCTP_ASSERT(expr, str, func)
66134diff -urNp linux-2.6.39.2/include/net/sock.h linux-2.6.39.2/include/net/sock.h
66135--- linux-2.6.39.2/include/net/sock.h 2011-05-19 00:06:34.000000000 -0400
66136+++ linux-2.6.39.2/include/net/sock.h 2011-05-22 19:36:33.000000000 -0400
66137@@ -277,7 +277,7 @@ struct sock {
66138 #ifdef CONFIG_RPS
66139 __u32 sk_rxhash;
66140 #endif
66141- atomic_t sk_drops;
66142+ atomic_unchecked_t sk_drops;
66143 int sk_rcvbuf;
66144
66145 struct sk_filter __rcu *sk_filter;
66146diff -urNp linux-2.6.39.2/include/net/tcp.h linux-2.6.39.2/include/net/tcp.h
66147--- linux-2.6.39.2/include/net/tcp.h 2011-05-19 00:06:34.000000000 -0400
66148+++ linux-2.6.39.2/include/net/tcp.h 2011-05-22 19:36:33.000000000 -0400
66149@@ -1374,7 +1374,7 @@ enum tcp_seq_states {
66150 struct tcp_seq_afinfo {
66151 char *name;
66152 sa_family_t family;
66153- struct file_operations seq_fops;
66154+ struct file_operations seq_fops; /* cannot be const */
66155 struct seq_operations seq_ops;
66156 };
66157
66158diff -urNp linux-2.6.39.2/include/net/udp.h linux-2.6.39.2/include/net/udp.h
66159--- linux-2.6.39.2/include/net/udp.h 2011-05-19 00:06:34.000000000 -0400
66160+++ linux-2.6.39.2/include/net/udp.h 2011-05-22 19:36:33.000000000 -0400
66161@@ -234,7 +234,7 @@ struct udp_seq_afinfo {
66162 char *name;
66163 sa_family_t family;
66164 struct udp_table *udp_table;
66165- struct file_operations seq_fops;
66166+ struct file_operations seq_fops; /* cannot be const */
66167 struct seq_operations seq_ops;
66168 };
66169
66170diff -urNp linux-2.6.39.2/include/net/xfrm.h linux-2.6.39.2/include/net/xfrm.h
66171--- linux-2.6.39.2/include/net/xfrm.h 2011-05-19 00:06:34.000000000 -0400
66172+++ linux-2.6.39.2/include/net/xfrm.h 2011-05-22 19:36:33.000000000 -0400
66173@@ -505,7 +505,7 @@ struct xfrm_policy {
66174 struct timer_list timer;
66175
66176 struct flow_cache_object flo;
66177- atomic_t genid;
66178+ atomic_unchecked_t genid;
66179 u32 priority;
66180 u32 index;
66181 struct xfrm_mark mark;
66182diff -urNp linux-2.6.39.2/include/pcmcia/ss.h linux-2.6.39.2/include/pcmcia/ss.h
66183--- linux-2.6.39.2/include/pcmcia/ss.h 2011-05-19 00:06:34.000000000 -0400
66184+++ linux-2.6.39.2/include/pcmcia/ss.h 2011-05-22 19:36:33.000000000 -0400
66185@@ -241,9 +241,9 @@ struct pcmcia_socket {
66186 * "select PCCARD_NONSTATIC" in Kconfig.
66187 *
66188 */
66189-extern struct pccard_resource_ops pccard_static_ops;
66190+extern const struct pccard_resource_ops pccard_static_ops;
66191 #if defined(CONFIG_PCMCIA) || defined(CONFIG_PCMCIA_MODULE)
66192-extern struct pccard_resource_ops pccard_iodyn_ops;
66193+extern const struct pccard_resource_ops pccard_iodyn_ops;
66194 extern struct pccard_resource_ops pccard_nonstatic_ops;
66195 #else
66196 /* If PCMCIA is not used, but only CARDBUS, these functions are not used
66197diff -urNp linux-2.6.39.2/include/rdma/ib_verbs.h linux-2.6.39.2/include/rdma/ib_verbs.h
66198--- linux-2.6.39.2/include/rdma/ib_verbs.h 2011-05-19 00:06:34.000000000 -0400
66199+++ linux-2.6.39.2/include/rdma/ib_verbs.h 2011-05-22 19:36:33.000000000 -0400
66200@@ -1149,7 +1149,7 @@ struct ib_device {
66201 struct ib_mad *in_mad,
66202 struct ib_mad *out_mad);
66203
66204- struct ib_dma_mapping_ops *dma_ops;
66205+ const struct ib_dma_mapping_ops *dma_ops;
66206
66207 struct module *owner;
66208 struct device dev;
66209diff -urNp linux-2.6.39.2/include/scsi/libfc.h linux-2.6.39.2/include/scsi/libfc.h
66210--- linux-2.6.39.2/include/scsi/libfc.h 2011-05-19 00:06:34.000000000 -0400
66211+++ linux-2.6.39.2/include/scsi/libfc.h 2011-05-22 19:36:33.000000000 -0400
66212@@ -202,7 +202,7 @@ struct fc_rport_priv {
66213 struct mutex rp_mutex;
66214 struct delayed_work retry_work;
66215 enum fc_rport_event event;
66216- struct fc_rport_operations *ops;
66217+ const struct fc_rport_operations *ops;
66218 struct list_head peers;
66219 struct work_struct event_work;
66220 u32 supported_classes;
66221diff -urNp linux-2.6.39.2/include/scsi/scsi_device.h linux-2.6.39.2/include/scsi/scsi_device.h
66222--- linux-2.6.39.2/include/scsi/scsi_device.h 2011-05-19 00:06:34.000000000 -0400
66223+++ linux-2.6.39.2/include/scsi/scsi_device.h 2011-05-22 19:36:33.000000000 -0400
66224@@ -161,9 +161,9 @@ struct scsi_device {
66225 unsigned int max_device_blocked; /* what device_blocked counts down from */
66226 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
66227
66228- atomic_t iorequest_cnt;
66229- atomic_t iodone_cnt;
66230- atomic_t ioerr_cnt;
66231+ atomic_unchecked_t iorequest_cnt;
66232+ atomic_unchecked_t iodone_cnt;
66233+ atomic_unchecked_t ioerr_cnt;
66234
66235 struct device sdev_gendev,
66236 sdev_dev;
66237diff -urNp linux-2.6.39.2/include/sound/ac97_codec.h linux-2.6.39.2/include/sound/ac97_codec.h
66238--- linux-2.6.39.2/include/sound/ac97_codec.h 2011-05-19 00:06:34.000000000 -0400
66239+++ linux-2.6.39.2/include/sound/ac97_codec.h 2011-05-22 19:36:33.000000000 -0400
66240@@ -424,15 +424,15 @@
66241 struct snd_ac97;
66242
66243 struct snd_ac97_build_ops {
66244- int (*build_3d) (struct snd_ac97 *ac97);
66245- int (*build_specific) (struct snd_ac97 *ac97);
66246- int (*build_spdif) (struct snd_ac97 *ac97);
66247- int (*build_post_spdif) (struct snd_ac97 *ac97);
66248+ int (* const build_3d) (struct snd_ac97 *ac97);
66249+ int (* const build_specific) (struct snd_ac97 *ac97);
66250+ int (* const build_spdif) (struct snd_ac97 *ac97);
66251+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
66252 #ifdef CONFIG_PM
66253- void (*suspend) (struct snd_ac97 *ac97);
66254- void (*resume) (struct snd_ac97 *ac97);
66255+ void (* const suspend) (struct snd_ac97 *ac97);
66256+ void (* const resume) (struct snd_ac97 *ac97);
66257 #endif
66258- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
66259+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
66260 };
66261
66262 struct snd_ac97_bus_ops {
66263@@ -446,7 +446,7 @@ struct snd_ac97_bus_ops {
66264
66265 struct snd_ac97_bus {
66266 /* -- lowlevel (hardware) driver specific -- */
66267- struct snd_ac97_bus_ops *ops;
66268+ const struct snd_ac97_bus_ops *ops;
66269 void *private_data;
66270 void (*private_free) (struct snd_ac97_bus *bus);
66271 /* --- */
66272@@ -556,7 +556,7 @@ static inline int ac97_can_spdif(struct
66273
66274 /* functions */
66275 /* create new AC97 bus */
66276-int snd_ac97_bus(struct snd_card *card, int num, struct snd_ac97_bus_ops *ops,
66277+int snd_ac97_bus(struct snd_card *card, int num, const struct snd_ac97_bus_ops *ops,
66278 void *private_data, struct snd_ac97_bus **rbus);
66279 /* create mixer controls */
66280 int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
66281diff -urNp linux-2.6.39.2/include/sound/core.h linux-2.6.39.2/include/sound/core.h
66282--- linux-2.6.39.2/include/sound/core.h 2011-05-19 00:06:34.000000000 -0400
66283+++ linux-2.6.39.2/include/sound/core.h 2011-05-22 19:36:33.000000000 -0400
66284@@ -88,7 +88,7 @@ struct snd_device {
66285 snd_device_state_t state; /* state of the device */
66286 snd_device_type_t type; /* device type */
66287 void *device_data; /* device structure */
66288- struct snd_device_ops *ops; /* operations */
66289+ const struct snd_device_ops *ops; /* operations */
66290 };
66291
66292 #define snd_device(n) list_entry(n, struct snd_device, list)
66293@@ -301,7 +301,7 @@ int snd_card_file_remove(struct snd_card
66294 /* device.c */
66295
66296 int snd_device_new(struct snd_card *card, snd_device_type_t type,
66297- void *device_data, struct snd_device_ops *ops);
66298+ void *device_data, const struct snd_device_ops *ops);
66299 int snd_device_register(struct snd_card *card, void *device_data);
66300 int snd_device_register_all(struct snd_card *card);
66301 int snd_device_disconnect(struct snd_card *card, void *device_data);
66302diff -urNp linux-2.6.39.2/include/sound/pcm.h linux-2.6.39.2/include/sound/pcm.h
66303--- linux-2.6.39.2/include/sound/pcm.h 2011-05-19 00:06:34.000000000 -0400
66304+++ linux-2.6.39.2/include/sound/pcm.h 2011-05-22 19:36:33.000000000 -0400
66305@@ -379,7 +379,7 @@ struct snd_pcm_substream {
66306 unsigned int dma_buf_id;
66307 size_t dma_max;
66308 /* -- hardware operations -- */
66309- struct snd_pcm_ops *ops;
66310+ const struct snd_pcm_ops *ops;
66311 /* -- runtime information -- */
66312 struct snd_pcm_runtime *runtime;
66313 /* -- timer section -- */
66314@@ -845,7 +845,7 @@ const unsigned char *snd_pcm_format_sile
66315 int snd_pcm_format_set_silence(snd_pcm_format_t format, void *buf, unsigned int frames);
66316 snd_pcm_format_t snd_pcm_build_linear_format(int width, int unsignd, int big_endian);
66317
66318-void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, struct snd_pcm_ops *ops);
66319+void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, const struct snd_pcm_ops *ops);
66320 void snd_pcm_set_sync(struct snd_pcm_substream *substream);
66321 int snd_pcm_lib_interleave_len(struct snd_pcm_substream *substream);
66322 int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream,
66323diff -urNp linux-2.6.39.2/include/sound/rawmidi.h linux-2.6.39.2/include/sound/rawmidi.h
66324--- linux-2.6.39.2/include/sound/rawmidi.h 2011-05-19 00:06:34.000000000 -0400
66325+++ linux-2.6.39.2/include/sound/rawmidi.h 2011-05-22 19:36:33.000000000 -0400
66326@@ -100,7 +100,7 @@ struct snd_rawmidi_substream {
66327 struct snd_rawmidi_runtime *runtime;
66328 struct pid *pid;
66329 /* hardware layer */
66330- struct snd_rawmidi_ops *ops;
66331+ const struct snd_rawmidi_ops *ops;
66332 };
66333
66334 struct snd_rawmidi_file {
66335@@ -127,7 +127,7 @@ struct snd_rawmidi {
66336 int ossreg;
66337 #endif
66338
66339- struct snd_rawmidi_global_ops *ops;
66340+ const struct snd_rawmidi_global_ops *ops;
66341
66342 struct snd_rawmidi_str streams[2];
66343
66344@@ -151,7 +151,7 @@ int snd_rawmidi_new(struct snd_card *car
66345 int output_count, int input_count,
66346 struct snd_rawmidi **rmidi);
66347 void snd_rawmidi_set_ops(struct snd_rawmidi *rmidi, int stream,
66348- struct snd_rawmidi_ops *ops);
66349+ const struct snd_rawmidi_ops *ops);
66350
66351 /* callbacks */
66352
66353diff -urNp linux-2.6.39.2/include/sound/seq_device.h linux-2.6.39.2/include/sound/seq_device.h
66354--- linux-2.6.39.2/include/sound/seq_device.h 2011-05-19 00:06:34.000000000 -0400
66355+++ linux-2.6.39.2/include/sound/seq_device.h 2011-05-22 19:36:33.000000000 -0400
66356@@ -69,7 +69,7 @@ struct snd_seq_dev_ops {
66357 */
66358 void snd_seq_device_load_drivers(void);
66359 int snd_seq_device_new(struct snd_card *card, int device, char *id, int argsize, struct snd_seq_device **result);
66360-int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry, int argsize);
66361+int snd_seq_device_register_driver(char *id, const struct snd_seq_dev_ops *entry, int argsize);
66362 int snd_seq_device_unregister_driver(char *id);
66363
66364 #define SNDRV_SEQ_DEVICE_ARGPTR(dev) (void *)((char *)(dev) + sizeof(struct snd_seq_device))
66365diff -urNp linux-2.6.39.2/include/sound/snd_wavefront.h linux-2.6.39.2/include/sound/snd_wavefront.h
66366--- linux-2.6.39.2/include/sound/snd_wavefront.h 2011-05-19 00:06:34.000000000 -0400
66367+++ linux-2.6.39.2/include/sound/snd_wavefront.h 2011-05-22 19:36:33.000000000 -0400
66368@@ -37,8 +37,8 @@ struct _snd_wavefront_midi {
66369 #define MPU_ACK 0xFE
66370 #define UART_MODE_ON 0x3F
66371
66372-extern struct snd_rawmidi_ops snd_wavefront_midi_output;
66373-extern struct snd_rawmidi_ops snd_wavefront_midi_input;
66374+extern const struct snd_rawmidi_ops snd_wavefront_midi_output;
66375+extern const struct snd_rawmidi_ops snd_wavefront_midi_input;
66376
66377 extern void snd_wavefront_midi_enable_virtual (snd_wavefront_card_t *);
66378 extern void snd_wavefront_midi_disable_virtual (snd_wavefront_card_t *);
66379diff -urNp linux-2.6.39.2/include/sound/soc.h linux-2.6.39.2/include/sound/soc.h
66380--- linux-2.6.39.2/include/sound/soc.h 2011-05-19 00:06:34.000000000 -0400
66381+++ linux-2.6.39.2/include/sound/soc.h 2011-05-22 19:36:33.000000000 -0400
66382@@ -245,7 +245,7 @@ struct snd_soc_jack_gpio;
66383
66384 typedef int (*hw_write_t)(void *,const char* ,int);
66385
66386-extern struct snd_ac97_bus_ops soc_ac97_ops;
66387+extern const struct snd_ac97_bus_ops soc_ac97_ops;
66388
66389 enum snd_soc_control_type {
66390 SND_SOC_CUSTOM,
66391diff -urNp linux-2.6.39.2/include/sound/ymfpci.h linux-2.6.39.2/include/sound/ymfpci.h
66392--- linux-2.6.39.2/include/sound/ymfpci.h 2011-05-19 00:06:34.000000000 -0400
66393+++ linux-2.6.39.2/include/sound/ymfpci.h 2011-05-22 19:36:33.000000000 -0400
66394@@ -358,7 +358,7 @@ struct snd_ymfpci {
66395 spinlock_t reg_lock;
66396 spinlock_t voice_lock;
66397 wait_queue_head_t interrupt_sleep;
66398- atomic_t interrupt_sleep_count;
66399+ atomic_unchecked_t interrupt_sleep_count;
66400 struct snd_info_entry *proc_entry;
66401 const struct firmware *dsp_microcode;
66402 const struct firmware *controller_microcode;
66403diff -urNp linux-2.6.39.2/include/target/target_core_base.h linux-2.6.39.2/include/target/target_core_base.h
66404--- linux-2.6.39.2/include/target/target_core_base.h 2011-06-03 00:04:14.000000000 -0400
66405+++ linux-2.6.39.2/include/target/target_core_base.h 2011-06-03 00:32:08.000000000 -0400
66406@@ -432,8 +432,8 @@ struct se_transport_task {
66407 atomic_t t_task_cdbs_left;
66408 atomic_t t_task_cdbs_ex_left;
66409 atomic_t t_task_cdbs_timeout_left;
66410- atomic_t t_task_cdbs_sent;
66411- atomic_t t_transport_aborted;
66412+ atomic_unchecked_t t_task_cdbs_sent;
66413+ atomic_unchecked_t t_transport_aborted;
66414 atomic_t t_transport_active;
66415 atomic_t t_transport_complete;
66416 atomic_t t_transport_queue_active;
66417@@ -774,7 +774,7 @@ struct se_device {
66418 atomic_t active_cmds;
66419 atomic_t simple_cmds;
66420 atomic_t depth_left;
66421- atomic_t dev_ordered_id;
66422+ atomic_unchecked_t dev_ordered_id;
66423 atomic_t dev_tur_active;
66424 atomic_t execute_tasks;
66425 atomic_t dev_status_thr_count;
66426diff -urNp linux-2.6.39.2/include/trace/events/irq.h linux-2.6.39.2/include/trace/events/irq.h
66427--- linux-2.6.39.2/include/trace/events/irq.h 2011-05-19 00:06:34.000000000 -0400
66428+++ linux-2.6.39.2/include/trace/events/irq.h 2011-05-22 19:36:33.000000000 -0400
66429@@ -36,7 +36,7 @@ struct softirq_action;
66430 */
66431 TRACE_EVENT(irq_handler_entry,
66432
66433- TP_PROTO(int irq, struct irqaction *action),
66434+ TP_PROTO(int irq, const struct irqaction *action),
66435
66436 TP_ARGS(irq, action),
66437
66438@@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
66439 */
66440 TRACE_EVENT(irq_handler_exit,
66441
66442- TP_PROTO(int irq, struct irqaction *action, int ret),
66443+ TP_PROTO(int irq, const struct irqaction *action, int ret),
66444
66445 TP_ARGS(irq, action, ret),
66446
66447diff -urNp linux-2.6.39.2/include/video/udlfb.h linux-2.6.39.2/include/video/udlfb.h
66448--- linux-2.6.39.2/include/video/udlfb.h 2011-05-19 00:06:34.000000000 -0400
66449+++ linux-2.6.39.2/include/video/udlfb.h 2011-05-22 19:36:33.000000000 -0400
66450@@ -51,10 +51,10 @@ struct dlfb_data {
66451 int base8;
66452 u32 pseudo_palette[256];
66453 /* blit-only rendering path metrics, exposed through sysfs */
66454- atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66455- atomic_t bytes_identical; /* saved effort with backbuffer comparison */
66456- atomic_t bytes_sent; /* to usb, after compression including overhead */
66457- atomic_t cpu_kcycles_used; /* transpired during pixel processing */
66458+ atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66459+ atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
66460+ atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
66461+ atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
66462 };
66463
66464 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
66465diff -urNp linux-2.6.39.2/include/video/uvesafb.h linux-2.6.39.2/include/video/uvesafb.h
66466--- linux-2.6.39.2/include/video/uvesafb.h 2011-05-19 00:06:34.000000000 -0400
66467+++ linux-2.6.39.2/include/video/uvesafb.h 2011-05-22 19:36:33.000000000 -0400
66468@@ -177,6 +177,7 @@ struct uvesafb_par {
66469 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
66470 u8 pmi_setpal; /* PMI for palette changes */
66471 u16 *pmi_base; /* protected mode interface location */
66472+ u8 *pmi_code; /* protected mode code location */
66473 void *pmi_start;
66474 void *pmi_pal;
66475 u8 *vbe_state_orig; /*
66476diff -urNp linux-2.6.39.2/init/do_mounts.c linux-2.6.39.2/init/do_mounts.c
66477--- linux-2.6.39.2/init/do_mounts.c 2011-05-19 00:06:34.000000000 -0400
66478+++ linux-2.6.39.2/init/do_mounts.c 2011-05-22 19:36:33.000000000 -0400
66479@@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa
66480
66481 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
66482 {
66483- int err = sys_mount(name, "/root", fs, flags, data);
66484+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
66485 if (err)
66486 return err;
66487
66488@@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...
66489 va_start(args, fmt);
66490 vsprintf(buf, fmt, args);
66491 va_end(args);
66492- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
66493+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
66494 if (fd >= 0) {
66495 sys_ioctl(fd, FDEJECT, 0);
66496 sys_close(fd);
66497 }
66498 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
66499- fd = sys_open("/dev/console", O_RDWR, 0);
66500+ fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
66501 if (fd >= 0) {
66502 sys_ioctl(fd, TCGETS, (long)&termios);
66503 termios.c_lflag &= ~ICANON;
66504 sys_ioctl(fd, TCSETSF, (long)&termios);
66505- sys_read(fd, &c, 1);
66506+ sys_read(fd, (char __user *)&c, 1);
66507 termios.c_lflag |= ICANON;
66508 sys_ioctl(fd, TCSETSF, (long)&termios);
66509 sys_close(fd);
66510@@ -488,6 +488,6 @@ void __init prepare_namespace(void)
66511 mount_root();
66512 out:
66513 devtmpfs_mount("dev");
66514- sys_mount(".", "/", NULL, MS_MOVE, NULL);
66515+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66516 sys_chroot((const char __user __force *)".");
66517 }
66518diff -urNp linux-2.6.39.2/init/do_mounts.h linux-2.6.39.2/init/do_mounts.h
66519--- linux-2.6.39.2/init/do_mounts.h 2011-05-19 00:06:34.000000000 -0400
66520+++ linux-2.6.39.2/init/do_mounts.h 2011-05-22 19:36:33.000000000 -0400
66521@@ -15,15 +15,15 @@ extern int root_mountflags;
66522
66523 static inline int create_dev(char *name, dev_t dev)
66524 {
66525- sys_unlink(name);
66526- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
66527+ sys_unlink((__force char __user *)name);
66528+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
66529 }
66530
66531 #if BITS_PER_LONG == 32
66532 static inline u32 bstat(char *name)
66533 {
66534 struct stat64 stat;
66535- if (sys_stat64(name, &stat) != 0)
66536+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
66537 return 0;
66538 if (!S_ISBLK(stat.st_mode))
66539 return 0;
66540diff -urNp linux-2.6.39.2/init/do_mounts_initrd.c linux-2.6.39.2/init/do_mounts_initrd.c
66541--- linux-2.6.39.2/init/do_mounts_initrd.c 2011-05-19 00:06:34.000000000 -0400
66542+++ linux-2.6.39.2/init/do_mounts_initrd.c 2011-05-22 19:36:33.000000000 -0400
66543@@ -44,13 +44,13 @@ static void __init handle_initrd(void)
66544 create_dev("/dev/root.old", Root_RAM0);
66545 /* mount initrd on rootfs' /root */
66546 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
66547- sys_mkdir("/old", 0700);
66548- root_fd = sys_open("/", 0, 0);
66549- old_fd = sys_open("/old", 0, 0);
66550+ sys_mkdir((__force const char __user *)"/old", 0700);
66551+ root_fd = sys_open((__force const char __user *)"/", 0, 0);
66552+ old_fd = sys_open((__force const char __user *)"/old", 0, 0);
66553 /* move initrd over / and chdir/chroot in initrd root */
66554- sys_chdir("/root");
66555- sys_mount(".", "/", NULL, MS_MOVE, NULL);
66556- sys_chroot(".");
66557+ sys_chdir((__force const char __user *)"/root");
66558+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66559+ sys_chroot((__force const char __user *)".");
66560
66561 /*
66562 * In case that a resume from disk is carried out by linuxrc or one of
66563@@ -67,15 +67,15 @@ static void __init handle_initrd(void)
66564
66565 /* move initrd to rootfs' /old */
66566 sys_fchdir(old_fd);
66567- sys_mount("/", ".", NULL, MS_MOVE, NULL);
66568+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
66569 /* switch root and cwd back to / of rootfs */
66570 sys_fchdir(root_fd);
66571- sys_chroot(".");
66572+ sys_chroot((__force const char __user *)".");
66573 sys_close(old_fd);
66574 sys_close(root_fd);
66575
66576 if (new_decode_dev(real_root_dev) == Root_RAM0) {
66577- sys_chdir("/old");
66578+ sys_chdir((__force const char __user *)"/old");
66579 return;
66580 }
66581
66582@@ -83,17 +83,17 @@ static void __init handle_initrd(void)
66583 mount_root();
66584
66585 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
66586- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
66587+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
66588 if (!error)
66589 printk("okay\n");
66590 else {
66591- int fd = sys_open("/dev/root.old", O_RDWR, 0);
66592+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
66593 if (error == -ENOENT)
66594 printk("/initrd does not exist. Ignored.\n");
66595 else
66596 printk("failed\n");
66597 printk(KERN_NOTICE "Unmounting old root\n");
66598- sys_umount("/old", MNT_DETACH);
66599+ sys_umount((__force char __user *)"/old", MNT_DETACH);
66600 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
66601 if (fd < 0) {
66602 error = fd;
66603@@ -116,11 +116,11 @@ int __init initrd_load(void)
66604 * mounted in the normal path.
66605 */
66606 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
66607- sys_unlink("/initrd.image");
66608+ sys_unlink((__force const char __user *)"/initrd.image");
66609 handle_initrd();
66610 return 1;
66611 }
66612 }
66613- sys_unlink("/initrd.image");
66614+ sys_unlink((__force const char __user *)"/initrd.image");
66615 return 0;
66616 }
66617diff -urNp linux-2.6.39.2/init/do_mounts_md.c linux-2.6.39.2/init/do_mounts_md.c
66618--- linux-2.6.39.2/init/do_mounts_md.c 2011-05-19 00:06:34.000000000 -0400
66619+++ linux-2.6.39.2/init/do_mounts_md.c 2011-05-22 19:36:33.000000000 -0400
66620@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
66621 partitioned ? "_d" : "", minor,
66622 md_setup_args[ent].device_names);
66623
66624- fd = sys_open(name, 0, 0);
66625+ fd = sys_open((__force char __user *)name, 0, 0);
66626 if (fd < 0) {
66627 printk(KERN_ERR "md: open failed - cannot start "
66628 "array %s\n", name);
66629@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
66630 * array without it
66631 */
66632 sys_close(fd);
66633- fd = sys_open(name, 0, 0);
66634+ fd = sys_open((__force char __user *)name, 0, 0);
66635 sys_ioctl(fd, BLKRRPART, 0);
66636 }
66637 sys_close(fd);
66638diff -urNp linux-2.6.39.2/init/initramfs.c linux-2.6.39.2/init/initramfs.c
66639--- linux-2.6.39.2/init/initramfs.c 2011-05-19 00:06:34.000000000 -0400
66640+++ linux-2.6.39.2/init/initramfs.c 2011-05-22 19:36:33.000000000 -0400
66641@@ -74,7 +74,7 @@ static void __init free_hash(void)
66642 }
66643 }
66644
66645-static long __init do_utime(char __user *filename, time_t mtime)
66646+static long __init do_utime(__force char __user *filename, time_t mtime)
66647 {
66648 struct timespec t[2];
66649
66650@@ -109,7 +109,7 @@ static void __init dir_utime(void)
66651 struct dir_entry *de, *tmp;
66652 list_for_each_entry_safe(de, tmp, &dir_list, list) {
66653 list_del(&de->list);
66654- do_utime(de->name, de->mtime);
66655+ do_utime((__force char __user *)de->name, de->mtime);
66656 kfree(de->name);
66657 kfree(de);
66658 }
66659@@ -271,7 +271,7 @@ static int __init maybe_link(void)
66660 if (nlink >= 2) {
66661 char *old = find_link(major, minor, ino, mode, collected);
66662 if (old)
66663- return (sys_link(old, collected) < 0) ? -1 : 1;
66664+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
66665 }
66666 return 0;
66667 }
66668@@ -280,11 +280,11 @@ static void __init clean_path(char *path
66669 {
66670 struct stat st;
66671
66672- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
66673+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
66674 if (S_ISDIR(st.st_mode))
66675- sys_rmdir(path);
66676+ sys_rmdir((__force char __user *)path);
66677 else
66678- sys_unlink(path);
66679+ sys_unlink((__force char __user *)path);
66680 }
66681 }
66682
66683@@ -305,7 +305,7 @@ static int __init do_name(void)
66684 int openflags = O_WRONLY|O_CREAT;
66685 if (ml != 1)
66686 openflags |= O_TRUNC;
66687- wfd = sys_open(collected, openflags, mode);
66688+ wfd = sys_open((__force char __user *)collected, openflags, mode);
66689
66690 if (wfd >= 0) {
66691 sys_fchown(wfd, uid, gid);
66692@@ -317,17 +317,17 @@ static int __init do_name(void)
66693 }
66694 }
66695 } else if (S_ISDIR(mode)) {
66696- sys_mkdir(collected, mode);
66697- sys_chown(collected, uid, gid);
66698- sys_chmod(collected, mode);
66699+ sys_mkdir((__force char __user *)collected, mode);
66700+ sys_chown((__force char __user *)collected, uid, gid);
66701+ sys_chmod((__force char __user *)collected, mode);
66702 dir_add(collected, mtime);
66703 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
66704 S_ISFIFO(mode) || S_ISSOCK(mode)) {
66705 if (maybe_link() == 0) {
66706- sys_mknod(collected, mode, rdev);
66707- sys_chown(collected, uid, gid);
66708- sys_chmod(collected, mode);
66709- do_utime(collected, mtime);
66710+ sys_mknod((__force char __user *)collected, mode, rdev);
66711+ sys_chown((__force char __user *)collected, uid, gid);
66712+ sys_chmod((__force char __user *)collected, mode);
66713+ do_utime((__force char __user *)collected, mtime);
66714 }
66715 }
66716 return 0;
66717@@ -336,15 +336,15 @@ static int __init do_name(void)
66718 static int __init do_copy(void)
66719 {
66720 if (count >= body_len) {
66721- sys_write(wfd, victim, body_len);
66722+ sys_write(wfd, (__force char __user *)victim, body_len);
66723 sys_close(wfd);
66724- do_utime(vcollected, mtime);
66725+ do_utime((__force char __user *)vcollected, mtime);
66726 kfree(vcollected);
66727 eat(body_len);
66728 state = SkipIt;
66729 return 0;
66730 } else {
66731- sys_write(wfd, victim, count);
66732+ sys_write(wfd, (__force char __user *)victim, count);
66733 body_len -= count;
66734 eat(count);
66735 return 1;
66736@@ -355,9 +355,9 @@ static int __init do_symlink(void)
66737 {
66738 collected[N_ALIGN(name_len) + body_len] = '\0';
66739 clean_path(collected, 0);
66740- sys_symlink(collected + N_ALIGN(name_len), collected);
66741- sys_lchown(collected, uid, gid);
66742- do_utime(collected, mtime);
66743+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
66744+ sys_lchown((__force char __user *)collected, uid, gid);
66745+ do_utime((__force char __user *)collected, mtime);
66746 state = SkipIt;
66747 next_state = Reset;
66748 return 0;
66749diff -urNp linux-2.6.39.2/init/Kconfig linux-2.6.39.2/init/Kconfig
66750--- linux-2.6.39.2/init/Kconfig 2011-05-19 00:06:34.000000000 -0400
66751+++ linux-2.6.39.2/init/Kconfig 2011-05-22 19:36:33.000000000 -0400
66752@@ -1202,7 +1202,7 @@ config SLUB_DEBUG
66753
66754 config COMPAT_BRK
66755 bool "Disable heap randomization"
66756- default y
66757+ default n
66758 help
66759 Randomizing heap placement makes heap exploits harder, but it
66760 also breaks ancient binaries (including anything libc5 based).
66761diff -urNp linux-2.6.39.2/init/main.c linux-2.6.39.2/init/main.c
66762--- linux-2.6.39.2/init/main.c 2011-06-03 00:04:14.000000000 -0400
66763+++ linux-2.6.39.2/init/main.c 2011-06-03 00:32:08.000000000 -0400
66764@@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void)
66765 extern void tc_init(void);
66766 #endif
66767
66768+extern void grsecurity_init(void);
66769+
66770 /*
66771 * Debug helper: via this flag we know that we are in 'early bootup code'
66772 * where only the boot processor is running with IRQ disabled. This means
66773@@ -149,6 +151,49 @@ static int __init set_reset_devices(char
66774
66775 __setup("reset_devices", set_reset_devices);
66776
66777+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
66778+extern char pax_enter_kernel_user[];
66779+extern char pax_exit_kernel_user[];
66780+extern pgdval_t clone_pgd_mask;
66781+#endif
66782+
66783+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
66784+static int __init setup_pax_nouderef(char *str)
66785+{
66786+#ifdef CONFIG_X86_32
66787+ unsigned int cpu;
66788+ struct desc_struct *gdt;
66789+
66790+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
66791+ gdt = get_cpu_gdt_table(cpu);
66792+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
66793+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
66794+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
66795+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
66796+ }
66797+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
66798+#else
66799+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
66800+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
66801+ clone_pgd_mask = ~(pgdval_t)0UL;
66802+#endif
66803+
66804+ return 0;
66805+}
66806+early_param("pax_nouderef", setup_pax_nouderef);
66807+#endif
66808+
66809+#ifdef CONFIG_PAX_SOFTMODE
66810+unsigned int pax_softmode;
66811+
66812+static int __init setup_pax_softmode(char *str)
66813+{
66814+ get_option(&str, &pax_softmode);
66815+ return 1;
66816+}
66817+__setup("pax_softmode=", setup_pax_softmode);
66818+#endif
66819+
66820 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
66821 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
66822 static const char *panic_later, *panic_param;
66823@@ -663,6 +708,7 @@ int __init_or_module do_one_initcall(ini
66824 {
66825 int count = preempt_count();
66826 int ret;
66827+ const char *msg1 = "", *msg2 = "";
66828
66829 if (initcall_debug)
66830 ret = do_one_initcall_debug(fn);
66831@@ -675,15 +721,15 @@ int __init_or_module do_one_initcall(ini
66832 sprintf(msgbuf, "error code %d ", ret);
66833
66834 if (preempt_count() != count) {
66835- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
66836+ msg1 = " preemption imbalance";
66837 preempt_count() = count;
66838 }
66839 if (irqs_disabled()) {
66840- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
66841+ msg2 = " disabled interrupts";
66842 local_irq_enable();
66843 }
66844- if (msgbuf[0]) {
66845- printk("initcall %pF returned with %s\n", fn, msgbuf);
66846+ if (msgbuf[0] || *msg1 || *msg2) {
66847+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
66848 }
66849
66850 return ret;
66851@@ -801,7 +847,7 @@ static int __init kernel_init(void * unu
66852 do_basic_setup();
66853
66854 /* Open the /dev/console on the rootfs, this should never fail */
66855- if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
66856+ if (sys_open((__force const char __user *) "/dev/console", O_RDWR, 0) < 0)
66857 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
66858
66859 (void) sys_dup(0);
66860@@ -814,11 +860,13 @@ static int __init kernel_init(void * unu
66861 if (!ramdisk_execute_command)
66862 ramdisk_execute_command = "/init";
66863
66864- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
66865+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
66866 ramdisk_execute_command = NULL;
66867 prepare_namespace();
66868 }
66869
66870+ grsecurity_init();
66871+
66872 /*
66873 * Ok, we have completed the initial bootup, and
66874 * we're essentially up and running. Get rid of the
66875diff -urNp linux-2.6.39.2/ipc/mqueue.c linux-2.6.39.2/ipc/mqueue.c
66876--- linux-2.6.39.2/ipc/mqueue.c 2011-05-19 00:06:34.000000000 -0400
66877+++ linux-2.6.39.2/ipc/mqueue.c 2011-05-22 19:41:42.000000000 -0400
66878@@ -154,6 +154,7 @@ static struct inode *mqueue_get_inode(st
66879 mq_bytes = (mq_msg_tblsz +
66880 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
66881
66882+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
66883 spin_lock(&mq_lock);
66884 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
66885 u->mq_bytes + mq_bytes >
66886diff -urNp linux-2.6.39.2/ipc/sem.c linux-2.6.39.2/ipc/sem.c
66887--- linux-2.6.39.2/ipc/sem.c 2011-05-19 00:06:34.000000000 -0400
66888+++ linux-2.6.39.2/ipc/sem.c 2011-05-22 19:36:33.000000000 -0400
66889@@ -854,6 +854,8 @@ static int semctl_main(struct ipc_namesp
66890 int nsems;
66891 struct list_head tasks;
66892
66893+ pax_track_stack();
66894+
66895 sma = sem_lock_check(ns, semid);
66896 if (IS_ERR(sma))
66897 return PTR_ERR(sma);
66898@@ -1301,6 +1303,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
66899 struct ipc_namespace *ns;
66900 struct list_head tasks;
66901
66902+ pax_track_stack();
66903+
66904 ns = current->nsproxy->ipc_ns;
66905
66906 if (nsops < 1 || semid < 0)
66907diff -urNp linux-2.6.39.2/ipc/shm.c linux-2.6.39.2/ipc/shm.c
66908--- linux-2.6.39.2/ipc/shm.c 2011-05-19 00:06:34.000000000 -0400
66909+++ linux-2.6.39.2/ipc/shm.c 2011-05-22 19:41:42.000000000 -0400
66910@@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
66911 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
66912 #endif
66913
66914+#ifdef CONFIG_GRKERNSEC
66915+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66916+ const time_t shm_createtime, const uid_t cuid,
66917+ const int shmid);
66918+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66919+ const time_t shm_createtime);
66920+#endif
66921+
66922 void shm_init_ns(struct ipc_namespace *ns)
66923 {
66924 ns->shm_ctlmax = SHMMAX;
66925@@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace *
66926 shp->shm_lprid = 0;
66927 shp->shm_atim = shp->shm_dtim = 0;
66928 shp->shm_ctim = get_seconds();
66929+#ifdef CONFIG_GRKERNSEC
66930+ {
66931+ struct timespec timeval;
66932+ do_posix_clock_monotonic_gettime(&timeval);
66933+
66934+ shp->shm_createtime = timeval.tv_sec;
66935+ }
66936+#endif
66937 shp->shm_segsz = size;
66938 shp->shm_nattch = 0;
66939 shp->shm_file = file;
66940@@ -762,8 +778,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
66941 case SHM_LOCK:
66942 case SHM_UNLOCK:
66943 {
66944- struct file *uninitialized_var(shm_file);
66945-
66946 lru_add_drain_all(); /* drain pagevecs to lru lists */
66947
66948 shp = shm_lock_check(ns, shmid);
66949@@ -896,9 +910,21 @@ long do_shmat(int shmid, char __user *sh
66950 if (err)
66951 goto out_unlock;
66952
66953+#ifdef CONFIG_GRKERNSEC
66954+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
66955+ shp->shm_perm.cuid, shmid) ||
66956+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
66957+ err = -EACCES;
66958+ goto out_unlock;
66959+ }
66960+#endif
66961+
66962 path = shp->shm_file->f_path;
66963 path_get(&path);
66964 shp->shm_nattch++;
66965+#ifdef CONFIG_GRKERNSEC
66966+ shp->shm_lapid = current->pid;
66967+#endif
66968 size = i_size_read(path.dentry->d_inode);
66969 shm_unlock(shp);
66970
66971diff -urNp linux-2.6.39.2/kernel/acct.c linux-2.6.39.2/kernel/acct.c
66972--- linux-2.6.39.2/kernel/acct.c 2011-05-19 00:06:34.000000000 -0400
66973+++ linux-2.6.39.2/kernel/acct.c 2011-05-22 19:36:33.000000000 -0400
66974@@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
66975 */
66976 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
66977 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
66978- file->f_op->write(file, (char *)&ac,
66979+ file->f_op->write(file, (__force char __user *)&ac,
66980 sizeof(acct_t), &file->f_pos);
66981 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
66982 set_fs(fs);
66983diff -urNp linux-2.6.39.2/kernel/audit.c linux-2.6.39.2/kernel/audit.c
66984--- linux-2.6.39.2/kernel/audit.c 2011-05-19 00:06:34.000000000 -0400
66985+++ linux-2.6.39.2/kernel/audit.c 2011-05-22 19:36:33.000000000 -0400
66986@@ -112,7 +112,7 @@ u32 audit_sig_sid = 0;
66987 3) suppressed due to audit_rate_limit
66988 4) suppressed due to audit_backlog_limit
66989 */
66990-static atomic_t audit_lost = ATOMIC_INIT(0);
66991+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
66992
66993 /* The netlink socket. */
66994 static struct sock *audit_sock;
66995@@ -234,7 +234,7 @@ void audit_log_lost(const char *message)
66996 unsigned long now;
66997 int print;
66998
66999- atomic_inc(&audit_lost);
67000+ atomic_inc_unchecked(&audit_lost);
67001
67002 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
67003
67004@@ -253,7 +253,7 @@ void audit_log_lost(const char *message)
67005 printk(KERN_WARNING
67006 "audit: audit_lost=%d audit_rate_limit=%d "
67007 "audit_backlog_limit=%d\n",
67008- atomic_read(&audit_lost),
67009+ atomic_read_unchecked(&audit_lost),
67010 audit_rate_limit,
67011 audit_backlog_limit);
67012 audit_panic(message);
67013@@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b
67014 status_set.pid = audit_pid;
67015 status_set.rate_limit = audit_rate_limit;
67016 status_set.backlog_limit = audit_backlog_limit;
67017- status_set.lost = atomic_read(&audit_lost);
67018+ status_set.lost = atomic_read_unchecked(&audit_lost);
67019 status_set.backlog = skb_queue_len(&audit_skb_queue);
67020 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
67021 &status_set, sizeof(status_set));
67022diff -urNp linux-2.6.39.2/kernel/auditsc.c linux-2.6.39.2/kernel/auditsc.c
67023--- linux-2.6.39.2/kernel/auditsc.c 2011-05-19 00:06:34.000000000 -0400
67024+++ linux-2.6.39.2/kernel/auditsc.c 2011-05-22 19:36:33.000000000 -0400
67025@@ -2111,7 +2111,7 @@ int auditsc_get_stamp(struct audit_conte
67026 }
67027
67028 /* global counter which is incremented every time something logs in */
67029-static atomic_t session_id = ATOMIC_INIT(0);
67030+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
67031
67032 /**
67033 * audit_set_loginuid - set a task's audit_context loginuid
67034@@ -2124,7 +2124,7 @@ static atomic_t session_id = ATOMIC_INIT
67035 */
67036 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
67037 {
67038- unsigned int sessionid = atomic_inc_return(&session_id);
67039+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
67040 struct audit_context *context = task->audit_context;
67041
67042 if (context && context->in_syscall) {
67043diff -urNp linux-2.6.39.2/kernel/capability.c linux-2.6.39.2/kernel/capability.c
67044--- linux-2.6.39.2/kernel/capability.c 2011-05-19 00:06:34.000000000 -0400
67045+++ linux-2.6.39.2/kernel/capability.c 2011-05-22 21:02:23.000000000 -0400
67046@@ -206,6 +206,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
67047 * before modification is attempted and the application
67048 * fails.
67049 */
67050+ if (tocopy > ARRAY_SIZE(kdata))
67051+ return -EFAULT;
67052+
67053 if (copy_to_user(dataptr, kdata, tocopy
67054 * sizeof(struct __user_cap_data_struct))) {
67055 return -EFAULT;
67056@@ -378,7 +381,7 @@ bool ns_capable(struct user_namespace *n
67057 BUG();
67058 }
67059
67060- if (security_capable(ns, current_cred(), cap) == 0) {
67061+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
67062 current->flags |= PF_SUPERPRIV;
67063 return true;
67064 }
67065@@ -386,6 +389,27 @@ bool ns_capable(struct user_namespace *n
67066 }
67067 EXPORT_SYMBOL(ns_capable);
67068
67069+bool ns_capable_nolog(struct user_namespace *ns, int cap)
67070+{
67071+ if (unlikely(!cap_valid(cap))) {
67072+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
67073+ BUG();
67074+ }
67075+
67076+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
67077+ current->flags |= PF_SUPERPRIV;
67078+ return true;
67079+ }
67080+ return false;
67081+}
67082+EXPORT_SYMBOL(ns_capable_nolog);
67083+
67084+bool capable_nolog(int cap)
67085+{
67086+ return ns_capable_nolog(&init_user_ns, cap);
67087+}
67088+EXPORT_SYMBOL(capable_nolog);
67089+
67090 /**
67091 * task_ns_capable - Determine whether current task has a superior
67092 * capability targeted at a specific task's user namespace.
67093@@ -400,6 +424,12 @@ bool task_ns_capable(struct task_struct
67094 }
67095 EXPORT_SYMBOL(task_ns_capable);
67096
67097+bool task_ns_capable_nolog(struct task_struct *t, int cap)
67098+{
67099+ return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
67100+}
67101+EXPORT_SYMBOL(task_ns_capable_nolog);
67102+
67103 /**
67104 * nsown_capable - Check superior capability to one's own user_ns
67105 * @cap: The capability in question
67106diff -urNp linux-2.6.39.2/kernel/cgroup.c linux-2.6.39.2/kernel/cgroup.c
67107--- linux-2.6.39.2/kernel/cgroup.c 2011-05-19 00:06:34.000000000 -0400
67108+++ linux-2.6.39.2/kernel/cgroup.c 2011-05-22 19:36:33.000000000 -0400
67109@@ -598,6 +598,8 @@ static struct css_set *find_css_set(
67110 struct hlist_head *hhead;
67111 struct cg_cgroup_link *link;
67112
67113+ pax_track_stack();
67114+
67115 /* First see if we already have a cgroup group that matches
67116 * the desired set */
67117 read_lock(&css_set_lock);
67118diff -urNp linux-2.6.39.2/kernel/compat.c linux-2.6.39.2/kernel/compat.c
67119--- linux-2.6.39.2/kernel/compat.c 2011-05-19 00:06:34.000000000 -0400
67120+++ linux-2.6.39.2/kernel/compat.c 2011-05-22 19:41:42.000000000 -0400
67121@@ -13,6 +13,7 @@
67122
67123 #include <linux/linkage.h>
67124 #include <linux/compat.h>
67125+#include <linux/module.h>
67126 #include <linux/errno.h>
67127 #include <linux/time.h>
67128 #include <linux/signal.h>
67129diff -urNp linux-2.6.39.2/kernel/configs.c linux-2.6.39.2/kernel/configs.c
67130--- linux-2.6.39.2/kernel/configs.c 2011-05-19 00:06:34.000000000 -0400
67131+++ linux-2.6.39.2/kernel/configs.c 2011-05-22 19:41:42.000000000 -0400
67132@@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
67133 struct proc_dir_entry *entry;
67134
67135 /* create the current config file */
67136+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
67137+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
67138+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
67139+ &ikconfig_file_ops);
67140+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
67141+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
67142+ &ikconfig_file_ops);
67143+#endif
67144+#else
67145 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
67146 &ikconfig_file_ops);
67147+#endif
67148+
67149 if (!entry)
67150 return -ENOMEM;
67151
67152diff -urNp linux-2.6.39.2/kernel/cred.c linux-2.6.39.2/kernel/cred.c
67153--- linux-2.6.39.2/kernel/cred.c 2011-05-19 00:06:34.000000000 -0400
67154+++ linux-2.6.39.2/kernel/cred.c 2011-05-22 19:41:42.000000000 -0400
67155@@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head
67156 */
67157 void __put_cred(struct cred *cred)
67158 {
67159+ pax_track_stack();
67160+
67161 kdebug("__put_cred(%p{%d,%d})", cred,
67162 atomic_read(&cred->usage),
67163 read_cred_subscribers(cred));
67164@@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
67165 {
67166 struct cred *cred;
67167
67168+ pax_track_stack();
67169+
67170 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
67171 atomic_read(&tsk->cred->usage),
67172 read_cred_subscribers(tsk->cred));
67173@@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct
67174 {
67175 const struct cred *cred;
67176
67177+ pax_track_stack();
67178+
67179 rcu_read_lock();
67180
67181 do {
67182@@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
67183 {
67184 struct cred *new;
67185
67186+ pax_track_stack();
67187+
67188 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
67189 if (!new)
67190 return NULL;
67191@@ -287,6 +295,8 @@ struct cred *prepare_creds(void)
67192 const struct cred *old;
67193 struct cred *new;
67194
67195+ pax_track_stack();
67196+
67197 validate_process_creds();
67198
67199 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
67200@@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void)
67201 struct thread_group_cred *tgcred = NULL;
67202 struct cred *new;
67203
67204+ pax_track_stack();
67205+
67206 #ifdef CONFIG_KEYS
67207 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
67208 if (!tgcred)
67209@@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un
67210 struct cred *new;
67211 int ret;
67212
67213+ pax_track_stack();
67214+
67215 if (
67216 #ifdef CONFIG_KEYS
67217 !p->cred->thread_keyring &&
67218@@ -475,6 +489,8 @@ int commit_creds(struct cred *new)
67219 struct task_struct *task = current;
67220 const struct cred *old = task->real_cred;
67221
67222+ pax_track_stack();
67223+
67224 kdebug("commit_creds(%p{%d,%d})", new,
67225 atomic_read(&new->usage),
67226 read_cred_subscribers(new));
67227@@ -489,6 +505,8 @@ int commit_creds(struct cred *new)
67228
67229 get_cred(new); /* we will require a ref for the subj creds too */
67230
67231+ gr_set_role_label(task, new->uid, new->gid);
67232+
67233 /* dumpability changes */
67234 if (old->euid != new->euid ||
67235 old->egid != new->egid ||
67236@@ -551,6 +569,8 @@ EXPORT_SYMBOL(commit_creds);
67237 */
67238 void abort_creds(struct cred *new)
67239 {
67240+ pax_track_stack();
67241+
67242 kdebug("abort_creds(%p{%d,%d})", new,
67243 atomic_read(&new->usage),
67244 read_cred_subscribers(new));
67245@@ -574,6 +594,8 @@ const struct cred *override_creds(const
67246 {
67247 const struct cred *old = current->cred;
67248
67249+ pax_track_stack();
67250+
67251 kdebug("override_creds(%p{%d,%d})", new,
67252 atomic_read(&new->usage),
67253 read_cred_subscribers(new));
67254@@ -603,6 +625,8 @@ void revert_creds(const struct cred *old
67255 {
67256 const struct cred *override = current->cred;
67257
67258+ pax_track_stack();
67259+
67260 kdebug("revert_creds(%p{%d,%d})", old,
67261 atomic_read(&old->usage),
67262 read_cred_subscribers(old));
67263@@ -649,6 +673,8 @@ struct cred *prepare_kernel_cred(struct
67264 const struct cred *old;
67265 struct cred *new;
67266
67267+ pax_track_stack();
67268+
67269 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
67270 if (!new)
67271 return NULL;
67272@@ -703,6 +729,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
67273 */
67274 int set_security_override(struct cred *new, u32 secid)
67275 {
67276+ pax_track_stack();
67277+
67278 return security_kernel_act_as(new, secid);
67279 }
67280 EXPORT_SYMBOL(set_security_override);
67281@@ -722,6 +750,8 @@ int set_security_override_from_ctx(struc
67282 u32 secid;
67283 int ret;
67284
67285+ pax_track_stack();
67286+
67287 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
67288 if (ret < 0)
67289 return ret;
67290diff -urNp linux-2.6.39.2/kernel/debug/debug_core.c linux-2.6.39.2/kernel/debug/debug_core.c
67291--- linux-2.6.39.2/kernel/debug/debug_core.c 2011-05-19 00:06:34.000000000 -0400
67292+++ linux-2.6.39.2/kernel/debug/debug_core.c 2011-05-22 19:36:33.000000000 -0400
67293@@ -72,7 +72,7 @@ int kgdb_io_module_registered;
67294 /* Guard for recursive entry */
67295 static int exception_level;
67296
67297-struct kgdb_io *dbg_io_ops;
67298+const struct kgdb_io *dbg_io_ops;
67299 static DEFINE_SPINLOCK(kgdb_registration_lock);
67300
67301 /* kgdb console driver is loaded */
67302@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
67303 */
67304 static atomic_t masters_in_kgdb;
67305 static atomic_t slaves_in_kgdb;
67306-static atomic_t kgdb_break_tasklet_var;
67307+static atomic_unchecked_t kgdb_break_tasklet_var;
67308 atomic_t kgdb_setting_breakpoint;
67309
67310 struct task_struct *kgdb_usethread;
67311@@ -129,7 +129,7 @@ int kgdb_single_step;
67312 static pid_t kgdb_sstep_pid;
67313
67314 /* to keep track of the CPU which is doing the single stepping*/
67315-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67316+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67317
67318 /*
67319 * If you are debugging a problem where roundup (the collection of
67320@@ -542,7 +542,7 @@ return_normal:
67321 * kernel will only try for the value of sstep_tries before
67322 * giving up and continuing on.
67323 */
67324- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
67325+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
67326 (kgdb_info[cpu].task &&
67327 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
67328 atomic_set(&kgdb_active, -1);
67329@@ -636,8 +636,8 @@ cpu_master_loop:
67330 }
67331
67332 kgdb_restore:
67333- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
67334- int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
67335+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
67336+ int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
67337 if (kgdb_info[sstep_cpu].task)
67338 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
67339 else
67340@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
67341 static void kgdb_tasklet_bpt(unsigned long ing)
67342 {
67343 kgdb_breakpoint();
67344- atomic_set(&kgdb_break_tasklet_var, 0);
67345+ atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
67346 }
67347
67348 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
67349
67350 void kgdb_schedule_breakpoint(void)
67351 {
67352- if (atomic_read(&kgdb_break_tasklet_var) ||
67353+ if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
67354 atomic_read(&kgdb_active) != -1 ||
67355 atomic_read(&kgdb_setting_breakpoint))
67356 return;
67357- atomic_inc(&kgdb_break_tasklet_var);
67358+ atomic_inc_unchecked(&kgdb_break_tasklet_var);
67359 tasklet_schedule(&kgdb_tasklet_breakpoint);
67360 }
67361 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
67362@@ -864,7 +864,7 @@ static void kgdb_initial_breakpoint(void
67363 *
67364 * Register it with the KGDB core.
67365 */
67366-int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
67367+int kgdb_register_io_module(const struct kgdb_io *new_dbg_io_ops)
67368 {
67369 int err;
67370
67371@@ -909,7 +909,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
67372 *
67373 * Unregister it with the KGDB core.
67374 */
67375-void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
67376+void kgdb_unregister_io_module(const struct kgdb_io *old_dbg_io_ops)
67377 {
67378 BUG_ON(kgdb_connected);
67379
67380diff -urNp linux-2.6.39.2/kernel/debug/kdb/kdb_main.c linux-2.6.39.2/kernel/debug/kdb/kdb_main.c
67381--- linux-2.6.39.2/kernel/debug/kdb/kdb_main.c 2011-05-19 00:06:34.000000000 -0400
67382+++ linux-2.6.39.2/kernel/debug/kdb/kdb_main.c 2011-05-22 19:36:33.000000000 -0400
67383@@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
67384 list_for_each_entry(mod, kdb_modules, list) {
67385
67386 kdb_printf("%-20s%8u 0x%p ", mod->name,
67387- mod->core_size, (void *)mod);
67388+ mod->core_size_rx + mod->core_size_rw, (void *)mod);
67389 #ifdef CONFIG_MODULE_UNLOAD
67390 kdb_printf("%4d ", module_refcount(mod));
67391 #endif
67392@@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha
67393 kdb_printf(" (Loading)");
67394 else
67395 kdb_printf(" (Live)");
67396- kdb_printf(" 0x%p", mod->module_core);
67397+ kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
67398
67399 #ifdef CONFIG_MODULE_UNLOAD
67400 {
67401diff -urNp linux-2.6.39.2/kernel/exit.c linux-2.6.39.2/kernel/exit.c
67402--- linux-2.6.39.2/kernel/exit.c 2011-05-19 00:06:34.000000000 -0400
67403+++ linux-2.6.39.2/kernel/exit.c 2011-05-22 20:02:30.000000000 -0400
67404@@ -57,6 +57,10 @@
67405 #include <asm/pgtable.h>
67406 #include <asm/mmu_context.h>
67407
67408+#ifdef CONFIG_GRKERNSEC
67409+extern rwlock_t grsec_exec_file_lock;
67410+#endif
67411+
67412 static void exit_mm(struct task_struct * tsk);
67413
67414 static void __unhash_process(struct task_struct *p, bool group_dead)
67415@@ -169,6 +173,8 @@ void release_task(struct task_struct * p
67416 struct task_struct *leader;
67417 int zap_leader;
67418 repeat:
67419+ gr_del_task_from_ip_table(p);
67420+
67421 tracehook_prepare_release_task(p);
67422 /* don't need to get the RCU readlock here - the process is dead and
67423 * can't be modifying its own credentials. But shut RCU-lockdep up */
67424@@ -338,11 +344,22 @@ static void reparent_to_kthreadd(void)
67425 {
67426 write_lock_irq(&tasklist_lock);
67427
67428+#ifdef CONFIG_GRKERNSEC
67429+ write_lock(&grsec_exec_file_lock);
67430+ if (current->exec_file) {
67431+ fput(current->exec_file);
67432+ current->exec_file = NULL;
67433+ }
67434+ write_unlock(&grsec_exec_file_lock);
67435+#endif
67436+
67437 ptrace_unlink(current);
67438 /* Reparent to init */
67439 current->real_parent = current->parent = kthreadd_task;
67440 list_move_tail(&current->sibling, &current->real_parent->children);
67441
67442+ gr_set_kernel_label(current);
67443+
67444 /* Set the exit signal to SIGCHLD so we signal init on exit */
67445 current->exit_signal = SIGCHLD;
67446
67447@@ -394,7 +411,7 @@ int allow_signal(int sig)
67448 * know it'll be handled, so that they don't get converted to
67449 * SIGKILL or just silently dropped.
