]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-2.2.2-2.6.39.1-201106211740.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-2.6.39.1-201106211740.patch
1 diff -urNp linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h
2 --- linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3 +++ linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
4 @@ -3,9 +3,9 @@
5
6 #include <linux/dma-attrs.h>
7
8 -extern struct dma_map_ops *dma_ops;
9 +extern const struct dma_map_ops *dma_ops;
10
11 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
12 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
13 {
14 return dma_ops;
15 }
16 diff -urNp linux-2.6.39.1/arch/alpha/include/asm/elf.h linux-2.6.39.1/arch/alpha/include/asm/elf.h
17 --- linux-2.6.39.1/arch/alpha/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
18 +++ linux-2.6.39.1/arch/alpha/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
19 @@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
20
21 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
22
23 +#ifdef CONFIG_PAX_ASLR
24 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
25 +
26 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
27 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
28 +#endif
29 +
30 /* $0 is set by ld.so to a pointer to a function which might be
31 registered using atexit. This provides a mean for the dynamic
32 linker to call DT_FINI functions for shared libraries that have
33 diff -urNp linux-2.6.39.1/arch/alpha/include/asm/pgtable.h linux-2.6.39.1/arch/alpha/include/asm/pgtable.h
34 --- linux-2.6.39.1/arch/alpha/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
35 +++ linux-2.6.39.1/arch/alpha/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
36 @@ -101,6 +101,17 @@ struct vm_area_struct;
37 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
38 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
39 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
40 +
41 +#ifdef CONFIG_PAX_PAGEEXEC
42 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
43 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
44 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
45 +#else
46 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
47 +# define PAGE_COPY_NOEXEC PAGE_COPY
48 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
49 +#endif
50 +
51 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
52
53 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
54 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_apecs.c linux-2.6.39.1/arch/alpha/kernel/core_apecs.c
55 --- linux-2.6.39.1/arch/alpha/kernel/core_apecs.c 2011-05-19 00:06:34.000000000 -0400
56 +++ linux-2.6.39.1/arch/alpha/kernel/core_apecs.c 2011-05-22 19:36:30.000000000 -0400
57 @@ -305,7 +305,7 @@ apecs_write_config(struct pci_bus *bus,
58 return PCIBIOS_SUCCESSFUL;
59 }
60
61 -struct pci_ops apecs_pci_ops =
62 +const struct pci_ops apecs_pci_ops =
63 {
64 .read = apecs_read_config,
65 .write = apecs_write_config,
66 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_cia.c linux-2.6.39.1/arch/alpha/kernel/core_cia.c
67 --- linux-2.6.39.1/arch/alpha/kernel/core_cia.c 2011-05-19 00:06:34.000000000 -0400
68 +++ linux-2.6.39.1/arch/alpha/kernel/core_cia.c 2011-05-22 19:36:30.000000000 -0400
69 @@ -239,7 +239,7 @@ cia_write_config(struct pci_bus *bus, un
70 return PCIBIOS_SUCCESSFUL;
71 }
72
73 -struct pci_ops cia_pci_ops =
74 +const struct pci_ops cia_pci_ops =
75 {
76 .read = cia_read_config,
77 .write = cia_write_config,
78 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_irongate.c linux-2.6.39.1/arch/alpha/kernel/core_irongate.c
79 --- linux-2.6.39.1/arch/alpha/kernel/core_irongate.c 2011-05-19 00:06:34.000000000 -0400
80 +++ linux-2.6.39.1/arch/alpha/kernel/core_irongate.c 2011-05-22 19:36:30.000000000 -0400
81 @@ -155,7 +155,7 @@ irongate_write_config(struct pci_bus *bu
82 return PCIBIOS_SUCCESSFUL;
83 }
84
85 -struct pci_ops irongate_pci_ops =
86 +const struct pci_ops irongate_pci_ops =
87 {
88 .read = irongate_read_config,
89 .write = irongate_write_config,
90 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_lca.c linux-2.6.39.1/arch/alpha/kernel/core_lca.c
91 --- linux-2.6.39.1/arch/alpha/kernel/core_lca.c 2011-05-19 00:06:34.000000000 -0400
92 +++ linux-2.6.39.1/arch/alpha/kernel/core_lca.c 2011-05-22 19:36:30.000000000 -0400
93 @@ -231,7 +231,7 @@ lca_write_config(struct pci_bus *bus, un
94 return PCIBIOS_SUCCESSFUL;
95 }
96
97 -struct pci_ops lca_pci_ops =
98 +const struct pci_ops lca_pci_ops =
99 {
100 .read = lca_read_config,
101 .write = lca_write_config,
102 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_marvel.c linux-2.6.39.1/arch/alpha/kernel/core_marvel.c
103 --- linux-2.6.39.1/arch/alpha/kernel/core_marvel.c 2011-05-19 00:06:34.000000000 -0400
104 +++ linux-2.6.39.1/arch/alpha/kernel/core_marvel.c 2011-05-22 19:36:30.000000000 -0400
105 @@ -588,7 +588,7 @@ marvel_write_config(struct pci_bus *bus,
106 return PCIBIOS_SUCCESSFUL;
107 }
108
109 -struct pci_ops marvel_pci_ops =
110 +const struct pci_ops marvel_pci_ops =
111 {
112 .read = marvel_read_config,
113 .write = marvel_write_config,
114 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c
115 --- linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c 2011-05-19 00:06:34.000000000 -0400
116 +++ linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c 2011-05-22 19:36:30.000000000 -0400
117 @@ -235,7 +235,7 @@ mcpcia_write_config(struct pci_bus *bus,
118 return PCIBIOS_SUCCESSFUL;
119 }
120
121 -struct pci_ops mcpcia_pci_ops =
122 +const struct pci_ops mcpcia_pci_ops =
123 {
124 .read = mcpcia_read_config,
125 .write = mcpcia_write_config,
126 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_polaris.c linux-2.6.39.1/arch/alpha/kernel/core_polaris.c
127 --- linux-2.6.39.1/arch/alpha/kernel/core_polaris.c 2011-05-19 00:06:34.000000000 -0400
128 +++ linux-2.6.39.1/arch/alpha/kernel/core_polaris.c 2011-05-22 19:36:30.000000000 -0400
129 @@ -136,7 +136,7 @@ polaris_write_config(struct pci_bus *bus
130 return PCIBIOS_SUCCESSFUL;
131 }
132
133 -struct pci_ops polaris_pci_ops =
134 +const struct pci_ops polaris_pci_ops =
135 {
136 .read = polaris_read_config,
137 .write = polaris_write_config,
138 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_t2.c linux-2.6.39.1/arch/alpha/kernel/core_t2.c
139 --- linux-2.6.39.1/arch/alpha/kernel/core_t2.c 2011-05-19 00:06:34.000000000 -0400
140 +++ linux-2.6.39.1/arch/alpha/kernel/core_t2.c 2011-05-22 19:36:30.000000000 -0400
141 @@ -314,7 +314,7 @@ t2_write_config(struct pci_bus *bus, uns
142 return PCIBIOS_SUCCESSFUL;
143 }
144
145 -struct pci_ops t2_pci_ops =
146 +const struct pci_ops t2_pci_ops =
147 {
148 .read = t2_read_config,
149 .write = t2_write_config,
150 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_titan.c linux-2.6.39.1/arch/alpha/kernel/core_titan.c
151 --- linux-2.6.39.1/arch/alpha/kernel/core_titan.c 2011-05-19 00:06:34.000000000 -0400
152 +++ linux-2.6.39.1/arch/alpha/kernel/core_titan.c 2011-05-22 19:36:30.000000000 -0400
153 @@ -191,7 +191,7 @@ titan_write_config(struct pci_bus *bus,
154 return PCIBIOS_SUCCESSFUL;
155 }
156
157 -struct pci_ops titan_pci_ops =
158 +const struct pci_ops titan_pci_ops =
159 {
160 .read = titan_read_config,
161 .write = titan_write_config,
162 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c
163 --- linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c 2011-05-19 00:06:34.000000000 -0400
164 +++ linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c 2011-05-22 19:36:30.000000000 -0400
165 @@ -166,7 +166,7 @@ tsunami_write_config(struct pci_bus *bus
166 return PCIBIOS_SUCCESSFUL;
167 }
168
169 -struct pci_ops tsunami_pci_ops =
170 +const struct pci_ops tsunami_pci_ops =
171 {
172 .read = tsunami_read_config,
173 .write = tsunami_write_config,
174 diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c
175 --- linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c 2011-05-19 00:06:34.000000000 -0400
176 +++ linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c 2011-05-22 19:36:30.000000000 -0400
177 @@ -431,7 +431,7 @@ wildfire_write_config(struct pci_bus *bu
178 return PCIBIOS_SUCCESSFUL;
179 }
180
181 -struct pci_ops wildfire_pci_ops =
182 +const struct pci_ops wildfire_pci_ops =
183 {
184 .read = wildfire_read_config,
185 .write = wildfire_write_config,
186 diff -urNp linux-2.6.39.1/arch/alpha/kernel/module.c linux-2.6.39.1/arch/alpha/kernel/module.c
187 --- linux-2.6.39.1/arch/alpha/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
188 +++ linux-2.6.39.1/arch/alpha/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
189 @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
190
191 /* The small sections were sorted to the end of the segment.
192 The following should definitely cover them. */
193 - gp = (u64)me->module_core + me->core_size - 0x8000;
194 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
195 got = sechdrs[me->arch.gotsecindex].sh_addr;
196
197 for (i = 0; i < n; i++) {
198 diff -urNp linux-2.6.39.1/arch/alpha/kernel/osf_sys.c linux-2.6.39.1/arch/alpha/kernel/osf_sys.c
199 --- linux-2.6.39.1/arch/alpha/kernel/osf_sys.c 2011-05-19 00:06:34.000000000 -0400
200 +++ linux-2.6.39.1/arch/alpha/kernel/osf_sys.c 2011-06-13 17:19:07.000000000 -0400
201 @@ -409,7 +409,7 @@ SYSCALL_DEFINE2(osf_getdomainname, char
202 return -EFAULT;
203
204 len = namelen;
205 - if (namelen > 32)
206 + if (len > 32)
207 len = 32;
208
209 down_read(&uts_sem);
210 @@ -594,7 +594,7 @@ SYSCALL_DEFINE3(osf_sysinfo, int, comman
211 down_read(&uts_sem);
212 res = sysinfo_table[offset];
213 len = strlen(res)+1;
214 - if (len > count)
215 + if ((unsigned long)len > (unsigned long)count)
216 len = count;
217 if (copy_to_user(buf, res, len))
218 err = -EFAULT;
219 @@ -649,7 +649,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned
220 return 1;
221
222 case GSI_GET_HWRPB:
223 - if (nbytes < sizeof(*hwrpb))
224 + if (nbytes > sizeof(*hwrpb))
225 return -EINVAL;
226 if (copy_to_user(buffer, hwrpb, nbytes) != 0)
227 return -EFAULT;
228 @@ -1008,6 +1008,7 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i
229 {
230 struct rusage r;
231 long ret, err;
232 + unsigned int status = 0;
233 mm_segment_t old_fs;
234
235 if (!ur)
236 @@ -1016,13 +1017,15 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i
237 old_fs = get_fs();
238
239 set_fs (KERNEL_DS);
240 - ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r);
241 + ret = sys_wait4(pid, (unsigned int __user *) &status, options,
242 + (struct rusage __user *) &r);
243 set_fs (old_fs);
244
245 if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
246 return -EFAULT;
247
248 err = 0;
249 + err |= put_user(status, ustatus);
250 err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
251 err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
252 err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
253 @@ -1142,7 +1145,7 @@ arch_get_unmapped_area_1(unsigned long a
254 /* At this point: (!vma || addr < vma->vm_end). */
255 if (limit - len < addr)
256 return -ENOMEM;
257 - if (!vma || addr + len <= vma->vm_start)
258 + if (check_heap_stack_gap(vma, addr, len))
259 return addr;
260 addr = vma->vm_end;
261 vma = vma->vm_next;
262 @@ -1178,6 +1181,10 @@ arch_get_unmapped_area(struct file *filp
263 merely specific addresses, but regions of memory -- perhaps
264 this feature should be incorporated into all ports? */
265
266 +#ifdef CONFIG_PAX_RANDMMAP
267 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
268 +#endif
269 +
270 if (addr) {
271 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
272 if (addr != (unsigned long) -ENOMEM)
273 @@ -1185,8 +1192,8 @@ arch_get_unmapped_area(struct file *filp
274 }
275
276 /* Next, try allocating at TASK_UNMAPPED_BASE. */
277 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
278 - len, limit);
279 + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
280 +
281 if (addr != (unsigned long) -ENOMEM)
282 return addr;
283
284 diff -urNp linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c
285 --- linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c 2011-05-19 00:06:34.000000000 -0400
286 +++ linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c 2011-05-22 19:36:30.000000000 -0400
287 @@ -950,7 +950,7 @@ static int alpha_pci_set_mask(struct dev
288 return 0;
289 }
290
291 -struct dma_map_ops alpha_pci_ops = {
292 +const struct dma_map_ops alpha_pci_ops = {
293 .alloc_coherent = alpha_pci_alloc_coherent,
294 .free_coherent = alpha_pci_free_coherent,
295 .map_page = alpha_pci_map_page,
296 @@ -962,5 +962,5 @@ struct dma_map_ops alpha_pci_ops = {
297 .set_dma_mask = alpha_pci_set_mask,
298 };
299
300 -struct dma_map_ops *dma_ops = &alpha_pci_ops;
301 +const struct dma_map_ops *dma_ops = &alpha_pci_ops;
302 EXPORT_SYMBOL(dma_ops);
303 diff -urNp linux-2.6.39.1/arch/alpha/kernel/pci-noop.c linux-2.6.39.1/arch/alpha/kernel/pci-noop.c
304 --- linux-2.6.39.1/arch/alpha/kernel/pci-noop.c 2011-05-19 00:06:34.000000000 -0400
305 +++ linux-2.6.39.1/arch/alpha/kernel/pci-noop.c 2011-05-22 19:36:30.000000000 -0400
306 @@ -173,7 +173,7 @@ static int alpha_noop_set_mask(struct de
307 return 0;
308 }
309
310 -struct dma_map_ops alpha_noop_ops = {
311 +const struct dma_map_ops alpha_noop_ops = {
312 .alloc_coherent = alpha_noop_alloc_coherent,
313 .free_coherent = alpha_noop_free_coherent,
314 .map_page = alpha_noop_map_page,
315 @@ -183,7 +183,7 @@ struct dma_map_ops alpha_noop_ops = {
316 .set_dma_mask = alpha_noop_set_mask,
317 };
318
319 -struct dma_map_ops *dma_ops = &alpha_noop_ops;
320 +const struct dma_map_ops *dma_ops = &alpha_noop_ops;
321 EXPORT_SYMBOL(dma_ops);
322
323 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
324 diff -urNp linux-2.6.39.1/arch/alpha/kernel/proto.h linux-2.6.39.1/arch/alpha/kernel/proto.h
325 --- linux-2.6.39.1/arch/alpha/kernel/proto.h 2011-05-19 00:06:34.000000000 -0400
326 +++ linux-2.6.39.1/arch/alpha/kernel/proto.h 2011-05-22 19:36:30.000000000 -0400
327 @@ -17,14 +17,14 @@ struct pci_dev;
328 struct pci_controller;
329
330 /* core_apecs.c */
331 -extern struct pci_ops apecs_pci_ops;
332 +extern const struct pci_ops apecs_pci_ops;
333 extern void apecs_init_arch(void);
334 extern void apecs_pci_clr_err(void);
335 extern void apecs_machine_check(unsigned long vector, unsigned long la_ptr);
336 extern void apecs_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
337
338 /* core_cia.c */
339 -extern struct pci_ops cia_pci_ops;
340 +extern const struct pci_ops cia_pci_ops;
341 extern void cia_init_pci(void);
342 extern void cia_init_arch(void);
343 extern void pyxis_init_arch(void);
344 @@ -33,19 +33,19 @@ extern void cia_machine_check(unsigned l
345 extern void cia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
346
347 /* core_irongate.c */
348 -extern struct pci_ops irongate_pci_ops;
349 +extern const struct pci_ops irongate_pci_ops;
350 extern int irongate_pci_clr_err(void);
351 extern void irongate_init_arch(void);
352 #define irongate_pci_tbi ((void *)0)
353
354 /* core_lca.c */
355 -extern struct pci_ops lca_pci_ops;
356 +extern const struct pci_ops lca_pci_ops;
357 extern void lca_init_arch(void);
358 extern void lca_machine_check(unsigned long vector, unsigned long la_ptr);
359 extern void lca_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
360
361 /* core_marvel.c */
362 -extern struct pci_ops marvel_pci_ops;
363 +extern const struct pci_ops marvel_pci_ops;
364 extern void marvel_init_arch(void);
365 extern void marvel_kill_arch(int);
366 extern void marvel_machine_check(unsigned long, unsigned long);
367 @@ -60,14 +60,14 @@ struct io7 *marvel_next_io7(struct io7 *
368 void io7_clear_errors(struct io7 *io7);
369
370 /* core_mcpcia.c */
371 -extern struct pci_ops mcpcia_pci_ops;
372 +extern const struct pci_ops mcpcia_pci_ops;
373 extern void mcpcia_init_arch(void);
374 extern void mcpcia_init_hoses(void);
375 extern void mcpcia_machine_check(unsigned long vector, unsigned long la_ptr);
376 extern void mcpcia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
377
378 /* core_polaris.c */
379 -extern struct pci_ops polaris_pci_ops;
380 +extern const struct pci_ops polaris_pci_ops;
381 extern int polaris_read_config_dword(struct pci_dev *, int, u32 *);
382 extern int polaris_write_config_dword(struct pci_dev *, int, u32);
383 extern void polaris_init_arch(void);
384 @@ -75,14 +75,14 @@ extern void polaris_machine_check(unsign
385 #define polaris_pci_tbi ((void *)0)
386
387 /* core_t2.c */
388 -extern struct pci_ops t2_pci_ops;
389 +extern const struct pci_ops t2_pci_ops;
390 extern void t2_init_arch(void);
391 extern void t2_kill_arch(int);
392 extern void t2_machine_check(unsigned long vector, unsigned long la_ptr);
393 extern void t2_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
394
395 /* core_titan.c */
396 -extern struct pci_ops titan_pci_ops;
397 +extern const struct pci_ops titan_pci_ops;
398 extern void titan_init_arch(void);
399 extern void titan_kill_arch(int);
400 extern void titan_machine_check(unsigned long, unsigned long);
401 @@ -90,14 +90,14 @@ extern void titan_pci_tbi(struct pci_con
402 extern struct _alpha_agp_info *titan_agp_info(void);
403
404 /* core_tsunami.c */
405 -extern struct pci_ops tsunami_pci_ops;
406 +extern const struct pci_ops tsunami_pci_ops;
407 extern void tsunami_init_arch(void);
408 extern void tsunami_kill_arch(int);
409 extern void tsunami_machine_check(unsigned long vector, unsigned long la_ptr);
410 extern void tsunami_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
411
412 /* core_wildfire.c */
413 -extern struct pci_ops wildfire_pci_ops;
414 +extern const struct pci_ops wildfire_pci_ops;
415 extern void wildfire_init_arch(void);
416 extern void wildfire_kill_arch(int);
417 extern void wildfire_machine_check(unsigned long vector, unsigned long la_ptr);
418 diff -urNp linux-2.6.39.1/arch/alpha/mm/fault.c linux-2.6.39.1/arch/alpha/mm/fault.c
419 --- linux-2.6.39.1/arch/alpha/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
420 +++ linux-2.6.39.1/arch/alpha/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
421 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
422 __reload_thread(pcb);
423 }
424
425 +#ifdef CONFIG_PAX_PAGEEXEC
426 +/*
427 + * PaX: decide what to do with offenders (regs->pc = fault address)
428 + *
429 + * returns 1 when task should be killed
430 + * 2 when patched PLT trampoline was detected
431 + * 3 when unpatched PLT trampoline was detected
432 + */
433 +static int pax_handle_fetch_fault(struct pt_regs *regs)
434 +{
435 +
436 +#ifdef CONFIG_PAX_EMUPLT
437 + int err;
438 +
439 + do { /* PaX: patched PLT emulation #1 */
440 + unsigned int ldah, ldq, jmp;
441 +
442 + err = get_user(ldah, (unsigned int *)regs->pc);
443 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
444 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
445 +
446 + if (err)
447 + break;
448 +
449 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
450 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
451 + jmp == 0x6BFB0000U)
452 + {
453 + unsigned long r27, addr;
454 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
455 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
456 +
457 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
458 + err = get_user(r27, (unsigned long *)addr);
459 + if (err)
460 + break;
461 +
462 + regs->r27 = r27;
463 + regs->pc = r27;
464 + return 2;
465 + }
466 + } while (0);
467 +
468 + do { /* PaX: patched PLT emulation #2 */
469 + unsigned int ldah, lda, br;
470 +
471 + err = get_user(ldah, (unsigned int *)regs->pc);
472 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
473 + err |= get_user(br, (unsigned int *)(regs->pc+8));
474 +
475 + if (err)
476 + break;
477 +
478 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
479 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
480 + (br & 0xFFE00000U) == 0xC3E00000U)
481 + {
482 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
483 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
484 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
485 +
486 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
487 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
488 + return 2;
489 + }
490 + } while (0);
491 +
492 + do { /* PaX: unpatched PLT emulation */
493 + unsigned int br;
494 +
495 + err = get_user(br, (unsigned int *)regs->pc);
496 +
497 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
498 + unsigned int br2, ldq, nop, jmp;
499 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
500 +
501 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
502 + err = get_user(br2, (unsigned int *)addr);
503 + err |= get_user(ldq, (unsigned int *)(addr+4));
504 + err |= get_user(nop, (unsigned int *)(addr+8));
505 + err |= get_user(jmp, (unsigned int *)(addr+12));
506 + err |= get_user(resolver, (unsigned long *)(addr+16));
507 +
508 + if (err)
509 + break;
510 +
511 + if (br2 == 0xC3600000U &&
512 + ldq == 0xA77B000CU &&
513 + nop == 0x47FF041FU &&
514 + jmp == 0x6B7B0000U)
515 + {
516 + regs->r28 = regs->pc+4;
517 + regs->r27 = addr+16;
518 + regs->pc = resolver;
519 + return 3;
520 + }
521 + }
522 + } while (0);
523 +#endif
524 +
525 + return 1;
526 +}
527 +
528 +void pax_report_insns(void *pc, void *sp)
529 +{
530 + unsigned long i;
531 +
532 + printk(KERN_ERR "PAX: bytes at PC: ");
533 + for (i = 0; i < 5; i++) {
534 + unsigned int c;
535 + if (get_user(c, (unsigned int *)pc+i))
536 + printk(KERN_CONT "???????? ");
537 + else
538 + printk(KERN_CONT "%08x ", c);
539 + }
540 + printk("\n");
541 +}
542 +#endif
543
544 /*
545 * This routine handles page faults. It determines the address,
546 @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
547 good_area:
548 si_code = SEGV_ACCERR;
549 if (cause < 0) {
550 - if (!(vma->vm_flags & VM_EXEC))
551 + if (!(vma->vm_flags & VM_EXEC)) {
552 +
553 +#ifdef CONFIG_PAX_PAGEEXEC
554 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
555 + goto bad_area;
556 +
557 + up_read(&mm->mmap_sem);
558 + switch (pax_handle_fetch_fault(regs)) {
559 +
560 +#ifdef CONFIG_PAX_EMUPLT
561 + case 2:
562 + case 3:
563 + return;
564 +#endif
565 +
566 + }
567 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
568 + do_group_exit(SIGKILL);
569 +#else
570 goto bad_area;
571 +#endif
572 +
573 + }
574 } else if (!cause) {
575 /* Allow reads even for write-only mappings */
576 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
577 diff -urNp linux-2.6.39.1/arch/arm/common/it8152.c linux-2.6.39.1/arch/arm/common/it8152.c
578 --- linux-2.6.39.1/arch/arm/common/it8152.c 2011-05-19 00:06:34.000000000 -0400
579 +++ linux-2.6.39.1/arch/arm/common/it8152.c 2011-05-22 19:36:30.000000000 -0400
580 @@ -221,7 +221,7 @@ static int it8152_pci_write_config(struc
581 return PCIBIOS_SUCCESSFUL;
582 }
583
584 -static struct pci_ops it8152_ops = {
585 +static const struct pci_ops it8152_ops = {
586 .read = it8152_pci_read_config,
587 .write = it8152_pci_write_config,
588 };
589 diff -urNp linux-2.6.39.1/arch/arm/common/via82c505.c linux-2.6.39.1/arch/arm/common/via82c505.c
590 --- linux-2.6.39.1/arch/arm/common/via82c505.c 2011-05-19 00:06:34.000000000 -0400
591 +++ linux-2.6.39.1/arch/arm/common/via82c505.c 2011-05-22 19:36:30.000000000 -0400
592 @@ -52,7 +52,7 @@ via82c505_write_config(struct pci_bus *b
593 return PCIBIOS_SUCCESSFUL;
594 }
595
596 -static struct pci_ops via82c505_ops = {
597 +static const struct pci_ops via82c505_ops = {
598 .read = via82c505_read_config,
599 .write = via82c505_write_config,
600 };
601 diff -urNp linux-2.6.39.1/arch/arm/include/asm/cacheflush.h linux-2.6.39.1/arch/arm/include/asm/cacheflush.h
602 --- linux-2.6.39.1/arch/arm/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
603 +++ linux-2.6.39.1/arch/arm/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
604 @@ -115,7 +115,7 @@ struct cpu_cache_fns {
605 */
606 #ifdef MULTI_CACHE
607
608 -extern struct cpu_cache_fns cpu_cache;
609 +extern const struct cpu_cache_fns cpu_cache;
610
611 #define __cpuc_flush_icache_all cpu_cache.flush_icache_all
612 #define __cpuc_flush_kern_all cpu_cache.flush_kern_all
613 diff -urNp linux-2.6.39.1/arch/arm/include/asm/elf.h linux-2.6.39.1/arch/arm/include/asm/elf.h
614 --- linux-2.6.39.1/arch/arm/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
615 +++ linux-2.6.39.1/arch/arm/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
616 @@ -115,7 +115,14 @@ int dump_task_regs(struct task_struct *t
617 the loader. We need to make sure that it is out of the way of the program
618 that it will "exec", and that there is sufficient room for the brk. */
619
620 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
621 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
622 +
623 +#ifdef CONFIG_PAX_ASLR
624 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
625 +
626 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
627 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
628 +#endif
629
630 /* When the program starts, a1 contains a pointer to a function to be
631 registered with atexit, as per the SVR4 ABI. A value of 0 means we
632 @@ -125,10 +132,6 @@ int dump_task_regs(struct task_struct *t
633 extern void elf_set_personality(const struct elf32_hdr *);
634 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
635
636 -struct mm_struct;
637 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
638 -#define arch_randomize_brk arch_randomize_brk
639 -
640 extern int vectors_user_mapping(void);
641 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
642 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
643 diff -urNp linux-2.6.39.1/arch/arm/include/asm/kmap_types.h linux-2.6.39.1/arch/arm/include/asm/kmap_types.h
644 --- linux-2.6.39.1/arch/arm/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
645 +++ linux-2.6.39.1/arch/arm/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
646 @@ -21,6 +21,7 @@ enum km_type {
647 KM_L1_CACHE,
648 KM_L2_CACHE,
649 KM_KDB,
650 + KM_CLEARPAGE,
651 KM_TYPE_NR
652 };
653
654 diff -urNp linux-2.6.39.1/arch/arm/include/asm/outercache.h linux-2.6.39.1/arch/arm/include/asm/outercache.h
655 --- linux-2.6.39.1/arch/arm/include/asm/outercache.h 2011-05-19 00:06:34.000000000 -0400
656 +++ linux-2.6.39.1/arch/arm/include/asm/outercache.h 2011-05-22 19:36:30.000000000 -0400
657 @@ -38,7 +38,7 @@ struct outer_cache_fns {
658
659 #ifdef CONFIG_OUTER_CACHE
660
661 -extern struct outer_cache_fns outer_cache;
662 +extern const struct outer_cache_fns outer_cache;
663
664 static inline void outer_inv_range(phys_addr_t start, phys_addr_t end)
665 {
666 diff -urNp linux-2.6.39.1/arch/arm/include/asm/page.h linux-2.6.39.1/arch/arm/include/asm/page.h
667 --- linux-2.6.39.1/arch/arm/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
668 +++ linux-2.6.39.1/arch/arm/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
669 @@ -126,7 +126,7 @@ struct cpu_user_fns {
670 };
671
672 #ifdef MULTI_USER
673 -extern struct cpu_user_fns cpu_user;
674 +extern const struct cpu_user_fns cpu_user;
675
676 #define __cpu_clear_user_highpage cpu_user.cpu_clear_user_highpage
677 #define __cpu_copy_user_highpage cpu_user.cpu_copy_user_highpage
678 diff -urNp linux-2.6.39.1/arch/arm/include/asm/uaccess.h linux-2.6.39.1/arch/arm/include/asm/uaccess.h
679 --- linux-2.6.39.1/arch/arm/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
680 +++ linux-2.6.39.1/arch/arm/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
681 @@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
682
683 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
684 {
685 + if ((long)n < 0)
686 + return n;
687 +
688 if (access_ok(VERIFY_READ, from, n))
689 n = __copy_from_user(to, from, n);
690 else /* security hole - plug it */
691 @@ -412,6 +415,9 @@ static inline unsigned long __must_check
692
693 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
694 {
695 + if ((long)n < 0)
696 + return n;
697 +
698 if (access_ok(VERIFY_WRITE, to, n))
699 n = __copy_to_user(to, from, n);
700 return n;
701 diff -urNp linux-2.6.39.1/arch/arm/kernel/kgdb.c linux-2.6.39.1/arch/arm/kernel/kgdb.c
702 --- linux-2.6.39.1/arch/arm/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
703 +++ linux-2.6.39.1/arch/arm/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
704 @@ -246,7 +246,7 @@ void kgdb_arch_exit(void)
705 * and we handle the normal undef case within the do_undefinstr
706 * handler.
707 */
708 -struct kgdb_arch arch_kgdb_ops = {
709 +const struct kgdb_arch arch_kgdb_ops = {
710 #ifndef __ARMEB__
711 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
712 #else /* ! __ARMEB__ */
713 diff -urNp linux-2.6.39.1/arch/arm/kernel/process.c linux-2.6.39.1/arch/arm/kernel/process.c
714 --- linux-2.6.39.1/arch/arm/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
715 +++ linux-2.6.39.1/arch/arm/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
716 @@ -28,7 +28,6 @@
717 #include <linux/tick.h>
718 #include <linux/utsname.h>
719 #include <linux/uaccess.h>
720 -#include <linux/random.h>
721 #include <linux/hw_breakpoint.h>
722
723 #include <asm/cacheflush.h>
724 @@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru
725 return 0;
726 }
727
728 -unsigned long arch_randomize_brk(struct mm_struct *mm)
729 -{
730 - unsigned long range_end = mm->brk + 0x02000000;
731 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
732 -}
733 -
734 #ifdef CONFIG_MMU
735 /*
736 * The vectors page is always readable from user space for the
737 diff -urNp linux-2.6.39.1/arch/arm/kernel/traps.c linux-2.6.39.1/arch/arm/kernel/traps.c
738 --- linux-2.6.39.1/arch/arm/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
739 +++ linux-2.6.39.1/arch/arm/kernel/traps.c 2011-06-13 21:30:34.000000000 -0400
740 @@ -258,6 +258,8 @@ static int __die(const char *str, int er
741
742 static DEFINE_SPINLOCK(die_lock);
743
744 +extern void gr_handle_kernel_exploit(void);
745 +
746 /*
747 * This function is protected against re-entrancy.
748 */
749 @@ -285,6 +287,9 @@ void die(const char *str, struct pt_regs
750 panic("Fatal exception in interrupt");
751 if (panic_on_oops)
752 panic("Fatal exception");
753 +
754 + gr_handle_kernel_exploit();
755 +
756 if (ret != NOTIFY_STOP)
757 do_exit(SIGSEGV);
758 }
759 diff -urNp linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c
760 --- linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c 2011-05-19 00:06:34.000000000 -0400
761 +++ linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c 2011-05-22 19:36:30.000000000 -0400
762 @@ -162,7 +162,7 @@ static int cns3xxx_pci_setup(int nr, str
763 return 1;
764 }
765
766 -static struct pci_ops cns3xxx_pcie_ops = {
767 +static const struct pci_ops cns3xxx_pcie_ops = {
768 .read = cns3xxx_pci_read_config,
769 .write = cns3xxx_pci_write_config,
770 };
771 diff -urNp linux-2.6.39.1/arch/arm/mach-dove/pcie.c linux-2.6.39.1/arch/arm/mach-dove/pcie.c
772 --- linux-2.6.39.1/arch/arm/mach-dove/pcie.c 2011-05-19 00:06:34.000000000 -0400
773 +++ linux-2.6.39.1/arch/arm/mach-dove/pcie.c 2011-05-22 19:36:30.000000000 -0400
774 @@ -155,7 +155,7 @@ static int pcie_wr_conf(struct pci_bus *
775 return ret;
776 }
777
778 -static struct pci_ops pcie_ops = {
779 +static const struct pci_ops pcie_ops = {
780 .read = pcie_rd_conf,
781 .write = pcie_wr_conf,
782 };
783 diff -urNp linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c
784 --- linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c 2011-05-19 00:06:34.000000000 -0400
785 +++ linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c 2011-05-22 19:36:30.000000000 -0400
786 @@ -129,7 +129,7 @@ dc21285_write_config(struct pci_bus *bus
787 return PCIBIOS_SUCCESSFUL;
788 }
789
790 -static struct pci_ops dc21285_ops = {
791 +static const struct pci_ops dc21285_ops = {
792 .read = dc21285_read_config,
793 .write = dc21285_write_config,
794 };
795 diff -urNp linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c
796 --- linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c 2011-05-19 00:06:34.000000000 -0400
797 +++ linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c 2011-05-22 19:36:30.000000000 -0400
798 @@ -340,7 +340,7 @@ static int v3_write_config(struct pci_bu
799 return PCIBIOS_SUCCESSFUL;
800 }
801
802 -static struct pci_ops pci_v3_ops = {
803 +static const struct pci_ops pci_v3_ops = {
804 .read = v3_read_config,
805 .write = v3_write_config,
806 };
807 diff -urNp linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c
808 --- linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c 2011-05-19 00:06:34.000000000 -0400
809 +++ linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c 2011-05-22 19:36:30.000000000 -0400
810 @@ -324,7 +324,7 @@ iop13xx_atux_write_config(struct pci_bus
811 return PCIBIOS_SUCCESSFUL;
812 }
813
814 -static struct pci_ops iop13xx_atux_ops = {
815 +static const struct pci_ops iop13xx_atux_ops = {
816 .read = iop13xx_atux_read_config,
817 .write = iop13xx_atux_write_config,
818 };
819 @@ -471,7 +471,7 @@ iop13xx_atue_write_config(struct pci_bus
820 return PCIBIOS_SUCCESSFUL;
821 }
822
823 -static struct pci_ops iop13xx_atue_ops = {
824 +static const struct pci_ops iop13xx_atue_ops = {
825 .read = iop13xx_atue_read_config,
826 .write = iop13xx_atue_write_config,
827 };
828 diff -urNp linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c
829 --- linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c 2011-05-19 00:06:34.000000000 -0400
830 +++ linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c 2011-05-22 19:36:30.000000000 -0400
831 @@ -137,7 +137,7 @@ static int enp2611_pci_write_config(stru
832 return PCIBIOS_DEVICE_NOT_FOUND;
833 }
834
835 -static struct pci_ops enp2611_pci_ops = {
836 +static const struct pci_ops enp2611_pci_ops = {
837 .read = enp2611_pci_read_config,
838 .write = enp2611_pci_write_config
839 };
840 diff -urNp linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c
841 --- linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c 2011-05-19 00:06:34.000000000 -0400
842 +++ linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c 2011-05-22 19:36:30.000000000 -0400
843 @@ -125,7 +125,7 @@ int ixp2000_pci_write_config(struct pci_
844 }
845
846
847 -static struct pci_ops ixp2000_pci_ops = {
848 +static const struct pci_ops ixp2000_pci_ops = {
849 .read = ixp2000_pci_read_config,
850 .write = ixp2000_pci_write_config
851 };
852 diff -urNp linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c
853 --- linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c 2011-05-19 00:06:34.000000000 -0400
854 +++ linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c 2011-05-22 19:36:30.000000000 -0400
855 @@ -136,7 +136,7 @@ static int ixp23xx_pci_write_config(stru
856 return PCIBIOS_SUCCESSFUL;
857 }
858
859 -struct pci_ops ixp23xx_pci_ops = {
860 +const struct pci_ops ixp23xx_pci_ops = {
861 .read = ixp23xx_pci_read_config,
862 .write = ixp23xx_pci_write_config,
863 };
864 diff -urNp linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c
865 --- linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c 2011-05-19 00:06:34.000000000 -0400
866 +++ linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c 2011-05-22 19:36:30.000000000 -0400
867 @@ -283,7 +283,7 @@ static int ixp4xx_pci_write_config(struc
868 return PCIBIOS_SUCCESSFUL;
869 }
870
871 -struct pci_ops ixp4xx_ops = {
872 +const struct pci_ops ixp4xx_ops = {
873 .read = ixp4xx_pci_read_config,
874 .write = ixp4xx_pci_write_config,
875 };
876 diff -urNp linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c
877 --- linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c 2011-05-19 00:06:34.000000000 -0400
878 +++ linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c 2011-05-22 19:36:30.000000000 -0400
879 @@ -111,7 +111,7 @@ static int pcie_wr_conf(struct pci_bus *
880 return ret;
881 }
882
883 -static struct pci_ops pcie_ops = {
884 +static const struct pci_ops pcie_ops = {
885 .read = pcie_rd_conf,
886 .write = pcie_wr_conf,
887 };
888 diff -urNp linux-2.6.39.1/arch/arm/mach-ks8695/pci.c linux-2.6.39.1/arch/arm/mach-ks8695/pci.c
889 --- linux-2.6.39.1/arch/arm/mach-ks8695/pci.c 2011-05-19 00:06:34.000000000 -0400
890 +++ linux-2.6.39.1/arch/arm/mach-ks8695/pci.c 2011-05-22 19:36:30.000000000 -0400
891 @@ -136,7 +136,7 @@ static void ks8695_local_writeconfig(int
892 __raw_writel(value, KS8695_PCI_VA + KS8695_PBCD);
893 }
894
895 -static struct pci_ops ks8695_pci_ops = {
896 +static const struct pci_ops ks8695_pci_ops = {
897 .read = ks8695_pci_readconfig,
898 .write = ks8695_pci_writeconfig,
899 };
900 diff -urNp linux-2.6.39.1/arch/arm/mach-mmp/clock.c linux-2.6.39.1/arch/arm/mach-mmp/clock.c
901 --- linux-2.6.39.1/arch/arm/mach-mmp/clock.c 2011-05-19 00:06:34.000000000 -0400
902 +++ linux-2.6.39.1/arch/arm/mach-mmp/clock.c 2011-05-22 19:36:30.000000000 -0400
903 @@ -29,7 +29,7 @@ static void apbc_clk_disable(struct clk
904 __raw_writel(0, clk->clk_rst);
905 }
906
907 -struct clkops apbc_clk_ops = {
908 +const struct clkops apbc_clk_ops = {
909 .enable = apbc_clk_enable,
910 .disable = apbc_clk_disable,
911 };
912 @@ -44,7 +44,7 @@ static void apmu_clk_disable(struct clk
913 __raw_writel(0, clk->clk_rst);
914 }
915
916 -struct clkops apmu_clk_ops = {
917 +const struct clkops apmu_clk_ops = {
918 .enable = apmu_clk_enable,
919 .disable = apmu_clk_disable,
920 };
921 diff -urNp linux-2.6.39.1/arch/arm/mach-msm/iommu.c linux-2.6.39.1/arch/arm/mach-msm/iommu.c
922 --- linux-2.6.39.1/arch/arm/mach-msm/iommu.c 2011-05-19 00:06:34.000000000 -0400
923 +++ linux-2.6.39.1/arch/arm/mach-msm/iommu.c 2011-05-22 19:36:30.000000000 -0400
924 @@ -669,7 +669,7 @@ fail:
925 return 0;
926 }
927
928 -static struct iommu_ops msm_iommu_ops = {
929 +static const struct iommu_ops msm_iommu_ops = {
930 .domain_init = msm_iommu_domain_init,
931 .domain_destroy = msm_iommu_domain_destroy,
932 .attach_dev = msm_iommu_attach_dev,
933 diff -urNp linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c
934 --- linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c 2011-05-19 00:06:34.000000000 -0400
935 +++ linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c 2011-05-22 19:36:30.000000000 -0400
936 @@ -48,6 +48,7 @@ static ssize_t last_radio_log_read(struc
937 }
938
939 static struct file_operations last_radio_log_fops = {
940 + /* cannot be const, see msm_init_last_radio_log */
941 .read = last_radio_log_read,
942 .llseek = default_llseek,
943 };
944 diff -urNp linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c
945 --- linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c 2011-05-19 00:06:34.000000000 -0400
946 +++ linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c 2011-05-22 19:36:30.000000000 -0400
947 @@ -222,7 +222,7 @@ static int pcie_wr_conf(struct pci_bus *
948 return ret;
949 }
950
951 -static struct pci_ops pcie_ops = {
952 +static const struct pci_ops pcie_ops = {
953 .read = pcie_rd_conf,
954 .write = pcie_wr_conf,
955 };
956 diff -urNp linux-2.6.39.1/arch/arm/mach-orion5x/pci.c linux-2.6.39.1/arch/arm/mach-orion5x/pci.c
957 --- linux-2.6.39.1/arch/arm/mach-orion5x/pci.c 2011-05-19 00:06:34.000000000 -0400
958 +++ linux-2.6.39.1/arch/arm/mach-orion5x/pci.c 2011-05-22 19:36:30.000000000 -0400
959 @@ -130,7 +130,7 @@ static int pcie_wr_conf(struct pci_bus *
960 return ret;
961 }
962
963 -static struct pci_ops pcie_ops = {
964 +static const struct pci_ops pcie_ops = {
965 .read = pcie_rd_conf,
966 .write = pcie_wr_conf,
967 };
968 @@ -368,7 +368,7 @@ static int orion5x_pci_wr_conf(struct pc
969 PCI_FUNC(devfn), where, size, val);
970 }
971
972 -static struct pci_ops pci_ops = {
973 +static const struct pci_ops pci_ops = {
974 .read = orion5x_pci_rd_conf,
975 .write = orion5x_pci_wr_conf,
976 };
977 diff -urNp linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c
978 --- linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-19 00:06:34.000000000 -0400
979 +++ linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-22 19:36:30.000000000 -0400
980 @@ -117,7 +117,7 @@ static int nanoengine_write_config(struc
981 return PCIBIOS_SUCCESSFUL;
982 }
983
984 -static struct pci_ops pci_nano_ops = {
985 +static const struct pci_ops pci_nano_ops = {
986 .read = nanoengine_read_config,
987 .write = nanoengine_write_config,
988 };
989 diff -urNp linux-2.6.39.1/arch/arm/mach-tegra/pcie.c linux-2.6.39.1/arch/arm/mach-tegra/pcie.c
990 --- linux-2.6.39.1/arch/arm/mach-tegra/pcie.c 2011-05-19 00:06:34.000000000 -0400
991 +++ linux-2.6.39.1/arch/arm/mach-tegra/pcie.c 2011-05-22 19:36:30.000000000 -0400
992 @@ -336,7 +336,7 @@ static int tegra_pcie_write_conf(struct
993 return PCIBIOS_SUCCESSFUL;
994 }
995
996 -static struct pci_ops tegra_pcie_ops = {
997 +static const struct pci_ops tegra_pcie_ops = {
998 .read = tegra_pcie_read_conf,
999 .write = tegra_pcie_write_conf,
1000 };
1001 diff -urNp linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c
1002 --- linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c 2011-05-19 00:06:34.000000000 -0400
1003 +++ linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c 2011-05-22 19:41:32.000000000 -0400
1004 @@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
1005 return sprintf(buf, "0x%X\n", mbox_value);
1006 }
1007
1008 -static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
1009 +static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
1010
1011 static int mbox_show(struct seq_file *s, void *data)
1012 {
1013 diff -urNp linux-2.6.39.1/arch/arm/mach-versatile/pci.c linux-2.6.39.1/arch/arm/mach-versatile/pci.c
1014 --- linux-2.6.39.1/arch/arm/mach-versatile/pci.c 2011-05-19 00:06:34.000000000 -0400
1015 +++ linux-2.6.39.1/arch/arm/mach-versatile/pci.c 2011-05-22 19:36:30.000000000 -0400
1016 @@ -165,7 +165,7 @@ static int versatile_write_config(struct
1017 return PCIBIOS_SUCCESSFUL;
1018 }
1019
1020 -static struct pci_ops pci_versatile_ops = {
1021 +static const struct pci_ops pci_versatile_ops = {
1022 .read = versatile_read_config,
1023 .write = versatile_write_config,
1024 };
1025 diff -urNp linux-2.6.39.1/arch/arm/mm/fault.c linux-2.6.39.1/arch/arm/mm/fault.c
1026 --- linux-2.6.39.1/arch/arm/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1027 +++ linux-2.6.39.1/arch/arm/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1028 @@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk,
1029 }
1030 #endif
1031
1032 +#ifdef CONFIG_PAX_PAGEEXEC
1033 + if (fsr & FSR_LNX_PF) {
1034 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
1035 + do_group_exit(SIGKILL);
1036 + }
1037 +#endif
1038 +
1039 tsk->thread.address = addr;
1040 tsk->thread.error_code = fsr;
1041 tsk->thread.trap_no = 14;
1042 @@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign
1043 }
1044 #endif /* CONFIG_MMU */
1045
1046 +#ifdef CONFIG_PAX_PAGEEXEC
1047 +void pax_report_insns(void *pc, void *sp)
1048 +{
1049 + long i;
1050 +
1051 + printk(KERN_ERR "PAX: bytes at PC: ");
1052 + for (i = 0; i < 20; i++) {
1053 + unsigned char c;
1054 + if (get_user(c, (__force unsigned char __user *)pc+i))
1055 + printk(KERN_CONT "?? ");
1056 + else
1057 + printk(KERN_CONT "%02x ", c);
1058 + }
1059 + printk("\n");
1060 +
1061 + printk(KERN_ERR "PAX: bytes at SP-4: ");
1062 + for (i = -1; i < 20; i++) {
1063 + unsigned long c;
1064 + if (get_user(c, (__force unsigned long __user *)sp+i))
1065 + printk(KERN_CONT "???????? ");
1066 + else
1067 + printk(KERN_CONT "%08lx ", c);
1068 + }
1069 + printk("\n");
1070 +}
1071 +#endif
1072 +
1073 /*
1074 * First Level Translation Fault Handler
1075 *
1076 diff -urNp linux-2.6.39.1/arch/arm/mm/mmap.c linux-2.6.39.1/arch/arm/mm/mmap.c
1077 --- linux-2.6.39.1/arch/arm/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
1078 +++ linux-2.6.39.1/arch/arm/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
1079 @@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp
1080 if (len > TASK_SIZE)
1081 return -ENOMEM;
1082
1083 +#ifdef CONFIG_PAX_RANDMMAP
1084 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1085 +#endif
1086 +
1087 if (addr) {
1088 if (do_align)
1089 addr = COLOUR_ALIGN(addr, pgoff);
1090 @@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp
1091 addr = PAGE_ALIGN(addr);
1092
1093 vma = find_vma(mm, addr);
1094 - if (TASK_SIZE - len >= addr &&
1095 - (!vma || addr + len <= vma->vm_start))
1096 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1097 return addr;
1098 }
1099 if (len > mm->cached_hole_size) {
1100 - start_addr = addr = mm->free_area_cache;
1101 + start_addr = addr = mm->free_area_cache;
1102 } else {
1103 - start_addr = addr = TASK_UNMAPPED_BASE;
1104 - mm->cached_hole_size = 0;
1105 + start_addr = addr = mm->mmap_base;
1106 + mm->cached_hole_size = 0;
1107 }
1108 /* 8 bits of randomness in 20 address space bits */
1109 if ((current->flags & PF_RANDOMIZE) &&
1110 @@ -100,14 +103,14 @@ full_search:
1111 * Start a new search - just in case we missed
1112 * some holes.
1113 */
1114 - if (start_addr != TASK_UNMAPPED_BASE) {
1115 - start_addr = addr = TASK_UNMAPPED_BASE;
1116 + if (start_addr != mm->mmap_base) {
1117 + start_addr = addr = mm->mmap_base;
1118 mm->cached_hole_size = 0;
1119 goto full_search;
1120 }
1121 return -ENOMEM;
1122 }
1123 - if (!vma || addr + len <= vma->vm_start) {
1124 + if (check_heap_stack_gap(vma, addr, len)) {
1125 /*
1126 * Remember the place where we stopped the search:
1127 */
1128 diff -urNp linux-2.6.39.1/arch/arm/plat-iop/pci.c linux-2.6.39.1/arch/arm/plat-iop/pci.c
1129 --- linux-2.6.39.1/arch/arm/plat-iop/pci.c 2011-05-19 00:06:34.000000000 -0400
1130 +++ linux-2.6.39.1/arch/arm/plat-iop/pci.c 2011-05-22 19:36:30.000000000 -0400
1131 @@ -161,7 +161,7 @@ iop3xx_write_config(struct pci_bus *bus,
1132 return PCIBIOS_SUCCESSFUL;
1133 }
1134
1135 -static struct pci_ops iop3xx_ops = {
1136 +static const struct pci_ops iop3xx_ops = {
1137 .read = iop3xx_read_config,
1138 .write = iop3xx_write_config,
1139 };
1140 diff -urNp linux-2.6.39.1/arch/avr32/include/asm/elf.h linux-2.6.39.1/arch/avr32/include/asm/elf.h
1141 --- linux-2.6.39.1/arch/avr32/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1142 +++ linux-2.6.39.1/arch/avr32/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1143 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
1144 the loader. We need to make sure that it is out of the way of the program
1145 that it will "exec", and that there is sufficient room for the brk. */
1146
1147 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1148 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1149
1150 +#ifdef CONFIG_PAX_ASLR
1151 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1152 +
1153 +#define PAX_DELTA_MMAP_LEN 15
1154 +#define PAX_DELTA_STACK_LEN 15
1155 +#endif
1156
1157 /* This yields a mask that user programs can use to figure out what
1158 instruction set this CPU supports. This could be done in user space,
1159 diff -urNp linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h
1160 --- linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1161 +++ linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1162 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1163 D(11) KM_IRQ1,
1164 D(12) KM_SOFTIRQ0,
1165 D(13) KM_SOFTIRQ1,
1166 -D(14) KM_TYPE_NR
1167 +D(14) KM_CLEARPAGE,
1168 +D(15) KM_TYPE_NR
1169 };
1170
1171 #undef D
1172 diff -urNp linux-2.6.39.1/arch/avr32/mm/fault.c linux-2.6.39.1/arch/avr32/mm/fault.c
1173 --- linux-2.6.39.1/arch/avr32/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1174 +++ linux-2.6.39.1/arch/avr32/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1175 @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
1176
1177 int exception_trace = 1;
1178
1179 +#ifdef CONFIG_PAX_PAGEEXEC
1180 +void pax_report_insns(void *pc, void *sp)
1181 +{
1182 + unsigned long i;
1183 +
1184 + printk(KERN_ERR "PAX: bytes at PC: ");
1185 + for (i = 0; i < 20; i++) {
1186 + unsigned char c;
1187 + if (get_user(c, (unsigned char *)pc+i))
1188 + printk(KERN_CONT "???????? ");
1189 + else
1190 + printk(KERN_CONT "%02x ", c);
1191 + }
1192 + printk("\n");
1193 +}
1194 +#endif
1195 +
1196 /*
1197 * This routine handles page faults. It determines the address and the
1198 * problem, and then passes it off to one of the appropriate routines.
1199 @@ -156,6 +173,16 @@ bad_area:
1200 up_read(&mm->mmap_sem);
1201
1202 if (user_mode(regs)) {
1203 +
1204 +#ifdef CONFIG_PAX_PAGEEXEC
1205 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1206 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1207 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1208 + do_group_exit(SIGKILL);
1209 + }
1210 + }
1211 +#endif
1212 +
1213 if (exception_trace && printk_ratelimit())
1214 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1215 "sp %08lx ecr %lu\n",
1216 diff -urNp linux-2.6.39.1/arch/blackfin/kernel/kgdb.c linux-2.6.39.1/arch/blackfin/kernel/kgdb.c
1217 --- linux-2.6.39.1/arch/blackfin/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1218 +++ linux-2.6.39.1/arch/blackfin/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1219 @@ -420,7 +420,7 @@ int kgdb_arch_handle_exception(int vecto
1220 return -1; /* this means that we do not want to exit from the handler */
1221 }
1222
1223 -struct kgdb_arch arch_kgdb_ops = {
1224 +const struct kgdb_arch arch_kgdb_ops = {
1225 .gdb_bpt_instr = {0xa1},
1226 .flags = KGDB_HW_BREAKPOINT,
1227 .set_hw_breakpoint = bfin_set_hw_break,
1228 diff -urNp linux-2.6.39.1/arch/blackfin/mm/maccess.c linux-2.6.39.1/arch/blackfin/mm/maccess.c
1229 --- linux-2.6.39.1/arch/blackfin/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
1230 +++ linux-2.6.39.1/arch/blackfin/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
1231 @@ -16,7 +16,7 @@ static int validate_memory_access_addres
1232 return bfin_mem_access_type(addr, size);
1233 }
1234
1235 -long probe_kernel_read(void *dst, void *src, size_t size)
1236 +long probe_kernel_read(void *dst, const void *src, size_t size)
1237 {
1238 unsigned long lsrc = (unsigned long)src;
1239 int mem_type;
1240 @@ -55,7 +55,7 @@ long probe_kernel_read(void *dst, void *
1241 return -EFAULT;
1242 }
1243
1244 -long probe_kernel_write(void *dst, void *src, size_t size)
1245 +long probe_kernel_write(void *dst, const void *src, size_t size)
1246 {
1247 unsigned long ldst = (unsigned long)dst;
1248 int mem_type;
1249 diff -urNp linux-2.6.39.1/arch/frv/include/asm/kmap_types.h linux-2.6.39.1/arch/frv/include/asm/kmap_types.h
1250 --- linux-2.6.39.1/arch/frv/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1251 +++ linux-2.6.39.1/arch/frv/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1252 @@ -23,6 +23,7 @@ enum km_type {
1253 KM_IRQ1,
1254 KM_SOFTIRQ0,
1255 KM_SOFTIRQ1,
1256 + KM_CLEARPAGE,
1257 KM_TYPE_NR
1258 };
1259
1260 diff -urNp linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h
1261 --- linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h 2011-05-19 00:06:34.000000000 -0400
1262 +++ linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h 2011-05-22 19:36:30.000000000 -0400
1263 @@ -34,7 +34,7 @@ void pcibios_resource_survey(void);
1264
1265 extern int __nongpreldata pcibios_last_bus;
1266 extern struct pci_bus *__nongpreldata pci_root_bus;
1267 -extern struct pci_ops *__nongpreldata pci_root_ops;
1268 +extern const struct pci_ops *__nongpreldata pci_root_ops;
1269
1270 /* pci-irq.c */
1271 extern unsigned int pcibios_irq_mask;
1272 diff -urNp linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c
1273 --- linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-19 00:06:34.000000000 -0400
1274 +++ linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-22 19:36:30.000000000 -0400
1275 @@ -27,7 +27,7 @@ unsigned int __nongpreldata pci_probe =
1276
1277 int __nongpreldata pcibios_last_bus = -1;
1278 struct pci_bus *__nongpreldata pci_root_bus;
1279 -struct pci_ops *__nongpreldata pci_root_ops;
1280 +const struct pci_ops *__nongpreldata pci_root_ops;
1281
1282 /*
1283 * The accessible PCI window does not cover the entire CPU address space, but
1284 @@ -169,7 +169,7 @@ static int pci_frv_write_config(struct p
1285 return PCIBIOS_SUCCESSFUL;
1286 }
1287
1288 -static struct pci_ops pci_direct_frv = {
1289 +static const struct pci_ops pci_direct_frv = {
1290 pci_frv_read_config,
1291 pci_frv_write_config,
1292 };
1293 @@ -356,7 +356,7 @@ void __init pcibios_fixup_bus(struct pci
1294
1295 int __init pcibios_init(void)
1296 {
1297 - struct pci_ops *dir = NULL;
1298 + const struct pci_ops *dir = NULL;
1299
1300 if (!mb93090_mb00_detected)
1301 return -ENXIO;
1302 diff -urNp linux-2.6.39.1/arch/frv/mm/elf-fdpic.c linux-2.6.39.1/arch/frv/mm/elf-fdpic.c
1303 --- linux-2.6.39.1/arch/frv/mm/elf-fdpic.c 2011-05-19 00:06:34.000000000 -0400
1304 +++ linux-2.6.39.1/arch/frv/mm/elf-fdpic.c 2011-05-22 19:36:30.000000000 -0400
1305 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
1306 if (addr) {
1307 addr = PAGE_ALIGN(addr);
1308 vma = find_vma(current->mm, addr);
1309 - if (TASK_SIZE - len >= addr &&
1310 - (!vma || addr + len <= vma->vm_start))
1311 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1312 goto success;
1313 }
1314
1315 @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
1316 for (; vma; vma = vma->vm_next) {
1317 if (addr > limit)
1318 break;
1319 - if (addr + len <= vma->vm_start)
1320 + if (check_heap_stack_gap(vma, addr, len))
1321 goto success;
1322 addr = vma->vm_end;
1323 }
1324 @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
1325 for (; vma; vma = vma->vm_next) {
1326 if (addr > limit)
1327 break;
1328 - if (addr + len <= vma->vm_start)
1329 + if (check_heap_stack_gap(vma, addr, len))
1330 goto success;
1331 addr = vma->vm_end;
1332 }
1333 diff -urNp linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c
1334 --- linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c 2011-05-19 00:06:34.000000000 -0400
1335 +++ linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c 2011-05-22 19:36:30.000000000 -0400
1336 @@ -17,7 +17,7 @@
1337 #include <linux/swiotlb.h>
1338 #include <asm/machvec.h>
1339
1340 -extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1341 +extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1342
1343 /* swiotlb declarations & definitions: */
1344 extern int swiotlb_late_init_with_default_size (size_t size);
1345 @@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
1346 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
1347 }
1348
1349 -struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1350 +const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1351 {
1352 if (use_swiotlb(dev))
1353 return &swiotlb_dma_ops;
1354 diff -urNp linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c
1355 --- linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c 2011-05-19 00:06:34.000000000 -0400
1356 +++ linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c 2011-05-22 19:36:30.000000000 -0400
1357 @@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
1358 },
1359 };
1360
1361 -extern struct dma_map_ops swiotlb_dma_ops;
1362 +extern const struct dma_map_ops swiotlb_dma_ops;
1363
1364 static int __init
1365 sba_init(void)
1366 @@ -2211,7 +2211,7 @@ sba_page_override(char *str)
1367
1368 __setup("sbapagesize=",sba_page_override);
1369
1370 -struct dma_map_ops sba_dma_ops = {
1371 +const struct dma_map_ops sba_dma_ops = {
1372 .alloc_coherent = sba_alloc_coherent,
1373 .free_coherent = sba_free_coherent,
1374 .map_page = sba_map_page,
1375 diff -urNp linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h
1376 --- linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1377 +++ linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1378 @@ -14,7 +14,7 @@
1379
1380 #define DMA_ERROR_CODE 0
1381
1382 -extern struct dma_map_ops *dma_ops;
1383 +extern const struct dma_map_ops *dma_ops;
1384 extern struct ia64_machine_vector ia64_mv;
1385 extern void set_iommu_machvec(void);
1386
1387 @@ -26,7 +26,7 @@ extern void machvec_dma_sync_sg(struct d
1388 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1389 dma_addr_t *daddr, gfp_t gfp)
1390 {
1391 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
1392 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1393 void *caddr;
1394
1395 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
1396 @@ -37,7 +37,7 @@ static inline void *dma_alloc_coherent(s
1397 static inline void dma_free_coherent(struct device *dev, size_t size,
1398 void *caddr, dma_addr_t daddr)
1399 {
1400 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
1401 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1402 debug_dma_free_coherent(dev, size, caddr, daddr);
1403 ops->free_coherent(dev, size, caddr, daddr);
1404 }
1405 @@ -51,13 +51,13 @@ static inline void dma_free_coherent(str
1406
1407 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
1408 {
1409 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
1410 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1411 return ops->mapping_error(dev, daddr);
1412 }
1413
1414 static inline int dma_supported(struct device *dev, u64 mask)
1415 {
1416 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
1417 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1418 return ops->dma_supported(dev, mask);
1419 }
1420
1421 diff -urNp linux-2.6.39.1/arch/ia64/include/asm/elf.h linux-2.6.39.1/arch/ia64/include/asm/elf.h
1422 --- linux-2.6.39.1/arch/ia64/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1423 +++ linux-2.6.39.1/arch/ia64/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1424 @@ -42,6 +42,13 @@
1425 */
1426 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1427
1428 +#ifdef CONFIG_PAX_ASLR
1429 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1430 +
1431 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1432 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1433 +#endif
1434 +
1435 #define PT_IA_64_UNWIND 0x70000001
1436
1437 /* IA-64 relocations: */
1438 diff -urNp linux-2.6.39.1/arch/ia64/include/asm/machvec.h linux-2.6.39.1/arch/ia64/include/asm/machvec.h
1439 --- linux-2.6.39.1/arch/ia64/include/asm/machvec.h 2011-05-19 00:06:34.000000000 -0400
1440 +++ linux-2.6.39.1/arch/ia64/include/asm/machvec.h 2011-05-22 19:36:30.000000000 -0400
1441 @@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1442 /* DMA-mapping interface: */
1443 typedef void ia64_mv_dma_init (void);
1444 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1445 -typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1446 +typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1447
1448 /*
1449 * WARNING: The legacy I/O space is _architected_. Platforms are
1450 @@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1451 # endif /* CONFIG_IA64_GENERIC */
1452
1453 extern void swiotlb_dma_init(void);
1454 -extern struct dma_map_ops *dma_get_ops(struct device *);
1455 +extern const struct dma_map_ops *dma_get_ops(struct device *);
1456
1457 /*
1458 * Define default versions so we can extend machvec for new platforms without having
1459 diff -urNp linux-2.6.39.1/arch/ia64/include/asm/pgtable.h linux-2.6.39.1/arch/ia64/include/asm/pgtable.h
1460 --- linux-2.6.39.1/arch/ia64/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
1461 +++ linux-2.6.39.1/arch/ia64/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
1462 @@ -12,7 +12,7 @@
1463 * David Mosberger-Tang <davidm@hpl.hp.com>
1464 */
1465
1466 -
1467 +#include <linux/const.h>
1468 #include <asm/mman.h>
1469 #include <asm/page.h>
1470 #include <asm/processor.h>
1471 @@ -143,6 +143,17 @@
1472 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1473 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1474 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1475 +
1476 +#ifdef CONFIG_PAX_PAGEEXEC
1477 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1478 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1479 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1480 +#else
1481 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1482 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1483 +# define PAGE_COPY_NOEXEC PAGE_COPY
1484 +#endif
1485 +
1486 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1487 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1488 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1489 diff -urNp linux-2.6.39.1/arch/ia64/include/asm/spinlock.h linux-2.6.39.1/arch/ia64/include/asm/spinlock.h
1490 --- linux-2.6.39.1/arch/ia64/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
1491 +++ linux-2.6.39.1/arch/ia64/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
1492 @@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1493 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1494
1495 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1496 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1497 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1498 }
1499
1500 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1501 diff -urNp linux-2.6.39.1/arch/ia64/include/asm/uaccess.h linux-2.6.39.1/arch/ia64/include/asm/uaccess.h
1502 --- linux-2.6.39.1/arch/ia64/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
1503 +++ linux-2.6.39.1/arch/ia64/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
1504 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1505 const void *__cu_from = (from); \
1506 long __cu_len = (n); \
1507 \
1508 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
1509 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1510 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1511 __cu_len; \
1512 })
1513 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1514 long __cu_len = (n); \
1515 \
1516 __chk_user_ptr(__cu_from); \
1517 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
1518 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1519 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1520 __cu_len; \
1521 })
1522 diff -urNp linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c
1523 --- linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c 2011-05-19 00:06:34.000000000 -0400
1524 +++ linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c 2011-05-22 19:36:30.000000000 -0400
1525 @@ -3,7 +3,7 @@
1526 /* Set this to 1 if there is a HW IOMMU in the system */
1527 int iommu_detected __read_mostly;
1528
1529 -struct dma_map_ops *dma_ops;
1530 +const struct dma_map_ops *dma_ops;
1531 EXPORT_SYMBOL(dma_ops);
1532
1533 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1534 @@ -16,7 +16,7 @@ static int __init dma_init(void)
1535 }
1536 fs_initcall(dma_init);
1537
1538 -struct dma_map_ops *dma_get_ops(struct device *dev)
1539 +const struct dma_map_ops *dma_get_ops(struct device *dev)
1540 {
1541 return dma_ops;
1542 }
1543 diff -urNp linux-2.6.39.1/arch/ia64/kernel/module.c linux-2.6.39.1/arch/ia64/kernel/module.c
1544 --- linux-2.6.39.1/arch/ia64/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
1545 +++ linux-2.6.39.1/arch/ia64/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
1546 @@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1547 void
1548 module_free (struct module *mod, void *module_region)
1549 {
1550 - if (mod && mod->arch.init_unw_table &&
1551 - module_region == mod->module_init) {
1552 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1553 unw_remove_unwind_table(mod->arch.init_unw_table);
1554 mod->arch.init_unw_table = NULL;
1555 }
1556 @@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1557 }
1558
1559 static inline int
1560 +in_init_rx (const struct module *mod, uint64_t addr)
1561 +{
1562 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1563 +}
1564 +
1565 +static inline int
1566 +in_init_rw (const struct module *mod, uint64_t addr)
1567 +{
1568 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1569 +}
1570 +
1571 +static inline int
1572 in_init (const struct module *mod, uint64_t addr)
1573 {
1574 - return addr - (uint64_t) mod->module_init < mod->init_size;
1575 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1576 +}
1577 +
1578 +static inline int
1579 +in_core_rx (const struct module *mod, uint64_t addr)
1580 +{
1581 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1582 +}
1583 +
1584 +static inline int
1585 +in_core_rw (const struct module *mod, uint64_t addr)
1586 +{
1587 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1588 }
1589
1590 static inline int
1591 in_core (const struct module *mod, uint64_t addr)
1592 {
1593 - return addr - (uint64_t) mod->module_core < mod->core_size;
1594 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1595 }
1596
1597 static inline int
1598 @@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1599 break;
1600
1601 case RV_BDREL:
1602 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1603 + if (in_init_rx(mod, val))
1604 + val -= (uint64_t) mod->module_init_rx;
1605 + else if (in_init_rw(mod, val))
1606 + val -= (uint64_t) mod->module_init_rw;
1607 + else if (in_core_rx(mod, val))
1608 + val -= (uint64_t) mod->module_core_rx;
1609 + else if (in_core_rw(mod, val))
1610 + val -= (uint64_t) mod->module_core_rw;
1611 break;
1612
1613 case RV_LTV:
1614 @@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1615 * addresses have been selected...
1616 */
1617 uint64_t gp;
1618 - if (mod->core_size > MAX_LTOFF)
1619 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1620 /*
1621 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1622 * at the end of the module.
1623 */
1624 - gp = mod->core_size - MAX_LTOFF / 2;
1625 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1626 else
1627 - gp = mod->core_size / 2;
1628 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1629 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1630 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1631 mod->arch.gp = gp;
1632 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1633 }
1634 diff -urNp linux-2.6.39.1/arch/ia64/kernel/pci-dma.c linux-2.6.39.1/arch/ia64/kernel/pci-dma.c
1635 --- linux-2.6.39.1/arch/ia64/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
1636 +++ linux-2.6.39.1/arch/ia64/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
1637 @@ -43,7 +43,7 @@ struct device fallback_dev = {
1638 .dma_mask = &fallback_dev.coherent_dma_mask,
1639 };
1640
1641 -extern struct dma_map_ops intel_dma_ops;
1642 +extern const struct dma_map_ops intel_dma_ops;
1643
1644 static int __init pci_iommu_init(void)
1645 {
1646 diff -urNp linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c
1647 --- linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
1648 +++ linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
1649 @@ -22,7 +22,7 @@ static void *ia64_swiotlb_alloc_coherent
1650 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1651 }
1652
1653 -struct dma_map_ops swiotlb_dma_ops = {
1654 +const struct dma_map_ops swiotlb_dma_ops = {
1655 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1656 .free_coherent = swiotlb_free_coherent,
1657 .map_page = swiotlb_map_page,
1658 diff -urNp linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c
1659 --- linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c 2011-05-19 00:06:34.000000000 -0400
1660 +++ linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c 2011-05-22 19:36:30.000000000 -0400
1661 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1662 if (REGION_NUMBER(addr) == RGN_HPAGE)
1663 addr = 0;
1664 #endif
1665 +
1666 +#ifdef CONFIG_PAX_RANDMMAP
1667 + if (mm->pax_flags & MF_PAX_RANDMMAP)
1668 + addr = mm->free_area_cache;
1669 + else
1670 +#endif
1671 +
1672 if (!addr)
1673 addr = mm->free_area_cache;
1674
1675 @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
1676 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1677 /* At this point: (!vma || addr < vma->vm_end). */
1678 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1679 - if (start_addr != TASK_UNMAPPED_BASE) {
1680 + if (start_addr != mm->mmap_base) {
1681 /* Start a new search --- just in case we missed some holes. */
1682 - addr = TASK_UNMAPPED_BASE;
1683 + addr = mm->mmap_base;
1684 goto full_search;
1685 }
1686 return -ENOMEM;
1687 }
1688 - if (!vma || addr + len <= vma->vm_start) {
1689 + if (check_heap_stack_gap(vma, addr, len)) {
1690 /* Remember the address where we stopped this search: */
1691 mm->free_area_cache = addr + len;
1692 return addr;
1693 diff -urNp linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S
1694 --- linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
1695 +++ linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
1696 @@ -199,7 +199,7 @@ SECTIONS {
1697 /* Per-cpu data: */
1698 . = ALIGN(PERCPU_PAGE_SIZE);
1699 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1700 - __phys_per_cpu_start = __per_cpu_load;
1701 + __phys_per_cpu_start = per_cpu_load;
1702 /*
1703 * ensure percpu data fits
1704 * into percpu page size
1705 diff -urNp linux-2.6.39.1/arch/ia64/mm/fault.c linux-2.6.39.1/arch/ia64/mm/fault.c
1706 --- linux-2.6.39.1/arch/ia64/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1707 +++ linux-2.6.39.1/arch/ia64/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1708 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1709 return pte_present(pte);
1710 }
1711
1712 +#ifdef CONFIG_PAX_PAGEEXEC
1713 +void pax_report_insns(void *pc, void *sp)
1714 +{
1715 + unsigned long i;
1716 +
1717 + printk(KERN_ERR "PAX: bytes at PC: ");
1718 + for (i = 0; i < 8; i++) {
1719 + unsigned int c;
1720 + if (get_user(c, (unsigned int *)pc+i))
1721 + printk(KERN_CONT "???????? ");
1722 + else
1723 + printk(KERN_CONT "%08x ", c);
1724 + }
1725 + printk("\n");
1726 +}
1727 +#endif
1728 +
1729 void __kprobes
1730 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1731 {
1732 @@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1733 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1734 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1735
1736 - if ((vma->vm_flags & mask) != mask)
1737 + if ((vma->vm_flags & mask) != mask) {
1738 +
1739 +#ifdef CONFIG_PAX_PAGEEXEC
1740 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1741 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1742 + goto bad_area;
1743 +
1744 + up_read(&mm->mmap_sem);
1745 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1746 + do_group_exit(SIGKILL);
1747 + }
1748 +#endif
1749 +
1750 goto bad_area;
1751
1752 + }
1753 +
1754 /*
1755 * If for any reason at all we couldn't handle the fault, make
1756 * sure we exit gracefully rather than endlessly redo the
1757 diff -urNp linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c
1758 --- linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
1759 +++ linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
1760 @@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
1761 /* At this point: (!vmm || addr < vmm->vm_end). */
1762 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1763 return -ENOMEM;
1764 - if (!vmm || (addr + len) <= vmm->vm_start)
1765 + if (check_heap_stack_gap(vmm, addr, len))
1766 return addr;
1767 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1768 }
1769 diff -urNp linux-2.6.39.1/arch/ia64/mm/init.c linux-2.6.39.1/arch/ia64/mm/init.c
1770 --- linux-2.6.39.1/arch/ia64/mm/init.c 2011-05-19 00:06:34.000000000 -0400
1771 +++ linux-2.6.39.1/arch/ia64/mm/init.c 2011-05-22 19:36:30.000000000 -0400
1772 @@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1773 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1774 vma->vm_end = vma->vm_start + PAGE_SIZE;
1775 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1776 +
1777 +#ifdef CONFIG_PAX_PAGEEXEC
1778 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1779 + vma->vm_flags &= ~VM_EXEC;
1780 +
1781 +#ifdef CONFIG_PAX_MPROTECT
1782 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
1783 + vma->vm_flags &= ~VM_MAYEXEC;
1784 +#endif
1785 +
1786 + }
1787 +#endif
1788 +
1789 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1790 down_write(&current->mm->mmap_sem);
1791 if (insert_vm_struct(current->mm, vma)) {
1792 diff -urNp linux-2.6.39.1/arch/ia64/pci/pci.c linux-2.6.39.1/arch/ia64/pci/pci.c
1793 --- linux-2.6.39.1/arch/ia64/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
1794 +++ linux-2.6.39.1/arch/ia64/pci/pci.c 2011-05-22 19:36:30.000000000 -0400
1795 @@ -109,7 +109,7 @@ static int pci_write(struct pci_bus *bus
1796 devfn, where, size, value);
1797 }
1798
1799 -struct pci_ops pci_root_ops = {
1800 +const struct pci_ops pci_root_ops = {
1801 .read = pci_read,
1802 .write = pci_write,
1803 };
1804 diff -urNp linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c
1805 --- linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c 2011-05-19 00:06:34.000000000 -0400
1806 +++ linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c 2011-05-22 19:36:30.000000000 -0400
1807 @@ -465,7 +465,7 @@ int sn_pci_legacy_write(struct pci_bus *
1808 return ret;
1809 }
1810
1811 -static struct dma_map_ops sn_dma_ops = {
1812 +static const struct dma_map_ops sn_dma_ops = {
1813 .alloc_coherent = sn_dma_alloc_coherent,
1814 .free_coherent = sn_dma_free_coherent,
1815 .map_page = sn_dma_map_page,
1816 diff -urNp linux-2.6.39.1/arch/m32r/lib/usercopy.c linux-2.6.39.1/arch/m32r/lib/usercopy.c
1817 --- linux-2.6.39.1/arch/m32r/lib/usercopy.c 2011-05-19 00:06:34.000000000 -0400
1818 +++ linux-2.6.39.1/arch/m32r/lib/usercopy.c 2011-05-22 19:36:30.000000000 -0400
1819 @@ -14,6 +14,9 @@
1820 unsigned long
1821 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1822 {
1823 + if ((long)n < 0)
1824 + return n;
1825 +
1826 prefetch(from);
1827 if (access_ok(VERIFY_WRITE, to, n))
1828 __copy_user(to,from,n);
1829 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1830 unsigned long
1831 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1832 {
1833 + if ((long)n < 0)
1834 + return n;
1835 +
1836 prefetchw(to);
1837 if (access_ok(VERIFY_READ, from, n))
1838 __copy_user_zeroing(to,from,n);
1839 diff -urNp linux-2.6.39.1/arch/microblaze/include/asm/device.h linux-2.6.39.1/arch/microblaze/include/asm/device.h
1840 --- linux-2.6.39.1/arch/microblaze/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1841 +++ linux-2.6.39.1/arch/microblaze/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
1842 @@ -13,7 +13,7 @@ struct device_node;
1843
1844 struct dev_archdata {
1845 /* DMA operations on that device */
1846 - struct dma_map_ops *dma_ops;
1847 + const struct dma_map_ops *dma_ops;
1848 void *dma_data;
1849 };
1850
1851 diff -urNp linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h
1852 --- linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1853 +++ linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1854 @@ -43,14 +43,14 @@ static inline unsigned long device_to_ma
1855 return 0xfffffffful;
1856 }
1857
1858 -extern struct dma_map_ops *dma_ops;
1859 +extern const struct dma_map_ops *dma_ops;
1860
1861 /*
1862 * Available generic sets of operations
1863 */
1864 -extern struct dma_map_ops dma_direct_ops;
1865 +extern const struct dma_map_ops dma_direct_ops;
1866
1867 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1868 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
1869 {
1870 /* We don't handle the NULL dev case for ISA for now. We could
1871 * do it via an out of line call but it is not needed for now. The
1872 @@ -63,14 +63,14 @@ static inline struct dma_map_ops *get_dm
1873 return dev->archdata.dma_ops;
1874 }
1875
1876 -static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
1877 +static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
1878 {
1879 dev->archdata.dma_ops = ops;
1880 }
1881
1882 static inline int dma_supported(struct device *dev, u64 mask)
1883 {
1884 - struct dma_map_ops *ops = get_dma_ops(dev);
1885 + const struct dma_map_ops *ops = get_dma_ops(dev);
1886
1887 if (unlikely(!ops))
1888 return 0;
1889 @@ -81,7 +81,7 @@ static inline int dma_supported(struct d
1890
1891 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
1892 {
1893 - struct dma_map_ops *ops = get_dma_ops(dev);
1894 + const struct dma_map_ops *ops = get_dma_ops(dev);
1895
1896 if (unlikely(ops == NULL))
1897 return -EIO;
1898 @@ -97,7 +97,7 @@ static inline int dma_set_mask(struct de
1899
1900 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1901 {
1902 - struct dma_map_ops *ops = get_dma_ops(dev);
1903 + const struct dma_map_ops *ops = get_dma_ops(dev);
1904 if (ops->mapping_error)
1905 return ops->mapping_error(dev, dma_addr);
1906
1907 @@ -110,7 +110,7 @@ static inline int dma_mapping_error(stru
1908 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1909 dma_addr_t *dma_handle, gfp_t flag)
1910 {
1911 - struct dma_map_ops *ops = get_dma_ops(dev);
1912 + const struct dma_map_ops *ops = get_dma_ops(dev);
1913 void *memory;
1914
1915 BUG_ON(!ops);
1916 @@ -124,7 +124,7 @@ static inline void *dma_alloc_coherent(s
1917 static inline void dma_free_coherent(struct device *dev, size_t size,
1918 void *cpu_addr, dma_addr_t dma_handle)
1919 {
1920 - struct dma_map_ops *ops = get_dma_ops(dev);
1921 + const struct dma_map_ops *ops = get_dma_ops(dev);
1922
1923 BUG_ON(!ops);
1924 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
1925 diff -urNp linux-2.6.39.1/arch/microblaze/include/asm/pci.h linux-2.6.39.1/arch/microblaze/include/asm/pci.h
1926 --- linux-2.6.39.1/arch/microblaze/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
1927 +++ linux-2.6.39.1/arch/microblaze/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
1928 @@ -54,8 +54,8 @@ static inline void pcibios_penalize_isa_
1929 }
1930
1931 #ifdef CONFIG_PCI
1932 -extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
1933 -extern struct dma_map_ops *get_pci_dma_ops(void);
1934 +extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
1935 +extern const struct dma_map_ops *get_pci_dma_ops(void);
1936 #else /* CONFIG_PCI */
1937 #define set_pci_dma_ops(d)
1938 #define get_pci_dma_ops() NULL
1939 diff -urNp linux-2.6.39.1/arch/microblaze/kernel/dma.c linux-2.6.39.1/arch/microblaze/kernel/dma.c
1940 --- linux-2.6.39.1/arch/microblaze/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
1941 +++ linux-2.6.39.1/arch/microblaze/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
1942 @@ -134,7 +134,7 @@ static inline void dma_direct_unmap_page
1943 __dma_sync_page(dma_address, 0 , size, direction);
1944 }
1945
1946 -struct dma_map_ops dma_direct_ops = {
1947 +const struct dma_map_ops dma_direct_ops = {
1948 .alloc_coherent = dma_direct_alloc_coherent,
1949 .free_coherent = dma_direct_free_coherent,
1950 .map_sg = dma_direct_map_sg,
1951 diff -urNp linux-2.6.39.1/arch/microblaze/kernel/kgdb.c linux-2.6.39.1/arch/microblaze/kernel/kgdb.c
1952 --- linux-2.6.39.1/arch/microblaze/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1953 +++ linux-2.6.39.1/arch/microblaze/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1954 @@ -141,7 +141,7 @@ void kgdb_arch_exit(void)
1955 /*
1956 * Global data
1957 */
1958 -struct kgdb_arch arch_kgdb_ops = {
1959 +const struct kgdb_arch arch_kgdb_ops = {
1960 #ifdef __MICROBLAZEEL__
1961 .gdb_bpt_instr = {0x18, 0x00, 0x0c, 0xba}, /* brki r16, 0x18 */
1962 #else
1963 diff -urNp linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c
1964 --- linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
1965 +++ linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
1966 @@ -140,7 +140,7 @@ indirect_write_config(struct pci_bus *bu
1967 return PCIBIOS_SUCCESSFUL;
1968 }
1969
1970 -static struct pci_ops indirect_pci_ops = {
1971 +static const struct pci_ops indirect_pci_ops = {
1972 .read = indirect_read_config,
1973 .write = indirect_write_config,
1974 };
1975 diff -urNp linux-2.6.39.1/arch/microblaze/pci/pci-common.c linux-2.6.39.1/arch/microblaze/pci/pci-common.c
1976 --- linux-2.6.39.1/arch/microblaze/pci/pci-common.c 2011-05-19 00:06:34.000000000 -0400
1977 +++ linux-2.6.39.1/arch/microblaze/pci/pci-common.c 2011-05-22 19:36:30.000000000 -0400
1978 @@ -48,14 +48,14 @@ resource_size_t isa_mem_base;
1979 /* Default PCI flags is 0 on ppc32, modified at boot on ppc64 */
1980 unsigned int pci_flags;
1981
1982 -static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1983 +static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1984
1985 -void set_pci_dma_ops(struct dma_map_ops *dma_ops)
1986 +void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
1987 {
1988 pci_dma_ops = dma_ops;
1989 }
1990
1991 -struct dma_map_ops *get_pci_dma_ops(void)
1992 +const struct dma_map_ops *get_pci_dma_ops(void)
1993 {
1994 return pci_dma_ops;
1995 }
1996 @@ -1583,7 +1583,7 @@ null_write_config(struct pci_bus *bus, u
1997 return PCIBIOS_DEVICE_NOT_FOUND;
1998 }
1999
2000 -static struct pci_ops null_pci_ops = {
2001 +static const struct pci_ops null_pci_ops = {
2002 .read = null_read_config,
2003 .write = null_write_config,
2004 };
2005 diff -urNp linux-2.6.39.1/arch/mips/alchemy/common/pci.c linux-2.6.39.1/arch/mips/alchemy/common/pci.c
2006 --- linux-2.6.39.1/arch/mips/alchemy/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2007 +++ linux-2.6.39.1/arch/mips/alchemy/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2008 @@ -51,7 +51,7 @@ static struct resource pci_mem_resource
2009 .flags = IORESOURCE_MEM
2010 };
2011
2012 -extern struct pci_ops au1x_pci_ops;
2013 +extern const struct pci_ops au1x_pci_ops;
2014
2015 static struct pci_controller au1x_controller = {
2016 .pci_ops = &au1x_pci_ops,
2017 diff -urNp linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c
2018 --- linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c 2011-05-19 00:06:34.000000000 -0400
2019 +++ linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c 2011-05-22 19:36:30.000000000 -0400
2020 @@ -202,7 +202,7 @@ static phys_addr_t octeon_unity_dma_to_p
2021 }
2022
2023 struct octeon_dma_map_ops {
2024 - struct dma_map_ops dma_map_ops;
2025 + const struct dma_map_ops dma_map_ops;
2026 dma_addr_t (*phys_to_dma)(struct device *dev, phys_addr_t paddr);
2027 phys_addr_t (*dma_to_phys)(struct device *dev, dma_addr_t daddr);
2028 };
2029 @@ -324,7 +324,7 @@ static struct octeon_dma_map_ops _octeon
2030 },
2031 };
2032
2033 -struct dma_map_ops *octeon_pci_dma_map_ops;
2034 +const struct dma_map_ops *octeon_pci_dma_map_ops;
2035
2036 void __init octeon_pci_dma_init(void)
2037 {
2038 diff -urNp linux-2.6.39.1/arch/mips/cobalt/pci.c linux-2.6.39.1/arch/mips/cobalt/pci.c
2039 --- linux-2.6.39.1/arch/mips/cobalt/pci.c 2011-05-19 00:06:34.000000000 -0400
2040 +++ linux-2.6.39.1/arch/mips/cobalt/pci.c 2011-05-22 19:36:30.000000000 -0400
2041 @@ -14,7 +14,7 @@
2042
2043 #include <asm/gt64120.h>
2044
2045 -extern struct pci_ops gt64xxx_pci0_ops;
2046 +extern const struct pci_ops gt64xxx_pci0_ops;
2047
2048 static struct resource cobalt_mem_resource = {
2049 .start = GT_DEF_PCI0_MEM0_BASE,
2050 diff -urNp linux-2.6.39.1/arch/mips/include/asm/device.h linux-2.6.39.1/arch/mips/include/asm/device.h
2051 --- linux-2.6.39.1/arch/mips/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
2052 +++ linux-2.6.39.1/arch/mips/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
2053 @@ -10,7 +10,7 @@ struct dma_map_ops;
2054
2055 struct dev_archdata {
2056 /* DMA operations on that device */
2057 - struct dma_map_ops *dma_ops;
2058 + const struct dma_map_ops *dma_ops;
2059 };
2060
2061 struct pdev_archdata {
2062 diff -urNp linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h
2063 --- linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
2064 +++ linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
2065 @@ -9,9 +9,9 @@
2066 #include <dma-coherence.h>
2067 #endif
2068
2069 -extern struct dma_map_ops *mips_dma_map_ops;
2070 +extern const struct dma_map_ops *mips_dma_map_ops;
2071
2072 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
2073 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2074 {
2075 if (dev && dev->archdata.dma_ops)
2076 return dev->archdata.dma_ops;
2077 @@ -33,13 +33,13 @@ static inline void dma_mark_clean(void *
2078
2079 static inline int dma_supported(struct device *dev, u64 mask)
2080 {
2081 - struct dma_map_ops *ops = get_dma_ops(dev);
2082 + const struct dma_map_ops *ops = get_dma_ops(dev);
2083 return ops->dma_supported(dev, mask);
2084 }
2085
2086 static inline int dma_mapping_error(struct device *dev, u64 mask)
2087 {
2088 - struct dma_map_ops *ops = get_dma_ops(dev);
2089 + const struct dma_map_ops *ops = get_dma_ops(dev);
2090 return ops->mapping_error(dev, mask);
2091 }
2092
2093 @@ -61,7 +61,7 @@ static inline void *dma_alloc_coherent(s
2094 dma_addr_t *dma_handle, gfp_t gfp)
2095 {
2096 void *ret;
2097 - struct dma_map_ops *ops = get_dma_ops(dev);
2098 + const struct dma_map_ops *ops = get_dma_ops(dev);
2099
2100 ret = ops->alloc_coherent(dev, size, dma_handle, gfp);
2101
2102 @@ -73,7 +73,7 @@ static inline void *dma_alloc_coherent(s
2103 static inline void dma_free_coherent(struct device *dev, size_t size,
2104 void *vaddr, dma_addr_t dma_handle)
2105 {
2106 - struct dma_map_ops *ops = get_dma_ops(dev);
2107 + const struct dma_map_ops *ops = get_dma_ops(dev);
2108
2109 ops->free_coherent(dev, size, vaddr, dma_handle);
2110
2111 diff -urNp linux-2.6.39.1/arch/mips/include/asm/elf.h linux-2.6.39.1/arch/mips/include/asm/elf.h
2112 --- linux-2.6.39.1/arch/mips/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2113 +++ linux-2.6.39.1/arch/mips/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
2114 @@ -372,13 +372,16 @@ extern const char *__elf_platform;
2115 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
2116 #endif
2117
2118 +#ifdef CONFIG_PAX_ASLR
2119 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2120 +
2121 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2122 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2123 +#endif
2124 +
2125 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2126 struct linux_binprm;
2127 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2128 int uses_interp);
2129
2130 -struct mm_struct;
2131 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2132 -#define arch_randomize_brk arch_randomize_brk
2133 -
2134 #endif /* _ASM_ELF_H */
2135 diff -urNp linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h
2136 --- linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-19 00:06:34.000000000 -0400
2137 +++ linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-22 19:36:30.000000000 -0400
2138 @@ -66,7 +66,7 @@ dma_addr_t phys_to_dma(struct device *de
2139 phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr);
2140
2141 struct dma_map_ops;
2142 -extern struct dma_map_ops *octeon_pci_dma_map_ops;
2143 +extern const struct dma_map_ops *octeon_pci_dma_map_ops;
2144 extern char *octeon_swiotlb;
2145
2146 #endif /* __ASM_MACH_CAVIUM_OCTEON_DMA_COHERENCE_H */
2147 diff -urNp linux-2.6.39.1/arch/mips/include/asm/page.h linux-2.6.39.1/arch/mips/include/asm/page.h
2148 --- linux-2.6.39.1/arch/mips/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
2149 +++ linux-2.6.39.1/arch/mips/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
2150 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
2151 #ifdef CONFIG_CPU_MIPS32
2152 typedef struct { unsigned long pte_low, pte_high; } pte_t;
2153 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
2154 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
2155 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
2156 #else
2157 typedef struct { unsigned long long pte; } pte_t;
2158 #define pte_val(x) ((x).pte)
2159 diff -urNp linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h
2160 --- linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h 2011-05-19 00:06:34.000000000 -0400
2161 +++ linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h 2011-05-22 19:36:30.000000000 -0400
2162 @@ -849,6 +849,6 @@ struct bridge_controller {
2163 extern void register_bridge_irq(unsigned int irq);
2164 extern int request_bridge_irq(struct bridge_controller *bc);
2165
2166 -extern struct pci_ops bridge_pci_ops;
2167 +extern const struct pci_ops bridge_pci_ops;
2168
2169 #endif /* _ASM_PCI_BRIDGE_H */
2170 diff -urNp linux-2.6.39.1/arch/mips/include/asm/system.h linux-2.6.39.1/arch/mips/include/asm/system.h
2171 --- linux-2.6.39.1/arch/mips/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
2172 +++ linux-2.6.39.1/arch/mips/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
2173 @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
2174 */
2175 #define __ARCH_WANT_UNLOCKED_CTXSW
2176
2177 -extern unsigned long arch_align_stack(unsigned long sp);
2178 +#define arch_align_stack(x) ((x) & ~0xfUL)
2179
2180 #endif /* _ASM_SYSTEM_H */
2181 diff -urNp linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c
2182 --- linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c 2011-05-19 00:06:34.000000000 -0400
2183 +++ linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c 2011-05-22 19:36:30.000000000 -0400
2184 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2185 #undef ELF_ET_DYN_BASE
2186 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2187
2188 +#ifdef CONFIG_PAX_ASLR
2189 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2190 +
2191 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2192 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2193 +#endif
2194 +
2195 #include <asm/processor.h>
2196 #include <linux/module.h>
2197 #include <linux/elfcore.h>
2198 diff -urNp linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c
2199 --- linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c 2011-05-19 00:06:34.000000000 -0400
2200 +++ linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c 2011-05-22 19:36:30.000000000 -0400
2201 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2202 #undef ELF_ET_DYN_BASE
2203 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2204
2205 +#ifdef CONFIG_PAX_ASLR
2206 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2207 +
2208 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2209 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2210 +#endif
2211 +
2212 #include <asm/processor.h>
2213
2214 /*
2215 diff -urNp linux-2.6.39.1/arch/mips/kernel/kgdb.c linux-2.6.39.1/arch/mips/kernel/kgdb.c
2216 --- linux-2.6.39.1/arch/mips/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
2217 +++ linux-2.6.39.1/arch/mips/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
2218 @@ -351,7 +351,7 @@ int kgdb_arch_handle_exception(int vecto
2219 return -1;
2220 }
2221
2222 -struct kgdb_arch arch_kgdb_ops;
2223 +struct kgdb_arch arch_kgdb_ops; /* cannot be const, see kgdb_arch_init */
2224
2225 /*
2226 * We use kgdb_early_setup so that functions we need to call now don't
2227 diff -urNp linux-2.6.39.1/arch/mips/kernel/process.c linux-2.6.39.1/arch/mips/kernel/process.c
2228 --- linux-2.6.39.1/arch/mips/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
2229 +++ linux-2.6.39.1/arch/mips/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
2230 @@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
2231 out:
2232 return pc;
2233 }
2234 -
2235 -/*
2236 - * Don't forget that the stack pointer must be aligned on a 8 bytes
2237 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
2238 - */
2239 -unsigned long arch_align_stack(unsigned long sp)
2240 -{
2241 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2242 - sp -= get_random_int() & ~PAGE_MASK;
2243 -
2244 - return sp & ALMASK;
2245 -}
2246 diff -urNp linux-2.6.39.1/arch/mips/kernel/syscall.c linux-2.6.39.1/arch/mips/kernel/syscall.c
2247 --- linux-2.6.39.1/arch/mips/kernel/syscall.c 2011-05-19 00:06:34.000000000 -0400
2248 +++ linux-2.6.39.1/arch/mips/kernel/syscall.c 2011-05-22 19:36:30.000000000 -0400
2249 @@ -108,14 +108,18 @@ unsigned long arch_get_unmapped_area(str
2250 do_color_align = 0;
2251 if (filp || (flags & MAP_SHARED))
2252 do_color_align = 1;
2253 +
2254 +#ifdef CONFIG_PAX_RANDMMAP
2255 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
2256 +#endif
2257 +
2258 if (addr) {
2259 if (do_color_align)
2260 addr = COLOUR_ALIGN(addr, pgoff);
2261 else
2262 addr = PAGE_ALIGN(addr);
2263 vmm = find_vma(current->mm, addr);
2264 - if (task_size - len >= addr &&
2265 - (!vmm || addr + len <= vmm->vm_start))
2266 + if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
2267 return addr;
2268 }
2269 addr = current->mm->mmap_base;
2270 @@ -128,7 +132,7 @@ unsigned long arch_get_unmapped_area(str
2271 /* At this point: (!vmm || addr < vmm->vm_end). */
2272 if (task_size - len < addr)
2273 return -ENOMEM;
2274 - if (!vmm || addr + len <= vmm->vm_start)
2275 + if (check_heap_stack_gap(vmm, addr, len))
2276 return addr;
2277 addr = vmm->vm_end;
2278 if (do_color_align)
2279 @@ -154,33 +158,6 @@ void arch_pick_mmap_layout(struct mm_str
2280 mm->unmap_area = arch_unmap_area;
2281 }
2282
2283 -static inline unsigned long brk_rnd(void)
2284 -{
2285 - unsigned long rnd = get_random_int();
2286 -
2287 - rnd = rnd << PAGE_SHIFT;
2288 - /* 8MB for 32bit, 256MB for 64bit */
2289 - if (TASK_IS_32BIT_ADDR)
2290 - rnd = rnd & 0x7ffffful;
2291 - else
2292 - rnd = rnd & 0xffffffful;
2293 -
2294 - return rnd;
2295 -}
2296 -
2297 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2298 -{
2299 - unsigned long base = mm->brk;
2300 - unsigned long ret;
2301 -
2302 - ret = PAGE_ALIGN(base + brk_rnd());
2303 -
2304 - if (ret < mm->brk)
2305 - return mm->brk;
2306 -
2307 - return ret;
2308 -}
2309 -
2310 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
2311 unsigned long, prot, unsigned long, flags, unsigned long,
2312 fd, off_t, offset)
2313 diff -urNp linux-2.6.39.1/arch/mips/mm/dma-default.c linux-2.6.39.1/arch/mips/mm/dma-default.c
2314 --- linux-2.6.39.1/arch/mips/mm/dma-default.c 2011-05-19 00:06:34.000000000 -0400
2315 +++ linux-2.6.39.1/arch/mips/mm/dma-default.c 2011-05-22 19:36:30.000000000 -0400
2316 @@ -300,7 +300,7 @@ void dma_cache_sync(struct device *dev,
2317
2318 EXPORT_SYMBOL(dma_cache_sync);
2319
2320 -static struct dma_map_ops mips_default_dma_map_ops = {
2321 +static const struct dma_map_ops mips_default_dma_map_ops = {
2322 .alloc_coherent = mips_dma_alloc_coherent,
2323 .free_coherent = mips_dma_free_coherent,
2324 .map_page = mips_dma_map_page,
2325 @@ -315,7 +315,7 @@ static struct dma_map_ops mips_default_d
2326 .dma_supported = mips_dma_supported
2327 };
2328
2329 -struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2330 +const struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2331 EXPORT_SYMBOL(mips_dma_map_ops);
2332
2333 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
2334 diff -urNp linux-2.6.39.1/arch/mips/mm/fault.c linux-2.6.39.1/arch/mips/mm/fault.c
2335 --- linux-2.6.39.1/arch/mips/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
2336 +++ linux-2.6.39.1/arch/mips/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
2337 @@ -28,6 +28,23 @@
2338 #include <asm/highmem.h> /* For VMALLOC_END */
2339 #include <linux/kdebug.h>
2340
2341 +#ifdef CONFIG_PAX_PAGEEXEC
2342 +void pax_report_insns(void *pc, void *sp)
2343 +{
2344 + unsigned long i;
2345 +
2346 + printk(KERN_ERR "PAX: bytes at PC: ");
2347 + for (i = 0; i < 5; i++) {
2348 + unsigned int c;
2349 + if (get_user(c, (unsigned int *)pc+i))
2350 + printk(KERN_CONT "???????? ");
2351 + else
2352 + printk(KERN_CONT "%08x ", c);
2353 + }
2354 + printk("\n");
2355 +}
2356 +#endif
2357 +
2358 /*
2359 * This routine handles page faults. It determines the address,
2360 * and the problem, and then passes it off to one of the appropriate
2361 diff -urNp linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c
2362 --- linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c 2011-05-19 00:06:34.000000000 -0400
2363 +++ linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c 2011-05-22 19:36:30.000000000 -0400
2364 @@ -64,9 +64,9 @@ static struct resource msc_io_resource =
2365 .flags = IORESOURCE_IO,
2366 };
2367
2368 -extern struct pci_ops bonito64_pci_ops;
2369 -extern struct pci_ops gt64xxx_pci0_ops;
2370 -extern struct pci_ops msc_pci_ops;
2371 +extern const struct pci_ops bonito64_pci_ops;
2372 +extern const struct pci_ops gt64xxx_pci0_ops;
2373 +extern const struct pci_ops msc_pci_ops;
2374
2375 static struct pci_controller bonito64_controller = {
2376 .pci_ops = &bonito64_pci_ops,
2377 diff -urNp linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c
2378 --- linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2379 +++ linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2380 @@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2381 .flags = IORESOURCE_MEM
2382 };
2383
2384 -extern struct pci_ops pnx8550_pci_ops;
2385 +extern const struct pci_ops pnx8550_pci_ops;
2386
2387 static struct pci_controller pnx8550_controller = {
2388 .pci_ops = &pnx8550_pci_ops,
2389 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-au1000.c linux-2.6.39.1/arch/mips/pci/ops-au1000.c
2390 --- linux-2.6.39.1/arch/mips/pci/ops-au1000.c 2011-05-19 00:06:34.000000000 -0400
2391 +++ linux-2.6.39.1/arch/mips/pci/ops-au1000.c 2011-05-22 19:36:30.000000000 -0400
2392 @@ -302,7 +302,7 @@ static int config_write(struct pci_bus *
2393 }
2394 }
2395
2396 -struct pci_ops au1x_pci_ops = {
2397 +const struct pci_ops au1x_pci_ops = {
2398 config_read,
2399 config_write
2400 };
2401 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c
2402 --- linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c 2011-05-19 00:06:34.000000000 -0400
2403 +++ linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c 2011-05-22 19:36:30.000000000 -0400
2404 @@ -173,7 +173,7 @@ static int bcm63xx_pci_write(struct pci_
2405 where, size, val);
2406 }
2407
2408 -struct pci_ops bcm63xx_pci_ops = {
2409 +const struct pci_ops bcm63xx_pci_ops = {
2410 .read = bcm63xx_pci_read,
2411 .write = bcm63xx_pci_write
2412 };
2413 @@ -402,7 +402,7 @@ static int bcm63xx_cb_write(struct pci_b
2414 return PCIBIOS_DEVICE_NOT_FOUND;
2415 }
2416
2417 -struct pci_ops bcm63xx_cb_ops = {
2418 +const struct pci_ops bcm63xx_cb_ops = {
2419 .read = bcm63xx_cb_read,
2420 .write = bcm63xx_cb_write,
2421 };
2422 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-bonito64.c linux-2.6.39.1/arch/mips/pci/ops-bonito64.c
2423 --- linux-2.6.39.1/arch/mips/pci/ops-bonito64.c 2011-05-19 00:06:34.000000000 -0400
2424 +++ linux-2.6.39.1/arch/mips/pci/ops-bonito64.c 2011-05-22 19:36:30.000000000 -0400
2425 @@ -155,7 +155,7 @@ static int bonito64_pcibios_write(struct
2426 return PCIBIOS_SUCCESSFUL;
2427 }
2428
2429 -struct pci_ops bonito64_pci_ops = {
2430 +const struct pci_ops bonito64_pci_ops = {
2431 .read = bonito64_pcibios_read,
2432 .write = bonito64_pcibios_write
2433 };
2434 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-bridge.c linux-2.6.39.1/arch/mips/pci/ops-bridge.c
2435 --- linux-2.6.39.1/arch/mips/pci/ops-bridge.c 2011-05-19 00:06:34.000000000 -0400
2436 +++ linux-2.6.39.1/arch/mips/pci/ops-bridge.c 2011-05-22 19:36:30.000000000 -0400
2437 @@ -316,7 +316,7 @@ static int pci_write_config(struct pci_b
2438 return pci_conf0_write_config(bus, devfn, where, size, value);
2439 }
2440
2441 -struct pci_ops bridge_pci_ops = {
2442 +const struct pci_ops bridge_pci_ops = {
2443 .read = pci_read_config,
2444 .write = pci_write_config,
2445 };
2446 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c
2447 --- linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2448 +++ linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2449 @@ -176,7 +176,7 @@ static int pci_config_write(struct pci_b
2450 return PCIBIOS_SUCCESSFUL;
2451 }
2452
2453 -struct pci_ops emma2rh_pci_ops = {
2454 +const struct pci_ops emma2rh_pci_ops = {
2455 .read = pci_config_read,
2456 .write = pci_config_write,
2457 };
2458 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c
2459 --- linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-19 00:06:34.000000000 -0400
2460 +++ linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-22 19:36:30.000000000 -0400
2461 @@ -146,7 +146,7 @@ static int gt64xxx_pci0_pcibios_write(st
2462 return PCIBIOS_SUCCESSFUL;
2463 }
2464
2465 -struct pci_ops gt64xxx_pci0_ops = {
2466 +const struct pci_ops gt64xxx_pci0_ops = {
2467 .read = gt64xxx_pci0_pcibios_read,
2468 .write = gt64xxx_pci0_pcibios_write
2469 };
2470 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-loongson2.c linux-2.6.39.1/arch/mips/pci/ops-loongson2.c
2471 --- linux-2.6.39.1/arch/mips/pci/ops-loongson2.c 2011-05-19 00:06:34.000000000 -0400
2472 +++ linux-2.6.39.1/arch/mips/pci/ops-loongson2.c 2011-05-22 19:36:30.000000000 -0400
2473 @@ -174,7 +174,7 @@ static int loongson_pcibios_write(struct
2474 return PCIBIOS_SUCCESSFUL;
2475 }
2476
2477 -struct pci_ops loongson_pci_ops = {
2478 +const struct pci_ops loongson_pci_ops = {
2479 .read = loongson_pcibios_read,
2480 .write = loongson_pcibios_write
2481 };
2482 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-mace.c linux-2.6.39.1/arch/mips/pci/ops-mace.c
2483 --- linux-2.6.39.1/arch/mips/pci/ops-mace.c 2011-05-19 00:06:34.000000000 -0400
2484 +++ linux-2.6.39.1/arch/mips/pci/ops-mace.c 2011-05-22 19:36:30.000000000 -0400
2485 @@ -96,7 +96,7 @@ mace_pci_write_config(struct pci_bus *bu
2486 return PCIBIOS_SUCCESSFUL;
2487 }
2488
2489 -struct pci_ops mace_pci_ops = {
2490 +const struct pci_ops mace_pci_ops = {
2491 .read = mace_pci_read_config,
2492 .write = mace_pci_write_config,
2493 };
2494 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-msc.c linux-2.6.39.1/arch/mips/pci/ops-msc.c
2495 --- linux-2.6.39.1/arch/mips/pci/ops-msc.c 2011-05-19 00:06:34.000000000 -0400
2496 +++ linux-2.6.39.1/arch/mips/pci/ops-msc.c 2011-05-22 19:36:30.000000000 -0400
2497 @@ -142,7 +142,7 @@ static int msc_pcibios_write(struct pci_
2498 return PCIBIOS_SUCCESSFUL;
2499 }
2500
2501 -struct pci_ops msc_pci_ops = {
2502 +const struct pci_ops msc_pci_ops = {
2503 .read = msc_pcibios_read,
2504 .write = msc_pcibios_write
2505 };
2506 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-nile4.c linux-2.6.39.1/arch/mips/pci/ops-nile4.c
2507 --- linux-2.6.39.1/arch/mips/pci/ops-nile4.c 2011-05-19 00:06:34.000000000 -0400
2508 +++ linux-2.6.39.1/arch/mips/pci/ops-nile4.c 2011-05-22 19:36:30.000000000 -0400
2509 @@ -141,7 +141,7 @@ static int nile4_pcibios_write(struct pc
2510 return PCIBIOS_SUCCESSFUL;
2511 }
2512
2513 -struct pci_ops nile4_pci_ops = {
2514 +const struct pci_ops nile4_pci_ops = {
2515 .read = nile4_pcibios_read,
2516 .write = nile4_pcibios_write,
2517 };
2518 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c
2519 --- linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
2520 +++ linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c 2011-05-22 19:36:30.000000000 -0400
2521 @@ -904,7 +904,7 @@ msp_pcibios_write_config(struct pci_bus
2522 * write - function for Linux to generate PCI Configuration writes.
2523 *
2524 ****************************************************************************/
2525 -struct pci_ops msp_pci_ops = {
2526 +const struct pci_ops msp_pci_ops = {
2527 .read = msp_pcibios_read_config,
2528 .write = msp_pcibios_write_config
2529 };
2530 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c
2531 --- linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c 2011-05-19 00:06:34.000000000 -0400
2532 +++ linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c 2011-05-22 19:36:30.000000000 -0400
2533 @@ -276,7 +276,7 @@ static int config_write(struct pci_bus *
2534 }
2535 }
2536
2537 -struct pci_ops pnx8550_pci_ops = {
2538 +const struct pci_ops pnx8550_pci_ops = {
2539 config_read,
2540 config_write
2541 };
2542 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-rc32434.c linux-2.6.39.1/arch/mips/pci/ops-rc32434.c
2543 --- linux-2.6.39.1/arch/mips/pci/ops-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2544 +++ linux-2.6.39.1/arch/mips/pci/ops-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2545 @@ -201,7 +201,7 @@ static int pci_config_write(struct pci_b
2546 }
2547 }
2548
2549 -struct pci_ops rc32434_pci_ops = {
2550 +const struct pci_ops rc32434_pci_ops = {
2551 .read = pci_config_read,
2552 .write = pci_config_write,
2553 };
2554 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-sni.c linux-2.6.39.1/arch/mips/pci/ops-sni.c
2555 --- linux-2.6.39.1/arch/mips/pci/ops-sni.c 2011-05-19 00:06:34.000000000 -0400
2556 +++ linux-2.6.39.1/arch/mips/pci/ops-sni.c 2011-05-22 19:36:30.000000000 -0400
2557 @@ -83,7 +83,7 @@ static int pcimt_write(struct pci_bus *b
2558 return 0;
2559 }
2560
2561 -struct pci_ops sni_pcimt_ops = {
2562 +const struct pci_ops sni_pcimt_ops = {
2563 .read = pcimt_read,
2564 .write = pcimt_write,
2565 };
2566 @@ -158,7 +158,7 @@ static int pcit_write(struct pci_bus *bu
2567 }
2568
2569
2570 -struct pci_ops sni_pcit_ops = {
2571 +const struct pci_ops sni_pcit_ops = {
2572 .read = pcit_read,
2573 .write = pcit_write,
2574 };
2575 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-titan.c linux-2.6.39.1/arch/mips/pci/ops-titan.c
2576 --- linux-2.6.39.1/arch/mips/pci/ops-titan.c 2011-05-19 00:06:34.000000000 -0400
2577 +++ linux-2.6.39.1/arch/mips/pci/ops-titan.c 2011-05-22 19:36:30.000000000 -0400
2578 @@ -105,7 +105,7 @@ static int titan_write_config(struct pci
2579 /*
2580 * Titan PCI structure
2581 */
2582 -struct pci_ops titan_pci_ops = {
2583 +const struct pci_ops titan_pci_ops = {
2584 titan_read_config,
2585 titan_write_config,
2586 };
2587 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c
2588 --- linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c 2011-05-19 00:06:34.000000000 -0400
2589 +++ linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c 2011-05-22 19:36:30.000000000 -0400
2590 @@ -118,7 +118,7 @@ static int titan_ht_config_write(struct
2591 return PCIBIOS_SUCCESSFUL;
2592 }
2593
2594 -struct pci_ops titan_ht_pci_ops = {
2595 +const struct pci_ops titan_ht_pci_ops = {
2596 .read = titan_ht_config_read,
2597 .write = titan_ht_config_write,
2598 };
2599 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-tx3927.c linux-2.6.39.1/arch/mips/pci/ops-tx3927.c
2600 --- linux-2.6.39.1/arch/mips/pci/ops-tx3927.c 2011-05-19 00:06:34.000000000 -0400
2601 +++ linux-2.6.39.1/arch/mips/pci/ops-tx3927.c 2011-05-22 19:36:30.000000000 -0400
2602 @@ -121,7 +121,7 @@ static int tx3927_pci_write_config(struc
2603 return check_abort();
2604 }
2605
2606 -static struct pci_ops tx3927_pci_ops = {
2607 +static const struct pci_ops tx3927_pci_ops = {
2608 .read = tx3927_pci_read_config,
2609 .write = tx3927_pci_write_config,
2610 };
2611 diff -urNp linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c
2612 --- linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2613 +++ linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2614 @@ -120,7 +120,7 @@ static int pci_config_write(struct pci_b
2615 return PCIBIOS_SUCCESSFUL;
2616 }
2617
2618 -struct pci_ops vr41xx_pci_ops = {
2619 +const struct pci_ops vr41xx_pci_ops = {
2620 .read = pci_config_read,
2621 .write = pci_config_write,
2622 };
2623 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c
2624 --- linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c 2011-05-19 00:06:34.000000000 -0400
2625 +++ linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c 2011-05-22 19:36:30.000000000 -0400
2626 @@ -171,7 +171,7 @@ static int bcm1480_pcibios_write(struct
2627 return PCIBIOS_SUCCESSFUL;
2628 }
2629
2630 -struct pci_ops bcm1480_pci_ops = {
2631 +const struct pci_ops bcm1480_pci_ops = {
2632 bcm1480_pcibios_read,
2633 bcm1480_pcibios_write,
2634 };
2635 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c
2636 --- linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c 2011-05-19 00:06:34.000000000 -0400
2637 +++ linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c 2011-05-22 19:36:30.000000000 -0400
2638 @@ -166,7 +166,7 @@ static int bcm1480ht_pcibios_get_busno(v
2639 return 0;
2640 }
2641
2642 -struct pci_ops bcm1480ht_pci_ops = {
2643 +const struct pci_ops bcm1480ht_pci_ops = {
2644 .read = bcm1480ht_pcibios_read,
2645 .write = bcm1480ht_pcibios_write,
2646 };
2647 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h
2648 --- linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h 2011-05-19 00:06:34.000000000 -0400
2649 +++ linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h 2011-05-22 19:36:30.000000000 -0400
2650 @@ -16,8 +16,8 @@
2651 /*
2652 * defined in ops-bcm63xx.c
2653 */
2654 -extern struct pci_ops bcm63xx_pci_ops;
2655 -extern struct pci_ops bcm63xx_cb_ops;
2656 +extern const struct pci_ops bcm63xx_pci_ops;
2657 +extern const struct pci_ops bcm63xx_cb_ops;
2658
2659 /*
2660 * defined in pci-bcm63xx.c
2661 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c
2662 --- linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2663 +++ linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2664 @@ -43,7 +43,7 @@ static struct resource pci_mem_resource
2665 .flags = IORESOURCE_MEM,
2666 };
2667
2668 -extern struct pci_ops emma2rh_pci_ops;
2669 +extern const struct pci_ops emma2rh_pci_ops;
2670
2671 static struct pci_controller emma2rh_pci_controller = {
2672 .pci_ops = &emma2rh_pci_ops,
2673 diff -urNp linux-2.6.39.1/arch/mips/pci/pcie-octeon.c linux-2.6.39.1/arch/mips/pci/pcie-octeon.c
2674 --- linux-2.6.39.1/arch/mips/pci/pcie-octeon.c 2011-05-19 00:06:34.000000000 -0400
2675 +++ linux-2.6.39.1/arch/mips/pci/pcie-octeon.c 2011-05-22 19:36:30.000000000 -0400
2676 @@ -1237,7 +1237,7 @@ static int octeon_pcie1_write_config(str
2677 return octeon_pcie_write_config(1, bus, devfn, reg, size, val);
2678 }
2679
2680 -static struct pci_ops octeon_pcie0_ops = {
2681 +static const struct pci_ops octeon_pcie0_ops = {
2682 octeon_pcie0_read_config,
2683 octeon_pcie0_write_config,
2684 };
2685 @@ -1258,7 +1258,7 @@ static struct pci_controller octeon_pcie
2686 .io_resource = &octeon_pcie0_io_resource,
2687 };
2688
2689 -static struct pci_ops octeon_pcie1_ops = {
2690 +static const struct pci_ops octeon_pcie1_ops = {
2691 octeon_pcie1_read_config,
2692 octeon_pcie1_write_config,
2693 };
2694 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-ip27.c linux-2.6.39.1/arch/mips/pci/pci-ip27.c
2695 --- linux-2.6.39.1/arch/mips/pci/pci-ip27.c 2011-05-19 00:06:34.000000000 -0400
2696 +++ linux-2.6.39.1/arch/mips/pci/pci-ip27.c 2011-05-22 19:36:30.000000000 -0400
2697 @@ -39,7 +39,7 @@ static struct bridge_controller bridges[
2698 struct bridge_controller *irq_to_bridge[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2699 int irq_to_slot[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2700
2701 -extern struct pci_ops bridge_pci_ops;
2702 +extern const struct pci_ops bridge_pci_ops;
2703
2704 int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
2705 {
2706 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-ip32.c linux-2.6.39.1/arch/mips/pci/pci-ip32.c
2707 --- linux-2.6.39.1/arch/mips/pci/pci-ip32.c 2011-05-19 00:06:34.000000000 -0400
2708 +++ linux-2.6.39.1/arch/mips/pci/pci-ip32.c 2011-05-22 19:36:30.000000000 -0400
2709 @@ -82,7 +82,7 @@ static irqreturn_t macepci_error(int irq
2710 }
2711
2712
2713 -extern struct pci_ops mace_pci_ops;
2714 +extern const struct pci_ops mace_pci_ops;
2715 #ifdef CONFIG_64BIT
2716 static struct resource mace_pci_mem_resource = {
2717 .name = "SGI O2 PCI MEM",
2718 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-lasat.c linux-2.6.39.1/arch/mips/pci/pci-lasat.c
2719 --- linux-2.6.39.1/arch/mips/pci/pci-lasat.c 2011-05-19 00:06:34.000000000 -0400
2720 +++ linux-2.6.39.1/arch/mips/pci/pci-lasat.c 2011-05-22 19:36:30.000000000 -0400
2721 @@ -14,8 +14,8 @@
2722
2723 #include <irq.h>
2724
2725 -extern struct pci_ops nile4_pci_ops;
2726 -extern struct pci_ops gt64xxx_pci0_ops;
2727 +extern const struct pci_ops nile4_pci_ops;
2728 +extern const struct pci_ops gt64xxx_pci0_ops;
2729 static struct resource lasat_pci_mem_resource = {
2730 .name = "LASAT PCI MEM",
2731 .start = 0x18000000,
2732 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-octeon.c linux-2.6.39.1/arch/mips/pci/pci-octeon.c
2733 --- linux-2.6.39.1/arch/mips/pci/pci-octeon.c 2011-05-19 00:06:34.000000000 -0400
2734 +++ linux-2.6.39.1/arch/mips/pci/pci-octeon.c 2011-05-22 19:36:30.000000000 -0400
2735 @@ -334,7 +334,7 @@ static int octeon_write_config(struct pc
2736 }
2737
2738
2739 -static struct pci_ops octeon_pci_ops = {
2740 +static const struct pci_ops octeon_pci_ops = {
2741 octeon_read_config,
2742 octeon_write_config,
2743 };
2744 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-rc32434.c linux-2.6.39.1/arch/mips/pci/pci-rc32434.c
2745 --- linux-2.6.39.1/arch/mips/pci/pci-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2746 +++ linux-2.6.39.1/arch/mips/pci/pci-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2747 @@ -75,7 +75,7 @@ static struct resource rc32434_res_pci_i
2748 .flags = IORESOURCE_IO,
2749 };
2750
2751 -extern struct pci_ops rc32434_pci_ops;
2752 +extern const struct pci_ops rc32434_pci_ops;
2753
2754 #define PCI_MEM1_START PCI_ADDR_START
2755 #define PCI_MEM1_END (PCI_ADDR_START + CPUTOPCI_MEM_WIN - 1)
2756 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-sb1250.c linux-2.6.39.1/arch/mips/pci/pci-sb1250.c
2757 --- linux-2.6.39.1/arch/mips/pci/pci-sb1250.c 2011-05-19 00:06:34.000000000 -0400
2758 +++ linux-2.6.39.1/arch/mips/pci/pci-sb1250.c 2011-05-22 19:36:30.000000000 -0400
2759 @@ -181,7 +181,7 @@ static int sb1250_pcibios_write(struct p
2760 return PCIBIOS_SUCCESSFUL;
2761 }
2762
2763 -struct pci_ops sb1250_pci_ops = {
2764 +const struct pci_ops sb1250_pci_ops = {
2765 .read = sb1250_pcibios_read,
2766 .write = sb1250_pcibios_write,
2767 };
2768 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c
2769 --- linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2770 +++ linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2771 @@ -36,7 +36,7 @@
2772
2773 #include "pci-vr41xx.h"
2774
2775 -extern struct pci_ops vr41xx_pci_ops;
2776 +extern const struct pci_ops vr41xx_pci_ops;
2777
2778 static void __iomem *pciu_base;
2779
2780 diff -urNp linux-2.6.39.1/arch/mips/pci/pci-yosemite.c linux-2.6.39.1/arch/mips/pci/pci-yosemite.c
2781 --- linux-2.6.39.1/arch/mips/pci/pci-yosemite.c 2011-05-19 00:06:34.000000000 -0400
2782 +++ linux-2.6.39.1/arch/mips/pci/pci-yosemite.c 2011-05-22 19:36:30.000000000 -0400
2783 @@ -11,7 +11,7 @@
2784 #include <linux/pci.h>
2785 #include <asm/titan_dep.h>
2786
2787 -extern struct pci_ops titan_pci_ops;
2788 +extern const struct pci_ops titan_pci_ops;
2789
2790 static struct resource py_mem_resource = {
2791 .start = 0xe0000000UL,
2792 diff -urNp linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c
2793 --- linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-19 00:06:34.000000000 -0400
2794 +++ linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-22 19:36:30.000000000 -0400
2795 @@ -366,7 +366,7 @@ resource_size_t pcibios_align_resource(v
2796 return start;
2797 }
2798
2799 -struct pci_ops titan_pci_ops = {
2800 +const struct pci_ops titan_pci_ops = {
2801 titan_ht_config_read_byte,
2802 titan_ht_config_read_word,
2803 titan_ht_config_read_dword,
2804 diff -urNp linux-2.6.39.1/arch/mips/pnx8550/common/pci.c linux-2.6.39.1/arch/mips/pnx8550/common/pci.c
2805 --- linux-2.6.39.1/arch/mips/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2806 +++ linux-2.6.39.1/arch/mips/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2807 @@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2808 .flags = IORESOURCE_MEM
2809 };
2810
2811 -extern struct pci_ops pnx8550_pci_ops;
2812 +extern const struct pci_ops pnx8550_pci_ops;
2813
2814 static struct pci_controller pnx8550_controller = {
2815 .pci_ops = &pnx8550_pci_ops,
2816 diff -urNp linux-2.6.39.1/arch/mips/sni/pcimt.c linux-2.6.39.1/arch/mips/sni/pcimt.c
2817 --- linux-2.6.39.1/arch/mips/sni/pcimt.c 2011-05-19 00:06:34.000000000 -0400
2818 +++ linux-2.6.39.1/arch/mips/sni/pcimt.c 2011-05-22 19:36:30.000000000 -0400
2819 @@ -183,7 +183,7 @@ static void __init sni_pcimt_resource_in
2820 request_resource(&sni_mem_resource, pcimt_mem_resources + i);
2821 }
2822
2823 -extern struct pci_ops sni_pcimt_ops;
2824 +extern const struct pci_ops sni_pcimt_ops;
2825
2826 static struct pci_controller sni_controller = {
2827 .pci_ops = &sni_pcimt_ops,
2828 diff -urNp linux-2.6.39.1/arch/mips/sni/pcit.c linux-2.6.39.1/arch/mips/sni/pcit.c
2829 --- linux-2.6.39.1/arch/mips/sni/pcit.c 2011-05-19 00:06:34.000000000 -0400
2830 +++ linux-2.6.39.1/arch/mips/sni/pcit.c 2011-05-22 19:36:30.000000000 -0400
2831 @@ -145,7 +145,7 @@ static void __init sni_pcit_resource_ini
2832 }
2833
2834
2835 -extern struct pci_ops sni_pcit_ops;
2836 +extern const struct pci_ops sni_pcit_ops;
2837
2838 static struct pci_controller sni_pcit_controller = {
2839 .pci_ops = &sni_pcit_ops,
2840 diff -urNp linux-2.6.39.1/arch/mips/wrppmc/pci.c linux-2.6.39.1/arch/mips/wrppmc/pci.c
2841 --- linux-2.6.39.1/arch/mips/wrppmc/pci.c 2011-05-19 00:06:34.000000000 -0400
2842 +++ linux-2.6.39.1/arch/mips/wrppmc/pci.c 2011-05-22 19:36:30.000000000 -0400
2843 @@ -14,7 +14,7 @@
2844
2845 #include <asm/gt64120.h>
2846
2847 -extern struct pci_ops gt64xxx_pci0_ops;
2848 +extern const struct pci_ops gt64xxx_pci0_ops;
2849
2850 static struct resource pci0_io_resource = {
2851 .name = "pci_0 io",
2852 diff -urNp linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h
2853 --- linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-19 00:06:34.000000000 -0400
2854 +++ linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-22 19:36:30.000000000 -0400
2855 @@ -39,7 +39,7 @@ extern void pcibios_resource_survey(void
2856
2857 extern int pcibios_last_bus;
2858 extern struct pci_bus *pci_root_bus;
2859 -extern struct pci_ops *pci_root_ops;
2860 +extern const struct pci_ops *pci_root_ops;
2861
2862 extern struct irq_routing_table *pcibios_get_irq_routing_table(void);
2863 extern int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq);
2864 diff -urNp linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c
2865 --- linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c 2011-05-19 00:06:34.000000000 -0400
2866 +++ linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c 2011-05-22 19:36:30.000000000 -0400
2867 @@ -24,7 +24,7 @@ unsigned int pci_probe = 1;
2868
2869 int pcibios_last_bus = -1;
2870 struct pci_bus *pci_root_bus;
2871 -struct pci_ops *pci_root_ops;
2872 +const struct pci_ops *pci_root_ops;
2873
2874 /*
2875 * The accessible PCI window does not cover the entire CPU address space, but
2876 @@ -274,7 +274,7 @@ static int pci_ampci_write_config(struct
2877 }
2878 }
2879
2880 -static struct pci_ops pci_direct_ampci = {
2881 +static const struct pci_ops pci_direct_ampci = {
2882 pci_ampci_read_config,
2883 pci_ampci_write_config,
2884 };
2885 @@ -289,7 +289,7 @@ static struct pci_ops pci_direct_ampci =
2886 * This should be close to trivial, but it isn't, because there are buggy
2887 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
2888 */
2889 -static int __init pci_sanity_check(struct pci_ops *o)
2890 +static int __init pci_sanity_check(const struct pci_ops *o)
2891 {
2892 struct pci_bus bus; /* Fake bus and device */
2893 u32 x;
2894 diff -urNp linux-2.6.39.1/arch/parisc/include/asm/elf.h linux-2.6.39.1/arch/parisc/include/asm/elf.h
2895 --- linux-2.6.39.1/arch/parisc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2896 +++ linux-2.6.39.1/arch/parisc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
2897 @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration..
2898
2899 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
2900
2901 +#ifdef CONFIG_PAX_ASLR
2902 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
2903 +
2904 +#define PAX_DELTA_MMAP_LEN 16
2905 +#define PAX_DELTA_STACK_LEN 16
2906 +#endif
2907 +
2908 /* This yields a mask that user programs can use to figure out what
2909 instruction set this CPU supports. This could be done in user space,
2910 but it's not easy, and we've already done it here. */
2911 diff -urNp linux-2.6.39.1/arch/parisc/include/asm/pgtable.h linux-2.6.39.1/arch/parisc/include/asm/pgtable.h
2912 --- linux-2.6.39.1/arch/parisc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
2913 +++ linux-2.6.39.1/arch/parisc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
2914 @@ -207,6 +207,17 @@ struct vm_area_struct;
2915 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
2916 #define PAGE_COPY PAGE_EXECREAD
2917 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
2918 +
2919 +#ifdef CONFIG_PAX_PAGEEXEC
2920 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
2921 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2922 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2923 +#else
2924 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
2925 +# define PAGE_COPY_NOEXEC PAGE_COPY
2926 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
2927 +#endif
2928 +
2929 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
2930 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
2931 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
2932 diff -urNp linux-2.6.39.1/arch/parisc/kernel/module.c linux-2.6.39.1/arch/parisc/kernel/module.c
2933 --- linux-2.6.39.1/arch/parisc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
2934 +++ linux-2.6.39.1/arch/parisc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
2935 @@ -96,16 +96,38 @@
2936
2937 /* three functions to determine where in the module core
2938 * or init pieces the location is */
2939 +static inline int in_init_rx(struct module *me, void *loc)
2940 +{
2941 + return (loc >= me->module_init_rx &&
2942 + loc < (me->module_init_rx + me->init_size_rx));
2943 +}
2944 +
2945 +static inline int in_init_rw(struct module *me, void *loc)
2946 +{
2947 + return (loc >= me->module_init_rw &&
2948 + loc < (me->module_init_rw + me->init_size_rw));
2949 +}
2950 +
2951 static inline int in_init(struct module *me, void *loc)
2952 {
2953 - return (loc >= me->module_init &&
2954 - loc <= (me->module_init + me->init_size));
2955 + return in_init_rx(me, loc) || in_init_rw(me, loc);
2956 +}
2957 +
2958 +static inline int in_core_rx(struct module *me, void *loc)
2959 +{
2960 + return (loc >= me->module_core_rx &&
2961 + loc < (me->module_core_rx + me->core_size_rx));
2962 +}
2963 +
2964 +static inline int in_core_rw(struct module *me, void *loc)
2965 +{
2966 + return (loc >= me->module_core_rw &&
2967 + loc < (me->module_core_rw + me->core_size_rw));
2968 }
2969
2970 static inline int in_core(struct module *me, void *loc)
2971 {
2972 - return (loc >= me->module_core &&
2973 - loc <= (me->module_core + me->core_size));
2974 + return in_core_rx(me, loc) || in_core_rw(me, loc);
2975 }
2976
2977 static inline int in_local(struct module *me, void *loc)
2978 @@ -365,13 +387,13 @@ int module_frob_arch_sections(CONST Elf_
2979 }
2980
2981 /* align things a bit */
2982 - me->core_size = ALIGN(me->core_size, 16);
2983 - me->arch.got_offset = me->core_size;
2984 - me->core_size += gots * sizeof(struct got_entry);
2985 -
2986 - me->core_size = ALIGN(me->core_size, 16);
2987 - me->arch.fdesc_offset = me->core_size;
2988 - me->core_size += fdescs * sizeof(Elf_Fdesc);
2989 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
2990 + me->arch.got_offset = me->core_size_rw;
2991 + me->core_size_rw += gots * sizeof(struct got_entry);
2992 +
2993 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
2994 + me->arch.fdesc_offset = me->core_size_rw;
2995 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
2996
2997 me->arch.got_max = gots;
2998 me->arch.fdesc_max = fdescs;
2999 @@ -389,7 +411,7 @@ static Elf64_Word get_got(struct module
3000
3001 BUG_ON(value == 0);
3002
3003 - got = me->module_core + me->arch.got_offset;
3004 + got = me->module_core_rw + me->arch.got_offset;
3005 for (i = 0; got[i].addr; i++)
3006 if (got[i].addr == value)
3007 goto out;
3008 @@ -407,7 +429,7 @@ static Elf64_Word get_got(struct module
3009 #ifdef CONFIG_64BIT
3010 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
3011 {
3012 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
3013 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
3014
3015 if (!value) {
3016 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
3017 @@ -425,7 +447,7 @@ static Elf_Addr get_fdesc(struct module
3018
3019 /* Create new one */
3020 fdesc->addr = value;
3021 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
3022 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
3023 return (Elf_Addr)fdesc;
3024 }
3025 #endif /* CONFIG_64BIT */
3026 @@ -849,7 +871,7 @@ register_unwind_table(struct module *me,
3027
3028 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
3029 end = table + sechdrs[me->arch.unwind_section].sh_size;
3030 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
3031 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
3032
3033 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
3034 me->arch.unwind_section, table, end, gp);
3035 diff -urNp linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c
3036 --- linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c 2011-05-19 00:06:34.000000000 -0400
3037 +++ linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c 2011-05-22 19:36:30.000000000 -0400
3038 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
3039 /* At this point: (!vma || addr < vma->vm_end). */
3040 if (TASK_SIZE - len < addr)
3041 return -ENOMEM;
3042 - if (!vma || addr + len <= vma->vm_start)
3043 + if (check_heap_stack_gap(vma, addr, len))
3044 return addr;
3045 addr = vma->vm_end;
3046 }
3047 @@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
3048 /* At this point: (!vma || addr < vma->vm_end). */
3049 if (TASK_SIZE - len < addr)
3050 return -ENOMEM;
3051 - if (!vma || addr + len <= vma->vm_start)
3052 + if (check_heap_stack_gap(vma, addr, len))
3053 return addr;
3054 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
3055 if (addr < vma->vm_end) /* handle wraparound */
3056 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
3057 if (flags & MAP_FIXED)
3058 return addr;
3059 if (!addr)
3060 - addr = TASK_UNMAPPED_BASE;
3061 + addr = current->mm->mmap_base;
3062
3063 if (filp) {
3064 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
3065 diff -urNp linux-2.6.39.1/arch/parisc/kernel/traps.c linux-2.6.39.1/arch/parisc/kernel/traps.c
3066 --- linux-2.6.39.1/arch/parisc/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
3067 +++ linux-2.6.39.1/arch/parisc/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
3068 @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
3069
3070 down_read(&current->mm->mmap_sem);
3071 vma = find_vma(current->mm,regs->iaoq[0]);
3072 - if (vma && (regs->iaoq[0] >= vma->vm_start)
3073 - && (vma->vm_flags & VM_EXEC)) {
3074 -
3075 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
3076 fault_address = regs->iaoq[0];
3077 fault_space = regs->iasq[0];
3078
3079 diff -urNp linux-2.6.39.1/arch/parisc/mm/fault.c linux-2.6.39.1/arch/parisc/mm/fault.c
3080 --- linux-2.6.39.1/arch/parisc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
3081 +++ linux-2.6.39.1/arch/parisc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
3082 @@ -15,6 +15,7 @@
3083 #include <linux/sched.h>
3084 #include <linux/interrupt.h>
3085 #include <linux/module.h>
3086 +#include <linux/unistd.h>
3087
3088 #include <asm/uaccess.h>
3089 #include <asm/traps.h>
3090 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
3091 static unsigned long
3092 parisc_acctyp(unsigned long code, unsigned int inst)
3093 {
3094 - if (code == 6 || code == 16)
3095 + if (code == 6 || code == 7 || code == 16)
3096 return VM_EXEC;
3097
3098 switch (inst & 0xf0000000) {
3099 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
3100 }
3101 #endif
3102
3103 +#ifdef CONFIG_PAX_PAGEEXEC
3104 +/*
3105 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
3106 + *
3107 + * returns 1 when task should be killed
3108 + * 2 when rt_sigreturn trampoline was detected
3109 + * 3 when unpatched PLT trampoline was detected
3110 + */
3111 +static int pax_handle_fetch_fault(struct pt_regs *regs)
3112 +{
3113 +
3114 +#ifdef CONFIG_PAX_EMUPLT
3115 + int err;
3116 +
3117 + do { /* PaX: unpatched PLT emulation */
3118 + unsigned int bl, depwi;
3119 +
3120 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
3121 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
3122 +
3123 + if (err)
3124 + break;
3125 +
3126 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
3127 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
3128 +
3129 + err = get_user(ldw, (unsigned int *)addr);
3130 + err |= get_user(bv, (unsigned int *)(addr+4));
3131 + err |= get_user(ldw2, (unsigned int *)(addr+8));
3132 +
3133 + if (err)
3134 + break;
3135 +
3136 + if (ldw == 0x0E801096U &&
3137 + bv == 0xEAC0C000U &&
3138 + ldw2 == 0x0E881095U)
3139 + {
3140 + unsigned int resolver, map;
3141 +
3142 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
3143 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
3144 + if (err)
3145 + break;
3146 +
3147 + regs->gr[20] = instruction_pointer(regs)+8;
3148 + regs->gr[21] = map;
3149 + regs->gr[22] = resolver;
3150 + regs->iaoq[0] = resolver | 3UL;
3151 + regs->iaoq[1] = regs->iaoq[0] + 4;
3152 + return 3;
3153 + }
3154 + }
3155 + } while (0);
3156 +#endif
3157 +
3158 +#ifdef CONFIG_PAX_EMUTRAMP
3159 +
3160 +#ifndef CONFIG_PAX_EMUSIGRT
3161 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
3162 + return 1;
3163 +#endif
3164 +
3165 + do { /* PaX: rt_sigreturn emulation */
3166 + unsigned int ldi1, ldi2, bel, nop;
3167 +
3168 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
3169 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
3170 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
3171 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
3172 +
3173 + if (err)
3174 + break;
3175 +
3176 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
3177 + ldi2 == 0x3414015AU &&
3178 + bel == 0xE4008200U &&
3179 + nop == 0x08000240U)
3180 + {
3181 + regs->gr[25] = (ldi1 & 2) >> 1;
3182 + regs->gr[20] = __NR_rt_sigreturn;
3183 + regs->gr[31] = regs->iaoq[1] + 16;
3184 + regs->sr[0] = regs->iasq[1];
3185 + regs->iaoq[0] = 0x100UL;
3186 + regs->iaoq[1] = regs->iaoq[0] + 4;
3187 + regs->iasq[0] = regs->sr[2];
3188 + regs->iasq[1] = regs->sr[2];
3189 + return 2;
3190 + }
3191 + } while (0);
3192 +#endif
3193 +
3194 + return 1;
3195 +}
3196 +
3197 +void pax_report_insns(void *pc, void *sp)
3198 +{
3199 + unsigned long i;
3200 +
3201 + printk(KERN_ERR "PAX: bytes at PC: ");
3202 + for (i = 0; i < 5; i++) {
3203 + unsigned int c;
3204 + if (get_user(c, (unsigned int *)pc+i))
3205 + printk(KERN_CONT "???????? ");
3206 + else
3207 + printk(KERN_CONT "%08x ", c);
3208 + }
3209 + printk("\n");
3210 +}
3211 +#endif
3212 +
3213 int fixup_exception(struct pt_regs *regs)
3214 {
3215 const struct exception_table_entry *fix;
3216 @@ -192,8 +303,33 @@ good_area:
3217
3218 acc_type = parisc_acctyp(code,regs->iir);
3219
3220 - if ((vma->vm_flags & acc_type) != acc_type)
3221 + if ((vma->vm_flags & acc_type) != acc_type) {
3222 +
3223 +#ifdef CONFIG_PAX_PAGEEXEC
3224 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
3225 + (address & ~3UL) == instruction_pointer(regs))
3226 + {
3227 + up_read(&mm->mmap_sem);
3228 + switch (pax_handle_fetch_fault(regs)) {
3229 +
3230 +#ifdef CONFIG_PAX_EMUPLT
3231 + case 3:
3232 + return;
3233 +#endif
3234 +
3235 +#ifdef CONFIG_PAX_EMUTRAMP
3236 + case 2:
3237 + return;
3238 +#endif
3239 +
3240 + }
3241 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
3242 + do_group_exit(SIGKILL);
3243 + }
3244 +#endif
3245 +
3246 goto bad_area;
3247 + }
3248
3249 /*
3250 * If for any reason at all we couldn't handle the fault, make
3251 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/device.h linux-2.6.39.1/arch/powerpc/include/asm/device.h
3252 --- linux-2.6.39.1/arch/powerpc/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
3253 +++ linux-2.6.39.1/arch/powerpc/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
3254 @@ -17,7 +17,7 @@ struct device_node;
3255 */
3256 struct dev_archdata {
3257 /* DMA operations on that device */
3258 - struct dma_map_ops *dma_ops;
3259 + const struct dma_map_ops *dma_ops;
3260
3261 /*
3262 * When an iommu is in use, dma_data is used as a ptr to the base of the
3263 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h
3264 --- linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3265 +++ linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
3266 @@ -67,12 +67,13 @@ static inline unsigned long device_to_ma
3267 /*
3268 * Available generic sets of operations
3269 */
3270 +/* cannot be const */
3271 #ifdef CONFIG_PPC64
3272 -extern struct dma_map_ops dma_iommu_ops;
3273 +extern const struct dma_map_ops dma_iommu_ops;
3274 #endif
3275 -extern struct dma_map_ops dma_direct_ops;
3276 +extern const struct dma_map_ops dma_direct_ops;
3277
3278 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3279 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3280 {
3281 /* We don't handle the NULL dev case for ISA for now. We could
3282 * do it via an out of line call but it is not needed for now. The
3283 @@ -85,7 +86,7 @@ static inline struct dma_map_ops *get_dm
3284 return dev->archdata.dma_ops;
3285 }
3286
3287 -static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
3288 +static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
3289 {
3290 dev->archdata.dma_ops = ops;
3291 }
3292 @@ -119,7 +120,7 @@ static inline void set_dma_offset(struct
3293
3294 static inline int dma_supported(struct device *dev, u64 mask)
3295 {
3296 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
3297 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3298
3299 if (unlikely(dma_ops == NULL))
3300 return 0;
3301 @@ -133,7 +134,7 @@ extern int dma_set_mask(struct device *d
3302 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3303 dma_addr_t *dma_handle, gfp_t flag)
3304 {
3305 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
3306 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3307 void *cpu_addr;
3308
3309 BUG_ON(!dma_ops);
3310 @@ -148,7 +149,7 @@ static inline void *dma_alloc_coherent(s
3311 static inline void dma_free_coherent(struct device *dev, size_t size,
3312 void *cpu_addr, dma_addr_t dma_handle)
3313 {
3314 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
3315 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3316
3317 BUG_ON(!dma_ops);
3318
3319 @@ -159,7 +160,7 @@ static inline void dma_free_coherent(str
3320
3321 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
3322 {
3323 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
3324 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3325
3326 if (dma_ops->mapping_error)
3327 return dma_ops->mapping_error(dev, dma_addr);
3328 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/elf.h linux-2.6.39.1/arch/powerpc/include/asm/elf.h
3329 --- linux-2.6.39.1/arch/powerpc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
3330 +++ linux-2.6.39.1/arch/powerpc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
3331 @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
3332 the loader. We need to make sure that it is out of the way of the program
3333 that it will "exec", and that there is sufficient room for the brk. */
3334
3335 -extern unsigned long randomize_et_dyn(unsigned long base);
3336 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
3337 +#define ELF_ET_DYN_BASE (0x20000000)
3338 +
3339 +#ifdef CONFIG_PAX_ASLR
3340 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
3341 +
3342 +#ifdef __powerpc64__
3343 +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
3344 +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
3345 +#else
3346 +#define PAX_DELTA_MMAP_LEN 15
3347 +#define PAX_DELTA_STACK_LEN 15
3348 +#endif
3349 +#endif
3350
3351 /*
3352 * Our registers are always unsigned longs, whether we're a 32 bit
3353 @@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
3354 (0x7ff >> (PAGE_SHIFT - 12)) : \
3355 (0x3ffff >> (PAGE_SHIFT - 12)))
3356
3357 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
3358 -#define arch_randomize_brk arch_randomize_brk
3359 -
3360 #endif /* __KERNEL__ */
3361
3362 /*
3363 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/iommu.h linux-2.6.39.1/arch/powerpc/include/asm/iommu.h
3364 --- linux-2.6.39.1/arch/powerpc/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
3365 +++ linux-2.6.39.1/arch/powerpc/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
3366 @@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
3367 extern void iommu_init_early_dart(void);
3368 extern void iommu_init_early_pasemi(void);
3369
3370 +/* dma-iommu.c */
3371 +extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
3372 +
3373 #ifdef CONFIG_PCI
3374 extern void pci_iommu_init(void);
3375 extern void pci_direct_iommu_init(void);
3376 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h
3377 --- linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
3378 +++ linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
3379 @@ -27,6 +27,7 @@ enum km_type {
3380 KM_PPC_SYNC_PAGE,
3381 KM_PPC_SYNC_ICACHE,
3382 KM_KDB,
3383 + KM_CLEARPAGE,
3384 KM_TYPE_NR
3385 };
3386
3387 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/page_64.h linux-2.6.39.1/arch/powerpc/include/asm/page_64.h
3388 --- linux-2.6.39.1/arch/powerpc/include/asm/page_64.h 2011-05-19 00:06:34.000000000 -0400
3389 +++ linux-2.6.39.1/arch/powerpc/include/asm/page_64.h 2011-05-22 19:36:30.000000000 -0400
3390 @@ -172,15 +172,18 @@ do { \
3391 * stack by default, so in the absence of a PT_GNU_STACK program header
3392 * we turn execute permission off.
3393 */
3394 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3395 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3396 +#define VM_STACK_DEFAULT_FLAGS32 \
3397 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3398 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3399
3400 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3401 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3402
3403 +#ifndef CONFIG_PAX_PAGEEXEC
3404 #define VM_STACK_DEFAULT_FLAGS \
3405 (is_32bit_task() ? \
3406 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
3407 +#endif
3408
3409 #include <asm-generic/getorder.h>
3410
3411 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/page.h linux-2.6.39.1/arch/powerpc/include/asm/page.h
3412 --- linux-2.6.39.1/arch/powerpc/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
3413 +++ linux-2.6.39.1/arch/powerpc/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
3414 @@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
3415 * and needs to be executable. This means the whole heap ends
3416 * up being executable.
3417 */
3418 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3419 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3420 +#define VM_DATA_DEFAULT_FLAGS32 \
3421 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3422 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3423
3424 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3425 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3426 @@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
3427 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
3428 #endif
3429
3430 +#define ktla_ktva(addr) (addr)
3431 +#define ktva_ktla(addr) (addr)
3432 +
3433 #ifndef __ASSEMBLY__
3434
3435 #undef STRICT_MM_TYPECHECKS
3436 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/pci.h linux-2.6.39.1/arch/powerpc/include/asm/pci.h
3437 --- linux-2.6.39.1/arch/powerpc/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
3438 +++ linux-2.6.39.1/arch/powerpc/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
3439 @@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
3440 }
3441
3442 #ifdef CONFIG_PCI
3443 -extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
3444 -extern struct dma_map_ops *get_pci_dma_ops(void);
3445 +extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
3446 +extern const struct dma_map_ops *get_pci_dma_ops(void);
3447 #else /* CONFIG_PCI */
3448 #define set_pci_dma_ops(d)
3449 #define get_pci_dma_ops() NULL
3450 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h
3451 --- linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
3452 +++ linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
3453 @@ -2,6 +2,7 @@
3454 #define _ASM_POWERPC_PGTABLE_H
3455 #ifdef __KERNEL__
3456
3457 +#include <linux/const.h>
3458 #ifndef __ASSEMBLY__
3459 #include <asm/processor.h> /* For TASK_SIZE */
3460 #include <asm/mmu.h>
3461 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h
3462 --- linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h 2011-05-19 00:06:34.000000000 -0400
3463 +++ linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h 2011-05-22 19:36:30.000000000 -0400
3464 @@ -21,6 +21,7 @@
3465 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
3466 #define _PAGE_USER 0x004 /* usermode access allowed */
3467 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
3468 +#define _PAGE_EXEC _PAGE_GUARDED
3469 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
3470 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
3471 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
3472 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/reg.h linux-2.6.39.1/arch/powerpc/include/asm/reg.h
3473 --- linux-2.6.39.1/arch/powerpc/include/asm/reg.h 2011-05-19 00:06:34.000000000 -0400
3474 +++ linux-2.6.39.1/arch/powerpc/include/asm/reg.h 2011-05-22 19:36:30.000000000 -0400
3475 @@ -201,6 +201,7 @@
3476 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
3477 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
3478 #define DSISR_NOHPTE 0x40000000 /* no translation found */
3479 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
3480 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
3481 #define DSISR_ISSTORE 0x02000000 /* access was a store */
3482 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
3483 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h
3484 --- linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h 2011-05-19 00:06:34.000000000 -0400
3485 +++ linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h 2011-05-22 19:36:30.000000000 -0400
3486 @@ -13,7 +13,7 @@
3487
3488 #include <linux/swiotlb.h>
3489
3490 -extern struct dma_map_ops swiotlb_dma_ops;
3491 +extern const struct dma_map_ops swiotlb_dma_ops;
3492
3493 static inline void dma_mark_clean(void *addr, size_t size) {}
3494
3495 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/system.h linux-2.6.39.1/arch/powerpc/include/asm/system.h
3496 --- linux-2.6.39.1/arch/powerpc/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
3497 +++ linux-2.6.39.1/arch/powerpc/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
3498 @@ -533,7 +533,7 @@ __cmpxchg_local(volatile void *ptr, unsi
3499 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
3500 #endif
3501
3502 -extern unsigned long arch_align_stack(unsigned long sp);
3503 +#define arch_align_stack(x) ((x) & ~0xfUL)
3504
3505 /* Used in very early kernel initialization. */
3506 extern unsigned long reloc_offset(void);
3507 diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h
3508 --- linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
3509 +++ linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
3510 @@ -13,6 +13,8 @@
3511 #define VERIFY_READ 0
3512 #define VERIFY_WRITE 1
3513
3514 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
3515 +
3516 /*
3517 * The fs value determines whether argument validity checking should be
3518 * performed or not. If get_fs() == USER_DS, checking is performed, with
3519 @@ -327,52 +329,6 @@ do { \
3520 extern unsigned long __copy_tofrom_user(void __user *to,
3521 const void __user *from, unsigned long size);
3522
3523 -#ifndef __powerpc64__
3524 -
3525 -static inline unsigned long copy_from_user(void *to,
3526 - const void __user *from, unsigned long n)
3527 -{
3528 - unsigned long over;
3529 -
3530 - if (access_ok(VERIFY_READ, from, n))
3531 - return __copy_tofrom_user((__force void __user *)to, from, n);
3532 - if ((unsigned long)from < TASK_SIZE) {
3533 - over = (unsigned long)from + n - TASK_SIZE;
3534 - return __copy_tofrom_user((__force void __user *)to, from,
3535 - n - over) + over;
3536 - }
3537 - return n;
3538 -}
3539 -
3540 -static inline unsigned long copy_to_user(void __user *to,
3541 - const void *from, unsigned long n)
3542 -{
3543 - unsigned long over;
3544 -
3545 - if (access_ok(VERIFY_WRITE, to, n))
3546 - return __copy_tofrom_user(to, (__force void __user *)from, n);
3547 - if ((unsigned long)to < TASK_SIZE) {
3548 - over = (unsigned long)to + n - TASK_SIZE;
3549 - return __copy_tofrom_user(to, (__force void __user *)from,
3550 - n - over) + over;
3551 - }
3552 - return n;
3553 -}
3554 -
3555 -#else /* __powerpc64__ */
3556 -
3557 -#define __copy_in_user(to, from, size) \
3558 - __copy_tofrom_user((to), (from), (size))
3559 -
3560 -extern unsigned long copy_from_user(void *to, const void __user *from,
3561 - unsigned long n);
3562 -extern unsigned long copy_to_user(void __user *to, const void *from,
3563 - unsigned long n);
3564 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
3565 - unsigned long n);
3566 -
3567 -#endif /* __powerpc64__ */
3568 -
3569 static inline unsigned long __copy_from_user_inatomic(void *to,
3570 const void __user *from, unsigned long n)
3571 {
3572 @@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
3573 if (ret == 0)
3574 return 0;
3575 }
3576 +
3577 + if (!__builtin_constant_p(n))
3578 + check_object_size(to, n, false);
3579 +
3580 return __copy_tofrom_user((__force void __user *)to, from, n);
3581 }
3582
3583 @@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
3584 if (ret == 0)
3585 return 0;
3586 }
3587 +
3588 + if (!__builtin_constant_p(n))
3589 + check_object_size(from, n, true);
3590 +
3591 return __copy_tofrom_user(to, (__force const void __user *)from, n);
3592 }
3593
3594 @@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
3595 return __copy_to_user_inatomic(to, from, size);
3596 }
3597
3598 +#ifndef __powerpc64__
3599 +
3600 +static inline unsigned long __must_check copy_from_user(void *to,
3601 + const void __user *from, unsigned long n)
3602 +{
3603 + unsigned long over;
3604 +
3605 + if ((long)n < 0)
3606 + return n;
3607 +
3608 + if (access_ok(VERIFY_READ, from, n)) {
3609 + if (!__builtin_constant_p(n))
3610 + check_object_size(to, n, false);
3611 + return __copy_tofrom_user((__force void __user *)to, from, n);
3612 + }
3613 + if ((unsigned long)from < TASK_SIZE) {
3614 + over = (unsigned long)from + n - TASK_SIZE;
3615 + if (!__builtin_constant_p(n - over))
3616 + check_object_size(to, n - over, false);
3617 + return __copy_tofrom_user((__force void __user *)to, from,
3618 + n - over) + over;
3619 + }
3620 + return n;
3621 +}
3622 +
3623 +static inline unsigned long __must_check copy_to_user(void __user *to,
3624 + const void *from, unsigned long n)
3625 +{
3626 + unsigned long over;
3627 +
3628 + if ((long)n < 0)
3629 + return n;
3630 +
3631 + if (access_ok(VERIFY_WRITE, to, n)) {
3632 + if (!__builtin_constant_p(n))
3633 + check_object_size(from, n, true);
3634 + return __copy_tofrom_user(to, (__force void __user *)from, n);
3635 + }
3636 + if ((unsigned long)to < TASK_SIZE) {
3637 + over = (unsigned long)to + n - TASK_SIZE;
3638 + if (!__builtin_constant_p(n))
3639 + check_object_size(from, n - over, true);
3640 + return __copy_tofrom_user(to, (__force void __user *)from,
3641 + n - over) + over;
3642 + }
3643 + return n;
3644 +}
3645 +
3646 +#else /* __powerpc64__ */
3647 +
3648 +#define __copy_in_user(to, from, size) \
3649 + __copy_tofrom_user((to), (from), (size))
3650 +
3651 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
3652 +{
3653 + if ((long)n < 0 || n > INT_MAX)
3654 + return n;
3655 +
3656 + if (!__builtin_constant_p(n))
3657 + check_object_size(to, n, false);
3658 +
3659 + if (likely(access_ok(VERIFY_READ, from, n)))
3660 + n = __copy_from_user(to, from, n);
3661 + else
3662 + memset(to, 0, n);
3663 + return n;
3664 +}
3665 +
3666 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
3667 +{
3668 + if ((long)n < 0 || n > INT_MAX)
3669 + return n;
3670 +
3671 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
3672 + if (!__builtin_constant_p(n))
3673 + check_object_size(from, n, true);
3674 + n = __copy_to_user(to, from, n);
3675 + }
3676 + return n;
3677 +}
3678 +
3679 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
3680 + unsigned long n);
3681 +
3682 +#endif /* __powerpc64__ */
3683 +
3684 extern unsigned long __clear_user(void __user *addr, unsigned long size);
3685
3686 static inline unsigned long clear_user(void __user *addr, unsigned long size)
3687 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/dma.c linux-2.6.39.1/arch/powerpc/kernel/dma.c
3688 --- linux-2.6.39.1/arch/powerpc/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
3689 +++ linux-2.6.39.1/arch/powerpc/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
3690 @@ -136,7 +136,7 @@ static inline void dma_direct_sync_singl
3691 }
3692 #endif
3693
3694 -struct dma_map_ops dma_direct_ops = {
3695 +const struct dma_map_ops dma_direct_ops = {
3696 .alloc_coherent = dma_direct_alloc_coherent,
3697 .free_coherent = dma_direct_free_coherent,
3698 .map_sg = dma_direct_map_sg,
3699 @@ -157,7 +157,7 @@ EXPORT_SYMBOL(dma_direct_ops);
3700
3701 int dma_set_mask(struct device *dev, u64 dma_mask)
3702 {
3703 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
3704 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3705
3706 if (ppc_md.dma_set_mask)
3707 return ppc_md.dma_set_mask(dev, dma_mask);
3708 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c
3709 --- linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c 2011-05-19 00:06:34.000000000 -0400
3710 +++ linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c 2011-05-22 19:36:30.000000000 -0400
3711 @@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
3712 }
3713
3714 /* We support DMA to/from any memory page via the iommu */
3715 -static int dma_iommu_dma_supported(struct device *dev, u64 mask)
3716 +int dma_iommu_dma_supported(struct device *dev, u64 mask)
3717 {
3718 struct iommu_table *tbl = get_iommu_table_base(dev);
3719
3720 @@ -90,7 +90,7 @@ static int dma_iommu_dma_supported(struc
3721 return 1;
3722 }
3723
3724 -struct dma_map_ops dma_iommu_ops = {
3725 +struct dma_map_ops dma_iommu_ops = { /* cannot be const, see arch/powerpc/platforms/cell/iommu.c */
3726 .alloc_coherent = dma_iommu_alloc_coherent,
3727 .free_coherent = dma_iommu_free_coherent,
3728 .map_sg = dma_iommu_map_sg,
3729 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c
3730 --- linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
3731 +++ linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
3732 @@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
3733 * map_page, and unmap_page on highmem, use normal dma_ops
3734 * for everything else.
3735 */
3736 -struct dma_map_ops swiotlb_dma_ops = {
3737 +const struct dma_map_ops swiotlb_dma_ops = {
3738 .alloc_coherent = dma_direct_alloc_coherent,
3739 .free_coherent = dma_direct_free_coherent,
3740 .map_sg = swiotlb_map_sg_attrs,
3741 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S
3742 --- linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S 2011-05-19 00:06:34.000000000 -0400
3743 +++ linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S 2011-05-22 19:36:30.000000000 -0400
3744 @@ -495,6 +495,7 @@ storage_fault_common:
3745 std r14,_DAR(r1)
3746 std r15,_DSISR(r1)
3747 addi r3,r1,STACK_FRAME_OVERHEAD
3748 + bl .save_nvgprs
3749 mr r4,r14
3750 mr r5,r15
3751 ld r14,PACA_EXGEN+EX_R14(r13)
3752 @@ -504,8 +505,7 @@ storage_fault_common:
3753 cmpdi r3,0
3754 bne- 1f
3755 b .ret_from_except_lite
3756 -1: bl .save_nvgprs
3757 - mr r5,r3
3758 +1: mr r5,r3
3759 addi r3,r1,STACK_FRAME_OVERHEAD
3760 ld r4,_DAR(r1)
3761 bl .bad_page_fault
3762 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S
3763 --- linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S 2011-05-19 00:06:34.000000000 -0400
3764 +++ linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S 2011-05-22 19:36:30.000000000 -0400
3765 @@ -848,10 +848,10 @@ handle_page_fault:
3766 11: ld r4,_DAR(r1)
3767 ld r5,_DSISR(r1)
3768 addi r3,r1,STACK_FRAME_OVERHEAD
3769 + bl .save_nvgprs
3770 bl .do_page_fault
3771 cmpdi r3,0
3772 beq+ 13f
3773 - bl .save_nvgprs
3774 mr r5,r3
3775 addi r3,r1,STACK_FRAME_OVERHEAD
3776 lwz r4,_DAR(r1)
3777 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c
3778 --- linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c 2011-05-19 00:06:34.000000000 -0400
3779 +++ linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c 2011-05-22 19:36:30.000000000 -0400
3780 @@ -128,7 +128,7 @@ static int ibmebus_dma_supported(struct
3781 return 1;
3782 }
3783
3784 -static struct dma_map_ops ibmebus_dma_ops = {
3785 +static const struct dma_map_ops ibmebus_dma_ops = {
3786 .alloc_coherent = ibmebus_alloc_coherent,
3787 .free_coherent = ibmebus_free_coherent,
3788 .map_sg = ibmebus_map_sg,
3789 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/kgdb.c linux-2.6.39.1/arch/powerpc/kernel/kgdb.c
3790 --- linux-2.6.39.1/arch/powerpc/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
3791 +++ linux-2.6.39.1/arch/powerpc/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
3792 @@ -422,7 +422,7 @@ int kgdb_arch_handle_exception(int vecto
3793 /*
3794 * Global data
3795 */
3796 -struct kgdb_arch arch_kgdb_ops = {
3797 +const struct kgdb_arch arch_kgdb_ops = {
3798 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
3799 };
3800
3801 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/module_32.c linux-2.6.39.1/arch/powerpc/kernel/module_32.c
3802 --- linux-2.6.39.1/arch/powerpc/kernel/module_32.c 2011-05-19 00:06:34.000000000 -0400
3803 +++ linux-2.6.39.1/arch/powerpc/kernel/module_32.c 2011-05-22 19:36:30.000000000 -0400
3804 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
3805 me->arch.core_plt_section = i;
3806 }
3807 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
3808 - printk("Module doesn't contain .plt or .init.plt sections.\n");
3809 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
3810 return -ENOEXEC;
3811 }
3812
3813 @@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
3814
3815 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
3816 /* Init, or core PLT? */
3817 - if (location >= mod->module_core
3818 - && location < mod->module_core + mod->core_size)
3819 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
3820 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
3821 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
3822 - else
3823 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
3824 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
3825 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
3826 + else {
3827 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
3828 + return ~0UL;
3829 + }
3830
3831 /* Find this entry, or if that fails, the next avail. entry */
3832 while (entry->jump[0]) {
3833 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/module.c linux-2.6.39.1/arch/powerpc/kernel/module.c
3834 --- linux-2.6.39.1/arch/powerpc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
3835 +++ linux-2.6.39.1/arch/powerpc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
3836 @@ -31,11 +31,24 @@
3837
3838 LIST_HEAD(module_bug_list);
3839
3840 +#ifdef CONFIG_PAX_KERNEXEC
3841 void *module_alloc(unsigned long size)
3842 {
3843 if (size == 0)
3844 return NULL;
3845
3846 + return vmalloc(size);
3847 +}
3848 +
3849 +void *module_alloc_exec(unsigned long size)
3850 +#else
3851 +void *module_alloc(unsigned long size)
3852 +#endif
3853 +
3854 +{
3855 + if (size == 0)
3856 + return NULL;
3857 +
3858 return vmalloc_exec(size);
3859 }
3860
3861 @@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
3862 vfree(module_region);
3863 }
3864
3865 +#ifdef CONFIG_PAX_KERNEXEC
3866 +void module_free_exec(struct module *mod, void *module_region)
3867 +{
3868 + module_free(mod, module_region);
3869 +}
3870 +#endif
3871 +
3872 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
3873 const Elf_Shdr *sechdrs,
3874 const char *name)
3875 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/pci-common.c linux-2.6.39.1/arch/powerpc/kernel/pci-common.c
3876 --- linux-2.6.39.1/arch/powerpc/kernel/pci-common.c 2011-05-19 00:06:34.000000000 -0400
3877 +++ linux-2.6.39.1/arch/powerpc/kernel/pci-common.c 2011-05-22 19:36:30.000000000 -0400
3878 @@ -53,14 +53,14 @@ resource_size_t isa_mem_base;
3879 unsigned int ppc_pci_flags = 0;
3880
3881
3882 -static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3883 +static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3884
3885 -void set_pci_dma_ops(struct dma_map_ops *dma_ops)
3886 +void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
3887 {
3888 pci_dma_ops = dma_ops;
3889 }
3890
3891 -struct dma_map_ops *get_pci_dma_ops(void)
3892 +const struct dma_map_ops *get_pci_dma_ops(void)
3893 {
3894 return pci_dma_ops;
3895 }
3896 @@ -1639,7 +1639,7 @@ null_write_config(struct pci_bus *bus, u
3897 return PCIBIOS_DEVICE_NOT_FOUND;
3898 }
3899
3900 -static struct pci_ops null_pci_ops =
3901 +static const struct pci_ops null_pci_ops =
3902 {
3903 .read = null_read_config,
3904 .write = null_write_config,
3905 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/process.c linux-2.6.39.1/arch/powerpc/kernel/process.c
3906 --- linux-2.6.39.1/arch/powerpc/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
3907 +++ linux-2.6.39.1/arch/powerpc/kernel/process.c 2011-05-22 19:41:32.000000000 -0400
3908 @@ -655,8 +655,8 @@ void show_regs(struct pt_regs * regs)
3909 * Lookup NIP late so we have the best change of getting the
3910 * above info out without failing
3911 */
3912 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
3913 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
3914 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
3915 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
3916 #endif
3917 show_stack(current, (unsigned long *) regs->gpr[1]);
3918 if (!user_mode(regs))
3919 @@ -1146,10 +1146,10 @@ void show_stack(struct task_struct *tsk,
3920 newsp = stack[0];
3921 ip = stack[STACK_FRAME_LR_SAVE];
3922 if (!firstframe || ip != lr) {
3923 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
3924 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
3925 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
3926 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
3927 - printk(" (%pS)",
3928 + printk(" (%pA)",
3929 (void *)current->ret_stack[curr_frame].ret);
3930 curr_frame--;
3931 }
3932 @@ -1169,7 +1169,7 @@ void show_stack(struct task_struct *tsk,
3933 struct pt_regs *regs = (struct pt_regs *)
3934 (sp + STACK_FRAME_OVERHEAD);
3935 lr = regs->link;
3936 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
3937 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
3938 regs->trap, (void *)regs->nip, (void *)lr);
3939 firstframe = 1;
3940 }
3941 @@ -1244,58 +1244,3 @@ void thread_info_cache_init(void)
3942 }
3943
3944 #endif /* THREAD_SHIFT < PAGE_SHIFT */
3945 -
3946 -unsigned long arch_align_stack(unsigned long sp)
3947 -{
3948 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3949 - sp -= get_random_int() & ~PAGE_MASK;
3950 - return sp & ~0xf;
3951 -}
3952 -
3953 -static inline unsigned long brk_rnd(void)
3954 -{
3955 - unsigned long rnd = 0;
3956 -
3957 - /* 8MB for 32bit, 1GB for 64bit */
3958 - if (is_32bit_task())
3959 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
3960 - else
3961 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
3962 -
3963 - return rnd << PAGE_SHIFT;
3964 -}
3965 -
3966 -unsigned long arch_randomize_brk(struct mm_struct *mm)
3967 -{
3968 - unsigned long base = mm->brk;
3969 - unsigned long ret;
3970 -
3971 -#ifdef CONFIG_PPC_STD_MMU_64
3972 - /*
3973 - * If we are using 1TB segments and we are allowed to randomise
3974 - * the heap, we can put it above 1TB so it is backed by a 1TB
3975 - * segment. Otherwise the heap will be in the bottom 1TB
3976 - * which always uses 256MB segments and this may result in a
3977 - * performance penalty.
3978 - */
3979 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
3980 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
3981 -#endif
3982 -
3983 - ret = PAGE_ALIGN(base + brk_rnd());
3984 -
3985 - if (ret < mm->brk)
3986 - return mm->brk;
3987 -
3988 - return ret;
3989 -}
3990 -
3991 -unsigned long randomize_et_dyn(unsigned long base)
3992 -{
3993 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3994 -
3995 - if (ret < base)
3996 - return base;
3997 -
3998 - return ret;
3999 -}
4000 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c
4001 --- linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c 2011-05-19 00:06:34.000000000 -0400
4002 +++ linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c 2011-05-22 19:36:30.000000000 -0400
4003 @@ -149,7 +149,7 @@ static int rtas_pci_write_config(struct
4004 return PCIBIOS_DEVICE_NOT_FOUND;
4005 }
4006
4007 -static struct pci_ops rtas_pci_ops = {
4008 +static const struct pci_ops rtas_pci_ops = {
4009 .read = rtas_pci_read_config,
4010 .write = rtas_pci_write_config,
4011 };
4012 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/signal_32.c linux-2.6.39.1/arch/powerpc/kernel/signal_32.c
4013 --- linux-2.6.39.1/arch/powerpc/kernel/signal_32.c 2011-05-19 00:06:34.000000000 -0400
4014 +++ linux-2.6.39.1/arch/powerpc/kernel/signal_32.c 2011-05-22 19:36:30.000000000 -0400
4015 @@ -858,7 +858,7 @@ int handle_rt_signal32(unsigned long sig
4016 /* Save user registers on the stack */
4017 frame = &rt_sf->uc.uc_mcontext;
4018 addr = frame;
4019 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
4020 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
4021 if (save_user_regs(regs, frame, 0, 1))
4022 goto badframe;
4023 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
4024 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/signal_64.c linux-2.6.39.1/arch/powerpc/kernel/signal_64.c
4025 --- linux-2.6.39.1/arch/powerpc/kernel/signal_64.c 2011-05-19 00:06:34.000000000 -0400
4026 +++ linux-2.6.39.1/arch/powerpc/kernel/signal_64.c 2011-05-22 19:36:30.000000000 -0400
4027 @@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
4028 current->thread.fpscr.val = 0;
4029
4030 /* Set up to return from userspace. */
4031 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
4032 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
4033 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
4034 } else {
4035 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
4036 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/traps.c linux-2.6.39.1/arch/powerpc/kernel/traps.c
4037 --- linux-2.6.39.1/arch/powerpc/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
4038 +++ linux-2.6.39.1/arch/powerpc/kernel/traps.c 2011-06-13 21:33:04.000000000 -0400
4039 @@ -96,6 +96,8 @@ static void pmac_backlight_unblank(void)
4040 static inline void pmac_backlight_unblank(void) { }
4041 #endif
4042
4043 +extern void gr_handle_kernel_exploit(void);
4044 +
4045 int die(const char *str, struct pt_regs *regs, long err)
4046 {
4047 static struct {
4048 @@ -170,6 +172,8 @@ int die(const char *str, struct pt_regs
4049 if (panic_on_oops)
4050 panic("Fatal exception");
4051
4052 + gr_handle_kernel_exploit();
4053 +
4054 oops_exit();
4055 do_exit(err);
4056
4057 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/vdso.c linux-2.6.39.1/arch/powerpc/kernel/vdso.c
4058 --- linux-2.6.39.1/arch/powerpc/kernel/vdso.c 2011-05-19 00:06:34.000000000 -0400
4059 +++ linux-2.6.39.1/arch/powerpc/kernel/vdso.c 2011-05-22 19:36:30.000000000 -0400
4060 @@ -36,6 +36,7 @@
4061 #include <asm/firmware.h>
4062 #include <asm/vdso.h>
4063 #include <asm/vdso_datapage.h>
4064 +#include <asm/mman.h>
4065
4066 #include "setup.h"
4067
4068 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
4069 vdso_base = VDSO32_MBASE;
4070 #endif
4071
4072 - current->mm->context.vdso_base = 0;
4073 + current->mm->context.vdso_base = ~0UL;
4074
4075 /* vDSO has a problem and was disabled, just don't "enable" it for the
4076 * process
4077 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
4078 vdso_base = get_unmapped_area(NULL, vdso_base,
4079 (vdso_pages << PAGE_SHIFT) +
4080 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
4081 - 0, 0);
4082 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
4083 if (IS_ERR_VALUE(vdso_base)) {
4084 rc = vdso_base;
4085 goto fail_mmapsem;
4086 diff -urNp linux-2.6.39.1/arch/powerpc/kernel/vio.c linux-2.6.39.1/arch/powerpc/kernel/vio.c
4087 --- linux-2.6.39.1/arch/powerpc/kernel/vio.c 2011-05-19 00:06:34.000000000 -0400
4088 +++ linux-2.6.39.1/arch/powerpc/kernel/vio.c 2011-05-22 19:36:30.000000000 -0400
4089 @@ -605,11 +605,12 @@ static int vio_dma_iommu_dma_supported(s
4090 return dma_iommu_ops.dma_supported(dev, mask);
4091 }
4092
4093 -struct dma_map_ops vio_dma_mapping_ops = {
4094 +const struct dma_map_ops vio_dma_mapping_ops = {
4095 .alloc_coherent = vio_dma_iommu_alloc_coherent,
4096 .free_coherent = vio_dma_iommu_free_coherent,
4097 .map_sg = vio_dma_iommu_map_sg,
4098 .unmap_sg = vio_dma_iommu_unmap_sg,
4099 + .dma_supported = dma_iommu_dma_supported,
4100 .map_page = vio_dma_iommu_map_page,
4101 .unmap_page = vio_dma_iommu_unmap_page,
4102 .dma_supported = vio_dma_iommu_dma_supported,
4103 diff -urNp linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c
4104 --- linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
4105 +++ linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
4106 @@ -9,22 +9,6 @@
4107 #include <linux/module.h>
4108 #include <asm/uaccess.h>
4109
4110 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4111 -{
4112 - if (likely(access_ok(VERIFY_READ, from, n)))
4113 - n = __copy_from_user(to, from, n);
4114 - else
4115 - memset(to, 0, n);
4116 - return n;
4117 -}
4118 -
4119 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4120 -{
4121 - if (likely(access_ok(VERIFY_WRITE, to, n)))
4122 - n = __copy_to_user(to, from, n);
4123 - return n;
4124 -}
4125 -
4126 unsigned long copy_in_user(void __user *to, const void __user *from,
4127 unsigned long n)
4128 {
4129 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
4130 return n;
4131 }
4132
4133 -EXPORT_SYMBOL(copy_from_user);
4134 -EXPORT_SYMBOL(copy_to_user);
4135 EXPORT_SYMBOL(copy_in_user);
4136
4137 diff -urNp linux-2.6.39.1/arch/powerpc/mm/fault.c linux-2.6.39.1/arch/powerpc/mm/fault.c
4138 --- linux-2.6.39.1/arch/powerpc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
4139 +++ linux-2.6.39.1/arch/powerpc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
4140 @@ -31,6 +31,10 @@
4141 #include <linux/kdebug.h>
4142 #include <linux/perf_event.h>
4143 #include <linux/magic.h>
4144 +#include <linux/slab.h>
4145 +#include <linux/pagemap.h>
4146 +#include <linux/compiler.h>
4147 +#include <linux/unistd.h>
4148
4149 #include <asm/firmware.h>
4150 #include <asm/page.h>
4151 @@ -42,6 +46,7 @@
4152 #include <asm/tlbflush.h>
4153 #include <asm/siginfo.h>
4154 #include <mm/mmu_decl.h>
4155 +#include <asm/ptrace.h>
4156
4157 #ifdef CONFIG_KPROBES
4158 static inline int notify_page_fault(struct pt_regs *regs)
4159 @@ -65,6 +70,33 @@ static inline int notify_page_fault(stru
4160 }
4161 #endif
4162
4163 +#ifdef CONFIG_PAX_PAGEEXEC
4164 +/*
4165 + * PaX: decide what to do with offenders (regs->nip = fault address)
4166 + *
4167 + * returns 1 when task should be killed
4168 + */
4169 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4170 +{
4171 + return 1;
4172 +}
4173 +
4174 +void pax_report_insns(void *pc, void *sp)
4175 +{
4176 + unsigned long i;
4177 +
4178 + printk(KERN_ERR "PAX: bytes at PC: ");
4179 + for (i = 0; i < 5; i++) {
4180 + unsigned int c;
4181 + if (get_user(c, (unsigned int __user *)pc+i))
4182 + printk(KERN_CONT "???????? ");
4183 + else
4184 + printk(KERN_CONT "%08x ", c);
4185 + }
4186 + printk("\n");
4187 +}
4188 +#endif
4189 +
4190 /*
4191 * Check whether the instruction at regs->nip is a store using
4192 * an update addressing form which will update r1.
4193 @@ -135,7 +167,7 @@ int __kprobes do_page_fault(struct pt_re
4194 * indicate errors in DSISR but can validly be set in SRR1.
4195 */
4196 if (trap == 0x400)
4197 - error_code &= 0x48200000;
4198 + error_code &= 0x58200000;
4199 else
4200 is_write = error_code & DSISR_ISSTORE;
4201 #else
4202 @@ -258,7 +290,7 @@ good_area:
4203 * "undefined". Of those that can be set, this is the only
4204 * one which seems bad.
4205 */
4206 - if (error_code & 0x10000000)
4207 + if (error_code & DSISR_GUARDED)
4208 /* Guarded storage error. */
4209 goto bad_area;
4210 #endif /* CONFIG_8xx */
4211 @@ -273,7 +305,7 @@ good_area:
4212 * processors use the same I/D cache coherency mechanism
4213 * as embedded.
4214 */
4215 - if (error_code & DSISR_PROTFAULT)
4216 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
4217 goto bad_area;
4218 #endif /* CONFIG_PPC_STD_MMU */
4219
4220 @@ -342,6 +374,23 @@ bad_area:
4221 bad_area_nosemaphore:
4222 /* User mode accesses cause a SIGSEGV */
4223 if (user_mode(regs)) {
4224 +
4225 +#ifdef CONFIG_PAX_PAGEEXEC
4226 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
4227 +#ifdef CONFIG_PPC_STD_MMU
4228 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
4229 +#else
4230 + if (is_exec && regs->nip == address) {
4231 +#endif
4232 + switch (pax_handle_fetch_fault(regs)) {
4233 + }
4234 +
4235 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
4236 + do_group_exit(SIGKILL);
4237 + }
4238 + }
4239 +#endif
4240 +
4241 _exception(SIGSEGV, regs, code, address);
4242 return 0;
4243 }
4244 diff -urNp linux-2.6.39.1/arch/powerpc/mm/mmap_64.c linux-2.6.39.1/arch/powerpc/mm/mmap_64.c
4245 --- linux-2.6.39.1/arch/powerpc/mm/mmap_64.c 2011-05-19 00:06:34.000000000 -0400
4246 +++ linux-2.6.39.1/arch/powerpc/mm/mmap_64.c 2011-05-22 19:36:30.000000000 -0400
4247 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
4248 */
4249 if (mmap_is_legacy()) {
4250 mm->mmap_base = TASK_UNMAPPED_BASE;
4251 +
4252 +#ifdef CONFIG_PAX_RANDMMAP
4253 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4254 + mm->mmap_base += mm->delta_mmap;
4255 +#endif
4256 +
4257 mm->get_unmapped_area = arch_get_unmapped_area;
4258 mm->unmap_area = arch_unmap_area;
4259 } else {
4260 mm->mmap_base = mmap_base();
4261 +
4262 +#ifdef CONFIG_PAX_RANDMMAP
4263 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4264 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4265 +#endif
4266 +
4267 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4268 mm->unmap_area = arch_unmap_area_topdown;
4269 }
4270 diff -urNp linux-2.6.39.1/arch/powerpc/mm/slice.c linux-2.6.39.1/arch/powerpc/mm/slice.c
4271 --- linux-2.6.39.1/arch/powerpc/mm/slice.c 2011-05-19 00:06:34.000000000 -0400
4272 +++ linux-2.6.39.1/arch/powerpc/mm/slice.c 2011-05-22 19:36:30.000000000 -0400
4273 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
4274 if ((mm->task_size - len) < addr)
4275 return 0;
4276 vma = find_vma(mm, addr);
4277 - return (!vma || (addr + len) <= vma->vm_start);
4278 + return check_heap_stack_gap(vma, addr, len);
4279 }
4280
4281 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
4282 @@ -256,7 +256,7 @@ full_search:
4283 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
4284 continue;
4285 }
4286 - if (!vma || addr + len <= vma->vm_start) {
4287 + if (check_heap_stack_gap(vma, addr, len)) {
4288 /*
4289 * Remember the place where we stopped the search:
4290 */
4291 @@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
4292 }
4293 }
4294
4295 - addr = mm->mmap_base;
4296 - while (addr > len) {
4297 + if (mm->mmap_base < len)
4298 + addr = -ENOMEM;
4299 + else
4300 + addr = mm->mmap_base - len;
4301 +
4302 + while (!IS_ERR_VALUE(addr)) {
4303 /* Go down by chunk size */
4304 - addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
4305 + addr = _ALIGN_DOWN(addr, 1ul << pshift);
4306
4307 /* Check for hit with different page size */
4308 mask = slice_range_to_mask(addr, len);
4309 @@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
4310 * return with success:
4311 */
4312 vma = find_vma(mm, addr);
4313 - if (!vma || (addr + len) <= vma->vm_start) {
4314 + if (check_heap_stack_gap(vma, addr, len)) {
4315 /* remember the address as a hint for next time */
4316 if (use_cache)
4317 mm->free_area_cache = addr;
4318 @@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
4319 mm->cached_hole_size = vma->vm_start - addr;
4320
4321 /* try just below the current vma->vm_start */
4322 - addr = vma->vm_start;
4323 + addr = skip_heap_stack_gap(vma, len);
4324 }
4325
4326 /*
4327 @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
4328 if (fixed && addr > (mm->task_size - len))
4329 return -EINVAL;
4330
4331 +#ifdef CONFIG_PAX_RANDMMAP
4332 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
4333 + addr = 0;
4334 +#endif
4335 +
4336 /* If hint, make sure it matches our alignment restrictions */
4337 if (!fixed && addr) {
4338 addr = _ALIGN_UP(addr, 1ul << pshift);
4339 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c
4340 --- linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c 2011-05-19 00:06:34.000000000 -0400
4341 +++ linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c 2011-05-22 19:36:30.000000000 -0400
4342 @@ -60,7 +60,7 @@ static int rtas_write_config(struct pci_
4343 return rval ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
4344 }
4345
4346 -static struct pci_ops rtas_pci_ops = {
4347 +static const struct pci_ops rtas_pci_ops = {
4348 .read = rtas_read_config,
4349 .write = rtas_write_config,
4350 };
4351 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c
4352 --- linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-19 00:06:34.000000000 -0400
4353 +++ linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-22 19:36:30.000000000 -0400
4354 @@ -234,7 +234,7 @@ static int celleb_fake_pci_write_config(
4355 return PCIBIOS_SUCCESSFUL;
4356 }
4357
4358 -static struct pci_ops celleb_fake_pci_ops = {
4359 +static const struct pci_ops celleb_fake_pci_ops = {
4360 .read = celleb_fake_pci_read_config,
4361 .write = celleb_fake_pci_write_config,
4362 };
4363 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c
4364 --- linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-19 00:06:34.000000000 -0400
4365 +++ linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-22 19:36:30.000000000 -0400
4366 @@ -245,7 +245,7 @@ static int celleb_epci_write_config(stru
4367 return celleb_epci_check_abort(hose, addr);
4368 }
4369
4370 -struct pci_ops celleb_epci_ops = {
4371 +const struct pci_ops celleb_epci_ops = {
4372 .read = celleb_epci_read_config,
4373 .write = celleb_epci_write_config,
4374 };
4375 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c
4376 --- linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-19 00:06:34.000000000 -0400
4377 +++ linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-22 19:36:30.000000000 -0400
4378 @@ -399,7 +399,7 @@ static int scc_pciex_write_config(struct
4379 return PCIBIOS_SUCCESSFUL;
4380 }
4381
4382 -static struct pci_ops scc_pciex_pci_ops = {
4383 +static const struct pci_ops scc_pciex_pci_ops = {
4384 scc_pciex_read_config,
4385 scc_pciex_write_config,
4386 };
4387 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c
4388 --- linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c 2011-05-19 00:06:34.000000000 -0400
4389 +++ linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c 2011-05-22 19:36:30.000000000 -0400
4390 @@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
4391
4392 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
4393
4394 -struct dma_map_ops dma_iommu_fixed_ops = {
4395 +const struct dma_map_ops dma_iommu_fixed_ops = {
4396 .alloc_coherent = dma_fixed_alloc_coherent,
4397 .free_coherent = dma_fixed_free_coherent,
4398 .map_sg = dma_fixed_map_sg,
4399 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c
4400 --- linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c 2011-05-19 00:06:34.000000000 -0400
4401 +++ linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c 2011-05-22 19:36:30.000000000 -0400
4402 @@ -84,7 +84,7 @@ int gg2_write_config(struct pci_bus *bus
4403 return PCIBIOS_SUCCESSFUL;
4404 }
4405
4406 -static struct pci_ops gg2_pci_ops =
4407 +static const struct pci_ops gg2_pci_ops =
4408 {
4409 .read = gg2_read_config,
4410 .write = gg2_write_config,
4411 @@ -122,7 +122,7 @@ int rtas_write_config(struct pci_bus *bu
4412 return rval? PCIBIOS_DEVICE_NOT_FOUND: PCIBIOS_SUCCESSFUL;
4413 }
4414
4415 -static struct pci_ops rtas_pci_ops =
4416 +static const struct pci_ops rtas_pci_ops =
4417 {
4418 .read = rtas_read_config,
4419 .write = rtas_write_config,
4420 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c
4421 --- linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c 2011-05-19 00:06:34.000000000 -0400
4422 +++ linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c 2011-05-22 19:36:30.000000000 -0400
4423 @@ -533,7 +533,7 @@ static int iSeries_pci_write_config(stru
4424 return 0;
4425 }
4426
4427 -static struct pci_ops iSeries_pci_ops = {
4428 +static const struct pci_ops iSeries_pci_ops = {
4429 .read = iSeries_pci_read_config,
4430 .write = iSeries_pci_write_config
4431 };
4432 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c
4433 --- linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c 2011-05-19 00:06:34.000000000 -0400
4434 +++ linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c 2011-05-22 19:36:30.000000000 -0400
4435 @@ -180,7 +180,7 @@ static int u3_agp_write_config(struct pc
4436 return PCIBIOS_SUCCESSFUL;
4437 }
4438
4439 -static struct pci_ops u3_agp_pci_ops =
4440 +static const struct pci_ops u3_agp_pci_ops =
4441 {
4442 .read = u3_agp_read_config,
4443 .write = u3_agp_write_config,
4444 @@ -276,7 +276,7 @@ static int u3_ht_write_config(struct pci
4445 return PCIBIOS_SUCCESSFUL;
4446 }
4447
4448 -static struct pci_ops u3_ht_pci_ops =
4449 +static const struct pci_ops u3_ht_pci_ops =
4450 {
4451 .read = u3_ht_read_config,
4452 .write = u3_ht_write_config,
4453 @@ -381,7 +381,7 @@ static int u4_pcie_write_config(struct p
4454 return PCIBIOS_SUCCESSFUL;
4455 }
4456
4457 -static struct pci_ops u4_pcie_pci_ops =
4458 +static const struct pci_ops u4_pcie_pci_ops =
4459 {
4460 .read = u4_pcie_read_config,
4461 .write = u4_pcie_write_config,
4462 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c
4463 --- linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c 2011-05-19 00:06:34.000000000 -0400
4464 +++ linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c 2011-05-22 19:36:30.000000000 -0400
4465 @@ -176,7 +176,7 @@ static int pa_pxp_write_config(struct pc
4466 return PCIBIOS_SUCCESSFUL;
4467 }
4468
4469 -static struct pci_ops pa_pxp_ops = {
4470 +static const struct pci_ops pa_pxp_ops = {
4471 .read = pa_pxp_read_config,
4472 .write = pa_pxp_write_config,
4473 };
4474 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c
4475 --- linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c 2011-05-19 00:06:34.000000000 -0400
4476 +++ linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c 2011-05-22 19:36:30.000000000 -0400
4477 @@ -218,7 +218,7 @@ static int macrisc_write_config(struct p
4478 return PCIBIOS_SUCCESSFUL;
4479 }
4480
4481 -static struct pci_ops macrisc_pci_ops =
4482 +static const struct pci_ops macrisc_pci_ops =
4483 {
4484 .read = macrisc_read_config,
4485 .write = macrisc_write_config,
4486 @@ -273,7 +273,7 @@ chaos_write_config(struct pci_bus *bus,
4487 return macrisc_write_config(bus, devfn, offset, len, val);
4488 }
4489
4490 -static struct pci_ops chaos_pci_ops =
4491 +static const struct pci_ops chaos_pci_ops =
4492 {
4493 .read = chaos_read_config,
4494 .write = chaos_write_config,
4495 diff -urNp linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c
4496 --- linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c 2011-05-19 00:06:34.000000000 -0400
4497 +++ linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c 2011-05-22 19:36:30.000000000 -0400
4498 @@ -695,7 +695,7 @@ static int ps3_dma_supported(struct devi
4499 return mask >= DMA_BIT_MASK(32);
4500 }
4501
4502 -static struct dma_map_ops ps3_sb_dma_ops = {
4503 +static const struct dma_map_ops ps3_sb_dma_ops = {
4504 .alloc_coherent = ps3_alloc_coherent,
4505 .free_coherent = ps3_free_coherent,
4506 .map_sg = ps3_sb_map_sg,
4507 @@ -705,7 +705,7 @@ static struct dma_map_ops ps3_sb_dma_ops
4508 .unmap_page = ps3_unmap_page,
4509 };
4510
4511 -static struct dma_map_ops ps3_ioc0_dma_ops = {
4512 +static const struct dma_map_ops ps3_ioc0_dma_ops = {
4513 .alloc_coherent = ps3_alloc_coherent,
4514 .free_coherent = ps3_free_coherent,
4515 .map_sg = ps3_ioc0_map_sg,
4516 diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c
4517 --- linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c 2011-05-19 00:06:34.000000000 -0400
4518 +++ linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c 2011-05-22 19:36:30.000000000 -0400
4519 @@ -573,7 +573,7 @@ static int mpc83xx_pcie_write_config(str
4520 return PCIBIOS_SUCCESSFUL;
4521 }
4522
4523 -static struct pci_ops mpc83xx_pcie_ops = {
4524 +static const struct pci_ops mpc83xx_pcie_ops = {
4525 .read = mpc83xx_pcie_read_config,
4526 .write = mpc83xx_pcie_write_config,
4527 };
4528 diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c
4529 --- linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
4530 +++ linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
4531 @@ -148,7 +148,7 @@ indirect_write_config(struct pci_bus *bu
4532 return PCIBIOS_SUCCESSFUL;
4533 }
4534
4535 -static struct pci_ops indirect_pci_ops =
4536 +static const struct pci_ops indirect_pci_ops =
4537 {
4538 .read = indirect_read_config,
4539 .write = indirect_write_config,
4540 diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c
4541 --- linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-19 00:06:34.000000000 -0400
4542 +++ linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-22 19:36:30.000000000 -0400
4543 @@ -1514,7 +1514,7 @@ static int ppc4xx_pciex_write_config(str
4544 return PCIBIOS_SUCCESSFUL;
4545 }
4546
4547 -static struct pci_ops ppc4xx_pciex_pci_ops =
4548 +static const struct pci_ops ppc4xx_pciex_pci_ops =
4549 {
4550 .read = ppc4xx_pciex_read_config,
4551 .write = ppc4xx_pciex_write_config,
4552 diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c
4553 --- linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c 2011-05-19 00:06:34.000000000 -0400
4554 +++ linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c 2011-05-22 19:36:30.000000000 -0400
4555 @@ -190,7 +190,7 @@ void tsi108_clear_pci_cfg_error(void)
4556 tsi108_clear_pci_error(tsi108_pci_cfg_phys);
4557 }
4558
4559 -static struct pci_ops tsi108_direct_pci_ops = {
4560 +static const struct pci_ops tsi108_direct_pci_ops = {
4561 .read = tsi108_direct_read_config,
4562 .write = tsi108_direct_write_config,
4563 };
4564 diff -urNp linux-2.6.39.1/arch/s390/include/asm/elf.h linux-2.6.39.1/arch/s390/include/asm/elf.h
4565 --- linux-2.6.39.1/arch/s390/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
4566 +++ linux-2.6.39.1/arch/s390/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
4567 @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
4568 the loader. We need to make sure that it is out of the way of the program
4569 that it will "exec", and that there is sufficient room for the brk. */
4570
4571 -extern unsigned long randomize_et_dyn(unsigned long base);
4572 -#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
4573 +#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
4574 +
4575 +#ifdef CONFIG_PAX_ASLR
4576 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
4577 +
4578 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4579 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4580 +#endif
4581
4582 /* This yields a mask that user programs can use to figure out what
4583 instruction set this CPU supports. */
4584 @@ -222,7 +228,4 @@ struct linux_binprm;
4585 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
4586 int arch_setup_additional_pages(struct linux_binprm *, int);
4587
4588 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
4589 -#define arch_randomize_brk arch_randomize_brk
4590 -
4591 #endif
4592 diff -urNp linux-2.6.39.1/arch/s390/include/asm/system.h linux-2.6.39.1/arch/s390/include/asm/system.h
4593 --- linux-2.6.39.1/arch/s390/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4594 +++ linux-2.6.39.1/arch/s390/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4595 @@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co
4596 extern void (*_machine_halt)(void);
4597 extern void (*_machine_power_off)(void);
4598
4599 -extern unsigned long arch_align_stack(unsigned long sp);
4600 +#define arch_align_stack(x) ((x) & ~0xfUL)
4601
4602 static inline int tprot(unsigned long addr)
4603 {
4604 diff -urNp linux-2.6.39.1/arch/s390/include/asm/uaccess.h linux-2.6.39.1/arch/s390/include/asm/uaccess.h
4605 --- linux-2.6.39.1/arch/s390/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
4606 +++ linux-2.6.39.1/arch/s390/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
4607 @@ -234,6 +234,10 @@ static inline unsigned long __must_check
4608 copy_to_user(void __user *to, const void *from, unsigned long n)
4609 {
4610 might_fault();
4611 +
4612 + if ((long)n < 0)
4613 + return n;
4614 +
4615 if (access_ok(VERIFY_WRITE, to, n))
4616 n = __copy_to_user(to, from, n);
4617 return n;
4618 @@ -259,6 +263,9 @@ copy_to_user(void __user *to, const void
4619 static inline unsigned long __must_check
4620 __copy_from_user(void *to, const void __user *from, unsigned long n)
4621 {
4622 + if ((long)n < 0)
4623 + return n;
4624 +
4625 if (__builtin_constant_p(n) && (n <= 256))
4626 return uaccess.copy_from_user_small(n, from, to);
4627 else
4628 @@ -293,6 +300,10 @@ copy_from_user(void *to, const void __us
4629 unsigned int sz = __compiletime_object_size(to);
4630
4631 might_fault();
4632 +
4633 + if ((long)n < 0)
4634 + return n;
4635 +
4636 if (unlikely(sz != -1 && sz < n)) {
4637 copy_from_user_overflow();
4638 return n;
4639 diff -urNp linux-2.6.39.1/arch/s390/Kconfig linux-2.6.39.1/arch/s390/Kconfig
4640 --- linux-2.6.39.1/arch/s390/Kconfig 2011-05-19 00:06:34.000000000 -0400
4641 +++ linux-2.6.39.1/arch/s390/Kconfig 2011-05-22 19:36:30.000000000 -0400
4642 @@ -234,11 +234,9 @@ config S390_EXEC_PROTECT
4643 prompt "Data execute protection"
4644 help
4645 This option allows to enable a buffer overflow protection for user
4646 - space programs and it also selects the addressing mode option above.
4647 - The kernel parameter noexec=on will enable this feature and also
4648 - switch the addressing modes, default is disabled. Enabling this (via
4649 - kernel parameter) on machines earlier than IBM System z9 this will
4650 - reduce system performance.
4651 + space programs.
4652 + Enabling this (via kernel parameter) on machines earlier than IBM
4653 + System z9 this will reduce system performance.
4654
4655 comment "Code generation options"
4656
4657 diff -urNp linux-2.6.39.1/arch/s390/kernel/module.c linux-2.6.39.1/arch/s390/kernel/module.c
4658 --- linux-2.6.39.1/arch/s390/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
4659 +++ linux-2.6.39.1/arch/s390/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
4660 @@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
4661
4662 /* Increase core size by size of got & plt and set start
4663 offsets for got and plt. */
4664 - me->core_size = ALIGN(me->core_size, 4);
4665 - me->arch.got_offset = me->core_size;
4666 - me->core_size += me->arch.got_size;
4667 - me->arch.plt_offset = me->core_size;
4668 - me->core_size += me->arch.plt_size;
4669 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
4670 + me->arch.got_offset = me->core_size_rw;
4671 + me->core_size_rw += me->arch.got_size;
4672 + me->arch.plt_offset = me->core_size_rx;
4673 + me->core_size_rx += me->arch.plt_size;
4674 return 0;
4675 }
4676
4677 @@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4678 if (info->got_initialized == 0) {
4679 Elf_Addr *gotent;
4680
4681 - gotent = me->module_core + me->arch.got_offset +
4682 + gotent = me->module_core_rw + me->arch.got_offset +
4683 info->got_offset;
4684 *gotent = val;
4685 info->got_initialized = 1;
4686 @@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4687 else if (r_type == R_390_GOTENT ||
4688 r_type == R_390_GOTPLTENT)
4689 *(unsigned int *) loc =
4690 - (val + (Elf_Addr) me->module_core - loc) >> 1;
4691 + (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
4692 else if (r_type == R_390_GOT64 ||
4693 r_type == R_390_GOTPLT64)
4694 *(unsigned long *) loc = val;
4695 @@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4696 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
4697 if (info->plt_initialized == 0) {
4698 unsigned int *ip;
4699 - ip = me->module_core + me->arch.plt_offset +
4700 + ip = me->module_core_rx + me->arch.plt_offset +
4701 info->plt_offset;
4702 #ifndef CONFIG_64BIT
4703 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
4704 @@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4705 val - loc + 0xffffUL < 0x1ffffeUL) ||
4706 (r_type == R_390_PLT32DBL &&
4707 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
4708 - val = (Elf_Addr) me->module_core +
4709 + val = (Elf_Addr) me->module_core_rx +
4710 me->arch.plt_offset +
4711 info->plt_offset;
4712 val += rela->r_addend - loc;
4713 @@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4714 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
4715 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
4716 val = val + rela->r_addend -
4717 - ((Elf_Addr) me->module_core + me->arch.got_offset);
4718 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
4719 if (r_type == R_390_GOTOFF16)
4720 *(unsigned short *) loc = val;
4721 else if (r_type == R_390_GOTOFF32)
4722 @@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4723 break;
4724 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
4725 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
4726 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
4727 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
4728 rela->r_addend - loc;
4729 if (r_type == R_390_GOTPC)
4730 *(unsigned int *) loc = val;
4731 diff -urNp linux-2.6.39.1/arch/s390/kernel/process.c linux-2.6.39.1/arch/s390/kernel/process.c
4732 --- linux-2.6.39.1/arch/s390/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4733 +++ linux-2.6.39.1/arch/s390/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
4734 @@ -334,39 +334,3 @@ unsigned long get_wchan(struct task_stru
4735 }
4736 return 0;
4737 }
4738 -
4739 -unsigned long arch_align_stack(unsigned long sp)
4740 -{
4741 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4742 - sp -= get_random_int() & ~PAGE_MASK;
4743 - return sp & ~0xf;
4744 -}
4745 -
4746 -static inline unsigned long brk_rnd(void)
4747 -{
4748 - /* 8MB for 32bit, 1GB for 64bit */
4749 - if (is_32bit_task())
4750 - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
4751 - else
4752 - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
4753 -}
4754 -
4755 -unsigned long arch_randomize_brk(struct mm_struct *mm)
4756 -{
4757 - unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
4758 -
4759 - if (ret < mm->brk)
4760 - return mm->brk;
4761 - return ret;
4762 -}
4763 -
4764 -unsigned long randomize_et_dyn(unsigned long base)
4765 -{
4766 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4767 -
4768 - if (!(current->flags & PF_RANDOMIZE))
4769 - return base;
4770 - if (ret < base)
4771 - return base;
4772 - return ret;
4773 -}
4774 diff -urNp linux-2.6.39.1/arch/s390/kernel/setup.c linux-2.6.39.1/arch/s390/kernel/setup.c
4775 --- linux-2.6.39.1/arch/s390/kernel/setup.c 2011-05-19 00:06:34.000000000 -0400
4776 +++ linux-2.6.39.1/arch/s390/kernel/setup.c 2011-05-22 19:36:30.000000000 -0400
4777 @@ -271,7 +271,7 @@ static int __init early_parse_mem(char *
4778 }
4779 early_param("mem", early_parse_mem);
4780
4781 -unsigned int user_mode = HOME_SPACE_MODE;
4782 +unsigned int user_mode = SECONDARY_SPACE_MODE;
4783 EXPORT_SYMBOL_GPL(user_mode);
4784
4785 static int set_amode_and_uaccess(unsigned long user_amode,
4786 @@ -300,17 +300,6 @@ static int set_amode_and_uaccess(unsigne
4787 }
4788 }
4789
4790 -/*
4791 - * Switch kernel/user addressing modes?
4792 - */
4793 -static int __init early_parse_switch_amode(char *p)
4794 -{
4795 - if (user_mode != SECONDARY_SPACE_MODE)
4796 - user_mode = PRIMARY_SPACE_MODE;
4797 - return 0;
4798 -}
4799 -early_param("switch_amode", early_parse_switch_amode);
4800 -
4801 static int __init early_parse_user_mode(char *p)
4802 {
4803 if (p && strcmp(p, "primary") == 0)
4804 @@ -327,20 +316,6 @@ static int __init early_parse_user_mode(
4805 }
4806 early_param("user_mode", early_parse_user_mode);
4807
4808 -#ifdef CONFIG_S390_EXEC_PROTECT
4809 -/*
4810 - * Enable execute protection?
4811 - */
4812 -static int __init early_parse_noexec(char *p)
4813 -{
4814 - if (!strncmp(p, "off", 3))
4815 - return 0;
4816 - user_mode = SECONDARY_SPACE_MODE;
4817 - return 0;
4818 -}
4819 -early_param("noexec", early_parse_noexec);
4820 -#endif /* CONFIG_S390_EXEC_PROTECT */
4821 -
4822 static void setup_addressing_mode(void)
4823 {
4824 if (user_mode == SECONDARY_SPACE_MODE) {
4825 diff -urNp linux-2.6.39.1/arch/s390/mm/maccess.c linux-2.6.39.1/arch/s390/mm/maccess.c
4826 --- linux-2.6.39.1/arch/s390/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
4827 +++ linux-2.6.39.1/arch/s390/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
4828 @@ -45,7 +45,7 @@ static long probe_kernel_write_odd(void
4829 return rc ? rc : count;
4830 }
4831
4832 -long probe_kernel_write(void *dst, void *src, size_t size)
4833 +long probe_kernel_write(void *dst, const void *src, size_t size)
4834 {
4835 long copied = 0;
4836
4837 diff -urNp linux-2.6.39.1/arch/s390/mm/mmap.c linux-2.6.39.1/arch/s390/mm/mmap.c
4838 --- linux-2.6.39.1/arch/s390/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4839 +++ linux-2.6.39.1/arch/s390/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
4840 @@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
4841 */
4842 if (mmap_is_legacy()) {
4843 mm->mmap_base = TASK_UNMAPPED_BASE;
4844 +
4845 +#ifdef CONFIG_PAX_RANDMMAP
4846 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4847 + mm->mmap_base += mm->delta_mmap;
4848 +#endif
4849 +
4850 mm->get_unmapped_area = arch_get_unmapped_area;
4851 mm->unmap_area = arch_unmap_area;
4852 } else {
4853 mm->mmap_base = mmap_base();
4854 +
4855 +#ifdef CONFIG_PAX_RANDMMAP
4856 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4857 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4858 +#endif
4859 +
4860 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4861 mm->unmap_area = arch_unmap_area_topdown;
4862 }
4863 @@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str
4864 */
4865 if (mmap_is_legacy()) {
4866 mm->mmap_base = TASK_UNMAPPED_BASE;
4867 +
4868 +#ifdef CONFIG_PAX_RANDMMAP
4869 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4870 + mm->mmap_base += mm->delta_mmap;
4871 +#endif
4872 +
4873 mm->get_unmapped_area = s390_get_unmapped_area;
4874 mm->unmap_area = arch_unmap_area;
4875 } else {
4876 mm->mmap_base = mmap_base();
4877 +
4878 +#ifdef CONFIG_PAX_RANDMMAP
4879 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4880 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4881 +#endif
4882 +
4883 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
4884 mm->unmap_area = arch_unmap_area_topdown;
4885 }
4886 diff -urNp linux-2.6.39.1/arch/score/include/asm/system.h linux-2.6.39.1/arch/score/include/asm/system.h
4887 --- linux-2.6.39.1/arch/score/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4888 +++ linux-2.6.39.1/arch/score/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4889 @@ -17,7 +17,7 @@ do { \
4890 #define finish_arch_switch(prev) do {} while (0)
4891
4892 typedef void (*vi_handler_t)(void);
4893 -extern unsigned long arch_align_stack(unsigned long sp);
4894 +#define arch_align_stack(x) (x)
4895
4896 #define mb() barrier()
4897 #define rmb() barrier()
4898 diff -urNp linux-2.6.39.1/arch/score/kernel/process.c linux-2.6.39.1/arch/score/kernel/process.c
4899 --- linux-2.6.39.1/arch/score/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4900 +++ linux-2.6.39.1/arch/score/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
4901 @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
4902
4903 return task_pt_regs(task)->cp0_epc;
4904 }
4905 -
4906 -unsigned long arch_align_stack(unsigned long sp)
4907 -{
4908 - return sp;
4909 -}
4910 diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c
4911 --- linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-19 00:06:34.000000000 -0400
4912 +++ linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-22 19:36:30.000000000 -0400
4913 @@ -76,7 +76,7 @@ static int gapspci_write(struct pci_bus
4914 return PCIBIOS_SUCCESSFUL;
4915 }
4916
4917 -struct pci_ops gapspci_pci_ops = {
4918 +const struct pci_ops gapspci_pci_ops = {
4919 .read = gapspci_read,
4920 .write = gapspci_write,
4921 };
4922 diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c
4923 --- linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c 2011-05-19 00:06:34.000000000 -0400
4924 +++ linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c 2011-05-22 19:36:30.000000000 -0400
4925 @@ -96,7 +96,7 @@ static int sh4_pci_write(struct pci_bus
4926 return PCIBIOS_SUCCESSFUL;
4927 }
4928
4929 -struct pci_ops sh4_pci_ops = {
4930 +const struct pci_ops sh4_pci_ops = {
4931 .read = sh4_pci_read,
4932 .write = sh4_pci_write,
4933 };
4934 diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c
4935 --- linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c 2011-05-19 00:06:34.000000000 -0400
4936 +++ linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c 2011-05-22 19:36:30.000000000 -0400
4937 @@ -62,7 +62,7 @@ static int sh5pci_write(struct pci_bus *
4938 return PCIBIOS_SUCCESSFUL;
4939 }
4940
4941 -struct pci_ops sh5_pci_ops = {
4942 +const struct pci_ops sh5_pci_ops = {
4943 .read = sh5pci_read,
4944 .write = sh5pci_write,
4945 };
4946 diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c
4947 --- linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4948 +++ linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4949 @@ -165,7 +165,7 @@ out:
4950 return ret;
4951 }
4952
4953 -struct pci_ops sh7786_pci_ops = {
4954 +const struct pci_ops sh7786_pci_ops = {
4955 .read = sh7786_pcie_read,
4956 .write = sh7786_pcie_write,
4957 };
4958 diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c
4959 --- linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4960 +++ linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4961 @@ -109,7 +109,7 @@ static struct resource sh7786_pci2_resou
4962 },
4963 };
4964
4965 -extern struct pci_ops sh7786_pci_ops;
4966 +extern const struct pci_ops sh7786_pci_ops;
4967
4968 #define DEFINE_CONTROLLER(start, idx) \
4969 { \
4970 diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h
4971 --- linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h 2011-05-19 00:06:34.000000000 -0400
4972 +++ linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h 2011-05-22 19:36:30.000000000 -0400
4973 @@ -161,7 +161,7 @@
4974 #define SH4_PCIPDR 0x220 /* Port IO Data Register */
4975
4976 /* arch/sh/kernel/drivers/pci/ops-sh4.c */
4977 -extern struct pci_ops sh4_pci_ops;
4978 +extern const struct pci_ops sh4_pci_ops;
4979 int pci_fixup_pcic(struct pci_channel *chan);
4980
4981 struct sh4_pci_address_space {
4982 diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h
4983 --- linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h 2011-05-19 00:06:34.000000000 -0400
4984 +++ linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h 2011-05-22 19:36:30.000000000 -0400
4985 @@ -105,6 +105,6 @@ extern unsigned long pcicr_virt;
4986 #define PCISH5_MEM_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4987 #define PCISH5_IO_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4988
4989 -extern struct pci_ops sh5_pci_ops;
4990 +extern const struct pci_ops sh5_pci_ops;
4991
4992 #endif /* __PCI_SH5_H */
4993 diff -urNp linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h
4994 --- linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
4995 +++ linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
4996 @@ -1,10 +1,10 @@
4997 #ifndef __ASM_SH_DMA_MAPPING_H
4998 #define __ASM_SH_DMA_MAPPING_H
4999
5000 -extern struct dma_map_ops *dma_ops;
5001 +extern const struct dma_map_ops *dma_ops;
5002 extern void no_iommu_init(void);
5003
5004 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
5005 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
5006 {
5007 return dma_ops;
5008 }
5009 @@ -14,7 +14,7 @@ static inline struct dma_map_ops *get_dm
5010
5011 static inline int dma_supported(struct device *dev, u64 mask)
5012 {
5013 - struct dma_map_ops *ops = get_dma_ops(dev);
5014 + const struct dma_map_ops *ops = get_dma_ops(dev);
5015
5016 if (ops->dma_supported)
5017 return ops->dma_supported(dev, mask);
5018 @@ -24,7 +24,7 @@ static inline int dma_supported(struct d
5019
5020 static inline int dma_set_mask(struct device *dev, u64 mask)
5021 {
5022 - struct dma_map_ops *ops = get_dma_ops(dev);
5023 + const struct dma_map_ops *ops = get_dma_ops(dev);
5024
5025 if (!dev->dma_mask || !dma_supported(dev, mask))
5026 return -EIO;
5027 @@ -44,7 +44,7 @@ void dma_cache_sync(struct device *dev,
5028
5029 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
5030 {
5031 - struct dma_map_ops *ops = get_dma_ops(dev);
5032 + const struct dma_map_ops *ops = get_dma_ops(dev);
5033
5034 if (ops->mapping_error)
5035 return ops->mapping_error(dev, dma_addr);
5036 @@ -55,7 +55,7 @@ static inline int dma_mapping_error(stru
5037 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
5038 dma_addr_t *dma_handle, gfp_t gfp)
5039 {
5040 - struct dma_map_ops *ops = get_dma_ops(dev);
5041 + const struct dma_map_ops *ops = get_dma_ops(dev);
5042 void *memory;
5043
5044 if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
5045 @@ -72,7 +72,7 @@ static inline void *dma_alloc_coherent(s
5046 static inline void dma_free_coherent(struct device *dev, size_t size,
5047 void *vaddr, dma_addr_t dma_handle)
5048 {
5049 - struct dma_map_ops *ops = get_dma_ops(dev);
5050 + const struct dma_map_ops *ops = get_dma_ops(dev);
5051
5052 if (dma_release_from_coherent(dev, get_order(size), vaddr))
5053 return;
5054 diff -urNp linux-2.6.39.1/arch/sh/kernel/dma-nommu.c linux-2.6.39.1/arch/sh/kernel/dma-nommu.c
5055 --- linux-2.6.39.1/arch/sh/kernel/dma-nommu.c 2011-05-19 00:06:34.000000000 -0400
5056 +++ linux-2.6.39.1/arch/sh/kernel/dma-nommu.c 2011-05-22 19:36:30.000000000 -0400
5057 @@ -62,7 +62,7 @@ static void nommu_sync_sg(struct device
5058 }
5059 #endif
5060
5061 -struct dma_map_ops nommu_dma_ops = {
5062 +const struct dma_map_ops nommu_dma_ops = {
5063 .alloc_coherent = dma_generic_alloc_coherent,
5064 .free_coherent = dma_generic_free_coherent,
5065 .map_page = nommu_map_page,
5066 diff -urNp linux-2.6.39.1/arch/sh/kernel/kgdb.c linux-2.6.39.1/arch/sh/kernel/kgdb.c
5067 --- linux-2.6.39.1/arch/sh/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
5068 +++ linux-2.6.39.1/arch/sh/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
5069 @@ -319,7 +319,7 @@ void kgdb_arch_exit(void)
5070 unregister_die_notifier(&kgdb_notifier);
5071 }
5072
5073 -struct kgdb_arch arch_kgdb_ops = {
5074 +const struct kgdb_arch arch_kgdb_ops = {
5075 /* Breakpoint instruction: trapa #0x3c */
5076 #ifdef CONFIG_CPU_LITTLE_ENDIAN
5077 .gdb_bpt_instr = { 0x3c, 0xc3 },
5078 diff -urNp linux-2.6.39.1/arch/sh/mm/consistent.c linux-2.6.39.1/arch/sh/mm/consistent.c
5079 --- linux-2.6.39.1/arch/sh/mm/consistent.c 2011-05-19 00:06:34.000000000 -0400
5080 +++ linux-2.6.39.1/arch/sh/mm/consistent.c 2011-05-22 19:36:30.000000000 -0400
5081 @@ -22,7 +22,7 @@
5082
5083 #define PREALLOC_DMA_DEBUG_ENTRIES 4096
5084
5085 -struct dma_map_ops *dma_ops;
5086 +const struct dma_map_ops *dma_ops;
5087 EXPORT_SYMBOL(dma_ops);
5088
5089 static int __init dma_init(void)
5090 diff -urNp linux-2.6.39.1/arch/sh/mm/mmap.c linux-2.6.39.1/arch/sh/mm/mmap.c
5091 --- linux-2.6.39.1/arch/sh/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
5092 +++ linux-2.6.39.1/arch/sh/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
5093 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
5094 addr = PAGE_ALIGN(addr);
5095
5096 vma = find_vma(mm, addr);
5097 - if (TASK_SIZE - len >= addr &&
5098 - (!vma || addr + len <= vma->vm_start))
5099 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5100 return addr;
5101 }
5102
5103 @@ -106,7 +105,7 @@ full_search:
5104 }
5105 return -ENOMEM;
5106 }
5107 - if (likely(!vma || addr + len <= vma->vm_start)) {
5108 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5109 /*
5110 * Remember the place where we stopped the search:
5111 */
5112 @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
5113 addr = PAGE_ALIGN(addr);
5114
5115 vma = find_vma(mm, addr);
5116 - if (TASK_SIZE - len >= addr &&
5117 - (!vma || addr + len <= vma->vm_start))
5118 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5119 return addr;
5120 }
5121
5122 @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
5123 /* make sure it can fit in the remaining address space */
5124 if (likely(addr > len)) {
5125 vma = find_vma(mm, addr-len);
5126 - if (!vma || addr <= vma->vm_start) {
5127 + if (check_heap_stack_gap(vma, addr - len, len)) {
5128 /* remember the address as a hint for next time */
5129 return (mm->free_area_cache = addr-len);
5130 }
5131 @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
5132 if (unlikely(mm->mmap_base < len))
5133 goto bottomup;
5134
5135 - addr = mm->mmap_base-len;
5136 - if (do_colour_align)
5137 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5138 + addr = mm->mmap_base - len;
5139
5140 do {
5141 + if (do_colour_align)
5142 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5143 /*
5144 * Lookup failure means no vma is above this address,
5145 * else if new region fits below vma->vm_start,
5146 * return with success:
5147 */
5148 vma = find_vma(mm, addr);
5149 - if (likely(!vma || addr+len <= vma->vm_start)) {
5150 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5151 /* remember the address as a hint for next time */
5152 return (mm->free_area_cache = addr);
5153 }
5154 @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
5155 mm->cached_hole_size = vma->vm_start - addr;
5156
5157 /* try just below the current vma->vm_start */
5158 - addr = vma->vm_start-len;
5159 - if (do_colour_align)
5160 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5161 - } while (likely(len < vma->vm_start));
5162 + addr = skip_heap_stack_gap(vma, len);
5163 + } while (!IS_ERR_VALUE(addr));
5164
5165 bottomup:
5166 /*
5167 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h
5168 --- linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h 2011-05-19 00:06:34.000000000 -0400
5169 +++ linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h 2011-05-22 19:36:30.000000000 -0400
5170 @@ -14,18 +14,40 @@
5171 #define ATOMIC64_INIT(i) { (i) }
5172
5173 #define atomic_read(v) (*(volatile int *)&(v)->counter)
5174 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5175 +{
5176 + return v->counter;
5177 +}
5178 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
5179 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
5180 +{
5181 + return v->counter;
5182 +}
5183
5184 #define atomic_set(v, i) (((v)->counter) = i)
5185 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5186 +{
5187 + v->counter = i;
5188 +}
5189 #define atomic64_set(v, i) (((v)->counter) = i)
5190 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
5191 +{
5192 + v->counter = i;
5193 +}
5194
5195 extern void atomic_add(int, atomic_t *);
5196 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
5197 extern void atomic64_add(long, atomic64_t *);
5198 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
5199 extern void atomic_sub(int, atomic_t *);
5200 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
5201 extern void atomic64_sub(long, atomic64_t *);
5202 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
5203
5204 extern int atomic_add_ret(int, atomic_t *);
5205 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
5206 extern long atomic64_add_ret(long, atomic64_t *);
5207 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
5208 extern int atomic_sub_ret(int, atomic_t *);
5209 extern long atomic64_sub_ret(long, atomic64_t *);
5210
5211 @@ -33,12 +55,24 @@ extern long atomic64_sub_ret(long, atomi
5212 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
5213
5214 #define atomic_inc_return(v) atomic_add_ret(1, v)
5215 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
5216 +{
5217 + return atomic_add_ret_unchecked(1, v);
5218 +}
5219 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
5220 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
5221 +{
5222 + return atomic64_add_ret_unchecked(1, v);
5223 +}
5224
5225 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
5226 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
5227
5228 #define atomic_add_return(i, v) atomic_add_ret(i, v)
5229 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5230 +{
5231 + return atomic_add_ret_unchecked(i, v);
5232 +}
5233 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
5234
5235 /*
5236 @@ -50,6 +84,7 @@ extern long atomic64_sub_ret(long, atomi
5237 * other cases.
5238 */
5239 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
5240 +#define atomic_inc_and_test_unchecked(v) (atomic_inc_return_unchecked(v) == 0)
5241 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
5242
5243 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
5244 @@ -59,30 +94,59 @@ extern long atomic64_sub_ret(long, atomi
5245 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
5246
5247 #define atomic_inc(v) atomic_add(1, v)
5248 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5249 +{
5250 + atomic_add_unchecked(1, v);
5251 +}
5252 #define atomic64_inc(v) atomic64_add(1, v)
5253 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
5254 +{
5255 + atomic64_add_unchecked(1, v);
5256 +}
5257
5258 #define atomic_dec(v) atomic_sub(1, v)
5259 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
5260 +{
5261 + atomic_sub_unchecked(1, v);
5262 +}
5263 #define atomic64_dec(v) atomic64_sub(1, v)
5264 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
5265 +{
5266 + atomic64_sub_unchecked(1, v);
5267 +}
5268
5269 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
5270 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
5271
5272 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5273 +#define atomic_cmpxchg_unchecked(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5274 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
5275 +#define atomic_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
5276
5277 static inline int atomic_add_unless(atomic_t *v, int a, int u)
5278 {
5279 - int c, old;
5280 + int c, old, new;
5281 c = atomic_read(v);
5282 for (;;) {
5283 - if (unlikely(c == (u)))
5284 + if (unlikely(c == u))
5285 break;
5286 - old = atomic_cmpxchg((v), c, c + (a));
5287 +
5288 + asm volatile("addcc %2, %0, %0\n"
5289 +
5290 +#ifdef CONFIG_PAX_REFCOUNT
5291 + "tvs %%icc, 6\n"
5292 +#endif
5293 +
5294 + : "=r" (new)
5295 + : "0" (c), "ir" (a)
5296 + : "cc");
5297 +
5298 + old = atomic_cmpxchg(v, c, new);
5299 if (likely(old == c))
5300 break;
5301 c = old;
5302 }
5303 - return c != (u);
5304 + return c != u;
5305 }
5306
5307 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
5308 @@ -93,17 +157,28 @@ static inline int atomic_add_unless(atom
5309
5310 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
5311 {
5312 - long c, old;
5313 + long c, old, new;
5314 c = atomic64_read(v);
5315 for (;;) {
5316 - if (unlikely(c == (u)))
5317 + if (unlikely(c == u))
5318 break;
5319 - old = atomic64_cmpxchg((v), c, c + (a));
5320 +
5321 + asm volatile("addcc %2, %0, %0\n"
5322 +
5323 +#ifdef CONFIG_PAX_REFCOUNT
5324 + "tvs %%xcc, 6\n"
5325 +#endif
5326 +
5327 + : "=r" (new)
5328 + : "0" (c), "ir" (a)
5329 + : "cc");
5330 +
5331 + old = atomic64_cmpxchg(v, c, new);
5332 if (likely(old == c))
5333 break;
5334 c = old;
5335 }
5336 - return c != (u);
5337 + return c != u;
5338 }
5339
5340 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
5341 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/cache.h linux-2.6.39.1/arch/sparc/include/asm/cache.h
5342 --- linux-2.6.39.1/arch/sparc/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
5343 +++ linux-2.6.39.1/arch/sparc/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
5344 @@ -10,7 +10,7 @@
5345 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
5346
5347 #define L1_CACHE_SHIFT 5
5348 -#define L1_CACHE_BYTES 32
5349 +#define L1_CACHE_BYTES 32U
5350
5351 #ifdef CONFIG_SPARC32
5352 #define SMP_CACHE_BYTES_SHIFT 5
5353 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h
5354 --- linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
5355 +++ linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
5356 @@ -12,10 +12,10 @@ extern int dma_supported(struct device *
5357 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
5358 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
5359
5360 -extern struct dma_map_ops *dma_ops, pci32_dma_ops;
5361 +extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
5362 extern struct bus_type pci_bus_type;
5363
5364 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
5365 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
5366 {
5367 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
5368 if (dev->bus == &pci_bus_type)
5369 @@ -29,7 +29,7 @@ static inline struct dma_map_ops *get_dm
5370 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
5371 dma_addr_t *dma_handle, gfp_t flag)
5372 {
5373 - struct dma_map_ops *ops = get_dma_ops(dev);
5374 + const struct dma_map_ops *ops = get_dma_ops(dev);
5375 void *cpu_addr;
5376
5377 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
5378 @@ -40,7 +40,7 @@ static inline void *dma_alloc_coherent(s
5379 static inline void dma_free_coherent(struct device *dev, size_t size,
5380 void *cpu_addr, dma_addr_t dma_handle)
5381 {
5382 - struct dma_map_ops *ops = get_dma_ops(dev);
5383 + const struct dma_map_ops *ops = get_dma_ops(dev);
5384
5385 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
5386 ops->free_coherent(dev, size, cpu_addr, dma_handle);
5387 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/elf_32.h linux-2.6.39.1/arch/sparc/include/asm/elf_32.h
5388 --- linux-2.6.39.1/arch/sparc/include/asm/elf_32.h 2011-05-19 00:06:34.000000000 -0400
5389 +++ linux-2.6.39.1/arch/sparc/include/asm/elf_32.h 2011-05-22 19:36:30.000000000 -0400
5390 @@ -114,6 +114,13 @@ typedef struct {
5391
5392 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
5393
5394 +#ifdef CONFIG_PAX_ASLR
5395 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
5396 +
5397 +#define PAX_DELTA_MMAP_LEN 16
5398 +#define PAX_DELTA_STACK_LEN 16
5399 +#endif
5400 +
5401 /* This yields a mask that user programs can use to figure out what
5402 instruction set this cpu supports. This can NOT be done in userspace
5403 on Sparc. */
5404 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/elf_64.h linux-2.6.39.1/arch/sparc/include/asm/elf_64.h
5405 --- linux-2.6.39.1/arch/sparc/include/asm/elf_64.h 2011-05-19 00:06:34.000000000 -0400
5406 +++ linux-2.6.39.1/arch/sparc/include/asm/elf_64.h 2011-05-22 19:36:30.000000000 -0400
5407 @@ -162,6 +162,12 @@ typedef struct {
5408 #define ELF_ET_DYN_BASE 0x0000010000000000UL
5409 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
5410
5411 +#ifdef CONFIG_PAX_ASLR
5412 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
5413 +
5414 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
5415 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
5416 +#endif
5417
5418 /* This yields a mask that user programs can use to figure out what
5419 instruction set this cpu supports. */
5420 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h
5421 --- linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
5422 +++ linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
5423 @@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
5424 BTFIXUPDEF_INT(page_none)
5425 BTFIXUPDEF_INT(page_copy)
5426 BTFIXUPDEF_INT(page_readonly)
5427 +
5428 +#ifdef CONFIG_PAX_PAGEEXEC
5429 +BTFIXUPDEF_INT(page_shared_noexec)
5430 +BTFIXUPDEF_INT(page_copy_noexec)
5431 +BTFIXUPDEF_INT(page_readonly_noexec)
5432 +#endif
5433 +
5434 BTFIXUPDEF_INT(page_kernel)
5435
5436 #define PMD_SHIFT SUN4C_PMD_SHIFT
5437 @@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
5438 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
5439 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
5440
5441 +#ifdef CONFIG_PAX_PAGEEXEC
5442 +extern pgprot_t PAGE_SHARED_NOEXEC;
5443 +# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
5444 +# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
5445 +#else
5446 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
5447 +# define PAGE_COPY_NOEXEC PAGE_COPY
5448 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
5449 +#endif
5450 +
5451 extern unsigned long page_kernel;
5452
5453 #ifdef MODULE
5454 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h
5455 --- linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h 2011-05-19 00:06:34.000000000 -0400
5456 +++ linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h 2011-05-22 19:36:30.000000000 -0400
5457 @@ -115,6 +115,13 @@
5458 SRMMU_EXEC | SRMMU_REF)
5459 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
5460 SRMMU_EXEC | SRMMU_REF)
5461 +
5462 +#ifdef CONFIG_PAX_PAGEEXEC
5463 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
5464 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5465 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5466 +#endif
5467 +
5468 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
5469 SRMMU_DIRTY | SRMMU_REF)
5470
5471 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h
5472 --- linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h 2011-05-19 00:06:34.000000000 -0400
5473 +++ linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h 2011-05-22 19:36:30.000000000 -0400
5474 @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
5475
5476 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
5477
5478 -static void inline arch_read_lock(arch_rwlock_t *lock)
5479 +static inline void arch_read_lock(arch_rwlock_t *lock)
5480 {
5481 unsigned long tmp1, tmp2;
5482
5483 __asm__ __volatile__ (
5484 "1: ldsw [%2], %0\n"
5485 " brlz,pn %0, 2f\n"
5486 -"4: add %0, 1, %1\n"
5487 +"4: addcc %0, 1, %1\n"
5488 +
5489 +#ifdef CONFIG_PAX_REFCOUNT
5490 +" tvs %%icc, 6\n"
5491 +#endif
5492 +
5493 " cas [%2], %0, %1\n"
5494 " cmp %0, %1\n"
5495 " bne,pn %%icc, 1b\n"
5496 @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
5497 " .previous"
5498 : "=&r" (tmp1), "=&r" (tmp2)
5499 : "r" (lock)
5500 - : "memory");
5501 + : "memory", "cc");
5502 }
5503
5504 -static int inline arch_read_trylock(arch_rwlock_t *lock)
5505 +static inline int arch_read_trylock(arch_rwlock_t *lock)
5506 {
5507 int tmp1, tmp2;
5508
5509 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
5510 "1: ldsw [%2], %0\n"
5511 " brlz,a,pn %0, 2f\n"
5512 " mov 0, %0\n"
5513 -" add %0, 1, %1\n"
5514 +" addcc %0, 1, %1\n"
5515 +
5516 +#ifdef CONFIG_PAX_REFCOUNT
5517 +" tvs %%icc, 6\n"
5518 +#endif
5519 +
5520 " cas [%2], %0, %1\n"
5521 " cmp %0, %1\n"
5522 " bne,pn %%icc, 1b\n"
5523 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
5524 return tmp1;
5525 }
5526
5527 -static void inline arch_read_unlock(arch_rwlock_t *lock)
5528 +static inline void arch_read_unlock(arch_rwlock_t *lock)
5529 {
5530 unsigned long tmp1, tmp2;
5531
5532 __asm__ __volatile__(
5533 "1: lduw [%2], %0\n"
5534 -" sub %0, 1, %1\n"
5535 +" subcc %0, 1, %1\n"
5536 +
5537 +#ifdef CONFIG_PAX_REFCOUNT
5538 +" tvs %%icc, 6\n"
5539 +#endif
5540 +
5541 " cas [%2], %0, %1\n"
5542 " cmp %0, %1\n"
5543 " bne,pn %%xcc, 1b\n"
5544 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
5545 : "memory");
5546 }
5547
5548 -static void inline arch_write_lock(arch_rwlock_t *lock)
5549 +static inline void arch_write_lock(arch_rwlock_t *lock)
5550 {
5551 unsigned long mask, tmp1, tmp2;
5552
5553 @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
5554 : "memory");
5555 }
5556
5557 -static void inline arch_write_unlock(arch_rwlock_t *lock)
5558 +static inline void arch_write_unlock(arch_rwlock_t *lock)
5559 {
5560 __asm__ __volatile__(
5561 " stw %%g0, [%0]"
5562 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
5563 : "memory");
5564 }
5565
5566 -static int inline arch_write_trylock(arch_rwlock_t *lock)
5567 +static inline int arch_write_trylock(arch_rwlock_t *lock)
5568 {
5569 unsigned long mask, tmp1, tmp2, result;
5570
5571 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h
5572 --- linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h 2011-05-19 00:06:34.000000000 -0400
5573 +++ linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h 2011-06-03 01:14:03.000000000 -0400
5574 @@ -50,6 +50,8 @@ struct thread_info {
5575 unsigned long w_saved;
5576
5577 struct restart_block restart_block;
5578 +
5579 + unsigned long lowest_stack;
5580 };
5581
5582 /*
5583 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h
5584 --- linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h 2011-05-19 00:06:34.000000000 -0400
5585 +++ linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h 2011-06-03 01:14:21.000000000 -0400
5586 @@ -63,6 +63,8 @@ struct thread_info {
5587 struct pt_regs *kern_una_regs;
5588 unsigned int kern_una_insn;
5589
5590 + unsigned long lowest_stack;
5591 +
5592 unsigned long fpregs[0] __attribute__ ((aligned(64)));
5593 };
5594
5595 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h
5596 --- linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
5597 +++ linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
5598 @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
5599
5600 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
5601 {
5602 - if (n && __access_ok((unsigned long) to, n))
5603 + if ((long)n < 0)
5604 + return n;
5605 +
5606 + if (n && __access_ok((unsigned long) to, n)) {
5607 + if (!__builtin_constant_p(n))
5608 + check_object_size(from, n, true);
5609 return __copy_user(to, (__force void __user *) from, n);
5610 - else
5611 + } else
5612 return n;
5613 }
5614
5615 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
5616 {
5617 + if ((long)n < 0)
5618 + return n;
5619 +
5620 + if (!__builtin_constant_p(n))
5621 + check_object_size(from, n, true);
5622 +
5623 return __copy_user(to, (__force void __user *) from, n);
5624 }
5625
5626 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
5627 {
5628 - if (n && __access_ok((unsigned long) from, n))
5629 + if ((long)n < 0)
5630 + return n;
5631 +
5632 + if (n && __access_ok((unsigned long) from, n)) {
5633 + if (!__builtin_constant_p(n))
5634 + check_object_size(to, n, false);
5635 return __copy_user((__force void __user *) to, from, n);
5636 - else
5637 + } else
5638 return n;
5639 }
5640
5641 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
5642 {
5643 + if ((long)n < 0)
5644 + return n;
5645 +
5646 return __copy_user((__force void __user *) to, from, n);
5647 }
5648
5649 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h
5650 --- linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
5651 +++ linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
5652 @@ -10,6 +10,7 @@
5653 #include <linux/compiler.h>
5654 #include <linux/string.h>
5655 #include <linux/thread_info.h>
5656 +#include <linux/kernel.h>
5657 #include <asm/asi.h>
5658 #include <asm/system.h>
5659 #include <asm/spitfire.h>
5660 @@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu
5661 static inline unsigned long __must_check
5662 copy_from_user(void *to, const void __user *from, unsigned long size)
5663 {
5664 - unsigned long ret = ___copy_from_user(to, from, size);
5665 + unsigned long ret;
5666
5667 + if ((long)size < 0 || size > INT_MAX)
5668 + return size;
5669 +
5670 + if (!__builtin_constant_p(size))
5671 + check_object_size(to, size, false);
5672 +
5673 + ret = ___copy_from_user(to, from, size);
5674 if (unlikely(ret))
5675 ret = copy_from_user_fixup(to, from, size);
5676
5677 @@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(
5678 static inline unsigned long __must_check
5679 copy_to_user(void __user *to, const void *from, unsigned long size)
5680 {
5681 - unsigned long ret = ___copy_to_user(to, from, size);
5682 + unsigned long ret;
5683 +
5684 + if ((long)size < 0 || size > INT_MAX)
5685 + return size;
5686 +
5687 + if (!__builtin_constant_p(size))
5688 + check_object_size(from, size, true);
5689
5690 + ret = ___copy_to_user(to, from, size);
5691 if (unlikely(ret))
5692 ret = copy_to_user_fixup(to, from, size);
5693 return ret;
5694 diff -urNp linux-2.6.39.1/arch/sparc/include/asm/uaccess.h linux-2.6.39.1/arch/sparc/include/asm/uaccess.h
5695 --- linux-2.6.39.1/arch/sparc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
5696 +++ linux-2.6.39.1/arch/sparc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
5697 @@ -1,5 +1,13 @@
5698 #ifndef ___ASM_SPARC_UACCESS_H
5699 #define ___ASM_SPARC_UACCESS_H
5700 +
5701 +#ifdef __KERNEL__
5702 +#ifndef __ASSEMBLY__
5703 +#include <linux/types.h>
5704 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
5705 +#endif
5706 +#endif
5707 +
5708 #if defined(__sparc__) && defined(__arch64__)
5709 #include <asm/uaccess_64.h>
5710 #else
5711 diff -urNp linux-2.6.39.1/arch/sparc/kernel/iommu.c linux-2.6.39.1/arch/sparc/kernel/iommu.c
5712 --- linux-2.6.39.1/arch/sparc/kernel/iommu.c 2011-05-19 00:06:34.000000000 -0400
5713 +++ linux-2.6.39.1/arch/sparc/kernel/iommu.c 2011-05-22 19:36:30.000000000 -0400
5714 @@ -824,7 +824,7 @@ static void dma_4u_sync_sg_for_cpu(struc
5715 spin_unlock_irqrestore(&iommu->lock, flags);
5716 }
5717
5718 -static struct dma_map_ops sun4u_dma_ops = {
5719 +static const struct dma_map_ops sun4u_dma_ops = {
5720 .alloc_coherent = dma_4u_alloc_coherent,
5721 .free_coherent = dma_4u_free_coherent,
5722 .map_page = dma_4u_map_page,
5723 @@ -835,7 +835,7 @@ static struct dma_map_ops sun4u_dma_ops
5724 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
5725 };
5726
5727 -struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5728 +const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5729 EXPORT_SYMBOL(dma_ops);
5730
5731 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
5732 diff -urNp linux-2.6.39.1/arch/sparc/kernel/ioport.c linux-2.6.39.1/arch/sparc/kernel/ioport.c
5733 --- linux-2.6.39.1/arch/sparc/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
5734 +++ linux-2.6.39.1/arch/sparc/kernel/ioport.c 2011-05-22 19:36:30.000000000 -0400
5735 @@ -402,7 +402,7 @@ static void sbus_sync_sg_for_device(stru
5736 BUG();
5737 }
5738
5739 -struct dma_map_ops sbus_dma_ops = {
5740 +const struct dma_map_ops sbus_dma_ops = {
5741 .alloc_coherent = sbus_alloc_coherent,
5742 .free_coherent = sbus_free_coherent,
5743 .map_page = sbus_map_page,
5744 @@ -653,7 +653,7 @@ static void pci32_sync_sg_for_device(str
5745 }
5746 }
5747
5748 -struct dma_map_ops pci32_dma_ops = {
5749 +const struct dma_map_ops pci32_dma_ops = {
5750 .alloc_coherent = pci32_alloc_coherent,
5751 .free_coherent = pci32_free_coherent,
5752 .map_page = pci32_map_page,
5753 diff -urNp linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c
5754 --- linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c 2011-05-19 00:06:34.000000000 -0400
5755 +++ linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c 2011-05-22 19:36:30.000000000 -0400
5756 @@ -164,7 +164,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5757 regs->npc = regs->pc + 4;
5758 }
5759
5760 -struct kgdb_arch arch_kgdb_ops = {
5761 +const struct kgdb_arch arch_kgdb_ops = {
5762 /* Breakpoint instruction: ta 0x7d */
5763 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
5764 };
5765 diff -urNp linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c
5766 --- linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c 2011-05-19 00:06:34.000000000 -0400
5767 +++ linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c 2011-05-22 19:36:30.000000000 -0400
5768 @@ -187,7 +187,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5769 regs->tnpc = regs->tpc + 4;
5770 }
5771
5772 -struct kgdb_arch arch_kgdb_ops = {
5773 +const struct kgdb_arch arch_kgdb_ops = {
5774 /* Breakpoint instruction: ta 0x72 */
5775 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
5776 };
5777 diff -urNp linux-2.6.39.1/arch/sparc/kernel/Makefile linux-2.6.39.1/arch/sparc/kernel/Makefile
5778 --- linux-2.6.39.1/arch/sparc/kernel/Makefile 2011-05-19 00:06:34.000000000 -0400
5779 +++ linux-2.6.39.1/arch/sparc/kernel/Makefile 2011-05-22 19:36:30.000000000 -0400
5780 @@ -3,7 +3,7 @@
5781 #
5782
5783 asflags-y := -ansi
5784 -ccflags-y := -Werror
5785 +#ccflags-y := -Werror
5786
5787 extra-y := head_$(BITS).o
5788 extra-y += init_task.o
5789 diff -urNp linux-2.6.39.1/arch/sparc/kernel/pcic.c linux-2.6.39.1/arch/sparc/kernel/pcic.c
5790 --- linux-2.6.39.1/arch/sparc/kernel/pcic.c 2011-05-19 00:06:34.000000000 -0400
5791 +++ linux-2.6.39.1/arch/sparc/kernel/pcic.c 2011-05-22 19:36:30.000000000 -0400
5792 @@ -268,7 +268,7 @@ static int pcic_write_config(struct pci_
5793 return -EINVAL;
5794 }
5795
5796 -static struct pci_ops pcic_ops = {
5797 +static const struct pci_ops pcic_ops = {
5798 .read = pcic_read_config,
5799 .write = pcic_write_config,
5800 };
5801 diff -urNp linux-2.6.39.1/arch/sparc/kernel/pci_common.c linux-2.6.39.1/arch/sparc/kernel/pci_common.c
5802 --- linux-2.6.39.1/arch/sparc/kernel/pci_common.c 2011-05-19 00:06:34.000000000 -0400
5803 +++ linux-2.6.39.1/arch/sparc/kernel/pci_common.c 2011-05-22 19:36:30.000000000 -0400
5804 @@ -249,7 +249,7 @@ static int sun4u_write_pci_cfg(struct pc
5805 return PCIBIOS_SUCCESSFUL;
5806 }
5807
5808 -struct pci_ops sun4u_pci_ops = {
5809 +const struct pci_ops sun4u_pci_ops = {
5810 .read = sun4u_read_pci_cfg,
5811 .write = sun4u_write_pci_cfg,
5812 };
5813 @@ -310,7 +310,7 @@ static int sun4v_write_pci_cfg(struct pc
5814 return PCIBIOS_SUCCESSFUL;
5815 }
5816
5817 -struct pci_ops sun4v_pci_ops = {
5818 +const struct pci_ops sun4v_pci_ops = {
5819 .read = sun4v_read_pci_cfg,
5820 .write = sun4v_write_pci_cfg,
5821 };
5822 diff -urNp linux-2.6.39.1/arch/sparc/kernel/pci_impl.h linux-2.6.39.1/arch/sparc/kernel/pci_impl.h
5823 --- linux-2.6.39.1/arch/sparc/kernel/pci_impl.h 2011-05-19 00:06:34.000000000 -0400
5824 +++ linux-2.6.39.1/arch/sparc/kernel/pci_impl.h 2011-05-22 19:36:30.000000000 -0400
5825 @@ -175,8 +175,8 @@ extern void pci_config_write8(u8 *addr,
5826 extern void pci_config_write16(u16 *addr, u16 val);
5827 extern void pci_config_write32(u32 *addr, u32 val);
5828
5829 -extern struct pci_ops sun4u_pci_ops;
5830 -extern struct pci_ops sun4v_pci_ops;
5831 +extern const struct pci_ops sun4u_pci_ops;
5832 +extern const struct pci_ops sun4v_pci_ops;
5833
5834 extern volatile int pci_poke_in_progress;
5835 extern volatile int pci_poke_cpu;
5836 diff -urNp linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c
5837 --- linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c 2011-05-19 00:06:34.000000000 -0400
5838 +++ linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c 2011-05-22 19:36:30.000000000 -0400
5839 @@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
5840 spin_unlock_irqrestore(&iommu->lock, flags);
5841 }
5842
5843 -static struct dma_map_ops sun4v_dma_ops = {
5844 +static const struct dma_map_ops sun4v_dma_ops = {
5845 .alloc_coherent = dma_4v_alloc_coherent,
5846 .free_coherent = dma_4v_free_coherent,
5847 .map_page = dma_4v_map_page,
5848 diff -urNp linux-2.6.39.1/arch/sparc/kernel/process_32.c linux-2.6.39.1/arch/sparc/kernel/process_32.c
5849 --- linux-2.6.39.1/arch/sparc/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
5850 +++ linux-2.6.39.1/arch/sparc/kernel/process_32.c 2011-05-22 19:41:32.000000000 -0400
5851 @@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
5852 rw->ins[4], rw->ins[5],
5853 rw->ins[6],
5854 rw->ins[7]);
5855 - printk("%pS\n", (void *) rw->ins[7]);
5856 + printk("%pA\n", (void *) rw->ins[7]);
5857 rw = (struct reg_window32 *) rw->ins[6];
5858 }
5859 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
5860 @@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
5861
5862 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
5863 r->psr, r->pc, r->npc, r->y, print_tainted());
5864 - printk("PC: <%pS>\n", (void *) r->pc);
5865 + printk("PC: <%pA>\n", (void *) r->pc);
5866 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5867 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
5868 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
5869 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5870 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
5871 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
5872 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
5873 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
5874
5875 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5876 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
5877 @@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
5878 rw = (struct reg_window32 *) fp;
5879 pc = rw->ins[7];
5880 printk("[%08lx : ", pc);
5881 - printk("%pS ] ", (void *) pc);
5882 + printk("%pA ] ", (void *) pc);
5883 fp = rw->ins[6];
5884 } while (++count < 16);
5885 printk("\n");
5886 diff -urNp linux-2.6.39.1/arch/sparc/kernel/process_64.c linux-2.6.39.1/arch/sparc/kernel/process_64.c
5887 --- linux-2.6.39.1/arch/sparc/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
5888 +++ linux-2.6.39.1/arch/sparc/kernel/process_64.c 2011-05-22 19:41:32.000000000 -0400
5889 @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
5890 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
5891 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
5892 if (regs->tstate & TSTATE_PRIV)
5893 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
5894 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
5895 }
5896
5897 void show_regs(struct pt_regs *regs)
5898 {
5899 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
5900 regs->tpc, regs->tnpc, regs->y, print_tainted());
5901 - printk("TPC: <%pS>\n", (void *) regs->tpc);
5902 + printk("TPC: <%pA>\n", (void *) regs->tpc);
5903 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
5904 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
5905 regs->u_regs[3]);
5906 @@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
5907 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
5908 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
5909 regs->u_regs[15]);
5910 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
5911 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
5912 show_regwindow(regs);
5913 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
5914 }
5915 @@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void
5916 ((tp && tp->task) ? tp->task->pid : -1));
5917
5918 if (gp->tstate & TSTATE_PRIV) {
5919 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
5920 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
5921 (void *) gp->tpc,
5922 (void *) gp->o7,
5923 (void *) gp->i7,
5924 diff -urNp linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c
5925 --- linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c 2011-05-19 00:06:34.000000000 -0400
5926 +++ linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c 2011-05-22 19:36:30.000000000 -0400
5927 @@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
5928 if (ARCH_SUN4C && len > 0x20000000)
5929 return -ENOMEM;
5930 if (!addr)
5931 - addr = TASK_UNMAPPED_BASE;
5932 + addr = current->mm->mmap_base;
5933
5934 if (flags & MAP_SHARED)
5935 addr = COLOUR_ALIGN(addr);
5936 @@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
5937 }
5938 if (TASK_SIZE - PAGE_SIZE - len < addr)
5939 return -ENOMEM;
5940 - if (!vmm || addr + len <= vmm->vm_start)
5941 + if (check_heap_stack_gap(vmm, addr, len))
5942 return addr;
5943 addr = vmm->vm_end;
5944 if (flags & MAP_SHARED)
5945 diff -urNp linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c
5946 --- linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c 2011-05-19 00:06:34.000000000 -0400
5947 +++ linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c 2011-05-22 19:36:30.000000000 -0400
5948 @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
5949 /* We do not accept a shared mapping if it would violate
5950 * cache aliasing constraints.
5951 */
5952 - if ((flags & MAP_SHARED) &&
5953 + if ((filp || (flags & MAP_SHARED)) &&
5954 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5955 return -EINVAL;
5956 return addr;
5957 @@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
5958 if (filp || (flags & MAP_SHARED))
5959 do_color_align = 1;
5960
5961 +#ifdef CONFIG_PAX_RANDMMAP
5962 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
5963 +#endif
5964 +
5965 if (addr) {
5966 if (do_color_align)
5967 addr = COLOUR_ALIGN(addr, pgoff);
5968 @@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str
5969 addr = PAGE_ALIGN(addr);
5970
5971 vma = find_vma(mm, addr);
5972 - if (task_size - len >= addr &&
5973 - (!vma || addr + len <= vma->vm_start))
5974 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5975 return addr;
5976 }
5977
5978 if (len > mm->cached_hole_size) {
5979 - start_addr = addr = mm->free_area_cache;
5980 + start_addr = addr = mm->free_area_cache;
5981 } else {
5982 - start_addr = addr = TASK_UNMAPPED_BASE;
5983 + start_addr = addr = mm->mmap_base;
5984 mm->cached_hole_size = 0;
5985 }
5986
5987 @@ -174,14 +177,14 @@ full_search:
5988 vma = find_vma(mm, VA_EXCLUDE_END);
5989 }
5990 if (unlikely(task_size < addr)) {
5991 - if (start_addr != TASK_UNMAPPED_BASE) {
5992 - start_addr = addr = TASK_UNMAPPED_BASE;
5993 + if (start_addr != mm->mmap_base) {
5994 + start_addr = addr = mm->mmap_base;
5995 mm->cached_hole_size = 0;
5996 goto full_search;
5997 }
5998 return -ENOMEM;
5999 }
6000 - if (likely(!vma || addr + len <= vma->vm_start)) {
6001 + if (likely(check_heap_stack_gap(vma, addr, len))) {
6002 /*
6003 * Remember the place where we stopped the search:
6004 */
6005 @@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi
6006 /* We do not accept a shared mapping if it would violate
6007 * cache aliasing constraints.
6008 */
6009 - if ((flags & MAP_SHARED) &&
6010 + if ((filp || (flags & MAP_SHARED)) &&
6011 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
6012 return -EINVAL;
6013 return addr;
6014 @@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
6015 addr = PAGE_ALIGN(addr);
6016
6017 vma = find_vma(mm, addr);
6018 - if (task_size - len >= addr &&
6019 - (!vma || addr + len <= vma->vm_start))
6020 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
6021 return addr;
6022 }
6023
6024 @@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi
6025 /* make sure it can fit in the remaining address space */
6026 if (likely(addr > len)) {
6027 vma = find_vma(mm, addr-len);
6028 - if (!vma || addr <= vma->vm_start) {
6029 + if (check_heap_stack_gap(vma, addr - len, len)) {
6030 /* remember the address as a hint for next time */
6031 return (mm->free_area_cache = addr-len);
6032 }
6033 @@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi
6034 if (unlikely(mm->mmap_base < len))
6035 goto bottomup;
6036
6037 - addr = mm->mmap_base-len;
6038 - if (do_color_align)
6039 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
6040 + addr = mm->mmap_base - len;
6041
6042 do {
6043 + if (do_color_align)
6044 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
6045 /*
6046 * Lookup failure means no vma is above this address,
6047 * else if new region fits below vma->vm_start,
6048 * return with success:
6049 */
6050 vma = find_vma(mm, addr);
6051 - if (likely(!vma || addr+len <= vma->vm_start)) {
6052 + if (likely(check_heap_stack_gap(vma, addr, len))) {
6053 /* remember the address as a hint for next time */
6054 return (mm->free_area_cache = addr);
6055 }
6056 @@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi
6057 mm->cached_hole_size = vma->vm_start - addr;
6058
6059 /* try just below the current vma->vm_start */
6060 - addr = vma->vm_start-len;
6061 - if (do_color_align)
6062 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
6063 - } while (likely(len < vma->vm_start));
6064 + addr = skip_heap_stack_gap(vma, len);
6065 + } while (!IS_ERR_VALUE(addr));
6066
6067 bottomup:
6068 /*
6069 @@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
6070 gap == RLIM_INFINITY ||
6071 sysctl_legacy_va_layout) {
6072 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
6073 +
6074 +#ifdef CONFIG_PAX_RANDMMAP
6075 + if (mm->pax_flags & MF_PAX_RANDMMAP)
6076 + mm->mmap_base += mm->delta_mmap;
6077 +#endif
6078 +
6079 mm->get_unmapped_area = arch_get_unmapped_area;
6080 mm->unmap_area = arch_unmap_area;
6081 } else {
6082 @@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
6083 gap = (task_size / 6 * 5);
6084
6085 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
6086 +
6087 +#ifdef CONFIG_PAX_RANDMMAP
6088 + if (mm->pax_flags & MF_PAX_RANDMMAP)
6089 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
6090 +#endif
6091 +
6092 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
6093 mm->unmap_area = arch_unmap_area_topdown;
6094 }
6095 diff -urNp linux-2.6.39.1/arch/sparc/kernel/traps_32.c linux-2.6.39.1/arch/sparc/kernel/traps_32.c
6096 --- linux-2.6.39.1/arch/sparc/kernel/traps_32.c 2011-05-19 00:06:34.000000000 -0400
6097 +++ linux-2.6.39.1/arch/sparc/kernel/traps_32.c 2011-06-13 21:29:23.000000000 -0400
6098 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
6099 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
6100 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
6101
6102 +extern void gr_handle_kernel_exploit(void);
6103 +
6104 void die_if_kernel(char *str, struct pt_regs *regs)
6105 {
6106 static int die_counter;
6107 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
6108 count++ < 30 &&
6109 (((unsigned long) rw) >= PAGE_OFFSET) &&
6110 !(((unsigned long) rw) & 0x7)) {
6111 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
6112 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
6113 (void *) rw->ins[7]);
6114 rw = (struct reg_window32 *)rw->ins[6];
6115 }
6116 }
6117 printk("Instruction DUMP:");
6118 instruction_dump ((unsigned long *) regs->pc);
6119 - if(regs->psr & PSR_PS)
6120 + if(regs->psr & PSR_PS) {
6121 + gr_handle_kernel_exploit();
6122 do_exit(SIGKILL);
6123 + }
6124 do_exit(SIGSEGV);
6125 }
6126
6127 diff -urNp linux-2.6.39.1/arch/sparc/kernel/traps_64.c linux-2.6.39.1/arch/sparc/kernel/traps_64.c
6128 --- linux-2.6.39.1/arch/sparc/kernel/traps_64.c 2011-05-19 00:06:34.000000000 -0400
6129 +++ linux-2.6.39.1/arch/sparc/kernel/traps_64.c 2011-06-13 21:28:54.000000000 -0400
6130 @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
6131 i + 1,
6132 p->trapstack[i].tstate, p->trapstack[i].tpc,
6133 p->trapstack[i].tnpc, p->trapstack[i].tt);
6134 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
6135 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
6136 }
6137 }
6138
6139 @@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long
6140
6141 lvl -= 0x100;
6142 if (regs->tstate & TSTATE_PRIV) {
6143 +
6144 +#ifdef CONFIG_PAX_REFCOUNT
6145 + if (lvl == 6)
6146 + pax_report_refcount_overflow(regs);
6147 +#endif
6148 +
6149 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
6150 die_if_kernel(buffer, regs);
6151 }
6152 @@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long
6153 void bad_trap_tl1(struct pt_regs *regs, long lvl)
6154 {
6155 char buffer[32];
6156 -
6157 +
6158 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
6159 0, lvl, SIGTRAP) == NOTIFY_STOP)
6160 return;
6161
6162 +#ifdef CONFIG_PAX_REFCOUNT
6163 + if (lvl == 6)
6164 + pax_report_refcount_overflow(regs);
6165 +#endif
6166 +
6167 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
6168
6169 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
6170 @@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt
6171 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
6172 printk("%s" "ERROR(%d): ",
6173 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
6174 - printk("TPC<%pS>\n", (void *) regs->tpc);
6175 + printk("TPC<%pA>\n", (void *) regs->tpc);
6176 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
6177 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
6178 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
6179 @@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type,
6180 smp_processor_id(),
6181 (type & 0x1) ? 'I' : 'D',
6182 regs->tpc);
6183 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
6184 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
6185 panic("Irrecoverable Cheetah+ parity error.");
6186 }
6187
6188 @@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type,
6189 smp_processor_id(),
6190 (type & 0x1) ? 'I' : 'D',
6191 regs->tpc);
6192 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
6193 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
6194 }
6195
6196 struct sun4v_error_entry {
6197 @@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r
6198
6199 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
6200 regs->tpc, tl);
6201 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
6202 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
6203 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6204 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
6205 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
6206 (void *) regs->u_regs[UREG_I7]);
6207 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
6208 "pte[%lx] error[%lx]\n",
6209 @@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r
6210
6211 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
6212 regs->tpc, tl);
6213 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
6214 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
6215 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6216 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
6217 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
6218 (void *) regs->u_regs[UREG_I7]);
6219 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
6220 "pte[%lx] error[%lx]\n",
6221 @@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
6222 fp = (unsigned long)sf->fp + STACK_BIAS;
6223 }
6224
6225 - printk(" [%016lx] %pS\n", pc, (void *) pc);
6226 + printk(" [%016lx] %pA\n", pc, (void *) pc);
6227 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
6228 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
6229 int index = tsk->curr_ret_stack;
6230 if (tsk->ret_stack && index >= graph) {
6231 pc = tsk->ret_stack[index - graph].ret;
6232 - printk(" [%016lx] %pS\n", pc, (void *) pc);
6233 + printk(" [%016lx] %pA\n", pc, (void *) pc);
6234 graph++;
6235 }
6236 }
6237 @@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_
6238 return (struct reg_window *) (fp + STACK_BIAS);
6239 }
6240
6241 +extern void gr_handle_kernel_exploit(void);
6242 +
6243 void die_if_kernel(char *str, struct pt_regs *regs)
6244 {
6245 static int die_counter;
6246 @@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_
6247 while (rw &&
6248 count++ < 30 &&
6249 kstack_valid(tp, (unsigned long) rw)) {
6250 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
6251 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
6252 (void *) rw->ins[7]);
6253
6254 rw = kernel_stack_up(rw);
6255 @@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_
6256 }
6257 user_instruction_dump ((unsigned int __user *) regs->tpc);
6258 }
6259 - if (regs->tstate & TSTATE_PRIV)
6260 + if (regs->tstate & TSTATE_PRIV) {
6261 + gr_handle_kernel_exploit();
6262 do_exit(SIGKILL);
6263 + }
6264 do_exit(SIGSEGV);
6265 }
6266 EXPORT_SYMBOL(die_if_kernel);
6267 diff -urNp linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c
6268 --- linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c 2011-05-19 00:06:34.000000000 -0400
6269 +++ linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c 2011-05-22 19:41:32.000000000 -0400
6270 @@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs
6271 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
6272
6273 if (__ratelimit(&ratelimit)) {
6274 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
6275 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
6276 regs->tpc, (void *) regs->tpc);
6277 }
6278 }
6279 diff -urNp linux-2.6.39.1/arch/sparc/lib/atomic_64.S linux-2.6.39.1/arch/sparc/lib/atomic_64.S
6280 --- linux-2.6.39.1/arch/sparc/lib/atomic_64.S 2011-05-19 00:06:34.000000000 -0400
6281 +++ linux-2.6.39.1/arch/sparc/lib/atomic_64.S 2011-05-22 19:36:30.000000000 -0400
6282 @@ -18,7 +18,12 @@
6283 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
6284 BACKOFF_SETUP(%o2)
6285 1: lduw [%o1], %g1
6286 - add %g1, %o0, %g7
6287 + addcc %g1, %o0, %g7
6288 +
6289 +#ifdef CONFIG_PAX_REFCOUNT
6290 + tvs %icc, 6
6291 +#endif
6292 +
6293 cas [%o1], %g1, %g7
6294 cmp %g1, %g7
6295 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6296 @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
6297 2: BACKOFF_SPIN(%o2, %o3, 1b)
6298 .size atomic_add, .-atomic_add
6299
6300 + .globl atomic_add_unchecked
6301 + .type atomic_add_unchecked,#function
6302 +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6303 + BACKOFF_SETUP(%o2)
6304 +1: lduw [%o1], %g1
6305 + add %g1, %o0, %g7
6306 + cas [%o1], %g1, %g7
6307 + cmp %g1, %g7
6308 + bne,pn %icc, 2f
6309 + nop
6310 + retl
6311 + nop
6312 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6313 + .size atomic_add_unchecked, .-atomic_add_unchecked
6314 +
6315 .globl atomic_sub
6316 .type atomic_sub,#function
6317 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6318 BACKOFF_SETUP(%o2)
6319 1: lduw [%o1], %g1
6320 - sub %g1, %o0, %g7
6321 + subcc %g1, %o0, %g7
6322 +
6323 +#ifdef CONFIG_PAX_REFCOUNT
6324 + tvs %icc, 6
6325 +#endif
6326 +
6327 cas [%o1], %g1, %g7
6328 cmp %g1, %g7
6329 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6330 @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
6331 2: BACKOFF_SPIN(%o2, %o3, 1b)
6332 .size atomic_sub, .-atomic_sub
6333
6334 + .globl atomic_sub_unchecked
6335 + .type atomic_sub_unchecked,#function
6336 +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6337 + BACKOFF_SETUP(%o2)
6338 +1: lduw [%o1], %g1
6339 + sub %g1, %o0, %g7
6340 + cas [%o1], %g1, %g7
6341 + cmp %g1, %g7
6342 + bne,pn %icc, 2f
6343 + nop
6344 + retl
6345 + nop
6346 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6347 + .size atomic_sub_unchecked, .-atomic_sub_unchecked
6348 +
6349 .globl atomic_add_ret
6350 .type atomic_add_ret,#function
6351 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6352 BACKOFF_SETUP(%o2)
6353 1: lduw [%o1], %g1
6354 - add %g1, %o0, %g7
6355 + addcc %g1, %o0, %g7
6356 +
6357 +#ifdef CONFIG_PAX_REFCOUNT
6358 + tvs %icc, 6
6359 +#endif
6360 +
6361 cas [%o1], %g1, %g7
6362 cmp %g1, %g7
6363 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6364 @@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1
6365 2: BACKOFF_SPIN(%o2, %o3, 1b)
6366 .size atomic_add_ret, .-atomic_add_ret
6367
6368 + .globl atomic_add_ret_unchecked
6369 + .type atomic_add_ret_unchecked,#function
6370 +atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6371 + BACKOFF_SETUP(%o2)
6372 +1: lduw [%o1], %g1
6373 + addcc %g1, %o0, %g7
6374 + cas [%o1], %g1, %g7
6375 + cmp %g1, %g7
6376 + bne,pn %icc, 2f
6377 + add %g7, %o0, %g7
6378 + sra %g7, 0, %o0
6379 + retl
6380 + nop
6381 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6382 + .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
6383 +
6384 .globl atomic_sub_ret
6385 .type atomic_sub_ret,#function
6386 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6387 BACKOFF_SETUP(%o2)
6388 1: lduw [%o1], %g1
6389 - sub %g1, %o0, %g7
6390 + subcc %g1, %o0, %g7
6391 +
6392 +#ifdef CONFIG_PAX_REFCOUNT
6393 + tvs %icc, 6
6394 +#endif
6395 +
6396 cas [%o1], %g1, %g7
6397 cmp %g1, %g7
6398 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6399 @@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
6400 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
6401 BACKOFF_SETUP(%o2)
6402 1: ldx [%o1], %g1
6403 - add %g1, %o0, %g7
6404 + addcc %g1, %o0, %g7
6405 +
6406 +#ifdef CONFIG_PAX_REFCOUNT
6407 + tvs %xcc, 6
6408 +#endif
6409 +
6410 casx [%o1], %g1, %g7
6411 cmp %g1, %g7
6412 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6413 @@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 =
6414 2: BACKOFF_SPIN(%o2, %o3, 1b)
6415 .size atomic64_add, .-atomic64_add
6416
6417 + .globl atomic64_add_unchecked
6418 + .type atomic64_add_unchecked,#function
6419 +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6420 + BACKOFF_SETUP(%o2)
6421 +1: ldx [%o1], %g1
6422 + addcc %g1, %o0, %g7
6423 + casx [%o1], %g1, %g7
6424 + cmp %g1, %g7
6425 + bne,pn %xcc, 2f
6426 + nop
6427 + retl
6428 + nop
6429 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6430 + .size atomic64_add_unchecked, .-atomic64_add_unchecked
6431 +
6432 .globl atomic64_sub
6433 .type atomic64_sub,#function
6434 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6435 BACKOFF_SETUP(%o2)
6436 1: ldx [%o1], %g1
6437 - sub %g1, %o0, %g7
6438 + subcc %g1, %o0, %g7
6439 +
6440 +#ifdef CONFIG_PAX_REFCOUNT
6441 + tvs %xcc, 6
6442 +#endif
6443 +
6444 casx [%o1], %g1, %g7
6445 cmp %g1, %g7
6446 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6447 @@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
6448 2: BACKOFF_SPIN(%o2, %o3, 1b)
6449 .size atomic64_sub, .-atomic64_sub
6450
6451 + .globl atomic64_sub_unchecked
6452 + .type atomic64_sub_unchecked,#function
6453 +atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6454 + BACKOFF_SETUP(%o2)
6455 +1: ldx [%o1], %g1
6456 + subcc %g1, %o0, %g7
6457 + casx [%o1], %g1, %g7
6458 + cmp %g1, %g7
6459 + bne,pn %xcc, 2f
6460 + nop
6461 + retl
6462 + nop
6463 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6464 + .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
6465 +
6466 .globl atomic64_add_ret
6467 .type atomic64_add_ret,#function
6468 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6469 BACKOFF_SETUP(%o2)
6470 1: ldx [%o1], %g1
6471 - add %g1, %o0, %g7
6472 + addcc %g1, %o0, %g7
6473 +
6474 +#ifdef CONFIG_PAX_REFCOUNT
6475 + tvs %xcc, 6
6476 +#endif
6477 +
6478 casx [%o1], %g1, %g7
6479 cmp %g1, %g7
6480 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6481 @@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o
6482 2: BACKOFF_SPIN(%o2, %o3, 1b)
6483 .size atomic64_add_ret, .-atomic64_add_ret
6484
6485 + .globl atomic64_add_ret_unchecked
6486 + .type atomic64_add_ret_unchecked,#function
6487 +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6488 + BACKOFF_SETUP(%o2)
6489 +1: ldx [%o1], %g1
6490 + addcc %g1, %o0, %g7
6491 + casx [%o1], %g1, %g7
6492 + cmp %g1, %g7
6493 + bne,pn %xcc, 2f
6494 + add %g7, %o0, %g7
6495 + mov %g7, %o0
6496 + retl
6497 + nop
6498 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6499 + .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
6500 +
6501 .globl atomic64_sub_ret
6502 .type atomic64_sub_ret,#function
6503 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6504 BACKOFF_SETUP(%o2)
6505 1: ldx [%o1], %g1
6506 - sub %g1, %o0, %g7
6507 + subcc %g1, %o0, %g7
6508 +
6509 +#ifdef CONFIG_PAX_REFCOUNT
6510 + tvs %xcc, 6
6511 +#endif
6512 +
6513 casx [%o1], %g1, %g7
6514 cmp %g1, %g7
6515 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6516 diff -urNp linux-2.6.39.1/arch/sparc/lib/ksyms.c linux-2.6.39.1/arch/sparc/lib/ksyms.c
6517 --- linux-2.6.39.1/arch/sparc/lib/ksyms.c 2011-05-19 00:06:34.000000000 -0400
6518 +++ linux-2.6.39.1/arch/sparc/lib/ksyms.c 2011-05-22 19:36:30.000000000 -0400
6519 @@ -142,12 +142,17 @@ EXPORT_SYMBOL(__downgrade_write);
6520
6521 /* Atomic counter implementation. */
6522 EXPORT_SYMBOL(atomic_add);
6523 +EXPORT_SYMBOL(atomic_add_unchecked);
6524 EXPORT_SYMBOL(atomic_add_ret);
6525 EXPORT_SYMBOL(atomic_sub);
6526 +EXPORT_SYMBOL(atomic_sub_unchecked);
6527 EXPORT_SYMBOL(atomic_sub_ret);
6528 EXPORT_SYMBOL(atomic64_add);
6529 +EXPORT_SYMBOL(atomic64_add_unchecked);
6530 EXPORT_SYMBOL(atomic64_add_ret);
6531 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
6532 EXPORT_SYMBOL(atomic64_sub);
6533 +EXPORT_SYMBOL(atomic64_sub_unchecked);
6534 EXPORT_SYMBOL(atomic64_sub_ret);
6535
6536 /* Atomic bit operations. */
6537 diff -urNp linux-2.6.39.1/arch/sparc/lib/Makefile linux-2.6.39.1/arch/sparc/lib/Makefile
6538 --- linux-2.6.39.1/arch/sparc/lib/Makefile 2011-05-19 00:06:34.000000000 -0400
6539 +++ linux-2.6.39.1/arch/sparc/lib/Makefile 2011-05-22 19:36:30.000000000 -0400
6540 @@ -2,7 +2,7 @@
6541 #
6542
6543 asflags-y := -ansi -DST_DIV0=0x02
6544 -ccflags-y := -Werror
6545 +#ccflags-y := -Werror
6546
6547 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
6548 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
6549 diff -urNp linux-2.6.39.1/arch/sparc/Makefile linux-2.6.39.1/arch/sparc/Makefile
6550 --- linux-2.6.39.1/arch/sparc/Makefile 2011-05-19 00:06:34.000000000 -0400
6551 +++ linux-2.6.39.1/arch/sparc/Makefile 2011-05-22 19:41:32.000000000 -0400
6552 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
6553 # Export what is needed by arch/sparc/boot/Makefile
6554 export VMLINUX_INIT VMLINUX_MAIN
6555 VMLINUX_INIT := $(head-y) $(init-y)
6556 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
6557 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
6558 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
6559 VMLINUX_MAIN += $(drivers-y) $(net-y)
6560
6561 diff -urNp linux-2.6.39.1/arch/sparc/mm/fault_32.c linux-2.6.39.1/arch/sparc/mm/fault_32.c
6562 --- linux-2.6.39.1/arch/sparc/mm/fault_32.c 2011-05-19 00:06:34.000000000 -0400
6563 +++ linux-2.6.39.1/arch/sparc/mm/fault_32.c 2011-05-22 19:36:30.000000000 -0400
6564 @@ -22,6 +22,9 @@
6565 #include <linux/interrupt.h>
6566 #include <linux/module.h>
6567 #include <linux/kdebug.h>
6568 +#include <linux/slab.h>
6569 +#include <linux/pagemap.h>
6570 +#include <linux/compiler.h>
6571
6572 #include <asm/system.h>
6573 #include <asm/page.h>
6574 @@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str
6575 return safe_compute_effective_address(regs, insn);
6576 }
6577
6578 +#ifdef CONFIG_PAX_PAGEEXEC
6579 +#ifdef CONFIG_PAX_DLRESOLVE
6580 +static void pax_emuplt_close(struct vm_area_struct *vma)
6581 +{
6582 + vma->vm_mm->call_dl_resolve = 0UL;
6583 +}
6584 +
6585 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6586 +{
6587 + unsigned int *kaddr;
6588 +
6589 + vmf->page = alloc_page(GFP_HIGHUSER);
6590 + if (!vmf->page)
6591 + return VM_FAULT_OOM;
6592 +
6593 + kaddr = kmap(vmf->page);
6594 + memset(kaddr, 0, PAGE_SIZE);
6595 + kaddr[0] = 0x9DE3BFA8U; /* save */
6596 + flush_dcache_page(vmf->page);
6597 + kunmap(vmf->page);
6598 + return VM_FAULT_MAJOR;
6599 +}
6600 +
6601 +static const struct vm_operations_struct pax_vm_ops = {
6602 + .close = pax_emuplt_close,
6603 + .fault = pax_emuplt_fault
6604 +};
6605 +
6606 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6607 +{
6608 + int ret;
6609 +
6610 + INIT_LIST_HEAD(&vma->anon_vma_chain);
6611 + vma->vm_mm = current->mm;
6612 + vma->vm_start = addr;
6613 + vma->vm_end = addr + PAGE_SIZE;
6614 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6615 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6616 + vma->vm_ops = &pax_vm_ops;
6617 +
6618 + ret = insert_vm_struct(current->mm, vma);
6619 + if (ret)
6620 + return ret;
6621 +
6622 + ++current->mm->total_vm;
6623 + return 0;
6624 +}
6625 +#endif
6626 +
6627 +/*
6628 + * PaX: decide what to do with offenders (regs->pc = fault address)
6629 + *
6630 + * returns 1 when task should be killed
6631 + * 2 when patched PLT trampoline was detected
6632 + * 3 when unpatched PLT trampoline was detected
6633 + */
6634 +static int pax_handle_fetch_fault(struct pt_regs *regs)
6635 +{
6636 +
6637 +#ifdef CONFIG_PAX_EMUPLT
6638 + int err;
6639 +
6640 + do { /* PaX: patched PLT emulation #1 */
6641 + unsigned int sethi1, sethi2, jmpl;
6642 +
6643 + err = get_user(sethi1, (unsigned int *)regs->pc);
6644 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
6645 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
6646 +
6647 + if (err)
6648 + break;
6649 +
6650 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6651 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
6652 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
6653 + {
6654 + unsigned int addr;
6655 +
6656 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6657 + addr = regs->u_regs[UREG_G1];
6658 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6659 + regs->pc = addr;
6660 + regs->npc = addr+4;
6661 + return 2;
6662 + }
6663 + } while (0);
6664 +
6665 + { /* PaX: patched PLT emulation #2 */
6666 + unsigned int ba;
6667 +
6668 + err = get_user(ba, (unsigned int *)regs->pc);
6669 +
6670 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6671 + unsigned int addr;
6672 +
6673 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6674 + regs->pc = addr;
6675 + regs->npc = addr+4;
6676 + return 2;
6677 + }
6678 + }
6679 +
6680 + do { /* PaX: patched PLT emulation #3 */
6681 + unsigned int sethi, jmpl, nop;
6682 +
6683 + err = get_user(sethi, (unsigned int *)regs->pc);
6684 + err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
6685 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
6686 +
6687 + if (err)
6688 + break;
6689 +
6690 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
6691 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6692 + nop == 0x01000000U)
6693 + {
6694 + unsigned int addr;
6695 +
6696 + addr = (sethi & 0x003FFFFFU) << 10;
6697 + regs->u_regs[UREG_G1] = addr;
6698 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6699 + regs->pc = addr;
6700 + regs->npc = addr+4;
6701 + return 2;
6702 + }
6703 + } while (0);
6704 +
6705 + do { /* PaX: unpatched PLT emulation step 1 */
6706 + unsigned int sethi, ba, nop;
6707 +
6708 + err = get_user(sethi, (unsigned int *)regs->pc);
6709 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
6710 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
6711 +
6712 + if (err)
6713 + break;
6714 +
6715 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
6716 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6717 + nop == 0x01000000U)
6718 + {
6719 + unsigned int addr, save, call;
6720 +
6721 + if ((ba & 0xFFC00000U) == 0x30800000U)
6722 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6723 + else
6724 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6725 +
6726 + err = get_user(save, (unsigned int *)addr);
6727 + err |= get_user(call, (unsigned int *)(addr+4));
6728 + err |= get_user(nop, (unsigned int *)(addr+8));
6729 + if (err)
6730 + break;
6731 +
6732 +#ifdef CONFIG_PAX_DLRESOLVE
6733 + if (save == 0x9DE3BFA8U &&
6734 + (call & 0xC0000000U) == 0x40000000U &&
6735 + nop == 0x01000000U)
6736 + {
6737 + struct vm_area_struct *vma;
6738 + unsigned long call_dl_resolve;
6739 +
6740 + down_read(&current->mm->mmap_sem);
6741 + call_dl_resolve = current->mm->call_dl_resolve;
6742 + up_read(&current->mm->mmap_sem);
6743 + if (likely(call_dl_resolve))
6744 + goto emulate;
6745 +
6746 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
6747 +
6748 + down_write(&current->mm->mmap_sem);
6749 + if (current->mm->call_dl_resolve) {
6750 + call_dl_resolve = current->mm->call_dl_resolve;
6751 + up_write(&current->mm->mmap_sem);
6752 + if (vma)
6753 + kmem_cache_free(vm_area_cachep, vma);
6754 + goto emulate;
6755 + }
6756 +
6757 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6758 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
6759 + up_write(&current->mm->mmap_sem);
6760 + if (vma)
6761 + kmem_cache_free(vm_area_cachep, vma);
6762 + return 1;
6763 + }
6764 +
6765 + if (pax_insert_vma(vma, call_dl_resolve)) {
6766 + up_write(&current->mm->mmap_sem);
6767 + kmem_cache_free(vm_area_cachep, vma);
6768 + return 1;
6769 + }
6770 +
6771 + current->mm->call_dl_resolve = call_dl_resolve;
6772 + up_write(&current->mm->mmap_sem);
6773 +
6774 +emulate:
6775 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6776 + regs->pc = call_dl_resolve;
6777 + regs->npc = addr+4;
6778 + return 3;
6779 + }
6780 +#endif
6781 +
6782 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
6783 + if ((save & 0xFFC00000U) == 0x05000000U &&
6784 + (call & 0xFFFFE000U) == 0x85C0A000U &&
6785 + nop == 0x01000000U)
6786 + {
6787 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6788 + regs->u_regs[UREG_G2] = addr + 4;
6789 + addr = (save & 0x003FFFFFU) << 10;
6790 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6791 + regs->pc = addr;
6792 + regs->npc = addr+4;
6793 + return 3;
6794 + }
6795 + }
6796 + } while (0);
6797 +
6798 + do { /* PaX: unpatched PLT emulation step 2 */
6799 + unsigned int save, call, nop;
6800 +
6801 + err = get_user(save, (unsigned int *)(regs->pc-4));
6802 + err |= get_user(call, (unsigned int *)regs->pc);
6803 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
6804 + if (err)
6805 + break;
6806 +
6807 + if (save == 0x9DE3BFA8U &&
6808 + (call & 0xC0000000U) == 0x40000000U &&
6809 + nop == 0x01000000U)
6810 + {
6811 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
6812 +
6813 + regs->u_regs[UREG_RETPC] = regs->pc;
6814 + regs->pc = dl_resolve;
6815 + regs->npc = dl_resolve+4;
6816 + return 3;
6817 + }
6818 + } while (0);
6819 +#endif
6820 +
6821 + return 1;
6822 +}
6823 +
6824 +void pax_report_insns(void *pc, void *sp)
6825 +{
6826 + unsigned long i;
6827 +
6828 + printk(KERN_ERR "PAX: bytes at PC: ");
6829 + for (i = 0; i < 8; i++) {
6830 + unsigned int c;
6831 + if (get_user(c, (unsigned int *)pc+i))
6832 + printk(KERN_CONT "???????? ");
6833 + else
6834 + printk(KERN_CONT "%08x ", c);
6835 + }
6836 + printk("\n");
6837 +}
6838 +#endif
6839 +
6840 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
6841 int text_fault)
6842 {
6843 @@ -281,6 +546,24 @@ good_area:
6844 if(!(vma->vm_flags & VM_WRITE))
6845 goto bad_area;
6846 } else {
6847 +
6848 +#ifdef CONFIG_PAX_PAGEEXEC
6849 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
6850 + up_read(&mm->mmap_sem);
6851 + switch (pax_handle_fetch_fault(regs)) {
6852 +
6853 +#ifdef CONFIG_PAX_EMUPLT
6854 + case 2:
6855 + case 3:
6856 + return;
6857 +#endif
6858 +
6859 + }
6860 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
6861 + do_group_exit(SIGKILL);
6862 + }
6863 +#endif
6864 +
6865 /* Allow reads even for write-only mappings */
6866 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
6867 goto bad_area;
6868 diff -urNp linux-2.6.39.1/arch/sparc/mm/fault_64.c linux-2.6.39.1/arch/sparc/mm/fault_64.c
6869 --- linux-2.6.39.1/arch/sparc/mm/fault_64.c 2011-05-19 00:06:34.000000000 -0400
6870 +++ linux-2.6.39.1/arch/sparc/mm/fault_64.c 2011-05-22 19:41:32.000000000 -0400
6871 @@ -21,6 +21,9 @@
6872 #include <linux/kprobes.h>
6873 #include <linux/kdebug.h>
6874 #include <linux/percpu.h>
6875 +#include <linux/slab.h>
6876 +#include <linux/pagemap.h>
6877 +#include <linux/compiler.h>
6878
6879 #include <asm/page.h>
6880 #include <asm/pgtable.h>
6881 @@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru
6882 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
6883 regs->tpc);
6884 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
6885 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
6886 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
6887 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
6888 dump_stack();
6889 unhandled_fault(regs->tpc, current, regs);
6890 @@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b
6891 show_regs(regs);
6892 }
6893
6894 +#ifdef CONFIG_PAX_PAGEEXEC
6895 +#ifdef CONFIG_PAX_DLRESOLVE
6896 +static void pax_emuplt_close(struct vm_area_struct *vma)
6897 +{
6898 + vma->vm_mm->call_dl_resolve = 0UL;
6899 +}
6900 +
6901 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6902 +{
6903 + unsigned int *kaddr;
6904 +
6905 + vmf->page = alloc_page(GFP_HIGHUSER);
6906 + if (!vmf->page)
6907 + return VM_FAULT_OOM;
6908 +
6909 + kaddr = kmap(vmf->page);
6910 + memset(kaddr, 0, PAGE_SIZE);
6911 + kaddr[0] = 0x9DE3BFA8U; /* save */
6912 + flush_dcache_page(vmf->page);
6913 + kunmap(vmf->page);
6914 + return VM_FAULT_MAJOR;
6915 +}
6916 +
6917 +static const struct vm_operations_struct pax_vm_ops = {
6918 + .close = pax_emuplt_close,
6919 + .fault = pax_emuplt_fault
6920 +};
6921 +
6922 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6923 +{
6924 + int ret;
6925 +
6926 + INIT_LIST_HEAD(&vma->anon_vma_chain);
6927 + vma->vm_mm = current->mm;
6928 + vma->vm_start = addr;
6929 + vma->vm_end = addr + PAGE_SIZE;
6930 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6931 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6932 + vma->vm_ops = &pax_vm_ops;
6933 +
6934 + ret = insert_vm_struct(current->mm, vma);
6935 + if (ret)
6936 + return ret;
6937 +
6938 + ++current->mm->total_vm;
6939 + return 0;
6940 +}
6941 +#endif
6942 +
6943 +/*
6944 + * PaX: decide what to do with offenders (regs->tpc = fault address)
6945 + *
6946 + * returns 1 when task should be killed
6947 + * 2 when patched PLT trampoline was detected
6948 + * 3 when unpatched PLT trampoline was detected
6949 + */
6950 +static int pax_handle_fetch_fault(struct pt_regs *regs)
6951 +{
6952 +
6953 +#ifdef CONFIG_PAX_EMUPLT
6954 + int err;
6955 +
6956 + do { /* PaX: patched PLT emulation #1 */
6957 + unsigned int sethi1, sethi2, jmpl;
6958 +
6959 + err = get_user(sethi1, (unsigned int *)regs->tpc);
6960 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
6961 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
6962 +
6963 + if (err)
6964 + break;
6965 +
6966 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6967 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
6968 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
6969 + {
6970 + unsigned long addr;
6971 +
6972 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6973 + addr = regs->u_regs[UREG_G1];
6974 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6975 +
6976 + if (test_thread_flag(TIF_32BIT))
6977 + addr &= 0xFFFFFFFFUL;
6978 +
6979 + regs->tpc = addr;
6980 + regs->tnpc = addr+4;
6981 + return 2;
6982 + }
6983 + } while (0);
6984 +
6985 + { /* PaX: patched PLT emulation #2 */
6986 + unsigned int ba;
6987 +
6988 + err = get_user(ba, (unsigned int *)regs->tpc);
6989 +
6990 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6991 + unsigned long addr;
6992 +
6993 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
6994 +
6995 + if (test_thread_flag(TIF_32BIT))
6996 + addr &= 0xFFFFFFFFUL;
6997 +
6998 + regs->tpc = addr;
6999 + regs->tnpc = addr+4;
7000 + return 2;
7001 + }
7002 + }
7003 +
7004 + do { /* PaX: patched PLT emulation #3 */
7005 + unsigned int sethi, jmpl, nop;
7006 +
7007 + err = get_user(sethi, (unsigned int *)regs->tpc);
7008 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
7009 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7010 +
7011 + if (err)
7012 + break;
7013 +
7014 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7015 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
7016 + nop == 0x01000000U)
7017 + {
7018 + unsigned long addr;
7019 +
7020 + addr = (sethi & 0x003FFFFFU) << 10;
7021 + regs->u_regs[UREG_G1] = addr;
7022 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7023 +
7024 + if (test_thread_flag(TIF_32BIT))
7025 + addr &= 0xFFFFFFFFUL;
7026 +
7027 + regs->tpc = addr;
7028 + regs->tnpc = addr+4;
7029 + return 2;
7030 + }
7031 + } while (0);
7032 +
7033 + do { /* PaX: patched PLT emulation #4 */
7034 + unsigned int sethi, mov1, call, mov2;
7035 +
7036 + err = get_user(sethi, (unsigned int *)regs->tpc);
7037 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
7038 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
7039 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
7040 +
7041 + if (err)
7042 + break;
7043 +
7044 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7045 + mov1 == 0x8210000FU &&
7046 + (call & 0xC0000000U) == 0x40000000U &&
7047 + mov2 == 0x9E100001U)
7048 + {
7049 + unsigned long addr;
7050 +
7051 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
7052 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7053 +
7054 + if (test_thread_flag(TIF_32BIT))
7055 + addr &= 0xFFFFFFFFUL;
7056 +
7057 + regs->tpc = addr;
7058 + regs->tnpc = addr+4;
7059 + return 2;
7060 + }
7061 + } while (0);
7062 +
7063 + do { /* PaX: patched PLT emulation #5 */
7064 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
7065 +
7066 + err = get_user(sethi, (unsigned int *)regs->tpc);
7067 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
7068 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
7069 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
7070 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
7071 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
7072 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
7073 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
7074 +
7075 + if (err)
7076 + break;
7077 +
7078 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7079 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
7080 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7081 + (or1 & 0xFFFFE000U) == 0x82106000U &&
7082 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
7083 + sllx == 0x83287020U &&
7084 + jmpl == 0x81C04005U &&
7085 + nop == 0x01000000U)
7086 + {
7087 + unsigned long addr;
7088 +
7089 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7090 + regs->u_regs[UREG_G1] <<= 32;
7091 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7092 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7093 + regs->tpc = addr;
7094 + regs->tnpc = addr+4;
7095 + return 2;
7096 + }
7097 + } while (0);
7098 +
7099 + do { /* PaX: patched PLT emulation #6 */
7100 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
7101 +
7102 + err = get_user(sethi, (unsigned int *)regs->tpc);
7103 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
7104 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
7105 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
7106 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
7107 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
7108 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
7109 +
7110 + if (err)
7111 + break;
7112 +
7113 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7114 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
7115 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7116 + sllx == 0x83287020U &&
7117 + (or & 0xFFFFE000U) == 0x8A116000U &&
7118 + jmpl == 0x81C04005U &&
7119 + nop == 0x01000000U)
7120 + {
7121 + unsigned long addr;
7122 +
7123 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
7124 + regs->u_regs[UREG_G1] <<= 32;
7125 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
7126 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7127 + regs->tpc = addr;
7128 + regs->tnpc = addr+4;
7129 + return 2;
7130 + }
7131 + } while (0);
7132 +
7133 + do { /* PaX: unpatched PLT emulation step 1 */
7134 + unsigned int sethi, ba, nop;
7135 +
7136 + err = get_user(sethi, (unsigned int *)regs->tpc);
7137 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7138 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7139 +
7140 + if (err)
7141 + break;
7142 +
7143 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7144 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
7145 + nop == 0x01000000U)
7146 + {
7147 + unsigned long addr;
7148 + unsigned int save, call;
7149 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
7150 +
7151 + if ((ba & 0xFFC00000U) == 0x30800000U)
7152 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
7153 + else
7154 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7155 +
7156 + if (test_thread_flag(TIF_32BIT))
7157 + addr &= 0xFFFFFFFFUL;
7158 +
7159 + err = get_user(save, (unsigned int *)addr);
7160 + err |= get_user(call, (unsigned int *)(addr+4));
7161 + err |= get_user(nop, (unsigned int *)(addr+8));
7162 + if (err)
7163 + break;
7164 +
7165 +#ifdef CONFIG_PAX_DLRESOLVE
7166 + if (save == 0x9DE3BFA8U &&
7167 + (call & 0xC0000000U) == 0x40000000U &&
7168 + nop == 0x01000000U)
7169 + {
7170 + struct vm_area_struct *vma;
7171 + unsigned long call_dl_resolve;
7172 +
7173 + down_read(&current->mm->mmap_sem);
7174 + call_dl_resolve = current->mm->call_dl_resolve;
7175 + up_read(&current->mm->mmap_sem);
7176 + if (likely(call_dl_resolve))
7177 + goto emulate;
7178 +
7179 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
7180 +
7181 + down_write(&current->mm->mmap_sem);
7182 + if (current->mm->call_dl_resolve) {
7183 + call_dl_resolve = current->mm->call_dl_resolve;
7184 + up_write(&current->mm->mmap_sem);
7185 + if (vma)
7186 + kmem_cache_free(vm_area_cachep, vma);
7187 + goto emulate;
7188 + }
7189 +
7190 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7191 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7192 + up_write(&current->mm->mmap_sem);
7193 + if (vma)
7194 + kmem_cache_free(vm_area_cachep, vma);
7195 + return 1;
7196 + }
7197 +
7198 + if (pax_insert_vma(vma, call_dl_resolve)) {
7199 + up_write(&current->mm->mmap_sem);
7200 + kmem_cache_free(vm_area_cachep, vma);
7201 + return 1;
7202 + }
7203 +
7204 + current->mm->call_dl_resolve = call_dl_resolve;
7205 + up_write(&current->mm->mmap_sem);
7206 +
7207 +emulate:
7208 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7209 + regs->tpc = call_dl_resolve;
7210 + regs->tnpc = addr+4;
7211 + return 3;
7212 + }
7213 +#endif
7214 +
7215 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
7216 + if ((save & 0xFFC00000U) == 0x05000000U &&
7217 + (call & 0xFFFFE000U) == 0x85C0A000U &&
7218 + nop == 0x01000000U)
7219 + {
7220 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7221 + regs->u_regs[UREG_G2] = addr + 4;
7222 + addr = (save & 0x003FFFFFU) << 10;
7223 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7224 +
7225 + if (test_thread_flag(TIF_32BIT))
7226 + addr &= 0xFFFFFFFFUL;
7227 +
7228 + regs->tpc = addr;
7229 + regs->tnpc = addr+4;
7230 + return 3;
7231 + }
7232 +
7233 + /* PaX: 64-bit PLT stub */
7234 + err = get_user(sethi1, (unsigned int *)addr);
7235 + err |= get_user(sethi2, (unsigned int *)(addr+4));
7236 + err |= get_user(or1, (unsigned int *)(addr+8));
7237 + err |= get_user(or2, (unsigned int *)(addr+12));
7238 + err |= get_user(sllx, (unsigned int *)(addr+16));
7239 + err |= get_user(add, (unsigned int *)(addr+20));
7240 + err |= get_user(jmpl, (unsigned int *)(addr+24));
7241 + err |= get_user(nop, (unsigned int *)(addr+28));
7242 + if (err)
7243 + break;
7244 +
7245 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
7246 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7247 + (or1 & 0xFFFFE000U) == 0x88112000U &&
7248 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
7249 + sllx == 0x89293020U &&
7250 + add == 0x8A010005U &&
7251 + jmpl == 0x89C14000U &&
7252 + nop == 0x01000000U)
7253 + {
7254 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7255 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7256 + regs->u_regs[UREG_G4] <<= 32;
7257 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7258 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
7259 + regs->u_regs[UREG_G4] = addr + 24;
7260 + addr = regs->u_regs[UREG_G5];
7261 + regs->tpc = addr;
7262 + regs->tnpc = addr+4;
7263 + return 3;
7264 + }
7265 + }
7266 + } while (0);
7267 +
7268 +#ifdef CONFIG_PAX_DLRESOLVE
7269 + do { /* PaX: unpatched PLT emulation step 2 */
7270 + unsigned int save, call, nop;
7271 +
7272 + err = get_user(save, (unsigned int *)(regs->tpc-4));
7273 + err |= get_user(call, (unsigned int *)regs->tpc);
7274 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
7275 + if (err)
7276 + break;
7277 +
7278 + if (save == 0x9DE3BFA8U &&
7279 + (call & 0xC0000000U) == 0x40000000U &&
7280 + nop == 0x01000000U)
7281 + {
7282 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7283 +
7284 + if (test_thread_flag(TIF_32BIT))
7285 + dl_resolve &= 0xFFFFFFFFUL;
7286 +
7287 + regs->u_regs[UREG_RETPC] = regs->tpc;
7288 + regs->tpc = dl_resolve;
7289 + regs->tnpc = dl_resolve+4;
7290 + return 3;
7291 + }
7292 + } while (0);
7293 +#endif
7294 +
7295 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
7296 + unsigned int sethi, ba, nop;
7297 +
7298 + err = get_user(sethi, (unsigned int *)regs->tpc);
7299 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7300 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7301 +
7302 + if (err)
7303 + break;
7304 +
7305 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7306 + (ba & 0xFFF00000U) == 0x30600000U &&
7307 + nop == 0x01000000U)
7308 + {
7309 + unsigned long addr;
7310 +
7311 + addr = (sethi & 0x003FFFFFU) << 10;
7312 + regs->u_regs[UREG_G1] = addr;
7313 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7314 +
7315 + if (test_thread_flag(TIF_32BIT))
7316 + addr &= 0xFFFFFFFFUL;
7317 +
7318 + regs->tpc = addr;
7319 + regs->tnpc = addr+4;
7320 + return 2;
7321 + }
7322 + } while (0);
7323 +
7324 +#endif
7325 +
7326 + return 1;
7327 +}
7328 +
7329 +void pax_report_insns(void *pc, void *sp)
7330 +{
7331 + unsigned long i;
7332 +
7333 + printk(KERN_ERR "PAX: bytes at PC: ");
7334 + for (i = 0; i < 8; i++) {
7335 + unsigned int c;
7336 + if (get_user(c, (unsigned int *)pc+i))
7337 + printk(KERN_CONT "???????? ");
7338 + else
7339 + printk(KERN_CONT "%08x ", c);
7340 + }
7341 + printk("\n");
7342 +}
7343 +#endif
7344 +
7345 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
7346 {
7347 struct mm_struct *mm = current->mm;
7348 @@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau
7349 if (!vma)
7350 goto bad_area;
7351
7352 +#ifdef CONFIG_PAX_PAGEEXEC
7353 + /* PaX: detect ITLB misses on non-exec pages */
7354 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
7355 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
7356 + {
7357 + if (address != regs->tpc)
7358 + goto good_area;
7359 +
7360 + up_read(&mm->mmap_sem);
7361 + switch (pax_handle_fetch_fault(regs)) {
7362 +
7363 +#ifdef CONFIG_PAX_EMUPLT
7364 + case 2:
7365 + case 3:
7366 + return;
7367 +#endif
7368 +
7369 + }
7370 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
7371 + do_group_exit(SIGKILL);
7372 + }
7373 +#endif
7374 +
7375 /* Pure DTLB misses do not tell us whether the fault causing
7376 * load/store/atomic was a write or not, it only says that there
7377 * was no match. So in such a case we (carefully) read the
7378 diff -urNp linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c
7379 --- linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
7380 +++ linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
7381 @@ -68,7 +68,7 @@ full_search:
7382 }
7383 return -ENOMEM;
7384 }
7385 - if (likely(!vma || addr + len <= vma->vm_start)) {
7386 + if (likely(check_heap_stack_gap(vma, addr, len))) {
7387 /*
7388 * Remember the place where we stopped the search:
7389 */
7390 @@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct
7391 /* make sure it can fit in the remaining address space */
7392 if (likely(addr > len)) {
7393 vma = find_vma(mm, addr-len);
7394 - if (!vma || addr <= vma->vm_start) {
7395 + if (check_heap_stack_gap(vma, addr - len, len)) {
7396 /* remember the address as a hint for next time */
7397 return (mm->free_area_cache = addr-len);
7398 }
7399 @@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct
7400 if (unlikely(mm->mmap_base < len))
7401 goto bottomup;
7402
7403 - addr = (mm->mmap_base-len) & HPAGE_MASK;
7404 + addr = mm->mmap_base - len;
7405
7406 do {
7407 + addr &= HPAGE_MASK;
7408 /*
7409 * Lookup failure means no vma is above this address,
7410 * else if new region fits below vma->vm_start,
7411 * return with success:
7412 */
7413 vma = find_vma(mm, addr);
7414 - if (likely(!vma || addr+len <= vma->vm_start)) {
7415 + if (likely(check_heap_stack_gap(vma, addr, len))) {
7416 /* remember the address as a hint for next time */
7417 return (mm->free_area_cache = addr);
7418 }
7419 @@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct
7420 mm->cached_hole_size = vma->vm_start - addr;
7421
7422 /* try just below the current vma->vm_start */
7423 - addr = (vma->vm_start-len) & HPAGE_MASK;
7424 - } while (likely(len < vma->vm_start));
7425 + addr = skip_heap_stack_gap(vma, len);
7426 + } while (!IS_ERR_VALUE(addr));
7427
7428 bottomup:
7429 /*
7430 @@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f
7431 if (addr) {
7432 addr = ALIGN(addr, HPAGE_SIZE);
7433 vma = find_vma(mm, addr);
7434 - if (task_size - len >= addr &&
7435 - (!vma || addr + len <= vma->vm_start))
7436 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
7437 return addr;
7438 }
7439 if (mm->get_unmapped_area == arch_get_unmapped_area)
7440 diff -urNp linux-2.6.39.1/arch/sparc/mm/init_32.c linux-2.6.39.1/arch/sparc/mm/init_32.c
7441 --- linux-2.6.39.1/arch/sparc/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
7442 +++ linux-2.6.39.1/arch/sparc/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
7443 @@ -318,6 +318,9 @@ extern void device_scan(void);
7444 pgprot_t PAGE_SHARED __read_mostly;
7445 EXPORT_SYMBOL(PAGE_SHARED);
7446
7447 +pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
7448 +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
7449 +
7450 void __init paging_init(void)
7451 {
7452 switch(sparc_cpu_model) {
7453 @@ -346,17 +349,17 @@ void __init paging_init(void)
7454
7455 /* Initialize the protection map with non-constant, MMU dependent values. */
7456 protection_map[0] = PAGE_NONE;
7457 - protection_map[1] = PAGE_READONLY;
7458 - protection_map[2] = PAGE_COPY;
7459 - protection_map[3] = PAGE_COPY;
7460 + protection_map[1] = PAGE_READONLY_NOEXEC;
7461 + protection_map[2] = PAGE_COPY_NOEXEC;
7462 + protection_map[3] = PAGE_COPY_NOEXEC;
7463 protection_map[4] = PAGE_READONLY;
7464 protection_map[5] = PAGE_READONLY;
7465 protection_map[6] = PAGE_COPY;
7466 protection_map[7] = PAGE_COPY;
7467 protection_map[8] = PAGE_NONE;
7468 - protection_map[9] = PAGE_READONLY;
7469 - protection_map[10] = PAGE_SHARED;
7470 - protection_map[11] = PAGE_SHARED;
7471 + protection_map[9] = PAGE_READONLY_NOEXEC;
7472 + protection_map[10] = PAGE_SHARED_NOEXEC;
7473 + protection_map[11] = PAGE_SHARED_NOEXEC;
7474 protection_map[12] = PAGE_READONLY;
7475 protection_map[13] = PAGE_READONLY;
7476 protection_map[14] = PAGE_SHARED;
7477 diff -urNp linux-2.6.39.1/arch/sparc/mm/Makefile linux-2.6.39.1/arch/sparc/mm/Makefile
7478 --- linux-2.6.39.1/arch/sparc/mm/Makefile 2011-05-19 00:06:34.000000000 -0400
7479 +++ linux-2.6.39.1/arch/sparc/mm/Makefile 2011-05-22 19:36:30.000000000 -0400
7480 @@ -2,7 +2,7 @@
7481 #
7482
7483 asflags-y := -ansi
7484 -ccflags-y := -Werror
7485 +#ccflags-y := -Werror
7486
7487 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
7488 obj-y += fault_$(BITS).o
7489 diff -urNp linux-2.6.39.1/arch/sparc/mm/srmmu.c linux-2.6.39.1/arch/sparc/mm/srmmu.c
7490 --- linux-2.6.39.1/arch/sparc/mm/srmmu.c 2011-05-19 00:06:34.000000000 -0400
7491 +++ linux-2.6.39.1/arch/sparc/mm/srmmu.c 2011-05-22 19:36:30.000000000 -0400
7492 @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
7493 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
7494 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
7495 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
7496 +
7497 +#ifdef CONFIG_PAX_PAGEEXEC
7498 + PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
7499 + BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
7500 + BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
7501 +#endif
7502 +
7503 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
7504 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
7505
7506 diff -urNp linux-2.6.39.1/arch/tile/kernel/pci.c linux-2.6.39.1/arch/tile/kernel/pci.c
7507 --- linux-2.6.39.1/arch/tile/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7508 +++ linux-2.6.39.1/arch/tile/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7509 @@ -60,7 +60,7 @@ int __write_once tile_plx_gen1;
7510 static struct pci_controller controllers[TILE_NUM_PCIE];
7511 static int num_controllers;
7512
7513 -static struct pci_ops tile_cfg_ops;
7514 +static const struct pci_ops tile_cfg_ops;
7515
7516
7517 /*
7518 @@ -564,7 +564,7 @@ static int __devinit tile_cfg_write(stru
7519 }
7520
7521
7522 -static struct pci_ops tile_cfg_ops = {
7523 +static const struct pci_ops tile_cfg_ops = {
7524 .read = tile_cfg_read,
7525 .write = tile_cfg_write,
7526 };
7527 diff -urNp linux-2.6.39.1/arch/um/include/asm/kmap_types.h linux-2.6.39.1/arch/um/include/asm/kmap_types.h
7528 --- linux-2.6.39.1/arch/um/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
7529 +++ linux-2.6.39.1/arch/um/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
7530 @@ -23,6 +23,7 @@ enum km_type {
7531 KM_IRQ1,
7532 KM_SOFTIRQ0,
7533 KM_SOFTIRQ1,
7534 + KM_CLEARPAGE,
7535 KM_TYPE_NR
7536 };
7537
7538 diff -urNp linux-2.6.39.1/arch/um/include/asm/page.h linux-2.6.39.1/arch/um/include/asm/page.h
7539 --- linux-2.6.39.1/arch/um/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
7540 +++ linux-2.6.39.1/arch/um/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
7541 @@ -14,6 +14,9 @@
7542 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
7543 #define PAGE_MASK (~(PAGE_SIZE-1))
7544
7545 +#define ktla_ktva(addr) (addr)
7546 +#define ktva_ktla(addr) (addr)
7547 +
7548 #ifndef __ASSEMBLY__
7549
7550 struct page;
7551 diff -urNp linux-2.6.39.1/arch/um/kernel/process.c linux-2.6.39.1/arch/um/kernel/process.c
7552 --- linux-2.6.39.1/arch/um/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
7553 +++ linux-2.6.39.1/arch/um/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
7554 @@ -404,22 +404,6 @@ int singlestepping(void * t)
7555 return 2;
7556 }
7557
7558 -/*
7559 - * Only x86 and x86_64 have an arch_align_stack().
7560 - * All other arches have "#define arch_align_stack(x) (x)"
7561 - * in their asm/system.h
7562 - * As this is included in UML from asm-um/system-generic.h,
7563 - * we can use it to behave as the subarch does.
7564 - */
7565 -#ifndef arch_align_stack
7566 -unsigned long arch_align_stack(unsigned long sp)
7567 -{
7568 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
7569 - sp -= get_random_int() % 8192;
7570 - return sp & ~0xf;
7571 -}
7572 -#endif
7573 -
7574 unsigned long get_wchan(struct task_struct *p)
7575 {
7576 unsigned long stack_page, sp, ip;
7577 diff -urNp linux-2.6.39.1/arch/um/sys-i386/syscalls.c linux-2.6.39.1/arch/um/sys-i386/syscalls.c
7578 --- linux-2.6.39.1/arch/um/sys-i386/syscalls.c 2011-05-19 00:06:34.000000000 -0400
7579 +++ linux-2.6.39.1/arch/um/sys-i386/syscalls.c 2011-05-22 19:36:30.000000000 -0400
7580 @@ -11,6 +11,21 @@
7581 #include "asm/uaccess.h"
7582 #include "asm/unistd.h"
7583
7584 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
7585 +{
7586 + unsigned long pax_task_size = TASK_SIZE;
7587 +
7588 +#ifdef CONFIG_PAX_SEGMEXEC
7589 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
7590 + pax_task_size = SEGMEXEC_TASK_SIZE;
7591 +#endif
7592 +
7593 + if (len > pax_task_size || addr > pax_task_size - len)
7594 + return -EINVAL;
7595 +
7596 + return 0;
7597 +}
7598 +
7599 /*
7600 * The prototype on i386 is:
7601 *
7602 diff -urNp linux-2.6.39.1/arch/unicore32/kernel/pci.c linux-2.6.39.1/arch/unicore32/kernel/pci.c
7603 --- linux-2.6.39.1/arch/unicore32/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7604 +++ linux-2.6.39.1/arch/unicore32/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7605 @@ -66,7 +66,7 @@ puv3_write_config(struct pci_bus *bus, u
7606 return PCIBIOS_SUCCESSFUL;
7607 }
7608
7609 -struct pci_ops pci_puv3_ops = {
7610 +const struct pci_ops pci_puv3_ops = {
7611 .read = puv3_read_config,
7612 .write = puv3_write_config,
7613 };
7614 diff -urNp linux-2.6.39.1/arch/x86/boot/bitops.h linux-2.6.39.1/arch/x86/boot/bitops.h
7615 --- linux-2.6.39.1/arch/x86/boot/bitops.h 2011-05-19 00:06:34.000000000 -0400
7616 +++ linux-2.6.39.1/arch/x86/boot/bitops.h 2011-05-22 19:36:30.000000000 -0400
7617 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int
7618 u8 v;
7619 const u32 *p = (const u32 *)addr;
7620
7621 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7622 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7623 return v;
7624 }
7625
7626 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int
7627
7628 static inline void set_bit(int nr, void *addr)
7629 {
7630 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7631 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7632 }
7633
7634 #endif /* BOOT_BITOPS_H */
7635 diff -urNp linux-2.6.39.1/arch/x86/boot/boot.h linux-2.6.39.1/arch/x86/boot/boot.h
7636 --- linux-2.6.39.1/arch/x86/boot/boot.h 2011-05-19 00:06:34.000000000 -0400
7637 +++ linux-2.6.39.1/arch/x86/boot/boot.h 2011-05-22 19:36:30.000000000 -0400
7638 @@ -85,7 +85,7 @@ static inline void io_delay(void)
7639 static inline u16 ds(void)
7640 {
7641 u16 seg;
7642 - asm("movw %%ds,%0" : "=rm" (seg));
7643 + asm volatile("movw %%ds,%0" : "=rm" (seg));
7644 return seg;
7645 }
7646
7647 @@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t
7648 static inline int memcmp(const void *s1, const void *s2, size_t len)
7649 {
7650 u8 diff;
7651 - asm("repe; cmpsb; setnz %0"
7652 + asm volatile("repe; cmpsb; setnz %0"
7653 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
7654 return diff;
7655 }
7656 diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/head_32.S linux-2.6.39.1/arch/x86/boot/compressed/head_32.S
7657 --- linux-2.6.39.1/arch/x86/boot/compressed/head_32.S 2011-05-19 00:06:34.000000000 -0400
7658 +++ linux-2.6.39.1/arch/x86/boot/compressed/head_32.S 2011-05-22 19:36:30.000000000 -0400
7659 @@ -76,7 +76,7 @@ ENTRY(startup_32)
7660 notl %eax
7661 andl %eax, %ebx
7662 #else
7663 - movl $LOAD_PHYSICAL_ADDR, %ebx
7664 + movl $____LOAD_PHYSICAL_ADDR, %ebx
7665 #endif
7666
7667 /* Target address to relocate to for decompression */
7668 @@ -162,7 +162,7 @@ relocated:
7669 * and where it was actually loaded.
7670 */
7671 movl %ebp, %ebx
7672 - subl $LOAD_PHYSICAL_ADDR, %ebx
7673 + subl $____LOAD_PHYSICAL_ADDR, %ebx
7674 jz 2f /* Nothing to be done if loaded at compiled addr. */
7675 /*
7676 * Process relocations.
7677 @@ -170,8 +170,7 @@ relocated:
7678
7679 1: subl $4, %edi
7680 movl (%edi), %ecx
7681 - testl %ecx, %ecx
7682 - jz 2f
7683 + jecxz 2f
7684 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
7685 jmp 1b
7686 2:
7687 diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/head_64.S linux-2.6.39.1/arch/x86/boot/compressed/head_64.S
7688 --- linux-2.6.39.1/arch/x86/boot/compressed/head_64.S 2011-05-19 00:06:34.000000000 -0400
7689 +++ linux-2.6.39.1/arch/x86/boot/compressed/head_64.S 2011-05-22 19:36:30.000000000 -0400
7690 @@ -91,7 +91,7 @@ ENTRY(startup_32)
7691 notl %eax
7692 andl %eax, %ebx
7693 #else
7694 - movl $LOAD_PHYSICAL_ADDR, %ebx
7695 + movl $____LOAD_PHYSICAL_ADDR, %ebx
7696 #endif
7697
7698 /* Target address to relocate to for decompression */
7699 @@ -233,7 +233,7 @@ ENTRY(startup_64)
7700 notq %rax
7701 andq %rax, %rbp
7702 #else
7703 - movq $LOAD_PHYSICAL_ADDR, %rbp
7704 + movq $____LOAD_PHYSICAL_ADDR, %rbp
7705 #endif
7706
7707 /* Target address to relocate to for decompression */
7708 diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/misc.c linux-2.6.39.1/arch/x86/boot/compressed/misc.c
7709 --- linux-2.6.39.1/arch/x86/boot/compressed/misc.c 2011-05-19 00:06:34.000000000 -0400
7710 +++ linux-2.6.39.1/arch/x86/boot/compressed/misc.c 2011-05-22 19:36:30.000000000 -0400
7711 @@ -310,7 +310,7 @@ static void parse_elf(void *output)
7712 case PT_LOAD:
7713 #ifdef CONFIG_RELOCATABLE
7714 dest = output;
7715 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
7716 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
7717 #else
7718 dest = (void *)(phdr->p_paddr);
7719 #endif
7720 @@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *
7721 error("Destination address too large");
7722 #endif
7723 #ifndef CONFIG_RELOCATABLE
7724 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
7725 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
7726 error("Wrong destination address");
7727 #endif
7728
7729 diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/relocs.c linux-2.6.39.1/arch/x86/boot/compressed/relocs.c
7730 --- linux-2.6.39.1/arch/x86/boot/compressed/relocs.c 2011-05-19 00:06:34.000000000 -0400
7731 +++ linux-2.6.39.1/arch/x86/boot/compressed/relocs.c 2011-05-22 19:36:30.000000000 -0400
7732 @@ -13,8 +13,11 @@
7733
7734 static void die(char *fmt, ...);
7735
7736 +#include "../../../../include/generated/autoconf.h"
7737 +
7738 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
7739 static Elf32_Ehdr ehdr;
7740 +static Elf32_Phdr *phdr;
7741 static unsigned long reloc_count, reloc_idx;
7742 static unsigned long *relocs;
7743
7744 @@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
7745 }
7746 }
7747
7748 +static void read_phdrs(FILE *fp)
7749 +{
7750 + unsigned int i;
7751 +
7752 + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
7753 + if (!phdr) {
7754 + die("Unable to allocate %d program headers\n",
7755 + ehdr.e_phnum);
7756 + }
7757 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
7758 + die("Seek to %d failed: %s\n",
7759 + ehdr.e_phoff, strerror(errno));
7760 + }
7761 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
7762 + die("Cannot read ELF program headers: %s\n",
7763 + strerror(errno));
7764 + }
7765 + for(i = 0; i < ehdr.e_phnum; i++) {
7766 + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
7767 + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
7768 + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
7769 + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
7770 + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
7771 + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
7772 + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
7773 + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
7774 + }
7775 +
7776 +}
7777 +
7778 static void read_shdrs(FILE *fp)
7779 {
7780 - int i;
7781 + unsigned int i;
7782 Elf32_Shdr shdr;
7783
7784 secs = calloc(ehdr.e_shnum, sizeof(struct section));
7785 @@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
7786
7787 static void read_strtabs(FILE *fp)
7788 {
7789 - int i;
7790 + unsigned int i;
7791 for (i = 0; i < ehdr.e_shnum; i++) {
7792 struct section *sec = &secs[i];
7793 if (sec->shdr.sh_type != SHT_STRTAB) {
7794 @@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
7795
7796 static void read_symtabs(FILE *fp)
7797 {
7798 - int i,j;
7799 + unsigned int i,j;
7800 for (i = 0; i < ehdr.e_shnum; i++) {
7801 struct section *sec = &secs[i];
7802 if (sec->shdr.sh_type != SHT_SYMTAB) {
7803 @@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
7804
7805 static void read_relocs(FILE *fp)
7806 {
7807 - int i,j;
7808 + unsigned int i,j;
7809 + uint32_t base;
7810 +
7811 for (i = 0; i < ehdr.e_shnum; i++) {
7812 struct section *sec = &secs[i];
7813 if (sec->shdr.sh_type != SHT_REL) {
7814 @@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
7815 die("Cannot read symbol table: %s\n",
7816 strerror(errno));
7817 }
7818 + base = 0;
7819 + for (j = 0; j < ehdr.e_phnum; j++) {
7820 + if (phdr[j].p_type != PT_LOAD )
7821 + continue;
7822 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
7823 + continue;
7824 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
7825 + break;
7826 + }
7827 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
7828 Elf32_Rel *rel = &sec->reltab[j];
7829 - rel->r_offset = elf32_to_cpu(rel->r_offset);
7830 + rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
7831 rel->r_info = elf32_to_cpu(rel->r_info);
7832 }
7833 }
7834 @@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
7835
7836 static void print_absolute_symbols(void)
7837 {
7838 - int i;
7839 + unsigned int i;
7840 printf("Absolute symbols\n");
7841 printf(" Num: Value Size Type Bind Visibility Name\n");
7842 for (i = 0; i < ehdr.e_shnum; i++) {
7843 struct section *sec = &secs[i];
7844 char *sym_strtab;
7845 Elf32_Sym *sh_symtab;
7846 - int j;
7847 + unsigned int j;
7848
7849 if (sec->shdr.sh_type != SHT_SYMTAB) {
7850 continue;
7851 @@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
7852
7853 static void print_absolute_relocs(void)
7854 {
7855 - int i, printed = 0;
7856 + unsigned int i, printed = 0;
7857
7858 for (i = 0; i < ehdr.e_shnum; i++) {
7859 struct section *sec = &secs[i];
7860 struct section *sec_applies, *sec_symtab;
7861 char *sym_strtab;
7862 Elf32_Sym *sh_symtab;
7863 - int j;
7864 + unsigned int j;
7865 if (sec->shdr.sh_type != SHT_REL) {
7866 continue;
7867 }
7868 @@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
7869
7870 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
7871 {
7872 - int i;
7873 + unsigned int i;
7874 /* Walk through the relocations */
7875 for (i = 0; i < ehdr.e_shnum; i++) {
7876 char *sym_strtab;
7877 Elf32_Sym *sh_symtab;
7878 struct section *sec_applies, *sec_symtab;
7879 - int j;
7880 + unsigned int j;
7881 struct section *sec = &secs[i];
7882
7883 if (sec->shdr.sh_type != SHT_REL) {
7884 @@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
7885 !is_rel_reloc(sym_name(sym_strtab, sym))) {
7886 continue;
7887 }
7888 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
7889 + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
7890 + continue;
7891 +
7892 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
7893 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
7894 + if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
7895 + continue;
7896 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
7897 + continue;
7898 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
7899 + continue;
7900 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
7901 + continue;
7902 +#endif
7903 +
7904 switch (r_type) {
7905 case R_386_NONE:
7906 case R_386_PC32:
7907 @@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
7908
7909 static void emit_relocs(int as_text)
7910 {
7911 - int i;
7912 + unsigned int i;
7913 /* Count how many relocations I have and allocate space for them. */
7914 reloc_count = 0;
7915 walk_relocs(count_reloc);
7916 @@ -665,6 +725,7 @@ int main(int argc, char **argv)
7917 fname, strerror(errno));
7918 }
7919 read_ehdr(fp);
7920 + read_phdrs(fp);
7921 read_shdrs(fp);
7922 read_strtabs(fp);
7923 read_symtabs(fp);
7924 diff -urNp linux-2.6.39.1/arch/x86/boot/cpucheck.c linux-2.6.39.1/arch/x86/boot/cpucheck.c
7925 --- linux-2.6.39.1/arch/x86/boot/cpucheck.c 2011-05-19 00:06:34.000000000 -0400
7926 +++ linux-2.6.39.1/arch/x86/boot/cpucheck.c 2011-05-22 19:36:30.000000000 -0400
7927 @@ -74,7 +74,7 @@ static int has_fpu(void)
7928 u16 fcw = -1, fsw = -1;
7929 u32 cr0;
7930
7931 - asm("movl %%cr0,%0" : "=r" (cr0));
7932 + asm volatile("movl %%cr0,%0" : "=r" (cr0));
7933 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
7934 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
7935 asm volatile("movl %0,%%cr0" : : "r" (cr0));
7936 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
7937 {
7938 u32 f0, f1;
7939
7940 - asm("pushfl ; "
7941 + asm volatile("pushfl ; "
7942 "pushfl ; "
7943 "popl %0 ; "
7944 "movl %0,%1 ; "
7945 @@ -115,7 +115,7 @@ static void get_flags(void)
7946 set_bit(X86_FEATURE_FPU, cpu.flags);
7947
7948 if (has_eflag(X86_EFLAGS_ID)) {
7949 - asm("cpuid"
7950 + asm volatile("cpuid"
7951 : "=a" (max_intel_level),
7952 "=b" (cpu_vendor[0]),
7953 "=d" (cpu_vendor[1]),
7954 @@ -124,7 +124,7 @@ static void get_flags(void)
7955
7956 if (max_intel_level >= 0x00000001 &&
7957 max_intel_level <= 0x0000ffff) {
7958 - asm("cpuid"
7959 + asm volatile("cpuid"
7960 : "=a" (tfms),
7961 "=c" (cpu.flags[4]),
7962 "=d" (cpu.flags[0])
7963 @@ -136,7 +136,7 @@ static void get_flags(void)
7964 cpu.model += ((tfms >> 16) & 0xf) << 4;
7965 }
7966
7967 - asm("cpuid"
7968 + asm volatile("cpuid"
7969 : "=a" (max_amd_level)
7970 : "a" (0x80000000)
7971 : "ebx", "ecx", "edx");
7972 @@ -144,7 +144,7 @@ static void get_flags(void)
7973 if (max_amd_level >= 0x80000001 &&
7974 max_amd_level <= 0x8000ffff) {
7975 u32 eax = 0x80000001;
7976 - asm("cpuid"
7977 + asm volatile("cpuid"
7978 : "+a" (eax),
7979 "=c" (cpu.flags[6]),
7980 "=d" (cpu.flags[1])
7981 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7982 u32 ecx = MSR_K7_HWCR;
7983 u32 eax, edx;
7984
7985 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7986 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7987 eax &= ~(1 << 15);
7988 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7989 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7990
7991 get_flags(); /* Make sure it really did something */
7992 err = check_flags();
7993 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7994 u32 ecx = MSR_VIA_FCR;
7995 u32 eax, edx;
7996
7997 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7998 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7999 eax |= (1<<1)|(1<<7);
8000 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8001 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8002
8003 set_bit(X86_FEATURE_CX8, cpu.flags);
8004 err = check_flags();
8005 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
8006 u32 eax, edx;
8007 u32 level = 1;
8008
8009 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8010 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
8011 - asm("cpuid"
8012 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8013 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
8014 + asm volatile("cpuid"
8015 : "+a" (level), "=d" (cpu.flags[0])
8016 : : "ecx", "ebx");
8017 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8018 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8019
8020 err = check_flags();
8021 }
8022 diff -urNp linux-2.6.39.1/arch/x86/boot/header.S linux-2.6.39.1/arch/x86/boot/header.S
8023 --- linux-2.6.39.1/arch/x86/boot/header.S 2011-05-19 00:06:34.000000000 -0400
8024 +++ linux-2.6.39.1/arch/x86/boot/header.S 2011-05-22 19:36:30.000000000 -0400
8025 @@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
8026 # single linked list of
8027 # struct setup_data
8028
8029 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
8030 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
8031
8032 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
8033 #define VO_INIT_SIZE (VO__end - VO__text)
8034 diff -urNp linux-2.6.39.1/arch/x86/boot/memory.c linux-2.6.39.1/arch/x86/boot/memory.c
8035 --- linux-2.6.39.1/arch/x86/boot/memory.c 2011-05-19 00:06:34.000000000 -0400
8036 +++ linux-2.6.39.1/arch/x86/boot/memory.c 2011-05-22 19:36:30.000000000 -0400
8037 @@ -19,7 +19,7 @@
8038
8039 static int detect_memory_e820(void)
8040 {
8041 - int count = 0;
8042 + unsigned int count = 0;
8043 struct biosregs ireg, oreg;
8044 struct e820entry *desc = boot_params.e820_map;
8045 static struct e820entry buf; /* static so it is zeroed */
8046 diff -urNp linux-2.6.39.1/arch/x86/boot/video.c linux-2.6.39.1/arch/x86/boot/video.c
8047 --- linux-2.6.39.1/arch/x86/boot/video.c 2011-05-19 00:06:34.000000000 -0400
8048 +++ linux-2.6.39.1/arch/x86/boot/video.c 2011-05-22 19:36:30.000000000 -0400
8049 @@ -96,7 +96,7 @@ static void store_mode_params(void)
8050 static unsigned int get_entry(void)
8051 {
8052 char entry_buf[4];
8053 - int i, len = 0;
8054 + unsigned int i, len = 0;
8055 int key;
8056 unsigned int v;
8057
8058 diff -urNp linux-2.6.39.1/arch/x86/boot/video-vesa.c linux-2.6.39.1/arch/x86/boot/video-vesa.c
8059 --- linux-2.6.39.1/arch/x86/boot/video-vesa.c 2011-05-19 00:06:34.000000000 -0400
8060 +++ linux-2.6.39.1/arch/x86/boot/video-vesa.c 2011-05-22 19:36:30.000000000 -0400
8061 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
8062
8063 boot_params.screen_info.vesapm_seg = oreg.es;
8064 boot_params.screen_info.vesapm_off = oreg.di;
8065 + boot_params.screen_info.vesapm_size = oreg.cx;
8066 }
8067
8068 /*
8069 diff -urNp linux-2.6.39.1/arch/x86/ia32/ia32_aout.c linux-2.6.39.1/arch/x86/ia32/ia32_aout.c
8070 --- linux-2.6.39.1/arch/x86/ia32/ia32_aout.c 2011-05-19 00:06:34.000000000 -0400
8071 +++ linux-2.6.39.1/arch/x86/ia32/ia32_aout.c 2011-05-22 19:41:32.000000000 -0400
8072 @@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
8073 unsigned long dump_start, dump_size;
8074 struct user32 dump;
8075
8076 + memset(&dump, 0, sizeof(dump));
8077 +
8078 fs = get_fs();
8079 set_fs(KERNEL_DS);
8080 has_dumped = 1;
8081 diff -urNp linux-2.6.39.1/arch/x86/ia32/ia32entry.S linux-2.6.39.1/arch/x86/ia32/ia32entry.S
8082 --- linux-2.6.39.1/arch/x86/ia32/ia32entry.S 2011-05-19 00:06:34.000000000 -0400
8083 +++ linux-2.6.39.1/arch/x86/ia32/ia32entry.S 2011-05-23 17:16:01.000000000 -0400
8084 @@ -13,6 +13,7 @@
8085 #include <asm/thread_info.h>
8086 #include <asm/segment.h>
8087 #include <asm/irqflags.h>
8088 +#include <asm/pgtable.h>
8089 #include <linux/linkage.h>
8090
8091 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
8092 @@ -95,6 +96,32 @@ ENTRY(native_irq_enable_sysexit)
8093 ENDPROC(native_irq_enable_sysexit)
8094 #endif
8095
8096 + .macro pax_enter_kernel_user
8097 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8098 + call pax_enter_kernel_user
8099 +#endif
8100 + .endm
8101 +
8102 + .macro pax_exit_kernel_user
8103 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8104 + call pax_exit_kernel_user
8105 +#endif
8106 +#ifdef CONFIG_PAX_RANDKSTACK
8107 + pushq %rax
8108 + call pax_randomize_kstack
8109 + popq %rax
8110 +#endif
8111 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
8112 + call pax_erase_kstack
8113 +#endif
8114 + .endm
8115 +
8116 + .macro pax_erase_kstack
8117 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
8118 + call pax_erase_kstack
8119 +#endif
8120 + .endm
8121 +
8122 /*
8123 * 32bit SYSENTER instruction entry.
8124 *
8125 @@ -121,7 +148,7 @@ ENTRY(ia32_sysenter_target)
8126 CFI_REGISTER rsp,rbp
8127 SWAPGS_UNSAFE_STACK
8128 movq PER_CPU_VAR(kernel_stack), %rsp
8129 - addq $(KERNEL_STACK_OFFSET),%rsp
8130 + pax_enter_kernel_user
8131 /*
8132 * No need to follow this irqs on/off section: the syscall
8133 * disabled irqs, here we enable it straight after entry:
8134 @@ -134,7 +161,8 @@ ENTRY(ia32_sysenter_target)
8135 CFI_REL_OFFSET rsp,0
8136 pushfq_cfi
8137 /*CFI_REL_OFFSET rflags,0*/
8138 - movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
8139 + GET_THREAD_INFO(%r10)
8140 + movl TI_sysenter_return(%r10), %r10d
8141 CFI_REGISTER rip,r10
8142 pushq_cfi $__USER32_CS
8143 /*CFI_REL_OFFSET cs,0*/
8144 @@ -146,6 +174,12 @@ ENTRY(ia32_sysenter_target)
8145 SAVE_ARGS 0,0,1
8146 /* no need to do an access_ok check here because rbp has been
8147 32bit zero extended */
8148 +
8149 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8150 + mov $PAX_USER_SHADOW_BASE,%r10
8151 + add %r10,%rbp
8152 +#endif
8153 +
8154 1: movl (%rbp),%ebp
8155 .section __ex_table,"a"
8156 .quad 1b,ia32_badarg
8157 @@ -168,6 +202,7 @@ sysenter_dispatch:
8158 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8159 jnz sysexit_audit
8160 sysexit_from_sys_call:
8161 + pax_exit_kernel_user
8162 andl $~TS_COMPAT,TI_status(%r10)
8163 /* clear IF, that popfq doesn't enable interrupts early */
8164 andl $~0x200,EFLAGS-R11(%rsp)
8165 @@ -194,6 +229,9 @@ sysexit_from_sys_call:
8166 movl %eax,%esi /* 2nd arg: syscall number */
8167 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
8168 call audit_syscall_entry
8169 +
8170 + pax_erase_kstack
8171 +
8172 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
8173 cmpq $(IA32_NR_syscalls-1),%rax
8174 ja ia32_badsys
8175 @@ -246,6 +284,9 @@ sysenter_tracesys:
8176 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
8177 movq %rsp,%rdi /* &pt_regs -> arg1 */
8178 call syscall_trace_enter
8179 +
8180 + pax_erase_kstack
8181 +
8182 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8183 RESTORE_REST
8184 cmpq $(IA32_NR_syscalls-1),%rax
8185 @@ -277,19 +318,24 @@ ENDPROC(ia32_sysenter_target)
8186 ENTRY(ia32_cstar_target)
8187 CFI_STARTPROC32 simple
8188 CFI_SIGNAL_FRAME
8189 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
8190 + CFI_DEF_CFA rsp,0
8191 CFI_REGISTER rip,rcx
8192 /*CFI_REGISTER rflags,r11*/
8193 SWAPGS_UNSAFE_STACK
8194 movl %esp,%r8d
8195 CFI_REGISTER rsp,r8
8196 movq PER_CPU_VAR(kernel_stack),%rsp
8197 +
8198 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8199 + pax_enter_kernel_user
8200 +#endif
8201 +
8202 /*
8203 * No need to follow this irqs on/off section: the syscall
8204 * disabled irqs and here we enable it straight after entry:
8205 */
8206 ENABLE_INTERRUPTS(CLBR_NONE)
8207 - SAVE_ARGS 8,1,1
8208 + SAVE_ARGS 8*6,1,1
8209 movl %eax,%eax /* zero extension */
8210 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
8211 movq %rcx,RIP-ARGOFFSET(%rsp)
8212 @@ -305,6 +351,12 @@ ENTRY(ia32_cstar_target)
8213 /* no need to do an access_ok check here because r8 has been
8214 32bit zero extended */
8215 /* hardware stack frame is complete now */
8216 +
8217 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8218 + mov $PAX_USER_SHADOW_BASE,%r10
8219 + add %r10,%r8
8220 +#endif
8221 +
8222 1: movl (%r8),%r9d
8223 .section __ex_table,"a"
8224 .quad 1b,ia32_badarg
8225 @@ -327,6 +379,7 @@ cstar_dispatch:
8226 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8227 jnz sysretl_audit
8228 sysretl_from_sys_call:
8229 + pax_exit_kernel_user
8230 andl $~TS_COMPAT,TI_status(%r10)
8231 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
8232 movl RIP-ARGOFFSET(%rsp),%ecx
8233 @@ -364,6 +417,9 @@ cstar_tracesys:
8234 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8235 movq %rsp,%rdi /* &pt_regs -> arg1 */
8236 call syscall_trace_enter
8237 +
8238 + pax_erase_kstack
8239 +
8240 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
8241 RESTORE_REST
8242 xchgl %ebp,%r9d
8243 @@ -409,6 +465,7 @@ ENTRY(ia32_syscall)
8244 CFI_REL_OFFSET rip,RIP-RIP
8245 PARAVIRT_ADJUST_EXCEPTION_FRAME
8246 SWAPGS
8247 + pax_enter_kernel_user
8248 /*
8249 * No need to follow this irqs on/off section: the syscall
8250 * disabled irqs and here we enable it straight after entry:
8251 @@ -441,6 +498,9 @@ ia32_tracesys:
8252 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8253 movq %rsp,%rdi /* &pt_regs -> arg1 */
8254 call syscall_trace_enter
8255 +
8256 + pax_erase_kstack
8257 +
8258 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8259 RESTORE_REST
8260 cmpq $(IA32_NR_syscalls-1),%rax
8261 diff -urNp linux-2.6.39.1/arch/x86/ia32/ia32_signal.c linux-2.6.39.1/arch/x86/ia32/ia32_signal.c
8262 --- linux-2.6.39.1/arch/x86/ia32/ia32_signal.c 2011-05-19 00:06:34.000000000 -0400
8263 +++ linux-2.6.39.1/arch/x86/ia32/ia32_signal.c 2011-05-22 19:36:30.000000000 -0400
8264 @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
8265 sp -= frame_size;
8266 /* Align the stack pointer according to the i386 ABI,
8267 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
8268 - sp = ((sp + 4) & -16ul) - 4;
8269 + sp = ((sp - 12) & -16ul) - 4;
8270 return (void __user *) sp;
8271 }
8272
8273 @@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
8274 * These are actually not used anymore, but left because some
8275 * gdb versions depend on them as a marker.
8276 */
8277 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8278 + put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8279 } put_user_catch(err);
8280
8281 if (err)
8282 @@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
8283 0xb8,
8284 __NR_ia32_rt_sigreturn,
8285 0x80cd,
8286 - 0,
8287 + 0
8288 };
8289
8290 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
8291 @@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
8292
8293 if (ka->sa.sa_flags & SA_RESTORER)
8294 restorer = ka->sa.sa_restorer;
8295 + else if (current->mm->context.vdso)
8296 + /* Return stub is in 32bit vsyscall page */
8297 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
8298 else
8299 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
8300 - rt_sigreturn);
8301 + restorer = &frame->retcode;
8302 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
8303
8304 /*
8305 * Not actually used anymore, but left because some gdb
8306 * versions need it.
8307 */
8308 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8309 + put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8310 } put_user_catch(err);
8311
8312 if (err)
8313 diff -urNp linux-2.6.39.1/arch/x86/include/asm/alternative.h linux-2.6.39.1/arch/x86/include/asm/alternative.h
8314 --- linux-2.6.39.1/arch/x86/include/asm/alternative.h 2011-05-19 00:06:34.000000000 -0400
8315 +++ linux-2.6.39.1/arch/x86/include/asm/alternative.h 2011-05-22 19:36:30.000000000 -0400
8316 @@ -94,7 +94,7 @@ static inline int alternatives_text_rese
8317 ".section .discard,\"aw\",@progbits\n" \
8318 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
8319 ".previous\n" \
8320 - ".section .altinstr_replacement, \"ax\"\n" \
8321 + ".section .altinstr_replacement, \"a\"\n" \
8322 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
8323 ".previous"
8324
8325 diff -urNp linux-2.6.39.1/arch/x86/include/asm/apm.h linux-2.6.39.1/arch/x86/include/asm/apm.h
8326 --- linux-2.6.39.1/arch/x86/include/asm/apm.h 2011-05-19 00:06:34.000000000 -0400
8327 +++ linux-2.6.39.1/arch/x86/include/asm/apm.h 2011-05-22 19:36:30.000000000 -0400
8328 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
8329 __asm__ __volatile__(APM_DO_ZERO_SEGS
8330 "pushl %%edi\n\t"
8331 "pushl %%ebp\n\t"
8332 - "lcall *%%cs:apm_bios_entry\n\t"
8333 + "lcall *%%ss:apm_bios_entry\n\t"
8334 "setc %%al\n\t"
8335 "popl %%ebp\n\t"
8336 "popl %%edi\n\t"
8337 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
8338 __asm__ __volatile__(APM_DO_ZERO_SEGS
8339 "pushl %%edi\n\t"
8340 "pushl %%ebp\n\t"
8341 - "lcall *%%cs:apm_bios_entry\n\t"
8342 + "lcall *%%ss:apm_bios_entry\n\t"
8343 "setc %%bl\n\t"
8344 "popl %%ebp\n\t"
8345 "popl %%edi\n\t"
8346 diff -urNp linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h
8347 --- linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h 2011-05-19 00:06:34.000000000 -0400
8348 +++ linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h 2011-05-22 19:36:30.000000000 -0400
8349 @@ -12,6 +12,14 @@ typedef struct {
8350 u64 __aligned(8) counter;
8351 } atomic64_t;
8352
8353 +#ifdef CONFIG_PAX_REFCOUNT
8354 +typedef struct {
8355 + u64 __aligned(8) counter;
8356 +} atomic64_unchecked_t;
8357 +#else
8358 +typedef atomic64_t atomic64_unchecked_t;
8359 +#endif
8360 +
8361 #define ATOMIC64_INIT(val) { (val) }
8362
8363 #ifdef CONFIG_X86_CMPXCHG64
8364 @@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
8365 }
8366
8367 /**
8368 + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
8369 + * @p: pointer to type atomic64_unchecked_t
8370 + * @o: expected value
8371 + * @n: new value
8372 + *
8373 + * Atomically sets @v to @n if it was equal to @o and returns
8374 + * the old value.
8375 + */
8376 +
8377 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
8378 +{
8379 + return cmpxchg64(&v->counter, o, n);
8380 +}
8381 +
8382 +/**
8383 * atomic64_xchg - xchg atomic64 variable
8384 * @v: pointer to type atomic64_t
8385 * @n: value to assign
8386 @@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
8387 }
8388
8389 /**
8390 + * atomic64_set_unchecked - set atomic64 variable
8391 + * @v: pointer to type atomic64_unchecked_t
8392 + * @n: value to assign
8393 + *
8394 + * Atomically sets the value of @v to @n.
8395 + */
8396 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
8397 +{
8398 + unsigned high = (unsigned)(i >> 32);
8399 + unsigned low = (unsigned)i;
8400 + asm volatile(ATOMIC64_ALTERNATIVE(set)
8401 + : "+b" (low), "+c" (high)
8402 + : "S" (v)
8403 + : "eax", "edx", "memory"
8404 + );
8405 +}
8406 +
8407 +/**
8408 * atomic64_read - read atomic64 variable
8409 * @v: pointer to type atomic64_t
8410 *
8411 @@ -93,6 +134,22 @@ static inline long long atomic64_read(at
8412 }
8413
8414 /**
8415 + * atomic64_read_unchecked - read atomic64 variable
8416 + * @v: pointer to type atomic64_unchecked_t
8417 + *
8418 + * Atomically reads the value of @v and returns it.
8419 + */
8420 +static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
8421 +{
8422 + long long r;
8423 + asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
8424 + : "=A" (r), "+c" (v)
8425 + : : "memory"
8426 + );
8427 + return r;
8428 + }
8429 +
8430 +/**
8431 * atomic64_add_return - add and return
8432 * @i: integer value to add
8433 * @v: pointer to type atomic64_t
8434 @@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
8435 return i;
8436 }
8437
8438 +/**
8439 + * atomic64_add_return_unchecked - add and return
8440 + * @i: integer value to add
8441 + * @v: pointer to type atomic64_unchecked_t
8442 + *
8443 + * Atomically adds @i to @v and returns @i + *@v
8444 + */
8445 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
8446 +{
8447 + asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
8448 + : "+A" (i), "+c" (v)
8449 + : : "memory"
8450 + );
8451 + return i;
8452 +}
8453 +
8454 /*
8455 * Other variants with different arithmetic operators:
8456 */
8457 @@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
8458 return a;
8459 }
8460
8461 +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8462 +{
8463 + long long a;
8464 + asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
8465 + : "=A" (a)
8466 + : "S" (v)
8467 + : "memory", "ecx"
8468 + );
8469 + return a;
8470 +}
8471 +
8472 static inline long long atomic64_dec_return(atomic64_t *v)
8473 {
8474 long long a;
8475 @@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
8476 }
8477
8478 /**
8479 + * atomic64_add_unchecked - add integer to atomic64 variable
8480 + * @i: integer value to add
8481 + * @v: pointer to type atomic64_unchecked_t
8482 + *
8483 + * Atomically adds @i to @v.
8484 + */
8485 +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
8486 +{
8487 + asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
8488 + : "+A" (i), "+c" (v)
8489 + : : "memory"
8490 + );
8491 + return i;
8492 +}
8493 +
8494 +/**
8495 * atomic64_sub - subtract the atomic64 variable
8496 * @i: integer value to subtract
8497 * @v: pointer to type atomic64_t
8498 diff -urNp linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h
8499 --- linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h 2011-05-19 00:06:34.000000000 -0400
8500 +++ linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h 2011-05-22 19:36:30.000000000 -0400
8501 @@ -18,7 +18,19 @@
8502 */
8503 static inline long atomic64_read(const atomic64_t *v)
8504 {
8505 - return (*(volatile long *)&(v)->counter);
8506 + return (*(volatile const long *)&(v)->counter);
8507 +}
8508 +
8509 +/**
8510 + * atomic64_read_unchecked - read atomic64 variable
8511 + * @v: pointer of type atomic64_unchecked_t
8512 + *
8513 + * Atomically reads the value of @v.
8514 + * Doesn't imply a read memory barrier.
8515 + */
8516 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8517 +{
8518 + return (*(volatile const long *)&(v)->counter);
8519 }
8520
8521 /**
8522 @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64
8523 }
8524
8525 /**
8526 + * atomic64_set_unchecked - set atomic64 variable
8527 + * @v: pointer to type atomic64_unchecked_t
8528 + * @i: required value
8529 + *
8530 + * Atomically sets the value of @v to @i.
8531 + */
8532 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8533 +{
8534 + v->counter = i;
8535 +}
8536 +
8537 +/**
8538 * atomic64_add - add integer to atomic64 variable
8539 * @i: integer value to add
8540 * @v: pointer to type atomic64_t
8541 @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64
8542 */
8543 static inline void atomic64_add(long i, atomic64_t *v)
8544 {
8545 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
8546 +
8547 +#ifdef CONFIG_PAX_REFCOUNT
8548 + "jno 0f\n"
8549 + LOCK_PREFIX "subq %1,%0\n"
8550 + "int $4\n0:\n"
8551 + _ASM_EXTABLE(0b, 0b)
8552 +#endif
8553 +
8554 + : "=m" (v->counter)
8555 + : "er" (i), "m" (v->counter));
8556 +}
8557 +
8558 +/**
8559 + * atomic64_add_unchecked - add integer to atomic64 variable
8560 + * @i: integer value to add
8561 + * @v: pointer to type atomic64_unchecked_t
8562 + *
8563 + * Atomically adds @i to @v.
8564 + */
8565 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
8566 +{
8567 asm volatile(LOCK_PREFIX "addq %1,%0"
8568 : "=m" (v->counter)
8569 : "er" (i), "m" (v->counter));
8570 @@ -56,7 +102,29 @@ static inline void atomic64_add(long i,
8571 */
8572 static inline void atomic64_sub(long i, atomic64_t *v)
8573 {
8574 - asm volatile(LOCK_PREFIX "subq %1,%0"
8575 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
8576 +
8577 +#ifdef CONFIG_PAX_REFCOUNT
8578 + "jno 0f\n"
8579 + LOCK_PREFIX "addq %1,%0\n"
8580 + "int $4\n0:\n"
8581 + _ASM_EXTABLE(0b, 0b)
8582 +#endif
8583 +
8584 + : "=m" (v->counter)
8585 + : "er" (i), "m" (v->counter));
8586 +}
8587 +
8588 +/**
8589 + * atomic64_sub_unchecked - subtract the atomic64 variable
8590 + * @i: integer value to subtract
8591 + * @v: pointer to type atomic64_unchecked_t
8592 + *
8593 + * Atomically subtracts @i from @v.
8594 + */
8595 +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
8596 +{
8597 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
8598 : "=m" (v->counter)
8599 : "er" (i), "m" (v->counter));
8600 }
8601 @@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(
8602 {
8603 unsigned char c;
8604
8605 - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
8606 + asm volatile(LOCK_PREFIX "subq %2,%0\n"
8607 +
8608 +#ifdef CONFIG_PAX_REFCOUNT
8609 + "jno 0f\n"
8610 + LOCK_PREFIX "addq %2,%0\n"
8611 + "int $4\n0:\n"
8612 + _ASM_EXTABLE(0b, 0b)
8613 +#endif
8614 +
8615 + "sete %1\n"
8616 : "=m" (v->counter), "=qm" (c)
8617 : "er" (i), "m" (v->counter) : "memory");
8618 return c;
8619 @@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(
8620 */
8621 static inline void atomic64_inc(atomic64_t *v)
8622 {
8623 + asm volatile(LOCK_PREFIX "incq %0\n"
8624 +
8625 +#ifdef CONFIG_PAX_REFCOUNT
8626 + "jno 0f\n"
8627 + LOCK_PREFIX "decq %0\n"
8628 + "int $4\n0:\n"
8629 + _ASM_EXTABLE(0b, 0b)
8630 +#endif
8631 +
8632 + : "=m" (v->counter)
8633 + : "m" (v->counter));
8634 +}
8635 +
8636 +/**
8637 + * atomic64_inc_unchecked - increment atomic64 variable
8638 + * @v: pointer to type atomic64_unchecked_t
8639 + *
8640 + * Atomically increments @v by 1.
8641 + */
8642 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8643 +{
8644 asm volatile(LOCK_PREFIX "incq %0"
8645 : "=m" (v->counter)
8646 : "m" (v->counter));
8647 @@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64
8648 */
8649 static inline void atomic64_dec(atomic64_t *v)
8650 {
8651 - asm volatile(LOCK_PREFIX "decq %0"
8652 + asm volatile(LOCK_PREFIX "decq %0\n"
8653 +
8654 +#ifdef CONFIG_PAX_REFCOUNT
8655 + "jno 0f\n"
8656 + LOCK_PREFIX "incq %0\n"
8657 + "int $4\n0:\n"
8658 + _ASM_EXTABLE(0b, 0b)
8659 +#endif
8660 +
8661 + : "=m" (v->counter)
8662 + : "m" (v->counter));
8663 +}
8664 +
8665 +/**
8666 + * atomic64_dec_unchecked - decrement atomic64 variable
8667 + * @v: pointer to type atomic64_t
8668 + *
8669 + * Atomically decrements @v by 1.
8670 + */
8671 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8672 +{
8673 + asm volatile(LOCK_PREFIX "decq %0\n"
8674 : "=m" (v->counter)
8675 : "m" (v->counter));
8676 }
8677 @@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(
8678 {
8679 unsigned char c;
8680
8681 - asm volatile(LOCK_PREFIX "decq %0; sete %1"
8682 + asm volatile(LOCK_PREFIX "decq %0\n"
8683 +
8684 +#ifdef CONFIG_PAX_REFCOUNT
8685 + "jno 0f\n"
8686 + LOCK_PREFIX "incq %0\n"
8687 + "int $4\n0:\n"
8688 + _ASM_EXTABLE(0b, 0b)
8689 +#endif
8690 +
8691 + "sete %1\n"
8692 : "=m" (v->counter), "=qm" (c)
8693 : "m" (v->counter) : "memory");
8694 return c != 0;
8695 @@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(
8696 {
8697 unsigned char c;
8698
8699 - asm volatile(LOCK_PREFIX "incq %0; sete %1"
8700 + asm volatile(LOCK_PREFIX "incq %0\n"
8701 +
8702 +#ifdef CONFIG_PAX_REFCOUNT
8703 + "jno 0f\n"
8704 + LOCK_PREFIX "decq %0\n"
8705 + "int $4\n0:\n"
8706 + _ASM_EXTABLE(0b, 0b)
8707 +#endif
8708 +
8709 + "sete %1\n"
8710 : "=m" (v->counter), "=qm" (c)
8711 : "m" (v->counter) : "memory");
8712 return c != 0;
8713 @@ -155,7 +292,16 @@ static inline int atomic64_add_negative(
8714 {
8715 unsigned char c;
8716
8717 - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8718 + asm volatile(LOCK_PREFIX "addq %2,%0\n"
8719 +
8720 +#ifdef CONFIG_PAX_REFCOUNT
8721 + "jno 0f\n"
8722 + LOCK_PREFIX "subq %2,%0\n"
8723 + "int $4\n0:\n"
8724 + _ASM_EXTABLE(0b, 0b)
8725 +#endif
8726 +
8727 + "sets %1\n"
8728 : "=m" (v->counter), "=qm" (c)
8729 : "er" (i), "m" (v->counter) : "memory");
8730 return c;
8731 @@ -171,7 +317,31 @@ static inline int atomic64_add_negative(
8732 static inline long atomic64_add_return(long i, atomic64_t *v)
8733 {
8734 long __i = i;
8735 - asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8736 + asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8737 +
8738 +#ifdef CONFIG_PAX_REFCOUNT
8739 + "jno 0f\n"
8740 + "movq %0, %1\n"
8741 + "int $4\n0:\n"
8742 + _ASM_EXTABLE(0b, 0b)
8743 +#endif
8744 +
8745 + : "+r" (i), "+m" (v->counter)
8746 + : : "memory");
8747 + return i + __i;
8748 +}
8749 +
8750 +/**
8751 + * atomic64_add_return_unchecked - add and return
8752 + * @i: integer value to add
8753 + * @v: pointer to type atomic64_unchecked_t
8754 + *
8755 + * Atomically adds @i to @v and returns @i + @v
8756 + */
8757 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8758 +{
8759 + long __i = i;
8760 + asm volatile(LOCK_PREFIX "xaddq %0, %1"
8761 : "+r" (i), "+m" (v->counter)
8762 : : "memory");
8763 return i + __i;
8764 @@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l
8765 }
8766
8767 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
8768 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8769 +{
8770 + return atomic64_add_return_unchecked(1, v);
8771 +}
8772 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8773
8774 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
8775 @@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
8776 return cmpxchg(&v->counter, old, new);
8777 }
8778
8779 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8780 +{
8781 + return cmpxchg(&v->counter, old, new);
8782 +}
8783 +
8784 static inline long atomic64_xchg(atomic64_t *v, long new)
8785 {
8786 return xchg(&v->counter, new);
8787 @@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
8788 */
8789 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
8790 {
8791 - long c, old;
8792 + long c, old, new;
8793 c = atomic64_read(v);
8794 for (;;) {
8795 - if (unlikely(c == (u)))
8796 + if (unlikely(c == u))
8797 break;
8798 - old = atomic64_cmpxchg((v), c, c + (a));
8799 +
8800 + asm volatile("add %2,%0\n"
8801 +
8802 +#ifdef CONFIG_PAX_REFCOUNT
8803 + "jno 0f\n"
8804 + "sub %2,%0\n"
8805 + "int $4\n0:\n"
8806 + _ASM_EXTABLE(0b, 0b)
8807 +#endif
8808 +
8809 + : "=r" (new)
8810 + : "0" (c), "ir" (a));
8811 +
8812 + old = atomic64_cmpxchg(v, c, new);
8813 if (likely(old == c))
8814 break;
8815 c = old;
8816 }
8817 - return c != (u);
8818 + return c != u;
8819 }
8820
8821 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
8822 diff -urNp linux-2.6.39.1/arch/x86/include/asm/atomic.h linux-2.6.39.1/arch/x86/include/asm/atomic.h
8823 --- linux-2.6.39.1/arch/x86/include/asm/atomic.h 2011-05-19 00:06:34.000000000 -0400
8824 +++ linux-2.6.39.1/arch/x86/include/asm/atomic.h 2011-05-22 19:36:30.000000000 -0400
8825 @@ -22,7 +22,18 @@
8826 */
8827 static inline int atomic_read(const atomic_t *v)
8828 {
8829 - return (*(volatile int *)&(v)->counter);
8830 + return (*(volatile const int *)&(v)->counter);
8831 +}
8832 +
8833 +/**
8834 + * atomic_read_unchecked - read atomic variable
8835 + * @v: pointer of type atomic_unchecked_t
8836 + *
8837 + * Atomically reads the value of @v.
8838 + */
8839 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
8840 +{
8841 + return (*(volatile const int *)&(v)->counter);
8842 }
8843
8844 /**
8845 @@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *
8846 }
8847
8848 /**
8849 + * atomic_set_unchecked - set atomic variable
8850 + * @v: pointer of type atomic_unchecked_t
8851 + * @i: required value
8852 + *
8853 + * Atomically sets the value of @v to @i.
8854 + */
8855 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
8856 +{
8857 + v->counter = i;
8858 +}
8859 +
8860 +/**
8861 * atomic_add - add integer to atomic variable
8862 * @i: integer value to add
8863 * @v: pointer of type atomic_t
8864 @@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *
8865 */
8866 static inline void atomic_add(int i, atomic_t *v)
8867 {
8868 - asm volatile(LOCK_PREFIX "addl %1,%0"
8869 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
8870 +
8871 +#ifdef CONFIG_PAX_REFCOUNT
8872 + "jno 0f\n"
8873 + LOCK_PREFIX "subl %1,%0\n"
8874 + "int $4\n0:\n"
8875 + _ASM_EXTABLE(0b, 0b)
8876 +#endif
8877 +
8878 + : "+m" (v->counter)
8879 + : "ir" (i));
8880 +}
8881 +
8882 +/**
8883 + * atomic_add_unchecked - add integer to atomic variable
8884 + * @i: integer value to add
8885 + * @v: pointer of type atomic_unchecked_t
8886 + *
8887 + * Atomically adds @i to @v.
8888 + */
8889 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
8890 +{
8891 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
8892 : "+m" (v->counter)
8893 : "ir" (i));
8894 }
8895 @@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato
8896 */
8897 static inline void atomic_sub(int i, atomic_t *v)
8898 {
8899 - asm volatile(LOCK_PREFIX "subl %1,%0"
8900 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
8901 +
8902 +#ifdef CONFIG_PAX_REFCOUNT
8903 + "jno 0f\n"
8904 + LOCK_PREFIX "addl %1,%0\n"
8905 + "int $4\n0:\n"
8906 + _ASM_EXTABLE(0b, 0b)
8907 +#endif
8908 +
8909 + : "+m" (v->counter)
8910 + : "ir" (i));
8911 +}
8912 +
8913 +/**
8914 + * atomic_sub_unchecked - subtract integer from atomic variable
8915 + * @i: integer value to subtract
8916 + * @v: pointer of type atomic_unchecked_t
8917 + *
8918 + * Atomically subtracts @i from @v.
8919 + */
8920 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
8921 +{
8922 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
8923 : "+m" (v->counter)
8924 : "ir" (i));
8925 }
8926 @@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in
8927 {
8928 unsigned char c;
8929
8930 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
8931 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
8932 +
8933 +#ifdef CONFIG_PAX_REFCOUNT
8934 + "jno 0f\n"
8935 + LOCK_PREFIX "addl %2,%0\n"
8936 + "int $4\n0:\n"
8937 + _ASM_EXTABLE(0b, 0b)
8938 +#endif
8939 +
8940 + "sete %1\n"
8941 : "+m" (v->counter), "=qm" (c)
8942 : "ir" (i) : "memory");
8943 return c;
8944 @@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in
8945 */
8946 static inline void atomic_inc(atomic_t *v)
8947 {
8948 - asm volatile(LOCK_PREFIX "incl %0"
8949 + asm volatile(LOCK_PREFIX "incl %0\n"
8950 +
8951 +#ifdef CONFIG_PAX_REFCOUNT
8952 + "jno 0f\n"
8953 + LOCK_PREFIX "decl %0\n"
8954 + "int $4\n0:\n"
8955 + _ASM_EXTABLE(0b, 0b)
8956 +#endif
8957 +
8958 + : "+m" (v->counter));
8959 +}
8960 +
8961 +/**
8962 + * atomic_inc_unchecked - increment atomic variable
8963 + * @v: pointer of type atomic_unchecked_t
8964 + *
8965 + * Atomically increments @v by 1.
8966 + */
8967 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
8968 +{
8969 + asm volatile(LOCK_PREFIX "incl %0\n"
8970 : "+m" (v->counter));
8971 }
8972
8973 @@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *
8974 */
8975 static inline void atomic_dec(atomic_t *v)
8976 {
8977 - asm volatile(LOCK_PREFIX "decl %0"
8978 + asm volatile(LOCK_PREFIX "decl %0\n"
8979 +
8980 +#ifdef CONFIG_PAX_REFCOUNT
8981 + "jno 0f\n"
8982 + LOCK_PREFIX "incl %0\n"
8983 + "int $4\n0:\n"
8984 + _ASM_EXTABLE(0b, 0b)
8985 +#endif
8986 +
8987 + : "+m" (v->counter));
8988 +}
8989 +
8990 +/**
8991 + * atomic_dec_unchecked - decrement atomic variable
8992 + * @v: pointer of type atomic_unchecked_t
8993 + *
8994 + * Atomically decrements @v by 1.
8995 + */
8996 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
8997 +{
8998 + asm volatile(LOCK_PREFIX "decl %0\n"
8999 : "+m" (v->counter));
9000 }
9001
9002 @@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at
9003 {
9004 unsigned char c;
9005
9006 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
9007 + asm volatile(LOCK_PREFIX "decl %0\n"
9008 +
9009 +#ifdef CONFIG_PAX_REFCOUNT
9010 + "jno 0f\n"
9011 + LOCK_PREFIX "incl %0\n"
9012 + "int $4\n0:\n"
9013 + _ASM_EXTABLE(0b, 0b)
9014 +#endif
9015 +
9016 + "sete %1\n"
9017 : "+m" (v->counter), "=qm" (c)
9018 : : "memory");
9019 return c != 0;
9020 @@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
9021 {
9022 unsigned char c;
9023
9024 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
9025 + asm volatile(LOCK_PREFIX "incl %0\n"
9026 +
9027 +#ifdef CONFIG_PAX_REFCOUNT
9028 + "jno 0f\n"
9029 + LOCK_PREFIX "decl %0\n"
9030 + "int $4\n0:\n"
9031 + _ASM_EXTABLE(0b, 0b)
9032 +#endif
9033 +
9034 + "sete %1\n"
9035 + : "+m" (v->counter), "=qm" (c)
9036 + : : "memory");
9037 + return c != 0;
9038 +}
9039 +
9040 +/**
9041 + * atomic_inc_and_test_unchecked - increment and test
9042 + * @v: pointer of type atomic_unchecked_t
9043 + *
9044 + * Atomically increments @v by 1
9045 + * and returns true if the result is zero, or false for all
9046 + * other cases.
9047 + */
9048 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
9049 +{
9050 + unsigned char c;
9051 +
9052 + asm volatile(LOCK_PREFIX "incl %0\n"
9053 + "sete %1\n"
9054 : "+m" (v->counter), "=qm" (c)
9055 : : "memory");
9056 return c != 0;
9057 @@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
9058 {
9059 unsigned char c;
9060
9061 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
9062 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
9063 +
9064 +#ifdef CONFIG_PAX_REFCOUNT
9065 + "jno 0f\n"
9066 + LOCK_PREFIX "subl %2,%0\n"
9067 + "int $4\n0:\n"
9068 + _ASM_EXTABLE(0b, 0b)
9069 +#endif
9070 +
9071 + "sets %1\n"
9072 : "+m" (v->counter), "=qm" (c)
9073 : "ir" (i) : "memory");
9074 return c;
9075 @@ -180,6 +342,46 @@ static inline int atomic_add_return(int
9076 #endif
9077 /* Modern 486+ processor */
9078 __i = i;
9079 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
9080 +
9081 +#ifdef CONFIG_PAX_REFCOUNT
9082 + "jno 0f\n"
9083 + "movl %0, %1\n"
9084 + "int $4\n0:\n"
9085 + _ASM_EXTABLE(0b, 0b)
9086 +#endif
9087 +
9088 + : "+r" (i), "+m" (v->counter)
9089 + : : "memory");
9090 + return i + __i;
9091 +
9092 +#ifdef CONFIG_M386
9093 +no_xadd: /* Legacy 386 processor */
9094 + local_irq_save(flags);
9095 + __i = atomic_read(v);
9096 + atomic_set(v, i + __i);
9097 + local_irq_restore(flags);
9098 + return i + __i;
9099 +#endif
9100 +}
9101 +
9102 +/**
9103 + * atomic_add_return_unchecked - add integer and return
9104 + * @v: pointer of type atomic_unchecked_t
9105 + * @i: integer value to add
9106 + *
9107 + * Atomically adds @i to @v and returns @i + @v
9108 + */
9109 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
9110 +{
9111 + int __i;
9112 +#ifdef CONFIG_M386
9113 + unsigned long flags;
9114 + if (unlikely(boot_cpu_data.x86 <= 3))
9115 + goto no_xadd;
9116 +#endif
9117 + /* Modern 486+ processor */
9118 + __i = i;
9119 asm volatile(LOCK_PREFIX "xaddl %0, %1"
9120 : "+r" (i), "+m" (v->counter)
9121 : : "memory");
9122 @@ -208,6 +410,10 @@ static inline int atomic_sub_return(int
9123 }
9124
9125 #define atomic_inc_return(v) (atomic_add_return(1, v))
9126 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
9127 +{
9128 + return atomic_add_return_unchecked(1, v);
9129 +}
9130 #define atomic_dec_return(v) (atomic_sub_return(1, v))
9131
9132 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
9133 @@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
9134 return cmpxchg(&v->counter, old, new);
9135 }
9136
9137 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
9138 +{
9139 + return cmpxchg(&v->counter, old, new);
9140 +}
9141 +
9142 static inline int atomic_xchg(atomic_t *v, int new)
9143 {
9144 return xchg(&v->counter, new);
9145 }
9146
9147 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
9148 +{
9149 + return xchg(&v->counter, new);
9150 +}
9151 +
9152 /**
9153 * atomic_add_unless - add unless the number is already a given value
9154 * @v: pointer of type atomic_t
9155 @@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
9156 */
9157 static inline int atomic_add_unless(atomic_t *v, int a, int u)
9158 {
9159 - int c, old;
9160 + int c, old, new;
9161 c = atomic_read(v);
9162 for (;;) {
9163 - if (unlikely(c == (u)))
9164 + if (unlikely(c == u))
9165 break;
9166 - old = atomic_cmpxchg((v), c, c + (a));
9167 +
9168 + asm volatile("addl %2,%0\n"
9169 +
9170 +#ifdef CONFIG_PAX_REFCOUNT
9171 + "jno 0f\n"
9172 + "subl %2,%0\n"
9173 + "int $4\n0:\n"
9174 + _ASM_EXTABLE(0b, 0b)
9175 +#endif
9176 +
9177 + : "=r" (new)
9178 + : "0" (c), "ir" (a));
9179 +
9180 + old = atomic_cmpxchg(v, c, new);
9181 if (likely(old == c))
9182 break;
9183 c = old;
9184 }
9185 - return c != (u);
9186 + return c != u;
9187 }
9188
9189 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
9190
9191 +/**
9192 + * atomic_inc_not_zero_hint - increment if not null
9193 + * @v: pointer of type atomic_t
9194 + * @hint: probable value of the atomic before the increment
9195 + *
9196 + * This version of atomic_inc_not_zero() gives a hint of probable
9197 + * value of the atomic. This helps processor to not read the memory
9198 + * before doing the atomic read/modify/write cycle, lowering
9199 + * number of bus transactions on some arches.
9200 + *
9201 + * Returns: 0 if increment was not done, 1 otherwise.
9202 + */
9203 +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
9204 +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
9205 +{
9206 + int val, c = hint, new;
9207 +
9208 + /* sanity test, should be removed by compiler if hint is a constant */
9209 + if (!hint)
9210 + return atomic_inc_not_zero(v);
9211 +
9212 + do {
9213 + asm volatile("incl %0\n"
9214 +
9215 +#ifdef CONFIG_PAX_REFCOUNT
9216 + "jno 0f\n"
9217 + "decl %0\n"
9218 + "int $4\n0:\n"
9219 + _ASM_EXTABLE(0b, 0b)
9220 +#endif
9221 +
9222 + : "=r" (new)
9223 + : "0" (c));
9224 +
9225 + val = atomic_cmpxchg(v, c, new);
9226 + if (val == c)
9227 + return 1;
9228 + c = val;
9229 + } while (c);
9230 +
9231 + return 0;
9232 +}
9233 +
9234 /*
9235 * atomic_dec_if_positive - decrement by 1 if old value positive
9236 * @v: pointer of type atomic_t
9237 diff -urNp linux-2.6.39.1/arch/x86/include/asm/bitops.h linux-2.6.39.1/arch/x86/include/asm/bitops.h
9238 --- linux-2.6.39.1/arch/x86/include/asm/bitops.h 2011-05-19 00:06:34.000000000 -0400
9239 +++ linux-2.6.39.1/arch/x86/include/asm/bitops.h 2011-05-22 19:36:30.000000000 -0400
9240 @@ -38,7 +38,7 @@
9241 * a mask operation on a byte.
9242 */
9243 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
9244 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
9245 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
9246 #define CONST_MASK(nr) (1 << ((nr) & 7))
9247
9248 /**
9249 diff -urNp linux-2.6.39.1/arch/x86/include/asm/boot.h linux-2.6.39.1/arch/x86/include/asm/boot.h
9250 --- linux-2.6.39.1/arch/x86/include/asm/boot.h 2011-05-19 00:06:34.000000000 -0400
9251 +++ linux-2.6.39.1/arch/x86/include/asm/boot.h 2011-05-22 19:36:30.000000000 -0400
9252 @@ -11,10 +11,15 @@
9253 #include <asm/pgtable_types.h>
9254
9255 /* Physical address where kernel should be loaded. */
9256 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9257 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9258 + (CONFIG_PHYSICAL_ALIGN - 1)) \
9259 & ~(CONFIG_PHYSICAL_ALIGN - 1))
9260
9261 +#ifndef __ASSEMBLY__
9262 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
9263 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
9264 +#endif
9265 +
9266 /* Minimum kernel alignment, as a power of two */
9267 #ifdef CONFIG_X86_64
9268 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
9269 diff -urNp linux-2.6.39.1/arch/x86/include/asm/cacheflush.h linux-2.6.39.1/arch/x86/include/asm/cacheflush.h
9270 --- linux-2.6.39.1/arch/x86/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
9271 +++ linux-2.6.39.1/arch/x86/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
9272 @@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
9273 unsigned long pg_flags = pg->flags & _PGMT_MASK;
9274
9275 if (pg_flags == _PGMT_DEFAULT)
9276 - return -1;
9277 + return ~0UL;
9278 else if (pg_flags == _PGMT_WC)
9279 return _PAGE_CACHE_WC;
9280 else if (pg_flags == _PGMT_UC_MINUS)
9281 diff -urNp linux-2.6.39.1/arch/x86/include/asm/cache.h linux-2.6.39.1/arch/x86/include/asm/cache.h
9282 --- linux-2.6.39.1/arch/x86/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
9283 +++ linux-2.6.39.1/arch/x86/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
9284 @@ -5,12 +5,13 @@
9285
9286 /* L1 cache line size */
9287 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
9288 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9289 +#define L1_CACHE_BYTES (_AC(1,U) << L1_CACHE_SHIFT)
9290
9291 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9292 +#define __read_only __attribute__((__section__(".data..read_only")))
9293
9294 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
9295 -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
9296 +#define INTERNODE_CACHE_BYTES (_AC(1,U) << INTERNODE_CACHE_SHIFT)
9297
9298 #ifdef CONFIG_X86_VSMP
9299 #ifdef CONFIG_SMP
9300 diff -urNp linux-2.6.39.1/arch/x86/include/asm/checksum_32.h linux-2.6.39.1/arch/x86/include/asm/checksum_32.h
9301 --- linux-2.6.39.1/arch/x86/include/asm/checksum_32.h 2011-05-19 00:06:34.000000000 -0400
9302 +++ linux-2.6.39.1/arch/x86/include/asm/checksum_32.h 2011-05-22 19:36:30.000000000 -0400
9303 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
9304 int len, __wsum sum,
9305 int *src_err_ptr, int *dst_err_ptr);
9306
9307 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
9308 + int len, __wsum sum,
9309 + int *src_err_ptr, int *dst_err_ptr);
9310 +
9311 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
9312 + int len, __wsum sum,
9313 + int *src_err_ptr, int *dst_err_ptr);
9314 +
9315 /*
9316 * Note: when you get a NULL pointer exception here this means someone
9317 * passed in an incorrect kernel address to one of these functions.
9318 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
9319 int *err_ptr)
9320 {
9321 might_sleep();
9322 - return csum_partial_copy_generic((__force void *)src, dst,
9323 + return csum_partial_copy_generic_from_user((__force void *)src, dst,
9324 len, sum, err_ptr, NULL);
9325 }
9326
9327 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
9328 {
9329 might_sleep();
9330 if (access_ok(VERIFY_WRITE, dst, len))
9331 - return csum_partial_copy_generic(src, (__force void *)dst,
9332 + return csum_partial_copy_generic_to_user(src, (__force void *)dst,
9333 len, sum, NULL, err_ptr);
9334
9335 if (len)
9336 diff -urNp linux-2.6.39.1/arch/x86/include/asm/cpufeature.h linux-2.6.39.1/arch/x86/include/asm/cpufeature.h
9337 --- linux-2.6.39.1/arch/x86/include/asm/cpufeature.h 2011-06-03 00:04:13.000000000 -0400
9338 +++ linux-2.6.39.1/arch/x86/include/asm/cpufeature.h 2011-06-03 00:32:04.000000000 -0400
9339 @@ -351,7 +351,7 @@ static __always_inline __pure bool __sta
9340 ".section .discard,\"aw\",@progbits\n"
9341 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
9342 ".previous\n"
9343 - ".section .altinstr_replacement,\"ax\"\n"
9344 + ".section .altinstr_replacement,\"a\"\n"
9345 "3: movb $1,%0\n"
9346 "4:\n"
9347 ".previous\n"
9348 diff -urNp linux-2.6.39.1/arch/x86/include/asm/desc_defs.h linux-2.6.39.1/arch/x86/include/asm/desc_defs.h
9349 --- linux-2.6.39.1/arch/x86/include/asm/desc_defs.h 2011-05-19 00:06:34.000000000 -0400
9350 +++ linux-2.6.39.1/arch/x86/include/asm/desc_defs.h 2011-05-22 19:36:30.000000000 -0400
9351 @@ -31,6 +31,12 @@ struct desc_struct {
9352 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
9353 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
9354 };
9355 + struct {
9356 + u16 offset_low;
9357 + u16 seg;
9358 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
9359 + unsigned offset_high: 16;
9360 + } gate;
9361 };
9362 } __attribute__((packed));
9363
9364 diff -urNp linux-2.6.39.1/arch/x86/include/asm/desc.h linux-2.6.39.1/arch/x86/include/asm/desc.h
9365 --- linux-2.6.39.1/arch/x86/include/asm/desc.h 2011-05-19 00:06:34.000000000 -0400
9366 +++ linux-2.6.39.1/arch/x86/include/asm/desc.h 2011-05-22 19:36:30.000000000 -0400
9367 @@ -4,6 +4,7 @@
9368 #include <asm/desc_defs.h>
9369 #include <asm/ldt.h>
9370 #include <asm/mmu.h>
9371 +#include <asm/pgtable.h>
9372 #include <linux/smp.h>
9373
9374 static inline void fill_ldt(struct desc_struct *desc,
9375 @@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
9376 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
9377 desc->type = (info->read_exec_only ^ 1) << 1;
9378 desc->type |= info->contents << 2;
9379 + desc->type |= info->seg_not_present ^ 1;
9380 desc->s = 1;
9381 desc->dpl = 0x3;
9382 desc->p = info->seg_not_present ^ 1;
9383 @@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
9384 }
9385
9386 extern struct desc_ptr idt_descr;
9387 -extern gate_desc idt_table[];
9388 -
9389 -struct gdt_page {
9390 - struct desc_struct gdt[GDT_ENTRIES];
9391 -} __attribute__((aligned(PAGE_SIZE)));
9392 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
9393 +extern gate_desc idt_table[256];
9394
9395 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
9396 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
9397 {
9398 - return per_cpu(gdt_page, cpu).gdt;
9399 + return cpu_gdt_table[cpu];
9400 }
9401
9402 #ifdef CONFIG_X86_64
9403 @@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
9404 unsigned long base, unsigned dpl, unsigned flags,
9405 unsigned short seg)
9406 {
9407 - gate->a = (seg << 16) | (base & 0xffff);
9408 - gate->b = (base & 0xffff0000) |
9409 - (((0x80 | type | (dpl << 5)) & 0xff) << 8);
9410 + gate->gate.offset_low = base;
9411 + gate->gate.seg = seg;
9412 + gate->gate.reserved = 0;
9413 + gate->gate.type = type;
9414 + gate->gate.s = 0;
9415 + gate->gate.dpl = dpl;
9416 + gate->gate.p = 1;
9417 + gate->gate.offset_high = base >> 16;
9418 }
9419
9420 #endif
9421 @@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
9422 static inline void native_write_idt_entry(gate_desc *idt, int entry,
9423 const gate_desc *gate)
9424 {
9425 + pax_open_kernel();
9426 memcpy(&idt[entry], gate, sizeof(*gate));
9427 + pax_close_kernel();
9428 }
9429
9430 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
9431 const void *desc)
9432 {
9433 + pax_open_kernel();
9434 memcpy(&ldt[entry], desc, 8);
9435 + pax_close_kernel();
9436 }
9437
9438 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
9439 @@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
9440 size = sizeof(struct desc_struct);
9441 break;
9442 }
9443 +
9444 + pax_open_kernel();
9445 memcpy(&gdt[entry], desc, size);
9446 + pax_close_kernel();
9447 }
9448
9449 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
9450 @@ -211,7 +221,9 @@ static inline void native_set_ldt(const
9451
9452 static inline void native_load_tr_desc(void)
9453 {
9454 + pax_open_kernel();
9455 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
9456 + pax_close_kernel();
9457 }
9458
9459 static inline void native_load_gdt(const struct desc_ptr *dtr)
9460 @@ -246,8 +258,10 @@ static inline void native_load_tls(struc
9461 unsigned int i;
9462 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
9463
9464 + pax_open_kernel();
9465 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
9466 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
9467 + pax_close_kernel();
9468 }
9469
9470 #define _LDT_empty(info) \
9471 @@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
9472 desc->limit = (limit >> 16) & 0xf;
9473 }
9474
9475 -static inline void _set_gate(int gate, unsigned type, void *addr,
9476 +static inline void _set_gate(int gate, unsigned type, const void *addr,
9477 unsigned dpl, unsigned ist, unsigned seg)
9478 {
9479 gate_desc s;
9480 @@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
9481 * Pentium F0 0F bugfix can have resulted in the mapped
9482 * IDT being write-protected.
9483 */
9484 -static inline void set_intr_gate(unsigned int n, void *addr)
9485 +static inline void set_intr_gate(unsigned int n, const void *addr)
9486 {
9487 BUG_ON((unsigned)n > 0xFF);
9488 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
9489 @@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
9490 /*
9491 * This routine sets up an interrupt gate at directory privilege level 3.
9492 */
9493 -static inline void set_system_intr_gate(unsigned int n, void *addr)
9494 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
9495 {
9496 BUG_ON((unsigned)n > 0xFF);
9497 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
9498 }
9499
9500 -static inline void set_system_trap_gate(unsigned int n, void *addr)
9501 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
9502 {
9503 BUG_ON((unsigned)n > 0xFF);
9504 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
9505 }
9506
9507 -static inline void set_trap_gate(unsigned int n, void *addr)
9508 +static inline void set_trap_gate(unsigned int n, const void *addr)
9509 {
9510 BUG_ON((unsigned)n > 0xFF);
9511 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
9512 @@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
9513 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
9514 {
9515 BUG_ON((unsigned)n > 0xFF);
9516 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
9517 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
9518 }
9519
9520 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
9521 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
9522 {
9523 BUG_ON((unsigned)n > 0xFF);
9524 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
9525 }
9526
9527 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
9528 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
9529 {
9530 BUG_ON((unsigned)n > 0xFF);
9531 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
9532 }
9533
9534 +#ifdef CONFIG_X86_32
9535 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
9536 +{
9537 + struct desc_struct d;
9538 +
9539 + if (likely(limit))
9540 + limit = (limit - 1UL) >> PAGE_SHIFT;
9541 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
9542 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
9543 +}
9544 +#endif
9545 +
9546 #endif /* _ASM_X86_DESC_H */
9547 diff -urNp linux-2.6.39.1/arch/x86/include/asm/device.h linux-2.6.39.1/arch/x86/include/asm/device.h
9548 --- linux-2.6.39.1/arch/x86/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
9549 +++ linux-2.6.39.1/arch/x86/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
9550 @@ -6,7 +6,7 @@ struct dev_archdata {
9551 void *acpi_handle;
9552 #endif
9553 #ifdef CONFIG_X86_64
9554 -struct dma_map_ops *dma_ops;
9555 + const struct dma_map_ops *dma_ops;
9556 #endif
9557 #if defined(CONFIG_DMAR) || defined(CONFIG_AMD_IOMMU)
9558 void *iommu; /* hook for IOMMU specific extension */
9559 diff -urNp linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h
9560 --- linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
9561 +++ linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
9562 @@ -26,9 +26,9 @@ extern int iommu_merge;
9563 extern struct device x86_dma_fallback_dev;
9564 extern int panic_on_overflow;
9565
9566 -extern struct dma_map_ops *dma_ops;
9567 +extern const struct dma_map_ops *dma_ops;
9568
9569 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
9570 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
9571 {
9572 #ifdef CONFIG_X86_32
9573 return dma_ops;
9574 @@ -45,7 +45,7 @@ static inline struct dma_map_ops *get_dm
9575 /* Make sure we keep the same behaviour */
9576 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
9577 {
9578 - struct dma_map_ops *ops = get_dma_ops(dev);
9579 + const struct dma_map_ops *ops = get_dma_ops(dev);
9580 if (ops->mapping_error)
9581 return ops->mapping_error(dev, dma_addr);
9582
9583 @@ -115,7 +115,7 @@ static inline void *
9584 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
9585 gfp_t gfp)
9586 {
9587 - struct dma_map_ops *ops = get_dma_ops(dev);
9588 + const struct dma_map_ops *ops = get_dma_ops(dev);
9589 void *memory;
9590
9591 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
9592 @@ -142,7 +142,7 @@ dma_alloc_coherent(struct device *dev, s
9593 static inline void dma_free_coherent(struct device *dev, size_t size,
9594 void *vaddr, dma_addr_t bus)
9595 {
9596 - struct dma_map_ops *ops = get_dma_ops(dev);
9597 + const struct dma_map_ops *ops = get_dma_ops(dev);
9598
9599 WARN_ON(irqs_disabled()); /* for portability */
9600
9601 diff -urNp linux-2.6.39.1/arch/x86/include/asm/e820.h linux-2.6.39.1/arch/x86/include/asm/e820.h
9602 --- linux-2.6.39.1/arch/x86/include/asm/e820.h 2011-05-19 00:06:34.000000000 -0400
9603 +++ linux-2.6.39.1/arch/x86/include/asm/e820.h 2011-05-22 19:36:30.000000000 -0400
9604 @@ -69,7 +69,7 @@ struct e820map {
9605 #define ISA_START_ADDRESS 0xa0000
9606 #define ISA_END_ADDRESS 0x100000
9607
9608 -#define BIOS_BEGIN 0x000a0000
9609 +#define BIOS_BEGIN 0x000c0000
9610 #define BIOS_END 0x00100000
9611
9612 #define BIOS_ROM_BASE 0xffe00000
9613 diff -urNp linux-2.6.39.1/arch/x86/include/asm/elf.h linux-2.6.39.1/arch/x86/include/asm/elf.h
9614 --- linux-2.6.39.1/arch/x86/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
9615 +++ linux-2.6.39.1/arch/x86/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
9616 @@ -237,7 +237,25 @@ extern int force_personality32;
9617 the loader. We need to make sure that it is out of the way of the program
9618 that it will "exec", and that there is sufficient room for the brk. */
9619
9620 +#ifdef CONFIG_PAX_SEGMEXEC
9621 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
9622 +#else
9623 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
9624 +#endif
9625 +
9626 +#ifdef CONFIG_PAX_ASLR
9627 +#ifdef CONFIG_X86_32
9628 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
9629 +
9630 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9631 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9632 +#else
9633 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
9634 +
9635 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9636 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9637 +#endif
9638 +#endif
9639
9640 /* This yields a mask that user programs can use to figure out what
9641 instruction set this CPU supports. This could be done in user space,
9642 @@ -291,8 +309,7 @@ do { \
9643 #define ARCH_DLINFO \
9644 do { \
9645 if (vdso_enabled) \
9646 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
9647 - (unsigned long)current->mm->context.vdso); \
9648 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
9649 } while (0)
9650
9651 #define AT_SYSINFO 32
9652 @@ -303,7 +320,7 @@ do { \
9653
9654 #endif /* !CONFIG_X86_32 */
9655
9656 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
9657 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
9658
9659 #define VDSO_ENTRY \
9660 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
9661 @@ -317,7 +334,4 @@ extern int arch_setup_additional_pages(s
9662 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
9663 #define compat_arch_setup_additional_pages syscall32_setup_pages
9664
9665 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
9666 -#define arch_randomize_brk arch_randomize_brk
9667 -
9668 #endif /* _ASM_X86_ELF_H */
9669 diff -urNp linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h
9670 --- linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h 2011-05-19 00:06:34.000000000 -0400
9671 +++ linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h 2011-05-22 19:36:30.000000000 -0400
9672 @@ -15,6 +15,6 @@ enum reboot_type {
9673
9674 extern enum reboot_type reboot_type;
9675
9676 -extern void machine_emergency_restart(void);
9677 +extern void machine_emergency_restart(void) __noreturn;
9678
9679 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
9680 diff -urNp linux-2.6.39.1/arch/x86/include/asm/futex.h linux-2.6.39.1/arch/x86/include/asm/futex.h
9681 --- linux-2.6.39.1/arch/x86/include/asm/futex.h 2011-05-19 00:06:34.000000000 -0400
9682 +++ linux-2.6.39.1/arch/x86/include/asm/futex.h 2011-05-22 19:36:30.000000000 -0400
9683 @@ -12,16 +12,18 @@
9684 #include <asm/system.h>
9685
9686 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
9687 + typecheck(u32 *, uaddr); \
9688 asm volatile("1:\t" insn "\n" \
9689 "2:\t.section .fixup,\"ax\"\n" \
9690 "3:\tmov\t%3, %1\n" \
9691 "\tjmp\t2b\n" \
9692 "\t.previous\n" \
9693 _ASM_EXTABLE(1b, 3b) \
9694 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
9695 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
9696 : "i" (-EFAULT), "0" (oparg), "1" (0))
9697
9698 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
9699 + typecheck(u32 *, uaddr); \
9700 asm volatile("1:\tmovl %2, %0\n" \
9701 "\tmovl\t%0, %3\n" \
9702 "\t" insn "\n" \
9703 @@ -34,7 +36,7 @@
9704 _ASM_EXTABLE(1b, 4b) \
9705 _ASM_EXTABLE(2b, 4b) \
9706 : "=&a" (oldval), "=&r" (ret), \
9707 - "+m" (*uaddr), "=&r" (tem) \
9708 + "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \
9709 : "r" (oparg), "i" (-EFAULT), "1" (0))
9710
9711 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
9712 @@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
9713
9714 switch (op) {
9715 case FUTEX_OP_SET:
9716 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
9717 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
9718 break;
9719 case FUTEX_OP_ADD:
9720 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
9721 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
9722 uaddr, oparg);
9723 break;
9724 case FUTEX_OP_OR:
9725 @@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i
9726 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
9727 return -EFAULT;
9728
9729 - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
9730 + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
9731 "2:\t.section .fixup, \"ax\"\n"
9732 "3:\tmov %3, %0\n"
9733 "\tjmp 2b\n"
9734 "\t.previous\n"
9735 _ASM_EXTABLE(1b, 3b)
9736 - : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
9737 + : "+r" (ret), "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
9738 : "i" (-EFAULT), "r" (newval), "1" (oldval)
9739 : "memory"
9740 );
9741 diff -urNp linux-2.6.39.1/arch/x86/include/asm/hw_irq.h linux-2.6.39.1/arch/x86/include/asm/hw_irq.h
9742 --- linux-2.6.39.1/arch/x86/include/asm/hw_irq.h 2011-05-19 00:06:34.000000000 -0400
9743 +++ linux-2.6.39.1/arch/x86/include/asm/hw_irq.h 2011-05-22 19:36:30.000000000 -0400
9744 @@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void);
9745 extern void enable_IO_APIC(void);
9746
9747 /* Statistics */
9748 -extern atomic_t irq_err_count;
9749 -extern atomic_t irq_mis_count;
9750 +extern atomic_unchecked_t irq_err_count;
9751 +extern atomic_unchecked_t irq_mis_count;
9752
9753 /* EISA */
9754 extern void eisa_set_level_irq(unsigned int irq);
9755 diff -urNp linux-2.6.39.1/arch/x86/include/asm/i387.h linux-2.6.39.1/arch/x86/include/asm/i387.h
9756 --- linux-2.6.39.1/arch/x86/include/asm/i387.h 2011-05-19 00:06:34.000000000 -0400
9757 +++ linux-2.6.39.1/arch/x86/include/asm/i387.h 2011-05-22 19:36:30.000000000 -0400
9758 @@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
9759 {
9760 int err;
9761
9762 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9763 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9764 + fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
9765 +#endif
9766 +
9767 /* See comment in fxsave() below. */
9768 #ifdef CONFIG_AS_FXSAVEQ
9769 asm volatile("1: fxrstorq %[fx]\n\t"
9770 @@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38
9771 {
9772 int err;
9773
9774 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9775 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9776 + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
9777 +#endif
9778 +
9779 /*
9780 * Clear the bytes not touched by the fxsave and reserved
9781 * for the SW usage.
9782 @@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu
9783 #endif /* CONFIG_X86_64 */
9784
9785 /* We need a safe address that is cheap to find and that is already
9786 - in L1 during context switch. The best choices are unfortunately
9787 - different for UP and SMP */
9788 -#ifdef CONFIG_SMP
9789 -#define safe_address (__per_cpu_offset[0])
9790 -#else
9791 -#define safe_address (kstat_cpu(0).cpustat.user)
9792 -#endif
9793 + in L1 during context switch. */
9794 +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
9795
9796 /*
9797 * These must be called with preempt disabled
9798 @@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
9799 struct thread_info *me = current_thread_info();
9800 preempt_disable();
9801 if (me->status & TS_USEDFPU)
9802 - __save_init_fpu(me->task);
9803 + __save_init_fpu(current);
9804 else
9805 clts();
9806 }
9807 diff -urNp linux-2.6.39.1/arch/x86/include/asm/io.h linux-2.6.39.1/arch/x86/include/asm/io.h
9808 --- linux-2.6.39.1/arch/x86/include/asm/io.h 2011-05-19 00:06:34.000000000 -0400
9809 +++ linux-2.6.39.1/arch/x86/include/asm/io.h 2011-05-22 19:36:30.000000000 -0400
9810 @@ -216,6 +216,17 @@ extern void set_iounmap_nonlazy(void);
9811
9812 #include <linux/vmalloc.h>
9813
9814 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9815 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9816 +{
9817 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9818 +}
9819 +
9820 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9821 +{
9822 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9823 +}
9824 +
9825 /*
9826 * Convert a virtual cached pointer to an uncached pointer
9827 */
9828 diff -urNp linux-2.6.39.1/arch/x86/include/asm/iommu.h linux-2.6.39.1/arch/x86/include/asm/iommu.h
9829 --- linux-2.6.39.1/arch/x86/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
9830 +++ linux-2.6.39.1/arch/x86/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
9831 @@ -1,7 +1,7 @@
9832 #ifndef _ASM_X86_IOMMU_H
9833 #define _ASM_X86_IOMMU_H
9834
9835 -extern struct dma_map_ops nommu_dma_ops;
9836 +extern const struct dma_map_ops nommu_dma_ops;
9837 extern int force_iommu, no_iommu;
9838 extern int iommu_detected;
9839 extern int iommu_pass_through;
9840 diff -urNp linux-2.6.39.1/arch/x86/include/asm/irqflags.h linux-2.6.39.1/arch/x86/include/asm/irqflags.h
9841 --- linux-2.6.39.1/arch/x86/include/asm/irqflags.h 2011-05-19 00:06:34.000000000 -0400
9842 +++ linux-2.6.39.1/arch/x86/include/asm/irqflags.h 2011-05-22 19:36:30.000000000 -0400
9843 @@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
9844 sti; \
9845 sysexit
9846
9847 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
9848 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
9849 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
9850 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
9851 +
9852 #else
9853 #define INTERRUPT_RETURN iret
9854 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
9855 diff -urNp linux-2.6.39.1/arch/x86/include/asm/kprobes.h linux-2.6.39.1/arch/x86/include/asm/kprobes.h
9856 --- linux-2.6.39.1/arch/x86/include/asm/kprobes.h 2011-05-19 00:06:34.000000000 -0400
9857 +++ linux-2.6.39.1/arch/x86/include/asm/kprobes.h 2011-05-22 19:36:30.000000000 -0400
9858 @@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
9859 #define RELATIVEJUMP_SIZE 5
9860 #define RELATIVECALL_OPCODE 0xe8
9861 #define RELATIVE_ADDR_SIZE 4
9862 -#define MAX_STACK_SIZE 64
9863 -#define MIN_STACK_SIZE(ADDR) \
9864 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
9865 - THREAD_SIZE - (unsigned long)(ADDR))) \
9866 - ? (MAX_STACK_SIZE) \
9867 - : (((unsigned long)current_thread_info()) + \
9868 - THREAD_SIZE - (unsigned long)(ADDR)))
9869 +#define MAX_STACK_SIZE 64UL
9870 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
9871
9872 #define flush_insn_slot(p) do { } while (0)
9873
9874 diff -urNp linux-2.6.39.1/arch/x86/include/asm/kvm_host.h linux-2.6.39.1/arch/x86/include/asm/kvm_host.h
9875 --- linux-2.6.39.1/arch/x86/include/asm/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
9876 +++ linux-2.6.39.1/arch/x86/include/asm/kvm_host.h 2011-05-22 19:36:30.000000000 -0400
9877 @@ -419,7 +419,7 @@ struct kvm_arch {
9878 unsigned int n_used_mmu_pages;
9879 unsigned int n_requested_mmu_pages;
9880 unsigned int n_max_mmu_pages;
9881 - atomic_t invlpg_counter;
9882 + atomic_unchecked_t invlpg_counter;
9883 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
9884 /*
9885 * Hash table of struct kvm_mmu_page.
9886 @@ -599,7 +599,7 @@ struct kvm_arch_async_pf {
9887 bool direct_map;
9888 };
9889
9890 -extern struct kvm_x86_ops *kvm_x86_ops;
9891 +extern const struct kvm_x86_ops *kvm_x86_ops;
9892
9893 int kvm_mmu_module_init(void);
9894 void kvm_mmu_module_exit(void);
9895 diff -urNp linux-2.6.39.1/arch/x86/include/asm/local.h linux-2.6.39.1/arch/x86/include/asm/local.h
9896 --- linux-2.6.39.1/arch/x86/include/asm/local.h 2011-05-19 00:06:34.000000000 -0400
9897 +++ linux-2.6.39.1/arch/x86/include/asm/local.h 2011-05-22 19:36:30.000000000 -0400
9898 @@ -18,26 +18,58 @@ typedef struct {
9899
9900 static inline void local_inc(local_t *l)
9901 {
9902 - asm volatile(_ASM_INC "%0"
9903 + asm volatile(_ASM_INC "%0\n"
9904 +
9905 +#ifdef CONFIG_PAX_REFCOUNT
9906 + "jno 0f\n"
9907 + _ASM_DEC "%0\n"
9908 + "int $4\n0:\n"
9909 + _ASM_EXTABLE(0b, 0b)
9910 +#endif
9911 +
9912 : "+m" (l->a.counter));
9913 }
9914
9915 static inline void local_dec(local_t *l)
9916 {
9917 - asm volatile(_ASM_DEC "%0"
9918 + asm volatile(_ASM_DEC "%0\n"
9919 +
9920 +#ifdef CONFIG_PAX_REFCOUNT
9921 + "jno 0f\n"
9922 + _ASM_INC "%0\n"
9923 + "int $4\n0:\n"
9924 + _ASM_EXTABLE(0b, 0b)
9925 +#endif
9926 +
9927 : "+m" (l->a.counter));
9928 }
9929
9930 static inline void local_add(long i, local_t *l)
9931 {
9932 - asm volatile(_ASM_ADD "%1,%0"
9933 + asm volatile(_ASM_ADD "%1,%0\n"
9934 +
9935 +#ifdef CONFIG_PAX_REFCOUNT
9936 + "jno 0f\n"
9937 + _ASM_SUB "%1,%0\n"
9938 + "int $4\n0:\n"
9939 + _ASM_EXTABLE(0b, 0b)
9940 +#endif
9941 +
9942 : "+m" (l->a.counter)
9943 : "ir" (i));
9944 }
9945
9946 static inline void local_sub(long i, local_t *l)
9947 {
9948 - asm volatile(_ASM_SUB "%1,%0"
9949 + asm volatile(_ASM_SUB "%1,%0\n"
9950 +
9951 +#ifdef CONFIG_PAX_REFCOUNT
9952 + "jno 0f\n"
9953 + _ASM_ADD "%1,%0\n"
9954 + "int $4\n0:\n"
9955 + _ASM_EXTABLE(0b, 0b)
9956 +#endif
9957 +
9958 : "+m" (l->a.counter)
9959 : "ir" (i));
9960 }
9961 @@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
9962 {
9963 unsigned char c;
9964
9965 - asm volatile(_ASM_SUB "%2,%0; sete %1"
9966 + asm volatile(_ASM_SUB "%2,%0\n"
9967 +
9968 +#ifdef CONFIG_PAX_REFCOUNT
9969 + "jno 0f\n"
9970 + _ASM_ADD "%2,%0\n"
9971 + "int $4\n0:\n"
9972 + _ASM_EXTABLE(0b, 0b)
9973 +#endif
9974 +
9975 + "sete %1\n"
9976 : "+m" (l->a.counter), "=qm" (c)
9977 : "ir" (i) : "memory");
9978 return c;
9979 @@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
9980 {
9981 unsigned char c;
9982
9983 - asm volatile(_ASM_DEC "%0; sete %1"
9984 + asm volatile(_ASM_DEC "%0\n"
9985 +
9986 +#ifdef CONFIG_PAX_REFCOUNT
9987 + "jno 0f\n"
9988 + _ASM_INC "%0\n"
9989 + "int $4\n0:\n"
9990 + _ASM_EXTABLE(0b, 0b)
9991 +#endif
9992 +
9993 + "sete %1\n"
9994 : "+m" (l->a.counter), "=qm" (c)
9995 : : "memory");
9996 return c != 0;
9997 @@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
9998 {
9999 unsigned char c;
10000
10001 - asm volatile(_ASM_INC "%0; sete %1"
10002 + asm volatile(_ASM_INC "%0\n"
10003 +
10004 +#ifdef CONFIG_PAX_REFCOUNT
10005 + "jno 0f\n"
10006 + _ASM_DEC "%0\n"
10007 + "int $4\n0:\n"
10008 + _ASM_EXTABLE(0b, 0b)
10009 +#endif
10010 +
10011 + "sete %1\n"
10012 : "+m" (l->a.counter), "=qm" (c)
10013 : : "memory");
10014 return c != 0;
10015 @@ -110,7 +169,16 @@ static inline int local_add_negative(lon
10016 {
10017 unsigned char c;
10018
10019 - asm volatile(_ASM_ADD "%2,%0; sets %1"
10020 + asm volatile(_ASM_ADD "%2,%0\n"
10021 +
10022 +#ifdef CONFIG_PAX_REFCOUNT
10023 + "jno 0f\n"
10024 + _ASM_SUB "%2,%0\n"
10025 + "int $4\n0:\n"
10026 + _ASM_EXTABLE(0b, 0b)
10027 +#endif
10028 +
10029 + "sets %1\n"
10030 : "+m" (l->a.counter), "=qm" (c)
10031 : "ir" (i) : "memory");
10032 return c;
10033 @@ -133,7 +201,15 @@ static inline long local_add_return(long
10034 #endif
10035 /* Modern 486+ processor */
10036 __i = i;
10037 - asm volatile(_ASM_XADD "%0, %1;"
10038 + asm volatile(_ASM_XADD "%0, %1\n"
10039 +
10040 +#ifdef CONFIG_PAX_REFCOUNT
10041 + "jno 0f\n"
10042 + _ASM_MOV "%0,%1\n"
10043 + "int $4\n0:\n"
10044 + _ASM_EXTABLE(0b, 0b)
10045 +#endif
10046 +
10047 : "+r" (i), "+m" (l->a.counter)
10048 : : "memory");
10049 return i + __i;
10050 diff -urNp linux-2.6.39.1/arch/x86/include/asm/mce.h linux-2.6.39.1/arch/x86/include/asm/mce.h
10051 --- linux-2.6.39.1/arch/x86/include/asm/mce.h 2011-05-19 00:06:34.000000000 -0400
10052 +++ linux-2.6.39.1/arch/x86/include/asm/mce.h 2011-05-22 19:36:30.000000000 -0400
10053 @@ -198,7 +198,7 @@ int mce_notify_irq(void);
10054 void mce_notify_process(void);
10055
10056 DECLARE_PER_CPU(struct mce, injectm);
10057 -extern struct file_operations mce_chrdev_ops;
10058 +extern struct file_operations mce_chrdev_ops; /* cannot be const, see arch/x86/kernel/cpu/mcheck/mce. */
10059
10060 /*
10061 * Exception handler
10062 diff -urNp linux-2.6.39.1/arch/x86/include/asm/microcode.h linux-2.6.39.1/arch/x86/include/asm/microcode.h
10063 --- linux-2.6.39.1/arch/x86/include/asm/microcode.h 2011-05-19 00:06:34.000000000 -0400
10064 +++ linux-2.6.39.1/arch/x86/include/asm/microcode.h 2011-05-22 19:36:30.000000000 -0400
10065 @@ -12,13 +12,13 @@ struct device;
10066 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
10067
10068 struct microcode_ops {
10069 - enum ucode_state (*request_microcode_user) (int cpu,
10070 + enum ucode_state (* const request_microcode_user) (int cpu,
10071 const void __user *buf, size_t size);
10072
10073 - enum ucode_state (*request_microcode_fw) (int cpu,
10074 + enum ucode_state (* const request_microcode_fw) (int cpu,
10075 struct device *device);
10076
10077 - void (*microcode_fini_cpu) (int cpu);
10078 + void (* const microcode_fini_cpu) (int cpu);
10079
10080 /*
10081 * The generic 'microcode_core' part guarantees that
10082 @@ -38,16 +38,16 @@ struct ucode_cpu_info {
10083 extern struct ucode_cpu_info ucode_cpu_info[];
10084
10085 #ifdef CONFIG_MICROCODE_INTEL
10086 -extern struct microcode_ops * __init init_intel_microcode(void);
10087 +extern const struct microcode_ops * __init init_intel_microcode(void);
10088 #else
10089 -static inline struct microcode_ops * __init init_intel_microcode(void)
10090 +static inline const struct microcode_ops * __init init_intel_microcode(void)
10091 {
10092 return NULL;
10093 }
10094 #endif /* CONFIG_MICROCODE_INTEL */
10095
10096 #ifdef CONFIG_MICROCODE_AMD
10097 -extern struct microcode_ops * __init init_amd_microcode(void);
10098 +extern const struct microcode_ops * __init init_amd_microcode(void);
10099
10100 static inline void get_ucode_data(void *to, const u8 *from, size_t n)
10101 {
10102 @@ -55,7 +55,7 @@ static inline void get_ucode_data(void *
10103 }
10104
10105 #else
10106 -static inline struct microcode_ops * __init init_amd_microcode(void)
10107 +static inline const struct microcode_ops * __init init_amd_microcode(void)
10108 {
10109 return NULL;
10110 }
10111 diff -urNp linux-2.6.39.1/arch/x86/include/asm/mman.h linux-2.6.39.1/arch/x86/include/asm/mman.h
10112 --- linux-2.6.39.1/arch/x86/include/asm/mman.h 2011-05-19 00:06:34.000000000 -0400
10113 +++ linux-2.6.39.1/arch/x86/include/asm/mman.h 2011-05-22 19:36:30.000000000 -0400
10114 @@ -5,4 +5,14 @@
10115
10116 #include <asm-generic/mman.h>
10117
10118 +#ifdef __KERNEL__
10119 +#ifndef __ASSEMBLY__
10120 +#ifdef CONFIG_X86_32
10121 +#define arch_mmap_check i386_mmap_check
10122 +int i386_mmap_check(unsigned long addr, unsigned long len,
10123 + unsigned long flags);
10124 +#endif
10125 +#endif
10126 +#endif
10127 +
10128 #endif /* _ASM_X86_MMAN_H */
10129 diff -urNp linux-2.6.39.1/arch/x86/include/asm/mmu_context.h linux-2.6.39.1/arch/x86/include/asm/mmu_context.h
10130 --- linux-2.6.39.1/arch/x86/include/asm/mmu_context.h 2011-05-19 00:06:34.000000000 -0400
10131 +++ linux-2.6.39.1/arch/x86/include/asm/mmu_context.h 2011-05-22 19:36:30.000000000 -0400
10132 @@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
10133
10134 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
10135 {
10136 +
10137 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10138 + unsigned int i;
10139 + pgd_t *pgd;
10140 +
10141 + pax_open_kernel();
10142 + pgd = get_cpu_pgd(smp_processor_id());
10143 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
10144 + if (paravirt_enabled())
10145 + set_pgd(pgd+i, native_make_pgd(0));
10146 + else
10147 + pgd[i] = native_make_pgd(0);
10148 + pax_close_kernel();
10149 +#endif
10150 +
10151 #ifdef CONFIG_SMP
10152 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
10153 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
10154 @@ -34,16 +49,30 @@ static inline void switch_mm(struct mm_s
10155 struct task_struct *tsk)
10156 {
10157 unsigned cpu = smp_processor_id();
10158 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
10159 + int tlbstate = TLBSTATE_OK;
10160 +#endif
10161
10162 if (likely(prev != next)) {
10163 #ifdef CONFIG_SMP
10164 +#ifdef CONFIG_X86_32
10165 + tlbstate = percpu_read(cpu_tlbstate.state);
10166 +#endif
10167 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10168 percpu_write(cpu_tlbstate.active_mm, next);
10169 #endif
10170 cpumask_set_cpu(cpu, mm_cpumask(next));
10171
10172 /* Re-load page tables */
10173 +#ifdef CONFIG_PAX_PER_CPU_PGD
10174 + pax_open_kernel();
10175 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10176 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10177 + pax_close_kernel();
10178 + load_cr3(get_cpu_pgd(cpu));
10179 +#else
10180 load_cr3(next->pgd);
10181 +#endif
10182
10183 /* stop flush ipis for the previous mm */
10184 cpumask_clear_cpu(cpu, mm_cpumask(prev));
10185 @@ -53,9 +82,38 @@ static inline void switch_mm(struct mm_s
10186 */
10187 if (unlikely(prev->context.ldt != next->context.ldt))
10188 load_LDT_nolock(&next->context);
10189 - }
10190 +
10191 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10192 + if (!(__supported_pte_mask & _PAGE_NX)) {
10193 + smp_mb__before_clear_bit();
10194 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
10195 + smp_mb__after_clear_bit();
10196 + cpu_set(cpu, next->context.cpu_user_cs_mask);
10197 + }
10198 +#endif
10199 +
10200 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10201 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
10202 + prev->context.user_cs_limit != next->context.user_cs_limit))
10203 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10204 #ifdef CONFIG_SMP
10205 + else if (unlikely(tlbstate != TLBSTATE_OK))
10206 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10207 +#endif
10208 +#endif
10209 +
10210 + }
10211 else {
10212 +
10213 +#ifdef CONFIG_PAX_PER_CPU_PGD
10214 + pax_open_kernel();
10215 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10216 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10217 + pax_close_kernel();
10218 + load_cr3(get_cpu_pgd(cpu));
10219 +#endif
10220 +
10221 +#ifdef CONFIG_SMP
10222 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10223 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
10224
10225 @@ -64,11 +122,28 @@ static inline void switch_mm(struct mm_s
10226 * tlb flush IPI delivery. We must reload CR3
10227 * to make sure to use no freed page tables.
10228 */
10229 +
10230 +#ifndef CONFIG_PAX_PER_CPU_PGD
10231 load_cr3(next->pgd);
10232 +#endif
10233 +
10234 load_LDT_nolock(&next->context);
10235 +
10236 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
10237 + if (!(__supported_pte_mask & _PAGE_NX))
10238 + cpu_set(cpu, next->context.cpu_user_cs_mask);
10239 +#endif
10240 +
10241 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10242 +#ifdef CONFIG_PAX_PAGEEXEC
10243 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
10244 +#endif
10245 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10246 +#endif
10247 +
10248 }
10249 - }
10250 #endif
10251 + }
10252 }
10253
10254 #define activate_mm(prev, next) \
10255 diff -urNp linux-2.6.39.1/arch/x86/include/asm/mmu.h linux-2.6.39.1/arch/x86/include/asm/mmu.h
10256 --- linux-2.6.39.1/arch/x86/include/asm/mmu.h 2011-05-19 00:06:34.000000000 -0400
10257 +++ linux-2.6.39.1/arch/x86/include/asm/mmu.h 2011-05-22 19:36:30.000000000 -0400
10258 @@ -9,10 +9,22 @@
10259 * we put the segment information here.
10260 */
10261 typedef struct {
10262 - void *ldt;
10263 + struct desc_struct *ldt;
10264 int size;
10265 struct mutex lock;
10266 - void *vdso;
10267 + unsigned long vdso;
10268 +
10269 +#ifdef CONFIG_X86_32
10270 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
10271 + unsigned long user_cs_base;
10272 + unsigned long user_cs_limit;
10273 +
10274 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10275 + cpumask_t cpu_user_cs_mask;
10276 +#endif
10277 +
10278 +#endif
10279 +#endif
10280
10281 #ifdef CONFIG_X86_64
10282 /* True if mm supports a task running in 32 bit compatibility mode. */
10283 diff -urNp linux-2.6.39.1/arch/x86/include/asm/module.h linux-2.6.39.1/arch/x86/include/asm/module.h
10284 --- linux-2.6.39.1/arch/x86/include/asm/module.h 2011-05-19 00:06:34.000000000 -0400
10285 +++ linux-2.6.39.1/arch/x86/include/asm/module.h 2011-05-22 19:41:32.000000000 -0400
10286 @@ -5,6 +5,7 @@
10287
10288 #ifdef CONFIG_X86_64
10289 /* X86_64 does not define MODULE_PROC_FAMILY */
10290 +#define MODULE_PROC_FAMILY ""
10291 #elif defined CONFIG_M386
10292 #define MODULE_PROC_FAMILY "386 "
10293 #elif defined CONFIG_M486
10294 @@ -59,8 +60,30 @@
10295 #error unknown processor family
10296 #endif
10297
10298 -#ifdef CONFIG_X86_32
10299 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
10300 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10301 +#define MODULE_PAX_UDEREF "UDEREF "
10302 +#else
10303 +#define MODULE_PAX_UDEREF ""
10304 +#endif
10305 +
10306 +#ifdef CONFIG_PAX_KERNEXEC
10307 +#define MODULE_PAX_KERNEXEC "KERNEXEC "
10308 +#else
10309 +#define MODULE_PAX_KERNEXEC ""
10310 #endif
10311
10312 +#ifdef CONFIG_PAX_REFCOUNT
10313 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
10314 +#else
10315 +#define MODULE_PAX_REFCOUNT ""
10316 +#endif
10317 +
10318 +#ifdef CONFIG_GRKERNSEC
10319 +#define MODULE_GRSEC "GRSECURITY "
10320 +#else
10321 +#define MODULE_GRSEC ""
10322 +#endif
10323 +
10324 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
10325 +
10326 #endif /* _ASM_X86_MODULE_H */
10327 diff -urNp linux-2.6.39.1/arch/x86/include/asm/page_64_types.h linux-2.6.39.1/arch/x86/include/asm/page_64_types.h
10328 --- linux-2.6.39.1/arch/x86/include/asm/page_64_types.h 2011-05-19 00:06:34.000000000 -0400
10329 +++ linux-2.6.39.1/arch/x86/include/asm/page_64_types.h 2011-05-22 19:36:30.000000000 -0400
10330 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
10331
10332 /* duplicated to the one in bootmem.h */
10333 extern unsigned long max_pfn;
10334 -extern unsigned long phys_base;
10335 +extern const unsigned long phys_base;
10336
10337 extern unsigned long __phys_addr(unsigned long);
10338 #define __phys_reloc_hide(x) (x)
10339 diff -urNp linux-2.6.39.1/arch/x86/include/asm/paravirt.h linux-2.6.39.1/arch/x86/include/asm/paravirt.h
10340 --- linux-2.6.39.1/arch/x86/include/asm/paravirt.h 2011-05-19 00:06:34.000000000 -0400
10341 +++ linux-2.6.39.1/arch/x86/include/asm/paravirt.h 2011-05-22 19:36:30.000000000 -0400
10342 @@ -739,6 +739,21 @@ static inline void __set_fixmap(unsigned
10343 pv_mmu_ops.set_fixmap(idx, phys, flags);
10344 }
10345
10346 +#ifdef CONFIG_PAX_KERNEXEC
10347 +static inline unsigned long pax_open_kernel(void)
10348 +{
10349 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
10350 +}
10351 +
10352 +static inline unsigned long pax_close_kernel(void)
10353 +{
10354 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
10355 +}
10356 +#else
10357 +static inline unsigned long pax_open_kernel(void) { return 0; }
10358 +static inline unsigned long pax_close_kernel(void) { return 0; }
10359 +#endif
10360 +
10361 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
10362
10363 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
10364 @@ -955,7 +970,7 @@ extern void default_banner(void);
10365
10366 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
10367 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
10368 -#define PARA_INDIRECT(addr) *%cs:addr
10369 +#define PARA_INDIRECT(addr) *%ss:addr
10370 #endif
10371
10372 #define INTERRUPT_RETURN \
10373 @@ -1032,6 +1047,21 @@ extern void default_banner(void);
10374 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
10375 CLBR_NONE, \
10376 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
10377 +
10378 +#define GET_CR0_INTO_RDI \
10379 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
10380 + mov %rax,%rdi
10381 +
10382 +#define SET_RDI_INTO_CR0 \
10383 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
10384 +
10385 +#define GET_CR3_INTO_RDI \
10386 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
10387 + mov %rax,%rdi
10388 +
10389 +#define SET_RDI_INTO_CR3 \
10390 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
10391 +
10392 #endif /* CONFIG_X86_32 */
10393
10394 #endif /* __ASSEMBLY__ */
10395 diff -urNp linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h
10396 --- linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h 2011-05-19 00:06:34.000000000 -0400
10397 +++ linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h 2011-05-22 19:36:30.000000000 -0400
10398 @@ -317,6 +317,12 @@ struct pv_mmu_ops {
10399 an mfn. We can tell which is which from the index. */
10400 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
10401 phys_addr_t phys, pgprot_t flags);
10402 +
10403 +#ifdef CONFIG_PAX_KERNEXEC
10404 + unsigned long (*pax_open_kernel)(void);
10405 + unsigned long (*pax_close_kernel)(void);
10406 +#endif
10407 +
10408 };
10409
10410 struct arch_spinlock;
10411 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pci_x86.h linux-2.6.39.1/arch/x86/include/asm/pci_x86.h
10412 --- linux-2.6.39.1/arch/x86/include/asm/pci_x86.h 2011-05-19 00:06:34.000000000 -0400
10413 +++ linux-2.6.39.1/arch/x86/include/asm/pci_x86.h 2011-05-22 19:36:30.000000000 -0400
10414 @@ -93,16 +93,16 @@ extern int (*pcibios_enable_irq)(struct
10415 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
10416
10417 struct pci_raw_ops {
10418 - int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10419 + int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10420 int reg, int len, u32 *val);
10421 - int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10422 + int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10423 int reg, int len, u32 val);
10424 };
10425
10426 -extern struct pci_raw_ops *raw_pci_ops;
10427 -extern struct pci_raw_ops *raw_pci_ext_ops;
10428 +extern const struct pci_raw_ops *raw_pci_ops;
10429 +extern const struct pci_raw_ops *raw_pci_ext_ops;
10430
10431 -extern struct pci_raw_ops pci_direct_conf1;
10432 +extern const struct pci_raw_ops pci_direct_conf1;
10433 extern bool port_cf9_safe;
10434
10435 /* arch_initcall level */
10436 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgalloc.h linux-2.6.39.1/arch/x86/include/asm/pgalloc.h
10437 --- linux-2.6.39.1/arch/x86/include/asm/pgalloc.h 2011-05-19 00:06:34.000000000 -0400
10438 +++ linux-2.6.39.1/arch/x86/include/asm/pgalloc.h 2011-05-22 19:36:30.000000000 -0400
10439 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
10440 pmd_t *pmd, pte_t *pte)
10441 {
10442 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10443 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
10444 +}
10445 +
10446 +static inline void pmd_populate_user(struct mm_struct *mm,
10447 + pmd_t *pmd, pte_t *pte)
10448 +{
10449 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10450 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
10451 }
10452
10453 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h
10454 --- linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h 2011-05-19 00:06:34.000000000 -0400
10455 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h 2011-05-22 19:36:30.000000000 -0400
10456 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
10457
10458 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10459 {
10460 + pax_open_kernel();
10461 *pmdp = pmd;
10462 + pax_close_kernel();
10463 }
10464
10465 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
10466 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h
10467 --- linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
10468 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
10469 @@ -25,9 +25,6 @@
10470 struct mm_struct;
10471 struct vm_area_struct;
10472
10473 -extern pgd_t swapper_pg_dir[1024];
10474 -extern pgd_t initial_page_table[1024];
10475 -
10476 static inline void pgtable_cache_init(void) { }
10477 static inline void check_pgt_cache(void) { }
10478 void paging_init(void);
10479 @@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u
10480 # include <asm/pgtable-2level.h>
10481 #endif
10482
10483 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
10484 +extern pgd_t initial_page_table[PTRS_PER_PGD];
10485 +#ifdef CONFIG_X86_PAE
10486 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
10487 +#endif
10488 +
10489 #if defined(CONFIG_HIGHPTE)
10490 #define pte_offset_map(dir, address) \
10491 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
10492 @@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u
10493 /* Clear a kernel PTE and flush it from the TLB */
10494 #define kpte_clear_flush(ptep, vaddr) \
10495 do { \
10496 + pax_open_kernel(); \
10497 pte_clear(&init_mm, (vaddr), (ptep)); \
10498 + pax_close_kernel(); \
10499 __flush_tlb_one((vaddr)); \
10500 } while (0)
10501
10502 @@ -74,6 +79,9 @@ do { \
10503
10504 #endif /* !__ASSEMBLY__ */
10505
10506 +#define HAVE_ARCH_UNMAPPED_AREA
10507 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
10508 +
10509 /*
10510 * kern_addr_valid() is (1) for FLATMEM and (0) for
10511 * SPARSEMEM and DISCONTIGMEM
10512 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h
10513 --- linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h 2011-05-19 00:06:34.000000000 -0400
10514 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h 2011-05-22 19:36:30.000000000 -0400
10515 @@ -8,7 +8,7 @@
10516 */
10517 #ifdef CONFIG_X86_PAE
10518 # include <asm/pgtable-3level_types.h>
10519 -# define PMD_SIZE (1UL << PMD_SHIFT)
10520 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
10521 # define PMD_MASK (~(PMD_SIZE - 1))
10522 #else
10523 # include <asm/pgtable-2level_types.h>
10524 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
10525 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
10526 #endif
10527
10528 +#ifdef CONFIG_PAX_KERNEXEC
10529 +#ifndef __ASSEMBLY__
10530 +extern unsigned char MODULES_EXEC_VADDR[];
10531 +extern unsigned char MODULES_EXEC_END[];
10532 +#endif
10533 +#include <asm/boot.h>
10534 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
10535 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
10536 +#else
10537 +#define ktla_ktva(addr) (addr)
10538 +#define ktva_ktla(addr) (addr)
10539 +#endif
10540 +
10541 #define MODULES_VADDR VMALLOC_START
10542 #define MODULES_END VMALLOC_END
10543 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
10544 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h
10545 --- linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h 2011-05-19 00:06:34.000000000 -0400
10546 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h 2011-05-22 19:36:30.000000000 -0400
10547 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
10548
10549 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10550 {
10551 + pax_open_kernel();
10552 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
10553 + pax_close_kernel();
10554 }
10555
10556 static inline void native_set_pud(pud_t *pudp, pud_t pud)
10557 {
10558 + pax_open_kernel();
10559 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
10560 + pax_close_kernel();
10561 }
10562
10563 /*
10564 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h
10565 --- linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h 2011-05-19 00:06:34.000000000 -0400
10566 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h 2011-05-22 19:36:30.000000000 -0400
10567 @@ -16,10 +16,13 @@
10568
10569 extern pud_t level3_kernel_pgt[512];
10570 extern pud_t level3_ident_pgt[512];
10571 +extern pud_t level3_vmalloc_pgt[512];
10572 +extern pud_t level3_vmemmap_pgt[512];
10573 +extern pud_t level2_vmemmap_pgt[512];
10574 extern pmd_t level2_kernel_pgt[512];
10575 extern pmd_t level2_fixmap_pgt[512];
10576 -extern pmd_t level2_ident_pgt[512];
10577 -extern pgd_t init_level4_pgt[];
10578 +extern pmd_t level2_ident_pgt[512*2];
10579 +extern pgd_t init_level4_pgt[512];
10580
10581 #define swapper_pg_dir init_level4_pgt
10582
10583 @@ -61,7 +64,9 @@ static inline void native_set_pte_atomic
10584
10585 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10586 {
10587 + pax_open_kernel();
10588 *pmdp = pmd;
10589 + pax_close_kernel();
10590 }
10591
10592 static inline void native_pmd_clear(pmd_t *pmd)
10593 @@ -107,7 +112,9 @@ static inline void native_pud_clear(pud_
10594
10595 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
10596 {
10597 + pax_open_kernel();
10598 *pgdp = pgd;
10599 + pax_close_kernel();
10600 }
10601
10602 static inline void native_pgd_clear(pgd_t *pgd)
10603 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h
10604 --- linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h 2011-05-19 00:06:34.000000000 -0400
10605 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h 2011-05-22 19:36:30.000000000 -0400
10606 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
10607 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
10608 #define MODULES_END _AC(0xffffffffff000000, UL)
10609 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
10610 +#define MODULES_EXEC_VADDR MODULES_VADDR
10611 +#define MODULES_EXEC_END MODULES_END
10612 +
10613 +#define ktla_ktva(addr) (addr)
10614 +#define ktva_ktla(addr) (addr)
10615
10616 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
10617 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable.h linux-2.6.39.1/arch/x86/include/asm/pgtable.h
10618 --- linux-2.6.39.1/arch/x86/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
10619 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
10620 @@ -81,12 +81,51 @@ extern struct mm_struct *pgd_page_get_mm
10621
10622 #define arch_end_context_switch(prev) do {} while(0)
10623
10624 +#define pax_open_kernel() native_pax_open_kernel()
10625 +#define pax_close_kernel() native_pax_close_kernel()
10626 #endif /* CONFIG_PARAVIRT */
10627
10628 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
10629 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
10630 +
10631 +#ifdef CONFIG_PAX_KERNEXEC
10632 +static inline unsigned long native_pax_open_kernel(void)
10633 +{
10634 + unsigned long cr0;
10635 +
10636 + preempt_disable();
10637 + barrier();
10638 + cr0 = read_cr0() ^ X86_CR0_WP;
10639 + BUG_ON(unlikely(cr0 & X86_CR0_WP));
10640 + write_cr0(cr0);
10641 + return cr0 ^ X86_CR0_WP;
10642 +}
10643 +
10644 +static inline unsigned long native_pax_close_kernel(void)
10645 +{
10646 + unsigned long cr0;
10647 +
10648 + cr0 = read_cr0() ^ X86_CR0_WP;
10649 + BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
10650 + write_cr0(cr0);
10651 + barrier();
10652 + preempt_enable_no_resched();
10653 + return cr0 ^ X86_CR0_WP;
10654 +}
10655 +#else
10656 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
10657 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
10658 +#endif
10659 +
10660 /*
10661 * The following only work if pte_present() is true.
10662 * Undefined behaviour if not..
10663 */
10664 +static inline int pte_user(pte_t pte)
10665 +{
10666 + return pte_val(pte) & _PAGE_USER;
10667 +}
10668 +
10669 static inline int pte_dirty(pte_t pte)
10670 {
10671 return pte_flags(pte) & _PAGE_DIRTY;
10672 @@ -196,9 +235,29 @@ static inline pte_t pte_wrprotect(pte_t
10673 return pte_clear_flags(pte, _PAGE_RW);
10674 }
10675
10676 +static inline pte_t pte_mkread(pte_t pte)
10677 +{
10678 + return __pte(pte_val(pte) | _PAGE_USER);
10679 +}
10680 +
10681 static inline pte_t pte_mkexec(pte_t pte)
10682 {
10683 - return pte_clear_flags(pte, _PAGE_NX);
10684 +#ifdef CONFIG_X86_PAE
10685 + if (__supported_pte_mask & _PAGE_NX)
10686 + return pte_clear_flags(pte, _PAGE_NX);
10687 + else
10688 +#endif
10689 + return pte_set_flags(pte, _PAGE_USER);
10690 +}
10691 +
10692 +static inline pte_t pte_exprotect(pte_t pte)
10693 +{
10694 +#ifdef CONFIG_X86_PAE
10695 + if (__supported_pte_mask & _PAGE_NX)
10696 + return pte_set_flags(pte, _PAGE_NX);
10697 + else
10698 +#endif
10699 + return pte_clear_flags(pte, _PAGE_USER);
10700 }
10701
10702 static inline pte_t pte_mkdirty(pte_t pte)
10703 @@ -390,6 +449,15 @@ pte_t *populate_extra_pte(unsigned long
10704 #endif
10705
10706 #ifndef __ASSEMBLY__
10707 +
10708 +#ifdef CONFIG_PAX_PER_CPU_PGD
10709 +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
10710 +static inline pgd_t *get_cpu_pgd(unsigned int cpu)
10711 +{
10712 + return cpu_pgd[cpu];
10713 +}
10714 +#endif
10715 +
10716 #include <linux/mm_types.h>
10717
10718 static inline int pte_none(pte_t pte)
10719 @@ -560,7 +628,7 @@ static inline pud_t *pud_offset(pgd_t *p
10720
10721 static inline int pgd_bad(pgd_t pgd)
10722 {
10723 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
10724 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
10725 }
10726
10727 static inline int pgd_none(pgd_t pgd)
10728 @@ -583,7 +651,12 @@ static inline int pgd_none(pgd_t pgd)
10729 * pgd_offset() returns a (pgd_t *)
10730 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
10731 */
10732 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
10733 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
10734 +
10735 +#ifdef CONFIG_PAX_PER_CPU_PGD
10736 +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
10737 +#endif
10738 +
10739 /*
10740 * a shortcut which implies the use of the kernel's pgd, instead
10741 * of a process's
10742 @@ -594,6 +667,20 @@ static inline int pgd_none(pgd_t pgd)
10743 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
10744 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
10745
10746 +#ifdef CONFIG_X86_32
10747 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
10748 +#else
10749 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
10750 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
10751 +
10752 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10753 +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
10754 +#else
10755 +#define PAX_USER_SHADOW_BASE (_AC(0,UL))
10756 +#endif
10757 +
10758 +#endif
10759 +
10760 #ifndef __ASSEMBLY__
10761
10762 extern int direct_gbpages;
10763 @@ -758,11 +845,23 @@ static inline void pmdp_set_wrprotect(st
10764 * dst and src can be on the same page, but the range must not overlap,
10765 * and must not cross a page boundary.
10766 */
10767 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
10768 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
10769 {
10770 - memcpy(dst, src, count * sizeof(pgd_t));
10771 + pax_open_kernel();
10772 + while (count--)
10773 + *dst++ = *src++;
10774 + pax_close_kernel();
10775 }
10776
10777 +#ifdef CONFIG_PAX_PER_CPU_PGD
10778 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10779 +#endif
10780 +
10781 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10782 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10783 +#else
10784 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
10785 +#endif
10786
10787 #include <asm-generic/pgtable.h>
10788 #endif /* __ASSEMBLY__ */
10789 diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h
10790 --- linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h 2011-05-19 00:06:34.000000000 -0400
10791 +++ linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h 2011-05-22 19:36:30.000000000 -0400
10792 @@ -16,13 +16,12 @@
10793 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
10794 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
10795 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
10796 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
10797 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
10798 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
10799 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
10800 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
10801 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
10802 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
10803 -#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
10804 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
10805 +#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
10806 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
10807
10808 /* If _PAGE_BIT_PRESENT is clear, we use these: */
10809 @@ -40,7 +39,6 @@
10810 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
10811 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
10812 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
10813 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
10814 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
10815 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
10816 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
10817 @@ -57,8 +55,10 @@
10818
10819 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
10820 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
10821 -#else
10822 +#elif defined(CONFIG_KMEMCHECK)
10823 #define _PAGE_NX (_AT(pteval_t, 0))
10824 +#else
10825 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
10826 #endif
10827
10828 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
10829 @@ -96,6 +96,9 @@
10830 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
10831 _PAGE_ACCESSED)
10832
10833 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
10834 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
10835 +
10836 #define __PAGE_KERNEL_EXEC \
10837 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
10838 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
10839 @@ -106,8 +109,8 @@
10840 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
10841 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
10842 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
10843 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
10844 -#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
10845 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
10846 +#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
10847 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
10848 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
10849 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
10850 @@ -166,8 +169,8 @@
10851 * bits are combined, this will alow user to access the high address mapped
10852 * VDSO in the presence of CONFIG_COMPAT_VDSO
10853 */
10854 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
10855 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
10856 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10857 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10858 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
10859 #endif
10860
10861 @@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p
10862 {
10863 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
10864 }
10865 +#endif
10866
10867 +#if PAGETABLE_LEVELS == 3
10868 +#include <asm-generic/pgtable-nopud.h>
10869 +#endif
10870 +
10871 +#if PAGETABLE_LEVELS == 2
10872 +#include <asm-generic/pgtable-nopmd.h>
10873 +#endif
10874 +
10875 +#ifndef __ASSEMBLY__
10876 #if PAGETABLE_LEVELS > 3
10877 typedef struct { pudval_t pud; } pud_t;
10878
10879 @@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu
10880 return pud.pud;
10881 }
10882 #else
10883 -#include <asm-generic/pgtable-nopud.h>
10884 -
10885 static inline pudval_t native_pud_val(pud_t pud)
10886 {
10887 return native_pgd_val(pud.pgd);
10888 @@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm
10889 return pmd.pmd;
10890 }
10891 #else
10892 -#include <asm-generic/pgtable-nopmd.h>
10893 -
10894 static inline pmdval_t native_pmd_val(pmd_t pmd)
10895 {
10896 return native_pgd_val(pmd.pud.pgd);
10897 @@ -281,7 +290,6 @@ typedef struct page *pgtable_t;
10898
10899 extern pteval_t __supported_pte_mask;
10900 extern void set_nx(void);
10901 -extern int nx_enabled;
10902
10903 #define pgprot_writecombine pgprot_writecombine
10904 extern pgprot_t pgprot_writecombine(pgprot_t prot);
10905 diff -urNp linux-2.6.39.1/arch/x86/include/asm/processor.h linux-2.6.39.1/arch/x86/include/asm/processor.h
10906 --- linux-2.6.39.1/arch/x86/include/asm/processor.h 2011-05-19 00:06:34.000000000 -0400
10907 +++ linux-2.6.39.1/arch/x86/include/asm/processor.h 2011-05-22 19:36:30.000000000 -0400
10908 @@ -266,7 +266,7 @@ struct tss_struct {
10909
10910 } ____cacheline_aligned;
10911
10912 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
10913 +extern struct tss_struct init_tss[NR_CPUS];
10914
10915 /*
10916 * Save the original ist values for checking stack pointers during debugging
10917 @@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co
10918 */
10919 #define TASK_SIZE PAGE_OFFSET
10920 #define TASK_SIZE_MAX TASK_SIZE
10921 +
10922 +#ifdef CONFIG_PAX_SEGMEXEC
10923 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
10924 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
10925 +#else
10926 #define STACK_TOP TASK_SIZE
10927 -#define STACK_TOP_MAX STACK_TOP
10928 +#endif
10929 +
10930 +#define STACK_TOP_MAX TASK_SIZE
10931
10932 #define INIT_THREAD { \
10933 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
10934 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10935 .vm86_info = NULL, \
10936 .sysenter_cs = __KERNEL_CS, \
10937 .io_bitmap_ptr = NULL, \
10938 @@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co
10939 */
10940 #define INIT_TSS { \
10941 .x86_tss = { \
10942 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
10943 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10944 .ss0 = __KERNEL_DS, \
10945 .ss1 = __KERNEL_CS, \
10946 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
10947 @@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co
10948 extern unsigned long thread_saved_pc(struct task_struct *tsk);
10949
10950 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
10951 -#define KSTK_TOP(info) \
10952 -({ \
10953 - unsigned long *__ptr = (unsigned long *)(info); \
10954 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
10955 -})
10956 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
10957
10958 /*
10959 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
10960 @@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str
10961 #define task_pt_regs(task) \
10962 ({ \
10963 struct pt_regs *__regs__; \
10964 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
10965 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
10966 __regs__ - 1; \
10967 })
10968
10969 @@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str
10970 /*
10971 * User space process size. 47bits minus one guard page.
10972 */
10973 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
10974 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
10975
10976 /* This decides where the kernel will search for a free chunk of vm
10977 * space during mmap's.
10978 */
10979 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
10980 - 0xc0000000 : 0xFFFFe000)
10981 + 0xc0000000 : 0xFFFFf000)
10982
10983 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
10984 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
10985 @@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str
10986 #define STACK_TOP_MAX TASK_SIZE_MAX
10987
10988 #define INIT_THREAD { \
10989 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10990 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10991 }
10992
10993 #define INIT_TSS { \
10994 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10995 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10996 }
10997
10998 /*
10999 @@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs
11000 */
11001 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
11002
11003 +#ifdef CONFIG_PAX_SEGMEXEC
11004 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
11005 +#endif
11006 +
11007 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
11008
11009 /* Get/set a process' ability to use the timestamp counter instruction */
11010 diff -urNp linux-2.6.39.1/arch/x86/include/asm/ptrace.h linux-2.6.39.1/arch/x86/include/asm/ptrace.h
11011 --- linux-2.6.39.1/arch/x86/include/asm/ptrace.h 2011-05-19 00:06:34.000000000 -0400
11012 +++ linux-2.6.39.1/arch/x86/include/asm/ptrace.h 2011-05-22 19:36:30.000000000 -0400
11013 @@ -152,28 +152,29 @@ static inline unsigned long regs_return_
11014 }
11015
11016 /*
11017 - * user_mode_vm(regs) determines whether a register set came from user mode.
11018 + * user_mode(regs) determines whether a register set came from user mode.
11019 * This is true if V8086 mode was enabled OR if the register set was from
11020 * protected mode with RPL-3 CS value. This tricky test checks that with
11021 * one comparison. Many places in the kernel can bypass this full check
11022 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
11023 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
11024 + * be used.
11025 */
11026 -static inline int user_mode(struct pt_regs *regs)
11027 +static inline int user_mode_novm(struct pt_regs *regs)
11028 {
11029 #ifdef CONFIG_X86_32
11030 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
11031 #else
11032 - return !!(regs->cs & 3);
11033 + return !!(regs->cs & SEGMENT_RPL_MASK);
11034 #endif
11035 }
11036
11037 -static inline int user_mode_vm(struct pt_regs *regs)
11038 +static inline int user_mode(struct pt_regs *regs)
11039 {
11040 #ifdef CONFIG_X86_32
11041 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
11042 USER_RPL;
11043 #else
11044 - return user_mode(regs);
11045 + return user_mode_novm(regs);
11046 #endif
11047 }
11048
11049 diff -urNp linux-2.6.39.1/arch/x86/include/asm/reboot.h linux-2.6.39.1/arch/x86/include/asm/reboot.h
11050 --- linux-2.6.39.1/arch/x86/include/asm/reboot.h 2011-05-19 00:06:34.000000000 -0400
11051 +++ linux-2.6.39.1/arch/x86/include/asm/reboot.h 2011-05-22 19:36:30.000000000 -0400
11052 @@ -6,19 +6,19 @@
11053 struct pt_regs;
11054
11055 struct machine_ops {
11056 - void (*restart)(char *cmd);
11057 - void (*halt)(void);
11058 - void (*power_off)(void);
11059 + void (* __noreturn restart)(char *cmd);
11060 + void (* __noreturn halt)(void);
11061 + void (* __noreturn power_off)(void);
11062 void (*shutdown)(void);
11063 void (*crash_shutdown)(struct pt_regs *);
11064 - void (*emergency_restart)(void);
11065 + void (* __noreturn emergency_restart)(void);
11066 };
11067
11068 extern struct machine_ops machine_ops;
11069
11070 void native_machine_crash_shutdown(struct pt_regs *regs);
11071 void native_machine_shutdown(void);
11072 -void machine_real_restart(unsigned int type);
11073 +void machine_real_restart(unsigned int type) __noreturn;
11074 /* These must match dispatch_table in reboot_32.S */
11075 #define MRR_BIOS 0
11076 #define MRR_APM 1
11077 diff -urNp linux-2.6.39.1/arch/x86/include/asm/rwsem.h linux-2.6.39.1/arch/x86/include/asm/rwsem.h
11078 --- linux-2.6.39.1/arch/x86/include/asm/rwsem.h 2011-05-19 00:06:34.000000000 -0400
11079 +++ linux-2.6.39.1/arch/x86/include/asm/rwsem.h 2011-05-22 19:36:30.000000000 -0400
11080 @@ -64,6 +64,14 @@ static inline void __down_read(struct rw
11081 {
11082 asm volatile("# beginning down_read\n\t"
11083 LOCK_PREFIX _ASM_INC "(%1)\n\t"
11084 +
11085 +#ifdef CONFIG_PAX_REFCOUNT
11086 + "jno 0f\n"
11087 + LOCK_PREFIX _ASM_DEC "(%1)\n"
11088 + "int $4\n0:\n"
11089 + _ASM_EXTABLE(0b, 0b)
11090 +#endif
11091 +
11092 /* adds 0x00000001 */
11093 " jns 1f\n"
11094 " call call_rwsem_down_read_failed\n"
11095 @@ -85,6 +93,14 @@ static inline int __down_read_trylock(st
11096 "1:\n\t"
11097 " mov %1,%2\n\t"
11098 " add %3,%2\n\t"
11099 +
11100 +#ifdef CONFIG_PAX_REFCOUNT
11101 + "jno 0f\n"
11102 + "sub %3,%2\n"
11103 + "int $4\n0:\n"
11104 + _ASM_EXTABLE(0b, 0b)
11105 +#endif
11106 +
11107 " jle 2f\n\t"
11108 LOCK_PREFIX " cmpxchg %2,%0\n\t"
11109 " jnz 1b\n\t"
11110 @@ -104,6 +120,14 @@ static inline void __down_write_nested(s
11111 long tmp;
11112 asm volatile("# beginning down_write\n\t"
11113 LOCK_PREFIX " xadd %1,(%2)\n\t"
11114 +
11115 +#ifdef CONFIG_PAX_REFCOUNT
11116 + "jno 0f\n"
11117 + "mov %1,(%2)\n"
11118 + "int $4\n0:\n"
11119 + _ASM_EXTABLE(0b, 0b)
11120 +#endif
11121 +
11122 /* adds 0xffff0001, returns the old value */
11123 " test %1,%1\n\t"
11124 /* was the count 0 before? */
11125 @@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s
11126 long tmp;
11127 asm volatile("# beginning __up_read\n\t"
11128 LOCK_PREFIX " xadd %1,(%2)\n\t"
11129 +
11130 +#ifdef CONFIG_PAX_REFCOUNT
11131 + "jno 0f\n"
11132 + "mov %1,(%2)\n"
11133 + "int $4\n0:\n"
11134 + _ASM_EXTABLE(0b, 0b)
11135 +#endif
11136 +
11137 /* subtracts 1, returns the old value */
11138 " jns 1f\n\t"
11139 " call call_rwsem_wake\n" /* expects old value in %edx */
11140 @@ -159,6 +191,14 @@ static inline void __up_write(struct rw_
11141 long tmp;
11142 asm volatile("# beginning __up_write\n\t"
11143 LOCK_PREFIX " xadd %1,(%2)\n\t"
11144 +
11145 +#ifdef CONFIG_PAX_REFCOUNT
11146 + "jno 0f\n"
11147 + "mov %1,(%2)\n"
11148 + "int $4\n0:\n"
11149 + _ASM_EXTABLE(0b, 0b)
11150 +#endif
11151 +
11152 /* subtracts 0xffff0001, returns the old value */
11153 " jns 1f\n\t"
11154 " call call_rwsem_wake\n" /* expects old value in %edx */
11155 @@ -176,6 +216,14 @@ static inline void __downgrade_write(str
11156 {
11157 asm volatile("# beginning __downgrade_write\n\t"
11158 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
11159 +
11160 +#ifdef CONFIG_PAX_REFCOUNT
11161 + "jno 0f\n"
11162 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
11163 + "int $4\n0:\n"
11164 + _ASM_EXTABLE(0b, 0b)
11165 +#endif
11166 +
11167 /*
11168 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
11169 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
11170 @@ -194,7 +242,15 @@ static inline void __downgrade_write(str
11171 */
11172 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
11173 {
11174 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
11175 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
11176 +
11177 +#ifdef CONFIG_PAX_REFCOUNT
11178 + "jno 0f\n"
11179 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
11180 + "int $4\n0:\n"
11181 + _ASM_EXTABLE(0b, 0b)
11182 +#endif
11183 +
11184 : "+m" (sem->count)
11185 : "er" (delta));
11186 }
11187 @@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l
11188 {
11189 long tmp = delta;
11190
11191 - asm volatile(LOCK_PREFIX "xadd %0,%1"
11192 + asm volatile(LOCK_PREFIX "xadd %0,%1\n"
11193 +
11194 +#ifdef CONFIG_PAX_REFCOUNT
11195 + "jno 0f\n"
11196 + "mov %0,%1\n"
11197 + "int $4\n0:\n"
11198 + _ASM_EXTABLE(0b, 0b)
11199 +#endif
11200 +
11201 : "+r" (tmp), "+m" (sem->count)
11202 : : "memory");
11203
11204 diff -urNp linux-2.6.39.1/arch/x86/include/asm/segment.h linux-2.6.39.1/arch/x86/include/asm/segment.h
11205 --- linux-2.6.39.1/arch/x86/include/asm/segment.h 2011-05-19 00:06:34.000000000 -0400
11206 +++ linux-2.6.39.1/arch/x86/include/asm/segment.h 2011-05-22 19:36:30.000000000 -0400
11207 @@ -64,8 +64,8 @@
11208 * 26 - ESPFIX small SS
11209 * 27 - per-cpu [ offset to per-cpu data area ]
11210 * 28 - stack_canary-20 [ for stack protector ]
11211 - * 29 - unused
11212 - * 30 - unused
11213 + * 29 - PCI BIOS CS
11214 + * 30 - PCI BIOS DS
11215 * 31 - TSS for double fault handler
11216 */
11217 #define GDT_ENTRY_TLS_MIN 6
11218 @@ -79,6 +79,8 @@
11219
11220 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
11221
11222 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
11223 +
11224 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
11225
11226 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
11227 @@ -104,6 +106,12 @@
11228 #define __KERNEL_STACK_CANARY 0
11229 #endif
11230
11231 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
11232 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
11233 +
11234 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
11235 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
11236 +
11237 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
11238
11239 /*
11240 @@ -141,7 +149,7 @@
11241 */
11242
11243 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
11244 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
11245 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
11246
11247
11248 #else
11249 @@ -165,6 +173,8 @@
11250 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
11251 #define __USER32_DS __USER_DS
11252
11253 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
11254 +
11255 #define GDT_ENTRY_TSS 8 /* needs two entries */
11256 #define GDT_ENTRY_LDT 10 /* needs two entries */
11257 #define GDT_ENTRY_TLS_MIN 12
11258 @@ -185,6 +195,7 @@
11259 #endif
11260
11261 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
11262 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
11263 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
11264 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
11265 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
11266 diff -urNp linux-2.6.39.1/arch/x86/include/asm/smp.h linux-2.6.39.1/arch/x86/include/asm/smp.h
11267 --- linux-2.6.39.1/arch/x86/include/asm/smp.h 2011-05-19 00:06:34.000000000 -0400
11268 +++ linux-2.6.39.1/arch/x86/include/asm/smp.h 2011-05-22 19:36:30.000000000 -0400
11269 @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_
11270 /* cpus sharing the last level cache: */
11271 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
11272 DECLARE_PER_CPU(u16, cpu_llc_id);
11273 -DECLARE_PER_CPU(int, cpu_number);
11274 +DECLARE_PER_CPU(unsigned int, cpu_number);
11275
11276 static inline struct cpumask *cpu_sibling_mask(int cpu)
11277 {
11278 @@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd
11279 extern int safe_smp_processor_id(void);
11280
11281 #elif defined(CONFIG_X86_64_SMP)
11282 -#define raw_smp_processor_id() (percpu_read(cpu_number))
11283 -
11284 -#define stack_smp_processor_id() \
11285 -({ \
11286 - struct thread_info *ti; \
11287 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
11288 - ti->cpu; \
11289 -})
11290 +#define raw_smp_processor_id() (percpu_read(cpu_number))
11291 +#define stack_smp_processor_id() raw_smp_processor_id()
11292 #define safe_smp_processor_id() smp_processor_id()
11293
11294 #endif
11295 diff -urNp linux-2.6.39.1/arch/x86/include/asm/spinlock.h linux-2.6.39.1/arch/x86/include/asm/spinlock.h
11296 --- linux-2.6.39.1/arch/x86/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
11297 +++ linux-2.6.39.1/arch/x86/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
11298 @@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
11299 static inline void arch_read_lock(arch_rwlock_t *rw)
11300 {
11301 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
11302 +
11303 +#ifdef CONFIG_PAX_REFCOUNT
11304 + "jno 0f\n"
11305 + LOCK_PREFIX " addl $1,(%0)\n"
11306 + "int $4\n0:\n"
11307 + _ASM_EXTABLE(0b, 0b)
11308 +#endif
11309 +
11310 "jns 1f\n"
11311 "call __read_lock_failed\n\t"
11312 "1:\n"
11313 @@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r
11314 static inline void arch_write_lock(arch_rwlock_t *rw)
11315 {
11316 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
11317 +
11318 +#ifdef CONFIG_PAX_REFCOUNT
11319 + "jno 0f\n"
11320 + LOCK_PREFIX " addl %1,(%0)\n"
11321 + "int $4\n0:\n"
11322 + _ASM_EXTABLE(0b, 0b)
11323 +#endif
11324 +
11325 "jz 1f\n"
11326 "call __write_lock_failed\n\t"
11327 "1:\n"
11328 @@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc
11329
11330 static inline void arch_read_unlock(arch_rwlock_t *rw)
11331 {
11332 - asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
11333 + asm volatile(LOCK_PREFIX "incl %0\n"
11334 +
11335 +#ifdef CONFIG_PAX_REFCOUNT
11336 + "jno 0f\n"
11337 + LOCK_PREFIX "decl %0\n"
11338 + "int $4\n0:\n"
11339 + _ASM_EXTABLE(0b, 0b)
11340 +#endif
11341 +
11342 + :"+m" (rw->lock) : : "memory");
11343 }
11344
11345 static inline void arch_write_unlock(arch_rwlock_t *rw)
11346 {
11347 - asm volatile(LOCK_PREFIX "addl %1, %0"
11348 + asm volatile(LOCK_PREFIX "addl %1, %0\n"
11349 +
11350 +#ifdef CONFIG_PAX_REFCOUNT
11351 + "jno 0f\n"
11352 + LOCK_PREFIX "subl %1, %0\n"
11353 + "int $4\n0:\n"
11354 + _ASM_EXTABLE(0b, 0b)
11355 +#endif
11356 +
11357 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
11358 }
11359
11360 diff -urNp linux-2.6.39.1/arch/x86/include/asm/stackprotector.h linux-2.6.39.1/arch/x86/include/asm/stackprotector.h
11361 --- linux-2.6.39.1/arch/x86/include/asm/stackprotector.h 2011-05-19 00:06:34.000000000 -0400
11362 +++ linux-2.6.39.1/arch/x86/include/asm/stackprotector.h 2011-05-22 19:36:30.000000000 -0400
11363 @@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
11364
11365 static inline void load_stack_canary_segment(void)
11366 {
11367 -#ifdef CONFIG_X86_32
11368 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
11369 asm volatile ("mov %0, %%gs" : : "r" (0));
11370 #endif
11371 }
11372 diff -urNp linux-2.6.39.1/arch/x86/include/asm/stacktrace.h linux-2.6.39.1/arch/x86/include/asm/stacktrace.h
11373 --- linux-2.6.39.1/arch/x86/include/asm/stacktrace.h 2011-05-19 00:06:34.000000000 -0400
11374 +++ linux-2.6.39.1/arch/x86/include/asm/stacktrace.h 2011-05-22 19:36:30.000000000 -0400
11375 @@ -11,28 +11,20 @@
11376
11377 extern int kstack_depth_to_print;
11378
11379 -struct thread_info;
11380 +struct task_struct;
11381 struct stacktrace_ops;
11382
11383 -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
11384 - unsigned long *stack,
11385 - unsigned long bp,
11386 - const struct stacktrace_ops *ops,
11387 - void *data,
11388 - unsigned long *end,
11389 - int *graph);
11390 -
11391 -extern unsigned long
11392 -print_context_stack(struct thread_info *tinfo,
11393 - unsigned long *stack, unsigned long bp,
11394 - const struct stacktrace_ops *ops, void *data,
11395 - unsigned long *end, int *graph);
11396 -
11397 -extern unsigned long
11398 -print_context_stack_bp(struct thread_info *tinfo,
11399 - unsigned long *stack, unsigned long bp,
11400 - const struct stacktrace_ops *ops, void *data,
11401 - unsigned long *end, int *graph);
11402 +typedef unsigned long walk_stack_t(struct task_struct *task,
11403 + void *stack_start,
11404 + unsigned long *stack,
11405 + unsigned long bp,
11406 + const struct stacktrace_ops *ops,
11407 + void *data,
11408 + unsigned long *end,
11409 + int *graph);
11410 +
11411 +extern walk_stack_t print_context_stack;
11412 +extern walk_stack_t print_context_stack_bp;
11413
11414 /* Generic stack tracer with callbacks */
11415
11416 @@ -43,7 +35,7 @@ struct stacktrace_ops {
11417 void (*address)(void *data, unsigned long address, int reliable);
11418 /* On negative return stop dumping */
11419 int (*stack)(void *data, char *name);
11420 - walk_stack_t walk_stack;
11421 + walk_stack_t *walk_stack;
11422 };
11423
11424 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
11425 diff -urNp linux-2.6.39.1/arch/x86/include/asm/system.h linux-2.6.39.1/arch/x86/include/asm/system.h
11426 --- linux-2.6.39.1/arch/x86/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
11427 +++ linux-2.6.39.1/arch/x86/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
11428 @@ -129,7 +129,7 @@ do { \
11429 "call __switch_to\n\t" \
11430 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
11431 __switch_canary \
11432 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
11433 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
11434 "movq %%rax,%%rdi\n\t" \
11435 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
11436 "jnz ret_from_fork\n\t" \
11437 @@ -140,7 +140,7 @@ do { \
11438 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
11439 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
11440 [_tif_fork] "i" (_TIF_FORK), \
11441 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
11442 + [thread_info] "m" (current_tinfo), \
11443 [current_task] "m" (current_task) \
11444 __switch_canary_iparam \
11445 : "memory", "cc" __EXTRA_CLOBBER)
11446 @@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
11447 {
11448 unsigned long __limit;
11449 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
11450 - return __limit + 1;
11451 + return __limit;
11452 }
11453
11454 static inline void native_clts(void)
11455 @@ -340,12 +340,12 @@ void enable_hlt(void);
11456
11457 void cpu_idle_wait(void);
11458
11459 -extern unsigned long arch_align_stack(unsigned long sp);
11460 +#define arch_align_stack(x) ((x) & ~0xfUL)
11461 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
11462
11463 void default_idle(void);
11464
11465 -void stop_this_cpu(void *dummy);
11466 +void stop_this_cpu(void *dummy) __noreturn;
11467
11468 /*
11469 * Force strict CPU ordering.
11470 diff -urNp linux-2.6.39.1/arch/x86/include/asm/thread_info.h linux-2.6.39.1/arch/x86/include/asm/thread_info.h
11471 --- linux-2.6.39.1/arch/x86/include/asm/thread_info.h 2011-05-19 00:06:34.000000000 -0400
11472 +++ linux-2.6.39.1/arch/x86/include/asm/thread_info.h 2011-05-22 19:36:30.000000000 -0400
11473 @@ -10,6 +10,7 @@
11474 #include <linux/compiler.h>
11475 #include <asm/page.h>
11476 #include <asm/types.h>
11477 +#include <asm/percpu.h>
11478
11479 /*
11480 * low level task data that entry.S needs immediate access to
11481 @@ -24,7 +25,6 @@ struct exec_domain;
11482 #include <asm/atomic.h>
11483
11484 struct thread_info {
11485 - struct task_struct *task; /* main task structure */
11486 struct exec_domain *exec_domain; /* execution domain */
11487 __u32 flags; /* low level flags */
11488 __u32 status; /* thread synchronous flags */
11489 @@ -34,18 +34,12 @@ struct thread_info {
11490 mm_segment_t addr_limit;
11491 struct restart_block restart_block;
11492 void __user *sysenter_return;
11493 -#ifdef CONFIG_X86_32
11494 - unsigned long previous_esp; /* ESP of the previous stack in
11495 - case of nested (IRQ) stacks
11496 - */
11497 - __u8 supervisor_stack[0];
11498 -#endif
11499 + unsigned long lowest_stack;
11500 int uaccess_err;
11501 };
11502
11503 -#define INIT_THREAD_INFO(tsk) \
11504 +#define INIT_THREAD_INFO \
11505 { \
11506 - .task = &tsk, \
11507 .exec_domain = &default_exec_domain, \
11508 .flags = 0, \
11509 .cpu = 0, \
11510 @@ -56,7 +50,7 @@ struct thread_info {
11511 }, \
11512 }
11513
11514 -#define init_thread_info (init_thread_union.thread_info)
11515 +#define init_thread_info (init_thread_union.stack)
11516 #define init_stack (init_thread_union.stack)
11517
11518 #else /* !__ASSEMBLY__ */
11519 @@ -170,6 +164,23 @@ struct thread_info {
11520 ret; \
11521 })
11522
11523 +#ifdef __ASSEMBLY__
11524 +/* how to get the thread information struct from ASM */
11525 +#define GET_THREAD_INFO(reg) \
11526 + mov PER_CPU_VAR(current_tinfo), reg
11527 +
11528 +/* use this one if reg already contains %esp */
11529 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
11530 +#else
11531 +/* how to get the thread information struct from C */
11532 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
11533 +
11534 +static __always_inline struct thread_info *current_thread_info(void)
11535 +{
11536 + return percpu_read_stable(current_tinfo);
11537 +}
11538 +#endif
11539 +
11540 #ifdef CONFIG_X86_32
11541
11542 #define STACK_WARN (THREAD_SIZE/8)
11543 @@ -180,35 +191,13 @@ struct thread_info {
11544 */
11545 #ifndef __ASSEMBLY__
11546
11547 -
11548 /* how to get the current stack pointer from C */
11549 register unsigned long current_stack_pointer asm("esp") __used;
11550
11551 -/* how to get the thread information struct from C */
11552 -static inline struct thread_info *current_thread_info(void)
11553 -{
11554 - return (struct thread_info *)
11555 - (current_stack_pointer & ~(THREAD_SIZE - 1));
11556 -}
11557 -
11558 -#else /* !__ASSEMBLY__ */
11559 -
11560 -/* how to get the thread information struct from ASM */
11561 -#define GET_THREAD_INFO(reg) \
11562 - movl $-THREAD_SIZE, reg; \
11563 - andl %esp, reg
11564 -
11565 -/* use this one if reg already contains %esp */
11566 -#define GET_THREAD_INFO_WITH_ESP(reg) \
11567 - andl $-THREAD_SIZE, reg
11568 -
11569 #endif
11570
11571 #else /* X86_32 */
11572
11573 -#include <asm/percpu.h>
11574 -#define KERNEL_STACK_OFFSET (5*8)
11575 -
11576 /*
11577 * macros/functions for gaining access to the thread information structure
11578 * preempt_count needs to be 1 initially, until the scheduler is functional.
11579 @@ -216,21 +205,8 @@ static inline struct thread_info *curren
11580 #ifndef __ASSEMBLY__
11581 DECLARE_PER_CPU(unsigned long, kernel_stack);
11582
11583 -static inline struct thread_info *current_thread_info(void)
11584 -{
11585 - struct thread_info *ti;
11586 - ti = (void *)(percpu_read_stable(kernel_stack) +
11587 - KERNEL_STACK_OFFSET - THREAD_SIZE);
11588 - return ti;
11589 -}
11590 -
11591 -#else /* !__ASSEMBLY__ */
11592 -
11593 -/* how to get the thread information struct from ASM */
11594 -#define GET_THREAD_INFO(reg) \
11595 - movq PER_CPU_VAR(kernel_stack),reg ; \
11596 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
11597 -
11598 +/* how to get the current stack pointer from C */
11599 +register unsigned long current_stack_pointer asm("rsp") __used;
11600 #endif
11601
11602 #endif /* !X86_32 */
11603 @@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
11604 extern void free_thread_info(struct thread_info *ti);
11605 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
11606 #define arch_task_cache_init arch_task_cache_init
11607 +
11608 +#define __HAVE_THREAD_FUNCTIONS
11609 +#define task_thread_info(task) (&(task)->tinfo)
11610 +#define task_stack_page(task) ((task)->stack)
11611 +#define setup_thread_stack(p, org) do {} while (0)
11612 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
11613 +
11614 +#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
11615 +extern struct task_struct *alloc_task_struct_node(int node);
11616 +extern void free_task_struct(struct task_struct *);
11617 +
11618 #endif
11619 #endif /* _ASM_X86_THREAD_INFO_H */
11620 diff -urNp linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h
11621 --- linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
11622 +++ linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
11623 @@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
11624 static __always_inline unsigned long __must_check
11625 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
11626 {
11627 + pax_track_stack();
11628 +
11629 + if ((long)n < 0)
11630 + return n;
11631 +
11632 if (__builtin_constant_p(n)) {
11633 unsigned long ret;
11634
11635 @@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
11636 return ret;
11637 }
11638 }
11639 + if (!__builtin_constant_p(n))
11640 + check_object_size(from, n, true);
11641 return __copy_to_user_ll(to, from, n);
11642 }
11643
11644 @@ -83,12 +90,16 @@ static __always_inline unsigned long __m
11645 __copy_to_user(void __user *to, const void *from, unsigned long n)
11646 {
11647 might_fault();
11648 +
11649 return __copy_to_user_inatomic(to, from, n);
11650 }
11651
11652 static __always_inline unsigned long
11653 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
11654 {
11655 + if ((long)n < 0)
11656 + return n;
11657 +
11658 /* Avoid zeroing the tail if the copy fails..
11659 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
11660 * but as the zeroing behaviour is only significant when n is not
11661 @@ -138,6 +149,12 @@ static __always_inline unsigned long
11662 __copy_from_user(void *to, const void __user *from, unsigned long n)
11663 {
11664 might_fault();
11665 +
11666 + pax_track_stack();
11667 +
11668 + if ((long)n < 0)
11669 + return n;
11670 +
11671 if (__builtin_constant_p(n)) {
11672 unsigned long ret;
11673
11674 @@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
11675 return ret;
11676 }
11677 }
11678 + if (!__builtin_constant_p(n))
11679 + check_object_size(to, n, false);
11680 return __copy_from_user_ll(to, from, n);
11681 }
11682
11683 @@ -160,6 +179,10 @@ static __always_inline unsigned long __c
11684 const void __user *from, unsigned long n)
11685 {
11686 might_fault();
11687 +
11688 + if ((long)n < 0)
11689 + return n;
11690 +
11691 if (__builtin_constant_p(n)) {
11692 unsigned long ret;
11693
11694 @@ -182,15 +205,19 @@ static __always_inline unsigned long
11695 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
11696 unsigned long n)
11697 {
11698 - return __copy_from_user_ll_nocache_nozero(to, from, n);
11699 -}
11700 + if ((long)n < 0)
11701 + return n;
11702
11703 -unsigned long __must_check copy_to_user(void __user *to,
11704 - const void *from, unsigned long n);
11705 -unsigned long __must_check _copy_from_user(void *to,
11706 - const void __user *from,
11707 - unsigned long n);
11708 + return __copy_from_user_ll_nocache_nozero(to, from, n);
11709 +}
11710
11711 +extern void copy_to_user_overflow(void)
11712 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11713 + __compiletime_error("copy_to_user() buffer size is not provably correct")
11714 +#else
11715 + __compiletime_warning("copy_to_user() buffer size is not provably correct")
11716 +#endif
11717 +;
11718
11719 extern void copy_from_user_overflow(void)
11720 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11721 @@ -200,17 +227,61 @@ extern void copy_from_user_overflow(void
11722 #endif
11723 ;
11724
11725 -static inline unsigned long __must_check copy_from_user(void *to,
11726 - const void __user *from,
11727 - unsigned long n)
11728 +/**
11729 + * copy_to_user: - Copy a block of data into user space.
11730 + * @to: Destination address, in user space.
11731 + * @from: Source address, in kernel space.
11732 + * @n: Number of bytes to copy.
11733 + *
11734 + * Context: User context only. This function may sleep.
11735 + *
11736 + * Copy data from kernel space to user space.
11737 + *
11738 + * Returns number of bytes that could not be copied.
11739 + * On success, this will be zero.
11740 + */
11741 +static inline unsigned long __must_check
11742 +copy_to_user(void __user *to, const void *from, unsigned long n)
11743 +{
11744 + int sz = __compiletime_object_size(from);
11745 +
11746 + if (unlikely(sz != -1 && sz < n))
11747 + copy_to_user_overflow();
11748 + else if (access_ok(VERIFY_WRITE, to, n))
11749 + n = __copy_to_user(to, from, n);
11750 + return n;
11751 +}
11752 +
11753 +/**
11754 + * copy_from_user: - Copy a block of data from user space.
11755 + * @to: Destination address, in kernel space.
11756 + * @from: Source address, in user space.
11757 + * @n: Number of bytes to copy.
11758 + *
11759 + * Context: User context only. This function may sleep.
11760 + *
11761 + * Copy data from user space to kernel space.
11762 + *
11763 + * Returns number of bytes that could not be copied.
11764 + * On success, this will be zero.
11765 + *
11766 + * If some data could not be copied, this function will pad the copied
11767 + * data to the requested size using zero bytes.
11768 + */
11769 +static inline unsigned long __must_check
11770 +copy_from_user(void *to, const void __user *from, unsigned long n)
11771 {
11772 int sz = __compiletime_object_size(to);
11773
11774 - if (likely(sz == -1 || sz >= n))
11775 - n = _copy_from_user(to, from, n);
11776 - else
11777 + if (unlikely(sz != -1 && sz < n))
11778 copy_from_user_overflow();
11779 -
11780 + else if (access_ok(VERIFY_READ, from, n))
11781 + n = __copy_from_user(to, from, n);
11782 + else if ((long)n > 0) {
11783 + if (!__builtin_constant_p(n))
11784 + check_object_size(to, n, false);
11785 + memset(to, 0, n);
11786 + }
11787 return n;
11788 }
11789
11790 diff -urNp linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h
11791 --- linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
11792 +++ linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
11793 @@ -11,6 +11,9 @@
11794 #include <asm/alternative.h>
11795 #include <asm/cpufeature.h>
11796 #include <asm/page.h>
11797 +#include <asm/pgtable.h>
11798 +
11799 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
11800
11801 /*
11802 * Copy To/From Userspace
11803 @@ -37,26 +40,26 @@ copy_user_generic(void *to, const void *
11804 return ret;
11805 }
11806
11807 -__must_check unsigned long
11808 -_copy_to_user(void __user *to, const void *from, unsigned len);
11809 -__must_check unsigned long
11810 -_copy_from_user(void *to, const void __user *from, unsigned len);
11811 +static __always_inline __must_check unsigned long
11812 +__copy_to_user(void __user *to, const void *from, unsigned len);
11813 +static __always_inline __must_check unsigned long
11814 +__copy_from_user(void *to, const void __user *from, unsigned len);
11815 __must_check unsigned long
11816 copy_in_user(void __user *to, const void __user *from, unsigned len);
11817
11818 static inline unsigned long __must_check copy_from_user(void *to,
11819 const void __user *from,
11820 - unsigned long n)
11821 + unsigned n)
11822 {
11823 - int sz = __compiletime_object_size(to);
11824 -
11825 might_fault();
11826 - if (likely(sz == -1 || sz >= n))
11827 - n = _copy_from_user(to, from, n);
11828 -#ifdef CONFIG_DEBUG_VM
11829 - else
11830 - WARN(1, "Buffer overflow detected!\n");
11831 -#endif
11832 +
11833 + if (access_ok(VERIFY_READ, from, n))
11834 + n = __copy_from_user(to, from, n);
11835 + else if ((int)n > 0) {
11836 + if (!__builtin_constant_p(n))
11837 + check_object_size(to, n, false);
11838 + memset(to, 0, n);
11839 + }
11840 return n;
11841 }
11842
11843 @@ -65,110 +68,198 @@ int copy_to_user(void __user *dst, const
11844 {
11845 might_fault();
11846
11847 - return _copy_to_user(dst, src, size);
11848 + if (access_ok(VERIFY_WRITE, dst, size))
11849 + size = __copy_to_user(dst, src, size);
11850 + return size;
11851 }
11852
11853 static __always_inline __must_check
11854 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
11855 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
11856 {
11857 - int ret = 0;
11858 + int sz = __compiletime_object_size(dst);
11859 + unsigned ret = 0;
11860
11861 might_fault();
11862 - if (!__builtin_constant_p(size))
11863 - return copy_user_generic(dst, (__force void *)src, size);
11864 +
11865 + pax_track_stack();
11866 +
11867 + if ((int)size < 0)
11868 + return size;
11869 +
11870 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11871 + if (!__access_ok(VERIFY_READ, src, size))
11872 + return size;
11873 +#endif
11874 +
11875 + if (unlikely(sz != -1 && sz < size)) {
11876 +#ifdef CONFIG_DEBUG_VM
11877 + WARN(1, "Buffer overflow detected!\n");
11878 +#endif
11879 + return size;
11880 + }
11881 +
11882 + if (!__builtin_constant_p(size)) {
11883 + check_object_size(dst, size, false);
11884 +
11885 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11886 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11887 + src += PAX_USER_SHADOW_BASE;
11888 +#endif
11889 +
11890 + return copy_user_generic(dst, (__force const void *)src, size);
11891 + }
11892 switch (size) {
11893 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
11894 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
11895 ret, "b", "b", "=q", 1);
11896 return ret;
11897 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
11898 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
11899 ret, "w", "w", "=r", 2);
11900 return ret;
11901 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
11902 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
11903 ret, "l", "k", "=r", 4);
11904 return ret;
11905 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
11906 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11907 ret, "q", "", "=r", 8);
11908 return ret;
11909 case 10:
11910 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11911 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11912 ret, "q", "", "=r", 10);
11913 if (unlikely(ret))
11914 return ret;
11915 __get_user_asm(*(u16 *)(8 + (char *)dst),
11916 - (u16 __user *)(8 + (char __user *)src),
11917 + (const u16 __user *)(8 + (const char __user *)src),
11918 ret, "w", "w", "=r", 2);
11919 return ret;
11920 case 16:
11921 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11922 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11923 ret, "q", "", "=r", 16);
11924 if (unlikely(ret))
11925 return ret;
11926 __get_user_asm(*(u64 *)(8 + (char *)dst),
11927 - (u64 __user *)(8 + (char __user *)src),
11928 + (const u64 __user *)(8 + (const char __user *)src),
11929 ret, "q", "", "=r", 8);
11930 return ret;
11931 default:
11932 - return copy_user_generic(dst, (__force void *)src, size);
11933 +
11934 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11935 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11936 + src += PAX_USER_SHADOW_BASE;
11937 +#endif
11938 +
11939 + return copy_user_generic(dst, (__force const void *)src, size);
11940 }
11941 }
11942
11943 static __always_inline __must_check
11944 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
11945 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
11946 {
11947 - int ret = 0;
11948 + int sz = __compiletime_object_size(src);
11949 + unsigned ret = 0;
11950
11951 might_fault();
11952 - if (!__builtin_constant_p(size))
11953 +
11954 + pax_track_stack();
11955 +
11956 + if ((int)size < 0)
11957 + return size;
11958 +
11959 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11960 + if (!__access_ok(VERIFY_WRITE, dst, size))
11961 + return size;
11962 +#endif
11963 +
11964 + if (unlikely(sz != -1 && sz < size)) {
11965 +#ifdef CONFIG_DEBUG_VM
11966 + WARN(1, "Buffer overflow detected!\n");
11967 +#endif
11968 + return size;
11969 + }
11970 +
11971 + if (!__builtin_constant_p(size)) {
11972 + check_object_size(src, size, true);
11973 +
11974 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11975 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11976 + dst += PAX_USER_SHADOW_BASE;
11977 +#endif
11978 +
11979 return copy_user_generic((__force void *)dst, src, size);
11980 + }
11981 switch (size) {
11982 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11983 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11984 ret, "b", "b", "iq", 1);
11985 return ret;
11986 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11987 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11988 ret, "w", "w", "ir", 2);
11989 return ret;
11990 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11991 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11992 ret, "l", "k", "ir", 4);
11993 return ret;
11994 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11995 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11996 ret, "q", "", "er", 8);
11997 return ret;
11998 case 10:
11999 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
12000 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
12001 ret, "q", "", "er", 10);
12002 if (unlikely(ret))
12003 return ret;
12004 asm("":::"memory");
12005 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
12006 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
12007 ret, "w", "w", "ir", 2);
12008 return ret;
12009 case 16:
12010 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
12011 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
12012 ret, "q", "", "er", 16);
12013 if (unlikely(ret))
12014 return ret;
12015 asm("":::"memory");
12016 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
12017 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
12018 ret, "q", "", "er", 8);
12019 return ret;
12020 default:
12021 +
12022 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12023 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12024 + dst += PAX_USER_SHADOW_BASE;
12025 +#endif
12026 +
12027 return copy_user_generic((__force void *)dst, src, size);
12028 }
12029 }
12030
12031 static __always_inline __must_check
12032 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
12033 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
12034 {
12035 - int ret = 0;
12036 + unsigned ret = 0;
12037
12038 might_fault();
12039 - if (!__builtin_constant_p(size))
12040 +
12041 + if ((int)size < 0)
12042 + return size;
12043 +
12044 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12045 + if (!__access_ok(VERIFY_READ, src, size))
12046 + return size;
12047 + if (!__access_ok(VERIFY_WRITE, dst, size))
12048 + return size;
12049 +#endif
12050 +
12051 + if (!__builtin_constant_p(size)) {
12052 +
12053 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12054 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12055 + src += PAX_USER_SHADOW_BASE;
12056 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12057 + dst += PAX_USER_SHADOW_BASE;
12058 +#endif
12059 +
12060 return copy_user_generic((__force void *)dst,
12061 - (__force void *)src, size);
12062 + (__force const void *)src, size);
12063 + }
12064 switch (size) {
12065 case 1: {
12066 u8 tmp;
12067 - __get_user_asm(tmp, (u8 __user *)src,
12068 + __get_user_asm(tmp, (const u8 __user *)src,
12069 ret, "b", "b", "=q", 1);
12070 if (likely(!ret))
12071 __put_user_asm(tmp, (u8 __user *)dst,
12072 @@ -177,7 +268,7 @@ int __copy_in_user(void __user *dst, con
12073 }
12074 case 2: {
12075 u16 tmp;
12076 - __get_user_asm(tmp, (u16 __user *)src,
12077 + __get_user_asm(tmp, (const u16 __user *)src,
12078 ret, "w", "w", "=r", 2);
12079 if (likely(!ret))
12080 __put_user_asm(tmp, (u16 __user *)dst,
12081 @@ -187,7 +278,7 @@ int __copy_in_user(void __user *dst, con
12082
12083 case 4: {
12084 u32 tmp;
12085 - __get_user_asm(tmp, (u32 __user *)src,
12086 + __get_user_asm(tmp, (const u32 __user *)src,
12087 ret, "l", "k", "=r", 4);
12088 if (likely(!ret))
12089 __put_user_asm(tmp, (u32 __user *)dst,
12090 @@ -196,7 +287,7 @@ int __copy_in_user(void __user *dst, con
12091 }
12092 case 8: {
12093 u64 tmp;
12094 - __get_user_asm(tmp, (u64 __user *)src,
12095 + __get_user_asm(tmp, (const u64 __user *)src,
12096 ret, "q", "", "=r", 8);
12097 if (likely(!ret))
12098 __put_user_asm(tmp, (u64 __user *)dst,
12099 @@ -204,8 +295,16 @@ int __copy_in_user(void __user *dst, con
12100 return ret;
12101 }
12102 default:
12103 +
12104 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12105 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12106 + src += PAX_USER_SHADOW_BASE;
12107 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12108 + dst += PAX_USER_SHADOW_BASE;
12109 +#endif
12110 +
12111 return copy_user_generic((__force void *)dst,
12112 - (__force void *)src, size);
12113 + (__force const void *)src, size);
12114 }
12115 }
12116
12117 @@ -222,33 +321,72 @@ __must_check unsigned long __clear_user(
12118 static __must_check __always_inline int
12119 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
12120 {
12121 + pax_track_stack();
12122 +
12123 + if ((int)size < 0)
12124 + return size;
12125 +
12126 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12127 + if (!__access_ok(VERIFY_READ, src, size))
12128 + return size;
12129 +
12130 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
12131 + src += PAX_USER_SHADOW_BASE;
12132 +#endif
12133 +
12134 return copy_user_generic(dst, (__force const void *)src, size);
12135 }
12136
12137 -static __must_check __always_inline int
12138 +static __must_check __always_inline unsigned long
12139 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
12140 {
12141 + if ((int)size < 0)
12142 + return size;
12143 +
12144 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12145 + if (!__access_ok(VERIFY_WRITE, dst, size))
12146 + return size;
12147 +
12148 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12149 + dst += PAX_USER_SHADOW_BASE;
12150 +#endif
12151 +
12152 return copy_user_generic((__force void *)dst, src, size);
12153 }
12154
12155 -extern long __copy_user_nocache(void *dst, const void __user *src,
12156 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
12157 unsigned size, int zerorest);
12158
12159 -static inline int
12160 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12161 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12162 {
12163 might_sleep();
12164 +
12165 + if ((int)size < 0)
12166 + return size;
12167 +
12168 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12169 + if (!__access_ok(VERIFY_READ, src, size))
12170 + return size;
12171 +#endif
12172 +
12173 return __copy_user_nocache(dst, src, size, 1);
12174 }
12175
12176 -static inline int
12177 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12178 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12179 unsigned size)
12180 {
12181 + if ((int)size < 0)
12182 + return size;
12183 +
12184 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12185 + if (!__access_ok(VERIFY_READ, src, size))
12186 + return size;
12187 +#endif
12188 +
12189 return __copy_user_nocache(dst, src, size, 0);
12190 }
12191
12192 -unsigned long
12193 +extern unsigned long
12194 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
12195
12196 #endif /* _ASM_X86_UACCESS_64_H */
12197 diff -urNp linux-2.6.39.1/arch/x86/include/asm/uaccess.h linux-2.6.39.1/arch/x86/include/asm/uaccess.h
12198 --- linux-2.6.39.1/arch/x86/include/asm/uaccess.h 2011-06-03 00:04:13.000000000 -0400
12199 +++ linux-2.6.39.1/arch/x86/include/asm/uaccess.h 2011-06-03 00:32:04.000000000 -0400
12200 @@ -8,12 +8,15 @@
12201 #include <linux/thread_info.h>
12202 #include <linux/prefetch.h>
12203 #include <linux/string.h>
12204 +#include <linux/sched.h>
12205 #include <asm/asm.h>
12206 #include <asm/page.h>
12207
12208 #define VERIFY_READ 0
12209 #define VERIFY_WRITE 1
12210
12211 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
12212 +
12213 /*
12214 * The fs value determines whether argument validity checking should be
12215 * performed or not. If get_fs() == USER_DS, checking is performed, with
12216 @@ -29,7 +32,12 @@
12217
12218 #define get_ds() (KERNEL_DS)
12219 #define get_fs() (current_thread_info()->addr_limit)
12220 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12221 +void __set_fs(mm_segment_t x);
12222 +void set_fs(mm_segment_t x);
12223 +#else
12224 #define set_fs(x) (current_thread_info()->addr_limit = (x))
12225 +#endif
12226
12227 #define segment_eq(a, b) ((a).seg == (b).seg)
12228
12229 @@ -77,7 +85,33 @@
12230 * checks that the pointer is in the user space range - after calling
12231 * this function, memory access functions may still return -EFAULT.
12232 */
12233 -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12234 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12235 +#define access_ok(type, addr, size) \
12236 +({ \
12237 + long __size = size; \
12238 + unsigned long __addr = (unsigned long)addr; \
12239 + unsigned long __addr_ao = __addr & PAGE_MASK; \
12240 + unsigned long __end_ao = __addr + __size - 1; \
12241 + bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
12242 + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
12243 + while(__addr_ao <= __end_ao) { \
12244 + char __c_ao; \
12245 + __addr_ao += PAGE_SIZE; \
12246 + if (__size > PAGE_SIZE) \
12247 + cond_resched(); \
12248 + if (__get_user(__c_ao, (char __user *)__addr)) \
12249 + break; \
12250 + if (type != VERIFY_WRITE) { \
12251 + __addr = __addr_ao; \
12252 + continue; \
12253 + } \
12254 + if (__put_user(__c_ao, (char __user *)__addr)) \
12255 + break; \
12256 + __addr = __addr_ao; \
12257 + } \
12258 + } \
12259 + __ret_ao; \
12260 +})
12261
12262 /*
12263 * The exception table consists of pairs of addresses: the first is the
12264 @@ -183,12 +217,20 @@ extern int __get_user_bad(void);
12265 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
12266 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
12267
12268 -
12269 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12270 +#define __copyuser_seg "gs;"
12271 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
12272 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
12273 +#else
12274 +#define __copyuser_seg
12275 +#define __COPYUSER_SET_ES
12276 +#define __COPYUSER_RESTORE_ES
12277 +#endif
12278
12279 #ifdef CONFIG_X86_32
12280 #define __put_user_asm_u64(x, addr, err, errret) \
12281 - asm volatile("1: movl %%eax,0(%2)\n" \
12282 - "2: movl %%edx,4(%2)\n" \
12283 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
12284 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
12285 "3:\n" \
12286 ".section .fixup,\"ax\"\n" \
12287 "4: movl %3,%0\n" \
12288 @@ -200,8 +242,8 @@ extern int __get_user_bad(void);
12289 : "A" (x), "r" (addr), "i" (errret), "0" (err))
12290
12291 #define __put_user_asm_ex_u64(x, addr) \
12292 - asm volatile("1: movl %%eax,0(%1)\n" \
12293 - "2: movl %%edx,4(%1)\n" \
12294 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
12295 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
12296 "3:\n" \
12297 _ASM_EXTABLE(1b, 2b - 1b) \
12298 _ASM_EXTABLE(2b, 3b - 2b) \
12299 @@ -374,7 +416,7 @@ do { \
12300 } while (0)
12301
12302 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12303 - asm volatile("1: mov"itype" %2,%"rtype"1\n" \
12304 + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
12305 "2:\n" \
12306 ".section .fixup,\"ax\"\n" \
12307 "3: mov %3,%0\n" \
12308 @@ -382,7 +424,7 @@ do { \
12309 " jmp 2b\n" \
12310 ".previous\n" \
12311 _ASM_EXTABLE(1b, 3b) \
12312 - : "=r" (err), ltype(x) \
12313 + : "=r" (err), ltype (x) \
12314 : "m" (__m(addr)), "i" (errret), "0" (err))
12315
12316 #define __get_user_size_ex(x, ptr, size) \
12317 @@ -407,7 +449,7 @@ do { \
12318 } while (0)
12319
12320 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
12321 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
12322 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
12323 "2:\n" \
12324 _ASM_EXTABLE(1b, 2b - 1b) \
12325 : ltype(x) : "m" (__m(addr)))
12326 @@ -424,13 +466,24 @@ do { \
12327 int __gu_err; \
12328 unsigned long __gu_val; \
12329 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
12330 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
12331 + (x) = (__typeof__(*(ptr)))__gu_val; \
12332 __gu_err; \
12333 })
12334
12335 /* FIXME: this hack is definitely wrong -AK */
12336 struct __large_struct { unsigned long buf[100]; };
12337 -#define __m(x) (*(struct __large_struct __user *)(x))
12338 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12339 +#define ____m(x) \
12340 +({ \
12341 + unsigned long ____x = (unsigned long)(x); \
12342 + if (____x < PAX_USER_SHADOW_BASE) \
12343 + ____x += PAX_USER_SHADOW_BASE; \
12344 + (void __user *)____x; \
12345 +})
12346 +#else
12347 +#define ____m(x) (x)
12348 +#endif
12349 +#define __m(x) (*(struct __large_struct __user *)____m(x))
12350
12351 /*
12352 * Tell gcc we read from memory instead of writing: this is because
12353 @@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
12354 * aliasing issues.
12355 */
12356 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12357 - asm volatile("1: mov"itype" %"rtype"1,%2\n" \
12358 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
12359 "2:\n" \
12360 ".section .fixup,\"ax\"\n" \
12361 "3: mov %3,%0\n" \
12362 @@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
12363 ".previous\n" \
12364 _ASM_EXTABLE(1b, 3b) \
12365 : "=r"(err) \
12366 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
12367 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
12368
12369 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
12370 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
12371 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
12372 "2:\n" \
12373 _ASM_EXTABLE(1b, 2b - 1b) \
12374 : : ltype(x), "m" (__m(addr)))
12375 @@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
12376 * On error, the variable @x is set to zero.
12377 */
12378
12379 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12380 +#define __get_user(x, ptr) get_user((x), (ptr))
12381 +#else
12382 #define __get_user(x, ptr) \
12383 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
12384 +#endif
12385
12386 /**
12387 * __put_user: - Write a simple value into user space, with less checking.
12388 @@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
12389 * Returns zero on success, or -EFAULT on error.
12390 */
12391
12392 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12393 +#define __put_user(x, ptr) put_user((x), (ptr))
12394 +#else
12395 #define __put_user(x, ptr) \
12396 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
12397 +#endif
12398
12399 #define __get_user_unaligned __get_user
12400 #define __put_user_unaligned __put_user
12401 @@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
12402 #define get_user_ex(x, ptr) do { \
12403 unsigned long __gue_val; \
12404 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
12405 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
12406 + (x) = (__typeof__(*(ptr)))__gue_val; \
12407 } while (0)
12408
12409 #ifdef CONFIG_X86_WP_WORKS_OK
12410 @@ -567,6 +628,7 @@ extern struct movsl_mask {
12411
12412 #define ARCH_HAS_NOCACHE_UACCESS 1
12413
12414 +#define ARCH_HAS_SORT_EXTABLE
12415 #ifdef CONFIG_X86_32
12416 # include "uaccess_32.h"
12417 #else
12418 diff -urNp linux-2.6.39.1/arch/x86/include/asm/vgtod.h linux-2.6.39.1/arch/x86/include/asm/vgtod.h
12419 --- linux-2.6.39.1/arch/x86/include/asm/vgtod.h 2011-05-19 00:06:34.000000000 -0400
12420 +++ linux-2.6.39.1/arch/x86/include/asm/vgtod.h 2011-05-22 19:36:30.000000000 -0400
12421 @@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
12422 int sysctl_enabled;
12423 struct timezone sys_tz;
12424 struct { /* extract of a clocksource struct */
12425 + char name[8];
12426 cycle_t (*vread)(void);
12427 cycle_t cycle_last;
12428 cycle_t mask;
12429 diff -urNp linux-2.6.39.1/arch/x86/include/asm/vsyscall.h linux-2.6.39.1/arch/x86/include/asm/vsyscall.h
12430 --- linux-2.6.39.1/arch/x86/include/asm/vsyscall.h 2011-05-19 00:06:34.000000000 -0400
12431 +++ linux-2.6.39.1/arch/x86/include/asm/vsyscall.h 2011-05-22 19:36:30.000000000 -0400
12432 @@ -15,9 +15,10 @@ enum vsyscall_num {
12433
12434 #ifdef __KERNEL__
12435 #include <linux/seqlock.h>
12436 +#include <linux/getcpu.h>
12437 +#include <linux/time.h>
12438
12439 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
12440 -#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
12441
12442 /* Definitions for CONFIG_GENERIC_TIME definitions */
12443 #define __section_vsyscall_gtod_data __attribute__ \
12444 @@ -31,7 +32,6 @@ enum vsyscall_num {
12445 #define VGETCPU_LSL 2
12446
12447 extern int __vgetcpu_mode;
12448 -extern volatile unsigned long __jiffies;
12449
12450 /* kernel space (writeable) */
12451 extern int vgetcpu_mode;
12452 @@ -39,6 +39,9 @@ extern struct timezone sys_tz;
12453
12454 extern void map_vsyscall(void);
12455
12456 +extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
12457 +extern time_t vtime(time_t *t);
12458 +extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
12459 #endif /* __KERNEL__ */
12460
12461 #endif /* _ASM_X86_VSYSCALL_H */
12462 diff -urNp linux-2.6.39.1/arch/x86/include/asm/xen/pci.h linux-2.6.39.1/arch/x86/include/asm/xen/pci.h
12463 --- linux-2.6.39.1/arch/x86/include/asm/xen/pci.h 2011-05-19 00:06:34.000000000 -0400
12464 +++ linux-2.6.39.1/arch/x86/include/asm/xen/pci.h 2011-05-22 19:36:30.000000000 -0400
12465 @@ -33,7 +33,7 @@ struct xen_pci_frontend_ops {
12466 void (*disable_msix)(struct pci_dev *dev);
12467 };
12468
12469 -extern struct xen_pci_frontend_ops *xen_pci_frontend;
12470 +extern const struct xen_pci_frontend_ops *xen_pci_frontend;
12471
12472 static inline int xen_pci_frontend_enable_msi(struct pci_dev *dev,
12473 int vectors[])
12474 diff -urNp linux-2.6.39.1/arch/x86/include/asm/xsave.h linux-2.6.39.1/arch/x86/include/asm/xsave.h
12475 --- linux-2.6.39.1/arch/x86/include/asm/xsave.h 2011-05-19 00:06:34.000000000 -0400
12476 +++ linux-2.6.39.1/arch/x86/include/asm/xsave.h 2011-05-22 19:36:30.000000000 -0400
12477 @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
12478 {
12479 int err;
12480
12481 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12482 + if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
12483 + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
12484 +#endif
12485 +
12486 /*
12487 * Clear the xsave header first, so that reserved fields are
12488 * initialized to zero.
12489 @@ -100,6 +105,11 @@ static inline int xrestore_user(struct x
12490 u32 lmask = mask;
12491 u32 hmask = mask >> 32;
12492
12493 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12494 + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
12495 + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
12496 +#endif
12497 +
12498 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
12499 "2:\n"
12500 ".section .fixup,\"ax\"\n"
12501 diff -urNp linux-2.6.39.1/arch/x86/Kconfig linux-2.6.39.1/arch/x86/Kconfig
12502 --- linux-2.6.39.1/arch/x86/Kconfig 2011-05-19 00:06:34.000000000 -0400
12503 +++ linux-2.6.39.1/arch/x86/Kconfig 2011-05-22 19:41:32.000000000 -0400
12504 @@ -224,7 +224,7 @@ config X86_HT
12505
12506 config X86_32_LAZY_GS
12507 def_bool y
12508 - depends on X86_32 && !CC_STACKPROTECTOR
12509 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
12510
12511 config ARCH_HWEIGHT_CFLAGS
12512 string
12513 @@ -1022,7 +1022,7 @@ choice
12514
12515 config NOHIGHMEM
12516 bool "off"
12517 - depends on !X86_NUMAQ
12518 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12519 ---help---
12520 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
12521 However, the address space of 32-bit x86 processors is only 4
12522 @@ -1059,7 +1059,7 @@ config NOHIGHMEM
12523
12524 config HIGHMEM4G
12525 bool "4GB"
12526 - depends on !X86_NUMAQ
12527 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12528 ---help---
12529 Select this if you have a 32-bit processor and between 1 and 4
12530 gigabytes of physical RAM.
12531 @@ -1113,7 +1113,7 @@ config PAGE_OFFSET
12532 hex
12533 default 0xB0000000 if VMSPLIT_3G_OPT
12534 default 0x80000000 if VMSPLIT_2G
12535 - default 0x78000000 if VMSPLIT_2G_OPT
12536 + default 0x70000000 if VMSPLIT_2G_OPT
12537 default 0x40000000 if VMSPLIT_1G
12538 default 0xC0000000
12539 depends on X86_32
12540 @@ -1457,7 +1457,7 @@ config ARCH_USES_PG_UNCACHED
12541
12542 config EFI
12543 bool "EFI runtime service support"
12544 - depends on ACPI
12545 + depends on ACPI && !PAX_KERNEXEC
12546 ---help---
12547 This enables the kernel to use EFI runtime services that are
12548 available (such as the EFI variable services).
12549 @@ -1487,6 +1487,7 @@ config SECCOMP
12550
12551 config CC_STACKPROTECTOR
12552 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
12553 + depends on X86_64 || !PAX_MEMORY_UDEREF
12554 ---help---
12555 This option turns on the -fstack-protector GCC feature. This
12556 feature puts, at the beginning of functions, a canary value on
12557 @@ -1544,6 +1545,7 @@ config KEXEC_JUMP
12558 config PHYSICAL_START
12559 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
12560 default "0x1000000"
12561 + range 0x400000 0x40000000
12562 ---help---
12563 This gives the physical address where the kernel is loaded.
12564
12565 @@ -1607,6 +1609,7 @@ config X86_NEED_RELOCS
12566 config PHYSICAL_ALIGN
12567 hex "Alignment value to which kernel should be aligned" if X86_32
12568 default "0x1000000"
12569 + range 0x400000 0x1000000 if PAX_KERNEXEC
12570 range 0x2000 0x1000000
12571 ---help---
12572 This value puts the alignment restrictions on physical address
12573 @@ -1638,9 +1641,10 @@ config HOTPLUG_CPU
12574 Say N if you want to disable CPU hotplug.
12575
12576 config COMPAT_VDSO
12577 - def_bool y
12578 + def_bool n
12579 prompt "Compat VDSO support"
12580 depends on X86_32 || IA32_EMULATION
12581 + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
12582 ---help---
12583 Map the 32-bit VDSO to the predictable old-style address too.
12584
12585 diff -urNp linux-2.6.39.1/arch/x86/Kconfig.cpu linux-2.6.39.1/arch/x86/Kconfig.cpu
12586 --- linux-2.6.39.1/arch/x86/Kconfig.cpu 2011-05-19 00:06:34.000000000 -0400
12587 +++ linux-2.6.39.1/arch/x86/Kconfig.cpu 2011-05-22 19:36:30.000000000 -0400
12588 @@ -334,7 +334,7 @@ config X86_PPRO_FENCE
12589
12590 config X86_F00F_BUG
12591 def_bool y
12592 - depends on M586MMX || M586TSC || M586 || M486 || M386
12593 + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
12594
12595 config X86_INVD_BUG
12596 def_bool y
12597 @@ -358,7 +358,7 @@ config X86_POPAD_OK
12598
12599 config X86_ALIGNMENT_16
12600 def_bool y
12601 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12602 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12603
12604 config X86_INTEL_USERCOPY
12605 def_bool y
12606 @@ -404,7 +404,7 @@ config X86_CMPXCHG64
12607 # generates cmov.
12608 config X86_CMOV
12609 def_bool y
12610 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12611 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12612
12613 config X86_MINIMUM_CPU_FAMILY
12614 int
12615 diff -urNp linux-2.6.39.1/arch/x86/Kconfig.debug linux-2.6.39.1/arch/x86/Kconfig.debug
12616 --- linux-2.6.39.1/arch/x86/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
12617 +++ linux-2.6.39.1/arch/x86/Kconfig.debug 2011-05-22 19:36:30.000000000 -0400
12618 @@ -101,7 +101,7 @@ config X86_PTDUMP
12619 config DEBUG_RODATA
12620 bool "Write protect kernel read-only data structures"
12621 default y
12622 - depends on DEBUG_KERNEL
12623 + depends on DEBUG_KERNEL && BROKEN
12624 ---help---
12625 Mark the kernel read-only data as write-protected in the pagetables,
12626 in order to catch accidental (and incorrect) writes to such const
12627 @@ -119,7 +119,7 @@ config DEBUG_RODATA_TEST
12628
12629 config DEBUG_SET_MODULE_RONX
12630 bool "Set loadable kernel module data as NX and text as RO"
12631 - depends on MODULES
12632 + depends on MODULES && BROKEN
12633 ---help---
12634 This option helps catch unintended modifications to loadable
12635 kernel module's text and read-only data. It also prevents execution
12636 diff -urNp linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c
12637 --- linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c 2011-05-19 00:06:34.000000000 -0400
12638 +++ linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c 2011-05-22 19:36:30.000000000 -0400
12639 @@ -88,8 +88,12 @@ int acpi_suspend_lowlevel(void)
12640 header->trampoline_segment = trampoline_address() >> 4;
12641 #ifdef CONFIG_SMP
12642 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
12643 +
12644 + pax_open_kernel();
12645 early_gdt_descr.address =
12646 (unsigned long)get_cpu_gdt_table(smp_processor_id());
12647 + pax_close_kernel();
12648 +
12649 initial_gs = per_cpu_offset(smp_processor_id());
12650 #endif
12651 initial_code = (unsigned long)wakeup_long64;
12652 diff -urNp linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S
12653 --- linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S 2011-05-19 00:06:34.000000000 -0400
12654 +++ linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S 2011-05-22 19:36:30.000000000 -0400
12655 @@ -30,13 +30,11 @@ wakeup_pmode_return:
12656 # and restore the stack ... but you need gdt for this to work
12657 movl saved_context_esp, %esp
12658
12659 - movl %cs:saved_magic, %eax
12660 - cmpl $0x12345678, %eax
12661 + cmpl $0x12345678, saved_magic
12662 jne bogus_magic
12663
12664 # jump to place where we left off
12665 - movl saved_eip, %eax
12666 - jmp *%eax
12667 + jmp *(saved_eip)
12668
12669 bogus_magic:
12670 jmp bogus_magic
12671 diff -urNp linux-2.6.39.1/arch/x86/kernel/alternative.c linux-2.6.39.1/arch/x86/kernel/alternative.c
12672 --- linux-2.6.39.1/arch/x86/kernel/alternative.c 2011-05-19 00:06:34.000000000 -0400
12673 +++ linux-2.6.39.1/arch/x86/kernel/alternative.c 2011-05-22 19:36:30.000000000 -0400
12674 @@ -248,7 +248,7 @@ static void alternatives_smp_lock(const
12675 if (!*poff || ptr < text || ptr >= text_end)
12676 continue;
12677 /* turn DS segment override prefix into lock prefix */
12678 - if (*ptr == 0x3e)
12679 + if (*ktla_ktva(ptr) == 0x3e)
12680 text_poke(ptr, ((unsigned char []){0xf0}), 1);
12681 };
12682 mutex_unlock(&text_mutex);
12683 @@ -269,7 +269,7 @@ static void alternatives_smp_unlock(cons
12684 if (!*poff || ptr < text || ptr >= text_end)
12685 continue;
12686 /* turn lock prefix into DS segment override prefix */
12687 - if (*ptr == 0xf0)
12688 + if (*ktla_ktva(ptr) == 0xf0)
12689 text_poke(ptr, ((unsigned char []){0x3E}), 1);
12690 };
12691 mutex_unlock(&text_mutex);
12692 @@ -438,7 +438,7 @@ void __init_or_module apply_paravirt(str
12693
12694 BUG_ON(p->len > MAX_PATCH_LEN);
12695 /* prep the buffer with the original instructions */
12696 - memcpy(insnbuf, p->instr, p->len);
12697 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
12698 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
12699 (unsigned long)p->instr, p->len);
12700
12701 @@ -506,7 +506,7 @@ void __init alternative_instructions(voi
12702 if (smp_alt_once)
12703 free_init_pages("SMP alternatives",
12704 (unsigned long)__smp_locks,
12705 - (unsigned long)__smp_locks_end);
12706 + PAGE_ALIGN((unsigned long)__smp_locks_end));
12707
12708 restart_nmi();
12709 }
12710 @@ -523,13 +523,17 @@ void __init alternative_instructions(voi
12711 * instructions. And on the local CPU you need to be protected again NMI or MCE
12712 * handlers seeing an inconsistent instruction while you patch.
12713 */
12714 -void *__init_or_module text_poke_early(void *addr, const void *opcode,
12715 +void *__kprobes text_poke_early(void *addr, const void *opcode,
12716 size_t len)
12717 {
12718 unsigned long flags;
12719 local_irq_save(flags);
12720 - memcpy(addr, opcode, len);
12721 +
12722 + pax_open_kernel();
12723 + memcpy(ktla_ktva(addr), opcode, len);
12724 sync_core();
12725 + pax_close_kernel();
12726 +
12727 local_irq_restore(flags);
12728 /* Could also do a CLFLUSH here to speed up CPU recovery; but
12729 that causes hangs on some VIA CPUs. */
12730 @@ -551,36 +555,22 @@ void *__init_or_module text_poke_early(v
12731 */
12732 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
12733 {
12734 - unsigned long flags;
12735 - char *vaddr;
12736 + unsigned char *vaddr = ktla_ktva(addr);
12737 struct page *pages[2];
12738 - int i;
12739 + size_t i;
12740
12741 if (!core_kernel_text((unsigned long)addr)) {
12742 - pages[0] = vmalloc_to_page(addr);
12743 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
12744 + pages[0] = vmalloc_to_page(vaddr);
12745 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
12746 } else {
12747 - pages[0] = virt_to_page(addr);
12748 + pages[0] = virt_to_page(vaddr);
12749 WARN_ON(!PageReserved(pages[0]));
12750 - pages[1] = virt_to_page(addr + PAGE_SIZE);
12751 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
12752 }
12753 BUG_ON(!pages[0]);
12754 - local_irq_save(flags);
12755 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
12756 - if (pages[1])
12757 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
12758 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
12759 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
12760 - clear_fixmap(FIX_TEXT_POKE0);
12761 - if (pages[1])
12762 - clear_fixmap(FIX_TEXT_POKE1);
12763 - local_flush_tlb();
12764 - sync_core();
12765 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
12766 - that causes hangs on some VIA CPUs. */
12767 + text_poke_early(addr, opcode, len);
12768 for (i = 0; i < len; i++)
12769 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
12770 - local_irq_restore(flags);
12771 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
12772 return addr;
12773 }
12774
12775 @@ -682,9 +672,9 @@ void __kprobes text_poke_smp_batch(struc
12776 #if defined(CONFIG_DYNAMIC_FTRACE) || defined(HAVE_JUMP_LABEL)
12777
12778 #ifdef CONFIG_X86_64
12779 -unsigned char ideal_nop5[5] = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12780 +unsigned char ideal_nop5[5] __read_only = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12781 #else
12782 -unsigned char ideal_nop5[5] = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12783 +unsigned char ideal_nop5[5] __read_only = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12784 #endif
12785
12786 void __init arch_init_ideal_nop5(void)
12787 diff -urNp linux-2.6.39.1/arch/x86/kernel/amd_iommu.c linux-2.6.39.1/arch/x86/kernel/amd_iommu.c
12788 --- linux-2.6.39.1/arch/x86/kernel/amd_iommu.c 2011-05-19 00:06:34.000000000 -0400
12789 +++ linux-2.6.39.1/arch/x86/kernel/amd_iommu.c 2011-05-22 19:36:30.000000000 -0400
12790 @@ -48,7 +48,7 @@ static DEFINE_SPINLOCK(iommu_pd_list_loc
12791 */
12792 static struct protection_domain *pt_domain;
12793
12794 -static struct iommu_ops amd_iommu_ops;
12795 +static const struct iommu_ops amd_iommu_ops;
12796
12797 /*
12798 * general struct to manage commands send to an IOMMU
12799 @@ -2286,7 +2286,7 @@ static void prealloc_protection_domains(
12800 }
12801 }
12802
12803 -static struct dma_map_ops amd_iommu_dma_ops = {
12804 +static const struct dma_map_ops amd_iommu_dma_ops = {
12805 .alloc_coherent = alloc_coherent,
12806 .free_coherent = free_coherent,
12807 .map_page = map_page,
12808 @@ -2582,7 +2582,7 @@ static int amd_iommu_domain_has_cap(stru
12809 return 0;
12810 }
12811
12812 -static struct iommu_ops amd_iommu_ops = {
12813 +static const struct iommu_ops amd_iommu_ops = {
12814 .domain_init = amd_iommu_domain_init,
12815 .domain_destroy = amd_iommu_domain_destroy,
12816 .attach_dev = amd_iommu_attach_device,
12817 diff -urNp linux-2.6.39.1/arch/x86/kernel/apic/apic.c linux-2.6.39.1/arch/x86/kernel/apic/apic.c
12818 --- linux-2.6.39.1/arch/x86/kernel/apic/apic.c 2011-05-19 00:06:34.000000000 -0400
12819 +++ linux-2.6.39.1/arch/x86/kernel/apic/apic.c 2011-05-22 19:36:30.000000000 -0400
12820 @@ -1821,7 +1821,7 @@ void smp_error_interrupt(struct pt_regs
12821 apic_write(APIC_ESR, 0);
12822 v1 = apic_read(APIC_ESR);
12823 ack_APIC_irq();
12824 - atomic_inc(&irq_err_count);
12825 + atomic_inc_unchecked(&irq_err_count);
12826
12827 /*
12828 * Here is what the APIC error bits mean:
12829 @@ -2204,6 +2204,8 @@ static int __cpuinit apic_cluster_num(vo
12830 u16 *bios_cpu_apicid;
12831 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
12832
12833 + pax_track_stack();
12834 +
12835 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
12836 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
12837
12838 diff -urNp linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c
12839 --- linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c 2011-06-03 00:04:13.000000000 -0400
12840 +++ linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c 2011-06-03 00:42:37.000000000 -0400
12841 @@ -623,7 +623,7 @@ struct IO_APIC_route_entry **alloc_ioapi
12842 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
12843 GFP_ATOMIC);
12844 if (!ioapic_entries)
12845 - return 0;
12846 + return NULL;
12847
12848 for (apic = 0; apic < nr_ioapics; apic++) {
12849 ioapic_entries[apic] =
12850 @@ -640,7 +640,7 @@ nomem:
12851 kfree(ioapic_entries[apic]);
12852 kfree(ioapic_entries);
12853
12854 - return 0;
12855 + return NULL;
12856 }
12857
12858 /*
12859 @@ -1040,7 +1040,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
12860 }
12861 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
12862
12863 -void lock_vector_lock(void)
12864 +void lock_vector_lock(void) __acquires(vector_lock)
12865 {
12866 /* Used to the online set of cpus does not change
12867 * during assign_irq_vector.
12868 @@ -1048,7 +1048,7 @@ void lock_vector_lock(void)
12869 raw_spin_lock(&vector_lock);
12870 }
12871
12872 -void unlock_vector_lock(void)
12873 +void unlock_vector_lock(void) __releases(vector_lock)
12874 {
12875 raw_spin_unlock(&vector_lock);
12876 }
12877 @@ -2379,7 +2379,7 @@ static void ack_apic_edge(struct irq_dat
12878 ack_APIC_irq();
12879 }
12880
12881 -atomic_t irq_mis_count;
12882 +atomic_unchecked_t irq_mis_count;
12883
12884 /*
12885 * IO-APIC versions below 0x20 don't support EOI register.
12886 @@ -2487,7 +2487,7 @@ static void ack_apic_level(struct irq_da
12887 * at the cpu.
12888 */
12889 if (!(v & (1 << (i & 0x1f)))) {
12890 - atomic_inc(&irq_mis_count);
12891 + atomic_inc_unchecked(&irq_mis_count);
12892
12893 eoi_ioapic_irq(irq, cfg);
12894 }
12895 diff -urNp linux-2.6.39.1/arch/x86/kernel/apm_32.c linux-2.6.39.1/arch/x86/kernel/apm_32.c
12896 --- linux-2.6.39.1/arch/x86/kernel/apm_32.c 2011-05-19 00:06:34.000000000 -0400
12897 +++ linux-2.6.39.1/arch/x86/kernel/apm_32.c 2011-05-22 19:36:30.000000000 -0400
12898 @@ -412,7 +412,7 @@ static DEFINE_MUTEX(apm_mutex);
12899 * This is for buggy BIOS's that refer to (real mode) segment 0x40
12900 * even though they are called in protected mode.
12901 */
12902 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
12903 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
12904 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
12905
12906 static const char driver_version[] = "1.16ac"; /* no spaces */
12907 @@ -590,7 +590,10 @@ static long __apm_bios_call(void *_call)
12908 BUG_ON(cpu != 0);
12909 gdt = get_cpu_gdt_table(cpu);
12910 save_desc_40 = gdt[0x40 / 8];
12911 +
12912 + pax_open_kernel();
12913 gdt[0x40 / 8] = bad_bios_desc;
12914 + pax_close_kernel();
12915
12916 apm_irq_save(flags);
12917 APM_DO_SAVE_SEGS;
12918 @@ -599,7 +602,11 @@ static long __apm_bios_call(void *_call)
12919 &call->esi);
12920 APM_DO_RESTORE_SEGS;
12921 apm_irq_restore(flags);
12922 +
12923 + pax_open_kernel();
12924 gdt[0x40 / 8] = save_desc_40;
12925 + pax_close_kernel();
12926 +
12927 put_cpu();
12928
12929 return call->eax & 0xff;
12930 @@ -666,7 +673,10 @@ static long __apm_bios_call_simple(void
12931 BUG_ON(cpu != 0);
12932 gdt = get_cpu_gdt_table(cpu);
12933 save_desc_40 = gdt[0x40 / 8];
12934 +
12935 + pax_open_kernel();
12936 gdt[0x40 / 8] = bad_bios_desc;
12937 + pax_close_kernel();
12938
12939 apm_irq_save(flags);
12940 APM_DO_SAVE_SEGS;
12941 @@ -674,7 +684,11 @@ static long __apm_bios_call_simple(void
12942 &call->eax);
12943 APM_DO_RESTORE_SEGS;
12944 apm_irq_restore(flags);
12945 +
12946 + pax_open_kernel();
12947 gdt[0x40 / 8] = save_desc_40;
12948 + pax_close_kernel();
12949 +
12950 put_cpu();
12951 return error;
12952 }
12953 @@ -2351,12 +2365,15 @@ static int __init apm_init(void)
12954 * code to that CPU.
12955 */
12956 gdt = get_cpu_gdt_table(0);
12957 +
12958 + pax_open_kernel();
12959 set_desc_base(&gdt[APM_CS >> 3],
12960 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
12961 set_desc_base(&gdt[APM_CS_16 >> 3],
12962 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
12963 set_desc_base(&gdt[APM_DS >> 3],
12964 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
12965 + pax_close_kernel();
12966
12967 proc_create("apm", 0, NULL, &apm_file_ops);
12968
12969 diff -urNp linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c
12970 --- linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c 2011-05-19 00:06:34.000000000 -0400
12971 +++ linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c 2011-05-22 19:36:30.000000000 -0400
12972 @@ -69,6 +69,7 @@ int main(void)
12973 BLANK();
12974 #undef ENTRY
12975
12976 + DEFINE(TSS_size, sizeof(struct tss_struct));
12977 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
12978 BLANK();
12979
12980 diff -urNp linux-2.6.39.1/arch/x86/kernel/asm-offsets.c linux-2.6.39.1/arch/x86/kernel/asm-offsets.c
12981 --- linux-2.6.39.1/arch/x86/kernel/asm-offsets.c 2011-05-19 00:06:34.000000000 -0400
12982 +++ linux-2.6.39.1/arch/x86/kernel/asm-offsets.c 2011-05-25 17:35:48.000000000 -0400
12983 @@ -33,6 +33,8 @@ void common(void) {
12984 OFFSET(TI_status, thread_info, status);
12985 OFFSET(TI_addr_limit, thread_info, addr_limit);
12986 OFFSET(TI_preempt_count, thread_info, preempt_count);
12987 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
12988 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12989
12990 BLANK();
12991 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
12992 @@ -53,8 +55,26 @@ void common(void) {
12993 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12994 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12995 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
12996 +
12997 +#ifdef CONFIG_PAX_KERNEXEC
12998 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12999 +#endif
13000 +
13001 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13002 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
13003 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
13004 +#ifdef CONFIG_X86_64
13005 + OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
13006 +#endif
13007 #endif
13008
13009 +#endif
13010 +
13011 + BLANK();
13012 + DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
13013 + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
13014 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
13015 +
13016 #ifdef CONFIG_XEN
13017 BLANK();
13018 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
13019 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/amd.c linux-2.6.39.1/arch/x86/kernel/cpu/amd.c
13020 --- linux-2.6.39.1/arch/x86/kernel/cpu/amd.c 2011-06-03 00:04:13.000000000 -0400
13021 +++ linux-2.6.39.1/arch/x86/kernel/cpu/amd.c 2011-06-03 00:32:04.000000000 -0400
13022 @@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_c
13023 unsigned int size)
13024 {
13025 /* AMD errata T13 (order #21922) */
13026 - if ((c->x86 == 6)) {
13027 + if (c->x86 == 6) {
13028 /* Duron Rev A0 */
13029 if (c->x86_model == 3 && c->x86_mask == 0)
13030 size = 64;
13031 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/common.c linux-2.6.39.1/arch/x86/kernel/cpu/common.c
13032 --- linux-2.6.39.1/arch/x86/kernel/cpu/common.c 2011-06-03 00:04:13.000000000 -0400
13033 +++ linux-2.6.39.1/arch/x86/kernel/cpu/common.c 2011-06-03 00:32:04.000000000 -0400
13034 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
13035
13036 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
13037
13038 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
13039 -#ifdef CONFIG_X86_64
13040 - /*
13041 - * We need valid kernel segments for data and code in long mode too
13042 - * IRET will check the segment types kkeil 2000/10/28
13043 - * Also sysret mandates a special GDT layout
13044 - *
13045 - * TLS descriptors are currently at a different place compared to i386.
13046 - * Hopefully nobody expects them at a fixed place (Wine?)
13047 - */
13048 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
13049 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
13050 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
13051 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
13052 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
13053 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
13054 -#else
13055 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
13056 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
13057 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
13058 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
13059 - /*
13060 - * Segments used for calling PnP BIOS have byte granularity.
13061 - * They code segments and data segments have fixed 64k limits,
13062 - * the transfer segment sizes are set at run time.
13063 - */
13064 - /* 32-bit code */
13065 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
13066 - /* 16-bit code */
13067 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
13068 - /* 16-bit data */
13069 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
13070 - /* 16-bit data */
13071 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
13072 - /* 16-bit data */
13073 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
13074 - /*
13075 - * The APM segments have byte granularity and their bases
13076 - * are set at run time. All have 64k limits.
13077 - */
13078 - /* 32-bit code */
13079 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
13080 - /* 16-bit code */
13081 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
13082 - /* data */
13083 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
13084 -
13085 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
13086 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
13087 - GDT_STACK_CANARY_INIT
13088 -#endif
13089 -} };
13090 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
13091 -
13092 static int __init x86_xsave_setup(char *s)
13093 {
13094 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
13095 @@ -352,7 +298,7 @@ void switch_to_new_gdt(int cpu)
13096 {
13097 struct desc_ptr gdt_descr;
13098
13099 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
13100 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
13101 gdt_descr.size = GDT_SIZE - 1;
13102 load_gdt(&gdt_descr);
13103 /* Reload the per-cpu base */
13104 @@ -824,6 +770,10 @@ static void __cpuinit identify_cpu(struc
13105 /* Filter out anything that depends on CPUID levels we don't have */
13106 filter_cpuid_features(c, true);
13107
13108 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
13109 + setup_clear_cpu_cap(X86_FEATURE_SEP);
13110 +#endif
13111 +
13112 /* If the model name is still unset, do table lookup. */
13113 if (!c->x86_model_id[0]) {
13114 const char *p;
13115 @@ -1003,6 +953,9 @@ static __init int setup_disablecpuid(cha
13116 }
13117 __setup("clearcpuid=", setup_disablecpuid);
13118
13119 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
13120 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
13121 +
13122 #ifdef CONFIG_X86_64
13123 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
13124
13125 @@ -1018,7 +971,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
13126 EXPORT_PER_CPU_SYMBOL(current_task);
13127
13128 DEFINE_PER_CPU(unsigned long, kernel_stack) =
13129 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
13130 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
13131 EXPORT_PER_CPU_SYMBOL(kernel_stack);
13132
13133 DEFINE_PER_CPU(char *, irq_stack_ptr) =
13134 @@ -1083,7 +1036,7 @@ struct pt_regs * __cpuinit idle_regs(str
13135 {
13136 memset(regs, 0, sizeof(struct pt_regs));
13137 regs->fs = __KERNEL_PERCPU;
13138 - regs->gs = __KERNEL_STACK_CANARY;
13139 + savesegment(gs, regs->gs);
13140
13141 return regs;
13142 }
13143 @@ -1138,7 +1091,7 @@ void __cpuinit cpu_init(void)
13144 int i;
13145
13146 cpu = stack_smp_processor_id();
13147 - t = &per_cpu(init_tss, cpu);
13148 + t = init_tss + cpu;
13149 oist = &per_cpu(orig_ist, cpu);
13150
13151 #ifdef CONFIG_NUMA
13152 @@ -1164,7 +1117,7 @@ void __cpuinit cpu_init(void)
13153 switch_to_new_gdt(cpu);
13154 loadsegment(fs, 0);
13155
13156 - load_idt((const struct desc_ptr *)&idt_descr);
13157 + load_idt(&idt_descr);
13158
13159 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
13160 syscall_init();
13161 @@ -1173,7 +1126,6 @@ void __cpuinit cpu_init(void)
13162 wrmsrl(MSR_KERNEL_GS_BASE, 0);
13163 barrier();
13164
13165 - x86_configure_nx();
13166 if (cpu != 0)
13167 enable_x2apic();
13168
13169 @@ -1227,7 +1179,7 @@ void __cpuinit cpu_init(void)
13170 {
13171 int cpu = smp_processor_id();
13172 struct task_struct *curr = current;
13173 - struct tss_struct *t = &per_cpu(init_tss, cpu);
13174 + struct tss_struct *t = init_tss + cpu;
13175 struct thread_struct *thread = &curr->thread;
13176
13177 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
13178 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/intel.c linux-2.6.39.1/arch/x86/kernel/cpu/intel.c
13179 --- linux-2.6.39.1/arch/x86/kernel/cpu/intel.c 2011-05-19 00:06:34.000000000 -0400
13180 +++ linux-2.6.39.1/arch/x86/kernel/cpu/intel.c 2011-05-22 19:36:30.000000000 -0400
13181 @@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
13182 * Update the IDT descriptor and reload the IDT so that
13183 * it uses the read-only mapped virtual address.
13184 */
13185 - idt_descr.address = fix_to_virt(FIX_F00F_IDT);
13186 + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
13187 load_idt(&idt_descr);
13188 }
13189 #endif
13190 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/Makefile linux-2.6.39.1/arch/x86/kernel/cpu/Makefile
13191 --- linux-2.6.39.1/arch/x86/kernel/cpu/Makefile 2011-05-19 00:06:34.000000000 -0400
13192 +++ linux-2.6.39.1/arch/x86/kernel/cpu/Makefile 2011-05-22 19:36:30.000000000 -0400
13193 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
13194 CFLAGS_REMOVE_perf_event.o = -pg
13195 endif
13196
13197 -# Make sure load_percpu_segment has no stackprotector
13198 -nostackp := $(call cc-option, -fno-stack-protector)
13199 -CFLAGS_common.o := $(nostackp)
13200 -
13201 obj-y := intel_cacheinfo.o scattered.o topology.o
13202 obj-y += proc.o capflags.o powerflags.o common.o
13203 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
13204 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c
13205 --- linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-19 00:06:34.000000000 -0400
13206 +++ linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-22 19:36:30.000000000 -0400
13207 @@ -46,6 +46,7 @@
13208 #include <asm/ipi.h>
13209 #include <asm/mce.h>
13210 #include <asm/msr.h>
13211 +#include <asm/local.h>
13212
13213 #include "mce-internal.h"
13214
13215 @@ -220,7 +221,7 @@ static void print_mce(struct mce *m)
13216 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
13217 m->cs, m->ip);
13218
13219 - if (m->cs == __KERNEL_CS)
13220 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
13221 print_symbol("{%s}", m->ip);
13222 pr_cont("\n");
13223 }
13224 @@ -244,10 +245,10 @@ static void print_mce(struct mce *m)
13225
13226 #define PANIC_TIMEOUT 5 /* 5 seconds */
13227
13228 -static atomic_t mce_paniced;
13229 +static atomic_unchecked_t mce_paniced;
13230
13231 static int fake_panic;
13232 -static atomic_t mce_fake_paniced;
13233 +static atomic_unchecked_t mce_fake_paniced;
13234
13235 /* Panic in progress. Enable interrupts and wait for final IPI */
13236 static void wait_for_panic(void)
13237 @@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct
13238 /*
13239 * Make sure only one CPU runs in machine check panic
13240 */
13241 - if (atomic_inc_return(&mce_paniced) > 1)
13242 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
13243 wait_for_panic();
13244 barrier();
13245
13246 @@ -279,7 +280,7 @@ static void mce_panic(char *msg, struct
13247 console_verbose();
13248 } else {
13249 /* Don't log too much for fake panic */
13250 - if (atomic_inc_return(&mce_fake_paniced) > 1)
13251 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
13252 return;
13253 }
13254 /* First print corrected ones that are still unlogged */
13255 @@ -647,7 +648,7 @@ static int mce_timed_out(u64 *t)
13256 * might have been modified by someone else.
13257 */
13258 rmb();
13259 - if (atomic_read(&mce_paniced))
13260 + if (atomic_read_unchecked(&mce_paniced))
13261 wait_for_panic();
13262 if (!monarch_timeout)
13263 goto out;
13264 @@ -1461,14 +1462,14 @@ void __cpuinit mcheck_cpu_init(struct cp
13265 */
13266
13267 static DEFINE_SPINLOCK(mce_state_lock);
13268 -static int open_count; /* #times opened */
13269 +static local_t open_count; /* #times opened */
13270 static int open_exclu; /* already open exclusive? */
13271
13272 static int mce_open(struct inode *inode, struct file *file)
13273 {
13274 spin_lock(&mce_state_lock);
13275
13276 - if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
13277 + if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
13278 spin_unlock(&mce_state_lock);
13279
13280 return -EBUSY;
13281 @@ -1476,7 +1477,7 @@ static int mce_open(struct inode *inode,
13282
13283 if (file->f_flags & O_EXCL)
13284 open_exclu = 1;
13285 - open_count++;
13286 + local_inc(&open_count);
13287
13288 spin_unlock(&mce_state_lock);
13289
13290 @@ -1487,7 +1488,7 @@ static int mce_release(struct inode *ino
13291 {
13292 spin_lock(&mce_state_lock);
13293
13294 - open_count--;
13295 + local_dec(&open_count);
13296 open_exclu = 0;
13297
13298 spin_unlock(&mce_state_lock);
13299 @@ -2174,7 +2175,7 @@ struct dentry *mce_get_debugfs_dir(void)
13300 static void mce_reset(void)
13301 {
13302 cpu_missing = 0;
13303 - atomic_set(&mce_fake_paniced, 0);
13304 + atomic_set_unchecked(&mce_fake_paniced, 0);
13305 atomic_set(&mce_executing, 0);
13306 atomic_set(&mce_callin, 0);
13307 atomic_set(&global_nwo, 0);
13308 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c
13309 --- linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c 2011-05-19 00:06:34.000000000 -0400
13310 +++ linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c 2011-05-22 19:36:30.000000000 -0400
13311 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
13312 u64 size_or_mask, size_and_mask;
13313 static bool mtrr_aps_delayed_init;
13314
13315 -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
13316 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
13317
13318 const struct mtrr_ops *mtrr_if;
13319
13320 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h
13321 --- linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-19 00:06:34.000000000 -0400
13322 +++ linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-22 19:36:30.000000000 -0400
13323 @@ -12,19 +12,19 @@
13324 extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
13325
13326 struct mtrr_ops {
13327 - u32 vendor;
13328 - u32 use_intel_if;
13329 - void (*set)(unsigned int reg, unsigned long base,
13330 + const u32 vendor;
13331 + const u32 use_intel_if;
13332 + void (* const set)(unsigned int reg, unsigned long base,
13333 unsigned long size, mtrr_type type);
13334 - void (*set_all)(void);
13335 + void (* const set_all)(void);
13336
13337 - void (*get)(unsigned int reg, unsigned long *base,
13338 + void (* const get)(unsigned int reg, unsigned long *base,
13339 unsigned long *size, mtrr_type *type);
13340 - int (*get_free_region)(unsigned long base, unsigned long size,
13341 + int (* const get_free_region)(unsigned long base, unsigned long size,
13342 int replace_reg);
13343 - int (*validate_add_page)(unsigned long base, unsigned long size,
13344 + int (* const validate_add_page)(unsigned long base, unsigned long size,
13345 unsigned int type);
13346 - int (*have_wrcomb)(void);
13347 + int (* const have_wrcomb)(void);
13348 };
13349
13350 extern int generic_get_free_region(unsigned long base, unsigned long size,
13351 diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c
13352 --- linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c 2011-05-19 00:06:34.000000000 -0400
13353 +++ linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c 2011-05-22 19:36:30.000000000 -0400
13354 @@ -774,6 +774,8 @@ static int x86_schedule_events(struct cp
13355 int i, j, w, wmax, num = 0;
13356 struct hw_perf_event *hwc;
13357
13358 + pax_track_stack();
13359 +
13360 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
13361
13362 for (i = 0; i < n; i++) {
13363 @@ -1878,7 +1880,7 @@ perf_callchain_user(struct perf_callchai
13364 break;
13365
13366 perf_callchain_store(entry, frame.return_address);
13367 - fp = frame.next_frame;
13368 + fp = (__force const void __user *)frame.next_frame;
13369 }
13370 }
13371
13372 diff -urNp linux-2.6.39.1/arch/x86/kernel/crash.c linux-2.6.39.1/arch/x86/kernel/crash.c
13373 --- linux-2.6.39.1/arch/x86/kernel/crash.c 2011-05-19 00:06:34.000000000 -0400
13374 +++ linux-2.6.39.1/arch/x86/kernel/crash.c 2011-05-22 19:36:30.000000000 -0400
13375 @@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu,
13376 regs = args->regs;
13377
13378 #ifdef CONFIG_X86_32
13379 - if (!user_mode_vm(regs)) {
13380 + if (!user_mode(regs)) {
13381 crash_fixup_ss_esp(&fixed_regs, regs);
13382 regs = &fixed_regs;
13383 }
13384 diff -urNp linux-2.6.39.1/arch/x86/kernel/doublefault_32.c linux-2.6.39.1/arch/x86/kernel/doublefault_32.c
13385 --- linux-2.6.39.1/arch/x86/kernel/doublefault_32.c 2011-05-19 00:06:34.000000000 -0400
13386 +++ linux-2.6.39.1/arch/x86/kernel/doublefault_32.c 2011-05-22 19:36:30.000000000 -0400
13387 @@ -11,7 +11,7 @@
13388
13389 #define DOUBLEFAULT_STACKSIZE (1024)
13390 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
13391 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
13392 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
13393
13394 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
13395
13396 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
13397 unsigned long gdt, tss;
13398
13399 store_gdt(&gdt_desc);
13400 - gdt = gdt_desc.address;
13401 + gdt = (unsigned long)gdt_desc.address;
13402
13403 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
13404
13405 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
13406 /* 0x2 bit is always set */
13407 .flags = X86_EFLAGS_SF | 0x2,
13408 .sp = STACK_START,
13409 - .es = __USER_DS,
13410 + .es = __KERNEL_DS,
13411 .cs = __KERNEL_CS,
13412 .ss = __KERNEL_DS,
13413 - .ds = __USER_DS,
13414 + .ds = __KERNEL_DS,
13415 .fs = __KERNEL_PERCPU,
13416
13417 .__cr3 = __pa_nodebug(swapper_pg_dir),
13418 diff -urNp linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c
13419 --- linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c 2011-05-19 00:06:34.000000000 -0400
13420 +++ linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c 2011-05-22 19:36:30.000000000 -0400
13421 @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task
13422 bp = stack_frame(task, regs);
13423
13424 for (;;) {
13425 - struct thread_info *context;
13426 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13427
13428 - context = (struct thread_info *)
13429 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
13430 - bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
13431 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13432
13433 - stack = (unsigned long *)context->previous_esp;
13434 - if (!stack)
13435 + if (stack_start == task_stack_page(task))
13436 break;
13437 + stack = *(unsigned long **)stack_start;
13438 if (ops->stack(data, "IRQ") < 0)
13439 break;
13440 touch_nmi_watchdog();
13441 @@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs
13442 * When in-kernel, we also print out the stack and code at the
13443 * time of the fault..
13444 */
13445 - if (!user_mode_vm(regs)) {
13446 + if (!user_mode(regs)) {
13447 unsigned int code_prologue = code_bytes * 43 / 64;
13448 unsigned int code_len = code_bytes;
13449 unsigned char c;
13450 u8 *ip;
13451 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
13452
13453 printk(KERN_EMERG "Stack:\n");
13454 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
13455
13456 printk(KERN_EMERG "Code: ");
13457
13458 - ip = (u8 *)regs->ip - code_prologue;
13459 + ip = (u8 *)regs->ip - code_prologue + cs_base;
13460 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
13461 /* try starting at IP */
13462 - ip = (u8 *)regs->ip;
13463 + ip = (u8 *)regs->ip + cs_base;
13464 code_len = code_len - code_prologue + 1;
13465 }
13466 for (i = 0; i < code_len; i++, ip++) {
13467 @@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs
13468 printk(" Bad EIP value.");
13469 break;
13470 }
13471 - if (ip == (u8 *)regs->ip)
13472 + if (ip == (u8 *)regs->ip + cs_base)
13473 printk("<%02x> ", c);
13474 else
13475 printk("%02x ", c);
13476 @@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
13477 {
13478 unsigned short ud2;
13479
13480 + ip = ktla_ktva(ip);
13481 if (ip < PAGE_OFFSET)
13482 return 0;
13483 if (probe_kernel_address((unsigned short *)ip, ud2))
13484 diff -urNp linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c
13485 --- linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c 2011-05-19 00:06:34.000000000 -0400
13486 +++ linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c 2011-05-22 19:36:30.000000000 -0400
13487 @@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task
13488 unsigned long *irq_stack_end =
13489 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
13490 unsigned used = 0;
13491 - struct thread_info *tinfo;
13492 int graph = 0;
13493 unsigned long dummy;
13494 + void *stack_start;
13495
13496 if (!task)
13497 task = current;
13498 @@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
13499 * current stack address. If the stacks consist of nested
13500 * exceptions
13501 */
13502 - tinfo = task_thread_info(task);
13503 for (;;) {
13504 char *id;
13505 unsigned long *estack_end;
13506 +
13507 estack_end = in_exception_stack(cpu, (unsigned long)stack,
13508 &used, &id);
13509
13510 @@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
13511 if (ops->stack(data, id) < 0)
13512 break;
13513
13514 - bp = ops->walk_stack(tinfo, stack, bp, ops,
13515 + bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
13516 data, estack_end, &graph);
13517 ops->stack(data, "<EOE>");
13518 /*
13519 @@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
13520 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
13521 if (ops->stack(data, "IRQ") < 0)
13522 break;
13523 - bp = ops->walk_stack(tinfo, stack, bp,
13524 + bp = ops->walk_stack(task, irq_stack, stack, bp,
13525 ops, data, irq_stack_end, &graph);
13526 /*
13527 * We link to the next stack (which would be
13528 @@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
13529 /*
13530 * This handles the process stack:
13531 */
13532 - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
13533 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13534 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13535 put_cpu();
13536 }
13537 EXPORT_SYMBOL(dump_trace);
13538 diff -urNp linux-2.6.39.1/arch/x86/kernel/dumpstack.c linux-2.6.39.1/arch/x86/kernel/dumpstack.c
13539 --- linux-2.6.39.1/arch/x86/kernel/dumpstack.c 2011-05-19 00:06:34.000000000 -0400
13540 +++ linux-2.6.39.1/arch/x86/kernel/dumpstack.c 2011-05-22 19:41:32.000000000 -0400
13541 @@ -2,6 +2,9 @@
13542 * Copyright (C) 1991, 1992 Linus Torvalds
13543 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
13544 */
13545 +#ifdef CONFIG_GRKERNSEC_HIDESYM
13546 +#define __INCLUDED_BY_HIDESYM 1
13547 +#endif
13548 #include <linux/kallsyms.h>
13549 #include <linux/kprobes.h>
13550 #include <linux/uaccess.h>
13551 @@ -35,9 +38,8 @@ void printk_address(unsigned long addres
13552 static void
13553 print_ftrace_graph_addr(unsigned long addr, void *data,
13554 const struct stacktrace_ops *ops,
13555 - struct thread_info *tinfo, int *graph)
13556 + struct task_struct *task, int *graph)
13557 {
13558 - struct task_struct *task = tinfo->task;
13559 unsigned long ret_addr;
13560 int index = task->curr_ret_stack;
13561
13562 @@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
13563 static inline void
13564 print_ftrace_graph_addr(unsigned long addr, void *data,
13565 const struct stacktrace_ops *ops,
13566 - struct thread_info *tinfo, int *graph)
13567 + struct task_struct *task, int *graph)
13568 { }
13569 #endif
13570
13571 @@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
13572 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
13573 */
13574
13575 -static inline int valid_stack_ptr(struct thread_info *tinfo,
13576 - void *p, unsigned int size, void *end)
13577 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
13578 {
13579 - void *t = tinfo;
13580 if (end) {
13581 if (p < end && p >= (end-THREAD_SIZE))
13582 return 1;
13583 @@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
13584 }
13585
13586 unsigned long
13587 -print_context_stack(struct thread_info *tinfo,
13588 +print_context_stack(struct task_struct *task, void *stack_start,
13589 unsigned long *stack, unsigned long bp,
13590 const struct stacktrace_ops *ops, void *data,
13591 unsigned long *end, int *graph)
13592 {
13593 struct stack_frame *frame = (struct stack_frame *)bp;
13594
13595 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
13596 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
13597 unsigned long addr;
13598
13599 addr = *stack;
13600 @@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
13601 } else {
13602 ops->address(data, addr, 0);
13603 }
13604 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13605 + print_ftrace_graph_addr(addr, data, ops, task, graph);
13606 }
13607 stack++;
13608 }
13609 @@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
13610 EXPORT_SYMBOL_GPL(print_context_stack);
13611
13612 unsigned long
13613 -print_context_stack_bp(struct thread_info *tinfo,
13614 +print_context_stack_bp(struct task_struct *task, void *stack_start,
13615 unsigned long *stack, unsigned long bp,
13616 const struct stacktrace_ops *ops, void *data,
13617 unsigned long *end, int *graph)
13618 @@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
13619 struct stack_frame *frame = (struct stack_frame *)bp;
13620 unsigned long *ret_addr = &frame->return_address;
13621
13622 - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
13623 + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
13624 unsigned long addr = *ret_addr;
13625
13626 if (!__kernel_text_address(addr))
13627 @@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
13628 ops->address(data, addr, 1);
13629 frame = frame->next_frame;
13630 ret_addr = &frame->return_address;
13631 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13632 + print_ftrace_graph_addr(addr, data, ops, task, graph);
13633 }
13634
13635 return (unsigned long)frame;
13636 @@ -202,7 +202,7 @@ void dump_stack(void)
13637
13638 bp = stack_frame(current, NULL);
13639 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
13640 - current->pid, current->comm, print_tainted(),
13641 + task_pid_nr(current), current->comm, print_tainted(),
13642 init_utsname()->release,
13643 (int)strcspn(init_utsname()->version, " "),
13644 init_utsname()->version);
13645 @@ -238,6 +238,8 @@ unsigned __kprobes long oops_begin(void)
13646 }
13647 EXPORT_SYMBOL_GPL(oops_begin);
13648
13649 +extern void gr_handle_kernel_exploit(void);
13650 +
13651 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13652 {
13653 if (regs && kexec_should_crash(current))
13654 @@ -259,7 +261,10 @@ void __kprobes oops_end(unsigned long fl
13655 panic("Fatal exception in interrupt");
13656 if (panic_on_oops)
13657 panic("Fatal exception");
13658 - do_exit(signr);
13659 +
13660 + gr_handle_kernel_exploit();
13661 +
13662 + do_group_exit(signr);
13663 }
13664
13665 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
13666 @@ -286,7 +291,7 @@ int __kprobes __die(const char *str, str
13667
13668 show_registers(regs);
13669 #ifdef CONFIG_X86_32
13670 - if (user_mode_vm(regs)) {
13671 + if (user_mode(regs)) {
13672 sp = regs->sp;
13673 ss = regs->ss & 0xffff;
13674 } else {
13675 @@ -314,7 +319,7 @@ void die(const char *str, struct pt_regs
13676 unsigned long flags = oops_begin();
13677 int sig = SIGSEGV;
13678
13679 - if (!user_mode_vm(regs))
13680 + if (!user_mode(regs))
13681 report_bug(regs->ip, regs);
13682
13683 if (__die(str, regs, err))
13684 diff -urNp linux-2.6.39.1/arch/x86/kernel/early_printk.c linux-2.6.39.1/arch/x86/kernel/early_printk.c
13685 --- linux-2.6.39.1/arch/x86/kernel/early_printk.c 2011-05-19 00:06:34.000000000 -0400
13686 +++ linux-2.6.39.1/arch/x86/kernel/early_printk.c 2011-05-22 19:36:30.000000000 -0400
13687 @@ -7,6 +7,7 @@
13688 #include <linux/pci_regs.h>
13689 #include <linux/pci_ids.h>
13690 #include <linux/errno.h>
13691 +#include <linux/sched.h>
13692 #include <asm/io.h>
13693 #include <asm/processor.h>
13694 #include <asm/fcntl.h>
13695 @@ -179,6 +180,8 @@ asmlinkage void early_printk(const char
13696 int n;
13697 va_list ap;
13698
13699 + pax_track_stack();
13700 +
13701 va_start(ap, fmt);
13702 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13703 early_console->write(early_console, buf, n);
13704 diff -urNp linux-2.6.39.1/arch/x86/kernel/entry_32.S linux-2.6.39.1/arch/x86/kernel/entry_32.S
13705 --- linux-2.6.39.1/arch/x86/kernel/entry_32.S 2011-05-19 00:06:34.000000000 -0400
13706 +++ linux-2.6.39.1/arch/x86/kernel/entry_32.S 2011-05-23 17:07:00.000000000 -0400
13707 @@ -185,13 +185,146 @@
13708 /*CFI_REL_OFFSET gs, PT_GS*/
13709 .endm
13710 .macro SET_KERNEL_GS reg
13711 +
13712 +#ifdef CONFIG_CC_STACKPROTECTOR
13713 movl $(__KERNEL_STACK_CANARY), \reg
13714 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13715 + movl $(__USER_DS), \reg
13716 +#else
13717 + xorl \reg, \reg
13718 +#endif
13719 +
13720 movl \reg, %gs
13721 .endm
13722
13723 #endif /* CONFIG_X86_32_LAZY_GS */
13724
13725 -.macro SAVE_ALL
13726 +.macro pax_enter_kernel
13727 +#ifdef CONFIG_PAX_KERNEXEC
13728 + call pax_enter_kernel
13729 +#endif
13730 +.endm
13731 +
13732 +.macro pax_exit_kernel
13733 +#ifdef CONFIG_PAX_KERNEXEC
13734 + call pax_exit_kernel
13735 +#endif
13736 +.endm
13737 +
13738 +#ifdef CONFIG_PAX_KERNEXEC
13739 +ENTRY(pax_enter_kernel)
13740 +#ifdef CONFIG_PARAVIRT
13741 + pushl %eax
13742 + pushl %ecx
13743 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13744 + mov %eax, %esi
13745 +#else
13746 + mov %cr0, %esi
13747 +#endif
13748 + bts $16, %esi
13749 + jnc 1f
13750 + mov %cs, %esi
13751 + cmp $__KERNEL_CS, %esi
13752 + jz 3f
13753 + ljmp $__KERNEL_CS, $3f
13754 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13755 +2:
13756 +#ifdef CONFIG_PARAVIRT
13757 + mov %esi, %eax
13758 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13759 +#else
13760 + mov %esi, %cr0
13761 +#endif
13762 +3:
13763 +#ifdef CONFIG_PARAVIRT
13764 + popl %ecx
13765 + popl %eax
13766 +#endif
13767 + ret
13768 +ENDPROC(pax_enter_kernel)
13769 +
13770 +ENTRY(pax_exit_kernel)
13771 +#ifdef CONFIG_PARAVIRT
13772 + pushl %eax
13773 + pushl %ecx
13774 +#endif
13775 + mov %cs, %esi
13776 + cmp $__KERNEXEC_KERNEL_CS, %esi
13777 + jnz 2f
13778 +#ifdef CONFIG_PARAVIRT
13779 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13780 + mov %eax, %esi
13781 +#else
13782 + mov %cr0, %esi
13783 +#endif
13784 + btr $16, %esi
13785 + ljmp $__KERNEL_CS, $1f
13786 +1:
13787 +#ifdef CONFIG_PARAVIRT
13788 + mov %esi, %eax
13789 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13790 +#else
13791 + mov %esi, %cr0
13792 +#endif
13793 +2:
13794 +#ifdef CONFIG_PARAVIRT
13795 + popl %ecx
13796 + popl %eax
13797 +#endif
13798 + ret
13799 +ENDPROC(pax_exit_kernel)
13800 +#endif
13801 +
13802 +.macro pax_erase_kstack
13803 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13804 + call pax_erase_kstack
13805 +#endif
13806 +.endm
13807 +
13808 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13809 +/*
13810 + * ebp: thread_info
13811 + * ecx, edx: can be clobbered
13812 + */
13813 +ENTRY(pax_erase_kstack)
13814 + pushl %edi
13815 + pushl %eax
13816 +
13817 + mov TI_lowest_stack(%ebp), %edi
13818 + mov $-0xBEEF, %eax
13819 + std
13820 +
13821 +1: mov %edi, %ecx
13822 + and $THREAD_SIZE_asm - 1, %ecx
13823 + shr $2, %ecx
13824 + repne scasl
13825 + jecxz 2f
13826 +
13827 + cmp $2*16, %ecx
13828 + jc 2f
13829 +
13830 + mov $2*16, %ecx
13831 + repe scasl
13832 + jecxz 2f
13833 + jne 1b
13834 +
13835 +2: cld
13836 + mov %esp, %ecx
13837 + sub %edi, %ecx
13838 + shr $2, %ecx
13839 + rep stosl
13840 +
13841 + mov TI_task_thread_sp0(%ebp), %edi
13842 + sub $128, %edi
13843 + mov %edi, TI_lowest_stack(%ebp)
13844 +
13845 + popl %eax
13846 + popl %edi
13847 + ret
13848 +ENDPROC(pax_erase_kstack)
13849 +#endif
13850 +
13851 +.macro __SAVE_ALL _DS
13852 cld
13853 PUSH_GS
13854 pushl_cfi %fs
13855 @@ -214,7 +347,7 @@
13856 CFI_REL_OFFSET ecx, 0
13857 pushl_cfi %ebx
13858 CFI_REL_OFFSET ebx, 0
13859 - movl $(__USER_DS), %edx
13860 + movl $\_DS, %edx
13861 movl %edx, %ds
13862 movl %edx, %es
13863 movl $(__KERNEL_PERCPU), %edx
13864 @@ -222,6 +355,15 @@
13865 SET_KERNEL_GS %edx
13866 .endm
13867
13868 +.macro SAVE_ALL
13869 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
13870 + __SAVE_ALL __KERNEL_DS
13871 + pax_enter_kernel
13872 +#else
13873 + __SAVE_ALL __USER_DS
13874 +#endif
13875 +.endm
13876 +
13877 .macro RESTORE_INT_REGS
13878 popl_cfi %ebx
13879 CFI_RESTORE ebx
13880 @@ -332,7 +474,15 @@ check_userspace:
13881 movb PT_CS(%esp), %al
13882 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
13883 cmpl $USER_RPL, %eax
13884 +
13885 +#ifdef CONFIG_PAX_KERNEXEC
13886 + jae resume_userspace
13887 +
13888 + PAX_EXIT_KERNEL
13889 + jmp resume_kernel
13890 +#else
13891 jb resume_kernel # not returning to v8086 or userspace
13892 +#endif
13893
13894 ENTRY(resume_userspace)
13895 LOCKDEP_SYS_EXIT
13896 @@ -344,7 +494,7 @@ ENTRY(resume_userspace)
13897 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
13898 # int/exception return?
13899 jne work_pending
13900 - jmp restore_all
13901 + jmp restore_all_pax
13902 END(ret_from_exception)
13903
13904 #ifdef CONFIG_PREEMPT
13905 @@ -394,23 +544,34 @@ sysenter_past_esp:
13906 /*CFI_REL_OFFSET cs, 0*/
13907 /*
13908 * Push current_thread_info()->sysenter_return to the stack.
13909 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
13910 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
13911 */
13912 - pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
13913 + pushl_cfi $0
13914 CFI_REL_OFFSET eip, 0
13915
13916 pushl_cfi %eax
13917 SAVE_ALL
13918 + GET_THREAD_INFO(%ebp)
13919 + movl TI_sysenter_return(%ebp),%ebp
13920 + movl %ebp,PT_EIP(%esp)
13921 ENABLE_INTERRUPTS(CLBR_NONE)
13922
13923 /*
13924 * Load the potential sixth argument from user stack.
13925 * Careful about security.
13926 */
13927 + movl PT_OLDESP(%esp),%ebp
13928 +
13929 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13930 + mov PT_OLDSS(%esp),%ds
13931 +1: movl %ds:(%ebp),%ebp
13932 + push %ss
13933 + pop %ds
13934 +#else
13935 cmpl $__PAGE_OFFSET-3,%ebp
13936 jae syscall_fault
13937 1: movl (%ebp),%ebp
13938 +#endif
13939 +
13940 movl %ebp,PT_EBP(%esp)
13941 .section __ex_table,"a"
13942 .align 4
13943 @@ -433,12 +594,23 @@ sysenter_do_call:
13944 testl $_TIF_ALLWORK_MASK, %ecx
13945 jne sysexit_audit
13946 sysenter_exit:
13947 +
13948 +#ifdef CONFIG_PAX_RANDKSTACK
13949 + pushl_cfi %eax
13950 + call pax_randomize_kstack
13951 + popl_cfi %eax
13952 +#endif
13953 +
13954 + pax_erase_kstack
13955 +
13956 /* if something modifies registers it must also disable sysexit */
13957 movl PT_EIP(%esp), %edx
13958 movl PT_OLDESP(%esp), %ecx
13959 xorl %ebp,%ebp
13960 TRACE_IRQS_ON
13961 1: mov PT_FS(%esp), %fs
13962 +2: mov PT_DS(%esp), %ds
13963 +3: mov PT_ES(%esp), %es
13964 PTGS_TO_GS
13965 ENABLE_INTERRUPTS_SYSEXIT
13966
13967 @@ -455,6 +627,9 @@ sysenter_audit:
13968 movl %eax,%edx /* 2nd arg: syscall number */
13969 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
13970 call audit_syscall_entry
13971 +
13972 + pax_erase_kstack
13973 +
13974 pushl_cfi %ebx
13975 movl PT_EAX(%esp),%eax /* reload syscall number */
13976 jmp sysenter_do_call
13977 @@ -481,11 +656,17 @@ sysexit_audit:
13978
13979 CFI_ENDPROC
13980 .pushsection .fixup,"ax"
13981 -2: movl $0,PT_FS(%esp)
13982 +4: movl $0,PT_FS(%esp)
13983 + jmp 1b
13984 +5: movl $0,PT_DS(%esp)
13985 + jmp 1b
13986 +6: movl $0,PT_ES(%esp)
13987 jmp 1b
13988 .section __ex_table,"a"
13989 .align 4
13990 - .long 1b,2b
13991 + .long 1b,4b
13992 + .long 2b,5b
13993 + .long 3b,6b
13994 .popsection
13995 PTGS_TO_GS_EX
13996 ENDPROC(ia32_sysenter_target)
13997 @@ -518,6 +699,14 @@ syscall_exit:
13998 testl $_TIF_ALLWORK_MASK, %ecx # current->work
13999 jne syscall_exit_work
14000
14001 +restore_all_pax:
14002 +
14003 +#ifdef CONFIG_PAX_RANDKSTACK
14004 + call pax_randomize_kstack
14005 +#endif
14006 +
14007 + pax_erase_kstack
14008 +
14009 restore_all:
14010 TRACE_IRQS_IRET
14011 restore_all_notrace:
14012 @@ -577,14 +766,21 @@ ldt_ss:
14013 * compensating for the offset by changing to the ESPFIX segment with
14014 * a base address that matches for the difference.
14015 */
14016 -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
14017 +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
14018 mov %esp, %edx /* load kernel esp */
14019 mov PT_OLDESP(%esp), %eax /* load userspace esp */
14020 mov %dx, %ax /* eax: new kernel esp */
14021 sub %eax, %edx /* offset (low word is 0) */
14022 +#ifdef CONFIG_SMP
14023 + movl PER_CPU_VAR(cpu_number), %ebx
14024 + shll $PAGE_SHIFT_asm, %ebx
14025 + addl $cpu_gdt_table, %ebx
14026 +#else
14027 + movl $cpu_gdt_table, %ebx
14028 +#endif
14029 shr $16, %edx
14030 - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
14031 - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
14032 + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
14033 + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
14034 pushl_cfi $__ESPFIX_SS
14035 pushl_cfi %eax /* new kernel esp */
14036 /* Disable interrupts, but do not irqtrace this section: we
14037 @@ -613,29 +809,23 @@ work_resched:
14038 movl TI_flags(%ebp), %ecx
14039 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
14040 # than syscall tracing?
14041 - jz restore_all
14042 + jz restore_all_pax
14043 testb $_TIF_NEED_RESCHED, %cl
14044 jnz work_resched
14045
14046 work_notifysig: # deal with pending signals and
14047 # notify-resume requests
14048 + movl %esp, %eax
14049 #ifdef CONFIG_VM86
14050 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
14051 - movl %esp, %eax
14052 - jne work_notifysig_v86 # returning to kernel-space or
14053 + jz 1f # returning to kernel-space or
14054 # vm86-space
14055 - xorl %edx, %edx
14056 - call do_notify_resume
14057 - jmp resume_userspace_sig
14058
14059 - ALIGN
14060 -work_notifysig_v86:
14061 pushl_cfi %ecx # save ti_flags for do_notify_resume
14062 call save_v86_state # %eax contains pt_regs pointer
14063 popl_cfi %ecx
14064 movl %eax, %esp
14065 -#else
14066 - movl %esp, %eax
14067 +1:
14068 #endif
14069 xorl %edx, %edx
14070 call do_notify_resume
14071 @@ -648,6 +838,9 @@ syscall_trace_entry:
14072 movl $-ENOSYS,PT_EAX(%esp)
14073 movl %esp, %eax
14074 call syscall_trace_enter
14075 +
14076 + pax_erase_kstack
14077 +
14078 /* What it returned is what we'll actually use. */
14079 cmpl $(nr_syscalls), %eax
14080 jnae syscall_call
14081 @@ -670,6 +863,10 @@ END(syscall_exit_work)
14082
14083 RING0_INT_FRAME # can't unwind into user space anyway
14084 syscall_fault:
14085 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14086 + push %ss
14087 + pop %ds
14088 +#endif
14089 GET_THREAD_INFO(%ebp)
14090 movl $-EFAULT,PT_EAX(%esp)
14091 jmp resume_userspace
14092 @@ -752,6 +949,36 @@ ptregs_clone:
14093 CFI_ENDPROC
14094 ENDPROC(ptregs_clone)
14095
14096 + ALIGN;
14097 +ENTRY(kernel_execve)
14098 + CFI_STARTPROC
14099 + pushl_cfi %ebp
14100 + sub $PT_OLDSS+4,%esp
14101 + pushl_cfi %edi
14102 + pushl_cfi %ecx
14103 + pushl_cfi %eax
14104 + lea 3*4(%esp),%edi
14105 + mov $PT_OLDSS/4+1,%ecx
14106 + xorl %eax,%eax
14107 + rep stosl
14108 + popl_cfi %eax
14109 + popl_cfi %ecx
14110 + popl_cfi %edi
14111 + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
14112 + pushl_cfi %esp
14113 + call sys_execve
14114 + add $4,%esp
14115 + CFI_ADJUST_CFA_OFFSET -4
14116 + GET_THREAD_INFO(%ebp)
14117 + test %eax,%eax
14118 + jz syscall_exit
14119 + add $PT_OLDSS+4,%esp
14120 + CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
14121 + popl_cfi %ebp
14122 + ret
14123 + CFI_ENDPROC
14124 +ENDPROC(kernel_execve)
14125 +
14126 .macro FIXUP_ESPFIX_STACK
14127 /*
14128 * Switch back for ESPFIX stack to the normal zerobased stack
14129 @@ -761,8 +988,15 @@ ENDPROC(ptregs_clone)
14130 * normal stack and adjusts ESP with the matching offset.
14131 */
14132 /* fixup the stack */
14133 - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
14134 - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
14135 +#ifdef CONFIG_SMP
14136 + movl PER_CPU_VAR(cpu_number), %ebx
14137 + shll $PAGE_SHIFT_asm, %ebx
14138 + addl $cpu_gdt_table, %ebx
14139 +#else
14140 + movl $cpu_gdt_table, %ebx
14141 +#endif
14142 + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
14143 + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
14144 shl $16, %eax
14145 addl %esp, %eax /* the adjusted stack pointer */
14146 pushl_cfi $__KERNEL_DS
14147 @@ -1213,7 +1447,6 @@ return_to_handler:
14148 jmp *%ecx
14149 #endif
14150
14151 -.section .rodata,"a"
14152 #include "syscall_table_32.S"
14153
14154 syscall_table_size=(.-sys_call_table)
14155 @@ -1259,9 +1492,12 @@ error_code:
14156 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
14157 REG_TO_PTGS %ecx
14158 SET_KERNEL_GS %ecx
14159 - movl $(__USER_DS), %ecx
14160 + movl $(__KERNEL_DS), %ecx
14161 movl %ecx, %ds
14162 movl %ecx, %es
14163 +
14164 + pax_enter_kernel
14165 +
14166 TRACE_IRQS_OFF
14167 movl %esp,%eax # pt_regs pointer
14168 call *%edi
14169 @@ -1346,6 +1582,9 @@ nmi_stack_correct:
14170 xorl %edx,%edx # zero error code
14171 movl %esp,%eax # pt_regs pointer
14172 call do_nmi
14173 +
14174 + pax_exit_kernel
14175 +
14176 jmp restore_all_notrace
14177 CFI_ENDPROC
14178
14179 @@ -1382,6 +1621,9 @@ nmi_espfix_stack:
14180 FIXUP_ESPFIX_STACK # %eax == %esp
14181 xorl %edx,%edx # zero error code
14182 call do_nmi
14183 +
14184 + pax_exit_kernel
14185 +
14186 RESTORE_REGS
14187 lss 12+4(%esp), %esp # back to espfix stack
14188 CFI_ADJUST_CFA_OFFSET -24
14189 diff -urNp linux-2.6.39.1/arch/x86/kernel/entry_64.S linux-2.6.39.1/arch/x86/kernel/entry_64.S
14190 --- linux-2.6.39.1/arch/x86/kernel/entry_64.S 2011-05-19 00:06:34.000000000 -0400
14191 +++ linux-2.6.39.1/arch/x86/kernel/entry_64.S 2011-05-23 17:10:49.000000000 -0400
14192 @@ -53,6 +53,7 @@
14193 #include <asm/paravirt.h>
14194 #include <asm/ftrace.h>
14195 #include <asm/percpu.h>
14196 +#include <asm/pgtable.h>
14197
14198 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14199 #include <linux/elf-em.h>
14200 @@ -176,6 +177,259 @@ ENTRY(native_usergs_sysret64)
14201 ENDPROC(native_usergs_sysret64)
14202 #endif /* CONFIG_PARAVIRT */
14203
14204 + .macro ljmpq sel, off
14205 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
14206 + .byte 0x48; ljmp *1234f(%rip)
14207 + .pushsection .rodata
14208 + .align 16
14209 + 1234: .quad \off; .word \sel
14210 + .popsection
14211 +#else
14212 + pushq $\sel
14213 + pushq $\off
14214 + lretq
14215 +#endif
14216 + .endm
14217 +
14218 + .macro pax_enter_kernel
14219 +#ifdef CONFIG_PAX_KERNEXEC
14220 + call pax_enter_kernel
14221 +#endif
14222 + .endm
14223 +
14224 + .macro pax_exit_kernel
14225 +#ifdef CONFIG_PAX_KERNEXEC
14226 + call pax_exit_kernel
14227 +#endif
14228 + .endm
14229 +
14230 +#ifdef CONFIG_PAX_KERNEXEC
14231 +ENTRY(pax_enter_kernel)
14232 + pushq %rdi
14233 +
14234 +#ifdef CONFIG_PARAVIRT
14235 + PV_SAVE_REGS(CLBR_RDI)
14236 +#endif
14237 +
14238 + GET_CR0_INTO_RDI
14239 + bts $16,%rdi
14240 + jnc 1f
14241 + mov %cs,%edi
14242 + cmp $__KERNEL_CS,%edi
14243 + jz 3f
14244 + ljmpq __KERNEL_CS,3f
14245 +1: ljmpq __KERNEXEC_KERNEL_CS,2f
14246 +2: SET_RDI_INTO_CR0
14247 +3:
14248 +
14249 +#ifdef CONFIG_PARAVIRT
14250 + PV_RESTORE_REGS(CLBR_RDI)
14251 +#endif
14252 +
14253 + popq %rdi
14254 + retq
14255 +ENDPROC(pax_enter_kernel)
14256 +
14257 +ENTRY(pax_exit_kernel)
14258 + pushq %rdi
14259 +
14260 +#ifdef CONFIG_PARAVIRT
14261 + PV_SAVE_REGS(CLBR_RDI)
14262 +#endif
14263 +
14264 + mov %cs,%rdi
14265 + cmp $__KERNEXEC_KERNEL_CS,%edi
14266 + jnz 2f
14267 + GET_CR0_INTO_RDI
14268 + btr $16,%rdi
14269 + ljmpq __KERNEL_CS,1f
14270 +1: SET_RDI_INTO_CR0
14271 +2:
14272 +
14273 +#ifdef CONFIG_PARAVIRT
14274 + PV_RESTORE_REGS(CLBR_RDI);
14275 +#endif
14276 +
14277 + popq %rdi
14278 + retq
14279 +ENDPROC(pax_exit_kernel)
14280 +#endif
14281 +
14282 + .macro pax_enter_kernel_user
14283 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14284 + call pax_enter_kernel_user
14285 +#endif
14286 + .endm
14287 +
14288 + .macro pax_exit_kernel_user
14289 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14290 + call pax_exit_kernel_user
14291 +#endif
14292 +#ifdef CONFIG_PAX_RANDKSTACK
14293 + push %rax
14294 + call pax_randomize_kstack
14295 + pop %rax
14296 +#endif
14297 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14298 + call pax_erase_kstack
14299 +#endif
14300 + .endm
14301 +
14302 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14303 +ENTRY(pax_enter_kernel_user)
14304 + pushq %rdi
14305 + pushq %rbx
14306 +
14307 +#ifdef CONFIG_PARAVIRT
14308 + PV_SAVE_REGS(CLBR_RDI)
14309 +#endif
14310 +
14311 + GET_CR3_INTO_RDI
14312 + mov %rdi,%rbx
14313 + add $__START_KERNEL_map,%rbx
14314 + sub phys_base(%rip),%rbx
14315 +
14316 +#ifdef CONFIG_PARAVIRT
14317 + pushq %rdi
14318 + cmpl $0, pv_info+PARAVIRT_enabled
14319 + jz 1f
14320 + i = 0
14321 + .rept USER_PGD_PTRS
14322 + mov i*8(%rbx),%rsi
14323 + mov $0,%sil
14324 + lea i*8(%rbx),%rdi
14325 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14326 + i = i + 1
14327 + .endr
14328 + jmp 2f
14329 +1:
14330 +#endif
14331 +
14332 + i = 0
14333 + .rept USER_PGD_PTRS
14334 + movb $0,i*8(%rbx)
14335 + i = i + 1
14336 + .endr
14337 +
14338 +#ifdef CONFIG_PARAVIRT
14339 +2: popq %rdi
14340 +#endif
14341 + SET_RDI_INTO_CR3
14342 +
14343 +#ifdef CONFIG_PAX_KERNEXEC
14344 + GET_CR0_INTO_RDI
14345 + bts $16,%rdi
14346 + SET_RDI_INTO_CR0
14347 +#endif
14348 +
14349 +#ifdef CONFIG_PARAVIRT
14350 + PV_RESTORE_REGS(CLBR_RDI)
14351 +#endif
14352 +
14353 + popq %rbx
14354 + popq %rdi
14355 + retq
14356 +ENDPROC(pax_enter_kernel_user)
14357 +
14358 +ENTRY(pax_exit_kernel_user)
14359 + push %rdi
14360 +
14361 +#ifdef CONFIG_PARAVIRT
14362 + pushq %rbx
14363 + PV_SAVE_REGS(CLBR_RDI)
14364 +#endif
14365 +
14366 +#ifdef CONFIG_PAX_KERNEXEC
14367 + GET_CR0_INTO_RDI
14368 + btr $16,%rdi
14369 + SET_RDI_INTO_CR0
14370 +#endif
14371 +
14372 + GET_CR3_INTO_RDI
14373 + add $__START_KERNEL_map,%rdi
14374 + sub phys_base(%rip),%rdi
14375 +
14376 +#ifdef CONFIG_PARAVIRT
14377 + cmpl $0, pv_info+PARAVIRT_enabled
14378 + jz 1f
14379 + mov %rdi,%rbx
14380 + i = 0
14381 + .rept USER_PGD_PTRS
14382 + mov i*8(%rbx),%rsi
14383 + mov $0x67,%sil
14384 + lea i*8(%rbx),%rdi
14385 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14386 + i = i + 1
14387 + .endr
14388 + jmp 2f
14389 +1:
14390 +#endif
14391 +
14392 + i = 0
14393 + .rept USER_PGD_PTRS
14394 + movb $0x67,i*8(%rdi)
14395 + i = i + 1
14396 + .endr
14397 +
14398 +#ifdef CONFIG_PARAVIRT
14399 +2: PV_RESTORE_REGS(CLBR_RDI)
14400 + popq %rbx
14401 +#endif
14402 +
14403 + popq %rdi
14404 + retq
14405 +ENDPROC(pax_exit_kernel_user)
14406 +#endif
14407 +
14408 + .macro pax_erase_kstack
14409 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14410 + call pax_erase_kstack
14411 +#endif
14412 + .endm
14413 +
14414 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14415 +/*
14416 + * r10: thread_info
14417 + * rcx, rdx: can be clobbered
14418 + */
14419 +ENTRY(pax_erase_kstack)
14420 + pushq %rdi
14421 + pushq %rax
14422 +
14423 + GET_THREAD_INFO(%r10)
14424 + mov TI_lowest_stack(%r10), %rdi
14425 + mov $-0xBEEF, %rax
14426 + std
14427 +
14428 +1: mov %edi, %ecx
14429 + and $THREAD_SIZE_asm - 1, %ecx
14430 + shr $3, %ecx
14431 + repne scasq
14432 + jecxz 2f
14433 +
14434 + cmp $2*8, %ecx
14435 + jc 2f
14436 +
14437 + mov $2*8, %ecx
14438 + repe scasq
14439 + jecxz 2f
14440 + jne 1b
14441 +
14442 +2: cld
14443 + mov %esp, %ecx
14444 + sub %edi, %ecx
14445 + shr $3, %ecx
14446 + rep stosq
14447 +
14448 + mov TI_task_thread_sp0(%r10), %rdi
14449 + sub $256, %rdi
14450 + mov %rdi, TI_lowest_stack(%r10)
14451 +
14452 + popq %rax
14453 + popq %rdi
14454 + ret
14455 +ENDPROC(pax_erase_kstack)
14456 +#endif
14457
14458 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14459 #ifdef CONFIG_TRACE_IRQFLAGS
14460 @@ -318,7 +572,7 @@ ENTRY(save_args)
14461 leaq -RBP+8(%rsp),%rdi /* arg1 for handler */
14462 movq_cfi rbp, 8 /* push %rbp */
14463 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14464 - testl $3, CS(%rdi)
14465 + testb $3, CS(%rdi)
14466 je 1f
14467 SWAPGS
14468 /*
14469 @@ -409,7 +663,7 @@ ENTRY(ret_from_fork)
14470
14471 RESTORE_REST
14472
14473 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14474 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14475 je int_ret_from_sys_call
14476
14477 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
14478 @@ -455,7 +709,7 @@ END(ret_from_fork)
14479 ENTRY(system_call)
14480 CFI_STARTPROC simple
14481 CFI_SIGNAL_FRAME
14482 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14483 + CFI_DEF_CFA rsp,0
14484 CFI_REGISTER rip,rcx
14485 /*CFI_REGISTER rflags,r11*/
14486 SWAPGS_UNSAFE_STACK
14487 @@ -468,12 +722,13 @@ ENTRY(system_call_after_swapgs)
14488
14489 movq %rsp,PER_CPU_VAR(old_rsp)
14490 movq PER_CPU_VAR(kernel_stack),%rsp
14491 + pax_enter_kernel_user
14492 /*
14493 * No need to follow this irqs off/on section - it's straight
14494 * and short:
14495 */
14496 ENABLE_INTERRUPTS(CLBR_NONE)
14497 - SAVE_ARGS 8,1
14498 + SAVE_ARGS 8*6,1
14499 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14500 movq %rcx,RIP-ARGOFFSET(%rsp)
14501 CFI_REL_OFFSET rip,RIP-ARGOFFSET
14502 @@ -502,6 +757,7 @@ sysret_check:
14503 andl %edi,%edx
14504 jnz sysret_careful
14505 CFI_REMEMBER_STATE
14506 + pax_exit_kernel_user
14507 /*
14508 * sysretq will re-enable interrupts:
14509 */
14510 @@ -560,6 +816,9 @@ auditsys:
14511 movq %rax,%rsi /* 2nd arg: syscall number */
14512 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14513 call audit_syscall_entry
14514 +
14515 + pax_erase_kstack
14516 +
14517 LOAD_ARGS 0 /* reload call-clobbered registers */
14518 jmp system_call_fastpath
14519
14520 @@ -590,6 +849,9 @@ tracesys:
14521 FIXUP_TOP_OF_STACK %rdi
14522 movq %rsp,%rdi
14523 call syscall_trace_enter
14524 +
14525 + pax_erase_kstack
14526 +
14527 /*
14528 * Reload arg registers from stack in case ptrace changed them.
14529 * We don't reload %rax because syscall_trace_enter() returned
14530 @@ -611,7 +873,7 @@ tracesys:
14531 GLOBAL(int_ret_from_sys_call)
14532 DISABLE_INTERRUPTS(CLBR_NONE)
14533 TRACE_IRQS_OFF
14534 - testl $3,CS-ARGOFFSET(%rsp)
14535 + testb $3,CS-ARGOFFSET(%rsp)
14536 je retint_restore_args
14537 movl $_TIF_ALLWORK_MASK,%edi
14538 /* edi: mask to check */
14539 @@ -793,6 +1055,16 @@ END(interrupt)
14540 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
14541 call save_args
14542 PARTIAL_FRAME 0
14543 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14544 + testb $3, CS(%rdi)
14545 + jnz 1f
14546 + pax_enter_kernel
14547 + jmp 2f
14548 +1: pax_enter_kernel_user
14549 +2:
14550 +#else
14551 + pax_enter_kernel
14552 +#endif
14553 call \func
14554 .endm
14555
14556 @@ -825,7 +1097,7 @@ ret_from_intr:
14557 CFI_ADJUST_CFA_OFFSET -8
14558 exit_intr:
14559 GET_THREAD_INFO(%rcx)
14560 - testl $3,CS-ARGOFFSET(%rsp)
14561 + testb $3,CS-ARGOFFSET(%rsp)
14562 je retint_kernel
14563
14564 /* Interrupt came from user space */
14565 @@ -847,12 +1119,14 @@ retint_swapgs: /* return to user-space
14566 * The iretq could re-enable interrupts:
14567 */
14568 DISABLE_INTERRUPTS(CLBR_ANY)
14569 + pax_exit_kernel_user
14570 TRACE_IRQS_IRETQ
14571 SWAPGS
14572 jmp restore_args
14573
14574 retint_restore_args: /* return to kernel space */
14575 DISABLE_INTERRUPTS(CLBR_ANY)
14576 + pax_exit_kernel
14577 /*
14578 * The iretq could re-enable interrupts:
14579 */
14580 @@ -1027,6 +1301,16 @@ ENTRY(\sym)
14581 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14582 call error_entry
14583 DEFAULT_FRAME 0
14584 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14585 + testb $3, CS(%rsp)
14586 + jnz 1f
14587 + pax_enter_kernel
14588 + jmp 2f
14589 +1: pax_enter_kernel_user
14590 +2:
14591 +#else
14592 + pax_enter_kernel
14593 +#endif
14594 movq %rsp,%rdi /* pt_regs pointer */
14595 xorl %esi,%esi /* no error code */
14596 call \do_sym
14597 @@ -1044,6 +1328,16 @@ ENTRY(\sym)
14598 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14599 call save_paranoid
14600 TRACE_IRQS_OFF
14601 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14602 + testb $3, CS(%rsp)
14603 + jnz 1f
14604 + pax_enter_kernel
14605 + jmp 2f
14606 +1: pax_enter_kernel_user
14607 +2:
14608 +#else
14609 + pax_enter_kernel
14610 +#endif
14611 movq %rsp,%rdi /* pt_regs pointer */
14612 xorl %esi,%esi /* no error code */
14613 call \do_sym
14614 @@ -1052,7 +1346,7 @@ ENTRY(\sym)
14615 END(\sym)
14616 .endm
14617
14618 -#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14619 +#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14620 .macro paranoidzeroentry_ist sym do_sym ist
14621 ENTRY(\sym)
14622 INTR_FRAME
14623 @@ -1062,8 +1356,24 @@ ENTRY(\sym)
14624 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14625 call save_paranoid
14626 TRACE_IRQS_OFF
14627 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14628 + testb $3, CS(%rsp)
14629 + jnz 1f
14630 + pax_enter_kernel
14631 + jmp 2f
14632 +1: pax_enter_kernel_user
14633 +2:
14634 +#else
14635 + pax_enter_kernel
14636 +#endif
14637 movq %rsp,%rdi /* pt_regs pointer */
14638 xorl %esi,%esi /* no error code */
14639 +#ifdef CONFIG_SMP
14640 + imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14641 + lea init_tss(%r12), %r12
14642 +#else
14643 + lea init_tss(%rip), %r12
14644 +#endif
14645 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14646 call \do_sym
14647 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14648 @@ -1080,6 +1390,16 @@ ENTRY(\sym)
14649 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14650 call error_entry
14651 DEFAULT_FRAME 0
14652 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14653 + testb $3, CS(%rsp)
14654 + jnz 1f
14655 + pax_enter_kernel
14656 + jmp 2f
14657 +1: pax_enter_kernel_user
14658 +2:
14659 +#else
14660 + pax_enter_kernel
14661 +#endif
14662 movq %rsp,%rdi /* pt_regs pointer */
14663 movq ORIG_RAX(%rsp),%rsi /* get error code */
14664 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14665 @@ -1099,6 +1419,16 @@ ENTRY(\sym)
14666 call save_paranoid
14667 DEFAULT_FRAME 0
14668 TRACE_IRQS_OFF
14669 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14670 + testb $3, CS(%rsp)
14671 + jnz 1f
14672 + pax_enter_kernel
14673 + jmp 2f
14674 +1: pax_enter_kernel_user
14675 +2:
14676 +#else
14677 + pax_enter_kernel
14678 +#endif
14679 movq %rsp,%rdi /* pt_regs pointer */
14680 movq ORIG_RAX(%rsp),%rsi /* get error code */
14681 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14682 @@ -1361,14 +1691,27 @@ ENTRY(paranoid_exit)
14683 TRACE_IRQS_OFF
14684 testl %ebx,%ebx /* swapgs needed? */
14685 jnz paranoid_restore
14686 - testl $3,CS(%rsp)
14687 + testb $3,CS(%rsp)
14688 jnz paranoid_userspace
14689 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14690 + pax_exit_kernel
14691 + TRACE_IRQS_IRETQ 0
14692 + SWAPGS_UNSAFE_STACK
14693 + RESTORE_ALL 8
14694 + jmp irq_return
14695 +#endif
14696 paranoid_swapgs:
14697 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14698 + pax_exit_kernel_user
14699 +#else
14700 + pax_exit_kernel
14701 +#endif
14702 TRACE_IRQS_IRETQ 0
14703 SWAPGS_UNSAFE_STACK
14704 RESTORE_ALL 8
14705 jmp irq_return
14706 paranoid_restore:
14707 + pax_exit_kernel
14708 TRACE_IRQS_IRETQ 0
14709 RESTORE_ALL 8
14710 jmp irq_return
14711 @@ -1426,7 +1769,7 @@ ENTRY(error_entry)
14712 movq_cfi r14, R14+8
14713 movq_cfi r15, R15+8
14714 xorl %ebx,%ebx
14715 - testl $3,CS+8(%rsp)
14716 + testb $3,CS+8(%rsp)
14717 je error_kernelspace
14718 error_swapgs:
14719 SWAPGS
14720 @@ -1490,6 +1833,16 @@ ENTRY(nmi)
14721 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14722 call save_paranoid
14723 DEFAULT_FRAME 0
14724 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14725 + testb $3, CS(%rsp)
14726 + jnz 1f
14727 + pax_enter_kernel
14728 + jmp 2f
14729 +1: pax_enter_kernel_user
14730 +2:
14731 +#else
14732 + pax_enter_kernel
14733 +#endif
14734 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14735 movq %rsp,%rdi
14736 movq $-1,%rsi
14737 @@ -1500,11 +1853,25 @@ ENTRY(nmi)
14738 DISABLE_INTERRUPTS(CLBR_NONE)
14739 testl %ebx,%ebx /* swapgs needed? */
14740 jnz nmi_restore
14741 - testl $3,CS(%rsp)
14742 + testb $3,CS(%rsp)
14743 jnz nmi_userspace
14744 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14745 + pax_exit_kernel
14746 + SWAPGS_UNSAFE_STACK
14747 + RESTORE_ALL 8
14748 + jmp irq_return
14749 +#endif
14750 nmi_swapgs:
14751 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14752 + pax_exit_kernel_user
14753 +#else
14754 + pax_exit_kernel
14755 +#endif
14756 SWAPGS_UNSAFE_STACK
14757 + RESTORE_ALL 8
14758 + jmp irq_return
14759 nmi_restore:
14760 + pax_exit_kernel
14761 RESTORE_ALL 8
14762 jmp irq_return
14763 nmi_userspace:
14764 diff -urNp linux-2.6.39.1/arch/x86/kernel/ftrace.c linux-2.6.39.1/arch/x86/kernel/ftrace.c
14765 --- linux-2.6.39.1/arch/x86/kernel/ftrace.c 2011-05-19 00:06:34.000000000 -0400
14766 +++ linux-2.6.39.1/arch/x86/kernel/ftrace.c 2011-05-22 19:36:30.000000000 -0400
14767 @@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the
14768 static void *mod_code_newcode; /* holds the text to write to the IP */
14769
14770 static unsigned nmi_wait_count;
14771 -static atomic_t nmi_update_count = ATOMIC_INIT(0);
14772 +static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14773
14774 int ftrace_arch_read_dyn_info(char *buf, int size)
14775 {
14776 @@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
14777
14778 r = snprintf(buf, size, "%u %u",
14779 nmi_wait_count,
14780 - atomic_read(&nmi_update_count));
14781 + atomic_read_unchecked(&nmi_update_count));
14782 return r;
14783 }
14784
14785 @@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14786
14787 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14788 smp_rmb();
14789 + pax_open_kernel();
14790 ftrace_mod_code();
14791 - atomic_inc(&nmi_update_count);
14792 + pax_close_kernel();
14793 + atomic_inc_unchecked(&nmi_update_count);
14794 }
14795 /* Must have previous changes seen before executions */
14796 smp_mb();
14797 @@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
14798 {
14799 unsigned char replaced[MCOUNT_INSN_SIZE];
14800
14801 + ip = ktla_ktva(ip);
14802 +
14803 /*
14804 * Note: Due to modules and __init, code can
14805 * disappear and change, we need to protect against faulting
14806 @@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun
14807 unsigned char old[MCOUNT_INSN_SIZE], *new;
14808 int ret;
14809
14810 - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14811 + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14812 new = ftrace_call_replace(ip, (unsigned long)func);
14813 ret = ftrace_modify_code(ip, old, new);
14814
14815 @@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long
14816 {
14817 unsigned char code[MCOUNT_INSN_SIZE];
14818
14819 + ip = ktla_ktva(ip);
14820 +
14821 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14822 return -EFAULT;
14823
14824 diff -urNp linux-2.6.39.1/arch/x86/kernel/head32.c linux-2.6.39.1/arch/x86/kernel/head32.c
14825 --- linux-2.6.39.1/arch/x86/kernel/head32.c 2011-05-19 00:06:34.000000000 -0400
14826 +++ linux-2.6.39.1/arch/x86/kernel/head32.c 2011-05-22 19:36:30.000000000 -0400
14827 @@ -19,6 +19,7 @@
14828 #include <asm/io_apic.h>
14829 #include <asm/bios_ebda.h>
14830 #include <asm/tlbflush.h>
14831 +#include <asm/boot.h>
14832
14833 static void __init i386_default_early_setup(void)
14834 {
14835 @@ -34,7 +35,7 @@ void __init i386_start_kernel(void)
14836 {
14837 memblock_init();
14838
14839 - memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14840 + memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14841
14842 #ifdef CONFIG_BLK_DEV_INITRD
14843 /* Reserve INITRD */
14844 diff -urNp linux-2.6.39.1/arch/x86/kernel/head_32.S linux-2.6.39.1/arch/x86/kernel/head_32.S
14845 --- linux-2.6.39.1/arch/x86/kernel/head_32.S 2011-05-19 00:06:34.000000000 -0400
14846 +++ linux-2.6.39.1/arch/x86/kernel/head_32.S 2011-05-22 19:36:30.000000000 -0400
14847 @@ -25,6 +25,12 @@
14848 /* Physical address */
14849 #define pa(X) ((X) - __PAGE_OFFSET)
14850
14851 +#ifdef CONFIG_PAX_KERNEXEC
14852 +#define ta(X) (X)
14853 +#else
14854 +#define ta(X) ((X) - __PAGE_OFFSET)
14855 +#endif
14856 +
14857 /*
14858 * References to members of the new_cpu_data structure.
14859 */
14860 @@ -54,11 +60,7 @@
14861 * and small than max_low_pfn, otherwise will waste some page table entries
14862 */
14863
14864 -#if PTRS_PER_PMD > 1
14865 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14866 -#else
14867 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14868 -#endif
14869 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14870
14871 /* Number of possible pages in the lowmem region */
14872 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14873 @@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
14874 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14875
14876 /*
14877 + * Real beginning of normal "text" segment
14878 + */
14879 +ENTRY(stext)
14880 +ENTRY(_stext)
14881 +
14882 +/*
14883 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14884 * %esi points to the real-mode code as a 32-bit pointer.
14885 * CS and DS must be 4 GB flat segments, but we don't depend on
14886 @@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14887 * can.
14888 */
14889 __HEAD
14890 +
14891 +#ifdef CONFIG_PAX_KERNEXEC
14892 + jmp startup_32
14893 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14894 +.fill PAGE_SIZE-5,1,0xcc
14895 +#endif
14896 +
14897 ENTRY(startup_32)
14898 movl pa(stack_start),%ecx
14899
14900 @@ -105,6 +120,57 @@ ENTRY(startup_32)
14901 2:
14902 leal -__PAGE_OFFSET(%ecx),%esp
14903
14904 +#ifdef CONFIG_SMP
14905 + movl $pa(cpu_gdt_table),%edi
14906 + movl $__per_cpu_load,%eax
14907 + movw %ax,__KERNEL_PERCPU + 2(%edi)
14908 + rorl $16,%eax
14909 + movb %al,__KERNEL_PERCPU + 4(%edi)
14910 + movb %ah,__KERNEL_PERCPU + 7(%edi)
14911 + movl $__per_cpu_end - 1,%eax
14912 + subl $__per_cpu_start,%eax
14913 + movw %ax,__KERNEL_PERCPU + 0(%edi)
14914 +#endif
14915 +
14916 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14917 + movl $NR_CPUS,%ecx
14918 + movl $pa(cpu_gdt_table),%edi
14919 +1:
14920 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14921 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14922 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14923 + addl $PAGE_SIZE_asm,%edi
14924 + loop 1b
14925 +#endif
14926 +
14927 +#ifdef CONFIG_PAX_KERNEXEC
14928 + movl $pa(boot_gdt),%edi
14929 + movl $__LOAD_PHYSICAL_ADDR,%eax
14930 + movw %ax,__BOOT_CS + 2(%edi)
14931 + rorl $16,%eax
14932 + movb %al,__BOOT_CS + 4(%edi)
14933 + movb %ah,__BOOT_CS + 7(%edi)
14934 + rorl $16,%eax
14935 +
14936 + ljmp $(__BOOT_CS),$1f
14937 +1:
14938 +
14939 + movl $NR_CPUS,%ecx
14940 + movl $pa(cpu_gdt_table),%edi
14941 + addl $__PAGE_OFFSET,%eax
14942 +1:
14943 + movw %ax,__KERNEL_CS + 2(%edi)
14944 + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14945 + rorl $16,%eax
14946 + movb %al,__KERNEL_CS + 4(%edi)
14947 + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14948 + movb %ah,__KERNEL_CS + 7(%edi)
14949 + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14950 + rorl $16,%eax
14951 + addl $PAGE_SIZE_asm,%edi
14952 + loop 1b
14953 +#endif
14954 +
14955 /*
14956 * Clear BSS first so that there are no surprises...
14957 */
14958 @@ -195,8 +261,11 @@ ENTRY(startup_32)
14959 movl %eax, pa(max_pfn_mapped)
14960
14961 /* Do early initialization of the fixmap area */
14962 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14963 - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
14964 +#ifdef CONFIG_COMPAT_VDSO
14965 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
14966 +#else
14967 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
14968 +#endif
14969 #else /* Not PAE */
14970
14971 page_pde_offset = (__PAGE_OFFSET >> 20);
14972 @@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14973 movl %eax, pa(max_pfn_mapped)
14974
14975 /* Do early initialization of the fixmap area */
14976 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14977 - movl %eax,pa(initial_page_table+0xffc)
14978 +#ifdef CONFIG_COMPAT_VDSO
14979 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
14980 +#else
14981 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
14982 +#endif
14983 #endif
14984
14985 #ifdef CONFIG_PARAVIRT
14986 @@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14987 cmpl $num_subarch_entries, %eax
14988 jae bad_subarch
14989
14990 - movl pa(subarch_entries)(,%eax,4), %eax
14991 - subl $__PAGE_OFFSET, %eax
14992 - jmp *%eax
14993 + jmp *pa(subarch_entries)(,%eax,4)
14994
14995 bad_subarch:
14996 WEAK(lguest_entry)
14997 @@ -255,10 +325,10 @@ WEAK(xen_entry)
14998 __INITDATA
14999
15000 subarch_entries:
15001 - .long default_entry /* normal x86/PC */
15002 - .long lguest_entry /* lguest hypervisor */
15003 - .long xen_entry /* Xen hypervisor */
15004 - .long default_entry /* Moorestown MID */
15005 + .long ta(default_entry) /* normal x86/PC */
15006 + .long ta(lguest_entry) /* lguest hypervisor */
15007 + .long ta(xen_entry) /* Xen hypervisor */
15008 + .long ta(default_entry) /* Moorestown MID */
15009 num_subarch_entries = (. - subarch_entries) / 4
15010 .previous
15011 #else
15012 @@ -312,6 +382,7 @@ default_entry:
15013 orl %edx,%eax
15014 movl %eax,%cr4
15015
15016 +#ifdef CONFIG_X86_PAE
15017 testb $X86_CR4_PAE, %al # check if PAE is enabled
15018 jz 6f
15019
15020 @@ -340,6 +411,9 @@ default_entry:
15021 /* Make changes effective */
15022 wrmsr
15023
15024 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
15025 +#endif
15026 +
15027 6:
15028
15029 /*
15030 @@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
15031 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
15032 movl %eax,%ss # after changing gdt.
15033
15034 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
15035 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
15036 movl %eax,%ds
15037 movl %eax,%es
15038
15039 @@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
15040 */
15041 cmpb $0,ready
15042 jne 1f
15043 - movl $gdt_page,%eax
15044 + movl $cpu_gdt_table,%eax
15045 movl $stack_canary,%ecx
15046 +#ifdef CONFIG_SMP
15047 + addl $__per_cpu_load,%ecx
15048 +#endif
15049 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
15050 shrl $16, %ecx
15051 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
15052 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
15053 1:
15054 -#endif
15055 movl $(__KERNEL_STACK_CANARY),%eax
15056 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
15057 + movl $(__USER_DS),%eax
15058 +#else
15059 + xorl %eax,%eax
15060 +#endif
15061 movl %eax,%gs
15062
15063 xorl %eax,%eax # Clear LDT
15064 @@ -558,22 +639,22 @@ early_page_fault:
15065 jmp early_fault
15066
15067 early_fault:
15068 - cld
15069 #ifdef CONFIG_PRINTK
15070 + cmpl $1,%ss:early_recursion_flag
15071 + je hlt_loop
15072 + incl %ss:early_recursion_flag
15073 + cld
15074 pusha
15075 movl $(__KERNEL_DS),%eax
15076 movl %eax,%ds
15077 movl %eax,%es
15078 - cmpl $2,early_recursion_flag
15079 - je hlt_loop
15080 - incl early_recursion_flag
15081 movl %cr2,%eax
15082 pushl %eax
15083 pushl %edx /* trapno */
15084 pushl $fault_msg
15085 call printk
15086 +; call dump_stack
15087 #endif
15088 - call dump_stack
15089 hlt_loop:
15090 hlt
15091 jmp hlt_loop
15092 @@ -581,8 +662,11 @@ hlt_loop:
15093 /* This is the default interrupt "handler" :-) */
15094 ALIGN
15095 ignore_int:
15096 - cld
15097 #ifdef CONFIG_PRINTK
15098 + cmpl $2,%ss:early_recursion_flag
15099 + je hlt_loop
15100 + incl %ss:early_recursion_flag
15101 + cld
15102 pushl %eax
15103 pushl %ecx
15104 pushl %edx
15105 @@ -591,9 +675,6 @@ ignore_int:
15106 movl $(__KERNEL_DS),%eax
15107 movl %eax,%ds
15108 movl %eax,%es
15109 - cmpl $2,early_recursion_flag
15110 - je hlt_loop
15111 - incl early_recursion_flag
15112 pushl 16(%esp)
15113 pushl 24(%esp)
15114 pushl 32(%esp)
15115 @@ -622,29 +703,43 @@ ENTRY(initial_code)
15116 /*
15117 * BSS section
15118 */
15119 -__PAGE_ALIGNED_BSS
15120 - .align PAGE_SIZE
15121 #ifdef CONFIG_X86_PAE
15122 +.section .initial_pg_pmd,"a",@progbits
15123 initial_pg_pmd:
15124 .fill 1024*KPMDS,4,0
15125 #else
15126 +.section .initial_page_table,"a",@progbits
15127 ENTRY(initial_page_table)
15128 .fill 1024,4,0
15129 #endif
15130 +.section .initial_pg_fixmap,"a",@progbits
15131 initial_pg_fixmap:
15132 .fill 1024,4,0
15133 +.section .empty_zero_page,"a",@progbits
15134 ENTRY(empty_zero_page)
15135 .fill 4096,1,0
15136 +.section .swapper_pg_dir,"a",@progbits
15137 ENTRY(swapper_pg_dir)
15138 +#ifdef CONFIG_X86_PAE
15139 + .fill 4,8,0
15140 +#else
15141 .fill 1024,4,0
15142 +#endif
15143 +
15144 +/*
15145 + * The IDT has to be page-aligned to simplify the Pentium
15146 + * F0 0F bug workaround.. We have a special link segment
15147 + * for this.
15148 + */
15149 +.section .idt,"a",@progbits
15150 +ENTRY(idt_table)
15151 + .fill 256,8,0
15152
15153 /*
15154 * This starts the data section.
15155 */
15156 #ifdef CONFIG_X86_PAE
15157 -__PAGE_ALIGNED_DATA
15158 - /* Page-aligned for the benefit of paravirt? */
15159 - .align PAGE_SIZE
15160 +.section .initial_page_table,"a",@progbits
15161 ENTRY(initial_page_table)
15162 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
15163 # if KPMDS == 3
15164 @@ -663,18 +758,27 @@ ENTRY(initial_page_table)
15165 # error "Kernel PMDs should be 1, 2 or 3"
15166 # endif
15167 .align PAGE_SIZE /* needs to be page-sized too */
15168 +
15169 +#ifdef CONFIG_PAX_PER_CPU_PGD
15170 +ENTRY(cpu_pgd)
15171 + .rept NR_CPUS
15172 + .fill 4,8,0
15173 + .endr
15174 +#endif
15175 +
15176 #endif
15177
15178 .data
15179 .balign 4
15180 ENTRY(stack_start)
15181 - .long init_thread_union+THREAD_SIZE
15182 + .long init_thread_union+THREAD_SIZE-8
15183 +
15184 +ready: .byte 0
15185
15186 +.section .rodata,"a",@progbits
15187 early_recursion_flag:
15188 .long 0
15189
15190 -ready: .byte 0
15191 -
15192 int_msg:
15193 .asciz "Unknown interrupt or fault at: %p %p %p\n"
15194
15195 @@ -707,7 +811,7 @@ fault_msg:
15196 .word 0 # 32 bit align gdt_desc.address
15197 boot_gdt_descr:
15198 .word __BOOT_DS+7
15199 - .long boot_gdt - __PAGE_OFFSET
15200 + .long pa(boot_gdt)
15201
15202 .word 0 # 32-bit align idt_desc.address
15203 idt_descr:
15204 @@ -718,7 +822,7 @@ idt_descr:
15205 .word 0 # 32 bit align gdt_desc.address
15206 ENTRY(early_gdt_descr)
15207 .word GDT_ENTRIES*8-1
15208 - .long gdt_page /* Overwritten for secondary CPUs */
15209 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
15210
15211 /*
15212 * The boot_gdt must mirror the equivalent in setup.S and is
15213 @@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
15214 .align L1_CACHE_BYTES
15215 ENTRY(boot_gdt)
15216 .fill GDT_ENTRY_BOOT_CS,8,0
15217 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
15218 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
15219 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
15220 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
15221 +
15222 + .align PAGE_SIZE_asm
15223 +ENTRY(cpu_gdt_table)
15224 + .rept NR_CPUS
15225 + .quad 0x0000000000000000 /* NULL descriptor */
15226 + .quad 0x0000000000000000 /* 0x0b reserved */
15227 + .quad 0x0000000000000000 /* 0x13 reserved */
15228 + .quad 0x0000000000000000 /* 0x1b reserved */
15229 +
15230 +#ifdef CONFIG_PAX_KERNEXEC
15231 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
15232 +#else
15233 + .quad 0x0000000000000000 /* 0x20 unused */
15234 +#endif
15235 +
15236 + .quad 0x0000000000000000 /* 0x28 unused */
15237 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
15238 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
15239 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
15240 + .quad 0x0000000000000000 /* 0x4b reserved */
15241 + .quad 0x0000000000000000 /* 0x53 reserved */
15242 + .quad 0x0000000000000000 /* 0x5b reserved */
15243 +
15244 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
15245 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
15246 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
15247 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
15248 +
15249 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
15250 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
15251 +
15252 + /*
15253 + * Segments used for calling PnP BIOS have byte granularity.
15254 + * The code segments and data segments have fixed 64k limits,
15255 + * the transfer segment sizes are set at run time.
15256 + */
15257 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
15258 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
15259 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
15260 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
15261 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
15262 +
15263 + /*
15264 + * The APM segments have byte granularity and their bases
15265 + * are set at run time. All have 64k limits.
15266 + */
15267 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
15268 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
15269 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
15270 +
15271 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
15272 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
15273 + .quad 0x0040910000000018 /* 0xe0 - STACK_CANARY */
15274 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
15275 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
15276 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
15277 +
15278 + /* Be sure this is zeroed to avoid false validations in Xen */
15279 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
15280 + .endr
15281 diff -urNp linux-2.6.39.1/arch/x86/kernel/head_64.S linux-2.6.39.1/arch/x86/kernel/head_64.S
15282 --- linux-2.6.39.1/arch/x86/kernel/head_64.S 2011-05-19 00:06:34.000000000 -0400
15283 +++ linux-2.6.39.1/arch/x86/kernel/head_64.S 2011-05-22 19:36:30.000000000 -0400
15284 @@ -19,6 +19,7 @@
15285 #include <asm/cache.h>
15286 #include <asm/processor-flags.h>
15287 #include <asm/percpu.h>
15288 +#include <asm/cpufeature.h>
15289
15290 #ifdef CONFIG_PARAVIRT
15291 #include <asm/asm-offsets.h>
15292 @@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
15293 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
15294 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
15295 L3_START_KERNEL = pud_index(__START_KERNEL_map)
15296 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
15297 +L3_VMALLOC_START = pud_index(VMALLOC_START)
15298 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
15299 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
15300
15301 .text
15302 __HEAD
15303 @@ -85,35 +90,22 @@ startup_64:
15304 */
15305 addq %rbp, init_level4_pgt + 0(%rip)
15306 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
15307 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
15308 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
15309 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
15310
15311 addq %rbp, level3_ident_pgt + 0(%rip)
15312 +#ifndef CONFIG_XEN
15313 + addq %rbp, level3_ident_pgt + 8(%rip)
15314 +#endif
15315
15316 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
15317 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
15318 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
15319
15320 - addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15321 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
15322 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
15323
15324 - /* Add an Identity mapping if I am above 1G */
15325 - leaq _text(%rip), %rdi
15326 - andq $PMD_PAGE_MASK, %rdi
15327 -
15328 - movq %rdi, %rax
15329 - shrq $PUD_SHIFT, %rax
15330 - andq $(PTRS_PER_PUD - 1), %rax
15331 - jz ident_complete
15332 -
15333 - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
15334 - leaq level3_ident_pgt(%rip), %rbx
15335 - movq %rdx, 0(%rbx, %rax, 8)
15336 -
15337 - movq %rdi, %rax
15338 - shrq $PMD_SHIFT, %rax
15339 - andq $(PTRS_PER_PMD - 1), %rax
15340 - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15341 - leaq level2_spare_pgt(%rip), %rbx
15342 - movq %rdx, 0(%rbx, %rax, 8)
15343 -ident_complete:
15344 + addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15345 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15346
15347 /*
15348 * Fixup the kernel text+data virtual addresses. Note that
15349 @@ -160,8 +152,8 @@ ENTRY(secondary_startup_64)
15350 * after the boot processor executes this code.
15351 */
15352
15353 - /* Enable PAE mode and PGE */
15354 - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15355 + /* Enable PAE mode and PSE/PGE */
15356 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15357 movq %rax, %cr4
15358
15359 /* Setup early boot stage 4 level pagetables. */
15360 @@ -183,9 +175,14 @@ ENTRY(secondary_startup_64)
15361 movl $MSR_EFER, %ecx
15362 rdmsr
15363 btsl $_EFER_SCE, %eax /* Enable System Call */
15364 - btl $20,%edi /* No Execute supported? */
15365 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15366 jnc 1f
15367 btsl $_EFER_NX, %eax
15368 + leaq init_level4_pgt(%rip), %rdi
15369 + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15370 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15371 + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15372 + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15373 1: wrmsr /* Make changes effective */
15374
15375 /* Setup cr0 */
15376 @@ -269,7 +266,7 @@ ENTRY(secondary_startup_64)
15377 bad_address:
15378 jmp bad_address
15379
15380 - .section ".init.text","ax"
15381 + __INIT
15382 #ifdef CONFIG_EARLY_PRINTK
15383 .globl early_idt_handlers
15384 early_idt_handlers:
15385 @@ -314,18 +311,23 @@ ENTRY(early_idt_handler)
15386 #endif /* EARLY_PRINTK */
15387 1: hlt
15388 jmp 1b
15389 + .previous
15390
15391 #ifdef CONFIG_EARLY_PRINTK
15392 + __INITDATA
15393 early_recursion_flag:
15394 .long 0
15395 + .previous
15396
15397 + .section .rodata,"a",@progbits
15398 early_idt_msg:
15399 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15400 early_idt_ripmsg:
15401 .asciz "RIP %s\n"
15402 -#endif /* CONFIG_EARLY_PRINTK */
15403 .previous
15404 +#endif /* CONFIG_EARLY_PRINTK */
15405
15406 + .section .rodata,"a",@progbits
15407 #define NEXT_PAGE(name) \
15408 .balign PAGE_SIZE; \
15409 ENTRY(name)
15410 @@ -338,7 +340,6 @@ ENTRY(name)
15411 i = i + 1 ; \
15412 .endr
15413
15414 - .data
15415 /*
15416 * This default setting generates an ident mapping at address 0x100000
15417 * and a mapping for the kernel that precisely maps virtual address
15418 @@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt)
15419 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15420 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15421 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15422 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
15423 + .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
15424 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15425 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15426 .org init_level4_pgt + L4_START_KERNEL*8, 0
15427 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15428 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15429
15430 +#ifdef CONFIG_PAX_PER_CPU_PGD
15431 +NEXT_PAGE(cpu_pgd)
15432 + .rept NR_CPUS
15433 + .fill 512,8,0
15434 + .endr
15435 +#endif
15436 +
15437 NEXT_PAGE(level3_ident_pgt)
15438 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15439 +#ifdef CONFIG_XEN
15440 .fill 511,8,0
15441 +#else
15442 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15443 + .fill 510,8,0
15444 +#endif
15445 +
15446 +NEXT_PAGE(level3_vmalloc_pgt)
15447 + .fill 512,8,0
15448 +
15449 +NEXT_PAGE(level3_vmemmap_pgt)
15450 + .fill L3_VMEMMAP_START,8,0
15451 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15452
15453 NEXT_PAGE(level3_kernel_pgt)
15454 .fill L3_START_KERNEL,8,0
15455 @@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt)
15456 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15457 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15458
15459 +NEXT_PAGE(level2_vmemmap_pgt)
15460 + .fill 512,8,0
15461 +
15462 NEXT_PAGE(level2_fixmap_pgt)
15463 - .fill 506,8,0
15464 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15465 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15466 - .fill 5,8,0
15467 + .fill 507,8,0
15468 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15469 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15470 + .fill 4,8,0
15471
15472 -NEXT_PAGE(level1_fixmap_pgt)
15473 +NEXT_PAGE(level1_vsyscall_pgt)
15474 .fill 512,8,0
15475
15476 -NEXT_PAGE(level2_ident_pgt)
15477 - /* Since I easily can, map the first 1G.
15478 + /* Since I easily can, map the first 2G.
15479 * Don't set NX because code runs from these pages.
15480 */
15481 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15482 +NEXT_PAGE(level2_ident_pgt)
15483 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15484
15485 NEXT_PAGE(level2_kernel_pgt)
15486 /*
15487 @@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt)
15488 * If you want to increase this then increase MODULES_VADDR
15489 * too.)
15490 */
15491 - PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15492 - KERNEL_IMAGE_SIZE/PMD_SIZE)
15493 -
15494 -NEXT_PAGE(level2_spare_pgt)
15495 - .fill 512, 8, 0
15496 + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15497
15498 #undef PMDS
15499 #undef NEXT_PAGE
15500
15501 - .data
15502 + .align PAGE_SIZE
15503 +ENTRY(cpu_gdt_table)
15504 + .rept NR_CPUS
15505 + .quad 0x0000000000000000 /* NULL descriptor */
15506 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15507 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
15508 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
15509 + .quad 0x00cffb000000ffff /* __USER32_CS */
15510 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15511 + .quad 0x00affb000000ffff /* __USER_CS */
15512 +
15513 +#ifdef CONFIG_PAX_KERNEXEC
15514 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15515 +#else
15516 + .quad 0x0 /* unused */
15517 +#endif
15518 +
15519 + .quad 0,0 /* TSS */
15520 + .quad 0,0 /* LDT */
15521 + .quad 0,0,0 /* three TLS descriptors */
15522 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
15523 + /* asm/segment.h:GDT_ENTRIES must match this */
15524 +
15525 + /* zero the remaining page */
15526 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15527 + .endr
15528 +
15529 .align 16
15530 .globl early_gdt_descr
15531 early_gdt_descr:
15532 .word GDT_ENTRIES*8-1
15533 early_gdt_descr_base:
15534 - .quad INIT_PER_CPU_VAR(gdt_page)
15535 + .quad cpu_gdt_table
15536
15537 ENTRY(phys_base)
15538 /* This must match the first entry in level2_kernel_pgt */
15539 .quad 0x0000000000000000
15540
15541 #include "../../x86/xen/xen-head.S"
15542 -
15543 - .section .bss, "aw", @nobits
15544 +
15545 + .section .rodata,"a",@progbits
15546 .align L1_CACHE_BYTES
15547 ENTRY(idt_table)
15548 - .skip IDT_ENTRIES * 16
15549 + .fill 512,8,0
15550
15551 __PAGE_ALIGNED_BSS
15552 .align PAGE_SIZE
15553 diff -urNp linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c
15554 --- linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c 2011-05-19 00:06:34.000000000 -0400
15555 +++ linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c 2011-05-22 19:36:30.000000000 -0400
15556 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15557 EXPORT_SYMBOL(cmpxchg8b_emu);
15558 #endif
15559
15560 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
15561 +
15562 /* Networking helper routines. */
15563 EXPORT_SYMBOL(csum_partial_copy_generic);
15564 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15565 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15566
15567 EXPORT_SYMBOL(__get_user_1);
15568 EXPORT_SYMBOL(__get_user_2);
15569 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15570
15571 EXPORT_SYMBOL(csum_partial);
15572 EXPORT_SYMBOL(empty_zero_page);
15573 +
15574 +#ifdef CONFIG_PAX_KERNEXEC
15575 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15576 +#endif
15577 diff -urNp linux-2.6.39.1/arch/x86/kernel/i8259.c linux-2.6.39.1/arch/x86/kernel/i8259.c
15578 --- linux-2.6.39.1/arch/x86/kernel/i8259.c 2011-05-19 00:06:34.000000000 -0400
15579 +++ linux-2.6.39.1/arch/x86/kernel/i8259.c 2011-05-22 19:36:30.000000000 -0400
15580 @@ -210,7 +210,7 @@ spurious_8259A_irq:
15581 "spurious 8259A interrupt: IRQ%d.\n", irq);
15582 spurious_irq_mask |= irqmask;
15583 }
15584 - atomic_inc(&irq_err_count);
15585 + atomic_inc_unchecked(&irq_err_count);
15586 /*
15587 * Theoretically we do not have to handle this IRQ,
15588 * but in Linux this does not cause problems and is
15589 diff -urNp linux-2.6.39.1/arch/x86/kernel/init_task.c linux-2.6.39.1/arch/x86/kernel/init_task.c
15590 --- linux-2.6.39.1/arch/x86/kernel/init_task.c 2011-05-19 00:06:34.000000000 -0400
15591 +++ linux-2.6.39.1/arch/x86/kernel/init_task.c 2011-05-22 19:36:30.000000000 -0400
15592 @@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
15593 * way process stacks are handled. This is done by having a special
15594 * "init_task" linker map entry..
15595 */
15596 -union thread_union init_thread_union __init_task_data =
15597 - { INIT_THREAD_INFO(init_task) };
15598 +union thread_union init_thread_union __init_task_data;
15599
15600 /*
15601 * Initial task structure.
15602 @@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15603 * section. Since TSS's are completely CPU-local, we want them
15604 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15605 */
15606 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15607 -
15608 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15609 +EXPORT_SYMBOL(init_tss);
15610 diff -urNp linux-2.6.39.1/arch/x86/kernel/ioport.c linux-2.6.39.1/arch/x86/kernel/ioport.c
15611 --- linux-2.6.39.1/arch/x86/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
15612 +++ linux-2.6.39.1/arch/x86/kernel/ioport.c 2011-05-22 19:41:32.000000000 -0400
15613 @@ -6,6 +6,7 @@
15614 #include <linux/sched.h>
15615 #include <linux/kernel.h>
15616 #include <linux/capability.h>
15617 +#include <linux/security.h>
15618 #include <linux/errno.h>
15619 #include <linux/types.h>
15620 #include <linux/ioport.h>
15621 @@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long
15622
15623 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15624 return -EINVAL;
15625 +#ifdef CONFIG_GRKERNSEC_IO
15626 + if (turn_on && grsec_disable_privio) {
15627 + gr_handle_ioperm();
15628 + return -EPERM;
15629 + }
15630 +#endif
15631 if (turn_on && !capable(CAP_SYS_RAWIO))
15632 return -EPERM;
15633
15634 @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long
15635 * because the ->io_bitmap_max value must match the bitmap
15636 * contents:
15637 */
15638 - tss = &per_cpu(init_tss, get_cpu());
15639 + tss = init_tss + get_cpu();
15640
15641 if (turn_on)
15642 bitmap_clear(t->io_bitmap_ptr, from, num);
15643 @@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct
15644 return -EINVAL;
15645 /* Trying to gain more privileges? */
15646 if (level > old) {
15647 +#ifdef CONFIG_GRKERNSEC_IO
15648 + if (grsec_disable_privio) {
15649 + gr_handle_iopl();
15650 + return -EPERM;
15651 + }
15652 +#endif
15653 if (!capable(CAP_SYS_RAWIO))
15654 return -EPERM;
15655 }
15656 diff -urNp linux-2.6.39.1/arch/x86/kernel/irq_32.c linux-2.6.39.1/arch/x86/kernel/irq_32.c
15657 --- linux-2.6.39.1/arch/x86/kernel/irq_32.c 2011-05-19 00:06:34.000000000 -0400
15658 +++ linux-2.6.39.1/arch/x86/kernel/irq_32.c 2011-05-22 19:36:30.000000000 -0400
15659 @@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15660 __asm__ __volatile__("andl %%esp,%0" :
15661 "=r" (sp) : "0" (THREAD_SIZE - 1));
15662
15663 - return sp < (sizeof(struct thread_info) + STACK_WARN);
15664 + return sp < STACK_WARN;
15665 }
15666
15667 static void print_stack_overflow(void)
15668 @@ -54,8 +54,8 @@ static inline void print_stack_overflow(
15669 * per-CPU IRQ handling contexts (thread information and stack)
15670 */
15671 union irq_ctx {
15672 - struct thread_info tinfo;
15673 - u32 stack[THREAD_SIZE/sizeof(u32)];
15674 + unsigned long previous_esp;
15675 + u32 stack[THREAD_SIZE/sizeof(u32)];
15676 } __attribute__((aligned(THREAD_SIZE)));
15677
15678 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15679 @@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
15680 static inline int
15681 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15682 {
15683 - union irq_ctx *curctx, *irqctx;
15684 + union irq_ctx *irqctx;
15685 u32 *isp, arg1, arg2;
15686
15687 - curctx = (union irq_ctx *) current_thread_info();
15688 irqctx = __this_cpu_read(hardirq_ctx);
15689
15690 /*
15691 @@ -87,21 +86,17 @@ execute_on_irq_stack(int overflow, struc
15692 * handler) we can't do that and just have to keep using the
15693 * current stack (which is the irq stack already after all)
15694 */
15695 - if (unlikely(curctx == irqctx))
15696 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15697 return 0;
15698
15699 /* build the stack frame on the IRQ stack */
15700 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15701 - irqctx->tinfo.task = curctx->tinfo.task;
15702 - irqctx->tinfo.previous_esp = current_stack_pointer;
15703 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15704 + irqctx->previous_esp = current_stack_pointer;
15705 + add_preempt_count(HARDIRQ_OFFSET);
15706
15707 - /*
15708 - * Copy the softirq bits in preempt_count so that the
15709 - * softirq checks work in the hardirq context.
15710 - */
15711 - irqctx->tinfo.preempt_count =
15712 - (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15713 - (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15714 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15715 + __set_fs(MAKE_MM_SEG(0));
15716 +#endif
15717
15718 if (unlikely(overflow))
15719 call_on_stack(print_stack_overflow, isp);
15720 @@ -113,6 +108,12 @@ execute_on_irq_stack(int overflow, struc
15721 : "0" (irq), "1" (desc), "2" (isp),
15722 "D" (desc->handle_irq)
15723 : "memory", "cc", "ecx");
15724 +
15725 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15726 + __set_fs(current_thread_info()->addr_limit);
15727 +#endif
15728 +
15729 + sub_preempt_count(HARDIRQ_OFFSET);
15730 return 1;
15731 }
15732
15733 @@ -121,29 +122,11 @@ execute_on_irq_stack(int overflow, struc
15734 */
15735 void __cpuinit irq_ctx_init(int cpu)
15736 {
15737 - union irq_ctx *irqctx;
15738 -
15739 if (per_cpu(hardirq_ctx, cpu))
15740 return;
15741
15742 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15743 - THREAD_FLAGS,
15744 - THREAD_ORDER));
15745 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15746 - irqctx->tinfo.cpu = cpu;
15747 - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15748 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15749 -
15750 - per_cpu(hardirq_ctx, cpu) = irqctx;
15751 -
15752 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15753 - THREAD_FLAGS,
15754 - THREAD_ORDER));
15755 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15756 - irqctx->tinfo.cpu = cpu;
15757 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15758 -
15759 - per_cpu(softirq_ctx, cpu) = irqctx;
15760 + per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15761 + per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15762
15763 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15764 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15765 @@ -152,7 +135,6 @@ void __cpuinit irq_ctx_init(int cpu)
15766 asmlinkage void do_softirq(void)
15767 {
15768 unsigned long flags;
15769 - struct thread_info *curctx;
15770 union irq_ctx *irqctx;
15771 u32 *isp;
15772
15773 @@ -162,15 +144,22 @@ asmlinkage void do_softirq(void)
15774 local_irq_save(flags);
15775
15776 if (local_softirq_pending()) {
15777 - curctx = current_thread_info();
15778 irqctx = __this_cpu_read(softirq_ctx);
15779 - irqctx->tinfo.task = curctx->task;
15780 - irqctx->tinfo.previous_esp = current_stack_pointer;
15781 + irqctx->previous_esp = current_stack_pointer;
15782
15783 /* build the stack frame on the softirq stack */
15784 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15785 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15786 +
15787 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15788 + __set_fs(MAKE_MM_SEG(0));
15789 +#endif
15790
15791 call_on_stack(__do_softirq, isp);
15792 +
15793 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15794 + __set_fs(current_thread_info()->addr_limit);
15795 +#endif
15796 +
15797 /*
15798 * Shouldn't happen, we returned above if in_interrupt():
15799 */
15800 diff -urNp linux-2.6.39.1/arch/x86/kernel/irq.c linux-2.6.39.1/arch/x86/kernel/irq.c
15801 --- linux-2.6.39.1/arch/x86/kernel/irq.c 2011-05-19 00:06:34.000000000 -0400
15802 +++ linux-2.6.39.1/arch/x86/kernel/irq.c 2011-05-22 19:36:30.000000000 -0400
15803 @@ -17,7 +17,7 @@
15804 #include <asm/mce.h>
15805 #include <asm/hw_irq.h>
15806
15807 -atomic_t irq_err_count;
15808 +atomic_unchecked_t irq_err_count;
15809
15810 /* Function pointer for generic interrupt vector handling */
15811 void (*x86_platform_ipi_callback)(void) = NULL;
15812 @@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file
15813 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15814 seq_printf(p, " Machine check polls\n");
15815 #endif
15816 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15817 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15818 #if defined(CONFIG_X86_IO_APIC)
15819 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15820 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15821 #endif
15822 return 0;
15823 }
15824 @@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15825
15826 u64 arch_irq_stat(void)
15827 {
15828 - u64 sum = atomic_read(&irq_err_count);
15829 + u64 sum = atomic_read_unchecked(&irq_err_count);
15830
15831 #ifdef CONFIG_X86_IO_APIC
15832 - sum += atomic_read(&irq_mis_count);
15833 + sum += atomic_read_unchecked(&irq_mis_count);
15834 #endif
15835 return sum;
15836 }
15837 diff -urNp linux-2.6.39.1/arch/x86/kernel/kgdb.c linux-2.6.39.1/arch/x86/kernel/kgdb.c
15838 --- linux-2.6.39.1/arch/x86/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
15839 +++ linux-2.6.39.1/arch/x86/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
15840 @@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem,
15841 #ifdef CONFIG_X86_32
15842 switch (regno) {
15843 case GDB_SS:
15844 - if (!user_mode_vm(regs))
15845 + if (!user_mode(regs))
15846 *(unsigned long *)mem = __KERNEL_DS;
15847 break;
15848 case GDB_SP:
15849 - if (!user_mode_vm(regs))
15850 + if (!user_mode(regs))
15851 *(unsigned long *)mem = kernel_stack_pointer(regs);
15852 break;
15853 case GDB_GS:
15854 @@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
15855 case 'k':
15856 /* clear the trace bit */
15857 linux_regs->flags &= ~X86_EFLAGS_TF;
15858 - atomic_set(&kgdb_cpu_doing_single_step, -1);
15859 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15860
15861 /* set the trace bit if we're stepping */
15862 if (remcomInBuffer[0] == 's') {
15863 linux_regs->flags |= X86_EFLAGS_TF;
15864 - atomic_set(&kgdb_cpu_doing_single_step,
15865 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15866 raw_smp_processor_id());
15867 }
15868
15869 @@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args
15870 return NOTIFY_DONE;
15871
15872 case DIE_DEBUG:
15873 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15874 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15875 if (user_mode(regs))
15876 return single_step_cont(regs, args);
15877 break;
15878 @@ -710,7 +710,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
15879 regs->ip = ip;
15880 }
15881
15882 -struct kgdb_arch arch_kgdb_ops = {
15883 +const struct kgdb_arch arch_kgdb_ops = {
15884 /* Breakpoint instruction: */
15885 .gdb_bpt_instr = { 0xcc },
15886 .flags = KGDB_HW_BREAKPOINT,
15887 diff -urNp linux-2.6.39.1/arch/x86/kernel/kprobes.c linux-2.6.39.1/arch/x86/kernel/kprobes.c
15888 --- linux-2.6.39.1/arch/x86/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
15889 +++ linux-2.6.39.1/arch/x86/kernel/kprobes.c 2011-05-22 19:36:30.000000000 -0400
15890 @@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat
15891 } __attribute__((packed)) *insn;
15892
15893 insn = (struct __arch_relative_insn *)from;
15894 +
15895 + pax_open_kernel();
15896 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15897 insn->op = op;
15898 + pax_close_kernel();
15899 }
15900
15901 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
15902 @@ -153,7 +156,7 @@ static int __kprobes can_boost(kprobe_op
15903 kprobe_opcode_t opcode;
15904 kprobe_opcode_t *orig_opcodes = opcodes;
15905
15906 - if (search_exception_tables((unsigned long)opcodes))
15907 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15908 return 0; /* Page fault may occur on this address. */
15909
15910 retry:
15911 @@ -314,7 +317,9 @@ static int __kprobes __copy_instruction(
15912 }
15913 }
15914 insn_get_length(&insn);
15915 + pax_open_kernel();
15916 memcpy(dest, insn.kaddr, insn.length);
15917 + pax_close_kernel();
15918
15919 #ifdef CONFIG_X86_64
15920 if (insn_rip_relative(&insn)) {
15921 @@ -338,7 +343,9 @@ static int __kprobes __copy_instruction(
15922 (u8 *) dest;
15923 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15924 disp = (u8 *) dest + insn_offset_displacement(&insn);
15925 + pax_open_kernel();
15926 *(s32 *) disp = (s32) newdisp;
15927 + pax_close_kernel();
15928 }
15929 #endif
15930 return insn.length;
15931 @@ -352,12 +359,12 @@ static void __kprobes arch_copy_kprobe(s
15932 */
15933 __copy_instruction(p->ainsn.insn, p->addr, 0);
15934
15935 - if (can_boost(p->addr))
15936 + if (can_boost(ktla_ktva(p->addr)))
15937 p->ainsn.boostable = 0;
15938 else
15939 p->ainsn.boostable = -1;
15940
15941 - p->opcode = *p->addr;
15942 + p->opcode = *(ktla_ktva(p->addr));
15943 }
15944
15945 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15946 @@ -474,7 +481,7 @@ static void __kprobes setup_singlestep(s
15947 * nor set current_kprobe, because it doesn't use single
15948 * stepping.
15949 */
15950 - regs->ip = (unsigned long)p->ainsn.insn;
15951 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15952 preempt_enable_no_resched();
15953 return;
15954 }
15955 @@ -493,7 +500,7 @@ static void __kprobes setup_singlestep(s
15956 if (p->opcode == BREAKPOINT_INSTRUCTION)
15957 regs->ip = (unsigned long)p->addr;
15958 else
15959 - regs->ip = (unsigned long)p->ainsn.insn;
15960 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15961 }
15962
15963 /*
15964 @@ -572,7 +579,7 @@ static int __kprobes kprobe_handler(stru
15965 setup_singlestep(p, regs, kcb, 0);
15966 return 1;
15967 }
15968 - } else if (*addr != BREAKPOINT_INSTRUCTION) {
15969 + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15970 /*
15971 * The breakpoint instruction was removed right
15972 * after we hit it. Another cpu has removed
15973 @@ -817,7 +824,7 @@ static void __kprobes resume_execution(s
15974 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15975 {
15976 unsigned long *tos = stack_addr(regs);
15977 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15978 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15979 unsigned long orig_ip = (unsigned long)p->addr;
15980 kprobe_opcode_t *insn = p->ainsn.insn;
15981
15982 @@ -999,7 +1006,7 @@ int __kprobes kprobe_exceptions_notify(s
15983 struct die_args *args = data;
15984 int ret = NOTIFY_DONE;
15985
15986 - if (args->regs && user_mode_vm(args->regs))
15987 + if (args->regs && user_mode(args->regs))
15988 return ret;
15989
15990 switch (val) {
15991 @@ -1381,7 +1388,7 @@ int __kprobes arch_prepare_optimized_kpr
15992 * Verify if the address gap is in 2GB range, because this uses
15993 * a relative jump.
15994 */
15995 - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15996 + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15997 if (abs(rel) > 0x7fffffff)
15998 return -ERANGE;
15999
16000 @@ -1402,11 +1409,11 @@ int __kprobes arch_prepare_optimized_kpr
16001 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
16002
16003 /* Set probe function call */
16004 - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
16005 + synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
16006
16007 /* Set returning jmp instruction at the tail of out-of-line buffer */
16008 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
16009 - (u8 *)op->kp.addr + op->optinsn.size);
16010 + (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
16011
16012 flush_icache_range((unsigned long) buf,
16013 (unsigned long) buf + TMPL_END_IDX +
16014 @@ -1428,7 +1435,7 @@ static void __kprobes setup_optimize_kpr
16015 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
16016
16017 /* Backup instructions which will be replaced by jump address */
16018 - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
16019 + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
16020 RELATIVE_ADDR_SIZE);
16021
16022 insn_buf[0] = RELATIVEJUMP_OPCODE;
16023 diff -urNp linux-2.6.39.1/arch/x86/kernel/ldt.c linux-2.6.39.1/arch/x86/kernel/ldt.c
16024 --- linux-2.6.39.1/arch/x86/kernel/ldt.c 2011-05-19 00:06:34.000000000 -0400
16025 +++ linux-2.6.39.1/arch/x86/kernel/ldt.c 2011-05-22 19:36:30.000000000 -0400
16026 @@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
16027 if (reload) {
16028 #ifdef CONFIG_SMP
16029 preempt_disable();
16030 - load_LDT(pc);
16031 + load_LDT_nolock(pc);
16032 if (!cpumask_equal(mm_cpumask(current->mm),
16033 cpumask_of(smp_processor_id())))
16034 smp_call_function(flush_ldt, current->mm, 1);
16035 preempt_enable();
16036 #else
16037 - load_LDT(pc);
16038 + load_LDT_nolock(pc);
16039 #endif
16040 }
16041 if (oldsize) {
16042 @@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t
16043 return err;
16044
16045 for (i = 0; i < old->size; i++)
16046 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
16047 + write_ldt_entry(new->ldt, i, old->ldt + i);
16048 return 0;
16049 }
16050
16051 @@ -116,6 +116,24 @@ int init_new_context(struct task_struct
16052 retval = copy_ldt(&mm->context, &old_mm->context);
16053 mutex_unlock(&old_mm->context.lock);
16054 }
16055 +
16056 + if (tsk == current) {
16057 + mm->context.vdso = 0;
16058 +
16059 +#ifdef CONFIG_X86_32
16060 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
16061 + mm->context.user_cs_base = 0UL;
16062 + mm->context.user_cs_limit = ~0UL;
16063 +
16064 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
16065 + cpus_clear(mm->context.cpu_user_cs_mask);
16066 +#endif
16067 +
16068 +#endif
16069 +#endif
16070 +
16071 + }
16072 +
16073 return retval;
16074 }
16075
16076 @@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u
16077 }
16078 }
16079
16080 +#ifdef CONFIG_PAX_SEGMEXEC
16081 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
16082 + error = -EINVAL;
16083 + goto out_unlock;
16084 + }
16085 +#endif
16086 +
16087 fill_ldt(&ldt, &ldt_info);
16088 if (oldmode)
16089 ldt.avl = 0;
16090 diff -urNp linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c
16091 --- linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c 2011-05-19 00:06:34.000000000 -0400
16092 +++ linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c 2011-05-22 19:36:30.000000000 -0400
16093 @@ -27,7 +27,7 @@
16094 #include <asm/cacheflush.h>
16095 #include <asm/debugreg.h>
16096
16097 -static void set_idt(void *newidt, __u16 limit)
16098 +static void set_idt(struct desc_struct *newidt, __u16 limit)
16099 {
16100 struct desc_ptr curidt;
16101
16102 @@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
16103 }
16104
16105
16106 -static void set_gdt(void *newgdt, __u16 limit)
16107 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
16108 {
16109 struct desc_ptr curgdt;
16110
16111 @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
16112 }
16113
16114 control_page = page_address(image->control_code_page);
16115 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
16116 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
16117
16118 relocate_kernel_ptr = control_page;
16119 page_list[PA_CONTROL_PAGE] = __pa(control_page);
16120 diff -urNp linux-2.6.39.1/arch/x86/kernel/microcode_amd.c linux-2.6.39.1/arch/x86/kernel/microcode_amd.c
16121 --- linux-2.6.39.1/arch/x86/kernel/microcode_amd.c 2011-05-19 00:06:34.000000000 -0400
16122 +++ linux-2.6.39.1/arch/x86/kernel/microcode_amd.c 2011-05-22 19:36:30.000000000 -0400
16123 @@ -339,7 +339,7 @@ static void microcode_fini_cpu_amd(int c
16124 uci->mc = NULL;
16125 }
16126
16127 -static struct microcode_ops microcode_amd_ops = {
16128 +static const struct microcode_ops microcode_amd_ops = {
16129 .request_microcode_user = request_microcode_user,
16130 .request_microcode_fw = request_microcode_amd,
16131 .collect_cpu_info = collect_cpu_info_amd,
16132 @@ -347,7 +347,7 @@ static struct microcode_ops microcode_am
16133 .microcode_fini_cpu = microcode_fini_cpu_amd,
16134 };
16135
16136 -struct microcode_ops * __init init_amd_microcode(void)
16137 +const struct microcode_ops * __init init_amd_microcode(void)
16138 {
16139 return &microcode_amd_ops;
16140 }
16141 diff -urNp linux-2.6.39.1/arch/x86/kernel/microcode_core.c linux-2.6.39.1/arch/x86/kernel/microcode_core.c
16142 --- linux-2.6.39.1/arch/x86/kernel/microcode_core.c 2011-05-19 00:06:34.000000000 -0400
16143 +++ linux-2.6.39.1/arch/x86/kernel/microcode_core.c 2011-05-22 19:36:30.000000000 -0400
16144 @@ -93,7 +93,7 @@ MODULE_LICENSE("GPL");
16145
16146 #define MICROCODE_VERSION "2.00"
16147
16148 -static struct microcode_ops *microcode_ops;
16149 +static const struct microcode_ops *microcode_ops;
16150
16151 /*
16152 * Synchronization.
16153 diff -urNp linux-2.6.39.1/arch/x86/kernel/microcode_intel.c linux-2.6.39.1/arch/x86/kernel/microcode_intel.c
16154 --- linux-2.6.39.1/arch/x86/kernel/microcode_intel.c 2011-05-19 00:06:34.000000000 -0400
16155 +++ linux-2.6.39.1/arch/x86/kernel/microcode_intel.c 2011-05-22 19:36:30.000000000 -0400
16156 @@ -440,13 +440,13 @@ static enum ucode_state request_microcod
16157
16158 static int get_ucode_user(void *to, const void *from, size_t n)
16159 {
16160 - return copy_from_user(to, from, n);
16161 + return copy_from_user(to, (__force const void __user *)from, n);
16162 }
16163
16164 static enum ucode_state
16165 request_microcode_user(int cpu, const void __user *buf, size_t size)
16166 {
16167 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
16168 + return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
16169 }
16170
16171 static void microcode_fini_cpu(int cpu)
16172 @@ -457,7 +457,7 @@ static void microcode_fini_cpu(int cpu)
16173 uci->mc = NULL;
16174 }
16175
16176 -static struct microcode_ops microcode_intel_ops = {
16177 +static const struct microcode_ops microcode_intel_ops = {
16178 .request_microcode_user = request_microcode_user,
16179 .request_microcode_fw = request_microcode_fw,
16180 .collect_cpu_info = collect_cpu_info,
16181 @@ -465,7 +465,7 @@ static struct microcode_ops microcode_in
16182 .microcode_fini_cpu = microcode_fini_cpu,
16183 };
16184
16185 -struct microcode_ops * __init init_intel_microcode(void)
16186 +const struct microcode_ops * __init init_intel_microcode(void)
16187 {
16188 return &microcode_intel_ops;
16189 }
16190 diff -urNp linux-2.6.39.1/arch/x86/kernel/module.c linux-2.6.39.1/arch/x86/kernel/module.c
16191 --- linux-2.6.39.1/arch/x86/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
16192 +++ linux-2.6.39.1/arch/x86/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
16193 @@ -35,21 +35,66 @@
16194 #define DEBUGP(fmt...)
16195 #endif
16196
16197 -void *module_alloc(unsigned long size)
16198 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
16199 {
16200 if (PAGE_ALIGN(size) > MODULES_LEN)
16201 return NULL;
16202 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
16203 - GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
16204 + GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
16205 -1, __builtin_return_address(0));
16206 }
16207
16208 +void *module_alloc(unsigned long size)
16209 +{
16210 +
16211 +#ifdef CONFIG_PAX_KERNEXEC
16212 + return __module_alloc(size, PAGE_KERNEL);
16213 +#else
16214 + return __module_alloc(size, PAGE_KERNEL_EXEC);
16215 +#endif
16216 +
16217 +}
16218 +
16219 /* Free memory returned from module_alloc */
16220 void module_free(struct module *mod, void *module_region)
16221 {
16222 vfree(module_region);
16223 }
16224
16225 +#ifdef CONFIG_PAX_KERNEXEC
16226 +#ifdef CONFIG_X86_32
16227 +void *module_alloc_exec(unsigned long size)
16228 +{
16229 + struct vm_struct *area;
16230 +
16231 + if (size == 0)
16232 + return NULL;
16233 +
16234 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
16235 + return area ? area->addr : NULL;
16236 +}
16237 +EXPORT_SYMBOL(module_alloc_exec);
16238 +
16239 +void module_free_exec(struct module *mod, void *module_region)
16240 +{
16241 + vunmap(module_region);
16242 +}
16243 +EXPORT_SYMBOL(module_free_exec);
16244 +#else
16245 +void module_free_exec(struct module *mod, void *module_region)
16246 +{
16247 + module_free(mod, module_region);
16248 +}
16249 +EXPORT_SYMBOL(module_free_exec);
16250 +
16251 +void *module_alloc_exec(unsigned long size)
16252 +{
16253 + return __module_alloc(size, PAGE_KERNEL_RX);
16254 +}
16255 +EXPORT_SYMBOL(module_alloc_exec);
16256 +#endif
16257 +#endif
16258 +
16259 /* We don't need anything special. */
16260 int module_frob_arch_sections(Elf_Ehdr *hdr,
16261 Elf_Shdr *sechdrs,
16262 @@ -69,14 +114,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16263 unsigned int i;
16264 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
16265 Elf32_Sym *sym;
16266 - uint32_t *location;
16267 + uint32_t *plocation, location;
16268
16269 DEBUGP("Applying relocate section %u to %u\n", relsec,
16270 sechdrs[relsec].sh_info);
16271 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
16272 /* This is where to make the change */
16273 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
16274 - + rel[i].r_offset;
16275 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
16276 + location = (uint32_t)plocation;
16277 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
16278 + plocation = ktla_ktva((void *)plocation);
16279 /* This is the symbol it is referring to. Note that all
16280 undefined symbols have been resolved. */
16281 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
16282 @@ -85,11 +132,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16283 switch (ELF32_R_TYPE(rel[i].r_info)) {
16284 case R_386_32:
16285 /* We add the value into the location given */
16286 - *location += sym->st_value;
16287 + pax_open_kernel();
16288 + *plocation += sym->st_value;
16289 + pax_close_kernel();
16290 break;
16291 case R_386_PC32:
16292 /* Add the value, subtract its postition */
16293 - *location += sym->st_value - (uint32_t)location;
16294 + pax_open_kernel();
16295 + *plocation += sym->st_value - location;
16296 + pax_close_kernel();
16297 break;
16298 default:
16299 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
16300 @@ -145,21 +196,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
16301 case R_X86_64_NONE:
16302 break;
16303 case R_X86_64_64:
16304 + pax_open_kernel();
16305 *(u64 *)loc = val;
16306 + pax_close_kernel();
16307 break;
16308 case R_X86_64_32:
16309 + pax_open_kernel();
16310 *(u32 *)loc = val;
16311 + pax_close_kernel();
16312 if (val != *(u32 *)loc)
16313 goto overflow;
16314 break;
16315 case R_X86_64_32S:
16316 + pax_open_kernel();
16317 *(s32 *)loc = val;
16318 + pax_close_kernel();
16319 if ((s64)val != *(s32 *)loc)
16320 goto overflow;
16321 break;
16322 case R_X86_64_PC32:
16323 val -= (u64)loc;
16324 + pax_open_kernel();
16325 *(u32 *)loc = val;
16326 + pax_close_kernel();
16327 +
16328 #if 0
16329 if ((s64)val != *(s32 *)loc)
16330 goto overflow;
16331 diff -urNp linux-2.6.39.1/arch/x86/kernel/paravirt.c linux-2.6.39.1/arch/x86/kernel/paravirt.c
16332 --- linux-2.6.39.1/arch/x86/kernel/paravirt.c 2011-05-19 00:06:34.000000000 -0400
16333 +++ linux-2.6.39.1/arch/x86/kernel/paravirt.c 2011-05-22 19:36:30.000000000 -0400
16334 @@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
16335 * corresponding structure. */
16336 static void *get_call_destination(u8 type)
16337 {
16338 - struct paravirt_patch_template tmpl = {
16339 + const struct paravirt_patch_template tmpl = {
16340 .pv_init_ops = pv_init_ops,
16341 .pv_time_ops = pv_time_ops,
16342 .pv_cpu_ops = pv_cpu_ops,
16343 @@ -133,6 +133,9 @@ static void *get_call_destination(u8 typ
16344 .pv_lock_ops = pv_lock_ops,
16345 #endif
16346 };
16347 +
16348 + pax_track_stack();
16349 +
16350 return *((void **)&tmpl + type);
16351 }
16352
16353 @@ -145,14 +148,14 @@ unsigned paravirt_patch_default(u8 type,
16354 if (opfunc == NULL)
16355 /* If there's no function, patch it with a ud2a (BUG) */
16356 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16357 - else if (opfunc == _paravirt_nop)
16358 + else if (opfunc == (void *)_paravirt_nop)
16359 /* If the operation is a nop, then nop the callsite */
16360 ret = paravirt_patch_nop();
16361
16362 /* identity functions just return their single argument */
16363 - else if (opfunc == _paravirt_ident_32)
16364 + else if (opfunc == (void *)_paravirt_ident_32)
16365 ret = paravirt_patch_ident_32(insnbuf, len);
16366 - else if (opfunc == _paravirt_ident_64)
16367 + else if (opfunc == (void *)_paravirt_ident_64)
16368 ret = paravirt_patch_ident_64(insnbuf, len);
16369
16370 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16371 @@ -178,7 +181,7 @@ unsigned paravirt_patch_insns(void *insn
16372 if (insn_len > len || start == NULL)
16373 insn_len = len;
16374 else
16375 - memcpy(insnbuf, start, insn_len);
16376 + memcpy(insnbuf, ktla_ktva(start), insn_len);
16377
16378 return insn_len;
16379 }
16380 @@ -294,22 +297,22 @@ void arch_flush_lazy_mmu_mode(void)
16381 preempt_enable();
16382 }
16383
16384 -struct pv_info pv_info = {
16385 +struct pv_info pv_info __read_only = {
16386 .name = "bare hardware",
16387 .paravirt_enabled = 0,
16388 .kernel_rpl = 0,
16389 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
16390 };
16391
16392 -struct pv_init_ops pv_init_ops = {
16393 +struct pv_init_ops pv_init_ops __read_only = {
16394 .patch = native_patch,
16395 };
16396
16397 -struct pv_time_ops pv_time_ops = {
16398 +struct pv_time_ops pv_time_ops __read_only = {
16399 .sched_clock = native_sched_clock,
16400 };
16401
16402 -struct pv_irq_ops pv_irq_ops = {
16403 +struct pv_irq_ops pv_irq_ops __read_only = {
16404 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16405 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16406 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16407 @@ -321,7 +324,7 @@ struct pv_irq_ops pv_irq_ops = {
16408 #endif
16409 };
16410
16411 -struct pv_cpu_ops pv_cpu_ops = {
16412 +struct pv_cpu_ops pv_cpu_ops __read_only = {
16413 .cpuid = native_cpuid,
16414 .get_debugreg = native_get_debugreg,
16415 .set_debugreg = native_set_debugreg,
16416 @@ -382,7 +385,7 @@ struct pv_cpu_ops pv_cpu_ops = {
16417 .end_context_switch = paravirt_nop,
16418 };
16419
16420 -struct pv_apic_ops pv_apic_ops = {
16421 +struct pv_apic_ops pv_apic_ops __read_only = {
16422 #ifdef CONFIG_X86_LOCAL_APIC
16423 .startup_ipi_hook = paravirt_nop,
16424 #endif
16425 @@ -396,7 +399,7 @@ struct pv_apic_ops pv_apic_ops = {
16426 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16427 #endif
16428
16429 -struct pv_mmu_ops pv_mmu_ops = {
16430 +struct pv_mmu_ops pv_mmu_ops __read_only = {
16431
16432 .read_cr2 = native_read_cr2,
16433 .write_cr2 = native_write_cr2,
16434 @@ -465,6 +468,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16435 },
16436
16437 .set_fixmap = native_set_fixmap,
16438 +
16439 +#ifdef CONFIG_PAX_KERNEXEC
16440 + .pax_open_kernel = native_pax_open_kernel,
16441 + .pax_close_kernel = native_pax_close_kernel,
16442 +#endif
16443 +
16444 };
16445
16446 EXPORT_SYMBOL_GPL(pv_time_ops);
16447 diff -urNp linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c
16448 --- linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c 2011-05-19 00:06:34.000000000 -0400
16449 +++ linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c 2011-05-22 19:36:30.000000000 -0400
16450 @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
16451 arch_spin_lock(lock);
16452 }
16453
16454 -struct pv_lock_ops pv_lock_ops = {
16455 +struct pv_lock_ops pv_lock_ops __read_only = {
16456 #ifdef CONFIG_SMP
16457 .spin_is_locked = __ticket_spin_is_locked,
16458 .spin_is_contended = __ticket_spin_is_contended,
16459 diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c
16460 --- linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c 2011-05-19 00:06:34.000000000 -0400
16461 +++ linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c 2011-05-22 19:36:30.000000000 -0400
16462 @@ -179,13 +179,13 @@ static void calioc2_dump_error_regs(stru
16463 static void calgary_init_bitmap_from_tce_table(struct iommu_table *tbl);
16464 static void get_tce_space_from_tar(void);
16465
16466 -static struct cal_chipset_ops calgary_chip_ops = {
16467 +static const struct cal_chipset_ops calgary_chip_ops = {
16468 .handle_quirks = calgary_handle_quirks,
16469 .tce_cache_blast = calgary_tce_cache_blast,
16470 .dump_error_regs = calgary_dump_error_regs
16471 };
16472
16473 -static struct cal_chipset_ops calioc2_chip_ops = {
16474 +static const struct cal_chipset_ops calioc2_chip_ops = {
16475 .handle_quirks = calioc2_handle_quirks,
16476 .tce_cache_blast = calioc2_tce_cache_blast,
16477 .dump_error_regs = calioc2_dump_error_regs
16478 @@ -476,7 +476,7 @@ static void calgary_free_coherent(struct
16479 free_pages((unsigned long)vaddr, get_order(size));
16480 }
16481
16482 -static struct dma_map_ops calgary_dma_ops = {
16483 +static const struct dma_map_ops calgary_dma_ops = {
16484 .alloc_coherent = calgary_alloc_coherent,
16485 .free_coherent = calgary_free_coherent,
16486 .map_sg = calgary_map_sg,
16487 diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-dma.c linux-2.6.39.1/arch/x86/kernel/pci-dma.c
16488 --- linux-2.6.39.1/arch/x86/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
16489 +++ linux-2.6.39.1/arch/x86/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
16490 @@ -16,7 +16,7 @@
16491
16492 static int forbid_dac __read_mostly;
16493
16494 -struct dma_map_ops *dma_ops = &nommu_dma_ops;
16495 +const struct dma_map_ops *dma_ops = &nommu_dma_ops;
16496 EXPORT_SYMBOL(dma_ops);
16497
16498 static int iommu_sac_force __read_mostly;
16499 @@ -250,7 +250,7 @@ early_param("iommu", iommu_setup);
16500
16501 int dma_supported(struct device *dev, u64 mask)
16502 {
16503 - struct dma_map_ops *ops = get_dma_ops(dev);
16504 + const struct dma_map_ops *ops = get_dma_ops(dev);
16505
16506 #ifdef CONFIG_PCI
16507 if (mask > 0xffffffff && forbid_dac > 0) {
16508 diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c
16509 --- linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c 2011-05-19 00:06:34.000000000 -0400
16510 +++ linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c 2011-05-22 19:36:30.000000000 -0400
16511 @@ -695,7 +695,7 @@ static __init int init_amd_gatt(struct a
16512 return -1;
16513 }
16514
16515 -static struct dma_map_ops gart_dma_ops = {
16516 +static const struct dma_map_ops gart_dma_ops = {
16517 .map_sg = gart_map_sg,
16518 .unmap_sg = gart_unmap_sg,
16519 .map_page = gart_map_page,
16520 diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c
16521 --- linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c 2011-05-19 00:06:34.000000000 -0400
16522 +++ linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c 2011-05-22 19:36:30.000000000 -0400
16523 @@ -2,7 +2,7 @@
16524 #include <asm/iommu_table.h>
16525 #include <linux/string.h>
16526 #include <linux/kallsyms.h>
16527 -
16528 +#include <linux/sched.h>
16529
16530 #define DEBUG 1
16531
16532 @@ -53,6 +53,8 @@ void __init check_iommu_entries(struct i
16533 char sym_p[KSYM_SYMBOL_LEN];
16534 char sym_q[KSYM_SYMBOL_LEN];
16535
16536 + pax_track_stack();
16537 +
16538 /* Simple cyclic dependency checker. */
16539 for (p = start; p < finish; p++) {
16540 q = find_dependents_of(start, finish, p);
16541 diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-nommu.c linux-2.6.39.1/arch/x86/kernel/pci-nommu.c
16542 --- linux-2.6.39.1/arch/x86/kernel/pci-nommu.c 2011-05-19 00:06:34.000000000 -0400
16543 +++ linux-2.6.39.1/arch/x86/kernel/pci-nommu.c 2011-05-22 19:36:30.000000000 -0400
16544 @@ -95,7 +95,7 @@ static void nommu_sync_sg_for_device(str
16545 flush_write_buffers();
16546 }
16547
16548 -struct dma_map_ops nommu_dma_ops = {
16549 +const struct dma_map_ops nommu_dma_ops = {
16550 .alloc_coherent = dma_generic_alloc_coherent,
16551 .free_coherent = nommu_free_coherent,
16552 .map_sg = nommu_map_sg,
16553 diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c
16554 --- linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
16555 +++ linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
16556 @@ -26,7 +26,7 @@ static void *x86_swiotlb_alloc_coherent(
16557 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
16558 }
16559
16560 -static struct dma_map_ops swiotlb_dma_ops = {
16561 +static const struct dma_map_ops swiotlb_dma_ops = {
16562 .mapping_error = swiotlb_dma_mapping_error,
16563 .alloc_coherent = x86_swiotlb_alloc_coherent,
16564 .free_coherent = swiotlb_free_coherent,
16565 diff -urNp linux-2.6.39.1/arch/x86/kernel/process_32.c linux-2.6.39.1/arch/x86/kernel/process_32.c
16566 --- linux-2.6.39.1/arch/x86/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
16567 +++ linux-2.6.39.1/arch/x86/kernel/process_32.c 2011-05-22 19:36:30.000000000 -0400
16568 @@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
16569 unsigned long thread_saved_pc(struct task_struct *tsk)
16570 {
16571 return ((unsigned long *)tsk->thread.sp)[3];
16572 +//XXX return tsk->thread.eip;
16573 }
16574
16575 #ifndef CONFIG_SMP
16576 @@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i
16577 unsigned long sp;
16578 unsigned short ss, gs;
16579
16580 - if (user_mode_vm(regs)) {
16581 + if (user_mode(regs)) {
16582 sp = regs->sp;
16583 ss = regs->ss & 0xffff;
16584 - gs = get_user_gs(regs);
16585 } else {
16586 sp = kernel_stack_pointer(regs);
16587 savesegment(ss, ss);
16588 - savesegment(gs, gs);
16589 }
16590 + gs = get_user_gs(regs);
16591
16592 show_regs_common();
16593
16594 @@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
16595 struct task_struct *tsk;
16596 int err;
16597
16598 - childregs = task_pt_regs(p);
16599 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16600 *childregs = *regs;
16601 childregs->ax = 0;
16602 childregs->sp = sp;
16603
16604 p->thread.sp = (unsigned long) childregs;
16605 p->thread.sp0 = (unsigned long) (childregs+1);
16606 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16607
16608 p->thread.ip = (unsigned long) ret_from_fork;
16609
16610 @@ -293,7 +294,7 @@ __switch_to(struct task_struct *prev_p,
16611 struct thread_struct *prev = &prev_p->thread,
16612 *next = &next_p->thread;
16613 int cpu = smp_processor_id();
16614 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
16615 + struct tss_struct *tss = init_tss + cpu;
16616 bool preload_fpu;
16617
16618 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16619 @@ -328,6 +329,10 @@ __switch_to(struct task_struct *prev_p,
16620 */
16621 lazy_save_gs(prev->gs);
16622
16623 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16624 + __set_fs(task_thread_info(next_p)->addr_limit);
16625 +#endif
16626 +
16627 /*
16628 * Load the per-thread Thread-Local Storage descriptor.
16629 */
16630 @@ -363,6 +368,9 @@ __switch_to(struct task_struct *prev_p,
16631 */
16632 arch_end_context_switch(next_p);
16633
16634 + percpu_write(current_task, next_p);
16635 + percpu_write(current_tinfo, &next_p->tinfo);
16636 +
16637 if (preload_fpu)
16638 __math_state_restore();
16639
16640 @@ -372,8 +380,6 @@ __switch_to(struct task_struct *prev_p,
16641 if (prev->gs | next->gs)
16642 lazy_load_gs(next->gs);
16643
16644 - percpu_write(current_task, next_p);
16645 -
16646 return prev_p;
16647 }
16648
16649 @@ -403,4 +409,3 @@ unsigned long get_wchan(struct task_stru
16650 } while (count++ < 16);
16651 return 0;
16652 }
16653 -
16654 diff -urNp linux-2.6.39.1/arch/x86/kernel/process_64.c linux-2.6.39.1/arch/x86/kernel/process_64.c
16655 --- linux-2.6.39.1/arch/x86/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
16656 +++ linux-2.6.39.1/arch/x86/kernel/process_64.c 2011-05-22 19:36:30.000000000 -0400
16657 @@ -87,7 +87,7 @@ static void __exit_idle(void)
16658 void exit_idle(void)
16659 {
16660 /* idle loop has pid 0 */
16661 - if (current->pid)
16662 + if (task_pid_nr(current))
16663 return;
16664 __exit_idle();
16665 }
16666 @@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
16667 struct pt_regs *childregs;
16668 struct task_struct *me = current;
16669
16670 - childregs = ((struct pt_regs *)
16671 - (THREAD_SIZE + task_stack_page(p))) - 1;
16672 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16673 *childregs = *regs;
16674
16675 childregs->ax = 0;
16676 @@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
16677 p->thread.sp = (unsigned long) childregs;
16678 p->thread.sp0 = (unsigned long) (childregs+1);
16679 p->thread.usersp = me->thread.usersp;
16680 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16681
16682 set_tsk_thread_flag(p, TIF_FORK);
16683
16684 @@ -376,7 +376,7 @@ __switch_to(struct task_struct *prev_p,
16685 struct thread_struct *prev = &prev_p->thread;
16686 struct thread_struct *next = &next_p->thread;
16687 int cpu = smp_processor_id();
16688 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
16689 + struct tss_struct *tss = init_tss + cpu;
16690 unsigned fsindex, gsindex;
16691 bool preload_fpu;
16692
16693 @@ -472,10 +472,9 @@ __switch_to(struct task_struct *prev_p,
16694 prev->usersp = percpu_read(old_rsp);
16695 percpu_write(old_rsp, next->usersp);
16696 percpu_write(current_task, next_p);
16697 + percpu_write(current_tinfo, &next_p->tinfo);
16698
16699 - percpu_write(kernel_stack,
16700 - (unsigned long)task_stack_page(next_p) +
16701 - THREAD_SIZE - KERNEL_STACK_OFFSET);
16702 + percpu_write(kernel_stack, next->sp0);
16703
16704 /*
16705 * Now maybe reload the debug registers and handle I/O bitmaps
16706 @@ -537,12 +536,11 @@ unsigned long get_wchan(struct task_stru
16707 if (!p || p == current || p->state == TASK_RUNNING)
16708 return 0;
16709 stack = (unsigned long)task_stack_page(p);
16710 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16711 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16712 return 0;
16713 fp = *(u64 *)(p->thread.sp);
16714 do {
16715 - if (fp < (unsigned long)stack ||
16716 - fp >= (unsigned long)stack+THREAD_SIZE)
16717 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16718 return 0;
16719 ip = *(u64 *)(fp+8);
16720 if (!in_sched_functions(ip))
16721 diff -urNp linux-2.6.39.1/arch/x86/kernel/process.c linux-2.6.39.1/arch/x86/kernel/process.c
16722 --- linux-2.6.39.1/arch/x86/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
16723 +++ linux-2.6.39.1/arch/x86/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
16724 @@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
16725
16726 void free_thread_info(struct thread_info *ti)
16727 {
16728 - free_thread_xstate(ti->task);
16729 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16730 }
16731
16732 +static struct kmem_cache *task_struct_cachep;
16733 +
16734 void arch_task_cache_init(void)
16735 {
16736 - task_xstate_cachep =
16737 - kmem_cache_create("task_xstate", xstate_size,
16738 + /* create a slab on which task_structs can be allocated */
16739 + task_struct_cachep =
16740 + kmem_cache_create("task_struct", sizeof(struct task_struct),
16741 + ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16742 +
16743 + task_xstate_cachep =
16744 + kmem_cache_create("task_xstate", xstate_size,
16745 __alignof__(union thread_xstate),
16746 - SLAB_PANIC | SLAB_NOTRACK, NULL);
16747 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16748 +}
16749 +
16750 +struct task_struct *alloc_task_struct_node(int node)
16751 +{
16752 + return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16753 +}
16754 +
16755 +void free_task_struct(struct task_struct *task)
16756 +{
16757 + free_thread_xstate(task);
16758 + kmem_cache_free(task_struct_cachep, task);
16759 }
16760
16761 /*
16762 @@ -70,7 +87,7 @@ void exit_thread(void)
16763 unsigned long *bp = t->io_bitmap_ptr;
16764
16765 if (bp) {
16766 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16767 + struct tss_struct *tss = init_tss + get_cpu();
16768
16769 t->io_bitmap_ptr = NULL;
16770 clear_thread_flag(TIF_IO_BITMAP);
16771 @@ -106,7 +123,7 @@ void show_regs_common(void)
16772
16773 printk(KERN_CONT "\n");
16774 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16775 - current->pid, current->comm, print_tainted(),
16776 + task_pid_nr(current), current->comm, print_tainted(),
16777 init_utsname()->release,
16778 (int)strcspn(init_utsname()->version, " "),
16779 init_utsname()->version);
16780 @@ -120,6 +137,9 @@ void flush_thread(void)
16781 {
16782 struct task_struct *tsk = current;
16783
16784 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16785 + loadsegment(gs, 0);
16786 +#endif
16787 flush_ptrace_hw_breakpoint(tsk);
16788 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16789 /*
16790 @@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi
16791 regs.di = (unsigned long) arg;
16792
16793 #ifdef CONFIG_X86_32
16794 - regs.ds = __USER_DS;
16795 - regs.es = __USER_DS;
16796 + regs.ds = __KERNEL_DS;
16797 + regs.es = __KERNEL_DS;
16798 regs.fs = __KERNEL_PERCPU;
16799 - regs.gs = __KERNEL_STACK_CANARY;
16800 + savesegment(gs, regs.gs);
16801 #else
16802 regs.ss = __KERNEL_DS;
16803 #endif
16804 @@ -401,7 +421,7 @@ void default_idle(void)
16805 EXPORT_SYMBOL(default_idle);
16806 #endif
16807
16808 -void stop_this_cpu(void *dummy)
16809 +__noreturn void stop_this_cpu(void *dummy)
16810 {
16811 local_irq_disable();
16812 /*
16813 @@ -665,16 +685,34 @@ static int __init idle_setup(char *str)
16814 }
16815 early_param("idle", idle_setup);
16816
16817 -unsigned long arch_align_stack(unsigned long sp)
16818 +#ifdef CONFIG_PAX_RANDKSTACK
16819 +asmlinkage void pax_randomize_kstack(void)
16820 {
16821 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16822 - sp -= get_random_int() % 8192;
16823 - return sp & ~0xf;
16824 -}
16825 + struct thread_struct *thread = &current->thread;
16826 + unsigned long time;
16827
16828 -unsigned long arch_randomize_brk(struct mm_struct *mm)
16829 -{
16830 - unsigned long range_end = mm->brk + 0x02000000;
16831 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16832 -}
16833 + if (!randomize_va_space)
16834 + return;
16835 +
16836 + rdtscl(time);
16837 +
16838 + /* P4 seems to return a 0 LSB, ignore it */
16839 +#ifdef CONFIG_MPENTIUM4
16840 + time &= 0x3EUL;
16841 + time <<= 2;
16842 +#elif defined(CONFIG_X86_64)
16843 + time &= 0xFUL;
16844 + time <<= 4;
16845 +#else
16846 + time &= 0x1FUL;
16847 + time <<= 3;
16848 +#endif
16849 +
16850 + thread->sp0 ^= time;
16851 + load_sp0(init_tss + smp_processor_id(), thread);
16852
16853 +#ifdef CONFIG_X86_64
16854 + percpu_write(kernel_stack, thread->sp0);
16855 +#endif
16856 +}
16857 +#endif
16858 diff -urNp linux-2.6.39.1/arch/x86/kernel/ptrace.c linux-2.6.39.1/arch/x86/kernel/ptrace.c
16859 --- linux-2.6.39.1/arch/x86/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
16860 +++ linux-2.6.39.1/arch/x86/kernel/ptrace.c 2011-05-22 19:36:30.000000000 -0400
16861 @@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
16862 unsigned long addr, unsigned long data)
16863 {
16864 int ret;
16865 - unsigned long __user *datap = (unsigned long __user *)data;
16866 + unsigned long __user *datap = (__force unsigned long __user *)data;
16867
16868 switch (request) {
16869 /* read the word at location addr in the USER area. */
16870 @@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
16871 if ((int) addr < 0)
16872 return -EIO;
16873 ret = do_get_thread_area(child, addr,
16874 - (struct user_desc __user *)data);
16875 + (__force struct user_desc __user *) data);
16876 break;
16877
16878 case PTRACE_SET_THREAD_AREA:
16879 if ((int) addr < 0)
16880 return -EIO;
16881 ret = do_set_thread_area(child, addr,
16882 - (struct user_desc __user *)data, 0);
16883 + (__force struct user_desc __user *) data, 0);
16884 break;
16885 #endif
16886
16887 @@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
16888 memset(info, 0, sizeof(*info));
16889 info->si_signo = SIGTRAP;
16890 info->si_code = si_code;
16891 - info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16892 + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16893 }
16894
16895 void user_single_step_siginfo(struct task_struct *tsk,
16896 @@ -1363,7 +1363,7 @@ void send_sigtrap(struct task_struct *ts
16897 * We must return the syscall number to actually look up in the table.
16898 * This can be -1L to skip running any syscall at all.
16899 */
16900 -asmregparm long syscall_trace_enter(struct pt_regs *regs)
16901 +long syscall_trace_enter(struct pt_regs *regs)
16902 {
16903 long ret = 0;
16904
16905 @@ -1408,7 +1408,7 @@ asmregparm long syscall_trace_enter(stru
16906 return ret ?: regs->orig_ax;
16907 }
16908
16909 -asmregparm void syscall_trace_leave(struct pt_regs *regs)
16910 +void syscall_trace_leave(struct pt_regs *regs)
16911 {
16912 bool step;
16913
16914 diff -urNp linux-2.6.39.1/arch/x86/kernel/pvclock.c linux-2.6.39.1/arch/x86/kernel/pvclock.c
16915 --- linux-2.6.39.1/arch/x86/kernel/pvclock.c 2011-05-19 00:06:34.000000000 -0400
16916 +++ linux-2.6.39.1/arch/x86/kernel/pvclock.c 2011-05-22 19:36:30.000000000 -0400
16917 @@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
16918 return pv_tsc_khz;
16919 }
16920
16921 -static atomic64_t last_value = ATOMIC64_INIT(0);
16922 +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16923
16924 void pvclock_resume(void)
16925 {
16926 - atomic64_set(&last_value, 0);
16927 + atomic64_set_unchecked(&last_value, 0);
16928 }
16929
16930 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16931 @@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct
16932 * updating at the same time, and one of them could be slightly behind,
16933 * making the assumption that last_value always go forward fail to hold.
16934 */
16935 - last = atomic64_read(&last_value);
16936 + last = atomic64_read_unchecked(&last_value);
16937 do {
16938 if (ret < last)
16939 return last;
16940 - last = atomic64_cmpxchg(&last_value, last, ret);
16941 + last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16942 } while (unlikely(last != ret));
16943
16944 return ret;
16945 diff -urNp linux-2.6.39.1/arch/x86/kernel/reboot.c linux-2.6.39.1/arch/x86/kernel/reboot.c
16946 --- linux-2.6.39.1/arch/x86/kernel/reboot.c 2011-05-19 00:06:34.000000000 -0400
16947 +++ linux-2.6.39.1/arch/x86/kernel/reboot.c 2011-05-23 17:07:00.000000000 -0400
16948 @@ -35,7 +35,7 @@ void (*pm_power_off)(void);
16949 EXPORT_SYMBOL(pm_power_off);
16950
16951 static const struct desc_ptr no_idt = {};
16952 -static int reboot_mode;
16953 +static unsigned short reboot_mode;
16954 enum reboot_type reboot_type = BOOT_KBD;
16955 int reboot_force;
16956
16957 @@ -307,13 +307,17 @@ core_initcall(reboot_init);
16958 extern const unsigned char machine_real_restart_asm[];
16959 extern const u64 machine_real_restart_gdt[3];
16960
16961 -void machine_real_restart(unsigned int type)
16962 +__noreturn void machine_real_restart(unsigned int type)
16963 {
16964 void *restart_va;
16965 unsigned long restart_pa;
16966 - void (*restart_lowmem)(unsigned int);
16967 + void (* __noreturn restart_lowmem)(unsigned int);
16968 u64 *lowmem_gdt;
16969
16970 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16971 + struct desc_struct *gdt;
16972 +#endif
16973 +
16974 local_irq_disable();
16975
16976 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16977 @@ -339,14 +343,14 @@ void machine_real_restart(unsigned int t
16978 boot)". This seems like a fairly standard thing that gets set by
16979 REBOOT.COM programs, and the previous reset routine did this
16980 too. */
16981 - *((unsigned short *)0x472) = reboot_mode;
16982 + *(unsigned short *)(__va(0x472)) = reboot_mode;
16983
16984 /* Patch the GDT in the low memory trampoline */
16985 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16986
16987 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16988 restart_pa = virt_to_phys(restart_va);
16989 - restart_lowmem = (void (*)(unsigned int))restart_pa;
16990 + restart_lowmem = (void *)restart_pa;
16991
16992 /* GDT[0]: GDT self-pointer */
16993 lowmem_gdt[0] =
16994 @@ -357,7 +361,33 @@ void machine_real_restart(unsigned int t
16995 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16996
16997 /* Jump to the identity-mapped low memory code */
16998 +
16999 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
17000 + gdt = get_cpu_gdt_table(smp_processor_id());
17001 + pax_open_kernel();
17002 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17003 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
17004 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
17005 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
17006 +#endif
17007 +#ifdef CONFIG_PAX_KERNEXEC
17008 + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
17009 + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
17010 + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
17011 + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
17012 + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
17013 + gdt[GDT_ENTRY_KERNEL_CS].g = 1;
17014 +#endif
17015 + pax_close_kernel();
17016 +#endif
17017 +
17018 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17019 + asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
17020 + unreachable();
17021 +#else
17022 restart_lowmem(type);
17023 +#endif
17024 +
17025 }
17026 #ifdef CONFIG_APM_MODULE
17027 EXPORT_SYMBOL(machine_real_restart);
17028 @@ -478,7 +508,7 @@ void __attribute__((weak)) mach_reboot_f
17029 {
17030 }
17031
17032 -static void native_machine_emergency_restart(void)
17033 +__noreturn static void native_machine_emergency_restart(void)
17034 {
17035 int i;
17036
17037 @@ -593,13 +623,13 @@ void native_machine_shutdown(void)
17038 #endif
17039 }
17040
17041 -static void __machine_emergency_restart(int emergency)
17042 +static __noreturn void __machine_emergency_restart(int emergency)
17043 {
17044 reboot_emergency = emergency;
17045 machine_ops.emergency_restart();
17046 }
17047
17048 -static void native_machine_restart(char *__unused)
17049 +static __noreturn void native_machine_restart(char *__unused)
17050 {
17051 printk("machine restart\n");
17052
17053 @@ -608,7 +638,7 @@ static void native_machine_restart(char
17054 __machine_emergency_restart(0);
17055 }
17056
17057 -static void native_machine_halt(void)
17058 +static __noreturn void native_machine_halt(void)
17059 {
17060 /* stop other cpus and apics */
17061 machine_shutdown();
17062 @@ -619,7 +649,7 @@ static void native_machine_halt(void)
17063 stop_this_cpu(NULL);
17064 }
17065
17066 -static void native_machine_power_off(void)
17067 +__noreturn static void native_machine_power_off(void)
17068 {
17069 if (pm_power_off) {
17070 if (!reboot_force)
17071 @@ -628,6 +658,7 @@ static void native_machine_power_off(voi
17072 }
17073 /* a fallback in case there is no PM info available */
17074 tboot_shutdown(TB_SHUTDOWN_HALT);
17075 + unreachable();
17076 }
17077
17078 struct machine_ops machine_ops = {
17079 diff -urNp linux-2.6.39.1/arch/x86/kernel/setup.c linux-2.6.39.1/arch/x86/kernel/setup.c
17080 --- linux-2.6.39.1/arch/x86/kernel/setup.c 2011-06-03 00:04:13.000000000 -0400
17081 +++ linux-2.6.39.1/arch/x86/kernel/setup.c 2011-06-03 00:32:04.000000000 -0400
17082 @@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
17083 * area (640->1Mb) as ram even though it is not.
17084 * take them out.
17085 */
17086 - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
17087 + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
17088 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
17089 }
17090
17091 @@ -775,14 +775,14 @@ void __init setup_arch(char **cmdline_p)
17092
17093 if (!boot_params.hdr.root_flags)
17094 root_mountflags &= ~MS_RDONLY;
17095 - init_mm.start_code = (unsigned long) _text;
17096 - init_mm.end_code = (unsigned long) _etext;
17097 + init_mm.start_code = ktla_ktva((unsigned long) _text);
17098 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
17099 init_mm.end_data = (unsigned long) _edata;
17100 init_mm.brk = _brk_end;
17101
17102 - code_resource.start = virt_to_phys(_text);
17103 - code_resource.end = virt_to_phys(_etext)-1;
17104 - data_resource.start = virt_to_phys(_etext);
17105 + code_resource.start = virt_to_phys(ktla_ktva(_text));
17106 + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
17107 + data_resource.start = virt_to_phys(_sdata);
17108 data_resource.end = virt_to_phys(_edata)-1;
17109 bss_resource.start = virt_to_phys(&__bss_start);
17110 bss_resource.end = virt_to_phys(&__bss_stop)-1;
17111 diff -urNp linux-2.6.39.1/arch/x86/kernel/setup_percpu.c linux-2.6.39.1/arch/x86/kernel/setup_percpu.c
17112 --- linux-2.6.39.1/arch/x86/kernel/setup_percpu.c 2011-05-19 00:06:34.000000000 -0400
17113 +++ linux-2.6.39.1/arch/x86/kernel/setup_percpu.c 2011-06-04 20:08:30.000000000 -0400
17114 @@ -21,19 +21,17 @@
17115 #include <asm/cpu.h>
17116 #include <asm/stackprotector.h>
17117
17118 -DEFINE_PER_CPU(int, cpu_number);
17119 +#ifdef CONFIG_SMP
17120 +DEFINE_PER_CPU(unsigned int, cpu_number);
17121 EXPORT_PER_CPU_SYMBOL(cpu_number);
17122 +#endif
17123
17124 -#ifdef CONFIG_X86_64
17125 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
17126 -#else
17127 -#define BOOT_PERCPU_OFFSET 0
17128 -#endif
17129
17130 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
17131 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
17132
17133 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
17134 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
17135 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
17136 };
17137 EXPORT_SYMBOL(__per_cpu_offset);
17138 @@ -155,10 +153,10 @@ static inline void setup_percpu_segment(
17139 {
17140 #ifdef CONFIG_X86_32
17141 struct desc_struct gdt;
17142 + unsigned long base = per_cpu_offset(cpu);
17143
17144 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
17145 - 0x2 | DESCTYPE_S, 0x8);
17146 - gdt.s = 1;
17147 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
17148 + 0x83 | DESCTYPE_S, 0xC);
17149 write_gdt_entry(get_cpu_gdt_table(cpu),
17150 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
17151 #endif
17152 @@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
17153 /* alrighty, percpu areas up and running */
17154 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
17155 for_each_possible_cpu(cpu) {
17156 +#ifdef CONFIG_CC_STACKPROTECTOR
17157 +#ifdef CONFIG_X86_32
17158 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
17159 +#endif
17160 +#endif
17161 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
17162 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
17163 per_cpu(cpu_number, cpu) = cpu;
17164 @@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
17165 */
17166 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
17167 #endif
17168 +#ifdef CONFIG_CC_STACKPROTECTOR
17169 +#ifdef CONFIG_X86_32
17170 + if (!cpu)
17171 + per_cpu(stack_canary.canary, cpu) = canary;
17172 +#endif
17173 +#endif
17174 /*
17175 * Up to this point, the boot CPU has been using .init.data
17176 * area. Reload any changed state for the boot CPU.
17177 diff -urNp linux-2.6.39.1/arch/x86/kernel/signal.c linux-2.6.39.1/arch/x86/kernel/signal.c
17178 --- linux-2.6.39.1/arch/x86/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
17179 +++ linux-2.6.39.1/arch/x86/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
17180 @@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
17181 * Align the stack pointer according to the i386 ABI,
17182 * i.e. so that on function entry ((sp + 4) & 15) == 0.
17183 */
17184 - sp = ((sp + 4) & -16ul) - 4;
17185 + sp = ((sp - 12) & -16ul) - 4;
17186 #else /* !CONFIG_X86_32 */
17187 sp = round_down(sp, 16) - 8;
17188 #endif
17189 @@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
17190 * Return an always-bogus address instead so we will die with SIGSEGV.
17191 */
17192 if (onsigstack && !likely(on_sig_stack(sp)))
17193 - return (void __user *)-1L;
17194 + return (__force void __user *)-1L;
17195
17196 /* save i387 state */
17197 if (used_math() && save_i387_xstate(*fpstate) < 0)
17198 - return (void __user *)-1L;
17199 + return (__force void __user *)-1L;
17200
17201 return (void __user *)sp;
17202 }
17203 @@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
17204 }
17205
17206 if (current->mm->context.vdso)
17207 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17208 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17209 else
17210 - restorer = &frame->retcode;
17211 + restorer = (void __user *)&frame->retcode;
17212 if (ka->sa.sa_flags & SA_RESTORER)
17213 restorer = ka->sa.sa_restorer;
17214
17215 @@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
17216 * reasons and because gdb uses it as a signature to notice
17217 * signal handler stack frames.
17218 */
17219 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
17220 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
17221
17222 if (err)
17223 return -EFAULT;
17224 @@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str
17225 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
17226
17227 /* Set up to return from userspace. */
17228 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17229 + if (current->mm->context.vdso)
17230 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17231 + else
17232 + restorer = (void __user *)&frame->retcode;
17233 if (ka->sa.sa_flags & SA_RESTORER)
17234 restorer = ka->sa.sa_restorer;
17235 put_user_ex(restorer, &frame->pretcode);
17236 @@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str
17237 * reasons and because gdb uses it as a signature to notice
17238 * signal handler stack frames.
17239 */
17240 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
17241 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
17242 } put_user_catch(err);
17243
17244 if (err)
17245 @@ -773,6 +776,8 @@ static void do_signal(struct pt_regs *re
17246 int signr;
17247 sigset_t *oldset;
17248
17249 + pax_track_stack();
17250 +
17251 /*
17252 * We want the common case to go fast, which is why we may in certain
17253 * cases get here from kernel mode. Just return without doing anything
17254 @@ -780,7 +785,7 @@ static void do_signal(struct pt_regs *re
17255 * X86_32: vm86 regs switched out by assembly code before reaching
17256 * here, so testing against kernel CS suffices.
17257 */
17258 - if (!user_mode(regs))
17259 + if (!user_mode_novm(regs))
17260 return;
17261
17262 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
17263 diff -urNp linux-2.6.39.1/arch/x86/kernel/smpboot.c linux-2.6.39.1/arch/x86/kernel/smpboot.c
17264 --- linux-2.6.39.1/arch/x86/kernel/smpboot.c 2011-05-19 00:06:34.000000000 -0400
17265 +++ linux-2.6.39.1/arch/x86/kernel/smpboot.c 2011-05-22 19:36:30.000000000 -0400
17266 @@ -696,17 +696,20 @@ static int __cpuinit do_boot_cpu(int api
17267 set_idle_for_cpu(cpu, c_idle.idle);
17268 do_rest:
17269 per_cpu(current_task, cpu) = c_idle.idle;
17270 + per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
17271 #ifdef CONFIG_X86_32
17272 /* Stack for startup_32 can be just as for start_secondary onwards */
17273 irq_ctx_init(cpu);
17274 #else
17275 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
17276 initial_gs = per_cpu_offset(cpu);
17277 - per_cpu(kernel_stack, cpu) =
17278 - (unsigned long)task_stack_page(c_idle.idle) -
17279 - KERNEL_STACK_OFFSET + THREAD_SIZE;
17280 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
17281 #endif
17282 +
17283 + pax_open_kernel();
17284 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
17285 + pax_close_kernel();
17286 +
17287 initial_code = (unsigned long)start_secondary;
17288 stack_start = c_idle.idle->thread.sp;
17289
17290 @@ -848,6 +851,12 @@ int __cpuinit native_cpu_up(unsigned int
17291
17292 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
17293
17294 +#ifdef CONFIG_PAX_PER_CPU_PGD
17295 + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
17296 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17297 + KERNEL_PGD_PTRS);
17298 +#endif
17299 +
17300 err = do_boot_cpu(apicid, cpu);
17301 if (err) {
17302 pr_debug("do_boot_cpu failed %d\n", err);
17303 diff -urNp linux-2.6.39.1/arch/x86/kernel/step.c linux-2.6.39.1/arch/x86/kernel/step.c
17304 --- linux-2.6.39.1/arch/x86/kernel/step.c 2011-05-19 00:06:34.000000000 -0400
17305 +++ linux-2.6.39.1/arch/x86/kernel/step.c 2011-05-22 19:36:30.000000000 -0400
17306 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
17307 struct desc_struct *desc;
17308 unsigned long base;
17309
17310 - seg &= ~7UL;
17311 + seg >>= 3;
17312
17313 mutex_lock(&child->mm->context.lock);
17314 - if (unlikely((seg >> 3) >= child->mm->context.size))
17315 + if (unlikely(seg >= child->mm->context.size))
17316 addr = -1L; /* bogus selector, access would fault */
17317 else {
17318 desc = child->mm->context.ldt + seg;
17319 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
17320 addr += base;
17321 }
17322 mutex_unlock(&child->mm->context.lock);
17323 - }
17324 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
17325 + addr = ktla_ktva(addr);
17326
17327 return addr;
17328 }
17329 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
17330 unsigned char opcode[15];
17331 unsigned long addr = convert_ip_to_linear(child, regs);
17332
17333 + if (addr == -EINVAL)
17334 + return 0;
17335 +
17336 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
17337 for (i = 0; i < copied; i++) {
17338 switch (opcode[i]) {
17339 @@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
17340
17341 #ifdef CONFIG_X86_64
17342 case 0x40 ... 0x4f:
17343 - if (regs->cs != __USER_CS)
17344 + if ((regs->cs & 0xffff) != __USER_CS)
17345 /* 32-bit mode: register increment */
17346 return 0;
17347 /* 64-bit mode: REX prefix */
17348 diff -urNp linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S
17349 --- linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S 2011-05-19 00:06:34.000000000 -0400
17350 +++ linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S 2011-05-22 19:36:30.000000000 -0400
17351 @@ -1,3 +1,4 @@
17352 +.section .rodata,"a",@progbits
17353 ENTRY(sys_call_table)
17354 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17355 .long sys_exit
17356 diff -urNp linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c
17357 --- linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c 2011-05-19 00:06:34.000000000 -0400
17358 +++ linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c 2011-05-22 19:36:30.000000000 -0400
17359 @@ -24,17 +24,224 @@
17360
17361 #include <asm/syscalls.h>
17362
17363 -/*
17364 - * Do a system call from kernel instead of calling sys_execve so we
17365 - * end up with proper pt_regs.
17366 - */
17367 -int kernel_execve(const char *filename,
17368 - const char *const argv[],
17369 - const char *const envp[])
17370 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
17371 {
17372 - long __res;
17373 - asm volatile ("int $0x80"
17374 - : "=a" (__res)
17375 - : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
17376 - return __res;
17377 + unsigned long pax_task_size = TASK_SIZE;
17378 +
17379 +#ifdef CONFIG_PAX_SEGMEXEC
17380 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
17381 + pax_task_size = SEGMEXEC_TASK_SIZE;
17382 +#endif
17383 +
17384 + if (len > pax_task_size || addr > pax_task_size - len)
17385 + return -EINVAL;
17386 +
17387 + return 0;
17388 +}
17389 +
17390 +unsigned long
17391 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
17392 + unsigned long len, unsigned long pgoff, unsigned long flags)
17393 +{
17394 + struct mm_struct *mm = current->mm;
17395 + struct vm_area_struct *vma;
17396 + unsigned long start_addr, pax_task_size = TASK_SIZE;
17397 +
17398 +#ifdef CONFIG_PAX_SEGMEXEC
17399 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17400 + pax_task_size = SEGMEXEC_TASK_SIZE;
17401 +#endif
17402 +
17403 + pax_task_size -= PAGE_SIZE;
17404 +
17405 + if (len > pax_task_size)
17406 + return -ENOMEM;
17407 +
17408 + if (flags & MAP_FIXED)
17409 + return addr;
17410 +
17411 +#ifdef CONFIG_PAX_RANDMMAP
17412 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17413 +#endif
17414 +
17415 + if (addr) {
17416 + addr = PAGE_ALIGN(addr);
17417 + if (pax_task_size - len >= addr) {
17418 + vma = find_vma(mm, addr);
17419 + if (check_heap_stack_gap(vma, addr, len))
17420 + return addr;
17421 + }
17422 + }
17423 + if (len > mm->cached_hole_size) {
17424 + start_addr = addr = mm->free_area_cache;
17425 + } else {
17426 + start_addr = addr = mm->mmap_base;
17427 + mm->cached_hole_size = 0;
17428 + }
17429 +
17430 +#ifdef CONFIG_PAX_PAGEEXEC
17431 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17432 + start_addr = 0x00110000UL;
17433 +
17434 +#ifdef CONFIG_PAX_RANDMMAP
17435 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17436 + start_addr += mm->delta_mmap & 0x03FFF000UL;
17437 +#endif
17438 +
17439 + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17440 + start_addr = addr = mm->mmap_base;
17441 + else
17442 + addr = start_addr;
17443 + }
17444 +#endif
17445 +
17446 +full_search:
17447 + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17448 + /* At this point: (!vma || addr < vma->vm_end). */
17449 + if (pax_task_size - len < addr) {
17450 + /*
17451 + * Start a new search - just in case we missed
17452 + * some holes.
17453 + */
17454 + if (start_addr != mm->mmap_base) {
17455 + start_addr = addr = mm->mmap_base;
17456 + mm->cached_hole_size = 0;
17457 + goto full_search;
17458 + }
17459 + return -ENOMEM;
17460 + }
17461 + if (check_heap_stack_gap(vma, addr, len))
17462 + break;
17463 + if (addr + mm->cached_hole_size < vma->vm_start)
17464 + mm->cached_hole_size = vma->vm_start - addr;
17465 + addr = vma->vm_end;
17466 + if (mm->start_brk <= addr && addr < mm->mmap_base) {
17467 + start_addr = addr = mm->mmap_base;
17468 + mm->cached_hole_size = 0;
17469 + goto full_search;
17470 + }
17471 + }
17472 +
17473 + /*
17474 + * Remember the place where we stopped the search:
17475 + */
17476 + mm->free_area_cache = addr + len;
17477 + return addr;
17478 +}
17479 +
17480 +unsigned long
17481 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17482 + const unsigned long len, const unsigned long pgoff,
17483 + const unsigned long flags)
17484 +{
17485 + struct vm_area_struct *vma;
17486 + struct mm_struct *mm = current->mm;
17487 + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17488 +
17489 +#ifdef CONFIG_PAX_SEGMEXEC
17490 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17491 + pax_task_size = SEGMEXEC_TASK_SIZE;
17492 +#endif
17493 +
17494 + pax_task_size -= PAGE_SIZE;
17495 +
17496 + /* requested length too big for entire address space */
17497 + if (len > pax_task_size)
17498 + return -ENOMEM;
17499 +
17500 + if (flags & MAP_FIXED)
17501 + return addr;
17502 +
17503 +#ifdef CONFIG_PAX_PAGEEXEC
17504 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17505 + goto bottomup;
17506 +#endif
17507 +
17508 +#ifdef CONFIG_PAX_RANDMMAP
17509 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17510 +#endif
17511 +
17512 + /* requesting a specific address */
17513 + if (addr) {
17514 + addr = PAGE_ALIGN(addr);
17515 + if (pax_task_size - len >= addr) {
17516 + vma = find_vma(mm, addr);
17517 + if (check_heap_stack_gap(vma, addr, len))
17518 + return addr;
17519 + }
17520 + }
17521 +
17522 + /* check if free_area_cache is useful for us */
17523 + if (len <= mm->cached_hole_size) {
17524 + mm->cached_hole_size = 0;
17525 + mm->free_area_cache = mm->mmap_base;
17526 + }
17527 +
17528 + /* either no address requested or can't fit in requested address hole */
17529 + addr = mm->free_area_cache;
17530 +
17531 + /* make sure it can fit in the remaining address space */
17532 + if (addr > len) {
17533 + vma = find_vma(mm, addr-len);
17534 + if (check_heap_stack_gap(vma, addr - len, len))
17535 + /* remember the address as a hint for next time */
17536 + return (mm->free_area_cache = addr-len);
17537 + }
17538 +
17539 + if (mm->mmap_base < len)
17540 + goto bottomup;
17541 +
17542 + addr = mm->mmap_base-len;
17543 +
17544 + do {
17545 + /*
17546 + * Lookup failure means no vma is above this address,
17547 + * else if new region fits below vma->vm_start,
17548 + * return with success:
17549 + */
17550 + vma = find_vma(mm, addr);
17551 + if (check_heap_stack_gap(vma, addr, len))
17552 + /* remember the address as a hint for next time */
17553 + return (mm->free_area_cache = addr);
17554 +
17555 + /* remember the largest hole we saw so far */
17556 + if (addr + mm->cached_hole_size < vma->vm_start)
17557 + mm->cached_hole_size = vma->vm_start - addr;
17558 +
17559 + /* try just below the current vma->vm_start */
17560 + addr = skip_heap_stack_gap(vma, len);
17561 + } while (!IS_ERR_VALUE(addr));
17562 +
17563 +bottomup:
17564 + /*
17565 + * A failed mmap() very likely causes application failure,
17566 + * so fall back to the bottom-up function here. This scenario
17567 + * can happen with large stack limits and large mmap()
17568 + * allocations.
17569 + */
17570 +
17571 +#ifdef CONFIG_PAX_SEGMEXEC
17572 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17573 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17574 + else
17575 +#endif
17576 +
17577 + mm->mmap_base = TASK_UNMAPPED_BASE;
17578 +
17579 +#ifdef CONFIG_PAX_RANDMMAP
17580 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17581 + mm->mmap_base += mm->delta_mmap;
17582 +#endif
17583 +
17584 + mm->free_area_cache = mm->mmap_base;
17585 + mm->cached_hole_size = ~0UL;
17586 + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17587 + /*
17588 + * Restore the topdown base:
17589 + */
17590 + mm->mmap_base = base;
17591 + mm->free_area_cache = base;
17592 + mm->cached_hole_size = ~0UL;
17593 +
17594 + return addr;
17595 }
17596 diff -urNp linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c
17597 --- linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c 2011-05-19 00:06:34.000000000 -0400
17598 +++ linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c 2011-05-22 19:36:30.000000000 -0400
17599 @@ -32,8 +32,8 @@ out:
17600 return error;
17601 }
17602
17603 -static void find_start_end(unsigned long flags, unsigned long *begin,
17604 - unsigned long *end)
17605 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
17606 + unsigned long *begin, unsigned long *end)
17607 {
17608 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17609 unsigned long new_begin;
17610 @@ -52,7 +52,7 @@ static void find_start_end(unsigned long
17611 *begin = new_begin;
17612 }
17613 } else {
17614 - *begin = TASK_UNMAPPED_BASE;
17615 + *begin = mm->mmap_base;
17616 *end = TASK_SIZE;
17617 }
17618 }
17619 @@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
17620 if (flags & MAP_FIXED)
17621 return addr;
17622
17623 - find_start_end(flags, &begin, &end);
17624 + find_start_end(mm, flags, &begin, &end);
17625
17626 if (len > end)
17627 return -ENOMEM;
17628
17629 +#ifdef CONFIG_PAX_RANDMMAP
17630 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17631 +#endif
17632 +
17633 if (addr) {
17634 addr = PAGE_ALIGN(addr);
17635 vma = find_vma(mm, addr);
17636 - if (end - len >= addr &&
17637 - (!vma || addr + len <= vma->vm_start))
17638 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17639 return addr;
17640 }
17641 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17642 @@ -106,7 +109,7 @@ full_search:
17643 }
17644 return -ENOMEM;
17645 }
17646 - if (!vma || addr + len <= vma->vm_start) {
17647 + if (check_heap_stack_gap(vma, addr, len)) {
17648 /*
17649 * Remember the place where we stopped the search:
17650 */
17651 @@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
17652 {
17653 struct vm_area_struct *vma;
17654 struct mm_struct *mm = current->mm;
17655 - unsigned long addr = addr0;
17656 + unsigned long base = mm->mmap_base, addr = addr0;
17657
17658 /* requested length too big for entire address space */
17659 if (len > TASK_SIZE)
17660 @@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
17661 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17662 goto bottomup;
17663
17664 +#ifdef CONFIG_PAX_RANDMMAP
17665 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17666 +#endif
17667 +
17668 /* requesting a specific address */
17669 if (addr) {
17670 addr = PAGE_ALIGN(addr);
17671 - vma = find_vma(mm, addr);
17672 - if (TASK_SIZE - len >= addr &&
17673 - (!vma || addr + len <= vma->vm_start))
17674 - return addr;
17675 + if (TASK_SIZE - len >= addr) {
17676 + vma = find_vma(mm, addr);
17677 + if (check_heap_stack_gap(vma, addr, len))
17678 + return addr;
17679 + }
17680 }
17681
17682 /* check if free_area_cache is useful for us */
17683 @@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
17684 /* make sure it can fit in the remaining address space */
17685 if (addr > len) {
17686 vma = find_vma(mm, addr-len);
17687 - if (!vma || addr <= vma->vm_start)
17688 + if (check_heap_stack_gap(vma, addr - len, len))
17689 /* remember the address as a hint for next time */
17690 return mm->free_area_cache = addr-len;
17691 }
17692 @@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
17693 * return with success:
17694 */
17695 vma = find_vma(mm, addr);
17696 - if (!vma || addr+len <= vma->vm_start)
17697 + if (check_heap_stack_gap(vma, addr, len))
17698 /* remember the address as a hint for next time */
17699 return mm->free_area_cache = addr;
17700
17701 @@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
17702 mm->cached_hole_size = vma->vm_start - addr;
17703
17704 /* try just below the current vma->vm_start */
17705 - addr = vma->vm_start-len;
17706 - } while (len < vma->vm_start);
17707 + addr = skip_heap_stack_gap(vma, len);
17708 + } while (!IS_ERR_VALUE(addr));
17709
17710 bottomup:
17711 /*
17712 @@ -198,13 +206,21 @@ bottomup:
17713 * can happen with large stack limits and large mmap()
17714 * allocations.
17715 */
17716 + mm->mmap_base = TASK_UNMAPPED_BASE;
17717 +
17718 +#ifdef CONFIG_PAX_RANDMMAP
17719 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17720 + mm->mmap_base += mm->delta_mmap;
17721 +#endif
17722 +
17723 + mm->free_area_cache = mm->mmap_base;
17724 mm->cached_hole_size = ~0UL;
17725 - mm->free_area_cache = TASK_UNMAPPED_BASE;
17726 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17727 /*
17728 * Restore the topdown base:
17729 */
17730 - mm->free_area_cache = mm->mmap_base;
17731 + mm->mmap_base = base;
17732 + mm->free_area_cache = base;
17733 mm->cached_hole_size = ~0UL;
17734
17735 return addr;
17736 diff -urNp linux-2.6.39.1/arch/x86/kernel/tboot.c linux-2.6.39.1/arch/x86/kernel/tboot.c
17737 --- linux-2.6.39.1/arch/x86/kernel/tboot.c 2011-05-19 00:06:34.000000000 -0400
17738 +++ linux-2.6.39.1/arch/x86/kernel/tboot.c 2011-05-22 19:36:30.000000000 -0400
17739 @@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17740
17741 void tboot_shutdown(u32 shutdown_type)
17742 {
17743 - void (*shutdown)(void);
17744 + void (* __noreturn shutdown)(void);
17745
17746 if (!tboot_enabled())
17747 return;
17748 @@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17749
17750 switch_to_tboot_pt();
17751
17752 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17753 + shutdown = (void *)tboot->shutdown_entry;
17754 shutdown();
17755
17756 /* should not reach here */
17757 @@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
17758 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17759 }
17760
17761 -static atomic_t ap_wfs_count;
17762 +static atomic_unchecked_t ap_wfs_count;
17763
17764 static int tboot_wait_for_aps(int num_aps)
17765 {
17766 @@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(
17767 {
17768 switch (action) {
17769 case CPU_DYING:
17770 - atomic_inc(&ap_wfs_count);
17771 + atomic_inc_unchecked(&ap_wfs_count);
17772 if (num_online_cpus() == 1)
17773 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17774 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17775 return NOTIFY_BAD;
17776 break;
17777 }
17778 @@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17779
17780 tboot_create_trampoline();
17781
17782 - atomic_set(&ap_wfs_count, 0);
17783 + atomic_set_unchecked(&ap_wfs_count, 0);
17784 register_hotcpu_notifier(&tboot_cpu_notifier);
17785 return 0;
17786 }
17787 diff -urNp linux-2.6.39.1/arch/x86/kernel/time.c linux-2.6.39.1/arch/x86/kernel/time.c
17788 --- linux-2.6.39.1/arch/x86/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
17789 +++ linux-2.6.39.1/arch/x86/kernel/time.c 2011-05-22 19:36:30.000000000 -0400
17790 @@ -22,17 +22,13 @@
17791 #include <asm/hpet.h>
17792 #include <asm/time.h>
17793
17794 -#ifdef CONFIG_X86_64
17795 -volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
17796 -#endif
17797 -
17798 unsigned long profile_pc(struct pt_regs *regs)
17799 {
17800 unsigned long pc = instruction_pointer(regs);
17801
17802 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17803 + if (!user_mode(regs) && in_lock_functions(pc)) {
17804 #ifdef CONFIG_FRAME_POINTER
17805 - return *(unsigned long *)(regs->bp + sizeof(long));
17806 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17807 #else
17808 unsigned long *sp =
17809 (unsigned long *)kernel_stack_pointer(regs);
17810 @@ -41,11 +37,17 @@ unsigned long profile_pc(struct pt_regs
17811 * or above a saved flags. Eflags has bits 22-31 zero,
17812 * kernel addresses don't.
17813 */
17814 +
17815 +#ifdef CONFIG_PAX_KERNEXEC
17816 + return ktla_ktva(sp[0]);
17817 +#else
17818 if (sp[0] >> 22)
17819 return sp[0];
17820 if (sp[1] >> 22)
17821 return sp[1];
17822 #endif
17823 +
17824 +#endif
17825 }
17826 return pc;
17827 }
17828 diff -urNp linux-2.6.39.1/arch/x86/kernel/tls.c linux-2.6.39.1/arch/x86/kernel/tls.c
17829 --- linux-2.6.39.1/arch/x86/kernel/tls.c 2011-05-19 00:06:34.000000000 -0400
17830 +++ linux-2.6.39.1/arch/x86/kernel/tls.c 2011-05-22 19:36:30.000000000 -0400
17831 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
17832 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17833 return -EINVAL;
17834
17835 +#ifdef CONFIG_PAX_SEGMEXEC
17836 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17837 + return -EINVAL;
17838 +#endif
17839 +
17840 set_tls_desc(p, idx, &info, 1);
17841
17842 return 0;
17843 diff -urNp linux-2.6.39.1/arch/x86/kernel/trampoline_32.S linux-2.6.39.1/arch/x86/kernel/trampoline_32.S
17844 --- linux-2.6.39.1/arch/x86/kernel/trampoline_32.S 2011-05-19 00:06:34.000000000 -0400
17845 +++ linux-2.6.39.1/arch/x86/kernel/trampoline_32.S 2011-05-22 19:36:30.000000000 -0400
17846 @@ -32,6 +32,12 @@
17847 #include <asm/segment.h>
17848 #include <asm/page_types.h>
17849
17850 +#ifdef CONFIG_PAX_KERNEXEC
17851 +#define ta(X) (X)
17852 +#else
17853 +#define ta(X) ((X) - __PAGE_OFFSET)
17854 +#endif
17855 +
17856 #ifdef CONFIG_SMP
17857
17858 .section ".x86_trampoline","a"
17859 @@ -62,7 +68,7 @@ r_base = .