67450 */
67451- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
67452+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
67453 recalc_sigpending();
67454 spin_unlock_irq(&current->sighand->siglock);
67455 return 0;
67456@@ -430,6 +447,17 @@ void daemonize(const char *name, ...)
67457 vsnprintf(current->comm, sizeof(current->comm), name, args);
67458 va_end(args);
67459
67460+#ifdef CONFIG_GRKERNSEC
67461+ write_lock(&grsec_exec_file_lock);
67462+ if (current->exec_file) {
67463+ fput(current->exec_file);
67464+ current->exec_file = NULL;
67465+ }
67466+ write_unlock(&grsec_exec_file_lock);
67467+#endif
67468+
67469+ gr_set_kernel_label(current);
67470+
67471 /*
67472 * If we were started as result of loading a module, close all of the
67473 * user space pages. We don't need them, and if we didn't close them
67474@@ -905,15 +933,8 @@ NORET_TYPE void do_exit(long code)
67475 struct task_struct *tsk = current;
67476 int group_dead;
67477
67478- profile_task_exit(tsk);
67479-
67480- WARN_ON(atomic_read(&tsk->fs_excl));
67481- WARN_ON(blk_needs_flush_plug(tsk));
67482-
67483 if (unlikely(in_interrupt()))
67484 panic("Aiee, killing interrupt handler!");
67485- if (unlikely(!tsk->pid))
67486- panic("Attempted to kill the idle task!");
67487
67488 /*
67489 * If do_exit is called because this processes oopsed, it's possible
67490@@ -924,6 +945,14 @@ NORET_TYPE void do_exit(long code)
67491 */
67492 set_fs(USER_DS);
67493
67494+ profile_task_exit(tsk);
67495+
67496+ WARN_ON(atomic_read(&tsk->fs_excl));
67497+ WARN_ON(blk_needs_flush_plug(tsk));
67498+
67499+ if (unlikely(!tsk->pid))
67500+ panic("Attempted to kill the idle task!");
67501+
67502 tracehook_report_exit(&code);
67503
67504 validate_creds_for_do_exit(tsk);
67505@@ -984,6 +1013,9 @@ NORET_TYPE void do_exit(long code)
67506 tsk->exit_code = code;
67507 taskstats_exit(tsk, group_dead);
67508
67509+ gr_acl_handle_psacct(tsk, code);
67510+ gr_acl_handle_exit();
67511+
67512 exit_mm(tsk);
67513
67514 if (group_dead)
67515diff -urNp linux-2.6.39.2/kernel/fork.c linux-2.6.39.2/kernel/fork.c
67516--- linux-2.6.39.2/kernel/fork.c 2011-05-19 00:06:34.000000000 -0400
67517+++ linux-2.6.39.2/kernel/fork.c 2011-05-22 19:41:42.000000000 -0400
67518@@ -287,7 +287,7 @@ static struct task_struct *dup_task_stru
67519 *stackend = STACK_END_MAGIC; /* for overflow detection */
67520
67521 #ifdef CONFIG_CC_STACKPROTECTOR
67522- tsk->stack_canary = get_random_int();
67523+ tsk->stack_canary = pax_get_random_long();
67524 #endif
67525
67526 /* One for us, one for whoever does the "release_task()" (usually parent) */
67527@@ -309,13 +309,78 @@ out:
67528 }
67529
67530 #ifdef CONFIG_MMU
67531+static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
67532+{
67533+ struct vm_area_struct *tmp;
67534+ unsigned long charge;
67535+ struct mempolicy *pol;
67536+ struct file *file;
67537+
67538+ charge = 0;
67539+ if (mpnt->vm_flags & VM_ACCOUNT) {
67540+ unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67541+ if (security_vm_enough_memory(len))
67542+ goto fail_nomem;
67543+ charge = len;
67544+ }
67545+ tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67546+ if (!tmp)
67547+ goto fail_nomem;
67548+ *tmp = *mpnt;
67549+ tmp->vm_mm = mm;
67550+ INIT_LIST_HEAD(&tmp->anon_vma_chain);
67551+ pol = mpol_dup(vma_policy(mpnt));
67552+ if (IS_ERR(pol))
67553+ goto fail_nomem_policy;
67554+ vma_set_policy(tmp, pol);
67555+ if (anon_vma_fork(tmp, mpnt))
67556+ goto fail_nomem_anon_vma_fork;
67557+ tmp->vm_flags &= ~VM_LOCKED;
67558+ tmp->vm_next = tmp->vm_prev = NULL;
67559+ tmp->vm_mirror = NULL;
67560+ file = tmp->vm_file;
67561+ if (file) {
67562+ struct inode *inode = file->f_path.dentry->d_inode;
67563+ struct address_space *mapping = file->f_mapping;
67564+
67565+ get_file(file);
67566+ if (tmp->vm_flags & VM_DENYWRITE)
67567+ atomic_dec(&inode->i_writecount);
67568+ spin_lock(&mapping->i_mmap_lock);
67569+ if (tmp->vm_flags & VM_SHARED)
67570+ mapping->i_mmap_writable++;
67571+ tmp->vm_truncate_count = mpnt->vm_truncate_count;
67572+ flush_dcache_mmap_lock(mapping);
67573+ /* insert tmp into the share list, just after mpnt */
67574+ vma_prio_tree_add(tmp, mpnt);
67575+ flush_dcache_mmap_unlock(mapping);
67576+ spin_unlock(&mapping->i_mmap_lock);
67577+ }
67578+
67579+ /*
67580+ * Clear hugetlb-related page reserves for children. This only
67581+ * affects MAP_PRIVATE mappings. Faults generated by the child
67582+ * are not guaranteed to succeed, even if read-only
67583+ */
67584+ if (is_vm_hugetlb_page(tmp))
67585+ reset_vma_resv_huge_pages(tmp);
67586+
67587+ return tmp;
67588+
67589+fail_nomem_anon_vma_fork:
67590+ mpol_put(pol);
67591+fail_nomem_policy:
67592+ kmem_cache_free(vm_area_cachep, tmp);
67593+fail_nomem:
67594+ vm_unacct_memory(charge);
67595+ return NULL;
67596+}
67597+
67598 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
67599 {
67600 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
67601 struct rb_node **rb_link, *rb_parent;
67602 int retval;
67603- unsigned long charge;
67604- struct mempolicy *pol;
67605
67606 down_write(&oldmm->mmap_sem);
67607 flush_cache_dup_mm(oldmm);
67608@@ -327,8 +392,8 @@ static int dup_mmap(struct mm_struct *mm
67609 mm->locked_vm = 0;
67610 mm->mmap = NULL;
67611 mm->mmap_cache = NULL;
67612- mm->free_area_cache = oldmm->mmap_base;
67613- mm->cached_hole_size = ~0UL;
67614+ mm->free_area_cache = oldmm->free_area_cache;
67615+ mm->cached_hole_size = oldmm->cached_hole_size;
67616 mm->map_count = 0;
67617 cpumask_clear(mm_cpumask(mm));
67618 mm->mm_rb = RB_ROOT;
67619@@ -344,8 +409,6 @@ static int dup_mmap(struct mm_struct *mm
67620
67621 prev = NULL;
67622 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
67623- struct file *file;
67624-
67625 if (mpnt->vm_flags & VM_DONTCOPY) {
67626 long pages = vma_pages(mpnt);
67627 mm->total_vm -= pages;
67628@@ -353,56 +416,13 @@ static int dup_mmap(struct mm_struct *mm
67629 -pages);
67630 continue;
67631 }
67632- charge = 0;
67633- if (mpnt->vm_flags & VM_ACCOUNT) {
67634- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67635- if (security_vm_enough_memory(len))
67636- goto fail_nomem;
67637- charge = len;
67638- }
67639- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67640- if (!tmp)
67641- goto fail_nomem;
67642- *tmp = *mpnt;
67643- INIT_LIST_HEAD(&tmp->anon_vma_chain);
67644- pol = mpol_dup(vma_policy(mpnt));
67645- retval = PTR_ERR(pol);
67646- if (IS_ERR(pol))
67647- goto fail_nomem_policy;
67648- vma_set_policy(tmp, pol);
67649- tmp->vm_mm = mm;
67650- if (anon_vma_fork(tmp, mpnt))
67651- goto fail_nomem_anon_vma_fork;
67652- tmp->vm_flags &= ~VM_LOCKED;
67653- tmp->vm_next = tmp->vm_prev = NULL;
67654- file = tmp->vm_file;
67655- if (file) {
67656- struct inode *inode = file->f_path.dentry->d_inode;
67657- struct address_space *mapping = file->f_mapping;
67658-
67659- get_file(file);
67660- if (tmp->vm_flags & VM_DENYWRITE)
67661- atomic_dec(&inode->i_writecount);
67662- spin_lock(&mapping->i_mmap_lock);
67663- if (tmp->vm_flags & VM_SHARED)
67664- mapping->i_mmap_writable++;
67665- tmp->vm_truncate_count = mpnt->vm_truncate_count;
67666- flush_dcache_mmap_lock(mapping);
67667- /* insert tmp into the share list, just after mpnt */
67668- vma_prio_tree_add(tmp, mpnt);
67669- flush_dcache_mmap_unlock(mapping);
67670- spin_unlock(&mapping->i_mmap_lock);
67671+ tmp = dup_vma(mm, mpnt);
67672+ if (!tmp) {
67673+ retval = -ENOMEM;
67674+ goto out;
67675 }
67676
67677 /*
67678- * Clear hugetlb-related page reserves for children. This only
67679- * affects MAP_PRIVATE mappings. Faults generated by the child
67680- * are not guaranteed to succeed, even if read-only
67681- */
67682- if (is_vm_hugetlb_page(tmp))
67683- reset_vma_resv_huge_pages(tmp);
67684-
67685- /*
67686 * Link in the new vma and copy the page table entries.
67687 */
67688 *pprev = tmp;
67689@@ -423,6 +443,31 @@ static int dup_mmap(struct mm_struct *mm
67690 if (retval)
67691 goto out;
67692 }
67693+
67694+#ifdef CONFIG_PAX_SEGMEXEC
67695+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
67696+ struct vm_area_struct *mpnt_m;
67697+
67698+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
67699+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
67700+
67701+ if (!mpnt->vm_mirror)
67702+ continue;
67703+
67704+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
67705+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
67706+ mpnt->vm_mirror = mpnt_m;
67707+ } else {
67708+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
67709+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
67710+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
67711+ mpnt->vm_mirror->vm_mirror = mpnt;
67712+ }
67713+ }
67714+ BUG_ON(mpnt_m);
67715+ }
67716+#endif
67717+
67718 /* a new mm has just been created */
67719 arch_dup_mmap(oldmm, mm);
67720 retval = 0;
67721@@ -431,14 +476,6 @@ out:
67722 flush_tlb_mm(oldmm);
67723 up_write(&oldmm->mmap_sem);
67724 return retval;
67725-fail_nomem_anon_vma_fork:
67726- mpol_put(pol);
67727-fail_nomem_policy:
67728- kmem_cache_free(vm_area_cachep, tmp);
67729-fail_nomem:
67730- retval = -ENOMEM;
67731- vm_unacct_memory(charge);
67732- goto out;
67733 }
67734
67735 static inline int mm_alloc_pgd(struct mm_struct * mm)
67736@@ -785,13 +822,14 @@ static int copy_fs(unsigned long clone_f
67737 spin_unlock(&fs->lock);
67738 return -EAGAIN;
67739 }
67740- fs->users++;
67741+ atomic_inc(&fs->users);
67742 spin_unlock(&fs->lock);
67743 return 0;
67744 }
67745 tsk->fs = copy_fs_struct(fs);
67746 if (!tsk->fs)
67747 return -ENOMEM;
67748+ gr_set_chroot_entries(tsk, &tsk->fs->root);
67749 return 0;
67750 }
67751
67752@@ -1049,10 +1087,13 @@ static struct task_struct *copy_process(
67753 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
67754 #endif
67755 retval = -EAGAIN;
67756+
67757+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
67758+
67759 if (atomic_read(&p->real_cred->user->processes) >=
67760 task_rlimit(p, RLIMIT_NPROC)) {
67761- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
67762- p->real_cred->user != INIT_USER)
67763+ if (p->real_cred->user != INIT_USER &&
67764+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
67765 goto bad_fork_free;
67766 }
67767
67768@@ -1200,6 +1241,8 @@ static struct task_struct *copy_process(
67769 goto bad_fork_free_pid;
67770 }
67771
67772+ gr_copy_label(p);
67773+
67774 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
67775 /*
67776 * Clear TID on mm_release()?
67777@@ -1360,6 +1403,8 @@ bad_fork_cleanup_count:
67778 bad_fork_free:
67779 free_task(p);
67780 fork_out:
67781+ gr_log_forkfail(retval);
67782+
67783 return ERR_PTR(retval);
67784 }
67785
67786@@ -1448,6 +1493,8 @@ long do_fork(unsigned long clone_flags,
67787 if (clone_flags & CLONE_PARENT_SETTID)
67788 put_user(nr, parent_tidptr);
67789
67790+ gr_handle_brute_check();
67791+
67792 if (clone_flags & CLONE_VFORK) {
67793 p->vfork_done = &vfork;
67794 init_completion(&vfork);
67795@@ -1549,7 +1596,7 @@ static int unshare_fs(unsigned long unsh
67796 return 0;
67797
67798 /* don't need lock here; in the worst case we'll do useless copy */
67799- if (fs->users == 1)
67800+ if (atomic_read(&fs->users) == 1)
67801 return 0;
67802
67803 *new_fsp = copy_fs_struct(fs);
67804@@ -1636,7 +1683,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
67805 fs = current->fs;
67806 spin_lock(&fs->lock);
67807 current->fs = new_fs;
67808- if (--fs->users)
67809+ gr_set_chroot_entries(current, &current->fs->root);
67810+ if (atomic_dec_return(&fs->users))
67811 new_fs = NULL;
67812 else
67813 new_fs = fs;
67814diff -urNp linux-2.6.39.2/kernel/futex.c linux-2.6.39.2/kernel/futex.c
67815--- linux-2.6.39.2/kernel/futex.c 2011-05-19 00:06:34.000000000 -0400
67816+++ linux-2.6.39.2/kernel/futex.c 2011-05-22 22:41:57.000000000 -0400
67817@@ -54,6 +54,7 @@
67818 #include <linux/mount.h>
67819 #include <linux/pagemap.h>
67820 #include <linux/syscalls.h>
67821+#include <linux/ptrace.h>
67822 #include <linux/signal.h>
67823 #include <linux/module.h>
67824 #include <linux/magic.h>
67825@@ -236,6 +237,11 @@ get_futex_key(u32 __user *uaddr, int fsh
67826 struct page *page, *page_head;
67827 int err;
67828
67829+#ifdef CONFIG_PAX_SEGMEXEC
67830+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
67831+ return -EFAULT;
67832+#endif
67833+
67834 /*
67835 * The futex address must be "naturally" aligned.
67836 */
67837@@ -1833,6 +1839,8 @@ static int futex_wait(u32 __user *uaddr,
67838 struct futex_q q = futex_q_init;
67839 int ret;
67840
67841+ pax_track_stack();
67842+
67843 if (!bitset)
67844 return -EINVAL;
67845 q.bitset = bitset;
67846@@ -2229,6 +2237,8 @@ static int futex_wait_requeue_pi(u32 __u
67847 struct futex_q q = futex_q_init;
67848 int res, ret;
67849
67850+ pax_track_stack();
67851+
67852 if (!bitset)
67853 return -EINVAL;
67854
67855@@ -2401,7 +2411,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67856 {
67857 struct robust_list_head __user *head;
67858 unsigned long ret;
67859+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67860 const struct cred *cred = current_cred(), *pcred;
67861+#endif
67862
67863 if (!futex_cmpxchg_enabled)
67864 return -ENOSYS;
67865@@ -2417,6 +2429,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67866 if (!p)
67867 goto err_unlock;
67868 ret = -EPERM;
67869+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67870+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67871+ goto err_unlock;
67872+#else
67873 pcred = __task_cred(p);
67874 /* If victim is in different user_ns, then uids are not
67875 comparable, so we must have CAP_SYS_PTRACE */
67876@@ -2431,6 +2447,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67877 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67878 goto err_unlock;
67879 ok:
67880+#endif
67881 head = p->robust_list;
67882 rcu_read_unlock();
67883 }
67884@@ -2682,6 +2699,7 @@ static int __init futex_init(void)
67885 {
67886 u32 curval;
67887 int i;
67888+ mm_segment_t oldfs;
67889
67890 /*
67891 * This will fail and we want it. Some arch implementations do
67892@@ -2693,8 +2711,11 @@ static int __init futex_init(void)
67893 * implementation, the non-functional ones will return
67894 * -ENOSYS.
67895 */
67896+ oldfs = get_fs();
67897+ set_fs(USER_DS);
67898 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
67899 futex_cmpxchg_enabled = 1;
67900+ set_fs(oldfs);
67901
67902 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
67903 plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
67904diff -urNp linux-2.6.39.2/kernel/futex_compat.c linux-2.6.39.2/kernel/futex_compat.c
67905--- linux-2.6.39.2/kernel/futex_compat.c 2011-05-19 00:06:34.000000000 -0400
67906+++ linux-2.6.39.2/kernel/futex_compat.c 2011-05-22 22:42:09.000000000 -0400
67907@@ -10,6 +10,7 @@
67908 #include <linux/compat.h>
67909 #include <linux/nsproxy.h>
67910 #include <linux/futex.h>
67911+#include <linux/ptrace.h>
67912
67913 #include <asm/uaccess.h>
67914
67915@@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp
67916 {
67917 struct compat_robust_list_head __user *head;
67918 unsigned long ret;
67919- const struct cred *cred = current_cred(), *pcred;
67920+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67921+ const struct cred *cred = current_cred();
67922+ const struct cred *pcred;
67923+#endif
67924
67925 if (!futex_cmpxchg_enabled)
67926 return -ENOSYS;
67927@@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp
67928 if (!p)
67929 goto err_unlock;
67930 ret = -EPERM;
67931+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67932+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67933+ goto err_unlock;
67934+#else
67935 pcred = __task_cred(p);
67936 /* If victim is in different user_ns, then uids are not
67937 comparable, so we must have CAP_SYS_PTRACE */
67938@@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp
67939 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67940 goto err_unlock;
67941 ok:
67942+#endif
67943 head = p->compat_robust_list;
67944 rcu_read_unlock();
67945 }
67946diff -urNp linux-2.6.39.2/kernel/gcov/base.c linux-2.6.39.2/kernel/gcov/base.c
67947--- linux-2.6.39.2/kernel/gcov/base.c 2011-05-19 00:06:34.000000000 -0400
67948+++ linux-2.6.39.2/kernel/gcov/base.c 2011-05-22 19:36:33.000000000 -0400
67949@@ -102,11 +102,6 @@ void gcov_enable_events(void)
67950 }
67951
67952 #ifdef CONFIG_MODULES
67953-static inline int within(void *addr, void *start, unsigned long size)
67954-{
67955- return ((addr >= start) && (addr < start + size));
67956-}
67957-
67958 /* Update list and generate events when modules are unloaded. */
67959 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67960 void *data)
67961@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
67962 prev = NULL;
67963 /* Remove entries located in module from linked list. */
67964 for (info = gcov_info_head; info; info = info->next) {
67965- if (within(info, mod->module_core, mod->core_size)) {
67966+ if (within_module_core_rw((unsigned long)info, mod)) {
67967 if (prev)
67968 prev->next = info->next;
67969 else
67970diff -urNp linux-2.6.39.2/kernel/hrtimer.c linux-2.6.39.2/kernel/hrtimer.c
67971--- linux-2.6.39.2/kernel/hrtimer.c 2011-05-19 00:06:34.000000000 -0400
67972+++ linux-2.6.39.2/kernel/hrtimer.c 2011-05-22 19:36:33.000000000 -0400
67973@@ -1383,7 +1383,7 @@ void hrtimer_peek_ahead_timers(void)
67974 local_irq_restore(flags);
67975 }
67976
67977-static void run_hrtimer_softirq(struct softirq_action *h)
67978+static void run_hrtimer_softirq(void)
67979 {
67980 hrtimer_peek_ahead_timers();
67981 }
67982diff -urNp linux-2.6.39.2/kernel/irq/manage.c linux-2.6.39.2/kernel/irq/manage.c
67983--- linux-2.6.39.2/kernel/irq/manage.c 2011-05-19 00:06:34.000000000 -0400
67984+++ linux-2.6.39.2/kernel/irq/manage.c 2011-06-13 17:09:06.000000000 -0400
67985@@ -491,6 +491,9 @@ int irq_set_irq_wake(unsigned int irq, u
67986 struct irq_desc *desc = irq_get_desc_buslock(irq, &flags);
67987 int ret = 0;
67988
67989+ if (!desc)
67990+ return -EINVAL;
67991+
67992 /* wakeup-capable irqs can be shared between drivers that
67993 * don't need to have the same sleep mode behaviors.
67994 */
67995diff -urNp linux-2.6.39.2/kernel/jump_label.c linux-2.6.39.2/kernel/jump_label.c
67996--- linux-2.6.39.2/kernel/jump_label.c 2011-05-19 00:06:34.000000000 -0400
67997+++ linux-2.6.39.2/kernel/jump_label.c 2011-05-22 19:36:33.000000000 -0400
67998@@ -49,6 +49,17 @@ void jump_label_unlock(void)
67999 mutex_unlock(&jump_label_mutex);
68000 }
68001
68002+static void jump_label_swap(void *a, void *b, int size)
68003+{
68004+ struct jump_entry t;
68005+
68006+ t = *(struct jump_entry *)a;
68007+ pax_open_kernel();
68008+ *(struct jump_entry *)a = *(struct jump_entry *)b;
68009+ *(struct jump_entry *)b = t;
68010+ pax_close_kernel();
68011+}
68012+
68013 static int jump_label_cmp(const void *a, const void *b)
68014 {
68015 const struct jump_entry *jea = a;
68016@@ -70,7 +81,7 @@ sort_jump_label_entries(struct jump_entr
68017
68018 size = (((unsigned long)stop - (unsigned long)start)
68019 / sizeof(struct jump_entry));
68020- sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
68021+ sort(start, size, sizeof(struct jump_entry), jump_label_cmp, jump_label_swap);
68022 }
68023
68024 static struct jump_label_entry *get_jump_label_entry(jump_label_t key)
68025@@ -407,8 +418,11 @@ static void remove_jump_label_module_ini
68026 count = e_module->nr_entries;
68027 iter = e_module->table;
68028 while (count--) {
68029- if (within_module_init(iter->code, mod))
68030+ if (within_module_init(iter->code, mod)) {
68031+ pax_open_kernel();
68032 iter->key = 0;
68033+ pax_close_kernel();
68034+ }
68035 iter++;
68036 }
68037 }
68038diff -urNp linux-2.6.39.2/kernel/kallsyms.c linux-2.6.39.2/kernel/kallsyms.c
68039--- linux-2.6.39.2/kernel/kallsyms.c 2011-05-19 00:06:34.000000000 -0400
68040+++ linux-2.6.39.2/kernel/kallsyms.c 2011-05-22 19:41:42.000000000 -0400
68041@@ -11,6 +11,9 @@
68042 * Changed the compression method from stem compression to "table lookup"
68043 * compression (see scripts/kallsyms.c for a more complete description)
68044 */
68045+#ifdef CONFIG_GRKERNSEC_HIDESYM
68046+#define __INCLUDED_BY_HIDESYM 1
68047+#endif
68048 #include <linux/kallsyms.h>
68049 #include <linux/module.h>
68050 #include <linux/init.h>
68051@@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark
68052
68053 static inline int is_kernel_inittext(unsigned long addr)
68054 {
68055+ if (system_state != SYSTEM_BOOTING)
68056+ return 0;
68057+
68058 if (addr >= (unsigned long)_sinittext
68059 && addr <= (unsigned long)_einittext)
68060 return 1;
68061 return 0;
68062 }
68063
68064+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
68065+#ifdef CONFIG_MODULES
68066+static inline int is_module_text(unsigned long addr)
68067+{
68068+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
68069+ return 1;
68070+
68071+ addr = ktla_ktva(addr);
68072+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
68073+}
68074+#else
68075+static inline int is_module_text(unsigned long addr)
68076+{
68077+ return 0;
68078+}
68079+#endif
68080+#endif
68081+
68082 static inline int is_kernel_text(unsigned long addr)
68083 {
68084 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
68085@@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne
68086
68087 static inline int is_kernel(unsigned long addr)
68088 {
68089+
68090+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
68091+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
68092+ return 1;
68093+
68094+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
68095+#else
68096 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
68097+#endif
68098+
68099 return 1;
68100 return in_gate_area_no_mm(addr);
68101 }
68102
68103 static int is_ksym_addr(unsigned long addr)
68104 {
68105+
68106+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
68107+ if (is_module_text(addr))
68108+ return 0;
68109+#endif
68110+
68111 if (all_var)
68112 return is_kernel(addr);
68113
68114@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st
68115
68116 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
68117 {
68118- iter->name[0] = '\0';
68119 iter->nameoff = get_symbol_offset(new_pos);
68120 iter->pos = new_pos;
68121 }
68122@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo
68123 {
68124 struct kallsym_iter *iter = m->private;
68125
68126+#ifdef CONFIG_GRKERNSEC_HIDESYM
68127+ if (current_uid())
68128+ return 0;
68129+#endif
68130+
68131 /* Some debugging symbols have no name. Ignore them. */
68132 if (!iter->name[0])
68133 return 0;
68134@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i
68135 struct kallsym_iter *iter;
68136 int ret;
68137
68138- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
68139+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
68140 if (!iter)
68141 return -ENOMEM;
68142 reset_iter(iter, 0);
68143diff -urNp linux-2.6.39.2/kernel/kmod.c linux-2.6.39.2/kernel/kmod.c
68144--- linux-2.6.39.2/kernel/kmod.c 2011-05-19 00:06:34.000000000 -0400
68145+++ linux-2.6.39.2/kernel/kmod.c 2011-05-22 19:41:42.000000000 -0400
68146@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
68147 * If module auto-loading support is disabled then this function
68148 * becomes a no-operation.
68149 */
68150-int __request_module(bool wait, const char *fmt, ...)
68151+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
68152 {
68153- va_list args;
68154 char module_name[MODULE_NAME_LEN];
68155 unsigned int max_modprobes;
68156 int ret;
68157- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
68158+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
68159 static char *envp[] = { "HOME=/",
68160 "TERM=linux",
68161 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
68162@@ -80,9 +79,7 @@ int __request_module(bool wait, const ch
68163 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
68164 static int kmod_loop_msg;
68165
68166- va_start(args, fmt);
68167- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
68168- va_end(args);
68169+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
68170 if (ret >= MODULE_NAME_LEN)
68171 return -ENAMETOOLONG;
68172
68173@@ -90,6 +87,20 @@ int __request_module(bool wait, const ch
68174 if (ret)
68175 return ret;
68176
68177+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68178+ if (!current_uid()) {
68179+ /* hack to workaround consolekit/udisks stupidity */
68180+ read_lock(&tasklist_lock);
68181+ if (!strcmp(current->comm, "mount") &&
68182+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
68183+ read_unlock(&tasklist_lock);
68184+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
68185+ return -EPERM;
68186+ }
68187+ read_unlock(&tasklist_lock);
68188+ }
68189+#endif
68190+
68191 /* If modprobe needs a service that is in a module, we get a recursive
68192 * loop. Limit the number of running kmod threads to max_threads/2 or
68193 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
68194@@ -123,6 +134,47 @@ int __request_module(bool wait, const ch
68195 atomic_dec(&kmod_concurrent);
68196 return ret;
68197 }
68198+
68199+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
68200+{
68201+ va_list args;
68202+ int ret;
68203+
68204+ va_start(args, fmt);
68205+ ret = ____request_module(wait, module_param, fmt, args);
68206+ va_end(args);
68207+
68208+ return ret;
68209+}
68210+
68211+int __request_module(bool wait, const char *fmt, ...)
68212+{
68213+ va_list args;
68214+ int ret;
68215+
68216+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68217+ if (current_uid()) {
68218+ char module_param[MODULE_NAME_LEN];
68219+
68220+ memset(module_param, 0, sizeof(module_param));
68221+
68222+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
68223+
68224+ va_start(args, fmt);
68225+ ret = ____request_module(wait, module_param, fmt, args);
68226+ va_end(args);
68227+
68228+ return ret;
68229+ }
68230+#endif
68231+
68232+ va_start(args, fmt);
68233+ ret = ____request_module(wait, NULL, fmt, args);
68234+ va_end(args);
68235+
68236+ return ret;
68237+}
68238+
68239 EXPORT_SYMBOL(__request_module);
68240 #endif /* CONFIG_MODULES */
68241
68242diff -urNp linux-2.6.39.2/kernel/kprobes.c linux-2.6.39.2/kernel/kprobes.c
68243--- linux-2.6.39.2/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
68244+++ linux-2.6.39.2/kernel/kprobes.c 2011-05-22 19:36:33.000000000 -0400
68245@@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
68246 * kernel image and loaded module images reside. This is required
68247 * so x86_64 can correctly handle the %rip-relative fixups.
68248 */
68249- kip->insns = module_alloc(PAGE_SIZE);
68250+ kip->insns = module_alloc_exec(PAGE_SIZE);
68251 if (!kip->insns) {
68252 kfree(kip);
68253 return NULL;
68254@@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st
68255 */
68256 if (!list_is_singular(&kip->list)) {
68257 list_del(&kip->list);
68258- module_free(NULL, kip->insns);
68259+ module_free_exec(NULL, kip->insns);
68260 kfree(kip);
68261 }
68262 return 1;
68263@@ -1936,7 +1936,7 @@ static int __init init_kprobes(void)
68264 {
68265 int i, err = 0;
68266 unsigned long offset = 0, size = 0;
68267- char *modname, namebuf[128];
68268+ char *modname, namebuf[KSYM_NAME_LEN];
68269 const char *symbol_name;
68270 void *addr;
68271 struct kprobe_blackpoint *kb;
68272@@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st
68273 const char *sym = NULL;
68274 unsigned int i = *(loff_t *) v;
68275 unsigned long offset = 0;
68276- char *modname, namebuf[128];
68277+ char *modname, namebuf[KSYM_NAME_LEN];
68278
68279 head = &kprobe_table[i];
68280 preempt_disable();
68281diff -urNp linux-2.6.39.2/kernel/lockdep.c linux-2.6.39.2/kernel/lockdep.c
68282--- linux-2.6.39.2/kernel/lockdep.c 2011-06-25 12:55:23.000000000 -0400
68283+++ linux-2.6.39.2/kernel/lockdep.c 2011-06-25 13:00:28.000000000 -0400
68284@@ -571,6 +571,10 @@ static int static_obj(void *obj)
68285 end = (unsigned long) &_end,
68286 addr = (unsigned long) obj;
68287
68288+#ifdef CONFIG_PAX_KERNEXEC
68289+ start = ktla_ktva(start);
68290+#endif
68291+
68292 /*
68293 * static variable?
68294 */
68295@@ -706,6 +710,7 @@ register_lock_class(struct lockdep_map *
68296 if (!static_obj(lock->key)) {
68297 debug_locks_off();
68298 printk("INFO: trying to register non-static key.\n");
68299+ printk("lock:%pS key:%pS.\n", lock, lock->key);
68300 printk("the code is fine but needs lockdep annotation.\n");
68301 printk("turning off the locking correctness validator.\n");
68302 dump_stack();
68303@@ -2752,7 +2757,7 @@ static int __lock_acquire(struct lockdep
68304 if (!class)
68305 return 0;
68306 }
68307- atomic_inc((atomic_t *)&class->ops);
68308+ atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
68309 if (very_verbose(class)) {
68310 printk("\nacquire class [%p] %s", class->key, class->name);
68311 if (class->name_version > 1)
68312diff -urNp linux-2.6.39.2/kernel/lockdep_proc.c linux-2.6.39.2/kernel/lockdep_proc.c
68313--- linux-2.6.39.2/kernel/lockdep_proc.c 2011-05-19 00:06:34.000000000 -0400
68314+++ linux-2.6.39.2/kernel/lockdep_proc.c 2011-05-22 19:36:33.000000000 -0400
68315@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
68316
68317 static void print_name(struct seq_file *m, struct lock_class *class)
68318 {
68319- char str[128];
68320+ char str[KSYM_NAME_LEN];
68321 const char *name = class->name;
68322
68323 if (!name) {
68324diff -urNp linux-2.6.39.2/kernel/module.c linux-2.6.39.2/kernel/module.c
68325--- linux-2.6.39.2/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
68326+++ linux-2.6.39.2/kernel/module.c 2011-05-22 19:41:42.000000000 -0400
68327@@ -57,6 +57,7 @@
68328 #include <linux/kmemleak.h>
68329 #include <linux/jump_label.h>
68330 #include <linux/pfn.h>
68331+#include <linux/grsecurity.h>
68332
68333 #define CREATE_TRACE_POINTS
68334 #include <trace/events/module.h>
68335@@ -118,7 +119,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
68336
68337 /* Bounds of module allocation, for speeding __module_address.
68338 * Protected by module_mutex. */
68339-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
68340+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
68341+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
68342
68343 int register_module_notifier(struct notifier_block * nb)
68344 {
68345@@ -282,7 +284,7 @@ bool each_symbol(bool (*fn)(const struct
68346 return true;
68347
68348 list_for_each_entry_rcu(mod, &modules, list) {
68349- struct symsearch arr[] = {
68350+ struct symsearch modarr[] = {
68351 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
68352 NOT_GPL_ONLY, false },
68353 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
68354@@ -304,7 +306,7 @@ bool each_symbol(bool (*fn)(const struct
68355 #endif
68356 };
68357
68358- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
68359+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
68360 return true;
68361 }
68362 return false;
68363@@ -415,7 +417,7 @@ static inline void __percpu *mod_percpu(
68364 static int percpu_modalloc(struct module *mod,
68365 unsigned long size, unsigned long align)
68366 {
68367- if (align > PAGE_SIZE) {
68368+ if (align-1 >= PAGE_SIZE) {
68369 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
68370 mod->name, align, PAGE_SIZE);
68371 align = PAGE_SIZE;
68372@@ -1143,7 +1145,7 @@ resolve_symbol_wait(struct module *mod,
68373 */
68374 #ifdef CONFIG_SYSFS
68375
68376-#ifdef CONFIG_KALLSYMS
68377+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
68378 static inline bool sect_empty(const Elf_Shdr *sect)
68379 {
68380 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
68381@@ -1612,17 +1614,17 @@ void unset_section_ro_nx(struct module *
68382 {
68383 unsigned long total_pages;
68384
68385- if (mod->module_core == module_region) {
68386+ if (mod->module_core_rx == module_region) {
68387 /* Set core as NX+RW */
68388- total_pages = MOD_NUMBER_OF_PAGES(mod->module_core, mod->core_size);
68389- set_memory_nx((unsigned long)mod->module_core, total_pages);
68390- set_memory_rw((unsigned long)mod->module_core, total_pages);
68391+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_core_rx, mod->core_size_rx);
68392+ set_memory_nx((unsigned long)mod->module_core_rx, total_pages);
68393+ set_memory_rw((unsigned long)mod->module_core_rx, total_pages);
68394
68395- } else if (mod->module_init == module_region) {
68396+ } else if (mod->module_init_rx == module_region) {
68397 /* Set init as NX+RW */
68398- total_pages = MOD_NUMBER_OF_PAGES(mod->module_init, mod->init_size);
68399- set_memory_nx((unsigned long)mod->module_init, total_pages);
68400- set_memory_rw((unsigned long)mod->module_init, total_pages);
68401+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_init_rx, mod->init_size_rx);
68402+ set_memory_nx((unsigned long)mod->module_init_rx, total_pages);
68403+ set_memory_rw((unsigned long)mod->module_init_rx, total_pages);
68404 }
68405 }
68406
68407@@ -1633,14 +1635,14 @@ void set_all_modules_text_rw()
68408
68409 mutex_lock(&module_mutex);
68410 list_for_each_entry_rcu(mod, &modules, list) {
68411- if ((mod->module_core) && (mod->core_text_size)) {
68412- set_page_attributes(mod->module_core,
68413- mod->module_core + mod->core_text_size,
68414+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68415+ set_page_attributes(mod->module_core_rx,
68416+ mod->module_core_rx + mod->core_size_rx,
68417 set_memory_rw);
68418 }
68419- if ((mod->module_init) && (mod->init_text_size)) {
68420- set_page_attributes(mod->module_init,
68421- mod->module_init + mod->init_text_size,
68422+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68423+ set_page_attributes(mod->module_init_rx,
68424+ mod->module_init_rx + mod->init_size_rx,
68425 set_memory_rw);
68426 }
68427 }
68428@@ -1654,14 +1656,14 @@ void set_all_modules_text_ro()
68429
68430 mutex_lock(&module_mutex);
68431 list_for_each_entry_rcu(mod, &modules, list) {
68432- if ((mod->module_core) && (mod->core_text_size)) {
68433- set_page_attributes(mod->module_core,
68434- mod->module_core + mod->core_text_size,
68435+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68436+ set_page_attributes(mod->module_core_rx,
68437+ mod->module_core_rx + mod->core_size_rx,
68438 set_memory_ro);
68439 }
68440- if ((mod->module_init) && (mod->init_text_size)) {
68441- set_page_attributes(mod->module_init,
68442- mod->module_init + mod->init_text_size,
68443+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68444+ set_page_attributes(mod->module_init_rx,
68445+ mod->module_init_rx + mod->init_size_rx,
68446 set_memory_ro);
68447 }
68448 }
68449@@ -1696,17 +1698,20 @@ static void free_module(struct module *m
68450 destroy_params(mod->kp, mod->num_kp);
68451
68452 /* This may be NULL, but that's OK */
68453- unset_section_ro_nx(mod, mod->module_init);
68454- module_free(mod, mod->module_init);
68455+ unset_section_ro_nx(mod, mod->module_init_rx);
68456+ module_free(mod, mod->module_init_rw);
68457+ module_free_exec(mod, mod->module_init_rx);
68458 kfree(mod->args);
68459 percpu_modfree(mod);
68460
68461 /* Free lock-classes: */
68462- lockdep_free_key_range(mod->module_core, mod->core_size);
68463+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
68464+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
68465
68466 /* Finally, free the core (containing the module structure) */
68467- unset_section_ro_nx(mod, mod->module_core);
68468- module_free(mod, mod->module_core);
68469+ unset_section_ro_nx(mod, mod->module_core_rx);
68470+ module_free_exec(mod, mod->module_core_rx);
68471+ module_free(mod, mod->module_core_rw);
68472
68473 #ifdef CONFIG_MPU
68474 update_protections(current->mm);
68475@@ -1775,10 +1780,31 @@ static int simplify_symbols(struct modul
68476 unsigned int i;
68477 int ret = 0;
68478 const struct kernel_symbol *ksym;
68479+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68480+ int is_fs_load = 0;
68481+ int register_filesystem_found = 0;
68482+ char *p;
68483+
68484+ p = strstr(mod->args, "grsec_modharden_fs");
68485+ if (p) {
68486+ char *endptr = p + strlen("grsec_modharden_fs");
68487+ /* copy \0 as well */
68488+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
68489+ is_fs_load = 1;
68490+ }
68491+#endif
68492
68493 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
68494 const char *name = info->strtab + sym[i].st_name;
68495
68496+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68497+ /* it's a real shame this will never get ripped and copied
68498+ upstream! ;(
68499+ */
68500+ if (is_fs_load && !strcmp(name, "register_filesystem"))
68501+ register_filesystem_found = 1;
68502+#endif
68503+
68504 switch (sym[i].st_shndx) {
68505 case SHN_COMMON:
68506 /* We compiled with -fno-common. These are not
68507@@ -1799,7 +1825,9 @@ static int simplify_symbols(struct modul
68508 ksym = resolve_symbol_wait(mod, info, name);
68509 /* Ok if resolved. */
68510 if (ksym && !IS_ERR(ksym)) {
68511+ pax_open_kernel();
68512 sym[i].st_value = ksym->value;
68513+ pax_close_kernel();
68514 break;
68515 }
68516
68517@@ -1818,11 +1846,20 @@ static int simplify_symbols(struct modul
68518 secbase = (unsigned long)mod_percpu(mod);
68519 else
68520 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
68521+ pax_open_kernel();
68522 sym[i].st_value += secbase;
68523+ pax_close_kernel();
68524 break;
68525 }
68526 }
68527
68528+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68529+ if (is_fs_load && !register_filesystem_found) {
68530+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
68531+ ret = -EPERM;
68532+ }
68533+#endif
68534+
68535 return ret;
68536 }
68537
68538@@ -1906,22 +1943,12 @@ static void layout_sections(struct modul
68539 || s->sh_entsize != ~0UL
68540 || strstarts(sname, ".init"))
68541 continue;
68542- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
68543+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68544+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
68545+ else
68546+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
68547 DEBUGP("\t%s\n", name);
68548 }
68549- switch (m) {
68550- case 0: /* executable */
68551- mod->core_size = debug_align(mod->core_size);
68552- mod->core_text_size = mod->core_size;
68553- break;
68554- case 1: /* RO: text and ro-data */
68555- mod->core_size = debug_align(mod->core_size);
68556- mod->core_ro_size = mod->core_size;
68557- break;
68558- case 3: /* whole core */
68559- mod->core_size = debug_align(mod->core_size);
68560- break;
68561- }
68562 }
68563
68564 DEBUGP("Init section allocation order:\n");
68565@@ -1935,23 +1962,13 @@ static void layout_sections(struct modul
68566 || s->sh_entsize != ~0UL
68567 || !strstarts(sname, ".init"))
68568 continue;
68569- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
68570- | INIT_OFFSET_MASK);
68571+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68572+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
68573+ else
68574+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
68575+ s->sh_entsize |= INIT_OFFSET_MASK;
68576 DEBUGP("\t%s\n", sname);
68577 }
68578- switch (m) {
68579- case 0: /* executable */
68580- mod->init_size = debug_align(mod->init_size);
68581- mod->init_text_size = mod->init_size;
68582- break;
68583- case 1: /* RO: text and ro-data */
68584- mod->init_size = debug_align(mod->init_size);
68585- mod->init_ro_size = mod->init_size;
68586- break;
68587- case 3: /* whole init */
68588- mod->init_size = debug_align(mod->init_size);
68589- break;
68590- }
68591 }
68592 }
68593
68594@@ -2119,7 +2136,7 @@ static void layout_symtab(struct module
68595
68596 /* Put symbol section at end of init part of module. */
68597 symsect->sh_flags |= SHF_ALLOC;
68598- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
68599+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
68600 info->index.sym) | INIT_OFFSET_MASK;
68601 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
68602
68603@@ -2136,19 +2153,19 @@ static void layout_symtab(struct module
68604 }
68605
68606 /* Append room for core symbols at end of core part. */
68607- info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
68608- mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
68609+ info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
68610+ mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
68611
68612 /* Put string table section at end of init part of module. */
68613 strsect->sh_flags |= SHF_ALLOC;
68614- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
68615+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
68616 info->index.str) | INIT_OFFSET_MASK;
68617 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
68618
68619 /* Append room for core symbols' strings at end of core part. */
68620- info->stroffs = mod->core_size;
68621+ info->stroffs = mod->core_size_rx;
68622 __set_bit(0, info->strmap);
68623- mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
68624+ mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
68625 }
68626
68627 static void add_kallsyms(struct module *mod, const struct load_info *info)
68628@@ -2164,11 +2181,13 @@ static void add_kallsyms(struct module *
68629 /* Make sure we get permanent strtab: don't use info->strtab. */
68630 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
68631
68632+ pax_open_kernel();
68633+
68634 /* Set types up while we still have access to sections. */
68635 for (i = 0; i < mod->num_symtab; i++)
68636 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
68637
68638- mod->core_symtab = dst = mod->module_core + info->symoffs;
68639+ mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
68640 src = mod->symtab;
68641 *dst = *src;
68642 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
68643@@ -2181,10 +2200,12 @@ static void add_kallsyms(struct module *
68644 }
68645 mod->core_num_syms = ndst;
68646
68647- mod->core_strtab = s = mod->module_core + info->stroffs;
68648+ mod->core_strtab = s = mod->module_core_rx + info->stroffs;
68649 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
68650 if (test_bit(i, info->strmap))
68651 *++s = mod->strtab[i];
68652+
68653+ pax_close_kernel();
68654 }
68655 #else
68656 static inline void layout_symtab(struct module *mod, struct load_info *info)
68657@@ -2213,17 +2234,33 @@ static void dynamic_debug_remove(struct
68658 ddebug_remove_module(debug->modname);
68659 }
68660
68661-static void *module_alloc_update_bounds(unsigned long size)
68662+static void *module_alloc_update_bounds_rw(unsigned long size)
68663 {
68664 void *ret = module_alloc(size);
68665
68666 if (ret) {
68667 mutex_lock(&module_mutex);
68668 /* Update module bounds. */
68669- if ((unsigned long)ret < module_addr_min)
68670- module_addr_min = (unsigned long)ret;
68671- if ((unsigned long)ret + size > module_addr_max)
68672- module_addr_max = (unsigned long)ret + size;
68673+ if ((unsigned long)ret < module_addr_min_rw)
68674+ module_addr_min_rw = (unsigned long)ret;
68675+ if ((unsigned long)ret + size > module_addr_max_rw)
68676+ module_addr_max_rw = (unsigned long)ret + size;
68677+ mutex_unlock(&module_mutex);
68678+ }
68679+ return ret;
68680+}
68681+
68682+static void *module_alloc_update_bounds_rx(unsigned long size)
68683+{
68684+ void *ret = module_alloc_exec(size);
68685+
68686+ if (ret) {
68687+ mutex_lock(&module_mutex);
68688+ /* Update module bounds. */
68689+ if ((unsigned long)ret < module_addr_min_rx)
68690+ module_addr_min_rx = (unsigned long)ret;
68691+ if ((unsigned long)ret + size > module_addr_max_rx)
68692+ module_addr_max_rx = (unsigned long)ret + size;
68693 mutex_unlock(&module_mutex);
68694 }
68695 return ret;
68696@@ -2516,7 +2553,7 @@ static int move_module(struct module *mo
68697 void *ptr;
68698
68699 /* Do the allocs. */
68700- ptr = module_alloc_update_bounds(mod->core_size);
68701+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
68702 /*
68703 * The pointer to this block is stored in the module structure
68704 * which is inside the block. Just mark it as not being a
68705@@ -2526,23 +2563,50 @@ static int move_module(struct module *mo
68706 if (!ptr)
68707 return -ENOMEM;
68708
68709- memset(ptr, 0, mod->core_size);
68710- mod->module_core = ptr;
68711+ memset(ptr, 0, mod->core_size_rw);
68712+ mod->module_core_rw = ptr;
68713
68714- ptr = module_alloc_update_bounds(mod->init_size);
68715+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
68716 /*
68717 * The pointer to this block is stored in the module structure
68718 * which is inside the block. This block doesn't need to be
68719 * scanned as it contains data and code that will be freed
68720 * after the module is initialized.
68721 */
68722- kmemleak_ignore(ptr);
68723- if (!ptr && mod->init_size) {
68724- module_free(mod, mod->module_core);
68725+ kmemleak_not_leak(ptr);
68726+ if (!ptr && mod->init_size_rw) {
68727+ module_free(mod, mod->module_core_rw);
68728 return -ENOMEM;
68729 }
68730- memset(ptr, 0, mod->init_size);
68731- mod->module_init = ptr;
68732+ memset(ptr, 0, mod->init_size_rw);
68733+ mod->module_init_rw = ptr;
68734+
68735+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
68736+ kmemleak_not_leak(ptr);
68737+ if (!ptr) {
68738+ module_free(mod, mod->module_init_rw);
68739+ module_free(mod, mod->module_core_rw);
68740+ return -ENOMEM;
68741+ }
68742+
68743+ pax_open_kernel();
68744+ memset(ptr, 0, mod->core_size_rx);
68745+ pax_close_kernel();
68746+ mod->module_core_rx = ptr;
68747+
68748+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
68749+ kmemleak_not_leak(ptr);
68750+ if (!ptr && mod->init_size_rx) {
68751+ module_free_exec(mod, mod->module_core_rx);
68752+ module_free(mod, mod->module_init_rw);
68753+ module_free(mod, mod->module_core_rw);
68754+ return -ENOMEM;
68755+ }
68756+
68757+ pax_open_kernel();
68758+ memset(ptr, 0, mod->init_size_rx);
68759+ pax_close_kernel();
68760+ mod->module_init_rx = ptr;
68761
68762 /* Transfer each section which specifies SHF_ALLOC */
68763 DEBUGP("final section addresses:\n");
68764@@ -2553,16 +2617,45 @@ static int move_module(struct module *mo
68765 if (!(shdr->sh_flags & SHF_ALLOC))
68766 continue;
68767
68768- if (shdr->sh_entsize & INIT_OFFSET_MASK)
68769- dest = mod->module_init
68770- + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68771- else
68772- dest = mod->module_core + shdr->sh_entsize;
68773+ if (shdr->sh_entsize & INIT_OFFSET_MASK) {
68774+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68775+ dest = mod->module_init_rw
68776+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68777+ else
68778+ dest = mod->module_init_rx
68779+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68780+ } else {
68781+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68782+ dest = mod->module_core_rw + shdr->sh_entsize;
68783+ else
68784+ dest = mod->module_core_rx + shdr->sh_entsize;
68785+ }
68786+
68787+ if (shdr->sh_type != SHT_NOBITS) {
68788+
68789+#ifdef CONFIG_PAX_KERNEXEC
68790+#ifdef CONFIG_X86_64
68791+ if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
68792+ set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
68793+#endif
68794+ if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
68795+ pax_open_kernel();
68796+ memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68797+ pax_close_kernel();
68798+ } else
68799+#endif
68800
68801- if (shdr->sh_type != SHT_NOBITS)
68802 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68803+ }
68804 /* Update sh_addr to point to copy in image. */
68805- shdr->sh_addr = (unsigned long)dest;
68806+
68807+#ifdef CONFIG_PAX_KERNEXEC
68808+ if (shdr->sh_flags & SHF_EXECINSTR)
68809+ shdr->sh_addr = ktva_ktla((unsigned long)dest);
68810+ else
68811+#endif
68812+
68813+ shdr->sh_addr = (unsigned long)dest;
68814 DEBUGP("\t0x%lx %s\n",
68815 shdr->sh_addr, info->secstrings + shdr->sh_name);
68816 }
68817@@ -2613,12 +2706,12 @@ static void flush_module_icache(const st
68818 * Do it before processing of module parameters, so the module
68819 * can provide parameter accessor functions of its own.
68820 */
68821- if (mod->module_init)
68822- flush_icache_range((unsigned long)mod->module_init,
68823- (unsigned long)mod->module_init
68824- + mod->init_size);
68825- flush_icache_range((unsigned long)mod->module_core,
68826- (unsigned long)mod->module_core + mod->core_size);
68827+ if (mod->module_init_rx)
68828+ flush_icache_range((unsigned long)mod->module_init_rx,
68829+ (unsigned long)mod->module_init_rx
68830+ + mod->init_size_rx);
68831+ flush_icache_range((unsigned long)mod->module_core_rx,
68832+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
68833
68834 set_fs(old_fs);
68835 }
68836@@ -2690,8 +2783,10 @@ static void module_deallocate(struct mod
68837 {
68838 kfree(info->strmap);
68839 percpu_modfree(mod);
68840- module_free(mod, mod->module_init);
68841- module_free(mod, mod->module_core);
68842+ module_free_exec(mod, mod->module_init_rx);
68843+ module_free_exec(mod, mod->module_core_rx);
68844+ module_free(mod, mod->module_init_rw);
68845+ module_free(mod, mod->module_core_rw);
68846 }
68847
68848 static int post_relocation(struct module *mod, const struct load_info *info)
68849@@ -2748,9 +2843,38 @@ static struct module *load_module(void _
68850 if (err)
68851 goto free_unload;
68852
68853+ /* Now copy in args */
68854+ mod->args = strndup_user(uargs, ~0UL >> 1);
68855+ if (IS_ERR(mod->args)) {
68856+ err = PTR_ERR(mod->args);
68857+ goto free_unload;
68858+ }
68859+
68860 /* Set up MODINFO_ATTR fields */
68861 setup_modinfo(mod, &info);
68862
68863+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68864+ {
68865+ char *p, *p2;
68866+
68867+ if (strstr(mod->args, "grsec_modharden_netdev")) {
68868+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
68869+ err = -EPERM;
68870+ goto free_modinfo;
68871+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
68872+ p += strlen("grsec_modharden_normal");
68873+ p2 = strstr(p, "_");
68874+ if (p2) {
68875+ *p2 = '\0';
68876+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
68877+ *p2 = '_';
68878+ }
68879+ err = -EPERM;
68880+ goto free_modinfo;
68881+ }
68882+ }
68883+#endif
68884+
68885 /* Fix up syms, so that st_value is a pointer to location. */
68886 err = simplify_symbols(mod, &info);
68887 if (err < 0)
68888@@ -2766,13 +2890,6 @@ static struct module *load_module(void _
68889
68890 flush_module_icache(mod);
68891
68892- /* Now copy in args */
68893- mod->args = strndup_user(uargs, ~0UL >> 1);
68894- if (IS_ERR(mod->args)) {
68895- err = PTR_ERR(mod->args);
68896- goto free_arch_cleanup;
68897- }
68898-
68899 /* Mark state as coming so strong_try_module_get() ignores us. */
68900 mod->state = MODULE_STATE_COMING;
68901
68902@@ -2832,11 +2949,10 @@ static struct module *load_module(void _
68903 unlock:
68904 mutex_unlock(&module_mutex);
68905 synchronize_sched();
68906- kfree(mod->args);
68907- free_arch_cleanup:
68908 module_arch_cleanup(mod);
68909 free_modinfo:
68910 free_modinfo(mod);
68911+ kfree(mod->args);
68912 free_unload:
68913 module_unload_free(mod);
68914 free_module:
68915@@ -2877,16 +2993,16 @@ SYSCALL_DEFINE3(init_module, void __user
68916 MODULE_STATE_COMING, mod);
68917
68918 /* Set RO and NX regions for core */
68919- set_section_ro_nx(mod->module_core,
68920- mod->core_text_size,
68921- mod->core_ro_size,
68922- mod->core_size);
68923+ set_section_ro_nx(mod->module_core_rx,
68924+ mod->core_size_rx,
68925+ mod->core_size_rx,
68926+ mod->core_size_rx);
68927
68928 /* Set RO and NX regions for init */
68929- set_section_ro_nx(mod->module_init,
68930- mod->init_text_size,
68931- mod->init_ro_size,
68932- mod->init_size);
68933+ set_section_ro_nx(mod->module_init_rx,
68934+ mod->init_size_rx,
68935+ mod->init_size_rx,
68936+ mod->init_size_rx);
68937
68938 do_mod_ctors(mod);
68939 /* Start the module */
68940@@ -2931,11 +3047,13 @@ SYSCALL_DEFINE3(init_module, void __user
68941 mod->symtab = mod->core_symtab;
68942 mod->strtab = mod->core_strtab;
68943 #endif
68944- unset_section_ro_nx(mod, mod->module_init);
68945- module_free(mod, mod->module_init);
68946- mod->module_init = NULL;
68947- mod->init_size = 0;
68948- mod->init_text_size = 0;
68949+ unset_section_ro_nx(mod, mod->module_init_rx);
68950+ module_free(mod, mod->module_init_rw);
68951+ module_free_exec(mod, mod->module_init_rx);
68952+ mod->module_init_rw = NULL;
68953+ mod->module_init_rx = NULL;
68954+ mod->init_size_rw = 0;
68955+ mod->init_size_rx = 0;
68956 mutex_unlock(&module_mutex);
68957
68958 return 0;
68959@@ -2966,10 +3084,16 @@ static const char *get_ksymbol(struct mo
68960 unsigned long nextval;
68961
68962 /* At worse, next value is at end of module */
68963- if (within_module_init(addr, mod))
68964- nextval = (unsigned long)mod->module_init+mod->init_text_size;
68965+ if (within_module_init_rx(addr, mod))
68966+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68967+ else if (within_module_init_rw(addr, mod))
68968+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68969+ else if (within_module_core_rx(addr, mod))
68970+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68971+ else if (within_module_core_rw(addr, mod))
68972+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68973 else
68974- nextval = (unsigned long)mod->module_core+mod->core_text_size;
68975+ return NULL;
68976
68977 /* Scan for closest preceding symbol, and next symbol. (ELF
68978 starts real symbols at 1). */
68979@@ -3215,7 +3339,7 @@ static int m_show(struct seq_file *m, vo
68980 char buf[8];
68981
68982 seq_printf(m, "%s %u",
68983- mod->name, mod->init_size + mod->core_size);
68984+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68985 print_unload_info(m, mod);
68986
68987 /* Informative for users. */
68988@@ -3224,7 +3348,7 @@ static int m_show(struct seq_file *m, vo
68989 mod->state == MODULE_STATE_COMING ? "Loading":
68990 "Live");
68991 /* Used by oprofile and other similar tools. */
68992- seq_printf(m, " 0x%pK", mod->module_core);
68993+ seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
68994
68995 /* Taints info */
68996 if (mod->taints)
68997@@ -3260,7 +3384,17 @@ static const struct file_operations proc
68998
68999 static int __init proc_modules_init(void)
69000 {
69001+#ifndef CONFIG_GRKERNSEC_HIDESYM
69002+#ifdef CONFIG_GRKERNSEC_PROC_USER
69003+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
69004+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69005+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
69006+#else
69007 proc_create("modules", 0, NULL, &proc_modules_operations);
69008+#endif
69009+#else
69010+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
69011+#endif
69012 return 0;
69013 }
69014 module_init(proc_modules_init);
69015@@ -3319,12 +3453,12 @@ struct module *__module_address(unsigned
69016 {
69017 struct module *mod;
69018
69019- if (addr < module_addr_min || addr > module_addr_max)
69020+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
69021+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
69022 return NULL;
69023
69024 list_for_each_entry_rcu(mod, &modules, list)
69025- if (within_module_core(addr, mod)
69026- || within_module_init(addr, mod))
69027+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
69028 return mod;
69029 return NULL;
69030 }
69031@@ -3358,11 +3492,20 @@ bool is_module_text_address(unsigned lon
69032 */
69033 struct module *__module_text_address(unsigned long addr)
69034 {
69035- struct module *mod = __module_address(addr);
69036+ struct module *mod;
69037+
69038+#ifdef CONFIG_X86_32
69039+ addr = ktla_ktva(addr);
69040+#endif
69041+
69042+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
69043+ return NULL;
69044+
69045+ mod = __module_address(addr);
69046+
69047 if (mod) {
69048 /* Make sure it's within the text section. */
69049- if (!within(addr, mod->module_init, mod->init_text_size)
69050- && !within(addr, mod->module_core, mod->core_text_size))
69051+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
69052 mod = NULL;
69053 }
69054 return mod;
69055diff -urNp linux-2.6.39.2/kernel/mutex.c linux-2.6.39.2/kernel/mutex.c
69056--- linux-2.6.39.2/kernel/mutex.c 2011-05-19 00:06:34.000000000 -0400
69057+++ linux-2.6.39.2/kernel/mutex.c 2011-05-22 19:36:33.000000000 -0400
69058@@ -160,7 +160,7 @@ __mutex_lock_common(struct mutex *lock,
69059 */
69060
69061 for (;;) {
69062- struct thread_info *owner;
69063+ struct task_struct *owner;
69064
69065 /*
69066 * If we own the BKL, then don't spin. The owner of
69067@@ -205,7 +205,7 @@ __mutex_lock_common(struct mutex *lock,
69068 spin_lock_mutex(&lock->wait_lock, flags);
69069
69070 debug_mutex_lock_common(lock, &waiter);
69071- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
69072+ debug_mutex_add_waiter(lock, &waiter, task);
69073
69074 /* add waiting tasks to the end of the waitqueue (FIFO): */
69075 list_add_tail(&waiter.list, &lock->wait_list);
69076@@ -234,8 +234,7 @@ __mutex_lock_common(struct mutex *lock,
69077 * TASK_UNINTERRUPTIBLE case.)