17860 inc %ax # protected mode (PE) bit
17861 lmsw %ax # into protected mode
17862 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17863 - ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17864 + ljmpl $__BOOT_CS, $ta(startup_32_smp)
17865
17866 # These need to be in the same 64K segment as the above;
17867 # hence we don't use the boot_gdt_descr defined in head.S
17868 diff -urNp linux-2.6.39.1/arch/x86/kernel/trampoline_64.S linux-2.6.39.1/arch/x86/kernel/trampoline_64.S
17869 --- linux-2.6.39.1/arch/x86/kernel/trampoline_64.S 2011-05-19 00:06:34.000000000 -0400
17870 +++ linux-2.6.39.1/arch/x86/kernel/trampoline_64.S 2011-05-22 19:36:30.000000000 -0400
17871 @@ -90,7 +90,7 @@ startup_32:
17872 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17873 movl %eax, %ds
17874
17875 - movl $X86_CR4_PAE, %eax
17876 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17877 movl %eax, %cr4 # Enable PAE mode
17878
17879 # Setup trampoline 4 level pagetables
17880 @@ -138,7 +138,7 @@ tidt:
17881 # so the kernel can live anywhere
17882 .balign 4
17883 tgdt:
17884 - .short tgdt_end - tgdt # gdt limit
17885 + .short tgdt_end - tgdt - 1 # gdt limit
17886 .long tgdt - r_base
17887 .short 0
17888 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17889 diff -urNp linux-2.6.39.1/arch/x86/kernel/traps.c linux-2.6.39.1/arch/x86/kernel/traps.c
17890 --- linux-2.6.39.1/arch/x86/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
17891 +++ linux-2.6.39.1/arch/x86/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
17892 @@ -70,12 +70,6 @@ asmlinkage int system_call(void);
17893
17894 /* Do we ignore FPU interrupts ? */
17895 char ignore_fpu_irq;
17896 -
17897 -/*
17898 - * The IDT has to be page-aligned to simplify the Pentium
17899 - * F0 0F bug workaround.
17900 - */
17901 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17902 #endif
17903
17904 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17905 @@ -117,13 +111,13 @@ static inline void preempt_conditional_c
17906 }
17907
17908 static void __kprobes
17909 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17910 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17911 long error_code, siginfo_t *info)
17912 {
17913 struct task_struct *tsk = current;
17914
17915 #ifdef CONFIG_X86_32
17916 - if (regs->flags & X86_VM_MASK) {
17917 + if (v8086_mode(regs)) {
17918 /*
17919 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17920 * On nmi (interrupt 2), do_trap should not be called.
17921 @@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str
17922 }
17923 #endif
17924
17925 - if (!user_mode(regs))
17926 + if (!user_mode_novm(regs))
17927 goto kernel_trap;
17928
17929 #ifdef CONFIG_X86_32
17930 @@ -157,7 +151,7 @@ trap_signal:
17931 printk_ratelimit()) {
17932 printk(KERN_INFO
17933 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17934 - tsk->comm, tsk->pid, str,
17935 + tsk->comm, task_pid_nr(tsk), str,
17936 regs->ip, regs->sp, error_code);
17937 print_vma_addr(" in ", regs->ip);
17938 printk("\n");
17939 @@ -174,8 +168,20 @@ kernel_trap:
17940 if (!fixup_exception(regs)) {
17941 tsk->thread.error_code = error_code;
17942 tsk->thread.trap_no = trapnr;
17943 +
17944 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17945 + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17946 + str = "PAX: suspicious stack segment fault";
17947 +#endif
17948 +
17949 die(str, regs, error_code);
17950 }
17951 +
17952 +#ifdef CONFIG_PAX_REFCOUNT
17953 + if (trapnr == 4)
17954 + pax_report_refcount_overflow(regs);
17955 +#endif
17956 +
17957 return;
17958
17959 #ifdef CONFIG_X86_32
17960 @@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re
17961 conditional_sti(regs);
17962
17963 #ifdef CONFIG_X86_32
17964 - if (regs->flags & X86_VM_MASK)
17965 + if (v8086_mode(regs))
17966 goto gp_in_vm86;
17967 #endif
17968
17969 tsk = current;
17970 - if (!user_mode(regs))
17971 + if (!user_mode_novm(regs))
17972 goto gp_in_kernel;
17973
17974 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17975 + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17976 + struct mm_struct *mm = tsk->mm;
17977 + unsigned long limit;
17978 +
17979 + down_write(&mm->mmap_sem);
17980 + limit = mm->context.user_cs_limit;
17981 + if (limit < TASK_SIZE) {
17982 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17983 + up_write(&mm->mmap_sem);
17984 + return;
17985 + }
17986 + up_write(&mm->mmap_sem);
17987 + }
17988 +#endif
17989 +
17990 tsk->thread.error_code = error_code;
17991 tsk->thread.trap_no = 13;
17992
17993 @@ -304,6 +326,13 @@ gp_in_kernel:
17994 if (notify_die(DIE_GPF, "general protection fault", regs,
17995 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17996 return;
17997 +
17998 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17999 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
18000 + die("PAX: suspicious general protection fault", regs, error_code);
18001 + else
18002 +#endif
18003 +
18004 die("general protection fault", regs, error_code);
18005 }
18006
18007 @@ -569,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
18008 /* It's safe to allow irq's after DR6 has been saved */
18009 preempt_conditional_sti(regs);
18010
18011 - if (regs->flags & X86_VM_MASK) {
18012 + if (v8086_mode(regs)) {
18013 handle_vm86_trap((struct kernel_vm86_regs *) regs,
18014 error_code, 1);
18015 preempt_conditional_cli(regs);
18016 @@ -583,7 +612,7 @@ dotraplinkage void __kprobes do_debug(st
18017 * We already checked v86 mode above, so we can check for kernel mode
18018 * by just checking the CPL of CS.
18019 */
18020 - if ((dr6 & DR_STEP) && !user_mode(regs)) {
18021 + if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
18022 tsk->thread.debugreg6 &= ~DR_STEP;
18023 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
18024 regs->flags &= ~X86_EFLAGS_TF;
18025 @@ -612,7 +641,7 @@ void math_error(struct pt_regs *regs, in
18026 return;
18027 conditional_sti(regs);
18028
18029 - if (!user_mode_vm(regs))
18030 + if (!user_mode(regs))
18031 {
18032 if (!fixup_exception(regs)) {
18033 task->thread.error_code = error_code;
18034 @@ -723,7 +752,7 @@ asmlinkage void __attribute__((weak)) sm
18035 void __math_state_restore(void)
18036 {
18037 struct thread_info *thread = current_thread_info();
18038 - struct task_struct *tsk = thread->task;
18039 + struct task_struct *tsk = current;
18040
18041 /*
18042 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
18043 @@ -750,8 +779,7 @@ void __math_state_restore(void)
18044 */
18045 asmlinkage void math_state_restore(void)
18046 {
18047 - struct thread_info *thread = current_thread_info();
18048 - struct task_struct *tsk = thread->task;
18049 + struct task_struct *tsk = current;
18050
18051 if (!tsk_used_math(tsk)) {
18052 local_irq_enable();
18053 diff -urNp linux-2.6.39.1/arch/x86/kernel/vm86_32.c linux-2.6.39.1/arch/x86/kernel/vm86_32.c
18054 --- linux-2.6.39.1/arch/x86/kernel/vm86_32.c 2011-05-19 00:06:34.000000000 -0400
18055 +++ linux-2.6.39.1/arch/x86/kernel/vm86_32.c 2011-05-22 19:41:32.000000000 -0400
18056 @@ -41,6 +41,7 @@
18057 #include <linux/ptrace.h>
18058 #include <linux/audit.h>
18059 #include <linux/stddef.h>
18060 +#include <linux/grsecurity.h>
18061
18062 #include <asm/uaccess.h>
18063 #include <asm/io.h>
18064 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
18065 do_exit(SIGSEGV);
18066 }
18067
18068 - tss = &per_cpu(init_tss, get_cpu());
18069 + tss = init_tss + get_cpu();
18070 current->thread.sp0 = current->thread.saved_sp0;
18071 current->thread.sysenter_cs = __KERNEL_CS;
18072 load_sp0(tss, &current->thread);
18073 @@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use
18074 struct task_struct *tsk;
18075 int tmp, ret = -EPERM;
18076
18077 +#ifdef CONFIG_GRKERNSEC_VM86
18078 + if (!capable(CAP_SYS_RAWIO)) {
18079 + gr_handle_vm86();
18080 + goto out;
18081 + }
18082 +#endif
18083 +
18084 tsk = current;
18085 if (tsk->thread.saved_sp0)
18086 goto out;
18087 @@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned
18088 int tmp, ret;
18089 struct vm86plus_struct __user *v86;
18090
18091 +#ifdef CONFIG_GRKERNSEC_VM86
18092 + if (!capable(CAP_SYS_RAWIO)) {
18093 + gr_handle_vm86();
18094 + ret = -EPERM;
18095 + goto out;
18096 + }
18097 +#endif
18098 +
18099 tsk = current;
18100 switch (cmd) {
18101 case VM86_REQUEST_IRQ:
18102 @@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
18103 tsk->thread.saved_fs = info->regs32->fs;
18104 tsk->thread.saved_gs = get_user_gs(info->regs32);
18105
18106 - tss = &per_cpu(init_tss, get_cpu());
18107 + tss = init_tss + get_cpu();
18108 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
18109 if (cpu_has_sep)
18110 tsk->thread.sysenter_cs = 0;
18111 @@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
18112 goto cannot_handle;
18113 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
18114 goto cannot_handle;
18115 - intr_ptr = (unsigned long __user *) (i << 2);
18116 + intr_ptr = (__force unsigned long __user *) (i << 2);
18117 if (get_user(segoffs, intr_ptr))
18118 goto cannot_handle;
18119 if ((segoffs >> 16) == BIOSSEG)
18120 diff -urNp linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S
18121 --- linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
18122 +++ linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
18123 @@ -26,6 +26,13 @@
18124 #include <asm/page_types.h>
18125 #include <asm/cache.h>
18126 #include <asm/boot.h>
18127 +#include <asm/segment.h>
18128 +
18129 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18130 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
18131 +#else
18132 +#define __KERNEL_TEXT_OFFSET 0
18133 +#endif
18134
18135 #undef i386 /* in case the preprocessor is a 32bit one */
18136
18137 @@ -34,11 +41,9 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
18138 #ifdef CONFIG_X86_32
18139 OUTPUT_ARCH(i386)
18140 ENTRY(phys_startup_32)
18141 -jiffies = jiffies_64;
18142 #else
18143 OUTPUT_ARCH(i386:x86-64)
18144 ENTRY(phys_startup_64)
18145 -jiffies_64 = jiffies;
18146 #endif
18147
18148 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
18149 @@ -69,31 +74,46 @@ jiffies_64 = jiffies;
18150
18151 PHDRS {
18152 text PT_LOAD FLAGS(5); /* R_E */
18153 +#ifdef CONFIG_X86_32
18154 + module PT_LOAD FLAGS(5); /* R_E */
18155 +#endif
18156 +#ifdef CONFIG_XEN
18157 + rodata PT_LOAD FLAGS(5); /* R_E */
18158 +#else
18159 + rodata PT_LOAD FLAGS(4); /* R__ */
18160 +#endif
18161 data PT_LOAD FLAGS(6); /* RW_ */
18162 #ifdef CONFIG_X86_64
18163 user PT_LOAD FLAGS(5); /* R_E */
18164 +#endif
18165 + init.begin PT_LOAD FLAGS(6); /* RW_ */
18166 #ifdef CONFIG_SMP
18167 percpu PT_LOAD FLAGS(6); /* RW_ */
18168 #endif
18169 + text.init PT_LOAD FLAGS(5); /* R_E */
18170 + text.exit PT_LOAD FLAGS(5); /* R_E */
18171 init PT_LOAD FLAGS(7); /* RWE */
18172 -#endif
18173 note PT_NOTE FLAGS(0); /* ___ */
18174 }
18175
18176 SECTIONS
18177 {
18178 #ifdef CONFIG_X86_32
18179 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
18180 - phys_startup_32 = startup_32 - LOAD_OFFSET;
18181 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
18182 #else
18183 - . = __START_KERNEL;
18184 - phys_startup_64 = startup_64 - LOAD_OFFSET;
18185 + . = __START_KERNEL;
18186 #endif
18187
18188 /* Text and read-only data */
18189 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
18190 - _text = .;
18191 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18192 /* bootstrapping code */
18193 +#ifdef CONFIG_X86_32
18194 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18195 +#else
18196 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18197 +#endif
18198 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18199 + _text = .;
18200 HEAD_TEXT
18201 #ifdef CONFIG_X86_32
18202 . = ALIGN(PAGE_SIZE);
18203 @@ -109,13 +129,47 @@ SECTIONS
18204 IRQENTRY_TEXT
18205 *(.fixup)
18206 *(.gnu.warning)
18207 - /* End of text section */
18208 - _etext = .;
18209 } :text = 0x9090
18210
18211 - NOTES :text :note
18212 + . += __KERNEL_TEXT_OFFSET;
18213 +
18214 +#ifdef CONFIG_X86_32
18215 + . = ALIGN(PAGE_SIZE);
18216 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
18217 +
18218 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
18219 + MODULES_EXEC_VADDR = .;
18220 + BYTE(0)
18221 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
18222 + . = ALIGN(HPAGE_SIZE);
18223 + MODULES_EXEC_END = . - 1;
18224 +#endif
18225 +
18226 + } :module
18227 +#endif
18228 +
18229 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
18230 + /* End of text section */
18231 + _etext = . - __KERNEL_TEXT_OFFSET;
18232 + }
18233
18234 - EXCEPTION_TABLE(16) :text = 0x9090
18235 +#ifdef CONFIG_X86_32
18236 + . = ALIGN(PAGE_SIZE);
18237 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
18238 + *(.idt)
18239 + . = ALIGN(PAGE_SIZE);
18240 + *(.empty_zero_page)
18241 + *(.initial_pg_fixmap)
18242 + *(.initial_pg_pmd)
18243 + *(.initial_page_table)
18244 + *(.swapper_pg_dir)
18245 + } :rodata
18246 +#endif
18247 +
18248 + . = ALIGN(PAGE_SIZE);
18249 + NOTES :rodata :note
18250 +
18251 + EXCEPTION_TABLE(16) :rodata
18252
18253 #if defined(CONFIG_DEBUG_RODATA)
18254 /* .text should occupy whole number of pages */
18255 @@ -127,16 +181,20 @@ SECTIONS
18256
18257 /* Data */
18258 .data : AT(ADDR(.data) - LOAD_OFFSET) {
18259 +
18260 +#ifdef CONFIG_PAX_KERNEXEC
18261 + . = ALIGN(HPAGE_SIZE);
18262 +#else
18263 + . = ALIGN(PAGE_SIZE);
18264 +#endif
18265 +
18266 /* Start of data section */
18267 _sdata = .;
18268
18269 /* init_task */
18270 INIT_TASK_DATA(THREAD_SIZE)
18271
18272 -#ifdef CONFIG_X86_32
18273 - /* 32 bit has nosave before _edata */
18274 NOSAVE_DATA
18275 -#endif
18276
18277 PAGE_ALIGNED_DATA(PAGE_SIZE)
18278
18279 @@ -145,6 +203,8 @@ SECTIONS
18280 DATA_DATA
18281 CONSTRUCTORS
18282
18283 + jiffies = jiffies_64;
18284 +
18285 /* rarely changed data like cpu maps */
18286 READ_MOSTLY_DATA(INTERNODE_CACHE_BYTES)
18287
18288 @@ -199,12 +259,6 @@ SECTIONS
18289 }
18290 vgetcpu_mode = VVIRT(.vgetcpu_mode);
18291
18292 - . = ALIGN(L1_CACHE_BYTES);
18293 - .jiffies : AT(VLOAD(.jiffies)) {
18294 - *(.jiffies)
18295 - }
18296 - jiffies = VVIRT(.jiffies);
18297 -
18298 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
18299 *(.vsyscall_3)
18300 }
18301 @@ -220,12 +274,19 @@ SECTIONS
18302 #endif /* CONFIG_X86_64 */
18303
18304 /* Init code and data - will be freed after init */
18305 - . = ALIGN(PAGE_SIZE);
18306 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
18307 + BYTE(0)
18308 +
18309 +#ifdef CONFIG_PAX_KERNEXEC
18310 + . = ALIGN(HPAGE_SIZE);
18311 +#else
18312 + . = ALIGN(PAGE_SIZE);
18313 +#endif
18314 +
18315 __init_begin = .; /* paired with __init_end */
18316 - }
18317 + } :init.begin
18318
18319 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
18320 +#ifdef CONFIG_SMP
18321 /*
18322 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
18323 * output PHDR, so the next output section - .init.text - should
18324 @@ -234,12 +295,27 @@ SECTIONS
18325 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
18326 #endif
18327
18328 - INIT_TEXT_SECTION(PAGE_SIZE)
18329 -#ifdef CONFIG_X86_64
18330 - :init
18331 -#endif
18332 + . = ALIGN(PAGE_SIZE);
18333 + init_begin = .;
18334 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
18335 + VMLINUX_SYMBOL(_sinittext) = .;
18336 + INIT_TEXT
18337 + VMLINUX_SYMBOL(_einittext) = .;
18338 + . = ALIGN(PAGE_SIZE);
18339 + } :text.init
18340
18341 - INIT_DATA_SECTION(16)
18342 + /*
18343 + * .exit.text is discard at runtime, not link time, to deal with
18344 + * references from .altinstructions and .eh_frame
18345 + */
18346 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18347 + EXIT_TEXT
18348 + . = ALIGN(16);
18349 + } :text.exit
18350 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
18351 +
18352 + . = ALIGN(PAGE_SIZE);
18353 + INIT_DATA_SECTION(16) :init
18354
18355 /*
18356 * Code and data for a variety of lowlevel trampolines, to be
18357 @@ -306,19 +382,12 @@ SECTIONS
18358 }
18359
18360 . = ALIGN(8);
18361 - /*
18362 - * .exit.text is discard at runtime, not link time, to deal with
18363 - * references from .altinstructions and .eh_frame
18364 - */
18365 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
18366 - EXIT_TEXT
18367 - }
18368
18369 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
18370 EXIT_DATA
18371 }
18372
18373 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
18374 +#ifndef CONFIG_SMP
18375 PERCPU(INTERNODE_CACHE_BYTES, PAGE_SIZE)
18376 #endif
18377
18378 @@ -337,16 +406,10 @@ SECTIONS
18379 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
18380 __smp_locks = .;
18381 *(.smp_locks)
18382 - . = ALIGN(PAGE_SIZE);
18383 __smp_locks_end = .;
18384 + . = ALIGN(PAGE_SIZE);
18385 }
18386
18387 -#ifdef CONFIG_X86_64
18388 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
18389 - NOSAVE_DATA
18390 - }
18391 -#endif
18392 -
18393 /* BSS */
18394 . = ALIGN(PAGE_SIZE);
18395 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
18396 @@ -362,6 +425,7 @@ SECTIONS
18397 __brk_base = .;
18398 . += 64 * 1024; /* 64k alignment slop space */
18399 *(.brk_reservation) /* areas brk users have reserved */
18400 + . = ALIGN(HPAGE_SIZE);
18401 __brk_limit = .;
18402 }
18403
18404 @@ -388,13 +452,12 @@ SECTIONS
18405 * for the boot processor.
18406 */
18407 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18408 -INIT_PER_CPU(gdt_page);
18409 INIT_PER_CPU(irq_stack_union);
18410
18411 /*
18412 * Build-time check on the image size:
18413 */
18414 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18415 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18416 "kernel image bigger than KERNEL_IMAGE_SIZE");
18417
18418 #ifdef CONFIG_SMP
18419 diff -urNp linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c
18420 --- linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c 2011-05-19 00:06:34.000000000 -0400
18421 +++ linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c 2011-05-22 19:36:30.000000000 -0400
18422 @@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
18423
18424 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
18425 /* copy vsyscall data */
18426 + strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
18427 vsyscall_gtod_data.clock.vread = clock->vread;
18428 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
18429 vsyscall_gtod_data.clock.mask = clock->mask;
18430 @@ -208,7 +209,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
18431 We do this here because otherwise user space would do it on
18432 its own in a likely inferior way (no access to jiffies).
18433 If you don't like it pass NULL. */
18434 - if (tcache && tcache->blob[0] == (j = __jiffies)) {
18435 + if (tcache && tcache->blob[0] == (j = jiffies)) {
18436 p = tcache->blob[1];
18437 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
18438 /* Load per CPU data from RDTSCP */
18439 diff -urNp linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c
18440 --- linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c 2011-05-19 00:06:34.000000000 -0400
18441 +++ linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c 2011-05-22 19:36:30.000000000 -0400
18442 @@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18443 EXPORT_SYMBOL(copy_user_generic_string);
18444 EXPORT_SYMBOL(copy_user_generic_unrolled);
18445 EXPORT_SYMBOL(__copy_user_nocache);
18446 -EXPORT_SYMBOL(_copy_from_user);
18447 -EXPORT_SYMBOL(_copy_to_user);
18448
18449 EXPORT_SYMBOL(copy_page);
18450 EXPORT_SYMBOL(clear_page);
18451 diff -urNp linux-2.6.39.1/arch/x86/kernel/xsave.c linux-2.6.39.1/arch/x86/kernel/xsave.c
18452 --- linux-2.6.39.1/arch/x86/kernel/xsave.c 2011-05-19 00:06:34.000000000 -0400
18453 +++ linux-2.6.39.1/arch/x86/kernel/xsave.c 2011-05-22 19:36:30.000000000 -0400
18454 @@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
18455 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18456 return -EINVAL;
18457
18458 - err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18459 + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18460 fx_sw_user->extended_size -
18461 FP_XSTATE_MAGIC2_SIZE));
18462 if (err)
18463 @@ -267,7 +267,7 @@ fx_only:
18464 * the other extended state.
18465 */
18466 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18467 - return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18468 + return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
18469 }
18470
18471 /*
18472 @@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf
18473 if (use_xsave())
18474 err = restore_user_xstate(buf);
18475 else
18476 - err = fxrstor_checking((__force struct i387_fxsave_struct *)
18477 + err = fxrstor_checking((struct i387_fxsave_struct __user *)
18478 buf);
18479 if (unlikely(err)) {
18480 /*
18481 diff -urNp linux-2.6.39.1/arch/x86/kvm/emulate.c linux-2.6.39.1/arch/x86/kvm/emulate.c
18482 --- linux-2.6.39.1/arch/x86/kvm/emulate.c 2011-05-19 00:06:34.000000000 -0400
18483 +++ linux-2.6.39.1/arch/x86/kvm/emulate.c 2011-05-22 19:36:30.000000000 -0400
18484 @@ -89,7 +89,7 @@
18485 #define Src2ImmByte (2<<29)
18486 #define Src2One (3<<29)
18487 #define Src2Imm (4<<29)
18488 -#define Src2Mask (7<<29)
18489 +#define Src2Mask (7U<<29)
18490
18491 #define X2(x...) x, x
18492 #define X3(x...) X2(x), x
18493 @@ -190,6 +190,7 @@ struct group_dual {
18494
18495 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18496 do { \
18497 + unsigned long _tmp; \
18498 __asm__ __volatile__ ( \
18499 _PRE_EFLAGS("0", "4", "2") \
18500 _op _suffix " %"_x"3,%1; " \
18501 @@ -203,8 +204,6 @@ struct group_dual {
18502 /* Raw emulation: instruction has two explicit operands. */
18503 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18504 do { \
18505 - unsigned long _tmp; \
18506 - \
18507 switch ((_dst).bytes) { \
18508 case 2: \
18509 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18510 @@ -220,7 +219,6 @@ struct group_dual {
18511
18512 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18513 do { \
18514 - unsigned long _tmp; \
18515 switch ((_dst).bytes) { \
18516 case 1: \
18517 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18518 diff -urNp linux-2.6.39.1/arch/x86/kvm/lapic.c linux-2.6.39.1/arch/x86/kvm/lapic.c
18519 --- linux-2.6.39.1/arch/x86/kvm/lapic.c 2011-05-19 00:06:34.000000000 -0400
18520 +++ linux-2.6.39.1/arch/x86/kvm/lapic.c 2011-05-22 19:36:30.000000000 -0400
18521 @@ -53,7 +53,7 @@
18522 #define APIC_BUS_CYCLE_NS 1
18523
18524 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18525 -#define apic_debug(fmt, arg...)
18526 +#define apic_debug(fmt, arg...) do {} while (0)
18527
18528 #define APIC_LVT_NUM 6
18529 /* 14 is the version for Xeon and Pentium 8.4.8*/
18530 diff -urNp linux-2.6.39.1/arch/x86/kvm/mmu.c linux-2.6.39.1/arch/x86/kvm/mmu.c
18531 --- linux-2.6.39.1/arch/x86/kvm/mmu.c 2011-05-19 00:06:34.000000000 -0400
18532 +++ linux-2.6.39.1/arch/x86/kvm/mmu.c 2011-05-22 19:36:30.000000000 -0400
18533 @@ -3240,7 +3240,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18534
18535 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18536
18537 - invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18538 + invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18539
18540 /*
18541 * Assume that the pte write on a page table of the same type
18542 @@ -3275,7 +3275,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18543 smp_rmb();
18544
18545 spin_lock(&vcpu->kvm->mmu_lock);
18546 - if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18547 + if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18548 gentry = 0;
18549 kvm_mmu_free_some_pages(vcpu);
18550 ++vcpu->kvm->stat.mmu_pte_write;
18551 diff -urNp linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h
18552 --- linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h 2011-05-19 00:06:34.000000000 -0400
18553 +++ linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h 2011-05-22 19:36:30.000000000 -0400
18554 @@ -552,6 +552,8 @@ static int FNAME(page_fault)(struct kvm_
18555 unsigned long mmu_seq;
18556 bool map_writable;
18557
18558 + pax_track_stack();
18559 +
18560 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18561
18562 r = mmu_topup_memory_caches(vcpu);
18563 @@ -672,7 +674,7 @@ static void FNAME(invlpg)(struct kvm_vcp
18564 if (need_flush)
18565 kvm_flush_remote_tlbs(vcpu->kvm);
18566
18567 - atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18568 + atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18569
18570 spin_unlock(&vcpu->kvm->mmu_lock);
18571
18572 diff -urNp linux-2.6.39.1/arch/x86/kvm/svm.c linux-2.6.39.1/arch/x86/kvm/svm.c
18573 --- linux-2.6.39.1/arch/x86/kvm/svm.c 2011-05-19 00:06:34.000000000 -0400
18574 +++ linux-2.6.39.1/arch/x86/kvm/svm.c 2011-05-22 19:36:30.000000000 -0400
18575 @@ -3278,7 +3278,11 @@ static void reload_tss(struct kvm_vcpu *
18576 int cpu = raw_smp_processor_id();
18577
18578 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18579 +
18580 + pax_open_kernel();
18581 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18582 + pax_close_kernel();
18583 +
18584 load_TR_desc();
18585 }
18586
18587 @@ -3656,6 +3660,10 @@ static void svm_vcpu_run(struct kvm_vcpu
18588 #endif
18589 #endif
18590
18591 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18592 + __set_fs(current_thread_info()->addr_limit);
18593 +#endif
18594 +
18595 reload_tss(vcpu);
18596
18597 local_irq_disable();
18598 @@ -3871,7 +3879,7 @@ static void svm_fpu_deactivate(struct kv
18599 update_cr0_intercept(svm);
18600 }
18601
18602 -static struct kvm_x86_ops svm_x86_ops = {
18603 +static const struct kvm_x86_ops svm_x86_ops = {
18604 .cpu_has_kvm_support = has_svm,
18605 .disabled_by_bios = is_disabled,
18606 .hardware_setup = svm_hardware_setup,
18607 diff -urNp linux-2.6.39.1/arch/x86/kvm/vmx.c linux-2.6.39.1/arch/x86/kvm/vmx.c
18608 --- linux-2.6.39.1/arch/x86/kvm/vmx.c 2011-05-19 00:06:34.000000000 -0400
18609 +++ linux-2.6.39.1/arch/x86/kvm/vmx.c 2011-05-22 19:36:30.000000000 -0400
18610 @@ -725,7 +725,11 @@ static void reload_tss(void)
18611 struct desc_struct *descs;
18612
18613 descs = (void *)gdt->address;
18614 +
18615 + pax_open_kernel();
18616 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18617 + pax_close_kernel();
18618 +
18619 load_TR_desc();
18620 }
18621
18622 @@ -1648,8 +1652,11 @@ static __init int hardware_setup(void)
18623 if (!cpu_has_vmx_flexpriority())
18624 flexpriority_enabled = 0;
18625
18626 - if (!cpu_has_vmx_tpr_shadow())
18627 - kvm_x86_ops->update_cr8_intercept = NULL;
18628 + if (!cpu_has_vmx_tpr_shadow()) {
18629 + pax_open_kernel();
18630 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18631 + pax_close_kernel();
18632 + }
18633
18634 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18635 kvm_disable_largepages();
18636 @@ -2693,7 +2700,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
18637 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18638
18639 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
18640 - vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
18641 + vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
18642 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
18643 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
18644 vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
18645 @@ -4068,6 +4075,12 @@ static void __noclone vmx_vcpu_run(struc
18646 "jmp .Lkvm_vmx_return \n\t"
18647 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18648 ".Lkvm_vmx_return: "
18649 +
18650 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18651 + "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18652 + ".Lkvm_vmx_return2: "
18653 +#endif
18654 +
18655 /* Save guest registers, load host registers, keep flags */
18656 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18657 "pop %0 \n\t"
18658 @@ -4116,6 +4129,11 @@ static void __noclone vmx_vcpu_run(struc
18659 #endif
18660 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18661 [wordsize]"i"(sizeof(ulong))
18662 +
18663 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18664 + ,[cs]"i"(__KERNEL_CS)
18665 +#endif
18666 +
18667 : "cc", "memory"
18668 , R"ax", R"bx", R"di", R"si"
18669 #ifdef CONFIG_X86_64
18670 @@ -4130,7 +4148,16 @@ static void __noclone vmx_vcpu_run(struc
18671
18672 vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
18673
18674 - asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18675 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18676 +
18677 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18678 + loadsegment(fs, __KERNEL_PERCPU);
18679 +#endif
18680 +
18681 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18682 + __set_fs(current_thread_info()->addr_limit);
18683 +#endif
18684 +
18685 vmx->launched = 1;
18686
18687 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18688 @@ -4368,7 +4395,7 @@ static void vmx_set_supported_cpuid(u32
18689 {
18690 }
18691
18692 -static struct kvm_x86_ops vmx_x86_ops = {
18693 +static const struct kvm_x86_ops vmx_x86_ops = {
18694 .cpu_has_kvm_support = cpu_has_kvm_support,
18695 .disabled_by_bios = vmx_disabled_by_bios,
18696 .hardware_setup = hardware_setup,
18697 diff -urNp linux-2.6.39.1/arch/x86/kvm/x86.c linux-2.6.39.1/arch/x86/kvm/x86.c
18698 --- linux-2.6.39.1/arch/x86/kvm/x86.c 2011-05-19 00:06:34.000000000 -0400
18699 +++ linux-2.6.39.1/arch/x86/kvm/x86.c 2011-05-22 19:36:30.000000000 -0400
18700 @@ -94,7 +94,7 @@ static void update_cr8_intercept(struct
18701 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
18702 struct kvm_cpuid_entry2 __user *entries);
18703
18704 -struct kvm_x86_ops *kvm_x86_ops;
18705 +const struct kvm_x86_ops *kvm_x86_ops;
18706 EXPORT_SYMBOL_GPL(kvm_x86_ops);
18707
18708 int ignore_msrs = 0;
18709 @@ -2050,6 +2050,8 @@ long kvm_arch_dev_ioctl(struct file *fil
18710 if (n < msr_list.nmsrs)
18711 goto out;
18712 r = -EFAULT;
18713 + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18714 + goto out;
18715 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18716 num_msrs_to_save * sizeof(u32)))
18717 goto out;
18718 @@ -2217,15 +2219,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
18719 struct kvm_cpuid2 *cpuid,
18720 struct kvm_cpuid_entry2 __user *entries)
18721 {
18722 - int r;
18723 + int r, i;
18724
18725 r = -E2BIG;
18726 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18727 goto out;
18728 r = -EFAULT;
18729 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18730 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18731 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18732 goto out;
18733 + for (i = 0; i < cpuid->nent; ++i) {
18734 + struct kvm_cpuid_entry2 cpuid_entry;
18735 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18736 + goto out;
18737 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
18738 + }
18739 vcpu->arch.cpuid_nent = cpuid->nent;
18740 kvm_apic_set_version(vcpu);
18741 kvm_x86_ops->cpuid_update(vcpu);
18742 @@ -2240,15 +2247,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
18743 struct kvm_cpuid2 *cpuid,
18744 struct kvm_cpuid_entry2 __user *entries)
18745 {
18746 - int r;
18747 + int r, i;
18748
18749 r = -E2BIG;
18750 if (cpuid->nent < vcpu->arch.cpuid_nent)
18751 goto out;
18752 r = -EFAULT;
18753 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18754 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18755 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18756 goto out;
18757 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18758 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18759 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18760 + goto out;
18761 + }
18762 return 0;
18763
18764 out:
18765 @@ -2526,7 +2537,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
18766 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18767 struct kvm_interrupt *irq)
18768 {
18769 - if (irq->irq < 0 || irq->irq >= 256)
18770 + if (irq->irq >= 256)
18771 return -EINVAL;
18772 if (irqchip_in_kernel(vcpu->kvm))
18773 return -ENXIO;
18774 @@ -4672,7 +4683,7 @@ static unsigned long kvm_get_guest_ip(vo
18775 return ip;
18776 }
18777
18778 -static struct perf_guest_info_callbacks kvm_guest_cbs = {
18779 +static const struct perf_guest_info_callbacks kvm_guest_cbs = {
18780 .is_in_guest = kvm_is_in_guest,
18781 .is_user_mode = kvm_is_user_mode,
18782 .get_guest_ip = kvm_get_guest_ip,
18783 @@ -4690,10 +4701,10 @@ void kvm_after_handle_nmi(struct kvm_vcp
18784 }
18785 EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
18786
18787 -int kvm_arch_init(void *opaque)
18788 +int kvm_arch_init(const void *opaque)
18789 {
18790 int r;
18791 - struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18792 + const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
18793
18794 if (kvm_x86_ops) {
18795 printk(KERN_ERR "kvm: already loaded the other module\n");
18796 diff -urNp linux-2.6.39.1/arch/x86/lib/atomic64_32.c linux-2.6.39.1/arch/x86/lib/atomic64_32.c
18797 --- linux-2.6.39.1/arch/x86/lib/atomic64_32.c 2011-05-19 00:06:34.000000000 -0400
18798 +++ linux-2.6.39.1/arch/x86/lib/atomic64_32.c 2011-05-22 19:36:30.000000000 -0400
18799 @@ -8,18 +8,30 @@
18800
18801 long long atomic64_read_cx8(long long, const atomic64_t *v);
18802 EXPORT_SYMBOL(atomic64_read_cx8);
18803 +long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18804 +EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18805 long long atomic64_set_cx8(long long, const atomic64_t *v);
18806 EXPORT_SYMBOL(atomic64_set_cx8);
18807 +long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18808 +EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18809 long long atomic64_xchg_cx8(long long, unsigned high);
18810 EXPORT_SYMBOL(atomic64_xchg_cx8);
18811 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18812 EXPORT_SYMBOL(atomic64_add_return_cx8);
18813 +long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18814 +EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18815 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
18816 EXPORT_SYMBOL(atomic64_sub_return_cx8);
18817 +long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18818 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
18819 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18820 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18821 +long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18822 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18823 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18824 EXPORT_SYMBOL(atomic64_dec_return_cx8);
18825 +long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18826 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
18827 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
18828 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18829 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18830 @@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18831 #ifndef CONFIG_X86_CMPXCHG64
18832 long long atomic64_read_386(long long, const atomic64_t *v);
18833 EXPORT_SYMBOL(atomic64_read_386);
18834 +long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18835 +EXPORT_SYMBOL(atomic64_read_unchecked_386);
18836 long long atomic64_set_386(long long, const atomic64_t *v);
18837 EXPORT_SYMBOL(atomic64_set_386);
18838 +long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18839 +EXPORT_SYMBOL(atomic64_set_unchecked_386);
18840 long long atomic64_xchg_386(long long, unsigned high);
18841 EXPORT_SYMBOL(atomic64_xchg_386);
18842 long long atomic64_add_return_386(long long a, atomic64_t *v);
18843 EXPORT_SYMBOL(atomic64_add_return_386);
18844 +long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18845 +EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18846 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18847 EXPORT_SYMBOL(atomic64_sub_return_386);
18848 +long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18849 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18850 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18851 EXPORT_SYMBOL(atomic64_inc_return_386);
18852 +long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18853 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18854 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18855 EXPORT_SYMBOL(atomic64_dec_return_386);
18856 +long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18857 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18858 long long atomic64_add_386(long long a, atomic64_t *v);
18859 EXPORT_SYMBOL(atomic64_add_386);
18860 +long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18861 +EXPORT_SYMBOL(atomic64_add_unchecked_386);
18862 long long atomic64_sub_386(long long a, atomic64_t *v);
18863 EXPORT_SYMBOL(atomic64_sub_386);
18864 +long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18865 +EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18866 long long atomic64_inc_386(long long a, atomic64_t *v);
18867 EXPORT_SYMBOL(atomic64_inc_386);
18868 +long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18869 +EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18870 long long atomic64_dec_386(long long a, atomic64_t *v);
18871 EXPORT_SYMBOL(atomic64_dec_386);
18872 +long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18873 +EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18874 long long atomic64_dec_if_positive_386(atomic64_t *v);
18875 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18876 int atomic64_inc_not_zero_386(atomic64_t *v);
18877 diff -urNp linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S
18878 --- linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S 2011-05-19 00:06:34.000000000 -0400
18879 +++ linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S 2011-05-22 19:36:30.000000000 -0400
18880 @@ -48,6 +48,10 @@ BEGIN(read)
18881 movl (v), %eax
18882 movl 4(v), %edx
18883 RET_ENDP
18884 +BEGIN(read_unchecked)
18885 + movl (v), %eax
18886 + movl 4(v), %edx
18887 +RET_ENDP
18888 #undef v
18889
18890 #define v %esi
18891 @@ -55,6 +59,10 @@ BEGIN(set)
18892 movl %ebx, (v)
18893 movl %ecx, 4(v)
18894 RET_ENDP
18895 +BEGIN(set_unchecked)
18896 + movl %ebx, (v)
18897 + movl %ecx, 4(v)
18898 +RET_ENDP
18899 #undef v
18900
18901 #define v %esi
18902 @@ -70,6 +78,20 @@ RET_ENDP
18903 BEGIN(add)
18904 addl %eax, (v)
18905 adcl %edx, 4(v)
18906 +
18907 +#ifdef CONFIG_PAX_REFCOUNT
18908 + jno 0f
18909 + subl %eax, (v)
18910 + sbbl %edx, 4(v)
18911 + int $4
18912 +0:
18913 + _ASM_EXTABLE(0b, 0b)
18914 +#endif
18915 +
18916 +RET_ENDP
18917 +BEGIN(add_unchecked)
18918 + addl %eax, (v)
18919 + adcl %edx, 4(v)
18920 RET_ENDP
18921 #undef v
18922
18923 @@ -77,6 +99,24 @@ RET_ENDP
18924 BEGIN(add_return)
18925 addl (v), %eax
18926 adcl 4(v), %edx
18927 +
18928 +#ifdef CONFIG_PAX_REFCOUNT
18929 + into
18930 +1234:
18931 + _ASM_EXTABLE(1234b, 2f)
18932 +#endif
18933 +
18934 + movl %eax, (v)
18935 + movl %edx, 4(v)
18936 +
18937 +#ifdef CONFIG_PAX_REFCOUNT
18938 +2:
18939 +#endif
18940 +
18941 +RET_ENDP
18942 +BEGIN(add_return_unchecked)
18943 + addl (v), %eax
18944 + adcl 4(v), %edx
18945 movl %eax, (v)
18946 movl %edx, 4(v)
18947 RET_ENDP
18948 @@ -86,6 +126,20 @@ RET_ENDP
18949 BEGIN(sub)
18950 subl %eax, (v)
18951 sbbl %edx, 4(v)
18952 +
18953 +#ifdef CONFIG_PAX_REFCOUNT
18954 + jno 0f
18955 + addl %eax, (v)
18956 + adcl %edx, 4(v)
18957 + int $4
18958 +0:
18959 + _ASM_EXTABLE(0b, 0b)
18960 +#endif
18961 +
18962 +RET_ENDP
18963 +BEGIN(sub_unchecked)
18964 + subl %eax, (v)
18965 + sbbl %edx, 4(v)
18966 RET_ENDP
18967 #undef v
18968
18969 @@ -96,6 +150,27 @@ BEGIN(sub_return)
18970 sbbl $0, %edx
18971 addl (v), %eax
18972 adcl 4(v), %edx
18973 +
18974 +#ifdef CONFIG_PAX_REFCOUNT
18975 + into
18976 +1234:
18977 + _ASM_EXTABLE(1234b, 2f)
18978 +#endif
18979 +
18980 + movl %eax, (v)
18981 + movl %edx, 4(v)
18982 +
18983 +#ifdef CONFIG_PAX_REFCOUNT
18984 +2:
18985 +#endif
18986 +
18987 +RET_ENDP
18988 +BEGIN(sub_return_unchecked)
18989 + negl %edx
18990 + negl %eax
18991 + sbbl $0, %edx
18992 + addl (v), %eax
18993 + adcl 4(v), %edx
18994 movl %eax, (v)
18995 movl %edx, 4(v)
18996 RET_ENDP
18997 @@ -105,6 +180,20 @@ RET_ENDP
18998 BEGIN(inc)
18999 addl $1, (v)
19000 adcl $0, 4(v)
19001 +
19002 +#ifdef CONFIG_PAX_REFCOUNT
19003 + jno 0f
19004 + subl $1, (v)
19005 + sbbl $0, 4(v)
19006 + int $4
19007 +0:
19008 + _ASM_EXTABLE(0b, 0b)
19009 +#endif
19010 +
19011 +RET_ENDP
19012 +BEGIN(inc_unchecked)
19013 + addl $1, (v)
19014 + adcl $0, 4(v)
19015 RET_ENDP
19016 #undef v
19017
19018 @@ -114,6 +203,26 @@ BEGIN(inc_return)
19019 movl 4(v), %edx
19020 addl $1, %eax
19021 adcl $0, %edx
19022 +
19023 +#ifdef CONFIG_PAX_REFCOUNT
19024 + into
19025 +1234:
19026 + _ASM_EXTABLE(1234b, 2f)
19027 +#endif
19028 +
19029 + movl %eax, (v)
19030 + movl %edx, 4(v)
19031 +
19032 +#ifdef CONFIG_PAX_REFCOUNT
19033 +2:
19034 +#endif
19035 +
19036 +RET_ENDP
19037 +BEGIN(inc_return_unchecked)
19038 + movl (v), %eax
19039 + movl 4(v), %edx
19040 + addl $1, %eax
19041 + adcl $0, %edx
19042 movl %eax, (v)
19043 movl %edx, 4(v)
19044 RET_ENDP
19045 @@ -123,6 +232,20 @@ RET_ENDP
19046 BEGIN(dec)
19047 subl $1, (v)
19048 sbbl $0, 4(v)
19049 +
19050 +#ifdef CONFIG_PAX_REFCOUNT
19051 + jno 0f
19052 + addl $1, (v)
19053 + adcl $0, 4(v)
19054 + int $4
19055 +0:
19056 + _ASM_EXTABLE(0b, 0b)
19057 +#endif
19058 +
19059 +RET_ENDP
19060 +BEGIN(dec_unchecked)
19061 + subl $1, (v)
19062 + sbbl $0, 4(v)
19063 RET_ENDP
19064 #undef v
19065
19066 @@ -132,6 +255,26 @@ BEGIN(dec_return)
19067 movl 4(v), %edx
19068 subl $1, %eax
19069 sbbl $0, %edx
19070 +
19071 +#ifdef CONFIG_PAX_REFCOUNT
19072 + into
19073 +1234:
19074 + _ASM_EXTABLE(1234b, 2f)
19075 +#endif
19076 +
19077 + movl %eax, (v)
19078 + movl %edx, 4(v)
19079 +
19080 +#ifdef CONFIG_PAX_REFCOUNT
19081 +2:
19082 +#endif
19083 +
19084 +RET_ENDP
19085 +BEGIN(dec_return_unchecked)
19086 + movl (v), %eax
19087 + movl 4(v), %edx
19088 + subl $1, %eax
19089 + sbbl $0, %edx
19090 movl %eax, (v)
19091 movl %edx, 4(v)
19092 RET_ENDP
19093 @@ -143,6 +286,13 @@ BEGIN(add_unless)
19094 adcl %edx, %edi
19095 addl (v), %eax
19096 adcl 4(v), %edx
19097 +
19098 +#ifdef CONFIG_PAX_REFCOUNT
19099 + into
19100 +1234:
19101 + _ASM_EXTABLE(1234b, 2f)
19102 +#endif
19103 +
19104 cmpl %eax, %esi
19105 je 3f
19106 1:
19107 @@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
19108 1:
19109 addl $1, %eax
19110 adcl $0, %edx
19111 +
19112 +#ifdef CONFIG_PAX_REFCOUNT
19113 + into
19114 +1234:
19115 + _ASM_EXTABLE(1234b, 2f)
19116 +#endif
19117 +
19118 movl %eax, (v)
19119 movl %edx, 4(v)
19120 movl $1, %eax
19121 @@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
19122 movl 4(v), %edx
19123 subl $1, %eax
19124 sbbl $0, %edx
19125 +
19126 +#ifdef CONFIG_PAX_REFCOUNT
19127 + into
19128 +1234:
19129 + _ASM_EXTABLE(1234b, 1f)
19130 +#endif
19131 +
19132 js 1f
19133 movl %eax, (v)
19134 movl %edx, 4(v)
19135 diff -urNp linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S
19136 --- linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S 2011-05-19 00:06:34.000000000 -0400
19137 +++ linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S 2011-05-22 19:36:30.000000000 -0400
19138 @@ -39,6 +39,14 @@ ENTRY(atomic64_read_cx8)
19139 CFI_ENDPROC
19140 ENDPROC(atomic64_read_cx8)
19141
19142 +ENTRY(atomic64_read_unchecked_cx8)
19143 + CFI_STARTPROC
19144 +
19145 + read64 %ecx
19146 + ret
19147 + CFI_ENDPROC
19148 +ENDPROC(atomic64_read_unchecked_cx8)
19149 +
19150 ENTRY(atomic64_set_cx8)
19151 CFI_STARTPROC
19152
19153 @@ -52,6 +60,19 @@ ENTRY(atomic64_set_cx8)
19154 CFI_ENDPROC
19155 ENDPROC(atomic64_set_cx8)
19156
19157 +ENTRY(atomic64_set_unchecked_cx8)
19158 + CFI_STARTPROC
19159 +
19160 +1:
19161 +/* we don't need LOCK_PREFIX since aligned 64-bit writes
19162 + * are atomic on 586 and newer */
19163 + cmpxchg8b (%esi)
19164 + jne 1b
19165 +
19166 + ret
19167 + CFI_ENDPROC
19168 +ENDPROC(atomic64_set_unchecked_cx8)
19169 +
19170 ENTRY(atomic64_xchg_cx8)
19171 CFI_STARTPROC
19172
19173 @@ -66,8 +87,8 @@ ENTRY(atomic64_xchg_cx8)
19174 CFI_ENDPROC
19175 ENDPROC(atomic64_xchg_cx8)
19176
19177 -.macro addsub_return func ins insc
19178 -ENTRY(atomic64_\func\()_return_cx8)
19179 +.macro addsub_return func ins insc unchecked=""
19180 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19181 CFI_STARTPROC
19182 SAVE ebp
19183 SAVE ebx
19184 @@ -84,27 +105,43 @@ ENTRY(atomic64_\func\()_return_cx8)
19185 movl %edx, %ecx
19186 \ins\()l %esi, %ebx
19187 \insc\()l %edi, %ecx
19188 +
19189 +.ifb \unchecked
19190 +#ifdef CONFIG_PAX_REFCOUNT
19191 + into
19192 +2:
19193 + _ASM_EXTABLE(2b, 3f)
19194 +#endif
19195 +.endif
19196 +
19197 LOCK_PREFIX
19198 cmpxchg8b (%ebp)
19199 jne 1b
19200 -
19201 -10:
19202 movl %ebx, %eax
19203 movl %ecx, %edx
19204 +
19205 +.ifb \unchecked
19206 +#ifdef CONFIG_PAX_REFCOUNT
19207 +3:
19208 +#endif
19209 +.endif
19210 +
19211 RESTORE edi
19212 RESTORE esi
19213 RESTORE ebx
19214 RESTORE ebp
19215 ret
19216 CFI_ENDPROC
19217 -ENDPROC(atomic64_\func\()_return_cx8)
19218 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19219 .endm
19220
19221 addsub_return add add adc
19222 addsub_return sub sub sbb
19223 +addsub_return add add adc _unchecked
19224 +addsub_return sub sub sbb _unchecked
19225
19226 -.macro incdec_return func ins insc
19227 -ENTRY(atomic64_\func\()_return_cx8)
19228 +.macro incdec_return func ins insc unchecked
19229 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19230 CFI_STARTPROC
19231 SAVE ebx
19232
19233 @@ -114,21 +151,38 @@ ENTRY(atomic64_\func\()_return_cx8)
19234 movl %edx, %ecx
19235 \ins\()l $1, %ebx
19236 \insc\()l $0, %ecx
19237 +
19238 +.ifb \unchecked
19239 +#ifdef CONFIG_PAX_REFCOUNT
19240 + into
19241 +2:
19242 + _ASM_EXTABLE(2b, 3f)
19243 +#endif
19244 +.endif
19245 +
19246 LOCK_PREFIX
19247 cmpxchg8b (%esi)
19248 jne 1b
19249
19250 -10:
19251 movl %ebx, %eax
19252 movl %ecx, %edx
19253 +
19254 +.ifb \unchecked
19255 +#ifdef CONFIG_PAX_REFCOUNT
19256 +3:
19257 +#endif
19258 +.endif
19259 +
19260 RESTORE ebx
19261 ret
19262 CFI_ENDPROC
19263 -ENDPROC(atomic64_\func\()_return_cx8)
19264 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19265 .endm
19266
19267 incdec_return inc add adc
19268 incdec_return dec sub sbb
19269 +incdec_return inc add adc _unchecked
19270 +incdec_return dec sub sbb _unchecked
19271
19272 ENTRY(atomic64_dec_if_positive_cx8)
19273 CFI_STARTPROC
19274 @@ -140,6 +194,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
19275 movl %edx, %ecx
19276 subl $1, %ebx
19277 sbb $0, %ecx
19278 +
19279 +#ifdef CONFIG_PAX_REFCOUNT
19280 + into
19281 +1234:
19282 + _ASM_EXTABLE(1234b, 2f)
19283 +#endif
19284 +
19285 js 2f
19286 LOCK_PREFIX
19287 cmpxchg8b (%esi)
19288 @@ -174,6 +235,13 @@ ENTRY(atomic64_add_unless_cx8)
19289 movl %edx, %ecx
19290 addl %esi, %ebx
19291 adcl %edi, %ecx
19292 +
19293 +#ifdef CONFIG_PAX_REFCOUNT
19294 + into
19295 +1234:
19296 + _ASM_EXTABLE(1234b, 3f)
19297 +#endif
19298 +
19299 LOCK_PREFIX
19300 cmpxchg8b (%ebp)
19301 jne 1b
19302 @@ -206,6 +274,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
19303 movl %edx, %ecx
19304 addl $1, %ebx
19305 adcl $0, %ecx
19306 +
19307 +#ifdef CONFIG_PAX_REFCOUNT
19308 + into
19309 +1234:
19310 + _ASM_EXTABLE(1234b, 3f)
19311 +#endif
19312 +
19313 LOCK_PREFIX
19314 cmpxchg8b (%esi)
19315 jne 1b
19316 diff -urNp linux-2.6.39.1/arch/x86/lib/checksum_32.S linux-2.6.39.1/arch/x86/lib/checksum_32.S
19317 --- linux-2.6.39.1/arch/x86/lib/checksum_32.S 2011-05-19 00:06:34.000000000 -0400
19318 +++ linux-2.6.39.1/arch/x86/lib/checksum_32.S 2011-05-22 19:36:30.000000000 -0400
19319 @@ -28,7 +28,8 @@
19320 #include <linux/linkage.h>
19321 #include <asm/dwarf2.h>
19322 #include <asm/errno.h>
19323 -
19324 +#include <asm/segment.h>
19325 +
19326 /*
19327 * computes a partial checksum, e.g. for TCP/UDP fragments
19328 */
19329 @@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (
19330
19331 #define ARGBASE 16
19332 #define FP 12
19333 -
19334 -ENTRY(csum_partial_copy_generic)
19335 +
19336 +ENTRY(csum_partial_copy_generic_to_user)
19337 CFI_STARTPROC
19338 +
19339 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19340 + pushl_cfi %gs
19341 + popl_cfi %es
19342 + jmp csum_partial_copy_generic
19343 +#endif
19344 +
19345 +ENTRY(csum_partial_copy_generic_from_user)
19346 +
19347 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19348 + pushl_cfi %gs
19349 + popl_cfi %ds
19350 +#endif
19351 +
19352 +ENTRY(csum_partial_copy_generic)
19353 subl $4,%esp
19354 CFI_ADJUST_CFA_OFFSET 4
19355 pushl_cfi %edi
19356 @@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19357 jmp 4f
19358 SRC(1: movw (%esi), %bx )
19359 addl $2, %esi
19360 -DST( movw %bx, (%edi) )
19361 +DST( movw %bx, %es:(%edi) )
19362 addl $2, %edi
19363 addw %bx, %ax
19364 adcl $0, %eax
19365 @@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19366 SRC(1: movl (%esi), %ebx )
19367 SRC( movl 4(%esi), %edx )
19368 adcl %ebx, %eax
19369 -DST( movl %ebx, (%edi) )
19370 +DST( movl %ebx, %es:(%edi) )
19371 adcl %edx, %eax
19372 -DST( movl %edx, 4(%edi) )
19373 +DST( movl %edx, %es:4(%edi) )
19374
19375 SRC( movl 8(%esi), %ebx )
19376 SRC( movl 12(%esi), %edx )
19377 adcl %ebx, %eax
19378 -DST( movl %ebx, 8(%edi) )
19379 +DST( movl %ebx, %es:8(%edi) )
19380 adcl %edx, %eax
19381 -DST( movl %edx, 12(%edi) )
19382 +DST( movl %edx, %es:12(%edi) )
19383
19384 SRC( movl 16(%esi), %ebx )
19385 SRC( movl 20(%esi), %edx )
19386 adcl %ebx, %eax
19387 -DST( movl %ebx, 16(%edi) )
19388 +DST( movl %ebx, %es:16(%edi) )
19389 adcl %edx, %eax
19390 -DST( movl %edx, 20(%edi) )
19391 +DST( movl %edx, %es:20(%edi) )
19392
19393 SRC( movl 24(%esi), %ebx )
19394 SRC( movl 28(%esi), %edx )
19395 adcl %ebx, %eax
19396 -DST( movl %ebx, 24(%edi) )
19397 +DST( movl %ebx, %es:24(%edi) )
19398 adcl %edx, %eax
19399 -DST( movl %edx, 28(%edi) )
19400 +DST( movl %edx, %es:28(%edi) )
19401
19402 lea 32(%esi), %esi
19403 lea 32(%edi), %edi
19404 @@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19405 shrl $2, %edx # This clears CF
19406 SRC(3: movl (%esi), %ebx )
19407 adcl %ebx, %eax
19408 -DST( movl %ebx, (%edi) )
19409 +DST( movl %ebx, %es:(%edi) )
19410 lea 4(%esi), %esi
19411 lea 4(%edi), %edi
19412 dec %edx
19413 @@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19414 jb 5f
19415 SRC( movw (%esi), %cx )
19416 leal 2(%esi), %esi
19417 -DST( movw %cx, (%edi) )
19418 +DST( movw %cx, %es:(%edi) )
19419 leal 2(%edi), %edi
19420 je 6f
19421 shll $16,%ecx
19422 SRC(5: movb (%esi), %cl )
19423 -DST( movb %cl, (%edi) )
19424 +DST( movb %cl, %es:(%edi) )
19425 6: addl %ecx, %eax
19426 adcl $0, %eax
19427 7:
19428 @@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19429
19430 6001:
19431 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19432 - movl $-EFAULT, (%ebx)
19433 + movl $-EFAULT, %ss:(%ebx)
19434
19435 # zero the complete destination - computing the rest
19436 # is too much work
19437 @@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19438
19439 6002:
19440 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19441 - movl $-EFAULT,(%ebx)
19442 + movl $-EFAULT,%ss:(%ebx)
19443 jmp 5000b
19444
19445 .previous
19446
19447 + pushl_cfi %ss
19448 + popl_cfi %ds
19449 + pushl_cfi %ss
19450 + popl_cfi %es
19451 popl_cfi %ebx
19452 CFI_RESTORE ebx
19453 popl_cfi %esi
19454 @@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19455 popl_cfi %ecx # equivalent to addl $4,%esp
19456 ret
19457 CFI_ENDPROC
19458 -ENDPROC(csum_partial_copy_generic)
19459 +ENDPROC(csum_partial_copy_generic_to_user)
19460
19461 #else
19462
19463 /* Version for PentiumII/PPro */
19464
19465 #define ROUND1(x) \
19466 + nop; nop; nop; \
19467 SRC(movl x(%esi), %ebx ) ; \
19468 addl %ebx, %eax ; \
19469 - DST(movl %ebx, x(%edi) ) ;
19470 + DST(movl %ebx, %es:x(%edi)) ;
19471
19472 #define ROUND(x) \
19473 + nop; nop; nop; \
19474 SRC(movl x(%esi), %ebx ) ; \
19475 adcl %ebx, %eax ; \
19476 - DST(movl %ebx, x(%edi) ) ;
19477 + DST(movl %ebx, %es:x(%edi)) ;
19478
19479 #define ARGBASE 12
19480 -
19481 -ENTRY(csum_partial_copy_generic)
19482 +
19483 +ENTRY(csum_partial_copy_generic_to_user)
19484 CFI_STARTPROC
19485 +
19486 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19487 + pushl_cfi %gs
19488 + popl_cfi %es
19489 + jmp csum_partial_copy_generic
19490 +#endif
19491 +
19492 +ENTRY(csum_partial_copy_generic_from_user)
19493 +
19494 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19495 + pushl_cfi %gs
19496 + popl_cfi %ds
19497 +#endif
19498 +
19499 +ENTRY(csum_partial_copy_generic)
19500 pushl_cfi %ebx
19501 CFI_REL_OFFSET ebx, 0
19502 pushl_cfi %edi
19503 @@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19504 subl %ebx, %edi
19505 lea -1(%esi),%edx
19506 andl $-32,%edx
19507 - lea 3f(%ebx,%ebx), %ebx
19508 + lea 3f(%ebx,%ebx,2), %ebx
19509 testl %esi, %esi
19510 jmp *%ebx
19511 1: addl $64,%esi
19512 @@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19513 jb 5f
19514 SRC( movw (%esi), %dx )
19515 leal 2(%esi), %esi
19516 -DST( movw %dx, (%edi) )
19517 +DST( movw %dx, %es:(%edi) )
19518 leal 2(%edi), %edi
19519 je 6f
19520 shll $16,%edx
19521 5:
19522 SRC( movb (%esi), %dl )
19523 -DST( movb %dl, (%edi) )
19524 +DST( movb %dl, %es:(%edi) )
19525 6: addl %edx, %eax
19526 adcl $0, %eax
19527 7:
19528 .section .fixup, "ax"
19529 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19530 - movl $-EFAULT, (%ebx)
19531 + movl $-EFAULT, %ss:(%ebx)
19532 # zero the complete destination (computing the rest is too much work)
19533 movl ARGBASE+8(%esp),%edi # dst
19534 movl ARGBASE+12(%esp),%ecx # len
19535 @@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19536 rep; stosb
19537 jmp 7b
19538 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19539 - movl $-EFAULT, (%ebx)
19540 + movl $-EFAULT, %ss:(%ebx)
19541 jmp 7b
19542 .previous
19543
19544 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19545 + pushl_cfi %ss
19546 + popl_cfi %ds
19547 + pushl_cfi %ss
19548 + popl_cfi %es
19549 +#endif
19550 +
19551 popl_cfi %esi
19552 CFI_RESTORE esi
19553 popl_cfi %edi
19554 @@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19555 CFI_RESTORE ebx
19556 ret
19557 CFI_ENDPROC
19558 -ENDPROC(csum_partial_copy_generic)
19559 +ENDPROC(csum_partial_copy_generic_to_user)
19560
19561 #undef ROUND
19562 #undef ROUND1
19563 diff -urNp linux-2.6.39.1/arch/x86/lib/clear_page_64.S linux-2.6.39.1/arch/x86/lib/clear_page_64.S
19564 --- linux-2.6.39.1/arch/x86/lib/clear_page_64.S 2011-05-19 00:06:34.000000000 -0400
19565 +++ linux-2.6.39.1/arch/x86/lib/clear_page_64.S 2011-05-22 19:36:30.000000000 -0400
19566 @@ -43,7 +43,7 @@ ENDPROC(clear_page)
19567
19568 #include <asm/cpufeature.h>
19569
19570 - .section .altinstr_replacement,"ax"
19571 + .section .altinstr_replacement,"a"
19572 1: .byte 0xeb /* jmp <disp8> */
19573 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19574 2:
19575 diff -urNp linux-2.6.39.1/arch/x86/lib/copy_page_64.S linux-2.6.39.1/arch/x86/lib/copy_page_64.S
19576 --- linux-2.6.39.1/arch/x86/lib/copy_page_64.S 2011-05-19 00:06:34.000000000 -0400
19577 +++ linux-2.6.39.1/arch/x86/lib/copy_page_64.S 2011-05-22 19:36:30.000000000 -0400
19578 @@ -104,7 +104,7 @@ ENDPROC(copy_page)
19579
19580 #include <asm/cpufeature.h>
19581
19582 - .section .altinstr_replacement,"ax"
19583 + .section .altinstr_replacement,"a"
19584 1: .byte 0xeb /* jmp <disp8> */
19585 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19586 2:
19587 diff -urNp linux-2.6.39.1/arch/x86/lib/copy_user_64.S linux-2.6.39.1/arch/x86/lib/copy_user_64.S
19588 --- linux-2.6.39.1/arch/x86/lib/copy_user_64.S 2011-06-03 00:04:13.000000000 -0400
19589 +++ linux-2.6.39.1/arch/x86/lib/copy_user_64.S 2011-06-03 00:32:05.000000000 -0400
19590 @@ -15,13 +15,14 @@
19591 #include <asm/asm-offsets.h>
19592 #include <asm/thread_info.h>
19593 #include <asm/cpufeature.h>
19594 +#include <asm/pgtable.h>
19595
19596 .macro ALTERNATIVE_JUMP feature,orig,alt
19597 0:
19598 .byte 0xe9 /* 32bit jump */
19599 .long \orig-1f /* by default jump to orig */
19600 1:
19601 - .section .altinstr_replacement,"ax"
19602 + .section .altinstr_replacement,"a"
19603 2: .byte 0xe9 /* near jump with 32bit immediate */
19604 .long \alt-1b /* offset */ /* or alternatively to alt */
19605 .previous
19606 @@ -64,37 +65,13 @@
19607 #endif
19608 .endm
19609
19610 -/* Standard copy_to_user with segment limit checking */
19611 -ENTRY(_copy_to_user)
19612 - CFI_STARTPROC
19613 - GET_THREAD_INFO(%rax)
19614 - movq %rdi,%rcx
19615 - addq %rdx,%rcx
19616 - jc bad_to_user
19617 - cmpq TI_addr_limit(%rax),%rcx
19618 - ja bad_to_user
19619 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19620 - CFI_ENDPROC
19621 -ENDPROC(_copy_to_user)
19622 -
19623 -/* Standard copy_from_user with segment limit checking */
19624 -ENTRY(_copy_from_user)
19625 - CFI_STARTPROC
19626 - GET_THREAD_INFO(%rax)
19627 - movq %rsi,%rcx
19628 - addq %rdx,%rcx
19629 - jc bad_from_user
19630 - cmpq TI_addr_limit(%rax),%rcx
19631 - ja bad_from_user
19632 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19633 - CFI_ENDPROC
19634 -ENDPROC(_copy_from_user)
19635 -
19636 .section .fixup,"ax"
19637 /* must zero dest */
19638 ENTRY(bad_from_user)
19639 bad_from_user:
19640 CFI_STARTPROC
19641 + testl %edx,%edx
19642 + js bad_to_user
19643 movl %edx,%ecx
19644 xorl %eax,%eax
19645 rep
19646 diff -urNp linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S
19647 --- linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S 2011-05-19 00:06:34.000000000 -0400
19648 +++ linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S 2011-05-22 19:36:30.000000000 -0400
19649 @@ -14,6 +14,7 @@
19650 #include <asm/current.h>
19651 #include <asm/asm-offsets.h>
19652 #include <asm/thread_info.h>
19653 +#include <asm/pgtable.h>
19654
19655 .macro ALIGN_DESTINATION
19656 #ifdef FIX_ALIGNMENT
19657 @@ -50,6 +51,15 @@
19658 */
19659 ENTRY(__copy_user_nocache)
19660 CFI_STARTPROC
19661 +
19662 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19663 + mov $PAX_USER_SHADOW_BASE,%rcx
19664 + cmp %rcx,%rsi
19665 + jae 1f
19666 + add %rcx,%rsi
19667 +1:
19668 +#endif
19669 +
19670 cmpl $8,%edx
19671 jb 20f /* less then 8 bytes, go to byte copy loop */
19672 ALIGN_DESTINATION
19673 diff -urNp linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c
19674 --- linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c 2011-05-19 00:06:34.000000000 -0400
19675 +++ linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c 2011-05-22 19:36:30.000000000 -0400
19676 @@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
19677 len -= 2;
19678 }
19679 }
19680 +
19681 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19682 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19683 + src += PAX_USER_SHADOW_BASE;
19684 +#endif
19685 +
19686 isum = csum_partial_copy_generic((__force const void *)src,
19687 dst, len, isum, errp, NULL);
19688 if (unlikely(*errp))
19689 @@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
19690 }
19691
19692 *errp = 0;
19693 +
19694 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19695 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19696 + dst += PAX_USER_SHADOW_BASE;
19697 +#endif
19698 +
19699 return csum_partial_copy_generic(src, (void __force *)dst,
19700 len, isum, NULL, errp);
19701 }
19702 diff -urNp linux-2.6.39.1/arch/x86/lib/getuser.S linux-2.6.39.1/arch/x86/lib/getuser.S
19703 --- linux-2.6.39.1/arch/x86/lib/getuser.S 2011-05-19 00:06:34.000000000 -0400
19704 +++ linux-2.6.39.1/arch/x86/lib/getuser.S 2011-05-22 19:36:30.000000000 -0400
19705 @@ -33,14 +33,35 @@
19706 #include <asm/asm-offsets.h>
19707 #include <asm/thread_info.h>
19708 #include <asm/asm.h>
19709 +#include <asm/segment.h>
19710 +#include <asm/pgtable.h>
19711 +
19712 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19713 +#define __copyuser_seg gs;
19714 +#else
19715 +#define __copyuser_seg
19716 +#endif
19717
19718 .text
19719 ENTRY(__get_user_1)
19720 CFI_STARTPROC
19721 +
19722 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19723 GET_THREAD_INFO(%_ASM_DX)
19724 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19725 jae bad_get_user
19726 -1: movzb (%_ASM_AX),%edx
19727 +
19728 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19729 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19730 + cmp %_ASM_DX,%_ASM_AX
19731 + jae 1234f
19732 + add %_ASM_DX,%_ASM_AX
19733 +1234:
19734 +#endif
19735 +
19736 +#endif
19737 +
19738 +1: __copyuser_seg movzb (%_ASM_AX),%edx
19739 xor %eax,%eax
19740 ret
19741 CFI_ENDPROC
19742 @@ -49,11 +70,24 @@ ENDPROC(__get_user_1)
19743 ENTRY(__get_user_2)
19744 CFI_STARTPROC
19745 add $1,%_ASM_AX
19746 +
19747 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19748 jc bad_get_user
19749 GET_THREAD_INFO(%_ASM_DX)
19750 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19751 jae bad_get_user
19752 -2: movzwl -1(%_ASM_AX),%edx
19753 +
19754 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19755 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19756 + cmp %_ASM_DX,%_ASM_AX
19757 + jae 1234f
19758 + add %_ASM_DX,%_ASM_AX
19759 +1234:
19760 +#endif
19761 +
19762 +#endif
19763 +
19764 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19765 xor %eax,%eax
19766 ret
19767 CFI_ENDPROC
19768 @@ -62,11 +96,24 @@ ENDPROC(__get_user_2)
19769 ENTRY(__get_user_4)
19770 CFI_STARTPROC
19771 add $3,%_ASM_AX
19772 +
19773 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19774 jc bad_get_user
19775 GET_THREAD_INFO(%_ASM_DX)
19776 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19777 jae bad_get_user
19778 -3: mov -3(%_ASM_AX),%edx
19779 +
19780 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19781 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19782 + cmp %_ASM_DX,%_ASM_AX
19783 + jae 1234f
19784 + add %_ASM_DX,%_ASM_AX
19785 +1234:
19786 +#endif
19787 +
19788 +#endif
19789 +
19790 +3: __copyuser_seg mov -3(%_ASM_AX),%edx
19791 xor %eax,%eax
19792 ret
19793 CFI_ENDPROC
19794 @@ -80,6 +127,15 @@ ENTRY(__get_user_8)
19795 GET_THREAD_INFO(%_ASM_DX)
19796 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19797 jae bad_get_user
19798 +
19799 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19800 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19801 + cmp %_ASM_DX,%_ASM_AX
19802 + jae 1234f
19803 + add %_ASM_DX,%_ASM_AX
19804 +1234:
19805 +#endif
19806 +
19807 4: movq -7(%_ASM_AX),%_ASM_DX
19808 xor %eax,%eax
19809 ret
19810 diff -urNp linux-2.6.39.1/arch/x86/lib/insn.c linux-2.6.39.1/arch/x86/lib/insn.c
19811 --- linux-2.6.39.1/arch/x86/lib/insn.c 2011-05-19 00:06:34.000000000 -0400
19812 +++ linux-2.6.39.1/arch/x86/lib/insn.c 2011-05-22 19:36:30.000000000 -0400
19813 @@ -21,6 +21,11 @@
19814 #include <linux/string.h>
19815 #include <asm/inat.h>
19816 #include <asm/insn.h>
19817 +#ifdef __KERNEL__
19818 +#include <asm/pgtable_types.h>
19819 +#else
19820 +#define ktla_ktva(addr) addr
19821 +#endif
19822
19823 #define get_next(t, insn) \
19824 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
19825 @@ -40,8 +45,8 @@
19826 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19827 {
19828 memset(insn, 0, sizeof(*insn));
19829 - insn->kaddr = kaddr;
19830 - insn->next_byte = kaddr;
19831 + insn->kaddr = ktla_ktva(kaddr);
19832 + insn->next_byte = ktla_ktva(kaddr);
19833 insn->x86_64 = x86_64 ? 1 : 0;
19834 insn->opnd_bytes = 4;
19835 if (x86_64)
19836 diff -urNp linux-2.6.39.1/arch/x86/lib/mmx_32.c linux-2.6.39.1/arch/x86/lib/mmx_32.c
19837 --- linux-2.6.39.1/arch/x86/lib/mmx_32.c 2011-05-19 00:06:34.000000000 -0400
19838 +++ linux-2.6.39.1/arch/x86/lib/mmx_32.c 2011-05-22 19:36:30.000000000 -0400
19839 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
19840 {
19841 void *p;
19842 int i;
19843 + unsigned long cr0;
19844
19845 if (unlikely(in_interrupt()))
19846 return __memcpy(to, from, len);
19847 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
19848 kernel_fpu_begin();
19849
19850 __asm__ __volatile__ (
19851 - "1: prefetch (%0)\n" /* This set is 28 bytes */
19852 - " prefetch 64(%0)\n"
19853 - " prefetch 128(%0)\n"
19854 - " prefetch 192(%0)\n"
19855 - " prefetch 256(%0)\n"
19856 + "1: prefetch (%1)\n" /* This set is 28 bytes */
19857 + " prefetch 64(%1)\n"
19858 + " prefetch 128(%1)\n"
19859 + " prefetch 192(%1)\n"
19860 + " prefetch 256(%1)\n"
19861 "2: \n"
19862 ".section .fixup, \"ax\"\n"
19863 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19864 + "3: \n"
19865 +
19866 +#ifdef CONFIG_PAX_KERNEXEC
19867 + " movl %%cr0, %0\n"
19868 + " movl %0, %%eax\n"
19869 + " andl $0xFFFEFFFF, %%eax\n"
19870 + " movl %%eax, %%cr0\n"
19871 +#endif
19872 +
19873 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19874 +
19875 +#ifdef CONFIG_PAX_KERNEXEC
19876 + " movl %0, %%cr0\n"
19877 +#endif
19878 +
19879 " jmp 2b\n"
19880 ".previous\n"
19881 _ASM_EXTABLE(1b, 3b)
19882 - : : "r" (from));
19883 + : "=&r" (cr0) : "r" (from) : "ax");
19884
19885 for ( ; i > 5; i--) {
19886 __asm__ __volatile__ (
19887 - "1: prefetch 320(%0)\n"
19888 - "2: movq (%0), %%mm0\n"
19889 - " movq 8(%0), %%mm1\n"
19890 - " movq 16(%0), %%mm2\n"
19891 - " movq 24(%0), %%mm3\n"
19892 - " movq %%mm0, (%1)\n"
19893 - " movq %%mm1, 8(%1)\n"
19894 - " movq %%mm2, 16(%1)\n"
19895 - " movq %%mm3, 24(%1)\n"
19896 - " movq 32(%0), %%mm0\n"
19897 - " movq 40(%0), %%mm1\n"
19898 - " movq 48(%0), %%mm2\n"
19899 - " movq 56(%0), %%mm3\n"
19900 - " movq %%mm0, 32(%1)\n"
19901 - " movq %%mm1, 40(%1)\n"
19902 - " movq %%mm2, 48(%1)\n"
19903 - " movq %%mm3, 56(%1)\n"
19904 + "1: prefetch 320(%1)\n"
19905 + "2: movq (%1), %%mm0\n"
19906 + " movq 8(%1), %%mm1\n"
19907 + " movq 16(%1), %%mm2\n"
19908 + " movq 24(%1), %%mm3\n"
19909 + " movq %%mm0, (%2)\n"
19910 + " movq %%mm1, 8(%2)\n"
19911 + " movq %%mm2, 16(%2)\n"
19912 + " movq %%mm3, 24(%2)\n"
19913 + " movq 32(%1), %%mm0\n"
19914 + " movq 40(%1), %%mm1\n"
19915 + " movq 48(%1), %%mm2\n"
19916 + " movq 56(%1), %%mm3\n"
19917 + " movq %%mm0, 32(%2)\n"
19918 + " movq %%mm1, 40(%2)\n"
19919 + " movq %%mm2, 48(%2)\n"
19920 + " movq %%mm3, 56(%2)\n"
19921 ".section .fixup, \"ax\"\n"
19922 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19923 + "3:\n"
19924 +
19925 +#ifdef CONFIG_PAX_KERNEXEC
19926 + " movl %%cr0, %0\n"
19927 + " movl %0, %%eax\n"
19928 + " andl $0xFFFEFFFF, %%eax\n"
19929 + " movl %%eax, %%cr0\n"
19930 +#endif
19931 +
19932 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19933 +
19934 +#ifdef CONFIG_PAX_KERNEXEC
19935 + " movl %0, %%cr0\n"
19936 +#endif
19937 +
19938 " jmp 2b\n"
19939 ".previous\n"
19940 _ASM_EXTABLE(1b, 3b)
19941 - : : "r" (from), "r" (to) : "memory");
19942 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19943
19944 from += 64;
19945 to += 64;
19946 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
19947 static void fast_copy_page(void *to, void *from)
19948 {
19949 int i;
19950 + unsigned long cr0;
19951
19952 kernel_fpu_begin();
19953
19954 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
19955 * but that is for later. -AV
19956 */
19957 __asm__ __volatile__(
19958 - "1: prefetch (%0)\n"
19959 - " prefetch 64(%0)\n"
19960 - " prefetch 128(%0)\n"
19961 - " prefetch 192(%0)\n"
19962 - " prefetch 256(%0)\n"
19963 + "1: prefetch (%1)\n"
19964 + " prefetch 64(%1)\n"
19965 + " prefetch 128(%1)\n"
19966 + " prefetch 192(%1)\n"
19967 + " prefetch 256(%1)\n"
19968 "2: \n"
19969 ".section .fixup, \"ax\"\n"
19970 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19971 + "3: \n"
19972 +
19973 +#ifdef CONFIG_PAX_KERNEXEC
19974 + " movl %%cr0, %0\n"
19975 + " movl %0, %%eax\n"
19976 + " andl $0xFFFEFFFF, %%eax\n"
19977 + " movl %%eax, %%cr0\n"
19978 +#endif
19979 +
19980 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19981 +
19982 +#ifdef CONFIG_PAX_KERNEXEC
19983 + " movl %0, %%cr0\n"
19984 +#endif
19985 +
19986 " jmp 2b\n"
19987 ".previous\n"
19988 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
19989 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19990
19991 for (i = 0; i < (4096-320)/64; i++) {
19992 __asm__ __volatile__ (
19993 - "1: prefetch 320(%0)\n"
19994 - "2: movq (%0), %%mm0\n"
19995 - " movntq %%mm0, (%1)\n"
19996 - " movq 8(%0), %%mm1\n"
19997 - " movntq %%mm1, 8(%1)\n"
19998 - " movq 16(%0), %%mm2\n"
19999 - " movntq %%mm2, 16(%1)\n"
20000 - " movq 24(%0), %%mm3\n"
20001 - " movntq %%mm3, 24(%1)\n"
20002 - " movq 32(%0), %%mm4\n"
20003 - " movntq %%mm4, 32(%1)\n"
20004 - " movq 40(%0), %%mm5\n"
20005 - " movntq %%mm5, 40(%1)\n"
20006 - " movq 48(%0), %%mm6\n"
20007 - " movntq %%mm6, 48(%1)\n"
20008 - " movq 56(%0), %%mm7\n"
20009 - " movntq %%mm7, 56(%1)\n"
20010 + "1: prefetch 320(%1)\n"
20011 + "2: movq (%1), %%mm0\n"
20012 + " movntq %%mm0, (%2)\n"
20013 + " movq 8(%1), %%mm1\n"
20014 + " movntq %%mm1, 8(%2)\n"
20015 + " movq 16(%1), %%mm2\n"
20016 + " movntq %%mm2, 16(%2)\n"
20017 + " movq 24(%1), %%mm3\n"
20018 + " movntq %%mm3, 24(%2)\n"
20019 + " movq 32(%1), %%mm4\n"
20020 + " movntq %%mm4, 32(%2)\n"
20021 + " movq 40(%1), %%mm5\n"
20022 + " movntq %%mm5, 40(%2)\n"
20023 + " movq 48(%1), %%mm6\n"
20024 + " movntq %%mm6, 48(%2)\n"
20025 + " movq 56(%1), %%mm7\n"
20026 + " movntq %%mm7, 56(%2)\n"
20027 ".section .fixup, \"ax\"\n"
20028 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20029 + "3:\n"
20030 +
20031 +#ifdef CONFIG_PAX_KERNEXEC
20032 + " movl %%cr0, %0\n"
20033 + " movl %0, %%eax\n"
20034 + " andl $0xFFFEFFFF, %%eax\n"
20035 + " movl %%eax, %%cr0\n"
20036 +#endif
20037 +
20038 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20039 +
20040 +#ifdef CONFIG_PAX_KERNEXEC
20041 + " movl %0, %%cr0\n"
20042 +#endif
20043 +
20044 " jmp 2b\n"
20045 ".previous\n"
20046 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
20047 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20048
20049 from += 64;
20050 to += 64;
20051 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
20052 static void fast_copy_page(void *to, void *from)
20053 {
20054 int i;
20055 + unsigned long cr0;
20056
20057 kernel_fpu_begin();
20058
20059 __asm__ __volatile__ (
20060 - "1: prefetch (%0)\n"
20061 - " prefetch 64(%0)\n"
20062 - " prefetch 128(%0)\n"
20063 - " prefetch 192(%0)\n"
20064 - " prefetch 256(%0)\n"
20065 + "1: prefetch (%1)\n"
20066 + " prefetch 64(%1)\n"
20067 + " prefetch 128(%1)\n"
20068 + " prefetch 192(%1)\n"
20069 + " prefetch 256(%1)\n"
20070 "2: \n"
20071 ".section .fixup, \"ax\"\n"
20072 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20073 + "3: \n"
20074 +
20075 +#ifdef CONFIG_PAX_KERNEXEC
20076 + " movl %%cr0, %0\n"
20077 + " movl %0, %%eax\n"
20078 + " andl $0xFFFEFFFF, %%eax\n"
20079 + " movl %%eax, %%cr0\n"
20080 +#endif
20081 +
20082 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20083 +
20084 +#ifdef CONFIG_PAX_KERNEXEC
20085 + " movl %0, %%cr0\n"
20086 +#endif
20087 +
20088 " jmp 2b\n"
20089 ".previous\n"
20090 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
20091 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20092
20093 for (i = 0; i < 4096/64; i++) {
20094 __asm__ __volatile__ (
20095 - "1: prefetch 320(%0)\n"
20096 - "2: movq (%0), %%mm0\n"
20097 - " movq 8(%0), %%mm1\n"
20098 - " movq 16(%0), %%mm2\n"
20099 - " movq 24(%0), %%mm3\n"
20100 - " movq %%mm0, (%1)\n"
20101 - " movq %%mm1, 8(%1)\n"
20102 - " movq %%mm2, 16(%1)\n"
20103 - " movq %%mm3, 24(%1)\n"
20104 - " movq 32(%0), %%mm0\n"
20105 - " movq 40(%0), %%mm1\n"
20106 - " movq 48(%0), %%mm2\n"
20107 - " movq 56(%0), %%mm3\n"
20108 - " movq %%mm0, 32(%1)\n"
20109 - " movq %%mm1, 40(%1)\n"
20110 - " movq %%mm2, 48(%1)\n"
20111 - " movq %%mm3, 56(%1)\n"
20112 + "1: prefetch 320(%1)\n"
20113 + "2: movq (%1), %%mm0\n"
20114 + " movq 8(%1), %%mm1\n"
20115 + " movq 16(%1), %%mm2\n"
20116 + " movq 24(%1), %%mm3\n"
20117 + " movq %%mm0, (%2)\n"
20118 + " movq %%mm1, 8(%2)\n"
20119 + " movq %%mm2, 16(%2)\n"
20120 + " movq %%mm3, 24(%2)\n"
20121 + " movq 32(%1), %%mm0\n"
20122 + " movq 40(%1), %%mm1\n"
20123 + " movq 48(%1), %%mm2\n"
20124 + " movq 56(%1), %%mm3\n"
20125 + " movq %%mm0, 32(%2)\n"
20126 + " movq %%mm1, 40(%2)\n"
20127 + " movq %%mm2, 48(%2)\n"
20128 + " movq %%mm3, 56(%2)\n"
20129 ".section .fixup, \"ax\"\n"
20130 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20131 + "3:\n"
20132 +
20133 +#ifdef CONFIG_PAX_KERNEXEC
20134 + " movl %%cr0, %0\n"
20135 + " movl %0, %%eax\n"
20136 + " andl $0xFFFEFFFF, %%eax\n"
20137 + " movl %%eax, %%cr0\n"
20138 +#endif
20139 +
20140 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20141 +
20142 +#ifdef CONFIG_PAX_KERNEXEC
20143 + " movl %0, %%cr0\n"
20144 +#endif
20145 +
20146 " jmp 2b\n"
20147 ".previous\n"
20148 _ASM_EXTABLE(1b, 3b)
20149 - : : "r" (from), "r" (to) : "memory");
20150 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20151
20152 from += 64;
20153 to += 64;
20154 diff -urNp linux-2.6.39.1/arch/x86/lib/putuser.S linux-2.6.39.1/arch/x86/lib/putuser.S
20155 --- linux-2.6.39.1/arch/x86/lib/putuser.S 2011-05-19 00:06:34.000000000 -0400
20156 +++ linux-2.6.39.1/arch/x86/lib/putuser.S 2011-05-22 19:36:30.000000000 -0400
20157 @@ -15,7 +15,8 @@
20158 #include <asm/thread_info.h>
20159 #include <asm/errno.h>
20160 #include <asm/asm.h>
20161 -
20162 +#include <asm/segment.h>
20163 +#include <asm/pgtable.h>
20164
20165 /*
20166 * __put_user_X
20167 @@ -29,52 +30,119 @@
20168 * as they get called from within inline assembly.
20169 */
20170
20171 -#define ENTER CFI_STARTPROC ; \
20172 - GET_THREAD_INFO(%_ASM_BX)
20173 +#define ENTER CFI_STARTPROC
20174 #define EXIT ret ; \
20175 CFI_ENDPROC
20176
20177 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20178 +#define _DEST %_ASM_CX,%_ASM_BX
20179 +#else
20180 +#define _DEST %_ASM_CX
20181 +#endif
20182 +
20183 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20184 +#define __copyuser_seg gs;
20185 +#else
20186 +#define __copyuser_seg
20187 +#endif
20188 +
20189 .text
20190 ENTRY(__put_user_1)
20191 ENTER
20192 +
20193 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20194 + GET_THREAD_INFO(%_ASM_BX)
20195 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20196 jae bad_put_user
20197 -1: movb %al,(%_ASM_CX)
20198 +
20199 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20200 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20201 + cmp %_ASM_BX,%_ASM_CX
20202 + jb 1234f
20203 + xor %ebx,%ebx
20204 +1234:
20205 +#endif
20206 +
20207 +#endif
20208 +
20209 +1: __copyuser_seg movb %al,(_DEST)
20210 xor %eax,%eax
20211 EXIT
20212 ENDPROC(__put_user_1)
20213
20214 ENTRY(__put_user_2)
20215 ENTER
20216 +
20217 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20218 + GET_THREAD_INFO(%_ASM_BX)
20219 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20220 sub $1,%_ASM_BX
20221 cmp %_ASM_BX,%_ASM_CX
20222 jae bad_put_user
20223 -2: movw %ax,(%_ASM_CX)
20224 +
20225 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20226 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20227 + cmp %_ASM_BX,%_ASM_CX
20228 + jb 1234f
20229 + xor %ebx,%ebx
20230 +1234:
20231 +#endif
20232 +
20233 +#endif
20234 +
20235 +2: __copyuser_seg movw %ax,(_DEST)
20236 xor %eax,%eax
20237 EXIT
20238 ENDPROC(__put_user_2)
20239
20240 ENTRY(__put_user_4)
20241 ENTER
20242 +
20243 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20244 + GET_THREAD_INFO(%_ASM_BX)
20245 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20246 sub $3,%_ASM_BX
20247 cmp %_ASM_BX,%_ASM_CX
20248 jae bad_put_user
20249 -3: movl %eax,(%_ASM_CX)
20250 +
20251 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20252 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20253 + cmp %_ASM_BX,%_ASM_CX
20254 + jb 1234f
20255 + xor %ebx,%ebx
20256 +1234:
20257 +#endif
20258 +
20259 +#endif
20260 +
20261 +3: __copyuser_seg movl %eax,(_DEST)
20262 xor %eax,%eax
20263 EXIT
20264 ENDPROC(__put_user_4)
20265
20266 ENTRY(__put_user_8)
20267 ENTER
20268 +
20269 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20270 + GET_THREAD_INFO(%_ASM_BX)
20271 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20272 sub $7,%_ASM_BX
20273 cmp %_ASM_BX,%_ASM_CX
20274 jae bad_put_user
20275 -4: mov %_ASM_AX,(%_ASM_CX)
20276 +
20277 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20278 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20279 + cmp %_ASM_BX,%_ASM_CX
20280 + jb 1234f
20281 + xor %ebx,%ebx
20282 +1234:
20283 +#endif
20284 +
20285 +#endif
20286 +
20287 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
20288 #ifdef CONFIG_X86_32
20289 -5: movl %edx,4(%_ASM_CX)
20290 +5: __copyuser_seg movl %edx,4(_DEST)
20291 #endif
20292 xor %eax,%eax
20293 EXIT
20294 diff -urNp linux-2.6.39.1/arch/x86/lib/usercopy_32.c linux-2.6.39.1/arch/x86/lib/usercopy_32.c
20295 --- linux-2.6.39.1/arch/x86/lib/usercopy_32.c 2011-05-19 00:06:34.000000000 -0400
20296 +++ linux-2.6.39.1/arch/x86/lib/usercopy_32.c 2011-05-22 19:36:30.000000000 -0400
20297 @@ -43,7 +43,7 @@ do { \
20298 __asm__ __volatile__( \
20299 " testl %1,%1\n" \
20300 " jz 2f\n" \
20301 - "0: lodsb\n" \
20302 + "0: "__copyuser_seg"lodsb\n" \
20303 " stosb\n" \
20304 " testb %%al,%%al\n" \
20305 " jz 1f\n" \
20306 @@ -128,10 +128,12 @@ do { \
20307 int __d0; \
20308 might_fault(); \
20309 __asm__ __volatile__( \
20310 + __COPYUSER_SET_ES \
20311 "0: rep; stosl\n" \
20312 " movl %2,%0\n" \
20313 "1: rep; stosb\n" \
20314 "2:\n" \
20315 + __COPYUSER_RESTORE_ES \
20316 ".section .fixup,\"ax\"\n" \
20317 "3: lea 0(%2,%0,4),%0\n" \
20318 " jmp 2b\n" \
20319 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
20320 might_fault();
20321
20322 __asm__ __volatile__(
20323 + __COPYUSER_SET_ES
20324 " testl %0, %0\n"
20325 " jz 3f\n"
20326 " andl %0,%%ecx\n"
20327 @@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
20328 " subl %%ecx,%0\n"
20329 " addl %0,%%eax\n"
20330 "1:\n"
20331 + __COPYUSER_RESTORE_ES
20332 ".section .fixup,\"ax\"\n"
20333 "2: xorl %%eax,%%eax\n"
20334 " jmp 1b\n"
20335 @@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20336
20337 #ifdef CONFIG_X86_INTEL_USERCOPY
20338 static unsigned long
20339 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
20340 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20341 {
20342 int d0, d1;
20343 __asm__ __volatile__(
20344 @@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
20345 " .align 2,0x90\n"
20346 "3: movl 0(%4), %%eax\n"
20347 "4: movl 4(%4), %%edx\n"
20348 - "5: movl %%eax, 0(%3)\n"
20349 - "6: movl %%edx, 4(%3)\n"
20350 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20351 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20352 "7: movl 8(%4), %%eax\n"
20353 "8: movl 12(%4),%%edx\n"
20354 - "9: movl %%eax, 8(%3)\n"
20355 - "10: movl %%edx, 12(%3)\n"
20356 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20357 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20358 "11: movl 16(%4), %%eax\n"
20359 "12: movl 20(%4), %%edx\n"
20360 - "13: movl %%eax, 16(%3)\n"
20361 - "14: movl %%edx, 20(%3)\n"
20362 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20363 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20364 "15: movl 24(%4), %%eax\n"
20365 "16: movl 28(%4), %%edx\n"
20366 - "17: movl %%eax, 24(%3)\n"
20367 - "18: movl %%edx, 28(%3)\n"
20368 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20369 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20370 "19: movl 32(%4), %%eax\n"
20371 "20: movl 36(%4), %%edx\n"
20372 - "21: movl %%eax, 32(%3)\n"
20373 - "22: movl %%edx, 36(%3)\n"
20374 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20375 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20376 "23: movl 40(%4), %%eax\n"
20377 "24: movl 44(%4), %%edx\n"
20378 - "25: movl %%eax, 40(%3)\n"
20379 - "26: movl %%edx, 44(%3)\n"
20380 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20381 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20382 "27: movl 48(%4), %%eax\n"
20383 "28: movl 52(%4), %%edx\n"
20384 - "29: movl %%eax, 48(%3)\n"
20385 - "30: movl %%edx, 52(%3)\n"
20386 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20387 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20388 "31: movl 56(%4), %%eax\n"
20389 "32: movl 60(%4), %%edx\n"
20390 - "33: movl %%eax, 56(%3)\n"
20391 - "34: movl %%edx, 60(%3)\n"
20392 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20393 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20394 " addl $-64, %0\n"
20395 " addl $64, %4\n"
20396 " addl $64, %3\n"
20397 @@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
20398 " shrl $2, %0\n"
20399 " andl $3, %%eax\n"
20400 " cld\n"
20401 + __COPYUSER_SET_ES
20402 "99: rep; movsl\n"
20403 "36: movl %%eax, %0\n"
20404 "37: rep; movsb\n"
20405 "100:\n"
20406 + __COPYUSER_RESTORE_ES
20407 + ".section .fixup,\"ax\"\n"
20408 + "101: lea 0(%%eax,%0,4),%0\n"
20409 + " jmp 100b\n"
20410 + ".previous\n"
20411 + ".section __ex_table,\"a\"\n"
20412 + " .align 4\n"
20413 + " .long 1b,100b\n"
20414 + " .long 2b,100b\n"
20415 + " .long 3b,100b\n"
20416 + " .long 4b,100b\n"
20417 + " .long 5b,100b\n"
20418 + " .long 6b,100b\n"
20419 + " .long 7b,100b\n"
20420 + " .long 8b,100b\n"
20421 + " .long 9b,100b\n"
20422 + " .long 10b,100b\n"
20423 + " .long 11b,100b\n"
20424 + " .long 12b,100b\n"
20425 + " .long 13b,100b\n"
20426 + " .long 14b,100b\n"
20427 + " .long 15b,100b\n"
20428 + " .long 16b,100b\n"
20429 + " .long 17b,100b\n"
20430 + " .long 18b,100b\n"
20431 + " .long 19b,100b\n"
20432 + " .long 20b,100b\n"
20433 + " .long 21b,100b\n"
20434 + " .long 22b,100b\n"
20435 + " .long 23b,100b\n"
20436 + " .long 24b,100b\n"
20437 + " .long 25b,100b\n"
20438 + " .long 26b,100b\n"
20439 + " .long 27b,100b\n"
20440 + " .long 28b,100b\n"
20441 + " .long 29b,100b\n"
20442 + " .long 30b,100b\n"
20443 + " .long 31b,100b\n"
20444 + " .long 32b,100b\n"
20445 + " .long 33b,100b\n"
20446 + " .long 34b,100b\n"
20447 + " .long 35b,100b\n"
20448 + " .long 36b,100b\n"
20449 + " .long 37b,100b\n"
20450 + " .long 99b,101b\n"
20451 + ".previous"
20452 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
20453 + : "1"(to), "2"(from), "0"(size)
20454 + : "eax", "edx", "memory");
20455 + return size;
20456 +}
20457 +
20458 +static unsigned long
20459 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20460 +{
20461 + int d0, d1;
20462 + __asm__ __volatile__(
20463 + " .align 2,0x90\n"
20464 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20465 + " cmpl $67, %0\n"
20466 + " jbe 3f\n"
20467 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20468 + " .align 2,0x90\n"
20469 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20470 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20471 + "5: movl %%eax, 0(%3)\n"
20472 + "6: movl %%edx, 4(%3)\n"
20473 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20474 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20475 + "9: movl %%eax, 8(%3)\n"
20476 + "10: movl %%edx, 12(%3)\n"
20477 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20478 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20479 + "13: movl %%eax, 16(%3)\n"
20480 + "14: movl %%edx, 20(%3)\n"
20481 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20482 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20483 + "17: movl %%eax, 24(%3)\n"
20484 + "18: movl %%edx, 28(%3)\n"
20485 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20486 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20487 + "21: movl %%eax, 32(%3)\n"
20488 + "22: movl %%edx, 36(%3)\n"
20489 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20490 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20491 + "25: movl %%eax, 40(%3)\n"
20492 + "26: movl %%edx, 44(%3)\n"
20493 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20494 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20495 + "29: movl %%eax, 48(%3)\n"
20496 + "30: movl %%edx, 52(%3)\n"
20497 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20498 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20499 + "33: movl %%eax, 56(%3)\n"
20500 + "34: movl %%edx, 60(%3)\n"
20501 + " addl $-64, %0\n"
20502 + " addl $64, %4\n"
20503 + " addl $64, %3\n"
20504 + " cmpl $63, %0\n"
20505 + " ja 1b\n"
20506 + "35: movl %0, %%eax\n"
20507 + " shrl $2, %0\n"
20508 + " andl $3, %%eax\n"
20509 + " cld\n"
20510 + "99: rep; "__copyuser_seg" movsl\n"
20511 + "36: movl %%eax, %0\n"
20512 + "37: rep; "__copyuser_seg" movsb\n"
20513 + "100:\n"
20514 ".section .fixup,\"ax\"\n"
20515 "101: lea 0(%%eax,%0,4),%0\n"
20516 " jmp 100b\n"
20517 @@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
20518 int d0, d1;
20519 __asm__ __volatile__(
20520 " .align 2,0x90\n"
20521 - "0: movl 32(%4), %%eax\n"
20522 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20523 " cmpl $67, %0\n"
20524 " jbe 2f\n"
20525 - "1: movl 64(%4), %%eax\n"
20526 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20527 " .align 2,0x90\n"
20528 - "2: movl 0(%4), %%eax\n"
20529 - "21: movl 4(%4), %%edx\n"
20530 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20531 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20532 " movl %%eax, 0(%3)\n"
20533 " movl %%edx, 4(%3)\n"
20534 - "3: movl 8(%4), %%eax\n"
20535 - "31: movl 12(%4),%%edx\n"
20536 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20537 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20538 " movl %%eax, 8(%3)\n"
20539 " movl %%edx, 12(%3)\n"
20540 - "4: movl 16(%4), %%eax\n"
20541 - "41: movl 20(%4), %%edx\n"
20542 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20543 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20544 " movl %%eax, 16(%3)\n"
20545 " movl %%edx, 20(%3)\n"
20546 - "10: movl 24(%4), %%eax\n"
20547 - "51: movl 28(%4), %%edx\n"
20548 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20549 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20550 " movl %%eax, 24(%3)\n"
20551 " movl %%edx, 28(%3)\n"
20552 - "11: movl 32(%4), %%eax\n"
20553 - "61: movl 36(%4), %%edx\n"
20554 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20555 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20556 " movl %%eax, 32(%3)\n"
20557 " movl %%edx, 36(%3)\n"
20558 - "12: movl 40(%4), %%eax\n"
20559 - "71: movl 44(%4), %%edx\n"
20560 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20561 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20562 " movl %%eax, 40(%3)\n"
20563 " movl %%edx, 44(%3)\n"
20564 - "13: movl 48(%4), %%eax\n"
20565 - "81: movl 52(%4), %%edx\n"
20566 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20567 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20568 " movl %%eax, 48(%3)\n"
20569 " movl %%edx, 52(%3)\n"
20570 - "14: movl 56(%4), %%eax\n"
20571 - "91: movl 60(%4), %%edx\n"
20572 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20573 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20574 " movl %%eax, 56(%3)\n"
20575 " movl %%edx, 60(%3)\n"
20576 " addl $-64, %0\n"
20577 @@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
20578 " shrl $2, %0\n"
20579 " andl $3, %%eax\n"
20580 " cld\n"
20581 - "6: rep; movsl\n"
20582 + "6: rep; "__copyuser_seg" movsl\n"
20583 " movl %%eax,%0\n"
20584 - "7: rep; movsb\n"
20585 + "7: rep; "__copyuser_seg" movsb\n"
20586 "8:\n"
20587 ".section .fixup,\"ax\"\n"
20588 "9: lea 0(%%eax,%0,4),%0\n"
20589 @@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
20590
20591 __asm__ __volatile__(
20592 " .align 2,0x90\n"
20593 - "0: movl 32(%4), %%eax\n"
20594 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20595 " cmpl $67, %0\n"
20596 " jbe 2f\n"
20597 - "1: movl 64(%4), %%eax\n"
20598 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20599 " .align 2,0x90\n"
20600 - "2: movl 0(%4), %%eax\n"
20601 - "21: movl 4(%4), %%edx\n"
20602 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20603 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20604 " movnti %%eax, 0(%3)\n"
20605 " movnti %%edx, 4(%3)\n"
20606 - "3: movl 8(%4), %%eax\n"
20607 - "31: movl 12(%4),%%edx\n"
20608 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20609 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20610 " movnti %%eax, 8(%3)\n"
20611 " movnti %%edx, 12(%3)\n"
20612 - "4: movl 16(%4), %%eax\n"
20613 - "41: movl 20(%4), %%edx\n"
20614 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20615 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20616 " movnti %%eax, 16(%3)\n"
20617 " movnti %%edx, 20(%3)\n"
20618 - "10: movl 24(%4), %%eax\n"
20619 - "51: movl 28(%4), %%edx\n"
20620 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20621 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20622 " movnti %%eax, 24(%3)\n"
20623 " movnti %%edx, 28(%3)\n"
20624 - "11: movl 32(%4), %%eax\n"
20625 - "61: movl 36(%4), %%edx\n"
20626 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20627 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20628 " movnti %%eax, 32(%3)\n"
20629 " movnti %%edx, 36(%3)\n"
20630 - "12: movl 40(%4), %%eax\n"
20631 - "71: movl 44(%4), %%edx\n"
20632 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20633 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20634 " movnti %%eax, 40(%3)\n"
20635 " movnti %%edx, 44(%3)\n"
20636 - "13: movl 48(%4), %%eax\n"
20637 - "81: movl 52(%4), %%edx\n"
20638 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20639 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20640 " movnti %%eax, 48(%3)\n"
20641 " movnti %%edx, 52(%3)\n"
20642 - "14: movl 56(%4), %%eax\n"
20643 - "91: movl 60(%4), %%edx\n"
20644 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20645 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20646 " movnti %%eax, 56(%3)\n"
20647 " movnti %%edx, 60(%3)\n"
20648 " addl $-64, %0\n"
20649 @@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
20650 " shrl $2, %0\n"
20651 " andl $3, %%eax\n"
20652 " cld\n"
20653 - "6: rep; movsl\n"
20654 + "6: rep; "__copyuser_seg" movsl\n"
20655 " movl %%eax,%0\n"
20656 - "7: rep; movsb\n"
20657 + "7: rep; "__copyuser_seg" movsb\n"
20658 "8:\n"
20659 ".section .fixup,\"ax\"\n"
20660 "9: lea 0(%%eax,%0,4),%0\n"
20661 @@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
20662
20663 __asm__ __volatile__(
20664 " .align 2,0x90\n"
20665 - "0: movl 32(%4), %%eax\n"
20666 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20667 " cmpl $67, %0\n"
20668 " jbe 2f\n"
20669 - "1: movl 64(%4), %%eax\n"
20670 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20671 " .align 2,0x90\n"
20672 - "2: movl 0(%4), %%eax\n"
20673 - "21: movl 4(%4), %%edx\n"
20674 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20675 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20676 " movnti %%eax, 0(%3)\n"
20677 " movnti %%edx, 4(%3)\n"
20678 - "3: movl 8(%4), %%eax\n"
20679 - "31: movl 12(%4),%%edx\n"
20680 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20681 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20682 " movnti %%eax, 8(%3)\n"
20683 " movnti %%edx, 12(%3)\n"
20684 - "4: movl 16(%4), %%eax\n"
20685 - "41: movl 20(%4), %%edx\n"
20686 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20687 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20688 " movnti %%eax, 16(%3)\n"
20689 " movnti %%edx, 20(%3)\n"
20690 - "10: movl 24(%4), %%eax\n"
20691 - "51: movl 28(%4), %%edx\n"
20692 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20693 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20694 " movnti %%eax, 24(%3)\n"
20695 " movnti %%edx, 28(%3)\n"
20696 - "11: movl 32(%4), %%eax\n"
20697 - "61: movl 36(%4), %%edx\n"
20698 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20699 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20700 " movnti %%eax, 32(%3)\n"
20701 " movnti %%edx, 36(%3)\n"
20702 - "12: movl 40(%4), %%eax\n"
20703 - "71: movl 44(%4), %%edx\n"
20704 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20705 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20706 " movnti %%eax, 40(%3)\n"
20707 " movnti %%edx, 44(%3)\n"
20708 - "13: movl 48(%4), %%eax\n"
20709 - "81: movl 52(%4), %%edx\n"
20710 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20711 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20712 " movnti %%eax, 48(%3)\n"
20713 " movnti %%edx, 52(%3)\n"
20714 - "14: movl 56(%4), %%eax\n"
20715 - "91: movl 60(%4), %%edx\n"
20716 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20717 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20718 " movnti %%eax, 56(%3)\n"
20719 " movnti %%edx, 60(%3)\n"
20720 " addl $-64, %0\n"
20721 @@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
20722 " shrl $2, %0\n"
20723 " andl $3, %%eax\n"
20724 " cld\n"
20725 - "6: rep; movsl\n"
20726 + "6: rep; "__copyuser_seg" movsl\n"
20727 " movl %%eax,%0\n"
20728 - "7: rep; movsb\n"
20729 + "7: rep; "__copyuser_seg" movsb\n"
20730 "8:\n"
20731 ".section .fixup,\"ax\"\n"
20732 "9: lea 0(%%eax,%0,4),%0\n"
20733 @@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
20734 */
20735 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
20736 unsigned long size);
20737 -unsigned long __copy_user_intel(void __user *to, const void *from,
20738 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
20739 + unsigned long size);
20740 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
20741 unsigned long size);
20742 unsigned long __copy_user_zeroing_intel_nocache(void *to,
20743 const void __user *from, unsigned long size);
20744 #endif /* CONFIG_X86_INTEL_USERCOPY */
20745
20746 /* Generic arbitrary sized copy. */
20747 -#define __copy_user(to, from, size) \
20748 +#define __copy_user(to, from, size, prefix, set, restore) \
20749 do { \
20750 int __d0, __d1, __d2; \
20751 __asm__ __volatile__( \
20752 + set \
20753 " cmp $7,%0\n" \
20754 " jbe 1f\n" \
20755 " movl %1,%0\n" \
20756 " negl %0\n" \
20757 " andl $7,%0\n" \
20758 " subl %0,%3\n" \
20759 - "4: rep; movsb\n" \
20760 + "4: rep; "prefix"movsb\n" \
20761 " movl %3,%0\n" \
20762 " shrl $2,%0\n" \
20763 " andl $3,%3\n" \
20764 " .align 2,0x90\n" \
20765 - "0: rep; movsl\n" \
20766 + "0: rep; "prefix"movsl\n" \
20767 " movl %3,%0\n" \
20768 - "1: rep; movsb\n" \
20769 + "1: rep; "prefix"movsb\n" \
20770 "2:\n" \
20771 + restore \
20772 ".section .fixup,\"ax\"\n" \
20773 "5: addl %3,%0\n" \
20774 " jmp 2b\n" \
20775 @@ -682,14 +799,14 @@ do { \
20776 " negl %0\n" \
20777 " andl $7,%0\n" \
20778 " subl %0,%3\n" \
20779 - "4: rep; movsb\n" \
20780 + "4: rep; "__copyuser_seg"movsb\n" \
20781 " movl %3,%0\n" \
20782 " shrl $2,%0\n" \
20783 " andl $3,%3\n" \
20784 " .align 2,0x90\n" \
20785 - "0: rep; movsl\n" \
20786 + "0: rep; "__copyuser_seg"movsl\n" \
20787 " movl %3,%0\n" \
20788 - "1: rep; movsb\n" \
20789 + "1: rep; "__copyuser_seg"movsb\n" \
20790 "2:\n" \
20791 ".section .fixup,\"ax\"\n" \
20792 "5: addl %3,%0\n" \
20793 @@ -775,9 +892,9 @@ survive:
20794 }
20795 #endif
20796 if (movsl_is_ok(to, from, n))
20797 - __copy_user(to, from, n);
20798 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
20799 else
20800 - n = __copy_user_intel(to, from, n);
20801 + n = __generic_copy_to_user_intel(to, from, n);
20802 return n;
20803 }
20804 EXPORT_SYMBOL(__copy_to_user_ll);
20805 @@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
20806 unsigned long n)
20807 {
20808 if (movsl_is_ok(to, from, n))
20809 - __copy_user(to, from, n);
20810 + __copy_user(to, from, n, __copyuser_seg, "", "");
20811 else
20812 - n = __copy_user_intel((void __user *)to,
20813 - (const void *)from, n);
20814 + n = __generic_copy_from_user_intel(to, from, n);
20815 return n;
20816 }
20817 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
20818 @@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
20819 if (n > 64 && cpu_has_xmm2)
20820 n = __copy_user_intel_nocache(to, from, n);
20821 else
20822 - __copy_user(to, from, n);
20823 + __copy_user(to, from, n, __copyuser_seg, "", "");
20824 #else
20825 - __copy_user(to, from, n);
20826 + __copy_user(to, from, n, __copyuser_seg, "", "");
20827 #endif
20828 return n;
20829 }
20830 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
20831
20832 -/**
20833 - * copy_to_user: - Copy a block of data into user space.
20834 - * @to: Destination address, in user space.
20835 - * @from: Source address, in kernel space.
20836 - * @n: Number of bytes to copy.
20837 - *
20838 - * Context: User context only. This function may sleep.
20839 - *
20840 - * Copy data from kernel space to user space.
20841 - *
20842 - * Returns number of bytes that could not be copied.
20843 - * On success, this will be zero.
20844 - */
20845 -unsigned long
20846 -copy_to_user(void __user *to, const void *from, unsigned long n)
20847 +void copy_from_user_overflow(void)
20848 {
20849 - if (access_ok(VERIFY_WRITE, to, n))
20850 - n = __copy_to_user(to, from, n);
20851 - return n;
20852 + WARN(1, "Buffer overflow detected!\n");
20853 }
20854 -EXPORT_SYMBOL(copy_to_user);
20855 +EXPORT_SYMBOL(copy_from_user_overflow);
20856
20857 -/**
20858 - * copy_from_user: - Copy a block of data from user space.
20859 - * @to: Destination address, in kernel space.
20860 - * @from: Source address, in user space.
20861 - * @n: Number of bytes to copy.
20862 - *
20863 - * Context: User context only. This function may sleep.
20864 - *
20865 - * Copy data from user space to kernel space.
20866 - *
20867 - * Returns number of bytes that could not be copied.
20868 - * On success, this will be zero.
20869 - *
20870 - * If some data could not be copied, this function will pad the copied
20871 - * data to the requested size using zero bytes.
20872 - */
20873 -unsigned long
20874 -_copy_from_user(void *to, const void __user *from, unsigned long n)
20875 +void copy_to_user_overflow(void)
20876 {
20877 - if (access_ok(VERIFY_READ, from, n))
20878 - n = __copy_from_user(to, from, n);
20879 - else
20880 - memset(to, 0, n);
20881 - return n;
20882 + WARN(1, "Buffer overflow detected!\n");
20883 }
20884 -EXPORT_SYMBOL(_copy_from_user);
20885 +EXPORT_SYMBOL(copy_to_user_overflow);
20886
20887 -void copy_from_user_overflow(void)
20888 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20889 +void __set_fs(mm_segment_t x)
20890 {
20891 - WARN(1, "Buffer overflow detected!\n");
20892 + switch (x.seg) {
20893 + case 0:
20894 + loadsegment(gs, 0);
20895 + break;
20896 + case TASK_SIZE_MAX:
20897 + loadsegment(gs, __USER_DS);
20898 + break;
20899 + case -1UL:
20900 + loadsegment(gs, __KERNEL_DS);
20901 + break;
20902 + default:
20903 + BUG();
20904 + }
20905 + return;
20906 }
20907 -EXPORT_SYMBOL(copy_from_user_overflow);
20908 +EXPORT_SYMBOL(__set_fs);
20909 +
20910 +void set_fs(mm_segment_t x)
20911 +{
20912 + current_thread_info()->addr_limit = x;
20913 + __set_fs(x);
20914 +}
20915 +EXPORT_SYMBOL(set_fs);
20916 +#endif
20917 diff -urNp linux-2.6.39.1/arch/x86/lib/usercopy_64.c linux-2.6.39.1/arch/x86/lib/usercopy_64.c
20918 --- linux-2.6.39.1/arch/x86/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
20919 +++ linux-2.6.39.1/arch/x86/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
20920 @@ -42,6 +42,12 @@ long
20921 __strncpy_from_user(char *dst, const char __user *src, long count)
20922 {
20923 long res;
20924 +
20925 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20926 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
20927 + src += PAX_USER_SHADOW_BASE;
20928 +#endif
20929 +
20930 __do_strncpy_from_user(dst, src, count, res);
20931 return res;
20932 }
20933 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
20934 {
20935 long __d0;
20936 might_fault();
20937 +
20938 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20939 + if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
20940 + addr += PAX_USER_SHADOW_BASE;
20941 +#endif
20942 +
20943 /* no memory constraint because it doesn't change any memory gcc knows
20944 about */
20945 asm volatile(
20946 @@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
20947
20948 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
20949 {
20950 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20951 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20952 +
20953 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20954 + if ((unsigned long)to < PAX_USER_SHADOW_BASE)
20955 + to += PAX_USER_SHADOW_BASE;
20956 + if ((unsigned long)from < PAX_USER_SHADOW_BASE)
20957 + from += PAX_USER_SHADOW_BASE;
20958 +#endif
20959 +
20960 return copy_user_generic((__force void *)to, (__force void *)from, len);
20961 - }
20962 - return len;
20963 + }
20964 + return len;
20965 }
20966 EXPORT_SYMBOL(copy_in_user);
20967
20968 diff -urNp linux-2.6.39.1/arch/x86/Makefile linux-2.6.39.1/arch/x86/Makefile
20969 --- linux-2.6.39.1/arch/x86/Makefile 2011-05-19 00:06:34.000000000 -0400
20970 +++ linux-2.6.39.1/arch/x86/Makefile 2011-05-22 19:36:30.000000000 -0400
20971 @@ -195,3 +195,12 @@ define archhelp
20972 echo ' FDARGS="..." arguments for the booted kernel'
20973 echo ' FDINITRD=file initrd for the booted kernel'
20974 endef
20975 +
20976 +define OLD_LD
20977 +
20978 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
20979 +*** Please upgrade your binutils to 2.18 or newer
20980 +endef
20981 +
20982 +archprepare:
20983 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
20984 diff -urNp linux-2.6.39.1/arch/x86/mm/extable.c linux-2.6.39.1/arch/x86/mm/extable.c
20985 --- linux-2.6.39.1/arch/x86/mm/extable.c 2011-05-19 00:06:34.000000000 -0400
20986 +++ linux-2.6.39.1/arch/x86/mm/extable.c 2011-05-22 19:36:30.000000000 -0400
20987 @@ -1,14 +1,71 @@
20988 #include <linux/module.h>
20989 #include <linux/spinlock.h>
20990 +#include <linux/sort.h>
20991 #include <asm/uaccess.h>
20992 +#include <asm/pgtable.h>
20993
20994 +/*
20995 + * The exception table needs to be sorted so that the binary
20996 + * search that we use to find entries in it works properly.
20997 + * This is used both for the kernel exception table and for
20998 + * the exception tables of modules that get loaded.
20999 + */
21000 +static int cmp_ex(const void *a, const void *b)
21001 +{
21002 + const struct exception_table_entry *x = a, *y = b;
21003 +
21004 + /* avoid overflow */
21005 + if (x->insn > y->insn)
21006 + return 1;
21007 + if (x->insn < y->insn)
21008 + return -1;
21009 + return 0;
21010 +}
21011 +
21012 +static void swap_ex(void *a, void *b, int size)
21013 +{
21014 + struct exception_table_entry t, *x = a, *y = b;
21015 +
21016 + t = *x;
21017 +
21018 + pax_open_kernel();
21019 + *x = *y;
21020 + *y = t;
21021 + pax_close_kernel();
21022 +}
21023 +
21024 +void sort_extable(struct exception_table_entry *start,
21025 + struct exception_table_entry *finish)
21026 +{
21027 + sort(start, finish - start, sizeof(struct exception_table_entry),
21028 + cmp_ex, swap_ex);
21029 +}
21030 +
21031 +#ifdef CONFIG_MODULES
21032 +/*
21033 + * If the exception table is sorted, any referring to the module init
21034 + * will be at the beginning or the end.
21035 + */
21036 +void trim_init_extable(struct module *m)
21037 +{
21038 + /*trim the beginning*/
21039 + while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
21040 + m->extable++;
21041 + m->num_exentries--;
21042 + }
21043 + /*trim the end*/
21044 + while (m->num_exentries &&
21045 + within_module_init(m->extable[m->num_exentries-1].insn, m))
21046 + m->num_exentries--;
21047 +}
21048 +#endif /* CONFIG_MODULES */
21049
21050 int fixup_exception(struct pt_regs *regs)
21051 {
21052 const struct exception_table_entry *fixup;
21053
21054 #ifdef CONFIG_PNPBIOS
21055 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
21056 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
21057 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
21058 extern u32 pnp_bios_is_utter_crap;
21059 pnp_bios_is_utter_crap = 1;
21060 diff -urNp linux-2.6.39.1/arch/x86/mm/fault.c linux-2.6.39.1/arch/x86/mm/fault.c
21061 --- linux-2.6.39.1/arch/x86/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
21062 +++ linux-2.6.39.1/arch/x86/mm/fault.c 2011-06-06 17:34:04.000000000 -0400
21063 @@ -12,10 +12,18 @@
21064 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
21065 #include <linux/perf_event.h> /* perf_sw_event */
21066 #include <linux/hugetlb.h> /* hstate_index_to_shift */
21067 +#include <linux/unistd.h>
21068 +#include <linux/compiler.h>
21069
21070 #include <asm/traps.h> /* dotraplinkage, ... */
21071 #include <asm/pgalloc.h> /* pgd_*(), ... */
21072 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
21073 +#include <asm/vsyscall.h>
21074 +#include <asm/tlbflush.h>
21075 +
21076 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21077 +#include <asm/stacktrace.h>
21078 +#endif
21079
21080 /*
21081 * Page fault error code bits:
21082 @@ -53,7 +61,7 @@ static inline int __kprobes notify_page_
21083 int ret = 0;
21084
21085 /* kprobe_running() needs smp_processor_id() */
21086 - if (kprobes_built_in() && !user_mode_vm(regs)) {
21087 + if (kprobes_built_in() && !user_mode(regs)) {
21088 preempt_disable();
21089 if (kprobe_running() && kprobe_fault_handler(regs, 14))
21090 ret = 1;
21091 @@ -114,7 +122,10 @@ check_prefetch_opcode(struct pt_regs *re
21092 return !instr_lo || (instr_lo>>1) == 1;
21093 case 0x00:
21094 /* Prefetch instruction is 0x0F0D or 0x0F18 */
21095 - if (probe_kernel_address(instr, opcode))
21096 + if (user_mode(regs)) {
21097 + if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
21098 + return 0;
21099 + } else if (probe_kernel_address(instr, opcode))
21100 return 0;
21101
21102 *prefetch = (instr_lo == 0xF) &&
21103 @@ -148,7 +159,10 @@ is_prefetch(struct pt_regs *regs, unsign
21104 while (instr < max_instr) {
21105 unsigned char opcode;
21106
21107 - if (probe_kernel_address(instr, opcode))
21108 + if (user_mode(regs)) {
21109 + if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
21110 + break;
21111 + } else if (probe_kernel_address(instr, opcode))
21112 break;
21113
21114 instr++;
21115 @@ -179,6 +193,30 @@ force_sig_info_fault(int si_signo, int s
21116 force_sig_info(si_signo, &info, tsk);
21117 }
21118
21119 +#ifdef CONFIG_PAX_EMUTRAMP
21120 +static int pax_handle_fetch_fault(struct pt_regs *regs);
21121 +#endif
21122 +
21123 +#ifdef CONFIG_PAX_PAGEEXEC
21124 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
21125 +{
21126 + pgd_t *pgd;
21127 + pud_t *pud;
21128 + pmd_t *pmd;
21129 +
21130 + pgd = pgd_offset(mm, address);
21131 + if (!pgd_present(*pgd))
21132 + return NULL;
21133 + pud = pud_offset(pgd, address);
21134 + if (!pud_present(*pud))
21135 + return NULL;
21136 + pmd = pmd_offset(pud, address);
21137 + if (!pmd_present(*pmd))
21138 + return NULL;
21139 + return pmd;
21140 +}
21141 +#endif
21142 +
21143 DEFINE_SPINLOCK(pgd_lock);
21144 LIST_HEAD(pgd_list);
21145
21146 @@ -229,10 +267,22 @@ void vmalloc_sync_all(void)
21147 for (address = VMALLOC_START & PMD_MASK;
21148 address >= TASK_SIZE && address < FIXADDR_TOP;
21149 address += PMD_SIZE) {
21150 +
21151 +#ifdef CONFIG_PAX_PER_CPU_PGD
21152 + unsigned long cpu;
21153 +#else
21154 struct page *page;
21155 +#endif
21156
21157 spin_lock(&pgd_lock);
21158 +
21159 +#ifdef CONFIG_PAX_PER_CPU_PGD
21160 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21161 + pgd_t *pgd = get_cpu_pgd(cpu);
21162 + pmd_t *ret;
21163 +#else
21164 list_for_each_entry(page, &pgd_list, lru) {
21165 + pgd_t *pgd = page_address(page);
21166 spinlock_t *pgt_lock;
21167 pmd_t *ret;
21168
21169 @@ -240,8 +290,13 @@ void vmalloc_sync_all(void)
21170 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21171
21172 spin_lock(pgt_lock);
21173 - ret = vmalloc_sync_one(page_address(page), address);
21174 +#endif
21175 +
21176 + ret = vmalloc_sync_one(pgd, address);
21177 +
21178 +#ifndef CONFIG_PAX_PER_CPU_PGD
21179 spin_unlock(pgt_lock);
21180 +#endif
21181
21182 if (!ret)
21183 break;
21184 @@ -275,6 +330,11 @@ static noinline __kprobes int vmalloc_fa
21185 * an interrupt in the middle of a task switch..
21186 */
21187 pgd_paddr = read_cr3();
21188 +
21189 +#ifdef CONFIG_PAX_PER_CPU_PGD
21190 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21191 +#endif
21192 +
21193 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21194 if (!pmd_k)
21195 return -1;
21196 @@ -370,7 +430,14 @@ static noinline __kprobes int vmalloc_fa
21197 * happen within a race in page table update. In the later
21198 * case just flush:
21199 */
21200 +
21201 +#ifdef CONFIG_PAX_PER_CPU_PGD
21202 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21203 + pgd = pgd_offset_cpu(smp_processor_id(), address);
21204 +#else
21205 pgd = pgd_offset(current->active_mm, address);
21206 +#endif
21207 +
21208 pgd_ref = pgd_offset_k(address);
21209 if (pgd_none(*pgd_ref))
21210 return -1;
21211 @@ -532,7 +599,7 @@ static int is_errata93(struct pt_regs *r
21212 static int is_errata100(struct pt_regs *regs, unsigned long address)
21213 {
21214 #ifdef CONFIG_X86_64
21215 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21216 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21217 return 1;
21218 #endif
21219 return 0;
21220 @@ -559,7 +626,7 @@ static int is_f00f_bug(struct pt_regs *r
21221 }
21222
21223 static const char nx_warning[] = KERN_CRIT
21224 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21225 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21226
21227 static void
21228 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21229 @@ -568,15 +635,26 @@ show_fault_oops(struct pt_regs *regs, un
21230 if (!oops_may_print())
21231 return;
21232
21233 - if (error_code & PF_INSTR) {
21234 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21235 unsigned int level;
21236
21237 pte_t *pte = lookup_address(address, &level);
21238
21239 if (pte && pte_present(*pte) && !pte_exec(*pte))
21240 - printk(nx_warning, current_uid());
21241 + printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21242 }
21243
21244 +#ifdef CONFIG_PAX_KERNEXEC
21245 + if (init_mm.start_code <= address && address < init_mm.end_code) {
21246 + if (current->signal->curr_ip)
21247 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21248 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21249 + else
21250 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21251 + current->comm, task_pid_nr(current), current_uid(), current_euid());
21252 + }
21253 +#endif
21254 +
21255 printk(KERN_ALERT "BUG: unable to handle kernel ");
21256 if (address < PAGE_SIZE)
21257 printk(KERN_CONT "NULL pointer dereference");
21258 @@ -701,6 +779,68 @@ __bad_area_nosemaphore(struct pt_regs *r
21259 unsigned long address, int si_code)
21260 {
21261 struct task_struct *tsk = current;
21262 + struct mm_struct *mm = tsk->mm;
21263 +
21264 +#ifdef CONFIG_X86_64
21265 + if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
21266 + if (regs->ip == (unsigned long)vgettimeofday) {
21267 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
21268 + return;
21269 + } else if (regs->ip == (unsigned long)vtime) {
21270 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
21271 + return;
21272 + } else if (regs->ip == (unsigned long)vgetcpu) {
21273 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
21274 + return;
21275 + }
21276 + }
21277 +#endif
21278 +
21279 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21280 + if (mm && (error_code & PF_USER)) {
21281 + unsigned long ip = regs->ip;
21282 +
21283 + if (v8086_mode(regs))
21284 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21285 +
21286 + /*
21287 + * It's possible to have interrupts off here:
21288 + */
21289 + local_irq_enable();
21290 +
21291 +#ifdef CONFIG_PAX_PAGEEXEC
21292 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
21293 + (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
21294 +
21295 +#ifdef CONFIG_PAX_EMUTRAMP
21296 + switch (pax_handle_fetch_fault(regs)) {
21297 + case 2:
21298 + return;
21299 + }
21300 +#endif
21301 +
21302 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21303 + do_group_exit(SIGKILL);
21304 + }
21305 +#endif
21306 +
21307 +#ifdef CONFIG_PAX_SEGMEXEC
21308 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
21309 +
21310 +#ifdef CONFIG_PAX_EMUTRAMP
21311 + switch (pax_handle_fetch_fault(regs)) {
21312 + case 2:
21313 + return;
21314 + }
21315 +#endif
21316 +
21317 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21318 + do_group_exit(SIGKILL);
21319 + }
21320 +#endif
21321 +
21322 + }
21323 +#endif
21324
21325 /* User mode accesses just cause a SIGSEGV */
21326 if (error_code & PF_USER) {
21327 @@ -855,6 +995,99 @@ static int spurious_fault_check(unsigned
21328 return 1;
21329 }
21330
21331 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21332 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21333 +{
21334 + pte_t *pte;
21335 + pmd_t *pmd;
21336 + spinlock_t *ptl;
21337 + unsigned char pte_mask;
21338 +
21339 + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21340 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
21341 + return 0;
21342 +
21343 + /* PaX: it's our fault, let's handle it if we can */
21344 +
21345 + /* PaX: take a look at read faults before acquiring any locks */
21346 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21347 + /* instruction fetch attempt from a protected page in user mode */
21348 + up_read(&mm->mmap_sem);
21349 +
21350 +#ifdef CONFIG_PAX_EMUTRAMP
21351 + switch (pax_handle_fetch_fault(regs)) {
21352 + case 2:
21353 + return 1;
21354 + }
21355 +#endif
21356 +
21357 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21358 + do_group_exit(SIGKILL);
21359 + }
21360 +
21361 + pmd = pax_get_pmd(mm, address);
21362 + if (unlikely(!pmd))
21363 + return 0;
21364 +
21365 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21366 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21367 + pte_unmap_unlock(pte, ptl);
21368 + return 0;
21369 + }
21370 +
21371 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21372 + /* write attempt to a protected page in user mode */
21373 + pte_unmap_unlock(pte, ptl);
21374 + return 0;
21375 + }
21376 +
21377 +#ifdef CONFIG_SMP
21378 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21379 +#else
21380 + if (likely(address > get_limit(regs->cs)))
21381 +#endif
21382 + {
21383 + set_pte(pte, pte_mkread(*pte));
21384 + __flush_tlb_one(address);
21385 + pte_unmap_unlock(pte, ptl);
21386 + up_read(&mm->mmap_sem);
21387 + return 1;
21388 + }
21389 +
21390 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21391 +
21392 + /*
21393 + * PaX: fill DTLB with user rights and retry
21394 + */
21395 + __asm__ __volatile__ (
21396 + "orb %2,(%1)\n"
21397 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21398 +/*
21399 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21400 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21401 + * page fault when examined during a TLB load attempt. this is true not only
21402 + * for PTEs holding a non-present entry but also present entries that will
21403 + * raise a page fault (such as those set up by PaX, or the copy-on-write
21404 + * mechanism). in effect it means that we do *not* need to flush the TLBs
21405 + * for our target pages since their PTEs are simply not in the TLBs at all.
21406 +
21407 + * the best thing in omitting it is that we gain around 15-20% speed in the
21408 + * fast path of the page fault handler and can get rid of tracing since we
21409 + * can no longer flush unintended entries.
21410 + */
21411 + "invlpg (%0)\n"
21412 +#endif
21413 + __copyuser_seg"testb $0,(%0)\n"
21414 + "xorb %3,(%1)\n"
21415 + :
21416 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21417 + : "memory", "cc");
21418 + pte_unmap_unlock(pte, ptl);
21419 + up_read(&mm->mmap_sem);
21420 + return 1;
21421 +}
21422 +#endif
21423 +
21424 /*
21425 * Handle a spurious fault caused by a stale TLB entry.
21426 *
21427 @@ -927,6 +1160,9 @@ int show_unhandled_signals = 1;
21428 static inline int
21429 access_error(unsigned long error_code, struct vm_area_struct *vma)
21430 {
21431 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21432 + return 1;
21433 +
21434 if (error_code & PF_WRITE) {
21435 /* write, present and write, not present: */
21436 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21437 @@ -960,19 +1196,33 @@ do_page_fault(struct pt_regs *regs, unsi
21438 {
21439 struct vm_area_struct *vma;
21440 struct task_struct *tsk;
21441 - unsigned long address;
21442 struct mm_struct *mm;
21443 int fault;
21444 int write = error_code & PF_WRITE;
21445 unsigned int flags = FAULT_FLAG_ALLOW_RETRY |
21446 (write ? FAULT_FLAG_WRITE : 0);
21447
21448 + /* Get the faulting address: */
21449 + unsigned long address = read_cr2();
21450 +
21451 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21452 + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21453 + if (!search_exception_tables(regs->ip)) {
21454 + bad_area_nosemaphore(regs, error_code, address);
21455 + return;
21456 + }
21457 + if (address < PAX_USER_SHADOW_BASE) {
21458 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21459 + printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
21460 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21461 + } else
21462 + address -= PAX_USER_SHADOW_BASE;
21463 + }
21464 +#endif
21465 +
21466 tsk = current;
21467 mm = tsk->mm;
21468
21469 - /* Get the faulting address: */
21470 - address = read_cr2();
21471 -
21472 /*
21473 * Detect and handle instructions that would cause a page fault for
21474 * both a tracked kernel page and a userspace page.
21475 @@ -1032,7 +1282,7 @@ do_page_fault(struct pt_regs *regs, unsi
21476 * User-mode registers count as a user access even for any
21477 * potential system fault or CPU buglet:
21478 */
21479 - if (user_mode_vm(regs)) {
21480 + if (user_mode(regs)) {
21481 local_irq_enable();
21482 error_code |= PF_USER;
21483 } else {
21484 @@ -1087,6 +1337,11 @@ retry:
21485 might_sleep();
21486 }
21487
21488 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21489 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21490 + return;
21491 +#endif
21492 +
21493 vma = find_vma(mm, address);
21494 if (unlikely(!vma)) {
21495 bad_area(regs, error_code, address);
21496 @@ -1098,18 +1353,24 @@ retry:
21497 bad_area(regs, error_code, address);
21498 return;
21499 }
21500 - if (error_code & PF_USER) {
21501 - /*
21502 - * Accessing the stack below %sp is always a bug.
21503 - * The large cushion allows instructions like enter
21504 - * and pusha to work. ("enter $65535, $31" pushes
21505 - * 32 pointers and then decrements %sp by 65535.)
21506 - */
21507 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21508 - bad_area(regs, error_code, address);
21509 - return;
21510 - }
21511 + /*
21512 + * Accessing the stack below %sp is always a bug.
21513 + * The large cushion allows instructions like enter
21514 + * and pusha to work. ("enter $65535, $31" pushes
21515 + * 32 pointers and then decrements %sp by 65535.)
21516 + */
21517 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21518 + bad_area(regs, error_code, address);
21519 + return;
21520 }
21521 +
21522 +#ifdef CONFIG_PAX_SEGMEXEC
21523 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21524 + bad_area(regs, error_code, address);
21525 + return;
21526 + }
21527 +#endif
21528 +
21529 if (unlikely(expand_stack(vma, address))) {
21530 bad_area(regs, error_code, address);
21531 return;
21532 @@ -1164,3 +1425,199 @@ good_area:
21533
21534 up_read(&mm->mmap_sem);
21535 }
21536 +
21537 +#ifdef CONFIG_PAX_EMUTRAMP
21538 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21539 +{
21540 + int err;
21541 +
21542 + do { /* PaX: gcc trampoline emulation #1 */
21543 + unsigned char mov1, mov2;
21544 + unsigned short jmp;
21545 + unsigned int addr1, addr2;
21546 +
21547 +#ifdef CONFIG_X86_64
21548 + if ((regs->ip + 11) >> 32)
21549 + break;
21550 +#endif
21551 +
21552 + err = get_user(mov1, (unsigned char __user *)regs->ip);
21553 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21554 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21555 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21556 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21557 +
21558 + if (err)
21559 + break;
21560 +
21561 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21562 + regs->cx = addr1;
21563 + regs->ax = addr2;
21564 + regs->ip = addr2;
21565 + return 2;
21566 + }
21567 + } while (0);
21568 +
21569 + do { /* PaX: gcc trampoline emulation #2 */
21570 + unsigned char mov, jmp;
21571 + unsigned int addr1, addr2;
21572 +
21573 +#ifdef CONFIG_X86_64
21574 + if ((regs->ip + 9) >> 32)
21575 + break;
21576 +#endif
21577 +
21578 + err = get_user(mov, (unsigned char __user *)regs->ip);
21579 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21580 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21581 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21582 +
21583 + if (err)
21584 + break;
21585 +
21586 + if (mov == 0xB9 && jmp == 0xE9) {
21587 + regs->cx = addr1;
21588 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21589 + return 2;
21590 + }
21591 + } while (0);
21592 +
21593 + return 1; /* PaX in action */
21594 +}
21595 +
21596 +#ifdef CONFIG_X86_64
21597 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21598 +{
21599 + int err;
21600 +
21601 + do { /* PaX: gcc trampoline emulation #1 */
21602 + unsigned short mov1, mov2, jmp1;
21603 + unsigned char jmp2;
21604 + unsigned int addr1;
21605 + unsigned long addr2;
21606 +
21607 + err = get_user(mov1, (unsigned short __user *)regs->ip);
21608 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21609 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21610 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21611 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21612 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21613 +
21614 + if (err)
21615 + break;
21616 +
21617 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21618 + regs->r11 = addr1;
21619 + regs->r10 = addr2;
21620 + regs->ip = addr1;
21621 + return 2;
21622 + }
21623 + } while (0);
21624 +
21625 + do { /* PaX: gcc trampoline emulation #2 */
21626 + unsigned short mov1, mov2, jmp1;
21627 + unsigned char jmp2;
21628 + unsigned long addr1, addr2;
21629 +
21630 + err = get_user(mov1, (unsigned short __user *)regs->ip);
21631 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21632 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21633 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21634 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21635 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21636 +
21637 + if (err)
21638 + break;
21639 +
21640 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21641 + regs->r11 = addr1;
21642 + regs->r10 = addr2;
21643 + regs->ip = addr1;
21644 + return 2;
21645 + }
21646 + } while (0);
21647 +
21648 + return 1; /* PaX in action */
21649 +}
21650 +#endif
21651 +
21652 +/*
21653 + * PaX: decide what to do with offenders (regs->ip = fault address)
21654 + *
21655 + * returns 1 when task should be killed
21656 + * 2 when gcc trampoline was detected
21657 + */
21658 +static int pax_handle_fetch_fault(struct pt_regs *regs)
21659 +{
21660 + if (v8086_mode(regs))
21661 + return 1;
21662 +
21663 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21664 + return 1;
21665 +
21666 +#ifdef CONFIG_X86_32
21667 + return pax_handle_fetch_fault_32(regs);
21668 +#else
21669 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21670 + return pax_handle_fetch_fault_32(regs);
21671 + else
21672 + return pax_handle_fetch_fault_64(regs);
21673 +#endif
21674 +}
21675 +#endif
21676 +
21677 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21678 +void pax_report_insns(void *pc, void *sp)
21679 +{
21680 + long i;
21681 +
21682 + printk(KERN_ERR "PAX: bytes at PC: ");
21683 + for (i = 0; i < 20; i++) {
21684 + unsigned char c;
21685 + if (get_user(c, (__force unsigned char __user *)pc+i))
21686 + printk(KERN_CONT "?? ");
21687 + else
21688 + printk(KERN_CONT "%02x ", c);
21689 + }
21690 + printk("\n");
21691 +
21692 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
21693 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
21694 + unsigned long c;
21695 + if (get_user(c, (__force unsigned long __user *)sp+i))
21696 +#ifdef CONFIG_X86_32
21697 + printk(KERN_CONT "???????? ");
21698 +#else
21699 + printk(KERN_CONT "???????????????? ");
21700 +#endif
21701 + else
21702 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
21703 + }
21704 + printk("\n");
21705 +}
21706 +#endif
21707 +
21708 +/**
21709 + * probe_kernel_write(): safely attempt to write to a location
21710 + * @dst: address to write to
21711 + * @src: pointer to the data that shall be written
21712 + * @size: size of the data chunk
21713 + *
21714 + * Safely write to address @dst from the buffer at @src. If a kernel fault
21715 + * happens, handle that and return -EFAULT.
21716 + */
21717 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
21718 +{
21719 + long ret;
21720 + mm_segment_t old_fs = get_fs();
21721 +
21722 + set_fs(KERNEL_DS);
21723 + pagefault_disable();
21724 + pax_open_kernel();
21725 + ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
21726 + pax_close_kernel();
21727 + pagefault_enable();
21728 + set_fs(old_fs);
21729 +
21730 + return ret ? -EFAULT : 0;
21731 +}
21732 diff -urNp linux-2.6.39.1/arch/x86/mm/gup.c linux-2.6.39.1/arch/x86/mm/gup.c
21733 --- linux-2.6.39.1/arch/x86/mm/gup.c 2011-05-19 00:06:34.000000000 -0400
21734 +++ linux-2.6.39.1/arch/x86/mm/gup.c 2011-05-22 19:36:30.000000000 -0400
21735 @@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long
21736 addr = start;
21737 len = (unsigned long) nr_pages << PAGE_SHIFT;
21738 end = start + len;
21739 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21740 + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21741 (void __user *)start, len)))
21742 return 0;
21743
21744 diff -urNp linux-2.6.39.1/arch/x86/mm/highmem_32.c linux-2.6.39.1/arch/x86/mm/highmem_32.c
21745 --- linux-2.6.39.1/arch/x86/mm/highmem_32.c 2011-05-19 00:06:34.000000000 -0400
21746 +++ linux-2.6.39.1/arch/x86/mm/highmem_32.c 2011-05-22 19:36:30.000000000 -0400
21747 @@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
21748 idx = type + KM_TYPE_NR*smp_processor_id();
21749 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21750 BUG_ON(!pte_none(*(kmap_pte-idx)));
21751 +
21752 + pax_open_kernel();
21753 set_pte(kmap_pte-idx, mk_pte(page, prot));
21754 + pax_close_kernel();
21755
21756 return (void *)vaddr;
21757 }
21758 diff -urNp linux-2.6.39.1/arch/x86/mm/hugetlbpage.c linux-2.6.39.1/arch/x86/mm/hugetlbpage.c
21759 --- linux-2.6.39.1/arch/x86/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
21760 +++ linux-2.6.39.1/arch/x86/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
21761 @@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
21762 struct hstate *h = hstate_file(file);
21763 struct mm_struct *mm = current->mm;
21764 struct vm_area_struct *vma;
21765 - unsigned long start_addr;
21766 + unsigned long start_addr, pax_task_size = TASK_SIZE;
21767 +
21768 +#ifdef CONFIG_PAX_SEGMEXEC
21769 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
21770 + pax_task_size = SEGMEXEC_TASK_SIZE;
21771 +#endif
21772 +
21773 + pax_task_size -= PAGE_SIZE;
21774
21775 if (len > mm->cached_hole_size) {
21776 - start_addr = mm->free_area_cache;
21777 + start_addr = mm->free_area_cache;
21778 } else {
21779 - start_addr = TASK_UNMAPPED_BASE;
21780 - mm->cached_hole_size = 0;
21781 + start_addr = mm->mmap_base;
21782 + mm->cached_hole_size = 0;
21783 }
21784
21785 full_search:
21786 @@ -280,26 +287,27 @@ full_search:
21787
21788 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
21789 /* At this point: (!vma || addr < vma->vm_end). */
21790 - if (TASK_SIZE - len < addr) {
21791 + if (pax_task_size - len < addr) {
21792 /*
21793 * Start a new search - just in case we missed
21794 * some holes.
21795 */
21796 - if (start_addr != TASK_UNMAPPED_BASE) {
21797 - start_addr = TASK_UNMAPPED_BASE;
21798 + if (start_addr != mm->mmap_base) {
21799 + start_addr = mm->mmap_base;
21800 mm->cached_hole_size = 0;
21801 goto full_search;
21802 }
21803 return -ENOMEM;
21804 }
21805 - if (!vma || addr + len <= vma->vm_start) {
21806 - mm->free_area_cache = addr + len;
21807 - return addr;
21808 - }
21809 + if (check_heap_stack_gap(vma, addr, len))
21810 + break;
21811 if (addr + mm->cached_hole_size < vma->vm_start)
21812 mm->cached_hole_size = vma->vm_start - addr;
21813 addr = ALIGN(vma->vm_end, huge_page_size(h));
21814 }
21815 +
21816 + mm->free_area_cache = addr + len;
21817 + return addr;
21818 }
21819
21820 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
21821 @@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe
21822 {
21823 struct hstate *h = hstate_file(file);
21824 struct mm_struct *mm = current->mm;
21825 - struct vm_area_struct *vma, *prev_vma;
21826 - unsigned long base = mm->mmap_base, addr = addr0;
21827 + struct vm_area_struct *vma;
21828 + unsigned long base = mm->mmap_base, addr;
21829 unsigned long largest_hole = mm->cached_hole_size;
21830 - int first_time = 1;
21831
21832 /* don't allow allocations above current base */
21833 if (mm->free_area_cache > base)
21834 @@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe
21835 largest_hole = 0;
21836 mm->free_area_cache = base;
21837 }
21838 -try_again:
21839 +
21840 /* make sure it can fit in the remaining address space */
21841 if (mm->free_area_cache < len)
21842 goto fail;
21843
21844 /* either no address requested or can't fit in requested address hole */
21845 - addr = (mm->free_area_cache - len) & huge_page_mask(h);
21846 + addr = (mm->free_area_cache - len);
21847 do {
21848 + addr &= huge_page_mask(h);
21849 + vma = find_vma(mm, addr);
21850 /*
21851 * Lookup failure means no vma is above this address,
21852 * i.e. return with success:
21853 - */
21854 - if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
21855 - return addr;
21856 -
21857 - /*
21858 * new region fits between prev_vma->vm_end and
21859 * vma->vm_start, use it:
21860 */
21861 - if (addr + len <= vma->vm_start &&
21862 - (!prev_vma || (addr >= prev_vma->vm_end))) {
21863 + if (check_heap_stack_gap(vma, addr, len)) {
21864 /* remember the address as a hint for next time */
21865 - mm->cached_hole_size = largest_hole;
21866 - return (mm->free_area_cache = addr);
21867 - } else {
21868 - /* pull free_area_cache down to the first hole */
21869 - if (mm->free_area_cache == vma->vm_end) {
21870 - mm->free_area_cache = vma->vm_start;
21871 - mm->cached_hole_size = largest_hole;
21872 - }
21873 + mm->cached_hole_size = largest_hole;
21874 + return (mm->free_area_cache = addr);
21875 + }
21876 + /* pull free_area_cache down to the first hole */
21877 + if (mm->free_area_cache == vma->vm_end) {
21878 + mm->free_area_cache = vma->vm_start;
21879 + mm->cached_hole_size = largest_hole;
21880 }
21881
21882 /* remember the largest hole we saw so far */
21883 if (addr + largest_hole < vma->vm_start)
21884 - largest_hole = vma->vm_start - addr;
21885 + largest_hole = vma->vm_start - addr;
21886
21887 /* try just below the current vma->vm_start */
21888 - addr = (vma->vm_start - len) & huge_page_mask(h);
21889 - } while (len <= vma->vm_start);
21890 + addr = skip_heap_stack_gap(vma, len);
21891 + } while (!IS_ERR_VALUE(addr));
21892
21893 fail:
21894 /*
21895 - * if hint left us with no space for the requested
21896 - * mapping then try again:
21897 - */
21898 - if (first_time) {
21899 - mm->free_area_cache = base;
21900 - largest_hole = 0;
21901 - first_time = 0;
21902 - goto try_again;
21903 - }
21904 - /*
21905 * A failed mmap() very likely causes application failure,
21906 * so fall back to the bottom-up function here. This scenario
21907 * can happen with large stack limits and large mmap()
21908 * allocations.
21909 */
21910 - mm->free_area_cache = TASK_UNMAPPED_BASE;
21911 +
21912 +#ifdef CONFIG_PAX_SEGMEXEC
21913 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
21914 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
21915 + else
21916 +#endif
21917 +
21918 + mm->mmap_base = TASK_UNMAPPED_BASE;
21919 +
21920 +#ifdef CONFIG_PAX_RANDMMAP
21921 + if (mm->pax_flags & MF_PAX_RANDMMAP)
21922 + mm->mmap_base += mm->delta_mmap;
21923 +#endif
21924 +
21925 + mm->free_area_cache = mm->mmap_base;
21926 mm->cached_hole_size = ~0UL;
21927 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
21928 len, pgoff, flags);
21929 @@ -386,6 +392,7 @@ fail:
21930 /*
21931 * Restore the topdown base:
21932 */
21933 + mm->mmap_base = base;
21934 mm->free_area_cache = base;
21935 mm->cached_hole_size = ~0UL;
21936
21937 @@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
21938 struct hstate *h = hstate_file(file);
21939 struct mm_struct *mm = current->mm;
21940 struct vm_area_struct *vma;
21941 + unsigned long pax_task_size = TASK_SIZE;
21942
21943 if (len & ~huge_page_mask(h))
21944 return -EINVAL;
21945 - if (len > TASK_SIZE)
21946 +
21947 +#ifdef CONFIG_PAX_SEGMEXEC
21948 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
21949 + pax_task_size = SEGMEXEC_TASK_SIZE;
21950 +#endif
21951 +
21952 + pax_task_size -= PAGE_SIZE;
21953 +
21954 + if (len > pax_task_size)
21955 return -ENOMEM;
21956
21957 if (flags & MAP_FIXED) {
21958 @@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
21959 if (addr) {
21960 addr = ALIGN(addr, huge_page_size(h));
21961 vma = find_vma(mm, addr);
21962 - if (TASK_SIZE - len >= addr &&
21963 - (!vma || addr + len <= vma->vm_start))
21964 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
21965 return addr;
21966 }
21967 if (mm->get_unmapped_area == arch_get_unmapped_area)
21968 diff -urNp linux-2.6.39.1/arch/x86/mm/init_32.c linux-2.6.39.1/arch/x86/mm/init_32.c
21969 --- linux-2.6.39.1/arch/x86/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
21970 +++ linux-2.6.39.1/arch/x86/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
21971 @@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
21972 }
21973
21974 /*
21975 - * Creates a middle page table and puts a pointer to it in the
21976 - * given global directory entry. This only returns the gd entry
21977 - * in non-PAE compilation mode, since the middle layer is folded.
21978 - */
21979 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
21980 -{
21981 - pud_t *pud;
21982 - pmd_t *pmd_table;
21983 -
21984 -#ifdef CONFIG_X86_PAE
21985 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
21986 - if (after_bootmem)
21987 - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
21988 - else
21989 - pmd_table = (pmd_t *)alloc_low_page();
21990 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
21991 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
21992 - pud = pud_offset(pgd, 0);
21993 - BUG_ON(pmd_table != pmd_offset(pud, 0));
21994 -
21995 - return pmd_table;
21996 - }
21997 -#endif
21998 - pud = pud_offset(pgd, 0);
21999 - pmd_table = pmd_offset(pud, 0);
22000 -
22001 - return pmd_table;
22002 -}
22003 -
22004 -/*
22005 * Create a page table and place a pointer to it in a middle page
22006 * directory entry:
22007 */
22008 @@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini
22009 page_table = (pte_t *)alloc_low_page();
22010
22011 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
22012 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22013 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
22014 +#else
22015 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
22016 +#endif
22017 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
22018 }
22019
22020 return pte_offset_kernel(pmd, 0);
22021 }
22022
22023 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
22024 +{
22025 + pud_t *pud;
22026 + pmd_t *pmd_table;
22027 +
22028 + pud = pud_offset(pgd, 0);
22029 + pmd_table = pmd_offset(pud, 0);
22030 +
22031 + return pmd_table;
22032 +}
22033 +
22034 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
22035 {
22036 int pgd_idx = pgd_index(vaddr);
22037 @@ -203,6 +188,7 @@ page_table_range_init(unsigned long star
22038 int pgd_idx, pmd_idx;
22039 unsigned long vaddr;
22040 pgd_t *pgd;
22041 + pud_t *pud;
22042 pmd_t *pmd;
22043 pte_t *pte = NULL;
22044
22045 @@ -212,8 +198,13 @@ page_table_range_init(unsigned long star
22046 pgd = pgd_base + pgd_idx;
22047
22048 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
22049 - pmd = one_md_table_init(pgd);
22050 - pmd = pmd + pmd_index(vaddr);
22051 + pud = pud_offset(pgd, vaddr);
22052 + pmd = pmd_offset(pud, vaddr);
22053 +
22054 +#ifdef CONFIG_X86_PAE
22055 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22056 +#endif
22057 +
22058 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
22059 pmd++, pmd_idx++) {
22060 pte = page_table_kmap_check(one_page_table_init(pmd),
22061 @@ -225,11 +216,20 @@ page_table_range_init(unsigned long star
22062 }
22063 }
22064
22065 -static inline int is_kernel_text(unsigned long addr)
22066 +static inline int is_kernel_text(unsigned long start, unsigned long end)
22067 {
22068 - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
22069 - return 1;
22070 - return 0;
22071 + if ((start > ktla_ktva((unsigned long)_etext) ||
22072 + end <= ktla_ktva((unsigned long)_stext)) &&
22073 + (start > ktla_ktva((unsigned long)_einittext) ||
22074 + end <= ktla_ktva((unsigned long)_sinittext)) &&
22075 +
22076 +#ifdef CONFIG_ACPI_SLEEP
22077 + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
22078 +#endif
22079 +
22080 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
22081 + return 0;
22082 + return 1;
22083 }
22084
22085 /*
22086 @@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo
22087 unsigned long last_map_addr = end;
22088 unsigned long start_pfn, end_pfn;
22089 pgd_t *pgd_base = swapper_pg_dir;
22090 - int pgd_idx, pmd_idx, pte_ofs;
22091 + unsigned int pgd_idx, pmd_idx, pte_ofs;
22092 unsigned long pfn;
22093 pgd_t *pgd;
22094 + pud_t *pud;
22095 pmd_t *pmd;
22096 pte_t *pte;
22097 unsigned pages_2m, pages_4k;
22098 @@ -281,8 +282,13 @@ repeat:
22099 pfn = start_pfn;
22100 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22101 pgd = pgd_base + pgd_idx;
22102 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
22103 - pmd = one_md_table_init(pgd);
22104 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
22105 + pud = pud_offset(pgd, 0);
22106 + pmd = pmd_offset(pud, 0);
22107 +
22108 +#ifdef CONFIG_X86_PAE
22109 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22110 +#endif
22111
22112 if (pfn >= end_pfn)
22113 continue;
22114 @@ -294,14 +300,13 @@ repeat:
22115 #endif
22116 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
22117 pmd++, pmd_idx++) {
22118 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
22119 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
22120
22121 /*
22122 * Map with big pages if possible, otherwise
22123 * create normal page tables:
22124 */
22125 if (use_pse) {
22126 - unsigned int addr2;
22127 pgprot_t prot = PAGE_KERNEL_LARGE;
22128 /*
22129 * first pass will use the same initial
22130 @@ -311,11 +316,7 @@ repeat:
22131 __pgprot(PTE_IDENT_ATTR |
22132 _PAGE_PSE);
22133
22134 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
22135 - PAGE_OFFSET + PAGE_SIZE-1;
22136 -
22137 - if (is_kernel_text(addr) ||
22138 - is_kernel_text(addr2))
22139 + if (is_kernel_text(address, address + PMD_SIZE))
22140 prot = PAGE_KERNEL_LARGE_EXEC;
22141
22142 pages_2m++;
22143 @@ -332,7 +333,7 @@ repeat:
22144 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22145 pte += pte_ofs;
22146 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22147 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22148 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22149 pgprot_t prot = PAGE_KERNEL;
22150 /*
22151 * first pass will use the same initial
22152 @@ -340,7 +341,7 @@ repeat:
22153 */
22154 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22155
22156 - if (is_kernel_text(addr))
22157 + if (is_kernel_text(address, address + PAGE_SIZE))
22158 prot = PAGE_KERNEL_EXEC;
22159
22160 pages_4k++;
22161 @@ -472,7 +473,7 @@ void __init native_pagetable_setup_start
22162
22163 pud = pud_offset(pgd, va);
22164 pmd = pmd_offset(pud, va);
22165 - if (!pmd_present(*pmd))
22166 + if (!pmd_present(*pmd) || pmd_huge(*pmd))
22167 break;
22168
22169 pte = pte_offset_kernel(pmd, va);
22170 @@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran
22171
22172 static void __init pagetable_init(void)
22173 {
22174 - pgd_t *pgd_base = swapper_pg_dir;
22175 -
22176 - permanent_kmaps_init(pgd_base);
22177 + permanent_kmaps_init(swapper_pg_dir);
22178 }
22179
22180 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22181 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22182 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22183
22184 /* user-defined highmem size */
22185 @@ -754,6 +753,12 @@ void __init mem_init(void)
22186
22187 pci_iommu_alloc();
22188
22189 +#ifdef CONFIG_PAX_PER_CPU_PGD
22190 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22191 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22192 + KERNEL_PGD_PTRS);
22193 +#endif
22194 +
22195 #ifdef CONFIG_FLATMEM
22196 BUG_ON(!mem_map);
22197 #endif
22198 @@ -771,7 +776,7 @@ void __init mem_init(void)
22199 set_highmem_pages_init();
22200
22201 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22202 - datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22203 + datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22204 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22205
22206 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22207 @@ -812,10 +817,10 @@ void __init mem_init(void)
22208 ((unsigned long)&__init_end -
22209 (unsigned long)&__init_begin) >> 10,
22210
22211 - (unsigned long)&_etext, (unsigned long)&_edata,
22212 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22213 + (unsigned long)&_sdata, (unsigned long)&_edata,
22214 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22215
22216 - (unsigned long)&_text, (unsigned long)&_etext,
22217 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22218 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22219
22220 /*
22221 @@ -893,6 +898,7 @@ void set_kernel_text_rw(void)
22222 if (!kernel_set_to_readonly)
22223 return;
22224
22225 + start = ktla_ktva(start);
22226 pr_debug("Set kernel text: %lx - %lx for read write\n",
22227 start, start+size);
22228
22229 @@ -907,6 +913,7 @@ void set_kernel_text_ro(void)
22230 if (!kernel_set_to_readonly)
22231 return;
22232
22233 + start = ktla_ktva(start);
22234 pr_debug("Set kernel text: %lx - %lx for read only\n",
22235 start, start+size);
22236
22237 @@ -935,6 +942,7 @@ void mark_rodata_ro(void)
22238 unsigned long start = PFN_ALIGN(_text);
22239 unsigned long size = PFN_ALIGN(_etext) - start;
22240
22241 + start = ktla_ktva(start);
22242 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22243 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22244 size >> 10);
22245 diff -urNp linux-2.6.39.1/arch/x86/mm/init_64.c linux-2.6.39.1/arch/x86/mm/init_64.c
22246 --- linux-2.6.39.1/arch/x86/mm/init_64.c 2011-05-19 00:06:34.000000000 -0400
22247 +++ linux-2.6.39.1/arch/x86/mm/init_64.c 2011-05-22 19:36:30.000000000 -0400
22248 @@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpa
22249 * around without checking the pgd every time.
22250 */
22251
22252 -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22253 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22254 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22255
22256 int force_personality32;
22257 @@ -107,12 +107,22 @@ void sync_global_pgds(unsigned long star
22258
22259 for (address = start; address <= end; address += PGDIR_SIZE) {
22260 const pgd_t *pgd_ref = pgd_offset_k(address);
22261 +
22262 +#ifdef CONFIG_PAX_PER_CPU_PGD
22263 + unsigned long cpu;
22264 +#else
22265 struct page *page;
22266 +#endif
22267
22268 if (pgd_none(*pgd_ref))
22269 continue;
22270
22271 spin_lock(&pgd_lock);
22272 +
22273 +#ifdef CONFIG_PAX_PER_CPU_PGD
22274 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22275 + pgd_t *pgd = pgd_offset_cpu(cpu, address);
22276 +#else
22277 list_for_each_entry(page, &pgd_list, lru) {
22278 pgd_t *pgd;
22279 spinlock_t *pgt_lock;
22280 @@ -121,6 +131,7 @@ void sync_global_pgds(unsigned long star
22281 /* the pgt_lock only for Xen */
22282 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22283 spin_lock(pgt_lock);
22284 +#endif
22285
22286 if (pgd_none(*pgd))
22287 set_pgd(pgd, *pgd_ref);
22288 @@ -128,7 +139,10 @@ void sync_global_pgds(unsigned long star
22289 BUG_ON(pgd_page_vaddr(*pgd)
22290 != pgd_page_vaddr(*pgd_ref));
22291
22292 +#ifndef CONFIG_PAX_PER_CPU_PGD
22293 spin_unlock(pgt_lock);
22294 +#endif
22295 +
22296 }
22297 spin_unlock(&pgd_lock);
22298 }
22299 @@ -202,7 +216,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
22300 pmd = fill_pmd(pud, vaddr);
22301 pte = fill_pte(pmd, vaddr);
22302
22303 + pax_open_kernel();
22304 set_pte(pte, new_pte);
22305 + pax_close_kernel();
22306
22307 /*
22308 * It's enough to flush this one mapping.
22309 @@ -261,14 +277,12 @@ static void __init __init_extra_mapping(
22310 pgd = pgd_offset_k((unsigned long)__va(phys));
22311 if (pgd_none(*pgd)) {
22312 pud = (pud_t *) spp_getpage();
22313 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22314 - _PAGE_USER));
22315 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22316 }
22317 pud = pud_offset(pgd, (unsigned long)__va(phys));
22318 if (pud_none(*pud)) {
22319 pmd = (pmd_t *) spp_getpage();
22320 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22321 - _PAGE_USER));
22322 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22323 }
22324 pmd = pmd_offset(pud, phys);
22325 BUG_ON(!pmd_none(*pmd));
22326 @@ -698,6 +712,12 @@ void __init mem_init(void)
22327
22328 pci_iommu_alloc();
22329
22330 +#ifdef CONFIG_PAX_PER_CPU_PGD
22331 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22332 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22333 + KERNEL_PGD_PTRS);
22334 +#endif
22335 +
22336 /* clear_bss() already clear the empty_zero_page */
22337
22338 reservedpages = 0;
22339 @@ -858,8 +878,8 @@ int kern_addr_valid(unsigned long addr)
22340 static struct vm_area_struct gate_vma = {
22341 .vm_start = VSYSCALL_START,
22342 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22343 - .vm_page_prot = PAGE_READONLY_EXEC,
22344 - .vm_flags = VM_READ | VM_EXEC
22345 + .vm_page_prot = PAGE_READONLY,
22346 + .vm_flags = VM_READ
22347 };
22348
22349 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22350 @@ -893,7 +913,7 @@ int in_gate_area_no_mm(unsigned long add
22351
22352 const char *arch_vma_name(struct vm_area_struct *vma)
22353 {
22354 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22355 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22356 return "[vdso]";
22357 if (vma == &gate_vma)
22358 return "[vsyscall]";
22359 diff -urNp linux-2.6.39.1/arch/x86/mm/init.c linux-2.6.39.1/arch/x86/mm/init.c
22360 --- linux-2.6.39.1/arch/x86/mm/init.c 2011-05-19 00:06:34.000000000 -0400
22361 +++ linux-2.6.39.1/arch/x86/mm/init.c 2011-06-07 19:41:11.000000000 -0400
22362 @@ -33,7 +33,7 @@ int direct_gbpages
22363 static void __init find_early_table_space(unsigned long end, int use_pse,
22364 int use_gbpages)
22365 {
22366 - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22367 + unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22368 phys_addr_t base;
22369
22370 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22371 @@ -315,12 +315,34 @@ unsigned long __init_refok init_memory_m
22372 */
22373 int devmem_is_allowed(unsigned long pagenr)
22374 {
22375 - if (pagenr <= 256)
22376 +#ifdef CONFIG_GRKERNSEC_KMEM
22377 + /* allow BDA */
22378 + if (!pagenr)
22379 + return 1;
22380 + /* allow EBDA */
22381 + if ((0x9f000 >> PAGE_SHIFT) == pagenr)
22382 + return 1;
22383 +#else
22384 + if (!pagenr)
22385 + return 1;
22386 +#ifdef CONFIG_VM86
22387 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22388 + return 1;
22389 +#endif
22390 +#endif
22391 +
22392 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22393 return 1;
22394 +#ifdef CONFIG_GRKERNSEC_KMEM
22395 + /* throw out everything else below 1MB */
22396 + if (pagenr <= 256)
22397 + return 0;
22398 +#endif
22399 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22400 return 0;
22401 if (!page_is_ram(pagenr))
22402 return 1;
22403 +
22404 return 0;
22405 }
22406
22407 @@ -375,6 +397,86 @@ void free_init_pages(char *what, unsigne
22408
22409 void free_initmem(void)
22410 {
22411 +
22412 +#ifdef CONFIG_PAX_KERNEXEC
22413 +#ifdef CONFIG_X86_32
22414 + /* PaX: limit KERNEL_CS to actual size */
22415 + unsigned long addr, limit;
22416 + struct desc_struct d;
22417 + int cpu;
22418 +
22419 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22420 + limit = (limit - 1UL) >> PAGE_SHIFT;
22421 +
22422 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22423 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
22424 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22425 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22426 + }
22427 +
22428 + /* PaX: make KERNEL_CS read-only */
22429 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22430 + if (!paravirt_enabled())
22431 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22432 +/*
22433 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22434 + pgd = pgd_offset_k(addr);
22435 + pud = pud_offset(pgd, addr);
22436 + pmd = pmd_offset(pud, addr);
22437 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22438 + }
22439 +*/
22440 +#ifdef CONFIG_X86_PAE
22441 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22442 +/*
22443 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22444 + pgd = pgd_offset_k(addr);
22445 + pud = pud_offset(pgd, addr);
22446 + pmd = pmd_offset(pud, addr);
22447 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22448 + }
22449 +*/
22450 +#endif
22451 +
22452 +#ifdef CONFIG_MODULES
22453 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22454 +#endif
22455 +
22456 +#else
22457 + pgd_t *pgd;
22458 + pud_t *pud;
22459 + pmd_t *pmd;
22460 + unsigned long addr, end;
22461 +
22462 + /* PaX: make kernel code/rodata read-only, rest non-executable */
22463 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22464 + pgd = pgd_offset_k(addr);
22465 + pud = pud_offset(pgd, addr);
22466 + pmd = pmd_offset(pud, addr);
22467 + if (!pmd_present(*pmd))
22468 + continue;
22469 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22470 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22471 + else
22472 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22473 + }
22474 +
22475 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22476 + end = addr + KERNEL_IMAGE_SIZE;
22477 + for (; addr < end; addr += PMD_SIZE) {
22478 + pgd = pgd_offset_k(addr);
22479 + pud = pud_offset(pgd, addr);
22480 + pmd = pmd_offset(pud, addr);
22481 + if (!pmd_present(*pmd))
22482 + continue;
22483 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22484 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22485 + }
22486 +#endif
22487 +
22488 + flush_tlb_all();
22489 +#endif
22490 +
22491 free_init_pages("unused kernel memory",
22492 (unsigned long)(&__init_begin),
22493 (unsigned long)(&__init_end));
22494 diff -urNp linux-2.6.39.1/arch/x86/mm/iomap_32.c linux-2.6.39.1/arch/x86/mm/iomap_32.c
22495 --- linux-2.6.39.1/arch/x86/mm/iomap_32.c 2011-05-19 00:06:34.000000000 -0400
22496 +++ linux-2.6.39.1/arch/x86/mm/iomap_32.c 2011-05-22 19:36:30.000000000 -0400
22497 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
22498 type = kmap_atomic_idx_push();
22499 idx = type + KM_TYPE_NR * smp_processor_id();
22500 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22501 +
22502 + pax_open_kernel();
22503 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22504 + pax_close_kernel();
22505 +
22506 arch_flush_lazy_mmu_mode();
22507
22508 return (void *)vaddr;
22509 diff -urNp linux-2.6.39.1/arch/x86/mm/ioremap.c linux-2.6.39.1/arch/x86/mm/ioremap.c
22510 --- linux-2.6.39.1/arch/x86/mm/ioremap.c 2011-05-19 00:06:34.000000000 -0400
22511 +++ linux-2.6.39.1/arch/x86/mm/ioremap.c 2011-05-22 19:36:30.000000000 -0400
22512 @@ -104,7 +104,7 @@ static void __iomem *__ioremap_caller(re
22513 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22514 int is_ram = page_is_ram(pfn);
22515
22516 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22517 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22518 return NULL;
22519 WARN_ON_ONCE(is_ram);
22520 }
22521 @@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se
22522 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22523
22524 static __initdata int after_paging_init;
22525 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22526 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22527
22528 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22529 {
22530 @@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22531 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22532
22533 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22534 - memset(bm_pte, 0, sizeof(bm_pte));
22535 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
22536 + pmd_populate_user(&init_mm, pmd, bm_pte);
22537
22538 /*
22539 * The boot-ioremap range spans multiple pmds, for which
22540 diff -urNp linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c
22541 --- linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-19 00:06:34.000000000 -0400
22542 +++ linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-22 19:36:30.000000000 -0400
22543 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
22544 * memory (e.g. tracked pages)? For now, we need this to avoid
22545 * invoking kmemcheck for PnP BIOS calls.
22546 */
22547 - if (regs->flags & X86_VM_MASK)
22548 + if (v8086_mode(regs))
22549 return false;
22550 - if (regs->cs != __KERNEL_CS)
22551 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22552 return false;
22553
22554 pte = kmemcheck_pte_lookup(address);
22555 diff -urNp linux-2.6.39.1/arch/x86/mm/mmap.c linux-2.6.39.1/arch/x86/mm/mmap.c
22556 --- linux-2.6.39.1/arch/x86/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
22557 +++ linux-2.6.39.1/arch/x86/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
22558 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
22559 * Leave an at least ~128 MB hole with possible stack randomization.
22560 */
22561 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22562 -#define MAX_GAP (TASK_SIZE/6*5)
22563 +#define MAX_GAP (pax_task_size/6*5)
22564
22565 /*
22566 * True on X86_32 or when emulating IA32 on X86_64
22567 @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22568 return rnd << PAGE_SHIFT;
22569 }
22570
22571 -static unsigned long mmap_base(void)
22572 +static unsigned long mmap_base(struct mm_struct *mm)
22573 {
22574 unsigned long gap = rlimit(RLIMIT_STACK);
22575 + unsigned long pax_task_size = TASK_SIZE;
22576 +
22577 +#ifdef CONFIG_PAX_SEGMEXEC
22578 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22579 + pax_task_size = SEGMEXEC_TASK_SIZE;
22580 +#endif
22581
22582 if (gap < MIN_GAP)
22583 gap = MIN_GAP;
22584 else if (gap > MAX_GAP)
22585 gap = MAX_GAP;
22586
22587 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22588 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22589 }
22590
22591 /*
22592 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22593 * does, but not when emulating X86_32
22594 */
22595 -static unsigned long mmap_legacy_base(void)
22596 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
22597 {
22598 - if (mmap_is_ia32())
22599 + if (mmap_is_ia32()) {
22600 +
22601 +#ifdef CONFIG_PAX_SEGMEXEC
22602 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22603 + return SEGMEXEC_TASK_UNMAPPED_BASE;
22604 + else
22605 +#endif
22606 +
22607 return TASK_UNMAPPED_BASE;
22608 - else
22609 + } else
22610 return TASK_UNMAPPED_BASE + mmap_rnd();
22611 }
22612
22613 @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
22614 void arch_pick_mmap_layout(struct mm_struct *mm)
22615 {
22616 if (mmap_is_legacy()) {
22617 - mm->mmap_base = mmap_legacy_base();
22618 + mm->mmap_base = mmap_legacy_base(mm);
22619 +
22620 +#ifdef CONFIG_PAX_RANDMMAP
22621 + if (mm->pax_flags & MF_PAX_RANDMMAP)
22622 + mm->mmap_base += mm->delta_mmap;
22623 +#endif
22624 +
22625 mm->get_unmapped_area = arch_get_unmapped_area;
22626 mm->unmap_area = arch_unmap_area;
22627 } else {
22628 - mm->mmap_base = mmap_base();
22629 + mm->mmap_base = mmap_base(mm);
22630 +
22631 +#ifdef CONFIG_PAX_RANDMMAP
22632 + if (mm->pax_flags & MF_PAX_RANDMMAP)
22633 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22634 +#endif
22635 +
22636 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22637 mm->unmap_area = arch_unmap_area_topdown;
22638 }
22639 diff -urNp linux-2.6.39.1/arch/x86/mm/mmio-mod.c linux-2.6.39.1/arch/x86/mm/mmio-mod.c
22640 --- linux-2.6.39.1/arch/x86/mm/mmio-mod.c 2011-05-19 00:06:34.000000000 -0400
22641 +++ linux-2.6.39.1/arch/x86/mm/mmio-mod.c 2011-05-22 19:36:30.000000000 -0400
22642 @@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p,
22643 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
22644 void __iomem *addr)
22645 {
22646 - static atomic_t next_id;
22647 + static atomic_unchecked_t next_id;
22648 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
22649 /* These are page-unaligned. */
22650 struct mmiotrace_map map = {
22651 @@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
22652 .private = trace
22653 },
22654 .phys = offset,
22655 - .id = atomic_inc_return(&next_id)
22656 + .id = atomic_inc_return_unchecked(&next_id)
22657 };
22658 map.map_id = trace->id;
22659
22660 diff -urNp linux-2.6.39.1/arch/x86/mm/numa_32.c linux-2.6.39.1/arch/x86/mm/numa_32.c
22661 --- linux-2.6.39.1/arch/x86/mm/numa_32.c 2011-05-19 00:06:34.000000000 -0400
22662 +++ linux-2.6.39.1/arch/x86/mm/numa_32.c 2011-05-22 19:36:30.000000000 -0400
22663 @@ -99,7 +99,6 @@ unsigned long node_memmap_size_bytes(int
22664 }
22665 #endif
22666
22667 -extern unsigned long find_max_low_pfn(void);
22668 extern unsigned long highend_pfn, highstart_pfn;
22669
22670 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
22671 diff -urNp linux-2.6.39.1/arch/x86/mm/pageattr.c linux-2.6.39.1/arch/x86/mm/pageattr.c
22672 --- linux-2.6.39.1/arch/x86/mm/pageattr.c 2011-05-19 00:06:34.000000000 -0400
22673 +++ linux-2.6.39.1/arch/x86/mm/pageattr.c 2011-05-22 19:36:30.000000000 -0400
22674 @@ -261,7 +261,7 @@ static inline pgprot_t static_protection
22675 */
22676 #ifdef CONFIG_PCI_BIOS
22677 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
22678 - pgprot_val(forbidden) |= _PAGE_NX;
22679 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22680 #endif
22681
22682 /*
22683 @@ -269,9 +269,10 @@ static inline pgprot_t static_protection
22684 * Does not cover __inittext since that is gone later on. On
22685 * 64bit we do not enforce !NX on the low mapping
22686 */
22687 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
22688 - pgprot_val(forbidden) |= _PAGE_NX;
22689 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
22690 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22691
22692 +#ifdef CONFIG_DEBUG_RODATA
22693 /*
22694 * The .rodata section needs to be read-only. Using the pfn
22695 * catches all aliases.
22696 @@ -279,6 +280,7 @@ static inline pgprot_t static_protection
22697 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
22698 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
22699 pgprot_val(forbidden) |= _PAGE_RW;
22700 +#endif
22701
22702 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
22703 /*
22704 @@ -317,6 +319,13 @@ static inline pgprot_t static_protection
22705 }
22706 #endif
22707
22708 +#ifdef CONFIG_PAX_KERNEXEC
22709 + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
22710 + pgprot_val(forbidden) |= _PAGE_RW;
22711 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22712 + }
22713 +#endif
22714 +
22715 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
22716
22717 return prot;
22718 @@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
22719 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
22720 {
22721 /* change init_mm */
22722 + pax_open_kernel();
22723 set_pte_atomic(kpte, pte);
22724 +
22725 #ifdef CONFIG_X86_32
22726 if (!SHARED_KERNEL_PMD) {
22727 +
22728 +#ifdef CONFIG_PAX_PER_CPU_PGD
22729 + unsigned long cpu;
22730 +#else
22731 struct page *page;
22732 +#endif
22733
22734 +#ifdef CONFIG_PAX_PER_CPU_PGD
22735 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22736 + pgd_t *pgd = get_cpu_pgd(cpu);
22737 +#else
22738 list_for_each_entry(page, &pgd_list, lru) {
22739 - pgd_t *pgd;
22740 + pgd_t *pgd = (pgd_t *)page_address(page);
22741 +#endif
22742 +
22743 pud_t *pud;
22744 pmd_t *pmd;
22745
22746 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
22747 + pgd += pgd_index(address);
22748 pud = pud_offset(pgd, address);
22749 pmd = pmd_offset(pud, address);
22750 set_pte_atomic((pte_t *)pmd, pte);
22751 }
22752 }
22753 #endif
22754 + pax_close_kernel();
22755 }
22756
22757 static int
22758 diff -urNp linux-2.6.39.1/arch/x86/mm/pageattr-test.c linux-2.6.39.1/arch/x86/mm/pageattr-test.c
22759 --- linux-2.6.39.1/arch/x86/mm/pageattr-test.c 2011-05-19 00:06:34.000000000 -0400
22760 +++ linux-2.6.39.1/arch/x86/mm/pageattr-test.c 2011-05-22 19:36:30.000000000 -0400
22761 @@ -36,7 +36,7 @@ enum {
22762
22763 static int pte_testbit(pte_t pte)
22764 {
22765 - return pte_flags(pte) & _PAGE_UNUSED1;
22766 + return pte_flags(pte) & _PAGE_CPA_TEST;
22767 }
22768
22769 struct split_state {
22770 diff -urNp linux-2.6.39.1/arch/x86/mm/pat.c linux-2.6.39.1/arch/x86/mm/pat.c
22771 --- linux-2.6.39.1/arch/x86/mm/pat.c 2011-05-19 00:06:34.000000000 -0400
22772 +++ linux-2.6.39.1/arch/x86/mm/pat.c 2011-05-22 19:36:30.000000000 -0400
22773 @@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
22774
22775 if (!entry) {
22776 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
22777 - current->comm, current->pid, start, end);
22778 + current->comm, task_pid_nr(current), start, end);
22779 return -EINVAL;
22780 }
22781
22782 @@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig
22783 while (cursor < to) {
22784 if (!devmem_is_allowed(pfn)) {
22785 printk(KERN_INFO
22786 - "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
22787 - current->comm, from, to);
22788 + "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
22789 + current->comm, from, to, cursor);
22790 return 0;
22791 }
22792 cursor += PAGE_SIZE;
22793 @@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un
22794 printk(KERN_INFO
22795 "%s:%d ioremap_change_attr failed %s "
22796 "for %Lx-%Lx\n",
22797 - current->comm, current->pid,
22798 + current->comm, task_pid_nr(current),
22799 cattr_name(flags),
22800 base, (unsigned long long)(base + size));
22801 return -EINVAL;
22802 @@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr,
22803 if (want_flags != flags) {
22804 printk(KERN_WARNING
22805 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
22806 - current->comm, current->pid,
22807 + current->comm, task_pid_nr(current),
22808 cattr_name(want_flags),
22809 (unsigned long long)paddr,
22810 (unsigned long long)(paddr + size),
22811 @@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr,
22812 free_memtype(paddr, paddr + size);
22813 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
22814 " for %Lx-%Lx, got %s\n",
22815 - current->comm, current->pid,
22816 + current->comm, task_pid_nr(current),
22817 cattr_name(want_flags),
22818 (unsigned long long)paddr,
22819 (unsigned long long)(paddr + size),
22820 diff -urNp linux-2.6.39.1/arch/x86/mm/pgtable_32.c linux-2.6.39.1/arch/x86/mm/pgtable_32.c
22821 --- linux-2.6.39.1/arch/x86/mm/pgtable_32.c 2011-05-19 00:06:34.000000000 -0400
22822 +++ linux-2.6.39.1/arch/x86/mm/pgtable_32.c 2011-05-22 19:36:30.000000000 -0400
22823 @@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr,
22824 return;
22825 }
22826 pte = pte_offset_kernel(pmd, vaddr);
22827 +
22828 + pax_open_kernel();
22829 if (pte_val(pteval))
22830 set_pte_at(&init_mm, vaddr, pte, pteval);
22831 else
22832 pte_clear(&init_mm, vaddr, pte);
22833 + pax_close_kernel();
22834
22835 /*
22836 * It's enough to flush this one mapping.
22837 diff -urNp linux-2.6.39.1/arch/x86/mm/pgtable.c linux-2.6.39.1/arch/x86/mm/pgtable.c
22838 --- linux-2.6.39.1/arch/x86/mm/pgtable.c 2011-05-19 00:06:34.000000000 -0400
22839 +++ linux-2.6.39.1/arch/x86/mm/pgtable.c 2011-05-22 19:36:30.000000000 -0400
22840 @@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
22841 list_del(&page->lru);
22842 }
22843
22844 -#define UNSHARED_PTRS_PER_PGD \
22845 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22846 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22847 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
22848
22849 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22850 +{
22851 + while (count--)
22852 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
22853 +}
22854 +#endif
22855 +
22856 +#ifdef CONFIG_PAX_PER_CPU_PGD
22857 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22858 +{
22859 + while (count--)
22860 +
22861 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22862 + *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
22863 +#else
22864 + *dst++ = *src++;
22865 +#endif
22866
22867 +}
22868 +#endif
22869 +
22870 +#ifdef CONFIG_X86_64
22871 +#define pxd_t pud_t
22872 +#define pyd_t pgd_t
22873 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
22874 +#define pxd_free(mm, pud) pud_free((mm), (pud))
22875 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
22876 +#define pyd_offset(mm ,address) pgd_offset((mm), (address))
22877 +#define PYD_SIZE PGDIR_SIZE
22878 +#else
22879 +#define pxd_t pmd_t
22880 +#define pyd_t pud_t
22881 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
22882 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
22883 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
22884 +#define pyd_offset(mm ,address) pud_offset((mm), (address))
22885 +#define PYD_SIZE PUD_SIZE
22886 +#endif
22887 +
22888 +#ifdef CONFIG_PAX_PER_CPU_PGD
22889 +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
22890 +static inline void pgd_dtor(pgd_t *pgd) {}
22891 +#else
22892 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
22893 {
22894 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
22895 @@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
22896 pgd_list_del(pgd);
22897 spin_unlock(&pgd_lock);
22898 }
22899 +#endif
22900
22901 /*
22902 * List of all pgd's needed for non-PAE so it can invalidate entries
22903 @@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
22904 * -- wli
22905 */
22906
22907 -#ifdef CONFIG_X86_PAE
22908 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
22909 /*
22910 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
22911 * updating the top-level pagetable entries to guarantee the
22912 @@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
22913 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
22914 * and initialize the kernel pmds here.
22915 */
22916 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
22917 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22918
22919 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
22920 {
22921 @@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm,
22922 */
22923 flush_tlb_mm(mm);
22924 }
22925 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
22926 +#define PREALLOCATED_PXDS USER_PGD_PTRS
22927 #else /* !CONFIG_X86_PAE */
22928
22929 /* No need to prepopulate any pagetable entries in non-PAE modes. */
22930 -#define PREALLOCATED_PMDS 0
22931 +#define PREALLOCATED_PXDS 0
22932
22933 #endif /* CONFIG_X86_PAE */
22934
22935 -static void free_pmds(pmd_t *pmds[])
22936 +static void free_pxds(pxd_t *pxds[])
22937 {
22938 int i;
22939
22940 - for(i = 0; i < PREALLOCATED_PMDS; i++)
22941 - if (pmds[i])
22942 - free_page((unsigned long)pmds[i]);
22943 + for(i = 0; i < PREALLOCATED_PXDS; i++)
22944 + if (pxds[i])
22945 + free_page((unsigned long)pxds[i]);
22946 }
22947
22948 -static int preallocate_pmds(pmd_t *pmds[])
22949 +static int preallocate_pxds(pxd_t *pxds[])
22950 {
22951 int i;
22952 bool failed = false;
22953
22954 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
22955 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
22956 - if (pmd == NULL)
22957 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
22958 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
22959 + if (pxd == NULL)
22960 failed = true;
22961 - pmds[i] = pmd;
22962 + pxds[i] = pxd;
22963 }
22964
22965 if (failed) {
22966 - free_pmds(pmds);
22967 + free_pxds(pxds);
22968 return -ENOMEM;
22969 }
22970
22971 @@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
22972 * preallocate which never got a corresponding vma will need to be
22973 * freed manually.
22974 */
22975 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
22976 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
22977 {
22978 int i;
22979
22980 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
22981 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
22982 pgd_t pgd = pgdp[i];
22983
22984 if (pgd_val(pgd) != 0) {
22985 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
22986 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
22987
22988 - pgdp[i] = native_make_pgd(0);
22989 + set_pgd(pgdp + i, native_make_pgd(0));
22990
22991 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
22992 - pmd_free(mm, pmd);
22993 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
22994 + pxd_free(mm, pxd);
22995 }
22996 }
22997 }
22998
22999 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
23000 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
23001 {
23002 - pud_t *pud;
23003 + pyd_t *pyd;
23004 unsigned long addr;
23005 int i;
23006
23007 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
23008 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
23009 return;
23010
23011 - pud = pud_offset(pgd, 0);
23012 +#ifdef CONFIG_X86_64
23013 + pyd = pyd_offset(mm, 0L);
23014 +#else
23015 + pyd = pyd_offset(pgd, 0L);
23016 +#endif
23017
23018 - for (addr = i = 0; i < PREALLOCATED_PMDS;
23019 - i++, pud++, addr += PUD_SIZE) {
23020 - pmd_t *pmd = pmds[i];
23021 + for (addr = i = 0; i < PREALLOCATED_PXDS;
23022 + i++, pyd++, addr += PYD_SIZE) {
23023 + pxd_t *pxd = pxds[i];
23024
23025 if (i >= KERNEL_PGD_BOUNDARY)
23026 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23027 - sizeof(pmd_t) * PTRS_PER_PMD);
23028 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23029 + sizeof(pxd_t) * PTRS_PER_PMD);
23030
23031 - pud_populate(mm, pud, pmd);
23032 + pyd_populate(mm, pyd, pxd);
23033 }
23034 }
23035
23036 pgd_t *pgd_alloc(struct mm_struct *mm)
23037 {
23038 pgd_t *pgd;
23039 - pmd_t *pmds[PREALLOCATED_PMDS];
23040 + pxd_t *pxds[PREALLOCATED_PXDS];
23041
23042 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
23043
23044 @@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23045
23046 mm->pgd = pgd;
23047
23048 - if (preallocate_pmds(pmds) != 0)
23049 + if (preallocate_pxds(pxds) != 0)
23050 goto out_free_pgd;
23051
23052 if (paravirt_pgd_alloc(mm) != 0)
23053 - goto out_free_pmds;
23054 + goto out_free_pxds;
23055
23056 /*
23057 * Make sure that pre-populating the pmds is atomic with
23058 @@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23059 spin_lock(&pgd_lock);
23060
23061 pgd_ctor(mm, pgd);
23062 - pgd_prepopulate_pmd(mm, pgd, pmds);
23063 + pgd_prepopulate_pxd(mm, pgd, pxds);
23064
23065 spin_unlock(&pgd_lock);
23066
23067 return pgd;
23068
23069 -out_free_pmds:
23070 - free_pmds(pmds);
23071 +out_free_pxds:
23072 + free_pxds(pxds);
23073 out_free_pgd:
23074 free_page((unsigned long)pgd);
23075 out:
23076 @@ -295,7 +344,7 @@ out:
23077
23078 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
23079 {
23080 - pgd_mop_up_pmds(mm, pgd);
23081 + pgd_mop_up_pxds(mm, pgd);
23082 pgd_dtor(pgd);
23083 paravirt_pgd_free(mm, pgd);
23084 free_page((unsigned long)pgd);
23085 diff -urNp linux-2.6.39.1/arch/x86/mm/setup_nx.c linux-2.6.39.1/arch/x86/mm/setup_nx.c
23086 --- linux-2.6.39.1/arch/x86/mm/setup_nx.c 2011-05-19 00:06:34.000000000 -0400
23087 +++ linux-2.6.39.1/arch/x86/mm/setup_nx.c 2011-05-22 19:36:30.000000000 -0400
23088 @@ -5,8 +5,10 @@
23089 #include <asm/pgtable.h>
23090 #include <asm/proto.h>
23091
23092 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23093 static int disable_nx __cpuinitdata;
23094
23095 +#ifndef CONFIG_PAX_PAGEEXEC
23096 /*
23097 * noexec = on|off
23098 *
23099 @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str
23100 return 0;
23101 }
23102 early_param("noexec", noexec_setup);
23103 +#endif
23104 +
23105 +#endif
23106
23107 void __cpuinit x86_configure_nx(void)
23108 {
23109 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23110 if (cpu_has_nx && !disable_nx)
23111 __supported_pte_mask |= _PAGE_NX;
23112 else
23113 +#endif
23114 __supported_pte_mask &= ~_PAGE_NX;
23115 }
23116
23117 diff -urNp linux-2.6.39.1/arch/x86/mm/tlb.c linux-2.6.39.1/arch/x86/mm/tlb.c
23118 --- linux-2.6.39.1/arch/x86/mm/tlb.c 2011-05-19 00:06:34.000000000 -0400
23119 +++ linux-2.6.39.1/arch/x86/mm/tlb.c 2011-05-22 19:36:30.000000000 -0400
23120 @@ -65,7 +65,11 @@ void leave_mm(int cpu)
23121 BUG();
23122 cpumask_clear_cpu(cpu,
23123 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23124 +
23125 +#ifndef CONFIG_PAX_PER_CPU_PGD
23126 load_cr3(swapper_pg_dir);
23127 +#endif
23128 +
23129 }
23130 EXPORT_SYMBOL_GPL(leave_mm);
23131
23132 diff -urNp linux-2.6.39.1/arch/x86/oprofile/backtrace.c linux-2.6.39.1/arch/x86/oprofile/backtrace.c
23133 --- linux-2.6.39.1/arch/x86/oprofile/backtrace.c 2011-05-19 00:06:34.000000000 -0400
23134 +++ linux-2.6.39.1/arch/x86/oprofile/backtrace.c 2011-05-22 19:36:30.000000000 -0400
23135 @@ -57,7 +57,7 @@ dump_user_backtrace_32(struct stack_fram
23136 struct stack_frame_ia32 *fp;
23137
23138 /* Also check accessibility of one struct frame_head beyond */
23139 - if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
23140 + if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
23141 return NULL;
23142 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
23143 return NULL;
23144 @@ -123,7 +123,7 @@ x86_backtrace(struct pt_regs * const reg
23145 {
23146 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
23147
23148 - if (!user_mode_vm(regs)) {
23149 + if (!user_mode(regs)) {
23150 unsigned long stack = kernel_stack_pointer(regs);
23151 if (depth)
23152 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23153 diff -urNp linux-2.6.39.1/arch/x86/pci/ce4100.c linux-2.6.39.1/arch/x86/pci/ce4100.c
23154 --- linux-2.6.39.1/arch/x86/pci/ce4100.c 2011-05-19 00:06:34.000000000 -0400
23155 +++ linux-2.6.39.1/arch/x86/pci/ce4100.c 2011-05-22 19:36:30.000000000 -0400
23156 @@ -302,7 +302,7 @@ static int ce4100_conf_write(unsigned in
23157 return pci_direct_conf1.write(seg, bus, devfn, reg, len, value);
23158 }
23159
23160 -struct pci_raw_ops ce4100_pci_conf = {
23161 +const struct pci_raw_ops ce4100_pci_conf = {
23162 .read = ce4100_conf_read,
23163 .write = ce4100_conf_write,
23164 };
23165 diff -urNp linux-2.6.39.1/arch/x86/pci/common.c linux-2.6.39.1/arch/x86/pci/common.c
23166 --- linux-2.6.39.1/arch/x86/pci/common.c 2011-05-19 00:06:34.000000000 -0400
23167 +++ linux-2.6.39.1/arch/x86/pci/common.c 2011-05-22 19:36:30.000000000 -0400
23168 @@ -33,8 +33,8 @@ int noioapicreroute = 1;
23169 int pcibios_last_bus = -1;
23170 unsigned long pirq_table_addr;
23171 struct pci_bus *pci_root_bus;
23172 -struct pci_raw_ops *raw_pci_ops;
23173 -struct pci_raw_ops *raw_pci_ext_ops;
23174 +const struct pci_raw_ops *raw_pci_ops;
23175 +const struct pci_raw_ops *raw_pci_ext_ops;
23176
23177 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
23178 int reg, int len, u32 *val)
23179 diff -urNp linux-2.6.39.1/arch/x86/pci/direct.c linux-2.6.39.1/arch/x86/pci/direct.c
23180 --- linux-2.6.39.1/arch/x86/pci/direct.c 2011-05-19 00:06:34.000000000 -0400
23181 +++ linux-2.6.39.1/arch/x86/pci/direct.c 2011-05-22 19:36:30.000000000 -0400
23182 @@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
23183
23184 #undef PCI_CONF1_ADDRESS
23185
23186 -struct pci_raw_ops pci_direct_conf1 = {
23187 +const struct pci_raw_ops pci_direct_conf1 = {
23188 .read = pci_conf1_read,
23189 .write = pci_conf1_write,
23190 };
23191 @@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
23192
23193 #undef PCI_CONF2_ADDRESS
23194
23195 -struct pci_raw_ops pci_direct_conf2 = {
23196 +const struct pci_raw_ops pci_direct_conf2 = {
23197 .read = pci_conf2_read,
23198 .write = pci_conf2_write,
23199 };
23200 @@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
23201 * This should be close to trivial, but it isn't, because there are buggy
23202 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
23203 */
23204 -static int __init pci_sanity_check(struct pci_raw_ops *o)
23205 +static int __init pci_sanity_check(const struct pci_raw_ops *o)
23206 {
23207 u32 x = 0;
23208 int year, devfn;
23209 diff -urNp linux-2.6.39.1/arch/x86/pci/fixup.c linux-2.6.39.1/arch/x86/pci/fixup.c
23210 --- linux-2.6.39.1/arch/x86/pci/fixup.c 2011-05-19 00:06:34.000000000 -0400
23211 +++ linux-2.6.39.1/arch/x86/pci/fixup.c 2011-05-22 19:36:30.000000000 -0400
23212 @@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
23213 DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
23214 },
23215 },
23216 - { }
23217 + {}
23218 };
23219
23220 static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
23221 diff -urNp linux-2.6.39.1/arch/x86/pci/mmconfig_32.c linux-2.6.39.1/arch/x86/pci/mmconfig_32.c
23222 --- linux-2.6.39.1/arch/x86/pci/mmconfig_32.c 2011-05-19 00:06:34.000000000 -0400
23223 +++ linux-2.6.39.1/arch/x86/pci/mmconfig_32.c 2011-05-22 19:36:30.000000000 -0400
23224 @@ -117,7 +117,7 @@ static int pci_mmcfg_write(unsigned int
23225 return 0;
23226 }
23227
23228 -static struct pci_raw_ops pci_mmcfg = {
23229 +static const struct pci_raw_ops pci_mmcfg = {
23230 .read = pci_mmcfg_read,
23231 .write = pci_mmcfg_write,
23232 };
23233 diff -urNp linux-2.6.39.1/arch/x86/pci/mmconfig_64.c linux-2.6.39.1/arch/x86/pci/mmconfig_64.c
23234 --- linux-2.6.39.1/arch/x86/pci/mmconfig_64.c 2011-05-19 00:06:34.000000000 -0400
23235 +++ linux-2.6.39.1/arch/x86/pci/mmconfig_64.c 2011-05-22 19:36:30.000000000 -0400
23236 @@ -81,7 +81,7 @@ static int pci_mmcfg_write(unsigned int
23237 return 0;
23238 }
23239
23240 -static struct pci_raw_ops pci_mmcfg = {
23241 +static const struct pci_raw_ops pci_mmcfg = {
23242 .read = pci_mmcfg_read,
23243 .write = pci_mmcfg_write,
23244 };
23245 diff -urNp linux-2.6.39.1/arch/x86/pci/mrst.c linux-2.6.39.1/arch/x86/pci/mrst.c
23246 --- linux-2.6.39.1/arch/x86/pci/mrst.c 2011-05-19 00:06:34.000000000 -0400
23247 +++ linux-2.6.39.1/arch/x86/pci/mrst.c 2011-05-22 19:36:30.000000000 -0400
23248 @@ -218,7 +218,7 @@ static int mrst_pci_irq_enable(struct pc
23249 return 0;
23250 }
23251
23252 -struct pci_ops pci_mrst_ops = {
23253 +const struct pci_ops pci_mrst_ops = {
23254 .read = pci_read,
23255 .write = pci_write,
23256 };
23257 diff -urNp linux-2.6.39.1/arch/x86/pci/numaq_32.c linux-2.6.39.1/arch/x86/pci/numaq_32.c
23258 --- linux-2.6.39.1/arch/x86/pci/numaq_32.c 2011-05-19 00:06:34.000000000 -0400
23259 +++ linux-2.6.39.1/arch/x86/pci/numaq_32.c 2011-05-22 19:36:30.000000000 -0400
23260 @@ -108,7 +108,7 @@ static int pci_conf1_mq_write(unsigned i
23261
23262 #undef PCI_CONF1_MQ_ADDRESS
23263
23264 -static struct pci_raw_ops pci_direct_conf1_mq = {
23265 +static const struct pci_raw_ops pci_direct_conf1_mq = {
23266 .read = pci_conf1_mq_read,
23267 .write = pci_conf1_mq_write
23268 };
23269 diff -urNp linux-2.6.39.1/arch/x86/pci/olpc.c linux-2.6.39.1/arch/x86/pci/olpc.c
23270 --- linux-2.6.39.1/arch/x86/pci/olpc.c 2011-05-19 00:06:34.000000000 -0400
23271 +++ linux-2.6.39.1/arch/x86/pci/olpc.c 2011-05-22 19:36:30.000000000 -0400
23272 @@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
23273 return 0;
23274 }
23275
23276 -static struct pci_raw_ops pci_olpc_conf = {
23277 +static const struct pci_raw_ops pci_olpc_conf = {
23278 .read = pci_olpc_read,
23279 .write = pci_olpc_write,
23280 };
23281 diff -urNp linux-2.6.39.1/arch/x86/pci/pcbios.c linux-2.6.39.1/arch/x86/pci/pcbios.c
23282 --- linux-2.6.39.1/arch/x86/pci/pcbios.c 2011-05-19 00:06:34.000000000 -0400
23283 +++ linux-2.6.39.1/arch/x86/pci/pcbios.c 2011-05-22 19:36:30.000000000 -0400
23284 @@ -79,50 +79,93 @@ union bios32 {
23285 static struct {
23286 unsigned long address;
23287 unsigned short segment;
23288 -} bios32_indirect = { 0, __KERNEL_CS };
23289 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23290
23291 /*
23292 * Returns the entry point for the given service, NULL on error
23293 */
23294
23295 -static unsigned long bios32_service(unsigned long service)
23296 +static unsigned long __devinit bios32_service(unsigned long service)
23297 {
23298 unsigned char return_code; /* %al */
23299 unsigned long address; /* %ebx */
23300 unsigned long length; /* %ecx */
23301 unsigned long entry; /* %edx */
23302 unsigned long flags;
23303 + struct desc_struct d, *gdt;
23304
23305 local_irq_save(flags);
23306 - __asm__("lcall *(%%edi); cld"
23307 +
23308 + gdt = get_cpu_gdt_table(smp_processor_id());
23309 +
23310 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23311 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23312 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23313 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23314 +
23315 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23316 : "=a" (return_code),
23317 "=b" (address),
23318 "=c" (length),
23319 "=d" (entry)
23320 : "0" (service),
23321 "1" (0),
23322 - "D" (&bios32_indirect));
23323 + "D" (&bios32_indirect),
23324 + "r"(__PCIBIOS_DS)
23325 + : "memory");
23326 +
23327 + pax_open_kernel();
23328 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23329 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23330 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23331 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23332 + pax_close_kernel();
23333 +
23334 local_irq_restore(flags);
23335
23336 switch (return_code) {
23337 - case 0:
23338 - return address + entry;
23339 - case 0x80: /* Not present */
23340 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23341 - return 0;
23342 - default: /* Shouldn't happen */
23343 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23344 - service, return_code);
23345 + case 0: {
23346 + int cpu;
23347 + unsigned char flags;
23348 +
23349 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23350 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23351 + printk(KERN_WARNING "bios32_service: not valid\n");
23352 return 0;
23353 + }
23354 + address = address + PAGE_OFFSET;
23355 + length += 16UL; /* some BIOSs underreport this... */
23356 + flags = 4;
23357 + if (length >= 64*1024*1024) {
23358 + length >>= PAGE_SHIFT;
23359 + flags |= 8;
23360 + }
23361 +
23362 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
23363 + gdt = get_cpu_gdt_table(cpu);
23364 + pack_descriptor(&d, address, length, 0x9b, flags);
23365 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23366 + pack_descriptor(&d, address, length, 0x93, flags);
23367 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23368 + }
23369 + return entry;
23370 + }
23371 + case 0x80: /* Not present */
23372 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23373 + return 0;
23374 + default: /* Shouldn't happen */
23375 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23376 + service, return_code);
23377 + return 0;
23378 }
23379 }
23380
23381 static struct {
23382 unsigned long address;
23383 unsigned short segment;
23384 -} pci_indirect = { 0, __KERNEL_CS };
23385 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23386
23387 -static int pci_bios_present;
23388 +static int pci_bios_present __read_only;
23389
23390 static int __devinit check_pcibios(void)
23391 {
23392 @@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23393 unsigned long flags, pcibios_entry;
23394
23395 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23396 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23397 + pci_indirect.address = pcibios_entry;
23398
23399 local_irq_save(flags);
23400 - __asm__(
23401 - "lcall *(%%edi); cld\n\t"
23402 + __asm__("movw %w6, %%ds\n\t"
23403 + "lcall *%%ss:(%%edi); cld\n\t"
23404 + "push %%ss\n\t"
23405 + "pop %%ds\n\t"
23406 "jc 1f\n\t"
23407 "xor %%ah, %%ah\n"
23408 "1:"
23409 @@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23410 "=b" (ebx),
23411 "=c" (ecx)
23412 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23413 - "D" (&pci_indirect)
23414 + "D" (&pci_indirect),
23415 + "r" (__PCIBIOS_DS)
23416 : "memory");
23417 local_irq_restore(flags);
23418
23419 @@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se
23420
23421 switch (len) {
23422 case 1:
23423 - __asm__("lcall *(%%esi); cld\n\t"
23424 + __asm__("movw %w6, %%ds\n\t"
23425 + "lcall *%%ss:(%%esi); cld\n\t"
23426 + "push %%ss\n\t"
23427 + "pop %%ds\n\t"
23428 "jc 1f\n\t"
23429 "xor %%ah, %%ah\n"
23430 "1:"
23431 @@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se
23432 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23433 "b" (bx),
23434 "D" ((long)reg),
23435 - "S" (&pci_indirect));
23436 + "S" (&pci_indirect),
23437 + "r" (__PCIBIOS_DS));
23438 /*
23439 * Zero-extend the result beyond 8 bits, do not trust the
23440 * BIOS having done it:
23441 @@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se
23442 *value &= 0xff;
23443 break;
23444 case 2:
23445 - __asm__("lcall *(%%esi); cld\n\t"
23446 + __asm__("movw %w6, %%ds\n\t"
23447 + "lcall *%%ss:(%%esi); cld\n\t"
23448 + "push %%ss\n\t"
23449 + "pop %%ds\n\t"
23450 "jc 1f\n\t"
23451 "xor %%ah, %%ah\n"
23452 "1:"
23453 @@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se
23454 : "1" (PCIBIOS_READ_CONFIG_WORD),
23455 "b" (bx),
23456 "D" ((long)reg),
23457 - "S" (&pci_indirect));
23458 + "S" (&pci_indirect),
23459 + "r" (__PCIBIOS_DS));
23460 /*
23461 * Zero-extend the result beyond 16 bits, do not trust the
23462 * BIOS having done it:
23463 @@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se
23464 *value &= 0xffff;
23465 break;
23466 case 4:
23467 - __asm__("lcall *(%%esi); cld\n\t"
23468 + __asm__("movw %w6, %%ds\n\t"
23469 + "lcall *%%ss:(%%esi); cld\n\t"
23470 + "push %%ss\n\t"
23471 + "pop %%ds\n\t"
23472 "jc 1f\n\t"
23473 "xor %%ah, %%ah\n"
23474 "1:"
23475 @@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se
23476 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23477 "b" (bx),
23478 "D" ((long)reg),
23479 - "S" (&pci_indirect));
23480 + "S" (&pci_indirect),
23481 + "r" (__PCIBIOS_DS));
23482 break;
23483 }
23484
23485 @@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s
23486
23487 switch (len) {
23488 case 1:
23489 - __asm__("lcall *(%%esi); cld\n\t"
23490 + __asm__("movw %w6, %%ds\n\t"
23491 + "lcall *%%ss:(%%esi); cld\n\t"
23492 + "push %%ss\n\t"
23493 + "pop %%ds\n\t"
23494 "jc 1f\n\t"
23495 "xor %%ah, %%ah\n"
23496 "1:"
23497 @@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s
23498 "c" (value),
23499 "b" (bx),
23500 "D" ((long)reg),
23501 - "S" (&pci_indirect));
23502 + "S" (&pci_indirect),
23503 + "r" (__PCIBIOS_DS));
23504 break;
23505 case 2:
23506 - __asm__("lcall *(%%esi); cld\n\t"
23507 + __asm__("movw %w6, %%ds\n\t"
23508 + "lcall *%%ss:(%%esi); cld\n\t"
23509 + "push %%ss\n\t"
23510 + "pop %%ds\n\t"
23511 "jc 1f\n\t"
23512 "xor %%ah, %%ah\n"
23513 "1:"
23514 @@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s
23515 "c" (value),
23516 "b" (bx),
23517 "D" ((long)reg),
23518 - "S" (&pci_indirect));
23519 + "S" (&pci_indirect),
23520 + "r" (__PCIBIOS_DS));
23521 break;
23522 case 4:
23523 - __asm__("lcall *(%%esi); cld\n\t"
23524 + __asm__("movw %w6, %%ds\n\t"
23525 + "lcall *%%ss:(%%esi); cld\n\t"
23526 + "push %%ss\n\t"
23527 + "pop %%ds\n\t"
23528 "jc 1f\n\t"
23529 "xor %%ah, %%ah\n"
23530 "1:"
23531 @@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s
23532 "c" (value),
23533 "b" (bx),
23534 "D" ((long)reg),
23535 - "S" (&pci_indirect));
23536 + "S" (&pci_indirect),
23537 + "r" (__PCIBIOS_DS));
23538 break;
23539 }
23540
23541 @@ -301,7 +371,7 @@ static int pci_bios_write(unsigned int s
23542 * Function table for BIOS32 access
23543 */
23544
23545 -static struct pci_raw_ops pci_bios_access = {
23546 +static const struct pci_raw_ops pci_bios_access = {
23547 .read = pci_bios_read,
23548 .write = pci_bios_write
23549 };
23550 @@ -310,7 +380,7 @@ static struct pci_raw_ops pci_bios_acces
23551 * Try to find PCI BIOS.
23552 */
23553
23554 -static struct pci_raw_ops * __devinit pci_find_bios(void)
23555 +static const struct pci_raw_ops * __devinit pci_find_bios(void)
23556 {
23557 union bios32 *check;
23558 unsigned char sum;
23559 @@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i
23560
23561 DBG("PCI: Fetching IRQ routing table... ");
23562 __asm__("push %%es\n\t"
23563 + "movw %w8, %%ds\n\t"
23564 "push %%ds\n\t"
23565 "pop %%es\n\t"
23566 - "lcall *(%%esi); cld\n\t"
23567 + "lcall *%%ss:(%%esi); cld\n\t"
23568 "pop %%es\n\t"
23569 + "push %%ss\n\t"
23570 + "pop %%ds\n"
23571 "jc 1f\n\t"
23572 "xor %%ah, %%ah\n"
23573 "1:"
23574 @@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i
23575 "1" (0),
23576 "D" ((long) &opt),
23577 "S" (&pci_indirect),
23578 - "m" (opt)
23579 + "m" (opt),
23580 + "r" (__PCIBIOS_DS)
23581 : "memory");
23582 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
23583 if (ret & 0xff00)
23584 @@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d
23585 {
23586 int ret;
23587
23588 - __asm__("lcall *(%%esi); cld\n\t"
23589 + __asm__("movw %w5, %%ds\n\t"
23590 + "lcall *%%ss:(%%esi); cld\n\t"
23591 + "push %%ss\n\t"
23592 + "pop %%ds\n"
23593 "jc 1f\n\t"
23594 "xor %%ah, %%ah\n"
23595 "1:"
23596 @@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d
23597 : "0" (PCIBIOS_SET_PCI_HW_INT),
23598 "b" ((dev->bus->number << 8) | dev->devfn),
23599 "c" ((irq << 8) | (pin + 10)),
23600 - "S" (&pci_indirect));
23601 + "S" (&pci_indirect),
23602 + "r" (__PCIBIOS_DS));
23603 return !(ret & 0xff00);
23604 }
23605 EXPORT_SYMBOL(pcibios_set_irq_routing);
23606 diff -urNp linux-2.6.39.1/arch/x86/pci/xen.c linux-2.6.39.1/arch/x86/pci/xen.c
23607 --- linux-2.6.39.1/arch/x86/pci/xen.c 2011-05-19 00:06:34.000000000 -0400
23608 +++ linux-2.6.39.1/arch/x86/pci/xen.c 2011-05-22 19:36:30.000000000 -0400
23609 @@ -62,7 +62,7 @@ static int acpi_register_gsi_xen_hvm(str
23610 #include <linux/msi.h>
23611 #include <asm/msidef.h>
23612
23613 -struct xen_pci_frontend_ops *xen_pci_frontend;
23614 +const struct xen_pci_frontend_ops *xen_pci_frontend;
23615 EXPORT_SYMBOL_GPL(xen_pci_frontend);
23616
23617 #define XEN_PIRQ_MSI_DATA (MSI_DATA_TRIGGER_EDGE | \
23618 diff -urNp linux-2.6.39.1/arch/x86/platform/efi/efi_32.c linux-2.6.39.1/arch/x86/platform/efi/efi_32.c
23619 --- linux-2.6.39.1/arch/x86/platform/efi/efi_32.c 2011-05-19 00:06:34.000000000 -0400
23620 +++ linux-2.6.39.1/arch/x86/platform/efi/efi_32.c 2011-05-22 19:36:30.000000000 -0400
23621 @@ -38,70 +38,37 @@
23622 */
23623
23624 static unsigned long efi_rt_eflags;
23625 -static pgd_t efi_bak_pg_dir_pointer[2];
23626 +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
23627
23628 -void efi_call_phys_prelog(void)
23629 +void __init efi_call_phys_prelog(void)
23630 {
23631 - unsigned long cr4;
23632 - unsigned long temp;
23633 struct desc_ptr gdt_descr;
23634
23635 local_irq_save(efi_rt_eflags);
23636
23637 - /*
23638 - * If I don't have PAE, I should just duplicate two entries in page
23639 - * directory. If I have PAE, I just need to duplicate one entry in
23640 - * page directory.
23641 - */
23642 - cr4 = read_cr4_safe();
23643 -
23644 - if (cr4 & X86_CR4_PAE) {
23645 - efi_bak_pg_dir_pointer[0].pgd =
23646 - swapper_pg_dir[pgd_index(0)].pgd;
23647 - swapper_pg_dir[0].pgd =
23648 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23649 - } else {
23650 - efi_bak_pg_dir_pointer[0].pgd =
23651 - swapper_pg_dir[pgd_index(0)].pgd;
23652 - efi_bak_pg_dir_pointer[1].pgd =
23653 - swapper_pg_dir[pgd_index(0x400000)].pgd;
23654 - swapper_pg_dir[pgd_index(0)].pgd =
23655 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23656 - temp = PAGE_OFFSET + 0x400000;
23657 - swapper_pg_dir[pgd_index(0x400000)].pgd =
23658 - swapper_pg_dir[pgd_index(temp)].pgd;
23659 - }
23660 + clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
23661 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
23662 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
23663
23664 /*
23665 * After the lock is released, the original page table is restored.
23666 */
23667 __flush_tlb_all();
23668
23669 - gdt_descr.address = __pa(get_cpu_gdt_table(0));
23670 + gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
23671 gdt_descr.size = GDT_SIZE - 1;
23672 load_gdt(&gdt_descr);
23673 }
23674
23675 -void efi_call_phys_epilog(void)
23676 +void __init efi_call_phys_epilog(void)
23677 {
23678 - unsigned long cr4;
23679 struct desc_ptr gdt_descr;
23680
23681 - gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
23682 + gdt_descr.address = get_cpu_gdt_table(0);
23683 gdt_descr.size = GDT_SIZE - 1;
23684 load_gdt(&gdt_descr);
23685
23686 - cr4 = read_cr4_safe();
23687 -
23688 - if (cr4 & X86_CR4_PAE) {
23689 - swapper_pg_dir[pgd_index(0)].pgd =
23690 - efi_bak_pg_dir_pointer[0].pgd;
23691 - } else {
23692 - swapper_pg_dir[pgd_index(0)].pgd =
23693 - efi_bak_pg_dir_pointer[0].pgd;
23694 - swapper_pg_dir[pgd_index(0x400000)].pgd =
23695 - efi_bak_pg_dir_pointer[1].pgd;
23696 - }
23697 + clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
23698
23699 /*
23700 * After the lock is released, the original page table is restored.
23701 diff -urNp linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S
23702 --- linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S 2011-05-19 00:06:34.000000000 -0400
23703 +++ linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S 2011-05-22 19:36:30.000000000 -0400
23704 @@ -6,6 +6,7 @@
23705 */
23706
23707 #include <linux/linkage.h>
23708 +#include <linux/init.h>
23709 #include <asm/page_types.h>
23710
23711 /*
23712 @@ -20,7 +21,7 @@
23713 * service functions will comply with gcc calling convention, too.
23714 */
23715
23716 -.text
23717 +__INIT
23718 ENTRY(efi_call_phys)
23719 /*
23720 * 0. The function can only be called in Linux kernel. So CS has been
23721 @@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
23722 * The mapping of lower virtual memory has been created in prelog and
23723 * epilog.
23724 */
23725 - movl $1f, %edx
23726 - subl $__PAGE_OFFSET, %edx
23727 - jmp *%edx
23728 + jmp 1f-__PAGE_OFFSET
23729 1:
23730
23731 /*
23732 @@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
23733 * parameter 2, ..., param n. To make things easy, we save the return
23734 * address of efi_call_phys in a global variable.
23735 */
23736 - popl %edx
23737 - movl %edx, saved_return_addr
23738 - /* get the function pointer into ECX*/
23739 - popl %ecx
23740 - movl %ecx, efi_rt_function_ptr
23741 - movl $2f, %edx
23742 - subl $__PAGE_OFFSET, %edx
23743 - pushl %edx
23744 + popl (saved_return_addr)
23745 + popl (efi_rt_function_ptr)
23746
23747 /*
23748 * 3. Clear PG bit in %CR0.
23749 @@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
23750 /*
23751 * 5. Call the physical function.
23752 */
23753 - jmp *%ecx
23754 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
23755
23756 -2:
23757 /*
23758 * 6. After EFI runtime service returns, control will return to
23759 * following instruction. We'd better readjust stack pointer first.
23760 @@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
23761 movl %cr0, %edx
23762 orl $0x80000000, %edx
23763 movl %edx, %cr0
23764 - jmp 1f
23765 -1:
23766 +
23767 /*
23768 * 8. Now restore the virtual mode from flat mode by
23769 * adding EIP with PAGE_OFFSET.
23770 */
23771 - movl $1f, %edx
23772 - jmp *%edx
23773 + jmp 1f+__PAGE_OFFSET
23774 1:
23775
23776 /*
23777 * 9. Balance the stack. And because EAX contain the return value,
23778 * we'd better not clobber it.
23779 */
23780 - leal efi_rt_function_ptr, %edx
23781 - movl (%edx), %ecx
23782 - pushl %ecx
23783 + pushl (efi_rt_function_ptr)
23784
23785 /*
23786 - * 10. Push the saved return address onto the stack and return.
23787 + * 10. Return to the saved return address.
23788 */
23789 - leal saved_return_addr, %edx
23790 - movl (%edx), %ecx
23791 - pushl %ecx
23792 - ret
23793 + jmpl *(saved_return_addr)
23794 ENDPROC(efi_call_phys)
23795 .previous
23796
23797 -.data
23798 +__INITDATA
23799 saved_return_addr:
23800 .long 0
23801 efi_rt_function_ptr:
23802 diff -urNp linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c
23803 --- linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c 2011-05-19 00:06:34.000000000 -0400
23804 +++ linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c 2011-05-22 19:36:30.000000000 -0400
23805 @@ -154,7 +154,7 @@ void * __init prom_early_alloc(unsigned
23806 return res;
23807 }
23808
23809 -static struct of_pdt_ops prom_olpc_ops __initdata = {
23810 +static const struct of_pdt_ops prom_olpc_ops = {
23811 .nextprop = olpc_dt_nextprop,
23812 .getproplen = olpc_dt_getproplen,
23813 .getproperty = olpc_dt_getproperty,
23814 diff -urNp linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c
23815 --- linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c 2011-05-19 00:06:34.000000000 -0400
23816 +++ linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c 2011-05-22 19:36:30.000000000 -0400
23817 @@ -342,6 +342,8 @@ static void uv_reset_with_ipi(struct bau
23818 cpumask_t mask;
23819 struct reset_args reset_args;
23820
23821 + pax_track_stack();
23822 +
23823 reset_args.sender = sender;
23824
23825 cpus_clear(mask);
23826 diff -urNp linux-2.6.39.1/arch/x86/power/cpu.c linux-2.6.39.1/arch/x86/power/cpu.c
23827 --- linux-2.6.39.1/arch/x86/power/cpu.c 2011-05-19 00:06:34.000000000 -0400
23828 +++ linux-2.6.39.1/arch/x86/power/cpu.c 2011-05-22 19:36:30.000000000 -0400
23829 @@ -130,7 +130,7 @@ static void do_fpu_end(void)
23830 static void fix_processor_context(void)
23831 {
23832 int cpu = smp_processor_id();
23833 - struct tss_struct *t = &per_cpu(init_tss, cpu);
23834 + struct tss_struct *t = init_tss + cpu;
23835
23836 set_tss_desc(cpu, t); /*
23837 * This just modifies memory; should not be
23838 @@ -140,7 +140,9 @@ static void fix_processor_context(void)
23839 */
23840
23841 #ifdef CONFIG_X86_64
23842 + pax_open_kernel();
23843 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
23844 + pax_close_kernel();
23845
23846 syscall_init(); /* This sets MSR_*STAR and related */
23847 #endif
23848 diff -urNp linux-2.6.39.1/arch/x86/vdso/Makefile linux-2.6.39.1/arch/x86/vdso/Makefile
23849 --- linux-2.6.39.1/arch/x86/vdso/Makefile 2011-05-19 00:06:34.000000000 -0400
23850 +++ linux-2.6.39.1/arch/x86/vdso/Makefile 2011-05-22 19:36:30.000000000 -0400
23851 @@ -123,7 +123,7 @@ quiet_cmd_vdso = VDSO $@
23852 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
23853 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
23854
23855 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23856 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23857 GCOV_PROFILE := n
23858
23859 #
23860 diff -urNp linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c
23861 --- linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c 2011-05-19 00:06:34.000000000 -0400
23862 +++ linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c 2011-05-22 19:36:30.000000000 -0400
23863 @@ -22,24 +22,48 @@
23864 #include <asm/hpet.h>
23865 #include <asm/unistd.h>
23866 #include <asm/io.h>
23867 +#include <asm/fixmap.h>
23868 #include "vextern.h"
23869
23870 #define gtod vdso_vsyscall_gtod_data
23871
23872 +notrace noinline long __vdso_fallback_time(long *t)
23873 +{
23874 + long secs;
23875 + asm volatile("syscall"
23876 + : "=a" (secs)
23877 + : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
23878 + return secs;
23879 +}
23880 +
23881 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
23882 {
23883 long ret;
23884 asm("syscall" : "=a" (ret) :
23885 - "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
23886 + "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
23887 return ret;
23888 }
23889
23890 +notrace static inline cycle_t __vdso_vread_hpet(void)
23891 +{
23892 + return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
23893 +}
23894 +
23895 +notrace static inline cycle_t __vdso_vread_tsc(void)
23896 +{
23897 + cycle_t ret = (cycle_t)vget_cycles();
23898 +
23899 + return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
23900 +}
23901 +
23902 notrace static inline long vgetns(void)
23903 {
23904 long v;
23905 - cycles_t (*vread)(void);
23906 - vread = gtod->clock.vread;
23907 - v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
23908 + if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
23909 + v = __vdso_vread_tsc();
23910 + else
23911 + v = __vdso_vread_hpet();
23912 + v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
23913 return (v * gtod->clock.mult) >> gtod->clock.shift;
23914 }
23915
23916 @@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
23917
23918 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
23919 {
23920 - if (likely(gtod->sysctl_enabled))
23921 + if (likely(gtod->sysctl_enabled &&
23922 + ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23923 + (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23924 switch (clock) {
23925 case CLOCK_REALTIME:
23926 if (likely(gtod->clock.vread))
23927 @@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
23928 int clock_gettime(clockid_t, struct timespec *)
23929 __attribute__((weak, alias("__vdso_clock_gettime")));
23930
23931 -notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23932 +notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
23933 {
23934 long ret;
23935 - if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
23936 + asm("syscall" : "=a" (ret) :
23937 + "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
23938 + return ret;
23939 +}
23940 +
23941 +notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23942 +{
23943 + if (likely(gtod->sysctl_enabled &&
23944 + ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23945 + (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23946 + {
23947 if (likely(tv != NULL)) {
23948 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
23949 offsetof(struct timespec, tv_nsec) ||
23950 @@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
23951 }
23952 return 0;
23953 }
23954 - asm("syscall" : "=a" (ret) :
23955 - "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
23956 - return ret;
23957 + return __vdso_fallback_gettimeofday(tv, tz);
23958 }
23959 int gettimeofday(struct timeval *, struct timezone *)
23960 __attribute__((weak, alias("__vdso_gettimeofday")));
23961 diff -urNp linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c
23962 --- linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c 2011-05-19 00:06:34.000000000 -0400
23963 +++ linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c 2011-05-22 19:36:30.000000000 -0400
23964 @@ -25,6 +25,7 @@
23965 #include <asm/tlbflush.h>
23966 #include <asm/vdso.h>
23967 #include <asm/proto.h>
23968 +#include <asm/mman.h>
23969
23970 enum {
23971 VDSO_DISABLED = 0,
23972 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
23973 void enable_sep_cpu(void)
23974 {
23975 int cpu = get_cpu();
23976 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
23977 + struct tss_struct *tss = init_tss + cpu;
23978
23979 if (!boot_cpu_has(X86_FEATURE_SEP)) {
23980 put_cpu();
23981 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
23982 gate_vma.vm_start = FIXADDR_USER_START;
23983 gate_vma.vm_end = FIXADDR_USER_END;
23984 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
23985 - gate_vma.vm_page_prot = __P101;
23986 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
23987 /*
23988 * Make sure the vDSO gets into every core dump.
23989 * Dumping its contents makes post-mortem fully interpretable later
23990 @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
23991 if (compat)
23992 addr = VDSO_HIGH_BASE;
23993 else {
23994 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
23995 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
23996 if (IS_ERR_VALUE(addr)) {
23997 ret = addr;
23998 goto up_fail;
23999 }
24000 }
24001
24002 - current->mm->context.vdso = (void *)addr;
24003 + current->mm->context.vdso = addr;
24004
24005 if (compat_uses_vma || !compat) {
24006 /*
24007 @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
24008 }
24009
24010 current_thread_info()->sysenter_return =
24011 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24012 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24013
24014 up_fail:
24015 if (ret)
24016 - current->mm->context.vdso = NULL;
24017 + current->mm->context.vdso = 0;
24018
24019 up_write(&mm->mmap_sem);
24020
24021 @@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
24022
24023 const char *arch_vma_name(struct vm_area_struct *vma)
24024 {
24025 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
24026 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
24027 return "[vdso]";
24028 +
24029 +#ifdef CONFIG_PAX_SEGMEXEC
24030 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
24031 + return "[vdso]";
24032 +#endif
24033 +
24034 return NULL;
24035 }
24036
24037 @@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
24038 * Check to see if the corresponding task was created in compat vdso
24039 * mode.
24040 */
24041 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
24042 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
24043 return &gate_vma;
24044 return NULL;
24045 }
24046 diff -urNp linux-2.6.39.1/arch/x86/vdso/vdso.lds.S linux-2.6.39.1/arch/x86/vdso/vdso.lds.S
24047 --- linux-2.6.39.1/arch/x86/vdso/vdso.lds.S 2011-05-19 00:06:34.000000000 -0400
24048 +++ linux-2.6.39.1/arch/x86/vdso/vdso.lds.S 2011-06-06 17:34:26.000000000 -0400
24049 @@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
24050 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
24051 #include "vextern.h"
24052 #undef VEXTERN
24053 +
24054 +#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
24055 +VEXTERN(fallback_gettimeofday)
24056 +VEXTERN(fallback_time)
24057 +VEXTERN(getcpu)
24058 +#undef VEXTERN
24059 diff -urNp linux-2.6.39.1/arch/x86/vdso/vextern.h linux-2.6.39.1/arch/x86/vdso/vextern.h
24060 --- linux-2.6.39.1/arch/x86/vdso/vextern.h 2011-05-19 00:06:34.000000000 -0400
24061 +++ linux-2.6.39.1/arch/x86/vdso/vextern.h 2011-05-22 19:36:30.000000000 -0400
24062 @@ -11,6 +11,5 @@
24063 put into vextern.h and be referenced as a pointer with vdso prefix.
24064 The main kernel later fills in the values. */
24065
24066 -VEXTERN(jiffies)
24067 VEXTERN(vgetcpu_mode)
24068 VEXTERN(vsyscall_gtod_data)
24069 diff -urNp linux-2.6.39.1/arch/x86/vdso/vma.c linux-2.6.39.1/arch/x86/vdso/vma.c
24070 --- linux-2.6.39.1/arch/x86/vdso/vma.c 2011-05-19 00:06:34.000000000 -0400
24071 +++ linux-2.6.39.1/arch/x86/vdso/vma.c 2011-05-22 19:36:30.000000000 -0400
24072 @@ -58,7 +58,7 @@ static int __init init_vdso_vars(void)
24073 if (!vbase)
24074 goto oom;
24075
24076 - if (memcmp(vbase, "\177ELF", 4)) {
24077 + if (memcmp(vbase, ELFMAG, SELFMAG)) {
24078 printk("VDSO: I'm broken; not ELF\n");
24079 vdso_enabled = 0;
24080 }
24081 @@ -118,7 +118,7 @@ int arch_setup_additional_pages(struct l
24082 goto up_fail;
24083 }
24084
24085 - current->mm->context.vdso = (void *)addr;
24086 + current->mm->context.vdso = addr;
24087
24088 ret = install_special_mapping(mm, addr, vdso_size,
24089 VM_READ|VM_EXEC|
24090 @@ -126,7 +126,7 @@ int arch_setup_additional_pages(struct l
24091 VM_ALWAYSDUMP,
24092 vdso_pages);
24093 if (ret) {
24094 - current->mm->context.vdso = NULL;
24095 + current->mm->context.vdso = 0;
24096 goto up_fail;
24097 }
24098
24099 @@ -134,10 +134,3 @@ up_fail:
24100 up_write(&mm->mmap_sem);
24101 return ret;
24102 }
24103 -
24104 -static __init int vdso_setup(char *s)
24105 -{
24106 - vdso_enabled = simple_strtoul(s, NULL, 0);
24107 - return 0;
24108 -}
24109 -__setup("vdso=", vdso_setup);
24110 diff -urNp linux-2.6.39.1/arch/x86/xen/enlighten.c linux-2.6.39.1/arch/x86/xen/enlighten.c
24111 --- linux-2.6.39.1/arch/x86/xen/enlighten.c 2011-05-19 00:06:34.000000000 -0400
24112 +++ linux-2.6.39.1/arch/x86/xen/enlighten.c 2011-05-22 19:36:30.000000000 -0400
24113 @@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
24114
24115 struct shared_info xen_dummy_shared_info;
24116
24117 -void *xen_initial_gdt;
24118 -
24119 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
24120 __read_mostly int xen_have_vector_callback;
24121 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
24122 @@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic
24123 #endif
24124 };
24125
24126 -static void xen_reboot(int reason)
24127 +static __noreturn void xen_reboot(int reason)
24128 {
24129 struct sched_shutdown r = { .reason = reason };
24130
24131 @@ -1018,17 +1016,17 @@ static void xen_reboot(int reason)
24132 BUG();
24133 }
24134
24135 -static void xen_restart(char *msg)
24136 +static __noreturn void xen_restart(char *msg)
24137 {
24138 xen_reboot(SHUTDOWN_reboot);
24139 }
24140
24141 -static void xen_emergency_restart(void)
24142 +static __noreturn void xen_emergency_restart(void)
24143 {
24144 xen_reboot(SHUTDOWN_reboot);
24145 }
24146
24147 -static void xen_machine_halt(void)
24148 +static __noreturn void xen_machine_halt(void)
24149 {
24150 xen_reboot(SHUTDOWN_poweroff);
24151 }
24152 @@ -1127,7 +1125,17 @@ asmlinkage void __init xen_start_kernel(
24153 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24154
24155 /* Work out if we support NX */
24156 - x86_configure_nx();
24157 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24158 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24159 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24160 + unsigned l, h;
24161 +
24162 + __supported_pte_mask |= _PAGE_NX;
24163 + rdmsr(MSR_EFER, l, h);
24164 + l |= EFER_NX;
24165 + wrmsr(MSR_EFER, l, h);
24166 + }
24167 +#endif
24168
24169 xen_setup_features();
24170
24171 @@ -1158,13 +1166,6 @@ asmlinkage void __init xen_start_kernel(
24172
24173 machine_ops = xen_machine_ops;
24174
24175 - /*
24176 - * The only reliable way to retain the initial address of the
24177 - * percpu gdt_page is to remember it here, so we can go and
24178 - * mark it RW later, when the initial percpu area is freed.
24179 - */
24180 - xen_initial_gdt = &per_cpu(gdt_page, 0);
24181 -
24182 xen_smp_init();
24183
24184 #ifdef CONFIG_ACPI_NUMA
24185 diff -urNp linux-2.6.39.1/arch/x86/xen/mmu.c linux-2.6.39.1/arch/x86/xen/mmu.c
24186 --- linux-2.6.39.1/arch/x86/xen/mmu.c 2011-06-03 00:04:13.000000000 -0400
24187 +++ linux-2.6.39.1/arch/x86/xen/mmu.c 2011-06-03 00:32:05.000000000 -0400
24188 @@ -1791,6 +1791,8 @@ __init pgd_t *xen_setup_kernel_pagetable
24189 convert_pfn_mfn(init_level4_pgt);
24190 convert_pfn_mfn(level3_ident_pgt);
24191 convert_pfn_mfn(level3_kernel_pgt);
24192 + convert_pfn_mfn(level3_vmalloc_pgt);
24193 + convert_pfn_mfn(level3_vmemmap_pgt);
24194
24195 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24196 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24197 @@ -1809,7 +1811,10 @@ __init pgd_t *xen_setup_kernel_pagetable
24198 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24199 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24200 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24201 + set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
24202 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24203 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24204 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24205 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24206 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24207
24208 diff -urNp linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c
24209 --- linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c 2011-05-19 00:06:34.000000000 -0400
24210 +++ linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c 2011-05-22 19:36:30.000000000 -0400
24211 @@ -10,7 +10,7 @@
24212
24213 int xen_swiotlb __read_mostly;
24214
24215 -static struct dma_map_ops xen_swiotlb_dma_ops = {
24216 +static const struct dma_map_ops xen_swiotlb_dma_ops = {
24217 .mapping_error = xen_swiotlb_dma_mapping_error,
24218 .alloc_coherent = xen_swiotlb_alloc_coherent,
24219 .free_coherent = xen_swiotlb_free_coherent,
24220 diff -urNp linux-2.6.39.1/arch/x86/xen/smp.c linux-2.6.39.1/arch/x86/xen/smp.c
24221 --- linux-2.6.39.1/arch/x86/xen/smp.c 2011-05-19 00:06:34.000000000 -0400
24222 +++ linux-2.6.39.1/arch/x86/xen/smp.c 2011-05-22 19:36:30.000000000 -0400
24223 @@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
24224 {
24225 BUG_ON(smp_processor_id() != 0);
24226 native_smp_prepare_boot_cpu();
24227 -
24228 - /* We've switched to the "real" per-cpu gdt, so make sure the
24229 - old memory can be recycled */
24230 - make_lowmem_page_readwrite(xen_initial_gdt);
24231 -
24232 xen_filter_cpu_maps();
24233 xen_setup_vcpu_info_placement();
24234 }
24235 @@ -259,12 +254,12 @@ cpu_initialize_context(unsigned int cpu,
24236 gdt = get_cpu_gdt_table(cpu);
24237
24238 ctxt->flags = VGCF_IN_KERNEL;
24239 - ctxt->user_regs.ds = __USER_DS;
24240 - ctxt->user_regs.es = __USER_DS;
24241 + ctxt->user_regs.ds = __KERNEL_DS;
24242 + ctxt->user_regs.es = __KERNEL_DS;
24243 ctxt->user_regs.ss = __KERNEL_DS;
24244 #ifdef CONFIG_X86_32
24245 ctxt->user_regs.fs = __KERNEL_PERCPU;
24246 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24247 + savesegment(gs, ctxt->user_regs.gs);
24248 #else
24249 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24250 #endif
24251 @@ -315,13 +310,12 @@ static int __cpuinit xen_cpu_up(unsigned
24252 int rc;
24253
24254 per_cpu(current_task, cpu) = idle;
24255 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
24256 #ifdef CONFIG_X86_32
24257 irq_ctx_init(cpu);
24258 #else
24259 clear_tsk_thread_flag(idle, TIF_FORK);
24260 - per_cpu(kernel_stack, cpu) =
24261 - (unsigned long)task_stack_page(idle) -
24262 - KERNEL_STACK_OFFSET + THREAD_SIZE;
24263 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24264 #endif
24265 xen_setup_runstate_info(cpu);
24266 xen_setup_timer(cpu);
24267 diff -urNp linux-2.6.39.1/arch/x86/xen/xen-asm_32.S linux-2.6.39.1/arch/x86/xen/xen-asm_32.S
24268 --- linux-2.6.39.1/arch/x86/xen/xen-asm_32.S 2011-05-19 00:06:34.000000000 -0400
24269 +++ linux-2.6.39.1/arch/x86/xen/xen-asm_32.S 2011-05-22 19:36:30.000000000 -0400
24270 @@ -83,14 +83,14 @@ ENTRY(xen_iret)
24271 ESP_OFFSET=4 # bytes pushed onto stack
24272
24273 /*
24274 - * Store vcpu_info pointer for easy access. Do it this way to
24275 - * avoid having to reload %fs
24276 + * Store vcpu_info pointer for easy access.
24277 */
24278 #ifdef CONFIG_SMP
24279 - GET_THREAD_INFO(%eax)
24280 - movl TI_cpu(%eax), %eax
24281 - movl __per_cpu_offset(,%eax,4), %eax
24282 - mov xen_vcpu(%eax), %eax
24283 + push %fs
24284 + mov $(__KERNEL_PERCPU), %eax
24285 + mov %eax, %fs
24286 + mov PER_CPU_VAR(xen_vcpu), %eax
24287 + pop %fs
24288 #else
24289 movl xen_vcpu, %eax
24290 #endif
24291 diff -urNp linux-2.6.39.1/arch/x86/xen/xen-head.S linux-2.6.39.1/arch/x86/xen/xen-head.S
24292 --- linux-2.6.39.1/arch/x86/xen/xen-head.S 2011-05-19 00:06:34.000000000 -0400
24293 +++ linux-2.6.39.1/arch/x86/xen/xen-head.S 2011-05-22 19:36:30.000000000 -0400
24294 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
24295 #ifdef CONFIG_X86_32
24296 mov %esi,xen_start_info
24297 mov $init_thread_union+THREAD_SIZE,%esp
24298 +#ifdef CONFIG_SMP
24299 + movl $cpu_gdt_table,%edi
24300 + movl $__per_cpu_load,%eax
24301 + movw %ax,__KERNEL_PERCPU + 2(%edi)
24302 + rorl $16,%eax
24303 + movb %al,__KERNEL_PERCPU + 4(%edi)
24304 + movb %ah,__KERNEL_PERCPU + 7(%edi)
24305 + movl $__per_cpu_end - 1,%eax
24306 + subl $__per_cpu_start,%eax
24307 + movw %ax,__KERNEL_PERCPU + 0(%edi)
24308 +#endif
24309 #else
24310 mov %rsi,xen_start_info
24311 mov $init_thread_union+THREAD_SIZE,%rsp
24312 diff -urNp linux-2.6.39.1/arch/x86/xen/xen-ops.h linux-2.6.39.1/arch/x86/xen/xen-ops.h
24313 --- linux-2.6.39.1/arch/x86/xen/xen-ops.h 2011-05-19 00:06:34.000000000 -0400
24314 +++ linux-2.6.39.1/arch/x86/xen/xen-ops.h 2011-05-22 19:36:30.000000000 -0400
24315 @@ -10,8 +10,6 @@
24316 extern const char xen_hypervisor_callback[];
24317 extern const char xen_failsafe_callback[];
24318
24319 -extern void *xen_initial_gdt;
24320 -
24321 struct trap_info;
24322 void xen_copy_trap_info(struct trap_info *traps);
24323
24324 diff -urNp linux-2.6.39.1/block/blk-iopoll.c linux-2.6.39.1/block/blk-iopoll.c
24325 --- linux-2.6.39.1/block/blk-iopoll.c 2011-05-19 00:06:34.000000000 -0400
24326 +++ linux-2.6.39.1/block/blk-iopoll.c 2011-05-22 19:36:30.000000000 -0400
24327 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
24328 }
24329 EXPORT_SYMBOL(blk_iopoll_complete);
24330
24331 -static void blk_iopoll_softirq(struct softirq_action *h)
24332 +static void blk_iopoll_softirq(void)
24333 {
24334 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24335 int rearm = 0, budget = blk_iopoll_budget;
24336 diff -urNp linux-2.6.39.1/block/blk-map.c linux-2.6.39.1/block/blk-map.c
24337 --- linux-2.6.39.1/block/blk-map.c 2011-05-19 00:06:34.000000000 -0400
24338 +++ linux-2.6.39.1/block/blk-map.c 2011-05-22 19:36:30.000000000 -0400
24339 @@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
24340 if (!len || !kbuf)
24341 return -EINVAL;
24342
24343 - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24344 + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24345 if (do_copy)
24346 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24347 else
24348 diff -urNp linux-2.6.39.1/block/blk-softirq.c linux-2.6.39.1/block/blk-softirq.c
24349 --- linux-2.6.39.1/block/blk-softirq.c 2011-05-19 00:06:34.000000000 -0400
24350 +++ linux-2.6.39.1/block/blk-softirq.c 2011-05-22 19:36:30.000000000 -0400
24351 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
24352 * Softirq action handler - move entries to local list and loop over them
24353 * while passing them to the queue registered handler.
24354 */
24355 -static void blk_done_softirq(struct softirq_action *h)
24356 +static void blk_done_softirq(void)
24357 {
24358 struct list_head *cpu_list, local_list;
24359
24360 diff -urNp linux-2.6.39.1/block/bsg.c linux-2.6.39.1/block/bsg.c
24361 --- linux-2.6.39.1/block/bsg.c 2011-05-19 00:06:34.000000000 -0400
24362 +++ linux-2.6.39.1/block/bsg.c 2011-05-22 19:36:30.000000000 -0400
24363 @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
24364 struct sg_io_v4 *hdr, struct bsg_device *bd,
24365 fmode_t has_write_perm)
24366 {
24367 + unsigned char tmpcmd[sizeof(rq->__cmd)];
24368 + unsigned char *cmdptr;
24369 +
24370 if (hdr->request_len > BLK_MAX_CDB) {
24371 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24372 if (!rq->cmd)
24373 return -ENOMEM;
24374 - }
24375 + cmdptr = rq->cmd;
24376 + } else
24377 + cmdptr = tmpcmd;
24378
24379 - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
24380 + if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
24381 hdr->request_len))
24382 return -EFAULT;
24383
24384 + if (cmdptr != rq->cmd)
24385 + memcpy(rq->cmd, cmdptr, hdr->request_len);
24386 +
24387 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24388 if (blk_verify_command(rq->cmd, has_write_perm))
24389 return -EPERM;
24390 diff -urNp linux-2.6.39.1/block/scsi_ioctl.c linux-2.6.39.1/block/scsi_ioctl.c
24391 --- linux-2.6.39.1/block/scsi_ioctl.c 2011-05-19 00:06:34.000000000 -0400
24392 +++ linux-2.6.39.1/block/scsi_ioctl.c 2011-05-22 19:36:30.000000000 -0400
24393 @@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24394 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24395 struct sg_io_hdr *hdr, fmode_t mode)
24396 {
24397 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24398 + unsigned char tmpcmd[sizeof(rq->__cmd)];
24399 + unsigned char *cmdptr;
24400 +
24401 + if (rq->cmd != rq->__cmd)
24402 + cmdptr = rq->cmd;
24403 + else
24404 + cmdptr = tmpcmd;
24405 +
24406 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24407 return -EFAULT;
24408 +
24409 + if (cmdptr != rq->cmd)
24410 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24411 +
24412 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24413 return -EPERM;
24414
24415 @@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
24416 int err;
24417 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24418 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24419 + unsigned char tmpcmd[sizeof(rq->__cmd)];
24420 + unsigned char *cmdptr;
24421
24422 if (!sic)
24423 return -EINVAL;
24424 @@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
24425 */
24426 err = -EFAULT;
24427 rq->cmd_len = cmdlen;
24428 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
24429 +
24430 + if (rq->cmd != rq->__cmd)
24431 + cmdptr = rq->cmd;
24432 + else
24433 + cmdptr = tmpcmd;
24434 +
24435 + if (copy_from_user(cmdptr, sic->data, cmdlen))
24436 goto error;
24437
24438 + if (rq->cmd != cmdptr)
24439 + memcpy(rq->cmd, cmdptr, cmdlen);
24440 +
24441 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24442 goto error;
24443
24444 diff -urNp linux-2.6.39.1/crypto/serpent.c linux-2.6.39.1/crypto/serpent.c
24445 --- linux-2.6.39.1/crypto/serpent.c 2011-05-19 00:06:34.000000000 -0400
24446 +++ linux-2.6.39.1/crypto/serpent.c 2011-05-22 19:36:30.000000000 -0400
24447 @@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
24448 u32 r0,r1,r2,r3,r4;
24449 int i;
24450
24451 + pax_track_stack();
24452 +
24453 /* Copy key, add padding */
24454
24455 for (i = 0; i < keylen; ++i)
24456 diff -urNp linux-2.6.39.1/Documentation/dontdiff linux-2.6.39.1/Documentation/dontdiff
24457 --- linux-2.6.39.1/Documentation/dontdiff 2011-05-19 00:06:34.000000000 -0400
24458 +++ linux-2.6.39.1/Documentation/dontdiff 2011-05-22 19:36:30.000000000 -0400
24459 @@ -1,13 +1,16 @@
24460 *.a
24461 *.aux
24462 *.bin
24463 +*.cis
24464 *.cpio
24465 *.csp
24466 +*.dbg
24467 *.dsp
24468 *.dvi
24469 *.elf
24470 *.eps
24471 *.fw
24472 +*.gcno
24473 *.gen.S
24474 *.gif
24475 *.grep
24476 @@ -38,8 +41,10 @@
24477 *.tab.h
24478 *.tex
24479 *.ver
24480 +*.vim
24481 *.xml
24482 *_MODULES
24483 +*_reg_safe.h
24484 *_vga16.c
24485 *~
24486 *.9
24487 @@ -49,11 +54,16 @@
24488 53c700_d.h
24489 CVS
24490 ChangeSet
24491 +GPATH
24492 +GRTAGS
24493 +GSYMS
24494 +GTAGS
24495 Image
24496 Kerntypes
24497 Module.markers
24498 Module.symvers
24499 PENDING
24500 +PERF*
24501 SCCS
24502 System.map*
24503 TAGS
24504 @@ -80,8 +90,11 @@ btfixupprep
24505 build
24506 bvmlinux
24507 bzImage*
24508 +capability_names.h
24509 capflags.c
24510 classlist.h*
24511 +clut_vga16.c
24512 +common-cmds.h
24513 comp*.log
24514 compile.h*
24515 conf
24516 @@ -106,16 +119,19 @@ fore200e_mkfirm
24517 fore200e_pca_fw.c*
24518 gconf
24519 gen-devlist
24520 +gen-kdb_cmds.c
24521 gen_crc32table
24522 gen_init_cpio
24523 generated
24524 genheaders
24525 genksyms
24526 *_gray256.c
24527 +hash
24528 ihex2fw
24529 ikconfig.h*
24530 inat-tables.c
24531 initramfs_data.cpio
24532 +initramfs_data.cpio.bz2
24533 initramfs_data.cpio.gz
24534 initramfs_list
24535 int16.c
24536 @@ -125,7 +141,6 @@ int32.c
24537 int4.c
24538 int8.c
24539 kallsyms
24540 -kconfig
24541 keywords.c
24542 ksym.c*
24543 ksym.h*
24544 @@ -149,7 +164,9 @@ mkboot
24545 mkbugboot
24546 mkcpustr
24547 mkdep
24548 +mkpiggy
24549 mkprep
24550 +mkregtable
24551 mktables
24552 mktree
24553 modpost
24554 @@ -165,6 +182,7 @@ parse.h
24555 patches*
24556 pca200e.bin
24557 pca200e_ecd.bin2
24558 +perf-archive
24559 piggy.gz
24560 piggyback
24561 piggy.S
24562 @@ -180,7 +198,9 @@ r600_reg_safe.h
24563 raid6altivec*.c
24564 raid6int*.c
24565 raid6tables.c
24566 +regdb.c
24567 relocs
24568 +rlim_names.h
24569 rn50_reg_safe.h
24570 rs600_reg_safe.h
24571 rv515_reg_safe.h
24572 @@ -189,6 +209,7 @@ setup
24573 setup.bin
24574 setup.elf
24575 sImage
24576 +slabinfo
24577 sm_tbl*
24578 split-include
24579 syscalltab.h
24580 @@ -213,13 +234,17 @@ version.h*
24581 vmlinux
24582 vmlinux-*
24583 vmlinux.aout
24584 +vmlinux.bin.all
24585 +vmlinux.bin.bz2
24586 vmlinux.lds
24587 +vmlinux.relocs
24588 voffset.h
24589 vsyscall.lds
24590 vsyscall_32.lds
24591 wanxlfw.inc
24592 uImage
24593 unifdef
24594 +utsrelease.h
24595 wakeup.bin
24596 wakeup.elf
24597 wakeup.lds
24598 diff -urNp linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c
24599 --- linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-19 00:06:34.000000000 -0400
24600 +++ linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-22 19:36:30.000000000 -0400
24601 @@ -368,7 +368,7 @@ static struct configfs_item_operations g
24602 * Note that, since no extra work is required on ->drop_item(),
24603 * no ->drop_item() is provided.
24604 */
24605 -static struct configfs_group_operations group_children_group_ops = {
24606 +static const struct configfs_group_operations group_children_group_ops = {
24607 .make_group = group_children_make_group,
24608 };
24609
24610 diff -urNp linux-2.6.39.1/Documentation/filesystems/sysfs.txt linux-2.6.39.1/Documentation/filesystems/sysfs.txt
24611 --- linux-2.6.39.1/Documentation/filesystems/sysfs.txt 2011-05-19 00:06:34.000000000 -0400
24612 +++ linux-2.6.39.1/Documentation/filesystems/sysfs.txt 2011-05-22 19:36:30.000000000 -0400
24613 @@ -125,8 +125,8 @@ set of sysfs operations for forwarding r
24614 show and store methods of the attribute owners.
24615
24616 struct sysfs_ops {
24617 - ssize_t (*show)(struct kobject *, struct attribute *, char *);
24618 - ssize_t (*store)(struct kobject *, struct attribute *, const char *, size_t);
24619 + ssize_t (* const show)(struct kobject *, struct attribute *, char *);
24620 + ssize_t (* const store)(struct kobject *, struct attribute *, const char *, size_t);
24621 };
24622
24623 [ Subsystems should have already defined a struct kobj_type as a
24624 diff -urNp linux-2.6.39.1/Documentation/kernel-parameters.txt linux-2.6.39.1/Documentation/kernel-parameters.txt
24625 --- linux-2.6.39.1/Documentation/kernel-parameters.txt 2011-05-19 00:06:34.000000000 -0400
24626 +++ linux-2.6.39.1/Documentation/kernel-parameters.txt 2011-05-22 19:36:30.000000000 -0400
24627 @@ -1879,6 +1879,13 @@ bytes respectively. Such letter suffixes
24628 the specified number of seconds. This is to be used if
24629 your oopses keep scrolling off the screen.
24630
24631 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
24632 + virtualization environments that don't cope well with the
24633 + expand down segment used by UDEREF on X86-32 or the frequent
24634 + page table updates on X86-64.
24635 +
24636 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
24637 +
24638 pcbit= [HW,ISDN]
24639
24640 pcd. [PARIDE]
24641 diff -urNp linux-2.6.39.1/drivers/acpi/acpi_ipmi.c linux-2.6.39.1/drivers/acpi/acpi_ipmi.c
24642 --- linux-2.6.39.1/drivers/acpi/acpi_ipmi.c 2011-05-19 00:06:34.000000000 -0400
24643 +++ linux-2.6.39.1/drivers/acpi/acpi_ipmi.c 2011-05-22 19:36:30.000000000 -0400
24644 @@ -70,7 +70,7 @@ struct acpi_ipmi_device {
24645 struct ipmi_driver_data {
24646 struct list_head ipmi_devices;
24647 struct ipmi_smi_watcher bmc_events;
24648 - struct ipmi_user_hndl ipmi_hndlrs;
24649 + const struct ipmi_user_hndl ipmi_hndlrs;
24650 struct mutex ipmi_lock;
24651 };
24652
24653 diff -urNp linux-2.6.39.1/drivers/acpi/apei/cper.c linux-2.6.39.1/drivers/acpi/apei/cper.c
24654 --- linux-2.6.39.1/drivers/acpi/apei/cper.c 2011-05-19 00:06:34.000000000 -0400
24655 +++ linux-2.6.39.1/drivers/acpi/apei/cper.c 2011-05-22 19:36:30.000000000 -0400
24656 @@ -38,12 +38,12 @@
24657 */
24658 u64 cper_next_record_id(void)
24659 {
24660 - static atomic64_t seq;
24661 + static atomic64_unchecked_t seq;
24662
24663 - if (!atomic64_read(&seq))
24664 - atomic64_set(&seq, ((u64)get_seconds()) << 32);
24665 + if (!atomic64_read_unchecked(&seq))
24666 + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24667
24668 - return atomic64_inc_return(&seq);
24669 + return atomic64_inc_return_unchecked(&seq);
24670 }
24671 EXPORT_SYMBOL_GPL(cper_next_record_id);
24672
24673 diff -urNp linux-2.6.39.1/drivers/acpi/battery.c linux-2.6.39.1/drivers/acpi/battery.c
24674 --- linux-2.6.39.1/drivers/acpi/battery.c 2011-05-19 00:06:34.000000000 -0400
24675 +++ linux-2.6.39.1/drivers/acpi/battery.c 2011-05-22 19:36:30.000000000 -0400
24676 @@ -864,7 +864,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
24677 }
24678
24679 static struct battery_file {
24680 - struct file_operations ops;
24681 + const struct file_operations ops;
24682 mode_t mode;
24683 const char *name;
24684 } acpi_battery_file[] = {
24685 diff -urNp linux-2.6.39.1/drivers/acpi/dock.c linux-2.6.39.1/drivers/acpi/dock.c
24686 --- linux-2.6.39.1/drivers/acpi/dock.c 2011-05-19 00:06:34.000000000 -0400
24687 +++ linux-2.6.39.1/drivers/acpi/dock.c 2011-05-22 19:36:30.000000000 -0400
24688 @@ -77,7 +77,7 @@ struct dock_dependent_device {
24689 struct list_head list;
24690 struct list_head hotplug_list;
24691 acpi_handle handle;
24692 - struct acpi_dock_ops *ops;
24693 + const struct acpi_dock_ops *ops;
24694 void *context;
24695 };
24696
24697 @@ -589,7 +589,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
24698 * the dock driver after _DCK is executed.
24699 */
24700 int
24701 -register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
24702 +register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
24703 void *context)
24704 {
24705 struct dock_dependent_device *dd;
24706 diff -urNp linux-2.6.39.1/drivers/acpi/ec_sys.c linux-2.6.39.1/drivers/acpi/ec_sys.c
24707 --- linux-2.6.39.1/drivers/acpi/ec_sys.c 2011-05-19 00:06:34.000000000 -0400
24708 +++ linux-2.6.39.1/drivers/acpi/ec_sys.c 2011-05-22 19:36:30.000000000 -0400
24709 @@ -92,7 +92,7 @@ static ssize_t acpi_ec_write_io(struct f
24710 return count;
24711 }
24712
24713 -static struct file_operations acpi_ec_io_ops = {
24714 +static const struct file_operations acpi_ec_io_ops = {
24715 .owner = THIS_MODULE,
24716 .open = acpi_ec_open_io,
24717 .read = acpi_ec_read_io,
24718 diff -urNp linux-2.6.39.1/drivers/acpi/fan.c linux-2.6.39.1/drivers/acpi/fan.c
24719 --- linux-2.6.39.1/drivers/acpi/fan.c 2011-05-19 00:06:34.000000000 -0400
24720 +++ linux-2.6.39.1/drivers/acpi/fan.c 2011-05-22 19:36:30.000000000 -0400
24721 @@ -110,7 +110,7 @@ fan_set_cur_state(struct thermal_cooling
24722 return result;
24723 }
24724
24725 -static struct thermal_cooling_device_ops fan_cooling_ops = {
24726 +static const struct thermal_cooling_device_ops fan_cooling_ops = {
24727 .get_max_state = fan_get_max_state,
24728 .get_cur_state = fan_get_cur_state,
24729 .set_cur_state = fan_set_cur_state,
24730 diff -urNp linux-2.6.39.1/drivers/acpi/power_meter.c linux-2.6.39.1/drivers/acpi/power_meter.c
24731 --- linux-2.6.39.1/drivers/acpi/power_meter.c 2011-05-19 00:06:34.000000000 -0400
24732 +++ linux-2.6.39.1/drivers/acpi/power_meter.c 2011-05-22 19:36:30.000000000 -0400
24733 @@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
24734 return res;
24735
24736 temp /= 1000;
24737 - if (temp < 0)
24738 - return -EINVAL;
24739
24740 mutex_lock(&resource->lock);
24741 resource->trip[attr->index - 7] = temp;
24742 diff -urNp linux-2.6.39.1/drivers/acpi/proc.c linux-2.6.39.1/drivers/acpi/proc.c
24743 --- linux-2.6.39.1/drivers/acpi/proc.c 2011-05-19 00:06:34.000000000 -0400
24744 +++ linux-2.6.39.1/drivers/acpi/proc.c 2011-05-22 19:36:30.000000000 -0400
24745 @@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
24746 size_t count, loff_t * ppos)
24747 {
24748 struct list_head *node, *next;
24749 - char strbuf[5];
24750 - char str[5] = "";
24751 - unsigned int len = count;
24752 -
24753 - if (len > 4)
24754 - len = 4;
24755 - if (len < 0)
24756 - return -EFAULT;
24757 + char strbuf[5] = {0};
24758
24759 - if (copy_from_user(strbuf, buffer, len))
24760 + if (count > 4)
24761 + count = 4;
24762 + if (copy_from_user(strbuf, buffer, count))
24763 return -EFAULT;
24764 - strbuf[len] = '\0';
24765 - sscanf(strbuf, "%s", str);
24766 + strbuf[count] = '\0';
24767
24768 mutex_lock(&acpi_device_lock);
24769 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
24770 @@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f
24771 if (!dev->wakeup.flags.valid)
24772 continue;
24773
24774 - if (!strncmp(dev->pnp.bus_id, str, 4)) {
24775 + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
24776 if (device_can_wakeup(&dev->dev)) {
24777 bool enable = !device_may_wakeup(&dev->dev);
24778 device_set_wakeup_enable(&dev->dev, enable);
24779 diff -urNp linux-2.6.39.1/drivers/acpi/processor_driver.c linux-2.6.39.1/drivers/acpi/processor_driver.c
24780 --- linux-2.6.39.1/drivers/acpi/processor_driver.c 2011-05-19 00:06:34.000000000 -0400
24781 +++ linux-2.6.39.1/drivers/acpi/processor_driver.c 2011-05-22 19:36:30.000000000 -0400
24782 @@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
24783 return 0;
24784 #endif
24785
24786 - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
24787 + BUG_ON(pr->id >= nr_cpu_ids);
24788
24789 /*
24790 * Buggy BIOS check
24791 diff -urNp linux-2.6.39.1/drivers/acpi/processor_idle.c linux-2.6.39.1/drivers/acpi/processor_idle.c
24792 --- linux-2.6.39.1/drivers/acpi/processor_idle.c 2011-05-19 00:06:34.000000000 -0400
24793 +++ linux-2.6.39.1/drivers/acpi/processor_idle.c 2011-05-22 19:36:30.000000000 -0400
24794 @@ -121,7 +121,7 @@ static struct dmi_system_id __cpuinitdat
24795 DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
24796 DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
24797 (void *)1},
24798 - {},
24799 + {}
24800 };
24801
24802
24803 diff -urNp linux-2.6.39.1/drivers/acpi/processor_thermal.c linux-2.6.39.1/drivers/acpi/processor_thermal.c
24804 --- linux-2.6.39.1/drivers/acpi/processor_thermal.c 2011-05-19 00:06:34.000000000 -0400
24805 +++ linux-2.6.39.1/drivers/acpi/processor_thermal.c 2011-05-22 19:36:30.000000000 -0400
24806 @@ -244,7 +244,7 @@ processor_set_cur_state(struct thermal_c
24807 return result;
24808 }
24809
24810 -struct thermal_cooling_device_ops processor_cooling_ops = {
24811 +const struct thermal_cooling_device_ops processor_cooling_ops = {
24812 .get_max_state = processor_get_max_state,
24813 .get_cur_state = processor_get_cur_state,
24814 .set_cur_state = processor_set_cur_state,
24815 diff -urNp linux-2.6.39.1/drivers/acpi/sysfs.c linux-2.6.39.1/drivers/acpi/sysfs.c
24816 --- linux-2.6.39.1/drivers/acpi/sysfs.c 2011-05-19 00:06:34.000000000 -0400
24817 +++ linux-2.6.39.1/drivers/acpi/sysfs.c 2011-05-22 19:36:30.000000000 -0400
24818 @@ -149,12 +149,12 @@ static int param_get_debug_level(char *b
24819 return result;
24820 }
24821
24822 -static struct kernel_param_ops param_ops_debug_layer = {
24823 +static const struct kernel_param_ops param_ops_debug_layer = {
24824 .set = param_set_uint,
24825 .get = param_get_debug_layer,
24826 };
24827
24828 -static struct kernel_param_ops param_ops_debug_level = {
24829 +static const struct kernel_param_ops param_ops_debug_level = {
24830 .set = param_set_uint,
24831 .get = param_get_debug_level,
24832 };
24833 diff -urNp linux-2.6.39.1/drivers/acpi/thermal.c linux-2.6.39.1/drivers/acpi/thermal.c
24834 --- linux-2.6.39.1/drivers/acpi/thermal.c 2011-05-19 00:06:34.000000000 -0400
24835 +++ linux-2.6.39.1/drivers/acpi/thermal.c 2011-05-22 19:36:30.000000000 -0400
24836 @@ -812,7 +812,7 @@ acpi_thermal_unbind_cooling_device(struc
24837 thermal_zone_unbind_cooling_device);
24838 }
24839
24840 -static struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24841 +static const struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24842 .bind = acpi_thermal_bind_cooling_device,
24843 .unbind = acpi_thermal_unbind_cooling_device,
24844 .get_temp = thermal_get_temp,
24845 diff -urNp linux-2.6.39.1/drivers/acpi/video.c linux-2.6.39.1/drivers/acpi/video.c
24846 --- linux-2.6.39.1/drivers/acpi/video.c 2011-05-19 00:06:34.000000000 -0400
24847 +++ linux-2.6.39.1/drivers/acpi/video.c 2011-05-22 19:36:30.000000000 -0400
24848 @@ -308,7 +308,7 @@ video_set_cur_state(struct thermal_cooli
24849 return acpi_video_device_lcd_set_level(video, level);
24850 }
24851
24852 -static struct thermal_cooling_device_ops video_cooling_ops = {
24853 +static const struct thermal_cooling_device_ops video_cooling_ops = {
24854 .get_max_state = video_get_max_state,
24855 .get_cur_state = video_get_cur_state,
24856 .set_cur_state = video_set_cur_state,
24857 diff -urNp linux-2.6.39.1/drivers/ata/acard-ahci.c linux-2.6.39.1/drivers/ata/acard-ahci.c
24858 --- linux-2.6.39.1/drivers/ata/acard-ahci.c 2011-05-19 00:06:34.000000000 -0400
24859 +++ linux-2.6.39.1/drivers/ata/acard-ahci.c 2011-05-22 19:36:30.000000000 -0400
24860 @@ -87,7 +87,7 @@ static struct scsi_host_template acard_a
24861 AHCI_SHT("acard-ahci"),
24862 };
24863
24864 -static struct ata_port_operations acard_ops = {
24865 +static const struct ata_port_operations acard_ops = {
24866 .inherits = &ahci_ops,
24867 .qc_prep = acard_ahci_qc_prep,
24868 .qc_fill_rtf = acard_ahci_qc_fill_rtf,
24869 diff -urNp linux-2.6.39.1/drivers/ata/ahci.c linux-2.6.39.1/drivers/ata/ahci.c
24870 --- linux-2.6.39.1/drivers/ata/ahci.c 2011-05-19 00:06:34.000000000 -0400
24871 +++ linux-2.6.39.1/drivers/ata/ahci.c 2011-05-22 19:36:30.000000000 -0400
24872 @@ -94,17 +94,17 @@ static struct scsi_host_template ahci_sh
24873 AHCI_SHT("ahci"),
24874 };
24875
24876 -static struct ata_port_operations ahci_vt8251_ops = {
24877 +static const struct ata_port_operations ahci_vt8251_ops = {
24878 .inherits = &ahci_ops,
24879 .hardreset = ahci_vt8251_hardreset,
24880 };
24881
24882 -static struct ata_port_operations ahci_p5wdh_ops = {
24883 +static const struct ata_port_operations ahci_p5wdh_ops = {
24884 .inherits = &ahci_ops,
24885 .hardreset = ahci_p5wdh_hardreset,
24886 };
24887
24888 -static struct ata_port_operations ahci_sb600_ops = {
24889 +static const struct ata_port_operations ahci_sb600_ops = {
24890 .inherits = &ahci_ops,
24891 .softreset = ahci_sb600_softreset,
24892 .pmp_softreset = ahci_sb600_softreset,
24893 diff -urNp linux-2.6.39.1/drivers/ata/ahci.h linux-2.6.39.1/drivers/ata/ahci.h
24894 --- linux-2.6.39.1/drivers/ata/ahci.h 2011-05-19 00:06:34.000000000 -0400
24895 +++ linux-2.6.39.1/drivers/ata/ahci.h 2011-05-22 19:36:30.000000000 -0400
24896 @@ -311,7 +311,7 @@ extern struct device_attribute *ahci_sde
24897 .shost_attrs = ahci_shost_attrs, \
24898 .sdev_attrs = ahci_sdev_attrs
24899
24900 -extern struct ata_port_operations ahci_ops;
24901 +extern const struct ata_port_operations ahci_ops;
24902
24903 void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
24904 u32 opts);
24905 diff -urNp linux-2.6.39.1/drivers/ata/ata_generic.c linux-2.6.39.1/drivers/ata/ata_generic.c
24906 --- linux-2.6.39.1/drivers/ata/ata_generic.c 2011-05-19 00:06:34.000000000 -0400
24907 +++ linux-2.6.39.1/drivers/ata/ata_generic.c 2011-05-22 19:36:30.000000000 -0400
24908 @@ -101,7 +101,7 @@ static struct scsi_host_template generic
24909 ATA_BMDMA_SHT(DRV_NAME),
24910 };
24911
24912 -static struct ata_port_operations generic_port_ops = {
24913 +static const struct ata_port_operations generic_port_ops = {
24914 .inherits = &ata_bmdma_port_ops,
24915 .cable_detect = ata_cable_unknown,
24916 .set_mode = generic_set_mode,
24917 diff -urNp linux-2.6.39.1/drivers/ata/ata_piix.c linux-2.6.39.1/drivers/ata/ata_piix.c
24918 --- linux-2.6.39.1/drivers/ata/ata_piix.c 2011-05-19 00:06:34.000000000 -0400
24919 +++ linux-2.6.39.1/drivers/ata/ata_piix.c 2011-05-22 19:36:30.000000000 -0400
24920 @@ -335,12 +335,12 @@ static struct scsi_host_template piix_sh
24921 ATA_BMDMA_SHT(DRV_NAME),
24922 };
24923
24924 -static struct ata_port_operations piix_sata_ops = {
24925 +static const struct ata_port_operations piix_sata_ops = {
24926 .inherits = &ata_bmdma32_port_ops,
24927 .sff_irq_check = piix_irq_check,
24928 };
24929
24930 -static struct ata_port_operations piix_pata_ops = {
24931 +static const struct ata_port_operations piix_pata_ops = {
24932 .inherits = &piix_sata_ops,
24933 .cable_detect = ata_cable_40wire,
24934 .set_piomode = piix_set_piomode,
24935 @@ -348,12 +348,12 @@ static struct ata_port_operations piix_p
24936 .prereset = piix_pata_prereset,
24937 };
24938
24939 -static struct ata_port_operations piix_vmw_ops = {
24940 +static const struct ata_port_operations piix_vmw_ops = {
24941 .inherits = &piix_pata_ops,
24942 .bmdma_status = piix_vmw_bmdma_status,
24943 };
24944
24945 -static struct ata_port_operations ich_pata_ops = {
24946 +static const struct ata_port_operations ich_pata_ops = {
24947 .inherits = &piix_pata_ops,
24948 .cable_detect = ich_pata_cable_detect,
24949 .set_dmamode = ich_set_dmamode,
24950 @@ -369,7 +369,7 @@ static struct scsi_host_template piix_si
24951 .shost_attrs = piix_sidpr_shost_attrs,
24952 };
24953
24954 -static struct ata_port_operations piix_sidpr_sata_ops = {
24955 +static const struct ata_port_operations piix_sidpr_sata_ops = {
24956 .inherits = &piix_sata_ops,
24957 .hardreset = sata_std_hardreset,
24958 .scr_read = piix_sidpr_scr_read,
24959 diff -urNp linux-2.6.39.1/drivers/ata/libahci.c linux-2.6.39.1/drivers/ata/libahci.c
24960 --- linux-2.6.39.1/drivers/ata/libahci.c 2011-05-19 00:06:34.000000000 -0400
24961 +++ linux-2.6.39.1/drivers/ata/libahci.c 2011-05-22 19:36:30.000000000 -0400
24962 @@ -141,7 +141,7 @@ struct device_attribute *ahci_sdev_attrs
24963 };
24964 EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
24965
24966 -struct ata_port_operations ahci_ops = {
24967 +const struct ata_port_operations ahci_ops = {
24968 .inherits = &sata_pmp_port_ops,
24969
24970 .qc_defer = ahci_pmp_qc_defer,
24971 diff -urNp linux-2.6.39.1/drivers/ata/libata-acpi.c linux-2.6.39.1/drivers/ata/libata-acpi.c
24972 --- linux-2.6.39.1/drivers/ata/libata-acpi.c 2011-05-19 00:06:34.000000000 -0400
24973 +++ linux-2.6.39.1/drivers/ata/libata-acpi.c 2011-05-22 19:36:30.000000000 -0400
24974 @@ -218,12 +218,12 @@ static void ata_acpi_dev_uevent(acpi_han
24975 ata_acpi_uevent(dev->link->ap, dev, event);
24976 }
24977
24978 -static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24979 +static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24980 .handler = ata_acpi_dev_notify_dock,
24981 .uevent = ata_acpi_dev_uevent,
24982 };
24983
24984 -static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24985 +static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24986 .handler = ata_acpi_ap_notify_dock,
24987 .uevent = ata_acpi_ap_uevent,
24988 };
24989 diff -urNp linux-2.6.39.1/drivers/ata/libata-core.c linux-2.6.39.1/drivers/ata/libata-core.c
24990 --- linux-2.6.39.1/drivers/ata/libata-core.c 2011-05-19 00:06:34.000000000 -0400
24991 +++ linux-2.6.39.1/drivers/ata/libata-core.c 2011-05-22 19:36:30.000000000 -0400
24992 @@ -4747,7 +4747,7 @@ void ata_qc_free(struct ata_queued_cmd *
24993 struct ata_port *ap;
24994 unsigned int tag;
24995
24996 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24997 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24998 ap = qc->ap;
24999
25000 qc->flags = 0;
25001 @@ -4763,7 +4763,7 @@ void __ata_qc_complete(struct ata_queued
25002 struct ata_port *ap;
25003 struct ata_link *link;
25004
25005 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25006 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25007 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
25008 ap = qc->ap;
25009 link = qc->dev->link;
25010 @@ -5756,7 +5756,7 @@ static void ata_host_stop(struct device
25011 * LOCKING:
25012 * None.
25013 */
25014 -static void ata_finalize_port_ops(struct ata_port_operations *ops)
25015 +static void ata_finalize_port_ops(const struct ata_port_operations *ops)
25016 {
25017 static DEFINE_SPINLOCK(lock);
25018 const struct ata_port_operations *cur;
25019 @@ -5768,6 +5768,7 @@ static void ata_finalize_port_ops(struct
25020 return;
25021
25022 spin_lock(&lock);
25023 + pax_open_kernel();
25024
25025 for (cur = ops->inherits; cur; cur = cur->inherits) {
25026 void **inherit = (void **)cur;
25027 @@ -5781,8 +5782,9 @@ static void ata_finalize_port_ops(struct
25028 if (IS_ERR(*pp))
25029 *pp = NULL;
25030
25031 - ops->inherits = NULL;
25032 + ((struct ata_port_operations *)ops)->inherits = NULL;
25033
25034 + pax_close_kernel();
25035 spin_unlock(&lock);
25036 }
25037
25038 @@ -5879,7 +5881,7 @@ int ata_host_start(struct ata_host *host
25039 */
25040 /* KILLME - the only user left is ipr */
25041 void ata_host_init(struct ata_host *host, struct device *dev,
25042 - unsigned long flags, struct ata_port_operations *ops)
25043 + unsigned long flags, const struct ata_port_operations *ops)
25044 {
25045 spin_lock_init(&host->lock);
25046 mutex_init(&host->eh_mutex);
25047 @@ -6583,7 +6585,7 @@ static void ata_dummy_error_handler(stru
25048 /* truly dummy */
25049 }
25050
25051 -struct ata_port_operations ata_dummy_port_ops = {
25052 +const struct ata_port_operations ata_dummy_port_ops = {
25053 .qc_prep = ata_noop_qc_prep,
25054 .qc_issue = ata_dummy_qc_issue,
25055 .error_handler = ata_dummy_error_handler,
25056 diff -urNp linux-2.6.39.1/drivers/ata/libata-eh.c linux-2.6.39.1/drivers/ata/libata-eh.c
25057 --- linux-2.6.39.1/drivers/ata/libata-eh.c 2011-05-19 00:06:34.000000000 -0400
25058 +++ linux-2.6.39.1/drivers/ata/libata-eh.c 2011-05-22 19:36:30.000000000 -0400
25059 @@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap)
25060 {
25061 struct ata_link *link;
25062
25063 + pax_track_stack();
25064 +
25065 ata_for_each_link(link, ap, HOST_FIRST)
25066 ata_eh_link_report(link);
25067 }
25068 @@ -3922,7 +3924,7 @@ void ata_do_eh(struct ata_port *ap, ata_
25069 */
25070 void ata_std_error_handler(struct ata_port *ap)
25071 {
25072 - struct ata_port_operations *ops = ap->ops;
25073 + const struct ata_port_operations *ops = ap->ops;
25074 ata_reset_fn_t hardreset = ops->hardreset;
25075
25076 /* ignore built-in hardreset if SCR access is not available */
25077 diff -urNp linux-2.6.39.1/drivers/ata/libata-pmp.c linux-2.6.39.1/drivers/ata/libata-pmp.c
25078 --- linux-2.6.39.1/drivers/ata/libata-pmp.c 2011-05-19 00:06:34.000000000 -0400
25079 +++ linux-2.6.39.1/drivers/ata/libata-pmp.c 2011-05-22 19:36:30.000000000 -0400
25080 @@ -912,7 +912,7 @@ static int sata_pmp_handle_link_fail(str
25081 */
25082 static int sata_pmp_eh_recover(struct ata_port *ap)
25083 {
25084 - struct ata_port_operations *ops = ap->ops;
25085 + const struct ata_port_operations *ops = ap->ops;
25086 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
25087 struct ata_link *pmp_link = &ap->link;
25088 struct ata_device *pmp_dev = pmp_link->device;
25089 diff -urNp linux-2.6.39.1/drivers/ata/pata_acpi.c linux-2.6.39.1/drivers/ata/pata_acpi.c
25090 --- linux-2.6.39.1/drivers/ata/pata_acpi.c 2011-05-19 00:06:34.000000000 -0400
25091 +++ linux-2.6.39.1/drivers/ata/pata_acpi.c 2011-05-22 19:36:30.000000000 -0400
25092 @@ -216,7 +216,7 @@ static struct scsi_host_template pacpi_s
25093 ATA_BMDMA_SHT(DRV_NAME),
25094 };
25095
25096 -static struct ata_port_operations pacpi_ops = {
25097 +static const struct ata_port_operations pacpi_ops = {
25098 .inherits = &ata_bmdma_port_ops,
25099 .qc_issue = pacpi_qc_issue,
25100 .cable_detect = pacpi_cable_detect,
25101 diff -urNp linux-2.6.39.1/drivers/ata/pata_ali.c linux-2.6.39.1/drivers/ata/pata_ali.c
25102 --- linux-2.6.39.1/drivers/ata/pata_ali.c 2011-05-19 00:06:34.000000000 -0400
25103 +++ linux-2.6.39.1/drivers/ata/pata_ali.c 2011-05-22 19:36:30.000000000 -0400
25104 @@ -363,7 +363,7 @@ static struct scsi_host_template ali_sht
25105 * Port operations for PIO only ALi
25106 */
25107
25108 -static struct ata_port_operations ali_early_port_ops = {
25109 +static const struct ata_port_operations ali_early_port_ops = {
25110 .inherits = &ata_sff_port_ops,
25111 .cable_detect = ata_cable_40wire,
25112 .set_piomode = ali_set_piomode,
25113 @@ -380,7 +380,7 @@ static const struct ata_port_operations
25114 * Port operations for DMA capable ALi without cable
25115 * detect
25116 */
25117 -static struct ata_port_operations ali_20_port_ops = {
25118 +static const struct ata_port_operations ali_20_port_ops = {
25119 .inherits = &ali_dma_base_ops,
25120 .cable_detect = ata_cable_40wire,
25121 .mode_filter = ali_20_filter,
25122 @@ -391,7 +391,7 @@ static struct ata_port_operations ali_20
25123 /*
25124 * Port operations for DMA capable ALi with cable detect
25125 */
25126 -static struct ata_port_operations ali_c2_port_ops = {
25127 +static const struct ata_port_operations ali_c2_port_ops = {
25128 .inherits = &ali_dma_base_ops,
25129 .check_atapi_dma = ali_check_atapi_dma,
25130 .cable_detect = ali_c2_cable_detect,
25131 @@ -402,7 +402,7 @@ static struct ata_port_operations ali_c2
25132 /*
25133 * Port operations for DMA capable ALi with cable detect
25134 */
25135 -static struct ata_port_operations ali_c4_port_ops = {
25136 +static const struct ata_port_operations ali_c4_port_ops = {
25137 .inherits = &ali_dma_base_ops,
25138 .check_atapi_dma = ali_check_atapi_dma,
25139 .cable_detect = ali_c2_cable_detect,
25140 @@ -412,7 +412,7 @@ static struct ata_port_operations ali_c4
25141 /*
25142 * Port operations for DMA capable ALi with cable detect and LBA48
25143 */
25144 -static struct ata_port_operations ali_c5_port_ops = {
25145 +static const struct ata_port_operations ali_c5_port_ops = {
25146 .inherits = &ali_dma_base_ops,
25147 .check_atapi_dma = ali_check_atapi_dma,
25148 .dev_config = ali_warn_atapi_dma,
25149 diff -urNp linux-2.6.39.1/drivers/ata/pata_amd.c linux-2.6.39.1/drivers/ata/pata_amd.c
25150 --- linux-2.6.39.1/drivers/ata/pata_amd.c 2011-05-19 00:06:34.000000000 -0400
25151 +++ linux-2.6.39.1/drivers/ata/pata_amd.c 2011-05-22 19:36:31.000000000 -0400
25152 @@ -397,28 +397,28 @@ static const struct ata_port_operations
25153 .prereset = amd_pre_reset,
25154 };
25155
25156 -static struct ata_port_operations amd33_port_ops = {
25157 +static const struct ata_port_operations amd33_port_ops = {
25158 .inherits = &amd_base_port_ops,
25159 .cable_detect = ata_cable_40wire,
25160 .set_piomode = amd33_set_piomode,
25161 .set_dmamode = amd33_set_dmamode,
25162 };
25163
25164 -static struct ata_port_operations amd66_port_ops = {
25165 +static const struct ata_port_operations amd66_port_ops = {
25166 .inherits = &amd_base_port_ops,
25167 .cable_detect = ata_cable_unknown,
25168 .set_piomode = amd66_set_piomode,
25169 .set_dmamode = amd66_set_dmamode,
25170 };
25171
25172 -static struct ata_port_operations amd100_port_ops = {
25173 +static const struct ata_port_operations amd100_port_ops = {
25174 .inherits = &amd_base_port_ops,
25175 .cable_detect = ata_cable_unknown,
25176 .set_piomode = amd100_set_piomode,
25177 .set_dmamode = amd100_set_dmamode,
25178 };
25179
25180 -static struct ata_port_operations amd133_port_ops = {
25181 +static const struct ata_port_operations amd133_port_ops = {
25182 .inherits = &amd_base_port_ops,
25183 .cable_detect = amd_cable_detect,
25184 .set_piomode = amd133_set_piomode,
25185 @@ -433,13 +433,13 @@ static const struct ata_port_operations
25186 .host_stop = nv_host_stop,
25187 };
25188
25189 -static struct ata_port_operations nv100_port_ops = {
25190 +static const struct ata_port_operations nv100_port_ops = {
25191 .inherits = &nv_base_port_ops,
25192 .set_piomode = nv100_set_piomode,
25193 .set_dmamode = nv100_set_dmamode,
25194 };
25195
25196 -static struct ata_port_operations nv133_port_ops = {
25197 +static const struct ata_port_operations nv133_port_ops = {
25198 .inherits = &nv_base_port_ops,
25199 .set_piomode = nv133_set_piomode,
25200 .set_dmamode = nv133_set_dmamode,
25201 diff -urNp linux-2.6.39.1/drivers/ata/pata_arasan_cf.c linux-2.6.39.1/drivers/ata/pata_arasan_cf.c
25202 --- linux-2.6.39.1/drivers/ata/pata_arasan_cf.c 2011-05-19 00:06:34.000000000 -0400
25203 +++ linux-2.6.39.1/drivers/ata/pata_arasan_cf.c 2011-05-22 19:36:31.000000000 -0400
25204 @@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str
25205 /* Handle platform specific quirks */
25206 if (pdata->quirk) {
25207 if (pdata->quirk & CF_BROKEN_PIO) {
25208 - ap->ops->set_piomode = NULL;
25209 + pax_open_kernel();
25210 + *(void**)&ap->ops->set_piomode = NULL;
25211 + pax_close_kernel();
25212 ap->pio_mask = 0;
25213 }
25214 if (pdata->quirk & CF_BROKEN_MWDMA)
25215 diff -urNp linux-2.6.39.1/drivers/ata/pata_artop.c linux-2.6.39.1/drivers/ata/pata_artop.c
25216 --- linux-2.6.39.1/drivers/ata/pata_artop.c 2011-05-19 00:06:34.000000000 -0400
25217 +++ linux-2.6.39.1/drivers/ata/pata_artop.c 2011-05-22 19:36:31.000000000 -0400
25218 @@ -312,7 +312,7 @@ static struct scsi_host_template artop_s
25219 ATA_BMDMA_SHT(DRV_NAME),
25220 };
25221
25222 -static struct ata_port_operations artop6210_ops = {
25223 +static const struct ata_port_operations artop6210_ops = {
25224 .inherits = &ata_bmdma_port_ops,
25225 .cable_detect = ata_cable_40wire,
25226 .set_piomode = artop6210_set_piomode,
25227 @@ -321,7 +321,7 @@ static struct ata_port_operations artop6
25228 .qc_defer = artop6210_qc_defer,
25229 };
25230
25231 -static struct ata_port_operations artop6260_ops = {
25232 +static const struct ata_port_operations artop6260_ops = {
25233 .inherits = &ata_bmdma_port_ops,
25234 .cable_detect = artop6260_cable_detect,
25235 .set_piomode = artop6260_set_piomode,
25236 diff -urNp linux-2.6.39.1/drivers/ata/pata_at32.c linux-2.6.39.1/drivers/ata/pata_at32.c
25237 --- linux-2.6.39.1/drivers/ata/pata_at32.c 2011-05-19 00:06:34.000000000 -0400
25238 +++ linux-2.6.39.1/drivers/ata/pata_at32.c 2011-05-22 19:36:31.000000000 -0400
25239 @@ -173,7 +173,7 @@ static struct scsi_host_template at32_sh
25240 ATA_PIO_SHT(DRV_NAME),
25241 };
25242
25243 -static struct ata_port_operations at32_port_ops = {
25244 +static const struct ata_port_operations at32_port_ops = {
25245 .inherits = &ata_sff_port_ops,
25246 .cable_detect = ata_cable_40wire,
25247 .set_piomode = pata_at32_set_piomode,
25248 diff -urNp linux-2.6.39.1/drivers/ata/pata_at91.c linux-2.6.39.1/drivers/ata/pata_at91.c
25249 --- linux-2.6.39.1/drivers/ata/pata_at91.c 2011-05-19 00:06:34.000000000 -0400
25250 +++ linux-2.6.39.1/drivers/ata/pata_at91.c 2011-05-22 19:36:31.000000000 -0400
25251 @@ -212,7 +212,7 @@ static struct scsi_host_template pata_at
25252 ATA_PIO_SHT(DRV_NAME),
25253 };
25254
25255 -static struct ata_port_operations pata_at91_port_ops = {
25256 +static const struct ata_port_operations pata_at91_port_ops = {
25257 .inherits = &ata_sff_port_ops,
25258
25259 .sff_data_xfer = pata_at91_data_xfer_noirq,
25260 diff -urNp linux-2.6.39.1/drivers/ata/pata_atiixp.c linux-2.6.39.1/drivers/ata/pata_atiixp.c
25261 --- linux-2.6.39.1/drivers/ata/pata_atiixp.c 2011-05-19 00:06:34.000000000 -0400
25262 +++ linux-2.6.39.1/drivers/ata/pata_atiixp.c 2011-05-22 19:36:31.000000000 -0400
25263 @@ -214,7 +214,7 @@ static struct scsi_host_template atiixp_
25264 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25265 };
25266
25267 -static struct ata_port_operations atiixp_port_ops = {
25268 +static const struct ata_port_operations atiixp_port_ops = {
25269 .inherits = &ata_bmdma_port_ops,
25270
25271 .qc_prep = ata_bmdma_dumb_qc_prep,
25272 diff -urNp linux-2.6.39.1/drivers/ata/pata_atp867x.c linux-2.6.39.1/drivers/ata/pata_atp867x.c
25273 --- linux-2.6.39.1/drivers/ata/pata_atp867x.c 2011-05-19 00:06:34.000000000 -0400
25274 +++ linux-2.6.39.1/drivers/ata/pata_atp867x.c 2011-05-22 19:36:31.000000000 -0400
25275 @@ -275,7 +275,7 @@ static struct scsi_host_template atp867x
25276 ATA_BMDMA_SHT(DRV_NAME),
25277 };
25278
25279 -static struct ata_port_operations atp867x_ops = {
25280 +static const struct ata_port_operations atp867x_ops = {
25281 .inherits = &ata_bmdma_port_ops,
25282 .cable_detect = atp867x_cable_detect,
25283 .set_piomode = atp867x_set_piomode,
25284 diff -urNp linux-2.6.39.1/drivers/ata/pata_bf54x.c linux-2.6.39.1/drivers/ata/pata_bf54x.c
25285 --- linux-2.6.39.1/drivers/ata/pata_bf54x.c 2011-05-19 00:06:34.000000000 -0400
25286 +++ linux-2.6.39.1/drivers/ata/pata_bf54x.c 2011-05-22 19:36:31.000000000 -0400
25287 @@ -1420,7 +1420,7 @@ static struct scsi_host_template bfin_sh
25288 .dma_boundary = ATA_DMA_BOUNDARY,
25289 };
25290
25291 -static struct ata_port_operations bfin_pata_ops = {
25292 +static const struct ata_port_operations bfin_pata_ops = {
25293 .inherits = &ata_bmdma_port_ops,
25294
25295 .set_piomode = bfin_set_piomode,
25296 diff -urNp linux-2.6.39.1/drivers/ata/pata_cmd640.c linux-2.6.39.1/drivers/ata/pata_cmd640.c
25297 --- linux-2.6.39.1/drivers/ata/pata_cmd640.c 2011-05-19 00:06:34.000000000 -0400
25298 +++ linux-2.6.39.1/drivers/ata/pata_cmd640.c 2011-05-22 19:36:31.000000000 -0400
25299 @@ -176,7 +176,7 @@ static struct scsi_host_template cmd640_
25300 ATA_PIO_SHT(DRV_NAME),
25301 };
25302
25303 -static struct ata_port_operations cmd640_port_ops = {
25304 +static const struct ata_port_operations cmd640_port_ops = {
25305 .inherits = &ata_sff_port_ops,
25306 /* In theory xfer_noirq is not needed once we kill the prefetcher */
25307 .sff_data_xfer = ata_sff_data_xfer_noirq,
25308 diff -urNp linux-2.6.39.1/drivers/ata/pata_cmd64x.c linux-2.6.39.1/drivers/ata/pata_cmd64x.c
25309 --- linux-2.6.39.1/drivers/ata/pata_cmd64x.c 2011-06-03 00:04:13.000000000 -0400
25310 +++ linux-2.6.39.1/drivers/ata/pata_cmd64x.c 2011-06-03 00:32:05.000000000 -0400
25311 @@ -271,18 +271,18 @@ static const struct ata_port_operations
25312 .set_dmamode = cmd64x_set_dmamode,
25313 };
25314
25315 -static struct ata_port_operations cmd64x_port_ops = {
25316 +static const struct ata_port_operations cmd64x_port_ops = {
25317 .inherits = &cmd64x_base_ops,
25318 .cable_detect = ata_cable_40wire,
25319 };
25320
25321 -static struct ata_port_operations cmd646r1_port_ops = {
25322 +static const struct ata_port_operations cmd646r1_port_ops = {
25323 .inherits = &cmd64x_base_ops,
25324 .bmdma_stop = cmd646r1_bmdma_stop,
25325 .cable_detect = ata_cable_40wire,
25326 };
25327
25328 -static struct ata_port_operations cmd648_port_ops = {
25329 +static const struct ata_port_operations cmd648_port_ops = {
25330 .inherits = &cmd64x_base_ops,
25331 .bmdma_stop = cmd648_bmdma_stop,
25332 .cable_detect = cmd648_cable_detect,
25333 diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5520.c linux-2.6.39.1/drivers/ata/pata_cs5520.c
25334 --- linux-2.6.39.1/drivers/ata/pata_cs5520.c 2011-05-19 00:06:34.000000000 -0400
25335 +++ linux-2.6.39.1/drivers/ata/pata_cs5520.c 2011-05-22 19:36:31.000000000 -0400
25336 @@ -108,7 +108,7 @@ static struct scsi_host_template cs5520_
25337 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25338 };
25339
25340 -static struct ata_port_operations cs5520_port_ops = {
25341 +static const struct ata_port_operations cs5520_port_ops = {
25342 .inherits = &ata_bmdma_port_ops,
25343 .qc_prep = ata_bmdma_dumb_qc_prep,
25344 .cable_detect = ata_cable_40wire,
25345 diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5530.c linux-2.6.39.1/drivers/ata/pata_cs5530.c
25346 --- linux-2.6.39.1/drivers/ata/pata_cs5530.c 2011-05-19 00:06:34.000000000 -0400
25347 +++ linux-2.6.39.1/drivers/ata/pata_cs5530.c 2011-05-22 19:36:31.000000000 -0400
25348 @@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
25349 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25350 };
25351
25352 -static struct ata_port_operations cs5530_port_ops = {
25353 +static const struct ata_port_operations cs5530_port_ops = {
25354 .inherits = &ata_bmdma_port_ops,
25355
25356 .qc_prep = ata_bmdma_dumb_qc_prep,
25357 diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5535.c linux-2.6.39.1/drivers/ata/pata_cs5535.c
25358 --- linux-2.6.39.1/drivers/ata/pata_cs5535.c 2011-05-19 00:06:34.000000000 -0400
25359 +++ linux-2.6.39.1/drivers/ata/pata_cs5535.c 2011-05-22 19:36:31.000000000 -0400
25360 @@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
25361 ATA_BMDMA_SHT(DRV_NAME),
25362 };
25363
25364 -static struct ata_port_operations cs5535_port_ops = {
25365 +static const struct ata_port_operations cs5535_port_ops = {
25366 .inherits = &ata_bmdma_port_ops,
25367 .cable_detect = cs5535_cable_detect,
25368 .set_piomode = cs5535_set_piomode,
25369 diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5536.c linux-2.6.39.1/drivers/ata/pata_cs5536.c
25370 --- linux-2.6.39.1/drivers/ata/pata_cs5536.c 2011-05-19 00:06:34.000000000 -0400
25371 +++ linux-2.6.39.1/drivers/ata/pata_cs5536.c 2011-05-22 19:36:31.000000000 -0400
25372 @@ -233,7 +233,7 @@ static struct scsi_host_template cs5536_
25373 ATA_BMDMA_SHT(DRV_NAME),
25374 };
25375
25376 -static struct ata_port_operations cs5536_port_ops = {
25377 +static const struct ata_port_operations cs5536_port_ops = {
25378 .inherits = &ata_bmdma32_port_ops,
25379 .cable_detect = cs5536_cable_detect,
25380 .set_piomode = cs5536_set_piomode,
25381 diff -urNp linux-2.6.39.1/drivers/ata/pata_cypress.c linux-2.6.39.1/drivers/ata/pata_cypress.c
25382 --- linux-2.6.39.1/drivers/ata/pata_cypress.c 2011-05-19 00:06:34.000000000 -0400
25383 +++ linux-2.6.39.1/drivers/ata/pata_cypress.c 2011-05-22 19:36:31.000000000 -0400
25384 @@ -115,7 +115,7 @@ static struct scsi_host_template cy82c69
25385 ATA_BMDMA_SHT(DRV_NAME),
25386 };
25387
25388 -static struct ata_port_operations cy82c693_port_ops = {
25389 +static const struct ata_port_operations cy82c693_port_ops = {
25390 .inherits = &ata_bmdma_port_ops,
25391 .cable_detect = ata_cable_40wire,
25392 .set_piomode = cy82c693_set_piomode,
25393 diff -urNp linux-2.6.39.1/drivers/ata/pata_efar.c linux-2.6.39.1/drivers/ata/pata_efar.c
25394 --- linux-2.6.39.1/drivers/ata/pata_efar.c 2011-05-19 00:06:34.000000000 -0400
25395 +++ linux-2.6.39.1/drivers/ata/pata_efar.c 2011-05-22 19:36:31.000000000 -0400
25396 @@ -238,7 +238,7 @@ static struct scsi_host_template efar_sh
25397 ATA_BMDMA_SHT(DRV_NAME),
25398 };
25399
25400 -static struct ata_port_operations efar_ops = {
25401 +static const struct ata_port_operations efar_ops = {
25402 .inherits = &ata_bmdma_port_ops,
25403 .cable_detect = efar_cable_detect,
25404 .set_piomode = efar_set_piomode,
25405 diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt366.c linux-2.6.39.1/drivers/ata/pata_hpt366.c
25406 --- linux-2.6.39.1/drivers/ata/pata_hpt366.c 2011-05-19 00:06:34.000000000 -0400
25407 +++ linux-2.6.39.1/drivers/ata/pata_hpt366.c 2011-05-22 19:36:31.000000000 -0400
25408 @@ -276,7 +276,7 @@ static struct scsi_host_template hpt36x_
25409 * Configuration for HPT366/68
25410 */
25411
25412 -static struct ata_port_operations hpt366_port_ops = {
25413 +static const struct ata_port_operations hpt366_port_ops = {
25414 .inherits = &ata_bmdma_port_ops,
25415 .cable_detect = hpt36x_cable_detect,
25416 .mode_filter = hpt366_filter,
25417 diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt37x.c linux-2.6.39.1/drivers/ata/pata_hpt37x.c
25418 --- linux-2.6.39.1/drivers/ata/pata_hpt37x.c 2011-05-19 00:06:34.000000000 -0400
25419 +++ linux-2.6.39.1/drivers/ata/pata_hpt37x.c 2011-05-22 19:36:31.000000000 -0400
25420 @@ -589,7 +589,7 @@ static struct scsi_host_template hpt37x_
25421 * Configuration for HPT370
25422 */
25423
25424 -static struct ata_port_operations hpt370_port_ops = {
25425 +static const struct ata_port_operations hpt370_port_ops = {
25426 .inherits = &ata_bmdma_port_ops,
25427
25428 .bmdma_stop = hpt370_bmdma_stop,
25429 @@ -605,7 +605,7 @@ static struct ata_port_operations hpt370
25430 * Configuration for HPT370A. Close to 370 but less filters
25431 */
25432
25433 -static struct ata_port_operations hpt370a_port_ops = {
25434 +static const struct ata_port_operations hpt370a_port_ops = {
25435 .inherits = &hpt370_port_ops,
25436 .mode_filter = hpt370a_filter,
25437 };
25438 @@ -615,7 +615,7 @@ static struct ata_port_operations hpt370
25439 * mode setting functionality.
25440 */
25441
25442 -static struct ata_port_operations hpt302_port_ops = {
25443 +static const struct ata_port_operations hpt302_port_ops = {
25444 .inherits = &ata_bmdma_port_ops,
25445
25446 .bmdma_stop = hpt37x_bmdma_stop,
25447 @@ -631,7 +631,7 @@ static struct ata_port_operations hpt302
25448 * but we have a mode filter.
25449 */
25450
25451 -static struct ata_port_operations hpt372_port_ops = {
25452 +static const struct ata_port_operations hpt372_port_ops = {
25453 .inherits = &hpt302_port_ops,
25454 .mode_filter = hpt372_filter,
25455 };
25456 @@ -641,7 +641,7 @@ static struct ata_port_operations hpt372
25457 * but we have a different cable detection procedure for function 1.
25458 */
25459
25460 -static struct ata_port_operations hpt374_fn1_port_ops = {
25461 +static const struct ata_port_operations hpt374_fn1_port_ops = {
25462 .inherits = &hpt372_port_ops,
25463 .cable_detect = hpt374_fn1_cable_detect,
25464 };
25465 diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c
25466 --- linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c 2011-05-19 00:06:34.000000000 -0400
25467 +++ linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c 2011-05-22 19:36:31.000000000 -0400
25468 @@ -350,7 +350,7 @@ static struct scsi_host_template hpt3x2n
25469 * Configuration for HPT302N/371N.
25470 */
25471
25472 -static struct ata_port_operations hpt3xxn_port_ops = {
25473 +static const struct ata_port_operations hpt3xxn_port_ops = {
25474 .inherits = &ata_bmdma_port_ops,
25475
25476 .bmdma_stop = hpt3x2n_bmdma_stop,
25477 @@ -368,7 +368,7 @@ static struct ata_port_operations hpt3xx
25478 * Configuration for HPT372N. Same as 302N/371N but we have a mode filter.
25479 */
25480
25481 -static struct ata_port_operations hpt372n_port_ops = {
25482 +static const struct ata_port_operations hpt372n_port_ops = {
25483 .inherits = &hpt3xxn_port_ops,
25484 .mode_filter = &hpt372n_filter,
25485 };
25486 diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt3x3.c linux-2.6.39.1/drivers/ata/pata_hpt3x3.c
25487 --- linux-2.6.39.1/drivers/ata/pata_hpt3x3.c 2011-05-19 00:06:34.000000000 -0400
25488 +++ linux-2.6.39.1/drivers/ata/pata_hpt3x3.c 2011-05-22 19:36:31.000000000 -0400
25489 @@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
25490 ATA_BMDMA_SHT(DRV_NAME),
25491 };
25492
25493 -static struct ata_port_operations hpt3x3_port_ops = {
25494 +static const struct ata_port_operations hpt3x3_port_ops = {
25495 .inherits = &ata_bmdma_port_ops,
25496 .cable_detect = ata_cable_40wire,
25497 .set_piomode = hpt3x3_set_piomode,
25498 diff -urNp linux-2.6.39.1/drivers/ata/pata_icside.c linux-2.6.39.1/drivers/ata/pata_icside.c
25499 --- linux-2.6.39.1/drivers/ata/pata_icside.c 2011-05-19 00:06:34.000000000 -0400
25500 +++ linux-2.6.39.1/drivers/ata/pata_icside.c 2011-05-22 19:36:31.000000000 -0400
25501 @@ -320,7 +320,7 @@ static void pata_icside_postreset(struct
25502 }
25503 }
25504
25505 -static struct ata_port_operations pata_icside_port_ops = {
25506 +static const struct ata_port_operations pata_icside_port_ops = {
25507 .inherits = &ata_bmdma_port_ops,
25508 /* no need to build any PRD tables for DMA */
25509 .qc_prep = ata_noop_qc_prep,
25510 diff -urNp linux-2.6.39.1/drivers/ata/pata_isapnp.c linux-2.6.39.1/drivers/ata/pata_isapnp.c
25511 --- linux-2.6.39.1/drivers/ata/pata_isapnp.c 2011-05-19 00:06:34.000000000 -0400
25512 +++ linux-2.6.39.1/drivers/ata/pata_isapnp.c 2011-05-22 19:36:31.000000000 -0400
25513 @@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
25514 ATA_PIO_SHT(DRV_NAME),
25515 };
25516
25517 -static struct ata_port_operations isapnp_port_ops = {
25518 +static const struct ata_port_operations isapnp_port_ops = {
25519 .inherits = &ata_sff_port_ops,
25520 .cable_detect = ata_cable_40wire,
25521 };
25522
25523 -static struct ata_port_operations isapnp_noalt_port_ops = {
25524 +static const struct ata_port_operations isapnp_noalt_port_ops = {
25525 .inherits = &ata_sff_port_ops,
25526 .cable_detect = ata_cable_40wire,
25527 /* No altstatus so we don't want to use the lost interrupt poll */
25528 diff -urNp linux-2.6.39.1/drivers/ata/pata_it8213.c linux-2.6.39.1/drivers/ata/pata_it8213.c
25529 --- linux-2.6.39.1/drivers/ata/pata_it8213.c 2011-05-19 00:06:34.000000000 -0400
25530 +++ linux-2.6.39.1/drivers/ata/pata_it8213.c 2011-05-22 19:36:31.000000000 -0400
25531 @@ -233,7 +233,7 @@ static struct scsi_host_template it8213_
25532 };
25533
25534
25535 -static struct ata_port_operations it8213_ops = {
25536 +static const struct ata_port_operations it8213_ops = {
25537 .inherits = &ata_bmdma_port_ops,
25538 .cable_detect = it8213_cable_detect,
25539 .set_piomode = it8213_set_piomode,
25540 diff -urNp linux-2.6.39.1/drivers/ata/pata_it821x.c linux-2.6.39.1/drivers/ata/pata_it821x.c
25541 --- linux-2.6.39.1/drivers/ata/pata_it821x.c 2011-05-19 00:06:34.000000000 -0400
25542 +++ linux-2.6.39.1/drivers/ata/pata_it821x.c 2011-05-22 19:36:31.000000000 -0400
25543 @@ -801,7 +801,7 @@ static struct scsi_host_template it821x_
25544 ATA_BMDMA_SHT(DRV_NAME),
25545 };
25546
25547 -static struct ata_port_operations it821x_smart_port_ops = {
25548 +static const struct ata_port_operations it821x_smart_port_ops = {
25549 .inherits = &ata_bmdma_port_ops,
25550
25551 .check_atapi_dma= it821x_check_atapi_dma,
25552 @@ -815,7 +815,7 @@ static struct ata_port_operations it821x
25553 .port_start = it821x_port_start,
25554 };
25555
25556 -static struct ata_port_operations it821x_passthru_port_ops = {
25557 +static const struct ata_port_operations it821x_passthru_port_ops = {
25558 .inherits = &ata_bmdma_port_ops,
25559
25560 .check_atapi_dma= it821x_check_atapi_dma,
25561 @@ -831,7 +831,7 @@ static struct ata_port_operations it821x
25562 .port_start = it821x_port_start,
25563 };
25564
25565 -static struct ata_port_operations it821x_rdc_port_ops = {
25566 +static const struct ata_port_operations it821x_rdc_port_ops = {
25567 .inherits = &ata_bmdma_port_ops,
25568
25569 .check_atapi_dma= it821x_check_atapi_dma,
25570 diff -urNp linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c
25571 --- linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c 2011-05-19 00:06:34.000000000 -0400
25572 +++ linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c 2011-05-22 19:36:31.000000000 -0400
25573 @@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
25574 ATA_PIO_SHT(DRV_NAME),
25575 };
25576
25577 -static struct ata_port_operations ixp4xx_port_ops = {
25578 +static const struct ata_port_operations ixp4xx_port_ops = {
25579 .inherits = &ata_sff_port_ops,
25580 .sff_data_xfer = ixp4xx_mmio_data_xfer,
25581 .cable_detect = ata_cable_40wire,
25582 diff -urNp linux-2.6.39.1/drivers/ata/pata_jmicron.c linux-2.6.39.1/drivers/ata/pata_jmicron.c
25583 --- linux-2.6.39.1/drivers/ata/pata_jmicron.c 2011-05-19 00:06:34.000000000 -0400
25584 +++ linux-2.6.39.1/drivers/ata/pata_jmicron.c 2011-05-22 19:36:31.000000000 -0400
25585 @@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
25586 ATA_BMDMA_SHT(DRV_NAME),
25587 };
25588
25589 -static struct ata_port_operations jmicron_ops = {
25590 +static const struct ata_port_operations jmicron_ops = {
25591 .inherits = &ata_bmdma_port_ops,
25592 .prereset = jmicron_pre_reset,
25593 };
25594 diff -urNp linux-2.6.39.1/drivers/ata/pata_legacy.c linux-2.6.39.1/drivers/ata/pata_legacy.c
25595 --- linux-2.6.39.1/drivers/ata/pata_legacy.c 2011-05-19 00:06:34.000000000 -0400
25596 +++ linux-2.6.39.1/drivers/ata/pata_legacy.c 2011-05-22 19:36:31.000000000 -0400
25597 @@ -116,7 +116,7 @@ struct legacy_probe {
25598
25599 struct legacy_controller {
25600 const char *name;
25601 - struct ata_port_operations *ops;
25602 + const struct ata_port_operations *ops;
25603 unsigned int pio_mask;
25604 unsigned int flags;
25605 unsigned int pflags;
25606 @@ -239,12 +239,12 @@ static const struct ata_port_operations
25607 * pio_mask as well.
25608 */
25609
25610 -static struct ata_port_operations simple_port_ops = {
25611 +static const struct ata_port_operations simple_port_ops = {
25612 .inherits = &legacy_base_port_ops,
25613 .sff_data_xfer = ata_sff_data_xfer_noirq,
25614 };
25615
25616 -static struct ata_port_operations legacy_port_ops = {
25617 +static const struct ata_port_operations legacy_port_ops = {
25618 .inherits = &legacy_base_port_ops,
25619 .sff_data_xfer = ata_sff_data_xfer_noirq,
25620 .set_mode = legacy_set_mode,
25621 @@ -340,7 +340,7 @@ static unsigned int pdc_data_xfer_vlb(st
25622 return buflen;
25623 }
25624
25625 -static struct ata_port_operations pdc20230_port_ops = {
25626 +static const struct ata_port_operations pdc20230_port_ops = {
25627 .inherits = &legacy_base_port_ops,
25628 .set_piomode = pdc20230_set_piomode,
25629 .sff_data_xfer = pdc_data_xfer_vlb,
25630 @@ -373,7 +373,7 @@ static void ht6560a_set_piomode(struct a
25631 ioread8(ap->ioaddr.status_addr);
25632 }
25633
25634 -static struct ata_port_operations ht6560a_port_ops = {
25635 +static const struct ata_port_operations ht6560a_port_ops = {
25636 .inherits = &legacy_base_port_ops,
25637 .set_piomode = ht6560a_set_piomode,
25638 };
25639 @@ -416,7 +416,7 @@ static void ht6560b_set_piomode(struct a
25640 ioread8(ap->ioaddr.status_addr);
25641 }
25642
25643 -static struct ata_port_operations ht6560b_port_ops = {
25644 +static const struct ata_port_operations ht6560b_port_ops = {
25645 .inherits = &legacy_base_port_ops,
25646 .set_piomode = ht6560b_set_piomode,
25647 };
25648 @@ -515,7 +515,7 @@ static void opti82c611a_set_piomode(stru
25649 }
25650
25651
25652 -static struct ata_port_operations opti82c611a_port_ops = {
25653 +static const struct ata_port_operations opti82c611a_port_ops = {
25654 .inherits = &legacy_base_port_ops,
25655 .set_piomode = opti82c611a_set_piomode,
25656 };
25657 @@ -625,7 +625,7 @@ static unsigned int opti82c46x_qc_issue(
25658 return ata_sff_qc_issue(qc);
25659 }
25660
25661 -static struct ata_port_operations opti82c46x_port_ops = {
25662 +static const struct ata_port_operations opti82c46x_port_ops = {
25663 .inherits = &legacy_base_port_ops,
25664 .set_piomode = opti82c46x_set_piomode,
25665 .qc_issue = opti82c46x_qc_issue,
25666 @@ -787,20 +787,20 @@ static int qdi_port(struct platform_devi
25667 return 0;
25668 }
25669
25670 -static struct ata_port_operations qdi6500_port_ops = {
25671 +static const struct ata_port_operations qdi6500_port_ops = {
25672 .inherits = &legacy_base_port_ops,
25673 .set_piomode = qdi6500_set_piomode,
25674 .qc_issue = qdi_qc_issue,
25675 .sff_data_xfer = vlb32_data_xfer,
25676 };
25677
25678 -static struct ata_port_operations qdi6580_port_ops = {
25679 +static const struct ata_port_operations qdi6580_port_ops = {
25680 .inherits = &legacy_base_port_ops,
25681 .set_piomode = qdi6580_set_piomode,
25682 .sff_data_xfer = vlb32_data_xfer,
25683 };
25684
25685 -static struct ata_port_operations qdi6580dp_port_ops = {
25686 +static const struct ata_port_operations qdi6580dp_port_ops = {
25687 .inherits = &legacy_base_port_ops,
25688 .set_piomode = qdi6580dp_set_piomode,
25689 .qc_issue = qdi_qc_issue,
25690 @@ -872,7 +872,7 @@ static int winbond_port(struct platform_
25691 return 0;
25692 }
25693
25694 -static struct ata_port_operations winbond_port_ops = {
25695 +static const struct ata_port_operations winbond_port_ops = {
25696 .inherits = &legacy_base_port_ops,
25697 .set_piomode = winbond_set_piomode,
25698 .sff_data_xfer = vlb32_data_xfer,
25699 @@ -995,7 +995,7 @@ static __init int legacy_init_one(struct
25700 int pio_modes = controller->pio_mask;
25701 unsigned long io = probe->port;
25702 u32 mask = (1 << probe->slot);
25703 - struct ata_port_operations *ops = controller->ops;
25704 + const struct ata_port_operations *ops = controller->ops;
25705 struct legacy_data *ld = &legacy_data[probe->slot];
25706 struct ata_host *host = NULL;
25707 struct ata_port *ap;
25708 diff -urNp linux-2.6.39.1/drivers/ata/pata_macio.c linux-2.6.39.1/drivers/ata/pata_macio.c
25709 --- linux-2.6.39.1/drivers/ata/pata_macio.c 2011-05-19 00:06:34.000000000 -0400
25710 +++ linux-2.6.39.1/drivers/ata/pata_macio.c 2011-05-22 19:36:31.000000000 -0400
25711 @@ -918,9 +918,8 @@ static struct scsi_host_template pata_ma
25712 .slave_configure = pata_macio_slave_config,
25713 };
25714
25715 -static struct ata_port_operations pata_macio_ops = {
25716 +static const struct ata_port_operations pata_macio_ops = {
25717 .inherits = &ata_bmdma_port_ops,
25718 -
25719 .freeze = pata_macio_freeze,
25720 .set_piomode = pata_macio_set_timings,
25721 .set_dmamode = pata_macio_set_timings,
25722 diff -urNp linux-2.6.39.1/drivers/ata/pata_marvell.c linux-2.6.39.1/drivers/ata/pata_marvell.c
25723 --- linux-2.6.39.1/drivers/ata/pata_marvell.c 2011-05-19 00:06:34.000000000 -0400
25724 +++ linux-2.6.39.1/drivers/ata/pata_marvell.c 2011-05-22 19:36:31.000000000 -0400
25725 @@ -100,7 +100,7 @@ static struct scsi_host_template marvell
25726 ATA_BMDMA_SHT(DRV_NAME),
25727 };
25728
25729 -static struct ata_port_operations marvell_ops = {
25730 +static const struct ata_port_operations marvell_ops = {
25731 .inherits = &ata_bmdma_port_ops,
25732 .cable_detect = marvell_cable_detect,
25733 .prereset = marvell_pre_reset,
25734 diff -urNp linux-2.6.39.1/drivers/ata/pata_mpc52xx.c linux-2.6.39.1/drivers/ata/pata_mpc52xx.c
25735 --- linux-2.6.39.1/drivers/ata/pata_mpc52xx.c 2011-05-19 00:06:34.000000000 -0400
25736 +++ linux-2.6.39.1/drivers/ata/pata_mpc52xx.c 2011-05-22 19:36:31.000000000 -0400
25737 @@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
25738 ATA_PIO_SHT(DRV_NAME),
25739 };
25740
25741 -static struct ata_port_operations mpc52xx_ata_port_ops = {
25742 +static const struct ata_port_operations mpc52xx_ata_port_ops = {
25743 .inherits = &ata_bmdma_port_ops,
25744 .sff_dev_select = mpc52xx_ata_dev_select,
25745 .set_piomode = mpc52xx_ata_set_piomode,
25746 diff -urNp linux-2.6.39.1/drivers/ata/pata_mpiix.c linux-2.6.39.1/drivers/ata/pata_mpiix.c
25747 --- linux-2.6.39.1/drivers/ata/pata_mpiix.c 2011-05-19 00:06:34.000000000 -0400
25748 +++ linux-2.6.39.1/drivers/ata/pata_mpiix.c 2011-05-22 19:36:31.000000000 -0400
25749 @@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
25750 ATA_PIO_SHT(DRV_NAME),
25751 };
25752
25753 -static struct ata_port_operations mpiix_port_ops = {
25754 +static const struct ata_port_operations mpiix_port_ops = {
25755 .inherits = &ata_sff_port_ops,
25756 .qc_issue = mpiix_qc_issue,
25757 .cable_detect = ata_cable_40wire,
25758 diff -urNp linux-2.6.39.1/drivers/ata/pata_netcell.c linux-2.6.39.1/drivers/ata/pata_netcell.c
25759 --- linux-2.6.39.1/drivers/ata/pata_netcell.c 2011-05-19 00:06:34.000000000 -0400
25760 +++ linux-2.6.39.1/drivers/ata/pata_netcell.c 2011-05-22 19:36:31.000000000 -0400
25761 @@ -34,7 +34,7 @@ static struct scsi_host_template netcell
25762 ATA_BMDMA_SHT(DRV_NAME),
25763 };
25764
25765 -static struct ata_port_operations netcell_ops = {
25766 +static const struct ata_port_operations netcell_ops = {
25767 .inherits = &ata_bmdma_port_ops,
25768 .cable_detect = ata_cable_80wire,
25769 .read_id = netcell_read_id,
25770 diff -urNp linux-2.6.39.1/drivers/ata/pata_ninja32.c linux-2.6.39.1/drivers/ata/pata_ninja32.c
25771 --- linux-2.6.39.1/drivers/ata/pata_ninja32.c 2011-05-19 00:06:34.000000000 -0400
25772 +++ linux-2.6.39.1/drivers/ata/pata_ninja32.c 2011-05-22 19:36:31.000000000 -0400
25773 @@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
25774 ATA_BMDMA_SHT(DRV_NAME),
25775 };
25776
25777 -static struct ata_port_operations ninja32_port_ops = {
25778 +static const struct ata_port_operations ninja32_port_ops = {
25779 .inherits = &ata_bmdma_port_ops,
25780 .sff_dev_select = ninja32_dev_select,
25781 .cable_detect = ata_cable_40wire,
25782 diff -urNp linux-2.6.39.1/drivers/ata/pata_ns87410.c linux-2.6.39.1/drivers/ata/pata_ns87410.c
25783 --- linux-2.6.39.1/drivers/ata/pata_ns87410.c 2011-05-19 00:06:34.000000000 -0400
25784 +++ linux-2.6.39.1/drivers/ata/pata_ns87410.c 2011-05-22 19:36:31.000000000 -0400
25785 @@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
25786 ATA_PIO_SHT(DRV_NAME),
25787 };
25788
25789 -static struct ata_port_operations ns87410_port_ops = {
25790 +static const struct ata_port_operations ns87410_port_ops = {
25791 .inherits = &ata_sff_port_ops,
25792 .qc_issue = ns87410_qc_issue,
25793 .cable_detect = ata_cable_40wire,
25794 diff -urNp linux-2.6.39.1/drivers/ata/pata_ns87415.c linux-2.6.39.1/drivers/ata/pata_ns87415.c
25795 --- linux-2.6.39.1/drivers/ata/pata_ns87415.c 2011-05-19 00:06:34.000000000 -0400
25796 +++ linux-2.6.39.1/drivers/ata/pata_ns87415.c 2011-05-22 19:36:31.000000000 -0400
25797 @@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
25798 }
25799 #endif /* 87560 SuperIO Support */
25800
25801 -static struct ata_port_operations ns87415_pata_ops = {
25802 +static const struct ata_port_operations ns87415_pata_ops = {
25803 .inherits = &ata_bmdma_port_ops,
25804
25805 .check_atapi_dma = ns87415_check_atapi_dma,
25806 @@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
25807 };
25808
25809 #if defined(CONFIG_SUPERIO)
25810 -static struct ata_port_operations ns87560_pata_ops = {
25811 +static const struct ata_port_operations ns87560_pata_ops = {
25812 .inherits = &ns87415_pata_ops,
25813 .sff_tf_read = ns87560_tf_read,
25814 .sff_check_status = ns87560_check_status,
25815 diff -urNp linux-2.6.39.1/drivers/ata/pata_octeon_cf.c linux-2.6.39.1/drivers/ata/pata_octeon_cf.c
25816 --- linux-2.6.39.1/drivers/ata/pata_octeon_cf.c 2011-05-19 00:06:34.000000000 -0400
25817 +++ linux-2.6.39.1/drivers/ata/pata_octeon_cf.c 2011-05-22 19:36:31.000000000 -0400
25818 @@ -780,7 +780,7 @@ static unsigned int octeon_cf_qc_issue(s
25819 return 0;
25820 }
25821
25822 -static struct ata_port_operations octeon_cf_ops = {
25823 +static struct ata_port_operations octeon_cf_ops = { /* cannot be const */
25824 .inherits = &ata_sff_port_ops,
25825 .check_atapi_dma = octeon_cf_check_atapi_dma,
25826 .qc_prep = ata_noop_qc_prep,
25827 diff -urNp linux-2.6.39.1/drivers/ata/pata_oldpiix.c linux-2.6.39.1/drivers/ata/pata_oldpiix.c
25828 --- linux-2.6.39.1/drivers/ata/pata_oldpiix.c 2011-05-19 00:06:34.000000000 -0400
25829 +++ linux-2.6.39.1/drivers/ata/pata_oldpiix.c 2011-05-22 19:36:31.000000000 -0400
25830 @@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
25831 ATA_BMDMA_SHT(DRV_NAME),
25832 };
25833
25834 -static struct ata_port_operations oldpiix_pata_ops = {
25835 +static const struct ata_port_operations oldpiix_pata_ops = {
25836 .inherits = &ata_bmdma_port_ops,
25837 .qc_issue = oldpiix_qc_issue,
25838 .cable_detect = ata_cable_40wire,
25839 diff -urNp linux-2.6.39.1/drivers/ata/pata_opti.c linux-2.6.39.1/drivers/ata/pata_opti.c
25840 --- linux-2.6.39.1/drivers/ata/pata_opti.c 2011-05-19 00:06:34.000000000 -0400
25841 +++ linux-2.6.39.1/drivers/ata/pata_opti.c 2011-05-22 19:36:31.000000000 -0400
25842 @@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
25843 ATA_PIO_SHT(DRV_NAME),
25844 };
25845
25846 -static struct ata_port_operations opti_port_ops = {
25847 +static const struct ata_port_operations opti_port_ops = {
25848 .inherits = &ata_sff_port_ops,
25849 .cable_detect = ata_cable_40wire,
25850 .set_piomode = opti_set_piomode,
25851 diff -urNp linux-2.6.39.1/drivers/ata/pata_optidma.c linux-2.6.39.1/drivers/ata/pata_optidma.c
25852 --- linux-2.6.39.1/drivers/ata/pata_optidma.c 2011-05-19 00:06:34.000000000 -0400
25853 +++ linux-2.6.39.1/drivers/ata/pata_optidma.c 2011-05-22 19:36:31.000000000 -0400
25854 @@ -337,7 +337,7 @@ static struct scsi_host_template optidma
25855 ATA_BMDMA_SHT(DRV_NAME),
25856 };
25857
25858 -static struct ata_port_operations optidma_port_ops = {
25859 +static const struct ata_port_operations optidma_port_ops = {
25860 .inherits = &ata_bmdma_port_ops,
25861 .cable_detect = ata_cable_40wire,
25862 .set_piomode = optidma_set_pio_mode,
25863 @@ -346,7 +346,7 @@ static struct ata_port_operations optidm
25864 .prereset = optidma_pre_reset,
25865 };
25866
25867 -static struct ata_port_operations optiplus_port_ops = {
25868 +static const struct ata_port_operations optiplus_port_ops = {
25869 .inherits = &optidma_port_ops,
25870 .set_piomode = optiplus_set_pio_mode,
25871 .set_dmamode = optiplus_set_dma_mode,
25872 diff -urNp linux-2.6.39.1/drivers/ata/pata_palmld.c linux-2.6.39.1/drivers/ata/pata_palmld.c
25873 --- linux-2.6.39.1/drivers/ata/pata_palmld.c 2011-05-19 00:06:34.000000000 -0400
25874 +++ linux-2.6.39.1/drivers/ata/pata_palmld.c 2011-05-22 19:36:31.000000000 -0400
25875 @@ -42,7 +42,7 @@ static struct scsi_host_template palmld_
25876 ATA_PIO_SHT(DRV_NAME),
25877 };
25878
25879 -static struct ata_port_operations palmld_port_ops = {
25880 +static const struct ata_port_operations palmld_port_ops = {
25881 .inherits = &ata_sff_port_ops,
25882 .sff_data_xfer = ata_sff_data_xfer_noirq,
25883 .cable_detect = ata_cable_40wire,
25884 diff -urNp linux-2.6.39.1/drivers/ata/pata_pcmcia.c linux-2.6.39.1/drivers/ata/pata_pcmcia.c
25885 --- linux-2.6.39.1/drivers/ata/pata_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
25886 +++ linux-2.6.39.1/drivers/ata/pata_pcmcia.c 2011-05-22 19:36:31.000000000 -0400
25887 @@ -151,14 +151,14 @@ static struct scsi_host_template pcmcia_
25888 ATA_PIO_SHT(DRV_NAME),
25889 };
25890
25891 -static struct ata_port_operations pcmcia_port_ops = {
25892 +static const struct ata_port_operations pcmcia_port_ops = {
25893 .inherits = &ata_sff_port_ops,
25894 .sff_data_xfer = ata_sff_data_xfer_noirq,
25895 .cable_detect = ata_cable_40wire,
25896 .set_mode = pcmcia_set_mode,
25897 };
25898
25899 -static struct ata_port_operations pcmcia_8bit_port_ops = {
25900 +static const struct ata_port_operations pcmcia_8bit_port_ops = {
25901 .inherits = &ata_sff_port_ops,
25902 .sff_data_xfer = ata_data_xfer_8bit,
25903 .cable_detect = ata_cable_40wire,
25904 @@ -205,7 +205,7 @@ static int pcmcia_init_one(struct pcmcia
25905 unsigned long io_base, ctl_base;
25906 void __iomem *io_addr, *ctl_addr;
25907 int n_ports = 1;
25908 - struct ata_port_operations *ops = &pcmcia_port_ops;
25909 + const struct ata_port_operations *ops = &pcmcia_port_ops;
25910
25911 /* Set up attributes in order to probe card and get resources */
25912 pdev->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IO |
25913 diff -urNp linux-2.6.39.1/drivers/ata/pata_pdc2027x.c linux-2.6.39.1/drivers/ata/pata_pdc2027x.c
25914 --- linux-2.6.39.1/drivers/ata/pata_pdc2027x.c 2011-05-19 00:06:34.000000000 -0400
25915 +++ linux-2.6.39.1/drivers/ata/pata_pdc2027x.c 2011-05-22 19:36:31.000000000 -0400
25916 @@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
25917 ATA_BMDMA_SHT(DRV_NAME),
25918 };
25919
25920 -static struct ata_port_operations pdc2027x_pata100_ops = {
25921 +static const struct ata_port_operations pdc2027x_pata100_ops = {
25922 .inherits = &ata_bmdma_port_ops,
25923 .check_atapi_dma = pdc2027x_check_atapi_dma,
25924 .cable_detect = pdc2027x_cable_detect,
25925 .prereset = pdc2027x_prereset,
25926 };
25927
25928 -static struct ata_port_operations pdc2027x_pata133_ops = {
25929 +static const struct ata_port_operations pdc2027x_pata133_ops = {
25930 .inherits = &pdc2027x_pata100_ops,
25931 .mode_filter = pdc2027x_mode_filter,
25932 .set_piomode = pdc2027x_set_piomode,
25933 diff -urNp linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c
25934 --- linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c 2011-05-19 00:06:34.000000000 -0400
25935 +++ linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c 2011-05-22 19:36:31.000000000 -0400
25936 @@ -295,7 +295,7 @@ static struct scsi_host_template pdc202x
25937 ATA_BMDMA_SHT(DRV_NAME),
25938 };
25939
25940 -static struct ata_port_operations pdc2024x_port_ops = {
25941 +static const struct ata_port_operations pdc2024x_port_ops = {
25942 .inherits = &ata_bmdma_port_ops,
25943
25944 .cable_detect = ata_cable_40wire,
25945 @@ -306,7 +306,7 @@ static struct ata_port_operations pdc202
25946 .sff_irq_check = pdc202xx_irq_check,
25947 };
25948
25949 -static struct ata_port_operations pdc2026x_port_ops = {
25950 +static const struct ata_port_operations pdc2026x_port_ops = {
25951 .inherits = &pdc2024x_port_ops,
25952
25953 .check_atapi_dma = pdc2026x_check_atapi_dma,
25954 diff -urNp linux-2.6.39.1/drivers/ata/pata_piccolo.c linux-2.6.39.1/drivers/ata/pata_piccolo.c
25955 --- linux-2.6.39.1/drivers/ata/pata_piccolo.c 2011-05-19 00:06:34.000000000 -0400
25956 +++ linux-2.6.39.1/drivers/ata/pata_piccolo.c 2011-05-22 19:36:31.000000000 -0400
25957 @@ -67,7 +67,7 @@ static struct scsi_host_template tosh_sh
25958 ATA_BMDMA_SHT(DRV_NAME),
25959 };
25960
25961 -static struct ata_port_operations tosh_port_ops = {
25962 +static const struct ata_port_operations tosh_port_ops = {
25963 .inherits = &ata_bmdma_port_ops,
25964 .cable_detect = ata_cable_unknown,
25965 .set_piomode = tosh_set_piomode,
25966 diff -urNp linux-2.6.39.1/drivers/ata/pata_platform.c linux-2.6.39.1/drivers/ata/pata_platform.c
25967 --- linux-2.6.39.1/drivers/ata/pata_platform.c 2011-05-19 00:06:34.000000000 -0400
25968 +++ linux-2.6.39.1/drivers/ata/pata_platform.c 2011-05-22 19:36:31.000000000 -0400
25969 @@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
25970 ATA_PIO_SHT(DRV_NAME),
25971 };
25972
25973 -static struct ata_port_operations pata_platform_port_ops = {
25974 +static const struct ata_port_operations pata_platform_port_ops = {
25975 .inherits = &ata_sff_port_ops,
25976 .sff_data_xfer = ata_sff_data_xfer_noirq,
25977 .cable_detect = ata_cable_unknown,
25978 diff -urNp linux-2.6.39.1/drivers/ata/pata_pxa.c linux-2.6.39.1/drivers/ata/pata_pxa.c
25979 --- linux-2.6.39.1/drivers/ata/pata_pxa.c 2011-05-19 00:06:34.000000000 -0400
25980 +++ linux-2.6.39.1/drivers/ata/pata_pxa.c 2011-05-22 19:36:31.000000000 -0400
25981 @@ -198,7 +198,7 @@ static struct scsi_host_template pxa_ata
25982 ATA_BMDMA_SHT(DRV_NAME),
25983 };
25984
25985 -static struct ata_port_operations pxa_ata_port_ops = {
25986 +static const struct ata_port_operations pxa_ata_port_ops = {
25987 .inherits = &ata_bmdma_port_ops,
25988 .cable_detect = ata_cable_40wire,
25989
25990 diff -urNp linux-2.6.39.1/drivers/ata/pata_qdi.c linux-2.6.39.1/drivers/ata/pata_qdi.c
25991 --- linux-2.6.39.1/drivers/ata/pata_qdi.c 2011-05-19 00:06:34.000000000 -0400
25992 +++ linux-2.6.39.1/drivers/ata/pata_qdi.c 2011-05-22 19:36:31.000000000 -0400
25993 @@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
25994 ATA_PIO_SHT(DRV_NAME),
25995 };
25996
25997 -static struct ata_port_operations qdi6500_port_ops = {
25998 +static const struct ata_port_operations qdi6500_port_ops = {
25999 .inherits = &ata_sff_port_ops,
26000 .qc_issue = qdi_qc_issue,
26001 .sff_data_xfer = qdi_data_xfer,
26002 @@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
26003 .set_piomode = qdi6500_set_piomode,
26004 };
26005
26006 -static struct ata_port_operations qdi6580_port_ops = {
26007 +static const struct ata_port_operations qdi6580_port_ops = {
26008 .inherits = &qdi6500_port_ops,
26009 .set_piomode = qdi6580_set_piomode,
26010 };
26011 diff -urNp linux-2.6.39.1/drivers/ata/pata_radisys.c linux-2.6.39.1/drivers/ata/pata_radisys.c
26012 --- linux-2.6.39.1/drivers/ata/pata_radisys.c 2011-05-19 00:06:34.000000000 -0400
26013 +++ linux-2.6.39.1/drivers/ata/pata_radisys.c 2011-05-22 19:36:31.000000000 -0400
26014 @@ -187,7 +187,7 @@ static struct scsi_host_template radisys
26015 ATA_BMDMA_SHT(DRV_NAME),
26016 };
26017
26018 -static struct ata_port_operations radisys_pata_ops = {
26019 +static const struct ata_port_operations radisys_pata_ops = {
26020 .inherits = &ata_bmdma_port_ops,
26021 .qc_issue = radisys_qc_issue,
26022 .cable_detect = ata_cable_unknown,
26023 diff -urNp linux-2.6.39.1/drivers/ata/pata_rb532_cf.c linux-2.6.39.1/drivers/ata/pata_rb532_cf.c
26024 --- linux-2.6.39.1/drivers/ata/pata_rb532_cf.c 2011-05-19 00:06:34.000000000 -0400
26025 +++ linux-2.6.39.1/drivers/ata/pata_rb532_cf.c 2011-05-22 19:36:31.000000000 -0400
26026 @@ -69,7 +69,7 @@ static irqreturn_t rb532_pata_irq_handle
26027 return IRQ_HANDLED;
26028 }
26029
26030 -static struct ata_port_operations rb532_pata_port_ops = {
26031 +static const struct ata_port_operations rb532_pata_port_ops = {
26032 .inherits = &ata_sff_port_ops,
26033 .sff_data_xfer = ata_sff_data_xfer32,
26034 };
26035 diff -urNp linux-2.6.39.1/drivers/ata/pata_rdc.c linux-2.6.39.1/drivers/ata/pata_rdc.c
26036 --- linux-2.6.39.1/drivers/ata/pata_rdc.c 2011-05-19 00:06:34.000000000 -0400
26037 +++ linux-2.6.39.1/drivers/ata/pata_rdc.c 2011-05-22 19:36:31.000000000 -0400
26038 @@ -273,7 +273,7 @@ static void rdc_set_dmamode(struct ata_p
26039 pci_write_config_byte(dev, 0x48, udma_enable);
26040 }
26041
26042 -static struct ata_port_operations rdc_pata_ops = {
26043 +static const struct ata_port_operations rdc_pata_ops = {
26044 .inherits = &ata_bmdma32_port_ops,
26045 .cable_detect = rdc_pata_cable_detect,
26046 .set_piomode = rdc_set_piomode,
26047 diff -urNp linux-2.6.39.1/drivers/ata/pata_rz1000.c linux-2.6.39.1/drivers/ata/pata_rz1000.c
26048 --- linux-2.6.39.1/drivers/ata/pata_rz1000.c 2011-05-19 00:06:34.000000000 -0400
26049 +++ linux-2.6.39.1/drivers/ata/pata_rz1000.c 2011-05-22 19:36:31.000000000 -0400
26050 @@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
26051 ATA_PIO_SHT(DRV_NAME),
26052 };
26053
26054 -static struct ata_port_operations rz1000_port_ops = {
26055 +static const struct ata_port_operations rz1000_port_ops = {
26056 .inherits = &ata_sff_port_ops,
26057 .cable_detect = ata_cable_40wire,
26058 .set_mode = rz1000_set_mode,
26059 diff -urNp linux-2.6.39.1/drivers/ata/pata_samsung_cf.c linux-2.6.39.1/drivers/ata/pata_samsung_cf.c
26060 --- linux-2.6.39.1/drivers/ata/pata_samsung_cf.c 2011-05-19 00:06:34.000000000 -0400
26061 +++ linux-2.6.39.1/drivers/ata/pata_samsung_cf.c 2011-05-22 19:36:31.000000000 -0400
26062 @@ -399,7 +399,7 @@ static struct scsi_host_template pata_s3
26063 ATA_PIO_SHT(DRV_NAME),
26064 };
26065
26066 -static struct ata_port_operations pata_s3c_port_ops = {
26067 +static const struct ata_port_operations pata_s3c_port_ops = {
26068 .inherits = &ata_sff_port_ops,
26069 .sff_check_status = pata_s3c_check_status,
26070 .sff_check_altstatus = pata_s3c_check_altstatus,
26071 @@ -413,7 +413,7 @@ static struct ata_port_operations pata_s
26072 .set_piomode = pata_s3c_set_piomode,
26073 };
26074
26075 -static struct ata_port_operations pata_s5p_port_ops = {
26076 +static const struct ata_port_operations pata_s5p_port_ops = {
26077 .inherits = &ata_sff_port_ops,
26078 .set_piomode = pata_s3c_set_piomode,
26079 };
26080 diff -urNp linux-2.6.39.1/drivers/ata/pata_sc1200.c linux-2.6.39.1/drivers/ata/pata_sc1200.c
26081 --- linux-2.6.39.1/drivers/ata/pata_sc1200.c 2011-05-19 00:06:34.000000000 -0400
26082 +++ linux-2.6.39.1/drivers/ata/pata_sc1200.c 2011-05-22 19:36:31.000000000 -0400
26083 @@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
26084 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
26085 };
26086
26087 -static struct ata_port_operations sc1200_port_ops = {
26088 +static const struct ata_port_operations sc1200_port_ops = {
26089 .inherits = &ata_bmdma_port_ops,
26090 .qc_prep = ata_bmdma_dumb_qc_prep,
26091 .qc_issue = sc1200_qc_issue,
26092 diff -urNp linux-2.6.39.1/drivers/ata/pata_scc.c linux-2.6.39.1/drivers/ata/pata_scc.c
26093 --- linux-2.6.39.1/drivers/ata/pata_scc.c 2011-05-19 00:06:34.000000000 -0400
26094 +++ linux-2.6.39.1/drivers/ata/pata_scc.c 2011-05-22 19:36:31.000000000 -0400
26095 @@ -926,7 +926,7 @@ static struct scsi_host_template scc_sht
26096 ATA_BMDMA_SHT(DRV_NAME),
26097 };
26098
26099 -static struct ata_port_operations scc_pata_ops = {
26100 +static const struct ata_port_operations scc_pata_ops = {
26101 .inherits = &ata_bmdma_port_ops,
26102
26103 .set_piomode = scc_set_piomode,
26104 diff -urNp linux-2.6.39.1/drivers/ata/pata_sch.c linux-2.6.39.1/drivers/ata/pata_sch.c
26105 --- linux-2.6.39.1/drivers/ata/pata_sch.c 2011-05-19 00:06:34.000000000 -0400
26106 +++ linux-2.6.39.1/drivers/ata/pata_sch.c 2011-05-22 19:36:31.000000000 -0400
26107 @@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
26108 ATA_BMDMA_SHT(DRV_NAME),
26109 };
26110
26111 -static struct ata_port_operations sch_pata_ops = {
26112 +static const struct ata_port_operations sch_pata_ops = {
26113 .inherits = &ata_bmdma_port_ops,
26114 .cable_detect = ata_cable_unknown,
26115 .set_piomode = sch_set_piomode,
26116 diff -urNp linux-2.6.39.1/drivers/ata/pata_serverworks.c linux-2.6.39.1/drivers/ata/pata_serverworks.c
26117 --- linux-2.6.39.1/drivers/ata/pata_serverworks.c 2011-05-19 00:06:34.000000000 -0400
26118 +++ linux-2.6.39.1/drivers/ata/pata_serverworks.c 2011-05-22 19:36:31.000000000 -0400
26119 @@ -300,7 +300,7 @@ static struct scsi_host_template serverw
26120 ATA_BMDMA_SHT(DRV_NAME),
26121 };
26122
26123 -static struct ata_port_operations serverworks_osb4_port_ops = {
26124 +static const struct ata_port_operations serverworks_osb4_port_ops = {
26125 .inherits = &ata_bmdma_port_ops,
26126 .cable_detect = serverworks_cable_detect,
26127 .mode_filter = serverworks_osb4_filter,
26128 @@ -308,7 +308,7 @@ static struct ata_port_operations server
26129 .set_dmamode = serverworks_set_dmamode,
26130 };
26131
26132 -static struct ata_port_operations serverworks_csb_port_ops = {
26133 +static const struct ata_port_operations serverworks_csb_port_ops = {
26134 .inherits = &serverworks_osb4_port_ops,
26135 .mode_filter = serverworks_csb_filter,
26136 };
26137 diff -urNp linux-2.6.39.1/drivers/ata/pata_sil680.c linux-2.6.39.1/drivers/ata/pata_sil680.c
26138 --- linux-2.6.39.1/drivers/ata/pata_sil680.c 2011-05-19 00:06:34.000000000 -0400
26139 +++ linux-2.6.39.1/drivers/ata/pata_sil680.c 2011-05-22 19:36:31.000000000 -0400
26140 @@ -225,8 +225,7 @@ static struct scsi_host_template sil680_
26141 ATA_BMDMA_SHT(DRV_NAME),
26142 };
26143
26144 -
26145 -static struct ata_port_operations sil680_port_ops = {
26146 +static const struct ata_port_operations sil680_port_ops = {
26147 .inherits = &ata_bmdma32_port_ops,
26148 .sff_exec_command = sil680_sff_exec_command,
26149 .sff_irq_check = sil680_sff_irq_check,
26150 diff -urNp linux-2.6.39.1/drivers/ata/pata_sis.c linux-2.6.39.1/drivers/ata/pata_sis.c
26151 --- linux-2.6.39.1/drivers/ata/pata_sis.c 2011-05-19 00:06:34.000000000 -0400
26152 +++ linux-2.6.39.1/drivers/ata/pata_sis.c 2011-05-22 19:36:31.000000000 -0400
26153 @@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
26154 ATA_BMDMA_SHT(DRV_NAME),
26155 };
26156
26157 -static struct ata_port_operations sis_133_for_sata_ops = {
26158 +static const struct ata_port_operations sis_133_for_sata_ops = {
26159 .inherits = &ata_bmdma_port_ops,
26160 .set_piomode = sis_133_set_piomode,
26161 .set_dmamode = sis_133_set_dmamode,
26162 .cable_detect = sis_133_cable_detect,
26163 };
26164
26165 -static struct ata_port_operations sis_base_ops = {
26166 +static const struct ata_port_operations sis_base_ops = {
26167 .inherits = &ata_bmdma_port_ops,
26168 .prereset = sis_pre_reset,
26169 };
26170
26171 -static struct ata_port_operations sis_133_ops = {
26172 +static const struct ata_port_operations sis_133_ops = {
26173 .inherits = &sis_base_ops,
26174 .set_piomode = sis_133_set_piomode,
26175 .set_dmamode = sis_133_set_dmamode,
26176 .cable_detect = sis_133_cable_detect,
26177 };
26178
26179 -static struct ata_port_operations sis_133_early_ops = {
26180 +static const struct ata_port_operations sis_133_early_ops = {
26181 .inherits = &sis_base_ops,
26182 .set_piomode = sis_100_set_piomode,
26183 .set_dmamode = sis_133_early_set_dmamode,
26184 .cable_detect = sis_66_cable_detect,
26185 };
26186
26187 -static struct ata_port_operations sis_100_ops = {
26188 +static const struct ata_port_operations sis_100_ops = {
26189 .inherits = &sis_base_ops,
26190 .set_piomode = sis_100_set_piomode,
26191 .set_dmamode = sis_100_set_dmamode,
26192 .cable_detect = sis_66_cable_detect,
26193 };
26194
26195 -static struct ata_port_operations sis_66_ops = {
26196 +static const struct ata_port_operations sis_66_ops = {
26197 .inherits = &sis_base_ops,
26198 .set_piomode = sis_old_set_piomode,
26199 .set_dmamode = sis_66_set_dmamode,
26200 .cable_detect = sis_66_cable_detect,
26201 };
26202
26203 -static struct ata_port_operations sis_old_ops = {
26204 +static const struct ata_port_operations sis_old_ops = {
26205 .inherits = &sis_base_ops,
26206 .set_piomode = sis_old_set_piomode,
26207 .set_dmamode = sis_old_set_dmamode,
26208 diff -urNp linux-2.6.39.1/drivers/ata/pata_sl82c105.c linux-2.6.39.1/drivers/ata/pata_sl82c105.c
26209 --- linux-2.6.39.1/drivers/ata/pata_sl82c105.c 2011-05-19 00:06:34.000000000 -0400
26210 +++ linux-2.6.39.1/drivers/ata/pata_sl82c105.c 2011-05-22 19:36:31.000000000 -0400
26211 @@ -241,7 +241,7 @@ static struct scsi_host_template sl82c10
26212 ATA_BMDMA_SHT(DRV_NAME),
26213 };
26214
26215 -static struct ata_port_operations sl82c105_port_ops = {
26216 +static const struct ata_port_operations sl82c105_port_ops = {
26217 .inherits = &ata_bmdma_port_ops,
26218 .qc_defer = sl82c105_qc_defer,
26219 .bmdma_start = sl82c105_bmdma_start,
26220 diff -urNp linux-2.6.39.1/drivers/ata/pata_triflex.c linux-2.6.39.1/drivers/ata/pata_triflex.c
26221 --- linux-2.6.39.1/drivers/ata/pata_triflex.c 2011-05-19 00:06:34.000000000 -0400
26222 +++ linux-2.6.39.1/drivers/ata/pata_triflex.c 2011-05-22 19:36:31.000000000 -0400
26223 @@ -178,7 +178,7 @@ static struct scsi_host_template triflex
26224 ATA_BMDMA_SHT(DRV_NAME),
26225 };
26226
26227 -static struct ata_port_operations triflex_port_ops = {
26228 +static const struct ata_port_operations triflex_port_ops = {
26229 .inherits = &ata_bmdma_port_ops,
26230 .bmdma_start = triflex_bmdma_start,
26231 .bmdma_stop = triflex_bmdma_stop,
26232 diff -urNp linux-2.6.39.1/drivers/ata/pata_via.c linux-2.6.39.1/drivers/ata/pata_via.c
26233 --- linux-2.6.39.1/drivers/ata/pata_via.c 2011-05-19 00:06:34.000000000 -0400
26234 +++ linux-2.6.39.1/drivers/ata/pata_via.c 2011-05-22 19:36:31.000000000 -0400
26235 @@ -441,7 +441,7 @@ static struct scsi_host_template via_sht
26236 ATA_BMDMA_SHT(DRV_NAME),
26237 };
26238
26239 -static struct ata_port_operations via_port_ops = {
26240 +static const struct ata_port_operations via_port_ops = {
26241 .inherits = &ata_bmdma_port_ops,
26242 .cable_detect = via_cable_detect,
26243 .set_piomode = via_set_piomode,
26244 @@ -452,7 +452,7 @@ static struct ata_port_operations via_po
26245 .mode_filter = via_mode_filter,
26246 };
26247
26248 -static struct ata_port_operations via_port_ops_noirq = {
26249 +static const struct ata_port_operations via_port_ops_noirq = {
26250 .inherits = &via_port_ops,
26251 .sff_data_xfer = ata_sff_data_xfer_noirq,
26252 };
26253 diff -urNp linux-2.6.39.1/drivers/ata/pdc_adma.c linux-2.6.39.1/drivers/ata/pdc_adma.c
26254 --- linux-2.6.39.1/drivers/ata/pdc_adma.c 2011-05-19 00:06:34.000000000 -0400
26255 +++ linux-2.6.39.1/drivers/ata/pdc_adma.c 2011-05-22 19:36:31.000000000 -0400
26256 @@ -146,7 +146,7 @@ static struct scsi_host_template adma_at
26257 .dma_boundary = ADMA_DMA_BOUNDARY,
26258 };
26259
26260 -static struct ata_port_operations adma_ata_ops = {
26261 +static const struct ata_port_operations adma_ata_ops = {
26262 .inherits = &ata_sff_port_ops,
26263
26264 .lost_interrupt = ATA_OP_NULL,
26265 diff -urNp linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c
26266 --- linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c 2011-05-19 00:06:34.000000000 -0400
26267 +++ linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c 2011-05-22 19:36:31.000000000 -0400
26268 @@ -1598,7 +1598,7 @@ static struct scsi_host_template sata_dw
26269 .dma_boundary = ATA_DMA_BOUNDARY,
26270 };
26271
26272 -static struct ata_port_operations sata_dwc_ops = {
26273 +static const struct ata_port_operations sata_dwc_ops = {
26274 .inherits = &ata_sff_port_ops,
26275
26276 .error_handler = sata_dwc_error_handler,
26277 diff -urNp linux-2.6.39.1/drivers/ata/sata_fsl.c linux-2.6.39.1/drivers/ata/sata_fsl.c
26278 --- linux-2.6.39.1/drivers/ata/sata_fsl.c 2011-05-19 00:06:34.000000000 -0400
26279 +++ linux-2.6.39.1/drivers/ata/sata_fsl.c 2011-05-22 19:36:31.000000000 -0400
26280 @@ -1268,7 +1268,7 @@ static struct scsi_host_template sata_fs
26281 .dma_boundary = ATA_DMA_BOUNDARY,
26282 };
26283
26284 -static struct ata_port_operations sata_fsl_ops = {
26285 +static const struct ata_port_operations sata_fsl_ops = {
26286 .inherits = &sata_pmp_port_ops,
26287
26288 .qc_defer = ata_std_qc_defer,
26289 diff -urNp linux-2.6.39.1/drivers/ata/sata_inic162x.c linux-2.6.39.1/drivers/ata/sata_inic162x.c
26290 --- linux-2.6.39.1/drivers/ata/sata_inic162x.c 2011-05-19 00:06:34.000000000 -0400
26291 +++ linux-2.6.39.1/drivers/ata/sata_inic162x.c 2011-05-22 19:36:31.000000000 -0400
26292 @@ -705,7 +705,7 @@ static int inic_port_start(struct ata_po
26293 return 0;
26294 }
26295
26296 -static struct ata_port_operations inic_port_ops = {
26297 +static const struct ata_port_operations inic_port_ops = {
26298 .inherits = &sata_port_ops,
26299
26300 .check_atapi_dma = inic_check_atapi_dma,
26301 diff -urNp linux-2.6.39.1/drivers/ata/sata_mv.c linux-2.6.39.1/drivers/ata/sata_mv.c
26302 --- linux-2.6.39.1/drivers/ata/sata_mv.c 2011-05-19 00:06:34.000000000 -0400
26303 +++ linux-2.6.39.1/drivers/ata/sata_mv.c 2011-05-22 19:36:31.000000000 -0400
26304 @@ -662,7 +662,7 @@ static struct scsi_host_template mv6_sht
26305 .dma_boundary = MV_DMA_BOUNDARY,
26306 };
26307
26308 -static struct ata_port_operations mv5_ops = {
26309 +static const struct ata_port_operations mv5_ops = {
26310 .inherits = &ata_sff_port_ops,
26311
26312 .lost_interrupt = ATA_OP_NULL,
26313 @@ -682,7 +682,7 @@ static struct ata_port_operations mv5_op
26314 .port_stop = mv_port_stop,
26315 };
26316
26317 -static struct ata_port_operations mv6_ops = {
26318 +static const struct ata_port_operations mv6_ops = {
26319 .inherits = &ata_bmdma_port_ops,
26320
26321 .lost_interrupt = ATA_OP_NULL,
26322 @@ -716,7 +716,7 @@ static struct ata_port_operations mv6_op
26323 .port_stop = mv_port_stop,
26324 };
26325
26326 -static struct ata_port_operations mv_iie_ops = {
26327 +static const struct ata_port_operations mv_iie_ops = {
26328 .inherits = &mv6_ops,
26329 .dev_config = ATA_OP_NULL,
26330 .qc_prep = mv_qc_prep_iie,
26331 diff -urNp linux-2.6.39.1/drivers/ata/sata_nv.c linux-2.6.39.1/drivers/ata/sata_nv.c
26332 --- linux-2.6.39.1/drivers/ata/sata_nv.c 2011-05-19 00:06:34.000000000 -0400
26333 +++ linux-2.6.39.1/drivers/ata/sata_nv.c 2011-05-22 19:36:31.000000000 -0400
26334 @@ -465,7 +465,7 @@ static struct scsi_host_template nv_swnc
26335 * cases. Define nv_hardreset() which only kicks in for post-boot
26336 * probing and use it for all variants.
26337 */
26338 -static struct ata_port_operations nv_generic_ops = {
26339 +static const struct ata_port_operations nv_generic_ops = {
26340 .inherits = &ata_bmdma_port_ops,
26341 .lost_interrupt = ATA_OP_NULL,
26342 .scr_read = nv_scr_read,
26343 @@ -473,20 +473,20 @@ static struct ata_port_operations nv_gen
26344 .hardreset = nv_hardreset,
26345 };
26346
26347 -static struct ata_port_operations nv_nf2_ops = {
26348 +static const struct ata_port_operations nv_nf2_ops = {
26349 .inherits = &nv_generic_ops,
26350 .freeze = nv_nf2_freeze,
26351 .thaw = nv_nf2_thaw,
26352 };
26353
26354 -static struct ata_port_operations nv_ck804_ops = {
26355 +static const struct ata_port_operations nv_ck804_ops = {
26356 .inherits = &nv_generic_ops,
26357 .freeze = nv_ck804_freeze,
26358 .thaw = nv_ck804_thaw,
26359 .host_stop = nv_ck804_host_stop,
26360 };
26361
26362 -static struct ata_port_operations nv_adma_ops = {
26363 +static const struct ata_port_operations nv_adma_ops = {
26364 .inherits = &nv_ck804_ops,
26365
26366 .check_atapi_dma = nv_adma_check_atapi_dma,
26367 @@ -510,7 +510,7 @@ static struct ata_port_operations nv_adm
26368 .host_stop = nv_adma_host_stop,
26369 };
26370
26371 -static struct ata_port_operations nv_swncq_ops = {
26372 +static const struct ata_port_operations nv_swncq_ops = {
26373 .inherits = &nv_generic_ops,
26374
26375 .qc_defer = ata_std_qc_defer,
26376 diff -urNp linux-2.6.39.1/drivers/ata/sata_promise.c linux-2.6.39.1/drivers/ata/sata_promise.c
26377 --- linux-2.6.39.1/drivers/ata/sata_promise.c 2011-05-19 00:06:34.000000000 -0400
26378 +++ linux-2.6.39.1/drivers/ata/sata_promise.c 2011-05-22 19:36:31.000000000 -0400
26379 @@ -194,7 +194,7 @@ static const struct ata_port_operations
26380 .error_handler = pdc_error_handler,
26381 };
26382
26383 -static struct ata_port_operations pdc_sata_ops = {
26384 +static const struct ata_port_operations pdc_sata_ops = {
26385 .inherits = &pdc_common_ops,
26386 .cable_detect = pdc_sata_cable_detect,
26387 .freeze = pdc_sata_freeze,
26388 @@ -207,14 +207,14 @@ static struct ata_port_operations pdc_sa
26389
26390 /* First-generation chips need a more restrictive ->check_atapi_dma op,
26391 and ->freeze/thaw that ignore the hotplug controls. */
26392 -static struct ata_port_operations pdc_old_sata_ops = {
26393 +static const struct ata_port_operations pdc_old_sata_ops = {
26394 .inherits = &pdc_sata_ops,
26395 .freeze = pdc_freeze,
26396 .thaw = pdc_thaw,
26397 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
26398 };
26399
26400 -static struct ata_port_operations pdc_pata_ops = {
26401 +static const struct ata_port_operations pdc_pata_ops = {
26402 .inherits = &pdc_common_ops,
26403 .cable_detect = pdc_pata_cable_detect,
26404 .freeze = pdc_freeze,
26405 diff -urNp linux-2.6.39.1/drivers/ata/sata_qstor.c linux-2.6.39.1/drivers/ata/sata_qstor.c
26406 --- linux-2.6.39.1/drivers/ata/sata_qstor.c 2011-05-19 00:06:34.000000000 -0400
26407 +++ linux-2.6.39.1/drivers/ata/sata_qstor.c 2011-05-22 19:36:31.000000000 -0400
26408 @@ -131,7 +131,7 @@ static struct scsi_host_template qs_ata_
26409 .dma_boundary = QS_DMA_BOUNDARY,
26410 };
26411
26412 -static struct ata_port_operations qs_ata_ops = {
26413 +static const struct ata_port_operations qs_ata_ops = {
26414 .inherits = &ata_sff_port_ops,
26415
26416 .check_atapi_dma = qs_check_atapi_dma,
26417 diff -urNp linux-2.6.39.1/drivers/ata/sata_sil24.c linux-2.6.39.1/drivers/ata/sata_sil24.c
26418 --- linux-2.6.39.1/drivers/ata/sata_sil24.c 2011-05-19 00:06:34.000000000 -0400
26419 +++ linux-2.6.39.1/drivers/ata/sata_sil24.c 2011-05-22 19:36:31.000000000 -0400
26420 @@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
26421 .dma_boundary = ATA_DMA_BOUNDARY,
26422 };
26423
26424 -static struct ata_port_operations sil24_ops = {
26425 +static const struct ata_port_operations sil24_ops = {
26426 .inherits = &sata_pmp_port_ops,
26427
26428 .qc_defer = sil24_qc_defer,
26429 diff -urNp linux-2.6.39.1/drivers/ata/sata_sil.c linux-2.6.39.1/drivers/ata/sata_sil.c
26430 --- linux-2.6.39.1/drivers/ata/sata_sil.c 2011-05-19 00:06:34.000000000 -0400
26431 +++ linux-2.6.39.1/drivers/ata/sata_sil.c 2011-05-22 19:36:31.000000000 -0400
26432 @@ -181,7 +181,7 @@ static struct scsi_host_template sil_sht
26433 .sg_tablesize = ATA_MAX_PRD
26434 };
26435
26436 -static struct ata_port_operations sil_ops = {
26437 +static const struct ata_port_operations sil_ops = {
26438 .inherits = &ata_bmdma32_port_ops,
26439 .dev_config = sil_dev_config,
26440 .set_mode = sil_set_mode,
26441 diff -urNp linux-2.6.39.1/drivers/ata/sata_sis.c linux-2.6.39.1/drivers/ata/sata_sis.c
26442 --- linux-2.6.39.1/drivers/ata/sata_sis.c 2011-05-19 00:06:34.000000000 -0400
26443 +++ linux-2.6.39.1/drivers/ata/sata_sis.c 2011-05-22 19:36:31.000000000 -0400
26444 @@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
26445 ATA_BMDMA_SHT(DRV_NAME),
26446 };
26447
26448 -static struct ata_port_operations sis_ops = {
26449 +static const struct ata_port_operations sis_ops = {
26450 .inherits = &ata_bmdma_port_ops,
26451 .scr_read = sis_scr_read,
26452 .scr_write = sis_scr_write,
26453 diff -urNp linux-2.6.39.1/drivers/ata/sata_svw.c linux-2.6.39.1/drivers/ata/sata_svw.c
26454 --- linux-2.6.39.1/drivers/ata/sata_svw.c 2011-05-19 00:06:34.000000000 -0400
26455 +++ linux-2.6.39.1/drivers/ata/sata_svw.c 2011-05-22 19:36:31.000000000 -0400
26456 @@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
26457 };
26458
26459
26460 -static struct ata_port_operations k2_sata_ops = {
26461 +static const struct ata_port_operations k2_sata_ops = {
26462 .inherits = &ata_bmdma_port_ops,
26463 .sff_tf_load = k2_sata_tf_load,
26464 .sff_tf_read = k2_sata_tf_read,
26465 diff -urNp linux-2.6.39.1/drivers/ata/sata_sx4.c linux-2.6.39.1/drivers/ata/sata_sx4.c
26466 --- linux-2.6.39.1/drivers/ata/sata_sx4.c 2011-05-19 00:06:34.000000000 -0400
26467 +++ linux-2.6.39.1/drivers/ata/sata_sx4.c 2011-05-22 19:36:31.000000000 -0400
26468 @@ -249,7 +249,7 @@ static struct scsi_host_template pdc_sat
26469 };
26470
26471 /* TODO: inherit from base port_ops after converting to new EH */
26472 -static struct ata_port_operations pdc_20621_ops = {
26473 +static const struct ata_port_operations pdc_20621_ops = {
26474 .inherits = &ata_sff_port_ops,
26475
26476 .check_atapi_dma = pdc_check_atapi_dma,
26477 diff -urNp linux-2.6.39.1/drivers/ata/sata_uli.c linux-2.6.39.1/drivers/ata/sata_uli.c
26478 --- linux-2.6.39.1/drivers/ata/sata_uli.c 2011-05-19 00:06:34.000000000 -0400
26479 +++ linux-2.6.39.1/drivers/ata/sata_uli.c 2011-05-22 19:36:31.000000000 -0400
26480 @@ -80,7 +80,7 @@ static struct scsi_host_template uli_sht
26481 ATA_BMDMA_SHT(DRV_NAME),
26482 };
26483
26484 -static struct ata_port_operations uli_ops = {
26485 +static const struct ata_port_operations uli_ops = {
26486 .inherits = &ata_bmdma_port_ops,
26487 .scr_read = uli_scr_read,
26488 .scr_write = uli_scr_write,
26489 diff -urNp linux-2.6.39.1/drivers/ata/sata_via.c linux-2.6.39.1/drivers/ata/sata_via.c
26490 --- linux-2.6.39.1/drivers/ata/sata_via.c 2011-05-19 00:06:34.000000000 -0400
26491 +++ linux-2.6.39.1/drivers/ata/sata_via.c 2011-05-22 19:36:31.000000000 -0400
26492 @@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
26493 ATA_BMDMA_SHT(DRV_NAME),
26494 };
26495
26496 -static struct ata_port_operations svia_base_ops = {
26497 +static const struct ata_port_operations svia_base_ops = {
26498 .inherits = &ata_bmdma_port_ops,
26499 .sff_tf_load = svia_tf_load,
26500 };
26501
26502 -static struct ata_port_operations vt6420_sata_ops = {
26503 +static const struct ata_port_operations vt6420_sata_ops = {
26504 .inherits = &svia_base_ops,
26505 .freeze = svia_noop_freeze,
26506 .prereset = vt6420_prereset,
26507 .bmdma_start = vt6420_bmdma_start,
26508 };
26509
26510 -static struct ata_port_operations vt6421_pata_ops = {
26511 +static const struct ata_port_operations vt6421_pata_ops = {
26512 .inherits = &svia_base_ops,
26513 .cable_detect = vt6421_pata_cable_detect,
26514 .set_piomode = vt6421_set_pio_mode,
26515 .set_dmamode = vt6421_set_dma_mode,
26516 };
26517
26518 -static struct ata_port_operations vt6421_sata_ops = {
26519 +static const struct ata_port_operations vt6421_sata_ops = {
26520 .inherits = &svia_base_ops,
26521 .scr_read = svia_scr_read,
26522 .scr_write = svia_scr_write,
26523 };
26524
26525 -static struct ata_port_operations vt8251_ops = {
26526 +static const struct ata_port_operations vt8251_ops = {
26527 .inherits = &svia_base_ops,
26528 .hardreset = sata_std_hardreset,
26529 .scr_read = vt8251_scr_read,
26530 diff -urNp linux-2.6.39.1/drivers/ata/sata_vsc.c linux-2.6.39.1/drivers/ata/sata_vsc.c
26531 --- linux-2.6.39.1/drivers/ata/sata_vsc.c 2011-05-19 00:06:34.000000000 -0400
26532 +++ linux-2.6.39.1/drivers/ata/sata_vsc.c 2011-05-22 19:36:31.000000000 -0400
26533 @@ -300,7 +300,7 @@ static struct scsi_host_template vsc_sat
26534 };
26535
26536
26537 -static struct ata_port_operations vsc_sata_ops = {
26538 +static const struct ata_port_operations vsc_sata_ops = {
26539 .inherits = &ata_bmdma_port_ops,
26540 /* The IRQ handling is not quite standard SFF behaviour so we
26541 cannot use the default lost interrupt handler */
26542 diff -urNp linux-2.6.39.1/drivers/atm/adummy.c linux-2.6.39.1/drivers/atm/adummy.c
26543 --- linux-2.6.39.1/drivers/atm/adummy.c 2011-05-19 00:06:34.000000000 -0400
26544 +++ linux-2.6.39.1/drivers/atm/adummy.c 2011-05-22 19:36:31.000000000 -0400
26545 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct
26546 vcc->pop(vcc, skb);
26547 else
26548 dev_kfree_skb_any(skb);
26549 - atomic_inc(&vcc->stats->tx);
26550 + atomic_inc_unchecked(&vcc->stats->tx);
26551
26552 return 0;
26553 }
26554 diff -urNp linux-2.6.39.1/drivers/atm/ambassador.c linux-2.6.39.1/drivers/atm/ambassador.c
26555 --- linux-2.6.39.1/drivers/atm/ambassador.c 2011-05-19 00:06:34.000000000 -0400
26556 +++ linux-2.6.39.1/drivers/atm/ambassador.c 2011-05-22 19:36:31.000000000 -0400
26557 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev,
26558 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
26559
26560 // VC layer stats
26561 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26562 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26563
26564 // free the descriptor
26565 kfree (tx_descr);
26566 @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev,
26567 dump_skb ("<<<", vc, skb);
26568
26569 // VC layer stats
26570 - atomic_inc(&atm_vcc->stats->rx);
26571 + atomic_inc_unchecked(&atm_vcc->stats->rx);
26572 __net_timestamp(skb);
26573 // end of our responsibility
26574 atm_vcc->push (atm_vcc, skb);
26575 @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev,
26576 } else {
26577 PRINTK (KERN_INFO, "dropped over-size frame");
26578 // should we count this?
26579 - atomic_inc(&atm_vcc->stats->rx_drop);
26580 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26581 }
26582
26583 } else {
26584 @@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at
26585 }
26586
26587 if (check_area (skb->data, skb->len)) {
26588 - atomic_inc(&atm_vcc->stats->tx_err);
26589 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
26590 return -ENOMEM; // ?
26591 }
26592
26593 diff -urNp linux-2.6.39.1/drivers/atm/atmtcp.c linux-2.6.39.1/drivers/atm/atmtcp.c
26594 --- linux-2.6.39.1/drivers/atm/atmtcp.c 2011-05-19 00:06:34.000000000 -0400
26595 +++ linux-2.6.39.1/drivers/atm/atmtcp.c 2011-05-22 19:36:31.000000000 -0400
26596 @@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc
26597 if (vcc->pop) vcc->pop(vcc,skb);
26598 else dev_kfree_skb(skb);
26599 if (dev_data) return 0;
26600 - atomic_inc(&vcc->stats->tx_err);
26601 + atomic_inc_unchecked(&vcc->stats->tx_err);
26602 return -ENOLINK;
26603 }
26604 size = skb->len+sizeof(struct atmtcp_hdr);
26605 @@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc
26606 if (!new_skb) {
26607 if (vcc->pop) vcc->pop(vcc,skb);
26608 else dev_kfree_skb(skb);
26609 - atomic_inc(&vcc->stats->tx_err);
26610 + atomic_inc_unchecked(&vcc->stats->tx_err);
26611 return -ENOBUFS;
26612 }
26613 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
26614 @@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc
26615 if (vcc->pop) vcc->pop(vcc,skb);
26616 else dev_kfree_skb(skb);
26617 out_vcc->push(out_vcc,new_skb);
26618 - atomic_inc(&vcc->stats->tx);
26619 - atomic_inc(&out_vcc->stats->rx);
26620 + atomic_inc_unchecked(&vcc->stats->tx);
26621 + atomic_inc_unchecked(&out_vcc->stats->rx);
26622 return 0;
26623 }
26624
26625 @@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc
26626 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
26627 read_unlock(&vcc_sklist_lock);
26628 if (!out_vcc) {
26629 - atomic_inc(&vcc->stats->tx_err);
26630 + atomic_inc_unchecked(&vcc->stats->tx_err);
26631 goto done;
26632 }
26633 skb_pull(skb,sizeof(struct atmtcp_hdr));
26634 @@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc
26635 __net_timestamp(new_skb);
26636 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
26637 out_vcc->push(out_vcc,new_skb);
26638 - atomic_inc(&vcc->stats->tx);
26639 - atomic_inc(&out_vcc->stats->rx);
26640 + atomic_inc_unchecked(&vcc->stats->tx);
26641 + atomic_inc_unchecked(&out_vcc->stats->rx);
26642 done:
26643 if (vcc->pop) vcc->pop(vcc,skb);
26644 else dev_kfree_skb(skb);
26645 diff -urNp linux-2.6.39.1/drivers/atm/eni.c linux-2.6.39.1/drivers/atm/eni.c
26646 --- linux-2.6.39.1/drivers/atm/eni.c 2011-05-19 00:06:34.000000000 -0400
26647 +++ linux-2.6.39.1/drivers/atm/eni.c 2011-05-22 19:36:31.000000000 -0400
26648 @@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
26649 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
26650 vcc->dev->number);
26651 length = 0;
26652 - atomic_inc(&vcc->stats->rx_err);
26653 + atomic_inc_unchecked(&vcc->stats->rx_err);
26654 }
26655 else {
26656 length = ATM_CELL_SIZE-1; /* no HEC */
26657 @@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26658 size);
26659 }
26660 eff = length = 0;
26661 - atomic_inc(&vcc->stats->rx_err);
26662 + atomic_inc_unchecked(&vcc->stats->rx_err);
26663 }
26664 else {
26665 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
26666 @@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26667 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
26668 vcc->dev->number,vcc->vci,length,size << 2,descr);
26669 length = eff = 0;
26670 - atomic_inc(&vcc->stats->rx_err);
26671 + atomic_inc_unchecked(&vcc->stats->rx_err);
26672 }
26673 }
26674 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
26675 @@ -771,7 +771,7 @@ rx_dequeued++;
26676 vcc->push(vcc,skb);
26677 pushed++;
26678 }
26679 - atomic_inc(&vcc->stats->rx);
26680 + atomic_inc_unchecked(&vcc->stats->rx);
26681 }
26682 wake_up(&eni_dev->rx_wait);
26683 }
26684 @@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d
26685 PCI_DMA_TODEVICE);
26686 if (vcc->pop) vcc->pop(vcc,skb);
26687 else dev_kfree_skb_irq(skb);
26688 - atomic_inc(&vcc->stats->tx);
26689 + atomic_inc_unchecked(&vcc->stats->tx);
26690 wake_up(&eni_dev->tx_wait);
26691 dma_complete++;
26692 }
26693 diff -urNp linux-2.6.39.1/drivers/atm/firestream.c linux-2.6.39.1/drivers/atm/firestream.c
26694 --- linux-2.6.39.1/drivers/atm/firestream.c 2011-05-19 00:06:34.000000000 -0400
26695 +++ linux-2.6.39.1/drivers/atm/firestream.c 2011-05-22 19:36:31.000000000 -0400
26696 @@ -749,7 +749,7 @@ static void process_txdone_queue (struct
26697 }
26698 }
26699
26700 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26701 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26702
26703 fs_dprintk (FS_DEBUG_TXMEM, "i");
26704 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
26705 @@ -816,7 +816,7 @@ static void process_incoming (struct fs_
26706 #endif
26707 skb_put (skb, qe->p1 & 0xffff);
26708 ATM_SKB(skb)->vcc = atm_vcc;
26709 - atomic_inc(&atm_vcc->stats->rx);
26710 + atomic_inc_unchecked(&atm_vcc->stats->rx);
26711 __net_timestamp(skb);
26712 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
26713 atm_vcc->push (atm_vcc, skb);
26714 @@ -837,12 +837,12 @@ static void process_incoming (struct fs_
26715 kfree (pe);
26716 }
26717 if (atm_vcc)
26718 - atomic_inc(&atm_vcc->stats->rx_drop);
26719 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26720 break;
26721 case 0x1f: /* Reassembly abort: no buffers. */
26722 /* Silently increment error counter. */
26723 if (atm_vcc)
26724 - atomic_inc(&atm_vcc->stats->rx_drop);
26725 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26726 break;
26727 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
26728 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
26729 diff -urNp linux-2.6.39.1/drivers/atm/fore200e.c linux-2.6.39.1/drivers/atm/fore200e.c
26730 --- linux-2.6.39.1/drivers/atm/fore200e.c 2011-05-19 00:06:34.000000000 -0400
26731 +++ linux-2.6.39.1/drivers/atm/fore200e.c 2011-05-22 19:36:31.000000000 -0400
26732 @@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
26733 #endif
26734 /* check error condition */
26735 if (*entry->status & STATUS_ERROR)
26736 - atomic_inc(&vcc->stats->tx_err);
26737 + atomic_inc_unchecked(&vcc->stats->tx_err);
26738 else
26739 - atomic_inc(&vcc->stats->tx);
26740 + atomic_inc_unchecked(&vcc->stats->tx);
26741 }
26742 }
26743
26744 @@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2
26745 if (skb == NULL) {
26746 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
26747
26748 - atomic_inc(&vcc->stats->rx_drop);
26749 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26750 return -ENOMEM;
26751 }
26752
26753 @@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2
26754
26755 dev_kfree_skb_any(skb);
26756
26757 - atomic_inc(&vcc->stats->rx_drop);
26758 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26759 return -ENOMEM;
26760 }
26761
26762 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26763
26764 vcc->push(vcc, skb);
26765 - atomic_inc(&vcc->stats->rx);
26766 + atomic_inc_unchecked(&vcc->stats->rx);
26767
26768 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26769
26770 @@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200
26771 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
26772 fore200e->atm_dev->number,
26773 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
26774 - atomic_inc(&vcc->stats->rx_err);
26775 + atomic_inc_unchecked(&vcc->stats->rx_err);
26776 }
26777 }
26778
26779 @@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc
26780 goto retry_here;
26781 }
26782
26783 - atomic_inc(&vcc->stats->tx_err);
26784 + atomic_inc_unchecked(&vcc->stats->tx_err);
26785
26786 fore200e->tx_sat++;
26787 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
26788 diff -urNp linux-2.6.39.1/drivers/atm/he.c linux-2.6.39.1/drivers/atm/he.c
26789 --- linux-2.6.39.1/drivers/atm/he.c 2011-05-19 00:06:34.000000000 -0400
26790 +++ linux-2.6.39.1/drivers/atm/he.c 2011-05-22 19:36:31.000000000 -0400
26791 @@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26792
26793 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
26794 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
26795 - atomic_inc(&vcc->stats->rx_drop);
26796 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26797 goto return_host_buffers;
26798 }
26799
26800 @@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26801 RBRQ_LEN_ERR(he_dev->rbrq_head)
26802 ? "LEN_ERR" : "",
26803 vcc->vpi, vcc->vci);
26804 - atomic_inc(&vcc->stats->rx_err);
26805 + atomic_inc_unchecked(&vcc->stats->rx_err);
26806 goto return_host_buffers;
26807 }
26808
26809 @@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26810 vcc->push(vcc, skb);
26811 spin_lock(&he_dev->global_lock);
26812
26813 - atomic_inc(&vcc->stats->rx);
26814 + atomic_inc_unchecked(&vcc->stats->rx);
26815
26816 return_host_buffers:
26817 ++pdus_assembled;
26818 @@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
26819 tpd->vcc->pop(tpd->vcc, tpd->skb);
26820 else
26821 dev_kfree_skb_any(tpd->skb);
26822 - atomic_inc(&tpd->vcc->stats->tx_err);
26823 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
26824 }
26825 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
26826 return;
26827 @@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26828 vcc->pop(vcc, skb);
26829 else
26830 dev_kfree_skb_any(skb);
26831 - atomic_inc(&vcc->stats->tx_err);
26832 + atomic_inc_unchecked(&vcc->stats->tx_err);
26833 return -EINVAL;
26834 }
26835
26836 @@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26837 vcc->pop(vcc, skb);
26838 else
26839 dev_kfree_skb_any(skb);
26840 - atomic_inc(&vcc->stats->tx_err);
26841 + atomic_inc_unchecked(&vcc->stats->tx_err);
26842 return -EINVAL;
26843 }
26844 #endif
26845 @@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26846 vcc->pop(vcc, skb);
26847 else
26848 dev_kfree_skb_any(skb);
26849 - atomic_inc(&vcc->stats->tx_err);
26850 + atomic_inc_unchecked(&vcc->stats->tx_err);
26851 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26852 return -ENOMEM;
26853 }
26854 @@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26855 vcc->pop(vcc, skb);
26856 else
26857 dev_kfree_skb_any(skb);
26858 - atomic_inc(&vcc->stats->tx_err);
26859 + atomic_inc_unchecked(&vcc->stats->tx_err);
26860 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26861 return -ENOMEM;
26862 }
26863 @@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26864 __enqueue_tpd(he_dev, tpd, cid);
26865 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26866
26867 - atomic_inc(&vcc->stats->tx);
26868 + atomic_inc_unchecked(&vcc->stats->tx);
26869
26870 return 0;
26871 }
26872 diff -urNp linux-2.6.39.1/drivers/atm/horizon.c linux-2.6.39.1/drivers/atm/horizon.c
26873 --- linux-2.6.39.1/drivers/atm/horizon.c 2011-05-19 00:06:34.000000000 -0400
26874 +++ linux-2.6.39.1/drivers/atm/horizon.c 2011-05-22 19:36:31.000000000 -0400
26875 @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev,
26876 {
26877 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
26878 // VC layer stats
26879 - atomic_inc(&vcc->stats->rx);
26880 + atomic_inc_unchecked(&vcc->stats->rx);
26881 __net_timestamp(skb);
26882 // end of our responsibility
26883 vcc->push (vcc, skb);
26884 @@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const
26885 dev->tx_iovec = NULL;
26886
26887 // VC layer stats
26888 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26889 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26890
26891 // free the skb
26892 hrz_kfree_skb (skb);
26893 diff -urNp linux-2.6.39.1/drivers/atm/idt77252.c linux-2.6.39.1/drivers/atm/idt77252.c
26894 --- linux-2.6.39.1/drivers/atm/idt77252.c 2011-05-19 00:06:34.000000000 -0400
26895 +++ linux-2.6.39.1/drivers/atm/idt77252.c 2011-05-22 19:36:31.000000000 -0400
26896 @@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
26897 else
26898 dev_kfree_skb(skb);
26899
26900 - atomic_inc(&vcc->stats->tx);
26901 + atomic_inc_unchecked(&vcc->stats->tx);
26902 }
26903
26904 atomic_dec(&scq->used);
26905 @@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st
26906 if ((sb = dev_alloc_skb(64)) == NULL) {
26907 printk("%s: Can't allocate buffers for aal0.\n",
26908 card->name);
26909 - atomic_add(i, &vcc->stats->rx_drop);
26910 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
26911 break;
26912 }
26913 if (!atm_charge(vcc, sb->truesize)) {
26914 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
26915 card->name);
26916 - atomic_add(i - 1, &vcc->stats->rx_drop);
26917 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
26918 dev_kfree_skb(sb);
26919 break;
26920 }
26921 @@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st
26922 ATM_SKB(sb)->vcc = vcc;
26923 __net_timestamp(sb);
26924 vcc->push(vcc, sb);
26925 - atomic_inc(&vcc->stats->rx);
26926 + atomic_inc_unchecked(&vcc->stats->rx);
26927
26928 cell += ATM_CELL_PAYLOAD;
26929 }
26930 @@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st
26931 "(CDC: %08x)\n",
26932 card->name, len, rpp->len, readl(SAR_REG_CDC));
26933 recycle_rx_pool_skb(card, rpp);
26934 - atomic_inc(&vcc->stats->rx_err);
26935 + atomic_inc_unchecked(&vcc->stats->rx_err);
26936 return;
26937 }
26938 if (stat & SAR_RSQE_CRC) {
26939 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
26940 recycle_rx_pool_skb(card, rpp);
26941 - atomic_inc(&vcc->stats->rx_err);
26942 + atomic_inc_unchecked(&vcc->stats->rx_err);
26943 return;
26944 }
26945 if (skb_queue_len(&rpp->queue) > 1) {
26946 @@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st
26947 RXPRINTK("%s: Can't alloc RX skb.\n",
26948 card->name);
26949 recycle_rx_pool_skb(card, rpp);
26950 - atomic_inc(&vcc->stats->rx_err);
26951 + atomic_inc_unchecked(&vcc->stats->rx_err);
26952 return;
26953 }
26954 if (!atm_charge(vcc, skb->truesize)) {
26955 @@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st
26956 __net_timestamp(skb);
26957
26958 vcc->push(vcc, skb);
26959 - atomic_inc(&vcc->stats->rx);
26960 + atomic_inc_unchecked(&vcc->stats->rx);
26961
26962 return;
26963 }
26964 @@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st
26965 __net_timestamp(skb);
26966
26967 vcc->push(vcc, skb);
26968 - atomic_inc(&vcc->stats->rx);
26969 + atomic_inc_unchecked(&vcc->stats->rx);
26970
26971 if (skb->truesize > SAR_FB_SIZE_3)
26972 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
26973 @@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *car
26974 if (vcc->qos.aal != ATM_AAL0) {
26975 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
26976 card->name, vpi, vci);
26977 - atomic_inc(&vcc->stats->rx_drop);
26978 + atomic_inc_unchecked(&vcc->stats->rx_drop);
26979 goto drop;
26980 }
26981
26982 if ((sb = dev_alloc_skb(64)) == NULL) {
26983 printk("%s: Can't allocate buffers for AAL0.\n",
26984 card->name);
26985 - atomic_inc(&vcc->stats->rx_err);
26986 + atomic_inc_unchecked(&vcc->stats->rx_err);
26987 goto drop;
26988 }
26989
26990 @@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *car
26991 ATM_SKB(sb)->vcc = vcc;
26992 __net_timestamp(sb);
26993 vcc->push(vcc, sb);
26994 - atomic_inc(&vcc->stats->rx);
26995 + atomic_inc_unchecked(&vcc->stats->rx);
26996
26997 drop:
26998 skb_pull(queue, 64);
26999 @@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27000
27001 if (vc == NULL) {
27002 printk("%s: NULL connection in send().\n", card->name);
27003 - atomic_inc(&vcc->stats->tx_err);
27004 + atomic_inc_unchecked(&vcc->stats->tx_err);
27005 dev_kfree_skb(skb);
27006 return -EINVAL;
27007 }
27008 if (!test_bit(VCF_TX, &vc->flags)) {
27009 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
27010 - atomic_inc(&vcc->stats->tx_err);
27011 + atomic_inc_unchecked(&vcc->stats->tx_err);
27012 dev_kfree_skb(skb);
27013 return -EINVAL;
27014 }
27015 @@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27016 break;
27017 default:
27018 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
27019 - atomic_inc(&vcc->stats->tx_err);
27020 + atomic_inc_unchecked(&vcc->stats->tx_err);
27021 dev_kfree_skb(skb);
27022 return -EINVAL;
27023 }
27024
27025 if (skb_shinfo(skb)->nr_frags != 0) {
27026 printk("%s: No scatter-gather yet.\n", card->name);
27027 - atomic_inc(&vcc->stats->tx_err);
27028 + atomic_inc_unchecked(&vcc->stats->tx_err);
27029 dev_kfree_skb(skb);
27030 return -EINVAL;
27031 }
27032 @@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27033
27034 err = queue_skb(card, vc, skb, oam);
27035 if (err) {
27036 - atomic_inc(&vcc->stats->tx_err);
27037 + atomic_inc_unchecked(&vcc->stats->tx_err);
27038 dev_kfree_skb(skb);
27039 return err;
27040 }
27041 @@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
27042 skb = dev_alloc_skb(64);
27043 if (!skb) {
27044 printk("%s: Out of memory in send_oam().\n", card->name);
27045 - atomic_inc(&vcc->stats->tx_err);
27046 + atomic_inc_unchecked(&vcc->stats->tx_err);
27047 return -ENOMEM;
27048 }
27049 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
27050 diff -urNp linux-2.6.39.1/drivers/atm/iphase.c linux-2.6.39.1/drivers/atm/iphase.c
27051 --- linux-2.6.39.1/drivers/atm/iphase.c 2011-05-19 00:06:34.000000000 -0400
27052 +++ linux-2.6.39.1/drivers/atm/iphase.c 2011-05-22 19:36:31.000000000 -0400
27053 @@ -1124,7 +1124,7 @@ static int rx_pkt(struct atm_dev *dev)
27054 status = (u_short) (buf_desc_ptr->desc_mode);
27055 if (status & (RX_CER | RX_PTE | RX_OFL))
27056 {
27057 - atomic_inc(&vcc->stats->rx_err);
27058 + atomic_inc_unchecked(&vcc->stats->rx_err);
27059 IF_ERR(printk("IA: bad packet, dropping it");)
27060 if (status & RX_CER) {
27061 IF_ERR(printk(" cause: packet CRC error\n");)
27062 @@ -1147,7 +1147,7 @@ static int rx_pkt(struct atm_dev *dev)
27063 len = dma_addr - buf_addr;
27064 if (len > iadev->rx_buf_sz) {
27065 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
27066 - atomic_inc(&vcc->stats->rx_err);
27067 + atomic_inc_unchecked(&vcc->stats->rx_err);
27068 goto out_free_desc;
27069 }
27070
27071 @@ -1297,7 +1297,7 @@ static void rx_dle_intr(struct atm_dev *
27072 ia_vcc = INPH_IA_VCC(vcc);
27073 if (ia_vcc == NULL)
27074 {
27075 - atomic_inc(&vcc->stats->rx_err);
27076 + atomic_inc_unchecked(&vcc->stats->rx_err);
27077 dev_kfree_skb_any(skb);
27078 atm_return(vcc, atm_guess_pdu2truesize(len));
27079 goto INCR_DLE;
27080 @@ -1309,7 +1309,7 @@ static void rx_dle_intr(struct atm_dev *
27081 if ((length > iadev->rx_buf_sz) || (length >
27082 (skb->len - sizeof(struct cpcs_trailer))))
27083 {
27084 - atomic_inc(&vcc->stats->rx_err);
27085 + atomic_inc_unchecked(&vcc->stats->rx_err);
27086 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
27087 length, skb->len);)
27088 dev_kfree_skb_any(skb);
27089 @@ -1325,7 +1325,7 @@ static void rx_dle_intr(struct atm_dev *
27090
27091 IF_RX(printk("rx_dle_intr: skb push");)
27092 vcc->push(vcc,skb);
27093 - atomic_inc(&vcc->stats->rx);
27094 + atomic_inc_unchecked(&vcc->stats->rx);
27095 iadev->rx_pkt_cnt++;
27096 }
27097 INCR_DLE:
27098 @@ -2807,15 +2807,15 @@ static int ia_ioctl(struct atm_dev *dev,
27099 {
27100 struct k_sonet_stats *stats;
27101 stats = &PRIV(_ia_dev[board])->sonet_stats;
27102 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
27103 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
27104 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
27105 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
27106 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
27107 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
27108 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
27109 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
27110 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
27111 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
27112 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
27113 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
27114 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
27115 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
27116 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
27117 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
27118 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
27119 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
27120 }
27121 ia_cmds.status = 0;
27122 break;
27123 @@ -2920,7 +2920,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
27124 if ((desc == 0) || (desc > iadev->num_tx_desc))
27125 {
27126 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
27127 - atomic_inc(&vcc->stats->tx);
27128 + atomic_inc_unchecked(&vcc->stats->tx);
27129 if (vcc->pop)
27130 vcc->pop(vcc, skb);
27131 else
27132 @@ -3025,14 +3025,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
27133 ATM_DESC(skb) = vcc->vci;
27134 skb_queue_tail(&iadev->tx_dma_q, skb);
27135
27136 - atomic_inc(&vcc->stats->tx);
27137 + atomic_inc_unchecked(&vcc->stats->tx);
27138 iadev->tx_pkt_cnt++;
27139 /* Increment transaction counter */
27140 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
27141
27142 #if 0
27143 /* add flow control logic */
27144 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
27145 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
27146 if (iavcc->vc_desc_cnt > 10) {
27147 vcc->tx_quota = vcc->tx_quota * 3 / 4;
27148 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
27149 diff -urNp linux-2.6.39.1/drivers/atm/lanai.c linux-2.6.39.1/drivers/atm/lanai.c
27150 --- linux-2.6.39.1/drivers/atm/lanai.c 2011-05-19 00:06:34.000000000 -0400
27151 +++ linux-2.6.39.1/drivers/atm/lanai.c 2011-05-22 19:36:31.000000000 -0400
27152 @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
27153 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
27154 lanai_endtx(lanai, lvcc);
27155 lanai_free_skb(lvcc->tx.atmvcc, skb);
27156 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
27157 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
27158 }
27159
27160 /* Try to fill the buffer - don't call unless there is backlog */
27161 @@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc
27162 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
27163 __net_timestamp(skb);
27164 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
27165 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
27166 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
27167 out:
27168 lvcc->rx.buf.ptr = end;
27169 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
27170 @@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d
27171 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
27172 "vcc %d\n", lanai->number, (unsigned int) s, vci);
27173 lanai->stats.service_rxnotaal5++;
27174 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27175 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27176 return 0;
27177 }
27178 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
27179 @@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d
27180 int bytes;
27181 read_unlock(&vcc_sklist_lock);
27182 DPRINTK("got trashed rx pdu on vci %d\n", vci);
27183 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27184 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27185 lvcc->stats.x.aal5.service_trash++;
27186 bytes = (SERVICE_GET_END(s) * 16) -
27187 (((unsigned long) lvcc->rx.buf.ptr) -
27188 @@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d
27189 }
27190 if (s & SERVICE_STREAM) {
27191 read_unlock(&vcc_sklist_lock);
27192 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27193 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27194 lvcc->stats.x.aal5.service_stream++;
27195 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
27196 "PDU on VCI %d!\n", lanai->number, vci);
27197 @@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d
27198 return 0;
27199 }
27200 DPRINTK("got rx crc error on vci %d\n", vci);
27201 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27202 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27203 lvcc->stats.x.aal5.service_rxcrc++;
27204 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
27205 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
27206 diff -urNp linux-2.6.39.1/drivers/atm/nicstar.c linux-2.6.39.1/drivers/atm/nicstar.c
27207 --- linux-2.6.39.1/drivers/atm/nicstar.c 2011-05-19 00:06:34.000000000 -0400
27208 +++ linux-2.6.39.1/drivers/atm/nicstar.c 2011-05-22 19:36:31.000000000 -0400
27209 @@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc,
27210 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
27211 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
27212 card->index);
27213 - atomic_inc(&vcc->stats->tx_err);
27214 + atomic_inc_unchecked(&vcc->stats->tx_err);
27215 dev_kfree_skb_any(skb);
27216 return -EINVAL;
27217 }
27218 @@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc,
27219 if (!vc->tx) {
27220 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
27221 card->index);
27222 - atomic_inc(&vcc->stats->tx_err);
27223 + atomic_inc_unchecked(&vcc->stats->tx_err);
27224 dev_kfree_skb_any(skb);
27225 return -EINVAL;
27226 }
27227 @@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc,
27228 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
27229 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
27230 card->index);
27231 - atomic_inc(&vcc->stats->tx_err);
27232 + atomic_inc_unchecked(&vcc->stats->tx_err);
27233 dev_kfree_skb_any(skb);
27234 return -EINVAL;
27235 }
27236
27237 if (skb_shinfo(skb)->nr_frags != 0) {
27238 printk("nicstar%d: No scatter-gather yet.\n", card->index);
27239 - atomic_inc(&vcc->stats->tx_err);
27240 + atomic_inc_unchecked(&vcc->stats->tx_err);
27241 dev_kfree_skb_any(skb);
27242 return -EINVAL;
27243 }
27244 @@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc,
27245 }
27246
27247 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
27248 - atomic_inc(&vcc->stats->tx_err);
27249 + atomic_inc_unchecked(&vcc->stats->tx_err);
27250 dev_kfree_skb_any(skb);
27251 return -EIO;
27252 }
27253 - atomic_inc(&vcc->stats->tx);
27254 + atomic_inc_unchecked(&vcc->stats->tx);
27255
27256 return 0;
27257 }
27258 @@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns
27259 printk
27260 ("nicstar%d: Can't allocate buffers for aal0.\n",
27261 card->index);
27262 - atomic_add(i, &vcc->stats->rx_drop);
27263 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
27264 break;
27265 }
27266 if (!atm_charge(vcc, sb->truesize)) {
27267 RXPRINTK
27268 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
27269 card->index);
27270 - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27271 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27272 dev_kfree_skb_any(sb);
27273 break;
27274 }
27275 @@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns
27276 ATM_SKB(sb)->vcc = vcc;
27277 __net_timestamp(sb);
27278 vcc->push(vcc, sb);
27279 - atomic_inc(&vcc->stats->rx);
27280 + atomic_inc_unchecked(&vcc->stats->rx);
27281 cell += ATM_CELL_PAYLOAD;
27282 }
27283
27284 @@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns
27285 if (iovb == NULL) {
27286 printk("nicstar%d: Out of iovec buffers.\n",
27287 card->index);
27288 - atomic_inc(&vcc->stats->rx_drop);
27289 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27290 recycle_rx_buf(card, skb);
27291 return;
27292 }
27293 @@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns
27294 small or large buffer itself. */
27295 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
27296 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
27297 - atomic_inc(&vcc->stats->rx_err);
27298 + atomic_inc_unchecked(&vcc->stats->rx_err);
27299 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27300 NS_MAX_IOVECS);
27301 NS_PRV_IOVCNT(iovb) = 0;
27302 @@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns
27303 ("nicstar%d: Expected a small buffer, and this is not one.\n",
27304 card->index);
27305 which_list(card, skb);
27306 - atomic_inc(&vcc->stats->rx_err);
27307 + atomic_inc_unchecked(&vcc->stats->rx_err);
27308 recycle_rx_buf(card, skb);
27309 vc->rx_iov = NULL;
27310 recycle_iov_buf(card, iovb);
27311 @@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns
27312 ("nicstar%d: Expected a large buffer, and this is not one.\n",
27313 card->index);
27314 which_list(card, skb);
27315 - atomic_inc(&vcc->stats->rx_err);
27316 + atomic_inc_unchecked(&vcc->stats->rx_err);
27317 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27318 NS_PRV_IOVCNT(iovb));
27319 vc->rx_iov = NULL;
27320 @@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns
27321 printk(" - PDU size mismatch.\n");
27322 else
27323 printk(".\n");
27324 - atomic_inc(&vcc->stats->rx_err);
27325 + atomic_inc_unchecked(&vcc->stats->rx_err);
27326 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27327 NS_PRV_IOVCNT(iovb));
27328 vc->rx_iov = NULL;
27329 @@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns
27330 /* skb points to a small buffer */
27331 if (!atm_charge(vcc, skb->truesize)) {
27332 push_rxbufs(card, skb);
27333 - atomic_inc(&vcc->stats->rx_drop);
27334 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27335 } else {
27336 skb_put(skb, len);
27337 dequeue_sm_buf(card, skb);
27338 @@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns
27339 ATM_SKB(skb)->vcc = vcc;
27340 __net_timestamp(skb);
27341 vcc->push(vcc, skb);
27342 - atomic_inc(&vcc->stats->rx);
27343 + atomic_inc_unchecked(&vcc->stats->rx);
27344 }
27345 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
27346 struct sk_buff *sb;
27347 @@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns
27348 if (len <= NS_SMBUFSIZE) {
27349 if (!atm_charge(vcc, sb->truesize)) {
27350 push_rxbufs(card, sb);
27351 - atomic_inc(&vcc->stats->rx_drop);
27352 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27353 } else {
27354 skb_put(sb, len);
27355 dequeue_sm_buf(card, sb);
27356 @@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns
27357 ATM_SKB(sb)->vcc = vcc;
27358 __net_timestamp(sb);
27359 vcc->push(vcc, sb);
27360 - atomic_inc(&vcc->stats->rx);
27361 + atomic_inc_unchecked(&vcc->stats->rx);
27362 }
27363
27364 push_rxbufs(card, skb);
27365 @@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns
27366
27367 if (!atm_charge(vcc, skb->truesize)) {
27368 push_rxbufs(card, skb);
27369 - atomic_inc(&vcc->stats->rx_drop);
27370 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27371 } else {
27372 dequeue_lg_buf(card, skb);
27373 #ifdef NS_USE_DESTRUCTORS
27374 @@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns
27375 ATM_SKB(skb)->vcc = vcc;
27376 __net_timestamp(skb);
27377 vcc->push(vcc, skb);
27378 - atomic_inc(&vcc->stats->rx);
27379 + atomic_inc_unchecked(&vcc->stats->rx);
27380 }
27381
27382 push_rxbufs(card, sb);
27383 @@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns
27384 printk
27385 ("nicstar%d: Out of huge buffers.\n",
27386 card->index);
27387 - atomic_inc(&vcc->stats->rx_drop);
27388 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27389 recycle_iovec_rx_bufs(card,
27390 (struct iovec *)
27391 iovb->data,
27392 @@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns
27393 card->hbpool.count++;
27394 } else
27395 dev_kfree_skb_any(hb);
27396 - atomic_inc(&vcc->stats->rx_drop);
27397 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27398 } else {
27399 /* Copy the small buffer to the huge buffer */
27400 sb = (struct sk_buff *)iov->iov_base;
27401 @@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns
27402 #endif /* NS_USE_DESTRUCTORS */
27403 __net_timestamp(hb);
27404 vcc->push(vcc, hb);
27405 - atomic_inc(&vcc->stats->rx);
27406 + atomic_inc_unchecked(&vcc->stats->rx);
27407 }
27408 }
27409
27410 diff -urNp linux-2.6.39.1/drivers/atm/solos-pci.c linux-2.6.39.1/drivers/atm/solos-pci.c
27411 --- linux-2.6.39.1/drivers/atm/solos-pci.c 2011-05-19 00:06:34.000000000 -0400
27412 +++ linux-2.6.39.1/drivers/atm/solos-pci.c 2011-05-22 19:36:31.000000000 -0400
27413 @@ -715,7 +715,7 @@ void solos_bh(unsigned long card_arg)
27414 }
27415 atm_charge(vcc, skb->truesize);
27416 vcc->push(vcc, skb);
27417 - atomic_inc(&vcc->stats->rx);
27418 + atomic_inc_unchecked(&vcc->stats->rx);
27419 break;
27420
27421 case PKT_STATUS:
27422 @@ -900,6 +900,8 @@ static int print_buffer(struct sk_buff *
27423 char msg[500];
27424 char item[10];
27425
27426 + pax_track_stack();
27427 +
27428 len = buf->len;
27429 for (i = 0; i < len; i++){
27430 if(i % 8 == 0)
27431 @@ -1009,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
27432 vcc = SKB_CB(oldskb)->vcc;
27433
27434 if (vcc) {
27435 - atomic_inc(&vcc->stats->tx);
27436 + atomic_inc_unchecked(&vcc->stats->tx);
27437 solos_pop(vcc, oldskb);
27438 } else
27439 dev_kfree_skb_irq(oldskb);
27440 diff -urNp linux-2.6.39.1/drivers/atm/suni.c linux-2.6.39.1/drivers/atm/suni.c
27441 --- linux-2.6.39.1/drivers/atm/suni.c 2011-05-19 00:06:34.000000000 -0400
27442 +++ linux-2.6.39.1/drivers/atm/suni.c 2011-05-22 19:36:31.000000000 -0400
27443 @@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
27444
27445
27446 #define ADD_LIMITED(s,v) \
27447 - atomic_add((v),&stats->s); \
27448 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
27449 + atomic_add_unchecked((v),&stats->s); \
27450 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
27451
27452
27453 static void suni_hz(unsigned long from_timer)
27454 diff -urNp linux-2.6.39.1/drivers/atm/uPD98402.c linux-2.6.39.1/drivers/atm/uPD98402.c
27455 --- linux-2.6.39.1/drivers/atm/uPD98402.c 2011-05-19 00:06:34.000000000 -0400
27456 +++ linux-2.6.39.1/drivers/atm/uPD98402.c 2011-05-22 19:36:31.000000000 -0400
27457 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
27458 struct sonet_stats tmp;
27459 int error = 0;
27460
27461 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27462 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27463 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
27464 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
27465 if (zero && !error) {
27466 @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev
27467
27468
27469 #define ADD_LIMITED(s,v) \
27470 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
27471 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
27472 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27473 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
27474 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
27475 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27476
27477
27478 static void stat_event(struct atm_dev *dev)
27479 @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev
27480 if (reason & uPD98402_INT_PFM) stat_event(dev);
27481 if (reason & uPD98402_INT_PCO) {
27482 (void) GET(PCOCR); /* clear interrupt cause */
27483 - atomic_add(GET(HECCT),
27484 + atomic_add_unchecked(GET(HECCT),
27485 &PRIV(dev)->sonet_stats.uncorr_hcs);
27486 }
27487 if ((reason & uPD98402_INT_RFO) &&
27488 @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev
27489 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
27490 uPD98402_INT_LOS),PIMR); /* enable them */
27491 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
27492 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27493 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
27494 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
27495 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27496 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
27497 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
27498 return 0;
27499 }
27500
27501 diff -urNp linux-2.6.39.1/drivers/atm/zatm.c linux-2.6.39.1/drivers/atm/zatm.c
27502 --- linux-2.6.39.1/drivers/atm/zatm.c 2011-05-19 00:06:34.000000000 -0400
27503 +++ linux-2.6.39.1/drivers/atm/zatm.c 2011-05-22 19:36:31.000000000 -0400
27504 @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27505 }
27506 if (!size) {
27507 dev_kfree_skb_irq(skb);
27508 - if (vcc) atomic_inc(&vcc->stats->rx_err);
27509 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
27510 continue;
27511 }
27512 if (!atm_charge(vcc,skb->truesize)) {
27513 @@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27514 skb->len = size;
27515 ATM_SKB(skb)->vcc = vcc;
27516 vcc->push(vcc,skb);
27517 - atomic_inc(&vcc->stats->rx);
27518 + atomic_inc_unchecked(&vcc->stats->rx);
27519 }
27520 zout(pos & 0xffff,MTA(mbx));
27521 #if 0 /* probably a stupid idea */
27522 @@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
27523 skb_queue_head(&zatm_vcc->backlog,skb);
27524 break;
27525 }
27526 - atomic_inc(&vcc->stats->tx);
27527 + atomic_inc_unchecked(&vcc->stats->tx);
27528 wake_up(&zatm_vcc->tx_wait);
27529 }
27530
27531 diff -urNp linux-2.6.39.1/drivers/base/iommu.c linux-2.6.39.1/drivers/base/iommu.c
27532 --- linux-2.6.39.1/drivers/base/iommu.c 2011-05-19 00:06:34.000000000 -0400
27533 +++ linux-2.6.39.1/drivers/base/iommu.c 2011-05-22 19:36:31.000000000 -0400
27534 @@ -23,9 +23,8 @@
27535 #include <linux/errno.h>
27536 #include <linux/iommu.h>
27537
27538 -static struct iommu_ops *iommu_ops;
27539 -
27540 -void register_iommu(struct iommu_ops *ops)
27541 +static const struct iommu_ops *iommu_ops;
27542 +void register_iommu(const struct iommu_ops *ops)
27543 {
27544 if (iommu_ops)
27545 BUG();
27546 diff -urNp linux-2.6.39.1/drivers/base/power/generic_ops.c linux-2.6.39.1/drivers/base/power/generic_ops.c
27547 --- linux-2.6.39.1/drivers/base/power/generic_ops.c 2011-05-19 00:06:34.000000000 -0400
27548 +++ linux-2.6.39.1/drivers/base/power/generic_ops.c 2011-05-22 19:36:31.000000000 -0400
27549 @@ -215,7 +215,7 @@ int pm_generic_restore(struct device *de
27550 EXPORT_SYMBOL_GPL(pm_generic_restore);
27551 #endif /* CONFIG_PM_SLEEP */
27552
27553 -struct dev_pm_ops generic_subsys_pm_ops = {
27554 +const struct dev_pm_ops generic_subsys_pm_ops = {
27555 #ifdef CONFIG_PM_SLEEP
27556 .suspend = pm_generic_suspend,
27557 .resume = pm_generic_resume,
27558 diff -urNp linux-2.6.39.1/drivers/base/power/wakeup.c linux-2.6.39.1/drivers/base/power/wakeup.c
27559 --- linux-2.6.39.1/drivers/base/power/wakeup.c 2011-05-19 00:06:34.000000000 -0400
27560 +++ linux-2.6.39.1/drivers/base/power/wakeup.c 2011-05-22 19:36:31.000000000 -0400
27561 @@ -29,14 +29,14 @@ bool events_check_enabled;
27562 * They need to be modified together atomically, so it's better to use one
27563 * atomic variable to hold them both.
27564 */
27565 -static atomic_t combined_event_count = ATOMIC_INIT(0);
27566 +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
27567
27568 #define IN_PROGRESS_BITS (sizeof(int) * 4)
27569 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
27570
27571 static void split_counters(unsigned int *cnt, unsigned int *inpr)
27572 {
27573 - unsigned int comb = atomic_read(&combined_event_count);
27574 + unsigned int comb = atomic_read_unchecked(&combined_event_count);
27575
27576 *cnt = (comb >> IN_PROGRESS_BITS);
27577 *inpr = comb & MAX_IN_PROGRESS;
27578 @@ -351,7 +351,7 @@ static void wakeup_source_activate(struc
27579 ws->last_time = ktime_get();
27580
27581 /* Increment the counter of events in progress. */
27582 - atomic_inc(&combined_event_count);
27583 + atomic_inc_unchecked(&combined_event_count);
27584 }
27585
27586 /**
27587 @@ -441,7 +441,7 @@ static void wakeup_source_deactivate(str
27588 * Increment the counter of registered wakeup events and decrement the
27589 * couter of wakeup events in progress simultaneously.
27590 */
27591 - atomic_add(MAX_IN_PROGRESS, &combined_event_count);
27592 + atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
27593 }
27594
27595 /**
27596 diff -urNp linux-2.6.39.1/drivers/block/cciss.c linux-2.6.39.1/drivers/block/cciss.c
27597 --- linux-2.6.39.1/drivers/block/cciss.c 2011-05-19 00:06:34.000000000 -0400
27598 +++ linux-2.6.39.1/drivers/block/cciss.c 2011-05-22 19:41:32.000000000 -0400
27599 @@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_devic
27600 * product = Marketing Name for the board
27601 * access = Address of the struct of function pointers
27602 */
27603 -static struct board_type products[] = {
27604 +static const struct board_type products[] = {
27605 {0x40700E11, "Smart Array 5300", &SA5_access},
27606 {0x40800E11, "Smart Array 5i", &SA5B_access},
27607 {0x40820E11, "Smart Array 532", &SA5B_access},
27608 @@ -1151,6 +1151,8 @@ static int cciss_ioctl32_passthru(struct
27609 int err;
27610 u32 cp;
27611
27612 + memset(&arg64, 0, sizeof(arg64));
27613 +
27614 err = 0;
27615 err |=
27616 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
27617 diff -urNp linux-2.6.39.1/drivers/block/cciss.h linux-2.6.39.1/drivers/block/cciss.h
27618 --- linux-2.6.39.1/drivers/block/cciss.h 2011-05-19 00:06:34.000000000 -0400
27619 +++ linux-2.6.39.1/drivers/block/cciss.h 2011-05-22 19:36:31.000000000 -0400
27620 @@ -393,7 +393,7 @@ static bool SA5_performant_intr_pending(
27621 return register_value & SA5_OUTDB_STATUS_PERF_BIT;
27622 }
27623
27624 -static struct access_method SA5_access = {
27625 +static const struct access_method SA5_access = {
27626 SA5_submit_command,
27627 SA5_intr_mask,
27628 SA5_fifo_full,
27629 @@ -401,7 +401,7 @@ static struct access_method SA5_access =
27630 SA5_completed,
27631 };
27632
27633 -static struct access_method SA5B_access = {
27634 +static const struct access_method SA5B_access = {
27635 SA5_submit_command,
27636 SA5B_intr_mask,
27637 SA5_fifo_full,
27638 @@ -409,7 +409,7 @@ static struct access_method SA5B_access
27639 SA5_completed,
27640 };
27641
27642 -static struct access_method SA5_performant_access = {
27643 +static const struct access_method SA5_performant_access = {
27644 SA5_submit_command,
27645 SA5_performant_intr_mask,
27646 SA5_fifo_full,
27647 @@ -420,7 +420,7 @@ static struct access_method SA5_performa
27648 struct board_type {
27649 __u32 board_id;
27650 char *product_name;
27651 - struct access_method *access;
27652 + const struct access_method *access;
27653 int nr_cmds; /* Max cmds this kind of ctlr can handle. */
27654 };
27655
27656 diff -urNp linux-2.6.39.1/drivers/block/cpqarray.c linux-2.6.39.1/drivers/block/cpqarray.c
27657 --- linux-2.6.39.1/drivers/block/cpqarray.c 2011-05-19 00:06:34.000000000 -0400
27658 +++ linux-2.6.39.1/drivers/block/cpqarray.c 2011-05-22 19:36:31.000000000 -0400
27659 @@ -80,7 +80,7 @@ static int eisa[8];
27660 * product = Marketing Name for the board
27661 * access = Address of the struct of function pointers
27662 */
27663 -static struct board_type products[] = {
27664 +static const struct board_type products[] = {
27665 { 0x0040110E, "IDA", &smart1_access },
27666 { 0x0140110E, "IDA-2", &smart1_access },
27667 { 0x1040110E, "IAES", &smart1_access },
27668 @@ -911,6 +911,8 @@ static void do_ida_request(struct reques
27669 struct scatterlist tmp_sg[SG_MAX];
27670 int i, dir, seg;
27671
27672 + pax_track_stack();
27673 +
27674 queue_next:
27675 creq = blk_peek_request(q);
27676 if (!creq)
27677 diff -urNp linux-2.6.39.1/drivers/block/cpqarray.h linux-2.6.39.1/drivers/block/cpqarray.h
27678 --- linux-2.6.39.1/drivers/block/cpqarray.h 2011-05-19 00:06:34.000000000 -0400
27679 +++ linux-2.6.39.1/drivers/block/cpqarray.h 2011-05-22 19:36:31.000000000 -0400
27680 @@ -69,7 +69,7 @@ struct access_method {
27681 struct board_type {
27682 __u32 board_id;
27683 char *product_name;
27684 - struct access_method *access;
27685 + const struct access_method *access;
27686 };
27687
27688 struct ctlr_info {
27689 diff -urNp linux-2.6.39.1/drivers/block/DAC960.c linux-2.6.39.1/drivers/block/DAC960.c
27690 --- linux-2.6.39.1/drivers/block/DAC960.c 2011-05-19 00:06:34.000000000 -0400
27691 +++ linux-2.6.39.1/drivers/block/DAC960.c 2011-05-22 19:36:31.000000000 -0400
27692 @@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur
27693 unsigned long flags;
27694 int Channel, TargetID;
27695
27696 + pax_track_stack();
27697 +
27698 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
27699 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
27700 sizeof(DAC960_SCSI_Inquiry_T) +
27701 diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_int.h linux-2.6.39.1/drivers/block/drbd/drbd_int.h
27702 --- linux-2.6.39.1/drivers/block/drbd/drbd_int.h 2011-05-19 00:06:34.000000000 -0400
27703 +++ linux-2.6.39.1/drivers/block/drbd/drbd_int.h 2011-05-22 19:36:31.000000000 -0400
27704 @@ -736,7 +736,7 @@ struct drbd_request;
27705 struct drbd_epoch {
27706 struct list_head list;
27707 unsigned int barrier_nr;
27708 - atomic_t epoch_size; /* increased on every request added. */
27709 + atomic_unchecked_t epoch_size; /* increased on every request added. */
27710 atomic_t active; /* increased on every req. added, and dec on every finished. */
27711 unsigned long flags;
27712 };
27713 @@ -1108,7 +1108,7 @@ struct drbd_conf {
27714 void *int_dig_in;
27715 void *int_dig_vv;
27716 wait_queue_head_t seq_wait;
27717 - atomic_t packet_seq;
27718 + atomic_unchecked_t packet_seq;
27719 unsigned int peer_seq;
27720 spinlock_t peer_seq_lock;
27721 unsigned int minor;
27722 diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_main.c linux-2.6.39.1/drivers/block/drbd/drbd_main.c
27723 --- linux-2.6.39.1/drivers/block/drbd/drbd_main.c 2011-05-19 00:06:34.000000000 -0400
27724 +++ linux-2.6.39.1/drivers/block/drbd/drbd_main.c 2011-05-22 19:36:31.000000000 -0400
27725 @@ -2387,7 +2387,7 @@ static int _drbd_send_ack(struct drbd_co
27726 p.sector = sector;
27727 p.block_id = block_id;
27728 p.blksize = blksize;
27729 - p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
27730 + p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
27731
27732 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
27733 return false;
27734 @@ -2686,7 +2686,7 @@ int drbd_send_dblock(struct drbd_conf *m
27735 p.sector = cpu_to_be64(req->sector);
27736 p.block_id = (unsigned long)req;
27737 p.seq_num = cpu_to_be32(req->seq_num =
27738 - atomic_add_return(1, &mdev->packet_seq));
27739 + atomic_add_return_unchecked(1, &mdev->packet_seq));
27740
27741 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
27742
27743 @@ -2971,7 +2971,7 @@ void drbd_init_set_defaults(struct drbd_
27744 atomic_set(&mdev->unacked_cnt, 0);
27745 atomic_set(&mdev->local_cnt, 0);
27746 atomic_set(&mdev->net_cnt, 0);
27747 - atomic_set(&mdev->packet_seq, 0);
27748 + atomic_set_unchecked(&mdev->packet_seq, 0);
27749 atomic_set(&mdev->pp_in_use, 0);
27750 atomic_set(&mdev->pp_in_use_by_net, 0);
27751 atomic_set(&mdev->rs_sect_in, 0);
27752 @@ -3051,8 +3051,8 @@ void drbd_mdev_cleanup(struct drbd_conf
27753 mdev->receiver.t_state);
27754
27755 /* no need to lock it, I'm the only thread alive */
27756 - if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
27757 - dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
27758 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
27759 + dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
27760 mdev->al_writ_cnt =
27761 mdev->bm_writ_cnt =
27762 mdev->read_cnt =
27763 diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_nl.c linux-2.6.39.1/drivers/block/drbd/drbd_nl.c
27764 --- linux-2.6.39.1/drivers/block/drbd/drbd_nl.c 2011-05-19 00:06:34.000000000 -0400
27765 +++ linux-2.6.39.1/drivers/block/drbd/drbd_nl.c 2011-05-22 19:36:31.000000000 -0400
27766 @@ -2298,7 +2298,7 @@ static void drbd_connector_callback(stru
27767 module_put(THIS_MODULE);
27768 }
27769
27770 -static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27771 +static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27772
27773 static unsigned short *
27774 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
27775 @@ -2369,7 +2369,7 @@ void drbd_bcast_state(struct drbd_conf *
27776 cn_reply->id.idx = CN_IDX_DRBD;
27777 cn_reply->id.val = CN_VAL_DRBD;
27778
27779 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27780 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27781 cn_reply->ack = 0; /* not used here. */
27782 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27783 (int)((char *)tl - (char *)reply->tag_list);
27784 @@ -2401,7 +2401,7 @@ void drbd_bcast_ev_helper(struct drbd_co
27785 cn_reply->id.idx = CN_IDX_DRBD;
27786 cn_reply->id.val = CN_VAL_DRBD;
27787
27788 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27789 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27790 cn_reply->ack = 0; /* not used here. */
27791 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27792 (int)((char *)tl - (char *)reply->tag_list);
27793 @@ -2479,7 +2479,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
27794 cn_reply->id.idx = CN_IDX_DRBD;
27795 cn_reply->id.val = CN_VAL_DRBD;
27796
27797 - cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
27798 + cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
27799 cn_reply->ack = 0; // not used here.
27800 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27801 (int)((char*)tl - (char*)reply->tag_list);
27802 @@ -2518,7 +2518,7 @@ void drbd_bcast_sync_progress(struct drb
27803 cn_reply->id.idx = CN_IDX_DRBD;
27804 cn_reply->id.val = CN_VAL_DRBD;
27805
27806 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27807 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27808 cn_reply->ack = 0; /* not used here. */
27809 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27810 (int)((char *)tl - (char *)reply->tag_list);
27811 diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c
27812 --- linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c 2011-05-19 00:06:34.000000000 -0400
27813 +++ linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c 2011-05-22 19:36:31.000000000 -0400
27814 @@ -894,7 +894,7 @@ retry:
27815 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
27816 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
27817
27818 - atomic_set(&mdev->packet_seq, 0);
27819 + atomic_set_unchecked(&mdev->packet_seq, 0);
27820 mdev->peer_seq = 0;
27821
27822 drbd_thread_start(&mdev->asender);
27823 @@ -990,7 +990,7 @@ static enum finish_epoch drbd_may_finish
27824 do {
27825 next_epoch = NULL;
27826
27827 - epoch_size = atomic_read(&epoch->epoch_size);
27828 + epoch_size = atomic_read_unchecked(&epoch->epoch_size);
27829
27830 switch (ev & ~EV_CLEANUP) {
27831 case EV_PUT:
27832 @@ -1025,7 +1025,7 @@ static enum finish_epoch drbd_may_finish
27833 rv = FE_DESTROYED;
27834 } else {
27835 epoch->flags = 0;
27836 - atomic_set(&epoch->epoch_size, 0);
27837 + atomic_set_unchecked(&epoch->epoch_size, 0);
27838 /* atomic_set(&epoch->active, 0); is already zero */
27839 if (rv == FE_STILL_LIVE)
27840 rv = FE_RECYCLED;
27841 @@ -1196,14 +1196,14 @@ static int receive_Barrier(struct drbd_c
27842 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
27843 drbd_flush(mdev);
27844
27845 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
27846 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27847 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
27848 if (epoch)
27849 break;
27850 }
27851
27852 epoch = mdev->current_epoch;
27853 - wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
27854 + wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
27855
27856 D_ASSERT(atomic_read(&epoch->active) == 0);
27857 D_ASSERT(epoch->flags == 0);
27858 @@ -1215,11 +1215,11 @@ static int receive_Barrier(struct drbd_c
27859 }
27860
27861 epoch->flags = 0;
27862 - atomic_set(&epoch->epoch_size, 0);
27863 + atomic_set_unchecked(&epoch->epoch_size, 0);
27864 atomic_set(&epoch->active, 0);
27865
27866 spin_lock(&mdev->epoch_lock);
27867 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
27868 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27869 list_add(&epoch->list, &mdev->current_epoch->list);
27870 mdev->current_epoch = epoch;
27871 mdev->epochs++;
27872 @@ -1668,7 +1668,7 @@ static int receive_Data(struct drbd_conf
27873 spin_unlock(&mdev->peer_seq_lock);
27874
27875 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
27876 - atomic_inc(&mdev->current_epoch->epoch_size);
27877 + atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
27878 return drbd_drain_block(mdev, data_size);
27879 }
27880
27881 @@ -1694,7 +1694,7 @@ static int receive_Data(struct drbd_conf
27882
27883 spin_lock(&mdev->epoch_lock);
27884 e->epoch = mdev->current_epoch;
27885 - atomic_inc(&e->epoch->epoch_size);
27886 + atomic_inc_unchecked(&e->epoch->epoch_size);
27887 atomic_inc(&e->epoch->active);
27888 spin_unlock(&mdev->epoch_lock);
27889
27890 @@ -3905,7 +3905,7 @@ static void drbd_disconnect(struct drbd_
27891 D_ASSERT(list_empty(&mdev->done_ee));
27892
27893 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
27894 - atomic_set(&mdev->current_epoch->epoch_size, 0);
27895 + atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
27896 D_ASSERT(list_empty(&mdev->current_epoch->list));
27897 }
27898
27899 diff -urNp linux-2.6.39.1/drivers/block/nbd.c linux-2.6.39.1/drivers/block/nbd.c
27900 --- linux-2.6.39.1/drivers/block/nbd.c 2011-05-19 00:06:34.000000000 -0400
27901 +++ linux-2.6.39.1/drivers/block/nbd.c 2011-05-22 19:36:31.000000000 -0400
27902 @@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
27903 struct kvec iov;
27904 sigset_t blocked, oldset;
27905
27906 + pax_track_stack();
27907 +
27908 if (unlikely(!sock)) {
27909 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
27910 lo->disk->disk_name, (send ? "send" : "recv"));
27911 @@ -571,6 +573,8 @@ static void do_nbd_request(struct reques
27912 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
27913 unsigned int cmd, unsigned long arg)
27914 {
27915 + pax_track_stack();
27916 +
27917 switch (cmd) {
27918 case NBD_DISCONNECT: {
27919 struct request sreq;
27920 diff -urNp linux-2.6.39.1/drivers/block/smart1,2.h linux-2.6.39.1/drivers/block/smart1,2.h
27921 --- linux-2.6.39.1/drivers/block/smart1,2.h 2011-05-19 00:06:34.000000000 -0400
27922 +++ linux-2.6.39.1/drivers/block/smart1,2.h 2011-05-22 19:36:31.000000000 -0400
27923 @@ -107,7 +107,7 @@ static unsigned long smart4_intr_pending
27924 return 0 ;
27925 }
27926
27927 -static struct access_method smart4_access = {
27928 +static const struct access_method smart4_access = {
27929 smart4_submit_command,
27930 smart4_intr_mask,
27931 smart4_fifo_full,
27932 @@ -143,7 +143,7 @@ static unsigned long smart2_intr_pending
27933 return readl(h->vaddr + INTR_PENDING);
27934 }
27935
27936 -static struct access_method smart2_access = {
27937 +static const struct access_method smart2_access = {
27938 smart2_submit_command,
27939 smart2_intr_mask,
27940 smart2_fifo_full,
27941 @@ -179,7 +179,7 @@ static unsigned long smart2e_intr_pendin
27942 return inl(h->io_mem_addr + INTR_PENDING);
27943 }
27944
27945 -static struct access_method smart2e_access = {
27946 +static const struct access_method smart2e_access = {
27947 smart2e_submit_command,
27948 smart2e_intr_mask,
27949 smart2e_fifo_full,
27950 @@ -269,7 +269,7 @@ static unsigned long smart1_intr_pending
27951 return chan;
27952 }
27953
27954 -static struct access_method smart1_access = {
27955 +static const struct access_method smart1_access = {
27956 smart1_submit_command,
27957 smart1_intr_mask,
27958 smart1_fifo_full,
27959 diff -urNp linux-2.6.39.1/drivers/block/xsysace.c linux-2.6.39.1/drivers/block/xsysace.c
27960 --- linux-2.6.39.1/drivers/block/xsysace.c 2011-05-19 00:06:34.000000000 -0400
27961 +++ linux-2.6.39.1/drivers/block/xsysace.c 2011-05-22 19:36:31.000000000 -0400
27962 @@ -262,7 +262,7 @@ static void ace_dataout_8(struct ace_dev
27963 ace->data_ptr = src;
27964 }
27965
27966 -static struct ace_reg_ops ace_reg_8_ops = {
27967 +static const struct ace_reg_ops ace_reg_8_ops = {
27968 .in = ace_in_8,
27969 .out = ace_out_8,
27970 .datain = ace_datain_8,
27971 @@ -327,14 +327,14 @@ static void ace_dataout_le16(struct ace_
27972 ace->data_ptr = src;
27973 }
27974
27975 -static struct ace_reg_ops ace_reg_be16_ops = {
27976 +static const struct ace_reg_ops ace_reg_be16_ops = {
27977 .in = ace_in_be16,
27978 .out = ace_out_be16,
27979 .datain = ace_datain_be16,
27980 .dataout = ace_dataout_be16,
27981 };
27982
27983 -static struct ace_reg_ops ace_reg_le16_ops = {
27984 +static const struct ace_reg_ops ace_reg_le16_ops = {
27985 .in = ace_in_le16,
27986 .out = ace_out_le16,
27987 .datain = ace_datain_le16,
27988 diff -urNp linux-2.6.39.1/drivers/char/agp/frontend.c linux-2.6.39.1/drivers/char/agp/frontend.c
27989 --- linux-2.6.39.1/drivers/char/agp/frontend.c 2011-05-19 00:06:34.000000000 -0400
27990 +++ linux-2.6.39.1/drivers/char/agp/frontend.c 2011-05-22 19:36:31.000000000 -0400
27991 @@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
27992 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
27993 return -EFAULT;
27994
27995 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
27996 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
27997 return -EFAULT;
27998
27999 client = agp_find_client_by_pid(reserve.pid);
28000 diff -urNp linux-2.6.39.1/drivers/char/briq_panel.c linux-2.6.39.1/drivers/char/briq_panel.c
28001 --- linux-2.6.39.1/drivers/char/briq_panel.c 2011-05-19 00:06:34.000000000 -0400
28002 +++ linux-2.6.39.1/drivers/char/briq_panel.c 2011-05-22 19:41:32.000000000 -0400
28003 @@ -9,6 +9,7 @@
28004 #include <linux/types.h>
28005 #include <linux/errno.h>
28006 #include <linux/tty.h>
28007 +#include <linux/mutex.h>
28008 #include <linux/timer.h>
28009 #include <linux/kernel.h>
28010 #include <linux/wait.h>
28011 @@ -34,6 +35,7 @@ static int vfd_is_open;
28012 static unsigned char vfd[40];
28013 static int vfd_cursor;
28014 static unsigned char ledpb, led;
28015 +static DEFINE_MUTEX(vfd_mutex);
28016
28017 static void update_vfd(void)
28018 {
28019 @@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
28020 if (!vfd_is_open)
28021 return -EBUSY;
28022
28023 + mutex_lock(&vfd_mutex);
28024 for (;;) {
28025 char c;
28026 if (!indx)
28027 break;
28028 - if (get_user(c, buf))
28029 + if (get_user(c, buf)) {
28030 + mutex_unlock(&vfd_mutex);
28031 return -EFAULT;
28032 + }
28033 if (esc) {
28034 set_led(c);
28035 esc = 0;
28036 @@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
28037 buf++;
28038 }
28039 update_vfd();
28040 + mutex_unlock(&vfd_mutex);
28041
28042 return len;
28043 }
28044 diff -urNp linux-2.6.39.1/drivers/char/genrtc.c linux-2.6.39.1/drivers/char/genrtc.c
28045 --- linux-2.6.39.1/drivers/char/genrtc.c 2011-05-19 00:06:34.000000000 -0400
28046 +++ linux-2.6.39.1/drivers/char/genrtc.c 2011-05-22 19:41:32.000000000 -0400
28047 @@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
28048 switch (cmd) {
28049
28050 case RTC_PLL_GET:
28051 + memset(&pll, 0, sizeof(pll));
28052 if (get_rtc_pll(&pll))
28053 return -EINVAL;
28054 else
28055 diff -urNp linux-2.6.39.1/drivers/char/hpet.c linux-2.6.39.1/drivers/char/hpet.c
28056 --- linux-2.6.39.1/drivers/char/hpet.c 2011-05-19 00:06:34.000000000 -0400
28057 +++ linux-2.6.39.1/drivers/char/hpet.c 2011-05-22 19:36:31.000000000 -0400
28058 @@ -553,7 +553,7 @@ static inline unsigned long hpet_time_di
28059 }
28060
28061 static int
28062 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
28063 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
28064 struct hpet_info *info)
28065 {
28066 struct hpet_timer __iomem *timer;
28067 diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c
28068 --- linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c 2011-05-19 00:06:34.000000000 -0400
28069 +++ linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c 2011-05-22 19:36:31.000000000 -0400
28070 @@ -109,8 +109,7 @@ static int ipmi_fasync(int fd, struct fi
28071 return (result);
28072 }
28073
28074 -static struct ipmi_user_hndl ipmi_hndlrs =
28075 -{
28076 +static const struct ipmi_user_hndl ipmi_hndlrs = {
28077 .ipmi_recv_hndl = file_receive_handler,
28078 };
28079
28080 diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c
28081 --- linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c 2011-05-19 00:06:34.000000000 -0400
28082 +++ linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c 2011-05-22 19:36:31.000000000 -0400
28083 @@ -82,7 +82,7 @@ struct ipmi_user {
28084 struct kref refcount;
28085
28086 /* The upper layer that handles receive messages. */
28087 - struct ipmi_user_hndl *handler;
28088 + const struct ipmi_user_hndl *handler;
28089 void *handler_data;
28090
28091 /* The interface this user is bound to. */
28092 @@ -414,7 +414,7 @@ struct ipmi_smi {
28093 struct proc_dir_entry *proc_dir;
28094 char proc_dir_name[10];
28095
28096 - atomic_t stats[IPMI_NUM_STATS];
28097 + atomic_unchecked_t stats[IPMI_NUM_STATS];
28098
28099 /*
28100 * run_to_completion duplicate of smb_info, smi_info
28101 @@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
28102
28103
28104 #define ipmi_inc_stat(intf, stat) \
28105 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
28106 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
28107 #define ipmi_get_stat(intf, stat) \
28108 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
28109 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
28110
28111 static int is_lan_addr(struct ipmi_addr *addr)
28112 {
28113 @@ -875,7 +875,7 @@ static int intf_err_seq(ipmi_smi_t int
28114
28115
28116 int ipmi_create_user(unsigned int if_num,
28117 - struct ipmi_user_hndl *handler,
28118 + const struct ipmi_user_hndl *handler,
28119 void *handler_data,
28120 ipmi_user_t *user)
28121 {
28122 @@ -2844,7 +2844,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
28123 INIT_LIST_HEAD(&intf->cmd_rcvrs);
28124 init_waitqueue_head(&intf->waitq);
28125 for (i = 0; i < IPMI_NUM_STATS; i++)
28126 - atomic_set(&intf->stats[i], 0);
28127 + atomic_set_unchecked(&intf->stats[i], 0);
28128
28129 intf->proc_dir = NULL;
28130
28131 @@ -4196,6 +4196,8 @@ static void send_panic_events(char *str)
28132 struct ipmi_smi_msg smi_msg;
28133 struct ipmi_recv_msg recv_msg;
28134
28135 + pax_track_stack();
28136 +
28137 si = (struct ipmi_system_interface_addr *) &addr;
28138 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
28139 si->channel = IPMI_BMC_CHANNEL;
28140 diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c
28141 --- linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c 2011-05-19 00:06:34.000000000 -0400
28142 +++ linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c 2011-05-22 19:36:31.000000000 -0400
28143 @@ -133,7 +133,7 @@ static void receive_handler(struct ipmi_
28144 complete(comp);
28145 }
28146
28147 -static struct ipmi_user_hndl ipmi_poweroff_handler = {
28148 +static const struct ipmi_user_hndl ipmi_poweroff_handler = {
28149 .ipmi_recv_hndl = receive_handler
28150 };
28151
28152 diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c
28153 --- linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c 2011-05-19 00:06:34.000000000 -0400
28154 +++ linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c 2011-05-22 19:36:31.000000000 -0400
28155 @@ -276,7 +276,7 @@ struct smi_info {
28156 unsigned char slave_addr;
28157
28158 /* Counters and things for the proc filesystem. */
28159 - atomic_t stats[SI_NUM_STATS];
28160 + atomic_unchecked_t stats[SI_NUM_STATS];
28161
28162 struct task_struct *thread;
28163
28164 @@ -285,9 +285,9 @@ struct smi_info {
28165 };
28166
28167 #define smi_inc_stat(smi, stat) \
28168 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
28169 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
28170 #define smi_get_stat(smi, stat) \
28171 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
28172 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
28173
28174 #define SI_MAX_PARMS 4
28175
28176 @@ -3198,7 +3198,7 @@ static int try_smi_init(struct smi_info
28177 atomic_set(&new_smi->req_events, 0);
28178 new_smi->run_to_completion = 0;
28179 for (i = 0; i < SI_NUM_STATS; i++)
28180 - atomic_set(&new_smi->stats[i], 0);
28181 + atomic_set_unchecked(&new_smi->stats[i], 0);
28182
28183 new_smi->interrupt_disabled = 1;
28184 atomic_set(&new_smi->stop_operation, 0);
28185 diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c
28186 --- linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c 2011-05-19 00:06:34.000000000 -0400
28187 +++ linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c 2011-05-22 19:36:31.000000000 -0400
28188 @@ -216,7 +216,7 @@ static int set_param_timeout(const char
28189 return rv;
28190 }
28191
28192 -static struct kernel_param_ops param_ops_timeout = {
28193 +static const struct kernel_param_ops param_ops_timeout = {
28194 .set = set_param_timeout,
28195 .get = param_get_int,
28196 };
28197 @@ -278,14 +278,14 @@ static int set_param_wdog_ifnum(const ch
28198 return 0;
28199 }
28200
28201 -static struct kernel_param_ops param_ops_wdog_ifnum = {
28202 +static const struct kernel_param_ops param_ops_wdog_ifnum = {
28203 .set = set_param_wdog_ifnum,
28204 .get = param_get_int,
28205 };
28206
28207 #define param_check_wdog_ifnum param_check_int
28208
28209 -static struct kernel_param_ops param_ops_str = {
28210 +static const struct kernel_param_ops param_ops_str = {
28211 .set = set_param_str,
28212 .get = get_param_str,
28213 };
28214 @@ -953,7 +953,7 @@ static void ipmi_wdog_pretimeout_handler
28215 pretimeout_since_last_heartbeat = 1;
28216 }
28217
28218 -static struct ipmi_user_hndl ipmi_hndlrs = {
28219 +static const struct ipmi_user_hndl ipmi_hndlrs = {
28220 .ipmi_recv_hndl = ipmi_wdog_msg_handler,
28221 .ipmi_watchdog_pretimeout = ipmi_wdog_pretimeout_handler
28222 };
28223 diff -urNp linux-2.6.39.1/drivers/char/Kconfig linux-2.6.39.1/drivers/char/Kconfig
28224 --- linux-2.6.39.1/drivers/char/Kconfig 2011-05-19 00:06:34.000000000 -0400
28225 +++ linux-2.6.39.1/drivers/char/Kconfig 2011-05-22 19:41:37.000000000 -0400
28226 @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
28227
28228 config DEVKMEM
28229 bool "/dev/kmem virtual device support"
28230 - default y
28231 + default n
28232 + depends on !GRKERNSEC_KMEM
28233 help
28234 Say Y here if you want to support the /dev/kmem device. The
28235 /dev/kmem device is rarely used, but can be used for certain
28236 @@ -596,6 +597,7 @@ config DEVPORT
28237 bool
28238 depends on !M68K
28239 depends on ISA || PCI
28240 + depends on !GRKERNSEC_KMEM
28241 default y
28242
28243 source "drivers/s390/char/Kconfig"
28244 diff -urNp linux-2.6.39.1/drivers/char/mem.c linux-2.6.39.1/drivers/char/mem.c
28245 --- linux-2.6.39.1/drivers/char/mem.c 2011-05-19 00:06:34.000000000 -0400
28246 +++ linux-2.6.39.1/drivers/char/mem.c 2011-05-22 19:41:37.000000000 -0400
28247 @@ -18,6 +18,7 @@
28248 #include <linux/raw.h>
28249 #include <linux/tty.h>
28250 #include <linux/capability.h>
28251 +#include <linux/security.h>
28252 #include <linux/ptrace.h>
28253 #include <linux/device.h>
28254 #include <linux/highmem.h>
28255 @@ -34,6 +35,10 @@
28256 # include <linux/efi.h>
28257 #endif
28258
28259 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28260 +extern struct file_operations grsec_fops;
28261 +#endif
28262 +
28263 static inline unsigned long size_inside_page(unsigned long start,
28264 unsigned long size)
28265 {
28266 @@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig
28267
28268 while (cursor < to) {
28269 if (!devmem_is_allowed(pfn)) {
28270 +#ifdef CONFIG_GRKERNSEC_KMEM
28271 + gr_handle_mem_readwrite(from, to);
28272 +#else
28273 printk(KERN_INFO
28274 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
28275 current->comm, from, to);
28276 +#endif
28277 return 0;
28278 }
28279 cursor += PAGE_SIZE;
28280 @@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig
28281 }
28282 return 1;
28283 }
28284 +#elif defined(CONFIG_GRKERNSEC_KMEM)
28285 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28286 +{
28287 + return 0;
28288 +}
28289 #else
28290 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28291 {
28292 @@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil
28293
28294 while (count > 0) {
28295 unsigned long remaining;
28296 + char *temp;
28297
28298 sz = size_inside_page(p, count);
28299
28300 @@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil
28301 if (!ptr)
28302 return -EFAULT;
28303
28304 - remaining = copy_to_user(buf, ptr, sz);
28305 +#ifdef CONFIG_PAX_USERCOPY
28306 + temp = kmalloc(sz, GFP_KERNEL);
28307 + if (!temp) {
28308 + unxlate_dev_mem_ptr(p, ptr);
28309 + return -ENOMEM;
28310 + }
28311 + memcpy(temp, ptr, sz);
28312 +#else
28313 + temp = ptr;
28314 +#endif
28315 +
28316 + remaining = copy_to_user(buf, temp, sz);
28317 +
28318 +#ifdef CONFIG_PAX_USERCOPY
28319 + kfree(temp);
28320 +#endif
28321 +
28322 unxlate_dev_mem_ptr(p, ptr);
28323 if (remaining)
28324 return -EFAULT;
28325 @@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi
28326 size_t count, loff_t *ppos)
28327 {
28328 unsigned long p = *ppos;
28329 - ssize_t low_count, read, sz;
28330 + ssize_t low_count, read, sz, err = 0;
28331 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
28332 - int err = 0;
28333
28334 read = 0;
28335 if (p < (unsigned long) high_memory) {
28336 @@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi
28337 }
28338 #endif
28339 while (low_count > 0) {
28340 + char *temp;
28341 +
28342 sz = size_inside_page(p, low_count);
28343
28344 /*
28345 @@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi
28346 */
28347 kbuf = xlate_dev_kmem_ptr((char *)p);
28348
28349 - if (copy_to_user(buf, kbuf, sz))
28350 +#ifdef CONFIG_PAX_USERCOPY
28351 + temp = kmalloc(sz, GFP_KERNEL);
28352 + if (!temp)
28353 + return -ENOMEM;
28354 + memcpy(temp, kbuf, sz);
28355 +#else
28356 + temp = kbuf;
28357 +#endif
28358 +
28359 + err = copy_to_user(buf, temp, sz);
28360 +
28361 +#ifdef CONFIG_PAX_USERCOPY
28362 + kfree(temp);
28363 +#endif
28364 +
28365 + if (err)
28366 return -EFAULT;
28367 buf += sz;
28368 p += sz;
28369 @@ -854,6 +901,9 @@ static const struct memdev {
28370 #ifdef CONFIG_CRASH_DUMP
28371 [12] = { "oldmem", 0, &oldmem_fops, NULL },
28372 #endif
28373 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28374 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
28375 +#endif
28376 };
28377
28378 static int memory_open(struct inode *inode, struct file *filp)
28379 diff -urNp linux-2.6.39.1/drivers/char/mmtimer.c linux-2.6.39.1/drivers/char/mmtimer.c
28380 --- linux-2.6.39.1/drivers/char/mmtimer.c 2011-05-19 00:06:34.000000000 -0400
28381 +++ linux-2.6.39.1/drivers/char/mmtimer.c 2011-05-22 19:36:31.000000000 -0400
28382 @@ -53,7 +53,7 @@ MODULE_LICENSE("GPL");
28383
28384 #define RTC_BITS 55 /* 55 bits for this implementation */
28385
28386 -static struct k_clock sgi_clock;
28387 +static const struct k_clock sgi_clock;
28388
28389 extern unsigned long sn_rtc_cycles_per_second;
28390
28391 @@ -772,7 +772,7 @@ static int sgi_clock_getres(const clocki
28392 return 0;
28393 }
28394
28395 -static struct k_clock sgi_clock = {
28396 +static const struct k_clock sgi_clock = {
28397 .clock_set = sgi_clock_set,
28398 .clock_get = sgi_clock_get,
28399 .clock_getres = sgi_clock_getres,
28400 diff -urNp linux-2.6.39.1/drivers/char/nvram.c linux-2.6.39.1/drivers/char/nvram.c
28401 --- linux-2.6.39.1/drivers/char/nvram.c 2011-05-19 00:06:34.000000000 -0400
28402 +++ linux-2.6.39.1/drivers/char/nvram.c 2011-05-22 19:36:31.000000000 -0400
28403 @@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
28404
28405 spin_unlock_irq(&rtc_lock);
28406
28407 - if (copy_to_user(buf, contents, tmp - contents))
28408 + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
28409 return -EFAULT;
28410
28411 *ppos = i;
28412 diff -urNp linux-2.6.39.1/drivers/char/random.c linux-2.6.39.1/drivers/char/random.c
28413 --- linux-2.6.39.1/drivers/char/random.c 2011-05-19 00:06:34.000000000 -0400
28414 +++ linux-2.6.39.1/drivers/char/random.c 2011-05-22 19:41:37.000000000 -0400
28415 @@ -261,8 +261,13 @@
28416 /*
28417 * Configuration information
28418 */
28419 +#ifdef CONFIG_GRKERNSEC_RANDNET
28420 +#define INPUT_POOL_WORDS 512
28421 +#define OUTPUT_POOL_WORDS 128
28422 +#else
28423 #define INPUT_POOL_WORDS 128
28424 #define OUTPUT_POOL_WORDS 32
28425 +#endif
28426 #define SEC_XFER_SIZE 512
28427 #define EXTRACT_SIZE 10
28428
28429 @@ -300,10 +305,17 @@ static struct poolinfo {
28430 int poolwords;
28431 int tap1, tap2, tap3, tap4, tap5;
28432 } poolinfo_table[] = {
28433 +#ifdef CONFIG_GRKERNSEC_RANDNET
28434 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
28435 + { 512, 411, 308, 208, 104, 1 },
28436 + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
28437 + { 128, 103, 76, 51, 25, 1 },
28438 +#else
28439 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
28440 { 128, 103, 76, 51, 25, 1 },
28441 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
28442 { 32, 26, 20, 14, 7, 1 },
28443 +#endif
28444 #if 0
28445 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
28446 { 2048, 1638, 1231, 819, 411, 1 },
28447 @@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru
28448
28449 extract_buf(r, tmp);
28450 i = min_t(int, nbytes, EXTRACT_SIZE);
28451 - if (copy_to_user(buf, tmp, i)) {
28452 + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
28453 ret = -EFAULT;
28454 break;
28455 }
28456 @@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
28457 #include <linux/sysctl.h>
28458
28459 static int min_read_thresh = 8, min_write_thresh;
28460 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
28461 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
28462 static int max_write_thresh = INPUT_POOL_WORDS * 32;
28463 static char sysctl_bootid[16];
28464
28465 diff -urNp linux-2.6.39.1/drivers/char/sonypi.c linux-2.6.39.1/drivers/char/sonypi.c
28466 --- linux-2.6.39.1/drivers/char/sonypi.c 2011-05-19 00:06:34.000000000 -0400
28467 +++ linux-2.6.39.1/drivers/char/sonypi.c 2011-05-22 19:36:31.000000000 -0400
28468 @@ -55,6 +55,7 @@
28469 #include <asm/uaccess.h>
28470 #include <asm/io.h>
28471 #include <asm/system.h>
28472 +#include <asm/local.h>
28473
28474 #include <linux/sonypi.h>
28475
28476 @@ -491,7 +492,7 @@ static struct sonypi_device {
28477 spinlock_t fifo_lock;
28478 wait_queue_head_t fifo_proc_list;
28479 struct fasync_struct *fifo_async;
28480 - int open_count;
28481 + local_t open_count;
28482 int model;
28483 struct input_dev *input_jog_dev;
28484 struct input_dev *input_key_dev;
28485 @@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
28486 static int sonypi_misc_release(struct inode *inode, struct file *file)
28487 {
28488 mutex_lock(&sonypi_device.lock);
28489 - sonypi_device.open_count--;
28490 + local_dec(&sonypi_device.open_count);
28491 mutex_unlock(&sonypi_device.lock);
28492 return 0;
28493 }
28494 @@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
28495 {
28496 mutex_lock(&sonypi_device.lock);
28497 /* Flush input queue on first open */
28498 - if (!sonypi_device.open_count)
28499 + if (!local_read(&sonypi_device.open_count))
28500 kfifo_reset(&sonypi_device.fifo);
28501 - sonypi_device.open_count++;
28502 + local_inc(&sonypi_device.open_count);
28503 mutex_unlock(&sonypi_device.lock);
28504
28505 return 0;
28506 diff -urNp linux-2.6.39.1/drivers/char/tpm/tpm_bios.c linux-2.6.39.1/drivers/char/tpm/tpm_bios.c
28507 --- linux-2.6.39.1/drivers/char/tpm/tpm_bios.c 2011-05-19 00:06:34.000000000 -0400
28508 +++ linux-2.6.39.1/drivers/char/tpm/tpm_bios.c 2011-05-22 19:36:31.000000000 -0400
28509 @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
28510 event = addr;
28511
28512 if ((event->event_type == 0 && event->event_size == 0) ||
28513 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
28514 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
28515 return NULL;
28516
28517 return addr;
28518 @@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(
28519 return NULL;
28520
28521 if ((event->event_type == 0 && event->event_size == 0) ||
28522 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
28523 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
28524 return NULL;
28525
28526 (*pos)++;
28527 @@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_
28528 int i;
28529
28530 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
28531 - seq_putc(m, data[i]);
28532 + if (!seq_putc(m, data[i]))
28533 + return -EFAULT;
28534
28535 return 0;
28536 }
28537 @@ -410,6 +411,11 @@ static int read_log(struct tpm_bios_log
28538 log->bios_event_log_end = log->bios_event_log + len;
28539
28540 virt = acpi_os_map_memory(start, len);
28541 + if (!virt) {
28542 + kfree(log->bios_event_log);
28543 + log->bios_event_log = NULL;
28544 + return -EFAULT;
28545 + }
28546
28547 memcpy(log->bios_event_log, virt, len);
28548
28549 diff -urNp linux-2.6.39.1/drivers/char/tpm/tpm.c linux-2.6.39.1/drivers/char/tpm/tpm.c
28550 --- linux-2.6.39.1/drivers/char/tpm/tpm.c 2011-05-19 00:06:34.000000000 -0400
28551 +++ linux-2.6.39.1/drivers/char/tpm/tpm.c 2011-05-22 19:36:31.000000000 -0400
28552 @@ -411,7 +411,7 @@ static ssize_t tpm_transmit(struct tpm_c
28553 chip->vendor.req_complete_val)
28554 goto out_recv;
28555
28556 - if ((status == chip->vendor.req_canceled)) {
28557 + if (status == chip->vendor.req_canceled) {
28558 dev_err(chip->dev, "Operation Canceled\n");
28559 rc = -ECANCELED;
28560 goto out;
28561 @@ -844,6 +844,8 @@ ssize_t tpm_show_pubek(struct device *de
28562
28563 struct tpm_chip *chip = dev_get_drvdata(dev);
28564
28565 + pax_track_stack();
28566 +
28567 tpm_cmd.header.in = tpm_readpubek_header;
28568 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
28569 "attempting to read the PUBEK");
28570 diff -urNp linux-2.6.39.1/drivers/char/ttyprintk.c linux-2.6.39.1/drivers/char/ttyprintk.c
28571 --- linux-2.6.39.1/drivers/char/ttyprintk.c 2011-05-19 00:06:34.000000000 -0400
28572 +++ linux-2.6.39.1/drivers/char/ttyprintk.c 2011-05-22 19:36:31.000000000 -0400
28573 @@ -170,7 +170,7 @@ static const struct tty_operations ttypr
28574 .ioctl = tpk_ioctl,
28575 };
28576
28577 -struct tty_port_operations null_ops = { };
28578 +const struct tty_port_operations null_ops = { };
28579
28580 static struct tty_driver *ttyprintk_driver;
28581
28582 diff -urNp linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c
28583 --- linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-19 00:06:34.000000000 -0400
28584 +++ linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-22 19:36:31.000000000 -0400
28585 @@ -678,14 +678,14 @@ static int __devinit hwicap_setup(struct
28586 return retval;
28587 }
28588
28589 -static struct hwicap_driver_config buffer_icap_config = {
28590 +static const struct hwicap_driver_config buffer_icap_config = {
28591 .get_configuration = buffer_icap_get_configuration,
28592 .set_configuration = buffer_icap_set_configuration,
28593 .get_status = buffer_icap_get_status,
28594 .reset = buffer_icap_reset,
28595 };
28596
28597 -static struct hwicap_driver_config fifo_icap_config = {
28598 +static const struct hwicap_driver_config fifo_icap_config = {
28599 .get_configuration = fifo_icap_get_configuration,
28600 .set_configuration = fifo_icap_set_configuration,
28601 .get_status = fifo_icap_get_status,
28602 diff -urNp linux-2.6.39.1/drivers/connector/Kconfig linux-2.6.39.1/drivers/connector/Kconfig
28603 --- linux-2.6.39.1/drivers/connector/Kconfig 2011-05-19 00:06:34.000000000 -0400
28604 +++ linux-2.6.39.1/drivers/connector/Kconfig 2011-06-20 17:54:16.000000000 -0400
28605 @@ -1,7 +1,7 @@
28606
28607 menuconfig CONNECTOR
28608 tristate "Connector - unified userspace <-> kernelspace linker"
28609 - depends on NET
28610 + depends on NET && !GRKERNSEC
28611 ---help---
28612 This is unified userspace <-> kernelspace connector working on top
28613 of the netlink socket protocol.
28614 @@ -13,7 +13,7 @@ if CONNECTOR
28615
28616 config PROC_EVENTS
28617 boolean "Report process events to userspace"
28618 - depends on CONNECTOR=y
28619 + depends on CONNECTOR=y && !GRKERNSEC
28620 default y
28621 ---help---
28622 Provide a connector that reports process events to userspace. Send
28623 diff -urNp linux-2.6.39.1/drivers/crypto/hifn_795x.c linux-2.6.39.1/drivers/crypto/hifn_795x.c
28624 --- linux-2.6.39.1/drivers/crypto/hifn_795x.c 2011-05-19 00:06:34.000000000 -0400
28625 +++ linux-2.6.39.1/drivers/crypto/hifn_795x.c 2011-05-22 19:36:31.000000000 -0400
28626 @@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
28627 0xCA, 0x34, 0x2B, 0x2E};
28628 struct scatterlist sg;
28629
28630 + pax_track_stack();
28631 +
28632 memset(src, 0, sizeof(src));
28633 memset(ctx.key, 0, sizeof(ctx.key));
28634
28635 diff -urNp linux-2.6.39.1/drivers/crypto/padlock-aes.c linux-2.6.39.1/drivers/crypto/padlock-aes.c
28636 --- linux-2.6.39.1/drivers/crypto/padlock-aes.c 2011-05-19 00:06:34.000000000 -0400
28637 +++ linux-2.6.39.1/drivers/crypto/padlock-aes.c 2011-05-22 19:36:31.000000000 -0400
28638 @@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
28639 struct crypto_aes_ctx gen_aes;
28640 int cpu;
28641
28642 + pax_track_stack();
28643 +
28644 if (key_len % 8) {
28645 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
28646 return -EINVAL;
28647 diff -urNp linux-2.6.39.1/drivers/dca/dca-core.c linux-2.6.39.1/drivers/dca/dca-core.c
28648 --- linux-2.6.39.1/drivers/dca/dca-core.c 2011-05-19 00:06:34.000000000 -0400
28649 +++ linux-2.6.39.1/drivers/dca/dca-core.c 2011-05-22 19:36:31.000000000 -0400
28650 @@ -325,7 +325,7 @@ EXPORT_SYMBOL_GPL(dca_get_tag);
28651 * @ops - pointer to struct of dca operation function pointers
28652 * @priv_size - size of extra mem to be added for provider's needs
28653 */
28654 -struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size)
28655 +struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size)
28656 {
28657 struct dca_provider *dca;
28658 int alloc_size;
28659 diff -urNp linux-2.6.39.1/drivers/dma/ioat/dca.c linux-2.6.39.1/drivers/dma/ioat/dca.c
28660 --- linux-2.6.39.1/drivers/dma/ioat/dca.c 2011-05-19 00:06:34.000000000 -0400
28661 +++ linux-2.6.39.1/drivers/dma/ioat/dca.c 2011-05-22 19:36:31.000000000 -0400
28662 @@ -234,7 +234,7 @@ static int ioat_dca_dev_managed(struct d
28663 return 0;
28664 }
28665
28666 -static struct dca_ops ioat_dca_ops = {
28667 +static const struct dca_ops ioat_dca_ops = {
28668 .add_requester = ioat_dca_add_requester,
28669 .remove_requester = ioat_dca_remove_requester,
28670 .get_tag = ioat_dca_get_tag,
28671 @@ -384,7 +384,7 @@ static u8 ioat2_dca_get_tag(struct dca_p
28672 return tag;
28673 }
28674
28675 -static struct dca_ops ioat2_dca_ops = {
28676 +static const struct dca_ops ioat2_dca_ops = {
28677 .add_requester = ioat2_dca_add_requester,
28678 .remove_requester = ioat2_dca_remove_requester,
28679 .get_tag = ioat2_dca_get_tag,
28680 @@ -579,7 +579,7 @@ static u8 ioat3_dca_get_tag(struct dca_p
28681 return tag;
28682 }
28683
28684 -static struct dca_ops ioat3_dca_ops = {
28685 +static const struct dca_ops ioat3_dca_ops = {
28686 .add_requester = ioat3_dca_add_requester,
28687 .remove_requester = ioat3_dca_remove_requester,
28688 .get_tag = ioat3_dca_get_tag,
28689 diff -urNp linux-2.6.39.1/drivers/edac/amd64_edac.h linux-2.6.39.1/drivers/edac/amd64_edac.h
28690 --- linux-2.6.39.1/drivers/edac/amd64_edac.h 2011-05-19 00:06:34.000000000 -0400
28691 +++ linux-2.6.39.1/drivers/edac/amd64_edac.h 2011-05-22 19:36:31.000000000 -0400
28692 @@ -333,7 +333,7 @@ struct chip_select {
28693 };
28694
28695 struct amd64_pvt {
28696 - struct low_ops *ops;
28697 + const struct low_ops *ops;
28698
28699 /* pci_device handles which we utilize */
28700 struct pci_dev *F1, *F2, *F3;
28701 @@ -443,7 +443,7 @@ struct low_ops {
28702 struct amd64_family_type {
28703 const char *ctl_name;
28704 u16 f1_id, f3_id;
28705 - struct low_ops ops;
28706 + const struct low_ops ops;
28707 };
28708
28709 int __amd64_write_pci_cfg_dword(struct pci_dev *pdev, int offset,
28710 diff -urNp linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c
28711 --- linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28712 +++ linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28713 @@ -760,7 +760,7 @@ static void edac_inst_grp_release(struct
28714 }
28715
28716 /* Intermediate show/store table */
28717 -static struct sysfs_ops inst_grp_ops = {
28718 +static const struct sysfs_ops inst_grp_ops = {
28719 .show = inst_grp_show,
28720 .store = inst_grp_store
28721 };
28722 diff -urNp linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c
28723 --- linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28724 +++ linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28725 @@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log
28726 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
28727 static int edac_pci_poll_msec = 1000; /* one second workq period */
28728
28729 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
28730 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
28731 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
28732 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
28733
28734 static struct kobject *edac_pci_top_main_kobj;
28735 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
28736 @@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
28737 edac_printk(KERN_CRIT, EDAC_PCI,
28738 "Signaled System Error on %s\n",
28739 pci_name(dev));
28740 - atomic_inc(&pci_nonparity_count);
28741 + atomic_inc_unchecked(&pci_nonparity_count);
28742 }
28743
28744 if (status & (PCI_STATUS_PARITY)) {
28745 @@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
28746 "Master Data Parity Error on %s\n",
28747 pci_name(dev));
28748
28749 - atomic_inc(&pci_parity_count);
28750 + atomic_inc_unchecked(&pci_parity_count);
28751 }
28752
28753 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28754 @@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
28755 "Detected Parity Error on %s\n",
28756 pci_name(dev));
28757
28758 - atomic_inc(&pci_parity_count);
28759 + atomic_inc_unchecked(&pci_parity_count);
28760 }
28761 }
28762
28763 @@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
28764 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
28765 "Signaled System Error on %s\n",
28766 pci_name(dev));
28767 - atomic_inc(&pci_nonparity_count);
28768 + atomic_inc_unchecked(&pci_nonparity_count);
28769 }
28770
28771 if (status & (PCI_STATUS_PARITY)) {
28772 @@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
28773 "Master Data Parity Error on "
28774 "%s\n", pci_name(dev));
28775
28776 - atomic_inc(&pci_parity_count);
28777 + atomic_inc_unchecked(&pci_parity_count);
28778 }
28779
28780 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28781 @@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
28782 "Detected Parity Error on %s\n",
28783 pci_name(dev));
28784
28785 - atomic_inc(&pci_parity_count);
28786 + atomic_inc_unchecked(&pci_parity_count);
28787 }
28788 }
28789 }
28790 @@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
28791 if (!check_pci_errors)
28792 return;
28793
28794 - before_count = atomic_read(&pci_parity_count);
28795 + before_count = atomic_read_unchecked(&pci_parity_count);
28796
28797 /* scan all PCI devices looking for a Parity Error on devices and
28798 * bridges.
28799 @@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
28800 /* Only if operator has selected panic on PCI Error */
28801 if (edac_pci_get_panic_on_pe()) {
28802 /* If the count is different 'after' from 'before' */
28803 - if (before_count != atomic_read(&pci_parity_count))
28804 + if (before_count != atomic_read_unchecked(&pci_parity_count))
28805 panic("EDAC: PCI Parity Error");
28806 }
28807 }
28808 diff -urNp linux-2.6.39.1/drivers/firewire/core-cdev.c linux-2.6.39.1/drivers/firewire/core-cdev.c
28809 --- linux-2.6.39.1/drivers/firewire/core-cdev.c 2011-05-19 00:06:34.000000000 -0400
28810 +++ linux-2.6.39.1/drivers/firewire/core-cdev.c 2011-05-22 19:36:31.000000000 -0400
28811 @@ -1312,8 +1312,7 @@ static int init_iso_resource(struct clie
28812 int ret;
28813
28814 if ((request->channels == 0 && request->bandwidth == 0) ||
28815 - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
28816 - request->bandwidth < 0)
28817 + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
28818 return -EINVAL;
28819
28820 r = kmalloc(sizeof(*r), GFP_KERNEL);
28821 diff -urNp linux-2.6.39.1/drivers/firewire/core-transaction.c linux-2.6.39.1/drivers/firewire/core-transaction.c
28822 --- linux-2.6.39.1/drivers/firewire/core-transaction.c 2011-05-19 00:06:34.000000000 -0400
28823 +++ linux-2.6.39.1/drivers/firewire/core-transaction.c 2011-05-22 19:36:31.000000000 -0400
28824 @@ -36,6 +36,7 @@
28825 #include <linux/string.h>
28826 #include <linux/timer.h>
28827 #include <linux/types.h>
28828 +#include <linux/sched.h>
28829
28830 #include <asm/byteorder.h>
28831
28832 @@ -420,6 +421,8 @@ int fw_run_transaction(struct fw_card *c
28833 struct transaction_callback_data d;
28834 struct fw_transaction t;
28835
28836 + pax_track_stack();
28837 +
28838 init_timer_on_stack(&t.split_timeout_timer);
28839 init_completion(&d.done);
28840 d.payload = payload;
28841 diff -urNp linux-2.6.39.1/drivers/firmware/dmi_scan.c linux-2.6.39.1/drivers/firmware/dmi_scan.c
28842 --- linux-2.6.39.1/drivers/firmware/dmi_scan.c 2011-05-19 00:06:34.000000000 -0400
28843 +++ linux-2.6.39.1/drivers/firmware/dmi_scan.c 2011-05-22 19:36:31.000000000 -0400
28844 @@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
28845 }
28846 }
28847 else {
28848 - /*
28849 - * no iounmap() for that ioremap(); it would be a no-op, but
28850 - * it's so early in setup that sucker gets confused into doing
28851 - * what it shouldn't if we actually call it.
28852 - */
28853 p = dmi_ioremap(0xF0000, 0x10000);
28854 if (p == NULL)
28855 goto error;
28856 diff -urNp linux-2.6.39.1/drivers/gpio/vr41xx_giu.c linux-2.6.39.1/drivers/gpio/vr41xx_giu.c
28857 --- linux-2.6.39.1/drivers/gpio/vr41xx_giu.c 2011-05-19 00:06:34.000000000 -0400
28858 +++ linux-2.6.39.1/drivers/gpio/vr41xx_giu.c 2011-05-22 19:36:31.000000000 -0400
28859 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
28860 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
28861 maskl, pendl, maskh, pendh);
28862
28863 - atomic_inc(&irq_err_count);
28864 + atomic_inc_unchecked(&irq_err_count);
28865
28866 return -EINVAL;
28867 }
28868 diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c
28869 --- linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c 2011-05-19 00:06:34.000000000 -0400
28870 +++ linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c 2011-05-22 19:36:31.000000000 -0400
28871 @@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
28872 struct drm_crtc *tmp;
28873 int crtc_mask = 1;
28874
28875 - WARN(!crtc, "checking null crtc?\n");
28876 + BUG_ON(!crtc);
28877
28878 dev = crtc->dev;
28879
28880 @@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
28881 struct drm_encoder *encoder;
28882 bool ret = true;
28883
28884 + pax_track_stack();
28885 +
28886 crtc->enabled = drm_helper_crtc_in_use(crtc);
28887 if (!crtc->enabled)
28888 return true;
28889 diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_drv.c linux-2.6.39.1/drivers/gpu/drm/drm_drv.c
28890 --- linux-2.6.39.1/drivers/gpu/drm/drm_drv.c 2011-05-19 00:06:34.000000000 -0400
28891 +++ linux-2.6.39.1/drivers/gpu/drm/drm_drv.c 2011-05-22 19:36:31.000000000 -0400
28892 @@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
28893
28894 dev = file_priv->minor->dev;
28895 atomic_inc(&dev->ioctl_count);
28896 - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
28897 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
28898 ++file_priv->ioctl_count;
28899
28900 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
28901 diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_fops.c linux-2.6.39.1/drivers/gpu/drm/drm_fops.c
28902 --- linux-2.6.39.1/drivers/gpu/drm/drm_fops.c 2011-05-19 00:06:34.000000000 -0400
28903 +++ linux-2.6.39.1/drivers/gpu/drm/drm_fops.c 2011-05-22 19:36:31.000000000 -0400
28904 @@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
28905 }
28906
28907 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
28908 - atomic_set(&dev->counts[i], 0);
28909 + atomic_set_unchecked(&dev->counts[i], 0);
28910
28911 dev->sigdata.lock = NULL;
28912
28913 @@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct
28914
28915 retcode = drm_open_helper(inode, filp, dev);
28916 if (!retcode) {
28917 - atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
28918 - if (!dev->open_count++)
28919 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
28920 + if (local_inc_return(&dev->open_count) == 1)
28921 retcode = drm_setup(dev);
28922 }
28923 if (!retcode) {
28924 @@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
28925
28926 mutex_lock(&drm_global_mutex);
28927
28928 - DRM_DEBUG("open_count = %d\n", dev->open_count);
28929 + DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
28930
28931 if (dev->driver->preclose)
28932 dev->driver->preclose(dev, file_priv);
28933 @@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
28934 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
28935 task_pid_nr(current),
28936 (long)old_encode_dev(file_priv->minor->device),
28937 - dev->open_count);
28938 + local_read(&dev->open_count));
28939
28940 /* if the master has gone away we can't do anything with the lock */
28941 if (file_priv->minor->master)
28942 @@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str
28943 * End inline drm_release
28944 */
28945
28946 - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
28947 - if (!--dev->open_count) {
28948 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
28949 + if (local_dec_and_test(&dev->open_count)) {
28950 if (atomic_read(&dev->ioctl_count)) {
28951 DRM_ERROR("Device busy: %d\n",
28952 atomic_read(&dev->ioctl_count));
28953 diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_global.c linux-2.6.39.1/drivers/gpu/drm/drm_global.c
28954 --- linux-2.6.39.1/drivers/gpu/drm/drm_global.c 2011-05-19 00:06:34.000000000 -0400
28955 +++ linux-2.6.39.1/drivers/gpu/drm/drm_global.c 2011-05-22 19:36:31.000000000 -0400
28956 @@ -36,7 +36,7 @@
28957 struct drm_global_item {
28958 struct mutex mutex;
28959 void *object;
28960 - int refcount;
28961 + atomic_t refcount;
28962 };
28963
28964 static struct drm_global_item glob[DRM_GLOBAL_NUM];
28965 @@ -49,7 +49,7 @@ void drm_global_init(void)
28966 struct drm_global_item *item = &glob[i];
28967 mutex_init(&item->mutex);
28968 item->object = NULL;
28969 - item->refcount = 0;
28970 + atomic_set(&item->refcount, 0);
28971 }
28972 }
28973
28974 @@ -59,7 +59,7 @@ void drm_global_release(void)
28975 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
28976 struct drm_global_item *item = &glob[i];
28977 BUG_ON(item->object != NULL);
28978 - BUG_ON(item->refcount != 0);
28979 + BUG_ON(atomic_read(&item->refcount) != 0);
28980 }
28981 }
28982
28983 @@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa
28984 void *object;
28985
28986 mutex_lock(&item->mutex);
28987 - if (item->refcount == 0) {
28988 + if (atomic_read(&item->refcount) == 0) {
28989 item->object = kzalloc(ref->size, GFP_KERNEL);
28990 if (unlikely(item->object == NULL)) {
28991 ret = -ENOMEM;
28992 @@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa
28993 goto out_err;
28994
28995 }
28996 - ++item->refcount;
28997 + atomic_inc(&item->refcount);
28998 ref->object = item->object;
28999 object = item->object;
29000 mutex_unlock(&item->mutex);
29001 @@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl
29002 struct drm_global_item *item = &glob[ref->global_type];
29003
29004 mutex_lock(&item->mutex);
29005 - BUG_ON(item->refcount == 0);
29006 + BUG_ON(atomic_read(&item->refcount) == 0);
29007 BUG_ON(ref->object != item->object);
29008 - if (--item->refcount == 0) {
29009 + if (atomic_dec_and_test(&item->refcount)) {
29010 ref->release(ref);
29011 item->object = NULL;
29012 }
29013 diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_info.c linux-2.6.39.1/drivers/gpu/drm/drm_info.c
29014 --- linux-2.6.39.1/drivers/gpu/drm/drm_info.c 2011-05-19 00:06:34.000000000 -0400
29015 +++ linux-2.6.39.1/drivers/gpu/drm/drm_info.c 2011-05-22 19:41:37.000000000 -0400
29016 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
29017 struct drm_local_map *map;
29018 struct drm_map_list *r_list;
29019
29020 - /* Hardcoded from _DRM_FRAME_BUFFER,
29021 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
29022 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
29023 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
29024 + static const char * const types[] = {
29025 + [_DRM_FRAME_BUFFER] = "FB",
29026 + [_DRM_REGISTERS] = "REG",
29027 + [_DRM_SHM] = "SHM",
29028 + [_DRM_AGP] = "AGP",
29029 + [_DRM_SCATTER_GATHER] = "SG",
29030 + [_DRM_CONSISTENT] = "PCI",
29031 + [_DRM_GEM] = "GEM" };
29032 const char *type;
29033 int i;
29034
29035 @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
29036 map = r_list->map;
29037 if (!map)
29038 continue;
29039 - if (map->type < 0 || map->type > 5)
29040 + if (map->type >= ARRAY_SIZE(types))
29041 type = "??";
29042 else
29043 type = types[map->type];
29044 @@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi
29045 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
29046 vma->vm_flags & VM_LOCKED ? 'l' : '-',
29047 vma->vm_flags & VM_IO ? 'i' : '-',
29048 +#ifdef CONFIG_GRKERNSEC_HIDESYM
29049 + 0);
29050 +#else
29051 vma->vm_pgoff);
29052 +#endif
29053
29054 #if defined(__i386__)
29055 pgprot = pgprot_val(vma->vm_page_prot);
29056 diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c
29057 --- linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c 2011-05-19 00:06:34.000000000 -0400
29058 +++ linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c 2011-05-22 19:36:31.000000000 -0400
29059 @@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev,
29060 stats->data[i].value =
29061 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
29062 else
29063 - stats->data[i].value = atomic_read(&dev->counts[i]);
29064 + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
29065 stats->data[i].type = dev->types[i];
29066 }
29067
29068 diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_lock.c linux-2.6.39.1/drivers/gpu/drm/drm_lock.c
29069 --- linux-2.6.39.1/drivers/gpu/drm/drm_lock.c 2011-05-19 00:06:34.000000000 -0400
29070 +++ linux-2.6.39.1/drivers/gpu/drm/drm_lock.c 2011-05-22 19:36:31.000000000 -0400
29071 @@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
29072 if (drm_lock_take(&master->lock, lock->context)) {
29073 master->lock.file_priv = file_priv;
29074 master->lock.lock_time = jiffies;
29075 - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
29076 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
29077 break; /* Got lock */
29078 }
29079
29080 @@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v
29081 return -EINVAL;
29082 }
29083
29084 - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
29085 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
29086
29087 if (drm_lock_free(&master->lock, lock->context)) {
29088 /* FIXME: Should really bail out here. */
29089 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c
29090 --- linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c 2011-05-19 00:06:34.000000000 -0400
29091 +++ linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c 2011-05-22 19:36:31.000000000 -0400
29092 @@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de
29093 dma->buflist[vertex->idx],
29094 vertex->discard, vertex->used);
29095
29096 - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
29097 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
29098 + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
29099 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
29100 sarea_priv->last_enqueue = dev_priv->counter - 1;
29101 sarea_priv->last_dispatch = (int)hw_status[5];
29102
29103 @@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device
29104 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
29105 mc->last_render);
29106
29107 - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
29108 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
29109 + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
29110 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
29111 sarea_priv->last_enqueue = dev_priv->counter - 1;
29112 sarea_priv->last_dispatch = (int)hw_status[5];
29113
29114 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h
29115 --- linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h 2011-05-19 00:06:34.000000000 -0400
29116 +++ linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h 2011-05-22 19:36:31.000000000 -0400
29117 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
29118 int page_flipping;
29119
29120 wait_queue_head_t irq_queue;
29121 - atomic_t irq_received;
29122 - atomic_t irq_emitted;
29123 + atomic_unchecked_t irq_received;
29124 + atomic_unchecked_t irq_emitted;
29125
29126 int front_offset;
29127 } drm_i810_private_t;
29128 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c
29129 --- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-19 00:06:34.000000000 -0400
29130 +++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-22 19:36:31.000000000 -0400
29131 @@ -390,7 +390,7 @@ static void ch7017_destroy(struct intel_
29132 }
29133 }
29134
29135 -struct intel_dvo_dev_ops ch7017_ops = {
29136 +const struct intel_dvo_dev_ops ch7017_ops = {
29137 .init = ch7017_init,
29138 .detect = ch7017_detect,
29139 .mode_valid = ch7017_mode_valid,
29140 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c
29141 --- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-19 00:06:34.000000000 -0400
29142 +++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-22 19:36:31.000000000 -0400
29143 @@ -320,7 +320,7 @@ static void ch7xxx_destroy(struct intel_
29144 }
29145 }
29146
29147 -struct intel_dvo_dev_ops ch7xxx_ops = {
29148 +const struct intel_dvo_dev_ops ch7xxx_ops = {
29149 .init = ch7xxx_init,
29150 .detect = ch7xxx_detect,
29151 .mode_valid = ch7xxx_mode_valid,
29152 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h
29153 --- linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h 2011-05-19 00:06:34.000000000 -0400
29154 +++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h 2011-05-22 19:36:31.000000000 -0400
29155 @@ -122,23 +122,23 @@ struct intel_dvo_dev_ops {
29156 *
29157 * \return singly-linked list of modes or NULL if no modes found.
29158 */
29159 - struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
29160 + struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
29161
29162 /**
29163 * Clean up driver-specific bits of the output
29164 */
29165 - void (*destroy) (struct intel_dvo_device *dvo);
29166 + void (* const destroy) (struct intel_dvo_device *dvo);
29167
29168 /**
29169 * Debugging hook to dump device registers to log file
29170 */
29171 - void (*dump_regs)(struct intel_dvo_device *dvo);
29172 + void (* const dump_regs)(struct intel_dvo_device *dvo);
29173 };
29174
29175 -extern struct intel_dvo_dev_ops sil164_ops;
29176 -extern struct intel_dvo_dev_ops ch7xxx_ops;
29177 -extern struct intel_dvo_dev_ops ivch_ops;
29178 -extern struct intel_dvo_dev_ops tfp410_ops;
29179 -extern struct intel_dvo_dev_ops ch7017_ops;
29180 +extern const struct intel_dvo_dev_ops sil164_ops;
29181 +extern const struct intel_dvo_dev_ops ch7xxx_ops;
29182 +extern const struct intel_dvo_dev_ops ivch_ops;
29183 +extern const struct intel_dvo_dev_ops tfp410_ops;
29184 +extern const struct intel_dvo_dev_ops ch7017_ops;
29185
29186 #endif /* _INTEL_DVO_H */
29187 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c
29188 --- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-19 00:06:34.000000000 -0400
29189 +++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-22 19:36:31.000000000 -0400
29190 @@ -410,7 +410,7 @@ static void ivch_destroy(struct intel_dv
29191 }
29192 }
29193
29194 -struct intel_dvo_dev_ops ivch_ops= {
29195 +const struct intel_dvo_dev_ops ivch_ops= {
29196 .init = ivch_init,
29197 .dpms = ivch_dpms,
29198 .mode_valid = ivch_mode_valid,
29199 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c
29200 --- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-19 00:06:34.000000000 -0400
29201 +++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-22 19:36:31.000000000 -0400
29202 @@ -252,7 +252,7 @@ static void sil164_destroy(struct intel_
29203 }
29204 }
29205
29206 -struct intel_dvo_dev_ops sil164_ops = {
29207 +const struct intel_dvo_dev_ops sil164_ops = {
29208 .init = sil164_init,
29209 .detect = sil164_detect,
29210 .mode_valid = sil164_mode_valid,
29211 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c
29212 --- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-19 00:06:34.000000000 -0400
29213 +++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-22 19:36:31.000000000 -0400
29214 @@ -293,7 +293,7 @@ static void tfp410_destroy(struct intel_
29215 }
29216 }
29217
29218 -struct intel_dvo_dev_ops tfp410_ops = {
29219 +const struct intel_dvo_dev_ops tfp410_ops = {
29220 .init = tfp410_init,
29221 .detect = tfp410_detect,
29222 .mode_valid = tfp410_mode_valid,
29223 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c
29224 --- linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-19 00:06:34.000000000 -0400
29225 +++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-22 19:36:31.000000000 -0400
29226 @@ -496,7 +496,7 @@ static int i915_interrupt_info(struct se
29227 I915_READ(GTIMR));
29228 }
29229 seq_printf(m, "Interrupts received: %d\n",
29230 - atomic_read(&dev_priv->irq_received));
29231 + atomic_read_unchecked(&dev_priv->irq_received));
29232 for (i = 0; i < I915_NUM_RINGS; i++) {
29233 if (IS_GEN6(dev)) {
29234 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
29235 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c
29236 --- linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c 2011-05-19 00:06:34.000000000 -0400
29237 +++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c 2011-05-22 19:36:31.000000000 -0400
29238 @@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(s
29239 bool can_switch;
29240
29241 spin_lock(&dev->count_lock);
29242 - can_switch = (dev->open_count == 0);
29243 + can_switch = (local_read(&dev->open_count) == 0);
29244 spin_unlock(&dev->count_lock);
29245 return can_switch;
29246 }
29247 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c
29248 --- linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c 2011-05-19 00:06:34.000000000 -0400
29249 +++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c 2011-05-22 19:36:31.000000000 -0400
29250 @@ -679,7 +679,7 @@ static const struct dev_pm_ops i915_pm_o
29251 .restore = i915_pm_resume,
29252 };
29253
29254 -static struct vm_operations_struct i915_gem_vm_ops = {
29255 +static const struct vm_operations_struct i915_gem_vm_ops = {
29256 .fault = i915_gem_fault,
29257 .open = drm_gem_vm_open,
29258 .close = drm_gem_vm_close,
29259 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h
29260 --- linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h 2011-05-19 00:06:34.000000000 -0400
29261 +++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h 2011-05-22 19:36:31.000000000 -0400
29262 @@ -287,7 +287,7 @@ typedef struct drm_i915_private {
29263 int current_page;
29264 int page_flipping;
29265
29266 - atomic_t irq_received;
29267 + atomic_unchecked_t irq_received;
29268
29269 /* protects the irq masks */
29270 spinlock_t irq_lock;
29271 @@ -848,7 +848,7 @@ struct drm_i915_gem_object {
29272 * will be page flipped away on the next vblank. When it
29273 * reaches 0, dev_priv->pending_flip_queue will be woken up.
29274 */
29275 - atomic_t pending_flip;
29276 + atomic_unchecked_t pending_flip;
29277 };
29278
29279 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
29280 @@ -1232,7 +1232,7 @@ extern int intel_setup_gmbus(struct drm_
29281 extern void intel_teardown_gmbus(struct drm_device *dev);
29282 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
29283 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
29284 -extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29285 +static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29286 {
29287 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
29288 }
29289 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c
29290 --- linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-19 00:06:34.000000000 -0400
29291 +++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-22 19:36:31.000000000 -0400
29292 @@ -192,7 +192,7 @@ i915_gem_object_set_to_gpu_domain(struct
29293 i915_gem_release_mmap(obj);
29294
29295 if (obj->base.pending_write_domain)
29296 - cd->flips |= atomic_read(&obj->pending_flip);
29297 + cd->flips |= atomic_read_unchecked(&obj->pending_flip);
29298
29299 /* The actual obj->write_domain will be updated with
29300 * pending_write_domain after we emit the accumulated flush for all
29301 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c
29302 --- linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c 2011-05-19 00:06:34.000000000 -0400
29303 +++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c 2011-05-22 19:36:31.000000000 -0400
29304 @@ -1101,7 +1101,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
29305 int ret = IRQ_NONE, pipe;
29306 bool blc_event = false;
29307
29308 - atomic_inc(&dev_priv->irq_received);
29309 + atomic_inc_unchecked(&dev_priv->irq_received);
29310
29311 if (HAS_PCH_SPLIT(dev))
29312 return ironlake_irq_handler(dev);
29313 @@ -1655,7 +1655,7 @@ void i915_driver_irq_preinstall(struct d
29314 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
29315 int pipe;
29316
29317 - atomic_set(&dev_priv->irq_received, 0);
29318 + atomic_set_unchecked(&dev_priv->irq_received, 0);
29319
29320 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
29321 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
29322 diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c
29323 --- linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c 2011-05-19 00:06:34.000000000 -0400
29324 +++ linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c 2011-05-22 19:36:31.000000000 -0400
29325 @@ -2244,7 +2244,7 @@ intel_pipe_set_base(struct drm_crtc *crt
29326
29327 wait_event(dev_priv->pending_flip_queue,
29328 atomic_read(&dev_priv->mm.wedged) ||
29329 - atomic_read(&obj->pending_flip) == 0);
29330 + atomic_read_unchecked(&obj->pending_flip) == 0);
29331
29332 /* Big Hammer, we also need to ensure that any pending
29333 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
29334 @@ -2712,7 +2712,7 @@ static void intel_crtc_wait_for_pending_
29335 obj = to_intel_framebuffer(crtc->fb)->obj;
29336 dev_priv = crtc->dev->dev_private;
29337 wait_event(dev_priv->pending_flip_queue,
29338 - atomic_read(&obj->pending_flip) == 0);
29339 + atomic_read_unchecked(&obj->pending_flip) == 0);
29340 }
29341
29342 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
29343 @@ -6016,7 +6016,7 @@ static void do_intel_finish_page_flip(st
29344
29345 atomic_clear_mask(1 << intel_crtc->plane,
29346 &obj->pending_flip.counter);
29347 - if (atomic_read(&obj->pending_flip) == 0)
29348 + if (atomic_read_unchecked(&obj->pending_flip) == 0)
29349 wake_up(&dev_priv->pending_flip_queue);
29350
29351 schedule_work(&work->work);
29352 @@ -6145,7 +6145,7 @@ static int intel_crtc_page_flip(struct d
29353 /* Block clients from rendering to the new back buffer until
29354 * the flip occurs and the object is no longer visible.
29355 */
29356 - atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29357 + atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29358
29359 switch (INTEL_INFO(dev)->gen) {
29360 case 2:
29361 diff -urNp linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h
29362 --- linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h 2011-05-19 00:06:34.000000000 -0400
29363 +++ linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h 2011-05-22 19:36:31.000000000 -0400
29364 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
29365 u32 clear_cmd;
29366 u32 maccess;
29367
29368 - atomic_t vbl_received; /**< Number of vblanks received. */
29369 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
29370 wait_queue_head_t fence_queue;
29371 - atomic_t last_fence_retired;
29372 + atomic_unchecked_t last_fence_retired;
29373 u32 next_fence_to_post;
29374
29375 unsigned int fb_cpp;
29376 diff -urNp linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c
29377 --- linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c 2011-05-19 00:06:34.000000000 -0400
29378 +++ linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c 2011-05-22 19:36:31.000000000 -0400
29379 @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
29380 if (crtc != 0)
29381 return 0;
29382
29383 - return atomic_read(&dev_priv->vbl_received);
29384 + return atomic_read_unchecked(&dev_priv->vbl_received);
29385 }
29386
29387
29388 @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29389 /* VBLANK interrupt */
29390 if (status & MGA_VLINEPEN) {
29391 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
29392 - atomic_inc(&dev_priv->vbl_received);
29393 + atomic_inc_unchecked(&dev_priv->vbl_received);
29394 drm_handle_vblank(dev, 0);
29395 handled = 1;
29396 }
29397 @@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29398 if ((prim_start & ~0x03) != (prim_end & ~0x03))
29399 MGA_WRITE(MGA_PRIMEND, prim_end);
29400
29401 - atomic_inc(&dev_priv->last_fence_retired);
29402 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
29403 DRM_WAKEUP(&dev_priv->fence_queue);
29404 handled = 1;
29405 }
29406 @@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
29407 * using fences.
29408 */
29409 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
29410 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
29411 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
29412 - *sequence) <= (1 << 23)));
29413
29414 *sequence = cur_fence;
29415 diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c
29416 --- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-19 00:06:34.000000000 -0400
29417 +++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-22 19:36:31.000000000 -0400
29418 @@ -141,7 +141,7 @@ static int nouveau_dsm_get_client_id(str
29419 return VGA_SWITCHEROO_DIS;
29420 }
29421
29422 -static struct vga_switcheroo_handler nouveau_dsm_handler = {
29423 +static const struct vga_switcheroo_handler nouveau_dsm_handler = {
29424 .switchto = nouveau_dsm_switchto,
29425 .power_state = nouveau_dsm_power_state,
29426 .init = nouveau_dsm_init,
29427 diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h
29428 --- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-19 00:06:34.000000000 -0400
29429 +++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-06-07 18:07:24.000000000 -0400
29430 @@ -228,7 +228,7 @@ struct nouveau_channel {
29431 struct list_head pending;
29432 uint32_t sequence;
29433 uint32_t sequence_ack;
29434 - atomic_t last_sequence_irq;
29435 + atomic_unchecked_t last_sequence_irq;
29436 } fence;
29437
29438 /* DMA push buffer */
29439 @@ -662,7 +662,7 @@ struct drm_nouveau_private {
29440 struct drm_global_reference mem_global_ref;
29441 struct ttm_bo_global_ref bo_global_ref;
29442 struct ttm_bo_device bdev;
29443 - atomic_t validate_sequence;
29444 + atomic_unchecked_t validate_sequence;
29445 } ttm;
29446
29447 struct {
29448 diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c
29449 --- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-19 00:06:34.000000000 -0400
29450 +++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-22 19:36:31.000000000 -0400
29451 @@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan
29452 if (USE_REFCNT(dev))
29453 sequence = nvchan_rd32(chan, 0x48);
29454 else
29455 - sequence = atomic_read(&chan->fence.last_sequence_irq);
29456 + sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
29457
29458 if (chan->fence.sequence_ack == sequence)
29459 goto out;
29460 @@ -553,7 +553,7 @@ nouveau_fence_channel_init(struct nouvea
29461 out_initialised:
29462 INIT_LIST_HEAD(&chan->fence.pending);
29463 spin_lock_init(&chan->fence.lock);
29464 - atomic_set(&chan->fence.last_sequence_irq, 0);
29465 + atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
29466 return 0;
29467 }
29468
29469 diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c
29470 --- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-19 00:06:34.000000000 -0400
29471 +++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-22 19:36:31.000000000 -0400
29472 @@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch
29473 int trycnt = 0;
29474 int ret, i;
29475
29476 - sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
29477 + sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
29478 retry:
29479 if (++trycnt > 100000) {
29480 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
29481 diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c
29482 --- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-19 00:06:34.000000000 -0400
29483 +++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-22 19:36:31.000000000 -0400
29484 @@ -583,7 +583,7 @@ static bool nouveau_switcheroo_can_switc
29485 bool can_switch;
29486
29487 spin_lock(&dev->count_lock);
29488 - can_switch = (dev->open_count == 0);
29489 + can_switch = (local_read(&dev->open_count) == 0);
29490 spin_unlock(&dev->count_lock);
29491 return can_switch;
29492 }
29493 diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c
29494 --- linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-19 00:06:34.000000000 -0400
29495 +++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-22 19:36:31.000000000 -0400
29496 @@ -552,7 +552,7 @@ static int
29497 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
29498 u32 class, u32 mthd, u32 data)
29499 {
29500 - atomic_set(&chan->fence.last_sequence_irq, data);
29501 + atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
29502 return 0;
29503 }
29504
29505 diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c
29506 --- linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c 2011-05-19 00:06:34.000000000 -0400
29507 +++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c 2011-05-22 19:36:31.000000000 -0400
29508 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
29509
29510 /* GH: Simple idle check.
29511 */
29512 - atomic_set(&dev_priv->idle_count, 0);
29513 + atomic_set_unchecked(&dev_priv->idle_count, 0);
29514
29515 /* We don't support anything other than bus-mastering ring mode,
29516 * but the ring can be in either AGP or PCI space for the ring
29517 diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h
29518 --- linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h 2011-05-19 00:06:34.000000000 -0400
29519 +++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h 2011-05-22 19:36:31.000000000 -0400
29520 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
29521 int is_pci;
29522 unsigned long cce_buffers_offset;
29523
29524 - atomic_t idle_count;
29525 + atomic_unchecked_t idle_count;
29526
29527 int page_flipping;
29528 int current_page;
29529 u32 crtc_offset;
29530 u32 crtc_offset_cntl;
29531
29532 - atomic_t vbl_received;
29533 + atomic_unchecked_t vbl_received;
29534
29535 u32 color_fmt;
29536 unsigned int front_offset;
29537 diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c
29538 --- linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c 2011-05-19 00:06:34.000000000 -0400
29539 +++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c 2011-05-22 19:36:31.000000000 -0400
29540 @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
29541 if (crtc != 0)
29542 return 0;
29543
29544 - return atomic_read(&dev_priv->vbl_received);
29545 + return atomic_read_unchecked(&dev_priv->vbl_received);
29546 }
29547
29548 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
29549 @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
29550 /* VBLANK interrupt */
29551 if (status & R128_CRTC_VBLANK_INT) {
29552 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
29553 - atomic_inc(&dev_priv->vbl_received);
29554 + atomic_inc_unchecked(&dev_priv->vbl_received);
29555 drm_handle_vblank(dev, 0);
29556 return IRQ_HANDLED;
29557 }
29558 diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c
29559 --- linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c 2011-05-19 00:06:34.000000000 -0400
29560 +++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c 2011-05-22 19:36:31.000000000 -0400
29561 @@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
29562
29563 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
29564 {
29565 - if (atomic_read(&dev_priv->idle_count) == 0)
29566 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
29567 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
29568 else
29569 - atomic_set(&dev_priv->idle_count, 0);
29570 + atomic_set_unchecked(&dev_priv->idle_count, 0);
29571 }
29572
29573 #endif
29574 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c
29575 --- linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c 2011-05-19 00:06:34.000000000 -0400
29576 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c 2011-05-22 19:36:31.000000000 -0400
29577 @@ -1245,6 +1245,8 @@ struct atom_context *atom_parse(struct c
29578 char name[512];
29579 int i;
29580
29581 + pax_track_stack();
29582 +
29583 ctx->card = card;
29584 ctx->bios = bios;
29585
29586 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c
29587 --- linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c 2011-05-19 00:06:34.000000000 -0400
29588 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c 2011-05-22 19:36:31.000000000 -0400
29589 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
29590 regex_t mask_rex;
29591 regmatch_t match[4];
29592 char buf[1024];
29593 - size_t end;
29594 + long end;
29595 int len;
29596 int done = 0;
29597 int r;
29598 unsigned o;
29599 struct offset *offset;
29600 char last_reg_s[10];
29601 - int last_reg;
29602 + unsigned long last_reg;
29603
29604 if (regcomp
29605 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
29606 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c
29607 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-19 00:06:34.000000000 -0400
29608 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-22 19:36:31.000000000 -0400
29609 @@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
29610 struct radeon_gpio_rec gpio;
29611 struct radeon_hpd hpd;
29612
29613 + pax_track_stack();
29614 +
29615 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
29616 return false;
29617
29618 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c
29619 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-19 00:06:34.000000000 -0400
29620 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-22 19:36:31.000000000 -0400
29621 @@ -234,7 +234,7 @@ static int radeon_atpx_get_client_id(str
29622 return VGA_SWITCHEROO_DIS;
29623 }
29624
29625 -static struct vga_switcheroo_handler radeon_atpx_handler = {
29626 +static const struct vga_switcheroo_handler radeon_atpx_handler = {
29627 .switchto = radeon_atpx_switchto,
29628 .power_state = radeon_atpx_power_state,
29629 .init = radeon_atpx_init,
29630 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c
29631 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c 2011-05-19 00:06:34.000000000 -0400
29632 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c 2011-05-22 19:36:31.000000000 -0400
29633 @@ -674,7 +674,7 @@ static bool radeon_switcheroo_can_switch
29634 bool can_switch;
29635
29636 spin_lock(&dev->count_lock);
29637 - can_switch = (dev->open_count == 0);
29638 + can_switch = (local_read(&dev->open_count) == 0);
29639 spin_unlock(&dev->count_lock);
29640 return can_switch;
29641 }
29642 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c
29643 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c 2011-05-19 00:06:34.000000000 -0400
29644 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c 2011-05-22 19:36:31.000000000 -0400
29645 @@ -934,6 +934,8 @@ void radeon_compute_pll_legacy(struct ra
29646 uint32_t post_div;
29647 u32 pll_out_min, pll_out_max;
29648
29649 + pax_track_stack();
29650 +
29651 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
29652 freq = freq * 1000;
29653
29654 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h
29655 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-19 00:06:34.000000000 -0400
29656 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-22 19:36:31.000000000 -0400
29657 @@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
29658
29659 /* SW interrupt */
29660 wait_queue_head_t swi_queue;
29661 - atomic_t swi_emitted;
29662 + atomic_unchecked_t swi_emitted;
29663 int vblank_crtc;
29664 uint32_t irq_enable_reg;
29665 uint32_t r500_disp_irq_reg;
29666 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c
29667 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-19 00:06:34.000000000 -0400
29668 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-22 19:36:31.000000000 -0400
29669 @@ -49,7 +49,7 @@ int radeon_fence_emit(struct radeon_devi
29670 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
29671 return 0;
29672 }
29673 - fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
29674 + fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
29675 if (!rdev->cp.ready) {
29676 /* FIXME: cp is not running assume everythings is done right
29677 * away
29678 @@ -352,7 +352,7 @@ int radeon_fence_driver_init(struct rade
29679 return r;
29680 }
29681 WREG32(rdev->fence_drv.scratch_reg, 0);
29682 - atomic_set(&rdev->fence_drv.seq, 0);
29683 + atomic_set_unchecked(&rdev->fence_drv.seq, 0);
29684 INIT_LIST_HEAD(&rdev->fence_drv.created);
29685 INIT_LIST_HEAD(&rdev->fence_drv.emited);
29686 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
29687 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h
29688 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h 2011-05-19 00:06:34.000000000 -0400
29689 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h 2011-05-22 19:36:31.000000000 -0400
29690 @@ -189,7 +189,7 @@ extern int sumo_get_temp(struct radeon_d
29691 */
29692 struct radeon_fence_driver {
29693 uint32_t scratch_reg;
29694 - atomic_t seq;
29695 + atomic_unchecked_t seq;
29696 uint32_t last_seq;
29697 unsigned long last_jiffies;
29698 unsigned long last_timeout;
29699 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c
29700 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-19 00:06:34.000000000 -0400
29701 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-22 19:36:31.000000000 -0400
29702 @@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
29703 request = compat_alloc_user_space(sizeof(*request));
29704 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
29705 || __put_user(req32.param, &request->param)
29706 - || __put_user((void __user *)(unsigned long)req32.value,
29707 + || __put_user((unsigned long)req32.value,
29708 &request->value))
29709 return -EFAULT;
29710
29711 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c
29712 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-19 00:06:34.000000000 -0400
29713 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-22 19:36:31.000000000 -0400
29714 @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
29715 unsigned int ret;
29716 RING_LOCALS;
29717
29718 - atomic_inc(&dev_priv->swi_emitted);
29719 - ret = atomic_read(&dev_priv->swi_emitted);
29720 + atomic_inc_unchecked(&dev_priv->swi_emitted);
29721 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
29722
29723 BEGIN_RING(4);
29724 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
29725 @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
29726 drm_radeon_private_t *dev_priv =
29727 (drm_radeon_private_t *) dev->dev_private;
29728
29729 - atomic_set(&dev_priv->swi_emitted, 0);
29730 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
29731 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
29732
29733 dev->max_vblank_count = 0x001fffff;
29734 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c
29735 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c 2011-05-19 00:06:34.000000000 -0400
29736 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c 2011-05-22 19:36:31.000000000 -0400
29737 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
29738 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
29739 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
29740
29741 - if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29742 + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29743 sarea_priv->nbox * sizeof(depth_boxes[0])))
29744 return -EFAULT;
29745
29746 @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm
29747 {
29748 drm_radeon_private_t *dev_priv = dev->dev_private;
29749 drm_radeon_getparam_t *param = data;
29750 - int value;
29751 + int value = 0;
29752
29753 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
29754
29755 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c
29756 --- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-19 00:06:34.000000000 -0400
29757 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-22 19:36:31.000000000 -0400
29758 @@ -603,8 +603,9 @@ void radeon_ttm_set_active_vram_size(str
29759 man->size = size >> PAGE_SHIFT;
29760 }
29761
29762 -static struct vm_operations_struct radeon_ttm_vm_ops;
29763 -static const struct vm_operations_struct *ttm_vm_ops = NULL;
29764 +extern int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
29765 +extern void ttm_bo_vm_open(struct vm_area_struct *vma);
29766 +extern void ttm_bo_vm_close(struct vm_area_struct *vma);
29767
29768 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29769 {
29770 @@ -612,17 +613,22 @@ static int radeon_ttm_fault(struct vm_ar
29771 struct radeon_device *rdev;
29772 int r;
29773
29774 - bo = (struct ttm_buffer_object *)vma->vm_private_data;
29775 - if (bo == NULL) {
29776 + bo = (struct ttm_buffer_object *)vma->vm_private_data;
29777 + if (!bo)
29778 return VM_FAULT_NOPAGE;
29779 - }
29780 rdev = radeon_get_rdev(bo->bdev);
29781 mutex_lock(&rdev->vram_mutex);
29782 - r = ttm_vm_ops->fault(vma, vmf);
29783 + r = ttm_bo_vm_fault(vma, vmf);
29784 mutex_unlock(&rdev->vram_mutex);
29785 return r;
29786 }
29787
29788 +static const struct vm_operations_struct radeon_ttm_vm_ops = {
29789 + .fault = radeon_ttm_fault,
29790 + .open = ttm_bo_vm_open,
29791 + .close = ttm_bo_vm_close
29792 +};
29793 +
29794 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
29795 {
29796 struct drm_file *file_priv;
29797 @@ -635,18 +641,11 @@ int radeon_mmap(struct file *filp, struc
29798
29799 file_priv = filp->private_data;
29800 rdev = file_priv->minor->dev->dev_private;
29801 - if (rdev == NULL) {
29802 + if (!rdev)
29803 return -EINVAL;
29804 - }
29805 r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
29806 - if (unlikely(r != 0)) {
29807 + if (r)
29808 return r;
29809 - }
29810 - if (unlikely(ttm_vm_ops == NULL)) {
29811 - ttm_vm_ops = vma->vm_ops;
29812 - radeon_ttm_vm_ops = *ttm_vm_ops;
29813 - radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
29814 - }
29815 vma->vm_ops = &radeon_ttm_vm_ops;
29816 return 0;
29817 }
29818 diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c
29819 --- linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c 2011-05-19 00:06:34.000000000 -0400
29820 +++ linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c 2011-05-22 19:36:31.000000000 -0400
29821 @@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
29822 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
29823 rdev->pm.sideport_bandwidth.full)
29824 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
29825 - read_delay_latency.full = dfixed_const(370 * 800 * 1000);
29826 + read_delay_latency.full = dfixed_const(800 * 1000);
29827 read_delay_latency.full = dfixed_div(read_delay_latency,
29828 rdev->pm.igp_sideport_mclk);
29829 + a.full = dfixed_const(370);
29830 + read_delay_latency.full = dfixed_mul(read_delay_latency, a);
29831 } else {
29832 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
29833 rdev->pm.k8_bandwidth.full)
29834 diff -urNp linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c
29835 --- linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-19 00:06:34.000000000 -0400
29836 +++ linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-22 19:36:31.000000000 -0400
29837 @@ -69,11 +69,11 @@ static struct ttm_buffer_object *ttm_bo_
29838 return best_bo;
29839 }
29840
29841 -static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29842 +int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29843 {
29844 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
29845 vma->vm_private_data;
29846 - struct ttm_bo_device *bdev = bo->bdev;
29847 + struct ttm_bo_device *bdev;
29848 unsigned long page_offset;
29849 unsigned long page_last;
29850 unsigned long pfn;
29851 @@ -83,8 +83,12 @@ static int ttm_bo_vm_fault(struct vm_are
29852 int i;
29853 unsigned long address = (unsigned long)vmf->virtual_address;
29854 int retval = VM_FAULT_NOPAGE;
29855 - struct ttm_mem_type_manager *man =
29856 - &bdev->man[bo->mem.mem_type];
29857 + struct ttm_mem_type_manager *man;
29858 +
29859 + if (!bo)
29860 + return VM_FAULT_NOPAGE;
29861 + bdev = bo->bdev;
29862 + man = &bdev->man[bo->mem.mem_type];
29863
29864 /*
29865 * Work around locking order reversal in fault / nopfn
29866 @@ -219,22 +223,25 @@ out_unlock:
29867 ttm_bo_unreserve(bo);
29868 return retval;
29869 }
29870 +EXPORT_SYMBOL(ttm_bo_vm_fault);
29871
29872 -static void ttm_bo_vm_open(struct vm_area_struct *vma)
29873 +void ttm_bo_vm_open(struct vm_area_struct *vma)
29874 {
29875 struct ttm_buffer_object *bo =
29876 (struct ttm_buffer_object *)vma->vm_private_data;
29877
29878 (void)ttm_bo_reference(bo);
29879 }
29880 +EXPORT_SYMBOL(ttm_bo_vm_open);
29881
29882 -static void ttm_bo_vm_close(struct vm_area_struct *vma)
29883 +void ttm_bo_vm_close(struct vm_area_struct *vma)
29884 {
29885 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)vma->vm_private_data;
29886
29887 ttm_bo_unref(&bo);
29888 vma->vm_private_data = NULL;
29889 }
29890 +EXPORT_SYMBOL(ttm_bo_vm_close);
29891
29892 static const struct vm_operations_struct ttm_bo_vm_ops = {
29893 .fault = ttm_bo_vm_fault,
29894 diff -urNp linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c
29895 --- linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-19 00:06:34.000000000 -0400
29896 +++ linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-22 19:36:31.000000000 -0400
29897 @@ -397,9 +397,9 @@ static int ttm_pool_get_num_unused_pages
29898 */
29899 static int ttm_pool_mm_shrink(struct shrinker *shrink, int shrink_pages, gfp_t gfp_mask)
29900 {
29901 - static atomic_t start_pool = ATOMIC_INIT(0);
29902 + static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
29903 unsigned i;
29904 - unsigned pool_offset = atomic_add_return(1, &start_pool);
29905 + unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
29906 struct ttm_page_pool *pool;
29907
29908 pool_offset = pool_offset % NUM_POOLS;
29909 diff -urNp linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h
29910 --- linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h 2011-05-19 00:06:34.000000000 -0400
29911 +++ linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h 2011-05-22 19:36:31.000000000 -0400
29912 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
29913 typedef uint32_t maskarray_t[5];
29914
29915 typedef struct drm_via_irq {
29916 - atomic_t irq_received;
29917 + atomic_unchecked_t irq_received;
29918 uint32_t pending_mask;
29919 uint32_t enable_mask;
29920 wait_queue_head_t irq_queue;
29921 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
29922 struct timeval last_vblank;
29923 int last_vblank_valid;
29924 unsigned usec_per_vblank;
29925 - atomic_t vbl_received;
29926 + atomic_unchecked_t vbl_received;
29927 drm_via_state_t hc_state;
29928 char pci_buf[VIA_PCI_BUF_SIZE];
29929 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
29930 diff -urNp linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c
29931 --- linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c 2011-05-19 00:06:34.000000000 -0400
29932 +++ linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c 2011-05-22 19:36:31.000000000 -0400
29933 @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
29934 if (crtc != 0)
29935 return 0;
29936
29937 - return atomic_read(&dev_priv->vbl_received);
29938 + return atomic_read_unchecked(&dev_priv->vbl_received);
29939 }
29940
29941 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29942 @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
29943
29944 status = VIA_READ(VIA_REG_INTERRUPT);
29945 if (status & VIA_IRQ_VBLANK_PENDING) {
29946 - atomic_inc(&dev_priv->vbl_received);
29947 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
29948 + atomic_inc_unchecked(&dev_priv->vbl_received);
29949 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
29950 do_gettimeofday(&cur_vblank);
29951 if (dev_priv->last_vblank_valid) {
29952 dev_priv->usec_per_vblank =
29953 @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29954 dev_priv->last_vblank = cur_vblank;
29955 dev_priv->last_vblank_valid = 1;
29956 }
29957 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
29958 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
29959 DRM_DEBUG("US per vblank is: %u\n",
29960 dev_priv->usec_per_vblank);
29961 }
29962 @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29963
29964 for (i = 0; i < dev_priv->num_irqs; ++i) {
29965 if (status & cur_irq->pending_mask) {
29966 - atomic_inc(&cur_irq->irq_received);
29967 + atomic_inc_unchecked(&cur_irq->irq_received);
29968 DRM_WAKEUP(&cur_irq->irq_queue);
29969 handled = 1;
29970 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
29971 @@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
29972 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29973 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
29974 masks[irq][4]));
29975 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
29976 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
29977 } else {
29978 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29979 (((cur_irq_sequence =
29980 - atomic_read(&cur_irq->irq_received)) -
29981 + atomic_read_unchecked(&cur_irq->irq_received)) -
29982 *sequence) <= (1 << 23)));
29983 }
29984 *sequence = cur_irq_sequence;
29985 @@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
29986 }
29987
29988 for (i = 0; i < dev_priv->num_irqs; ++i) {
29989 - atomic_set(&cur_irq->irq_received, 0);
29990 + atomic_set_unchecked(&cur_irq->irq_received, 0);
29991 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
29992 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
29993 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
29994 @@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
29995 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
29996 case VIA_IRQ_RELATIVE:
29997 irqwait->request.sequence +=
29998 - atomic_read(&cur_irq->irq_received);
29999 + atomic_read_unchecked(&cur_irq->irq_received);
30000 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
30001 case VIA_IRQ_ABSOLUTE:
30002 break;
30003 diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
30004 --- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-19 00:06:34.000000000 -0400
30005 +++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-22 19:36:31.000000000 -0400
30006 @@ -240,7 +240,7 @@ struct vmw_private {
30007 * Fencing and IRQs.
30008 */
30009
30010 - atomic_t fence_seq;
30011 + atomic_unchecked_t fence_seq;
30012 wait_queue_head_t fence_queue;
30013 wait_queue_head_t fifo_queue;
30014 atomic_t fence_queue_waiters;
30015 diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
30016 --- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-19 00:06:34.000000000 -0400
30017 +++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-22 19:36:31.000000000 -0400
30018 @@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
30019 while (!vmw_lag_lt(queue, us)) {
30020 spin_lock(&queue->lock);
30021 if (list_empty(&queue->head))
30022 - sequence = atomic_read(&dev_priv->fence_seq);
30023 + sequence = atomic_read_unchecked(&dev_priv->fence_seq);
30024 else {
30025 fence = list_first_entry(&queue->head,
30026 struct vmw_fence, head);
30027 diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
30028 --- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-19 00:06:34.000000000 -0400
30029 +++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-22 19:36:31.000000000 -0400
30030 @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
30031 (unsigned int) min,
30032 (unsigned int) fifo->capabilities);
30033
30034 - atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
30035 + atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
30036 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
30037 vmw_fence_queue_init(&fifo->fence_queue);
30038 return vmw_fifo_send_fence(dev_priv, &dummy);
30039 @@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
30040
30041 fm = vmw_fifo_reserve(dev_priv, bytes);
30042 if (unlikely(fm == NULL)) {
30043 - *sequence = atomic_read(&dev_priv->fence_seq);
30044 + *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
30045 ret = -ENOMEM;
30046 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
30047 false, 3*HZ);
30048 @@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
30049 }
30050
30051 do {
30052 - *sequence = atomic_add_return(1, &dev_priv->fence_seq);
30053 + *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
30054 } while (*sequence == 0);
30055
30056 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
30057 @@ -534,7 +534,7 @@ static int vmw_fifo_vm_fault(struct vm_a
30058 return VM_FAULT_SIGBUS;
30059 }
30060
30061 -static struct vm_operations_struct vmw_fifo_vm_ops = {
30062 +static const struct vm_operations_struct vmw_fifo_vm_ops = {
30063 .fault = vmw_fifo_vm_fault,
30064 .open = NULL,
30065 .close = NULL
30066 diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
30067 --- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-19 00:06:34.000000000 -0400
30068 +++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-22 19:36:31.000000000 -0400
30069 @@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
30070 * emitted. Then the fence is stale and signaled.
30071 */
30072
30073 - ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
30074 + ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
30075 > VMW_FENCE_WRAP);
30076
30077 return ret;
30078 @@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
30079
30080 if (fifo_idle)
30081 down_read(&fifo_state->rwsem);
30082 - signal_seq = atomic_read(&dev_priv->fence_seq);
30083 + signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
30084 ret = 0;
30085
30086 for (;;) {
30087 diff -urNp linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c
30088 --- linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c 2011-05-19 00:06:34.000000000 -0400
30089 +++ linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c 2011-05-22 19:36:31.000000000 -0400
30090 @@ -53,7 +53,7 @@ struct vgasr_priv {
30091 int registered_clients;
30092 struct vga_switcheroo_client clients[VGA_SWITCHEROO_MAX_CLIENTS];
30093
30094 - struct vga_switcheroo_handler *handler;
30095 + const struct vga_switcheroo_handler *handler;
30096 };
30097
30098 static int vga_switcheroo_debugfs_init(struct vgasr_priv *priv);
30099 @@ -62,7 +62,7 @@ static void vga_switcheroo_debugfs_fini(
30100 /* only one switcheroo per system */
30101 static struct vgasr_priv vgasr_priv;
30102
30103 -int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler)
30104 +int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler)
30105 {
30106 mutex_lock(&vgasr_mutex);
30107 if (vgasr_priv.handler) {
30108 diff -urNp linux-2.6.39.1/drivers/hid/hid-core.c linux-2.6.39.1/drivers/hid/hid-core.c
30109 --- linux-2.6.39.1/drivers/hid/hid-core.c 2011-05-19 00:06:34.000000000 -0400
30110 +++ linux-2.6.39.1/drivers/hid/hid-core.c 2011-05-22 19:36:31.000000000 -0400
30111 @@ -1888,7 +1888,7 @@ static bool hid_ignore(struct hid_device
30112
30113 int hid_add_device(struct hid_device *hdev)
30114 {
30115 - static atomic_t id = ATOMIC_INIT(0);
30116 + static atomic_unchecked_t id = ATOMIC_INIT(0);
30117 int ret;
30118
30119 if (WARN_ON(hdev->status & HID_STAT_ADDED))
30120 @@ -1903,7 +1903,7 @@ int hid_add_device(struct hid_device *hd
30121 /* XXX hack, any other cleaner solution after the driver core
30122 * is converted to allow more than 20 bytes as the device name? */
30123 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
30124 - hdev->vendor, hdev->product, atomic_inc_return(&id));
30125 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
30126
30127 hid_debug_register(hdev, dev_name(&hdev->dev));
30128 ret = device_add(&hdev->dev);
30129 diff -urNp linux-2.6.39.1/drivers/hid/hid-picolcd.c linux-2.6.39.1/drivers/hid/hid-picolcd.c
30130 --- linux-2.6.39.1/drivers/hid/hid-picolcd.c 2011-05-19 00:06:34.000000000 -0400
30131 +++ linux-2.6.39.1/drivers/hid/hid-picolcd.c 2011-05-22 19:36:31.000000000 -0400
30132 @@ -1037,7 +1037,7 @@ static int picolcd_check_lcd_fb(struct l
30133 return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
30134 }
30135
30136 -static struct lcd_ops picolcd_lcdops = {
30137 +static const struct lcd_ops picolcd_lcdops = {
30138 .get_contrast = picolcd_get_contrast,
30139 .set_contrast = picolcd_set_contrast,
30140 .check_fb = picolcd_check_lcd_fb,
30141 diff -urNp linux-2.6.39.1/drivers/hid/usbhid/hiddev.c linux-2.6.39.1/drivers/hid/usbhid/hiddev.c
30142 --- linux-2.6.39.1/drivers/hid/usbhid/hiddev.c 2011-05-19 00:06:34.000000000 -0400
30143 +++ linux-2.6.39.1/drivers/hid/usbhid/hiddev.c 2011-05-22 19:36:31.000000000 -0400
30144 @@ -613,7 +613,7 @@ static long hiddev_ioctl(struct file *fi
30145 break;
30146
30147 case HIDIOCAPPLICATION:
30148 - if (arg < 0 || arg >= hid->maxapplication)
30149 + if (arg >= hid->maxapplication)
30150 break;
30151
30152 for (i = 0; i < hid->maxcollection; i++)
30153 diff -urNp linux-2.6.39.1/drivers/hwmon/ibmaem.c linux-2.6.39.1/drivers/hwmon/ibmaem.c
30154 --- linux-2.6.39.1/drivers/hwmon/ibmaem.c 2011-05-19 00:06:34.000000000 -0400
30155 +++ linux-2.6.39.1/drivers/hwmon/ibmaem.c 2011-05-22 19:36:31.000000000 -0400
30156 @@ -238,7 +238,7 @@ struct aem_read_sensor_resp {
30157 struct aem_driver_data {
30158 struct list_head aem_devices;
30159 struct ipmi_smi_watcher bmc_events;
30160 - struct ipmi_user_hndl ipmi_hndlrs;
30161 + const struct ipmi_user_hndl ipmi_hndlrs;
30162 };
30163
30164 static void aem_register_bmc(int iface, struct device *dev);
30165 diff -urNp linux-2.6.39.1/drivers/hwmon/ibmpex.c linux-2.6.39.1/drivers/hwmon/ibmpex.c
30166 --- linux-2.6.39.1/drivers/hwmon/ibmpex.c 2011-05-19 00:06:34.000000000 -0400
30167 +++ linux-2.6.39.1/drivers/hwmon/ibmpex.c 2011-05-22 19:36:31.000000000 -0400
30168 @@ -110,7 +110,7 @@ struct ibmpex_bmc_data {
30169 struct ibmpex_driver_data {
30170 struct list_head bmc_data;
30171 struct ipmi_smi_watcher bmc_events;
30172 - struct ipmi_user_hndl ipmi_hndlrs;
30173 + const struct ipmi_user_hndl ipmi_hndlrs;
30174 };
30175
30176 static struct ibmpex_driver_data driver_data = {
30177 diff -urNp linux-2.6.39.1/drivers/hwmon/sht15.c linux-2.6.39.1/drivers/hwmon/sht15.c
30178 --- linux-2.6.39.1/drivers/hwmon/sht15.c 2011-05-19 00:06:34.000000000 -0400
30179 +++ linux-2.6.39.1/drivers/hwmon/sht15.c 2011-05-22 19:36:31.000000000 -0400
30180 @@ -113,7 +113,7 @@ struct sht15_data {
30181 int supply_uV;
30182 int supply_uV_valid;
30183 struct work_struct update_supply_work;
30184 - atomic_t interrupt_handled;
30185 + atomic_unchecked_t interrupt_handled;
30186 };
30187
30188 /**
30189 @@ -246,13 +246,13 @@ static inline int sht15_update_single_va
30190 return ret;
30191
30192 gpio_direction_input(data->pdata->gpio_data);
30193 - atomic_set(&data->interrupt_handled, 0);
30194 + atomic_set_unchecked(&data->interrupt_handled, 0);
30195
30196 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30197 if (gpio_get_value(data->pdata->gpio_data) == 0) {
30198 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
30199 /* Only relevant if the interrupt hasn't occurred. */
30200 - if (!atomic_read(&data->interrupt_handled))
30201 + if (!atomic_read_unchecked(&data->interrupt_handled))
30202 schedule_work(&data->read_work);
30203 }
30204 ret = wait_event_timeout(data->wait_queue,
30205 @@ -399,7 +399,7 @@ static irqreturn_t sht15_interrupt_fired
30206 struct sht15_data *data = d;
30207 /* First disable the interrupt */
30208 disable_irq_nosync(irq);
30209 - atomic_inc(&data->interrupt_handled);
30210 + atomic_inc_unchecked(&data->interrupt_handled);
30211 /* Then schedule a reading work struct */
30212 if (data->flag != SHT15_READING_NOTHING)
30213 schedule_work(&data->read_work);
30214 @@ -450,11 +450,11 @@ static void sht15_bh_read_data(struct wo
30215 here as could have gone low in meantime so verify
30216 it hasn't!
30217 */
30218 - atomic_set(&data->interrupt_handled, 0);
30219 + atomic_set_unchecked(&data->interrupt_handled, 0);
30220 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30221 /* If still not occurred or another handler has been scheduled */
30222 if (gpio_get_value(data->pdata->gpio_data)
30223 - || atomic_read(&data->interrupt_handled))
30224 + || atomic_read_unchecked(&data->interrupt_handled))
30225 return;
30226 }
30227 /* Read the data back from the device */
30228 diff -urNp linux-2.6.39.1/drivers/hwmon/w83791d.c linux-2.6.39.1/drivers/hwmon/w83791d.c
30229 --- linux-2.6.39.1/drivers/hwmon/w83791d.c 2011-05-19 00:06:34.000000000 -0400
30230 +++ linux-2.6.39.1/drivers/hwmon/w83791d.c 2011-05-22 19:36:31.000000000 -0400
30231 @@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
30232 struct i2c_board_info *info);
30233 static int w83791d_remove(struct i2c_client *client);
30234
30235 -static int w83791d_read(struct i2c_client *client, u8 register);
30236 -static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
30237 +static int w83791d_read(struct i2c_client *client, u8 reg);
30238 +static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
30239 static struct w83791d_data *w83791d_update_device(struct device *dev);
30240
30241 #ifdef DEBUG
30242 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c
30243 --- linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c 2011-05-19 00:06:34.000000000 -0400
30244 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c 2011-05-22 19:36:31.000000000 -0400
30245 @@ -181,7 +181,7 @@ static u32 at91_func(struct i2c_adapter
30246 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30247 }
30248
30249 -static struct i2c_algorithm at91_algorithm = {
30250 +static const struct i2c_algorithm at91_algorithm = {
30251 .master_xfer = at91_xfer,
30252 .functionality = at91_func,
30253 };
30254 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c
30255 --- linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-19 00:06:34.000000000 -0400
30256 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-22 19:36:31.000000000 -0400
30257 @@ -599,7 +599,7 @@ static u32 bfin_twi_functionality(struct
30258 I2C_FUNC_I2C | I2C_FUNC_SMBUS_I2C_BLOCK;
30259 }
30260
30261 -static struct i2c_algorithm bfin_twi_algorithm = {
30262 +static const struct i2c_algorithm bfin_twi_algorithm = {
30263 .master_xfer = bfin_twi_master_xfer,
30264 .smbus_xfer = bfin_twi_smbus_xfer,
30265 .functionality = bfin_twi_functionality,
30266 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c
30267 --- linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c 2011-05-19 00:06:34.000000000 -0400
30268 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c 2011-05-22 19:36:31.000000000 -0400
30269 @@ -630,7 +630,7 @@ static inline void i2c_davinci_cpufreq_d
30270 }
30271 #endif
30272
30273 -static struct i2c_algorithm i2c_davinci_algo = {
30274 +static const struct i2c_algorithm i2c_davinci_algo = {
30275 .master_xfer = i2c_davinci_xfer,
30276 .functionality = i2c_davinci_func,
30277 };
30278 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c
30279 --- linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c 2011-05-19 00:06:34.000000000 -0400
30280 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c 2011-05-22 19:36:31.000000000 -0400
30281 @@ -689,7 +689,7 @@ tx_aborted:
30282 return IRQ_HANDLED;
30283 }
30284
30285 -static struct i2c_algorithm i2c_dw_algo = {
30286 +static const struct i2c_algorithm i2c_dw_algo = {
30287 .master_xfer = i2c_dw_xfer,
30288 .functionality = i2c_dw_func,
30289 };
30290 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c
30291 --- linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c 2011-05-19 00:06:34.000000000 -0400
30292 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c 2011-05-22 19:36:31.000000000 -0400
30293 @@ -708,7 +708,7 @@ static u32 pch_i2c_func(struct i2c_adapt
30294 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_10BIT_ADDR;
30295 }
30296
30297 -static struct i2c_algorithm pch_algorithm = {
30298 +static const struct i2c_algorithm pch_algorithm = {
30299 .master_xfer = pch_i2c_xfer,
30300 .functionality = pch_i2c_func
30301 };
30302 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c
30303 --- linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c 2011-05-19 00:06:34.000000000 -0400
30304 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c 2011-05-22 19:36:31.000000000 -0400
30305 @@ -457,7 +457,7 @@ static u32 i2c_imx_func(struct i2c_adapt
30306 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30307 }
30308
30309 -static struct i2c_algorithm i2c_imx_algo = {
30310 +static const struct i2c_algorithm i2c_imx_algo = {
30311 .master_xfer = i2c_imx_xfer,
30312 .functionality = i2c_imx_func,
30313 };
30314 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c
30315 --- linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c 2011-05-19 00:06:34.000000000 -0400
30316 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c 2011-05-22 19:36:31.000000000 -0400
30317 @@ -917,7 +917,7 @@ err:
30318 return IRQ_HANDLED;
30319 }
30320
30321 -static struct i2c_algorithm intel_mid_i2c_algorithm = {
30322 +static const struct i2c_algorithm intel_mid_i2c_algorithm = {
30323 .master_xfer = intel_mid_i2c_xfer,
30324 .functionality = intel_mid_i2c_func,
30325 };
30326 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c
30327 --- linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c 2011-05-19 00:06:34.000000000 -0400
30328 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c 2011-05-22 19:36:31.000000000 -0400
30329 @@ -303,7 +303,7 @@ static u32 nforce2_func(struct i2c_adapt
30330 I2C_FUNC_SMBUS_BLOCK_DATA : 0);
30331 }
30332
30333 -static struct i2c_algorithm smbus_algorithm = {
30334 +static const struct i2c_algorithm smbus_algorithm = {
30335 .smbus_xfer = nforce2_access,
30336 .functionality = nforce2_func,
30337 };
30338 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c
30339 --- linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
30340 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-22 19:36:31.000000000 -0400
30341 @@ -615,7 +615,7 @@ static u32 pmcmsptwi_i2c_func(struct i2c
30342
30343 /* -- Initialization -- */
30344
30345 -static struct i2c_algorithm pmcmsptwi_algo = {
30346 +static const struct i2c_algorithm pmcmsptwi_algo = {
30347 .master_xfer = pmcmsptwi_master_xfer,
30348 .functionality = pmcmsptwi_i2c_func,
30349 };
30350 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c
30351 --- linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c 2011-05-19 00:06:34.000000000 -0400
30352 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c 2011-05-22 19:36:31.000000000 -0400
30353 @@ -535,7 +535,7 @@ static u32 i2c_pnx_func(struct i2c_adapt
30354 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30355 }
30356
30357 -static struct i2c_algorithm pnx_algorithm = {
30358 +static const struct i2c_algorithm pnx_algorithm = {
30359 .master_xfer = i2c_pnx_xfer,
30360 .functionality = i2c_pnx_func,
30361 };
30362 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c
30363 --- linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c 2011-05-19 00:06:34.000000000 -0400
30364 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c 2011-05-22 19:36:31.000000000 -0400
30365 @@ -176,7 +176,7 @@ static u32 puv3_i2c_func(struct i2c_adap
30366 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30367 }
30368
30369 -static struct i2c_algorithm puv3_i2c_algorithm = {
30370 +static const struct i2c_algorithm puv3_i2c_algorithm = {
30371 .master_xfer = puv3_i2c_xfer,
30372 .functionality = puv3_i2c_func,
30373 };
30374 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c
30375 --- linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c 2011-05-19 00:06:34.000000000 -0400
30376 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c 2011-05-22 19:36:31.000000000 -0400
30377 @@ -243,7 +243,7 @@ static u32 s6i2c_functionality(struct i2
30378 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30379 }
30380
30381 -static struct i2c_algorithm s6i2c_algorithm = {
30382 +static const struct i2c_algorithm s6i2c_algorithm = {
30383 .master_xfer = s6i2c_master_xfer,
30384 .functionality = s6i2c_functionality,
30385 };
30386 diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c
30387 --- linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-19 00:06:34.000000000 -0400
30388 +++ linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-22 19:36:31.000000000 -0400
30389 @@ -529,7 +529,7 @@ static u32 sh_mobile_i2c_func(struct i2c
30390 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30391 }
30392
30393 -static struct i2c_algorithm sh_mobile_i2c_algorithm = {
30394 +static const struct i2c_algorithm sh_mobile_i2c_algorithm = {
30395 .functionality = sh_mobile_i2c_func,
30396 .master_xfer = sh_mobile_i2c_xfer,
30397 };
30398 diff -urNp linux-2.6.39.1/drivers/ide/ide-cd.c linux-2.6.39.1/drivers/ide/ide-cd.c
30399 --- linux-2.6.39.1/drivers/ide/ide-cd.c 2011-06-03 00:04:14.000000000 -0400
30400 +++ linux-2.6.39.1/drivers/ide/ide-cd.c 2011-06-03 00:32:05.000000000 -0400
30401 @@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_
30402 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
30403 if ((unsigned long)buf & alignment
30404 || blk_rq_bytes(rq) & q->dma_pad_mask
30405 - || object_is_on_stack(buf))
30406 + || object_starts_on_stack(buf))
30407 drive->dma = 0;
30408 }
30409 }
30410 diff -urNp linux-2.6.39.1/drivers/ide/ide-floppy.c linux-2.6.39.1/drivers/ide/ide-floppy.c
30411 --- linux-2.6.39.1/drivers/ide/ide-floppy.c 2011-05-19 00:06:34.000000000 -0400
30412 +++ linux-2.6.39.1/drivers/ide/ide-floppy.c 2011-05-22 19:36:31.000000000 -0400
30413 @@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
30414 u8 pc_buf[256], header_len, desc_cnt;
30415 int i, rc = 1, blocks, length;
30416
30417 + pax_track_stack();
30418 +
30419 ide_debug_log(IDE_DBG_FUNC, "enter");
30420
30421 drive->bios_cyl = 0;
30422 diff -urNp linux-2.6.39.1/drivers/ide/it821x.c linux-2.6.39.1/drivers/ide/it821x.c
30423 --- linux-2.6.39.1/drivers/ide/it821x.c 2011-05-19 00:06:34.000000000 -0400
30424 +++ linux-2.6.39.1/drivers/ide/it821x.c 2011-05-22 19:36:31.000000000 -0400
30425 @@ -508,7 +508,7 @@ static void it821x_quirkproc(ide_drive_t
30426
30427 }
30428
30429 -static struct ide_dma_ops it821x_pass_through_dma_ops = {
30430 +static const struct ide_dma_ops it821x_pass_through_dma_ops = {
30431 .dma_host_set = ide_dma_host_set,
30432 .dma_setup = ide_dma_setup,
30433 .dma_start = it821x_dma_start,
30434 diff -urNp linux-2.6.39.1/drivers/ide/setup-pci.c linux-2.6.39.1/drivers/ide/setup-pci.c
30435 --- linux-2.6.39.1/drivers/ide/setup-pci.c 2011-05-19 00:06:34.000000000 -0400
30436 +++ linux-2.6.39.1/drivers/ide/setup-pci.c 2011-05-22 19:36:31.000000000 -0400
30437 @@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
30438 int ret, i, n_ports = dev2 ? 4 : 2;
30439 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
30440
30441 + pax_track_stack();
30442 +
30443 for (i = 0; i < n_ports / 2; i++) {
30444 ret = ide_setup_pci_controller(pdev[i], d, !i);
30445 if (ret < 0)
30446 diff -urNp linux-2.6.39.1/drivers/ide/trm290.c linux-2.6.39.1/drivers/ide/trm290.c
30447 --- linux-2.6.39.1/drivers/ide/trm290.c 2011-05-19 00:06:34.000000000 -0400
30448 +++ linux-2.6.39.1/drivers/ide/trm290.c 2011-05-22 19:36:31.000000000 -0400
30449 @@ -314,7 +314,7 @@ static const struct ide_tp_ops trm290_tp
30450 .output_data = ide_output_data,
30451 };
30452
30453 -static struct ide_dma_ops trm290_dma_ops = {
30454 +static const struct ide_dma_ops trm290_dma_ops = {
30455 .dma_host_set = trm290_dma_host_set,
30456 .dma_setup = trm290_dma_setup,
30457 .dma_start = trm290_dma_start,
30458 diff -urNp linux-2.6.39.1/drivers/infiniband/core/cm.c linux-2.6.39.1/drivers/infiniband/core/cm.c
30459 --- linux-2.6.39.1/drivers/infiniband/core/cm.c 2011-05-19 00:06:34.000000000 -0400
30460 +++ linux-2.6.39.1/drivers/infiniband/core/cm.c 2011-05-22 19:36:31.000000000 -0400
30461 @@ -113,7 +113,7 @@ static char const counter_group_names[CM
30462
30463 struct cm_counter_group {
30464 struct kobject obj;
30465 - atomic_long_t counter[CM_ATTR_COUNT];
30466 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
30467 };
30468
30469 struct cm_counter_attribute {
30470 @@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm
30471 struct ib_mad_send_buf *msg = NULL;
30472 int ret;
30473
30474 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30475 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30476 counter[CM_REQ_COUNTER]);
30477
30478 /* Quick state check to discard duplicate REQs. */
30479 @@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm
30480 if (!cm_id_priv)
30481 return;
30482
30483 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30484 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30485 counter[CM_REP_COUNTER]);
30486 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
30487 if (ret)
30488 @@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work
30489 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
30490 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
30491 spin_unlock_irq(&cm_id_priv->lock);
30492 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30493 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30494 counter[CM_RTU_COUNTER]);
30495 goto out;
30496 }
30497 @@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor
30498 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
30499 dreq_msg->local_comm_id);
30500 if (!cm_id_priv) {
30501 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30502 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30503 counter[CM_DREQ_COUNTER]);
30504 cm_issue_drep(work->port, work->mad_recv_wc);
30505 return -EINVAL;
30506 @@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor
30507 case IB_CM_MRA_REP_RCVD:
30508 break;
30509 case IB_CM_TIMEWAIT:
30510 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30511 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30512 counter[CM_DREQ_COUNTER]);
30513 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30514 goto unlock;
30515 @@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor
30516 cm_free_msg(msg);
30517 goto deref;
30518 case IB_CM_DREQ_RCVD:
30519 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30520 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30521 counter[CM_DREQ_COUNTER]);
30522 goto unlock;
30523 default:
30524 @@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work
30525 ib_modify_mad(cm_id_priv->av.port->mad_agent,
30526 cm_id_priv->msg, timeout)) {
30527 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
30528 - atomic_long_inc(&work->port->
30529 + atomic_long_inc_unchecked(&work->port->
30530 counter_group[CM_RECV_DUPLICATES].
30531 counter[CM_MRA_COUNTER]);
30532 goto out;
30533 @@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work
30534 break;
30535 case IB_CM_MRA_REQ_RCVD:
30536 case IB_CM_MRA_REP_RCVD:
30537 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30538 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30539 counter[CM_MRA_COUNTER]);
30540 /* fall through */
30541 default:
30542 @@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work
30543 case IB_CM_LAP_IDLE:
30544 break;
30545 case IB_CM_MRA_LAP_SENT:
30546 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30547 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30548 counter[CM_LAP_COUNTER]);
30549 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30550 goto unlock;
30551 @@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work
30552 cm_free_msg(msg);
30553 goto deref;
30554 case IB_CM_LAP_RCVD:
30555 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30556 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30557 counter[CM_LAP_COUNTER]);
30558 goto unlock;
30559 default:
30560 @@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm
30561 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
30562 if (cur_cm_id_priv) {
30563 spin_unlock_irq(&cm.lock);
30564 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30565 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30566 counter[CM_SIDR_REQ_COUNTER]);
30567 goto out; /* Duplicate message. */
30568 }
30569 @@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma
30570 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
30571 msg->retries = 1;
30572
30573 - atomic_long_add(1 + msg->retries,
30574 + atomic_long_add_unchecked(1 + msg->retries,
30575 &port->counter_group[CM_XMIT].counter[attr_index]);
30576 if (msg->retries)
30577 - atomic_long_add(msg->retries,
30578 + atomic_long_add_unchecked(msg->retries,
30579 &port->counter_group[CM_XMIT_RETRIES].
30580 counter[attr_index]);
30581
30582 @@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma
30583 }
30584
30585 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
30586 - atomic_long_inc(&port->counter_group[CM_RECV].
30587 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
30588 counter[attr_id - CM_ATTR_ID_OFFSET]);
30589
30590 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
30591 @@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko
30592 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
30593
30594 return sprintf(buf, "%ld\n",
30595 - atomic_long_read(&group->counter[cm_attr->index]));
30596 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
30597 }
30598
30599 static const struct sysfs_ops cm_counter_ops = {
30600 diff -urNp linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c
30601 --- linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c 2011-05-19 00:06:34.000000000 -0400
30602 +++ linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c 2011-05-22 19:36:31.000000000 -0400
30603 @@ -97,8 +97,8 @@ struct ib_fmr_pool {
30604
30605 struct task_struct *thread;
30606
30607 - atomic_t req_ser;
30608 - atomic_t flush_ser;
30609 + atomic_unchecked_t req_ser;
30610 + atomic_unchecked_t flush_ser;
30611
30612 wait_queue_head_t force_wait;
30613 };
30614 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
30615 struct ib_fmr_pool *pool = pool_ptr;
30616
30617 do {
30618 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30619 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30620 ib_fmr_batch_release(pool);
30621
30622 - atomic_inc(&pool->flush_ser);
30623 + atomic_inc_unchecked(&pool->flush_ser);
30624 wake_up_interruptible(&pool->force_wait);
30625
30626 if (pool->flush_function)
30627 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
30628 }
30629
30630 set_current_state(TASK_INTERRUPTIBLE);
30631 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30632 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30633 !kthread_should_stop())
30634 schedule();
30635 __set_current_state(TASK_RUNNING);
30636 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
30637 pool->dirty_watermark = params->dirty_watermark;
30638 pool->dirty_len = 0;
30639 spin_lock_init(&pool->pool_lock);
30640 - atomic_set(&pool->req_ser, 0);
30641 - atomic_set(&pool->flush_ser, 0);
30642 + atomic_set_unchecked(&pool->req_ser, 0);
30643 + atomic_set_unchecked(&pool->flush_ser, 0);
30644 init_waitqueue_head(&pool->force_wait);
30645
30646 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30647 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
30648 }
30649 spin_unlock_irq(&pool->pool_lock);
30650
30651 - serial = atomic_inc_return(&pool->req_ser);
30652 + serial = atomic_inc_return_unchecked(&pool->req_ser);
30653 wake_up_process(pool->thread);
30654
30655 if (wait_event_interruptible(pool->force_wait,
30656 - atomic_read(&pool->flush_ser) - serial >= 0))
30657 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30658 return -EINTR;
30659
30660 return 0;
30661 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
30662 } else {
30663 list_add_tail(&fmr->list, &pool->dirty_list);
30664 if (++pool->dirty_len >= pool->dirty_watermark) {
30665 - atomic_inc(&pool->req_ser);
30666 + atomic_inc_unchecked(&pool->req_ser);
30667 wake_up_process(pool->thread);
30668 }
30669 }
30670 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c
30671 --- linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c 2011-05-19 00:06:34.000000000 -0400
30672 +++ linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c 2011-05-22 19:36:31.000000000 -0400
30673 @@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
30674 int err;
30675 struct fw_ri_tpte tpt;
30676 u32 stag_idx;
30677 - static atomic_t key;
30678 + static atomic_unchecked_t key;
30679
30680 if (c4iw_fatal_error(rdev))
30681 return -EIO;
30682 @@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
30683 &rdev->resource.tpt_fifo_lock);
30684 if (!stag_idx)
30685 return -ENOMEM;
30686 - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30687 + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30688 }
30689 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30690 __func__, stag_state, type, pdid, stag_idx);
30691 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c
30692 --- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-19 00:06:34.000000000 -0400
30693 +++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-22 19:36:31.000000000 -0400
30694 @@ -175,7 +175,7 @@ static void ipath_dma_free_coherent(stru
30695 free_pages((unsigned long) cpu_addr, get_order(size));
30696 }
30697
30698 -struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30699 +const struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30700 ipath_mapping_error,
30701 ipath_dma_map_single,
30702 ipath_dma_unmap_single,
30703 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c
30704 --- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-19 00:06:34.000000000 -0400
30705 +++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-22 19:36:31.000000000 -0400
30706 @@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
30707 struct infinipath_counters counters;
30708 struct ipath_devdata *dd;
30709
30710 + pax_track_stack();
30711 +
30712 dd = file->f_path.dentry->d_inode->i_private;
30713 dd->ipath_f_read_counters(dd, &counters);
30714
30715 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c
30716 --- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-19 00:06:34.000000000 -0400
30717 +++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-22 19:36:31.000000000 -0400
30718 @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30719 struct ib_atomic_eth *ateth;
30720 struct ipath_ack_entry *e;
30721 u64 vaddr;
30722 - atomic64_t *maddr;
30723 + atomic64_unchecked_t *maddr;
30724 u64 sdata;
30725 u32 rkey;
30726 u8 next;
30727 @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30728 IB_ACCESS_REMOTE_ATOMIC)))
30729 goto nack_acc_unlck;
30730 /* Perform atomic OP and save result. */
30731 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30732 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30733 sdata = be64_to_cpu(ateth->swap_data);
30734 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30735 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30736 - (u64) atomic64_add_return(sdata, maddr) - sdata :
30737 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30738 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30739 be64_to_cpu(ateth->compare_data),
30740 sdata);
30741 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c
30742 --- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-19 00:06:34.000000000 -0400
30743 +++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-22 19:36:31.000000000 -0400
30744 @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
30745 unsigned long flags;
30746 struct ib_wc wc;
30747 u64 sdata;
30748 - atomic64_t *maddr;
30749 + atomic64_unchecked_t *maddr;
30750 enum ib_wc_status send_status;
30751
30752 /*
30753 @@ -382,11 +382,11 @@ again:
30754 IB_ACCESS_REMOTE_ATOMIC)))
30755 goto acc_err;
30756 /* Perform atomic OP and save result. */
30757 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30758 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30759 sdata = wqe->wr.wr.atomic.compare_add;
30760 *(u64 *) sqp->s_sge.sge.vaddr =
30761 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30762 - (u64) atomic64_add_return(sdata, maddr) - sdata :
30763 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30764 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30765 sdata, wqe->wr.wr.atomic.swap);
30766 goto send_comp;
30767 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h
30768 --- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-19 00:06:34.000000000 -0400
30769 +++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-22 19:36:31.000000000 -0400
30770 @@ -931,6 +931,6 @@ extern unsigned int ib_ipath_max_srq_wrs
30771
30772 extern const u32 ib_ipath_rnr_table[];
30773
30774 -extern struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30775 +extern const struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30776
30777 #endif /* IPATH_VERBS_H */
30778 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c
30779 --- linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c 2011-05-19 00:06:34.000000000 -0400
30780 +++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c 2011-05-22 19:36:31.000000000 -0400
30781 @@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
30782 LIST_HEAD(nes_adapter_list);
30783 static LIST_HEAD(nes_dev_list);
30784
30785 -atomic_t qps_destroyed;
30786 +atomic_unchecked_t qps_destroyed;
30787
30788 static unsigned int ee_flsh_adapter;
30789 static unsigned int sysfs_nonidx_addr;
30790 @@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str
30791 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30792 struct nes_adapter *nesadapter = nesdev->nesadapter;
30793
30794 - atomic_inc(&qps_destroyed);
30795 + atomic_inc_unchecked(&qps_destroyed);
30796
30797 /* Free the control structures */
30798
30799 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c
30800 --- linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c 2011-05-19 00:06:34.000000000 -0400
30801 +++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c 2011-05-22 19:36:31.000000000 -0400
30802 @@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30803 u32 cm_packets_retrans;
30804 u32 cm_packets_created;
30805 u32 cm_packets_received;
30806 -atomic_t cm_listens_created;
30807 -atomic_t cm_listens_destroyed;
30808 +atomic_unchecked_t cm_listens_created;
30809 +atomic_unchecked_t cm_listens_destroyed;
30810 u32 cm_backlog_drops;
30811 -atomic_t cm_loopbacks;
30812 -atomic_t cm_nodes_created;
30813 -atomic_t cm_nodes_destroyed;
30814 -atomic_t cm_accel_dropped_pkts;
30815 -atomic_t cm_resets_recvd;
30816 +atomic_unchecked_t cm_loopbacks;
30817 +atomic_unchecked_t cm_nodes_created;
30818 +atomic_unchecked_t cm_nodes_destroyed;
30819 +atomic_unchecked_t cm_accel_dropped_pkts;
30820 +atomic_unchecked_t cm_resets_recvd;
30821
30822 static inline int mini_cm_accelerated(struct nes_cm_core *,
30823 struct nes_cm_node *);
30824 @@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30825
30826 static struct nes_cm_core *g_cm_core;
30827
30828 -atomic_t cm_connects;
30829 -atomic_t cm_accepts;
30830 -atomic_t cm_disconnects;
30831 -atomic_t cm_closes;
30832 -atomic_t cm_connecteds;
30833 -atomic_t cm_connect_reqs;
30834 -atomic_t cm_rejects;
30835 +atomic_unchecked_t cm_connects;
30836 +atomic_unchecked_t cm_accepts;
30837 +atomic_unchecked_t cm_disconnects;
30838 +atomic_unchecked_t cm_closes;
30839 +atomic_unchecked_t cm_connecteds;
30840 +atomic_unchecked_t cm_connect_reqs;
30841 +atomic_unchecked_t cm_rejects;
30842
30843
30844 /**
30845 @@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
30846 kfree(listener);
30847 listener = NULL;
30848 ret = 0;
30849 - atomic_inc(&cm_listens_destroyed);
30850 + atomic_inc_unchecked(&cm_listens_destroyed);
30851 } else {
30852 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30853 }
30854 @@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node(
30855 cm_node->rem_mac);
30856
30857 add_hte_node(cm_core, cm_node);
30858 - atomic_inc(&cm_nodes_created);
30859 + atomic_inc_unchecked(&cm_nodes_created);
30860
30861 return cm_node;
30862 }
30863 @@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm
30864 }
30865
30866 atomic_dec(&cm_core->node_cnt);
30867 - atomic_inc(&cm_nodes_destroyed);
30868 + atomic_inc_unchecked(&cm_nodes_destroyed);
30869 nesqp = cm_node->nesqp;
30870 if (nesqp) {
30871 nesqp->cm_node = NULL;
30872 @@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm
30873
30874 static void drop_packet(struct sk_buff *skb)
30875 {
30876 - atomic_inc(&cm_accel_dropped_pkts);
30877 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
30878 dev_kfree_skb_any(skb);
30879 }
30880
30881 @@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm
30882 {
30883
30884 int reset = 0; /* whether to send reset in case of err.. */
30885 - atomic_inc(&cm_resets_recvd);
30886 + atomic_inc_unchecked(&cm_resets_recvd);
30887 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30888 " refcnt=%d\n", cm_node, cm_node->state,
30889 atomic_read(&cm_node->ref_count));
30890 @@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne
30891 rem_ref_cm_node(cm_node->cm_core, cm_node);
30892 return NULL;
30893 }
30894 - atomic_inc(&cm_loopbacks);
30895 + atomic_inc_unchecked(&cm_loopbacks);
30896 loopbackremotenode->loopbackpartner = cm_node;
30897 loopbackremotenode->tcp_cntxt.rcv_wscale =
30898 NES_CM_DEFAULT_RCV_WND_SCALE;
30899 @@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c
30900 add_ref_cm_node(cm_node);
30901 } else if (cm_node->state == NES_CM_STATE_TSA) {
30902 rem_ref_cm_node(cm_core, cm_node);
30903 - atomic_inc(&cm_accel_dropped_pkts);
30904 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
30905 dev_kfree_skb_any(skb);
30906 break;
30907 }
30908 @@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne
30909
30910 if ((cm_id) && (cm_id->event_handler)) {
30911 if (issue_disconn) {
30912 - atomic_inc(&cm_disconnects);
30913 + atomic_inc_unchecked(&cm_disconnects);
30914 cm_event.event = IW_CM_EVENT_DISCONNECT;
30915 cm_event.status = disconn_status;
30916 cm_event.local_addr = cm_id->local_addr;
30917 @@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne
30918 }
30919
30920 if (issue_close) {
30921 - atomic_inc(&cm_closes);
30922 + atomic_inc_unchecked(&cm_closes);
30923 nes_disconnect(nesqp, 1);
30924
30925 cm_id->provider_data = nesqp;
30926 @@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
30927
30928 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30929 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30930 - atomic_inc(&cm_accepts);
30931 + atomic_inc_unchecked(&cm_accepts);
30932
30933 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30934 netdev_refcnt_read(nesvnic->netdev));
30935 @@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
30936
30937 struct nes_cm_core *cm_core;
30938
30939 - atomic_inc(&cm_rejects);
30940 + atomic_inc_unchecked(&cm_rejects);
30941 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30942 loopback = cm_node->loopbackpartner;
30943 cm_core = cm_node->cm_core;
30944 @@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id,
30945 ntohl(cm_id->local_addr.sin_addr.s_addr),
30946 ntohs(cm_id->local_addr.sin_port));
30947
30948 - atomic_inc(&cm_connects);
30949 + atomic_inc_unchecked(&cm_connects);
30950 nesqp->active_conn = 1;
30951
30952 /* cache the cm_id in the qp */
30953 @@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c
30954 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30955 return err;
30956 }
30957 - atomic_inc(&cm_listens_created);
30958 + atomic_inc_unchecked(&cm_listens_created);
30959 }
30960
30961 cm_id->add_ref(cm_id);
30962 @@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne
30963 if (nesqp->destroyed) {
30964 return;
30965 }
30966 - atomic_inc(&cm_connecteds);
30967 + atomic_inc_unchecked(&cm_connecteds);
30968 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30969 " local port 0x%04X. jiffies = %lu.\n",
30970 nesqp->hwqp.qp_id,
30971 @@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm
30972
30973 cm_id->add_ref(cm_id);
30974 ret = cm_id->event_handler(cm_id, &cm_event);
30975 - atomic_inc(&cm_closes);
30976 + atomic_inc_unchecked(&cm_closes);
30977 cm_event.event = IW_CM_EVENT_CLOSE;
30978 cm_event.status = IW_CM_EVENT_STATUS_OK;
30979 cm_event.provider_data = cm_id->provider_data;
30980 @@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_
30981 return;
30982 cm_id = cm_node->cm_id;
30983
30984 - atomic_inc(&cm_connect_reqs);
30985 + atomic_inc_unchecked(&cm_connect_reqs);
30986 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30987 cm_node, cm_id, jiffies);
30988
30989 @@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n
30990 return;
30991 cm_id = cm_node->cm_id;
30992
30993 - atomic_inc(&cm_connect_reqs);
30994 + atomic_inc_unchecked(&cm_connect_reqs);
30995 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30996 cm_node, cm_id, jiffies);
30997
30998 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h
30999 --- linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h 2011-05-19 00:06:34.000000000 -0400
31000 +++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h 2011-05-22 19:36:31.000000000 -0400
31001 @@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
31002 extern unsigned int wqm_quanta;
31003 extern struct list_head nes_adapter_list;
31004
31005 -extern atomic_t cm_connects;
31006 -extern atomic_t cm_accepts;
31007 -extern atomic_t cm_disconnects;
31008 -extern atomic_t cm_closes;
31009 -extern atomic_t cm_connecteds;
31010 -extern atomic_t cm_connect_reqs;
31011 -extern atomic_t cm_rejects;
31012 -extern atomic_t mod_qp_timouts;
31013 -extern atomic_t qps_created;
31014 -extern atomic_t qps_destroyed;
31015 -extern atomic_t sw_qps_destroyed;
31016 +extern atomic_unchecked_t cm_connects;
31017 +extern atomic_unchecked_t cm_accepts;
31018 +extern atomic_unchecked_t cm_disconnects;
31019 +extern atomic_unchecked_t cm_closes;
31020 +extern atomic_unchecked_t cm_connecteds;
31021 +extern atomic_unchecked_t cm_connect_reqs;
31022 +extern atomic_unchecked_t cm_rejects;
31023 +extern atomic_unchecked_t mod_qp_timouts;
31024 +extern atomic_unchecked_t qps_created;
31025 +extern atomic_unchecked_t qps_destroyed;
31026 +extern atomic_unchecked_t sw_qps_destroyed;
31027 extern u32 mh_detected;
31028 extern u32 mh_pauses_sent;
31029 extern u32 cm_packets_sent;
31030 @@ -194,14 +194,14 @@ extern u32 cm_packets_created;
31031 extern u32 cm_packets_received;
31032 extern u32 cm_packets_dropped;
31033 extern u32 cm_packets_retrans;
31034 -extern atomic_t cm_listens_created;
31035 -extern atomic_t cm_listens_destroyed;
31036 +extern atomic_unchecked_t cm_listens_created;
31037 +extern atomic_unchecked_t cm_listens_destroyed;
31038 extern u32 cm_backlog_drops;
31039 -extern atomic_t cm_loopbacks;
31040 -extern atomic_t cm_nodes_created;
31041 -extern atomic_t cm_nodes_destroyed;
31042 -extern atomic_t cm_accel_dropped_pkts;
31043 -extern atomic_t cm_resets_recvd;
31044 +extern atomic_unchecked_t cm_loopbacks;
31045 +extern atomic_unchecked_t cm_nodes_created;
31046 +extern atomic_unchecked_t cm_nodes_destroyed;
31047 +extern atomic_unchecked_t cm_accel_dropped_pkts;
31048 +extern atomic_unchecked_t cm_resets_recvd;
31049
31050 extern u32 int_mod_timer_init;
31051 extern u32 int_mod_cq_depth_256;
31052 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c
31053 --- linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c 2011-05-19 00:06:34.000000000 -0400
31054 +++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c 2011-05-22 19:36:31.000000000 -0400
31055 @@ -1302,31 +1302,31 @@ static void nes_netdev_get_ethtool_stats
31056 target_stat_values[++index] = mh_detected;
31057 target_stat_values[++index] = mh_pauses_sent;
31058 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
31059 - target_stat_values[++index] = atomic_read(&cm_connects);
31060 - target_stat_values[++index] = atomic_read(&cm_accepts);
31061 - target_stat_values[++index] = atomic_read(&cm_disconnects);
31062 - target_stat_values[++index] = atomic_read(&cm_connecteds);
31063 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
31064 - target_stat_values[++index] = atomic_read(&cm_rejects);
31065 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
31066 - target_stat_values[++index] = atomic_read(&qps_created);
31067 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
31068 - target_stat_values[++index] = atomic_read(&qps_destroyed);
31069 - target_stat_values[++index] = atomic_read(&cm_closes);
31070 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
31071 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
31072 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
31073 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
31074 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
31075 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
31076 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
31077 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
31078 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
31079 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
31080 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
31081 target_stat_values[++index] = cm_packets_sent;
31082 target_stat_values[++index] = cm_packets_bounced;
31083 target_stat_values[++index] = cm_packets_created;
31084 target_stat_values[++index] = cm_packets_received;
31085 target_stat_values[++index] = cm_packets_dropped;
31086 target_stat_values[++index] = cm_packets_retrans;
31087 - target_stat_values[++index] = atomic_read(&cm_listens_created);
31088 - target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
31089 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
31090 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
31091 target_stat_values[++index] = cm_backlog_drops;
31092 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
31093 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
31094 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
31095 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
31096 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
31097 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
31098 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
31099 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
31100 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
31101 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
31102 target_stat_values[++index] = nesadapter->free_4kpbl;
31103 target_stat_values[++index] = nesadapter->free_256pbl;
31104 target_stat_values[++index] = int_mod_timer_init;
31105 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c
31106 --- linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-19 00:06:34.000000000 -0400
31107 +++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-22 19:36:31.000000000 -0400
31108 @@ -46,9 +46,9 @@
31109
31110 #include <rdma/ib_umem.h>
31111
31112 -atomic_t mod_qp_timouts;
31113 -atomic_t qps_created;
31114 -atomic_t sw_qps_destroyed;
31115 +atomic_unchecked_t mod_qp_timouts;
31116 +atomic_unchecked_t qps_created;
31117 +atomic_unchecked_t sw_qps_destroyed;
31118
31119 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
31120
31121 @@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
31122 if (init_attr->create_flags)
31123 return ERR_PTR(-EINVAL);
31124
31125 - atomic_inc(&qps_created);
31126 + atomic_inc_unchecked(&qps_created);
31127 switch (init_attr->qp_type) {
31128 case IB_QPT_RC:
31129 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
31130 @@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
31131 struct iw_cm_event cm_event;
31132 int ret;
31133
31134 - atomic_inc(&sw_qps_destroyed);
31135 + atomic_inc_unchecked(&sw_qps_destroyed);
31136 nesqp->destroyed = 1;
31137
31138 /* Blow away the connection if it exists. */
31139 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h
31140 --- linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h 2011-05-19 00:06:34.000000000 -0400
31141 +++ linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h 2011-05-22 19:36:31.000000000 -0400
31142 @@ -51,6 +51,7 @@
31143 #include <linux/completion.h>
31144 #include <linux/kref.h>
31145 #include <linux/sched.h>
31146 +#include <linux/slab.h>
31147
31148 #include "qib_common.h"
31149 #include "qib_verbs.h"
31150 @@ -87,7 +88,7 @@ struct qlogic_ib_stats {
31151 };
31152
31153 extern struct qlogic_ib_stats qib_stats;
31154 -extern struct pci_error_handlers qib_pci_err_handler;
31155 +extern const struct pci_error_handlers qib_pci_err_handler;
31156 extern struct pci_driver qib_driver;
31157
31158 #define QIB_CHIP_SWVERSION QIB_CHIP_VERS_MAJ
31159 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c
31160 --- linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-19 00:06:34.000000000 -0400
31161 +++ linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-22 19:36:31.000000000 -0400
31162 @@ -75,7 +75,7 @@ static void qib_vma_close(struct vm_area
31163 kref_put(&ip->ref, qib_release_mmap_info);
31164 }
31165
31166 -static struct vm_operations_struct qib_vm_ops = {
31167 +static const struct vm_operations_struct qib_vm_ops = {
31168 .open = qib_vma_open,
31169 .close = qib_vma_close,
31170 };
31171 diff -urNp linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c
31172 --- linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-19 00:06:34.000000000 -0400
31173 +++ linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-22 19:36:31.000000000 -0400
31174 @@ -735,7 +735,7 @@ qib_pci_resume(struct pci_dev *pdev)
31175 qib_init(dd, 1); /* same as re-init after reset */
31176 }
31177
31178 -struct pci_error_handlers qib_pci_err_handler = {
31179 +const struct pci_error_handlers qib_pci_err_handler = {
31180 .error_detected = qib_pci_error_detected,
31181 .mmio_enabled = qib_pci_mmio_enabled,
31182 .link_reset = qib_pci_link_reset,
31183 diff -urNp linux-2.6.39.1/drivers/input/gameport/gameport.c linux-2.6.39.1/drivers/input/gameport/gameport.c
31184 --- linux-2.6.39.1/drivers/input/gameport/gameport.c 2011-05-19 00:06:34.000000000 -0400
31185 +++ linux-2.6.39.1/drivers/input/gameport/gameport.c 2011-05-22 19:36:31.000000000 -0400
31186 @@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
31187 */
31188 static void gameport_init_port(struct gameport *gameport)
31189 {
31190 - static atomic_t gameport_no = ATOMIC_INIT(0);
31191 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
31192
31193 __module_get(THIS_MODULE);
31194
31195 mutex_init(&gameport->drv_mutex);
31196 device_initialize(&gameport->dev);
31197 dev_set_name(&gameport->dev, "gameport%lu",
31198 - (unsigned long)atomic_inc_return(&gameport_no) - 1);
31199 + (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
31200 gameport->dev.bus = &gameport_bus;
31201 gameport->dev.release = gameport_release_port;
31202 if (gameport->parent)
31203 diff -urNp linux-2.6.39.1/drivers/input/input.c linux-2.6.39.1/drivers/input/input.c
31204 --- linux-2.6.39.1/drivers/input/input.c 2011-05-19 00:06:34.000000000 -0400
31205 +++ linux-2.6.39.1/drivers/input/input.c 2011-05-22 19:36:31.000000000 -0400
31206 @@ -1815,7 +1815,7 @@ static void input_cleanse_bitmasks(struc
31207 */
31208 int input_register_device(struct input_dev *dev)
31209 {
31210 - static atomic_t input_no = ATOMIC_INIT(0);
31211 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
31212 struct input_handler *handler;
31213 const char *path;
31214 int error;
31215 @@ -1852,7 +1852,7 @@ int input_register_device(struct input_d
31216 dev->setkeycode = input_default_setkeycode;
31217
31218 dev_set_name(&dev->dev, "input%ld",
31219 - (unsigned long) atomic_inc_return(&input_no) - 1);
31220 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
31221
31222 error = device_add(&dev->dev);
31223 if (error)
31224 diff -urNp linux-2.6.39.1/drivers/input/joystick/sidewinder.c linux-2.6.39.1/drivers/input/joystick/sidewinder.c
31225 --- linux-2.6.39.1/drivers/input/joystick/sidewinder.c 2011-05-19 00:06:34.000000000 -0400
31226 +++ linux-2.6.39.1/drivers/input/joystick/sidewinder.c 2011-05-22 19:36:31.000000000 -0400
31227 @@ -30,6 +30,7 @@
31228 #include <linux/kernel.h>
31229 #include <linux/module.h>
31230 #include <linux/slab.h>
31231 +#include <linux/sched.h>
31232 #include <linux/init.h>
31233 #include <linux/input.h>
31234 #include <linux/gameport.h>
31235 @@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
31236 unsigned char buf[SW_LENGTH];
31237 int i;
31238
31239 + pax_track_stack();
31240 +
31241 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
31242
31243 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
31244 diff -urNp linux-2.6.39.1/drivers/input/joystick/xpad.c linux-2.6.39.1/drivers/input/joystick/xpad.c
31245 --- linux-2.6.39.1/drivers/input/joystick/xpad.c 2011-05-19 00:06:34.000000000 -0400
31246 +++ linux-2.6.39.1/drivers/input/joystick/xpad.c 2011-05-22 19:36:31.000000000 -0400
31247 @@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
31248
31249 static int xpad_led_probe(struct usb_xpad *xpad)
31250 {
31251 - static atomic_t led_seq = ATOMIC_INIT(0);
31252 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
31253 long led_no;
31254 struct xpad_led *led;
31255 struct led_classdev *led_cdev;
31256 @@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
31257 if (!led)
31258 return -ENOMEM;
31259
31260 - led_no = (long)atomic_inc_return(&led_seq) - 1;
31261 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
31262
31263 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
31264 led->xpad = xpad;
31265 diff -urNp linux-2.6.39.1/drivers/input/mousedev.c linux-2.6.39.1/drivers/input/mousedev.c
31266 --- linux-2.6.39.1/drivers/input/mousedev.c 2011-05-19 00:06:34.000000000 -0400
31267 +++ linux-2.6.39.1/drivers/input/mousedev.c 2011-05-22 19:36:31.000000000 -0400
31268 @@ -764,7 +764,7 @@ static ssize_t mousedev_read(struct file
31269
31270 spin_unlock_irq(&client->packet_lock);
31271
31272 - if (copy_to_user(buffer, data, count))
31273 + if (count > sizeof(data) || copy_to_user(buffer, data, count))
31274 return -EFAULT;
31275
31276 return count;
31277 diff -urNp linux-2.6.39.1/drivers/input/serio/serio.c linux-2.6.39.1/drivers/input/serio/serio.c
31278 --- linux-2.6.39.1/drivers/input/serio/serio.c 2011-05-19 00:06:34.000000000 -0400
31279 +++ linux-2.6.39.1/drivers/input/serio/serio.c 2011-05-22 19:36:31.000000000 -0400
31280 @@ -497,7 +497,7 @@ static void serio_release_port(struct de
31281 */
31282 static void serio_init_port(struct serio *serio)
31283 {
31284 - static atomic_t serio_no = ATOMIC_INIT(0);
31285 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
31286
31287 __module_get(THIS_MODULE);
31288
31289 @@ -508,7 +508,7 @@ static void serio_init_port(struct serio
31290 mutex_init(&serio->drv_mutex);
31291 device_initialize(&serio->dev);
31292 dev_set_name(&serio->dev, "serio%ld",
31293 - (long)atomic_inc_return(&serio_no) - 1);
31294 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
31295 serio->dev.bus = &serio_bus;
31296 serio->dev.release = serio_release_port;
31297 serio->dev.groups = serio_device_attr_groups;
31298 diff -urNp linux-2.6.39.1/drivers/isdn/capi/capi.c linux-2.6.39.1/drivers/isdn/capi/capi.c
31299 --- linux-2.6.39.1/drivers/isdn/capi/capi.c 2011-05-19 00:06:34.000000000 -0400
31300 +++ linux-2.6.39.1/drivers/isdn/capi/capi.c 2011-05-22 19:36:31.000000000 -0400
31301 @@ -89,8 +89,8 @@ struct capiminor {
31302
31303 struct capi20_appl *ap;
31304 u32 ncci;
31305 - atomic_t datahandle;
31306 - atomic_t msgid;
31307 + atomic_unchecked_t datahandle;
31308 + atomic_unchecked_t msgid;
31309
31310 struct tty_port port;
31311 int ttyinstop;
31312 @@ -414,7 +414,7 @@ gen_data_b3_resp_for(struct capiminor *m
31313 capimsg_setu16(s, 2, mp->ap->applid);
31314 capimsg_setu8 (s, 4, CAPI_DATA_B3);
31315 capimsg_setu8 (s, 5, CAPI_RESP);
31316 - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
31317 + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
31318 capimsg_setu32(s, 8, mp->ncci);
31319 capimsg_setu16(s, 12, datahandle);
31320 }
31321 @@ -547,14 +547,14 @@ static void handle_minor_send(struct cap
31322 mp->outbytes -= len;
31323 spin_unlock_bh(&mp->outlock);
31324
31325 - datahandle = atomic_inc_return(&mp->datahandle);
31326 + datahandle = atomic_inc_return_unchecked(&mp->datahandle);
31327 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
31328 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31329 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31330 capimsg_setu16(skb->data, 2, mp->ap->applid);
31331 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
31332 capimsg_setu8 (skb->data, 5, CAPI_REQ);
31333 - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
31334 + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
31335 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
31336 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
31337 capimsg_setu16(skb->data, 16, len); /* Data length */
31338 diff -urNp linux-2.6.39.1/drivers/isdn/gigaset/common.c linux-2.6.39.1/drivers/isdn/gigaset/common.c
31339 --- linux-2.6.39.1/drivers/isdn/gigaset/common.c 2011-05-19 00:06:34.000000000 -0400
31340 +++ linux-2.6.39.1/drivers/isdn/gigaset/common.c 2011-05-22 19:36:31.000000000 -0400
31341 @@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct
31342 cs->commands_pending = 0;
31343 cs->cur_at_seq = 0;
31344 cs->gotfwver = -1;
31345 - cs->open_count = 0;
31346 + local_set(&cs->open_count, 0);
31347 cs->dev = NULL;
31348 cs->tty = NULL;
31349 cs->tty_dev = NULL;
31350 diff -urNp linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h
31351 --- linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h 2011-05-19 00:06:34.000000000 -0400
31352 +++ linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h 2011-05-22 19:36:31.000000000 -0400
31353 @@ -35,6 +35,7 @@
31354 #include <linux/tty_driver.h>
31355 #include <linux/list.h>
31356 #include <asm/atomic.h>
31357 +#include <asm/local.h>
31358
31359 #define GIG_VERSION {0, 5, 0, 0}
31360 #define GIG_COMPAT {0, 4, 0, 0}
31361 @@ -433,7 +434,7 @@ struct cardstate {
31362 spinlock_t cmdlock;
31363 unsigned curlen, cmdbytes;
31364
31365 - unsigned open_count;
31366 + local_t open_count;
31367 struct tty_struct *tty;
31368 struct tasklet_struct if_wake_tasklet;
31369 unsigned control_state;
31370 diff -urNp linux-2.6.39.1/drivers/isdn/gigaset/interface.c linux-2.6.39.1/drivers/isdn/gigaset/interface.c
31371 --- linux-2.6.39.1/drivers/isdn/gigaset/interface.c 2011-05-19 00:06:34.000000000 -0400
31372 +++ linux-2.6.39.1/drivers/isdn/gigaset/interface.c 2011-05-22 19:36:31.000000000 -0400
31373 @@ -160,9 +160,7 @@ static int if_open(struct tty_struct *tt
31374 return -ERESTARTSYS;
31375 tty->driver_data = cs;
31376
31377 - ++cs->open_count;
31378 -
31379 - if (cs->open_count == 1) {
31380 + if (local_inc_return(&cs->open_count) == 1) {
31381 spin_lock_irqsave(&cs->lock, flags);
31382 cs->tty = tty;
31383 spin_unlock_irqrestore(&cs->lock, flags);
31384 @@ -190,10 +188,10 @@ static void if_close(struct tty_struct *
31385
31386 if (!cs->connected)
31387 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31388 - else if (!cs->open_count)
31389 + else if (!local_read(&cs->open_count))
31390 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31391 else {
31392 - if (!--cs->open_count) {
31393 + if (!local_dec_return(&cs->open_count)) {
31394 spin_lock_irqsave(&cs->lock, flags);
31395 cs->tty = NULL;
31396 spin_unlock_irqrestore(&cs->lock, flags);
31397 @@ -228,7 +226,7 @@ static int if_ioctl(struct tty_struct *t
31398 if (!cs->connected) {
31399 gig_dbg(DEBUG_IF, "not connected");
31400 retval = -ENODEV;
31401 - } else if (!cs->open_count)
31402 + } else if (!local_read(&cs->open_count))
31403 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31404 else {
31405 retval = 0;
31406 @@ -358,7 +356,7 @@ static int if_write(struct tty_struct *t
31407 retval = -ENODEV;
31408 goto done;
31409 }
31410 - if (!cs->open_count) {
31411 + if (!local_read(&cs->open_count)) {
31412 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31413 retval = -ENODEV;
31414 goto done;
31415 @@ -411,7 +409,7 @@ static int if_write_room(struct tty_stru
31416 if (!cs->connected) {
31417 gig_dbg(DEBUG_IF, "not connected");
31418 retval = -ENODEV;
31419 - } else if (!cs->open_count)
31420 + } else if (!local_read(&cs->open_count))
31421 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31422 else if (cs->mstate != MS_LOCKED) {
31423 dev_warn(cs->dev, "can't write to unlocked device\n");
31424 @@ -441,7 +439,7 @@ static int if_chars_in_buffer(struct tty
31425
31426 if (!cs->connected)
31427 gig_dbg(DEBUG_IF, "not connected");
31428 - else if (!cs->open_count)
31429 + else if (!local_read(&cs->open_count))
31430 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31431 else if (cs->mstate != MS_LOCKED)
31432 dev_warn(cs->dev, "can't write to unlocked device\n");
31433 @@ -469,7 +467,7 @@ static void if_throttle(struct tty_struc
31434
31435 if (!cs->connected)
31436 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31437 - else if (!cs->open_count)
31438 + else if (!local_read(&cs->open_count))
31439 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31440 else
31441 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31442 @@ -493,7 +491,7 @@ static void if_unthrottle(struct tty_str
31443
31444 if (!cs->connected)
31445 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31446 - else if (!cs->open_count)
31447 + else if (!local_read(&cs->open_count))
31448 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31449 else
31450 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31451 @@ -524,7 +522,7 @@ static void if_set_termios(struct tty_st
31452 goto out;
31453 }
31454
31455 - if (!cs->open_count) {
31456 + if (!local_read(&cs->open_count)) {
31457 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31458 goto out;
31459 }
31460 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c
31461 --- linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c 2011-05-19 00:06:34.000000000 -0400
31462 +++ linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c 2011-05-22 19:36:31.000000000 -0400
31463 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
31464 }
31465 if (left) {
31466 if (t4file->user) {
31467 - if (copy_from_user(buf, dp, left))
31468 + if (left > sizeof buf || copy_from_user(buf, dp, left))
31469 return -EFAULT;
31470 } else {
31471 memcpy(buf, dp, left);
31472 @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo
31473 }
31474 if (left) {
31475 if (config->user) {
31476 - if (copy_from_user(buf, dp, left))
31477 + if (left > sizeof buf || copy_from_user(buf, dp, left))
31478 return -EFAULT;
31479 } else {
31480 memcpy(buf, dp, left);
31481 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c
31482 --- linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-19 00:06:34.000000000 -0400
31483 +++ linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-22 19:36:31.000000000 -0400
31484 @@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
31485 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
31486 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
31487
31488 + pax_track_stack();
31489
31490 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
31491 {
31492 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c
31493 --- linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c 2011-05-19 00:06:34.000000000 -0400
31494 +++ linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c 2011-05-22 19:36:31.000000000 -0400
31495 @@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
31496 IDI_SYNC_REQ req;
31497 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31498
31499 + pax_track_stack();
31500 +
31501 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31502
31503 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31504 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c
31505 --- linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-19 00:06:34.000000000 -0400
31506 +++ linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-22 19:36:31.000000000 -0400
31507 @@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
31508 IDI_SYNC_REQ req;
31509 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31510
31511 + pax_track_stack();
31512 +
31513 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31514
31515 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31516 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c
31517 --- linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-19 00:06:34.000000000 -0400
31518 +++ linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-22 19:36:31.000000000 -0400
31519 @@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
31520 IDI_SYNC_REQ req;
31521 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31522
31523 + pax_track_stack();
31524 +
31525 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31526
31527 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31528 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c
31529 --- linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c 2011-05-19 00:06:34.000000000 -0400
31530 +++ linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c 2011-05-22 19:36:31.000000000 -0400
31531 @@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
31532 IDI_SYNC_REQ req;
31533 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31534
31535 + pax_track_stack();
31536 +
31537 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31538
31539 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31540 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c
31541 --- linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c 2011-05-19 00:06:34.000000000 -0400
31542 +++ linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c 2011-05-22 19:36:31.000000000 -0400
31543 @@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
31544 dword d;
31545 word w;
31546
31547 + pax_track_stack();
31548 +
31549 a = plci->adapter;
31550 Id = ((word)plci->Id<<8)|a->Id;
31551 PUT_WORD(&SS_Ind[4],0x0000);
31552 @@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
31553 word j, n, w;
31554 dword d;
31555
31556 + pax_track_stack();
31557 +
31558
31559 for(i=0;i<8;i++) bp_parms[i].length = 0;
31560 for(i=0;i<2;i++) global_config[i].length = 0;
31561 @@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
31562 const byte llc3[] = {4,3,2,2,6,6,0};
31563 const byte header[] = {0,2,3,3,0,0,0};
31564
31565 + pax_track_stack();
31566 +
31567 for(i=0;i<8;i++) bp_parms[i].length = 0;
31568 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
31569 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
31570 @@ -14760,6 +14766,8 @@ static void group_optimization(DIVA_CAPI
31571 word appl_number_group_type[MAX_APPL];
31572 PLCI *auxplci;
31573
31574 + pax_track_stack();
31575 +
31576 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
31577
31578 if(!a->group_optimization_enabled)
31579 diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c
31580 --- linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-19 00:06:34.000000000 -0400
31581 +++ linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-22 19:36:31.000000000 -0400
31582 @@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
31583 IDI_SYNC_REQ req;
31584 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31585
31586 + pax_track_stack();
31587 +
31588 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31589
31590 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31591 diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c
31592 --- linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c 2011-05-19 00:06:34.000000000 -0400
31593 +++ linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c 2011-05-22 19:36:31.000000000 -0400
31594 @@ -1292,6 +1292,8 @@ isdn_ioctl(struct file *file, uint cmd,
31595 } iocpar;
31596 void __user *argp = (void __user *)arg;
31597
31598 + pax_track_stack();
31599 +
31600 #define name iocpar.name
31601 #define bname iocpar.bname
31602 #define iocts iocpar.iocts
31603 diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c
31604 --- linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c 2011-05-19 00:06:34.000000000 -0400
31605 +++ linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c 2011-05-22 19:36:31.000000000 -0400
31606 @@ -400,7 +400,7 @@ isdn_net_stat_callback(int idx, isdn_ctr
31607 isdn_net_local *lp = p->local;
31608 #ifdef CONFIG_ISDN_X25
31609 struct concap_proto *cprot = lp->netdev->cprot;
31610 - struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31611 + const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31612 #endif
31613 switch (cmd) {
31614 case ISDN_STAT_BSENT:
31615 @@ -831,7 +831,7 @@ isdn_net_hangup(struct net_device *d)
31616 isdn_ctrl cmd;
31617 #ifdef CONFIG_ISDN_X25
31618 struct concap_proto *cprot = lp->netdev->cprot;
31619 - struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31620 + const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31621 #endif
31622
31623 if (lp->flags & ISDN_NET_CONNECTED) {
31624 diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c
31625 --- linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c 2011-05-19 00:06:34.000000000 -0400
31626 +++ linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c 2011-05-22 19:36:31.000000000 -0400
31627 @@ -52,7 +52,7 @@ static int isdn_x25iface_connect_ind( st
31628 static int isdn_x25iface_disconn_ind( struct concap_proto * );
31629
31630
31631 -static struct concap_proto_ops ix25_pops = {
31632 +static const struct concap_proto_ops ix25_pops = {
31633 &isdn_x25iface_proto_new,
31634 &isdn_x25iface_proto_del,
31635 &isdn_x25iface_proto_restart,
31636 diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h
31637 --- linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h 2011-05-19 00:06:34.000000000 -0400
31638 +++ linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h 2011-05-22 19:36:31.000000000 -0400
31639 @@ -23,7 +23,7 @@
31640 #include <linux/isdn.h>
31641 #include <linux/concap.h>
31642
31643 -extern struct concap_proto_ops * isdn_x25iface_concap_proto_ops_pt;
31644 +extern const struct concap_proto_ops *isdn_x25iface_concap_proto_ops_pt;
31645 extern struct concap_proto * isdn_x25iface_proto_new(void);
31646
31647
31648 diff -urNp linux-2.6.39.1/drivers/isdn/icn/icn.c linux-2.6.39.1/drivers/isdn/icn/icn.c
31649 --- linux-2.6.39.1/drivers/isdn/icn/icn.c 2011-05-19 00:06:34.000000000 -0400
31650 +++ linux-2.6.39.1/drivers/isdn/icn/icn.c 2011-05-22 19:36:31.000000000 -0400
31651 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
31652 if (count > len)
31653 count = len;
31654 if (user) {
31655 - if (copy_from_user(msg, buf, count))
31656 + if (count > sizeof msg || copy_from_user(msg, buf, count))
31657 return -EFAULT;
31658 } else
31659 memcpy(msg, buf, count);
31660 diff -urNp linux-2.6.39.1/drivers/lguest/core.c linux-2.6.39.1/drivers/lguest/core.c
31661 --- linux-2.6.39.1/drivers/lguest/core.c 2011-05-19 00:06:34.000000000 -0400
31662 +++ linux-2.6.39.1/drivers/lguest/core.c 2011-05-22 19:36:31.000000000 -0400
31663 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
31664 * it's worked so far. The end address needs +1 because __get_vm_area
31665 * allocates an extra guard page, so we need space for that.
31666 */
31667 +
31668 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31669 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31670 + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31671 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31672 +#else
31673 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31674 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31675 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31676 +#endif
31677 +
31678 if (!switcher_vma) {
31679 err = -ENOMEM;
31680 printk("lguest: could not map switcher pages high\n");
31681 @@ -119,7 +127,7 @@ static __init int map_switcher(void)
31682 * Now the Switcher is mapped at the right address, we can't fail!
31683 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
31684 */
31685 - memcpy(switcher_vma->addr, start_switcher_text,
31686 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31687 end_switcher_text - start_switcher_text);
31688
31689 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31690 diff -urNp linux-2.6.39.1/drivers/lguest/lguest_device.c linux-2.6.39.1/drivers/lguest/lguest_device.c
31691 --- linux-2.6.39.1/drivers/lguest/lguest_device.c 2011-05-19 00:06:34.000000000 -0400
31692 +++ linux-2.6.39.1/drivers/lguest/lguest_device.c 2011-05-22 19:36:31.000000000 -0400
31693 @@ -374,7 +374,7 @@ error:
31694 }
31695
31696 /* The ops structure which hooks everything together. */
31697 -static struct virtio_config_ops lguest_config_ops = {
31698 +static const struct virtio_config_ops lguest_config_ops = {
31699 .get_features = lg_get_features,
31700 .finalize_features = lg_finalize_features,
31701 .get = lg_get,
31702 diff -urNp linux-2.6.39.1/drivers/lguest/x86/core.c linux-2.6.39.1/drivers/lguest/x86/core.c
31703 --- linux-2.6.39.1/drivers/lguest/x86/core.c 2011-05-19 00:06:34.000000000 -0400
31704 +++ linux-2.6.39.1/drivers/lguest/x86/core.c 2011-05-22 19:36:31.000000000 -0400
31705 @@ -59,7 +59,7 @@ static struct {
31706 /* Offset from where switcher.S was compiled to where we've copied it */
31707 static unsigned long switcher_offset(void)
31708 {
31709 - return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31710 + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31711 }
31712
31713 /* This cpu's struct lguest_pages. */
31714 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
31715 * These copies are pretty cheap, so we do them unconditionally: */
31716 /* Save the current Host top-level page directory.
31717 */
31718 +
31719 +#ifdef CONFIG_PAX_PER_CPU_PGD
31720 + pages->state.host_cr3 = read_cr3();
31721 +#else
31722 pages->state.host_cr3 = __pa(current->mm->pgd);
31723 +#endif
31724 +
31725 /*
31726 * Set up the Guest's page tables to see this CPU's pages (and no
31727 * other CPU's pages).
31728 @@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void)
31729 * compiled-in switcher code and the high-mapped copy we just made.
31730 */
31731 for (i = 0; i < IDT_ENTRIES; i++)
31732 - default_idt_entries[i] += switcher_offset();
31733 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31734
31735 /*
31736 * Set up the Switcher's per-cpu areas.
31737 @@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void)
31738 * it will be undisturbed when we switch. To change %cs and jump we
31739 * need this structure to feed to Intel's "lcall" instruction.
31740 */
31741 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31742 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31743 lguest_entry.segment = LGUEST_CS;
31744
31745 /*
31746 diff -urNp linux-2.6.39.1/drivers/lguest/x86/switcher_32.S linux-2.6.39.1/drivers/lguest/x86/switcher_32.S
31747 --- linux-2.6.39.1/drivers/lguest/x86/switcher_32.S 2011-05-19 00:06:34.000000000 -0400
31748 +++ linux-2.6.39.1/drivers/lguest/x86/switcher_32.S 2011-05-22 19:36:31.000000000 -0400
31749 @@ -87,6 +87,7 @@
31750 #include <asm/page.h>
31751 #include <asm/segment.h>
31752 #include <asm/lguest.h>
31753 +#include <asm/processor-flags.h>
31754
31755 // We mark the start of the code to copy
31756 // It's placed in .text tho it's never run here
31757 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31758 // Changes type when we load it: damn Intel!
31759 // For after we switch over our page tables
31760 // That entry will be read-only: we'd crash.
31761 +
31762 +#ifdef CONFIG_PAX_KERNEXEC
31763 + mov %cr0, %edx
31764 + xor $X86_CR0_WP, %edx
31765 + mov %edx, %cr0
31766 +#endif
31767 +
31768 movl $(GDT_ENTRY_TSS*8), %edx
31769 ltr %dx
31770
31771 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31772 // Let's clear it again for our return.
31773 // The GDT descriptor of the Host
31774 // Points to the table after two "size" bytes
31775 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31776 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31777 // Clear "used" from type field (byte 5, bit 2)
31778 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31779 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31780 +
31781 +#ifdef CONFIG_PAX_KERNEXEC
31782 + mov %cr0, %eax
31783 + xor $X86_CR0_WP, %eax
31784 + mov %eax, %cr0
31785 +#endif
31786
31787 // Once our page table's switched, the Guest is live!
31788 // The Host fades as we run this final step.
31789 @@ -295,13 +309,12 @@ deliver_to_host:
31790 // I consulted gcc, and it gave
31791 // These instructions, which I gladly credit:
31792 leal (%edx,%ebx,8), %eax
31793 - movzwl (%eax),%edx
31794 - movl 4(%eax), %eax
31795 - xorw %ax, %ax
31796 - orl %eax, %edx
31797 + movl 4(%eax), %edx
31798 + movw (%eax), %dx
31799 // Now the address of the handler's in %edx
31800 // We call it now: its "iret" drops us home.
31801 - jmp *%edx
31802 + ljmp $__KERNEL_CS, $1f
31803 +1: jmp *%edx
31804
31805 // Every interrupt can come to us here
31806 // But we must truly tell each apart.
31807 diff -urNp linux-2.6.39.1/drivers/md/dm.c linux-2.6.39.1/drivers/md/dm.c
31808 --- linux-2.6.39.1/drivers/md/dm.c 2011-05-19 00:06:34.000000000 -0400
31809 +++ linux-2.6.39.1/drivers/md/dm.c 2011-05-22 19:36:31.000000000 -0400
31810 @@ -162,9 +162,9 @@ struct mapped_device {
31811 /*
31812 * Event handling.
31813 */
31814 - atomic_t event_nr;
31815 + atomic_unchecked_t event_nr;
31816 wait_queue_head_t eventq;
31817 - atomic_t uevent_seq;
31818 + atomic_unchecked_t uevent_seq;
31819 struct list_head uevent_list;
31820 spinlock_t uevent_lock; /* Protect access to uevent_list */
31821
31822 @@ -1836,8 +1836,8 @@ static struct mapped_device *alloc_dev(i
31823 rwlock_init(&md->map_lock);
31824 atomic_set(&md->holders, 1);
31825 atomic_set(&md->open_count, 0);
31826 - atomic_set(&md->event_nr, 0);
31827 - atomic_set(&md->uevent_seq, 0);
31828 + atomic_set_unchecked(&md->event_nr, 0);
31829 + atomic_set_unchecked(&md->uevent_seq, 0);
31830 INIT_LIST_HEAD(&md->uevent_list);
31831 spin_lock_init(&md->uevent_lock);
31832
31833 @@ -1971,7 +1971,7 @@ static void event_callback(void *context
31834
31835 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31836
31837 - atomic_inc(&md->event_nr);
31838 + atomic_inc_unchecked(&md->event_nr);
31839 wake_up(&md->eventq);
31840 }
31841
31842 @@ -2547,18 +2547,18 @@ int dm_kobject_uevent(struct mapped_devi
31843
31844 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31845 {
31846 - return atomic_add_return(1, &md->uevent_seq);
31847 + return atomic_add_return_unchecked(1, &md->uevent_seq);
31848 }
31849
31850 uint32_t dm_get_event_nr(struct mapped_device *md)
31851 {
31852 - return atomic_read(&md->event_nr);
31853 + return atomic_read_unchecked(&md->event_nr);
31854 }
31855
31856 int dm_wait_event(struct mapped_device *md, int event_nr)
31857 {
31858 return wait_event_interruptible(md->eventq,
31859 - (event_nr != atomic_read(&md->event_nr)));
31860 + (event_nr != atomic_read_unchecked(&md->event_nr)));
31861 }
31862
31863 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31864 diff -urNp linux-2.6.39.1/drivers/md/dm-crypt.c linux-2.6.39.1/drivers/md/dm-crypt.c
31865 --- linux-2.6.39.1/drivers/md/dm-crypt.c 2011-05-19 00:06:34.000000000 -0400
31866 +++ linux-2.6.39.1/drivers/md/dm-crypt.c 2011-05-22 19:36:31.000000000 -0400
31867 @@ -138,7 +138,7 @@ struct crypt_config {
31868 char *cipher;
31869 char *cipher_string;
31870
31871 - struct crypt_iv_operations *iv_gen_ops;
31872 + const struct crypt_iv_operations *iv_gen_ops;
31873 union {
31874 struct iv_essiv_private essiv;
31875 struct iv_benbi_private benbi;
31876 @@ -620,15 +620,15 @@ static int crypt_iv_lmk_post(struct cryp
31877 return r;
31878 }
31879
31880 -static struct crypt_iv_operations crypt_iv_plain_ops = {
31881 +static const struct crypt_iv_operations crypt_iv_plain_ops = {
31882 .generator = crypt_iv_plain_gen
31883 };
31884
31885 -static struct crypt_iv_operations crypt_iv_plain64_ops = {
31886 +static const struct crypt_iv_operations crypt_iv_plain64_ops = {
31887 .generator = crypt_iv_plain64_gen
31888 };
31889
31890 -static struct crypt_iv_operations crypt_iv_essiv_ops = {
31891 +static const struct crypt_iv_operations crypt_iv_essiv_ops = {
31892 .ctr = crypt_iv_essiv_ctr,
31893 .dtr = crypt_iv_essiv_dtr,
31894 .init = crypt_iv_essiv_init,
31895 @@ -636,17 +636,17 @@ static struct crypt_iv_operations crypt_
31896 .generator = crypt_iv_essiv_gen
31897 };
31898
31899 -static struct crypt_iv_operations crypt_iv_benbi_ops = {
31900 +static const struct crypt_iv_operations crypt_iv_benbi_ops = {
31901 .ctr = crypt_iv_benbi_ctr,
31902 .dtr = crypt_iv_benbi_dtr,
31903 .generator = crypt_iv_benbi_gen
31904 };
31905
31906 -static struct crypt_iv_operations crypt_iv_null_ops = {
31907 +static const struct crypt_iv_operations crypt_iv_null_ops = {
31908 .generator = crypt_iv_null_gen
31909 };
31910
31911 -static struct crypt_iv_operations crypt_iv_lmk_ops = {
31912 +static const struct crypt_iv_operations crypt_iv_lmk_ops = {
31913 .ctr = crypt_iv_lmk_ctr,
31914 .dtr = crypt_iv_lmk_dtr,
31915 .init = crypt_iv_lmk_init,
31916 diff -urNp linux-2.6.39.1/drivers/md/dm-ioctl.c linux-2.6.39.1/drivers/md/dm-ioctl.c
31917 --- linux-2.6.39.1/drivers/md/dm-ioctl.c 2011-05-19 00:06:34.000000000 -0400
31918 +++ linux-2.6.39.1/drivers/md/dm-ioctl.c 2011-05-22 19:36:31.000000000 -0400
31919 @@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str
31920 cmd == DM_LIST_VERSIONS_CMD)
31921 return 0;
31922
31923 - if ((cmd == DM_DEV_CREATE_CMD)) {
31924 + if (cmd == DM_DEV_CREATE_CMD) {
31925 if (!*param->name) {
31926 DMWARN("name not supplied when creating device");
31927 return -EINVAL;
31928 diff -urNp linux-2.6.39.1/drivers/md/dm-raid1.c linux-2.6.39.1/drivers/md/dm-raid1.c
31929 --- linux-2.6.39.1/drivers/md/dm-raid1.c 2011-05-19 00:06:34.000000000 -0400
31930 +++ linux-2.6.39.1/drivers/md/dm-raid1.c 2011-05-22 19:36:31.000000000 -0400
31931 @@ -42,7 +42,7 @@ enum dm_raid1_error {
31932
31933 struct mirror {
31934 struct mirror_set *ms;
31935 - atomic_t error_count;
31936 + atomic_unchecked_t error_count;
31937 unsigned long error_type;
31938 struct dm_dev *dev;
31939 sector_t offset;
31940 @@ -187,7 +187,7 @@ static struct mirror *get_valid_mirror(s
31941 struct mirror *m;
31942
31943 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31944 - if (!atomic_read(&m->error_count))
31945 + if (!atomic_read_unchecked(&m->error_count))
31946 return m;
31947
31948 return NULL;
31949 @@ -219,7 +219,7 @@ static void fail_mirror(struct mirror *m
31950 * simple way to tell if a device has encountered
31951 * errors.
31952 */
31953 - atomic_inc(&m->error_count);
31954 + atomic_inc_unchecked(&m->error_count);
31955
31956 if (test_and_set_bit(error_type, &m->error_type))
31957 return;
31958 @@ -410,7 +410,7 @@ static struct mirror *choose_mirror(stru
31959 struct mirror *m = get_default_mirror(ms);
31960
31961 do {
31962 - if (likely(!atomic_read(&m->error_count)))
31963 + if (likely(!atomic_read_unchecked(&m->error_count)))
31964 return m;
31965
31966 if (m-- == ms->mirror)
31967 @@ -424,7 +424,7 @@ static int default_ok(struct mirror *m)
31968 {
31969 struct mirror *default_mirror = get_default_mirror(m->ms);
31970
31971 - return !atomic_read(&default_mirror->error_count);
31972 + return !atomic_read_unchecked(&default_mirror->error_count);
31973 }
31974
31975 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31976 @@ -561,7 +561,7 @@ static void do_reads(struct mirror_set *
31977 */
31978 if (likely(region_in_sync(ms, region, 1)))
31979 m = choose_mirror(ms, bio->bi_sector);
31980 - else if (m && atomic_read(&m->error_count))
31981 + else if (m && atomic_read_unchecked(&m->error_count))
31982 m = NULL;
31983
31984 if (likely(m))
31985 @@ -939,7 +939,7 @@ static int get_mirror(struct mirror_set
31986 }
31987
31988 ms->mirror[mirror].ms = ms;
31989 - atomic_set(&(ms->mirror[mirror].error_count), 0);
31990 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31991 ms->mirror[mirror].error_type = 0;
31992 ms->mirror[mirror].offset = offset;
31993
31994 @@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ
31995 */
31996 static char device_status_char(struct mirror *m)
31997 {
31998 - if (!atomic_read(&(m->error_count)))
31999 + if (!atomic_read_unchecked(&(m->error_count)))
32000 return 'A';
32001
32002 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
32003 diff -urNp linux-2.6.39.1/drivers/md/dm-stripe.c linux-2.6.39.1/drivers/md/dm-stripe.c
32004 --- linux-2.6.39.1/drivers/md/dm-stripe.c 2011-05-19 00:06:34.000000000 -0400
32005 +++ linux-2.6.39.1/drivers/md/dm-stripe.c 2011-05-22 19:36:31.000000000 -0400
32006 @@ -20,7 +20,7 @@ struct stripe {
32007 struct dm_dev *dev;
32008 sector_t physical_start;
32009
32010 - atomic_t error_count;
32011 + atomic_unchecked_t error_count;
32012 };
32013
32014 struct stripe_c {
32015 @@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
32016 kfree(sc);
32017 return r;
32018 }
32019 - atomic_set(&(sc->stripe[i].error_count), 0);
32020 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
32021 }
32022
32023 ti->private = sc;
32024 @@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
32025 DMEMIT("%d ", sc->stripes);
32026 for (i = 0; i < sc->stripes; i++) {
32027 DMEMIT("%s ", sc->stripe[i].dev->name);
32028 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
32029 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
32030 'D' : 'A';
32031 }
32032 buffer[i] = '\0';
32033 @@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
32034 */
32035 for (i = 0; i < sc->stripes; i++)
32036 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
32037 - atomic_inc(&(sc->stripe[i].error_count));
32038 - if (atomic_read(&(sc->stripe[i].error_count)) <
32039 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
32040 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
32041 DM_IO_ERROR_THRESHOLD)
32042 schedule_work(&sc->trigger_event);
32043 }
32044 diff -urNp linux-2.6.39.1/drivers/md/dm-table.c linux-2.6.39.1/drivers/md/dm-table.c
32045 --- linux-2.6.39.1/drivers/md/dm-table.c 2011-06-03 00:04:14.000000000 -0400
32046 +++ linux-2.6.39.1/drivers/md/dm-table.c 2011-06-03 00:32:05.000000000 -0400
32047 @@ -390,7 +390,7 @@ static int device_area_is_invalid(struct
32048 if (!dev_size)
32049 return 0;
32050
32051 - if ((start >= dev_size) || (start + len > dev_size)) {
32052 + if ((start >= dev_size) || (len > dev_size - start)) {
32053 DMWARN("%s: %s too small for target: "
32054 "start=%llu, len=%llu, dev_size=%llu",
32055 dm_device_name(ti->table->md), bdevname(bdev, b),
32056 diff -urNp linux-2.6.39.1/drivers/md/md.c linux-2.6.39.1/drivers/md/md.c
32057 --- linux-2.6.39.1/drivers/md/md.c 2011-06-03 00:04:14.000000000 -0400
32058 +++ linux-2.6.39.1/drivers/md/md.c 2011-06-03 00:32:05.000000000 -0400
32059 @@ -226,10 +226,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
32060 * start build, activate spare
32061 */
32062 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
32063 -static atomic_t md_event_count;
32064 +static atomic_unchecked_t md_event_count;
32065 void md_new_event(mddev_t *mddev)
32066 {
32067 - atomic_inc(&md_event_count);
32068 + atomic_inc_unchecked(&md_event_count);
32069 wake_up(&md_event_waiters);
32070 }
32071 EXPORT_SYMBOL_GPL(md_new_event);
32072 @@ -239,7 +239,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
32073 */
32074 static void md_new_event_inintr(mddev_t *mddev)
32075 {
32076 - atomic_inc(&md_event_count);
32077 + atomic_inc_unchecked(&md_event_count);
32078 wake_up(&md_event_waiters);
32079 }
32080
32081 @@ -1454,7 +1454,7 @@ static int super_1_load(mdk_rdev_t *rdev
32082
32083 rdev->preferred_minor = 0xffff;
32084 rdev->data_offset = le64_to_cpu(sb->data_offset);
32085 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
32086 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
32087
32088 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
32089 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
32090 @@ -1632,7 +1632,7 @@ static void super_1_sync(mddev_t *mddev,
32091 else
32092 sb->resync_offset = cpu_to_le64(0);
32093
32094 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
32095 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
32096
32097 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
32098 sb->size = cpu_to_le64(mddev->dev_sectors);
32099 @@ -2414,7 +2414,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
32100 static ssize_t
32101 errors_show(mdk_rdev_t *rdev, char *page)
32102 {
32103 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
32104 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
32105 }
32106
32107 static ssize_t
32108 @@ -2423,7 +2423,7 @@ errors_store(mdk_rdev_t *rdev, const cha
32109 char *e;
32110 unsigned long n = simple_strtoul(buf, &e, 10);
32111 if (*buf && (*e == 0 || *e == '\n')) {
32112 - atomic_set(&rdev->corrected_errors, n);
32113 + atomic_set_unchecked(&rdev->corrected_errors, n);
32114 return len;
32115 }
32116 return -EINVAL;
32117 @@ -2779,8 +2779,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
32118 rdev->last_read_error.tv_sec = 0;
32119 rdev->last_read_error.tv_nsec = 0;
32120 atomic_set(&rdev->nr_pending, 0);
32121 - atomic_set(&rdev->read_errors, 0);
32122 - atomic_set(&rdev->corrected_errors, 0);
32123 + atomic_set_unchecked(&rdev->read_errors, 0);
32124 + atomic_set_unchecked(&rdev->corrected_errors, 0);
32125
32126 INIT_LIST_HEAD(&rdev->same_set);
32127 init_waitqueue_head(&rdev->blocked_wait);
32128 @@ -6388,7 +6388,7 @@ static int md_seq_show(struct seq_file *
32129
32130 spin_unlock(&pers_lock);
32131 seq_printf(seq, "\n");
32132 - mi->event = atomic_read(&md_event_count);
32133 + mi->event = atomic_read_unchecked(&md_event_count);
32134 return 0;
32135 }
32136 if (v == (void*)2) {
32137 @@ -6477,7 +6477,7 @@ static int md_seq_show(struct seq_file *
32138 chunk_kb ? "KB" : "B");
32139 if (bitmap->file) {
32140 seq_printf(seq, ", file: ");
32141 - seq_path(seq, &bitmap->file->f_path, " \t\n");
32142 + seq_path(seq, &bitmap->file->f_path, " \t\n\\");
32143 }
32144
32145 seq_printf(seq, "\n");
32146 @@ -6511,7 +6511,7 @@ static int md_seq_open(struct inode *ino
32147 else {
32148 struct seq_file *p = file->private_data;
32149 p->private = mi;
32150 - mi->event = atomic_read(&md_event_count);
32151 + mi->event = atomic_read_unchecked(&md_event_count);
32152 }
32153 return error;
32154 }
32155 @@ -6527,7 +6527,7 @@ static unsigned int mdstat_poll(struct f
32156 /* always allow read */
32157 mask = POLLIN | POLLRDNORM;
32158
32159 - if (mi->event != atomic_read(&md_event_count))
32160 + if (mi->event != atomic_read_unchecked(&md_event_count))
32161 mask |= POLLERR | POLLPRI;
32162 return mask;
32163 }
32164 @@ -6571,7 +6571,7 @@ static int is_mddev_idle(mddev_t *mddev,
32165 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
32166 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
32167 (int)part_stat_read(&disk->part0, sectors[1]) -
32168 - atomic_read(&disk->sync_io);
32169 + atomic_read_unchecked(&disk->sync_io);
32170 /* sync IO will cause sync_io to increase before the disk_stats
32171 * as sync_io is counted when a request starts, and
32172 * disk_stats is counted when it completes.
32173 diff -urNp linux-2.6.39.1/drivers/md/md.h linux-2.6.39.1/drivers/md/md.h
32174 --- linux-2.6.39.1/drivers/md/md.h 2011-05-19 00:06:34.000000000 -0400
32175 +++ linux-2.6.39.1/drivers/md/md.h 2011-05-22 19:36:31.000000000 -0400
32176 @@ -97,13 +97,13 @@ struct mdk_rdev_s
32177 * only maintained for arrays that
32178 * support hot removal
32179 */
32180 - atomic_t read_errors; /* number of consecutive read errors that
32181 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
32182 * we have tried to ignore.
32183 */
32184 struct timespec last_read_error; /* monotonic time since our
32185 * last read error
32186 */
32187 - atomic_t corrected_errors; /* number of corrected read errors,
32188 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
32189 * for reporting to userspace and storing
32190 * in superblock.
32191 */
32192 @@ -342,7 +342,7 @@ static inline void rdev_dec_pending(mdk_
32193
32194 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
32195 {
32196 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32197 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32198 }
32199
32200 struct mdk_personality
32201 diff -urNp linux-2.6.39.1/drivers/md/raid10.c linux-2.6.39.1/drivers/md/raid10.c
32202 --- linux-2.6.39.1/drivers/md/raid10.c 2011-05-19 00:06:34.000000000 -0400
32203 +++ linux-2.6.39.1/drivers/md/raid10.c 2011-05-22 19:36:31.000000000 -0400
32204 @@ -1209,7 +1209,7 @@ static void end_sync_read(struct bio *bi
32205 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
32206 set_bit(R10BIO_Uptodate, &r10_bio->state);
32207 else {
32208 - atomic_add(r10_bio->sectors,
32209 + atomic_add_unchecked(r10_bio->sectors,
32210 &conf->mirrors[d].rdev->corrected_errors);
32211 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
32212 md_error(r10_bio->mddev,
32213 @@ -1417,7 +1417,7 @@ static void check_decay_read_errors(mdde
32214 {
32215 struct timespec cur_time_mon;
32216 unsigned long hours_since_last;
32217 - unsigned int read_errors = atomic_read(&rdev->read_errors);
32218 + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
32219
32220 ktime_get_ts(&cur_time_mon);
32221
32222 @@ -1439,9 +1439,9 @@ static void check_decay_read_errors(mdde
32223 * overflowing the shift of read_errors by hours_since_last.
32224 */
32225 if (hours_since_last >= 8 * sizeof(read_errors))
32226 - atomic_set(&rdev->read_errors, 0);
32227 + atomic_set_unchecked(&rdev->read_errors, 0);
32228 else
32229 - atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
32230 + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
32231 }
32232
32233 /*
32234 @@ -1476,8 +1476,8 @@ static void fix_read_error(conf_t *conf,
32235 }
32236
32237 check_decay_read_errors(mddev, rdev);
32238 - atomic_inc(&rdev->read_errors);
32239 - cur_read_error_count = atomic_read(&rdev->read_errors);
32240 + atomic_inc_unchecked(&rdev->read_errors);
32241 + cur_read_error_count = atomic_read_unchecked(&rdev->read_errors);
32242 if (cur_read_error_count > max_read_errors) {
32243 rcu_read_unlock();
32244 printk(KERN_NOTICE
32245 @@ -1550,7 +1550,7 @@ static void fix_read_error(conf_t *conf,
32246 test_bit(In_sync, &rdev->flags)) {
32247 atomic_inc(&rdev->nr_pending);
32248 rcu_read_unlock();
32249 - atomic_add(s, &rdev->corrected_errors);
32250 + atomic_add_unchecked(s, &rdev->corrected_errors);
32251 if (sync_page_io(rdev,
32252 r10_bio->devs[sl].addr +
32253 sect,
32254 diff -urNp linux-2.6.39.1/drivers/md/raid1.c linux-2.6.39.1/drivers/md/raid1.c
32255 --- linux-2.6.39.1/drivers/md/raid1.c 2011-05-19 00:06:34.000000000 -0400
32256 +++ linux-2.6.39.1/drivers/md/raid1.c 2011-05-22 19:36:31.000000000 -0400
32257 @@ -1342,7 +1342,7 @@ static void sync_request_write(mddev_t *
32258 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
32259 continue;
32260 rdev = conf->mirrors[d].rdev;
32261 - atomic_add(s, &rdev->corrected_errors);
32262 + atomic_add_unchecked(s, &rdev->corrected_errors);
32263 if (sync_page_io(rdev,
32264 sect,
32265 s<<9,
32266 @@ -1488,7 +1488,7 @@ static void fix_read_error(conf_t *conf,
32267 /* Well, this device is dead */
32268 md_error(mddev, rdev);
32269 else {
32270 - atomic_add(s, &rdev->corrected_errors);
32271 + atomic_add_unchecked(s, &rdev->corrected_errors);
32272 printk(KERN_INFO
32273 "md/raid1:%s: read error corrected "
32274 "(%d sectors at %llu on %s)\n",
32275 diff -urNp linux-2.6.39.1/drivers/md/raid5.c linux-2.6.39.1/drivers/md/raid5.c
32276 --- linux-2.6.39.1/drivers/md/raid5.c 2011-05-19 00:06:34.000000000 -0400
32277 +++ linux-2.6.39.1/drivers/md/raid5.c 2011-05-22 19:36:31.000000000 -0400
32278 @@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea
32279 bi->bi_next = NULL;
32280 if (rw == WRITE &&
32281 test_bit(R5_ReWrite, &sh->dev[i].flags))
32282 - atomic_add(STRIPE_SECTORS,
32283 + atomic_add_unchecked(STRIPE_SECTORS,
32284 &rdev->corrected_errors);
32285 generic_make_request(bi);
32286 } else {
32287 @@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc
32288 clear_bit(R5_ReadError, &sh->dev[i].flags);
32289 clear_bit(R5_ReWrite, &sh->dev[i].flags);
32290 }
32291 - if (atomic_read(&conf->disks[i].rdev->read_errors))
32292 - atomic_set(&conf->disks[i].rdev->read_errors, 0);
32293 + if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
32294 + atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
32295 } else {
32296 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
32297 int retry = 0;
32298 rdev = conf->disks[i].rdev;
32299
32300 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
32301 - atomic_inc(&rdev->read_errors);
32302 + atomic_inc_unchecked(&rdev->read_errors);
32303 if (conf->mddev->degraded >= conf->max_degraded)
32304 printk_rl(KERN_WARNING
32305 "md/raid:%s: read error not correctable "
32306 @@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc
32307 (unsigned long long)(sh->sector
32308 + rdev->data_offset),
32309 bdn);
32310 - else if (atomic_read(&rdev->read_errors)
32311 + else if (atomic_read_unchecked(&rdev->read_errors)
32312 > conf->max_nr_stripes)
32313 printk(KERN_WARNING
32314 "md/raid:%s: Too many read errors, failing device %s.\n",
32315 @@ -1947,6 +1947,7 @@ static sector_t compute_blocknr(struct s
32316 sector_t r_sector;
32317 struct stripe_head sh2;
32318
32319 + pax_track_stack();
32320
32321 chunk_offset = sector_div(new_sector, sectors_per_chunk);
32322 stripe = new_sector;
32323 diff -urNp linux-2.6.39.1/drivers/media/common/saa7146_hlp.c linux-2.6.39.1/drivers/media/common/saa7146_hlp.c
32324 --- linux-2.6.39.1/drivers/media/common/saa7146_hlp.c 2011-05-19 00:06:34.000000000 -0400
32325 +++ linux-2.6.39.1/drivers/media/common/saa7146_hlp.c 2011-05-22 19:36:31.000000000 -0400
32326 @@ -353,6 +353,8 @@ static void calculate_clipping_registers
32327
32328 int x[32], y[32], w[32], h[32];
32329
32330 + pax_track_stack();
32331 +
32332 /* clear out memory */
32333 memset(&line_list[0], 0x00, sizeof(u32)*32);
32334 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
32335 diff -urNp linux-2.6.39.1/drivers/media/common/saa7146_vbi.c linux-2.6.39.1/drivers/media/common/saa7146_vbi.c
32336 --- linux-2.6.39.1/drivers/media/common/saa7146_vbi.c 2011-05-19 00:06:34.000000000 -0400
32337 +++ linux-2.6.39.1/drivers/media/common/saa7146_vbi.c 2011-05-22 19:36:31.000000000 -0400
32338 @@ -501,7 +501,7 @@ static ssize_t vbi_read(struct file *fil
32339 return ret;
32340 }
32341
32342 -struct saa7146_use_ops saa7146_vbi_uops = {
32343 +const struct saa7146_use_ops saa7146_vbi_uops = {
32344 .init = vbi_init,
32345 .open = vbi_open,
32346 .release = vbi_close,
32347 diff -urNp linux-2.6.39.1/drivers/media/common/saa7146_video.c linux-2.6.39.1/drivers/media/common/saa7146_video.c
32348 --- linux-2.6.39.1/drivers/media/common/saa7146_video.c 2011-05-19 00:06:34.000000000 -0400
32349 +++ linux-2.6.39.1/drivers/media/common/saa7146_video.c 2011-05-22 19:36:31.000000000 -0400
32350 @@ -1420,7 +1420,7 @@ out:
32351 return ret;
32352 }
32353
32354 -struct saa7146_use_ops saa7146_video_uops = {
32355 +const struct saa7146_use_ops saa7146_video_uops = {
32356 .init = video_init,
32357 .open = video_open,
32358 .release = video_close,
32359 diff -urNp linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c
32360 --- linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c 2011-05-19 00:06:34.000000000 -0400
32361 +++ linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c 2011-05-22 19:36:31.000000000 -0400
32362 @@ -418,7 +418,7 @@ static u32 functionality(struct i2c_adap
32363 return I2C_FUNC_I2C;
32364 }
32365
32366 -static struct i2c_algorithm dm1105_algo = {
32367 +static const struct i2c_algorithm dm1105_algo = {
32368 .master_xfer = dm1105_i2c_xfer,
32369 .functionality = functionality,
32370 };
32371 diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
32372 --- linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-19 00:06:34.000000000 -0400
32373 +++ linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-22 19:36:31.000000000 -0400
32374 @@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
32375 u8 buf[HOST_LINK_BUF_SIZE];
32376 int i;
32377
32378 + pax_track_stack();
32379 +
32380 dprintk("%s\n", __func__);
32381
32382 /* check if we have space for a link buf in the rx_buffer */
32383 @@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
32384 unsigned long timeout;
32385 int written;
32386
32387 + pax_track_stack();
32388 +
32389 dprintk("%s\n", __func__);
32390
32391 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
32392 diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c
32393 --- linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-19 00:06:34.000000000 -0400
32394 +++ linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-22 19:36:31.000000000 -0400
32395 @@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
32396 const struct dvb_device *template, void *priv, int type)
32397 {
32398 struct dvb_device *dvbdev;
32399 - struct file_operations *dvbdevfops;
32400 + struct file_operations *dvbdevfops; /* cannot be const, see this function */
32401 struct device *clsdev;
32402 int minor;
32403 int id;
32404 diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c
32405 --- linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-19 00:06:34.000000000 -0400
32406 +++ linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-22 19:36:31.000000000 -0400
32407 @@ -391,6 +391,8 @@ int dib0700_download_firmware(struct usb
32408
32409 u8 buf[260];
32410
32411 + pax_track_stack();
32412 +
32413 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
32414 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
32415 hx.addr, hx.len, hx.chk);
32416 diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c
32417 --- linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-19 00:06:34.000000000 -0400
32418 +++ linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-22 19:36:31.000000000 -0400
32419 @@ -663,6 +663,7 @@ static int lme2510_download_firmware(str
32420 packet_size = 0x31;
32421 len_in = 1;
32422
32423 + pax_track_stack();
32424
32425 info("FRM Starting Firmware Download");
32426
32427 @@ -715,6 +716,8 @@ static void lme_coldreset(struct usb_dev
32428 int ret = 0, len_in;
32429 u8 data[512] = {0};
32430
32431 + pax_track_stack();
32432 +
32433 data[0] = 0x0a;
32434 len_in = 1;
32435 info("FRM Firmware Cold Reset");
32436 diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c
32437 --- linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c 2011-06-03 00:04:14.000000000 -0400
32438 +++ linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c 2011-06-03 00:32:05.000000000 -0400
32439 @@ -1945,7 +1945,7 @@ static u32 dib7000p_i2c_func(struct i2c_
32440 return I2C_FUNC_I2C;
32441 }
32442
32443 -static struct i2c_algorithm dib7090_tuner_xfer_algo = {
32444 +static const struct i2c_algorithm dib7090_tuner_xfer_algo = {
32445 .master_xfer = dib7090_tuner_xfer,
32446 .functionality = dib7000p_i2c_func,
32447 };
32448 diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c
32449 --- linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c 2011-06-03 00:04:14.000000000 -0400
32450 +++ linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c 2011-06-03 00:32:05.000000000 -0400
32451 @@ -1676,12 +1676,12 @@ static u32 dib9000_i2c_func(struct i2c_a
32452 return I2C_FUNC_I2C;
32453 }
32454
32455 -static struct i2c_algorithm dib9000_tuner_algo = {
32456 +static const struct i2c_algorithm dib9000_tuner_algo = {
32457 .master_xfer = dib9000_tuner_xfer,
32458 .functionality = dib9000_i2c_func,
32459 };
32460
32461 -static struct i2c_algorithm dib9000_component_bus_algo = {
32462 +static const struct i2c_algorithm dib9000_component_bus_algo = {
32463 .master_xfer = dib9000_fw_component_bus_xfer,
32464 .functionality = dib9000_i2c_func,
32465 };
32466 diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c
32467 --- linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c 2011-06-03 00:04:14.000000000 -0400
32468 +++ linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c 2011-06-03 00:37:36.000000000 -0400
32469 @@ -221,12 +221,12 @@ static int dibx000_i2c_master_xfer_gpio3
32470 return num;
32471 }
32472
32473 -static struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32474 +static const struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32475 .master_xfer = dibx000_i2c_master_xfer_gpio12,
32476 .functionality = dibx000_i2c_func,
32477 };
32478
32479 -static struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32480 +static const struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32481 .master_xfer = dibx000_i2c_master_xfer_gpio34,
32482 .functionality = dibx000_i2c_func,
32483 };
32484 @@ -285,7 +285,7 @@ static int dibx000_i2c_gated_gpio67_xfer
32485 return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO;
32486 }
32487
32488 -static struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32489 +static const struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32490 .master_xfer = dibx000_i2c_gated_gpio67_xfer,
32491 .functionality = dibx000_i2c_func,
32492 };
32493 @@ -322,7 +322,7 @@ static int dibx000_i2c_gated_tuner_xfer(
32494 return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO;
32495 }
32496
32497 -static struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32498 +static const struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32499 .master_xfer = dibx000_i2c_gated_tuner_xfer,
32500 .functionality = dibx000_i2c_func,
32501 };
32502 @@ -375,7 +375,7 @@ void dibx000_reset_i2c_master(struct dib
32503 EXPORT_SYMBOL(dibx000_reset_i2c_master);
32504
32505 static int i2c_adapter_init(struct i2c_adapter *i2c_adap,
32506 - struct i2c_algorithm *algo, const char *name,
32507 + const struct i2c_algorithm *algo, const char *name,
32508 struct dibx000_i2c_master *mst)
32509 {
32510 strncpy(i2c_adap->name, name, sizeof(i2c_adap->name));
32511 diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c
32512 --- linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c 2011-05-19 00:06:34.000000000 -0400
32513 +++ linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c 2011-05-22 19:36:31.000000000 -0400
32514 @@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
32515 int ret = -1;
32516 int sync;
32517
32518 + pax_track_stack();
32519 +
32520 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
32521
32522 fcp = 3000;
32523 diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c
32524 --- linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c 2011-05-19 00:06:34.000000000 -0400
32525 +++ linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c 2011-05-22 19:36:31.000000000 -0400
32526 @@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
32527 u8 tudata[585];
32528 int i;
32529
32530 + pax_track_stack();
32531 +
32532 dprintk("Firmware is %zd bytes\n",fw->size);
32533
32534 /* Get eprom data */
32535 diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c
32536 --- linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c 2011-05-19 00:06:34.000000000 -0400
32537 +++ linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c 2011-05-22 19:36:31.000000000 -0400
32538 @@ -870,7 +870,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(
32539 return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
32540 }
32541
32542 -static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32543 +static const struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32544 .master_xfer = s5h1420_tuner_i2c_tuner_xfer,
32545 .functionality = s5h1420_tuner_i2c_func,
32546 };
32547 diff -urNp linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c
32548 --- linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-19 00:06:34.000000000 -0400
32549 +++ linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-22 19:36:31.000000000 -0400
32550 @@ -212,7 +212,7 @@ static u32 mantis_i2c_func(struct i2c_ad
32551 return I2C_FUNC_SMBUS_EMUL;
32552 }
32553
32554 -static struct i2c_algorithm mantis_algo = {
32555 +static const struct i2c_algorithm mantis_algo = {
32556 .master_xfer = mantis_i2c_xfer,
32557 .functionality = mantis_i2c_func,
32558 };
32559 diff -urNp linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c
32560 --- linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-19 00:06:34.000000000 -0400
32561 +++ linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-22 19:36:31.000000000 -0400
32562 @@ -1614,7 +1614,7 @@ static int fe_send_command(struct dvb_fr
32563 return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
32564 }
32565
32566 -static struct ttusbdecfe_config fe_config = {
32567 +static const struct ttusbdecfe_config fe_config = {
32568 .send_command = fe_send_command
32569 };
32570
32571 diff -urNp linux-2.6.39.1/drivers/media/radio/radio-cadet.c linux-2.6.39.1/drivers/media/radio/radio-cadet.c
32572 --- linux-2.6.39.1/drivers/media/radio/radio-cadet.c 2011-05-19 00:06:34.000000000 -0400
32573 +++ linux-2.6.39.1/drivers/media/radio/radio-cadet.c 2011-05-22 19:36:31.000000000 -0400
32574 @@ -349,7 +349,7 @@ static ssize_t cadet_read(struct file *f
32575 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
32576 mutex_unlock(&dev->lock);
32577
32578 - if (copy_to_user(data, readbuf, i))
32579 + if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
32580 return -EFAULT;
32581 return i;
32582 }
32583 diff -urNp linux-2.6.39.1/drivers/media/radio/radio-si4713.c linux-2.6.39.1/drivers/media/radio/radio-si4713.c
32584 --- linux-2.6.39.1/drivers/media/radio/radio-si4713.c 2011-05-19 00:06:34.000000000 -0400
32585 +++ linux-2.6.39.1/drivers/media/radio/radio-si4713.c 2011-05-22 19:36:31.000000000 -0400
32586 @@ -231,7 +231,7 @@ static long radio_si4713_default(struct
32587 ioctl, cmd, arg);
32588 }
32589
32590 -static struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32591 +static const struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32592 .vidioc_enumaudout = radio_si4713_enumaudout,
32593 .vidioc_g_audout = radio_si4713_g_audout,
32594 .vidioc_s_audout = radio_si4713_s_audout,
32595 diff -urNp linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c
32596 --- linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c 2011-05-19 00:06:34.000000000 -0400
32597 +++ linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c 2011-05-22 19:36:31.000000000 -0400
32598 @@ -277,7 +277,7 @@ static void ir_lirc_close(void *data)
32599 return;
32600 }
32601
32602 -static struct file_operations lirc_fops = {
32603 +static const struct file_operations lirc_fops = {
32604 .owner = THIS_MODULE,
32605 .write = ir_lirc_transmit_ir,
32606 .unlocked_ioctl = ir_lirc_ioctl,
32607 diff -urNp linux-2.6.39.1/drivers/media/rc/lirc_dev.c linux-2.6.39.1/drivers/media/rc/lirc_dev.c
32608 --- linux-2.6.39.1/drivers/media/rc/lirc_dev.c 2011-05-19 00:06:34.000000000 -0400
32609 +++ linux-2.6.39.1/drivers/media/rc/lirc_dev.c 2011-05-22 19:36:31.000000000 -0400
32610 @@ -151,7 +151,7 @@ static int lirc_thread(void *irctl)
32611 }
32612
32613
32614 -static struct file_operations lirc_dev_fops = {
32615 +static const struct file_operations lirc_dev_fops = {
32616 .owner = THIS_MODULE,
32617 .read = lirc_dev_fop_read,
32618 .write = lirc_dev_fop_write,
32619 diff -urNp linux-2.6.39.1/drivers/media/rc/rc-main.c linux-2.6.39.1/drivers/media/rc/rc-main.c
32620 --- linux-2.6.39.1/drivers/media/rc/rc-main.c 2011-05-19 00:06:34.000000000 -0400
32621 +++ linux-2.6.39.1/drivers/media/rc/rc-main.c 2011-05-22 19:36:31.000000000 -0400
32622 @@ -996,7 +996,7 @@ EXPORT_SYMBOL_GPL(rc_free_device);
32623
32624 int rc_register_device(struct rc_dev *dev)
32625 {
32626 - static atomic_t devno = ATOMIC_INIT(0);
32627 + static atomic_unchecked_t devno = ATOMIC_INIT(0);
32628 struct rc_map *rc_map;
32629 const char *path;
32630 int rc;
32631 @@ -1019,7 +1019,7 @@ int rc_register_device(struct rc_dev *de
32632 if (dev->close)
32633 dev->input_dev->close = ir_close;
32634
32635 - dev->devno = (unsigned long)(atomic_inc_return(&devno) - 1);
32636 + dev->devno = (unsigned long)(atomic_inc_return_unchecked(&devno) - 1);
32637 dev_set_name(&dev->dev, "rc%ld", dev->devno);
32638 dev_set_drvdata(&dev->dev, dev);
32639 rc = device_add(&dev->dev);
32640 diff -urNp linux-2.6.39.1/drivers/media/video/cafe_ccic.c linux-2.6.39.1/drivers/media/video/cafe_ccic.c
32641 --- linux-2.6.39.1/drivers/media/video/cafe_ccic.c 2011-05-19 00:06:34.000000000 -0400
32642 +++ linux-2.6.39.1/drivers/media/video/cafe_ccic.c 2011-05-22 19:36:31.000000000 -0400
32643 @@ -520,7 +520,7 @@ static u32 cafe_smbus_func(struct i2c_ad
32644 I2C_FUNC_SMBUS_WRITE_BYTE_DATA;
32645 }
32646
32647 -static struct i2c_algorithm cafe_smbus_algo = {
32648 +static const struct i2c_algorithm cafe_smbus_algo = {
32649 .smbus_xfer = cafe_smbus_xfer,
32650 .functionality = cafe_smbus_func
32651 };
32652 diff -urNp linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c
32653 --- linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-19 00:06:34.000000000 -0400
32654 +++ linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-22 19:36:31.000000000 -0400
32655 @@ -314,7 +314,7 @@ static struct page *snd_pcm_get_vmalloc_
32656 return vmalloc_to_page(pageptr);
32657 }
32658
32659 -static struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32660 +static const struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32661 .open = snd_cx18_pcm_capture_open,
32662 .close = snd_cx18_pcm_capture_close,
32663 .ioctl = snd_cx18_pcm_ioctl,
32664 diff -urNp linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c
32665 --- linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c 2011-05-19 00:06:34.000000000 -0400
32666 +++ linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c 2011-05-22 19:36:31.000000000 -0400
32667 @@ -61,7 +61,7 @@ static struct pci_device_id cx18_pci_tbl
32668
32669 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
32670
32671 -static atomic_t cx18_instance = ATOMIC_INIT(0);
32672 +static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
32673
32674 /* Parameter declarations */
32675 static int cardtype[CX18_MAX_CARDS];
32676 @@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
32677 struct i2c_client c;
32678 u8 eedata[256];
32679
32680 + pax_track_stack();
32681 +
32682 memset(&c, 0, sizeof(c));
32683 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
32684 c.adapter = &cx->i2c_adap[0];
32685 @@ -892,7 +894,7 @@ static int __devinit cx18_probe(struct p
32686 struct cx18 *cx;
32687
32688 /* FIXME - module parameter arrays constrain max instances */
32689 - i = atomic_inc_return(&cx18_instance) - 1;
32690 + i = atomic_inc_return_unchecked(&cx18_instance) - 1;
32691 if (i >= CX18_MAX_CARDS) {
32692 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
32693 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
32694 diff -urNp linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c
32695 --- linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32696 +++ linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32697 @@ -613,7 +613,7 @@ static struct page *snd_pcm_get_vmalloc_
32698 return vmalloc_to_page(pageptr);
32699 }
32700
32701 -static struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32702 +static const struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32703 .open = snd_cx231xx_capture_open,
32704 .close = snd_cx231xx_pcm_close,
32705 .ioctl = snd_pcm_lib_ioctl,
32706 diff -urNp linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c
32707 --- linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32708 +++ linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32709 @@ -435,7 +435,7 @@ static u32 functionality(struct i2c_adap
32710 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32711 }
32712
32713 -static struct i2c_algorithm cx231xx_algo = {
32714 +static const struct i2c_algorithm cx231xx_algo = {
32715 .master_xfer = cx231xx_i2c_xfer,
32716 .functionality = functionality,
32717 };
32718 diff -urNp linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c
32719 --- linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c 2011-05-19 00:06:34.000000000 -0400
32720 +++ linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c 2011-05-22 19:36:31.000000000 -0400
32721 @@ -53,6 +53,8 @@ static void cx23885_input_process_measur
32722 bool handle = false;
32723 struct ir_raw_event ir_core_event[64];
32724
32725 + pax_track_stack();
32726 +
32727 do {
32728 num = 0;
32729 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
32730 diff -urNp linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c
32731 --- linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c 2011-05-19 00:06:34.000000000 -0400
32732 +++ linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c 2011-05-22 19:36:31.000000000 -0400
32733 @@ -519,7 +519,7 @@ static struct page *snd_cx88_page(struct
32734 /*
32735 * operators
32736 */
32737 -static struct snd_pcm_ops snd_cx88_pcm_ops = {
32738 +static const struct snd_pcm_ops snd_cx88_pcm_ops = {
32739 .open = snd_cx88_pcm_open,
32740 .close = snd_cx88_close,
32741 .ioctl = snd_pcm_lib_ioctl,
32742 diff -urNp linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h
32743 --- linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-19 00:06:34.000000000 -0400
32744 +++ linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-22 19:36:31.000000000 -0400
32745 @@ -99,7 +99,7 @@ struct ccdc_hw_device {
32746 /* module owner */
32747 struct module *owner;
32748 /* hw ops */
32749 - struct ccdc_hw_ops hw_ops;
32750 + const struct ccdc_hw_ops hw_ops;
32751 };
32752
32753 /* Used by CCDC module to register & unregister with vpfe capture driver */
32754 diff -urNp linux-2.6.39.1/drivers/media/video/davinci/vpss.c linux-2.6.39.1/drivers/media/video/davinci/vpss.c
32755 --- linux-2.6.39.1/drivers/media/video/davinci/vpss.c 2011-05-19 00:06:34.000000000 -0400
32756 +++ linux-2.6.39.1/drivers/media/video/davinci/vpss.c 2011-05-22 19:36:31.000000000 -0400
32757 @@ -103,7 +103,7 @@ struct vpss_oper_config {
32758 __iomem void *vpss_regs_base1;
32759 enum vpss_platform_type platform;
32760 spinlock_t vpss_lock;
32761 - struct vpss_hw_ops hw_ops;
32762 + const struct vpss_hw_ops hw_ops;
32763 };
32764
32765 static struct vpss_oper_config oper_cfg;
32766 diff -urNp linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c
32767 --- linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32768 +++ linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32769 @@ -432,7 +432,7 @@ static struct page *snd_pcm_get_vmalloc_
32770 return vmalloc_to_page(pageptr);
32771 }
32772
32773 -static struct snd_pcm_ops snd_em28xx_pcm_capture = {
32774 +static const struct snd_pcm_ops snd_em28xx_pcm_capture = {
32775 .open = snd_em28xx_capture_open,
32776 .close = snd_em28xx_pcm_close,
32777 .ioctl = snd_pcm_lib_ioctl,
32778 diff -urNp linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c
32779 --- linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32780 +++ linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32781 @@ -451,7 +451,7 @@ static u32 functionality(struct i2c_adap
32782 return I2C_FUNC_SMBUS_EMUL;
32783 }
32784
32785 -static struct i2c_algorithm em28xx_algo = {
32786 +static const struct i2c_algorithm em28xx_algo = {
32787 .master_xfer = em28xx_i2c_xfer,
32788 .functionality = functionality,
32789 };
32790 diff -urNp linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c
32791 --- linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-19 00:06:34.000000000 -0400
32792 +++ linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-22 19:36:31.000000000 -0400
32793 @@ -179,7 +179,7 @@ static u32 hdpvr_functionality(struct i2
32794 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
32795 }
32796
32797 -static struct i2c_algorithm hdpvr_algo = {
32798 +static const struct i2c_algorithm hdpvr_algo = {
32799 .master_xfer = hdpvr_transfer,
32800 .functionality = hdpvr_functionality,
32801 };
32802 diff -urNp linux-2.6.39.1/drivers/media/video/imx074.c linux-2.6.39.1/drivers/media/video/imx074.c
32803 --- linux-2.6.39.1/drivers/media/video/imx074.c 2011-05-19 00:06:34.000000000 -0400
32804 +++ linux-2.6.39.1/drivers/media/video/imx074.c 2011-05-22 19:36:31.000000000 -0400
32805 @@ -267,7 +267,7 @@ static int imx074_g_chip_ident(struct v4
32806 return 0;
32807 }
32808
32809 -static struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32810 +static const struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32811 .s_stream = imx074_s_stream,
32812 .s_mbus_fmt = imx074_s_fmt,
32813 .g_mbus_fmt = imx074_g_fmt,
32814 @@ -277,7 +277,7 @@ static struct v4l2_subdev_video_ops imx0
32815 .cropcap = imx074_cropcap,
32816 };
32817
32818 -static struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32819 +static const struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32820 .g_chip_ident = imx074_g_chip_ident,
32821 };
32822
32823 diff -urNp linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c
32824 --- linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c 2011-05-19 00:06:34.000000000 -0400
32825 +++ linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c 2011-05-22 19:36:31.000000000 -0400
32826 @@ -80,7 +80,7 @@ static struct pci_device_id ivtv_pci_tbl
32827 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
32828
32829 /* ivtv instance counter */
32830 -static atomic_t ivtv_instance = ATOMIC_INIT(0);
32831 +static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
32832
32833 /* Parameter declarations */
32834 static int cardtype[IVTV_MAX_CARDS];
32835 diff -urNp linux-2.6.39.1/drivers/media/video/mt9m001.c linux-2.6.39.1/drivers/media/video/mt9m001.c
32836 --- linux-2.6.39.1/drivers/media/video/mt9m001.c 2011-05-19 00:06:34.000000000 -0400
32837 +++ linux-2.6.39.1/drivers/media/video/mt9m001.c 2011-05-22 19:36:31.000000000 -0400
32838 @@ -691,7 +691,7 @@ static int mt9m001_g_skip_top_lines(stru
32839 return 0;
32840 }
32841
32842 -static struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32843 +static const struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32844 .g_ctrl = mt9m001_g_ctrl,
32845 .s_ctrl = mt9m001_s_ctrl,
32846 .g_chip_ident = mt9m001_g_chip_ident,
32847 @@ -714,7 +714,7 @@ static int mt9m001_enum_fmt(struct v4l2_
32848 return 0;
32849 }
32850
32851 -static struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32852 +static const struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32853 .s_stream = mt9m001_s_stream,
32854 .s_mbus_fmt = mt9m001_s_fmt,
32855 .g_mbus_fmt = mt9m001_g_fmt,
32856 @@ -725,7 +725,7 @@ static struct v4l2_subdev_video_ops mt9m
32857 .enum_mbus_fmt = mt9m001_enum_fmt,
32858 };
32859
32860 -static struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32861 +static const struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32862 .g_skip_top_lines = mt9m001_g_skip_top_lines,
32863 };
32864
32865 diff -urNp linux-2.6.39.1/drivers/media/video/mt9t031.c linux-2.6.39.1/drivers/media/video/mt9t031.c
32866 --- linux-2.6.39.1/drivers/media/video/mt9t031.c 2011-05-19 00:06:34.000000000 -0400
32867 +++ linux-2.6.39.1/drivers/media/video/mt9t031.c 2011-05-22 19:36:31.000000000 -0400
32868 @@ -725,7 +725,7 @@ static int mt9t031_runtime_resume(struct
32869 return 0;
32870 }
32871
32872 -static struct dev_pm_ops mt9t031_dev_pm_ops = {
32873 +static const struct dev_pm_ops mt9t031_dev_pm_ops = {
32874 .runtime_suspend = mt9t031_runtime_suspend,
32875 .runtime_resume = mt9t031_runtime_resume,
32876 };
32877 @@ -788,7 +788,7 @@ static int mt9t031_g_skip_top_lines(stru
32878 return 0;
32879 }
32880
32881 -static struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32882 +static const struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32883 .g_ctrl = mt9t031_g_ctrl,
32884 .s_ctrl = mt9t031_s_ctrl,
32885 .g_chip_ident = mt9t031_g_chip_ident,
32886 @@ -808,7 +808,7 @@ static int mt9t031_enum_fmt(struct v4l2_
32887 return 0;
32888 }
32889
32890 -static struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32891 +static const struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32892 .s_stream = mt9t031_s_stream,
32893 .s_mbus_fmt = mt9t031_s_fmt,
32894 .g_mbus_fmt = mt9t031_g_fmt,
32895 @@ -819,7 +819,7 @@ static struct v4l2_subdev_video_ops mt9t
32896 .enum_mbus_fmt = mt9t031_enum_fmt,
32897 };
32898
32899 -static struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32900 +static const struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32901 .g_skip_top_lines = mt9t031_g_skip_top_lines,
32902 };
32903
32904 diff -urNp linux-2.6.39.1/drivers/media/video/mt9v022.c linux-2.6.39.1/drivers/media/video/mt9v022.c
32905 --- linux-2.6.39.1/drivers/media/video/mt9v022.c 2011-05-19 00:06:34.000000000 -0400
32906 +++ linux-2.6.39.1/drivers/media/video/mt9v022.c 2011-05-22 19:36:31.000000000 -0400
32907 @@ -825,7 +825,7 @@ static int mt9v022_g_skip_top_lines(stru
32908 return 0;
32909 }
32910
32911 -static struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32912 +static const struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32913 .g_ctrl = mt9v022_g_ctrl,
32914 .s_ctrl = mt9v022_s_ctrl,
32915 .g_chip_ident = mt9v022_g_chip_ident,
32916 @@ -848,7 +848,7 @@ static int mt9v022_enum_fmt(struct v4l2_
32917 return 0;
32918 }
32919
32920 -static struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32921 +static const struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32922 .s_stream = mt9v022_s_stream,
32923 .s_mbus_fmt = mt9v022_s_fmt,
32924 .g_mbus_fmt = mt9v022_g_fmt,
32925 @@ -859,7 +859,7 @@ static struct v4l2_subdev_video_ops mt9v
32926 .enum_mbus_fmt = mt9v022_enum_fmt,
32927 };
32928
32929 -static struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32930 +static const struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32931 .g_skip_top_lines = mt9v022_g_skip_top_lines,
32932 };
32933
32934 diff -urNp linux-2.6.39.1/drivers/media/video/mx2_camera.c linux-2.6.39.1/drivers/media/video/mx2_camera.c
32935 --- linux-2.6.39.1/drivers/media/video/mx2_camera.c 2011-05-19 00:06:34.000000000 -0400
32936 +++ linux-2.6.39.1/drivers/media/video/mx2_camera.c 2011-05-22 19:36:31.000000000 -0400
32937 @@ -668,7 +668,7 @@ static void mx2_videobuf_release(struct
32938 free_buffer(vq, buf);
32939 }
32940
32941 -static struct videobuf_queue_ops mx2_videobuf_ops = {
32942 +static const struct videobuf_queue_ops mx2_videobuf_ops = {
32943 .buf_setup = mx2_videobuf_setup,
32944 .buf_prepare = mx2_videobuf_prepare,
32945 .buf_queue = mx2_videobuf_queue,
32946 diff -urNp linux-2.6.39.1/drivers/media/video/omap24xxcam.c linux-2.6.39.1/drivers/media/video/omap24xxcam.c
32947 --- linux-2.6.39.1/drivers/media/video/omap24xxcam.c 2011-05-19 00:06:34.000000000 -0400
32948 +++ linux-2.6.39.1/drivers/media/video/omap24xxcam.c 2011-05-22 19:36:31.000000000 -0400
32949 @@ -403,7 +403,7 @@ static void omap24xxcam_vbq_complete(str
32950 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
32951
32952 do_gettimeofday(&vb->ts);
32953 - vb->field_count = atomic_add_return(2, &fh->field_count);
32954 + vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
32955 if (csr & csr_error) {
32956 vb->state = VIDEOBUF_ERROR;
32957 if (!atomic_read(&fh->cam->in_reset)) {
32958 diff -urNp linux-2.6.39.1/drivers/media/video/omap24xxcam.h linux-2.6.39.1/drivers/media/video/omap24xxcam.h
32959 --- linux-2.6.39.1/drivers/media/video/omap24xxcam.h 2011-05-19 00:06:34.000000000 -0400
32960 +++ linux-2.6.39.1/drivers/media/video/omap24xxcam.h 2011-05-22 19:36:31.000000000 -0400
32961 @@ -533,7 +533,7 @@ struct omap24xxcam_fh {
32962 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
32963 struct videobuf_queue vbq;
32964 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
32965 - atomic_t field_count; /* field counter for videobuf_buffer */
32966 + atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
32967 /* accessing cam here doesn't need serialisation: it's constant */
32968 struct omap24xxcam_device *cam;
32969 };
32970 diff -urNp linux-2.6.39.1/drivers/media/video/omap3isp/isp.h linux-2.6.39.1/drivers/media/video/omap3isp/isp.h
32971 --- linux-2.6.39.1/drivers/media/video/omap3isp/isp.h 2011-05-19 00:06:34.000000000 -0400
32972 +++ linux-2.6.39.1/drivers/media/video/omap3isp/isp.h 2011-05-22 19:36:31.000000000 -0400
32973 @@ -290,7 +290,7 @@ struct isp_device {
32974
32975 struct iommu *iommu;
32976
32977 - struct isp_platform_callback platform_cb;
32978 + const struct isp_platform_callback platform_cb;
32979 };
32980
32981 #define v4l2_dev_to_isp_device(dev) \
32982 diff -urNp linux-2.6.39.1/drivers/media/video/ov2640.c linux-2.6.39.1/drivers/media/video/ov2640.c
32983 --- linux-2.6.39.1/drivers/media/video/ov2640.c 2011-05-19 00:06:34.000000000 -0400
32984 +++ linux-2.6.39.1/drivers/media/video/ov2640.c 2011-05-22 19:36:31.000000000 -0400
32985 @@ -1080,7 +1080,7 @@ static struct soc_camera_ops ov2640_ops
32986 .num_controls = ARRAY_SIZE(ov2640_controls),
32987 };
32988
32989 -static struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32990 +static const struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32991 .g_ctrl = ov2640_g_ctrl,
32992 .s_ctrl = ov2640_s_ctrl,
32993 .g_chip_ident = ov2640_g_chip_ident,
32994 @@ -1090,7 +1090,7 @@ static struct v4l2_subdev_core_ops ov264
32995 #endif
32996 };
32997
32998 -static struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
32999 +static const struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
33000 .s_stream = ov2640_s_stream,
33001 .g_mbus_fmt = ov2640_g_fmt,
33002 .s_mbus_fmt = ov2640_s_fmt,
33003 diff -urNp linux-2.6.39.1/drivers/media/video/ov772x.c linux-2.6.39.1/drivers/media/video/ov772x.c
33004 --- linux-2.6.39.1/drivers/media/video/ov772x.c 2011-05-19 00:06:34.000000000 -0400
33005 +++ linux-2.6.39.1/drivers/media/video/ov772x.c 2011-05-22 19:36:31.000000000 -0400
33006 @@ -1079,7 +1079,7 @@ static struct soc_camera_ops ov772x_ops
33007 .num_controls = ARRAY_SIZE(ov772x_controls),
33008 };
33009
33010 -static struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
33011 +static const struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
33012 .g_ctrl = ov772x_g_ctrl,
33013 .s_ctrl = ov772x_s_ctrl,
33014 .g_chip_ident = ov772x_g_chip_ident,
33015 @@ -1099,7 +1099,7 @@ static int ov772x_enum_fmt(struct v4l2_s
33016 return 0;
33017 }
33018
33019 -static struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
33020 +static const struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
33021 .s_stream = ov772x_s_stream,
33022 .g_mbus_fmt = ov772x_g_fmt,
33023 .s_mbus_fmt = ov772x_s_fmt,
33024 diff -urNp linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
33025 --- linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-19 00:06:34.000000000 -0400
33026 +++ linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-22 19:36:31.000000000 -0400
33027 @@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
33028 u8 *eeprom;
33029 struct tveeprom tvdata;
33030
33031 + pax_track_stack();
33032 +
33033 memset(&tvdata,0,sizeof(tvdata));
33034
33035 eeprom = pvr2_eeprom_fetch(hdw);
33036 diff -urNp linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
33037 --- linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-19 00:06:34.000000000 -0400
33038 +++ linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-22 19:36:31.000000000 -0400
33039 @@ -527,7 +527,7 @@ static u32 pvr2_i2c_functionality(struct
33040 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
33041 }
33042
33043 -static struct i2c_algorithm pvr2_i2c_algo_template = {
33044 +static const struct i2c_algorithm pvr2_i2c_algo_template = {
33045 .master_xfer = pvr2_i2c_xfer,
33046 .functionality = pvr2_i2c_functionality,
33047 };
33048 diff -urNp linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c
33049 --- linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c 2011-05-19 00:06:34.000000000 -0400
33050 +++ linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c 2011-05-22 19:36:31.000000000 -0400
33051 @@ -1327,7 +1327,7 @@ static int rj54n1_s_ctrl(struct v4l2_sub
33052 return 0;
33053 }
33054
33055 -static struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
33056 +static const struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
33057 .g_ctrl = rj54n1_g_ctrl,
33058 .s_ctrl = rj54n1_s_ctrl,
33059 .g_chip_ident = rj54n1_g_chip_ident,
33060 @@ -1337,7 +1337,7 @@ static struct v4l2_subdev_core_ops rj54n
33061 #endif
33062 };
33063
33064 -static struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
33065 +static const struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
33066 .s_stream = rj54n1_s_stream,
33067 .s_mbus_fmt = rj54n1_s_fmt,
33068 .g_mbus_fmt = rj54n1_g_fmt,
33069 diff -urNp linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c
33070 --- linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-19 00:06:34.000000000 -0400
33071 +++ linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-22 19:36:31.000000000 -0400
33072 @@ -376,7 +376,7 @@ static void fimc_unlock(struct vb2_queue
33073 mutex_unlock(&ctx->fimc_dev->lock);
33074 }
33075
33076 -static struct vb2_ops fimc_capture_qops = {
33077 +static const struct vb2_ops fimc_capture_qops = {
33078 .queue_setup = queue_setup,
33079 .buf_prepare = buffer_prepare,
33080 .buf_queue = buffer_queue,
33081 diff -urNp linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c
33082 --- linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-19 00:06:34.000000000 -0400
33083 +++ linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-22 19:36:31.000000000 -0400
33084 @@ -768,7 +768,7 @@ static void fimc_unlock(struct vb2_queue
33085 mutex_unlock(&ctx->fimc_dev->lock);
33086 }
33087
33088 -static struct vb2_ops fimc_qops = {
33089 +static const struct vb2_ops fimc_qops = {
33090 .queue_setup = fimc_queue_setup,
33091 .buf_prepare = fimc_buf_prepare,
33092 .buf_queue = fimc_buf_queue,
33093 diff -urNp linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c
33094 --- linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c 2011-05-19 00:06:34.000000000 -0400
33095 +++ linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c 2011-05-22 19:36:31.000000000 -0400
33096 @@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
33097 unsigned char localPAT[256];
33098 unsigned char localPMT[256];
33099
33100 + pax_track_stack();
33101 +
33102 /* Set video format - must be done first as it resets other settings */
33103 set_reg8(client, 0x41, h->video_format);
33104
33105 diff -urNp linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c
33106 --- linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-19 00:06:34.000000000 -0400
33107 +++ linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-22 19:36:31.000000000 -0400
33108 @@ -808,7 +808,7 @@ static struct page *snd_card_saa7134_pag
33109 * ALSA capture callbacks definition
33110 */
33111
33112 -static struct snd_pcm_ops snd_card_saa7134_capture_ops = {
33113 +static const struct snd_pcm_ops snd_card_saa7134_capture_ops = {
33114 .open = snd_card_saa7134_capture_open,
33115 .close = snd_card_saa7134_capture_close,
33116 .ioctl = snd_pcm_lib_ioctl,
33117 diff -urNp linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c
33118 --- linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-19 00:06:34.000000000 -0400
33119 +++ linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-22 19:36:31.000000000 -0400
33120 @@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
33121 u8 tmp[512];
33122 dprintk(DBGLVL_CMD, "%s()\n", __func__);
33123
33124 + pax_track_stack();
33125 +
33126 /* While any outstand message on the bus exists... */
33127 do {
33128
33129 @@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
33130 u8 tmp[512];
33131 dprintk(DBGLVL_CMD, "%s()\n", __func__);
33132
33133 + pax_track_stack();
33134 +
33135 while (loop) {
33136
33137 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
33138 diff -urNp linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c
33139 --- linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c 2011-05-19 00:06:34.000000000 -0400
33140 +++ linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c 2011-05-22 19:36:31.000000000 -0400
33141 @@ -127,12 +127,12 @@ static int sh_csi2_s_fmt(struct v4l2_sub
33142 return 0;
33143 }
33144
33145 -static struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
33146 +static const struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
33147 .s_mbus_fmt = sh_csi2_s_fmt,
33148 .try_mbus_fmt = sh_csi2_try_fmt,
33149 };
33150
33151 -static struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
33152 +static const struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
33153
33154 static struct v4l2_subdev_ops sh_csi2_subdev_ops = {
33155 .core = &sh_csi2_subdev_core_ops,
33156 diff -urNp linux-2.6.39.1/drivers/media/video/soc_camera_platform.c linux-2.6.39.1/drivers/media/video/soc_camera_platform.c
33157 --- linux-2.6.39.1/drivers/media/video/soc_camera_platform.c 2011-05-19 00:06:34.000000000 -0400
33158 +++ linux-2.6.39.1/drivers/media/video/soc_camera_platform.c 2011-05-22 19:36:31.000000000 -0400
33159 @@ -70,7 +70,7 @@ static int soc_camera_platform_fill_fmt(
33160 return 0;
33161 }
33162
33163 -static struct v4l2_subdev_core_ops platform_subdev_core_ops;
33164 +static const struct v4l2_subdev_core_ops platform_subdev_core_ops;
33165
33166 static int soc_camera_platform_enum_fmt(struct v4l2_subdev *sd, unsigned int index,
33167 enum v4l2_mbus_pixelcode *code)
33168 @@ -115,7 +115,7 @@ static int soc_camera_platform_cropcap(s
33169 return 0;
33170 }
33171
33172 -static struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33173 +static const struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33174 .s_stream = soc_camera_platform_s_stream,
33175 .enum_mbus_fmt = soc_camera_platform_enum_fmt,
33176 .cropcap = soc_camera_platform_cropcap,
33177 diff -urNp linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c
33178 --- linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c 2011-05-19 00:06:34.000000000 -0400
33179 +++ linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c 2011-05-22 19:36:31.000000000 -0400
33180 @@ -265,7 +265,7 @@ static struct page *snd_pcm_pd_get_page(
33181 return vmalloc_to_page(pageptr);
33182 }
33183
33184 -static struct snd_pcm_ops pcm_capture_ops = {
33185 +static const struct snd_pcm_ops pcm_capture_ops = {
33186 .open = snd_pd_capture_open,
33187 .close = snd_pd_pcm_close,
33188 .ioctl = snd_pcm_lib_ioctl,
33189 diff -urNp linux-2.6.39.1/drivers/media/video/tw9910.c linux-2.6.39.1/drivers/media/video/tw9910.c
33190 --- linux-2.6.39.1/drivers/media/video/tw9910.c 2011-05-19 00:06:34.000000000 -0400
33191 +++ linux-2.6.39.1/drivers/media/video/tw9910.c 2011-05-22 19:36:31.000000000 -0400
33192 @@ -894,7 +894,7 @@ static struct soc_camera_ops tw9910_ops
33193 .enum_input = tw9910_enum_input,
33194 };
33195
33196 -static struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33197 +static const struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33198 .g_chip_ident = tw9910_g_chip_ident,
33199 .s_std = tw9910_s_std,
33200 #ifdef CONFIG_VIDEO_ADV_DEBUG
33201 @@ -913,7 +913,7 @@ static int tw9910_enum_fmt(struct v4l2_s
33202 return 0;
33203 }
33204
33205 -static struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33206 +static const struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33207 .s_stream = tw9910_s_stream,
33208 .g_mbus_fmt = tw9910_g_fmt,
33209 .s_mbus_fmt = tw9910_s_fmt,
33210 diff -urNp linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c
33211 --- linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c 2011-05-19 00:06:34.000000000 -0400
33212 +++ linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c 2011-05-22 19:36:31.000000000 -0400
33213 @@ -799,6 +799,8 @@ static enum parse_state usbvision_parse_
33214 unsigned char rv, gv, bv;
33215 static unsigned char *Y, *U, *V;
33216
33217 + pax_track_stack();
33218 +
33219 frame = usbvision->cur_frame;
33220 image_size = frame->frmwidth * frame->frmheight;
33221 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
33222 diff -urNp linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c
33223 --- linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-19 00:06:34.000000000 -0400
33224 +++ linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-22 19:36:31.000000000 -0400
33225 @@ -189,7 +189,7 @@ static u32 functionality(struct i2c_adap
33226
33227 /* -----exported algorithm data: ------------------------------------- */
33228
33229 -static struct i2c_algorithm usbvision_algo = {
33230 +static const struct i2c_algorithm usbvision_algo = {
33231 .master_xfer = usbvision_i2c_xfer,
33232 .smbus_xfer = NULL,
33233 .functionality = functionality,
33234 diff -urNp linux-2.6.39.1/drivers/media/video/v4l2-device.c linux-2.6.39.1/drivers/media/video/v4l2-device.c
33235 --- linux-2.6.39.1/drivers/media/video/v4l2-device.c 2011-05-19 00:06:34.000000000 -0400
33236 +++ linux-2.6.39.1/drivers/media/video/v4l2-device.c 2011-05-22 19:36:31.000000000 -0400
33237 @@ -71,9 +71,9 @@ int v4l2_device_put(struct v4l2_device *
33238 EXPORT_SYMBOL_GPL(v4l2_device_put);
33239
33240 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
33241 - atomic_t *instance)
33242 + atomic_unchecked_t *instance)
33243 {
33244 - int num = atomic_inc_return(instance) - 1;
33245 + int num = atomic_inc_return_unchecked(instance) - 1;
33246 int len = strlen(basename);
33247
33248 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
33249 diff -urNp linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c
33250 --- linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c 2011-05-19 00:06:34.000000000 -0400
33251 +++ linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c 2011-05-22 19:36:31.000000000 -0400
33252 @@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
33253 {
33254 struct videobuf_queue q;
33255
33256 + pax_track_stack();
33257 +
33258 /* Required to make generic handler to call __videobuf_alloc */
33259 q.int_ops = &sg_ops;
33260
33261 diff -urNp linux-2.6.39.1/drivers/message/fusion/mptbase.c linux-2.6.39.1/drivers/message/fusion/mptbase.c
33262 --- linux-2.6.39.1/drivers/message/fusion/mptbase.c 2011-05-19 00:06:34.000000000 -0400
33263 +++ linux-2.6.39.1/drivers/message/fusion/mptbase.c 2011-05-22 19:41:37.000000000 -0400
33264 @@ -143,7 +143,7 @@ static int MptDriverClass[MPT_MAX_PRO
33265 static MPT_EVHANDLER MptEvHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33266 /* Reset handler lookup table */
33267 static MPT_RESETHANDLER MptResetHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33268 -static struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33269 +static const struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33270
33271 #ifdef CONFIG_PROC_FS
33272 static struct proc_dir_entry *mpt_proc_root_dir;
33273 @@ -772,7 +772,7 @@ mpt_reset_deregister(u8 cb_idx)
33274 * @cb_idx: MPT protocol driver index
33275 */
33276 int
33277 -mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33278 +mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33279 {
33280 MPT_ADAPTER *ioc;
33281 const struct pci_device_id *id;
33282 @@ -801,7 +801,7 @@ mpt_device_driver_register(struct mpt_pc
33283 void
33284 mpt_device_driver_deregister(u8 cb_idx)
33285 {
33286 - struct mpt_pci_driver *dd_cbfunc;
33287 + const struct mpt_pci_driver *dd_cbfunc;
33288 MPT_ADAPTER *ioc;
33289
33290 if (!cb_idx || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
33291 @@ -6683,8 +6683,13 @@ static int mpt_iocinfo_proc_show(struct
33292 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
33293 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
33294
33295 +#ifdef CONFIG_GRKERNSEC_HIDESYM
33296 + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
33297 +#else
33298 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
33299 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
33300 +#endif
33301 +
33302 /*
33303 * Rounding UP to nearest 4-kB boundary here...
33304 */
33305 diff -urNp linux-2.6.39.1/drivers/message/fusion/mptbase.h linux-2.6.39.1/drivers/message/fusion/mptbase.h
33306 --- linux-2.6.39.1/drivers/message/fusion/mptbase.h 2011-05-19 00:06:34.000000000 -0400
33307 +++ linux-2.6.39.1/drivers/message/fusion/mptbase.h 2011-05-22 19:36:31.000000000 -0400
33308 @@ -908,7 +908,7 @@ extern int mpt_event_register(u8 cb_idx
33309 extern void mpt_event_deregister(u8 cb_idx);
33310 extern int mpt_reset_register(u8 cb_idx, MPT_RESETHANDLER reset_func);
33311 extern void mpt_reset_deregister(u8 cb_idx);
33312 -extern int mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33313 +extern int mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33314 extern void mpt_device_driver_deregister(u8 cb_idx);
33315 extern MPT_FRAME_HDR *mpt_get_msg_frame(u8 cb_idx, MPT_ADAPTER *ioc);
33316 extern void mpt_free_msg_frame(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf);
33317 diff -urNp linux-2.6.39.1/drivers/message/fusion/mptctl.c linux-2.6.39.1/drivers/message/fusion/mptctl.c
33318 --- linux-2.6.39.1/drivers/message/fusion/mptctl.c 2011-05-19 00:06:34.000000000 -0400
33319 +++ linux-2.6.39.1/drivers/message/fusion/mptctl.c 2011-05-22 19:36:31.000000000 -0400
33320 @@ -3000,7 +3000,7 @@ mptctl_remove(struct pci_dev *pdev)
33321 {
33322 }
33323
33324 -static struct mpt_pci_driver mptctl_driver = {
33325 +static const struct mpt_pci_driver mptctl_driver = {
33326 .probe = mptctl_probe,
33327 .remove = mptctl_remove,
33328 };
33329 diff -urNp linux-2.6.39.1/drivers/message/fusion/mptsas.c linux-2.6.39.1/drivers/message/fusion/mptsas.c
33330 --- linux-2.6.39.1/drivers/message/fusion/mptsas.c 2011-05-19 00:06:34.000000000 -0400
33331 +++ linux-2.6.39.1/drivers/message/fusion/mptsas.c 2011-05-22 19:36:31.000000000 -0400
33332 @@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
33333 return 0;
33334 }
33335
33336 +static inline void
33337 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33338 +{
33339 + if (phy_info->port_details) {
33340 + phy_info->port_details->rphy = rphy;
33341 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33342 + ioc->name, rphy));
33343 + }
33344 +
33345 + if (rphy) {
33346 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33347 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33348 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33349 + ioc->name, rphy, rphy->dev.release));
33350 + }
33351 +}
33352 +
33353 /* no mutex */
33354 static void
33355 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
33356 @@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
33357 return NULL;
33358 }
33359
33360 -static inline void
33361 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33362 -{
33363 - if (phy_info->port_details) {
33364 - phy_info->port_details->rphy = rphy;
33365 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33366 - ioc->name, rphy));
33367 - }
33368 -
33369 - if (rphy) {
33370 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33371 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33372 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33373 - ioc->name, rphy, rphy->dev.release));
33374 - }
33375 -}
33376 -
33377 static inline struct sas_port *
33378 mptsas_get_port(struct mptsas_phyinfo *phy_info)
33379 {
33380 diff -urNp linux-2.6.39.1/drivers/message/fusion/mptscsih.c linux-2.6.39.1/drivers/message/fusion/mptscsih.c
33381 --- linux-2.6.39.1/drivers/message/fusion/mptscsih.c 2011-05-19 00:06:34.000000000 -0400
33382 +++ linux-2.6.39.1/drivers/message/fusion/mptscsih.c 2011-05-22 19:36:31.000000000 -0400
33383 @@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
33384
33385 h = shost_priv(SChost);
33386
33387 - if (h) {
33388 - if (h->info_kbuf == NULL)
33389 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33390 - return h->info_kbuf;
33391 - h->info_kbuf[0] = '\0';
33392 + if (!h)
33393 + return NULL;
33394
33395 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33396 - h->info_kbuf[size-1] = '\0';
33397 - }
33398 + if (h->info_kbuf == NULL)
33399 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33400 + return h->info_kbuf;
33401 + h->info_kbuf[0] = '\0';
33402 +
33403 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33404 + h->info_kbuf[size-1] = '\0';
33405
33406 return h->info_kbuf;
33407 }
33408 diff -urNp linux-2.6.39.1/drivers/message/i2o/i2o_config.c linux-2.6.39.1/drivers/message/i2o/i2o_config.c
33409 --- linux-2.6.39.1/drivers/message/i2o/i2o_config.c 2011-05-19 00:06:34.000000000 -0400
33410 +++ linux-2.6.39.1/drivers/message/i2o/i2o_config.c 2011-05-22 19:36:31.000000000 -0400
33411 @@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
33412 struct i2o_message *msg;
33413 unsigned int iop;
33414
33415 + pax_track_stack();
33416 +
33417 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
33418 return -EFAULT;
33419
33420 diff -urNp linux-2.6.39.1/drivers/message/i2o/i2o_proc.c linux-2.6.39.1/drivers/message/i2o/i2o_proc.c
33421 --- linux-2.6.39.1/drivers/message/i2o/i2o_proc.c 2011-05-19 00:06:34.000000000 -0400
33422 +++ linux-2.6.39.1/drivers/message/i2o/i2o_proc.c 2011-05-22 19:36:31.000000000 -0400
33423 @@ -255,13 +255,6 @@ static char *scsi_devices[] = {
33424 "Array Controller Device"
33425 };
33426
33427 -static char *chtostr(u8 * chars, int n)
33428 -{
33429 - char tmp[256];
33430 - tmp[0] = 0;
33431 - return strncat(tmp, (char *)chars, n);
33432 -}
33433 -
33434 static int i2o_report_query_status(struct seq_file *seq, int block_status,
33435 char *group)
33436 {
33437 @@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct
33438
33439 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
33440 seq_printf(seq, "%-#8x", ddm_table.module_id);
33441 - seq_printf(seq, "%-29s",
33442 - chtostr(ddm_table.module_name_version, 28));
33443 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
33444 seq_printf(seq, "%9d ", ddm_table.data_size);
33445 seq_printf(seq, "%8d", ddm_table.code_size);
33446
33447 @@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s
33448
33449 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
33450 seq_printf(seq, "%-#8x", dst->module_id);
33451 - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
33452 - seq_printf(seq, "%-9s", chtostr(dst->date, 8));
33453 + seq_printf(seq, "%-.28s", dst->module_name_version);
33454 + seq_printf(seq, "%-.8s", dst->date);
33455 seq_printf(seq, "%8d ", dst->module_size);
33456 seq_printf(seq, "%8d ", dst->mpb_size);
33457 seq_printf(seq, "0x%04x", dst->module_flags);
33458 @@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str
33459 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
33460 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
33461 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
33462 - seq_printf(seq, "Vendor info : %s\n",
33463 - chtostr((u8 *) (work32 + 2), 16));
33464 - seq_printf(seq, "Product info : %s\n",
33465 - chtostr((u8 *) (work32 + 6), 16));
33466 - seq_printf(seq, "Description : %s\n",
33467 - chtostr((u8 *) (work32 + 10), 16));
33468 - seq_printf(seq, "Product rev. : %s\n",
33469 - chtostr((u8 *) (work32 + 14), 8));
33470 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
33471 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
33472 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
33473 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
33474
33475 seq_printf(seq, "Serial number : ");
33476 print_serial_number(seq, (u8 *) (work32 + 16),
33477 @@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str
33478 }
33479
33480 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
33481 - seq_printf(seq, "Module name : %s\n",
33482 - chtostr(result.module_name, 24));
33483 - seq_printf(seq, "Module revision : %s\n",
33484 - chtostr(result.module_rev, 8));
33485 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
33486 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
33487
33488 seq_printf(seq, "Serial number : ");
33489 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
33490 @@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq
33491 return 0;
33492 }
33493
33494 - seq_printf(seq, "Device name : %s\n",
33495 - chtostr(result.device_name, 64));
33496 - seq_printf(seq, "Service name : %s\n",
33497 - chtostr(result.service_name, 64));
33498 - seq_printf(seq, "Physical name : %s\n",
33499 - chtostr(result.physical_location, 64));
33500 - seq_printf(seq, "Instance number : %s\n",
33501 - chtostr(result.instance_number, 4));
33502 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
33503 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
33504 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
33505 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
33506
33507 return 0;
33508 }
33509 diff -urNp linux-2.6.39.1/drivers/message/i2o/iop.c linux-2.6.39.1/drivers/message/i2o/iop.c
33510 --- linux-2.6.39.1/drivers/message/i2o/iop.c 2011-05-19 00:06:34.000000000 -0400
33511 +++ linux-2.6.39.1/drivers/message/i2o/iop.c 2011-05-22 19:36:31.000000000 -0400
33512 @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
33513
33514 spin_lock_irqsave(&c->context_list_lock, flags);
33515
33516 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
33517 - atomic_inc(&c->context_list_counter);
33518 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
33519 + atomic_inc_unchecked(&c->context_list_counter);
33520
33521 - entry->context = atomic_read(&c->context_list_counter);
33522 + entry->context = atomic_read_unchecked(&c->context_list_counter);
33523
33524 list_add(&entry->list, &c->context_list);
33525
33526 @@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
33527
33528 #if BITS_PER_LONG == 64
33529 spin_lock_init(&c->context_list_lock);
33530 - atomic_set(&c->context_list_counter, 0);
33531 + atomic_set_unchecked(&c->context_list_counter, 0);
33532 INIT_LIST_HEAD(&c->context_list);
33533 #endif
33534
33535 diff -urNp linux-2.6.39.1/drivers/mfd/ab3100-core.c linux-2.6.39.1/drivers/mfd/ab3100-core.c
33536 --- linux-2.6.39.1/drivers/mfd/ab3100-core.c 2011-05-19 00:06:34.000000000 -0400
33537 +++ linux-2.6.39.1/drivers/mfd/ab3100-core.c 2011-05-22 19:36:31.000000000 -0400
33538 @@ -385,7 +385,7 @@ static int ab3100_event_registers_startu
33539 return 0;
33540 }
33541
33542 -static struct abx500_ops ab3100_ops = {
33543 +static const struct abx500_ops ab3100_ops = {
33544 .get_chip_id = ab3100_get_chip_id,
33545 .set_register = set_register_interruptible,
33546 .get_register = get_register_interruptible,
33547 diff -urNp linux-2.6.39.1/drivers/mfd/ab3550-core.c linux-2.6.39.1/drivers/mfd/ab3550-core.c
33548 --- linux-2.6.39.1/drivers/mfd/ab3550-core.c 2011-05-19 00:06:34.000000000 -0400
33549 +++ linux-2.6.39.1/drivers/mfd/ab3550-core.c 2011-05-22 19:36:31.000000000 -0400
33550 @@ -676,7 +676,7 @@ static int ab3550_startup_irq_enabled(st
33551 return val;
33552 }
33553
33554 -static struct abx500_ops ab3550_ops = {
33555 +static const struct abx500_ops ab3550_ops = {
33556 .get_chip_id = ab3550_get_chip_id,
33557 .get_register = ab3550_get_register_interruptible,
33558 .set_register = ab3550_set_register_interruptible,
33559 diff -urNp linux-2.6.39.1/drivers/mfd/ab8500-core.c linux-2.6.39.1/drivers/mfd/ab8500-core.c
33560 --- linux-2.6.39.1/drivers/mfd/ab8500-core.c 2011-05-19 00:06:34.000000000 -0400
33561 +++ linux-2.6.39.1/drivers/mfd/ab8500-core.c 2011-05-22 19:36:31.000000000 -0400
33562 @@ -223,7 +223,7 @@ static int ab8500_mask_and_set_register(
33563
33564 }
33565
33566 -static struct abx500_ops ab8500_ops = {
33567 +static const struct abx500_ops ab8500_ops = {
33568 .get_chip_id = ab8500_get_chip_id,
33569 .get_register = ab8500_get_register,
33570 .set_register = ab8500_set_register,
33571 diff -urNp linux-2.6.39.1/drivers/mfd/abx500-core.c linux-2.6.39.1/drivers/mfd/abx500-core.c
33572 --- linux-2.6.39.1/drivers/mfd/abx500-core.c 2011-05-19 00:06:34.000000000 -0400
33573 +++ linux-2.6.39.1/drivers/mfd/abx500-core.c 2011-05-22 19:36:31.000000000 -0400
33574 @@ -18,7 +18,7 @@ struct abx500_device_entry {
33575 struct device *dev;
33576 };
33577
33578 -static void lookup_ops(struct device *dev, struct abx500_ops **ops)
33579 +static void lookup_ops(struct device *dev, const struct abx500_ops **ops)
33580 {
33581 struct abx500_device_entry *dev_entry;
33582
33583 @@ -31,7 +31,7 @@ static void lookup_ops(struct device *de
33584 }
33585 }
33586
33587 -int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
33588 +int abx500_register_ops(struct device *dev, const struct abx500_ops *ops)
33589 {
33590 struct abx500_device_entry *dev_entry;
33591
33592 @@ -65,7 +65,7 @@ EXPORT_SYMBOL(abx500_remove_ops);
33593 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
33594 u8 value)
33595 {
33596 - struct abx500_ops *ops;
33597 + const struct abx500_ops *ops;
33598
33599 lookup_ops(dev->parent, &ops);
33600 if ((ops != NULL) && (ops->set_register != NULL))
33601 @@ -78,7 +78,7 @@ EXPORT_SYMBOL(abx500_set_register_interr
33602 int abx500_get_register_interruptible(struct device *dev, u8 bank, u8 reg,
33603 u8 *value)
33604 {
33605 - struct abx500_ops *ops;
33606 + const struct abx500_ops *ops;
33607
33608 lookup_ops(dev->parent, &ops);
33609 if ((ops != NULL) && (ops->get_register != NULL))
33610 @@ -91,7 +91,7 @@ EXPORT_SYMBOL(abx500_get_register_interr
33611 int abx500_get_register_page_interruptible(struct device *dev, u8 bank,
33612 u8 first_reg, u8 *regvals, u8 numregs)
33613 {
33614 - struct abx500_ops *ops;
33615 + const struct abx500_ops *ops;
33616
33617 lookup_ops(dev->parent, &ops);
33618 if ((ops != NULL) && (ops->get_register_page != NULL))
33619 @@ -105,7 +105,7 @@ EXPORT_SYMBOL(abx500_get_register_page_i
33620 int abx500_mask_and_set_register_interruptible(struct device *dev, u8 bank,
33621 u8 reg, u8 bitmask, u8 bitvalues)
33622 {
33623 - struct abx500_ops *ops;
33624 + const struct abx500_ops *ops;
33625
33626 lookup_ops(dev->parent, &ops);
33627 if ((ops != NULL) && (ops->mask_and_set_register != NULL))
33628 @@ -118,7 +118,7 @@ EXPORT_SYMBOL(abx500_mask_and_set_regist
33629
33630 int abx500_get_chip_id(struct device *dev)
33631 {
33632 - struct abx500_ops *ops;
33633 + const struct abx500_ops *ops;
33634
33635 lookup_ops(dev->parent, &ops);
33636 if ((ops != NULL) && (ops->get_chip_id != NULL))
33637 @@ -130,7 +130,7 @@ EXPORT_SYMBOL(abx500_get_chip_id);
33638
33639 int abx500_event_registers_startup_state_get(struct device *dev, u8 *event)
33640 {
33641 - struct abx500_ops *ops;
33642 + const struct abx500_ops *ops;
33643
33644 lookup_ops(dev->parent, &ops);
33645 if ((ops != NULL) && (ops->event_registers_startup_state_get != NULL))
33646 @@ -142,7 +142,7 @@ EXPORT_SYMBOL(abx500_event_registers_sta
33647
33648 int abx500_startup_irq_enabled(struct device *dev, unsigned int irq)
33649 {
33650 - struct abx500_ops *ops;
33651 + const struct abx500_ops *ops;
33652
33653 lookup_ops(dev->parent, &ops);
33654 if ((ops != NULL) && (ops->startup_irq_enabled != NULL))
33655 diff -urNp linux-2.6.39.1/drivers/mfd/janz-cmodio.c linux-2.6.39.1/drivers/mfd/janz-cmodio.c
33656 --- linux-2.6.39.1/drivers/mfd/janz-cmodio.c 2011-05-19 00:06:34.000000000 -0400
33657 +++ linux-2.6.39.1/drivers/mfd/janz-cmodio.c 2011-05-22 19:36:31.000000000 -0400
33658 @@ -13,6 +13,7 @@
33659
33660 #include <linux/kernel.h>
33661 #include <linux/module.h>
33662 +#include <linux/slab.h>
33663 #include <linux/init.h>
33664 #include <linux/pci.h>
33665 #include <linux/interrupt.h>
33666 diff -urNp linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c
33667 --- linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c 2011-05-19 00:06:34.000000000 -0400
33668 +++ linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c 2011-05-22 19:36:31.000000000 -0400
33669 @@ -128,7 +128,7 @@ static void mcp_sa11x0_disable(struct mc
33670 /*
33671 * Our methods.
33672 */
33673 -static struct mcp_ops mcp_sa11x0 = {
33674 +static const struct mcp_ops mcp_sa11x0 = {
33675 .set_telecom_divisor = mcp_sa11x0_set_telecom_divisor,
33676 .set_audio_divisor = mcp_sa11x0_set_audio_divisor,
33677 .reg_write = mcp_sa11x0_write,
33678 diff -urNp linux-2.6.39.1/drivers/mfd/wm8350-i2c.c linux-2.6.39.1/drivers/mfd/wm8350-i2c.c
33679 --- linux-2.6.39.1/drivers/mfd/wm8350-i2c.c 2011-05-19 00:06:34.000000000 -0400
33680 +++ linux-2.6.39.1/drivers/mfd/wm8350-i2c.c 2011-05-22 19:36:31.000000000 -0400
33681 @@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
33682 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
33683 int ret;
33684
33685 + pax_track_stack();
33686 +
33687 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
33688 return -EINVAL;
33689
33690 diff -urNp linux-2.6.39.1/drivers/misc/enclosure.c linux-2.6.39.1/drivers/misc/enclosure.c
33691 --- linux-2.6.39.1/drivers/misc/enclosure.c 2011-05-19 00:06:34.000000000 -0400
33692 +++ linux-2.6.39.1/drivers/misc/enclosure.c 2011-05-22 19:36:31.000000000 -0400
33693 @@ -161,7 +161,7 @@ enclosure_register(struct device *dev, c
33694 }
33695 EXPORT_SYMBOL_GPL(enclosure_register);
33696
33697 -static struct enclosure_component_callbacks enclosure_null_callbacks;
33698 +static const struct enclosure_component_callbacks enclosure_null_callbacks;
33699
33700 /**
33701 * enclosure_unregister - remove an enclosure
33702 diff -urNp linux-2.6.39.1/drivers/misc/kgdbts.c linux-2.6.39.1/drivers/misc/kgdbts.c
33703 --- linux-2.6.39.1/drivers/misc/kgdbts.c 2011-05-19 00:06:34.000000000 -0400
33704 +++ linux-2.6.39.1/drivers/misc/kgdbts.c 2011-05-22 19:36:31.000000000 -0400
33705 @@ -118,7 +118,7 @@
33706 } while (0)
33707 #define MAX_CONFIG_LEN 40
33708
33709 -static struct kgdb_io kgdbts_io_ops;
33710 +static const struct kgdb_io kgdbts_io_ops;
33711 static char get_buf[BUFMAX];
33712 static int get_buf_cnt;
33713 static char put_buf[BUFMAX];
33714 @@ -1103,7 +1103,7 @@ static void kgdbts_post_exp_handler(void
33715 module_put(THIS_MODULE);
33716 }
33717
33718 -static struct kgdb_io kgdbts_io_ops = {
33719 +static const struct kgdb_io kgdbts_io_ops = {
33720 .name = "kgdbts",
33721 .read_char = kgdbts_get_char,
33722 .write_char = kgdbts_put_char,
33723 diff -urNp linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c
33724 --- linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-19 00:06:34.000000000 -0400
33725 +++ linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-22 19:36:31.000000000 -0400
33726 @@ -435,7 +435,7 @@ static irqreturn_t lis302dl_interrupt(in
33727 * the lid is closed. This leads to interrupts as soon as a little move
33728 * is done.
33729 */
33730 - atomic_inc(&lis3_dev.count);
33731 + atomic_inc_unchecked(&lis3_dev.count);
33732
33733 wake_up_interruptible(&lis3_dev.misc_wait);
33734 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
33735 @@ -518,7 +518,7 @@ static int lis3lv02d_misc_open(struct in
33736 if (lis3_dev.pm_dev)
33737 pm_runtime_get_sync(lis3_dev.pm_dev);
33738
33739 - atomic_set(&lis3_dev.count, 0);
33740 + atomic_set_unchecked(&lis3_dev.count, 0);
33741 return 0;
33742 }
33743
33744 @@ -545,7 +545,7 @@ static ssize_t lis3lv02d_misc_read(struc
33745 add_wait_queue(&lis3_dev.misc_wait, &wait);
33746 while (true) {
33747 set_current_state(TASK_INTERRUPTIBLE);
33748 - data = atomic_xchg(&lis3_dev.count, 0);
33749 + data = atomic_xchg_unchecked(&lis3_dev.count, 0);
33750 if (data)
33751 break;
33752
33753 @@ -583,7 +583,7 @@ out:
33754 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
33755 {
33756 poll_wait(file, &lis3_dev.misc_wait, wait);
33757 - if (atomic_read(&lis3_dev.count))
33758 + if (atomic_read_unchecked(&lis3_dev.count))
33759 return POLLIN | POLLRDNORM;
33760 return 0;
33761 }
33762 diff -urNp linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h
33763 --- linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-19 00:06:34.000000000 -0400
33764 +++ linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-22 19:36:31.000000000 -0400
33765 @@ -265,7 +265,7 @@ struct lis3lv02d {
33766 struct input_polled_dev *idev; /* input device */
33767 struct platform_device *pdev; /* platform device */
33768 struct regulator_bulk_data regulators[2];
33769 - atomic_t count; /* interrupt count after last read */
33770 + atomic_unchecked_t count; /* interrupt count after last read */
33771 union axis_conversion ac; /* hw -> logical axis */
33772 int mapped_btns[3];
33773
33774 diff -urNp linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c
33775 --- linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c 2011-05-19 00:06:34.000000000 -0400
33776 +++ linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c 2011-05-22 19:36:31.000000000 -0400
33777 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
33778 unsigned long nsec;
33779
33780 nsec = CLKS2NSEC(clks);
33781 - atomic_long_inc(&mcs_op_statistics[op].count);
33782 - atomic_long_add(nsec, &mcs_op_statistics[op].total);
33783 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
33784 + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
33785 if (mcs_op_statistics[op].max < nsec)
33786 mcs_op_statistics[op].max = nsec;
33787 }
33788 diff -urNp linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c
33789 --- linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c 2011-05-19 00:06:34.000000000 -0400
33790 +++ linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c 2011-05-22 19:36:31.000000000 -0400
33791 @@ -32,9 +32,9 @@
33792
33793 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
33794
33795 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
33796 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
33797 {
33798 - unsigned long val = atomic_long_read(v);
33799 + unsigned long val = atomic_long_read_unchecked(v);
33800
33801 seq_printf(s, "%16lu %s\n", val, id);
33802 }
33803 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
33804
33805 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
33806 for (op = 0; op < mcsop_last; op++) {
33807 - count = atomic_long_read(&mcs_op_statistics[op].count);
33808 - total = atomic_long_read(&mcs_op_statistics[op].total);
33809 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
33810 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
33811 max = mcs_op_statistics[op].max;
33812 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
33813 count ? total / count : 0, max);
33814 diff -urNp linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h
33815 --- linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h 2011-05-19 00:06:34.000000000 -0400
33816 +++ linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h 2011-05-22 19:36:31.000000000 -0400
33817 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
33818 * GRU statistics.