69078 */
69079 if (unlikely(signal_pending_state(state, task))) {
69080- mutex_remove_waiter(lock, &waiter,
69081- task_thread_info(task));
69082+ mutex_remove_waiter(lock, &waiter, task);
69083 mutex_release(&lock->dep_map, 1, ip);
69084 spin_unlock_mutex(&lock->wait_lock, flags);
69085
69086@@ -256,7 +255,7 @@ __mutex_lock_common(struct mutex *lock,
69087 done:
69088 lock_acquired(&lock->dep_map, ip);
69089 /* got the lock - rejoice! */
69090- mutex_remove_waiter(lock, &waiter, current_thread_info());
69091+ mutex_remove_waiter(lock, &waiter, task);
69092 mutex_set_owner(lock);
69093
69094 /* set it to 0 if there are no waiters left: */
69095diff -urNp linux-2.6.39.2/kernel/mutex-debug.c linux-2.6.39.2/kernel/mutex-debug.c
69096--- linux-2.6.39.2/kernel/mutex-debug.c 2011-05-19 00:06:34.000000000 -0400
69097+++ linux-2.6.39.2/kernel/mutex-debug.c 2011-05-22 19:36:33.000000000 -0400
69098@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
69099 }
69100
69101 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
69102- struct thread_info *ti)
69103+ struct task_struct *task)
69104 {
69105 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
69106
69107 /* Mark the current thread as blocked on the lock: */
69108- ti->task->blocked_on = waiter;
69109+ task->blocked_on = waiter;
69110 }
69111
69112 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
69113- struct thread_info *ti)
69114+ struct task_struct *task)
69115 {
69116 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
69117- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
69118- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
69119- ti->task->blocked_on = NULL;
69120+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
69121+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
69122+ task->blocked_on = NULL;
69123
69124 list_del_init(&waiter->list);
69125 waiter->task = NULL;
69126@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
69127 return;
69128
69129 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
69130- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
69131+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
69132 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
69133 mutex_clear_owner(lock);
69134 }
69135diff -urNp linux-2.6.39.2/kernel/mutex-debug.h linux-2.6.39.2/kernel/mutex-debug.h
69136--- linux-2.6.39.2/kernel/mutex-debug.h 2011-05-19 00:06:34.000000000 -0400
69137+++ linux-2.6.39.2/kernel/mutex-debug.h 2011-05-22 19:36:33.000000000 -0400
69138@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
69139 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
69140 extern void debug_mutex_add_waiter(struct mutex *lock,
69141 struct mutex_waiter *waiter,
69142- struct thread_info *ti);
69143+ struct task_struct *task);
69144 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
69145- struct thread_info *ti);
69146+ struct task_struct *task);
69147 extern void debug_mutex_unlock(struct mutex *lock);
69148 extern void debug_mutex_init(struct mutex *lock, const char *name,
69149 struct lock_class_key *key);
69150
69151 static inline void mutex_set_owner(struct mutex *lock)
69152 {
69153- lock->owner = current_thread_info();
69154+ lock->owner = current;
69155 }
69156
69157 static inline void mutex_clear_owner(struct mutex *lock)
69158diff -urNp linux-2.6.39.2/kernel/mutex.h linux-2.6.39.2/kernel/mutex.h
69159--- linux-2.6.39.2/kernel/mutex.h 2011-05-19 00:06:34.000000000 -0400
69160+++ linux-2.6.39.2/kernel/mutex.h 2011-05-22 19:36:33.000000000 -0400
69161@@ -19,7 +19,7 @@
69162 #ifdef CONFIG_SMP
69163 static inline void mutex_set_owner(struct mutex *lock)
69164 {
69165- lock->owner = current_thread_info();
69166+ lock->owner = current;
69167 }
69168
69169 static inline void mutex_clear_owner(struct mutex *lock)
69170diff -urNp linux-2.6.39.2/kernel/padata.c linux-2.6.39.2/kernel/padata.c
69171--- linux-2.6.39.2/kernel/padata.c 2011-05-19 00:06:34.000000000 -0400
69172+++ linux-2.6.39.2/kernel/padata.c 2011-05-22 19:36:33.000000000 -0400
69173@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
69174 padata->pd = pd;
69175 padata->cb_cpu = cb_cpu;
69176
69177- if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
69178- atomic_set(&pd->seq_nr, -1);
69179+ if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
69180+ atomic_set_unchecked(&pd->seq_nr, -1);
69181
69182- padata->seq_nr = atomic_inc_return(&pd->seq_nr);
69183+ padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
69184
69185 target_cpu = padata_cpu_hash(padata);
69186 queue = per_cpu_ptr(pd->pqueue, target_cpu);
69187@@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
69188 padata_init_pqueues(pd);
69189 padata_init_squeues(pd);
69190 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
69191- atomic_set(&pd->seq_nr, -1);
69192+ atomic_set_unchecked(&pd->seq_nr, -1);
69193 atomic_set(&pd->reorder_objects, 0);
69194 atomic_set(&pd->refcnt, 0);
69195 pd->pinst = pinst;
69196diff -urNp linux-2.6.39.2/kernel/panic.c linux-2.6.39.2/kernel/panic.c
69197--- linux-2.6.39.2/kernel/panic.c 2011-05-19 00:06:34.000000000 -0400
69198+++ linux-2.6.39.2/kernel/panic.c 2011-05-22 19:41:42.000000000 -0400
69199@@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
69200 const char *board;
69201
69202 printk(KERN_WARNING "------------[ cut here ]------------\n");
69203- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
69204+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
69205 board = dmi_get_system_info(DMI_PRODUCT_NAME);
69206 if (board)
69207 printk(KERN_WARNING "Hardware name: %s\n", board);
69208@@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
69209 */
69210 void __stack_chk_fail(void)
69211 {
69212- panic("stack-protector: Kernel stack is corrupted in: %p\n",
69213+ dump_stack();
69214+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
69215 __builtin_return_address(0));
69216 }
69217 EXPORT_SYMBOL(__stack_chk_fail);
69218diff -urNp linux-2.6.39.2/kernel/params.c linux-2.6.39.2/kernel/params.c
69219--- linux-2.6.39.2/kernel/params.c 2011-05-19 00:06:34.000000000 -0400
69220+++ linux-2.6.39.2/kernel/params.c 2011-05-22 19:36:33.000000000 -0400
69221@@ -234,7 +234,7 @@ int parse_args(const char *name,
69222 { \
69223 return sprintf(buffer, format, *((type *)kp->arg)); \
69224 } \
69225- struct kernel_param_ops param_ops_##name = { \
69226+ const struct kernel_param_ops param_ops_##name = { \
69227 .set = param_set_##name, \
69228 .get = param_get_##name, \
69229 }; \
69230@@ -286,7 +286,7 @@ static void param_free_charp(void *arg)
69231 maybe_kfree_parameter(*((char **)arg));
69232 }
69233
69234-struct kernel_param_ops param_ops_charp = {
69235+const struct kernel_param_ops param_ops_charp = {
69236 .set = param_set_charp,
69237 .get = param_get_charp,
69238 .free = param_free_charp,
69239@@ -334,7 +334,7 @@ int param_get_bool(char *buffer, const s
69240 }
69241 EXPORT_SYMBOL(param_get_bool);
69242
69243-struct kernel_param_ops param_ops_bool = {
69244+const struct kernel_param_ops param_ops_bool = {
69245 .set = param_set_bool,
69246 .get = param_get_bool,
69247 };
69248@@ -362,7 +362,7 @@ int param_get_invbool(char *buffer, cons
69249 }
69250 EXPORT_SYMBOL(param_get_invbool);
69251
69252-struct kernel_param_ops param_ops_invbool = {
69253+const struct kernel_param_ops param_ops_invbool = {
69254 .set = param_set_invbool,
69255 .get = param_get_invbool,
69256 };
69257@@ -460,7 +460,7 @@ static void param_array_free(void *arg)
69258 arr->ops->free(arr->elem + arr->elemsize * i);
69259 }
69260
69261-struct kernel_param_ops param_array_ops = {
69262+const struct kernel_param_ops param_array_ops = {
69263 .set = param_array_set,
69264 .get = param_array_get,
69265 .free = param_array_free,
69266@@ -488,7 +488,7 @@ int param_get_string(char *buffer, const
69267 }
69268 EXPORT_SYMBOL(param_get_string);
69269
69270-struct kernel_param_ops param_ops_string = {
69271+const struct kernel_param_ops param_ops_string = {
69272 .set = param_set_copystring,
69273 .get = param_get_string,
69274 };
69275diff -urNp linux-2.6.39.2/kernel/perf_event.c linux-2.6.39.2/kernel/perf_event.c
69276--- linux-2.6.39.2/kernel/perf_event.c 2011-05-19 00:06:34.000000000 -0400
69277+++ linux-2.6.39.2/kernel/perf_event.c 2011-05-22 19:36:33.000000000 -0400
69278@@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_
69279 return 0;
69280 }
69281
69282-static atomic64_t perf_event_id;
69283+static atomic64_unchecked_t perf_event_id;
69284
69285 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
69286 enum event_type_t event_type);
69287@@ -2496,7 +2496,7 @@ static void __perf_event_read(void *info
69288
69289 static inline u64 perf_event_count(struct perf_event *event)
69290 {
69291- return local64_read(&event->count) + atomic64_read(&event->child_count);
69292+ return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
69293 }
69294
69295 static u64 perf_event_read(struct perf_event *event)
69296@@ -3031,9 +3031,9 @@ u64 perf_event_read_value(struct perf_ev
69297 mutex_lock(&event->child_mutex);
69298 total += perf_event_read(event);
69299 *enabled += event->total_time_enabled +
69300- atomic64_read(&event->child_total_time_enabled);
69301+ atomic64_read_unchecked(&event->child_total_time_enabled);
69302 *running += event->total_time_running +
69303- atomic64_read(&event->child_total_time_running);
69304+ atomic64_read_unchecked(&event->child_total_time_running);
69305
69306 list_for_each_entry(child, &event->child_list, child_list) {
69307 total += perf_event_read(child);
69308@@ -3396,10 +3396,10 @@ void perf_event_update_userpage(struct p
69309 userpg->offset -= local64_read(&event->hw.prev_count);
69310
69311 userpg->time_enabled = event->total_time_enabled +
69312- atomic64_read(&event->child_total_time_enabled);
69313+ atomic64_read_unchecked(&event->child_total_time_enabled);
69314
69315 userpg->time_running = event->total_time_running +
69316- atomic64_read(&event->child_total_time_running);
69317+ atomic64_read_unchecked(&event->child_total_time_running);
69318
69319 barrier();
69320 ++userpg->lock;
69321@@ -3884,16 +3884,16 @@ static void perf_pending_event(struct ir
69322 * Later on, we might change it to a list if there is
69323 * another virtualization implementation supporting the callbacks.
69324 */
69325-struct perf_guest_info_callbacks *perf_guest_cbs;
69326+const struct perf_guest_info_callbacks *perf_guest_cbs;
69327
69328-int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
69329+int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
69330 {
69331 perf_guest_cbs = cbs;
69332 return 0;
69333 }
69334 EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks);
69335
69336-int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
69337+int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
69338 {
69339 perf_guest_cbs = NULL;
69340 return 0;
69341@@ -4196,11 +4196,11 @@ static void perf_output_read_one(struct
69342 values[n++] = perf_event_count(event);
69343 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
69344 values[n++] = enabled +
69345- atomic64_read(&event->child_total_time_enabled);
69346+ atomic64_read_unchecked(&event->child_total_time_enabled);
69347 }
69348 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
69349 values[n++] = running +
69350- atomic64_read(&event->child_total_time_running);
69351+ atomic64_read_unchecked(&event->child_total_time_running);
69352 }
69353 if (read_format & PERF_FORMAT_ID)
69354 values[n++] = primary_event_id(event);
69355@@ -6201,7 +6201,7 @@ perf_event_alloc(struct perf_event_attr
69356 event->parent = parent_event;
69357
69358 event->ns = get_pid_ns(current->nsproxy->pid_ns);
69359- event->id = atomic64_inc_return(&perf_event_id);
69360+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
69361
69362 event->state = PERF_EVENT_STATE_INACTIVE;
69363
69364@@ -6724,10 +6724,10 @@ static void sync_child_event(struct perf
69365 /*
69366 * Add back the child's count to the parent's count:
69367 */
69368- atomic64_add(child_val, &parent_event->child_count);
69369- atomic64_add(child_event->total_time_enabled,
69370+ atomic64_add_unchecked(child_val, &parent_event->child_count);
69371+ atomic64_add_unchecked(child_event->total_time_enabled,
69372 &parent_event->child_total_time_enabled);
69373- atomic64_add(child_event->total_time_running,
69374+ atomic64_add_unchecked(child_event->total_time_running,
69375 &parent_event->child_total_time_running);
69376
69377 /*
69378diff -urNp linux-2.6.39.2/kernel/pid.c linux-2.6.39.2/kernel/pid.c
69379--- linux-2.6.39.2/kernel/pid.c 2011-05-19 00:06:34.000000000 -0400
69380+++ linux-2.6.39.2/kernel/pid.c 2011-05-22 19:41:42.000000000 -0400
69381@@ -33,6 +33,7 @@
69382 #include <linux/rculist.h>
69383 #include <linux/bootmem.h>
69384 #include <linux/hash.h>
69385+#include <linux/security.h>
69386 #include <linux/pid_namespace.h>
69387 #include <linux/init_task.h>
69388 #include <linux/syscalls.h>
69389@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
69390
69391 int pid_max = PID_MAX_DEFAULT;
69392
69393-#define RESERVED_PIDS 300
69394+#define RESERVED_PIDS 500
69395
69396 int pid_max_min = RESERVED_PIDS + 1;
69397 int pid_max_max = PID_MAX_LIMIT;
69398@@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
69399 */
69400 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
69401 {
69402+ struct task_struct *task;
69403+
69404 rcu_lockdep_assert(rcu_read_lock_held());
69405- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69406+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69407+
69408+ if (gr_pid_is_chrooted(task))
69409+ return NULL;
69410+
69411+ return task;
69412 }
69413
69414 struct task_struct *find_task_by_vpid(pid_t vnr)
69415diff -urNp linux-2.6.39.2/kernel/posix-cpu-timers.c linux-2.6.39.2/kernel/posix-cpu-timers.c
69416--- linux-2.6.39.2/kernel/posix-cpu-timers.c 2011-05-19 00:06:34.000000000 -0400
69417+++ linux-2.6.39.2/kernel/posix-cpu-timers.c 2011-05-22 19:41:42.000000000 -0400
69418@@ -6,6 +6,7 @@
69419 #include <linux/posix-timers.h>
69420 #include <linux/errno.h>
69421 #include <linux/math64.h>
69422+#include <linux/security.h>
69423 #include <asm/uaccess.h>
69424 #include <linux/kernel_stat.h>
69425 #include <trace/events/timer.h>
69426@@ -1590,7 +1591,7 @@ static int thread_cpu_timer_create(struc
69427 return posix_cpu_timer_create(timer);
69428 }
69429
69430-struct k_clock clock_posix_cpu = {
69431+const struct k_clock clock_posix_cpu = {
69432 .clock_getres = posix_cpu_clock_getres,
69433 .clock_set = posix_cpu_clock_set,
69434 .clock_get = posix_cpu_clock_get,
69435@@ -1604,14 +1605,14 @@ struct k_clock clock_posix_cpu = {
69436
69437 static __init int init_posix_cpu_timers(void)
69438 {
69439- struct k_clock process = {
69440+ const struct k_clock process = {
69441 .clock_getres = process_cpu_clock_getres,
69442 .clock_get = process_cpu_clock_get,
69443 .timer_create = process_cpu_timer_create,
69444 .nsleep = process_cpu_nsleep,
69445 .nsleep_restart = process_cpu_nsleep_restart,
69446 };
69447- struct k_clock thread = {
69448+ const struct k_clock thread = {
69449 .clock_getres = thread_cpu_clock_getres,
69450 .clock_get = thread_cpu_clock_get,
69451 .timer_create = thread_cpu_timer_create,
69452diff -urNp linux-2.6.39.2/kernel/posix-timers.c linux-2.6.39.2/kernel/posix-timers.c
69453--- linux-2.6.39.2/kernel/posix-timers.c 2011-05-19 00:06:34.000000000 -0400
69454+++ linux-2.6.39.2/kernel/posix-timers.c 2011-05-22 20:13:41.000000000 -0400
69455@@ -43,6 +43,7 @@
69456 #include <linux/idr.h>
69457 #include <linux/posix-clock.h>
69458 #include <linux/posix-timers.h>
69459+#include <linux/grsecurity.h>
69460 #include <linux/syscalls.h>
69461 #include <linux/wait.h>
69462 #include <linux/workqueue.h>
69463@@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc
69464 */
69465 static __init int init_posix_timers(void)
69466 {
69467- struct k_clock clock_realtime = {
69468+ const struct k_clock clock_realtime = {
69469 .clock_getres = hrtimer_get_res,
69470 .clock_get = posix_clock_realtime_get,
69471 .clock_set = posix_clock_realtime_set,
69472@@ -239,7 +240,7 @@ static __init int init_posix_timers(void
69473 .timer_get = common_timer_get,
69474 .timer_del = common_timer_del,
69475 };
69476- struct k_clock clock_monotonic = {
69477+ const struct k_clock clock_monotonic = {
69478 .clock_getres = hrtimer_get_res,
69479 .clock_get = posix_ktime_get_ts,
69480 .nsleep = common_nsleep,
69481@@ -249,19 +250,19 @@ static __init int init_posix_timers(void
69482 .timer_get = common_timer_get,
69483 .timer_del = common_timer_del,
69484 };
69485- struct k_clock clock_monotonic_raw = {
69486+ const struct k_clock clock_monotonic_raw = {
69487 .clock_getres = hrtimer_get_res,
69488 .clock_get = posix_get_monotonic_raw,
69489 };
69490- struct k_clock clock_realtime_coarse = {
69491+ const struct k_clock clock_realtime_coarse = {
69492 .clock_getres = posix_get_coarse_res,
69493 .clock_get = posix_get_realtime_coarse,
69494 };
69495- struct k_clock clock_monotonic_coarse = {
69496+ const struct k_clock clock_monotonic_coarse = {
69497 .clock_getres = posix_get_coarse_res,
69498 .clock_get = posix_get_monotonic_coarse,
69499 };
69500- struct k_clock clock_boottime = {
69501+ const struct k_clock clock_boottime = {
69502 .clock_getres = hrtimer_get_res,
69503 .clock_get = posix_get_boottime,
69504 .nsleep = common_nsleep,
69505@@ -272,6 +273,8 @@ static __init int init_posix_timers(void
69506 .timer_del = common_timer_del,
69507 };
69508
69509+ pax_track_stack();
69510+
69511 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
69512 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
69513 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
69514@@ -454,7 +457,7 @@ static struct pid *good_sigevent(sigeven
69515 }
69516
69517 void posix_timers_register_clock(const clockid_t clock_id,
69518- struct k_clock *new_clock)
69519+ const struct k_clock *new_clock)
69520 {
69521 if ((unsigned) clock_id >= MAX_CLOCKS) {
69522 printk(KERN_WARNING "POSIX clock register failed for clock_id %d\n",
69523@@ -506,7 +509,7 @@ static void release_posix_timer(struct k
69524 kmem_cache_free(posix_timers_cache, tmr);
69525 }
69526
69527-static struct k_clock *clockid_to_kclock(const clockid_t id)
69528+static const struct k_clock *clockid_to_kclock(const clockid_t id)
69529 {
69530 if (id < 0)
69531 return (id & CLOCKFD_MASK) == CLOCKFD ?
69532@@ -529,7 +532,7 @@ SYSCALL_DEFINE3(timer_create, const cloc
69533 struct sigevent __user *, timer_event_spec,
69534 timer_t __user *, created_timer_id)
69535 {
69536- struct k_clock *kc = clockid_to_kclock(which_clock);
69537+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69538 struct k_itimer *new_timer;
69539 int error, new_timer_id;
69540 sigevent_t event;
69541@@ -714,7 +717,7 @@ SYSCALL_DEFINE2(timer_gettime, timer_t,
69542 {
69543 struct itimerspec cur_setting;
69544 struct k_itimer *timr;
69545- struct k_clock *kc;
69546+ const struct k_clock *kc;
69547 unsigned long flags;
69548 int ret = 0;
69549
69550@@ -822,7 +825,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t,
69551 int error = 0;
69552 unsigned long flag;
69553 struct itimerspec *rtn = old_setting ? &old_spec : NULL;
69554- struct k_clock *kc;
69555+ const struct k_clock *kc;
69556
69557 if (!new_setting)
69558 return -EINVAL;
69559@@ -868,7 +871,7 @@ static int common_timer_del(struct k_iti
69560
69561 static inline int timer_delete_hook(struct k_itimer *timer)
69562 {
69563- struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69564+ const struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69565
69566 if (WARN_ON_ONCE(!kc || !kc->timer_del))
69567 return -EINVAL;
69568@@ -947,7 +950,7 @@ void exit_itimers(struct signal_struct *
69569 SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
69570 const struct timespec __user *, tp)
69571 {
69572- struct k_clock *kc = clockid_to_kclock(which_clock);
69573+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69574 struct timespec new_tp;
69575
69576 if (!kc || !kc->clock_set)
69577@@ -956,13 +959,20 @@ SYSCALL_DEFINE2(clock_settime, const clo
69578 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
69579 return -EFAULT;
69580
69581+ /* only the CLOCK_REALTIME clock can be set, all other clocks
69582+ have their clock_set fptr set to a nosettime dummy function
69583+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
69584+ call common_clock_set, which calls do_sys_settimeofday, which
69585+ we hook
69586+ */
69587+
69588 return kc->clock_set(which_clock, &new_tp);
69589 }
69590
69591 SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
69592 struct timespec __user *,tp)
69593 {
69594- struct k_clock *kc = clockid_to_kclock(which_clock);
69595+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69596 struct timespec kernel_tp;
69597 int error;
69598
69599@@ -980,7 +990,7 @@ SYSCALL_DEFINE2(clock_gettime, const clo
69600 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
69601 struct timex __user *, utx)
69602 {
69603- struct k_clock *kc = clockid_to_kclock(which_clock);
69604+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69605 struct timex ktx;
69606 int err;
69607
69608@@ -1003,7 +1013,7 @@ SYSCALL_DEFINE2(clock_adjtime, const clo
69609 SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
69610 struct timespec __user *, tp)
69611 {
69612- struct k_clock *kc = clockid_to_kclock(which_clock);
69613+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69614 struct timespec rtn_tp;
69615 int error;
69616
69617@@ -1033,7 +1043,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69618 const struct timespec __user *, rqtp,
69619 struct timespec __user *, rmtp)
69620 {
69621- struct k_clock *kc = clockid_to_kclock(which_clock);
69622+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69623 struct timespec t;
69624
69625 if (!kc)
69626@@ -1057,7 +1067,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69627 long clock_nanosleep_restart(struct restart_block *restart_block)
69628 {
69629 clockid_t which_clock = restart_block->nanosleep.index;
69630- struct k_clock *kc = clockid_to_kclock(which_clock);
69631+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69632
69633 if (WARN_ON_ONCE(!kc || !kc->nsleep_restart))
69634 return -EINVAL;
69635diff -urNp linux-2.6.39.2/kernel/power/poweroff.c linux-2.6.39.2/kernel/power/poweroff.c
69636--- linux-2.6.39.2/kernel/power/poweroff.c 2011-05-19 00:06:34.000000000 -0400
69637+++ linux-2.6.39.2/kernel/power/poweroff.c 2011-05-22 19:36:33.000000000 -0400
69638@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
69639 .enable_mask = SYSRQ_ENABLE_BOOT,
69640 };
69641
69642-static int pm_sysrq_init(void)
69643+static int __init pm_sysrq_init(void)
69644 {
69645 register_sysrq_key('o', &sysrq_poweroff_op);
69646 return 0;
69647diff -urNp linux-2.6.39.2/kernel/power/process.c linux-2.6.39.2/kernel/power/process.c
69648--- linux-2.6.39.2/kernel/power/process.c 2011-05-19 00:06:34.000000000 -0400
69649+++ linux-2.6.39.2/kernel/power/process.c 2011-05-22 19:36:33.000000000 -0400
69650@@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
69651 u64 elapsed_csecs64;
69652 unsigned int elapsed_csecs;
69653 bool wakeup = false;
69654+ bool timedout = false;
69655
69656 do_gettimeofday(&start);
69657
69658@@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_
69659
69660 while (true) {
69661 todo = 0;
69662+ if (time_after(jiffies, end_time))
69663+ timedout = true;
69664 read_lock(&tasklist_lock);
69665 do_each_thread(g, p) {
69666 if (frozen(p) || !freezable(p))
69667@@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_
69668 * try_to_stop() after schedule() in ptrace/signal
69669 * stop sees TIF_FREEZE.
69670 */
69671- if (!task_is_stopped_or_traced(p) &&
69672- !freezer_should_skip(p))
69673+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
69674 todo++;
69675+ if (timedout) {
69676+ printk(KERN_ERR "Task refusing to freeze:\n");
69677+ sched_show_task(p);
69678+ }
69679+ }
69680 } while_each_thread(g, p);
69681 read_unlock(&tasklist_lock);
69682
69683@@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_
69684 todo += wq_busy;
69685 }
69686
69687- if (!todo || time_after(jiffies, end_time))
69688+ if (!todo || timedout)
69689 break;
69690
69691 if (pm_wakeup_pending()) {
69692diff -urNp linux-2.6.39.2/kernel/printk.c linux-2.6.39.2/kernel/printk.c
69693--- linux-2.6.39.2/kernel/printk.c 2011-05-19 00:06:34.000000000 -0400
69694+++ linux-2.6.39.2/kernel/printk.c 2011-05-22 19:41:42.000000000 -0400
69695@@ -284,12 +284,17 @@ static int check_syslog_permissions(int
69696 if (from_file && type != SYSLOG_ACTION_OPEN)
69697 return 0;
69698
69699+#ifdef CONFIG_GRKERNSEC_DMESG
69700+ if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
69701+ return -EPERM;
69702+#endif
69703+
69704 if (syslog_action_restricted(type)) {
69705 if (capable(CAP_SYSLOG))
69706 return 0;
69707 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
69708 if (capable(CAP_SYS_ADMIN)) {
69709- WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
69710+ printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN "
69711 "but no CAP_SYSLOG (deprecated).\n");
69712 return 0;
69713 }
69714diff -urNp linux-2.6.39.2/kernel/profile.c linux-2.6.39.2/kernel/profile.c
69715--- linux-2.6.39.2/kernel/profile.c 2011-05-19 00:06:34.000000000 -0400
69716+++ linux-2.6.39.2/kernel/profile.c 2011-05-22 19:36:33.000000000 -0400
69717@@ -39,7 +39,7 @@ struct profile_hit {
69718 /* Oprofile timer tick hook */
69719 static int (*timer_hook)(struct pt_regs *) __read_mostly;
69720
69721-static atomic_t *prof_buffer;
69722+static atomic_unchecked_t *prof_buffer;
69723 static unsigned long prof_len, prof_shift;
69724
69725 int prof_on __read_mostly;
69726@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
69727 hits[i].pc = 0;
69728 continue;
69729 }
69730- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69731+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69732 hits[i].hits = hits[i].pc = 0;
69733 }
69734 }
69735@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
69736 * Add the current hit(s) and flush the write-queue out
69737 * to the global buffer:
69738 */
69739- atomic_add(nr_hits, &prof_buffer[pc]);
69740+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
69741 for (i = 0; i < NR_PROFILE_HIT; ++i) {
69742- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69743+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69744 hits[i].pc = hits[i].hits = 0;
69745 }
69746 out:
69747@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
69748 if (prof_on != type || !prof_buffer)
69749 return;
69750 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
69751- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69752+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69753 }
69754 #endif /* !CONFIG_SMP */
69755 EXPORT_SYMBOL_GPL(profile_hits);
69756@@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
69757 return -EFAULT;
69758 buf++; p++; count--; read++;
69759 }
69760- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
69761+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
69762 if (copy_to_user(buf, (void *)pnt, count))
69763 return -EFAULT;
69764 read += count;
69765@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
69766 }
69767 #endif
69768 profile_discard_flip_buffers();
69769- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
69770+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
69771 return count;
69772 }
69773
69774diff -urNp linux-2.6.39.2/kernel/ptrace.c linux-2.6.39.2/kernel/ptrace.c
69775--- linux-2.6.39.2/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
69776+++ linux-2.6.39.2/kernel/ptrace.c 2011-05-23 17:07:00.000000000 -0400
69777@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
69778 return ret;
69779 }
69780
69781-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
69782+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
69783+ unsigned int log)
69784 {
69785 const struct cred *cred = current_cred(), *tcred;
69786
69787@@ -143,7 +144,8 @@ int __ptrace_may_access(struct task_stru
69788 cred->gid == tcred->sgid &&
69789 cred->gid == tcred->gid))
69790 goto ok;
69791- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
69792+ if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
69793+ (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
69794 goto ok;
69795 rcu_read_unlock();
69796 return -EPERM;
69797@@ -152,7 +154,9 @@ ok:
69798 smp_rmb();
69799 if (task->mm)
69800 dumpable = get_dumpable(task->mm);
69801- if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
69802+ if (!dumpable &&
69803+ ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
69804+ (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
69805 return -EPERM;
69806
69807 return security_ptrace_access_check(task, mode);
69808@@ -162,7 +166,16 @@ bool ptrace_may_access(struct task_struc
69809 {
69810 int err;
69811 task_lock(task);
69812- err = __ptrace_may_access(task, mode);
69813+ err = __ptrace_may_access(task, mode, 0);
69814+ task_unlock(task);
69815+ return !err;
69816+}
69817+
69818+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
69819+{
69820+ int err;
69821+ task_lock(task);
69822+ err = __ptrace_may_access(task, mode, 1);
69823 task_unlock(task);
69824 return !err;
69825 }
69826@@ -189,7 +202,7 @@ static int ptrace_attach(struct task_str
69827 goto out;
69828
69829 task_lock(task);
69830- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
69831+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
69832 task_unlock(task);
69833 if (retval)
69834 goto unlock_creds;
69835@@ -202,7 +215,7 @@ static int ptrace_attach(struct task_str
69836 goto unlock_tasklist;
69837
69838 task->ptrace = PT_PTRACED;
69839- if (task_ns_capable(task, CAP_SYS_PTRACE))
69840+ if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
69841 task->ptrace |= PT_PTRACE_CAP;
69842
69843 __ptrace_link(task, current);
69844@@ -362,6 +375,8 @@ int ptrace_readdata(struct task_struct *
69845 {
69846 int copied = 0;
69847
69848+ pax_track_stack();
69849+
69850 while (len > 0) {
69851 char buf[128];
69852 int this_len, retval;
69853@@ -373,7 +388,7 @@ int ptrace_readdata(struct task_struct *
69854 break;
69855 return -EIO;
69856 }
69857- if (copy_to_user(dst, buf, retval))
69858+ if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
69859 return -EFAULT;
69860 copied += retval;
69861 src += retval;
69862@@ -387,6 +402,8 @@ int ptrace_writedata(struct task_struct
69863 {
69864 int copied = 0;
69865
69866+ pax_track_stack();
69867+
69868 while (len > 0) {
69869 char buf[128];
69870 int this_len, retval;
69871@@ -569,9 +586,11 @@ int ptrace_request(struct task_struct *c
69872 {
69873 int ret = -EIO;
69874 siginfo_t siginfo;
69875- void __user *datavp = (void __user *) data;
69876+ void __user *datavp = (__force void __user *) data;
69877 unsigned long __user *datalp = datavp;
69878
69879+ pax_track_stack();
69880+
69881 switch (request) {
69882 case PTRACE_PEEKTEXT:
69883 case PTRACE_PEEKDATA:
69884@@ -717,14 +736,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
69885 goto out;
69886 }
69887
69888+ if (gr_handle_ptrace(child, request)) {
69889+ ret = -EPERM;
69890+ goto out_put_task_struct;
69891+ }
69892+
69893 if (request == PTRACE_ATTACH) {
69894 ret = ptrace_attach(child);
69895 /*
69896 * Some architectures need to do book-keeping after
69897 * a ptrace attach.
69898 */
69899- if (!ret)
69900+ if (!ret) {
69901 arch_ptrace_attach(child);
69902+ gr_audit_ptrace(child);
69903+ }
69904 goto out_put_task_struct;
69905 }
69906
69907@@ -749,7 +775,7 @@ int generic_ptrace_peekdata(struct task_
69908 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
69909 if (copied != sizeof(tmp))
69910 return -EIO;
69911- return put_user(tmp, (unsigned long __user *)data);
69912+ return put_user(tmp, (__force unsigned long __user *)data);
69913 }
69914
69915 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
69916@@ -772,6 +798,8 @@ int compat_ptrace_request(struct task_st
69917 siginfo_t siginfo;
69918 int ret;
69919
69920+ pax_track_stack();
69921+
69922 switch (request) {
69923 case PTRACE_PEEKTEXT:
69924 case PTRACE_PEEKDATA:
69925@@ -859,14 +887,21 @@ asmlinkage long compat_sys_ptrace(compat
69926 goto out;
69927 }
69928
69929+ if (gr_handle_ptrace(child, request)) {
69930+ ret = -EPERM;
69931+ goto out_put_task_struct;
69932+ }
69933+
69934 if (request == PTRACE_ATTACH) {
69935 ret = ptrace_attach(child);
69936 /*
69937 * Some architectures need to do book-keeping after
69938 * a ptrace attach.
69939 */
69940- if (!ret)
69941+ if (!ret) {
69942 arch_ptrace_attach(child);
69943+ gr_audit_ptrace(child);
69944+ }
69945 goto out_put_task_struct;
69946 }
69947
69948diff -urNp linux-2.6.39.2/kernel/rcutorture.c linux-2.6.39.2/kernel/rcutorture.c
69949--- linux-2.6.39.2/kernel/rcutorture.c 2011-05-19 00:06:34.000000000 -0400
69950+++ linux-2.6.39.2/kernel/rcutorture.c 2011-05-22 19:36:33.000000000 -0400
69951@@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
69952 { 0 };
69953 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
69954 { 0 };
69955-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69956-static atomic_t n_rcu_torture_alloc;
69957-static atomic_t n_rcu_torture_alloc_fail;
69958-static atomic_t n_rcu_torture_free;
69959-static atomic_t n_rcu_torture_mberror;
69960-static atomic_t n_rcu_torture_error;
69961+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69962+static atomic_unchecked_t n_rcu_torture_alloc;
69963+static atomic_unchecked_t n_rcu_torture_alloc_fail;
69964+static atomic_unchecked_t n_rcu_torture_free;
69965+static atomic_unchecked_t n_rcu_torture_mberror;
69966+static atomic_unchecked_t n_rcu_torture_error;
69967 static long n_rcu_torture_boost_ktrerror;
69968 static long n_rcu_torture_boost_rterror;
69969 static long n_rcu_torture_boost_allocerror;
69970@@ -225,11 +225,11 @@ rcu_torture_alloc(void)
69971
69972 spin_lock_bh(&rcu_torture_lock);
69973 if (list_empty(&rcu_torture_freelist)) {
69974- atomic_inc(&n_rcu_torture_alloc_fail);
69975+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
69976 spin_unlock_bh(&rcu_torture_lock);
69977 return NULL;
69978 }
69979- atomic_inc(&n_rcu_torture_alloc);
69980+ atomic_inc_unchecked(&n_rcu_torture_alloc);
69981 p = rcu_torture_freelist.next;
69982 list_del_init(p);
69983 spin_unlock_bh(&rcu_torture_lock);
69984@@ -242,7 +242,7 @@ rcu_torture_alloc(void)
69985 static void
69986 rcu_torture_free(struct rcu_torture *p)
69987 {
69988- atomic_inc(&n_rcu_torture_free);
69989+ atomic_inc_unchecked(&n_rcu_torture_free);
69990 spin_lock_bh(&rcu_torture_lock);
69991 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
69992 spin_unlock_bh(&rcu_torture_lock);
69993@@ -362,7 +362,7 @@ rcu_torture_cb(struct rcu_head *p)
69994 i = rp->rtort_pipe_count;
69995 if (i > RCU_TORTURE_PIPE_LEN)
69996 i = RCU_TORTURE_PIPE_LEN;
69997- atomic_inc(&rcu_torture_wcount[i]);
69998+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69999 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
70000 rp->rtort_mbtest = 0;
70001 rcu_torture_free(rp);
70002@@ -409,7 +409,7 @@ static void rcu_sync_torture_deferred_fr
70003 i = rp->rtort_pipe_count;
70004 if (i > RCU_TORTURE_PIPE_LEN)
70005 i = RCU_TORTURE_PIPE_LEN;
70006- atomic_inc(&rcu_torture_wcount[i]);
70007+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
70008 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
70009 rp->rtort_mbtest = 0;
70010 list_del(&rp->rtort_free);
70011@@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
70012 i = old_rp->rtort_pipe_count;
70013 if (i > RCU_TORTURE_PIPE_LEN)
70014 i = RCU_TORTURE_PIPE_LEN;
70015- atomic_inc(&rcu_torture_wcount[i]);
70016+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
70017 old_rp->rtort_pipe_count++;
70018 cur_ops->deferred_free(old_rp);
70019 }
70020@@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l
70021 return;
70022 }
70023 if (p->rtort_mbtest == 0)
70024- atomic_inc(&n_rcu_torture_mberror);
70025+ atomic_inc_unchecked(&n_rcu_torture_mberror);
70026 spin_lock(&rand_lock);
70027 cur_ops->read_delay(&rand);
70028 n_rcu_torture_timers++;
70029@@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg)
70030 continue;
70031 }
70032 if (p->rtort_mbtest == 0)
70033- atomic_inc(&n_rcu_torture_mberror);
70034+ atomic_inc_unchecked(&n_rcu_torture_mberror);
70035 cur_ops->read_delay(&rand);
70036 preempt_disable();
70037 pipe_count = p->rtort_pipe_count;
70038@@ -1072,10 +1072,10 @@ rcu_torture_printk(char *page)
70039 rcu_torture_current,
70040 rcu_torture_current_version,
70041 list_empty(&rcu_torture_freelist),
70042- atomic_read(&n_rcu_torture_alloc),
70043- atomic_read(&n_rcu_torture_alloc_fail),
70044- atomic_read(&n_rcu_torture_free),
70045- atomic_read(&n_rcu_torture_mberror),
70046+ atomic_read_unchecked(&n_rcu_torture_alloc),
70047+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
70048+ atomic_read_unchecked(&n_rcu_torture_free),
70049+ atomic_read_unchecked(&n_rcu_torture_mberror),
70050 n_rcu_torture_boost_ktrerror,
70051 n_rcu_torture_boost_rterror,
70052 n_rcu_torture_boost_allocerror,
70053@@ -1083,7 +1083,7 @@ rcu_torture_printk(char *page)
70054 n_rcu_torture_boost_failure,
70055 n_rcu_torture_boosts,
70056 n_rcu_torture_timers);
70057- if (atomic_read(&n_rcu_torture_mberror) != 0 ||
70058+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
70059 n_rcu_torture_boost_ktrerror != 0 ||
70060 n_rcu_torture_boost_rterror != 0 ||
70061 n_rcu_torture_boost_allocerror != 0 ||
70062@@ -1093,7 +1093,7 @@ rcu_torture_printk(char *page)
70063 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
70064 if (i > 1) {
70065 cnt += sprintf(&page[cnt], "!!! ");
70066- atomic_inc(&n_rcu_torture_error);
70067+ atomic_inc_unchecked(&n_rcu_torture_error);
70068 WARN_ON_ONCE(1);
70069 }
70070 cnt += sprintf(&page[cnt], "Reader Pipe: ");
70071@@ -1107,7 +1107,7 @@ rcu_torture_printk(char *page)
70072 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
70073 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
70074 cnt += sprintf(&page[cnt], " %d",
70075- atomic_read(&rcu_torture_wcount[i]));
70076+ atomic_read_unchecked(&rcu_torture_wcount[i]));
70077 }
70078 cnt += sprintf(&page[cnt], "\n");
70079 if (cur_ops->stats)
70080@@ -1415,7 +1415,7 @@ rcu_torture_cleanup(void)
70081
70082 if (cur_ops->cleanup)
70083 cur_ops->cleanup();
70084- if (atomic_read(&n_rcu_torture_error))
70085+ if (atomic_read_unchecked(&n_rcu_torture_error))
70086 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
70087 else
70088 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
70089@@ -1479,11 +1479,11 @@ rcu_torture_init(void)
70090
70091 rcu_torture_current = NULL;
70092 rcu_torture_current_version = 0;
70093- atomic_set(&n_rcu_torture_alloc, 0);
70094- atomic_set(&n_rcu_torture_alloc_fail, 0);
70095- atomic_set(&n_rcu_torture_free, 0);
70096- atomic_set(&n_rcu_torture_mberror, 0);
70097- atomic_set(&n_rcu_torture_error, 0);
70098+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
70099+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
70100+ atomic_set_unchecked(&n_rcu_torture_free, 0);
70101+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
70102+ atomic_set_unchecked(&n_rcu_torture_error, 0);
70103 n_rcu_torture_boost_ktrerror = 0;
70104 n_rcu_torture_boost_rterror = 0;
70105 n_rcu_torture_boost_allocerror = 0;
70106@@ -1491,7 +1491,7 @@ rcu_torture_init(void)
70107 n_rcu_torture_boost_failure = 0;
70108 n_rcu_torture_boosts = 0;
70109 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
70110- atomic_set(&rcu_torture_wcount[i], 0);
70111+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
70112 for_each_possible_cpu(cpu) {
70113 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
70114 per_cpu(rcu_torture_count, cpu)[i] = 0;
70115diff -urNp linux-2.6.39.2/kernel/rcutree.c linux-2.6.39.2/kernel/rcutree.c
70116--- linux-2.6.39.2/kernel/rcutree.c 2011-05-19 00:06:34.000000000 -0400
70117+++ linux-2.6.39.2/kernel/rcutree.c 2011-05-22 19:36:33.000000000 -0400
70118@@ -1389,7 +1389,7 @@ __rcu_process_callbacks(struct rcu_state
70119 /*
70120 * Do softirq processing for the current CPU.
70121 */
70122-static void rcu_process_callbacks(struct softirq_action *unused)
70123+static void rcu_process_callbacks(void)
70124 {
70125 /*
70126 * Memory references from any prior RCU read-side critical sections
70127diff -urNp linux-2.6.39.2/kernel/rcutree_plugin.h linux-2.6.39.2/kernel/rcutree_plugin.h
70128--- linux-2.6.39.2/kernel/rcutree_plugin.h 2011-05-19 00:06:34.000000000 -0400
70129+++ linux-2.6.39.2/kernel/rcutree_plugin.h 2011-05-22 19:36:33.000000000 -0400
70130@@ -730,7 +730,7 @@ void synchronize_rcu_expedited(void)
70131
70132 /* Clean up and exit. */
70133 smp_mb(); /* ensure expedited GP seen before counter increment. */
70134- ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
70135+ ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
70136 unlock_mb_ret:
70137 mutex_unlock(&sync_rcu_preempt_exp_mutex);
70138 mb_ret:
70139@@ -1025,8 +1025,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
70140
70141 #else /* #ifndef CONFIG_SMP */
70142
70143-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
70144-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
70145+static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
70146+static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
70147
70148 static int synchronize_sched_expedited_cpu_stop(void *data)
70149 {
70150@@ -1081,7 +1081,7 @@ void synchronize_sched_expedited(void)
70151 int firstsnap, s, snap, trycount = 0;
70152
70153 /* Note that atomic_inc_return() implies full memory barrier. */
70154- firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
70155+ firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
70156 get_online_cpus();
70157
70158 /*
70159@@ -1102,7 +1102,7 @@ void synchronize_sched_expedited(void)
70160 }
70161
70162 /* Check to see if someone else did our work for us. */
70163- s = atomic_read(&sync_sched_expedited_done);
70164+ s = atomic_read_unchecked(&sync_sched_expedited_done);
70165 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
70166 smp_mb(); /* ensure test happens before caller kfree */
70167 return;
70168@@ -1117,7 +1117,7 @@ void synchronize_sched_expedited(void)
70169 * grace period works for us.
70170 */
70171 get_online_cpus();
70172- snap = atomic_read(&sync_sched_expedited_started) - 1;
70173+ snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
70174 smp_mb(); /* ensure read is before try_stop_cpus(). */
70175 }
70176
70177@@ -1128,12 +1128,12 @@ void synchronize_sched_expedited(void)
70178 * than we did beat us to the punch.
70179 */
70180 do {
70181- s = atomic_read(&sync_sched_expedited_done);
70182+ s = atomic_read_unchecked(&sync_sched_expedited_done);
70183 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
70184 smp_mb(); /* ensure test happens before caller kfree */
70185 break;
70186 }
70187- } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
70188+ } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
70189
70190 put_online_cpus();
70191 }
70192diff -urNp linux-2.6.39.2/kernel/relay.c linux-2.6.39.2/kernel/relay.c
70193--- linux-2.6.39.2/kernel/relay.c 2011-05-19 00:06:34.000000000 -0400
70194+++ linux-2.6.39.2/kernel/relay.c 2011-05-22 19:36:33.000000000 -0400
70195@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
70196 };
70197 ssize_t ret;
70198
70199+ pax_track_stack();
70200+
70201 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
70202 return 0;
70203 if (splice_grow_spd(pipe, &spd))
70204diff -urNp linux-2.6.39.2/kernel/resource.c linux-2.6.39.2/kernel/resource.c
70205--- linux-2.6.39.2/kernel/resource.c 2011-05-19 00:06:34.000000000 -0400
70206+++ linux-2.6.39.2/kernel/resource.c 2011-05-22 19:41:42.000000000 -0400
70207@@ -133,8 +133,18 @@ static const struct file_operations proc
70208
70209 static int __init ioresources_init(void)
70210 {
70211+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70212+#ifdef CONFIG_GRKERNSEC_PROC_USER
70213+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
70214+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
70215+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
70216+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
70217+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
70218+#endif
70219+#else
70220 proc_create("ioports", 0, NULL, &proc_ioports_operations);
70221 proc_create("iomem", 0, NULL, &proc_iomem_operations);
70222+#endif
70223 return 0;
70224 }
70225 __initcall(ioresources_init);
70226diff -urNp linux-2.6.39.2/kernel/rtmutex-tester.c linux-2.6.39.2/kernel/rtmutex-tester.c
70227--- linux-2.6.39.2/kernel/rtmutex-tester.c 2011-05-19 00:06:34.000000000 -0400
70228+++ linux-2.6.39.2/kernel/rtmutex-tester.c 2011-05-22 19:36:33.000000000 -0400
70229@@ -20,7 +20,7 @@
70230 #define MAX_RT_TEST_MUTEXES 8
70231
70232 static spinlock_t rttest_lock;
70233-static atomic_t rttest_event;
70234+static atomic_unchecked_t rttest_event;
70235
70236 struct test_thread_data {
70237 int opcode;
70238@@ -61,7 +61,7 @@ static int handle_op(struct test_thread_
70239
70240 case RTTEST_LOCKCONT:
70241 td->mutexes[td->opdata] = 1;
70242- td->event = atomic_add_return(1, &rttest_event);
70243+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70244 return 0;
70245
70246 case RTTEST_RESET:
70247@@ -74,7 +74,7 @@ static int handle_op(struct test_thread_
70248 return 0;
70249
70250 case RTTEST_RESETEVENT:
70251- atomic_set(&rttest_event, 0);
70252+ atomic_set_unchecked(&rttest_event, 0);
70253 return 0;
70254
70255 default:
70256@@ -91,9 +91,9 @@ static int handle_op(struct test_thread_
70257 return ret;
70258
70259 td->mutexes[id] = 1;
70260- td->event = atomic_add_return(1, &rttest_event);
70261+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70262 rt_mutex_lock(&mutexes[id]);
70263- td->event = atomic_add_return(1, &rttest_event);
70264+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70265 td->mutexes[id] = 4;
70266 return 0;
70267
70268@@ -104,9 +104,9 @@ static int handle_op(struct test_thread_
70269 return ret;
70270
70271 td->mutexes[id] = 1;
70272- td->event = atomic_add_return(1, &rttest_event);
70273+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70274 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
70275- td->event = atomic_add_return(1, &rttest_event);
70276+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70277 td->mutexes[id] = ret ? 0 : 4;
70278 return ret ? -EINTR : 0;
70279
70280@@ -115,9 +115,9 @@ static int handle_op(struct test_thread_
70281 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
70282 return ret;
70283
70284- td->event = atomic_add_return(1, &rttest_event);
70285+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70286 rt_mutex_unlock(&mutexes[id]);
70287- td->event = atomic_add_return(1, &rttest_event);
70288+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70289 td->mutexes[id] = 0;
70290 return 0;
70291
70292@@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu
70293 break;
70294
70295 td->mutexes[dat] = 2;
70296- td->event = atomic_add_return(1, &rttest_event);
70297+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70298 break;
70299
70300 default:
70301@@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu
70302 return;
70303
70304 td->mutexes[dat] = 3;
70305- td->event = atomic_add_return(1, &rttest_event);
70306+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70307 break;
70308
70309 case RTTEST_LOCKNOWAIT:
70310@@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu
70311 return;
70312
70313 td->mutexes[dat] = 1;
70314- td->event = atomic_add_return(1, &rttest_event);
70315+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70316 return;
70317
70318 default:
70319diff -urNp linux-2.6.39.2/kernel/sched_autogroup.c linux-2.6.39.2/kernel/sched_autogroup.c
70320--- linux-2.6.39.2/kernel/sched_autogroup.c 2011-05-19 00:06:34.000000000 -0400
70321+++ linux-2.6.39.2/kernel/sched_autogroup.c 2011-05-22 19:36:33.000000000 -0400
70322@@ -7,7 +7,7 @@
70323
70324 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
70325 static struct autogroup autogroup_default;
70326-static atomic_t autogroup_seq_nr;
70327+static atomic_unchecked_t autogroup_seq_nr;
70328
70329 static void __init autogroup_init(struct task_struct *init_task)
70330 {
70331@@ -78,7 +78,7 @@ static inline struct autogroup *autogrou
70332
70333 kref_init(&ag->kref);
70334 init_rwsem(&ag->lock);
70335- ag->id = atomic_inc_return(&autogroup_seq_nr);
70336+ ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
70337 ag->tg = tg;
70338 #ifdef CONFIG_RT_GROUP_SCHED
70339 /*
70340diff -urNp linux-2.6.39.2/kernel/sched.c linux-2.6.39.2/kernel/sched.c
70341--- linux-2.6.39.2/kernel/sched.c 2011-05-19 00:06:34.000000000 -0400
70342+++ linux-2.6.39.2/kernel/sched.c 2011-05-23 17:07:00.000000000 -0400
70343@@ -4078,6 +4078,8 @@ asmlinkage void __sched schedule(void)
70344 struct rq *rq;
70345 int cpu;
70346
70347+ pax_track_stack();
70348+
70349 need_resched:
70350 preempt_disable();
70351 cpu = smp_processor_id();
70352@@ -4165,7 +4167,7 @@ EXPORT_SYMBOL(schedule);
70353 * Look out! "owner" is an entirely speculative pointer
70354 * access and not reliable.
70355 */
70356-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
70357+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
70358 {
70359 unsigned int cpu;
70360 struct rq *rq;
70361@@ -4179,10 +4181,10 @@ int mutex_spin_on_owner(struct mutex *lo
70362 * DEBUG_PAGEALLOC could have unmapped it if
70363 * the mutex owner just released it and exited.
70364 */
70365- if (probe_kernel_address(&owner->cpu, cpu))
70366+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
70367 return 0;
70368 #else
70369- cpu = owner->cpu;
70370+ cpu = task_thread_info(owner)->cpu;
70371 #endif
70372
70373 /*
70374@@ -4219,7 +4221,7 @@ int mutex_spin_on_owner(struct mutex *lo
70375 /*
70376 * Is that owner really running on that cpu?
70377 */
70378- if (task_thread_info(rq->curr) != owner || need_resched())
70379+ if (rq->curr != owner || need_resched())
70380 return 0;
70381
70382 arch_mutex_cpu_relax();
70383@@ -4778,6 +4780,8 @@ int can_nice(const struct task_struct *p
70384 /* convert nice value [19,-20] to rlimit style value [1,40] */
70385 int nice_rlim = 20 - nice;
70386
70387+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
70388+
70389 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
70390 capable(CAP_SYS_NICE));
70391 }
70392@@ -4811,7 +4815,8 @@ SYSCALL_DEFINE1(nice, int, increment)
70393 if (nice > 19)
70394 nice = 19;
70395
70396- if (increment < 0 && !can_nice(current, nice))
70397+ if (increment < 0 && (!can_nice(current, nice) ||
70398+ gr_handle_chroot_nice()))
70399 return -EPERM;
70400
70401 retval = security_task_setnice(current, nice);
70402@@ -4957,6 +4962,7 @@ recheck:
70403 unsigned long rlim_rtprio =
70404 task_rlimit(p, RLIMIT_RTPRIO);
70405
70406+ gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
70407 /* can't set/change the rt policy */
70408 if (policy != p->policy && !rlim_rtprio)
70409 return -EPERM;
70410@@ -7164,7 +7170,7 @@ static void init_sched_groups_power(int
70411 long power;
70412 int weight;
70413
70414- WARN_ON(!sd || !sd->groups);
70415+ BUG_ON(!sd || !sd->groups);
70416
70417 if (cpu != group_first_cpu(sd->groups))
70418 return;
70419diff -urNp linux-2.6.39.2/kernel/sched_fair.c linux-2.6.39.2/kernel/sched_fair.c
70420--- linux-2.6.39.2/kernel/sched_fair.c 2011-05-19 00:06:34.000000000 -0400
70421+++ linux-2.6.39.2/kernel/sched_fair.c 2011-05-22 19:36:33.000000000 -0400
70422@@ -3999,7 +3999,7 @@ static void nohz_idle_balance(int this_c
70423 * run_rebalance_domains is triggered when needed from the scheduler tick.