33819 */
33820 struct gru_stats_s {
33821 - atomic_long_t vdata_alloc;
33822 - atomic_long_t vdata_free;
33823 - atomic_long_t gts_alloc;
33824 - atomic_long_t gts_free;
33825 - atomic_long_t gms_alloc;
33826 - atomic_long_t gms_free;
33827 - atomic_long_t gts_double_allocate;
33828 - atomic_long_t assign_context;
33829 - atomic_long_t assign_context_failed;
33830 - atomic_long_t free_context;
33831 - atomic_long_t load_user_context;
33832 - atomic_long_t load_kernel_context;
33833 - atomic_long_t lock_kernel_context;
33834 - atomic_long_t unlock_kernel_context;
33835 - atomic_long_t steal_user_context;
33836 - atomic_long_t steal_kernel_context;
33837 - atomic_long_t steal_context_failed;
33838 - atomic_long_t nopfn;
33839 - atomic_long_t asid_new;
33840 - atomic_long_t asid_next;
33841 - atomic_long_t asid_wrap;
33842 - atomic_long_t asid_reuse;
33843 - atomic_long_t intr;
33844 - atomic_long_t intr_cbr;
33845 - atomic_long_t intr_tfh;
33846 - atomic_long_t intr_spurious;
33847 - atomic_long_t intr_mm_lock_failed;
33848 - atomic_long_t call_os;
33849 - atomic_long_t call_os_wait_queue;
33850 - atomic_long_t user_flush_tlb;
33851 - atomic_long_t user_unload_context;
33852 - atomic_long_t user_exception;
33853 - atomic_long_t set_context_option;
33854 - atomic_long_t check_context_retarget_intr;
33855 - atomic_long_t check_context_unload;
33856 - atomic_long_t tlb_dropin;
33857 - atomic_long_t tlb_preload_page;
33858 - atomic_long_t tlb_dropin_fail_no_asid;
33859 - atomic_long_t tlb_dropin_fail_upm;
33860 - atomic_long_t tlb_dropin_fail_invalid;
33861 - atomic_long_t tlb_dropin_fail_range_active;
33862 - atomic_long_t tlb_dropin_fail_idle;
33863 - atomic_long_t tlb_dropin_fail_fmm;
33864 - atomic_long_t tlb_dropin_fail_no_exception;
33865 - atomic_long_t tfh_stale_on_fault;
33866 - atomic_long_t mmu_invalidate_range;
33867 - atomic_long_t mmu_invalidate_page;
33868 - atomic_long_t flush_tlb;
33869 - atomic_long_t flush_tlb_gru;
33870 - atomic_long_t flush_tlb_gru_tgh;
33871 - atomic_long_t flush_tlb_gru_zero_asid;
33872 -
33873 - atomic_long_t copy_gpa;
33874 - atomic_long_t read_gpa;
33875 -
33876 - atomic_long_t mesq_receive;
33877 - atomic_long_t mesq_receive_none;
33878 - atomic_long_t mesq_send;
33879 - atomic_long_t mesq_send_failed;
33880 - atomic_long_t mesq_noop;
33881 - atomic_long_t mesq_send_unexpected_error;
33882 - atomic_long_t mesq_send_lb_overflow;
33883 - atomic_long_t mesq_send_qlimit_reached;
33884 - atomic_long_t mesq_send_amo_nacked;
33885 - atomic_long_t mesq_send_put_nacked;
33886 - atomic_long_t mesq_page_overflow;
33887 - atomic_long_t mesq_qf_locked;
33888 - atomic_long_t mesq_qf_noop_not_full;
33889 - atomic_long_t mesq_qf_switch_head_failed;
33890 - atomic_long_t mesq_qf_unexpected_error;
33891 - atomic_long_t mesq_noop_unexpected_error;
33892 - atomic_long_t mesq_noop_lb_overflow;
33893 - atomic_long_t mesq_noop_qlimit_reached;
33894 - atomic_long_t mesq_noop_amo_nacked;
33895 - atomic_long_t mesq_noop_put_nacked;
33896 - atomic_long_t mesq_noop_page_overflow;
33897 + atomic_long_unchecked_t vdata_alloc;
33898 + atomic_long_unchecked_t vdata_free;
33899 + atomic_long_unchecked_t gts_alloc;
33900 + atomic_long_unchecked_t gts_free;
33901 + atomic_long_unchecked_t gms_alloc;
33902 + atomic_long_unchecked_t gms_free;
33903 + atomic_long_unchecked_t gts_double_allocate;
33904 + atomic_long_unchecked_t assign_context;
33905 + atomic_long_unchecked_t assign_context_failed;
33906 + atomic_long_unchecked_t free_context;
33907 + atomic_long_unchecked_t load_user_context;
33908 + atomic_long_unchecked_t load_kernel_context;
33909 + atomic_long_unchecked_t lock_kernel_context;
33910 + atomic_long_unchecked_t unlock_kernel_context;
33911 + atomic_long_unchecked_t steal_user_context;
33912 + atomic_long_unchecked_t steal_kernel_context;
33913 + atomic_long_unchecked_t steal_context_failed;
33914 + atomic_long_unchecked_t nopfn;
33915 + atomic_long_unchecked_t asid_new;
33916 + atomic_long_unchecked_t asid_next;
33917 + atomic_long_unchecked_t asid_wrap;
33918 + atomic_long_unchecked_t asid_reuse;
33919 + atomic_long_unchecked_t intr;
33920 + atomic_long_unchecked_t intr_cbr;
33921 + atomic_long_unchecked_t intr_tfh;
33922 + atomic_long_unchecked_t intr_spurious;
33923 + atomic_long_unchecked_t intr_mm_lock_failed;
33924 + atomic_long_unchecked_t call_os;
33925 + atomic_long_unchecked_t call_os_wait_queue;
33926 + atomic_long_unchecked_t user_flush_tlb;
33927 + atomic_long_unchecked_t user_unload_context;
33928 + atomic_long_unchecked_t user_exception;
33929 + atomic_long_unchecked_t set_context_option;
33930 + atomic_long_unchecked_t check_context_retarget_intr;
33931 + atomic_long_unchecked_t check_context_unload;
33932 + atomic_long_unchecked_t tlb_dropin;
33933 + atomic_long_unchecked_t tlb_preload_page;
33934 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
33935 + atomic_long_unchecked_t tlb_dropin_fail_upm;
33936 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
33937 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
33938 + atomic_long_unchecked_t tlb_dropin_fail_idle;
33939 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
33940 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
33941 + atomic_long_unchecked_t tfh_stale_on_fault;
33942 + atomic_long_unchecked_t mmu_invalidate_range;
33943 + atomic_long_unchecked_t mmu_invalidate_page;
33944 + atomic_long_unchecked_t flush_tlb;
33945 + atomic_long_unchecked_t flush_tlb_gru;
33946 + atomic_long_unchecked_t flush_tlb_gru_tgh;
33947 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
33948 +
33949 + atomic_long_unchecked_t copy_gpa;
33950 + atomic_long_unchecked_t read_gpa;
33951 +
33952 + atomic_long_unchecked_t mesq_receive;
33953 + atomic_long_unchecked_t mesq_receive_none;
33954 + atomic_long_unchecked_t mesq_send;
33955 + atomic_long_unchecked_t mesq_send_failed;
33956 + atomic_long_unchecked_t mesq_noop;
33957 + atomic_long_unchecked_t mesq_send_unexpected_error;
33958 + atomic_long_unchecked_t mesq_send_lb_overflow;
33959 + atomic_long_unchecked_t mesq_send_qlimit_reached;
33960 + atomic_long_unchecked_t mesq_send_amo_nacked;
33961 + atomic_long_unchecked_t mesq_send_put_nacked;
33962 + atomic_long_unchecked_t mesq_page_overflow;
33963 + atomic_long_unchecked_t mesq_qf_locked;
33964 + atomic_long_unchecked_t mesq_qf_noop_not_full;
33965 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
33966 + atomic_long_unchecked_t mesq_qf_unexpected_error;
33967 + atomic_long_unchecked_t mesq_noop_unexpected_error;
33968 + atomic_long_unchecked_t mesq_noop_lb_overflow;
33969 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
33970 + atomic_long_unchecked_t mesq_noop_amo_nacked;
33971 + atomic_long_unchecked_t mesq_noop_put_nacked;
33972 + atomic_long_unchecked_t mesq_noop_page_overflow;
33973
33974 };
33975
33976 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
33977 tghop_invalidate, mcsop_last};
33978
33979 struct mcs_op_statistic {
33980 - atomic_long_t count;
33981 - atomic_long_t total;
33982 + atomic_long_unchecked_t count;
33983 + atomic_long_unchecked_t total;
33984 unsigned long max;
33985 };
33986
33987 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
33988
33989 #define STAT(id) do { \
33990 if (gru_options & OPT_STATS) \
33991 - atomic_long_inc(&gru_stats.id); \
33992 + atomic_long_inc_unchecked(&gru_stats.id); \
33993 } while (0)
33994
33995 #ifdef CONFIG_SGI_GRU_DEBUG
33996 diff -urNp linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c
33997 --- linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-19 00:06:34.000000000 -0400
33998 +++ linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-22 19:36:31.000000000 -0400
33999 @@ -2351,7 +2351,7 @@ xpc_received_payload_sn2(struct xpc_chan
34000 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
34001 }
34002
34003 -static struct xpc_arch_operations xpc_arch_ops_sn2 = {
34004 +static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
34005 .setup_partitions = xpc_setup_partitions_sn2,
34006 .teardown_partitions = xpc_teardown_partitions_sn2,
34007 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
34008 diff -urNp linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c
34009 --- linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c 2011-05-19 00:06:34.000000000 -0400
34010 +++ linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c 2011-05-22 19:36:31.000000000 -0400
34011 @@ -1674,7 +1674,7 @@ xpc_received_payload_uv(struct xpc_chann
34012 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
34013 }
34014
34015 -static struct xpc_arch_operations xpc_arch_ops_uv = {
34016 +static const struct xpc_arch_operations xpc_arch_ops_uv = {
34017 .setup_partitions = xpc_setup_partitions_uv,
34018 .teardown_partitions = xpc_teardown_partitions_uv,
34019 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
34020 diff -urNp linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c
34021 --- linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c 2011-05-19 00:06:34.000000000 -0400
34022 +++ linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c 2011-05-22 19:36:31.000000000 -0400
34023 @@ -644,7 +644,7 @@ static ssize_t pcie_gadget_target_attr_s
34024 return ret;
34025 }
34026
34027 -static struct configfs_item_operations pcie_gadget_target_item_ops = {
34028 +static const struct configfs_item_operations pcie_gadget_target_item_ops = {
34029 .show_attribute = pcie_gadget_target_attr_show,
34030 .store_attribute = pcie_gadget_target_attr_store,
34031 };
34032 diff -urNp linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c
34033 --- linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c 2011-05-19 00:06:34.000000000 -0400
34034 +++ linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c 2011-05-22 19:36:31.000000000 -0400
34035 @@ -1133,7 +1133,7 @@ static void mmc_davinci_enable_sdio_irq(
34036 }
34037 }
34038
34039 -static struct mmc_host_ops mmc_davinci_ops = {
34040 +static const struct mmc_host_ops mmc_davinci_ops = {
34041 .request = mmc_davinci_request,
34042 .set_ios = mmc_davinci_set_ios,
34043 .get_cd = mmc_davinci_get_cd,
34044 diff -urNp linux-2.6.39.1/drivers/mmc/host/dw_mmc.c linux-2.6.39.1/drivers/mmc/host/dw_mmc.c
34045 --- linux-2.6.39.1/drivers/mmc/host/dw_mmc.c 2011-05-19 00:06:34.000000000 -0400
34046 +++ linux-2.6.39.1/drivers/mmc/host/dw_mmc.c 2011-05-22 19:36:31.000000000 -0400
34047 @@ -417,7 +417,7 @@ static int dw_mci_idmac_init(struct dw_m
34048 return 0;
34049 }
34050
34051 -static struct dw_mci_dma_ops dw_mci_idmac_ops = {
34052 +static const struct dw_mci_dma_ops dw_mci_idmac_ops = {
34053 .init = dw_mci_idmac_init,
34054 .start = dw_mci_idmac_start_dma,
34055 .stop = dw_mci_idmac_stop_dma,
34056 diff -urNp linux-2.6.39.1/drivers/mmc/host/s3cmci.c linux-2.6.39.1/drivers/mmc/host/s3cmci.c
34057 --- linux-2.6.39.1/drivers/mmc/host/s3cmci.c 2011-05-19 00:06:34.000000000 -0400
34058 +++ linux-2.6.39.1/drivers/mmc/host/s3cmci.c 2011-05-22 19:36:31.000000000 -0400
34059 @@ -1349,7 +1349,7 @@ static void s3cmci_enable_sdio_irq(struc
34060 s3cmci_check_sdio_irq(host);
34061 }
34062
34063 -static struct mmc_host_ops s3cmci_ops = {
34064 +static const struct mmc_host_ops s3cmci_ops = {
34065 .request = s3cmci_request,
34066 .set_ios = s3cmci_set_ios,
34067 .get_ro = s3cmci_get_ro,
34068 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c
34069 --- linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-19 00:06:34.000000000 -0400
34070 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-22 19:36:31.000000000 -0400
34071 @@ -81,7 +81,7 @@ out:
34072 host->clock = clock;
34073 }
34074
34075 -static struct sdhci_ops sdhci_cns3xxx_ops = {
34076 +static const struct sdhci_ops sdhci_cns3xxx_ops = {
34077 .get_max_clock = sdhci_cns3xxx_get_max_clk,
34078 .set_clock = sdhci_cns3xxx_set_clock,
34079 };
34080 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c
34081 --- linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c 2011-05-19 00:06:34.000000000 -0400
34082 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c 2011-05-22 19:36:31.000000000 -0400
34083 @@ -56,7 +56,7 @@ static u32 sdhci_dove_readl(struct sdhci
34084 return ret;
34085 }
34086
34087 -static struct sdhci_ops sdhci_dove_ops = {
34088 +static const struct sdhci_ops sdhci_dove_ops = {
34089 .read_w = sdhci_dove_readw,
34090 .read_l = sdhci_dove_readl,
34091 };
34092 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c
34093 --- linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-19 00:06:34.000000000 -0400
34094 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-22 19:36:31.000000000 -0400
34095 @@ -201,7 +201,7 @@ static unsigned int esdhc_pltfm_get_ro(s
34096 return -ENOSYS;
34097 }
34098
34099 -static struct sdhci_ops sdhci_esdhc_ops = {
34100 +static const struct sdhci_ops sdhci_esdhc_ops = {
34101 .read_l = esdhc_readl_le,
34102 .read_w = esdhc_readw_le,
34103 .write_l = esdhc_writel_le,
34104 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-of.h linux-2.6.39.1/drivers/mmc/host/sdhci-of.h
34105 --- linux-2.6.39.1/drivers/mmc/host/sdhci-of.h 2011-05-19 00:06:34.000000000 -0400
34106 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-of.h 2011-05-22 19:36:31.000000000 -0400
34107 @@ -21,7 +21,7 @@
34108
34109 struct sdhci_of_data {
34110 unsigned int quirks;
34111 - struct sdhci_ops ops;
34112 + const struct sdhci_ops ops;
34113 };
34114
34115 struct sdhci_of_host {
34116 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c
34117 --- linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c 2011-05-19 00:06:34.000000000 -0400
34118 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c 2011-05-22 19:36:31.000000000 -0400
34119 @@ -786,7 +786,7 @@ static int sdhci_pci_enable_dma(struct s
34120 return 0;
34121 }
34122
34123 -static struct sdhci_ops sdhci_pci_ops = {
34124 +static const struct sdhci_ops sdhci_pci_ops = {
34125 .enable_dma = sdhci_pci_enable_dma,
34126 };
34127
34128 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c
34129 --- linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c 2011-05-19 00:06:34.000000000 -0400
34130 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c 2011-05-22 19:36:31.000000000 -0400
34131 @@ -41,7 +41,7 @@
34132 * *
34133 \*****************************************************************************/
34134
34135 -static struct sdhci_ops sdhci_pltfm_ops = {
34136 +static const struct sdhci_ops sdhci_pltfm_ops = {
34137 };
34138
34139 /*****************************************************************************\
34140 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c
34141 --- linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c 2011-05-19 00:06:34.000000000 -0400
34142 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c 2011-05-22 19:36:31.000000000 -0400
34143 @@ -69,7 +69,7 @@ static void set_clock(struct sdhci_host
34144 }
34145 }
34146
34147 -static struct sdhci_ops sdhci_pxa_ops = {
34148 +static const struct sdhci_ops sdhci_pxa_ops = {
34149 .set_clock = set_clock,
34150 };
34151
34152 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c
34153 --- linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c 2011-05-19 00:06:34.000000000 -0400
34154 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c 2011-05-22 19:36:31.000000000 -0400
34155 @@ -309,7 +309,7 @@ static int sdhci_s3c_platform_8bit_width
34156 return 0;
34157 }
34158
34159 -static struct sdhci_ops sdhci_s3c_ops = {
34160 +static const struct sdhci_ops sdhci_s3c_ops = {
34161 .get_max_clock = sdhci_s3c_get_max_clk,
34162 .set_clock = sdhci_s3c_set_clock,
34163 .get_min_clock = sdhci_s3c_get_min_clock,
34164 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c
34165 --- linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c 2011-05-19 00:06:34.000000000 -0400
34166 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c 2011-05-22 19:36:31.000000000 -0400
34167 @@ -32,7 +32,7 @@ struct spear_sdhci {
34168 };
34169
34170 /* sdhci ops */
34171 -static struct sdhci_ops sdhci_pltfm_ops = {
34172 +static const struct sdhci_ops sdhci_pltfm_ops = {
34173 /* Nothing to do for now. */
34174 };
34175
34176 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c
34177 --- linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c 2011-05-19 00:06:34.000000000 -0400
34178 +++ linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c 2011-05-22 19:36:31.000000000 -0400
34179 @@ -242,7 +242,7 @@ static void tegra_sdhci_pltfm_exit(struc
34180 clk_put(pltfm_host->clk);
34181 }
34182
34183 -static struct sdhci_ops tegra_sdhci_ops = {
34184 +static const struct sdhci_ops tegra_sdhci_ops = {
34185 .get_ro = tegra_sdhci_get_ro,
34186 .read_l = tegra_sdhci_readl,
34187 .read_w = tegra_sdhci_readw,
34188 diff -urNp linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c
34189 --- linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c 2011-05-19 00:06:34.000000000 -0400
34190 +++ linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c 2011-05-22 19:36:31.000000000 -0400
34191 @@ -387,7 +387,7 @@ static int sdricoh_get_ro(struct mmc_hos
34192 return (status & STATUS_CARD_LOCKED);
34193 }
34194
34195 -static struct mmc_host_ops sdricoh_ops = {
34196 +static const struct mmc_host_ops sdricoh_ops = {
34197 .request = sdricoh_request,
34198 .set_ios = sdricoh_set_ios,
34199 .get_ro = sdricoh_get_ro,
34200 diff -urNp linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c
34201 --- linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c 2011-05-19 00:06:34.000000000 -0400
34202 +++ linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c 2011-05-22 19:36:31.000000000 -0400
34203 @@ -872,7 +872,7 @@ static int sh_mmcif_get_cd(struct mmc_ho
34204 return p->get_cd(host->pd);
34205 }
34206
34207 -static struct mmc_host_ops sh_mmcif_ops = {
34208 +static const struct mmc_host_ops sh_mmcif_ops = {
34209 .request = sh_mmcif_request,
34210 .set_ios = sh_mmcif_set_ios,
34211 .get_cd = sh_mmcif_get_cd,
34212 diff -urNp linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c
34213 --- linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-19 00:06:34.000000000 -0400
34214 +++ linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-22 19:36:31.000000000 -0400
34215 @@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
34216 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
34217 unsigned long timeo = jiffies + HZ;
34218
34219 + pax_track_stack();
34220 +
34221 /* Prevent setting state FL_SYNCING for chip in suspended state. */
34222 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
34223 goto sleep;
34224 @@ -1657,6 +1659,8 @@ static int __xipram do_write_buffer(stru
34225 unsigned long initial_adr;
34226 int initial_len = len;
34227
34228 + pax_track_stack();
34229 +
34230 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
34231 adr += chip->start;
34232 initial_adr = adr;
34233 @@ -1875,6 +1879,8 @@ static int __xipram do_erase_oneblock(st
34234 int retries = 3;
34235 int ret;
34236
34237 + pax_track_stack();
34238 +
34239 adr += chip->start;
34240
34241 retry:
34242 diff -urNp linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c
34243 --- linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-19 00:06:34.000000000 -0400
34244 +++ linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-22 19:36:31.000000000 -0400
34245 @@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
34246 unsigned long cmd_addr;
34247 struct cfi_private *cfi = map->fldrv_priv;
34248
34249 + pax_track_stack();
34250 +
34251 adr += chip->start;
34252
34253 /* Ensure cmd read/writes are aligned. */
34254 @@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
34255 DECLARE_WAITQUEUE(wait, current);
34256 int wbufsize, z;
34257
34258 + pax_track_stack();
34259 +
34260 /* M58LW064A requires bus alignment for buffer wriets -- saw */
34261 if (adr & (map_bankwidth(map)-1))
34262 return -EINVAL;
34263 @@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
34264 DECLARE_WAITQUEUE(wait, current);
34265 int ret = 0;
34266
34267 + pax_track_stack();
34268 +
34269 adr += chip->start;
34270
34271 /* Let's determine this according to the interleave only once */
34272 @@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
34273 unsigned long timeo = jiffies + HZ;
34274 DECLARE_WAITQUEUE(wait, current);
34275
34276 + pax_track_stack();
34277 +
34278 adr += chip->start;
34279
34280 /* Let's determine this according to the interleave only once */
34281 @@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
34282 unsigned long timeo = jiffies + HZ;
34283 DECLARE_WAITQUEUE(wait, current);
34284
34285 + pax_track_stack();
34286 +
34287 adr += chip->start;
34288
34289 /* Let's determine this according to the interleave only once */
34290 diff -urNp linux-2.6.39.1/drivers/mtd/devices/doc2000.c linux-2.6.39.1/drivers/mtd/devices/doc2000.c
34291 --- linux-2.6.39.1/drivers/mtd/devices/doc2000.c 2011-05-19 00:06:34.000000000 -0400
34292 +++ linux-2.6.39.1/drivers/mtd/devices/doc2000.c 2011-05-22 19:36:31.000000000 -0400
34293 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
34294
34295 /* The ECC will not be calculated correctly if less than 512 is written */
34296 /* DBB-
34297 - if (len != 0x200 && eccbuf)
34298 + if (len != 0x200)
34299 printk(KERN_WARNING
34300 "ECC needs a full sector write (adr: %lx size %lx)\n",
34301 (long) to, (long) len);
34302 diff -urNp linux-2.6.39.1/drivers/mtd/devices/doc2001.c linux-2.6.39.1/drivers/mtd/devices/doc2001.c
34303 --- linux-2.6.39.1/drivers/mtd/devices/doc2001.c 2011-05-19 00:06:34.000000000 -0400
34304 +++ linux-2.6.39.1/drivers/mtd/devices/doc2001.c 2011-05-22 19:36:31.000000000 -0400
34305 @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
34306 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
34307
34308 /* Don't allow read past end of device */
34309 - if (from >= this->totlen)
34310 + if (from >= this->totlen || !len)
34311 return -EINVAL;
34312
34313 /* Don't allow a single read to cross a 512-byte block boundary */
34314 diff -urNp linux-2.6.39.1/drivers/mtd/ftl.c linux-2.6.39.1/drivers/mtd/ftl.c
34315 --- linux-2.6.39.1/drivers/mtd/ftl.c 2011-05-19 00:06:34.000000000 -0400
34316 +++ linux-2.6.39.1/drivers/mtd/ftl.c 2011-05-22 19:36:31.000000000 -0400
34317 @@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
34318 loff_t offset;
34319 uint16_t srcunitswap = cpu_to_le16(srcunit);
34320
34321 + pax_track_stack();
34322 +
34323 eun = &part->EUNInfo[srcunit];
34324 xfer = &part->XferInfo[xferunit];
34325 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
34326 diff -urNp linux-2.6.39.1/drivers/mtd/inftlcore.c linux-2.6.39.1/drivers/mtd/inftlcore.c
34327 --- linux-2.6.39.1/drivers/mtd/inftlcore.c 2011-05-19 00:06:34.000000000 -0400
34328 +++ linux-2.6.39.1/drivers/mtd/inftlcore.c 2011-05-22 19:36:31.000000000 -0400
34329 @@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
34330 struct inftl_oob oob;
34331 size_t retlen;
34332
34333 + pax_track_stack();
34334 +
34335 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
34336 "pending=%d)\n", inftl, thisVUC, pendingblock);
34337
34338 diff -urNp linux-2.6.39.1/drivers/mtd/inftlmount.c linux-2.6.39.1/drivers/mtd/inftlmount.c
34339 --- linux-2.6.39.1/drivers/mtd/inftlmount.c 2011-05-19 00:06:34.000000000 -0400
34340 +++ linux-2.6.39.1/drivers/mtd/inftlmount.c 2011-05-22 19:36:31.000000000 -0400
34341 @@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
34342 struct INFTLPartition *ip;
34343 size_t retlen;
34344
34345 + pax_track_stack();
34346 +
34347 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
34348
34349 /*
34350 diff -urNp linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c
34351 --- linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c 2011-05-19 00:06:34.000000000 -0400
34352 +++ linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c 2011-05-22 19:36:31.000000000 -0400
34353 @@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
34354 {
34355 map_word pfow_val[4];
34356
34357 + pax_track_stack();
34358 +
34359 /* Check identification string */
34360 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
34361 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
34362 diff -urNp linux-2.6.39.1/drivers/mtd/mtdchar.c linux-2.6.39.1/drivers/mtd/mtdchar.c
34363 --- linux-2.6.39.1/drivers/mtd/mtdchar.c 2011-05-19 00:06:34.000000000 -0400
34364 +++ linux-2.6.39.1/drivers/mtd/mtdchar.c 2011-05-22 19:36:31.000000000 -0400
34365 @@ -560,6 +560,8 @@ static int mtd_ioctl(struct file *file,
34366 u_long size;
34367 struct mtd_info_user info;
34368
34369 + pax_track_stack();
34370 +
34371 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
34372
34373 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
34374 diff -urNp linux-2.6.39.1/drivers/mtd/nand/denali.c linux-2.6.39.1/drivers/mtd/nand/denali.c
34375 --- linux-2.6.39.1/drivers/mtd/nand/denali.c 2011-05-19 00:06:34.000000000 -0400
34376 +++ linux-2.6.39.1/drivers/mtd/nand/denali.c 2011-05-22 19:36:31.000000000 -0400
34377 @@ -25,6 +25,7 @@
34378 #include <linux/pci.h>
34379 #include <linux/mtd/mtd.h>
34380 #include <linux/module.h>
34381 +#include <linux/slab.h>
34382
34383 #include "denali.h"
34384
34385 diff -urNp linux-2.6.39.1/drivers/mtd/nftlcore.c linux-2.6.39.1/drivers/mtd/nftlcore.c
34386 --- linux-2.6.39.1/drivers/mtd/nftlcore.c 2011-05-19 00:06:34.000000000 -0400
34387 +++ linux-2.6.39.1/drivers/mtd/nftlcore.c 2011-05-22 19:36:31.000000000 -0400
34388 @@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
34389 int inplace = 1;
34390 size_t retlen;
34391
34392 + pax_track_stack();
34393 +
34394 memset(BlockMap, 0xff, sizeof(BlockMap));
34395 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
34396
34397 diff -urNp linux-2.6.39.1/drivers/mtd/nftlmount.c linux-2.6.39.1/drivers/mtd/nftlmount.c
34398 --- linux-2.6.39.1/drivers/mtd/nftlmount.c 2011-05-19 00:06:34.000000000 -0400
34399 +++ linux-2.6.39.1/drivers/mtd/nftlmount.c 2011-05-22 19:36:31.000000000 -0400
34400 @@ -24,6 +24,7 @@
34401 #include <asm/errno.h>
34402 #include <linux/delay.h>
34403 #include <linux/slab.h>
34404 +#include <linux/sched.h>
34405 #include <linux/mtd/mtd.h>
34406 #include <linux/mtd/nand.h>
34407 #include <linux/mtd/nftl.h>
34408 @@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
34409 struct mtd_info *mtd = nftl->mbd.mtd;
34410 unsigned int i;
34411
34412 + pax_track_stack();
34413 +
34414 /* Assume logical EraseSize == physical erasesize for starting the scan.
34415 We'll sort it out later if we find a MediaHeader which says otherwise */
34416 /* Actually, we won't. The new DiskOnChip driver has already scanned
34417 diff -urNp linux-2.6.39.1/drivers/mtd/ubi/build.c linux-2.6.39.1/drivers/mtd/ubi/build.c
34418 --- linux-2.6.39.1/drivers/mtd/ubi/build.c 2011-05-19 00:06:34.000000000 -0400
34419 +++ linux-2.6.39.1/drivers/mtd/ubi/build.c 2011-05-22 19:36:31.000000000 -0400
34420 @@ -1287,7 +1287,7 @@ module_exit(ubi_exit);
34421 static int __init bytes_str_to_int(const char *str)
34422 {
34423 char *endp;
34424 - unsigned long result;
34425 + unsigned long result, scale = 1;
34426
34427 result = simple_strtoul(str, &endp, 0);
34428 if (str == endp || result >= INT_MAX) {
34429 @@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const
34430
34431 switch (*endp) {
34432 case 'G':
34433 - result *= 1024;
34434 + scale *= 1024;
34435 case 'M':
34436 - result *= 1024;
34437 + scale *= 1024;
34438 case 'K':
34439 - result *= 1024;
34440 + scale *= 1024;
34441 if (endp[1] == 'i' && endp[2] == 'B')
34442 endp += 2;
34443 case '\0':
34444 @@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const
34445 return -EINVAL;
34446 }
34447
34448 - return result;
34449 + if ((intoverflow_t)result*scale >= INT_MAX) {
34450 + printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
34451 + str);
34452 + return -EINVAL;
34453 + }
34454 +
34455 + return result*scale;
34456 }
34457
34458 /**
34459 diff -urNp linux-2.6.39.1/drivers/net/bcm63xx_enet.c linux-2.6.39.1/drivers/net/bcm63xx_enet.c
34460 --- linux-2.6.39.1/drivers/net/bcm63xx_enet.c 2011-05-19 00:06:34.000000000 -0400
34461 +++ linux-2.6.39.1/drivers/net/bcm63xx_enet.c 2011-05-22 19:36:31.000000000 -0400
34462 @@ -1469,7 +1469,7 @@ static int bcm_enet_set_pauseparam(struc
34463 return 0;
34464 }
34465
34466 -static struct ethtool_ops bcm_enet_ethtool_ops = {
34467 +static const struct ethtool_ops bcm_enet_ethtool_ops = {
34468 .get_strings = bcm_enet_get_strings,
34469 .get_sset_count = bcm_enet_get_sset_count,
34470 .get_ethtool_stats = bcm_enet_get_ethtool_stats,
34471 diff -urNp linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c
34472 --- linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34473 +++ linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34474 @@ -1242,7 +1242,7 @@ bnad_get_sset_count(struct net_device *n
34475 }
34476 }
34477
34478 -static struct ethtool_ops bnad_ethtool_ops = {
34479 +static const struct ethtool_ops bnad_ethtool_ops = {
34480 .get_settings = bnad_get_settings,
34481 .set_settings = bnad_set_settings,
34482 .get_drvinfo = bnad_get_drvinfo,
34483 diff -urNp linux-2.6.39.1/drivers/net/bnx2.c linux-2.6.39.1/drivers/net/bnx2.c
34484 --- linux-2.6.39.1/drivers/net/bnx2.c 2011-05-19 00:06:34.000000000 -0400
34485 +++ linux-2.6.39.1/drivers/net/bnx2.c 2011-05-22 19:36:31.000000000 -0400
34486 @@ -5828,6 +5828,8 @@ bnx2_test_nvram(struct bnx2 *bp)
34487 int rc = 0;
34488 u32 magic, csum;
34489
34490 + pax_track_stack();
34491 +
34492 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
34493 goto test_nvram_done;
34494
34495 diff -urNp linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c
34496 --- linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34497 +++ linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34498 @@ -1788,6 +1788,8 @@ static int bnx2x_test_nvram(struct bnx2x
34499 int i, rc;
34500 u32 magic, crc;
34501
34502 + pax_track_stack();
34503 +
34504 if (BP_NOMCP(bp))
34505 return 0;
34506
34507 diff -urNp linux-2.6.39.1/drivers/net/chelsio/pm3393.c linux-2.6.39.1/drivers/net/chelsio/pm3393.c
34508 --- linux-2.6.39.1/drivers/net/chelsio/pm3393.c 2011-05-19 00:06:34.000000000 -0400
34509 +++ linux-2.6.39.1/drivers/net/chelsio/pm3393.c 2011-05-22 19:36:31.000000000 -0400
34510 @@ -571,7 +571,7 @@ static void pm3393_destroy(struct cmac *
34511 kfree(cmac);
34512 }
34513
34514 -static struct cmac_ops pm3393_ops = {
34515 +static const struct cmac_ops pm3393_ops = {
34516 .destroy = pm3393_destroy,
34517 .reset = pm3393_reset,
34518 .interrupt_enable = pm3393_interrupt_enable,
34519 diff -urNp linux-2.6.39.1/drivers/net/chelsio/vsc7326.c linux-2.6.39.1/drivers/net/chelsio/vsc7326.c
34520 --- linux-2.6.39.1/drivers/net/chelsio/vsc7326.c 2011-05-19 00:06:34.000000000 -0400
34521 +++ linux-2.6.39.1/drivers/net/chelsio/vsc7326.c 2011-05-22 19:36:31.000000000 -0400
34522 @@ -666,7 +666,7 @@ static void mac_destroy(struct cmac *mac
34523 kfree(mac);
34524 }
34525
34526 -static struct cmac_ops vsc7326_ops = {
34527 +static const struct cmac_ops vsc7326_ops = {
34528 .destroy = mac_destroy,
34529 .reset = mac_reset,
34530 .interrupt_handler = mac_intr_handler,
34531 diff -urNp linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c
34532 --- linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c 2011-05-19 00:06:34.000000000 -0400
34533 +++ linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c 2011-05-22 19:36:31.000000000 -0400
34534 @@ -3428,6 +3428,8 @@ static int __devinit enable_msix(struct
34535 unsigned int nchan = adap->params.nports;
34536 struct msix_entry entries[MAX_INGQ + 1];
34537
34538 + pax_track_stack();
34539 +
34540 for (i = 0; i < ARRAY_SIZE(entries); ++i)
34541 entries[i].entry = i;
34542
34543 diff -urNp linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c
34544 --- linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c 2011-05-19 00:06:34.000000000 -0400
34545 +++ linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c 2011-05-22 19:36:31.000000000 -0400
34546 @@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
34547 u8 vpd[VPD_LEN], csum;
34548 unsigned int vpdr_len, kw_offset, id_len;
34549
34550 + pax_track_stack();
34551 +
34552 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
34553 if (ret < 0)
34554 return ret;
34555 diff -urNp linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c
34556 --- linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-19 00:06:34.000000000 -0400
34557 +++ linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-22 19:36:31.000000000 -0400
34558 @@ -1572,7 +1572,7 @@ static int cxgb4vf_set_tso(struct net_de
34559 return 0;
34560 }
34561
34562 -static struct ethtool_ops cxgb4vf_ethtool_ops = {
34563 +static const struct ethtool_ops cxgb4vf_ethtool_ops = {
34564 .get_settings = cxgb4vf_get_settings,
34565 .get_drvinfo = cxgb4vf_get_drvinfo,
34566 .get_msglevel = cxgb4vf_get_msglevel,
34567 diff -urNp linux-2.6.39.1/drivers/net/e1000e/82571.c linux-2.6.39.1/drivers/net/e1000e/82571.c
34568 --- linux-2.6.39.1/drivers/net/e1000e/82571.c 2011-05-19 00:06:34.000000000 -0400
34569 +++ linux-2.6.39.1/drivers/net/e1000e/82571.c 2011-05-22 19:36:31.000000000 -0400
34570 @@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
34571 {
34572 struct e1000_hw *hw = &adapter->hw;
34573 struct e1000_mac_info *mac = &hw->mac;
34574 - struct e1000_mac_operations *func = &mac->ops;
34575 + struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34576 u32 swsm = 0;
34577 u32 swsm2 = 0;
34578 bool force_clear_smbi = false;
34579 @@ -1930,7 +1930,7 @@ static void e1000_clear_hw_cntrs_82571(s
34580 er32(ICRXDMTC);
34581 }
34582
34583 -static struct e1000_mac_operations e82571_mac_ops = {
34584 +static const struct e1000_mac_operations e82571_mac_ops = {
34585 /* .check_mng_mode: mac type dependent */
34586 /* .check_for_link: media type dependent */
34587 .id_led_init = e1000e_id_led_init,
34588 @@ -1952,7 +1952,7 @@ static struct e1000_mac_operations e8257
34589 .read_mac_addr = e1000_read_mac_addr_82571,
34590 };
34591
34592 -static struct e1000_phy_operations e82_phy_ops_igp = {
34593 +static const struct e1000_phy_operations e82_phy_ops_igp = {
34594 .acquire = e1000_get_hw_semaphore_82571,
34595 .check_polarity = e1000_check_polarity_igp,
34596 .check_reset_block = e1000e_check_reset_block_generic,
34597 @@ -1970,7 +1970,7 @@ static struct e1000_phy_operations e82_p
34598 .cfg_on_link_up = NULL,
34599 };
34600
34601 -static struct e1000_phy_operations e82_phy_ops_m88 = {
34602 +static const struct e1000_phy_operations e82_phy_ops_m88 = {
34603 .acquire = e1000_get_hw_semaphore_82571,
34604 .check_polarity = e1000_check_polarity_m88,
34605 .check_reset_block = e1000e_check_reset_block_generic,
34606 @@ -1988,7 +1988,7 @@ static struct e1000_phy_operations e82_p
34607 .cfg_on_link_up = NULL,
34608 };
34609
34610 -static struct e1000_phy_operations e82_phy_ops_bm = {
34611 +static const struct e1000_phy_operations e82_phy_ops_bm = {
34612 .acquire = e1000_get_hw_semaphore_82571,
34613 .check_polarity = e1000_check_polarity_m88,
34614 .check_reset_block = e1000e_check_reset_block_generic,
34615 @@ -2006,7 +2006,7 @@ static struct e1000_phy_operations e82_p
34616 .cfg_on_link_up = NULL,
34617 };
34618
34619 -static struct e1000_nvm_operations e82571_nvm_ops = {
34620 +static const struct e1000_nvm_operations e82571_nvm_ops = {
34621 .acquire = e1000_acquire_nvm_82571,
34622 .read = e1000e_read_nvm_eerd,
34623 .release = e1000_release_nvm_82571,
34624 diff -urNp linux-2.6.39.1/drivers/net/e1000e/e1000.h linux-2.6.39.1/drivers/net/e1000e/e1000.h
34625 --- linux-2.6.39.1/drivers/net/e1000e/e1000.h 2011-05-19 00:06:34.000000000 -0400
34626 +++ linux-2.6.39.1/drivers/net/e1000e/e1000.h 2011-05-22 19:36:31.000000000 -0400
34627 @@ -409,9 +409,9 @@ struct e1000_info {
34628 u32 pba;
34629 u32 max_hw_frame_size;
34630 s32 (*get_variants)(struct e1000_adapter *);
34631 - struct e1000_mac_operations *mac_ops;
34632 - struct e1000_phy_operations *phy_ops;
34633 - struct e1000_nvm_operations *nvm_ops;
34634 + const struct e1000_mac_operations *mac_ops;
34635 + const struct e1000_phy_operations *phy_ops;
34636 + const struct e1000_nvm_operations *nvm_ops;
34637 };
34638
34639 /* hardware capability, feature, and workaround flags */
34640 diff -urNp linux-2.6.39.1/drivers/net/e1000e/es2lan.c linux-2.6.39.1/drivers/net/e1000e/es2lan.c
34641 --- linux-2.6.39.1/drivers/net/e1000e/es2lan.c 2011-05-19 00:06:34.000000000 -0400
34642 +++ linux-2.6.39.1/drivers/net/e1000e/es2lan.c 2011-05-22 19:36:31.000000000 -0400
34643 @@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
34644 {
34645 struct e1000_hw *hw = &adapter->hw;
34646 struct e1000_mac_info *mac = &hw->mac;
34647 - struct e1000_mac_operations *func = &mac->ops;
34648 + struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34649
34650 /* Set media type */
34651 switch (adapter->pdev->device) {
34652 @@ -1431,7 +1431,7 @@ static void e1000_clear_hw_cntrs_80003es
34653 er32(ICRXDMTC);
34654 }
34655
34656 -static struct e1000_mac_operations es2_mac_ops = {
34657 +static const struct e1000_mac_operations es2_mac_ops = {
34658 .read_mac_addr = e1000_read_mac_addr_80003es2lan,
34659 .id_led_init = e1000e_id_led_init,
34660 .check_mng_mode = e1000e_check_mng_mode_generic,
34661 @@ -1453,7 +1453,7 @@ static struct e1000_mac_operations es2_m
34662 .setup_led = e1000e_setup_led_generic,
34663 };
34664
34665 -static struct e1000_phy_operations es2_phy_ops = {
34666 +static const struct e1000_phy_operations es2_phy_ops = {
34667 .acquire = e1000_acquire_phy_80003es2lan,
34668 .check_polarity = e1000_check_polarity_m88,
34669 .check_reset_block = e1000e_check_reset_block_generic,
34670 @@ -1471,7 +1471,7 @@ static struct e1000_phy_operations es2_p
34671 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
34672 };
34673
34674 -static struct e1000_nvm_operations es2_nvm_ops = {
34675 +static const struct e1000_nvm_operations es2_nvm_ops = {
34676 .acquire = e1000_acquire_nvm_80003es2lan,
34677 .read = e1000e_read_nvm_eerd,
34678 .release = e1000_release_nvm_80003es2lan,
34679 diff -urNp linux-2.6.39.1/drivers/net/e1000e/hw.h linux-2.6.39.1/drivers/net/e1000e/hw.h
34680 --- linux-2.6.39.1/drivers/net/e1000e/hw.h 2011-05-19 00:06:34.000000000 -0400
34681 +++ linux-2.6.39.1/drivers/net/e1000e/hw.h 2011-05-22 19:36:31.000000000 -0400
34682 @@ -811,6 +811,7 @@ struct e1000_nvm_operations {
34683 };
34684
34685 struct e1000_mac_info {
34686 + /* cannot be const see e1000_init_mac_params_ich8lan */
34687 struct e1000_mac_operations ops;
34688 u8 addr[ETH_ALEN];
34689 u8 perm_addr[ETH_ALEN];
34690 @@ -852,6 +853,7 @@ struct e1000_mac_info {
34691 };
34692
34693 struct e1000_phy_info {
34694 + /* Cannot be const see e1000_init_phy_params_82571() */
34695 struct e1000_phy_operations ops;
34696
34697 enum e1000_phy_type type;
34698 @@ -886,6 +888,7 @@ struct e1000_phy_info {
34699 };
34700
34701 struct e1000_nvm_info {
34702 + /* cannot be const */
34703 struct e1000_nvm_operations ops;
34704
34705 enum e1000_nvm_type type;
34706 diff -urNp linux-2.6.39.1/drivers/net/e1000e/ich8lan.c linux-2.6.39.1/drivers/net/e1000e/ich8lan.c
34707 --- linux-2.6.39.1/drivers/net/e1000e/ich8lan.c 2011-05-19 00:06:34.000000000 -0400
34708 +++ linux-2.6.39.1/drivers/net/e1000e/ich8lan.c 2011-05-22 19:36:31.000000000 -0400
34709 @@ -3866,7 +3866,7 @@ static void e1000_clear_hw_cntrs_ich8lan
34710 }
34711 }
34712
34713 -static struct e1000_mac_operations ich8_mac_ops = {
34714 +static const struct e1000_mac_operations ich8_mac_ops = {
34715 .id_led_init = e1000e_id_led_init,
34716 /* check_mng_mode dependent on mac type */
34717 .check_for_link = e1000_check_for_copper_link_ich8lan,
34718 @@ -3885,7 +3885,7 @@ static struct e1000_mac_operations ich8_
34719 /* id_led_init dependent on mac type */
34720 };
34721
34722 -static struct e1000_phy_operations ich8_phy_ops = {
34723 +static const struct e1000_phy_operations ich8_phy_ops = {
34724 .acquire = e1000_acquire_swflag_ich8lan,
34725 .check_reset_block = e1000_check_reset_block_ich8lan,
34726 .commit = NULL,
34727 @@ -3899,7 +3899,7 @@ static struct e1000_phy_operations ich8_
34728 .write_reg = e1000e_write_phy_reg_igp,
34729 };
34730
34731 -static struct e1000_nvm_operations ich8_nvm_ops = {
34732 +static const struct e1000_nvm_operations ich8_nvm_ops = {
34733 .acquire = e1000_acquire_nvm_ich8lan,
34734 .read = e1000_read_nvm_ich8lan,
34735 .release = e1000_release_nvm_ich8lan,
34736 diff -urNp linux-2.6.39.1/drivers/net/greth.c linux-2.6.39.1/drivers/net/greth.c
34737 --- linux-2.6.39.1/drivers/net/greth.c 2011-05-19 00:06:34.000000000 -0400
34738 +++ linux-2.6.39.1/drivers/net/greth.c 2011-05-22 19:36:31.000000000 -0400
34739 @@ -1192,7 +1192,7 @@ static const struct ethtool_ops greth_et
34740 .get_link = ethtool_op_get_link,
34741 };
34742
34743 -static struct net_device_ops greth_netdev_ops = {
34744 +static const struct net_device_ops greth_netdev_ops = {
34745 .ndo_open = greth_open,
34746 .ndo_stop = greth_close,
34747 .ndo_start_xmit = greth_start_xmit,
34748 diff -urNp linux-2.6.39.1/drivers/net/hamradio/6pack.c linux-2.6.39.1/drivers/net/hamradio/6pack.c
34749 --- linux-2.6.39.1/drivers/net/hamradio/6pack.c 2011-05-19 00:06:34.000000000 -0400
34750 +++ linux-2.6.39.1/drivers/net/hamradio/6pack.c 2011-05-22 19:36:31.000000000 -0400
34751 @@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
34752 unsigned char buf[512];
34753 int count1;
34754
34755 + pax_track_stack();
34756 +
34757 if (!count)
34758 return;
34759
34760 diff -urNp linux-2.6.39.1/drivers/net/ibm_newemac/phy.c linux-2.6.39.1/drivers/net/ibm_newemac/phy.c
34761 --- linux-2.6.39.1/drivers/net/ibm_newemac/phy.c 2011-05-19 00:06:34.000000000 -0400
34762 +++ linux-2.6.39.1/drivers/net/ibm_newemac/phy.c 2011-05-22 19:36:31.000000000 -0400
34763 @@ -273,7 +273,7 @@ static int genmii_read_link(struct mii_p
34764 }
34765
34766 /* Generic implementation for most 10/100/1000 PHYs */
34767 -static struct mii_phy_ops generic_phy_ops = {
34768 +static const struct mii_phy_ops generic_phy_ops = {
34769 .setup_aneg = genmii_setup_aneg,
34770 .setup_forced = genmii_setup_forced,
34771 .poll_link = genmii_poll_link,
34772 @@ -337,7 +337,7 @@ static int cis8201_init(struct mii_phy *
34773 return 0;
34774 }
34775
34776 -static struct mii_phy_ops cis8201_phy_ops = {
34777 +static const struct mii_phy_ops cis8201_phy_ops = {
34778 .init = cis8201_init,
34779 .setup_aneg = genmii_setup_aneg,
34780 .setup_forced = genmii_setup_forced,
34781 @@ -417,7 +417,7 @@ static int et1011c_init(struct mii_phy *
34782 return 0;
34783 }
34784
34785 -static struct mii_phy_ops et1011c_phy_ops = {
34786 +static const struct mii_phy_ops et1011c_phy_ops = {
34787 .init = et1011c_init,
34788 .setup_aneg = genmii_setup_aneg,
34789 .setup_forced = genmii_setup_forced,
34790 @@ -436,7 +436,7 @@ static struct mii_phy_def et1011c_phy_de
34791
34792
34793
34794 -static struct mii_phy_ops m88e1111_phy_ops = {
34795 +static const struct mii_phy_ops m88e1111_phy_ops = {
34796 .init = m88e1111_init,
34797 .setup_aneg = genmii_setup_aneg,
34798 .setup_forced = genmii_setup_forced,
34799 @@ -452,7 +452,7 @@ static struct mii_phy_def m88e1111_phy_d
34800 .ops = &m88e1111_phy_ops,
34801 };
34802
34803 -static struct mii_phy_ops m88e1112_phy_ops = {
34804 +static const struct mii_phy_ops m88e1112_phy_ops = {
34805 .init = m88e1112_init,
34806 .setup_aneg = genmii_setup_aneg,
34807 .setup_forced = genmii_setup_forced,
34808 diff -urNp linux-2.6.39.1/drivers/net/ibmveth.c linux-2.6.39.1/drivers/net/ibmveth.c
34809 --- linux-2.6.39.1/drivers/net/ibmveth.c 2011-05-19 00:06:34.000000000 -0400
34810 +++ linux-2.6.39.1/drivers/net/ibmveth.c 2011-05-22 19:36:31.000000000 -0400
34811 @@ -1625,7 +1625,7 @@ static struct vio_device_id ibmveth_devi
34812 };
34813 MODULE_DEVICE_TABLE(vio, ibmveth_device_table);
34814
34815 -static struct dev_pm_ops ibmveth_pm_ops = {
34816 +static const struct dev_pm_ops ibmveth_pm_ops = {
34817 .resume = ibmveth_resume
34818 };
34819
34820 diff -urNp linux-2.6.39.1/drivers/net/igb/e1000_82575.c linux-2.6.39.1/drivers/net/igb/e1000_82575.c
34821 --- linux-2.6.39.1/drivers/net/igb/e1000_82575.c 2011-05-19 00:06:34.000000000 -0400
34822 +++ linux-2.6.39.1/drivers/net/igb/e1000_82575.c 2011-05-22 19:36:31.000000000 -0400
34823 @@ -2029,7 +2029,7 @@ out:
34824 return ret_val;
34825 }
34826
34827 -static struct e1000_mac_operations e1000_mac_ops_82575 = {
34828 +static const struct e1000_mac_operations e1000_mac_ops_82575 = {
34829 .init_hw = igb_init_hw_82575,
34830 .check_for_link = igb_check_for_link_82575,
34831 .rar_set = igb_rar_set,
34832 @@ -2037,13 +2037,13 @@ static struct e1000_mac_operations e1000
34833 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
34834 };
34835
34836 -static struct e1000_phy_operations e1000_phy_ops_82575 = {
34837 +static const struct e1000_phy_operations e1000_phy_ops_82575 = {
34838 .acquire = igb_acquire_phy_82575,
34839 .get_cfg_done = igb_get_cfg_done_82575,
34840 .release = igb_release_phy_82575,
34841 };
34842
34843 -static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34844 +static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34845 .acquire = igb_acquire_nvm_82575,
34846 .read = igb_read_nvm_eerd,
34847 .release = igb_release_nvm_82575,
34848 diff -urNp linux-2.6.39.1/drivers/net/igb/e1000_hw.h linux-2.6.39.1/drivers/net/igb/e1000_hw.h
34849 --- linux-2.6.39.1/drivers/net/igb/e1000_hw.h 2011-05-19 00:06:34.000000000 -0400
34850 +++ linux-2.6.39.1/drivers/net/igb/e1000_hw.h 2011-05-22 19:36:31.000000000 -0400
34851 @@ -342,14 +342,15 @@ struct e1000_nvm_operations {
34852
34853 struct e1000_info {
34854 s32 (*get_invariants)(struct e1000_hw *);
34855 - struct e1000_mac_operations *mac_ops;
34856 - struct e1000_phy_operations *phy_ops;
34857 - struct e1000_nvm_operations *nvm_ops;
34858 + const struct e1000_mac_operations *mac_ops;
34859 + const struct e1000_phy_operations *phy_ops;
34860 + const struct e1000_nvm_operations *nvm_ops;
34861 };
34862
34863 extern const struct e1000_info e1000_82575_info;
34864
34865 struct e1000_mac_info {
34866 + /* cannot be const see igb_get_invariants_82575() */
34867 struct e1000_mac_operations ops;
34868
34869 u8 addr[6];
34870 @@ -388,6 +389,7 @@ struct e1000_mac_info {
34871 };
34872
34873 struct e1000_phy_info {
34874 + /* cannot be const see igb_get_invariants_82575() */
34875 struct e1000_phy_operations ops;
34876
34877 enum e1000_phy_type type;
34878 @@ -423,6 +425,7 @@ struct e1000_phy_info {
34879 };
34880
34881 struct e1000_nvm_info {
34882 + /* cannot be const */
34883 struct e1000_nvm_operations ops;
34884 enum e1000_nvm_type type;
34885 enum e1000_nvm_override override;
34886 diff -urNp linux-2.6.39.1/drivers/net/igbvf/vf.h linux-2.6.39.1/drivers/net/igbvf/vf.h
34887 --- linux-2.6.39.1/drivers/net/igbvf/vf.h 2011-05-19 00:06:34.000000000 -0400
34888 +++ linux-2.6.39.1/drivers/net/igbvf/vf.h 2011-05-22 19:36:31.000000000 -0400
34889 @@ -191,6 +191,7 @@ struct e1000_mac_operations {
34890 };
34891
34892 struct e1000_mac_info {
34893 + /* cannot be const see e1000_init_mac_params_vf() */
34894 struct e1000_mac_operations ops;
34895 u8 addr[6];
34896 u8 perm_addr[6];
34897 diff -urNp linux-2.6.39.1/drivers/net/irda/sh_irda.c linux-2.6.39.1/drivers/net/irda/sh_irda.c
34898 --- linux-2.6.39.1/drivers/net/irda/sh_irda.c 2011-05-19 00:06:34.000000000 -0400
34899 +++ linux-2.6.39.1/drivers/net/irda/sh_irda.c 2011-05-22 19:36:31.000000000 -0400
34900 @@ -307,7 +307,7 @@ static int xir_fte(struct sh_irda_self *
34901 return 0;
34902 }
34903
34904 -static struct sh_irda_xir_func xir_func = {
34905 +static const struct sh_irda_xir_func xir_func = {
34906 .xir_fre = xir_fre,
34907 .xir_trov = xir_trov,
34908 .xir_9 = xir_9,
34909 @@ -321,7 +321,7 @@ static struct sh_irda_xir_func xir_func
34910 *
34911 * MIR/FIR are not supported now
34912 *=====================================*/
34913 -static struct sh_irda_xir_func mfir_func = {
34914 +static const struct sh_irda_xir_func mfir_func = {
34915 .xir_fre = xir_fre,
34916 .xir_trov = xir_trov,
34917 .xir_9 = xir_9,
34918 @@ -400,7 +400,7 @@ static int sir_fte(struct sh_irda_self *
34919 return 0;
34920 }
34921
34922 -static struct sh_irda_xir_func sir_func = {
34923 +static const struct sh_irda_xir_func sir_func = {
34924 .xir_fre = sir_fre,
34925 .xir_trov = sir_trov,
34926 .xir_9 = sir_tot,
34927 @@ -411,7 +411,7 @@ static struct sh_irda_xir_func sir_func
34928 static void sh_irda_set_mode(struct sh_irda_self *self, enum sh_irda_mode mode)
34929 {
34930 struct device *dev = &self->ndev->dev;
34931 - struct sh_irda_xir_func *func;
34932 + const struct sh_irda_xir_func *func;
34933 const char *name;
34934 u16 data;
34935
34936 diff -urNp linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c
34937 --- linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c 2011-05-19 00:06:34.000000000 -0400
34938 +++ linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c 2011-05-22 19:36:31.000000000 -0400
34939 @@ -1069,6 +1069,8 @@ ixgb_set_multi(struct net_device *netdev
34940 u32 rctl;
34941 int i;
34942
34943 + pax_track_stack();
34944 +
34945 /* Check for Promiscuous and All Multicast modes */
34946
34947 rctl = IXGB_READ_REG(hw, RCTL);
34948 diff -urNp linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c
34949 --- linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c 2011-05-19 00:06:34.000000000 -0400
34950 +++ linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c 2011-05-22 19:36:31.000000000 -0400
34951 @@ -261,6 +261,9 @@ void __devinit
34952 ixgb_check_options(struct ixgb_adapter *adapter)
34953 {
34954 int bd = adapter->bd_number;
34955 +
34956 + pax_track_stack();
34957 +
34958 if (bd >= IXGB_MAX_NIC) {
34959 pr_notice("Warning: no configuration for board #%i\n", bd);
34960 pr_notice("Using defaults for all values\n");
34961 diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c
34962 --- linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c 2011-05-19 00:06:34.000000000 -0400
34963 +++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c 2011-05-22 19:36:31.000000000 -0400
34964 @@ -2099,7 +2099,7 @@ static struct ixgbe_phy_operations phy_o
34965 .check_overtemp = &ixgbe_tn_check_overtemp,
34966 };
34967
34968 -struct ixgbe_info ixgbe_82599_info = {
34969 +const struct ixgbe_info ixgbe_82599_info = {
34970 .mac = ixgbe_mac_82599EB,
34971 .get_invariants = &ixgbe_get_invariants_82599,
34972 .mac_ops = &mac_ops_82599,
34973 diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h
34974 --- linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h 2011-05-19 00:06:34.000000000 -0400
34975 +++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h 2011-05-22 19:36:31.000000000 -0400
34976 @@ -493,8 +493,8 @@ enum ixgbe_boards {
34977 };
34978
34979 extern struct ixgbe_info ixgbe_82598_info;
34980 -extern struct ixgbe_info ixgbe_82599_info;
34981 -extern struct ixgbe_info ixgbe_X540_info;
34982 +extern const struct ixgbe_info ixgbe_82599_info;
34983 +extern const struct ixgbe_info ixgbe_X540_info;
34984 #ifdef CONFIG_IXGBE_DCB
34985 extern const struct dcbnl_rtnl_ops dcbnl_ops;
34986 extern int ixgbe_copy_dcb_cfg(struct ixgbe_dcb_config *src_dcb_cfg,
34987 diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c
34988 --- linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c 2011-05-19 00:06:34.000000000 -0400
34989 +++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c 2011-05-22 19:36:31.000000000 -0400
34990 @@ -727,7 +727,7 @@ static struct ixgbe_phy_operations phy_o
34991 .check_overtemp = &ixgbe_tn_check_overtemp,
34992 };
34993
34994 -struct ixgbe_info ixgbe_X540_info = {
34995 +const struct ixgbe_info ixgbe_X540_info = {
34996 .mac = ixgbe_mac_X540,
34997 .get_invariants = &ixgbe_get_invariants_X540,
34998 .mac_ops = &mac_ops_X540,
34999 diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c
35000 --- linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c 2011-05-19 00:06:34.000000000 -0400
35001 +++ linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c 2011-05-22 19:36:31.000000000 -0400
35002 @@ -709,7 +709,7 @@ static int ixgbevf_nway_reset(struct net
35003 return 0;
35004 }
35005
35006 -static struct ethtool_ops ixgbevf_ethtool_ops = {
35007 +static const struct ethtool_ops ixgbevf_ethtool_ops = {
35008 .get_settings = ixgbevf_get_settings,
35009 .get_drvinfo = ixgbevf_get_drvinfo,
35010 .get_regs_len = ixgbevf_get_regs_len,
35011 diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h
35012 --- linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h 2011-05-19 00:06:34.000000000 -0400
35013 +++ linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h 2011-05-22 19:36:31.000000000 -0400
35014 @@ -279,7 +279,7 @@ enum ixgbevf_boards {
35015
35016 extern struct ixgbevf_info ixgbevf_82599_vf_info;
35017 extern struct ixgbevf_info ixgbevf_X540_vf_info;
35018 -extern struct ixgbe_mac_operations ixgbevf_mbx_ops;
35019 +extern const struct ixgbe_mac_operations ixgbevf_mbx_ops;
35020
35021 /* needed by ethtool.c */
35022 extern char ixgbevf_driver_name[];
35023 diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/vf.c linux-2.6.39.1/drivers/net/ixgbevf/vf.c
35024 --- linux-2.6.39.1/drivers/net/ixgbevf/vf.c 2011-05-19 00:06:34.000000000 -0400
35025 +++ linux-2.6.39.1/drivers/net/ixgbevf/vf.c 2011-05-22 19:36:31.000000000 -0400
35026 @@ -368,7 +368,7 @@ static s32 ixgbevf_check_mac_link_vf(str
35027 return 0;
35028 }
35029
35030 -static struct ixgbe_mac_operations ixgbevf_mac_ops = {
35031 +static const struct ixgbe_mac_operations ixgbevf_mac_ops = {
35032 .init_hw = ixgbevf_init_hw_vf,
35033 .reset_hw = ixgbevf_reset_hw_vf,
35034 .start_hw = ixgbevf_start_hw_vf,
35035 @@ -381,12 +381,12 @@ static struct ixgbe_mac_operations ixgbe
35036 .set_vfta = ixgbevf_set_vfta_vf,
35037 };
35038
35039 -struct ixgbevf_info ixgbevf_82599_vf_info = {
35040 +const struct ixgbevf_info ixgbevf_82599_vf_info = {
35041 .mac = ixgbe_mac_82599_vf,
35042 .mac_ops = &ixgbevf_mac_ops,
35043 };
35044
35045 -struct ixgbevf_info ixgbevf_X540_vf_info = {
35046 +const struct ixgbevf_info ixgbevf_X540_vf_info = {
35047 .mac = ixgbe_mac_X540_vf,
35048 .mac_ops = &ixgbevf_mac_ops,
35049 };
35050 diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/vf.h linux-2.6.39.1/drivers/net/ixgbevf/vf.h
35051 --- linux-2.6.39.1/drivers/net/ixgbevf/vf.h 2011-05-19 00:06:34.000000000 -0400
35052 +++ linux-2.6.39.1/drivers/net/ixgbevf/vf.h 2011-05-22 19:36:31.000000000 -0400
35053 @@ -166,7 +166,7 @@ struct ixgbevf_hw_stats {
35054
35055 struct ixgbevf_info {
35056 enum ixgbe_mac_type mac;
35057 - struct ixgbe_mac_operations *mac_ops;
35058 + const struct ixgbe_mac_operations *mac_ops;
35059 };
35060
35061 #endif /* __IXGBE_VF_H__ */
35062 diff -urNp linux-2.6.39.1/drivers/net/ksz884x.c linux-2.6.39.1/drivers/net/ksz884x.c
35063 --- linux-2.6.39.1/drivers/net/ksz884x.c 2011-05-19 00:06:34.000000000 -0400
35064 +++ linux-2.6.39.1/drivers/net/ksz884x.c 2011-05-22 19:36:31.000000000 -0400
35065 @@ -6536,6 +6536,8 @@ static void netdev_get_ethtool_stats(str
35066 int rc;
35067 u64 counter[TOTAL_PORT_COUNTER_NUM];
35068
35069 + pax_track_stack();
35070 +
35071 mutex_lock(&hw_priv->lock);
35072 n = SWITCH_PORT_NUM;
35073 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
35074 @@ -6637,7 +6639,7 @@ static int netdev_set_rx_csum(struct net
35075 return 0;
35076 }
35077
35078 -static struct ethtool_ops netdev_ethtool_ops = {
35079 +static const struct ethtool_ops netdev_ethtool_ops = {
35080 .get_settings = netdev_get_settings,
35081 .set_settings = netdev_set_settings,
35082 .nway_reset = netdev_nway_reset,
35083 diff -urNp linux-2.6.39.1/drivers/net/mlx4/main.c linux-2.6.39.1/drivers/net/mlx4/main.c
35084 --- linux-2.6.39.1/drivers/net/mlx4/main.c 2011-05-19 00:06:34.000000000 -0400
35085 +++ linux-2.6.39.1/drivers/net/mlx4/main.c 2011-05-22 19:36:31.000000000 -0400
35086 @@ -40,6 +40,7 @@
35087 #include <linux/dma-mapping.h>
35088 #include <linux/slab.h>
35089 #include <linux/io-mapping.h>
35090 +#include <linux/sched.h>
35091
35092 #include <linux/mlx4/device.h>
35093 #include <linux/mlx4/doorbell.h>
35094 @@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev
35095 u64 icm_size;
35096 int err;
35097
35098 + pax_track_stack();
35099 +
35100 err = mlx4_QUERY_FW(dev);
35101 if (err) {
35102 if (err == -EACCES)
35103 diff -urNp linux-2.6.39.1/drivers/net/netconsole.c linux-2.6.39.1/drivers/net/netconsole.c
35104 --- linux-2.6.39.1/drivers/net/netconsole.c 2011-05-19 00:06:34.000000000 -0400
35105 +++ linux-2.6.39.1/drivers/net/netconsole.c 2011-05-22 19:36:31.000000000 -0400
35106 @@ -634,7 +634,7 @@ static void drop_netconsole_target(struc
35107 config_item_put(&nt->item);
35108 }
35109
35110 -static struct configfs_group_operations netconsole_subsys_group_ops = {
35111 +static const struct configfs_group_operations netconsole_subsys_group_ops = {
35112 .make_item = make_netconsole_target,
35113 .drop_item = drop_netconsole_target,
35114 };
35115 diff -urNp linux-2.6.39.1/drivers/net/niu.c linux-2.6.39.1/drivers/net/niu.c
35116 --- linux-2.6.39.1/drivers/net/niu.c 2011-05-19 00:06:34.000000000 -0400
35117 +++ linux-2.6.39.1/drivers/net/niu.c 2011-05-22 19:36:31.000000000 -0400
35118 @@ -9067,6 +9067,8 @@ static void __devinit niu_try_msix(struc
35119 int i, num_irqs, err;
35120 u8 first_ldg;
35121
35122 + pax_track_stack();
35123 +
35124 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
35125 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
35126 ldg_num_map[i] = first_ldg + i;
35127 diff -urNp linux-2.6.39.1/drivers/net/pcnet32.c linux-2.6.39.1/drivers/net/pcnet32.c
35128 --- linux-2.6.39.1/drivers/net/pcnet32.c 2011-05-19 00:06:34.000000000 -0400
35129 +++ linux-2.6.39.1/drivers/net/pcnet32.c 2011-05-22 19:36:31.000000000 -0400
35130 @@ -82,7 +82,7 @@ static int cards_found;
35131 /*
35132 * VLB I/O addresses
35133 */
35134 -static unsigned int pcnet32_portlist[] __initdata =
35135 +static unsigned int pcnet32_portlist[] __devinitdata =
35136 { 0x300, 0x320, 0x340, 0x360, 0 };
35137
35138 static int pcnet32_debug;
35139 @@ -379,7 +379,7 @@ static int pcnet32_wio_check(unsigned lo
35140 return inw(addr + PCNET32_WIO_RAP) == 88;
35141 }
35142
35143 -static struct pcnet32_access pcnet32_wio = {
35144 +static const struct pcnet32_access pcnet32_wio = {
35145 .read_csr = pcnet32_wio_read_csr,
35146 .write_csr = pcnet32_wio_write_csr,
35147 .read_bcr = pcnet32_wio_read_bcr,
35148 @@ -434,7 +434,7 @@ static int pcnet32_dwio_check(unsigned l
35149 return (inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88;
35150 }
35151
35152 -static struct pcnet32_access pcnet32_dwio = {
35153 +static const struct pcnet32_access pcnet32_dwio = {
35154 .read_csr = pcnet32_dwio_read_csr,
35155 .write_csr = pcnet32_dwio_write_csr,
35156 .read_bcr = pcnet32_dwio_read_bcr,
35157 @@ -1546,7 +1546,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35158 int chip_version;
35159 char *chipname;
35160 struct net_device *dev;
35161 - struct pcnet32_access *a = NULL;
35162 + const struct pcnet32_access *a = NULL;
35163 u8 promaddr[6];
35164 int ret = -ENODEV;
35165
35166 diff -urNp linux-2.6.39.1/drivers/net/ppp_generic.c linux-2.6.39.1/drivers/net/ppp_generic.c
35167 --- linux-2.6.39.1/drivers/net/ppp_generic.c 2011-05-19 00:06:34.000000000 -0400
35168 +++ linux-2.6.39.1/drivers/net/ppp_generic.c 2011-05-22 19:36:31.000000000 -0400
35169 @@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st
35170 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
35171 struct ppp_stats stats;
35172 struct ppp_comp_stats cstats;
35173 - char *vers;
35174
35175 switch (cmd) {
35176 case SIOCGPPPSTATS:
35177 @@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st
35178 break;
35179
35180 case SIOCGPPPVER:
35181 - vers = PPP_VERSION;
35182 - if (copy_to_user(addr, vers, strlen(vers) + 1))
35183 + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
35184 break;
35185 err = 0;
35186 break;
35187 diff -urNp linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h
35188 --- linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h 2011-05-19 00:06:34.000000000 -0400
35189 +++ linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h 2011-05-22 19:36:31.000000000 -0400
35190 @@ -1037,7 +1037,7 @@ struct qlcnic_adapter {
35191 struct vlan_group *vlgrp;
35192 struct qlcnic_npar_info *npars;
35193 struct qlcnic_eswitch *eswitch;
35194 - struct qlcnic_nic_template *nic_ops;
35195 + const struct qlcnic_nic_template *nic_ops;
35196
35197 struct qlcnic_adapter_stats stats;
35198
35199 diff -urNp linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c
35200 --- linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c 2011-05-19 00:06:34.000000000 -0400
35201 +++ linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c 2011-05-22 19:36:31.000000000 -0400
35202 @@ -340,13 +340,13 @@ static const struct net_device_ops qlcni
35203 #endif
35204 };
35205
35206 -static struct qlcnic_nic_template qlcnic_ops = {
35207 +static const struct qlcnic_nic_template qlcnic_ops = {
35208 .config_bridged_mode = qlcnic_config_bridged_mode,
35209 .config_led = qlcnic_config_led,
35210 .start_firmware = qlcnic_start_firmware
35211 };
35212
35213 -static struct qlcnic_nic_template qlcnic_vf_ops = {
35214 +static const struct qlcnic_nic_template qlcnic_vf_ops = {
35215 .config_bridged_mode = qlcnicvf_config_bridged_mode,
35216 .config_led = qlcnicvf_config_led,
35217 .start_firmware = qlcnicvf_start_firmware
35218 diff -urNp linux-2.6.39.1/drivers/net/qlge/qlge.h linux-2.6.39.1/drivers/net/qlge/qlge.h
35219 --- linux-2.6.39.1/drivers/net/qlge/qlge.h 2011-05-19 00:06:34.000000000 -0400
35220 +++ linux-2.6.39.1/drivers/net/qlge/qlge.h 2011-05-22 19:36:31.000000000 -0400
35221 @@ -2134,7 +2134,7 @@ struct ql_adapter {
35222 struct delayed_work mpi_idc_work;
35223 struct delayed_work mpi_core_to_log;
35224 struct completion ide_completion;
35225 - struct nic_operations *nic_ops;
35226 + const struct nic_operations *nic_ops;
35227 u16 device_id;
35228 struct timer_list timer;
35229 atomic_t lb_count;
35230 diff -urNp linux-2.6.39.1/drivers/net/qlge/qlge_main.c linux-2.6.39.1/drivers/net/qlge/qlge_main.c
35231 --- linux-2.6.39.1/drivers/net/qlge/qlge_main.c 2011-05-19 00:06:34.000000000 -0400
35232 +++ linux-2.6.39.1/drivers/net/qlge/qlge_main.c 2011-05-22 19:36:31.000000000 -0400
35233 @@ -4412,12 +4412,12 @@ error:
35234 rtnl_unlock();
35235 }
35236
35237 -static struct nic_operations qla8012_nic_ops = {
35238 +static const struct nic_operations qla8012_nic_ops = {
35239 .get_flash = ql_get_8012_flash_params,
35240 .port_initialize = ql_8012_port_initialize,
35241 };
35242
35243 -static struct nic_operations qla8000_nic_ops = {
35244 +static const struct nic_operations qla8000_nic_ops = {
35245 .get_flash = ql_get_8000_flash_params,
35246 .port_initialize = ql_8000_port_initialize,
35247 };
35248 diff -urNp linux-2.6.39.1/drivers/net/sfc/falcon.c linux-2.6.39.1/drivers/net/sfc/falcon.c
35249 --- linux-2.6.39.1/drivers/net/sfc/falcon.c 2011-05-19 00:06:34.000000000 -0400
35250 +++ linux-2.6.39.1/drivers/net/sfc/falcon.c 2011-05-22 19:36:31.000000000 -0400
35251 @@ -1703,7 +1703,7 @@ static int falcon_set_wol(struct efx_nic
35252 **************************************************************************
35253 */
35254
35255 -struct efx_nic_type falcon_a1_nic_type = {
35256 +const struct efx_nic_type falcon_a1_nic_type = {
35257 .probe = falcon_probe_nic,
35258 .remove = falcon_remove_nic,
35259 .init = falcon_init_nic,
35260 @@ -1744,7 +1744,7 @@ struct efx_nic_type falcon_a1_nic_type =
35261 .reset_world_flags = ETH_RESET_IRQ,
35262 };
35263
35264 -struct efx_nic_type falcon_b0_nic_type = {
35265 +const struct efx_nic_type falcon_b0_nic_type = {
35266 .probe = falcon_probe_nic,
35267 .remove = falcon_remove_nic,
35268 .init = falcon_init_nic,
35269 diff -urNp linux-2.6.39.1/drivers/net/sfc/mtd.c linux-2.6.39.1/drivers/net/sfc/mtd.c
35270 --- linux-2.6.39.1/drivers/net/sfc/mtd.c 2011-05-19 00:06:34.000000000 -0400
35271 +++ linux-2.6.39.1/drivers/net/sfc/mtd.c 2011-05-22 19:36:31.000000000 -0400
35272 @@ -382,7 +382,7 @@ static int falcon_mtd_sync(struct mtd_in
35273 return rc;
35274 }
35275
35276 -static struct efx_mtd_ops falcon_mtd_ops = {
35277 +static const struct efx_mtd_ops falcon_mtd_ops = {
35278 .read = falcon_mtd_read,
35279 .erase = falcon_mtd_erase,
35280 .write = falcon_mtd_write,
35281 @@ -560,7 +560,7 @@ static int siena_mtd_sync(struct mtd_inf
35282 return rc;
35283 }
35284
35285 -static struct efx_mtd_ops siena_mtd_ops = {
35286 +static const struct efx_mtd_ops siena_mtd_ops = {
35287 .read = siena_mtd_read,
35288 .erase = siena_mtd_erase,
35289 .write = siena_mtd_write,
35290 diff -urNp linux-2.6.39.1/drivers/net/sfc/nic.h linux-2.6.39.1/drivers/net/sfc/nic.h
35291 --- linux-2.6.39.1/drivers/net/sfc/nic.h 2011-05-19 00:06:34.000000000 -0400
35292 +++ linux-2.6.39.1/drivers/net/sfc/nic.h 2011-05-22 19:36:31.000000000 -0400
35293 @@ -152,9 +152,9 @@ struct siena_nic_data {
35294 int wol_filter_id;
35295 };
35296
35297 -extern struct efx_nic_type falcon_a1_nic_type;
35298 -extern struct efx_nic_type falcon_b0_nic_type;
35299 -extern struct efx_nic_type siena_a0_nic_type;
35300 +extern const struct efx_nic_type falcon_a1_nic_type;
35301 +extern const struct efx_nic_type falcon_b0_nic_type;
35302 +extern const struct efx_nic_type siena_a0_nic_type;
35303
35304 /**************************************************************************
35305 *
35306 diff -urNp linux-2.6.39.1/drivers/net/sfc/siena.c linux-2.6.39.1/drivers/net/sfc/siena.c
35307 --- linux-2.6.39.1/drivers/net/sfc/siena.c 2011-05-19 00:06:34.000000000 -0400
35308 +++ linux-2.6.39.1/drivers/net/sfc/siena.c 2011-05-22 19:36:31.000000000 -0400
35309 @@ -599,7 +599,7 @@ static void siena_init_wol(struct efx_ni
35310 **************************************************************************
35311 */
35312
35313 -struct efx_nic_type siena_a0_nic_type = {
35314 +const struct efx_nic_type siena_a0_nic_type = {
35315 .probe = siena_probe_nic,
35316 .remove = siena_remove_nic,
35317 .init = siena_init_nic,
35318 diff -urNp linux-2.6.39.1/drivers/net/sh_eth.c linux-2.6.39.1/drivers/net/sh_eth.c
35319 --- linux-2.6.39.1/drivers/net/sh_eth.c 2011-05-19 00:06:34.000000000 -0400
35320 +++ linux-2.6.39.1/drivers/net/sh_eth.c 2011-05-22 19:36:31.000000000 -0400
35321 @@ -1360,7 +1360,7 @@ static void sh_eth_get_strings(struct ne
35322 }
35323 }
35324
35325 -static struct ethtool_ops sh_eth_ethtool_ops = {
35326 +static const struct ethtool_ops sh_eth_ethtool_ops = {
35327 .get_settings = sh_eth_get_settings,
35328 .set_settings = sh_eth_set_settings,
35329 .nway_reset = sh_eth_nway_reset,
35330 diff -urNp linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c
35331 --- linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35332 +++ linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35333 @@ -348,7 +348,7 @@ static int stmmac_set_wol(struct net_dev
35334 return 0;
35335 }
35336
35337 -static struct ethtool_ops stmmac_ethtool_ops = {
35338 +static const struct ethtool_ops stmmac_ethtool_ops = {
35339 .begin = stmmac_check_if_running,
35340 .get_drvinfo = stmmac_ethtool_getdrvinfo,
35341 .get_settings = stmmac_ethtool_getsettings,
35342 diff -urNp linux-2.6.39.1/drivers/net/sungem_phy.c linux-2.6.39.1/drivers/net/sungem_phy.c
35343 --- linux-2.6.39.1/drivers/net/sungem_phy.c 2011-05-19 00:06:34.000000000 -0400
35344 +++ linux-2.6.39.1/drivers/net/sungem_phy.c 2011-05-22 19:36:31.000000000 -0400
35345 @@ -886,7 +886,7 @@ static int marvell_read_link(struct mii_
35346 SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
35347
35348 /* Broadcom BCM 5201 */
35349 -static struct mii_phy_ops bcm5201_phy_ops = {
35350 +static const struct mii_phy_ops bcm5201_phy_ops = {
35351 .init = bcm5201_init,
35352 .suspend = bcm5201_suspend,
35353 .setup_aneg = genmii_setup_aneg,
35354 @@ -905,7 +905,7 @@ static struct mii_phy_def bcm5201_phy_de
35355 };
35356
35357 /* Broadcom BCM 5221 */
35358 -static struct mii_phy_ops bcm5221_phy_ops = {
35359 +static const struct mii_phy_ops bcm5221_phy_ops = {
35360 .suspend = bcm5221_suspend,
35361 .init = bcm5221_init,
35362 .setup_aneg = genmii_setup_aneg,
35363 @@ -924,7 +924,7 @@ static struct mii_phy_def bcm5221_phy_de
35364 };
35365
35366 /* Broadcom BCM 5241 */
35367 -static struct mii_phy_ops bcm5241_phy_ops = {
35368 +static const struct mii_phy_ops bcm5241_phy_ops = {
35369 .suspend = bcm5241_suspend,
35370 .init = bcm5241_init,
35371 .setup_aneg = genmii_setup_aneg,
35372 @@ -942,7 +942,7 @@ static struct mii_phy_def bcm5241_phy_de
35373 };
35374
35375 /* Broadcom BCM 5400 */
35376 -static struct mii_phy_ops bcm5400_phy_ops = {
35377 +static const struct mii_phy_ops bcm5400_phy_ops = {
35378 .init = bcm5400_init,
35379 .suspend = bcm5400_suspend,
35380 .setup_aneg = bcm54xx_setup_aneg,
35381 @@ -961,7 +961,7 @@ static struct mii_phy_def bcm5400_phy_de
35382 };
35383
35384 /* Broadcom BCM 5401 */
35385 -static struct mii_phy_ops bcm5401_phy_ops = {
35386 +static const struct mii_phy_ops bcm5401_phy_ops = {
35387 .init = bcm5401_init,
35388 .suspend = bcm5401_suspend,
35389 .setup_aneg = bcm54xx_setup_aneg,
35390 @@ -980,7 +980,7 @@ static struct mii_phy_def bcm5401_phy_de
35391 };
35392
35393 /* Broadcom BCM 5411 */
35394 -static struct mii_phy_ops bcm5411_phy_ops = {
35395 +static const struct mii_phy_ops bcm5411_phy_ops = {
35396 .init = bcm5411_init,
35397 .suspend = generic_suspend,
35398 .setup_aneg = bcm54xx_setup_aneg,
35399 @@ -999,7 +999,7 @@ static struct mii_phy_def bcm5411_phy_de
35400 };
35401
35402 /* Broadcom BCM 5421 */
35403 -static struct mii_phy_ops bcm5421_phy_ops = {
35404 +static const struct mii_phy_ops bcm5421_phy_ops = {
35405 .init = bcm5421_init,
35406 .suspend = generic_suspend,
35407 .setup_aneg = bcm54xx_setup_aneg,
35408 @@ -1019,7 +1019,7 @@ static struct mii_phy_def bcm5421_phy_de
35409 };
35410
35411 /* Broadcom BCM 5421 built-in K2 */
35412 -static struct mii_phy_ops bcm5421k2_phy_ops = {
35413 +static const struct mii_phy_ops bcm5421k2_phy_ops = {
35414 .init = bcm5421_init,
35415 .suspend = generic_suspend,
35416 .setup_aneg = bcm54xx_setup_aneg,
35417 @@ -1037,7 +1037,7 @@ static struct mii_phy_def bcm5421k2_phy_
35418 .ops = &bcm5421k2_phy_ops
35419 };
35420
35421 -static struct mii_phy_ops bcm5461_phy_ops = {
35422 +static const struct mii_phy_ops bcm5461_phy_ops = {
35423 .init = bcm5421_init,
35424 .suspend = generic_suspend,
35425 .setup_aneg = bcm54xx_setup_aneg,
35426 @@ -1057,7 +1057,7 @@ static struct mii_phy_def bcm5461_phy_de
35427 };
35428
35429 /* Broadcom BCM 5462 built-in Vesta */
35430 -static struct mii_phy_ops bcm5462V_phy_ops = {
35431 +static const struct mii_phy_ops bcm5462V_phy_ops = {
35432 .init = bcm5421_init,
35433 .suspend = generic_suspend,
35434 .setup_aneg = bcm54xx_setup_aneg,
35435 @@ -1076,7 +1076,7 @@ static struct mii_phy_def bcm5462V_phy_d
35436 };
35437
35438 /* Marvell 88E1101 amd 88E1111 */
35439 -static struct mii_phy_ops marvell88e1101_phy_ops = {
35440 +static const struct mii_phy_ops marvell88e1101_phy_ops = {
35441 .suspend = generic_suspend,
35442 .setup_aneg = marvell_setup_aneg,
35443 .setup_forced = marvell_setup_forced,
35444 @@ -1084,7 +1084,7 @@ static struct mii_phy_ops marvell88e1101
35445 .read_link = marvell_read_link
35446 };
35447
35448 -static struct mii_phy_ops marvell88e1111_phy_ops = {
35449 +static const struct mii_phy_ops marvell88e1111_phy_ops = {
35450 .init = marvell88e1111_init,
35451 .suspend = generic_suspend,
35452 .setup_aneg = marvell_setup_aneg,
35453 @@ -1122,7 +1122,7 @@ static struct mii_phy_def marvell88e1111
35454 };
35455
35456 /* Generic implementation for most 10/100 PHYs */
35457 -static struct mii_phy_ops generic_phy_ops = {
35458 +static const struct mii_phy_ops generic_phy_ops = {
35459 .setup_aneg = genmii_setup_aneg,
35460 .setup_forced = genmii_setup_forced,
35461 .poll_link = genmii_poll_link,
35462 diff -urNp linux-2.6.39.1/drivers/net/tg3.h linux-2.6.39.1/drivers/net/tg3.h
35463 --- linux-2.6.39.1/drivers/net/tg3.h 2011-05-19 00:06:34.000000000 -0400
35464 +++ linux-2.6.39.1/drivers/net/tg3.h 2011-05-22 19:36:31.000000000 -0400
35465 @@ -131,6 +131,7 @@
35466 #define CHIPREV_ID_5750_A0 0x4000
35467 #define CHIPREV_ID_5750_A1 0x4001
35468 #define CHIPREV_ID_5750_A3 0x4003
35469 +#define CHIPREV_ID_5750_C1 0x4201
35470 #define CHIPREV_ID_5750_C2 0x4202
35471 #define CHIPREV_ID_5752_A0_HW 0x5000
35472 #define CHIPREV_ID_5752_A0 0x6000
35473 diff -urNp linux-2.6.39.1/drivers/net/tile/tilepro.c linux-2.6.39.1/drivers/net/tile/tilepro.c
35474 --- linux-2.6.39.1/drivers/net/tile/tilepro.c 2011-05-19 00:06:34.000000000 -0400
35475 +++ linux-2.6.39.1/drivers/net/tile/tilepro.c 2011-05-22 19:36:31.000000000 -0400
35476 @@ -2263,7 +2263,7 @@ static int tile_net_get_mac(struct net_d
35477 }
35478
35479
35480 -static struct net_device_ops tile_net_ops = {
35481 +static const struct net_device_ops tile_net_ops = {
35482 .ndo_open = tile_net_open,
35483 .ndo_stop = tile_net_stop,
35484 .ndo_start_xmit = tile_net_tx,
35485 diff -urNp linux-2.6.39.1/drivers/net/tulip/de2104x.c linux-2.6.39.1/drivers/net/tulip/de2104x.c
35486 --- linux-2.6.39.1/drivers/net/tulip/de2104x.c 2011-05-19 00:06:34.000000000 -0400
35487 +++ linux-2.6.39.1/drivers/net/tulip/de2104x.c 2011-05-22 19:36:31.000000000 -0400
35488 @@ -1817,6 +1817,8 @@ static void __devinit de21041_get_srom_i
35489 struct de_srom_info_leaf *il;
35490 void *bufp;
35491
35492 + pax_track_stack();
35493 +
35494 /* download entire eeprom */
35495 for (i = 0; i < DE_EEPROM_WORDS; i++)
35496 ((__le16 *)ee_data)[i] =
35497 diff -urNp linux-2.6.39.1/drivers/net/tulip/de4x5.c linux-2.6.39.1/drivers/net/tulip/de4x5.c
35498 --- linux-2.6.39.1/drivers/net/tulip/de4x5.c 2011-05-19 00:06:34.000000000 -0400
35499 +++ linux-2.6.39.1/drivers/net/tulip/de4x5.c 2011-05-22 19:36:31.000000000 -0400
35500 @@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
35501 for (i=0; i<ETH_ALEN; i++) {
35502 tmp.addr[i] = dev->dev_addr[i];
35503 }
35504 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35505 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35506 break;
35507
35508 case DE4X5_SET_HWADDR: /* Set the hardware address */
35509 @@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru
35510 spin_lock_irqsave(&lp->lock, flags);
35511 memcpy(&statbuf, &lp->pktStats, ioc->len);
35512 spin_unlock_irqrestore(&lp->lock, flags);
35513 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
35514 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
35515 return -EFAULT;
35516 break;
35517 }
35518 diff -urNp linux-2.6.39.1/drivers/net/usb/asix.c linux-2.6.39.1/drivers/net/usb/asix.c
35519 --- linux-2.6.39.1/drivers/net/usb/asix.c 2011-05-19 00:06:34.000000000 -0400
35520 +++ linux-2.6.39.1/drivers/net/usb/asix.c 2011-05-22 19:36:31.000000000 -0400
35521 @@ -1098,7 +1098,7 @@ out:
35522 return ret;
35523 }
35524
35525 -static struct ethtool_ops ax88178_ethtool_ops = {
35526 +static const struct ethtool_ops ax88178_ethtool_ops = {
35527 .get_drvinfo = asix_get_drvinfo,
35528 .get_link = asix_get_link,
35529 .get_msglevel = usbnet_get_msglevel,
35530 diff -urNp linux-2.6.39.1/drivers/net/usb/cdc_ncm.c linux-2.6.39.1/drivers/net/usb/cdc_ncm.c
35531 --- linux-2.6.39.1/drivers/net/usb/cdc_ncm.c 2011-05-19 00:06:34.000000000 -0400
35532 +++ linux-2.6.39.1/drivers/net/usb/cdc_ncm.c 2011-05-22 19:36:31.000000000 -0400
35533 @@ -141,7 +141,7 @@ struct cdc_ncm_ctx {
35534 static void cdc_ncm_tx_timeout(unsigned long arg);
35535 static const struct driver_info cdc_ncm_info;
35536 static struct usb_driver cdc_ncm_driver;
35537 -static struct ethtool_ops cdc_ncm_ethtool_ops;
35538 +static const struct ethtool_ops cdc_ncm_ethtool_ops;
35539
35540 static const struct usb_device_id cdc_devs[] = {
35541 { USB_INTERFACE_INFO(USB_CLASS_COMM,
35542 @@ -1257,7 +1257,7 @@ static struct usb_driver cdc_ncm_driver
35543 .supports_autosuspend = 1,
35544 };
35545
35546 -static struct ethtool_ops cdc_ncm_ethtool_ops = {
35547 +static const struct ethtool_ops cdc_ncm_ethtool_ops = {
35548 .get_drvinfo = cdc_ncm_get_drvinfo,
35549 .get_link = usbnet_get_link,
35550 .get_msglevel = usbnet_get_msglevel,
35551 diff -urNp linux-2.6.39.1/drivers/net/usb/hso.c linux-2.6.39.1/drivers/net/usb/hso.c
35552 --- linux-2.6.39.1/drivers/net/usb/hso.c 2011-05-19 00:06:34.000000000 -0400
35553 +++ linux-2.6.39.1/drivers/net/usb/hso.c 2011-05-22 19:36:31.000000000 -0400
35554 @@ -71,7 +71,7 @@
35555 #include <asm/byteorder.h>
35556 #include <linux/serial_core.h>
35557 #include <linux/serial.h>
35558 -
35559 +#include <asm/local.h>
35560
35561 #define MOD_AUTHOR "Option Wireless"
35562 #define MOD_DESCRIPTION "USB High Speed Option driver"
35563 @@ -257,7 +257,7 @@ struct hso_serial {
35564
35565 /* from usb_serial_port */
35566 struct tty_struct *tty;
35567 - int open_count;
35568 + local_t open_count;
35569 spinlock_t serial_lock;
35570
35571 int (*write_data) (struct hso_serial *serial);
35572 @@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_
35573 struct urb *urb;
35574
35575 urb = serial->rx_urb[0];
35576 - if (serial->open_count > 0) {
35577 + if (local_read(&serial->open_count) > 0) {
35578 count = put_rxbuf_data(urb, serial);
35579 if (count == -1)
35580 return;
35581 @@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal
35582 DUMP1(urb->transfer_buffer, urb->actual_length);
35583
35584 /* Anyone listening? */
35585 - if (serial->open_count == 0)
35586 + if (local_read(&serial->open_count) == 0)
35587 return;
35588
35589 if (status == 0) {
35590 @@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
35591 spin_unlock_irq(&serial->serial_lock);
35592
35593 /* check for port already opened, if not set the termios */
35594 - serial->open_count++;
35595 - if (serial->open_count == 1) {
35596 + if (local_inc_return(&serial->open_count) == 1) {
35597 serial->rx_state = RX_IDLE;
35598 /* Force default termio settings */
35599 _hso_serial_set_termios(tty, NULL);
35600 @@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st
35601 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
35602 if (result) {
35603 hso_stop_serial_device(serial->parent);
35604 - serial->open_count--;
35605 + local_dec(&serial->open_count);
35606 kref_put(&serial->parent->ref, hso_serial_ref_free);
35607 }
35608 } else {
35609 @@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_
35610
35611 /* reset the rts and dtr */
35612 /* do the actual close */
35613 - serial->open_count--;
35614 + local_dec(&serial->open_count);
35615
35616 - if (serial->open_count <= 0) {
35617 - serial->open_count = 0;
35618 + if (local_read(&serial->open_count) <= 0) {
35619 + local_set(&serial->open_count, 0);
35620 spin_lock_irq(&serial->serial_lock);
35621 if (serial->tty == tty) {
35622 serial->tty->driver_data = NULL;
35623 @@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc
35624
35625 /* the actual setup */
35626 spin_lock_irqsave(&serial->serial_lock, flags);
35627 - if (serial->open_count)
35628 + if (local_read(&serial->open_count))
35629 _hso_serial_set_termios(tty, old);
35630 else
35631 tty->termios = old;
35632 @@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur
35633 D1("Pending read interrupt on port %d\n", i);
35634 spin_lock(&serial->serial_lock);
35635 if (serial->rx_state == RX_IDLE &&
35636 - serial->open_count > 0) {
35637 + local_read(&serial->open_count) > 0) {
35638 /* Setup and send a ctrl req read on
35639 * port i */
35640 if (!serial->rx_urb_filled[0]) {
35641 @@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
35642 /* Start all serial ports */
35643 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
35644 if (serial_table[i] && (serial_table[i]->interface == iface)) {
35645 - if (dev2ser(serial_table[i])->open_count) {
35646 + if (local_read(&dev2ser(serial_table[i])->open_count)) {
35647 result =
35648 hso_start_serial_device(serial_table[i], GFP_NOIO);
35649 hso_kick_transmit(dev2ser(serial_table[i]));
35650 diff -urNp linux-2.6.39.1/drivers/net/usb/ipheth.c linux-2.6.39.1/drivers/net/usb/ipheth.c
35651 --- linux-2.6.39.1/drivers/net/usb/ipheth.c 2011-05-19 00:06:34.000000000 -0400
35652 +++ linux-2.6.39.1/drivers/net/usb/ipheth.c 2011-05-22 19:36:31.000000000 -0400
35653 @@ -421,7 +421,7 @@ static u32 ipheth_ethtool_op_get_link(st
35654 return netif_carrier_ok(dev->net);
35655 }
35656
35657 -static struct ethtool_ops ops = {
35658 +static const struct ethtool_ops ops = {
35659 .get_link = ipheth_ethtool_op_get_link
35660 };
35661
35662 diff -urNp linux-2.6.39.1/drivers/net/usb/sierra_net.c linux-2.6.39.1/drivers/net/usb/sierra_net.c
35663 --- linux-2.6.39.1/drivers/net/usb/sierra_net.c 2011-05-19 00:06:34.000000000 -0400
35664 +++ linux-2.6.39.1/drivers/net/usb/sierra_net.c 2011-05-22 19:36:31.000000000 -0400
35665 @@ -618,7 +618,7 @@ static u32 sierra_net_get_link(struct ne
35666 return sierra_net_get_private(dev)->link_up && netif_running(net);
35667 }
35668
35669 -static struct ethtool_ops sierra_net_ethtool_ops = {
35670 +static const struct ethtool_ops sierra_net_ethtool_ops = {
35671 .get_drvinfo = sierra_net_get_drvinfo,
35672 .get_link = sierra_net_get_link,
35673 .get_msglevel = usbnet_get_msglevel,
35674 diff -urNp linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c
35675 --- linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35676 +++ linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35677 @@ -631,8 +631,7 @@ vmxnet3_set_rss_indir(struct net_device
35678 * Return with error code if any of the queue indices
35679 * is out of range
35680 */
35681 - if (p->ring_index[i] < 0 ||
35682 - p->ring_index[i] >= adapter->num_rx_queues)
35683 + if (p->ring_index[i] >= adapter->num_rx_queues)
35684 return -EINVAL;
35685 }
35686
35687 diff -urNp linux-2.6.39.1/drivers/net/vxge/vxge-main.c linux-2.6.39.1/drivers/net/vxge/vxge-main.c
35688 --- linux-2.6.39.1/drivers/net/vxge/vxge-main.c 2011-05-19 00:06:34.000000000 -0400
35689 +++ linux-2.6.39.1/drivers/net/vxge/vxge-main.c 2011-05-22 19:36:31.000000000 -0400
35690 @@ -97,6 +97,8 @@ static inline void VXGE_COMPLETE_VPATH_T
35691 struct sk_buff *completed[NR_SKB_COMPLETED];
35692 int more;
35693
35694 + pax_track_stack();
35695 +
35696 do {
35697 more = 0;
35698 skb_ptr = completed;
35699 @@ -1927,6 +1929,8 @@ static enum vxge_hw_status vxge_rth_conf
35700 u8 mtable[256] = {0}; /* CPU to vpath mapping */
35701 int index;
35702
35703 + pax_track_stack();
35704 +
35705 /*
35706 * Filling
35707 * - itable with bucket numbers
35708 diff -urNp linux-2.6.39.1/drivers/net/wan/cycx_x25.c linux-2.6.39.1/drivers/net/wan/cycx_x25.c
35709 --- linux-2.6.39.1/drivers/net/wan/cycx_x25.c 2011-05-19 00:06:34.000000000 -0400
35710 +++ linux-2.6.39.1/drivers/net/wan/cycx_x25.c 2011-05-22 19:36:31.000000000 -0400
35711 @@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
35712 unsigned char hex[1024],
35713 * phex = hex;
35714
35715 + pax_track_stack();
35716 +
35717 if (len >= (sizeof(hex) / 2))
35718 len = (sizeof(hex) / 2) - 1;
35719
35720 diff -urNp linux-2.6.39.1/drivers/net/wan/lapbether.c linux-2.6.39.1/drivers/net/wan/lapbether.c
35721 --- linux-2.6.39.1/drivers/net/wan/lapbether.c 2011-05-19 00:06:34.000000000 -0400
35722 +++ linux-2.6.39.1/drivers/net/wan/lapbether.c 2011-05-22 19:36:31.000000000 -0400
35723 @@ -259,7 +259,7 @@ static int lapbeth_set_mac_address(struc
35724 }
35725
35726
35727 -static struct lapb_register_struct lapbeth_callbacks = {
35728 +static const struct lapb_register_struct lapbeth_callbacks = {
35729 .connect_confirmation = lapbeth_connected,
35730 .connect_indication = lapbeth_connected,
35731 .disconnect_confirmation = lapbeth_disconnected,
35732 diff -urNp linux-2.6.39.1/drivers/net/wan/x25_asy.c linux-2.6.39.1/drivers/net/wan/x25_asy.c
35733 --- linux-2.6.39.1/drivers/net/wan/x25_asy.c 2011-05-19 00:06:34.000000000 -0400
35734 +++ linux-2.6.39.1/drivers/net/wan/x25_asy.c 2011-05-22 19:36:31.000000000 -0400
35735 @@ -434,7 +434,7 @@ static void x25_asy_disconnected(struct
35736 netif_rx(skb);
35737 }
35738
35739 -static struct lapb_register_struct x25_asy_callbacks = {
35740 +static const struct lapb_register_struct x25_asy_callbacks = {
35741 .connect_confirmation = x25_asy_connected,
35742 .connect_indication = x25_asy_connected,
35743 .disconnect_confirmation = x25_asy_disconnected,
35744 diff -urNp linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c
35745 --- linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c 2011-05-19 00:06:34.000000000 -0400
35746 +++ linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c 2011-05-22 19:36:31.000000000 -0400
35747 @@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
35748 int do_autopm = 1;
35749 DECLARE_COMPLETION_ONSTACK(notif_completion);
35750
35751 + pax_track_stack();
35752 +
35753 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
35754 i2400m, ack, ack_size);
35755 BUG_ON(_ack == i2400m->bm_ack_buf);
35756 diff -urNp linux-2.6.39.1/drivers/net/wireless/airo.c linux-2.6.39.1/drivers/net/wireless/airo.c
35757 --- linux-2.6.39.1/drivers/net/wireless/airo.c 2011-05-19 00:06:34.000000000 -0400
35758 +++ linux-2.6.39.1/drivers/net/wireless/airo.c 2011-05-22 19:36:31.000000000 -0400
35759 @@ -3001,6 +3001,8 @@ static void airo_process_scan_results (s
35760 BSSListElement * loop_net;
35761 BSSListElement * tmp_net;
35762
35763 + pax_track_stack();
35764 +
35765 /* Blow away current list of scan results */
35766 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
35767 list_move_tail (&loop_net->list, &ai->network_free_list);
35768 @@ -3792,6 +3794,8 @@ static u16 setup_card(struct airo_info *
35769 WepKeyRid wkr;
35770 int rc;
35771
35772 + pax_track_stack();
35773 +
35774 memset( &mySsid, 0, sizeof( mySsid ) );
35775 kfree (ai->flash);
35776 ai->flash = NULL;
35777 @@ -4760,6 +4764,8 @@ static int proc_stats_rid_open( struct i
35778 __le32 *vals = stats.vals;
35779 int len;
35780
35781 + pax_track_stack();
35782 +
35783 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35784 return -ENOMEM;
35785 data = file->private_data;
35786 @@ -5483,6 +5489,8 @@ static int proc_BSSList_open( struct ino
35787 /* If doLoseSync is not 1, we won't do a Lose Sync */
35788 int doLoseSync = -1;
35789
35790 + pax_track_stack();
35791 +
35792 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35793 return -ENOMEM;
35794 data = file->private_data;
35795 @@ -7190,6 +7198,8 @@ static int airo_get_aplist(struct net_de
35796 int i;
35797 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
35798
35799 + pax_track_stack();
35800 +
35801 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
35802 if (!qual)
35803 return -ENOMEM;
35804 @@ -7750,6 +7760,8 @@ static void airo_read_wireless_stats(str
35805 CapabilityRid cap_rid;
35806 __le32 *vals = stats_rid.vals;
35807
35808 + pax_track_stack();
35809 +
35810 /* Get stats out of the card */
35811 clear_bit(JOB_WSTATS, &local->jobs);
35812 if (local->power.event) {
35813 diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c
35814 --- linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c 2011-05-19 00:06:34.000000000 -0400
35815 +++ linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c 2011-05-22 19:36:31.000000000 -0400
35816 @@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
35817 unsigned int v;
35818 u64 tsf;
35819
35820 + pax_track_stack();
35821 +
35822 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
35823 len += snprintf(buf+len, sizeof(buf)-len,
35824 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
35825 @@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi
35826 unsigned int len = 0;
35827 unsigned int i;
35828
35829 + pax_track_stack();
35830 +
35831 len += snprintf(buf+len, sizeof(buf)-len,
35832 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
35833
35834 @@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct
35835 unsigned int i;
35836 unsigned int v;
35837
35838 + pax_track_stack();
35839 +
35840 len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
35841 sc->ah->ah_ant_mode);
35842 len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
35843 @@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil
35844 unsigned int len = 0;
35845 u32 filt = ath5k_hw_get_rx_filter(sc->ah);
35846
35847 + pax_track_stack();
35848 +
35849 len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
35850 sc->bssidmask);
35851 len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
35852 @@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str
35853 unsigned int len = 0;
35854 int i;
35855
35856 + pax_track_stack();
35857 +
35858 len += snprintf(buf+len, sizeof(buf)-len,
35859 "RX\n---------------------\n");
35860 len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
35861 @@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file
35862 char buf[700];
35863 unsigned int len = 0;
35864
35865 + pax_track_stack();
35866 +
35867 len += snprintf(buf+len, sizeof(buf)-len,
35868 "HW has PHY error counters:\t%s\n",
35869 sc->ah->ah_capabilities.cap_has_phyerr_counters ?
35870 @@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi
35871 struct ath5k_buf *bf, *bf0;
35872 int i, n;
35873
35874 + pax_track_stack();
35875 +
35876 len += snprintf(buf+len, sizeof(buf)-len,
35877 "available txbuffers: %d\n", sc->txbuf_len);
35878
35879 diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c
35880 --- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-19 00:06:34.000000000 -0400
35881 +++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-22 19:36:31.000000000 -0400
35882 @@ -734,6 +734,8 @@ static void ar9003_hw_tx_iq_cal(struct a
35883 s32 i, j, ip, im, nmeasurement;
35884 u8 nchains = get_streams(common->tx_chainmask);
35885
35886 + pax_track_stack();
35887 +
35888 for (ip = 0; ip < MPASS; ip++) {
35889 REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
35890 AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
35891 @@ -856,6 +858,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
35892 int i, ip, im, j;
35893 int nmeasurement;
35894
35895 + pax_track_stack();
35896 +
35897 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
35898 if (ah->txchainmask & (1 << i))
35899 num_chains++;
35900 diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
35901 --- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-19 00:06:34.000000000 -0400
35902 +++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-22 19:36:31.000000000 -0400
35903 @@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
35904 int theta_low_bin = 0;
35905 int i;
35906
35907 + pax_track_stack();
35908 +
35909 /* disregard any bin that contains <= 16 samples */
35910 thresh_accum_cnt = 16;
35911 scale_factor = 5;
35912 diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c
35913 --- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c 2011-05-19 00:06:34.000000000 -0400
35914 +++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c 2011-05-22 19:36:31.000000000 -0400
35915 @@ -335,6 +335,8 @@ static ssize_t read_file_interrupt(struc
35916 char buf[512];
35917 unsigned int len = 0;
35918
35919 + pax_track_stack();
35920 +
35921 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
35922 len += snprintf(buf + len, sizeof(buf) - len,
35923 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
35924 @@ -422,6 +424,8 @@ static ssize_t read_file_wiphy(struct fi
35925 u8 addr[ETH_ALEN];
35926 u32 tmp;
35927
35928 + pax_track_stack();
35929 +
35930 len += snprintf(buf + len, sizeof(buf) - len,
35931 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
35932 wiphy_name(sc->hw->wiphy),
35933 diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c
35934 --- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-19 00:06:34.000000000 -0400
35935 +++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-22 19:36:31.000000000 -0400
35936 @@ -737,6 +737,8 @@ static ssize_t read_file_tgt_stats(struc
35937 unsigned int len = 0;
35938 int ret = 0;
35939
35940 + pax_track_stack();
35941 +
35942 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
35943
35944 WMI_CMD(WMI_TGT_STATS_CMDID);
35945 @@ -782,6 +784,8 @@ static ssize_t read_file_xmit(struct fil
35946 char buf[512];
35947 unsigned int len = 0;
35948
35949 + pax_track_stack();
35950 +
35951 len += snprintf(buf + len, sizeof(buf) - len,
35952 "%20s : %10u\n", "Buffers queued",
35953 priv->debug.tx_stats.buf_queued);
35954 @@ -831,6 +835,8 @@ static ssize_t read_file_recv(struct fil
35955 char buf[512];
35956 unsigned int len = 0;
35957
35958 + pax_track_stack();
35959 +
35960 len += snprintf(buf + len, sizeof(buf) - len,
35961 "%20s : %10u\n", "SKBs allocated",
35962 priv->debug.rx_stats.skb_allocated);
35963 @@ -1816,7 +1822,7 @@ static void ath9k_htc_set_coverage_class
35964 mutex_unlock(&priv->mutex);
35965 }
35966
35967 -struct ieee80211_ops ath9k_htc_ops = {
35968 +const struct ieee80211_ops ath9k_htc_ops = {
35969 .tx = ath9k_htc_tx,
35970 .start = ath9k_htc_start,
35971 .stop = ath9k_htc_stop,
35972 diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h
35973 --- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h 2011-05-19 00:06:34.000000000 -0400
35974 +++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h 2011-05-22 19:36:31.000000000 -0400
35975 @@ -42,7 +42,7 @@
35976 #define TSF_TO_TU(_h, _l) \
35977 ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
35978
35979 -extern struct ieee80211_ops ath9k_htc_ops;
35980 +extern const struct ieee80211_ops ath9k_htc_ops;
35981 extern int htc_modparam_nohwcrypt;
35982
35983 enum htc_phymode {
35984 diff -urNp linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c
35985 --- linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35986 +++ linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c 2011-05-22 19:36:31.000000000 -0400
35987 @@ -43,7 +43,7 @@ static struct dentry *rootdir;
35988 struct b43_debugfs_fops {
35989 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
35990 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
35991 - struct file_operations fops;
35992 + const struct file_operations fops;
35993 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
35994 size_t file_struct_offset;
35995 };
35996 diff -urNp linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c
35997 --- linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35998 +++ linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c 2011-05-22 19:36:31.000000000 -0400
35999 @@ -44,7 +44,7 @@ static struct dentry *rootdir;
36000 struct b43legacy_debugfs_fops {
36001 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
36002 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
36003 - struct file_operations fops;
36004 + const struct file_operations fops;
36005 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
36006 size_t file_struct_offset;
36007 /* Take wl->irq_lock before calling read/write? */
36008 diff -urNp linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c
36009 --- linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-19 00:06:34.000000000 -0400
36010 +++ linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-22 19:36:31.000000000 -0400
36011 @@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2
36012 int err;
36013 DECLARE_SSID_BUF(ssid);
36014
36015 + pax_track_stack();
36016 +
36017 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
36018
36019 if (ssid_len)
36020 @@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210
36021 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
36022 int err;
36023
36024 + pax_track_stack();
36025 +
36026 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
36027 idx, keylen, len);
36028
36029 diff -urNp linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c
36030 --- linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-19 00:06:34.000000000 -0400
36031 +++ linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-22 19:36:31.000000000 -0400
36032 @@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
36033 unsigned long flags;
36034 DECLARE_SSID_BUF(ssid);
36035
36036 + pax_track_stack();
36037 +
36038 LIBIPW_DEBUG_SCAN("'%s' (%pM"
36039 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
36040 print_ssid(ssid, info_element->data, info_element->len),
36041 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c
36042 --- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-19 00:06:34.000000000 -0400
36043 +++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-22 19:36:31.000000000 -0400
36044 @@ -2630,7 +2630,7 @@ static int iwl3945_load_bsm(struct iwl_p
36045 return 0;
36046 }
36047
36048 -static struct iwl_hcmd_ops iwl3945_hcmd = {
36049 +static const struct iwl_hcmd_ops iwl3945_hcmd = {
36050 .rxon_assoc = iwl3945_send_rxon_assoc,
36051 .commit_rxon = iwl3945_commit_rxon,
36052 };
36053 @@ -2675,7 +2675,7 @@ static const struct iwl_legacy_ops iwl39
36054 .manage_ibss_station = iwl3945_manage_ibss_station,
36055 };
36056
36057 -static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
36058 +static const struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
36059 .get_hcmd_size = iwl3945_get_hcmd_size,
36060 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
36061 .request_scan = iwl3945_request_scan,
36062 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c
36063 --- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-19 00:06:34.000000000 -0400
36064 +++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-22 19:36:32.000000000 -0400
36065 @@ -1904,7 +1904,7 @@ static void iwl4965_rx_handler_setup(str
36066 priv->rx_handlers[BEACON_NOTIFICATION] = iwl4965_rx_beacon_notif;
36067 }
36068
36069 -static struct iwl_hcmd_ops iwl4965_hcmd = {
36070 +static const struct iwl_hcmd_ops iwl4965_hcmd = {
36071 .rxon_assoc = iwl4965_send_rxon_assoc,
36072 .commit_rxon = iwl4965_commit_rxon,
36073 .set_rxon_chain = iwl4965_set_rxon_chain,
36074 @@ -2056,7 +2056,7 @@ static void iwl4965_config_ap(struct iwl
36075 iwl4965_send_beacon_cmd(priv);
36076 }
36077
36078 -static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
36079 +static const struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
36080 .get_hcmd_size = iwl4965_get_hcmd_size,
36081 .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
36082 .request_scan = iwl4965_request_scan,
36083 @@ -2114,7 +2114,7 @@ static const struct iwl_legacy_ops iwl49
36084 .update_bcast_stations = iwl4965_update_bcast_stations,
36085 };
36086
36087 -struct ieee80211_ops iwl4965_hw_ops = {
36088 +const struct ieee80211_ops iwl4965_hw_ops = {
36089 .tx = iwl4965_mac_tx,
36090 .start = iwl4965_mac_start,
36091 .stop = iwl4965_mac_stop,
36092 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h
36093 --- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-19 00:06:34.000000000 -0400
36094 +++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-22 19:36:32.000000000 -0400
36095 @@ -70,7 +70,7 @@ extern struct iwl_cfg iwl4965_cfg;
36096
36097 extern struct iwl_mod_params iwl4965_mod_params;
36098
36099 -extern struct ieee80211_ops iwl4965_hw_ops;
36100 +extern const struct ieee80211_ops iwl4965_hw_ops;
36101
36102 /* tx queue */
36103 void iwl4965_free_tfds_in_queue(struct iwl_priv *priv,
36104 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h
36105 --- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36106 +++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36107 @@ -150,7 +150,7 @@ struct iwl_lib_ops {
36108 int (*set_channel_switch)(struct iwl_priv *priv,
36109 struct ieee80211_channel_switch *ch_switch);
36110 /* power management */
36111 - struct iwl_apm_ops apm_ops;
36112 + const struct iwl_apm_ops apm_ops;
36113
36114 /* power */
36115 int (*send_tx_power) (struct iwl_priv *priv);
36116 @@ -160,12 +160,12 @@ struct iwl_lib_ops {
36117 struct iwl_eeprom_ops eeprom_ops;
36118
36119 /* temperature */
36120 - struct iwl_temp_ops temp_ops;
36121 + const struct iwl_temp_ops temp_ops;
36122 /* check for plcp health */
36123 bool (*check_plcp_health)(struct iwl_priv *priv,
36124 struct iwl_rx_packet *pkt);
36125
36126 - struct iwl_debugfs_ops debugfs_ops;
36127 + const struct iwl_debugfs_ops debugfs_ops;
36128
36129 };
36130
36131 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c
36132 --- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-19 00:06:34.000000000 -0400
36133 +++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-22 19:36:32.000000000 -0400
36134 @@ -422,11 +422,11 @@ static struct iwl_lib_ops iwl6030_lib =
36135 }
36136 };
36137
36138 -static struct iwl_nic_ops iwl6050_nic_ops = {
36139 +static const struct iwl_nic_ops iwl6050_nic_ops = {
36140 .additional_nic_config = &iwl6050_additional_nic_config,
36141 };
36142
36143 -static struct iwl_nic_ops iwl6150_nic_ops = {
36144 +static const struct iwl_nic_ops iwl6150_nic_ops = {
36145 .additional_nic_config = &iwl6150_additional_nic_config,
36146 };
36147
36148 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h
36149 --- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-19 00:06:34.000000000 -0400
36150 +++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-22 19:36:32.000000000 -0400
36151 @@ -109,9 +109,9 @@ extern struct iwl_cfg iwl230_bg_cfg;
36152 extern struct iwl_cfg iwl230_bgn_cfg;
36153
36154 extern struct iwl_mod_params iwlagn_mod_params;
36155 -extern struct iwl_hcmd_ops iwlagn_hcmd;
36156 -extern struct iwl_hcmd_ops iwlagn_bt_hcmd;
36157 -extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36158 +extern const struct iwl_hcmd_ops iwlagn_hcmd;
36159 +extern const struct iwl_hcmd_ops iwlagn_bt_hcmd;
36160 +extern const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36161
36162 extern struct ieee80211_ops iwlagn_hw_ops;
36163 extern struct ieee80211_ops iwl4965_hw_ops;
36164 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
36165 --- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-19 00:06:34.000000000 -0400
36166 +++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-22 19:36:32.000000000 -0400
36167 @@ -363,7 +363,7 @@ static int iwlagn_set_pan_params(struct
36168 return ret;
36169 }
36170
36171 -struct iwl_hcmd_ops iwlagn_hcmd = {
36172 +const struct iwl_hcmd_ops iwlagn_hcmd = {
36173 .rxon_assoc = iwlagn_send_rxon_assoc,
36174 .commit_rxon = iwlagn_commit_rxon,
36175 .set_rxon_chain = iwlagn_set_rxon_chain,
36176 @@ -372,7 +372,7 @@ struct iwl_hcmd_ops iwlagn_hcmd = {
36177 .set_pan_params = iwlagn_set_pan_params,
36178 };
36179
36180 -struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36181 +const struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36182 .rxon_assoc = iwlagn_send_rxon_assoc,
36183 .commit_rxon = iwlagn_commit_rxon,
36184 .set_rxon_chain = iwlagn_set_rxon_chain,
36185 @@ -381,7 +381,7 @@ struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36186 .set_pan_params = iwlagn_set_pan_params,
36187 };
36188
36189 -struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36190 +const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36191 .get_hcmd_size = iwlagn_get_hcmd_size,
36192 .build_addsta_hcmd = iwlagn_build_addsta_hcmd,
36193 .gain_computation = iwlagn_gain_computation,
36194 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
36195 --- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-19 00:06:34.000000000 -0400
36196 +++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-22 19:36:32.000000000 -0400
36197 @@ -883,6 +883,8 @@ static void rs_tx_status(void *priv_r, s
36198 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
36199 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
36200
36201 + pax_track_stack();
36202 +
36203 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
36204
36205 /* Treat uninitialized rate scaling data same as non-existing. */
36206 @@ -2894,6 +2896,8 @@ static void rs_fill_link_cmd(struct iwl_
36207 container_of(lq_sta, struct iwl_station_priv, lq_sta);
36208 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
36209
36210 + pax_track_stack();
36211 +
36212 /* Override starting rate (index 0) if needed for debug purposes */
36213 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
36214
36215 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h
36216 --- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36217 +++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36218 @@ -198,28 +198,25 @@ struct iwl_lib_ops {
36219 int (*set_channel_switch)(struct iwl_priv *priv,
36220 struct ieee80211_channel_switch *ch_switch);
36221 /* power management */
36222 - struct iwl_apm_ops apm_ops;
36223 + const struct iwl_apm_ops apm_ops;
36224
36225 /* power */
36226 int (*send_tx_power) (struct iwl_priv *priv);
36227 void (*update_chain_flags)(struct iwl_priv *priv);
36228
36229 /* isr */
36230 - struct iwl_isr_ops isr_ops;
36231 + const struct iwl_isr_ops isr_ops;
36232
36233 /* eeprom operations (as defined in iwl-eeprom.h) */
36234 struct iwl_eeprom_ops eeprom_ops;
36235
36236 /* temperature */
36237 - struct iwl_temp_ops temp_ops;
36238 + const struct iwl_temp_ops temp_ops;
36239
36240 int (*txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36241 void (*dev_txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36242
36243 - struct iwl_debugfs_ops debugfs_ops;
36244 -
36245 - /* thermal throttling */
36246 - struct iwl_tt_ops tt_ops;
36247 + const struct iwl_debugfs_ops debugfs_ops;const struct iwl_tt_ops tt_ops;
36248 };
36249
36250 struct iwl_led_ops {
36251 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c
36252 --- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-19 00:06:34.000000000 -0400
36253 +++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-22 19:36:32.000000000 -0400
36254 @@ -549,6 +549,8 @@ static ssize_t iwl_dbgfs_status_read(str
36255 int pos = 0;
36256 const size_t bufsz = sizeof(buf);
36257
36258 + pax_track_stack();
36259 +
36260 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
36261 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
36262 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
36263 @@ -681,6 +683,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
36264 char buf[256 * NUM_IWL_RXON_CTX];
36265 const size_t bufsz = sizeof(buf);
36266
36267 + pax_track_stack();
36268 +
36269 for_each_context(priv, ctx) {
36270 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
36271 ctx->ctxid);
36272 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h
36273 --- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-19 00:06:34.000000000 -0400
36274 +++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-22 19:36:32.000000000 -0400
36275 @@ -68,8 +68,8 @@ do {
36276 } while (0)
36277
36278 #else
36279 -#define IWL_DEBUG(__priv, level, fmt, args...)
36280 -#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
36281 +#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
36282 +#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
36283 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
36284 const void *p, u32 len)
36285 {}
36286 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c
36287 --- linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
36288 +++ linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
36289 @@ -763,7 +763,7 @@ static int iwm_cfg80211_flush_pmksa(stru
36290 }
36291
36292
36293 -static struct cfg80211_ops iwm_cfg80211_ops = {
36294 +static const struct cfg80211_ops iwm_cfg80211_ops = {
36295 .change_virtual_intf = iwm_cfg80211_change_iface,
36296 .add_key = iwm_cfg80211_add_key,
36297 .get_key = iwm_cfg80211_get_key,
36298 diff -urNp linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c
36299 --- linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36300 +++ linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36301 @@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
36302 int buf_len = 512;
36303 size_t len = 0;
36304
36305 + pax_track_stack();
36306 +
36307 if (*ppos != 0)
36308 return 0;
36309 if (count < sizeof(buf))
36310 diff -urNp linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c
36311 --- linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c 2011-05-19 00:06:34.000000000 -0400
36312 +++ linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c 2011-05-22 19:36:32.000000000 -0400
36313 @@ -2003,7 +2003,7 @@ static int lbs_leave_ibss(struct wiphy *
36314 * Initialization
36315 */
36316
36317 -static struct cfg80211_ops lbs_cfg80211_ops = {
36318 +static const struct cfg80211_ops lbs_cfg80211_ops = {
36319 .set_channel = lbs_cfg_set_channel,
36320 .scan = lbs_cfg_scan,
36321 .connect = lbs_cfg_connect,
36322 diff -urNp linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c
36323 --- linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36324 +++ linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36325 @@ -702,7 +702,7 @@ out_unlock:
36326 struct lbs_debugfs_files {
36327 const char *name;
36328 int perm;
36329 - struct file_operations fops;
36330 + const struct file_operations fops;
36331 };
36332
36333 static const struct lbs_debugfs_files debugfs_files[] = {
36334 diff -urNp linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c
36335 --- linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c 2011-05-19 00:06:34.000000000 -0400
36336 +++ linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c 2011-05-22 19:36:32.000000000 -0400
36337 @@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
36338
36339 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
36340
36341 - if (rts_threshold < 0 || rts_threshold > 2347)
36342 + if (rts_threshold > 2347)
36343 rts_threshold = 2347;
36344
36345 tmp = cpu_to_le32(rts_threshold);
36346 diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c
36347 --- linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c 2011-05-19 00:06:34.000000000 -0400
36348 +++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c 2011-05-22 19:36:32.000000000 -0400
36349 @@ -1869,7 +1869,7 @@ int rtl_pci_resume(struct pci_dev *pdev)
36350 }
36351 EXPORT_SYMBOL(rtl_pci_resume);
36352
36353 -struct rtl_intf_ops rtl_pci_ops = {
36354 +const struct rtl_intf_ops rtl_pci_ops = {
36355 .adapter_start = rtl_pci_start,
36356 .adapter_stop = rtl_pci_stop,
36357 .adapter_tx = rtl_pci_tx,
36358 diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h
36359 --- linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h 2011-05-19 00:06:34.000000000 -0400
36360 +++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h 2011-05-22 19:36:32.000000000 -0400
36361 @@ -234,7 +234,7 @@ struct rtl_pci_priv {
36362
36363 int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw);
36364
36365 -extern struct rtl_intf_ops rtl_pci_ops;
36366 +extern const struct rtl_intf_ops rtl_pci_ops;
36367
36368 int __devinit rtl_pci_probe(struct pci_dev *pdev,
36369 const struct pci_device_id *id);
36370 diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
36371 --- linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-19 00:06:34.000000000 -0400
36372 +++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-22 19:36:32.000000000 -0400
36373 @@ -827,6 +827,8 @@ static bool _rtl92c_phy_sw_chnl_step_by_
36374 u8 rfpath;
36375 u8 num_total_rfpath = rtlphy->num_total_rfpath;
36376
36377 + pax_track_stack();
36378 +
36379 precommoncmdcnt = 0;
36380 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
36381 MAX_PRECMD_CNT,
36382 diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
36383 --- linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-19 00:06:34.000000000 -0400
36384 +++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-22 19:36:32.000000000 -0400
36385 @@ -96,7 +96,7 @@ void rtl92c_deinit_sw_vars(struct ieee80
36386 }
36387 }
36388
36389 -static struct rtl_hal_ops rtl8192ce_hal_ops = {
36390 +static const struct rtl_hal_ops rtl8192ce_hal_ops = {
36391 .init_sw_vars = rtl92c_init_sw_vars,
36392 .deinit_sw_vars = rtl92c_deinit_sw_vars,
36393 .read_eeprom_info = rtl92ce_read_eeprom_info,
36394 @@ -151,7 +151,7 @@ static struct rtl_mod_params rtl92ce_mod
36395 .sw_crypto = 0,
36396 };
36397
36398 -static struct rtl_hal_cfg rtl92ce_hal_cfg = {
36399 +static const struct rtl_hal_cfg rtl92ce_hal_cfg = {
36400 .name = "rtl92c_pci",
36401 .fw_name = "rtlwifi/rtl8192cfw.bin",
36402 .ops = &rtl8192ce_hal_ops,
36403 diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
36404 --- linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-19 00:06:34.000000000 -0400
36405 +++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-22 19:36:32.000000000 -0400
36406 @@ -77,7 +77,7 @@ static void rtl92cu_deinit_sw_vars(struc
36407 }
36408 }
36409
36410 -static struct rtl_hal_ops rtl8192cu_hal_ops = {
36411 +static const struct rtl_hal_ops rtl8192cu_hal_ops = {
36412 .init_sw_vars = rtl92cu_init_sw_vars,
36413 .deinit_sw_vars = rtl92cu_deinit_sw_vars,
36414 .read_chip_version = rtl92c_read_chip_version,
36415 @@ -147,7 +147,7 @@ static struct rtl_hal_usbint_cfg rtl92cu
36416 .usb_mq_to_hwq = rtl8192cu_mq_to_hwq,
36417 };
36418
36419 -static struct rtl_hal_cfg rtl92cu_hal_cfg = {
36420 +static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
36421 .name = "rtl92c_usb",
36422 .fw_name = "rtlwifi/rtl8192cufw.bin",
36423 .ops = &rtl8192cu_hal_ops,
36424 diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c
36425 --- linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c 2011-05-19 00:06:34.000000000 -0400
36426 +++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c 2011-05-22 19:36:32.000000000 -0400
36427 @@ -913,7 +913,7 @@ static bool rtl_usb_tx_chk_waitq_insert(
36428 return false;
36429 }
36430
36431 -static struct rtl_intf_ops rtl_usb_ops = {
36432 +static const struct rtl_intf_ops rtl_usb_ops = {
36433 .adapter_start = rtl_usb_start,
36434 .adapter_stop = rtl_usb_stop,
36435 .adapter_tx = rtl_usb_tx,
36436 diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h
36437 --- linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h 2011-05-19 00:06:34.000000000 -0400
36438 +++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h 2011-05-22 19:36:32.000000000 -0400
36439 @@ -1447,7 +1447,7 @@ struct rtl_hal_cfg {
36440 u8 bar_id;
36441 char *name;
36442 char *fw_name;
36443 - struct rtl_hal_ops *ops;
36444 + const struct rtl_hal_ops *ops;
36445 struct rtl_mod_params *mod_params;
36446 struct rtl_hal_usbint_cfg *usb_interface_cfg;
36447
36448 @@ -1533,7 +1533,7 @@ struct rtl_priv {
36449 *intf_ops : for diff interrface usb/pcie
36450 */
36451 struct rtl_hal_cfg *cfg;
36452 - struct rtl_intf_ops *intf_ops;
36453 + const struct rtl_intf_ops *intf_ops;
36454
36455 /*this var will be set by set_bit,
36456 and was used to indicate status of
36457 diff -urNp linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c
36458 --- linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c 2011-05-19 00:06:34.000000000 -0400
36459 +++ linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c 2011-05-22 19:36:32.000000000 -0400
36460 @@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct
36461 u32 chunk_len;
36462 int i;
36463
36464 + pax_track_stack();
36465 +
36466 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
36467
36468 spi_message_init(&m);
36469 diff -urNp linux-2.6.39.1/drivers/net/xen-netback/interface.c linux-2.6.39.1/drivers/net/xen-netback/interface.c
36470 --- linux-2.6.39.1/drivers/net/xen-netback/interface.c 2011-05-19 00:06:34.000000000 -0400
36471 +++ linux-2.6.39.1/drivers/net/xen-netback/interface.c 2011-05-22 19:36:32.000000000 -0400
36472 @@ -273,7 +273,7 @@ static void xenvif_get_strings(struct ne
36473 }
36474 }
36475
36476 -static struct ethtool_ops xenvif_ethtool_ops = {
36477 +static const struct ethtool_ops xenvif_ethtool_ops = {
36478 .get_tx_csum = ethtool_op_get_tx_csum,
36479 .set_tx_csum = xenvif_set_tx_csum,
36480 .get_sg = ethtool_op_get_sg,
36481 diff -urNp linux-2.6.39.1/drivers/net/xilinx_emaclite.c linux-2.6.39.1/drivers/net/xilinx_emaclite.c
36482 --- linux-2.6.39.1/drivers/net/xilinx_emaclite.c 2011-05-19 00:06:34.000000000 -0400
36483 +++ linux-2.6.39.1/drivers/net/xilinx_emaclite.c 2011-05-22 19:36:32.000000000 -0400
36484 @@ -1085,7 +1085,7 @@ static bool get_bool(struct platform_dev
36485 }
36486 }
36487
36488 -static struct net_device_ops xemaclite_netdev_ops;
36489 +static const struct net_device_ops xemaclite_netdev_ops;
36490
36491 /**
36492 * xemaclite_of_probe - Probe method for the Emaclite device.
36493 @@ -1264,7 +1264,7 @@ xemaclite_poll_controller(struct net_dev
36494 }
36495 #endif
36496
36497 -static struct net_device_ops xemaclite_netdev_ops = {
36498 +static const struct net_device_ops xemaclite_netdev_ops = {
36499 .ndo_open = xemaclite_open,
36500 .ndo_stop = xemaclite_close,
36501 .ndo_start_xmit = xemaclite_send,
36502 diff -urNp linux-2.6.39.1/drivers/nfc/pn544.c linux-2.6.39.1/drivers/nfc/pn544.c
36503 --- linux-2.6.39.1/drivers/nfc/pn544.c 2011-05-19 00:06:34.000000000 -0400
36504 +++ linux-2.6.39.1/drivers/nfc/pn544.c 2011-05-22 19:36:32.000000000 -0400
36505 @@ -89,7 +89,7 @@ static ssize_t pn544_test(struct device
36506
36507 static int pn544_enable(struct pn544_info *info, int mode)
36508 {
36509 - struct pn544_nfc_platform_data *pdata;
36510 + const struct pn544_nfc_platform_data *pdata;
36511 struct i2c_client *client = info->i2c_dev;
36512
36513 int r;
36514 @@ -118,7 +118,7 @@ static int pn544_enable(struct pn544_inf
36515
36516 static void pn544_disable(struct pn544_info *info)
36517 {
36518 - struct pn544_nfc_platform_data *pdata;
36519 + const struct pn544_nfc_platform_data *pdata;
36520 struct i2c_client *client = info->i2c_dev;
36521
36522 pdata = client->dev.platform_data;
36523 @@ -509,7 +509,7 @@ static long pn544_ioctl(struct file *fil
36524 struct pn544_info *info = container_of(file->private_data,
36525 struct pn544_info, miscdev);
36526 struct i2c_client *client = info->i2c_dev;
36527 - struct pn544_nfc_platform_data *pdata;
36528 + const struct pn544_nfc_platform_data *pdata;
36529 unsigned int val;
36530 int r = 0;
36531
36532 @@ -715,7 +715,7 @@ static int __devinit pn544_probe(struct
36533 const struct i2c_device_id *id)
36534 {
36535 struct pn544_info *info;
36536 - struct pn544_nfc_platform_data *pdata;
36537 + const struct pn544_nfc_platform_data *pdata;
36538 int r = 0;
36539
36540 dev_dbg(&client->dev, "%s\n", __func__);
36541 diff -urNp linux-2.6.39.1/drivers/of/pdt.c linux-2.6.39.1/drivers/of/pdt.c
36542 --- linux-2.6.39.1/drivers/of/pdt.c 2011-05-19 00:06:34.000000000 -0400
36543 +++ linux-2.6.39.1/drivers/of/pdt.c 2011-05-22 19:36:32.000000000 -0400
36544 @@ -24,7 +24,7 @@
36545 #include <linux/of_pdt.h>
36546 #include <asm/prom.h>
36547
36548 -static struct of_pdt_ops *of_pdt_prom_ops __initdata;
36549 +static const struct of_pdt_ops *of_pdt_prom_ops;
36550
36551 void __initdata (*of_pdt_build_more)(struct device_node *dp,
36552 struct device_node ***nextp);
36553 diff -urNp linux-2.6.39.1/drivers/oprofile/buffer_sync.c linux-2.6.39.1/drivers/oprofile/buffer_sync.c
36554 --- linux-2.6.39.1/drivers/oprofile/buffer_sync.c 2011-05-19 00:06:34.000000000 -0400
36555 +++ linux-2.6.39.1/drivers/oprofile/buffer_sync.c 2011-05-22 19:36:32.000000000 -0400
36556 @@ -342,7 +342,7 @@ static void add_data(struct op_entry *en
36557 if (cookie == NO_COOKIE)
36558 offset = pc;
36559 if (cookie == INVALID_COOKIE) {
36560 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36561 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36562 offset = pc;
36563 }
36564 if (cookie != last_cookie) {
36565 @@ -386,14 +386,14 @@ add_sample(struct mm_struct *mm, struct
36566 /* add userspace sample */
36567
36568 if (!mm) {
36569 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
36570 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
36571 return 0;
36572 }
36573
36574 cookie = lookup_dcookie(mm, s->eip, &offset);
36575
36576 if (cookie == INVALID_COOKIE) {
36577 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36578 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36579 return 0;
36580 }
36581
36582 @@ -562,7 +562,7 @@ void sync_buffer(int cpu)
36583 /* ignore backtraces if failed to add a sample */
36584 if (state == sb_bt_start) {
36585 state = sb_bt_ignore;
36586 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
36587 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
36588 }
36589 }
36590 release_mm(mm);
36591 diff -urNp linux-2.6.39.1/drivers/oprofile/event_buffer.c linux-2.6.39.1/drivers/oprofile/event_buffer.c
36592 --- linux-2.6.39.1/drivers/oprofile/event_buffer.c 2011-05-19 00:06:34.000000000 -0400
36593 +++ linux-2.6.39.1/drivers/oprofile/event_buffer.c 2011-05-22 19:36:32.000000000 -0400
36594 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
36595 }
36596
36597 if (buffer_pos == buffer_size) {
36598 - atomic_inc(&oprofile_stats.event_lost_overflow);
36599 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
36600 return;
36601 }
36602
36603 diff -urNp linux-2.6.39.1/drivers/oprofile/oprof.c linux-2.6.39.1/drivers/oprofile/oprof.c
36604 --- linux-2.6.39.1/drivers/oprofile/oprof.c 2011-05-19 00:06:34.000000000 -0400
36605 +++ linux-2.6.39.1/drivers/oprofile/oprof.c 2011-05-22 19:36:32.000000000 -0400
36606 @@ -110,7 +110,7 @@ static void switch_worker(struct work_st
36607 if (oprofile_ops.switch_events())
36608 return;
36609
36610 - atomic_inc(&oprofile_stats.multiplex_counter);
36611 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
36612 start_switch_worker();
36613 }
36614
36615 diff -urNp linux-2.6.39.1/drivers/oprofile/oprofilefs.c linux-2.6.39.1/drivers/oprofile/oprofilefs.c
36616 --- linux-2.6.39.1/drivers/oprofile/oprofilefs.c 2011-05-19 00:06:34.000000000 -0400
36617 +++ linux-2.6.39.1/drivers/oprofile/oprofilefs.c 2011-05-22 19:36:32.000000000 -0400
36618 @@ -186,7 +186,7 @@ static const struct file_operations atom
36619
36620
36621 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
36622 - char const *name, atomic_t *val)
36623 + char const *name, atomic_unchecked_t *val)
36624 {
36625 return __oprofilefs_create_file(sb, root, name,
36626 &atomic_ro_fops, 0444, val);
36627 diff -urNp linux-2.6.39.1/drivers/oprofile/oprofile_stats.c linux-2.6.39.1/drivers/oprofile/oprofile_stats.c
36628 --- linux-2.6.39.1/drivers/oprofile/oprofile_stats.c 2011-05-19 00:06:34.000000000 -0400
36629 +++ linux-2.6.39.1/drivers/oprofile/oprofile_stats.c 2011-05-22 19:36:32.000000000 -0400
36630 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
36631 cpu_buf->sample_invalid_eip = 0;
36632 }
36633
36634 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
36635 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
36636 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
36637 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
36638 - atomic_set(&oprofile_stats.multiplex_counter, 0);
36639 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
36640 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
36641 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
36642 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
36643 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
36644 }
36645
36646
36647 diff -urNp linux-2.6.39.1/drivers/oprofile/oprofile_stats.h linux-2.6.39.1/drivers/oprofile/oprofile_stats.h
36648 --- linux-2.6.39.1/drivers/oprofile/oprofile_stats.h 2011-05-19 00:06:34.000000000 -0400
36649 +++ linux-2.6.39.1/drivers/oprofile/oprofile_stats.h 2011-05-22 19:36:32.000000000 -0400
36650 @@ -13,11 +13,11 @@
36651 #include <asm/atomic.h>
36652
36653 struct oprofile_stat_struct {
36654 - atomic_t sample_lost_no_mm;
36655 - atomic_t sample_lost_no_mapping;
36656 - atomic_t bt_lost_no_mapping;
36657 - atomic_t event_lost_overflow;
36658 - atomic_t multiplex_counter;
36659 + atomic_unchecked_t sample_lost_no_mm;
36660 + atomic_unchecked_t sample_lost_no_mapping;
36661 + atomic_unchecked_t bt_lost_no_mapping;
36662 + atomic_unchecked_t event_lost_overflow;
36663 + atomic_unchecked_t multiplex_counter;
36664 };
36665
36666 extern struct oprofile_stat_struct oprofile_stats;
36667 diff -urNp linux-2.6.39.1/drivers/parisc/dino.c linux-2.6.39.1/drivers/parisc/dino.c
36668 --- linux-2.6.39.1/drivers/parisc/dino.c 2011-05-19 00:06:34.000000000 -0400
36669 +++ linux-2.6.39.1/drivers/parisc/dino.c 2011-05-22 19:36:32.000000000 -0400
36670 @@ -238,7 +238,7 @@ static int dino_cfg_write(struct pci_bus
36671 return 0;
36672 }
36673
36674 -static struct pci_ops dino_cfg_ops = {
36675 +static const struct pci_ops dino_cfg_ops = {
36676 .read = dino_cfg_read,
36677 .write = dino_cfg_write,
36678 };
36679 diff -urNp linux-2.6.39.1/drivers/parisc/lba_pci.c linux-2.6.39.1/drivers/parisc/lba_pci.c
36680 --- linux-2.6.39.1/drivers/parisc/lba_pci.c 2011-05-19 00:06:34.000000000 -0400
36681 +++ linux-2.6.39.1/drivers/parisc/lba_pci.c 2011-05-22 19:36:32.000000000 -0400
36682 @@ -468,7 +468,7 @@ static int elroy_cfg_write(struct pci_bu
36683 }
36684
36685
36686 -static struct pci_ops elroy_cfg_ops = {
36687 +static const struct pci_ops elroy_cfg_ops = {
36688 .read = elroy_cfg_read,
36689 .write = elroy_cfg_write,
36690 };
36691 @@ -541,7 +541,7 @@ static int mercury_cfg_write(struct pci_
36692 return 0;
36693 }
36694
36695 -static struct pci_ops mercury_cfg_ops = {
36696 +static const struct pci_ops mercury_cfg_ops = {
36697 .read = mercury_cfg_read,
36698 .write = mercury_cfg_write,
36699 };
36700 @@ -1405,7 +1405,7 @@ lba_driver_probe(struct parisc_device *d
36701 {
36702 struct lba_device *lba_dev;
36703 struct pci_bus *lba_bus;
36704 - struct pci_ops *cfg_ops;
36705 + const struct pci_ops *cfg_ops;
36706 u32 func_class;
36707 void *tmp_obj;
36708 char *version;
36709 diff -urNp linux-2.6.39.1/drivers/parport/procfs.c linux-2.6.39.1/drivers/parport/procfs.c
36710 --- linux-2.6.39.1/drivers/parport/procfs.c 2011-05-19 00:06:34.000000000 -0400
36711 +++ linux-2.6.39.1/drivers/parport/procfs.c 2011-05-22 19:36:32.000000000 -0400
36712 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
36713
36714 *ppos += len;
36715
36716 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
36717 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
36718 }
36719
36720 #ifdef CONFIG_PARPORT_1284
36721 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
36722
36723 *ppos += len;
36724
36725 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
36726 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
36727 }
36728 #endif /* IEEE1284.3 support. */
36729
36730 diff -urNp linux-2.6.39.1/drivers/pci/access.c linux-2.6.39.1/drivers/pci/access.c
36731 --- linux-2.6.39.1/drivers/pci/access.c 2011-05-19 00:06:34.000000000 -0400
36732 +++ linux-2.6.39.1/drivers/pci/access.c 2011-05-22 19:36:32.000000000 -0400
36733 @@ -74,9 +74,9 @@ EXPORT_SYMBOL(pci_bus_write_config_dword
36734 *
36735 * Return previous raw operations
36736 */
36737 -struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops)
36738 +const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops)
36739 {
36740 - struct pci_ops *old_ops;
36741 + const struct pci_ops *old_ops;
36742 unsigned long flags;
36743
36744 raw_spin_lock_irqsave(&pci_lock, flags);
36745 diff -urNp linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c
36746 --- linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c 2011-05-19 00:06:34.000000000 -0400
36747 +++ linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c 2011-05-22 19:36:32.000000000 -0400
36748 @@ -110,7 +110,7 @@ static int post_dock_fixups(struct notif
36749 }
36750
36751
36752 -static struct acpi_dock_ops acpiphp_dock_ops = {
36753 +static const struct acpi_dock_ops acpiphp_dock_ops = {
36754 .handler = handle_hotplug_event_func,
36755 };
36756
36757 diff -urNp linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c
36758 --- linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-19 00:06:34.000000000 -0400
36759 +++ linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-22 19:36:32.000000000 -0400
36760 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
36761
36762 void compaq_nvram_init (void __iomem *rom_start)
36763 {
36764 +
36765 +#ifndef CONFIG_PAX_KERNEXEC
36766 if (rom_start) {
36767 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
36768 }
36769 +#endif
36770 +
36771 dbg("int15 entry = %p\n", compaq_int15_entry_point);
36772
36773 /* initialize our int15 lock */
36774 diff -urNp linux-2.6.39.1/drivers/pci/hotplug/shpchp.h linux-2.6.39.1/drivers/pci/hotplug/shpchp.h
36775 --- linux-2.6.39.1/drivers/pci/hotplug/shpchp.h 2011-05-19 00:06:34.000000000 -0400
36776 +++ linux-2.6.39.1/drivers/pci/hotplug/shpchp.h 2011-05-22 19:36:32.000000000 -0400
36777 @@ -86,7 +86,7 @@ struct slot {
36778 u8 presence_save;
36779 u8 pwr_save;
36780 struct controller *ctrl;
36781 - struct hpc_ops *hpc_ops;
36782 + const struct hpc_ops *hpc_ops;
36783 struct hotplug_slot *hotplug_slot;
36784 struct list_head slot_list;
36785 struct delayed_work work; /* work for button event */
36786 @@ -107,7 +107,7 @@ struct controller {
36787 int slot_num_inc; /* 1 or -1 */
36788 struct pci_dev *pci_dev;
36789 struct list_head slot_list;
36790 - struct hpc_ops *hpc_ops;
36791 + const struct hpc_ops *hpc_ops;
36792 wait_queue_head_t queue; /* sleep & wake process */
36793 u8 slot_device_offset;
36794 u32 pcix_misc2_reg; /* for amd pogo errata */
36795 diff -urNp linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c
36796 --- linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c 2011-05-19 00:06:34.000000000 -0400
36797 +++ linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c 2011-05-22 19:36:32.000000000 -0400
36798 @@ -910,7 +910,7 @@ static int shpc_get_max_bus_speed(struct
36799 return retval;
36800 }
36801
36802 -static struct hpc_ops shpchp_hpc_ops = {
36803 +static const struct hpc_ops shpchp_hpc_ops = {
36804 .power_on_slot = hpc_power_on_slot,
36805 .slot_enable = hpc_slot_enable,
36806 .slot_disable = hpc_slot_disable,
36807 diff -urNp linux-2.6.39.1/drivers/pci/intel-iommu.c linux-2.6.39.1/drivers/pci/intel-iommu.c
36808 --- linux-2.6.39.1/drivers/pci/intel-iommu.c 2011-05-19 00:06:34.000000000 -0400
36809 +++ linux-2.6.39.1/drivers/pci/intel-iommu.c 2011-05-22 19:36:32.000000000 -0400
36810 @@ -391,7 +391,7 @@ static int intel_iommu_strict;
36811 static DEFINE_SPINLOCK(device_domain_lock);
36812 static LIST_HEAD(device_domain_list);
36813
36814 -static struct iommu_ops intel_iommu_ops;
36815 +static const struct iommu_ops intel_iommu_ops;
36816
36817 static int __init intel_iommu_setup(char *str)
36818 {
36819 @@ -2945,7 +2945,7 @@ static int intel_mapping_error(struct de
36820 return !dma_addr;
36821 }
36822
36823 -struct dma_map_ops intel_dma_ops = {
36824 +const struct dma_map_ops intel_dma_ops = {
36825 .alloc_coherent = intel_alloc_coherent,
36826 .free_coherent = intel_free_coherent,
36827 .map_sg = intel_map_sg,
36828 @@ -3739,7 +3739,7 @@ static int intel_iommu_domain_has_cap(st
36829 return 0;
36830 }
36831
36832 -static struct iommu_ops intel_iommu_ops = {
36833 +static const struct iommu_ops intel_iommu_ops = {
36834 .domain_init = intel_iommu_domain_init,
36835 .domain_destroy = intel_iommu_domain_destroy,
36836 .attach_dev = intel_iommu_attach_device,
36837 diff -urNp linux-2.6.39.1/drivers/pci/pci-acpi.c linux-2.6.39.1/drivers/pci/pci-acpi.c
36838 --- linux-2.6.39.1/drivers/pci/pci-acpi.c 2011-05-19 00:06:34.000000000 -0400
36839 +++ linux-2.6.39.1/drivers/pci/pci-acpi.c 2011-05-22 19:36:32.000000000 -0400
36840 @@ -332,7 +332,7 @@ static int acpi_pci_run_wake(struct pci_
36841 return 0;
36842 }
36843
36844 -static struct pci_platform_pm_ops acpi_pci_platform_pm = {
36845 +static const struct pci_platform_pm_ops acpi_pci_platform_pm = {
36846 .is_manageable = acpi_pci_power_manageable,
36847 .set_state = acpi_pci_set_power_state,
36848 .choose_state = acpi_pci_choose_state,
36849 diff -urNp linux-2.6.39.1/drivers/pci/pci.c linux-2.6.39.1/drivers/pci/pci.c
36850 --- linux-2.6.39.1/drivers/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
36851 +++ linux-2.6.39.1/drivers/pci/pci.c 2011-05-22 19:36:32.000000000 -0400
36852 @@ -480,9 +480,9 @@ pci_restore_bars(struct pci_dev *dev)
36853 pci_update_resource(dev, i);
36854 }
36855
36856 -static struct pci_platform_pm_ops *pci_platform_pm;
36857 +static const struct pci_platform_pm_ops *pci_platform_pm;
36858
36859 -int pci_set_platform_pm(struct pci_platform_pm_ops *ops)
36860 +int pci_set_platform_pm(const struct pci_platform_pm_ops *ops)
36861 {
36862 if (!ops->is_manageable || !ops->set_state || !ops->choose_state
36863 || !ops->sleep_wake || !ops->can_wakeup)
36864 diff -urNp linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c
36865 --- linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-19 00:06:34.000000000 -0400
36866 +++ linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-22 19:36:32.000000000 -0400
36867 @@ -239,7 +239,7 @@ static bool find_source_device(struct pc
36868 static int report_error_detected(struct pci_dev *dev, void *data)
36869 {
36870 pci_ers_result_t vote;
36871 - struct pci_error_handlers *err_handler;
36872 + const struct pci_error_handlers *err_handler;
36873 struct aer_broadcast_data *result_data;
36874 result_data = (struct aer_broadcast_data *) data;
36875
36876 @@ -273,7 +273,7 @@ static int report_error_detected(struct
36877 static int report_mmio_enabled(struct pci_dev *dev, void *data)
36878 {
36879 pci_ers_result_t vote;
36880 - struct pci_error_handlers *err_handler;
36881 + const struct pci_error_handlers *err_handler;
36882 struct aer_broadcast_data *result_data;
36883 result_data = (struct aer_broadcast_data *) data;
36884
36885 @@ -291,7 +291,7 @@ static int report_mmio_enabled(struct pc
36886 static int report_slot_reset(struct pci_dev *dev, void *data)
36887 {
36888 pci_ers_result_t vote;
36889 - struct pci_error_handlers *err_handler;
36890 + const struct pci_error_handlers *err_handler;
36891 struct aer_broadcast_data *result_data;
36892 result_data = (struct aer_broadcast_data *) data;
36893
36894 @@ -308,7 +308,7 @@ static int report_slot_reset(struct pci_
36895
36896 static int report_resume(struct pci_dev *dev, void *data)
36897 {
36898 - struct pci_error_handlers *err_handler;
36899 + const struct pci_error_handlers *err_handler;
36900
36901 dev->error_state = pci_channel_io_normal;
36902
36903 diff -urNp linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c
36904 --- linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c 2011-05-19 00:06:34.000000000 -0400
36905 +++ linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c 2011-05-22 19:36:32.000000000 -0400
36906 @@ -64,7 +64,7 @@ struct aer_error {
36907 struct pci_bus_ops {
36908 struct list_head list;
36909 struct pci_bus *bus;
36910 - struct pci_ops *ops;
36911 + const struct pci_ops *ops;
36912 };
36913
36914 static LIST_HEAD(einjected);
36915 @@ -110,7 +110,7 @@ static struct aer_error *__find_aer_erro
36916 }
36917
36918 /* inject_lock must be held before calling */
36919 -static struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36920 +static const struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36921 {
36922 struct pci_bus_ops *bus_ops;
36923
36924 @@ -187,7 +187,7 @@ static int pci_read_aer(struct pci_bus *
36925 u32 *sim;
36926 struct aer_error *err;
36927 unsigned long flags;
36928 - struct pci_ops *ops;
36929 + const struct pci_ops *ops;
36930 int domain;
36931
36932 spin_lock_irqsave(&inject_lock, flags);
36933 @@ -219,7 +219,7 @@ int pci_write_aer(struct pci_bus *bus, u
36934 struct aer_error *err;
36935 unsigned long flags;
36936 int rw1cs;
36937 - struct pci_ops *ops;
36938 + const struct pci_ops *ops;
36939 int domain;
36940
36941 spin_lock_irqsave(&inject_lock, flags);
36942 @@ -254,7 +254,7 @@ static struct pci_ops pci_ops_aer = {
36943
36944 static void pci_bus_ops_init(struct pci_bus_ops *bus_ops,
36945 struct pci_bus *bus,
36946 - struct pci_ops *ops)
36947 + const struct pci_ops *ops)
36948 {
36949 INIT_LIST_HEAD(&bus_ops->list);
36950 bus_ops->bus = bus;
36951 @@ -263,7 +263,7 @@ static void pci_bus_ops_init(struct pci_
36952
36953 static int pci_bus_set_aer_ops(struct pci_bus *bus)
36954 {
36955 - struct pci_ops *ops;
36956 + const struct pci_ops *ops;
36957 struct pci_bus_ops *bus_ops;
36958 unsigned long flags;
36959
36960 diff -urNp linux-2.6.39.1/drivers/pci/pcie/aspm.c linux-2.6.39.1/drivers/pci/pcie/aspm.c
36961 --- linux-2.6.39.1/drivers/pci/pcie/aspm.c 2011-05-19 00:06:34.000000000 -0400
36962 +++ linux-2.6.39.1/drivers/pci/pcie/aspm.c 2011-05-22 19:36:32.000000000 -0400
36963 @@ -27,9 +27,9 @@
36964 #define MODULE_PARAM_PREFIX "pcie_aspm."
36965
36966 /* Note: those are not register definitions */
36967 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
36968 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
36969 -#define ASPM_STATE_L1 (4) /* L1 state */
36970 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
36971 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
36972 +#define ASPM_STATE_L1 (4U) /* L1 state */
36973 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
36974 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
36975
36976 diff -urNp linux-2.6.39.1/drivers/pci/pci.h linux-2.6.39.1/drivers/pci/pci.h
36977 --- linux-2.6.39.1/drivers/pci/pci.h 2011-05-19 00:06:34.000000000 -0400
36978 +++ linux-2.6.39.1/drivers/pci/pci.h 2011-05-22 19:36:32.000000000 -0400
36979 @@ -65,7 +65,7 @@ struct pci_platform_pm_ops {
36980 int (*run_wake)(struct pci_dev *dev, bool enable);
36981 };
36982
36983 -extern int pci_set_platform_pm(struct pci_platform_pm_ops *ops);
36984 +extern int pci_set_platform_pm(const struct pci_platform_pm_ops *ops);
36985 extern void pci_update_current_state(struct pci_dev *dev, pci_power_t state);
36986 extern void pci_disable_enabled_device(struct pci_dev *dev);
36987 extern int pci_finish_runtime_suspend(struct pci_dev *dev);
36988 diff -urNp linux-2.6.39.1/drivers/pci/probe.c linux-2.6.39.1/drivers/pci/probe.c
36989 --- linux-2.6.39.1/drivers/pci/probe.c 2011-05-19 00:06:34.000000000 -0400
36990 +++ linux-2.6.39.1/drivers/pci/probe.c 2011-05-22 19:36:32.000000000 -0400
36991 @@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
36992 return ret;
36993 }
36994
36995 -static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
36996 +static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
36997 struct device_attribute *attr,
36998 char *buf)
36999 {
37000 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
37001 }
37002
37003 -static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
37004 +static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
37005 struct device_attribute *attr,
37006 char *buf)
37007 {
37008 @@ -165,7 +165,7 @@ int __pci_read_base(struct pci_dev *dev,
37009 u32 l, sz, mask;
37010 u16 orig_cmd;
37011
37012 - mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
37013 + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
37014
37015 if (!dev->mmio_always_on) {
37016 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
37017 @@ -1407,7 +1407,7 @@ unsigned int __devinit pci_scan_child_bu
37018 }
37019
37020 struct pci_bus * pci_create_bus(struct device *parent,
37021 - int bus, struct pci_ops *ops, void *sysdata)
37022 + int bus, const struct pci_ops *ops, void *sysdata)
37023 {
37024 int error;
37025 struct pci_bus *b, *b2;
37026 @@ -1483,7 +1483,7 @@ err_out:
37027 }
37028
37029 struct pci_bus * __devinit pci_scan_bus_parented(struct device *parent,
37030 - int bus, struct pci_ops *ops, void *sysdata)
37031 + int bus, const struct pci_ops *ops, void *sysdata)
37032 {
37033 struct pci_bus *b;
37034
37035 diff -urNp linux-2.6.39.1/drivers/pci/proc.c linux-2.6.39.1/drivers/pci/proc.c
37036 --- linux-2.6.39.1/drivers/pci/proc.c 2011-05-19 00:06:34.000000000 -0400
37037 +++ linux-2.6.39.1/drivers/pci/proc.c 2011-05-22 19:41:37.000000000 -0400
37038 @@ -476,7 +476,16 @@ static const struct file_operations proc
37039 static int __init pci_proc_init(void)
37040 {
37041 struct pci_dev *dev = NULL;
37042 +
37043 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
37044 +#ifdef CONFIG_GRKERNSEC_PROC_USER
37045 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
37046 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
37047 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
37048 +#endif
37049 +#else
37050 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
37051 +#endif
37052 proc_create("devices", 0, proc_bus_pci_dir,
37053 &proc_bus_pci_dev_operations);
37054 proc_initialized = 1;
37055 diff -urNp linux-2.6.39.1/drivers/pci/xen-pcifront.c linux-2.6.39.1/drivers/pci/xen-pcifront.c
37056 --- linux-2.6.39.1/drivers/pci/xen-pcifront.c 2011-05-19 00:06:34.000000000 -0400
37057 +++ linux-2.6.39.1/drivers/pci/xen-pcifront.c 2011-05-22 19:36:32.000000000 -0400
37058 @@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
37059 struct pcifront_sd *sd = bus->sysdata;
37060 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37061
37062 + pax_track_stack();
37063 +
37064 if (verbose_request)
37065 dev_info(&pdev->xdev->dev,
37066 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
37067 @@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
37068 struct pcifront_sd *sd = bus->sysdata;
37069 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37070
37071 + pax_track_stack();
37072 +
37073 if (verbose_request)
37074 dev_info(&pdev->xdev->dev,
37075 "write dev=%04x:%02x:%02x.%01x - "
37076 @@ -236,7 +240,7 @@ static int pcifront_bus_write(struct pci
37077 return errno_to_pcibios_err(do_pci_op(pdev, &op));
37078 }
37079
37080 -struct pci_ops pcifront_bus_ops = {
37081 +const struct pci_ops pcifront_bus_ops = {
37082 .read = pcifront_bus_read,
37083 .write = pcifront_bus_write,
37084 };
37085 @@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
37086 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37087 struct msi_desc *entry;
37088
37089 + pax_track_stack();
37090 +
37091 if (nvec > SH_INFO_MAX_VEC) {
37092 dev_err(&dev->dev, "too much vector for pci frontend: %x."
37093 " Increase SH_INFO_MAX_VEC.\n", nvec);
37094 @@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st
37095 struct pcifront_sd *sd = dev->bus->sysdata;
37096 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37097
37098 + pax_track_stack();
37099 +
37100 err = do_pci_op(pdev, &op);
37101
37102 /* What should do for error ? */
37103 @@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc
37104 struct pcifront_sd *sd = dev->bus->sysdata;
37105 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37106
37107 + pax_track_stack();
37108 +
37109 err = do_pci_op(pdev, &op);
37110 if (likely(!err)) {
37111 vector[0] = op.value;
37112 @@ -368,7 +378,7 @@ static void pci_frontend_disable_msi(str
37113 printk(KERN_DEBUG "get fake response frombackend\n");
37114 }
37115
37116 -static struct xen_pci_frontend_ops pci_frontend_ops = {
37117 +static const struct xen_pci_frontend_ops pci_frontend_ops = {
37118 .enable_msi = pci_frontend_enable_msi,
37119 .disable_msi = pci_frontend_disable_msi,
37120 .enable_msix = pci_frontend_enable_msix,
37121 diff -urNp linux-2.6.39.1/drivers/pcmcia/at91_cf.c linux-2.6.39.1/drivers/pcmcia/at91_cf.c
37122 --- linux-2.6.39.1/drivers/pcmcia/at91_cf.c 2011-05-19 00:06:34.000000000 -0400
37123 +++ linux-2.6.39.1/drivers/pcmcia/at91_cf.c 2011-05-22 19:36:32.000000000 -0400
37124 @@ -203,7 +203,7 @@ at91_cf_set_mem_map(struct pcmcia_socket
37125 return 0;
37126 }
37127
37128 -static struct pccard_operations at91_cf_ops = {
37129 +static const struct pccard_operations at91_cf_ops = {
37130 .init = at91_cf_ss_init,
37131 .suspend = at91_cf_ss_suspend,
37132 .get_status = at91_cf_get_status,
37133 diff -urNp linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c
37134 --- linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37135 +++ linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37136 @@ -184,7 +184,7 @@ bfin_cf_set_mem_map(struct pcmcia_socket
37137 return 0;
37138 }
37139
37140 -static struct pccard_operations bfin_cf_ops = {
37141 +static const struct pccard_operations bfin_cf_ops = {
37142 .init = bfin_cf_ss_init,
37143 .suspend = bfin_cf_ss_suspend,
37144 .get_status = bfin_cf_get_status,
37145 diff -urNp linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c
37146 --- linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c 2011-05-19 00:06:34.000000000 -0400
37147 +++ linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c 2011-05-22 19:36:32.000000000 -0400
37148 @@ -384,7 +384,7 @@ static int au1x00_pcmcia_set_mem_map(str
37149 return 0;
37150 }
37151
37152 -static struct pccard_operations db1x_pcmcia_operations = {
37153 +static const struct pccard_operations db1x_pcmcia_operations = {
37154 .init = db1x_pcmcia_sock_init,
37155 .suspend = db1x_pcmcia_sock_suspend,
37156 .get_status = db1x_pcmcia_get_status,
37157 diff -urNp linux-2.6.39.1/drivers/pcmcia/electra_cf.c linux-2.6.39.1/drivers/pcmcia/electra_cf.c
37158 --- linux-2.6.39.1/drivers/pcmcia/electra_cf.c 2011-05-19 00:06:34.000000000 -0400
37159 +++ linux-2.6.39.1/drivers/pcmcia/electra_cf.c 2011-05-22 19:36:32.000000000 -0400
37160 @@ -173,7 +173,7 @@ static int electra_cf_set_mem_map(struct
37161 return 0;
37162 }
37163
37164 -static struct pccard_operations electra_cf_ops = {
37165 +static const struct pccard_operations electra_cf_ops = {
37166 .init = electra_cf_ss_init,
37167 .get_status = electra_cf_get_status,
37168 .set_socket = electra_cf_set_socket,
37169 diff -urNp linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c
37170 --- linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c 2011-05-19 00:06:34.000000000 -0400
37171 +++ linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c 2011-05-22 19:36:32.000000000 -0400
37172 @@ -674,7 +674,7 @@ static int pcc_init(struct pcmcia_socket
37173 return 0;
37174 }
37175
37176 -static struct pccard_operations pcc_operations = {
37177 +static const struct pccard_operations pcc_operations = {
37178 .init = pcc_init,
37179 .get_status = pcc_get_status,
37180 .set_socket = pcc_set_socket,
37181 diff -urNp linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c
37182 --- linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c 2011-05-19 00:06:34.000000000 -0400
37183 +++ linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c 2011-05-22 19:36:32.000000000 -0400
37184 @@ -652,7 +652,7 @@ static int pcc_init(struct pcmcia_socket
37185 return 0;
37186 }
37187
37188 -static struct pccard_operations pcc_operations = {
37189 +static const struct pccard_operations pcc_operations = {
37190 .init = pcc_init,
37191 .get_status = pcc_get_status,
37192 .set_socket = pcc_set_socket,
37193 diff -urNp linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c
37194 --- linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37195 +++ linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37196 @@ -1139,7 +1139,7 @@ static int m8xx_sock_suspend(struct pcmc
37197 return m8xx_set_socket(sock, &dead_socket);
37198 }
37199
37200 -static struct pccard_operations m8xx_services = {
37201 +static const struct pccard_operations m8xx_services = {
37202 .init = m8xx_sock_init,
37203 .suspend = m8xx_sock_suspend,
37204 .get_status = m8xx_get_status,
37205 diff -urNp linux-2.6.39.1/drivers/pcmcia/omap_cf.c linux-2.6.39.1/drivers/pcmcia/omap_cf.c
37206 --- linux-2.6.39.1/drivers/pcmcia/omap_cf.c 2011-05-19 00:06:34.000000000 -0400
37207 +++ linux-2.6.39.1/drivers/pcmcia/omap_cf.c 2011-05-22 19:36:32.000000000 -0400
37208 @@ -185,7 +185,7 @@ omap_cf_set_mem_map(struct pcmcia_socket
37209 return 0;
37210 }
37211
37212 -static struct pccard_operations omap_cf_ops = {
37213 +static const struct pccard_operations omap_cf_ops = {
37214 .init = omap_cf_ss_init,
37215 .suspend = omap_cf_ss_suspend,
37216 .get_status = omap_cf_get_status,
37217 diff -urNp linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c
37218 --- linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c 2011-05-19 00:06:34.000000000 -0400
37219 +++ linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c 2011-05-22 19:36:32.000000000 -0400
37220 @@ -161,7 +161,7 @@ static int iodyn_find_io(struct pcmcia_s
37221 }
37222
37223
37224 -struct pccard_resource_ops pccard_iodyn_ops = {
37225 +const struct pccard_resource_ops pccard_iodyn_ops = {
37226 .validate_mem = NULL,
37227 .find_io = iodyn_find_io,
37228 .find_mem = NULL,
37229 diff -urNp linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c
37230 --- linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c 2011-05-19 00:06:34.000000000 -0400
37231 +++ linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c 2011-05-22 19:36:32.000000000 -0400
37232 @@ -57,7 +57,7 @@ static int static_find_io(struct pcmcia_
37233 }
37234
37235
37236 -struct pccard_resource_ops pccard_static_ops = {
37237 +const struct pccard_resource_ops pccard_static_ops = {
37238 .validate_mem = NULL,
37239 .find_io = static_find_io,
37240 .find_mem = NULL,
37241 diff -urNp linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c
37242 --- linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c 2011-05-19 00:06:34.000000000 -0400
37243 +++ linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c 2011-05-22 19:36:32.000000000 -0400
37244 @@ -479,7 +479,7 @@ static int pccard_set_mem_map(struct pcm
37245 return 0;
37246 }
37247
37248 -static struct pccard_operations vrc4171_pccard_operations = {
37249 +static const struct pccard_operations vrc4171_pccard_operations = {
37250 .init = pccard_init,
37251 .get_status = pccard_get_status,
37252 .set_socket = pccard_set_socket,
37253 diff -urNp linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c
37254 --- linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c 2011-05-19 00:06:34.000000000 -0400
37255 +++ linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c 2011-05-22 19:36:32.000000000 -0400
37256 @@ -384,7 +384,7 @@ static void cardu_proc_setup(unsigned in
37257 {
37258 }
37259
37260 -static struct pccard_operations cardu_operations = {
37261 +static const struct pccard_operations cardu_operations = {
37262 .init = cardu_init,
37263 .register_callback = cardu_register_callback,
37264 .inquire_socket = cardu_inquire_socket,
37265 diff -urNp linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c
37266 --- linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c 2011-05-19 00:06:34.000000000 -0400
37267 +++ linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c 2011-05-22 19:36:32.000000000 -0400
37268 @@ -196,7 +196,7 @@ static int au1x00_pcmcia_set_mem_map(str
37269 return 0;
37270 }
37271
37272 -static struct pccard_operations xxs1500_pcmcia_operations = {
37273 +static const struct pccard_operations xxs1500_pcmcia_operations = {
37274 .init = xxs1500_pcmcia_sock_init,
37275 .suspend = xxs1500_pcmcia_sock_suspend,
37276 .get_status = xxs1500_pcmcia_get_status,
37277 diff -urNp linux-2.6.39.1/drivers/platform/x86/acerhdf.c linux-2.6.39.1/drivers/platform/x86/acerhdf.c
37278 --- linux-2.6.39.1/drivers/platform/x86/acerhdf.c 2011-05-19 00:06:34.000000000 -0400
37279 +++ linux-2.6.39.1/drivers/platform/x86/acerhdf.c 2011-05-22 19:36:32.000000000 -0400
37280 @@ -406,7 +406,7 @@ static int acerhdf_get_crit_temp(struct
37281 }
37282
37283 /* bind callback functions to thermalzone */
37284 -static struct thermal_zone_device_ops acerhdf_dev_ops = {
37285 +static const struct thermal_zone_device_ops acerhdf_dev_ops = {
37286 .bind = acerhdf_bind,
37287 .unbind = acerhdf_unbind,
37288 .get_temp = acerhdf_get_ec_temp,
37289 @@ -481,7 +481,7 @@ err_out:
37290 }
37291
37292 /* bind fan callbacks to fan device */
37293 -static struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37294 +static const struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37295 .get_max_state = acerhdf_get_max_state,
37296 .get_cur_state = acerhdf_get_cur_state,
37297 .set_cur_state = acerhdf_set_cur_state,
37298 diff -urNp linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c
37299 --- linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c 2011-05-19 00:06:34.000000000 -0400
37300 +++ linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c 2011-05-22 19:36:32.000000000 -0400
37301 @@ -207,7 +207,7 @@ static int ideapad_rfk_set(void *data, b
37302 return write_ec_cmd(ideapad_handle, opcode, !blocked);
37303 }
37304
37305 -static struct rfkill_ops ideapad_rfk_ops = {
37306 +static const struct rfkill_ops ideapad_rfk_ops = {
37307 .set_block = ideapad_rfk_set,
37308 };
37309
37310 diff -urNp linux-2.6.39.1/drivers/platform/x86/intel_menlow.c linux-2.6.39.1/drivers/platform/x86/intel_menlow.c
37311 --- linux-2.6.39.1/drivers/platform/x86/intel_menlow.c 2011-05-19 00:06:34.000000000 -0400
37312 +++ linux-2.6.39.1/drivers/platform/x86/intel_menlow.c 2011-05-22 19:36:32.000000000 -0400
37313 @@ -143,7 +143,7 @@ static int memory_set_cur_bandwidth(stru
37314 return 0;
37315 }
37316
37317 -static struct thermal_cooling_device_ops memory_cooling_ops = {
37318 +static const struct thermal_cooling_device_ops memory_cooling_ops = {
37319 .get_max_state = memory_get_max_bandwidth,
37320 .get_cur_state = memory_get_cur_bandwidth,
37321 .set_cur_state = memory_set_cur_bandwidth,
37322 diff -urNp linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c
37323 --- linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c 2011-05-19 00:06:34.000000000 -0400
37324 +++ linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c 2011-05-22 19:36:32.000000000 -0400
37325 @@ -458,7 +458,7 @@ static int read_curr_temp(struct thermal
37326 }
37327
37328 /* Can't be const */
37329 -static struct thermal_zone_device_ops tzd_ops = {
37330 +static const struct thermal_zone_device_ops tzd_ops = {
37331 .get_temp = read_curr_temp,
37332 };
37333
37334 diff -urNp linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c
37335 --- linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c 2011-05-19 00:06:34.000000000 -0400
37336 +++ linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c 2011-05-22 19:36:32.000000000 -0400
37337 @@ -419,7 +419,7 @@ static int rfkill_set(void *data, bool b
37338 return 0;
37339 }
37340
37341 -static struct rfkill_ops rfkill_ops = {
37342 +static const struct rfkill_ops rfkill_ops = {
37343 .set_block = rfkill_set,
37344 };
37345
37346 diff -urNp linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c
37347 --- linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c 2011-05-19 00:06:34.000000000 -0400
37348 +++ linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c 2011-05-22 19:36:32.000000000 -0400
37349 @@ -59,7 +59,7 @@ do { \
37350 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
37351 } while(0)
37352
37353 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
37354 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
37355 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
37356
37357 /*
37358 @@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func
37359
37360 cpu = get_cpu();
37361 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
37362 +
37363 + pax_open_kernel();
37364 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
37365 + pax_close_kernel();
37366
37367 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
37368 spin_lock_irqsave(&pnp_bios_lock, flags);
37369 @@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func
37370 :"memory");
37371 spin_unlock_irqrestore(&pnp_bios_lock, flags);
37372
37373 + pax_open_kernel();
37374 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
37375 + pax_close_kernel();
37376 +
37377 put_cpu();
37378
37379 /* If we get here and this is set then the PnP BIOS faulted on us. */
37380 @@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n
37381 return status;
37382 }
37383
37384 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
37385 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
37386 {
37387 int i;
37388
37389 @@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i
37390 pnp_bios_callpoint.offset = header->fields.pm16offset;
37391 pnp_bios_callpoint.segment = PNP_CS16;
37392
37393 + pax_open_kernel();
37394 +
37395 for_each_possible_cpu(i) {
37396 struct desc_struct *gdt = get_cpu_gdt_table(i);
37397 if (!gdt)
37398 @@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i
37399 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
37400 (unsigned long)__va(header->fields.pm16dseg));
37401 }
37402 +
37403 + pax_close_kernel();
37404 }
37405 diff -urNp linux-2.6.39.1/drivers/pnp/resource.c linux-2.6.39.1/drivers/pnp/resource.c
37406 --- linux-2.6.39.1/drivers/pnp/resource.c 2011-05-19 00:06:34.000000000 -0400
37407 +++ linux-2.6.39.1/drivers/pnp/resource.c 2011-05-22 19:36:32.000000000 -0400
37408 @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
37409 return 1;
37410
37411 /* check if the resource is valid */
37412 - if (*irq < 0 || *irq > 15)
37413 + if (*irq > 15)
37414 return 0;
37415
37416 /* check if the resource is reserved */
37417 @@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
37418 return 1;
37419
37420 /* check if the resource is valid */
37421 - if (*dma < 0 || *dma == 4 || *dma > 7)
37422 + if (*dma == 4 || *dma > 7)
37423 return 0;
37424
37425 /* check if the resource is reserved */
37426 diff -urNp linux-2.6.39.1/drivers/power/max8925_power.c linux-2.6.39.1/drivers/power/max8925_power.c
37427 --- linux-2.6.39.1/drivers/power/max8925_power.c 2011-05-19 00:06:34.000000000 -0400
37428 +++ linux-2.6.39.1/drivers/power/max8925_power.c 2011-05-22 19:36:32.000000000 -0400
37429 @@ -426,7 +426,7 @@ static __devinit int max8925_power_probe
37430 {
37431 struct max8925_chip *chip = dev_get_drvdata(pdev->dev.parent);
37432 struct max8925_platform_data *max8925_pdata;
37433 - struct max8925_power_pdata *pdata = NULL;
37434 + const struct max8925_power_pdata *pdata = NULL;
37435 struct max8925_power_info *info;
37436 int ret;
37437
37438 diff -urNp linux-2.6.39.1/drivers/regulator/core.c linux-2.6.39.1/drivers/regulator/core.c
37439 --- linux-2.6.39.1/drivers/regulator/core.c 2011-05-19 00:06:34.000000000 -0400
37440 +++ linux-2.6.39.1/drivers/regulator/core.c 2011-05-22 19:36:32.000000000 -0400
37441 @@ -2883,7 +2883,7 @@ core_initcall(regulator_init);
37442 static int __init regulator_init_complete(void)
37443 {
37444 struct regulator_dev *rdev;
37445 - struct regulator_ops *ops;
37446 + const struct regulator_ops *ops;
37447 struct regulation_constraints *c;
37448 int enabled, ret;
37449
37450 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c
37451 --- linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c 2011-05-19 00:06:34.000000000 -0400
37452 +++ linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c 2011-05-22 19:36:32.000000000 -0400
37453 @@ -187,7 +187,7 @@ static irqreturn_t at32_rtc_interrupt(in
37454 return ret;
37455 }
37456
37457 -static struct rtc_class_ops at32_rtc_ops = {
37458 +static const struct rtc_class_ops at32_rtc_ops = {
37459 .read_time = at32_rtc_readtime,
37460 .set_time = at32_rtc_settime,
37461 .read_alarm = at32_rtc_readalarm,
37462 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c
37463 --- linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c 2011-05-19 00:06:34.000000000 -0400
37464 +++ linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c 2011-05-22 19:36:32.000000000 -0400
37465 @@ -57,7 +57,7 @@ static int au1xtoy_rtc_set_time(struct d
37466 return 0;
37467 }
37468
37469 -static struct rtc_class_ops au1xtoy_rtc_ops = {
37470 +static const struct rtc_class_ops au1xtoy_rtc_ops = {
37471 .read_time = au1xtoy_rtc_read_time,
37472 .set_time = au1xtoy_rtc_set_time,
37473 };
37474 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-bfin.c linux-2.6.39.1/drivers/rtc/rtc-bfin.c
37475 --- linux-2.6.39.1/drivers/rtc/rtc-bfin.c 2011-05-19 00:06:34.000000000 -0400
37476 +++ linux-2.6.39.1/drivers/rtc/rtc-bfin.c 2011-05-22 19:36:32.000000000 -0400
37477 @@ -333,7 +333,7 @@ static int bfin_rtc_proc(struct device *
37478 #undef yesno
37479 }
37480
37481 -static struct rtc_class_ops bfin_rtc_ops = {
37482 +static const struct rtc_class_ops bfin_rtc_ops = {
37483 .read_time = bfin_rtc_read_time,
37484 .set_time = bfin_rtc_set_time,
37485 .read_alarm = bfin_rtc_read_alarm,
37486 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-coh901331.c linux-2.6.39.1/drivers/rtc/rtc-coh901331.c
37487 --- linux-2.6.39.1/drivers/rtc/rtc-coh901331.c 2011-05-19 00:06:34.000000000 -0400
37488 +++ linux-2.6.39.1/drivers/rtc/rtc-coh901331.c 2011-05-22 19:36:32.000000000 -0400
37489 @@ -142,7 +142,7 @@ static int coh901331_alarm_irq_enable(st
37490 return 0;
37491 }
37492
37493 -static struct rtc_class_ops coh901331_ops = {
37494 +static const struct rtc_class_ops coh901331_ops = {
37495 .read_time = coh901331_read_time,
37496 .set_mmss = coh901331_set_mmss,
37497 .read_alarm = coh901331_read_alarm,
37498 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-davinci.c linux-2.6.39.1/drivers/rtc/rtc-davinci.c
37499 --- linux-2.6.39.1/drivers/rtc/rtc-davinci.c 2011-05-19 00:06:34.000000000 -0400
37500 +++ linux-2.6.39.1/drivers/rtc/rtc-davinci.c 2011-05-22 19:36:32.000000000 -0400
37501 @@ -469,7 +469,7 @@ static int davinci_rtc_set_alarm(struct
37502 return 0;
37503 }
37504
37505 -static struct rtc_class_ops davinci_rtc_ops = {
37506 +static const struct rtc_class_ops davinci_rtc_ops = {
37507 .ioctl = davinci_rtc_ioctl,
37508 .read_time = davinci_rtc_read_time,
37509 .set_time = davinci_rtc_set_time,
37510 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-dev.c linux-2.6.39.1/drivers/rtc/rtc-dev.c
37511 --- linux-2.6.39.1/drivers/rtc/rtc-dev.c 2011-05-19 00:06:34.000000000 -0400
37512 +++ linux-2.6.39.1/drivers/rtc/rtc-dev.c 2011-05-22 19:41:37.000000000 -0400
37513 @@ -14,6 +14,7 @@
37514 #include <linux/module.h>
37515 #include <linux/rtc.h>
37516 #include <linux/sched.h>
37517 +#include <linux/grsecurity.h>
37518 #include "rtc-core.h"
37519
37520 static dev_t rtc_devt;
37521 @@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f
37522 if (copy_from_user(&tm, uarg, sizeof(tm)))
37523 return -EFAULT;
37524
37525 + gr_log_timechange();
37526 +
37527 return rtc_set_time(rtc, &tm);
37528
37529 case RTC_PIE_ON:
37530 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c
37531 --- linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c 2011-05-19 00:06:34.000000000 -0400
37532 +++ linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c 2011-05-22 19:36:32.000000000 -0400
37533 @@ -115,7 +115,7 @@ static int dm355evm_rtc_set_time(struct
37534 return 0;
37535 }
37536
37537 -static struct rtc_class_ops dm355evm_rtc_ops = {
37538 +static const struct rtc_class_ops dm355evm_rtc_ops = {
37539 .read_time = dm355evm_rtc_read_time,
37540 .set_time = dm355evm_rtc_set_time,
37541 };
37542 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-ds1302.c linux-2.6.39.1/drivers/rtc/rtc-ds1302.c
37543 --- linux-2.6.39.1/drivers/rtc/rtc-ds1302.c 2011-05-19 00:06:34.000000000 -0400
37544 +++ linux-2.6.39.1/drivers/rtc/rtc-ds1302.c 2011-05-22 19:36:32.000000000 -0400
37545 @@ -199,7 +199,7 @@ static int ds1302_rtc_ioctl(struct devic
37546 return -ENOIOCTLCMD;
37547 }
37548
37549 -static struct rtc_class_ops ds1302_rtc_ops = {
37550 +static const struct rtc_class_ops ds1302_rtc_ops = {
37551 .read_time = ds1302_rtc_read_time,
37552 .set_time = ds1302_rtc_set_time,
37553 .ioctl = ds1302_rtc_ioctl,
37554 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-imxdi.c linux-2.6.39.1/drivers/rtc/rtc-imxdi.c
37555 --- linux-2.6.39.1/drivers/rtc/rtc-imxdi.c 2011-05-19 00:06:34.000000000 -0400
37556 +++ linux-2.6.39.1/drivers/rtc/rtc-imxdi.c 2011-05-22 19:36:32.000000000 -0400
37557 @@ -290,7 +290,7 @@ static int dryice_rtc_set_alarm(struct d
37558 return 0;
37559 }
37560
37561 -static struct rtc_class_ops dryice_rtc_ops = {
37562 +static const struct rtc_class_ops dryice_rtc_ops = {
37563 .read_time = dryice_rtc_read_time,
37564 .set_mmss = dryice_rtc_set_mmss,
37565 .alarm_irq_enable = dryice_rtc_alarm_irq_enable,
37566 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-jz4740.c linux-2.6.39.1/drivers/rtc/rtc-jz4740.c
37567 --- linux-2.6.39.1/drivers/rtc/rtc-jz4740.c 2011-05-19 00:06:34.000000000 -0400
37568 +++ linux-2.6.39.1/drivers/rtc/rtc-jz4740.c 2011-05-22 19:36:32.000000000 -0400
37569 @@ -174,7 +174,7 @@ static int jz4740_rtc_alarm_irq_enable(s
37570 return jz4740_rtc_ctrl_set_bits(rtc, JZ_RTC_CTRL_AF_IRQ, enable);
37571 }
37572
37573 -static struct rtc_class_ops jz4740_rtc_ops = {
37574 +static const struct rtc_class_ops jz4740_rtc_ops = {
37575 .read_time = jz4740_rtc_read_time,
37576 .set_mmss = jz4740_rtc_set_mmss,
37577 .read_alarm = jz4740_rtc_read_alarm,
37578 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-m41t80.c linux-2.6.39.1/drivers/rtc/rtc-m41t80.c
37579 --- linux-2.6.39.1/drivers/rtc/rtc-m41t80.c 2011-05-19 00:06:34.000000000 -0400
37580 +++ linux-2.6.39.1/drivers/rtc/rtc-m41t80.c 2011-05-22 19:36:32.000000000 -0400
37581 @@ -354,7 +354,7 @@ static int m41t80_rtc_read_alarm(struct
37582 return 0;
37583 }
37584
37585 -static struct rtc_class_ops m41t80_rtc_ops = {
37586 +static const struct rtc_class_ops m41t80_rtc_ops = {
37587 .read_time = m41t80_rtc_read_time,
37588 .set_time = m41t80_rtc_set_time,
37589 .read_alarm = m41t80_rtc_read_alarm,
37590 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-mxc.c linux-2.6.39.1/drivers/rtc/rtc-mxc.c
37591 --- linux-2.6.39.1/drivers/rtc/rtc-mxc.c 2011-05-19 00:06:34.000000000 -0400
37592 +++ linux-2.6.39.1/drivers/rtc/rtc-mxc.c 2011-05-22 19:36:32.000000000 -0400
37593 @@ -355,7 +355,7 @@ static int mxc_rtc_set_alarm(struct devi
37594 }
37595
37596 /* RTC layer */
37597 -static struct rtc_class_ops mxc_rtc_ops = {
37598 +static const struct rtc_class_ops mxc_rtc_ops = {
37599 .release = mxc_rtc_release,
37600 .read_time = mxc_rtc_read_time,
37601 .set_mmss = mxc_rtc_set_mmss,
37602 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-nuc900.c linux-2.6.39.1/drivers/rtc/rtc-nuc900.c
37603 --- linux-2.6.39.1/drivers/rtc/rtc-nuc900.c 2011-05-19 00:06:34.000000000 -0400
37604 +++ linux-2.6.39.1/drivers/rtc/rtc-nuc900.c 2011-05-22 19:36:32.000000000 -0400
37605 @@ -214,7 +214,7 @@ static int nuc900_rtc_set_alarm(struct d
37606 return 0;
37607 }
37608
37609 -static struct rtc_class_ops nuc900_rtc_ops = {
37610 +static const struct rtc_class_ops nuc900_rtc_ops = {
37611 .read_time = nuc900_rtc_read_time,
37612 .set_time = nuc900_rtc_set_time,
37613 .read_alarm = nuc900_rtc_read_alarm,
37614 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-omap.c linux-2.6.39.1/drivers/rtc/rtc-omap.c
37615 --- linux-2.6.39.1/drivers/rtc/rtc-omap.c 2011-05-19 00:06:34.000000000 -0400
37616 +++ linux-2.6.39.1/drivers/rtc/rtc-omap.c 2011-05-22 19:36:32.000000000 -0400
37617 @@ -274,7 +274,7 @@ static int omap_rtc_set_alarm(struct dev
37618 return 0;
37619 }
37620
37621 -static struct rtc_class_ops omap_rtc_ops = {
37622 +static const struct rtc_class_ops omap_rtc_ops = {
37623 .read_time = omap_rtc_read_time,
37624 .set_time = omap_rtc_set_time,
37625 .read_alarm = omap_rtc_read_alarm,
37626 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c
37627 --- linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c 2011-05-19 00:06:34.000000000 -0400
37628 +++ linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c 2011-05-22 19:36:32.000000000 -0400
37629 @@ -238,7 +238,7 @@ static int pcf50633_rtc_set_alarm(struct
37630 return ret;
37631 }
37632
37633 -static struct rtc_class_ops pcf50633_rtc_ops = {
37634 +static const struct rtc_class_ops pcf50633_rtc_ops = {
37635 .read_time = pcf50633_rtc_read_time,
37636 .set_time = pcf50633_rtc_set_time,
37637 .read_alarm = pcf50633_rtc_read_alarm,
37638 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-pl031.c linux-2.6.39.1/drivers/rtc/rtc-pl031.c
37639 --- linux-2.6.39.1/drivers/rtc/rtc-pl031.c 2011-05-19 00:06:34.000000000 -0400
37640 +++ linux-2.6.39.1/drivers/rtc/rtc-pl031.c 2011-05-22 19:36:32.000000000 -0400
37641 @@ -374,7 +374,7 @@ err_req:
37642 }
37643
37644 /* Operations for the original ARM version */
37645 -static struct rtc_class_ops arm_pl031_ops = {
37646 +static const struct rtc_class_ops arm_pl031_ops = {
37647 .read_time = pl031_read_time,
37648 .set_time = pl031_set_time,
37649 .read_alarm = pl031_read_alarm,
37650 @@ -383,7 +383,7 @@ static struct rtc_class_ops arm_pl031_op
37651 };
37652
37653 /* The First ST derivative */
37654 -static struct rtc_class_ops stv1_pl031_ops = {
37655 +static const struct rtc_class_ops stv1_pl031_ops = {
37656 .read_time = pl031_read_time,
37657 .set_time = pl031_set_time,
37658 .read_alarm = pl031_read_alarm,
37659 @@ -392,7 +392,7 @@ static struct rtc_class_ops stv1_pl031_o
37660 };
37661
37662 /* And the second ST derivative */
37663 -static struct rtc_class_ops stv2_pl031_ops = {
37664 +static const struct rtc_class_ops stv2_pl031_ops = {
37665 .read_time = pl031_stv2_read_time,
37666 .set_time = pl031_stv2_set_time,
37667 .read_alarm = pl031_stv2_read_alarm,
37668 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-rx8025.c linux-2.6.39.1/drivers/rtc/rtc-rx8025.c
37669 --- linux-2.6.39.1/drivers/rtc/rtc-rx8025.c 2011-05-19 00:06:34.000000000 -0400
37670 +++ linux-2.6.39.1/drivers/rtc/rtc-rx8025.c 2011-05-22 19:36:32.000000000 -0400
37671 @@ -424,7 +424,7 @@ static int rx8025_alarm_irq_enable(struc
37672 return 0;
37673 }
37674
37675 -static struct rtc_class_ops rx8025_rtc_ops = {
37676 +static const struct rtc_class_ops rx8025_rtc_ops = {
37677 .read_time = rx8025_get_time,
37678 .set_time = rx8025_set_time,
37679 .read_alarm = rx8025_read_alarm,
37680 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-sh.c linux-2.6.39.1/drivers/rtc/rtc-sh.c
37681 --- linux-2.6.39.1/drivers/rtc/rtc-sh.c 2011-05-19 00:06:34.000000000 -0400
37682 +++ linux-2.6.39.1/drivers/rtc/rtc-sh.c 2011-05-22 19:36:32.000000000 -0400
37683 @@ -576,7 +576,7 @@ static int sh_rtc_set_alarm(struct devic
37684 return 0;
37685 }
37686
37687 -static struct rtc_class_ops sh_rtc_ops = {
37688 +static const struct rtc_class_ops sh_rtc_ops = {
37689 .read_time = sh_rtc_read_time,
37690 .set_time = sh_rtc_set_time,
37691 .read_alarm = sh_rtc_read_alarm,
37692 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c
37693 --- linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c 2011-05-19 00:06:34.000000000 -0400
37694 +++ linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c 2011-05-22 19:36:32.000000000 -0400
37695 @@ -133,7 +133,7 @@ static int stmp3xxx_rtc_set_alarm(struct
37696 return 0;
37697 }
37698
37699 -static struct rtc_class_ops stmp3xxx_rtc_ops = {
37700 +static const struct rtc_class_ops stmp3xxx_rtc_ops = {
37701 .alarm_irq_enable =
37702 stmp3xxx_alarm_irq_enable,
37703 .read_time = stmp3xxx_rtc_gettime,
37704 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-tegra.c linux-2.6.39.1/drivers/rtc/rtc-tegra.c
37705 --- linux-2.6.39.1/drivers/rtc/rtc-tegra.c 2011-05-19 00:06:34.000000000 -0400
37706 +++ linux-2.6.39.1/drivers/rtc/rtc-tegra.c 2011-05-22 19:36:32.000000000 -0400
37707 @@ -294,7 +294,7 @@ static irqreturn_t tegra_rtc_irq_handler
37708 return IRQ_HANDLED;
37709 }
37710
37711 -static struct rtc_class_ops tegra_rtc_ops = {
37712 +static const struct rtc_class_ops tegra_rtc_ops = {
37713 .read_time = tegra_rtc_read_time,
37714 .set_time = tegra_rtc_set_time,
37715 .read_alarm = tegra_rtc_read_alarm,
37716 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-twl.c linux-2.6.39.1/drivers/rtc/rtc-twl.c
37717 --- linux-2.6.39.1/drivers/rtc/rtc-twl.c 2011-05-19 00:06:34.000000000 -0400
37718 +++ linux-2.6.39.1/drivers/rtc/rtc-twl.c 2011-05-22 19:36:32.000000000 -0400
37719 @@ -415,7 +415,7 @@ out:
37720 return ret;
37721 }
37722
37723 -static struct rtc_class_ops twl_rtc_ops = {
37724 +static const struct rtc_class_ops twl_rtc_ops = {
37725 .read_time = twl_rtc_read_time,
37726 .set_time = twl_rtc_set_time,
37727 .read_alarm = twl_rtc_read_alarm,
37728 diff -urNp linux-2.6.39.1/drivers/rtc/rtc-v3020.c linux-2.6.39.1/drivers/rtc/rtc-v3020.c
37729 --- linux-2.6.39.1/drivers/rtc/rtc-v3020.c 2011-05-19 00:06:34.000000000 -0400
37730 +++ linux-2.6.39.1/drivers/rtc/rtc-v3020.c 2011-05-22 19:36:32.000000000 -0400
37731 @@ -62,7 +62,7 @@ struct v3020 {
37732 /* GPIO access */
37733 struct v3020_gpio *gpio;
37734
37735 - struct v3020_chip_ops *ops;
37736 + const struct v3020_chip_ops *ops;
37737
37738 struct rtc_device *rtc;
37739 };
37740 @@ -100,7 +100,7 @@ static unsigned char v3020_mmio_read_bit
37741 return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
37742 }
37743
37744 -static struct v3020_chip_ops v3020_mmio_ops = {
37745 +static const struct v3020_chip_ops v3020_mmio_ops = {
37746 .map_io = v3020_mmio_map,
37747 .unmap_io = v3020_mmio_unmap,
37748 .read_bit = v3020_mmio_read_bit,
37749 @@ -177,7 +177,7 @@ static unsigned char v3020_gpio_read_bit
37750 return bit;
37751 }
37752
37753 -static struct v3020_chip_ops v3020_gpio_ops = {
37754 +static const struct v3020_chip_ops v3020_gpio_ops = {
37755 .map_io = v3020_gpio_map,
37756 .unmap_io = v3020_gpio_unmap,
37757 .read_bit = v3020_gpio_read_bit,
37758 diff -urNp linux-2.6.39.1/drivers/s390/char/con3270.c linux-2.6.39.1/drivers/s390/char/con3270.c
37759 --- linux-2.6.39.1/drivers/s390/char/con3270.c 2011-05-19 00:06:34.000000000 -0400
37760 +++ linux-2.6.39.1/drivers/s390/char/con3270.c 2011-05-22 19:36:32.000000000 -0400
37761 @@ -28,7 +28,7 @@
37762 #define CON3270_OUTPUT_BUFFER_SIZE 1024
37763 #define CON3270_STRING_PAGES 4
37764
37765 -static struct raw3270_fn con3270_fn;
37766 +static const struct raw3270_fn con3270_fn;
37767
37768 /*
37769 * Main 3270 console view data structure.
37770 @@ -413,7 +413,7 @@ con3270_irq(struct con3270 *cp, struct r
37771 }
37772
37773 /* Console view to a 3270 device. */
37774 -static struct raw3270_fn con3270_fn = {
37775 +static const struct raw3270_fn con3270_fn = {
37776 .activate = con3270_activate,
37777 .deactivate = con3270_deactivate,
37778 .intv = (void *) con3270_irq
37779 diff -urNp linux-2.6.39.1/drivers/s390/char/fs3270.c linux-2.6.39.1/drivers/s390/char/fs3270.c
37780 --- linux-2.6.39.1/drivers/s390/char/fs3270.c 2011-05-19 00:06:34.000000000 -0400
37781 +++ linux-2.6.39.1/drivers/s390/char/fs3270.c 2011-05-22 19:36:32.000000000 -0400
37782 @@ -24,7 +24,7 @@
37783 #include "raw3270.h"
37784 #include "ctrlchar.h"
37785
37786 -static struct raw3270_fn fs3270_fn;
37787 +static const struct raw3270_fn fs3270_fn;
37788
37789 struct fs3270 {
37790 struct raw3270_view view;
37791 @@ -413,7 +413,7 @@ fs3270_release(struct raw3270_view *view
37792 }
37793
37794 /* View to a 3270 device. Can be console, tty or fullscreen. */
37795 -static struct raw3270_fn fs3270_fn = {
37796 +static const struct raw3270_fn fs3270_fn = {
37797 .activate = fs3270_activate,
37798 .deactivate = fs3270_deactivate,
37799 .intv = (void *) fs3270_irq,
37800 diff -urNp linux-2.6.39.1/drivers/s390/char/raw3270.c linux-2.6.39.1/drivers/s390/char/raw3270.c
37801 --- linux-2.6.39.1/drivers/s390/char/raw3270.c 2011-05-19 00:06:34.000000000 -0400
37802 +++ linux-2.6.39.1/drivers/s390/char/raw3270.c 2011-05-22 19:36:32.000000000 -0400
37803 @@ -488,7 +488,7 @@ raw3270_init_irq(struct raw3270_view *vi
37804 return RAW3270_IO_DONE;
37805 }
37806
37807 -static struct raw3270_fn raw3270_init_fn = {
37808 +static const struct raw3270_fn raw3270_init_fn = {
37809 .intv = raw3270_init_irq
37810 };
37811
37812 diff -urNp linux-2.6.39.1/drivers/s390/char/tty3270.c linux-2.6.39.1/drivers/s390/char/tty3270.c
37813 --- linux-2.6.39.1/drivers/s390/char/tty3270.c 2011-05-19 00:06:34.000000000 -0400
37814 +++ linux-2.6.39.1/drivers/s390/char/tty3270.c 2011-05-22 19:36:32.000000000 -0400
37815 @@ -37,7 +37,7 @@
37816 struct tty_driver *tty3270_driver;
37817 static int tty3270_max_index;
37818
37819 -static struct raw3270_fn tty3270_fn;
37820 +static const struct raw3270_fn tty3270_fn;
37821
37822 struct tty3270_cell {
37823 unsigned char character;
37824 @@ -834,7 +834,7 @@ tty3270_del_views(void)
37825 }
37826 }
37827
37828 -static struct raw3270_fn tty3270_fn = {
37829 +static const struct raw3270_fn tty3270_fn = {
37830 .activate = tty3270_activate,
37831 .deactivate = tty3270_deactivate,
37832 .intv = (void *) tty3270_irq,
37833 diff -urNp linux-2.6.39.1/drivers/s390/cio/qdio_debug.c linux-2.6.39.1/drivers/s390/cio/qdio_debug.c
37834 --- linux-2.6.39.1/drivers/s390/cio/qdio_debug.c 2011-05-19 00:06:34.000000000 -0400
37835 +++ linux-2.6.39.1/drivers/s390/cio/qdio_debug.c 2011-05-22 19:36:32.000000000 -0400
37836 @@ -225,7 +225,7 @@ static int qperf_seq_open(struct inode *
37837 filp->f_path.dentry->d_inode->i_private);
37838 }
37839
37840 -static struct file_operations debugfs_perf_fops = {
37841 +static const struct file_operations debugfs_perf_fops = {
37842 .owner = THIS_MODULE,
37843 .open = qperf_seq_open,
37844 .read = seq_read,
37845 diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c
37846 --- linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-19 00:06:34.000000000 -0400
37847 +++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-22 19:36:32.000000000 -0400
37848 @@ -415,7 +415,7 @@ out_free:
37849 /**
37850 * The crypto operations for a CEX2A card.
37851 */
37852 -static struct zcrypt_ops zcrypt_cex2a_ops = {
37853 +static const struct zcrypt_ops zcrypt_cex2a_ops = {
37854 .rsa_modexpo = zcrypt_cex2a_modexpo,
37855 .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
37856 };
37857 diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c
37858 --- linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c 2011-05-19 00:06:34.000000000 -0400
37859 +++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c 2011-05-22 19:36:32.000000000 -0400
37860 @@ -347,7 +347,7 @@ out_free:
37861 /**
37862 * The crypto operations for a PCICA card.
37863 */
37864 -static struct zcrypt_ops zcrypt_pcica_ops = {
37865 +static const struct zcrypt_ops zcrypt_pcica_ops = {
37866 .rsa_modexpo = zcrypt_pcica_modexpo,
37867 .rsa_modexpo_crt = zcrypt_pcica_modexpo_crt,
37868 };
37869 diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c
37870 --- linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-19 00:06:34.000000000 -0400
37871 +++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-22 19:36:32.000000000 -0400
37872 @@ -553,7 +553,7 @@ out_free:
37873 /**
37874 * The crypto operations for a PCICC card.
37875 */
37876 -static struct zcrypt_ops zcrypt_pcicc_ops = {
37877 +static const struct zcrypt_ops zcrypt_pcicc_ops = {
37878 .rsa_modexpo = zcrypt_pcicc_modexpo,
37879 .rsa_modexpo_crt = zcrypt_pcicc_modexpo_crt,
37880 };
37881 diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c
37882 --- linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-19 00:06:34.000000000 -0400
37883 +++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-22 19:36:32.000000000 -0400
37884 @@ -851,13 +851,13 @@ static long zcrypt_pcixcc_rng(struct zcr
37885 /**
37886 * The crypto operations for a PCIXCC/CEX2C card.
37887 */
37888 -static struct zcrypt_ops zcrypt_pcixcc_ops = {
37889 +static const struct zcrypt_ops zcrypt_pcixcc_ops = {
37890 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37891 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37892 .send_cprb = zcrypt_pcixcc_send_cprb,
37893 };
37894
37895 -static struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37896 +static const struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37897 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37898 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37899 .send_cprb = zcrypt_pcixcc_send_cprb,
37900 diff -urNp linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c
37901 --- linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c 2011-05-19 00:06:34.000000000 -0400
37902 +++ linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c 2011-05-22 19:36:32.000000000 -0400
37903 @@ -266,7 +266,7 @@ error:
37904 /*
37905 * The config ops structure as defined by virtio config
37906 */
37907 -static struct virtio_config_ops kvm_vq_configspace_ops = {
37908 +static const struct virtio_config_ops kvm_vq_configspace_ops = {
37909 .get_features = kvm_get_features,
37910 .finalize_features = kvm_finalize_features,
37911 .get = kvm_get,
37912 diff -urNp linux-2.6.39.1/drivers/s390/net/qeth_core.h linux-2.6.39.1/drivers/s390/net/qeth_core.h
37913 --- linux-2.6.39.1/drivers/s390/net/qeth_core.h 2011-05-19 00:06:34.000000000 -0400
37914 +++ linux-2.6.39.1/drivers/s390/net/qeth_core.h 2011-05-22 19:36:32.000000000 -0400
37915 @@ -743,7 +743,7 @@ struct qeth_card {
37916 struct qeth_qdio_info qdio;
37917 struct qeth_perf_stats perf_stats;
37918 int read_or_write_problem;
37919 - struct qeth_osn_info osn_info;
37920 + const struct qeth_osn_info osn_info;
37921 struct qeth_discipline discipline;
37922 atomic_t force_alloc_skb;
37923 struct service_level qeth_service_level;
37924 diff -urNp linux-2.6.39.1/drivers/scsi/53c700.c linux-2.6.39.1/drivers/scsi/53c700.c
37925 --- linux-2.6.39.1/drivers/scsi/53c700.c 2011-05-19 00:06:34.000000000 -0400
37926 +++ linux-2.6.39.1/drivers/scsi/53c700.c 2011-05-22 19:36:32.000000000 -0400
37927 @@ -2153,7 +2153,7 @@ EXPORT_SYMBOL(NCR_700_detect);
37928 EXPORT_SYMBOL(NCR_700_release);
37929 EXPORT_SYMBOL(NCR_700_intr);
37930
37931 -static struct spi_function_template NCR_700_transport_functions = {
37932 +static struct spi_function_template NCR_700_transport_functions = {
37933 .set_period = NCR_700_set_period,
37934 .show_period = 1,
37935 .set_offset = NCR_700_set_offset,
37936 diff -urNp linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c
37937 --- linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c 2011-05-19 00:06:34.000000000 -0400
37938 +++ linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c 2011-05-22 19:36:32.000000000 -0400
37939 @@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d
37940 u32 actual_fibsize64, actual_fibsize = 0;
37941 int i;
37942
37943 + pax_track_stack();
37944
37945 if (dev->in_reset) {
37946 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
37947 diff -urNp linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c
37948 --- linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-19 00:06:34.000000000 -0400
37949 +++ linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-22 19:41:37.000000000 -0400
37950 @@ -486,7 +486,7 @@ static ssize_t asd_show_update_bios(stru
37951 flash_error_table[i].reason);
37952 }
37953
37954 -static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
37955 +static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
37956 asd_show_update_bios, asd_store_update_bios);
37957
37958 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
37959 diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c
37960 --- linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c 2011-05-19 00:06:34.000000000 -0400
37961 +++ linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c 2011-05-22 19:36:32.000000000 -0400
37962 @@ -24,7 +24,7 @@ BFA_TRC_FILE(HAL, CORE);
37963 /*
37964 * BFA module list terminated by NULL
37965 */
37966 -static struct bfa_module_s *hal_mods[] = {
37967 +static const struct bfa_module_s *hal_mods[] = {
37968 &hal_mod_sgpg,
37969 &hal_mod_fcport,
37970 &hal_mod_fcxp,
37971 diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfad.c linux-2.6.39.1/drivers/scsi/bfa/bfad.c
37972 --- linux-2.6.39.1/drivers/scsi/bfa/bfad.c 2011-05-19 00:06:34.000000000 -0400
37973 +++ linux-2.6.39.1/drivers/scsi/bfa/bfad.c 2011-05-22 19:36:32.000000000 -0400
37974 @@ -1027,6 +1027,8 @@ bfad_start_ops(struct bfad_s *bfad) {
37975 struct bfad_vport_s *vport, *vport_new;
37976 struct bfa_fcs_driver_info_s driver_info;
37977
37978 + pax_track_stack();
37979 +
37980 /* Fill the driver_info info to fcs*/
37981 memset(&driver_info, 0, sizeof(driver_info));
37982 strncpy(driver_info.version, BFAD_DRIVER_VERSION,
37983 diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c
37984 --- linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c 2011-05-19 00:06:34.000000000 -0400
37985 +++ linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c 2011-05-22 19:36:32.000000000 -0400
37986 @@ -70,7 +70,7 @@ bfa_fcs_attach(struct bfa_fcs_s *fcs, st
37987 bfa_boolean_t min_cfg)
37988 {
37989 int i;
37990 - struct bfa_fcs_mod_s *mod;
37991 + const struct bfa_fcs_mod_s *mod;
37992
37993 fcs->bfa = bfa;
37994 fcs->bfad = bfad;
37995 @@ -93,7 +93,7 @@ void
37996 bfa_fcs_init(struct bfa_fcs_s *fcs)
37997 {
37998 int i, npbc_vports;
37999 - struct bfa_fcs_mod_s *mod;
38000 + const struct bfa_fcs_mod_s *mod;
38001 struct bfi_pbc_vport_s pbc_vports[BFI_PBC_MAX_VPORTS];
38002
38003 for (i = 0; i < sizeof(fcs_modules) / sizeof(fcs_modules[0]); i++) {
38004 @@ -140,7 +140,7 @@ bfa_fcs_driver_info_init(struct bfa_fcs_
38005 void
38006 bfa_fcs_exit(struct bfa_fcs_s *fcs)
38007 {
38008 - struct bfa_fcs_mod_s *mod;
38009 + const struct bfa_fcs_mod_s *mod;
38010 int nmods, i;
38011
38012 bfa_wc_init(&fcs->wc, bfa_fcs_exit_comp, fcs);
38013 diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c
38014 --- linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-19 00:06:34.000000000 -0400
38015 +++ linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-22 19:36:32.000000000 -0400
38016 @@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
38017 u16 len, count;
38018 u16 templen;
38019
38020 + pax_track_stack();
38021 +
38022 /*
38023 * get hba attributes
38024 */
38025 @@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
38026 u8 count = 0;
38027 u16 templen;
38028
38029 + pax_track_stack();
38030 +
38031 /*
38032 * get port attributes
38033 */
38034 diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c
38035 --- linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-19 00:06:34.000000000 -0400
38036 +++ linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-22 19:36:32.000000000 -0400
38037 @@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
38038 struct fc_rpsc_speed_info_s speeds;
38039 struct bfa_port_attr_s pport_attr;
38040
38041 + pax_track_stack();
38042 +
38043 bfa_trc(port->fcs, rx_fchs->s_id);
38044 bfa_trc(port->fcs, rx_fchs->d_id);
38045
38046 diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h
38047 --- linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h 2011-05-19 00:06:34.000000000 -0400
38048 +++ linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h 2011-05-22 19:36:32.000000000 -0400
38049 @@ -68,8 +68,8 @@ enum {
38050 static void bfa_ ## __mod ## _stop(struct bfa_s *bfa); \
38051 static void bfa_ ## __mod ## _iocdisable(struct bfa_s *bfa); \
38052 \
38053 - extern struct bfa_module_s hal_mod_ ## __mod; \
38054 - struct bfa_module_s hal_mod_ ## __mod = { \
38055 + extern const struct bfa_module_s hal_mod_ ## __mod; \
38056 + const struct bfa_module_s hal_mod_ ## __mod = { \
38057 bfa_ ## __mod ## _meminfo, \
38058 bfa_ ## __mod ## _attach, \
38059 bfa_ ## __mod ## _detach, \
38060 @@ -116,12 +116,12 @@ struct bfa_s {
38061 };
38062
38063 extern bfa_boolean_t bfa_auto_recover;
38064 -extern struct bfa_module_s hal_mod_sgpg;
38065 -extern struct bfa_module_s hal_mod_fcport;
38066 -extern struct bfa_module_s hal_mod_fcxp;
38067 -extern struct bfa_module_s hal_mod_lps;
38068 -extern struct bfa_module_s hal_mod_uf;
38069 -extern struct bfa_module_s hal_mod_rport;
38070 -extern struct bfa_module_s hal_mod_fcpim;
38071 +extern const struct bfa_module_s hal_mod_sgpg;
38072 +extern const struct bfa_module_s hal_mod_fcport;
38073 +extern const struct bfa_module_s hal_mod_fcxp;
38074 +extern const struct bfa_module_s hal_mod_lps;
38075 +extern const struct bfa_module_s hal_mod_uf;
38076 +extern const struct bfa_module_s hal_mod_rport;
38077 +extern const struct bfa_module_s hal_mod_fcpim;
38078
38079 #endif /* __BFA_MODULES_H__ */
38080 diff -urNp linux-2.6.39.1/drivers/scsi/BusLogic.c linux-2.6.39.1/drivers/scsi/BusLogic.c
38081 --- linux-2.6.39.1/drivers/scsi/BusLogic.c 2011-05-19 00:06:34.000000000 -0400
38082 +++ linux-2.6.39.1/drivers/scsi/BusLogic.c 2011-05-22 19:36:32.000000000 -0400
38083 @@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
38084 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
38085 *PrototypeHostAdapter)
38086 {
38087 + pax_track_stack();
38088 +
38089 /*
38090 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
38091 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
38092 diff -urNp linux-2.6.39.1/drivers/scsi/dpt_i2o.c linux-2.6.39.1/drivers/scsi/dpt_i2o.c
38093 --- linux-2.6.39.1/drivers/scsi/dpt_i2o.c 2011-05-19 00:06:34.000000000 -0400
38094 +++ linux-2.6.39.1/drivers/scsi/dpt_i2o.c 2011-05-22 19:36:32.000000000 -0400
38095 @@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
38096 dma_addr_t addr;
38097 ulong flags = 0;
38098
38099 + pax_track_stack();
38100 +
38101 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
38102 // get user msg size in u32s
38103 if(get_user(size, &user_msg[0])){
38104 @@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
38105 s32 rcode;
38106 dma_addr_t addr;
38107
38108 + pax_track_stack();
38109 +
38110 memset(msg, 0 , sizeof(msg));
38111 len = scsi_bufflen(cmd);
38112 direction = 0x00000000;
38113 diff -urNp linux-2.6.39.1/drivers/scsi/eata.c linux-2.6.39.1/drivers/scsi/eata.c
38114 --- linux-2.6.39.1/drivers/scsi/eata.c 2011-05-19 00:06:34.000000000 -0400
38115 +++ linux-2.6.39.1/drivers/scsi/eata.c 2011-05-22 19:36:32.000000000 -0400
38116 @@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
38117 struct hostdata *ha;
38118 char name[16];
38119
38120 + pax_track_stack();
38121 +
38122 sprintf(name, "%s%d", driver_name, j);
38123
38124 if (!request_region(port_base, REGION_SIZE, driver_name)) {
38125 diff -urNp linux-2.6.39.1/drivers/scsi/esp_scsi.c linux-2.6.39.1/drivers/scsi/esp_scsi.c
38126 --- linux-2.6.39.1/drivers/scsi/esp_scsi.c 2011-05-19 00:06:34.000000000 -0400
38127 +++ linux-2.6.39.1/drivers/scsi/esp_scsi.c 2011-05-22 19:36:32.000000000 -0400
38128 @@ -2680,7 +2680,7 @@ static void esp_set_width(struct scsi_ta
38129 tp->flags |= ESP_TGT_CHECK_NEGO;
38130 }
38131
38132 -static struct spi_function_template esp_transport_ops = {
38133 +static const struct spi_function_template esp_transport_ops = {
38134 .set_offset = esp_set_offset,
38135 .show_offset = 1,
38136 .set_period = esp_set_period,
38137 diff -urNp linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c
38138 --- linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c 2011-05-19 00:06:34.000000000 -0400
38139 +++ linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c 2011-05-22 19:36:32.000000000 -0400
38140 @@ -138,7 +138,7 @@ static int fcoe_vport_disable(struct fc_
38141 static void fcoe_set_vport_symbolic_name(struct fc_vport *);
38142 static void fcoe_set_port_id(struct fc_lport *, u32, struct fc_frame *);
38143
38144 -static struct libfc_function_template fcoe_libfc_fcn_templ = {
38145 +static const struct libfc_function_template fcoe_libfc_fcn_templ = {
38146 .frame_send = fcoe_xmit,
38147 .ddp_setup = fcoe_ddp_setup,
38148 .ddp_done = fcoe_ddp_done,
38149 diff -urNp linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c
38150 --- linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-19 00:06:34.000000000 -0400
38151 +++ linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-22 19:36:32.000000000 -0400
38152 @@ -1912,7 +1912,7 @@ static void fcoe_ctlr_vn_rport_callback(
38153 mutex_unlock(&fip->ctlr_mutex);
38154 }
38155
38156 -static struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38157 +static const struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38158 .event_callback = fcoe_ctlr_vn_rport_callback,
38159 };
38160
38161 @@ -2458,6 +2458,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
38162 } buf;
38163 int rc;
38164
38165 + pax_track_stack();
38166 +
38167 fiph = (struct fip_header *)skb->data;
38168 sub = fiph->fip_subcode;
38169
38170 diff -urNp linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c
38171 --- linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c 2011-05-19 00:06:34.000000000 -0400
38172 +++ linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c 2011-05-22 19:36:32.000000000 -0400
38173 @@ -69,7 +69,7 @@ module_param(fnic_log_level, int, S_IRUG
38174 MODULE_PARM_DESC(fnic_log_level, "bit mask of fnic logging levels");
38175
38176
38177 -static struct libfc_function_template fnic_transport_template = {
38178 +static const struct libfc_function_template fnic_transport_template = {
38179 .frame_send = fnic_send,
38180 .lport_set_port_id = fnic_set_port_id,
38181 .fcp_abort_io = fnic_empty_scsi_cleanup,
38182 diff -urNp linux-2.6.39.1/drivers/scsi/gdth.c linux-2.6.39.1/drivers/scsi/gdth.c
38183 --- linux-2.6.39.1/drivers/scsi/gdth.c 2011-05-19 00:06:34.000000000 -0400
38184 +++ linux-2.6.39.1/drivers/scsi/gdth.c 2011-05-22 19:36:32.000000000 -0400
38185 @@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
38186 unsigned long flags;
38187 gdth_ha_str *ha;
38188
38189 + pax_track_stack();
38190 +
38191 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
38192 return -EFAULT;
38193 ha = gdth_find_ha(ldrv.ionode);
38194 @@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
38195 gdth_ha_str *ha;
38196 int rval;
38197
38198 + pax_track_stack();
38199 +
38200 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
38201 res.number >= MAX_HDRIVES)
38202 return -EFAULT;
38203 @@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
38204 gdth_ha_str *ha;
38205 int rval;
38206
38207 + pax_track_stack();
38208 +
38209 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
38210 return -EFAULT;
38211 ha = gdth_find_ha(gen.ionode);
38212 @@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
38213 int i;
38214 gdth_cmd_str gdtcmd;
38215 char cmnd[MAX_COMMAND_SIZE];
38216 +
38217 + pax_track_stack();
38218 +
38219 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
38220
38221 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
38222 diff -urNp linux-2.6.39.1/drivers/scsi/gdth_proc.c linux-2.6.39.1/drivers/scsi/gdth_proc.c
38223 --- linux-2.6.39.1/drivers/scsi/gdth_proc.c 2011-05-19 00:06:34.000000000 -0400
38224 +++ linux-2.6.39.1/drivers/scsi/gdth_proc.c 2011-05-22 19:36:32.000000000 -0400
38225 @@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
38226 u64 paddr;
38227
38228 char cmnd[MAX_COMMAND_SIZE];
38229 +
38230 + pax_track_stack();
38231 +
38232 memset(cmnd, 0xff, 12);
38233 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
38234
38235 @@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
38236 gdth_hget_str *phg;
38237 char cmnd[MAX_COMMAND_SIZE];
38238
38239 + pax_track_stack();
38240 +
38241 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
38242 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
38243 if (!gdtcmd || !estr)
38244 diff -urNp linux-2.6.39.1/drivers/scsi/hosts.c linux-2.6.39.1/drivers/scsi/hosts.c
38245 --- linux-2.6.39.1/drivers/scsi/hosts.c 2011-05-19 00:06:34.000000000 -0400
38246 +++ linux-2.6.39.1/drivers/scsi/hosts.c 2011-05-22 19:36:32.000000000 -0400
38247 @@ -42,7 +42,7 @@
38248 #include "scsi_logging.h"
38249
38250
38251 -static atomic_t scsi_host_next_hn; /* host_no for next new host */
38252 +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
38253
38254
38255 static void scsi_host_cls_release(struct device *dev)
38256 @@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct
38257 * subtract one because we increment first then return, but we need to
38258 * know what the next host number was before increment
38259 */
38260 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
38261 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
38262 shost->dma_channel = 0xff;
38263
38264 /* These three are default values which can be overridden */
38265 diff -urNp linux-2.6.39.1/drivers/scsi/hpsa.h linux-2.6.39.1/drivers/scsi/hpsa.h
38266 --- linux-2.6.39.1/drivers/scsi/hpsa.h 2011-05-19 00:06:34.000000000 -0400
38267 +++ linux-2.6.39.1/drivers/scsi/hpsa.h 2011-05-22 19:36:32.000000000 -0400
38268 @@ -347,7 +347,7 @@ static struct access_method SA5_access =
38269 SA5_completed,
38270 };
38271
38272 -static struct access_method SA5_performant_access = {
38273 +static const struct access_method SA5_performant_access = {
38274 SA5_submit_command,
38275 SA5_performant_intr_mask,
38276 SA5_fifo_full,
38277 diff -urNp linux-2.6.39.1/drivers/scsi/hptiop.c linux-2.6.39.1/drivers/scsi/hptiop.c
38278 --- linux-2.6.39.1/drivers/scsi/hptiop.c 2011-05-19 00:06:34.000000000 -0400
38279 +++ linux-2.6.39.1/drivers/scsi/hptiop.c 2011-05-22 19:36:32.000000000 -0400
38280 @@ -1226,7 +1226,7 @@ static void hptiop_remove(struct pci_dev
38281 scsi_host_put(host);
38282 }
38283
38284 -static struct hptiop_adapter_ops hptiop_itl_ops = {
38285 +static const struct hptiop_adapter_ops hptiop_itl_ops = {
38286 .iop_wait_ready = iop_wait_ready_itl,
38287 .internal_memalloc = NULL,
38288 .internal_memfree = NULL,
38289 @@ -1241,7 +1241,7 @@ static struct hptiop_adapter_ops hptiop_
38290 .post_req = hptiop_post_req_itl,
38291 };
38292
38293 -static struct hptiop_adapter_ops hptiop_mv_ops = {
38294 +static const struct hptiop_adapter_ops hptiop_mv_ops = {
38295 .iop_wait_ready = iop_wait_ready_mv,
38296 .internal_memalloc = hptiop_internal_memalloc_mv,
38297 .internal_memfree = hptiop_internal_memfree_mv,
38298 diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c
38299 --- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-19 00:06:34.000000000 -0400
38300 +++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-22 19:36:32.000000000 -0400
38301 @@ -4881,7 +4881,7 @@ static struct vio_device_id ibmvfc_devic
38302 };
38303 MODULE_DEVICE_TABLE(vio, ibmvfc_device_table);
38304
38305 -static struct dev_pm_ops ibmvfc_pm_ops = {
38306 +static const struct dev_pm_ops ibmvfc_pm_ops = {
38307 .resume = ibmvfc_resume
38308 };
38309
38310 diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c
38311 --- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-19 00:06:34.000000000 -0400
38312 +++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-22 19:36:32.000000000 -0400
38313 @@ -104,7 +104,7 @@ static struct scsi_transport_template *i
38314
38315 #define IBMVSCSI_VERSION "1.5.9"
38316
38317 -static struct ibmvscsi_ops *ibmvscsi_ops;
38318 +static const struct ibmvscsi_ops *ibmvscsi_ops;
38319
38320 MODULE_DESCRIPTION("IBM Virtual SCSI");
38321 MODULE_AUTHOR("Dave Boutcher");
38322 @@ -2059,7 +2059,7 @@ static struct vio_device_id ibmvscsi_dev
38323 };
38324 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
38325
38326 -static struct dev_pm_ops ibmvscsi_pm_ops = {
38327 +static const struct dev_pm_ops ibmvscsi_pm_ops = {
38328 .resume = ibmvscsi_resume
38329 };
38330
38331 @@ -2075,7 +2075,7 @@ static struct vio_driver ibmvscsi_driver
38332 }
38333 };
38334
38335 -static struct srp_function_template ibmvscsi_transport_functions = {
38336 +static const struct srp_function_template ibmvscsi_transport_functions = {
38337 };
38338
38339 int __init ibmvscsi_module_init(void)
38340 diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h
38341 --- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-19 00:06:34.000000000 -0400
38342 +++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-22 19:36:32.000000000 -0400
38343 @@ -127,7 +127,7 @@ struct ibmvscsi_ops {
38344 int (*resume) (struct ibmvscsi_host_data *hostdata);
38345 };
38346
38347 -extern struct ibmvscsi_ops iseriesvscsi_ops;
38348 -extern struct ibmvscsi_ops rpavscsi_ops;
38349 +extern const struct ibmvscsi_ops iseriesvscsi_ops;
38350 +extern const struct ibmvscsi_ops rpavscsi_ops;
38351
38352 #endif /* IBMVSCSI_H */
38353 diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c
38354 --- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-19 00:06:34.000000000 -0400
38355 +++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-22 19:36:32.000000000 -0400
38356 @@ -951,7 +951,7 @@ static int get_system_info(void)
38357 return 0;
38358 }
38359
38360 -static struct srp_function_template ibmvstgt_transport_functions = {
38361 +static const struct srp_function_template ibmvstgt_transport_functions = {
38362 .tsk_mgmt_response = ibmvstgt_tsk_mgmt_response,
38363 .it_nexus_response = ibmvstgt_it_nexus_response,
38364 };
38365 diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c
38366 --- linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38367 +++ linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38368 @@ -163,7 +163,7 @@ static int iseriesvscsi_resume(struct ib
38369 return 0;
38370 }
38371
38372 -struct ibmvscsi_ops iseriesvscsi_ops = {
38373 +const struct ibmvscsi_ops iseriesvscsi_ops = {
38374 .init_crq_queue = iseriesvscsi_init_crq_queue,
38375 .release_crq_queue = iseriesvscsi_release_crq_queue,
38376 .reset_crq_queue = iseriesvscsi_reset_crq_queue,
38377 diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c
38378 --- linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38379 +++ linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38380 @@ -358,7 +358,7 @@ static int rpavscsi_resume(struct ibmvsc
38381 return 0;
38382 }
38383
38384 -struct ibmvscsi_ops rpavscsi_ops = {
38385 +const struct ibmvscsi_ops rpavscsi_ops = {
38386 .init_crq_queue = rpavscsi_init_crq_queue,
38387 .release_crq_queue = rpavscsi_release_crq_queue,
38388 .reset_crq_queue = rpavscsi_reset_crq_queue,
38389 diff -urNp linux-2.6.39.1/drivers/scsi/ipr.c linux-2.6.39.1/drivers/scsi/ipr.c
38390 --- linux-2.6.39.1/drivers/scsi/ipr.c 2011-05-19 00:06:34.000000000 -0400
38391 +++ linux-2.6.39.1/drivers/scsi/ipr.c 2011-05-22 19:36:32.000000000 -0400
38392 @@ -6210,7 +6210,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
38393 return true;
38394 }
38395
38396 -static struct ata_port_operations ipr_sata_ops = {
38397 +static const struct ata_port_operations ipr_sata_ops = {
38398 .phy_reset = ipr_ata_phy_reset,
38399 .hardreset = ipr_sata_reset,
38400 .post_internal_cmd = ipr_ata_post_internal,
38401 diff -urNp linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c
38402 --- linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c 2011-05-19 00:06:34.000000000 -0400
38403 +++ linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c 2011-05-22 19:36:32.000000000 -0400
38404 @@ -105,12 +105,12 @@ struct fc_exch_mgr {
38405 * all together if not used XXX
38406 */
38407 struct {
38408 - atomic_t no_free_exch;
38409 - atomic_t no_free_exch_xid;
38410 - atomic_t xid_not_found;
38411 - atomic_t xid_busy;
38412 - atomic_t seq_not_found;
38413 - atomic_t non_bls_resp;
38414 + atomic_unchecked_t no_free_exch;
38415 + atomic_unchecked_t no_free_exch_xid;
38416 + atomic_unchecked_t xid_not_found;
38417 + atomic_unchecked_t xid_busy;
38418 + atomic_unchecked_t seq_not_found;
38419 + atomic_unchecked_t non_bls_resp;
38420 } stats;
38421 };
38422
38423 @@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc(
38424 /* allocate memory for exchange */
38425 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
38426 if (!ep) {
38427 - atomic_inc(&mp->stats.no_free_exch);
38428 + atomic_inc_unchecked(&mp->stats.no_free_exch);
38429 goto out;
38430 }
38431 memset(ep, 0, sizeof(*ep));
38432 @@ -761,7 +761,7 @@ out:
38433 return ep;
38434 err:
38435 spin_unlock_bh(&pool->lock);
38436 - atomic_inc(&mp->stats.no_free_exch_xid);
38437 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
38438 mempool_free(ep, mp->ep_pool);
38439 return NULL;
38440 }
38441 @@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38442 xid = ntohs(fh->fh_ox_id); /* we originated exch */
38443 ep = fc_exch_find(mp, xid);
38444 if (!ep) {
38445 - atomic_inc(&mp->stats.xid_not_found);
38446 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38447 reject = FC_RJT_OX_ID;
38448 goto out;
38449 }
38450 @@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38451 ep = fc_exch_find(mp, xid);
38452 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
38453 if (ep) {
38454 - atomic_inc(&mp->stats.xid_busy);
38455 + atomic_inc_unchecked(&mp->stats.xid_busy);
38456 reject = FC_RJT_RX_ID;
38457 goto rel;
38458 }
38459 @@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38460 }
38461 xid = ep->xid; /* get our XID */
38462 } else if (!ep) {
38463 - atomic_inc(&mp->stats.xid_not_found);
38464 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38465 reject = FC_RJT_RX_ID; /* XID not found */
38466 goto out;
38467 }
38468 @@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38469 } else {
38470 sp = &ep->seq;
38471 if (sp->id != fh->fh_seq_id) {
38472 - atomic_inc(&mp->stats.seq_not_found);
38473 + atomic_inc_unchecked(&mp->stats.seq_not_found);
38474 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
38475 goto rel;
38476 }
38477 @@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct
38478
38479 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
38480 if (!ep) {
38481 - atomic_inc(&mp->stats.xid_not_found);
38482 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38483 goto out;
38484 }
38485 if (ep->esb_stat & ESB_ST_COMPLETE) {
38486 - atomic_inc(&mp->stats.xid_not_found);
38487 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38488 goto rel;
38489 }
38490 if (ep->rxid == FC_XID_UNKNOWN)
38491 ep->rxid = ntohs(fh->fh_rx_id);
38492 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
38493 - atomic_inc(&mp->stats.xid_not_found);
38494 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38495 goto rel;
38496 }
38497 if (ep->did != ntoh24(fh->fh_s_id) &&
38498 ep->did != FC_FID_FLOGI) {
38499 - atomic_inc(&mp->stats.xid_not_found);
38500 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38501 goto rel;
38502 }
38503 sof = fr_sof(fp);
38504 @@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct
38505 sp->ssb_stat |= SSB_ST_RESP;
38506 sp->id = fh->fh_seq_id;
38507 } else if (sp->id != fh->fh_seq_id) {
38508 - atomic_inc(&mp->stats.seq_not_found);
38509 + atomic_inc_unchecked(&mp->stats.seq_not_found);
38510 goto rel;
38511 }
38512
38513 @@ -1479,9 +1479,9 @@ static void fc_exch_recv_resp(struct fc_
38514 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
38515
38516 if (!sp)
38517 - atomic_inc(&mp->stats.xid_not_found);
38518 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38519 else
38520 - atomic_inc(&mp->stats.non_bls_resp);
38521 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
38522
38523 fc_frame_free(fp);
38524 }
38525 diff -urNp linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c
38526 --- linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c 2011-05-19 00:06:34.000000000 -0400
38527 +++ linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c 2011-05-22 19:36:32.000000000 -0400
38528 @@ -1299,7 +1299,7 @@ static void fc_lport_enter_ns(struct fc_
38529 fc_lport_error(lport, fp);
38530 }
38531
38532 -static struct fc_rport_operations fc_lport_rport_ops = {
38533 +static const struct fc_rport_operations fc_lport_rport_ops = {
38534 .event_callback = fc_lport_rport_callback,
38535 };
38536
38537 diff -urNp linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c
38538 --- linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c 2011-05-19 00:06:34.000000000 -0400
38539 +++ linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c 2011-05-22 19:36:32.000000000 -0400
38540 @@ -256,7 +256,7 @@ static void fc_rport_work(struct work_st
38541 struct fc_rport_libfc_priv *rpriv;
38542 enum fc_rport_event event;
38543 struct fc_lport *lport = rdata->local_port;
38544 - struct fc_rport_operations *rport_ops;
38545 + const struct fc_rport_operations *rport_ops;
38546 struct fc_rport_identifiers ids;
38547 struct fc_rport *rport;
38548 struct fc4_prov *prov;
38549 diff -urNp linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c
38550 --- linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c 2011-05-19 00:06:34.000000000 -0400
38551 +++ linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c 2011-05-22 19:36:32.000000000 -0400
38552 @@ -307,14 +307,14 @@ static void sas_ata_post_internal(struct
38553 }
38554 }
38555
38556 -static struct ata_port_operations sas_sata_ops = {
38557 +static const struct ata_port_operations sas_sata_ops = {
38558 .prereset = ata_std_prereset,
38559 .softreset = NULL,
38560 .hardreset = sas_ata_hard_reset,
38561 .postreset = ata_std_postreset,
38562 .error_handler = ata_std_error_handler,
38563 .post_internal_cmd = sas_ata_post_internal,
38564 - .qc_defer = ata_std_qc_defer,
38565 + .qc_defer = ata_std_qc_defer,
38566 .qc_prep = ata_noop_qc_prep,
38567 .qc_issue = sas_ata_qc_issue,
38568 .qc_fill_rtf = sas_ata_qc_fill_rtf,
38569 diff -urNp linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c
38570 --- linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-19 00:06:34.000000000 -0400
38571 +++ linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-22 19:36:32.000000000 -0400
38572 @@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_
38573
38574 #include <linux/debugfs.h>
38575
38576 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38577 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38578 static unsigned long lpfc_debugfs_start_time = 0L;
38579
38580 /* iDiag */
38581 @@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
38582 lpfc_debugfs_enable = 0;
38583
38584 len = 0;
38585 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
38586 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
38587 (lpfc_debugfs_max_disc_trc - 1);
38588 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
38589 dtp = vport->disc_trc + i;
38590 @@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
38591 lpfc_debugfs_enable = 0;
38592
38593 len = 0;
38594 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
38595 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
38596 (lpfc_debugfs_max_slow_ring_trc - 1);
38597 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
38598 dtp = phba->slow_ring_trc + i;
38599 @@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
38600 uint32_t *ptr;
38601 char buffer[1024];
38602
38603 + pax_track_stack();
38604 +
38605 off = 0;
38606 spin_lock_irq(&phba->hbalock);
38607
38608 @@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
38609 !vport || !vport->disc_trc)
38610 return;
38611
38612 - index = atomic_inc_return(&vport->disc_trc_cnt) &
38613 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
38614 (lpfc_debugfs_max_disc_trc - 1);
38615 dtp = vport->disc_trc + index;
38616 dtp->fmt = fmt;
38617 dtp->data1 = data1;
38618 dtp->data2 = data2;
38619 dtp->data3 = data3;
38620 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38621 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38622 dtp->jif = jiffies;
38623 #endif
38624 return;
38625 @@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
38626 !phba || !phba->slow_ring_trc)
38627 return;
38628
38629 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
38630 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
38631 (lpfc_debugfs_max_slow_ring_trc - 1);
38632 dtp = phba->slow_ring_trc + index;
38633 dtp->fmt = fmt;
38634 dtp->data1 = data1;
38635 dtp->data2 = data2;
38636 dtp->data3 = data3;
38637 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38638 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38639 dtp->jif = jiffies;
38640 #endif
38641 return;
38642 @@ -2145,7 +2147,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38643 "slow_ring buffer\n");
38644 goto debug_failed;
38645 }
38646 - atomic_set(&phba->slow_ring_trc_cnt, 0);
38647 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
38648 memset(phba->slow_ring_trc, 0,
38649 (sizeof(struct lpfc_debugfs_trc) *
38650 lpfc_debugfs_max_slow_ring_trc));
38651 @@ -2191,7 +2193,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38652 "buffer\n");
38653 goto debug_failed;
38654 }
38655 - atomic_set(&vport->disc_trc_cnt, 0);
38656 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
38657
38658 snprintf(name, sizeof(name), "discovery_trace");
38659 vport->debug_disc_trc =
38660 diff -urNp linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h
38661 --- linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h 2011-05-19 00:06:34.000000000 -0400
38662 +++ linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h 2011-05-22 19:36:32.000000000 -0400
38663 @@ -419,7 +419,7 @@ struct lpfc_vport {
38664 struct dentry *debug_nodelist;
38665 struct dentry *vport_debugfs_root;
38666 struct lpfc_debugfs_trc *disc_trc;
38667 - atomic_t disc_trc_cnt;
38668 + atomic_unchecked_t disc_trc_cnt;
38669 #endif
38670 uint8_t stat_data_enabled;
38671 uint8_t stat_data_blocked;
38672 @@ -785,8 +785,8 @@ struct lpfc_hba {
38673 struct timer_list fabric_block_timer;
38674 unsigned long bit_flags;
38675 #define FABRIC_COMANDS_BLOCKED 0
38676 - atomic_t num_rsrc_err;
38677 - atomic_t num_cmd_success;
38678 + atomic_unchecked_t num_rsrc_err;
38679 + atomic_unchecked_t num_cmd_success;
38680 unsigned long last_rsrc_error_time;
38681 unsigned long last_ramp_down_time;
38682 unsigned long last_ramp_up_time;
38683 @@ -800,7 +800,7 @@ struct lpfc_hba {
38684 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
38685 struct dentry *debug_slow_ring_trc;
38686 struct lpfc_debugfs_trc *slow_ring_trc;
38687 - atomic_t slow_ring_trc_cnt;
38688 + atomic_unchecked_t slow_ring_trc_cnt;
38689 /* iDiag debugfs sub-directory */
38690 struct dentry *idiag_root;
38691 struct dentry *idiag_pci_cfg;
38692 diff -urNp linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c
38693 --- linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-19 00:06:34.000000000 -0400
38694 +++ linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-22 19:36:32.000000000 -0400
38695 @@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
38696 uint32_t evt_posted;
38697
38698 spin_lock_irqsave(&phba->hbalock, flags);
38699 - atomic_inc(&phba->num_rsrc_err);
38700 + atomic_inc_unchecked(&phba->num_rsrc_err);
38701 phba->last_rsrc_error_time = jiffies;
38702
38703 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
38704 @@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
38705 unsigned long flags;
38706 struct lpfc_hba *phba = vport->phba;
38707 uint32_t evt_posted;
38708 - atomic_inc(&phba->num_cmd_success);
38709 + atomic_inc_unchecked(&phba->num_cmd_success);
38710
38711 if (vport->cfg_lun_queue_depth <= queue_depth)
38712 return;
38713 @@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38714 unsigned long num_rsrc_err, num_cmd_success;
38715 int i;
38716
38717 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
38718 - num_cmd_success = atomic_read(&phba->num_cmd_success);
38719 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
38720 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
38721
38722 vports = lpfc_create_vport_work_array(phba);
38723 if (vports != NULL)
38724 @@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38725 }
38726 }
38727 lpfc_destroy_vport_work_array(phba, vports);
38728 - atomic_set(&phba->num_rsrc_err, 0);
38729 - atomic_set(&phba->num_cmd_success, 0);
38730 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
38731 + atomic_set_unchecked(&phba->num_cmd_success, 0);
38732 }
38733
38734 /**
38735 @@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
38736 }
38737 }
38738 lpfc_destroy_vport_work_array(phba, vports);
38739 - atomic_set(&phba->num_rsrc_err, 0);
38740 - atomic_set(&phba->num_cmd_success, 0);
38741 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
38742 + atomic_set_unchecked(&phba->num_cmd_success, 0);
38743 }
38744
38745 /**
38746 diff -urNp linux-2.6.39.1/drivers/scsi/mac_esp.c linux-2.6.39.1/drivers/scsi/mac_esp.c
38747 --- linux-2.6.39.1/drivers/scsi/mac_esp.c 2011-05-19 00:06:34.000000000 -0400
38748 +++ linux-2.6.39.1/drivers/scsi/mac_esp.c 2011-05-22 19:36:32.000000000 -0400
38749 @@ -473,7 +473,7 @@ static irqreturn_t mac_scsi_esp_intr(int
38750 return IRQ_HANDLED;
38751 }
38752
38753 -static struct esp_driver_ops mac_esp_ops = {
38754 +static const struct esp_driver_ops mac_esp_ops = {
38755 .esp_write8 = mac_esp_write8,
38756 .esp_read8 = mac_esp_read8,
38757 .map_single = mac_esp_map_single,
38758 diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c
38759 --- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-19 00:06:34.000000000 -0400
38760 +++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-22 19:36:32.000000000 -0400
38761 @@ -3510,6 +3510,8 @@ megaraid_cmm_register(adapter_t *adapter
38762 int rval;
38763 int i;
38764
38765 + pax_track_stack();
38766 +
38767 // Allocate memory for the base list of scb for management module.
38768 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
38769
38770 diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c
38771 --- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-19 00:06:34.000000000 -0400
38772 +++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-22 19:36:32.000000000 -0400
38773 @@ -366,7 +366,7 @@ megasas_check_reset_xscale(struct megasa
38774 return 0;
38775 }
38776
38777 -static struct megasas_instance_template megasas_instance_template_xscale = {
38778 +static const struct megasas_instance_template megasas_instance_template_xscale = {
38779
38780 .fire_cmd = megasas_fire_cmd_xscale,
38781 .enable_intr = megasas_enable_intr_xscale,
38782 @@ -497,7 +497,7 @@ megasas_check_reset_ppc(struct megasas_i
38783 {
38784 return 0;
38785 }
38786 -static struct megasas_instance_template megasas_instance_template_ppc = {
38787 +static const struct megasas_instance_template megasas_instance_template_ppc = {
38788
38789 .fire_cmd = megasas_fire_cmd_ppc,
38790 .enable_intr = megasas_enable_intr_ppc,
38791 @@ -623,7 +623,7 @@ megasas_check_reset_skinny(struct megasa
38792 return 0;
38793 }
38794
38795 -static struct megasas_instance_template megasas_instance_template_skinny = {
38796 +static const struct megasas_instance_template megasas_instance_template_skinny = {
38797
38798 .fire_cmd = megasas_fire_cmd_skinny,
38799 .enable_intr = megasas_enable_intr_skinny,
38800 @@ -810,7 +810,7 @@ megasas_check_reset_gen2(struct megasas_
38801 return 0;
38802 }
38803
38804 -static struct megasas_instance_template megasas_instance_template_gen2 = {
38805 +static const struct megasas_instance_template megasas_instance_template_gen2 = {
38806
38807 .fire_cmd = megasas_fire_cmd_gen2,
38808 .enable_intr = megasas_enable_intr_gen2,
38809 @@ -834,7 +834,7 @@ static struct megasas_instance_template
38810 /*
38811 * Template added for TB (Fusion)
38812 */
38813 -extern struct megasas_instance_template megasas_instance_template_fusion;
38814 +extern const struct megasas_instance_template megasas_instance_template_fusion;
38815
38816 /**
38817 * megasas_issue_polled - Issues a polling command
38818 diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c
38819 --- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-19 00:06:34.000000000 -0400
38820 +++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-22 19:36:32.000000000 -0400
38821 @@ -2236,7 +2236,7 @@ void megasas_fusion_ocr_wq(struct work_s
38822 megasas_reset_fusion(instance->host);
38823 }
38824
38825 -struct megasas_instance_template megasas_instance_template_fusion = {
38826 +const struct megasas_instance_template megasas_instance_template_fusion = {
38827 .fire_cmd = megasas_fire_cmd_fusion,
38828 .enable_intr = megasas_enable_intr_fusion,
38829 .disable_intr = megasas_disable_intr_fusion,
38830 diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h
38831 --- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h 2011-05-19 00:06:34.000000000 -0400
38832 +++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h 2011-05-22 19:36:32.000000000 -0400
38833 @@ -1330,7 +1330,7 @@ struct megasas_instance {
38834 atomic_t fw_outstanding;
38835 atomic_t fw_reset_no_pci_access;
38836
38837 - struct megasas_instance_template *instancet;
38838 + const struct megasas_instance_template *instancet;
38839 struct tasklet_struct isr_tasklet;
38840 struct work_struct work_init;
38841
38842 diff -urNp linux-2.6.39.1/drivers/scsi/ncr53c8xx.c linux-2.6.39.1/drivers/scsi/ncr53c8xx.c
38843 --- linux-2.6.39.1/drivers/scsi/ncr53c8xx.c 2011-05-19 00:06:34.000000000 -0400
38844 +++ linux-2.6.39.1/drivers/scsi/ncr53c8xx.c 2011-05-22 19:36:32.000000000 -0400
38845 @@ -8606,7 +8606,7 @@ static void ncr53c8xx_get_signalling(str
38846 spi_signalling(shost) = type;
38847 }
38848
38849 -static struct spi_function_template ncr53c8xx_transport_functions = {
38850 +static struct spi_function_template ncr53c8xx_transport_functions = {
38851 .set_period = ncr53c8xx_set_period,
38852 .show_period = 1,
38853 .set_offset = ncr53c8xx_set_offset,
38854 diff -urNp linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c
38855 --- linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c 2011-05-19 00:06:34.000000000 -0400
38856 +++ linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c 2011-05-22 19:36:32.000000000 -0400
38857 @@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
38858 int nelem = ARRAY_SIZE(get_attrs), a = 0;
38859 int ret;
38860
38861 + pax_track_stack();
38862 +
38863 or = osd_start_request(od, GFP_KERNEL);
38864 if (!or)
38865 return -ENOMEM;
38866 diff -urNp linux-2.6.39.1/drivers/scsi/pmcraid.c linux-2.6.39.1/drivers/scsi/pmcraid.c
38867 --- linux-2.6.39.1/drivers/scsi/pmcraid.c 2011-05-19 00:06:34.000000000 -0400
38868 +++ linux-2.6.39.1/drivers/scsi/pmcraid.c 2011-05-22 19:36:32.000000000 -0400
38869 @@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
38870 res->scsi_dev = scsi_dev;
38871 scsi_dev->hostdata = res;
38872 res->change_detected = 0;
38873 - atomic_set(&res->read_failures, 0);
38874 - atomic_set(&res->write_failures, 0);
38875 + atomic_set_unchecked(&res->read_failures, 0);
38876 + atomic_set_unchecked(&res->write_failures, 0);
38877 rc = 0;
38878 }
38879 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
38880 @@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct
38881
38882 /* If this was a SCSI read/write command keep count of errors */
38883 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
38884 - atomic_inc(&res->read_failures);
38885 + atomic_inc_unchecked(&res->read_failures);
38886 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
38887 - atomic_inc(&res->write_failures);
38888 + atomic_inc_unchecked(&res->write_failures);
38889
38890 if (!RES_IS_GSCSI(res->cfg_entry) &&
38891 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
38892 @@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
38893 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38894 * hrrq_id assigned here in queuecommand
38895 */
38896 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38897 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38898 pinstance->num_hrrq;
38899 cmd->cmd_done = pmcraid_io_done;
38900
38901 @@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
38902 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38903 * hrrq_id assigned here in queuecommand
38904 */
38905 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38906 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38907 pinstance->num_hrrq;
38908
38909 if (request_size) {
38910 @@ -4495,7 +4495,7 @@ static void pmcraid_worker_function(stru
38911
38912 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
38913 /* add resources only after host is added into system */
38914 - if (!atomic_read(&pinstance->expose_resources))
38915 + if (!atomic_read_unchecked(&pinstance->expose_resources))
38916 return;
38917
38918 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
38919 @@ -5329,8 +5329,8 @@ static int __devinit pmcraid_init_instan
38920 init_waitqueue_head(&pinstance->reset_wait_q);
38921
38922 atomic_set(&pinstance->outstanding_cmds, 0);
38923 - atomic_set(&pinstance->last_message_id, 0);
38924 - atomic_set(&pinstance->expose_resources, 0);
38925 + atomic_set_unchecked(&pinstance->last_message_id, 0);
38926 + atomic_set_unchecked(&pinstance->expose_resources, 0);
38927
38928 INIT_LIST_HEAD(&pinstance->free_res_q);
38929 INIT_LIST_HEAD(&pinstance->used_res_q);
38930 @@ -6045,7 +6045,7 @@ static int __devinit pmcraid_probe(
38931 /* Schedule worker thread to handle CCN and take care of adding and
38932 * removing devices to OS
38933 */
38934 - atomic_set(&pinstance->expose_resources, 1);
38935 + atomic_set_unchecked(&pinstance->expose_resources, 1);
38936 schedule_work(&pinstance->worker_q);
38937 return rc;
38938
38939 diff -urNp linux-2.6.39.1/drivers/scsi/pmcraid.h linux-2.6.39.1/drivers/scsi/pmcraid.h
38940 --- linux-2.6.39.1/drivers/scsi/pmcraid.h 2011-05-19 00:06:34.000000000 -0400
38941 +++ linux-2.6.39.1/drivers/scsi/pmcraid.h 2011-05-22 19:36:32.000000000 -0400
38942 @@ -750,7 +750,7 @@ struct pmcraid_instance {
38943 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
38944
38945 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
38946 - atomic_t last_message_id;
38947 + atomic_unchecked_t last_message_id;
38948
38949 /* configuration table */
38950 struct pmcraid_config_table *cfg_table;
38951 @@ -779,7 +779,7 @@ struct pmcraid_instance {
38952 atomic_t outstanding_cmds;
38953
38954 /* should add/delete resources to mid-layer now ?*/
38955 - atomic_t expose_resources;
38956 + atomic_unchecked_t expose_resources;
38957
38958
38959
38960 @@ -815,8 +815,8 @@ struct pmcraid_resource_entry {
38961 struct pmcraid_config_table_entry_ext cfg_entry_ext;
38962 };
38963 struct scsi_device *scsi_dev; /* Link scsi_device structure */
38964 - atomic_t read_failures; /* count of failed READ commands */
38965 - atomic_t write_failures; /* count of failed WRITE commands */
38966 + atomic_unchecked_t read_failures; /* count of failed READ commands */
38967 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
38968
38969 /* To indicate add/delete/modify during CCN */
38970 u8 change_detected;
38971 diff -urNp linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c
38972 --- linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c 2011-06-03 00:04:14.000000000 -0400
38973 +++ linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c 2011-06-03 00:32:06.000000000 -0400
38974 @@ -4103,7 +4103,7 @@ static struct pci_driver qla2xxx_pci_dri
38975 .err_handler = &qla2xxx_err_handler,
38976 };
38977
38978 -static struct file_operations apidev_fops = {
38979 +static const struct file_operations apidev_fops = {
38980 .owner = THIS_MODULE,
38981 .llseek = noop_llseek,
38982 };
38983 diff -urNp linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h
38984 --- linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h 2011-05-19 00:06:34.000000000 -0400
38985 +++ linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h 2011-05-22 19:36:32.000000000 -0400
38986 @@ -256,7 +256,7 @@ struct ddb_entry {
38987 atomic_t retry_relogin_timer; /* Min Time between relogins
38988 * (4000 only) */
38989 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
38990 - atomic_t relogin_retry_count; /* Num of times relogin has been
38991 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
38992 * retried */
38993
38994 uint16_t port;
38995 diff -urNp linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c
38996 --- linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c 2011-05-19 00:06:34.000000000 -0400
38997 +++ linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c 2011-05-22 19:36:32.000000000 -0400
38998 @@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
38999 ddb_entry->fw_ddb_index = fw_ddb_index;
39000 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
39001 atomic_set(&ddb_entry->relogin_timer, 0);
39002 - atomic_set(&ddb_entry->relogin_retry_count, 0);
39003 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
39004 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
39005 list_add_tail(&ddb_entry->list, &ha->ddb_list);
39006 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
39007 @@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s
39008 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
39009 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
39010 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
39011 - atomic_set(&ddb_entry->relogin_retry_count, 0);
39012 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
39013 atomic_set(&ddb_entry->relogin_timer, 0);
39014 clear_bit(DF_RELOGIN, &ddb_entry->flags);
39015 iscsi_unblock_session(ddb_entry->sess);
39016 diff -urNp linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c
39017 --- linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c 2011-05-19 00:06:34.000000000 -0400
39018 +++ linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c 2011-05-22 19:36:32.000000000 -0400
39019 @@ -802,13 +802,13 @@ static void qla4xxx_timer(struct scsi_ql
39020 ddb_entry->fw_ddb_device_state ==
39021 DDB_DS_SESSION_FAILED) {
39022 /* Reset retry relogin timer */
39023 - atomic_inc(&ddb_entry->relogin_retry_count);
39024 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
39025 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
39026 " timed out-retrying"
39027 " relogin (%d)\n",
39028 ha->host_no,
39029 ddb_entry->fw_ddb_index,
39030 - atomic_read(&ddb_entry->
39031 + atomic_read_unchecked(&ddb_entry->
39032 relogin_retry_count))
39033 );
39034 start_dpc++;
39035 diff -urNp linux-2.6.39.1/drivers/scsi/scsi.c linux-2.6.39.1/drivers/scsi/scsi.c
39036 --- linux-2.6.39.1/drivers/scsi/scsi.c 2011-05-19 00:06:34.000000000 -0400
39037 +++ linux-2.6.39.1/drivers/scsi/scsi.c 2011-05-22 19:36:32.000000000 -0400
39038 @@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
39039 unsigned long timeout;
39040 int rtn = 0;
39041
39042 - atomic_inc(&cmd->device->iorequest_cnt);
39043 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
39044
39045 /* check if the device is still usable */
39046 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
39047 diff -urNp linux-2.6.39.1/drivers/scsi/scsi_debug.c linux-2.6.39.1/drivers/scsi/scsi_debug.c
39048 --- linux-2.6.39.1/drivers/scsi/scsi_debug.c 2011-05-19 00:06:34.000000000 -0400
39049 +++ linux-2.6.39.1/drivers/scsi/scsi_debug.c 2011-05-22 19:36:32.000000000 -0400
39050 @@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_
39051 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
39052 unsigned char *cmd = (unsigned char *)scp->cmnd;
39053
39054 + pax_track_stack();
39055 +
39056 if ((errsts = check_readiness(scp, 1, devip)))
39057 return errsts;
39058 memset(arr, 0, sizeof(arr));
39059 @@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm
39060 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
39061 unsigned char *cmd = (unsigned char *)scp->cmnd;
39062
39063 + pax_track_stack();
39064 +
39065 if ((errsts = check_readiness(scp, 1, devip)))
39066 return errsts;
39067 memset(arr, 0, sizeof(arr));
39068 diff -urNp linux-2.6.39.1/drivers/scsi/scsi_lib.c linux-2.6.39.1/drivers/scsi/scsi_lib.c
39069 --- linux-2.6.39.1/drivers/scsi/scsi_lib.c 2011-05-19 00:06:34.000000000 -0400
39070 +++ linux-2.6.39.1/drivers/scsi/scsi_lib.c 2011-05-22 19:36:32.000000000 -0400
39071 @@ -1410,7 +1410,7 @@ static void scsi_kill_request(struct req
39072 shost = sdev->host;
39073 scsi_init_cmd_errh(cmd);
39074 cmd->result = DID_NO_CONNECT << 16;
39075 - atomic_inc(&cmd->device->iorequest_cnt);
39076 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
39077
39078 /*
39079 * SCSI request completion path will do scsi_device_unbusy(),
39080 @@ -1436,9 +1436,9 @@ static void scsi_softirq_done(struct req
39081
39082 INIT_LIST_HEAD(&cmd->eh_entry);
39083
39084 - atomic_inc(&cmd->device->iodone_cnt);
39085 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
39086 if (cmd->result)
39087 - atomic_inc(&cmd->device->ioerr_cnt);
39088 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
39089
39090 disposition = scsi_decide_disposition(cmd);
39091 if (disposition != SUCCESS &&
39092 diff -urNp linux-2.6.39.1/drivers/scsi/scsi_sysfs.c linux-2.6.39.1/drivers/scsi/scsi_sysfs.c
39093 --- linux-2.6.39.1/drivers/scsi/scsi_sysfs.c 2011-05-19 00:06:34.000000000 -0400
39094 +++ linux-2.6.39.1/drivers/scsi/scsi_sysfs.c 2011-05-22 19:36:32.000000000 -0400
39095 @@ -621,7 +621,7 @@ show_iostat_##field(struct device *dev,
39096 char *buf) \
39097 { \
39098 struct scsi_device *sdev = to_scsi_device(dev); \
39099 - unsigned long long count = atomic_read(&sdev->field); \
39100 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
39101 return snprintf(buf, 20, "0x%llx\n", count); \
39102 } \
39103 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
39104 diff -urNp linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c
39105 --- linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c 2011-05-19 00:06:34.000000000 -0400
39106 +++ linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c 2011-05-22 19:36:32.000000000 -0400
39107 @@ -485,7 +485,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
39108 * Netlink Infrastructure
39109 */
39110
39111 -static atomic_t fc_event_seq;
39112 +static atomic_unchecked_t fc_event_seq;
39113
39114 /**
39115 * fc_get_event_number - Obtain the next sequential FC event number
39116 @@ -498,7 +498,7 @@ static atomic_t fc_event_seq;
39117 u32
39118 fc_get_event_number(void)
39119 {
39120 - return atomic_add_return(1, &fc_event_seq);
39121 + return atomic_add_return_unchecked(1, &fc_event_seq);
39122 }
39123 EXPORT_SYMBOL(fc_get_event_number);
39124
39125 @@ -646,7 +646,7 @@ static __init int fc_transport_init(void
39126 {
39127 int error;
39128
39129 - atomic_set(&fc_event_seq, 0);
39130 + atomic_set_unchecked(&fc_event_seq, 0);
39131
39132 error = transport_class_register(&fc_host_class);
39133 if (error)
39134 @@ -836,7 +836,7 @@ static int fc_str_to_dev_loss(const char
39135 char *cp;
39136
39137 *val = simple_strtoul(buf, &cp, 0);
39138 - if ((*cp && (*cp != '\n')) || (*val < 0))
39139 + if (*cp && (*cp != '\n'))
39140 return -EINVAL;
39141 /*
39142 * Check for overflow; dev_loss_tmo is u32
39143 diff -urNp linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c
39144 --- linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c 2011-05-19 00:06:34.000000000 -0400
39145 +++ linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c 2011-05-22 19:36:32.000000000 -0400
39146 @@ -83,7 +83,7 @@ struct iscsi_internal {
39147 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
39148 };
39149
39150 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
39151 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
39152 static struct workqueue_struct *iscsi_eh_timer_workq;
39153
39154 /*
39155 @@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
39156 int err;
39157
39158 ihost = shost->shost_data;
39159 - session->sid = atomic_add_return(1, &iscsi_session_nr);
39160 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
39161
39162 if (id == ISCSI_MAX_TARGET) {
39163 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
39164 @@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v
39165 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
39166 ISCSI_TRANSPORT_VERSION);
39167
39168 - atomic_set(&iscsi_session_nr, 0);
39169 + atomic_set_unchecked(&iscsi_session_nr, 0);
39170
39171 err = class_register(&iscsi_transport_class);
39172 if (err)
39173 diff -urNp linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c
39174 --- linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c 2011-05-19 00:06:34.000000000 -0400
39175 +++ linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c 2011-05-22 19:36:32.000000000 -0400
39176 @@ -33,7 +33,7 @@
39177 #include "scsi_transport_srp_internal.h"
39178
39179 struct srp_host_attrs {
39180 - atomic_t next_port_id;
39181 + atomic_unchecked_t next_port_id;
39182 };
39183 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
39184
39185 @@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
39186 struct Scsi_Host *shost = dev_to_shost(dev);
39187 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
39188
39189 - atomic_set(&srp_host->next_port_id, 0);
39190 + atomic_set_unchecked(&srp_host->next_port_id, 0);
39191 return 0;
39192 }
39193
39194 @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
39195 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
39196 rport->roles = ids->roles;
39197
39198 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
39199 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
39200 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
39201
39202 transport_setup_device(&rport->dev);
39203 diff -urNp linux-2.6.39.1/drivers/scsi/sg.c linux-2.6.39.1/drivers/scsi/sg.c
39204 --- linux-2.6.39.1/drivers/scsi/sg.c 2011-05-19 00:06:34.000000000 -0400
39205 +++ linux-2.6.39.1/drivers/scsi/sg.c 2011-05-22 19:36:32.000000000 -0400
39206 @@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
39207 const struct file_operations * fops;
39208 };
39209
39210 -static struct sg_proc_leaf sg_proc_leaf_arr[] = {
39211 +static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
39212 {"allow_dio", &adio_fops},
39213 {"debug", &debug_fops},
39214 {"def_reserved_size", &dressz_fops},
39215 @@ -2325,7 +2325,7 @@ sg_proc_init(void)
39216 {
39217 int k, mask;
39218 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
39219 - struct sg_proc_leaf * leaf;
39220 + const struct sg_proc_leaf * leaf;
39221
39222 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
39223 if (!sg_proc_sgp)
39224 diff -urNp linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c
39225 --- linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-19 00:06:34.000000000 -0400
39226 +++ linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-22 19:36:32.000000000 -0400
39227 @@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
39228 int do_iounmap = 0;
39229 int do_disable_device = 1;
39230
39231 + pax_track_stack();
39232 +
39233 memset(&sym_dev, 0, sizeof(sym_dev));
39234 memset(&nvram, 0, sizeof(nvram));
39235 sym_dev.pdev = pdev;
39236 diff -urNp linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c
39237 --- linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c 2011-05-19 00:06:34.000000000 -0400
39238 +++ linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c 2011-05-22 19:36:32.000000000 -0400
39239 @@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
39240 dma_addr_t base;
39241 unsigned i;
39242
39243 + pax_track_stack();
39244 +
39245 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
39246 cmd.reqRingNumPages = adapter->req_pages;
39247 cmd.cmpRingNumPages = adapter->cmp_pages;
39248 diff -urNp linux-2.6.39.1/drivers/sh/clk/cpg.c linux-2.6.39.1/drivers/sh/clk/cpg.c
39249 --- linux-2.6.39.1/drivers/sh/clk/cpg.c 2011-06-03 00:04:14.000000000 -0400
39250 +++ linux-2.6.39.1/drivers/sh/clk/cpg.c 2011-06-03 00:32:06.000000000 -0400
39251 @@ -26,7 +26,7 @@ static void sh_clk_mstp32_disable(struct
39252 clk->enable_reg);
39253 }
39254
39255 -static struct clk_ops sh_clk_mstp32_clk_ops = {
39256 +static const struct clk_ops sh_clk_mstp32_clk_ops = {
39257 .enable = sh_clk_mstp32_enable,
39258 .disable = sh_clk_mstp32_disable,
39259 .recalc = followparent_recalc,
39260 @@ -150,7 +150,7 @@ static void sh_clk_div6_disable(struct c
39261 __raw_writel(value, clk->enable_reg);
39262 }
39263
39264 -static struct clk_ops sh_clk_div6_clk_ops = {
39265 +static const struct clk_ops sh_clk_div6_clk_ops = {
39266 .recalc = sh_clk_div6_recalc,
39267 .round_rate = sh_clk_div_round_rate,
39268 .set_rate = sh_clk_div6_set_rate,
39269 @@ -158,7 +158,7 @@ static struct clk_ops sh_clk_div6_clk_op
39270 .disable = sh_clk_div6_disable,
39271 };
39272
39273 -static struct clk_ops sh_clk_div6_reparent_clk_ops = {
39274 +static const struct clk_ops sh_clk_div6_reparent_clk_ops = {
39275 .recalc = sh_clk_div6_recalc,
39276 .round_rate = sh_clk_div_round_rate,
39277 .set_rate = sh_clk_div6_set_rate,
39278 @@ -282,13 +282,13 @@ static void sh_clk_div4_disable(struct c
39279 __raw_writel(__raw_readl(clk->enable_reg) | (1 << 8), clk->enable_reg);
39280 }
39281
39282 -static struct clk_ops sh_clk_div4_clk_ops = {
39283 +static const struct clk_ops sh_clk_div4_clk_ops = {
39284 .recalc = sh_clk_div4_recalc,
39285 .set_rate = sh_clk_div4_set_rate,
39286 .round_rate = sh_clk_div_round_rate,
39287 };
39288
39289 -static struct clk_ops sh_clk_div4_enable_clk_ops = {
39290 +static const struct clk_ops sh_clk_div4_enable_clk_ops = {
39291 .recalc = sh_clk_div4_recalc,
39292 .set_rate = sh_clk_div4_set_rate,
39293 .round_rate = sh_clk_div_round_rate,
39294 @@ -296,7 +296,7 @@ static struct clk_ops sh_clk_div4_enable
39295 .disable = sh_clk_div4_disable,
39296 };
39297
39298 -static struct clk_ops sh_clk_div4_reparent_clk_ops = {
39299 +static const struct clk_ops sh_clk_div4_reparent_clk_ops = {
39300 .recalc = sh_clk_div4_recalc,
39301 .set_rate = sh_clk_div4_set_rate,
39302 .round_rate = sh_clk_div_round_rate,
39303 diff -urNp linux-2.6.39.1/drivers/spi/dw_spi.h linux-2.6.39.1/drivers/spi/dw_spi.h
39304 --- linux-2.6.39.1/drivers/spi/dw_spi.h 2011-05-19 00:06:34.000000000 -0400
39305 +++ linux-2.6.39.1/drivers/spi/dw_spi.h 2011-05-22 19:36:32.000000000 -0400
39306 @@ -151,7 +151,7 @@ struct dw_spi {
39307 int dma_chan_done;
39308 struct device *dma_dev;
39309 dma_addr_t dma_addr; /* phy address of the Data register */
39310 - struct dw_spi_dma_ops *dma_ops;
39311 + const struct dw_spi_dma_ops *dma_ops;
39312 void *dma_priv; /* platform relate info */
39313 struct pci_dev *dmac;
39314
39315 diff -urNp linux-2.6.39.1/drivers/spi/dw_spi_mid.c linux-2.6.39.1/drivers/spi/dw_spi_mid.c
39316 --- linux-2.6.39.1/drivers/spi/dw_spi_mid.c 2011-05-19 00:06:34.000000000 -0400
39317 +++ linux-2.6.39.1/drivers/spi/dw_spi_mid.c 2011-05-22 19:36:32.000000000 -0400
39318 @@ -180,7 +180,7 @@ static int mid_spi_dma_transfer(struct d
39319 return 0;
39320 }
39321
39322 -static struct dw_spi_dma_ops mid_dma_ops = {
39323 +static const struct dw_spi_dma_ops mid_dma_ops = {
39324 .dma_init = mid_spi_dma_init,
39325 .dma_exit = mid_spi_dma_exit,
39326 .dma_transfer = mid_spi_dma_transfer,
39327 diff -urNp linux-2.6.39.1/drivers/spi/spi.c linux-2.6.39.1/drivers/spi/spi.c
39328 --- linux-2.6.39.1/drivers/spi/spi.c 2011-05-19 00:06:34.000000000 -0400
39329 +++ linux-2.6.39.1/drivers/spi/spi.c 2011-05-22 19:36:32.000000000 -0400
39330 @@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
39331 EXPORT_SYMBOL_GPL(spi_bus_unlock);
39332
39333 /* portable code must never pass more than 32 bytes */
39334 -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
39335 +#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
39336
39337 static u8 *buf;
39338
39339 diff -urNp linux-2.6.39.1/drivers/ssb/driver_pcicore.c linux-2.6.39.1/drivers/ssb/driver_pcicore.c
39340 --- linux-2.6.39.1/drivers/ssb/driver_pcicore.c 2011-05-19 00:06:34.000000000 -0400
39341 +++ linux-2.6.39.1/drivers/ssb/driver_pcicore.c 2011-05-22 19:36:32.000000000 -0400
39342 @@ -223,7 +223,7 @@ static int ssb_pcicore_write_config(stru
39343 return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
39344 }
39345
39346 -static struct pci_ops ssb_pcicore_pciops = {
39347 +static const struct pci_ops ssb_pcicore_pciops = {
39348 .read = ssb_pcicore_read_config,
39349 .write = ssb_pcicore_write_config,
39350 };
39351 diff -urNp linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c
39352 --- linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39353 +++ linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39354 @@ -1391,8 +1391,7 @@ u32 cipher_suites[] = {
39355 WLAN_CIPHER_SUITE_CCMP,
39356 };
39357
39358 -static struct
39359 -cfg80211_ops ar6k_cfg80211_ops = {
39360 +static const struct cfg80211_ops ar6k_cfg80211_ops = {
39361 .change_virtual_intf = ar6k_cfg80211_change_iface,
39362 .add_virtual_intf = ar6k_cfg80211_add_virtual_intf,
39363 .del_virtual_intf = ar6k_cfg80211_del_virtual_intf,
39364 diff -urNp linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
39365 --- linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-19 00:06:34.000000000 -0400
39366 +++ linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-22 19:36:32.000000000 -0400
39367 @@ -857,14 +857,14 @@ static void dhd_op_if(dhd_if_t *ifp)
39368 free_netdev(ifp->net);
39369 }
39370 /* Allocate etherdev, including space for private structure */
39371 - ifp->net = alloc_etherdev(sizeof(dhd));
39372 + ifp->net = alloc_etherdev(sizeof(*dhd));
39373 if (!ifp->net) {
39374 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39375 ret = -ENOMEM;
39376 }
39377 if (ret == 0) {
39378 strcpy(ifp->net->name, ifp->name);
39379 - memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
39380 + memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
39381 err = dhd_net_attach(&dhd->pub, ifp->idx);
39382 if (err != 0) {
39383 DHD_ERROR(("%s: dhd_net_attach failed, "
39384 @@ -1500,7 +1500,7 @@ static void dhd_ethtool_get_drvinfo(stru
39385 sprintf(info->bus_info, "%s", dev_name(&wl_cfg80211_get_sdio_func()->dev));
39386 }
39387
39388 -struct ethtool_ops dhd_ethtool_ops = {
39389 +const struct ethtool_ops dhd_ethtool_ops = {
39390 .get_drvinfo = dhd_ethtool_get_drvinfo
39391 };
39392
39393 @@ -1923,7 +1923,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39394 strcpy(nv_path, nvram_path);
39395
39396 /* Allocate etherdev, including space for private structure */
39397 - net = alloc_etherdev(sizeof(dhd));
39398 + net = alloc_etherdev(sizeof(*dhd));
39399 if (!net) {
39400 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39401 goto fail;
39402 @@ -1939,7 +1939,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39403 /*
39404 * Save the dhd_info into the priv
39405 */
39406 - memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39407 + memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39408
39409 /* Set network interface name if it was provided as module parameter */
39410 if (iface_name[0]) {
39411 @@ -2056,7 +2056,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39412 /*
39413 * Save the dhd_info into the priv
39414 */
39415 - memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39416 + memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39417
39418 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
39419 g_bus = bus;
39420 @@ -2206,7 +2206,7 @@ dhd_iovar(dhd_pub_t *pub, int ifidx, cha
39421 return ret;
39422 }
39423
39424 -static struct net_device_ops dhd_ops_pri = {
39425 +static const struct net_device_ops dhd_ops_pri = {
39426 .ndo_open = dhd_open,
39427 .ndo_stop = dhd_stop,
39428 .ndo_get_stats = dhd_get_stats,
39429 diff -urNp linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
39430 --- linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39431 +++ linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39432 @@ -2109,7 +2109,7 @@ wl_cfg80211_flush_pmksa(struct wiphy *wi
39433
39434 }
39435
39436 -static struct cfg80211_ops wl_cfg80211_ops = {
39437 +static const struct cfg80211_ops wl_cfg80211_ops = {
39438 .change_virtual_intf = wl_cfg80211_change_iface,
39439 .scan = wl_cfg80211_scan,
39440 .set_wiphy_params = wl_cfg80211_set_wiphy_params,
39441 diff -urNp linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c
39442 --- linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-19 00:06:34.000000000 -0400
39443 +++ linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-22 19:36:32.000000000 -0400
39444 @@ -495,7 +495,7 @@ wl_iw_get_range(struct net_device *dev,
39445 list = (wl_u32_list_t *) channels;
39446
39447 dwrq->length = sizeof(struct iw_range);
39448 - memset(range, 0, sizeof(range));
39449 + memset(range, 0, sizeof(*range));
39450
39451 range->min_nwid = range->max_nwid = 0;
39452
39453 diff -urNp linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c
39454 --- linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c 2011-05-19 00:06:34.000000000 -0400
39455 +++ linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c 2011-05-22 19:36:32.000000000 -0400
39456 @@ -1445,7 +1445,7 @@ static void comedi_unmap(struct vm_area_
39457 mutex_unlock(&dev->mutex);
39458 }
39459
39460 -static struct vm_operations_struct comedi_vm_ops = {
39461 +static const struct vm_operations_struct comedi_vm_ops = {
39462 .close = comedi_unmap,
39463 };
39464
39465 diff -urNp linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c
39466 --- linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c 2011-05-19 00:06:34.000000000 -0400
39467 +++ linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c 2011-05-22 19:36:32.000000000 -0400
39468 @@ -586,7 +586,7 @@ static struct page *snd_cx25821_page(str
39469 /*
39470 * operators
39471 */
39472 -static struct snd_pcm_ops snd_cx25821_pcm_ops = {
39473 +static const struct snd_pcm_ops snd_cx25821_pcm_ops = {
39474 .open = snd_cx25821_pcm_open,
39475 .close = snd_cx25821_close,
39476 .ioctl = snd_pcm_lib_ioctl,
39477 diff -urNp linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c
39478 --- linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c 2011-05-19 00:06:34.000000000 -0400
39479 +++ linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c 2011-05-22 19:36:32.000000000 -0400
39480 @@ -282,7 +282,7 @@ static u32 cx25821_functionality(struct
39481 I2C_FUNC_SMBUS_READ_WORD_DATA | I2C_FUNC_SMBUS_WRITE_WORD_DATA;
39482 }
39483
39484 -static struct i2c_algorithm cx25821_i2c_algo_template = {
39485 +static const struct i2c_algorithm cx25821_i2c_algo_template = {
39486 .master_xfer = i2c_xfer,
39487 .functionality = cx25821_functionality,
39488 #ifdef NEED_ALGO_CONTROL
39489 diff -urNp linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c
39490 --- linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c 2011-05-19 00:06:34.000000000 -0400
39491 +++ linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c 2011-05-22 19:36:32.000000000 -0400
39492 @@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
39493 struct net_device_stats *stats = &etdev->net_stats;
39494
39495 if (tcb->flags & fMP_DEST_BROAD)
39496 - atomic_inc(&etdev->Stats.brdcstxmt);
39497 + atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
39498 else if (tcb->flags & fMP_DEST_MULTI)
39499 - atomic_inc(&etdev->Stats.multixmt);
39500 + atomic_inc_unchecked(&etdev->Stats.multixmt);
39501 else
39502 - atomic_inc(&etdev->Stats.unixmt);
39503 + atomic_inc_unchecked(&etdev->Stats.unixmt);
39504
39505 if (tcb->skb) {
39506 stats->tx_bytes += tcb->skb->len;
39507 diff -urNp linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h
39508 --- linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h 2011-05-19 00:06:34.000000000 -0400
39509 +++ linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h 2011-05-22 19:36:32.000000000 -0400
39510 @@ -110,11 +110,11 @@ typedef struct _ce_stats_t {
39511 * operations
39512 */
39513 u32 unircv; /* # multicast packets received */
39514 - atomic_t unixmt; /* # multicast packets for Tx */
39515 + atomic_unchecked_t unixmt; /* # multicast packets for Tx */
39516 u32 multircv; /* # multicast packets received */
39517 - atomic_t multixmt; /* # multicast packets for Tx */
39518 + atomic_unchecked_t multixmt; /* # multicast packets for Tx */
39519 u32 brdcstrcv; /* # broadcast packets received */
39520 - atomic_t brdcstxmt; /* # broadcast packets for Tx */
39521 + atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
39522 u32 norcvbuf; /* # Rx packets discarded */
39523 u32 noxmtbuf; /* # Tx packets discarded */
39524
39525 diff -urNp linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
39526 --- linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-19 00:06:34.000000000 -0400
39527 +++ linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-22 19:36:32.000000000 -0400
39528 @@ -55,7 +55,7 @@ int numofmsgbuf = 0;
39529 //
39530 // Table of entry-point routines for char device
39531 //
39532 -static struct file_operations ft1000fops =
39533 +static const struct file_operations ft1000fops =
39534 {
39535 .unlocked_ioctl = ft1000_ioctl,
39536 .poll = ft1000_poll_dev,
39537 diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c
39538 --- linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-19 00:06:34.000000000 -0400
39539 +++ linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-22 19:36:32.000000000 -0400
39540 @@ -221,7 +221,7 @@ module_param(rio_poll, int, 0);
39541 module_param(rio_debug, int, 0644);
39542 module_param(rio_irqmask, long, 0);
39543
39544 -static struct real_driver rio_real_driver = {
39545 +static const struct real_driver rio_real_driver = {
39546 rio_disable_tx_interrupts,
39547 rio_enable_tx_interrupts,
39548 rio_disable_rx_interrupts,
39549 diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c
39550 --- linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c 2011-05-19 00:06:34.000000000 -0400
39551 +++ linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c 2011-05-22 19:36:32.000000000 -0400
39552 @@ -144,7 +144,7 @@ static int a2232_open(struct tty_struct
39553 /*---------------------------------------------------------------------------
39554 * Interface from generic_serial.c back here
39555 *--------------------------------------------------------------------------*/
39556 -static struct real_driver a2232_real_driver = {
39557 +static const struct real_driver a2232_real_driver = {
39558 a2232_disable_tx_interrupts,
39559 a2232_enable_tx_interrupts,
39560 a2232_disable_rx_interrupts,
39561 diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/sx.c linux-2.6.39.1/drivers/staging/generic_serial/sx.c
39562 --- linux-2.6.39.1/drivers/staging/generic_serial/sx.c 2011-05-19 00:06:34.000000000 -0400
39563 +++ linux-2.6.39.1/drivers/staging/generic_serial/sx.c 2011-05-22 19:36:32.000000000 -0400
39564 @@ -355,7 +355,7 @@ module_param(sx_irqmask, int, 0);
39565
39566 MODULE_LICENSE("GPL");
39567
39568 -static struct real_driver sx_real_driver = {
39569 +static const struct real_driver sx_real_driver = {
39570 sx_disable_tx_interrupts,
39571 sx_enable_tx_interrupts,
39572 sx_disable_rx_interrupts,
39573 diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c
39574 --- linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c 2011-05-19 00:06:34.000000000 -0400
39575 +++ linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c 2011-05-22 19:36:32.000000000 -0400
39576 @@ -94,7 +94,7 @@ static struct scc_port scc_ports[2];
39577 * Interface from generic_serial.c back here
39578 *--------------------------------------------------------------------------*/
39579
39580 -static struct real_driver scc_real_driver = {
39581 +static const struct real_driver scc_real_driver = {
39582 scc_disable_tx_interrupts,
39583 scc_enable_tx_interrupts,
39584 scc_disable_rx_interrupts,
39585 diff -urNp linux-2.6.39.1/drivers/staging/gma500/psb_fb.c linux-2.6.39.1/drivers/staging/gma500/psb_fb.c
39586 --- linux-2.6.39.1/drivers/staging/gma500/psb_fb.c 2011-05-19 00:06:34.000000000 -0400
39587 +++ linux-2.6.39.1/drivers/staging/gma500/psb_fb.c 2011-05-22 19:36:32.000000000 -0400
39588 @@ -230,7 +230,7 @@ static void psbfb_vm_close(struct vm_are
39589 DRM_DEBUG("vm_close\n");
39590 }
39591
39592 -static struct vm_operations_struct psbfb_vm_ops = {
39593 +static const struct vm_operations_struct psbfb_vm_ops = {
39594 .fault = psbfb_vm_fault,
39595 .open = psbfb_vm_open,
39596 .close = psbfb_vm_close
39597 diff -urNp linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c
39598 --- linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c 2011-05-19 00:06:34.000000000 -0400
39599 +++ linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c 2011-05-22 19:36:32.000000000 -0400
39600 @@ -198,7 +198,7 @@ static u32 go7007_functionality(struct i
39601 return I2C_FUNC_SMBUS_BYTE_DATA;
39602 }
39603
39604 -static struct i2c_algorithm go7007_algo = {
39605 +static const struct i2c_algorithm go7007_algo = {
39606 .smbus_xfer = go7007_smbus_xfer,
39607 .master_xfer = go7007_i2c_master_xfer,
39608 .functionality = go7007_functionality,
39609 diff -urNp linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c
39610 --- linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c 2011-05-19 00:06:34.000000000 -0400
39611 +++ linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c 2011-05-22 19:36:32.000000000 -0400
39612 @@ -849,7 +849,7 @@ static int go7007_usb_send_firmware(stru
39613 &transferred, timeout);
39614 }
39615
39616 -static struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39617 +static const struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39618 .interface_reset = go7007_usb_interface_reset,
39619 .write_interrupt = go7007_usb_ezusb_write_interrupt,
39620 .read_interrupt = go7007_usb_read_interrupt,
39621 @@ -858,7 +858,7 @@ static struct go7007_hpi_ops go7007_usb_
39622 .send_firmware = go7007_usb_send_firmware,
39623 };
39624
39625 -static struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39626 +static const struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39627 .interface_reset = go7007_usb_interface_reset,
39628 .write_interrupt = go7007_usb_onboard_write_interrupt,
39629 .read_interrupt = go7007_usb_read_interrupt,
39630 @@ -950,7 +950,7 @@ static u32 go7007_usb_functionality(stru
39631 return (I2C_FUNC_SMBUS_EMUL) & ~I2C_FUNC_SMBUS_QUICK;
39632 }
39633
39634 -static struct i2c_algorithm go7007_usb_algo = {
39635 +static const struct i2c_algorithm go7007_usb_algo = {
39636 .master_xfer = go7007_usb_i2c_master_xfer,
39637 .functionality = go7007_usb_functionality,
39638 };
39639 diff -urNp linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c
39640 --- linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c 2011-05-19 00:06:34.000000000 -0400
39641 +++ linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c 2011-05-22 19:36:32.000000000 -0400
39642 @@ -1672,7 +1672,7 @@ static int go7007_vm_fault(struct vm_are
39643 return 0;
39644 }
39645
39646 -static struct vm_operations_struct go7007_vm_ops = {
39647 +static const struct vm_operations_struct go7007_vm_ops = {
39648 .open = go7007_vm_open,
39649 .close = go7007_vm_close,
39650 .fault = go7007_vm_fault,
39651 diff -urNp linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c
39652 --- linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c 2011-05-19 00:06:34.000000000 -0400
39653 +++ linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c 2011-05-22 19:36:32.000000000 -0400
39654 @@ -421,7 +421,7 @@ static int saa7134_go7007_send_command(s
39655
39656 }
39657
39658 -static struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39659 +static const struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39660 .interface_reset = saa7134_go7007_interface_reset,
39661 .write_interrupt = saa7134_go7007_write_interrupt,
39662 .read_interrupt = saa7134_go7007_read_interrupt,
39663 diff -urNp linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c
39664 --- linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c 2011-05-19 00:06:34.000000000 -0400
39665 +++ linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c 2011-05-22 19:36:32.000000000 -0400
39666 @@ -204,7 +204,7 @@ static struct page *go7007_snd_pcm_page(
39667 return vmalloc_to_page(substream->runtime->dma_area + offset);
39668 }
39669
39670 -static struct snd_pcm_ops go7007_snd_capture_ops = {
39671 +static const struct snd_pcm_ops go7007_snd_capture_ops = {
39672 .open = go7007_snd_capture_open,
39673 .close = go7007_snd_capture_close,
39674 .ioctl = snd_pcm_lib_ioctl,
39675 @@ -227,7 +227,7 @@ static int go7007_snd_free(struct snd_de
39676 return 0;
39677 }
39678
39679 -static struct snd_device_ops go7007_snd_device_ops = {
39680 +static const struct snd_device_ops go7007_snd_device_ops = {
39681 .dev_free = go7007_snd_free,
39682 };
39683
39684 diff -urNp linux-2.6.39.1/drivers/staging/hv/channel.c linux-2.6.39.1/drivers/staging/hv/channel.c
39685 --- linux-2.6.39.1/drivers/staging/hv/channel.c 2011-05-19 00:06:34.000000000 -0400
39686 +++ linux-2.6.39.1/drivers/staging/hv/channel.c 2011-05-22 19:36:32.000000000 -0400
39687 @@ -509,8 +509,8 @@ int vmbus_establish_gpadl(struct vmbus_c
39688 unsigned long flags;
39689 int ret = 0;
39690
39691 - next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
39692 - atomic_inc(&vmbus_connection.next_gpadl_handle);
39693 + next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
39694 + atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
39695
39696 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
39697 if (ret)
39698 diff -urNp linux-2.6.39.1/drivers/staging/hv/hv.c linux-2.6.39.1/drivers/staging/hv/hv.c
39699 --- linux-2.6.39.1/drivers/staging/hv/hv.c 2011-05-19 00:06:34.000000000 -0400
39700 +++ linux-2.6.39.1/drivers/staging/hv/hv.c 2011-05-22 19:36:32.000000000 -0400
39701 @@ -163,7 +163,7 @@ static u64 do_hypercall(u64 control, voi
39702 u64 output_address = (output) ? virt_to_phys(output) : 0;
39703 u32 output_address_hi = output_address >> 32;
39704 u32 output_address_lo = output_address & 0xFFFFFFFF;
39705 - volatile void *hypercall_page = hv_context.hypercall_page;
39706 + volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
39707
39708 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
39709 control, input, output);
39710 diff -urNp linux-2.6.39.1/drivers/staging/hv/rndis_filter.c linux-2.6.39.1/drivers/staging/hv/rndis_filter.c
39711 --- linux-2.6.39.1/drivers/staging/hv/rndis_filter.c 2011-05-19 00:06:34.000000000 -0400
39712 +++ linux-2.6.39.1/drivers/staging/hv/rndis_filter.c 2011-05-22 19:36:32.000000000 -0400
39713 @@ -49,7 +49,7 @@ struct rndis_device {
39714
39715 enum rndis_device_state state;
39716 u32 link_stat;
39717 - atomic_t new_req_id;
39718 + atomic_unchecked_t new_req_id;
39719
39720 spinlock_t request_lock;
39721 struct list_head req_list;
39722 @@ -144,7 +144,7 @@ static struct rndis_request *get_rndis_r
39723 * template
39724 */
39725 set = &rndis_msg->msg.set_req;
39726 - set->req_id = atomic_inc_return(&dev->new_req_id);
39727 + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39728
39729 /* Add to the request list */
39730 spin_lock_irqsave(&dev->request_lock, flags);
39731 @@ -709,7 +709,7 @@ static void rndis_filter_halt_device(str
39732
39733 /* Setup the rndis set */
39734 halt = &request->request_msg.msg.halt_req;
39735 - halt->req_id = atomic_inc_return(&dev->new_req_id);
39736 + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39737
39738 /* Ignore return since this msg is optional. */
39739 rndis_filter_send_request(dev, request);
39740 diff -urNp linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c
39741 --- linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c 2011-05-19 00:06:34.000000000 -0400
39742 +++ linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c 2011-05-22 19:36:32.000000000 -0400
39743 @@ -661,14 +661,14 @@ int vmbus_child_device_register(struct h
39744 {
39745 int ret = 0;
39746
39747 - static atomic_t device_num = ATOMIC_INIT(0);
39748 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
39749
39750 DPRINT_DBG(VMBUS_DRV, "child device (%p) registering",
39751 child_device_obj);
39752
39753 /* Set the device name. Otherwise, device_register() will fail. */
39754 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
39755 - atomic_inc_return(&device_num));
39756 + atomic_inc_return_unchecked(&device_num));
39757
39758 /* The new device belongs to this bus */
39759 child_device_obj->device.bus = &vmbus_drv.bus; /* device->dev.bus; */
39760 diff -urNp linux-2.6.39.1/drivers/staging/hv/vmbus_private.h linux-2.6.39.1/drivers/staging/hv/vmbus_private.h
39761 --- linux-2.6.39.1/drivers/staging/hv/vmbus_private.h 2011-05-19 00:06:34.000000000 -0400
39762 +++ linux-2.6.39.1/drivers/staging/hv/vmbus_private.h 2011-05-22 19:36:32.000000000 -0400
39763 @@ -58,7 +58,7 @@ enum vmbus_connect_state {
39764 struct vmbus_connection {
39765 enum vmbus_connect_state conn_state;
39766
39767 - atomic_t next_gpadl_handle;
39768 + atomic_unchecked_t next_gpadl_handle;
39769
39770 /*
39771 * Represents channel interrupts. Each bit position represents a
39772 diff -urNp linux-2.6.39.1/drivers/staging/iio/ring_generic.h linux-2.6.39.1/drivers/staging/iio/ring_generic.h
39773 --- linux-2.6.39.1/drivers/staging/iio/ring_generic.h 2011-05-19 00:06:34.000000000 -0400
39774 +++ linux-2.6.39.1/drivers/staging/iio/ring_generic.h 2011-05-25 16:55:27.000000000 -0400
39775 @@ -134,7 +134,7 @@ struct iio_ring_buffer {
39776 struct iio_handler access_handler;
39777 struct iio_event_interface ev_int;
39778 struct iio_shared_ev_pointer shared_ev_pointer;
39779 - struct iio_ring_access_funcs access;
39780 + struct iio_ring_access_funcs access;
39781 int (*preenable)(struct iio_dev *);
39782 int (*postenable)(struct iio_dev *);
39783 int (*predisable)(struct iio_dev *);
39784 diff -urNp linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c
39785 --- linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-19 00:06:34.000000000 -0400
39786 +++ linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-22 19:36:32.000000000 -0400
39787 @@ -494,7 +494,7 @@ static int snd_intelmad_device_set(struc
39788 struct snd_intelmad *intelmaddata;
39789 struct snd_pmic_ops *scard_ops;
39790 int ret_val = 0, vendor, status;
39791 - struct intel_sst_pcm_control *pcm_control;
39792 + const struct intel_sst_pcm_control *pcm_control;
39793
39794 pr_debug("snd_intelmad_device_set called\n");
39795
39796 diff -urNp linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c
39797 --- linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-19 00:06:34.000000000 -0400
39798 +++ linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-22 19:36:32.000000000 -0400
39799 @@ -470,7 +470,7 @@ int sst_device_control(int cmd, void *ar
39800 }
39801
39802
39803 -struct intel_sst_pcm_control pcm_ops = {
39804 +const struct intel_sst_pcm_control pcm_ops = {
39805 .open = sst_open_pcm_stream,
39806 .device_control = sst_device_control,
39807 .close = sst_close_pcm_stream,
39808 diff -urNp linux-2.6.39.1/drivers/staging/line6/capture.c linux-2.6.39.1/drivers/staging/line6/capture.c
39809 --- linux-2.6.39.1/drivers/staging/line6/capture.c 2011-05-19 00:06:34.000000000 -0400
39810 +++ linux-2.6.39.1/drivers/staging/line6/capture.c 2011-05-22 19:36:32.000000000 -0400
39811 @@ -378,7 +378,7 @@ snd_line6_capture_pointer(struct snd_pcm
39812 }
39813
39814 /* capture operators */
39815 -struct snd_pcm_ops snd_line6_capture_ops = {
39816 +const struct snd_pcm_ops snd_line6_capture_ops = {
39817 .open = snd_line6_capture_open,
39818 .close = snd_line6_capture_close,
39819 .ioctl = snd_pcm_lib_ioctl,
39820 diff -urNp linux-2.6.39.1/drivers/staging/line6/capture.h linux-2.6.39.1/drivers/staging/line6/capture.h
39821 --- linux-2.6.39.1/drivers/staging/line6/capture.h 2011-05-19 00:06:34.000000000 -0400
39822 +++ linux-2.6.39.1/drivers/staging/line6/capture.h 2011-05-22 19:36:32.000000000 -0400
39823 @@ -17,7 +17,7 @@
39824 #include "driver.h"
39825 #include "pcm.h"
39826
39827 -extern struct snd_pcm_ops snd_line6_capture_ops;
39828 +extern const struct snd_pcm_ops snd_line6_capture_ops;
39829
39830 extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
39831 int fsize);
39832 diff -urNp linux-2.6.39.1/drivers/staging/line6/midi.c linux-2.6.39.1/drivers/staging/line6/midi.c
39833 --- linux-2.6.39.1/drivers/staging/line6/midi.c 2011-05-19 00:06:34.000000000 -0400
39834 +++ linux-2.6.39.1/drivers/staging/line6/midi.c 2011-05-22 19:36:32.000000000 -0400
39835 @@ -239,14 +239,14 @@ static void line6_midi_input_trigger(str
39836 line6->line6midi->substream_receive = 0;
39837 }
39838
39839 -static struct snd_rawmidi_ops line6_midi_output_ops = {
39840 +static const struct snd_rawmidi_ops line6_midi_output_ops = {
39841 .open = line6_midi_output_open,
39842 .close = line6_midi_output_close,
39843 .trigger = line6_midi_output_trigger,
39844 .drain = line6_midi_output_drain,
39845 };
39846
39847 -static struct snd_rawmidi_ops line6_midi_input_ops = {
39848 +static const struct snd_rawmidi_ops line6_midi_input_ops = {
39849 .open = line6_midi_input_open,
39850 .close = line6_midi_input_close,
39851 .trigger = line6_midi_input_trigger,
39852 @@ -373,7 +373,7 @@ static int snd_line6_midi_free(struct sn
39853 */
39854 int line6_init_midi(struct usb_line6 *line6)
39855 {
39856 - static struct snd_device_ops midi_ops = {
39857 + static const struct snd_device_ops midi_ops = {
39858 .dev_free = snd_line6_midi_free,
39859 };
39860
39861 diff -urNp linux-2.6.39.1/drivers/staging/line6/pcm.c linux-2.6.39.1/drivers/staging/line6/pcm.c
39862 --- linux-2.6.39.1/drivers/staging/line6/pcm.c 2011-05-19 00:06:34.000000000 -0400
39863 +++ linux-2.6.39.1/drivers/staging/line6/pcm.c 2011-05-22 19:36:32.000000000 -0400
39864 @@ -384,7 +384,7 @@ void line6_pcm_disconnect(struct snd_lin
39865 int line6_init_pcm(struct usb_line6 *line6,
39866 struct line6_pcm_properties *properties)
39867 {
39868 - static struct snd_device_ops pcm_ops = {
39869 + static const struct snd_device_ops pcm_ops = {
39870 .dev_free = snd_line6_pcm_free,
39871 };
39872
39873 diff -urNp linux-2.6.39.1/drivers/staging/line6/playback.c linux-2.6.39.1/drivers/staging/line6/playback.c
39874 --- linux-2.6.39.1/drivers/staging/line6/playback.c 2011-05-19 00:06:34.000000000 -0400
39875 +++ linux-2.6.39.1/drivers/staging/line6/playback.c 2011-05-22 19:36:32.000000000 -0400
39876 @@ -536,7 +536,7 @@ snd_line6_playback_pointer(struct snd_pc
39877 }
39878
39879 /* playback operators */
39880 -struct snd_pcm_ops snd_line6_playback_ops = {
39881 +const struct snd_pcm_ops snd_line6_playback_ops = {
39882 .open = snd_line6_playback_open,
39883 .close = snd_line6_playback_close,
39884 .ioctl = snd_pcm_lib_ioctl,
39885 diff -urNp linux-2.6.39.1/drivers/staging/line6/playback.h linux-2.6.39.1/drivers/staging/line6/playback.h
39886 --- linux-2.6.39.1/drivers/staging/line6/playback.h 2011-05-19 00:06:34.000000000 -0400
39887 +++ linux-2.6.39.1/drivers/staging/line6/playback.h 2011-05-22 19:36:32.000000000 -0400
39888 @@ -27,7 +27,7 @@
39889 */
39890 #define USE_CLEAR_BUFFER_WORKAROUND 1
39891
39892 -extern struct snd_pcm_ops snd_line6_playback_ops;
39893 +extern const struct snd_pcm_ops snd_line6_playback_ops;
39894
39895 extern int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm);
39896 extern int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm);
39897 diff -urNp linux-2.6.39.1/drivers/staging/msm/staging-devices.c linux-2.6.39.1/drivers/staging/msm/staging-devices.c
39898 --- linux-2.6.39.1/drivers/staging/msm/staging-devices.c 2011-05-19 00:06:34.000000000 -0400
39899 +++ linux-2.6.39.1/drivers/staging/msm/staging-devices.c 2011-05-22 19:36:32.000000000 -0400
39900 @@ -211,7 +211,7 @@ static int msm_fb_lcdc_gpio_config(int o
39901 }
39902
39903
39904 -static struct lcdc_platform_data lcdc_pdata = {
39905 +static const struct lcdc_platform_data lcdc_pdata = {
39906 .lcdc_gpio_config = msm_fb_lcdc_gpio_config,
39907 };
39908
39909 diff -urNp linux-2.6.39.1/drivers/staging/octeon/ethernet.c linux-2.6.39.1/drivers/staging/octeon/ethernet.c
39910 --- linux-2.6.39.1/drivers/staging/octeon/ethernet.c 2011-05-19 00:06:34.000000000 -0400
39911 +++ linux-2.6.39.1/drivers/staging/octeon/ethernet.c 2011-05-22 19:36:32.000000000 -0400
39912 @@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
39913 * since the RX tasklet also increments it.
39914 */
39915 #ifdef CONFIG_64BIT
39916 - atomic64_add(rx_status.dropped_packets,
39917 - (atomic64_t *)&priv->stats.rx_dropped);
39918 + atomic64_add_unchecked(rx_status.dropped_packets,
39919 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39920 #else
39921 - atomic_add(rx_status.dropped_packets,
39922 - (atomic_t *)&priv->stats.rx_dropped);
39923 + atomic_add_unchecked(rx_status.dropped_packets,
39924 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
39925 #endif
39926 }
39927
39928 diff -urNp linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c
39929 --- linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c 2011-05-19 00:06:34.000000000 -0400
39930 +++ linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c 2011-05-22 19:36:32.000000000 -0400
39931 @@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
39932 /* Increment RX stats for virtual ports */
39933 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
39934 #ifdef CONFIG_64BIT
39935 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
39936 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
39937 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
39938 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
39939 #else
39940 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
39941 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
39942 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
39943 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
39944 #endif
39945 }
39946 netif_receive_skb(skb);
39947 @@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
39948 dev->name);
39949 */
39950 #ifdef CONFIG_64BIT
39951 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
39952 + atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39953 #else
39954 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
39955 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
39956 #endif
39957 dev_kfree_skb_irq(skb);
39958 }
39959 diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c
39960 --- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-19 00:06:34.000000000 -0400
39961 +++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-22 19:36:32.000000000 -0400
39962 @@ -43,7 +43,7 @@ module_param(noinit, int, 0444);
39963 static int useaa = 1;
39964 module_param(useaa, int, 0444);
39965
39966 -static struct dcon_platform_data *pdata;
39967 +static const struct dcon_platform_data *pdata;
39968
39969 /* I2C structures */
39970
39971 diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h
39972 --- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-19 00:06:34.000000000 -0400
39973 +++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-22 19:36:32.000000000 -0400
39974 @@ -92,11 +92,11 @@ struct dcon_platform_data {
39975 extern irqreturn_t dcon_interrupt(int irq, void *id);
39976
39977 #ifdef CONFIG_FB_OLPC_DCON_1
39978 -extern struct dcon_platform_data dcon_pdata_xo_1;
39979 +extern const struct dcon_platform_data dcon_pdata_xo_1;
39980 #endif
39981
39982 #ifdef CONFIG_FB_OLPC_DCON_1_5
39983 -extern struct dcon_platform_data dcon_pdata_xo_1_5;
39984 +extern const struct dcon_platform_data dcon_pdata_xo_1_5;
39985 #endif
39986
39987 #endif
39988 diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c
39989 --- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-19 00:06:34.000000000 -0400
39990 +++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-22 19:36:32.000000000 -0400
39991 @@ -185,7 +185,7 @@ static u8 dcon_read_status_xo_1_5(void)
39992 return status;
39993 }
39994
39995 -struct dcon_platform_data dcon_pdata_xo_1_5 = {
39996 +const struct dcon_platform_data dcon_pdata_xo_1_5 = {
39997 .init = dcon_init_xo_1_5,
39998 .bus_stabilize_wiggle = dcon_wiggle_xo_1_5,
39999 .set_dconload = dcon_set_dconload_xo_1_5,
40000 diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
40001 --- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-19 00:06:34.000000000 -0400
40002 +++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-22 19:36:32.000000000 -0400
40003 @@ -196,7 +196,7 @@ static u8 dcon_read_status_xo_1(void)
40004 return status;
40005 }
40006
40007 -struct dcon_platform_data dcon_pdata_xo_1 = {
40008 +const struct dcon_platform_data dcon_pdata_xo_1 = {
40009 .init = dcon_init_xo_1,
40010 .bus_stabilize_wiggle = dcon_wiggle_xo_1,
40011 .set_dconload = dcon_set_dconload_1,
40012 diff -urNp linux-2.6.39.1/drivers/staging/phison/phison.c linux-2.6.39.1/drivers/staging/phison/phison.c
40013 --- linux-2.6.39.1/drivers/staging/phison/phison.c 2011-05-19 00:06:34.000000000 -0400
40014 +++ linux-2.6.39.1/drivers/staging/phison/phison.c 2011-05-22 19:36:32.000000000 -0400
40015 @@ -43,7 +43,7 @@ static struct scsi_host_template phison_
40016 ATA_BMDMA_SHT(DRV_NAME),
40017 };
40018
40019 -static struct ata_port_operations phison_ops = {
40020 +static const struct ata_port_operations phison_ops = {
40021 .inherits = &ata_bmdma_port_ops,
40022 .prereset = phison_pre_reset,
40023 };
40024 diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/inode.c linux-2.6.39.1/drivers/staging/pohmelfs/inode.c
40025 --- linux-2.6.39.1/drivers/staging/pohmelfs/inode.c 2011-05-19 00:06:34.000000000 -0400
40026 +++ linux-2.6.39.1/drivers/staging/pohmelfs/inode.c 2011-05-22 19:36:32.000000000 -0400
40027 @@ -1855,7 +1855,7 @@ static int pohmelfs_fill_super(struct su
40028 mutex_init(&psb->mcache_lock);
40029 psb->mcache_root = RB_ROOT;
40030 psb->mcache_timeout = msecs_to_jiffies(5000);
40031 - atomic_long_set(&psb->mcache_gen, 0);
40032 + atomic_long_set_unchecked(&psb->mcache_gen, 0);
40033
40034 psb->trans_max_pages = 100;
40035
40036 @@ -1870,7 +1870,7 @@ static int pohmelfs_fill_super(struct su
40037 INIT_LIST_HEAD(&psb->crypto_ready_list);
40038 INIT_LIST_HEAD(&psb->crypto_active_list);
40039
40040 - atomic_set(&psb->trans_gen, 1);
40041 + atomic_set_unchecked(&psb->trans_gen, 1);
40042 atomic_long_set(&psb->total_inodes, 0);
40043
40044 mutex_init(&psb->state_lock);
40045 diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c
40046 --- linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c 2011-05-19 00:06:34.000000000 -0400
40047 +++ linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c 2011-05-22 19:36:32.000000000 -0400
40048 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
40049 m->data = data;
40050 m->start = start;
40051 m->size = size;
40052 - m->gen = atomic_long_inc_return(&psb->mcache_gen);
40053 + m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
40054
40055 mutex_lock(&psb->mcache_lock);
40056 err = pohmelfs_mcache_insert(psb, m);
40057 diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h
40058 --- linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h 2011-05-19 00:06:34.000000000 -0400
40059 +++ linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h 2011-05-22 19:36:32.000000000 -0400
40060 @@ -571,14 +571,14 @@ struct pohmelfs_config;
40061 struct pohmelfs_sb {
40062 struct rb_root mcache_root;
40063 struct mutex mcache_lock;
40064 - atomic_long_t mcache_gen;
40065 + atomic_long_unchecked_t mcache_gen;
40066 unsigned long mcache_timeout;
40067
40068 unsigned int idx;
40069
40070 unsigned int trans_retries;
40071
40072 - atomic_t trans_gen;
40073 + atomic_unchecked_t trans_gen;
40074
40075 unsigned int crypto_attached_size;
40076 unsigned int crypto_align_size;
40077 diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/trans.c linux-2.6.39.1/drivers/staging/pohmelfs/trans.c
40078 --- linux-2.6.39.1/drivers/staging/pohmelfs/trans.c 2011-05-19 00:06:34.000000000 -0400
40079 +++ linux-2.6.39.1/drivers/staging/pohmelfs/trans.c 2011-05-22 19:36:32.000000000 -0400
40080 @@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
40081 int err;
40082 struct netfs_cmd *cmd = t->iovec.iov_base;
40083
40084 - t->gen = atomic_inc_return(&psb->trans_gen);
40085 + t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
40086
40087 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
40088 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
40089 diff -urNp linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c
40090 --- linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-19 00:06:34.000000000 -0400
40091 +++ linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-22 19:36:32.000000000 -0400
40092 @@ -87,7 +87,7 @@ static int c_show(struct seq_file *m, vo
40093 return 0;
40094 }
40095
40096 -static struct seq_operations crypto_seq_ops = {
40097 +static const struct seq_operations crypto_seq_ops = {
40098 .start = c_start,
40099 .next = c_next,
40100 .stop = c_stop,
40101 @@ -99,7 +99,7 @@ static int crypto_info_open(struct inode
40102 return seq_open(file, &crypto_seq_ops);
40103 }
40104
40105 -static struct file_operations proc_crypto_ops = {
40106 +static const struct file_operations proc_crypto_ops = {
40107 .open = crypto_info_open,
40108 .read = seq_read,
40109 .llseek = seq_lseek,
40110 diff -urNp linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h
40111 --- linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h 2011-05-19 00:06:34.000000000 -0400
40112 +++ linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h 2011-05-22 19:36:32.000000000 -0400
40113 @@ -107,7 +107,7 @@ struct intf_hdl {
40114 void (*intf_hdl_unload)(u8 *priv);
40115 void (*intf_hdl_open)(u8 *priv);
40116 void (*intf_hdl_close)(u8 *priv);
40117 - struct _io_ops io_ops;
40118 + const struct _io_ops io_ops;
40119 };
40120
40121 struct reg_protocol_rd {
40122 diff -urNp linux-2.6.39.1/drivers/staging/solo6x10/g723.c linux-2.6.39.1/drivers/staging/solo6x10/g723.c
40123 --- linux-2.6.39.1/drivers/staging/solo6x10/g723.c 2011-05-19 00:06:34.000000000 -0400
40124 +++ linux-2.6.39.1/drivers/staging/solo6x10/g723.c 2011-05-22 19:36:32.000000000 -0400
40125 @@ -237,7 +237,7 @@ static int snd_solo_pcm_copy(struct snd_
40126 return 0;
40127 }
40128
40129 -static struct snd_pcm_ops snd_solo_pcm_ops = {
40130 +static const struct snd_pcm_ops snd_solo_pcm_ops = {
40131 .open = snd_solo_pcm_open,
40132 .close = snd_solo_pcm_close,
40133 .ioctl = snd_pcm_lib_ioctl,
40134 @@ -334,7 +334,7 @@ static int solo_snd_pcm_init(struct solo
40135
40136 int solo_g723_init(struct solo_dev *solo_dev)
40137 {
40138 - static struct snd_device_ops ops = { NULL };
40139 + static const struct snd_device_ops ops = { NULL };
40140 struct snd_card *card;
40141 struct snd_kcontrol_new kctl;
40142 char name[32];
40143 diff -urNp linux-2.6.39.1/drivers/staging/spectra/ffsport.c linux-2.6.39.1/drivers/staging/spectra/ffsport.c
40144 --- linux-2.6.39.1/drivers/staging/spectra/ffsport.c 2011-05-19 00:06:34.000000000 -0400
40145 +++ linux-2.6.39.1/drivers/staging/spectra/ffsport.c 2011-05-22 19:36:32.000000000 -0400
40146 @@ -604,7 +604,7 @@ int GLOB_SBD_unlocked_ioctl(struct block
40147 return ret;
40148 }
40149
40150 -static struct block_device_operations GLOB_SBD_ops = {
40151 +static const struct block_device_operations GLOB_SBD_ops = {
40152 .owner = THIS_MODULE,
40153 .open = GLOB_SBD_open,
40154 .release = GLOB_SBD_release,
40155 diff -urNp linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c
40156 --- linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c 2011-05-19 00:06:34.000000000 -0400
40157 +++ linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c 2011-05-22 19:36:32.000000000 -0400
40158 @@ -380,7 +380,7 @@ static snd_pcm_uframes_t snd_tm6000_poin
40159 /*
40160 * operators
40161 */
40162 -static struct snd_pcm_ops snd_tm6000_pcm_ops = {
40163 +static const struct snd_pcm_ops snd_tm6000_pcm_ops = {
40164 .open = snd_tm6000_pcm_open,
40165 .close = snd_tm6000_close,
40166 .ioctl = snd_pcm_lib_ioctl,
40167 diff -urNp linux-2.6.39.1/drivers/staging/tty/istallion.c linux-2.6.39.1/drivers/staging/tty/istallion.c
40168 --- linux-2.6.39.1/drivers/staging/tty/istallion.c 2011-05-19 00:06:34.000000000 -0400
40169 +++ linux-2.6.39.1/drivers/staging/tty/istallion.c 2011-05-22 20:49:07.000000000 -0400
40170 @@ -186,7 +186,6 @@ static struct ktermios stli_deftermios
40171 * re-used for each stats call.
40172 */
40173 static comstats_t stli_comstats;
40174 -static combrd_t stli_brdstats;
40175 static struct asystats stli_cdkstats;
40176
40177 /*****************************************************************************/
40178 @@ -4003,6 +4002,7 @@ out:
40179
40180 static int stli_getbrdstats(combrd_t __user *bp)
40181 {
40182 + combrd_t stli_brdstats;
40183 struct stlibrd *brdp;
40184 unsigned int i;
40185
40186 @@ -4226,6 +4226,8 @@ static int stli_getportstruct(struct stl
40187 struct stliport stli_dummyport;
40188 struct stliport *portp;
40189
40190 + pax_track_stack();
40191 +
40192 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
40193 return -EFAULT;
40194 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
40195 @@ -4248,6 +4250,8 @@ static int stli_getbrdstruct(struct stli
40196 struct stlibrd stli_dummybrd;
40197 struct stlibrd *brdp;
40198
40199 + pax_track_stack();
40200 +
40201 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
40202 return -EFAULT;
40203 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
40204 diff -urNp linux-2.6.39.1/drivers/staging/tty/stallion.c linux-2.6.39.1/drivers/staging/tty/stallion.c
40205 --- linux-2.6.39.1/drivers/staging/tty/stallion.c 2011-05-19 00:06:34.000000000 -0400
40206 +++ linux-2.6.39.1/drivers/staging/tty/stallion.c 2011-05-22 19:36:32.000000000 -0400
40207 @@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp
40208 struct stlport stl_dummyport;
40209 struct stlport *portp;
40210
40211 + pax_track_stack();
40212 +
40213 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
40214 return -EFAULT;
40215 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
40216 diff -urNp linux-2.6.39.1/drivers/staging/usbip/vhci.h linux-2.6.39.1/drivers/staging/usbip/vhci.h
40217 --- linux-2.6.39.1/drivers/staging/usbip/vhci.h 2011-05-19 00:06:34.000000000 -0400
40218 +++ linux-2.6.39.1/drivers/staging/usbip/vhci.h 2011-05-22 19:36:32.000000000 -0400
40219 @@ -92,7 +92,7 @@ struct vhci_hcd {
40220 unsigned resuming:1;
40221 unsigned long re_timeout;
40222
40223 - atomic_t seqnum;
40224 + atomic_unchecked_t seqnum;
40225
40226 /*
40227 * NOTE:
40228 diff -urNp linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c
40229 --- linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c 2011-05-19 00:06:34.000000000 -0400
40230 +++ linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c 2011-05-22 19:36:32.000000000 -0400
40231 @@ -536,7 +536,7 @@ static void vhci_tx_urb(struct urb *urb)
40232 return;
40233 }
40234
40235 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
40236 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40237 if (priv->seqnum == 0xffff)
40238 usbip_uinfo("seqnum max\n");
40239
40240 @@ -795,7 +795,7 @@ static int vhci_urb_dequeue(struct usb_h
40241 return -ENOMEM;
40242 }
40243
40244 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
40245 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40246 if (unlink->seqnum == 0xffff)
40247 usbip_uinfo("seqnum max\n");
40248
40249 @@ -992,7 +992,7 @@ static int vhci_start(struct usb_hcd *hc
40250 vdev->rhport = rhport;
40251 }
40252
40253 - atomic_set(&vhci->seqnum, 0);
40254 + atomic_set_unchecked(&vhci->seqnum, 0);
40255 spin_lock_init(&vhci->lock);
40256
40257
40258 diff -urNp linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c
40259 --- linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c 2011-05-19 00:06:34.000000000 -0400
40260 +++ linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c 2011-05-22 19:36:32.000000000 -0400
40261 @@ -81,7 +81,7 @@ static void vhci_recv_ret_submit(struct
40262 usbip_uerr("cannot find a urb of seqnum %u\n",
40263 pdu->base.seqnum);
40264 usbip_uinfo("max seqnum %d\n",
40265 - atomic_read(&the_controller->seqnum));
40266 + atomic_read_unchecked(&the_controller->seqnum));
40267 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
40268 return;
40269 }
40270 diff -urNp linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c
40271 --- linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c 2011-05-19 00:06:34.000000000 -0400
40272 +++ linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c 2011-05-22 19:36:32.000000000 -0400
40273 @@ -138,7 +138,7 @@ static long vme_user_unlocked_ioctl(stru
40274 static int __devinit vme_user_probe(struct device *, int, int);
40275 static int __devexit vme_user_remove(struct device *, int, int);
40276
40277 -static struct file_operations vme_user_fops = {
40278 +static const struct file_operations vme_user_fops = {
40279 .open = vme_user_open,
40280 .release = vme_user_release,
40281 .read = vme_user_read,
40282 diff -urNp linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c
40283 --- linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-19 00:06:34.000000000 -0400
40284 +++ linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-22 19:36:32.000000000 -0400
40285 @@ -426,7 +426,7 @@ int cyasblkdev_revalidate_disk(struct ge
40286
40287
40288 /*standard block device driver interface */
40289 -static struct block_device_operations cyasblkdev_bdops = {
40290 +static const struct block_device_operations cyasblkdev_bdops = {
40291 .open = cyasblkdev_blk_open,
40292 .release = cyasblkdev_blk_release,
40293 .ioctl = cyasblkdev_blk_ioctl,
40294 diff -urNp linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c
40295 --- linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-19 00:06:34.000000000 -0400
40296 +++ linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-22 19:36:32.000000000 -0400
40297 @@ -474,7 +474,7 @@ static void wl_get_drvinfo(struct net_de
40298 }
40299 } // wl_get_drvinfo
40300
40301 -static struct ethtool_ops wl_ethtool_ops = {
40302 +static const struct ethtool_ops wl_ethtool_ops = {
40303 .get_drvinfo = wl_get_drvinfo,
40304 .get_link = ethtool_op_get_link,
40305 };
40306 diff -urNp linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c
40307 --- linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-19 00:06:34.000000000 -0400
40308 +++ linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-22 19:36:32.000000000 -0400
40309 @@ -671,7 +671,7 @@ struct usbctlx_cmd_completor {
40310 hfa384x_cmdresult_t *result;
40311 };
40312
40313 -static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
40314 +static inline int usbctlx_cmd_completor_fn(const struct usbctlx_completor *head)
40315 {
40316 struct usbctlx_cmd_completor *complete;
40317
40318 @@ -705,7 +705,7 @@ struct usbctlx_rrid_completor {
40319 unsigned int riddatalen;
40320 };
40321
40322 -static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
40323 +static int usbctlx_rrid_completor_fn(const struct usbctlx_completor *head)
40324 {
40325 struct usbctlx_rrid_completor *complete;
40326 hfa384x_rridresult_t rridresult;
40327 @@ -768,7 +768,7 @@ struct usbctlx_rmem_completor {
40328 };
40329 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
40330
40331 -static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
40332 +static int usbctlx_rmem_completor_fn(const struct usbctlx_completor *head)
40333 {
40334 usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t *) head;
40335
40336 diff -urNp linux-2.6.39.1/drivers/staging/zcache/tmem.c linux-2.6.39.1/drivers/staging/zcache/tmem.c
40337 --- linux-2.6.39.1/drivers/staging/zcache/tmem.c 2011-05-19 00:06:34.000000000 -0400
40338 +++ linux-2.6.39.1/drivers/staging/zcache/tmem.c 2011-05-22 19:36:32.000000000 -0400
40339 @@ -39,7 +39,7 @@
40340 * A tmem host implementation must use this function to register callbacks
40341 * for memory allocation.
40342 */
40343 -static struct tmem_hostops tmem_hostops;
40344 +static const struct tmem_hostops tmem_hostops;
40345
40346 static void tmem_objnode_tree_init(void);
40347
40348 @@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h
40349 * A tmem host implementation must use this function to register
40350 * callbacks for a page-accessible memory (PAM) implementation
40351 */
40352 -static struct tmem_pamops tmem_pamops;
40353 +static const struct tmem_pamops tmem_pamops;
40354
40355 void tmem_register_pamops(struct tmem_pamops *m)
40356 {
40357 diff -urNp linux-2.6.39.1/drivers/staging/zcache/zcache.c linux-2.6.39.1/drivers/staging/zcache/zcache.c
40358 --- linux-2.6.39.1/drivers/staging/zcache/zcache.c 2011-05-19 00:06:34.000000000 -0400
40359 +++ linux-2.6.39.1/drivers/staging/zcache/zcache.c 2011-05-22 19:36:32.000000000 -0400
40360 @@ -882,7 +882,7 @@ static void zcache_obj_free(struct tmem_
40361 kmem_cache_free(zcache_obj_cache, obj);
40362 }
40363
40364 -static struct tmem_hostops zcache_hostops = {
40365 +static const struct tmem_hostops zcache_hostops = {
40366 .obj_alloc = zcache_obj_alloc,
40367 .obj_free = zcache_obj_free,
40368 .objnode_alloc = zcache_objnode_alloc,
40369 @@ -987,7 +987,7 @@ static void zcache_pampd_free(void *pamp
40370 }
40371 }
40372
40373 -static struct tmem_pamops zcache_pamops = {
40374 +static const struct tmem_pamops zcache_pamops = {
40375 .create = zcache_pampd_create,
40376 .get_data = zcache_pampd_get_data,
40377 .free = zcache_pampd_free,
40378 diff -urNp linux-2.6.39.1/drivers/target/target_core_alua.c linux-2.6.39.1/drivers/target/target_core_alua.c
40379 --- linux-2.6.39.1/drivers/target/target_core_alua.c 2011-05-19 00:06:34.000000000 -0400
40380 +++ linux-2.6.39.1/drivers/target/target_core_alua.c 2011-05-22 19:36:32.000000000 -0400
40381 @@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_
40382 char path[ALUA_METADATA_PATH_LEN];
40383 int len;
40384
40385 + pax_track_stack();
40386 +
40387 memset(path, 0, ALUA_METADATA_PATH_LEN);
40388
40389 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
40390 @@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar
40391 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
40392 int len;
40393
40394 + pax_track_stack();
40395 +
40396 memset(path, 0, ALUA_METADATA_PATH_LEN);
40397 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
40398
40399 diff -urNp linux-2.6.39.1/drivers/target/target_core_cdb.c linux-2.6.39.1/drivers/target/target_core_cdb.c
40400 --- linux-2.6.39.1/drivers/target/target_core_cdb.c 2011-05-19 00:06:34.000000000 -0400
40401 +++ linux-2.6.39.1/drivers/target/target_core_cdb.c 2011-05-22 19:36:32.000000000 -0400
40402 @@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
40403 int length = 0;
40404 unsigned char buf[SE_MODE_PAGE_BUF];
40405
40406 + pax_track_stack();
40407 +
40408 memset(buf, 0, SE_MODE_PAGE_BUF);
40409
40410 switch (cdb[2] & 0x3f) {
40411 diff -urNp linux-2.6.39.1/drivers/target/target_core_configfs.c linux-2.6.39.1/drivers/target/target_core_configfs.c
40412 --- linux-2.6.39.1/drivers/target/target_core_configfs.c 2011-05-19 00:06:34.000000000 -0400
40413 +++ linux-2.6.39.1/drivers/target/target_core_configfs.c 2011-05-22 19:36:32.000000000 -0400
40414 @@ -1280,6 +1280,8 @@ static ssize_t target_core_dev_pr_show_a
40415 ssize_t len = 0;
40416 int reg_count = 0, prf_isid;
40417
40418 + pax_track_stack();
40419 +
40420 if (!(su_dev->se_dev_ptr))
40421 return -ENODEV;
40422
40423 @@ -2682,7 +2684,7 @@ static void target_core_alua_drop_tg_pt_
40424 config_item_put(item);
40425 }
40426
40427 -static struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40428 +static const struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40429 .make_group = &target_core_alua_create_tg_pt_gp,
40430 .drop_item = &target_core_alua_drop_tg_pt_gp,
40431 };
40432 @@ -2726,7 +2728,7 @@ static void target_core_stat_rmdir(
40433 return;
40434 }
40435
40436 -static struct configfs_group_operations target_core_stat_group_ops = {
40437 +static const struct configfs_group_operations target_core_stat_group_ops = {
40438 .make_group = &target_core_stat_mkdir,
40439 .drop_item = &target_core_stat_rmdir,
40440 };
40441 @@ -2939,7 +2941,7 @@ static void target_core_drop_subdev(
40442 mutex_unlock(&hba->hba_access_mutex);
40443 }
40444
40445 -static struct configfs_group_operations target_core_hba_group_ops = {
40446 +static const struct configfs_group_operations target_core_hba_group_ops = {
40447 .make_group = target_core_make_subdev,
40448 .drop_item = target_core_drop_subdev,
40449 };
40450 @@ -3117,7 +3119,7 @@ static void target_core_call_delhbafromt
40451 config_item_put(item);
40452 }
40453
40454 -static struct configfs_group_operations target_core_group_ops = {
40455 +static const struct configfs_group_operations target_core_group_ops = {
40456 .make_group = target_core_call_addhbatotarget,
40457 .drop_item = target_core_call_delhbafromtarget,
40458 };
40459 diff -urNp linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c
40460 --- linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c 2011-05-19 00:06:34.000000000 -0400
40461 +++ linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c 2011-05-22 19:36:32.000000000 -0400
40462 @@ -1174,7 +1174,7 @@ static void target_fabric_drop_wwn(
40463 config_item_put(item);
40464 }
40465
40466 -static struct configfs_group_operations target_fabric_wwn_group_ops = {
40467 +static const struct configfs_group_operations target_fabric_wwn_group_ops = {
40468 .make_group = target_fabric_make_wwn,
40469 .drop_item = target_fabric_drop_wwn,
40470 };
40471 diff -urNp linux-2.6.39.1/drivers/target/target_core_pr.c linux-2.6.39.1/drivers/target/target_core_pr.c
40472 --- linux-2.6.39.1/drivers/target/target_core_pr.c 2011-05-19 00:06:34.000000000 -0400
40473 +++ linux-2.6.39.1/drivers/target/target_core_pr.c 2011-05-22 19:36:32.000000000 -0400
40474 @@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
40475 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
40476 u16 tpgt;
40477
40478 + pax_track_stack();
40479 +
40480 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
40481 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
40482 /*
40483 @@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
40484 ssize_t len = 0;
40485 int reg_count = 0;
40486
40487 + pax_track_stack();
40488 +
40489 memset(buf, 0, pr_aptpl_buf_len);
40490 /*
40491 * Called to clear metadata once APTPL has been deactivated.
40492 @@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
40493 char path[512];
40494 int ret;
40495
40496 + pax_track_stack();
40497 +
40498 memset(iov, 0, sizeof(struct iovec));
40499 memset(path, 0, 512);
40500
40501 diff -urNp linux-2.6.39.1/drivers/target/target_core_tmr.c linux-2.6.39.1/drivers/target/target_core_tmr.c
40502 --- linux-2.6.39.1/drivers/target/target_core_tmr.c 2011-06-03 00:04:14.000000000 -0400
40503 +++ linux-2.6.39.1/drivers/target/target_core_tmr.c 2011-06-03 00:32:07.000000000 -0400
40504 @@ -263,7 +263,7 @@ int core_tmr_lun_reset(
40505 CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
40506 T_TASK(cmd)->t_task_cdbs,
40507 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40508 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40509 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40510 atomic_read(&T_TASK(cmd)->t_transport_active),
40511 atomic_read(&T_TASK(cmd)->t_transport_stop),
40512 atomic_read(&T_TASK(cmd)->t_transport_sent));
40513 @@ -305,7 +305,7 @@ int core_tmr_lun_reset(
40514 DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
40515 " task: %p, t_fe_count: %d dev: %p\n", task,
40516 fe_count, dev);
40517 - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40518 + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40519 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
40520 flags);
40521 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40522 @@ -315,7 +315,7 @@ int core_tmr_lun_reset(
40523 }
40524 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
40525 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
40526 - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40527 + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40528 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
40529 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40530
40531 diff -urNp linux-2.6.39.1/drivers/target/target_core_transport.c linux-2.6.39.1/drivers/target/target_core_transport.c
40532 --- linux-2.6.39.1/drivers/target/target_core_transport.c 2011-06-03 00:04:14.000000000 -0400
40533 +++ linux-2.6.39.1/drivers/target/target_core_transport.c 2011-06-03 00:32:07.000000000 -0400
40534 @@ -1681,7 +1681,7 @@ struct se_device *transport_add_device_t
40535
40536 dev->queue_depth = dev_limits->queue_depth;
40537 atomic_set(&dev->depth_left, dev->queue_depth);
40538 - atomic_set(&dev->dev_ordered_id, 0);
40539 + atomic_set_unchecked(&dev->dev_ordered_id, 0);
40540
40541 se_dev_set_default_attribs(dev, dev_limits);
40542
40543 @@ -1882,7 +1882,7 @@ static int transport_check_alloc_task_at
40544 * Used to determine when ORDERED commands should go from
40545 * Dormant to Active status.
40546 */
40547 - cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
40548 + cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
40549 smp_mb__after_atomic_inc();
40550 DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
40551 cmd->se_ordered_id, cmd->sam_task_attr,
40552 @@ -2169,7 +2169,7 @@ static void transport_generic_request_fa
40553 " t_transport_active: %d t_transport_stop: %d"
40554 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
40555 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40556 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40557 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40558 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
40559 atomic_read(&T_TASK(cmd)->t_transport_active),
40560 atomic_read(&T_TASK(cmd)->t_transport_stop),
40561 @@ -2673,9 +2673,9 @@ check_depth:
40562 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
40563 atomic_set(&task->task_active, 1);
40564 atomic_set(&task->task_sent, 1);
40565 - atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
40566 + atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
40567
40568 - if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
40569 + if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
40570 T_TASK(cmd)->t_task_cdbs)
40571 atomic_set(&cmd->transport_sent, 1);
40572
40573 @@ -5568,7 +5568,7 @@ static void transport_generic_wait_for_t
40574 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
40575 }
40576 if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
40577 - atomic_read(&T_TASK(cmd)->t_transport_aborted))
40578 + atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
40579 goto remove;
40580
40581 atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
40582 @@ -5797,7 +5797,7 @@ int transport_check_aborted_status(struc
40583 {
40584 int ret = 0;
40585
40586 - if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
40587 + if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
40588 if (!(send_status) ||
40589 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
40590 return 1;
40591 @@ -5825,7 +5825,7 @@ void transport_send_task_abort(struct se
40592 */
40593 if (cmd->data_direction == DMA_TO_DEVICE) {
40594 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
40595 - atomic_inc(&T_TASK(cmd)->t_transport_aborted);
40596 + atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
40597 smp_mb__after_atomic_inc();
40598 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
40599 transport_new_cmd_failure(cmd);
40600 @@ -5949,7 +5949,7 @@ static void transport_processing_shutdow
40601 CMD_TFO(cmd)->get_task_tag(cmd),
40602 T_TASK(cmd)->t_task_cdbs,
40603 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40604 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40605 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40606 atomic_read(&T_TASK(cmd)->t_transport_active),
40607 atomic_read(&T_TASK(cmd)->t_transport_stop),
40608 atomic_read(&T_TASK(cmd)->t_transport_sent));
40609 diff -urNp linux-2.6.39.1/drivers/telephony/ixj.c linux-2.6.39.1/drivers/telephony/ixj.c
40610 --- linux-2.6.39.1/drivers/telephony/ixj.c 2011-05-19 00:06:34.000000000 -0400
40611 +++ linux-2.6.39.1/drivers/telephony/ixj.c 2011-05-22 19:36:32.000000000 -0400
40612 @@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
40613 bool mContinue;
40614 char *pIn, *pOut;
40615
40616 + pax_track_stack();
40617 +
40618 if (!SCI_Prepare(j))
40619 return 0;
40620
40621 diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvc_console.h linux-2.6.39.1/drivers/tty/hvc/hvc_console.h
40622 --- linux-2.6.39.1/drivers/tty/hvc/hvc_console.h 2011-05-19 00:06:34.000000000 -0400
40623 +++ linux-2.6.39.1/drivers/tty/hvc/hvc_console.h 2011-05-22 19:36:32.000000000 -0400
40624 @@ -82,6 +82,7 @@ extern int hvc_instantiate(uint32_t vter
40625 /* register a vterm for hvc tty operation (module_init or hotplug add) */
40626 extern struct hvc_struct * hvc_alloc(uint32_t vtermno, int data,
40627 const struct hv_ops *ops, int outbuf_size);
40628 +
40629 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
40630 extern int hvc_remove(struct hvc_struct *hp);
40631
40632 diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c
40633 --- linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c 2011-05-19 00:06:34.000000000 -0400
40634 +++ linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c 2011-05-22 19:36:32.000000000 -0400
40635 @@ -1203,7 +1203,7 @@ static int param_get_vmidfilter(char *bu
40636
40637 #define param_check_vmidfilter(name, p) __param_check(name, p, void)
40638
40639 -static struct kernel_param_ops param_ops_vmidfilter = {
40640 +static const struct kernel_param_ops param_ops_vmidfilter = {
40641 .set = param_set_vmidfilter,
40642 .get = param_get_vmidfilter,
40643 };
40644 diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvcs.c linux-2.6.39.1/drivers/tty/hvc/hvcs.c
40645 --- linux-2.6.39.1/drivers/tty/hvc/hvcs.c 2011-05-19 00:06:34.000000000 -0400
40646 +++ linux-2.6.39.1/drivers/tty/hvc/hvcs.c 2011-05-22 19:36:32.000000000 -0400
40647 @@ -83,6 +83,7 @@
40648 #include <asm/hvcserver.h>
40649 #include <asm/uaccess.h>
40650 #include <asm/vio.h>
40651 +#include <asm/local.h>
40652
40653 /*
40654 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
40655 @@ -270,7 +271,7 @@ struct hvcs_struct {
40656 unsigned int index;
40657
40658 struct tty_struct *tty;
40659 - int open_count;
40660 + local_t open_count;
40661
40662 /*
40663 * Used to tell the driver kernel_thread what operations need to take
40664 @@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st
40665
40666 spin_lock_irqsave(&hvcsd->lock, flags);
40667
40668 - if (hvcsd->open_count > 0) {
40669 + if (local_read(&hvcsd->open_count) > 0) {
40670 spin_unlock_irqrestore(&hvcsd->lock, flags);
40671 printk(KERN_INFO "HVCS: vterm state unchanged. "
40672 "The hvcs device node is still in use.\n");
40673 @@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *
40674 if ((retval = hvcs_partner_connect(hvcsd)))
40675 goto error_release;
40676
40677 - hvcsd->open_count = 1;
40678 + local_set(&hvcsd->open_count, 1);
40679 hvcsd->tty = tty;
40680 tty->driver_data = hvcsd;
40681
40682 @@ -1179,7 +1180,7 @@ fast_open:
40683
40684 spin_lock_irqsave(&hvcsd->lock, flags);
40685 kref_get(&hvcsd->kref);
40686 - hvcsd->open_count++;
40687 + local_inc(&hvcsd->open_count);
40688 hvcsd->todo_mask |= HVCS_SCHED_READ;
40689 spin_unlock_irqrestore(&hvcsd->lock, flags);
40690
40691 @@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct
40692 hvcsd = tty->driver_data;
40693
40694 spin_lock_irqsave(&hvcsd->lock, flags);
40695 - if (--hvcsd->open_count == 0) {
40696 + if (local_dec_and_test(&hvcsd->open_count)) {
40697
40698 vio_disable_interrupts(hvcsd->vdev);
40699
40700 @@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct
40701 free_irq(irq, hvcsd);
40702 kref_put(&hvcsd->kref, destroy_hvcs_struct);
40703 return;
40704 - } else if (hvcsd->open_count < 0) {
40705 + } else if (local_read(&hvcsd->open_count) < 0) {
40706 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
40707 " is missmanaged.\n",
40708 - hvcsd->vdev->unit_address, hvcsd->open_count);
40709 + hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
40710 }
40711
40712 spin_unlock_irqrestore(&hvcsd->lock, flags);
40713 @@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc
40714
40715 spin_lock_irqsave(&hvcsd->lock, flags);
40716 /* Preserve this so that we know how many kref refs to put */
40717 - temp_open_count = hvcsd->open_count;
40718 + temp_open_count = local_read(&hvcsd->open_count);
40719
40720 /*
40721 * Don't kref put inside the spinlock because the destruction
40722 @@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc
40723 hvcsd->tty->driver_data = NULL;
40724 hvcsd->tty = NULL;
40725
40726 - hvcsd->open_count = 0;
40727 + local_set(&hvcsd->open_count, 0);
40728
40729 /* This will drop any buffered data on the floor which is OK in a hangup
40730 * scenario. */
40731 @@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct
40732 * the middle of a write operation? This is a crummy place to do this
40733 * but we want to keep it all in the spinlock.
40734 */
40735 - if (hvcsd->open_count <= 0) {
40736 + if (local_read(&hvcsd->open_count) <= 0) {
40737 spin_unlock_irqrestore(&hvcsd->lock, flags);
40738 return -ENODEV;
40739 }
40740 @@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st
40741 {
40742 struct hvcs_struct *hvcsd = tty->driver_data;
40743
40744 - if (!hvcsd || hvcsd->open_count <= 0)
40745 + if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
40746 return 0;
40747
40748 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
40749 diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c
40750 --- linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c 2011-05-19 00:06:34.000000000 -0400
40751 +++ linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c 2011-05-22 19:36:32.000000000 -0400
40752 @@ -123,7 +123,7 @@ static int domU_read_console(uint32_t vt
40753 return recv;
40754 }
40755
40756 -static struct hv_ops domU_hvc_ops = {
40757 +static const struct hv_ops domU_hvc_ops = {
40758 .get_chars = domU_read_console,
40759 .put_chars = domU_write_console,
40760 .notifier_add = notifier_add_irq,
40761 @@ -149,7 +149,7 @@ static int dom0_write_console(uint32_t v
40762 return len;
40763 }
40764
40765 -static struct hv_ops dom0_hvc_ops = {
40766 +static const struct hv_ops dom0_hvc_ops = {
40767 .get_chars = dom0_read_console,
40768 .put_chars = dom0_write_console,
40769 .notifier_add = notifier_add_irq,
40770 @@ -160,7 +160,7 @@ static struct hv_ops dom0_hvc_ops = {
40771 static int __init xen_hvc_init(void)
40772 {
40773 struct hvc_struct *hp;
40774 - struct hv_ops *ops;
40775 + const struct hv_ops *ops;
40776
40777 if (!xen_pv_domain())
40778 return -ENODEV;
40779 @@ -205,7 +205,7 @@ static void __exit xen_hvc_fini(void)
40780
40781 static int xen_cons_init(void)
40782 {
40783 - struct hv_ops *ops;
40784 + const struct hv_ops *ops;
40785
40786 if (!xen_pv_domain())
40787 return 0;
40788 diff -urNp linux-2.6.39.1/drivers/tty/ipwireless/tty.c linux-2.6.39.1/drivers/tty/ipwireless/tty.c
40789 --- linux-2.6.39.1/drivers/tty/ipwireless/tty.c 2011-05-19 00:06:34.000000000 -0400
40790 +++ linux-2.6.39.1/drivers/tty/ipwireless/tty.c 2011-05-22 19:36:32.000000000 -0400
40791 @@ -29,6 +29,7 @@
40792 #include <linux/tty_driver.h>
40793 #include <linux/tty_flip.h>
40794 #include <linux/uaccess.h>
40795 +#include <asm/local.h>
40796
40797 #include "tty.h"
40798 #include "network.h"
40799 @@ -51,7 +52,7 @@ struct ipw_tty {
40800 int tty_type;
40801 struct ipw_network *network;
40802 struct tty_struct *linux_tty;
40803 - int open_count;
40804 + local_t open_count;
40805 unsigned int control_lines;
40806 struct mutex ipw_tty_mutex;
40807 int tx_bytes_queued;
40808 @@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
40809 mutex_unlock(&tty->ipw_tty_mutex);
40810 return -ENODEV;
40811 }
40812 - if (tty->open_count == 0)
40813 + if (local_read(&tty->open_count) == 0)
40814 tty->tx_bytes_queued = 0;
40815
40816 - tty->open_count++;
40817 + local_inc(&tty->open_count);
40818
40819 tty->linux_tty = linux_tty;
40820 linux_tty->driver_data = tty;
40821 @@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
40822
40823 static void do_ipw_close(struct ipw_tty *tty)
40824 {
40825 - tty->open_count--;
40826 -
40827 - if (tty->open_count == 0) {
40828 + if (local_dec_return(&tty->open_count) == 0) {
40829 struct tty_struct *linux_tty = tty->linux_tty;
40830
40831 if (linux_tty != NULL) {
40832 @@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
40833 return;
40834
40835 mutex_lock(&tty->ipw_tty_mutex);
40836 - if (tty->open_count == 0) {
40837 + if (local_read(&tty->open_count) == 0) {
40838 mutex_unlock(&tty->ipw_tty_mutex);
40839 return;
40840 }
40841 @@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
40842 return;
40843 }
40844
40845 - if (!tty->open_count) {
40846 + if (!local_read(&tty->open_count)) {
40847 mutex_unlock(&tty->ipw_tty_mutex);
40848 return;
40849 }
40850 @@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
40851 return -ENODEV;
40852
40853 mutex_lock(&tty->ipw_tty_mutex);
40854 - if (!tty->open_count) {
40855 + if (!local_read(&tty->open_count)) {
40856 mutex_unlock(&tty->ipw_tty_mutex);
40857 return -EINVAL;
40858 }
40859 @@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
40860 if (!tty)
40861 return -ENODEV;
40862
40863 - if (!tty->open_count)
40864 + if (!local_read(&tty->open_count))
40865 return -EINVAL;
40866
40867 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
40868 @@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
40869 if (!tty)
40870 return 0;
40871
40872 - if (!tty->open_count)
40873 + if (!local_read(&tty->open_count))
40874 return 0;
40875
40876 return tty->tx_bytes_queued;
40877 @@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
40878 if (!tty)
40879 return -ENODEV;
40880
40881 - if (!tty->open_count)
40882 + if (!local_read(&tty->open_count))
40883 return -EINVAL;
40884
40885 return get_control_lines(tty);
40886 @@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
40887 if (!tty)
40888 return -ENODEV;
40889
40890 - if (!tty->open_count)
40891 + if (!local_read(&tty->open_count))
40892 return -EINVAL;
40893
40894 return set_control_lines(tty, set, clear);
40895 @@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
40896 if (!tty)
40897 return -ENODEV;
40898
40899 - if (!tty->open_count)
40900 + if (!local_read(&tty->open_count))
40901 return -EINVAL;
40902
40903 /* FIXME: Exactly how is the tty object locked here .. */
40904 @@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty
40905 against a parallel ioctl etc */
40906 mutex_lock(&ttyj->ipw_tty_mutex);
40907 }
40908 - while (ttyj->open_count)
40909 + while (local_read(&ttyj->open_count))
40910 do_ipw_close(ttyj);
40911 ipwireless_disassociate_network_ttys(network,
40912 ttyj->channel_idx);
40913 diff -urNp linux-2.6.39.1/drivers/tty/mxser.c linux-2.6.39.1/drivers/tty/mxser.c
40914 --- linux-2.6.39.1/drivers/tty/mxser.c 2011-05-19 00:06:34.000000000 -0400
40915 +++ linux-2.6.39.1/drivers/tty/mxser.c 2011-05-22 19:36:32.000000000 -0400
40916 @@ -2340,7 +2340,7 @@ static const struct tty_operations mxser
40917 .get_icount = mxser_get_icount,
40918 };
40919
40920 -struct tty_port_operations mxser_port_ops = {
40921 +const struct tty_port_operations mxser_port_ops = {
40922 .carrier_raised = mxser_carrier_raised,
40923 .dtr_rts = mxser_dtr_rts,
40924 .activate = mxser_activate,
40925 diff -urNp linux-2.6.39.1/drivers/tty/n_gsm.c linux-2.6.39.1/drivers/tty/n_gsm.c
40926 --- linux-2.6.39.1/drivers/tty/n_gsm.c 2011-05-19 00:06:34.000000000 -0400
40927 +++ linux-2.6.39.1/drivers/tty/n_gsm.c 2011-05-22 19:36:32.000000000 -0400
40928 @@ -1588,7 +1588,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
40929 return NULL;
40930 spin_lock_init(&dlci->lock);
40931 dlci->fifo = &dlci->_fifo;
40932 - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
40933 + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
40934 kfree(dlci);
40935 return NULL;
40936 }
40937 diff -urNp linux-2.6.39.1/drivers/tty/n_tty.c linux-2.6.39.1/drivers/tty/n_tty.c
40938 --- linux-2.6.39.1/drivers/tty/n_tty.c 2011-05-19 00:06:34.000000000 -0400
40939 +++ linux-2.6.39.1/drivers/tty/n_tty.c 2011-05-22 19:36:32.000000000 -0400
40940 @@ -2122,6 +2122,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
40941 {
40942 *ops = tty_ldisc_N_TTY;
40943 ops->owner = NULL;
40944 - ops->refcount = ops->flags = 0;
40945 + atomic_set(&ops->refcount, 0);
40946 + ops->flags = 0;
40947 }
40948 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
40949 diff -urNp linux-2.6.39.1/drivers/tty/pty.c linux-2.6.39.1/drivers/tty/pty.c
40950 --- linux-2.6.39.1/drivers/tty/pty.c 2011-05-19 00:06:34.000000000 -0400
40951 +++ linux-2.6.39.1/drivers/tty/pty.c 2011-05-22 19:36:32.000000000 -0400
40952 @@ -699,7 +699,18 @@ out:
40953 return retval;
40954 }
40955
40956 -static struct file_operations ptmx_fops;
40957 +static const struct file_operations ptmx_fops = {
40958 + .llseek = no_llseek,
40959 + .read = tty_read,
40960 + .write = tty_write,
40961 + .poll = tty_poll,
40962 + .unlocked_ioctl = tty_ioctl,
40963 + .compat_ioctl = tty_compat_ioctl,
40964 + .open = ptmx_open,
40965 + .release = tty_release,
40966 + .fasync = tty_fasync,
40967 +};
40968 +
40969
40970 static void __init unix98_pty_init(void)
40971 {
40972 @@ -752,10 +763,6 @@ static void __init unix98_pty_init(void)
40973
40974 register_sysctl_table(pty_root_table);
40975
40976 - /* Now create the /dev/ptmx special device */
40977 - tty_default_fops(&ptmx_fops);
40978 - ptmx_fops.open = ptmx_open;
40979 -
40980 cdev_init(&ptmx_cdev, &ptmx_fops);
40981 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
40982 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
40983 diff -urNp linux-2.6.39.1/drivers/tty/rocket.c linux-2.6.39.1/drivers/tty/rocket.c
40984 --- linux-2.6.39.1/drivers/tty/rocket.c 2011-05-19 00:06:34.000000000 -0400
40985 +++ linux-2.6.39.1/drivers/tty/rocket.c 2011-05-22 19:36:32.000000000 -0400
40986 @@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
40987 struct rocket_ports tmp;
40988 int board;
40989
40990 + pax_track_stack();
40991 +
40992 if (!retports)
40993 return -EFAULT;
40994 memset(&tmp, 0, sizeof (tmp));
40995 diff -urNp linux-2.6.39.1/drivers/tty/serial/21285.c linux-2.6.39.1/drivers/tty/serial/21285.c
40996 --- linux-2.6.39.1/drivers/tty/serial/21285.c 2011-05-19 00:06:34.000000000 -0400
40997 +++ linux-2.6.39.1/drivers/tty/serial/21285.c 2011-05-22 19:36:32.000000000 -0400
40998 @@ -340,7 +340,7 @@ static int serial21285_verify_port(struc
40999 return ret;
41000 }
41001
41002 -static struct uart_ops serial21285_ops = {
41003 +static const struct uart_ops serial21285_ops = {
41004 .tx_empty = serial21285_tx_empty,
41005 .get_mctrl = serial21285_get_mctrl,
41006 .set_mctrl = serial21285_set_mctrl,
41007 diff -urNp linux-2.6.39.1/drivers/tty/serial/8250.c linux-2.6.39.1/drivers/tty/serial/8250.c
41008 --- linux-2.6.39.1/drivers/tty/serial/8250.c 2011-05-19 00:06:34.000000000 -0400
41009 +++ linux-2.6.39.1/drivers/tty/serial/8250.c 2011-05-22 19:36:32.000000000 -0400
41010 @@ -2708,7 +2708,7 @@ serial8250_type(struct uart_port *port)
41011 return uart_config[type].name;
41012 }
41013
41014 -static struct uart_ops serial8250_pops = {
41015 +static const struct uart_ops serial8250_pops = {
41016 .tx_empty = serial8250_tx_empty,
41017 .set_mctrl = serial8250_set_mctrl,
41018 .get_mctrl = serial8250_get_mctrl,
41019 diff -urNp linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c
41020 --- linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c 2011-05-19 00:06:34.000000000 -0400
41021 +++ linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c 2011-05-22 19:36:32.000000000 -0400
41022 @@ -281,7 +281,7 @@ static int altera_jtaguart_verify_port(s
41023 /*
41024 * Define the basic serial functions we support.
41025 */
41026 -static struct uart_ops altera_jtaguart_ops = {
41027 +static const struct uart_ops altera_jtaguart_ops = {
41028 .tx_empty = altera_jtaguart_tx_empty,
41029 .get_mctrl = altera_jtaguart_get_mctrl,
41030 .set_mctrl = altera_jtaguart_set_mctrl,
41031 diff -urNp linux-2.6.39.1/drivers/tty/serial/altera_uart.c linux-2.6.39.1/drivers/tty/serial/altera_uart.c
41032 --- linux-2.6.39.1/drivers/tty/serial/altera_uart.c 2011-05-19 00:06:34.000000000 -0400
41033 +++ linux-2.6.39.1/drivers/tty/serial/altera_uart.c 2011-05-22 19:36:32.000000000 -0400
41034 @@ -380,7 +380,7 @@ static int altera_uart_verify_port(struc
41035 /*
41036 * Define the basic serial functions we support.
41037 */
41038 -static struct uart_ops altera_uart_ops = {
41039 +static const struct uart_ops altera_uart_ops = {
41040 .tx_empty = altera_uart_tx_empty,
41041 .get_mctrl = altera_uart_get_mctrl,
41042 .set_mctrl = altera_uart_set_mctrl,
41043 diff -urNp linux-2.6.39.1/drivers/tty/serial/amba-pl010.c linux-2.6.39.1/drivers/tty/serial/amba-pl010.c
41044 --- linux-2.6.39.1/drivers/tty/serial/amba-pl010.c 2011-05-19 00:06:34.000000000 -0400
41045 +++ linux-2.6.39.1/drivers/tty/serial/amba-pl010.c 2011-05-22 19:36:32.000000000 -0400
41046 @@ -529,7 +529,7 @@ static int pl010_verify_port(struct uart
41047 return ret;
41048 }
41049
41050 -static struct uart_ops amba_pl010_pops = {
41051 +static const struct uart_ops amba_pl010_pops = {
41052 .tx_empty = pl010_tx_empty,
41053 .set_mctrl = pl010_set_mctrl,
41054 .get_mctrl = pl010_get_mctrl,
41055 diff -urNp linux-2.6.39.1/drivers/tty/serial/amba-pl011.c linux-2.6.39.1/drivers/tty/serial/amba-pl011.c
41056 --- linux-2.6.39.1/drivers/tty/serial/amba-pl011.c 2011-05-19 00:06:34.000000000 -0400
41057 +++ linux-2.6.39.1/drivers/tty/serial/amba-pl011.c 2011-05-22 19:36:32.000000000 -0400
41058 @@ -1581,7 +1581,7 @@ static int pl010_verify_port(struct uart
41059 return ret;
41060 }
41061
41062 -static struct uart_ops amba_pl011_pops = {
41063 +static const struct uart_ops amba_pl011_pops = {
41064 .tx_empty = pl01x_tx_empty,
41065 .set_mctrl = pl011_set_mctrl,
41066 .get_mctrl = pl01x_get_mctrl,
41067 diff -urNp linux-2.6.39.1/drivers/tty/serial/apbuart.c linux-2.6.39.1/drivers/tty/serial/apbuart.c
41068 --- linux-2.6.39.1/drivers/tty/serial/apbuart.c 2011-05-19 00:06:34.000000000 -0400
41069 +++ linux-2.6.39.1/drivers/tty/serial/apbuart.c 2011-05-22 19:36:32.000000000 -0400
41070 @@ -328,7 +328,7 @@ static int apbuart_verify_port(struct ua
41071 return ret;
41072 }
41073
41074 -static struct uart_ops grlib_apbuart_ops = {
41075 +static const struct uart_ops grlib_apbuart_ops = {
41076 .tx_empty = apbuart_tx_empty,
41077 .set_mctrl = apbuart_set_mctrl,
41078 .get_mctrl = apbuart_get_mctrl,
41079 diff -urNp linux-2.6.39.1/drivers/tty/serial/atmel_serial.c linux-2.6.39.1/drivers/tty/serial/atmel_serial.c
41080 --- linux-2.6.39.1/drivers/tty/serial/atmel_serial.c 2011-05-19 00:06:34.000000000 -0400
41081 +++ linux-2.6.39.1/drivers/tty/serial/atmel_serial.c 2011-05-22 19:36:32.000000000 -0400
41082 @@ -1382,7 +1382,7 @@ atmel_ioctl(struct uart_port *port, unsi
41083
41084
41085
41086 -static struct uart_ops atmel_pops = {
41087 +static const struct uart_ops atmel_pops = {
41088 .tx_empty = atmel_tx_empty,
41089 .set_mctrl = atmel_set_mctrl,
41090 .get_mctrl = atmel_get_mctrl,
41091 diff -urNp linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c
41092 --- linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41093 +++ linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41094 @@ -636,7 +636,7 @@ static int bcm_uart_verify_port(struct u
41095 }
41096
41097 /* serial core callbacks */
41098 -static struct uart_ops bcm_uart_ops = {
41099 +static const struct uart_ops bcm_uart_ops = {
41100 .tx_empty = bcm_uart_tx_empty,
41101 .get_mctrl = bcm_uart_get_mctrl,
41102 .set_mctrl = bcm_uart_set_mctrl,
41103 diff -urNp linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c
41104 --- linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c 2011-05-19 00:06:34.000000000 -0400
41105 +++ linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c 2011-05-22 19:36:32.000000000 -0400
41106 @@ -1036,7 +1036,7 @@ static int bfin_kgdboc_port_startup(stru
41107 }
41108 #endif
41109
41110 -static struct uart_ops bfin_serial_pops = {
41111 +static const struct uart_ops bfin_serial_pops = {
41112 .tx_empty = bfin_serial_tx_empty,
41113 .set_mctrl = bfin_serial_set_mctrl,
41114 .get_mctrl = bfin_serial_get_mctrl,
41115 diff -urNp linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c
41116 --- linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c 2011-05-19 00:06:34.000000000 -0400
41117 +++ linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c 2011-05-22 19:36:32.000000000 -0400
41118 @@ -571,7 +571,7 @@ static void sport_set_termios(struct uar
41119 spin_unlock_irqrestore(&up->port.lock, flags);
41120 }
41121
41122 -struct uart_ops sport_uart_ops = {
41123 +const struct uart_ops sport_uart_ops = {
41124 .tx_empty = sport_tx_empty,
41125 .set_mctrl = sport_set_mctrl,
41126 .get_mctrl = sport_get_mctrl,
41127 diff -urNp linux-2.6.39.1/drivers/tty/serial/clps711x.c linux-2.6.39.1/drivers/tty/serial/clps711x.c
41128 --- linux-2.6.39.1/drivers/tty/serial/clps711x.c 2011-05-19 00:06:34.000000000 -0400
41129 +++ linux-2.6.39.1/drivers/tty/serial/clps711x.c 2011-05-22 19:36:32.000000000 -0400
41130 @@ -380,7 +380,7 @@ static int clps711xuart_request_port(str
41131 return 0;
41132 }
41133
41134 -static struct uart_ops clps711x_pops = {
41135 +static const struct uart_ops clps711x_pops = {
41136 .tx_empty = clps711xuart_tx_empty,
41137 .set_mctrl = clps711xuart_set_mctrl_null,
41138 .get_mctrl = clps711xuart_get_mctrl,
41139 diff -urNp linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c
41140 --- linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-19 00:06:34.000000000 -0400
41141 +++ linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-22 19:36:32.000000000 -0400
41142 @@ -1099,7 +1099,7 @@ static void cpm_put_poll_char(struct uar
41143 }
41144 #endif /* CONFIG_CONSOLE_POLL */
41145
41146 -static struct uart_ops cpm_uart_pops = {
41147 +static const struct uart_ops cpm_uart_pops = {
41148 .tx_empty = cpm_uart_tx_empty,
41149 .set_mctrl = cpm_uart_set_mctrl,
41150 .get_mctrl = cpm_uart_get_mctrl,
41151 diff -urNp linux-2.6.39.1/drivers/tty/serial/dz.c linux-2.6.39.1/drivers/tty/serial/dz.c
41152 --- linux-2.6.39.1/drivers/tty/serial/dz.c 2011-05-19 00:06:34.000000000 -0400
41153 +++ linux-2.6.39.1/drivers/tty/serial/dz.c 2011-05-22 19:36:32.000000000 -0400
41154 @@ -746,7 +746,7 @@ static int dz_verify_port(struct uart_po
41155 return ret;
41156 }
41157
41158 -static struct uart_ops dz_ops = {
41159 +static const struct uart_ops dz_ops = {
41160 .tx_empty = dz_tx_empty,
41161 .get_mctrl = dz_get_mctrl,
41162 .set_mctrl = dz_set_mctrl,
41163 diff -urNp linux-2.6.39.1/drivers/tty/serial/imx.c linux-2.6.39.1/drivers/tty/serial/imx.c
41164 --- linux-2.6.39.1/drivers/tty/serial/imx.c 2011-05-19 00:06:34.000000000 -0400
41165 +++ linux-2.6.39.1/drivers/tty/serial/imx.c 2011-05-22 19:36:32.000000000 -0400
41166 @@ -1018,7 +1018,7 @@ imx_verify_port(struct uart_port *port,
41167 return ret;
41168 }
41169
41170 -static struct uart_ops imx_pops = {
41171 +static const struct uart_ops imx_pops = {
41172 .tx_empty = imx_tx_empty,
41173 .set_mctrl = imx_set_mctrl,
41174 .get_mctrl = imx_get_mctrl,
41175 diff -urNp linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c
41176 --- linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c 2011-05-19 00:06:34.000000000 -0400
41177 +++ linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c 2011-05-22 19:36:32.000000000 -0400
41178 @@ -1874,7 +1874,7 @@ static int ic3_request_port(struct uart_
41179 }
41180
41181 /* Associate the uart functions above - given to serial core */
41182 -static struct uart_ops ioc3_ops = {
41183 +static const struct uart_ops ioc3_ops = {
41184 .tx_empty = ic3_tx_empty,
41185 .set_mctrl = ic3_set_mctrl,
41186 .get_mctrl = ic3_get_mctrl,
41187 diff -urNp linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c
41188 --- linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c 2011-05-19 00:06:34.000000000 -0400
41189 +++ linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c 2011-05-22 19:36:32.000000000 -0400
41190 @@ -2593,7 +2593,7 @@ static int ic4_request_port(struct uart_
41191
41192 /* Associate the uart functions above - given to serial core */
41193
41194 -static struct uart_ops ioc4_ops = {
41195 +static const struct uart_ops ioc4_ops = {
41196 .tx_empty = ic4_tx_empty,
41197 .set_mctrl = ic4_set_mctrl,
41198 .get_mctrl = ic4_get_mctrl,
41199 diff -urNp linux-2.6.39.1/drivers/tty/serial/ip22zilog.c linux-2.6.39.1/drivers/tty/serial/ip22zilog.c
41200 --- linux-2.6.39.1/drivers/tty/serial/ip22zilog.c 2011-05-19 00:06:34.000000000 -0400
41201 +++ linux-2.6.39.1/drivers/tty/serial/ip22zilog.c 2011-05-22 19:36:32.000000000 -0400
41202 @@ -928,7 +928,7 @@ static int ip22zilog_verify_port(struct
41203 return -EINVAL;
41204 }
41205
41206 -static struct uart_ops ip22zilog_pops = {
41207 +static const struct uart_ops ip22zilog_pops = {
41208 .tx_empty = ip22zilog_tx_empty,
41209 .set_mctrl = ip22zilog_set_mctrl,
41210 .get_mctrl = ip22zilog_get_mctrl,
41211 diff -urNp linux-2.6.39.1/drivers/tty/serial/kgdboc.c linux-2.6.39.1/drivers/tty/serial/kgdboc.c
41212 --- linux-2.6.39.1/drivers/tty/serial/kgdboc.c 2011-05-19 00:06:34.000000000 -0400
41213 +++ linux-2.6.39.1/drivers/tty/serial/kgdboc.c 2011-05-22 19:36:32.000000000 -0400
41214 @@ -22,7 +22,7 @@
41215
41216 #define MAX_CONFIG_LEN 40
41217
41218 -static struct kgdb_io kgdboc_io_ops;
41219 +static struct kgdb_io kgdboc_io_ops; /* cannot be const, see configure_kgdboc() */
41220
41221 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
41222 static int configured = -1;
41223 @@ -293,7 +293,7 @@ static void kgdboc_post_exp_handler(void
41224 kgdboc_restore_input();
41225 }
41226
41227 -static struct kgdb_io kgdboc_io_ops = {
41228 +static struct kgdb_io kgdboc_io_ops = { /* cannot be const, see configure_kgdboc() */
41229 .name = "kgdboc",
41230 .read_char = kgdboc_get_char,
41231 .write_char = kgdboc_put_char,
41232 diff -urNp linux-2.6.39.1/drivers/tty/serial/m32r_sio.c linux-2.6.39.1/drivers/tty/serial/m32r_sio.c
41233 --- linux-2.6.39.1/drivers/tty/serial/m32r_sio.c 2011-05-19 00:06:34.000000000 -0400
41234 +++ linux-2.6.39.1/drivers/tty/serial/m32r_sio.c 2011-05-22 19:36:32.000000000 -0400
41235 @@ -939,7 +939,7 @@ m32r_sio_type(struct uart_port *port)
41236 return uart_config[type].name;
41237 }
41238
41239 -static struct uart_ops m32r_sio_pops = {
41240 +static const struct uart_ops m32r_sio_pops = {
41241 .tx_empty = m32r_sio_tx_empty,
41242 .set_mctrl = m32r_sio_set_mctrl,
41243 .get_mctrl = m32r_sio_get_mctrl,
41244 diff -urNp linux-2.6.39.1/drivers/tty/serial/max3100.c linux-2.6.39.1/drivers/tty/serial/max3100.c
41245 --- linux-2.6.39.1/drivers/tty/serial/max3100.c 2011-05-19 00:06:34.000000000 -0400
41246 +++ linux-2.6.39.1/drivers/tty/serial/max3100.c 2011-05-22 19:36:32.000000000 -0400
41247 @@ -710,7 +710,7 @@ static void max3100_break_ctl(struct uar
41248 dev_dbg(&s->spi->dev, "%s\n", __func__);
41249 }
41250
41251 -static struct uart_ops max3100_ops = {
41252 +static const struct uart_ops max3100_ops = {
41253 .tx_empty = max3100_tx_empty,
41254 .set_mctrl = max3100_set_mctrl,
41255 .get_mctrl = max3100_get_mctrl,
41256 diff -urNp linux-2.6.39.1/drivers/tty/serial/max3107.c linux-2.6.39.1/drivers/tty/serial/max3107.c
41257 --- linux-2.6.39.1/drivers/tty/serial/max3107.c 2011-05-19 00:06:34.000000000 -0400
41258 +++ linux-2.6.39.1/drivers/tty/serial/max3107.c 2011-05-22 19:36:32.000000000 -0400
41259 @@ -910,7 +910,7 @@ static void max3107_break_ctl(struct uar
41260
41261
41262 /* Port functions */
41263 -static struct uart_ops max3107_ops = {
41264 +static const struct uart_ops max3107_ops = {
41265 .tx_empty = max3107_tx_empty,
41266 .set_mctrl = max3107_set_mctrl,
41267 .get_mctrl = max3107_get_mctrl,
41268 diff -urNp linux-2.6.39.1/drivers/tty/serial/mfd.c linux-2.6.39.1/drivers/tty/serial/mfd.c
41269 --- linux-2.6.39.1/drivers/tty/serial/mfd.c 2011-05-19 00:06:34.000000000 -0400
41270 +++ linux-2.6.39.1/drivers/tty/serial/mfd.c 2011-05-22 19:36:32.000000000 -0400
41271 @@ -1178,7 +1178,7 @@ static struct console serial_hsu_console
41272 };
41273 #endif
41274
41275 -struct uart_ops serial_hsu_pops = {
41276 +const struct uart_ops serial_hsu_pops = {
41277 .tx_empty = serial_hsu_tx_empty,
41278 .set_mctrl = serial_hsu_set_mctrl,
41279 .get_mctrl = serial_hsu_get_mctrl,
41280 diff -urNp linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c
41281 --- linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41282 +++ linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41283 @@ -283,7 +283,7 @@ static irqreturn_t mpc52xx_psc_handle_ir
41284 return mpc5xxx_uart_process_int(port);
41285 }
41286
41287 -static struct psc_ops mpc52xx_psc_ops = {
41288 +static const struct psc_ops mpc52xx_psc_ops = {
41289 .fifo_init = mpc52xx_psc_fifo_init,
41290 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41291 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41292 @@ -304,7 +304,7 @@ static struct psc_ops mpc52xx_psc_ops =
41293 .handle_irq = mpc52xx_psc_handle_irq,
41294 };
41295
41296 -static struct psc_ops mpc5200b_psc_ops = {
41297 +static const struct psc_ops mpc5200b_psc_ops = {
41298 .fifo_init = mpc52xx_psc_fifo_init,
41299 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41300 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41301 @@ -571,7 +571,7 @@ static void mpc512x_psc_get_irq(struct u
41302 port->irq = psc_fifoc_irq;
41303 }
41304
41305 -static struct psc_ops mpc512x_psc_ops = {
41306 +static const struct psc_ops mpc512x_psc_ops = {
41307 .fifo_init = mpc512x_psc_fifo_init,
41308 .raw_rx_rdy = mpc512x_psc_raw_rx_rdy,
41309 .raw_tx_rdy = mpc512x_psc_raw_tx_rdy,
41310 @@ -596,7 +596,7 @@ static struct psc_ops mpc512x_psc_ops =
41311 };
41312 #endif
41313
41314 -static struct psc_ops *psc_ops;
41315 +static const struct psc_ops *psc_ops;
41316
41317 /* ======================================================================== */
41318 /* UART operations */
41319 @@ -905,7 +905,7 @@ mpc52xx_uart_verify_port(struct uart_por
41320 }
41321
41322
41323 -static struct uart_ops mpc52xx_uart_ops = {
41324 +static const struct uart_ops mpc52xx_uart_ops = {
41325 .tx_empty = mpc52xx_uart_tx_empty,
41326 .set_mctrl = mpc52xx_uart_set_mctrl,
41327 .get_mctrl = mpc52xx_uart_get_mctrl,
41328 diff -urNp linux-2.6.39.1/drivers/tty/serial/mpsc.c linux-2.6.39.1/drivers/tty/serial/mpsc.c
41329 --- linux-2.6.39.1/drivers/tty/serial/mpsc.c 2011-05-19 00:06:34.000000000 -0400
41330 +++ linux-2.6.39.1/drivers/tty/serial/mpsc.c 2011-05-22 19:36:32.000000000 -0400
41331 @@ -1663,7 +1663,7 @@ static void mpsc_put_poll_char(struct ua
41332 }
41333 #endif
41334
41335 -static struct uart_ops mpsc_pops = {
41336 +static const struct uart_ops mpsc_pops = {
41337 .tx_empty = mpsc_tx_empty,
41338 .set_mctrl = mpsc_set_mctrl,
41339 .get_mctrl = mpsc_get_mctrl,
41340 diff -urNp linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c
41341 --- linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c 2011-05-19 00:06:34.000000000 -0400
41342 +++ linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c 2011-05-22 19:36:32.000000000 -0400
41343 @@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
41344 int loop = 1, num, total = 0;
41345 u8 recv_buf[512], *pbuf;
41346
41347 + pax_track_stack();
41348 +
41349 pbuf = recv_buf;
41350 do {
41351 num = max3110_read_multi(max, pbuf);
41352 @@ -726,7 +728,7 @@ static void serial_m3110_enable_ms(struc
41353 {
41354 }
41355
41356 -struct uart_ops serial_m3110_ops = {
41357 +const struct uart_ops serial_m3110_ops = {
41358 .tx_empty = serial_m3110_tx_empty,
41359 .set_mctrl = serial_m3110_set_mctrl,
41360 .get_mctrl = serial_m3110_get_mctrl,
41361 diff -urNp linux-2.6.39.1/drivers/tty/serial/msm_serial.c linux-2.6.39.1/drivers/tty/serial/msm_serial.c
41362 --- linux-2.6.39.1/drivers/tty/serial/msm_serial.c 2011-05-19 00:06:34.000000000 -0400
41363 +++ linux-2.6.39.1/drivers/tty/serial/msm_serial.c 2011-05-22 19:36:32.000000000 -0400
41364 @@ -702,7 +702,7 @@ static void msm_power(struct uart_port *
41365 }
41366 }
41367
41368 -static struct uart_ops msm_uart_pops = {
41369 +static const struct uart_ops msm_uart_pops = {
41370 .tx_empty = msm_tx_empty,
41371 .set_mctrl = msm_set_mctrl,
41372 .get_mctrl = msm_get_mctrl,
41373 diff -urNp linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c
41374 --- linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c 2011-05-19 00:06:34.000000000 -0400
41375 +++ linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c 2011-05-22 19:36:32.000000000 -0400
41376 @@ -360,7 +360,7 @@ struct msm_hs_port {
41377 static struct msm_hs_port q_uart_port[UARTDM_NR];
41378 static struct platform_driver msm_serial_hs_platform_driver;
41379 static struct uart_driver msm_hs_driver;
41380 -static struct uart_ops msm_hs_ops;
41381 +static const struct uart_ops msm_hs_ops;
41382 static struct workqueue_struct *msm_hs_workqueue;
41383
41384 #define UARTDM_TO_MSM(uart_port) \
41385 @@ -1856,7 +1856,7 @@ static struct uart_driver msm_hs_driver
41386 .cons = 0,
41387 };
41388
41389 -static struct uart_ops msm_hs_ops = {
41390 +static const struct uart_ops msm_hs_ops = {
41391 .tx_empty = msm_hs_tx_empty,
41392 .set_mctrl = msm_hs_set_mctrl_locked,
41393 .get_mctrl = msm_hs_get_mctrl_locked,
41394 diff -urNp linux-2.6.39.1/drivers/tty/serial/mux.c linux-2.6.39.1/drivers/tty/serial/mux.c
41395 --- linux-2.6.39.1/drivers/tty/serial/mux.c 2011-05-19 00:06:34.000000000 -0400
41396 +++ linux-2.6.39.1/drivers/tty/serial/mux.c 2011-05-22 19:36:32.000000000 -0400
41397 @@ -442,7 +442,7 @@ static struct console mux_console = {
41398 #define MUX_CONSOLE NULL
41399 #endif
41400
41401 -static struct uart_ops mux_pops = {
41402 +static const struct uart_ops mux_pops = {
41403 .tx_empty = mux_tx_empty,
41404 .set_mctrl = mux_set_mctrl,
41405 .get_mctrl = mux_get_mctrl,
41406 diff -urNp linux-2.6.39.1/drivers/tty/serial/mxs-auart.c linux-2.6.39.1/drivers/tty/serial/mxs-auart.c
41407 --- linux-2.6.39.1/drivers/tty/serial/mxs-auart.c 2011-05-19 00:06:34.000000000 -0400
41408 +++ linux-2.6.39.1/drivers/tty/serial/mxs-auart.c 2011-05-22 19:36:32.000000000 -0400
41409 @@ -499,7 +499,7 @@ static void mxs_auart_enable_ms(struct u
41410 /* just empty */
41411 }
41412
41413 -static struct uart_ops mxs_auart_ops = {
41414 +static const struct uart_ops mxs_auart_ops = {
41415 .tx_empty = mxs_auart_tx_empty,
41416 .start_tx = mxs_auart_start_tx,
41417 .stop_tx = mxs_auart_stop_tx,
41418 diff -urNp linux-2.6.39.1/drivers/tty/serial/netx-serial.c linux-2.6.39.1/drivers/tty/serial/netx-serial.c
41419 --- linux-2.6.39.1/drivers/tty/serial/netx-serial.c 2011-05-19 00:06:34.000000000 -0400
41420 +++ linux-2.6.39.1/drivers/tty/serial/netx-serial.c 2011-05-22 19:36:32.000000000 -0400
41421 @@ -464,7 +464,7 @@ netx_verify_port(struct uart_port *port,
41422 return ret;
41423 }
41424
41425 -static struct uart_ops netx_pops = {
41426 +static const struct uart_ops netx_pops = {
41427 .tx_empty = netx_tx_empty,
41428 .set_mctrl = netx_set_mctrl,
41429 .get_mctrl = netx_get_mctrl,
41430 diff -urNp linux-2.6.39.1/drivers/tty/serial/nwpserial.c linux-2.6.39.1/drivers/tty/serial/nwpserial.c
41431 --- linux-2.6.39.1/drivers/tty/serial/nwpserial.c 2011-05-19 00:06:34.000000000 -0400
41432 +++ linux-2.6.39.1/drivers/tty/serial/nwpserial.c 2011-05-22 19:36:32.000000000 -0400
41433 @@ -303,7 +303,7 @@ static unsigned int nwpserial_tx_empty(s
41434 return ret & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
41435 }
41436
41437 -static struct uart_ops nwpserial_pops = {
41438 +static const struct uart_ops nwpserial_pops = {
41439 .tx_empty = nwpserial_tx_empty,
41440 .set_mctrl = nwpserial_set_mctrl,
41441 .get_mctrl = nwpserial_get_mctrl,
41442 diff -urNp linux-2.6.39.1/drivers/tty/serial/omap-serial.c linux-2.6.39.1/drivers/tty/serial/omap-serial.c
41443 --- linux-2.6.39.1/drivers/tty/serial/omap-serial.c 2011-05-19 00:06:34.000000000 -0400
41444 +++ linux-2.6.39.1/drivers/tty/serial/omap-serial.c 2011-05-22 19:36:32.000000000 -0400
41445 @@ -1029,7 +1029,7 @@ static inline void serial_omap_add_conso
41446
41447 #endif
41448
41449 -static struct uart_ops serial_omap_pops = {
41450 +static const struct uart_ops serial_omap_pops = {
41451 .tx_empty = serial_omap_tx_empty,
41452 .set_mctrl = serial_omap_set_mctrl,
41453 .get_mctrl = serial_omap_get_mctrl,
41454 diff -urNp linux-2.6.39.1/drivers/tty/serial/pch_uart.c linux-2.6.39.1/drivers/tty/serial/pch_uart.c
41455 --- linux-2.6.39.1/drivers/tty/serial/pch_uart.c 2011-05-19 00:06:34.000000000 -0400
41456 +++ linux-2.6.39.1/drivers/tty/serial/pch_uart.c 2011-05-22 19:36:32.000000000 -0400
41457 @@ -1351,7 +1351,7 @@ static int pch_uart_verify_port(struct u
41458 return 0;
41459 }
41460
41461 -static struct uart_ops pch_uart_ops = {
41462 +static const struct uart_ops pch_uart_ops = {
41463 .tx_empty = pch_uart_tx_empty,
41464 .set_mctrl = pch_uart_set_mctrl,
41465 .get_mctrl = pch_uart_get_mctrl,
41466 diff -urNp linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c
41467 --- linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c 2011-05-19 00:06:34.000000000 -0400
41468 +++ linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c 2011-05-22 19:36:32.000000000 -0400
41469 @@ -1427,7 +1427,7 @@ static void pmz_poll_put_char(struct uar
41470
41471 #endif /* CONFIG_CONSOLE_POLL */
41472
41473 -static struct uart_ops pmz_pops = {
41474 +static const struct uart_ops pmz_pops = {
41475 .tx_empty = pmz_tx_empty,
41476 .set_mctrl = pmz_set_mctrl,
41477 .get_mctrl = pmz_get_mctrl,
41478 diff -urNp linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c
41479 --- linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c 2011-05-19 00:06:34.000000000 -0400
41480 +++ linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c 2011-05-22 19:36:32.000000000 -0400
41481 @@ -614,7 +614,7 @@ pnx8xxx_verify_port(struct uart_port *po
41482 return ret;
41483 }
41484
41485 -static struct uart_ops pnx8xxx_pops = {
41486 +static const struct uart_ops pnx8xxx_pops = {
41487 .tx_empty = pnx8xxx_tx_empty,
41488 .set_mctrl = pnx8xxx_set_mctrl,
41489 .get_mctrl = pnx8xxx_get_mctrl,
41490 diff -urNp linux-2.6.39.1/drivers/tty/serial/pxa.c linux-2.6.39.1/drivers/tty/serial/pxa.c
41491 --- linux-2.6.39.1/drivers/tty/serial/pxa.c 2011-05-19 00:06:34.000000000 -0400
41492 +++ linux-2.6.39.1/drivers/tty/serial/pxa.c 2011-05-22 19:36:32.000000000 -0400
41493 @@ -706,7 +706,7 @@ static struct console serial_pxa_console
41494 #define PXA_CONSOLE NULL
41495 #endif
41496
41497 -struct uart_ops serial_pxa_pops = {
41498 +const struct uart_ops serial_pxa_pops = {
41499 .tx_empty = serial_pxa_tx_empty,
41500 .set_mctrl = serial_pxa_set_mctrl,
41501 .get_mctrl = serial_pxa_get_mctrl,
41502 diff -urNp linux-2.6.39.1/drivers/tty/serial/sa1100.c linux-2.6.39.1/drivers/tty/serial/sa1100.c
41503 --- linux-2.6.39.1/drivers/tty/serial/sa1100.c 2011-05-19 00:06:34.000000000 -0400
41504 +++ linux-2.6.39.1/drivers/tty/serial/sa1100.c 2011-05-22 19:36:32.000000000 -0400
41505 @@ -577,7 +577,7 @@ sa1100_verify_port(struct uart_port *por
41506 return ret;
41507 }
41508
41509 -static struct uart_ops sa1100_pops = {
41510 +static const struct uart_ops sa1100_pops = {
41511 .tx_empty = sa1100_tx_empty,
41512 .set_mctrl = sa1100_set_mctrl,
41513 .get_mctrl = sa1100_get_mctrl,
41514 diff -urNp linux-2.6.39.1/drivers/tty/serial/samsung.c linux-2.6.39.1/drivers/tty/serial/samsung.c
41515 --- linux-2.6.39.1/drivers/tty/serial/samsung.c 2011-05-19 00:06:34.000000000 -0400
41516 +++ linux-2.6.39.1/drivers/tty/serial/samsung.c 2011-05-22 19:36:32.000000000 -0400
41517 @@ -860,7 +860,7 @@ static struct console s3c24xx_serial_con
41518 #define S3C24XX_SERIAL_CONSOLE NULL
41519 #endif
41520
41521 -static struct uart_ops s3c24xx_serial_ops = {
41522 +static const struct uart_ops s3c24xx_serial_ops = {
41523 .pm = s3c24xx_serial_pm,
41524 .tx_empty = s3c24xx_serial_tx_empty,
41525 .get_mctrl = s3c24xx_serial_get_mctrl,
41526 diff -urNp linux-2.6.39.1/drivers/tty/serial/sc26xx.c linux-2.6.39.1/drivers/tty/serial/sc26xx.c
41527 --- linux-2.6.39.1/drivers/tty/serial/sc26xx.c 2011-05-19 00:06:34.000000000 -0400
41528 +++ linux-2.6.39.1/drivers/tty/serial/sc26xx.c 2011-05-22 19:36:32.000000000 -0400
41529 @@ -515,7 +515,7 @@ static int sc26xx_verify_port(struct uar
41530 return -EINVAL;
41531 }
41532
41533 -static struct uart_ops sc26xx_ops = {
41534 +static const struct uart_ops sc26xx_ops = {
41535 .tx_empty = sc26xx_tx_empty,
41536 .set_mctrl = sc26xx_set_mctrl,
41537 .get_mctrl = sc26xx_get_mctrl,
41538 diff -urNp linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c
41539 --- linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c 2011-05-19 00:06:34.000000000 -0400
41540 +++ linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c 2011-05-22 19:36:32.000000000 -0400
41541 @@ -528,7 +528,7 @@ static int ks8695uart_verify_port(struct
41542 return ret;
41543 }
41544
41545 -static struct uart_ops ks8695uart_pops = {
41546 +static const struct uart_ops ks8695uart_pops = {
41547 .tx_empty = ks8695uart_tx_empty,
41548 .set_mctrl = ks8695uart_set_mctrl,
41549 .get_mctrl = ks8695uart_get_mctrl,
41550 diff -urNp linux-2.6.39.1/drivers/tty/serial/serial_txx9.c linux-2.6.39.1/drivers/tty/serial/serial_txx9.c
41551 --- linux-2.6.39.1/drivers/tty/serial/serial_txx9.c 2011-05-19 00:06:34.000000000 -0400
41552 +++ linux-2.6.39.1/drivers/tty/serial/serial_txx9.c 2011-05-22 19:36:32.000000000 -0400
41553 @@ -857,7 +857,7 @@ serial_txx9_type(struct uart_port *port)
41554 return "txx9";
41555 }
41556
41557 -static struct uart_ops serial_txx9_pops = {
41558 +static const struct uart_ops serial_txx9_pops = {
41559 .tx_empty = serial_txx9_tx_empty,
41560 .set_mctrl = serial_txx9_set_mctrl,
41561 .get_mctrl = serial_txx9_get_mctrl,
41562 diff -urNp linux-2.6.39.1/drivers/tty/serial/sn_console.c linux-2.6.39.1/drivers/tty/serial/sn_console.c
41563 --- linux-2.6.39.1/drivers/tty/serial/sn_console.c 2011-05-19 00:06:34.000000000 -0400
41564 +++ linux-2.6.39.1/drivers/tty/serial/sn_console.c 2011-05-22 19:36:32.000000000 -0400
41565 @@ -388,7 +388,7 @@ static void snp_config_port(struct uart_
41566
41567 /* Associate the uart functions above - given to serial core */
41568
41569 -static struct uart_ops sn_console_ops = {
41570 +static const struct uart_ops sn_console_ops = {
41571 .tx_empty = snp_tx_empty,
41572 .set_mctrl = snp_set_mctrl,
41573 .get_mctrl = snp_get_mctrl,
41574 diff -urNp linux-2.6.39.1/drivers/tty/serial/sunhv.c linux-2.6.39.1/drivers/tty/serial/sunhv.c
41575 --- linux-2.6.39.1/drivers/tty/serial/sunhv.c 2011-05-19 00:06:34.000000000 -0400
41576 +++ linux-2.6.39.1/drivers/tty/serial/sunhv.c 2011-05-22 19:36:32.000000000 -0400
41577 @@ -168,12 +168,12 @@ struct sunhv_ops {
41578 int (*receive_chars)(struct uart_port *port, struct tty_struct *tty);
41579 };
41580
41581 -static struct sunhv_ops bychar_ops = {
41582 +static const struct sunhv_ops bychar_ops = {
41583 .transmit_chars = transmit_chars_putchar,
41584 .receive_chars = receive_chars_getchar,
41585 };
41586
41587 -static struct sunhv_ops bywrite_ops = {
41588 +static const struct sunhv_ops bywrite_ops = {
41589 .transmit_chars = transmit_chars_write,
41590 .receive_chars = receive_chars_read,
41591 };
41592 @@ -370,7 +370,7 @@ static int sunhv_verify_port(struct uart
41593 return -EINVAL;
41594 }
41595
41596 -static struct uart_ops sunhv_pops = {
41597 +static const struct uart_ops sunhv_pops = {
41598 .tx_empty = sunhv_tx_empty,
41599 .set_mctrl = sunhv_set_mctrl,
41600 .get_mctrl = sunhv_get_mctrl,
41601 diff -urNp linux-2.6.39.1/drivers/tty/serial/sunsab.c linux-2.6.39.1/drivers/tty/serial/sunsab.c
41602 --- linux-2.6.39.1/drivers/tty/serial/sunsab.c 2011-05-19 00:06:34.000000000 -0400
41603 +++ linux-2.6.39.1/drivers/tty/serial/sunsab.c 2011-05-22 19:36:32.000000000 -0400
41604 @@ -804,7 +804,7 @@ static int sunsab_verify_port(struct uar
41605 return -EINVAL;
41606 }
41607
41608 -static struct uart_ops sunsab_pops = {
41609 +static const struct uart_ops sunsab_pops = {
41610 .tx_empty = sunsab_tx_empty,
41611 .set_mctrl = sunsab_set_mctrl,
41612 .get_mctrl = sunsab_get_mctrl,
41613 diff -urNp linux-2.6.39.1/drivers/tty/serial/sunsu.c linux-2.6.39.1/drivers/tty/serial/sunsu.c
41614 --- linux-2.6.39.1/drivers/tty/serial/sunsu.c 2011-05-19 00:06:34.000000000 -0400
41615 +++ linux-2.6.39.1/drivers/tty/serial/sunsu.c 2011-05-22 19:36:32.000000000 -0400
41616 @@ -946,7 +946,7 @@ sunsu_type(struct uart_port *port)
41617 return uart_config[type].name;
41618 }
41619
41620 -static struct uart_ops sunsu_pops = {
41621 +static const struct uart_ops sunsu_pops = {
41622 .tx_empty = sunsu_tx_empty,
41623 .set_mctrl = sunsu_set_mctrl,
41624 .get_mctrl = sunsu_get_mctrl,
41625 diff -urNp linux-2.6.39.1/drivers/tty/serial/sunzilog.c linux-2.6.39.1/drivers/tty/serial/sunzilog.c
41626 --- linux-2.6.39.1/drivers/tty/serial/sunzilog.c 2011-05-19 00:06:34.000000000 -0400
41627 +++ linux-2.6.39.1/drivers/tty/serial/sunzilog.c 2011-05-22 19:36:32.000000000 -0400
41628 @@ -1042,7 +1042,7 @@ static void sunzilog_put_poll_char(struc
41629 }
41630 #endif /* CONFIG_CONSOLE_POLL */
41631
41632 -static struct uart_ops sunzilog_pops = {
41633 +static const struct uart_ops sunzilog_pops = {
41634 .tx_empty = sunzilog_tx_empty,
41635 .set_mctrl = sunzilog_set_mctrl,
41636 .get_mctrl = sunzilog_get_mctrl,
41637 diff -urNp linux-2.6.39.1/drivers/tty/serial/timbuart.c linux-2.6.39.1/drivers/tty/serial/timbuart.c
41638 --- linux-2.6.39.1/drivers/tty/serial/timbuart.c 2011-05-19 00:06:34.000000000 -0400
41639 +++ linux-2.6.39.1/drivers/tty/serial/timbuart.c 2011-05-22 19:36:32.000000000 -0400
41640 @@ -394,7 +394,7 @@ static int timbuart_verify_port(struct u
41641 return -EINVAL;
41642 }
41643
41644 -static struct uart_ops timbuart_ops = {
41645 +static const struct uart_ops timbuart_ops = {
41646 .tx_empty = timbuart_tx_empty,
41647 .set_mctrl = timbuart_set_mctrl,
41648 .get_mctrl = timbuart_get_mctrl,
41649 diff -urNp linux-2.6.39.1/drivers/tty/serial/uartlite.c linux-2.6.39.1/drivers/tty/serial/uartlite.c
41650 --- linux-2.6.39.1/drivers/tty/serial/uartlite.c 2011-05-19 00:06:34.000000000 -0400
41651 +++ linux-2.6.39.1/drivers/tty/serial/uartlite.c 2011-05-22 19:36:32.000000000 -0400
41652 @@ -331,7 +331,7 @@ static void ulite_put_poll_char(struct u
41653 }
41654 #endif
41655
41656 -static struct uart_ops ulite_ops = {
41657 +static const struct uart_ops ulite_ops = {
41658 .tx_empty = ulite_tx_empty,
41659 .set_mctrl = ulite_set_mctrl,
41660 .get_mctrl = ulite_get_mctrl,
41661 diff -urNp linux-2.6.39.1/drivers/tty/serial/ucc_uart.c linux-2.6.39.1/drivers/tty/serial/ucc_uart.c
41662 --- linux-2.6.39.1/drivers/tty/serial/ucc_uart.c 2011-05-19 00:06:34.000000000 -0400
41663 +++ linux-2.6.39.1/drivers/tty/serial/ucc_uart.c 2011-05-22 19:36:32.000000000 -0400
41664 @@ -1088,7 +1088,7 @@ static int qe_uart_verify_port(struct ua
41665 *
41666 * Details on these functions can be found in Documentation/serial/driver
41667 */
41668 -static struct uart_ops qe_uart_pops = {
41669 +static const struct uart_ops qe_uart_pops = {
41670 .tx_empty = qe_uart_tx_empty,
41671 .set_mctrl = qe_uart_set_mctrl,
41672 .get_mctrl = qe_uart_get_mctrl,
41673 diff -urNp linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c
41674 --- linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c 2011-05-19 00:06:34.000000000 -0400
41675 +++ linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c 2011-05-22 19:36:32.000000000 -0400
41676 @@ -683,7 +683,7 @@ static int siu_verify_port(struct uart_p
41677 return 0;
41678 }
41679
41680 -static struct uart_ops siu_uart_ops = {
41681 +static const struct uart_ops siu_uart_ops = {
41682 .tx_empty = siu_tx_empty,
41683 .set_mctrl = siu_set_mctrl,
41684 .get_mctrl = siu_get_mctrl,
41685 diff -urNp linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c
41686 --- linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c 2011-05-19 00:06:34.000000000 -0400
41687 +++ linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c 2011-05-22 19:36:32.000000000 -0400
41688 @@ -519,7 +519,7 @@ static struct console vt8500_console = {
41689 #define VT8500_CONSOLE NULL
41690 #endif
41691
41692 -static struct uart_ops vt8500_uart_pops = {
41693 +static const struct uart_ops vt8500_uart_pops = {
41694 .tx_empty = vt8500_tx_empty,
41695 .set_mctrl = vt8500_set_mctrl,
41696 .get_mctrl = vt8500_get_mctrl,
41697 diff -urNp linux-2.6.39.1/drivers/tty/serial/zs.c linux-2.6.39.1/drivers/tty/serial/zs.c
41698 --- linux-2.6.39.1/drivers/tty/serial/zs.c 2011-05-19 00:06:34.000000000 -0400
41699 +++ linux-2.6.39.1/drivers/tty/serial/zs.c 2011-05-22 19:36:32.000000000 -0400
41700 @@ -1044,7 +1044,7 @@ static int zs_verify_port(struct uart_po
41701 }
41702
41703
41704 -static struct uart_ops zs_ops = {
41705 +static const struct uart_ops zs_ops = {
41706 .tx_empty = zs_tx_empty,
41707 .set_mctrl = zs_set_mctrl,
41708 .get_mctrl = zs_get_mctrl,
41709 diff -urNp linux-2.6.39.1/drivers/tty/tty_io.c linux-2.6.39.1/drivers/tty/tty_io.c
41710 --- linux-2.6.39.1/drivers/tty/tty_io.c 2011-05-19 00:06:34.000000000 -0400
41711 +++ linux-2.6.39.1/drivers/tty/tty_io.c 2011-05-22 19:36:32.000000000 -0400
41712 @@ -139,21 +139,11 @@ EXPORT_SYMBOL(tty_mutex);
41713 /* Spinlock to protect the tty->tty_files list */
41714 DEFINE_SPINLOCK(tty_files_lock);
41715
41716 -static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
41717 -static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
41718 ssize_t redirected_tty_write(struct file *, const char __user *,
41719 size_t, loff_t *);
41720 -static unsigned int tty_poll(struct file *, poll_table *);
41721 static int tty_open(struct inode *, struct file *);
41722 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
41723 -#ifdef CONFIG_COMPAT
41724 -static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41725 - unsigned long arg);
41726 -#else
41727 -#define tty_compat_ioctl NULL
41728 -#endif
41729 static int __tty_fasync(int fd, struct file *filp, int on);
41730 -static int tty_fasync(int fd, struct file *filp, int on);
41731 static void release_tty(struct tty_struct *tty, int idx);
41732 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41733 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41734 @@ -937,7 +927,7 @@ EXPORT_SYMBOL(start_tty);
41735 * read calls may be outstanding in parallel.
41736 */
41737
41738 -static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41739 +ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41740 loff_t *ppos)
41741 {
41742 int i;
41743 @@ -963,6 +953,8 @@ static ssize_t tty_read(struct file *fil
41744 return i;
41745 }
41746
41747 +EXPORT_SYMBOL(tty_read);
41748 +
41749 void tty_write_unlock(struct tty_struct *tty)
41750 {
41751 mutex_unlock(&tty->atomic_write_lock);
41752 @@ -1112,7 +1104,7 @@ void tty_write_message(struct tty_struct
41753 * write method will not be invoked in parallel for each device.
41754 */
41755
41756 -static ssize_t tty_write(struct file *file, const char __user *buf,
41757 +ssize_t tty_write(struct file *file, const char __user *buf,
41758 size_t count, loff_t *ppos)
41759 {
41760 struct inode *inode = file->f_path.dentry->d_inode;
41761 @@ -1138,6 +1130,8 @@ static ssize_t tty_write(struct file *fi
41762 return ret;
41763 }
41764
41765 +EXPORT_SYMBOL(tty_write);
41766 +
41767 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
41768 size_t count, loff_t *ppos)
41769 {
41770 @@ -1777,6 +1771,8 @@ int tty_release(struct inode *inode, str
41771 return 0;
41772 }
41773
41774 +EXPORT_SYMBOL(tty_release);
41775 +
41776 /**
41777 * tty_open - open a tty device
41778 * @inode: inode of device file
41779 @@ -1968,7 +1964,7 @@ got_driver:
41780 * may be re-entered freely by other callers.
41781 */
41782
41783 -static unsigned int tty_poll(struct file *filp, poll_table *wait)
41784 +unsigned int tty_poll(struct file *filp, poll_table *wait)
41785 {
41786 struct tty_struct *tty = file_tty(filp);
41787 struct tty_ldisc *ld;
41788 @@ -1984,6 +1980,8 @@ static unsigned int tty_poll(struct file
41789 return ret;
41790 }
41791
41792 +EXPORT_SYMBOL(tty_poll);
41793 +
41794 static int __tty_fasync(int fd, struct file *filp, int on)
41795 {
41796 struct tty_struct *tty = file_tty(filp);
41797 @@ -2025,7 +2023,7 @@ out:
41798 return retval;
41799 }
41800
41801 -static int tty_fasync(int fd, struct file *filp, int on)
41802 +int tty_fasync(int fd, struct file *filp, int on)
41803 {
41804 int retval;
41805 tty_lock();
41806 @@ -2034,6 +2032,8 @@ static int tty_fasync(int fd, struct fil
41807 return retval;
41808 }
41809
41810 +EXPORT_SYMBOL(tty_fasync);
41811 +
41812 /**
41813 * tiocsti - fake input character
41814 * @tty: tty to fake input into
41815 @@ -2695,8 +2695,10 @@ long tty_ioctl(struct file *file, unsign
41816 return retval;
41817 }
41818
41819 +EXPORT_SYMBOL(tty_ioctl);
41820 +
41821 #ifdef CONFIG_COMPAT
41822 -static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41823 +long tty_compat_ioctl(struct file *file, unsigned int cmd,
41824 unsigned long arg)
41825 {
41826 struct inode *inode = file->f_dentry->d_inode;
41827 @@ -2720,6 +2722,9 @@ static long tty_compat_ioctl(struct file
41828
41829 return retval;
41830 }
41831 +
41832 +EXPORT_SYMBOL(tty_compat_ioctl);
41833 +
41834 #endif
41835
41836 /*
41837 @@ -3198,11 +3203,6 @@ struct tty_struct *get_current_tty(void)
41838 }
41839 EXPORT_SYMBOL_GPL(get_current_tty);
41840
41841 -void tty_default_fops(struct file_operations *fops)
41842 -{
41843 - *fops = tty_fops;
41844 -}
41845 -
41846 /*
41847 * Initialize the console device. This is called *early*, so
41848 * we can't necessarily depend on lots of kernel help here.
41849 diff -urNp linux-2.6.39.1/drivers/tty/tty_ldisc.c linux-2.6.39.1/drivers/tty/tty_ldisc.c
41850 --- linux-2.6.39.1/drivers/tty/tty_ldisc.c 2011-05-19 00:06:34.000000000 -0400
41851 +++ linux-2.6.39.1/drivers/tty/tty_ldisc.c 2011-05-22 19:36:32.000000000 -0400
41852 @@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
41853 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
41854 struct tty_ldisc_ops *ldo = ld->ops;
41855
41856 - ldo->refcount--;
41857 + atomic_dec(&ldo->refcount);
41858 module_put(ldo->owner);
41859 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41860
41861 @@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
41862 spin_lock_irqsave(&tty_ldisc_lock, flags);
41863 tty_ldiscs[disc] = new_ldisc;
41864 new_ldisc->num = disc;
41865 - new_ldisc->refcount = 0;
41866 + atomic_set(&new_ldisc->refcount, 0);
41867 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41868
41869 return ret;
41870 @@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
41871 return -EINVAL;
41872
41873 spin_lock_irqsave(&tty_ldisc_lock, flags);
41874 - if (tty_ldiscs[disc]->refcount)
41875 + if (atomic_read(&tty_ldiscs[disc]->refcount))
41876 ret = -EBUSY;
41877 else
41878 tty_ldiscs[disc] = NULL;
41879 @@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
41880 if (ldops) {
41881 ret = ERR_PTR(-EAGAIN);
41882 if (try_module_get(ldops->owner)) {
41883 - ldops->refcount++;
41884 + atomic_inc(&ldops->refcount);
41885 ret = ldops;
41886 }
41887 }
41888 @@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
41889 unsigned long flags;
41890
41891 spin_lock_irqsave(&tty_ldisc_lock, flags);
41892 - ldops->refcount--;
41893 + atomic_dec(&ldops->refcount);
41894 module_put(ldops->owner);
41895 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41896 }
41897 diff -urNp linux-2.6.39.1/drivers/tty/vt/keyboard.c linux-2.6.39.1/drivers/tty/vt/keyboard.c
41898 --- linux-2.6.39.1/drivers/tty/vt/keyboard.c 2011-05-19 00:06:34.000000000 -0400
41899 +++ linux-2.6.39.1/drivers/tty/vt/keyboard.c 2011-05-22 20:32:43.000000000 -0400
41900 @@ -658,6 +658,16 @@ static void k_spec(struct vc_data *vc, u
41901 kbd->kbdmode == VC_OFF) &&
41902 value != KVAL(K_SAK))
41903 return; /* SAK is allowed even in raw mode */
41904 +
41905 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
41906 + {
41907 + void *func = fn_handler[value];
41908 + if (func == fn_show_state || func == fn_show_ptregs ||
41909 + func == fn_show_mem)
41910 + return;
41911 + }
41912 +#endif
41913 +
41914 fn_handler[value](vc);
41915 }
41916
41917 diff -urNp linux-2.6.39.1/drivers/tty/vt/vt.c linux-2.6.39.1/drivers/tty/vt/vt.c
41918 --- linux-2.6.39.1/drivers/tty/vt/vt.c 2011-05-19 00:06:34.000000000 -0400
41919 +++ linux-2.6.39.1/drivers/tty/vt/vt.c 2011-05-22 19:36:32.000000000 -0400
41920 @@ -261,7 +261,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
41921
41922 static void notify_write(struct vc_data *vc, unsigned int unicode)
41923 {
41924 - struct vt_notifier_param param = { .vc = vc, unicode = unicode };
41925 + struct vt_notifier_param param = { .vc = vc, .c = unicode };
41926 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
41927 }
41928
41929 diff -urNp linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c
41930 --- linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c 2011-05-19 00:06:34.000000000 -0400
41931 +++ linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c 2011-05-22 19:41:37.000000000 -0400
41932 @@ -209,9 +209,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
41933 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
41934 return -EFAULT;
41935
41936 - if (!capable(CAP_SYS_TTY_CONFIG))
41937 - perm = 0;
41938 -
41939 switch (cmd) {
41940 case KDGKBENT:
41941 key_map = key_maps[s];
41942 @@ -223,6 +220,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
41943 val = (i ? K_HOLE : K_NOSUCHMAP);
41944 return put_user(val, &user_kbe->kb_value);
41945 case KDSKBENT:
41946 + if (!capable(CAP_SYS_TTY_CONFIG))
41947 + perm = 0;
41948 +
41949 if (!perm)
41950 return -EPERM;
41951 if (!i && v == K_NOSUCHMAP) {
41952 @@ -324,9 +324,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
41953 int i, j, k;
41954 int ret;
41955
41956 - if (!capable(CAP_SYS_TTY_CONFIG))
41957 - perm = 0;
41958 -
41959 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
41960 if (!kbs) {
41961 ret = -ENOMEM;
41962 @@ -360,6 +357,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
41963 kfree(kbs);
41964 return ((p && *p) ? -EOVERFLOW : 0);
41965 case KDSKBSENT:
41966 + if (!capable(CAP_SYS_TTY_CONFIG))
41967 + perm = 0;
41968 +
41969 if (!perm) {
41970 ret = -EPERM;
41971 goto reterr;
41972 diff -urNp linux-2.6.39.1/drivers/uio/uio.c linux-2.6.39.1/drivers/uio/uio.c
41973 --- linux-2.6.39.1/drivers/uio/uio.c 2011-05-19 00:06:34.000000000 -0400
41974 +++ linux-2.6.39.1/drivers/uio/uio.c 2011-05-22 19:36:32.000000000 -0400
41975 @@ -25,6 +25,7 @@
41976 #include <linux/kobject.h>
41977 #include <linux/cdev.h>
41978 #include <linux/uio_driver.h>
41979 +#include <asm/local.h>
41980
41981 #define UIO_MAX_DEVICES (1U << MINORBITS)
41982
41983 @@ -32,10 +33,10 @@ struct uio_device {
41984 struct module *owner;
41985 struct device *dev;
41986 int minor;
41987 - atomic_t event;
41988 + atomic_unchecked_t event;
41989 struct fasync_struct *async_queue;
41990 wait_queue_head_t wait;
41991 - int vma_count;
41992 + local_t vma_count;
41993 struct uio_info *info;
41994 struct kobject *map_dir;
41995 struct kobject *portio_dir;
41996 @@ -242,7 +243,7 @@ static ssize_t show_event(struct device
41997 struct device_attribute *attr, char *buf)
41998 {
41999 struct uio_device *idev = dev_get_drvdata(dev);
42000 - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
42001 + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
42002 }
42003
42004 static struct device_attribute uio_class_attributes[] = {
42005 @@ -402,7 +403,7 @@ void uio_event_notify(struct uio_info *i
42006 {
42007 struct uio_device *idev = info->uio_dev;
42008
42009 - atomic_inc(&idev->event);
42010 + atomic_inc_unchecked(&idev->event);
42011 wake_up_interruptible(&idev->wait);
42012 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
42013 }
42014 @@ -455,7 +456,7 @@ static int uio_open(struct inode *inode,
42015 }
42016
42017 listener->dev = idev;
42018 - listener->event_count = atomic_read(&idev->event);
42019 + listener->event_count = atomic_read_unchecked(&idev->event);
42020 filep->private_data = listener;
42021
42022 if (idev->info->open) {
42023 @@ -506,7 +507,7 @@ static unsigned int uio_poll(struct file
42024 return -EIO;
42025
42026 poll_wait(filep, &idev->wait, wait);
42027 - if (listener->event_count != atomic_read(&idev->event))
42028 + if (listener->event_count != atomic_read_unchecked(&idev->event))
42029 return POLLIN | POLLRDNORM;
42030 return 0;
42031 }
42032 @@ -531,7 +532,7 @@ static ssize_t uio_read(struct file *fil
42033 do {
42034 set_current_state(TASK_INTERRUPTIBLE);
42035
42036 - event_count = atomic_read(&idev->event);
42037 + event_count = atomic_read_unchecked(&idev->event);
42038 if (event_count != listener->event_count) {
42039 if (copy_to_user(buf, &event_count, count))
42040 retval = -EFAULT;
42041 @@ -602,13 +603,13 @@ static int uio_find_mem_index(struct vm_
42042 static void uio_vma_open(struct vm_area_struct *vma)
42043 {
42044 struct uio_device *idev = vma->vm_private_data;
42045 - idev->vma_count++;
42046 + local_inc(&idev->vma_count);
42047 }
42048
42049 static void uio_vma_close(struct vm_area_struct *vma)
42050 {
42051 struct uio_device *idev = vma->vm_private_data;
42052 - idev->vma_count--;
42053 + local_dec(&idev->vma_count);
42054 }
42055
42056 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
42057 @@ -819,7 +820,7 @@ int __uio_register_device(struct module
42058 idev->owner = owner;
42059 idev->info = info;
42060 init_waitqueue_head(&idev->wait);
42061 - atomic_set(&idev->event, 0);
42062 + atomic_set_unchecked(&idev->event, 0);
42063
42064 ret = uio_get_minor(idev);
42065 if (ret)
42066 diff -urNp linux-2.6.39.1/drivers/usb/atm/cxacru.c linux-2.6.39.1/drivers/usb/atm/cxacru.c
42067 --- linux-2.6.39.1/drivers/usb/atm/cxacru.c 2011-05-19 00:06:34.000000000 -0400
42068 +++ linux-2.6.39.1/drivers/usb/atm/cxacru.c 2011-05-22 19:36:32.000000000 -0400
42069 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
42070 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
42071 if (ret < 2)
42072 return -EINVAL;
42073 - if (index < 0 || index > 0x7f)
42074 + if (index > 0x7f)
42075 return -EINVAL;
42076 pos += tmp;
42077
42078 diff -urNp linux-2.6.39.1/drivers/usb/atm/usbatm.c linux-2.6.39.1/drivers/usb/atm/usbatm.c
42079 --- linux-2.6.39.1/drivers/usb/atm/usbatm.c 2011-05-19 00:06:34.000000000 -0400
42080 +++ linux-2.6.39.1/drivers/usb/atm/usbatm.c 2011-05-22 19:36:32.000000000 -0400
42081 @@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
42082 if (printk_ratelimit())
42083 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
42084 __func__, vpi, vci);
42085 - atomic_inc(&vcc->stats->rx_err);
42086 + atomic_inc_unchecked(&vcc->stats->rx_err);
42087 return;
42088 }
42089
42090 @@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru
42091 if (length > ATM_MAX_AAL5_PDU) {
42092 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
42093 __func__, length, vcc);
42094 - atomic_inc(&vcc->stats->rx_err);
42095 + atomic_inc_unchecked(&vcc->stats->rx_err);
42096 goto out;
42097 }
42098
42099 @@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru
42100 if (sarb->len < pdu_length) {
42101 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
42102 __func__, pdu_length, sarb->len, vcc);
42103 - atomic_inc(&vcc->stats->rx_err);
42104 + atomic_inc_unchecked(&vcc->stats->rx_err);
42105 goto out;
42106 }
42107
42108 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
42109 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
42110 __func__, vcc);
42111 - atomic_inc(&vcc->stats->rx_err);
42112 + atomic_inc_unchecked(&vcc->stats->rx_err);
42113 goto out;
42114 }
42115
42116 @@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru
42117 if (printk_ratelimit())
42118 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
42119 __func__, length);
42120 - atomic_inc(&vcc->stats->rx_drop);
42121 + atomic_inc_unchecked(&vcc->stats->rx_drop);
42122 goto out;
42123 }
42124
42125 @@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru
42126
42127 vcc->push(vcc, skb);
42128
42129 - atomic_inc(&vcc->stats->rx);
42130 + atomic_inc_unchecked(&vcc->stats->rx);
42131 out:
42132 skb_trim(sarb, 0);
42133 }
42134 @@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l
42135 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
42136
42137 usbatm_pop(vcc, skb);
42138 - atomic_inc(&vcc->stats->tx);
42139 + atomic_inc_unchecked(&vcc->stats->tx);
42140
42141 skb = skb_dequeue(&instance->sndqueue);
42142 }
42143 @@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a
42144 if (!left--)
42145 return sprintf(page,
42146 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
42147 - atomic_read(&atm_dev->stats.aal5.tx),
42148 - atomic_read(&atm_dev->stats.aal5.tx_err),
42149 - atomic_read(&atm_dev->stats.aal5.rx),
42150 - atomic_read(&atm_dev->stats.aal5.rx_err),
42151 - atomic_read(&atm_dev->stats.aal5.rx_drop));
42152 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
42153 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
42154 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
42155 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
42156 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
42157
42158 if (!left--) {
42159 if (instance->disconnected)
42160 diff -urNp linux-2.6.39.1/drivers/usb/core/devices.c linux-2.6.39.1/drivers/usb/core/devices.c
42161 --- linux-2.6.39.1/drivers/usb/core/devices.c 2011-05-19 00:06:34.000000000 -0400
42162 +++ linux-2.6.39.1/drivers/usb/core/devices.c 2011-05-22 19:36:32.000000000 -0400
42163 @@ -126,7 +126,7 @@ static const char *format_endpt =
42164 * time it gets called.
42165 */
42166 static struct device_connect_event {
42167 - atomic_t count;
42168 + atomic_unchecked_t count;
42169 wait_queue_head_t wait;
42170 } device_event = {
42171 .count = ATOMIC_INIT(1),
42172 @@ -164,7 +164,7 @@ static const struct class_info clas_info
42173
42174 void usbfs_conn_disc_event(void)
42175 {
42176 - atomic_add(2, &device_event.count);
42177 + atomic_add_unchecked(2, &device_event.count);
42178 wake_up(&device_event.wait);
42179 }
42180
42181 @@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
42182
42183 poll_wait(file, &device_event.wait, wait);
42184
42185 - event_count = atomic_read(&device_event.count);
42186 + event_count = atomic_read_unchecked(&device_event.count);
42187 if (file->f_version != event_count) {
42188 file->f_version = event_count;
42189 return POLLIN | POLLRDNORM;
42190 diff -urNp linux-2.6.39.1/drivers/usb/core/hcd.c linux-2.6.39.1/drivers/usb/core/hcd.c
42191 --- linux-2.6.39.1/drivers/usb/core/hcd.c 2011-06-03 00:04:14.000000000 -0400
42192 +++ linux-2.6.39.1/drivers/usb/core/hcd.c 2011-06-03 00:32:07.000000000 -0400
42193 @@ -2574,7 +2574,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
42194
42195 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
42196
42197 -struct usb_mon_operations *mon_ops;
42198 +const struct usb_mon_operations *mon_ops;
42199
42200 /*
42201 * The registration is unlocked.
42202 @@ -2584,7 +2584,7 @@ struct usb_mon_operations *mon_ops;
42203 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
42204 */
42205
42206 -int usb_mon_register (struct usb_mon_operations *ops)
42207 +int usb_mon_register (const struct usb_mon_operations *ops)
42208 {
42209
42210 if (mon_ops)
42211 diff -urNp linux-2.6.39.1/drivers/usb/core/message.c linux-2.6.39.1/drivers/usb/core/message.c
42212 --- linux-2.6.39.1/drivers/usb/core/message.c 2011-05-19 00:06:34.000000000 -0400
42213 +++ linux-2.6.39.1/drivers/usb/core/message.c 2011-05-22 19:36:32.000000000 -0400
42214 @@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
42215 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
42216 if (buf) {
42217 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
42218 - if (len > 0) {
42219 - smallbuf = kmalloc(++len, GFP_NOIO);
42220 + if (len++ > 0) {
42221 + smallbuf = kmalloc(len, GFP_NOIO);
42222 if (!smallbuf)
42223 return buf;
42224 memcpy(smallbuf, buf, len);
42225 diff -urNp linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c
42226 --- linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c 2011-05-19 00:06:34.000000000 -0400
42227 +++ linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c 2011-05-22 19:36:32.000000000 -0400
42228 @@ -96,7 +96,7 @@ static inline u32 dbgp_len_update(u32 x,
42229 }
42230
42231 #ifdef CONFIG_KGDB
42232 -static struct kgdb_io kgdbdbgp_io_ops;
42233 +static struct kgdb_io kgdbdbgp_io_ops; /* cannot be const, see kgdbdbgp_parse_config */
42234 #define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
42235 #else
42236 #define dbgp_kgdb_mode (0)
42237 @@ -1026,7 +1026,7 @@ static void kgdbdbgp_write_char(u8 chr)
42238 early_dbgp_write(NULL, &chr, 1);
42239 }
42240
42241 -static struct kgdb_io kgdbdbgp_io_ops = {
42242 +static struct kgdb_io kgdbdbgp_io_ops = { /* cannot be const, see kgdbdbgp_parse_config() */
42243 .name = "kgdbdbgp",
42244 .read_char = kgdbdbgp_read_char,
42245 .write_char = kgdbdbgp_write_char,
42246 diff -urNp linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c
42247 --- linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c 2011-05-19 00:06:34.000000000 -0400
42248 +++ linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c 2011-05-22 19:36:32.000000000 -0400
42249 @@ -1859,7 +1859,7 @@ out:
42250 return status;
42251 }
42252
42253 -static struct usb_ep_ops qe_ep_ops = {
42254 +static const struct usb_ep_ops qe_ep_ops = {
42255 .enable = qe_ep_enable,
42256 .disable = qe_ep_disable,
42257
42258 @@ -1928,7 +1928,7 @@ static int qe_pullup(struct usb_gadget *
42259 }
42260
42261 /* defined in usb_gadget.h */
42262 -static struct usb_gadget_ops qe_gadget_ops = {
42263 +static const struct usb_gadget_ops qe_gadget_ops = {
42264 .get_frame = qe_get_frame,
42265 .wakeup = qe_wakeup,
42266 /* .set_selfpowered = qe_set_selfpowered,*/ /* always selfpowered */
42267 diff -urNp linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c
42268 --- linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42269 +++ linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42270 @@ -1003,7 +1003,7 @@ static void fsl_ep_fifo_flush(struct usb
42271 } while (fsl_readl(&dr_regs->endptstatus) & bits);
42272 }
42273
42274 -static struct usb_ep_ops fsl_ep_ops = {
42275 +static const struct usb_ep_ops fsl_ep_ops = {
42276 .enable = fsl_ep_enable,
42277 .disable = fsl_ep_disable,
42278
42279 @@ -1114,7 +1114,7 @@ static int fsl_pullup(struct usb_gadget
42280 }
42281
42282 /* defined in gadget.h */
42283 -static struct usb_gadget_ops fsl_gadget_ops = {
42284 +static const struct usb_gadget_ops fsl_gadget_ops = {
42285 .get_frame = fsl_get_frame,
42286 .wakeup = fsl_wakeup,
42287 /* .set_selfpowered = fsl_set_selfpowered, */ /* Always selfpowered */
42288 diff -urNp linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c
42289 --- linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c 2011-05-19 00:06:34.000000000 -0400
42290 +++ linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c 2011-05-22 19:36:32.000000000 -0400
42291 @@ -527,7 +527,7 @@ static void fusb300_fifo_flush(struct us
42292 {
42293 }
42294
42295 -static struct usb_ep_ops fusb300_ep_ops = {
42296 +static const struct usb_ep_ops fusb300_ep_ops = {
42297 .enable = fusb300_enable,
42298 .disable = fusb300_disable,
42299
42300 @@ -1570,7 +1570,7 @@ static int fusb300_udc_pullup(struct usb
42301 return 0;
42302 }
42303
42304 -static struct usb_gadget_ops fusb300_gadget_ops = {
42305 +static const struct usb_gadget_ops fusb300_gadget_ops = {
42306 .pullup = fusb300_udc_pullup,
42307 };
42308
42309 diff -urNp linux-2.6.39.1/drivers/usb/gadget/goku_udc.c linux-2.6.39.1/drivers/usb/gadget/goku_udc.c
42310 --- linux-2.6.39.1/drivers/usb/gadget/goku_udc.c 2011-05-19 00:06:34.000000000 -0400
42311 +++ linux-2.6.39.1/drivers/usb/gadget/goku_udc.c 2011-05-22 19:36:32.000000000 -0400
42312 @@ -973,7 +973,7 @@ static void goku_fifo_flush(struct usb_e
42313 command(regs, COMMAND_FIFO_CLEAR, ep->num);
42314 }
42315
42316 -static struct usb_ep_ops goku_ep_ops = {
42317 +static const struct usb_ep_ops goku_ep_ops = {
42318 .enable = goku_ep_enable,
42319 .disable = goku_ep_disable,
42320
42321 diff -urNp linux-2.6.39.1/drivers/usb/gadget/imx_udc.c linux-2.6.39.1/drivers/usb/gadget/imx_udc.c
42322 --- linux-2.6.39.1/drivers/usb/gadget/imx_udc.c 2011-05-19 00:06:34.000000000 -0400
42323 +++ linux-2.6.39.1/drivers/usb/gadget/imx_udc.c 2011-05-22 19:36:32.000000000 -0400
42324 @@ -937,7 +937,7 @@ static void imx_ep_fifo_flush(struct usb
42325 local_irq_restore(flags);
42326 }
42327
42328 -static struct usb_ep_ops imx_ep_ops = {
42329 +static const struct usb_ep_ops imx_ep_ops = {
42330 .enable = imx_ep_enable,
42331 .disable = imx_ep_disable,
42332
42333 diff -urNp linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c
42334 --- linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c 2011-05-19 00:06:34.000000000 -0400
42335 +++ linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c 2011-05-22 19:36:32.000000000 -0400
42336 @@ -1437,7 +1437,7 @@ static void m66592_fifo_flush(struct usb
42337 spin_unlock_irqrestore(&ep->m66592->lock, flags);
42338 }
42339
42340 -static struct usb_ep_ops m66592_ep_ops = {
42341 +static const struct usb_ep_ops m66592_ep_ops = {
42342 .enable = m66592_enable,
42343 .disable = m66592_disable,
42344
42345 @@ -1542,7 +1542,7 @@ static int m66592_get_frame(struct usb_g
42346 return m66592_read(m66592, M66592_FRMNUM) & 0x03FF;
42347 }
42348
42349 -static struct usb_gadget_ops m66592_gadget_ops = {
42350 +static const struct usb_gadget_ops m66592_gadget_ops = {
42351 .get_frame = m66592_get_frame,
42352 };
42353
42354 diff -urNp linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c
42355 --- linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42356 +++ linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42357 @@ -972,7 +972,7 @@ static int mv_ep_set_wedge(struct usb_ep
42358 return mv_ep_set_halt_wedge(_ep, 1, 1);
42359 }
42360
42361 -static struct usb_ep_ops mv_ep_ops = {
42362 +static const struct usb_ep_ops mv_ep_ops = {
42363 .enable = mv_ep_enable,
42364 .disable = mv_ep_disable,
42365
42366 diff -urNp linux-2.6.39.1/drivers/usb/gadget/omap_udc.c linux-2.6.39.1/drivers/usb/gadget/omap_udc.c
42367 --- linux-2.6.39.1/drivers/usb/gadget/omap_udc.c 2011-05-19 00:06:34.000000000 -0400
42368 +++ linux-2.6.39.1/drivers/usb/gadget/omap_udc.c 2011-05-22 19:36:32.000000000 -0400
42369 @@ -1177,7 +1177,7 @@ done:
42370 return status;
42371 }
42372
42373 -static struct usb_ep_ops omap_ep_ops = {
42374 +static const struct usb_ep_ops omap_ep_ops = {
42375 .enable = omap_ep_enable,
42376 .disable = omap_ep_disable,
42377
42378 @@ -1374,7 +1374,7 @@ static int omap_pullup(struct usb_gadget
42379 return 0;
42380 }
42381
42382 -static struct usb_gadget_ops omap_gadget_ops = {
42383 +static const struct usb_gadget_ops omap_gadget_ops = {
42384 .get_frame = omap_get_frame,
42385 .wakeup = omap_wakeup,
42386 .set_selfpowered = omap_set_selfpowered,
42387 diff -urNp linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c
42388 --- linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c 2011-05-19 00:06:34.000000000 -0400
42389 +++ linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c 2011-05-22 19:36:32.000000000 -0400
42390 @@ -896,7 +896,7 @@ static void pxa25x_ep_fifo_flush(struct
42391 }
42392
42393
42394 -static struct usb_ep_ops pxa25x_ep_ops = {
42395 +static const struct usb_ep_ops pxa25x_ep_ops = {
42396 .enable = pxa25x_ep_enable,
42397 .disable = pxa25x_ep_disable,
42398
42399 diff -urNp linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c
42400 --- linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c 2011-05-19 00:06:34.000000000 -0400
42401 +++ linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c 2011-05-22 19:36:32.000000000 -0400
42402 @@ -1491,7 +1491,7 @@ static int pxa_ep_disable(struct usb_ep
42403 return 0;
42404 }
42405
42406 -static struct usb_ep_ops pxa_ep_ops = {
42407 +static const struct usb_ep_ops pxa_ep_ops = {
42408 .enable = pxa_ep_enable,
42409 .disable = pxa_ep_disable,
42410
42411 diff -urNp linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c
42412 --- linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c 2011-05-19 00:06:34.000000000 -0400
42413 +++ linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c 2011-05-22 19:36:32.000000000 -0400
42414 @@ -1392,7 +1392,7 @@ static void r8a66597_fifo_flush(struct u
42415 spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
42416 }
42417
42418 -static struct usb_ep_ops r8a66597_ep_ops = {
42419 +static const struct usb_ep_ops r8a66597_ep_ops = {
42420 .enable = r8a66597_enable,
42421 .disable = r8a66597_disable,
42422
42423 @@ -1497,7 +1497,7 @@ static int r8a66597_get_frame(struct usb
42424 return r8a66597_read(r8a66597, FRMNUM) & 0x03FF;
42425 }
42426
42427 -static struct usb_gadget_ops r8a66597_gadget_ops = {
42428 +static const struct usb_gadget_ops r8a66597_gadget_ops = {
42429 .get_frame = r8a66597_get_frame,
42430 };
42431
42432 diff -urNp linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c
42433 --- linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c 2011-05-19 00:06:34.000000000 -0400
42434 +++ linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c 2011-05-22 19:36:32.000000000 -0400
42435 @@ -2461,7 +2461,7 @@ static int s3c_hsotg_ep_sethalt(struct u
42436 return 0;
42437 }
42438
42439 -static struct usb_ep_ops s3c_hsotg_ep_ops = {
42440 +static const struct usb_ep_ops s3c_hsotg_ep_ops = {
42441 .enable = s3c_hsotg_ep_enable,
42442 .disable = s3c_hsotg_ep_disable,
42443 .alloc_request = s3c_hsotg_ep_alloc_request,
42444 @@ -2725,7 +2725,7 @@ static int s3c_hsotg_gadget_getframe(str
42445 return s3c_hsotg_read_frameno(to_hsotg(gadget));
42446 }
42447
42448 -static struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42449 +static const struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42450 .get_frame = s3c_hsotg_gadget_getframe,
42451 };
42452
42453 diff -urNp linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c
42454 --- linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c 2011-05-19 00:06:34.000000000 -0400
42455 +++ linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c 2011-05-22 19:36:32.000000000 -0400
42456 @@ -400,7 +400,7 @@ static void uvc_vm_close(struct vm_area_
42457 buffer->vma_use_count--;
42458 }
42459
42460 -static struct vm_operations_struct uvc_vm_ops = {
42461 +static const struct vm_operations_struct uvc_vm_ops = {
42462 .open = uvc_vm_open,
42463 .close = uvc_vm_close,
42464 };
42465 diff -urNp linux-2.6.39.1/drivers/usb/host/ehci-fsl.c linux-2.6.39.1/drivers/usb/host/ehci-fsl.c
42466 --- linux-2.6.39.1/drivers/usb/host/ehci-fsl.c 2011-05-19 00:06:34.000000000 -0400
42467 +++ linux-2.6.39.1/drivers/usb/host/ehci-fsl.c 2011-05-22 19:36:32.000000000 -0400
42468 @@ -380,7 +380,7 @@ static int ehci_fsl_drv_restore(struct d
42469 return 0;
42470 }
42471
42472 -static struct dev_pm_ops ehci_fsl_pm_ops = {
42473 +static const struct dev_pm_ops ehci_fsl_pm_ops = {
42474 .suspend = ehci_fsl_drv_suspend,
42475 .resume = ehci_fsl_drv_resume,
42476 .restore = ehci_fsl_drv_restore,
42477 diff -urNp linux-2.6.39.1/drivers/usb/host/xhci-mem.c linux-2.6.39.1/drivers/usb/host/xhci-mem.c
42478 --- linux-2.6.39.1/drivers/usb/host/xhci-mem.c 2011-06-03 00:04:14.000000000 -0400
42479 +++ linux-2.6.39.1/drivers/usb/host/xhci-mem.c 2011-06-03 00:32:07.000000000 -0400
42480 @@ -1670,6 +1670,8 @@ static int xhci_check_trb_in_td_math(str
42481 unsigned int num_tests;
42482 int i, ret;
42483
42484 + pax_track_stack();
42485 +
42486 num_tests = ARRAY_SIZE(simple_test_vector);
42487 for (i = 0; i < num_tests; i++) {
42488 ret = xhci_test_trb_in_td(xhci,
42489 diff -urNp linux-2.6.39.1/drivers/usb/mon/mon_main.c linux-2.6.39.1/drivers/usb/mon/mon_main.c
42490 --- linux-2.6.39.1/drivers/usb/mon/mon_main.c 2011-05-19 00:06:34.000000000 -0400
42491 +++ linux-2.6.39.1/drivers/usb/mon/mon_main.c 2011-05-22 19:36:32.000000000 -0400
42492 @@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
42493 /*
42494 * Ops
42495 */
42496 -static struct usb_mon_operations mon_ops_0 = {
42497 +static const struct usb_mon_operations mon_ops_0 = {
42498 .urb_submit = mon_submit,
42499 .urb_submit_error = mon_submit_error,
42500 .urb_complete = mon_complete,
42501 diff -urNp linux-2.6.39.1/drivers/usb/musb/cppi_dma.h linux-2.6.39.1/drivers/usb/musb/cppi_dma.h
42502 --- linux-2.6.39.1/drivers/usb/musb/cppi_dma.h 2011-05-19 00:06:34.000000000 -0400
42503 +++ linux-2.6.39.1/drivers/usb/musb/cppi_dma.h 2011-05-22 19:36:32.000000000 -0400
42504 @@ -113,7 +113,7 @@ struct cppi_channel {
42505
42506 /* CPPI DMA controller object */
42507 struct cppi {
42508 - struct dma_controller controller;
42509 + const struct dma_controller controller;
42510 struct musb *musb;
42511 void __iomem *mregs; /* Mentor regs */
42512 void __iomem *tibase; /* TI/CPPI regs */
42513 diff -urNp linux-2.6.39.1/drivers/usb/otg/msm_otg.c linux-2.6.39.1/drivers/usb/otg/msm_otg.c
42514 --- linux-2.6.39.1/drivers/usb/otg/msm_otg.c 2011-05-19 00:06:34.000000000 -0400
42515 +++ linux-2.6.39.1/drivers/usb/otg/msm_otg.c 2011-05-22 19:36:32.000000000 -0400
42516 @@ -95,7 +95,7 @@ static int ulpi_write(struct otg_transce
42517 return 0;
42518 }
42519
42520 -static struct otg_io_access_ops msm_otg_io_ops = {
42521 +static const struct otg_io_access_ops msm_otg_io_ops = {
42522 .read = ulpi_read,
42523 .write = ulpi_write,
42524 };
42525 diff -urNp linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c
42526 --- linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c 2011-05-19 00:06:34.000000000 -0400
42527 +++ linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c 2011-05-22 19:36:32.000000000 -0400
42528 @@ -74,7 +74,7 @@ static int ulpi_viewport_write(struct ot
42529 return ulpi_viewport_wait(view, ULPI_VIEW_RUN);
42530 }
42531
42532 -struct otg_io_access_ops ulpi_viewport_access_ops = {
42533 +const struct otg_io_access_ops ulpi_viewport_access_ops = {
42534 .read = ulpi_viewport_read,
42535 .write = ulpi_viewport_write,
42536 };
42537 diff -urNp linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c
42538 --- linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c 2011-06-03 00:04:14.000000000 -0400
42539 +++ linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c 2011-06-03 00:32:07.000000000 -0400
42540 @@ -104,27 +104,27 @@ static int ftdi_stmclite_probe(struct
42541 static void ftdi_USB_UIRT_setup(struct ftdi_private *priv);
42542 static void ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
42543
42544 -static struct ftdi_sio_quirk ftdi_jtag_quirk = {
42545 +static const struct ftdi_sio_quirk ftdi_jtag_quirk = {
42546 .probe = ftdi_jtag_probe,
42547 };
42548
42549 -static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42550 +static const struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42551 .probe = ftdi_mtxorb_hack_setup,
42552 };
42553
42554 -static struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42555 +static const struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42556 .probe = ftdi_NDI_device_setup,
42557 };
42558
42559 -static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42560 +static const struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42561 .port_probe = ftdi_USB_UIRT_setup,
42562 };
42563
42564 -static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42565 +static const struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42566 .port_probe = ftdi_HE_TIRA1_setup,
42567 };
42568
42569 -static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42570 +static const struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42571 .probe = ftdi_stmclite_probe,
42572 };
42573
42574 diff -urNp linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h
42575 --- linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h 2011-05-19 00:06:34.000000000 -0400
42576 +++ linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h 2011-05-22 19:36:32.000000000 -0400
42577 @@ -192,7 +192,7 @@ struct wahc {
42578 struct list_head xfer_delayed_list;
42579 spinlock_t xfer_list_lock;
42580 struct work_struct xfer_work;
42581 - atomic_t xfer_id_count;
42582 + atomic_unchecked_t xfer_id_count;
42583 };
42584
42585
42586 @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
42587 INIT_LIST_HEAD(&wa->xfer_delayed_list);
42588 spin_lock_init(&wa->xfer_list_lock);
42589 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
42590 - atomic_set(&wa->xfer_id_count, 1);
42591 + atomic_set_unchecked(&wa->xfer_id_count, 1);
42592 }
42593
42594 /**
42595 diff -urNp linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c
42596 --- linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c 2011-05-19 00:06:34.000000000 -0400
42597 +++ linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c 2011-05-22 19:36:32.000000000 -0400
42598 @@ -294,7 +294,7 @@ out:
42599 */
42600 static void wa_xfer_id_init(struct wa_xfer *xfer)
42601 {
42602 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
42603 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
42604 }
42605
42606 /*
42607 diff -urNp linux-2.6.39.1/drivers/vhost/vhost.c linux-2.6.39.1/drivers/vhost/vhost.c
42608 --- linux-2.6.39.1/drivers/vhost/vhost.c 2011-05-19 00:06:34.000000000 -0400
42609 +++ linux-2.6.39.1/drivers/vhost/vhost.c 2011-05-22 19:36:32.000000000 -0400
42610 @@ -580,7 +580,7 @@ static int init_used(struct vhost_virtqu
42611 return get_user(vq->last_used_idx, &used->idx);
42612 }
42613
42614 -static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
42615 +static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
42616 {
42617 struct file *eventfp, *filep = NULL,
42618 *pollstart = NULL, *pollstop = NULL;
42619 diff -urNp linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c
42620 --- linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c 2011-05-19 00:06:34.000000000 -0400
42621 +++ linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c 2011-05-22 19:36:32.000000000 -0400
42622 @@ -383,7 +383,7 @@ static int corgi_lcd_get_power(struct lc
42623 return lcd->power;
42624 }
42625
42626 -static struct lcd_ops corgi_lcd_ops = {
42627 +static const struct lcd_ops corgi_lcd_ops = {
42628 .get_power = corgi_lcd_get_power,
42629 .set_power = corgi_lcd_set_power,
42630 .set_mode = corgi_lcd_set_mode,
42631 diff -urNp linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c
42632 --- linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c 2011-05-19 00:06:34.000000000 -0400
42633 +++ linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c 2011-05-22 19:36:32.000000000 -0400
42634 @@ -165,7 +165,7 @@ static int cr_lcd_set_power(struct lcd_d
42635 return 0;
42636 }
42637
42638 -static struct lcd_ops cr_lcd_ops = {
42639 +static const struct lcd_ops cr_lcd_ops = {
42640 .set_power = cr_lcd_set_power,
42641 };
42642
42643 diff -urNp linux-2.6.39.1/drivers/video/backlight/ili9320.c linux-2.6.39.1/drivers/video/backlight/ili9320.c
42644 --- linux-2.6.39.1/drivers/video/backlight/ili9320.c 2011-05-19 00:06:34.000000000 -0400
42645 +++ linux-2.6.39.1/drivers/video/backlight/ili9320.c 2011-05-22 19:36:32.000000000 -0400
42646 @@ -166,7 +166,7 @@ static int ili9320_get_power(struct lcd_
42647 return lcd->power;
42648 }
42649
42650 -static struct lcd_ops ili9320_ops = {
42651 +static const struct lcd_ops ili9320_ops = {
42652 .get_power = ili9320_get_power,
42653 .set_power = ili9320_set_power,
42654 };
42655 diff -urNp linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c
42656 --- linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c 2011-05-19 00:06:34.000000000 -0400
42657 +++ linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c 2011-05-22 19:36:32.000000000 -0400
42658 @@ -87,7 +87,7 @@ static int jornada_lcd_set_power(struct
42659 return 0;
42660 }
42661
42662 -static struct lcd_ops jornada_lcd_props = {
42663 +static const struct lcd_ops jornada_lcd_props = {
42664 .get_contrast = jornada_lcd_get_contrast,
42665 .set_contrast = jornada_lcd_set_contrast,
42666 .get_power = jornada_lcd_get_power,
42667 diff -urNp linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c
42668 --- linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c 2011-05-19 00:06:34.000000000 -0400
42669 +++ linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c 2011-05-22 19:36:32.000000000 -0400
42670 @@ -149,7 +149,7 @@ static int l4f00242t03_lcd_power_set(str
42671 return 0;
42672 }
42673
42674 -static struct lcd_ops l4f_ops = {
42675 +static const struct lcd_ops l4f_ops = {
42676 .set_power = l4f00242t03_lcd_power_set,
42677 .get_power = l4f00242t03_lcd_power_get,
42678 };
42679 diff -urNp linux-2.6.39.1/drivers/video/backlight/lcd.c linux-2.6.39.1/drivers/video/backlight/lcd.c
42680 --- linux-2.6.39.1/drivers/video/backlight/lcd.c 2011-05-19 00:06:34.000000000 -0400
42681 +++ linux-2.6.39.1/drivers/video/backlight/lcd.c 2011-05-22 19:36:32.000000000 -0400
42682 @@ -192,7 +192,7 @@ static struct device_attribute lcd_devic
42683 * or a pointer to the newly allocated device.
42684 */
42685 struct lcd_device *lcd_device_register(const char *name, struct device *parent,
42686 - void *devdata, struct lcd_ops *ops)
42687 + void *devdata, const struct lcd_ops *ops)
42688 {
42689 struct lcd_device *new_ld;
42690 int rc;
42691 diff -urNp linux-2.6.39.1/drivers/video/backlight/ld9040.c linux-2.6.39.1/drivers/video/backlight/ld9040.c
42692 --- linux-2.6.39.1/drivers/video/backlight/ld9040.c 2011-05-19 00:06:34.000000000 -0400
42693 +++ linux-2.6.39.1/drivers/video/backlight/ld9040.c 2011-05-22 19:36:32.000000000 -0400
42694 @@ -651,7 +651,7 @@ static int ld9040_set_brightness(struct
42695 return ret;
42696 }
42697
42698 -static struct lcd_ops ld9040_lcd_ops = {
42699 +static const struct lcd_ops ld9040_lcd_ops = {
42700 .set_power = ld9040_set_power,
42701 .get_power = ld9040_get_power,
42702 };
42703 diff -urNp linux-2.6.39.1/drivers/video/backlight/lms283gf05.c linux-2.6.39.1/drivers/video/backlight/lms283gf05.c
42704 --- linux-2.6.39.1/drivers/video/backlight/lms283gf05.c 2011-05-19 00:06:34.000000000 -0400
42705 +++ linux-2.6.39.1/drivers/video/backlight/lms283gf05.c 2011-05-22 19:36:32.000000000 -0400
42706 @@ -144,7 +144,7 @@ static int lms283gf05_power_set(struct l
42707 return 0;
42708 }
42709
42710 -static struct lcd_ops lms_ops = {
42711 +static const struct lcd_ops lms_ops = {
42712 .set_power = lms283gf05_power_set,
42713 .get_power = NULL,
42714 };
42715 diff -urNp linux-2.6.39.1/drivers/video/backlight/ltv350qv.c linux-2.6.39.1/drivers/video/backlight/ltv350qv.c
42716 --- linux-2.6.39.1/drivers/video/backlight/ltv350qv.c 2011-05-19 00:06:34.000000000 -0400
42717 +++ linux-2.6.39.1/drivers/video/backlight/ltv350qv.c 2011-05-22 19:36:32.000000000 -0400
42718 @@ -221,7 +221,7 @@ static int ltv350qv_get_power(struct lcd
42719 return lcd->power;
42720 }
42721
42722 -static struct lcd_ops ltv_ops = {
42723 +static const struct lcd_ops ltv_ops = {
42724 .get_power = ltv350qv_get_power,
42725 .set_power = ltv350qv_set_power,
42726 };
42727 diff -urNp linux-2.6.39.1/drivers/video/backlight/platform_lcd.c linux-2.6.39.1/drivers/video/backlight/platform_lcd.c
42728 --- linux-2.6.39.1/drivers/video/backlight/platform_lcd.c 2011-05-19 00:06:34.000000000 -0400
42729 +++ linux-2.6.39.1/drivers/video/backlight/platform_lcd.c 2011-05-22 19:36:32.000000000 -0400
42730 @@ -66,7 +66,7 @@ static int platform_lcd_match(struct lcd
42731 return plcd->us->parent == info->device;
42732 }
42733
42734 -static struct lcd_ops platform_lcd_ops = {
42735 +static const struct lcd_ops platform_lcd_ops = {
42736 .get_power = platform_lcd_get_power,
42737 .set_power = platform_lcd_set_power,
42738 .check_fb = platform_lcd_match,
42739 diff -urNp linux-2.6.39.1/drivers/video/backlight/s6e63m0.c linux-2.6.39.1/drivers/video/backlight/s6e63m0.c
42740 --- linux-2.6.39.1/drivers/video/backlight/s6e63m0.c 2011-05-19 00:06:34.000000000 -0400
42741 +++ linux-2.6.39.1/drivers/video/backlight/s6e63m0.c 2011-05-22 19:36:32.000000000 -0400
42742 @@ -644,7 +644,7 @@ static int s6e63m0_set_brightness(struct
42743 return ret;
42744 }
42745
42746 -static struct lcd_ops s6e63m0_lcd_ops = {
42747 +static const struct lcd_ops s6e63m0_lcd_ops = {
42748 .set_power = s6e63m0_set_power,
42749 .get_power = s6e63m0_get_power,
42750 };
42751 diff -urNp linux-2.6.39.1/drivers/video/backlight/tdo24m.c linux-2.6.39.1/drivers/video/backlight/tdo24m.c
42752 --- linux-2.6.39.1/drivers/video/backlight/tdo24m.c 2011-05-19 00:06:34.000000000 -0400
42753 +++ linux-2.6.39.1/drivers/video/backlight/tdo24m.c 2011-05-22 19:36:32.000000000 -0400
42754 @@ -322,7 +322,7 @@ static int tdo24m_set_mode(struct lcd_de
42755 return lcd->adj_mode(lcd, mode);
42756 }
42757
42758 -static struct lcd_ops tdo24m_ops = {
42759 +static const struct lcd_ops tdo24m_ops = {
42760 .get_power = tdo24m_get_power,
42761 .set_power = tdo24m_set_power,
42762 .set_mode = tdo24m_set_mode,
42763 diff -urNp linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c
42764 --- linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c 2011-05-19 00:06:34.000000000 -0400
42765 +++ linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c 2011-05-22 19:36:32.000000000 -0400
42766 @@ -163,7 +163,7 @@ static int tosa_lcd_set_mode(struct lcd_
42767 return 0;
42768 }
42769
42770 -static struct lcd_ops tosa_lcd_ops = {
42771 +static const struct lcd_ops tosa_lcd_ops = {
42772 .set_power = tosa_lcd_set_power,
42773 .get_power = tosa_lcd_get_power,
42774 .set_mode = tosa_lcd_set_mode,
42775 diff -urNp linux-2.6.39.1/drivers/video/bf537-lq035.c linux-2.6.39.1/drivers/video/bf537-lq035.c
42776 --- linux-2.6.39.1/drivers/video/bf537-lq035.c 2011-05-19 00:06:34.000000000 -0400
42777 +++ linux-2.6.39.1/drivers/video/bf537-lq035.c 2011-05-22 19:36:32.000000000 -0400
42778 @@ -682,7 +682,7 @@ static int bfin_lcd_check_fb(struct lcd_
42779 return 0;
42780 }
42781
42782 -static struct lcd_ops bfin_lcd_ops = {
42783 +static const struct lcd_ops bfin_lcd_ops = {
42784 .get_power = bfin_lcd_get_power,
42785 .set_power = bfin_lcd_set_power,
42786 .get_contrast = bfin_lcd_get_contrast,
42787 diff -urNp linux-2.6.39.1/drivers/video/bf54x-lq043fb.c linux-2.6.39.1/drivers/video/bf54x-lq043fb.c
42788 --- linux-2.6.39.1/drivers/video/bf54x-lq043fb.c 2011-05-19 00:06:34.000000000 -0400
42789 +++ linux-2.6.39.1/drivers/video/bf54x-lq043fb.c 2011-05-22 19:36:32.000000000 -0400
42790 @@ -467,7 +467,7 @@ static int bfin_lcd_check_fb(struct lcd_
42791 return 0;
42792 }
42793
42794 -static struct lcd_ops bfin_lcd_ops = {
42795 +static const struct lcd_ops bfin_lcd_ops = {
42796 .get_power = bfin_lcd_get_power,
42797 .set_power = bfin_lcd_set_power,
42798 .get_contrast = bfin_lcd_get_contrast,
42799 diff -urNp linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c
42800 --- linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c 2011-05-19 00:06:34.000000000 -0400
42801 +++ linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c 2011-05-22 19:36:32.000000000 -0400
42802 @@ -387,7 +387,7 @@ static int bfin_lcd_check_fb(struct lcd_
42803 return 0;
42804 }
42805
42806 -static struct lcd_ops bfin_lcd_ops = {
42807 +static const struct lcd_ops bfin_lcd_ops = {
42808 .get_power = bfin_lcd_get_power,
42809 .set_power = bfin_lcd_set_power,
42810 .get_contrast = bfin_lcd_get_contrast,
42811 diff -urNp linux-2.6.39.1/drivers/video/fbcmap.c linux-2.6.39.1/drivers/video/fbcmap.c
42812 --- linux-2.6.39.1/drivers/video/fbcmap.c 2011-05-19 00:06:34.000000000 -0400
42813 +++ linux-2.6.39.1/drivers/video/fbcmap.c 2011-05-22 19:36:32.000000000 -0400
42814 @@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
42815 rc = -ENODEV;
42816 goto out;
42817 }
42818 - if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
42819 - !info->fbops->fb_setcmap)) {
42820 + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
42821 rc = -EINVAL;
42822 goto out1;
42823 }
42824 diff -urNp linux-2.6.39.1/drivers/video/fbmem.c linux-2.6.39.1/drivers/video/fbmem.c
42825 --- linux-2.6.39.1/drivers/video/fbmem.c 2011-05-19 00:06:34.000000000 -0400
42826 +++ linux-2.6.39.1/drivers/video/fbmem.c 2011-05-22 19:36:32.000000000 -0400
42827 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in
42828 image->dx += image->width + 8;
42829 }
42830 } else if (rotate == FB_ROTATE_UD) {
42831 - for (x = 0; x < num && image->dx >= 0; x++) {
42832 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
42833 info->fbops->fb_imageblit(info, image);
42834 image->dx -= image->width + 8;
42835 }
42836 @@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in
42837 image->dy += image->height + 8;
42838 }
42839 } else if (rotate == FB_ROTATE_CCW) {
42840 - for (x = 0; x < num && image->dy >= 0; x++) {
42841 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
42842 info->fbops->fb_imageblit(info, image);
42843 image->dy -= image->height + 8;
42844 }
42845 @@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct
42846 int flags = info->flags;
42847 int ret = 0;
42848
42849 + pax_track_stack();
42850 +
42851 if (var->activate & FB_ACTIVATE_INV_MODE) {
42852 struct fb_videomode mode1, mode2;
42853
42854 @@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *
42855 void __user *argp = (void __user *)arg;
42856 long ret = 0;
42857
42858 + pax_track_stack();
42859 +
42860 switch (cmd) {
42861 case FBIOGET_VSCREENINFO:
42862 if (!lock_fb_info(info))
42863 @@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *
42864 return -EFAULT;
42865 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
42866 return -EINVAL;
42867 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
42868 + if (con2fb.framebuffer >= FB_MAX)
42869 return -EINVAL;
42870 if (!registered_fb[con2fb.framebuffer])
42871 request_module("fb%d", con2fb.framebuffer);
42872 diff -urNp linux-2.6.39.1/drivers/video/geode/display_gx1.c linux-2.6.39.1/drivers/video/geode/display_gx1.c
42873 --- linux-2.6.39.1/drivers/video/geode/display_gx1.c 2011-05-19 00:06:34.000000000 -0400
42874 +++ linux-2.6.39.1/drivers/video/geode/display_gx1.c 2011-05-22 19:36:32.000000000 -0400
42875 @@ -208,7 +208,7 @@ static void gx1_set_hw_palette_reg(struc
42876 writel(val, par->dc_regs + DC_PAL_DATA);
42877 }
42878
42879 -struct geode_dc_ops gx1_dc_ops = {
42880 +const struct geode_dc_ops gx1_dc_ops = {
42881 .set_mode = gx1_set_mode,
42882 .set_palette_reg = gx1_set_hw_palette_reg,
42883 };
42884 diff -urNp linux-2.6.39.1/drivers/video/geode/display_gx1.h linux-2.6.39.1/drivers/video/geode/display_gx1.h
42885 --- linux-2.6.39.1/drivers/video/geode/display_gx1.h 2011-05-19 00:06:34.000000000 -0400
42886 +++ linux-2.6.39.1/drivers/video/geode/display_gx1.h 2011-05-22 19:36:32.000000000 -0400
42887 @@ -18,7 +18,7 @@
42888 unsigned gx1_gx_base(void);
42889 int gx1_frame_buffer_size(void);
42890
42891 -extern struct geode_dc_ops gx1_dc_ops;
42892 +extern const struct geode_dc_ops gx1_dc_ops;
42893
42894 /* GX1 configuration I/O registers */
42895
42896 diff -urNp linux-2.6.39.1/drivers/video/geode/geodefb.h linux-2.6.39.1/drivers/video/geode/geodefb.h
42897 --- linux-2.6.39.1/drivers/video/geode/geodefb.h 2011-05-19 00:06:34.000000000 -0400
42898 +++ linux-2.6.39.1/drivers/video/geode/geodefb.h 2011-05-22 19:36:32.000000000 -0400
42899 @@ -31,8 +31,8 @@ struct geodefb_par {
42900 int panel_y;
42901 void __iomem *dc_regs;
42902 void __iomem *vid_regs;
42903 - struct geode_dc_ops *dc_ops;
42904 - struct geode_vid_ops *vid_ops;
42905 + const struct geode_dc_ops *dc_ops;
42906 + const struct geode_vid_ops *vid_ops;
42907 };
42908
42909 #endif /* !__GEODEFB_H__ */
42910 diff -urNp linux-2.6.39.1/drivers/video/geode/video_cs5530.c linux-2.6.39.1/drivers/video/geode/video_cs5530.c
42911 --- linux-2.6.39.1/drivers/video/geode/video_cs5530.c 2011-05-19 00:06:34.000000000 -0400
42912 +++ linux-2.6.39.1/drivers/video/geode/video_cs5530.c 2011-05-22 19:36:32.000000000 -0400
42913 @@ -186,7 +186,7 @@ static int cs5530_blank_display(struct f
42914 return 0;
42915 }
42916
42917 -struct geode_vid_ops cs5530_vid_ops = {
42918 +const struct geode_vid_ops cs5530_vid_ops = {
42919 .set_dclk = cs5530_set_dclk_frequency,
42920 .configure_display = cs5530_configure_display,
42921 .blank_display = cs5530_blank_display,
42922 diff -urNp linux-2.6.39.1/drivers/video/geode/video_cs5530.h linux-2.6.39.1/drivers/video/geode/video_cs5530.h
42923 --- linux-2.6.39.1/drivers/video/geode/video_cs5530.h 2011-05-19 00:06:34.000000000 -0400
42924 +++ linux-2.6.39.1/drivers/video/geode/video_cs5530.h 2011-05-22 19:36:32.000000000 -0400
42925 @@ -15,7 +15,7 @@
42926 #ifndef __VIDEO_CS5530_H__
42927 #define __VIDEO_CS5530_H__
42928
42929 -extern struct geode_vid_ops cs5530_vid_ops;
42930 +extern const struct geode_vid_ops cs5530_vid_ops;
42931
42932 /* CS5530 Video device registers */
42933
42934 diff -urNp linux-2.6.39.1/drivers/video/i810/i810_accel.c linux-2.6.39.1/drivers/video/i810/i810_accel.c
42935 --- linux-2.6.39.1/drivers/video/i810/i810_accel.c 2011-05-19 00:06:34.000000000 -0400
42936 +++ linux-2.6.39.1/drivers/video/i810/i810_accel.c 2011-05-22 19:36:32.000000000 -0400
42937 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct
42938 }
42939 }
42940 printk("ringbuffer lockup!!!\n");
42941 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
42942 i810_report_error(mmio);
42943 par->dev_flags |= LOCKUP;
42944 info->pixmap.scan_align = 1;
42945 diff -urNp linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c
42946 --- linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c 2011-05-19 00:06:34.000000000 -0400
42947 +++ linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c 2011-05-22 19:36:32.000000000 -0400
42948 @@ -1232,7 +1232,7 @@ static struct fb_ops matroxfb_ops = {
42949 #define RSText 0x7
42950 #define RSText8 0x8
42951 /* 9-F */
42952 -static struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42953 +static const struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42954 { { 0, 8, 0}, { 0, 8, 0}, { 0, 8, 0}, { 0, 0, 0}, 8 },
42955 { { 10, 5, 0}, { 5, 5, 0}, { 0, 5, 0}, { 15, 1, 0}, 16 },
42956 { { 11, 5, 0}, { 5, 6, 0}, { 0, 5, 0}, { 0, 0, 0}, 16 },
42957 diff -urNp linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c
42958 --- linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c 2011-05-19 00:06:34.000000000 -0400
42959 +++ linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c 2011-05-22 19:36:32.000000000 -0400
42960 @@ -87,7 +87,7 @@ static int ams_delta_lcd_get_contrast(st
42961 return ams_delta_lcd & AMS_DELTA_MAX_CONTRAST;
42962 }
42963
42964 -static struct lcd_ops ams_delta_lcd_ops = {
42965 +static const struct lcd_ops ams_delta_lcd_ops = {
42966 .get_power = ams_delta_lcd_get_power,
42967 .set_power = ams_delta_lcd_set_power,
42968 .get_contrast = ams_delta_lcd_get_contrast,
42969 diff -urNp linux-2.6.39.1/drivers/video/pxa3xx-gcu.c linux-2.6.39.1/drivers/video/pxa3xx-gcu.c
42970 --- linux-2.6.39.1/drivers/video/pxa3xx-gcu.c 2011-05-19 00:06:34.000000000 -0400
42971 +++ linux-2.6.39.1/drivers/video/pxa3xx-gcu.c 2011-05-22 19:36:32.000000000 -0400
42972 @@ -103,7 +103,7 @@ struct pxa3xx_gcu_priv {
42973 dma_addr_t shared_phys;
42974 struct resource *resource_mem;
42975 struct miscdevice misc_dev;
42976 - struct file_operations misc_fops;
42977 + const struct file_operations misc_fops;
42978 wait_queue_head_t wait_idle;
42979 wait_queue_head_t wait_free;
42980 spinlock_t spinlock;
42981 diff -urNp linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c
42982 --- linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c 2011-05-19 00:06:34.000000000 -0400
42983 +++ linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c 2011-05-22 19:36:32.000000000 -0400
42984 @@ -245,7 +245,7 @@ static unsigned long lcdc_sys_read_data(
42985 return lcdc_read(ch->lcdc, _LDDRDR) & 0x3ffff;
42986 }
42987
42988 -struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42989 +const struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42990 lcdc_sys_write_index,
42991 lcdc_sys_write_data,
42992 lcdc_sys_read_data,
42993 diff -urNp linux-2.6.39.1/drivers/video/udlfb.c linux-2.6.39.1/drivers/video/udlfb.c
42994 --- linux-2.6.39.1/drivers/video/udlfb.c 2011-05-19 00:06:34.000000000 -0400
42995 +++ linux-2.6.39.1/drivers/video/udlfb.c 2011-05-22 19:36:32.000000000 -0400
42996 @@ -584,11 +584,11 @@ int dlfb_handle_damage(struct dlfb_data
42997 dlfb_urb_completion(urb);
42998
42999 error:
43000 - atomic_add(bytes_sent, &dev->bytes_sent);
43001 - atomic_add(bytes_identical, &dev->bytes_identical);
43002 - atomic_add(width*height*2, &dev->bytes_rendered);
43003 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
43004 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
43005 + atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
43006 end_cycles = get_cycles();
43007 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
43008 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
43009 >> 10)), /* Kcycles */
43010 &dev->cpu_kcycles_used);
43011
43012 @@ -709,11 +709,11 @@ static void dlfb_dpy_deferred_io(struct
43013 dlfb_urb_completion(urb);
43014
43015 error:
43016 - atomic_add(bytes_sent, &dev->bytes_sent);
43017 - atomic_add(bytes_identical, &dev->bytes_identical);
43018 - atomic_add(bytes_rendered, &dev->bytes_rendered);
43019 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
43020 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
43021 + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
43022 end_cycles = get_cycles();
43023 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
43024 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
43025 >> 10)), /* Kcycles */
43026 &dev->cpu_kcycles_used);
43027 }
43028 @@ -1301,7 +1301,7 @@ static ssize_t metrics_bytes_rendered_sh
43029 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43030 struct dlfb_data *dev = fb_info->par;
43031 return snprintf(buf, PAGE_SIZE, "%u\n",
43032 - atomic_read(&dev->bytes_rendered));
43033 + atomic_read_unchecked(&dev->bytes_rendered));
43034 }
43035
43036 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
43037 @@ -1309,7 +1309,7 @@ static ssize_t metrics_bytes_identical_s
43038 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43039 struct dlfb_data *dev = fb_info->par;
43040 return snprintf(buf, PAGE_SIZE, "%u\n",
43041 - atomic_read(&dev->bytes_identical));
43042 + atomic_read_unchecked(&dev->bytes_identical));
43043 }
43044
43045 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
43046 @@ -1317,7 +1317,7 @@ static ssize_t metrics_bytes_sent_show(s
43047 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43048 struct dlfb_data *dev = fb_info->par;
43049 return snprintf(buf, PAGE_SIZE, "%u\n",
43050 - atomic_read(&dev->bytes_sent));
43051 + atomic_read_unchecked(&dev->bytes_sent));
43052 }
43053
43054 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
43055 @@ -1325,7 +1325,7 @@ static ssize_t metrics_cpu_kcycles_used_
43056 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43057 struct dlfb_data *dev = fb_info->par;
43058 return snprintf(buf, PAGE_SIZE, "%u\n",
43059 - atomic_read(&dev->cpu_kcycles_used));
43060 + atomic_read_unchecked(&dev->cpu_kcycles_used));
43061 }
43062
43063 static ssize_t edid_show(
43064 @@ -1382,10 +1382,10 @@ static ssize_t metrics_reset_store(struc
43065 struct fb_info *fb_info = dev_get_drvdata(fbdev);
43066 struct dlfb_data *dev = fb_info->par;
43067
43068 - atomic_set(&dev->bytes_rendered, 0);
43069 - atomic_set(&dev->bytes_identical, 0);
43070 - atomic_set(&dev->bytes_sent, 0);
43071 - atomic_set(&dev->cpu_kcycles_used, 0);
43072 + atomic_set_unchecked(&dev->bytes_rendered, 0);
43073 + atomic_set_unchecked(&dev->bytes_identical, 0);
43074 + atomic_set_unchecked(&dev->bytes_sent, 0);
43075 + atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
43076
43077 return count;
43078 }
43079 diff -urNp linux-2.6.39.1/drivers/video/uvesafb.c linux-2.6.39.1/drivers/video/uvesafb.c
43080 --- linux-2.6.39.1/drivers/video/uvesafb.c 2011-05-19 00:06:34.000000000 -0400
43081 +++ linux-2.6.39.1/drivers/video/uvesafb.c 2011-05-22 19:36:32.000000000 -0400
43082 @@ -19,6 +19,7 @@
43083 #include <linux/io.h>
43084 #include <linux/mutex.h>
43085 #include <linux/slab.h>
43086 +#include <linux/moduleloader.h>
43087 #include <video/edid.h>
43088 #include <video/uvesafb.h>
43089 #ifdef CONFIG_X86
43090 @@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
43091 NULL,
43092 };
43093
43094 - return call_usermodehelper(v86d_path, argv, envp, 1);
43095 + return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
43096 }
43097
43098 /*
43099 @@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(
43100 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
43101 par->pmi_setpal = par->ypan = 0;
43102 } else {
43103 +
43104 +#ifdef CONFIG_PAX_KERNEXEC
43105 +#ifdef CONFIG_MODULES
43106 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
43107 +#endif
43108 + if (!par->pmi_code) {
43109 + par->pmi_setpal = par->ypan = 0;
43110 + return 0;
43111 + }
43112 +#endif
43113 +
43114 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
43115 + task->t.regs.edi);
43116 +
43117 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43118 + pax_open_kernel();
43119 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
43120 + pax_close_kernel();
43121 +
43122 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
43123 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
43124 +#else
43125 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
43126 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
43127 +#endif
43128 +
43129 printk(KERN_INFO "uvesafb: protected mode interface info at "
43130 "%04x:%04x\n",
43131 (u16)task->t.regs.es, (u16)task->t.regs.edi);
43132 @@ -1821,6 +1844,11 @@ out:
43133 if (par->vbe_modes)
43134 kfree(par->vbe_modes);
43135
43136 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43137 + if (par->pmi_code)
43138 + module_free_exec(NULL, par->pmi_code);
43139 +#endif
43140 +
43141 framebuffer_release(info);
43142 return err;
43143 }
43144 @@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor
43145 kfree(par->vbe_state_orig);
43146 if (par->vbe_state_saved)
43147 kfree(par->vbe_state_saved);
43148 +
43149 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43150 + if (par->pmi_code)
43151 + module_free_exec(NULL, par->pmi_code);
43152 +#endif
43153 +
43154 }
43155
43156 framebuffer_release(info);
43157 @@ -2013,7 +2047,7 @@ static int param_set_scroll(const char *
43158
43159 return 0;
43160 }
43161 -static struct kernel_param_ops param_ops_scroll = {
43162 +static const struct kernel_param_ops param_ops_scroll = {
43163 .set = param_set_scroll,
43164 };
43165 #define param_check_scroll(name, p) __param_check(name, p, void)
43166 diff -urNp linux-2.6.39.1/drivers/video/vesafb.c linux-2.6.39.1/drivers/video/vesafb.c
43167 --- linux-2.6.39.1/drivers/video/vesafb.c 2011-05-19 00:06:34.000000000 -0400
43168 +++ linux-2.6.39.1/drivers/video/vesafb.c 2011-05-22 19:36:32.000000000 -0400
43169 @@ -9,6 +9,7 @@
43170 */
43171
43172 #include <linux/module.h>
43173 +#include <linux/moduleloader.h>
43174 #include <linux/kernel.h>
43175 #include <linux/errno.h>
43176 #include <linux/string.h>
43177 @@ -52,8 +53,8 @@ static int vram_remap __initdata; /*
43178 static int vram_total __initdata; /* Set total amount of memory */
43179 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
43180 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
43181 -static void (*pmi_start)(void) __read_mostly;
43182 -static void (*pmi_pal) (void) __read_mostly;
43183 +static void (*pmi_start)(void) __read_only;
43184 +static void (*pmi_pal) (void) __read_only;
43185 static int depth __read_mostly;
43186 static int vga_compat __read_mostly;
43187 /* --------------------------------------------------------------------- */
43188 @@ -232,6 +233,7 @@ static int __init vesafb_probe(struct pl
43189 unsigned int size_vmode;
43190 unsigned int size_remap;
43191 unsigned int size_total;
43192 + void *pmi_code = NULL;
43193
43194 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
43195 return -ENODEV;
43196 @@ -274,10 +276,6 @@ static int __init vesafb_probe(struct pl
43197 size_remap = size_total;
43198 vesafb_fix.smem_len = size_remap;
43199
43200 -#ifndef __i386__
43201 - screen_info.vesapm_seg = 0;
43202 -#endif
43203 -
43204 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
43205 printk(KERN_WARNING
43206 "vesafb: cannot reserve video memory at 0x%lx\n",
43207 @@ -306,9 +304,21 @@ static int __init vesafb_probe(struct pl
43208 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
43209 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
43210
43211 +#ifdef __i386__
43212 +
43213 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43214 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
43215 + if (!pmi_code)
43216 +#elif !defined(CONFIG_PAX_KERNEXEC)
43217 + if (0)
43218 +#endif
43219 +
43220 +#endif
43221 + screen_info.vesapm_seg = 0;
43222 +
43223 if (screen_info.vesapm_seg) {
43224 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
43225 - screen_info.vesapm_seg,screen_info.vesapm_off);
43226 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
43227 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
43228 }
43229
43230 if (screen_info.vesapm_seg < 0xc000)
43231 @@ -316,9 +326,25 @@ static int __init vesafb_probe(struct pl
43232
43233 if (ypan || pmi_setpal) {
43234 unsigned short *pmi_base;
43235 - pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43236 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
43237 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
43238 +
43239 + pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43240 +
43241 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43242 + pax_open_kernel();
43243 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
43244 +#else
43245 + pmi_code = pmi_base;
43246 +#endif
43247 +
43248 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
43249 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
43250 +
43251 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43252 + pmi_start = ktva_ktla(pmi_start);
43253 + pmi_pal = ktva_ktla(pmi_pal);
43254 + pax_close_kernel();
43255 +#endif
43256 +
43257 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
43258 if (pmi_base[3]) {
43259 printk(KERN_INFO "vesafb: pmi: ports = ");
43260 @@ -487,6 +513,11 @@ static int __init vesafb_probe(struct pl
43261 info->node, info->fix.id);
43262 return 0;
43263 err:
43264 +
43265 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43266 + module_free_exec(NULL, pmi_code);
43267 +#endif
43268 +
43269 if (info->screen_base)
43270 iounmap(info->screen_base);
43271 framebuffer_release(info);
43272 diff -urNp linux-2.6.39.1/drivers/virtio/virtio_balloon.c linux-2.6.39.1/drivers/virtio/virtio_balloon.c
43273 --- linux-2.6.39.1/drivers/virtio/virtio_balloon.c 2011-05-19 00:06:34.000000000 -0400
43274 +++ linux-2.6.39.1/drivers/virtio/virtio_balloon.c 2011-05-22 19:36:32.000000000 -0400
43275 @@ -176,6 +176,8 @@ static void update_balloon_stats(struct
43276 struct sysinfo i;
43277 int idx = 0;
43278
43279 + pax_track_stack();
43280 +
43281 all_vm_events(events);
43282 si_meminfo(&i);
43283
43284 diff -urNp linux-2.6.39.1/drivers/xen/gntalloc.c linux-2.6.39.1/drivers/xen/gntalloc.c
43285 --- linux-2.6.39.1/drivers/xen/gntalloc.c 2011-05-19 00:06:34.000000000 -0400
43286 +++ linux-2.6.39.1/drivers/xen/gntalloc.c 2011-05-22 19:36:32.000000000 -0400
43287 @@ -440,7 +440,7 @@ static void gntalloc_vma_close(struct vm
43288 spin_unlock(&gref_lock);
43289 }
43290
43291 -static struct vm_operations_struct gntalloc_vmops = {
43292 +static const struct vm_operations_struct gntalloc_vmops = {
43293 .close = gntalloc_vma_close,
43294 };
43295
43296 diff -urNp linux-2.6.39.1/drivers/xen/gntdev.c linux-2.6.39.1/drivers/xen/gntdev.c
43297 --- linux-2.6.39.1/drivers/xen/gntdev.c 2011-05-19 00:06:34.000000000 -0400
43298 +++ linux-2.6.39.1/drivers/xen/gntdev.c 2011-05-22 19:36:32.000000000 -0400
43299 @@ -340,7 +340,7 @@ static void gntdev_vma_close(struct vm_a
43300 gntdev_put_map(map);
43301 }
43302
43303 -static struct vm_operations_struct gntdev_vmops = {
43304 +static const struct vm_operations_struct gntdev_vmops = {
43305 .close = gntdev_vma_close,
43306 };
43307
43308 @@ -404,7 +404,7 @@ static void mn_release(struct mmu_notifi
43309 spin_unlock(&priv->lock);
43310 }
43311
43312 -struct mmu_notifier_ops gntdev_mmu_ops = {
43313 +const struct mmu_notifier_ops gntdev_mmu_ops = {
43314 .release = mn_release,
43315 .invalidate_page = mn_invl_page,
43316 .invalidate_range_start = mn_invl_range_start,
43317 diff -urNp linux-2.6.39.1/drivers/xen/xenfs/privcmd.c linux-2.6.39.1/drivers/xen/xenfs/privcmd.c
43318 --- linux-2.6.39.1/drivers/xen/xenfs/privcmd.c 2011-05-19 00:06:34.000000000 -0400
43319 +++ linux-2.6.39.1/drivers/xen/xenfs/privcmd.c 2011-05-22 19:36:32.000000000 -0400
43320 @@ -268,7 +268,7 @@ static int mmap_return_errors(void *data
43321 return put_user(*mfnp, st->user++);
43322 }
43323
43324 -static struct vm_operations_struct privcmd_vm_ops;
43325 +static const struct vm_operations_struct privcmd_vm_ops;
43326
43327 static long privcmd_ioctl_mmap_batch(void __user *udata)
43328 {
43329 @@ -369,7 +369,7 @@ static int privcmd_fault(struct vm_area_
43330 return VM_FAULT_SIGBUS;
43331 }
43332
43333 -static struct vm_operations_struct privcmd_vm_ops = {
43334 +static const struct vm_operations_struct privcmd_vm_ops = {
43335 .fault = privcmd_fault
43336 };
43337
43338 diff -urNp linux-2.6.39.1/fs/9p/vfs_inode.c linux-2.6.39.1/fs/9p/vfs_inode.c
43339 --- linux-2.6.39.1/fs/9p/vfs_inode.c 2011-05-19 00:06:34.000000000 -0400
43340 +++ linux-2.6.39.1/fs/9p/vfs_inode.c 2011-05-22 19:36:32.000000000 -0400
43341 @@ -1210,7 +1210,7 @@ static void *v9fs_vfs_follow_link(struct
43342 void
43343 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43344 {
43345 - char *s = nd_get_link(nd);
43346 + const char *s = nd_get_link(nd);
43347
43348 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
43349 IS_ERR(s) ? "<error>" : s);
43350 diff -urNp linux-2.6.39.1/fs/aio.c linux-2.6.39.1/fs/aio.c
43351 --- linux-2.6.39.1/fs/aio.c 2011-05-19 00:06:34.000000000 -0400
43352 +++ linux-2.6.39.1/fs/aio.c 2011-06-03 01:00:34.000000000 -0400
43353 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx
43354 size += sizeof(struct io_event) * nr_events;
43355 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
43356
43357 - if (nr_pages < 0)
43358 + if (nr_pages <= 0)
43359 return -EINVAL;
43360
43361 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
43362 @@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct
43363 struct aio_timeout to;
43364 int retry = 0;
43365
43366 + pax_track_stack();
43367 +
43368 /* needed to zero any padding within an entry (there shouldn't be
43369 * any, but C is fun!
43370 */
43371 @@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *i
43372 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
43373 {
43374 ssize_t ret;
43375 + struct iovec iovstack;
43376
43377 #ifdef CONFIG_COMPAT
43378 if (compat)
43379 ret = compat_rw_copy_check_uvector(type,
43380 (struct compat_iovec __user *)kiocb->ki_buf,
43381 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
43382 + kiocb->ki_nbytes, 1, &iovstack,
43383 &kiocb->ki_iovec);
43384 else
43385 #endif
43386 ret = rw_copy_check_uvector(type,
43387 (struct iovec __user *)kiocb->ki_buf,
43388 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
43389 + kiocb->ki_nbytes, 1, &iovstack,
43390 &kiocb->ki_iovec);
43391 if (ret < 0)
43392 goto out;
43393
43394 + if (kiocb->ki_iovec == &iovstack) {
43395 + kiocb->ki_inline_vec = iovstack;
43396 + kiocb->ki_iovec = &kiocb->ki_inline_vec;
43397 + }
43398 kiocb->ki_nr_segs = kiocb->ki_nbytes;
43399 kiocb->ki_cur_seg = 0;
43400 /* ki_nbytes/left now reflect bytes instead of segs */
43401 diff -urNp linux-2.6.39.1/fs/attr.c linux-2.6.39.1/fs/attr.c
43402 --- linux-2.6.39.1/fs/attr.c 2011-05-19 00:06:34.000000000 -0400
43403 +++ linux-2.6.39.1/fs/attr.c 2011-05-22 19:41:37.000000000 -0400
43404 @@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode
43405 unsigned long limit;
43406
43407 limit = rlimit(RLIMIT_FSIZE);
43408 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
43409 if (limit != RLIM_INFINITY && offset > limit)
43410 goto out_sig;
43411 if (offset > inode->i_sb->s_maxbytes)
43412 diff -urNp linux-2.6.39.1/fs/befs/linuxvfs.c linux-2.6.39.1/fs/befs/linuxvfs.c
43413 --- linux-2.6.39.1/fs/befs/linuxvfs.c 2011-05-19 00:06:34.000000000 -0400
43414 +++ linux-2.6.39.1/fs/befs/linuxvfs.c 2011-05-22 19:36:32.000000000 -0400
43415 @@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
43416 {
43417 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
43418 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
43419 - char *link = nd_get_link(nd);
43420 + const char *link = nd_get_link(nd);
43421 if (!IS_ERR(link))
43422 kfree(link);
43423 }
43424 diff -urNp linux-2.6.39.1/fs/binfmt_aout.c linux-2.6.39.1/fs/binfmt_aout.c
43425 --- linux-2.6.39.1/fs/binfmt_aout.c 2011-05-19 00:06:34.000000000 -0400
43426 +++ linux-2.6.39.1/fs/binfmt_aout.c 2011-05-22 19:41:37.000000000 -0400
43427 @@ -16,6 +16,7 @@
43428 #include <linux/string.h>
43429 #include <linux/fs.h>
43430 #include <linux/file.h>
43431 +#include <linux/security.h>
43432 #include <linux/stat.h>
43433 #include <linux/fcntl.h>
43434 #include <linux/ptrace.h>
43435 @@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum
43436 #endif
43437 # define START_STACK(u) ((void __user *)u.start_stack)
43438
43439 + memset(&dump, 0, sizeof(dump));
43440 +
43441 fs = get_fs();
43442 set_fs(KERNEL_DS);
43443 has_dumped = 1;
43444 @@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum
43445
43446 /* If the size of the dump file exceeds the rlimit, then see what would happen
43447 if we wrote the stack, but not the data area. */
43448 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
43449 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
43450 dump.u_dsize = 0;
43451
43452 /* Make sure we have enough room to write the stack and data areas. */
43453 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
43454 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
43455 dump.u_ssize = 0;
43456
43457 @@ -234,6 +239,8 @@ static int load_aout_binary(struct linux
43458 rlim = rlimit(RLIMIT_DATA);
43459 if (rlim >= RLIM_INFINITY)
43460 rlim = ~0;
43461 +
43462 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
43463 if (ex.a_data + ex.a_bss > rlim)
43464 return -ENOMEM;
43465
43466 @@ -262,6 +269,27 @@ static int load_aout_binary(struct linux
43467 install_exec_creds(bprm);
43468 current->flags &= ~PF_FORKNOEXEC;
43469
43470 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43471 + current->mm->pax_flags = 0UL;
43472 +#endif
43473 +
43474 +#ifdef CONFIG_PAX_PAGEEXEC
43475 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
43476 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
43477 +
43478 +#ifdef CONFIG_PAX_EMUTRAMP
43479 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
43480 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
43481 +#endif
43482 +
43483 +#ifdef CONFIG_PAX_MPROTECT
43484 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
43485 + current->mm->pax_flags |= MF_PAX_MPROTECT;
43486 +#endif
43487 +
43488 + }
43489 +#endif
43490 +
43491 if (N_MAGIC(ex) == OMAGIC) {
43492 unsigned long text_addr, map_size;
43493 loff_t pos;
43494 @@ -334,7 +362,7 @@ static int load_aout_binary(struct linux
43495
43496 down_write(&current->mm->mmap_sem);
43497 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
43498 - PROT_READ | PROT_WRITE | PROT_EXEC,
43499 + PROT_READ | PROT_WRITE,
43500 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
43501 fd_offset + ex.a_text);
43502 up_write(&current->mm->mmap_sem);
43503 diff -urNp linux-2.6.39.1/fs/binfmt_elf.c linux-2.6.39.1/fs/binfmt_elf.c
43504 --- linux-2.6.39.1/fs/binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
43505 +++ linux-2.6.39.1/fs/binfmt_elf.c 2011-05-22 19:41:37.000000000 -0400
43506 @@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
43507 #define elf_core_dump NULL
43508 #endif
43509
43510 +#ifdef CONFIG_PAX_MPROTECT
43511 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
43512 +#endif
43513 +
43514 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
43515 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
43516 #else
43517 @@ -70,6 +74,11 @@ static struct linux_binfmt elf_format =
43518 .load_binary = load_elf_binary,
43519 .load_shlib = load_elf_library,
43520 .core_dump = elf_core_dump,
43521 +
43522 +#ifdef CONFIG_PAX_MPROTECT
43523 + .handle_mprotect= elf_handle_mprotect,
43524 +#endif
43525 +
43526 .min_coredump = ELF_EXEC_PAGESIZE,
43527 };
43528
43529 @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
43530
43531 static int set_brk(unsigned long start, unsigned long end)
43532 {
43533 + unsigned long e = end;
43534 +
43535 start = ELF_PAGEALIGN(start);
43536 end = ELF_PAGEALIGN(end);
43537 if (end > start) {
43538 @@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
43539 if (BAD_ADDR(addr))
43540 return addr;
43541 }
43542 - current->mm->start_brk = current->mm->brk = end;
43543 + current->mm->start_brk = current->mm->brk = e;
43544 return 0;
43545 }
43546
43547 @@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
43548 elf_addr_t __user *u_rand_bytes;
43549 const char *k_platform = ELF_PLATFORM;
43550 const char *k_base_platform = ELF_BASE_PLATFORM;
43551 - unsigned char k_rand_bytes[16];
43552 + u32 k_rand_bytes[4];
43553 int items;
43554 elf_addr_t *elf_info;
43555 int ei_index = 0;
43556 const struct cred *cred = current_cred();
43557 struct vm_area_struct *vma;
43558 + unsigned long saved_auxv[AT_VECTOR_SIZE];
43559 +
43560 + pax_track_stack();
43561
43562 /*
43563 * In some cases (e.g. Hyper-Threading), we want to avoid L1
43564 @@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
43565 * Generate 16 random bytes for userspace PRNG seeding.
43566 */
43567 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
43568 - u_rand_bytes = (elf_addr_t __user *)
43569 - STACK_ALLOC(p, sizeof(k_rand_bytes));
43570 + srandom32(k_rand_bytes[0] ^ random32());
43571 + srandom32(k_rand_bytes[1] ^ random32());
43572 + srandom32(k_rand_bytes[2] ^ random32());
43573 + srandom32(k_rand_bytes[3] ^ random32());
43574 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
43575 + u_rand_bytes = (elf_addr_t __user *) p;
43576 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
43577 return -EFAULT;
43578
43579 @@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
43580 return -EFAULT;
43581 current->mm->env_end = p;
43582
43583 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
43584 +
43585 /* Put the elf_info on the stack in the right place. */
43586 sp = (elf_addr_t __user *)envp + 1;
43587 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
43588 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
43589 return -EFAULT;
43590 return 0;
43591 }
43592 @@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
43593 {
43594 struct elf_phdr *elf_phdata;
43595 struct elf_phdr *eppnt;
43596 - unsigned long load_addr = 0;
43597 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
43598 int load_addr_set = 0;
43599 unsigned long last_bss = 0, elf_bss = 0;
43600 - unsigned long error = ~0UL;
43601 + unsigned long error = -EINVAL;
43602 unsigned long total_size;
43603 int retval, i, size;
43604
43605 @@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
43606 goto out_close;
43607 }
43608
43609 +#ifdef CONFIG_PAX_SEGMEXEC
43610 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
43611 + pax_task_size = SEGMEXEC_TASK_SIZE;
43612 +#endif
43613 +
43614 eppnt = elf_phdata;
43615 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
43616 if (eppnt->p_type == PT_LOAD) {
43617 @@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
43618 k = load_addr + eppnt->p_vaddr;
43619 if (BAD_ADDR(k) ||
43620 eppnt->p_filesz > eppnt->p_memsz ||
43621 - eppnt->p_memsz > TASK_SIZE ||
43622 - TASK_SIZE - eppnt->p_memsz < k) {
43623 + eppnt->p_memsz > pax_task_size ||
43624 + pax_task_size - eppnt->p_memsz < k) {
43625 error = -ENOMEM;
43626 goto out_close;
43627 }
43628 @@ -528,6 +553,193 @@ out:
43629 return error;
43630 }
43631
43632 +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
43633 +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
43634 +{
43635 + unsigned long pax_flags = 0UL;
43636 +
43637 +#ifdef CONFIG_PAX_PAGEEXEC
43638 + if (elf_phdata->p_flags & PF_PAGEEXEC)
43639 + pax_flags |= MF_PAX_PAGEEXEC;
43640 +#endif
43641 +
43642 +#ifdef CONFIG_PAX_SEGMEXEC
43643 + if (elf_phdata->p_flags & PF_SEGMEXEC)
43644 + pax_flags |= MF_PAX_SEGMEXEC;
43645 +#endif
43646 +
43647 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43648 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43649 + if ((__supported_pte_mask & _PAGE_NX))
43650 + pax_flags &= ~MF_PAX_SEGMEXEC;
43651 + else
43652 + pax_flags &= ~MF_PAX_PAGEEXEC;
43653 + }
43654 +#endif
43655 +
43656 +#ifdef CONFIG_PAX_EMUTRAMP
43657 + if (elf_phdata->p_flags & PF_EMUTRAMP)
43658 + pax_flags |= MF_PAX_EMUTRAMP;
43659 +#endif
43660 +
43661 +#ifdef CONFIG_PAX_MPROTECT
43662 + if (elf_phdata->p_flags & PF_MPROTECT)
43663 + pax_flags |= MF_PAX_MPROTECT;
43664 +#endif
43665 +
43666 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43667 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
43668 + pax_flags |= MF_PAX_RANDMMAP;
43669 +#endif
43670 +
43671 + return pax_flags;
43672 +}
43673 +#endif
43674 +
43675 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
43676 +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
43677 +{
43678 + unsigned long pax_flags = 0UL;
43679 +
43680 +#ifdef CONFIG_PAX_PAGEEXEC
43681 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
43682 + pax_flags |= MF_PAX_PAGEEXEC;
43683 +#endif
43684 +
43685 +#ifdef CONFIG_PAX_SEGMEXEC
43686 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
43687 + pax_flags |= MF_PAX_SEGMEXEC;
43688 +#endif
43689 +
43690 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43691 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43692 + if ((__supported_pte_mask & _PAGE_NX))
43693 + pax_flags &= ~MF_PAX_SEGMEXEC;
43694 + else
43695 + pax_flags &= ~MF_PAX_PAGEEXEC;
43696 + }
43697 +#endif
43698 +
43699 +#ifdef CONFIG_PAX_EMUTRAMP
43700 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
43701 + pax_flags |= MF_PAX_EMUTRAMP;
43702 +#endif
43703 +
43704 +#ifdef CONFIG_PAX_MPROTECT
43705 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
43706 + pax_flags |= MF_PAX_MPROTECT;
43707 +#endif
43708 +
43709 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43710 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
43711 + pax_flags |= MF_PAX_RANDMMAP;
43712 +#endif
43713 +
43714 + return pax_flags;
43715 +}
43716 +#endif
43717 +
43718 +#ifdef CONFIG_PAX_EI_PAX
43719 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
43720 +{
43721 + unsigned long pax_flags = 0UL;
43722 +
43723 +#ifdef CONFIG_PAX_PAGEEXEC
43724 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
43725 + pax_flags |= MF_PAX_PAGEEXEC;
43726 +#endif
43727 +
43728 +#ifdef CONFIG_PAX_SEGMEXEC
43729 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
43730 + pax_flags |= MF_PAX_SEGMEXEC;
43731 +#endif
43732 +
43733 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43734 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43735 + if ((__supported_pte_mask & _PAGE_NX))
43736 + pax_flags &= ~MF_PAX_SEGMEXEC;
43737 + else
43738 + pax_flags &= ~MF_PAX_PAGEEXEC;
43739 + }
43740 +#endif
43741 +
43742 +#ifdef CONFIG_PAX_EMUTRAMP
43743 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
43744 + pax_flags |= MF_PAX_EMUTRAMP;
43745 +#endif
43746 +
43747 +#ifdef CONFIG_PAX_MPROTECT
43748 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
43749 + pax_flags |= MF_PAX_MPROTECT;
43750 +#endif
43751 +
43752 +#ifdef CONFIG_PAX_ASLR
43753 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
43754 + pax_flags |= MF_PAX_RANDMMAP;
43755 +#endif
43756 +
43757 + return pax_flags;
43758 +}
43759 +#endif
43760 +
43761 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43762 +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
43763 +{
43764 + unsigned long pax_flags = 0UL;
43765 +
43766 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
43767 + unsigned long i;
43768 + int found_flags = 0;
43769 +#endif
43770 +
43771 +#ifdef CONFIG_PAX_EI_PAX
43772 + pax_flags = pax_parse_ei_pax(elf_ex);
43773 +#endif
43774 +
43775 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
43776 + for (i = 0UL; i < elf_ex->e_phnum; i++)
43777 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
43778 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
43779 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
43780 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
43781 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
43782 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
43783 + return -EINVAL;
43784 +
43785 +#ifdef CONFIG_PAX_SOFTMODE
43786 + if (pax_softmode)
43787 + pax_flags = pax_parse_softmode(&elf_phdata[i]);
43788 + else
43789 +#endif
43790 +
43791 + pax_flags = pax_parse_hardmode(&elf_phdata[i]);
43792 + found_flags = 1;
43793 + break;
43794 + }
43795 +#endif
43796 +
43797 +#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
43798 + if (found_flags == 0) {
43799 + struct elf_phdr phdr;
43800 + memset(&phdr, 0, sizeof(phdr));
43801 + phdr.p_flags = PF_NOEMUTRAMP;
43802 +#ifdef CONFIG_PAX_SOFTMODE
43803 + if (pax_softmode)
43804 + pax_flags = pax_parse_softmode(&phdr);
43805 + else
43806 +#endif
43807 + pax_flags = pax_parse_hardmode(&phdr);
43808 + }
43809 +#endif
43810 +
43811 + if (0 > pax_check_flags(&pax_flags))
43812 + return -EINVAL;
43813 +
43814 + current->mm->pax_flags = pax_flags;
43815 + return 0;
43816 +}
43817 +#endif
43818 +
43819 /*
43820 * These are the functions used to load ELF style executables and shared
43821 * libraries. There is no binary dependent code anywhere else.
43822 @@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
43823 {
43824 unsigned int random_variable = 0;
43825
43826 +#ifdef CONFIG_PAX_RANDUSTACK
43827 + if (randomize_va_space)
43828 + return stack_top - current->mm->delta_stack;
43829 +#endif
43830 +
43831 if ((current->flags & PF_RANDOMIZE) &&
43832 !(current->personality & ADDR_NO_RANDOMIZE)) {
43833 random_variable = get_random_int() & STACK_RND_MASK;
43834 @@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
43835 unsigned long load_addr = 0, load_bias = 0;
43836 int load_addr_set = 0;
43837 char * elf_interpreter = NULL;
43838 - unsigned long error;
43839 + unsigned long error = 0;
43840 struct elf_phdr *elf_ppnt, *elf_phdata;
43841 unsigned long elf_bss, elf_brk;
43842 int retval, i;
43843 @@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
43844 unsigned long start_code, end_code, start_data, end_data;
43845 unsigned long reloc_func_desc __maybe_unused = 0;
43846 int executable_stack = EXSTACK_DEFAULT;
43847 - unsigned long def_flags = 0;
43848 struct {
43849 struct elfhdr elf_ex;
43850 struct elfhdr interp_elf_ex;
43851 } *loc;
43852 + unsigned long pax_task_size = TASK_SIZE;
43853
43854 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
43855 if (!loc) {
43856 @@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
43857
43858 /* OK, This is the point of no return */
43859 current->flags &= ~PF_FORKNOEXEC;
43860 - current->mm->def_flags = def_flags;
43861 +
43862 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43863 + current->mm->pax_flags = 0UL;
43864 +#endif
43865 +
43866 +#ifdef CONFIG_PAX_DLRESOLVE
43867 + current->mm->call_dl_resolve = 0UL;
43868 +#endif
43869 +
43870 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
43871 + current->mm->call_syscall = 0UL;
43872 +#endif
43873 +
43874 +#ifdef CONFIG_PAX_ASLR
43875 + current->mm->delta_mmap = 0UL;
43876 + current->mm->delta_stack = 0UL;
43877 +#endif
43878 +
43879 + current->mm->def_flags = 0;
43880 +
43881 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43882 + if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
43883 + send_sig(SIGKILL, current, 0);
43884 + goto out_free_dentry;
43885 + }
43886 +#endif
43887 +
43888 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
43889 + pax_set_initial_flags(bprm);
43890 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
43891 + if (pax_set_initial_flags_func)
43892 + (pax_set_initial_flags_func)(bprm);
43893 +#endif
43894 +
43895 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
43896 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
43897 + current->mm->context.user_cs_limit = PAGE_SIZE;
43898 + current->mm->def_flags |= VM_PAGEEXEC;
43899 + }
43900 +#endif
43901 +
43902 +#ifdef CONFIG_PAX_SEGMEXEC
43903 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
43904 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
43905 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
43906 + pax_task_size = SEGMEXEC_TASK_SIZE;
43907 + current->mm->def_flags |= VM_NOHUGEPAGE;
43908 + }
43909 +#endif
43910 +
43911 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
43912 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43913 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
43914 + put_cpu();
43915 + }
43916 +#endif
43917
43918 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
43919 may depend on the personality. */
43920 SET_PERSONALITY(loc->elf_ex);
43921 +
43922 +#ifdef CONFIG_PAX_ASLR
43923 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
43924 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
43925 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
43926 + }
43927 +#endif
43928 +
43929 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43930 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43931 + executable_stack = EXSTACK_DISABLE_X;
43932 + current->personality &= ~READ_IMPLIES_EXEC;
43933 + } else
43934 +#endif
43935 +
43936 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
43937 current->personality |= READ_IMPLIES_EXEC;
43938
43939 @@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_
43940 #else
43941 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
43942 #endif
43943 +
43944 +#ifdef CONFIG_PAX_RANDMMAP
43945 + /* PaX: randomize base address at the default exe base if requested */
43946 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
43947 +#ifdef CONFIG_SPARC64
43948 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
43949 +#else
43950 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
43951 +#endif
43952 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
43953 + elf_flags |= MAP_FIXED;
43954 + }
43955 +#endif
43956 +
43957 }
43958
43959 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
43960 @@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_
43961 * allowed task size. Note that p_filesz must always be
43962 * <= p_memsz so it is only necessary to check p_memsz.
43963 */
43964 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43965 - elf_ppnt->p_memsz > TASK_SIZE ||
43966 - TASK_SIZE - elf_ppnt->p_memsz < k) {
43967 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43968 + elf_ppnt->p_memsz > pax_task_size ||
43969 + pax_task_size - elf_ppnt->p_memsz < k) {
43970 /* set_brk can never work. Avoid overflows. */
43971 send_sig(SIGKILL, current, 0);
43972 retval = -EINVAL;
43973 @@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_
43974 start_data += load_bias;
43975 end_data += load_bias;
43976
43977 +#ifdef CONFIG_PAX_RANDMMAP
43978 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
43979 + elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
43980 +#endif
43981 +
43982 /* Calling set_brk effectively mmaps the pages that we need
43983 * for the bss and break sections. We must do this before
43984 * mapping in the interpreter, to make sure it doesn't wind
43985 @@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_
43986 goto out_free_dentry;
43987 }
43988 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
43989 - send_sig(SIGSEGV, current, 0);
43990 - retval = -EFAULT; /* Nobody gets to see this, but.. */
43991 - goto out_free_dentry;
43992 + /*
43993 + * This bss-zeroing can fail if the ELF
43994 + * file specifies odd protections. So
43995 + * we don't check the return value
43996 + */
43997 }
43998
43999 if (elf_interpreter) {
44000 @@ -1090,7 +1398,7 @@ out:
44001 * Decide what to dump of a segment, part, all or none.
44002 */
44003 static unsigned long vma_dump_size(struct vm_area_struct *vma,
44004 - unsigned long mm_flags)
44005 + unsigned long mm_flags, long signr)
44006 {
44007 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
44008
44009 @@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc
44010 if (vma->vm_file == NULL)
44011 return 0;
44012
44013 - if (FILTER(MAPPED_PRIVATE))
44014 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
44015 goto whole;
44016
44017 /*
44018 @@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf
44019 {
44020 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
44021 int i = 0;
44022 - do
44023 + do {
44024 i += 2;
44025 - while (auxv[i - 2] != AT_NULL);
44026 + } while (auxv[i - 2] != AT_NULL);
44027 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
44028 }
44029
44030 @@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh
44031 }
44032
44033 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
44034 - unsigned long mm_flags)
44035 + struct coredump_params *cprm)
44036 {
44037 struct vm_area_struct *vma;
44038 size_t size = 0;
44039
44040 for (vma = first_vma(current, gate_vma); vma != NULL;
44041 vma = next_vma(vma, gate_vma))
44042 - size += vma_dump_size(vma, mm_flags);
44043 + size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
44044 return size;
44045 }
44046
44047 @@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump
44048
44049 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
44050
44051 - offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
44052 + offset += elf_core_vma_data_size(gate_vma, cprm);
44053 offset += elf_core_extra_data_size();
44054 e_shoff = offset;
44055
44056 @@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump
44057 offset = dataoff;
44058
44059 size += sizeof(*elf);
44060 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
44061 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
44062 goto end_coredump;
44063
44064 size += sizeof(*phdr4note);
44065 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
44066 if (size > cprm->limit
44067 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
44068 goto end_coredump;
44069 @@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump
44070 phdr.p_offset = offset;
44071 phdr.p_vaddr = vma->vm_start;
44072 phdr.p_paddr = 0;
44073 - phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
44074 + phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
44075 phdr.p_memsz = vma->vm_end - vma->vm_start;
44076 offset += phdr.p_filesz;
44077 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
44078 @@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump
44079 phdr.p_align = ELF_EXEC_PAGESIZE;
44080
44081 size += sizeof(phdr);
44082 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
44083 if (size > cprm->limit
44084 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
44085 goto end_coredump;
44086 @@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump
44087 unsigned long addr;
44088 unsigned long end;
44089
44090 - end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
44091 + end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
44092
44093 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
44094 struct page *page;
44095 @@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump
44096 page = get_dump_page(addr);
44097 if (page) {
44098 void *kaddr = kmap(page);
44099 + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
44100 stop = ((size += PAGE_SIZE) > cprm->limit) ||
44101 !dump_write(cprm->file, kaddr,
44102 PAGE_SIZE);
44103 @@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump
44104
44105 if (e_phnum == PN_XNUM) {
44106 size += sizeof(*shdr4extnum);
44107 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
44108 if (size > cprm->limit
44109 || !dump_write(cprm->file, shdr4extnum,
44110 sizeof(*shdr4extnum)))
44111 @@ -2067,6 +2380,97 @@ out:
44112
44113 #endif /* CONFIG_ELF_CORE */
44114
44115 +#ifdef CONFIG_PAX_MPROTECT
44116 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
44117 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
44118 + * we'll remove VM_MAYWRITE for good on RELRO segments.
44119 + *
44120 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
44121 + * basis because we want to allow the common case and not the special ones.
44122 + */
44123 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
44124 +{
44125 + struct elfhdr elf_h;
44126 + struct elf_phdr elf_p;
44127 + unsigned long i;
44128 + unsigned long oldflags;
44129 + bool is_textrel_rw, is_textrel_rx, is_relro;
44130 +
44131 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
44132 + return;
44133 +
44134 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
44135 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
44136 +
44137 +#ifdef CONFIG_PAX_ELFRELOCS
44138 + /* possible TEXTREL */
44139 + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
44140 + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
44141 +#else
44142 + is_textrel_rw = false;
44143 + is_textrel_rx = false;
44144 +#endif
44145 +
44146 + /* possible RELRO */
44147 + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
44148 +
44149 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
44150 + return;
44151 +
44152 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
44153 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
44154 +
44155 +#ifdef CONFIG_PAX_ETEXECRELOCS
44156 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44157 +#else
44158 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
44159 +#endif
44160 +
44161 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44162 + !elf_check_arch(&elf_h) ||
44163 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
44164 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
44165 + return;
44166 +
44167 + for (i = 0UL; i < elf_h.e_phnum; i++) {
44168 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
44169 + return;
44170 + switch (elf_p.p_type) {
44171 + case PT_DYNAMIC:
44172 + if (!is_textrel_rw && !is_textrel_rx)
44173 + continue;
44174 + i = 0UL;
44175 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
44176 + elf_dyn dyn;
44177 +
44178 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
44179 + return;
44180 + if (dyn.d_tag == DT_NULL)
44181 + return;
44182 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
44183 + gr_log_textrel(vma);
44184 + if (is_textrel_rw)
44185 + vma->vm_flags |= VM_MAYWRITE;
44186 + else
44187 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
44188 + vma->vm_flags &= ~VM_MAYWRITE;
44189 + return;
44190 + }
44191 + i++;
44192 + }
44193 + return;
44194 +
44195 + case PT_GNU_RELRO:
44196 + if (!is_relro)
44197 + continue;
44198 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
44199 + vma->vm_flags &= ~VM_MAYWRITE;
44200 + return;
44201 + }
44202 + }
44203 +}
44204 +#endif
44205 +
44206 static int __init init_elf_binfmt(void)
44207 {
44208 return register_binfmt(&elf_format);
44209 diff -urNp linux-2.6.39.1/fs/binfmt_flat.c linux-2.6.39.1/fs/binfmt_flat.c
44210 --- linux-2.6.39.1/fs/binfmt_flat.c 2011-05-19 00:06:34.000000000 -0400
44211 +++ linux-2.6.39.1/fs/binfmt_flat.c 2011-05-22 19:36:32.000000000 -0400
44212 @@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
44213 realdatastart = (unsigned long) -ENOMEM;
44214 printk("Unable to allocate RAM for process data, errno %d\n",
44215 (int)-realdatastart);
44216 + down_write(&current->mm->mmap_sem);
44217 do_munmap(current->mm, textpos, text_len);
44218 + up_write(&current->mm->mmap_sem);
44219 ret = realdatastart;
44220 goto err;
44221 }
44222 @@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b
44223 }
44224 if (IS_ERR_VALUE(result)) {
44225 printk("Unable to read data+bss, errno %d\n", (int)-result);
44226 + down_write(&current->mm->mmap_sem);
44227 do_munmap(current->mm, textpos, text_len);
44228 do_munmap(current->mm, realdatastart, len);
44229 + up_write(&current->mm->mmap_sem);
44230 ret = result;
44231 goto err;
44232 }
44233 @@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b
44234 }
44235 if (IS_ERR_VALUE(result)) {
44236 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
44237 + down_write(&current->mm->mmap_sem);
44238 do_munmap(current->mm, textpos, text_len + data_len + extra +
44239 MAX_SHARED_LIBS * sizeof(unsigned long));
44240 + up_write(&current->mm->mmap_sem);
44241 ret = result;
44242 goto err;
44243 }
44244 diff -urNp linux-2.6.39.1/fs/bio.c linux-2.6.39.1/fs/bio.c
44245 --- linux-2.6.39.1/fs/bio.c 2011-05-19 00:06:34.000000000 -0400
44246 +++ linux-2.6.39.1/fs/bio.c 2011-05-22 19:36:32.000000000 -0400
44247 @@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
44248 const int read = bio_data_dir(bio) == READ;
44249 struct bio_map_data *bmd = bio->bi_private;
44250 int i;
44251 - char *p = bmd->sgvecs[0].iov_base;
44252 + char *p = (__force char *)bmd->sgvecs[0].iov_base;
44253
44254 __bio_for_each_segment(bvec, bio, i, 0) {
44255 char *addr = page_address(bvec->bv_page);
44256 diff -urNp linux-2.6.39.1/fs/block_dev.c linux-2.6.39.1/fs/block_dev.c
44257 --- linux-2.6.39.1/fs/block_dev.c 2011-06-03 00:04:14.000000000 -0400
44258 +++ linux-2.6.39.1/fs/block_dev.c 2011-06-06 19:57:05.000000000 -0400
44259 @@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de
44260 else if (bdev->bd_contains == bdev)
44261 return true; /* is a whole device which isn't held */
44262
44263 - else if (whole->bd_holder == bd_may_claim)
44264 + else if (whole->bd_holder == (void *)bd_may_claim)
44265 return true; /* is a partition of a device that is being partitioned */
44266 else if (whole->bd_holder != NULL)
44267 return false; /* is a partition of a held device */
44268 @@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev
44269 * individual writeable reference is too fragile given the
44270 * way @mode is used in blkdev_get/put().
44271 */
44272 - if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) &&
44273 - !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) {
44274 + if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder &&
44275 + (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) {
44276 bdev->bd_write_holder = true;
44277 disk_block_events(disk);
44278 }
44279 diff -urNp linux-2.6.39.1/fs/btrfs/compression.c linux-2.6.39.1/fs/btrfs/compression.c
44280 --- linux-2.6.39.1/fs/btrfs/compression.c 2011-05-19 00:06:34.000000000 -0400
44281 +++ linux-2.6.39.1/fs/btrfs/compression.c 2011-05-22 19:36:32.000000000 -0400
44282 @@ -719,7 +719,7 @@ static int comp_num_workspace[BTRFS_COMP
44283 static atomic_t comp_alloc_workspace[BTRFS_COMPRESS_TYPES];
44284 static wait_queue_head_t comp_workspace_wait[BTRFS_COMPRESS_TYPES];
44285
44286 -struct btrfs_compress_op *btrfs_compress_op[] = {
44287 +const struct btrfs_compress_op *btrfs_compress_op[] = {
44288 &btrfs_zlib_compress,
44289 &btrfs_lzo_compress,
44290 };
44291 diff -urNp linux-2.6.39.1/fs/btrfs/compression.h linux-2.6.39.1/fs/btrfs/compression.h
44292 --- linux-2.6.39.1/fs/btrfs/compression.h 2011-05-19 00:06:34.000000000 -0400
44293 +++ linux-2.6.39.1/fs/btrfs/compression.h 2011-05-22 19:36:32.000000000 -0400
44294 @@ -77,7 +77,7 @@ struct btrfs_compress_op {
44295 size_t srclen, size_t destlen);
44296 };
44297
44298 -extern struct btrfs_compress_op btrfs_zlib_compress;
44299 -extern struct btrfs_compress_op btrfs_lzo_compress;
44300 +extern const struct btrfs_compress_op btrfs_zlib_compress;
44301 +extern const struct btrfs_compress_op btrfs_lzo_compress;
44302
44303 #endif
44304 diff -urNp linux-2.6.39.1/fs/btrfs/ctree.c linux-2.6.39.1/fs/btrfs/ctree.c
44305 --- linux-2.6.39.1/fs/btrfs/ctree.c 2011-05-19 00:06:34.000000000 -0400
44306 +++ linux-2.6.39.1/fs/btrfs/ctree.c 2011-05-22 19:36:32.000000000 -0400
44307 @@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
44308 free_extent_buffer(buf);
44309 add_root_to_dirty_list(root);
44310 } else {
44311 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
44312 - parent_start = parent->start;
44313 - else
44314 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
44315 + if (parent)
44316 + parent_start = parent->start;
44317 + else
44318 + parent_start = 0;
44319 + } else
44320 parent_start = 0;
44321
44322 WARN_ON(trans->transid != btrfs_header_generation(parent));
44323 @@ -3647,7 +3650,6 @@ setup_items_for_insert(struct btrfs_tran
44324
44325 ret = 0;
44326 if (slot == 0) {
44327 - struct btrfs_disk_key disk_key;
44328 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
44329 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
44330 }
44331 diff -urNp linux-2.6.39.1/fs/btrfs/disk-io.c linux-2.6.39.1/fs/btrfs/disk-io.c
44332 --- linux-2.6.39.1/fs/btrfs/disk-io.c 2011-05-19 00:06:34.000000000 -0400
44333 +++ linux-2.6.39.1/fs/btrfs/disk-io.c 2011-05-22 19:36:32.000000000 -0400
44334 @@ -42,7 +42,7 @@
44335 #include "tree-log.h"
44336 #include "free-space-cache.h"
44337
44338 -static struct extent_io_ops btree_extent_io_ops;
44339 +static const struct extent_io_ops btree_extent_io_ops;
44340 static void end_workqueue_fn(struct btrfs_work *work);
44341 static void free_fs_root(struct btrfs_root *root);
44342 static void btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
44343 @@ -3070,7 +3070,7 @@ static int btrfs_cleanup_transaction(str
44344 return 0;
44345 }
44346
44347 -static struct extent_io_ops btree_extent_io_ops = {
44348 +static const struct extent_io_ops btree_extent_io_ops = {
44349 .write_cache_pages_lock_hook = btree_lock_page_hook,
44350 .readpage_end_io_hook = btree_readpage_end_io_hook,
44351 .submit_bio_hook = btree_submit_bio_hook,
44352 diff -urNp linux-2.6.39.1/fs/btrfs/extent_io.h linux-2.6.39.1/fs/btrfs/extent_io.h
44353 --- linux-2.6.39.1/fs/btrfs/extent_io.h 2011-05-19 00:06:34.000000000 -0400
44354 +++ linux-2.6.39.1/fs/btrfs/extent_io.h 2011-05-22 19:36:32.000000000 -0400
44355 @@ -56,36 +56,36 @@ typedef int (extent_submit_bio_hook_t)(s
44356 struct bio *bio, int mirror_num,
44357 unsigned long bio_flags, u64 bio_offset);
44358 struct extent_io_ops {
44359 - int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
44360 + int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
44361 u64 start, u64 end, int *page_started,
44362 unsigned long *nr_written);
44363 - int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
44364 - int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
44365 + int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
44366 + int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
44367 extent_submit_bio_hook_t *submit_bio_hook;
44368 - int (*merge_bio_hook)(struct page *page, unsigned long offset,
44369 + int (* const merge_bio_hook)(struct page *page, unsigned long offset,
44370 size_t size, struct bio *bio,
44371 unsigned long bio_flags);
44372 - int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
44373 - int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
44374 + int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
44375 + int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
44376 u64 start, u64 end,
44377 struct extent_state *state);
44378 - int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
44379 + int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
44380 u64 start, u64 end,
44381 struct extent_state *state);
44382 - int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44383 + int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44384 struct extent_state *state);
44385 - int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44386 + int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44387 struct extent_state *state, int uptodate);
44388 - int (*set_bit_hook)(struct inode *inode, struct extent_state *state,
44389 + int (* const set_bit_hook)(struct inode *inode, struct extent_state *state,
44390 int *bits);
44391 - int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
44392 + int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
44393 int *bits);
44394 - int (*merge_extent_hook)(struct inode *inode,
44395 + int (* const merge_extent_hook)(struct inode *inode,
44396 struct extent_state *new,
44397 struct extent_state *other);
44398 - int (*split_extent_hook)(struct inode *inode,
44399 + int (* const split_extent_hook)(struct inode *inode,
44400 struct extent_state *orig, u64 split);
44401 - int (*write_cache_pages_lock_hook)(struct page *page);
44402 + int (* const write_cache_pages_lock_hook)(struct page *page);
44403 };
44404
44405 struct extent_io_tree {
44406 @@ -95,7 +95,7 @@ struct extent_io_tree {
44407 u64 dirty_bytes;
44408 spinlock_t lock;
44409 spinlock_t buffer_lock;
44410 - struct extent_io_ops *ops;
44411 + const struct extent_io_ops *ops;
44412 };
44413
44414 struct extent_state {
44415 diff -urNp linux-2.6.39.1/fs/btrfs/free-space-cache.c linux-2.6.39.1/fs/btrfs/free-space-cache.c
44416 --- linux-2.6.39.1/fs/btrfs/free-space-cache.c 2011-05-19 00:06:34.000000000 -0400
44417 +++ linux-2.6.39.1/fs/btrfs/free-space-cache.c 2011-05-22 19:36:32.000000000 -0400
44418 @@ -1910,8 +1910,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44419 while(1) {
44420 if (entry->bytes < bytes ||
44421 (!entry->bitmap && entry->offset < min_start)) {
44422 - struct rb_node *node;
44423 -
44424 node = rb_next(&entry->offset_index);
44425 if (!node)
44426 break;
44427 @@ -1925,7 +1923,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44428 cluster, entry, bytes,
44429 min_start);
44430 if (ret == 0) {
44431 - struct rb_node *node;
44432 node = rb_next(&entry->offset_index);
44433 if (!node)
44434 break;
44435 diff -urNp linux-2.6.39.1/fs/btrfs/inode.c linux-2.6.39.1/fs/btrfs/inode.c
44436 --- linux-2.6.39.1/fs/btrfs/inode.c 2011-05-19 00:06:34.000000000 -0400
44437 +++ linux-2.6.39.1/fs/btrfs/inode.c 2011-05-22 20:42:42.000000000 -0400
44438 @@ -65,7 +65,7 @@ static const struct inode_operations btr
44439 static const struct address_space_operations btrfs_aops;
44440 static const struct address_space_operations btrfs_symlink_aops;
44441 static const struct file_operations btrfs_dir_file_operations;
44442 -static struct extent_io_ops btrfs_extent_io_ops;
44443 +static const struct extent_io_ops btrfs_extent_io_ops;
44444
44445 static struct kmem_cache *btrfs_inode_cachep;
44446 struct kmem_cache *btrfs_trans_handle_cachep;
44447 @@ -6947,7 +6947,7 @@ fail:
44448 return -ENOMEM;
44449 }
44450
44451 -static int btrfs_getattr(struct vfsmount *mnt,
44452 +int btrfs_getattr(struct vfsmount *mnt,
44453 struct dentry *dentry, struct kstat *stat)
44454 {
44455 struct inode *inode = dentry->d_inode;
44456 @@ -6959,6 +6959,14 @@ static int btrfs_getattr(struct vfsmount
44457 return 0;
44458 }
44459
44460 +EXPORT_SYMBOL(btrfs_getattr);
44461 +
44462 +dev_t get_btrfs_dev_from_inode(struct inode *inode)
44463 +{
44464 + return BTRFS_I(inode)->root->anon_super.s_dev;
44465 +}
44466 +EXPORT_SYMBOL(get_btrfs_dev_from_inode);
44467 +
44468 /*
44469 * If a file is moved, it will inherit the cow and compression flags of the new
44470 * directory.
44471 @@ -7488,7 +7496,7 @@ static const struct file_operations btrf
44472 .fsync = btrfs_sync_file,
44473 };
44474
44475 -static struct extent_io_ops btrfs_extent_io_ops = {
44476 +static const struct extent_io_ops btrfs_extent_io_ops = {
44477 .fill_delalloc = run_delalloc_range,
44478 .submit_bio_hook = btrfs_submit_bio_hook,
44479 .merge_bio_hook = btrfs_merge_bio_hook,
44480 diff -urNp linux-2.6.39.1/fs/btrfs/ioctl.c linux-2.6.39.1/fs/btrfs/ioctl.c
44481 --- linux-2.6.39.1/fs/btrfs/ioctl.c 2011-05-19 00:06:34.000000000 -0400
44482 +++ linux-2.6.39.1/fs/btrfs/ioctl.c 2011-05-22 19:41:37.000000000 -0400
44483 @@ -2361,9 +2361,12 @@ long btrfs_ioctl_space_info(struct btrfs
44484 for (i = 0; i < num_types; i++) {
44485 struct btrfs_space_info *tmp;
44486
44487 + /* Don't copy in more than we allocated */
44488 if (!slot_count)
44489 break;
44490
44491 + slot_count--;
44492 +
44493 info = NULL;
44494 rcu_read_lock();
44495 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
44496 @@ -2385,10 +2388,7 @@ long btrfs_ioctl_space_info(struct btrfs
44497 memcpy(dest, &space, sizeof(space));
44498 dest++;
44499 space_args.total_spaces++;
44500 - slot_count--;
44501 }
44502 - if (!slot_count)
44503 - break;
44504 }
44505 up_read(&info->groups_sem);
44506 }
44507 diff -urNp linux-2.6.39.1/fs/btrfs/lzo.c linux-2.6.39.1/fs/btrfs/lzo.c
44508 --- linux-2.6.39.1/fs/btrfs/lzo.c 2011-05-19 00:06:34.000000000 -0400
44509 +++ linux-2.6.39.1/fs/btrfs/lzo.c 2011-05-22 19:36:32.000000000 -0400
44510 @@ -418,7 +418,7 @@ out:
44511 return ret;
44512 }
44513
44514 -struct btrfs_compress_op btrfs_lzo_compress = {
44515 +const struct btrfs_compress_op btrfs_lzo_compress = {
44516 .alloc_workspace = lzo_alloc_workspace,
44517 .free_workspace = lzo_free_workspace,
44518 .compress_pages = lzo_compress_pages,
44519 diff -urNp linux-2.6.39.1/fs/btrfs/relocation.c linux-2.6.39.1/fs/btrfs/relocation.c
44520 --- linux-2.6.39.1/fs/btrfs/relocation.c 2011-05-19 00:06:34.000000000 -0400
44521 +++ linux-2.6.39.1/fs/btrfs/relocation.c 2011-05-22 19:36:32.000000000 -0400
44522 @@ -1239,7 +1239,7 @@ static int __update_reloc_root(struct bt
44523 }
44524 spin_unlock(&rc->reloc_root_tree.lock);
44525
44526 - BUG_ON((struct btrfs_root *)node->data != root);
44527 + BUG_ON(!node || (struct btrfs_root *)node->data != root);
44528
44529 if (!del) {
44530 spin_lock(&rc->reloc_root_tree.lock);
44531 diff -urNp linux-2.6.39.1/fs/btrfs/zlib.c linux-2.6.39.1/fs/btrfs/zlib.c
44532 --- linux-2.6.39.1/fs/btrfs/zlib.c 2011-05-19 00:06:34.000000000 -0400
44533 +++ linux-2.6.39.1/fs/btrfs/zlib.c 2011-05-22 19:36:32.000000000 -0400
44534 @@ -390,7 +390,7 @@ next:
44535 return ret;
44536 }
44537
44538 -struct btrfs_compress_op btrfs_zlib_compress = {
44539 +const struct btrfs_compress_op btrfs_zlib_compress = {
44540 .alloc_workspace = zlib_alloc_workspace,
44541 .free_workspace = zlib_free_workspace,
44542 .compress_pages = zlib_compress_pages,
44543 diff -urNp linux-2.6.39.1/fs/cachefiles/bind.c linux-2.6.39.1/fs/cachefiles/bind.c
44544 --- linux-2.6.39.1/fs/cachefiles/bind.c 2011-05-19 00:06:34.000000000 -0400
44545 +++ linux-2.6.39.1/fs/cachefiles/bind.c 2011-05-22 19:36:32.000000000 -0400
44546 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
44547 args);
44548
44549 /* start by checking things over */
44550 - ASSERT(cache->fstop_percent >= 0 &&
44551 - cache->fstop_percent < cache->fcull_percent &&
44552 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
44553 cache->fcull_percent < cache->frun_percent &&
44554 cache->frun_percent < 100);
44555
44556 - ASSERT(cache->bstop_percent >= 0 &&
44557 - cache->bstop_percent < cache->bcull_percent &&
44558 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
44559 cache->bcull_percent < cache->brun_percent &&
44560 cache->brun_percent < 100);
44561
44562 diff -urNp linux-2.6.39.1/fs/cachefiles/daemon.c linux-2.6.39.1/fs/cachefiles/daemon.c
44563 --- linux-2.6.39.1/fs/cachefiles/daemon.c 2011-05-19 00:06:34.000000000 -0400
44564 +++ linux-2.6.39.1/fs/cachefiles/daemon.c 2011-05-22 19:36:32.000000000 -0400
44565 @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
44566 if (n > buflen)
44567 return -EMSGSIZE;
44568
44569 - if (copy_to_user(_buffer, buffer, n) != 0)
44570 + if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
44571 return -EFAULT;
44572
44573 return n;
44574 @@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s
44575 if (test_bit(CACHEFILES_DEAD, &cache->flags))
44576 return -EIO;
44577
44578 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
44579 + if (datalen > PAGE_SIZE - 1)
44580 return -EOPNOTSUPP;
44581
44582 /* drag the command string into the kernel so we can parse it */
44583 @@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc
44584 if (args[0] != '%' || args[1] != '\0')
44585 return -EINVAL;
44586
44587 - if (fstop < 0 || fstop >= cache->fcull_percent)
44588 + if (fstop >= cache->fcull_percent)
44589 return cachefiles_daemon_range_error(cache, args);
44590
44591 cache->fstop_percent = fstop;
44592 @@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc
44593 if (args[0] != '%' || args[1] != '\0')
44594 return -EINVAL;
44595
44596 - if (bstop < 0 || bstop >= cache->bcull_percent)
44597 + if (bstop >= cache->bcull_percent)
44598 return cachefiles_daemon_range_error(cache, args);
44599
44600 cache->bstop_percent = bstop;
44601 diff -urNp linux-2.6.39.1/fs/cachefiles/internal.h linux-2.6.39.1/fs/cachefiles/internal.h
44602 --- linux-2.6.39.1/fs/cachefiles/internal.h 2011-05-19 00:06:34.000000000 -0400
44603 +++ linux-2.6.39.1/fs/cachefiles/internal.h 2011-05-22 19:36:32.000000000 -0400
44604 @@ -57,7 +57,7 @@ struct cachefiles_cache {
44605 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
44606 struct rb_root active_nodes; /* active nodes (can't be culled) */
44607 rwlock_t active_lock; /* lock for active_nodes */
44608 - atomic_t gravecounter; /* graveyard uniquifier */
44609 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
44610 unsigned frun_percent; /* when to stop culling (% files) */
44611 unsigned fcull_percent; /* when to start culling (% files) */
44612 unsigned fstop_percent; /* when to stop allocating (% files) */
44613 @@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
44614 * proc.c
44615 */
44616 #ifdef CONFIG_CACHEFILES_HISTOGRAM
44617 -extern atomic_t cachefiles_lookup_histogram[HZ];
44618 -extern atomic_t cachefiles_mkdir_histogram[HZ];
44619 -extern atomic_t cachefiles_create_histogram[HZ];
44620 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44621 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44622 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
44623
44624 extern int __init cachefiles_proc_init(void);
44625 extern void cachefiles_proc_cleanup(void);
44626 static inline
44627 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
44628 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
44629 {
44630 unsigned long jif = jiffies - start_jif;
44631 if (jif >= HZ)
44632 jif = HZ - 1;
44633 - atomic_inc(&histogram[jif]);
44634 + atomic_inc_unchecked(&histogram[jif]);
44635 }
44636
44637 #else
44638 diff -urNp linux-2.6.39.1/fs/cachefiles/namei.c linux-2.6.39.1/fs/cachefiles/namei.c
44639 --- linux-2.6.39.1/fs/cachefiles/namei.c 2011-05-19 00:06:34.000000000 -0400
44640 +++ linux-2.6.39.1/fs/cachefiles/namei.c 2011-05-22 19:36:32.000000000 -0400
44641 @@ -318,7 +318,7 @@ try_again:
44642 /* first step is to make up a grave dentry in the graveyard */
44643 sprintf(nbuffer, "%08x%08x",
44644 (uint32_t) get_seconds(),
44645 - (uint32_t) atomic_inc_return(&cache->gravecounter));
44646 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
44647
44648 /* do the multiway lock magic */
44649 trap = lock_rename(cache->graveyard, dir);
44650 diff -urNp linux-2.6.39.1/fs/cachefiles/proc.c linux-2.6.39.1/fs/cachefiles/proc.c
44651 --- linux-2.6.39.1/fs/cachefiles/proc.c 2011-05-19 00:06:34.000000000 -0400
44652 +++ linux-2.6.39.1/fs/cachefiles/proc.c 2011-05-22 19:36:32.000000000 -0400
44653 @@ -14,9 +14,9 @@
44654 #include <linux/seq_file.h>
44655 #include "internal.h"
44656
44657 -atomic_t cachefiles_lookup_histogram[HZ];
44658 -atomic_t cachefiles_mkdir_histogram[HZ];
44659 -atomic_t cachefiles_create_histogram[HZ];
44660 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44661 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44662 +atomic_unchecked_t cachefiles_create_histogram[HZ];
44663
44664 /*
44665 * display the latency histogram
44666 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
44667 return 0;
44668 default:
44669 index = (unsigned long) v - 3;
44670 - x = atomic_read(&cachefiles_lookup_histogram[index]);
44671 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
44672 - z = atomic_read(&cachefiles_create_histogram[index]);
44673 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
44674 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
44675 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
44676 if (x == 0 && y == 0 && z == 0)
44677 return 0;
44678
44679 diff -urNp linux-2.6.39.1/fs/cachefiles/rdwr.c linux-2.6.39.1/fs/cachefiles/rdwr.c
44680 --- linux-2.6.39.1/fs/cachefiles/rdwr.c 2011-05-19 00:06:34.000000000 -0400
44681 +++ linux-2.6.39.1/fs/cachefiles/rdwr.c 2011-05-22 19:36:32.000000000 -0400
44682 @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
44683 old_fs = get_fs();
44684 set_fs(KERNEL_DS);
44685 ret = file->f_op->write(
44686 - file, (const void __user *) data, len, &pos);
44687 + file, (__force const void __user *) data, len, &pos);
44688 set_fs(old_fs);
44689 kunmap(page);
44690 if (ret != len)
44691 diff -urNp linux-2.6.39.1/fs/ceph/addr.c linux-2.6.39.1/fs/ceph/addr.c
44692 --- linux-2.6.39.1/fs/ceph/addr.c 2011-05-19 00:06:34.000000000 -0400
44693 +++ linux-2.6.39.1/fs/ceph/addr.c 2011-05-22 19:36:32.000000000 -0400
44694 @@ -1164,7 +1164,7 @@ out:
44695 return ret;
44696 }
44697
44698 -static struct vm_operations_struct ceph_vmops = {
44699 +static const struct vm_operations_struct ceph_vmops = {
44700 .fault = filemap_fault,
44701 .page_mkwrite = ceph_page_mkwrite,
44702 };
44703 diff -urNp linux-2.6.39.1/fs/ceph/dir.c linux-2.6.39.1/fs/ceph/dir.c
44704 --- linux-2.6.39.1/fs/ceph/dir.c 2011-05-19 00:06:34.000000000 -0400
44705 +++ linux-2.6.39.1/fs/ceph/dir.c 2011-05-22 19:36:32.000000000 -0400
44706 @@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
44707 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
44708 struct ceph_mds_client *mdsc = fsc->mdsc;
44709 unsigned frag = fpos_frag(filp->f_pos);
44710 - int off = fpos_off(filp->f_pos);
44711 + unsigned int off = fpos_off(filp->f_pos);
44712 int err;
44713 u32 ftype;
44714 struct ceph_mds_reply_info_parsed *rinfo;
44715 @@ -360,7 +360,7 @@ more:
44716 rinfo = &fi->last_readdir->r_reply_info;
44717 dout("readdir frag %x num %d off %d chunkoff %d\n", frag,
44718 rinfo->dir_nr, off, fi->offset);
44719 - while (off - fi->offset >= 0 && off - fi->offset < rinfo->dir_nr) {
44720 + while (off >= fi->offset && off - fi->offset < rinfo->dir_nr) {
44721 u64 pos = ceph_make_fpos(frag, off);
44722 struct ceph_mds_reply_inode *in =
44723 rinfo->dir_in[off - fi->offset].in;
44724 diff -urNp linux-2.6.39.1/fs/cifs/cifs_debug.c linux-2.6.39.1/fs/cifs/cifs_debug.c
44725 --- linux-2.6.39.1/fs/cifs/cifs_debug.c 2011-05-19 00:06:34.000000000 -0400
44726 +++ linux-2.6.39.1/fs/cifs/cifs_debug.c 2011-05-22 19:36:32.000000000 -0400
44727 @@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
44728 tcon = list_entry(tmp3,
44729 struct cifsTconInfo,
44730 tcon_list);
44731 - atomic_set(&tcon->num_smbs_sent, 0);
44732 - atomic_set(&tcon->num_writes, 0);
44733 - atomic_set(&tcon->num_reads, 0);
44734 - atomic_set(&tcon->num_oplock_brks, 0);
44735 - atomic_set(&tcon->num_opens, 0);
44736 - atomic_set(&tcon->num_posixopens, 0);
44737 - atomic_set(&tcon->num_posixmkdirs, 0);
44738 - atomic_set(&tcon->num_closes, 0);
44739 - atomic_set(&tcon->num_deletes, 0);
44740 - atomic_set(&tcon->num_mkdirs, 0);
44741 - atomic_set(&tcon->num_rmdirs, 0);
44742 - atomic_set(&tcon->num_renames, 0);
44743 - atomic_set(&tcon->num_t2renames, 0);
44744 - atomic_set(&tcon->num_ffirst, 0);
44745 - atomic_set(&tcon->num_fnext, 0);
44746 - atomic_set(&tcon->num_fclose, 0);
44747 - atomic_set(&tcon->num_hardlinks, 0);
44748 - atomic_set(&tcon->num_symlinks, 0);
44749 - atomic_set(&tcon->num_locks, 0);
44750 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
44751 + atomic_set_unchecked(&tcon->num_writes, 0);
44752 + atomic_set_unchecked(&tcon->num_reads, 0);
44753 + atomic_set_unchecked(&tcon->num_oplock_brks, 0);
44754 + atomic_set_unchecked(&tcon->num_opens, 0);
44755 + atomic_set_unchecked(&tcon->num_posixopens, 0);
44756 + atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
44757 + atomic_set_unchecked(&tcon->num_closes, 0);
44758 + atomic_set_unchecked(&tcon->num_deletes, 0);
44759 + atomic_set_unchecked(&tcon->num_mkdirs, 0);
44760 + atomic_set_unchecked(&tcon->num_rmdirs, 0);
44761 + atomic_set_unchecked(&tcon->num_renames, 0);
44762 + atomic_set_unchecked(&tcon->num_t2renames, 0);
44763 + atomic_set_unchecked(&tcon->num_ffirst, 0);
44764 + atomic_set_unchecked(&tcon->num_fnext, 0);
44765 + atomic_set_unchecked(&tcon->num_fclose, 0);
44766 + atomic_set_unchecked(&tcon->num_hardlinks, 0);
44767 + atomic_set_unchecked(&tcon->num_symlinks, 0);
44768 + atomic_set_unchecked(&tcon->num_locks, 0);
44769 }
44770 }
44771 }
44772 @@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
44773 if (tcon->need_reconnect)
44774 seq_puts(m, "\tDISCONNECTED ");
44775 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
44776 - atomic_read(&tcon->num_smbs_sent),
44777 - atomic_read(&tcon->num_oplock_brks));
44778 + atomic_read_unchecked(&tcon->num_smbs_sent),
44779 + atomic_read_unchecked(&tcon->num_oplock_brks));
44780 seq_printf(m, "\nReads: %d Bytes: %lld",
44781 - atomic_read(&tcon->num_reads),
44782 + atomic_read_unchecked(&tcon->num_reads),
44783 (long long)(tcon->bytes_read));
44784 seq_printf(m, "\nWrites: %d Bytes: %lld",
44785 - atomic_read(&tcon->num_writes),
44786 + atomic_read_unchecked(&tcon->num_writes),
44787 (long long)(tcon->bytes_written));
44788 seq_printf(m, "\nFlushes: %d",
44789 - atomic_read(&tcon->num_flushes));
44790 + atomic_read_unchecked(&tcon->num_flushes));
44791 seq_printf(m, "\nLocks: %d HardLinks: %d "
44792 "Symlinks: %d",
44793 - atomic_read(&tcon->num_locks),
44794 - atomic_read(&tcon->num_hardlinks),
44795 - atomic_read(&tcon->num_symlinks));
44796 + atomic_read_unchecked(&tcon->num_locks),
44797 + atomic_read_unchecked(&tcon->num_hardlinks),
44798 + atomic_read_unchecked(&tcon->num_symlinks));
44799 seq_printf(m, "\nOpens: %d Closes: %d "
44800 "Deletes: %d",
44801 - atomic_read(&tcon->num_opens),
44802 - atomic_read(&tcon->num_closes),
44803 - atomic_read(&tcon->num_deletes));
44804 + atomic_read_unchecked(&tcon->num_opens),
44805 + atomic_read_unchecked(&tcon->num_closes),
44806 + atomic_read_unchecked(&tcon->num_deletes));
44807 seq_printf(m, "\nPosix Opens: %d "
44808 "Posix Mkdirs: %d",
44809 - atomic_read(&tcon->num_posixopens),
44810 - atomic_read(&tcon->num_posixmkdirs));
44811 + atomic_read_unchecked(&tcon->num_posixopens),
44812 + atomic_read_unchecked(&tcon->num_posixmkdirs));
44813 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
44814 - atomic_read(&tcon->num_mkdirs),
44815 - atomic_read(&tcon->num_rmdirs));
44816 + atomic_read_unchecked(&tcon->num_mkdirs),
44817 + atomic_read_unchecked(&tcon->num_rmdirs));
44818 seq_printf(m, "\nRenames: %d T2 Renames %d",
44819 - atomic_read(&tcon->num_renames),
44820 - atomic_read(&tcon->num_t2renames));
44821 + atomic_read_unchecked(&tcon->num_renames),
44822 + atomic_read_unchecked(&tcon->num_t2renames));
44823 seq_printf(m, "\nFindFirst: %d FNext %d "
44824 "FClose %d",
44825 - atomic_read(&tcon->num_ffirst),
44826 - atomic_read(&tcon->num_fnext),
44827 - atomic_read(&tcon->num_fclose));
44828 + atomic_read_unchecked(&tcon->num_ffirst),
44829 + atomic_read_unchecked(&tcon->num_fnext),
44830 + atomic_read_unchecked(&tcon->num_fclose));
44831 }
44832 }
44833 }
44834 diff -urNp linux-2.6.39.1/fs/cifs/cifsglob.h linux-2.6.39.1/fs/cifs/cifsglob.h
44835 --- linux-2.6.39.1/fs/cifs/cifsglob.h 2011-05-19 00:06:34.000000000 -0400
44836 +++ linux-2.6.39.1/fs/cifs/cifsglob.h 2011-05-22 19:36:32.000000000 -0400
44837 @@ -305,28 +305,28 @@ struct cifsTconInfo {
44838 __u16 Flags; /* optional support bits */
44839 enum statusEnum tidStatus;
44840 #ifdef CONFIG_CIFS_STATS
44841 - atomic_t num_smbs_sent;
44842 - atomic_t num_writes;
44843 - atomic_t num_reads;
44844 - atomic_t num_flushes;
44845 - atomic_t num_oplock_brks;
44846 - atomic_t num_opens;
44847 - atomic_t num_closes;
44848 - atomic_t num_deletes;
44849 - atomic_t num_mkdirs;
44850 - atomic_t num_posixopens;
44851 - atomic_t num_posixmkdirs;
44852 - atomic_t num_rmdirs;
44853 - atomic_t num_renames;
44854 - atomic_t num_t2renames;
44855 - atomic_t num_ffirst;
44856 - atomic_t num_fnext;
44857 - atomic_t num_fclose;
44858 - atomic_t num_hardlinks;
44859 - atomic_t num_symlinks;
44860 - atomic_t num_locks;
44861 - atomic_t num_acl_get;
44862 - atomic_t num_acl_set;
44863 + atomic_unchecked_t num_smbs_sent;
44864 + atomic_unchecked_t num_writes;
44865 + atomic_unchecked_t num_reads;
44866 + atomic_unchecked_t num_flushes;
44867 + atomic_unchecked_t num_oplock_brks;
44868 + atomic_unchecked_t num_opens;
44869 + atomic_unchecked_t num_closes;
44870 + atomic_unchecked_t num_deletes;
44871 + atomic_unchecked_t num_mkdirs;
44872 + atomic_unchecked_t num_posixopens;
44873 + atomic_unchecked_t num_posixmkdirs;
44874 + atomic_unchecked_t num_rmdirs;
44875 + atomic_unchecked_t num_renames;
44876 + atomic_unchecked_t num_t2renames;
44877 + atomic_unchecked_t num_ffirst;
44878 + atomic_unchecked_t num_fnext;
44879 + atomic_unchecked_t num_fclose;
44880 + atomic_unchecked_t num_hardlinks;
44881 + atomic_unchecked_t num_symlinks;
44882 + atomic_unchecked_t num_locks;
44883 + atomic_unchecked_t num_acl_get;
44884 + atomic_unchecked_t num_acl_set;
44885 #ifdef CONFIG_CIFS_STATS2
44886 unsigned long long time_writes;
44887 unsigned long long time_reads;
44888 @@ -509,7 +509,7 @@ static inline char CIFS_DIR_SEP(const st
44889 }
44890
44891 #ifdef CONFIG_CIFS_STATS
44892 -#define cifs_stats_inc atomic_inc
44893 +#define cifs_stats_inc atomic_inc_unchecked
44894
44895 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
44896 unsigned int bytes)
44897 diff -urNp linux-2.6.39.1/fs/cifs/link.c linux-2.6.39.1/fs/cifs/link.c
44898 --- linux-2.6.39.1/fs/cifs/link.c 2011-05-19 00:06:34.000000000 -0400
44899 +++ linux-2.6.39.1/fs/cifs/link.c 2011-05-22 19:36:32.000000000 -0400
44900 @@ -577,7 +577,7 @@ symlink_exit:
44901
44902 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
44903 {
44904 - char *p = nd_get_link(nd);
44905 + const char *p = nd_get_link(nd);
44906 if (!IS_ERR(p))
44907 kfree(p);
44908 }
44909 diff -urNp linux-2.6.39.1/fs/coda/cache.c linux-2.6.39.1/fs/coda/cache.c
44910 --- linux-2.6.39.1/fs/coda/cache.c 2011-05-19 00:06:34.000000000 -0400
44911 +++ linux-2.6.39.1/fs/coda/cache.c 2011-05-22 19:36:32.000000000 -0400
44912 @@ -24,7 +24,7 @@
44913 #include "coda_linux.h"
44914 #include "coda_cache.h"
44915
44916 -static atomic_t permission_epoch = ATOMIC_INIT(0);
44917 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
44918
44919 /* replace or extend an acl cache hit */
44920 void coda_cache_enter(struct inode *inode, int mask)
44921 @@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
44922 struct coda_inode_info *cii = ITOC(inode);
44923
44924 spin_lock(&cii->c_lock);
44925 - cii->c_cached_epoch = atomic_read(&permission_epoch);
44926 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
44927 if (cii->c_uid != current_fsuid()) {
44928 cii->c_uid = current_fsuid();
44929 cii->c_cached_perm = mask;
44930 @@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
44931 {
44932 struct coda_inode_info *cii = ITOC(inode);
44933 spin_lock(&cii->c_lock);
44934 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
44935 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
44936 spin_unlock(&cii->c_lock);
44937 }
44938
44939 /* remove all acl caches */
44940 void coda_cache_clear_all(struct super_block *sb)
44941 {
44942 - atomic_inc(&permission_epoch);
44943 + atomic_inc_unchecked(&permission_epoch);
44944 }
44945
44946
44947 @@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
44948 spin_lock(&cii->c_lock);
44949 hit = (mask & cii->c_cached_perm) == mask &&
44950 cii->c_uid == current_fsuid() &&
44951 - cii->c_cached_epoch == atomic_read(&permission_epoch);
44952 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
44953 spin_unlock(&cii->c_lock);
44954
44955 return hit;
44956 diff -urNp linux-2.6.39.1/fs/compat_binfmt_elf.c linux-2.6.39.1/fs/compat_binfmt_elf.c
44957 --- linux-2.6.39.1/fs/compat_binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
44958 +++ linux-2.6.39.1/fs/compat_binfmt_elf.c 2011-05-22 19:36:32.000000000 -0400
44959 @@ -30,11 +30,13 @@
44960 #undef elf_phdr
44961 #undef elf_shdr
44962 #undef elf_note
44963 +#undef elf_dyn
44964 #undef elf_addr_t
44965 #define elfhdr elf32_hdr
44966 #define elf_phdr elf32_phdr
44967 #define elf_shdr elf32_shdr
44968 #define elf_note elf32_note
44969 +#define elf_dyn Elf32_Dyn
44970 #define elf_addr_t Elf32_Addr
44971
44972 /*
44973 diff -urNp linux-2.6.39.1/fs/compat.c linux-2.6.39.1/fs/compat.c
44974 --- linux-2.6.39.1/fs/compat.c 2011-05-19 00:06:34.000000000 -0400
44975 +++ linux-2.6.39.1/fs/compat.c 2011-05-22 19:41:37.000000000 -0400
44976 @@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int
44977 goto out;
44978
44979 ret = -EINVAL;
44980 - if (nr_segs > UIO_MAXIOV || nr_segs < 0)
44981 + if (nr_segs > UIO_MAXIOV)
44982 goto out;
44983 if (nr_segs > fast_segs) {
44984 ret = -ENOMEM;
44985 @@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
44986
44987 struct compat_readdir_callback {
44988 struct compat_old_linux_dirent __user *dirent;
44989 + struct file * file;
44990 int result;
44991 };
44992
44993 @@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf
44994 buf->result = -EOVERFLOW;
44995 return -EOVERFLOW;
44996 }
44997 +
44998 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44999 + return 0;
45000 +
45001 buf->result++;
45002 dirent = buf->dirent;
45003 if (!access_ok(VERIFY_WRITE, dirent,
45004 @@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u
45005
45006 buf.result = 0;
45007 buf.dirent = dirent;
45008 + buf.file = file;
45009
45010 error = vfs_readdir(file, compat_fillonedir, &buf);
45011 if (buf.result)
45012 @@ -917,6 +923,7 @@ struct compat_linux_dirent {
45013 struct compat_getdents_callback {
45014 struct compat_linux_dirent __user *current_dir;
45015 struct compat_linux_dirent __user *previous;
45016 + struct file * file;
45017 int count;
45018 int error;
45019 };
45020 @@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c
45021 buf->error = -EOVERFLOW;
45022 return -EOVERFLOW;
45023 }
45024 +
45025 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45026 + return 0;
45027 +
45028 dirent = buf->previous;
45029 if (dirent) {
45030 if (__put_user(offset, &dirent->d_off))
45031 @@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi
45032 buf.previous = NULL;
45033 buf.count = count;
45034 buf.error = 0;
45035 + buf.file = file;
45036
45037 error = vfs_readdir(file, compat_filldir, &buf);
45038 if (error >= 0)
45039 @@ -1006,6 +1018,7 @@ out:
45040 struct compat_getdents_callback64 {
45041 struct linux_dirent64 __user *current_dir;
45042 struct linux_dirent64 __user *previous;
45043 + struct file * file;
45044 int count;
45045 int error;
45046 };
45047 @@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf
45048 buf->error = -EINVAL; /* only used if we fail.. */
45049 if (reclen > buf->count)
45050 return -EINVAL;
45051 +
45052 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45053 + return 0;
45054 +
45055 dirent = buf->previous;
45056
45057 if (dirent) {
45058 @@ -1073,6 +1090,7 @@ asmlinkage long compat_sys_getdents64(un
45059 buf.previous = NULL;
45060 buf.count = count;
45061 buf.error = 0;
45062 + buf.file = file;
45063
45064 error = vfs_readdir(file, compat_filldir64, &buf);
45065 if (error >= 0)
45066 @@ -1436,6 +1454,11 @@ int compat_do_execve(char * filename,
45067 compat_uptr_t __user *envp,
45068 struct pt_regs * regs)
45069 {
45070 +#ifdef CONFIG_GRKERNSEC
45071 + struct file *old_exec_file;
45072 + struct acl_subject_label *old_acl;
45073 + struct rlimit old_rlim[RLIM_NLIMITS];
45074 +#endif
45075 struct linux_binprm *bprm;
45076 struct file *file;
45077 struct files_struct *displaced;
45078 @@ -1472,6 +1495,19 @@ int compat_do_execve(char * filename,
45079 bprm->filename = filename;
45080 bprm->interp = filename;
45081
45082 + if (gr_process_user_ban()) {
45083 + retval = -EPERM;
45084 + goto out_file;
45085 + }
45086 +
45087 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45088 + retval = -EAGAIN;
45089 + if (gr_handle_nproc())
45090 + goto out_file;
45091 + retval = -EACCES;
45092 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
45093 + goto out_file;
45094 +
45095 retval = bprm_mm_init(bprm);
45096 if (retval)
45097 goto out_file;
45098 @@ -1501,9 +1537,40 @@ int compat_do_execve(char * filename,
45099 if (retval < 0)
45100 goto out;
45101
45102 + if (!gr_tpe_allow(file)) {
45103 + retval = -EACCES;
45104 + goto out;
45105 + }
45106 +
45107 + if (gr_check_crash_exec(file)) {
45108 + retval = -EACCES;
45109 + goto out;
45110 + }
45111 +
45112 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45113 +
45114 + gr_handle_exec_args_compat(bprm, argv);
45115 +
45116 +#ifdef CONFIG_GRKERNSEC
45117 + old_acl = current->acl;
45118 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45119 + old_exec_file = current->exec_file;
45120 + get_file(file);
45121 + current->exec_file = file;
45122 +#endif
45123 +
45124 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45125 + bprm->unsafe & LSM_UNSAFE_SHARE);
45126 + if (retval < 0)
45127 + goto out_fail;
45128 +
45129 retval = search_binary_handler(bprm, regs);
45130 if (retval < 0)
45131 - goto out;
45132 + goto out_fail;
45133 +#ifdef CONFIG_GRKERNSEC
45134 + if (old_exec_file)
45135 + fput(old_exec_file);
45136 +#endif
45137
45138 /* execve succeeded */
45139 current->fs->in_exec = 0;
45140 @@ -1514,6 +1581,14 @@ int compat_do_execve(char * filename,
45141 put_files_struct(displaced);
45142 return retval;
45143
45144 +out_fail:
45145 +#ifdef CONFIG_GRKERNSEC
45146 + current->acl = old_acl;
45147 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45148 + fput(current->exec_file);
45149 + current->exec_file = old_exec_file;
45150 +#endif
45151 +
45152 out:
45153 if (bprm->mm) {
45154 acct_arg_size(bprm, 0);
45155 @@ -1681,6 +1756,8 @@ int compat_core_sys_select(int n, compat
45156 struct fdtable *fdt;
45157 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
45158
45159 + pax_track_stack();
45160 +
45161 if (n < 0)
45162 goto out_nofds;
45163
45164 diff -urNp linux-2.6.39.1/fs/compat_ioctl.c linux-2.6.39.1/fs/compat_ioctl.c
45165 --- linux-2.6.39.1/fs/compat_ioctl.c 2011-05-19 00:06:34.000000000 -0400
45166 +++ linux-2.6.39.1/fs/compat_ioctl.c 2011-05-22 19:36:32.000000000 -0400
45167 @@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
45168
45169 err = get_user(palp, &up->palette);
45170 err |= get_user(length, &up->length);
45171 + if (err)
45172 + return -EFAULT;
45173
45174 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
45175 err = put_user(compat_ptr(palp), &up_native->palette);
45176 @@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne
45177 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
45178 {
45179 unsigned int a, b;
45180 - a = *(unsigned int *)p;
45181 - b = *(unsigned int *)q;
45182 + a = *(const unsigned int *)p;
45183 + b = *(const unsigned int *)q;
45184 if (a > b)
45185 return 1;
45186 if (a < b)
45187 diff -urNp linux-2.6.39.1/fs/configfs/dir.c linux-2.6.39.1/fs/configfs/dir.c
45188 --- linux-2.6.39.1/fs/configfs/dir.c 2011-05-19 00:06:34.000000000 -0400
45189 +++ linux-2.6.39.1/fs/configfs/dir.c 2011-05-22 19:36:32.000000000 -0400
45190 @@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file
45191 }
45192 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
45193 struct configfs_dirent *next;
45194 - const char * name;
45195 + const unsigned char * name;
45196 + char d_name[sizeof(next->s_dentry->d_iname)];
45197 int len;
45198 struct inode *inode = NULL;
45199
45200 @@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file
45201 continue;
45202
45203 name = configfs_get_name(next);
45204 - len = strlen(name);
45205 + if (next->s_dentry && name == next->s_dentry->d_iname) {
45206 + len = next->s_dentry->d_name.len;
45207 + memcpy(d_name, name, len);
45208 + name = d_name;
45209 + } else
45210 + len = strlen(name);
45211
45212 /*
45213 * We'll have a dentry and an inode for
45214 diff -urNp linux-2.6.39.1/fs/configfs/file.c linux-2.6.39.1/fs/configfs/file.c
45215 --- linux-2.6.39.1/fs/configfs/file.c 2011-05-19 00:06:34.000000000 -0400
45216 +++ linux-2.6.39.1/fs/configfs/file.c 2011-05-22 19:36:32.000000000 -0400
45217 @@ -215,7 +215,7 @@ static int check_perm(struct inode * ino
45218 struct config_item *item = configfs_get_config_item(file->f_path.dentry->d_parent);
45219 struct configfs_attribute * attr = to_attr(file->f_path.dentry);
45220 struct configfs_buffer * buffer;
45221 - struct configfs_item_operations * ops = NULL;
45222 + struct configfs_item_operations *ops = NULL;
45223 int error = 0;
45224
45225 if (!item || !attr)
45226 diff -urNp linux-2.6.39.1/fs/configfs/item.c linux-2.6.39.1/fs/configfs/item.c
45227 --- linux-2.6.39.1/fs/configfs/item.c 2011-05-19 00:06:34.000000000 -0400
45228 +++ linux-2.6.39.1/fs/configfs/item.c 2011-05-22 19:36:32.000000000 -0400
45229 @@ -123,7 +123,7 @@ void config_item_init_type_name(struct c
45230 EXPORT_SYMBOL(config_item_init_type_name);
45231
45232 void config_group_init_type_name(struct config_group *group, const char *name,
45233 - struct config_item_type *type)
45234 + struct config_item_type *type)
45235 {
45236 config_item_set_name(&group->cg_item, name);
45237 group->cg_item.ci_type = type;
45238 diff -urNp linux-2.6.39.1/fs/dcache.c linux-2.6.39.1/fs/dcache.c
45239 --- linux-2.6.39.1/fs/dcache.c 2011-05-19 00:06:34.000000000 -0400
45240 +++ linux-2.6.39.1/fs/dcache.c 2011-05-22 19:36:32.000000000 -0400
45241 @@ -3069,7 +3069,7 @@ void __init vfs_caches_init(unsigned lon
45242 mempages -= reserve;
45243
45244 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
45245 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
45246 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
45247
45248 dcache_init();
45249 inode_init();
45250 diff -urNp linux-2.6.39.1/fs/dlm/lockspace.c linux-2.6.39.1/fs/dlm/lockspace.c
45251 --- linux-2.6.39.1/fs/dlm/lockspace.c 2011-05-19 00:06:34.000000000 -0400
45252 +++ linux-2.6.39.1/fs/dlm/lockspace.c 2011-05-22 19:36:32.000000000 -0400
45253 @@ -200,7 +200,7 @@ static int dlm_uevent(struct kset *kset,
45254 return 0;
45255 }
45256
45257 -static struct kset_uevent_ops dlm_uevent_ops = {
45258 +static const struct kset_uevent_ops dlm_uevent_ops = {
45259 .uevent = dlm_uevent,
45260 };
45261
45262 diff -urNp linux-2.6.39.1/fs/ecryptfs/inode.c linux-2.6.39.1/fs/ecryptfs/inode.c
45263 --- linux-2.6.39.1/fs/ecryptfs/inode.c 2011-06-03 00:04:14.000000000 -0400
45264 +++ linux-2.6.39.1/fs/ecryptfs/inode.c 2011-06-03 00:32:07.000000000 -0400
45265 @@ -623,7 +623,7 @@ static int ecryptfs_readlink_lower(struc
45266 old_fs = get_fs();
45267 set_fs(get_ds());
45268 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
45269 - (char __user *)lower_buf,
45270 + (__force char __user *)lower_buf,
45271 lower_bufsiz);
45272 set_fs(old_fs);
45273 if (rc < 0)
45274 @@ -669,7 +669,7 @@ static void *ecryptfs_follow_link(struct
45275 }
45276 old_fs = get_fs();
45277 set_fs(get_ds());
45278 - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
45279 + rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
45280 set_fs(old_fs);
45281 if (rc < 0) {
45282 kfree(buf);
45283 @@ -684,7 +684,7 @@ out:
45284 static void
45285 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
45286 {
45287 - char *buf = nd_get_link(nd);
45288 + const char *buf = nd_get_link(nd);
45289 if (!IS_ERR(buf)) {
45290 /* Free the char* */
45291 kfree(buf);
45292 diff -urNp linux-2.6.39.1/fs/ecryptfs/miscdev.c linux-2.6.39.1/fs/ecryptfs/miscdev.c
45293 --- linux-2.6.39.1/fs/ecryptfs/miscdev.c 2011-05-19 00:06:34.000000000 -0400
45294 +++ linux-2.6.39.1/fs/ecryptfs/miscdev.c 2011-05-22 19:36:32.000000000 -0400
45295 @@ -328,7 +328,7 @@ check_list:
45296 goto out_unlock_msg_ctx;
45297 i = 5;
45298 if (msg_ctx->msg) {
45299 - if (copy_to_user(&buf[i], packet_length, packet_length_size))
45300 + if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
45301 goto out_unlock_msg_ctx;
45302 i += packet_length_size;
45303 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
45304 diff -urNp linux-2.6.39.1/fs/exec.c linux-2.6.39.1/fs/exec.c
45305 --- linux-2.6.39.1/fs/exec.c 2011-05-19 00:06:34.000000000 -0400
45306 +++ linux-2.6.39.1/fs/exec.c 2011-06-03 23:33:13.000000000 -0400
45307 @@ -55,12 +55,24 @@
45308 #include <linux/fs_struct.h>
45309 #include <linux/pipe_fs_i.h>
45310 #include <linux/oom.h>
45311 +#include <linux/random.h>
45312 +#include <linux/seq_file.h>
45313 +
45314 +#ifdef CONFIG_PAX_REFCOUNT
45315 +#include <linux/kallsyms.h>
45316 +#include <linux/kdebug.h>
45317 +#endif
45318
45319 #include <asm/uaccess.h>
45320 #include <asm/mmu_context.h>
45321 #include <asm/tlb.h>
45322 #include "internal.h"
45323
45324 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
45325 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
45326 +EXPORT_SYMBOL(pax_set_initial_flags_func);
45327 +#endif
45328 +
45329 int core_uses_pid;
45330 char core_pattern[CORENAME_MAX_SIZE] = "core";
45331 unsigned int core_pipe_limit;
45332 @@ -70,7 +82,7 @@ struct core_name {
45333 char *corename;
45334 int used, size;
45335 };
45336 -static atomic_t call_count = ATOMIC_INIT(1);
45337 +static atomic_unchecked_t call_count = ATOMIC_INIT(1);
45338
45339 /* The maximal length of core_pattern is also specified in sysctl.c */
45340
45341 @@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use
45342 char *tmp = getname(library);
45343 int error = PTR_ERR(tmp);
45344 static const struct open_flags uselib_flags = {
45345 - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45346 + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45347 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
45348 .intent = LOOKUP_OPEN
45349 };
45350 @@ -190,18 +202,10 @@ struct page *get_arg_page(struct linux_b
45351 int write)
45352 {
45353 struct page *page;
45354 - int ret;
45355
45356 -#ifdef CONFIG_STACK_GROWSUP
45357 - if (write) {
45358 - ret = expand_stack_downwards(bprm->vma, pos);
45359 - if (ret < 0)
45360 - return NULL;
45361 - }
45362 -#endif
45363 - ret = get_user_pages(current, bprm->mm, pos,
45364 - 1, write, 1, &page, NULL);
45365 - if (ret <= 0)
45366 + if (0 > expand_stack_downwards(bprm->vma, pos))
45367 + return NULL;
45368 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
45369 return NULL;
45370
45371 if (write) {
45372 @@ -276,6 +280,11 @@ static int __bprm_mm_init(struct linux_b
45373 vma->vm_end = STACK_TOP_MAX;
45374 vma->vm_start = vma->vm_end - PAGE_SIZE;
45375 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
45376 +
45377 +#ifdef CONFIG_PAX_SEGMEXEC
45378 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
45379 +#endif
45380 +
45381 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
45382 INIT_LIST_HEAD(&vma->anon_vma_chain);
45383
45384 @@ -290,6 +299,12 @@ static int __bprm_mm_init(struct linux_b
45385 mm->stack_vm = mm->total_vm = 1;
45386 up_write(&mm->mmap_sem);
45387 bprm->p = vma->vm_end - sizeof(void *);
45388 +
45389 +#ifdef CONFIG_PAX_RANDUSTACK
45390 + if (randomize_va_space)
45391 + bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
45392 +#endif
45393 +
45394 return 0;
45395 err:
45396 up_write(&mm->mmap_sem);
45397 @@ -525,7 +540,7 @@ int copy_strings_kernel(int argc, const
45398 int r;
45399 mm_segment_t oldfs = get_fs();
45400 set_fs(KERNEL_DS);
45401 - r = copy_strings(argc, (const char __user *const __user *)argv, bprm);
45402 + r = copy_strings(argc, (__force const char __user *const __user *)argv, bprm);
45403 set_fs(oldfs);
45404 return r;
45405 }
45406 @@ -555,7 +570,8 @@ static int shift_arg_pages(struct vm_are
45407 unsigned long new_end = old_end - shift;
45408 struct mmu_gather *tlb;
45409
45410 - BUG_ON(new_start > new_end);
45411 + if (new_start >= new_end || new_start < mmap_min_addr)
45412 + return -ENOMEM;
45413
45414 /*
45415 * ensure there are no vmas between where we want to go
45416 @@ -564,6 +580,10 @@ static int shift_arg_pages(struct vm_are
45417 if (vma != find_vma(mm, new_start))
45418 return -EFAULT;
45419
45420 +#ifdef CONFIG_PAX_SEGMEXEC
45421 + BUG_ON(pax_find_mirror_vma(vma));
45422 +#endif
45423 +
45424 /*
45425 * cover the whole range: [new_start, old_end)
45426 */
45427 @@ -644,10 +664,6 @@ int setup_arg_pages(struct linux_binprm
45428 stack_top = arch_align_stack(stack_top);
45429 stack_top = PAGE_ALIGN(stack_top);
45430
45431 - if (unlikely(stack_top < mmap_min_addr) ||
45432 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
45433 - return -ENOMEM;
45434 -
45435 stack_shift = vma->vm_end - stack_top;
45436
45437 bprm->p -= stack_shift;
45438 @@ -659,8 +675,28 @@ int setup_arg_pages(struct linux_binprm
45439 bprm->exec -= stack_shift;
45440
45441 down_write(&mm->mmap_sem);
45442 +
45443 + /* Move stack pages down in memory. */
45444 + if (stack_shift) {
45445 + ret = shift_arg_pages(vma, stack_shift);
45446 + if (ret)
45447 + goto out_unlock;
45448 + }
45449 +
45450 vm_flags = VM_STACK_FLAGS;
45451
45452 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45453 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
45454 + vm_flags &= ~VM_EXEC;
45455 +
45456 +#ifdef CONFIG_PAX_MPROTECT
45457 + if (mm->pax_flags & MF_PAX_MPROTECT)
45458 + vm_flags &= ~VM_MAYEXEC;
45459 +#endif
45460 +
45461 + }
45462 +#endif
45463 +
45464 /*
45465 * Adjust stack execute permissions; explicitly enable for
45466 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
45467 @@ -679,13 +715,6 @@ int setup_arg_pages(struct linux_binprm
45468 goto out_unlock;
45469 BUG_ON(prev != vma);
45470
45471 - /* Move stack pages down in memory. */
45472 - if (stack_shift) {
45473 - ret = shift_arg_pages(vma, stack_shift);
45474 - if (ret)
45475 - goto out_unlock;
45476 - }
45477 -
45478 /* mprotect_fixup is overkill to remove the temporary stack flags */
45479 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
45480
45481 @@ -725,7 +754,7 @@ struct file *open_exec(const char *name)
45482 struct file *file;
45483 int err;
45484 static const struct open_flags open_exec_flags = {
45485 - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45486 + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45487 .acc_mode = MAY_EXEC | MAY_OPEN,
45488 .intent = LOOKUP_OPEN
45489 };
45490 @@ -766,7 +795,7 @@ int kernel_read(struct file *file, loff_
45491 old_fs = get_fs();
45492 set_fs(get_ds());
45493 /* The cast to a user pointer is valid due to the set_fs() */
45494 - result = vfs_read(file, (void __user *)addr, count, &pos);
45495 + result = vfs_read(file, (__force void __user *)addr, count, &pos);
45496 set_fs(old_fs);
45497 return result;
45498 }
45499 @@ -1188,7 +1217,7 @@ int check_unsafe_exec(struct linux_binpr
45500 }
45501 rcu_read_unlock();
45502
45503 - if (p->fs->users > n_fs) {
45504 + if (atomic_read(&p->fs->users) > n_fs) {
45505 bprm->unsafe |= LSM_UNSAFE_SHARE;
45506 } else {
45507 res = -EAGAIN;
45508 @@ -1384,6 +1413,11 @@ int do_execve(const char * filename,
45509 const char __user *const __user *envp,
45510 struct pt_regs * regs)
45511 {
45512 +#ifdef CONFIG_GRKERNSEC
45513 + struct file *old_exec_file;
45514 + struct acl_subject_label *old_acl;
45515 + struct rlimit old_rlim[RLIM_NLIMITS];
45516 +#endif
45517 struct linux_binprm *bprm;
45518 struct file *file;
45519 struct files_struct *displaced;
45520 @@ -1420,6 +1454,23 @@ int do_execve(const char * filename,
45521 bprm->filename = filename;
45522 bprm->interp = filename;
45523
45524 + if (gr_process_user_ban()) {
45525 + retval = -EPERM;
45526 + goto out_file;
45527 + }
45528 +
45529 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45530 +
45531 + if (gr_handle_nproc()) {
45532 + retval = -EAGAIN;
45533 + goto out_file;
45534 + }
45535 +
45536 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
45537 + retval = -EACCES;
45538 + goto out_file;
45539 + }
45540 +
45541 retval = bprm_mm_init(bprm);
45542 if (retval)
45543 goto out_file;
45544 @@ -1449,9 +1500,40 @@ int do_execve(const char * filename,
45545 if (retval < 0)
45546 goto out;
45547
45548 + if (!gr_tpe_allow(file)) {
45549 + retval = -EACCES;
45550 + goto out;
45551 + }
45552 +
45553 + if (gr_check_crash_exec(file)) {
45554 + retval = -EACCES;
45555 + goto out;
45556 + }
45557 +
45558 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45559 +
45560 + gr_handle_exec_args(bprm, argv);
45561 +
45562 +#ifdef CONFIG_GRKERNSEC
45563 + old_acl = current->acl;
45564 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45565 + old_exec_file = current->exec_file;
45566 + get_file(file);
45567 + current->exec_file = file;
45568 +#endif
45569 +
45570 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45571 + bprm->unsafe & LSM_UNSAFE_SHARE);
45572 + if (retval < 0)
45573 + goto out_fail;
45574 +
45575 retval = search_binary_handler(bprm,regs);
45576 if (retval < 0)
45577 - goto out;
45578 + goto out_fail;
45579 +#ifdef CONFIG_GRKERNSEC
45580 + if (old_exec_file)
45581 + fput(old_exec_file);
45582 +#endif
45583
45584 /* execve succeeded */
45585 current->fs->in_exec = 0;
45586 @@ -1462,6 +1544,14 @@ int do_execve(const char * filename,
45587 put_files_struct(displaced);
45588 return retval;
45589
45590 +out_fail:
45591 +#ifdef CONFIG_GRKERNSEC
45592 + current->acl = old_acl;
45593 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45594 + fput(current->exec_file);
45595 + current->exec_file = old_exec_file;
45596 +#endif
45597 +
45598 out:
45599 if (bprm->mm) {
45600 acct_arg_size(bprm, 0);
45601 @@ -1507,7 +1597,7 @@ static int expand_corename(struct core_n
45602 {
45603 char *old_corename = cn->corename;
45604
45605 - cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
45606 + cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
45607 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
45608
45609 if (!cn->corename) {
45610 @@ -1560,7 +1650,7 @@ static int format_corename(struct core_n
45611 int pid_in_pattern = 0;
45612 int err = 0;
45613
45614 - cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
45615 + cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
45616 cn->corename = kmalloc(cn->size, GFP_KERNEL);
45617 cn->used = 0;
45618
45619 @@ -1648,6 +1738,219 @@ out:
45620 return ispipe;
45621 }
45622
45623 +int pax_check_flags(unsigned long *flags)
45624 +{
45625 + int retval = 0;
45626 +
45627 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
45628 + if (*flags & MF_PAX_SEGMEXEC)
45629 + {
45630 + *flags &= ~MF_PAX_SEGMEXEC;
45631 + retval = -EINVAL;
45632 + }
45633 +#endif
45634 +
45635 + if ((*flags & MF_PAX_PAGEEXEC)
45636 +
45637 +#ifdef CONFIG_PAX_PAGEEXEC
45638 + && (*flags & MF_PAX_SEGMEXEC)
45639 +#endif
45640 +
45641 + )
45642 + {
45643 + *flags &= ~MF_PAX_PAGEEXEC;
45644 + retval = -EINVAL;
45645 + }
45646 +
45647 + if ((*flags & MF_PAX_MPROTECT)
45648 +
45649 +#ifdef CONFIG_PAX_MPROTECT
45650 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45651 +#endif
45652 +
45653 + )
45654 + {
45655 + *flags &= ~MF_PAX_MPROTECT;
45656 + retval = -EINVAL;
45657 + }
45658 +
45659 + if ((*flags & MF_PAX_EMUTRAMP)
45660 +
45661 +#ifdef CONFIG_PAX_EMUTRAMP
45662 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45663 +#endif
45664 +
45665 + )
45666 + {
45667 + *flags &= ~MF_PAX_EMUTRAMP;
45668 + retval = -EINVAL;
45669 + }
45670 +
45671 + return retval;
45672 +}
45673 +
45674 +EXPORT_SYMBOL(pax_check_flags);
45675 +
45676 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45677 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
45678 +{
45679 + struct task_struct *tsk = current;
45680 + struct mm_struct *mm = current->mm;
45681 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
45682 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
45683 + char *path_exec = NULL;
45684 + char *path_fault = NULL;
45685 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
45686 +
45687 + if (buffer_exec && buffer_fault) {
45688 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
45689 +
45690 + down_read(&mm->mmap_sem);
45691 + vma = mm->mmap;
45692 + while (vma && (!vma_exec || !vma_fault)) {
45693 + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
45694 + vma_exec = vma;
45695 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
45696 + vma_fault = vma;
45697 + vma = vma->vm_next;
45698 + }
45699 + if (vma_exec) {
45700 + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
45701 + if (IS_ERR(path_exec))
45702 + path_exec = "<path too long>";
45703 + else {
45704 + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
45705 + if (path_exec) {
45706 + *path_exec = 0;
45707 + path_exec = buffer_exec;
45708 + } else
45709 + path_exec = "<path too long>";
45710 + }
45711 + }
45712 + if (vma_fault) {
45713 + start = vma_fault->vm_start;
45714 + end = vma_fault->vm_end;
45715 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
45716 + if (vma_fault->vm_file) {
45717 + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
45718 + if (IS_ERR(path_fault))
45719 + path_fault = "<path too long>";
45720 + else {
45721 + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
45722 + if (path_fault) {
45723 + *path_fault = 0;
45724 + path_fault = buffer_fault;
45725 + } else
45726 + path_fault = "<path too long>";
45727 + }
45728 + } else
45729 + path_fault = "<anonymous mapping>";
45730 + }
45731 + up_read(&mm->mmap_sem);
45732 + }
45733 + if (tsk->signal->curr_ip)
45734 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
45735 + else
45736 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
45737 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
45738 + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
45739 + task_uid(tsk), task_euid(tsk), pc, sp);
45740 + free_page((unsigned long)buffer_exec);
45741 + free_page((unsigned long)buffer_fault);
45742 + pax_report_insns(pc, sp);
45743 + do_coredump(SIGKILL, SIGKILL, regs);
45744 +}
45745 +#endif
45746 +
45747 +#ifdef CONFIG_PAX_REFCOUNT
45748 +void pax_report_refcount_overflow(struct pt_regs *regs)
45749 +{
45750 + if (current->signal->curr_ip)
45751 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45752 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
45753 + else
45754 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45755 + current->comm, task_pid_nr(current), current_uid(), current_euid());
45756 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
45757 + show_regs(regs);
45758 + force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
45759 +}
45760 +#endif
45761 +
45762 +#ifdef CONFIG_PAX_USERCOPY
45763 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
45764 +int object_is_on_stack(const void *obj, unsigned long len)
45765 +{
45766 + const void * const stack = task_stack_page(current);
45767 + const void * const stackend = stack + THREAD_SIZE;
45768 +
45769 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45770 + const void *frame = NULL;
45771 + const void *oldframe;
45772 +#endif
45773 +
45774 + if (obj + len < obj)
45775 + return -1;
45776 +
45777 + if (obj + len <= stack || stackend <= obj)
45778 + return 0;
45779 +
45780 + if (obj < stack || stackend < obj + len)
45781 + return -1;
45782 +
45783 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45784 + oldframe = __builtin_frame_address(1);
45785 + if (oldframe)
45786 + frame = __builtin_frame_address(2);
45787 + /*
45788 + low ----------------------------------------------> high
45789 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
45790 + ^----------------^
45791 + allow copies only within here
45792 + */
45793 + while (stack <= frame && frame < stackend) {
45794 + /* if obj + len extends past the last frame, this
45795 + check won't pass and the next frame will be 0,
45796 + causing us to bail out and correctly report
45797 + the copy as invalid
45798 + */
45799 + if (obj + len <= frame)
45800 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
45801 + oldframe = frame;
45802 + frame = *(const void * const *)frame;
45803 + }
45804 + return -1;
45805 +#else
45806 + return 1;
45807 +#endif
45808 +}
45809 +
45810 +
45811 +void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
45812 +{
45813 + if (current->signal->curr_ip)
45814 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45815 + &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45816 + else
45817 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45818 + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45819 + dump_stack();
45820 + gr_handle_kernel_exploit();
45821 + do_group_exit(SIGKILL);
45822 +}
45823 +#endif
45824 +
45825 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
45826 +void pax_track_stack(void)
45827 +{
45828 + unsigned long sp = (unsigned long)&sp;
45829 + if (sp < current_thread_info()->lowest_stack &&
45830 + sp > (unsigned long)task_stack_page(current))
45831 + current_thread_info()->lowest_stack = sp;
45832 +}
45833 +EXPORT_SYMBOL(pax_track_stack);
45834 +#endif
45835 +
45836 static int zap_process(struct task_struct *start, int exit_code)
45837 {
45838 struct task_struct *t;
45839 @@ -1858,17 +2161,17 @@ static void wait_for_dump_helpers(struct
45840 pipe = file->f_path.dentry->d_inode->i_pipe;
45841
45842 pipe_lock(pipe);
45843 - pipe->readers++;
45844 - pipe->writers--;
45845 + atomic_inc(&pipe->readers);
45846 + atomic_dec(&pipe->writers);
45847
45848 - while ((pipe->readers > 1) && (!signal_pending(current))) {
45849 + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
45850 wake_up_interruptible_sync(&pipe->wait);
45851 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
45852 pipe_wait(pipe);
45853 }
45854
45855 - pipe->readers--;
45856 - pipe->writers++;
45857 + atomic_dec(&pipe->readers);
45858 + atomic_inc(&pipe->writers);
45859 pipe_unlock(pipe);
45860
45861 }
45862 @@ -1929,7 +2232,7 @@ void do_coredump(long signr, int exit_co
45863 int retval = 0;
45864 int flag = 0;
45865 int ispipe;
45866 - static atomic_t core_dump_count = ATOMIC_INIT(0);
45867 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
45868 struct coredump_params cprm = {
45869 .signr = signr,
45870 .regs = regs,
45871 @@ -1944,6 +2247,9 @@ void do_coredump(long signr, int exit_co
45872
45873 audit_core_dumps(signr);
45874
45875 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
45876 + gr_handle_brute_attach(current, cprm.mm_flags);
45877 +
45878 binfmt = mm->binfmt;
45879 if (!binfmt || !binfmt->core_dump)
45880 goto fail;
45881 @@ -1984,6 +2290,8 @@ void do_coredump(long signr, int exit_co
45882 goto fail_corename;
45883 }
45884
45885 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
45886 +
45887 if (ispipe) {
45888 int dump_count;
45889 char **helper_argv;
45890 @@ -2011,7 +2319,7 @@ void do_coredump(long signr, int exit_co
45891 }
45892 cprm.limit = RLIM_INFINITY;
45893
45894 - dump_count = atomic_inc_return(&core_dump_count);
45895 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
45896 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
45897 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
45898 task_tgid_vnr(current), current->comm);
45899 @@ -2081,7 +2389,7 @@ close_fail:
45900 filp_close(cprm.file, NULL);
45901 fail_dropcount:
45902 if (ispipe)
45903 - atomic_dec(&core_dump_count);
45904 + atomic_dec_unchecked(&core_dump_count);
45905 fail_unlock:
45906 kfree(cn.corename);
45907 fail_corename:
45908 diff -urNp linux-2.6.39.1/fs/ext2/balloc.c linux-2.6.39.1/fs/ext2/balloc.c
45909 --- linux-2.6.39.1/fs/ext2/balloc.c 2011-05-19 00:06:34.000000000 -0400
45910 +++ linux-2.6.39.1/fs/ext2/balloc.c 2011-05-22 19:41:37.000000000 -0400
45911 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
45912
45913 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45914 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45915 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45916 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45917 sbi->s_resuid != current_fsuid() &&
45918 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45919 return 0;
45920 diff -urNp linux-2.6.39.1/fs/ext3/balloc.c linux-2.6.39.1/fs/ext3/balloc.c
45921 --- linux-2.6.39.1/fs/ext3/balloc.c 2011-05-19 00:06:34.000000000 -0400
45922 +++ linux-2.6.39.1/fs/ext3/balloc.c 2011-05-22 19:41:37.000000000 -0400
45923 @@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
45924
45925 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45926 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45927 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45928 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45929 sbi->s_resuid != current_fsuid() &&
45930 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45931 return 0;
45932 diff -urNp linux-2.6.39.1/fs/ext4/balloc.c linux-2.6.39.1/fs/ext4/balloc.c
45933 --- linux-2.6.39.1/fs/ext4/balloc.c 2011-05-19 00:06:34.000000000 -0400
45934 +++ linux-2.6.39.1/fs/ext4/balloc.c 2011-05-22 19:41:37.000000000 -0400
45935 @@ -522,7 +522,7 @@ static int ext4_has_free_blocks(struct e
45936 /* Hm, nope. Are (enough) root reserved blocks available? */
45937 if (sbi->s_resuid == current_fsuid() ||
45938 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
45939 - capable(CAP_SYS_RESOURCE)) {
45940 + capable_nolog(CAP_SYS_RESOURCE)) {
45941 if (free_blocks >= (nblocks + dirty_blocks))
45942 return 1;
45943 }
45944 diff -urNp linux-2.6.39.1/fs/ext4/ext4.h linux-2.6.39.1/fs/ext4/ext4.h
45945 --- linux-2.6.39.1/fs/ext4/ext4.h 2011-06-03 00:04:14.000000000 -0400
45946 +++ linux-2.6.39.1/fs/ext4/ext4.h 2011-06-03 00:32:07.000000000 -0400
45947 @@ -1166,19 +1166,19 @@ struct ext4_sb_info {
45948 unsigned long s_mb_last_start;
45949
45950 /* stats for buddy allocator */
45951 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
45952 - atomic_t s_bal_success; /* we found long enough chunks */
45953 - atomic_t s_bal_allocated; /* in blocks */
45954 - atomic_t s_bal_ex_scanned; /* total extents scanned */
45955 - atomic_t s_bal_goals; /* goal hits */
45956 - atomic_t s_bal_breaks; /* too long searches */
45957 - atomic_t s_bal_2orders; /* 2^order hits */
45958 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
45959 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
45960 + atomic_unchecked_t s_bal_allocated; /* in blocks */
45961 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
45962 + atomic_unchecked_t s_bal_goals; /* goal hits */
45963 + atomic_unchecked_t s_bal_breaks; /* too long searches */
45964 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
45965 spinlock_t s_bal_lock;
45966 unsigned long s_mb_buddies_generated;
45967 unsigned long long s_mb_generation_time;
45968 - atomic_t s_mb_lost_chunks;
45969 - atomic_t s_mb_preallocated;
45970 - atomic_t s_mb_discarded;
45971 + atomic_unchecked_t s_mb_lost_chunks;
45972 + atomic_unchecked_t s_mb_preallocated;
45973 + atomic_unchecked_t s_mb_discarded;
45974 atomic_t s_lock_busy;
45975
45976 /* locality groups */
45977 diff -urNp linux-2.6.39.1/fs/ext4/mballoc.c linux-2.6.39.1/fs/ext4/mballoc.c
45978 --- linux-2.6.39.1/fs/ext4/mballoc.c 2011-06-03 00:04:14.000000000 -0400
45979 +++ linux-2.6.39.1/fs/ext4/mballoc.c 2011-06-03 00:32:07.000000000 -0400
45980 @@ -1853,7 +1853,7 @@ void ext4_mb_simple_scan_group(struct ex
45981 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
45982
45983 if (EXT4_SB(sb)->s_mb_stats)
45984 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
45985 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
45986
45987 break;
45988 }
45989 @@ -2147,7 +2147,7 @@ repeat:
45990 ac->ac_status = AC_STATUS_CONTINUE;
45991 ac->ac_flags |= EXT4_MB_HINT_FIRST;
45992 cr = 3;
45993 - atomic_inc(&sbi->s_mb_lost_chunks);
45994 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
45995 goto repeat;
45996 }
45997 }
45998 @@ -2190,6 +2190,8 @@ static int ext4_mb_seq_groups_show(struc
45999 ext4_grpblk_t counters[16];
46000 } sg;
46001
46002 + pax_track_stack();
46003 +
46004 group--;
46005 if (group == 0)
46006 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
46007 @@ -2613,25 +2615,25 @@ int ext4_mb_release(struct super_block *
46008 if (sbi->s_mb_stats) {
46009 printk(KERN_INFO
46010 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
46011 - atomic_read(&sbi->s_bal_allocated),
46012 - atomic_read(&sbi->s_bal_reqs),
46013 - atomic_read(&sbi->s_bal_success));
46014 + atomic_read_unchecked(&sbi->s_bal_allocated),
46015 + atomic_read_unchecked(&sbi->s_bal_reqs),
46016 + atomic_read_unchecked(&sbi->s_bal_success));
46017 printk(KERN_INFO
46018 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
46019 "%u 2^N hits, %u breaks, %u lost\n",
46020 - atomic_read(&sbi->s_bal_ex_scanned),
46021 - atomic_read(&sbi->s_bal_goals),
46022 - atomic_read(&sbi->s_bal_2orders),
46023 - atomic_read(&sbi->s_bal_breaks),
46024 - atomic_read(&sbi->s_mb_lost_chunks));
46025 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
46026 + atomic_read_unchecked(&sbi->s_bal_goals),
46027 + atomic_read_unchecked(&sbi->s_bal_2orders),
46028 + atomic_read_unchecked(&sbi->s_bal_breaks),
46029 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
46030 printk(KERN_INFO
46031 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
46032 sbi->s_mb_buddies_generated++,
46033 sbi->s_mb_generation_time);
46034 printk(KERN_INFO
46035 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
46036 - atomic_read(&sbi->s_mb_preallocated),
46037 - atomic_read(&sbi->s_mb_discarded));
46038 + atomic_read_unchecked(&sbi->s_mb_preallocated),
46039 + atomic_read_unchecked(&sbi->s_mb_discarded));
46040 }
46041
46042 free_percpu(sbi->s_locality_groups);
46043 @@ -3107,16 +3109,16 @@ static void ext4_mb_collect_stats(struct
46044 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
46045
46046 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
46047 - atomic_inc(&sbi->s_bal_reqs);
46048 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
46049 + atomic_inc_unchecked(&sbi->s_bal_reqs);
46050 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
46051 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
46052 - atomic_inc(&sbi->s_bal_success);
46053 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
46054 + atomic_inc_unchecked(&sbi->s_bal_success);
46055 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
46056 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
46057 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
46058 - atomic_inc(&sbi->s_bal_goals);
46059 + atomic_inc_unchecked(&sbi->s_bal_goals);
46060 if (ac->ac_found > sbi->s_mb_max_to_scan)
46061 - atomic_inc(&sbi->s_bal_breaks);
46062 + atomic_inc_unchecked(&sbi->s_bal_breaks);
46063 }
46064
46065 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
46066 @@ -3514,7 +3516,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
46067 trace_ext4_mb_new_inode_pa(ac, pa);
46068
46069 ext4_mb_use_inode_pa(ac, pa);
46070 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46071 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46072
46073 ei = EXT4_I(ac->ac_inode);
46074 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
46075 @@ -3574,7 +3576,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
46076 trace_ext4_mb_new_group_pa(ac, pa);
46077
46078 ext4_mb_use_group_pa(ac, pa);
46079 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46080 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46081
46082 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
46083 lg = ac->ac_lg;
46084 @@ -3661,7 +3663,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
46085 * from the bitmap and continue.
46086 */
46087 }
46088 - atomic_add(free, &sbi->s_mb_discarded);
46089 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
46090
46091 return err;
46092 }
46093 @@ -3679,7 +3681,7 @@ ext4_mb_release_group_pa(struct ext4_bud
46094 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
46095 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
46096 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
46097 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46098 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46099 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
46100
46101 return 0;
46102 diff -urNp linux-2.6.39.1/fs/fcntl.c linux-2.6.39.1/fs/fcntl.c
46103 --- linux-2.6.39.1/fs/fcntl.c 2011-05-19 00:06:34.000000000 -0400
46104 +++ linux-2.6.39.1/fs/fcntl.c 2011-05-22 20:45:50.000000000 -0400
46105 @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
46106 if (err)
46107 return err;
46108
46109 + if (gr_handle_chroot_fowner(pid, type))
46110 + return -ENOENT;
46111 + if (gr_check_protected_task_fowner(pid, type))
46112 + return -EACCES;
46113 +
46114 f_modown(filp, pid, type, force);
46115 return 0;
46116 }
46117 @@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in
46118 switch (cmd) {
46119 case F_DUPFD:
46120 case F_DUPFD_CLOEXEC:
46121 + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
46122 if (arg >= rlimit(RLIMIT_NOFILE))
46123 break;
46124 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
46125 @@ -835,14 +841,14 @@ static int __init fcntl_init(void)
46126 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
46127 * is defined as O_NONBLOCK on some platforms and not on others.
46128 */
46129 - BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
46130 + BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
46131 O_RDONLY | O_WRONLY | O_RDWR |
46132 O_CREAT | O_EXCL | O_NOCTTY |
46133 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
46134 __O_SYNC | O_DSYNC | FASYNC |
46135 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
46136 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
46137 - __FMODE_EXEC | O_PATH
46138 + __FMODE_EXEC | O_PATH | FMODE_GREXEC
46139 ));
46140
46141 fasync_cache = kmem_cache_create("fasync_cache",
46142 diff -urNp linux-2.6.39.1/fs/fifo.c linux-2.6.39.1/fs/fifo.c
46143 --- linux-2.6.39.1/fs/fifo.c 2011-05-19 00:06:34.000000000 -0400
46144 +++ linux-2.6.39.1/fs/fifo.c 2011-05-22 19:36:32.000000000 -0400
46145 @@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
46146 */
46147 filp->f_op = &read_pipefifo_fops;
46148 pipe->r_counter++;
46149 - if (pipe->readers++ == 0)
46150 + if (atomic_inc_return(&pipe->readers) == 1)
46151 wake_up_partner(inode);
46152
46153 - if (!pipe->writers) {
46154 + if (!atomic_read(&pipe->writers)) {
46155 if ((filp->f_flags & O_NONBLOCK)) {
46156 /* suppress POLLHUP until we have
46157 * seen a writer */
46158 @@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode
46159 * errno=ENXIO when there is no process reading the FIFO.
46160 */
46161 ret = -ENXIO;
46162 - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
46163 + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
46164 goto err;
46165
46166 filp->f_op = &write_pipefifo_fops;
46167 pipe->w_counter++;
46168 - if (!pipe->writers++)
46169 + if (atomic_inc_return(&pipe->writers) == 1)
46170 wake_up_partner(inode);
46171
46172 - if (!pipe->readers) {
46173 + if (!atomic_read(&pipe->readers)) {
46174 wait_for_partner(inode, &pipe->r_counter);
46175 if (signal_pending(current))
46176 goto err_wr;
46177 @@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode
46178 */
46179 filp->f_op = &rdwr_pipefifo_fops;
46180
46181 - pipe->readers++;
46182 - pipe->writers++;
46183 + atomic_inc(&pipe->readers);
46184 + atomic_inc(&pipe->writers);
46185 pipe->r_counter++;
46186 pipe->w_counter++;
46187 - if (pipe->readers == 1 || pipe->writers == 1)
46188 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
46189 wake_up_partner(inode);
46190 break;
46191
46192 @@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode
46193 return 0;
46194
46195 err_rd:
46196 - if (!--pipe->readers)
46197 + if (atomic_dec_and_test(&pipe->readers))
46198 wake_up_interruptible(&pipe->wait);
46199 ret = -ERESTARTSYS;
46200 goto err;
46201
46202 err_wr:
46203 - if (!--pipe->writers)
46204 + if (atomic_dec_and_test(&pipe->writers))
46205 wake_up_interruptible(&pipe->wait);
46206 ret = -ERESTARTSYS;
46207 goto err;
46208
46209 err:
46210 - if (!pipe->readers && !pipe->writers)
46211 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
46212 free_pipe_info(inode);
46213
46214 err_nocleanup:
46215 diff -urNp linux-2.6.39.1/fs/file.c linux-2.6.39.1/fs/file.c
46216 --- linux-2.6.39.1/fs/file.c 2011-05-19 00:06:34.000000000 -0400
46217 +++ linux-2.6.39.1/fs/file.c 2011-05-22 19:41:37.000000000 -0400
46218 @@ -15,6 +15,7 @@
46219 #include <linux/slab.h>
46220 #include <linux/vmalloc.h>
46221 #include <linux/file.h>
46222 +#include <linux/security.h>
46223 #include <linux/fdtable.h>
46224 #include <linux/bitops.h>
46225 #include <linux/interrupt.h>
46226 @@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
46227 * N.B. For clone tasks sharing a files structure, this test
46228 * will limit the total number of files that can be opened.
46229 */
46230 + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
46231 if (nr >= rlimit(RLIMIT_NOFILE))
46232 return -EMFILE;
46233
46234 diff -urNp linux-2.6.39.1/fs/filesystems.c linux-2.6.39.1/fs/filesystems.c
46235 --- linux-2.6.39.1/fs/filesystems.c 2011-05-19 00:06:34.000000000 -0400
46236 +++ linux-2.6.39.1/fs/filesystems.c 2011-05-22 19:41:37.000000000 -0400
46237 @@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con
46238 int len = dot ? dot - name : strlen(name);
46239
46240 fs = __get_fs_type(name, len);
46241 +
46242 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
46243 + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
46244 +#else
46245 if (!fs && (request_module("%.*s", len, name) == 0))
46246 +#endif
46247 fs = __get_fs_type(name, len);
46248
46249 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
46250 diff -urNp linux-2.6.39.1/fs/fscache/cookie.c linux-2.6.39.1/fs/fscache/cookie.c
46251 --- linux-2.6.39.1/fs/fscache/cookie.c 2011-05-19 00:06:34.000000000 -0400
46252 +++ linux-2.6.39.1/fs/fscache/cookie.c 2011-05-22 19:36:32.000000000 -0400
46253 @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
46254 parent ? (char *) parent->def->name : "<no-parent>",
46255 def->name, netfs_data);
46256
46257 - fscache_stat(&fscache_n_acquires);
46258 + fscache_stat_unchecked(&fscache_n_acquires);
46259
46260 /* if there's no parent cookie, then we don't create one here either */
46261 if (!parent) {
46262 - fscache_stat(&fscache_n_acquires_null);
46263 + fscache_stat_unchecked(&fscache_n_acquires_null);
46264 _leave(" [no parent]");
46265 return NULL;
46266 }
46267 @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
46268 /* allocate and initialise a cookie */
46269 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
46270 if (!cookie) {
46271 - fscache_stat(&fscache_n_acquires_oom);
46272 + fscache_stat_unchecked(&fscache_n_acquires_oom);
46273 _leave(" [ENOMEM]");
46274 return NULL;
46275 }
46276 @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
46277
46278 switch (cookie->def->type) {
46279 case FSCACHE_COOKIE_TYPE_INDEX:
46280 - fscache_stat(&fscache_n_cookie_index);
46281 + fscache_stat_unchecked(&fscache_n_cookie_index);
46282 break;
46283 case FSCACHE_COOKIE_TYPE_DATAFILE:
46284 - fscache_stat(&fscache_n_cookie_data);
46285 + fscache_stat_unchecked(&fscache_n_cookie_data);
46286 break;
46287 default:
46288 - fscache_stat(&fscache_n_cookie_special);
46289 + fscache_stat_unchecked(&fscache_n_cookie_special);
46290 break;
46291 }
46292
46293 @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
46294 if (fscache_acquire_non_index_cookie(cookie) < 0) {
46295 atomic_dec(&parent->n_children);
46296 __fscache_cookie_put(cookie);
46297 - fscache_stat(&fscache_n_acquires_nobufs);
46298 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
46299 _leave(" = NULL");
46300 return NULL;
46301 }
46302 }
46303
46304 - fscache_stat(&fscache_n_acquires_ok);
46305 + fscache_stat_unchecked(&fscache_n_acquires_ok);
46306 _leave(" = %p", cookie);
46307 return cookie;
46308 }
46309 @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
46310 cache = fscache_select_cache_for_object(cookie->parent);
46311 if (!cache) {
46312 up_read(&fscache_addremove_sem);
46313 - fscache_stat(&fscache_n_acquires_no_cache);
46314 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
46315 _leave(" = -ENOMEDIUM [no cache]");
46316 return -ENOMEDIUM;
46317 }
46318 @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
46319 object = cache->ops->alloc_object(cache, cookie);
46320 fscache_stat_d(&fscache_n_cop_alloc_object);
46321 if (IS_ERR(object)) {
46322 - fscache_stat(&fscache_n_object_no_alloc);
46323 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
46324 ret = PTR_ERR(object);
46325 goto error;
46326 }
46327
46328 - fscache_stat(&fscache_n_object_alloc);
46329 + fscache_stat_unchecked(&fscache_n_object_alloc);
46330
46331 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
46332
46333 @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
46334 struct fscache_object *object;
46335 struct hlist_node *_p;
46336
46337 - fscache_stat(&fscache_n_updates);
46338 + fscache_stat_unchecked(&fscache_n_updates);
46339
46340 if (!cookie) {
46341 - fscache_stat(&fscache_n_updates_null);
46342 + fscache_stat_unchecked(&fscache_n_updates_null);
46343 _leave(" [no cookie]");
46344 return;
46345 }
46346 @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
46347 struct fscache_object *object;
46348 unsigned long event;
46349
46350 - fscache_stat(&fscache_n_relinquishes);
46351 + fscache_stat_unchecked(&fscache_n_relinquishes);
46352 if (retire)
46353 - fscache_stat(&fscache_n_relinquishes_retire);
46354 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
46355
46356 if (!cookie) {
46357 - fscache_stat(&fscache_n_relinquishes_null);
46358 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
46359 _leave(" [no cookie]");
46360 return;
46361 }
46362 @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
46363
46364 /* wait for the cookie to finish being instantiated (or to fail) */
46365 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
46366 - fscache_stat(&fscache_n_relinquishes_waitcrt);
46367 + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
46368 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
46369 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
46370 }
46371 diff -urNp linux-2.6.39.1/fs/fscache/internal.h linux-2.6.39.1/fs/fscache/internal.h
46372 --- linux-2.6.39.1/fs/fscache/internal.h 2011-05-19 00:06:34.000000000 -0400
46373 +++ linux-2.6.39.1/fs/fscache/internal.h 2011-05-22 19:36:32.000000000 -0400
46374 @@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
46375 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
46376 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
46377
46378 -extern atomic_t fscache_n_op_pend;
46379 -extern atomic_t fscache_n_op_run;
46380 -extern atomic_t fscache_n_op_enqueue;
46381 -extern atomic_t fscache_n_op_deferred_release;
46382 -extern atomic_t fscache_n_op_release;
46383 -extern atomic_t fscache_n_op_gc;
46384 -extern atomic_t fscache_n_op_cancelled;
46385 -extern atomic_t fscache_n_op_rejected;
46386 -
46387 -extern atomic_t fscache_n_attr_changed;
46388 -extern atomic_t fscache_n_attr_changed_ok;
46389 -extern atomic_t fscache_n_attr_changed_nobufs;
46390 -extern atomic_t fscache_n_attr_changed_nomem;
46391 -extern atomic_t fscache_n_attr_changed_calls;
46392 -
46393 -extern atomic_t fscache_n_allocs;
46394 -extern atomic_t fscache_n_allocs_ok;
46395 -extern atomic_t fscache_n_allocs_wait;
46396 -extern atomic_t fscache_n_allocs_nobufs;
46397 -extern atomic_t fscache_n_allocs_intr;
46398 -extern atomic_t fscache_n_allocs_object_dead;
46399 -extern atomic_t fscache_n_alloc_ops;
46400 -extern atomic_t fscache_n_alloc_op_waits;
46401 -
46402 -extern atomic_t fscache_n_retrievals;
46403 -extern atomic_t fscache_n_retrievals_ok;
46404 -extern atomic_t fscache_n_retrievals_wait;
46405 -extern atomic_t fscache_n_retrievals_nodata;
46406 -extern atomic_t fscache_n_retrievals_nobufs;
46407 -extern atomic_t fscache_n_retrievals_intr;
46408 -extern atomic_t fscache_n_retrievals_nomem;
46409 -extern atomic_t fscache_n_retrievals_object_dead;
46410 -extern atomic_t fscache_n_retrieval_ops;
46411 -extern atomic_t fscache_n_retrieval_op_waits;
46412 -
46413 -extern atomic_t fscache_n_stores;
46414 -extern atomic_t fscache_n_stores_ok;
46415 -extern atomic_t fscache_n_stores_again;
46416 -extern atomic_t fscache_n_stores_nobufs;
46417 -extern atomic_t fscache_n_stores_oom;
46418 -extern atomic_t fscache_n_store_ops;
46419 -extern atomic_t fscache_n_store_calls;
46420 -extern atomic_t fscache_n_store_pages;
46421 -extern atomic_t fscache_n_store_radix_deletes;
46422 -extern atomic_t fscache_n_store_pages_over_limit;
46423 -
46424 -extern atomic_t fscache_n_store_vmscan_not_storing;
46425 -extern atomic_t fscache_n_store_vmscan_gone;
46426 -extern atomic_t fscache_n_store_vmscan_busy;
46427 -extern atomic_t fscache_n_store_vmscan_cancelled;
46428 -
46429 -extern atomic_t fscache_n_marks;
46430 -extern atomic_t fscache_n_uncaches;
46431 -
46432 -extern atomic_t fscache_n_acquires;
46433 -extern atomic_t fscache_n_acquires_null;
46434 -extern atomic_t fscache_n_acquires_no_cache;
46435 -extern atomic_t fscache_n_acquires_ok;
46436 -extern atomic_t fscache_n_acquires_nobufs;
46437 -extern atomic_t fscache_n_acquires_oom;
46438 -
46439 -extern atomic_t fscache_n_updates;
46440 -extern atomic_t fscache_n_updates_null;
46441 -extern atomic_t fscache_n_updates_run;
46442 -
46443 -extern atomic_t fscache_n_relinquishes;
46444 -extern atomic_t fscache_n_relinquishes_null;
46445 -extern atomic_t fscache_n_relinquishes_waitcrt;
46446 -extern atomic_t fscache_n_relinquishes_retire;
46447 -
46448 -extern atomic_t fscache_n_cookie_index;
46449 -extern atomic_t fscache_n_cookie_data;
46450 -extern atomic_t fscache_n_cookie_special;
46451 -
46452 -extern atomic_t fscache_n_object_alloc;
46453 -extern atomic_t fscache_n_object_no_alloc;
46454 -extern atomic_t fscache_n_object_lookups;
46455 -extern atomic_t fscache_n_object_lookups_negative;
46456 -extern atomic_t fscache_n_object_lookups_positive;
46457 -extern atomic_t fscache_n_object_lookups_timed_out;
46458 -extern atomic_t fscache_n_object_created;
46459 -extern atomic_t fscache_n_object_avail;
46460 -extern atomic_t fscache_n_object_dead;
46461 -
46462 -extern atomic_t fscache_n_checkaux_none;
46463 -extern atomic_t fscache_n_checkaux_okay;
46464 -extern atomic_t fscache_n_checkaux_update;
46465 -extern atomic_t fscache_n_checkaux_obsolete;
46466 +extern atomic_unchecked_t fscache_n_op_pend;
46467 +extern atomic_unchecked_t fscache_n_op_run;
46468 +extern atomic_unchecked_t fscache_n_op_enqueue;
46469 +extern atomic_unchecked_t fscache_n_op_deferred_release;
46470 +extern atomic_unchecked_t fscache_n_op_release;
46471 +extern atomic_unchecked_t fscache_n_op_gc;
46472 +extern atomic_unchecked_t fscache_n_op_cancelled;
46473 +extern atomic_unchecked_t fscache_n_op_rejected;
46474 +
46475 +extern atomic_unchecked_t fscache_n_attr_changed;
46476 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
46477 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
46478 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
46479 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
46480 +
46481 +extern atomic_unchecked_t fscache_n_allocs;
46482 +extern atomic_unchecked_t fscache_n_allocs_ok;
46483 +extern atomic_unchecked_t fscache_n_allocs_wait;
46484 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
46485 +extern atomic_unchecked_t fscache_n_allocs_intr;
46486 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
46487 +extern atomic_unchecked_t fscache_n_alloc_ops;
46488 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
46489 +
46490 +extern atomic_unchecked_t fscache_n_retrievals;
46491 +extern atomic_unchecked_t fscache_n_retrievals_ok;
46492 +extern atomic_unchecked_t fscache_n_retrievals_wait;
46493 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
46494 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
46495 +extern atomic_unchecked_t fscache_n_retrievals_intr;
46496 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
46497 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
46498 +extern atomic_unchecked_t fscache_n_retrieval_ops;
46499 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
46500 +
46501 +extern atomic_unchecked_t fscache_n_stores;
46502 +extern atomic_unchecked_t fscache_n_stores_ok;
46503 +extern atomic_unchecked_t fscache_n_stores_again;
46504 +extern atomic_unchecked_t fscache_n_stores_nobufs;
46505 +extern atomic_unchecked_t fscache_n_stores_oom;
46506 +extern atomic_unchecked_t fscache_n_store_ops;
46507 +extern atomic_unchecked_t fscache_n_store_calls;
46508 +extern atomic_unchecked_t fscache_n_store_pages;
46509 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
46510 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
46511 +
46512 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46513 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
46514 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
46515 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46516 +
46517 +extern atomic_unchecked_t fscache_n_marks;
46518 +extern atomic_unchecked_t fscache_n_uncaches;
46519 +
46520 +extern atomic_unchecked_t fscache_n_acquires;
46521 +extern atomic_unchecked_t fscache_n_acquires_null;
46522 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
46523 +extern atomic_unchecked_t fscache_n_acquires_ok;
46524 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
46525 +extern atomic_unchecked_t fscache_n_acquires_oom;
46526 +
46527 +extern atomic_unchecked_t fscache_n_updates;
46528 +extern atomic_unchecked_t fscache_n_updates_null;
46529 +extern atomic_unchecked_t fscache_n_updates_run;
46530 +
46531 +extern atomic_unchecked_t fscache_n_relinquishes;
46532 +extern atomic_unchecked_t fscache_n_relinquishes_null;
46533 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46534 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
46535 +
46536 +extern atomic_unchecked_t fscache_n_cookie_index;
46537 +extern atomic_unchecked_t fscache_n_cookie_data;
46538 +extern atomic_unchecked_t fscache_n_cookie_special;
46539 +
46540 +extern atomic_unchecked_t fscache_n_object_alloc;
46541 +extern atomic_unchecked_t fscache_n_object_no_alloc;
46542 +extern atomic_unchecked_t fscache_n_object_lookups;
46543 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
46544 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
46545 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
46546 +extern atomic_unchecked_t fscache_n_object_created;
46547 +extern atomic_unchecked_t fscache_n_object_avail;
46548 +extern atomic_unchecked_t fscache_n_object_dead;
46549 +
46550 +extern atomic_unchecked_t fscache_n_checkaux_none;
46551 +extern atomic_unchecked_t fscache_n_checkaux_okay;
46552 +extern atomic_unchecked_t fscache_n_checkaux_update;
46553 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
46554
46555 extern atomic_t fscache_n_cop_alloc_object;
46556 extern atomic_t fscache_n_cop_lookup_object;
46557 @@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
46558 atomic_inc(stat);
46559 }
46560
46561 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
46562 +{
46563 + atomic_inc_unchecked(stat);
46564 +}
46565 +
46566 static inline void fscache_stat_d(atomic_t *stat)
46567 {
46568 atomic_dec(stat);
46569 @@ -267,6 +272,7 @@ extern const struct file_operations fsca
46570
46571 #define __fscache_stat(stat) (NULL)
46572 #define fscache_stat(stat) do {} while (0)
46573 +#define fscache_stat_unchecked(stat) do {} while (0)
46574 #define fscache_stat_d(stat) do {} while (0)
46575 #endif
46576
46577 diff -urNp linux-2.6.39.1/fs/fscache/object.c linux-2.6.39.1/fs/fscache/object.c
46578 --- linux-2.6.39.1/fs/fscache/object.c 2011-05-19 00:06:34.000000000 -0400
46579 +++ linux-2.6.39.1/fs/fscache/object.c 2011-05-22 19:36:32.000000000 -0400
46580 @@ -128,7 +128,7 @@ static void fscache_object_state_machine
46581 /* update the object metadata on disk */
46582 case FSCACHE_OBJECT_UPDATING:
46583 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
46584 - fscache_stat(&fscache_n_updates_run);
46585 + fscache_stat_unchecked(&fscache_n_updates_run);
46586 fscache_stat(&fscache_n_cop_update_object);
46587 object->cache->ops->update_object(object);
46588 fscache_stat_d(&fscache_n_cop_update_object);
46589 @@ -217,7 +217,7 @@ static void fscache_object_state_machine
46590 spin_lock(&object->lock);
46591 object->state = FSCACHE_OBJECT_DEAD;
46592 spin_unlock(&object->lock);
46593 - fscache_stat(&fscache_n_object_dead);
46594 + fscache_stat_unchecked(&fscache_n_object_dead);
46595 goto terminal_transit;
46596
46597 /* handle the parent cache of this object being withdrawn from
46598 @@ -232,7 +232,7 @@ static void fscache_object_state_machine
46599 spin_lock(&object->lock);
46600 object->state = FSCACHE_OBJECT_DEAD;
46601 spin_unlock(&object->lock);
46602 - fscache_stat(&fscache_n_object_dead);
46603 + fscache_stat_unchecked(&fscache_n_object_dead);
46604 goto terminal_transit;
46605
46606 /* complain about the object being woken up once it is
46607 @@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
46608 parent->cookie->def->name, cookie->def->name,
46609 object->cache->tag->name);
46610
46611 - fscache_stat(&fscache_n_object_lookups);
46612 + fscache_stat_unchecked(&fscache_n_object_lookups);
46613 fscache_stat(&fscache_n_cop_lookup_object);
46614 ret = object->cache->ops->lookup_object(object);
46615 fscache_stat_d(&fscache_n_cop_lookup_object);
46616 @@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
46617 if (ret == -ETIMEDOUT) {
46618 /* probably stuck behind another object, so move this one to
46619 * the back of the queue */
46620 - fscache_stat(&fscache_n_object_lookups_timed_out);
46621 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
46622 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46623 }
46624
46625 @@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
46626
46627 spin_lock(&object->lock);
46628 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46629 - fscache_stat(&fscache_n_object_lookups_negative);
46630 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
46631
46632 /* transit here to allow write requests to begin stacking up
46633 * and read requests to begin returning ENODATA */
46634 @@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
46635 * result, in which case there may be data available */
46636 spin_lock(&object->lock);
46637 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46638 - fscache_stat(&fscache_n_object_lookups_positive);
46639 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
46640
46641 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
46642
46643 @@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
46644 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46645 } else {
46646 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
46647 - fscache_stat(&fscache_n_object_created);
46648 + fscache_stat_unchecked(&fscache_n_object_created);
46649
46650 object->state = FSCACHE_OBJECT_AVAILABLE;
46651 spin_unlock(&object->lock);
46652 @@ -602,7 +602,7 @@ static void fscache_object_available(str
46653 fscache_enqueue_dependents(object);
46654
46655 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
46656 - fscache_stat(&fscache_n_object_avail);
46657 + fscache_stat_unchecked(&fscache_n_object_avail);
46658
46659 _leave("");
46660 }
46661 @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
46662 enum fscache_checkaux result;
46663
46664 if (!object->cookie->def->check_aux) {
46665 - fscache_stat(&fscache_n_checkaux_none);
46666 + fscache_stat_unchecked(&fscache_n_checkaux_none);
46667 return FSCACHE_CHECKAUX_OKAY;
46668 }
46669
46670 @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
46671 switch (result) {
46672 /* entry okay as is */
46673 case FSCACHE_CHECKAUX_OKAY:
46674 - fscache_stat(&fscache_n_checkaux_okay);
46675 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
46676 break;
46677
46678 /* entry requires update */
46679 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
46680 - fscache_stat(&fscache_n_checkaux_update);
46681 + fscache_stat_unchecked(&fscache_n_checkaux_update);
46682 break;
46683
46684 /* entry requires deletion */
46685 case FSCACHE_CHECKAUX_OBSOLETE:
46686 - fscache_stat(&fscache_n_checkaux_obsolete);
46687 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
46688 break;
46689
46690 default:
46691 diff -urNp linux-2.6.39.1/fs/fscache/operation.c linux-2.6.39.1/fs/fscache/operation.c
46692 --- linux-2.6.39.1/fs/fscache/operation.c 2011-05-19 00:06:34.000000000 -0400
46693 +++ linux-2.6.39.1/fs/fscache/operation.c 2011-05-22 19:36:32.000000000 -0400
46694 @@ -17,7 +17,7 @@
46695 #include <linux/slab.h>
46696 #include "internal.h"
46697
46698 -atomic_t fscache_op_debug_id;
46699 +atomic_unchecked_t fscache_op_debug_id;
46700 EXPORT_SYMBOL(fscache_op_debug_id);
46701
46702 /**
46703 @@ -40,7 +40,7 @@ void fscache_enqueue_operation(struct fs
46704 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
46705 ASSERTCMP(atomic_read(&op->usage), >, 0);
46706
46707 - fscache_stat(&fscache_n_op_enqueue);
46708 + fscache_stat_unchecked(&fscache_n_op_enqueue);
46709 switch (op->flags & FSCACHE_OP_TYPE) {
46710 case FSCACHE_OP_ASYNC:
46711 _debug("queue async");
46712 @@ -73,7 +73,7 @@ static void fscache_run_op(struct fscach
46713 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
46714 if (op->processor)
46715 fscache_enqueue_operation(op);
46716 - fscache_stat(&fscache_n_op_run);
46717 + fscache_stat_unchecked(&fscache_n_op_run);
46718 }
46719
46720 /*
46721 @@ -104,11 +104,11 @@ int fscache_submit_exclusive_op(struct f
46722 if (object->n_ops > 1) {
46723 atomic_inc(&op->usage);
46724 list_add_tail(&op->pend_link, &object->pending_ops);
46725 - fscache_stat(&fscache_n_op_pend);
46726 + fscache_stat_unchecked(&fscache_n_op_pend);
46727 } else if (!list_empty(&object->pending_ops)) {
46728 atomic_inc(&op->usage);
46729 list_add_tail(&op->pend_link, &object->pending_ops);
46730 - fscache_stat(&fscache_n_op_pend);
46731 + fscache_stat_unchecked(&fscache_n_op_pend);
46732 fscache_start_operations(object);
46733 } else {
46734 ASSERTCMP(object->n_in_progress, ==, 0);
46735 @@ -124,7 +124,7 @@ int fscache_submit_exclusive_op(struct f
46736 object->n_exclusive++; /* reads and writes must wait */
46737 atomic_inc(&op->usage);
46738 list_add_tail(&op->pend_link, &object->pending_ops);
46739 - fscache_stat(&fscache_n_op_pend);
46740 + fscache_stat_unchecked(&fscache_n_op_pend);
46741 ret = 0;
46742 } else {
46743 /* not allowed to submit ops in any other state */
46744 @@ -211,11 +211,11 @@ int fscache_submit_op(struct fscache_obj
46745 if (object->n_exclusive > 0) {
46746 atomic_inc(&op->usage);
46747 list_add_tail(&op->pend_link, &object->pending_ops);
46748 - fscache_stat(&fscache_n_op_pend);
46749 + fscache_stat_unchecked(&fscache_n_op_pend);
46750 } else if (!list_empty(&object->pending_ops)) {
46751 atomic_inc(&op->usage);
46752 list_add_tail(&op->pend_link, &object->pending_ops);
46753 - fscache_stat(&fscache_n_op_pend);
46754 + fscache_stat_unchecked(&fscache_n_op_pend);
46755 fscache_start_operations(object);
46756 } else {
46757 ASSERTCMP(object->n_exclusive, ==, 0);
46758 @@ -227,12 +227,12 @@ int fscache_submit_op(struct fscache_obj
46759 object->n_ops++;
46760 atomic_inc(&op->usage);
46761 list_add_tail(&op->pend_link, &object->pending_ops);
46762 - fscache_stat(&fscache_n_op_pend);
46763 + fscache_stat_unchecked(&fscache_n_op_pend);
46764 ret = 0;
46765 } else if (object->state == FSCACHE_OBJECT_DYING ||
46766 object->state == FSCACHE_OBJECT_LC_DYING ||
46767 object->state == FSCACHE_OBJECT_WITHDRAWING) {
46768 - fscache_stat(&fscache_n_op_rejected);
46769 + fscache_stat_unchecked(&fscache_n_op_rejected);
46770 ret = -ENOBUFS;
46771 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
46772 fscache_report_unexpected_submission(object, op, ostate);
46773 @@ -302,7 +302,7 @@ int fscache_cancel_op(struct fscache_ope
46774
46775 ret = -EBUSY;
46776 if (!list_empty(&op->pend_link)) {
46777 - fscache_stat(&fscache_n_op_cancelled);
46778 + fscache_stat_unchecked(&fscache_n_op_cancelled);
46779 list_del_init(&op->pend_link);
46780 object->n_ops--;
46781 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
46782 @@ -341,7 +341,7 @@ void fscache_put_operation(struct fscach
46783 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
46784 BUG();
46785
46786 - fscache_stat(&fscache_n_op_release);
46787 + fscache_stat_unchecked(&fscache_n_op_release);
46788
46789 if (op->release) {
46790 op->release(op);
46791 @@ -358,7 +358,7 @@ void fscache_put_operation(struct fscach
46792 * lock, and defer it otherwise */
46793 if (!spin_trylock(&object->lock)) {
46794 _debug("defer put");
46795 - fscache_stat(&fscache_n_op_deferred_release);
46796 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
46797
46798 cache = object->cache;
46799 spin_lock(&cache->op_gc_list_lock);
46800 @@ -420,7 +420,7 @@ void fscache_operation_gc(struct work_st
46801
46802 _debug("GC DEFERRED REL OBJ%x OP%x",
46803 object->debug_id, op->debug_id);
46804 - fscache_stat(&fscache_n_op_gc);
46805 + fscache_stat_unchecked(&fscache_n_op_gc);
46806
46807 ASSERTCMP(atomic_read(&op->usage), ==, 0);
46808
46809 diff -urNp linux-2.6.39.1/fs/fscache/page.c linux-2.6.39.1/fs/fscache/page.c
46810 --- linux-2.6.39.1/fs/fscache/page.c 2011-05-19 00:06:34.000000000 -0400
46811 +++ linux-2.6.39.1/fs/fscache/page.c 2011-05-22 19:36:32.000000000 -0400
46812 @@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
46813 val = radix_tree_lookup(&cookie->stores, page->index);
46814 if (!val) {
46815 rcu_read_unlock();
46816 - fscache_stat(&fscache_n_store_vmscan_not_storing);
46817 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
46818 __fscache_uncache_page(cookie, page);
46819 return true;
46820 }
46821 @@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
46822 spin_unlock(&cookie->stores_lock);
46823
46824 if (xpage) {
46825 - fscache_stat(&fscache_n_store_vmscan_cancelled);
46826 - fscache_stat(&fscache_n_store_radix_deletes);
46827 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
46828 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46829 ASSERTCMP(xpage, ==, page);
46830 } else {
46831 - fscache_stat(&fscache_n_store_vmscan_gone);
46832 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
46833 }
46834
46835 wake_up_bit(&cookie->flags, 0);
46836 @@ -107,7 +107,7 @@ page_busy:
46837 /* we might want to wait here, but that could deadlock the allocator as
46838 * the work threads writing to the cache may all end up sleeping
46839 * on memory allocation */
46840 - fscache_stat(&fscache_n_store_vmscan_busy);
46841 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
46842 return false;
46843 }
46844 EXPORT_SYMBOL(__fscache_maybe_release_page);
46845 @@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
46846 FSCACHE_COOKIE_STORING_TAG);
46847 if (!radix_tree_tag_get(&cookie->stores, page->index,
46848 FSCACHE_COOKIE_PENDING_TAG)) {
46849 - fscache_stat(&fscache_n_store_radix_deletes);
46850 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46851 xpage = radix_tree_delete(&cookie->stores, page->index);
46852 }
46853 spin_unlock(&cookie->stores_lock);
46854 @@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
46855
46856 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
46857
46858 - fscache_stat(&fscache_n_attr_changed_calls);
46859 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
46860
46861 if (fscache_object_is_active(object)) {
46862 fscache_set_op_state(op, "CallFS");
46863 @@ -179,11 +179,11 @@ int __fscache_attr_changed(struct fscach
46864
46865 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46866
46867 - fscache_stat(&fscache_n_attr_changed);
46868 + fscache_stat_unchecked(&fscache_n_attr_changed);
46869
46870 op = kzalloc(sizeof(*op), GFP_KERNEL);
46871 if (!op) {
46872 - fscache_stat(&fscache_n_attr_changed_nomem);
46873 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
46874 _leave(" = -ENOMEM");
46875 return -ENOMEM;
46876 }
46877 @@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
46878 if (fscache_submit_exclusive_op(object, op) < 0)
46879 goto nobufs;
46880 spin_unlock(&cookie->lock);
46881 - fscache_stat(&fscache_n_attr_changed_ok);
46882 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
46883 fscache_put_operation(op);
46884 _leave(" = 0");
46885 return 0;
46886 @@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
46887 nobufs:
46888 spin_unlock(&cookie->lock);
46889 kfree(op);
46890 - fscache_stat(&fscache_n_attr_changed_nobufs);
46891 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
46892 _leave(" = %d", -ENOBUFS);
46893 return -ENOBUFS;
46894 }
46895 @@ -246,7 +246,7 @@ static struct fscache_retrieval *fscache
46896 /* allocate a retrieval operation and attempt to submit it */
46897 op = kzalloc(sizeof(*op), GFP_NOIO);
46898 if (!op) {
46899 - fscache_stat(&fscache_n_retrievals_nomem);
46900 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46901 return NULL;
46902 }
46903
46904 @@ -275,13 +275,13 @@ static int fscache_wait_for_deferred_loo
46905 return 0;
46906 }
46907
46908 - fscache_stat(&fscache_n_retrievals_wait);
46909 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
46910
46911 jif = jiffies;
46912 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
46913 fscache_wait_bit_interruptible,
46914 TASK_INTERRUPTIBLE) != 0) {
46915 - fscache_stat(&fscache_n_retrievals_intr);
46916 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46917 _leave(" = -ERESTARTSYS");
46918 return -ERESTARTSYS;
46919 }
46920 @@ -299,8 +299,8 @@ static int fscache_wait_for_deferred_loo
46921 */
46922 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46923 struct fscache_retrieval *op,
46924 - atomic_t *stat_op_waits,
46925 - atomic_t *stat_object_dead)
46926 + atomic_unchecked_t *stat_op_waits,
46927 + atomic_unchecked_t *stat_object_dead)
46928 {
46929 int ret;
46930
46931 @@ -308,7 +308,7 @@ static int fscache_wait_for_retrieval_ac
46932 goto check_if_dead;
46933
46934 _debug(">>> WT");
46935 - fscache_stat(stat_op_waits);
46936 + fscache_stat_unchecked(stat_op_waits);
46937 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
46938 fscache_wait_bit_interruptible,
46939 TASK_INTERRUPTIBLE) < 0) {
46940 @@ -325,7 +325,7 @@ static int fscache_wait_for_retrieval_ac
46941
46942 check_if_dead:
46943 if (unlikely(fscache_object_is_dead(object))) {
46944 - fscache_stat(stat_object_dead);
46945 + fscache_stat_unchecked(stat_object_dead);
46946 return -ENOBUFS;
46947 }
46948 return 0;
46949 @@ -352,7 +352,7 @@ int __fscache_read_or_alloc_page(struct
46950
46951 _enter("%p,%p,,,", cookie, page);
46952
46953 - fscache_stat(&fscache_n_retrievals);
46954 + fscache_stat_unchecked(&fscache_n_retrievals);
46955
46956 if (hlist_empty(&cookie->backing_objects))
46957 goto nobufs;
46958 @@ -386,7 +386,7 @@ int __fscache_read_or_alloc_page(struct
46959 goto nobufs_unlock;
46960 spin_unlock(&cookie->lock);
46961
46962 - fscache_stat(&fscache_n_retrieval_ops);
46963 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
46964
46965 /* pin the netfs read context in case we need to do the actual netfs
46966 * read because we've encountered a cache read failure */
46967 @@ -416,15 +416,15 @@ int __fscache_read_or_alloc_page(struct
46968
46969 error:
46970 if (ret == -ENOMEM)
46971 - fscache_stat(&fscache_n_retrievals_nomem);
46972 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46973 else if (ret == -ERESTARTSYS)
46974 - fscache_stat(&fscache_n_retrievals_intr);
46975 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46976 else if (ret == -ENODATA)
46977 - fscache_stat(&fscache_n_retrievals_nodata);
46978 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46979 else if (ret < 0)
46980 - fscache_stat(&fscache_n_retrievals_nobufs);
46981 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46982 else
46983 - fscache_stat(&fscache_n_retrievals_ok);
46984 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
46985
46986 fscache_put_retrieval(op);
46987 _leave(" = %d", ret);
46988 @@ -434,7 +434,7 @@ nobufs_unlock:
46989 spin_unlock(&cookie->lock);
46990 kfree(op);
46991 nobufs:
46992 - fscache_stat(&fscache_n_retrievals_nobufs);
46993 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46994 _leave(" = -ENOBUFS");
46995 return -ENOBUFS;
46996 }
46997 @@ -472,7 +472,7 @@ int __fscache_read_or_alloc_pages(struct
46998
46999 _enter("%p,,%d,,,", cookie, *nr_pages);
47000
47001 - fscache_stat(&fscache_n_retrievals);
47002 + fscache_stat_unchecked(&fscache_n_retrievals);
47003
47004 if (hlist_empty(&cookie->backing_objects))
47005 goto nobufs;
47006 @@ -503,7 +503,7 @@ int __fscache_read_or_alloc_pages(struct
47007 goto nobufs_unlock;
47008 spin_unlock(&cookie->lock);
47009
47010 - fscache_stat(&fscache_n_retrieval_ops);
47011 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
47012
47013 /* pin the netfs read context in case we need to do the actual netfs
47014 * read because we've encountered a cache read failure */
47015 @@ -533,15 +533,15 @@ int __fscache_read_or_alloc_pages(struct
47016
47017 error:
47018 if (ret == -ENOMEM)
47019 - fscache_stat(&fscache_n_retrievals_nomem);
47020 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
47021 else if (ret == -ERESTARTSYS)
47022 - fscache_stat(&fscache_n_retrievals_intr);
47023 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
47024 else if (ret == -ENODATA)
47025 - fscache_stat(&fscache_n_retrievals_nodata);
47026 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
47027 else if (ret < 0)
47028 - fscache_stat(&fscache_n_retrievals_nobufs);
47029 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47030 else
47031 - fscache_stat(&fscache_n_retrievals_ok);
47032 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
47033
47034 fscache_put_retrieval(op);
47035 _leave(" = %d", ret);
47036 @@ -551,7 +551,7 @@ nobufs_unlock:
47037 spin_unlock(&cookie->lock);
47038 kfree(op);
47039 nobufs:
47040 - fscache_stat(&fscache_n_retrievals_nobufs);
47041 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47042 _leave(" = -ENOBUFS");
47043 return -ENOBUFS;
47044 }
47045 @@ -575,7 +575,7 @@ int __fscache_alloc_page(struct fscache_
47046
47047 _enter("%p,%p,,,", cookie, page);
47048
47049 - fscache_stat(&fscache_n_allocs);
47050 + fscache_stat_unchecked(&fscache_n_allocs);
47051
47052 if (hlist_empty(&cookie->backing_objects))
47053 goto nobufs;
47054 @@ -602,7 +602,7 @@ int __fscache_alloc_page(struct fscache_
47055 goto nobufs_unlock;
47056 spin_unlock(&cookie->lock);
47057
47058 - fscache_stat(&fscache_n_alloc_ops);
47059 + fscache_stat_unchecked(&fscache_n_alloc_ops);
47060
47061 ret = fscache_wait_for_retrieval_activation(
47062 object, op,
47063 @@ -618,11 +618,11 @@ int __fscache_alloc_page(struct fscache_
47064
47065 error:
47066 if (ret == -ERESTARTSYS)
47067 - fscache_stat(&fscache_n_allocs_intr);
47068 + fscache_stat_unchecked(&fscache_n_allocs_intr);
47069 else if (ret < 0)
47070 - fscache_stat(&fscache_n_allocs_nobufs);
47071 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
47072 else
47073 - fscache_stat(&fscache_n_allocs_ok);
47074 + fscache_stat_unchecked(&fscache_n_allocs_ok);
47075
47076 fscache_put_retrieval(op);
47077 _leave(" = %d", ret);
47078 @@ -632,7 +632,7 @@ nobufs_unlock:
47079 spin_unlock(&cookie->lock);
47080 kfree(op);
47081 nobufs:
47082 - fscache_stat(&fscache_n_allocs_nobufs);
47083 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
47084 _leave(" = -ENOBUFS");
47085 return -ENOBUFS;
47086 }
47087 @@ -675,7 +675,7 @@ static void fscache_write_op(struct fsca
47088
47089 spin_lock(&cookie->stores_lock);
47090
47091 - fscache_stat(&fscache_n_store_calls);
47092 + fscache_stat_unchecked(&fscache_n_store_calls);
47093
47094 /* find a page to store */
47095 page = NULL;
47096 @@ -686,7 +686,7 @@ static void fscache_write_op(struct fsca
47097 page = results[0];
47098 _debug("gang %d [%lx]", n, page->index);
47099 if (page->index > op->store_limit) {
47100 - fscache_stat(&fscache_n_store_pages_over_limit);
47101 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
47102 goto superseded;
47103 }
47104
47105 @@ -699,7 +699,7 @@ static void fscache_write_op(struct fsca
47106 spin_unlock(&object->lock);
47107
47108 fscache_set_op_state(&op->op, "Store");
47109 - fscache_stat(&fscache_n_store_pages);
47110 + fscache_stat_unchecked(&fscache_n_store_pages);
47111 fscache_stat(&fscache_n_cop_write_page);
47112 ret = object->cache->ops->write_page(op, page);
47113 fscache_stat_d(&fscache_n_cop_write_page);
47114 @@ -769,7 +769,7 @@ int __fscache_write_page(struct fscache_
47115 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47116 ASSERT(PageFsCache(page));
47117
47118 - fscache_stat(&fscache_n_stores);
47119 + fscache_stat_unchecked(&fscache_n_stores);
47120
47121 op = kzalloc(sizeof(*op), GFP_NOIO);
47122 if (!op)
47123 @@ -821,7 +821,7 @@ int __fscache_write_page(struct fscache_
47124 spin_unlock(&cookie->stores_lock);
47125 spin_unlock(&object->lock);
47126
47127 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
47128 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
47129 op->store_limit = object->store_limit;
47130
47131 if (fscache_submit_op(object, &op->op) < 0)
47132 @@ -829,8 +829,8 @@ int __fscache_write_page(struct fscache_
47133
47134 spin_unlock(&cookie->lock);
47135 radix_tree_preload_end();
47136 - fscache_stat(&fscache_n_store_ops);
47137 - fscache_stat(&fscache_n_stores_ok);
47138 + fscache_stat_unchecked(&fscache_n_store_ops);
47139 + fscache_stat_unchecked(&fscache_n_stores_ok);
47140
47141 /* the work queue now carries its own ref on the object */
47142 fscache_put_operation(&op->op);
47143 @@ -838,14 +838,14 @@ int __fscache_write_page(struct fscache_
47144 return 0;
47145
47146 already_queued:
47147 - fscache_stat(&fscache_n_stores_again);
47148 + fscache_stat_unchecked(&fscache_n_stores_again);
47149 already_pending:
47150 spin_unlock(&cookie->stores_lock);
47151 spin_unlock(&object->lock);
47152 spin_unlock(&cookie->lock);
47153 radix_tree_preload_end();
47154 kfree(op);
47155 - fscache_stat(&fscache_n_stores_ok);
47156 + fscache_stat_unchecked(&fscache_n_stores_ok);
47157 _leave(" = 0");
47158 return 0;
47159
47160 @@ -864,14 +864,14 @@ nobufs:
47161 spin_unlock(&cookie->lock);
47162 radix_tree_preload_end();
47163 kfree(op);
47164 - fscache_stat(&fscache_n_stores_nobufs);
47165 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
47166 _leave(" = -ENOBUFS");
47167 return -ENOBUFS;
47168
47169 nomem_free:
47170 kfree(op);
47171 nomem:
47172 - fscache_stat(&fscache_n_stores_oom);
47173 + fscache_stat_unchecked(&fscache_n_stores_oom);
47174 _leave(" = -ENOMEM");
47175 return -ENOMEM;
47176 }
47177 @@ -889,7 +889,7 @@ void __fscache_uncache_page(struct fscac
47178 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47179 ASSERTCMP(page, !=, NULL);
47180
47181 - fscache_stat(&fscache_n_uncaches);
47182 + fscache_stat_unchecked(&fscache_n_uncaches);
47183
47184 /* cache withdrawal may beat us to it */
47185 if (!PageFsCache(page))
47186 @@ -942,7 +942,7 @@ void fscache_mark_pages_cached(struct fs
47187 unsigned long loop;
47188
47189 #ifdef CONFIG_FSCACHE_STATS
47190 - atomic_add(pagevec->nr, &fscache_n_marks);
47191 + atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
47192 #endif
47193
47194 for (loop = 0; loop < pagevec->nr; loop++) {
47195 diff -urNp linux-2.6.39.1/fs/fscache/stats.c linux-2.6.39.1/fs/fscache/stats.c
47196 --- linux-2.6.39.1/fs/fscache/stats.c 2011-05-19 00:06:34.000000000 -0400
47197 +++ linux-2.6.39.1/fs/fscache/stats.c 2011-05-22 19:36:32.000000000 -0400
47198 @@ -18,95 +18,95 @@
47199 /*
47200 * operation counters
47201 */
47202 -atomic_t fscache_n_op_pend;
47203 -atomic_t fscache_n_op_run;
47204 -atomic_t fscache_n_op_enqueue;
47205 -atomic_t fscache_n_op_requeue;
47206 -atomic_t fscache_n_op_deferred_release;
47207 -atomic_t fscache_n_op_release;
47208 -atomic_t fscache_n_op_gc;
47209 -atomic_t fscache_n_op_cancelled;
47210 -atomic_t fscache_n_op_rejected;
47211 -
47212 -atomic_t fscache_n_attr_changed;
47213 -atomic_t fscache_n_attr_changed_ok;
47214 -atomic_t fscache_n_attr_changed_nobufs;
47215 -atomic_t fscache_n_attr_changed_nomem;
47216 -atomic_t fscache_n_attr_changed_calls;
47217 -
47218 -atomic_t fscache_n_allocs;
47219 -atomic_t fscache_n_allocs_ok;
47220 -atomic_t fscache_n_allocs_wait;
47221 -atomic_t fscache_n_allocs_nobufs;
47222 -atomic_t fscache_n_allocs_intr;
47223 -atomic_t fscache_n_allocs_object_dead;
47224 -atomic_t fscache_n_alloc_ops;
47225 -atomic_t fscache_n_alloc_op_waits;
47226 -
47227 -atomic_t fscache_n_retrievals;
47228 -atomic_t fscache_n_retrievals_ok;
47229 -atomic_t fscache_n_retrievals_wait;
47230 -atomic_t fscache_n_retrievals_nodata;
47231 -atomic_t fscache_n_retrievals_nobufs;
47232 -atomic_t fscache_n_retrievals_intr;
47233 -atomic_t fscache_n_retrievals_nomem;
47234 -atomic_t fscache_n_retrievals_object_dead;
47235 -atomic_t fscache_n_retrieval_ops;
47236 -atomic_t fscache_n_retrieval_op_waits;
47237 -
47238 -atomic_t fscache_n_stores;
47239 -atomic_t fscache_n_stores_ok;
47240 -atomic_t fscache_n_stores_again;
47241 -atomic_t fscache_n_stores_nobufs;
47242 -atomic_t fscache_n_stores_oom;
47243 -atomic_t fscache_n_store_ops;
47244 -atomic_t fscache_n_store_calls;
47245 -atomic_t fscache_n_store_pages;
47246 -atomic_t fscache_n_store_radix_deletes;
47247 -atomic_t fscache_n_store_pages_over_limit;
47248 -
47249 -atomic_t fscache_n_store_vmscan_not_storing;
47250 -atomic_t fscache_n_store_vmscan_gone;
47251 -atomic_t fscache_n_store_vmscan_busy;
47252 -atomic_t fscache_n_store_vmscan_cancelled;
47253 -
47254 -atomic_t fscache_n_marks;
47255 -atomic_t fscache_n_uncaches;
47256 -
47257 -atomic_t fscache_n_acquires;
47258 -atomic_t fscache_n_acquires_null;
47259 -atomic_t fscache_n_acquires_no_cache;
47260 -atomic_t fscache_n_acquires_ok;
47261 -atomic_t fscache_n_acquires_nobufs;
47262 -atomic_t fscache_n_acquires_oom;
47263 -
47264 -atomic_t fscache_n_updates;
47265 -atomic_t fscache_n_updates_null;
47266 -atomic_t fscache_n_updates_run;
47267 -
47268 -atomic_t fscache_n_relinquishes;
47269 -atomic_t fscache_n_relinquishes_null;
47270 -atomic_t fscache_n_relinquishes_waitcrt;
47271 -atomic_t fscache_n_relinquishes_retire;
47272 -
47273 -atomic_t fscache_n_cookie_index;
47274 -atomic_t fscache_n_cookie_data;
47275 -atomic_t fscache_n_cookie_special;
47276 -
47277 -atomic_t fscache_n_object_alloc;
47278 -atomic_t fscache_n_object_no_alloc;
47279 -atomic_t fscache_n_object_lookups;
47280 -atomic_t fscache_n_object_lookups_negative;
47281 -atomic_t fscache_n_object_lookups_positive;
47282 -atomic_t fscache_n_object_lookups_timed_out;
47283 -atomic_t fscache_n_object_created;
47284 -atomic_t fscache_n_object_avail;
47285 -atomic_t fscache_n_object_dead;
47286 -
47287 -atomic_t fscache_n_checkaux_none;
47288 -atomic_t fscache_n_checkaux_okay;
47289 -atomic_t fscache_n_checkaux_update;
47290 -atomic_t fscache_n_checkaux_obsolete;
47291 +atomic_unchecked_t fscache_n_op_pend;
47292 +atomic_unchecked_t fscache_n_op_run;
47293 +atomic_unchecked_t fscache_n_op_enqueue;
47294 +atomic_unchecked_t fscache_n_op_requeue;
47295 +atomic_unchecked_t fscache_n_op_deferred_release;
47296 +atomic_unchecked_t fscache_n_op_release;
47297 +atomic_unchecked_t fscache_n_op_gc;
47298 +atomic_unchecked_t fscache_n_op_cancelled;
47299 +atomic_unchecked_t fscache_n_op_rejected;
47300 +
47301 +atomic_unchecked_t fscache_n_attr_changed;
47302 +atomic_unchecked_t fscache_n_attr_changed_ok;
47303 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
47304 +atomic_unchecked_t fscache_n_attr_changed_nomem;
47305 +atomic_unchecked_t fscache_n_attr_changed_calls;
47306 +
47307 +atomic_unchecked_t fscache_n_allocs;
47308 +atomic_unchecked_t fscache_n_allocs_ok;
47309 +atomic_unchecked_t fscache_n_allocs_wait;
47310 +atomic_unchecked_t fscache_n_allocs_nobufs;
47311 +atomic_unchecked_t fscache_n_allocs_intr;
47312 +atomic_unchecked_t fscache_n_allocs_object_dead;
47313 +atomic_unchecked_t fscache_n_alloc_ops;
47314 +atomic_unchecked_t fscache_n_alloc_op_waits;
47315 +
47316 +atomic_unchecked_t fscache_n_retrievals;
47317 +atomic_unchecked_t fscache_n_retrievals_ok;
47318 +atomic_unchecked_t fscache_n_retrievals_wait;
47319 +atomic_unchecked_t fscache_n_retrievals_nodata;
47320 +atomic_unchecked_t fscache_n_retrievals_nobufs;
47321 +atomic_unchecked_t fscache_n_retrievals_intr;
47322 +atomic_unchecked_t fscache_n_retrievals_nomem;
47323 +atomic_unchecked_t fscache_n_retrievals_object_dead;
47324 +atomic_unchecked_t fscache_n_retrieval_ops;
47325 +atomic_unchecked_t fscache_n_retrieval_op_waits;
47326 +
47327 +atomic_unchecked_t fscache_n_stores;
47328 +atomic_unchecked_t fscache_n_stores_ok;
47329 +atomic_unchecked_t fscache_n_stores_again;
47330 +atomic_unchecked_t fscache_n_stores_nobufs;
47331 +atomic_unchecked_t fscache_n_stores_oom;
47332 +atomic_unchecked_t fscache_n_store_ops;
47333 +atomic_unchecked_t fscache_n_store_calls;
47334 +atomic_unchecked_t fscache_n_store_pages;
47335 +atomic_unchecked_t fscache_n_store_radix_deletes;
47336 +atomic_unchecked_t fscache_n_store_pages_over_limit;
47337 +
47338 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
47339 +atomic_unchecked_t fscache_n_store_vmscan_gone;
47340 +atomic_unchecked_t fscache_n_store_vmscan_busy;
47341 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
47342 +
47343 +atomic_unchecked_t fscache_n_marks;
47344 +atomic_unchecked_t fscache_n_uncaches;
47345 +
47346 +atomic_unchecked_t fscache_n_acquires;
47347 +atomic_unchecked_t fscache_n_acquires_null;
47348 +atomic_unchecked_t fscache_n_acquires_no_cache;
47349 +atomic_unchecked_t fscache_n_acquires_ok;
47350 +atomic_unchecked_t fscache_n_acquires_nobufs;
47351 +atomic_unchecked_t fscache_n_acquires_oom;
47352 +
47353 +atomic_unchecked_t fscache_n_updates;
47354 +atomic_unchecked_t fscache_n_updates_null;
47355 +atomic_unchecked_t fscache_n_updates_run;
47356 +
47357 +atomic_unchecked_t fscache_n_relinquishes;
47358 +atomic_unchecked_t fscache_n_relinquishes_null;
47359 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
47360 +atomic_unchecked_t fscache_n_relinquishes_retire;
47361 +
47362 +atomic_unchecked_t fscache_n_cookie_index;
47363 +atomic_unchecked_t fscache_n_cookie_data;
47364 +atomic_unchecked_t fscache_n_cookie_special;
47365 +
47366 +atomic_unchecked_t fscache_n_object_alloc;
47367 +atomic_unchecked_t fscache_n_object_no_alloc;
47368 +atomic_unchecked_t fscache_n_object_lookups;
47369 +atomic_unchecked_t fscache_n_object_lookups_negative;
47370 +atomic_unchecked_t fscache_n_object_lookups_positive;
47371 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
47372 +atomic_unchecked_t fscache_n_object_created;
47373 +atomic_unchecked_t fscache_n_object_avail;
47374 +atomic_unchecked_t fscache_n_object_dead;
47375 +
47376 +atomic_unchecked_t fscache_n_checkaux_none;
47377 +atomic_unchecked_t fscache_n_checkaux_okay;
47378 +atomic_unchecked_t fscache_n_checkaux_update;
47379 +atomic_unchecked_t fscache_n_checkaux_obsolete;
47380
47381 atomic_t fscache_n_cop_alloc_object;
47382 atomic_t fscache_n_cop_lookup_object;
47383 @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
47384 seq_puts(m, "FS-Cache statistics\n");
47385
47386 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
47387 - atomic_read(&fscache_n_cookie_index),
47388 - atomic_read(&fscache_n_cookie_data),
47389 - atomic_read(&fscache_n_cookie_special));
47390 + atomic_read_unchecked(&fscache_n_cookie_index),
47391 + atomic_read_unchecked(&fscache_n_cookie_data),
47392 + atomic_read_unchecked(&fscache_n_cookie_special));
47393
47394 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
47395 - atomic_read(&fscache_n_object_alloc),
47396 - atomic_read(&fscache_n_object_no_alloc),
47397 - atomic_read(&fscache_n_object_avail),
47398 - atomic_read(&fscache_n_object_dead));
47399 + atomic_read_unchecked(&fscache_n_object_alloc),
47400 + atomic_read_unchecked(&fscache_n_object_no_alloc),
47401 + atomic_read_unchecked(&fscache_n_object_avail),
47402 + atomic_read_unchecked(&fscache_n_object_dead));
47403 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
47404 - atomic_read(&fscache_n_checkaux_none),
47405 - atomic_read(&fscache_n_checkaux_okay),
47406 - atomic_read(&fscache_n_checkaux_update),
47407 - atomic_read(&fscache_n_checkaux_obsolete));
47408 + atomic_read_unchecked(&fscache_n_checkaux_none),
47409 + atomic_read_unchecked(&fscache_n_checkaux_okay),
47410 + atomic_read_unchecked(&fscache_n_checkaux_update),
47411 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
47412
47413 seq_printf(m, "Pages : mrk=%u unc=%u\n",
47414 - atomic_read(&fscache_n_marks),
47415 - atomic_read(&fscache_n_uncaches));
47416 + atomic_read_unchecked(&fscache_n_marks),
47417 + atomic_read_unchecked(&fscache_n_uncaches));
47418
47419 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
47420 " oom=%u\n",
47421 - atomic_read(&fscache_n_acquires),
47422 - atomic_read(&fscache_n_acquires_null),
47423 - atomic_read(&fscache_n_acquires_no_cache),
47424 - atomic_read(&fscache_n_acquires_ok),
47425 - atomic_read(&fscache_n_acquires_nobufs),
47426 - atomic_read(&fscache_n_acquires_oom));
47427 + atomic_read_unchecked(&fscache_n_acquires),
47428 + atomic_read_unchecked(&fscache_n_acquires_null),
47429 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
47430 + atomic_read_unchecked(&fscache_n_acquires_ok),
47431 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
47432 + atomic_read_unchecked(&fscache_n_acquires_oom));
47433
47434 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
47435 - atomic_read(&fscache_n_object_lookups),
47436 - atomic_read(&fscache_n_object_lookups_negative),
47437 - atomic_read(&fscache_n_object_lookups_positive),
47438 - atomic_read(&fscache_n_object_created),
47439 - atomic_read(&fscache_n_object_lookups_timed_out));
47440 + atomic_read_unchecked(&fscache_n_object_lookups),
47441 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
47442 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
47443 + atomic_read_unchecked(&fscache_n_object_created),
47444 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
47445
47446 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
47447 - atomic_read(&fscache_n_updates),
47448 - atomic_read(&fscache_n_updates_null),
47449 - atomic_read(&fscache_n_updates_run));
47450 + atomic_read_unchecked(&fscache_n_updates),
47451 + atomic_read_unchecked(&fscache_n_updates_null),
47452 + atomic_read_unchecked(&fscache_n_updates_run));
47453
47454 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
47455 - atomic_read(&fscache_n_relinquishes),
47456 - atomic_read(&fscache_n_relinquishes_null),
47457 - atomic_read(&fscache_n_relinquishes_waitcrt),
47458 - atomic_read(&fscache_n_relinquishes_retire));
47459 + atomic_read_unchecked(&fscache_n_relinquishes),
47460 + atomic_read_unchecked(&fscache_n_relinquishes_null),
47461 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
47462 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
47463
47464 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
47465 - atomic_read(&fscache_n_attr_changed),
47466 - atomic_read(&fscache_n_attr_changed_ok),
47467 - atomic_read(&fscache_n_attr_changed_nobufs),
47468 - atomic_read(&fscache_n_attr_changed_nomem),
47469 - atomic_read(&fscache_n_attr_changed_calls));
47470 + atomic_read_unchecked(&fscache_n_attr_changed),
47471 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
47472 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
47473 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
47474 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
47475
47476 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
47477 - atomic_read(&fscache_n_allocs),
47478 - atomic_read(&fscache_n_allocs_ok),
47479 - atomic_read(&fscache_n_allocs_wait),
47480 - atomic_read(&fscache_n_allocs_nobufs),
47481 - atomic_read(&fscache_n_allocs_intr));
47482 + atomic_read_unchecked(&fscache_n_allocs),
47483 + atomic_read_unchecked(&fscache_n_allocs_ok),
47484 + atomic_read_unchecked(&fscache_n_allocs_wait),
47485 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
47486 + atomic_read_unchecked(&fscache_n_allocs_intr));
47487 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
47488 - atomic_read(&fscache_n_alloc_ops),
47489 - atomic_read(&fscache_n_alloc_op_waits),
47490 - atomic_read(&fscache_n_allocs_object_dead));
47491 + atomic_read_unchecked(&fscache_n_alloc_ops),
47492 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
47493 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
47494
47495 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
47496 " int=%u oom=%u\n",
47497 - atomic_read(&fscache_n_retrievals),
47498 - atomic_read(&fscache_n_retrievals_ok),
47499 - atomic_read(&fscache_n_retrievals_wait),
47500 - atomic_read(&fscache_n_retrievals_nodata),
47501 - atomic_read(&fscache_n_retrievals_nobufs),
47502 - atomic_read(&fscache_n_retrievals_intr),
47503 - atomic_read(&fscache_n_retrievals_nomem));
47504 + atomic_read_unchecked(&fscache_n_retrievals),
47505 + atomic_read_unchecked(&fscache_n_retrievals_ok),
47506 + atomic_read_unchecked(&fscache_n_retrievals_wait),
47507 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
47508 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
47509 + atomic_read_unchecked(&fscache_n_retrievals_intr),
47510 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
47511 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
47512 - atomic_read(&fscache_n_retrieval_ops),
47513 - atomic_read(&fscache_n_retrieval_op_waits),
47514 - atomic_read(&fscache_n_retrievals_object_dead));
47515 + atomic_read_unchecked(&fscache_n_retrieval_ops),
47516 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
47517 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
47518
47519 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
47520 - atomic_read(&fscache_n_stores),
47521 - atomic_read(&fscache_n_stores_ok),
47522 - atomic_read(&fscache_n_stores_again),
47523 - atomic_read(&fscache_n_stores_nobufs),
47524 - atomic_read(&fscache_n_stores_oom));
47525 + atomic_read_unchecked(&fscache_n_stores),
47526 + atomic_read_unchecked(&fscache_n_stores_ok),
47527 + atomic_read_unchecked(&fscache_n_stores_again),
47528 + atomic_read_unchecked(&fscache_n_stores_nobufs),
47529 + atomic_read_unchecked(&fscache_n_stores_oom));
47530 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
47531 - atomic_read(&fscache_n_store_ops),
47532 - atomic_read(&fscache_n_store_calls),
47533 - atomic_read(&fscache_n_store_pages),
47534 - atomic_read(&fscache_n_store_radix_deletes),
47535 - atomic_read(&fscache_n_store_pages_over_limit));
47536 + atomic_read_unchecked(&fscache_n_store_ops),
47537 + atomic_read_unchecked(&fscache_n_store_calls),
47538 + atomic_read_unchecked(&fscache_n_store_pages),
47539 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
47540 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
47541
47542 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
47543 - atomic_read(&fscache_n_store_vmscan_not_storing),
47544 - atomic_read(&fscache_n_store_vmscan_gone),
47545 - atomic_read(&fscache_n_store_vmscan_busy),
47546 - atomic_read(&fscache_n_store_vmscan_cancelled));
47547 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
47548 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
47549 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
47550 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
47551
47552 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
47553 - atomic_read(&fscache_n_op_pend),
47554 - atomic_read(&fscache_n_op_run),
47555 - atomic_read(&fscache_n_op_enqueue),
47556 - atomic_read(&fscache_n_op_cancelled),
47557 - atomic_read(&fscache_n_op_rejected));
47558 + atomic_read_unchecked(&fscache_n_op_pend),
47559 + atomic_read_unchecked(&fscache_n_op_run),
47560 + atomic_read_unchecked(&fscache_n_op_enqueue),
47561 + atomic_read_unchecked(&fscache_n_op_cancelled),
47562 + atomic_read_unchecked(&fscache_n_op_rejected));
47563 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
47564 - atomic_read(&fscache_n_op_deferred_release),
47565 - atomic_read(&fscache_n_op_release),
47566 - atomic_read(&fscache_n_op_gc));
47567 + atomic_read_unchecked(&fscache_n_op_deferred_release),
47568 + atomic_read_unchecked(&fscache_n_op_release),
47569 + atomic_read_unchecked(&fscache_n_op_gc));
47570
47571 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
47572 atomic_read(&fscache_n_cop_alloc_object),
47573 diff -urNp linux-2.6.39.1/fs/fs_struct.c linux-2.6.39.1/fs/fs_struct.c
47574 --- linux-2.6.39.1/fs/fs_struct.c 2011-05-19 00:06:34.000000000 -0400
47575 +++ linux-2.6.39.1/fs/fs_struct.c 2011-05-22 19:41:37.000000000 -0400
47576 @@ -4,6 +4,7 @@
47577 #include <linux/path.h>
47578 #include <linux/slab.h>
47579 #include <linux/fs_struct.h>
47580 +#include <linux/grsecurity.h>
47581 #include "internal.h"
47582
47583 static inline void path_get_longterm(struct path *path)
47584 @@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s
47585 old_root = fs->root;
47586 fs->root = *path;
47587 path_get_longterm(path);
47588 + gr_set_chroot_entries(current, path);
47589 write_seqcount_end(&fs->seq);
47590 spin_unlock(&fs->lock);
47591 if (old_root.dentry)
47592 @@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo
47593 && fs->root.mnt == old_root->mnt) {
47594 path_get_longterm(new_root);
47595 fs->root = *new_root;
47596 + gr_set_chroot_entries(p, new_root);
47597 count++;
47598 }
47599 if (fs->pwd.dentry == old_root->dentry
47600 @@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
47601 spin_lock(&fs->lock);
47602 write_seqcount_begin(&fs->seq);
47603 tsk->fs = NULL;
47604 - kill = !--fs->users;
47605 + gr_clear_chroot_entries(tsk);
47606 + kill = !atomic_dec_return(&fs->users);
47607 write_seqcount_end(&fs->seq);
47608 spin_unlock(&fs->lock);
47609 task_unlock(tsk);
47610 @@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct
47611 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
47612 /* We don't need to lock fs - think why ;-) */
47613 if (fs) {
47614 - fs->users = 1;
47615 + atomic_set(&fs->users, 1);
47616 fs->in_exec = 0;
47617 spin_lock_init(&fs->lock);
47618 seqcount_init(&fs->seq);
47619 @@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct
47620 spin_lock(&old->lock);
47621 fs->root = old->root;
47622 path_get_longterm(&fs->root);
47623 + /* instead of calling gr_set_chroot_entries here,
47624 + we call it from every caller of this function
47625 + */
47626 fs->pwd = old->pwd;
47627 path_get_longterm(&fs->pwd);
47628 spin_unlock(&old->lock);
47629 @@ -150,8 +157,9 @@ int unshare_fs_struct(void)
47630
47631 task_lock(current);
47632 spin_lock(&fs->lock);
47633 - kill = !--fs->users;
47634 + kill = !atomic_dec_return(&fs->users);
47635 current->fs = new_fs;
47636 + gr_set_chroot_entries(current, &new_fs->root);
47637 spin_unlock(&fs->lock);
47638 task_unlock(current);
47639
47640 @@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
47641
47642 /* to be mentioned only in INIT_TASK */
47643 struct fs_struct init_fs = {
47644 - .users = 1,
47645 + .users = ATOMIC_INIT(1),
47646 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
47647 .seq = SEQCNT_ZERO,
47648 .umask = 0022,
47649 @@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
47650 task_lock(current);
47651
47652 spin_lock(&init_fs.lock);
47653 - init_fs.users++;
47654 + atomic_inc(&init_fs.users);
47655 spin_unlock(&init_fs.lock);
47656
47657 spin_lock(&fs->lock);
47658 current->fs = &init_fs;
47659 - kill = !--fs->users;
47660 + gr_set_chroot_entries(current, &current->fs->root);
47661 + kill = !atomic_dec_return(&fs->users);
47662 spin_unlock(&fs->lock);
47663
47664 task_unlock(current);
47665 diff -urNp linux-2.6.39.1/fs/fuse/cuse.c linux-2.6.39.1/fs/fuse/cuse.c
47666 --- linux-2.6.39.1/fs/fuse/cuse.c 2011-05-19 00:06:34.000000000 -0400
47667 +++ linux-2.6.39.1/fs/fuse/cuse.c 2011-05-22 19:36:32.000000000 -0400
47668 @@ -538,8 +538,18 @@ static int cuse_channel_release(struct i
47669 return rc;
47670 }
47671
47672 -static struct file_operations cuse_channel_fops; /* initialized during init */
47673 -
47674 +static const struct file_operations cuse_channel_fops = { /* initialized during init */
47675 + .owner = THIS_MODULE,
47676 + .llseek = no_llseek,
47677 + .read = do_sync_read,
47678 + .aio_read = fuse_dev_read,
47679 + .write = do_sync_write,
47680 + .aio_write = fuse_dev_write,
47681 + .poll = fuse_dev_poll,
47682 + .open = cuse_channel_open,
47683 + .release = cuse_channel_release,
47684 + .fasync = fuse_dev_fasync,
47685 +};
47686
47687 /**************************************************************************
47688 * Misc stuff and module initializatiion
47689 @@ -585,12 +595,6 @@ static int __init cuse_init(void)
47690 for (i = 0; i < CUSE_CONNTBL_LEN; i++)
47691 INIT_LIST_HEAD(&cuse_conntbl[i]);
47692
47693 - /* inherit and extend fuse_dev_operations */
47694 - cuse_channel_fops = fuse_dev_operations;
47695 - cuse_channel_fops.owner = THIS_MODULE;
47696 - cuse_channel_fops.open = cuse_channel_open;
47697 - cuse_channel_fops.release = cuse_channel_release;
47698 -
47699 cuse_class = class_create(THIS_MODULE, "cuse");
47700 if (IS_ERR(cuse_class))
47701 return PTR_ERR(cuse_class);
47702 diff -urNp linux-2.6.39.1/fs/fuse/dev.c linux-2.6.39.1/fs/fuse/dev.c
47703 --- linux-2.6.39.1/fs/fuse/dev.c 2011-05-19 00:06:34.000000000 -0400
47704 +++ linux-2.6.39.1/fs/fuse/dev.c 2011-05-22 19:36:32.000000000 -0400
47705 @@ -1181,7 +1181,7 @@ static ssize_t fuse_dev_do_read(struct f
47706 return err;
47707 }
47708
47709 -static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47710 +ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47711 unsigned long nr_segs, loff_t pos)
47712 {
47713 struct fuse_copy_state cs;
47714 @@ -1195,6 +1195,8 @@ static ssize_t fuse_dev_read(struct kioc
47715 return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
47716 }
47717
47718 +EXPORT_SYMBOL_GPL(fuse_dev_read);
47719 +
47720 static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
47721 struct pipe_buffer *buf)
47722 {
47723 @@ -1238,7 +1240,7 @@ static ssize_t fuse_dev_splice_read(stru
47724 ret = 0;
47725 pipe_lock(pipe);
47726
47727 - if (!pipe->readers) {
47728 + if (!atomic_read(&pipe->readers)) {
47729 send_sig(SIGPIPE, current, 0);
47730 if (!ret)
47731 ret = -EPIPE;
47732 @@ -1731,7 +1733,7 @@ static ssize_t fuse_dev_do_write(struct
47733 return err;
47734 }
47735
47736 -static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47737 +ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47738 unsigned long nr_segs, loff_t pos)
47739 {
47740 struct fuse_copy_state cs;
47741 @@ -1744,6 +1746,8 @@ static ssize_t fuse_dev_write(struct kio
47742 return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
47743 }
47744
47745 +EXPORT_SYMBOL_GPL(fuse_dev_write);
47746 +
47747 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
47748 struct file *out, loff_t *ppos,
47749 size_t len, unsigned int flags)
47750 @@ -1822,7 +1826,7 @@ out:
47751 return ret;
47752 }
47753
47754 -static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47755 +unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47756 {
47757 unsigned mask = POLLOUT | POLLWRNORM;
47758 struct fuse_conn *fc = fuse_get_conn(file);
47759 @@ -1841,6 +1845,8 @@ static unsigned fuse_dev_poll(struct fil
47760 return mask;
47761 }
47762
47763 +EXPORT_SYMBOL_GPL(fuse_dev_poll);
47764 +
47765 /*
47766 * Abort all requests on the given list (pending or processing)
47767 *
47768 @@ -1977,7 +1983,7 @@ int fuse_dev_release(struct inode *inode
47769 }
47770 EXPORT_SYMBOL_GPL(fuse_dev_release);
47771
47772 -static int fuse_dev_fasync(int fd, struct file *file, int on)
47773 +int fuse_dev_fasync(int fd, struct file *file, int on)
47774 {
47775 struct fuse_conn *fc = fuse_get_conn(file);
47776 if (!fc)
47777 @@ -1987,6 +1993,8 @@ static int fuse_dev_fasync(int fd, struc
47778 return fasync_helper(fd, file, on, &fc->fasync);
47779 }
47780
47781 +EXPORT_SYMBOL_GPL(fuse_dev_fasync);
47782 +
47783 const struct file_operations fuse_dev_operations = {
47784 .owner = THIS_MODULE,
47785 .llseek = no_llseek,
47786 diff -urNp linux-2.6.39.1/fs/fuse/dir.c linux-2.6.39.1/fs/fuse/dir.c
47787 --- linux-2.6.39.1/fs/fuse/dir.c 2011-05-19 00:06:34.000000000 -0400
47788 +++ linux-2.6.39.1/fs/fuse/dir.c 2011-05-22 19:36:32.000000000 -0400
47789 @@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *de
47790 return link;
47791 }
47792
47793 -static void free_link(char *link)
47794 +static void free_link(const char *link)
47795 {
47796 if (!IS_ERR(link))
47797 free_page((unsigned long) link);
47798 diff -urNp linux-2.6.39.1/fs/fuse/fuse_i.h linux-2.6.39.1/fs/fuse/fuse_i.h
47799 --- linux-2.6.39.1/fs/fuse/fuse_i.h 2011-05-19 00:06:34.000000000 -0400
47800 +++ linux-2.6.39.1/fs/fuse/fuse_i.h 2011-05-22 19:36:32.000000000 -0400
47801 @@ -540,6 +540,16 @@ extern const struct file_operations fuse
47802
47803 extern const struct dentry_operations fuse_dentry_operations;
47804
47805 +extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47806 + unsigned long nr_segs, loff_t pos);
47807 +
47808 +extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47809 + unsigned long nr_segs, loff_t pos);
47810 +
47811 +extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
47812 +
47813 +extern int fuse_dev_fasync(int fd, struct file *file, int on);
47814 +
47815 /**
47816 * Inode to nodeid comparison.
47817 */
47818 diff -urNp linux-2.6.39.1/fs/gfs2/ops_inode.c linux-2.6.39.1/fs/gfs2/ops_inode.c
47819 --- linux-2.6.39.1/fs/gfs2/ops_inode.c 2011-05-19 00:06:34.000000000 -0400
47820 +++ linux-2.6.39.1/fs/gfs2/ops_inode.c 2011-05-22 19:36:32.000000000 -0400
47821 @@ -740,6 +740,8 @@ static int gfs2_rename(struct inode *odi
47822 unsigned int x;
47823 int error;
47824
47825 + pax_track_stack();
47826 +
47827 if (ndentry->d_inode) {
47828 nip = GFS2_I(ndentry->d_inode);
47829 if (ip == nip)
47830 @@ -1019,7 +1021,7 @@ out:
47831
47832 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
47833 {
47834 - char *s = nd_get_link(nd);
47835 + const char *s = nd_get_link(nd);
47836 if (!IS_ERR(s))
47837 kfree(s);
47838 }
47839 diff -urNp linux-2.6.39.1/fs/hfsplus/catalog.c linux-2.6.39.1/fs/hfsplus/catalog.c
47840 --- linux-2.6.39.1/fs/hfsplus/catalog.c 2011-05-19 00:06:34.000000000 -0400
47841 +++ linux-2.6.39.1/fs/hfsplus/catalog.c 2011-05-22 19:36:32.000000000 -0400
47842 @@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block
47843 int err;
47844 u16 type;
47845
47846 + pax_track_stack();
47847 +
47848 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
47849 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
47850 if (err)
47851 @@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct
47852 int entry_size;
47853 int err;
47854
47855 + pax_track_stack();
47856 +
47857 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
47858 str->name, cnid, inode->i_nlink);
47859 hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
47860 @@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
47861 int entry_size, type;
47862 int err = 0;
47863
47864 + pax_track_stack();
47865 +
47866 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
47867 cnid, src_dir->i_ino, src_name->name,
47868 dst_dir->i_ino, dst_name->name);
47869 diff -urNp linux-2.6.39.1/fs/hfsplus/dir.c linux-2.6.39.1/fs/hfsplus/dir.c
47870 --- linux-2.6.39.1/fs/hfsplus/dir.c 2011-05-19 00:06:34.000000000 -0400
47871 +++ linux-2.6.39.1/fs/hfsplus/dir.c 2011-05-22 19:36:32.000000000 -0400
47872 @@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
47873 struct hfsplus_readdir_data *rd;
47874 u16 type;
47875
47876 + pax_track_stack();
47877 +
47878 if (filp->f_pos >= inode->i_size)
47879 return 0;
47880
47881 diff -urNp linux-2.6.39.1/fs/hfsplus/inode.c linux-2.6.39.1/fs/hfsplus/inode.c
47882 --- linux-2.6.39.1/fs/hfsplus/inode.c 2011-05-19 00:06:34.000000000 -0400
47883 +++ linux-2.6.39.1/fs/hfsplus/inode.c 2011-05-22 19:36:32.000000000 -0400
47884 @@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode
47885 int res = 0;
47886 u16 type;
47887
47888 + pax_track_stack();
47889 +
47890 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
47891
47892 HFSPLUS_I(inode)->linkid = 0;
47893 @@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode
47894 struct hfs_find_data fd;
47895 hfsplus_cat_entry entry;
47896
47897 + pax_track_stack();
47898 +
47899 if (HFSPLUS_IS_RSRC(inode))
47900 main_inode = HFSPLUS_I(inode)->rsrc_inode;
47901
47902 diff -urNp linux-2.6.39.1/fs/hfsplus/ioctl.c linux-2.6.39.1/fs/hfsplus/ioctl.c
47903 --- linux-2.6.39.1/fs/hfsplus/ioctl.c 2011-05-19 00:06:34.000000000 -0400
47904 +++ linux-2.6.39.1/fs/hfsplus/ioctl.c 2011-05-22 19:36:32.000000000 -0400
47905 @@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
47906 struct hfsplus_cat_file *file;
47907 int res;
47908
47909 + pax_track_stack();
47910 +
47911 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47912 return -EOPNOTSUPP;
47913
47914 @@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
47915 struct hfsplus_cat_file *file;
47916 ssize_t res = 0;
47917
47918 + pax_track_stack();
47919 +
47920 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47921 return -EOPNOTSUPP;
47922
47923 diff -urNp linux-2.6.39.1/fs/hfsplus/super.c linux-2.6.39.1/fs/hfsplus/super.c
47924 --- linux-2.6.39.1/fs/hfsplus/super.c 2011-05-19 00:06:34.000000000 -0400
47925 +++ linux-2.6.39.1/fs/hfsplus/super.c 2011-05-22 19:36:32.000000000 -0400
47926 @@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
47927 struct nls_table *nls = NULL;
47928 int err;
47929
47930 + pax_track_stack();
47931 +
47932 err = -EINVAL;
47933 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
47934 if (!sbi)
47935 diff -urNp linux-2.6.39.1/fs/hugetlbfs/inode.c linux-2.6.39.1/fs/hugetlbfs/inode.c
47936 --- linux-2.6.39.1/fs/hugetlbfs/inode.c 2011-05-19 00:06:34.000000000 -0400
47937 +++ linux-2.6.39.1/fs/hugetlbfs/inode.c 2011-05-22 19:41:37.000000000 -0400
47938 @@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs
47939 .kill_sb = kill_litter_super,
47940 };
47941
47942 -static struct vfsmount *hugetlbfs_vfsmount;
47943 +struct vfsmount *hugetlbfs_vfsmount;
47944
47945 static int can_do_hugetlb_shm(void)
47946 {
47947 diff -urNp linux-2.6.39.1/fs/inode.c linux-2.6.39.1/fs/inode.c
47948 --- linux-2.6.39.1/fs/inode.c 2011-05-19 00:06:34.000000000 -0400
47949 +++ linux-2.6.39.1/fs/inode.c 2011-05-22 19:36:32.000000000 -0400
47950 @@ -862,8 +862,8 @@ unsigned int get_next_ino(void)
47951
47952 #ifdef CONFIG_SMP
47953 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
47954 - static atomic_t shared_last_ino;
47955 - int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
47956 + static atomic_unchecked_t shared_last_ino;
47957 + int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
47958
47959 res = next - LAST_INO_BATCH;
47960 }
47961 diff -urNp linux-2.6.39.1/fs/jbd/checkpoint.c linux-2.6.39.1/fs/jbd/checkpoint.c
47962 --- linux-2.6.39.1/fs/jbd/checkpoint.c 2011-05-19 00:06:34.000000000 -0400
47963 +++ linux-2.6.39.1/fs/jbd/checkpoint.c 2011-05-22 19:36:32.000000000 -0400
47964 @@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
47965 tid_t this_tid;
47966 int result;
47967
47968 + pax_track_stack();
47969 +
47970 jbd_debug(1, "Start checkpoint\n");
47971
47972 /*
47973 diff -urNp linux-2.6.39.1/fs/jffs2/compr_rtime.c linux-2.6.39.1/fs/jffs2/compr_rtime.c
47974 --- linux-2.6.39.1/fs/jffs2/compr_rtime.c 2011-05-19 00:06:34.000000000 -0400
47975 +++ linux-2.6.39.1/fs/jffs2/compr_rtime.c 2011-05-22 19:36:32.000000000 -0400
47976 @@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
47977 int outpos = 0;
47978 int pos=0;
47979
47980 + pax_track_stack();
47981 +
47982 memset(positions,0,sizeof(positions));
47983
47984 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
47985 @@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
47986 int outpos = 0;
47987 int pos=0;
47988
47989 + pax_track_stack();
47990 +
47991 memset(positions,0,sizeof(positions));
47992
47993 while (outpos<destlen) {
47994 diff -urNp linux-2.6.39.1/fs/jffs2/compr_rubin.c linux-2.6.39.1/fs/jffs2/compr_rubin.c
47995 --- linux-2.6.39.1/fs/jffs2/compr_rubin.c 2011-05-19 00:06:34.000000000 -0400
47996 +++ linux-2.6.39.1/fs/jffs2/compr_rubin.c 2011-05-22 19:36:32.000000000 -0400
47997 @@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
47998 int ret;
47999 uint32_t mysrclen, mydstlen;
48000
48001 + pax_track_stack();
48002 +
48003 mysrclen = *sourcelen;
48004 mydstlen = *dstlen - 8;
48005
48006 diff -urNp linux-2.6.39.1/fs/jffs2/erase.c linux-2.6.39.1/fs/jffs2/erase.c
48007 --- linux-2.6.39.1/fs/jffs2/erase.c 2011-05-19 00:06:34.000000000 -0400
48008 +++ linux-2.6.39.1/fs/jffs2/erase.c 2011-05-22 19:36:32.000000000 -0400
48009 @@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
48010 struct jffs2_unknown_node marker = {
48011 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
48012 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
48013 - .totlen = cpu_to_je32(c->cleanmarker_size)
48014 + .totlen = cpu_to_je32(c->cleanmarker_size),
48015 + .hdr_crc = cpu_to_je32(0)
48016 };
48017
48018 jffs2_prealloc_raw_node_refs(c, jeb, 1);
48019 diff -urNp linux-2.6.39.1/fs/jffs2/wbuf.c linux-2.6.39.1/fs/jffs2/wbuf.c
48020 --- linux-2.6.39.1/fs/jffs2/wbuf.c 2011-05-19 00:06:34.000000000 -0400
48021 +++ linux-2.6.39.1/fs/jffs2/wbuf.c 2011-05-22 19:36:32.000000000 -0400
48022 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
48023 {
48024 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
48025 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
48026 - .totlen = constant_cpu_to_je32(8)
48027 + .totlen = constant_cpu_to_je32(8),
48028 + .hdr_crc = constant_cpu_to_je32(0)
48029 };
48030
48031 /*
48032 diff -urNp linux-2.6.39.1/fs/jffs2/xattr.c linux-2.6.39.1/fs/jffs2/xattr.c
48033 --- linux-2.6.39.1/fs/jffs2/xattr.c 2011-05-19 00:06:34.000000000 -0400
48034 +++ linux-2.6.39.1/fs/jffs2/xattr.c 2011-05-22 19:36:32.000000000 -0400
48035 @@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
48036
48037 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
48038
48039 + pax_track_stack();
48040 +
48041 /* Phase.1 : Merge same xref */
48042 for (i=0; i < XREF_TMPHASH_SIZE; i++)
48043 xref_tmphash[i] = NULL;
48044 diff -urNp linux-2.6.39.1/fs/jfs/super.c linux-2.6.39.1/fs/jfs/super.c
48045 --- linux-2.6.39.1/fs/jfs/super.c 2011-05-19 00:06:34.000000000 -0400
48046 +++ linux-2.6.39.1/fs/jfs/super.c 2011-06-07 18:07:24.000000000 -0400
48047 @@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
48048
48049 jfs_inode_cachep =
48050 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
48051 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
48052 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
48053 init_once);
48054 if (jfs_inode_cachep == NULL)
48055 return -ENOMEM;
48056 diff -urNp linux-2.6.39.1/fs/Kconfig.binfmt linux-2.6.39.1/fs/Kconfig.binfmt
48057 --- linux-2.6.39.1/fs/Kconfig.binfmt 2011-05-19 00:06:34.000000000 -0400
48058 +++ linux-2.6.39.1/fs/Kconfig.binfmt 2011-05-22 19:36:32.000000000 -0400
48059 @@ -86,7 +86,7 @@ config HAVE_AOUT
48060
48061 config BINFMT_AOUT
48062 tristate "Kernel support for a.out and ECOFF binaries"
48063 - depends on HAVE_AOUT
48064 + depends on HAVE_AOUT && BROKEN
48065 ---help---
48066 A.out (Assembler.OUTput) is a set of formats for libraries and
48067 executables used in the earliest versions of UNIX. Linux used
48068 diff -urNp linux-2.6.39.1/fs/libfs.c linux-2.6.39.1/fs/libfs.c
48069 --- linux-2.6.39.1/fs/libfs.c 2011-05-19 00:06:34.000000000 -0400
48070 +++ linux-2.6.39.1/fs/libfs.c 2011-05-22 19:36:32.000000000 -0400
48071 @@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
48072
48073 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
48074 struct dentry *next;
48075 + char d_name[sizeof(next->d_iname)];
48076 + const unsigned char *name;
48077 +
48078 next = list_entry(p, struct dentry, d_u.d_child);
48079 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
48080 if (!simple_positive(next)) {
48081 @@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
48082
48083 spin_unlock(&next->d_lock);
48084 spin_unlock(&dentry->d_lock);
48085 - if (filldir(dirent, next->d_name.name,
48086 + name = next->d_name.name;
48087 + if (name == next->d_iname) {
48088 + memcpy(d_name, name, next->d_name.len);
48089 + name = d_name;
48090 + }
48091 + if (filldir(dirent, name,
48092 next->d_name.len, filp->f_pos,
48093 next->d_inode->i_ino,
48094 dt_type(next->d_inode)) < 0)
48095 diff -urNp linux-2.6.39.1/fs/lockd/clntproc.c linux-2.6.39.1/fs/lockd/clntproc.c
48096 --- linux-2.6.39.1/fs/lockd/clntproc.c 2011-05-19 00:06:34.000000000 -0400
48097 +++ linux-2.6.39.1/fs/lockd/clntproc.c 2011-05-22 19:36:32.000000000 -0400
48098 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
48099 /*
48100 * Cookie counter for NLM requests
48101 */
48102 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
48103 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
48104
48105 void nlmclnt_next_cookie(struct nlm_cookie *c)
48106 {
48107 - u32 cookie = atomic_inc_return(&nlm_cookie);
48108 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
48109
48110 memcpy(c->data, &cookie, 4);
48111 c->len=4;
48112 @@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
48113 struct nlm_rqst reqst, *req;
48114 int status;
48115
48116 + pax_track_stack();
48117 +
48118 req = &reqst;
48119 memset(req, 0, sizeof(*req));
48120 locks_init_lock(&req->a_args.lock.fl);
48121 diff -urNp linux-2.6.39.1/fs/lockd/svc.c linux-2.6.39.1/fs/lockd/svc.c
48122 --- linux-2.6.39.1/fs/lockd/svc.c 2011-05-19 00:06:34.000000000 -0400
48123 +++ linux-2.6.39.1/fs/lockd/svc.c 2011-05-22 19:36:32.000000000 -0400
48124 @@ -41,7 +41,7 @@
48125
48126 static struct svc_program nlmsvc_program;
48127
48128 -struct nlmsvc_binding * nlmsvc_ops;
48129 +const struct nlmsvc_binding * nlmsvc_ops;
48130 EXPORT_SYMBOL_GPL(nlmsvc_ops);
48131
48132 static DEFINE_MUTEX(nlmsvc_mutex);
48133 diff -urNp linux-2.6.39.1/fs/locks.c linux-2.6.39.1/fs/locks.c
48134 --- linux-2.6.39.1/fs/locks.c 2011-05-19 00:06:34.000000000 -0400
48135 +++ linux-2.6.39.1/fs/locks.c 2011-05-22 19:36:32.000000000 -0400
48136 @@ -2033,16 +2033,16 @@ void locks_remove_flock(struct file *fil
48137 return;
48138
48139 if (filp->f_op && filp->f_op->flock) {
48140 - struct file_lock fl = {
48141 + struct file_lock flock = {
48142 .fl_pid = current->tgid,
48143 .fl_file = filp,
48144 .fl_flags = FL_FLOCK,
48145 .fl_type = F_UNLCK,
48146 .fl_end = OFFSET_MAX,
48147 };
48148 - filp->f_op->flock(filp, F_SETLKW, &fl);
48149 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
48150 - fl.fl_ops->fl_release_private(&fl);
48151 + filp->f_op->flock(filp, F_SETLKW, &flock);
48152 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
48153 + flock.fl_ops->fl_release_private(&flock);
48154 }
48155
48156 lock_flocks();
48157 diff -urNp linux-2.6.39.1/fs/logfs/super.c linux-2.6.39.1/fs/logfs/super.c
48158 --- linux-2.6.39.1/fs/logfs/super.c 2011-05-19 00:06:34.000000000 -0400
48159 +++ linux-2.6.39.1/fs/logfs/super.c 2011-05-22 19:36:32.000000000 -0400
48160 @@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
48161 struct logfs_disk_super _ds1, *ds1 = &_ds1;
48162 int err, valid0, valid1;
48163
48164 + pax_track_stack();
48165 +
48166 /* read first superblock */
48167 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
48168 if (err)
48169 diff -urNp linux-2.6.39.1/fs/namei.c linux-2.6.39.1/fs/namei.c
48170 --- linux-2.6.39.1/fs/namei.c 2011-06-03 00:04:14.000000000 -0400
48171 +++ linux-2.6.39.1/fs/namei.c 2011-06-03 00:32:07.000000000 -0400
48172 @@ -237,20 +237,30 @@ int generic_permission(struct inode *ino
48173 return ret;
48174
48175 /*
48176 - * Read/write DACs are always overridable.
48177 - * Executable DACs are overridable if at least one exec bit is set.
48178 + * Searching includes executable on directories, else just read.
48179 */
48180 - if (!(mask & MAY_EXEC) || execute_ok(inode))
48181 - if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48182 + mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48183 + if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
48184 +#ifdef CONFIG_GRKERNSEC
48185 + if (flags & IPERM_FLAG_RCU)
48186 + return -ECHILD;
48187 +#endif
48188 + if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48189 return 0;
48190 + }
48191
48192 /*
48193 - * Searching includes executable on directories, else just read.
48194 + * Read/write DACs are always overridable.
48195 + * Executable DACs are overridable if at least one exec bit is set.
48196 */
48197 - mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48198 - if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
48199 - if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48200 + if (!(mask & MAY_EXEC) || execute_ok(inode)) {
48201 +#ifdef CONFIG_GRKERNSEC
48202 + if (flags & IPERM_FLAG_RCU)
48203 + return -ECHILD;
48204 +#endif
48205 + if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48206 return 0;
48207 + }
48208
48209 return -EACCES;
48210 }
48211 @@ -626,6 +636,9 @@ static inline int handle_reval_path(stru
48212 struct dentry *dentry = nd->path.dentry;
48213 int status;
48214
48215 + if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
48216 + return -ENOENT;
48217 +
48218 if (likely(!(nd->flags & LOOKUP_JUMPED)))
48219 return 0;
48220
48221 @@ -671,9 +684,16 @@ static inline int exec_permission(struct
48222 if (ret == -ECHILD)
48223 return ret;
48224
48225 - if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
48226 - ns_capable(ns, CAP_DAC_READ_SEARCH))
48227 + if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE))
48228 goto ok;
48229 + else {
48230 +#ifdef CONFIG_GRKERNSEC
48231 + if (flags & IPERM_FLAG_RCU)
48232 + return -ECHILD;
48233 +#endif
48234 + if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE))
48235 + goto ok;
48236 + }
48237
48238 return ret;
48239 ok:
48240 @@ -781,11 +801,19 @@ follow_link(struct path *link, struct na
48241 return error;
48242 }
48243
48244 + if (gr_handle_follow_link(dentry->d_parent->d_inode,
48245 + dentry->d_inode, dentry, nd->path.mnt)) {
48246 + error = -EACCES;
48247 + *p = ERR_PTR(error); /* no ->put_link(), please */
48248 + path_put(&nd->path);
48249 + return error;
48250 + }
48251 +
48252 nd->last_type = LAST_BIND;
48253 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
48254 error = PTR_ERR(*p);
48255 if (!IS_ERR(*p)) {
48256 - char *s = nd_get_link(nd);
48257 + const char *s = nd_get_link(nd);
48258 error = 0;
48259 if (s)
48260 error = __vfs_follow_link(nd, s);
48261 @@ -1697,6 +1725,9 @@ static int do_path_lookup(int dfd, const
48262 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
48263
48264 if (likely(!retval)) {
48265 + if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
48266 + return -ENOENT;
48267 +
48268 if (unlikely(!audit_dummy_context())) {
48269 if (nd->path.dentry && nd->inode)
48270 audit_inode(name, nd->path.dentry);
48271 @@ -2007,6 +2038,30 @@ int vfs_create(struct inode *dir, struct
48272 return error;
48273 }
48274
48275 +/*
48276 + * Note that while the flag value (low two bits) for sys_open means:
48277 + * 00 - read-only
48278 + * 01 - write-only
48279 + * 10 - read-write
48280 + * 11 - special
48281 + * it is changed into
48282 + * 00 - no permissions needed
48283 + * 01 - read-permission
48284 + * 10 - write-permission
48285 + * 11 - read-write
48286 + * for the internal routines (ie open_namei()/follow_link() etc)
48287 + * This is more logical, and also allows the 00 "no perm needed"
48288 + * to be used for symlinks (where the permissions are checked
48289 + * later).
48290 + *
48291 +*/
48292 +static inline int open_to_namei_flags(int flag)
48293 +{
48294 + if ((flag+1) & O_ACCMODE)
48295 + flag++;
48296 + return flag;
48297 +}
48298 +
48299 static int may_open(struct path *path, int acc_mode, int flag)
48300 {
48301 struct dentry *dentry = path->dentry;
48302 @@ -2059,7 +2114,27 @@ static int may_open(struct path *path, i
48303 /*
48304 * Ensure there are no outstanding leases on the file.
48305 */
48306 - return break_lease(inode, flag);
48307 + error = break_lease(inode, flag);
48308 +
48309 + if (error)
48310 + return error;
48311 +
48312 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
48313 + error = -EPERM;
48314 + goto exit;
48315 + }
48316 +
48317 + if (gr_handle_rawio(inode)) {
48318 + error = -EPERM;
48319 + goto exit;
48320 + }
48321 +
48322 + if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) {
48323 + error = -EACCES;
48324 + goto exit;
48325 + }
48326 +exit:
48327 + return error;
48328 }
48329
48330 static int handle_truncate(struct file *filp)
48331 @@ -2085,30 +2160,6 @@ static int handle_truncate(struct file *
48332 }
48333
48334 /*
48335 - * Note that while the flag value (low two bits) for sys_open means:
48336 - * 00 - read-only
48337 - * 01 - write-only
48338 - * 10 - read-write
48339 - * 11 - special
48340 - * it is changed into
48341 - * 00 - no permissions needed
48342 - * 01 - read-permission
48343 - * 10 - write-permission
48344 - * 11 - read-write
48345 - * for the internal routines (ie open_namei()/follow_link() etc)
48346 - * This is more logical, and also allows the 00 "no perm needed"
48347 - * to be used for symlinks (where the permissions are checked
48348 - * later).
48349 - *
48350 -*/
48351 -static inline int open_to_namei_flags(int flag)
48352 -{
48353 - if ((flag+1) & O_ACCMODE)
48354 - flag++;
48355 - return flag;
48356 -}
48357 -
48358 -/*
48359 * Handle the last step of open()
48360 */
48361 static struct file *do_last(struct nameidata *nd, struct path *path,
48362 @@ -2117,6 +2168,7 @@ static struct file *do_last(struct namei
48363 struct dentry *dir = nd->path.dentry;
48364 struct dentry *dentry;
48365 int open_flag = op->open_flag;
48366 + int flag = open_to_namei_flags(open_flag);
48367 int will_truncate = open_flag & O_TRUNC;
48368 int want_write = 0;
48369 int acc_mode = op->acc_mode;
48370 @@ -2212,6 +2264,12 @@ static struct file *do_last(struct namei
48371 /* Negative dentry, just create the file */
48372 if (!dentry->d_inode) {
48373 int mode = op->mode;
48374 +
48375 + if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) {
48376 + error = -EACCES;
48377 + goto exit_mutex_unlock;
48378 + }
48379 +
48380 if (!IS_POSIXACL(dir->d_inode))
48381 mode &= ~current_umask();
48382 /*
48383 @@ -2235,6 +2293,8 @@ static struct file *do_last(struct namei
48384 error = vfs_create(dir->d_inode, dentry, mode, nd);
48385 if (error)
48386 goto exit_mutex_unlock;
48387 + else
48388 + gr_handle_create(path->dentry, path->mnt);
48389 mutex_unlock(&dir->d_inode->i_mutex);
48390 dput(nd->path.dentry);
48391 nd->path.dentry = dentry;
48392 @@ -2244,6 +2304,14 @@ static struct file *do_last(struct namei
48393 /*
48394 * It already exists.
48395 */
48396 +
48397 + /* only check if O_CREAT is specified, all other checks need to go
48398 + into may_open */
48399 + if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) {
48400 + error = -EACCES;
48401 + goto exit_mutex_unlock;
48402 + }
48403 +
48404 mutex_unlock(&dir->d_inode->i_mutex);
48405 audit_inode(pathname, path->dentry);
48406
48407 @@ -2530,6 +2598,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48408 error = may_mknod(mode);
48409 if (error)
48410 goto out_dput;
48411 +
48412 + if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
48413 + error = -EPERM;
48414 + goto out_dput;
48415 + }
48416 +
48417 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
48418 + error = -EACCES;
48419 + goto out_dput;
48420 + }
48421 +
48422 error = mnt_want_write(nd.path.mnt);
48423 if (error)
48424 goto out_dput;
48425 @@ -2550,6 +2629,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48426 }
48427 out_drop_write:
48428 mnt_drop_write(nd.path.mnt);
48429 +
48430 + if (!error)
48431 + gr_handle_create(dentry, nd.path.mnt);
48432 out_dput:
48433 dput(dentry);
48434 out_unlock:
48435 @@ -2602,6 +2684,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48436 if (IS_ERR(dentry))
48437 goto out_unlock;
48438
48439 + if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
48440 + error = -EACCES;
48441 + goto out_dput;
48442 + }
48443 +
48444 if (!IS_POSIXACL(nd.path.dentry->d_inode))
48445 mode &= ~current_umask();
48446 error = mnt_want_write(nd.path.mnt);
48447 @@ -2613,6 +2700,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48448 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
48449 out_drop_write:
48450 mnt_drop_write(nd.path.mnt);
48451 +
48452 + if (!error)
48453 + gr_handle_create(dentry, nd.path.mnt);
48454 +
48455 out_dput:
48456 dput(dentry);
48457 out_unlock:
48458 @@ -2692,6 +2783,8 @@ static long do_rmdir(int dfd, const char
48459 char * name;
48460 struct dentry *dentry;
48461 struct nameidata nd;
48462 + ino_t saved_ino = 0;
48463 + dev_t saved_dev = 0;
48464
48465 error = user_path_parent(dfd, pathname, &nd, &name);
48466 if (error)
48467 @@ -2716,6 +2809,19 @@ static long do_rmdir(int dfd, const char
48468 error = PTR_ERR(dentry);
48469 if (IS_ERR(dentry))
48470 goto exit2;
48471 +
48472 + if (dentry->d_inode != NULL) {
48473 + if (dentry->d_inode->i_nlink <= 1) {
48474 + saved_ino = dentry->d_inode->i_ino;
48475 + saved_dev = gr_get_dev_from_dentry(dentry);
48476 + }
48477 +
48478 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
48479 + error = -EACCES;
48480 + goto exit3;
48481 + }
48482 + }
48483 +
48484 error = mnt_want_write(nd.path.mnt);
48485 if (error)
48486 goto exit3;
48487 @@ -2723,6 +2829,8 @@ static long do_rmdir(int dfd, const char
48488 if (error)
48489 goto exit4;
48490 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
48491 + if (!error && (saved_dev || saved_ino))
48492 + gr_handle_delete(saved_ino, saved_dev);
48493 exit4:
48494 mnt_drop_write(nd.path.mnt);
48495 exit3:
48496 @@ -2785,6 +2893,8 @@ static long do_unlinkat(int dfd, const c
48497 struct dentry *dentry;
48498 struct nameidata nd;
48499 struct inode *inode = NULL;
48500 + ino_t saved_ino = 0;
48501 + dev_t saved_dev = 0;
48502
48503 error = user_path_parent(dfd, pathname, &nd, &name);
48504 if (error)
48505 @@ -2804,8 +2914,17 @@ static long do_unlinkat(int dfd, const c
48506 if (nd.last.name[nd.last.len])
48507 goto slashes;
48508 inode = dentry->d_inode;
48509 - if (inode)
48510 + if (inode) {
48511 ihold(inode);
48512 + if (inode->i_nlink <= 1) {
48513 + saved_ino = inode->i_ino;
48514 + saved_dev = gr_get_dev_from_dentry(dentry);
48515 + }
48516 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
48517 + error = -EACCES;
48518 + goto exit2;
48519 + }
48520 + }
48521 error = mnt_want_write(nd.path.mnt);
48522 if (error)
48523 goto exit2;
48524 @@ -2813,6 +2932,8 @@ static long do_unlinkat(int dfd, const c
48525 if (error)
48526 goto exit3;
48527 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
48528 + if (!error && (saved_ino || saved_dev))
48529 + gr_handle_delete(saved_ino, saved_dev);
48530 exit3:
48531 mnt_drop_write(nd.path.mnt);
48532 exit2:
48533 @@ -2890,6 +3011,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
48534 if (IS_ERR(dentry))
48535 goto out_unlock;
48536
48537 + if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
48538 + error = -EACCES;
48539 + goto out_dput;
48540 + }
48541 +
48542 error = mnt_want_write(nd.path.mnt);
48543 if (error)
48544 goto out_dput;
48545 @@ -2897,6 +3023,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
48546 if (error)
48547 goto out_drop_write;
48548 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
48549 + if (!error)
48550 + gr_handle_create(dentry, nd.path.mnt);
48551 out_drop_write:
48552 mnt_drop_write(nd.path.mnt);
48553 out_dput:
48554 @@ -3005,6 +3133,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48555 error = PTR_ERR(new_dentry);
48556 if (IS_ERR(new_dentry))
48557 goto out_unlock;
48558 +
48559 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
48560 + old_path.dentry->d_inode,
48561 + old_path.dentry->d_inode->i_mode, to)) {
48562 + error = -EACCES;
48563 + goto out_dput;
48564 + }
48565 +
48566 + if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
48567 + old_path.dentry, old_path.mnt, to)) {
48568 + error = -EACCES;
48569 + goto out_dput;
48570 + }
48571 +
48572 error = mnt_want_write(nd.path.mnt);
48573 if (error)
48574 goto out_dput;
48575 @@ -3012,6 +3154,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48576 if (error)
48577 goto out_drop_write;
48578 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
48579 + if (!error)
48580 + gr_handle_create(new_dentry, nd.path.mnt);
48581 out_drop_write:
48582 mnt_drop_write(nd.path.mnt);
48583 out_dput:
48584 @@ -3189,6 +3333,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48585 char *to;
48586 int error;
48587
48588 + pax_track_stack();
48589 +
48590 error = user_path_parent(olddfd, oldname, &oldnd, &from);
48591 if (error)
48592 goto exit;
48593 @@ -3245,6 +3391,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48594 if (new_dentry == trap)
48595 goto exit5;
48596
48597 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
48598 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
48599 + to);
48600 + if (error)
48601 + goto exit5;
48602 +
48603 error = mnt_want_write(oldnd.path.mnt);
48604 if (error)
48605 goto exit5;
48606 @@ -3254,6 +3406,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48607 goto exit6;
48608 error = vfs_rename(old_dir->d_inode, old_dentry,
48609 new_dir->d_inode, new_dentry);
48610 + if (!error)
48611 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
48612 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
48613 exit6:
48614 mnt_drop_write(oldnd.path.mnt);
48615 exit5:
48616 @@ -3279,6 +3434,8 @@ SYSCALL_DEFINE2(rename, const char __use
48617
48618 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
48619 {
48620 + char tmpbuf[64];
48621 + const char *newlink;
48622 int len;
48623
48624 len = PTR_ERR(link);
48625 @@ -3288,7 +3445,14 @@ int vfs_readlink(struct dentry *dentry,
48626 len = strlen(link);
48627 if (len > (unsigned) buflen)
48628 len = buflen;
48629 - if (copy_to_user(buffer, link, len))
48630 +
48631 + if (len < sizeof(tmpbuf)) {
48632 + memcpy(tmpbuf, link, len);
48633 + newlink = tmpbuf;
48634 + } else
48635 + newlink = link;
48636 +
48637 + if (copy_to_user(buffer, newlink, len))
48638 len = -EFAULT;
48639 out:
48640 return len;
48641 diff -urNp linux-2.6.39.1/fs/namespace.c linux-2.6.39.1/fs/namespace.c
48642 --- linux-2.6.39.1/fs/namespace.c 2011-05-19 00:06:34.000000000 -0400
48643 +++ linux-2.6.39.1/fs/namespace.c 2011-05-22 20:43:58.000000000 -0400
48644 @@ -1328,6 +1328,9 @@ static int do_umount(struct vfsmount *mn
48645 if (!(sb->s_flags & MS_RDONLY))
48646 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
48647 up_write(&sb->s_umount);
48648 +
48649 + gr_log_remount(mnt->mnt_devname, retval);
48650 +
48651 return retval;
48652 }
48653
48654 @@ -1347,6 +1350,9 @@ static int do_umount(struct vfsmount *mn
48655 br_write_unlock(vfsmount_lock);
48656 up_write(&namespace_sem);
48657 release_mounts(&umount_list);
48658 +
48659 + gr_log_unmount(mnt->mnt_devname, retval);
48660 +
48661 return retval;
48662 }
48663
48664 @@ -2338,6 +2344,16 @@ long do_mount(char *dev_name, char *dir_
48665 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
48666 MS_STRICTATIME);
48667
48668 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
48669 + retval = -EPERM;
48670 + goto dput_out;
48671 + }
48672 +
48673 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
48674 + retval = -EPERM;
48675 + goto dput_out;
48676 + }
48677 +
48678 if (flags & MS_REMOUNT)
48679 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
48680 data_page);
48681 @@ -2352,6 +2368,9 @@ long do_mount(char *dev_name, char *dir_
48682 dev_name, data_page);
48683 dput_out:
48684 path_put(&path);
48685 +
48686 + gr_log_mount(dev_name, dir_name, retval);
48687 +
48688 return retval;
48689 }
48690
48691 @@ -2575,6 +2594,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
48692 if (error)
48693 goto out2;
48694
48695 + if (gr_handle_chroot_pivot()) {
48696 + error = -EPERM;
48697 + goto out2;
48698 + }
48699 +
48700 get_fs_root(current->fs, &root);
48701 error = lock_mount(&old);
48702 if (error)
48703 diff -urNp linux-2.6.39.1/fs/ncpfs/dir.c linux-2.6.39.1/fs/ncpfs/dir.c
48704 --- linux-2.6.39.1/fs/ncpfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48705 +++ linux-2.6.39.1/fs/ncpfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48706 @@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
48707 int res, val = 0, len;
48708 __u8 __name[NCP_MAXPATHLEN + 1];
48709
48710 + pax_track_stack();
48711 +
48712 if (dentry == dentry->d_sb->s_root)
48713 return 1;
48714
48715 @@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct
48716 int error, res, len;
48717 __u8 __name[NCP_MAXPATHLEN + 1];
48718
48719 + pax_track_stack();
48720 +
48721 error = -EIO;
48722 if (!ncp_conn_valid(server))
48723 goto finished;
48724 @@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
48725 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
48726 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
48727
48728 + pax_track_stack();
48729 +
48730 ncp_age_dentry(server, dentry);
48731 len = sizeof(__name);
48732 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
48733 @@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir,
48734 int error, len;
48735 __u8 __name[NCP_MAXPATHLEN + 1];
48736
48737 + pax_track_stack();
48738 +
48739 DPRINTK("ncp_mkdir: making %s/%s\n",
48740 dentry->d_parent->d_name.name, dentry->d_name.name);
48741
48742 @@ -1135,6 +1143,8 @@ static int ncp_rename(struct inode *old_
48743 int old_len, new_len;
48744 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
48745
48746 + pax_track_stack();
48747 +
48748 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
48749 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
48750 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
48751 diff -urNp linux-2.6.39.1/fs/ncpfs/inode.c linux-2.6.39.1/fs/ncpfs/inode.c
48752 --- linux-2.6.39.1/fs/ncpfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48753 +++ linux-2.6.39.1/fs/ncpfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48754 @@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
48755 #endif
48756 struct ncp_entry_info finfo;
48757
48758 + pax_track_stack();
48759 +
48760 data.wdog_pid = NULL;
48761 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
48762 if (!server)
48763 diff -urNp linux-2.6.39.1/fs/nfs/inode.c linux-2.6.39.1/fs/nfs/inode.c
48764 --- linux-2.6.39.1/fs/nfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48765 +++ linux-2.6.39.1/fs/nfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48766 @@ -999,16 +999,16 @@ static int nfs_size_need_update(const st
48767 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
48768 }
48769
48770 -static atomic_long_t nfs_attr_generation_counter;
48771 +static atomic_long_unchecked_t nfs_attr_generation_counter;
48772
48773 static unsigned long nfs_read_attr_generation_counter(void)
48774 {
48775 - return atomic_long_read(&nfs_attr_generation_counter);
48776 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
48777 }
48778
48779 unsigned long nfs_inc_attr_generation_counter(void)
48780 {
48781 - return atomic_long_inc_return(&nfs_attr_generation_counter);
48782 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
48783 }
48784
48785 void nfs_fattr_init(struct nfs_fattr *fattr)
48786 diff -urNp linux-2.6.39.1/fs/nfs/nfs4proc.c linux-2.6.39.1/fs/nfs/nfs4proc.c
48787 --- linux-2.6.39.1/fs/nfs/nfs4proc.c 2011-06-03 00:04:14.000000000 -0400
48788 +++ linux-2.6.39.1/fs/nfs/nfs4proc.c 2011-06-03 00:32:07.000000000 -0400
48789 @@ -5845,14 +5845,14 @@ struct nfs4_state_recovery_ops nfs41_nog
48790 };
48791 #endif /* CONFIG_NFS_V4_1 */
48792
48793 -struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48794 +const struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48795 .sched_state_renewal = nfs4_proc_async_renew,
48796 .get_state_renewal_cred_locked = nfs4_get_renew_cred_locked,
48797 .renew_lease = nfs4_proc_renew,
48798 };
48799
48800 #if defined(CONFIG_NFS_V4_1)
48801 -struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48802 +const struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48803 .sched_state_renewal = nfs41_proc_async_sequence,
48804 .get_state_renewal_cred_locked = nfs4_get_machine_cred_locked,
48805 .renew_lease = nfs4_proc_sequence,
48806 diff -urNp linux-2.6.39.1/fs/nfsd/lockd.c linux-2.6.39.1/fs/nfsd/lockd.c
48807 --- linux-2.6.39.1/fs/nfsd/lockd.c 2011-05-19 00:06:34.000000000 -0400
48808 +++ linux-2.6.39.1/fs/nfsd/lockd.c 2011-05-22 19:36:32.000000000 -0400
48809 @@ -60,7 +60,7 @@ nlm_fclose(struct file *filp)
48810 fput(filp);
48811 }
48812
48813 -static struct nlmsvc_binding nfsd_nlm_ops = {
48814 +static const struct nlmsvc_binding nfsd_nlm_ops = {
48815 .fopen = nlm_fopen, /* open file for locking */
48816 .fclose = nlm_fclose, /* close file */
48817 };
48818 diff -urNp linux-2.6.39.1/fs/nfsd/nfs4state.c linux-2.6.39.1/fs/nfsd/nfs4state.c
48819 --- linux-2.6.39.1/fs/nfsd/nfs4state.c 2011-05-19 00:06:34.000000000 -0400
48820 +++ linux-2.6.39.1/fs/nfsd/nfs4state.c 2011-05-22 19:36:32.000000000 -0400
48821 @@ -3784,6 +3784,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
48822 unsigned int strhashval;
48823 int err;
48824
48825 + pax_track_stack();
48826 +
48827 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
48828 (long long) lock->lk_offset,
48829 (long long) lock->lk_length);
48830 diff -urNp linux-2.6.39.1/fs/nfsd/nfs4xdr.c linux-2.6.39.1/fs/nfsd/nfs4xdr.c
48831 --- linux-2.6.39.1/fs/nfsd/nfs4xdr.c 2011-05-19 00:06:34.000000000 -0400
48832 +++ linux-2.6.39.1/fs/nfsd/nfs4xdr.c 2011-05-22 19:36:32.000000000 -0400
48833 @@ -1793,6 +1793,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
48834 .dentry = dentry,
48835 };
48836
48837 + pax_track_stack();
48838 +
48839 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
48840 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
48841 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
48842 diff -urNp linux-2.6.39.1/fs/nfsd/nfsctl.c linux-2.6.39.1/fs/nfsd/nfsctl.c
48843 --- linux-2.6.39.1/fs/nfsd/nfsctl.c 2011-05-19 00:06:34.000000000 -0400
48844 +++ linux-2.6.39.1/fs/nfsd/nfsctl.c 2011-05-22 19:36:32.000000000 -0400
48845 @@ -182,7 +182,7 @@ static int export_features_open(struct i
48846 return single_open(file, export_features_show, NULL);
48847 }
48848
48849 -static struct file_operations export_features_operations = {
48850 +static const struct file_operations export_features_operations = {
48851 .open = export_features_open,
48852 .read = seq_read,
48853 .llseek = seq_lseek,
48854 diff -urNp linux-2.6.39.1/fs/nfsd/vfs.c linux-2.6.39.1/fs/nfsd/vfs.c
48855 --- linux-2.6.39.1/fs/nfsd/vfs.c 2011-05-19 00:06:34.000000000 -0400
48856 +++ linux-2.6.39.1/fs/nfsd/vfs.c 2011-05-22 19:36:32.000000000 -0400
48857 @@ -898,7 +898,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
48858 } else {
48859 oldfs = get_fs();
48860 set_fs(KERNEL_DS);
48861 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
48862 + host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
48863 set_fs(oldfs);
48864 }
48865
48866 @@ -1002,7 +1002,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
48867
48868 /* Write the data. */
48869 oldfs = get_fs(); set_fs(KERNEL_DS);
48870 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
48871 + host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
48872 set_fs(oldfs);
48873 if (host_err < 0)
48874 goto out_nfserr;
48875 @@ -1525,7 +1525,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
48876 */
48877
48878 oldfs = get_fs(); set_fs(KERNEL_DS);
48879 - host_err = inode->i_op->readlink(dentry, buf, *lenp);
48880 + host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
48881 set_fs(oldfs);
48882
48883 if (host_err < 0)
48884 diff -urNp linux-2.6.39.1/fs/nilfs2/segment.c linux-2.6.39.1/fs/nilfs2/segment.c
48885 --- linux-2.6.39.1/fs/nilfs2/segment.c 2011-05-19 00:06:34.000000000 -0400
48886 +++ linux-2.6.39.1/fs/nilfs2/segment.c 2011-05-22 19:36:32.000000000 -0400
48887 @@ -555,7 +555,7 @@ static void nilfs_write_file_node_binfo(
48888 *vblocknr = binfo->bi_v.bi_vblocknr;
48889 }
48890
48891 -static struct nilfs_sc_operations nilfs_sc_file_ops = {
48892 +static const struct nilfs_sc_operations nilfs_sc_file_ops = {
48893 .collect_data = nilfs_collect_file_data,
48894 .collect_node = nilfs_collect_file_node,
48895 .collect_bmap = nilfs_collect_file_bmap,
48896 @@ -604,7 +604,7 @@ static void nilfs_write_dat_node_binfo(s
48897 *binfo_dat = binfo->bi_dat;
48898 }
48899
48900 -static struct nilfs_sc_operations nilfs_sc_dat_ops = {
48901 +static const struct nilfs_sc_operations nilfs_sc_dat_ops = {
48902 .collect_data = nilfs_collect_dat_data,
48903 .collect_node = nilfs_collect_file_node,
48904 .collect_bmap = nilfs_collect_dat_bmap,
48905 @@ -612,7 +612,7 @@ static struct nilfs_sc_operations nilfs_
48906 .write_node_binfo = nilfs_write_dat_node_binfo,
48907 };
48908
48909 -static struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48910 +static const struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48911 .collect_data = nilfs_collect_file_data,
48912 .collect_node = NULL,
48913 .collect_bmap = NULL,
48914 @@ -971,7 +971,7 @@ static size_t nilfs_segctor_buffer_rest(
48915
48916 static int nilfs_segctor_scan_file(struct nilfs_sc_info *sci,
48917 struct inode *inode,
48918 - struct nilfs_sc_operations *sc_ops)
48919 + const struct nilfs_sc_operations *sc_ops)
48920 {
48921 LIST_HEAD(data_buffers);
48922 LIST_HEAD(node_buffers);
48923 @@ -1475,7 +1475,7 @@ nilfs_segctor_update_payload_blocknr(str
48924 sector_t blocknr;
48925 unsigned long nfinfo = segbuf->sb_sum.nfinfo;
48926 unsigned long nblocks = 0, ndatablk = 0;
48927 - struct nilfs_sc_operations *sc_op = NULL;
48928 + const struct nilfs_sc_operations *sc_op = NULL;
48929 struct nilfs_segsum_pointer ssp;
48930 struct nilfs_finfo *finfo = NULL;
48931 union nilfs_binfo binfo;
48932 diff -urNp linux-2.6.39.1/fs/notify/dnotify/dnotify.c linux-2.6.39.1/fs/notify/dnotify/dnotify.c
48933 --- linux-2.6.39.1/fs/notify/dnotify/dnotify.c 2011-05-19 00:06:34.000000000 -0400
48934 +++ linux-2.6.39.1/fs/notify/dnotify/dnotify.c 2011-05-22 19:36:32.000000000 -0400
48935 @@ -151,7 +151,7 @@ static void dnotify_free_mark(struct fsn
48936 kmem_cache_free(dnotify_mark_cache, dn_mark);
48937 }
48938
48939 -static struct fsnotify_ops dnotify_fsnotify_ops = {
48940 +static const struct fsnotify_ops dnotify_fsnotify_ops = {
48941 .handle_event = dnotify_handle_event,
48942 .should_send_event = dnotify_should_send_event,
48943 .free_group_priv = NULL,
48944 diff -urNp linux-2.6.39.1/fs/notify/notification.c linux-2.6.39.1/fs/notify/notification.c
48945 --- linux-2.6.39.1/fs/notify/notification.c 2011-05-19 00:06:34.000000000 -0400
48946 +++ linux-2.6.39.1/fs/notify/notification.c 2011-05-22 19:36:32.000000000 -0400
48947 @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
48948 * get set to 0 so it will never get 'freed'
48949 */
48950 static struct fsnotify_event *q_overflow_event;
48951 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48952 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48953
48954 /**
48955 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
48956 @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
48957 */
48958 u32 fsnotify_get_cookie(void)
48959 {
48960 - return atomic_inc_return(&fsnotify_sync_cookie);
48961 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
48962 }
48963 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
48964
48965 diff -urNp linux-2.6.39.1/fs/ntfs/dir.c linux-2.6.39.1/fs/ntfs/dir.c
48966 --- linux-2.6.39.1/fs/ntfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48967 +++ linux-2.6.39.1/fs/ntfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48968 @@ -1329,7 +1329,7 @@ find_next_index_buffer:
48969 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
48970 ~(s64)(ndir->itype.index.block_size - 1)));
48971 /* Bounds checks. */
48972 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48973 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48974 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
48975 "inode 0x%lx or driver bug.", vdir->i_ino);
48976 goto err_out;
48977 diff -urNp linux-2.6.39.1/fs/ntfs/file.c linux-2.6.39.1/fs/ntfs/file.c
48978 --- linux-2.6.39.1/fs/ntfs/file.c 2011-05-19 00:06:34.000000000 -0400
48979 +++ linux-2.6.39.1/fs/ntfs/file.c 2011-05-22 19:36:32.000000000 -0400
48980 @@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
48981 #endif /* NTFS_RW */
48982 };
48983
48984 -const struct file_operations ntfs_empty_file_ops = {};
48985 +const struct file_operations ntfs_empty_file_ops __read_only;
48986
48987 -const struct inode_operations ntfs_empty_inode_ops = {};
48988 +const struct inode_operations ntfs_empty_inode_ops __read_only;
48989 diff -urNp linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c
48990 --- linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c 2011-05-19 00:06:34.000000000 -0400
48991 +++ linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c 2011-05-22 19:36:32.000000000 -0400
48992 @@ -2261,7 +2261,7 @@ static struct configfs_item_operations o
48993 .store_attribute = o2hb_heartbeat_group_store,
48994 };
48995
48996 -static struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48997 +static const struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48998 .make_item = o2hb_heartbeat_group_make_item,
48999 .drop_item = o2hb_heartbeat_group_drop_item,
49000 };
49001 diff -urNp linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c
49002 --- linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c 2011-05-19 00:06:34.000000000 -0400
49003 +++ linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c 2011-05-22 19:36:32.000000000 -0400
49004 @@ -752,7 +752,7 @@ static void o2nm_node_group_drop_item(st
49005 config_item_put(item);
49006 }
49007
49008 -static struct configfs_group_operations o2nm_node_group_group_ops = {
49009 +static const struct configfs_group_operations o2nm_node_group_group_ops = {
49010 .make_item = o2nm_node_group_make_item,
49011 .drop_item = o2nm_node_group_drop_item,
49012 };
49013 @@ -869,7 +869,7 @@ static void o2nm_cluster_group_drop_item
49014 config_item_put(item);
49015 }
49016
49017 -static struct configfs_group_operations o2nm_cluster_group_group_ops = {
49018 +static const struct configfs_group_operations o2nm_cluster_group_group_ops = {
49019 .make_group = o2nm_cluster_group_make_group,
49020 .drop_item = o2nm_cluster_group_drop_item,
49021 };
49022 diff -urNp linux-2.6.39.1/fs/ocfs2/localalloc.c linux-2.6.39.1/fs/ocfs2/localalloc.c
49023 --- linux-2.6.39.1/fs/ocfs2/localalloc.c 2011-05-19 00:06:34.000000000 -0400
49024 +++ linux-2.6.39.1/fs/ocfs2/localalloc.c 2011-05-22 19:36:32.000000000 -0400
49025 @@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo
49026 goto bail;
49027 }
49028
49029 - atomic_inc(&osb->alloc_stats.moves);
49030 + atomic_inc_unchecked(&osb->alloc_stats.moves);
49031
49032 bail:
49033 if (handle)
49034 diff -urNp linux-2.6.39.1/fs/ocfs2/namei.c linux-2.6.39.1/fs/ocfs2/namei.c
49035 --- linux-2.6.39.1/fs/ocfs2/namei.c 2011-05-19 00:06:34.000000000 -0400
49036 +++ linux-2.6.39.1/fs/ocfs2/namei.c 2011-05-22 19:36:32.000000000 -0400
49037 @@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol
49038 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
49039 struct ocfs2_dir_lookup_result target_insert = { NULL, };
49040
49041 + pax_track_stack();
49042 +
49043 /* At some point it might be nice to break this function up a
49044 * bit. */
49045
49046 diff -urNp linux-2.6.39.1/fs/ocfs2/ocfs2.h linux-2.6.39.1/fs/ocfs2/ocfs2.h
49047 --- linux-2.6.39.1/fs/ocfs2/ocfs2.h 2011-05-19 00:06:34.000000000 -0400
49048 +++ linux-2.6.39.1/fs/ocfs2/ocfs2.h 2011-05-22 19:36:32.000000000 -0400
49049 @@ -235,11 +235,11 @@ enum ocfs2_vol_state
49050
49051 struct ocfs2_alloc_stats
49052 {
49053 - atomic_t moves;
49054 - atomic_t local_data;
49055 - atomic_t bitmap_data;
49056 - atomic_t bg_allocs;
49057 - atomic_t bg_extends;
49058 + atomic_unchecked_t moves;
49059 + atomic_unchecked_t local_data;
49060 + atomic_unchecked_t bitmap_data;
49061 + atomic_unchecked_t bg_allocs;
49062 + atomic_unchecked_t bg_extends;
49063 };
49064
49065 enum ocfs2_local_alloc_state
49066 diff -urNp linux-2.6.39.1/fs/ocfs2/stackglue.h linux-2.6.39.1/fs/ocfs2/stackglue.h
49067 --- linux-2.6.39.1/fs/ocfs2/stackglue.h 2011-05-19 00:06:34.000000000 -0400
49068 +++ linux-2.6.39.1/fs/ocfs2/stackglue.h 2011-05-22 19:36:32.000000000 -0400
49069 @@ -221,13 +221,13 @@ struct ocfs2_stack_operations {
49070 };
49071
49072 /*
49073 - * Each stack plugin must describe itself by registering a
49074 + * Each stack plugin must describe itself by registerin const g a
49075 * ocfs2_stack_plugin structure. This is only seen by stackglue and the
49076 * stack driver.