70424 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
70425 */
70426-static void run_rebalance_domains(struct softirq_action *h)
70427+static void run_rebalance_domains(void)
70428 {
70429 int this_cpu = smp_processor_id();
70430 struct rq *this_rq = cpu_rq(this_cpu);
70431diff -urNp linux-2.6.39.2/kernel/signal.c linux-2.6.39.2/kernel/signal.c
70432--- linux-2.6.39.2/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
70433+++ linux-2.6.39.2/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
70434@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
70435
70436 int print_fatal_signals __read_mostly;
70437
70438-static void __user *sig_handler(struct task_struct *t, int sig)
70439+static __sighandler_t sig_handler(struct task_struct *t, int sig)
70440 {
70441 return t->sighand->action[sig - 1].sa.sa_handler;
70442 }
70443
70444-static int sig_handler_ignored(void __user *handler, int sig)
70445+static int sig_handler_ignored(__sighandler_t handler, int sig)
70446 {
70447 /* Is it explicitly or implicitly ignored? */
70448 return handler == SIG_IGN ||
70449@@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us
70450 static int sig_task_ignored(struct task_struct *t, int sig,
70451 int from_ancestor_ns)
70452 {
70453- void __user *handler;
70454+ __sighandler_t handler;
70455
70456 handler = sig_handler(t, sig);
70457
70458@@ -243,6 +243,9 @@ __sigqueue_alloc(int sig, struct task_st
70459 atomic_inc(&user->sigpending);
70460 rcu_read_unlock();
70461
70462+ if (!override_rlimit)
70463+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
70464+
70465 if (override_rlimit ||
70466 atomic_read(&user->sigpending) <=
70467 task_rlimit(t, RLIMIT_SIGPENDING)) {
70468@@ -367,7 +370,7 @@ flush_signal_handlers(struct task_struct
70469
70470 int unhandled_signal(struct task_struct *tsk, int sig)
70471 {
70472- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
70473+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
70474 if (is_global_init(tsk))
70475 return 1;
70476 if (handler != SIG_IGN && handler != SIG_DFL)
70477@@ -693,6 +696,9 @@ static int check_kill_permission(int sig
70478 }
70479 }
70480
70481+ if (gr_handle_signal(t, sig))
70482+ return -EPERM;
70483+
70484 return security_task_kill(t, info, sig, 0);
70485 }
70486
70487@@ -1041,7 +1047,7 @@ __group_send_sig_info(int sig, struct si
70488 return send_signal(sig, info, p, 1);
70489 }
70490
70491-static int
70492+int
70493 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
70494 {
70495 return send_signal(sig, info, t, 0);
70496@@ -1078,6 +1084,7 @@ force_sig_info(int sig, struct siginfo *
70497 unsigned long int flags;
70498 int ret, blocked, ignored;
70499 struct k_sigaction *action;
70500+ int is_unhandled = 0;
70501
70502 spin_lock_irqsave(&t->sighand->siglock, flags);
70503 action = &t->sighand->action[sig-1];
70504@@ -1092,9 +1099,18 @@ force_sig_info(int sig, struct siginfo *
70505 }
70506 if (action->sa.sa_handler == SIG_DFL)
70507 t->signal->flags &= ~SIGNAL_UNKILLABLE;
70508+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
70509+ is_unhandled = 1;
70510 ret = specific_send_sig_info(sig, info, t);
70511 spin_unlock_irqrestore(&t->sighand->siglock, flags);
70512
70513+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
70514+ normal operation */
70515+ if (is_unhandled) {
70516+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
70517+ gr_handle_crash(t, sig);
70518+ }
70519+
70520 return ret;
70521 }
70522
70523@@ -1153,8 +1169,11 @@ int group_send_sig_info(int sig, struct
70524 ret = check_kill_permission(sig, info, p);
70525 rcu_read_unlock();
70526
70527- if (!ret && sig)
70528+ if (!ret && sig) {
70529 ret = do_send_sig_info(sig, info, p, true);
70530+ if (!ret)
70531+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
70532+ }
70533
70534 return ret;
70535 }
70536@@ -1718,6 +1737,8 @@ void ptrace_notify(int exit_code)
70537 {
70538 siginfo_t info;
70539
70540+ pax_track_stack();
70541+
70542 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
70543
70544 memset(&info, 0, sizeof info);
70545diff -urNp linux-2.6.39.2/kernel/smp.c linux-2.6.39.2/kernel/smp.c
70546--- linux-2.6.39.2/kernel/smp.c 2011-05-19 00:06:34.000000000 -0400
70547+++ linux-2.6.39.2/kernel/smp.c 2011-05-22 19:36:33.000000000 -0400
70548@@ -583,22 +583,22 @@ int smp_call_function(smp_call_func_t fu
70549 }
70550 EXPORT_SYMBOL(smp_call_function);
70551
70552-void ipi_call_lock(void)
70553+void ipi_call_lock(void) __acquires(call_function.lock)
70554 {
70555 raw_spin_lock(&call_function.lock);
70556 }
70557
70558-void ipi_call_unlock(void)
70559+void ipi_call_unlock(void) __releases(call_function.lock)
70560 {
70561 raw_spin_unlock(&call_function.lock);
70562 }
70563
70564-void ipi_call_lock_irq(void)
70565+void ipi_call_lock_irq(void) __acquires(call_function.lock)
70566 {
70567 raw_spin_lock_irq(&call_function.lock);
70568 }
70569
70570-void ipi_call_unlock_irq(void)
70571+void ipi_call_unlock_irq(void) __releases(call_function.lock)
70572 {
70573 raw_spin_unlock_irq(&call_function.lock);
70574 }
70575diff -urNp linux-2.6.39.2/kernel/softirq.c linux-2.6.39.2/kernel/softirq.c
70576--- linux-2.6.39.2/kernel/softirq.c 2011-05-19 00:06:34.000000000 -0400
70577+++ linux-2.6.39.2/kernel/softirq.c 2011-05-22 19:36:33.000000000 -0400
70578@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
70579
70580 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
70581
70582-char *softirq_to_name[NR_SOFTIRQS] = {
70583+const char * const softirq_to_name[NR_SOFTIRQS] = {
70584 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
70585 "TASKLET", "SCHED", "HRTIMER", "RCU"
70586 };
70587@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
70588
70589 asmlinkage void __do_softirq(void)
70590 {
70591- struct softirq_action *h;
70592+ const struct softirq_action *h;
70593 __u32 pending;
70594 int max_restart = MAX_SOFTIRQ_RESTART;
70595 int cpu;
70596@@ -235,7 +235,7 @@ restart:
70597 kstat_incr_softirqs_this_cpu(vec_nr);
70598
70599 trace_softirq_entry(vec_nr);
70600- h->action(h);
70601+ h->action();
70602 trace_softirq_exit(vec_nr);
70603 if (unlikely(prev_count != preempt_count())) {
70604 printk(KERN_ERR "huh, entered softirq %u %s %p"
70605@@ -377,7 +377,7 @@ void raise_softirq(unsigned int nr)
70606 local_irq_restore(flags);
70607 }
70608
70609-void open_softirq(int nr, void (*action)(struct softirq_action *))
70610+void open_softirq(int nr, void (*action)(void))
70611 {
70612 softirq_vec[nr].action = action;
70613 }
70614@@ -433,7 +433,7 @@ void __tasklet_hi_schedule_first(struct
70615
70616 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
70617
70618-static void tasklet_action(struct softirq_action *a)
70619+static void tasklet_action(void)
70620 {
70621 struct tasklet_struct *list;
70622
70623@@ -468,7 +468,7 @@ static void tasklet_action(struct softir
70624 }
70625 }
70626
70627-static void tasklet_hi_action(struct softirq_action *a)
70628+static void tasklet_hi_action(void)
70629 {
70630 struct tasklet_struct *list;
70631
70632diff -urNp linux-2.6.39.2/kernel/sys.c linux-2.6.39.2/kernel/sys.c
70633--- linux-2.6.39.2/kernel/sys.c 2011-05-19 00:06:34.000000000 -0400
70634+++ linux-2.6.39.2/kernel/sys.c 2011-05-22 21:08:10.000000000 -0400
70635@@ -154,6 +154,12 @@ static int set_one_prio(struct task_stru
70636 error = -EACCES;
70637 goto out;
70638 }
70639+
70640+ if (gr_handle_chroot_setpriority(p, niceval)) {
70641+ error = -EACCES;
70642+ goto out;
70643+ }
70644+
70645 no_nice = security_task_setnice(p, niceval);
70646 if (no_nice) {
70647 error = no_nice;
70648@@ -538,6 +544,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
70649 goto error;
70650 }
70651
70652+ if (gr_check_group_change(new->gid, new->egid, -1))
70653+ goto error;
70654+
70655 if (rgid != (gid_t) -1 ||
70656 (egid != (gid_t) -1 && egid != old->gid))
70657 new->sgid = new->egid;
70658@@ -567,6 +576,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
70659 old = current_cred();
70660
70661 retval = -EPERM;
70662+
70663+ if (gr_check_group_change(gid, gid, gid))
70664+ goto error;
70665+
70666 if (nsown_capable(CAP_SETGID))
70667 new->gid = new->egid = new->sgid = new->fsgid = gid;
70668 else if (gid == old->gid || gid == old->sgid)
70669@@ -647,6 +660,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
70670 goto error;
70671 }
70672
70673+ if (gr_check_user_change(new->uid, new->euid, -1))
70674+ goto error;
70675+
70676 if (new->uid != old->uid) {
70677 retval = set_user(new);
70678 if (retval < 0)
70679@@ -691,6 +707,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
70680 old = current_cred();
70681
70682 retval = -EPERM;
70683+
70684+ if (gr_check_crash_uid(uid))
70685+ goto error;
70686+ if (gr_check_user_change(uid, uid, uid))
70687+ goto error;
70688+
70689 if (nsown_capable(CAP_SETUID)) {
70690 new->suid = new->uid = uid;
70691 if (uid != old->uid) {
70692@@ -745,6 +767,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
70693 goto error;
70694 }
70695
70696+ if (gr_check_user_change(ruid, euid, -1))
70697+ goto error;
70698+
70699 if (ruid != (uid_t) -1) {
70700 new->uid = ruid;
70701 if (ruid != old->uid) {
70702@@ -809,6 +834,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
70703 goto error;
70704 }
70705
70706+ if (gr_check_group_change(rgid, egid, -1))
70707+ goto error;
70708+
70709 if (rgid != (gid_t) -1)
70710 new->gid = rgid;
70711 if (egid != (gid_t) -1)
70712@@ -855,6 +883,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70713 old = current_cred();
70714 old_fsuid = old->fsuid;
70715
70716+ if (gr_check_user_change(-1, -1, uid))
70717+ goto error;
70718+
70719 if (uid == old->uid || uid == old->euid ||
70720 uid == old->suid || uid == old->fsuid ||
70721 nsown_capable(CAP_SETUID)) {
70722@@ -865,6 +896,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70723 }
70724 }
70725
70726+error:
70727 abort_creds(new);
70728 return old_fsuid;
70729
70730@@ -891,12 +923,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
70731 if (gid == old->gid || gid == old->egid ||
70732 gid == old->sgid || gid == old->fsgid ||
70733 nsown_capable(CAP_SETGID)) {
70734+ if (gr_check_group_change(-1, -1, gid))
70735+ goto error;
70736+
70737 if (gid != old_fsgid) {
70738 new->fsgid = gid;
70739 goto change_okay;
70740 }
70741 }
70742
70743+error:
70744 abort_creds(new);
70745 return old_fsgid;
70746
70747@@ -1643,7 +1679,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
70748 error = get_dumpable(me->mm);
70749 break;
70750 case PR_SET_DUMPABLE:
70751- if (arg2 < 0 || arg2 > 1) {
70752+ if (arg2 > 1) {
70753 error = -EINVAL;
70754 break;
70755 }
70756diff -urNp linux-2.6.39.2/kernel/sysctl.c linux-2.6.39.2/kernel/sysctl.c
70757--- linux-2.6.39.2/kernel/sysctl.c 2011-05-19 00:06:34.000000000 -0400
70758+++ linux-2.6.39.2/kernel/sysctl.c 2011-05-22 20:23:10.000000000 -0400
70759@@ -84,6 +84,13 @@
70760
70761
70762 #if defined(CONFIG_SYSCTL)
70763+#include <linux/grsecurity.h>
70764+#include <linux/grinternal.h>
70765+
70766+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
70767+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
70768+ const int op);
70769+extern int gr_handle_chroot_sysctl(const int op);
70770
70771 /* External variables not in a header file. */
70772 extern int sysctl_overcommit_memory;
70773@@ -196,6 +203,7 @@ static int sysrq_sysctl_handler(ctl_tabl
70774 }
70775
70776 #endif
70777+extern struct ctl_table grsecurity_table[];
70778
70779 static struct ctl_table root_table[];
70780 static struct ctl_table_root sysctl_table_root;
70781@@ -225,6 +233,20 @@ extern struct ctl_table epoll_table[];
70782 int sysctl_legacy_va_layout;
70783 #endif
70784
70785+#ifdef CONFIG_PAX_SOFTMODE
70786+static ctl_table pax_table[] = {
70787+ {
70788+ .procname = "softmode",
70789+ .data = &pax_softmode,
70790+ .maxlen = sizeof(unsigned int),
70791+ .mode = 0600,
70792+ .proc_handler = &proc_dointvec,
70793+ },
70794+
70795+ { }
70796+};
70797+#endif
70798+
70799 /* The default sysctl tables: */
70800
70801 static struct ctl_table root_table[] = {
70802@@ -271,6 +293,22 @@ static int max_extfrag_threshold = 1000;
70803 #endif
70804
70805 static struct ctl_table kern_table[] = {
70806+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
70807+ {
70808+ .procname = "grsecurity",
70809+ .mode = 0500,
70810+ .child = grsecurity_table,
70811+ },
70812+#endif
70813+
70814+#ifdef CONFIG_PAX_SOFTMODE
70815+ {
70816+ .procname = "pax",
70817+ .mode = 0500,
70818+ .child = pax_table,
70819+ },
70820+#endif
70821+
70822 {
70823 .procname = "sched_child_runs_first",
70824 .data = &sysctl_sched_child_runs_first,
70825@@ -545,7 +583,7 @@ static struct ctl_table kern_table[] = {
70826 .data = &modprobe_path,
70827 .maxlen = KMOD_PATH_LEN,
70828 .mode = 0644,
70829- .proc_handler = proc_dostring,
70830+ .proc_handler = proc_dostring_modpriv,
70831 },
70832 {
70833 .procname = "modules_disabled",
70834@@ -707,16 +745,20 @@ static struct ctl_table kern_table[] = {
70835 .extra1 = &zero,
70836 .extra2 = &one,
70837 },
70838+#endif
70839 {
70840 .procname = "kptr_restrict",
70841 .data = &kptr_restrict,
70842 .maxlen = sizeof(int),
70843 .mode = 0644,
70844 .proc_handler = proc_dmesg_restrict,
70845+#ifdef CONFIG_GRKERNSEC_HIDESYM
70846+ .extra1 = &two,
70847+#else
70848 .extra1 = &zero,
70849+#endif
70850 .extra2 = &two,
70851 },
70852-#endif
70853 {
70854 .procname = "ngroups_max",
70855 .data = &ngroups_max,
70856@@ -1189,6 +1231,13 @@ static struct ctl_table vm_table[] = {
70857 .proc_handler = proc_dointvec_minmax,
70858 .extra1 = &zero,
70859 },
70860+ {
70861+ .procname = "heap_stack_gap",
70862+ .data = &sysctl_heap_stack_gap,
70863+ .maxlen = sizeof(sysctl_heap_stack_gap),
70864+ .mode = 0644,
70865+ .proc_handler = proc_doulongvec_minmax,
70866+ },
70867 #else
70868 {
70869 .procname = "nr_trim_pages",
70870@@ -1698,6 +1747,17 @@ static int test_perm(int mode, int op)
70871 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
70872 {
70873 int mode;
70874+ int error;
70875+
70876+ if (table->parent != NULL && table->parent->procname != NULL &&
70877+ table->procname != NULL &&
70878+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
70879+ return -EACCES;
70880+ if (gr_handle_chroot_sysctl(op))
70881+ return -EACCES;
70882+ error = gr_handle_sysctl(table, op);
70883+ if (error)
70884+ return error;
70885
70886 if (root->permissions)
70887 mode = root->permissions(root, current->nsproxy, table);
70888@@ -2102,6 +2162,16 @@ int proc_dostring(struct ctl_table *tabl
70889 buffer, lenp, ppos);
70890 }
70891
70892+int proc_dostring_modpriv(struct ctl_table *table, int write,
70893+ void __user *buffer, size_t *lenp, loff_t *ppos)
70894+{
70895+ if (write && !capable(CAP_SYS_MODULE))
70896+ return -EPERM;
70897+
70898+ return _proc_do_string(table->data, table->maxlen, write,
70899+ buffer, lenp, ppos);
70900+}
70901+
70902 static size_t proc_skip_spaces(char **buf)
70903 {
70904 size_t ret;
70905@@ -2207,6 +2277,8 @@ static int proc_put_long(void __user **b
70906 len = strlen(tmp);
70907 if (len > *size)
70908 len = *size;
70909+ if (len > sizeof(tmp))
70910+ len = sizeof(tmp);
70911 if (copy_to_user(*buf, tmp, len))
70912 return -EFAULT;
70913 *size -= len;
70914@@ -2523,8 +2595,11 @@ static int __do_proc_doulongvec_minmax(v
70915 *i = val;
70916 } else {
70917 val = convdiv * (*i) / convmul;
70918- if (!first)
70919+ if (!first) {
70920 err = proc_put_char(&buffer, &left, '\t');
70921+ if (err)
70922+ break;
70923+ }
70924 err = proc_put_long(&buffer, &left, val, false);
70925 if (err)
70926 break;
70927@@ -2919,6 +2994,12 @@ int proc_dostring(struct ctl_table *tabl
70928 return -ENOSYS;
70929 }
70930
70931+int proc_dostring_modpriv(struct ctl_table *table, int write,
70932+ void __user *buffer, size_t *lenp, loff_t *ppos)
70933+{
70934+ return -ENOSYS;
70935+}
70936+
70937 int proc_dointvec(struct ctl_table *table, int write,
70938 void __user *buffer, size_t *lenp, loff_t *ppos)
70939 {
70940@@ -2975,6 +3056,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
70941 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
70942 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
70943 EXPORT_SYMBOL(proc_dostring);
70944+EXPORT_SYMBOL(proc_dostring_modpriv);
70945 EXPORT_SYMBOL(proc_doulongvec_minmax);
70946 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
70947 EXPORT_SYMBOL(register_sysctl_table);
70948diff -urNp linux-2.6.39.2/kernel/sysctl_check.c linux-2.6.39.2/kernel/sysctl_check.c
70949--- linux-2.6.39.2/kernel/sysctl_check.c 2011-05-19 00:06:34.000000000 -0400
70950+++ linux-2.6.39.2/kernel/sysctl_check.c 2011-05-22 19:41:42.000000000 -0400
70951@@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n
70952 set_fail(&fail, table, "Directory with extra2");
70953 } else {
70954 if ((table->proc_handler == proc_dostring) ||
70955+ (table->proc_handler == proc_dostring_modpriv) ||
70956 (table->proc_handler == proc_dointvec) ||
70957 (table->proc_handler == proc_dointvec_minmax) ||
70958 (table->proc_handler == proc_dointvec_jiffies) ||
70959diff -urNp linux-2.6.39.2/kernel/taskstats.c linux-2.6.39.2/kernel/taskstats.c
70960--- linux-2.6.39.2/kernel/taskstats.c 2011-05-19 00:06:34.000000000 -0400
70961+++ linux-2.6.39.2/kernel/taskstats.c 2011-05-22 19:41:42.000000000 -0400
70962@@ -27,9 +27,12 @@
70963 #include <linux/cgroup.h>
70964 #include <linux/fs.h>
70965 #include <linux/file.h>
70966+#include <linux/grsecurity.h>
70967 #include <net/genetlink.h>
70968 #include <asm/atomic.h>
70969
70970+extern int gr_is_taskstats_denied(int pid);
70971+
70972 /*
70973 * Maximum length of a cpumask that can be specified in
70974 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
70975@@ -549,6 +552,9 @@ err:
70976
70977 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
70978 {
70979+ if (gr_is_taskstats_denied(current->pid))
70980+ return -EACCES;
70981+
70982 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
70983 return cmd_attr_register_cpumask(info);
70984 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
70985diff -urNp linux-2.6.39.2/kernel/time/posix-clock.c linux-2.6.39.2/kernel/time/posix-clock.c
70986--- linux-2.6.39.2/kernel/time/posix-clock.c 2011-05-19 00:06:34.000000000 -0400
70987+++ linux-2.6.39.2/kernel/time/posix-clock.c 2011-05-22 19:36:33.000000000 -0400
70988@@ -433,7 +433,7 @@ static int pc_timer_settime(struct k_iti
70989 return err;
70990 }
70991
70992-struct k_clock clock_posix_dynamic = {
70993+const struct k_clock clock_posix_dynamic = {
70994 .clock_getres = pc_clock_getres,
70995 .clock_set = pc_clock_settime,
70996 .clock_get = pc_clock_gettime,
70997diff -urNp linux-2.6.39.2/kernel/time/tick-broadcast.c linux-2.6.39.2/kernel/time/tick-broadcast.c
70998--- linux-2.6.39.2/kernel/time/tick-broadcast.c 2011-05-19 00:06:34.000000000 -0400
70999+++ linux-2.6.39.2/kernel/time/tick-broadcast.c 2011-05-22 19:36:33.000000000 -0400
71000@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl
71001 * then clear the broadcast bit.
71002 */
71003 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
71004- int cpu = smp_processor_id();
71005+ cpu = smp_processor_id();
71006
71007 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
71008 tick_broadcast_clear_oneshot(cpu);
71009diff -urNp linux-2.6.39.2/kernel/time/timekeeping.c linux-2.6.39.2/kernel/time/timekeeping.c
71010--- linux-2.6.39.2/kernel/time/timekeeping.c 2011-05-19 00:06:34.000000000 -0400
71011+++ linux-2.6.39.2/kernel/time/timekeeping.c 2011-05-22 20:40:50.000000000 -0400
71012@@ -14,6 +14,7 @@
71013 #include <linux/init.h>
71014 #include <linux/mm.h>
71015 #include <linux/sched.h>
71016+#include <linux/grsecurity.h>
71017 #include <linux/syscore_ops.h>
71018 #include <linux/clocksource.h>
71019 #include <linux/jiffies.h>
71020@@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe
71021 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
71022 return -EINVAL;
71023
71024+ gr_log_timechange();
71025+
71026 write_seqlock_irqsave(&xtime_lock, flags);
71027
71028 timekeeping_forward_now();
71029diff -urNp linux-2.6.39.2/kernel/time/timer_list.c linux-2.6.39.2/kernel/time/timer_list.c
71030--- linux-2.6.39.2/kernel/time/timer_list.c 2011-05-19 00:06:34.000000000 -0400
71031+++ linux-2.6.39.2/kernel/time/timer_list.c 2011-05-22 19:41:42.000000000 -0400
71032@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
71033
71034 static void print_name_offset(struct seq_file *m, void *sym)
71035 {
71036+#ifdef CONFIG_GRKERNSEC_HIDESYM
71037+ SEQ_printf(m, "<%p>", NULL);
71038+#else
71039 char symname[KSYM_NAME_LEN];
71040
71041 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
71042 SEQ_printf(m, "<%pK>", sym);
71043 else
71044 SEQ_printf(m, "%s", symname);
71045+#endif
71046 }
71047
71048 static void
71049@@ -112,7 +116,11 @@ next_one:
71050 static void
71051 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
71052 {
71053+#ifdef CONFIG_GRKERNSEC_HIDESYM
71054+ SEQ_printf(m, " .base: %p\n", NULL);
71055+#else
71056 SEQ_printf(m, " .base: %pK\n", base);
71057+#endif
71058 SEQ_printf(m, " .index: %d\n",
71059 base->index);
71060 SEQ_printf(m, " .resolution: %Lu nsecs\n",
71061@@ -293,7 +301,11 @@ static int __init init_timer_list_procfs
71062 {
71063 struct proc_dir_entry *pe;
71064
71065+#ifdef CONFIG_GRKERNSEC_PROC_ADD
71066+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
71067+#else
71068 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
71069+#endif
71070 if (!pe)
71071 return -ENOMEM;
71072 return 0;
71073diff -urNp linux-2.6.39.2/kernel/time/timer_stats.c linux-2.6.39.2/kernel/time/timer_stats.c
71074--- linux-2.6.39.2/kernel/time/timer_stats.c 2011-05-19 00:06:34.000000000 -0400
71075+++ linux-2.6.39.2/kernel/time/timer_stats.c 2011-05-22 19:41:42.000000000 -0400
71076@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
71077 static unsigned long nr_entries;
71078 static struct entry entries[MAX_ENTRIES];
71079
71080-static atomic_t overflow_count;
71081+static atomic_unchecked_t overflow_count;
71082
71083 /*
71084 * The entries are in a hash-table, for fast lookup:
71085@@ -140,7 +140,7 @@ static void reset_entries(void)
71086 nr_entries = 0;
71087 memset(entries, 0, sizeof(entries));
71088 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
71089- atomic_set(&overflow_count, 0);
71090+ atomic_set_unchecked(&overflow_count, 0);
71091 }
71092
71093 static struct entry *alloc_entry(void)
71094@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
71095 if (likely(entry))
71096 entry->count++;
71097 else
71098- atomic_inc(&overflow_count);
71099+ atomic_inc_unchecked(&overflow_count);
71100
71101 out_unlock:
71102 raw_spin_unlock_irqrestore(lock, flags);
71103@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
71104
71105 static void print_name_offset(struct seq_file *m, unsigned long addr)
71106 {
71107+#ifdef CONFIG_GRKERNSEC_HIDESYM
71108+ seq_printf(m, "<%p>", NULL);
71109+#else
71110 char symname[KSYM_NAME_LEN];
71111
71112 if (lookup_symbol_name(addr, symname) < 0)
71113 seq_printf(m, "<%p>", (void *)addr);
71114 else
71115 seq_printf(m, "%s", symname);
71116+#endif
71117 }
71118
71119 static int tstats_show(struct seq_file *m, void *v)
71120@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
71121
71122 seq_puts(m, "Timer Stats Version: v0.2\n");
71123 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
71124- if (atomic_read(&overflow_count))
71125+ if (atomic_read_unchecked(&overflow_count))
71126 seq_printf(m, "Overflow: %d entries\n",
71127- atomic_read(&overflow_count));
71128+ atomic_read_unchecked(&overflow_count));
71129
71130 for (i = 0; i < nr_entries; i++) {
71131 entry = entries + i;
71132@@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
71133 {
71134 struct proc_dir_entry *pe;
71135
71136+#ifdef CONFIG_GRKERNSEC_PROC_ADD
71137+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
71138+#else
71139 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
71140+#endif
71141 if (!pe)
71142 return -ENOMEM;
71143 return 0;
71144diff -urNp linux-2.6.39.2/kernel/time.c linux-2.6.39.2/kernel/time.c
71145--- linux-2.6.39.2/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
71146+++ linux-2.6.39.2/kernel/time.c 2011-05-22 19:41:42.000000000 -0400
71147@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim
71148 return error;
71149
71150 if (tz) {
71151+ /* we log in do_settimeofday called below, so don't log twice
71152+ */
71153+ if (!tv)
71154+ gr_log_timechange();
71155+
71156 /* SMP safe, global irq locking makes it work. */
71157 sys_tz = *tz;
71158 update_vsyscall_tz();
71159diff -urNp linux-2.6.39.2/kernel/timer.c linux-2.6.39.2/kernel/timer.c
71160--- linux-2.6.39.2/kernel/timer.c 2011-05-19 00:06:34.000000000 -0400
71161+++ linux-2.6.39.2/kernel/timer.c 2011-05-22 19:36:33.000000000 -0400
71162@@ -1305,7 +1305,7 @@ void update_process_times(int user_tick)
71163 /*
71164 * This function runs timers and the timer-tq in bottom half context.
71165 */
71166-static void run_timer_softirq(struct softirq_action *h)
71167+static void run_timer_softirq(void)
71168 {
71169 struct tvec_base *base = __this_cpu_read(tvec_bases);
71170
71171diff -urNp linux-2.6.39.2/kernel/trace/blktrace.c linux-2.6.39.2/kernel/trace/blktrace.c
71172--- linux-2.6.39.2/kernel/trace/blktrace.c 2011-05-19 00:06:34.000000000 -0400
71173+++ linux-2.6.39.2/kernel/trace/blktrace.c 2011-05-22 19:36:33.000000000 -0400
71174@@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
71175 struct blk_trace *bt = filp->private_data;
71176 char buf[16];
71177
71178- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
71179+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
71180
71181 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
71182 }
71183@@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
71184 return 1;
71185
71186 bt = buf->chan->private_data;
71187- atomic_inc(&bt->dropped);
71188+ atomic_inc_unchecked(&bt->dropped);
71189 return 0;
71190 }
71191
71192@@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
71193
71194 bt->dir = dir;
71195 bt->dev = dev;
71196- atomic_set(&bt->dropped, 0);
71197+ atomic_set_unchecked(&bt->dropped, 0);
71198
71199 ret = -EIO;
71200 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
71201diff -urNp linux-2.6.39.2/kernel/trace/ftrace.c linux-2.6.39.2/kernel/trace/ftrace.c
71202--- linux-2.6.39.2/kernel/trace/ftrace.c 2011-06-03 00:04:14.000000000 -0400
71203+++ linux-2.6.39.2/kernel/trace/ftrace.c 2011-06-03 00:32:08.000000000 -0400
71204@@ -1107,13 +1107,18 @@ ftrace_code_disable(struct module *mod,
71205
71206 ip = rec->ip;
71207
71208+ ret = ftrace_arch_code_modify_prepare();
71209+ FTRACE_WARN_ON(ret);
71210+ if (ret)
71211+ return 0;
71212+
71213 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
71214+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
71215 if (ret) {
71216 ftrace_bug(ret, ip);
71217 rec->flags |= FTRACE_FL_FAILED;
71218- return 0;
71219 }
71220- return 1;
71221+ return ret ? 0 : 1;
71222 }
71223
71224 /*
71225@@ -2011,7 +2016,7 @@ static void ftrace_free_entry_rcu(struct
71226
71227 int
71228 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
71229- void *data)
71230+ void *data)
71231 {
71232 struct ftrace_func_probe *entry;
71233 struct ftrace_page *pg;
71234@@ -2083,7 +2088,7 @@ enum {
71235 };
71236
71237 static void
71238-__unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
71239+__unregister_ftrace_function_probe(char *glob, const struct ftrace_probe_ops *ops,
71240 void *data, int flags)
71241 {
71242 struct ftrace_func_probe *entry;
71243@@ -2144,7 +2149,7 @@ unregister_ftrace_function_probe(char *g
71244 }
71245
71246 void
71247-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops)
71248+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops)
71249 {
71250 __unregister_ftrace_function_probe(glob, ops, NULL, PROBE_TEST_FUNC);
71251 }
71252diff -urNp linux-2.6.39.2/kernel/trace/trace.c linux-2.6.39.2/kernel/trace/trace.c
71253--- linux-2.6.39.2/kernel/trace/trace.c 2011-05-19 00:06:34.000000000 -0400
71254+++ linux-2.6.39.2/kernel/trace/trace.c 2011-05-22 19:36:33.000000000 -0400
71255@@ -3330,6 +3330,8 @@ static ssize_t tracing_splice_read_pipe(
71256 size_t rem;
71257 unsigned int i;
71258
71259+ pax_track_stack();
71260+
71261 if (splice_grow_spd(pipe, &spd))
71262 return -ENOMEM;
71263
71264@@ -3813,6 +3815,8 @@ tracing_buffers_splice_read(struct file
71265 int entries, size, i;
71266 size_t ret;
71267
71268+ pax_track_stack();
71269+
71270 if (splice_grow_spd(pipe, &spd))
71271 return -ENOMEM;
71272
71273@@ -3981,10 +3985,9 @@ static const struct file_operations trac
71274 };
71275 #endif
71276
71277-static struct dentry *d_tracer;
71278-
71279 struct dentry *tracing_init_dentry(void)
71280 {
71281+ static struct dentry *d_tracer;
71282 static int once;
71283
71284 if (d_tracer)
71285@@ -4004,10 +4007,9 @@ struct dentry *tracing_init_dentry(void)
71286 return d_tracer;
71287 }
71288
71289-static struct dentry *d_percpu;
71290-
71291 struct dentry *tracing_dentry_percpu(void)
71292 {
71293+ static struct dentry *d_percpu;
71294 static int once;
71295 struct dentry *d_tracer;
71296
71297diff -urNp linux-2.6.39.2/kernel/trace/trace_events.c linux-2.6.39.2/kernel/trace/trace_events.c
71298--- linux-2.6.39.2/kernel/trace/trace_events.c 2011-05-19 00:06:34.000000000 -0400
71299+++ linux-2.6.39.2/kernel/trace/trace_events.c 2011-05-22 19:36:33.000000000 -0400
71300@@ -1241,10 +1241,10 @@ static LIST_HEAD(ftrace_module_file_list
71301 struct ftrace_module_file_ops {
71302 struct list_head list;
71303 struct module *mod;
71304- struct file_operations id;
71305- struct file_operations enable;
71306- struct file_operations format;
71307- struct file_operations filter;
71308+ struct file_operations id; /* cannot be const, see trace_create_file_ops() */
71309+ struct file_operations enable; /* cannot be const, see trace_create_file_ops() */
71310+ struct file_operations format; /* cannot be const, see trace_create_file_ops() */
71311+ struct file_operations filter; /* cannot be const, see trace_create_file_ops() */
71312 };
71313
71314 static struct ftrace_module_file_ops *
71315diff -urNp linux-2.6.39.2/kernel/trace/trace_functions.c linux-2.6.39.2/kernel/trace/trace_functions.c
71316--- linux-2.6.39.2/kernel/trace/trace_functions.c 2011-05-19 00:06:34.000000000 -0400
71317+++ linux-2.6.39.2/kernel/trace/trace_functions.c 2011-05-22 19:36:33.000000000 -0400
71318@@ -308,7 +308,7 @@ ftrace_trace_onoff_print(struct seq_file
71319 static int
71320 ftrace_trace_onoff_unreg(char *glob, char *cmd, char *param)
71321 {
71322- struct ftrace_probe_ops *ops;
71323+ const struct ftrace_probe_ops *ops;
71324
71325 /* we register both traceon and traceoff to this callback */
71326 if (strcmp(cmd, "traceon") == 0)
71327diff -urNp linux-2.6.39.2/kernel/trace/trace_mmiotrace.c linux-2.6.39.2/kernel/trace/trace_mmiotrace.c
71328--- linux-2.6.39.2/kernel/trace/trace_mmiotrace.c 2011-05-19 00:06:34.000000000 -0400
71329+++ linux-2.6.39.2/kernel/trace/trace_mmiotrace.c 2011-05-22 19:36:33.000000000 -0400
71330@@ -24,7 +24,7 @@ struct header_iter {
71331 static struct trace_array *mmio_trace_array;
71332 static bool overrun_detected;
71333 static unsigned long prev_overruns;
71334-static atomic_t dropped_count;
71335+static atomic_unchecked_t dropped_count;
71336
71337 static void mmio_reset_data(struct trace_array *tr)
71338 {
71339@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
71340
71341 static unsigned long count_overruns(struct trace_iterator *iter)
71342 {
71343- unsigned long cnt = atomic_xchg(&dropped_count, 0);
71344+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
71345 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
71346
71347 if (over > prev_overruns)
71348@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct
71349 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
71350 sizeof(*entry), 0, pc);
71351 if (!event) {
71352- atomic_inc(&dropped_count);
71353+ atomic_inc_unchecked(&dropped_count);
71354 return;
71355 }
71356 entry = ring_buffer_event_data(event);
71357@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
71358 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
71359 sizeof(*entry), 0, pc);
71360 if (!event) {
71361- atomic_inc(&dropped_count);
71362+ atomic_inc_unchecked(&dropped_count);
71363 return;
71364 }
71365 entry = ring_buffer_event_data(event);
71366diff -urNp linux-2.6.39.2/kernel/trace/trace_output.c linux-2.6.39.2/kernel/trace/trace_output.c
71367--- linux-2.6.39.2/kernel/trace/trace_output.c 2011-05-19 00:06:34.000000000 -0400
71368+++ linux-2.6.39.2/kernel/trace/trace_output.c 2011-05-22 19:36:33.000000000 -0400
71369@@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s,
71370
71371 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
71372 if (!IS_ERR(p)) {
71373- p = mangle_path(s->buffer + s->len, p, "\n");
71374+ p = mangle_path(s->buffer + s->len, p, "\n\\");
71375 if (p) {
71376 s->len = p - s->buffer;
71377 return 1;
71378diff -urNp linux-2.6.39.2/kernel/trace/trace_stack.c linux-2.6.39.2/kernel/trace/trace_stack.c
71379--- linux-2.6.39.2/kernel/trace/trace_stack.c 2011-05-19 00:06:34.000000000 -0400
71380+++ linux-2.6.39.2/kernel/trace/trace_stack.c 2011-05-22 19:36:33.000000000 -0400
71381@@ -50,7 +50,7 @@ static inline void check_stack(void)
71382 return;
71383
71384 /* we do not handle interrupt stacks yet */
71385- if (!object_is_on_stack(&this_size))
71386+ if (!object_starts_on_stack(&this_size))
71387 return;
71388
71389 local_irq_save(flags);
71390diff -urNp linux-2.6.39.2/kernel/trace/trace_workqueue.c linux-2.6.39.2/kernel/trace/trace_workqueue.c
71391--- linux-2.6.39.2/kernel/trace/trace_workqueue.c 2011-05-19 00:06:34.000000000 -0400
71392+++ linux-2.6.39.2/kernel/trace/trace_workqueue.c 2011-05-22 19:36:33.000000000 -0400
71393@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
71394 int cpu;
71395 pid_t pid;
71396 /* Can be inserted from interrupt or user context, need to be atomic */
71397- atomic_t inserted;
71398+ atomic_unchecked_t inserted;
71399 /*
71400 * Don't need to be atomic, works are serialized in a single workqueue thread
71401 * on a single CPU.
71402@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
71403 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
71404 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
71405 if (node->pid == wq_thread->pid) {
71406- atomic_inc(&node->inserted);
71407+ atomic_inc_unchecked(&node->inserted);
71408 goto found;
71409 }
71410 }
71411@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
71412 tsk = get_pid_task(pid, PIDTYPE_PID);
71413 if (tsk) {
71414 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
71415- atomic_read(&cws->inserted), cws->executed,
71416+ atomic_read_unchecked(&cws->inserted), cws->executed,
71417 tsk->comm);
71418 put_task_struct(tsk);
71419 }
71420diff -urNp linux-2.6.39.2/lib/bug.c linux-2.6.39.2/lib/bug.c
71421--- linux-2.6.39.2/lib/bug.c 2011-05-19 00:06:34.000000000 -0400
71422+++ linux-2.6.39.2/lib/bug.c 2011-05-22 19:36:33.000000000 -0400
71423@@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
71424 return BUG_TRAP_TYPE_NONE;
71425
71426 bug = find_bug(bugaddr);
71427+ if (!bug)
71428+ return BUG_TRAP_TYPE_NONE;
71429
71430 file = NULL;
71431 line = 0;
71432diff -urNp linux-2.6.39.2/lib/debugobjects.c linux-2.6.39.2/lib/debugobjects.c
71433--- linux-2.6.39.2/lib/debugobjects.c 2011-05-19 00:06:34.000000000 -0400
71434+++ linux-2.6.39.2/lib/debugobjects.c 2011-05-22 19:36:33.000000000 -0400
71435@@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi
71436 if (limit > 4)
71437 return;
71438
71439- is_on_stack = object_is_on_stack(addr);
71440+ is_on_stack = object_starts_on_stack(addr);
71441 if (is_on_stack == onstack)
71442 return;
71443
71444diff -urNp linux-2.6.39.2/lib/dma-debug.c linux-2.6.39.2/lib/dma-debug.c
71445--- linux-2.6.39.2/lib/dma-debug.c 2011-05-19 00:06:34.000000000 -0400
71446+++ linux-2.6.39.2/lib/dma-debug.c 2011-05-22 19:36:33.000000000 -0400
71447@@ -862,7 +862,7 @@ out:
71448
71449 static void check_for_stack(struct device *dev, void *addr)
71450 {
71451- if (object_is_on_stack(addr))
71452+ if (object_starts_on_stack(addr))
71453 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
71454 "stack [addr=%p]\n", addr);
71455 }
71456diff -urNp linux-2.6.39.2/lib/inflate.c linux-2.6.39.2/lib/inflate.c
71457--- linux-2.6.39.2/lib/inflate.c 2011-05-19 00:06:34.000000000 -0400
71458+++ linux-2.6.39.2/lib/inflate.c 2011-05-22 19:36:33.000000000 -0400
71459@@ -269,7 +269,7 @@ static void free(void *where)
71460 malloc_ptr = free_mem_ptr;
71461 }
71462 #else
71463-#define malloc(a) kmalloc(a, GFP_KERNEL)
71464+#define malloc(a) kmalloc((a), GFP_KERNEL)
71465 #define free(a) kfree(a)
71466 #endif
71467
71468diff -urNp linux-2.6.39.2/lib/Kconfig.debug linux-2.6.39.2/lib/Kconfig.debug
71469--- linux-2.6.39.2/lib/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
71470+++ linux-2.6.39.2/lib/Kconfig.debug 2011-05-22 19:41:42.000000000 -0400
71471@@ -1078,6 +1078,7 @@ config LATENCYTOP
71472 depends on DEBUG_KERNEL
71473 depends on STACKTRACE_SUPPORT
71474 depends on PROC_FS
71475+ depends on !GRKERNSEC_HIDESYM
71476 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
71477 select KALLSYMS
71478 select KALLSYMS_ALL
71479diff -urNp linux-2.6.39.2/lib/kref.c linux-2.6.39.2/lib/kref.c
71480--- linux-2.6.39.2/lib/kref.c 2011-05-19 00:06:34.000000000 -0400
71481+++ linux-2.6.39.2/lib/kref.c 2011-05-22 19:36:33.000000000 -0400
71482@@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
71483 */
71484 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
71485 {
71486- WARN_ON(release == NULL);
71487+ BUG_ON(release == NULL);
71488 WARN_ON(release == (void (*)(struct kref *))kfree);
71489
71490 if (atomic_dec_and_test(&kref->refcount)) {
71491diff -urNp linux-2.6.39.2/lib/radix-tree.c linux-2.6.39.2/lib/radix-tree.c
71492--- linux-2.6.39.2/lib/radix-tree.c 2011-05-19 00:06:34.000000000 -0400
71493+++ linux-2.6.39.2/lib/radix-tree.c 2011-05-22 19:36:33.000000000 -0400
71494@@ -80,7 +80,7 @@ struct radix_tree_preload {
71495 int nr;
71496 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
71497 };
71498-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
71499+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
71500
71501 static inline void *ptr_to_indirect(void *ptr)
71502 {
71503diff -urNp linux-2.6.39.2/lib/vsprintf.c linux-2.6.39.2/lib/vsprintf.c
71504--- linux-2.6.39.2/lib/vsprintf.c 2011-05-19 00:06:34.000000000 -0400
71505+++ linux-2.6.39.2/lib/vsprintf.c 2011-05-22 20:54:59.000000000 -0400
71506@@ -16,6 +16,9 @@
71507 * - scnprintf and vscnprintf
71508 */
71509
71510+#ifdef CONFIG_GRKERNSEC_HIDESYM
71511+#define __INCLUDED_BY_HIDESYM 1
71512+#endif
71513 #include <stdarg.h>
71514 #include <linux/module.h>
71515 #include <linux/types.h>
71516@@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end
71517 char sym[KSYM_SYMBOL_LEN];
71518 if (ext == 'B')
71519 sprint_backtrace(sym, value);
71520- else if (ext != 'f' && ext != 's')
71521+ else if (ext != 'f' && ext != 's' && ext != 'a')
71522 sprint_symbol(sym, value);
71523 else
71524 kallsyms_lookup(value, NULL, NULL, NULL, sym);
71525@@ -797,7 +800,11 @@ char *uuid_string(char *buf, char *end,
71526 return string(buf, end, uuid, spec);
71527 }
71528
71529+#ifdef CONFIG_GRKERNSEC_HIDESYM
71530+int kptr_restrict __read_mostly = 2;
71531+#else
71532 int kptr_restrict __read_mostly;
71533+#endif
71534
71535 /*
71536 * Show a '%p' thing. A kernel extension is that the '%p' is followed
71537@@ -811,6 +818,8 @@ int kptr_restrict __read_mostly;
71538 * - 'S' For symbolic direct pointers with offset
71539 * - 's' For symbolic direct pointers without offset
71540 * - 'B' For backtraced symbolic direct pointers with offset
71541+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
71542+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
71543 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
71544 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
71545 * - 'M' For a 6-byte MAC address, it prints the address in the
71546@@ -855,12 +864,12 @@ char *pointer(const char *fmt, char *buf
71547 {
71548 if (!ptr && *fmt != 'K') {
71549 /*
71550- * Print (null) with the same width as a pointer so it makes
71551+ * Print (nil) with the same width as a pointer so it makes
71552 * tabular output look nice.
71553 */
71554 if (spec.field_width == -1)
71555 spec.field_width = 2 * sizeof(void *);
71556- return string(buf, end, "(null)", spec);
71557+ return string(buf, end, "(nil)", spec);
71558 }
71559
71560 switch (*fmt) {
71561@@ -870,6 +879,13 @@ char *pointer(const char *fmt, char *buf
71562 /* Fallthrough */
71563 case 'S':
71564 case 's':
71565+#ifdef CONFIG_GRKERNSEC_HIDESYM
71566+ break;
71567+#else
71568+ return symbol_string(buf, end, ptr, spec, *fmt);
71569+#endif
71570+ case 'A':
71571+ case 'a':
71572 case 'B':
71573 return symbol_string(buf, end, ptr, spec, *fmt);
71574 case 'R':
71575@@ -1632,11 +1648,11 @@ int bstr_printf(char *buf, size_t size,
71576 typeof(type) value; \
71577 if (sizeof(type) == 8) { \
71578 args = PTR_ALIGN(args, sizeof(u32)); \
71579- *(u32 *)&value = *(u32 *)args; \
71580- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
71581+ *(u32 *)&value = *(const u32 *)args; \
71582+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
71583 } else { \
71584 args = PTR_ALIGN(args, sizeof(type)); \
71585- value = *(typeof(type) *)args; \
71586+ value = *(const typeof(type) *)args; \
71587 } \
71588 args += sizeof(type); \
71589 value; \
71590@@ -1699,7 +1715,7 @@ int bstr_printf(char *buf, size_t size,
71591 case FORMAT_TYPE_STR: {
71592 const char *str_arg = args;
71593 args += strlen(str_arg) + 1;
71594- str = string(str, end, (char *)str_arg, spec);
71595+ str = string(str, end, str_arg, spec);
71596 break;
71597 }
71598
71599diff -urNp linux-2.6.39.2/localversion-grsec linux-2.6.39.2/localversion-grsec
71600--- linux-2.6.39.2/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
71601+++ linux-2.6.39.2/localversion-grsec 2011-05-22 19:41:42.000000000 -0400
71602@@ -0,0 +1 @@
71603+-grsec
71604diff -urNp linux-2.6.39.2/Makefile linux-2.6.39.2/Makefile
71605--- linux-2.6.39.2/Makefile 2011-06-25 12:55:22.000000000 -0400
71606+++ linux-2.6.39.2/Makefile 2011-06-25 13:00:25.000000000 -0400
71607@@ -237,8 +237,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
71608
71609 HOSTCC = gcc
71610 HOSTCXX = g++
71611-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
71612-HOSTCXXFLAGS = -O2
71613+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
71614+HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
71615+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
71616
71617 # Decide whether to build built-in, modular, or both.
71618 # Normally, just do built-in.
71619@@ -356,10 +357,12 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h
71620 KBUILD_CPPFLAGS := -D__KERNEL__
71621
71622 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
71623+ -W -Wno-unused-parameter -Wno-missing-field-initializers \
71624 -fno-strict-aliasing -fno-common \
71625 -Werror-implicit-function-declaration \
71626 -Wno-format-security \
71627 -fno-delete-null-pointer-checks
71628+KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
71629 KBUILD_AFLAGS_KERNEL :=
71630 KBUILD_CFLAGS_KERNEL :=
71631 KBUILD_AFLAGS := -D__ASSEMBLY__
71632@@ -685,7 +688,7 @@ export mod_strip_cmd
71633
71634
71635 ifeq ($(KBUILD_EXTMOD),)
71636-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
71637+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
71638
71639 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
71640 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
71641@@ -931,7 +934,19 @@ include/config/kernel.release: include/c
71642 # version.h and scripts_basic is processed / created.
71643
71644 # Listed in dependency order
71645-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
71646+PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3 pax-plugin
71647+
71648+ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
71649+KBUILD_CFLAGS += $(call cc-ifversion, -ge, 0405, -fplugin=$(objtree)/tools/gcc/pax_plugin.so -fplugin-arg-pax_plugin-track-lowest-sp=100)
71650+endif
71651+pax-plugin:
71652+ifneq (,$(findstring pax_plugin, $(KBUILD_CFLAGS)))
71653+ $(Q)$(MAKE) $(build)=tools/gcc
71654+else
71655+ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
71656+ $(Q)echo "warning, your gcc does not support plugins, PAX_MEMORY_STACKLEAK will be less secure"
71657+endif
71658+endif
71659
71660 # prepare3 is used to check if we are building in a separate output directory,
71661 # and if so do:
71662@@ -947,7 +962,7 @@ ifneq ($(KBUILD_SRC),)
71663 endif
71664
71665 # prepare2 creates a makefile if using a separate output directory
71666-prepare2: prepare3 outputmakefile
71667+prepare2: prepare3 outputmakefile pax-plugin
71668
71669 prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
71670 include/config/auto.conf
71671diff -urNp linux-2.6.39.2/mm/filemap.c linux-2.6.39.2/mm/filemap.c
71672--- linux-2.6.39.2/mm/filemap.c 2011-05-19 00:06:34.000000000 -0400
71673+++ linux-2.6.39.2/mm/filemap.c 2011-05-22 19:41:42.000000000 -0400
71674@@ -1724,7 +1724,7 @@ int generic_file_mmap(struct file * file
71675 struct address_space *mapping = file->f_mapping;
71676
71677 if (!mapping->a_ops->readpage)
71678- return -ENOEXEC;
71679+ return -ENODEV;
71680 file_accessed(file);
71681 vma->vm_ops = &generic_file_vm_ops;
71682 vma->vm_flags |= VM_CAN_NONLINEAR;
71683@@ -2120,6 +2120,7 @@ inline int generic_write_checks(struct f
71684 *pos = i_size_read(inode);
71685
71686 if (limit != RLIM_INFINITY) {
71687+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
71688 if (*pos >= limit) {
71689 send_sig(SIGXFSZ, current, 0);
71690 return -EFBIG;
71691diff -urNp linux-2.6.39.2/mm/fremap.c linux-2.6.39.2/mm/fremap.c
71692--- linux-2.6.39.2/mm/fremap.c 2011-05-19 00:06:34.000000000 -0400
71693+++ linux-2.6.39.2/mm/fremap.c 2011-05-22 19:36:33.000000000 -0400
71694@@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71695 retry:
71696 vma = find_vma(mm, start);
71697
71698+#ifdef CONFIG_PAX_SEGMEXEC
71699+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
71700+ goto out;
71701+#endif
71702+
71703 /*
71704 * Make sure the vma is shared, that it supports prefaulting,
71705 * and that the remapped range is valid and fully within
71706@@ -224,7 +229,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71707 /*
71708 * drop PG_Mlocked flag for over-mapped range
71709 */
71710- unsigned int saved_flags = vma->vm_flags;
71711+ unsigned long saved_flags = vma->vm_flags;
71712 munlock_vma_pages_range(vma, start, start + size);
71713 vma->vm_flags = saved_flags;
71714 }
71715diff -urNp linux-2.6.39.2/mm/highmem.c linux-2.6.39.2/mm/highmem.c
71716--- linux-2.6.39.2/mm/highmem.c 2011-05-19 00:06:34.000000000 -0400
71717+++ linux-2.6.39.2/mm/highmem.c 2011-05-22 19:36:33.000000000 -0400
71718@@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
71719 * So no dangers, even with speculative execution.
71720 */
71721 page = pte_page(pkmap_page_table[i]);
71722+ pax_open_kernel();
71723 pte_clear(&init_mm, (unsigned long)page_address(page),
71724 &pkmap_page_table[i]);
71725-
71726+ pax_close_kernel();
71727 set_page_address(page, NULL);
71728 need_flush = 1;
71729 }
71730@@ -186,9 +187,11 @@ start:
71731 }
71732 }
71733 vaddr = PKMAP_ADDR(last_pkmap_nr);
71734+
71735+ pax_open_kernel();
71736 set_pte_at(&init_mm, vaddr,
71737 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
71738-
71739+ pax_close_kernel();
71740 pkmap_count[last_pkmap_nr] = 1;
71741 set_page_address(page, (void *)vaddr);
71742
71743diff -urNp linux-2.6.39.2/mm/huge_memory.c linux-2.6.39.2/mm/huge_memory.c
71744--- linux-2.6.39.2/mm/huge_memory.c 2011-05-19 00:06:34.000000000 -0400
71745+++ linux-2.6.39.2/mm/huge_memory.c 2011-05-22 19:36:33.000000000 -0400
71746@@ -702,7 +702,7 @@ out:
71747 * run pte_offset_map on the pmd, if an huge pmd could
71748 * materialize from under us from a different thread.
71749 */
71750- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
71751+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71752 return VM_FAULT_OOM;
71753 /* if an huge pmd materialized from under us just retry later */
71754 if (unlikely(pmd_trans_huge(*pmd)))
71755diff -urNp linux-2.6.39.2/mm/hugetlb.c linux-2.6.39.2/mm/hugetlb.c
71756--- linux-2.6.39.2/mm/hugetlb.c 2011-06-25 12:55:23.000000000 -0400
71757+++ linux-2.6.39.2/mm/hugetlb.c 2011-06-25 13:00:28.000000000 -0400
71758@@ -2331,6 +2331,27 @@ static int unmap_ref_private(struct mm_s
71759 return 1;
71760 }
71761
71762+#ifdef CONFIG_PAX_SEGMEXEC
71763+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
71764+{
71765+ struct mm_struct *mm = vma->vm_mm;
71766+ struct vm_area_struct *vma_m;
71767+ unsigned long address_m;
71768+ pte_t *ptep_m;
71769+
71770+ vma_m = pax_find_mirror_vma(vma);
71771+ if (!vma_m)
71772+ return;
71773+
71774+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71775+ address_m = address + SEGMEXEC_TASK_SIZE;
71776+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
71777+ get_page(page_m);
71778+ hugepage_add_anon_rmap(page_m, vma_m, address_m);
71779+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
71780+}
71781+#endif
71782+
71783 /*
71784 * Hugetlb_cow() should be called with page lock of the original hugepage held.
71785 */
71786@@ -2432,6 +2453,11 @@ retry_avoidcopy:
71787 make_huge_pte(vma, new_page, 1));
71788 page_remove_rmap(old_page);
71789 hugepage_add_new_anon_rmap(new_page, vma, address);
71790+
71791+#ifdef CONFIG_PAX_SEGMEXEC
71792+ pax_mirror_huge_pte(vma, address, new_page);
71793+#endif
71794+
71795 /* Make the old page be freed below */
71796 new_page = old_page;
71797 mmu_notifier_invalidate_range_end(mm,
71798@@ -2583,6 +2609,10 @@ retry:
71799 && (vma->vm_flags & VM_SHARED)));
71800 set_huge_pte_at(mm, address, ptep, new_pte);
71801
71802+#ifdef CONFIG_PAX_SEGMEXEC
71803+ pax_mirror_huge_pte(vma, address, page);
71804+#endif
71805+
71806 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
71807 /* Optimization, do the COW without a second fault */
71808 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
71809@@ -2612,6 +2642,10 @@ int hugetlb_fault(struct mm_struct *mm,
71810 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
71811 struct hstate *h = hstate_vma(vma);
71812
71813+#ifdef CONFIG_PAX_SEGMEXEC
71814+ struct vm_area_struct *vma_m;
71815+#endif
71816+
71817 ptep = huge_pte_offset(mm, address);
71818 if (ptep) {
71819 entry = huge_ptep_get(ptep);
71820@@ -2623,6 +2657,26 @@ int hugetlb_fault(struct mm_struct *mm,
71821 VM_FAULT_SET_HINDEX(h - hstates);
71822 }
71823
71824+#ifdef CONFIG_PAX_SEGMEXEC
71825+ vma_m = pax_find_mirror_vma(vma);
71826+ if (vma_m) {
71827+ unsigned long address_m;
71828+
71829+ if (vma->vm_start > vma_m->vm_start) {
71830+ address_m = address;
71831+ address -= SEGMEXEC_TASK_SIZE;
71832+ vma = vma_m;
71833+ h = hstate_vma(vma);
71834+ } else
71835+ address_m = address + SEGMEXEC_TASK_SIZE;
71836+
71837+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71838+ return VM_FAULT_OOM;
71839+ address_m &= HPAGE_MASK;
71840+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71841+ }
71842+#endif
71843+
71844 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71845 if (!ptep)
71846 return VM_FAULT_OOM;
71847diff -urNp linux-2.6.39.2/mm/Kconfig linux-2.6.39.2/mm/Kconfig
71848--- linux-2.6.39.2/mm/Kconfig 2011-05-19 00:06:34.000000000 -0400
71849+++ linux-2.6.39.2/mm/Kconfig 2011-05-22 19:41:42.000000000 -0400
71850@@ -240,7 +240,7 @@ config KSM
71851 config DEFAULT_MMAP_MIN_ADDR
71852 int "Low address space to protect from user allocation"
71853 depends on MMU
71854- default 4096
71855+ default 65536
71856 help
71857 This is the portion of low virtual memory which should be protected
71858 from userspace allocation. Keeping a user from writing to low pages
71859diff -urNp linux-2.6.39.2/mm/kmemleak.c linux-2.6.39.2/mm/kmemleak.c
71860--- linux-2.6.39.2/mm/kmemleak.c 2011-06-03 00:04:14.000000000 -0400
71861+++ linux-2.6.39.2/mm/kmemleak.c 2011-06-03 00:32:08.000000000 -0400
71862@@ -357,7 +357,7 @@ static void print_unreferenced(struct se
71863
71864 for (i = 0; i < object->trace_len; i++) {
71865 void *ptr = (void *)object->trace[i];
71866- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71867+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71868 }
71869 }
71870
71871diff -urNp linux-2.6.39.2/mm/ksm.c linux-2.6.39.2/mm/ksm.c
71872--- linux-2.6.39.2/mm/ksm.c 2011-05-19 00:06:34.000000000 -0400
71873+++ linux-2.6.39.2/mm/ksm.c 2011-06-20 19:42:16.000000000 -0400
71874@@ -1301,6 +1301,12 @@ static struct rmap_item *scan_get_next_r
71875 slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
71876 ksm_scan.mm_slot = slot;
71877 spin_unlock(&ksm_mmlist_lock);
71878+ /*
71879+ * Although we tested list_empty() above, a racing __ksm_exit
71880+ * of the last mm on the list may have removed it since then.
71881+ */
71882+ if (slot == &ksm_mm_head)
71883+ return NULL;
71884 next_mm:
71885 ksm_scan.address = 0;
71886 ksm_scan.rmap_list = &slot->rmap_list;
71887diff -urNp linux-2.6.39.2/mm/maccess.c linux-2.6.39.2/mm/maccess.c
71888--- linux-2.6.39.2/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
71889+++ linux-2.6.39.2/mm/maccess.c 2011-05-22 19:36:33.000000000 -0400
71890@@ -15,10 +15,10 @@
71891 * happens, handle that and return -EFAULT.
71892 */
71893
71894-long __weak probe_kernel_read(void *dst, void *src, size_t size)
71895+long __weak probe_kernel_read(void *dst, const void *src, size_t size)
71896 __attribute__((alias("__probe_kernel_read")));
71897
71898-long __probe_kernel_read(void *dst, void *src, size_t size)
71899+long __probe_kernel_read(void *dst, const void *src, size_t size)
71900 {
71901 long ret;
71902 mm_segment_t old_fs = get_fs();
71903@@ -43,10 +43,10 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
71904 * Safely write to address @dst from the buffer at @src. If a kernel fault
71905 * happens, handle that and return -EFAULT.
71906 */
71907-long __weak probe_kernel_write(void *dst, void *src, size_t size)
71908+long __weak probe_kernel_write(void *dst, const void *src, size_t size)
71909 __attribute__((alias("__probe_kernel_write")));
71910
71911-long __probe_kernel_write(void *dst, void *src, size_t size)
71912+long __probe_kernel_write(void *dst, const void *src, size_t size)
71913 {
71914 long ret;
71915 mm_segment_t old_fs = get_fs();
71916diff -urNp linux-2.6.39.2/mm/madvise.c linux-2.6.39.2/mm/madvise.c
71917--- linux-2.6.39.2/mm/madvise.c 2011-05-19 00:06:34.000000000 -0400
71918+++ linux-2.6.39.2/mm/madvise.c 2011-05-22 19:36:33.000000000 -0400
71919@@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
71920 pgoff_t pgoff;
71921 unsigned long new_flags = vma->vm_flags;
71922
71923+#ifdef CONFIG_PAX_SEGMEXEC
71924+ struct vm_area_struct *vma_m;
71925+#endif
71926+
71927 switch (behavior) {
71928 case MADV_NORMAL:
71929 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
71930@@ -110,6 +114,13 @@ success:
71931 /*
71932 * vm_flags is protected by the mmap_sem held in write mode.
71933 */
71934+
71935+#ifdef CONFIG_PAX_SEGMEXEC
71936+ vma_m = pax_find_mirror_vma(vma);
71937+ if (vma_m)
71938+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71939+#endif
71940+
71941 vma->vm_flags = new_flags;
71942
71943 out:
71944@@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a
71945 struct vm_area_struct ** prev,
71946 unsigned long start, unsigned long end)
71947 {
71948+
71949+#ifdef CONFIG_PAX_SEGMEXEC
71950+ struct vm_area_struct *vma_m;
71951+#endif
71952+
71953 *prev = vma;
71954 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71955 return -EINVAL;
71956@@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a
71957 zap_page_range(vma, start, end - start, &details);
71958 } else
71959 zap_page_range(vma, start, end - start, NULL);
71960+
71961+#ifdef CONFIG_PAX_SEGMEXEC
71962+ vma_m = pax_find_mirror_vma(vma);
71963+ if (vma_m) {
71964+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71965+ struct zap_details details = {
71966+ .nonlinear_vma = vma_m,
71967+ .last_index = ULONG_MAX,
71968+ };
71969+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71970+ } else
71971+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71972+ }
71973+#endif
71974+
71975 return 0;
71976 }
71977
71978@@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
71979 if (end < start)
71980 goto out;
71981
71982+#ifdef CONFIG_PAX_SEGMEXEC
71983+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71984+ if (end > SEGMEXEC_TASK_SIZE)
71985+ goto out;
71986+ } else
71987+#endif
71988+
71989+ if (end > TASK_SIZE)
71990+ goto out;
71991+
71992 error = 0;
71993 if (end == start)
71994 goto out;
71995diff -urNp linux-2.6.39.2/mm/memory.c linux-2.6.39.2/mm/memory.c
71996--- linux-2.6.39.2/mm/memory.c 2011-05-19 00:06:34.000000000 -0400
71997+++ linux-2.6.39.2/mm/memory.c 2011-05-22 19:36:33.000000000 -0400
71998@@ -259,8 +259,12 @@ static inline void free_pmd_range(struct
71999 return;
72000
72001 pmd = pmd_offset(pud, start);
72002+
72003+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
72004 pud_clear(pud);
72005 pmd_free_tlb(tlb, pmd, start);
72006+#endif
72007+
72008 }
72009
72010 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
72011@@ -291,9 +295,12 @@ static inline void free_pud_range(struct
72012 if (end - 1 > ceiling - 1)
72013 return;
72014
72015+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
72016 pud = pud_offset(pgd, start);
72017 pgd_clear(pgd);
72018 pud_free_tlb(tlb, pud, start);
72019+#endif
72020+
72021 }
72022
72023 /*
72024@@ -1410,12 +1417,6 @@ no_page_table:
72025 return page;
72026 }
72027
72028-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
72029-{
72030- return stack_guard_page_start(vma, addr) ||
72031- stack_guard_page_end(vma, addr+PAGE_SIZE);
72032-}
72033-
72034 /**
72035 * __get_user_pages() - pin user pages in memory
72036 * @tsk: task_struct of target task
72037@@ -1488,10 +1489,10 @@ int __get_user_pages(struct task_struct
72038 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
72039 i = 0;
72040
72041- do {
72042+ while (nr_pages) {
72043 struct vm_area_struct *vma;
72044
72045- vma = find_extend_vma(mm, start);
72046+ vma = find_vma(mm, start);
72047 if (!vma && in_gate_area(mm, start)) {
72048 unsigned long pg = start & PAGE_MASK;
72049 pgd_t *pgd;
72050@@ -1539,7 +1540,7 @@ int __get_user_pages(struct task_struct
72051 goto next_page;
72052 }
72053
72054- if (!vma ||
72055+ if (!vma || start < vma->vm_start ||
72056 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
72057 !(vm_flags & vma->vm_flags))
72058 return i ? : -EFAULT;
72059@@ -1566,11 +1567,6 @@ int __get_user_pages(struct task_struct
72060 int ret;
72061 unsigned int fault_flags = 0;
72062
72063- /* For mlock, just skip the stack guard page. */
72064- if (foll_flags & FOLL_MLOCK) {
72065- if (stack_guard_page(vma, start))
72066- goto next_page;
72067- }
72068 if (foll_flags & FOLL_WRITE)
72069 fault_flags |= FAULT_FLAG_WRITE;
72070 if (nonblocking)
72071@@ -1644,7 +1640,7 @@ next_page:
72072 start += PAGE_SIZE;
72073 nr_pages--;
72074 } while (nr_pages && start < vma->vm_end);
72075- } while (nr_pages);
72076+ }
72077 return i;
72078 }
72079 EXPORT_SYMBOL(__get_user_pages);
72080@@ -1795,6 +1791,10 @@ static int insert_page(struct vm_area_st
72081 page_add_file_rmap(page);
72082 set_pte_at(mm, addr, pte, mk_pte(page, prot));
72083
72084+#ifdef CONFIG_PAX_SEGMEXEC
72085+ pax_mirror_file_pte(vma, addr, page, ptl);
72086+#endif
72087+
72088 retval = 0;
72089 pte_unmap_unlock(pte, ptl);
72090 return retval;
72091@@ -1829,10 +1829,22 @@ out:
72092 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
72093 struct page *page)
72094 {
72095+
72096+#ifdef CONFIG_PAX_SEGMEXEC
72097+ struct vm_area_struct *vma_m;
72098+#endif
72099+
72100 if (addr < vma->vm_start || addr >= vma->vm_end)
72101 return -EFAULT;
72102 if (!page_count(page))
72103 return -EINVAL;
72104+
72105+#ifdef CONFIG_PAX_SEGMEXEC
72106+ vma_m = pax_find_mirror_vma(vma);
72107+ if (vma_m)
72108+ vma_m->vm_flags |= VM_INSERTPAGE;
72109+#endif
72110+
72111 vma->vm_flags |= VM_INSERTPAGE;
72112 return insert_page(vma, addr, page, vma->vm_page_prot);
72113 }
72114@@ -1918,6 +1930,7 @@ int vm_insert_mixed(struct vm_area_struc
72115 unsigned long pfn)
72116 {
72117 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
72118+ BUG_ON(vma->vm_mirror);
72119
72120 if (addr < vma->vm_start || addr >= vma->vm_end)
72121 return -EFAULT;
72122@@ -2233,6 +2246,186 @@ static inline void cow_user_page(struct
72123 copy_user_highpage(dst, src, va, vma);
72124 }
72125
72126+#ifdef CONFIG_PAX_SEGMEXEC
72127+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
72128+{
72129+ struct mm_struct *mm = vma->vm_mm;
72130+ spinlock_t *ptl;
72131+ pte_t *pte, entry;
72132+
72133+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
72134+ entry = *pte;
72135+ if (!pte_present(entry)) {
72136+ if (!pte_none(entry)) {
72137+ BUG_ON(pte_file(entry));
72138+ free_swap_and_cache(pte_to_swp_entry(entry));
72139+ pte_clear_not_present_full(mm, address, pte, 0);
72140+ }
72141+ } else {
72142+ struct page *page;
72143+
72144+ flush_cache_page(vma, address, pte_pfn(entry));
72145+ entry = ptep_clear_flush(vma, address, pte);
72146+ BUG_ON(pte_dirty(entry));
72147+ page = vm_normal_page(vma, address, entry);
72148+ if (page) {
72149+ update_hiwater_rss(mm);
72150+ if (PageAnon(page))
72151+ dec_mm_counter_fast(mm, MM_ANONPAGES);
72152+ else
72153+ dec_mm_counter_fast(mm, MM_FILEPAGES);
72154+ page_remove_rmap(page);
72155+ page_cache_release(page);
72156+ }
72157+ }
72158+ pte_unmap_unlock(pte, ptl);
72159+}
72160+
72161+/* PaX: if vma is mirrored, synchronize the mirror's PTE
72162+ *
72163+ * the ptl of the lower mapped page is held on entry and is not released on exit
72164+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
72165+ */
72166+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
72167+{
72168+ struct mm_struct *mm = vma->vm_mm;
72169+ unsigned long address_m;
72170+ spinlock_t *ptl_m;
72171+ struct vm_area_struct *vma_m;
72172+ pmd_t *pmd_m;
72173+ pte_t *pte_m, entry_m;
72174+
72175+ BUG_ON(!page_m || !PageAnon(page_m));
72176+
72177+ vma_m = pax_find_mirror_vma(vma);
72178+ if (!vma_m)
72179+ return;
72180+
72181+ BUG_ON(!PageLocked(page_m));
72182+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
72183+ address_m = address + SEGMEXEC_TASK_SIZE;
72184+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
72185+ pte_m = pte_offset_map(pmd_m, address_m);
72186+ ptl_m = pte_lockptr(mm, pmd_m);
72187+ if (ptl != ptl_m) {
72188+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
72189+ if (!pte_none(*pte_m))
72190+ goto out;
72191+ }
72192+
72193+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
72194+ page_cache_get(page_m);
72195+ page_add_anon_rmap(page_m, vma_m, address_m);
72196+ inc_mm_counter_fast(mm, MM_ANONPAGES);
72197+ set_pte_at(mm, address_m, pte_m, entry_m);
72198+ update_mmu_cache(vma_m, address_m, entry_m);
72199+out:
72200+ if (ptl != ptl_m)
72201+ spin_unlock(ptl_m);
72202+ pte_unmap(pte_m);
72203+ unlock_page(page_m);
72204+}
72205+
72206+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
72207+{
72208+ struct mm_struct *mm = vma->vm_mm;
72209+ unsigned long address_m;
72210+ spinlock_t *ptl_m;
72211+ struct vm_area_struct *vma_m;
72212+ pmd_t *pmd_m;
72213+ pte_t *pte_m, entry_m;
72214+
72215+ BUG_ON(!page_m || PageAnon(page_m));
72216+
72217+ vma_m = pax_find_mirror_vma(vma);
72218+ if (!vma_m)
72219+ return;
72220+
72221+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
72222+ address_m = address + SEGMEXEC_TASK_SIZE;
72223+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
72224+ pte_m = pte_offset_map(pmd_m, address_m);
72225+ ptl_m = pte_lockptr(mm, pmd_m);
72226+ if (ptl != ptl_m) {
72227+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
72228+ if (!pte_none(*pte_m))
72229+ goto out;
72230+ }
72231+
72232+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
72233+ page_cache_get(page_m);
72234+ page_add_file_rmap(page_m);
72235+ inc_mm_counter_fast(mm, MM_FILEPAGES);
72236+ set_pte_at(mm, address_m, pte_m, entry_m);
72237+ update_mmu_cache(vma_m, address_m, entry_m);
72238+out:
72239+ if (ptl != ptl_m)
72240+ spin_unlock(ptl_m);
72241+ pte_unmap(pte_m);
72242+}
72243+
72244+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
72245+{
72246+ struct mm_struct *mm = vma->vm_mm;
72247+ unsigned long address_m;
72248+ spinlock_t *ptl_m;
72249+ struct vm_area_struct *vma_m;
72250+ pmd_t *pmd_m;
72251+ pte_t *pte_m, entry_m;
72252+
72253+ vma_m = pax_find_mirror_vma(vma);
72254+ if (!vma_m)
72255+ return;
72256+
72257+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
72258+ address_m = address + SEGMEXEC_TASK_SIZE;
72259+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
72260+ pte_m = pte_offset_map(pmd_m, address_m);
72261+ ptl_m = pte_lockptr(mm, pmd_m);
72262+ if (ptl != ptl_m) {
72263+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
72264+ if (!pte_none(*pte_m))
72265+ goto out;
72266+ }
72267+
72268+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
72269+ set_pte_at(mm, address_m, pte_m, entry_m);
72270+out:
72271+ if (ptl != ptl_m)
72272+ spin_unlock(ptl_m);
72273+ pte_unmap(pte_m);
72274+}
72275+
72276+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
72277+{
72278+ struct page *page_m;
72279+ pte_t entry;
72280+
72281+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
72282+ goto out;
72283+
72284+ entry = *pte;
72285+ page_m = vm_normal_page(vma, address, entry);
72286+ if (!page_m)
72287+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
72288+ else if (PageAnon(page_m)) {
72289+ if (pax_find_mirror_vma(vma)) {
72290+ pte_unmap_unlock(pte, ptl);
72291+ lock_page(page_m);
72292+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
72293+ if (pte_same(entry, *pte))
72294+ pax_mirror_anon_pte(vma, address, page_m, ptl);
72295+ else
72296+ unlock_page(page_m);
72297+ }
72298+ } else
72299+ pax_mirror_file_pte(vma, address, page_m, ptl);
72300+
72301+out:
72302+ pte_unmap_unlock(pte, ptl);
72303+}
72304+#endif
72305+
72306 /*
72307 * This routine handles present pages, when users try to write
72308 * to a shared page. It is done by copying the page to a new address
72309@@ -2444,6 +2637,12 @@ gotten:
72310 */
72311 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72312 if (likely(pte_same(*page_table, orig_pte))) {
72313+
72314+#ifdef CONFIG_PAX_SEGMEXEC
72315+ if (pax_find_mirror_vma(vma))
72316+ BUG_ON(!trylock_page(new_page));
72317+#endif
72318+
72319 if (old_page) {
72320 if (!PageAnon(old_page)) {
72321 dec_mm_counter_fast(mm, MM_FILEPAGES);
72322@@ -2495,6 +2694,10 @@ gotten:
72323 page_remove_rmap(old_page);
72324 }
72325
72326+#ifdef CONFIG_PAX_SEGMEXEC
72327+ pax_mirror_anon_pte(vma, address, new_page, ptl);
72328+#endif
72329+
72330 /* Free the old page.. */
72331 new_page = old_page;
72332 ret |= VM_FAULT_WRITE;
72333@@ -2905,6 +3108,11 @@ static int do_swap_page(struct mm_struct
72334 swap_free(entry);
72335 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
72336 try_to_free_swap(page);
72337+
72338+#ifdef CONFIG_PAX_SEGMEXEC
72339+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
72340+#endif
72341+
72342 unlock_page(page);
72343 if (swapcache) {
72344 /*
72345@@ -2928,6 +3136,11 @@ static int do_swap_page(struct mm_struct
72346
72347 /* No need to invalidate - it was non-present before */
72348 update_mmu_cache(vma, address, page_table);
72349+
72350+#ifdef CONFIG_PAX_SEGMEXEC
72351+ pax_mirror_anon_pte(vma, address, page, ptl);
72352+#endif
72353+
72354 unlock:
72355 pte_unmap_unlock(page_table, ptl);
72356 out:
72357@@ -2947,40 +3160,6 @@ out_release:
72358 }
72359
72360 /*
72361- * This is like a special single-page "expand_{down|up}wards()",
72362- * except we must first make sure that 'address{-|+}PAGE_SIZE'
72363- * doesn't hit another vma.
72364- */
72365-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
72366-{
72367- address &= PAGE_MASK;
72368- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
72369- struct vm_area_struct *prev = vma->vm_prev;
72370-
72371- /*
72372- * Is there a mapping abutting this one below?
72373- *
72374- * That's only ok if it's the same stack mapping
72375- * that has gotten split..
72376- */
72377- if (prev && prev->vm_end == address)
72378- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
72379-
72380- expand_stack(vma, address - PAGE_SIZE);
72381- }
72382- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
72383- struct vm_area_struct *next = vma->vm_next;
72384-
72385- /* As VM_GROWSDOWN but s/below/above/ */
72386- if (next && next->vm_start == address + PAGE_SIZE)
72387- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
72388-
72389- expand_upwards(vma, address + PAGE_SIZE);
72390- }
72391- return 0;
72392-}
72393-
72394-/*
72395 * We enter with non-exclusive mmap_sem (to exclude vma changes,
72396 * but allow concurrent faults), and pte mapped but not yet locked.
72397 * We return with mmap_sem still held, but pte unmapped and unlocked.
72398@@ -2989,27 +3168,23 @@ static int do_anonymous_page(struct mm_s
72399 unsigned long address, pte_t *page_table, pmd_t *pmd,
72400 unsigned int flags)
72401 {
72402- struct page *page;
72403+ struct page *page = NULL;
72404 spinlock_t *ptl;
72405 pte_t entry;
72406
72407- pte_unmap(page_table);
72408-
72409- /* Check if we need to add a guard page to the stack */
72410- if (check_stack_guard_page(vma, address) < 0)
72411- return VM_FAULT_SIGBUS;
72412-
72413- /* Use the zero-page for reads */
72414 if (!(flags & FAULT_FLAG_WRITE)) {
72415 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
72416 vma->vm_page_prot));
72417- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72418+ ptl = pte_lockptr(mm, pmd);
72419+ spin_lock(ptl);
72420 if (!pte_none(*page_table))
72421 goto unlock;
72422 goto setpte;
72423 }
72424
72425 /* Allocate our own private page. */
72426+ pte_unmap(page_table);
72427+
72428 if (unlikely(anon_vma_prepare(vma)))
72429 goto oom;
72430 page = alloc_zeroed_user_highpage_movable(vma, address);
72431@@ -3028,6 +3203,11 @@ static int do_anonymous_page(struct mm_s
72432 if (!pte_none(*page_table))
72433 goto release;
72434
72435+#ifdef CONFIG_PAX_SEGMEXEC
72436+ if (pax_find_mirror_vma(vma))
72437+ BUG_ON(!trylock_page(page));
72438+#endif
72439+
72440 inc_mm_counter_fast(mm, MM_ANONPAGES);
72441 page_add_new_anon_rmap(page, vma, address);
72442 setpte:
72443@@ -3035,6 +3215,12 @@ setpte:
72444
72445 /* No need to invalidate - it was non-present before */
72446 update_mmu_cache(vma, address, page_table);
72447+
72448+#ifdef CONFIG_PAX_SEGMEXEC
72449+ if (page)
72450+ pax_mirror_anon_pte(vma, address, page, ptl);
72451+#endif
72452+
72453 unlock:
72454 pte_unmap_unlock(page_table, ptl);
72455 return 0;
72456@@ -3172,6 +3358,12 @@ static int __do_fault(struct mm_struct *
72457 */
72458 /* Only go through if we didn't race with anybody else... */
72459 if (likely(pte_same(*page_table, orig_pte))) {
72460+
72461+#ifdef CONFIG_PAX_SEGMEXEC
72462+ if (anon && pax_find_mirror_vma(vma))
72463+ BUG_ON(!trylock_page(page));
72464+#endif
72465+
72466 flush_icache_page(vma, page);
72467 entry = mk_pte(page, vma->vm_page_prot);
72468 if (flags & FAULT_FLAG_WRITE)
72469@@ -3191,6 +3383,14 @@ static int __do_fault(struct mm_struct *
72470
72471 /* no need to invalidate: a not-present page won't be cached */
72472 update_mmu_cache(vma, address, page_table);
72473+
72474+#ifdef CONFIG_PAX_SEGMEXEC
72475+ if (anon)
72476+ pax_mirror_anon_pte(vma, address, page, ptl);
72477+ else
72478+ pax_mirror_file_pte(vma, address, page, ptl);
72479+#endif
72480+
72481 } else {
72482 if (charged)
72483 mem_cgroup_uncharge_page(page);
72484@@ -3338,6 +3538,12 @@ int handle_pte_fault(struct mm_struct *m
72485 if (flags & FAULT_FLAG_WRITE)
72486 flush_tlb_fix_spurious_fault(vma, address);
72487 }
72488+
72489+#ifdef CONFIG_PAX_SEGMEXEC
72490+ pax_mirror_pte(vma, address, pte, pmd, ptl);
72491+ return 0;
72492+#endif
72493+
72494 unlock:
72495 pte_unmap_unlock(pte, ptl);
72496 return 0;
72497@@ -3354,6 +3560,10 @@ int handle_mm_fault(struct mm_struct *mm
72498 pmd_t *pmd;
72499 pte_t *pte;
72500
72501+#ifdef CONFIG_PAX_SEGMEXEC
72502+ struct vm_area_struct *vma_m;
72503+#endif
72504+
72505 __set_current_state(TASK_RUNNING);
72506
72507 count_vm_event(PGFAULT);
72508@@ -3364,6 +3574,34 @@ int handle_mm_fault(struct mm_struct *mm
72509 if (unlikely(is_vm_hugetlb_page(vma)))
72510 return hugetlb_fault(mm, vma, address, flags);
72511
72512+#ifdef CONFIG_PAX_SEGMEXEC
72513+ vma_m = pax_find_mirror_vma(vma);
72514+ if (vma_m) {
72515+ unsigned long address_m;
72516+ pgd_t *pgd_m;
72517+ pud_t *pud_m;
72518+ pmd_t *pmd_m;
72519+
72520+ if (vma->vm_start > vma_m->vm_start) {
72521+ address_m = address;
72522+ address -= SEGMEXEC_TASK_SIZE;
72523+ vma = vma_m;
72524+ } else
72525+ address_m = address + SEGMEXEC_TASK_SIZE;
72526+
72527+ pgd_m = pgd_offset(mm, address_m);
72528+ pud_m = pud_alloc(mm, pgd_m, address_m);
72529+ if (!pud_m)
72530+ return VM_FAULT_OOM;
72531+ pmd_m = pmd_alloc(mm, pud_m, address_m);
72532+ if (!pmd_m)
72533+ return VM_FAULT_OOM;
72534+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
72535+ return VM_FAULT_OOM;
72536+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
72537+ }
72538+#endif
72539+
72540 pgd = pgd_offset(mm, address);
72541 pud = pud_alloc(mm, pgd, address);
72542 if (!pud)
72543@@ -3393,7 +3631,7 @@ int handle_mm_fault(struct mm_struct *mm
72544 * run pte_offset_map on the pmd, if an huge pmd could
72545 * materialize from under us from a different thread.
72546 */
72547- if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
72548+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
72549 return VM_FAULT_OOM;
72550 /* if an huge pmd materialized from under us just retry later */
72551 if (unlikely(pmd_trans_huge(*pmd)))
72552@@ -3497,7 +3735,7 @@ static int __init gate_vma_init(void)
72553 gate_vma.vm_start = FIXADDR_USER_START;
72554 gate_vma.vm_end = FIXADDR_USER_END;
72555 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
72556- gate_vma.vm_page_prot = __P101;
72557+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
72558 /*
72559 * Make sure the vDSO gets into every core dump.
72560 * Dumping its contents makes post-mortem fully interpretable later
72561diff -urNp linux-2.6.39.2/mm/memory-failure.c linux-2.6.39.2/mm/memory-failure.c
72562--- linux-2.6.39.2/mm/memory-failure.c 2011-05-19 00:06:34.000000000 -0400
72563+++ linux-2.6.39.2/mm/memory-failure.c 2011-05-22 19:36:33.000000000 -0400
72564@@ -58,7 +58,7 @@ int sysctl_memory_failure_early_kill __r
72565
72566 int sysctl_memory_failure_recovery __read_mostly = 1;
72567
72568-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72569+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72570
72571 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
72572
72573@@ -1012,7 +1012,7 @@ int __memory_failure(unsigned long pfn,
72574 }
72575
72576 nr_pages = 1 << compound_trans_order(hpage);
72577- atomic_long_add(nr_pages, &mce_bad_pages);
72578+ atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
72579
72580 /*
72581 * We need/can do nothing about count=0 pages.
72582@@ -1042,7 +1042,7 @@ int __memory_failure(unsigned long pfn,
72583 if (!PageHWPoison(hpage)
72584 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
72585 || (p != hpage && TestSetPageHWPoison(hpage))) {
72586- atomic_long_sub(nr_pages, &mce_bad_pages);
72587+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72588 return 0;
72589 }
72590 set_page_hwpoison_huge_page(hpage);
72591@@ -1100,7 +1100,7 @@ int __memory_failure(unsigned long pfn,
72592 }
72593 if (hwpoison_filter(p)) {
72594 if (TestClearPageHWPoison(p))
72595- atomic_long_sub(nr_pages, &mce_bad_pages);
72596+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72597 unlock_page(hpage);
72598 put_page(hpage);
72599 return 0;
72600@@ -1226,7 +1226,7 @@ int unpoison_memory(unsigned long pfn)
72601 return 0;
72602 }
72603 if (TestClearPageHWPoison(p))
72604- atomic_long_sub(nr_pages, &mce_bad_pages);
72605+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72606 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
72607 return 0;
72608 }
72609@@ -1240,7 +1240,7 @@ int unpoison_memory(unsigned long pfn)
72610 */
72611 if (TestClearPageHWPoison(page)) {
72612 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
72613- atomic_long_sub(nr_pages, &mce_bad_pages);
72614+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72615 freeit = 1;
72616 if (PageHuge(page))
72617 clear_page_hwpoison_huge_page(page);
72618@@ -1353,7 +1353,7 @@ static int soft_offline_huge_page(struct
72619 }
72620 done:
72621 if (!PageHWPoison(hpage))
72622- atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
72623+ atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
72624 set_page_hwpoison_huge_page(hpage);
72625 dequeue_hwpoisoned_huge_page(hpage);
72626 /* keep elevated page count for bad page */
72627@@ -1482,7 +1482,7 @@ int soft_offline_page(struct page *page,
72628 return ret;
72629
72630 done:
72631- atomic_long_add(1, &mce_bad_pages);
72632+ atomic_long_add_unchecked(1, &mce_bad_pages);
72633 SetPageHWPoison(page);
72634 /* keep elevated page count for bad page */
72635 return ret;
72636diff -urNp linux-2.6.39.2/mm/mempolicy.c linux-2.6.39.2/mm/mempolicy.c
72637--- linux-2.6.39.2/mm/mempolicy.c 2011-05-19 00:06:34.000000000 -0400
72638+++ linux-2.6.39.2/mm/mempolicy.c 2011-05-22 19:41:42.000000000 -0400
72639@@ -643,6 +643,10 @@ static int mbind_range(struct mm_struct
72640 unsigned long vmstart;
72641 unsigned long vmend;
72642
72643+#ifdef CONFIG_PAX_SEGMEXEC
72644+ struct vm_area_struct *vma_m;
72645+#endif
72646+
72647 vma = find_vma_prev(mm, start, &prev);
72648 if (!vma || vma->vm_start > start)
72649 return -EFAULT;
72650@@ -673,6 +677,16 @@ static int mbind_range(struct mm_struct
72651 err = policy_vma(vma, new_pol);
72652 if (err)
72653 goto out;
72654+
72655+#ifdef CONFIG_PAX_SEGMEXEC
72656+ vma_m = pax_find_mirror_vma(vma);
72657+ if (vma_m) {
72658+ err = policy_vma(vma_m, new_pol);
72659+ if (err)
72660+ goto out;
72661+ }
72662+#endif
72663+
72664 }
72665
72666 out:
72667@@ -1106,6 +1120,17 @@ static long do_mbind(unsigned long start
72668
72669 if (end < start)
72670 return -EINVAL;
72671+
72672+#ifdef CONFIG_PAX_SEGMEXEC
72673+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72674+ if (end > SEGMEXEC_TASK_SIZE)
72675+ return -EINVAL;
72676+ } else
72677+#endif
72678+
72679+ if (end > TASK_SIZE)
72680+ return -EINVAL;
72681+
72682 if (end == start)
72683 return 0;
72684
72685@@ -1324,6 +1349,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72686 if (!mm)
72687 goto out;
72688
72689+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72690+ if (mm != current->mm &&
72691+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72692+ err = -EPERM;
72693+ goto out;
72694+ }
72695+#endif
72696+
72697 /*
72698 * Check if this process has the right to modify the specified
72699 * process. The right exists if the process has administrative
72700@@ -1333,8 +1366,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72701 rcu_read_lock();
72702 tcred = __task_cred(task);
72703 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72704- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72705- !capable(CAP_SYS_NICE)) {
72706+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72707 rcu_read_unlock();
72708 err = -EPERM;
72709 goto out;
72710@@ -2634,7 +2666,7 @@ int show_numa_map(struct seq_file *m, vo
72711
72712 if (file) {
72713 seq_printf(m, " file=");
72714- seq_path(m, &file->f_path, "\n\t= ");
72715+ seq_path(m, &file->f_path, "\n\t\\= ");
72716 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
72717 seq_printf(m, " heap");
72718 } else if (vma->vm_start <= mm->start_stack &&
72719diff -urNp linux-2.6.39.2/mm/migrate.c linux-2.6.39.2/mm/migrate.c
72720--- linux-2.6.39.2/mm/migrate.c 2011-05-19 00:06:34.000000000 -0400
72721+++ linux-2.6.39.2/mm/migrate.c 2011-05-22 19:41:42.000000000 -0400
72722@@ -1133,6 +1133,8 @@ static int do_pages_move(struct mm_struc
72723 unsigned long chunk_start;
72724 int err;
72725
72726+ pax_track_stack();
72727+
72728 task_nodes = cpuset_mems_allowed(task);
72729
72730 err = -ENOMEM;
72731@@ -1317,6 +1319,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72732 if (!mm)
72733 return -EINVAL;
72734
72735+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72736+ if (mm != current->mm &&
72737+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72738+ err = -EPERM;
72739+ goto out;
72740+ }
72741+#endif
72742+
72743 /*
72744 * Check if this process has the right to modify the specified
72745 * process. The right exists if the process has administrative
72746@@ -1326,8 +1336,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72747 rcu_read_lock();
72748 tcred = __task_cred(task);
72749 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72750- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72751- !capable(CAP_SYS_NICE)) {
72752+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72753 rcu_read_unlock();
72754 err = -EPERM;
72755 goto out;
72756diff -urNp linux-2.6.39.2/mm/mlock.c linux-2.6.39.2/mm/mlock.c
72757--- linux-2.6.39.2/mm/mlock.c 2011-05-19 00:06:34.000000000 -0400
72758+++ linux-2.6.39.2/mm/mlock.c 2011-05-22 19:41:42.000000000 -0400
72759@@ -13,6 +13,7 @@
72760 #include <linux/pagemap.h>
72761 #include <linux/mempolicy.h>
72762 #include <linux/syscalls.h>
72763+#include <linux/security.h>
72764 #include <linux/sched.h>
72765 #include <linux/module.h>
72766 #include <linux/rmap.h>
72767@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
72768 return -EINVAL;
72769 if (end == start)
72770 return 0;
72771+ if (end > TASK_SIZE)
72772+ return -EINVAL;
72773+
72774 vma = find_vma_prev(current->mm, start, &prev);
72775 if (!vma || vma->vm_start > start)
72776 return -ENOMEM;
72777@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
72778 for (nstart = start ; ; ) {
72779 unsigned int newflags;
72780
72781+#ifdef CONFIG_PAX_SEGMEXEC
72782+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72783+ break;
72784+#endif
72785+
72786 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
72787
72788 newflags = vma->vm_flags | VM_LOCKED;
72789@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
72790 lock_limit >>= PAGE_SHIFT;
72791
72792 /* check against resource limits */
72793+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
72794 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
72795 error = do_mlock(start, len, 1);
72796 up_write(&current->mm->mmap_sem);
72797@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
72798 static int do_mlockall(int flags)
72799 {
72800 struct vm_area_struct * vma, * prev = NULL;
72801- unsigned int def_flags = 0;
72802
72803 if (flags & MCL_FUTURE)
72804- def_flags = VM_LOCKED;
72805- current->mm->def_flags = def_flags;
72806+ current->mm->def_flags |= VM_LOCKED;
72807+ else
72808+ current->mm->def_flags &= ~VM_LOCKED;
72809 if (flags == MCL_FUTURE)
72810 goto out;
72811
72812 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
72813- unsigned int newflags;
72814+ unsigned long newflags;
72815+
72816+#ifdef CONFIG_PAX_SEGMEXEC
72817+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72818+ break;
72819+#endif
72820
72821+ BUG_ON(vma->vm_end > TASK_SIZE);
72822 newflags = vma->vm_flags | VM_LOCKED;
72823 if (!(flags & MCL_CURRENT))
72824 newflags &= ~VM_LOCKED;
72825@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
72826 lock_limit >>= PAGE_SHIFT;
72827
72828 ret = -ENOMEM;
72829+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
72830 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
72831 capable(CAP_IPC_LOCK))
72832 ret = do_mlockall(flags);
72833diff -urNp linux-2.6.39.2/mm/mmap.c linux-2.6.39.2/mm/mmap.c
72834--- linux-2.6.39.2/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
72835+++ linux-2.6.39.2/mm/mmap.c 2011-05-22 19:41:42.000000000 -0400
72836@@ -46,6 +46,16 @@
72837 #define arch_rebalance_pgtables(addr, len) (addr)
72838 #endif
72839
72840+static inline void verify_mm_writelocked(struct mm_struct *mm)
72841+{
72842+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72843+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72844+ up_read(&mm->mmap_sem);
72845+ BUG();
72846+ }
72847+#endif
72848+}
72849+
72850 static void unmap_region(struct mm_struct *mm,
72851 struct vm_area_struct *vma, struct vm_area_struct *prev,
72852 unsigned long start, unsigned long end);
72853@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc
72854 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72855 *
72856 */
72857-pgprot_t protection_map[16] = {
72858+pgprot_t protection_map[16] __read_only = {
72859 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72860 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72861 };
72862
72863 pgprot_t vm_get_page_prot(unsigned long vm_flags)
72864 {
72865- return __pgprot(pgprot_val(protection_map[vm_flags &
72866+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72867 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72868 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72869+
72870+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72871+ if (!(__supported_pte_mask & _PAGE_NX) &&
72872+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72873+ (vm_flags & (VM_READ | VM_WRITE)))
72874+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72875+#endif
72876+
72877+ return prot;
72878 }
72879 EXPORT_SYMBOL(vm_get_page_prot);
72880
72881 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72882 int sysctl_overcommit_ratio = 50; /* default is 50% */
72883 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72884+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72885 struct percpu_counter vm_committed_as;
72886
72887 /*
72888@@ -232,6 +252,7 @@ static struct vm_area_struct *remove_vma
72889 struct vm_area_struct *next = vma->vm_next;
72890
72891 might_sleep();
72892+ BUG_ON(vma->vm_mirror);
72893 if (vma->vm_ops && vma->vm_ops->close)
72894 vma->vm_ops->close(vma);
72895 if (vma->vm_file) {
72896@@ -276,6 +297,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
72897 * not page aligned -Ram Gupta
72898 */
72899 rlim = rlimit(RLIMIT_DATA);
72900+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72901 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72902 (mm->end_data - mm->start_data) > rlim)
72903 goto out;
72904@@ -719,6 +741,12 @@ static int
72905 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72906 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72907 {
72908+
72909+#ifdef CONFIG_PAX_SEGMEXEC
72910+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72911+ return 0;
72912+#endif
72913+
72914 if (is_mergeable_vma(vma, file, vm_flags) &&
72915 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72916 if (vma->vm_pgoff == vm_pgoff)
72917@@ -738,6 +766,12 @@ static int
72918 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72919 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72920 {
72921+
72922+#ifdef CONFIG_PAX_SEGMEXEC
72923+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72924+ return 0;
72925+#endif
72926+
72927 if (is_mergeable_vma(vma, file, vm_flags) &&
72928 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72929 pgoff_t vm_pglen;
72930@@ -780,13 +814,20 @@ can_vma_merge_after(struct vm_area_struc
72931 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72932 struct vm_area_struct *prev, unsigned long addr,
72933 unsigned long end, unsigned long vm_flags,
72934- struct anon_vma *anon_vma, struct file *file,
72935+ struct anon_vma *anon_vma, struct file *file,
72936 pgoff_t pgoff, struct mempolicy *policy)
72937 {
72938 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72939 struct vm_area_struct *area, *next;
72940 int err;
72941
72942+#ifdef CONFIG_PAX_SEGMEXEC
72943+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72944+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72945+
72946+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72947+#endif
72948+
72949 /*
72950 * We later require that vma->vm_flags == vm_flags,
72951 * so this tests vma->vm_flags & VM_SPECIAL, too.
72952@@ -802,6 +843,15 @@ struct vm_area_struct *vma_merge(struct
72953 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72954 next = next->vm_next;
72955
72956+#ifdef CONFIG_PAX_SEGMEXEC
72957+ if (prev)
72958+ prev_m = pax_find_mirror_vma(prev);
72959+ if (area)
72960+ area_m = pax_find_mirror_vma(area);
72961+ if (next)
72962+ next_m = pax_find_mirror_vma(next);
72963+#endif
72964+
72965 /*
72966 * Can it merge with the predecessor?
72967 */
72968@@ -821,9 +871,24 @@ struct vm_area_struct *vma_merge(struct
72969 /* cases 1, 6 */
72970 err = vma_adjust(prev, prev->vm_start,
72971 next->vm_end, prev->vm_pgoff, NULL);
72972- } else /* cases 2, 5, 7 */
72973+
72974+#ifdef CONFIG_PAX_SEGMEXEC
72975+ if (!err && prev_m)
72976+ err = vma_adjust(prev_m, prev_m->vm_start,
72977+ next_m->vm_end, prev_m->vm_pgoff, NULL);
72978+#endif
72979+
72980+ } else { /* cases 2, 5, 7 */
72981 err = vma_adjust(prev, prev->vm_start,
72982 end, prev->vm_pgoff, NULL);
72983+
72984+#ifdef CONFIG_PAX_SEGMEXEC
72985+ if (!err && prev_m)
72986+ err = vma_adjust(prev_m, prev_m->vm_start,
72987+ end_m, prev_m->vm_pgoff, NULL);
72988+#endif
72989+
72990+ }
72991 if (err)
72992 return NULL;
72993 khugepaged_enter_vma_merge(prev);
72994@@ -837,12 +902,27 @@ struct vm_area_struct *vma_merge(struct
72995 mpol_equal(policy, vma_policy(next)) &&
72996 can_vma_merge_before(next, vm_flags,
72997 anon_vma, file, pgoff+pglen)) {
72998- if (prev && addr < prev->vm_end) /* case 4 */
72999+ if (prev && addr < prev->vm_end) { /* case 4 */
73000 err = vma_adjust(prev, prev->vm_start,
73001 addr, prev->vm_pgoff, NULL);
73002- else /* cases 3, 8 */
73003+
73004+#ifdef CONFIG_PAX_SEGMEXEC
73005+ if (!err && prev_m)
73006+ err = vma_adjust(prev_m, prev_m->vm_start,
73007+ addr_m, prev_m->vm_pgoff, NULL);
73008+#endif
73009+
73010+ } else { /* cases 3, 8 */
73011 err = vma_adjust(area, addr, next->vm_end,
73012 next->vm_pgoff - pglen, NULL);
73013+
73014+#ifdef CONFIG_PAX_SEGMEXEC
73015+ if (!err && area_m)
73016+ err = vma_adjust(area_m, addr_m, next_m->vm_end,
73017+ next_m->vm_pgoff - pglen, NULL);
73018+#endif
73019+
73020+ }
73021 if (err)
73022 return NULL;
73023 khugepaged_enter_vma_merge(area);
73024@@ -958,14 +1038,11 @@ none:
73025 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
73026 struct file *file, long pages)
73027 {
73028- const unsigned long stack_flags
73029- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
73030-
73031 if (file) {
73032 mm->shared_vm += pages;
73033 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
73034 mm->exec_vm += pages;
73035- } else if (flags & stack_flags)
73036+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
73037 mm->stack_vm += pages;
73038 if (flags & (VM_RESERVED|VM_IO))
73039 mm->reserved_vm += pages;
73040@@ -992,7 +1069,7 @@ unsigned long do_mmap_pgoff(struct file
73041 * (the exception is when the underlying filesystem is noexec
73042 * mounted, in which case we dont add PROT_EXEC.)
73043 */
73044- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
73045+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
73046 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
73047 prot |= PROT_EXEC;
73048
73049@@ -1018,7 +1095,7 @@ unsigned long do_mmap_pgoff(struct file
73050 /* Obtain the address to map to. we verify (or select) it and ensure
73051 * that it represents a valid section of the address space.
73052 */
73053- addr = get_unmapped_area(file, addr, len, pgoff, flags);
73054+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
73055 if (addr & ~PAGE_MASK)
73056 return addr;
73057
73058@@ -1029,6 +1106,36 @@ unsigned long do_mmap_pgoff(struct file
73059 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
73060 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
73061
73062+#ifdef CONFIG_PAX_MPROTECT
73063+ if (mm->pax_flags & MF_PAX_MPROTECT) {
73064+#ifndef CONFIG_PAX_MPROTECT_COMPAT
73065+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
73066+ gr_log_rwxmmap(file);
73067+
73068+#ifdef CONFIG_PAX_EMUPLT
73069+ vm_flags &= ~VM_EXEC;
73070+#else
73071+ return -EPERM;
73072+#endif
73073+
73074+ }
73075+
73076+ if (!(vm_flags & VM_EXEC))
73077+ vm_flags &= ~VM_MAYEXEC;
73078+#else
73079+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73080+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73081+#endif
73082+ else
73083+ vm_flags &= ~VM_MAYWRITE;
73084+ }
73085+#endif
73086+
73087+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
73088+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
73089+ vm_flags &= ~VM_PAGEEXEC;
73090+#endif
73091+
73092 if (flags & MAP_LOCKED)
73093 if (!can_do_mlock())
73094 return -EPERM;
73095@@ -1040,6 +1147,7 @@ unsigned long do_mmap_pgoff(struct file
73096 locked += mm->locked_vm;
73097 lock_limit = rlimit(RLIMIT_MEMLOCK);
73098 lock_limit >>= PAGE_SHIFT;
73099+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
73100 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
73101 return -EAGAIN;
73102 }
73103@@ -1110,6 +1218,9 @@ unsigned long do_mmap_pgoff(struct file
73104 if (error)
73105 return error;
73106
73107+ if (!gr_acl_handle_mmap(file, prot))
73108+ return -EACCES;
73109+
73110 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
73111 }
73112 EXPORT_SYMBOL(do_mmap_pgoff);
73113@@ -1187,10 +1298,10 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_ar
73114 */
73115 int vma_wants_writenotify(struct vm_area_struct *vma)
73116 {
73117- unsigned int vm_flags = vma->vm_flags;
73118+ unsigned long vm_flags = vma->vm_flags;
73119
73120 /* If it was private or non-writable, the write bit is already clear */
73121- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
73122+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
73123 return 0;
73124
73125 /* The backer wishes to know when pages are first written to? */
73126@@ -1239,14 +1350,24 @@ unsigned long mmap_region(struct file *f
73127 unsigned long charged = 0;
73128 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
73129
73130+#ifdef CONFIG_PAX_SEGMEXEC
73131+ struct vm_area_struct *vma_m = NULL;
73132+#endif
73133+
73134+ /*
73135+ * mm->mmap_sem is required to protect against another thread
73136+ * changing the mappings in case we sleep.
73137+ */
73138+ verify_mm_writelocked(mm);
73139+
73140 /* Clear old maps */
73141 error = -ENOMEM;
73142-munmap_back:
73143 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73144 if (vma && vma->vm_start < addr + len) {
73145 if (do_munmap(mm, addr, len))
73146 return -ENOMEM;
73147- goto munmap_back;
73148+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73149+ BUG_ON(vma && vma->vm_start < addr + len);
73150 }
73151
73152 /* Check against address space limit. */
73153@@ -1295,6 +1416,16 @@ munmap_back:
73154 goto unacct_error;
73155 }
73156
73157+#ifdef CONFIG_PAX_SEGMEXEC
73158+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
73159+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73160+ if (!vma_m) {
73161+ error = -ENOMEM;
73162+ goto free_vma;
73163+ }
73164+ }
73165+#endif
73166+
73167 vma->vm_mm = mm;
73168 vma->vm_start = addr;
73169 vma->vm_end = addr + len;
73170@@ -1318,6 +1449,19 @@ munmap_back:
73171 error = file->f_op->mmap(file, vma);
73172 if (error)
73173 goto unmap_and_free_vma;
73174+
73175+#ifdef CONFIG_PAX_SEGMEXEC
73176+ if (vma_m && (vm_flags & VM_EXECUTABLE))
73177+ added_exe_file_vma(mm);
73178+#endif
73179+
73180+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
73181+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
73182+ vma->vm_flags |= VM_PAGEEXEC;
73183+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73184+ }
73185+#endif
73186+
73187 if (vm_flags & VM_EXECUTABLE)
73188 added_exe_file_vma(mm);
73189
73190@@ -1353,6 +1497,11 @@ munmap_back:
73191 vma_link(mm, vma, prev, rb_link, rb_parent);
73192 file = vma->vm_file;
73193
73194+#ifdef CONFIG_PAX_SEGMEXEC
73195+ if (vma_m)
73196+ BUG_ON(pax_mirror_vma(vma_m, vma));
73197+#endif
73198+
73199 /* Once vma denies write, undo our temporary denial count */
73200 if (correct_wcount)
73201 atomic_inc(&inode->i_writecount);
73202@@ -1361,6 +1510,7 @@ out:
73203
73204 mm->total_vm += len >> PAGE_SHIFT;
73205 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
73206+ track_exec_limit(mm, addr, addr + len, vm_flags);
73207 if (vm_flags & VM_LOCKED) {
73208 if (!mlock_vma_pages_range(vma, addr, addr + len))
73209 mm->locked_vm += (len >> PAGE_SHIFT);
73210@@ -1378,6 +1528,12 @@ unmap_and_free_vma:
73211 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
73212 charged = 0;
73213 free_vma:
73214+
73215+#ifdef CONFIG_PAX_SEGMEXEC
73216+ if (vma_m)
73217+ kmem_cache_free(vm_area_cachep, vma_m);
73218+#endif
73219+
73220 kmem_cache_free(vm_area_cachep, vma);
73221 unacct_error:
73222 if (charged)
73223@@ -1385,6 +1541,44 @@ unacct_error:
73224 return error;
73225 }
73226
73227+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
73228+{
73229+ if (!vma) {
73230+#ifdef CONFIG_STACK_GROWSUP
73231+ if (addr > sysctl_heap_stack_gap)
73232+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
73233+ else
73234+ vma = find_vma(current->mm, 0);
73235+ if (vma && (vma->vm_flags & VM_GROWSUP))
73236+ return false;
73237+#endif
73238+ return true;
73239+ }
73240+
73241+ if (addr + len > vma->vm_start)
73242+ return false;
73243+
73244+ if (vma->vm_flags & VM_GROWSDOWN)
73245+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
73246+#ifdef CONFIG_STACK_GROWSUP
73247+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
73248+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
73249+#endif
73250+
73251+ return true;
73252+}
73253+
73254+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
73255+{
73256+ if (vma->vm_start < len)
73257+ return -ENOMEM;
73258+ if (!(vma->vm_flags & VM_GROWSDOWN))
73259+ return vma->vm_start - len;
73260+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
73261+ return vma->vm_start - len - sysctl_heap_stack_gap;
73262+ return -ENOMEM;
73263+}
73264+
73265 /* Get an address range which is currently unmapped.
73266 * For shmat() with addr=0.
73267 *
73268@@ -1411,18 +1605,23 @@ arch_get_unmapped_area(struct file *filp
73269 if (flags & MAP_FIXED)
73270 return addr;
73271
73272+#ifdef CONFIG_PAX_RANDMMAP
73273+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
73274+#endif
73275+
73276 if (addr) {
73277 addr = PAGE_ALIGN(addr);
73278- vma = find_vma(mm, addr);
73279- if (TASK_SIZE - len >= addr &&
73280- (!vma || addr + len <= vma->vm_start))
73281- return addr;
73282+ if (TASK_SIZE - len >= addr) {
73283+ vma = find_vma(mm, addr);
73284+ if (check_heap_stack_gap(vma, addr, len))
73285+ return addr;
73286+ }
73287 }
73288 if (len > mm->cached_hole_size) {
73289- start_addr = addr = mm->free_area_cache;
73290+ start_addr = addr = mm->free_area_cache;
73291 } else {
73292- start_addr = addr = TASK_UNMAPPED_BASE;
73293- mm->cached_hole_size = 0;
73294+ start_addr = addr = mm->mmap_base;
73295+ mm->cached_hole_size = 0;
73296 }
73297
73298 full_search:
73299@@ -1433,34 +1632,40 @@ full_search:
73300 * Start a new search - just in case we missed
73301 * some holes.
73302 */
73303- if (start_addr != TASK_UNMAPPED_BASE) {
73304- addr = TASK_UNMAPPED_BASE;
73305- start_addr = addr;
73306+ if (start_addr != mm->mmap_base) {
73307+ start_addr = addr = mm->mmap_base;
73308 mm->cached_hole_size = 0;
73309 goto full_search;
73310 }
73311 return -ENOMEM;
73312 }
73313- if (!vma || addr + len <= vma->vm_start) {
73314- /*
73315- * Remember the place where we stopped the search:
73316- */
73317- mm->free_area_cache = addr + len;
73318- return addr;
73319- }
73320+ if (check_heap_stack_gap(vma, addr, len))
73321+ break;
73322 if (addr + mm->cached_hole_size < vma->vm_start)
73323 mm->cached_hole_size = vma->vm_start - addr;
73324 addr = vma->vm_end;
73325 }
73326+
73327+ /*
73328+ * Remember the place where we stopped the search:
73329+ */
73330+ mm->free_area_cache = addr + len;
73331+ return addr;
73332 }
73333 #endif
73334
73335 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
73336 {
73337+
73338+#ifdef CONFIG_PAX_SEGMEXEC
73339+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73340+ return;
73341+#endif
73342+
73343 /*
73344 * Is this a new hole at the lowest possible address?
73345 */
73346- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
73347+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
73348 mm->free_area_cache = addr;
73349 mm->cached_hole_size = ~0UL;
73350 }
73351@@ -1478,7 +1683,7 @@ arch_get_unmapped_area_topdown(struct fi
73352 {
73353 struct vm_area_struct *vma;
73354 struct mm_struct *mm = current->mm;
73355- unsigned long addr = addr0;
73356+ unsigned long base = mm->mmap_base, addr = addr0;
73357
73358 /* requested length too big for entire address space */
73359 if (len > TASK_SIZE)
73360@@ -1487,13 +1692,18 @@ arch_get_unmapped_area_topdown(struct fi
73361 if (flags & MAP_FIXED)
73362 return addr;
73363
73364+#ifdef CONFIG_PAX_RANDMMAP
73365+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
73366+#endif
73367+
73368 /* requesting a specific address */
73369 if (addr) {
73370 addr = PAGE_ALIGN(addr);
73371- vma = find_vma(mm, addr);
73372- if (TASK_SIZE - len >= addr &&
73373- (!vma || addr + len <= vma->vm_start))
73374- return addr;
73375+ if (TASK_SIZE - len >= addr) {
73376+ vma = find_vma(mm, addr);
73377+ if (check_heap_stack_gap(vma, addr, len))
73378+ return addr;
73379+ }
73380 }
73381
73382 /* check if free_area_cache is useful for us */
73383@@ -1508,7 +1718,7 @@ arch_get_unmapped_area_topdown(struct fi
73384 /* make sure it can fit in the remaining address space */
73385 if (addr > len) {
73386 vma = find_vma(mm, addr-len);
73387- if (!vma || addr <= vma->vm_start)
73388+ if (check_heap_stack_gap(vma, addr - len, len))
73389 /* remember the address as a hint for next time */
73390 return (mm->free_area_cache = addr-len);
73391 }
73392@@ -1525,7 +1735,7 @@ arch_get_unmapped_area_topdown(struct fi
73393 * return with success:
73394 */
73395 vma = find_vma(mm, addr);
73396- if (!vma || addr+len <= vma->vm_start)
73397+ if (check_heap_stack_gap(vma, addr, len))
73398 /* remember the address as a hint for next time */
73399 return (mm->free_area_cache = addr);
73400
73401@@ -1534,8 +1744,8 @@ arch_get_unmapped_area_topdown(struct fi
73402 mm->cached_hole_size = vma->vm_start - addr;
73403
73404 /* try just below the current vma->vm_start */
73405- addr = vma->vm_start-len;
73406- } while (len < vma->vm_start);
73407+ addr = skip_heap_stack_gap(vma, len);
73408+ } while (!IS_ERR_VALUE(addr));
73409
73410 bottomup:
73411 /*
73412@@ -1544,13 +1754,21 @@ bottomup:
73413 * can happen with large stack limits and large mmap()
73414 * allocations.
73415 */
73416+ mm->mmap_base = TASK_UNMAPPED_BASE;
73417+
73418+#ifdef CONFIG_PAX_RANDMMAP
73419+ if (mm->pax_flags & MF_PAX_RANDMMAP)
73420+ mm->mmap_base += mm->delta_mmap;
73421+#endif
73422+
73423+ mm->free_area_cache = mm->mmap_base;
73424 mm->cached_hole_size = ~0UL;
73425- mm->free_area_cache = TASK_UNMAPPED_BASE;
73426 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
73427 /*
73428 * Restore the topdown base:
73429 */
73430- mm->free_area_cache = mm->mmap_base;
73431+ mm->mmap_base = base;
73432+ mm->free_area_cache = base;
73433 mm->cached_hole_size = ~0UL;
73434
73435 return addr;
73436@@ -1559,6 +1777,12 @@ bottomup:
73437
73438 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
73439 {
73440+
73441+#ifdef CONFIG_PAX_SEGMEXEC
73442+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73443+ return;
73444+#endif
73445+
73446 /*
73447 * Is this a new hole at the highest possible address?
73448 */
73449@@ -1566,8 +1790,10 @@ void arch_unmap_area_topdown(struct mm_s
73450 mm->free_area_cache = addr;
73451
73452 /* dont allow allocations above current base */
73453- if (mm->free_area_cache > mm->mmap_base)
73454+ if (mm->free_area_cache > mm->mmap_base) {
73455 mm->free_area_cache = mm->mmap_base;
73456+ mm->cached_hole_size = ~0UL;
73457+ }
73458 }
73459
73460 unsigned long
73461@@ -1675,6 +1901,28 @@ out:
73462 return prev ? prev->vm_next : vma;
73463 }
73464
73465+#ifdef CONFIG_PAX_SEGMEXEC
73466+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
73467+{
73468+ struct vm_area_struct *vma_m;
73469+
73470+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
73471+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
73472+ BUG_ON(vma->vm_mirror);
73473+ return NULL;
73474+ }
73475+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
73476+ vma_m = vma->vm_mirror;
73477+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
73478+ BUG_ON(vma->vm_file != vma_m->vm_file);
73479+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
73480+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
73481+ BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
73482+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
73483+ return vma_m;
73484+}
73485+#endif
73486+
73487 /*
73488 * Verify that the stack growth is acceptable and
73489 * update accounting. This is shared with both the
73490@@ -1691,6 +1939,7 @@ static int acct_stack_growth(struct vm_a
73491 return -ENOMEM;
73492
73493 /* Stack limit test */
73494+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
73495 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
73496 return -ENOMEM;
73497
73498@@ -1701,6 +1950,7 @@ static int acct_stack_growth(struct vm_a
73499 locked = mm->locked_vm + grow;
73500 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
73501 limit >>= PAGE_SHIFT;
73502+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
73503 if (locked > limit && !capable(CAP_IPC_LOCK))
73504 return -ENOMEM;
73505 }
73506@@ -1731,37 +1981,48 @@ static int acct_stack_growth(struct vm_a
73507 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
73508 * vma is the last one with address > vma->vm_end. Have to extend vma.
73509 */
73510+#ifndef CONFIG_IA64
73511+static
73512+#endif
73513 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
73514 {
73515 int error;
73516+ bool locknext;
73517
73518 if (!(vma->vm_flags & VM_GROWSUP))
73519 return -EFAULT;
73520
73521+ /* Also guard against wrapping around to address 0. */
73522+ if (address < PAGE_ALIGN(address+1))
73523+ address = PAGE_ALIGN(address+1);
73524+ else
73525+ return -ENOMEM;
73526+
73527 /*
73528 * We must make sure the anon_vma is allocated
73529 * so that the anon_vma locking is not a noop.