49077 */
49078 struct ocfs2_stack_plugin {
49079 char *sp_name;
49080 - struct ocfs2_stack_operations *sp_ops;
49081 + const struct ocfs2_stack_operations *sp_ops;
49082 struct module *sp_owner;
49083
49084 /* These are managed by the stackglue code. */
49085 diff -urNp linux-2.6.39.1/fs/ocfs2/stack_o2cb.c linux-2.6.39.1/fs/ocfs2/stack_o2cb.c
49086 --- linux-2.6.39.1/fs/ocfs2/stack_o2cb.c 2011-05-19 00:06:34.000000000 -0400
49087 +++ linux-2.6.39.1/fs/ocfs2/stack_o2cb.c 2011-06-07 18:07:24.000000000 -0400
49088 @@ -358,7 +358,7 @@ static int o2cb_cluster_this_node(unsign
49089 return 0;
49090 }
49091
49092 -static struct ocfs2_stack_operations o2cb_stack_ops = {
49093 +static const struct ocfs2_stack_operations o2cb_stack_ops = {
49094 .connect = o2cb_cluster_connect,
49095 .disconnect = o2cb_cluster_disconnect,
49096 .this_node = o2cb_cluster_this_node,
49097 diff -urNp linux-2.6.39.1/fs/ocfs2/stack_user.c linux-2.6.39.1/fs/ocfs2/stack_user.c
49098 --- linux-2.6.39.1/fs/ocfs2/stack_user.c 2011-05-19 00:06:34.000000000 -0400
49099 +++ linux-2.6.39.1/fs/ocfs2/stack_user.c 2011-05-22 19:36:32.000000000 -0400
49100 @@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_m
49101 long major, minor;
49102 char *ptr = NULL;
49103 struct ocfs2_control_private *p = file->private_data;
49104 - struct ocfs2_protocol_version *max =
49105 + const struct ocfs2_protocol_version *max =
49106 &ocfs2_user_plugin.sp_max_proto;
49107
49108 if (ocfs2_control_get_handshake_state(file) !=
49109 @@ -861,7 +861,7 @@ static int user_cluster_this_node(unsign
49110 return 0;
49111 }
49112
49113 -static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
49114 +static const struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
49115 .connect = user_cluster_connect,
49116 .disconnect = user_cluster_disconnect,
49117 .this_node = user_cluster_this_node,
49118 diff -urNp linux-2.6.39.1/fs/ocfs2/suballoc.c linux-2.6.39.1/fs/ocfs2/suballoc.c
49119 --- linux-2.6.39.1/fs/ocfs2/suballoc.c 2011-05-19 00:06:34.000000000 -0400
49120 +++ linux-2.6.39.1/fs/ocfs2/suballoc.c 2011-05-22 19:36:32.000000000 -0400
49121 @@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s
49122 mlog_errno(status);
49123 goto bail;
49124 }
49125 - atomic_inc(&osb->alloc_stats.bg_extends);
49126 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
49127
49128 /* You should never ask for this much metadata */
49129 BUG_ON(bits_wanted >
49130 @@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl
49131 mlog_errno(status);
49132 goto bail;
49133 }
49134 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49135 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49136
49137 *suballoc_loc = res.sr_bg_blkno;
49138 *suballoc_bit_start = res.sr_bit_offset;
49139 @@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
49140 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
49141 res->sr_bits);
49142
49143 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49144 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49145
49146 BUG_ON(res->sr_bits != 1);
49147
49148 @@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand
49149 mlog_errno(status);
49150 goto bail;
49151 }
49152 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49153 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49154
49155 BUG_ON(res.sr_bits != 1);
49156
49157 @@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han
49158 cluster_start,
49159 num_clusters);
49160 if (!status)
49161 - atomic_inc(&osb->alloc_stats.local_data);
49162 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
49163 } else {
49164 if (min_clusters > (osb->bitmap_cpg - 1)) {
49165 /* The only paths asking for contiguousness
49166 @@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han
49167 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
49168 res.sr_bg_blkno,
49169 res.sr_bit_offset);
49170 - atomic_inc(&osb->alloc_stats.bitmap_data);
49171 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
49172 *num_clusters = res.sr_bits;
49173 }
49174 }
49175 diff -urNp linux-2.6.39.1/fs/ocfs2/super.c linux-2.6.39.1/fs/ocfs2/super.c
49176 --- linux-2.6.39.1/fs/ocfs2/super.c 2011-05-19 00:06:34.000000000 -0400
49177 +++ linux-2.6.39.1/fs/ocfs2/super.c 2011-05-22 19:36:32.000000000 -0400
49178 @@ -299,11 +299,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
49179 "%10s => GlobalAllocs: %d LocalAllocs: %d "
49180 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
49181 "Stats",
49182 - atomic_read(&osb->alloc_stats.bitmap_data),
49183 - atomic_read(&osb->alloc_stats.local_data),
49184 - atomic_read(&osb->alloc_stats.bg_allocs),
49185 - atomic_read(&osb->alloc_stats.moves),
49186 - atomic_read(&osb->alloc_stats.bg_extends));
49187 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
49188 + atomic_read_unchecked(&osb->alloc_stats.local_data),
49189 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
49190 + atomic_read_unchecked(&osb->alloc_stats.moves),
49191 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
49192
49193 out += snprintf(buf + out, len - out,
49194 "%10s => State: %u Descriptor: %llu Size: %u bits "
49195 @@ -2111,11 +2111,11 @@ static int ocfs2_initialize_super(struct
49196 spin_lock_init(&osb->osb_xattr_lock);
49197 ocfs2_init_steal_slots(osb);
49198
49199 - atomic_set(&osb->alloc_stats.moves, 0);
49200 - atomic_set(&osb->alloc_stats.local_data, 0);
49201 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
49202 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
49203 - atomic_set(&osb->alloc_stats.bg_extends, 0);
49204 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
49205 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
49206 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
49207 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
49208 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
49209
49210 /* Copy the blockcheck stats from the superblock probe */
49211 osb->osb_ecc_stats = *stats;
49212 diff -urNp linux-2.6.39.1/fs/ocfs2/symlink.c linux-2.6.39.1/fs/ocfs2/symlink.c
49213 --- linux-2.6.39.1/fs/ocfs2/symlink.c 2011-05-19 00:06:34.000000000 -0400
49214 +++ linux-2.6.39.1/fs/ocfs2/symlink.c 2011-05-22 19:36:32.000000000 -0400
49215 @@ -142,7 +142,7 @@ bail:
49216
49217 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49218 {
49219 - char *link = nd_get_link(nd);
49220 + const char *link = nd_get_link(nd);
49221 if (!IS_ERR(link))
49222 kfree(link);
49223 }
49224 diff -urNp linux-2.6.39.1/fs/open.c linux-2.6.39.1/fs/open.c
49225 --- linux-2.6.39.1/fs/open.c 2011-05-19 00:06:34.000000000 -0400
49226 +++ linux-2.6.39.1/fs/open.c 2011-05-22 20:46:51.000000000 -0400
49227 @@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
49228 error = locks_verify_truncate(inode, NULL, length);
49229 if (!error)
49230 error = security_path_truncate(&path);
49231 +
49232 + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
49233 + error = -EACCES;
49234 +
49235 if (!error)
49236 error = do_truncate(path.dentry, length, 0, NULL);
49237
49238 @@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
49239 if (__mnt_is_readonly(path.mnt))
49240 res = -EROFS;
49241
49242 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
49243 + res = -EACCES;
49244 +
49245 out_path_release:
49246 path_put(&path);
49247 out:
49248 @@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user
49249 if (error)
49250 goto dput_and_out;
49251
49252 + gr_log_chdir(path.dentry, path.mnt);
49253 +
49254 set_fs_pwd(current->fs, &path);
49255
49256 dput_and_out:
49257 @@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
49258 goto out_putf;
49259
49260 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
49261 +
49262 + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
49263 + error = -EPERM;
49264 +
49265 + if (!error)
49266 + gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
49267 +
49268 if (!error)
49269 set_fs_pwd(current->fs, &file->f_path);
49270 out_putf:
49271 @@ -438,7 +454,18 @@ SYSCALL_DEFINE1(chroot, const char __use
49272 if (error)
49273 goto dput_and_out;
49274
49275 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
49276 + goto dput_and_out;
49277 +
49278 + if (gr_handle_chroot_caps(&path)) {
49279 + error = -ENOMEM;
49280 + goto dput_and_out;
49281 + }
49282 +
49283 set_fs_root(current->fs, &path);
49284 +
49285 + gr_handle_chroot_chdir(&path);
49286 +
49287 error = 0;
49288 dput_and_out:
49289 path_put(&path);
49290 @@ -466,12 +493,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
49291 err = mnt_want_write_file(file);
49292 if (err)
49293 goto out_putf;
49294 +
49295 mutex_lock(&inode->i_mutex);
49296 +
49297 + if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
49298 + err = -EACCES;
49299 + goto out_unlock;
49300 + }
49301 +
49302 err = security_path_chmod(dentry, file->f_vfsmnt, mode);
49303 if (err)
49304 goto out_unlock;
49305 if (mode == (mode_t) -1)
49306 mode = inode->i_mode;
49307 +
49308 + if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
49309 + err = -EACCES;
49310 + goto out_unlock;
49311 + }
49312 +
49313 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49314 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49315 err = notify_change(dentry, &newattrs);
49316 @@ -499,12 +539,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
49317 error = mnt_want_write(path.mnt);
49318 if (error)
49319 goto dput_and_out;
49320 +
49321 mutex_lock(&inode->i_mutex);
49322 +
49323 + if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
49324 + error = -EACCES;
49325 + goto out_unlock;
49326 + }
49327 +
49328 error = security_path_chmod(path.dentry, path.mnt, mode);
49329 if (error)
49330 goto out_unlock;
49331 if (mode == (mode_t) -1)
49332 mode = inode->i_mode;
49333 +
49334 + if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
49335 + error = -EACCES;
49336 + goto out_unlock;
49337 + }
49338 +
49339 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49340 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49341 error = notify_change(path.dentry, &newattrs);
49342 @@ -528,6 +581,9 @@ static int chown_common(struct path *pat
49343 int error;
49344 struct iattr newattrs;
49345
49346 + if (!gr_acl_handle_chown(path->dentry, path->mnt))
49347 + return -EACCES;
49348 +
49349 newattrs.ia_valid = ATTR_CTIME;
49350 if (user != (uid_t) -1) {
49351 newattrs.ia_valid |= ATTR_UID;
49352 @@ -998,7 +1054,10 @@ long do_sys_open(int dfd, const char __u
49353 if (!IS_ERR(tmp)) {
49354 fd = get_unused_fd_flags(flags);
49355 if (fd >= 0) {
49356 - struct file *f = do_filp_open(dfd, tmp, &op, lookup);
49357 + struct file *f;
49358 + /* don't allow to be set by userland */
49359 + flags &= ~FMODE_GREXEC;
49360 + f = do_filp_open(dfd, tmp, &op, lookup);
49361 if (IS_ERR(f)) {
49362 put_unused_fd(fd);
49363 fd = PTR_ERR(f);
49364 diff -urNp linux-2.6.39.1/fs/partitions/ldm.c linux-2.6.39.1/fs/partitions/ldm.c
49365 --- linux-2.6.39.1/fs/partitions/ldm.c 2011-06-03 00:04:14.000000000 -0400
49366 +++ linux-2.6.39.1/fs/partitions/ldm.c 2011-06-03 00:32:07.000000000 -0400
49367 @@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
49368 ldm_error ("A VBLK claims to have %d parts.", num);
49369 return false;
49370 }
49371 +
49372 if (rec >= num) {
49373 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
49374 return false;
49375 @@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
49376 goto found;
49377 }
49378
49379 - f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
49380 + f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
49381 if (!f) {
49382 ldm_crit ("Out of memory.");
49383 return false;
49384 diff -urNp linux-2.6.39.1/fs/pipe.c linux-2.6.39.1/fs/pipe.c
49385 --- linux-2.6.39.1/fs/pipe.c 2011-05-19 00:06:34.000000000 -0400
49386 +++ linux-2.6.39.1/fs/pipe.c 2011-05-22 19:41:37.000000000 -0400
49387 @@ -420,9 +420,9 @@ redo:
49388 }
49389 if (bufs) /* More to do? */
49390 continue;
49391 - if (!pipe->writers)
49392 + if (!atomic_read(&pipe->writers))
49393 break;
49394 - if (!pipe->waiting_writers) {
49395 + if (!atomic_read(&pipe->waiting_writers)) {
49396 /* syscall merging: Usually we must not sleep
49397 * if O_NONBLOCK is set, or if we got some data.
49398 * But if a writer sleeps in kernel space, then
49399 @@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str
49400 mutex_lock(&inode->i_mutex);
49401 pipe = inode->i_pipe;
49402
49403 - if (!pipe->readers) {
49404 + if (!atomic_read(&pipe->readers)) {
49405 send_sig(SIGPIPE, current, 0);
49406 ret = -EPIPE;
49407 goto out;
49408 @@ -530,7 +530,7 @@ redo1:
49409 for (;;) {
49410 int bufs;
49411
49412 - if (!pipe->readers) {
49413 + if (!atomic_read(&pipe->readers)) {
49414 send_sig(SIGPIPE, current, 0);
49415 if (!ret)
49416 ret = -EPIPE;
49417 @@ -616,9 +616,9 @@ redo2:
49418 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
49419 do_wakeup = 0;
49420 }
49421 - pipe->waiting_writers++;
49422 + atomic_inc(&pipe->waiting_writers);
49423 pipe_wait(pipe);
49424 - pipe->waiting_writers--;
49425 + atomic_dec(&pipe->waiting_writers);
49426 }
49427 out:
49428 mutex_unlock(&inode->i_mutex);
49429 @@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table
49430 mask = 0;
49431 if (filp->f_mode & FMODE_READ) {
49432 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
49433 - if (!pipe->writers && filp->f_version != pipe->w_counter)
49434 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
49435 mask |= POLLHUP;
49436 }
49437
49438 @@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table
49439 * Most Unices do not set POLLERR for FIFOs but on Linux they
49440 * behave exactly like pipes for poll().
49441 */
49442 - if (!pipe->readers)
49443 + if (!atomic_read(&pipe->readers))
49444 mask |= POLLERR;
49445 }
49446
49447 @@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de
49448
49449 mutex_lock(&inode->i_mutex);
49450 pipe = inode->i_pipe;
49451 - pipe->readers -= decr;
49452 - pipe->writers -= decw;
49453 + atomic_sub(decr, &pipe->readers);
49454 + atomic_sub(decw, &pipe->writers);
49455
49456 - if (!pipe->readers && !pipe->writers) {
49457 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
49458 free_pipe_info(inode);
49459 } else {
49460 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
49461 @@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru
49462
49463 if (inode->i_pipe) {
49464 ret = 0;
49465 - inode->i_pipe->readers++;
49466 + atomic_inc(&inode->i_pipe->readers);
49467 }
49468
49469 mutex_unlock(&inode->i_mutex);
49470 @@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str
49471
49472 if (inode->i_pipe) {
49473 ret = 0;
49474 - inode->i_pipe->writers++;
49475 + atomic_inc(&inode->i_pipe->writers);
49476 }
49477
49478 mutex_unlock(&inode->i_mutex);
49479 @@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru
49480 if (inode->i_pipe) {
49481 ret = 0;
49482 if (filp->f_mode & FMODE_READ)
49483 - inode->i_pipe->readers++;
49484 + atomic_inc(&inode->i_pipe->readers);
49485 if (filp->f_mode & FMODE_WRITE)
49486 - inode->i_pipe->writers++;
49487 + atomic_inc(&inode->i_pipe->writers);
49488 }
49489
49490 mutex_unlock(&inode->i_mutex);
49491 @@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
49492 inode->i_pipe = NULL;
49493 }
49494
49495 -static struct vfsmount *pipe_mnt __read_mostly;
49496 +struct vfsmount *pipe_mnt __read_mostly;
49497
49498 /*
49499 * pipefs_dname() is called from d_path().
49500 @@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi
49501 goto fail_iput;
49502 inode->i_pipe = pipe;
49503
49504 - pipe->readers = pipe->writers = 1;
49505 + atomic_set(&pipe->readers, 1);
49506 + atomic_set(&pipe->writers, 1);
49507 inode->i_fop = &rdwr_pipefifo_fops;
49508
49509 /*
49510 diff -urNp linux-2.6.39.1/fs/proc/array.c linux-2.6.39.1/fs/proc/array.c
49511 --- linux-2.6.39.1/fs/proc/array.c 2011-05-19 00:06:34.000000000 -0400
49512 +++ linux-2.6.39.1/fs/proc/array.c 2011-05-22 19:41:37.000000000 -0400
49513 @@ -60,6 +60,7 @@
49514 #include <linux/tty.h>
49515 #include <linux/string.h>
49516 #include <linux/mman.h>
49517 +#include <linux/grsecurity.h>
49518 #include <linux/proc_fs.h>
49519 #include <linux/ioport.h>
49520 #include <linux/uaccess.h>
49521 @@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq
49522 seq_putc(m, '\n');
49523 }
49524
49525 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49526 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
49527 +{
49528 + if (p->mm)
49529 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
49530 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
49531 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
49532 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
49533 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
49534 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
49535 + else
49536 + seq_printf(m, "PaX:\t-----\n");
49537 +}
49538 +#endif
49539 +
49540 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
49541 struct pid *pid, struct task_struct *task)
49542 {
49543 @@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m,
49544 task_cpus_allowed(m, task);
49545 cpuset_task_status_allowed(m, task);
49546 task_context_switch_counts(m, task);
49547 +
49548 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49549 + task_pax(m, task);
49550 +#endif
49551 +
49552 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
49553 + task_grsec_rbac(m, task);
49554 +#endif
49555 +
49556 return 0;
49557 }
49558
49559 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49560 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49561 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
49562 + _mm->pax_flags & MF_PAX_SEGMEXEC))
49563 +#endif
49564 +
49565 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
49566 struct pid *pid, struct task_struct *task, int whole)
49567 {
49568 @@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file
49569 cputime_t cutime, cstime, utime, stime;
49570 cputime_t cgtime, gtime;
49571 unsigned long rsslim = 0;
49572 - char tcomm[sizeof(task->comm)];
49573 + char tcomm[sizeof(task->comm)] = { 0 };
49574 unsigned long flags;
49575
49576 + pax_track_stack();
49577 +
49578 state = *get_task_state(task);
49579 vsize = eip = esp = 0;
49580 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
49581 @@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file
49582 gtime = task->gtime;
49583 }
49584
49585 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49586 + if (PAX_RAND_FLAGS(mm)) {
49587 + eip = 0;
49588 + esp = 0;
49589 + wchan = 0;
49590 + }
49591 +#endif
49592 +#ifdef CONFIG_GRKERNSEC_HIDESYM
49593 + wchan = 0;
49594 + eip =0;
49595 + esp =0;
49596 +#endif
49597 +
49598 /* scale priority and nice values from timeslices to -20..20 */
49599 /* to make it look like a "normal" Unix priority/nice value */
49600 priority = task_prio(task);
49601 @@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file
49602 vsize,
49603 mm ? get_mm_rss(mm) : 0,
49604 rsslim,
49605 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49606 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
49607 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
49608 + PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
49609 +#else
49610 mm ? (permitted ? mm->start_code : 1) : 0,
49611 mm ? (permitted ? mm->end_code : 1) : 0,
49612 (permitted && mm) ? mm->start_stack : 0,
49613 +#endif
49614 esp,
49615 eip,
49616 /* The signal information here is obsolete.
49617 @@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
49618
49619 return 0;
49620 }
49621 +
49622 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49623 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
49624 +{
49625 + u32 curr_ip = 0;
49626 + unsigned long flags;
49627 +
49628 + if (lock_task_sighand(task, &flags)) {
49629 + curr_ip = task->signal->curr_ip;
49630 + unlock_task_sighand(task, &flags);
49631 + }
49632 +
49633 + return sprintf(buffer, "%pI4\n", &curr_ip);
49634 +}
49635 +#endif
49636 diff -urNp linux-2.6.39.1/fs/proc/base.c linux-2.6.39.1/fs/proc/base.c
49637 --- linux-2.6.39.1/fs/proc/base.c 2011-05-19 00:06:34.000000000 -0400
49638 +++ linux-2.6.39.1/fs/proc/base.c 2011-06-04 21:20:04.000000000 -0400
49639 @@ -104,6 +104,22 @@ struct pid_entry {
49640 union proc_op op;
49641 };
49642
49643 +struct getdents_callback {
49644 + struct linux_dirent __user * current_dir;
49645 + struct linux_dirent __user * previous;
49646 + struct file * file;
49647 + int count;
49648 + int error;
49649 +};
49650 +
49651 +static int gr_fake_filldir(void * __buf, const char *name, int namlen,
49652 + loff_t offset, u64 ino, unsigned int d_type)
49653 +{
49654 + struct getdents_callback * buf = (struct getdents_callback *) __buf;
49655 + buf->error = -EINVAL;
49656 + return 0;
49657 +}
49658 +
49659 #define NOD(NAME, MODE, IOP, FOP, OP) { \
49660 .name = (NAME), \
49661 .len = sizeof(NAME) - 1, \
49662 @@ -206,6 +222,9 @@ static struct mm_struct *__check_mem_per
49663 if (task == current)
49664 return mm;
49665
49666 + if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
49667 + return ERR_PTR(-EPERM);
49668 +
49669 /*
49670 * If current is actively ptrace'ing, and would also be
49671 * permitted to freshly attach with ptrace now, permit it.
49672 @@ -279,6 +298,9 @@ static int proc_pid_cmdline(struct task_
49673 if (!mm->arg_end)
49674 goto out_mm; /* Shh! No looking before we're done */
49675
49676 + if (gr_acl_handle_procpidmem(task))
49677 + goto out_mm;
49678 +
49679 len = mm->arg_end - mm->arg_start;
49680
49681 if (len > PAGE_SIZE)
49682 @@ -306,12 +328,28 @@ out:
49683 return res;
49684 }
49685
49686 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49687 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49688 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
49689 + _mm->pax_flags & MF_PAX_SEGMEXEC))
49690 +#endif
49691 +
49692 static int proc_pid_auxv(struct task_struct *task, char *buffer)
49693 {
49694 struct mm_struct *mm = mm_for_maps(task);
49695 int res = PTR_ERR(mm);
49696 if (mm && !IS_ERR(mm)) {
49697 unsigned int nwords = 0;
49698 +
49699 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49700 + /* allow if we're currently ptracing this task */
49701 + if (PAX_RAND_FLAGS(mm) &&
49702 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
49703 + mmput(mm);
49704 + return res;
49705 + }
49706 +#endif
49707 +
49708 do {
49709 nwords += 2;
49710 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
49711 @@ -325,7 +363,7 @@ static int proc_pid_auxv(struct task_str
49712 }
49713
49714
49715 -#ifdef CONFIG_KALLSYMS
49716 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49717 /*
49718 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
49719 * Returns the resolved symbol. If that fails, simply return the address.
49720 @@ -364,7 +402,7 @@ static void unlock_trace(struct task_str
49721 mutex_unlock(&task->signal->cred_guard_mutex);
49722 }
49723
49724 -#ifdef CONFIG_STACKTRACE
49725 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49726
49727 #define MAX_STACK_TRACE_DEPTH 64
49728
49729 @@ -555,7 +593,7 @@ static int proc_pid_limits(struct task_s
49730 return count;
49731 }
49732
49733 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49734 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49735 static int proc_pid_syscall(struct task_struct *task, char *buffer)
49736 {
49737 long nr;
49738 @@ -584,7 +622,7 @@ static int proc_pid_syscall(struct task_
49739 /************************************************************************/
49740
49741 /* permission checks */
49742 -static int proc_fd_access_allowed(struct inode *inode)
49743 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
49744 {
49745 struct task_struct *task;
49746 int allowed = 0;
49747 @@ -594,7 +632,10 @@ static int proc_fd_access_allowed(struct
49748 */
49749 task = get_proc_task(inode);
49750 if (task) {
49751 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49752 + if (log)
49753 + allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
49754 + else
49755 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49756 put_task_struct(task);
49757 }
49758 return allowed;
49759 @@ -973,6 +1014,9 @@ static ssize_t environ_read(struct file
49760 if (!task)
49761 goto out_no_task;
49762
49763 + if (gr_acl_handle_procpidmem(task))
49764 + goto out;
49765 +
49766 ret = -ENOMEM;
49767 page = (char *)__get_free_page(GFP_TEMPORARY);
49768 if (!page)
49769 @@ -1660,7 +1704,7 @@ static void *proc_pid_follow_link(struct
49770 path_put(&nd->path);
49771
49772 /* Are we allowed to snoop on the tasks file descriptors? */
49773 - if (!proc_fd_access_allowed(inode))
49774 + if (!proc_fd_access_allowed(inode,0))
49775 goto out;
49776
49777 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
49778 @@ -1699,8 +1743,18 @@ static int proc_pid_readlink(struct dent
49779 struct path path;
49780
49781 /* Are we allowed to snoop on the tasks file descriptors? */
49782 - if (!proc_fd_access_allowed(inode))
49783 - goto out;
49784 + /* logging this is needed for learning on chromium to work properly,
49785 + but we don't want to flood the logs from 'ps' which does a readlink
49786 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
49787 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
49788 + */
49789 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
49790 + if (!proc_fd_access_allowed(inode,0))
49791 + goto out;
49792 + } else {
49793 + if (!proc_fd_access_allowed(inode,1))
49794 + goto out;
49795 + }
49796
49797 error = PROC_I(inode)->op.proc_get_link(inode, &path);
49798 if (error)
49799 @@ -1766,7 +1820,11 @@ static struct inode *proc_pid_make_inode
49800 rcu_read_lock();
49801 cred = __task_cred(task);
49802 inode->i_uid = cred->euid;
49803 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49804 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49805 +#else
49806 inode->i_gid = cred->egid;
49807 +#endif
49808 rcu_read_unlock();
49809 }
49810 security_task_to_inode(task, inode);
49811 @@ -1784,6 +1842,9 @@ static int pid_getattr(struct vfsmount *
49812 struct inode *inode = dentry->d_inode;
49813 struct task_struct *task;
49814 const struct cred *cred;
49815 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49816 + const struct cred *tmpcred = current_cred();
49817 +#endif
49818
49819 generic_fillattr(inode, stat);
49820
49821 @@ -1791,13 +1852,41 @@ static int pid_getattr(struct vfsmount *
49822 stat->uid = 0;
49823 stat->gid = 0;
49824 task = pid_task(proc_pid(inode), PIDTYPE_PID);
49825 +
49826 + if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
49827 + rcu_read_unlock();
49828 + return -ENOENT;
49829 + }
49830 +
49831 if (task) {
49832 + cred = __task_cred(task);
49833 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49834 + if (!tmpcred->uid || (tmpcred->uid == cred->uid)
49835 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49836 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49837 +#endif
49838 + ) {
49839 +#endif
49840 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49841 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49842 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49843 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49844 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49845 +#endif
49846 task_dumpable(task)) {
49847 - cred = __task_cred(task);
49848 stat->uid = cred->euid;
49849 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49850 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
49851 +#else
49852 stat->gid = cred->egid;
49853 +#endif
49854 }
49855 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49856 + } else {
49857 + rcu_read_unlock();
49858 + return -ENOENT;
49859 + }
49860 +#endif
49861 }
49862 rcu_read_unlock();
49863 return 0;
49864 @@ -1834,11 +1923,20 @@ static int pid_revalidate(struct dentry
49865
49866 if (task) {
49867 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49868 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49869 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49870 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49871 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49872 +#endif
49873 task_dumpable(task)) {
49874 rcu_read_lock();
49875 cred = __task_cred(task);
49876 inode->i_uid = cred->euid;
49877 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49878 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49879 +#else
49880 inode->i_gid = cred->egid;
49881 +#endif
49882 rcu_read_unlock();
49883 } else {
49884 inode->i_uid = 0;
49885 @@ -1959,7 +2057,8 @@ static int proc_fd_info(struct inode *in
49886 int fd = proc_fd(inode);
49887
49888 if (task) {
49889 - files = get_files_struct(task);
49890 + if (!gr_acl_handle_procpidmem(task))
49891 + files = get_files_struct(task);
49892 put_task_struct(task);
49893 }
49894 if (files) {
49895 @@ -2219,15 +2318,25 @@ static const struct file_operations proc
49896 */
49897 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
49898 {
49899 + struct task_struct *task;
49900 int rv;
49901
49902 if (flags & IPERM_FLAG_RCU)
49903 return -ECHILD;
49904 rv = generic_permission(inode, mask, flags, NULL);
49905 - if (rv == 0)
49906 - return 0;
49907 +
49908 if (task_pid(current) == proc_pid(inode))
49909 rv = 0;
49910 +
49911 + task = get_proc_task(inode);
49912 + if (task == NULL)
49913 + return rv;
49914 +
49915 + if (gr_acl_handle_procpidmem(task))
49916 + rv = -EACCES;
49917 +
49918 + put_task_struct(task);
49919 +
49920 return rv;
49921 }
49922
49923 @@ -2337,6 +2446,9 @@ static struct dentry *proc_pident_lookup
49924 if (!task)
49925 goto out_no_task;
49926
49927 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49928 + goto out;
49929 +
49930 /*
49931 * Yes, it does not scale. And it should not. Don't add
49932 * new entries into /proc/<tgid>/ without very good reasons.
49933 @@ -2381,6 +2493,9 @@ static int proc_pident_readdir(struct fi
49934 if (!task)
49935 goto out_no_task;
49936
49937 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49938 + goto out;
49939 +
49940 ret = 0;
49941 i = filp->f_pos;
49942 switch (i) {
49943 @@ -2651,7 +2766,7 @@ static void *proc_self_follow_link(struc
49944 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
49945 void *cookie)
49946 {
49947 - char *s = nd_get_link(nd);
49948 + const char *s = nd_get_link(nd);
49949 if (!IS_ERR(s))
49950 __putname(s);
49951 }
49952 @@ -2835,7 +2950,7 @@ static const struct pid_entry tgid_base_
49953 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
49954 #endif
49955 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49956 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49957 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49958 INF("syscall", S_IRUGO, proc_pid_syscall),
49959 #endif
49960 INF("cmdline", S_IRUGO, proc_pid_cmdline),
49961 @@ -2860,10 +2975,10 @@ static const struct pid_entry tgid_base_
49962 #ifdef CONFIG_SECURITY
49963 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49964 #endif
49965 -#ifdef CONFIG_KALLSYMS
49966 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49967 INF("wchan", S_IRUGO, proc_pid_wchan),
49968 #endif
49969 -#ifdef CONFIG_STACKTRACE
49970 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49971 ONE("stack", S_IRUGO, proc_pid_stack),
49972 #endif
49973 #ifdef CONFIG_SCHEDSTATS
49974 @@ -2894,6 +3009,9 @@ static const struct pid_entry tgid_base_
49975 #ifdef CONFIG_TASK_IO_ACCOUNTING
49976 INF("io", S_IRUGO, proc_tgid_io_accounting),
49977 #endif
49978 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49979 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
49980 +#endif
49981 };
49982
49983 static int proc_tgid_base_readdir(struct file * filp,
49984 @@ -3019,7 +3137,14 @@ static struct dentry *proc_pid_instantia
49985 if (!inode)
49986 goto out;
49987
49988 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49989 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
49990 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49991 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49992 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
49993 +#else
49994 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
49995 +#endif
49996 inode->i_op = &proc_tgid_base_inode_operations;
49997 inode->i_fop = &proc_tgid_base_operations;
49998 inode->i_flags|=S_IMMUTABLE;
49999 @@ -3061,7 +3186,11 @@ struct dentry *proc_pid_lookup(struct in
50000 if (!task)
50001 goto out;
50002
50003 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
50004 + goto out_put_task;
50005 +
50006 result = proc_pid_instantiate(dir, dentry, task, NULL);
50007 +out_put_task:
50008 put_task_struct(task);
50009 out:
50010 return result;
50011 @@ -3126,6 +3255,11 @@ int proc_pid_readdir(struct file * filp,
50012 {
50013 unsigned int nr;
50014 struct task_struct *reaper;
50015 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50016 + const struct cred *tmpcred = current_cred();
50017 + const struct cred *itercred;
50018 +#endif
50019 + filldir_t __filldir = filldir;
50020 struct tgid_iter iter;
50021 struct pid_namespace *ns;
50022
50023 @@ -3149,8 +3283,27 @@ int proc_pid_readdir(struct file * filp,
50024 for (iter = next_tgid(ns, iter);
50025 iter.task;
50026 iter.tgid += 1, iter = next_tgid(ns, iter)) {
50027 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50028 + rcu_read_lock();
50029 + itercred = __task_cred(iter.task);
50030 +#endif
50031 + if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
50032 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50033 + || (tmpcred->uid && (itercred->uid != tmpcred->uid)
50034 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50035 + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
50036 +#endif
50037 + )
50038 +#endif
50039 + )
50040 + __filldir = &gr_fake_filldir;
50041 + else
50042 + __filldir = filldir;
50043 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50044 + rcu_read_unlock();
50045 +#endif
50046 filp->f_pos = iter.tgid + TGID_OFFSET;
50047 - if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
50048 + if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
50049 put_task_struct(iter.task);
50050 goto out;
50051 }
50052 @@ -3177,7 +3330,7 @@ static const struct pid_entry tid_base_s
50053 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
50054 #endif
50055 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
50056 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
50057 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
50058 INF("syscall", S_IRUGO, proc_pid_syscall),
50059 #endif
50060 INF("cmdline", S_IRUGO, proc_pid_cmdline),
50061 @@ -3201,10 +3354,10 @@ static const struct pid_entry tid_base_s
50062 #ifdef CONFIG_SECURITY
50063 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
50064 #endif
50065 -#ifdef CONFIG_KALLSYMS
50066 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50067 INF("wchan", S_IRUGO, proc_pid_wchan),
50068 #endif
50069 -#ifdef CONFIG_STACKTRACE
50070 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50071 ONE("stack", S_IRUGO, proc_pid_stack),
50072 #endif
50073 #ifdef CONFIG_SCHEDSTATS
50074 diff -urNp linux-2.6.39.1/fs/proc/cmdline.c linux-2.6.39.1/fs/proc/cmdline.c
50075 --- linux-2.6.39.1/fs/proc/cmdline.c 2011-05-19 00:06:34.000000000 -0400
50076 +++ linux-2.6.39.1/fs/proc/cmdline.c 2011-05-22 19:41:37.000000000 -0400
50077 @@ -23,7 +23,11 @@ static const struct file_operations cmdl
50078
50079 static int __init proc_cmdline_init(void)
50080 {
50081 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
50082 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
50083 +#else
50084 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
50085 +#endif
50086 return 0;
50087 }
50088 module_init(proc_cmdline_init);
50089 diff -urNp linux-2.6.39.1/fs/proc/devices.c linux-2.6.39.1/fs/proc/devices.c
50090 --- linux-2.6.39.1/fs/proc/devices.c 2011-05-19 00:06:34.000000000 -0400
50091 +++ linux-2.6.39.1/fs/proc/devices.c 2011-05-22 19:41:37.000000000 -0400
50092 @@ -64,7 +64,11 @@ static const struct file_operations proc
50093
50094 static int __init proc_devices_init(void)
50095 {
50096 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
50097 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
50098 +#else
50099 proc_create("devices", 0, NULL, &proc_devinfo_operations);
50100 +#endif
50101 return 0;
50102 }
50103 module_init(proc_devices_init);
50104 diff -urNp linux-2.6.39.1/fs/proc/inode.c linux-2.6.39.1/fs/proc/inode.c
50105 --- linux-2.6.39.1/fs/proc/inode.c 2011-05-19 00:06:34.000000000 -0400
50106 +++ linux-2.6.39.1/fs/proc/inode.c 2011-05-22 19:41:37.000000000 -0400
50107 @@ -433,7 +433,11 @@ struct inode *proc_get_inode(struct supe
50108 if (de->mode) {
50109 inode->i_mode = de->mode;
50110 inode->i_uid = de->uid;
50111 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50112 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50113 +#else
50114 inode->i_gid = de->gid;
50115 +#endif
50116 }
50117 if (de->size)
50118 inode->i_size = de->size;
50119 diff -urNp linux-2.6.39.1/fs/proc/internal.h linux-2.6.39.1/fs/proc/internal.h
50120 --- linux-2.6.39.1/fs/proc/internal.h 2011-05-19 00:06:34.000000000 -0400
50121 +++ linux-2.6.39.1/fs/proc/internal.h 2011-05-22 19:41:37.000000000 -0400
50122 @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
50123 struct pid *pid, struct task_struct *task);
50124 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
50125 struct pid *pid, struct task_struct *task);
50126 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
50127 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
50128 +#endif
50129 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
50130
50131 extern const struct file_operations proc_maps_operations;
50132 diff -urNp linux-2.6.39.1/fs/proc/Kconfig linux-2.6.39.1/fs/proc/Kconfig
50133 --- linux-2.6.39.1/fs/proc/Kconfig 2011-05-19 00:06:34.000000000 -0400
50134 +++ linux-2.6.39.1/fs/proc/Kconfig 2011-05-22 19:41:37.000000000 -0400
50135 @@ -30,12 +30,12 @@ config PROC_FS
50136
50137 config PROC_KCORE
50138 bool "/proc/kcore support" if !ARM
50139 - depends on PROC_FS && MMU
50140 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
50141
50142 config PROC_VMCORE
50143 bool "/proc/vmcore support"
50144 - depends on PROC_FS && CRASH_DUMP
50145 - default y
50146 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
50147 + default n
50148 help
50149 Exports the dump image of crashed kernel in ELF format.
50150
50151 @@ -59,8 +59,8 @@ config PROC_SYSCTL
50152 limited in memory.
50153
50154 config PROC_PAGE_MONITOR
50155 - default y
50156 - depends on PROC_FS && MMU
50157 + default n
50158 + depends on PROC_FS && MMU && !GRKERNSEC
50159 bool "Enable /proc page monitoring" if EXPERT
50160 help
50161 Various /proc files exist to monitor process memory utilization:
50162 diff -urNp linux-2.6.39.1/fs/proc/kcore.c linux-2.6.39.1/fs/proc/kcore.c
50163 --- linux-2.6.39.1/fs/proc/kcore.c 2011-05-19 00:06:34.000000000 -0400
50164 +++ linux-2.6.39.1/fs/proc/kcore.c 2011-05-22 19:41:37.000000000 -0400
50165 @@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
50166 off_t offset = 0;
50167 struct kcore_list *m;
50168
50169 + pax_track_stack();
50170 +
50171 /* setup ELF header */
50172 elf = (struct elfhdr *) bufp;
50173 bufp += sizeof(struct elfhdr);
50174 @@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
50175 * the addresses in the elf_phdr on our list.
50176 */
50177 start = kc_offset_to_vaddr(*fpos - elf_buflen);
50178 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
50179 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
50180 + if (tsz > buflen)
50181 tsz = buflen;
50182 -
50183 +
50184 while (buflen) {
50185 struct kcore_list *m;
50186
50187 @@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
50188 kfree(elf_buf);
50189 } else {
50190 if (kern_addr_valid(start)) {
50191 - unsigned long n;
50192 + char *elf_buf;
50193 + mm_segment_t oldfs;
50194
50195 - n = copy_to_user(buffer, (char *)start, tsz);
50196 - /*
50197 - * We cannot distingush between fault on source
50198 - * and fault on destination. When this happens
50199 - * we clear too and hope it will trigger the
50200 - * EFAULT again.
50201 - */
50202 - if (n) {
50203 - if (clear_user(buffer + tsz - n,
50204 - n))
50205 + elf_buf = kmalloc(tsz, GFP_KERNEL);
50206 + if (!elf_buf)
50207 + return -ENOMEM;
50208 + oldfs = get_fs();
50209 + set_fs(KERNEL_DS);
50210 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
50211 + set_fs(oldfs);
50212 + if (copy_to_user(buffer, elf_buf, tsz)) {
50213 + kfree(elf_buf);
50214 return -EFAULT;
50215 + }
50216 }
50217 + set_fs(oldfs);
50218 + kfree(elf_buf);
50219 } else {
50220 if (clear_user(buffer, tsz))
50221 return -EFAULT;
50222 @@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
50223
50224 static int open_kcore(struct inode *inode, struct file *filp)
50225 {
50226 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
50227 + return -EPERM;
50228 +#endif
50229 if (!capable(CAP_SYS_RAWIO))
50230 return -EPERM;
50231 if (kcore_need_update)
50232 diff -urNp linux-2.6.39.1/fs/proc/meminfo.c linux-2.6.39.1/fs/proc/meminfo.c
50233 --- linux-2.6.39.1/fs/proc/meminfo.c 2011-05-19 00:06:34.000000000 -0400
50234 +++ linux-2.6.39.1/fs/proc/meminfo.c 2011-05-22 19:36:32.000000000 -0400
50235 @@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
50236 unsigned long pages[NR_LRU_LISTS];
50237 int lru;
50238
50239 + pax_track_stack();
50240 +
50241 /*
50242 * display in kilobytes.
50243 */
50244 @@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
50245 vmi.used >> 10,
50246 vmi.largest_chunk >> 10
50247 #ifdef CONFIG_MEMORY_FAILURE
50248 - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
50249 + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
50250 #endif
50251 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
50252 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
50253 diff -urNp linux-2.6.39.1/fs/proc/nommu.c linux-2.6.39.1/fs/proc/nommu.c
50254 --- linux-2.6.39.1/fs/proc/nommu.c 2011-05-19 00:06:34.000000000 -0400
50255 +++ linux-2.6.39.1/fs/proc/nommu.c 2011-05-22 19:36:32.000000000 -0400
50256 @@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
50257 if (len < 1)
50258 len = 1;
50259 seq_printf(m, "%*c", len, ' ');
50260 - seq_path(m, &file->f_path, "");
50261 + seq_path(m, &file->f_path, "\n\\");
50262 }
50263
50264 seq_putc(m, '\n');
50265 diff -urNp linux-2.6.39.1/fs/proc/proc_net.c linux-2.6.39.1/fs/proc/proc_net.c
50266 --- linux-2.6.39.1/fs/proc/proc_net.c 2011-05-19 00:06:34.000000000 -0400
50267 +++ linux-2.6.39.1/fs/proc/proc_net.c 2011-05-22 19:41:37.000000000 -0400
50268 @@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
50269 struct task_struct *task;
50270 struct nsproxy *ns;
50271 struct net *net = NULL;
50272 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50273 + const struct cred *cred = current_cred();
50274 +#endif
50275 +
50276 +#ifdef CONFIG_GRKERNSEC_PROC_USER
50277 + if (cred->fsuid)
50278 + return net;
50279 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50280 + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
50281 + return net;
50282 +#endif
50283
50284 rcu_read_lock();
50285 task = pid_task(proc_pid(dir), PIDTYPE_PID);
50286 diff -urNp linux-2.6.39.1/fs/proc/proc_sysctl.c linux-2.6.39.1/fs/proc/proc_sysctl.c
50287 --- linux-2.6.39.1/fs/proc/proc_sysctl.c 2011-05-19 00:06:34.000000000 -0400
50288 +++ linux-2.6.39.1/fs/proc/proc_sysctl.c 2011-05-22 19:41:37.000000000 -0400
50289 @@ -8,6 +8,8 @@
50290 #include <linux/namei.h>
50291 #include "internal.h"
50292
50293 +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
50294 +
50295 static const struct dentry_operations proc_sys_dentry_operations;
50296 static const struct file_operations proc_sys_file_operations;
50297 static const struct inode_operations proc_sys_inode_operations;
50298 @@ -111,6 +113,9 @@ static struct dentry *proc_sys_lookup(st
50299 if (!p)
50300 goto out;
50301
50302 + if (gr_handle_sysctl(p, MAY_EXEC))
50303 + goto out;
50304 +
50305 err = ERR_PTR(-ENOMEM);
50306 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
50307 if (h)
50308 @@ -230,6 +235,9 @@ static int scan(struct ctl_table_header
50309 if (*pos < file->f_pos)
50310 continue;
50311
50312 + if (gr_handle_sysctl(table, 0))
50313 + continue;
50314 +
50315 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
50316 if (res)
50317 return res;
50318 @@ -358,6 +366,9 @@ static int proc_sys_getattr(struct vfsmo
50319 if (IS_ERR(head))
50320 return PTR_ERR(head);
50321
50322 + if (table && gr_handle_sysctl(table, MAY_EXEC))
50323 + return -ENOENT;
50324 +
50325 generic_fillattr(inode, stat);
50326 if (table)
50327 stat->mode = (stat->mode & S_IFMT) | table->mode;
50328 diff -urNp linux-2.6.39.1/fs/proc/root.c linux-2.6.39.1/fs/proc/root.c
50329 --- linux-2.6.39.1/fs/proc/root.c 2011-05-19 00:06:34.000000000 -0400
50330 +++ linux-2.6.39.1/fs/proc/root.c 2011-05-22 19:41:37.000000000 -0400
50331 @@ -122,7 +122,15 @@ void __init proc_root_init(void)
50332 #ifdef CONFIG_PROC_DEVICETREE
50333 proc_device_tree_init();
50334 #endif
50335 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
50336 +#ifdef CONFIG_GRKERNSEC_PROC_USER
50337 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
50338 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50339 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
50340 +#endif
50341 +#else
50342 proc_mkdir("bus", NULL);
50343 +#endif
50344 proc_sys_init();
50345 }
50346
50347 diff -urNp linux-2.6.39.1/fs/proc/task_mmu.c linux-2.6.39.1/fs/proc/task_mmu.c
50348 --- linux-2.6.39.1/fs/proc/task_mmu.c 2011-05-19 00:06:34.000000000 -0400
50349 +++ linux-2.6.39.1/fs/proc/task_mmu.c 2011-05-22 22:43:29.000000000 -0400
50350 @@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct
50351 "VmExe:\t%8lu kB\n"
50352 "VmLib:\t%8lu kB\n"
50353 "VmPTE:\t%8lu kB\n"
50354 - "VmSwap:\t%8lu kB\n",
50355 - hiwater_vm << (PAGE_SHIFT-10),
50356 + "VmSwap:\t%8lu kB\n"
50357 +
50358 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50359 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
50360 +#endif
50361 +
50362 + ,hiwater_vm << (PAGE_SHIFT-10),
50363 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
50364 mm->locked_vm << (PAGE_SHIFT-10),
50365 hiwater_rss << (PAGE_SHIFT-10),
50366 @@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct
50367 data << (PAGE_SHIFT-10),
50368 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
50369 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
50370 - swap << (PAGE_SHIFT-10));
50371 + swap << (PAGE_SHIFT-10)
50372 +
50373 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50374 + , mm->context.user_cs_base, mm->context.user_cs_limit
50375 +#endif
50376 +
50377 + );
50378 }
50379
50380 unsigned long task_vsize(struct mm_struct *mm)
50381 @@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in
50382 return ret;
50383 }
50384
50385 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50386 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
50387 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
50388 + _mm->pax_flags & MF_PAX_SEGMEXEC))
50389 +#endif
50390 +
50391 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
50392 {
50393 struct mm_struct *mm = vma->vm_mm;
50394 @@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file
50395 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
50396 }
50397
50398 - /* We don't show the stack guard page in /proc/maps */
50399 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50400 + start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
50401 + end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
50402 +#else
50403 start = vma->vm_start;
50404 - if (stack_guard_page_start(vma, start))
50405 - start += PAGE_SIZE;
50406 end = vma->vm_end;
50407 - if (stack_guard_page_end(vma, end))
50408 - end -= PAGE_SIZE;
50409 +#endif
50410
50411 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
50412 start,
50413 @@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file
50414 flags & VM_WRITE ? 'w' : '-',
50415 flags & VM_EXEC ? 'x' : '-',
50416 flags & VM_MAYSHARE ? 's' : 'p',
50417 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50418 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
50419 +#else
50420 pgoff,
50421 +#endif
50422 MAJOR(dev), MINOR(dev), ino, &len);
50423
50424 /*
50425 @@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file
50426 */
50427 if (file) {
50428 pad_len_spaces(m, len);
50429 - seq_path(m, &file->f_path, "\n");
50430 + seq_path(m, &file->f_path, "\n\\");
50431 } else {
50432 const char *name = arch_vma_name(vma);
50433 if (!name) {
50434 @@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file
50435 if (vma->vm_start <= mm->brk &&
50436 vma->vm_end >= mm->start_brk) {
50437 name = "[heap]";
50438 - } else if (vma->vm_start <= mm->start_stack &&
50439 - vma->vm_end >= mm->start_stack) {
50440 + } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
50441 + (vma->vm_start <= mm->start_stack &&
50442 + vma->vm_end >= mm->start_stack)) {
50443 name = "[stack]";
50444 }
50445 } else {
50446 @@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m,
50447 };
50448
50449 memset(&mss, 0, sizeof mss);
50450 - mss.vma = vma;
50451 - /* mmap_sem is held in m_start */
50452 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50453 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50454 -
50455 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50456 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
50457 +#endif
50458 + mss.vma = vma;
50459 + /* mmap_sem is held in m_start */
50460 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50461 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50462 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50463 + }
50464 +#endif
50465 show_map_vma(m, vma);
50466
50467 seq_printf(m,
50468 @@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m,
50469 "KernelPageSize: %8lu kB\n"
50470 "MMUPageSize: %8lu kB\n"
50471 "Locked: %8lu kB\n",
50472 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50473 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
50474 +#else
50475 (vma->vm_end - vma->vm_start) >> 10,
50476 +#endif
50477 mss.resident >> 10,
50478 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
50479 mss.shared_clean >> 10,
50480 diff -urNp linux-2.6.39.1/fs/proc/task_nommu.c linux-2.6.39.1/fs/proc/task_nommu.c
50481 --- linux-2.6.39.1/fs/proc/task_nommu.c 2011-05-19 00:06:34.000000000 -0400
50482 +++ linux-2.6.39.1/fs/proc/task_nommu.c 2011-05-22 19:36:32.000000000 -0400
50483 @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
50484 else
50485 bytes += kobjsize(mm);
50486
50487 - if (current->fs && current->fs->users > 1)
50488 + if (current->fs && atomic_read(&current->fs->users) > 1)
50489 sbytes += kobjsize(current->fs);
50490 else
50491 bytes += kobjsize(current->fs);
50492 @@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil
50493
50494 if (file) {
50495 pad_len_spaces(m, len);
50496 - seq_path(m, &file->f_path, "");
50497 + seq_path(m, &file->f_path, "\n\\");
50498 } else if (mm) {
50499 if (vma->vm_start <= mm->start_stack &&
50500 vma->vm_end >= mm->start_stack) {
50501 diff -urNp linux-2.6.39.1/fs/quota/netlink.c linux-2.6.39.1/fs/quota/netlink.c
50502 --- linux-2.6.39.1/fs/quota/netlink.c 2011-05-19 00:06:34.000000000 -0400
50503 +++ linux-2.6.39.1/fs/quota/netlink.c 2011-05-22 19:36:32.000000000 -0400
50504 @@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
50505 void quota_send_warning(short type, unsigned int id, dev_t dev,
50506 const char warntype)
50507 {
50508 - static atomic_t seq;
50509 + static atomic_unchecked_t seq;
50510 struct sk_buff *skb;
50511 void *msg_head;
50512 int ret;
50513 @@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
50514 "VFS: Not enough memory to send quota warning.\n");
50515 return;
50516 }
50517 - msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
50518 + msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
50519 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
50520 if (!msg_head) {
50521 printk(KERN_ERR
50522 diff -urNp linux-2.6.39.1/fs/readdir.c linux-2.6.39.1/fs/readdir.c
50523 --- linux-2.6.39.1/fs/readdir.c 2011-05-19 00:06:34.000000000 -0400
50524 +++ linux-2.6.39.1/fs/readdir.c 2011-05-22 19:41:42.000000000 -0400
50525 @@ -17,6 +17,7 @@
50526 #include <linux/security.h>
50527 #include <linux/syscalls.h>
50528 #include <linux/unistd.h>
50529 +#include <linux/namei.h>
50530
50531 #include <asm/uaccess.h>
50532
50533 @@ -67,6 +68,7 @@ struct old_linux_dirent {
50534
50535 struct readdir_callback {
50536 struct old_linux_dirent __user * dirent;
50537 + struct file * file;
50538 int result;
50539 };
50540
50541 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
50542 buf->result = -EOVERFLOW;
50543 return -EOVERFLOW;
50544 }
50545 +
50546 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50547 + return 0;
50548 +
50549 buf->result++;
50550 dirent = buf->dirent;
50551 if (!access_ok(VERIFY_WRITE, dirent,
50552 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
50553
50554 buf.result = 0;
50555 buf.dirent = dirent;
50556 + buf.file = file;
50557
50558 error = vfs_readdir(file, fillonedir, &buf);
50559 if (buf.result)
50560 @@ -142,6 +149,7 @@ struct linux_dirent {
50561 struct getdents_callback {
50562 struct linux_dirent __user * current_dir;
50563 struct linux_dirent __user * previous;
50564 + struct file * file;
50565 int count;
50566 int error;
50567 };
50568 @@ -163,6 +171,10 @@ static int filldir(void * __buf, const c
50569 buf->error = -EOVERFLOW;
50570 return -EOVERFLOW;
50571 }
50572 +
50573 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50574 + return 0;
50575 +
50576 dirent = buf->previous;
50577 if (dirent) {
50578 if (__put_user(offset, &dirent->d_off))
50579 @@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
50580 buf.previous = NULL;
50581 buf.count = count;
50582 buf.error = 0;
50583 + buf.file = file;
50584
50585 error = vfs_readdir(file, filldir, &buf);
50586 if (error >= 0)
50587 @@ -229,6 +242,7 @@ out:
50588 struct getdents_callback64 {
50589 struct linux_dirent64 __user * current_dir;
50590 struct linux_dirent64 __user * previous;
50591 + struct file *file;
50592 int count;
50593 int error;
50594 };
50595 @@ -244,6 +258,10 @@ static int filldir64(void * __buf, const
50596 buf->error = -EINVAL; /* only used if we fail.. */
50597 if (reclen > buf->count)
50598 return -EINVAL;
50599 +
50600 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50601 + return 0;
50602 +
50603 dirent = buf->previous;
50604 if (dirent) {
50605 if (__put_user(offset, &dirent->d_off))
50606 @@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
50607
50608 buf.current_dir = dirent;
50609 buf.previous = NULL;
50610 + buf.file = file;
50611 buf.count = count;
50612 buf.error = 0;
50613
50614 diff -urNp linux-2.6.39.1/fs/reiserfs/dir.c linux-2.6.39.1/fs/reiserfs/dir.c
50615 --- linux-2.6.39.1/fs/reiserfs/dir.c 2011-05-19 00:06:34.000000000 -0400
50616 +++ linux-2.6.39.1/fs/reiserfs/dir.c 2011-05-22 19:36:32.000000000 -0400
50617 @@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
50618 struct reiserfs_dir_entry de;
50619 int ret = 0;
50620
50621 + pax_track_stack();
50622 +
50623 reiserfs_write_lock(inode->i_sb);
50624
50625 reiserfs_check_lock_depth(inode->i_sb, "readdir");
50626 diff -urNp linux-2.6.39.1/fs/reiserfs/do_balan.c linux-2.6.39.1/fs/reiserfs/do_balan.c
50627 --- linux-2.6.39.1/fs/reiserfs/do_balan.c 2011-05-19 00:06:34.000000000 -0400
50628 +++ linux-2.6.39.1/fs/reiserfs/do_balan.c 2011-05-22 19:36:32.000000000 -0400
50629 @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
50630 return;
50631 }
50632
50633 - atomic_inc(&(fs_generation(tb->tb_sb)));
50634 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
50635 do_balance_starts(tb);
50636
50637 /* balance leaf returns 0 except if combining L R and S into
50638 diff -urNp linux-2.6.39.1/fs/reiserfs/item_ops.c linux-2.6.39.1/fs/reiserfs/item_ops.c
50639 --- linux-2.6.39.1/fs/reiserfs/item_ops.c 2011-05-19 00:06:34.000000000 -0400
50640 +++ linux-2.6.39.1/fs/reiserfs/item_ops.c 2011-05-22 19:36:32.000000000 -0400
50641 @@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
50642 vi->vi_index, vi->vi_type, vi->vi_ih);
50643 }
50644
50645 -static struct item_operations stat_data_ops = {
50646 +static const struct item_operations stat_data_ops = {
50647 .bytes_number = sd_bytes_number,
50648 .decrement_key = sd_decrement_key,
50649 .is_left_mergeable = sd_is_left_mergeable,
50650 @@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
50651 vi->vi_index, vi->vi_type, vi->vi_ih);
50652 }
50653
50654 -static struct item_operations direct_ops = {
50655 +static const struct item_operations direct_ops = {
50656 .bytes_number = direct_bytes_number,
50657 .decrement_key = direct_decrement_key,
50658 .is_left_mergeable = direct_is_left_mergeable,
50659 @@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
50660 vi->vi_index, vi->vi_type, vi->vi_ih);
50661 }
50662
50663 -static struct item_operations indirect_ops = {
50664 +static const struct item_operations indirect_ops = {
50665 .bytes_number = indirect_bytes_number,
50666 .decrement_key = indirect_decrement_key,
50667 .is_left_mergeable = indirect_is_left_mergeable,
50668 @@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
50669 printk("\n");
50670 }
50671
50672 -static struct item_operations direntry_ops = {
50673 +static const struct item_operations direntry_ops = {
50674 .bytes_number = direntry_bytes_number,
50675 .decrement_key = direntry_decrement_key,
50676 .is_left_mergeable = direntry_is_left_mergeable,
50677 @@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
50678 "Invalid item type observed, run fsck ASAP");
50679 }
50680
50681 -static struct item_operations errcatch_ops = {
50682 +static const struct item_operations errcatch_ops = {
50683 errcatch_bytes_number,
50684 errcatch_decrement_key,
50685 errcatch_is_left_mergeable,
50686 @@ -746,7 +746,7 @@ static struct item_operations errcatch_o
50687 #error Item types must use disk-format assigned values.
50688 #endif
50689
50690 -struct item_operations *item_ops[TYPE_ANY + 1] = {
50691 +const struct item_operations * const item_ops[TYPE_ANY + 1] = {
50692 &stat_data_ops,
50693 &indirect_ops,
50694 &direct_ops,
50695 diff -urNp linux-2.6.39.1/fs/reiserfs/journal.c linux-2.6.39.1/fs/reiserfs/journal.c
50696 --- linux-2.6.39.1/fs/reiserfs/journal.c 2011-05-19 00:06:34.000000000 -0400
50697 +++ linux-2.6.39.1/fs/reiserfs/journal.c 2011-05-22 19:36:32.000000000 -0400
50698 @@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
50699 struct buffer_head *bh;
50700 int i, j;
50701
50702 + pax_track_stack();
50703 +
50704 bh = __getblk(dev, block, bufsize);
50705 if (buffer_uptodate(bh))
50706 return (bh);
50707 diff -urNp linux-2.6.39.1/fs/reiserfs/namei.c linux-2.6.39.1/fs/reiserfs/namei.c
50708 --- linux-2.6.39.1/fs/reiserfs/namei.c 2011-05-19 00:06:34.000000000 -0400
50709 +++ linux-2.6.39.1/fs/reiserfs/namei.c 2011-05-22 19:36:32.000000000 -0400
50710 @@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode
50711 unsigned long savelink = 1;
50712 struct timespec ctime;
50713
50714 + pax_track_stack();
50715 +
50716 /* three balancings: (1) old name removal, (2) new name insertion
50717 and (3) maybe "save" link insertion
50718 stat data updates: (1) old directory,
50719 diff -urNp linux-2.6.39.1/fs/reiserfs/procfs.c linux-2.6.39.1/fs/reiserfs/procfs.c
50720 --- linux-2.6.39.1/fs/reiserfs/procfs.c 2011-05-19 00:06:34.000000000 -0400
50721 +++ linux-2.6.39.1/fs/reiserfs/procfs.c 2011-05-22 19:36:32.000000000 -0400
50722 @@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
50723 "SMALL_TAILS " : "NO_TAILS ",
50724 replay_only(sb) ? "REPLAY_ONLY " : "",
50725 convert_reiserfs(sb) ? "CONV " : "",
50726 - atomic_read(&r->s_generation_counter),
50727 + atomic_read_unchecked(&r->s_generation_counter),
50728 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
50729 SF(s_do_balance), SF(s_unneeded_left_neighbor),
50730 SF(s_good_search_by_key_reada), SF(s_bmaps),
50731 @@ -299,6 +299,8 @@ static int show_journal(struct seq_file
50732 struct journal_params *jp = &rs->s_v1.s_journal;
50733 char b[BDEVNAME_SIZE];
50734
50735 + pax_track_stack();
50736 +
50737 seq_printf(m, /* on-disk fields */
50738 "jp_journal_1st_block: \t%i\n"
50739 "jp_journal_dev: \t%s[%x]\n"
50740 diff -urNp linux-2.6.39.1/fs/reiserfs/stree.c linux-2.6.39.1/fs/reiserfs/stree.c
50741 --- linux-2.6.39.1/fs/reiserfs/stree.c 2011-05-19 00:06:34.000000000 -0400
50742 +++ linux-2.6.39.1/fs/reiserfs/stree.c 2011-05-22 19:36:32.000000000 -0400
50743 @@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
50744 int iter = 0;
50745 #endif
50746
50747 + pax_track_stack();
50748 +
50749 BUG_ON(!th->t_trans_id);
50750
50751 init_tb_struct(th, &s_del_balance, sb, path,
50752 @@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
50753 int retval;
50754 int quota_cut_bytes = 0;
50755
50756 + pax_track_stack();
50757 +
50758 BUG_ON(!th->t_trans_id);
50759
50760 le_key2cpu_key(&cpu_key, key);
50761 @@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
50762 int quota_cut_bytes;
50763 loff_t tail_pos = 0;
50764
50765 + pax_track_stack();
50766 +
50767 BUG_ON(!th->t_trans_id);
50768
50769 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
50770 @@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
50771 int retval;
50772 int fs_gen;
50773
50774 + pax_track_stack();
50775 +
50776 BUG_ON(!th->t_trans_id);
50777
50778 fs_gen = get_generation(inode->i_sb);
50779 @@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
50780 int fs_gen = 0;
50781 int quota_bytes = 0;
50782
50783 + pax_track_stack();
50784 +
50785 BUG_ON(!th->t_trans_id);
50786
50787 if (inode) { /* Do we count quotas for item? */
50788 diff -urNp linux-2.6.39.1/fs/reiserfs/super.c linux-2.6.39.1/fs/reiserfs/super.c
50789 --- linux-2.6.39.1/fs/reiserfs/super.c 2011-05-19 00:06:34.000000000 -0400
50790 +++ linux-2.6.39.1/fs/reiserfs/super.c 2011-05-22 19:36:32.000000000 -0400
50791 @@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
50792 {.option_name = NULL}
50793 };
50794
50795 + pax_track_stack();
50796 +
50797 *blocks = 0;
50798 if (!options || !*options)
50799 /* use default configuration: create tails, journaling on, no
50800 diff -urNp linux-2.6.39.1/fs/select.c linux-2.6.39.1/fs/select.c
50801 --- linux-2.6.39.1/fs/select.c 2011-05-19 00:06:34.000000000 -0400
50802 +++ linux-2.6.39.1/fs/select.c 2011-05-22 19:41:42.000000000 -0400
50803 @@ -20,6 +20,7 @@
50804 #include <linux/module.h>
50805 #include <linux/slab.h>
50806 #include <linux/poll.h>
50807 +#include <linux/security.h>
50808 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
50809 #include <linux/file.h>
50810 #include <linux/fdtable.h>
50811 @@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
50812 int retval, i, timed_out = 0;
50813 unsigned long slack = 0;
50814
50815 + pax_track_stack();
50816 +
50817 rcu_read_lock();
50818 retval = max_select_fd(n, fds);
50819 rcu_read_unlock();
50820 @@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user
50821 /* Allocate small arguments on the stack to save memory and be faster */
50822 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
50823
50824 + pax_track_stack();
50825 +
50826 ret = -EINVAL;
50827 if (n < 0)
50828 goto out_nofds;
50829 @@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf
50830 struct poll_list *walk = head;
50831 unsigned long todo = nfds;
50832
50833 + pax_track_stack();
50834 +
50835 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
50836 if (nfds > rlimit(RLIMIT_NOFILE))
50837 return -EINVAL;
50838
50839 diff -urNp linux-2.6.39.1/fs/seq_file.c linux-2.6.39.1/fs/seq_file.c
50840 --- linux-2.6.39.1/fs/seq_file.c 2011-05-19 00:06:34.000000000 -0400
50841 +++ linux-2.6.39.1/fs/seq_file.c 2011-05-22 19:36:32.000000000 -0400
50842 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
50843 return 0;
50844 }
50845 if (!m->buf) {
50846 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50847 + m->size = PAGE_SIZE;
50848 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
50849 if (!m->buf)
50850 return -ENOMEM;
50851 }
50852 @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
50853 Eoverflow:
50854 m->op->stop(m, p);
50855 kfree(m->buf);
50856 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50857 + m->size <<= 1;
50858 + m->buf = kmalloc(m->size, GFP_KERNEL);
50859 return !m->buf ? -ENOMEM : -EAGAIN;
50860 }
50861
50862 @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
50863 m->version = file->f_version;
50864 /* grab buffer if we didn't have one */
50865 if (!m->buf) {
50866 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50867 + m->size = PAGE_SIZE;
50868 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
50869 if (!m->buf)
50870 goto Enomem;
50871 }
50872 @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
50873 goto Fill;
50874 m->op->stop(m, p);
50875 kfree(m->buf);
50876 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50877 + m->size <<= 1;
50878 + m->buf = kmalloc(m->size, GFP_KERNEL);
50879 if (!m->buf)
50880 goto Enomem;
50881 m->count = 0;
50882 diff -urNp linux-2.6.39.1/fs/splice.c linux-2.6.39.1/fs/splice.c
50883 --- linux-2.6.39.1/fs/splice.c 2011-05-19 00:06:34.000000000 -0400
50884 +++ linux-2.6.39.1/fs/splice.c 2011-05-22 19:36:32.000000000 -0400
50885 @@ -186,7 +186,7 @@ ssize_t splice_to_pipe(struct pipe_inode
50886 pipe_lock(pipe);
50887
50888 for (;;) {
50889 - if (!pipe->readers) {
50890 + if (!atomic_read(&pipe->readers)) {
50891 send_sig(SIGPIPE, current, 0);
50892 if (!ret)
50893 ret = -EPIPE;
50894 @@ -240,9 +240,9 @@ ssize_t splice_to_pipe(struct pipe_inode
50895 do_wakeup = 0;
50896 }
50897
50898 - pipe->waiting_writers++;
50899 + atomic_inc(&pipe->waiting_writers);
50900 pipe_wait(pipe);
50901 - pipe->waiting_writers--;
50902 + atomic_dec(&pipe->waiting_writers);
50903 }
50904
50905 pipe_unlock(pipe);
50906 @@ -316,6 +316,8 @@ __generic_file_splice_read(struct file *
50907 .spd_release = spd_release_page,
50908 };
50909
50910 + pax_track_stack();
50911 +
50912 if (splice_grow_spd(pipe, &spd))
50913 return -ENOMEM;
50914
50915 @@ -556,7 +558,7 @@ static ssize_t kernel_readv(struct file
50916 old_fs = get_fs();
50917 set_fs(get_ds());
50918 /* The cast to a user pointer is valid due to the set_fs() */
50919 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
50920 + res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
50921 set_fs(old_fs);
50922
50923 return res;
50924 @@ -571,7 +573,7 @@ static ssize_t kernel_write(struct file
50925 old_fs = get_fs();
50926 set_fs(get_ds());
50927 /* The cast to a user pointer is valid due to the set_fs() */
50928 - res = vfs_write(file, (const char __user *)buf, count, &pos);
50929 + res = vfs_write(file, (__force const char __user *)buf, count, &pos);
50930 set_fs(old_fs);
50931
50932 return res;
50933 @@ -599,6 +601,8 @@ ssize_t default_file_splice_read(struct
50934 .spd_release = spd_release_page,
50935 };
50936
50937 + pax_track_stack();
50938 +
50939 if (splice_grow_spd(pipe, &spd))
50940 return -ENOMEM;
50941
50942 @@ -622,7 +626,7 @@ ssize_t default_file_splice_read(struct
50943 goto err;
50944
50945 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
50946 - vec[i].iov_base = (void __user *) page_address(page);
50947 + vec[i].iov_base = (__force void __user *) page_address(page);
50948 vec[i].iov_len = this_len;
50949 spd.pages[i] = page;
50950 spd.nr_pages++;
50951 @@ -842,10 +846,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
50952 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
50953 {
50954 while (!pipe->nrbufs) {
50955 - if (!pipe->writers)
50956 + if (!atomic_read(&pipe->writers))
50957 return 0;
50958
50959 - if (!pipe->waiting_writers && sd->num_spliced)
50960 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
50961 return 0;
50962
50963 if (sd->flags & SPLICE_F_NONBLOCK)
50964 @@ -1178,7 +1182,7 @@ ssize_t splice_direct_to_actor(struct fi
50965 * out of the pipe right after the splice_to_pipe(). So set
50966 * PIPE_READERS appropriately.
50967 */
50968 - pipe->readers = 1;
50969 + atomic_set(&pipe->readers, 1);
50970
50971 current->splice_pipe = pipe;
50972 }
50973 @@ -1615,6 +1619,8 @@ static long vmsplice_to_pipe(struct file
50974 };
50975 long ret;
50976
50977 + pax_track_stack();
50978 +
50979 pipe = get_pipe_info(file);
50980 if (!pipe)
50981 return -EBADF;
50982 @@ -1730,9 +1736,9 @@ static int ipipe_prep(struct pipe_inode_
50983 ret = -ERESTARTSYS;
50984 break;
50985 }
50986 - if (!pipe->writers)
50987 + if (!atomic_read(&pipe->writers))
50988 break;
50989 - if (!pipe->waiting_writers) {
50990 + if (!atomic_read(&pipe->waiting_writers)) {
50991 if (flags & SPLICE_F_NONBLOCK) {
50992 ret = -EAGAIN;
50993 break;
50994 @@ -1764,7 +1770,7 @@ static int opipe_prep(struct pipe_inode_
50995 pipe_lock(pipe);
50996
50997 while (pipe->nrbufs >= pipe->buffers) {
50998 - if (!pipe->readers) {
50999 + if (!atomic_read(&pipe->readers)) {
51000 send_sig(SIGPIPE, current, 0);
51001 ret = -EPIPE;
51002 break;
51003 @@ -1777,9 +1783,9 @@ static int opipe_prep(struct pipe_inode_
51004 ret = -ERESTARTSYS;
51005 break;
51006 }
51007 - pipe->waiting_writers++;
51008 + atomic_inc(&pipe->waiting_writers);
51009 pipe_wait(pipe);
51010 - pipe->waiting_writers--;
51011 + atomic_dec(&pipe->waiting_writers);
51012 }
51013
51014 pipe_unlock(pipe);
51015 @@ -1815,14 +1821,14 @@ retry:
51016 pipe_double_lock(ipipe, opipe);
51017
51018 do {
51019 - if (!opipe->readers) {
51020 + if (!atomic_read(&opipe->readers)) {
51021 send_sig(SIGPIPE, current, 0);
51022 if (!ret)
51023 ret = -EPIPE;
51024 break;
51025 }
51026
51027 - if (!ipipe->nrbufs && !ipipe->writers)
51028 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
51029 break;
51030
51031 /*
51032 @@ -1922,7 +1928,7 @@ static int link_pipe(struct pipe_inode_i
51033 pipe_double_lock(ipipe, opipe);
51034
51035 do {
51036 - if (!opipe->readers) {
51037 + if (!atomic_read(&opipe->readers)) {
51038 send_sig(SIGPIPE, current, 0);
51039 if (!ret)
51040 ret = -EPIPE;
51041 @@ -1967,7 +1973,7 @@ static int link_pipe(struct pipe_inode_i
51042 * return EAGAIN if we have the potential of some data in the
51043 * future, otherwise just return 0
51044 */
51045 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
51046 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
51047 ret = -EAGAIN;
51048
51049 pipe_unlock(ipipe);
51050 diff -urNp linux-2.6.39.1/fs/sysfs/file.c linux-2.6.39.1/fs/sysfs/file.c
51051 --- linux-2.6.39.1/fs/sysfs/file.c 2011-05-19 00:06:34.000000000 -0400
51052 +++ linux-2.6.39.1/fs/sysfs/file.c 2011-05-22 19:36:32.000000000 -0400
51053 @@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
51054
51055 struct sysfs_open_dirent {
51056 atomic_t refcnt;
51057 - atomic_t event;
51058 + atomic_unchecked_t event;
51059 wait_queue_head_t poll;
51060 struct list_head buffers; /* goes through sysfs_buffer.list */
51061 };
51062 @@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
51063 if (!sysfs_get_active(attr_sd))
51064 return -ENODEV;
51065
51066 - buffer->event = atomic_read(&attr_sd->s_attr.open->event);
51067 + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
51068 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
51069
51070 sysfs_put_active(attr_sd);
51071 @@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
51072 return -ENOMEM;
51073
51074 atomic_set(&new_od->refcnt, 0);
51075 - atomic_set(&new_od->event, 1);
51076 + atomic_set_unchecked(&new_od->event, 1);
51077 init_waitqueue_head(&new_od->poll);
51078 INIT_LIST_HEAD(&new_od->buffers);
51079 goto retry;
51080 @@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
51081
51082 sysfs_put_active(attr_sd);
51083
51084 - if (buffer->event != atomic_read(&od->event))
51085 + if (buffer->event != atomic_read_unchecked(&od->event))
51086 goto trigger;
51087
51088 return DEFAULT_POLLMASK;
51089 @@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
51090
51091 od = sd->s_attr.open;
51092 if (od) {
51093 - atomic_inc(&od->event);
51094 + atomic_inc_unchecked(&od->event);
51095 wake_up_interruptible(&od->poll);
51096 }
51097
51098 diff -urNp linux-2.6.39.1/fs/sysfs/mount.c linux-2.6.39.1/fs/sysfs/mount.c
51099 --- linux-2.6.39.1/fs/sysfs/mount.c 2011-05-19 00:06:34.000000000 -0400
51100 +++ linux-2.6.39.1/fs/sysfs/mount.c 2011-05-22 19:41:42.000000000 -0400
51101 @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
51102 .s_name = "",
51103 .s_count = ATOMIC_INIT(1),
51104 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
51105 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
51106 + .s_mode = S_IFDIR | S_IRWXU,
51107 +#else
51108 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
51109 +#endif
51110 .s_ino = 1,
51111 };
51112
51113 diff -urNp linux-2.6.39.1/fs/sysfs/symlink.c linux-2.6.39.1/fs/sysfs/symlink.c
51114 --- linux-2.6.39.1/fs/sysfs/symlink.c 2011-05-19 00:06:34.000000000 -0400
51115 +++ linux-2.6.39.1/fs/sysfs/symlink.c 2011-05-22 19:36:32.000000000 -0400
51116 @@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
51117
51118 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
51119 {
51120 - char *page = nd_get_link(nd);
51121 + const char *page = nd_get_link(nd);
51122 if (!IS_ERR(page))
51123 free_page((unsigned long)page);
51124 }
51125 diff -urNp linux-2.6.39.1/fs/udf/inode.c linux-2.6.39.1/fs/udf/inode.c
51126 --- linux-2.6.39.1/fs/udf/inode.c 2011-05-19 00:06:34.000000000 -0400
51127 +++ linux-2.6.39.1/fs/udf/inode.c 2011-05-22 19:36:32.000000000 -0400
51128 @@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(
51129 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
51130 int lastblock = 0;
51131
51132 + pax_track_stack();
51133 +
51134 prev_epos.offset = udf_file_entry_alloc_offset(inode);
51135 prev_epos.block = iinfo->i_location;
51136 prev_epos.bh = NULL;
51137 diff -urNp linux-2.6.39.1/fs/udf/misc.c linux-2.6.39.1/fs/udf/misc.c
51138 --- linux-2.6.39.1/fs/udf/misc.c 2011-05-19 00:06:34.000000000 -0400
51139 +++ linux-2.6.39.1/fs/udf/misc.c 2011-05-22 19:36:32.000000000 -0400
51140 @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
51141
51142 u8 udf_tag_checksum(const struct tag *t)
51143 {
51144 - u8 *data = (u8 *)t;
51145 + const u8 *data = (const u8 *)t;
51146 u8 checksum = 0;
51147 int i;
51148 for (i = 0; i < sizeof(struct tag); ++i)
51149 diff -urNp linux-2.6.39.1/fs/utimes.c linux-2.6.39.1/fs/utimes.c
51150 --- linux-2.6.39.1/fs/utimes.c 2011-05-19 00:06:34.000000000 -0400
51151 +++ linux-2.6.39.1/fs/utimes.c 2011-05-22 19:41:42.000000000 -0400
51152 @@ -1,6 +1,7 @@
51153 #include <linux/compiler.h>
51154 #include <linux/file.h>
51155 #include <linux/fs.h>
51156 +#include <linux/security.h>
51157 #include <linux/linkage.h>
51158 #include <linux/mount.h>
51159 #include <linux/namei.h>
51160 @@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
51161 goto mnt_drop_write_and_out;
51162 }
51163 }
51164 +
51165 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
51166 + error = -EACCES;
51167 + goto mnt_drop_write_and_out;
51168 + }
51169 +
51170 mutex_lock(&inode->i_mutex);
51171 error = notify_change(path->dentry, &newattrs);
51172 mutex_unlock(&inode->i_mutex);
51173 diff -urNp linux-2.6.39.1/fs/xattr_acl.c linux-2.6.39.1/fs/xattr_acl.c
51174 --- linux-2.6.39.1/fs/xattr_acl.c 2011-05-19 00:06:34.000000000 -0400
51175 +++ linux-2.6.39.1/fs/xattr_acl.c 2011-05-22 19:36:32.000000000 -0400
51176 @@ -17,8 +17,8 @@
51177 struct posix_acl *
51178 posix_acl_from_xattr(const void *value, size_t size)
51179 {
51180 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
51181 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
51182 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
51183 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
51184 int count;
51185 struct posix_acl *acl;
51186 struct posix_acl_entry *acl_e;
51187 diff -urNp linux-2.6.39.1/fs/xattr.c linux-2.6.39.1/fs/xattr.c
51188 --- linux-2.6.39.1/fs/xattr.c 2011-05-19 00:06:34.000000000 -0400
51189 +++ linux-2.6.39.1/fs/xattr.c 2011-05-22 19:41:42.000000000 -0400
51190 @@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
51191 * Extended attribute SET operations
51192 */
51193 static long
51194 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
51195 +setxattr(struct path *path, const char __user *name, const void __user *value,
51196 size_t size, int flags)
51197 {
51198 int error;
51199 @@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
51200 return PTR_ERR(kvalue);
51201 }
51202
51203 - error = vfs_setxattr(d, kname, kvalue, size, flags);
51204 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
51205 + error = -EACCES;
51206 + goto out;
51207 + }
51208 +
51209 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
51210 +out:
51211 kfree(kvalue);
51212 return error;
51213 }
51214 @@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
51215 return error;
51216 error = mnt_want_write(path.mnt);
51217 if (!error) {
51218 - error = setxattr(path.dentry, name, value, size, flags);
51219 + error = setxattr(&path, name, value, size, flags);
51220 mnt_drop_write(path.mnt);
51221 }
51222 path_put(&path);
51223 @@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
51224 return error;
51225 error = mnt_want_write(path.mnt);
51226 if (!error) {
51227 - error = setxattr(path.dentry, name, value, size, flags);
51228 + error = setxattr(&path, name, value, size, flags);
51229 mnt_drop_write(path.mnt);
51230 }
51231 path_put(&path);
51232 @@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
51233 const void __user *,value, size_t, size, int, flags)
51234 {
51235 struct file *f;
51236 - struct dentry *dentry;
51237 int error = -EBADF;
51238
51239 f = fget(fd);
51240 if (!f)
51241 return error;
51242 - dentry = f->f_path.dentry;
51243 - audit_inode(NULL, dentry);
51244 + audit_inode(NULL, f->f_path.dentry);
51245 error = mnt_want_write_file(f);
51246 if (!error) {
51247 - error = setxattr(dentry, name, value, size, flags);
51248 + error = setxattr(&f->f_path, name, value, size, flags);
51249 mnt_drop_write(f->f_path.mnt);
51250 }
51251 fput(f);
51252 diff -urNp linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c
51253 --- linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-19 00:06:34.000000000 -0400
51254 +++ linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-22 19:41:42.000000000 -0400
51255 @@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
51256 xfs_fsop_geom_t fsgeo;
51257 int error;
51258
51259 + memset(&fsgeo, 0, sizeof(fsgeo));
51260 error = xfs_fs_geometry(mp, &fsgeo, 3);
51261 if (error)
51262 return -error;
51263 diff -urNp linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c
51264 --- linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-19 00:06:34.000000000 -0400
51265 +++ linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-22 19:36:32.000000000 -0400
51266 @@ -128,7 +128,7 @@ xfs_find_handle(
51267 }
51268
51269 error = -EFAULT;
51270 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
51271 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
51272 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
51273 goto out_put;
51274
51275 diff -urNp linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c
51276 --- linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c 2011-05-19 00:06:34.000000000 -0400
51277 +++ linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c 2011-05-22 19:36:32.000000000 -0400
51278 @@ -437,7 +437,7 @@ xfs_vn_put_link(
51279 struct nameidata *nd,
51280 void *p)
51281 {
51282 - char *s = nd_get_link(nd);
51283 + const char *s = nd_get_link(nd);
51284
51285 if (!IS_ERR(s))
51286 kfree(s);
51287 diff -urNp linux-2.6.39.1/fs/xfs/xfs_bmap.c linux-2.6.39.1/fs/xfs/xfs_bmap.c
51288 --- linux-2.6.39.1/fs/xfs/xfs_bmap.c 2011-05-19 00:06:34.000000000 -0400
51289 +++ linux-2.6.39.1/fs/xfs/xfs_bmap.c 2011-05-22 19:36:32.000000000 -0400
51290 @@ -287,7 +287,7 @@ xfs_bmap_validate_ret(
51291 int nmap,
51292 int ret_nmap);
51293 #else
51294 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
51295 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
51296 #endif /* DEBUG */
51297
51298 STATIC int
51299 diff -urNp linux-2.6.39.1/fs/xfs/xfs_dir2.c linux-2.6.39.1/fs/xfs/xfs_dir2.c
51300 --- linux-2.6.39.1/fs/xfs/xfs_dir2.c 2011-05-19 00:06:34.000000000 -0400
51301 +++ linux-2.6.39.1/fs/xfs/xfs_dir2.c 2011-05-22 19:36:32.000000000 -0400
51302 @@ -85,7 +85,7 @@ xfs_ascii_ci_compname(
51303 return result;
51304 }
51305
51306 -static struct xfs_nameops xfs_ascii_ci_nameops = {
51307 +static const struct xfs_nameops xfs_ascii_ci_nameops = {
51308 .hashname = xfs_ascii_ci_hashname,
51309 .compname = xfs_ascii_ci_compname,
51310 };
51311 diff -urNp linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c
51312 --- linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c 2011-05-19 00:06:34.000000000 -0400
51313 +++ linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c 2011-05-22 19:36:32.000000000 -0400
51314 @@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
51315 }
51316
51317 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
51318 - if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51319 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
51320 + char name[sfep->namelen];
51321 + memcpy(name, sfep->name, sfep->namelen);
51322 + if (filldir(dirent, name, sfep->namelen,
51323 + off & 0x7fffffff, ino, DT_UNKNOWN)) {
51324 + *offset = off & 0x7fffffff;
51325 + return 0;
51326 + }
51327 + } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51328 off & 0x7fffffff, ino, DT_UNKNOWN)) {
51329 *offset = off & 0x7fffffff;
51330 return 0;
51331 diff -urNp linux-2.6.39.1/grsecurity/gracl_alloc.c linux-2.6.39.1/grsecurity/gracl_alloc.c
51332 --- linux-2.6.39.1/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
51333 +++ linux-2.6.39.1/grsecurity/gracl_alloc.c 2011-05-22 19:41:42.000000000 -0400
51334 @@ -0,0 +1,105 @@
51335 +#include <linux/kernel.h>
51336 +#include <linux/mm.h>
51337 +#include <linux/slab.h>
51338 +#include <linux/vmalloc.h>
51339 +#include <linux/gracl.h>
51340 +#include <linux/grsecurity.h>
51341 +
51342 +static unsigned long alloc_stack_next = 1;
51343 +static unsigned long alloc_stack_size = 1;
51344 +static void **alloc_stack;
51345 +
51346 +static __inline__ int
51347 +alloc_pop(void)
51348 +{
51349 + if (alloc_stack_next == 1)
51350 + return 0;
51351 +
51352 + kfree(alloc_stack[alloc_stack_next - 2]);
51353 +
51354 + alloc_stack_next--;
51355 +
51356 + return 1;
51357 +}
51358 +
51359 +static __inline__ int
51360 +alloc_push(void *buf)
51361 +{
51362 + if (alloc_stack_next >= alloc_stack_size)
51363 + return 1;
51364 +
51365 + alloc_stack[alloc_stack_next - 1] = buf;
51366 +
51367 + alloc_stack_next++;
51368 +
51369 + return 0;
51370 +}
51371 +
51372 +void *
51373 +acl_alloc(unsigned long len)
51374 +{
51375 + void *ret = NULL;
51376 +
51377 + if (!len || len > PAGE_SIZE)
51378 + goto out;
51379 +
51380 + ret = kmalloc(len, GFP_KERNEL);
51381 +
51382 + if (ret) {
51383 + if (alloc_push(ret)) {
51384 + kfree(ret);
51385 + ret = NULL;
51386 + }
51387 + }
51388 +
51389 +out:
51390 + return ret;
51391 +}
51392 +
51393 +void *
51394 +acl_alloc_num(unsigned long num, unsigned long len)
51395 +{
51396 + if (!len || (num > (PAGE_SIZE / len)))
51397 + return NULL;
51398 +
51399 + return acl_alloc(num * len);
51400 +}
51401 +
51402 +void
51403 +acl_free_all(void)
51404 +{
51405 + if (gr_acl_is_enabled() || !alloc_stack)
51406 + return;
51407 +
51408 + while (alloc_pop()) ;
51409 +
51410 + if (alloc_stack) {
51411 + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
51412 + kfree(alloc_stack);
51413 + else
51414 + vfree(alloc_stack);
51415 + }
51416 +
51417 + alloc_stack = NULL;
51418 + alloc_stack_size = 1;
51419 + alloc_stack_next = 1;
51420 +
51421 + return;
51422 +}
51423 +
51424 +int
51425 +acl_alloc_stack_init(unsigned long size)
51426 +{
51427 + if ((size * sizeof (void *)) <= PAGE_SIZE)
51428 + alloc_stack =
51429 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
51430 + else
51431 + alloc_stack = (void **) vmalloc(size * sizeof (void *));
51432 +
51433 + alloc_stack_size = size;
51434 +
51435 + if (!alloc_stack)
51436 + return 0;
51437 + else
51438 + return 1;
51439 +}
51440 diff -urNp linux-2.6.39.1/grsecurity/gracl.c linux-2.6.39.1/grsecurity/gracl.c
51441 --- linux-2.6.39.1/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
51442 +++ linux-2.6.39.1/grsecurity/gracl.c 2011-06-11 16:26:18.000000000 -0400
51443 @@ -0,0 +1,4109 @@
51444 +#include <linux/kernel.h>
51445 +#include <linux/module.h>
51446 +#include <linux/sched.h>
51447 +#include <linux/mm.h>
51448 +#include <linux/file.h>
51449 +#include <linux/fs.h>
51450 +#include <linux/namei.h>
51451 +#include <linux/mount.h>
51452 +#include <linux/tty.h>
51453 +#include <linux/proc_fs.h>
51454 +#include <linux/lglock.h>
51455 +#include <linux/slab.h>
51456 +#include <linux/vmalloc.h>
51457 +#include <linux/types.h>
51458 +#include <linux/sysctl.h>
51459 +#include <linux/netdevice.h>
51460 +#include <linux/ptrace.h>
51461 +#include <linux/gracl.h>
51462 +#include <linux/gralloc.h>
51463 +#include <linux/grsecurity.h>
51464 +#include <linux/grinternal.h>
51465 +#include <linux/pid_namespace.h>
51466 +#include <linux/fdtable.h>
51467 +#include <linux/percpu.h>
51468 +
51469 +#include <asm/uaccess.h>
51470 +#include <asm/errno.h>
51471 +#include <asm/mman.h>
51472 +
51473 +static struct acl_role_db acl_role_set;
51474 +static struct name_db name_set;
51475 +static struct inodev_db inodev_set;
51476 +
51477 +/* for keeping track of userspace pointers used for subjects, so we
51478 + can share references in the kernel as well
51479 +*/
51480 +
51481 +static struct path real_root;
51482 +
51483 +static struct acl_subj_map_db subj_map_set;
51484 +
51485 +static struct acl_role_label *default_role;
51486 +
51487 +static struct acl_role_label *role_list;
51488 +
51489 +static u16 acl_sp_role_value;
51490 +
51491 +extern char *gr_shared_page[4];
51492 +static DEFINE_MUTEX(gr_dev_mutex);
51493 +DEFINE_RWLOCK(gr_inode_lock);
51494 +
51495 +struct gr_arg *gr_usermode;
51496 +
51497 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
51498 +
51499 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
51500 +extern void gr_clear_learn_entries(void);
51501 +
51502 +#ifdef CONFIG_GRKERNSEC_RESLOG
51503 +extern void gr_log_resource(const struct task_struct *task,
51504 + const int res, const unsigned long wanted, const int gt);
51505 +#endif
51506 +
51507 +unsigned char *gr_system_salt;
51508 +unsigned char *gr_system_sum;
51509 +
51510 +static struct sprole_pw **acl_special_roles = NULL;
51511 +static __u16 num_sprole_pws = 0;
51512 +
51513 +static struct acl_role_label *kernel_role = NULL;
51514 +
51515 +static unsigned int gr_auth_attempts = 0;
51516 +static unsigned long gr_auth_expires = 0UL;
51517 +
51518 +#ifdef CONFIG_NET
51519 +extern struct vfsmount *sock_mnt;
51520 +#endif
51521 +
51522 +extern struct vfsmount *pipe_mnt;
51523 +extern struct vfsmount *shm_mnt;
51524 +#ifdef CONFIG_HUGETLBFS
51525 +extern struct vfsmount *hugetlbfs_vfsmount;
51526 +#endif
51527 +
51528 +static struct acl_object_label *fakefs_obj_rw;
51529 +static struct acl_object_label *fakefs_obj_rwx;
51530 +
51531 +extern int gr_init_uidset(void);
51532 +extern void gr_free_uidset(void);
51533 +extern void gr_remove_uid(uid_t uid);
51534 +extern int gr_find_uid(uid_t uid);
51535 +
51536 +DECLARE_BRLOCK(vfsmount_lock);
51537 +
51538 +__inline__ int
51539 +gr_acl_is_enabled(void)
51540 +{
51541 + return (gr_status & GR_READY);
51542 +}
51543 +
51544 +#ifdef CONFIG_BTRFS_FS
51545 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
51546 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
51547 +#endif
51548 +
51549 +static inline dev_t __get_dev(const struct dentry *dentry)
51550 +{
51551 +#ifdef CONFIG_BTRFS_FS
51552 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
51553 + return get_btrfs_dev_from_inode(dentry->d_inode);
51554 + else
51555 +#endif
51556 + return dentry->d_inode->i_sb->s_dev;
51557 +}
51558 +
51559 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
51560 +{
51561 + return __get_dev(dentry);
51562 +}
51563 +
51564 +static char gr_task_roletype_to_char(struct task_struct *task)
51565 +{
51566 + switch (task->role->roletype &
51567 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
51568 + GR_ROLE_SPECIAL)) {
51569 + case GR_ROLE_DEFAULT:
51570 + return 'D';
51571 + case GR_ROLE_USER:
51572 + return 'U';
51573 + case GR_ROLE_GROUP:
51574 + return 'G';
51575 + case GR_ROLE_SPECIAL:
51576 + return 'S';
51577 + }
51578 +
51579 + return 'X';
51580 +}
51581 +
51582 +char gr_roletype_to_char(void)
51583 +{
51584 + return gr_task_roletype_to_char(current);
51585 +}
51586 +
51587 +__inline__ int
51588 +gr_acl_tpe_check(void)
51589 +{
51590 + if (unlikely(!(gr_status & GR_READY)))
51591 + return 0;
51592 + if (current->role->roletype & GR_ROLE_TPE)
51593 + return 1;
51594 + else
51595 + return 0;
51596 +}
51597 +
51598 +int
51599 +gr_handle_rawio(const struct inode *inode)
51600 +{
51601 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
51602 + if (inode && S_ISBLK(inode->i_mode) &&
51603 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
51604 + !capable(CAP_SYS_RAWIO))
51605 + return 1;
51606 +#endif
51607 + return 0;
51608 +}
51609 +
51610 +static int
51611 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
51612 +{
51613 + if (likely(lena != lenb))
51614 + return 0;
51615 +
51616 + return !memcmp(a, b, lena);
51617 +}
51618 +
51619 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
51620 +{
51621 + *buflen -= namelen;
51622 + if (*buflen < 0)
51623 + return -ENAMETOOLONG;
51624 + *buffer -= namelen;
51625 + memcpy(*buffer, str, namelen);
51626 + return 0;
51627 +}
51628 +
51629 +static int prepend_name(char **buffer, int *buflen, struct qstr *name)
51630 +{
51631 + return prepend(buffer, buflen, name->name, name->len);
51632 +}
51633 +
51634 +static int prepend_path(const struct path *path, struct path *root,
51635 + char **buffer, int *buflen)
51636 +{
51637 + struct dentry *dentry = path->dentry;
51638 + struct vfsmount *vfsmnt = path->mnt;
51639 + bool slash = false;
51640 + int error = 0;
51641 +
51642 + while (dentry != root->dentry || vfsmnt != root->mnt) {
51643 + struct dentry * parent;
51644 +
51645 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
51646 + /* Global root? */
51647 + if (vfsmnt->mnt_parent == vfsmnt) {
51648 + goto out;
51649 + }
51650 + dentry = vfsmnt->mnt_mountpoint;
51651 + vfsmnt = vfsmnt->mnt_parent;
51652 + continue;
51653 + }
51654 + parent = dentry->d_parent;
51655 + prefetch(parent);
51656 + spin_lock(&dentry->d_lock);
51657 + error = prepend_name(buffer, buflen, &dentry->d_name);
51658 + spin_unlock(&dentry->d_lock);
51659 + if (!error)
51660 + error = prepend(buffer, buflen, "/", 1);
51661 + if (error)
51662 + break;
51663 +
51664 + slash = true;
51665 + dentry = parent;
51666 + }
51667 +
51668 +out:
51669 + if (!error && !slash)
51670 + error = prepend(buffer, buflen, "/", 1);
51671 +
51672 + return error;
51673 +}
51674 +
51675 +/* this must be called with vfsmount_lock and rename_lock held */
51676 +
51677 +static char *__our_d_path(const struct path *path, struct path *root,
51678 + char *buf, int buflen)
51679 +{
51680 + char *res = buf + buflen;
51681 + int error;
51682 +
51683 + prepend(&res, &buflen, "\0", 1);
51684 + error = prepend_path(path, root, &res, &buflen);
51685 + if (error)
51686 + return ERR_PTR(error);
51687 +
51688 + return res;
51689 +}
51690 +
51691 +static char *
51692 +gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
51693 +{
51694 + char *retval;
51695 +
51696 + retval = __our_d_path(path, root, buf, buflen);
51697 + if (unlikely(IS_ERR(retval)))
51698 + retval = strcpy(buf, "<path too long>");
51699 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
51700 + retval[1] = '\0';
51701 +
51702 + return retval;
51703 +}
51704 +
51705 +static char *
51706 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51707 + char *buf, int buflen)
51708 +{
51709 + struct path path;
51710 + char *res;
51711 +
51712 + path.dentry = (struct dentry *)dentry;
51713 + path.mnt = (struct vfsmount *)vfsmnt;
51714 +
51715 + /* we can use real_root.dentry, real_root.mnt, because this is only called
51716 + by the RBAC system */
51717 + res = gen_full_path(&path, &real_root, buf, buflen);
51718 +
51719 + return res;
51720 +}
51721 +
51722 +static char *
51723 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51724 + char *buf, int buflen)
51725 +{
51726 + char *res;
51727 + struct path path;
51728 + struct path root;
51729 + struct task_struct *reaper = &init_task;
51730 +
51731 + path.dentry = (struct dentry *)dentry;
51732 + path.mnt = (struct vfsmount *)vfsmnt;
51733 +
51734 + /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51735 + get_fs_root(reaper->fs, &root);
51736 +
51737 + write_seqlock(&rename_lock);
51738 + br_read_lock(vfsmount_lock);
51739 + res = gen_full_path(&path, &root, buf, buflen);
51740 + br_read_unlock(vfsmount_lock);
51741 + write_sequnlock(&rename_lock);
51742 +
51743 + path_put(&root);
51744 + return res;
51745 +}
51746 +
51747 +static char *
51748 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51749 +{
51750 + char *ret;
51751 + write_seqlock(&rename_lock);
51752 + br_read_lock(vfsmount_lock);
51753 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51754 + PAGE_SIZE);
51755 + br_read_unlock(vfsmount_lock);
51756 + write_sequnlock(&rename_lock);
51757 + return ret;
51758 +}
51759 +
51760 +char *
51761 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51762 +{
51763 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51764 + PAGE_SIZE);
51765 +}
51766 +
51767 +char *
51768 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51769 +{
51770 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51771 + PAGE_SIZE);
51772 +}
51773 +
51774 +char *
51775 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51776 +{
51777 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51778 + PAGE_SIZE);
51779 +}
51780 +
51781 +char *
51782 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51783 +{
51784 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51785 + PAGE_SIZE);
51786 +}
51787 +
51788 +char *
51789 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51790 +{
51791 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51792 + PAGE_SIZE);
51793 +}
51794 +
51795 +__inline__ __u32
51796 +to_gr_audit(const __u32 reqmode)
51797 +{
51798 + /* masks off auditable permission flags, then shifts them to create
51799 + auditing flags, and adds the special case of append auditing if
51800 + we're requesting write */
51801 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51802 +}
51803 +
51804 +struct acl_subject_label *
51805 +lookup_subject_map(const struct acl_subject_label *userp)
51806 +{
51807 + unsigned int index = shash(userp, subj_map_set.s_size);
51808 + struct subject_map *match;
51809 +
51810 + match = subj_map_set.s_hash[index];
51811 +
51812 + while (match && match->user != userp)
51813 + match = match->next;
51814 +
51815 + if (match != NULL)
51816 + return match->kernel;
51817 + else
51818 + return NULL;
51819 +}
51820 +
51821 +static void
51822 +insert_subj_map_entry(struct subject_map *subjmap)
51823 +{
51824 + unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51825 + struct subject_map **curr;
51826 +
51827 + subjmap->prev = NULL;
51828 +
51829 + curr = &subj_map_set.s_hash[index];
51830 + if (*curr != NULL)
51831 + (*curr)->prev = subjmap;
51832 +
51833 + subjmap->next = *curr;
51834 + *curr = subjmap;
51835 +
51836 + return;
51837 +}
51838 +
51839 +static struct acl_role_label *
51840 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51841 + const gid_t gid)
51842 +{
51843 + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51844 + struct acl_role_label *match;
51845 + struct role_allowed_ip *ipp;
51846 + unsigned int x;
51847 + u32 curr_ip = task->signal->curr_ip;
51848 +
51849 + task->signal->saved_ip = curr_ip;
51850 +
51851 + match = acl_role_set.r_hash[index];
51852 +
51853 + while (match) {
51854 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51855 + for (x = 0; x < match->domain_child_num; x++) {
51856 + if (match->domain_children[x] == uid)
51857 + goto found;
51858 + }
51859 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51860 + break;
51861 + match = match->next;
51862 + }
51863 +found:
51864 + if (match == NULL) {
51865 + try_group:
51866 + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51867 + match = acl_role_set.r_hash[index];
51868 +
51869 + while (match) {
51870 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51871 + for (x = 0; x < match->domain_child_num; x++) {
51872 + if (match->domain_children[x] == gid)
51873 + goto found2;
51874 + }
51875 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51876 + break;
51877 + match = match->next;
51878 + }
51879 +found2:
51880 + if (match == NULL)
51881 + match = default_role;
51882 + if (match->allowed_ips == NULL)
51883 + return match;
51884 + else {
51885 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51886 + if (likely
51887 + ((ntohl(curr_ip) & ipp->netmask) ==
51888 + (ntohl(ipp->addr) & ipp->netmask)))
51889 + return match;
51890 + }
51891 + match = default_role;
51892 + }
51893 + } else if (match->allowed_ips == NULL) {
51894 + return match;
51895 + } else {
51896 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51897 + if (likely
51898 + ((ntohl(curr_ip) & ipp->netmask) ==
51899 + (ntohl(ipp->addr) & ipp->netmask)))
51900 + return match;
51901 + }
51902 + goto try_group;
51903 + }
51904 +
51905 + return match;
51906 +}
51907 +
51908 +struct acl_subject_label *
51909 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51910 + const struct acl_role_label *role)
51911 +{
51912 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51913 + struct acl_subject_label *match;
51914 +
51915 + match = role->subj_hash[index];
51916 +
51917 + while (match && (match->inode != ino || match->device != dev ||
51918 + (match->mode & GR_DELETED))) {
51919 + match = match->next;
51920 + }
51921 +
51922 + if (match && !(match->mode & GR_DELETED))
51923 + return match;
51924 + else
51925 + return NULL;
51926 +}
51927 +
51928 +struct acl_subject_label *
51929 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51930 + const struct acl_role_label *role)
51931 +{
51932 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51933 + struct acl_subject_label *match;
51934 +
51935 + match = role->subj_hash[index];
51936 +
51937 + while (match && (match->inode != ino || match->device != dev ||
51938 + !(match->mode & GR_DELETED))) {
51939 + match = match->next;
51940 + }
51941 +
51942 + if (match && (match->mode & GR_DELETED))
51943 + return match;
51944 + else
51945 + return NULL;
51946 +}
51947 +
51948 +static struct acl_object_label *
51949 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51950 + const struct acl_subject_label *subj)
51951 +{
51952 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51953 + struct acl_object_label *match;
51954 +
51955 + match = subj->obj_hash[index];
51956 +
51957 + while (match && (match->inode != ino || match->device != dev ||
51958 + (match->mode & GR_DELETED))) {
51959 + match = match->next;
51960 + }
51961 +
51962 + if (match && !(match->mode & GR_DELETED))
51963 + return match;
51964 + else
51965 + return NULL;
51966 +}
51967 +
51968 +static struct acl_object_label *
51969 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51970 + const struct acl_subject_label *subj)
51971 +{
51972 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51973 + struct acl_object_label *match;
51974 +
51975 + match = subj->obj_hash[index];
51976 +
51977 + while (match && (match->inode != ino || match->device != dev ||
51978 + !(match->mode & GR_DELETED))) {
51979 + match = match->next;
51980 + }
51981 +
51982 + if (match && (match->mode & GR_DELETED))
51983 + return match;
51984 +
51985 + match = subj->obj_hash[index];
51986 +
51987 + while (match && (match->inode != ino || match->device != dev ||
51988 + (match->mode & GR_DELETED))) {
51989 + match = match->next;
51990 + }
51991 +
51992 + if (match && !(match->mode & GR_DELETED))
51993 + return match;
51994 + else
51995 + return NULL;
51996 +}
51997 +
51998 +static struct name_entry *
51999 +lookup_name_entry(const char *name)
52000 +{
52001 + unsigned int len = strlen(name);
52002 + unsigned int key = full_name_hash(name, len);
52003 + unsigned int index = key % name_set.n_size;
52004 + struct name_entry *match;
52005 +
52006 + match = name_set.n_hash[index];
52007 +
52008 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
52009 + match = match->next;
52010 +
52011 + return match;
52012 +}
52013 +
52014 +static struct name_entry *
52015 +lookup_name_entry_create(const char *name)
52016 +{
52017 + unsigned int len = strlen(name);
52018 + unsigned int key = full_name_hash(name, len);
52019 + unsigned int index = key % name_set.n_size;
52020 + struct name_entry *match;
52021 +
52022 + match = name_set.n_hash[index];
52023 +
52024 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52025 + !match->deleted))
52026 + match = match->next;
52027 +
52028 + if (match && match->deleted)
52029 + return match;
52030 +
52031 + match = name_set.n_hash[index];
52032 +
52033 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52034 + match->deleted))
52035 + match = match->next;
52036 +
52037 + if (match && !match->deleted)
52038 + return match;
52039 + else
52040 + return NULL;
52041 +}
52042 +
52043 +static struct inodev_entry *
52044 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
52045 +{
52046 + unsigned int index = fhash(ino, dev, inodev_set.i_size);
52047 + struct inodev_entry *match;
52048 +
52049 + match = inodev_set.i_hash[index];
52050 +
52051 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
52052 + match = match->next;
52053 +
52054 + return match;
52055 +}
52056 +
52057 +static void
52058 +insert_inodev_entry(struct inodev_entry *entry)
52059 +{
52060 + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
52061 + inodev_set.i_size);
52062 + struct inodev_entry **curr;
52063 +
52064 + entry->prev = NULL;
52065 +
52066 + curr = &inodev_set.i_hash[index];
52067 + if (*curr != NULL)
52068 + (*curr)->prev = entry;
52069 +
52070 + entry->next = *curr;
52071 + *curr = entry;
52072 +
52073 + return;
52074 +}
52075 +
52076 +static void
52077 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
52078 +{
52079 + unsigned int index =
52080 + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
52081 + struct acl_role_label **curr;
52082 + struct acl_role_label *tmp;
52083 +
52084 + curr = &acl_role_set.r_hash[index];
52085 +
52086 + /* if role was already inserted due to domains and already has
52087 + a role in the same bucket as it attached, then we need to
52088 + combine these two buckets
52089 + */
52090 + if (role->next) {
52091 + tmp = role->next;
52092 + while (tmp->next)
52093 + tmp = tmp->next;
52094 + tmp->next = *curr;
52095 + } else
52096 + role->next = *curr;
52097 + *curr = role;
52098 +
52099 + return;
52100 +}
52101 +
52102 +static void
52103 +insert_acl_role_label(struct acl_role_label *role)
52104 +{
52105 + int i;
52106 +
52107 + if (role_list == NULL) {
52108 + role_list = role;
52109 + role->prev = NULL;
52110 + } else {
52111 + role->prev = role_list;
52112 + role_list = role;
52113 + }
52114 +
52115 + /* used for hash chains */
52116 + role->next = NULL;
52117 +
52118 + if (role->roletype & GR_ROLE_DOMAIN) {
52119 + for (i = 0; i < role->domain_child_num; i++)
52120 + __insert_acl_role_label(role, role->domain_children[i]);
52121 + } else
52122 + __insert_acl_role_label(role, role->uidgid);
52123 +}
52124 +
52125 +static int
52126 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
52127 +{
52128 + struct name_entry **curr, *nentry;
52129 + struct inodev_entry *ientry;
52130 + unsigned int len = strlen(name);
52131 + unsigned int key = full_name_hash(name, len);
52132 + unsigned int index = key % name_set.n_size;
52133 +
52134 + curr = &name_set.n_hash[index];
52135 +
52136 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
52137 + curr = &((*curr)->next);
52138 +
52139 + if (*curr != NULL)
52140 + return 1;
52141 +
52142 + nentry = acl_alloc(sizeof (struct name_entry));
52143 + if (nentry == NULL)
52144 + return 0;
52145 + ientry = acl_alloc(sizeof (struct inodev_entry));
52146 + if (ientry == NULL)
52147 + return 0;
52148 + ientry->nentry = nentry;
52149 +
52150 + nentry->key = key;
52151 + nentry->name = name;
52152 + nentry->inode = inode;
52153 + nentry->device = device;
52154 + nentry->len = len;
52155 + nentry->deleted = deleted;
52156 +
52157 + nentry->prev = NULL;
52158 + curr = &name_set.n_hash[index];
52159 + if (*curr != NULL)
52160 + (*curr)->prev = nentry;
52161 + nentry->next = *curr;
52162 + *curr = nentry;
52163 +
52164 + /* insert us into the table searchable by inode/dev */
52165 + insert_inodev_entry(ientry);
52166 +
52167 + return 1;
52168 +}
52169 +
52170 +static void
52171 +insert_acl_obj_label(struct acl_object_label *obj,
52172 + struct acl_subject_label *subj)
52173 +{
52174 + unsigned int index =
52175 + fhash(obj->inode, obj->device, subj->obj_hash_size);
52176 + struct acl_object_label **curr;
52177 +
52178 +
52179 + obj->prev = NULL;
52180 +
52181 + curr = &subj->obj_hash[index];
52182 + if (*curr != NULL)
52183 + (*curr)->prev = obj;
52184 +
52185 + obj->next = *curr;
52186 + *curr = obj;
52187 +
52188 + return;
52189 +}
52190 +
52191 +static void
52192 +insert_acl_subj_label(struct acl_subject_label *obj,
52193 + struct acl_role_label *role)
52194 +{
52195 + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
52196 + struct acl_subject_label **curr;
52197 +
52198 + obj->prev = NULL;
52199 +
52200 + curr = &role->subj_hash[index];
52201 + if (*curr != NULL)
52202 + (*curr)->prev = obj;
52203 +
52204 + obj->next = *curr;
52205 + *curr = obj;
52206 +
52207 + return;
52208 +}
52209 +
52210 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
52211 +
52212 +static void *
52213 +create_table(__u32 * len, int elementsize)
52214 +{
52215 + unsigned int table_sizes[] = {
52216 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
52217 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
52218 + 4194301, 8388593, 16777213, 33554393, 67108859
52219 + };
52220 + void *newtable = NULL;
52221 + unsigned int pwr = 0;
52222 +
52223 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
52224 + table_sizes[pwr] <= *len)
52225 + pwr++;
52226 +
52227 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
52228 + return newtable;
52229 +
52230 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
52231 + newtable =
52232 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
52233 + else
52234 + newtable = vmalloc(table_sizes[pwr] * elementsize);
52235 +
52236 + *len = table_sizes[pwr];
52237 +
52238 + return newtable;
52239 +}
52240 +
52241 +static int
52242 +init_variables(const struct gr_arg *arg)
52243 +{
52244 + struct task_struct *reaper = &init_task;
52245 + unsigned int stacksize;
52246 +
52247 + subj_map_set.s_size = arg->role_db.num_subjects;
52248 + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
52249 + name_set.n_size = arg->role_db.num_objects;
52250 + inodev_set.i_size = arg->role_db.num_objects;
52251 +
52252 + if (!subj_map_set.s_size || !acl_role_set.r_size ||
52253 + !name_set.n_size || !inodev_set.i_size)
52254 + return 1;
52255 +
52256 + if (!gr_init_uidset())
52257 + return 1;
52258 +
52259 + /* set up the stack that holds allocation info */
52260 +
52261 + stacksize = arg->role_db.num_pointers + 5;
52262 +
52263 + if (!acl_alloc_stack_init(stacksize))
52264 + return 1;
52265 +
52266 + /* grab reference for the real root dentry and vfsmount */
52267 + get_fs_root(reaper->fs, &real_root);
52268 +
52269 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52270 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
52271 +#endif
52272 +
52273 + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
52274 + if (fakefs_obj_rw == NULL)
52275 + return 1;
52276 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
52277 +
52278 + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
52279 + if (fakefs_obj_rwx == NULL)
52280 + return 1;
52281 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
52282 +
52283 + subj_map_set.s_hash =
52284 + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
52285 + acl_role_set.r_hash =
52286 + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
52287 + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
52288 + inodev_set.i_hash =
52289 + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
52290 +
52291 + if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
52292 + !name_set.n_hash || !inodev_set.i_hash)
52293 + return 1;
52294 +
52295 + memset(subj_map_set.s_hash, 0,
52296 + sizeof(struct subject_map *) * subj_map_set.s_size);
52297 + memset(acl_role_set.r_hash, 0,
52298 + sizeof (struct acl_role_label *) * acl_role_set.r_size);
52299 + memset(name_set.n_hash, 0,
52300 + sizeof (struct name_entry *) * name_set.n_size);
52301 + memset(inodev_set.i_hash, 0,
52302 + sizeof (struct inodev_entry *) * inodev_set.i_size);
52303 +
52304 + return 0;
52305 +}
52306 +
52307 +/* free information not needed after startup
52308 + currently contains user->kernel pointer mappings for subjects
52309 +*/
52310 +
52311 +static void
52312 +free_init_variables(void)
52313 +{
52314 + __u32 i;
52315 +
52316 + if (subj_map_set.s_hash) {
52317 + for (i = 0; i < subj_map_set.s_size; i++) {
52318 + if (subj_map_set.s_hash[i]) {
52319 + kfree(subj_map_set.s_hash[i]);
52320 + subj_map_set.s_hash[i] = NULL;
52321 + }
52322 + }
52323 +
52324 + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
52325 + PAGE_SIZE)
52326 + kfree(subj_map_set.s_hash);
52327 + else
52328 + vfree(subj_map_set.s_hash);
52329 + }
52330 +
52331 + return;
52332 +}
52333 +
52334 +static void
52335 +free_variables(void)
52336 +{
52337 + struct acl_subject_label *s;
52338 + struct acl_role_label *r;
52339 + struct task_struct *task, *task2;
52340 + unsigned int x;
52341 +
52342 + gr_clear_learn_entries();
52343 +
52344 + read_lock(&tasklist_lock);
52345 + do_each_thread(task2, task) {
52346 + task->acl_sp_role = 0;
52347 + task->acl_role_id = 0;
52348 + task->acl = NULL;
52349 + task->role = NULL;
52350 + } while_each_thread(task2, task);
52351 + read_unlock(&tasklist_lock);
52352 +
52353 + /* release the reference to the real root dentry and vfsmount */
52354 + path_put(&real_root);
52355 +
52356 + /* free all object hash tables */
52357 +
52358 + FOR_EACH_ROLE_START(r)
52359 + if (r->subj_hash == NULL)
52360 + goto next_role;
52361 + FOR_EACH_SUBJECT_START(r, s, x)
52362 + if (s->obj_hash == NULL)
52363 + break;
52364 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52365 + kfree(s->obj_hash);
52366 + else
52367 + vfree(s->obj_hash);
52368 + FOR_EACH_SUBJECT_END(s, x)
52369 + FOR_EACH_NESTED_SUBJECT_START(r, s)
52370 + if (s->obj_hash == NULL)
52371 + break;
52372 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52373 + kfree(s->obj_hash);
52374 + else
52375 + vfree(s->obj_hash);
52376 + FOR_EACH_NESTED_SUBJECT_END(s)
52377 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
52378 + kfree(r->subj_hash);
52379 + else
52380 + vfree(r->subj_hash);
52381 + r->subj_hash = NULL;
52382 +next_role:
52383 + FOR_EACH_ROLE_END(r)
52384 +
52385 + acl_free_all();
52386 +
52387 + if (acl_role_set.r_hash) {
52388 + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
52389 + PAGE_SIZE)
52390 + kfree(acl_role_set.r_hash);
52391 + else
52392 + vfree(acl_role_set.r_hash);
52393 + }
52394 + if (name_set.n_hash) {
52395 + if ((name_set.n_size * sizeof (struct name_entry *)) <=
52396 + PAGE_SIZE)
52397 + kfree(name_set.n_hash);
52398 + else
52399 + vfree(name_set.n_hash);
52400 + }
52401 +
52402 + if (inodev_set.i_hash) {
52403 + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
52404 + PAGE_SIZE)
52405 + kfree(inodev_set.i_hash);
52406 + else
52407 + vfree(inodev_set.i_hash);
52408 + }
52409 +
52410 + gr_free_uidset();
52411 +
52412 + memset(&name_set, 0, sizeof (struct name_db));
52413 + memset(&inodev_set, 0, sizeof (struct inodev_db));
52414 + memset(&acl_role_set, 0, sizeof (struct acl_role_db));
52415 + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
52416 +
52417 + default_role = NULL;
52418 + role_list = NULL;
52419 +
52420 + return;
52421 +}
52422 +
52423 +static __u32
52424 +count_user_objs(struct acl_object_label *userp)
52425 +{
52426 + struct acl_object_label o_tmp;
52427 + __u32 num = 0;
52428 +
52429 + while (userp) {
52430 + if (copy_from_user(&o_tmp, userp,
52431 + sizeof (struct acl_object_label)))
52432 + break;
52433 +
52434 + userp = o_tmp.prev;
52435 + num++;
52436 + }
52437 +
52438 + return num;
52439 +}
52440 +
52441 +static struct acl_subject_label *
52442 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
52443 +
52444 +static int
52445 +copy_user_glob(struct acl_object_label *obj)
52446 +{
52447 + struct acl_object_label *g_tmp, **guser;
52448 + unsigned int len;
52449 + char *tmp;
52450 +
52451 + if (obj->globbed == NULL)
52452 + return 0;
52453 +
52454 + guser = &obj->globbed;
52455 + while (*guser) {
52456 + g_tmp = (struct acl_object_label *)
52457 + acl_alloc(sizeof (struct acl_object_label));
52458 + if (g_tmp == NULL)
52459 + return -ENOMEM;
52460 +
52461 + if (copy_from_user(g_tmp, *guser,
52462 + sizeof (struct acl_object_label)))
52463 + return -EFAULT;
52464 +
52465 + len = strnlen_user(g_tmp->filename, PATH_MAX);
52466 +
52467 + if (!len || len >= PATH_MAX)
52468 + return -EINVAL;
52469 +
52470 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52471 + return -ENOMEM;
52472 +
52473 + if (copy_from_user(tmp, g_tmp->filename, len))
52474 + return -EFAULT;
52475 + tmp[len-1] = '\0';
52476 + g_tmp->filename = tmp;
52477 +
52478 + *guser = g_tmp;
52479 + guser = &(g_tmp->next);
52480 + }
52481 +
52482 + return 0;
52483 +}
52484 +
52485 +static int
52486 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
52487 + struct acl_role_label *role)
52488 +{
52489 + struct acl_object_label *o_tmp;
52490 + unsigned int len;
52491 + int ret;
52492 + char *tmp;
52493 +
52494 + while (userp) {
52495 + if ((o_tmp = (struct acl_object_label *)
52496 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
52497 + return -ENOMEM;
52498 +
52499 + if (copy_from_user(o_tmp, userp,
52500 + sizeof (struct acl_object_label)))
52501 + return -EFAULT;
52502 +
52503 + userp = o_tmp->prev;
52504 +
52505 + len = strnlen_user(o_tmp->filename, PATH_MAX);
52506 +
52507 + if (!len || len >= PATH_MAX)
52508 + return -EINVAL;
52509 +
52510 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52511 + return -ENOMEM;
52512 +
52513 + if (copy_from_user(tmp, o_tmp->filename, len))
52514 + return -EFAULT;
52515 + tmp[len-1] = '\0';
52516 + o_tmp->filename = tmp;
52517 +
52518 + insert_acl_obj_label(o_tmp, subj);
52519 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
52520 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
52521 + return -ENOMEM;
52522 +
52523 + ret = copy_user_glob(o_tmp);
52524 + if (ret)
52525 + return ret;
52526 +
52527 + if (o_tmp->nested) {
52528 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
52529 + if (IS_ERR(o_tmp->nested))
52530 + return PTR_ERR(o_tmp->nested);
52531 +
52532 + /* insert into nested subject list */
52533 + o_tmp->nested->next = role->hash->first;
52534 + role->hash->first = o_tmp->nested;
52535 + }
52536 + }
52537 +
52538 + return 0;
52539 +}
52540 +
52541 +static __u32
52542 +count_user_subjs(struct acl_subject_label *userp)
52543 +{
52544 + struct acl_subject_label s_tmp;
52545 + __u32 num = 0;
52546 +
52547 + while (userp) {
52548 + if (copy_from_user(&s_tmp, userp,
52549 + sizeof (struct acl_subject_label)))
52550 + break;
52551 +
52552 + userp = s_tmp.prev;
52553 + /* do not count nested subjects against this count, since
52554 + they are not included in the hash table, but are
52555 + attached to objects. We have already counted
52556 + the subjects in userspace for the allocation
52557 + stack
52558 + */
52559 + if (!(s_tmp.mode & GR_NESTED))
52560 + num++;
52561 + }
52562 +
52563 + return num;
52564 +}
52565 +
52566 +static int
52567 +copy_user_allowedips(struct acl_role_label *rolep)
52568 +{
52569 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
52570 +
52571 + ruserip = rolep->allowed_ips;
52572 +
52573 + while (ruserip) {
52574 + rlast = rtmp;
52575 +
52576 + if ((rtmp = (struct role_allowed_ip *)
52577 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
52578 + return -ENOMEM;
52579 +
52580 + if (copy_from_user(rtmp, ruserip,
52581 + sizeof (struct role_allowed_ip)))
52582 + return -EFAULT;
52583 +
52584 + ruserip = rtmp->prev;
52585 +
52586 + if (!rlast) {
52587 + rtmp->prev = NULL;
52588 + rolep->allowed_ips = rtmp;
52589 + } else {
52590 + rlast->next = rtmp;
52591 + rtmp->prev = rlast;
52592 + }
52593 +
52594 + if (!ruserip)
52595 + rtmp->next = NULL;
52596 + }
52597 +
52598 + return 0;
52599 +}
52600 +
52601 +static int
52602 +copy_user_transitions(struct acl_role_label *rolep)
52603 +{
52604 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
52605 +
52606 + unsigned int len;
52607 + char *tmp;
52608 +
52609 + rusertp = rolep->transitions;
52610 +
52611 + while (rusertp) {
52612 + rlast = rtmp;
52613 +
52614 + if ((rtmp = (struct role_transition *)
52615 + acl_alloc(sizeof (struct role_transition))) == NULL)
52616 + return -ENOMEM;
52617 +
52618 + if (copy_from_user(rtmp, rusertp,
52619 + sizeof (struct role_transition)))
52620 + return -EFAULT;
52621 +
52622 + rusertp = rtmp->prev;
52623 +
52624 + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
52625 +
52626 + if (!len || len >= GR_SPROLE_LEN)
52627 + return -EINVAL;
52628 +
52629 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52630 + return -ENOMEM;
52631 +
52632 + if (copy_from_user(tmp, rtmp->rolename, len))
52633 + return -EFAULT;
52634 + tmp[len-1] = '\0';
52635 + rtmp->rolename = tmp;
52636 +
52637 + if (!rlast) {
52638 + rtmp->prev = NULL;
52639 + rolep->transitions = rtmp;
52640 + } else {
52641 + rlast->next = rtmp;
52642 + rtmp->prev = rlast;
52643 + }
52644 +
52645 + if (!rusertp)
52646 + rtmp->next = NULL;
52647 + }
52648 +
52649 + return 0;
52650 +}
52651 +
52652 +static struct acl_subject_label *
52653 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
52654 +{
52655 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
52656 + unsigned int len;
52657 + char *tmp;
52658 + __u32 num_objs;
52659 + struct acl_ip_label **i_tmp, *i_utmp2;
52660 + struct gr_hash_struct ghash;
52661 + struct subject_map *subjmap;
52662 + unsigned int i_num;
52663 + int err;
52664 +
52665 + s_tmp = lookup_subject_map(userp);
52666 +
52667 + /* we've already copied this subject into the kernel, just return
52668 + the reference to it, and don't copy it over again
52669 + */
52670 + if (s_tmp)
52671 + return(s_tmp);
52672 +
52673 + if ((s_tmp = (struct acl_subject_label *)
52674 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
52675 + return ERR_PTR(-ENOMEM);
52676 +
52677 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
52678 + if (subjmap == NULL)
52679 + return ERR_PTR(-ENOMEM);
52680 +
52681 + subjmap->user = userp;
52682 + subjmap->kernel = s_tmp;
52683 + insert_subj_map_entry(subjmap);
52684 +
52685 + if (copy_from_user(s_tmp, userp,
52686 + sizeof (struct acl_subject_label)))
52687 + return ERR_PTR(-EFAULT);
52688 +
52689 + len = strnlen_user(s_tmp->filename, PATH_MAX);
52690 +
52691 + if (!len || len >= PATH_MAX)
52692 + return ERR_PTR(-EINVAL);
52693 +
52694 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52695 + return ERR_PTR(-ENOMEM);
52696 +
52697 + if (copy_from_user(tmp, s_tmp->filename, len))
52698 + return ERR_PTR(-EFAULT);
52699 + tmp[len-1] = '\0';
52700 + s_tmp->filename = tmp;
52701 +
52702 + if (!strcmp(s_tmp->filename, "/"))
52703 + role->root_label = s_tmp;
52704 +
52705 + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52706 + return ERR_PTR(-EFAULT);
52707 +
52708 + /* copy user and group transition tables */
52709 +
52710 + if (s_tmp->user_trans_num) {
52711 + uid_t *uidlist;
52712 +
52713 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52714 + if (uidlist == NULL)
52715 + return ERR_PTR(-ENOMEM);
52716 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52717 + return ERR_PTR(-EFAULT);
52718 +
52719 + s_tmp->user_transitions = uidlist;
52720 + }
52721 +
52722 + if (s_tmp->group_trans_num) {
52723 + gid_t *gidlist;
52724 +
52725 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52726 + if (gidlist == NULL)
52727 + return ERR_PTR(-ENOMEM);
52728 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52729 + return ERR_PTR(-EFAULT);
52730 +
52731 + s_tmp->group_transitions = gidlist;
52732 + }
52733 +
52734 + /* set up object hash table */
52735 + num_objs = count_user_objs(ghash.first);
52736 +
52737 + s_tmp->obj_hash_size = num_objs;
52738 + s_tmp->obj_hash =
52739 + (struct acl_object_label **)
52740 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52741 +
52742 + if (!s_tmp->obj_hash)
52743 + return ERR_PTR(-ENOMEM);
52744 +
52745 + memset(s_tmp->obj_hash, 0,
52746 + s_tmp->obj_hash_size *
52747 + sizeof (struct acl_object_label *));
52748 +
52749 + /* add in objects */
52750 + err = copy_user_objs(ghash.first, s_tmp, role);
52751 +
52752 + if (err)
52753 + return ERR_PTR(err);
52754 +
52755 + /* set pointer for parent subject */
52756 + if (s_tmp->parent_subject) {
52757 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52758 +
52759 + if (IS_ERR(s_tmp2))
52760 + return s_tmp2;
52761 +
52762 + s_tmp->parent_subject = s_tmp2;
52763 + }
52764 +
52765 + /* add in ip acls */
52766 +
52767 + if (!s_tmp->ip_num) {
52768 + s_tmp->ips = NULL;
52769 + goto insert;
52770 + }
52771 +
52772 + i_tmp =
52773 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52774 + sizeof (struct acl_ip_label *));
52775 +
52776 + if (!i_tmp)
52777 + return ERR_PTR(-ENOMEM);
52778 +
52779 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52780 + *(i_tmp + i_num) =
52781 + (struct acl_ip_label *)
52782 + acl_alloc(sizeof (struct acl_ip_label));
52783 + if (!*(i_tmp + i_num))
52784 + return ERR_PTR(-ENOMEM);
52785 +
52786 + if (copy_from_user
52787 + (&i_utmp2, s_tmp->ips + i_num,
52788 + sizeof (struct acl_ip_label *)))
52789 + return ERR_PTR(-EFAULT);
52790 +
52791 + if (copy_from_user
52792 + (*(i_tmp + i_num), i_utmp2,
52793 + sizeof (struct acl_ip_label)))
52794 + return ERR_PTR(-EFAULT);
52795 +
52796 + if ((*(i_tmp + i_num))->iface == NULL)
52797 + continue;
52798 +
52799 + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52800 + if (!len || len >= IFNAMSIZ)
52801 + return ERR_PTR(-EINVAL);
52802 + tmp = acl_alloc(len);
52803 + if (tmp == NULL)
52804 + return ERR_PTR(-ENOMEM);
52805 + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52806 + return ERR_PTR(-EFAULT);
52807 + (*(i_tmp + i_num))->iface = tmp;
52808 + }
52809 +
52810 + s_tmp->ips = i_tmp;
52811 +
52812 +insert:
52813 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52814 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52815 + return ERR_PTR(-ENOMEM);
52816 +
52817 + return s_tmp;
52818 +}
52819 +
52820 +static int
52821 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52822 +{
52823 + struct acl_subject_label s_pre;
52824 + struct acl_subject_label * ret;
52825 + int err;
52826 +
52827 + while (userp) {
52828 + if (copy_from_user(&s_pre, userp,
52829 + sizeof (struct acl_subject_label)))
52830 + return -EFAULT;
52831 +
52832 + /* do not add nested subjects here, add
52833 + while parsing objects
52834 + */
52835 +
52836 + if (s_pre.mode & GR_NESTED) {
52837 + userp = s_pre.prev;
52838 + continue;
52839 + }
52840 +
52841 + ret = do_copy_user_subj(userp, role);
52842 +
52843 + err = PTR_ERR(ret);
52844 + if (IS_ERR(ret))
52845 + return err;
52846 +
52847 + insert_acl_subj_label(ret, role);
52848 +
52849 + userp = s_pre.prev;
52850 + }
52851 +
52852 + return 0;
52853 +}
52854 +
52855 +static int
52856 +copy_user_acl(struct gr_arg *arg)
52857 +{
52858 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52859 + struct sprole_pw *sptmp;
52860 + struct gr_hash_struct *ghash;
52861 + uid_t *domainlist;
52862 + unsigned int r_num;
52863 + unsigned int len;
52864 + char *tmp;
52865 + int err = 0;
52866 + __u16 i;
52867 + __u32 num_subjs;
52868 +
52869 + /* we need a default and kernel role */
52870 + if (arg->role_db.num_roles < 2)
52871 + return -EINVAL;
52872 +
52873 + /* copy special role authentication info from userspace */
52874 +
52875 + num_sprole_pws = arg->num_sprole_pws;
52876 + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52877 +
52878 + if (!acl_special_roles) {
52879 + err = -ENOMEM;
52880 + goto cleanup;
52881 + }
52882 +
52883 + for (i = 0; i < num_sprole_pws; i++) {
52884 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52885 + if (!sptmp) {
52886 + err = -ENOMEM;
52887 + goto cleanup;
52888 + }
52889 + if (copy_from_user(sptmp, arg->sprole_pws + i,
52890 + sizeof (struct sprole_pw))) {
52891 + err = -EFAULT;
52892 + goto cleanup;
52893 + }
52894 +
52895 + len =
52896 + strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52897 +
52898 + if (!len || len >= GR_SPROLE_LEN) {
52899 + err = -EINVAL;
52900 + goto cleanup;
52901 + }
52902 +
52903 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
52904 + err = -ENOMEM;
52905 + goto cleanup;
52906 + }
52907 +
52908 + if (copy_from_user(tmp, sptmp->rolename, len)) {
52909 + err = -EFAULT;
52910 + goto cleanup;
52911 + }
52912 + tmp[len-1] = '\0';
52913 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52914 + printk(KERN_ALERT "Copying special role %s\n", tmp);
52915 +#endif
52916 + sptmp->rolename = tmp;
52917 + acl_special_roles[i] = sptmp;
52918 + }
52919 +
52920 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52921 +
52922 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52923 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
52924 +
52925 + if (!r_tmp) {
52926 + err = -ENOMEM;
52927 + goto cleanup;
52928 + }
52929 +
52930 + if (copy_from_user(&r_utmp2, r_utmp + r_num,
52931 + sizeof (struct acl_role_label *))) {
52932 + err = -EFAULT;
52933 + goto cleanup;
52934 + }
52935 +
52936 + if (copy_from_user(r_tmp, r_utmp2,
52937 + sizeof (struct acl_role_label))) {
52938 + err = -EFAULT;
52939 + goto cleanup;
52940 + }
52941 +
52942 + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52943 +
52944 + if (!len || len >= PATH_MAX) {
52945 + err = -EINVAL;
52946 + goto cleanup;
52947 + }
52948 +
52949 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
52950 + err = -ENOMEM;
52951 + goto cleanup;
52952 + }
52953 + if (copy_from_user(tmp, r_tmp->rolename, len)) {
52954 + err = -EFAULT;
52955 + goto cleanup;
52956 + }
52957 + tmp[len-1] = '\0';
52958 + r_tmp->rolename = tmp;
52959 +
52960 + if (!strcmp(r_tmp->rolename, "default")
52961 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52962 + default_role = r_tmp;
52963 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52964 + kernel_role = r_tmp;
52965 + }
52966 +
52967 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52968 + err = -ENOMEM;
52969 + goto cleanup;
52970 + }
52971 + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52972 + err = -EFAULT;
52973 + goto cleanup;
52974 + }
52975 +
52976 + r_tmp->hash = ghash;
52977 +
52978 + num_subjs = count_user_subjs(r_tmp->hash->first);
52979 +
52980 + r_tmp->subj_hash_size = num_subjs;
52981 + r_tmp->subj_hash =
52982 + (struct acl_subject_label **)
52983 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52984 +
52985 + if (!r_tmp->subj_hash) {
52986 + err = -ENOMEM;
52987 + goto cleanup;
52988 + }
52989 +
52990 + err = copy_user_allowedips(r_tmp);
52991 + if (err)
52992 + goto cleanup;
52993 +
52994 + /* copy domain info */
52995 + if (r_tmp->domain_children != NULL) {
52996 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52997 + if (domainlist == NULL) {
52998 + err = -ENOMEM;
52999 + goto cleanup;
53000 + }
53001 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
53002 + err = -EFAULT;
53003 + goto cleanup;
53004 + }
53005 + r_tmp->domain_children = domainlist;
53006 + }
53007 +
53008 + err = copy_user_transitions(r_tmp);
53009 + if (err)
53010 + goto cleanup;
53011 +
53012 + memset(r_tmp->subj_hash, 0,
53013 + r_tmp->subj_hash_size *
53014 + sizeof (struct acl_subject_label *));
53015 +
53016 + err = copy_user_subjs(r_tmp->hash->first, r_tmp);
53017 +
53018 + if (err)
53019 + goto cleanup;
53020 +
53021 + /* set nested subject list to null */
53022 + r_tmp->hash->first = NULL;
53023 +
53024 + insert_acl_role_label(r_tmp);
53025 + }
53026 +
53027 + goto return_err;
53028 + cleanup:
53029 + free_variables();
53030 + return_err:
53031 + return err;
53032 +
53033 +}
53034 +
53035 +static int
53036 +gracl_init(struct gr_arg *args)
53037 +{
53038 + int error = 0;
53039 +
53040 + memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
53041 + memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
53042 +
53043 + if (init_variables(args)) {
53044 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
53045 + error = -ENOMEM;
53046 + free_variables();
53047 + goto out;
53048 + }
53049 +
53050 + error = copy_user_acl(args);
53051 + free_init_variables();
53052 + if (error) {
53053 + free_variables();
53054 + goto out;
53055 + }
53056 +
53057 + if ((error = gr_set_acls(0))) {
53058 + free_variables();
53059 + goto out;
53060 + }
53061 +
53062 + pax_open_kernel();
53063 + gr_status |= GR_READY;
53064 + pax_close_kernel();
53065 +
53066 + out:
53067 + return error;
53068 +}
53069 +
53070 +/* derived from glibc fnmatch() 0: match, 1: no match*/
53071 +
53072 +static int
53073 +glob_match(const char *p, const char *n)
53074 +{
53075 + char c;
53076 +
53077 + while ((c = *p++) != '\0') {
53078 + switch (c) {
53079 + case '?':
53080 + if (*n == '\0')
53081 + return 1;
53082 + else if (*n == '/')
53083 + return 1;
53084 + break;
53085 + case '\\':
53086 + if (*n != c)
53087 + return 1;
53088 + break;
53089 + case '*':
53090 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
53091 + if (*n == '/')
53092 + return 1;
53093 + else if (c == '?') {
53094 + if (*n == '\0')
53095 + return 1;
53096 + else
53097 + ++n;
53098 + }
53099 + }
53100 + if (c == '\0') {
53101 + return 0;
53102 + } else {
53103 + const char *endp;
53104 +
53105 + if ((endp = strchr(n, '/')) == NULL)
53106 + endp = n + strlen(n);
53107 +
53108 + if (c == '[') {
53109 + for (--p; n < endp; ++n)
53110 + if (!glob_match(p, n))
53111 + return 0;
53112 + } else if (c == '/') {
53113 + while (*n != '\0' && *n != '/')
53114 + ++n;
53115 + if (*n == '/' && !glob_match(p, n + 1))
53116 + return 0;
53117 + } else {
53118 + for (--p; n < endp; ++n)
53119 + if (*n == c && !glob_match(p, n))
53120 + return 0;
53121 + }
53122 +
53123 + return 1;
53124 + }
53125 + case '[':
53126 + {
53127 + int not;
53128 + char cold;
53129 +
53130 + if (*n == '\0' || *n == '/')
53131 + return 1;
53132 +
53133 + not = (*p == '!' || *p == '^');
53134 + if (not)
53135 + ++p;
53136 +
53137 + c = *p++;
53138 + for (;;) {
53139 + unsigned char fn = (unsigned char)*n;
53140 +
53141 + if (c == '\0')
53142 + return 1;
53143 + else {
53144 + if (c == fn)
53145 + goto matched;
53146 + cold = c;
53147 + c = *p++;
53148 +
53149 + if (c == '-' && *p != ']') {
53150 + unsigned char cend = *p++;
53151 +
53152 + if (cend == '\0')
53153 + return 1;
53154 +
53155 + if (cold <= fn && fn <= cend)
53156 + goto matched;
53157 +
53158 + c = *p++;
53159 + }
53160 + }
53161 +
53162 + if (c == ']')
53163 + break;
53164 + }
53165 + if (!not)
53166 + return 1;
53167 + break;
53168 + matched:
53169 + while (c != ']') {
53170 + if (c == '\0')
53171 + return 1;
53172 +
53173 + c = *p++;
53174 + }
53175 + if (not)
53176 + return 1;
53177 + }
53178 + break;
53179 + default:
53180 + if (c != *n)
53181 + return 1;
53182 + }
53183 +
53184 + ++n;
53185 + }
53186 +
53187 + if (*n == '\0')
53188 + return 0;
53189 +
53190 + if (*n == '/')
53191 + return 0;
53192 +
53193 + return 1;
53194 +}
53195 +
53196 +static struct acl_object_label *
53197 +chk_glob_label(struct acl_object_label *globbed,
53198 + struct dentry *dentry, struct vfsmount *mnt, char **path)
53199 +{
53200 + struct acl_object_label *tmp;
53201 +
53202 + if (*path == NULL)
53203 + *path = gr_to_filename_nolock(dentry, mnt);
53204 +
53205 + tmp = globbed;
53206 +
53207 + while (tmp) {
53208 + if (!glob_match(tmp->filename, *path))
53209 + return tmp;
53210 + tmp = tmp->next;
53211 + }
53212 +
53213 + return NULL;
53214 +}
53215 +
53216 +static struct acl_object_label *
53217 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53218 + const ino_t curr_ino, const dev_t curr_dev,
53219 + const struct acl_subject_label *subj, char **path, const int checkglob)
53220 +{
53221 + struct acl_subject_label *tmpsubj;
53222 + struct acl_object_label *retval;
53223 + struct acl_object_label *retval2;
53224 +
53225 + tmpsubj = (struct acl_subject_label *) subj;
53226 + read_lock(&gr_inode_lock);
53227 + do {
53228 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
53229 + if (retval) {
53230 + if (checkglob && retval->globbed) {
53231 + retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
53232 + (struct vfsmount *)orig_mnt, path);
53233 + if (retval2)
53234 + retval = retval2;
53235 + }
53236 + break;
53237 + }
53238 + } while ((tmpsubj = tmpsubj->parent_subject));
53239 + read_unlock(&gr_inode_lock);
53240 +
53241 + return retval;
53242 +}
53243 +
53244 +static __inline__ struct acl_object_label *
53245 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53246 + struct dentry *curr_dentry,
53247 + const struct acl_subject_label *subj, char **path, const int checkglob)
53248 +{
53249 + int newglob = checkglob;
53250 + ino_t inode;
53251 + dev_t device;
53252 +
53253 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
53254 + as we don't want a / * rule to match instead of the / object
53255 + don't do this for create lookups that call this function though, since they're looking up
53256 + on the parent and thus need globbing checks on all paths
53257 + */
53258 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
53259 + newglob = GR_NO_GLOB;
53260 +
53261 + spin_lock(&curr_dentry->d_lock);
53262 + inode = curr_dentry->d_inode->i_ino;
53263 + device = __get_dev(curr_dentry);
53264 + spin_unlock(&curr_dentry->d_lock);
53265 +
53266 + return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
53267 +}
53268 +
53269 +static struct acl_object_label *
53270 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53271 + const struct acl_subject_label *subj, char *path, const int checkglob)
53272 +{
53273 + struct dentry *dentry = (struct dentry *) l_dentry;
53274 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53275 + struct acl_object_label *retval;
53276 + struct dentry *parent;
53277 +
53278 + write_seqlock(&rename_lock);
53279 + br_read_lock(vfsmount_lock);
53280 +
53281 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
53282 +#ifdef CONFIG_NET
53283 + mnt == sock_mnt ||
53284 +#endif
53285 +#ifdef CONFIG_HUGETLBFS
53286 + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
53287 +#endif
53288 + /* ignore Eric Biederman */
53289 + IS_PRIVATE(l_dentry->d_inode))) {
53290 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
53291 + goto out;
53292 + }
53293 +
53294 + for (;;) {
53295 + if (dentry == real_root.dentry && mnt == real_root.mnt)
53296 + break;
53297 +
53298 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53299 + if (mnt->mnt_parent == mnt)
53300 + break;
53301 +
53302 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53303 + if (retval != NULL)
53304 + goto out;
53305 +
53306 + dentry = mnt->mnt_mountpoint;
53307 + mnt = mnt->mnt_parent;
53308 + continue;
53309 + }
53310 +
53311 + parent = dentry->d_parent;
53312 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53313 + if (retval != NULL)
53314 + goto out;
53315 +
53316 + dentry = parent;
53317 + }
53318 +
53319 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53320 +
53321 + /* real_root is pinned so we don't have to hold a reference */
53322 + if (retval == NULL)
53323 + retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
53324 +out:
53325 + br_read_unlock(vfsmount_lock);
53326 + write_sequnlock(&rename_lock);
53327 +
53328 + BUG_ON(retval == NULL);
53329 +
53330 + return retval;
53331 +}
53332 +
53333 +static __inline__ struct acl_object_label *
53334 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53335 + const struct acl_subject_label *subj)
53336 +{
53337 + char *path = NULL;
53338 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
53339 +}
53340 +
53341 +static __inline__ struct acl_object_label *
53342 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53343 + const struct acl_subject_label *subj)
53344 +{
53345 + char *path = NULL;
53346 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
53347 +}
53348 +
53349 +static __inline__ struct acl_object_label *
53350 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53351 + const struct acl_subject_label *subj, char *path)
53352 +{
53353 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
53354 +}
53355 +
53356 +static struct acl_subject_label *
53357 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53358 + const struct acl_role_label *role)
53359 +{
53360 + struct dentry *dentry = (struct dentry *) l_dentry;
53361 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53362 + struct acl_subject_label *retval;
53363 + struct dentry *parent;
53364 +
53365 + write_seqlock(&rename_lock);
53366 + br_read_lock(vfsmount_lock);
53367 +
53368 + for (;;) {
53369 + if (dentry == real_root.dentry && mnt == real_root.mnt)
53370 + break;
53371 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53372 + if (mnt->mnt_parent == mnt)
53373 + break;
53374 +
53375 + spin_lock(&dentry->d_lock);
53376 + read_lock(&gr_inode_lock);
53377 + retval =
53378 + lookup_acl_subj_label(dentry->d_inode->i_ino,
53379 + __get_dev(dentry), role);
53380 + read_unlock(&gr_inode_lock);
53381 + spin_unlock(&dentry->d_lock);
53382 + if (retval != NULL)
53383 + goto out;
53384 +
53385 + dentry = mnt->mnt_mountpoint;
53386 + mnt = mnt->mnt_parent;
53387 + continue;
53388 + }
53389 +
53390 + spin_lock(&dentry->d_lock);
53391 + read_lock(&gr_inode_lock);
53392 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53393 + __get_dev(dentry), role);
53394 + read_unlock(&gr_inode_lock);
53395 + parent = dentry->d_parent;
53396 + spin_unlock(&dentry->d_lock);
53397 +
53398 + if (retval != NULL)
53399 + goto out;
53400 +
53401 + dentry = parent;
53402 + }
53403 +
53404 + spin_lock(&dentry->d_lock);
53405 + read_lock(&gr_inode_lock);
53406 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53407 + __get_dev(dentry), role);
53408 + read_unlock(&gr_inode_lock);
53409 + spin_unlock(&dentry->d_lock);
53410 +
53411 + if (unlikely(retval == NULL)) {
53412 + /* real_root is pinned, we don't need to hold a reference */
53413 + read_lock(&gr_inode_lock);
53414 + retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
53415 + __get_dev(real_root.dentry), role);
53416 + read_unlock(&gr_inode_lock);
53417 + }
53418 +out:
53419 + br_read_unlock(vfsmount_lock);
53420 + write_sequnlock(&rename_lock);
53421 +
53422 + BUG_ON(retval == NULL);
53423 +
53424 + return retval;
53425 +}
53426 +
53427 +static void
53428 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
53429 +{
53430 + struct task_struct *task = current;
53431 + const struct cred *cred = current_cred();
53432 +
53433 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53434 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53435 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53436 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
53437 +
53438 + return;
53439 +}
53440 +
53441 +static void
53442 +gr_log_learn_sysctl(const char *path, const __u32 mode)
53443 +{
53444 + struct task_struct *task = current;
53445 + const struct cred *cred = current_cred();
53446 +
53447 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53448 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53449 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53450 + 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
53451 +
53452 + return;
53453 +}
53454 +
53455 +static void
53456 +gr_log_learn_id_change(const char type, const unsigned int real,
53457 + const unsigned int effective, const unsigned int fs)
53458 +{
53459 + struct task_struct *task = current;
53460 + const struct cred *cred = current_cred();
53461 +
53462 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
53463 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53464 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53465 + type, real, effective, fs, &task->signal->saved_ip);
53466 +
53467 + return;
53468 +}
53469 +
53470 +__u32
53471 +gr_check_link(const struct dentry * new_dentry,
53472 + const struct dentry * parent_dentry,
53473 + const struct vfsmount * parent_mnt,
53474 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
53475 +{
53476 + struct acl_object_label *obj;
53477 + __u32 oldmode, newmode;
53478 + __u32 needmode;
53479 +
53480 + if (unlikely(!(gr_status & GR_READY)))
53481 + return (GR_CREATE | GR_LINK);
53482 +
53483 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
53484 + oldmode = obj->mode;
53485 +
53486 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53487 + oldmode |= (GR_CREATE | GR_LINK);
53488 +
53489 + needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
53490 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53491 + needmode |= GR_SETID | GR_AUDIT_SETID;
53492 +
53493 + newmode =
53494 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
53495 + oldmode | needmode);
53496 +
53497 + needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
53498 + GR_SETID | GR_READ | GR_FIND | GR_DELETE |
53499 + GR_INHERIT | GR_AUDIT_INHERIT);
53500 +
53501 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
53502 + goto bad;
53503 +
53504 + if ((oldmode & needmode) != needmode)
53505 + goto bad;
53506 +
53507 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
53508 + if ((newmode & needmode) != needmode)
53509 + goto bad;
53510 +
53511 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
53512 + return newmode;
53513 +bad:
53514 + needmode = oldmode;
53515 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53516 + needmode |= GR_SETID;
53517 +
53518 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53519 + gr_log_learn(old_dentry, old_mnt, needmode);
53520 + return (GR_CREATE | GR_LINK);
53521 + } else if (newmode & GR_SUPPRESS)
53522 + return GR_SUPPRESS;
53523 + else
53524 + return 0;
53525 +}
53526 +
53527 +__u32
53528 +gr_search_file(const struct dentry * dentry, const __u32 mode,
53529 + const struct vfsmount * mnt)
53530 +{
53531 + __u32 retval = mode;
53532 + struct acl_subject_label *curracl;
53533 + struct acl_object_label *currobj;
53534 +
53535 + if (unlikely(!(gr_status & GR_READY)))
53536 + return (mode & ~GR_AUDITS);
53537 +
53538 + curracl = current->acl;
53539 +
53540 + currobj = chk_obj_label(dentry, mnt, curracl);
53541 + retval = currobj->mode & mode;
53542 +
53543 + /* if we're opening a specified transfer file for writing
53544 + (e.g. /dev/initctl), then transfer our role to init
53545 + */
53546 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
53547 + current->role->roletype & GR_ROLE_PERSIST)) {
53548 + struct task_struct *task = init_pid_ns.child_reaper;
53549 +
53550 + if (task->role != current->role) {
53551 + task->acl_sp_role = 0;
53552 + task->acl_role_id = current->acl_role_id;
53553 + task->role = current->role;
53554 + rcu_read_lock();
53555 + read_lock(&grsec_exec_file_lock);
53556 + gr_apply_subject_to_task(task);
53557 + read_unlock(&grsec_exec_file_lock);
53558 + rcu_read_unlock();
53559 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
53560 + }
53561 + }
53562 +
53563 + if (unlikely
53564 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
53565 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
53566 + __u32 new_mode = mode;
53567 +
53568 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53569 +
53570 + retval = new_mode;
53571 +
53572 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
53573 + new_mode |= GR_INHERIT;
53574 +
53575 + if (!(mode & GR_NOLEARN))
53576 + gr_log_learn(dentry, mnt, new_mode);
53577 + }
53578 +
53579 + return retval;
53580 +}
53581 +
53582 +__u32
53583 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
53584 + const struct vfsmount * mnt, const __u32 mode)
53585 +{
53586 + struct name_entry *match;
53587 + struct acl_object_label *matchpo;
53588 + struct acl_subject_label *curracl;
53589 + char *path;
53590 + __u32 retval;
53591 +
53592 + if (unlikely(!(gr_status & GR_READY)))
53593 + return (mode & ~GR_AUDITS);
53594 +
53595 + preempt_disable();
53596 + path = gr_to_filename_rbac(new_dentry, mnt);
53597 + match = lookup_name_entry_create(path);
53598 +
53599 + if (!match)
53600 + goto check_parent;
53601 +
53602 + curracl = current->acl;
53603 +
53604 + read_lock(&gr_inode_lock);
53605 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
53606 + read_unlock(&gr_inode_lock);
53607 +
53608 + if (matchpo) {
53609 + if ((matchpo->mode & mode) !=
53610 + (mode & ~(GR_AUDITS | GR_SUPPRESS))
53611 + && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53612 + __u32 new_mode = mode;
53613 +
53614 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53615 +
53616 + gr_log_learn(new_dentry, mnt, new_mode);
53617 +
53618 + preempt_enable();
53619 + return new_mode;
53620 + }
53621 + preempt_enable();
53622 + return (matchpo->mode & mode);
53623 + }
53624 +
53625 + check_parent:
53626 + curracl = current->acl;
53627 +
53628 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
53629 + retval = matchpo->mode & mode;
53630 +
53631 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
53632 + && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53633 + __u32 new_mode = mode;
53634 +
53635 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53636 +
53637 + gr_log_learn(new_dentry, mnt, new_mode);
53638 + preempt_enable();
53639 + return new_mode;
53640 + }
53641 +
53642 + preempt_enable();
53643 + return retval;
53644 +}
53645 +
53646 +int
53647 +gr_check_hidden_task(const struct task_struct *task)
53648 +{
53649 + if (unlikely(!(gr_status & GR_READY)))
53650 + return 0;
53651 +
53652 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
53653 + return 1;
53654 +
53655 + return 0;
53656 +}
53657 +
53658 +int
53659 +gr_check_protected_task(const struct task_struct *task)
53660 +{
53661 + if (unlikely(!(gr_status & GR_READY) || !task))
53662 + return 0;
53663 +
53664 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53665 + task->acl != current->acl)
53666 + return 1;
53667 +
53668 + return 0;
53669 +}
53670 +
53671 +int
53672 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53673 +{
53674 + struct task_struct *p;
53675 + int ret = 0;
53676 +
53677 + if (unlikely(!(gr_status & GR_READY) || !pid))
53678 + return ret;
53679 +
53680 + read_lock(&tasklist_lock);
53681 + do_each_pid_task(pid, type, p) {
53682 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53683 + p->acl != current->acl) {
53684 + ret = 1;
53685 + goto out;
53686 + }
53687 + } while_each_pid_task(pid, type, p);
53688 +out:
53689 + read_unlock(&tasklist_lock);
53690 +
53691 + return ret;
53692 +}
53693 +
53694 +void
53695 +gr_copy_label(struct task_struct *tsk)
53696 +{
53697 + tsk->signal->used_accept = 0;
53698 + tsk->acl_sp_role = 0;
53699 + tsk->acl_role_id = current->acl_role_id;
53700 + tsk->acl = current->acl;
53701 + tsk->role = current->role;
53702 + tsk->signal->curr_ip = current->signal->curr_ip;
53703 + tsk->signal->saved_ip = current->signal->saved_ip;
53704 + if (current->exec_file)
53705 + get_file(current->exec_file);
53706 + tsk->exec_file = current->exec_file;
53707 + tsk->is_writable = current->is_writable;
53708 + if (unlikely(current->signal->used_accept)) {
53709 + current->signal->curr_ip = 0;
53710 + current->signal->saved_ip = 0;
53711 + }
53712 +
53713 + return;
53714 +}
53715 +
53716 +static void
53717 +gr_set_proc_res(struct task_struct *task)
53718 +{
53719 + struct acl_subject_label *proc;
53720 + unsigned short i;
53721 +
53722 + proc = task->acl;
53723 +
53724 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53725 + return;
53726 +
53727 + for (i = 0; i < RLIM_NLIMITS; i++) {
53728 + if (!(proc->resmask & (1 << i)))
53729 + continue;
53730 +
53731 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53732 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53733 + }
53734 +
53735 + return;
53736 +}
53737 +
53738 +extern int __gr_process_user_ban(struct user_struct *user);
53739 +
53740 +int
53741 +gr_check_user_change(int real, int effective, int fs)
53742 +{
53743 + unsigned int i;
53744 + __u16 num;
53745 + uid_t *uidlist;
53746 + int curuid;
53747 + int realok = 0;
53748 + int effectiveok = 0;
53749 + int fsok = 0;
53750 +
53751 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53752 + struct user_struct *user;
53753 +
53754 + if (real == -1)
53755 + goto skipit;
53756 +
53757 + user = find_user(real);
53758 + if (user == NULL)
53759 + goto skipit;
53760 +
53761 + if (__gr_process_user_ban(user)) {
53762 + /* for find_user */
53763 + free_uid(user);
53764 + return 1;
53765 + }
53766 +
53767 + /* for find_user */
53768 + free_uid(user);
53769 +
53770 +skipit:
53771 +#endif
53772 +
53773 + if (unlikely(!(gr_status & GR_READY)))
53774 + return 0;
53775 +
53776 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53777 + gr_log_learn_id_change('u', real, effective, fs);
53778 +
53779 + num = current->acl->user_trans_num;
53780 + uidlist = current->acl->user_transitions;
53781 +
53782 + if (uidlist == NULL)
53783 + return 0;
53784 +
53785 + if (real == -1)
53786 + realok = 1;
53787 + if (effective == -1)
53788 + effectiveok = 1;
53789 + if (fs == -1)
53790 + fsok = 1;
53791 +
53792 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
53793 + for (i = 0; i < num; i++) {
53794 + curuid = (int)uidlist[i];
53795 + if (real == curuid)
53796 + realok = 1;
53797 + if (effective == curuid)
53798 + effectiveok = 1;
53799 + if (fs == curuid)
53800 + fsok = 1;
53801 + }
53802 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
53803 + for (i = 0; i < num; i++) {
53804 + curuid = (int)uidlist[i];
53805 + if (real == curuid)
53806 + break;
53807 + if (effective == curuid)
53808 + break;
53809 + if (fs == curuid)
53810 + break;
53811 + }
53812 + /* not in deny list */
53813 + if (i == num) {
53814 + realok = 1;
53815 + effectiveok = 1;
53816 + fsok = 1;
53817 + }
53818 + }
53819 +
53820 + if (realok && effectiveok && fsok)
53821 + return 0;
53822 + else {
53823 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53824 + return 1;
53825 + }
53826 +}
53827 +
53828 +int
53829 +gr_check_group_change(int real, int effective, int fs)
53830 +{
53831 + unsigned int i;
53832 + __u16 num;
53833 + gid_t *gidlist;
53834 + int curgid;
53835 + int realok = 0;
53836 + int effectiveok = 0;
53837 + int fsok = 0;
53838 +
53839 + if (unlikely(!(gr_status & GR_READY)))
53840 + return 0;
53841 +
53842 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53843 + gr_log_learn_id_change('g', real, effective, fs);
53844 +
53845 + num = current->acl->group_trans_num;
53846 + gidlist = current->acl->group_transitions;
53847 +
53848 + if (gidlist == NULL)
53849 + return 0;
53850 +
53851 + if (real == -1)
53852 + realok = 1;
53853 + if (effective == -1)
53854 + effectiveok = 1;
53855 + if (fs == -1)
53856 + fsok = 1;
53857 +
53858 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
53859 + for (i = 0; i < num; i++) {
53860 + curgid = (int)gidlist[i];
53861 + if (real == curgid)
53862 + realok = 1;
53863 + if (effective == curgid)
53864 + effectiveok = 1;
53865 + if (fs == curgid)
53866 + fsok = 1;
53867 + }
53868 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
53869 + for (i = 0; i < num; i++) {
53870 + curgid = (int)gidlist[i];
53871 + if (real == curgid)
53872 + break;
53873 + if (effective == curgid)
53874 + break;
53875 + if (fs == curgid)
53876 + break;
53877 + }
53878 + /* not in deny list */
53879 + if (i == num) {
53880 + realok = 1;
53881 + effectiveok = 1;
53882 + fsok = 1;
53883 + }
53884 + }
53885 +
53886 + if (realok && effectiveok && fsok)
53887 + return 0;
53888 + else {
53889 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53890 + return 1;
53891 + }
53892 +}
53893 +
53894 +void
53895 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53896 +{
53897 + struct acl_role_label *role = task->role;
53898 + struct acl_subject_label *subj = NULL;
53899 + struct acl_object_label *obj;
53900 + struct file *filp;
53901 +
53902 + if (unlikely(!(gr_status & GR_READY)))
53903 + return;
53904 +
53905 + filp = task->exec_file;
53906 +
53907 + /* kernel process, we'll give them the kernel role */
53908 + if (unlikely(!filp)) {
53909 + task->role = kernel_role;
53910 + task->acl = kernel_role->root_label;
53911 + return;
53912 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53913 + role = lookup_acl_role_label(task, uid, gid);
53914 +
53915 + /* perform subject lookup in possibly new role
53916 + we can use this result below in the case where role == task->role
53917 + */
53918 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53919 +
53920 + /* if we changed uid/gid, but result in the same role
53921 + and are using inheritance, don't lose the inherited subject
53922 + if current subject is other than what normal lookup
53923 + would result in, we arrived via inheritance, don't
53924 + lose subject
53925 + */
53926 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53927 + (subj == task->acl)))
53928 + task->acl = subj;
53929 +
53930 + task->role = role;
53931 +
53932 + task->is_writable = 0;
53933 +
53934 + /* ignore additional mmap checks for processes that are writable
53935 + by the default ACL */
53936 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53937 + if (unlikely(obj->mode & GR_WRITE))
53938 + task->is_writable = 1;
53939 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53940 + if (unlikely(obj->mode & GR_WRITE))
53941 + task->is_writable = 1;
53942 +
53943 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53944 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53945 +#endif
53946 +
53947 + gr_set_proc_res(task);
53948 +
53949 + return;
53950 +}
53951 +
53952 +int
53953 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53954 + const int unsafe_share)
53955 +{
53956 + struct task_struct *task = current;
53957 + struct acl_subject_label *newacl;
53958 + struct acl_object_label *obj;
53959 + __u32 retmode;
53960 +
53961 + if (unlikely(!(gr_status & GR_READY)))
53962 + return 0;
53963 +
53964 + newacl = chk_subj_label(dentry, mnt, task->role);
53965 +
53966 + task_lock(task);
53967 + if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53968 + !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53969 + !(task->role->roletype & GR_ROLE_GOD) &&
53970 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53971 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53972 + task_unlock(task);
53973 + if (unsafe_share)
53974 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53975 + else
53976 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53977 + return -EACCES;
53978 + }
53979 + task_unlock(task);
53980 +
53981 + obj = chk_obj_label(dentry, mnt, task->acl);
53982 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53983 +
53984 + if (!(task->acl->mode & GR_INHERITLEARN) &&
53985 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53986 + if (obj->nested)
53987 + task->acl = obj->nested;
53988 + else
53989 + task->acl = newacl;
53990 + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53991 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53992 +
53993 + task->is_writable = 0;
53994 +
53995 + /* ignore additional mmap checks for processes that are writable
53996 + by the default ACL */
53997 + obj = chk_obj_label(dentry, mnt, default_role->root_label);
53998 + if (unlikely(obj->mode & GR_WRITE))
53999 + task->is_writable = 1;
54000 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
54001 + if (unlikely(obj->mode & GR_WRITE))
54002 + task->is_writable = 1;
54003 +
54004 + gr_set_proc_res(task);
54005 +
54006 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54007 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54008 +#endif
54009 + return 0;
54010 +}
54011 +
54012 +/* always called with valid inodev ptr */
54013 +static void
54014 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
54015 +{
54016 + struct acl_object_label *matchpo;
54017 + struct acl_subject_label *matchps;
54018 + struct acl_subject_label *subj;
54019 + struct acl_role_label *role;
54020 + unsigned int x;
54021 +
54022 + FOR_EACH_ROLE_START(role)
54023 + FOR_EACH_SUBJECT_START(role, subj, x)
54024 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
54025 + matchpo->mode |= GR_DELETED;
54026 + FOR_EACH_SUBJECT_END(subj,x)
54027 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
54028 + if (subj->inode == ino && subj->device == dev)
54029 + subj->mode |= GR_DELETED;
54030 + FOR_EACH_NESTED_SUBJECT_END(subj)
54031 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
54032 + matchps->mode |= GR_DELETED;
54033 + FOR_EACH_ROLE_END(role)
54034 +
54035 + inodev->nentry->deleted = 1;
54036 +
54037 + return;
54038 +}
54039 +
54040 +void
54041 +gr_handle_delete(const ino_t ino, const dev_t dev)
54042 +{
54043 + struct inodev_entry *inodev;
54044 +
54045 + if (unlikely(!(gr_status & GR_READY)))
54046 + return;
54047 +
54048 + write_lock(&gr_inode_lock);
54049 + inodev = lookup_inodev_entry(ino, dev);
54050 + if (inodev != NULL)
54051 + do_handle_delete(inodev, ino, dev);
54052 + write_unlock(&gr_inode_lock);
54053 +
54054 + return;
54055 +}
54056 +
54057 +static void
54058 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
54059 + const ino_t newinode, const dev_t newdevice,
54060 + struct acl_subject_label *subj)
54061 +{
54062 + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
54063 + struct acl_object_label *match;
54064 +
54065 + match = subj->obj_hash[index];
54066 +
54067 + while (match && (match->inode != oldinode ||
54068 + match->device != olddevice ||
54069 + !(match->mode & GR_DELETED)))
54070 + match = match->next;
54071 +
54072 + if (match && (match->inode == oldinode)
54073 + && (match->device == olddevice)
54074 + && (match->mode & GR_DELETED)) {
54075 + if (match->prev == NULL) {
54076 + subj->obj_hash[index] = match->next;
54077 + if (match->next != NULL)
54078 + match->next->prev = NULL;
54079 + } else {
54080 + match->prev->next = match->next;
54081 + if (match->next != NULL)
54082 + match->next->prev = match->prev;
54083 + }
54084 + match->prev = NULL;
54085 + match->next = NULL;
54086 + match->inode = newinode;
54087 + match->device = newdevice;
54088 + match->mode &= ~GR_DELETED;
54089 +
54090 + insert_acl_obj_label(match, subj);
54091 + }
54092 +
54093 + return;
54094 +}
54095 +
54096 +static void
54097 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
54098 + const ino_t newinode, const dev_t newdevice,
54099 + struct acl_role_label *role)
54100 +{
54101 + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
54102 + struct acl_subject_label *match;
54103 +
54104 + match = role->subj_hash[index];
54105 +
54106 + while (match && (match->inode != oldinode ||
54107 + match->device != olddevice ||
54108 + !(match->mode & GR_DELETED)))
54109 + match = match->next;
54110 +
54111 + if (match && (match->inode == oldinode)
54112 + && (match->device == olddevice)
54113 + && (match->mode & GR_DELETED)) {
54114 + if (match->prev == NULL) {
54115 + role->subj_hash[index] = match->next;
54116 + if (match->next != NULL)
54117 + match->next->prev = NULL;
54118 + } else {
54119 + match->prev->next = match->next;
54120 + if (match->next != NULL)
54121 + match->next->prev = match->prev;
54122 + }
54123 + match->prev = NULL;
54124 + match->next = NULL;
54125 + match->inode = newinode;
54126 + match->device = newdevice;
54127 + match->mode &= ~GR_DELETED;
54128 +
54129 + insert_acl_subj_label(match, role);
54130 + }
54131 +
54132 + return;
54133 +}
54134 +
54135 +static void
54136 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
54137 + const ino_t newinode, const dev_t newdevice)
54138 +{
54139 + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
54140 + struct inodev_entry *match;
54141 +
54142 + match = inodev_set.i_hash[index];
54143 +
54144 + while (match && (match->nentry->inode != oldinode ||
54145 + match->nentry->device != olddevice || !match->nentry->deleted))
54146 + match = match->next;
54147 +
54148 + if (match && (match->nentry->inode == oldinode)
54149 + && (match->nentry->device == olddevice) &&
54150 + match->nentry->deleted) {
54151 + if (match->prev == NULL) {
54152 + inodev_set.i_hash[index] = match->next;
54153 + if (match->next != NULL)
54154 + match->next->prev = NULL;
54155 + } else {
54156 + match->prev->next = match->next;
54157 + if (match->next != NULL)
54158 + match->next->prev = match->prev;
54159 + }
54160 + match->prev = NULL;
54161 + match->next = NULL;
54162 + match->nentry->inode = newinode;
54163 + match->nentry->device = newdevice;
54164 + match->nentry->deleted = 0;
54165 +
54166 + insert_inodev_entry(match);
54167 + }
54168 +
54169 + return;
54170 +}
54171 +
54172 +static void
54173 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
54174 + const struct vfsmount *mnt)
54175 +{
54176 + struct acl_subject_label *subj;
54177 + struct acl_role_label *role;
54178 + unsigned int x;
54179 + ino_t ino = dentry->d_inode->i_ino;
54180 + dev_t dev = __get_dev(dentry);
54181 +
54182 + FOR_EACH_ROLE_START(role)
54183 + update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
54184 +
54185 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
54186 + if ((subj->inode == ino) && (subj->device == dev)) {
54187 + subj->inode = ino;
54188 + subj->device = dev;
54189 + }
54190 + FOR_EACH_NESTED_SUBJECT_END(subj)
54191 + FOR_EACH_SUBJECT_START(role, subj, x)
54192 + update_acl_obj_label(matchn->inode, matchn->device,
54193 + ino, dev, subj);
54194 + FOR_EACH_SUBJECT_END(subj,x)
54195 + FOR_EACH_ROLE_END(role)
54196 +
54197 + update_inodev_entry(matchn->inode, matchn->device, ino, dev);
54198 +
54199 + return;
54200 +}
54201 +
54202 +void
54203 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
54204 +{
54205 + struct name_entry *matchn;
54206 +
54207 + if (unlikely(!(gr_status & GR_READY)))
54208 + return;
54209 +
54210 + preempt_disable();
54211 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
54212 +
54213 + if (unlikely((unsigned long)matchn)) {
54214 + write_lock(&gr_inode_lock);
54215 + do_handle_create(matchn, dentry, mnt);
54216 + write_unlock(&gr_inode_lock);
54217 + }
54218 + preempt_enable();
54219 +
54220 + return;
54221 +}
54222 +
54223 +void
54224 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
54225 + struct dentry *old_dentry,
54226 + struct dentry *new_dentry,
54227 + struct vfsmount *mnt, const __u8 replace)
54228 +{
54229 + struct name_entry *matchn;
54230 + struct inodev_entry *inodev;
54231 + ino_t old_ino = old_dentry->d_inode->i_ino;
54232 + dev_t old_dev = __get_dev(old_dentry);
54233 +
54234 + /* vfs_rename swaps the name and parent link for old_dentry and
54235 + new_dentry
54236 + at this point, old_dentry has the new name, parent link, and inode
54237 + for the renamed file
54238 + if a file is being replaced by a rename, new_dentry has the inode
54239 + and name for the replaced file
54240 + */
54241 +
54242 + if (unlikely(!(gr_status & GR_READY)))
54243 + return;
54244 +
54245 + preempt_disable();
54246 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
54247 +
54248 + /* we wouldn't have to check d_inode if it weren't for
54249 + NFS silly-renaming
54250 + */
54251 +
54252 + write_lock(&gr_inode_lock);
54253 + if (unlikely(replace && new_dentry->d_inode)) {
54254 + ino_t new_ino = new_dentry->d_inode->i_ino;
54255 + dev_t new_dev = __get_dev(new_dentry);
54256 +
54257 + inodev = lookup_inodev_entry(new_ino, new_dev);
54258 + if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
54259 + do_handle_delete(inodev, new_ino, new_dev);
54260 + }
54261 +
54262 + inodev = lookup_inodev_entry(old_ino, old_dev);
54263 + if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
54264 + do_handle_delete(inodev, old_ino, old_dev);
54265 +
54266 + if (unlikely((unsigned long)matchn))
54267 + do_handle_create(matchn, old_dentry, mnt);
54268 +
54269 + write_unlock(&gr_inode_lock);
54270 + preempt_enable();
54271 +
54272 + return;
54273 +}
54274 +
54275 +static int
54276 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
54277 + unsigned char **sum)
54278 +{
54279 + struct acl_role_label *r;
54280 + struct role_allowed_ip *ipp;
54281 + struct role_transition *trans;
54282 + unsigned int i;
54283 + int found = 0;
54284 + u32 curr_ip = current->signal->curr_ip;
54285 +
54286 + current->signal->saved_ip = curr_ip;
54287 +
54288 + /* check transition table */
54289 +
54290 + for (trans = current->role->transitions; trans; trans = trans->next) {
54291 + if (!strcmp(rolename, trans->rolename)) {
54292 + found = 1;
54293 + break;
54294 + }
54295 + }
54296 +
54297 + if (!found)
54298 + return 0;
54299 +
54300 + /* handle special roles that do not require authentication
54301 + and check ip */
54302 +
54303 + FOR_EACH_ROLE_START(r)
54304 + if (!strcmp(rolename, r->rolename) &&
54305 + (r->roletype & GR_ROLE_SPECIAL)) {
54306 + found = 0;
54307 + if (r->allowed_ips != NULL) {
54308 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
54309 + if ((ntohl(curr_ip) & ipp->netmask) ==
54310 + (ntohl(ipp->addr) & ipp->netmask))
54311 + found = 1;
54312 + }
54313 + } else
54314 + found = 2;
54315 + if (!found)
54316 + return 0;
54317 +
54318 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
54319 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
54320 + *salt = NULL;
54321 + *sum = NULL;
54322 + return 1;
54323 + }
54324 + }
54325 + FOR_EACH_ROLE_END(r)
54326 +
54327 + for (i = 0; i < num_sprole_pws; i++) {
54328 + if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
54329 + *salt = acl_special_roles[i]->salt;
54330 + *sum = acl_special_roles[i]->sum;
54331 + return 1;
54332 + }
54333 + }
54334 +
54335 + return 0;
54336 +}
54337 +
54338 +static void
54339 +assign_special_role(char *rolename)
54340 +{
54341 + struct acl_object_label *obj;
54342 + struct acl_role_label *r;
54343 + struct acl_role_label *assigned = NULL;
54344 + struct task_struct *tsk;
54345 + struct file *filp;
54346 +
54347 + FOR_EACH_ROLE_START(r)
54348 + if (!strcmp(rolename, r->rolename) &&
54349 + (r->roletype & GR_ROLE_SPECIAL)) {
54350 + assigned = r;
54351 + break;
54352 + }
54353 + FOR_EACH_ROLE_END(r)
54354 +
54355 + if (!assigned)
54356 + return;
54357 +
54358 + read_lock(&tasklist_lock);
54359 + read_lock(&grsec_exec_file_lock);
54360 +
54361 + tsk = current->real_parent;
54362 + if (tsk == NULL)
54363 + goto out_unlock;
54364 +
54365 + filp = tsk->exec_file;
54366 + if (filp == NULL)
54367 + goto out_unlock;
54368 +
54369 + tsk->is_writable = 0;
54370 +
54371 + tsk->acl_sp_role = 1;
54372 + tsk->acl_role_id = ++acl_sp_role_value;
54373 + tsk->role = assigned;
54374 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
54375 +
54376 + /* ignore additional mmap checks for processes that are writable
54377 + by the default ACL */
54378 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54379 + if (unlikely(obj->mode & GR_WRITE))
54380 + tsk->is_writable = 1;
54381 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
54382 + if (unlikely(obj->mode & GR_WRITE))
54383 + tsk->is_writable = 1;
54384 +
54385 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54386 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
54387 +#endif
54388 +
54389 +out_unlock:
54390 + read_unlock(&grsec_exec_file_lock);
54391 + read_unlock(&tasklist_lock);
54392 + return;
54393 +}
54394 +
54395 +int gr_check_secure_terminal(struct task_struct *task)
54396 +{
54397 + struct task_struct *p, *p2, *p3;
54398 + struct files_struct *files;
54399 + struct fdtable *fdt;
54400 + struct file *our_file = NULL, *file;
54401 + int i;
54402 +
54403 + if (task->signal->tty == NULL)
54404 + return 1;
54405 +
54406 + files = get_files_struct(task);
54407 + if (files != NULL) {
54408 + rcu_read_lock();
54409 + fdt = files_fdtable(files);
54410 + for (i=0; i < fdt->max_fds; i++) {
54411 + file = fcheck_files(files, i);
54412 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
54413 + get_file(file);
54414 + our_file = file;
54415 + }
54416 + }
54417 + rcu_read_unlock();
54418 + put_files_struct(files);
54419 + }
54420 +
54421 + if (our_file == NULL)
54422 + return 1;
54423 +
54424 + read_lock(&tasklist_lock);
54425 + do_each_thread(p2, p) {
54426 + files = get_files_struct(p);
54427 + if (files == NULL ||
54428 + (p->signal && p->signal->tty == task->signal->tty)) {
54429 + if (files != NULL)
54430 + put_files_struct(files);
54431 + continue;
54432 + }
54433 + rcu_read_lock();
54434 + fdt = files_fdtable(files);
54435 + for (i=0; i < fdt->max_fds; i++) {
54436 + file = fcheck_files(files, i);
54437 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
54438 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
54439 + p3 = task;
54440 + while (p3->pid > 0) {
54441 + if (p3 == p)
54442 + break;
54443 + p3 = p3->real_parent;
54444 + }
54445 + if (p3 == p)
54446 + break;
54447 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
54448 + gr_handle_alertkill(p);
54449 + rcu_read_unlock();
54450 + put_files_struct(files);
54451 + read_unlock(&tasklist_lock);
54452 + fput(our_file);
54453 + return 0;
54454 + }
54455 + }
54456 + rcu_read_unlock();
54457 + put_files_struct(files);
54458 + } while_each_thread(p2, p);
54459 + read_unlock(&tasklist_lock);
54460 +
54461 + fput(our_file);
54462 + return 1;
54463 +}
54464 +
54465 +ssize_t
54466 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
54467 +{
54468 + struct gr_arg_wrapper uwrap;
54469 + unsigned char *sprole_salt = NULL;
54470 + unsigned char *sprole_sum = NULL;
54471 + int error = sizeof (struct gr_arg_wrapper);
54472 + int error2 = 0;
54473 +
54474 + mutex_lock(&gr_dev_mutex);
54475 +
54476 + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
54477 + error = -EPERM;
54478 + goto out;
54479 + }
54480 +
54481 + if (count != sizeof (struct gr_arg_wrapper)) {
54482 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
54483 + error = -EINVAL;
54484 + goto out;
54485 + }
54486 +
54487 +
54488 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
54489 + gr_auth_expires = 0;
54490 + gr_auth_attempts = 0;
54491 + }
54492 +
54493 + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
54494 + error = -EFAULT;
54495 + goto out;
54496 + }
54497 +
54498 + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
54499 + error = -EINVAL;
54500 + goto out;
54501 + }
54502 +
54503 + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
54504 + error = -EFAULT;
54505 + goto out;
54506 + }
54507 +
54508 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54509 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54510 + time_after(gr_auth_expires, get_seconds())) {
54511 + error = -EBUSY;
54512 + goto out;
54513 + }
54514 +
54515 + /* if non-root trying to do anything other than use a special role,
54516 + do not attempt authentication, do not count towards authentication
54517 + locking
54518 + */
54519 +
54520 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
54521 + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54522 + current_uid()) {
54523 + error = -EPERM;
54524 + goto out;
54525 + }
54526 +
54527 + /* ensure pw and special role name are null terminated */
54528 +
54529 + gr_usermode->pw[GR_PW_LEN - 1] = '\0';
54530 + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
54531 +
54532 + /* Okay.
54533 + * We have our enough of the argument structure..(we have yet
54534 + * to copy_from_user the tables themselves) . Copy the tables
54535 + * only if we need them, i.e. for loading operations. */
54536 +
54537 + switch (gr_usermode->mode) {
54538 + case GR_STATUS:
54539 + if (gr_status & GR_READY) {
54540 + error = 1;
54541 + if (!gr_check_secure_terminal(current))
54542 + error = 3;
54543 + } else
54544 + error = 2;
54545 + goto out;
54546 + case GR_SHUTDOWN:
54547 + if ((gr_status & GR_READY)
54548 + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54549 + pax_open_kernel();
54550 + gr_status &= ~GR_READY;
54551 + pax_close_kernel();
54552 +
54553 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
54554 + free_variables();
54555 + memset(gr_usermode, 0, sizeof (struct gr_arg));
54556 + memset(gr_system_salt, 0, GR_SALT_LEN);
54557 + memset(gr_system_sum, 0, GR_SHA_LEN);
54558 + } else if (gr_status & GR_READY) {
54559 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
54560 + error = -EPERM;
54561 + } else {
54562 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
54563 + error = -EAGAIN;
54564 + }
54565 + break;
54566 + case GR_ENABLE:
54567 + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
54568 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
54569 + else {
54570 + if (gr_status & GR_READY)
54571 + error = -EAGAIN;
54572 + else
54573 + error = error2;
54574 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
54575 + }
54576 + break;
54577 + case GR_RELOAD:
54578 + if (!(gr_status & GR_READY)) {
54579 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
54580 + error = -EAGAIN;
54581 + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54582 + preempt_disable();
54583 +
54584 + pax_open_kernel();
54585 + gr_status &= ~GR_READY;
54586 + pax_close_kernel();
54587 +
54588 + free_variables();
54589 + if (!(error2 = gracl_init(gr_usermode))) {
54590 + preempt_enable();
54591 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
54592 + } else {
54593 + preempt_enable();
54594 + error = error2;
54595 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54596 + }
54597 + } else {
54598 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54599 + error = -EPERM;
54600 + }
54601 + break;
54602 + case GR_SEGVMOD:
54603 + if (unlikely(!(gr_status & GR_READY))) {
54604 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
54605 + error = -EAGAIN;
54606 + break;
54607 + }
54608 +
54609 + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54610 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
54611 + if (gr_usermode->segv_device && gr_usermode->segv_inode) {
54612 + struct acl_subject_label *segvacl;
54613 + segvacl =
54614 + lookup_acl_subj_label(gr_usermode->segv_inode,
54615 + gr_usermode->segv_device,
54616 + current->role);
54617 + if (segvacl) {
54618 + segvacl->crashes = 0;
54619 + segvacl->expires = 0;
54620 + }
54621 + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
54622 + gr_remove_uid(gr_usermode->segv_uid);
54623 + }
54624 + } else {
54625 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
54626 + error = -EPERM;
54627 + }
54628 + break;
54629 + case GR_SPROLE:
54630 + case GR_SPROLEPAM:
54631 + if (unlikely(!(gr_status & GR_READY))) {
54632 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
54633 + error = -EAGAIN;
54634 + break;
54635 + }
54636 +
54637 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
54638 + current->role->expires = 0;
54639 + current->role->auth_attempts = 0;
54640 + }
54641 +
54642 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54643 + time_after(current->role->expires, get_seconds())) {
54644 + error = -EBUSY;
54645 + goto out;
54646 + }
54647 +
54648 + if (lookup_special_role_auth
54649 + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
54650 + && ((!sprole_salt && !sprole_sum)
54651 + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
54652 + char *p = "";
54653 + assign_special_role(gr_usermode->sp_role);
54654 + read_lock(&tasklist_lock);
54655 + if (current->real_parent)
54656 + p = current->real_parent->role->rolename;
54657 + read_unlock(&tasklist_lock);
54658 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
54659 + p, acl_sp_role_value);
54660 + } else {
54661 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
54662 + error = -EPERM;
54663 + if(!(current->role->auth_attempts++))
54664 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54665 +
54666 + goto out;
54667 + }
54668 + break;
54669 + case GR_UNSPROLE:
54670 + if (unlikely(!(gr_status & GR_READY))) {
54671 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54672 + error = -EAGAIN;
54673 + break;
54674 + }
54675 +
54676 + if (current->role->roletype & GR_ROLE_SPECIAL) {
54677 + char *p = "";
54678 + int i = 0;
54679 +
54680 + read_lock(&tasklist_lock);
54681 + if (current->real_parent) {
54682 + p = current->real_parent->role->rolename;
54683 + i = current->real_parent->acl_role_id;
54684 + }
54685 + read_unlock(&tasklist_lock);
54686 +
54687 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54688 + gr_set_acls(1);
54689 + } else {
54690 + error = -EPERM;
54691 + goto out;
54692 + }
54693 + break;
54694 + default:
54695 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54696 + error = -EINVAL;
54697 + break;
54698 + }
54699 +
54700 + if (error != -EPERM)
54701 + goto out;
54702 +
54703 + if(!(gr_auth_attempts++))
54704 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54705 +
54706 + out:
54707 + mutex_unlock(&gr_dev_mutex);
54708 + return error;
54709 +}
54710 +
54711 +/* must be called with
54712 + rcu_read_lock();
54713 + read_lock(&tasklist_lock);
54714 + read_lock(&grsec_exec_file_lock);
54715 +*/
54716 +int gr_apply_subject_to_task(struct task_struct *task)
54717 +{
54718 + struct acl_object_label *obj;
54719 + char *tmpname;
54720 + struct acl_subject_label *tmpsubj;
54721 + struct file *filp;
54722 + struct name_entry *nmatch;
54723 +
54724 + filp = task->exec_file;
54725 + if (filp == NULL)
54726 + return 0;
54727 +
54728 + /* the following is to apply the correct subject
54729 + on binaries running when the RBAC system
54730 + is enabled, when the binaries have been
54731 + replaced or deleted since their execution
54732 + -----
54733 + when the RBAC system starts, the inode/dev
54734 + from exec_file will be one the RBAC system
54735 + is unaware of. It only knows the inode/dev
54736 + of the present file on disk, or the absence
54737 + of it.
54738 + */
54739 + preempt_disable();
54740 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54741 +
54742 + nmatch = lookup_name_entry(tmpname);
54743 + preempt_enable();
54744 + tmpsubj = NULL;
54745 + if (nmatch) {
54746 + if (nmatch->deleted)
54747 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54748 + else
54749 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54750 + if (tmpsubj != NULL)
54751 + task->acl = tmpsubj;
54752 + }
54753 + if (tmpsubj == NULL)
54754 + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54755 + task->role);
54756 + if (task->acl) {
54757 + struct acl_subject_label *curr;
54758 + curr = task->acl;
54759 +
54760 + task->is_writable = 0;
54761 + /* ignore additional mmap checks for processes that are writable
54762 + by the default ACL */
54763 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54764 + if (unlikely(obj->mode & GR_WRITE))
54765 + task->is_writable = 1;
54766 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54767 + if (unlikely(obj->mode & GR_WRITE))
54768 + task->is_writable = 1;
54769 +
54770 + gr_set_proc_res(task);
54771 +
54772 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54773 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54774 +#endif
54775 + } else {
54776 + return 1;
54777 + }
54778 +
54779 + return 0;
54780 +}
54781 +
54782 +int
54783 +gr_set_acls(const int type)
54784 +{
54785 + struct task_struct *task, *task2;
54786 + struct acl_role_label *role = current->role;
54787 + __u16 acl_role_id = current->acl_role_id;
54788 + const struct cred *cred;
54789 + int ret;
54790 +
54791 + rcu_read_lock();
54792 + read_lock(&tasklist_lock);
54793 + read_lock(&grsec_exec_file_lock);
54794 + do_each_thread(task2, task) {
54795 + /* check to see if we're called from the exit handler,
54796 + if so, only replace ACLs that have inherited the admin
54797 + ACL */
54798 +
54799 + if (type && (task->role != role ||
54800 + task->acl_role_id != acl_role_id))
54801 + continue;
54802 +
54803 + task->acl_role_id = 0;
54804 + task->acl_sp_role = 0;
54805 +
54806 + if (task->exec_file) {
54807 + cred = __task_cred(task);
54808 + task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54809 + ret = gr_apply_subject_to_task(task);
54810 + if (ret) {
54811 + read_unlock(&grsec_exec_file_lock);
54812 + read_unlock(&tasklist_lock);
54813 + rcu_read_unlock();
54814 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54815 + return ret;
54816 + }
54817 + } else {
54818 + // it's a kernel process
54819 + task->role = kernel_role;
54820 + task->acl = kernel_role->root_label;
54821 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54822 + task->acl->mode &= ~GR_PROCFIND;
54823 +#endif
54824 + }
54825 + } while_each_thread(task2, task);
54826 + read_unlock(&grsec_exec_file_lock);
54827 + read_unlock(&tasklist_lock);
54828 + rcu_read_unlock();
54829 +
54830 + return 0;
54831 +}
54832 +
54833 +void
54834 +gr_learn_resource(const struct task_struct *task,
54835 + const int res, const unsigned long wanted, const int gt)
54836 +{
54837 + struct acl_subject_label *acl;
54838 + const struct cred *cred;
54839 +
54840 + if (unlikely((gr_status & GR_READY) &&
54841 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54842 + goto skip_reslog;
54843 +
54844 +#ifdef CONFIG_GRKERNSEC_RESLOG
54845 + gr_log_resource(task, res, wanted, gt);
54846 +#endif
54847 + skip_reslog:
54848 +
54849 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54850 + return;
54851 +
54852 + acl = task->acl;
54853 +
54854 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54855 + !(acl->resmask & (1 << (unsigned short) res))))
54856 + return;
54857 +
54858 + if (wanted >= acl->res[res].rlim_cur) {
54859 + unsigned long res_add;
54860 +
54861 + res_add = wanted;
54862 + switch (res) {
54863 + case RLIMIT_CPU:
54864 + res_add += GR_RLIM_CPU_BUMP;
54865 + break;
54866 + case RLIMIT_FSIZE:
54867 + res_add += GR_RLIM_FSIZE_BUMP;
54868 + break;
54869 + case RLIMIT_DATA:
54870 + res_add += GR_RLIM_DATA_BUMP;
54871 + break;
54872 + case RLIMIT_STACK:
54873 + res_add += GR_RLIM_STACK_BUMP;
54874 + break;
54875 + case RLIMIT_CORE:
54876 + res_add += GR_RLIM_CORE_BUMP;
54877 + break;
54878 + case RLIMIT_RSS:
54879 + res_add += GR_RLIM_RSS_BUMP;
54880 + break;
54881 + case RLIMIT_NPROC:
54882 + res_add += GR_RLIM_NPROC_BUMP;
54883 + break;
54884 + case RLIMIT_NOFILE:
54885 + res_add += GR_RLIM_NOFILE_BUMP;
54886 + break;
54887 + case RLIMIT_MEMLOCK:
54888 + res_add += GR_RLIM_MEMLOCK_BUMP;
54889 + break;
54890 + case RLIMIT_AS:
54891 + res_add += GR_RLIM_AS_BUMP;
54892 + break;
54893 + case RLIMIT_LOCKS:
54894 + res_add += GR_RLIM_LOCKS_BUMP;
54895 + break;
54896 + case RLIMIT_SIGPENDING:
54897 + res_add += GR_RLIM_SIGPENDING_BUMP;
54898 + break;
54899 + case RLIMIT_MSGQUEUE:
54900 + res_add += GR_RLIM_MSGQUEUE_BUMP;
54901 + break;
54902 + case RLIMIT_NICE:
54903 + res_add += GR_RLIM_NICE_BUMP;
54904 + break;
54905 + case RLIMIT_RTPRIO:
54906 + res_add += GR_RLIM_RTPRIO_BUMP;
54907 + break;
54908 + case RLIMIT_RTTIME:
54909 + res_add += GR_RLIM_RTTIME_BUMP;
54910 + break;
54911 + }
54912 +
54913 + acl->res[res].rlim_cur = res_add;
54914 +
54915 + if (wanted > acl->res[res].rlim_max)
54916 + acl->res[res].rlim_max = res_add;
54917 +
54918 + /* only log the subject filename, since resource logging is supported for
54919 + single-subject learning only */
54920 + rcu_read_lock();
54921 + cred = __task_cred(task);
54922 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54923 + task->role->roletype, cred->uid, cred->gid, acl->filename,
54924 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54925 + "", (unsigned long) res, &task->signal->saved_ip);
54926 + rcu_read_unlock();
54927 + }
54928 +
54929 + return;
54930 +}
54931 +
54932 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54933 +void
54934 +pax_set_initial_flags(struct linux_binprm *bprm)
54935 +{
54936 + struct task_struct *task = current;
54937 + struct acl_subject_label *proc;
54938 + unsigned long flags;
54939 +
54940 + if (unlikely(!(gr_status & GR_READY)))
54941 + return;
54942 +
54943 + flags = pax_get_flags(task);
54944 +
54945 + proc = task->acl;
54946 +
54947 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54948 + flags &= ~MF_PAX_PAGEEXEC;
54949 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54950 + flags &= ~MF_PAX_SEGMEXEC;
54951 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54952 + flags &= ~MF_PAX_RANDMMAP;
54953 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54954 + flags &= ~MF_PAX_EMUTRAMP;
54955 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54956 + flags &= ~MF_PAX_MPROTECT;
54957 +
54958 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54959 + flags |= MF_PAX_PAGEEXEC;
54960 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54961 + flags |= MF_PAX_SEGMEXEC;
54962 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54963 + flags |= MF_PAX_RANDMMAP;
54964 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54965 + flags |= MF_PAX_EMUTRAMP;
54966 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54967 + flags |= MF_PAX_MPROTECT;
54968 +
54969 + pax_set_flags(task, flags);
54970 +
54971 + return;
54972 +}
54973 +#endif
54974 +
54975 +#ifdef CONFIG_SYSCTL
54976 +/* Eric Biederman likes breaking userland ABI and every inode-based security
54977 + system to save 35kb of memory */
54978 +
54979 +/* we modify the passed in filename, but adjust it back before returning */
54980 +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54981 +{
54982 + struct name_entry *nmatch;
54983 + char *p, *lastp = NULL;
54984 + struct acl_object_label *obj = NULL, *tmp;
54985 + struct acl_subject_label *tmpsubj;
54986 + char c = '\0';
54987 +
54988 + read_lock(&gr_inode_lock);
54989 +
54990 + p = name + len - 1;
54991 + do {
54992 + nmatch = lookup_name_entry(name);
54993 + if (lastp != NULL)
54994 + *lastp = c;
54995 +
54996 + if (nmatch == NULL)
54997 + goto next_component;
54998 + tmpsubj = current->acl;
54999 + do {
55000 + obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
55001 + if (obj != NULL) {
55002 + tmp = obj->globbed;
55003 + while (tmp) {
55004 + if (!glob_match(tmp->filename, name)) {
55005 + obj = tmp;
55006 + goto found_obj;
55007 + }
55008 + tmp = tmp->next;
55009 + }
55010 + goto found_obj;
55011 + }
55012 + } while ((tmpsubj = tmpsubj->parent_subject));
55013 +next_component:
55014 + /* end case */
55015 + if (p == name)
55016 + break;
55017 +
55018 + while (*p != '/')
55019 + p--;
55020 + if (p == name)
55021 + lastp = p + 1;
55022 + else {
55023 + lastp = p;
55024 + p--;
55025 + }
55026 + c = *lastp;
55027 + *lastp = '\0';
55028 + } while (1);
55029 +found_obj:
55030 + read_unlock(&gr_inode_lock);
55031 + /* obj returned will always be non-null */
55032 + return obj;
55033 +}
55034 +
55035 +/* returns 0 when allowing, non-zero on error
55036 + op of 0 is used for readdir, so we don't log the names of hidden files
55037 +*/
55038 +__u32
55039 +gr_handle_sysctl(const struct ctl_table *table, const int op)
55040 +{
55041 + struct ctl_table *tmp;
55042 + const char *proc_sys = "/proc/sys";
55043 + char *path;
55044 + struct acl_object_label *obj;
55045 + unsigned short len = 0, pos = 0, depth = 0, i;
55046 + __u32 err = 0;
55047 + __u32 mode = 0;
55048 +
55049 + if (unlikely(!(gr_status & GR_READY)))
55050 + return 0;
55051 +
55052 + /* for now, ignore operations on non-sysctl entries if it's not a
55053 + readdir*/
55054 + if (table->child != NULL && op != 0)
55055 + return 0;
55056 +
55057 + mode |= GR_FIND;
55058 + /* it's only a read if it's an entry, read on dirs is for readdir */
55059 + if (op & MAY_READ)
55060 + mode |= GR_READ;
55061 + if (op & MAY_WRITE)
55062 + mode |= GR_WRITE;
55063 +
55064 + preempt_disable();
55065 +
55066 + path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
55067 +
55068 + /* it's only a read/write if it's an actual entry, not a dir
55069 + (which are opened for readdir)
55070 + */
55071 +
55072 + /* convert the requested sysctl entry into a pathname */
55073 +
55074 + for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55075 + len += strlen(tmp->procname);
55076 + len++;
55077 + depth++;
55078 + }
55079 +
55080 + if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
55081 + /* deny */
55082 + goto out;
55083 + }
55084 +
55085 + memset(path, 0, PAGE_SIZE);
55086 +
55087 + memcpy(path, proc_sys, strlen(proc_sys));
55088 +
55089 + pos += strlen(proc_sys);
55090 +
55091 + for (; depth > 0; depth--) {
55092 + path[pos] = '/';
55093 + pos++;
55094 + for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55095 + if (depth == i) {
55096 + memcpy(path + pos, tmp->procname,
55097 + strlen(tmp->procname));
55098 + pos += strlen(tmp->procname);
55099 + }
55100 + i++;
55101 + }
55102 + }
55103 +
55104 + obj = gr_lookup_by_name(path, pos);
55105 + err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
55106 +
55107 + if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
55108 + ((err & mode) != mode))) {
55109 + __u32 new_mode = mode;
55110 +
55111 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
55112 +
55113 + err = 0;
55114 + gr_log_learn_sysctl(path, new_mode);
55115 + } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
55116 + gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
55117 + err = -ENOENT;
55118 + } else if (!(err & GR_FIND)) {
55119 + err = -ENOENT;
55120 + } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
55121 + gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
55122 + path, (mode & GR_READ) ? " reading" : "",
55123 + (mode & GR_WRITE) ? " writing" : "");
55124 + err = -EACCES;
55125 + } else if ((err & mode) != mode) {
55126 + err = -EACCES;
55127 + } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
55128 + gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
55129 + path, (mode & GR_READ) ? " reading" : "",
55130 + (mode & GR_WRITE) ? " writing" : "");
55131 + err = 0;
55132 + } else
55133 + err = 0;
55134 +
55135 + out:
55136 + preempt_enable();
55137 +
55138 + return err;
55139 +}
55140 +#endif
55141 +
55142 +int
55143 +gr_handle_proc_ptrace(struct task_struct *task)
55144 +{
55145 + struct file *filp;
55146 + struct task_struct *tmp = task;
55147 + struct task_struct *curtemp = current;
55148 + __u32 retmode;
55149 +
55150 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55151 + if (unlikely(!(gr_status & GR_READY)))
55152 + return 0;
55153 +#endif
55154 +
55155 + read_lock(&tasklist_lock);
55156 + read_lock(&grsec_exec_file_lock);
55157 + filp = task->exec_file;
55158 +
55159 + while (tmp->pid > 0) {
55160 + if (tmp == curtemp)
55161 + break;
55162 + tmp = tmp->real_parent;
55163 + }
55164 +
55165 + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55166 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
55167 + read_unlock(&grsec_exec_file_lock);
55168 + read_unlock(&tasklist_lock);
55169 + return 1;
55170 + }
55171 +
55172 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55173 + if (!(gr_status & GR_READY)) {
55174 + read_unlock(&grsec_exec_file_lock);
55175 + read_unlock(&tasklist_lock);
55176 + return 0;
55177 + }
55178 +#endif
55179 +
55180 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
55181 + read_unlock(&grsec_exec_file_lock);
55182 + read_unlock(&tasklist_lock);
55183 +
55184 + if (retmode & GR_NOPTRACE)
55185 + return 1;
55186 +
55187 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
55188 + && (current->acl != task->acl || (current->acl != current->role->root_label
55189 + && current->pid != task->pid)))
55190 + return 1;
55191 +
55192 + return 0;
55193 +}
55194 +
55195 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
55196 +{
55197 + if (unlikely(!(gr_status & GR_READY)))
55198 + return;
55199 +
55200 + if (!(current->role->roletype & GR_ROLE_GOD))
55201 + return;
55202 +
55203 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
55204 + p->role->rolename, gr_task_roletype_to_char(p),
55205 + p->acl->filename);
55206 +}
55207 +
55208 +int
55209 +gr_handle_ptrace(struct task_struct *task, const long request)
55210 +{
55211 + struct task_struct *tmp = task;
55212 + struct task_struct *curtemp = current;
55213 + __u32 retmode;
55214 +
55215 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55216 + if (unlikely(!(gr_status & GR_READY)))
55217 + return 0;
55218 +#endif
55219 +
55220 + read_lock(&tasklist_lock);
55221 + while (tmp->pid > 0) {
55222 + if (tmp == curtemp)
55223 + break;
55224 + tmp = tmp->real_parent;
55225 + }
55226 +
55227 + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55228 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
55229 + read_unlock(&tasklist_lock);
55230 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55231 + return 1;
55232 + }
55233 + read_unlock(&tasklist_lock);
55234 +
55235 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55236 + if (!(gr_status & GR_READY))
55237 + return 0;
55238 +#endif
55239 +
55240 + read_lock(&grsec_exec_file_lock);
55241 + if (unlikely(!task->exec_file)) {
55242 + read_unlock(&grsec_exec_file_lock);
55243 + return 0;
55244 + }
55245 +
55246 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
55247 + read_unlock(&grsec_exec_file_lock);
55248 +
55249 + if (retmode & GR_NOPTRACE) {
55250 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55251 + return 1;
55252 + }
55253 +
55254 + if (retmode & GR_PTRACERD) {
55255 + switch (request) {
55256 + case PTRACE_POKETEXT:
55257 + case PTRACE_POKEDATA:
55258 + case PTRACE_POKEUSR:
55259 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
55260 + case PTRACE_SETREGS:
55261 + case PTRACE_SETFPREGS:
55262 +#endif
55263 +#ifdef CONFIG_X86
55264 + case PTRACE_SETFPXREGS:
55265 +#endif
55266 +#ifdef CONFIG_ALTIVEC
55267 + case PTRACE_SETVRREGS:
55268 +#endif
55269 + return 1;
55270 + default:
55271 + return 0;
55272 + }
55273 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
55274 + !(current->role->roletype & GR_ROLE_GOD) &&
55275 + (current->acl != task->acl)) {
55276 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55277 + return 1;
55278 + }
55279 +
55280 + return 0;
55281 +}
55282 +
55283 +static int is_writable_mmap(const struct file *filp)
55284 +{
55285 + struct task_struct *task = current;
55286 + struct acl_object_label *obj, *obj2;
55287 +
55288 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
55289 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
55290 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55291 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
55292 + task->role->root_label);
55293 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
55294 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
55295 + return 1;
55296 + }
55297 + }
55298 + return 0;
55299 +}
55300 +
55301 +int
55302 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
55303 +{
55304 + __u32 mode;
55305 +
55306 + if (unlikely(!file || !(prot & PROT_EXEC)))
55307 + return 1;
55308 +
55309 + if (is_writable_mmap(file))
55310 + return 0;
55311 +
55312 + mode =
55313 + gr_search_file(file->f_path.dentry,
55314 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55315 + file->f_path.mnt);
55316 +
55317 + if (!gr_tpe_allow(file))
55318 + return 0;
55319 +
55320 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55321 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55322 + return 0;
55323 + } else if (unlikely(!(mode & GR_EXEC))) {
55324 + return 0;
55325 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55326 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55327 + return 1;
55328 + }
55329 +
55330 + return 1;
55331 +}
55332 +
55333 +int
55334 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55335 +{
55336 + __u32 mode;
55337 +
55338 + if (unlikely(!file || !(prot & PROT_EXEC)))
55339 + return 1;
55340 +
55341 + if (is_writable_mmap(file))
55342 + return 0;
55343 +
55344 + mode =
55345 + gr_search_file(file->f_path.dentry,
55346 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55347 + file->f_path.mnt);
55348 +
55349 + if (!gr_tpe_allow(file))
55350 + return 0;
55351 +
55352 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55353 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55354 + return 0;
55355 + } else if (unlikely(!(mode & GR_EXEC))) {
55356 + return 0;
55357 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55358 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55359 + return 1;
55360 + }
55361 +
55362 + return 1;
55363 +}
55364 +
55365 +void
55366 +gr_acl_handle_psacct(struct task_struct *task, const long code)
55367 +{
55368 + unsigned long runtime;
55369 + unsigned long cputime;
55370 + unsigned int wday, cday;
55371 + __u8 whr, chr;
55372 + __u8 wmin, cmin;
55373 + __u8 wsec, csec;
55374 + struct timespec timeval;
55375 +
55376 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
55377 + !(task->acl->mode & GR_PROCACCT)))
55378 + return;
55379 +
55380 + do_posix_clock_monotonic_gettime(&timeval);
55381 + runtime = timeval.tv_sec - task->start_time.tv_sec;
55382 + wday = runtime / (3600 * 24);
55383 + runtime -= wday * (3600 * 24);
55384 + whr = runtime / 3600;
55385 + runtime -= whr * 3600;
55386 + wmin = runtime / 60;
55387 + runtime -= wmin * 60;
55388 + wsec = runtime;
55389 +
55390 + cputime = (task->utime + task->stime) / HZ;
55391 + cday = cputime / (3600 * 24);
55392 + cputime -= cday * (3600 * 24);
55393 + chr = cputime / 3600;
55394 + cputime -= chr * 3600;
55395 + cmin = cputime / 60;
55396 + cputime -= cmin * 60;
55397 + csec = cputime;
55398 +
55399 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
55400 +
55401 + return;
55402 +}
55403 +
55404 +void gr_set_kernel_label(struct task_struct *task)
55405 +{
55406 + if (gr_status & GR_READY) {
55407 + task->role = kernel_role;
55408 + task->acl = kernel_role->root_label;
55409 + }
55410 + return;
55411 +}
55412 +
55413 +#ifdef CONFIG_TASKSTATS
55414 +int gr_is_taskstats_denied(int pid)
55415 +{
55416 + struct task_struct *task;
55417 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55418 + const struct cred *cred;
55419 +#endif
55420 + int ret = 0;
55421 +
55422 + /* restrict taskstats viewing to un-chrooted root users
55423 + who have the 'view' subject flag if the RBAC system is enabled
55424 + */
55425 +
55426 + rcu_read_lock();
55427 + read_lock(&tasklist_lock);
55428 + task = find_task_by_vpid(pid);
55429 + if (task) {
55430 +#ifdef CONFIG_GRKERNSEC_CHROOT
55431 + if (proc_is_chrooted(task))
55432 + ret = -EACCES;
55433 +#endif
55434 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55435 + cred = __task_cred(task);
55436 +#ifdef CONFIG_GRKERNSEC_PROC_USER
55437 + if (cred->uid != 0)
55438 + ret = -EACCES;
55439 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55440 + if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
55441 + ret = -EACCES;
55442 +#endif
55443 +#endif
55444 + if (gr_status & GR_READY) {
55445 + if (!(task->acl->mode & GR_VIEW))
55446 + ret = -EACCES;
55447 + }
55448 + } else
55449 + ret = -ENOENT;
55450 +
55451 + read_unlock(&tasklist_lock);
55452 + rcu_read_unlock();
55453 +
55454 + return ret;
55455 +}
55456 +#endif
55457 +
55458 +/* AUXV entries are filled via a descendant of search_binary_handler
55459 + after we've already applied the subject for the target
55460 +*/
55461 +int gr_acl_enable_at_secure(void)
55462 +{
55463 + if (unlikely(!(gr_status & GR_READY)))
55464 + return 0;
55465 +
55466 + if (current->acl->mode & GR_ATSECURE)
55467 + return 1;
55468 +
55469 + return 0;
55470 +}
55471 +
55472 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
55473 +{
55474 + struct task_struct *task = current;
55475 + struct dentry *dentry = file->f_path.dentry;
55476 + struct vfsmount *mnt = file->f_path.mnt;
55477 + struct acl_object_label *obj, *tmp;
55478 + struct acl_subject_label *subj;
55479 + unsigned int bufsize;
55480 + int is_not_root;
55481 + char *path;
55482 + dev_t dev = __get_dev(dentry);
55483 +
55484 + if (unlikely(!(gr_status & GR_READY)))
55485 + return 1;
55486 +
55487 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
55488 + return 1;
55489 +
55490 + /* ignore Eric Biederman */
55491 + if (IS_PRIVATE(dentry->d_inode))
55492 + return 1;
55493 +
55494 + subj = task->acl;
55495 + do {
55496 + obj = lookup_acl_obj_label(ino, dev, subj);
55497 + if (obj != NULL)
55498 + return (obj->mode & GR_FIND) ? 1 : 0;
55499 + } while ((subj = subj->parent_subject));
55500 +
55501 + /* this is purely an optimization since we're looking for an object
55502 + for the directory we're doing a readdir on
55503 + if it's possible for any globbed object to match the entry we're
55504 + filling into the directory, then the object we find here will be
55505 + an anchor point with attached globbed objects
55506 + */
55507 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
55508 + if (obj->globbed == NULL)
55509 + return (obj->mode & GR_FIND) ? 1 : 0;
55510 +
55511 + is_not_root = ((obj->filename[0] == '/') &&
55512 + (obj->filename[1] == '\0')) ? 0 : 1;
55513 + bufsize = PAGE_SIZE - namelen - is_not_root;
55514 +
55515 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
55516 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
55517 + return 1;
55518 +
55519 + preempt_disable();
55520 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
55521 + bufsize);
55522 +
55523 + bufsize = strlen(path);
55524 +
55525 + /* if base is "/", don't append an additional slash */
55526 + if (is_not_root)
55527 + *(path + bufsize) = '/';
55528 + memcpy(path + bufsize + is_not_root, name, namelen);
55529 + *(path + bufsize + namelen + is_not_root) = '\0';
55530 +
55531 + tmp = obj->globbed;
55532 + while (tmp) {
55533 + if (!glob_match(tmp->filename, path)) {
55534 + preempt_enable();
55535 + return (tmp->mode & GR_FIND) ? 1 : 0;
55536 + }
55537 + tmp = tmp->next;
55538 + }
55539 + preempt_enable();
55540 + return (obj->mode & GR_FIND) ? 1 : 0;
55541 +}
55542 +
55543 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
55544 +EXPORT_SYMBOL(gr_acl_is_enabled);
55545 +#endif
55546 +EXPORT_SYMBOL(gr_learn_resource);
55547 +EXPORT_SYMBOL(gr_set_kernel_label);
55548 +#ifdef CONFIG_SECURITY
55549 +EXPORT_SYMBOL(gr_check_user_change);
55550 +EXPORT_SYMBOL(gr_check_group_change);
55551 +#endif
55552 +
55553 diff -urNp linux-2.6.39.1/grsecurity/gracl_cap.c linux-2.6.39.1/grsecurity/gracl_cap.c
55554 --- linux-2.6.39.1/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
55555 +++ linux-2.6.39.1/grsecurity/gracl_cap.c 2011-05-22 19:41:42.000000000 -0400
55556 @@ -0,0 +1,139 @@
55557 +#include <linux/kernel.h>
55558 +#include <linux/module.h>
55559 +#include <linux/sched.h>
55560 +#include <linux/gracl.h>
55561 +#include <linux/grsecurity.h>
55562 +#include <linux/grinternal.h>
55563 +
55564 +static const char *captab_log[] = {
55565 + "CAP_CHOWN",
55566 + "CAP_DAC_OVERRIDE",
55567 + "CAP_DAC_READ_SEARCH",
55568 + "CAP_FOWNER",
55569 + "CAP_FSETID",
55570 + "CAP_KILL",
55571 + "CAP_SETGID",
55572 + "CAP_SETUID",
55573 + "CAP_SETPCAP",
55574 + "CAP_LINUX_IMMUTABLE",
55575 + "CAP_NET_BIND_SERVICE",
55576 + "CAP_NET_BROADCAST",
55577 + "CAP_NET_ADMIN",
55578 + "CAP_NET_RAW",
55579 + "CAP_IPC_LOCK",
55580 + "CAP_IPC_OWNER",
55581 + "CAP_SYS_MODULE",
55582 + "CAP_SYS_RAWIO",
55583 + "CAP_SYS_CHROOT",
55584 + "CAP_SYS_PTRACE",
55585 + "CAP_SYS_PACCT",
55586 + "CAP_SYS_ADMIN",
55587 + "CAP_SYS_BOOT",
55588 + "CAP_SYS_NICE",
55589 + "CAP_SYS_RESOURCE",
55590 + "CAP_SYS_TIME",
55591 + "CAP_SYS_TTY_CONFIG",
55592 + "CAP_MKNOD",
55593 + "CAP_LEASE",
55594 + "CAP_AUDIT_WRITE",
55595 + "CAP_AUDIT_CONTROL",
55596 + "CAP_SETFCAP",
55597 + "CAP_MAC_OVERRIDE",
55598 + "CAP_MAC_ADMIN",
55599 + "CAP_SYSLOG"
55600 +};
55601 +
55602 +EXPORT_SYMBOL(gr_is_capable);
55603 +EXPORT_SYMBOL(gr_is_capable_nolog);
55604 +
55605 +int
55606 +gr_is_capable(const int cap)
55607 +{
55608 + struct task_struct *task = current;
55609 + const struct cred *cred = current_cred();
55610 + struct acl_subject_label *curracl;
55611 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55612 + kernel_cap_t cap_audit = __cap_empty_set;
55613 +
55614 + if (!gr_acl_is_enabled())
55615 + return 1;
55616 +
55617 + curracl = task->acl;
55618 +
55619 + cap_drop = curracl->cap_lower;
55620 + cap_mask = curracl->cap_mask;
55621 + cap_audit = curracl->cap_invert_audit;
55622 +
55623 + while ((curracl = curracl->parent_subject)) {
55624 + /* if the cap isn't specified in the current computed mask but is specified in the
55625 + current level subject, and is lowered in the current level subject, then add
55626 + it to the set of dropped capabilities
55627 + otherwise, add the current level subject's mask to the current computed mask
55628 + */
55629 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55630 + cap_raise(cap_mask, cap);
55631 + if (cap_raised(curracl->cap_lower, cap))
55632 + cap_raise(cap_drop, cap);
55633 + if (cap_raised(curracl->cap_invert_audit, cap))
55634 + cap_raise(cap_audit, cap);
55635 + }
55636 + }
55637 +
55638 + if (!cap_raised(cap_drop, cap)) {
55639 + if (cap_raised(cap_audit, cap))
55640 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55641 + return 1;
55642 + }
55643 +
55644 + curracl = task->acl;
55645 +
55646 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55647 + && cap_raised(cred->cap_effective, cap)) {
55648 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55649 + task->role->roletype, cred->uid,
55650 + cred->gid, task->exec_file ?
55651 + gr_to_filename(task->exec_file->f_path.dentry,
55652 + task->exec_file->f_path.mnt) : curracl->filename,
55653 + curracl->filename, 0UL,
55654 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55655 + return 1;
55656 + }
55657 +
55658 + if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55659 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55660 + return 0;
55661 +}
55662 +
55663 +int
55664 +gr_is_capable_nolog(const int cap)
55665 +{
55666 + struct acl_subject_label *curracl;
55667 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55668 +
55669 + if (!gr_acl_is_enabled())
55670 + return 1;
55671 +
55672 + curracl = current->acl;
55673 +
55674 + cap_drop = curracl->cap_lower;
55675 + cap_mask = curracl->cap_mask;
55676 +
55677 + while ((curracl = curracl->parent_subject)) {
55678 + /* if the cap isn't specified in the current computed mask but is specified in the
55679 + current level subject, and is lowered in the current level subject, then add
55680 + it to the set of dropped capabilities
55681 + otherwise, add the current level subject's mask to the current computed mask
55682 + */
55683 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55684 + cap_raise(cap_mask, cap);
55685 + if (cap_raised(curracl->cap_lower, cap))
55686 + cap_raise(cap_drop, cap);
55687 + }
55688 + }
55689 +
55690 + if (!cap_raised(cap_drop, cap))
55691 + return 1;
55692 +
55693 + return 0;
55694 +}
55695 +
55696 diff -urNp linux-2.6.39.1/grsecurity/gracl_fs.c linux-2.6.39.1/grsecurity/gracl_fs.c
55697 --- linux-2.6.39.1/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
55698 +++ linux-2.6.39.1/grsecurity/gracl_fs.c 2011-05-22 19:41:42.000000000 -0400
55699 @@ -0,0 +1,431 @@
55700 +#include <linux/kernel.h>
55701 +#include <linux/sched.h>
55702 +#include <linux/types.h>
55703 +#include <linux/fs.h>
55704 +#include <linux/file.h>
55705 +#include <linux/stat.h>
55706 +#include <linux/grsecurity.h>
55707 +#include <linux/grinternal.h>
55708 +#include <linux/gracl.h>
55709 +
55710 +__u32
55711 +gr_acl_handle_hidden_file(const struct dentry * dentry,
55712 + const struct vfsmount * mnt)
55713 +{
55714 + __u32 mode;
55715 +
55716 + if (unlikely(!dentry->d_inode))
55717 + return GR_FIND;
55718 +
55719 + mode =
55720 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55721 +
55722 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55723 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55724 + return mode;
55725 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55726 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55727 + return 0;
55728 + } else if (unlikely(!(mode & GR_FIND)))
55729 + return 0;
55730 +
55731 + return GR_FIND;
55732 +}
55733 +
55734 +__u32
55735 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55736 + const int fmode)
55737 +{
55738 + __u32 reqmode = GR_FIND;
55739 + __u32 mode;
55740 +
55741 + if (unlikely(!dentry->d_inode))
55742 + return reqmode;
55743 +
55744 + if (unlikely(fmode & O_APPEND))
55745 + reqmode |= GR_APPEND;
55746 + else if (unlikely(fmode & FMODE_WRITE))
55747 + reqmode |= GR_WRITE;
55748 + if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55749 + reqmode |= GR_READ;
55750 + if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC))
55751 + reqmode &= ~GR_READ;
55752 + mode =
55753 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55754 + mnt);
55755 +
55756 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55757 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55758 + reqmode & GR_READ ? " reading" : "",
55759 + reqmode & GR_WRITE ? " writing" : reqmode &
55760 + GR_APPEND ? " appending" : "");
55761 + return reqmode;
55762 + } else
55763 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55764 + {
55765 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55766 + reqmode & GR_READ ? " reading" : "",
55767 + reqmode & GR_WRITE ? " writing" : reqmode &
55768 + GR_APPEND ? " appending" : "");
55769 + return 0;
55770 + } else if (unlikely((mode & reqmode) != reqmode))
55771 + return 0;
55772 +
55773 + return reqmode;
55774 +}
55775 +
55776 +__u32
55777 +gr_acl_handle_creat(const struct dentry * dentry,
55778 + const struct dentry * p_dentry,
55779 + const struct vfsmount * p_mnt, const int fmode,
55780 + const int imode)
55781 +{
55782 + __u32 reqmode = GR_WRITE | GR_CREATE;
55783 + __u32 mode;
55784 +
55785 + if (unlikely(fmode & O_APPEND))
55786 + reqmode |= GR_APPEND;
55787 + if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55788 + reqmode |= GR_READ;
55789 + if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
55790 + reqmode |= GR_SETID;
55791 +
55792 + mode =
55793 + gr_check_create(dentry, p_dentry, p_mnt,
55794 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55795 +
55796 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55797 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55798 + reqmode & GR_READ ? " reading" : "",
55799 + reqmode & GR_WRITE ? " writing" : reqmode &
55800 + GR_APPEND ? " appending" : "");
55801 + return reqmode;
55802 + } else
55803 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55804 + {
55805 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55806 + reqmode & GR_READ ? " reading" : "",
55807 + reqmode & GR_WRITE ? " writing" : reqmode &
55808 + GR_APPEND ? " appending" : "");
55809 + return 0;
55810 + } else if (unlikely((mode & reqmode) != reqmode))
55811 + return 0;
55812 +
55813 + return reqmode;
55814 +}
55815 +
55816 +__u32
55817 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55818 + const int fmode)
55819 +{
55820 + __u32 mode, reqmode = GR_FIND;
55821 +
55822 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55823 + reqmode |= GR_EXEC;
55824 + if (fmode & S_IWOTH)
55825 + reqmode |= GR_WRITE;
55826 + if (fmode & S_IROTH)
55827 + reqmode |= GR_READ;
55828 +
55829 + mode =
55830 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55831 + mnt);
55832 +
55833 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55834 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55835 + reqmode & GR_READ ? " reading" : "",
55836 + reqmode & GR_WRITE ? " writing" : "",
55837 + reqmode & GR_EXEC ? " executing" : "");
55838 + return reqmode;
55839 + } else
55840 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55841 + {
55842 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55843 + reqmode & GR_READ ? " reading" : "",
55844 + reqmode & GR_WRITE ? " writing" : "",
55845 + reqmode & GR_EXEC ? " executing" : "");
55846 + return 0;
55847 + } else if (unlikely((mode & reqmode) != reqmode))
55848 + return 0;
55849 +
55850 + return reqmode;
55851 +}
55852 +
55853 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55854 +{
55855 + __u32 mode;
55856 +
55857 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55858 +
55859 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55860 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55861 + return mode;
55862 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55863 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55864 + return 0;
55865 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
55866 + return 0;
55867 +
55868 + return (reqmode);
55869 +}
55870 +
55871 +__u32
55872 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55873 +{
55874 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55875 +}
55876 +
55877 +__u32
55878 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55879 +{
55880 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55881 +}
55882 +
55883 +__u32
55884 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55885 +{
55886 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55887 +}
55888 +
55889 +__u32
55890 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55891 +{
55892 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55893 +}
55894 +
55895 +__u32
55896 +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55897 + mode_t mode)
55898 +{
55899 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55900 + return 1;
55901 +
55902 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55903 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55904 + GR_FCHMOD_ACL_MSG);
55905 + } else {
55906 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55907 + }
55908 +}
55909 +
55910 +__u32
55911 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55912 + mode_t mode)
55913 +{
55914 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55915 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55916 + GR_CHMOD_ACL_MSG);
55917 + } else {
55918 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55919 + }
55920 +}
55921 +
55922 +__u32
55923 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55924 +{
55925 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55926 +}
55927 +
55928 +__u32
55929 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55930 +{
55931 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55932 +}
55933 +
55934 +__u32
55935 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55936 +{
55937 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55938 +}
55939 +
55940 +__u32
55941 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55942 +{
55943 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55944 + GR_UNIXCONNECT_ACL_MSG);
55945 +}
55946 +
55947 +/* hardlinks require at minimum create permission,
55948 + any additional privilege required is based on the
55949 + privilege of the file being linked to
55950 +*/
55951 +__u32
55952 +gr_acl_handle_link(const struct dentry * new_dentry,
55953 + const struct dentry * parent_dentry,
55954 + const struct vfsmount * parent_mnt,
55955 + const struct dentry * old_dentry,
55956 + const struct vfsmount * old_mnt, const char *to)
55957 +{
55958 + __u32 mode;
55959 + __u32 needmode = GR_CREATE | GR_LINK;
55960 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55961 +
55962 + mode =
55963 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55964 + old_mnt);
55965 +
55966 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55967 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55968 + return mode;
55969 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55970 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55971 + return 0;
55972 + } else if (unlikely((mode & needmode) != needmode))
55973 + return 0;
55974 +
55975 + return 1;
55976 +}
55977 +
55978 +__u32
55979 +gr_acl_handle_symlink(const struct dentry * new_dentry,
55980 + const struct dentry * parent_dentry,
55981 + const struct vfsmount * parent_mnt, const char *from)
55982 +{
55983 + __u32 needmode = GR_WRITE | GR_CREATE;
55984 + __u32 mode;
55985 +
55986 + mode =
55987 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
55988 + GR_CREATE | GR_AUDIT_CREATE |
55989 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55990 +
55991 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55992 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55993 + return mode;
55994 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55995 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55996 + return 0;
55997 + } else if (unlikely((mode & needmode) != needmode))
55998 + return 0;
55999 +
56000 + return (GR_WRITE | GR_CREATE);
56001 +}
56002 +
56003 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
56004 +{
56005 + __u32 mode;
56006 +
56007 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
56008 +
56009 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
56010 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
56011 + return mode;
56012 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
56013 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
56014 + return 0;
56015 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
56016 + return 0;
56017 +
56018 + return (reqmode);
56019 +}
56020 +
56021 +__u32
56022 +gr_acl_handle_mknod(const struct dentry * new_dentry,
56023 + const struct dentry * parent_dentry,
56024 + const struct vfsmount * parent_mnt,
56025 + const int mode)
56026 +{
56027 + __u32 reqmode = GR_WRITE | GR_CREATE;
56028 + if (unlikely(mode & (S_ISUID | S_ISGID)))
56029 + reqmode |= GR_SETID;
56030 +
56031 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56032 + reqmode, GR_MKNOD_ACL_MSG);
56033 +}
56034 +
56035 +__u32
56036 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
56037 + const struct dentry *parent_dentry,
56038 + const struct vfsmount *parent_mnt)
56039 +{
56040 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56041 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
56042 +}
56043 +
56044 +#define RENAME_CHECK_SUCCESS(old, new) \
56045 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
56046 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
56047 +
56048 +int
56049 +gr_acl_handle_rename(struct dentry *new_dentry,
56050 + struct dentry *parent_dentry,
56051 + const struct vfsmount *parent_mnt,
56052 + struct dentry *old_dentry,
56053 + struct inode *old_parent_inode,
56054 + struct vfsmount *old_mnt, const char *newname)
56055 +{
56056 + __u32 comp1, comp2;
56057 + int error = 0;
56058 +
56059 + if (unlikely(!gr_acl_is_enabled()))
56060 + return 0;
56061 +
56062 + if (!new_dentry->d_inode) {
56063 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
56064 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
56065 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
56066 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
56067 + GR_DELETE | GR_AUDIT_DELETE |
56068 + GR_AUDIT_READ | GR_AUDIT_WRITE |
56069 + GR_SUPPRESS, old_mnt);
56070 + } else {
56071 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
56072 + GR_CREATE | GR_DELETE |
56073 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
56074 + GR_AUDIT_READ | GR_AUDIT_WRITE |
56075 + GR_SUPPRESS, parent_mnt);
56076 + comp2 =
56077 + gr_search_file(old_dentry,
56078 + GR_READ | GR_WRITE | GR_AUDIT_READ |
56079 + GR_DELETE | GR_AUDIT_DELETE |
56080 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
56081 + }
56082 +
56083 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
56084 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
56085 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56086 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
56087 + && !(comp2 & GR_SUPPRESS)) {
56088 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56089 + error = -EACCES;
56090 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
56091 + error = -EACCES;
56092 +
56093 + return error;
56094 +}
56095 +
56096 +void
56097 +gr_acl_handle_exit(void)
56098 +{
56099 + u16 id;
56100 + char *rolename;
56101 + struct file *exec_file;
56102 +
56103 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
56104 + !(current->role->roletype & GR_ROLE_PERSIST))) {
56105 + id = current->acl_role_id;
56106 + rolename = current->role->rolename;
56107 + gr_set_acls(1);
56108 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
56109 + }
56110 +
56111 + write_lock(&grsec_exec_file_lock);
56112 + exec_file = current->exec_file;
56113 + current->exec_file = NULL;
56114 + write_unlock(&grsec_exec_file_lock);
56115 +
56116 + if (exec_file)
56117 + fput(exec_file);
56118 +}
56119 +
56120 +int
56121 +gr_acl_handle_procpidmem(const struct task_struct *task)
56122 +{
56123 + if (unlikely(!gr_acl_is_enabled()))
56124 + return 0;
56125 +
56126 + if (task != current && task->acl->mode & GR_PROTPROCFD)
56127 + return -EACCES;
56128 +
56129 + return 0;
56130 +}
56131 diff -urNp linux-2.6.39.1/grsecurity/gracl_ip.c linux-2.6.39.1/grsecurity/gracl_ip.c
56132 --- linux-2.6.39.1/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
56133 +++ linux-2.6.39.1/grsecurity/gracl_ip.c 2011-05-22 22:47:31.000000000 -0400
56134 @@ -0,0 +1,381 @@
56135 +#include <linux/kernel.h>
56136 +#include <asm/uaccess.h>
56137 +#include <asm/errno.h>
56138 +#include <net/sock.h>
56139 +#include <linux/file.h>
56140 +#include <linux/fs.h>
56141 +#include <linux/net.h>
56142 +#include <linux/in.h>
56143 +#include <linux/skbuff.h>
56144 +#include <linux/ip.h>
56145 +#include <linux/udp.h>
56146 +#include <linux/types.h>
56147 +#include <linux/sched.h>
56148 +#include <linux/netdevice.h>
56149 +#include <linux/inetdevice.h>
56150 +#include <linux/gracl.h>
56151 +#include <linux/grsecurity.h>
56152 +#include <linux/grinternal.h>
56153 +
56154 +#define GR_BIND 0x01
56155 +#define GR_CONNECT 0x02
56156 +#define GR_INVERT 0x04
56157 +#define GR_BINDOVERRIDE 0x08
56158 +#define GR_CONNECTOVERRIDE 0x10
56159 +#define GR_SOCK_FAMILY 0x20
56160 +
56161 +static const char * gr_protocols[IPPROTO_MAX] = {
56162 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
56163 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
56164 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
56165 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
56166 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
56167 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
56168 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
56169 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
56170 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
56171 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
56172 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
56173 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
56174 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
56175 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
56176 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
56177 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
56178 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
56179 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
56180 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
56181 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
56182 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
56183 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
56184 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
56185 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
56186 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
56187 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
56188 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
56189 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
56190 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
56191 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
56192 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
56193 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
56194 + };
56195 +
56196 +static const char * gr_socktypes[SOCK_MAX] = {
56197 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
56198 + "unknown:7", "unknown:8", "unknown:9", "packet"
56199 + };
56200 +
56201 +static const char * gr_sockfamilies[AF_MAX+1] = {
56202 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
56203 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
56204 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
56205 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
56206 + };
56207 +
56208 +const char *
56209 +gr_proto_to_name(unsigned char proto)
56210 +{
56211 + return gr_protocols[proto];
56212 +}
56213 +
56214 +const char *
56215 +gr_socktype_to_name(unsigned char type)
56216 +{
56217 + return gr_socktypes[type];
56218 +}
56219 +
56220 +const char *
56221 +gr_sockfamily_to_name(unsigned char family)
56222 +{
56223 + return gr_sockfamilies[family];
56224 +}
56225 +
56226 +int
56227 +gr_search_socket(const int domain, const int type, const int protocol)
56228 +{
56229 + struct acl_subject_label *curr;
56230 + const struct cred *cred = current_cred();
56231 +
56232 + if (unlikely(!gr_acl_is_enabled()))
56233 + goto exit;
56234 +
56235 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
56236 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
56237 + goto exit; // let the kernel handle it
56238 +
56239 + curr = current->acl;
56240 +
56241 + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
56242 + /* the family is allowed, if this is PF_INET allow it only if
56243 + the extra sock type/protocol checks pass */
56244 + if (domain == PF_INET)
56245 + goto inet_check;
56246 + goto exit;
56247 + } else {
56248 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56249 + __u32 fakeip = 0;
56250 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56251 + current->role->roletype, cred->uid,
56252 + cred->gid, current->exec_file ?
56253 + gr_to_filename(current->exec_file->f_path.dentry,
56254 + current->exec_file->f_path.mnt) :
56255 + curr->filename, curr->filename,
56256 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
56257 + &current->signal->saved_ip);
56258 + goto exit;
56259 + }
56260 + goto exit_fail;
56261 + }
56262 +
56263 +inet_check:
56264 + /* the rest of this checking is for IPv4 only */
56265 + if (!curr->ips)
56266 + goto exit;
56267 +
56268 + if ((curr->ip_type & (1 << type)) &&
56269 + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
56270 + goto exit;
56271 +
56272 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56273 + /* we don't place acls on raw sockets , and sometimes
56274 + dgram/ip sockets are opened for ioctl and not
56275 + bind/connect, so we'll fake a bind learn log */
56276 + if (type == SOCK_RAW || type == SOCK_PACKET) {
56277 + __u32 fakeip = 0;
56278 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56279 + current->role->roletype, cred->uid,
56280 + cred->gid, current->exec_file ?
56281 + gr_to_filename(current->exec_file->f_path.dentry,
56282 + current->exec_file->f_path.mnt) :
56283 + curr->filename, curr->filename,
56284 + &fakeip, 0, type,
56285 + protocol, GR_CONNECT, &current->signal->saved_ip);
56286 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
56287 + __u32 fakeip = 0;
56288 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56289 + current->role->roletype, cred->uid,
56290 + cred->gid, current->exec_file ?
56291 + gr_to_filename(current->exec_file->f_path.dentry,
56292 + current->exec_file->f_path.mnt) :
56293 + curr->filename, curr->filename,
56294 + &fakeip, 0, type,
56295 + protocol, GR_BIND, &current->signal->saved_ip);
56296 + }
56297 + /* we'll log when they use connect or bind */
56298 + goto exit;
56299 + }
56300 +
56301 +exit_fail:
56302 + if (domain == PF_INET)
56303 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
56304 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
56305 + else
56306 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
56307 + gr_socktype_to_name(type), protocol);
56308 +
56309 + return 0;
56310 +exit:
56311 + return 1;
56312 +}
56313 +
56314 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
56315 +{
56316 + if ((ip->mode & mode) &&
56317 + (ip_port >= ip->low) &&
56318 + (ip_port <= ip->high) &&
56319 + ((ntohl(ip_addr) & our_netmask) ==
56320 + (ntohl(our_addr) & our_netmask))
56321 + && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
56322 + && (ip->type & (1 << type))) {
56323 + if (ip->mode & GR_INVERT)
56324 + return 2; // specifically denied
56325 + else
56326 + return 1; // allowed
56327 + }
56328 +
56329 + return 0; // not specifically allowed, may continue parsing
56330 +}
56331 +
56332 +static int
56333 +gr_search_connectbind(const int full_mode, struct sock *sk,
56334 + struct sockaddr_in *addr, const int type)
56335 +{
56336 + char iface[IFNAMSIZ] = {0};
56337 + struct acl_subject_label *curr;
56338 + struct acl_ip_label *ip;
56339 + struct inet_sock *isk;
56340 + struct net_device *dev;
56341 + struct in_device *idev;
56342 + unsigned long i;
56343 + int ret;
56344 + int mode = full_mode & (GR_BIND | GR_CONNECT);
56345 + __u32 ip_addr = 0;
56346 + __u32 our_addr;
56347 + __u32 our_netmask;
56348 + char *p;
56349 + __u16 ip_port = 0;
56350 + const struct cred *cred = current_cred();
56351 +
56352 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
56353 + return 0;
56354 +
56355 + curr = current->acl;
56356 + isk = inet_sk(sk);
56357 +
56358 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
56359 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
56360 + addr->sin_addr.s_addr = curr->inaddr_any_override;
56361 + if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
56362 + struct sockaddr_in saddr;
56363 + int err;
56364 +
56365 + saddr.sin_family = AF_INET;
56366 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
56367 + saddr.sin_port = isk->inet_sport;
56368 +
56369 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56370 + if (err)
56371 + return err;
56372 +
56373 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56374 + if (err)
56375 + return err;
56376 + }
56377 +
56378 + if (!curr->ips)
56379 + return 0;
56380 +
56381 + ip_addr = addr->sin_addr.s_addr;
56382 + ip_port = ntohs(addr->sin_port);
56383 +
56384 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56385 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56386 + current->role->roletype, cred->uid,
56387 + cred->gid, current->exec_file ?
56388 + gr_to_filename(current->exec_file->f_path.dentry,
56389 + current->exec_file->f_path.mnt) :
56390 + curr->filename, curr->filename,
56391 + &ip_addr, ip_port, type,
56392 + sk->sk_protocol, mode, &current->signal->saved_ip);
56393 + return 0;
56394 + }
56395 +
56396 + for (i = 0; i < curr->ip_num; i++) {
56397 + ip = *(curr->ips + i);
56398 + if (ip->iface != NULL) {
56399 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
56400 + p = strchr(iface, ':');
56401 + if (p != NULL)
56402 + *p = '\0';
56403 + dev = dev_get_by_name(sock_net(sk), iface);
56404 + if (dev == NULL)
56405 + continue;
56406 + idev = in_dev_get(dev);
56407 + if (idev == NULL) {
56408 + dev_put(dev);
56409 + continue;
56410 + }
56411 + rcu_read_lock();
56412 + for_ifa(idev) {
56413 + if (!strcmp(ip->iface, ifa->ifa_label)) {
56414 + our_addr = ifa->ifa_address;
56415 + our_netmask = 0xffffffff;
56416 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56417 + if (ret == 1) {
56418 + rcu_read_unlock();
56419 + in_dev_put(idev);
56420 + dev_put(dev);
56421 + return 0;
56422 + } else if (ret == 2) {
56423 + rcu_read_unlock();
56424 + in_dev_put(idev);
56425 + dev_put(dev);
56426 + goto denied;
56427 + }
56428 + }
56429 + } endfor_ifa(idev);
56430 + rcu_read_unlock();
56431 + in_dev_put(idev);
56432 + dev_put(dev);
56433 + } else {
56434 + our_addr = ip->addr;
56435 + our_netmask = ip->netmask;
56436 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56437 + if (ret == 1)
56438 + return 0;
56439 + else if (ret == 2)
56440 + goto denied;
56441 + }
56442 + }
56443 +
56444 +denied:
56445 + if (mode == GR_BIND)
56446 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56447 + else if (mode == GR_CONNECT)
56448 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56449 +
56450 + return -EACCES;
56451 +}
56452 +
56453 +int
56454 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
56455 +{
56456 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
56457 +}
56458 +
56459 +int
56460 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
56461 +{
56462 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
56463 +}
56464 +
56465 +int gr_search_listen(struct socket *sock)
56466 +{
56467 + struct sock *sk = sock->sk;
56468 + struct sockaddr_in addr;
56469 +
56470 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56471 + addr.sin_port = inet_sk(sk)->inet_sport;
56472 +
56473 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56474 +}
56475 +
56476 +int gr_search_accept(struct socket *sock)
56477 +{
56478 + struct sock *sk = sock->sk;
56479 + struct sockaddr_in addr;
56480 +
56481 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56482 + addr.sin_port = inet_sk(sk)->inet_sport;
56483 +
56484 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56485 +}
56486 +
56487 +int
56488 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
56489 +{
56490 + if (addr)
56491 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
56492 + else {
56493 + struct sockaddr_in sin;
56494 + const struct inet_sock *inet = inet_sk(sk);
56495 +
56496 + sin.sin_addr.s_addr = inet->inet_daddr;
56497 + sin.sin_port = inet->inet_dport;
56498 +
56499 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56500 + }
56501 +}
56502 +
56503 +int
56504 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
56505 +{
56506 + struct sockaddr_in sin;
56507 +
56508 + if (unlikely(skb->len < sizeof (struct udphdr)))
56509 + return 0; // skip this packet
56510 +
56511 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
56512 + sin.sin_port = udp_hdr(skb)->source;
56513 +
56514 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56515 +}
56516 diff -urNp linux-2.6.39.1/grsecurity/gracl_learn.c linux-2.6.39.1/grsecurity/gracl_learn.c
56517 --- linux-2.6.39.1/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
56518 +++ linux-2.6.39.1/grsecurity/gracl_learn.c 2011-05-22 22:47:45.000000000 -0400
56519 @@ -0,0 +1,210 @@
56520 +#include <linux/kernel.h>
56521 +#include <linux/mm.h>
56522 +#include <linux/sched.h>
56523 +#include <linux/poll.h>
56524 +#include <linux/string.h>
56525 +#include <linux/file.h>
56526 +#include <linux/types.h>
56527 +#include <linux/vmalloc.h>
56528 +#include <linux/grinternal.h>
56529 +
56530 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
56531 + size_t count, loff_t *ppos);
56532 +extern int gr_acl_is_enabled(void);
56533 +
56534 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
56535 +static int gr_learn_attached;
56536 +
56537 +/* use a 512k buffer */
56538 +#define LEARN_BUFFER_SIZE (512 * 1024)
56539 +
56540 +static DEFINE_SPINLOCK(gr_learn_lock);
56541 +static DEFINE_MUTEX(gr_learn_user_mutex);
56542 +
56543 +/* we need to maintain two buffers, so that the kernel context of grlearn
56544 + uses a semaphore around the userspace copying, and the other kernel contexts
56545 + use a spinlock when copying into the buffer, since they cannot sleep
56546 +*/
56547 +static char *learn_buffer;
56548 +static char *learn_buffer_user;
56549 +static int learn_buffer_len;
56550 +static int learn_buffer_user_len;
56551 +
56552 +static ssize_t
56553 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
56554 +{
56555 + DECLARE_WAITQUEUE(wait, current);
56556 + ssize_t retval = 0;
56557 +
56558 + add_wait_queue(&learn_wait, &wait);
56559 + set_current_state(TASK_INTERRUPTIBLE);
56560 + do {
56561 + mutex_lock(&gr_learn_user_mutex);
56562 + spin_lock(&gr_learn_lock);
56563 + if (learn_buffer_len)
56564 + break;
56565 + spin_unlock(&gr_learn_lock);
56566 + mutex_unlock(&gr_learn_user_mutex);
56567 + if (file->f_flags & O_NONBLOCK) {
56568 + retval = -EAGAIN;
56569 + goto out;
56570 + }
56571 + if (signal_pending(current)) {
56572 + retval = -ERESTARTSYS;
56573 + goto out;
56574 + }
56575 +
56576 + schedule();
56577 + } while (1);
56578 +
56579 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
56580 + learn_buffer_user_len = learn_buffer_len;
56581 + retval = learn_buffer_len;
56582 + learn_buffer_len = 0;
56583 +
56584 + spin_unlock(&gr_learn_lock);
56585 +
56586 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
56587 + retval = -EFAULT;
56588 +
56589 + mutex_unlock(&gr_learn_user_mutex);
56590 +out:
56591 + set_current_state(TASK_RUNNING);
56592 + remove_wait_queue(&learn_wait, &wait);
56593 + return retval;
56594 +}
56595 +
56596 +static unsigned int
56597 +poll_learn(struct file * file, poll_table * wait)
56598 +{
56599 + poll_wait(file, &learn_wait, wait);
56600 +
56601 + if (learn_buffer_len)
56602 + return (POLLIN | POLLRDNORM);
56603 +
56604 + return 0;
56605 +}
56606 +
56607 +void
56608 +gr_clear_learn_entries(void)
56609 +{
56610 + char *tmp;
56611 +
56612 + mutex_lock(&gr_learn_user_mutex);
56613 + if (learn_buffer != NULL) {
56614 + spin_lock(&gr_learn_lock);
56615 + tmp = learn_buffer;
56616 + learn_buffer = NULL;
56617 + spin_unlock(&gr_learn_lock);
56618 + vfree(learn_buffer);
56619 + }
56620 + if (learn_buffer_user != NULL) {
56621 + vfree(learn_buffer_user);
56622 + learn_buffer_user = NULL;
56623 + }
56624 + learn_buffer_len = 0;
56625 + mutex_unlock(&gr_learn_user_mutex);
56626 +
56627 + return;
56628 +}
56629 +
56630 +void
56631 +gr_add_learn_entry(const char *fmt, ...)
56632 +{
56633 + va_list args;
56634 + unsigned int len;
56635 +
56636 + if (!gr_learn_attached)
56637 + return;
56638 +
56639 + spin_lock(&gr_learn_lock);
56640 +
56641 + /* leave a gap at the end so we know when it's "full" but don't have to
56642 + compute the exact length of the string we're trying to append
56643 + */
56644 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56645 + spin_unlock(&gr_learn_lock);
56646 + wake_up_interruptible(&learn_wait);
56647 + return;
56648 + }
56649 + if (learn_buffer == NULL) {
56650 + spin_unlock(&gr_learn_lock);
56651 + return;
56652 + }
56653 +
56654 + va_start(args, fmt);
56655 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56656 + va_end(args);
56657 +
56658 + learn_buffer_len += len + 1;
56659 +
56660 + spin_unlock(&gr_learn_lock);
56661 + wake_up_interruptible(&learn_wait);
56662 +
56663 + return;
56664 +}
56665 +
56666 +static int
56667 +open_learn(struct inode *inode, struct file *file)
56668 +{
56669 + if (file->f_mode & FMODE_READ && gr_learn_attached)
56670 + return -EBUSY;
56671 + if (file->f_mode & FMODE_READ) {
56672 + int retval = 0;
56673 + mutex_lock(&gr_learn_user_mutex);
56674 + if (learn_buffer == NULL)
56675 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56676 + if (learn_buffer_user == NULL)
56677 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56678 + if (learn_buffer == NULL) {
56679 + retval = -ENOMEM;
56680 + goto out_error;
56681 + }
56682 + if (learn_buffer_user == NULL) {
56683 + retval = -ENOMEM;
56684 + goto out_error;
56685 + }
56686 + learn_buffer_len = 0;
56687 + learn_buffer_user_len = 0;
56688 + gr_learn_attached = 1;
56689 +out_error:
56690 + mutex_unlock(&gr_learn_user_mutex);
56691 + return retval;
56692 + }
56693 + return 0;
56694 +}
56695 +
56696 +static int
56697 +close_learn(struct inode *inode, struct file *file)
56698 +{
56699 + char *tmp;
56700 +
56701 + if (file->f_mode & FMODE_READ) {
56702 + mutex_lock(&gr_learn_user_mutex);
56703 + if (learn_buffer != NULL) {
56704 + spin_lock(&gr_learn_lock);
56705 + tmp = learn_buffer;
56706 + learn_buffer = NULL;
56707 + spin_unlock(&gr_learn_lock);
56708 + vfree(tmp);
56709 + }
56710 + if (learn_buffer_user != NULL) {
56711 + vfree(learn_buffer_user);
56712 + learn_buffer_user = NULL;
56713 + }
56714 + learn_buffer_len = 0;
56715 + learn_buffer_user_len = 0;
56716 + gr_learn_attached = 0;
56717 + mutex_unlock(&gr_learn_user_mutex);
56718 + }
56719 +
56720 + return 0;
56721 +}
56722 +
56723 +const struct file_operations grsec_fops = {
56724 + .read = read_learn,
56725 + .write = write_grsec_handler,
56726 + .open = open_learn,
56727 + .release = close_learn,
56728 + .poll = poll_learn,
56729 +};
56730 diff -urNp linux-2.6.39.1/grsecurity/gracl_res.c linux-2.6.39.1/grsecurity/gracl_res.c
56731 --- linux-2.6.39.1/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
56732 +++ linux-2.6.39.1/grsecurity/gracl_res.c 2011-05-22 19:41:42.000000000 -0400
56733 @@ -0,0 +1,68 @@
56734 +#include <linux/kernel.h>
56735 +#include <linux/sched.h>
56736 +#include <linux/gracl.h>
56737 +#include <linux/grinternal.h>
56738 +
56739 +static const char *restab_log[] = {
56740 + [RLIMIT_CPU] = "RLIMIT_CPU",
56741 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56742 + [RLIMIT_DATA] = "RLIMIT_DATA",
56743 + [RLIMIT_STACK] = "RLIMIT_STACK",
56744 + [RLIMIT_CORE] = "RLIMIT_CORE",
56745 + [RLIMIT_RSS] = "RLIMIT_RSS",
56746 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
56747 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56748 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56749 + [RLIMIT_AS] = "RLIMIT_AS",
56750 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56751 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56752 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56753 + [RLIMIT_NICE] = "RLIMIT_NICE",
56754 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56755 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56756 + [GR_CRASH_RES] = "RLIMIT_CRASH"
56757 +};
56758 +
56759 +void
56760 +gr_log_resource(const struct task_struct *task,
56761 + const int res, const unsigned long wanted, const int gt)
56762 +{
56763 + const struct cred *cred;
56764 + unsigned long rlim;
56765 +
56766 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
56767 + return;
56768 +
56769 + // not yet supported resource
56770 + if (unlikely(!restab_log[res]))
56771 + return;
56772 +
56773 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56774 + rlim = task_rlimit_max(task, res);
56775 + else
56776 + rlim = task_rlimit(task, res);
56777 +
56778 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56779 + return;
56780 +
56781 + rcu_read_lock();
56782 + cred = __task_cred(task);
56783 +
56784 + if (res == RLIMIT_NPROC &&
56785 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56786 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56787 + goto out_rcu_unlock;
56788 + else if (res == RLIMIT_MEMLOCK &&
56789 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56790 + goto out_rcu_unlock;
56791 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56792 + goto out_rcu_unlock;
56793 + rcu_read_unlock();
56794 +
56795 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56796 +
56797 + return;
56798 +out_rcu_unlock:
56799 + rcu_read_unlock();
56800 + return;
56801 +}
56802 diff -urNp linux-2.6.39.1/grsecurity/gracl_segv.c linux-2.6.39.1/grsecurity/gracl_segv.c
56803 --- linux-2.6.39.1/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
56804 +++ linux-2.6.39.1/grsecurity/gracl_segv.c 2011-05-22 22:47:39.000000000 -0400
56805 @@ -0,0 +1,299 @@
56806 +#include <linux/kernel.h>
56807 +#include <linux/mm.h>
56808 +#include <asm/uaccess.h>
56809 +#include <asm/errno.h>
56810 +#include <asm/mman.h>
56811 +#include <net/sock.h>
56812 +#include <linux/file.h>
56813 +#include <linux/fs.h>
56814 +#include <linux/net.h>
56815 +#include <linux/in.h>
56816 +#include <linux/slab.h>
56817 +#include <linux/types.h>
56818 +#include <linux/sched.h>
56819 +#include <linux/timer.h>
56820 +#include <linux/gracl.h>
56821 +#include <linux/grsecurity.h>
56822 +#include <linux/grinternal.h>
56823 +
56824 +static struct crash_uid *uid_set;
56825 +static unsigned short uid_used;
56826 +static DEFINE_SPINLOCK(gr_uid_lock);
56827 +extern rwlock_t gr_inode_lock;
56828 +extern struct acl_subject_label *
56829 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56830 + struct acl_role_label *role);
56831 +
56832 +#ifdef CONFIG_BTRFS_FS
56833 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56834 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56835 +#endif
56836 +
56837 +static inline dev_t __get_dev(const struct dentry *dentry)
56838 +{
56839 +#ifdef CONFIG_BTRFS_FS
56840 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56841 + return get_btrfs_dev_from_inode(dentry->d_inode);
56842 + else
56843 +#endif
56844 + return dentry->d_inode->i_sb->s_dev;
56845 +}
56846 +
56847 +int
56848 +gr_init_uidset(void)
56849 +{
56850 + uid_set =
56851 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56852 + uid_used = 0;
56853 +
56854 + return uid_set ? 1 : 0;
56855 +}
56856 +
56857 +void
56858 +gr_free_uidset(void)
56859 +{
56860 + if (uid_set)
56861 + kfree(uid_set);
56862 +
56863 + return;
56864 +}
56865 +
56866 +int
56867 +gr_find_uid(const uid_t uid)
56868 +{
56869 + struct crash_uid *tmp = uid_set;
56870 + uid_t buid;
56871 + int low = 0, high = uid_used - 1, mid;
56872 +
56873 + while (high >= low) {
56874 + mid = (low + high) >> 1;
56875 + buid = tmp[mid].uid;
56876 + if (buid == uid)
56877 + return mid;
56878 + if (buid > uid)
56879 + high = mid - 1;
56880 + if (buid < uid)
56881 + low = mid + 1;
56882 + }
56883 +
56884 + return -1;
56885 +}
56886 +
56887 +static __inline__ void
56888 +gr_insertsort(void)
56889 +{
56890 + unsigned short i, j;
56891 + struct crash_uid index;
56892 +
56893 + for (i = 1; i < uid_used; i++) {
56894 + index = uid_set[i];
56895 + j = i;
56896 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56897 + uid_set[j] = uid_set[j - 1];
56898 + j--;
56899 + }
56900 + uid_set[j] = index;
56901 + }
56902 +
56903 + return;
56904 +}
56905 +
56906 +static __inline__ void
56907 +gr_insert_uid(const uid_t uid, const unsigned long expires)
56908 +{
56909 + int loc;
56910 +
56911 + if (uid_used == GR_UIDTABLE_MAX)
56912 + return;
56913 +
56914 + loc = gr_find_uid(uid);
56915 +
56916 + if (loc >= 0) {
56917 + uid_set[loc].expires = expires;
56918 + return;
56919 + }
56920 +
56921 + uid_set[uid_used].uid = uid;
56922 + uid_set[uid_used].expires = expires;
56923 + uid_used++;
56924 +
56925 + gr_insertsort();
56926 +
56927 + return;
56928 +}
56929 +
56930 +void
56931 +gr_remove_uid(const unsigned short loc)
56932 +{
56933 + unsigned short i;
56934 +
56935 + for (i = loc + 1; i < uid_used; i++)
56936 + uid_set[i - 1] = uid_set[i];
56937 +
56938 + uid_used--;
56939 +
56940 + return;
56941 +}
56942 +
56943 +int
56944 +gr_check_crash_uid(const uid_t uid)
56945 +{
56946 + int loc;
56947 + int ret = 0;
56948 +
56949 + if (unlikely(!gr_acl_is_enabled()))
56950 + return 0;
56951 +
56952 + spin_lock(&gr_uid_lock);
56953 + loc = gr_find_uid(uid);
56954 +
56955 + if (loc < 0)
56956 + goto out_unlock;
56957 +
56958 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
56959 + gr_remove_uid(loc);
56960 + else
56961 + ret = 1;
56962 +
56963 +out_unlock:
56964 + spin_unlock(&gr_uid_lock);
56965 + return ret;
56966 +}
56967 +
56968 +static __inline__ int
56969 +proc_is_setxid(const struct cred *cred)
56970 +{
56971 + if (cred->uid != cred->euid || cred->uid != cred->suid ||
56972 + cred->uid != cred->fsuid)
56973 + return 1;
56974 + if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56975 + cred->gid != cred->fsgid)
56976 + return 1;
56977 +
56978 + return 0;
56979 +}
56980 +
56981 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
56982 +
56983 +void
56984 +gr_handle_crash(struct task_struct *task, const int sig)
56985 +{
56986 + struct acl_subject_label *curr;
56987 + struct acl_subject_label *curr2;
56988 + struct task_struct *tsk, *tsk2;
56989 + const struct cred *cred;
56990 + const struct cred *cred2;
56991 +
56992 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56993 + return;
56994 +
56995 + if (unlikely(!gr_acl_is_enabled()))
56996 + return;
56997 +
56998 + curr = task->acl;
56999 +
57000 + if (!(curr->resmask & (1 << GR_CRASH_RES)))
57001 + return;
57002 +
57003 + if (time_before_eq(curr->expires, get_seconds())) {
57004 + curr->expires = 0;
57005 + curr->crashes = 0;
57006 + }
57007 +
57008 + curr->crashes++;
57009 +
57010 + if (!curr->expires)
57011 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
57012 +
57013 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57014 + time_after(curr->expires, get_seconds())) {
57015 + rcu_read_lock();
57016 + cred = __task_cred(task);
57017 + if (cred->uid && proc_is_setxid(cred)) {
57018 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57019 + spin_lock(&gr_uid_lock);
57020 + gr_insert_uid(cred->uid, curr->expires);
57021 + spin_unlock(&gr_uid_lock);
57022 + curr->expires = 0;
57023 + curr->crashes = 0;
57024 + read_lock(&tasklist_lock);
57025 + do_each_thread(tsk2, tsk) {
57026 + cred2 = __task_cred(tsk);
57027 + if (tsk != task && cred2->uid == cred->uid)
57028 + gr_fake_force_sig(SIGKILL, tsk);
57029 + } while_each_thread(tsk2, tsk);
57030 + read_unlock(&tasklist_lock);
57031 + } else {
57032 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57033 + read_lock(&tasklist_lock);
57034 + do_each_thread(tsk2, tsk) {
57035 + if (likely(tsk != task)) {
57036 + curr2 = tsk->acl;
57037 +
57038 + if (curr2->device == curr->device &&
57039 + curr2->inode == curr->inode)
57040 + gr_fake_force_sig(SIGKILL, tsk);
57041 + }
57042 + } while_each_thread(tsk2, tsk);
57043 + read_unlock(&tasklist_lock);
57044 + }
57045 + rcu_read_unlock();
57046 + }
57047 +
57048 + return;
57049 +}
57050 +
57051 +int
57052 +gr_check_crash_exec(const struct file *filp)
57053 +{
57054 + struct acl_subject_label *curr;
57055 +
57056 + if (unlikely(!gr_acl_is_enabled()))
57057 + return 0;
57058 +
57059 + read_lock(&gr_inode_lock);
57060 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
57061 + __get_dev(filp->f_path.dentry),
57062 + current->role);
57063 + read_unlock(&gr_inode_lock);
57064 +
57065 + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
57066 + (!curr->crashes && !curr->expires))
57067 + return 0;
57068 +
57069 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57070 + time_after(curr->expires, get_seconds()))
57071 + return 1;
57072 + else if (time_before_eq(curr->expires, get_seconds())) {
57073 + curr->crashes = 0;
57074 + curr->expires = 0;
57075 + }
57076 +
57077 + return 0;
57078 +}
57079 +
57080 +void
57081 +gr_handle_alertkill(struct task_struct *task)
57082 +{
57083 + struct acl_subject_label *curracl;
57084 + __u32 curr_ip;
57085 + struct task_struct *p, *p2;
57086 +
57087 + if (unlikely(!gr_acl_is_enabled()))
57088 + return;
57089 +
57090 + curracl = task->acl;
57091 + curr_ip = task->signal->curr_ip;
57092 +
57093 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
57094 + read_lock(&tasklist_lock);
57095 + do_each_thread(p2, p) {
57096 + if (p->signal->curr_ip == curr_ip)
57097 + gr_fake_force_sig(SIGKILL, p);
57098 + } while_each_thread(p2, p);
57099 + read_unlock(&tasklist_lock);
57100 + } else if (curracl->mode & GR_KILLPROC)
57101 + gr_fake_force_sig(SIGKILL, task);
57102 +
57103 + return;
57104 +}
57105 diff -urNp linux-2.6.39.1/grsecurity/gracl_shm.c linux-2.6.39.1/grsecurity/gracl_shm.c
57106 --- linux-2.6.39.1/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
57107 +++ linux-2.6.39.1/grsecurity/gracl_shm.c 2011-05-22 19:41:42.000000000 -0400
57108 @@ -0,0 +1,40 @@
57109 +#include <linux/kernel.h>
57110 +#include <linux/mm.h>
57111 +#include <linux/sched.h>
57112 +#include <linux/file.h>
57113 +#include <linux/ipc.h>
57114 +#include <linux/gracl.h>
57115 +#include <linux/grsecurity.h>
57116 +#include <linux/grinternal.h>
57117 +
57118 +int
57119 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57120 + const time_t shm_createtime, const uid_t cuid, const int shmid)
57121 +{
57122 + struct task_struct *task;
57123 +
57124 + if (!gr_acl_is_enabled())
57125 + return 1;
57126 +
57127 + rcu_read_lock();
57128 + read_lock(&tasklist_lock);
57129 +
57130 + task = find_task_by_vpid(shm_cprid);
57131 +
57132 + if (unlikely(!task))
57133 + task = find_task_by_vpid(shm_lapid);
57134 +
57135 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
57136 + (task->pid == shm_lapid)) &&
57137 + (task->acl->mode & GR_PROTSHM) &&
57138 + (task->acl != current->acl))) {
57139 + read_unlock(&tasklist_lock);
57140 + rcu_read_unlock();
57141 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
57142 + return 0;
57143 + }
57144 + read_unlock(&tasklist_lock);
57145 + rcu_read_unlock();
57146 +
57147 + return 1;
57148 +}
57149 diff -urNp linux-2.6.39.1/grsecurity/grsec_chdir.c linux-2.6.39.1/grsecurity/grsec_chdir.c
57150 --- linux-2.6.39.1/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
57151 +++ linux-2.6.39.1/grsecurity/grsec_chdir.c 2011-05-22 19:41:42.000000000 -0400
57152 @@ -0,0 +1,19 @@
57153 +#include <linux/kernel.h>
57154 +#include <linux/sched.h>
57155 +#include <linux/fs.h>
57156 +#include <linux/file.h>
57157 +#include <linux/grsecurity.h>
57158 +#include <linux/grinternal.h>
57159 +
57160 +void
57161 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
57162 +{
57163 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57164 + if ((grsec_enable_chdir && grsec_enable_group &&
57165 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
57166 + !grsec_enable_group)) {
57167 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
57168 + }
57169 +#endif
57170 + return;
57171 +}
57172 diff -urNp linux-2.6.39.1/grsecurity/grsec_chroot.c linux-2.6.39.1/grsecurity/grsec_chroot.c
57173 --- linux-2.6.39.1/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
57174 +++ linux-2.6.39.1/grsecurity/grsec_chroot.c 2011-06-20 19:44:48.000000000 -0400
57175 @@ -0,0 +1,355 @@
57176 +#include <linux/kernel.h>
57177 +#include <linux/module.h>
57178 +#include <linux/sched.h>
57179 +#include <linux/file.h>
57180 +#include <linux/fs.h>
57181 +#include <linux/mount.h>
57182 +#include <linux/types.h>
57183 +#include <linux/pid_namespace.h>
57184 +#include <linux/grsecurity.h>
57185 +#include <linux/grinternal.h>
57186 +
57187 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
57188 +{
57189 +#ifdef CONFIG_GRKERNSEC
57190 + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
57191 + path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
57192 + task->gr_is_chrooted = 1;
57193 + else
57194 + task->gr_is_chrooted = 0;
57195 +
57196 + task->gr_chroot_dentry = path->dentry;
57197 +#endif
57198 + return;
57199 +}
57200 +
57201 +void gr_clear_chroot_entries(struct task_struct *task)
57202 +{
57203 +#ifdef CONFIG_GRKERNSEC
57204 + task->gr_is_chrooted = 0;
57205 + task->gr_chroot_dentry = NULL;
57206 +#endif
57207 + return;
57208 +}
57209 +
57210 +int
57211 +gr_handle_chroot_unix(struct pid *pid)
57212 +{
57213 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57214 + struct task_struct *p;
57215 +
57216 + if (unlikely(!grsec_enable_chroot_unix))
57217 + return 1;
57218 +
57219 + if (likely(!proc_is_chrooted(current)))
57220 + return 1;
57221 +
57222 + rcu_read_lock();
57223 + read_lock(&tasklist_lock);
57224 + p = pid_task(pid, PIDTYPE_PID);
57225 + if (unlikely(p && !have_same_root(current, p))) {
57226 + read_unlock(&tasklist_lock);
57227 + rcu_read_unlock();
57228 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
57229 + return 0;
57230 + }
57231 + read_unlock(&tasklist_lock);
57232 + rcu_read_unlock();
57233 +#endif
57234 + return 1;
57235 +}
57236 +
57237 +int
57238 +gr_handle_chroot_nice(void)
57239 +{
57240 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57241 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
57242 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
57243 + return -EPERM;
57244 + }
57245 +#endif
57246 + return 0;
57247 +}
57248 +
57249 +int
57250 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
57251 +{
57252 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57253 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
57254 + && proc_is_chrooted(current)) {
57255 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
57256 + return -EACCES;
57257 + }
57258 +#endif
57259 + return 0;
57260 +}
57261 +
57262 +int
57263 +gr_handle_chroot_rawio(const struct inode *inode)
57264 +{
57265 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57266 + if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
57267 + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
57268 + return 1;
57269 +#endif
57270 + return 0;
57271 +}
57272 +
57273 +int
57274 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
57275 +{
57276 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57277 + struct task_struct *p;
57278 + int ret = 0;
57279 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
57280 + return ret;
57281 +
57282 + read_lock(&tasklist_lock);
57283 + do_each_pid_task(pid, type, p) {
57284 + if (!have_same_root(current, p)) {
57285 + ret = 1;
57286 + goto out;
57287 + }
57288 + } while_each_pid_task(pid, type, p);
57289 +out:
57290 + read_unlock(&tasklist_lock);
57291 + return ret;
57292 +#endif
57293 + return 0;
57294 +}
57295 +
57296 +int
57297 +gr_pid_is_chrooted(struct task_struct *p)
57298 +{
57299 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57300 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
57301 + return 0;
57302 +
57303 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
57304 + !have_same_root(current, p)) {
57305 + return 1;
57306 + }
57307 +#endif
57308 + return 0;
57309 +}
57310 +
57311 +EXPORT_SYMBOL(gr_pid_is_chrooted);
57312 +
57313 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
57314 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
57315 +{
57316 + struct path path, currentroot;
57317 + int ret = 0;
57318 +
57319 + path.dentry = (struct dentry *)u_dentry;
57320 + path.mnt = (struct vfsmount *)u_mnt;
57321 + get_fs_root(current->fs, &currentroot);
57322 + if (path_is_under(&path, &currentroot))
57323 + ret = 1;
57324 + path_put(&currentroot);
57325 +
57326 + return ret;
57327 +}
57328 +#endif
57329 +
57330 +int
57331 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
57332 +{
57333 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57334 + if (!grsec_enable_chroot_fchdir)
57335 + return 1;
57336 +
57337 + if (!proc_is_chrooted(current))
57338 + return 1;
57339 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
57340 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
57341 + return 0;
57342 + }
57343 +#endif
57344 + return 1;
57345 +}
57346 +
57347 +int
57348 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57349 + const time_t shm_createtime)
57350 +{
57351 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57352 + struct pid *pid = NULL;
57353 + time_t starttime;
57354 +
57355 + if (unlikely(!grsec_enable_chroot_shmat))
57356 + return 1;
57357 +
57358 + if (likely(!proc_is_chrooted(current)))
57359 + return 1;
57360 +
57361 + rcu_read_lock();
57362 + read_lock(&tasklist_lock);
57363 +
57364 + pid = find_vpid(shm_cprid);
57365 + if (pid) {
57366 + struct task_struct *p;
57367 + p = pid_task(pid, PIDTYPE_PID);
57368 + if (p == NULL)
57369 + goto unlock;
57370 + starttime = p->start_time.tv_sec;
57371 + if (unlikely(!have_same_root(current, p) &&
57372 + time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
57373 + read_unlock(&tasklist_lock);
57374 + rcu_read_unlock();
57375 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57376 + return 0;
57377 + }
57378 + } else {
57379 + pid = find_vpid(shm_lapid);
57380 + if (pid) {
57381 + struct task_struct *p;
57382 + p = pid_task(pid, PIDTYPE_PID);
57383 + if (p == NULL)
57384 + goto unlock;
57385 + if (unlikely(!have_same_root(current, p))) {
57386 + read_unlock(&tasklist_lock);
57387 + rcu_read_unlock();
57388 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57389 + return 0;
57390 + }
57391 + }
57392 + }
57393 +unlock:
57394 + read_unlock(&tasklist_lock);
57395 + rcu_read_unlock();
57396 +#endif
57397 + return 1;
57398 +}
57399 +
57400 +void
57401 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
57402 +{
57403 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57404 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
57405 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
57406 +#endif
57407 + return;
57408 +}
57409 +
57410 +int
57411 +gr_handle_chroot_mknod(const struct dentry *dentry,
57412 + const struct vfsmount *mnt, const int mode)
57413 +{
57414 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57415 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
57416 + proc_is_chrooted(current)) {
57417 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
57418 + return -EPERM;
57419 + }
57420 +#endif
57421 + return 0;
57422 +}
57423 +
57424 +int
57425 +gr_handle_chroot_mount(const struct dentry *dentry,
57426 + const struct vfsmount *mnt, const char *dev_name)
57427 +{
57428 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57429 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
57430 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
57431 + return -EPERM;
57432 + }
57433 +#endif
57434 + return 0;
57435 +}
57436 +
57437 +int
57438 +gr_handle_chroot_pivot(void)
57439 +{
57440 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57441 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
57442 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
57443 + return -EPERM;
57444 + }
57445 +#endif
57446 + return 0;
57447 +}
57448 +
57449 +int
57450 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
57451 +{
57452 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57453 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
57454 + !gr_is_outside_chroot(dentry, mnt)) {
57455 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
57456 + return -EPERM;
57457 + }
57458 +#endif
57459 + return 0;
57460 +}
57461 +
57462 +int
57463 +gr_handle_chroot_caps(struct path *path)
57464 +{
57465 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57466 + if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
57467 + (init_task.fs->root.dentry != path->dentry) &&
57468 + (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
57469 +
57470 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57471 + const struct cred *old = current_cred();
57472 + struct cred *new = prepare_creds();
57473 + if (new == NULL)
57474 + return 1;
57475 +
57476 + new->cap_permitted = cap_drop(old->cap_permitted,
57477 + chroot_caps);
57478 + new->cap_inheritable = cap_drop(old->cap_inheritable,
57479 + chroot_caps);
57480 + new->cap_effective = cap_drop(old->cap_effective,
57481 + chroot_caps);
57482 +
57483 + commit_creds(new);
57484 +
57485 + return 0;
57486 + }
57487 +#endif
57488 + return 0;
57489 +}
57490 +
57491 +int
57492 +gr_handle_chroot_sysctl(const int op)
57493 +{
57494 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57495 + if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
57496 + proc_is_chrooted(current))
57497 + return -EACCES;
57498 +#endif
57499 + return 0;
57500 +}
57501 +
57502 +void
57503 +gr_handle_chroot_chdir(struct path *path)
57504 +{
57505 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57506 + if (grsec_enable_chroot_chdir)
57507 + set_fs_pwd(current->fs, path);
57508 +#endif
57509 + return;
57510 +}
57511 +
57512 +int
57513 +gr_handle_chroot_chmod(const struct dentry *dentry,
57514 + const struct vfsmount *mnt, const int mode)
57515 +{
57516 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57517 + /* allow chmod +s on directories, but not files */
57518 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
57519 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
57520 + proc_is_chrooted(current)) {
57521 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
57522 + return -EPERM;
57523 + }
57524 +#endif
57525 + return 0;
57526 +}
57527 +
57528 +#ifdef CONFIG_SECURITY
57529 +EXPORT_SYMBOL(gr_handle_chroot_caps);
57530 +#endif
57531 diff -urNp linux-2.6.39.1/grsecurity/grsec_disabled.c linux-2.6.39.1/grsecurity/grsec_disabled.c
57532 --- linux-2.6.39.1/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
57533 +++ linux-2.6.39.1/grsecurity/grsec_disabled.c 2011-05-22 19:41:42.000000000 -0400
57534 @@ -0,0 +1,447 @@
57535 +#include <linux/kernel.h>
57536 +#include <linux/module.h>
57537 +#include <linux/sched.h>
57538 +#include <linux/file.h>
57539 +#include <linux/fs.h>
57540 +#include <linux/kdev_t.h>
57541 +#include <linux/net.h>
57542 +#include <linux/in.h>
57543 +#include <linux/ip.h>
57544 +#include <linux/skbuff.h>
57545 +#include <linux/sysctl.h>
57546 +
57547 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57548 +void
57549 +pax_set_initial_flags(struct linux_binprm *bprm)
57550 +{
57551 + return;
57552 +}
57553 +#endif
57554 +
57555 +#ifdef CONFIG_SYSCTL
57556 +__u32
57557 +gr_handle_sysctl(const struct ctl_table * table, const int op)
57558 +{
57559 + return 0;
57560 +}
57561 +#endif
57562 +
57563 +#ifdef CONFIG_TASKSTATS
57564 +int gr_is_taskstats_denied(int pid)
57565 +{
57566 + return 0;
57567 +}
57568 +#endif
57569 +
57570 +int
57571 +gr_acl_is_enabled(void)
57572 +{
57573 + return 0;
57574 +}
57575 +
57576 +int
57577 +gr_handle_rawio(const struct inode *inode)
57578 +{
57579 + return 0;
57580 +}
57581 +
57582 +void
57583 +gr_acl_handle_psacct(struct task_struct *task, const long code)
57584 +{
57585 + return;
57586 +}
57587 +
57588 +int
57589 +gr_handle_ptrace(struct task_struct *task, const long request)
57590 +{
57591 + return 0;
57592 +}
57593 +
57594 +int
57595 +gr_handle_proc_ptrace(struct task_struct *task)
57596 +{
57597 + return 0;
57598 +}
57599 +
57600 +void
57601 +gr_learn_resource(const struct task_struct *task,
57602 + const int res, const unsigned long wanted, const int gt)
57603 +{
57604 + return;
57605 +}
57606 +
57607 +int
57608 +gr_set_acls(const int type)
57609 +{
57610 + return 0;
57611 +}
57612 +
57613 +int
57614 +gr_check_hidden_task(const struct task_struct *tsk)
57615 +{
57616 + return 0;
57617 +}
57618 +
57619 +int
57620 +gr_check_protected_task(const struct task_struct *task)
57621 +{
57622 + return 0;
57623 +}
57624 +
57625 +int
57626 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57627 +{
57628 + return 0;
57629 +}
57630 +
57631 +void
57632 +gr_copy_label(struct task_struct *tsk)
57633 +{
57634 + return;
57635 +}
57636 +
57637 +void
57638 +gr_set_pax_flags(struct task_struct *task)
57639 +{
57640 + return;
57641 +}
57642 +
57643 +int
57644 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57645 + const int unsafe_share)
57646 +{
57647 + return 0;
57648 +}
57649 +
57650 +void
57651 +gr_handle_delete(const ino_t ino, const dev_t dev)
57652 +{
57653 + return;
57654 +}
57655 +
57656 +void
57657 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57658 +{
57659 + return;
57660 +}
57661 +
57662 +void
57663 +gr_handle_crash(struct task_struct *task, const int sig)
57664 +{
57665 + return;
57666 +}
57667 +
57668 +int
57669 +gr_check_crash_exec(const struct file *filp)
57670 +{
57671 + return 0;
57672 +}
57673 +
57674 +int
57675 +gr_check_crash_uid(const uid_t uid)
57676 +{
57677 + return 0;
57678 +}
57679 +
57680 +void
57681 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57682 + struct dentry *old_dentry,
57683 + struct dentry *new_dentry,
57684 + struct vfsmount *mnt, const __u8 replace)
57685 +{
57686 + return;
57687 +}
57688 +
57689 +int
57690 +gr_search_socket(const int family, const int type, const int protocol)
57691 +{
57692 + return 1;
57693 +}
57694 +
57695 +int
57696 +gr_search_connectbind(const int mode, const struct socket *sock,
57697 + const struct sockaddr_in *addr)
57698 +{
57699 + return 0;
57700 +}
57701 +
57702 +int
57703 +gr_is_capable(const int cap)
57704 +{
57705 + return 1;
57706 +}
57707 +
57708 +int
57709 +gr_is_capable_nolog(const int cap)
57710 +{
57711 + return 1;
57712 +}
57713 +
57714 +void
57715 +gr_handle_alertkill(struct task_struct *task)
57716 +{
57717 + return;
57718 +}
57719 +
57720 +__u32
57721 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57722 +{
57723 + return 1;
57724 +}
57725 +
57726 +__u32
57727 +gr_acl_handle_hidden_file(const struct dentry * dentry,
57728 + const struct vfsmount * mnt)
57729 +{
57730 + return 1;
57731 +}
57732 +
57733 +__u32
57734 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57735 + const int fmode)
57736 +{
57737 + return 1;
57738 +}
57739 +
57740 +__u32
57741 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57742 +{
57743 + return 1;
57744 +}
57745 +
57746 +__u32
57747 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57748 +{
57749 + return 1;
57750 +}
57751 +
57752 +int
57753 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57754 + unsigned int *vm_flags)
57755 +{
57756 + return 1;
57757 +}
57758 +
57759 +__u32
57760 +gr_acl_handle_truncate(const struct dentry * dentry,
57761 + const struct vfsmount * mnt)
57762 +{
57763 + return 1;
57764 +}
57765 +
57766 +__u32
57767 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57768 +{
57769 + return 1;
57770 +}
57771 +
57772 +__u32
57773 +gr_acl_handle_access(const struct dentry * dentry,
57774 + const struct vfsmount * mnt, const int fmode)
57775 +{
57776 + return 1;
57777 +}
57778 +
57779 +__u32
57780 +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57781 + mode_t mode)
57782 +{
57783 + return 1;
57784 +}
57785 +
57786 +__u32
57787 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57788 + mode_t mode)
57789 +{
57790 + return 1;
57791 +}
57792 +
57793 +__u32
57794 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57795 +{
57796 + return 1;
57797 +}
57798 +
57799 +__u32
57800 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57801 +{
57802 + return 1;
57803 +}
57804 +
57805 +void
57806 +grsecurity_init(void)
57807 +{
57808 + return;
57809 +}
57810 +
57811 +__u32
57812 +gr_acl_handle_mknod(const struct dentry * new_dentry,
57813 + const struct dentry * parent_dentry,
57814 + const struct vfsmount * parent_mnt,
57815 + const int mode)
57816 +{
57817 + return 1;
57818 +}
57819 +
57820 +__u32
57821 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
57822 + const struct dentry * parent_dentry,
57823 + const struct vfsmount * parent_mnt)
57824 +{
57825 + return 1;
57826 +}
57827 +
57828 +__u32
57829 +gr_acl_handle_symlink(const struct dentry * new_dentry,
57830 + const struct dentry * parent_dentry,
57831 + const struct vfsmount * parent_mnt, const char *from)
57832 +{
57833 + return 1;
57834 +}
57835 +
57836 +__u32
57837 +gr_acl_handle_link(const struct dentry * new_dentry,
57838 + const struct dentry * parent_dentry,
57839 + const struct vfsmount * parent_mnt,
57840 + const struct dentry * old_dentry,
57841 + const struct vfsmount * old_mnt, const char *to)
57842 +{
57843 + return 1;
57844 +}
57845 +
57846 +int
57847 +gr_acl_handle_rename(const struct dentry *new_dentry,
57848 + const struct dentry *parent_dentry,
57849 + const struct vfsmount *parent_mnt,
57850 + const struct dentry *old_dentry,
57851 + const struct inode *old_parent_inode,
57852 + const struct vfsmount *old_mnt, const char *newname)
57853 +{
57854 + return 0;
57855 +}
57856 +
57857 +int
57858 +gr_acl_handle_filldir(const struct file *file, const char *name,
57859 + const int namelen, const ino_t ino)
57860 +{
57861 + return 1;
57862 +}
57863 +
57864 +int
57865 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57866 + const time_t shm_createtime, const uid_t cuid, const int shmid)
57867 +{
57868 + return 1;
57869 +}
57870 +
57871 +int
57872 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57873 +{
57874 + return 0;
57875 +}
57876 +
57877 +int
57878 +gr_search_accept(const struct socket *sock)
57879 +{
57880 + return 0;
57881 +}
57882 +
57883 +int
57884 +gr_search_listen(const struct socket *sock)
57885 +{
57886 + return 0;
57887 +}
57888 +
57889 +int
57890 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57891 +{
57892 + return 0;
57893 +}
57894 +
57895 +__u32
57896 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57897 +{
57898 + return 1;
57899 +}
57900 +
57901 +__u32
57902 +gr_acl_handle_creat(const struct dentry * dentry,
57903 + const struct dentry * p_dentry,
57904 + const struct vfsmount * p_mnt, const int fmode,
57905 + const int imode)
57906 +{
57907 + return 1;
57908 +}
57909 +
57910 +void
57911 +gr_acl_handle_exit(void)
57912 +{
57913 + return;
57914 +}
57915 +
57916 +int
57917 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57918 +{
57919 + return 1;
57920 +}
57921 +
57922 +void
57923 +gr_set_role_label(const uid_t uid, const gid_t gid)
57924 +{
57925 + return;
57926 +}
57927 +
57928 +int
57929 +gr_acl_handle_procpidmem(const struct task_struct *task)
57930 +{
57931 + return 0;
57932 +}
57933 +
57934 +int
57935 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57936 +{
57937 + return 0;
57938 +}
57939 +
57940 +int
57941 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57942 +{
57943 + return 0;
57944 +}
57945 +
57946 +void
57947 +gr_set_kernel_label(struct task_struct *task)
57948 +{
57949 + return;
57950 +}
57951 +
57952 +int
57953 +gr_check_user_change(int real, int effective, int fs)
57954 +{
57955 + return 0;
57956 +}
57957 +
57958 +int
57959 +gr_check_group_change(int real, int effective, int fs)
57960 +{
57961 + return 0;
57962 +}
57963 +
57964 +int gr_acl_enable_at_secure(void)
57965 +{
57966 + return 0;
57967 +}
57968 +
57969 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57970 +{
57971 + return dentry->d_inode->i_sb->s_dev;
57972 +}
57973 +
57974 +EXPORT_SYMBOL(gr_is_capable);
57975 +EXPORT_SYMBOL(gr_is_capable_nolog);
57976 +EXPORT_SYMBOL(gr_learn_resource);
57977 +EXPORT_SYMBOL(gr_set_kernel_label);
57978 +#ifdef CONFIG_SECURITY
57979 +EXPORT_SYMBOL(gr_check_user_change);
57980 +EXPORT_SYMBOL(gr_check_group_change);
57981 +#endif
57982 diff -urNp linux-2.6.39.1/grsecurity/grsec_exec.c linux-2.6.39.1/grsecurity/grsec_exec.c
57983 --- linux-2.6.39.1/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
57984 +++ linux-2.6.39.1/grsecurity/grsec_exec.c 2011-05-22 22:41:29.000000000 -0400
57985 @@ -0,0 +1,146 @@
57986 +#include <linux/kernel.h>
57987 +#include <linux/sched.h>
57988 +#include <linux/file.h>
57989 +#include <linux/binfmts.h>
57990 +#include <linux/fs.h>
57991 +#include <linux/types.h>
57992 +#include <linux/grdefs.h>
57993 +#include <linux/grinternal.h>
57994 +#include <linux/capability.h>
57995 +#include <linux/compat.h>
57996 +
57997 +#include <asm/uaccess.h>
57998 +
57999 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58000 +static char gr_exec_arg_buf[132];
58001 +static DEFINE_MUTEX(gr_exec_arg_mutex);
58002 +#endif
58003 +
58004 +int
58005 +gr_handle_nproc(void)
58006 +{
58007 +#ifdef CONFIG_GRKERNSEC_EXECVE
58008 + const struct cred *cred = current_cred();
58009 + if (grsec_enable_execve && cred->user &&
58010 + (atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) &&
58011 + !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
58012 + gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
58013 + return -EAGAIN;
58014 + }
58015 +#endif
58016 + return 0;
58017 +}
58018 +
58019 +void
58020 +gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
58021 +{
58022 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58023 + char *grarg = gr_exec_arg_buf;
58024 + unsigned int i, x, execlen = 0;
58025 + char c;
58026 +
58027 + if (!((grsec_enable_execlog && grsec_enable_group &&
58028 + in_group_p(grsec_audit_gid))
58029 + || (grsec_enable_execlog && !grsec_enable_group)))
58030 + return;
58031 +
58032 + mutex_lock(&gr_exec_arg_mutex);
58033 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
58034 +
58035 + if (unlikely(argv == NULL))
58036 + goto log;
58037 +
58038 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
58039 + const char __user *p;
58040 + unsigned int len;
58041 +
58042 + if (copy_from_user(&p, argv + i, sizeof(p)))
58043 + goto log;
58044 + if (!p)
58045 + goto log;
58046 + len = strnlen_user(p, 128 - execlen);
58047 + if (len > 128 - execlen)
58048 + len = 128 - execlen;
58049 + else if (len > 0)
58050 + len--;
58051 + if (copy_from_user(grarg + execlen, p, len))
58052 + goto log;
58053 +
58054 + /* rewrite unprintable characters */
58055 + for (x = 0; x < len; x++) {
58056 + c = *(grarg + execlen + x);
58057 + if (c < 32 || c > 126)
58058 + *(grarg + execlen + x) = ' ';
58059 + }
58060 +
58061 + execlen += len;
58062 + *(grarg + execlen) = ' ';
58063 + *(grarg + execlen + 1) = '\0';
58064 + execlen++;
58065 + }
58066 +
58067 + log:
58068 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58069 + bprm->file->f_path.mnt, grarg);
58070 + mutex_unlock(&gr_exec_arg_mutex);
58071 +#endif
58072 + return;
58073 +}
58074 +
58075 +#ifdef CONFIG_COMPAT
58076 +void
58077 +gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
58078 +{
58079 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58080 + char *grarg = gr_exec_arg_buf;
58081 + unsigned int i, x, execlen = 0;
58082 + char c;
58083 +
58084 + if (!((grsec_enable_execlog && grsec_enable_group &&
58085 + in_group_p(grsec_audit_gid))
58086 + || (grsec_enable_execlog && !grsec_enable_group)))
58087 + return;
58088 +
58089 + mutex_lock(&gr_exec_arg_mutex);
58090 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
58091 +
58092 + if (unlikely(argv == NULL))
58093 + goto log;
58094 +
58095 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
58096 + compat_uptr_t p;
58097 + unsigned int len;
58098 +
58099 + if (get_user(p, argv + i))
58100 + goto log;
58101 + len = strnlen_user(compat_ptr(p), 128 - execlen);
58102 + if (len > 128 - execlen)
58103 + len = 128 - execlen;
58104 + else if (len > 0)
58105 + len--;
58106 + else
58107 + goto log;
58108 + if (copy_from_user(grarg + execlen, compat_ptr(p), len))
58109 + goto log;
58110 +
58111 + /* rewrite unprintable characters */
58112 + for (x = 0; x < len; x++) {
58113 + c = *(grarg + execlen + x);
58114 + if (c < 32 || c > 126)
58115 + *(grarg + execlen + x) = ' ';
58116 + }
58117 +
58118 + execlen += len;
58119 + *(grarg + execlen) = ' ';
58120 + *(grarg + execlen + 1) = '\0';
58121 + execlen++;
58122 + }
58123 +
58124 + log:
58125 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58126 + bprm->file->f_path.mnt, grarg);
58127 + mutex_unlock(&gr_exec_arg_mutex);
58128 +#endif
58129 + return;
58130 +}
58131 +#endif
58132 diff -urNp linux-2.6.39.1/grsecurity/grsec_fifo.c linux-2.6.39.1/grsecurity/grsec_fifo.c
58133 --- linux-2.6.39.1/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
58134 +++ linux-2.6.39.1/grsecurity/grsec_fifo.c 2011-05-22 19:41:42.000000000 -0400
58135 @@ -0,0 +1,24 @@
58136 +#include <linux/kernel.h>
58137 +#include <linux/sched.h>
58138 +#include <linux/fs.h>
58139 +#include <linux/file.h>
58140 +#include <linux/grinternal.h>
58141 +
58142 +int
58143 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
58144 + const struct dentry *dir, const int flag, const int acc_mode)
58145 +{
58146 +#ifdef CONFIG_GRKERNSEC_FIFO
58147 + const struct cred *cred = current_cred();
58148 +
58149 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
58150 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
58151 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
58152 + (cred->fsuid != dentry->d_inode->i_uid)) {
58153 + if (!inode_permission(dentry->d_inode, acc_mode))
58154 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
58155 + return -EACCES;
58156 + }
58157 +#endif
58158 + return 0;
58159 +}
58160 diff -urNp linux-2.6.39.1/grsecurity/grsec_fork.c linux-2.6.39.1/grsecurity/grsec_fork.c
58161 --- linux-2.6.39.1/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
58162 +++ linux-2.6.39.1/grsecurity/grsec_fork.c 2011-05-22 19:41:42.000000000 -0400
58163 @@ -0,0 +1,23 @@
58164 +#include <linux/kernel.h>
58165 +#include <linux/sched.h>
58166 +#include <linux/grsecurity.h>
58167 +#include <linux/grinternal.h>
58168 +#include <linux/errno.h>
58169 +
58170 +void
58171 +gr_log_forkfail(const int retval)
58172 +{
58173 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
58174 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
58175 + switch (retval) {
58176 + case -EAGAIN:
58177 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
58178 + break;
58179 + case -ENOMEM:
58180 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
58181 + break;
58182 + }
58183 + }
58184 +#endif
58185 + return;
58186 +}
58187 diff -urNp linux-2.6.39.1/grsecurity/grsec_init.c linux-2.6.39.1/grsecurity/grsec_init.c
58188 --- linux-2.6.39.1/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
58189 +++ linux-2.6.39.1/grsecurity/grsec_init.c 2011-05-22 22:47:15.000000000 -0400
58190 @@ -0,0 +1,269 @@
58191 +#include <linux/kernel.h>
58192 +#include <linux/sched.h>
58193 +#include <linux/mm.h>
58194 +#include <linux/gracl.h>
58195 +#include <linux/slab.h>
58196 +#include <linux/vmalloc.h>
58197 +#include <linux/percpu.h>
58198 +#include <linux/module.h>
58199 +
58200 +int grsec_enable_link;
58201 +int grsec_enable_dmesg;
58202 +int grsec_enable_harden_ptrace;
58203 +int grsec_enable_fifo;
58204 +int grsec_enable_execve;
58205 +int grsec_enable_execlog;
58206 +int grsec_enable_signal;
58207 +int grsec_enable_forkfail;
58208 +int grsec_enable_audit_ptrace;
58209 +int grsec_enable_time;
58210 +int grsec_enable_audit_textrel;
58211 +int grsec_enable_group;
58212 +int grsec_audit_gid;
58213 +int grsec_enable_chdir;
58214 +int grsec_enable_mount;
58215 +int grsec_enable_rofs;
58216 +int grsec_enable_chroot_findtask;
58217 +int grsec_enable_chroot_mount;
58218 +int grsec_enable_chroot_shmat;
58219 +int grsec_enable_chroot_fchdir;
58220 +int grsec_enable_chroot_double;
58221 +int grsec_enable_chroot_pivot;
58222 +int grsec_enable_chroot_chdir;
58223 +int grsec_enable_chroot_chmod;
58224 +int grsec_enable_chroot_mknod;
58225 +int grsec_enable_chroot_nice;
58226 +int grsec_enable_chroot_execlog;
58227 +int grsec_enable_chroot_caps;
58228 +int grsec_enable_chroot_sysctl;
58229 +int grsec_enable_chroot_unix;
58230 +int grsec_enable_tpe;
58231 +int grsec_tpe_gid;
58232 +int grsec_enable_blackhole;
58233 +#ifdef CONFIG_IPV6_MODULE
58234 +EXPORT_SYMBOL(grsec_enable_blackhole);
58235 +#endif
58236 +int grsec_lastack_retries;
58237 +int grsec_enable_tpe_all;
58238 +int grsec_enable_tpe_invert;
58239 +int grsec_enable_socket_all;
58240 +int grsec_socket_all_gid;
58241 +int grsec_enable_socket_client;
58242 +int grsec_socket_client_gid;
58243 +int grsec_enable_socket_server;
58244 +int grsec_socket_server_gid;
58245 +int grsec_resource_logging;
58246 +int grsec_disable_privio;
58247 +int grsec_enable_log_rwxmaps;
58248 +int grsec_lock;
58249 +
58250 +DEFINE_SPINLOCK(grsec_alert_lock);
58251 +unsigned long grsec_alert_wtime = 0;
58252 +unsigned long grsec_alert_fyet = 0;
58253 +
58254 +DEFINE_SPINLOCK(grsec_audit_lock);
58255 +
58256 +DEFINE_RWLOCK(grsec_exec_file_lock);
58257 +
58258 +char *gr_shared_page[4];
58259 +
58260 +char *gr_alert_log_fmt;
58261 +char *gr_audit_log_fmt;
58262 +char *gr_alert_log_buf;
58263 +char *gr_audit_log_buf;
58264 +
58265 +extern struct gr_arg *gr_usermode;
58266 +extern unsigned char *gr_system_salt;
58267 +extern unsigned char *gr_system_sum;
58268 +
58269 +void __init
58270 +grsecurity_init(void)
58271 +{
58272 + int j;
58273 + /* create the per-cpu shared pages */
58274 +
58275 +#ifdef CONFIG_X86
58276 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
58277 +#endif
58278 +
58279 + for (j = 0; j < 4; j++) {
58280 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
58281 + if (gr_shared_page[j] == NULL) {
58282 + panic("Unable to allocate grsecurity shared page");
58283 + return;
58284 + }
58285 + }
58286 +
58287 + /* allocate log buffers */
58288 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
58289 + if (!gr_alert_log_fmt) {
58290 + panic("Unable to allocate grsecurity alert log format buffer");
58291 + return;
58292 + }
58293 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
58294 + if (!gr_audit_log_fmt) {
58295 + panic("Unable to allocate grsecurity audit log format buffer");
58296 + return;
58297 + }
58298 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58299 + if (!gr_alert_log_buf) {
58300 + panic("Unable to allocate grsecurity alert log buffer");
58301 + return;
58302 + }
58303 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58304 + if (!gr_audit_log_buf) {
58305 + panic("Unable to allocate grsecurity audit log buffer");
58306 + return;
58307 + }
58308 +
58309 + /* allocate memory for authentication structure */
58310 + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
58311 + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
58312 + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
58313 +
58314 + if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
58315 + panic("Unable to allocate grsecurity authentication structure");
58316 + return;
58317 + }
58318 +
58319 +
58320 +#ifdef CONFIG_GRKERNSEC_IO
58321 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
58322 + grsec_disable_privio = 1;
58323 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58324 + grsec_disable_privio = 1;
58325 +#else
58326 + grsec_disable_privio = 0;
58327 +#endif
58328 +#endif
58329 +
58330 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58331 + /* for backward compatibility, tpe_invert always defaults to on if
58332 + enabled in the kernel
58333 + */
58334 + grsec_enable_tpe_invert = 1;
58335 +#endif
58336 +
58337 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58338 +#ifndef CONFIG_GRKERNSEC_SYSCTL
58339 + grsec_lock = 1;
58340 +#endif
58341 +
58342 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58343 + grsec_enable_audit_textrel = 1;
58344 +#endif
58345 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58346 + grsec_enable_log_rwxmaps = 1;
58347 +#endif
58348 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
58349 + grsec_enable_group = 1;
58350 + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
58351 +#endif
58352 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
58353 + grsec_enable_chdir = 1;
58354 +#endif
58355 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
58356 + grsec_enable_harden_ptrace = 1;
58357 +#endif
58358 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58359 + grsec_enable_mount = 1;
58360 +#endif
58361 +#ifdef CONFIG_GRKERNSEC_LINK
58362 + grsec_enable_link = 1;
58363 +#endif
58364 +#ifdef CONFIG_GRKERNSEC_DMESG
58365 + grsec_enable_dmesg = 1;
58366 +#endif
58367 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58368 + grsec_enable_blackhole = 1;
58369 + grsec_lastack_retries = 4;
58370 +#endif
58371 +#ifdef CONFIG_GRKERNSEC_FIFO
58372 + grsec_enable_fifo = 1;
58373 +#endif
58374 +#ifdef CONFIG_GRKERNSEC_EXECVE
58375 + grsec_enable_execve = 1;
58376 +#endif
58377 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58378 + grsec_enable_execlog = 1;
58379 +#endif
58380 +#ifdef CONFIG_GRKERNSEC_SIGNAL
58381 + grsec_enable_signal = 1;
58382 +#endif
58383 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
58384 + grsec_enable_forkfail = 1;
58385 +#endif
58386 +#ifdef CONFIG_GRKERNSEC_TIME
58387 + grsec_enable_time = 1;
58388 +#endif
58389 +#ifdef CONFIG_GRKERNSEC_RESLOG
58390 + grsec_resource_logging = 1;
58391 +#endif
58392 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58393 + grsec_enable_chroot_findtask = 1;
58394 +#endif
58395 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58396 + grsec_enable_chroot_unix = 1;
58397 +#endif
58398 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58399 + grsec_enable_chroot_mount = 1;
58400 +#endif
58401 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58402 + grsec_enable_chroot_fchdir = 1;
58403 +#endif
58404 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58405 + grsec_enable_chroot_shmat = 1;
58406 +#endif
58407 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58408 + grsec_enable_audit_ptrace = 1;
58409 +#endif
58410 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58411 + grsec_enable_chroot_double = 1;
58412 +#endif
58413 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58414 + grsec_enable_chroot_pivot = 1;
58415 +#endif
58416 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58417 + grsec_enable_chroot_chdir = 1;
58418 +#endif
58419 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58420 + grsec_enable_chroot_chmod = 1;
58421 +#endif
58422 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58423 + grsec_enable_chroot_mknod = 1;
58424 +#endif
58425 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58426 + grsec_enable_chroot_nice = 1;
58427 +#endif
58428 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58429 + grsec_enable_chroot_execlog = 1;
58430 +#endif
58431 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58432 + grsec_enable_chroot_caps = 1;
58433 +#endif
58434 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58435 + grsec_enable_chroot_sysctl = 1;
58436 +#endif
58437 +#ifdef CONFIG_GRKERNSEC_TPE
58438 + grsec_enable_tpe = 1;
58439 + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
58440 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
58441 + grsec_enable_tpe_all = 1;
58442 +#endif
58443 +#endif
58444 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58445 + grsec_enable_socket_all = 1;
58446 + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
58447 +#endif
58448 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58449 + grsec_enable_socket_client = 1;
58450 + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
58451 +#endif
58452 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58453 + grsec_enable_socket_server = 1;
58454 + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
58455 +#endif
58456 +#endif
58457 +
58458 + return;
58459 +}
58460 diff -urNp linux-2.6.39.1/grsecurity/grsec_link.c linux-2.6.39.1/grsecurity/grsec_link.c
58461 --- linux-2.6.39.1/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
58462 +++ linux-2.6.39.1/grsecurity/grsec_link.c 2011-05-22 19:41:42.000000000 -0400
58463 @@ -0,0 +1,43 @@
58464 +#include <linux/kernel.h>
58465 +#include <linux/sched.h>
58466 +#include <linux/fs.h>
58467 +#include <linux/file.h>
58468 +#include <linux/grinternal.h>
58469 +
58470 +int
58471 +gr_handle_follow_link(const struct inode *parent,
58472 + const struct inode *inode,
58473 + const struct dentry *dentry, const struct vfsmount *mnt)
58474 +{
58475 +#ifdef CONFIG_GRKERNSEC_LINK
58476 + const struct cred *cred = current_cred();
58477 +
58478 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
58479 + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
58480 + (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
58481 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
58482 + return -EACCES;
58483 + }
58484 +#endif
58485 + return 0;
58486 +}
58487 +
58488 +int
58489 +gr_handle_hardlink(const struct dentry *dentry,
58490 + const struct vfsmount *mnt,
58491 + struct inode *inode, const int mode, const char *to)
58492 +{
58493 +#ifdef CONFIG_GRKERNSEC_LINK
58494 + const struct cred *cred = current_cred();
58495 +
58496 + if (grsec_enable_link && cred->fsuid != inode->i_uid &&
58497 + (!S_ISREG(mode) || (mode & S_ISUID) ||
58498 + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
58499 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
58500 + !capable(CAP_FOWNER) && cred->uid) {
58501 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
58502 + return -EPERM;
58503 + }
58504 +#endif
58505 + return 0;
58506 +}
58507 diff -urNp linux-2.6.39.1/grsecurity/grsec_log.c linux-2.6.39.1/grsecurity/grsec_log.c
58508 --- linux-2.6.39.1/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
58509 +++ linux-2.6.39.1/grsecurity/grsec_log.c 2011-05-22 19:41:42.000000000 -0400
58510 @@ -0,0 +1,310 @@
58511 +#include <linux/kernel.h>
58512 +#include <linux/sched.h>
58513 +#include <linux/file.h>
58514 +#include <linux/tty.h>
58515 +#include <linux/fs.h>
58516 +#include <linux/grinternal.h>
58517 +
58518 +#ifdef CONFIG_TREE_PREEMPT_RCU
58519 +#define DISABLE_PREEMPT() preempt_disable()
58520 +#define ENABLE_PREEMPT() preempt_enable()
58521 +#else
58522 +#define DISABLE_PREEMPT()
58523 +#define ENABLE_PREEMPT()
58524 +#endif
58525 +
58526 +#define BEGIN_LOCKS(x) \
58527 + DISABLE_PREEMPT(); \
58528 + rcu_read_lock(); \
58529 + read_lock(&tasklist_lock); \
58530 + read_lock(&grsec_exec_file_lock); \
58531 + if (x != GR_DO_AUDIT) \
58532 + spin_lock(&grsec_alert_lock); \
58533 + else \
58534 + spin_lock(&grsec_audit_lock)
58535 +
58536 +#define END_LOCKS(x) \
58537 + if (x != GR_DO_AUDIT) \
58538 + spin_unlock(&grsec_alert_lock); \
58539 + else \
58540 + spin_unlock(&grsec_audit_lock); \
58541 + read_unlock(&grsec_exec_file_lock); \
58542 + read_unlock(&tasklist_lock); \
58543 + rcu_read_unlock(); \
58544 + ENABLE_PREEMPT(); \
58545 + if (x == GR_DONT_AUDIT) \
58546 + gr_handle_alertkill(current)
58547 +
58548 +enum {
58549 + FLOODING,
58550 + NO_FLOODING
58551 +};
58552 +
58553 +extern char *gr_alert_log_fmt;
58554 +extern char *gr_audit_log_fmt;
58555 +extern char *gr_alert_log_buf;
58556 +extern char *gr_audit_log_buf;
58557 +
58558 +static int gr_log_start(int audit)
58559 +{
58560 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
58561 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
58562 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58563 +
58564 + if (audit == GR_DO_AUDIT)
58565 + goto set_fmt;
58566 +
58567 + if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
58568 + grsec_alert_wtime = jiffies;
58569 + grsec_alert_fyet = 0;
58570 + } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
58571 + grsec_alert_fyet++;
58572 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
58573 + grsec_alert_wtime = jiffies;
58574 + grsec_alert_fyet++;
58575 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58576 + return FLOODING;
58577 + } else return FLOODING;
58578 +
58579 +set_fmt:
58580 + memset(buf, 0, PAGE_SIZE);
58581 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
58582 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58583 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58584 + } else if (current->signal->curr_ip) {
58585 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58586 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58587 + } else if (gr_acl_is_enabled()) {
58588 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58589 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58590 + } else {
58591 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
58592 + strcpy(buf, fmt);
58593 + }
58594 +
58595 + return NO_FLOODING;
58596 +}
58597 +
58598 +static void gr_log_middle(int audit, const char *msg, va_list ap)
58599 + __attribute__ ((format (printf, 2, 0)));
58600 +
58601 +static void gr_log_middle(int audit, const char *msg, va_list ap)
58602 +{
58603 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58604 + unsigned int len = strlen(buf);
58605 +
58606 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58607 +
58608 + return;
58609 +}
58610 +
58611 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
58612 + __attribute__ ((format (printf, 2, 3)));
58613 +
58614 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
58615 +{
58616 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58617 + unsigned int len = strlen(buf);
58618 + va_list ap;
58619 +
58620 + va_start(ap, msg);
58621 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58622 + va_end(ap);
58623 +
58624 + return;
58625 +}
58626 +
58627 +static void gr_log_end(int audit)
58628 +{
58629 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58630 + unsigned int len = strlen(buf);
58631 +
58632 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58633 + printk("%s\n", buf);
58634 +
58635 + return;
58636 +}
58637 +
58638 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58639 +{
58640 + int logtype;
58641 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58642 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58643 + void *voidptr = NULL;
58644 + int num1 = 0, num2 = 0;
58645 + unsigned long ulong1 = 0, ulong2 = 0;
58646 + struct dentry *dentry = NULL;
58647 + struct vfsmount *mnt = NULL;
58648 + struct file *file = NULL;
58649 + struct task_struct *task = NULL;
58650 + const struct cred *cred, *pcred;
58651 + va_list ap;
58652 +
58653 + BEGIN_LOCKS(audit);
58654 + logtype = gr_log_start(audit);
58655 + if (logtype == FLOODING) {
58656 + END_LOCKS(audit);
58657 + return;
58658 + }
58659 + va_start(ap, argtypes);
58660 + switch (argtypes) {
58661 + case GR_TTYSNIFF:
58662 + task = va_arg(ap, struct task_struct *);
58663 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58664 + break;
58665 + case GR_SYSCTL_HIDDEN:
58666 + str1 = va_arg(ap, char *);
58667 + gr_log_middle_varargs(audit, msg, result, str1);
58668 + break;
58669 + case GR_RBAC:
58670 + dentry = va_arg(ap, struct dentry *);
58671 + mnt = va_arg(ap, struct vfsmount *);
58672 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58673 + break;
58674 + case GR_RBAC_STR:
58675 + dentry = va_arg(ap, struct dentry *);
58676 + mnt = va_arg(ap, struct vfsmount *);
58677 + str1 = va_arg(ap, char *);
58678 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58679 + break;
58680 + case GR_STR_RBAC:
58681 + str1 = va_arg(ap, char *);
58682 + dentry = va_arg(ap, struct dentry *);
58683 + mnt = va_arg(ap, struct vfsmount *);
58684 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58685 + break;
58686 + case GR_RBAC_MODE2:
58687 + dentry = va_arg(ap, struct dentry *);
58688 + mnt = va_arg(ap, struct vfsmount *);
58689 + str1 = va_arg(ap, char *);
58690 + str2 = va_arg(ap, char *);
58691 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58692 + break;
58693 + case GR_RBAC_MODE3:
58694 + dentry = va_arg(ap, struct dentry *);
58695 + mnt = va_arg(ap, struct vfsmount *);
58696 + str1 = va_arg(ap, char *);
58697 + str2 = va_arg(ap, char *);
58698 + str3 = va_arg(ap, char *);
58699 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58700 + break;
58701 + case GR_FILENAME:
58702 + dentry = va_arg(ap, struct dentry *);
58703 + mnt = va_arg(ap, struct vfsmount *);
58704 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58705 + break;
58706 + case GR_STR_FILENAME:
58707 + str1 = va_arg(ap, char *);
58708 + dentry = va_arg(ap, struct dentry *);
58709 + mnt = va_arg(ap, struct vfsmount *);
58710 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58711 + break;
58712 + case GR_FILENAME_STR:
58713 + dentry = va_arg(ap, struct dentry *);
58714 + mnt = va_arg(ap, struct vfsmount *);
58715 + str1 = va_arg(ap, char *);
58716 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58717 + break;
58718 + case GR_FILENAME_TWO_INT:
58719 + dentry = va_arg(ap, struct dentry *);
58720 + mnt = va_arg(ap, struct vfsmount *);
58721 + num1 = va_arg(ap, int);
58722 + num2 = va_arg(ap, int);
58723 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58724 + break;
58725 + case GR_FILENAME_TWO_INT_STR:
58726 + dentry = va_arg(ap, struct dentry *);
58727 + mnt = va_arg(ap, struct vfsmount *);
58728 + num1 = va_arg(ap, int);
58729 + num2 = va_arg(ap, int);
58730 + str1 = va_arg(ap, char *);
58731 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58732 + break;
58733 + case GR_TEXTREL:
58734 + file = va_arg(ap, struct file *);
58735 + ulong1 = va_arg(ap, unsigned long);
58736 + ulong2 = va_arg(ap, unsigned long);
58737 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58738 + break;
58739 + case GR_PTRACE:
58740 + task = va_arg(ap, struct task_struct *);
58741 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58742 + break;
58743 + case GR_RESOURCE:
58744 + task = va_arg(ap, struct task_struct *);
58745 + cred = __task_cred(task);
58746 + pcred = __task_cred(task->real_parent);
58747 + ulong1 = va_arg(ap, unsigned long);
58748 + str1 = va_arg(ap, char *);
58749 + ulong2 = va_arg(ap, unsigned long);
58750 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58751 + break;
58752 + case GR_CAP:
58753 + task = va_arg(ap, struct task_struct *);
58754 + cred = __task_cred(task);
58755 + pcred = __task_cred(task->real_parent);
58756 + str1 = va_arg(ap, char *);
58757 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58758 + break;
58759 + case GR_SIG:
58760 + str1 = va_arg(ap, char *);
58761 + voidptr = va_arg(ap, void *);
58762 + gr_log_middle_varargs(audit, msg, str1, voidptr);
58763 + break;
58764 + case GR_SIG2:
58765 + task = va_arg(ap, struct task_struct *);
58766 + cred = __task_cred(task);
58767 + pcred = __task_cred(task->real_parent);
58768 + num1 = va_arg(ap, int);
58769 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58770 + break;
58771 + case GR_CRASH1:
58772 + task = va_arg(ap, struct task_struct *);
58773 + cred = __task_cred(task);
58774 + pcred = __task_cred(task->real_parent);
58775 + ulong1 = va_arg(ap, unsigned long);
58776 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58777 + break;
58778 + case GR_CRASH2:
58779 + task = va_arg(ap, struct task_struct *);
58780 + cred = __task_cred(task);
58781 + pcred = __task_cred(task->real_parent);
58782 + ulong1 = va_arg(ap, unsigned long);
58783 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58784 + break;
58785 + case GR_RWXMAP:
58786 + file = va_arg(ap, struct file *);
58787 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58788 + break;
58789 + case GR_PSACCT:
58790 + {
58791 + unsigned int wday, cday;
58792 + __u8 whr, chr;
58793 + __u8 wmin, cmin;
58794 + __u8 wsec, csec;
58795 + char cur_tty[64] = { 0 };
58796 + char parent_tty[64] = { 0 };
58797 +
58798 + task = va_arg(ap, struct task_struct *);
58799 + wday = va_arg(ap, unsigned int);
58800 + cday = va_arg(ap, unsigned int);
58801 + whr = va_arg(ap, int);
58802 + chr = va_arg(ap, int);
58803 + wmin = va_arg(ap, int);
58804 + cmin = va_arg(ap, int);
58805 + wsec = va_arg(ap, int);
58806 + csec = va_arg(ap, int);
58807 + ulong1 = va_arg(ap, unsigned long);
58808 + cred = __task_cred(task);
58809 + pcred = __task_cred(task->real_parent);
58810 +
58811 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58812 + }
58813 + break;
58814 + default:
58815 + gr_log_middle(audit, msg, ap);
58816 + }
58817 + va_end(ap);
58818 + gr_log_end(audit);
58819 + END_LOCKS(audit);
58820 +}
58821 diff -urNp linux-2.6.39.1/grsecurity/grsec_mem.c linux-2.6.39.1/grsecurity/grsec_mem.c
58822 --- linux-2.6.39.1/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
58823 +++ linux-2.6.39.1/grsecurity/grsec_mem.c 2011-05-22 19:41:42.000000000 -0400
58824 @@ -0,0 +1,33 @@
58825 +#include <linux/kernel.h>
58826 +#include <linux/sched.h>
58827 +#include <linux/mm.h>
58828 +#include <linux/mman.h>
58829 +#include <linux/grinternal.h>
58830 +
58831 +void
58832 +gr_handle_ioperm(void)
58833 +{
58834 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58835 + return;
58836 +}
58837 +
58838 +void
58839 +gr_handle_iopl(void)
58840 +{
58841 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58842 + return;
58843 +}
58844 +
58845 +void
58846 +gr_handle_mem_readwrite(u64 from, u64 to)
58847 +{
58848 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58849 + return;
58850 +}
58851 +
58852 +void
58853 +gr_handle_vm86(void)
58854 +{
58855 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58856 + return;
58857 +}
58858 diff -urNp linux-2.6.39.1/grsecurity/grsec_mount.c linux-2.6.39.1/grsecurity/grsec_mount.c
58859 --- linux-2.6.39.1/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
58860 +++ linux-2.6.39.1/grsecurity/grsec_mount.c 2011-06-20 19:46:18.000000000 -0400
58861 @@ -0,0 +1,62 @@
58862 +#include <linux/kernel.h>
58863 +#include <linux/sched.h>
58864 +#include <linux/mount.h>
58865 +#include <linux/grsecurity.h>
58866 +#include <linux/grinternal.h>
58867 +
58868 +void
58869 +gr_log_remount(const char *devname, const int retval)
58870 +{
58871 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58872 + if (grsec_enable_mount && (retval >= 0))
58873 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58874 +#endif
58875 + return;
58876 +}
58877 +
58878 +void
58879 +gr_log_unmount(const char *devname, const int retval)
58880 +{
58881 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58882 + if (grsec_enable_mount && (retval >= 0))
58883 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58884 +#endif
58885 + return;
58886 +}
58887 +
58888 +void
58889 +gr_log_mount(const char *from, const char *to, const int retval)
58890 +{
58891 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58892 + if (grsec_enable_mount && (retval >= 0))
58893 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
58894 +#endif
58895 + return;
58896 +}
58897 +
58898 +int
58899 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58900 +{
58901 +#ifdef CONFIG_GRKERNSEC_ROFS
58902 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58903 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58904 + return -EPERM;
58905 + } else
58906 + return 0;
58907 +#endif
58908 + return 0;
58909 +}
58910 +
58911 +int
58912 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58913 +{
58914 +#ifdef CONFIG_GRKERNSEC_ROFS
58915 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58916 + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58917 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58918 + return -EPERM;
58919 + } else
58920 + return 0;
58921 +#endif
58922 + return 0;
58923 +}
58924 diff -urNp linux-2.6.39.1/grsecurity/grsec_pax.c linux-2.6.39.1/grsecurity/grsec_pax.c
58925 --- linux-2.6.39.1/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
58926 +++ linux-2.6.39.1/grsecurity/grsec_pax.c 2011-05-22 19:41:42.000000000 -0400
58927 @@ -0,0 +1,36 @@
58928 +#include <linux/kernel.h>
58929 +#include <linux/sched.h>
58930 +#include <linux/mm.h>
58931 +#include <linux/file.h>
58932 +#include <linux/grinternal.h>
58933 +#include <linux/grsecurity.h>
58934 +
58935 +void
58936 +gr_log_textrel(struct vm_area_struct * vma)
58937 +{
58938 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58939 + if (grsec_enable_audit_textrel)
58940 + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58941 +#endif
58942 + return;
58943 +}
58944 +
58945 +void
58946 +gr_log_rwxmmap(struct file *file)
58947 +{
58948 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58949 + if (grsec_enable_log_rwxmaps)
58950 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58951 +#endif
58952 + return;
58953 +}
58954 +
58955 +void
58956 +gr_log_rwxmprotect(struct file *file)
58957 +{
58958 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58959 + if (grsec_enable_log_rwxmaps)
58960 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58961 +#endif
58962 + return;
58963 +}
58964 diff -urNp linux-2.6.39.1/grsecurity/grsec_ptrace.c linux-2.6.39.1/grsecurity/grsec_ptrace.c
58965 --- linux-2.6.39.1/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
58966 +++ linux-2.6.39.1/grsecurity/grsec_ptrace.c 2011-05-22 19:41:42.000000000 -0400
58967 @@ -0,0 +1,14 @@
58968 +#include <linux/kernel.h>
58969 +#include <linux/sched.h>
58970 +#include <linux/grinternal.h>
58971 +#include <linux/grsecurity.h>
58972 +
58973 +void
58974 +gr_audit_ptrace(struct task_struct *task)
58975 +{
58976 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58977 + if (grsec_enable_audit_ptrace)
58978 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58979 +#endif
58980 + return;
58981 +}
58982 diff -urNp linux-2.6.39.1/grsecurity/grsec_sig.c linux-2.6.39.1/grsecurity/grsec_sig.c
58983 --- linux-2.6.39.1/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
58984 +++ linux-2.6.39.1/grsecurity/grsec_sig.c 2011-05-22 19:41:42.000000000 -0400
58985 @@ -0,0 +1,203 @@
58986 +#include <linux/kernel.h>
58987 +#include <linux/sched.h>
58988 +#include <linux/delay.h>
58989 +#include <linux/grsecurity.h>
58990 +#include <linux/grinternal.h>
58991 +#include <linux/hardirq.h>
58992 +
58993 +char *signames[] = {
58994 + [SIGSEGV] = "Segmentation fault",
58995 + [SIGILL] = "Illegal instruction",
58996 + [SIGABRT] = "Abort",
58997 + [SIGBUS] = "Invalid alignment/Bus error"
58998 +};
58999 +
59000 +void
59001 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
59002 +{
59003 +#ifdef CONFIG_GRKERNSEC_SIGNAL
59004 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
59005 + (sig == SIGABRT) || (sig == SIGBUS))) {
59006 + if (t->pid == current->pid) {
59007 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
59008 + } else {
59009 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
59010 + }
59011 + }
59012 +#endif
59013 + return;
59014 +}
59015 +
59016 +int
59017 +gr_handle_signal(const struct task_struct *p, const int sig)
59018 +{
59019 +#ifdef CONFIG_GRKERNSEC
59020 + if (current->pid > 1 && gr_check_protected_task(p)) {
59021 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
59022 + return -EPERM;
59023 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
59024 + return -EPERM;
59025 + }
59026 +#endif
59027 + return 0;
59028 +}
59029 +
59030 +#ifdef CONFIG_GRKERNSEC
59031 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
59032 +
59033 +int gr_fake_force_sig(int sig, struct task_struct *t)
59034 +{
59035 + unsigned long int flags;
59036 + int ret, blocked, ignored;
59037 + struct k_sigaction *action;
59038 +
59039 + spin_lock_irqsave(&t->sighand->siglock, flags);
59040 + action = &t->sighand->action[sig-1];
59041 + ignored = action->sa.sa_handler == SIG_IGN;
59042 + blocked = sigismember(&t->blocked, sig);
59043 + if (blocked || ignored) {
59044 + action->sa.sa_handler = SIG_DFL;
59045 + if (blocked) {
59046 + sigdelset(&t->blocked, sig);
59047 + recalc_sigpending_and_wake(t);
59048 + }
59049 + }
59050 + if (action->sa.sa_handler == SIG_DFL)
59051 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
59052 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
59053 +
59054 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
59055 +
59056 + return ret;
59057 +}
59058 +#endif
59059 +
59060 +#ifdef CONFIG_GRKERNSEC_BRUTE
59061 +#define GR_USER_BAN_TIME (15 * 60)
59062 +
59063 +static int __get_dumpable(unsigned long mm_flags)
59064 +{
59065 + int ret;
59066 +
59067 + ret = mm_flags & MMF_DUMPABLE_MASK;
59068 + return (ret >= 2) ? 2 : ret;
59069 +}
59070 +#endif
59071 +
59072 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
59073 +{
59074 +#ifdef CONFIG_GRKERNSEC_BRUTE
59075 + uid_t uid = 0;
59076 +
59077 + rcu_read_lock();
59078 + read_lock(&tasklist_lock);
59079 + read_lock(&grsec_exec_file_lock);
59080 + if (p->real_parent && p->real_parent->exec_file == p->exec_file)
59081 + p->real_parent->brute = 1;
59082 + else {
59083 + const struct cred *cred = __task_cred(p), *cred2;
59084 + struct task_struct *tsk, *tsk2;
59085 +
59086 + if (!__get_dumpable(mm_flags) && cred->uid) {
59087 + struct user_struct *user;
59088 +
59089 + uid = cred->uid;
59090 +
59091 + /* this is put upon execution past expiration */
59092 + user = find_user(uid);
59093 + if (user == NULL)
59094 + goto unlock;
59095 + user->banned = 1;
59096 + user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
59097 + if (user->ban_expires == ~0UL)
59098 + user->ban_expires--;
59099 +
59100 + do_each_thread(tsk2, tsk) {
59101 + cred2 = __task_cred(tsk);
59102 + if (tsk != p && cred2->uid == uid)
59103 + gr_fake_force_sig(SIGKILL, tsk);
59104 + } while_each_thread(tsk2, tsk);
59105 + }
59106 + }
59107 +unlock:
59108 + read_unlock(&grsec_exec_file_lock);
59109 + read_unlock(&tasklist_lock);
59110 + rcu_read_unlock();
59111 +
59112 + if (uid)
59113 + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
59114 +
59115 +#endif
59116 + return;
59117 +}
59118 +
59119 +void gr_handle_brute_check(void)
59120 +{
59121 +#ifdef CONFIG_GRKERNSEC_BRUTE
59122 + if (current->brute)
59123 + msleep(30 * 1000);
59124 +#endif
59125 + return;
59126 +}
59127 +
59128 +void gr_handle_kernel_exploit(void)
59129 +{
59130 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
59131 + const struct cred *cred;
59132 + struct task_struct *tsk, *tsk2;
59133 + struct user_struct *user;
59134 + uid_t uid;
59135 +
59136 + if (in_irq() || in_serving_softirq() || in_nmi())
59137 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
59138 +
59139 + uid = current_uid();
59140 +
59141 + if (uid == 0)
59142 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
59143 + else {
59144 + /* kill all the processes of this user, hold a reference
59145 + to their creds struct, and prevent them from creating
59146 + another process until system reset
59147 + */
59148 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
59149 + /* we intentionally leak this ref */
59150 + user = get_uid(current->cred->user);
59151 + if (user) {
59152 + user->banned = 1;
59153 + user->ban_expires = ~0UL;
59154 + }
59155 +
59156 + read_lock(&tasklist_lock);
59157 + do_each_thread(tsk2, tsk) {
59158 + cred = __task_cred(tsk);
59159 + if (cred->uid == uid)
59160 + gr_fake_force_sig(SIGKILL, tsk);
59161 + } while_each_thread(tsk2, tsk);
59162 + read_unlock(&tasklist_lock);
59163 + }
59164 +#endif
59165 +}
59166 +
59167 +int __gr_process_user_ban(struct user_struct *user)
59168 +{
59169 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59170 + if (unlikely(user->banned)) {
59171 + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
59172 + user->banned = 0;
59173 + user->ban_expires = 0;
59174 + free_uid(user);
59175 + } else
59176 + return -EPERM;
59177 + }
59178 +#endif
59179 + return 0;
59180 +}
59181 +
59182 +int gr_process_user_ban(void)
59183 +{
59184 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59185 + return __gr_process_user_ban(current->cred->user);
59186 +#endif
59187 + return 0;
59188 +}
59189 diff -urNp linux-2.6.39.1/grsecurity/grsec_sock.c linux-2.6.39.1/grsecurity/grsec_sock.c
59190 --- linux-2.6.39.1/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
59191 +++ linux-2.6.39.1/grsecurity/grsec_sock.c 2011-05-22 20:29:21.000000000 -0400
59192 @@ -0,0 +1,244 @@
59193 +#include <linux/kernel.h>
59194 +#include <linux/module.h>
59195 +#include <linux/sched.h>
59196 +#include <linux/file.h>
59197 +#include <linux/net.h>
59198 +#include <linux/in.h>
59199 +#include <linux/ip.h>
59200 +#include <net/sock.h>
59201 +#include <net/inet_sock.h>
59202 +#include <linux/grsecurity.h>
59203 +#include <linux/grinternal.h>
59204 +#include <linux/gracl.h>
59205 +
59206 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
59207 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
59208 +
59209 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
59210 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
59211 +
59212 +#ifdef CONFIG_UNIX_MODULE
59213 +EXPORT_SYMBOL(gr_acl_handle_unix);
59214 +EXPORT_SYMBOL(gr_acl_handle_mknod);
59215 +EXPORT_SYMBOL(gr_handle_chroot_unix);
59216 +EXPORT_SYMBOL(gr_handle_create);
59217 +#endif
59218 +
59219 +#ifdef CONFIG_GRKERNSEC
59220 +#define gr_conn_table_size 32749
59221 +struct conn_table_entry {
59222 + struct conn_table_entry *next;
59223 + struct signal_struct *sig;
59224 +};
59225 +
59226 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
59227 +DEFINE_SPINLOCK(gr_conn_table_lock);
59228 +
59229 +extern const char * gr_socktype_to_name(unsigned char type);
59230 +extern const char * gr_proto_to_name(unsigned char proto);
59231 +extern const char * gr_sockfamily_to_name(unsigned char family);
59232 +
59233 +static __inline__ int
59234 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
59235 +{
59236 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
59237 +}
59238 +
59239 +static __inline__ int
59240 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
59241 + __u16 sport, __u16 dport)
59242 +{
59243 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
59244 + sig->gr_sport == sport && sig->gr_dport == dport))
59245 + return 1;
59246 + else
59247 + return 0;
59248 +}
59249 +
59250 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
59251 +{
59252 + struct conn_table_entry **match;
59253 + unsigned int index;
59254 +
59255 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59256 + sig->gr_sport, sig->gr_dport,
59257 + gr_conn_table_size);
59258 +
59259 + newent->sig = sig;
59260 +
59261 + match = &gr_conn_table[index];
59262 + newent->next = *match;
59263 + *match = newent;
59264 +
59265 + return;
59266 +}
59267 +
59268 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
59269 +{
59270 + struct conn_table_entry *match, *last = NULL;
59271 + unsigned int index;
59272 +
59273 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59274 + sig->gr_sport, sig->gr_dport,
59275 + gr_conn_table_size);
59276 +
59277 + match = gr_conn_table[index];
59278 + while (match && !conn_match(match->sig,
59279 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
59280 + sig->gr_dport)) {
59281 + last = match;
59282 + match = match->next;
59283 + }
59284 +
59285 + if (match) {
59286 + if (last)
59287 + last->next = match->next;
59288 + else
59289 + gr_conn_table[index] = NULL;
59290 + kfree(match);
59291 + }
59292 +
59293 + return;
59294 +}
59295 +
59296 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
59297 + __u16 sport, __u16 dport)
59298 +{
59299 + struct conn_table_entry *match;
59300 + unsigned int index;
59301 +
59302 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
59303 +
59304 + match = gr_conn_table[index];
59305 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
59306 + match = match->next;
59307 +
59308 + if (match)
59309 + return match->sig;
59310 + else
59311 + return NULL;
59312 +}
59313 +
59314 +#endif
59315 +
59316 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
59317 +{
59318 +#ifdef CONFIG_GRKERNSEC
59319 + struct signal_struct *sig = task->signal;
59320 + struct conn_table_entry *newent;
59321 +
59322 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
59323 + if (newent == NULL)
59324 + return;
59325 + /* no bh lock needed since we are called with bh disabled */
59326 + spin_lock(&gr_conn_table_lock);
59327 + gr_del_task_from_ip_table_nolock(sig);
59328 + sig->gr_saddr = inet->inet_rcv_saddr;
59329 + sig->gr_daddr = inet->inet_daddr;
59330 + sig->gr_sport = inet->inet_sport;
59331 + sig->gr_dport = inet->inet_dport;
59332 + gr_add_to_task_ip_table_nolock(sig, newent);
59333 + spin_unlock(&gr_conn_table_lock);
59334 +#endif
59335 + return;
59336 +}
59337 +
59338 +void gr_del_task_from_ip_table(struct task_struct *task)
59339 +{
59340 +#ifdef CONFIG_GRKERNSEC
59341 + spin_lock_bh(&gr_conn_table_lock);
59342 + gr_del_task_from_ip_table_nolock(task->signal);
59343 + spin_unlock_bh(&gr_conn_table_lock);
59344 +#endif
59345 + return;
59346 +}
59347 +
59348 +void
59349 +gr_attach_curr_ip(const struct sock *sk)
59350 +{
59351 +#ifdef CONFIG_GRKERNSEC
59352 + struct signal_struct *p, *set;
59353 + const struct inet_sock *inet = inet_sk(sk);
59354 +
59355 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
59356 + return;
59357 +
59358 + set = current->signal;
59359 +
59360 + spin_lock_bh(&gr_conn_table_lock);
59361 + p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
59362 + inet->inet_dport, inet->inet_sport);
59363 + if (unlikely(p != NULL)) {
59364 + set->curr_ip = p->curr_ip;
59365 + set->used_accept = 1;
59366 + gr_del_task_from_ip_table_nolock(p);
59367 + spin_unlock_bh(&gr_conn_table_lock);
59368 + return;
59369 + }
59370 + spin_unlock_bh(&gr_conn_table_lock);
59371 +
59372 + set->curr_ip = inet->inet_daddr;
59373 + set->used_accept = 1;
59374 +#endif
59375 + return;
59376 +}
59377 +
59378 +int
59379 +gr_handle_sock_all(const int family, const int type, const int protocol)
59380 +{
59381 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59382 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
59383 + (family != AF_UNIX)) {
59384 + if (family == AF_INET)
59385 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
59386 + else
59387 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
59388 + return -EACCES;
59389 + }
59390 +#endif
59391 + return 0;
59392 +}
59393 +
59394 +int
59395 +gr_handle_sock_server(const struct sockaddr *sck)
59396 +{
59397 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59398 + if (grsec_enable_socket_server &&
59399 + in_group_p(grsec_socket_server_gid) &&
59400 + sck && (sck->sa_family != AF_UNIX) &&
59401 + (sck->sa_family != AF_LOCAL)) {
59402 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59403 + return -EACCES;
59404 + }
59405 +#endif
59406 + return 0;
59407 +}
59408 +
59409 +int
59410 +gr_handle_sock_server_other(const struct sock *sck)
59411 +{
59412 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59413 + if (grsec_enable_socket_server &&
59414 + in_group_p(grsec_socket_server_gid) &&
59415 + sck && (sck->sk_family != AF_UNIX) &&
59416 + (sck->sk_family != AF_LOCAL)) {
59417 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59418 + return -EACCES;
59419 + }
59420 +#endif
59421 + return 0;
59422 +}
59423 +
59424 +int
59425 +gr_handle_sock_client(const struct sockaddr *sck)
59426 +{
59427 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59428 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
59429 + sck && (sck->sa_family != AF_UNIX) &&
59430 + (sck->sa_family != AF_LOCAL)) {
59431 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
59432 + return -EACCES;
59433 + }
59434 +#endif
59435 + return 0;
59436 +}
59437 diff -urNp linux-2.6.39.1/grsecurity/grsec_sysctl.c linux-2.6.39.1/grsecurity/grsec_sysctl.c
59438 --- linux-2.6.39.1/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
59439 +++ linux-2.6.39.1/grsecurity/grsec_sysctl.c 2011-05-22 19:41:42.000000000 -0400
59440 @@ -0,0 +1,433 @@
59441 +#include <linux/kernel.h>
59442 +#include <linux/sched.h>
59443 +#include <linux/sysctl.h>
59444 +#include <linux/grsecurity.h>
59445 +#include <linux/grinternal.h>
59446 +
59447 +int
59448 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
59449 +{
59450 +#ifdef CONFIG_GRKERNSEC_SYSCTL
59451 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
59452 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
59453 + return -EACCES;
59454 + }
59455 +#endif
59456 + return 0;
59457 +}
59458 +
59459 +#ifdef CONFIG_GRKERNSEC_ROFS
59460 +static int __maybe_unused one = 1;
59461 +#endif
59462 +
59463 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
59464 +struct ctl_table grsecurity_table[] = {
59465 +#ifdef CONFIG_GRKERNSEC_SYSCTL
59466 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
59467 +#ifdef CONFIG_GRKERNSEC_IO
59468 + {
59469 + .procname = "disable_priv_io",
59470 + .data = &grsec_disable_privio,
59471 + .maxlen = sizeof(int),
59472 + .mode = 0600,
59473 + .proc_handler = &proc_dointvec,
59474 + },
59475 +#endif
59476 +#endif
59477 +#ifdef CONFIG_GRKERNSEC_LINK
59478 + {
59479 + .procname = "linking_restrictions",
59480 + .data = &grsec_enable_link,
59481 + .maxlen = sizeof(int),
59482 + .mode = 0600,
59483 + .proc_handler = &proc_dointvec,
59484 + },
59485 +#endif
59486 +#ifdef CONFIG_GRKERNSEC_FIFO
59487 + {
59488 + .procname = "fifo_restrictions",
59489 + .data = &grsec_enable_fifo,
59490 + .maxlen = sizeof(int),
59491 + .mode = 0600,
59492 + .proc_handler = &proc_dointvec,
59493 + },
59494 +#endif
59495 +#ifdef CONFIG_GRKERNSEC_EXECVE
59496 + {
59497 + .procname = "execve_limiting",
59498 + .data = &grsec_enable_execve,
59499 + .maxlen = sizeof(int),
59500 + .mode = 0600,
59501 + .proc_handler = &proc_dointvec,
59502 + },
59503 +#endif
59504 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59505 + {
59506 + .procname = "ip_blackhole",
59507 + .data = &grsec_enable_blackhole,
59508 + .maxlen = sizeof(int),
59509 + .mode = 0600,
59510 + .proc_handler = &proc_dointvec,
59511 + },
59512 + {
59513 + .procname = "lastack_retries",
59514 + .data = &grsec_lastack_retries,
59515 + .maxlen = sizeof(int),
59516 + .mode = 0600,
59517 + .proc_handler = &proc_dointvec,
59518 + },
59519 +#endif
59520 +#ifdef CONFIG_GRKERNSEC_EXECLOG
59521 + {
59522 + .procname = "exec_logging",
59523 + .data = &grsec_enable_execlog,
59524 + .maxlen = sizeof(int),
59525 + .mode = 0600,
59526 + .proc_handler = &proc_dointvec,
59527 + },
59528 +#endif
59529 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59530 + {
59531 + .procname = "rwxmap_logging",
59532 + .data = &grsec_enable_log_rwxmaps,
59533 + .maxlen = sizeof(int),
59534 + .mode = 0600,
59535 + .proc_handler = &proc_dointvec,
59536 + },
59537 +#endif
59538 +#ifdef CONFIG_GRKERNSEC_SIGNAL
59539 + {
59540 + .procname = "signal_logging",
59541 + .data = &grsec_enable_signal,
59542 + .maxlen = sizeof(int),
59543 + .mode = 0600,
59544 + .proc_handler = &proc_dointvec,
59545 + },
59546 +#endif
59547 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
59548 + {
59549 + .procname = "forkfail_logging",
59550 + .data = &grsec_enable_forkfail,
59551 + .maxlen = sizeof(int),
59552 + .mode = 0600,
59553 + .proc_handler = &proc_dointvec,
59554 + },
59555 +#endif
59556 +#ifdef CONFIG_GRKERNSEC_TIME
59557 + {
59558 + .procname = "timechange_logging",
59559 + .data = &grsec_enable_time,
59560 + .maxlen = sizeof(int),
59561 + .mode = 0600,
59562 + .proc_handler = &proc_dointvec,
59563 + },
59564 +#endif
59565 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59566 + {
59567 + .procname = "chroot_deny_shmat",
59568 + .data = &grsec_enable_chroot_shmat,
59569 + .maxlen = sizeof(int),
59570 + .mode = 0600,
59571 + .proc_handler = &proc_dointvec,
59572 + },
59573 +#endif
59574 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59575 + {
59576 + .procname = "chroot_deny_unix",
59577 + .data = &grsec_enable_chroot_unix,
59578 + .maxlen = sizeof(int),
59579 + .mode = 0600,
59580 + .proc_handler = &proc_dointvec,
59581 + },
59582 +#endif
59583 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59584 + {
59585 + .procname = "chroot_deny_mount",
59586 + .data = &grsec_enable_chroot_mount,
59587 + .maxlen = sizeof(int),
59588 + .mode = 0600,
59589 + .proc_handler = &proc_dointvec,
59590 + },
59591 +#endif
59592 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59593 + {
59594 + .procname = "chroot_deny_fchdir",
59595 + .data = &grsec_enable_chroot_fchdir,
59596 + .maxlen = sizeof(int),
59597 + .mode = 0600,
59598 + .proc_handler = &proc_dointvec,
59599 + },
59600 +#endif
59601 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59602 + {
59603 + .procname = "chroot_deny_chroot",
59604 + .data = &grsec_enable_chroot_double,
59605 + .maxlen = sizeof(int),
59606 + .mode = 0600,
59607 + .proc_handler = &proc_dointvec,
59608 + },
59609 +#endif
59610 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59611 + {
59612 + .procname = "chroot_deny_pivot",
59613 + .data = &grsec_enable_chroot_pivot,
59614 + .maxlen = sizeof(int),
59615 + .mode = 0600,
59616 + .proc_handler = &proc_dointvec,
59617 + },
59618 +#endif
59619 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59620 + {
59621 + .procname = "chroot_enforce_chdir",
59622 + .data = &grsec_enable_chroot_chdir,
59623 + .maxlen = sizeof(int),
59624 + .mode = 0600,
59625 + .proc_handler = &proc_dointvec,
59626 + },
59627 +#endif
59628 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59629 + {
59630 + .procname = "chroot_deny_chmod",
59631 + .data = &grsec_enable_chroot_chmod,
59632 + .maxlen = sizeof(int),
59633 + .mode = 0600,
59634 + .proc_handler = &proc_dointvec,
59635 + },
59636 +#endif
59637 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59638 + {
59639 + .procname = "chroot_deny_mknod",
59640 + .data = &grsec_enable_chroot_mknod,
59641 + .maxlen = sizeof(int),
59642 + .mode = 0600,
59643 + .proc_handler = &proc_dointvec,
59644 + },
59645 +#endif
59646 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59647 + {
59648 + .procname = "chroot_restrict_nice",
59649 + .data = &grsec_enable_chroot_nice,
59650 + .maxlen = sizeof(int),
59651 + .mode = 0600,
59652 + .proc_handler = &proc_dointvec,
59653 + },
59654 +#endif
59655 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59656 + {
59657 + .procname = "chroot_execlog",
59658 + .data = &grsec_enable_chroot_execlog,
59659 + .maxlen = sizeof(int),
59660 + .mode = 0600,
59661 + .proc_handler = &proc_dointvec,
59662 + },
59663 +#endif
59664 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59665 + {
59666 + .procname = "chroot_caps",
59667 + .data = &grsec_enable_chroot_caps,
59668 + .maxlen = sizeof(int),
59669 + .mode = 0600,
59670 + .proc_handler = &proc_dointvec,
59671 + },
59672 +#endif
59673 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59674 + {
59675 + .procname = "chroot_deny_sysctl",
59676 + .data = &grsec_enable_chroot_sysctl,
59677 + .maxlen = sizeof(int),
59678 + .mode = 0600,
59679 + .proc_handler = &proc_dointvec,
59680 + },
59681 +#endif
59682 +#ifdef CONFIG_GRKERNSEC_TPE
59683 + {
59684 + .procname = "tpe",
59685 + .data = &grsec_enable_tpe,
59686 + .maxlen = sizeof(int),
59687 + .mode = 0600,
59688 + .proc_handler = &proc_dointvec,
59689 + },
59690 + {
59691 + .procname = "tpe_gid",
59692 + .data = &grsec_tpe_gid,
59693 + .maxlen = sizeof(int),
59694 + .mode = 0600,
59695 + .proc_handler = &proc_dointvec,
59696 + },
59697 +#endif
59698 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59699 + {
59700 + .procname = "tpe_invert",
59701 + .data = &grsec_enable_tpe_invert,
59702 + .maxlen = sizeof(int),
59703 + .mode = 0600,
59704 + .proc_handler = &proc_dointvec,
59705 + },
59706 +#endif
59707 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59708 + {
59709 + .procname = "tpe_restrict_all",
59710 + .data = &grsec_enable_tpe_all,
59711 + .maxlen = sizeof(int),
59712 + .mode = 0600,
59713 + .proc_handler = &proc_dointvec,
59714 + },
59715 +#endif
59716 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59717 + {
59718 + .procname = "socket_all",
59719 + .data = &grsec_enable_socket_all,
59720 + .maxlen = sizeof(int),
59721 + .mode = 0600,
59722 + .proc_handler = &proc_dointvec,
59723 + },
59724 + {
59725 + .procname = "socket_all_gid",
59726 + .data = &grsec_socket_all_gid,
59727 + .maxlen = sizeof(int),
59728 + .mode = 0600,
59729 + .proc_handler = &proc_dointvec,
59730 + },
59731 +#endif
59732 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59733 + {
59734 + .procname = "socket_client",
59735 + .data = &grsec_enable_socket_client,
59736 + .maxlen = sizeof(int),
59737 + .mode = 0600,
59738 + .proc_handler = &proc_dointvec,
59739 + },
59740 + {
59741 + .procname = "socket_client_gid",
59742 + .data = &grsec_socket_client_gid,
59743 + .maxlen = sizeof(int),
59744 + .mode = 0600,
59745 + .proc_handler = &proc_dointvec,
59746 + },
59747 +#endif
59748 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59749 + {
59750 + .procname = "socket_server",
59751 + .data = &grsec_enable_socket_server,
59752 + .maxlen = sizeof(int),
59753 + .mode = 0600,
59754 + .proc_handler = &proc_dointvec,
59755 + },
59756 + {
59757 + .procname = "socket_server_gid",
59758 + .data = &grsec_socket_server_gid,
59759 + .maxlen = sizeof(int),
59760 + .mode = 0600,
59761 + .proc_handler = &proc_dointvec,
59762 + },
59763 +#endif
59764 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59765 + {
59766 + .procname = "audit_group",
59767 + .data = &grsec_enable_group,
59768 + .maxlen = sizeof(int),
59769 + .mode = 0600,
59770 + .proc_handler = &proc_dointvec,
59771 + },
59772 + {
59773 + .procname = "audit_gid",
59774 + .data = &grsec_audit_gid,
59775 + .maxlen = sizeof(int),
59776 + .mode = 0600,
59777 + .proc_handler = &proc_dointvec,
59778 + },
59779 +#endif
59780 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59781 + {
59782 + .procname = "audit_chdir",
59783 + .data = &grsec_enable_chdir,
59784 + .maxlen = sizeof(int),
59785 + .mode = 0600,
59786 + .proc_handler = &proc_dointvec,
59787 + },
59788 +#endif
59789 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59790 + {
59791 + .procname = "audit_mount",
59792 + .data = &grsec_enable_mount,
59793 + .maxlen = sizeof(int),
59794 + .mode = 0600,
59795 + .proc_handler = &proc_dointvec,
59796 + },
59797 +#endif
59798 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59799 + {
59800 + .procname = "audit_textrel",
59801 + .data = &grsec_enable_audit_textrel,
59802 + .maxlen = sizeof(int),
59803 + .mode = 0600,
59804 + .proc_handler = &proc_dointvec,
59805 + },
59806 +#endif
59807 +#ifdef CONFIG_GRKERNSEC_DMESG
59808 + {
59809 + .procname = "dmesg",
59810 + .data = &grsec_enable_dmesg,
59811 + .maxlen = sizeof(int),
59812 + .mode = 0600,
59813 + .proc_handler = &proc_dointvec,
59814 + },
59815 +#endif
59816 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59817 + {
59818 + .procname = "chroot_findtask",
59819 + .data = &grsec_enable_chroot_findtask,
59820 + .maxlen = sizeof(int),
59821 + .mode = 0600,
59822 + .proc_handler = &proc_dointvec,
59823 + },
59824 +#endif
59825 +#ifdef CONFIG_GRKERNSEC_RESLOG
59826 + {
59827 + .procname = "resource_logging",
59828 + .data = &grsec_resource_logging,
59829 + .maxlen = sizeof(int),
59830 + .mode = 0600,
59831 + .proc_handler = &proc_dointvec,
59832 + },
59833 +#endif
59834 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59835 + {
59836 + .procname = "audit_ptrace",
59837 + .data = &grsec_enable_audit_ptrace,
59838 + .maxlen = sizeof(int),
59839 + .mode = 0600,
59840 + .proc_handler = &proc_dointvec,
59841 + },
59842 +#endif
59843 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59844 + {
59845 + .procname = "harden_ptrace",
59846 + .data = &grsec_enable_harden_ptrace,
59847 + .maxlen = sizeof(int),
59848 + .mode = 0600,
59849 + .proc_handler = &proc_dointvec,
59850 + },
59851 +#endif
59852 + {
59853 + .procname = "grsec_lock",
59854 + .data = &grsec_lock,
59855 + .maxlen = sizeof(int),
59856 + .mode = 0600,
59857 + .proc_handler = &proc_dointvec,
59858 + },
59859 +#endif
59860 +#ifdef CONFIG_GRKERNSEC_ROFS
59861 + {
59862 + .procname = "romount_protect",
59863 + .data = &grsec_enable_rofs,
59864 + .maxlen = sizeof(int),
59865 + .mode = 0600,
59866 + .proc_handler = &proc_dointvec_minmax,
59867 + .extra1 = &one,
59868 + .extra2 = &one,
59869 + },
59870 +#endif
59871 + { }
59872 +};
59873 +#endif
59874 diff -urNp linux-2.6.39.1/grsecurity/grsec_time.c linux-2.6.39.1/grsecurity/grsec_time.c
59875 --- linux-2.6.39.1/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
59876 +++ linux-2.6.39.1/grsecurity/grsec_time.c 2011-05-22 19:41:42.000000000 -0400
59877 @@ -0,0 +1,16 @@
59878 +#include <linux/kernel.h>
59879 +#include <linux/sched.h>
59880 +#include <linux/grinternal.h>
59881 +#include <linux/module.h>
59882 +
59883 +void
59884 +gr_log_timechange(void)
59885 +{
59886 +#ifdef CONFIG_GRKERNSEC_TIME
59887 + if (grsec_enable_time)
59888 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59889 +#endif
59890 + return;
59891 +}
59892 +
59893 +EXPORT_SYMBOL(gr_log_timechange);
59894 diff -urNp linux-2.6.39.1/grsecurity/grsec_tpe.c linux-2.6.39.1/grsecurity/grsec_tpe.c
59895 --- linux-2.6.39.1/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
59896 +++ linux-2.6.39.1/grsecurity/grsec_tpe.c 2011-05-22 19:41:42.000000000 -0400
59897 @@ -0,0 +1,39 @@
59898 +#include <linux/kernel.h>
59899 +#include <linux/sched.h>
59900 +#include <linux/file.h>
59901 +#include <linux/fs.h>
59902 +#include <linux/grinternal.h>
59903 +
59904 +extern int gr_acl_tpe_check(void);
59905 +
59906 +int
59907 +gr_tpe_allow(const struct file *file)
59908 +{
59909 +#ifdef CONFIG_GRKERNSEC
59910 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59911 + const struct cred *cred = current_cred();
59912 +
59913 + if (cred->uid && ((grsec_enable_tpe &&
59914 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59915 + ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59916 + (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59917 +#else
59918 + in_group_p(grsec_tpe_gid)
59919 +#endif
59920 + ) || gr_acl_tpe_check()) &&
59921 + (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59922 + (inode->i_mode & S_IWOTH))))) {
59923 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59924 + return 0;
59925 + }
59926 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59927 + if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59928 + ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59929 + (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59930 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59931 + return 0;
59932 + }
59933 +#endif
59934 +#endif
59935 + return 1;
59936 +}
59937 diff -urNp linux-2.6.39.1/grsecurity/grsum.c linux-2.6.39.1/grsecurity/grsum.c
59938 --- linux-2.6.39.1/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
59939 +++ linux-2.6.39.1/grsecurity/grsum.c 2011-05-22 19:41:42.000000000 -0400
59940 @@ -0,0 +1,61 @@
59941 +#include <linux/err.h>
59942 +#include <linux/kernel.h>
59943 +#include <linux/sched.h>
59944 +#include <linux/mm.h>
59945 +#include <linux/scatterlist.h>
59946 +#include <linux/crypto.h>
59947 +#include <linux/gracl.h>
59948 +
59949 +
59950 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59951 +#error "crypto and sha256 must be built into the kernel"
59952 +#endif
59953 +
59954 +int
59955 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59956 +{
59957 + char *p;
59958 + struct crypto_hash *tfm;
59959 + struct hash_desc desc;
59960 + struct scatterlist sg;
59961 + unsigned char temp_sum[GR_SHA_LEN];
59962 + volatile int retval = 0;
59963 + volatile int dummy = 0;
59964 + unsigned int i;
59965 +
59966 + sg_init_table(&sg, 1);
59967 +
59968 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59969 + if (IS_ERR(tfm)) {
59970 + /* should never happen, since sha256 should be built in */
59971 + return 1;
59972 + }
59973 +
59974 + desc.tfm = tfm;
59975 + desc.flags = 0;
59976 +
59977 + crypto_hash_init(&desc);
59978 +
59979 + p = salt;
59980 + sg_set_buf(&sg, p, GR_SALT_LEN);
59981 + crypto_hash_update(&desc, &sg, sg.length);
59982 +
59983 + p = entry->pw;
59984 + sg_set_buf(&sg, p, strlen(p));
59985 +
59986 + crypto_hash_update(&desc, &sg, sg.length);
59987 +
59988 + crypto_hash_final(&desc, temp_sum);
59989 +
59990 + memset(entry->pw, 0, GR_PW_LEN);
59991 +
59992 + for (i = 0; i < GR_SHA_LEN; i++)
59993 + if (sum[i] != temp_sum[i])
59994 + retval = 1;
59995 + else
59996 + dummy = 1; // waste a cycle
59997 +
59998 + crypto_free_hash(tfm);
59999 +
60000 + return retval;
60001 +}
60002 diff -urNp linux-2.6.39.1/grsecurity/Kconfig linux-2.6.39.1/grsecurity/Kconfig
60003 --- linux-2.6.39.1/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
60004 +++ linux-2.6.39.1/grsecurity/Kconfig 2011-06-13 21:34:34.000000000 -0400
60005 @@ -0,0 +1,1045 @@
60006 +#
60007 +# grecurity configuration
60008 +#
60009 +
60010 +menu "Grsecurity"
60011 +
60012 +config GRKERNSEC
60013 + bool "Grsecurity"
60014 + select CRYPTO
60015 + select CRYPTO_SHA256
60016 + help
60017 + If you say Y here, you will be able to configure many features
60018 + that will enhance the security of your system. It is highly
60019 + recommended that you say Y here and read through the help
60020 + for each option so that you fully understand the features and
60021 + can evaluate their usefulness for your machine.