73530 */
73531 if (unlikely(anon_vma_prepare(vma)))
73532 return -ENOMEM;
73533+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
73534+ if (locknext && anon_vma_prepare(vma->vm_next))
73535+ return -ENOMEM;
73536 vma_lock_anon_vma(vma);
73537+ if (locknext)
73538+ vma_lock_anon_vma(vma->vm_next);
73539
73540 /*
73541 * vma->vm_start/vm_end cannot change under us because the caller
73542 * is required to hold the mmap_sem in read mode. We need the
73543- * anon_vma lock to serialize against concurrent expand_stacks.
73544- * Also guard against wrapping around to address 0.
73545+ * anon_vma locks to serialize against concurrent expand_stacks
73546+ * and expand_upwards.
73547 */
73548- if (address < PAGE_ALIGN(address+4))
73549- address = PAGE_ALIGN(address+4);
73550- else {
73551- vma_unlock_anon_vma(vma);
73552- return -ENOMEM;
73553- }
73554 error = 0;
73555
73556 /* Somebody else might have raced and expanded it already */
73557- if (address > vma->vm_end) {
73558+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
73559+ error = -ENOMEM;
73560+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
73561 unsigned long size, grow;
73562
73563 size = address - vma->vm_start;
73564@@ -1776,6 +2037,8 @@ int expand_upwards(struct vm_area_struct
73565 }
73566 }
73567 }
73568+ if (locknext)
73569+ vma_unlock_anon_vma(vma->vm_next);
73570 vma_unlock_anon_vma(vma);
73571 khugepaged_enter_vma_merge(vma);
73572 return error;
73573@@ -1789,6 +2052,8 @@ static int expand_downwards(struct vm_ar
73574 unsigned long address)
73575 {
73576 int error;
73577+ bool lockprev = false;
73578+ struct vm_area_struct *prev;
73579
73580 /*
73581 * We must make sure the anon_vma is allocated
73582@@ -1802,6 +2067,15 @@ static int expand_downwards(struct vm_ar
73583 if (error)
73584 return error;
73585
73586+ prev = vma->vm_prev;
73587+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
73588+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
73589+#endif
73590+ if (lockprev && anon_vma_prepare(prev))
73591+ return -ENOMEM;
73592+ if (lockprev)
73593+ vma_lock_anon_vma(prev);
73594+
73595 vma_lock_anon_vma(vma);
73596
73597 /*
73598@@ -1811,9 +2085,17 @@ static int expand_downwards(struct vm_ar
73599 */
73600
73601 /* Somebody else might have raced and expanded it already */
73602- if (address < vma->vm_start) {
73603+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
73604+ error = -ENOMEM;
73605+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
73606 unsigned long size, grow;
73607
73608+#ifdef CONFIG_PAX_SEGMEXEC
73609+ struct vm_area_struct *vma_m;
73610+
73611+ vma_m = pax_find_mirror_vma(vma);
73612+#endif
73613+
73614 size = vma->vm_end - address;
73615 grow = (vma->vm_start - address) >> PAGE_SHIFT;
73616
73617@@ -1823,11 +2105,22 @@ static int expand_downwards(struct vm_ar
73618 if (!error) {
73619 vma->vm_start = address;
73620 vma->vm_pgoff -= grow;
73621+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
73622+
73623+#ifdef CONFIG_PAX_SEGMEXEC
73624+ if (vma_m) {
73625+ vma_m->vm_start -= grow << PAGE_SHIFT;
73626+ vma_m->vm_pgoff -= grow;
73627+ }
73628+#endif
73629+
73630 perf_event_mmap(vma);
73631 }
73632 }
73633 }
73634 vma_unlock_anon_vma(vma);
73635+ if (lockprev)
73636+ vma_unlock_anon_vma(prev);
73637 khugepaged_enter_vma_merge(vma);
73638 return error;
73639 }
73640@@ -1902,6 +2195,13 @@ static void remove_vma_list(struct mm_st
73641 do {
73642 long nrpages = vma_pages(vma);
73643
73644+#ifdef CONFIG_PAX_SEGMEXEC
73645+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
73646+ vma = remove_vma(vma);
73647+ continue;
73648+ }
73649+#endif
73650+
73651 mm->total_vm -= nrpages;
73652 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
73653 vma = remove_vma(vma);
73654@@ -1947,6 +2247,16 @@ detach_vmas_to_be_unmapped(struct mm_str
73655 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
73656 vma->vm_prev = NULL;
73657 do {
73658+
73659+#ifdef CONFIG_PAX_SEGMEXEC
73660+ if (vma->vm_mirror) {
73661+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
73662+ vma->vm_mirror->vm_mirror = NULL;
73663+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
73664+ vma->vm_mirror = NULL;
73665+ }
73666+#endif
73667+
73668 rb_erase(&vma->vm_rb, &mm->mm_rb);
73669 mm->map_count--;
73670 tail_vma = vma;
73671@@ -1975,14 +2285,33 @@ static int __split_vma(struct mm_struct
73672 struct vm_area_struct *new;
73673 int err = -ENOMEM;
73674
73675+#ifdef CONFIG_PAX_SEGMEXEC
73676+ struct vm_area_struct *vma_m, *new_m = NULL;
73677+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
73678+#endif
73679+
73680 if (is_vm_hugetlb_page(vma) && (addr &
73681 ~(huge_page_mask(hstate_vma(vma)))))
73682 return -EINVAL;
73683
73684+#ifdef CONFIG_PAX_SEGMEXEC
73685+ vma_m = pax_find_mirror_vma(vma);
73686+#endif
73687+
73688 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73689 if (!new)
73690 goto out_err;
73691
73692+#ifdef CONFIG_PAX_SEGMEXEC
73693+ if (vma_m) {
73694+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73695+ if (!new_m) {
73696+ kmem_cache_free(vm_area_cachep, new);
73697+ goto out_err;
73698+ }
73699+ }
73700+#endif
73701+
73702 /* most fields are the same, copy all, and then fixup */
73703 *new = *vma;
73704
73705@@ -1995,6 +2324,22 @@ static int __split_vma(struct mm_struct
73706 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
73707 }
73708
73709+#ifdef CONFIG_PAX_SEGMEXEC
73710+ if (vma_m) {
73711+ *new_m = *vma_m;
73712+ INIT_LIST_HEAD(&new_m->anon_vma_chain);
73713+ new_m->vm_mirror = new;
73714+ new->vm_mirror = new_m;
73715+
73716+ if (new_below)
73717+ new_m->vm_end = addr_m;
73718+ else {
73719+ new_m->vm_start = addr_m;
73720+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
73721+ }
73722+ }
73723+#endif
73724+
73725 pol = mpol_dup(vma_policy(vma));
73726 if (IS_ERR(pol)) {
73727 err = PTR_ERR(pol);
73728@@ -2020,6 +2365,42 @@ static int __split_vma(struct mm_struct
73729 else
73730 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
73731
73732+#ifdef CONFIG_PAX_SEGMEXEC
73733+ if (!err && vma_m) {
73734+ if (anon_vma_clone(new_m, vma_m))
73735+ goto out_free_mpol;
73736+
73737+ mpol_get(pol);
73738+ vma_set_policy(new_m, pol);
73739+
73740+ if (new_m->vm_file) {
73741+ get_file(new_m->vm_file);
73742+ if (vma_m->vm_flags & VM_EXECUTABLE)
73743+ added_exe_file_vma(mm);
73744+ }
73745+
73746+ if (new_m->vm_ops && new_m->vm_ops->open)
73747+ new_m->vm_ops->open(new_m);
73748+
73749+ if (new_below)
73750+ err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
73751+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
73752+ else
73753+ err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
73754+
73755+ if (err) {
73756+ if (new_m->vm_ops && new_m->vm_ops->close)
73757+ new_m->vm_ops->close(new_m);
73758+ if (new_m->vm_file) {
73759+ if (vma_m->vm_flags & VM_EXECUTABLE)
73760+ removed_exe_file_vma(mm);
73761+ fput(new_m->vm_file);
73762+ }
73763+ mpol_put(pol);
73764+ }
73765+ }
73766+#endif
73767+
73768 /* Success. */
73769 if (!err)
73770 return 0;
73771@@ -2032,10 +2413,18 @@ static int __split_vma(struct mm_struct
73772 removed_exe_file_vma(mm);
73773 fput(new->vm_file);
73774 }
73775- unlink_anon_vmas(new);
73776 out_free_mpol:
73777 mpol_put(pol);
73778 out_free_vma:
73779+
73780+#ifdef CONFIG_PAX_SEGMEXEC
73781+ if (new_m) {
73782+ unlink_anon_vmas(new_m);
73783+ kmem_cache_free(vm_area_cachep, new_m);
73784+ }
73785+#endif
73786+
73787+ unlink_anon_vmas(new);
73788 kmem_cache_free(vm_area_cachep, new);
73789 out_err:
73790 return err;
73791@@ -2048,6 +2437,15 @@ static int __split_vma(struct mm_struct
73792 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73793 unsigned long addr, int new_below)
73794 {
73795+
73796+#ifdef CONFIG_PAX_SEGMEXEC
73797+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73798+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
73799+ if (mm->map_count >= sysctl_max_map_count-1)
73800+ return -ENOMEM;
73801+ } else
73802+#endif
73803+
73804 if (mm->map_count >= sysctl_max_map_count)
73805 return -ENOMEM;
73806
73807@@ -2059,11 +2457,30 @@ int split_vma(struct mm_struct *mm, stru
73808 * work. This now handles partial unmappings.
73809 * Jeremy Fitzhardinge <jeremy@goop.org>
73810 */
73811+#ifdef CONFIG_PAX_SEGMEXEC
73812+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73813+{
73814+ int ret = __do_munmap(mm, start, len);
73815+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
73816+ return ret;
73817+
73818+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
73819+}
73820+
73821+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73822+#else
73823 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73824+#endif
73825 {
73826 unsigned long end;
73827 struct vm_area_struct *vma, *prev, *last;
73828
73829+ /*
73830+ * mm->mmap_sem is required to protect against another thread
73831+ * changing the mappings in case we sleep.
73832+ */
73833+ verify_mm_writelocked(mm);
73834+
73835 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
73836 return -EINVAL;
73837
73838@@ -2137,6 +2554,8 @@ int do_munmap(struct mm_struct *mm, unsi
73839 /* Fix up all other VM information */
73840 remove_vma_list(mm, vma);
73841
73842+ track_exec_limit(mm, start, end, 0UL);
73843+
73844 return 0;
73845 }
73846
73847@@ -2149,22 +2568,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
73848
73849 profile_munmap(addr);
73850
73851+#ifdef CONFIG_PAX_SEGMEXEC
73852+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73853+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
73854+ return -EINVAL;
73855+#endif
73856+
73857 down_write(&mm->mmap_sem);
73858 ret = do_munmap(mm, addr, len);
73859 up_write(&mm->mmap_sem);
73860 return ret;
73861 }
73862
73863-static inline void verify_mm_writelocked(struct mm_struct *mm)
73864-{
73865-#ifdef CONFIG_DEBUG_VM
73866- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73867- WARN_ON(1);
73868- up_read(&mm->mmap_sem);
73869- }
73870-#endif
73871-}
73872-
73873 /*
73874 * this is really a simplified "do_mmap". it only handles
73875 * anonymous maps. eventually we may be able to do some
73876@@ -2178,6 +2593,7 @@ unsigned long do_brk(unsigned long addr,
73877 struct rb_node ** rb_link, * rb_parent;
73878 pgoff_t pgoff = addr >> PAGE_SHIFT;
73879 int error;
73880+ unsigned long charged;
73881
73882 len = PAGE_ALIGN(len);
73883 if (!len)
73884@@ -2189,16 +2605,30 @@ unsigned long do_brk(unsigned long addr,
73885
73886 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73887
73888+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73889+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73890+ flags &= ~VM_EXEC;
73891+
73892+#ifdef CONFIG_PAX_MPROTECT
73893+ if (mm->pax_flags & MF_PAX_MPROTECT)
73894+ flags &= ~VM_MAYEXEC;
73895+#endif
73896+
73897+ }
73898+#endif
73899+
73900 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73901 if (error & ~PAGE_MASK)
73902 return error;
73903
73904+ charged = len >> PAGE_SHIFT;
73905+
73906 /*
73907 * mlock MCL_FUTURE?
73908 */
73909 if (mm->def_flags & VM_LOCKED) {
73910 unsigned long locked, lock_limit;
73911- locked = len >> PAGE_SHIFT;
73912+ locked = charged;
73913 locked += mm->locked_vm;
73914 lock_limit = rlimit(RLIMIT_MEMLOCK);
73915 lock_limit >>= PAGE_SHIFT;
73916@@ -2215,22 +2645,22 @@ unsigned long do_brk(unsigned long addr,
73917 /*
73918 * Clear old maps. this also does some error checking for us
73919 */
73920- munmap_back:
73921 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73922 if (vma && vma->vm_start < addr + len) {
73923 if (do_munmap(mm, addr, len))
73924 return -ENOMEM;
73925- goto munmap_back;
73926+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73927+ BUG_ON(vma && vma->vm_start < addr + len);
73928 }
73929
73930 /* Check against address space limits *after* clearing old maps... */
73931- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73932+ if (!may_expand_vm(mm, charged))
73933 return -ENOMEM;
73934
73935 if (mm->map_count > sysctl_max_map_count)
73936 return -ENOMEM;
73937
73938- if (security_vm_enough_memory(len >> PAGE_SHIFT))
73939+ if (security_vm_enough_memory(charged))
73940 return -ENOMEM;
73941
73942 /* Can we just expand an old private anonymous mapping? */
73943@@ -2244,7 +2674,7 @@ unsigned long do_brk(unsigned long addr,
73944 */
73945 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73946 if (!vma) {
73947- vm_unacct_memory(len >> PAGE_SHIFT);
73948+ vm_unacct_memory(charged);
73949 return -ENOMEM;
73950 }
73951
73952@@ -2258,11 +2688,12 @@ unsigned long do_brk(unsigned long addr,
73953 vma_link(mm, vma, prev, rb_link, rb_parent);
73954 out:
73955 perf_event_mmap(vma);
73956- mm->total_vm += len >> PAGE_SHIFT;
73957+ mm->total_vm += charged;
73958 if (flags & VM_LOCKED) {
73959 if (!mlock_vma_pages_range(vma, addr, addr + len))
73960- mm->locked_vm += (len >> PAGE_SHIFT);
73961+ mm->locked_vm += charged;
73962 }
73963+ track_exec_limit(mm, addr, addr + len, flags);
73964 return addr;
73965 }
73966
73967@@ -2309,8 +2740,10 @@ void exit_mmap(struct mm_struct *mm)
73968 * Walk the list again, actually closing and freeing it,
73969 * with preemption enabled, without holding any MM locks.
73970 */
73971- while (vma)
73972+ while (vma) {
73973+ vma->vm_mirror = NULL;
73974 vma = remove_vma(vma);
73975+ }
73976
73977 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
73978 }
73979@@ -2324,6 +2757,13 @@ int insert_vm_struct(struct mm_struct *
73980 struct vm_area_struct * __vma, * prev;
73981 struct rb_node ** rb_link, * rb_parent;
73982
73983+#ifdef CONFIG_PAX_SEGMEXEC
73984+ struct vm_area_struct *vma_m = NULL;
73985+#endif
73986+
73987+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
73988+ return -EPERM;
73989+
73990 /*
73991 * The vm_pgoff of a purely anonymous vma should be irrelevant
73992 * until its first write fault, when page's anon_vma and index
73993@@ -2346,7 +2786,22 @@ int insert_vm_struct(struct mm_struct *
73994 if ((vma->vm_flags & VM_ACCOUNT) &&
73995 security_vm_enough_memory_mm(mm, vma_pages(vma)))
73996 return -ENOMEM;
73997+
73998+#ifdef CONFIG_PAX_SEGMEXEC
73999+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
74000+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
74001+ if (!vma_m)
74002+ return -ENOMEM;
74003+ }
74004+#endif
74005+
74006 vma_link(mm, vma, prev, rb_link, rb_parent);
74007+
74008+#ifdef CONFIG_PAX_SEGMEXEC
74009+ if (vma_m)
74010+ BUG_ON(pax_mirror_vma(vma_m, vma));
74011+#endif
74012+
74013 return 0;
74014 }
74015
74016@@ -2364,6 +2819,8 @@ struct vm_area_struct *copy_vma(struct v
74017 struct rb_node **rb_link, *rb_parent;
74018 struct mempolicy *pol;
74019
74020+ BUG_ON(vma->vm_mirror);
74021+
74022 /*
74023 * If anonymous vma has not yet been faulted, update new pgoff
74024 * to match new location, to increase its chance of merging.
74025@@ -2413,6 +2870,39 @@ struct vm_area_struct *copy_vma(struct v
74026 kmem_cache_free(vm_area_cachep, new_vma);
74027 return NULL;
74028 }
74029+
74030+#ifdef CONFIG_PAX_SEGMEXEC
74031+long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
74032+{
74033+ struct vm_area_struct *prev_m;
74034+ struct rb_node **rb_link_m, *rb_parent_m;
74035+ struct mempolicy *pol_m;
74036+
74037+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
74038+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
74039+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
74040+ *vma_m = *vma;
74041+ INIT_LIST_HEAD(&vma_m->anon_vma_chain);
74042+ if (anon_vma_clone(vma_m, vma))
74043+ return -ENOMEM;
74044+ pol_m = vma_policy(vma_m);
74045+ mpol_get(pol_m);
74046+ vma_set_policy(vma_m, pol_m);
74047+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
74048+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
74049+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
74050+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
74051+ if (vma_m->vm_file)
74052+ get_file(vma_m->vm_file);
74053+ if (vma_m->vm_ops && vma_m->vm_ops->open)
74054+ vma_m->vm_ops->open(vma_m);
74055+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
74056+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
74057+ vma_m->vm_mirror = vma;
74058+ vma->vm_mirror = vma_m;
74059+ return 0;
74060+}
74061+#endif
74062
74063 /*
74064 * Return true if the calling process may expand its vm space by the passed
74065@@ -2424,7 +2914,7 @@ int may_expand_vm(struct mm_struct *mm,
74066 unsigned long lim;
74067
74068 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
74069-
74070+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
74071 if (cur + npages > lim)
74072 return 0;
74073 return 1;
74074@@ -2495,6 +2985,22 @@ int install_special_mapping(struct mm_st
74075 vma->vm_start = addr;
74076 vma->vm_end = addr + len;
74077
74078+#ifdef CONFIG_PAX_MPROTECT
74079+ if (mm->pax_flags & MF_PAX_MPROTECT) {
74080+#ifndef CONFIG_PAX_MPROTECT_COMPAT
74081+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
74082+ return -EPERM;
74083+ if (!(vm_flags & VM_EXEC))
74084+ vm_flags &= ~VM_MAYEXEC;
74085+#else
74086+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
74087+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
74088+#endif
74089+ else
74090+ vm_flags &= ~VM_MAYWRITE;
74091+ }
74092+#endif
74093+
74094 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
74095 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
74096
74097diff -urNp linux-2.6.39.2/mm/mprotect.c linux-2.6.39.2/mm/mprotect.c
74098--- linux-2.6.39.2/mm/mprotect.c 2011-05-19 00:06:34.000000000 -0400
74099+++ linux-2.6.39.2/mm/mprotect.c 2011-05-22 19:41:42.000000000 -0400
74100@@ -23,10 +23,16 @@
74101 #include <linux/mmu_notifier.h>
74102 #include <linux/migrate.h>
74103 #include <linux/perf_event.h>
74104+
74105+#ifdef CONFIG_PAX_MPROTECT
74106+#include <linux/elf.h>
74107+#endif
74108+
74109 #include <asm/uaccess.h>
74110 #include <asm/pgtable.h>
74111 #include <asm/cacheflush.h>
74112 #include <asm/tlbflush.h>
74113+#include <asm/mmu_context.h>
74114
74115 #ifndef pgprot_modify
74116 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
74117@@ -141,6 +147,48 @@ static void change_protection(struct vm_
74118 flush_tlb_range(vma, start, end);
74119 }
74120
74121+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
74122+/* called while holding the mmap semaphor for writing except stack expansion */
74123+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
74124+{
74125+ unsigned long oldlimit, newlimit = 0UL;
74126+
74127+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
74128+ return;
74129+
74130+ spin_lock(&mm->page_table_lock);
74131+ oldlimit = mm->context.user_cs_limit;
74132+ if ((prot & VM_EXEC) && oldlimit < end)
74133+ /* USER_CS limit moved up */
74134+ newlimit = end;
74135+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
74136+ /* USER_CS limit moved down */
74137+ newlimit = start;
74138+
74139+ if (newlimit) {
74140+ mm->context.user_cs_limit = newlimit;
74141+
74142+#ifdef CONFIG_SMP
74143+ wmb();
74144+ cpus_clear(mm->context.cpu_user_cs_mask);
74145+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
74146+#endif
74147+
74148+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
74149+ }
74150+ spin_unlock(&mm->page_table_lock);
74151+ if (newlimit == end) {
74152+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
74153+
74154+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
74155+ if (is_vm_hugetlb_page(vma))
74156+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
74157+ else
74158+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
74159+ }
74160+}
74161+#endif
74162+
74163 int
74164 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
74165 unsigned long start, unsigned long end, unsigned long newflags)
74166@@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm
74167 int error;
74168 int dirty_accountable = 0;
74169
74170+#ifdef CONFIG_PAX_SEGMEXEC
74171+ struct vm_area_struct *vma_m = NULL;
74172+ unsigned long start_m, end_m;
74173+
74174+ start_m = start + SEGMEXEC_TASK_SIZE;
74175+ end_m = end + SEGMEXEC_TASK_SIZE;
74176+#endif
74177+
74178 if (newflags == oldflags) {
74179 *pprev = vma;
74180 return 0;
74181 }
74182
74183+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
74184+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
74185+
74186+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
74187+ return -ENOMEM;
74188+
74189+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
74190+ return -ENOMEM;
74191+ }
74192+
74193 /*
74194 * If we make a private mapping writable we increase our commit;
74195 * but (without finer accounting) cannot reduce our commit if we
74196@@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm
74197 }
74198 }
74199
74200+#ifdef CONFIG_PAX_SEGMEXEC
74201+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
74202+ if (start != vma->vm_start) {
74203+ error = split_vma(mm, vma, start, 1);
74204+ if (error)
74205+ goto fail;
74206+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
74207+ *pprev = (*pprev)->vm_next;
74208+ }
74209+
74210+ if (end != vma->vm_end) {
74211+ error = split_vma(mm, vma, end, 0);
74212+ if (error)
74213+ goto fail;
74214+ }
74215+
74216+ if (pax_find_mirror_vma(vma)) {
74217+ error = __do_munmap(mm, start_m, end_m - start_m);
74218+ if (error)
74219+ goto fail;
74220+ } else {
74221+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
74222+ if (!vma_m) {
74223+ error = -ENOMEM;
74224+ goto fail;
74225+ }
74226+ vma->vm_flags = newflags;
74227+ error = pax_mirror_vma(vma_m, vma);
74228+ if (error) {
74229+ vma->vm_flags = oldflags;
74230+ goto fail;
74231+ }
74232+ }
74233+ }
74234+#endif
74235+
74236 /*
74237 * First try to merge with previous and/or next vma.
74238 */
74239@@ -204,9 +306,21 @@ success:
74240 * vm_flags and vm_page_prot are protected by the mmap_sem
74241 * held in write mode.
74242 */
74243+
74244+#ifdef CONFIG_PAX_SEGMEXEC
74245+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
74246+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
74247+#endif
74248+
74249 vma->vm_flags = newflags;
74250+
74251+#ifdef CONFIG_PAX_MPROTECT
74252+ if (mm->binfmt && mm->binfmt->handle_mprotect)
74253+ mm->binfmt->handle_mprotect(vma, newflags);
74254+#endif
74255+
74256 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
74257- vm_get_page_prot(newflags));
74258+ vm_get_page_prot(vma->vm_flags));
74259
74260 if (vma_wants_writenotify(vma)) {
74261 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
74262@@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74263 end = start + len;
74264 if (end <= start)
74265 return -ENOMEM;
74266+
74267+#ifdef CONFIG_PAX_SEGMEXEC
74268+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
74269+ if (end > SEGMEXEC_TASK_SIZE)
74270+ return -EINVAL;
74271+ } else
74272+#endif
74273+
74274+ if (end > TASK_SIZE)
74275+ return -EINVAL;
74276+
74277 if (!arch_validate_prot(prot))
74278 return -EINVAL;
74279
74280@@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74281 /*
74282 * Does the application expect PROT_READ to imply PROT_EXEC:
74283 */
74284- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
74285+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
74286 prot |= PROT_EXEC;
74287
74288 vm_flags = calc_vm_prot_bits(prot);
74289@@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74290 if (start > vma->vm_start)
74291 prev = vma;
74292
74293+#ifdef CONFIG_PAX_MPROTECT
74294+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
74295+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
74296+#endif
74297+
74298 for (nstart = start ; ; ) {
74299 unsigned long newflags;
74300
74301@@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74302
74303 /* newflags >> 4 shift VM_MAY% in place of VM_% */
74304 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
74305+ if (prot & (PROT_WRITE | PROT_EXEC))
74306+ gr_log_rwxmprotect(vma->vm_file);
74307+
74308+ error = -EACCES;
74309+ goto out;
74310+ }
74311+
74312+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
74313 error = -EACCES;
74314 goto out;
74315 }
74316@@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74317 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
74318 if (error)
74319 goto out;
74320+
74321+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
74322+
74323 nstart = tmp;
74324
74325 if (nstart < prev->vm_end)
74326diff -urNp linux-2.6.39.2/mm/mremap.c linux-2.6.39.2/mm/mremap.c
74327--- linux-2.6.39.2/mm/mremap.c 2011-05-19 00:06:34.000000000 -0400
74328+++ linux-2.6.39.2/mm/mremap.c 2011-05-22 19:36:33.000000000 -0400
74329@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
74330 continue;
74331 pte = ptep_clear_flush(vma, old_addr, old_pte);
74332 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
74333+
74334+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
74335+ if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
74336+ pte = pte_exprotect(pte);
74337+#endif
74338+
74339 set_pte_at(mm, new_addr, new_pte, pte);
74340 }
74341
74342@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
74343 if (is_vm_hugetlb_page(vma))
74344 goto Einval;
74345
74346+#ifdef CONFIG_PAX_SEGMEXEC
74347+ if (pax_find_mirror_vma(vma))
74348+ goto Einval;
74349+#endif
74350+
74351 /* We can't remap across vm area boundaries */
74352 if (old_len > vma->vm_end - addr)
74353 goto Efault;
74354@@ -329,20 +340,25 @@ static unsigned long mremap_to(unsigned
74355 unsigned long ret = -EINVAL;
74356 unsigned long charged = 0;
74357 unsigned long map_flags;
74358+ unsigned long pax_task_size = TASK_SIZE;
74359
74360 if (new_addr & ~PAGE_MASK)
74361 goto out;
74362
74363- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
74364+#ifdef CONFIG_PAX_SEGMEXEC
74365+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
74366+ pax_task_size = SEGMEXEC_TASK_SIZE;
74367+#endif
74368+
74369+ pax_task_size -= PAGE_SIZE;
74370+
74371+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
74372 goto out;
74373
74374 /* Check if the location we're moving into overlaps the
74375 * old location at all, and fail if it does.
74376 */
74377- if ((new_addr <= addr) && (new_addr+new_len) > addr)
74378- goto out;
74379-
74380- if ((addr <= new_addr) && (addr+old_len) > new_addr)
74381+ if (addr + old_len > new_addr && new_addr + new_len > addr)
74382 goto out;
74383
74384 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74385@@ -414,6 +430,7 @@ unsigned long do_mremap(unsigned long ad
74386 struct vm_area_struct *vma;
74387 unsigned long ret = -EINVAL;
74388 unsigned long charged = 0;
74389+ unsigned long pax_task_size = TASK_SIZE;
74390
74391 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
74392 goto out;
74393@@ -432,6 +449,17 @@ unsigned long do_mremap(unsigned long ad
74394 if (!new_len)
74395 goto out;
74396
74397+#ifdef CONFIG_PAX_SEGMEXEC
74398+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
74399+ pax_task_size = SEGMEXEC_TASK_SIZE;
74400+#endif
74401+
74402+ pax_task_size -= PAGE_SIZE;
74403+
74404+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
74405+ old_len > pax_task_size || addr > pax_task_size-old_len)
74406+ goto out;
74407+
74408 if (flags & MREMAP_FIXED) {
74409 if (flags & MREMAP_MAYMOVE)
74410 ret = mremap_to(addr, old_len, new_addr, new_len);
74411@@ -481,6 +509,7 @@ unsigned long do_mremap(unsigned long ad
74412 addr + new_len);
74413 }
74414 ret = addr;
74415+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
74416 goto out;
74417 }
74418 }
74419@@ -507,7 +536,13 @@ unsigned long do_mremap(unsigned long ad
74420 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74421 if (ret)
74422 goto out;
74423+
74424+ map_flags = vma->vm_flags;
74425 ret = move_vma(vma, addr, old_len, new_len, new_addr);
74426+ if (!(ret & ~PAGE_MASK)) {
74427+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
74428+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
74429+ }
74430 }
74431 out:
74432 if (ret & ~PAGE_MASK)
74433diff -urNp linux-2.6.39.2/mm/nobootmem.c linux-2.6.39.2/mm/nobootmem.c
74434--- linux-2.6.39.2/mm/nobootmem.c 2011-05-19 00:06:34.000000000 -0400
74435+++ linux-2.6.39.2/mm/nobootmem.c 2011-05-22 19:36:33.000000000 -0400
74436@@ -110,19 +110,30 @@ static void __init __free_pages_memory(u
74437 unsigned long __init free_all_memory_core_early(int nodeid)
74438 {
74439 int i;
74440- u64 start, end;
74441+ u64 start, end, startrange, endrange;
74442 unsigned long count = 0;
74443- struct range *range = NULL;
74444+ struct range *range = NULL, rangerange = { 0, 0 };
74445 int nr_range;
74446
74447 nr_range = get_free_all_memory_range(&range, nodeid);
74448+ startrange = __pa(range) >> PAGE_SHIFT;
74449+ endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
74450
74451 for (i = 0; i < nr_range; i++) {
74452 start = range[i].start;
74453 end = range[i].end;
74454+ if (start <= endrange && startrange < end) {
74455+ BUG_ON(rangerange.start | rangerange.end);
74456+ rangerange = range[i];
74457+ continue;
74458+ }
74459 count += end - start;
74460 __free_pages_memory(start, end);
74461 }
74462+ start = rangerange.start;
74463+ end = rangerange.end;
74464+ count += end - start;
74465+ __free_pages_memory(start, end);
74466
74467 return count;
74468 }
74469diff -urNp linux-2.6.39.2/mm/nommu.c linux-2.6.39.2/mm/nommu.c
74470--- linux-2.6.39.2/mm/nommu.c 2011-05-19 00:06:34.000000000 -0400
74471+++ linux-2.6.39.2/mm/nommu.c 2011-05-22 19:36:33.000000000 -0400
74472@@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
74473 int sysctl_overcommit_ratio = 50; /* default is 50% */
74474 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
74475 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
74476-int heap_stack_gap = 0;
74477
74478 atomic_long_t mmap_pages_allocated;
74479
74480@@ -833,15 +832,6 @@ struct vm_area_struct *find_vma(struct m
74481 EXPORT_SYMBOL(find_vma);
74482
74483 /*
74484- * find a VMA
74485- * - we don't extend stack VMAs under NOMMU conditions
74486- */
74487-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
74488-{
74489- return find_vma(mm, addr);
74490-}
74491-
74492-/*
74493 * expand a stack to a given address
74494 * - not supported under NOMMU conditions
74495 */
74496@@ -1563,6 +1553,7 @@ int split_vma(struct mm_struct *mm, stru
74497
74498 /* most fields are the same, copy all, and then fixup */
74499 *new = *vma;
74500+ INIT_LIST_HEAD(&new->anon_vma_chain);
74501 *region = *vma->vm_region;
74502 new->vm_region = region;
74503
74504diff -urNp linux-2.6.39.2/mm/page_alloc.c linux-2.6.39.2/mm/page_alloc.c
74505--- linux-2.6.39.2/mm/page_alloc.c 2011-06-03 00:04:14.000000000 -0400
74506+++ linux-2.6.39.2/mm/page_alloc.c 2011-06-03 00:32:08.000000000 -0400
74507@@ -650,6 +650,10 @@ static bool free_pages_prepare(struct pa
74508 int i;
74509 int bad = 0;
74510
74511+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74512+ unsigned long index = 1UL << order;
74513+#endif
74514+
74515 trace_mm_page_free_direct(page, order);
74516 kmemcheck_free_shadow(page, order);
74517
74518@@ -665,6 +669,12 @@ static bool free_pages_prepare(struct pa
74519 debug_check_no_obj_freed(page_address(page),
74520 PAGE_SIZE << order);
74521 }
74522+
74523+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74524+ for (; index; --index)
74525+ sanitize_highpage(page + index - 1);
74526+#endif
74527+
74528 arch_free_page(page, order);
74529 kernel_map_pages(page, 1 << order, 0);
74530
74531@@ -780,8 +790,10 @@ static int prep_new_page(struct page *pa
74532 arch_alloc_page(page, order);
74533 kernel_map_pages(page, 1 << order, 1);
74534
74535+#ifndef CONFIG_PAX_MEMORY_SANITIZE
74536 if (gfp_flags & __GFP_ZERO)
74537 prep_zero_page(page, order, gfp_flags);
74538+#endif
74539
74540 if (order && (gfp_flags & __GFP_COMP))
74541 prep_compound_page(page, order);
74542@@ -2504,6 +2516,8 @@ void __show_free_areas(unsigned int filt
74543 int cpu;
74544 struct zone *zone;
74545
74546+ pax_track_stack();
74547+
74548 for_each_populated_zone(zone) {
74549 if (skip_free_areas_zone(filter, zone))
74550 continue;
74551diff -urNp linux-2.6.39.2/mm/percpu.c linux-2.6.39.2/mm/percpu.c
74552--- linux-2.6.39.2/mm/percpu.c 2011-05-19 00:06:34.000000000 -0400
74553+++ linux-2.6.39.2/mm/percpu.c 2011-05-22 19:36:33.000000000 -0400
74554@@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu
74555 static unsigned int pcpu_last_unit_cpu __read_mostly;
74556
74557 /* the address of the first chunk which starts with the kernel static area */
74558-void *pcpu_base_addr __read_mostly;
74559+void *pcpu_base_addr __read_only;
74560 EXPORT_SYMBOL_GPL(pcpu_base_addr);
74561
74562 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
74563diff -urNp linux-2.6.39.2/mm/rmap.c linux-2.6.39.2/mm/rmap.c
74564--- linux-2.6.39.2/mm/rmap.c 2011-05-19 00:06:34.000000000 -0400
74565+++ linux-2.6.39.2/mm/rmap.c 2011-05-22 19:36:33.000000000 -0400
74566@@ -131,6 +131,10 @@ int anon_vma_prepare(struct vm_area_stru
74567 struct anon_vma *anon_vma = vma->anon_vma;
74568 struct anon_vma_chain *avc;
74569
74570+#ifdef CONFIG_PAX_SEGMEXEC
74571+ struct anon_vma_chain *avc_m = NULL;
74572+#endif
74573+
74574 might_sleep();
74575 if (unlikely(!anon_vma)) {
74576 struct mm_struct *mm = vma->vm_mm;
74577@@ -140,6 +144,12 @@ int anon_vma_prepare(struct vm_area_stru
74578 if (!avc)
74579 goto out_enomem;
74580
74581+#ifdef CONFIG_PAX_SEGMEXEC
74582+ avc_m = anon_vma_chain_alloc();
74583+ if (!avc_m)
74584+ goto out_enomem_free_avc;
74585+#endif
74586+
74587 anon_vma = find_mergeable_anon_vma(vma);
74588 allocated = NULL;
74589 if (!anon_vma) {
74590@@ -153,6 +163,21 @@ int anon_vma_prepare(struct vm_area_stru
74591 /* page_table_lock to protect against threads */
74592 spin_lock(&mm->page_table_lock);
74593 if (likely(!vma->anon_vma)) {
74594+
74595+#ifdef CONFIG_PAX_SEGMEXEC
74596+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
74597+
74598+ if (vma_m) {
74599+ BUG_ON(vma_m->anon_vma);
74600+ vma_m->anon_vma = anon_vma;
74601+ avc_m->anon_vma = anon_vma;
74602+ avc_m->vma = vma;
74603+ list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
74604+ list_add(&avc_m->same_anon_vma, &anon_vma->head);
74605+ avc_m = NULL;
74606+ }
74607+#endif
74608+
74609 vma->anon_vma = anon_vma;
74610 avc->anon_vma = anon_vma;
74611 avc->vma = vma;
74612@@ -166,12 +191,24 @@ int anon_vma_prepare(struct vm_area_stru
74613
74614 if (unlikely(allocated))
74615 put_anon_vma(allocated);
74616+
74617+#ifdef CONFIG_PAX_SEGMEXEC
74618+ if (unlikely(avc_m))
74619+ anon_vma_chain_free(avc_m);
74620+#endif
74621+
74622 if (unlikely(avc))
74623 anon_vma_chain_free(avc);
74624 }
74625 return 0;
74626
74627 out_enomem_free_avc:
74628+
74629+#ifdef CONFIG_PAX_SEGMEXEC
74630+ if (avc_m)
74631+ anon_vma_chain_free(avc_m);
74632+#endif
74633+
74634 anon_vma_chain_free(avc);
74635 out_enomem:
74636 return -ENOMEM;
74637@@ -198,7 +235,7 @@ static void anon_vma_chain_link(struct v
74638 * Attach the anon_vmas from src to dst.
74639 * Returns 0 on success, -ENOMEM on failure.
74640 */
74641-int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
74642+int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
74643 {
74644 struct anon_vma_chain *avc, *pavc;
74645
74646@@ -220,7 +257,7 @@ int anon_vma_clone(struct vm_area_struct
74647 * the corresponding VMA in the parent process is attached to.
74648 * Returns 0 on success, non-zero on failure.
74649 */
74650-int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
74651+int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
74652 {
74653 struct anon_vma_chain *avc;
74654 struct anon_vma *anon_vma;
74655diff -urNp linux-2.6.39.2/mm/shmem.c linux-2.6.39.2/mm/shmem.c
74656--- linux-2.6.39.2/mm/shmem.c 2011-06-03 00:04:14.000000000 -0400
74657+++ linux-2.6.39.2/mm/shmem.c 2011-06-03 00:32:08.000000000 -0400
74658@@ -31,7 +31,7 @@
74659 #include <linux/percpu_counter.h>
74660 #include <linux/swap.h>
74661
74662-static struct vfsmount *shm_mnt;
74663+struct vfsmount *shm_mnt;
74664
74665 #ifdef CONFIG_SHMEM
74666 /*
74667@@ -1087,6 +1087,8 @@ static int shmem_writepage(struct page *
74668 goto unlock;
74669 }
74670 entry = shmem_swp_entry(info, index, NULL);
74671+ if (!entry)
74672+ goto unlock;
74673 if (entry->val) {
74674 /*
74675 * The more uptodate page coming down from a stacked
74676@@ -1158,6 +1160,8 @@ static struct page *shmem_swapin(swp_ent
74677 struct vm_area_struct pvma;
74678 struct page *page;
74679
74680+ pax_track_stack();
74681+
74682 spol = mpol_cond_copy(&mpol,
74683 mpol_shared_policy_lookup(&info->policy, idx));
74684
74685@@ -2014,7 +2018,7 @@ static int shmem_symlink(struct inode *d
74686
74687 info = SHMEM_I(inode);
74688 inode->i_size = len-1;
74689- if (len <= (char *)inode - (char *)info) {
74690+ if (len <= (char *)inode - (char *)info && len <= 64) {
74691 /* do it inline */
74692 memcpy(info, symname, len);
74693 inode->i_op = &shmem_symlink_inline_operations;
74694@@ -2362,8 +2366,7 @@ int shmem_fill_super(struct super_block
74695 int err = -ENOMEM;
74696
74697 /* Round up to L1_CACHE_BYTES to resist false sharing */
74698- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
74699- L1_CACHE_BYTES), GFP_KERNEL);
74700+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
74701 if (!sbinfo)
74702 return -ENOMEM;
74703
74704diff -urNp linux-2.6.39.2/mm/slab.c linux-2.6.39.2/mm/slab.c
74705--- linux-2.6.39.2/mm/slab.c 2011-05-19 00:06:34.000000000 -0400
74706+++ linux-2.6.39.2/mm/slab.c 2011-05-22 19:41:42.000000000 -0400
74707@@ -150,7 +150,7 @@
74708
74709 /* Legal flag mask for kmem_cache_create(). */
74710 #if DEBUG
74711-# define CREATE_MASK (SLAB_RED_ZONE | \
74712+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
74713 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
74714 SLAB_CACHE_DMA | \
74715 SLAB_STORE_USER | \
74716@@ -158,7 +158,7 @@
74717 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74718 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
74719 #else
74720-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
74721+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
74722 SLAB_CACHE_DMA | \
74723 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
74724 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74725@@ -287,7 +287,7 @@ struct kmem_list3 {
74726 * Need this for bootstrapping a per node allocator.
74727 */
74728 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
74729-static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
74730+static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
74731 #define CACHE_CACHE 0
74732 #define SIZE_AC MAX_NUMNODES
74733 #define SIZE_L3 (2 * MAX_NUMNODES)
74734@@ -388,10 +388,10 @@ static void kmem_list3_init(struct kmem_
74735 if ((x)->max_freeable < i) \
74736 (x)->max_freeable = i; \
74737 } while (0)
74738-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
74739-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
74740-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
74741-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
74742+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
74743+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
74744+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
74745+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
74746 #else
74747 #define STATS_INC_ACTIVE(x) do { } while (0)
74748 #define STATS_DEC_ACTIVE(x) do { } while (0)
74749@@ -537,7 +537,7 @@ static inline void *index_to_obj(struct
74750 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
74751 */
74752 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
74753- const struct slab *slab, void *obj)
74754+ const struct slab *slab, const void *obj)
74755 {
74756 u32 offset = (obj - slab->s_mem);
74757 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
74758@@ -563,7 +563,7 @@ struct cache_names {
74759 static struct cache_names __initdata cache_names[] = {
74760 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
74761 #include <linux/kmalloc_sizes.h>
74762- {NULL,}
74763+ {NULL}
74764 #undef CACHE
74765 };
74766
74767@@ -1529,7 +1529,7 @@ void __init kmem_cache_init(void)
74768 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
74769 sizes[INDEX_AC].cs_size,
74770 ARCH_KMALLOC_MINALIGN,
74771- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74772+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74773 NULL);
74774
74775 if (INDEX_AC != INDEX_L3) {
74776@@ -1537,7 +1537,7 @@ void __init kmem_cache_init(void)
74777 kmem_cache_create(names[INDEX_L3].name,
74778 sizes[INDEX_L3].cs_size,
74779 ARCH_KMALLOC_MINALIGN,
74780- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74781+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74782 NULL);
74783 }
74784
74785@@ -1555,7 +1555,7 @@ void __init kmem_cache_init(void)
74786 sizes->cs_cachep = kmem_cache_create(names->name,
74787 sizes->cs_size,
74788 ARCH_KMALLOC_MINALIGN,
74789- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74790+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74791 NULL);
74792 }
74793 #ifdef CONFIG_ZONE_DMA
74794@@ -4270,10 +4270,10 @@ static int s_show(struct seq_file *m, vo
74795 }
74796 /* cpu stats */
74797 {
74798- unsigned long allochit = atomic_read(&cachep->allochit);
74799- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
74800- unsigned long freehit = atomic_read(&cachep->freehit);
74801- unsigned long freemiss = atomic_read(&cachep->freemiss);
74802+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
74803+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
74804+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
74805+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
74806
74807 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
74808 allochit, allocmiss, freehit, freemiss);
74809@@ -4530,15 +4530,66 @@ static const struct file_operations proc
74810
74811 static int __init slab_proc_init(void)
74812 {
74813- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
74814+ mode_t gr_mode = S_IRUGO;
74815+
74816+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74817+ gr_mode = S_IRUSR;
74818+#endif
74819+
74820+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
74821 #ifdef CONFIG_DEBUG_SLAB_LEAK
74822- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74823+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
74824 #endif
74825 return 0;
74826 }
74827 module_init(slab_proc_init);
74828 #endif
74829
74830+void check_object_size(const void *ptr, unsigned long n, bool to)
74831+{
74832+
74833+#ifdef CONFIG_PAX_USERCOPY
74834+ struct page *page;
74835+ struct kmem_cache *cachep = NULL;
74836+ struct slab *slabp;
74837+ unsigned int objnr;
74838+ unsigned long offset;
74839+
74840+ if (!n)
74841+ return;
74842+
74843+ if (ZERO_OR_NULL_PTR(ptr))
74844+ goto report;
74845+
74846+ if (!virt_addr_valid(ptr))
74847+ return;
74848+
74849+ page = virt_to_head_page(ptr);
74850+
74851+ if (!PageSlab(page)) {
74852+ if (object_is_on_stack(ptr, n) == -1)
74853+ goto report;
74854+ return;
74855+ }
74856+
74857+ cachep = page_get_cache(page);
74858+ if (!(cachep->flags & SLAB_USERCOPY))
74859+ goto report;
74860+
74861+ slabp = page_get_slab(page);
74862+ objnr = obj_to_index(cachep, slabp, ptr);
74863+ BUG_ON(objnr >= cachep->num);
74864+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74865+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74866+ return;
74867+
74868+report:
74869+ pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
74870+#endif
74871+
74872+}
74873+EXPORT_SYMBOL(check_object_size);
74874+
74875 /**
74876 * ksize - get the actual amount of memory allocated for a given object
74877 * @objp: Pointer to the object
74878diff -urNp linux-2.6.39.2/mm/slob.c linux-2.6.39.2/mm/slob.c
74879--- linux-2.6.39.2/mm/slob.c 2011-05-19 00:06:34.000000000 -0400
74880+++ linux-2.6.39.2/mm/slob.c 2011-05-22 19:36:33.000000000 -0400
74881@@ -29,7 +29,7 @@
74882 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74883 * alloc_pages() directly, allocating compound pages so the page order
74884 * does not have to be separately tracked, and also stores the exact
74885- * allocation size in page->private so that it can be used to accurately
74886+ * allocation size in slob_page->size so that it can be used to accurately
74887 * provide ksize(). These objects are detected in kfree() because slob_page()
74888 * is false for them.
74889 *
74890@@ -58,6 +58,7 @@
74891 */
74892
74893 #include <linux/kernel.h>
74894+#include <linux/sched.h>
74895 #include <linux/slab.h>
74896 #include <linux/mm.h>
74897 #include <linux/swap.h> /* struct reclaim_state */
74898@@ -102,7 +103,8 @@ struct slob_page {
74899 unsigned long flags; /* mandatory */
74900 atomic_t _count; /* mandatory */
74901 slobidx_t units; /* free units left in page */
74902- unsigned long pad[2];
74903+ unsigned long pad[1];
74904+ unsigned long size; /* size when >=PAGE_SIZE */
74905 slob_t *free; /* first free slob_t in page */
74906 struct list_head list; /* linked list of free pages */
74907 };
74908@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
74909 */
74910 static inline int is_slob_page(struct slob_page *sp)
74911 {
74912- return PageSlab((struct page *)sp);
74913+ return PageSlab((struct page *)sp) && !sp->size;
74914 }
74915
74916 static inline void set_slob_page(struct slob_page *sp)
74917@@ -150,7 +152,7 @@ static inline void clear_slob_page(struc
74918
74919 static inline struct slob_page *slob_page(const void *addr)
74920 {
74921- return (struct slob_page *)virt_to_page(addr);
74922+ return (struct slob_page *)virt_to_head_page(addr);
74923 }
74924
74925 /*
74926@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_
74927 /*
74928 * Return the size of a slob block.
74929 */
74930-static slobidx_t slob_units(slob_t *s)
74931+static slobidx_t slob_units(const slob_t *s)
74932 {
74933 if (s->units > 0)
74934 return s->units;
74935@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
74936 /*
74937 * Return the next free slob block pointer after this one.
74938 */
74939-static slob_t *slob_next(slob_t *s)
74940+static slob_t *slob_next(const slob_t *s)
74941 {
74942 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74943 slobidx_t next;
74944@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
74945 /*
74946 * Returns true if s is the last free block in its page.
74947 */
74948-static int slob_last(slob_t *s)
74949+static int slob_last(const slob_t *s)
74950 {
74951 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74952 }
74953@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i
74954 if (!page)
74955 return NULL;
74956
74957+ set_slob_page(page);
74958 return page_address(page);
74959 }
74960
74961@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp
74962 if (!b)
74963 return NULL;
74964 sp = slob_page(b);
74965- set_slob_page(sp);
74966
74967 spin_lock_irqsave(&slob_lock, flags);
74968 sp->units = SLOB_UNITS(PAGE_SIZE);
74969 sp->free = b;
74970+ sp->size = 0;
74971 INIT_LIST_HEAD(&sp->list);
74972 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74973 set_slob_page_free(sp, slob_list);
74974@@ -476,10 +479,9 @@ out:
74975 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
74976 */
74977
74978-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74979+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74980 {
74981- unsigned int *m;
74982- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74983+ slob_t *m;
74984 void *ret;
74985
74986 lockdep_trace_alloc(gfp);
74987@@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t
74988
74989 if (!m)
74990 return NULL;
74991- *m = size;
74992+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74993+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74994+ m[0].units = size;
74995+ m[1].units = align;
74996 ret = (void *)m + align;
74997
74998 trace_kmalloc_node(_RET_IP_, ret,
74999@@ -504,9 +509,9 @@ void *__kmalloc_node(size_t size, gfp_t
75000 gfp |= __GFP_COMP;
75001 ret = slob_new_pages(gfp, order, node);
75002 if (ret) {
75003- struct page *page;
75004- page = virt_to_page(ret);
75005- page->private = size;
75006+ struct slob_page *sp;
75007+ sp = slob_page(ret);
75008+ sp->size = size;
75009 }
75010
75011 trace_kmalloc_node(_RET_IP_, ret,
75012@@ -516,6 +521,13 @@ void *__kmalloc_node(size_t size, gfp_t
75013 kmemleak_alloc(ret, size, 1, gfp);
75014 return ret;
75015 }
75016+
75017+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
75018+{
75019+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
75020+
75021+ return __kmalloc_node_align(size, gfp, node, align);
75022+}
75023 EXPORT_SYMBOL(__kmalloc_node);
75024
75025 void kfree(const void *block)
75026@@ -531,13 +543,81 @@ void kfree(const void *block)
75027 sp = slob_page(block);
75028 if (is_slob_page(sp)) {
75029 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
75030- unsigned int *m = (unsigned int *)(block - align);
75031- slob_free(m, *m + align);
75032- } else
75033+ slob_t *m = (slob_t *)(block - align);
75034+ slob_free(m, m[0].units + align);
75035+ } else {
75036+ clear_slob_page(sp);
75037+ free_slob_page(sp);
75038+ sp->size = 0;
75039 put_page(&sp->page);
75040+ }
75041 }
75042 EXPORT_SYMBOL(kfree);
75043
75044+void check_object_size(const void *ptr, unsigned long n, bool to)
75045+{
75046+
75047+#ifdef CONFIG_PAX_USERCOPY
75048+ struct slob_page *sp;
75049+ const slob_t *free;
75050+ const void *base;
75051+
75052+ if (!n)
75053+ return;
75054+
75055+ if (ZERO_OR_NULL_PTR(ptr))
75056+ goto report;
75057+
75058+ if (!virt_addr_valid(ptr))
75059+ return;
75060+
75061+ sp = slob_page(ptr);
75062+ if (!PageSlab((struct page*)sp)) {
75063+ if (object_is_on_stack(ptr, n) == -1)
75064+ goto report;
75065+ return;
75066+ }
75067+
75068+ if (sp->size) {
75069+ base = page_address(&sp->page);
75070+ if (base <= ptr && n <= sp->size - (ptr - base))
75071+ return;
75072+ goto report;
75073+ }
75074+
75075+ /* some tricky double walking to find the chunk */
75076+ base = (void *)((unsigned long)ptr & PAGE_MASK);
75077+ free = sp->free;
75078+
75079+ while (!slob_last(free) && (void *)free <= ptr) {
75080+ base = free + slob_units(free);
75081+ free = slob_next(free);
75082+ }
75083+
75084+ while (base < (void *)free) {
75085+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
75086+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
75087+ int offset;
75088+
75089+ if (ptr < base + align)
75090+ goto report;
75091+
75092+ offset = ptr - base - align;
75093+ if (offset < m) {
75094+ if (n <= m - offset)
75095+ return;
75096+ goto report;
75097+ }
75098+ base += size;
75099+ }
75100+
75101+report:
75102+ pax_report_usercopy(ptr, n, to, NULL);
75103+#endif
75104+
75105+}
75106+EXPORT_SYMBOL(check_object_size);
75107+
75108 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
75109 size_t ksize(const void *block)
75110 {
75111@@ -550,10 +630,10 @@ size_t ksize(const void *block)
75112 sp = slob_page(block);
75113 if (is_slob_page(sp)) {
75114 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
75115- unsigned int *m = (unsigned int *)(block - align);
75116- return SLOB_UNITS(*m) * SLOB_UNIT;
75117+ slob_t *m = (slob_t *)(block - align);
75118+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
75119 } else
75120- return sp->page.private;
75121+ return sp->size;
75122 }
75123 EXPORT_SYMBOL(ksize);
75124
75125@@ -608,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
75126 {
75127 void *b;
75128
75129+#ifdef CONFIG_PAX_USERCOPY
75130+ b = __kmalloc_node_align(c->size, flags, node, c->align);
75131+#else
75132 if (c->size < PAGE_SIZE) {
75133 b = slob_alloc(c->size, flags, c->align, node);
75134 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
75135 SLOB_UNITS(c->size) * SLOB_UNIT,
75136 flags, node);
75137 } else {
75138+ struct slob_page *sp;
75139+
75140 b = slob_new_pages(flags, get_order(c->size), node);
75141+ sp = slob_page(b);
75142+ sp->size = c->size;
75143 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
75144 PAGE_SIZE << get_order(c->size),
75145 flags, node);
75146 }
75147+#endif
75148
75149 if (c->ctor)
75150 c->ctor(b);
75151@@ -630,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
75152
75153 static void __kmem_cache_free(void *b, int size)
75154 {
75155- if (size < PAGE_SIZE)
75156+ struct slob_page *sp = slob_page(b);
75157+
75158+ if (is_slob_page(sp))
75159 slob_free(b, size);
75160- else
75161+ else {
75162+ clear_slob_page(sp);
75163+ free_slob_page(sp);
75164+ sp->size = 0;
75165 slob_free_pages(b, get_order(size));
75166+ }
75167 }
75168
75169 static void kmem_rcu_free(struct rcu_head *head)
75170@@ -646,14 +740,23 @@ static void kmem_rcu_free(struct rcu_hea
75171
75172 void kmem_cache_free(struct kmem_cache *c, void *b)
75173 {
75174+ int size = c->size;
75175+
75176+#ifdef CONFIG_PAX_USERCOPY
75177+ if (size + c->align < PAGE_SIZE) {
75178+ size += c->align;
75179+ b -= c->align;
75180+ }
75181+#endif
75182+
75183 kmemleak_free_recursive(b, c->flags);
75184 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
75185 struct slob_rcu *slob_rcu;
75186- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
75187- slob_rcu->size = c->size;
75188+ slob_rcu = b + (size - sizeof(struct slob_rcu));
75189+ slob_rcu->size = size;
75190 call_rcu(&slob_rcu->head, kmem_rcu_free);
75191 } else {
75192- __kmem_cache_free(b, c->size);
75193+ __kmem_cache_free(b, size);
75194 }
75195
75196 trace_kmem_cache_free(_RET_IP_, b);
75197diff -urNp linux-2.6.39.2/mm/slub.c linux-2.6.39.2/mm/slub.c
75198--- linux-2.6.39.2/mm/slub.c 2011-06-03 00:04:14.000000000 -0400
75199+++ linux-2.6.39.2/mm/slub.c 2011-06-03 00:32:08.000000000 -0400
75200@@ -431,7 +431,7 @@ static void print_track(const char *s, s
75201 if (!t->addr)
75202 return;
75203
75204- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
75205+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
75206 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
75207 }
75208
75209@@ -2183,6 +2183,8 @@ void kmem_cache_free(struct kmem_cache *
75210
75211 page = virt_to_head_page(x);
75212
75213+ BUG_ON(!PageSlab(page));
75214+
75215 slab_free(s, page, x, _RET_IP_);
75216
75217 trace_kmem_cache_free(_RET_IP_, x);
75218@@ -2216,7 +2218,7 @@ static int slub_min_objects;
75219 * Merge control. If this is set then no merging of slab caches will occur.
75220 * (Could be removed. This was introduced to pacify the merge skeptics.)
75221 */
75222-static int slub_nomerge;
75223+static int slub_nomerge = 1;
75224
75225 /*
75226 * Calculate the order of allocation given an slab object size.
75227@@ -2644,7 +2646,7 @@ static int kmem_cache_open(struct kmem_c
75228 * list to avoid pounding the page allocator excessively.
75229 */
75230 set_min_partial(s, ilog2(s->size));
75231- s->refcount = 1;
75232+ atomic_set(&s->refcount, 1);
75233 #ifdef CONFIG_NUMA
75234 s->remote_node_defrag_ratio = 1000;
75235 #endif
75236@@ -2750,8 +2752,7 @@ static inline int kmem_cache_close(struc
75237 void kmem_cache_destroy(struct kmem_cache *s)
75238 {
75239 down_write(&slub_lock);
75240- s->refcount--;
75241- if (!s->refcount) {
75242+ if (atomic_dec_and_test(&s->refcount)) {
75243 list_del(&s->list);
75244 if (kmem_cache_close(s)) {
75245 printk(KERN_ERR "SLUB %s: %s called for cache that "
75246@@ -2961,6 +2962,46 @@ void *__kmalloc_node(size_t size, gfp_t
75247 EXPORT_SYMBOL(__kmalloc_node);
75248 #endif
75249
75250+void check_object_size(const void *ptr, unsigned long n, bool to)
75251+{
75252+
75253+#ifdef CONFIG_PAX_USERCOPY
75254+ struct page *page;
75255+ struct kmem_cache *s = NULL;
75256+ unsigned long offset;
75257+
75258+ if (!n)
75259+ return;
75260+
75261+ if (ZERO_OR_NULL_PTR(ptr))
75262+ goto report;
75263+
75264+ if (!virt_addr_valid(ptr))
75265+ return;
75266+
75267+ page = virt_to_head_page(ptr);
75268+
75269+ if (!PageSlab(page)) {
75270+ if (object_is_on_stack(ptr, n) == -1)
75271+ goto report;
75272+ return;
75273+ }
75274+
75275+ s = page->slab;
75276+ if (!(s->flags & SLAB_USERCOPY))
75277+ goto report;
75278+
75279+ offset = (ptr - page_address(page)) % s->size;
75280+ if (offset <= s->objsize && n <= s->objsize - offset)
75281+ return;
75282+
75283+report:
75284+ pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
75285+#endif
75286+
75287+}
75288+EXPORT_SYMBOL(check_object_size);
75289+
75290 size_t ksize(const void *object)
75291 {
75292 struct page *page;
75293@@ -3205,7 +3246,7 @@ static void __init kmem_cache_bootstrap_
75294 int node;
75295
75296 list_add(&s->list, &slab_caches);
75297- s->refcount = -1;
75298+ atomic_set(&s->refcount, -1);
75299
75300 for_each_node_state(node, N_NORMAL_MEMORY) {
75301 struct kmem_cache_node *n = get_node(s, node);
75302@@ -3322,17 +3363,17 @@ void __init kmem_cache_init(void)
75303
75304 /* Caches that are not of the two-to-the-power-of size */
75305 if (KMALLOC_MIN_SIZE <= 32) {
75306- kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
75307+ kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
75308 caches++;
75309 }
75310
75311 if (KMALLOC_MIN_SIZE <= 64) {
75312- kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
75313+ kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
75314 caches++;
75315 }
75316
75317 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
75318- kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
75319+ kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
75320 caches++;
75321 }
75322
75323@@ -3400,7 +3441,7 @@ static int slab_unmergeable(struct kmem_
75324 /*
75325 * We may have set a slab to be unmergeable during bootstrap.
75326 */
75327- if (s->refcount < 0)
75328+ if (atomic_read(&s->refcount) < 0)
75329 return 1;
75330
75331 return 0;
75332@@ -3459,7 +3500,7 @@ struct kmem_cache *kmem_cache_create(con
75333 down_write(&slub_lock);
75334 s = find_mergeable(size, align, flags, name, ctor);
75335 if (s) {
75336- s->refcount++;
75337+ atomic_inc(&s->refcount);
75338 /*
75339 * Adjust the object sizes so that we clear
75340 * the complete object on kzalloc.
75341@@ -3468,7 +3509,7 @@ struct kmem_cache *kmem_cache_create(con
75342 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
75343
75344 if (sysfs_slab_alias(s, name)) {
75345- s->refcount--;
75346+ atomic_dec(&s->refcount);
75347 goto err;
75348 }
75349 up_write(&slub_lock);
75350@@ -4201,7 +4242,7 @@ SLAB_ATTR_RO(ctor);
75351
75352 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
75353 {
75354- return sprintf(buf, "%d\n", s->refcount - 1);
75355+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
75356 }
75357 SLAB_ATTR_RO(aliases);
75358
75359@@ -4945,7 +4986,13 @@ static const struct file_operations proc
75360
75361 static int __init slab_proc_init(void)
75362 {
75363- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
75364+ mode_t gr_mode = S_IRUGO;
75365+
75366+#ifdef CONFIG_GRKERNSEC_PROC_ADD
75367+ gr_mode = S_IRUSR;
75368+#endif
75369+
75370+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
75371 return 0;
75372 }
75373 module_init(slab_proc_init);
75374diff -urNp linux-2.6.39.2/mm/swapfile.c linux-2.6.39.2/mm/swapfile.c
75375--- linux-2.6.39.2/mm/swapfile.c 2011-05-19 00:06:34.000000000 -0400
75376+++ linux-2.6.39.2/mm/swapfile.c 2011-05-22 19:36:33.000000000 -0400
75377@@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
75378
75379 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
75380 /* Activity counter to indicate that a swapon or swapoff has occurred */
75381-static atomic_t proc_poll_event = ATOMIC_INIT(0);
75382+static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
75383
75384 static inline unsigned char swap_count(unsigned char ent)
75385 {
75386@@ -1669,7 +1669,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
75387 }
75388 filp_close(swap_file, NULL);
75389 err = 0;
75390- atomic_inc(&proc_poll_event);
75391+ atomic_inc_unchecked(&proc_poll_event);
75392 wake_up_interruptible(&proc_poll_wait);
75393
75394 out_dput:
75395@@ -1690,8 +1690,8 @@ static unsigned swaps_poll(struct file *
75396
75397 poll_wait(file, &proc_poll_wait, wait);
75398
75399- if (s->event != atomic_read(&proc_poll_event)) {
75400- s->event = atomic_read(&proc_poll_event);
75401+ if (s->event != atomic_read_unchecked(&proc_poll_event)) {
75402+ s->event = atomic_read_unchecked(&proc_poll_event);
75403 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
75404 }
75405
75406@@ -1797,7 +1797,7 @@ static int swaps_open(struct inode *inod
75407 }
75408
75409 s->seq.private = s;
75410- s->event = atomic_read(&proc_poll_event);
75411+ s->event = atomic_read_unchecked(&proc_poll_event);
75412 return ret;
75413 }
75414
75415@@ -2131,7 +2131,7 @@ SYSCALL_DEFINE2(swapon, const char __use
75416 (p->flags & SWP_DISCARDABLE) ? "D" : "");
75417
75418 mutex_unlock(&swapon_mutex);
75419- atomic_inc(&proc_poll_event);
75420+ atomic_inc_unchecked(&proc_poll_event);
75421 wake_up_interruptible(&proc_poll_wait);
75422
75423 if (S_ISREG(inode->i_mode))
75424diff -urNp linux-2.6.39.2/mm/util.c linux-2.6.39.2/mm/util.c
75425--- linux-2.6.39.2/mm/util.c 2011-05-19 00:06:34.000000000 -0400
75426+++ linux-2.6.39.2/mm/util.c 2011-05-23 17:07:00.000000000 -0400
75427@@ -112,6 +112,7 @@ EXPORT_SYMBOL(memdup_user);
75428 * allocated buffer. Use this if you don't want to free the buffer immediately
75429 * like, for example, with RCU.
75430 */
75431+#undef __krealloc
75432 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
75433 {
75434 void *ret;
75435@@ -145,6 +146,7 @@ EXPORT_SYMBOL(__krealloc);
75436 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
75437 * %NULL pointer, the object pointed to is freed.
75438 */
75439+#undef krealloc
75440 void *krealloc(const void *p, size_t new_size, gfp_t flags)
75441 {
75442 void *ret;
75443@@ -219,6 +221,12 @@ EXPORT_SYMBOL(strndup_user);
75444 void arch_pick_mmap_layout(struct mm_struct *mm)
75445 {
75446 mm->mmap_base = TASK_UNMAPPED_BASE;
75447+
75448+#ifdef CONFIG_PAX_RANDMMAP
75449+ if (mm->pax_flags & MF_PAX_RANDMMAP)
75450+ mm->mmap_base += mm->delta_mmap;
75451+#endif
75452+
75453 mm->get_unmapped_area = arch_get_unmapped_area;
75454 mm->unmap_area = arch_unmap_area;
75455 }
75456diff -urNp linux-2.6.39.2/mm/vmalloc.c linux-2.6.39.2/mm/vmalloc.c
75457--- linux-2.6.39.2/mm/vmalloc.c 2011-05-19 00:06:34.000000000 -0400
75458+++ linux-2.6.39.2/mm/vmalloc.c 2011-05-22 19:36:33.000000000 -0400
75459@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
75460
75461 pte = pte_offset_kernel(pmd, addr);
75462 do {
75463- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75464- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75465+
75466+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75467+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
75468+ BUG_ON(!pte_exec(*pte));
75469+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
75470+ continue;
75471+ }
75472+#endif
75473+
75474+ {
75475+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75476+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75477+ }
75478 } while (pte++, addr += PAGE_SIZE, addr != end);
75479 }
75480
75481@@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un
75482 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
75483 {
75484 pte_t *pte;
75485+ int ret = -ENOMEM;
75486
75487 /*
75488 * nr is a running index into the array which helps higher level
75489@@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un
75490 pte = pte_alloc_kernel(pmd, addr);
75491 if (!pte)
75492 return -ENOMEM;
75493+
75494+ pax_open_kernel();
75495 do {
75496 struct page *page = pages[*nr];
75497
75498- if (WARN_ON(!pte_none(*pte)))
75499- return -EBUSY;
75500- if (WARN_ON(!page))
75501- return -ENOMEM;
75502+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75503+ if (pgprot_val(prot) & _PAGE_NX)
75504+#endif
75505+
75506+ if (WARN_ON(!pte_none(*pte))) {
75507+ ret = -EBUSY;
75508+ goto out;
75509+ }
75510+ if (WARN_ON(!page)) {
75511+ ret = -ENOMEM;
75512+ goto out;
75513+ }
75514 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
75515 (*nr)++;
75516 } while (pte++, addr += PAGE_SIZE, addr != end);
75517- return 0;
75518+ ret = 0;
75519+out:
75520+ pax_close_kernel();
75521+ return ret;
75522 }
75523
75524 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
75525@@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void
75526 * and fall back on vmalloc() if that fails. Others
75527 * just put it in the vmalloc space.
75528 */
75529-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
75530+#ifdef CONFIG_MODULES
75531+#ifdef MODULES_VADDR
75532 unsigned long addr = (unsigned long)x;
75533 if (addr >= MODULES_VADDR && addr < MODULES_END)
75534 return 1;
75535 #endif
75536+
75537+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75538+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
75539+ return 1;
75540+#endif
75541+
75542+#endif
75543+
75544 return is_vmalloc_addr(x);
75545 }
75546
75547@@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void
75548
75549 if (!pgd_none(*pgd)) {
75550 pud_t *pud = pud_offset(pgd, addr);
75551+#ifdef CONFIG_X86
75552+ if (!pud_large(*pud))
75553+#endif
75554 if (!pud_none(*pud)) {
75555 pmd_t *pmd = pmd_offset(pud, addr);
75556+#ifdef CONFIG_X86
75557+ if (!pmd_large(*pmd))
75558+#endif
75559 if (!pmd_none(*pmd)) {
75560 pte_t *ptep, pte;
75561
75562@@ -1296,6 +1336,16 @@ static struct vm_struct *__get_vm_area_n
75563 struct vm_struct *area;
75564
75565 BUG_ON(in_interrupt());
75566+
75567+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75568+ if (flags & VM_KERNEXEC) {
75569+ if (start != VMALLOC_START || end != VMALLOC_END)
75570+ return NULL;
75571+ start = (unsigned long)MODULES_EXEC_VADDR;
75572+ end = (unsigned long)MODULES_EXEC_END;
75573+ }
75574+#endif
75575+
75576 if (flags & VM_IOREMAP) {
75577 int bit = fls(size);
75578
75579@@ -1514,6 +1564,11 @@ void *vmap(struct page **pages, unsigned
75580 if (count > totalram_pages)
75581 return NULL;
75582
75583+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75584+ if (!(pgprot_val(prot) & _PAGE_NX))
75585+ flags |= VM_KERNEXEC;
75586+#endif
75587+
75588 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
75589 __builtin_return_address(0));
75590 if (!area)
75591@@ -1610,6 +1665,13 @@ void *__vmalloc_node_range(unsigned long
75592 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
75593 return NULL;
75594
75595+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75596+ if (!(pgprot_val(prot) & _PAGE_NX))
75597+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
75598+ node, gfp_mask, caller);
75599+ else
75600+#endif
75601+
75602 area = __get_vm_area_node(size, align, VM_ALLOC, start, end, node,
75603 gfp_mask, caller);
75604
75605@@ -1649,6 +1711,7 @@ static void *__vmalloc_node(unsigned lon
75606 gfp_mask, prot, node, caller);
75607 }
75608
75609+#undef __vmalloc
75610 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
75611 {
75612 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
75613@@ -1672,6 +1735,7 @@ static inline void *__vmalloc_node_flags
75614 * For tight control over page level allocator and protection flags
75615 * use __vmalloc() instead.
75616 */
75617+#undef vmalloc
75618 void *vmalloc(unsigned long size)
75619 {
75620 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
75621@@ -1688,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc);
75622 * For tight control over page level allocator and protection flags
75623 * use __vmalloc() instead.
75624 */
75625+#undef vzalloc
75626 void *vzalloc(unsigned long size)
75627 {
75628 return __vmalloc_node_flags(size, -1,
75629@@ -1702,6 +1767,7 @@ EXPORT_SYMBOL(vzalloc);
75630 * The resulting memory area is zeroed so it can be mapped to userspace
75631 * without leaking data.
75632 */
75633+#undef vmalloc_user
75634 void *vmalloc_user(unsigned long size)
75635 {
75636 struct vm_struct *area;
75637@@ -1729,6 +1795,7 @@ EXPORT_SYMBOL(vmalloc_user);
75638 * For tight control over page level allocator and protection flags
75639 * use __vmalloc() instead.
75640 */
75641+#undef vmalloc_node
75642 void *vmalloc_node(unsigned long size, int node)
75643 {
75644 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
75645@@ -1748,6 +1815,7 @@ EXPORT_SYMBOL(vmalloc_node);
75646 * For tight control over page level allocator and protection flags
75647 * use __vmalloc_node() instead.
75648 */
75649+#undef vzalloc_node
75650 void *vzalloc_node(unsigned long size, int node)
75651 {
75652 return __vmalloc_node_flags(size, node,
75653@@ -1770,10 +1838,10 @@ EXPORT_SYMBOL(vzalloc_node);
75654 * For tight control over page level allocator and protection flags
75655 * use __vmalloc() instead.
75656 */
75657-
75658+#undef vmalloc_exec
75659 void *vmalloc_exec(unsigned long size)
75660 {
75661- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
75662+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
75663 -1, __builtin_return_address(0));
75664 }
75665
75666@@ -1792,6 +1860,7 @@ void *vmalloc_exec(unsigned long size)
75667 * Allocate enough 32bit PA addressable pages to cover @size from the
75668 * page level allocator and map them into contiguous kernel virtual space.
75669 */
75670+#undef vmalloc_32
75671 void *vmalloc_32(unsigned long size)
75672 {
75673 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
75674@@ -1806,6 +1875,7 @@ EXPORT_SYMBOL(vmalloc_32);
75675 * The resulting memory area is 32bit addressable and zeroed so it can be
75676 * mapped to userspace without leaking data.
75677 */
75678+#undef vmalloc_32_user
75679 void *vmalloc_32_user(unsigned long size)
75680 {
75681 struct vm_struct *area;
75682@@ -2068,6 +2138,8 @@ int remap_vmalloc_range(struct vm_area_s
75683 unsigned long uaddr = vma->vm_start;
75684 unsigned long usize = vma->vm_end - vma->vm_start;
75685
75686+ BUG_ON(vma->vm_mirror);
75687+
75688 if ((PAGE_SIZE-1) & (unsigned long)addr)
75689 return -EINVAL;
75690
75691diff -urNp linux-2.6.39.2/mm/vmstat.c linux-2.6.39.2/mm/vmstat.c
75692--- linux-2.6.39.2/mm/vmstat.c 2011-05-19 00:06:34.000000000 -0400
75693+++ linux-2.6.39.2/mm/vmstat.c 2011-05-22 19:41:42.000000000 -0400
75694@@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
75695 *
75696 * vm_stat contains the global counters
75697 */
75698-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75699+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75700 EXPORT_SYMBOL(vm_stat);
75701
75702 #ifdef CONFIG_SMP
75703@@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
75704 v = p->vm_stat_diff[i];
75705 p->vm_stat_diff[i] = 0;
75706 local_irq_restore(flags);
75707- atomic_long_add(v, &zone->vm_stat[i]);
75708+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75709 global_diff[i] += v;
75710 #ifdef CONFIG_NUMA
75711 /* 3 seconds idle till flush */
75712@@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
75713
75714 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75715 if (global_diff[i])
75716- atomic_long_add(global_diff[i], &vm_stat[i]);
75717+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75718 }
75719
75720 #endif
75721@@ -1205,10 +1205,20 @@ static int __init setup_vmstat(void)
75722 start_cpu_timer(cpu);
75723 #endif
75724 #ifdef CONFIG_PROC_FS
75725- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75726- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75727- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75728- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75729+ {
75730+ mode_t gr_mode = S_IRUGO;
75731+#ifdef CONFIG_GRKERNSEC_PROC_ADD
75732+ gr_mode = S_IRUSR;
75733+#endif
75734+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75735+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
75736+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75737+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75738+#else
75739+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
75740+#endif
75741+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75742+ }
75743 #endif
75744 return 0;
75745 }
75746diff -urNp linux-2.6.39.2/net/8021q/vlan.c linux-2.6.39.2/net/8021q/vlan.c
75747--- linux-2.6.39.2/net/8021q/vlan.c 2011-05-19 00:06:34.000000000 -0400
75748+++ linux-2.6.39.2/net/8021q/vlan.c 2011-05-22 19:36:33.000000000 -0400
75749@@ -592,8 +592,7 @@ static int vlan_ioctl_handler(struct net
75750 err = -EPERM;
75751 if (!capable(CAP_NET_ADMIN))
75752 break;
75753- if ((args.u.name_type >= 0) &&
75754- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75755+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75756 struct vlan_net *vn;
75757
75758 vn = net_generic(net, vlan_net_id);
75759diff -urNp linux-2.6.39.2/net/atm/atm_misc.c linux-2.6.39.2/net/atm/atm_misc.c
75760--- linux-2.6.39.2/net/atm/atm_misc.c 2011-05-19 00:06:34.000000000 -0400
75761+++ linux-2.6.39.2/net/atm/atm_misc.c 2011-05-22 19:36:33.000000000 -0400
75762@@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int
75763 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75764 return 1;
75765 atm_return(vcc, truesize);
75766- atomic_inc(&vcc->stats->rx_drop);
75767+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75768 return 0;
75769 }
75770 EXPORT_SYMBOL(atm_charge);
75771@@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct
75772 }
75773 }
75774 atm_return(vcc, guess);
75775- atomic_inc(&vcc->stats->rx_drop);
75776+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75777 return NULL;
75778 }
75779 EXPORT_SYMBOL(atm_alloc_charge);
75780@@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
75781
75782 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75783 {
75784-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75785+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75786 __SONET_ITEMS
75787 #undef __HANDLE_ITEM
75788 }
75789@@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
75790
75791 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75792 {
75793-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75794+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75795 __SONET_ITEMS
75796 #undef __HANDLE_ITEM
75797 }
75798diff -urNp linux-2.6.39.2/net/atm/mpoa_caches.c linux-2.6.39.2/net/atm/mpoa_caches.c
75799--- linux-2.6.39.2/net/atm/mpoa_caches.c 2011-05-19 00:06:34.000000000 -0400
75800+++ linux-2.6.39.2/net/atm/mpoa_caches.c 2011-05-22 19:36:33.000000000 -0400
75801@@ -255,6 +255,8 @@ static void check_resolving_entries(stru
75802 struct timeval now;
75803 struct k_message msg;
75804
75805+ pax_track_stack();
75806+
75807 do_gettimeofday(&now);
75808
75809 read_lock_bh(&client->ingress_lock);
75810diff -urNp linux-2.6.39.2/net/atm/proc.c linux-2.6.39.2/net/atm/proc.c
75811--- linux-2.6.39.2/net/atm/proc.c 2011-05-19 00:06:34.000000000 -0400
75812+++ linux-2.6.39.2/net/atm/proc.c 2011-05-22 19:41:42.000000000 -0400
75813@@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
75814 const struct k_atm_aal_stats *stats)
75815 {
75816 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
75817- atomic_read(&stats->tx), atomic_read(&stats->tx_err),
75818- atomic_read(&stats->rx), atomic_read(&stats->rx_err),
75819- atomic_read(&stats->rx_drop));
75820+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75821+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75822+ atomic_read_unchecked(&stats->rx_drop));
75823 }
75824
75825 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
75826@@ -191,7 +191,12 @@ static void vcc_info(struct seq_file *se
75827 {
75828 struct sock *sk = sk_atm(vcc);
75829
75830+#ifdef CONFIG_GRKERNSEC_HIDESYM
75831+ seq_printf(seq, "%p ", NULL);
75832+#else
75833 seq_printf(seq, "%p ", vcc);
75834+#endif
75835+
75836 if (!vcc->dev)
75837 seq_printf(seq, "Unassigned ");
75838 else
75839@@ -218,7 +223,11 @@ static void svc_info(struct seq_file *se
75840 {
75841 if (!vcc->dev)
75842 seq_printf(seq, sizeof(void *) == 4 ?
75843+#ifdef CONFIG_GRKERNSEC_HIDESYM
75844+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
75845+#else
75846 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
75847+#endif
75848 else
75849 seq_printf(seq, "%3d %3d %5d ",
75850 vcc->dev->number, vcc->vpi, vcc->vci);
75851diff -urNp linux-2.6.39.2/net/atm/resources.c linux-2.6.39.2/net/atm/resources.c
75852--- linux-2.6.39.2/net/atm/resources.c 2011-05-19 00:06:34.000000000 -0400
75853+++ linux-2.6.39.2/net/atm/resources.c 2011-05-22 19:36:33.000000000 -0400
75854@@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
75855 static void copy_aal_stats(struct k_atm_aal_stats *from,
75856 struct atm_aal_stats *to)
75857 {
75858-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75859+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75860 __AAL_STAT_ITEMS
75861 #undef __HANDLE_ITEM
75862 }
75863@@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_
75864 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75865 struct atm_aal_stats *to)
75866 {
75867-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75868+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75869 __AAL_STAT_ITEMS
75870 #undef __HANDLE_ITEM
75871 }
75872diff -urNp linux-2.6.39.2/net/batman-adv/hard-interface.c linux-2.6.39.2/net/batman-adv/hard-interface.c
75873--- linux-2.6.39.2/net/batman-adv/hard-interface.c 2011-05-19 00:06:34.000000000 -0400
75874+++ linux-2.6.39.2/net/batman-adv/hard-interface.c 2011-05-22 19:36:33.000000000 -0400
75875@@ -339,8 +339,8 @@ int hardif_enable_interface(struct hard_
75876 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
75877 dev_add_pack(&hard_iface->batman_adv_ptype);
75878
75879- atomic_set(&hard_iface->seqno, 1);
75880- atomic_set(&hard_iface->frag_seqno, 1);
75881+ atomic_set_unchecked(&hard_iface->seqno, 1);
75882+ atomic_set_unchecked(&hard_iface->frag_seqno, 1);
75883 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
75884 hard_iface->net_dev->name);
75885
75886diff -urNp linux-2.6.39.2/net/batman-adv/routing.c linux-2.6.39.2/net/batman-adv/routing.c
75887--- linux-2.6.39.2/net/batman-adv/routing.c 2011-05-19 00:06:34.000000000 -0400
75888+++ linux-2.6.39.2/net/batman-adv/routing.c 2011-05-22 19:36:33.000000000 -0400
75889@@ -625,7 +625,7 @@ void receive_bat_packet(struct ethhdr *e
75890 return;
75891
75892 /* could be changed by schedule_own_packet() */
75893- if_incoming_seqno = atomic_read(&if_incoming->seqno);
75894+ if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
75895
75896 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
75897
75898diff -urNp linux-2.6.39.2/net/batman-adv/send.c linux-2.6.39.2/net/batman-adv/send.c
75899--- linux-2.6.39.2/net/batman-adv/send.c 2011-05-19 00:06:34.000000000 -0400
75900+++ linux-2.6.39.2/net/batman-adv/send.c 2011-05-22 19:36:33.000000000 -0400
75901@@ -277,7 +277,7 @@ void schedule_own_packet(struct hard_ifa
75902
75903 /* change sequence number to network order */
75904 batman_packet->seqno =
75905- htonl((uint32_t)atomic_read(&hard_iface->seqno));
75906+ htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
75907
75908 if (vis_server == VIS_TYPE_SERVER_SYNC)
75909 batman_packet->flags |= VIS_SERVER;
75910@@ -291,7 +291,7 @@ void schedule_own_packet(struct hard_ifa
75911 else
75912 batman_packet->gw_flags = 0;
75913
75914- atomic_inc(&hard_iface->seqno);
75915+ atomic_inc_unchecked(&hard_iface->seqno);
75916
75917 slide_own_bcast_window(hard_iface);
75918 send_time = own_send_time(bat_priv);
75919diff -urNp linux-2.6.39.2/net/batman-adv/soft-interface.c linux-2.6.39.2/net/batman-adv/soft-interface.c
75920--- linux-2.6.39.2/net/batman-adv/soft-interface.c 2011-05-19 00:06:34.000000000 -0400
75921+++ linux-2.6.39.2/net/batman-adv/soft-interface.c 2011-05-22 19:36:33.000000000 -0400
75922@@ -386,7 +386,7 @@ int interface_tx(struct sk_buff *skb, st
75923
75924 /* set broadcast sequence number */
75925 bcast_packet->seqno =
75926- htonl(atomic_inc_return(&bat_priv->bcast_seqno));
75927+ htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
75928
75929 add_bcast_packet_to_list(bat_priv, skb);
75930
75931@@ -579,7 +579,7 @@ struct net_device *softif_create(char *n
75932 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
75933
75934 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
75935- atomic_set(&bat_priv->bcast_seqno, 1);
75936+ atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
75937 atomic_set(&bat_priv->hna_local_changed, 0);
75938
75939 bat_priv->primary_if = NULL;
75940diff -urNp linux-2.6.39.2/net/batman-adv/types.h linux-2.6.39.2/net/batman-adv/types.h
75941--- linux-2.6.39.2/net/batman-adv/types.h 2011-05-19 00:06:34.000000000 -0400
75942+++ linux-2.6.39.2/net/batman-adv/types.h 2011-05-22 19:36:33.000000000 -0400
75943@@ -38,8 +38,8 @@ struct hard_iface {
75944 int16_t if_num;
75945 char if_status;
75946 struct net_device *net_dev;
75947- atomic_t seqno;
75948- atomic_t frag_seqno;
75949+ atomic_unchecked_t seqno;
75950+ atomic_unchecked_t frag_seqno;
75951 unsigned char *packet_buff;
75952 int packet_len;
75953 struct kobject *hardif_obj;
75954@@ -141,7 +141,7 @@ struct bat_priv {
75955 atomic_t orig_interval; /* uint */
75956 atomic_t hop_penalty; /* uint */
75957 atomic_t log_level; /* uint */
75958- atomic_t bcast_seqno;
75959+ atomic_unchecked_t bcast_seqno;
75960 atomic_t bcast_queue_left;
75961 atomic_t batman_queue_left;
75962 char num_ifaces;
75963diff -urNp linux-2.6.39.2/net/batman-adv/unicast.c linux-2.6.39.2/net/batman-adv/unicast.c
75964--- linux-2.6.39.2/net/batman-adv/unicast.c 2011-05-19 00:06:34.000000000 -0400
75965+++ linux-2.6.39.2/net/batman-adv/unicast.c 2011-05-22 19:36:33.000000000 -0400
75966@@ -263,7 +263,7 @@ int frag_send_skb(struct sk_buff *skb, s
75967 frag1->flags = UNI_FRAG_HEAD | large_tail;
75968 frag2->flags = large_tail;
75969
75970- seqno = atomic_add_return(2, &hard_iface->frag_seqno);
75971+ seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
75972 frag1->seqno = htons(seqno - 1);
75973 frag2->seqno = htons(seqno);
75974
75975diff -urNp linux-2.6.39.2/net/bluetooth/l2cap_core.c linux-2.6.39.2/net/bluetooth/l2cap_core.c
75976--- linux-2.6.39.2/net/bluetooth/l2cap_core.c 2011-05-19 00:06:34.000000000 -0400
75977+++ linux-2.6.39.2/net/bluetooth/l2cap_core.c 2011-06-25 14:32:21.000000000 -0400
75978@@ -2202,7 +2202,7 @@ static inline int l2cap_config_req(struc
75979
75980 /* Reject if config buffer is too small. */
75981 len = cmd_len - sizeof(*req);
75982- if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
75983+ if (len < 0 || l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
75984 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
75985 l2cap_build_conf_rsp(sk, rsp,
75986 L2CAP_CONF_REJECT, flags), rsp);
75987diff -urNp linux-2.6.39.2/net/bluetooth/l2cap_sock.c linux-2.6.39.2/net/bluetooth/l2cap_sock.c
75988--- linux-2.6.39.2/net/bluetooth/l2cap_sock.c 2011-05-19 00:06:34.000000000 -0400
75989+++ linux-2.6.39.2/net/bluetooth/l2cap_sock.c 2011-06-12 06:36:08.000000000 -0400
75990@@ -446,6 +446,7 @@ static int l2cap_sock_getsockopt_old(str
75991 break;
75992 }
75993
75994+ memset(&cinfo, 0, sizeof(cinfo));
75995 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
75996 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
75997
75998diff -urNp linux-2.6.39.2/net/bluetooth/rfcomm/sock.c linux-2.6.39.2/net/bluetooth/rfcomm/sock.c
75999--- linux-2.6.39.2/net/bluetooth/rfcomm/sock.c 2011-05-19 00:06:34.000000000 -0400
76000+++ linux-2.6.39.2/net/bluetooth/rfcomm/sock.c 2011-06-12 06:36:42.000000000 -0400
76001@@ -787,6 +787,7 @@ static int rfcomm_sock_getsockopt_old(st
76002
76003 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
76004
76005+ memset(&cinfo, 0, sizeof(cinfo));
76006 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
76007 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
76008
76009diff -urNp linux-2.6.39.2/net/bridge/br_multicast.c linux-2.6.39.2/net/bridge/br_multicast.c
76010--- linux-2.6.39.2/net/bridge/br_multicast.c 2011-05-19 00:06:34.000000000 -0400
76011+++ linux-2.6.39.2/net/bridge/br_multicast.c 2011-05-22 19:36:33.000000000 -0400
76012@@ -1482,7 +1482,7 @@ static int br_multicast_ipv6_rcv(struct
76013 nexthdr = ip6h->nexthdr;
76014 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
76015
76016- if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
76017+ if (nexthdr != IPPROTO_ICMPV6)
76018 return 0;
76019
76020 /* Okay, we found ICMPv6 header */
76021diff -urNp linux-2.6.39.2/net/bridge/netfilter/ebtables.c linux-2.6.39.2/net/bridge/netfilter/ebtables.c
76022--- linux-2.6.39.2/net/bridge/netfilter/ebtables.c 2011-05-19 00:06:34.000000000 -0400
76023+++ linux-2.6.39.2/net/bridge/netfilter/ebtables.c 2011-05-22 19:36:33.000000000 -0400
76024@@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
76025 tmp.valid_hooks = t->table->valid_hooks;
76026 }
76027 mutex_unlock(&ebt_mutex);
76028- if (copy_to_user(user, &tmp, *len) != 0){
76029+ if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
76030 BUGPRINT("c2u Didn't work\n");
76031 ret = -EFAULT;
76032 break;
76033@@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use
76034 int ret;
76035 void __user *pos;
76036
76037+ pax_track_stack();
76038+
76039 memset(&tinfo, 0, sizeof(tinfo));
76040
76041 if (cmd == EBT_SO_GET_ENTRIES) {
76042diff -urNp linux-2.6.39.2/net/caif/caif_socket.c linux-2.6.39.2/net/caif/caif_socket.c
76043--- linux-2.6.39.2/net/caif/caif_socket.c 2011-05-19 00:06:34.000000000 -0400
76044+++ linux-2.6.39.2/net/caif/caif_socket.c 2011-05-22 19:36:33.000000000 -0400
76045@@ -48,18 +48,19 @@ static struct dentry *debugfsdir;
76046 #ifdef CONFIG_DEBUG_FS
76047 struct debug_fs_counter {
76048 atomic_t caif_nr_socks;
76049- atomic_t num_connect_req;
76050- atomic_t num_connect_resp;
76051- atomic_t num_connect_fail_resp;
76052- atomic_t num_disconnect;
76053- atomic_t num_remote_shutdown_ind;
76054- atomic_t num_tx_flow_off_ind;
76055- atomic_t num_tx_flow_on_ind;
76056- atomic_t num_rx_flow_off;
76057- atomic_t num_rx_flow_on;
76058+ atomic_unchecked_t num_connect_req;
76059+ atomic_unchecked_t num_connect_resp;
76060+ atomic_unchecked_t num_connect_fail_resp;
76061+ atomic_unchecked_t num_disconnect;
76062+ atomic_unchecked_t num_remote_shutdown_ind;
76063+ atomic_unchecked_t num_tx_flow_off_ind;
76064+ atomic_unchecked_t num_tx_flow_on_ind;
76065+ atomic_unchecked_t num_rx_flow_off;
76066+ atomic_unchecked_t num_rx_flow_on;
76067 };
76068 static struct debug_fs_counter cnt;
76069 #define dbfs_atomic_inc(v) atomic_inc(v)
76070+#define dbfs_atomic_inc_unchecked(v) atomic_inc_unchecked(v)
76071 #define dbfs_atomic_dec(v) atomic_dec(v)
76072 #else
76073 #define dbfs_atomic_inc(v)
76074@@ -159,7 +160,7 @@ static int caif_queue_rcv_skb(struct soc
76075 atomic_read(&cf_sk->sk.sk_rmem_alloc),
76076 sk_rcvbuf_lowwater(cf_sk));
76077 set_rx_flow_off(cf_sk);
76078- dbfs_atomic_inc(&cnt.num_rx_flow_off);
76079+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
76080 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
76081 }
76082
76083@@ -169,7 +170,7 @@ static int caif_queue_rcv_skb(struct soc
76084 if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
76085 set_rx_flow_off(cf_sk);
76086 pr_debug("sending flow OFF due to rmem_schedule\n");
76087- dbfs_atomic_inc(&cnt.num_rx_flow_off);
76088+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
76089 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
76090 }
76091 skb->dev = NULL;
76092@@ -218,21 +219,21 @@ static void caif_ctrl_cb(struct cflayer
76093 switch (flow) {
76094 case CAIF_CTRLCMD_FLOW_ON_IND:
76095 /* OK from modem to start sending again */
76096- dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
76097+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
76098 set_tx_flow_on(cf_sk);
76099 cf_sk->sk.sk_state_change(&cf_sk->sk);
76100 break;
76101
76102 case CAIF_CTRLCMD_FLOW_OFF_IND:
76103 /* Modem asks us to shut up */
76104- dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
76105+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
76106 set_tx_flow_off(cf_sk);
76107 cf_sk->sk.sk_state_change(&cf_sk->sk);
76108 break;
76109
76110 case CAIF_CTRLCMD_INIT_RSP:
76111 /* We're now connected */
76112- dbfs_atomic_inc(&cnt.num_connect_resp);
76113+ dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
76114 cf_sk->sk.sk_state = CAIF_CONNECTED;
76115 set_tx_flow_on(cf_sk);
76116 cf_sk->sk.sk_state_change(&cf_sk->sk);
76117@@ -247,7 +248,7 @@ static void caif_ctrl_cb(struct cflayer
76118
76119 case CAIF_CTRLCMD_INIT_FAIL_RSP:
76120 /* Connect request failed */
76121- dbfs_atomic_inc(&cnt.num_connect_fail_resp);
76122+ dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
76123 cf_sk->sk.sk_err = ECONNREFUSED;
76124 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
76125 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
76126@@ -261,7 +262,7 @@ static void caif_ctrl_cb(struct cflayer
76127
76128 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
76129 /* Modem has closed this connection, or device is down. */
76130- dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
76131+ dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
76132 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
76133 cf_sk->sk.sk_err = ECONNRESET;
76134 set_rx_flow_on(cf_sk);
76135@@ -281,7 +282,7 @@ static void caif_check_flow_release(stru
76136 return;
76137
76138 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
76139- dbfs_atomic_inc(&cnt.num_rx_flow_on);
76140+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
76141 set_rx_flow_on(cf_sk);
76142 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
76143 }
76144@@ -864,7 +865,7 @@ static int caif_connect(struct socket *s
76145 /*ifindex = id of the interface.*/
76146 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
76147
76148- dbfs_atomic_inc(&cnt.num_connect_req);
76149+ dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
76150 cf_sk->layer.receive = caif_sktrecv_cb;
76151 err = caif_connect_client(&cf_sk->conn_req,
76152 &cf_sk->layer, &ifindex, &headroom, &tailroom);
76153@@ -952,7 +953,7 @@ static int caif_release(struct socket *s
76154 spin_unlock(&sk->sk_receive_queue.lock);
76155 sock->sk = NULL;
76156
76157- dbfs_atomic_inc(&cnt.num_disconnect);
76158+ dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
76159
76160 if (cf_sk->debugfs_socket_dir != NULL)
76161 debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
76162diff -urNp linux-2.6.39.2/net/caif/cfctrl.c linux-2.6.39.2/net/caif/cfctrl.c
76163--- linux-2.6.39.2/net/caif/cfctrl.c 2011-05-19 00:06:34.000000000 -0400
76164+++ linux-2.6.39.2/net/caif/cfctrl.c 2011-05-22 19:36:33.000000000 -0400
76165@@ -9,6 +9,7 @@
76166 #include <linux/stddef.h>
76167 #include <linux/spinlock.h>
76168 #include <linux/slab.h>
76169+#include <linux/sched.h>
76170 #include <net/caif/caif_layer.h>
76171 #include <net/caif/cfpkt.h>
76172 #include <net/caif/cfctrl.h>
76173@@ -46,8 +47,8 @@ struct cflayer *cfctrl_create(void)
76174 dev_info.id = 0xff;
76175 memset(this, 0, sizeof(*this));
76176 cfsrvl_init(&this->serv, 0, &dev_info, false);
76177- atomic_set(&this->req_seq_no, 1);
76178- atomic_set(&this->rsp_seq_no, 1);
76179+ atomic_set_unchecked(&this->req_seq_no, 1);
76180+ atomic_set_unchecked(&this->rsp_seq_no, 1);
76181 this->serv.layer.receive = cfctrl_recv;
76182 sprintf(this->serv.layer.name, "ctrl");
76183 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
76184@@ -116,8 +117,8 @@ void cfctrl_insert_req(struct cfctrl *ct
76185 struct cfctrl_request_info *req)
76186 {
76187 spin_lock(&ctrl->info_list_lock);
76188- atomic_inc(&ctrl->req_seq_no);
76189- req->sequence_no = atomic_read(&ctrl->req_seq_no);
76190+ atomic_inc_unchecked(&ctrl->req_seq_no);
76191+ req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
76192 list_add_tail(&req->list, &ctrl->list);
76193 spin_unlock(&ctrl->info_list_lock);
76194 }
76195@@ -136,7 +137,7 @@ struct cfctrl_request_info *cfctrl_remov
76196 if (p != first)
76197 pr_warn("Requests are not received in order\n");
76198
76199- atomic_set(&ctrl->rsp_seq_no,
76200+ atomic_set_unchecked(&ctrl->rsp_seq_no,
76201 p->sequence_no);
76202 list_del(&p->list);
76203 goto out;
76204@@ -385,6 +386,7 @@ static int cfctrl_recv(struct cflayer *l
76205 struct cfctrl *cfctrl = container_obj(layer);
76206 struct cfctrl_request_info rsp, *req;
76207
76208+ pax_track_stack();
76209
76210 cfpkt_extr_head(pkt, &cmdrsp, 1);
76211 cmd = cmdrsp & CFCTRL_CMD_MASK;
76212diff -urNp linux-2.6.39.2/net/can/bcm.c linux-2.6.39.2/net/can/bcm.c
76213--- linux-2.6.39.2/net/can/bcm.c 2011-05-19 00:06:34.000000000 -0400
76214+++ linux-2.6.39.2/net/can/bcm.c 2011-05-22 19:41:42.000000000 -0400
76215@@ -165,9 +165,15 @@ static int bcm_proc_show(struct seq_file
76216 struct bcm_sock *bo = bcm_sk(sk);
76217 struct bcm_op *op;
76218
76219+#ifdef CONFIG_GRKERNSEC_HIDESYM
76220+ seq_printf(m, ">>> socket %p", NULL);
76221+ seq_printf(m, " / sk %p", NULL);
76222+ seq_printf(m, " / bo %p", NULL);
76223+#else
76224 seq_printf(m, ">>> socket %p", sk->sk_socket);
76225 seq_printf(m, " / sk %p", sk);
76226 seq_printf(m, " / bo %p", bo);
76227+#endif
76228 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
76229 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
76230 seq_printf(m, " <<<\n");
76231diff -urNp linux-2.6.39.2/net/core/datagram.c linux-2.6.39.2/net/core/datagram.c
76232--- linux-2.6.39.2/net/core/datagram.c 2011-05-19 00:06:34.000000000 -0400
76233+++ linux-2.6.39.2/net/core/datagram.c 2011-05-22 19:36:33.000000000 -0400
76234@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
76235 }
76236
76237 kfree_skb(skb);
76238- atomic_inc(&sk->sk_drops);
76239+ atomic_inc_unchecked(&sk->sk_drops);
76240 sk_mem_reclaim_partial(sk);
76241
76242 return err;
76243diff -urNp linux-2.6.39.2/net/core/dev.c linux-2.6.39.2/net/core/dev.c
76244--- linux-2.6.39.2/net/core/dev.c 2011-06-03 00:04:14.000000000 -0400
76245+++ linux-2.6.39.2/net/core/dev.c 2011-06-03 00:32:08.000000000 -0400
76246@@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha
76247 if (no_module && capable(CAP_NET_ADMIN))
76248 no_module = request_module("netdev-%s", name);
76249 if (no_module && capable(CAP_SYS_MODULE)) {
76250+#ifdef CONFIG_GRKERNSEC_MODHARDEN
76251+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
76252+#else
76253 if (!request_module("%s", name))
76254 pr_err("Loading kernel module for a network device "
76255 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
76256 "instead\n", name);
76257+#endif
76258 }
76259 }
76260 EXPORT_SYMBOL(dev_load);
76261@@ -1957,7 +1961,7 @@ struct dev_gso_cb {
76262
76263 static void dev_gso_skb_destructor(struct sk_buff *skb)
76264 {
76265- struct dev_gso_cb *cb;
76266+ const struct dev_gso_cb *cb;
76267
76268 do {
76269 struct sk_buff *nskb = skb->next;
76270@@ -2901,7 +2905,7 @@ int netif_rx_ni(struct sk_buff *skb)
76271 }
76272 EXPORT_SYMBOL(netif_rx_ni);
76273
76274-static void net_tx_action(struct softirq_action *h)
76275+static void net_tx_action(void)
76276 {
76277 struct softnet_data *sd = &__get_cpu_var(softnet_data);
76278
76279@@ -3765,7 +3769,7 @@ void netif_napi_del(struct napi_struct *
76280 }
76281 EXPORT_SYMBOL(netif_napi_del);
76282
76283-static void net_rx_action(struct softirq_action *h)
76284+static void net_rx_action(void)
76285 {
76286 struct softnet_data *sd = &__get_cpu_var(softnet_data);
76287 unsigned long time_limit = jiffies + 2;
76288diff -urNp linux-2.6.39.2/net/core/flow.c linux-2.6.39.2/net/core/flow.c
76289--- linux-2.6.39.2/net/core/flow.c 2011-05-19 00:06:34.000000000 -0400
76290+++ linux-2.6.39.2/net/core/flow.c 2011-05-22 19:36:34.000000000 -0400
76291@@ -60,7 +60,7 @@ struct flow_cache {
76292 struct timer_list rnd_timer;
76293 };
76294
76295-atomic_t flow_cache_genid = ATOMIC_INIT(0);
76296+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
76297 EXPORT_SYMBOL(flow_cache_genid);
76298 static struct flow_cache flow_cache_global;
76299 static struct kmem_cache *flow_cachep __read_mostly;
76300@@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
76301
76302 static int flow_entry_valid(struct flow_cache_entry *fle)
76303 {
76304- if (atomic_read(&flow_cache_genid) != fle->genid)
76305+ if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
76306 return 0;
76307 if (fle->object && !fle->object->ops->check(fle->object))
76308 return 0;
76309@@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, const
76310 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
76311 fcp->hash_count++;
76312 }
76313- } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
76314+ } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
76315 flo = fle->object;
76316 if (!flo)
76317 goto ret_object;
76318@@ -274,7 +274,7 @@ nocache:
76319 }
76320 flo = resolver(net, key, family, dir, flo, ctx);
76321 if (fle) {
76322- fle->genid = atomic_read(&flow_cache_genid);
76323+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
76324 if (!IS_ERR(flo))
76325 fle->object = flo;
76326 else
76327diff -urNp linux-2.6.39.2/net/core/skbuff.c linux-2.6.39.2/net/core/skbuff.c
76328--- linux-2.6.39.2/net/core/skbuff.c 2011-06-03 00:04:14.000000000 -0400
76329+++ linux-2.6.39.2/net/core/skbuff.c 2011-06-03 00:32:08.000000000 -0400
76330@@ -1542,6 +1542,8 @@ int skb_splice_bits(struct sk_buff *skb,
76331 struct sock *sk = skb->sk;
76332 int ret = 0;
76333
76334+ pax_track_stack();
76335+
76336 if (splice_grow_spd(pipe, &spd))
76337 return -ENOMEM;
76338
76339diff -urNp linux-2.6.39.2/net/core/sock.c linux-2.6.39.2/net/core/sock.c
76340--- linux-2.6.39.2/net/core/sock.c 2011-05-19 00:06:34.000000000 -0400
76341+++ linux-2.6.39.2/net/core/sock.c 2011-05-22 19:36:34.000000000 -0400
76342@@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76343 */
76344 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
76345 (unsigned)sk->sk_rcvbuf) {
76346- atomic_inc(&sk->sk_drops);
76347+ atomic_inc_unchecked(&sk->sk_drops);
76348 return -ENOMEM;
76349 }
76350
76351@@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76352 return err;
76353
76354 if (!sk_rmem_schedule(sk, skb->truesize)) {
76355- atomic_inc(&sk->sk_drops);
76356+ atomic_inc_unchecked(&sk->sk_drops);
76357 return -ENOBUFS;
76358 }
76359
76360@@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76361 skb_dst_force(skb);
76362
76363 spin_lock_irqsave(&list->lock, flags);
76364- skb->dropcount = atomic_read(&sk->sk_drops);
76365+ skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
76366 __skb_queue_tail(list, skb);
76367 spin_unlock_irqrestore(&list->lock, flags);
76368
76369@@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
76370 skb->dev = NULL;
76371
76372 if (sk_rcvqueues_full(sk, skb)) {
76373- atomic_inc(&sk->sk_drops);
76374+ atomic_inc_unchecked(&sk->sk_drops);
76375 goto discard_and_relse;
76376 }
76377 if (nested)
76378@@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
76379 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
76380 } else if (sk_add_backlog(sk, skb)) {
76381 bh_unlock_sock(sk);
76382- atomic_inc(&sk->sk_drops);
76383+ atomic_inc_unchecked(&sk->sk_drops);
76384 goto discard_and_relse;
76385 }
76386
76387@@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
76388 return -ENOTCONN;
76389 if (lv < len)
76390 return -EINVAL;
76391- if (copy_to_user(optval, address, len))
76392+ if (len > sizeof(address) || copy_to_user(optval, address, len))
76393 return -EFAULT;
76394 goto lenout;
76395 }
76396@@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock,
76397
76398 if (len > lv)
76399 len = lv;
76400- if (copy_to_user(optval, &v, len))
76401+ if (len > sizeof(v) || copy_to_user(optval, &v, len))
76402 return -EFAULT;
76403 lenout:
76404 if (put_user(len, optlen))
76405@@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock,
76406 */
76407 smp_wmb();
76408 atomic_set(&sk->sk_refcnt, 1);
76409- atomic_set(&sk->sk_drops, 0);
76410+ atomic_set_unchecked(&sk->sk_drops, 0);
76411 }
76412 EXPORT_SYMBOL(sock_init_data);
76413
76414diff -urNp linux-2.6.39.2/net/decnet/sysctl_net_decnet.c linux-2.6.39.2/net/decnet/sysctl_net_decnet.c
76415--- linux-2.6.39.2/net/decnet/sysctl_net_decnet.c 2011-05-19 00:06:34.000000000 -0400
76416+++ linux-2.6.39.2/net/decnet/sysctl_net_decnet.c 2011-05-22 19:36:34.000000000 -0400
76417@@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
76418
76419 if (len > *lenp) len = *lenp;
76420
76421- if (copy_to_user(buffer, addr, len))
76422+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
76423 return -EFAULT;
76424
76425 *lenp = len;
76426@@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
76427
76428 if (len > *lenp) len = *lenp;
76429
76430- if (copy_to_user(buffer, devname, len))
76431+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
76432 return -EFAULT;
76433
76434 *lenp = len;
76435diff -urNp linux-2.6.39.2/net/econet/Kconfig linux-2.6.39.2/net/econet/Kconfig
76436--- linux-2.6.39.2/net/econet/Kconfig 2011-05-19 00:06:34.000000000 -0400
76437+++ linux-2.6.39.2/net/econet/Kconfig 2011-05-22 19:41:42.000000000 -0400
76438@@ -4,7 +4,7 @@
76439
76440 config ECONET
76441 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
76442- depends on EXPERIMENTAL && INET
76443+ depends on EXPERIMENTAL && INET && BROKEN
76444 ---help---
76445 Econet is a fairly old and slow networking protocol mainly used by
76446 Acorn computers to access file and print servers. It uses native
76447diff -urNp linux-2.6.39.2/net/ipv4/fib_frontend.c linux-2.6.39.2/net/ipv4/fib_frontend.c
76448--- linux-2.6.39.2/net/ipv4/fib_frontend.c 2011-05-19 00:06:34.000000000 -0400
76449+++ linux-2.6.39.2/net/ipv4/fib_frontend.c 2011-05-22 19:36:34.000000000 -0400
76450@@ -968,12 +968,12 @@ static int fib_inetaddr_event(struct not
76451 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76452 fib_sync_up(dev);
76453 #endif
76454- atomic_inc(&net->ipv4.dev_addr_genid);
76455+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76456 rt_cache_flush(dev_net(dev), -1);
76457 break;
76458 case NETDEV_DOWN:
76459 fib_del_ifaddr(ifa, NULL);
76460- atomic_inc(&net->ipv4.dev_addr_genid);
76461+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76462 if (ifa->ifa_dev->ifa_list == NULL) {
76463 /* Last address was deleted from this interface.
76464 * Disable IP.
76465@@ -1009,7 +1009,7 @@ static int fib_netdev_event(struct notif
76466 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76467 fib_sync_up(dev);
76468 #endif
76469- atomic_inc(&net->ipv4.dev_addr_genid);
76470+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76471 rt_cache_flush(dev_net(dev), -1);
76472 break;
76473 case NETDEV_DOWN:
76474diff -urNp linux-2.6.39.2/net/ipv4/fib_semantics.c linux-2.6.39.2/net/ipv4/fib_semantics.c
76475--- linux-2.6.39.2/net/ipv4/fib_semantics.c 2011-05-19 00:06:34.000000000 -0400
76476+++ linux-2.6.39.2/net/ipv4/fib_semantics.c 2011-05-22 19:36:34.000000000 -0400
76477@@ -701,7 +701,7 @@ __be32 fib_info_update_nh_saddr(struct n
76478 nh->nh_saddr = inet_select_addr(nh->nh_dev,
76479 nh->nh_gw,
76480 nh->nh_parent->fib_scope);
76481- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
76482+ nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
76483
76484 return nh->nh_saddr;
76485 }
76486diff -urNp linux-2.6.39.2/net/ipv4/inet_diag.c linux-2.6.39.2/net/ipv4/inet_diag.c
76487--- linux-2.6.39.2/net/ipv4/inet_diag.c 2011-05-19 00:06:34.000000000 -0400
76488+++ linux-2.6.39.2/net/ipv4/inet_diag.c 2011-06-20 19:27:58.000000000 -0400
76489@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
76490 r->idiag_retrans = 0;
76491
76492 r->id.idiag_if = sk->sk_bound_dev_if;
76493+
76494+#ifdef CONFIG_GRKERNSEC_HIDESYM
76495+ r->id.idiag_cookie[0] = 0;
76496+ r->id.idiag_cookie[1] = 0;
76497+#else
76498 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
76499 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
76500+#endif
76501
76502 r->id.idiag_sport = inet->inet_sport;
76503 r->id.idiag_dport = inet->inet_dport;
76504@@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in
76505 r->idiag_family = tw->tw_family;
76506 r->idiag_retrans = 0;
76507 r->id.idiag_if = tw->tw_bound_dev_if;
76508+
76509+#ifdef CONFIG_GRKERNSEC_HIDESYM
76510+ r->id.idiag_cookie[0] = 0;
76511+ r->id.idiag_cookie[1] = 0;
76512+#else
76513 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
76514 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
76515+#endif
76516+
76517 r->id.idiag_sport = tw->tw_sport;
76518 r->id.idiag_dport = tw->tw_dport;
76519 r->id.idiag_src[0] = tw->tw_rcv_saddr;
76520@@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk
76521 if (sk == NULL)
76522 goto unlock;
76523
76524+#ifndef CONFIG_GRKERNSEC_HIDESYM
76525 err = -ESTALE;
76526 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
76527 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
76528 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
76529 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
76530 goto out;
76531+#endif
76532
76533 err = -ENOMEM;
76534 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
76535@@ -437,7 +452,7 @@ static int valid_cc(const void *bc, int
76536 return 0;
76537 if (cc == len)
76538 return 1;
76539- if (op->yes < 4)
76540+ if (op->yes < 4 || op->yes & 3)
76541 return 0;
76542 len -= op->yes;
76543 bc += op->yes;
76544@@ -447,11 +462,11 @@ static int valid_cc(const void *bc, int
76545
76546 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
76547 {
76548- const unsigned char *bc = bytecode;
76549+ const void *bc = bytecode;
76550 int len = bytecode_len;
76551
76552 while (len > 0) {
76553- struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
76554+ const struct inet_diag_bc_op *op = bc;
76555
76556 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
76557 switch (op->code) {
76558@@ -462,22 +477,20 @@ static int inet_diag_bc_audit(const void
76559 case INET_DIAG_BC_S_LE:
76560 case INET_DIAG_BC_D_GE:
76561 case INET_DIAG_BC_D_LE:
76562- if (op->yes < 4 || op->yes > len + 4)
76563- return -EINVAL;
76564 case INET_DIAG_BC_JMP:
76565- if (op->no < 4 || op->no > len + 4)
76566+ if (op->no < 4 || op->no > len + 4 || op->no & 3)
76567 return -EINVAL;
76568 if (op->no < len &&
76569 !valid_cc(bytecode, bytecode_len, len - op->no))
76570 return -EINVAL;
76571 break;
76572 case INET_DIAG_BC_NOP:
76573- if (op->yes < 4 || op->yes > len + 4)
76574- return -EINVAL;
76575 break;
76576 default:
76577 return -EINVAL;
76578 }
76579+ if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
76580+ return -EINVAL;
76581 bc += op->yes;
76582 len -= op->yes;
76583 }
76584@@ -582,8 +595,14 @@ static int inet_diag_fill_req(struct sk_
76585 r->idiag_retrans = req->retrans;
76586
76587 r->id.idiag_if = sk->sk_bound_dev_if;
76588+
76589+#ifdef CONFIG_GRKERNSEC_HIDESYM
76590+ r->id.idiag_cookie[0] = 0;
76591+ r->id.idiag_cookie[1] = 0;
76592+#else
76593 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
76594 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
76595+#endif
76596
76597 tmo = req->expires - jiffies;
76598 if (tmo < 0)
76599diff -urNp linux-2.6.39.2/net/ipv4/inet_hashtables.c linux-2.6.39.2/net/ipv4/inet_hashtables.c
76600--- linux-2.6.39.2/net/ipv4/inet_hashtables.c 2011-05-19 00:06:34.000000000 -0400
76601+++ linux-2.6.39.2/net/ipv4/inet_hashtables.c 2011-05-22 19:41:42.000000000 -0400
76602@@ -18,11 +18,14 @@
76603 #include <linux/sched.h>
76604 #include <linux/slab.h>
76605 #include <linux/wait.h>
76606+#include <linux/security.h>
76607
76608 #include <net/inet_connection_sock.h>
76609 #include <net/inet_hashtables.h>
76610 #include <net/ip.h>
76611
76612+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76613+
76614 /*
76615 * Allocate and initialize a new local port bind bucket.
76616 * The bindhash mutex for snum's hash chain must be held here.
76617@@ -529,6 +532,8 @@ ok:
76618 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
76619 spin_unlock(&head->lock);
76620
76621+ gr_update_task_in_ip_table(current, inet_sk(sk));
76622+
76623 if (tw) {
76624 inet_twsk_deschedule(tw, death_row);
76625 while (twrefcnt) {
76626diff -urNp linux-2.6.39.2/net/ipv4/inetpeer.c linux-2.6.39.2/net/ipv4/inetpeer.c
76627--- linux-2.6.39.2/net/ipv4/inetpeer.c 2011-05-19 00:06:34.000000000 -0400
76628+++ linux-2.6.39.2/net/ipv4/inetpeer.c 2011-05-22 19:36:34.000000000 -0400
76629@@ -467,6 +467,8 @@ struct inet_peer *inet_getpeer(struct in
76630 unsigned int sequence;
76631 int invalidated;
76632
76633+ pax_track_stack();
76634+
76635 /* Look up for the address quickly, lockless.
76636 * Because of a concurrent writer, we might not find an existing entry.
76637 */
76638@@ -504,8 +506,8 @@ struct inet_peer *inet_getpeer(struct in
76639 if (p) {
76640 p->daddr = *daddr;
76641 atomic_set(&p->refcnt, 1);
76642- atomic_set(&p->rid, 0);
76643- atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76644+ atomic_set_unchecked(&p->rid, 0);
76645+ atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76646 p->tcp_ts_stamp = 0;
76647 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
76648 p->rate_tokens = 0;
76649diff -urNp linux-2.6.39.2/net/ipv4/ip_fragment.c linux-2.6.39.2/net/ipv4/ip_fragment.c
76650--- linux-2.6.39.2/net/ipv4/ip_fragment.c 2011-05-19 00:06:34.000000000 -0400
76651+++ linux-2.6.39.2/net/ipv4/ip_fragment.c 2011-05-22 19:36:34.000000000 -0400
76652@@ -297,7 +297,7 @@ static inline int ip_frag_too_far(struct
76653 return 0;
76654
76655 start = qp->rid;
76656- end = atomic_inc_return(&peer->rid);
76657+ end = atomic_inc_return_unchecked(&peer->rid);
76658 qp->rid = end;
76659
76660 rc = qp->q.fragments && (end - start) > max;
76661diff -urNp linux-2.6.39.2/net/ipv4/ip_sockglue.c linux-2.6.39.2/net/ipv4/ip_sockglue.c
76662--- linux-2.6.39.2/net/ipv4/ip_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76663+++ linux-2.6.39.2/net/ipv4/ip_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76664@@ -1064,6 +1064,8 @@ static int do_ip_getsockopt(struct sock
76665 int val;
76666 int len;
76667
76668+ pax_track_stack();
76669+
76670 if (level != SOL_IP)
76671 return -EOPNOTSUPP;
76672
76673diff -urNp linux-2.6.39.2/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.39.2/net/ipv4/netfilter/nf_nat_snmp_basic.c
76674--- linux-2.6.39.2/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-19 00:06:34.000000000 -0400
76675+++ linux-2.6.39.2/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-22 19:36:34.000000000 -0400
76676@@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(
76677
76678 *len = 0;
76679
76680- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
76681+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
76682 if (*octets == NULL) {
76683 if (net_ratelimit())
76684 pr_notice("OOM in bsalg (%d)\n", __LINE__);
76685diff -urNp linux-2.6.39.2/net/ipv4/raw.c linux-2.6.39.2/net/ipv4/raw.c
76686--- linux-2.6.39.2/net/ipv4/raw.c 2011-05-19 00:06:34.000000000 -0400
76687+++ linux-2.6.39.2/net/ipv4/raw.c 2011-05-22 19:41:42.000000000 -0400
76688@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
76689 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76690 {
76691 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76692- atomic_inc(&sk->sk_drops);
76693+ atomic_inc_unchecked(&sk->sk_drops);
76694 kfree_skb(skb);
76695 return NET_RX_DROP;
76696 }
76697@@ -730,15 +730,19 @@ static int raw_init(struct sock *sk)
76698
76699 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76700 {
76701+ struct icmp_filter filter;
76702+
76703 if (optlen > sizeof(struct icmp_filter))
76704 optlen = sizeof(struct icmp_filter);
76705- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76706+ if (copy_from_user(&filter, optval, optlen))
76707 return -EFAULT;
76708+ memcpy(&raw_sk(sk)->filter, &filter, sizeof(filter));
76709 return 0;
76710 }
76711
76712 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76713 {
76714+ struct icmp_filter filter;
76715 int len, ret = -EFAULT;
76716
76717 if (get_user(len, optlen))
76718@@ -749,8 +753,9 @@ static int raw_geticmpfilter(struct sock
76719 if (len > sizeof(struct icmp_filter))
76720 len = sizeof(struct icmp_filter);
76721 ret = -EFAULT;
76722+ memcpy(&filter, &raw_sk(sk)->filter, len);
76723 if (put_user(len, optlen) ||
76724- copy_to_user(optval, &raw_sk(sk)->filter, len))
76725+ copy_to_user(optval, &filter, len))
76726 goto out;
76727 ret = 0;
76728 out: return ret;
76729@@ -978,7 +983,13 @@ static void raw_sock_seq_show(struct seq
76730 sk_wmem_alloc_get(sp),
76731 sk_rmem_alloc_get(sp),
76732 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76733- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76734+ atomic_read(&sp->sk_refcnt),
76735+#ifdef CONFIG_GRKERNSEC_HIDESYM
76736+ NULL,
76737+#else
76738+ sp,
76739+#endif
76740+ atomic_read_unchecked(&sp->sk_drops));
76741 }
76742
76743 static int raw_seq_show(struct seq_file *seq, void *v)
76744diff -urNp linux-2.6.39.2/net/ipv4/route.c linux-2.6.39.2/net/ipv4/route.c
76745--- linux-2.6.39.2/net/ipv4/route.c 2011-05-19 00:06:34.000000000 -0400
76746+++ linux-2.6.39.2/net/ipv4/route.c 2011-05-22 19:36:34.000000000 -0400
76747@@ -303,7 +303,7 @@ static inline unsigned int rt_hash(__be3
76748
76749 static inline int rt_genid(struct net *net)
76750 {
76751- return atomic_read(&net->ipv4.rt_genid);
76752+ return atomic_read_unchecked(&net->ipv4.rt_genid);
76753 }
76754
76755 #ifdef CONFIG_PROC_FS
76756@@ -831,7 +831,7 @@ static void rt_cache_invalidate(struct n
76757 unsigned char shuffle;
76758
76759 get_random_bytes(&shuffle, sizeof(shuffle));
76760- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76761+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76762 }
76763
76764 /*
76765@@ -2835,7 +2835,7 @@ static int rt_fill_info(struct net *net,
76766 rt->peer->pmtu_expires - jiffies : 0;
76767 if (rt->peer) {
76768 inet_peer_refcheck(rt->peer);
76769- id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
76770+ id = atomic_read_unchecked(&rt->peer->ip_id_count) & 0xffff;
76771 if (rt->peer->tcp_ts_stamp) {
76772 ts = rt->peer->tcp_ts;
76773 tsage = get_seconds() - rt->peer->tcp_ts_stamp;
76774diff -urNp linux-2.6.39.2/net/ipv4/tcp.c linux-2.6.39.2/net/ipv4/tcp.c
76775--- linux-2.6.39.2/net/ipv4/tcp.c 2011-05-19 00:06:34.000000000 -0400
76776+++ linux-2.6.39.2/net/ipv4/tcp.c 2011-05-22 19:36:34.000000000 -0400
76777@@ -2121,6 +2121,8 @@ static int do_tcp_setsockopt(struct sock
76778 int val;
76779 int err = 0;
76780
76781+ pax_track_stack();
76782+
76783 /* These are data/string values, all the others are ints */
76784 switch (optname) {
76785 case TCP_CONGESTION: {
76786@@ -2500,6 +2502,8 @@ static int do_tcp_getsockopt(struct sock
76787 struct tcp_sock *tp = tcp_sk(sk);
76788 int val, len;
76789
76790+ pax_track_stack();
76791+
76792 if (get_user(len, optlen))
76793 return -EFAULT;
76794
76795diff -urNp linux-2.6.39.2/net/ipv4/tcp_ipv4.c linux-2.6.39.2/net/ipv4/tcp_ipv4.c
76796--- linux-2.6.39.2/net/ipv4/tcp_ipv4.c 2011-05-19 00:06:34.000000000 -0400
76797+++ linux-2.6.39.2/net/ipv4/tcp_ipv4.c 2011-05-22 19:41:42.000000000 -0400
76798@@ -86,6 +86,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
76799 int sysctl_tcp_low_latency __read_mostly;
76800 EXPORT_SYMBOL(sysctl_tcp_low_latency);
76801
76802+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76803+extern int grsec_enable_blackhole;
76804+#endif
76805
76806 #ifdef CONFIG_TCP_MD5SIG
76807 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
76808@@ -1594,6 +1597,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
76809 return 0;
76810
76811 reset:
76812+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76813+ if (!grsec_enable_blackhole)
76814+#endif
76815 tcp_v4_send_reset(rsk, skb);
76816 discard:
76817 kfree_skb(skb);
76818@@ -1656,12 +1662,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
76819 TCP_SKB_CB(skb)->sacked = 0;
76820
76821 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76822- if (!sk)
76823+ if (!sk) {
76824+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76825+ ret = 1;
76826+#endif
76827 goto no_tcp_socket;
76828-
76829+ }
76830 process:
76831- if (sk->sk_state == TCP_TIME_WAIT)
76832+ if (sk->sk_state == TCP_TIME_WAIT) {
76833+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76834+ ret = 2;
76835+#endif
76836 goto do_time_wait;
76837+ }
76838
76839 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
76840 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76841@@ -1711,6 +1724,10 @@ no_tcp_socket:
76842 bad_packet:
76843 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76844 } else {
76845+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76846+ if (!grsec_enable_blackhole || (ret == 1 &&
76847+ (skb->dev->flags & IFF_LOOPBACK)))
76848+#endif
76849 tcp_v4_send_reset(NULL, skb);
76850 }
76851
76852@@ -2374,7 +2391,11 @@ static void get_openreq4(struct sock *sk
76853 0, /* non standard timer */
76854 0, /* open_requests have no inode */
76855 atomic_read(&sk->sk_refcnt),
76856+#ifdef CONFIG_GRKERNSEC_HIDESYM
76857+ NULL,
76858+#else
76859 req,
76860+#endif
76861 len);
76862 }
76863
76864@@ -2424,7 +2445,12 @@ static void get_tcp4_sock(struct sock *s
76865 sock_i_uid(sk),
76866 icsk->icsk_probes_out,
76867 sock_i_ino(sk),
76868- atomic_read(&sk->sk_refcnt), sk,
76869+ atomic_read(&sk->sk_refcnt),
76870+#ifdef CONFIG_GRKERNSEC_HIDESYM
76871+ NULL,
76872+#else
76873+ sk,
76874+#endif
76875 jiffies_to_clock_t(icsk->icsk_rto),
76876 jiffies_to_clock_t(icsk->icsk_ack.ato),
76877 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
76878@@ -2452,7 +2478,13 @@ static void get_timewait4_sock(struct in
76879 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
76880 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76881 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76882- atomic_read(&tw->tw_refcnt), tw, len);
76883+ atomic_read(&tw->tw_refcnt),
76884+#ifdef CONFIG_GRKERNSEC_HIDESYM
76885+ NULL,
76886+#else
76887+ tw,
76888+#endif
76889+ len);
76890 }
76891
76892 #define TMPSZ 150
76893diff -urNp linux-2.6.39.2/net/ipv4/tcp_minisocks.c linux-2.6.39.2/net/ipv4/tcp_minisocks.c
76894--- linux-2.6.39.2/net/ipv4/tcp_minisocks.c 2011-05-19 00:06:34.000000000 -0400
76895+++ linux-2.6.39.2/net/ipv4/tcp_minisocks.c 2011-05-22 19:41:42.000000000 -0400
76896@@ -27,6 +27,10 @@
76897 #include <net/inet_common.h>
76898 #include <net/xfrm.h>
76899
76900+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76901+extern int grsec_enable_blackhole;
76902+#endif
76903+
76904 int sysctl_tcp_syncookies __read_mostly = 1;
76905 EXPORT_SYMBOL(sysctl_tcp_syncookies);
76906
76907@@ -745,6 +749,10 @@ listen_overflow:
76908
76909 embryonic_reset:
76910 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76911+
76912+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76913+ if (!grsec_enable_blackhole)
76914+#endif
76915 if (!(flg & TCP_FLAG_RST))
76916 req->rsk_ops->send_reset(sk, skb);
76917
76918diff -urNp linux-2.6.39.2/net/ipv4/tcp_output.c linux-2.6.39.2/net/ipv4/tcp_output.c
76919--- linux-2.6.39.2/net/ipv4/tcp_output.c 2011-05-19 00:06:34.000000000 -0400
76920+++ linux-2.6.39.2/net/ipv4/tcp_output.c 2011-05-22 19:36:34.000000000 -0400
76921@@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s
76922 int mss;
76923 int s_data_desired = 0;
76924
76925+ pax_track_stack();
76926+
76927 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
76928 s_data_desired = cvp->s_data_desired;
76929 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
76930diff -urNp linux-2.6.39.2/net/ipv4/tcp_probe.c linux-2.6.39.2/net/ipv4/tcp_probe.c
76931--- linux-2.6.39.2/net/ipv4/tcp_probe.c 2011-05-19 00:06:34.000000000 -0400
76932+++ linux-2.6.39.2/net/ipv4/tcp_probe.c 2011-05-22 19:36:34.000000000 -0400
76933@@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
76934 if (cnt + width >= len)
76935 break;
76936
76937- if (copy_to_user(buf + cnt, tbuf, width))
76938+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
76939 return -EFAULT;
76940 cnt += width;
76941 }
76942diff -urNp linux-2.6.39.2/net/ipv4/tcp_timer.c linux-2.6.39.2/net/ipv4/tcp_timer.c
76943--- linux-2.6.39.2/net/ipv4/tcp_timer.c 2011-05-19 00:06:34.000000000 -0400
76944+++ linux-2.6.39.2/net/ipv4/tcp_timer.c 2011-05-22 19:41:42.000000000 -0400
76945@@ -22,6 +22,10 @@
76946 #include <linux/gfp.h>
76947 #include <net/tcp.h>
76948
76949+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76950+extern int grsec_lastack_retries;
76951+#endif
76952+
76953 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76954 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76955 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
76956@@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock
76957 }
76958 }
76959
76960+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76961+ if ((sk->sk_state == TCP_LAST_ACK) &&
76962+ (grsec_lastack_retries > 0) &&
76963+ (grsec_lastack_retries < retry_until))
76964+ retry_until = grsec_lastack_retries;
76965+#endif
76966+
76967 if (retransmits_timed_out(sk, retry_until,
76968 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
76969 /* Has it gone just too far? */
76970diff -urNp linux-2.6.39.2/net/ipv4/udp.c linux-2.6.39.2/net/ipv4/udp.c
76971--- linux-2.6.39.2/net/ipv4/udp.c 2011-05-19 00:06:34.000000000 -0400
76972+++ linux-2.6.39.2/net/ipv4/udp.c 2011-05-22 19:41:42.000000000 -0400
76973@@ -86,6 +86,7 @@
76974 #include <linux/types.h>
76975 #include <linux/fcntl.h>
76976 #include <linux/module.h>
76977+#include <linux/security.h>
76978 #include <linux/socket.h>
76979 #include <linux/sockios.h>
76980 #include <linux/igmp.h>
76981@@ -107,6 +108,10 @@
76982 #include <net/xfrm.h>
76983 #include "udp_impl.h"
76984
76985+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76986+extern int grsec_enable_blackhole;
76987+#endif
76988+
76989 struct udp_table udp_table __read_mostly;
76990 EXPORT_SYMBOL(udp_table);
76991
76992@@ -564,6 +569,9 @@ found:
76993 return s;
76994 }
76995
76996+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76997+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76998+
76999 /*
77000 * This routine is called by the ICMP module when it gets some
77001 * sort of error condition. If err < 0 then the socket should
77002@@ -853,9 +861,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
77003 dport = usin->sin_port;
77004 if (dport == 0)
77005 return -EINVAL;
77006+
77007+ err = gr_search_udp_sendmsg(sk, usin);
77008+ if (err)
77009+ return err;
77010 } else {
77011 if (sk->sk_state != TCP_ESTABLISHED)
77012 return -EDESTADDRREQ;
77013+
77014+ err = gr_search_udp_sendmsg(sk, NULL);
77015+ if (err)
77016+ return err;
77017+
77018 daddr = inet->inet_daddr;
77019 dport = inet->inet_dport;
77020 /* Open fast path for connected socket.
77021@@ -1090,7 +1107,7 @@ static unsigned int first_packet_length(
77022 udp_lib_checksum_complete(skb)) {
77023 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
77024 IS_UDPLITE(sk));
77025- atomic_inc(&sk->sk_drops);
77026+ atomic_inc_unchecked(&sk->sk_drops);
77027 __skb_unlink(skb, rcvq);
77028 __skb_queue_tail(&list_kill, skb);
77029 }
77030@@ -1176,6 +1193,10 @@ try_again:
77031 if (!skb)
77032 goto out;
77033
77034+ err = gr_search_udp_recvmsg(sk, skb);
77035+ if (err)
77036+ goto out_free;
77037+
77038 ulen = skb->len - sizeof(struct udphdr);
77039 if (len > ulen)
77040 len = ulen;
77041@@ -1472,7 +1493,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
77042
77043 drop:
77044 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
77045- atomic_inc(&sk->sk_drops);
77046+ atomic_inc_unchecked(&sk->sk_drops);
77047 kfree_skb(skb);
77048 return -1;
77049 }
77050@@ -1491,7 +1512,7 @@ static void flush_stack(struct sock **st
77051 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
77052
77053 if (!skb1) {
77054- atomic_inc(&sk->sk_drops);
77055+ atomic_inc_unchecked(&sk->sk_drops);
77056 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
77057 IS_UDPLITE(sk));
77058 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
77059@@ -1660,6 +1681,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
77060 goto csum_error;
77061
77062 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
77063+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77064+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
77065+#endif
77066 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
77067
77068 /*
77069@@ -2087,8 +2111,13 @@ static void udp4_format_sock(struct sock
77070 sk_wmem_alloc_get(sp),
77071 sk_rmem_alloc_get(sp),
77072 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
77073- atomic_read(&sp->sk_refcnt), sp,
77074- atomic_read(&sp->sk_drops), len);
77075+ atomic_read(&sp->sk_refcnt),
77076+#ifdef CONFIG_GRKERNSEC_HIDESYM
77077+ NULL,
77078+#else
77079+ sp,
77080+#endif
77081+ atomic_read_unchecked(&sp->sk_drops), len);
77082 }
77083
77084 int udp4_seq_show(struct seq_file *seq, void *v)
77085diff -urNp linux-2.6.39.2/net/ipv6/inet6_connection_sock.c linux-2.6.39.2/net/ipv6/inet6_connection_sock.c
77086--- linux-2.6.39.2/net/ipv6/inet6_connection_sock.c 2011-05-19 00:06:34.000000000 -0400
77087+++ linux-2.6.39.2/net/ipv6/inet6_connection_sock.c 2011-05-22 19:36:34.000000000 -0400
77088@@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *
77089 #ifdef CONFIG_XFRM
77090 {
77091 struct rt6_info *rt = (struct rt6_info *)dst;
77092- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
77093+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
77094 }
77095 #endif
77096 }
77097@@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(
77098 #ifdef CONFIG_XFRM
77099 if (dst) {
77100 struct rt6_info *rt = (struct rt6_info *)dst;
77101- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
77102+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
77103 __sk_dst_reset(sk);
77104 dst = NULL;
77105 }
77106diff -urNp linux-2.6.39.2/net/ipv6/ipv6_sockglue.c linux-2.6.39.2/net/ipv6/ipv6_sockglue.c
77107--- linux-2.6.39.2/net/ipv6/ipv6_sockglue.c 2011-05-19 00:06:34.000000000 -0400
77108+++ linux-2.6.39.2/net/ipv6/ipv6_sockglue.c 2011-05-22 19:36:34.000000000 -0400
77109@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
77110 int val, valbool;
77111 int retv = -ENOPROTOOPT;
77112
77113+ pax_track_stack();
77114+
77115 if (optval == NULL)
77116 val=0;
77117 else {
77118@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
77119 int len;
77120 int val;
77121
77122+ pax_track_stack();
77123+
77124 if (ip6_mroute_opt(optname))
77125 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
77126
77127diff -urNp linux-2.6.39.2/net/ipv6/raw.c linux-2.6.39.2/net/ipv6/raw.c
77128--- linux-2.6.39.2/net/ipv6/raw.c 2011-05-19 00:06:34.000000000 -0400
77129+++ linux-2.6.39.2/net/ipv6/raw.c 2011-05-22 19:41:42.000000000 -0400
77130@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
77131 {
77132 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
77133 skb_checksum_complete(skb)) {
77134- atomic_inc(&sk->sk_drops);
77135+ atomic_inc_unchecked(&sk->sk_drops);
77136 kfree_skb(skb);
77137 return NET_RX_DROP;
77138 }
77139@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
77140 struct raw6_sock *rp = raw6_sk(sk);
77141
77142 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
77143- atomic_inc(&sk->sk_drops);
77144+ atomic_inc_unchecked(&sk->sk_drops);
77145 kfree_skb(skb);
77146 return NET_RX_DROP;
77147 }
77148@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
77149
77150 if (inet->hdrincl) {
77151 if (skb_checksum_complete(skb)) {
77152- atomic_inc(&sk->sk_drops);
77153+ atomic_inc_unchecked(&sk->sk_drops);
77154 kfree_skb(skb);
77155 return NET_RX_DROP;
77156 }
77157@@ -601,7 +601,7 @@ out:
77158 return err;
77159 }
77160
77161-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
77162+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
77163 struct flowi6 *fl6, struct dst_entry **dstp,
77164 unsigned int flags)
77165 {
77166@@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i
77167 u16 proto;
77168 int err;
77169
77170+ pax_track_stack();
77171+
77172 /* Rough check on arithmetic overflow,
77173 better check is made in ip6_append_data().
77174 */
77175@@ -909,12 +911,15 @@ do_confirm:
77176 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
77177 char __user *optval, int optlen)
77178 {
77179+ struct icmp6_filter filter;
77180+
77181 switch (optname) {
77182 case ICMPV6_FILTER:
77183 if (optlen > sizeof(struct icmp6_filter))
77184 optlen = sizeof(struct icmp6_filter);
77185- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
77186+ if (copy_from_user(&filter, optval, optlen))
77187 return -EFAULT;
77188+ memcpy(&raw6_sk(sk)->filter, &filter, optlen);
77189 return 0;
77190 default:
77191 return -ENOPROTOOPT;
77192@@ -926,6 +931,7 @@ static int rawv6_seticmpfilter(struct so
77193 static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
77194 char __user *optval, int __user *optlen)
77195 {
77196+ struct icmp6_filter filter;
77197 int len;
77198
77199 switch (optname) {
77200@@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so
77201 len = sizeof(struct icmp6_filter);
77202 if (put_user(len, optlen))
77203 return -EFAULT;
77204- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
77205+ memcpy(&filter, &raw6_sk(sk)->filter, len);
77206+ if (copy_to_user(optval, &filter, len))
77207 return -EFAULT;
77208 return 0;
77209 default:
77210@@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se
77211 0, 0L, 0,
77212 sock_i_uid(sp), 0,
77213 sock_i_ino(sp),
77214- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
77215+ atomic_read(&sp->sk_refcnt),
77216+#ifdef CONFIG_GRKERNSEC_HIDESYM
77217+ NULL,
77218+#else
77219+ sp,
77220+#endif
77221+ atomic_read_unchecked(&sp->sk_drops));
77222 }
77223
77224 static int raw6_seq_show(struct seq_file *seq, void *v)
77225diff -urNp linux-2.6.39.2/net/ipv6/tcp_ipv6.c linux-2.6.39.2/net/ipv6/tcp_ipv6.c
77226--- linux-2.6.39.2/net/ipv6/tcp_ipv6.c 2011-05-19 00:06:34.000000000 -0400
77227+++ linux-2.6.39.2/net/ipv6/tcp_ipv6.c 2011-05-22 19:41:42.000000000 -0400
77228@@ -92,6 +92,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
77229 }
77230 #endif
77231
77232+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77233+extern int grsec_enable_blackhole;
77234+#endif
77235+
77236 static void tcp_v6_hash(struct sock *sk)
77237 {
77238 if (sk->sk_state != TCP_CLOSE) {
77239@@ -1660,6 +1664,9 @@ static int tcp_v6_do_rcv(struct sock *sk
77240 return 0;
77241
77242 reset:
77243+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77244+ if (!grsec_enable_blackhole)
77245+#endif
77246 tcp_v6_send_reset(sk, skb);
77247 discard:
77248 if (opt_skb)
77249@@ -1739,12 +1746,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
77250 TCP_SKB_CB(skb)->sacked = 0;
77251
77252 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
77253- if (!sk)
77254+ if (!sk) {
77255+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77256+ ret = 1;
77257+#endif
77258 goto no_tcp_socket;
77259+ }
77260
77261 process:
77262- if (sk->sk_state == TCP_TIME_WAIT)
77263+ if (sk->sk_state == TCP_TIME_WAIT) {
77264+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77265+ ret = 2;
77266+#endif
77267 goto do_time_wait;
77268+ }
77269
77270 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
77271 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
77272@@ -1792,6 +1807,10 @@ no_tcp_socket:
77273 bad_packet:
77274 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
77275 } else {
77276+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77277+ if (!grsec_enable_blackhole || (ret == 1 &&
77278+ (skb->dev->flags & IFF_LOOPBACK)))
77279+#endif
77280 tcp_v6_send_reset(NULL, skb);
77281 }
77282
77283@@ -2052,7 +2071,13 @@ static void get_openreq6(struct seq_file
77284 uid,
77285 0, /* non standard timer */
77286 0, /* open_requests have no inode */
77287- 0, req);
77288+ 0,
77289+#ifdef CONFIG_GRKERNSEC_HIDESYM
77290+ NULL
77291+#else
77292+ req
77293+#endif
77294+ );
77295 }
77296
77297 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
77298@@ -2102,7 +2127,12 @@ static void get_tcp6_sock(struct seq_fil
77299 sock_i_uid(sp),
77300 icsk->icsk_probes_out,
77301 sock_i_ino(sp),
77302- atomic_read(&sp->sk_refcnt), sp,
77303+ atomic_read(&sp->sk_refcnt),
77304+#ifdef CONFIG_GRKERNSEC_HIDESYM
77305+ NULL,
77306+#else
77307+ sp,
77308+#endif
77309 jiffies_to_clock_t(icsk->icsk_rto),
77310 jiffies_to_clock_t(icsk->icsk_ack.ato),
77311 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
77312@@ -2137,7 +2167,13 @@ static void get_timewait6_sock(struct se
77313 dest->s6_addr32[2], dest->s6_addr32[3], destp,
77314 tw->tw_substate, 0, 0,
77315 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
77316- atomic_read(&tw->tw_refcnt), tw);
77317+ atomic_read(&tw->tw_refcnt),
77318+#ifdef CONFIG_GRKERNSEC_HIDESYM
77319+ NULL
77320+#else
77321+ tw
77322+#endif
77323+ );
77324 }
77325
77326 static int tcp6_seq_show(struct seq_file *seq, void *v)
77327diff -urNp linux-2.6.39.2/net/ipv6/udp.c linux-2.6.39.2/net/ipv6/udp.c
77328--- linux-2.6.39.2/net/ipv6/udp.c 2011-05-19 00:06:34.000000000 -0400
77329+++ linux-2.6.39.2/net/ipv6/udp.c 2011-05-22 19:41:42.000000000 -0400
77330@@ -50,6 +50,10 @@
77331 #include <linux/seq_file.h>
77332 #include "udp_impl.h"
77333
77334+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77335+extern int grsec_enable_blackhole;
77336+#endif
77337+
77338 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
77339 {
77340 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
77341@@ -545,7 +549,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
77342
77343 return 0;
77344 drop:
77345- atomic_inc(&sk->sk_drops);
77346+ atomic_inc_unchecked(&sk->sk_drops);
77347 drop_no_sk_drops_inc:
77348 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
77349 kfree_skb(skb);
77350@@ -621,7 +625,7 @@ static void flush_stack(struct sock **st
77351 continue;
77352 }
77353 drop:
77354- atomic_inc(&sk->sk_drops);
77355+ atomic_inc_unchecked(&sk->sk_drops);
77356 UDP6_INC_STATS_BH(sock_net(sk),
77357 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
77358 UDP6_INC_STATS_BH(sock_net(sk),
77359@@ -776,6 +780,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
77360 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
77361 proto == IPPROTO_UDPLITE);
77362
77363+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77364+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
77365+#endif
77366 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
77367
77368 kfree_skb(skb);
77369@@ -792,7 +799,7 @@ int __udp6_lib_rcv(struct sk_buff *skb,
77370 if (!sock_owned_by_user(sk))
77371 udpv6_queue_rcv_skb(sk, skb);
77372 else if (sk_add_backlog(sk, skb)) {
77373- atomic_inc(&sk->sk_drops);
77374+ atomic_inc_unchecked(&sk->sk_drops);
77375 bh_unlock_sock(sk);
77376 sock_put(sk);
77377 goto discard;
77378@@ -1403,8 +1410,13 @@ static void udp6_sock_seq_show(struct se
77379 0, 0L, 0,
77380 sock_i_uid(sp), 0,
77381 sock_i_ino(sp),
77382- atomic_read(&sp->sk_refcnt), sp,
77383- atomic_read(&sp->sk_drops));
77384+ atomic_read(&sp->sk_refcnt),
77385+#ifdef CONFIG_GRKERNSEC_HIDESYM
77386+ NULL,
77387+#else
77388+ sp,
77389+#endif
77390+ atomic_read_unchecked(&sp->sk_drops));
77391 }
77392
77393 int udp6_seq_show(struct seq_file *seq, void *v)
77394diff -urNp linux-2.6.39.2/net/irda/ircomm/ircomm_tty.c linux-2.6.39.2/net/irda/ircomm/ircomm_tty.c
77395--- linux-2.6.39.2/net/irda/ircomm/ircomm_tty.c 2011-05-19 00:06:34.000000000 -0400
77396+++ linux-2.6.39.2/net/irda/ircomm/ircomm_tty.c 2011-05-22 19:36:34.000000000 -0400
77397@@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(st
77398 add_wait_queue(&self->open_wait, &wait);
77399
77400 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
77401- __FILE__,__LINE__, tty->driver->name, self->open_count );
77402+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77403
77404 /* As far as I can see, we protect open_count - Jean II */
77405 spin_lock_irqsave(&self->spinlock, flags);
77406 if (!tty_hung_up_p(filp)) {
77407 extra_count = 1;
77408- self->open_count--;
77409+ local_dec(&self->open_count);
77410 }
77411 spin_unlock_irqrestore(&self->spinlock, flags);
77412- self->blocked_open++;
77413+ local_inc(&self->blocked_open);
77414
77415 while (1) {
77416 if (tty->termios->c_cflag & CBAUD) {
77417@@ -330,7 +330,7 @@ static int ircomm_tty_block_til_ready(st
77418 }
77419
77420 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
77421- __FILE__,__LINE__, tty->driver->name, self->open_count );
77422+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77423
77424 schedule();
77425 }
77426@@ -341,13 +341,13 @@ static int ircomm_tty_block_til_ready(st
77427 if (extra_count) {
77428 /* ++ is not atomic, so this should be protected - Jean II */
77429 spin_lock_irqsave(&self->spinlock, flags);
77430- self->open_count++;
77431+ local_inc(&self->open_count);
77432 spin_unlock_irqrestore(&self->spinlock, flags);
77433 }
77434- self->blocked_open--;
77435+ local_dec(&self->blocked_open);
77436
77437 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
77438- __FILE__,__LINE__, tty->driver->name, self->open_count);
77439+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
77440
77441 if (!retval)
77442 self->flags |= ASYNC_NORMAL_ACTIVE;
77443@@ -416,14 +416,14 @@ static int ircomm_tty_open(struct tty_st
77444 }
77445 /* ++ is not atomic, so this should be protected - Jean II */
77446 spin_lock_irqsave(&self->spinlock, flags);
77447- self->open_count++;
77448+ local_inc(&self->open_count);
77449
77450 tty->driver_data = self;
77451 self->tty = tty;
77452 spin_unlock_irqrestore(&self->spinlock, flags);
77453
77454 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
77455- self->line, self->open_count);
77456+ self->line, local_read(&self->open_count));
77457
77458 /* Not really used by us, but lets do it anyway */
77459 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
77460@@ -509,7 +509,7 @@ static void ircomm_tty_close(struct tty_
77461 return;
77462 }
77463
77464- if ((tty->count == 1) && (self->open_count != 1)) {
77465+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
77466 /*
77467 * Uh, oh. tty->count is 1, which means that the tty
77468 * structure will be freed. state->count should always
77469@@ -519,16 +519,16 @@ static void ircomm_tty_close(struct tty_
77470 */
77471 IRDA_DEBUG(0, "%s(), bad serial port count; "
77472 "tty->count is 1, state->count is %d\n", __func__ ,
77473- self->open_count);
77474- self->open_count = 1;
77475+ local_read(&self->open_count));
77476+ local_set(&self->open_count, 1);
77477 }
77478
77479- if (--self->open_count < 0) {
77480+ if (local_dec_return(&self->open_count) < 0) {
77481 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
77482- __func__, self->line, self->open_count);
77483- self->open_count = 0;
77484+ __func__, self->line, local_read(&self->open_count));
77485+ local_set(&self->open_count, 0);
77486 }
77487- if (self->open_count) {
77488+ if (local_read(&self->open_count)) {
77489 spin_unlock_irqrestore(&self->spinlock, flags);
77490
77491 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
77492@@ -560,7 +560,7 @@ static void ircomm_tty_close(struct tty_
77493 tty->closing = 0;
77494 self->tty = NULL;
77495
77496- if (self->blocked_open) {
77497+ if (local_read(&self->blocked_open)) {
77498 if (self->close_delay)
77499 schedule_timeout_interruptible(self->close_delay);
77500 wake_up_interruptible(&self->open_wait);
77501@@ -1012,7 +1012,7 @@ static void ircomm_tty_hangup(struct tty
77502 spin_lock_irqsave(&self->spinlock, flags);
77503 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77504 self->tty = NULL;
77505- self->open_count = 0;
77506+ local_set(&self->open_count, 0);
77507 spin_unlock_irqrestore(&self->spinlock, flags);
77508
77509 wake_up_interruptible(&self->open_wait);
77510@@ -1364,7 +1364,7 @@ static void ircomm_tty_line_info(struct
77511 seq_putc(m, '\n');
77512
77513 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77514- seq_printf(m, "Open count: %d\n", self->open_count);
77515+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
77516 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77517 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77518
77519diff -urNp linux-2.6.39.2/net/iucv/af_iucv.c linux-2.6.39.2/net/iucv/af_iucv.c
77520--- linux-2.6.39.2/net/iucv/af_iucv.c 2011-05-19 00:06:34.000000000 -0400
77521+++ linux-2.6.39.2/net/iucv/af_iucv.c 2011-05-22 19:36:34.000000000 -0400
77522@@ -653,10 +653,10 @@ static int iucv_sock_autobind(struct soc
77523
77524 write_lock_bh(&iucv_sk_list.lock);
77525
77526- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77527+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77528 while (__iucv_get_sock_by_name(name)) {
77529 sprintf(name, "%08x",
77530- atomic_inc_return(&iucv_sk_list.autobind_name));
77531+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77532 }
77533
77534 write_unlock_bh(&iucv_sk_list.lock);
77535diff -urNp linux-2.6.39.2/net/key/af_key.c linux-2.6.39.2/net/key/af_key.c
77536--- linux-2.6.39.2/net/key/af_key.c 2011-05-19 00:06:34.000000000 -0400
77537+++ linux-2.6.39.2/net/key/af_key.c 2011-05-22 19:41:42.000000000 -0400
77538@@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk
77539 struct xfrm_migrate m[XFRM_MAX_DEPTH];
77540 struct xfrm_kmaddress k;
77541
77542+ pax_track_stack();
77543+
77544 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
77545 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
77546 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
77547@@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru
77548 static u32 get_acqseq(void)
77549 {
77550 u32 res;
77551- static atomic_t acqseq;
77552+ static atomic_unchecked_t acqseq;
77553
77554 do {
77555- res = atomic_inc_return(&acqseq);
77556+ res = atomic_inc_return_unchecked(&acqseq);
77557 } while (!res);
77558 return res;
77559 }
77560@@ -3657,7 +3659,11 @@ static int pfkey_seq_show(struct seq_fil
77561 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
77562 else
77563 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
77564+#ifdef CONFIG_GRKERNSEC_HIDESYM
77565+ NULL,
77566+#else
77567 s,
77568+#endif
77569 atomic_read(&s->sk_refcnt),
77570 sk_rmem_alloc_get(s),
77571 sk_wmem_alloc_get(s),
77572diff -urNp linux-2.6.39.2/net/l2tp/l2tp_ip.c linux-2.6.39.2/net/l2tp/l2tp_ip.c
77573--- linux-2.6.39.2/net/l2tp/l2tp_ip.c 2011-05-19 00:06:34.000000000 -0400
77574+++ linux-2.6.39.2/net/l2tp/l2tp_ip.c 2011-05-22 19:36:34.000000000 -0400
77575@@ -625,7 +625,7 @@ static struct inet_protosw l2tp_ip_proto
77576 .no_check = 0,
77577 };
77578
77579-static struct net_protocol l2tp_ip_protocol __read_mostly = {
77580+static const struct net_protocol l2tp_ip_protocol = {
77581 .handler = l2tp_ip_recv,
77582 };
77583
77584diff -urNp linux-2.6.39.2/net/lapb/lapb_iface.c linux-2.6.39.2/net/lapb/lapb_iface.c
77585--- linux-2.6.39.2/net/lapb/lapb_iface.c 2011-05-19 00:06:34.000000000 -0400
77586+++ linux-2.6.39.2/net/lapb/lapb_iface.c 2011-05-22 19:36:34.000000000 -0400
77587@@ -138,8 +138,7 @@ static struct lapb_cb *lapb_create_cb(vo
77588 out:
77589 return lapb;
77590 }
77591-
77592-int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks)
77593+int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks)
77594 {
77595 struct lapb_cb *lapb;
77596 int rc = LAPB_BADTOKEN;
77597diff -urNp linux-2.6.39.2/net/mac80211/cfg.c linux-2.6.39.2/net/mac80211/cfg.c
77598--- linux-2.6.39.2/net/mac80211/cfg.c 2011-06-03 00:04:14.000000000 -0400
77599+++ linux-2.6.39.2/net/mac80211/cfg.c 2011-06-03 00:32:08.000000000 -0400
77600@@ -2031,7 +2031,7 @@ static void ieee80211_get_ringparam(stru
77601 drv_get_ringparam(local, tx, tx_max, rx, rx_max);
77602 }
77603
77604-struct cfg80211_ops mac80211_config_ops = {
77605+const struct cfg80211_ops mac80211_config_ops = {
77606 .add_virtual_intf = ieee80211_add_iface,
77607 .del_virtual_intf = ieee80211_del_iface,
77608 .change_virtual_intf = ieee80211_change_iface,
77609diff -urNp linux-2.6.39.2/net/mac80211/cfg.h linux-2.6.39.2/net/mac80211/cfg.h
77610--- linux-2.6.39.2/net/mac80211/cfg.h 2011-05-19 00:06:34.000000000 -0400
77611+++ linux-2.6.39.2/net/mac80211/cfg.h 2011-05-22 19:36:34.000000000 -0400
77612@@ -4,6 +4,6 @@
77613 #ifndef __CFG_H
77614 #define __CFG_H
77615
77616-extern struct cfg80211_ops mac80211_config_ops;
77617+extern const struct cfg80211_ops mac80211_config_ops;
77618
77619 #endif /* __CFG_H */
77620diff -urNp linux-2.6.39.2/net/mac80211/debugfs_sta.c linux-2.6.39.2/net/mac80211/debugfs_sta.c
77621--- linux-2.6.39.2/net/mac80211/debugfs_sta.c 2011-05-19 00:06:34.000000000 -0400
77622+++ linux-2.6.39.2/net/mac80211/debugfs_sta.c 2011-05-22 19:36:34.000000000 -0400
77623@@ -115,6 +115,8 @@ static ssize_t sta_agg_status_read(struc
77624 struct tid_ampdu_rx *tid_rx;
77625 struct tid_ampdu_tx *tid_tx;
77626
77627+ pax_track_stack();
77628+
77629 rcu_read_lock();
77630
77631 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
77632@@ -215,6 +217,8 @@ static ssize_t sta_ht_capa_read(struct f
77633 struct sta_info *sta = file->private_data;
77634 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
77635
77636+ pax_track_stack();
77637+
77638 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
77639 htc->ht_supported ? "" : "not ");
77640 if (htc->ht_supported) {
77641diff -urNp linux-2.6.39.2/net/mac80211/ieee80211_i.h linux-2.6.39.2/net/mac80211/ieee80211_i.h
77642--- linux-2.6.39.2/net/mac80211/ieee80211_i.h 2011-05-19 00:06:34.000000000 -0400
77643+++ linux-2.6.39.2/net/mac80211/ieee80211_i.h 2011-05-22 19:36:34.000000000 -0400
77644@@ -27,6 +27,7 @@
77645 #include <net/ieee80211_radiotap.h>
77646 #include <net/cfg80211.h>
77647 #include <net/mac80211.h>
77648+#include <asm/local.h>
77649 #include "key.h"
77650 #include "sta_info.h"
77651
77652@@ -714,7 +715,7 @@ struct ieee80211_local {
77653 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
77654 spinlock_t queue_stop_reason_lock;
77655
77656- int open_count;
77657+ local_t open_count;
77658 int monitors, cooked_mntrs;
77659 /* number of interfaces with corresponding FIF_ flags */
77660 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
77661diff -urNp linux-2.6.39.2/net/mac80211/iface.c linux-2.6.39.2/net/mac80211/iface.c
77662--- linux-2.6.39.2/net/mac80211/iface.c 2011-05-19 00:06:34.000000000 -0400
77663+++ linux-2.6.39.2/net/mac80211/iface.c 2011-05-22 19:36:34.000000000 -0400
77664@@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
77665 break;
77666 }
77667
77668- if (local->open_count == 0) {
77669+ if (local_read(&local->open_count) == 0) {
77670 res = drv_start(local);
77671 if (res)
77672 goto err_del_bss;
77673@@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_
77674 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
77675
77676 if (!is_valid_ether_addr(dev->dev_addr)) {
77677- if (!local->open_count)
77678+ if (!local_read(&local->open_count))
77679 drv_stop(local);
77680 return -EADDRNOTAVAIL;
77681 }
77682@@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_
77683 mutex_unlock(&local->mtx);
77684
77685 if (coming_up)
77686- local->open_count++;
77687+ local_inc(&local->open_count);
77688
77689 if (hw_reconf_flags) {
77690 ieee80211_hw_config(local, hw_reconf_flags);
77691@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_
77692 err_del_interface:
77693 drv_remove_interface(local, &sdata->vif);
77694 err_stop:
77695- if (!local->open_count)
77696+ if (!local_read(&local->open_count))
77697 drv_stop(local);
77698 err_del_bss:
77699 sdata->bss = NULL;
77700@@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct iee
77701 }
77702
77703 if (going_down)
77704- local->open_count--;
77705+ local_dec(&local->open_count);
77706
77707 switch (sdata->vif.type) {
77708 case NL80211_IFTYPE_AP_VLAN:
77709@@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct iee
77710
77711 ieee80211_recalc_ps(local, -1);
77712
77713- if (local->open_count == 0) {
77714+ if (local_read(&local->open_count) == 0) {
77715 if (local->ops->napi_poll)
77716 napi_disable(&local->napi);
77717 ieee80211_clear_tx_pending(local);
77718diff -urNp linux-2.6.39.2/net/mac80211/main.c linux-2.6.39.2/net/mac80211/main.c
77719--- linux-2.6.39.2/net/mac80211/main.c 2011-05-19 00:06:34.000000000 -0400
77720+++ linux-2.6.39.2/net/mac80211/main.c 2011-05-22 19:36:34.000000000 -0400
77721@@ -215,7 +215,7 @@ int ieee80211_hw_config(struct ieee80211
77722 local->hw.conf.power_level = power;
77723 }
77724
77725- if (changed && local->open_count) {
77726+ if (changed && local_read(&local->open_count)) {
77727 ret = drv_config(local, changed);
77728 /*
77729 * Goal:
77730diff -urNp linux-2.6.39.2/net/mac80211/mlme.c linux-2.6.39.2/net/mac80211/mlme.c
77731--- linux-2.6.39.2/net/mac80211/mlme.c 2011-06-03 00:04:14.000000000 -0400
77732+++ linux-2.6.39.2/net/mac80211/mlme.c 2011-06-03 00:32:08.000000000 -0400
77733@@ -1431,6 +1431,8 @@ static bool ieee80211_assoc_success(stru
77734 bool have_higher_than_11mbit = false;
77735 u16 ap_ht_cap_flags;
77736
77737+ pax_track_stack();
77738+
77739 /* AssocResp and ReassocResp have identical structure */
77740
77741 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
77742diff -urNp linux-2.6.39.2/net/mac80211/pm.c linux-2.6.39.2/net/mac80211/pm.c
77743--- linux-2.6.39.2/net/mac80211/pm.c 2011-05-19 00:06:34.000000000 -0400
77744+++ linux-2.6.39.2/net/mac80211/pm.c 2011-05-22 19:36:34.000000000 -0400
77745@@ -95,7 +95,7 @@ int __ieee80211_suspend(struct ieee80211
77746 }
77747
77748 /* stop hardware - this must stop RX */
77749- if (local->open_count)
77750+ if (local_read(&local->open_count))
77751 ieee80211_stop_device(local);
77752
77753 local->suspended = true;
77754diff -urNp linux-2.6.39.2/net/mac80211/rate.c linux-2.6.39.2/net/mac80211/rate.c
77755--- linux-2.6.39.2/net/mac80211/rate.c 2011-05-19 00:06:34.000000000 -0400
77756+++ linux-2.6.39.2/net/mac80211/rate.c 2011-05-22 19:36:34.000000000 -0400
77757@@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct
77758
77759 ASSERT_RTNL();
77760
77761- if (local->open_count)
77762+ if (local_read(&local->open_count))
77763 return -EBUSY;
77764
77765 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
77766diff -urNp linux-2.6.39.2/net/mac80211/rc80211_pid_debugfs.c linux-2.6.39.2/net/mac80211/rc80211_pid_debugfs.c
77767--- linux-2.6.39.2/net/mac80211/rc80211_pid_debugfs.c 2011-05-19 00:06:34.000000000 -0400
77768+++ linux-2.6.39.2/net/mac80211/rc80211_pid_debugfs.c 2011-05-22 19:36:34.000000000 -0400
77769@@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
77770
77771 spin_unlock_irqrestore(&events->lock, status);
77772
77773- if (copy_to_user(buf, pb, p))
77774+ if (p > sizeof(pb) || copy_to_user(buf, pb, p))
77775 return -EFAULT;
77776
77777 return p;
77778diff -urNp linux-2.6.39.2/net/mac80211/util.c linux-2.6.39.2/net/mac80211/util.c
77779--- linux-2.6.39.2/net/mac80211/util.c 2011-05-19 00:06:34.000000000 -0400
77780+++ linux-2.6.39.2/net/mac80211/util.c 2011-05-22 19:36:34.000000000 -0400
77781@@ -1129,7 +1129,7 @@ int ieee80211_reconfig(struct ieee80211_
77782 local->resuming = true;
77783
77784 /* restart hardware */
77785- if (local->open_count) {
77786+ if (local_read(&local->open_count)) {
77787 /*
77788 * Upon resume hardware can sometimes be goofy due to
77789 * various platform / driver / bus issues, so restarting
77790diff -urNp linux-2.6.39.2/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.39.2/net/netfilter/ipvs/ip_vs_conn.c
77791--- linux-2.6.39.2/net/netfilter/ipvs/ip_vs_conn.c 2011-05-19 00:06:34.000000000 -0400
77792+++ linux-2.6.39.2/net/netfilter/ipvs/ip_vs_conn.c 2011-05-22 19:36:34.000000000 -0400
77793@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
77794 /* Increase the refcnt counter of the dest */
77795 atomic_inc(&dest->refcnt);
77796
77797- conn_flags = atomic_read(&dest->conn_flags);
77798+ conn_flags = atomic_read_unchecked(&dest->conn_flags);
77799 if (cp->protocol != IPPROTO_UDP)
77800 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
77801 /* Bind with the destination and its corresponding transmitter */
77802@@ -861,7 +861,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
77803 atomic_set(&cp->refcnt, 1);
77804
77805 atomic_set(&cp->n_control, 0);
77806- atomic_set(&cp->in_pkts, 0);
77807+ atomic_set_unchecked(&cp->in_pkts, 0);
77808
77809 atomic_inc(&ipvs->conn_count);
77810 if (flags & IP_VS_CONN_F_NO_CPORT)
77811@@ -1141,7 +1141,7 @@ static inline int todrop_entry(struct ip
77812
77813 /* Don't drop the entry if its number of incoming packets is not
77814 located in [0, 8] */
77815- i = atomic_read(&cp->in_pkts);
77816+ i = atomic_read_unchecked(&cp->in_pkts);
77817 if (i > 8 || i < 0) return 0;
77818
77819 if (!todrop_rate[i]) return 0;
77820diff -urNp linux-2.6.39.2/net/netfilter/ipvs/ip_vs_core.c linux-2.6.39.2/net/netfilter/ipvs/ip_vs_core.c
77821--- linux-2.6.39.2/net/netfilter/ipvs/ip_vs_core.c 2011-05-19 00:06:34.000000000 -0400
77822+++ linux-2.6.39.2/net/netfilter/ipvs/ip_vs_core.c 2011-05-22 19:36:34.000000000 -0400
77823@@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv
77824 ret = cp->packet_xmit(skb, cp, pd->pp);
77825 /* do not touch skb anymore */
77826
77827- atomic_inc(&cp->in_pkts);
77828+ atomic_inc_unchecked(&cp->in_pkts);
77829 ip_vs_conn_put(cp);
77830 return ret;
77831 }
77832@@ -1633,7 +1633,7 @@ ip_vs_in(unsigned int hooknum, struct sk
77833 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
77834 pkts = sysctl_sync_threshold(ipvs);
77835 else
77836- pkts = atomic_add_return(1, &cp->in_pkts);
77837+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77838
77839 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
77840 cp->protocol == IPPROTO_SCTP) {
77841diff -urNp linux-2.6.39.2/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.39.2/net/netfilter/ipvs/ip_vs_ctl.c
77842--- linux-2.6.39.2/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-19 00:06:34.000000000 -0400
77843+++ linux-2.6.39.2/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-22 19:36:34.000000000 -0400
77844@@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service
77845 ip_vs_rs_hash(ipvs, dest);
77846 write_unlock_bh(&ipvs->rs_lock);
77847 }
77848- atomic_set(&dest->conn_flags, conn_flags);
77849+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
77850
77851 /* bind the service */
77852 if (!dest->svc) {
77853@@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se
77854 " %-7s %-6d %-10d %-10d\n",
77855 &dest->addr.in6,
77856 ntohs(dest->port),
77857- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77858+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77859 atomic_read(&dest->weight),
77860 atomic_read(&dest->activeconns),
77861 atomic_read(&dest->inactconns));
77862@@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se
77863 "%-7s %-6d %-10d %-10d\n",
77864 ntohl(dest->addr.ip),
77865 ntohs(dest->port),
77866- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77867+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77868 atomic_read(&dest->weight),
77869 atomic_read(&dest->activeconns),
77870 atomic_read(&dest->inactconns));
77871@@ -2287,6 +2287,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
77872 struct ip_vs_dest_user *udest_compat;
77873 struct ip_vs_dest_user_kern udest;
77874
77875+ pax_track_stack();
77876+
77877 if (!capable(CAP_NET_ADMIN))
77878 return -EPERM;
77879
77880@@ -2501,7 +2503,7 @@ __ip_vs_get_dest_entries(struct net *net
77881
77882 entry.addr = dest->addr.ip;
77883 entry.port = dest->port;
77884- entry.conn_flags = atomic_read(&dest->conn_flags);
77885+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77886 entry.weight = atomic_read(&dest->weight);
77887 entry.u_threshold = dest->u_threshold;
77888 entry.l_threshold = dest->l_threshold;
77889@@ -3029,7 +3031,7 @@ static int ip_vs_genl_fill_dest(struct s
77890 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
77891
77892 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77893- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77894+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77895 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
77896 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
77897 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
77898diff -urNp linux-2.6.39.2/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.39.2/net/netfilter/ipvs/ip_vs_sync.c
77899--- linux-2.6.39.2/net/netfilter/ipvs/ip_vs_sync.c 2011-05-19 00:06:34.000000000 -0400
77900+++ linux-2.6.39.2/net/netfilter/ipvs/ip_vs_sync.c 2011-05-22 19:36:34.000000000 -0400
77901@@ -648,7 +648,7 @@ control:
77902 * i.e only increment in_pkts for Templates.
77903 */
77904 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
77905- int pkts = atomic_add_return(1, &cp->in_pkts);
77906+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77907
77908 if (pkts % sysctl_sync_period(ipvs) != 1)
77909 return;
77910@@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net *
77911
77912 if (opt)
77913 memcpy(&cp->in_seq, opt, sizeof(*opt));
77914- atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77915+ atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77916 cp->state = state;
77917 cp->old_state = cp->state;
77918 /*
77919diff -urNp linux-2.6.39.2/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.39.2/net/netfilter/ipvs/ip_vs_xmit.c
77920--- linux-2.6.39.2/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-19 00:06:34.000000000 -0400
77921+++ linux-2.6.39.2/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-22 19:36:34.000000000 -0400
77922@@ -1127,7 +1127,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
77923 else
77924 rc = NF_ACCEPT;
77925 /* do not touch skb anymore */
77926- atomic_inc(&cp->in_pkts);
77927+ atomic_inc_unchecked(&cp->in_pkts);
77928 goto out;
77929 }
77930
77931@@ -1245,7 +1245,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
77932 else
77933 rc = NF_ACCEPT;
77934 /* do not touch skb anymore */
77935- atomic_inc(&cp->in_pkts);
77936+ atomic_inc_unchecked(&cp->in_pkts);
77937 goto out;
77938 }
77939
77940diff -urNp linux-2.6.39.2/net/netfilter/Kconfig linux-2.6.39.2/net/netfilter/Kconfig
77941--- linux-2.6.39.2/net/netfilter/Kconfig 2011-05-19 00:06:34.000000000 -0400
77942+++ linux-2.6.39.2/net/netfilter/Kconfig 2011-05-22 19:41:42.000000000 -0400
77943@@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
77944
77945 To compile it as a module, choose M here. If unsure, say N.
77946
77947+config NETFILTER_XT_MATCH_GRADM
77948+ tristate '"gradm" match support'
77949+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77950+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77951+ ---help---
77952+ The gradm match allows to match on grsecurity RBAC being enabled.
77953+ It is useful when iptables rules are applied early on bootup to
77954+ prevent connections to the machine (except from a trusted host)
77955+ while the RBAC system is disabled.
77956+
77957 config NETFILTER_XT_MATCH_HASHLIMIT
77958 tristate '"hashlimit" match support'
77959 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
77960diff -urNp linux-2.6.39.2/net/netfilter/Makefile linux-2.6.39.2/net/netfilter/Makefile
77961--- linux-2.6.39.2/net/netfilter/Makefile 2011-05-19 00:06:34.000000000 -0400
77962+++ linux-2.6.39.2/net/netfilter/Makefile 2011-05-22 20:40:16.000000000 -0400
77963@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) +=
77964 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
77965 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77966 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77967+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77968 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77969 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77970 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
77971diff -urNp linux-2.6.39.2/net/netfilter/nfnetlink_log.c linux-2.6.39.2/net/netfilter/nfnetlink_log.c
77972--- linux-2.6.39.2/net/netfilter/nfnetlink_log.c 2011-05-19 00:06:34.000000000 -0400
77973+++ linux-2.6.39.2/net/netfilter/nfnetlink_log.c 2011-05-22 19:36:35.000000000 -0400
77974@@ -70,7 +70,7 @@ struct nfulnl_instance {
77975 };
77976
77977 static DEFINE_SPINLOCK(instances_lock);
77978-static atomic_t global_seq;
77979+static atomic_unchecked_t global_seq;
77980
77981 #define INSTANCE_BUCKETS 16
77982 static struct hlist_head instance_table[INSTANCE_BUCKETS];
77983@@ -506,7 +506,7 @@ __build_packet_message(struct nfulnl_ins
77984 /* global sequence number */
77985 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
77986 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
77987- htonl(atomic_inc_return(&global_seq)));
77988+ htonl(atomic_inc_return_unchecked(&global_seq)));
77989
77990 if (data_len) {
77991 struct nlattr *nla;
77992diff -urNp linux-2.6.39.2/net/netfilter/nfnetlink_queue.c linux-2.6.39.2/net/netfilter/nfnetlink_queue.c
77993--- linux-2.6.39.2/net/netfilter/nfnetlink_queue.c 2011-05-19 00:06:34.000000000 -0400
77994+++ linux-2.6.39.2/net/netfilter/nfnetlink_queue.c 2011-05-22 19:36:35.000000000 -0400
77995@@ -58,7 +58,7 @@ struct nfqnl_instance {
77996 */
77997 spinlock_t lock;
77998 unsigned int queue_total;
77999- atomic_t id_sequence; /* 'sequence' of pkt ids */
78000+ atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */
78001 struct list_head queue_list; /* packets in queue */
78002 };
78003
78004@@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
78005 nfmsg->version = NFNETLINK_V0;
78006 nfmsg->res_id = htons(queue->queue_num);
78007
78008- entry->id = atomic_inc_return(&queue->id_sequence);
78009+ entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
78010 pmsg.packet_id = htonl(entry->id);
78011 pmsg.hw_protocol = entskb->protocol;
78012 pmsg.hook = entry->hook;
78013@@ -869,7 +869,7 @@ static int seq_show(struct seq_file *s,
78014 inst->peer_pid, inst->queue_total,
78015 inst->copy_mode, inst->copy_range,
78016 inst->queue_dropped, inst->queue_user_dropped,
78017- atomic_read(&inst->id_sequence), 1);
78018+ atomic_read_unchecked(&inst->id_sequence), 1);
78019 }
78020
78021 static const struct seq_operations nfqnl_seq_ops = {
78022diff -urNp linux-2.6.39.2/net/netfilter/xt_gradm.c linux-2.6.39.2/net/netfilter/xt_gradm.c
78023--- linux-2.6.39.2/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
78024+++ linux-2.6.39.2/net/netfilter/xt_gradm.c 2011-05-22 19:41:42.000000000 -0400
78025@@ -0,0 +1,51 @@
78026+/*
78027+ * gradm match for netfilter
78028