60022 +
60023 +choice
60024 + prompt "Security Level"
60025 + depends on GRKERNSEC
60026 + default GRKERNSEC_CUSTOM
60027 +
60028 +config GRKERNSEC_LOW
60029 + bool "Low"
60030 + select GRKERNSEC_LINK
60031 + select GRKERNSEC_FIFO
60032 + select GRKERNSEC_EXECVE
60033 + select GRKERNSEC_RANDNET
60034 + select GRKERNSEC_DMESG
60035 + select GRKERNSEC_CHROOT
60036 + select GRKERNSEC_CHROOT_CHDIR
60037 +
60038 + help
60039 + If you choose this option, several of the grsecurity options will
60040 + be enabled that will give you greater protection against a number
60041 + of attacks, while assuring that none of your software will have any
60042 + conflicts with the additional security measures. If you run a lot
60043 + of unusual software, or you are having problems with the higher
60044 + security levels, you should say Y here. With this option, the
60045 + following features are enabled:
60046 +
60047 + - Linking restrictions
60048 + - FIFO restrictions
60049 + - Enforcing RLIMIT_NPROC on execve
60050 + - Restricted dmesg
60051 + - Enforced chdir("/") on chroot
60052 + - Runtime module disabling
60053 +
60054 +config GRKERNSEC_MEDIUM
60055 + bool "Medium"
60056 + select PAX
60057 + select PAX_EI_PAX
60058 + select PAX_PT_PAX_FLAGS
60059 + select PAX_HAVE_ACL_FLAGS
60060 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
60061 + select GRKERNSEC_CHROOT
60062 + select GRKERNSEC_CHROOT_SYSCTL
60063 + select GRKERNSEC_LINK
60064 + select GRKERNSEC_FIFO
60065 + select GRKERNSEC_EXECVE
60066 + select GRKERNSEC_DMESG
60067 + select GRKERNSEC_RANDNET
60068 + select GRKERNSEC_FORKFAIL
60069 + select GRKERNSEC_TIME
60070 + select GRKERNSEC_SIGNAL
60071 + select GRKERNSEC_CHROOT
60072 + select GRKERNSEC_CHROOT_UNIX
60073 + select GRKERNSEC_CHROOT_MOUNT
60074 + select GRKERNSEC_CHROOT_PIVOT
60075 + select GRKERNSEC_CHROOT_DOUBLE
60076 + select GRKERNSEC_CHROOT_CHDIR
60077 + select GRKERNSEC_CHROOT_MKNOD
60078 + select GRKERNSEC_PROC
60079 + select GRKERNSEC_PROC_USERGROUP
60080 + select PAX_RANDUSTACK
60081 + select PAX_ASLR
60082 + select PAX_RANDMMAP
60083 + select PAX_REFCOUNT if (X86 || SPARC64)
60084 + select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC) && (SLAB || SLUB || SLOB))
60085 +
60086 + help
60087 + If you say Y here, several features in addition to those included
60088 + in the low additional security level will be enabled. These
60089 + features provide even more security to your system, though in rare
60090 + cases they may be incompatible with very old or poorly written
60091 + software. If you enable this option, make sure that your auth
60092 + service (identd) is running as gid 1001. With this option,
60093 + the following features (in addition to those provided in the
60094 + low additional security level) will be enabled:
60095 +
60096 + - Failed fork logging
60097 + - Time change logging
60098 + - Signal logging
60099 + - Deny mounts in chroot
60100 + - Deny double chrooting
60101 + - Deny sysctl writes in chroot
60102 + - Deny mknod in chroot
60103 + - Deny access to abstract AF_UNIX sockets out of chroot
60104 + - Deny pivot_root in chroot
60105 + - Denied writes of /dev/kmem, /dev/mem, and /dev/port
60106 + - /proc restrictions with special GID set to 10 (usually wheel)
60107 + - Address Space Layout Randomization (ASLR)
60108 + - Prevent exploitation of most refcount overflows
60109 + - Bounds checking of copying between the kernel and userland
60110 +
60111 +config GRKERNSEC_HIGH
60112 + bool "High"
60113 + select GRKERNSEC_LINK
60114 + select GRKERNSEC_FIFO
60115 + select GRKERNSEC_EXECVE
60116 + select GRKERNSEC_DMESG
60117 + select GRKERNSEC_FORKFAIL
60118 + select GRKERNSEC_TIME
60119 + select GRKERNSEC_SIGNAL
60120 + select GRKERNSEC_CHROOT
60121 + select GRKERNSEC_CHROOT_SHMAT
60122 + select GRKERNSEC_CHROOT_UNIX
60123 + select GRKERNSEC_CHROOT_MOUNT
60124 + select GRKERNSEC_CHROOT_FCHDIR
60125 + select GRKERNSEC_CHROOT_PIVOT
60126 + select GRKERNSEC_CHROOT_DOUBLE
60127 + select GRKERNSEC_CHROOT_CHDIR
60128 + select GRKERNSEC_CHROOT_MKNOD
60129 + select GRKERNSEC_CHROOT_CAPS
60130 + select GRKERNSEC_CHROOT_SYSCTL
60131 + select GRKERNSEC_CHROOT_FINDTASK
60132 + select GRKERNSEC_SYSFS_RESTRICT
60133 + select GRKERNSEC_PROC
60134 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
60135 + select GRKERNSEC_HIDESYM
60136 + select GRKERNSEC_BRUTE
60137 + select GRKERNSEC_PROC_USERGROUP
60138 + select GRKERNSEC_KMEM
60139 + select GRKERNSEC_RESLOG
60140 + select GRKERNSEC_RANDNET
60141 + select GRKERNSEC_PROC_ADD
60142 + select GRKERNSEC_CHROOT_CHMOD
60143 + select GRKERNSEC_CHROOT_NICE
60144 + select GRKERNSEC_AUDIT_MOUNT
60145 + select GRKERNSEC_MODHARDEN if (MODULES)
60146 + select GRKERNSEC_HARDEN_PTRACE
60147 + select GRKERNSEC_VM86 if (X86_32)
60148 + select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC32 || SPARC64)
60149 + select PAX
60150 + select PAX_RANDUSTACK
60151 + select PAX_ASLR
60152 + select PAX_RANDMMAP
60153 + select PAX_NOEXEC
60154 + select PAX_MPROTECT
60155 + select PAX_EI_PAX
60156 + select PAX_PT_PAX_FLAGS
60157 + select PAX_HAVE_ACL_FLAGS
60158 + select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
60159 + select PAX_MEMORY_UDEREF if (X86 && !XEN)
60160 + select PAX_RANDKSTACK if (X86_TSC && X86)
60161 + select PAX_SEGMEXEC if (X86_32)
60162 + select PAX_PAGEEXEC
60163 + select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
60164 + select PAX_EMUTRAMP if (PARISC)
60165 + select PAX_EMUSIGRT if (PARISC)
60166 + select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
60167 + select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
60168 + select PAX_REFCOUNT if (X86 || SPARC64)
60169 + select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
60170 + help
60171 + If you say Y here, many of the features of grsecurity will be
60172 + enabled, which will protect you against many kinds of attacks
60173 + against your system. The heightened security comes at a cost
60174 + of an increased chance of incompatibilities with rare software
60175 + on your machine. Since this security level enables PaX, you should
60176 + view <http://pax.grsecurity.net> and read about the PaX
60177 + project. While you are there, download chpax and run it on
60178 + binaries that cause problems with PaX. Also remember that
60179 + since the /proc restrictions are enabled, you must run your
60180 + identd as gid 1001. This security level enables the following
60181 + features in addition to those listed in the low and medium
60182 + security levels:
60183 +
60184 + - Additional /proc restrictions
60185 + - Chmod restrictions in chroot
60186 + - No signals, ptrace, or viewing of processes outside of chroot
60187 + - Capability restrictions in chroot
60188 + - Deny fchdir out of chroot
60189 + - Priority restrictions in chroot
60190 + - Segmentation-based implementation of PaX
60191 + - Mprotect restrictions
60192 + - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
60193 + - Kernel stack randomization
60194 + - Mount/unmount/remount logging
60195 + - Kernel symbol hiding
60196 + - Prevention of memory exhaustion-based exploits
60197 + - Hardening of module auto-loading
60198 + - Ptrace restrictions
60199 + - Restricted vm86 mode
60200 + - Restricted sysfs/debugfs
60201 + - Active kernel exploit response
60202 +
60203 +config GRKERNSEC_CUSTOM
60204 + bool "Custom"
60205 + help
60206 + If you say Y here, you will be able to configure every grsecurity
60207 + option, which allows you to enable many more features that aren't
60208 + covered in the basic security levels. These additional features
60209 + include TPE, socket restrictions, and the sysctl system for
60210 + grsecurity. It is advised that you read through the help for
60211 + each option to determine its usefulness in your situation.
60212 +
60213 +endchoice
60214 +
60215 +menu "Address Space Protection"
60216 +depends on GRKERNSEC
60217 +
60218 +config GRKERNSEC_KMEM
60219 + bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
60220 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
60221 + help
60222 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
60223 + be written to via mmap or otherwise to modify the running kernel.
60224 + /dev/port will also not be allowed to be opened. If you have module
60225 + support disabled, enabling this will close up four ways that are
60226 + currently used to insert malicious code into the running kernel.
60227 + Even with all these features enabled, we still highly recommend that
60228 + you use the RBAC system, as it is still possible for an attacker to
60229 + modify the running kernel through privileged I/O granted by ioperm/iopl.
60230 + If you are not using XFree86, you may be able to stop this additional
60231 + case by enabling the 'Disable privileged I/O' option. Though nothing
60232 + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
60233 + but only to video memory, which is the only writing we allow in this
60234 + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
60235 + not be allowed to mprotect it with PROT_WRITE later.
60236 + It is highly recommended that you say Y here if you meet all the
60237 + conditions above.
60238 +
60239 +config GRKERNSEC_VM86
60240 + bool "Restrict VM86 mode"
60241 + depends on X86_32
60242 +
60243 + help
60244 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
60245 + make use of a special execution mode on 32bit x86 processors called
60246 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
60247 + video cards and will still work with this option enabled. The purpose
60248 + of the option is to prevent exploitation of emulation errors in
60249 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
60250 + Nearly all users should be able to enable this option.
60251 +
60252 +config GRKERNSEC_IO
60253 + bool "Disable privileged I/O"
60254 + depends on X86
60255 + select RTC_CLASS
60256 + select RTC_INTF_DEV
60257 + select RTC_DRV_CMOS
60258 +
60259 + help
60260 + If you say Y here, all ioperm and iopl calls will return an error.
60261 + Ioperm and iopl can be used to modify the running kernel.
60262 + Unfortunately, some programs need this access to operate properly,
60263 + the most notable of which are XFree86 and hwclock. hwclock can be
60264 + remedied by having RTC support in the kernel, so real-time
60265 + clock support is enabled if this option is enabled, to ensure
60266 + that hwclock operates correctly. XFree86 still will not
60267 + operate correctly with this option enabled, so DO NOT CHOOSE Y
60268 + IF YOU USE XFree86. If you use XFree86 and you still want to
60269 + protect your kernel against modification, use the RBAC system.
60270 +
60271 +config GRKERNSEC_PROC_MEMMAP
60272 + bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
60273 + default y if (PAX_NOEXEC || PAX_ASLR)
60274 + depends on PAX_NOEXEC || PAX_ASLR
60275 + help
60276 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
60277 + give no information about the addresses of its mappings if
60278 + PaX features that rely on random addresses are enabled on the task.
60279 + If you use PaX it is greatly recommended that you say Y here as it
60280 + closes up a hole that makes the full ASLR useless for suid
60281 + binaries.
60282 +
60283 +config GRKERNSEC_BRUTE
60284 + bool "Deter exploit bruteforcing"
60285 + help
60286 + If you say Y here, attempts to bruteforce exploits against forking
60287 + daemons such as apache or sshd, as well as against suid/sgid binaries
60288 + will be deterred. When a child of a forking daemon is killed by PaX
60289 + or crashes due to an illegal instruction or other suspicious signal,
60290 + the parent process will be delayed 30 seconds upon every subsequent
60291 + fork until the administrator is able to assess the situation and
60292 + restart the daemon.
60293 + In the suid/sgid case, the attempt is logged, the user has all their
60294 + processes terminated, and they are prevented from executing any further
60295 + processes for 15 minutes.
60296 + It is recommended that you also enable signal logging in the auditing
60297 + section so that logs are generated when a process triggers a suspicious
60298 + signal.
60299 +
60300 +config GRKERNSEC_MODHARDEN
60301 + bool "Harden module auto-loading"
60302 + depends on MODULES
60303 + help
60304 + If you say Y here, module auto-loading in response to use of some
60305 + feature implemented by an unloaded module will be restricted to
60306 + root users. Enabling this option helps defend against attacks
60307 + by unprivileged users who abuse the auto-loading behavior to
60308 + cause a vulnerable module to load that is then exploited.
60309 +
60310 + If this option prevents a legitimate use of auto-loading for a
60311 + non-root user, the administrator can execute modprobe manually
60312 + with the exact name of the module mentioned in the alert log.
60313 + Alternatively, the administrator can add the module to the list
60314 + of modules loaded at boot by modifying init scripts.
60315 +
60316 + Modification of init scripts will most likely be needed on
60317 + Ubuntu servers with encrypted home directory support enabled,
60318 + as the first non-root user logging in will cause the ecb(aes),
60319 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
60320 +
60321 +config GRKERNSEC_HIDESYM
60322 + bool "Hide kernel symbols"
60323 + help
60324 + If you say Y here, getting information on loaded modules, and
60325 + displaying all kernel symbols through a syscall will be restricted
60326 + to users with CAP_SYS_MODULE. For software compatibility reasons,
60327 + /proc/kallsyms will be restricted to the root user. The RBAC
60328 + system can hide that entry even from root.
60329 +
60330 + This option also prevents leaking of kernel addresses through
60331 + several /proc entries.
60332 +
60333 + Note that this option is only effective provided the following
60334 + conditions are met:
60335 + 1) The kernel using grsecurity is not precompiled by some distribution
60336 + 2) You have also enabled GRKERNSEC_DMESG
60337 + 3) You are using the RBAC system and hiding other files such as your
60338 + kernel image and System.map. Alternatively, enabling this option
60339 + causes the permissions on /boot, /lib/modules, and the kernel
60340 + source directory to change at compile time to prevent
60341 + reading by non-root users.
60342 + If the above conditions are met, this option will aid in providing a
60343 + useful protection against local kernel exploitation of overflows
60344 + and arbitrary read/write vulnerabilities.
60345 +
60346 +config GRKERNSEC_KERN_LOCKOUT
60347 + bool "Active kernel exploit response"
60348 + depends on X86 || ARM || PPC || SPARC32 || SPARC64
60349 + help
60350 + If you say Y here, when a PaX alert is triggered due to suspicious
60351 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
60352 + or an OOPs occurs due to bad memory accesses, instead of just
60353 + terminating the offending process (and potentially allowing
60354 + a subsequent exploit from the same user), we will take one of two
60355 + actions:
60356 + If the user was root, we will panic the system
60357 + If the user was non-root, we will log the attempt, terminate
60358 + all processes owned by the user, then prevent them from creating
60359 + any new processes until the system is restarted
60360 + This deters repeated kernel exploitation/bruteforcing attempts
60361 + and is useful for later forensics.
60362 +
60363 +endmenu
60364 +menu "Role Based Access Control Options"
60365 +depends on GRKERNSEC
60366 +
60367 +config GRKERNSEC_RBAC_DEBUG
60368 + bool
60369 +
60370 +config GRKERNSEC_NO_RBAC
60371 + bool "Disable RBAC system"
60372 + help
60373 + If you say Y here, the /dev/grsec device will be removed from the kernel,
60374 + preventing the RBAC system from being enabled. You should only say Y
60375 + here if you have no intention of using the RBAC system, so as to prevent
60376 + an attacker with root access from misusing the RBAC system to hide files
60377 + and processes when loadable module support and /dev/[k]mem have been
60378 + locked down.
60379 +
60380 +config GRKERNSEC_ACL_HIDEKERN
60381 + bool "Hide kernel processes"
60382 + help
60383 + If you say Y here, all kernel threads will be hidden to all
60384 + processes but those whose subject has the "view hidden processes"
60385 + flag.
60386 +
60387 +config GRKERNSEC_ACL_MAXTRIES
60388 + int "Maximum tries before password lockout"
60389 + default 3
60390 + help
60391 + This option enforces the maximum number of times a user can attempt
60392 + to authorize themselves with the grsecurity RBAC system before being
60393 + denied the ability to attempt authorization again for a specified time.
60394 + The lower the number, the harder it will be to brute-force a password.
60395 +
60396 +config GRKERNSEC_ACL_TIMEOUT
60397 + int "Time to wait after max password tries, in seconds"
60398 + default 30
60399 + help
60400 + This option specifies the time the user must wait after attempting to
60401 + authorize to the RBAC system with the maximum number of invalid
60402 + passwords. The higher the number, the harder it will be to brute-force
60403 + a password.
60404 +
60405 +endmenu
60406 +menu "Filesystem Protections"
60407 +depends on GRKERNSEC
60408 +
60409 +config GRKERNSEC_PROC
60410 + bool "Proc restrictions"
60411 + help
60412 + If you say Y here, the permissions of the /proc filesystem
60413 + will be altered to enhance system security and privacy. You MUST
60414 + choose either a user only restriction or a user and group restriction.
60415 + Depending upon the option you choose, you can either restrict users to
60416 + see only the processes they themselves run, or choose a group that can
60417 + view all processes and files normally restricted to root if you choose
60418 + the "restrict to user only" option. NOTE: If you're running identd as
60419 + a non-root user, you will have to run it as the group you specify here.
60420 +
60421 +config GRKERNSEC_PROC_USER
60422 + bool "Restrict /proc to user only"
60423 + depends on GRKERNSEC_PROC
60424 + help
60425 + If you say Y here, non-root users will only be able to view their own
60426 + processes, and restricts them from viewing network-related information,
60427 + and viewing kernel symbol and module information.
60428 +
60429 +config GRKERNSEC_PROC_USERGROUP
60430 + bool "Allow special group"
60431 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
60432 + help
60433 + If you say Y here, you will be able to select a group that will be
60434 + able to view all processes and network-related information. If you've
60435 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
60436 + remain hidden. This option is useful if you want to run identd as
60437 + a non-root user.
60438 +
60439 +config GRKERNSEC_PROC_GID
60440 + int "GID for special group"
60441 + depends on GRKERNSEC_PROC_USERGROUP
60442 + default 1001
60443 +
60444 +config GRKERNSEC_PROC_ADD
60445 + bool "Additional restrictions"
60446 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
60447 + help
60448 + If you say Y here, additional restrictions will be placed on
60449 + /proc that keep normal users from viewing device information and
60450 + slabinfo information that could be useful for exploits.
60451 +
60452 +config GRKERNSEC_LINK
60453 + bool "Linking restrictions"
60454 + help
60455 + If you say Y here, /tmp race exploits will be prevented, since users
60456 + will no longer be able to follow symlinks owned by other users in
60457 + world-writable +t directories (e.g. /tmp), unless the owner of the
60458 + symlink is the owner of the directory. users will also not be
60459 + able to hardlink to files they do not own. If the sysctl option is
60460 + enabled, a sysctl option with name "linking_restrictions" is created.
60461 +
60462 +config GRKERNSEC_FIFO
60463 + bool "FIFO restrictions"
60464 + help
60465 + If you say Y here, users will not be able to write to FIFOs they don't
60466 + own in world-writable +t directories (e.g. /tmp), unless the owner of
60467 + the FIFO is the same owner of the directory it's held in. If the sysctl
60468 + option is enabled, a sysctl option with name "fifo_restrictions" is
60469 + created.
60470 +
60471 +config GRKERNSEC_SYSFS_RESTRICT
60472 + bool "Sysfs/debugfs restriction"
60473 + depends on SYSFS
60474 + help
60475 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
60476 + any filesystem normally mounted under it (e.g. debugfs) will only
60477 + be accessible by root. These filesystems generally provide access
60478 + to hardware and debug information that isn't appropriate for unprivileged
60479 + users of the system. Sysfs and debugfs have also become a large source
60480 + of new vulnerabilities, ranging from infoleaks to local compromise.
60481 + There has been very little oversight with an eye toward security involved
60482 + in adding new exporters of information to these filesystems, so their
60483 + use is discouraged.
60484 + This option is equivalent to a chmod 0700 of the mount paths.
60485 +
60486 +config GRKERNSEC_ROFS
60487 + bool "Runtime read-only mount protection"
60488 + help
60489 + If you say Y here, a sysctl option with name "romount_protect" will
60490 + be created. By setting this option to 1 at runtime, filesystems
60491 + will be protected in the following ways:
60492 + * No new writable mounts will be allowed
60493 + * Existing read-only mounts won't be able to be remounted read/write
60494 + * Write operations will be denied on all block devices
60495 + This option acts independently of grsec_lock: once it is set to 1,
60496 + it cannot be turned off. Therefore, please be mindful of the resulting
60497 + behavior if this option is enabled in an init script on a read-only
60498 + filesystem. This feature is mainly intended for secure embedded systems.
60499 +
60500 +config GRKERNSEC_CHROOT
60501 + bool "Chroot jail restrictions"
60502 + help
60503 + If you say Y here, you will be able to choose several options that will
60504 + make breaking out of a chrooted jail much more difficult. If you
60505 + encounter no software incompatibilities with the following options, it
60506 + is recommended that you enable each one.
60507 +
60508 +config GRKERNSEC_CHROOT_MOUNT
60509 + bool "Deny mounts"
60510 + depends on GRKERNSEC_CHROOT
60511 + help
60512 + If you say Y here, processes inside a chroot will not be able to
60513 + mount or remount filesystems. If the sysctl option is enabled, a
60514 + sysctl option with name "chroot_deny_mount" is created.
60515 +
60516 +config GRKERNSEC_CHROOT_DOUBLE
60517 + bool "Deny double-chroots"
60518 + depends on GRKERNSEC_CHROOT
60519 + help
60520 + If you say Y here, processes inside a chroot will not be able to chroot
60521 + again outside the chroot. This is a widely used method of breaking
60522 + out of a chroot jail and should not be allowed. If the sysctl
60523 + option is enabled, a sysctl option with name
60524 + "chroot_deny_chroot" is created.
60525 +
60526 +config GRKERNSEC_CHROOT_PIVOT
60527 + bool "Deny pivot_root in chroot"
60528 + depends on GRKERNSEC_CHROOT
60529 + help
60530 + If you say Y here, processes inside a chroot will not be able to use
60531 + a function called pivot_root() that was introduced in Linux 2.3.41. It
60532 + works similar to chroot in that it changes the root filesystem. This
60533 + function could be misused in a chrooted process to attempt to break out
60534 + of the chroot, and therefore should not be allowed. If the sysctl
60535 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
60536 + created.
60537 +
60538 +config GRKERNSEC_CHROOT_CHDIR
60539 + bool "Enforce chdir(\"/\") on all chroots"
60540 + depends on GRKERNSEC_CHROOT
60541 + help
60542 + If you say Y here, the current working directory of all newly-chrooted
60543 + applications will be set to the the root directory of the chroot.
60544 + The man page on chroot(2) states:
60545 + Note that this call does not change the current working
60546 + directory, so that `.' can be outside the tree rooted at
60547 + `/'. In particular, the super-user can escape from a
60548 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
60549 +
60550 + It is recommended that you say Y here, since it's not known to break
60551 + any software. If the sysctl option is enabled, a sysctl option with
60552 + name "chroot_enforce_chdir" is created.
60553 +
60554 +config GRKERNSEC_CHROOT_CHMOD
60555 + bool "Deny (f)chmod +s"
60556 + depends on GRKERNSEC_CHROOT
60557 + help
60558 + If you say Y here, processes inside a chroot will not be able to chmod
60559 + or fchmod files to make them have suid or sgid bits. This protects
60560 + against another published method of breaking a chroot. If the sysctl
60561 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
60562 + created.
60563 +
60564 +config GRKERNSEC_CHROOT_FCHDIR
60565 + bool "Deny fchdir out of chroot"
60566 + depends on GRKERNSEC_CHROOT
60567 + help
60568 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
60569 + to a file descriptor of the chrooting process that points to a directory
60570 + outside the filesystem will be stopped. If the sysctl option
60571 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
60572 +
60573 +config GRKERNSEC_CHROOT_MKNOD
60574 + bool "Deny mknod"
60575 + depends on GRKERNSEC_CHROOT
60576 + help
60577 + If you say Y here, processes inside a chroot will not be allowed to
60578 + mknod. The problem with using mknod inside a chroot is that it
60579 + would allow an attacker to create a device entry that is the same
60580 + as one on the physical root of your system, which could range from
60581 + anything from the console device to a device for your harddrive (which
60582 + they could then use to wipe the drive or steal data). It is recommended
60583 + that you say Y here, unless you run into software incompatibilities.
60584 + If the sysctl option is enabled, a sysctl option with name
60585 + "chroot_deny_mknod" is created.
60586 +
60587 +config GRKERNSEC_CHROOT_SHMAT
60588 + bool "Deny shmat() out of chroot"
60589 + depends on GRKERNSEC_CHROOT
60590 + help
60591 + If you say Y here, processes inside a chroot will not be able to attach
60592 + to shared memory segments that were created outside of the chroot jail.
60593 + It is recommended that you say Y here. If the sysctl option is enabled,
60594 + a sysctl option with name "chroot_deny_shmat" is created.
60595 +
60596 +config GRKERNSEC_CHROOT_UNIX
60597 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
60598 + depends on GRKERNSEC_CHROOT
60599 + help
60600 + If you say Y here, processes inside a chroot will not be able to
60601 + connect to abstract (meaning not belonging to a filesystem) Unix
60602 + domain sockets that were bound outside of a chroot. It is recommended
60603 + that you say Y here. If the sysctl option is enabled, a sysctl option
60604 + with name "chroot_deny_unix" is created.
60605 +
60606 +config GRKERNSEC_CHROOT_FINDTASK
60607 + bool "Protect outside processes"
60608 + depends on GRKERNSEC_CHROOT
60609 + help
60610 + If you say Y here, processes inside a chroot will not be able to
60611 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
60612 + getsid, or view any process outside of the chroot. If the sysctl
60613 + option is enabled, a sysctl option with name "chroot_findtask" is
60614 + created.
60615 +
60616 +config GRKERNSEC_CHROOT_NICE
60617 + bool "Restrict priority changes"
60618 + depends on GRKERNSEC_CHROOT
60619 + help
60620 + If you say Y here, processes inside a chroot will not be able to raise
60621 + the priority of processes in the chroot, or alter the priority of
60622 + processes outside the chroot. This provides more security than simply
60623 + removing CAP_SYS_NICE from the process' capability set. If the
60624 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
60625 + is created.
60626 +
60627 +config GRKERNSEC_CHROOT_SYSCTL
60628 + bool "Deny sysctl writes"
60629 + depends on GRKERNSEC_CHROOT
60630 + help
60631 + If you say Y here, an attacker in a chroot will not be able to
60632 + write to sysctl entries, either by sysctl(2) or through a /proc
60633 + interface. It is strongly recommended that you say Y here. If the
60634 + sysctl option is enabled, a sysctl option with name
60635 + "chroot_deny_sysctl" is created.
60636 +
60637 +config GRKERNSEC_CHROOT_CAPS
60638 + bool "Capability restrictions"
60639 + depends on GRKERNSEC_CHROOT
60640 + help
60641 + If you say Y here, the capabilities on all root processes within a
60642 + chroot jail will be lowered to stop module insertion, raw i/o,
60643 + system and net admin tasks, rebooting the system, modifying immutable
60644 + files, modifying IPC owned by another, and changing the system time.
60645 + This is left an option because it can break some apps. Disable this
60646 + if your chrooted apps are having problems performing those kinds of
60647 + tasks. If the sysctl option is enabled, a sysctl option with
60648 + name "chroot_caps" is created.
60649 +
60650 +endmenu
60651 +menu "Kernel Auditing"
60652 +depends on GRKERNSEC
60653 +
60654 +config GRKERNSEC_AUDIT_GROUP
60655 + bool "Single group for auditing"
60656 + help
60657 + If you say Y here, the exec, chdir, and (un)mount logging features
60658 + will only operate on a group you specify. This option is recommended
60659 + if you only want to watch certain users instead of having a large
60660 + amount of logs from the entire system. If the sysctl option is enabled,
60661 + a sysctl option with name "audit_group" is created.
60662 +
60663 +config GRKERNSEC_AUDIT_GID
60664 + int "GID for auditing"
60665 + depends on GRKERNSEC_AUDIT_GROUP
60666 + default 1007
60667 +
60668 +config GRKERNSEC_EXECLOG
60669 + bool "Exec logging"
60670 + help
60671 + If you say Y here, all execve() calls will be logged (since the
60672 + other exec*() calls are frontends to execve(), all execution
60673 + will be logged). Useful for shell-servers that like to keep track
60674 + of their users. If the sysctl option is enabled, a sysctl option with
60675 + name "exec_logging" is created.
60676 + WARNING: This option when enabled will produce a LOT of logs, especially
60677 + on an active system.
60678 +
60679 +config GRKERNSEC_RESLOG
60680 + bool "Resource logging"
60681 + help
60682 + If you say Y here, all attempts to overstep resource limits will
60683 + be logged with the resource name, the requested size, and the current
60684 + limit. It is highly recommended that you say Y here. If the sysctl
60685 + option is enabled, a sysctl option with name "resource_logging" is
60686 + created. If the RBAC system is enabled, the sysctl value is ignored.
60687 +
60688 +config GRKERNSEC_CHROOT_EXECLOG
60689 + bool "Log execs within chroot"
60690 + help
60691 + If you say Y here, all executions inside a chroot jail will be logged
60692 + to syslog. This can cause a large amount of logs if certain
60693 + applications (eg. djb's daemontools) are installed on the system, and
60694 + is therefore left as an option. If the sysctl option is enabled, a
60695 + sysctl option with name "chroot_execlog" is created.
60696 +
60697 +config GRKERNSEC_AUDIT_PTRACE
60698 + bool "Ptrace logging"
60699 + help
60700 + If you say Y here, all attempts to attach to a process via ptrace
60701 + will be logged. If the sysctl option is enabled, a sysctl option
60702 + with name "audit_ptrace" is created.
60703 +
60704 +config GRKERNSEC_AUDIT_CHDIR
60705 + bool "Chdir logging"
60706 + help
60707 + If you say Y here, all chdir() calls will be logged. If the sysctl
60708 + option is enabled, a sysctl option with name "audit_chdir" is created.
60709 +
60710 +config GRKERNSEC_AUDIT_MOUNT
60711 + bool "(Un)Mount logging"
60712 + help
60713 + If you say Y here, all mounts and unmounts will be logged. If the
60714 + sysctl option is enabled, a sysctl option with name "audit_mount" is
60715 + created.
60716 +
60717 +config GRKERNSEC_SIGNAL
60718 + bool "Signal logging"
60719 + help
60720 + If you say Y here, certain important signals will be logged, such as
60721 + SIGSEGV, which will as a result inform you of when a error in a program
60722 + occurred, which in some cases could mean a possible exploit attempt.
60723 + If the sysctl option is enabled, a sysctl option with name
60724 + "signal_logging" is created.
60725 +
60726 +config GRKERNSEC_FORKFAIL
60727 + bool "Fork failure logging"
60728 + help
60729 + If you say Y here, all failed fork() attempts will be logged.
60730 + This could suggest a fork bomb, or someone attempting to overstep
60731 + their process limit. If the sysctl option is enabled, a sysctl option
60732 + with name "forkfail_logging" is created.
60733 +
60734 +config GRKERNSEC_TIME
60735 + bool "Time change logging"
60736 + help
60737 + If you say Y here, any changes of the system clock will be logged.
60738 + If the sysctl option is enabled, a sysctl option with name
60739 + "timechange_logging" is created.
60740 +
60741 +config GRKERNSEC_PROC_IPADDR
60742 + bool "/proc/<pid>/ipaddr support"
60743 + help
60744 + If you say Y here, a new entry will be added to each /proc/<pid>
60745 + directory that contains the IP address of the person using the task.
60746 + The IP is carried across local TCP and AF_UNIX stream sockets.
60747 + This information can be useful for IDS/IPSes to perform remote response
60748 + to a local attack. The entry is readable by only the owner of the
60749 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
60750 + the RBAC system), and thus does not create privacy concerns.
60751 +
60752 +config GRKERNSEC_RWXMAP_LOG
60753 + bool 'Denied RWX mmap/mprotect logging'
60754 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
60755 + help
60756 + If you say Y here, calls to mmap() and mprotect() with explicit
60757 + usage of PROT_WRITE and PROT_EXEC together will be logged when
60758 + denied by the PAX_MPROTECT feature. If the sysctl option is
60759 + enabled, a sysctl option with name "rwxmap_logging" is created.
60760 +
60761 +config GRKERNSEC_AUDIT_TEXTREL
60762 + bool 'ELF text relocations logging (READ HELP)'
60763 + depends on PAX_MPROTECT
60764 + help
60765 + If you say Y here, text relocations will be logged with the filename
60766 + of the offending library or binary. The purpose of the feature is
60767 + to help Linux distribution developers get rid of libraries and
60768 + binaries that need text relocations which hinder the future progress
60769 + of PaX. Only Linux distribution developers should say Y here, and
60770 + never on a production machine, as this option creates an information
60771 + leak that could aid an attacker in defeating the randomization of
60772 + a single memory region. If the sysctl option is enabled, a sysctl
60773 + option with name "audit_textrel" is created.
60774 +
60775 +endmenu
60776 +
60777 +menu "Executable Protections"
60778 +depends on GRKERNSEC
60779 +
60780 +config GRKERNSEC_EXECVE
60781 + bool "Enforce RLIMIT_NPROC on execs"
60782 + help
60783 + If you say Y here, users with a resource limit on processes will
60784 + have the value checked during execve() calls. The current system
60785 + only checks the system limit during fork() calls. If the sysctl option
60786 + is enabled, a sysctl option with name "execve_limiting" is created.
60787 +
60788 +config GRKERNSEC_DMESG
60789 + bool "Dmesg(8) restriction"
60790 + help
60791 + If you say Y here, non-root users will not be able to use dmesg(8)
60792 + to view up to the last 4kb of messages in the kernel's log buffer.
60793 + The kernel's log buffer often contains kernel addresses and other
60794 + identifying information useful to an attacker in fingerprinting a
60795 + system for a targeted exploit.
60796 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
60797 + created.
60798 +
60799 +config GRKERNSEC_HARDEN_PTRACE
60800 + bool "Deter ptrace-based process snooping"
60801 + help
60802 + If you say Y here, TTY sniffers and other malicious monitoring
60803 + programs implemented through ptrace will be defeated. If you
60804 + have been using the RBAC system, this option has already been
60805 + enabled for several years for all users, with the ability to make
60806 + fine-grained exceptions.
60807 +
60808 + This option only affects the ability of non-root users to ptrace
60809 + processes that are not a descendent of the ptracing process.
60810 + This means that strace ./binary and gdb ./binary will still work,
60811 + but attaching to arbitrary processes will not. If the sysctl
60812 + option is enabled, a sysctl option with name "harden_ptrace" is
60813 + created.
60814 +
60815 +config GRKERNSEC_TPE
60816 + bool "Trusted Path Execution (TPE)"
60817 + help
60818 + If you say Y here, you will be able to choose a gid to add to the
60819 + supplementary groups of users you want to mark as "untrusted."
60820 + These users will not be able to execute any files that are not in
60821 + root-owned directories writable only by root. If the sysctl option
60822 + is enabled, a sysctl option with name "tpe" is created.
60823 +
60824 +config GRKERNSEC_TPE_ALL
60825 + bool "Partially restrict all non-root users"
60826 + depends on GRKERNSEC_TPE
60827 + help
60828 + If you say Y here, all non-root users will be covered under
60829 + a weaker TPE restriction. This is separate from, and in addition to,
60830 + the main TPE options that you have selected elsewhere. Thus, if a
60831 + "trusted" GID is chosen, this restriction applies to even that GID.
60832 + Under this restriction, all non-root users will only be allowed to
60833 + execute files in directories they own that are not group or
60834 + world-writable, or in directories owned by root and writable only by
60835 + root. If the sysctl option is enabled, a sysctl option with name
60836 + "tpe_restrict_all" is created.
60837 +
60838 +config GRKERNSEC_TPE_INVERT
60839 + bool "Invert GID option"
60840 + depends on GRKERNSEC_TPE
60841 + help
60842 + If you say Y here, the group you specify in the TPE configuration will
60843 + decide what group TPE restrictions will be *disabled* for. This
60844 + option is useful if you want TPE restrictions to be applied to most
60845 + users on the system. If the sysctl option is enabled, a sysctl option
60846 + with name "tpe_invert" is created. Unlike other sysctl options, this
60847 + entry will default to on for backward-compatibility.
60848 +
60849 +config GRKERNSEC_TPE_GID
60850 + int "GID for untrusted users"
60851 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
60852 + default 1005
60853 + help
60854 + Setting this GID determines what group TPE restrictions will be
60855 + *enabled* for. If the sysctl option is enabled, a sysctl option
60856 + with name "tpe_gid" is created.
60857 +
60858 +config GRKERNSEC_TPE_GID
60859 + int "GID for trusted users"
60860 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
60861 + default 1005
60862 + help
60863 + Setting this GID determines what group TPE restrictions will be
60864 + *disabled* for. If the sysctl option is enabled, a sysctl option
60865 + with name "tpe_gid" is created.
60866 +
60867 +endmenu
60868 +menu "Network Protections"
60869 +depends on GRKERNSEC
60870 +
60871 +config GRKERNSEC_RANDNET
60872 + bool "Larger entropy pools"
60873 + help
60874 + If you say Y here, the entropy pools used for many features of Linux
60875 + and grsecurity will be doubled in size. Since several grsecurity
60876 + features use additional randomness, it is recommended that you say Y
60877 + here. Saying Y here has a similar effect as modifying
60878 + /proc/sys/kernel/random/poolsize.
60879 +
60880 +config GRKERNSEC_BLACKHOLE
60881 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
60882 + help
60883 + If you say Y here, neither TCP resets nor ICMP
60884 + destination-unreachable packets will be sent in response to packets
60885 + sent to ports for which no associated listening process exists.
60886 + This feature supports both IPV4 and IPV6 and exempts the
60887 + loopback interface from blackholing. Enabling this feature
60888 + makes a host more resilient to DoS attacks and reduces network
60889 + visibility against scanners.
60890 +
60891 + The blackhole feature as-implemented is equivalent to the FreeBSD
60892 + blackhole feature, as it prevents RST responses to all packets, not
60893 + just SYNs. Under most application behavior this causes no
60894 + problems, but applications (like haproxy) may not close certain
60895 + connections in a way that cleanly terminates them on the remote
60896 + end, leaving the remote host in LAST_ACK state. Because of this
60897 + side-effect and to prevent intentional LAST_ACK DoSes, this
60898 + feature also adds automatic mitigation against such attacks.
60899 + The mitigation drastically reduces the amount of time a socket
60900 + can spend in LAST_ACK state. If you're using haproxy and not
60901 + all servers it connects to have this option enabled, consider
60902 + disabling this feature on the haproxy host.
60903 +
60904 + If the sysctl option is enabled, two sysctl options with names
60905 + "ip_blackhole" and "lastack_retries" will be created.
60906 + While "ip_blackhole" takes the standard zero/non-zero on/off
60907 + toggle, "lastack_retries" uses the same kinds of values as
60908 + "tcp_retries1" and "tcp_retries2". The default value of 4
60909 + prevents a socket from lasting more than 45 seconds in LAST_ACK
60910 + state.
60911 +
60912 +config GRKERNSEC_SOCKET
60913 + bool "Socket restrictions"
60914 + help
60915 + If you say Y here, you will be able to choose from several options.
60916 + If you assign a GID on your system and add it to the supplementary
60917 + groups of users you want to restrict socket access to, this patch
60918 + will perform up to three things, based on the option(s) you choose.
60919 +
60920 +config GRKERNSEC_SOCKET_ALL
60921 + bool "Deny any sockets to group"
60922 + depends on GRKERNSEC_SOCKET
60923 + help
60924 + If you say Y here, you will be able to choose a GID of whose users will
60925 + be unable to connect to other hosts from your machine or run server
60926 + applications from your machine. If the sysctl option is enabled, a
60927 + sysctl option with name "socket_all" is created.
60928 +
60929 +config GRKERNSEC_SOCKET_ALL_GID
60930 + int "GID to deny all sockets for"
60931 + depends on GRKERNSEC_SOCKET_ALL
60932 + default 1004
60933 + help
60934 + Here you can choose the GID to disable socket access for. Remember to
60935 + add the users you want socket access disabled for to the GID
60936 + specified here. If the sysctl option is enabled, a sysctl option
60937 + with name "socket_all_gid" is created.
60938 +
60939 +config GRKERNSEC_SOCKET_CLIENT
60940 + bool "Deny client sockets to group"
60941 + depends on GRKERNSEC_SOCKET
60942 + help
60943 + If you say Y here, you will be able to choose a GID of whose users will
60944 + be unable to connect to other hosts from your machine, but will be
60945 + able to run servers. If this option is enabled, all users in the group
60946 + you specify will have to use passive mode when initiating ftp transfers
60947 + from the shell on your machine. If the sysctl option is enabled, a
60948 + sysctl option with name "socket_client" is created.
60949 +
60950 +config GRKERNSEC_SOCKET_CLIENT_GID
60951 + int "GID to deny client sockets for"
60952 + depends on GRKERNSEC_SOCKET_CLIENT
60953 + default 1003
60954 + help
60955 + Here you can choose the GID to disable client socket access for.
60956 + Remember to add the users you want client socket access disabled for to
60957 + the GID specified here. If the sysctl option is enabled, a sysctl
60958 + option with name "socket_client_gid" is created.
60959 +
60960 +config GRKERNSEC_SOCKET_SERVER
60961 + bool "Deny server sockets to group"
60962 + depends on GRKERNSEC_SOCKET
60963 + help
60964 + If you say Y here, you will be able to choose a GID of whose users will
60965 + be unable to run server applications from your machine. If the sysctl
60966 + option is enabled, a sysctl option with name "socket_server" is created.
60967 +
60968 +config GRKERNSEC_SOCKET_SERVER_GID
60969 + int "GID to deny server sockets for"
60970 + depends on GRKERNSEC_SOCKET_SERVER
60971 + default 1002
60972 + help
60973 + Here you can choose the GID to disable server socket access for.
60974 + Remember to add the users you want server socket access disabled for to
60975 + the GID specified here. If the sysctl option is enabled, a sysctl
60976 + option with name "socket_server_gid" is created.
60977 +
60978 +endmenu
60979 +menu "Sysctl support"
60980 +depends on GRKERNSEC && SYSCTL
60981 +
60982 +config GRKERNSEC_SYSCTL
60983 + bool "Sysctl support"
60984 + help
60985 + If you say Y here, you will be able to change the options that
60986 + grsecurity runs with at bootup, without having to recompile your
60987 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
60988 + to enable (1) or disable (0) various features. All the sysctl entries
60989 + are mutable until the "grsec_lock" entry is set to a non-zero value.
60990 + All features enabled in the kernel configuration are disabled at boot
60991 + if you do not say Y to the "Turn on features by default" option.
60992 + All options should be set at startup, and the grsec_lock entry should
60993 + be set to a non-zero value after all the options are set.
60994 + *THIS IS EXTREMELY IMPORTANT*
60995 +
60996 +config GRKERNSEC_SYSCTL_DISTRO
60997 + bool "Extra sysctl support for distro makers (READ HELP)"
60998 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
60999 + help
61000 + If you say Y here, additional sysctl options will be created
61001 + for features that affect processes running as root. Therefore,
61002 + it is critical when using this option that the grsec_lock entry be
61003 + enabled after boot. Only distros with prebuilt kernel packages
61004 + with this option enabled that can ensure grsec_lock is enabled
61005 + after boot should use this option.
61006 + *Failure to set grsec_lock after boot makes all grsec features
61007 + this option covers useless*
61008 +
61009 + Currently this option creates the following sysctl entries:
61010 + "Disable Privileged I/O": "disable_priv_io"
61011 +
61012 +config GRKERNSEC_SYSCTL_ON
61013 + bool "Turn on features by default"
61014 + depends on GRKERNSEC_SYSCTL
61015 + help
61016 + If you say Y here, instead of having all features enabled in the
61017 + kernel configuration disabled at boot time, the features will be
61018 + enabled at boot time. It is recommended you say Y here unless
61019 + there is some reason you would want all sysctl-tunable features to
61020 + be disabled by default. As mentioned elsewhere, it is important
61021 + to enable the grsec_lock entry once you have finished modifying
61022 + the sysctl entries.
61023 +
61024 +endmenu
61025 +menu "Logging Options"
61026 +depends on GRKERNSEC
61027 +
61028 +config GRKERNSEC_FLOODTIME
61029 + int "Seconds in between log messages (minimum)"
61030 + default 10
61031 + help
61032 + This option allows you to enforce the number of seconds between
61033 + grsecurity log messages. The default should be suitable for most
61034 + people, however, if you choose to change it, choose a value small enough
61035 + to allow informative logs to be produced, but large enough to
61036 + prevent flooding.
61037 +
61038 +config GRKERNSEC_FLOODBURST
61039 + int "Number of messages in a burst (maximum)"
61040 + default 4
61041 + help
61042 + This option allows you to choose the maximum number of messages allowed
61043 + within the flood time interval you chose in a separate option. The
61044 + default should be suitable for most people, however if you find that
61045 + many of your logs are being interpreted as flooding, you may want to
61046 + raise this value.
61047 +
61048 +endmenu
61049 +
61050 +endmenu
61051 diff -urNp linux-2.6.39.1/grsecurity/Makefile linux-2.6.39.1/grsecurity/Makefile
61052 --- linux-2.6.39.1/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
61053 +++ linux-2.6.39.1/grsecurity/Makefile 2011-05-24 20:26:54.000000000 -0400
61054 @@ -0,0 +1,33 @@
61055 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
61056 +# during 2001-2009 it has been completely redesigned by Brad Spengler
61057 +# into an RBAC system
61058 +#
61059 +# All code in this directory and various hooks inserted throughout the kernel
61060 +# are copyright Brad Spengler - Open Source Security, Inc., and released
61061 +# under the GPL v2 or higher
61062 +
61063 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
61064 + grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
61065 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
61066 +
61067 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
61068 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
61069 + gracl_learn.o grsec_log.o
61070 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
61071 +
61072 +ifdef CONFIG_NET
61073 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
61074 +endif
61075 +
61076 +ifndef CONFIG_GRKERNSEC
61077 +obj-y += grsec_disabled.o
61078 +endif
61079 +
61080 +ifdef CONFIG_GRKERNSEC_HIDESYM
61081 +extra-y := grsec_hidesym.o
61082 +$(obj)/grsec_hidesym.o:
61083 + @-chmod -f 500 /boot
61084 + @-chmod -f 500 /lib/modules
61085 + @-chmod -f 700 .
61086 + @echo ' grsec: protected kernel image paths'
61087 +endif
61088 diff -urNp linux-2.6.39.1/include/acpi/acpi_drivers.h linux-2.6.39.1/include/acpi/acpi_drivers.h
61089 --- linux-2.6.39.1/include/acpi/acpi_drivers.h 2011-05-19 00:06:34.000000000 -0400
61090 +++ linux-2.6.39.1/include/acpi/acpi_drivers.h 2011-05-22 19:36:32.000000000 -0400
61091 @@ -119,8 +119,8 @@ void pci_acpi_crs_quirks(void);
61092 Dock Station
61093 -------------------------------------------------------------------------- */
61094 struct acpi_dock_ops {
61095 - acpi_notify_handler handler;
61096 - acpi_notify_handler uevent;
61097 + const acpi_notify_handler handler;
61098 + const acpi_notify_handler uevent;
61099 };
61100
61101 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
61102 @@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
61103 extern int register_dock_notifier(struct notifier_block *nb);
61104 extern void unregister_dock_notifier(struct notifier_block *nb);
61105 extern int register_hotplug_dock_device(acpi_handle handle,
61106 - struct acpi_dock_ops *ops,
61107 + const struct acpi_dock_ops *ops,
61108 void *context);
61109 extern void unregister_hotplug_dock_device(acpi_handle handle);
61110 #else
61111 @@ -144,7 +144,7 @@ static inline void unregister_dock_notif
61112 {
61113 }
61114 static inline int register_hotplug_dock_device(acpi_handle handle,
61115 - struct acpi_dock_ops *ops,
61116 + const struct acpi_dock_ops *ops,
61117 void *context)
61118 {
61119 return -ENODEV;
61120 diff -urNp linux-2.6.39.1/include/acpi/processor.h linux-2.6.39.1/include/acpi/processor.h
61121 --- linux-2.6.39.1/include/acpi/processor.h 2011-05-19 00:06:34.000000000 -0400
61122 +++ linux-2.6.39.1/include/acpi/processor.h 2011-05-22 19:36:32.000000000 -0400
61123 @@ -344,7 +344,7 @@ extern struct cpuidle_driver acpi_idle_d
61124
61125 /* in processor_thermal.c */
61126 int acpi_processor_get_limit_info(struct acpi_processor *pr);
61127 -extern struct thermal_cooling_device_ops processor_cooling_ops;
61128 +extern const struct thermal_cooling_device_ops processor_cooling_ops;
61129 #ifdef CONFIG_CPU_FREQ
61130 void acpi_thermal_cpufreq_init(void);
61131 void acpi_thermal_cpufreq_exit(void);
61132 diff -urNp linux-2.6.39.1/include/asm-generic/atomic-long.h linux-2.6.39.1/include/asm-generic/atomic-long.h
61133 --- linux-2.6.39.1/include/asm-generic/atomic-long.h 2011-05-19 00:06:34.000000000 -0400
61134 +++ linux-2.6.39.1/include/asm-generic/atomic-long.h 2011-05-22 19:36:32.000000000 -0400
61135 @@ -22,6 +22,12 @@
61136
61137 typedef atomic64_t atomic_long_t;
61138
61139 +#ifdef CONFIG_PAX_REFCOUNT
61140 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
61141 +#else
61142 +typedef atomic64_t atomic_long_unchecked_t;
61143 +#endif
61144 +
61145 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
61146
61147 static inline long atomic_long_read(atomic_long_t *l)
61148 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
61149 return (long)atomic64_read(v);
61150 }
61151
61152 +#ifdef CONFIG_PAX_REFCOUNT
61153 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61154 +{
61155 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61156 +
61157 + return (long)atomic64_read_unchecked(v);
61158 +}
61159 +#endif
61160 +
61161 static inline void atomic_long_set(atomic_long_t *l, long i)
61162 {
61163 atomic64_t *v = (atomic64_t *)l;
61164 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
61165 atomic64_set(v, i);
61166 }
61167
61168 +#ifdef CONFIG_PAX_REFCOUNT
61169 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61170 +{
61171 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61172 +
61173 + atomic64_set_unchecked(v, i);
61174 +}
61175 +#endif
61176 +
61177 static inline void atomic_long_inc(atomic_long_t *l)
61178 {
61179 atomic64_t *v = (atomic64_t *)l;
61180 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
61181 atomic64_inc(v);
61182 }
61183
61184 +#ifdef CONFIG_PAX_REFCOUNT
61185 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61186 +{
61187 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61188 +
61189 + atomic64_inc_unchecked(v);
61190 +}
61191 +#endif
61192 +
61193 static inline void atomic_long_dec(atomic_long_t *l)
61194 {
61195 atomic64_t *v = (atomic64_t *)l;
61196 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
61197 atomic64_dec(v);
61198 }
61199
61200 +#ifdef CONFIG_PAX_REFCOUNT
61201 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61202 +{
61203 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61204 +
61205 + atomic64_dec_unchecked(v);
61206 +}
61207 +#endif
61208 +
61209 static inline void atomic_long_add(long i, atomic_long_t *l)
61210 {
61211 atomic64_t *v = (atomic64_t *)l;
61212 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long
61213 atomic64_add(i, v);
61214 }
61215
61216 +#ifdef CONFIG_PAX_REFCOUNT
61217 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61218 +{
61219 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61220 +
61221 + atomic64_add_unchecked(i, v);
61222 +}
61223 +#endif
61224 +
61225 static inline void atomic_long_sub(long i, atomic_long_t *l)
61226 {
61227 atomic64_t *v = (atomic64_t *)l;
61228 @@ -66,6 +117,15 @@ static inline void atomic_long_sub(long
61229 atomic64_sub(i, v);
61230 }
61231
61232 +#ifdef CONFIG_PAX_REFCOUNT
61233 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61234 +{
61235 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61236 +
61237 + atomic64_sub_unchecked(i, v);
61238 +}
61239 +#endif
61240 +
61241 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61242 {
61243 atomic64_t *v = (atomic64_t *)l;
61244 @@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur
61245 return (long)atomic64_inc_return(v);
61246 }
61247
61248 +#ifdef CONFIG_PAX_REFCOUNT
61249 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61250 +{
61251 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61252 +
61253 + return (long)atomic64_inc_return_unchecked(v);
61254 +}
61255 +#endif
61256 +
61257 static inline long atomic_long_dec_return(atomic_long_t *l)
61258 {
61259 atomic64_t *v = (atomic64_t *)l;
61260 @@ -140,6 +209,12 @@ static inline long atomic_long_add_unles
61261
61262 typedef atomic_t atomic_long_t;
61263
61264 +#ifdef CONFIG_PAX_REFCOUNT
61265 +typedef atomic_unchecked_t atomic_long_unchecked_t;
61266 +#else
61267 +typedef atomic_t atomic_long_unchecked_t;
61268 +#endif
61269 +
61270 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
61271 static inline long atomic_long_read(atomic_long_t *l)
61272 {
61273 @@ -148,6 +223,15 @@ static inline long atomic_long_read(atom
61274 return (long)atomic_read(v);
61275 }
61276
61277 +#ifdef CONFIG_PAX_REFCOUNT
61278 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61279 +{
61280 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61281 +
61282 + return (long)atomic_read_unchecked(v);
61283 +}
61284 +#endif
61285 +
61286 static inline void atomic_long_set(atomic_long_t *l, long i)
61287 {
61288 atomic_t *v = (atomic_t *)l;
61289 @@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi
61290 atomic_set(v, i);
61291 }
61292
61293 +#ifdef CONFIG_PAX_REFCOUNT
61294 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61295 +{
61296 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61297 +
61298 + atomic_set_unchecked(v, i);
61299 +}
61300 +#endif
61301 +
61302 static inline void atomic_long_inc(atomic_long_t *l)
61303 {
61304 atomic_t *v = (atomic_t *)l;
61305 @@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi
61306 atomic_inc(v);
61307 }
61308
61309 +#ifdef CONFIG_PAX_REFCOUNT
61310 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61311 +{
61312 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61313 +
61314 + atomic_inc_unchecked(v);
61315 +}
61316 +#endif
61317 +
61318 static inline void atomic_long_dec(atomic_long_t *l)
61319 {
61320 atomic_t *v = (atomic_t *)l;
61321 @@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi
61322 atomic_dec(v);
61323 }
61324
61325 +#ifdef CONFIG_PAX_REFCOUNT
61326 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61327 +{
61328 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61329 +
61330 + atomic_dec_unchecked(v);
61331 +}
61332 +#endif
61333 +
61334 static inline void atomic_long_add(long i, atomic_long_t *l)
61335 {
61336 atomic_t *v = (atomic_t *)l;
61337 @@ -176,6 +287,15 @@ static inline void atomic_long_add(long
61338 atomic_add(i, v);
61339 }
61340
61341 +#ifdef CONFIG_PAX_REFCOUNT
61342 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61343 +{
61344 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61345 +
61346 + atomic_add_unchecked(i, v);
61347 +}
61348 +#endif
61349 +
61350 static inline void atomic_long_sub(long i, atomic_long_t *l)
61351 {
61352 atomic_t *v = (atomic_t *)l;
61353 @@ -183,6 +303,15 @@ static inline void atomic_long_sub(long
61354 atomic_sub(i, v);
61355 }
61356
61357 +#ifdef CONFIG_PAX_REFCOUNT
61358 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61359 +{
61360 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61361 +
61362 + atomic_sub_unchecked(i, v);
61363 +}
61364 +#endif
61365 +
61366 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61367 {
61368 atomic_t *v = (atomic_t *)l;
61369 @@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur
61370 return (long)atomic_inc_return(v);
61371 }
61372
61373 +#ifdef CONFIG_PAX_REFCOUNT
61374 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61375 +{
61376 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61377 +
61378 + return (long)atomic_inc_return_unchecked(v);
61379 +}
61380 +#endif
61381 +
61382 static inline long atomic_long_dec_return(atomic_long_t *l)
61383 {
61384 atomic_t *v = (atomic_t *)l;
61385 @@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
61386
61387 #endif /* BITS_PER_LONG == 64 */
61388
61389 +#ifdef CONFIG_PAX_REFCOUNT
61390 +static inline void pax_refcount_needs_these_functions(void)
61391 +{
61392 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
61393 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
61394 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
61395 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
61396 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
61397 + atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
61398 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
61399 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
61400 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
61401 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
61402 + atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
61403 +
61404 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
61405 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
61406 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
61407 + atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
61408 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
61409 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
61410 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
61411 +}
61412 +#else
61413 +#define atomic_read_unchecked(v) atomic_read(v)
61414 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
61415 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
61416 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
61417 +#define atomic_inc_unchecked(v) atomic_inc(v)
61418 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
61419 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
61420 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
61421 +#define atomic_dec_unchecked(v) atomic_dec(v)
61422 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
61423 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
61424 +
61425 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
61426 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
61427 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
61428 +#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
61429 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
61430 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
61431 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
61432 +#endif
61433 +
61434 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
61435 diff -urNp linux-2.6.39.1/include/asm-generic/cache.h linux-2.6.39.1/include/asm-generic/cache.h
61436 --- linux-2.6.39.1/include/asm-generic/cache.h 2011-05-19 00:06:34.000000000 -0400
61437 +++ linux-2.6.39.1/include/asm-generic/cache.h 2011-05-22 19:36:32.000000000 -0400
61438 @@ -6,7 +6,7 @@
61439 * cache lines need to provide their own cache.h.
61440 */
61441
61442 -#define L1_CACHE_SHIFT 5
61443 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
61444 +#define L1_CACHE_SHIFT 5U
61445 +#define L1_CACHE_BYTES (1U << L1_CACHE_SHIFT)
61446
61447 #endif /* __ASM_GENERIC_CACHE_H */
61448 diff -urNp linux-2.6.39.1/include/asm-generic/dma-mapping-common.h linux-2.6.39.1/include/asm-generic/dma-mapping-common.h
61449 --- linux-2.6.39.1/include/asm-generic/dma-mapping-common.h 2011-05-19 00:06:34.000000000 -0400
61450 +++ linux-2.6.39.1/include/asm-generic/dma-mapping-common.h 2011-05-22 19:36:32.000000000 -0400
61451 @@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
61452 enum dma_data_direction dir,
61453 struct dma_attrs *attrs)
61454 {
61455 - struct dma_map_ops *ops = get_dma_ops(dev);
61456 + const struct dma_map_ops *ops = get_dma_ops(dev);
61457 dma_addr_t addr;
61458
61459 kmemcheck_mark_initialized(ptr, size);
61460 @@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
61461 enum dma_data_direction dir,
61462 struct dma_attrs *attrs)
61463 {
61464 - struct dma_map_ops *ops = get_dma_ops(dev);
61465 + const struct dma_map_ops *ops = get_dma_ops(dev);
61466
61467 BUG_ON(!valid_dma_direction(dir));
61468 if (ops->unmap_page)
61469 @@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
61470 int nents, enum dma_data_direction dir,
61471 struct dma_attrs *attrs)
61472 {
61473 - struct dma_map_ops *ops = get_dma_ops(dev);
61474 + const struct dma_map_ops *ops = get_dma_ops(dev);
61475 int i, ents;
61476 struct scatterlist *s;
61477
61478 @@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
61479 int nents, enum dma_data_direction dir,
61480 struct dma_attrs *attrs)
61481 {
61482 - struct dma_map_ops *ops = get_dma_ops(dev);
61483 + const struct dma_map_ops *ops = get_dma_ops(dev);
61484
61485 BUG_ON(!valid_dma_direction(dir));
61486 debug_dma_unmap_sg(dev, sg, nents, dir);
61487 @@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
61488 size_t offset, size_t size,
61489 enum dma_data_direction dir)
61490 {
61491 - struct dma_map_ops *ops = get_dma_ops(dev);
61492 + const struct dma_map_ops *ops = get_dma_ops(dev);
61493 dma_addr_t addr;
61494
61495 kmemcheck_mark_initialized(page_address(page) + offset, size);
61496 @@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
61497 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
61498 size_t size, enum dma_data_direction dir)
61499 {
61500 - struct dma_map_ops *ops = get_dma_ops(dev);
61501 + const struct dma_map_ops *ops = get_dma_ops(dev);
61502
61503 BUG_ON(!valid_dma_direction(dir));
61504 if (ops->unmap_page)
61505 @@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
61506 size_t size,
61507 enum dma_data_direction dir)
61508 {
61509 - struct dma_map_ops *ops = get_dma_ops(dev);
61510 + const struct dma_map_ops *ops = get_dma_ops(dev);
61511
61512 BUG_ON(!valid_dma_direction(dir));
61513 if (ops->sync_single_for_cpu)
61514 @@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
61515 dma_addr_t addr, size_t size,
61516 enum dma_data_direction dir)
61517 {
61518 - struct dma_map_ops *ops = get_dma_ops(dev);
61519 + const struct dma_map_ops *ops = get_dma_ops(dev);
61520
61521 BUG_ON(!valid_dma_direction(dir));
61522 if (ops->sync_single_for_device)
61523 @@ -139,7 +139,7 @@ static inline void
61524 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
61525 int nelems, enum dma_data_direction dir)
61526 {
61527 - struct dma_map_ops *ops = get_dma_ops(dev);
61528 + const struct dma_map_ops *ops = get_dma_ops(dev);
61529
61530 BUG_ON(!valid_dma_direction(dir));
61531 if (ops->sync_sg_for_cpu)
61532 @@ -151,7 +151,7 @@ static inline void
61533 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
61534 int nelems, enum dma_data_direction dir)
61535 {
61536 - struct dma_map_ops *ops = get_dma_ops(dev);
61537 + const struct dma_map_ops *ops = get_dma_ops(dev);
61538
61539 BUG_ON(!valid_dma_direction(dir));
61540 if (ops->sync_sg_for_device)
61541 diff -urNp linux-2.6.39.1/include/asm-generic/int-l64.h linux-2.6.39.1/include/asm-generic/int-l64.h
61542 --- linux-2.6.39.1/include/asm-generic/int-l64.h 2011-05-19 00:06:34.000000000 -0400
61543 +++ linux-2.6.39.1/include/asm-generic/int-l64.h 2011-05-22 19:36:32.000000000 -0400
61544 @@ -46,6 +46,8 @@ typedef unsigned int u32;
61545 typedef signed long s64;
61546 typedef unsigned long u64;
61547
61548 +typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
61549 +
61550 #define S8_C(x) x
61551 #define U8_C(x) x ## U
61552 #define S16_C(x) x
61553 diff -urNp linux-2.6.39.1/include/asm-generic/int-ll64.h linux-2.6.39.1/include/asm-generic/int-ll64.h
61554 --- linux-2.6.39.1/include/asm-generic/int-ll64.h 2011-05-19 00:06:34.000000000 -0400
61555 +++ linux-2.6.39.1/include/asm-generic/int-ll64.h 2011-05-22 19:36:32.000000000 -0400
61556 @@ -51,6 +51,8 @@ typedef unsigned int u32;
61557 typedef signed long long s64;
61558 typedef unsigned long long u64;
61559
61560 +typedef unsigned long long intoverflow_t;
61561 +
61562 #define S8_C(x) x
61563 #define U8_C(x) x ## U
61564 #define S16_C(x) x
61565 diff -urNp linux-2.6.39.1/include/asm-generic/kmap_types.h linux-2.6.39.1/include/asm-generic/kmap_types.h
61566 --- linux-2.6.39.1/include/asm-generic/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
61567 +++ linux-2.6.39.1/include/asm-generic/kmap_types.h 2011-05-22 19:36:32.000000000 -0400
61568 @@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
61569 KMAP_D(17) KM_NMI,
61570 KMAP_D(18) KM_NMI_PTE,
61571 KMAP_D(19) KM_KDB,
61572 +KMAP_D(20) KM_CLEARPAGE,
61573 /*
61574 * Remember to update debug_kmap_atomic() when adding new kmap types!
61575 */
61576 -KMAP_D(20) KM_TYPE_NR
61577 +KMAP_D(21) KM_TYPE_NR
61578 };
61579
61580 #undef KMAP_D
61581 diff -urNp linux-2.6.39.1/include/asm-generic/pgtable.h linux-2.6.39.1/include/asm-generic/pgtable.h
61582 --- linux-2.6.39.1/include/asm-generic/pgtable.h 2011-05-19 00:06:34.000000000 -0400
61583 +++ linux-2.6.39.1/include/asm-generic/pgtable.h 2011-05-22 19:36:32.000000000 -0400
61584 @@ -447,6 +447,14 @@ static inline int pmd_write(pmd_t pmd)
61585 #endif /* __HAVE_ARCH_PMD_WRITE */
61586 #endif
61587
61588 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
61589 +static inline unsigned long pax_open_kernel(void) { return 0; }
61590 +#endif
61591 +
61592 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
61593 +static inline unsigned long pax_close_kernel(void) { return 0; }
61594 +#endif
61595 +
61596 #endif /* !__ASSEMBLY__ */
61597
61598 #endif /* _ASM_GENERIC_PGTABLE_H */
61599 diff -urNp linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h
61600 --- linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h 2011-05-19 00:06:34.000000000 -0400
61601 +++ linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h 2011-05-22 19:36:32.000000000 -0400
61602 @@ -1,14 +1,19 @@
61603 #ifndef _PGTABLE_NOPMD_H
61604 #define _PGTABLE_NOPMD_H
61605
61606 -#ifndef __ASSEMBLY__
61607 -
61608 #include <asm-generic/pgtable-nopud.h>
61609
61610 -struct mm_struct;
61611 -
61612 #define __PAGETABLE_PMD_FOLDED
61613
61614 +#define PMD_SHIFT PUD_SHIFT
61615 +#define PTRS_PER_PMD 1
61616 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
61617 +#define PMD_MASK (~(PMD_SIZE-1))
61618 +
61619 +#ifndef __ASSEMBLY__
61620 +
61621 +struct mm_struct;
61622 +
61623 /*
61624 * Having the pmd type consist of a pud gets the size right, and allows
61625 * us to conceptually access the pud entry that this pmd is folded into
61626 @@ -16,11 +21,6 @@ struct mm_struct;
61627 */
61628 typedef struct { pud_t pud; } pmd_t;
61629
61630 -#define PMD_SHIFT PUD_SHIFT
61631 -#define PTRS_PER_PMD 1
61632 -#define PMD_SIZE (1UL << PMD_SHIFT)
61633 -#define PMD_MASK (~(PMD_SIZE-1))
61634 -
61635 /*
61636 * The "pud_xxx()" functions here are trivial for a folded two-level
61637 * setup: the pmd is never bad, and a pmd always exists (as it's folded
61638 diff -urNp linux-2.6.39.1/include/asm-generic/pgtable-nopud.h linux-2.6.39.1/include/asm-generic/pgtable-nopud.h
61639 --- linux-2.6.39.1/include/asm-generic/pgtable-nopud.h 2011-05-19 00:06:34.000000000 -0400
61640 +++ linux-2.6.39.1/include/asm-generic/pgtable-nopud.h 2011-05-22 19:36:32.000000000 -0400
61641 @@ -1,10 +1,15 @@
61642 #ifndef _PGTABLE_NOPUD_H
61643 #define _PGTABLE_NOPUD_H
61644
61645 -#ifndef __ASSEMBLY__
61646 -
61647 #define __PAGETABLE_PUD_FOLDED
61648
61649 +#define PUD_SHIFT PGDIR_SHIFT
61650 +#define PTRS_PER_PUD 1
61651 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
61652 +#define PUD_MASK (~(PUD_SIZE-1))
61653 +
61654 +#ifndef __ASSEMBLY__
61655 +
61656 /*
61657 * Having the pud type consist of a pgd gets the size right, and allows
61658 * us to conceptually access the pgd entry that this pud is folded into
61659 @@ -12,11 +17,6 @@
61660 */
61661 typedef struct { pgd_t pgd; } pud_t;
61662
61663 -#define PUD_SHIFT PGDIR_SHIFT
61664 -#define PTRS_PER_PUD 1
61665 -#define PUD_SIZE (1UL << PUD_SHIFT)
61666 -#define PUD_MASK (~(PUD_SIZE-1))
61667 -
61668 /*
61669 * The "pgd_xxx()" functions here are trivial for a folded two-level
61670 * setup: the pud is never bad, and a pud always exists (as it's folded
61671 diff -urNp linux-2.6.39.1/include/asm-generic/vmlinux.lds.h linux-2.6.39.1/include/asm-generic/vmlinux.lds.h
61672 --- linux-2.6.39.1/include/asm-generic/vmlinux.lds.h 2011-05-19 00:06:34.000000000 -0400
61673 +++ linux-2.6.39.1/include/asm-generic/vmlinux.lds.h 2011-05-22 19:36:32.000000000 -0400
61674 @@ -213,6 +213,7 @@
61675 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
61676 VMLINUX_SYMBOL(__start_rodata) = .; \
61677 *(.rodata) *(.rodata.*) \
61678 + *(.data..read_only) \
61679 *(__vermagic) /* Kernel version magic */ \
61680 . = ALIGN(8); \
61681 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
61682 @@ -707,14 +708,15 @@
61683 * section in the linker script will go there too. @phdr should have
61684 * a leading colon.
61685 *
61686 - * Note that this macros defines __per_cpu_load as an absolute symbol.
61687 + * Note that this macros defines per_cpu_load as an absolute symbol.
61688 * If there is no need to put the percpu section at a predetermined
61689 * address, use PERCPU().
61690 */
61691 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
61692 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
61693 - .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
61694 + per_cpu_load = .; \
61695 + .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
61696 - LOAD_OFFSET) { \
61697 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
61698 VMLINUX_SYMBOL(__per_cpu_start) = .; \
61699 *(.data..percpu..first) \
61700 . = ALIGN(PAGE_SIZE); \
61701 @@ -726,7 +728,7 @@
61702 *(.data..percpu..shared_aligned) \
61703 VMLINUX_SYMBOL(__per_cpu_end) = .; \
61704 } phdr \
61705 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
61706 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
61707
61708 /**
61709 * PERCPU - define output section for percpu area, simple version
61710 diff -urNp linux-2.6.39.1/include/drm/drmP.h linux-2.6.39.1/include/drm/drmP.h
61711 --- linux-2.6.39.1/include/drm/drmP.h 2011-05-19 00:06:34.000000000 -0400
61712 +++ linux-2.6.39.1/include/drm/drmP.h 2011-05-22 19:41:42.000000000 -0400
61713 @@ -73,6 +73,7 @@
61714 #include <linux/workqueue.h>
61715 #include <linux/poll.h>
61716 #include <asm/pgalloc.h>
61717 +#include <asm/local.h>
61718 #include "drm.h"
61719
61720 #include <linux/idr.h>
61721 @@ -908,7 +909,7 @@ struct drm_driver {
61722 uint32_t handle);
61723
61724 /* Driver private ops for this object */
61725 - struct vm_operations_struct *gem_vm_ops;
61726 + const struct vm_operations_struct *gem_vm_ops;
61727
61728 int major;
61729 int minor;
61730 @@ -1023,7 +1024,7 @@ struct drm_device {
61731
61732 /** \name Usage Counters */
61733 /*@{ */
61734 - int open_count; /**< Outstanding files open */
61735 + local_t open_count; /**< Outstanding files open */
61736 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
61737 atomic_t vma_count; /**< Outstanding vma areas open */
61738 int buf_use; /**< Buffers in use -- cannot alloc */
61739 @@ -1034,7 +1035,7 @@ struct drm_device {
61740 /*@{ */
61741 unsigned long counters;
61742 enum drm_stat_type types[15];
61743 - atomic_t counts[15];
61744 + atomic_unchecked_t counts[15];
61745 /*@} */
61746
61747 struct list_head filelist;
61748 diff -urNp linux-2.6.39.1/include/linux/a.out.h linux-2.6.39.1/include/linux/a.out.h
61749 --- linux-2.6.39.1/include/linux/a.out.h 2011-05-19 00:06:34.000000000 -0400
61750 +++ linux-2.6.39.1/include/linux/a.out.h 2011-05-22 19:36:32.000000000 -0400
61751 @@ -39,6 +39,14 @@ enum machine_type {
61752 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
61753 };
61754
61755 +/* Constants for the N_FLAGS field */
61756 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61757 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
61758 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
61759 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
61760 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61761 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61762 +
61763 #if !defined (N_MAGIC)
61764 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
61765 #endif
61766 diff -urNp linux-2.6.39.1/include/linux/atmdev.h linux-2.6.39.1/include/linux/atmdev.h
61767 --- linux-2.6.39.1/include/linux/atmdev.h 2011-05-19 00:06:34.000000000 -0400
61768 +++ linux-2.6.39.1/include/linux/atmdev.h 2011-05-22 19:36:32.000000000 -0400
61769 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
61770 #endif
61771
61772 struct k_atm_aal_stats {
61773 -#define __HANDLE_ITEM(i) atomic_t i
61774 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
61775 __AAL_STAT_ITEMS
61776 #undef __HANDLE_ITEM
61777 };
61778 diff -urNp linux-2.6.39.1/include/linux/binfmts.h linux-2.6.39.1/include/linux/binfmts.h
61779 --- linux-2.6.39.1/include/linux/binfmts.h 2011-05-19 00:06:34.000000000 -0400
61780 +++ linux-2.6.39.1/include/linux/binfmts.h 2011-05-22 19:36:32.000000000 -0400
61781 @@ -92,6 +92,7 @@ struct linux_binfmt {
61782 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
61783 int (*load_shlib)(struct file *);
61784 int (*core_dump)(struct coredump_params *cprm);
61785 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
61786 unsigned long min_coredump; /* minimal dump size */
61787 };
61788
61789 diff -urNp linux-2.6.39.1/include/linux/blkdev.h linux-2.6.39.1/include/linux/blkdev.h
61790 --- linux-2.6.39.1/include/linux/blkdev.h 2011-06-03 00:04:14.000000000 -0400
61791 +++ linux-2.6.39.1/include/linux/blkdev.h 2011-06-03 00:32:08.000000000 -0400
61792 @@ -1292,22 +1292,22 @@ queue_max_integrity_segments(struct requ
61793 #endif /* CONFIG_BLK_DEV_INTEGRITY */
61794
61795 struct block_device_operations {
61796 - int (*open) (struct block_device *, fmode_t);
61797 - int (*release) (struct gendisk *, fmode_t);
61798 - int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61799 - int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61800 - int (*direct_access) (struct block_device *, sector_t,
61801 + int (* const open) (struct block_device *, fmode_t);
61802 + int (* const release) (struct gendisk *, fmode_t);
61803 + int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61804 + int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61805 + int (* const direct_access) (struct block_device *, sector_t,
61806 void **, unsigned long *);
61807 - unsigned int (*check_events) (struct gendisk *disk,
61808 + unsigned int (* const check_events) (struct gendisk *disk,
61809 unsigned int clearing);
61810 /* ->media_changed() is DEPRECATED, use ->check_events() instead */
61811 - int (*media_changed) (struct gendisk *);
61812 - void (*unlock_native_capacity) (struct gendisk *);
61813 - int (*revalidate_disk) (struct gendisk *);
61814 - int (*getgeo)(struct block_device *, struct hd_geometry *);
61815 + int (* const media_changed) (struct gendisk *);
61816 + void (* const unlock_native_capacity) (struct gendisk *);
61817 + int (* const revalidate_disk) (struct gendisk *);
61818 + int (* const getgeo)(struct block_device *, struct hd_geometry *);
61819 /* this callback is with swap_lock and sometimes page table lock held */
61820 - void (*swap_slot_free_notify) (struct block_device *, unsigned long);
61821 - struct module *owner;
61822 + void (* const swap_slot_free_notify) (struct block_device *, unsigned long);
61823 + struct module * const owner;
61824 };
61825
61826 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
61827 diff -urNp linux-2.6.39.1/include/linux/blktrace_api.h linux-2.6.39.1/include/linux/blktrace_api.h
61828 --- linux-2.6.39.1/include/linux/blktrace_api.h 2011-05-19 00:06:34.000000000 -0400
61829 +++ linux-2.6.39.1/include/linux/blktrace_api.h 2011-05-22 19:36:32.000000000 -0400
61830 @@ -161,7 +161,7 @@ struct blk_trace {
61831 struct dentry *dir;
61832 struct dentry *dropped_file;
61833 struct dentry *msg_file;
61834 - atomic_t dropped;
61835 + atomic_unchecked_t dropped;
61836 };
61837
61838 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
61839 diff -urNp linux-2.6.39.1/include/linux/byteorder/little_endian.h linux-2.6.39.1/include/linux/byteorder/little_endian.h
61840 --- linux-2.6.39.1/include/linux/byteorder/little_endian.h 2011-05-19 00:06:34.000000000 -0400
61841 +++ linux-2.6.39.1/include/linux/byteorder/little_endian.h 2011-05-22 19:36:32.000000000 -0400
61842 @@ -42,51 +42,51 @@
61843
61844 static inline __le64 __cpu_to_le64p(const __u64 *p)
61845 {
61846 - return (__force __le64)*p;
61847 + return (__force const __le64)*p;
61848 }
61849 static inline __u64 __le64_to_cpup(const __le64 *p)
61850 {
61851 - return (__force __u64)*p;
61852 + return (__force const __u64)*p;
61853 }
61854 static inline __le32 __cpu_to_le32p(const __u32 *p)
61855 {
61856 - return (__force __le32)*p;
61857 + return (__force const __le32)*p;
61858 }
61859 static inline __u32 __le32_to_cpup(const __le32 *p)
61860 {
61861 - return (__force __u32)*p;
61862 + return (__force const __u32)*p;
61863 }
61864 static inline __le16 __cpu_to_le16p(const __u16 *p)
61865 {
61866 - return (__force __le16)*p;
61867 + return (__force const __le16)*p;
61868 }
61869 static inline __u16 __le16_to_cpup(const __le16 *p)
61870 {
61871 - return (__force __u16)*p;
61872 + return (__force const __u16)*p;
61873 }
61874 static inline __be64 __cpu_to_be64p(const __u64 *p)
61875 {
61876 - return (__force __be64)__swab64p(p);
61877 + return (__force const __be64)__swab64p(p);
61878 }
61879 static inline __u64 __be64_to_cpup(const __be64 *p)
61880 {
61881 - return __swab64p((__u64 *)p);
61882 + return __swab64p((const __u64 *)p);
61883 }
61884 static inline __be32 __cpu_to_be32p(const __u32 *p)
61885 {
61886 - return (__force __be32)__swab32p(p);
61887 + return (__force const __be32)__swab32p(p);
61888 }
61889 static inline __u32 __be32_to_cpup(const __be32 *p)
61890 {
61891 - return __swab32p((__u32 *)p);
61892 + return __swab32p((const __u32 *)p);
61893 }
61894 static inline __be16 __cpu_to_be16p(const __u16 *p)
61895 {
61896 - return (__force __be16)__swab16p(p);
61897 + return (__force const __be16)__swab16p(p);
61898 }
61899 static inline __u16 __be16_to_cpup(const __be16 *p)
61900 {
61901 - return __swab16p((__u16 *)p);
61902 + return __swab16p((const __u16 *)p);
61903 }
61904 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
61905 #define __le64_to_cpus(x) do { (void)(x); } while (0)
61906 diff -urNp linux-2.6.39.1/include/linux/cache.h linux-2.6.39.1/include/linux/cache.h
61907 --- linux-2.6.39.1/include/linux/cache.h 2011-05-19 00:06:34.000000000 -0400
61908 +++ linux-2.6.39.1/include/linux/cache.h 2011-05-22 19:36:32.000000000 -0400
61909 @@ -16,6 +16,10 @@
61910 #define __read_mostly
61911 #endif
61912
61913 +#ifndef __read_only
61914 +#define __read_only __read_mostly
61915 +#endif
61916 +
61917 #ifndef ____cacheline_aligned
61918 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
61919 #endif
61920 diff -urNp linux-2.6.39.1/include/linux/capability.h linux-2.6.39.1/include/linux/capability.h
61921 --- linux-2.6.39.1/include/linux/capability.h 2011-05-19 00:06:34.000000000 -0400
61922 +++ linux-2.6.39.1/include/linux/capability.h 2011-05-22 21:02:47.000000000 -0400
61923 @@ -547,6 +547,9 @@ extern bool capable(int cap);
61924 extern bool ns_capable(struct user_namespace *ns, int cap);
61925 extern bool task_ns_capable(struct task_struct *t, int cap);
61926 extern bool nsown_capable(int cap);
61927 +extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
61928 +extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
61929 +extern bool capable_nolog(int cap);
61930
61931 /* audit system wants to get cap info from files as well */
61932 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
61933 diff -urNp linux-2.6.39.1/include/linux/compiler-gcc4.h linux-2.6.39.1/include/linux/compiler-gcc4.h
61934 --- linux-2.6.39.1/include/linux/compiler-gcc4.h 2011-05-19 00:06:34.000000000 -0400
61935 +++ linux-2.6.39.1/include/linux/compiler-gcc4.h 2011-05-22 19:36:32.000000000 -0400
61936 @@ -46,6 +46,11 @@
61937 #define __noclone __attribute__((__noclone__))
61938
61939 #endif
61940 +
61941 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
61942 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
61943 +#define __bos0(ptr) __bos((ptr), 0)
61944 +#define __bos1(ptr) __bos((ptr), 1)
61945 #endif
61946
61947 #if __GNUC_MINOR__ > 0
61948 diff -urNp linux-2.6.39.1/include/linux/compiler.h linux-2.6.39.1/include/linux/compiler.h
61949 --- linux-2.6.39.1/include/linux/compiler.h 2011-05-19 00:06:34.000000000 -0400
61950 +++ linux-2.6.39.1/include/linux/compiler.h 2011-05-22 19:36:32.000000000 -0400
61951 @@ -273,6 +273,22 @@ void ftrace_likely_update(struct ftrace_
61952 #define __cold
61953 #endif
61954
61955 +#ifndef __alloc_size
61956 +#define __alloc_size
61957 +#endif
61958 +
61959 +#ifndef __bos
61960 +#define __bos
61961 +#endif
61962 +
61963 +#ifndef __bos0
61964 +#define __bos0
61965 +#endif
61966 +
61967 +#ifndef __bos1
61968 +#define __bos1
61969 +#endif
61970 +
61971 /* Simple shorthand for a section definition */
61972 #ifndef __section
61973 # define __section(S) __attribute__ ((__section__(#S)))
61974 @@ -306,6 +322,7 @@ void ftrace_likely_update(struct ftrace_
61975 * use is to mediate communication between process-level code and irq/NMI
61976 * handlers, all running on the same CPU.
61977 */
61978 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
61979 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
61980 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
61981
61982 #endif /* __LINUX_COMPILER_H */
61983 diff -urNp linux-2.6.39.1/include/linux/concap.h linux-2.6.39.1/include/linux/concap.h
61984 --- linux-2.6.39.1/include/linux/concap.h 2011-05-19 00:06:34.000000000 -0400
61985 +++ linux-2.6.39.1/include/linux/concap.h 2011-05-22 19:36:32.000000000 -0400
61986 @@ -30,7 +30,7 @@ struct concap_device_ops;
61987 struct concap_proto{
61988 struct net_device *net_dev; /* net device using our service */
61989 struct concap_device_ops *dops; /* callbacks provided by device */
61990 - struct concap_proto_ops *pops; /* callbacks provided by us */
61991 + const struct concap_proto_ops *pops; /* callbacks provided by us */
61992 spinlock_t lock;
61993 int flags;
61994 void *proto_data; /* protocol specific private data, to
61995 diff -urNp linux-2.6.39.1/include/linux/configfs.h linux-2.6.39.1/include/linux/configfs.h
61996 --- linux-2.6.39.1/include/linux/configfs.h 2011-05-19 00:06:34.000000000 -0400
61997 +++ linux-2.6.39.1/include/linux/configfs.h 2011-05-22 19:36:32.000000000 -0400
61998 @@ -82,7 +82,7 @@ extern void config_item_put(struct confi
61999 struct config_item_type {
62000 struct module *ct_owner;
62001 struct configfs_item_operations *ct_item_ops;
62002 - struct configfs_group_operations *ct_group_ops;
62003 + const struct configfs_group_operations *ct_group_ops;
62004 struct configfs_attribute **ct_attrs;
62005 };
62006
62007 diff -urNp linux-2.6.39.1/include/linux/cpuset.h linux-2.6.39.1/include/linux/cpuset.h
62008 --- linux-2.6.39.1/include/linux/cpuset.h 2011-05-19 00:06:34.000000000 -0400
62009 +++ linux-2.6.39.1/include/linux/cpuset.h 2011-05-22 19:36:32.000000000 -0400
62010 @@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
62011 * nodemask.
62012 */
62013 smp_mb();
62014 - --ACCESS_ONCE(current->mems_allowed_change_disable);
62015 + --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
62016 }
62017
62018 static inline void set_mems_allowed(nodemask_t nodemask)
62019 diff -urNp linux-2.6.39.1/include/linux/dca.h linux-2.6.39.1/include/linux/dca.h
62020 --- linux-2.6.39.1/include/linux/dca.h 2011-05-19 00:06:34.000000000 -0400
62021 +++ linux-2.6.39.1/include/linux/dca.h 2011-05-22 19:36:32.000000000 -0400
62022 @@ -34,7 +34,7 @@ void dca_unregister_notify(struct notifi
62023
62024 struct dca_provider {
62025 struct list_head node;
62026 - struct dca_ops *ops;
62027 + const struct dca_ops *ops;
62028 struct device *cd;
62029 int id;
62030 };
62031 @@ -53,7 +53,7 @@ struct dca_ops {
62032 int (*dev_managed) (struct dca_provider *, struct device *);
62033 };
62034
62035 -struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size);
62036 +struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size);
62037 void free_dca_provider(struct dca_provider *dca);
62038 int register_dca_provider(struct dca_provider *dca, struct device *dev);
62039 void unregister_dca_provider(struct dca_provider *dca, struct device *dev);
62040 diff -urNp linux-2.6.39.1/include/linux/decompress/mm.h linux-2.6.39.1/include/linux/decompress/mm.h
62041 --- linux-2.6.39.1/include/linux/decompress/mm.h 2011-05-19 00:06:34.000000000 -0400
62042 +++ linux-2.6.39.1/include/linux/decompress/mm.h 2011-05-22 19:36:33.000000000 -0400
62043 @@ -77,7 +77,7 @@ static void free(void *where)
62044 * warnings when not needed (indeed large_malloc / large_free are not
62045 * needed by inflate */
62046
62047 -#define malloc(a) kmalloc(a, GFP_KERNEL)
62048 +#define malloc(a) kmalloc((a), GFP_KERNEL)
62049 #define free(a) kfree(a)
62050
62051 #define large_malloc(a) vmalloc(a)
62052 diff -urNp linux-2.6.39.1/include/linux/dma-mapping.h linux-2.6.39.1/include/linux/dma-mapping.h
62053 --- linux-2.6.39.1/include/linux/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
62054 +++ linux-2.6.39.1/include/linux/dma-mapping.h 2011-05-22 19:36:33.000000000 -0400
62055 @@ -16,40 +16,40 @@ enum dma_data_direction {
62056 };
62057
62058 struct dma_map_ops {
62059 - void* (*alloc_coherent)(struct device *dev, size_t size,
62060 + void* (* const alloc_coherent)(struct device *dev, size_t size,
62061 dma_addr_t *dma_handle, gfp_t gfp);
62062 - void (*free_coherent)(struct device *dev, size_t size,
62063 + void (* const free_coherent)(struct device *dev, size_t size,
62064 void *vaddr, dma_addr_t dma_handle);
62065 - dma_addr_t (*map_page)(struct device *dev, struct page *page,
62066 + dma_addr_t (* const map_page)(struct device *dev, struct page *page,
62067 unsigned long offset, size_t size,
62068 enum dma_data_direction dir,
62069 struct dma_attrs *attrs);
62070 - void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
62071 + void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
62072 size_t size, enum dma_data_direction dir,
62073 struct dma_attrs *attrs);
62074 - int (*map_sg)(struct device *dev, struct scatterlist *sg,
62075 + int (* const map_sg)(struct device *dev, struct scatterlist *sg,
62076 int nents, enum dma_data_direction dir,
62077 struct dma_attrs *attrs);
62078 - void (*unmap_sg)(struct device *dev,
62079 + void (* const unmap_sg)(struct device *dev,
62080 struct scatterlist *sg, int nents,
62081 enum dma_data_direction dir,
62082 struct dma_attrs *attrs);
62083 - void (*sync_single_for_cpu)(struct device *dev,
62084 + void (* const sync_single_for_cpu)(struct device *dev,
62085 dma_addr_t dma_handle, size_t size,
62086 enum dma_data_direction dir);
62087 - void (*sync_single_for_device)(struct device *dev,
62088 + void (* const sync_single_for_device)(struct device *dev,
62089 dma_addr_t dma_handle, size_t size,
62090 enum dma_data_direction dir);
62091 - void (*sync_sg_for_cpu)(struct device *dev,
62092 + void (* const sync_sg_for_cpu)(struct device *dev,
62093 struct scatterlist *sg, int nents,
62094 enum dma_data_direction dir);
62095 - void (*sync_sg_for_device)(struct device *dev,
62096 + void (* const sync_sg_for_device)(struct device *dev,
62097 struct scatterlist *sg, int nents,
62098 enum dma_data_direction dir);
62099 - int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
62100 - int (*dma_supported)(struct device *dev, u64 mask);
62101 - int (*set_dma_mask)(struct device *dev, u64 mask);
62102 - int is_phys;
62103 + int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
62104 + int (* const dma_supported)(struct device *dev, u64 mask);
62105 + int (* set_dma_mask)(struct device *dev, u64 mask);
62106 + const int is_phys;
62107 };
62108
62109 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
62110 diff -urNp linux-2.6.39.1/include/linux/elf.h linux-2.6.39.1/include/linux/elf.h
62111 --- linux-2.6.39.1/include/linux/elf.h 2011-05-19 00:06:34.000000000 -0400
62112 +++ linux-2.6.39.1/include/linux/elf.h 2011-05-22 19:36:33.000000000 -0400
62113 @@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
62114 #define PT_GNU_EH_FRAME 0x6474e550
62115
62116 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
62117 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
62118 +
62119 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
62120 +
62121 +/* Constants for the e_flags field */
62122 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
62123 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
62124 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
62125 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
62126 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
62127 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
62128
62129 /*
62130 * Extended Numbering
62131 @@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
62132 #define DT_DEBUG 21
62133 #define DT_TEXTREL 22
62134 #define DT_JMPREL 23
62135 +#define DT_FLAGS 30
62136 + #define DF_TEXTREL 0x00000004
62137 #define DT_ENCODING 32
62138 #define OLD_DT_LOOS 0x60000000
62139 #define DT_LOOS 0x6000000d
62140 @@ -252,6 +265,19 @@ typedef struct elf64_hdr {
62141 #define PF_W 0x2
62142 #define PF_X 0x1
62143
62144 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
62145 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
62146 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
62147 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
62148 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
62149 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
62150 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
62151 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
62152 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
62153 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
62154 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
62155 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
62156 +
62157 typedef struct elf32_phdr{
62158 Elf32_Word p_type;
62159 Elf32_Off p_offset;
62160 @@ -344,6 +370,8 @@ typedef struct elf64_shdr {
62161 #define EI_OSABI 7
62162 #define EI_PAD 8
62163
62164 +#define EI_PAX 14
62165 +
62166 #define ELFMAG0 0x7f /* EI_MAG */
62167 #define ELFMAG1 'E'
62168 #define ELFMAG2 'L'
62169 @@ -421,6 +449,7 @@ extern Elf32_Dyn _DYNAMIC [];
62170 #define elf_note elf32_note
62171 #define elf_addr_t Elf32_Off
62172 #define Elf_Half Elf32_Half
62173 +#define elf_dyn Elf32_Dyn
62174
62175 #else
62176
62177 @@ -431,6 +460,7 @@ extern Elf64_Dyn _DYNAMIC [];
62178 #define elf_note elf64_note
62179 #define elf_addr_t Elf64_Off
62180 #define Elf_Half Elf64_Half
62181 +#define elf_dyn Elf64_Dyn
62182
62183 #endif
62184
62185 diff -urNp linux-2.6.39.1/include/linux/enclosure.h linux-2.6.39.1/include/linux/enclosure.h
62186 --- linux-2.6.39.1/include/linux/enclosure.h 2011-05-19 00:06:34.000000000 -0400
62187 +++ linux-2.6.39.1/include/linux/enclosure.h 2011-05-22 19:36:33.000000000 -0400
62188 @@ -98,7 +98,7 @@ struct enclosure_device {
62189 void *scratch;
62190 struct list_head node;
62191 struct device edev;
62192 - struct enclosure_component_callbacks *cb;
62193 + const struct enclosure_component_callbacks *cb;
62194 int components;
62195 struct enclosure_component component[0];
62196 };
62197 diff -urNp linux-2.6.39.1/include/linux/fscache-cache.h linux-2.6.39.1/include/linux/fscache-cache.h
62198 --- linux-2.6.39.1/include/linux/fscache-cache.h 2011-05-19 00:06:34.000000000 -0400
62199 +++ linux-2.6.39.1/include/linux/fscache-cache.h 2011-05-22 19:36:33.000000000 -0400
62200 @@ -113,7 +113,7 @@ struct fscache_operation {
62201 #endif
62202 };
62203
62204 -extern atomic_t fscache_op_debug_id;
62205 +extern atomic_unchecked_t fscache_op_debug_id;
62206 extern void fscache_op_work_func(struct work_struct *work);
62207
62208 extern void fscache_enqueue_operation(struct fscache_operation *);
62209 @@ -133,7 +133,7 @@ static inline void fscache_operation_ini
62210 {
62211 INIT_WORK(&op->work, fscache_op_work_func);
62212 atomic_set(&op->usage, 1);
62213 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
62214 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
62215 op->processor = processor;
62216 op->release = release;
62217 INIT_LIST_HEAD(&op->pend_link);
62218 diff -urNp linux-2.6.39.1/include/linux/fs.h linux-2.6.39.1/include/linux/fs.h
62219 --- linux-2.6.39.1/include/linux/fs.h 2011-05-19 00:06:34.000000000 -0400
62220 +++ linux-2.6.39.1/include/linux/fs.h 2011-05-22 19:41:42.000000000 -0400
62221 @@ -108,6 +108,11 @@ struct inodes_stat_t {
62222 /* File was opened by fanotify and shouldn't generate fanotify events */
62223 #define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
62224
62225 +/* Hack for grsec so as not to require read permission simply to execute
62226 + * a binary
62227 + */
62228 +#define FMODE_GREXEC ((__force fmode_t)0x2000000)
62229 +
62230 /*
62231 * The below are the various read and write types that we support. Some of
62232 * them include behavioral modifiers that send information down to the
62233 @@ -575,41 +580,41 @@ typedef int (*read_actor_t)(read_descrip
62234 unsigned long, unsigned long);
62235
62236 struct address_space_operations {
62237 - int (*writepage)(struct page *page, struct writeback_control *wbc);
62238 - int (*readpage)(struct file *, struct page *);
62239 + int (* const writepage)(struct page *page, struct writeback_control *wbc);
62240 + int (* const readpage)(struct file *, struct page *);
62241
62242 /* Write back some dirty pages from this mapping. */
62243 - int (*writepages)(struct address_space *, struct writeback_control *);
62244 + int (* const writepages)(struct address_space *, struct writeback_control *);
62245
62246 /* Set a page dirty. Return true if this dirtied it */
62247 - int (*set_page_dirty)(struct page *page);
62248 + int (* const set_page_dirty)(struct page *page);
62249
62250 - int (*readpages)(struct file *filp, struct address_space *mapping,
62251 + int (* const readpages)(struct file *filp, struct address_space *mapping,
62252 struct list_head *pages, unsigned nr_pages);
62253
62254 - int (*write_begin)(struct file *, struct address_space *mapping,
62255 + int (* const write_begin)(struct file *, struct address_space *mapping,
62256 loff_t pos, unsigned len, unsigned flags,
62257 struct page **pagep, void **fsdata);
62258 - int (*write_end)(struct file *, struct address_space *mapping,
62259 + int (* const write_end)(struct file *, struct address_space *mapping,
62260 loff_t pos, unsigned len, unsigned copied,
62261 struct page *page, void *fsdata);
62262
62263 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
62264 - sector_t (*bmap)(struct address_space *, sector_t);
62265 - void (*invalidatepage) (struct page *, unsigned long);
62266 - int (*releasepage) (struct page *, gfp_t);
62267 - void (*freepage)(struct page *);
62268 - ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
62269 + sector_t (* const bmap)(struct address_space *, sector_t);
62270 + void (* const invalidatepage) (struct page *, unsigned long);
62271 + int (* const releasepage) (struct page *, gfp_t);
62272 + void (* const freepage)(struct page *);
62273 + ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
62274 loff_t offset, unsigned long nr_segs);
62275 - int (*get_xip_mem)(struct address_space *, pgoff_t, int,
62276 + int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
62277 void **, unsigned long *);
62278 /* migrate the contents of a page to the specified target */
62279 - int (*migratepage) (struct address_space *,
62280 + int (* const migratepage) (struct address_space *,
62281 struct page *, struct page *);
62282 - int (*launder_page) (struct page *);
62283 - int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
62284 + int (* const launder_page) (struct page *);
62285 + int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
62286 unsigned long);
62287 - int (*error_remove_page)(struct address_space *, struct page *);
62288 + int (* const error_remove_page)(struct address_space *, struct page *);
62289 };
62290
62291 extern const struct address_space_operations empty_aops;
62292 @@ -1060,17 +1065,17 @@ static inline int file_check_writeable(s
62293 typedef struct files_struct *fl_owner_t;
62294
62295 struct file_lock_operations {
62296 - void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
62297 - void (*fl_release_private)(struct file_lock *);
62298 + void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
62299 + void (* const fl_release_private)(struct file_lock *);
62300 };
62301
62302 struct lock_manager_operations {
62303 - int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
62304 - void (*fl_notify)(struct file_lock *); /* unblock callback */
62305 - int (*fl_grant)(struct file_lock *, struct file_lock *, int);
62306 - void (*fl_release_private)(struct file_lock *);
62307 - void (*fl_break)(struct file_lock *);
62308 - int (*fl_change)(struct file_lock **, int);
62309 + int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
62310 + void (* const fl_notify)(struct file_lock *); /* unblock callback */
62311 + int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
62312 + void (* const fl_release_private)(struct file_lock *);
62313 + void (* const fl_break)(struct file_lock *);
62314 + int (* const fl_change)(struct file_lock **, int);
62315 };
62316
62317 struct lock_manager {
62318 @@ -1611,31 +1616,31 @@ extern ssize_t vfs_writev(struct file *,
62319 unsigned long, loff_t *);
62320
62321 struct super_operations {
62322 - struct inode *(*alloc_inode)(struct super_block *sb);
62323 - void (*destroy_inode)(struct inode *);
62324 + struct inode *(* const alloc_inode)(struct super_block *sb);
62325 + void (* const destroy_inode)(struct inode *);
62326
62327 - void (*dirty_inode) (struct inode *);
62328 - int (*write_inode) (struct inode *, struct writeback_control *wbc);
62329 - int (*drop_inode) (struct inode *);
62330 - void (*evict_inode) (struct inode *);
62331 - void (*put_super) (struct super_block *);
62332 - void (*write_super) (struct super_block *);
62333 - int (*sync_fs)(struct super_block *sb, int wait);
62334 - int (*freeze_fs) (struct super_block *);
62335 - int (*unfreeze_fs) (struct super_block *);
62336 - int (*statfs) (struct dentry *, struct kstatfs *);
62337 - int (*remount_fs) (struct super_block *, int *, char *);
62338 - void (*umount_begin) (struct super_block *);
62339 -
62340 - int (*show_options)(struct seq_file *, struct vfsmount *);
62341 - int (*show_devname)(struct seq_file *, struct vfsmount *);
62342 - int (*show_path)(struct seq_file *, struct vfsmount *);
62343 - int (*show_stats)(struct seq_file *, struct vfsmount *);
62344 + void (* const dirty_inode) (struct inode *);
62345 + int (* const write_inode) (struct inode *, struct writeback_control *wbc);
62346 + int (* const drop_inode) (struct inode *);
62347 + void (* const evict_inode) (struct inode *);
62348 + void (* const put_super) (struct super_block *);
62349 + void (* const write_super) (struct super_block *);
62350 + int (* const sync_fs)(struct super_block *sb, int wait);
62351 + int (* const freeze_fs) (struct super_block *);
62352 + int (* const unfreeze_fs) (struct super_block *);
62353 + int (* const statfs) (struct dentry *, struct kstatfs *);
62354 + int (* const remount_fs) (struct super_block *, int *, char *);
62355 + void (* const umount_begin) (struct super_block *);
62356 +
62357 + int (* const show_options)(struct seq_file *, struct vfsmount *);
62358 + int (* const show_devname)(struct seq_file *, struct vfsmount *);
62359 + int (* const show_path)(struct seq_file *, struct vfsmount *);
62360 + int (* const show_stats)(struct seq_file *, struct vfsmount *);
62361 #ifdef CONFIG_QUOTA
62362 - ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
62363 - ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62364 + ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
62365 + ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62366 #endif
62367 - int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62368 + int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62369 };
62370
62371 /*
62372 diff -urNp linux-2.6.39.1/include/linux/fs_struct.h linux-2.6.39.1/include/linux/fs_struct.h
62373 --- linux-2.6.39.1/include/linux/fs_struct.h 2011-05-19 00:06:34.000000000 -0400
62374 +++ linux-2.6.39.1/include/linux/fs_struct.h 2011-05-22 19:36:33.000000000 -0400
62375 @@ -6,7 +6,7 @@
62376 #include <linux/seqlock.h>
62377
62378 struct fs_struct {
62379 - int users;
62380 + atomic_t users;
62381 spinlock_t lock;
62382 seqcount_t seq;
62383 int umask;
62384 diff -urNp linux-2.6.39.1/include/linux/ftrace_event.h linux-2.6.39.1/include/linux/ftrace_event.h
62385 --- linux-2.6.39.1/include/linux/ftrace_event.h 2011-05-19 00:06:34.000000000 -0400
62386 +++ linux-2.6.39.1/include/linux/ftrace_event.h 2011-05-22 19:36:33.000000000 -0400
62387 @@ -235,7 +235,7 @@ extern int trace_define_field(struct ftr
62388 extern int trace_add_event_call(struct ftrace_event_call *call);
62389 extern void trace_remove_event_call(struct ftrace_event_call *call);
62390
62391 -#define is_signed_type(type) (((type)(-1)) < 0)
62392 +#define is_signed_type(type) (((type)(-1)) < (type)1)
62393
62394 int trace_set_clr_event(const char *system, const char *event, int set);
62395
62396 diff -urNp linux-2.6.39.1/include/linux/ftrace.h linux-2.6.39.1/include/linux/ftrace.h
62397 --- linux-2.6.39.1/include/linux/ftrace.h 2011-05-19 00:06:34.000000000 -0400
62398 +++ linux-2.6.39.1/include/linux/ftrace.h 2011-05-22 19:36:33.000000000 -0400
62399 @@ -140,7 +140,7 @@ extern void
62400 unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
62401 void *data);
62402 extern void
62403 -unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops);
62404 +unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops);
62405 extern void unregister_ftrace_function_probe_all(char *glob);
62406
62407 extern int ftrace_text_reserved(void *start, void *end);
62408 diff -urNp linux-2.6.39.1/include/linux/genhd.h linux-2.6.39.1/include/linux/genhd.h
62409 --- linux-2.6.39.1/include/linux/genhd.h 2011-06-03 00:04:14.000000000 -0400
62410 +++ linux-2.6.39.1/include/linux/genhd.h 2011-06-03 00:32:08.000000000 -0400
62411 @@ -184,7 +184,7 @@ struct gendisk {
62412 struct kobject *slave_dir;
62413
62414 struct timer_rand_state *random;
62415 - atomic_t sync_io; /* RAID */
62416 + atomic_unchecked_t sync_io; /* RAID */
62417 struct disk_events *ev;
62418 #ifdef CONFIG_BLK_DEV_INTEGRITY
62419 struct blk_integrity *integrity;
62420 diff -urNp linux-2.6.39.1/include/linux/gracl.h linux-2.6.39.1/include/linux/gracl.h
62421 --- linux-2.6.39.1/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
62422 +++ linux-2.6.39.1/include/linux/gracl.h 2011-05-22 19:41:42.000000000 -0400
62423 @@ -0,0 +1,317 @@
62424 +#ifndef GR_ACL_H
62425 +#define GR_ACL_H
62426 +
62427 +#include <linux/grdefs.h>
62428 +#include <linux/resource.h>
62429 +#include <linux/capability.h>
62430 +#include <linux/dcache.h>
62431 +#include <asm/resource.h>
62432 +
62433 +/* Major status information */
62434 +
62435 +#define GR_VERSION "grsecurity 2.2.2"
62436 +#define GRSECURITY_VERSION 0x2202
62437 +
62438 +enum {
62439 + GR_SHUTDOWN = 0,
62440 + GR_ENABLE = 1,
62441 + GR_SPROLE = 2,
62442 + GR_RELOAD = 3,
62443 + GR_SEGVMOD = 4,
62444 + GR_STATUS = 5,
62445 + GR_UNSPROLE = 6,
62446 + GR_PASSSET = 7,
62447 + GR_SPROLEPAM = 8,
62448 +};
62449 +
62450 +/* Password setup definitions
62451 + * kernel/grhash.c */
62452 +enum {
62453 + GR_PW_LEN = 128,
62454 + GR_SALT_LEN = 16,
62455 + GR_SHA_LEN = 32,
62456 +};
62457 +
62458 +enum {
62459 + GR_SPROLE_LEN = 64,
62460 +};
62461 +
62462 +enum {
62463 + GR_NO_GLOB = 0,
62464 + GR_REG_GLOB,
62465 + GR_CREATE_GLOB
62466 +};
62467 +
62468 +#define GR_NLIMITS 32
62469 +
62470 +/* Begin Data Structures */
62471 +
62472 +struct sprole_pw {
62473 + unsigned char *rolename;
62474 + unsigned char salt[GR_SALT_LEN];
62475 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
62476 +};
62477 +
62478 +struct name_entry {
62479 + __u32 key;
62480 + ino_t inode;
62481 + dev_t device;
62482 + char *name;
62483 + __u16 len;
62484 + __u8 deleted;
62485 + struct name_entry *prev;
62486 + struct name_entry *next;
62487 +};
62488 +
62489 +struct inodev_entry {
62490 + struct name_entry *nentry;
62491 + struct inodev_entry *prev;
62492 + struct inodev_entry *next;
62493 +};
62494 +
62495 +struct acl_role_db {
62496 + struct acl_role_label **r_hash;
62497 + __u32 r_size;
62498 +};
62499 +
62500 +struct inodev_db {
62501 + struct inodev_entry **i_hash;
62502 + __u32 i_size;
62503 +};
62504 +
62505 +struct name_db {
62506 + struct name_entry **n_hash;
62507 + __u32 n_size;
62508 +};
62509 +
62510 +struct crash_uid {
62511 + uid_t uid;
62512 + unsigned long expires;
62513 +};
62514 +
62515 +struct gr_hash_struct {
62516 + void **table;
62517 + void **nametable;
62518 + void *first;
62519 + __u32 table_size;
62520 + __u32 used_size;
62521 + int type;
62522 +};
62523 +
62524 +/* Userspace Grsecurity ACL data structures */
62525 +
62526 +struct acl_subject_label {
62527 + char *filename;
62528 + ino_t inode;
62529 + dev_t device;
62530 + __u32 mode;
62531 + kernel_cap_t cap_mask;
62532 + kernel_cap_t cap_lower;
62533 + kernel_cap_t cap_invert_audit;
62534 +
62535 + struct rlimit res[GR_NLIMITS];
62536 + __u32 resmask;
62537 +
62538 + __u8 user_trans_type;
62539 + __u8 group_trans_type;
62540 + uid_t *user_transitions;
62541 + gid_t *group_transitions;
62542 + __u16 user_trans_num;
62543 + __u16 group_trans_num;
62544 +
62545 + __u32 sock_families[2];
62546 + __u32 ip_proto[8];
62547 + __u32 ip_type;
62548 + struct acl_ip_label **ips;
62549 + __u32 ip_num;
62550 + __u32 inaddr_any_override;
62551 +
62552 + __u32 crashes;
62553 + unsigned long expires;
62554 +
62555 + struct acl_subject_label *parent_subject;
62556 + struct gr_hash_struct *hash;
62557 + struct acl_subject_label *prev;
62558 + struct acl_subject_label *next;
62559 +
62560 + struct acl_object_label **obj_hash;
62561 + __u32 obj_hash_size;
62562 + __u16 pax_flags;
62563 +};
62564 +
62565 +struct role_allowed_ip {
62566 + __u32 addr;
62567 + __u32 netmask;
62568 +
62569 + struct role_allowed_ip *prev;
62570 + struct role_allowed_ip *next;
62571 +};
62572 +
62573 +struct role_transition {
62574 + char *rolename;
62575 +
62576 + struct role_transition *prev;
62577 + struct role_transition *next;
62578 +};
62579 +
62580 +struct acl_role_label {
62581 + char *rolename;
62582 + uid_t uidgid;
62583 + __u16 roletype;
62584 +
62585 + __u16 auth_attempts;
62586 + unsigned long expires;
62587 +
62588 + struct acl_subject_label *root_label;
62589 + struct gr_hash_struct *hash;
62590 +
62591 + struct acl_role_label *prev;
62592 + struct acl_role_label *next;
62593 +
62594 + struct role_transition *transitions;
62595 + struct role_allowed_ip *allowed_ips;
62596 + uid_t *domain_children;
62597 + __u16 domain_child_num;
62598 +
62599 + struct acl_subject_label **subj_hash;
62600 + __u32 subj_hash_size;
62601 +};
62602 +
62603 +struct user_acl_role_db {
62604 + struct acl_role_label **r_table;
62605 + __u32 num_pointers; /* Number of allocations to track */
62606 + __u32 num_roles; /* Number of roles */
62607 + __u32 num_domain_children; /* Number of domain children */
62608 + __u32 num_subjects; /* Number of subjects */
62609 + __u32 num_objects; /* Number of objects */
62610 +};
62611 +
62612 +struct acl_object_label {
62613 + char *filename;
62614 + ino_t inode;
62615 + dev_t device;
62616 + __u32 mode;
62617 +
62618 + struct acl_subject_label *nested;
62619 + struct acl_object_label *globbed;
62620 +
62621 + /* next two structures not used */
62622 +
62623 + struct acl_object_label *prev;
62624 + struct acl_object_label *next;
62625 +};
62626 +
62627 +struct acl_ip_label {
62628 + char *iface;
62629 + __u32 addr;
62630 + __u32 netmask;
62631 + __u16 low, high;
62632 + __u8 mode;
62633 + __u32 type;
62634 + __u32 proto[8];
62635 +
62636 + /* next two structures not used */
62637 +
62638 + struct acl_ip_label *prev;
62639 + struct acl_ip_label *next;
62640 +};
62641 +
62642 +struct gr_arg {
62643 + struct user_acl_role_db role_db;
62644 + unsigned char pw[GR_PW_LEN];
62645 + unsigned char salt[GR_SALT_LEN];
62646 + unsigned char sum[GR_SHA_LEN];
62647 + unsigned char sp_role[GR_SPROLE_LEN];
62648 + struct sprole_pw *sprole_pws;
62649 + dev_t segv_device;
62650 + ino_t segv_inode;
62651 + uid_t segv_uid;
62652 + __u16 num_sprole_pws;
62653 + __u16 mode;
62654 +};
62655 +
62656 +struct gr_arg_wrapper {
62657 + struct gr_arg *arg;
62658 + __u32 version;
62659 + __u32 size;
62660 +};
62661 +
62662 +struct subject_map {
62663 + struct acl_subject_label *user;
62664 + struct acl_subject_label *kernel;
62665 + struct subject_map *prev;
62666 + struct subject_map *next;
62667 +};
62668 +
62669 +struct acl_subj_map_db {
62670 + struct subject_map **s_hash;
62671 + __u32 s_size;
62672 +};
62673 +
62674 +/* End Data Structures Section */
62675 +
62676 +/* Hash functions generated by empirical testing by Brad Spengler
62677 + Makes good use of the low bits of the inode. Generally 0-1 times
62678 + in loop for successful match. 0-3 for unsuccessful match.
62679 + Shift/add algorithm with modulus of table size and an XOR*/
62680 +
62681 +static __inline__ unsigned int
62682 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
62683 +{
62684 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
62685 +}
62686 +
62687 + static __inline__ unsigned int
62688 +shash(const struct acl_subject_label *userp, const unsigned int sz)
62689 +{
62690 + return ((const unsigned long)userp % sz);
62691 +}
62692 +
62693 +static __inline__ unsigned int
62694 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
62695 +{
62696 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
62697 +}
62698 +
62699 +static __inline__ unsigned int
62700 +nhash(const char *name, const __u16 len, const unsigned int sz)
62701 +{
62702 + return full_name_hash((const unsigned char *)name, len) % sz;
62703 +}
62704 +
62705 +#define FOR_EACH_ROLE_START(role) \
62706 + role = role_list; \
62707 + while (role) {
62708 +
62709 +#define FOR_EACH_ROLE_END(role) \
62710 + role = role->prev; \
62711 + }
62712 +
62713 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
62714 + subj = NULL; \
62715 + iter = 0; \
62716 + while (iter < role->subj_hash_size) { \
62717 + if (subj == NULL) \
62718 + subj = role->subj_hash[iter]; \
62719 + if (subj == NULL) { \
62720 + iter++; \
62721 + continue; \
62722 + }
62723 +
62724 +#define FOR_EACH_SUBJECT_END(subj,iter) \
62725 + subj = subj->next; \
62726 + if (subj == NULL) \
62727 + iter++; \
62728 + }
62729 +
62730 +
62731 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
62732 + subj = role->hash->first; \
62733 + while (subj != NULL) {
62734 +
62735 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
62736 + subj = subj->next; \
62737 + }
62738 +
62739 +#endif
62740 +
62741 diff -urNp linux-2.6.39.1/include/linux/gralloc.h linux-2.6.39.1/include/linux/gralloc.h
62742 --- linux-2.6.39.1/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
62743 +++ linux-2.6.39.1/include/linux/gralloc.h 2011-05-22 19:41:42.000000000 -0400
62744 @@ -0,0 +1,9 @@
62745 +#ifndef __GRALLOC_H
62746 +#define __GRALLOC_H
62747 +
62748 +void acl_free_all(void);
62749 +int acl_alloc_stack_init(unsigned long size);
62750 +void *acl_alloc(unsigned long len);
62751 +void *acl_alloc_num(unsigned long num, unsigned long len);
62752 +
62753 +#endif
62754 diff -urNp linux-2.6.39.1/include/linux/grdefs.h linux-2.6.39.1/include/linux/grdefs.h
62755 --- linux-2.6.39.1/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
62756 +++ linux-2.6.39.1/include/linux/grdefs.h 2011-06-11 16:24:51.000000000 -0400
62757 @@ -0,0 +1,140 @@
62758 +#ifndef GRDEFS_H
62759 +#define GRDEFS_H
62760 +
62761 +/* Begin grsecurity status declarations */
62762 +
62763 +enum {
62764 + GR_READY = 0x01,
62765 + GR_STATUS_INIT = 0x00 // disabled state
62766 +};
62767 +
62768 +/* Begin ACL declarations */
62769 +
62770 +/* Role flags */
62771 +
62772 +enum {
62773 + GR_ROLE_USER = 0x0001,
62774 + GR_ROLE_GROUP = 0x0002,
62775 + GR_ROLE_DEFAULT = 0x0004,
62776 + GR_ROLE_SPECIAL = 0x0008,
62777 + GR_ROLE_AUTH = 0x0010,
62778 + GR_ROLE_NOPW = 0x0020,
62779 + GR_ROLE_GOD = 0x0040,
62780 + GR_ROLE_LEARN = 0x0080,
62781 + GR_ROLE_TPE = 0x0100,
62782 + GR_ROLE_DOMAIN = 0x0200,
62783 + GR_ROLE_PAM = 0x0400,
62784 + GR_ROLE_PERSIST = 0x0800
62785 +};
62786 +
62787 +/* ACL Subject and Object mode flags */
62788 +enum {
62789 + GR_DELETED = 0x80000000
62790 +};
62791 +
62792 +/* ACL Object-only mode flags */
62793 +enum {
62794 + GR_READ = 0x00000001,
62795 + GR_APPEND = 0x00000002,
62796 + GR_WRITE = 0x00000004,
62797 + GR_EXEC = 0x00000008,
62798 + GR_FIND = 0x00000010,
62799 + GR_INHERIT = 0x00000020,
62800 + GR_SETID = 0x00000040,
62801 + GR_CREATE = 0x00000080,
62802 + GR_DELETE = 0x00000100,
62803 + GR_LINK = 0x00000200,
62804 + GR_AUDIT_READ = 0x00000400,
62805 + GR_AUDIT_APPEND = 0x00000800,
62806 + GR_AUDIT_WRITE = 0x00001000,
62807 + GR_AUDIT_EXEC = 0x00002000,
62808 + GR_AUDIT_FIND = 0x00004000,
62809 + GR_AUDIT_INHERIT= 0x00008000,
62810 + GR_AUDIT_SETID = 0x00010000,
62811 + GR_AUDIT_CREATE = 0x00020000,
62812 + GR_AUDIT_DELETE = 0x00040000,
62813 + GR_AUDIT_LINK = 0x00080000,
62814 + GR_PTRACERD = 0x00100000,
62815 + GR_NOPTRACE = 0x00200000,
62816 + GR_SUPPRESS = 0x00400000,
62817 + GR_NOLEARN = 0x00800000,
62818 + GR_INIT_TRANSFER= 0x01000000
62819 +};
62820 +
62821 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
62822 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
62823 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
62824 +
62825 +/* ACL subject-only mode flags */
62826 +enum {
62827 + GR_KILL = 0x00000001,
62828 + GR_VIEW = 0x00000002,
62829 + GR_PROTECTED = 0x00000004,
62830 + GR_LEARN = 0x00000008,
62831 + GR_OVERRIDE = 0x00000010,
62832 + /* just a placeholder, this mode is only used in userspace */
62833 + GR_DUMMY = 0x00000020,
62834 + GR_PROTSHM = 0x00000040,
62835 + GR_KILLPROC = 0x00000080,
62836 + GR_KILLIPPROC = 0x00000100,
62837 + /* just a placeholder, this mode is only used in userspace */
62838 + GR_NOTROJAN = 0x00000200,
62839 + GR_PROTPROCFD = 0x00000400,
62840 + GR_PROCACCT = 0x00000800,
62841 + GR_RELAXPTRACE = 0x00001000,
62842 + GR_NESTED = 0x00002000,
62843 + GR_INHERITLEARN = 0x00004000,
62844 + GR_PROCFIND = 0x00008000,
62845 + GR_POVERRIDE = 0x00010000,
62846 + GR_KERNELAUTH = 0x00020000,
62847 + GR_ATSECURE = 0x00040000,
62848 + GR_SHMEXEC = 0x00080000
62849 +};
62850 +
62851 +enum {
62852 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
62853 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
62854 + GR_PAX_ENABLE_MPROTECT = 0x0004,
62855 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
62856 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
62857 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
62858 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
62859 + GR_PAX_DISABLE_MPROTECT = 0x0400,
62860 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
62861 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
62862 +};
62863 +
62864 +enum {
62865 + GR_ID_USER = 0x01,
62866 + GR_ID_GROUP = 0x02,
62867 +};
62868 +
62869 +enum {
62870 + GR_ID_ALLOW = 0x01,
62871 + GR_ID_DENY = 0x02,
62872 +};
62873 +
62874 +#define GR_CRASH_RES 31
62875 +#define GR_UIDTABLE_MAX 500
62876 +
62877 +/* begin resource learning section */
62878 +enum {
62879 + GR_RLIM_CPU_BUMP = 60,
62880 + GR_RLIM_FSIZE_BUMP = 50000,
62881 + GR_RLIM_DATA_BUMP = 10000,
62882 + GR_RLIM_STACK_BUMP = 1000,
62883 + GR_RLIM_CORE_BUMP = 10000,
62884 + GR_RLIM_RSS_BUMP = 500000,
62885 + GR_RLIM_NPROC_BUMP = 1,
62886 + GR_RLIM_NOFILE_BUMP = 5,
62887 + GR_RLIM_MEMLOCK_BUMP = 50000,
62888 + GR_RLIM_AS_BUMP = 500000,
62889 + GR_RLIM_LOCKS_BUMP = 2,
62890 + GR_RLIM_SIGPENDING_BUMP = 5,
62891 + GR_RLIM_MSGQUEUE_BUMP = 10000,
62892 + GR_RLIM_NICE_BUMP = 1,
62893 + GR_RLIM_RTPRIO_BUMP = 1,
62894 + GR_RLIM_RTTIME_BUMP = 1000000
62895 +};
62896 +
62897 +#endif
62898 diff -urNp linux-2.6.39.1/include/linux/grinternal.h linux-2.6.39.1/include/linux/grinternal.h
62899 --- linux-2.6.39.1/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
62900 +++ linux-2.6.39.1/include/linux/grinternal.h 2011-05-22 19:41:42.000000000 -0400
62901 @@ -0,0 +1,219 @@
62902 +#ifndef __GRINTERNAL_H
62903 +#define __GRINTERNAL_H
62904 +
62905 +#ifdef CONFIG_GRKERNSEC
62906 +
62907 +#include <linux/fs.h>
62908 +#include <linux/mnt_namespace.h>
62909 +#include <linux/nsproxy.h>
62910 +#include <linux/gracl.h>
62911 +#include <linux/grdefs.h>
62912 +#include <linux/grmsg.h>
62913 +
62914 +void gr_add_learn_entry(const char *fmt, ...)
62915 + __attribute__ ((format (printf, 1, 2)));
62916 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
62917 + const struct vfsmount *mnt);
62918 +__u32 gr_check_create(const struct dentry *new_dentry,
62919 + const struct dentry *parent,
62920 + const struct vfsmount *mnt, const __u32 mode);
62921 +int gr_check_protected_task(const struct task_struct *task);
62922 +__u32 to_gr_audit(const __u32 reqmode);
62923 +int gr_set_acls(const int type);
62924 +int gr_apply_subject_to_task(struct task_struct *task);
62925 +int gr_acl_is_enabled(void);
62926 +char gr_roletype_to_char(void);
62927 +
62928 +void gr_handle_alertkill(struct task_struct *task);
62929 +char *gr_to_filename(const struct dentry *dentry,
62930 + const struct vfsmount *mnt);
62931 +char *gr_to_filename1(const struct dentry *dentry,
62932 + const struct vfsmount *mnt);
62933 +char *gr_to_filename2(const struct dentry *dentry,
62934 + const struct vfsmount *mnt);
62935 +char *gr_to_filename3(const struct dentry *dentry,
62936 + const struct vfsmount *mnt);
62937 +
62938 +extern int grsec_enable_harden_ptrace;
62939 +extern int grsec_enable_link;
62940 +extern int grsec_enable_fifo;
62941 +extern int grsec_enable_execve;
62942 +extern int grsec_enable_shm;
62943 +extern int grsec_enable_execlog;
62944 +extern int grsec_enable_signal;
62945 +extern int grsec_enable_audit_ptrace;
62946 +extern int grsec_enable_forkfail;
62947 +extern int grsec_enable_time;
62948 +extern int grsec_enable_rofs;
62949 +extern int grsec_enable_chroot_shmat;
62950 +extern int grsec_enable_chroot_findtask;
62951 +extern int grsec_enable_chroot_mount;
62952 +extern int grsec_enable_chroot_double;
62953 +extern int grsec_enable_chroot_pivot;
62954 +extern int grsec_enable_chroot_chdir;
62955 +extern int grsec_enable_chroot_chmod;
62956 +extern int grsec_enable_chroot_mknod;
62957 +extern int grsec_enable_chroot_fchdir;
62958 +extern int grsec_enable_chroot_nice;
62959 +extern int grsec_enable_chroot_execlog;
62960 +extern int grsec_enable_chroot_caps;
62961 +extern int grsec_enable_chroot_sysctl;
62962 +extern int grsec_enable_chroot_unix;
62963 +extern int grsec_enable_tpe;
62964 +extern int grsec_tpe_gid;
62965 +extern int grsec_enable_tpe_all;
62966 +extern int grsec_enable_tpe_invert;
62967 +extern int grsec_enable_socket_all;
62968 +extern int grsec_socket_all_gid;
62969 +extern int grsec_enable_socket_client;
62970 +extern int grsec_socket_client_gid;
62971 +extern int grsec_enable_socket_server;
62972 +extern int grsec_socket_server_gid;
62973 +extern int grsec_audit_gid;
62974 +extern int grsec_enable_group;
62975 +extern int grsec_enable_audit_textrel;
62976 +extern int grsec_enable_log_rwxmaps;
62977 +extern int grsec_enable_mount;
62978 +extern int grsec_enable_chdir;
62979 +extern int grsec_resource_logging;
62980 +extern int grsec_enable_blackhole;
62981 +extern int grsec_lastack_retries;
62982 +extern int grsec_lock;
62983 +
62984 +extern spinlock_t grsec_alert_lock;
62985 +extern unsigned long grsec_alert_wtime;
62986 +extern unsigned long grsec_alert_fyet;
62987 +
62988 +extern spinlock_t grsec_audit_lock;
62989 +
62990 +extern rwlock_t grsec_exec_file_lock;
62991 +
62992 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
62993 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
62994 + (tsk)->exec_file->f_vfsmnt) : "/")
62995 +
62996 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
62997 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
62998 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62999 +
63000 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
63001 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
63002 + (tsk)->exec_file->f_vfsmnt) : "/")
63003 +
63004 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
63005 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
63006 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
63007 +
63008 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
63009 +
63010 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
63011 +
63012 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
63013 + (task)->pid, (cred)->uid, \
63014 + (cred)->euid, (cred)->gid, (cred)->egid, \
63015 + gr_parent_task_fullpath(task), \
63016 + (task)->real_parent->comm, (task)->real_parent->pid, \
63017 + (pcred)->uid, (pcred)->euid, \
63018 + (pcred)->gid, (pcred)->egid
63019 +
63020 +#define GR_CHROOT_CAPS {{ \
63021 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
63022 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
63023 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
63024 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
63025 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
63026 + CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
63027 +
63028 +#define security_learn(normal_msg,args...) \
63029 +({ \
63030 + read_lock(&grsec_exec_file_lock); \
63031 + gr_add_learn_entry(normal_msg "\n", ## args); \
63032 + read_unlock(&grsec_exec_file_lock); \
63033 +})
63034 +
63035 +enum {
63036 + GR_DO_AUDIT,
63037 + GR_DONT_AUDIT,
63038 + /* used for non-audit messages that we shouldn't kill the task on */
63039 + GR_DONT_AUDIT_GOOD
63040 +};
63041 +
63042 +enum {
63043 + GR_TTYSNIFF,
63044 + GR_RBAC,
63045 + GR_RBAC_STR,
63046 + GR_STR_RBAC,
63047 + GR_RBAC_MODE2,
63048 + GR_RBAC_MODE3,
63049 + GR_FILENAME,
63050 + GR_SYSCTL_HIDDEN,
63051 + GR_NOARGS,
63052 + GR_ONE_INT,
63053 + GR_ONE_INT_TWO_STR,
63054 + GR_ONE_STR,
63055 + GR_STR_INT,
63056 + GR_TWO_STR_INT,
63057 + GR_TWO_INT,
63058 + GR_TWO_U64,
63059 + GR_THREE_INT,
63060 + GR_FIVE_INT_TWO_STR,
63061 + GR_TWO_STR,
63062 + GR_THREE_STR,
63063 + GR_FOUR_STR,
63064 + GR_STR_FILENAME,
63065 + GR_FILENAME_STR,
63066 + GR_FILENAME_TWO_INT,
63067 + GR_FILENAME_TWO_INT_STR,
63068 + GR_TEXTREL,
63069 + GR_PTRACE,
63070 + GR_RESOURCE,
63071 + GR_CAP,
63072 + GR_SIG,
63073 + GR_SIG2,
63074 + GR_CRASH1,
63075 + GR_CRASH2,
63076 + GR_PSACCT,
63077 + GR_RWXMAP
63078 +};
63079 +
63080 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
63081 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
63082 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
63083 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
63084 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
63085 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
63086 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
63087 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
63088 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
63089 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
63090 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
63091 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
63092 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
63093 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
63094 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
63095 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
63096 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
63097 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
63098 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
63099 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
63100 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
63101 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
63102 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
63103 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
63104 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
63105 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
63106 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
63107 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
63108 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
63109 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
63110 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
63111 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
63112 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
63113 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
63114 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
63115 +
63116 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
63117 +
63118 +#endif
63119 +
63120 +#endif
63121 diff -urNp linux-2.6.39.1/include/linux/grmsg.h linux-2.6.39.1/include/linux/grmsg.h
63122 --- linux-2.6.39.1/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
63123 +++ linux-2.6.39.1/include/linux/grmsg.h 2011-05-22 19:41:42.000000000 -0400
63124 @@ -0,0 +1,108 @@
63125 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
63126 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
63127 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
63128 +#define GR_STOPMOD_MSG "denied modification of module state by "
63129 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
63130 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
63131 +#define GR_IOPERM_MSG "denied use of ioperm() by "
63132 +#define GR_IOPL_MSG "denied use of iopl() by "
63133 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
63134 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
63135 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
63136 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
63137 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
63138 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
63139 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
63140 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
63141 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
63142 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
63143 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
63144 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
63145 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
63146 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
63147 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
63148 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
63149 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
63150 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
63151 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
63152 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
63153 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
63154 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
63155 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
63156 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
63157 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
63158 +#define GR_NPROC_MSG "denied overstep of process limit by "
63159 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
63160 +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
63161 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
63162 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
63163 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
63164 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
63165 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
63166 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
63167 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
63168 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
63169 +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
63170 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
63171 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
63172 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
63173 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
63174 +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
63175 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
63176 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
63177 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
63178 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
63179 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
63180 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
63181 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
63182 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
63183 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
63184 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
63185 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
63186 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
63187 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
63188 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
63189 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
63190 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
63191 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
63192 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
63193 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
63194 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
63195 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
63196 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
63197 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
63198 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
63199 +#define GR_NICE_CHROOT_MSG "denied priority change by "
63200 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
63201 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
63202 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
63203 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
63204 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
63205 +#define GR_TIME_MSG "time set by "
63206 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
63207 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
63208 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
63209 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
63210 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
63211 +#define GR_BIND_MSG "denied bind() by "
63212 +#define GR_CONNECT_MSG "denied connect() by "
63213 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
63214 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
63215 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
63216 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
63217 +#define GR_CAP_ACL_MSG "use of %s denied for "
63218 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
63219 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
63220 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
63221 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
63222 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
63223 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
63224 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
63225 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
63226 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
63227 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
63228 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
63229 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
63230 +#define GR_VM86_MSG "denied use of vm86 by "
63231 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
63232 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
63233 diff -urNp linux-2.6.39.1/include/linux/grsecurity.h linux-2.6.39.1/include/linux/grsecurity.h
63234 --- linux-2.6.39.1/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
63235 +++ linux-2.6.39.1/include/linux/grsecurity.h 2011-05-22 19:41:42.000000000 -0400
63236 @@ -0,0 +1,212 @@
63237 +#ifndef GR_SECURITY_H
63238 +#define GR_SECURITY_H
63239 +#include <linux/fs.h>
63240 +#include <linux/fs_struct.h>
63241 +#include <linux/binfmts.h>
63242 +#include <linux/gracl.h>
63243 +#include <linux/compat.h>
63244 +
63245 +/* notify of brain-dead configs */
63246 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
63247 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
63248 +#endif
63249 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63250 +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63251 +#endif
63252 +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63253 +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63254 +#endif
63255 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
63256 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
63257 +#endif
63258 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
63259 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
63260 +#endif
63261 +
63262 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
63263 +void gr_handle_brute_check(void);
63264 +void gr_handle_kernel_exploit(void);
63265 +int gr_process_user_ban(void);
63266 +
63267 +char gr_roletype_to_char(void);
63268 +
63269 +int gr_acl_enable_at_secure(void);
63270 +
63271 +int gr_check_user_change(int real, int effective, int fs);
63272 +int gr_check_group_change(int real, int effective, int fs);
63273 +
63274 +void gr_del_task_from_ip_table(struct task_struct *p);
63275 +
63276 +int gr_pid_is_chrooted(struct task_struct *p);
63277 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
63278 +int gr_handle_chroot_nice(void);
63279 +int gr_handle_chroot_sysctl(const int op);
63280 +int gr_handle_chroot_setpriority(struct task_struct *p,
63281 + const int niceval);
63282 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
63283 +int gr_handle_chroot_chroot(const struct dentry *dentry,
63284 + const struct vfsmount *mnt);
63285 +int gr_handle_chroot_caps(struct path *path);
63286 +void gr_handle_chroot_chdir(struct path *path);
63287 +int gr_handle_chroot_chmod(const struct dentry *dentry,
63288 + const struct vfsmount *mnt, const int mode);
63289 +int gr_handle_chroot_mknod(const struct dentry *dentry,
63290 + const struct vfsmount *mnt, const int mode);
63291 +int gr_handle_chroot_mount(const struct dentry *dentry,
63292 + const struct vfsmount *mnt,
63293 + const char *dev_name);
63294 +int gr_handle_chroot_pivot(void);
63295 +int gr_handle_chroot_unix(struct pid *pid);
63296 +
63297 +int gr_handle_rawio(const struct inode *inode);
63298 +int gr_handle_nproc(void);
63299 +
63300 +void gr_handle_ioperm(void);
63301 +void gr_handle_iopl(void);
63302 +
63303 +int gr_tpe_allow(const struct file *file);
63304 +
63305 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
63306 +void gr_clear_chroot_entries(struct task_struct *task);
63307 +
63308 +void gr_log_forkfail(const int retval);
63309 +void gr_log_timechange(void);
63310 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
63311 +void gr_log_chdir(const struct dentry *dentry,
63312 + const struct vfsmount *mnt);
63313 +void gr_log_chroot_exec(const struct dentry *dentry,
63314 + const struct vfsmount *mnt);
63315 +void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
63316 +#ifdef CONFIG_COMPAT
63317 +void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
63318 +#endif
63319 +void gr_log_remount(const char *devname, const int retval);
63320 +void gr_log_unmount(const char *devname, const int retval);
63321 +void gr_log_mount(const char *from, const char *to, const int retval);
63322 +void gr_log_textrel(struct vm_area_struct *vma);
63323 +void gr_log_rwxmmap(struct file *file);
63324 +void gr_log_rwxmprotect(struct file *file);
63325 +
63326 +int gr_handle_follow_link(const struct inode *parent,
63327 + const struct inode *inode,
63328 + const struct dentry *dentry,
63329 + const struct vfsmount *mnt);
63330 +int gr_handle_fifo(const struct dentry *dentry,
63331 + const struct vfsmount *mnt,
63332 + const struct dentry *dir, const int flag,
63333 + const int acc_mode);
63334 +int gr_handle_hardlink(const struct dentry *dentry,
63335 + const struct vfsmount *mnt,
63336 + struct inode *inode,
63337 + const int mode, const char *to);
63338 +
63339 +int gr_is_capable(const int cap);
63340 +int gr_is_capable_nolog(const int cap);
63341 +void gr_learn_resource(const struct task_struct *task, const int limit,
63342 + const unsigned long wanted, const int gt);
63343 +void gr_copy_label(struct task_struct *tsk);
63344 +void gr_handle_crash(struct task_struct *task, const int sig);
63345 +int gr_handle_signal(const struct task_struct *p, const int sig);
63346 +int gr_check_crash_uid(const uid_t uid);
63347 +int gr_check_protected_task(const struct task_struct *task);
63348 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
63349 +int gr_acl_handle_mmap(const struct file *file,
63350 + const unsigned long prot);
63351 +int gr_acl_handle_mprotect(const struct file *file,
63352 + const unsigned long prot);
63353 +int gr_check_hidden_task(const struct task_struct *tsk);
63354 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
63355 + const struct vfsmount *mnt);
63356 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
63357 + const struct vfsmount *mnt);
63358 +__u32 gr_acl_handle_access(const struct dentry *dentry,
63359 + const struct vfsmount *mnt, const int fmode);
63360 +__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
63361 + const struct vfsmount *mnt, mode_t mode);
63362 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
63363 + const struct vfsmount *mnt, mode_t mode);
63364 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
63365 + const struct vfsmount *mnt);
63366 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
63367 + const struct vfsmount *mnt);
63368 +int gr_handle_ptrace(struct task_struct *task, const long request);
63369 +int gr_handle_proc_ptrace(struct task_struct *task);
63370 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
63371 + const struct vfsmount *mnt);
63372 +int gr_check_crash_exec(const struct file *filp);
63373 +int gr_acl_is_enabled(void);
63374 +void gr_set_kernel_label(struct task_struct *task);
63375 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
63376 + const gid_t gid);
63377 +int gr_set_proc_label(const struct dentry *dentry,
63378 + const struct vfsmount *mnt,
63379 + const int unsafe_share);
63380 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
63381 + const struct vfsmount *mnt);
63382 +__u32 gr_acl_handle_open(const struct dentry *dentry,
63383 + const struct vfsmount *mnt, const int fmode);
63384 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
63385 + const struct dentry *p_dentry,
63386 + const struct vfsmount *p_mnt, const int fmode,
63387 + const int imode);
63388 +void gr_handle_create(const struct dentry *dentry,
63389 + const struct vfsmount *mnt);
63390 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
63391 + const struct dentry *parent_dentry,
63392 + const struct vfsmount *parent_mnt,
63393 + const int mode);
63394 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
63395 + const struct dentry *parent_dentry,
63396 + const struct vfsmount *parent_mnt);
63397 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
63398 + const struct vfsmount *mnt);
63399 +void gr_handle_delete(const ino_t ino, const dev_t dev);
63400 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
63401 + const struct vfsmount *mnt);
63402 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
63403 + const struct dentry *parent_dentry,
63404 + const struct vfsmount *parent_mnt,
63405 + const char *from);
63406 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
63407 + const struct dentry *parent_dentry,
63408 + const struct vfsmount *parent_mnt,
63409 + const struct dentry *old_dentry,
63410 + const struct vfsmount *old_mnt, const char *to);
63411 +int gr_acl_handle_rename(struct dentry *new_dentry,
63412 + struct dentry *parent_dentry,
63413 + const struct vfsmount *parent_mnt,
63414 + struct dentry *old_dentry,
63415 + struct inode *old_parent_inode,
63416 + struct vfsmount *old_mnt, const char *newname);
63417 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
63418 + struct dentry *old_dentry,
63419 + struct dentry *new_dentry,
63420 + struct vfsmount *mnt, const __u8 replace);
63421 +__u32 gr_check_link(const struct dentry *new_dentry,
63422 + const struct dentry *parent_dentry,
63423 + const struct vfsmount *parent_mnt,
63424 + const struct dentry *old_dentry,
63425 + const struct vfsmount *old_mnt);
63426 +int gr_acl_handle_filldir(const struct file *file, const char *name,
63427 + const unsigned int namelen, const ino_t ino);
63428 +
63429 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
63430 + const struct vfsmount *mnt);
63431 +void gr_acl_handle_exit(void);
63432 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
63433 +int gr_acl_handle_procpidmem(const struct task_struct *task);
63434 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
63435 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
63436 +void gr_audit_ptrace(struct task_struct *task);
63437 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
63438 +
63439 +#ifdef CONFIG_GRKERNSEC
63440 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
63441 +void gr_handle_vm86(void);
63442 +void gr_handle_mem_readwrite(u64 from, u64 to);
63443 +
63444 +extern int grsec_enable_dmesg;
63445 +extern int grsec_disable_privio;
63446 +#endif
63447 +
63448 +#endif
63449 diff -urNp linux-2.6.39.1/include/linux/grsock.h linux-2.6.39.1/include/linux/grsock.h
63450 --- linux-2.6.39.1/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
63451 +++ linux-2.6.39.1/include/linux/grsock.h 2011-05-22 19:41:42.000000000 -0400
63452 @@ -0,0 +1,19 @@
63453 +#ifndef __GRSOCK_H
63454 +#define __GRSOCK_H
63455 +
63456 +extern void gr_attach_curr_ip(const struct sock *sk);
63457 +extern int gr_handle_sock_all(const int family, const int type,
63458 + const int protocol);
63459 +extern int gr_handle_sock_server(const struct sockaddr *sck);
63460 +extern int gr_handle_sock_server_other(const struct sock *sck);
63461 +extern int gr_handle_sock_client(const struct sockaddr *sck);
63462 +extern int gr_search_connect(struct socket * sock,
63463 + struct sockaddr_in * addr);
63464 +extern int gr_search_bind(struct socket * sock,
63465 + struct sockaddr_in * addr);
63466 +extern int gr_search_listen(struct socket * sock);
63467 +extern int gr_search_accept(struct socket * sock);
63468 +extern int gr_search_socket(const int domain, const int type,
63469 + const int protocol);
63470 +
63471 +#endif
63472 diff -urNp linux-2.6.39.1/include/linux/highmem.h linux-2.6.39.1/include/linux/highmem.h
63473 --- linux-2.6.39.1/include/linux/highmem.h 2011-05-19 00:06:34.000000000 -0400
63474 +++ linux-2.6.39.1/include/linux/highmem.h 2011-05-22 19:36:33.000000000 -0400
63475 @@ -185,6 +185,18 @@ static inline void clear_highpage(struct
63476 kunmap_atomic(kaddr, KM_USER0);
63477 }
63478
63479 +static inline void sanitize_highpage(struct page *page)
63480 +{
63481 + void *kaddr;
63482 + unsigned long flags;
63483 +
63484 + local_irq_save(flags);
63485 + kaddr = kmap_atomic(page, KM_CLEARPAGE);
63486 + clear_page(kaddr);
63487 + kunmap_atomic(kaddr, KM_CLEARPAGE);
63488 + local_irq_restore(flags);
63489 +}
63490 +
63491 static inline void zero_user_segments(struct page *page,
63492 unsigned start1, unsigned end1,
63493 unsigned start2, unsigned end2)
63494 diff -urNp linux-2.6.39.1/include/linux/i2o.h linux-2.6.39.1/include/linux/i2o.h
63495 --- linux-2.6.39.1/include/linux/i2o.h 2011-05-19 00:06:34.000000000 -0400
63496 +++ linux-2.6.39.1/include/linux/i2o.h 2011-05-22 19:36:33.000000000 -0400
63497 @@ -564,7 +564,7 @@ struct i2o_controller {
63498 struct i2o_device *exec; /* Executive */
63499 #if BITS_PER_LONG == 64
63500 spinlock_t context_list_lock; /* lock for context_list */
63501 - atomic_t context_list_counter; /* needed for unique contexts */
63502 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
63503 struct list_head context_list; /* list of context id's
63504 and pointers */
63505 #endif
63506 diff -urNp linux-2.6.39.1/include/linux/if_phonet.h linux-2.6.39.1/include/linux/if_phonet.h
63507 --- linux-2.6.39.1/include/linux/if_phonet.h 2011-05-19 00:06:34.000000000 -0400
63508 +++ linux-2.6.39.1/include/linux/if_phonet.h 2011-05-22 19:36:33.000000000 -0400
63509 @@ -13,7 +13,7 @@
63510 #define PHONET_DEV_MTU PHONET_MAX_MTU
63511
63512 #ifdef __KERNEL__
63513 -extern struct header_ops phonet_header_ops;
63514 +extern const struct header_ops phonet_header_ops;
63515 #endif
63516
63517 #endif
63518 diff -urNp linux-2.6.39.1/include/linux/init.h linux-2.6.39.1/include/linux/init.h
63519 --- linux-2.6.39.1/include/linux/init.h 2011-05-19 00:06:34.000000000 -0400
63520 +++ linux-2.6.39.1/include/linux/init.h 2011-05-22 19:36:33.000000000 -0400
63521 @@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
63522
63523 /* Each module must use one module_init(). */
63524 #define module_init(initfn) \
63525 - static inline initcall_t __inittest(void) \
63526 + static inline __used initcall_t __inittest(void) \
63527 { return initfn; } \
63528 int init_module(void) __attribute__((alias(#initfn)));
63529
63530 /* This is only required if you want to be unloadable. */
63531 #define module_exit(exitfn) \
63532 - static inline exitcall_t __exittest(void) \
63533 + static inline __used exitcall_t __exittest(void) \
63534 { return exitfn; } \
63535 void cleanup_module(void) __attribute__((alias(#exitfn)));
63536
63537 diff -urNp linux-2.6.39.1/include/linux/init_task.h linux-2.6.39.1/include/linux/init_task.h
63538 --- linux-2.6.39.1/include/linux/init_task.h 2011-05-19 00:06:34.000000000 -0400
63539 +++ linux-2.6.39.1/include/linux/init_task.h 2011-05-22 19:36:33.000000000 -0400
63540 @@ -83,6 +83,12 @@ extern struct group_info init_groups;
63541 #define INIT_IDS
63542 #endif
63543
63544 +#ifdef CONFIG_X86
63545 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
63546 +#else
63547 +#define INIT_TASK_THREAD_INFO
63548 +#endif
63549 +
63550 /*
63551 * Because of the reduced scope of CAP_SETPCAP when filesystem
63552 * capabilities are in effect, it is safe to allow CAP_SETPCAP to
63553 @@ -163,6 +169,7 @@ extern struct cred init_cred;
63554 RCU_INIT_POINTER(.cred, &init_cred), \
63555 .comm = "swapper", \
63556 .thread = INIT_THREAD, \
63557 + INIT_TASK_THREAD_INFO \
63558 .fs = &init_fs, \
63559 .files = &init_files, \
63560 .signal = &init_signals, \
63561 diff -urNp linux-2.6.39.1/include/linux/interrupt.h linux-2.6.39.1/include/linux/interrupt.h
63562 --- linux-2.6.39.1/include/linux/interrupt.h 2011-05-19 00:06:34.000000000 -0400
63563 +++ linux-2.6.39.1/include/linux/interrupt.h 2011-05-22 19:36:33.000000000 -0400
63564 @@ -422,7 +422,7 @@ enum
63565 /* map softirq index to softirq name. update 'softirq_to_name' in
63566 * kernel/softirq.c when adding a new softirq.
63567 */
63568 -extern char *softirq_to_name[NR_SOFTIRQS];
63569 +extern const char * const softirq_to_name[NR_SOFTIRQS];
63570
63571 /* softirq mask and active fields moved to irq_cpustat_t in
63572 * asm/hardirq.h to get better cache usage. KAO
63573 @@ -430,12 +430,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
63574
63575 struct softirq_action
63576 {
63577 - void (*action)(struct softirq_action *);
63578 + void (*action)(void);
63579 };
63580
63581 asmlinkage void do_softirq(void);
63582 asmlinkage void __do_softirq(void);
63583 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
63584 +extern void open_softirq(int nr, void (*action)(void));
63585 extern void softirq_init(void);
63586 static inline void __raise_softirq_irqoff(unsigned int nr)
63587 {
63588 diff -urNp linux-2.6.39.1/include/linux/iommu.h linux-2.6.39.1/include/linux/iommu.h
63589 --- linux-2.6.39.1/include/linux/iommu.h 2011-05-19 00:06:34.000000000 -0400
63590 +++ linux-2.6.39.1/include/linux/iommu.h 2011-05-22 19:36:33.000000000 -0400
63591 @@ -49,7 +49,7 @@ struct iommu_ops {
63592
63593 #ifdef CONFIG_IOMMU_API
63594
63595 -extern void register_iommu(struct iommu_ops *ops);
63596 +extern void register_iommu(const struct iommu_ops *ops);
63597 extern bool iommu_found(void);
63598 extern struct iommu_domain *iommu_domain_alloc(void);
63599 extern void iommu_domain_free(struct iommu_domain *domain);
63600 diff -urNp linux-2.6.39.1/include/linux/ipmi.h linux-2.6.39.1/include/linux/ipmi.h
63601 --- linux-2.6.39.1/include/linux/ipmi.h 2011-05-19 00:06:34.000000000 -0400
63602 +++ linux-2.6.39.1/include/linux/ipmi.h 2011-05-22 19:36:33.000000000 -0400
63603 @@ -282,7 +282,7 @@ struct ipmi_user_hndl {
63604
63605 /* Create a new user of the IPMI layer on the given interface number. */
63606 int ipmi_create_user(unsigned int if_num,
63607 - struct ipmi_user_hndl *handler,
63608 + const struct ipmi_user_hndl *handler,
63609 void *handler_data,
63610 ipmi_user_t *user);
63611
63612 diff -urNp linux-2.6.39.1/include/linux/kallsyms.h linux-2.6.39.1/include/linux/kallsyms.h
63613 --- linux-2.6.39.1/include/linux/kallsyms.h 2011-05-19 00:06:34.000000000 -0400
63614 +++ linux-2.6.39.1/include/linux/kallsyms.h 2011-05-22 22:52:54.000000000 -0400
63615 @@ -15,7 +15,8 @@
63616
63617 struct module;
63618
63619 -#ifdef CONFIG_KALLSYMS
63620 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
63621 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63622 /* Lookup the address for a symbol. Returns 0 if not found. */
63623 unsigned long kallsyms_lookup_name(const char *name);
63624
63625 @@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un
63626 /* Stupid that this does nothing, but I didn't create this mess. */
63627 #define __print_symbol(fmt, addr)
63628 #endif /*CONFIG_KALLSYMS*/
63629 +#else /* when included by kallsyms.c, vsnprintf.c, or
63630 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
63631 +extern void __print_symbol(const char *fmt, unsigned long address);
63632 +extern int sprint_backtrace(char *buffer, unsigned long address);
63633 +extern int sprint_symbol(char *buffer, unsigned long address);
63634 +const char *kallsyms_lookup(unsigned long addr,
63635 + unsigned long *symbolsize,
63636 + unsigned long *offset,
63637 + char **modname, char *namebuf);
63638 +#endif
63639
63640 /* This macro allows us to keep printk typechecking */
63641 static void __check_printsym_format(const char *fmt, ...)
63642 diff -urNp linux-2.6.39.1/include/linux/kgdb.h linux-2.6.39.1/include/linux/kgdb.h
63643 --- linux-2.6.39.1/include/linux/kgdb.h 2011-05-19 00:06:34.000000000 -0400
63644 +++ linux-2.6.39.1/include/linux/kgdb.h 2011-05-22 19:36:33.000000000 -0400
63645 @@ -53,7 +53,7 @@ extern int kgdb_connected;
63646 extern int kgdb_io_module_registered;
63647
63648 extern atomic_t kgdb_setting_breakpoint;
63649 -extern atomic_t kgdb_cpu_doing_single_step;
63650 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
63651
63652 extern struct task_struct *kgdb_usethread;
63653 extern struct task_struct *kgdb_contthread;
63654 @@ -269,22 +269,22 @@ struct kgdb_arch {
63655 */
63656 struct kgdb_io {
63657 const char *name;
63658 - int (*read_char) (void);
63659 - void (*write_char) (u8);
63660 - void (*flush) (void);
63661 - int (*init) (void);
63662 - void (*pre_exception) (void);
63663 - void (*post_exception) (void);
63664 + int (* const read_char) (void);
63665 + void (* const write_char) (u8);
63666 + void (* const flush) (void);
63667 + int (* const init) (void);
63668 + void (* const pre_exception) (void);
63669 + void (* const post_exception) (void);
63670 int is_console;
63671 };
63672
63673 -extern struct kgdb_arch arch_kgdb_ops;
63674 +extern const struct kgdb_arch arch_kgdb_ops;
63675
63676 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
63677
63678 -extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
63679 -extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
63680 -extern struct kgdb_io *dbg_io_ops;
63681 +extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
63682 +extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
63683 +extern const struct kgdb_io *dbg_io_ops;
63684
63685 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
63686 extern char *kgdb_mem2hex(char *mem, char *buf, int count);
63687 diff -urNp linux-2.6.39.1/include/linux/kmod.h linux-2.6.39.1/include/linux/kmod.h
63688 --- linux-2.6.39.1/include/linux/kmod.h 2011-05-19 00:06:34.000000000 -0400
63689 +++ linux-2.6.39.1/include/linux/kmod.h 2011-05-22 19:41:42.000000000 -0400
63690 @@ -33,6 +33,8 @@ extern char modprobe_path[]; /* for sysc
63691 * usually useless though. */
63692 extern int __request_module(bool wait, const char *name, ...) \
63693 __attribute__((format(printf, 2, 3)));
63694 +extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
63695 + __attribute__((format(printf, 3, 4)));
63696 #define request_module(mod...) __request_module(true, mod)
63697 #define request_module_nowait(mod...) __request_module(false, mod)
63698 #define try_then_request_module(x, mod...) \
63699 diff -urNp linux-2.6.39.1/include/linux/kvm_host.h linux-2.6.39.1/include/linux/kvm_host.h
63700 --- linux-2.6.39.1/include/linux/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
63701 +++ linux-2.6.39.1/include/linux/kvm_host.h 2011-05-22 19:36:33.000000000 -0400
63702 @@ -302,7 +302,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
63703 void vcpu_load(struct kvm_vcpu *vcpu);
63704 void vcpu_put(struct kvm_vcpu *vcpu);
63705
63706 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63707 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63708 struct module *module);
63709 void kvm_exit(void);
63710
63711 @@ -442,7 +442,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
63712 struct kvm_guest_debug *dbg);
63713 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
63714
63715 -int kvm_arch_init(void *opaque);
63716 +int kvm_arch_init(const void *opaque);
63717 void kvm_arch_exit(void);
63718
63719 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
63720 diff -urNp linux-2.6.39.1/include/linux/lapb.h linux-2.6.39.1/include/linux/lapb.h
63721 --- linux-2.6.39.1/include/linux/lapb.h 2011-05-19 00:06:34.000000000 -0400
63722 +++ linux-2.6.39.1/include/linux/lapb.h 2011-05-22 19:36:33.000000000 -0400
63723 @@ -44,7 +44,7 @@ struct lapb_parms_struct {
63724 unsigned int mode;
63725 };
63726
63727 -extern int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks);
63728 +extern int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks);
63729 extern int lapb_unregister(struct net_device *dev);
63730 extern int lapb_getparms(struct net_device *dev, struct lapb_parms_struct *parms);
63731 extern int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms);
63732 diff -urNp linux-2.6.39.1/include/linux/lcd.h linux-2.6.39.1/include/linux/lcd.h
63733 --- linux-2.6.39.1/include/linux/lcd.h 2011-05-19 00:06:34.000000000 -0400
63734 +++ linux-2.6.39.1/include/linux/lcd.h 2011-05-22 19:36:33.000000000 -0400
63735 @@ -60,7 +60,7 @@ struct lcd_device {
63736 points to something in the body of that driver, it is also invalid. */
63737 struct mutex ops_lock;
63738 /* If this is NULL, the backing module is unloaded */
63739 - struct lcd_ops *ops;
63740 + const struct lcd_ops *ops;
63741 /* Serialise access to set_power method */
63742 struct mutex update_lock;
63743 /* The framebuffer notifier block */
63744 @@ -101,7 +101,7 @@ static inline void lcd_set_power(struct
63745 }
63746
63747 extern struct lcd_device *lcd_device_register(const char *name,
63748 - struct device *parent, void *devdata, struct lcd_ops *ops);
63749 + struct device *parent, void *devdata, const struct lcd_ops *ops);
63750 extern void lcd_device_unregister(struct lcd_device *ld);
63751
63752 #define to_lcd_device(obj) container_of(obj, struct lcd_device, dev)
63753 diff -urNp linux-2.6.39.1/include/linux/libata.h linux-2.6.39.1/include/linux/libata.h
63754 --- linux-2.6.39.1/include/linux/libata.h 2011-05-19 00:06:34.000000000 -0400
63755 +++ linux-2.6.39.1/include/linux/libata.h 2011-05-22 19:36:33.000000000 -0400
63756 @@ -524,11 +524,11 @@ struct ata_ioports {
63757
63758 struct ata_host {
63759 spinlock_t lock;
63760 - struct device *dev;
63761 + struct device *dev;
63762 void __iomem * const *iomap;
63763 unsigned int n_ports;
63764 void *private_data;
63765 - struct ata_port_operations *ops;
63766 + const struct ata_port_operations *ops;
63767 unsigned long flags;
63768
63769 struct mutex eh_mutex;
63770 @@ -719,7 +719,7 @@ struct ata_link {
63771
63772 struct ata_port {
63773 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
63774 - struct ata_port_operations *ops;
63775 + const struct ata_port_operations *ops;
63776 spinlock_t *lock;
63777 /* Flags owned by the EH context. Only EH should touch these once the
63778 port is active */
63779 @@ -907,7 +907,7 @@ struct ata_port_info {
63780 unsigned long pio_mask;
63781 unsigned long mwdma_mask;
63782 unsigned long udma_mask;
63783 - struct ata_port_operations *port_ops;
63784 + const struct ata_port_operations *port_ops;
63785 void *private_data;
63786 };
63787
63788 @@ -931,7 +931,7 @@ extern const unsigned long sata_deb_timi
63789 extern const unsigned long sata_deb_timing_hotplug[];
63790 extern const unsigned long sata_deb_timing_long[];
63791
63792 -extern struct ata_port_operations ata_dummy_port_ops;
63793 +extern const struct ata_port_operations ata_dummy_port_ops;
63794 extern const struct ata_port_info ata_dummy_port_info;
63795
63796 static inline const unsigned long *
63797 @@ -977,7 +977,7 @@ extern int ata_host_activate(struct ata_
63798 struct scsi_host_template *sht);
63799 extern void ata_host_detach(struct ata_host *host);
63800 extern void ata_host_init(struct ata_host *, struct device *,
63801 - unsigned long, struct ata_port_operations *);
63802 + unsigned long, const struct ata_port_operations *);
63803 extern int ata_scsi_detect(struct scsi_host_template *sht);
63804 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
63805 extern int ata_scsi_queuecmd(struct Scsi_Host *h, struct scsi_cmnd *cmd);
63806 diff -urNp linux-2.6.39.1/include/linux/lockd/bind.h linux-2.6.39.1/include/linux/lockd/bind.h
63807 --- linux-2.6.39.1/include/linux/lockd/bind.h 2011-05-19 00:06:34.000000000 -0400
63808 +++ linux-2.6.39.1/include/linux/lockd/bind.h 2011-05-22 19:36:33.000000000 -0400
63809 @@ -23,13 +23,13 @@ struct svc_rqst;
63810 * This is the set of functions for lockd->nfsd communication
63811 */
63812 struct nlmsvc_binding {
63813 - __be32 (*fopen)(struct svc_rqst *,
63814 + __be32 (* const fopen)(struct svc_rqst *,
63815 struct nfs_fh *,
63816 struct file **);
63817 - void (*fclose)(struct file *);
63818 + void (* const fclose)(struct file *);
63819 };
63820
63821 -extern struct nlmsvc_binding * nlmsvc_ops;
63822 +extern const struct nlmsvc_binding * nlmsvc_ops;
63823
63824 /*
63825 * Similar to nfs_client_initdata, but without the NFS-specific
63826 diff -urNp linux-2.6.39.1/include/linux/mfd/abx500.h linux-2.6.39.1/include/linux/mfd/abx500.h
63827 --- linux-2.6.39.1/include/linux/mfd/abx500.h 2011-05-19 00:06:34.000000000 -0400
63828 +++ linux-2.6.39.1/include/linux/mfd/abx500.h 2011-05-22 19:36:33.000000000 -0400
63829 @@ -227,6 +227,6 @@ struct abx500_ops {
63830 int (*startup_irq_enabled) (struct device *, unsigned int);
63831 };
63832
63833 -int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
63834 +int abx500_register_ops(struct device *core_dev, const struct abx500_ops *ops);
63835 void abx500_remove_ops(struct device *dev);
63836 #endif
63837 diff -urNp linux-2.6.39.1/include/linux/mm.h linux-2.6.39.1/include/linux/mm.h
63838 --- linux-2.6.39.1/include/linux/mm.h 2011-05-19 00:06:34.000000000 -0400
63839 +++ linux-2.6.39.1/include/linux/mm.h 2011-05-22 19:36:33.000000000 -0400
63840 @@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void
63841
63842 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
63843 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
63844 +
63845 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
63846 +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
63847 +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
63848 +#else
63849 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
63850 +#endif
63851 +
63852 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
63853 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
63854
63855 @@ -1010,34 +1017,6 @@ int set_page_dirty(struct page *page);
63856 int set_page_dirty_lock(struct page *page);
63857 int clear_page_dirty_for_io(struct page *page);
63858
63859 -/* Is the vma a continuation of the stack vma above it? */
63860 -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
63861 -{
63862 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
63863 -}
63864 -
63865 -static inline int stack_guard_page_start(struct vm_area_struct *vma,
63866 - unsigned long addr)
63867 -{
63868 - return (vma->vm_flags & VM_GROWSDOWN) &&
63869 - (vma->vm_start == addr) &&
63870 - !vma_growsdown(vma->vm_prev, addr);
63871 -}
63872 -
63873 -/* Is the vma a continuation of the stack vma below it? */
63874 -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
63875 -{
63876 - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
63877 -}
63878 -
63879 -static inline int stack_guard_page_end(struct vm_area_struct *vma,
63880 - unsigned long addr)
63881 -{
63882 - return (vma->vm_flags & VM_GROWSUP) &&
63883 - (vma->vm_end == addr) &&
63884 - !vma_growsup(vma->vm_next, addr);
63885 -}
63886 -
63887 extern unsigned long move_page_tables(struct vm_area_struct *vma,
63888 unsigned long old_addr, struct vm_area_struct *new_vma,
63889 unsigned long new_addr, unsigned long len);
63890 @@ -1189,6 +1168,15 @@ struct shrinker {
63891 extern void register_shrinker(struct shrinker *);
63892 extern void unregister_shrinker(struct shrinker *);
63893
63894 +#ifdef CONFIG_MMU
63895 +pgprot_t vm_get_page_prot(unsigned long vm_flags);
63896 +#else
63897 +static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63898 +{
63899 + return __pgprot(0);
63900 +}
63901 +#endif
63902 +
63903 int vma_wants_writenotify(struct vm_area_struct *vma);
63904
63905 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
63906 @@ -1476,6 +1464,7 @@ out:
63907 }
63908
63909 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
63910 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
63911
63912 extern unsigned long do_brk(unsigned long, unsigned long);
63913
63914 @@ -1532,6 +1521,10 @@ extern struct vm_area_struct * find_vma(
63915 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
63916 struct vm_area_struct **pprev);
63917
63918 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
63919 +extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
63920 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
63921 +
63922 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
63923 NULL if none. Assume start_addr < end_addr. */
63924 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
63925 @@ -1548,15 +1541,6 @@ static inline unsigned long vma_pages(st
63926 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
63927 }
63928
63929 -#ifdef CONFIG_MMU
63930 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
63931 -#else
63932 -static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63933 -{
63934 - return __pgprot(0);
63935 -}
63936 -#endif
63937 -
63938 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
63939 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
63940 unsigned long pfn, unsigned long size, pgprot_t);
63941 @@ -1668,7 +1652,7 @@ extern int unpoison_memory(unsigned long
63942 extern int sysctl_memory_failure_early_kill;
63943 extern int sysctl_memory_failure_recovery;
63944 extern void shake_page(struct page *p, int access);
63945 -extern atomic_long_t mce_bad_pages;
63946 +extern atomic_long_unchecked_t mce_bad_pages;
63947 extern int soft_offline_page(struct page *page, int flags);
63948
63949 extern void dump_page(struct page *page);
63950 @@ -1682,5 +1666,11 @@ extern void copy_user_huge_page(struct p
63951 unsigned int pages_per_huge_page);
63952 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
63953
63954 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
63955 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
63956 +#else
63957 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
63958 +#endif
63959 +
63960 #endif /* __KERNEL__ */
63961 #endif /* _LINUX_MM_H */
63962 diff -urNp linux-2.6.39.1/include/linux/mm_types.h linux-2.6.39.1/include/linux/mm_types.h
63963 --- linux-2.6.39.1/include/linux/mm_types.h 2011-05-19 00:06:34.000000000 -0400
63964 +++ linux-2.6.39.1/include/linux/mm_types.h 2011-05-22 19:36:33.000000000 -0400
63965 @@ -183,6 +183,8 @@ struct vm_area_struct {
63966 #ifdef CONFIG_NUMA
63967 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
63968 #endif
63969 +
63970 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
63971 };
63972
63973 struct core_thread {
63974 @@ -317,6 +319,24 @@ struct mm_struct {
63975 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
63976 pgtable_t pmd_huge_pte; /* protected by page_table_lock */
63977 #endif
63978 +
63979 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63980 + unsigned long pax_flags;
63981 +#endif
63982 +
63983 +#ifdef CONFIG_PAX_DLRESOLVE
63984 + unsigned long call_dl_resolve;
63985 +#endif
63986 +
63987 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
63988 + unsigned long call_syscall;
63989 +#endif
63990 +
63991 +#ifdef CONFIG_PAX_ASLR
63992 + unsigned long delta_mmap; /* randomized offset */
63993 + unsigned long delta_stack; /* randomized offset */
63994 +#endif
63995 +
63996 };
63997
63998 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
63999 diff -urNp linux-2.6.39.1/include/linux/mmu_notifier.h linux-2.6.39.1/include/linux/mmu_notifier.h
64000 --- linux-2.6.39.1/include/linux/mmu_notifier.h 2011-05-19 00:06:34.000000000 -0400
64001 +++ linux-2.6.39.1/include/linux/mmu_notifier.h 2011-05-22 19:36:33.000000000 -0400
64002 @@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
64003 */
64004 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
64005 ({ \
64006 - pte_t __pte; \
64007 + pte_t ___pte; \
64008 struct vm_area_struct *___vma = __vma; \
64009 unsigned long ___address = __address; \
64010 - __pte = ptep_clear_flush(___vma, ___address, __ptep); \
64011 + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
64012 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
64013 - __pte; \
64014 + ___pte; \
64015 })
64016
64017 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
64018 diff -urNp linux-2.6.39.1/include/linux/mmzone.h linux-2.6.39.1/include/linux/mmzone.h
64019 --- linux-2.6.39.1/include/linux/mmzone.h 2011-05-19 00:06:34.000000000 -0400
64020 +++ linux-2.6.39.1/include/linux/mmzone.h 2011-05-22 19:36:33.000000000 -0400
64021 @@ -355,7 +355,7 @@ struct zone {
64022 unsigned long flags; /* zone flags, see below */
64023
64024 /* Zone statistics */
64025 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64026 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64027
64028 /*
64029 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
64030 diff -urNp linux-2.6.39.1/include/linux/mod_devicetable.h linux-2.6.39.1/include/linux/mod_devicetable.h
64031 --- linux-2.6.39.1/include/linux/mod_devicetable.h 2011-05-19 00:06:34.000000000 -0400
64032 +++ linux-2.6.39.1/include/linux/mod_devicetable.h 2011-05-22 19:36:33.000000000 -0400
64033 @@ -12,7 +12,7 @@
64034 typedef unsigned long kernel_ulong_t;
64035 #endif
64036
64037 -#define PCI_ANY_ID (~0)
64038 +#define PCI_ANY_ID ((__u16)~0)
64039
64040 struct pci_device_id {
64041 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
64042 @@ -131,7 +131,7 @@ struct usb_device_id {
64043 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
64044 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
64045
64046 -#define HID_ANY_ID (~0)
64047 +#define HID_ANY_ID (~0U)
64048
64049 struct hid_device_id {
64050 __u16 bus;
64051 diff -urNp linux-2.6.39.1/include/linux/module.h linux-2.6.39.1/include/linux/module.h
64052 --- linux-2.6.39.1/include/linux/module.h 2011-05-19 00:06:34.000000000 -0400
64053 +++ linux-2.6.39.1/include/linux/module.h 2011-05-22 19:36:33.000000000 -0400
64054 @@ -324,19 +324,16 @@ struct module
64055 int (*init)(void);
64056
64057 /* If this is non-NULL, vfree after init() returns */
64058 - void *module_init;
64059 + void *module_init_rx, *module_init_rw;
64060
64061 /* Here is the actual code + data, vfree'd on unload. */
64062 - void *module_core;
64063 + void *module_core_rx, *module_core_rw;
64064
64065 /* Here are the sizes of the init and core sections */
64066 - unsigned int init_size, core_size;
64067 + unsigned int init_size_rw, core_size_rw;
64068
64069 /* The size of the executable code in each section. */
64070 - unsigned int init_text_size, core_text_size;
64071 -
64072 - /* Size of RO sections of the module (text+rodata) */
64073 - unsigned int init_ro_size, core_ro_size;
64074 + unsigned int init_size_rx, core_size_rx;
64075
64076 /* Arch-specific module values */
64077 struct mod_arch_specific arch;
64078 @@ -441,16 +438,46 @@ bool is_module_address(unsigned long add
64079 bool is_module_percpu_address(unsigned long addr);
64080 bool is_module_text_address(unsigned long addr);
64081
64082 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
64083 +{
64084 +
64085 +#ifdef CONFIG_PAX_KERNEXEC
64086 + if (ktla_ktva(addr) >= (unsigned long)start &&
64087 + ktla_ktva(addr) < (unsigned long)start + size)
64088 + return 1;
64089 +#endif
64090 +
64091 + return ((void *)addr >= start && (void *)addr < start + size);
64092 +}
64093 +
64094 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
64095 +{
64096 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
64097 +}
64098 +
64099 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
64100 +{
64101 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
64102 +}
64103 +
64104 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
64105 +{
64106 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
64107 +}
64108 +
64109 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
64110 +{
64111 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
64112 +}
64113 +
64114 static inline int within_module_core(unsigned long addr, struct module *mod)
64115 {
64116 - return (unsigned long)mod->module_core <= addr &&
64117 - addr < (unsigned long)mod->module_core + mod->core_size;
64118 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
64119 }
64120
64121 static inline int within_module_init(unsigned long addr, struct module *mod)
64122 {
64123 - return (unsigned long)mod->module_init <= addr &&
64124 - addr < (unsigned long)mod->module_init + mod->init_size;
64125 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
64126 }
64127
64128 /* Search for module by name: must hold module_mutex. */
64129 diff -urNp linux-2.6.39.1/include/linux/moduleloader.h linux-2.6.39.1/include/linux/moduleloader.h
64130 --- linux-2.6.39.1/include/linux/moduleloader.h 2011-05-19 00:06:34.000000000 -0400
64131 +++ linux-2.6.39.1/include/linux/moduleloader.h 2011-05-22 19:36:33.000000000 -0400
64132 @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
64133 sections. Returns NULL on failure. */
64134 void *module_alloc(unsigned long size);
64135
64136 +#ifdef CONFIG_PAX_KERNEXEC
64137 +void *module_alloc_exec(unsigned long size);
64138 +#else
64139 +#define module_alloc_exec(x) module_alloc(x)
64140 +#endif
64141 +
64142 /* Free memory returned from module_alloc. */
64143 void module_free(struct module *mod, void *module_region);
64144
64145 +#ifdef CONFIG_PAX_KERNEXEC
64146 +void module_free_exec(struct module *mod, void *module_region);
64147 +#else
64148 +#define module_free_exec(x, y) module_free((x), (y))
64149 +#endif
64150 +
64151 /* Apply the given relocation to the (simplified) ELF. Return -error
64152 or 0. */
64153 int apply_relocate(Elf_Shdr *sechdrs,
64154 diff -urNp linux-2.6.39.1/include/linux/moduleparam.h linux-2.6.39.1/include/linux/moduleparam.h
64155 --- linux-2.6.39.1/include/linux/moduleparam.h 2011-05-19 00:06:34.000000000 -0400
64156 +++ linux-2.6.39.1/include/linux/moduleparam.h 2011-05-22 19:36:33.000000000 -0400
64157 @@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
64158 * @len is usually just sizeof(string).
64159 */
64160 #define module_param_string(name, string, len, perm) \
64161 - static const struct kparam_string __param_string_##name \
64162 + static const struct kparam_string __param_string_##name __used \
64163 = { len, string }; \
64164 __module_param_call(MODULE_PARAM_PREFIX, name, \
64165 &param_ops_string, \
64166 @@ -285,48 +285,48 @@ static inline void destroy_params(const
64167 #define __param_check(name, p, type) \
64168 static inline type *__check_##name(void) { return(p); }
64169
64170 -extern struct kernel_param_ops param_ops_byte;
64171 +extern const struct kernel_param_ops param_ops_byte;
64172 extern int param_set_byte(const char *val, const struct kernel_param *kp);
64173 extern int param_get_byte(char *buffer, const struct kernel_param *kp);
64174 #define param_check_byte(name, p) __param_check(name, p, unsigned char)
64175
64176 -extern struct kernel_param_ops param_ops_short;
64177 +extern const struct kernel_param_ops param_ops_short;
64178 extern int param_set_short(const char *val, const struct kernel_param *kp);
64179 extern int param_get_short(char *buffer, const struct kernel_param *kp);
64180 #define param_check_short(name, p) __param_check(name, p, short)
64181
64182 -extern struct kernel_param_ops param_ops_ushort;
64183 +extern const struct kernel_param_ops param_ops_ushort;
64184 extern int param_set_ushort(const char *val, const struct kernel_param *kp);
64185 extern int param_get_ushort(char *buffer, const struct kernel_param *kp);
64186 #define param_check_ushort(name, p) __param_check(name, p, unsigned short)
64187
64188 -extern struct kernel_param_ops param_ops_int;
64189 +extern const struct kernel_param_ops param_ops_int;
64190 extern int param_set_int(const char *val, const struct kernel_param *kp);
64191 extern int param_get_int(char *buffer, const struct kernel_param *kp);
64192 #define param_check_int(name, p) __param_check(name, p, int)
64193
64194 -extern struct kernel_param_ops param_ops_uint;
64195 +extern const struct kernel_param_ops param_ops_uint;
64196 extern int param_set_uint(const char *val, const struct kernel_param *kp);
64197 extern int param_get_uint(char *buffer, const struct kernel_param *kp);
64198 #define param_check_uint(name, p) __param_check(name, p, unsigned int)
64199
64200 -extern struct kernel_param_ops param_ops_long;
64201 +extern const struct kernel_param_ops param_ops_long;
64202 extern int param_set_long(const char *val, const struct kernel_param *kp);
64203 extern int param_get_long(char *buffer, const struct kernel_param *kp);
64204 #define param_check_long(name, p) __param_check(name, p, long)
64205
64206 -extern struct kernel_param_ops param_ops_ulong;
64207 +extern const struct kernel_param_ops param_ops_ulong;
64208 extern int param_set_ulong(const char *val, const struct kernel_param *kp);
64209 extern int param_get_ulong(char *buffer, const struct kernel_param *kp);
64210 #define param_check_ulong(name, p) __param_check(name, p, unsigned long)
64211
64212 -extern struct kernel_param_ops param_ops_charp;
64213 +extern const struct kernel_param_ops param_ops_charp;
64214 extern int param_set_charp(const char *val, const struct kernel_param *kp);
64215 extern int param_get_charp(char *buffer, const struct kernel_param *kp);
64216 #define param_check_charp(name, p) __param_check(name, p, char *)
64217
64218 /* For historical reasons "bool" parameters can be (unsigned) "int". */
64219 -extern struct kernel_param_ops param_ops_bool;
64220 +extern const struct kernel_param_ops param_ops_bool;
64221 extern int param_set_bool(const char *val, const struct kernel_param *kp);
64222 extern int param_get_bool(char *buffer, const struct kernel_param *kp);
64223 #define param_check_bool(name, p) \
64224 @@ -337,7 +337,7 @@ extern int param_get_bool(char *buffer,
64225 !__same_type((p), int *)); \
64226 }
64227
64228 -extern struct kernel_param_ops param_ops_invbool;
64229 +extern const struct kernel_param_ops param_ops_invbool;
64230 extern int param_set_invbool(const char *val, const struct kernel_param *kp);
64231 extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
64232 #define param_check_invbool(name, p) __param_check(name, p, bool)
64233 @@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe
64234 * module_param_named() for why this might be necessary.
64235 */
64236 #define module_param_array_named(name, array, type, nump, perm) \
64237 - static const struct kparam_array __param_arr_##name \
64238 + static const struct kparam_array __param_arr_##name __used \
64239 = { ARRAY_SIZE(array), nump, &param_ops_##type, \
64240 sizeof(array[0]), array }; \
64241 __module_param_call(MODULE_PARAM_PREFIX, name, \
64242 @@ -379,9 +379,9 @@ extern int param_get_invbool(char *buffe
64243 __same_type(array[0], bool), perm); \
64244 __MODULE_PARM_TYPE(name, "array of " #type)
64245
64246 -extern struct kernel_param_ops param_array_ops;
64247 +extern const struct kernel_param_ops param_array_ops;
64248
64249 -extern struct kernel_param_ops param_ops_string;
64250 +extern const struct kernel_param_ops param_ops_string;
64251 extern int param_set_copystring(const char *val, const struct kernel_param *);
64252 extern int param_get_string(char *buffer, const struct kernel_param *kp);
64253
64254 diff -urNp linux-2.6.39.1/include/linux/mutex.h linux-2.6.39.1/include/linux/mutex.h
64255 --- linux-2.6.39.1/include/linux/mutex.h 2011-05-19 00:06:34.000000000 -0400
64256 +++ linux-2.6.39.1/include/linux/mutex.h 2011-05-22 19:36:33.000000000 -0400
64257 @@ -51,7 +51,7 @@ struct mutex {
64258 spinlock_t wait_lock;
64259 struct list_head wait_list;
64260 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
64261 - struct thread_info *owner;
64262 + struct task_struct *owner;
64263 #endif
64264 #ifdef CONFIG_DEBUG_MUTEXES
64265 const char *name;
64266 diff -urNp linux-2.6.39.1/include/linux/namei.h linux-2.6.39.1/include/linux/namei.h
64267 --- linux-2.6.39.1/include/linux/namei.h 2011-05-19 00:06:34.000000000 -0400
64268 +++ linux-2.6.39.1/include/linux/namei.h 2011-05-22 19:36:33.000000000 -0400
64269 @@ -24,7 +24,7 @@ struct nameidata {
64270 unsigned seq;
64271 int last_type;
64272 unsigned depth;
64273 - char *saved_names[MAX_NESTED_LINKS + 1];
64274 + const char *saved_names[MAX_NESTED_LINKS + 1];
64275
64276 /* Intent data */
64277 union {
64278 @@ -91,12 +91,12 @@ extern int follow_up(struct path *);
64279 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
64280 extern void unlock_rename(struct dentry *, struct dentry *);
64281
64282 -static inline void nd_set_link(struct nameidata *nd, char *path)
64283 +static inline void nd_set_link(struct nameidata *nd, const char *path)
64284 {
64285 nd->saved_names[nd->depth] = path;
64286 }
64287
64288 -static inline char *nd_get_link(struct nameidata *nd)
64289 +static inline const char *nd_get_link(const struct nameidata *nd)
64290 {
64291 return nd->saved_names[nd->depth];
64292 }
64293 diff -urNp linux-2.6.39.1/include/linux/netfilter/xt_gradm.h linux-2.6.39.1/include/linux/netfilter/xt_gradm.h
64294 --- linux-2.6.39.1/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
64295 +++ linux-2.6.39.1/include/linux/netfilter/xt_gradm.h 2011-05-22 19:41:42.000000000 -0400
64296 @@ -0,0 +1,9 @@
64297 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
64298 +#define _LINUX_NETFILTER_XT_GRADM_H 1
64299 +
64300 +struct xt_gradm_mtinfo {
64301 + __u16 flags;
64302 + __u16 invflags;
64303 +};
64304 +
64305 +#endif
64306 diff -urNp linux-2.6.39.1/include/linux/oprofile.h linux-2.6.39.1/include/linux/oprofile.h
64307 --- linux-2.6.39.1/include/linux/oprofile.h 2011-05-19 00:06:34.000000000 -0400
64308 +++ linux-2.6.39.1/include/linux/oprofile.h 2011-05-22 19:36:33.000000000 -0400
64309 @@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super
64310 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
64311 char const * name, ulong * val);
64312
64313 -/** Create a file for read-only access to an atomic_t. */
64314 +/** Create a file for read-only access to an atomic_unchecked_t. */
64315 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
64316 - char const * name, atomic_t * val);
64317 + char const * name, atomic_unchecked_t * val);
64318
64319 /** create a directory */
64320 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
64321 diff -urNp linux-2.6.39.1/include/linux/padata.h linux-2.6.39.1/include/linux/padata.h
64322 --- linux-2.6.39.1/include/linux/padata.h 2011-05-19 00:06:34.000000000 -0400
64323 +++ linux-2.6.39.1/include/linux/padata.h 2011-05-22 19:36:33.000000000 -0400
64324 @@ -129,7 +129,7 @@ struct parallel_data {
64325 struct padata_instance *pinst;
64326 struct padata_parallel_queue __percpu *pqueue;
64327 struct padata_serial_queue __percpu *squeue;
64328 - atomic_t seq_nr;
64329 + atomic_unchecked_t seq_nr;
64330 atomic_t reorder_objects;
64331 atomic_t refcnt;
64332 unsigned int max_seq_nr;
64333 diff -urNp linux-2.6.39.1/include/linux/pci.h linux-2.6.39.1/include/linux/pci.h
64334 --- linux-2.6.39.1/include/linux/pci.h 2011-05-19 00:06:34.000000000 -0400
64335 +++ linux-2.6.39.1/include/linux/pci.h 2011-05-22 19:36:33.000000000 -0400
64336 @@ -411,7 +411,7 @@ struct pci_bus {
64337 struct resource *resource[PCI_BRIDGE_RESOURCE_NUM];
64338 struct list_head resources; /* address space routed to this bus */
64339
64340 - struct pci_ops *ops; /* configuration access functions */
64341 + const struct pci_ops *ops; /* configuration access functions */
64342 void *sysdata; /* hook for sys-specific extension */
64343 struct proc_dir_entry *procdir; /* directory entry in /proc/bus/pci */
64344
64345 @@ -550,7 +550,7 @@ struct pci_driver {
64346 int (*resume_early) (struct pci_dev *dev);
64347 int (*resume) (struct pci_dev *dev); /* Device woken up */
64348 void (*shutdown) (struct pci_dev *dev);
64349 - struct pci_error_handlers *err_handler;
64350 + const struct pci_error_handlers *err_handler;
64351 struct device_driver driver;
64352 struct pci_dynids dynids;
64353 };
64354 @@ -639,7 +639,7 @@ void pcibios_scan_specific_bus(int busn)
64355 extern struct pci_bus *pci_find_bus(int domain, int busnr);
64356 void pci_bus_add_devices(const struct pci_bus *bus);
64357 struct pci_bus *pci_scan_bus_parented(struct device *parent, int bus,
64358 - struct pci_ops *ops, void *sysdata);
64359 + const struct pci_ops *ops, void *sysdata);
64360 static inline struct pci_bus * __devinit pci_scan_bus(int bus, struct pci_ops *ops,
64361 void *sysdata)
64362 {
64363 @@ -650,7 +650,7 @@ static inline struct pci_bus * __devinit
64364 return root_bus;
64365 }
64366 struct pci_bus *pci_create_bus(struct device *parent, int bus,
64367 - struct pci_ops *ops, void *sysdata);
64368 + const struct pci_ops *ops, void *sysdata);
64369 struct pci_bus *pci_add_new_bus(struct pci_bus *parent, struct pci_dev *dev,
64370 int busnr);
64371 void pcie_update_link_speed(struct pci_bus *bus, u16 link_status);
64372 @@ -727,7 +727,7 @@ int pci_bus_write_config_word(struct pci
64373 int where, u16 val);
64374 int pci_bus_write_config_dword(struct pci_bus *bus, unsigned int devfn,
64375 int where, u32 val);
64376 -struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops);
64377 +const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops);
64378
64379 static inline int pci_read_config_byte(struct pci_dev *dev, int where, u8 *val)
64380 {
64381 diff -urNp linux-2.6.39.1/include/linux/perf_event.h linux-2.6.39.1/include/linux/perf_event.h
64382 --- linux-2.6.39.1/include/linux/perf_event.h 2011-05-19 00:06:34.000000000 -0400
64383 +++ linux-2.6.39.1/include/linux/perf_event.h 2011-05-22 19:36:33.000000000 -0400
64384 @@ -759,8 +759,8 @@ struct perf_event {
64385
64386 enum perf_event_active_state state;
64387 unsigned int attach_state;
64388 - local64_t count;
64389 - atomic64_t child_count;
64390 + local64_t count; /* PaX: fix it one day */
64391 + atomic64_unchecked_t child_count;
64392
64393 /*
64394 * These are the total time in nanoseconds that the event
64395 @@ -811,8 +811,8 @@ struct perf_event {
64396 * These accumulate total time (in nanoseconds) that children
64397 * events have been enabled and running, respectively.
64398 */
64399 - atomic64_t child_total_time_enabled;
64400 - atomic64_t child_total_time_running;
64401 + atomic64_unchecked_t child_total_time_enabled;
64402 + atomic64_unchecked_t child_total_time_running;
64403
64404 /*
64405 * Protect attach/detach and child_list:
64406 @@ -1090,9 +1090,9 @@ void perf_event_task_sched_out(struct ta
64407 }
64408
64409 extern void perf_event_mmap(struct vm_area_struct *vma);
64410 -extern struct perf_guest_info_callbacks *perf_guest_cbs;
64411 -extern int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64412 -extern int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64413 +extern const struct perf_guest_info_callbacks *perf_guest_cbs;
64414 +extern int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64415 +extern int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64416
64417 extern void perf_event_comm(struct task_struct *tsk);
64418 extern void perf_event_fork(struct task_struct *tsk);
64419 diff -urNp linux-2.6.39.1/include/linux/pipe_fs_i.h linux-2.6.39.1/include/linux/pipe_fs_i.h
64420 --- linux-2.6.39.1/include/linux/pipe_fs_i.h 2011-05-19 00:06:34.000000000 -0400
64421 +++ linux-2.6.39.1/include/linux/pipe_fs_i.h 2011-05-22 19:36:33.000000000 -0400
64422 @@ -46,9 +46,9 @@ struct pipe_buffer {
64423 struct pipe_inode_info {
64424 wait_queue_head_t wait;
64425 unsigned int nrbufs, curbuf, buffers;
64426 - unsigned int readers;
64427 - unsigned int writers;
64428 - unsigned int waiting_writers;
64429 + atomic_t readers;
64430 + atomic_t writers;
64431 + atomic_t waiting_writers;
64432 unsigned int r_counter;
64433 unsigned int w_counter;
64434 struct page *tmp_page;
64435 diff -urNp linux-2.6.39.1/include/linux/pm.h linux-2.6.39.1/include/linux/pm.h
64436 --- linux-2.6.39.1/include/linux/pm.h 2011-05-19 00:06:34.000000000 -0400
64437 +++ linux-2.6.39.1/include/linux/pm.h 2011-05-22 19:36:33.000000000 -0400
64438 @@ -268,7 +268,7 @@ const struct dev_pm_ops name = { \
64439 * runtime PM, make the pm member point to generic_subsys_pm_ops.
64440 */
64441 #ifdef CONFIG_PM
64442 -extern struct dev_pm_ops generic_subsys_pm_ops;
64443 +extern const struct dev_pm_ops generic_subsys_pm_ops;
64444 #define GENERIC_SUBSYS_PM_OPS (&generic_subsys_pm_ops)
64445 #else
64446 #define GENERIC_SUBSYS_PM_OPS NULL
64447 @@ -471,7 +471,7 @@ extern void update_pm_runtime_accounting
64448 * subsystem-level and driver-level callbacks.
64449 */
64450 struct dev_power_domain {
64451 - struct dev_pm_ops ops;
64452 + const struct dev_pm_ops ops;
64453 };
64454
64455 /*
64456 diff -urNp linux-2.6.39.1/include/linux/pm_runtime.h linux-2.6.39.1/include/linux/pm_runtime.h
64457 --- linux-2.6.39.1/include/linux/pm_runtime.h 2011-05-19 00:06:34.000000000 -0400
64458 +++ linux-2.6.39.1/include/linux/pm_runtime.h 2011-05-22 19:36:33.000000000 -0400
64459 @@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_
64460
64461 static inline void pm_runtime_mark_last_busy(struct device *dev)
64462 {
64463 - ACCESS_ONCE(dev->power.last_busy) = jiffies;
64464 + ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
64465 }
64466
64467 #else /* !CONFIG_PM_RUNTIME */
64468 diff -urNp linux-2.6.39.1/include/linux/poison.h linux-2.6.39.1/include/linux/poison.h
64469 --- linux-2.6.39.1/include/linux/poison.h 2011-05-19 00:06:34.000000000 -0400
64470 +++ linux-2.6.39.1/include/linux/poison.h 2011-05-22 19:36:33.000000000 -0400
64471 @@ -19,8 +19,8 @@
64472 * under normal circumstances, used to verify that nobody uses
64473 * non-initialized list entries.
64474 */
64475 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
64476 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
64477 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
64478 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
64479
64480 /********** include/linux/timer.h **********/
64481 /*
64482 diff -urNp linux-2.6.39.1/include/linux/posix-timers.h linux-2.6.39.1/include/linux/posix-timers.h
64483 --- linux-2.6.39.1/include/linux/posix-timers.h 2011-05-19 00:06:34.000000000 -0400
64484 +++ linux-2.6.39.1/include/linux/posix-timers.h 2011-05-22 19:36:33.000000000 -0400
64485 @@ -102,10 +102,10 @@ struct k_clock {
64486 struct itimerspec * cur_setting);
64487 };
64488
64489 -extern struct k_clock clock_posix_cpu;
64490 -extern struct k_clock clock_posix_dynamic;
64491 +extern const struct k_clock clock_posix_cpu;
64492 +extern const struct k_clock clock_posix_dynamic;
64493
64494 -void posix_timers_register_clock(const clockid_t clock_id, struct k_clock *new_clock);
64495 +void posix_timers_register_clock(const clockid_t clock_id, const struct k_clock *new_clock);
64496
64497 /* function to call to trigger timer event */
64498 int posix_timer_event(struct k_itimer *timr, int si_private);
64499 diff -urNp linux-2.6.39.1/include/linux/proc_fs.h linux-2.6.39.1/include/linux/proc_fs.h
64500 --- linux-2.6.39.1/include/linux/proc_fs.h 2011-05-19 00:06:34.000000000 -0400
64501 +++ linux-2.6.39.1/include/linux/proc_fs.h 2011-05-22 19:41:42.000000000 -0400
64502 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
64503 return proc_create_data(name, mode, parent, proc_fops, NULL);
64504 }
64505
64506 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
64507 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
64508 +{
64509 +#ifdef CONFIG_GRKERNSEC_PROC_USER
64510 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
64511 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64512 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
64513 +#else
64514 + return proc_create_data(name, mode, parent, proc_fops, NULL);
64515 +#endif
64516 +}
64517 +
64518 +
64519 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
64520 mode_t mode, struct proc_dir_entry *base,
64521 read_proc_t *read_proc, void * data)
64522 diff -urNp linux-2.6.39.1/include/linux/ptrace.h linux-2.6.39.1/include/linux/ptrace.h
64523 --- linux-2.6.39.1/include/linux/ptrace.h 2011-05-19 00:06:34.000000000 -0400
64524 +++ linux-2.6.39.1/include/linux/ptrace.h 2011-05-22 19:41:42.000000000 -0400
64525 @@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
64526 extern void exit_ptrace(struct task_struct *tracer);
64527 #define PTRACE_MODE_READ 1
64528 #define PTRACE_MODE_ATTACH 2
64529 -/* Returns 0 on success, -errno on denial. */
64530 -extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
64531 /* Returns true on success, false on denial. */
64532 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
64533 +/* Returns true on success, false on denial. */
64534 +extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
64535
64536 static inline int ptrace_reparented(struct task_struct *child)
64537 {
64538 diff -urNp linux-2.6.39.1/include/linux/random.h linux-2.6.39.1/include/linux/random.h
64539 --- linux-2.6.39.1/include/linux/random.h 2011-05-19 00:06:34.000000000 -0400
64540 +++ linux-2.6.39.1/include/linux/random.h 2011-05-22 19:36:33.000000000 -0400
64541 @@ -80,12 +80,17 @@ void srandom32(u32 seed);
64542
64543 u32 prandom32(struct rnd_state *);
64544
64545 +static inline unsigned long pax_get_random_long(void)
64546 +{
64547 + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
64548 +}
64549 +
64550 /*
64551 * Handle minimum values for seeds
64552 */
64553 static inline u32 __seed(u32 x, u32 m)
64554 {
64555 - return (x < m) ? x + m : x;
64556 + return (x <= m) ? x + m + 1 : x;
64557 }
64558
64559 /**
64560 diff -urNp linux-2.6.39.1/include/linux/reboot.h linux-2.6.39.1/include/linux/reboot.h
64561 --- linux-2.6.39.1/include/linux/reboot.h 2011-05-19 00:06:34.000000000 -0400
64562 +++ linux-2.6.39.1/include/linux/reboot.h 2011-05-22 19:36:33.000000000 -0400
64563 @@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
64564 * Architecture-specific implementations of sys_reboot commands.
64565 */
64566
64567 -extern void machine_restart(char *cmd);
64568 -extern void machine_halt(void);
64569 -extern void machine_power_off(void);
64570 +extern void machine_restart(char *cmd) __noreturn;
64571 +extern void machine_halt(void) __noreturn;
64572 +extern void machine_power_off(void) __noreturn;
64573
64574 extern void machine_shutdown(void);
64575 struct pt_regs;
64576 @@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
64577 */
64578
64579 extern void kernel_restart_prepare(char *cmd);
64580 -extern void kernel_restart(char *cmd);
64581 -extern void kernel_halt(void);
64582 -extern void kernel_power_off(void);
64583 +extern void kernel_restart(char *cmd) __noreturn;
64584 +extern void kernel_halt(void) __noreturn;
64585 +extern void kernel_power_off(void) __noreturn;
64586
64587 extern int C_A_D; /* for sysctl */
64588 void ctrl_alt_del(void);
64589 @@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
64590 * Emergency restart, callable from an interrupt handler.
64591 */
64592
64593 -extern void emergency_restart(void);
64594 +extern void emergency_restart(void) __noreturn;
64595 #include <asm/emergency-restart.h>
64596
64597 #endif
64598 diff -urNp linux-2.6.39.1/include/linux/reiserfs_fs.h linux-2.6.39.1/include/linux/reiserfs_fs.h
64599 --- linux-2.6.39.1/include/linux/reiserfs_fs.h 2011-05-19 00:06:34.000000000 -0400
64600 +++ linux-2.6.39.1/include/linux/reiserfs_fs.h 2011-05-22 19:36:33.000000000 -0400
64601 @@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset
64602 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
64603
64604 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
64605 -#define get_generation(s) atomic_read (&fs_generation(s))
64606 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
64607 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
64608 #define __fs_changed(gen,s) (gen != get_generation (s))
64609 #define fs_changed(gen,s) \
64610 @@ -1618,24 +1618,24 @@ static inline struct super_block *sb_fro
64611 */
64612
64613 struct item_operations {
64614 - int (*bytes_number) (struct item_head * ih, int block_size);
64615 - void (*decrement_key) (struct cpu_key *);
64616 - int (*is_left_mergeable) (struct reiserfs_key * ih,
64617 + int (* const bytes_number) (struct item_head * ih, int block_size);
64618 + void (* const decrement_key) (struct cpu_key *);
64619 + int (* const is_left_mergeable) (struct reiserfs_key * ih,
64620 unsigned long bsize);
64621 - void (*print_item) (struct item_head *, char *item);
64622 - void (*check_item) (struct item_head *, char *item);
64623 + void (* const print_item) (struct item_head *, char *item);
64624 + void (* const check_item) (struct item_head *, char *item);
64625
64626 - int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64627 + int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64628 int is_affected, int insert_size);
64629 - int (*check_left) (struct virtual_item * vi, int free,
64630 + int (* const check_left) (struct virtual_item * vi, int free,
64631 int start_skip, int end_skip);
64632 - int (*check_right) (struct virtual_item * vi, int free);
64633 - int (*part_size) (struct virtual_item * vi, int from, int to);
64634 - int (*unit_num) (struct virtual_item * vi);
64635 - void (*print_vi) (struct virtual_item * vi);
64636 + int (* const check_right) (struct virtual_item * vi, int free);
64637 + int (* const part_size) (struct virtual_item * vi, int from, int to);
64638 + int (* const unit_num) (struct virtual_item * vi);
64639 + void (* const print_vi) (struct virtual_item * vi);
64640 };
64641
64642 -extern struct item_operations *item_ops[TYPE_ANY + 1];
64643 +extern const struct item_operations * const item_ops[TYPE_ANY + 1];
64644
64645 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
64646 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
64647 diff -urNp linux-2.6.39.1/include/linux/reiserfs_fs_sb.h linux-2.6.39.1/include/linux/reiserfs_fs_sb.h
64648 --- linux-2.6.39.1/include/linux/reiserfs_fs_sb.h 2011-05-19 00:06:34.000000000 -0400
64649 +++ linux-2.6.39.1/include/linux/reiserfs_fs_sb.h 2011-05-22 19:36:33.000000000 -0400
64650 @@ -386,7 +386,7 @@ struct reiserfs_sb_info {
64651 /* Comment? -Hans */
64652 wait_queue_head_t s_wait;
64653 /* To be obsoleted soon by per buffer seals.. -Hans */
64654 - atomic_t s_generation_counter; // increased by one every time the
64655 + atomic_unchecked_t s_generation_counter; // increased by one every time the
64656 // tree gets re-balanced
64657 unsigned long s_properties; /* File system properties. Currently holds
64658 on-disk FS format */
64659 diff -urNp linux-2.6.39.1/include/linux/rmap.h linux-2.6.39.1/include/linux/rmap.h
64660 --- linux-2.6.39.1/include/linux/rmap.h 2011-05-19 00:06:34.000000000 -0400
64661 +++ linux-2.6.39.1/include/linux/rmap.h 2011-05-22 19:36:33.000000000 -0400
64662 @@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc
64663 void anon_vma_init(void); /* create anon_vma_cachep */
64664 int anon_vma_prepare(struct vm_area_struct *);
64665 void unlink_anon_vmas(struct vm_area_struct *);
64666 -int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
64667 -int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
64668 +int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
64669 +int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
64670 void __anon_vma_link(struct vm_area_struct *);
64671
64672 static inline void anon_vma_merge(struct vm_area_struct *vma,
64673 diff -urNp linux-2.6.39.1/include/linux/sched.h linux-2.6.39.1/include/linux/sched.h
64674 --- linux-2.6.39.1/include/linux/sched.h 2011-05-19 00:06:34.000000000 -0400
64675 +++ linux-2.6.39.1/include/linux/sched.h 2011-06-03 23:34:26.000000000 -0400
64676 @@ -100,6 +100,7 @@ struct bio_list;
64677 struct fs_struct;
64678 struct perf_event_context;
64679 struct blk_plug;
64680 +struct linux_binprm;
64681
64682 /*
64683 * List of flags we want to share for kernel threads,
64684 @@ -360,7 +361,7 @@ extern signed long schedule_timeout_inte
64685 extern signed long schedule_timeout_killable(signed long timeout);
64686 extern signed long schedule_timeout_uninterruptible(signed long timeout);
64687 asmlinkage void schedule(void);
64688 -extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
64689 +extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
64690
64691 struct nsproxy;
64692 struct user_namespace;
64693 @@ -381,10 +382,13 @@ struct user_namespace;
64694 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
64695
64696 extern int sysctl_max_map_count;
64697 +extern unsigned long sysctl_heap_stack_gap;
64698
64699 #include <linux/aio.h>
64700
64701 #ifdef CONFIG_MMU
64702 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
64703 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
64704 extern void arch_pick_mmap_layout(struct mm_struct *mm);
64705 extern unsigned long
64706 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
64707 @@ -629,6 +633,17 @@ struct signal_struct {
64708 #ifdef CONFIG_TASKSTATS
64709 struct taskstats *stats;
64710 #endif
64711 +
64712 +#ifdef CONFIG_GRKERNSEC
64713 + u32 curr_ip;
64714 + u32 saved_ip;
64715 + u32 gr_saddr;
64716 + u32 gr_daddr;
64717 + u16 gr_sport;
64718 + u16 gr_dport;
64719 + u8 used_accept:1;
64720 +#endif
64721 +
64722 #ifdef CONFIG_AUDIT
64723 unsigned audit_tty;
64724 struct tty_audit_buf *tty_audit_buf;
64725 @@ -701,6 +716,11 @@ struct user_struct {
64726 struct key *session_keyring; /* UID's default session keyring */
64727 #endif
64728
64729 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
64730 + unsigned int banned;
64731 + unsigned long ban_expires;
64732 +#endif
64733 +
64734 /* Hash table maintenance information */
64735 struct hlist_node uidhash_node;
64736 uid_t uid;
64737 @@ -1310,8 +1330,8 @@ struct task_struct {
64738 struct list_head thread_group;
64739
64740 struct completion *vfork_done; /* for vfork() */
64741 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
64742 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64743 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
64744 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64745
64746 cputime_t utime, stime, utimescaled, stimescaled;
64747 cputime_t gtime;
64748 @@ -1327,13 +1347,6 @@ struct task_struct {
64749 struct task_cputime cputime_expires;
64750 struct list_head cpu_timers[3];
64751
64752 -/* process credentials */
64753 - const struct cred __rcu *real_cred; /* objective and real subjective task
64754 - * credentials (COW) */
64755 - const struct cred __rcu *cred; /* effective (overridable) subjective task
64756 - * credentials (COW) */
64757 - struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64758 -
64759 char comm[TASK_COMM_LEN]; /* executable name excluding path
64760 - access with [gs]et_task_comm (which lock
64761 it with task_lock())
64762 @@ -1350,8 +1363,16 @@ struct task_struct {
64763 #endif
64764 /* CPU-specific state of this task */
64765 struct thread_struct thread;
64766 +/* thread_info moved to task_struct */
64767 +#ifdef CONFIG_X86
64768 + struct thread_info tinfo;
64769 +#endif
64770 /* filesystem information */
64771 struct fs_struct *fs;
64772 +
64773 + const struct cred __rcu *cred; /* effective (overridable) subjective task
64774 + * credentials (COW) */
64775 +
64776 /* open file information */
64777 struct files_struct *files;
64778 /* namespaces */
64779 @@ -1398,6 +1419,11 @@ struct task_struct {
64780 struct rt_mutex_waiter *pi_blocked_on;
64781 #endif
64782
64783 +/* process credentials */
64784 + const struct cred __rcu *real_cred; /* objective and real subjective task
64785 + * credentials (COW) */
64786 + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64787 +
64788 #ifdef CONFIG_DEBUG_MUTEXES
64789 /* mutex deadlock detection */
64790 struct mutex_waiter *blocked_on;
64791 @@ -1508,6 +1534,21 @@ struct task_struct {
64792 unsigned long default_timer_slack_ns;
64793
64794 struct list_head *scm_work_list;
64795 +
64796 +#ifdef CONFIG_GRKERNSEC
64797 + /* grsecurity */
64798 + struct dentry *gr_chroot_dentry;
64799 + struct acl_subject_label *acl;
64800 + struct acl_role_label *role;
64801 + struct file *exec_file;
64802 + u16 acl_role_id;
64803 + /* is this the task that authenticated to the special role */
64804 + u8 acl_sp_role;
64805 + u8 is_writable;
64806 + u8 brute;
64807 + u8 gr_is_chrooted;
64808 +#endif
64809 +
64810 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
64811 /* Index of current stored address in ret_stack */
64812 int curr_ret_stack;
64813 @@ -1542,6 +1583,57 @@ struct task_struct {
64814 #endif
64815 };
64816
64817 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
64818 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
64819 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
64820 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
64821 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
64822 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
64823 +
64824 +#ifdef CONFIG_PAX_SOFTMODE
64825 +extern unsigned int pax_softmode;
64826 +#endif
64827 +
64828 +extern int pax_check_flags(unsigned long *);
64829 +
64830 +/* if tsk != current then task_lock must be held on it */
64831 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
64832 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
64833 +{
64834 + if (likely(tsk->mm))
64835 + return tsk->mm->pax_flags;
64836 + else
64837 + return 0UL;
64838 +}
64839 +
64840 +/* if tsk != current then task_lock must be held on it */
64841 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
64842 +{
64843 + if (likely(tsk->mm)) {
64844 + tsk->mm->pax_flags = flags;
64845 + return 0;
64846 + }
64847 + return -EINVAL;
64848 +}
64849 +#endif
64850 +
64851 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
64852 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
64853 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
64854 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
64855 +#endif
64856 +
64857 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
64858 +void pax_report_insns(void *pc, void *sp);
64859 +void pax_report_refcount_overflow(struct pt_regs *regs);
64860 +void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
64861 +
64862 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
64863 +extern void pax_track_stack(void);
64864 +#else
64865 +static inline void pax_track_stack(void) {}
64866 +#endif
64867 +
64868 /* Future-safe accessor for struct task_struct's cpus_allowed. */
64869 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
64870
64871 @@ -2009,7 +2101,9 @@ void yield(void);
64872 extern struct exec_domain default_exec_domain;
64873
64874 union thread_union {
64875 +#ifndef CONFIG_X86
64876 struct thread_info thread_info;
64877 +#endif
64878 unsigned long stack[THREAD_SIZE/sizeof(long)];
64879 };
64880
64881 @@ -2179,7 +2273,7 @@ extern void __cleanup_sighand(struct sig
64882 extern void exit_itimers(struct signal_struct *);
64883 extern void flush_itimer_signals(void);
64884
64885 -extern NORET_TYPE void do_group_exit(int);
64886 +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
64887
64888 extern void daemonize(const char *, ...);
64889 extern int allow_signal(int);
64890 @@ -2320,13 +2414,17 @@ static inline unsigned long *end_of_stac
64891
64892 #endif
64893
64894 -static inline int object_is_on_stack(void *obj)
64895 +static inline int object_starts_on_stack(void *obj)
64896 {
64897 - void *stack = task_stack_page(current);
64898 + const void *stack = task_stack_page(current);
64899
64900 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
64901 }
64902
64903 +#ifdef CONFIG_PAX_USERCOPY
64904 +extern int object_is_on_stack(const void *obj, unsigned long len);
64905 +#endif
64906 +
64907 extern void thread_info_cache_init(void);
64908
64909 #ifdef CONFIG_DEBUG_STACK_USAGE
64910 diff -urNp linux-2.6.39.1/include/linux/screen_info.h linux-2.6.39.1/include/linux/screen_info.h
64911 --- linux-2.6.39.1/include/linux/screen_info.h 2011-05-19 00:06:34.000000000 -0400
64912 +++ linux-2.6.39.1/include/linux/screen_info.h 2011-05-22 19:36:33.000000000 -0400
64913 @@ -43,7 +43,8 @@ struct screen_info {
64914 __u16 pages; /* 0x32 */
64915 __u16 vesa_attributes; /* 0x34 */
64916 __u32 capabilities; /* 0x36 */
64917 - __u8 _reserved[6]; /* 0x3a */
64918 + __u16 vesapm_size; /* 0x3a */
64919 + __u8 _reserved[4]; /* 0x3c */
64920 } __attribute__((packed));
64921
64922 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
64923 diff -urNp linux-2.6.39.1/include/linux/security.h linux-2.6.39.1/include/linux/security.h
64924 --- linux-2.6.39.1/include/linux/security.h 2011-05-19 00:06:34.000000000 -0400
64925 +++ linux-2.6.39.1/include/linux/security.h 2011-05-22 19:41:42.000000000 -0400
64926 @@ -36,6 +36,7 @@
64927 #include <linux/key.h>
64928 #include <linux/xfrm.h>
64929 #include <linux/slab.h>
64930 +#include <linux/grsecurity.h>
64931 #include <net/flow.h>
64932
64933 /* Maximum number of letters for an LSM name string */
64934 diff -urNp linux-2.6.39.1/include/linux/shm.h linux-2.6.39.1/include/linux/shm.h
64935 --- linux-2.6.39.1/include/linux/shm.h 2011-05-19 00:06:34.000000000 -0400
64936 +++ linux-2.6.39.1/include/linux/shm.h 2011-05-22 19:41:42.000000000 -0400
64937 @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
64938 pid_t shm_cprid;
64939 pid_t shm_lprid;
64940 struct user_struct *mlock_user;
64941 +#ifdef CONFIG_GRKERNSEC
64942 + time_t shm_createtime;
64943 + pid_t shm_lapid;
64944 +#endif
64945 };
64946
64947 /* shm_mode upper byte flags */
64948 diff -urNp linux-2.6.39.1/include/linux/skbuff.h linux-2.6.39.1/include/linux/skbuff.h
64949 --- linux-2.6.39.1/include/linux/skbuff.h 2011-05-19 00:06:34.000000000 -0400
64950 +++ linux-2.6.39.1/include/linux/skbuff.h 2011-05-22 19:36:33.000000000 -0400
64951 @@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp
64952 */
64953 static inline int skb_queue_empty(const struct sk_buff_head *list)
64954 {
64955 - return list->next == (struct sk_buff *)list;
64956 + return list->next == (const struct sk_buff *)list;
64957 }
64958
64959 /**
64960 @@ -605,7 +605,7 @@ static inline int skb_queue_empty(const
64961 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
64962 const struct sk_buff *skb)
64963 {
64964 - return skb->next == (struct sk_buff *)list;
64965 + return skb->next == (const struct sk_buff *)list;
64966 }
64967
64968 /**
64969 @@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con
64970 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
64971 const struct sk_buff *skb)
64972 {
64973 - return skb->prev == (struct sk_buff *)list;
64974 + return skb->prev == (const struct sk_buff *)list;
64975 }
64976
64977 /**
64978 @@ -1435,7 +1435,7 @@ static inline int pskb_network_may_pull(
64979 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
64980 */
64981 #ifndef NET_SKB_PAD
64982 -#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
64983 +#define NET_SKB_PAD max(_AC(32,U), L1_CACHE_BYTES)
64984 #endif
64985
64986 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
64987 diff -urNp linux-2.6.39.1/include/linux/slab_def.h linux-2.6.39.1/include/linux/slab_def.h
64988 --- linux-2.6.39.1/include/linux/slab_def.h 2011-05-19 00:06:34.000000000 -0400
64989 +++ linux-2.6.39.1/include/linux/slab_def.h 2011-05-22 19:36:33.000000000 -0400
64990 @@ -96,10 +96,10 @@ struct kmem_cache {
64991 unsigned long node_allocs;
64992 unsigned long node_frees;
64993 unsigned long node_overflow;
64994 - atomic_t allochit;
64995 - atomic_t allocmiss;
64996 - atomic_t freehit;
64997 - atomic_t freemiss;
64998 + atomic_unchecked_t allochit;
64999 + atomic_unchecked_t allocmiss;
65000 + atomic_unchecked_t freehit;
65001 + atomic_unchecked_t freemiss;
65002
65003 /*
65004 * If debugging is enabled, then the allocator can add additional
65005 diff -urNp linux-2.6.39.1/include/linux/slab.h linux-2.6.39.1/include/linux/slab.h
65006 --- linux-2.6.39.1/include/linux/slab.h 2011-05-19 00:06:34.000000000 -0400
65007 +++ linux-2.6.39.1/include/linux/slab.h 2011-05-23 17:07:00.000000000 -0400
65008 @@ -11,12 +11,20 @@
65009
65010 #include <linux/gfp.h>
65011 #include <linux/types.h>
65012 +#include <linux/err.h>
65013
65014 /*
65015 * Flags to pass to kmem_cache_create().
65016 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
65017 */
65018 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
65019 +
65020 +#ifdef CONFIG_PAX_USERCOPY
65021 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
65022 +#else
65023 +#define SLAB_USERCOPY 0x00000000UL
65024 +#endif
65025 +
65026 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
65027 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
65028 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
65029 @@ -87,10 +95,13 @@
65030 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
65031 * Both make kfree a no-op.
65032 */
65033 -#define ZERO_SIZE_PTR ((void *)16)
65034 +#define ZERO_SIZE_PTR \
65035 +({ \
65036 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
65037 + (void *)(-MAX_ERRNO-1L); \
65038 +})
65039
65040 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
65041 - (unsigned long)ZERO_SIZE_PTR)
65042 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
65043
65044 /*
65045 * struct kmem_cache related prototypes
65046 @@ -141,6 +152,7 @@ void * __must_check krealloc(const void
65047 void kfree(const void *);
65048 void kzfree(const void *);
65049 size_t ksize(const void *);
65050 +void check_object_size(const void *ptr, unsigned long n, bool to);
65051
65052 /*
65053 * Allocator specific definitions. These are mainly used to establish optimized
65054 @@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t
65055
65056 void __init kmem_cache_init_late(void);
65057
65058 +#define kmalloc(x, y) \
65059 +({ \
65060 + void *___retval; \
65061 + intoverflow_t ___x = (intoverflow_t)x; \
65062 + if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
65063 + ___retval = NULL; \
65064 + else \
65065 + ___retval = kmalloc((size_t)___x, (y)); \
65066 + ___retval; \
65067 +})
65068 +
65069 +#define kmalloc_node(x, y, z) \
65070 +({ \
65071 + void *___retval; \
65072 + intoverflow_t ___x = (intoverflow_t)x; \
65073 + if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
65074 + ___retval = NULL; \
65075 + else \
65076 + ___retval = kmalloc_node((size_t)___x, (y), (z));\
65077 + ___retval; \
65078 +})
65079 +
65080 +#define kzalloc(x, y) \
65081 +({ \
65082 + void *___retval; \
65083 + intoverflow_t ___x = (intoverflow_t)x; \
65084 + if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
65085 + ___retval = NULL; \
65086 + else \
65087 + ___retval = kzalloc((size_t)___x, (y)); \
65088 + ___retval; \
65089 +})
65090 +
65091 +#define __krealloc(x, y, z) \
65092 +({ \
65093 + void *___retval; \
65094 + intoverflow_t ___y = (intoverflow_t)y; \
65095 + if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
65096 + ___retval = NULL; \
65097 + else \
65098 + ___retval = __krealloc((x), (size_t)___y, (z)); \
65099 + ___retval; \
65100 +})
65101 +
65102 +#define krealloc(x, y, z) \
65103 +({ \
65104 + void *___retval; \
65105 + intoverflow_t ___y = (intoverflow_t)y; \
65106 + if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
65107 + ___retval = NULL; \
65108 + else \
65109 + ___retval = krealloc((x), (size_t)___y, (z)); \
65110 + ___retval; \
65111 +})
65112 +
65113 #endif /* _LINUX_SLAB_H */
65114 diff -urNp linux-2.6.39.1/include/linux/slub_def.h linux-2.6.39.1/include/linux/slub_def.h
65115 --- linux-2.6.39.1/include/linux/slub_def.h 2011-05-19 00:06:34.000000000 -0400
65116 +++ linux-2.6.39.1/include/linux/slub_def.h 2011-05-22 19:36:33.000000000 -0400
65117 @@ -84,7 +84,7 @@ struct kmem_cache {
65118 struct kmem_cache_order_objects max;
65119 struct kmem_cache_order_objects min;
65120 gfp_t allocflags; /* gfp flags to use on each alloc */
65121 - int refcount; /* Refcount for slab cache destroy */
65122 + atomic_t refcount; /* Refcount for slab cache destroy */
65123 void (*ctor)(void *);
65124 int inuse; /* Offset to metadata */
65125 int align; /* Alignment */
65126 diff -urNp linux-2.6.39.1/include/linux/sonet.h linux-2.6.39.1/include/linux/sonet.h
65127 --- linux-2.6.39.1/include/linux/sonet.h 2011-05-19 00:06:34.000000000 -0400
65128 +++ linux-2.6.39.1/include/linux/sonet.h 2011-05-22 19:36:33.000000000 -0400
65129 @@ -61,7 +61,7 @@ struct sonet_stats {
65130 #include <asm/atomic.h>
65131
65132 struct k_sonet_stats {
65133 -#define __HANDLE_ITEM(i) atomic_t i
65134 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
65135 __SONET_ITEMS
65136 #undef __HANDLE_ITEM
65137 };
65138 diff -urNp linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h
65139 --- linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h 2011-05-19 00:06:34.000000000 -0400
65140 +++ linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h 2011-05-22 19:36:33.000000000 -0400
65141 @@ -44,7 +44,7 @@ struct ssb_gige {
65142
65143 /* The PCI controller device. */
65144 struct pci_controller pci_controller;
65145 - struct pci_ops pci_ops;
65146 + const struct pci_ops pci_ops;
65147 struct resource mem_resource;
65148 struct resource io_resource;
65149 };
65150 diff -urNp linux-2.6.39.1/include/linux/sunrpc/clnt.h linux-2.6.39.1/include/linux/sunrpc/clnt.h
65151 --- linux-2.6.39.1/include/linux/sunrpc/clnt.h 2011-05-19 00:06:34.000000000 -0400
65152 +++ linux-2.6.39.1/include/linux/sunrpc/clnt.h 2011-05-22 19:36:33.000000000 -0400
65153 @@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por
65154 {
65155 switch (sap->sa_family) {
65156 case AF_INET:
65157 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
65158 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
65159 case AF_INET6:
65160 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
65161 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
65162 }
65163 return 0;
65164 }
65165 @@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const
65166 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
65167 const struct sockaddr *src)
65168 {
65169 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
65170 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
65171 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
65172
65173 dsin->sin_family = ssin->sin_family;
65174 @@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const
65175 if (sa->sa_family != AF_INET6)
65176 return 0;
65177
65178 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
65179 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
65180 }
65181
65182 #endif /* __KERNEL__ */
65183 diff -urNp linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h
65184 --- linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h 2011-05-19 00:06:34.000000000 -0400
65185 +++ linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h 2011-05-22 19:36:33.000000000 -0400
65186 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
65187 extern unsigned int svcrdma_max_requests;
65188 extern unsigned int svcrdma_max_req_size;
65189
65190 -extern atomic_t rdma_stat_recv;
65191 -extern atomic_t rdma_stat_read;
65192 -extern atomic_t rdma_stat_write;
65193 -extern atomic_t rdma_stat_sq_starve;
65194 -extern atomic_t rdma_stat_rq_starve;
65195 -extern atomic_t rdma_stat_rq_poll;
65196 -extern atomic_t rdma_stat_rq_prod;
65197 -extern atomic_t rdma_stat_sq_poll;
65198 -extern atomic_t rdma_stat_sq_prod;
65199 +extern atomic_unchecked_t rdma_stat_recv;
65200 +extern atomic_unchecked_t rdma_stat_read;
65201 +extern atomic_unchecked_t rdma_stat_write;
65202 +extern atomic_unchecked_t rdma_stat_sq_starve;
65203 +extern atomic_unchecked_t rdma_stat_rq_starve;
65204 +extern atomic_unchecked_t rdma_stat_rq_poll;
65205 +extern atomic_unchecked_t rdma_stat_rq_prod;
65206 +extern atomic_unchecked_t rdma_stat_sq_poll;
65207 +extern atomic_unchecked_t rdma_stat_sq_prod;
65208
65209 #define RPCRDMA_VERSION 1
65210
65211 diff -urNp linux-2.6.39.1/include/linux/suspend.h linux-2.6.39.1/include/linux/suspend.h
65212 --- linux-2.6.39.1/include/linux/suspend.h 2011-05-19 00:06:34.000000000 -0400
65213 +++ linux-2.6.39.1/include/linux/suspend.h 2011-05-22 19:36:33.000000000 -0400
65214 @@ -106,15 +106,15 @@ typedef int __bitwise suspend_state_t;
65215 * which require special recovery actions in that situation.
65216 */
65217 struct platform_suspend_ops {
65218 - int (*valid)(suspend_state_t state);
65219 - int (*begin)(suspend_state_t state);
65220 - int (*prepare)(void);
65221 - int (*prepare_late)(void);
65222 - int (*enter)(suspend_state_t state);
65223 - void (*wake)(void);
65224 - void (*finish)(void);
65225 - void (*end)(void);
65226 - void (*recover)(void);
65227 + int (* const valid)(suspend_state_t state);
65228 + int (* const begin)(suspend_state_t state);
65229 + int (* const prepare)(void);
65230 + int (* const prepare_late)(void);
65231 + int (* const enter)(suspend_state_t state);
65232 + void (* const wake)(void);
65233 + void (* const finish)(void);
65234 + void (* const end)(void);
65235 + void (* const recover)(void);
65236 };
65237
65238 #ifdef CONFIG_SUSPEND
65239 @@ -217,16 +217,16 @@ extern void mark_free_pages(struct zone
65240 * platforms which require special recovery actions in that situation.
65241 */
65242 struct platform_hibernation_ops {
65243 - int (*begin)(void);
65244 - void (*end)(void);
65245 - int (*pre_snapshot)(void);
65246 - void (*finish)(void);
65247 - int (*prepare)(void);
65248 - int (*enter)(void);
65249 - void (*leave)(void);
65250 - int (*pre_restore)(void);
65251 - void (*restore_cleanup)(void);
65252 - void (*recover)(void);
65253 + int (* const begin)(void);
65254 + void (* const end)(void);
65255 + int (* const pre_snapshot)(void);
65256 + void (* const finish)(void);
65257 + int (* const prepare)(void);
65258 + int (* const enter)(void);
65259 + void (* const leave)(void);
65260 + int (* const pre_restore)(void);
65261 + void (* const restore_cleanup)(void);
65262 + void (* const recover)(void);
65263 };
65264
65265 #ifdef CONFIG_HIBERNATION
65266 diff -urNp linux-2.6.39.1/include/linux/sysctl.h linux-2.6.39.1/include/linux/sysctl.h
65267 --- linux-2.6.39.1/include/linux/sysctl.h 2011-05-19 00:06:34.000000000 -0400
65268 +++ linux-2.6.39.1/include/linux/sysctl.h 2011-05-22 19:41:42.000000000 -0400
65269 @@ -155,7 +155,11 @@ enum
65270 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
65271 };
65272
65273 -
65274 +#ifdef CONFIG_PAX_SOFTMODE
65275 +enum {
65276 + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
65277 +};
65278 +#endif
65279
65280 /* CTL_VM names: */
65281 enum
65282 @@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab
65283
65284 extern int proc_dostring(struct ctl_table *, int,
65285 void __user *, size_t *, loff_t *);
65286 +extern int proc_dostring_modpriv(struct ctl_table *, int,
65287 + void __user *, size_t *, loff_t *);
65288 extern int proc_dointvec(struct ctl_table *, int,
65289 void __user *, size_t *, loff_t *);
65290 extern int proc_dointvec_minmax(struct ctl_table *, int,
65291 diff -urNp linux-2.6.39.1/include/linux/sysfs.h linux-2.6.39.1/include/linux/sysfs.h
65292 --- linux-2.6.39.1/include/linux/sysfs.h 2011-05-19 00:06:34.000000000 -0400
65293 +++ linux-2.6.39.1/include/linux/sysfs.h 2011-05-22 19:36:33.000000000 -0400
65294 @@ -110,8 +110,8 @@ struct bin_attribute {
65295 #define sysfs_bin_attr_init(bin_attr) sysfs_attr_init(&(bin_attr)->attr)
65296
65297 struct sysfs_ops {
65298 - ssize_t (*show)(struct kobject *, struct attribute *,char *);
65299 - ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
65300 + ssize_t (* const show)(struct kobject *, struct attribute *,char *);
65301 + ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
65302 };
65303
65304 struct sysfs_dirent;
65305 diff -urNp linux-2.6.39.1/include/linux/tty.h linux-2.6.39.1/include/linux/tty.h
65306 --- linux-2.6.39.1/include/linux/tty.h 2011-05-19 00:06:34.000000000 -0400
65307 +++ linux-2.6.39.1/include/linux/tty.h 2011-05-22 19:36:33.000000000 -0400
65308 @@ -13,6 +13,7 @@
65309 #include <linux/tty_driver.h>
65310 #include <linux/tty_ldisc.h>
65311 #include <linux/mutex.h>
65312 +#include <linux/poll.h>
65313
65314 #include <asm/system.h>
65315
65316 @@ -466,7 +467,6 @@ extern int tty_perform_flush(struct tty_
65317 extern dev_t tty_devnum(struct tty_struct *tty);
65318 extern void proc_clear_tty(struct task_struct *p);
65319 extern struct tty_struct *get_current_tty(void);
65320 -extern void tty_default_fops(struct file_operations *fops);
65321 extern struct tty_struct *alloc_tty_struct(void);
65322 extern int tty_add_file(struct tty_struct *tty, struct file *file);
65323 extern void free_tty_struct(struct tty_struct *tty);
65324 @@ -529,6 +529,18 @@ extern void tty_ldisc_begin(void);
65325 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
65326 extern void tty_ldisc_enable(struct tty_struct *tty);
65327
65328 +/* tty_io.c */
65329 +extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
65330 +extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
65331 +extern unsigned int tty_poll(struct file *, poll_table *);
65332 +#ifdef CONFIG_COMPAT
65333 +extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
65334 + unsigned long arg);
65335 +#else
65336 +#define tty_compat_ioctl NULL
65337 +#endif
65338 +extern int tty_release(struct inode *, struct file *);
65339 +extern int tty_fasync(int fd, struct file *filp, int on);
65340
65341 /* n_tty.c */
65342 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
65343 diff -urNp linux-2.6.39.1/include/linux/tty_ldisc.h linux-2.6.39.1/include/linux/tty_ldisc.h
65344 --- linux-2.6.39.1/include/linux/tty_ldisc.h 2011-05-19 00:06:34.000000000 -0400
65345 +++ linux-2.6.39.1/include/linux/tty_ldisc.h 2011-05-22 19:36:33.000000000 -0400
65346 @@ -148,7 +148,7 @@ struct tty_ldisc_ops {
65347
65348 struct module *owner;
65349
65350 - int refcount;
65351 + atomic_t refcount;
65352 };
65353
65354 struct tty_ldisc {
65355 diff -urNp linux-2.6.39.1/include/linux/types.h linux-2.6.39.1/include/linux/types.h
65356 --- linux-2.6.39.1/include/linux/types.h 2011-05-19 00:06:34.000000000 -0400
65357 +++ linux-2.6.39.1/include/linux/types.h 2011-05-22 19:36:33.000000000 -0400
65358 @@ -213,10 +213,26 @@ typedef struct {
65359 int counter;
65360 } atomic_t;
65361
65362 +#ifdef CONFIG_PAX_REFCOUNT
65363 +typedef struct {
65364 + int counter;
65365 +} atomic_unchecked_t;
65366 +#else
65367 +typedef atomic_t atomic_unchecked_t;
65368 +#endif
65369 +
65370 #ifdef CONFIG_64BIT
65371 typedef struct {
65372 long counter;
65373 } atomic64_t;
65374 +
65375 +#ifdef CONFIG_PAX_REFCOUNT
65376 +typedef struct {
65377 + long counter;
65378 +} atomic64_unchecked_t;
65379 +#else
65380 +typedef atomic64_t atomic64_unchecked_t;
65381 +#endif
65382 #endif
65383
65384 struct list_head {
65385 diff -urNp linux-2.6.39.1/include/linux/uaccess.h linux-2.6.39.1/include/linux/uaccess.h
65386 --- linux-2.6.39.1/include/linux/uaccess.h 2011-05-19 00:06:34.000000000 -0400
65387 +++ linux-2.6.39.1/include/linux/uaccess.h 2011-05-22 19:36:33.000000000 -0400
65388 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
65389 long ret; \
65390 mm_segment_t old_fs = get_fs(); \
65391 \
65392 - set_fs(KERNEL_DS); \
65393 pagefault_disable(); \
65394 + set_fs(KERNEL_DS); \
65395 ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
65396 - pagefault_enable(); \
65397 set_fs(old_fs); \
65398 + pagefault_enable(); \
65399 ret; \
65400 })
65401
65402 @@ -93,8 +93,8 @@ static inline unsigned long __copy_from_
65403 * Safely read from address @src to the buffer at @dst. If a kernel fault
65404 * happens, handle that and return -EFAULT.
65405 */
65406 -extern long probe_kernel_read(void *dst, void *src, size_t size);
65407 -extern long __probe_kernel_read(void *dst, void *src, size_t size);
65408 +extern long probe_kernel_read(void *dst, const void *src, size_t size);
65409 +extern long __probe_kernel_read(void *dst, const void *src, size_t size);
65410
65411 /*
65412 * probe_kernel_write(): safely attempt to write to a location
65413 @@ -105,7 +105,7 @@ extern long __probe_kernel_read(void *ds
65414 * Safely write to address @dst from the buffer at @src. If a kernel fault
65415 * happens, handle that and return -EFAULT.
65416 */
65417 -extern long notrace probe_kernel_write(void *dst, void *src, size_t size);
65418 -extern long notrace __probe_kernel_write(void *dst, void *src, size_t size);
65419 +extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
65420 +extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
65421
65422 #endif /* __LINUX_UACCESS_H__ */
65423 diff -urNp linux-2.6.39.1/include/linux/unaligned/access_ok.h linux-2.6.39.1/include/linux/unaligned/access_ok.h
65424 --- linux-2.6.39.1/include/linux/unaligned/access_ok.h 2011-05-19 00:06:34.000000000 -0400
65425 +++ linux-2.6.39.1/include/linux/unaligned/access_ok.h 2011-05-22 19:36:33.000000000 -0400
65426 @@ -6,32 +6,32 @@
65427
65428 static inline u16 get_unaligned_le16(const void *p)
65429 {
65430 - return le16_to_cpup((__le16 *)p);
65431 + return le16_to_cpup((const __le16 *)p);
65432 }
65433
65434 static inline u32 get_unaligned_le32(const void *p)
65435 {
65436 - return le32_to_cpup((__le32 *)p);
65437 + return le32_to_cpup((const __le32 *)p);
65438 }
65439
65440 static inline u64 get_unaligned_le64(const void *p)
65441 {
65442 - return le64_to_cpup((__le64 *)p);
65443 + return le64_to_cpup((const __le64 *)p);
65444 }
65445
65446 static inline u16 get_unaligned_be16(const void *p)
65447 {
65448 - return be16_to_cpup((__be16 *)p);
65449 + return be16_to_cpup((const __be16 *)p);
65450 }
65451
65452 static inline u32 get_unaligned_be32(const void *p)
65453 {
65454 - return be32_to_cpup((__be32 *)p);
65455 + return be32_to_cpup((const __be32 *)p);
65456 }
65457
65458 static inline u64 get_unaligned_be64(const void *p)
65459 {
65460 - return be64_to_cpup((__be64 *)p);
65461 + return be64_to_cpup((const __be64 *)p);
65462 }
65463
65464 static inline void put_unaligned_le16(u16 val, void *p)
65465 diff -urNp linux-2.6.39.1/include/linux/usb/hcd.h linux-2.6.39.1/include/linux/usb/hcd.h
65466 --- linux-2.6.39.1/include/linux/usb/hcd.h 2011-05-19 00:06:34.000000000 -0400
65467 +++ linux-2.6.39.1/include/linux/usb/hcd.h 2011-05-22 19:36:33.000000000 -0400
65468 @@ -615,7 +615,7 @@ struct usb_mon_operations {
65469 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
65470 };
65471
65472 -extern struct usb_mon_operations *mon_ops;
65473 +extern const struct usb_mon_operations *mon_ops;
65474
65475 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
65476 {
65477 @@ -637,7 +637,7 @@ static inline void usbmon_urb_complete(s
65478 (*mon_ops->urb_complete)(bus, urb, status);
65479 }
65480
65481 -int usb_mon_register(struct usb_mon_operations *ops);
65482 +int usb_mon_register(const struct usb_mon_operations *ops);
65483 void usb_mon_deregister(void);
65484
65485 #else
65486 diff -urNp linux-2.6.39.1/include/linux/usb/intel_mid_otg.h linux-2.6.39.1/include/linux/usb/intel_mid_otg.h
65487 --- linux-2.6.39.1/include/linux/usb/intel_mid_otg.h 2011-05-19 00:06:34.000000000 -0400
65488 +++ linux-2.6.39.1/include/linux/usb/intel_mid_otg.h 2011-05-22 19:36:33.000000000 -0400
65489 @@ -115,7 +115,7 @@ struct intel_mid_otg_xceiv {
65490 void __iomem *base;
65491
65492 /* ops to access ulpi */
65493 - struct iotg_ulpi_access_ops ulpi_ops;
65494 + const struct iotg_ulpi_access_ops ulpi_ops;
65495
65496 /* atomic notifier for interrupt context */
65497 struct atomic_notifier_head iotg_notifier;
65498 diff -urNp linux-2.6.39.1/include/linux/usb/ulpi.h linux-2.6.39.1/include/linux/usb/ulpi.h
65499 --- linux-2.6.39.1/include/linux/usb/ulpi.h 2011-05-19 00:06:34.000000000 -0400
65500 +++ linux-2.6.39.1/include/linux/usb/ulpi.h 2011-05-22 19:36:33.000000000 -0400
65501 @@ -186,7 +186,7 @@ struct otg_transceiver *otg_ulpi_create(
65502
65503 #ifdef CONFIG_USB_ULPI_VIEWPORT
65504 /* access ops for controllers with a viewport register */
65505 -extern struct otg_io_access_ops ulpi_viewport_access_ops;
65506 +extern const struct otg_io_access_ops ulpi_viewport_access_ops;
65507 #endif
65508
65509 #endif /* __LINUX_USB_ULPI_H */
65510 diff -urNp linux-2.6.39.1/include/linux/vga_switcheroo.h linux-2.6.39.1/include/linux/vga_switcheroo.h
65511 --- linux-2.6.39.1/include/linux/vga_switcheroo.h 2011-05-19 00:06:34.000000000 -0400
65512 +++ linux-2.6.39.1/include/linux/vga_switcheroo.h 2011-05-22 19:36:33.000000000 -0400
65513 @@ -39,7 +39,7 @@ int vga_switcheroo_register_client(struc
65514 void vga_switcheroo_client_fb_set(struct pci_dev *dev,
65515 struct fb_info *info);
65516
65517 -int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler);
65518 +int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler);
65519 void vga_switcheroo_unregister_handler(void);
65520
65521 int vga_switcheroo_process_delayed_switch(void);
65522 @@ -52,7 +52,7 @@ static inline int vga_switcheroo_registe
65523 void (*reprobe)(struct pci_dev *dev),
65524 bool (*can_switch)(struct pci_dev *dev)) { return 0; }
65525 static inline void vga_switcheroo_client_fb_set(struct pci_dev *dev, struct fb_info *info) {}
65526 -static inline int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler) { return 0; }
65527 +static inline int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler) { return 0; }
65528 static inline void vga_switcheroo_unregister_handler(void) {}
65529 static inline int vga_switcheroo_process_delayed_switch(void) { return 0; }
65530
65531 diff -urNp linux-2.6.39.1/include/linux/virtio.h linux-2.6.39.1/include/linux/virtio.h
65532 --- linux-2.6.39.1/include/linux/virtio.h 2011-05-19 00:06:34.000000000 -0400
65533 +++ linux-2.6.39.1/include/linux/virtio.h 2011-05-22 19:36:33.000000000 -0400
65534 @@ -102,7 +102,7 @@ struct virtio_device {
65535 int index;
65536 struct device dev;
65537 struct virtio_device_id id;
65538 - struct virtio_config_ops *config;
65539 + const struct virtio_config_ops *config;
65540 struct list_head vqs;
65541 /* Note that this is a Linux set_bit-style bitmap. */
65542 unsigned long features[1];
65543 diff -urNp linux-2.6.39.1/include/linux/vmalloc.h linux-2.6.39.1/include/linux/vmalloc.h
65544 --- linux-2.6.39.1/include/linux/vmalloc.h 2011-05-19 00:06:34.000000000 -0400
65545 +++ linux-2.6.39.1/include/linux/vmalloc.h 2011-05-22 19:36:33.000000000 -0400
65546 @@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
65547 #define VM_MAP 0x00000004 /* vmap()ed pages */
65548 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
65549 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
65550 +
65551 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
65552 +#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
65553 +#endif
65554 +
65555 /* bits [20..32] reserved for arch specific ioremap internals */
65556
65557 /*
65558 @@ -155,4 +160,103 @@ pcpu_free_vm_areas(struct vm_struct **vm
65559 # endif
65560 #endif
65561
65562 +#define vmalloc(x) \
65563 +({ \
65564 + void *___retval; \
65565 + intoverflow_t ___x = (intoverflow_t)x; \
65566 + if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
65567 + ___retval = NULL; \
65568 + else \
65569 + ___retval = vmalloc((unsigned long)___x); \
65570 + ___retval; \
65571 +})
65572 +
65573 +#define vzalloc(x) \
65574 +({ \
65575 + void *___retval; \
65576 + intoverflow_t ___x = (intoverflow_t)x; \
65577 + if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
65578 + ___retval = NULL; \
65579 + else \
65580 + ___retval = vzalloc((unsigned long)___x); \
65581 + ___retval; \
65582 +})
65583 +
65584 +#define __vmalloc(x, y, z) \
65585 +({ \
65586 + void *___retval; \
65587 + intoverflow_t ___x = (intoverflow_t)x; \
65588 + if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
65589 + ___retval = NULL; \
65590 + else \
65591 + ___retval = __vmalloc((unsigned long)___x, (y), (z));\
65592 + ___retval; \
65593 +})
65594 +
65595 +#define vmalloc_user(x) \
65596 +({ \
65597 + void *___retval; \
65598 + intoverflow_t ___x = (intoverflow_t)x; \
65599 + if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
65600 + ___retval = NULL; \
65601 + else \
65602 + ___retval = vmalloc_user((unsigned long)___x); \
65603 + ___retval; \
65604 +})
65605 +
65606 +#define vmalloc_exec(x) \
65607 +({ \
65608 + void *___retval; \
65609 + intoverflow_t ___x = (intoverflow_t)x; \
65610 + if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
65611 + ___retval = NULL; \
65612 + else \
65613 + ___retval = vmalloc_exec((unsigned long)___x); \
65614 + ___retval; \
65615 +})
65616 +
65617 +#define vmalloc_node(x, y) \
65618 +({ \
65619 + void *___retval; \
65620 + intoverflow_t ___x = (intoverflow_t)x; \
65621 + if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
65622 + ___retval = NULL; \
65623 + else \
65624 + ___retval = vmalloc_node((unsigned long)___x, (y));\
65625 + ___retval; \
65626 +})
65627 +
65628 +#define vzalloc_node(x, y) \
65629 +({ \
65630 + void *___retval; \
65631 + intoverflow_t ___x = (intoverflow_t)x; \
65632 + if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
65633 + ___retval = NULL; \
65634 + else \
65635 + ___retval = vzalloc_node((unsigned long)___x, (y));\
65636 + ___retval; \
65637 +})
65638 +
65639 +#define vmalloc_32(x) \
65640 +({ \
65641 + void *___retval; \
65642 + intoverflow_t ___x = (intoverflow_t)x; \
65643 + if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
65644 + ___retval = NULL; \
65645 + else \
65646 + ___retval = vmalloc_32((unsigned long)___x); \
65647 + ___retval; \
65648 +})
65649 +
65650 +#define vmalloc_32_user(x) \
65651 +({ \
65652 +void *___retval; \
65653 + intoverflow_t ___x = (intoverflow_t)x; \
65654 + if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
65655 + ___retval = NULL; \
65656 + else \
65657 + ___retval = vmalloc_32_user((unsigned long)___x);\
65658 + ___retval; \
65659 +})
65660 +
65661 #endif /* _LINUX_VMALLOC_H */
65662 diff -urNp linux-2.6.39.1/include/linux/vmstat.h linux-2.6.39.1/include/linux/vmstat.h
65663 --- linux-2.6.39.1/include/linux/vmstat.h 2011-05-19 00:06:34.000000000 -0400
65664 +++ linux-2.6.39.1/include/linux/vmstat.h 2011-05-22 19:36:33.000000000 -0400
65665 @@ -147,18 +147,18 @@ static inline void vm_events_fold_cpu(in
65666 /*
65667 * Zone based page accounting with per cpu differentials.
65668 */
65669 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65670 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65671
65672 static inline void zone_page_state_add(long x, struct zone *zone,
65673 enum zone_stat_item item)
65674 {
65675 - atomic_long_add(x, &zone->vm_stat[item]);
65676 - atomic_long_add(x, &vm_stat[item]);
65677 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
65678 + atomic_long_add_unchecked(x, &vm_stat[item]);
65679 }
65680
65681 static inline unsigned long global_page_state(enum zone_stat_item item)
65682 {
65683 - long x = atomic_long_read(&vm_stat[item]);
65684 + long x = atomic_long_read_unchecked(&vm_stat[item]);
65685 #ifdef CONFIG_SMP
65686 if (x < 0)
65687 x = 0;
65688 @@ -169,7 +169,7 @@ static inline unsigned long global_page_
65689 static inline unsigned long zone_page_state(struct zone *zone,
65690 enum zone_stat_item item)
65691 {
65692 - long x = atomic_long_read(&zone->vm_stat[item]);
65693 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65694 #ifdef CONFIG_SMP
65695 if (x < 0)
65696 x = 0;
65697 @@ -186,7 +186,7 @@ static inline unsigned long zone_page_st
65698 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
65699 enum zone_stat_item item)
65700 {
65701 - long x = atomic_long_read(&zone->vm_stat[item]);
65702 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65703
65704 #ifdef CONFIG_SMP
65705 int cpu;
65706 @@ -280,8 +280,8 @@ static inline void __mod_zone_page_state
65707
65708 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
65709 {
65710 - atomic_long_inc(&zone->vm_stat[item]);
65711 - atomic_long_inc(&vm_stat[item]);
65712 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
65713 + atomic_long_inc_unchecked(&vm_stat[item]);
65714 }
65715
65716 static inline void __inc_zone_page_state(struct page *page,
65717 @@ -292,8 +292,8 @@ static inline void __inc_zone_page_state
65718
65719 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
65720 {
65721 - atomic_long_dec(&zone->vm_stat[item]);
65722 - atomic_long_dec(&vm_stat[item]);
65723 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
65724 + atomic_long_dec_unchecked(&vm_stat[item]);
65725 }
65726
65727 static inline void __dec_zone_page_state(struct page *page,
65728 diff -urNp linux-2.6.39.1/include/media/saa7146_vv.h linux-2.6.39.1/include/media/saa7146_vv.h
65729 --- linux-2.6.39.1/include/media/saa7146_vv.h 2011-05-19 00:06:34.000000000 -0400
65730 +++ linux-2.6.39.1/include/media/saa7146_vv.h 2011-05-22 19:36:33.000000000 -0400
65731 @@ -202,13 +202,13 @@ void saa7146_set_gpio(struct saa7146_dev
65732
65733 /* from saa7146_video.c */
65734 extern const struct v4l2_ioctl_ops saa7146_video_ioctl_ops;
65735 -extern struct saa7146_use_ops saa7146_video_uops;
65736 +extern const struct saa7146_use_ops saa7146_video_uops;
65737 int saa7146_start_preview(struct saa7146_fh *fh);
65738 int saa7146_stop_preview(struct saa7146_fh *fh);
65739 long saa7146_video_do_ioctl(struct file *file, unsigned int cmd, void *arg);
65740
65741 /* from saa7146_vbi.c */
65742 -extern struct saa7146_use_ops saa7146_vbi_uops;
65743 +extern const struct saa7146_use_ops saa7146_vbi_uops;
65744
65745 /* resource management functions */
65746 int saa7146_res_get(struct saa7146_fh *fh, unsigned int bit);
65747 diff -urNp linux-2.6.39.1/include/media/v4l2-device.h linux-2.6.39.1/include/media/v4l2-device.h
65748 --- linux-2.6.39.1/include/media/v4l2-device.h 2011-05-19 00:06:34.000000000 -0400
65749 +++ linux-2.6.39.1/include/media/v4l2-device.h 2011-05-22 19:36:33.000000000 -0400
65750 @@ -95,7 +95,7 @@ int __must_check v4l2_device_register(st
65751 this function returns 0. If the name ends with a digit (e.g. cx18),
65752 then the name will be set to cx18-0 since cx180 looks really odd. */
65753 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
65754 - atomic_t *instance);
65755 + atomic_unchecked_t *instance);
65756
65757 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
65758 Since the parent disappears this ensures that v4l2_dev doesn't have an
65759 diff -urNp linux-2.6.39.1/include/net/caif/cfctrl.h linux-2.6.39.1/include/net/caif/cfctrl.h
65760 --- linux-2.6.39.1/include/net/caif/cfctrl.h 2011-05-19 00:06:34.000000000 -0400
65761 +++ linux-2.6.39.1/include/net/caif/cfctrl.h 2011-05-22 19:36:33.000000000 -0400
65762 @@ -101,8 +101,8 @@ struct cfctrl_request_info {
65763 struct cfctrl {
65764 struct cfsrvl serv;
65765 struct cfctrl_rsp res;
65766 - atomic_t req_seq_no;
65767 - atomic_t rsp_seq_no;
65768 + atomic_unchecked_t req_seq_no;
65769 + atomic_unchecked_t rsp_seq_no;
65770 struct list_head list;
65771 /* Protects from simultaneous access to first_req list */
65772 spinlock_t info_list_lock;
65773 diff -urNp linux-2.6.39.1/include/net/flow.h linux-2.6.39.1/include/net/flow.h
65774 --- linux-2.6.39.1/include/net/flow.h 2011-05-19 00:06:34.000000000 -0400
65775 +++ linux-2.6.39.1/include/net/flow.h 2011-05-22 19:36:33.000000000 -0400
65776 @@ -167,6 +167,6 @@ extern struct flow_cache_object *flow_ca
65777 u8 dir, flow_resolve_t resolver, void *ctx);
65778
65779 extern void flow_cache_flush(void);
65780 -extern atomic_t flow_cache_genid;
65781 +extern atomic_unchecked_t flow_cache_genid;
65782
65783 #endif
65784 diff -urNp linux-2.6.39.1/include/net/inetpeer.h linux-2.6.39.1/include/net/inetpeer.h
65785 --- linux-2.6.39.1/include/net/inetpeer.h 2011-05-19 00:06:34.000000000 -0400
65786 +++ linux-2.6.39.1/include/net/inetpeer.h 2011-05-22 19:36:33.000000000 -0400
65787 @@ -43,8 +43,8 @@ struct inet_peer {
65788 */
65789 union {
65790 struct {
65791 - atomic_t rid; /* Frag reception counter */
65792 - atomic_t ip_id_count; /* IP ID for the next packet */
65793 + atomic_unchecked_t rid; /* Frag reception counter */
65794 + atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
65795 __u32 tcp_ts;
65796 __u32 tcp_ts_stamp;
65797 u32 metrics[RTAX_MAX];
65798 @@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in
65799 {
65800 more++;
65801 inet_peer_refcheck(p);
65802 - return atomic_add_return(more, &p->ip_id_count) - more;
65803 + return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
65804 }
65805
65806 #endif /* _NET_INETPEER_H */
65807 diff -urNp linux-2.6.39.1/include/net/ip_fib.h linux-2.6.39.1/include/net/ip_fib.h
65808 --- linux-2.6.39.1/include/net/ip_fib.h 2011-05-19 00:06:34.000000000 -0400
65809 +++ linux-2.6.39.1/include/net/ip_fib.h 2011-05-22 19:36:33.000000000 -0400
65810 @@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s
65811
65812 #define FIB_RES_SADDR(net, res) \
65813 ((FIB_RES_NH(res).nh_saddr_genid == \
65814 - atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
65815 + atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
65816 FIB_RES_NH(res).nh_saddr : \
65817 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
65818 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
65819 diff -urNp linux-2.6.39.1/include/net/ip_vs.h linux-2.6.39.1/include/net/ip_vs.h
65820 --- linux-2.6.39.1/include/net/ip_vs.h 2011-05-19 00:06:34.000000000 -0400
65821 +++ linux-2.6.39.1/include/net/ip_vs.h 2011-05-22 19:36:33.000000000 -0400
65822 @@ -512,7 +512,7 @@ struct ip_vs_conn {
65823 struct ip_vs_conn *control; /* Master control connection */
65824 atomic_t n_control; /* Number of controlled ones */
65825 struct ip_vs_dest *dest; /* real server */
65826 - atomic_t in_pkts; /* incoming packet counter */
65827 + atomic_unchecked_t in_pkts; /* incoming packet counter */
65828
65829 /* packet transmitter for different forwarding methods. If it
65830 mangles the packet, it must return NF_DROP or better NF_STOLEN,
65831 @@ -650,7 +650,7 @@ struct ip_vs_dest {
65832 __be16 port; /* port number of the server */
65833 union nf_inet_addr addr; /* IP address of the server */
65834 volatile unsigned flags; /* dest status flags */
65835 - atomic_t conn_flags; /* flags to copy to conn */
65836 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
65837 atomic_t weight; /* server weight */
65838
65839 atomic_t refcnt; /* reference counter */
65840 diff -urNp linux-2.6.39.1/include/net/irda/ircomm_tty.h linux-2.6.39.1/include/net/irda/ircomm_tty.h
65841 --- linux-2.6.39.1/include/net/irda/ircomm_tty.h 2011-05-19 00:06:34.000000000 -0400
65842 +++ linux-2.6.39.1/include/net/irda/ircomm_tty.h 2011-05-22 19:36:33.000000000 -0400
65843 @@ -35,6 +35,7 @@
65844 #include <linux/termios.h>
65845 #include <linux/timer.h>
65846 #include <linux/tty.h> /* struct tty_struct */
65847 +#include <asm/local.h>
65848
65849 #include <net/irda/irias_object.h>
65850 #include <net/irda/ircomm_core.h>
65851 @@ -105,8 +106,8 @@ struct ircomm_tty_cb {
65852 unsigned short close_delay;
65853 unsigned short closing_wait; /* time to wait before closing */
65854
65855 - int open_count;
65856 - int blocked_open; /* # of blocked opens */
65857 + local_t open_count;
65858 + local_t blocked_open; /* # of blocked opens */
65859
65860 /* Protect concurent access to :
65861 * o self->open_count
65862 diff -urNp linux-2.6.39.1/include/net/iucv/af_iucv.h linux-2.6.39.1/include/net/iucv/af_iucv.h
65863 --- linux-2.6.39.1/include/net/iucv/af_iucv.h 2011-05-19 00:06:34.000000000 -0400
65864 +++ linux-2.6.39.1/include/net/iucv/af_iucv.h 2011-05-22 19:36:33.000000000 -0400
65865 @@ -87,7 +87,7 @@ struct iucv_sock {
65866 struct iucv_sock_list {
65867 struct hlist_head head;
65868 rwlock_t lock;
65869 - atomic_t autobind_name;
65870 + atomic_unchecked_t autobind_name;
65871 };
65872
65873 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
65874 diff -urNp linux-2.6.39.1/include/net/neighbour.h linux-2.6.39.1/include/net/neighbour.h
65875 --- linux-2.6.39.1/include/net/neighbour.h 2011-05-19 00:06:34.000000000 -0400
65876 +++ linux-2.6.39.1/include/net/neighbour.h 2011-05-22 19:36:33.000000000 -0400
65877 @@ -118,12 +118,12 @@ struct neighbour {
65878
65879 struct neigh_ops {
65880 int family;
65881 - void (*solicit)(struct neighbour *, struct sk_buff*);
65882 - void (*error_report)(struct neighbour *, struct sk_buff*);
65883 - int (*output)(struct sk_buff*);
65884 - int (*connected_output)(struct sk_buff*);
65885 - int (*hh_output)(struct sk_buff*);
65886 - int (*queue_xmit)(struct sk_buff*);
65887 + void (* const solicit)(struct neighbour *, struct sk_buff*);
65888 + void (* const error_report)(struct neighbour *, struct sk_buff*);
65889 + int (* const output)(struct sk_buff*);
65890 + int (* const connected_output)(struct sk_buff*);
65891 + int (* const hh_output)(struct sk_buff*);
65892 + int (* const queue_xmit)(struct sk_buff*);
65893 };
65894
65895 struct pneigh_entry {
65896 diff -urNp linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h
65897 --- linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h 2011-05-19 00:06:34.000000000 -0400
65898 +++ linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h 2011-05-22 19:36:33.000000000 -0400
65899 @@ -95,7 +95,7 @@ nf_conntrack_eventmask_report(unsigned i
65900 int report)
65901 {
65902 int ret = 0;
65903 - struct nf_ct_event_notifier *notify;
65904 + const struct nf_ct_event_notifier *notify;
65905 struct nf_conntrack_ecache *e;
65906
65907 rcu_read_lock();
65908 @@ -174,7 +174,7 @@ nf_ct_expect_event_report(enum ip_conntr
65909 u32 pid,
65910 int report)
65911 {
65912 - struct nf_exp_event_notifier *notify;
65913 + const struct nf_exp_event_notifier *notify;
65914 struct nf_conntrack_ecache *e;
65915
65916 rcu_read_lock();
65917 diff -urNp linux-2.6.39.1/include/net/netlink.h linux-2.6.39.1/include/net/netlink.h
65918 --- linux-2.6.39.1/include/net/netlink.h 2011-05-19 00:06:34.000000000 -0400
65919 +++ linux-2.6.39.1/include/net/netlink.h 2011-05-22 19:36:33.000000000 -0400
65920 @@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
65921 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
65922 {
65923 if (mark)
65924 - skb_trim(skb, (unsigned char *) mark - skb->data);
65925 + skb_trim(skb, (const unsigned char *) mark - skb->data);
65926 }
65927
65928 /**
65929 diff -urNp linux-2.6.39.1/include/net/netns/ipv4.h linux-2.6.39.1/include/net/netns/ipv4.h
65930 --- linux-2.6.39.1/include/net/netns/ipv4.h 2011-05-19 00:06:34.000000000 -0400
65931 +++ linux-2.6.39.1/include/net/netns/ipv4.h 2011-05-22 19:36:33.000000000 -0400
65932 @@ -54,8 +54,8 @@ struct netns_ipv4 {
65933 int sysctl_rt_cache_rebuild_count;
65934 int current_rt_cache_rebuild_count;
65935
65936 - atomic_t rt_genid;
65937 - atomic_t dev_addr_genid;
65938 + atomic_unchecked_t rt_genid;
65939 + atomic_unchecked_t dev_addr_genid;
65940
65941 #ifdef CONFIG_IP_MROUTE
65942 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
65943 diff -urNp linux-2.6.39.1/include/net/sctp/sctp.h linux-2.6.39.1/include/net/sctp/sctp.h
65944 --- linux-2.6.39.1/include/net/sctp/sctp.h 2011-05-19 00:06:34.000000000 -0400
65945 +++ linux-2.6.39.1/include/net/sctp/sctp.h 2011-05-22 19:36:33.000000000 -0400
65946 @@ -316,9 +316,9 @@ do { \
65947
65948 #else /* SCTP_DEBUG */
65949
65950 -#define SCTP_DEBUG_PRINTK(whatever...)
65951 -#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
65952 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
65953 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
65954 +#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
65955 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
65956 #define SCTP_ENABLE_DEBUG
65957 #define SCTP_DISABLE_DEBUG
65958 #define SCTP_ASSERT(expr, str, func)
65959 diff -urNp linux-2.6.39.1/include/net/sock.h linux-2.6.39.1/include/net/sock.h
65960 --- linux-2.6.39.1/include/net/sock.h 2011-05-19 00:06:34.000000000 -0400
65961 +++ linux-2.6.39.1/include/net/sock.h 2011-05-22 19:36:33.000000000 -0400
65962 @@ -277,7 +277,7 @@ struct sock {
65963 #ifdef CONFIG_RPS
65964 __u32 sk_rxhash;
65965 #endif
65966 - atomic_t sk_drops;
65967 + atomic_unchecked_t sk_drops;
65968 int sk_rcvbuf;
65969
65970 struct sk_filter __rcu *sk_filter;
65971 diff -urNp linux-2.6.39.1/include/net/tcp.h linux-2.6.39.1/include/net/tcp.h
65972 --- linux-2.6.39.1/include/net/tcp.h 2011-05-19 00:06:34.000000000 -0400
65973 +++ linux-2.6.39.1/include/net/tcp.h 2011-05-22 19:36:33.000000000 -0400
65974 @@ -1374,7 +1374,7 @@ enum tcp_seq_states {
65975 struct tcp_seq_afinfo {
65976 char *name;
65977 sa_family_t family;
65978 - struct file_operations seq_fops;
65979 + struct file_operations seq_fops; /* cannot be const */
65980 struct seq_operations seq_ops;
65981 };
65982
65983 diff -urNp linux-2.6.39.1/include/net/udp.h linux-2.6.39.1/include/net/udp.h
65984 --- linux-2.6.39.1/include/net/udp.h 2011-05-19 00:06:34.000000000 -0400
65985 +++ linux-2.6.39.1/include/net/udp.h 2011-05-22 19:36:33.000000000 -0400
65986 @@ -234,7 +234,7 @@ struct udp_seq_afinfo {
65987 char *name;
65988 sa_family_t family;
65989 struct udp_table *udp_table;
65990 - struct file_operations seq_fops;
65991 + struct file_operations seq_fops; /* cannot be const */
65992 struct seq_operations seq_ops;
65993 };
65994
65995 diff -urNp linux-2.6.39.1/include/net/xfrm.h linux-2.6.39.1/include/net/xfrm.h
65996 --- linux-2.6.39.1/include/net/xfrm.h 2011-05-19 00:06:34.000000000 -0400
65997 +++ linux-2.6.39.1/include/net/xfrm.h 2011-05-22 19:36:33.000000000 -0400
65998 @@ -505,7 +505,7 @@ struct xfrm_policy {
65999 struct timer_list timer;
66000
66001 struct flow_cache_object flo;
66002 - atomic_t genid;
66003 + atomic_unchecked_t genid;
66004 u32 priority;
66005 u32 index;
66006 struct xfrm_mark mark;
66007 diff -urNp linux-2.6.39.1/include/pcmcia/ss.h linux-2.6.39.1/include/pcmcia/ss.h
66008 --- linux-2.6.39.1/include/pcmcia/ss.h 2011-05-19 00:06:34.000000000 -0400
66009 +++ linux-2.6.39.1/include/pcmcia/ss.h 2011-05-22 19:36:33.000000000 -0400
66010 @@ -241,9 +241,9 @@ struct pcmcia_socket {
66011 * "select PCCARD_NONSTATIC" in Kconfig.
66012 *
66013 */
66014 -extern struct pccard_resource_ops pccard_static_ops;
66015 +extern const struct pccard_resource_ops pccard_static_ops;
66016 #if defined(CONFIG_PCMCIA) || defined(CONFIG_PCMCIA_MODULE)
66017 -extern struct pccard_resource_ops pccard_iodyn_ops;
66018 +extern const struct pccard_resource_ops pccard_iodyn_ops;
66019 extern struct pccard_resource_ops pccard_nonstatic_ops;
66020 #else
66021 /* If PCMCIA is not used, but only CARDBUS, these functions are not used
66022 diff -urNp linux-2.6.39.1/include/rdma/ib_verbs.h linux-2.6.39.1/include/rdma/ib_verbs.h
66023 --- linux-2.6.39.1/include/rdma/ib_verbs.h 2011-05-19 00:06:34.000000000 -0400
66024 +++ linux-2.6.39.1/include/rdma/ib_verbs.h 2011-05-22 19:36:33.000000000 -0400
66025 @@ -1149,7 +1149,7 @@ struct ib_device {
66026 struct ib_mad *in_mad,
66027 struct ib_mad *out_mad);
66028
66029 - struct ib_dma_mapping_ops *dma_ops;
66030 + const struct ib_dma_mapping_ops *dma_ops;
66031
66032 struct module *owner;
66033 struct device dev;
66034 diff -urNp linux-2.6.39.1/include/scsi/libfc.h linux-2.6.39.1/include/scsi/libfc.h
66035 --- linux-2.6.39.1/include/scsi/libfc.h 2011-05-19 00:06:34.000000000 -0400
66036 +++ linux-2.6.39.1/include/scsi/libfc.h 2011-05-22 19:36:33.000000000 -0400
66037 @@ -202,7 +202,7 @@ struct fc_rport_priv {
66038 struct mutex rp_mutex;
66039 struct delayed_work retry_work;
66040 enum fc_rport_event event;
66041 - struct fc_rport_operations *ops;
66042 + const struct fc_rport_operations *ops;
66043 struct list_head peers;
66044 struct work_struct event_work;
66045 u32 supported_classes;
66046 diff -urNp linux-2.6.39.1/include/scsi/scsi_device.h linux-2.6.39.1/include/scsi/scsi_device.h
66047 --- linux-2.6.39.1/include/scsi/scsi_device.h 2011-05-19 00:06:34.000000000 -0400
66048 +++ linux-2.6.39.1/include/scsi/scsi_device.h 2011-05-22 19:36:33.000000000 -0400
66049 @@ -161,9 +161,9 @@ struct scsi_device {
66050 unsigned int max_device_blocked; /* what device_blocked counts down from */
66051 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
66052
66053 - atomic_t iorequest_cnt;
66054 - atomic_t iodone_cnt;
66055 - atomic_t ioerr_cnt;
66056 + atomic_unchecked_t iorequest_cnt;
66057 + atomic_unchecked_t iodone_cnt;
66058 + atomic_unchecked_t ioerr_cnt;
66059
66060 struct device sdev_gendev,
66061 sdev_dev;
66062 diff -urNp linux-2.6.39.1/include/sound/ac97_codec.h linux-2.6.39.1/include/sound/ac97_codec.h
66063 --- linux-2.6.39.1/include/sound/ac97_codec.h 2011-05-19 00:06:34.000000000 -0400
66064 +++ linux-2.6.39.1/include/sound/ac97_codec.h 2011-05-22 19:36:33.000000000 -0400
66065 @@ -424,15 +424,15 @@
66066 struct snd_ac97;
66067
66068 struct snd_ac97_build_ops {
66069 - int (*build_3d) (struct snd_ac97 *ac97);
66070 - int (*build_specific) (struct snd_ac97 *ac97);
66071 - int (*build_spdif) (struct snd_ac97 *ac97);
66072 - int (*build_post_spdif) (struct snd_ac97 *ac97);
66073 + int (* const build_3d) (struct snd_ac97 *ac97);
66074 + int (* const build_specific) (struct snd_ac97 *ac97);
66075 + int (* const build_spdif) (struct snd_ac97 *ac97);
66076 + int (* const build_post_spdif) (struct snd_ac97 *ac97);
66077 #ifdef CONFIG_PM
66078 - void (*suspend) (struct snd_ac97 *ac97);
66079 - void (*resume) (struct snd_ac97 *ac97);
66080 + void (* const suspend) (struct snd_ac97 *ac97);
66081 + void (* const resume) (struct snd_ac97 *ac97);
66082 #endif
66083 - void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
66084 + void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
66085 };
66086
66087 struct snd_ac97_bus_ops {
66088 @@ -446,7 +446,7 @@ struct snd_ac97_bus_ops {
66089
66090 struct snd_ac97_bus {
66091 /* -- lowlevel (hardware) driver specific -- */
66092 - struct snd_ac97_bus_ops *ops;
66093 + const struct snd_ac97_bus_ops *ops;
66094 void *private_data;
66095 void (*private_free) (struct snd_ac97_bus *bus);
66096 /* --- */
66097 @@ -556,7 +556,7 @@ static inline int ac97_can_spdif(struct
66098
66099 /* functions */
66100 /* create new AC97 bus */
66101 -int snd_ac97_bus(struct snd_card *card, int num, struct snd_ac97_bus_ops *ops,
66102 +int snd_ac97_bus(struct snd_card *card, int num, const struct snd_ac97_bus_ops *ops,
66103 void *private_data, struct snd_ac97_bus **rbus);
66104 /* create mixer controls */
66105 int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
66106 diff -urNp linux-2.6.39.1/include/sound/core.h linux-2.6.39.1/include/sound/core.h
66107 --- linux-2.6.39.1/include/sound/core.h 2011-05-19 00:06:34.000000000 -0400
66108 +++ linux-2.6.39.1/include/sound/core.h 2011-05-22 19:36:33.000000000 -0400
66109 @@ -88,7 +88,7 @@ struct snd_device {
66110 snd_device_state_t state; /* state of the device */
66111 snd_device_type_t type; /* device type */
66112 void *device_data; /* device structure */
66113 - struct snd_device_ops *ops; /* operations */
66114 + const struct snd_device_ops *ops; /* operations */
66115 };
66116
66117 #define snd_device(n) list_entry(n, struct snd_device, list)
66118 @@ -301,7 +301,7 @@ int snd_card_file_remove(struct snd_card
66119 /* device.c */
66120
66121 int snd_device_new(struct snd_card *card, snd_device_type_t type,
66122 - void *device_data, struct snd_device_ops *ops);
66123 + void *device_data, const struct snd_device_ops *ops);
66124 int snd_device_register(struct snd_card *card, void *device_data);
66125 int snd_device_register_all(struct snd_card *card);
66126 int snd_device_disconnect(struct snd_card *card, void *device_data);
66127 diff -urNp linux-2.6.39.1/include/sound/pcm.h linux-2.6.39.1/include/sound/pcm.h
66128 --- linux-2.6.39.1/include/sound/pcm.h 2011-05-19 00:06:34.000000000 -0400
66129 +++ linux-2.6.39.1/include/sound/pcm.h 2011-05-22 19:36:33.000000000 -0400
66130 @@ -379,7 +379,7 @@ struct snd_pcm_substream {
66131 unsigned int dma_buf_id;
66132 size_t dma_max;
66133 /* -- hardware operations -- */
66134 - struct snd_pcm_ops *ops;
66135 + const struct snd_pcm_ops *ops;
66136 /* -- runtime information -- */
66137 struct snd_pcm_runtime *runtime;
66138 /* -- timer section -- */
66139 @@ -845,7 +845,7 @@ const unsigned char *snd_pcm_format_sile
66140 int snd_pcm_format_set_silence(snd_pcm_format_t format, void *buf, unsigned int frames);
66141 snd_pcm_format_t snd_pcm_build_linear_format(int width, int unsignd, int big_endian);
66142
66143 -void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, struct snd_pcm_ops *ops);
66144 +void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, const struct snd_pcm_ops *ops);
66145 void snd_pcm_set_sync(struct snd_pcm_substream *substream);
66146 int snd_pcm_lib_interleave_len(struct snd_pcm_substream *substream);
66147 int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream,
66148 diff -urNp linux-2.6.39.1/include/sound/rawmidi.h linux-2.6.39.1/include/sound/rawmidi.h
66149 --- linux-2.6.39.1/include/sound/rawmidi.h 2011-05-19 00:06:34.000000000 -0400
66150 +++ linux-2.6.39.1/include/sound/rawmidi.h 2011-05-22 19:36:33.000000000 -0400
66151 @@ -100,7 +100,7 @@ struct snd_rawmidi_substream {
66152 struct snd_rawmidi_runtime *runtime;
66153 struct pid *pid;
66154 /* hardware layer */
66155 - struct snd_rawmidi_ops *ops;
66156 + const struct snd_rawmidi_ops *ops;
66157 };
66158
66159 struct snd_rawmidi_file {
66160 @@ -127,7 +127,7 @@ struct snd_rawmidi {
66161 int ossreg;
66162 #endif
66163
66164 - struct snd_rawmidi_global_ops *ops;
66165 + const struct snd_rawmidi_global_ops *ops;
66166
66167 struct snd_rawmidi_str streams[2];
66168
66169 @@ -151,7 +151,7 @@ int snd_rawmidi_new(struct snd_card *car
66170 int output_count, int input_count,
66171 struct snd_rawmidi **rmidi);
66172 void snd_rawmidi_set_ops(struct snd_rawmidi *rmidi, int stream,
66173 - struct snd_rawmidi_ops *ops);
66174 + const struct snd_rawmidi_ops *ops);
66175
66176 /* callbacks */
66177
66178 diff -urNp linux-2.6.39.1/include/sound/seq_device.h linux-2.6.39.1/include/sound/seq_device.h
66179 --- linux-2.6.39.1/include/sound/seq_device.h 2011-05-19 00:06:34.000000000 -0400
66180 +++ linux-2.6.39.1/include/sound/seq_device.h 2011-05-22 19:36:33.000000000 -0400
66181 @@ -69,7 +69,7 @@ struct snd_seq_dev_ops {
66182 */
66183 void snd_seq_device_load_drivers(void);
66184 int snd_seq_device_new(struct snd_card *card, int device, char *id, int argsize, struct snd_seq_device **result);
66185 -int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry, int argsize);
66186 +int snd_seq_device_register_driver(char *id, const struct snd_seq_dev_ops *entry, int argsize);
66187 int snd_seq_device_unregister_driver(char *id);
66188
66189 #define SNDRV_SEQ_DEVICE_ARGPTR(dev) (void *)((char *)(dev) + sizeof(struct snd_seq_device))
66190 diff -urNp linux-2.6.39.1/include/sound/snd_wavefront.h linux-2.6.39.1/include/sound/snd_wavefront.h
66191 --- linux-2.6.39.1/include/sound/snd_wavefront.h 2011-05-19 00:06:34.000000000 -0400
66192 +++ linux-2.6.39.1/include/sound/snd_wavefront.h 2011-05-22 19:36:33.000000000 -0400
66193 @@ -37,8 +37,8 @@ struct _snd_wavefront_midi {
66194 #define MPU_ACK 0xFE
66195 #define UART_MODE_ON 0x3F
66196
66197 -extern struct snd_rawmidi_ops snd_wavefront_midi_output;
66198 -extern struct snd_rawmidi_ops snd_wavefront_midi_input;
66199 +extern const struct snd_rawmidi_ops snd_wavefront_midi_output;
66200 +extern const struct snd_rawmidi_ops snd_wavefront_midi_input;
66201
66202 extern void snd_wavefront_midi_enable_virtual (snd_wavefront_card_t *);
66203 extern void snd_wavefront_midi_disable_virtual (snd_wavefront_card_t *);
66204 diff -urNp linux-2.6.39.1/include/sound/soc.h linux-2.6.39.1/include/sound/soc.h
66205 --- linux-2.6.39.1/include/sound/soc.h 2011-05-19 00:06:34.000000000 -0400
66206 +++ linux-2.6.39.1/include/sound/soc.h 2011-05-22 19:36:33.000000000 -0400
66207 @@ -245,7 +245,7 @@ struct snd_soc_jack_gpio;
66208
66209 typedef int (*hw_write_t)(void *,const char* ,int);
66210
66211 -extern struct snd_ac97_bus_ops soc_ac97_ops;
66212 +extern const struct snd_ac97_bus_ops soc_ac97_ops;
66213
66214 enum snd_soc_control_type {
66215 SND_SOC_CUSTOM,
66216 diff -urNp linux-2.6.39.1/include/sound/ymfpci.h linux-2.6.39.1/include/sound/ymfpci.h
66217 --- linux-2.6.39.1/include/sound/ymfpci.h 2011-05-19 00:06:34.000000000 -0400
66218 +++ linux-2.6.39.1/include/sound/ymfpci.h 2011-05-22 19:36:33.000000000 -0400
66219 @@ -358,7 +358,7 @@ struct snd_ymfpci {
66220 spinlock_t reg_lock;
66221 spinlock_t voice_lock;
66222 wait_queue_head_t interrupt_sleep;
66223 - atomic_t interrupt_sleep_count;
66224 + atomic_unchecked_t interrupt_sleep_count;
66225 struct snd_info_entry *proc_entry;
66226 const struct firmware *dsp_microcode;
66227 const struct firmware *controller_microcode;
66228 diff -urNp linux-2.6.39.1/include/target/target_core_base.h linux-2.6.39.1/include/target/target_core_base.h
66229 --- linux-2.6.39.1/include/target/target_core_base.h 2011-06-03 00:04:14.000000000 -0400
66230 +++ linux-2.6.39.1/include/target/target_core_base.h 2011-06-03 00:32:08.000000000 -0400
66231 @@ -432,8 +432,8 @@ struct se_transport_task {
66232 atomic_t t_task_cdbs_left;
66233 atomic_t t_task_cdbs_ex_left;
66234 atomic_t t_task_cdbs_timeout_left;
66235 - atomic_t t_task_cdbs_sent;
66236 - atomic_t t_transport_aborted;
66237 + atomic_unchecked_t t_task_cdbs_sent;
66238 + atomic_unchecked_t t_transport_aborted;
66239 atomic_t t_transport_active;
66240 atomic_t t_transport_complete;
66241 atomic_t t_transport_queue_active;
66242 @@ -774,7 +774,7 @@ struct se_device {
66243 atomic_t active_cmds;
66244 atomic_t simple_cmds;
66245 atomic_t depth_left;
66246 - atomic_t dev_ordered_id;
66247 + atomic_unchecked_t dev_ordered_id;
66248 atomic_t dev_tur_active;
66249 atomic_t execute_tasks;
66250 atomic_t dev_status_thr_count;
66251 diff -urNp linux-2.6.39.1/include/trace/events/irq.h linux-2.6.39.1/include/trace/events/irq.h
66252 --- linux-2.6.39.1/include/trace/events/irq.h 2011-05-19 00:06:34.000000000 -0400
66253 +++ linux-2.6.39.1/include/trace/events/irq.h 2011-05-22 19:36:33.000000000 -0400
66254 @@ -36,7 +36,7 @@ struct softirq_action;
66255 */
66256 TRACE_EVENT(irq_handler_entry,
66257
66258 - TP_PROTO(int irq, struct irqaction *action),
66259 + TP_PROTO(int irq, const struct irqaction *action),
66260
66261 TP_ARGS(irq, action),
66262
66263 @@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
66264 */
66265 TRACE_EVENT(irq_handler_exit,
66266
66267 - TP_PROTO(int irq, struct irqaction *action, int ret),
66268 + TP_PROTO(int irq, const struct irqaction *action, int ret),
66269
66270 TP_ARGS(irq, action, ret),
66271
66272 diff -urNp linux-2.6.39.1/include/video/udlfb.h linux-2.6.39.1/include/video/udlfb.h
66273 --- linux-2.6.39.1/include/video/udlfb.h 2011-05-19 00:06:34.000000000 -0400
66274 +++ linux-2.6.39.1/include/video/udlfb.h 2011-05-22 19:36:33.000000000 -0400
66275 @@ -51,10 +51,10 @@ struct dlfb_data {
66276 int base8;
66277 u32 pseudo_palette[256];
66278 /* blit-only rendering path metrics, exposed through sysfs */
66279 - atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66280 - atomic_t bytes_identical; /* saved effort with backbuffer comparison */
66281 - atomic_t bytes_sent; /* to usb, after compression including overhead */
66282 - atomic_t cpu_kcycles_used; /* transpired during pixel processing */
66283 + atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66284 + atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
66285 + atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
66286 + atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
66287 };
66288
66289 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
66290 diff -urNp linux-2.6.39.1/include/video/uvesafb.h linux-2.6.39.1/include/video/uvesafb.h
66291 --- linux-2.6.39.1/include/video/uvesafb.h 2011-05-19 00:06:34.000000000 -0400
66292 +++ linux-2.6.39.1/include/video/uvesafb.h 2011-05-22 19:36:33.000000000 -0400
66293 @@ -177,6 +177,7 @@ struct uvesafb_par {
66294 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
66295 u8 pmi_setpal; /* PMI for palette changes */
66296 u16 *pmi_base; /* protected mode interface location */
66297 + u8 *pmi_code; /* protected mode code location */
66298 void *pmi_start;
66299 void *pmi_pal;
66300 u8 *vbe_state_orig; /*
66301 diff -urNp linux-2.6.39.1/init/do_mounts.c linux-2.6.39.1/init/do_mounts.c
66302 --- linux-2.6.39.1/init/do_mounts.c 2011-05-19 00:06:34.000000000 -0400
66303 +++ linux-2.6.39.1/init/do_mounts.c 2011-05-22 19:36:33.000000000 -0400
66304 @@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa
66305
66306 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
66307 {
66308 - int err = sys_mount(name, "/root", fs, flags, data);
66309 + int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
66310 if (err)
66311 return err;
66312
66313 @@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...
66314 va_start(args, fmt);
66315 vsprintf(buf, fmt, args);
66316 va_end(args);
66317 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
66318 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
66319 if (fd >= 0) {
66320 sys_ioctl(fd, FDEJECT, 0);
66321 sys_close(fd);
66322 }
66323 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
66324 - fd = sys_open("/dev/console", O_RDWR, 0);
66325 + fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
66326 if (fd >= 0) {
66327 sys_ioctl(fd, TCGETS, (long)&termios);
66328 termios.c_lflag &= ~ICANON;
66329 sys_ioctl(fd, TCSETSF, (long)&termios);
66330 - sys_read(fd, &c, 1);
66331 + sys_read(fd, (char __user *)&c, 1);
66332 termios.c_lflag |= ICANON;
66333 sys_ioctl(fd, TCSETSF, (long)&termios);
66334 sys_close(fd);
66335 @@ -488,6 +488,6 @@ void __init prepare_namespace(void)
66336 mount_root();
66337 out:
66338 devtmpfs_mount("dev");
66339 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
66340 + sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66341 sys_chroot((const char __user __force *)".");
66342 }
66343 diff -urNp linux-2.6.39.1/init/do_mounts.h linux-2.6.39.1/init/do_mounts.h
66344 --- linux-2.6.39.1/init/do_mounts.h 2011-05-19 00:06:34.000000000 -0400
66345 +++ linux-2.6.39.1/init/do_mounts.h 2011-05-22 19:36:33.000000000 -0400
66346 @@ -15,15 +15,15 @@ extern int root_mountflags;
66347
66348 static inline int create_dev(char *name, dev_t dev)
66349 {
66350 - sys_unlink(name);
66351 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
66352 + sys_unlink((__force char __user *)name);
66353 + return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
66354 }
66355
66356 #if BITS_PER_LONG == 32
66357 static inline u32 bstat(char *name)
66358 {
66359 struct stat64 stat;
66360 - if (sys_stat64(name, &stat) != 0)
66361 + if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
66362 return 0;
66363 if (!S_ISBLK(stat.st_mode))
66364 return 0;
66365 diff -urNp linux-2.6.39.1/init/do_mounts_initrd.c linux-2.6.39.1/init/do_mounts_initrd.c
66366 --- linux-2.6.39.1/init/do_mounts_initrd.c 2011-05-19 00:06:34.000000000 -0400
66367 +++ linux-2.6.39.1/init/do_mounts_initrd.c 2011-05-22 19:36:33.000000000 -0400
66368 @@ -44,13 +44,13 @@ static void __init handle_initrd(void)
66369 create_dev("/dev/root.old", Root_RAM0);
66370 /* mount initrd on rootfs' /root */
66371 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
66372 - sys_mkdir("/old", 0700);
66373 - root_fd = sys_open("/", 0, 0);
66374 - old_fd = sys_open("/old", 0, 0);
66375 + sys_mkdir((__force const char __user *)"/old", 0700);
66376 + root_fd = sys_open((__force const char __user *)"/", 0, 0);
66377 + old_fd = sys_open((__force const char __user *)"/old", 0, 0);
66378 /* move initrd over / and chdir/chroot in initrd root */
66379 - sys_chdir("/root");
66380 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
66381 - sys_chroot(".");
66382 + sys_chdir((__force const char __user *)"/root");
66383 + sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66384 + sys_chroot((__force const char __user *)".");
66385
66386 /*
66387 * In case that a resume from disk is carried out by linuxrc or one of
66388 @@ -67,15 +67,15 @@ static void __init handle_initrd(void)
66389
66390 /* move initrd to rootfs' /old */
66391 sys_fchdir(old_fd);
66392 - sys_mount("/", ".", NULL, MS_MOVE, NULL);
66393 + sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
66394 /* switch root and cwd back to / of rootfs */
66395 sys_fchdir(root_fd);
66396 - sys_chroot(".");
66397 + sys_chroot((__force const char __user *)".");
66398 sys_close(old_fd);
66399 sys_close(root_fd);
66400
66401 if (new_decode_dev(real_root_dev) == Root_RAM0) {
66402 - sys_chdir("/old");
66403 + sys_chdir((__force const char __user *)"/old");
66404 return;
66405 }
66406
66407 @@ -83,17 +83,17 @@ static void __init handle_initrd(void)
66408 mount_root();
66409
66410 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
66411 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
66412 + error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
66413 if (!error)
66414 printk("okay\n");
66415 else {
66416 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
66417 + int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
66418 if (error == -ENOENT)
66419 printk("/initrd does not exist. Ignored.\n");
66420 else
66421 printk("failed\n");
66422 printk(KERN_NOTICE "Unmounting old root\n");
66423 - sys_umount("/old", MNT_DETACH);
66424 + sys_umount((__force char __user *)"/old", MNT_DETACH);
66425 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
66426 if (fd < 0) {
66427 error = fd;
66428 @@ -116,11 +116,11 @@ int __init initrd_load(void)
66429 * mounted in the normal path.
66430 */
66431 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
66432 - sys_unlink("/initrd.image");
66433 + sys_unlink((__force const char __user *)"/initrd.image");
66434 handle_initrd();
66435 return 1;
66436 }
66437 }
66438 - sys_unlink("/initrd.image");
66439 + sys_unlink((__force const char __user *)"/initrd.image");
66440 return 0;
66441 }
66442 diff -urNp linux-2.6.39.1/init/do_mounts_md.c linux-2.6.39.1/init/do_mounts_md.c
66443 --- linux-2.6.39.1/init/do_mounts_md.c 2011-05-19 00:06:34.000000000 -0400
66444 +++ linux-2.6.39.1/init/do_mounts_md.c 2011-05-22 19:36:33.000000000 -0400
66445 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
66446 partitioned ? "_d" : "", minor,
66447 md_setup_args[ent].device_names);
66448
66449 - fd = sys_open(name, 0, 0);
66450 + fd = sys_open((__force char __user *)name, 0, 0);
66451 if (fd < 0) {
66452 printk(KERN_ERR "md: open failed - cannot start "
66453 "array %s\n", name);
66454 @@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
66455 * array without it
66456 */
66457 sys_close(fd);
66458 - fd = sys_open(name, 0, 0);
66459 + fd = sys_open((__force char __user *)name, 0, 0);
66460 sys_ioctl(fd, BLKRRPART, 0);
66461 }
66462 sys_close(fd);
66463 diff -urNp linux-2.6.39.1/init/initramfs.c linux-2.6.39.1/init/initramfs.c
66464 --- linux-2.6.39.1/init/initramfs.c 2011-05-19 00:06:34.000000000 -0400
66465 +++ linux-2.6.39.1/init/initramfs.c 2011-05-22 19:36:33.000000000 -0400
66466 @@ -74,7 +74,7 @@ static void __init free_hash(void)
66467 }
66468 }
66469
66470 -static long __init do_utime(char __user *filename, time_t mtime)
66471 +static long __init do_utime(__force char __user *filename, time_t mtime)
66472 {
66473 struct timespec t[2];
66474
66475 @@ -109,7 +109,7 @@ static void __init dir_utime(void)
66476 struct dir_entry *de, *tmp;
66477 list_for_each_entry_safe(de, tmp, &dir_list, list) {
66478 list_del(&de->list);
66479 - do_utime(de->name, de->mtime);
66480 + do_utime((__force char __user *)de->name, de->mtime);
66481 kfree(de->name);
66482 kfree(de);
66483 }
66484 @@ -271,7 +271,7 @@ static int __init maybe_link(void)
66485 if (nlink >= 2) {
66486 char *old = find_link(major, minor, ino, mode, collected);
66487 if (old)
66488 - return (sys_link(old, collected) < 0) ? -1 : 1;
66489 + return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
66490 }
66491 return 0;
66492 }
66493 @@ -280,11 +280,11 @@ static void __init clean_path(char *path
66494 {
66495 struct stat st;
66496
66497 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
66498 + if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
66499 if (S_ISDIR(st.st_mode))
66500 - sys_rmdir(path);
66501 + sys_rmdir((__force char __user *)path);
66502 else
66503 - sys_unlink(path);
66504 + sys_unlink((__force char __user *)path);
66505 }
66506 }
66507
66508 @@ -305,7 +305,7 @@ static int __init do_name(void)
66509 int openflags = O_WRONLY|O_CREAT;
66510 if (ml != 1)
66511 openflags |= O_TRUNC;
66512 - wfd = sys_open(collected, openflags, mode);
66513 + wfd = sys_open((__force char __user *)collected, openflags, mode);
66514
66515 if (wfd >= 0) {
66516 sys_fchown(wfd, uid, gid);
66517 @@ -317,17 +317,17 @@ static int __init do_name(void)
66518 }
66519 }
66520 } else if (S_ISDIR(mode)) {
66521 - sys_mkdir(collected, mode);
66522 - sys_chown(collected, uid, gid);
66523 - sys_chmod(collected, mode);
66524 + sys_mkdir((__force char __user *)collected, mode);
66525 + sys_chown((__force char __user *)collected, uid, gid);
66526 + sys_chmod((__force char __user *)collected, mode);
66527 dir_add(collected, mtime);
66528 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
66529 S_ISFIFO(mode) || S_ISSOCK(mode)) {
66530 if (maybe_link() == 0) {
66531 - sys_mknod(collected, mode, rdev);
66532 - sys_chown(collected, uid, gid);
66533 - sys_chmod(collected, mode);
66534 - do_utime(collected, mtime);
66535 + sys_mknod((__force char __user *)collected, mode, rdev);
66536 + sys_chown((__force char __user *)collected, uid, gid);
66537 + sys_chmod((__force char __user *)collected, mode);
66538 + do_utime((__force char __user *)collected, mtime);
66539 }
66540 }
66541 return 0;
66542 @@ -336,15 +336,15 @@ static int __init do_name(void)
66543 static int __init do_copy(void)
66544 {
66545 if (count >= body_len) {
66546 - sys_write(wfd, victim, body_len);
66547 + sys_write(wfd, (__force char __user *)victim, body_len);
66548 sys_close(wfd);
66549 - do_utime(vcollected, mtime);
66550 + do_utime((__force char __user *)vcollected, mtime);
66551 kfree(vcollected);
66552 eat(body_len);
66553 state = SkipIt;
66554 return 0;
66555 } else {
66556 - sys_write(wfd, victim, count);
66557 + sys_write(wfd, (__force char __user *)victim, count);
66558 body_len -= count;
66559 eat(count);
66560 return 1;
66561 @@ -355,9 +355,9 @@ static int __init do_symlink(void)
66562 {
66563 collected[N_ALIGN(name_len) + body_len] = '\0';
66564 clean_path(collected, 0);
66565 - sys_symlink(collected + N_ALIGN(name_len), collected);
66566 - sys_lchown(collected, uid, gid);
66567 - do_utime(collected, mtime);
66568 + sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
66569 + sys_lchown((__force char __user *)collected, uid, gid);
66570 + do_utime((__force char __user *)collected, mtime);
66571 state = SkipIt;
66572 next_state = Reset;
66573 return 0;
66574 diff -urNp linux-2.6.39.1/init/Kconfig linux-2.6.39.1/init/Kconfig
66575 --- linux-2.6.39.1/init/Kconfig 2011-05-19 00:06:34.000000000 -0400
66576 +++ linux-2.6.39.1/init/Kconfig 2011-05-22 19:36:33.000000000 -0400
66577 @@ -1202,7 +1202,7 @@ config SLUB_DEBUG
66578
66579 config COMPAT_BRK
66580 bool "Disable heap randomization"
66581 - default y
66582 + default n
66583 help
66584 Randomizing heap placement makes heap exploits harder, but it
66585 also breaks ancient binaries (including anything libc5 based).
66586 diff -urNp linux-2.6.39.1/init/main.c linux-2.6.39.1/init/main.c
66587 --- linux-2.6.39.1/init/main.c 2011-06-03 00:04:14.000000000 -0400
66588 +++ linux-2.6.39.1/init/main.c 2011-06-03 00:32:08.000000000 -0400
66589 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void)
66590 extern void tc_init(void);
66591 #endif
66592
66593 +extern void grsecurity_init(void);
66594 +
66595 /*
66596 * Debug helper: via this flag we know that we are in 'early bootup code'
66597 * where only the boot processor is running with IRQ disabled. This means
66598 @@ -149,6 +151,49 @@ static int __init set_reset_devices(char
66599
66600 __setup("reset_devices", set_reset_devices);
66601
66602 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
66603 +extern char pax_enter_kernel_user[];
66604 +extern char pax_exit_kernel_user[];
66605 +extern pgdval_t clone_pgd_mask;
66606 +#endif
66607 +
66608 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
66609 +static int __init setup_pax_nouderef(char *str)
66610 +{
66611 +#ifdef CONFIG_X86_32
66612 + unsigned int cpu;
66613 + struct desc_struct *gdt;
66614 +
66615 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
66616 + gdt = get_cpu_gdt_table(cpu);
66617 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
66618 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
66619 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
66620 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
66621 + }
66622 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
66623 +#else
66624 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
66625 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
66626 + clone_pgd_mask = ~(pgdval_t)0UL;
66627 +#endif
66628 +
66629 + return 0;
66630 +}
66631 +early_param("pax_nouderef", setup_pax_nouderef);
66632 +#endif
66633 +
66634 +#ifdef CONFIG_PAX_SOFTMODE
66635 +unsigned int pax_softmode;
66636 +
66637 +static int __init setup_pax_softmode(char *str)
66638 +{
66639 + get_option(&str, &pax_softmode);
66640 + return 1;
66641 +}
66642 +__setup("pax_softmode=", setup_pax_softmode);
66643 +#endif
66644 +
66645 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
66646 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
66647 static const char *panic_later, *panic_param;
66648 @@ -663,6 +708,7 @@ int __init_or_module do_one_initcall(ini
66649 {
66650 int count = preempt_count();
66651 int ret;
66652 + const char *msg1 = "", *msg2 = "";
66653
66654 if (initcall_debug)
66655 ret = do_one_initcall_debug(fn);
66656 @@ -675,15 +721,15 @@ int __init_or_module do_one_initcall(ini
66657 sprintf(msgbuf, "error code %d ", ret);
66658
66659 if (preempt_count() != count) {
66660 - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
66661 + msg1 = " preemption imbalance";
66662 preempt_count() = count;
66663 }
66664 if (irqs_disabled()) {
66665 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
66666 + msg2 = " disabled interrupts";
66667 local_irq_enable();
66668 }
66669 - if (msgbuf[0]) {
66670 - printk("initcall %pF returned with %s\n", fn, msgbuf);
66671 + if (msgbuf[0] || *msg1 || *msg2) {
66672 + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
66673 }
66674
66675 return ret;
66676 @@ -801,7 +847,7 @@ static int __init kernel_init(void * unu
66677 do_basic_setup();
66678
66679 /* Open the /dev/console on the rootfs, this should never fail */
66680 - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
66681 + if (sys_open((__force const char __user *) "/dev/console", O_RDWR, 0) < 0)
66682 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
66683
66684 (void) sys_dup(0);
66685 @@ -814,11 +860,13 @@ static int __init kernel_init(void * unu
66686 if (!ramdisk_execute_command)
66687 ramdisk_execute_command = "/init";
66688
66689 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
66690 + if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
66691 ramdisk_execute_command = NULL;
66692 prepare_namespace();
66693 }
66694
66695 + grsecurity_init();
66696 +
66697 /*
66698 * Ok, we have completed the initial bootup, and
66699 * we're essentially up and running. Get rid of the
66700 diff -urNp linux-2.6.39.1/ipc/mqueue.c linux-2.6.39.1/ipc/mqueue.c
66701 --- linux-2.6.39.1/ipc/mqueue.c 2011-05-19 00:06:34.000000000 -0400
66702 +++ linux-2.6.39.1/ipc/mqueue.c 2011-05-22 19:41:42.000000000 -0400
66703 @@ -154,6 +154,7 @@ static struct inode *mqueue_get_inode(st
66704 mq_bytes = (mq_msg_tblsz +
66705 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
66706
66707 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
66708 spin_lock(&mq_lock);
66709 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
66710 u->mq_bytes + mq_bytes >
66711 diff -urNp linux-2.6.39.1/ipc/sem.c linux-2.6.39.1/ipc/sem.c
66712 --- linux-2.6.39.1/ipc/sem.c 2011-05-19 00:06:34.000000000 -0400
66713 +++ linux-2.6.39.1/ipc/sem.c 2011-05-22 19:36:33.000000000 -0400
66714 @@ -854,6 +854,8 @@ static int semctl_main(struct ipc_namesp
66715 int nsems;
66716 struct list_head tasks;
66717
66718 + pax_track_stack();
66719 +
66720 sma = sem_lock_check(ns, semid);
66721 if (IS_ERR(sma))
66722 return PTR_ERR(sma);
66723 @@ -1301,6 +1303,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
66724 struct ipc_namespace *ns;
66725 struct list_head tasks;
66726
66727 + pax_track_stack();
66728 +
66729 ns = current->nsproxy->ipc_ns;
66730
66731 if (nsops < 1 || semid < 0)
66732 diff -urNp linux-2.6.39.1/ipc/shm.c linux-2.6.39.1/ipc/shm.c
66733 --- linux-2.6.39.1/ipc/shm.c 2011-05-19 00:06:34.000000000 -0400
66734 +++ linux-2.6.39.1/ipc/shm.c 2011-05-22 19:41:42.000000000 -0400
66735 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
66736 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
66737 #endif
66738
66739 +#ifdef CONFIG_GRKERNSEC
66740 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66741 + const time_t shm_createtime, const uid_t cuid,
66742 + const int shmid);
66743 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66744 + const time_t shm_createtime);
66745 +#endif
66746 +
66747 void shm_init_ns(struct ipc_namespace *ns)
66748 {
66749 ns->shm_ctlmax = SHMMAX;
66750 @@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace *
66751 shp->shm_lprid = 0;
66752 shp->shm_atim = shp->shm_dtim = 0;
66753 shp->shm_ctim = get_seconds();
66754 +#ifdef CONFIG_GRKERNSEC
66755 + {
66756 + struct timespec timeval;
66757 + do_posix_clock_monotonic_gettime(&timeval);
66758 +
66759 + shp->shm_createtime = timeval.tv_sec;
66760 + }
66761 +#endif
66762 shp->shm_segsz = size;
66763 shp->shm_nattch = 0;
66764 shp->shm_file = file;
66765 @@ -762,8 +778,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
66766 case SHM_LOCK:
66767 case SHM_UNLOCK:
66768 {
66769 - struct file *uninitialized_var(shm_file);
66770 -
66771 lru_add_drain_all(); /* drain pagevecs to lru lists */
66772
66773 shp = shm_lock_check(ns, shmid);
66774 @@ -896,9 +910,21 @@ long do_shmat(int shmid, char __user *sh
66775 if (err)
66776 goto out_unlock;
66777
66778 +#ifdef CONFIG_GRKERNSEC
66779 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
66780 + shp->shm_perm.cuid, shmid) ||
66781 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
66782 + err = -EACCES;
66783 + goto out_unlock;
66784 + }
66785 +#endif
66786 +
66787 path = shp->shm_file->f_path;
66788 path_get(&path);
66789 shp->shm_nattch++;
66790 +#ifdef CONFIG_GRKERNSEC
66791 + shp->shm_lapid = current->pid;
66792 +#endif
66793 size = i_size_read(path.dentry->d_inode);
66794 shm_unlock(shp);
66795
66796 diff -urNp linux-2.6.39.1/kernel/acct.c linux-2.6.39.1/kernel/acct.c
66797 --- linux-2.6.39.1/kernel/acct.c 2011-05-19 00:06:34.000000000 -0400
66798 +++ linux-2.6.39.1/kernel/acct.c 2011-05-22 19:36:33.000000000 -0400
66799 @@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
66800 */
66801 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
66802 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
66803 - file->f_op->write(file, (char *)&ac,
66804 + file->f_op->write(file, (__force char __user *)&ac,
66805 sizeof(acct_t), &file->f_pos);
66806 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
66807 set_fs(fs);
66808 diff -urNp linux-2.6.39.1/kernel/audit.c linux-2.6.39.1/kernel/audit.c
66809 --- linux-2.6.39.1/kernel/audit.c 2011-05-19 00:06:34.000000000 -0400
66810 +++ linux-2.6.39.1/kernel/audit.c 2011-05-22 19:36:33.000000000 -0400
66811 @@ -112,7 +112,7 @@ u32 audit_sig_sid = 0;
66812 3) suppressed due to audit_rate_limit
66813 4) suppressed due to audit_backlog_limit
66814 */
66815 -static atomic_t audit_lost = ATOMIC_INIT(0);
66816 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
66817
66818 /* The netlink socket. */
66819 static struct sock *audit_sock;
66820 @@ -234,7 +234,7 @@ void audit_log_lost(const char *message)
66821 unsigned long now;
66822 int print;
66823
66824 - atomic_inc(&audit_lost);
66825 + atomic_inc_unchecked(&audit_lost);
66826
66827 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
66828
66829 @@ -253,7 +253,7 @@ void audit_log_lost(const char *message)
66830 printk(KERN_WARNING
66831 "audit: audit_lost=%d audit_rate_limit=%d "
66832 "audit_backlog_limit=%d\n",
66833 - atomic_read(&audit_lost),
66834 + atomic_read_unchecked(&audit_lost),
66835 audit_rate_limit,
66836 audit_backlog_limit);
66837 audit_panic(message);
66838 @@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b
66839 status_set.pid = audit_pid;
66840 status_set.rate_limit = audit_rate_limit;
66841 status_set.backlog_limit = audit_backlog_limit;
66842 - status_set.lost = atomic_read(&audit_lost);
66843 + status_set.lost = atomic_read_unchecked(&audit_lost);
66844 status_set.backlog = skb_queue_len(&audit_skb_queue);
66845 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
66846 &status_set, sizeof(status_set));
66847 diff -urNp linux-2.6.39.1/kernel/auditsc.c linux-2.6.39.1/kernel/auditsc.c
66848 --- linux-2.6.39.1/kernel/auditsc.c 2011-05-19 00:06:34.000000000 -0400
66849 +++ linux-2.6.39.1/kernel/auditsc.c 2011-05-22 19:36:33.000000000 -0400
66850 @@ -2111,7 +2111,7 @@ int auditsc_get_stamp(struct audit_conte
66851 }
66852
66853 /* global counter which is incremented every time something logs in */
66854 -static atomic_t session_id = ATOMIC_INIT(0);
66855 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
66856
66857 /**
66858 * audit_set_loginuid - set a task's audit_context loginuid
66859 @@ -2124,7 +2124,7 @@ static atomic_t session_id = ATOMIC_INIT
66860 */
66861 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
66862 {
66863 - unsigned int sessionid = atomic_inc_return(&session_id);
66864 + unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
66865 struct audit_context *context = task->audit_context;
66866
66867 if (context && context->in_syscall) {
66868 diff -urNp linux-2.6.39.1/kernel/capability.c linux-2.6.39.1/kernel/capability.c
66869 --- linux-2.6.39.1/kernel/capability.c 2011-05-19 00:06:34.000000000 -0400
66870 +++ linux-2.6.39.1/kernel/capability.c 2011-05-22 21:02:23.000000000 -0400
66871 @@ -206,6 +206,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
66872 * before modification is attempted and the application
66873 * fails.
66874 */
66875 + if (tocopy > ARRAY_SIZE(kdata))
66876 + return -EFAULT;
66877 +
66878 if (copy_to_user(dataptr, kdata, tocopy
66879 * sizeof(struct __user_cap_data_struct))) {
66880 return -EFAULT;
66881 @@ -378,7 +381,7 @@ bool ns_capable(struct user_namespace *n
66882 BUG();
66883 }
66884
66885 - if (security_capable(ns, current_cred(), cap) == 0) {
66886 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
66887 current->flags |= PF_SUPERPRIV;
66888 return true;
66889 }
66890 @@ -386,6 +389,27 @@ bool ns_capable(struct user_namespace *n
66891 }
66892 EXPORT_SYMBOL(ns_capable);
66893
66894 +bool ns_capable_nolog(struct user_namespace *ns, int cap)
66895 +{
66896 + if (unlikely(!cap_valid(cap))) {
66897 + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
66898 + BUG();
66899 + }
66900 +
66901 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
66902 + current->flags |= PF_SUPERPRIV;
66903 + return true;
66904 + }
66905 + return false;
66906 +}
66907 +EXPORT_SYMBOL(ns_capable_nolog);
66908 +
66909 +bool capable_nolog(int cap)
66910 +{
66911 + return ns_capable_nolog(&init_user_ns, cap);
66912 +}
66913 +EXPORT_SYMBOL(capable_nolog);
66914 +
66915 /**
66916 * task_ns_capable - Determine whether current task has a superior
66917 * capability targeted at a specific task's user namespace.
66918 @@ -400,6 +424,12 @@ bool task_ns_capable(struct task_struct
66919 }
66920 EXPORT_SYMBOL(task_ns_capable);
66921
66922 +bool task_ns_capable_nolog(struct task_struct *t, int cap)
66923 +{
66924 + return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
66925 +}
66926 +EXPORT_SYMBOL(task_ns_capable_nolog);
66927 +
66928 /**
66929 * nsown_capable - Check superior capability to one's own user_ns
66930 * @cap: The capability in question
66931 diff -urNp linux-2.6.39.1/kernel/cgroup.c linux-2.6.39.1/kernel/cgroup.c
66932 --- linux-2.6.39.1/kernel/cgroup.c 2011-05-19 00:06:34.000000000 -0400
66933 +++ linux-2.6.39.1/kernel/cgroup.c 2011-05-22 19:36:33.000000000 -0400
66934 @@ -598,6 +598,8 @@ static struct css_set *find_css_set(
66935 struct hlist_head *hhead;
66936 struct cg_cgroup_link *link;
66937
66938 + pax_track_stack();
66939 +
66940 /* First see if we already have a cgroup group that matches
66941 * the desired set */
66942 read_lock(&css_set_lock);
66943 diff -urNp linux-2.6.39.1/kernel/compat.c linux-2.6.39.1/kernel/compat.c
66944 --- linux-2.6.39.1/kernel/compat.c 2011-05-19 00:06:34.000000000 -0400
66945 +++ linux-2.6.39.1/kernel/compat.c 2011-05-22 19:41:42.000000000 -0400
66946 @@ -13,6 +13,7 @@
66947
66948 #include <linux/linkage.h>
66949 #include <linux/compat.h>
66950 +#include <linux/module.h>
66951 #include <linux/errno.h>
66952 #include <linux/time.h>
66953 #include <linux/signal.h>
66954 diff -urNp linux-2.6.39.1/kernel/configs.c linux-2.6.39.1/kernel/configs.c
66955 --- linux-2.6.39.1/kernel/configs.c 2011-05-19 00:06:34.000000000 -0400
66956 +++ linux-2.6.39.1/kernel/configs.c 2011-05-22 19:41:42.000000000 -0400
66957 @@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
66958 struct proc_dir_entry *entry;
66959
66960 /* create the current config file */
66961 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
66962 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
66963 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
66964 + &ikconfig_file_ops);
66965 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66966 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
66967 + &ikconfig_file_ops);
66968 +#endif
66969 +#else
66970 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
66971 &ikconfig_file_ops);
66972 +#endif
66973 +
66974 if (!entry)
66975 return -ENOMEM;
66976
66977 diff -urNp linux-2.6.39.1/kernel/cred.c linux-2.6.39.1/kernel/cred.c
66978 --- linux-2.6.39.1/kernel/cred.c 2011-05-19 00:06:34.000000000 -0400
66979 +++ linux-2.6.39.1/kernel/cred.c 2011-05-22 19:41:42.000000000 -0400
66980 @@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head
66981 */
66982 void __put_cred(struct cred *cred)
66983 {
66984 + pax_track_stack();
66985 +
66986 kdebug("__put_cred(%p{%d,%d})", cred,
66987 atomic_read(&cred->usage),
66988 read_cred_subscribers(cred));
66989 @@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
66990 {
66991 struct cred *cred;
66992
66993 + pax_track_stack();
66994 +
66995 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
66996 atomic_read(&tsk->cred->usage),
66997 read_cred_subscribers(tsk->cred));
66998 @@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct
66999 {
67000 const struct cred *cred;
67001
67002 + pax_track_stack();
67003 +
67004 rcu_read_lock();
67005
67006 do {
67007 @@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
67008 {
67009 struct cred *new;
67010
67011 + pax_track_stack();
67012 +
67013 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
67014 if (!new)
67015 return NULL;
67016 @@ -287,6 +295,8 @@ struct cred *prepare_creds(void)
67017 const struct cred *old;
67018 struct cred *new;
67019
67020 + pax_track_stack();
67021 +
67022 validate_process_creds();
67023
67024 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
67025 @@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void)
67026 struct thread_group_cred *tgcred = NULL;
67027 struct cred *new;
67028
67029 + pax_track_stack();
67030 +
67031 #ifdef CONFIG_KEYS
67032 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
67033 if (!tgcred)
67034 @@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un
67035 struct cred *new;
67036 int ret;
67037
67038 + pax_track_stack();
67039 +
67040 if (
67041 #ifdef CONFIG_KEYS
67042 !p->cred->thread_keyring &&
67043 @@ -475,6 +489,8 @@ int commit_creds(struct cred *new)
67044 struct task_struct *task = current;
67045 const struct cred *old = task->real_cred;
67046
67047 + pax_track_stack();
67048 +
67049 kdebug("commit_creds(%p{%d,%d})", new,
67050 atomic_read(&new->usage),
67051 read_cred_subscribers(new));
67052 @@ -489,6 +505,8 @@ int commit_creds(struct cred *new)
67053
67054 get_cred(new); /* we will require a ref for the subj creds too */
67055
67056 + gr_set_role_label(task, new->uid, new->gid);
67057 +
67058 /* dumpability changes */
67059 if (old->euid != new->euid ||
67060 old->egid != new->egid ||
67061 @@ -551,6 +569,8 @@ EXPORT_SYMBOL(commit_creds);
67062 */
67063 void abort_creds(struct cred *new)
67064 {
67065 + pax_track_stack();
67066 +
67067 kdebug("abort_creds(%p{%d,%d})", new,
67068 atomic_read(&new->usage),
67069 read_cred_subscribers(new));
67070 @@ -574,6 +594,8 @@ const struct cred *override_creds(const
67071 {
67072 const struct cred *old = current->cred;
67073
67074 + pax_track_stack();
67075 +
67076 kdebug("override_creds(%p{%d,%d})", new,
67077 atomic_read(&new->usage),
67078 read_cred_subscribers(new));
67079 @@ -603,6 +625,8 @@ void revert_creds(const struct cred *old
67080 {
67081 const struct cred *override = current->cred;
67082
67083 + pax_track_stack();
67084 +
67085 kdebug("revert_creds(%p{%d,%d})", old,
67086 atomic_read(&old->usage),
67087 read_cred_subscribers(old));
67088 @@ -649,6 +673,8 @@ struct cred *prepare_kernel_cred(struct
67089 const struct cred *old;
67090 struct cred *new;
67091
67092 + pax_track_stack();
67093 +
67094 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
67095 if (!new)
67096 return NULL;
67097 @@ -703,6 +729,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
67098 */
67099 int set_security_override(struct cred *new, u32 secid)
67100 {
67101 + pax_track_stack();
67102 +
67103 return security_kernel_act_as(new, secid);
67104 }
67105 EXPORT_SYMBOL(set_security_override);
67106 @@ -722,6 +750,8 @@ int set_security_override_from_ctx(struc
67107 u32 secid;
67108 int ret;
67109
67110 + pax_track_stack();
67111 +
67112 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
67113 if (ret < 0)
67114 return ret;
67115 diff -urNp linux-2.6.39.1/kernel/debug/debug_core.c linux-2.6.39.1/kernel/debug/debug_core.c
67116 --- linux-2.6.39.1/kernel/debug/debug_core.c 2011-05-19 00:06:34.000000000 -0400
67117 +++ linux-2.6.39.1/kernel/debug/debug_core.c 2011-05-22 19:36:33.000000000 -0400
67118 @@ -72,7 +72,7 @@ int kgdb_io_module_registered;
67119 /* Guard for recursive entry */
67120 static int exception_level;
67121
67122 -struct kgdb_io *dbg_io_ops;
67123 +const struct kgdb_io *dbg_io_ops;
67124 static DEFINE_SPINLOCK(kgdb_registration_lock);
67125
67126 /* kgdb console driver is loaded */
67127 @@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
67128 */
67129 static atomic_t masters_in_kgdb;
67130 static atomic_t slaves_in_kgdb;
67131 -static atomic_t kgdb_break_tasklet_var;
67132 +static atomic_unchecked_t kgdb_break_tasklet_var;
67133 atomic_t kgdb_setting_breakpoint;
67134
67135 struct task_struct *kgdb_usethread;
67136 @@ -129,7 +129,7 @@ int kgdb_single_step;
67137 static pid_t kgdb_sstep_pid;
67138
67139 /* to keep track of the CPU which is doing the single stepping*/
67140 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67141 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67142
67143 /*
67144 * If you are debugging a problem where roundup (the collection of
67145 @@ -542,7 +542,7 @@ return_normal:
67146 * kernel will only try for the value of sstep_tries before
67147 * giving up and continuing on.
67148 */
67149 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
67150 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
67151 (kgdb_info[cpu].task &&
67152 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
67153 atomic_set(&kgdb_active, -1);
67154 @@ -636,8 +636,8 @@ cpu_master_loop:
67155 }
67156
67157 kgdb_restore:
67158 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
67159 - int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
67160 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
67161 + int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
67162 if (kgdb_info[sstep_cpu].task)
67163 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
67164 else
67165 @@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
67166 static void kgdb_tasklet_bpt(unsigned long ing)
67167 {
67168 kgdb_breakpoint();
67169 - atomic_set(&kgdb_break_tasklet_var, 0);
67170 + atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
67171 }
67172
67173 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
67174
67175 void kgdb_schedule_breakpoint(void)
67176 {
67177 - if (atomic_read(&kgdb_break_tasklet_var) ||
67178 + if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
67179 atomic_read(&kgdb_active) != -1 ||
67180 atomic_read(&kgdb_setting_breakpoint))
67181 return;
67182 - atomic_inc(&kgdb_break_tasklet_var);
67183 + atomic_inc_unchecked(&kgdb_break_tasklet_var);
67184 tasklet_schedule(&kgdb_tasklet_breakpoint);
67185 }
67186 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
67187 @@ -864,7 +864,7 @@ static void kgdb_initial_breakpoint(void
67188 *
67189 * Register it with the KGDB core.
67190 */
67191 -int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
67192 +int kgdb_register_io_module(const struct kgdb_io *new_dbg_io_ops)
67193 {
67194 int err;
67195
67196 @@ -909,7 +909,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
67197 *
67198 * Unregister it with the KGDB core.
67199 */
67200 -void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
67201 +void kgdb_unregister_io_module(const struct kgdb_io *old_dbg_io_ops)
67202 {
67203 BUG_ON(kgdb_connected);
67204
67205 diff -urNp linux-2.6.39.1/kernel/debug/kdb/kdb_main.c linux-2.6.39.1/kernel/debug/kdb/kdb_main.c
67206 --- linux-2.6.39.1/kernel/debug/kdb/kdb_main.c 2011-05-19 00:06:34.000000000 -0400
67207 +++ linux-2.6.39.1/kernel/debug/kdb/kdb_main.c 2011-05-22 19:36:33.000000000 -0400
67208 @@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
67209 list_for_each_entry(mod, kdb_modules, list) {
67210
67211 kdb_printf("%-20s%8u 0x%p ", mod->name,
67212 - mod->core_size, (void *)mod);
67213 + mod->core_size_rx + mod->core_size_rw, (void *)mod);
67214 #ifdef CONFIG_MODULE_UNLOAD
67215 kdb_printf("%4d ", module_refcount(mod));
67216 #endif
67217 @@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha
67218 kdb_printf(" (Loading)");
67219 else
67220 kdb_printf(" (Live)");
67221 - kdb_printf(" 0x%p", mod->module_core);
67222 + kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
67223
67224 #ifdef CONFIG_MODULE_UNLOAD
67225 {
67226 diff -urNp linux-2.6.39.1/kernel/exit.c linux-2.6.39.1/kernel/exit.c
67227 --- linux-2.6.39.1/kernel/exit.c 2011-05-19 00:06:34.000000000 -0400
67228 +++ linux-2.6.39.1/kernel/exit.c 2011-05-22 20:02:30.000000000 -0400
67229 @@ -57,6 +57,10 @@
67230 #include <asm/pgtable.h>
67231 #include <asm/mmu_context.h>
67232
67233 +#ifdef CONFIG_GRKERNSEC
67234 +extern rwlock_t grsec_exec_file_lock;
67235 +#endif
67236 +
67237 static void exit_mm(struct task_struct * tsk);
67238
67239 static void __unhash_process(struct task_struct *p, bool group_dead)
67240 @@ -169,6 +173,8 @@ void release_task(struct task_struct * p
67241 struct task_struct *leader;
67242 int zap_leader;
67243 repeat:
67244 + gr_del_task_from_ip_table(p);
67245 +
67246 tracehook_prepare_release_task(p);
67247 /* don't need to get the RCU readlock here - the process is dead and
67248 * can't be modifying its own credentials. But shut RCU-lockdep up */
67249 @@ -338,11 +344,22 @@ static void reparent_to_kthreadd(void)
67250 {
67251 write_lock_irq(&tasklist_lock);
67252
67253 +#ifdef CONFIG_GRKERNSEC
67254 + write_lock(&grsec_exec_file_lock);
67255 + if (current->exec_file) {
67256 + fput(current->exec_file);
67257 + current->exec_file = NULL;
67258 + }
67259 + write_unlock(&grsec_exec_file_lock);
67260 +#endif
67261 +
67262 ptrace_unlink(current);
67263 /* Reparent to init */
67264 current->real_parent = current->parent = kthreadd_task;
67265 list_move_tail(&current->sibling, &current->real_parent->children);
67266
67267 + gr_set_kernel_label(current);
67268 +
67269 /* Set the exit signal to SIGCHLD so we signal init on exit */
67270 current->exit_signal = SIGCHLD;
67271
67272 @@ -394,7 +411,7 @@ int allow_signal(int sig)
67273 * know it'll be handled, so that they don't get converted to
67274 * SIGKILL or just silently dropped.
67275 */
67276 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
67277 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
67278 recalc_sigpending();
67279 spin_unlock_irq(&current->sighand->siglock);
67280 return 0;
67281 @@ -430,6 +447,17 @@ void daemonize(const char *name, ...)
67282 vsnprintf(current->comm, sizeof(current->comm), name, args);
67283 va_end(args);
67284
67285 +#ifdef CONFIG_GRKERNSEC
67286 + write_lock(&grsec_exec_file_lock);
67287 + if (current->exec_file) {
67288 + fput(current->exec_file);
67289 + current->exec_file = NULL;
67290 + }
67291 + write_unlock(&grsec_exec_file_lock);
67292 +#endif
67293 +
67294 + gr_set_kernel_label(current);
67295 +
67296 /*
67297 * If we were started as result of loading a module, close all of the
67298 * user space pages. We don't need them, and if we didn't close them
67299 @@ -905,15 +933,8 @@ NORET_TYPE void do_exit(long code)
67300 struct task_struct *tsk = current;
67301 int group_dead;
67302
67303 - profile_task_exit(tsk);
67304 -
67305 - WARN_ON(atomic_read(&tsk->fs_excl));
67306 - WARN_ON(blk_needs_flush_plug(tsk));
67307 -
67308 if (unlikely(in_interrupt()))
67309 panic("Aiee, killing interrupt handler!");
67310 - if (unlikely(!tsk->pid))
67311 - panic("Attempted to kill the idle task!");
67312
67313 /*
67314 * If do_exit is called because this processes oopsed, it's possible
67315 @@ -924,6 +945,14 @@ NORET_TYPE void do_exit(long code)
67316 */
67317 set_fs(USER_DS);
67318
67319 + profile_task_exit(tsk);
67320 +
67321 + WARN_ON(atomic_read(&tsk->fs_excl));
67322 + WARN_ON(blk_needs_flush_plug(tsk));
67323 +
67324 + if (unlikely(!tsk->pid))
67325 + panic("Attempted to kill the idle task!");
67326 +
67327 tracehook_report_exit(&code);
67328
67329 validate_creds_for_do_exit(tsk);
67330 @@ -984,6 +1013,9 @@ NORET_TYPE void do_exit(long code)
67331 tsk->exit_code = code;
67332 taskstats_exit(tsk, group_dead);
67333
67334 + gr_acl_handle_psacct(tsk, code);
67335 + gr_acl_handle_exit();
67336 +
67337 exit_mm(tsk);
67338
67339 if (group_dead)
67340 diff -urNp linux-2.6.39.1/kernel/fork.c linux-2.6.39.1/kernel/fork.c
67341 --- linux-2.6.39.1/kernel/fork.c 2011-05-19 00:06:34.000000000 -0400
67342 +++ linux-2.6.39.1/kernel/fork.c 2011-05-22 19:41:42.000000000 -0400
67343 @@ -287,7 +287,7 @@ static struct task_struct *dup_task_stru
67344 *stackend = STACK_END_MAGIC; /* for overflow detection */
67345
67346 #ifdef CONFIG_CC_STACKPROTECTOR
67347 - tsk->stack_canary = get_random_int();
67348 + tsk->stack_canary = pax_get_random_long();
67349 #endif
67350
67351 /* One for us, one for whoever does the "release_task()" (usually parent) */
67352 @@ -309,13 +309,78 @@ out:
67353 }
67354
67355 #ifdef CONFIG_MMU
67356 +static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
67357 +{
67358 + struct vm_area_struct *tmp;
67359 + unsigned long charge;
67360 + struct mempolicy *pol;
67361 + struct file *file;
67362 +
67363 + charge = 0;
67364 + if (mpnt->vm_flags & VM_ACCOUNT) {
67365 + unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67366 + if (security_vm_enough_memory(len))
67367 + goto fail_nomem;
67368 + charge = len;
67369 + }
67370 + tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67371 + if (!tmp)
67372 + goto fail_nomem;
67373 + *tmp = *mpnt;
67374 + tmp->vm_mm = mm;
67375 + INIT_LIST_HEAD(&tmp->anon_vma_chain);
67376 + pol = mpol_dup(vma_policy(mpnt));
67377 + if (IS_ERR(pol))
67378 + goto fail_nomem_policy;
67379 + vma_set_policy(tmp, pol);
67380 + if (anon_vma_fork(tmp, mpnt))
67381 + goto fail_nomem_anon_vma_fork;
67382 + tmp->vm_flags &= ~VM_LOCKED;
67383 + tmp->vm_next = tmp->vm_prev = NULL;
67384 + tmp->vm_mirror = NULL;
67385 + file = tmp->vm_file;
67386 + if (file) {
67387 + struct inode *inode = file->f_path.dentry->d_inode;
67388 + struct address_space *mapping = file->f_mapping;
67389 +
67390 + get_file(file);
67391 + if (tmp->vm_flags & VM_DENYWRITE)
67392 + atomic_dec(&inode->i_writecount);
67393 + spin_lock(&mapping->i_mmap_lock);
67394 + if (tmp->vm_flags & VM_SHARED)
67395 + mapping->i_mmap_writable++;
67396 + tmp->vm_truncate_count = mpnt->vm_truncate_count;
67397 + flush_dcache_mmap_lock(mapping);
67398 + /* insert tmp into the share list, just after mpnt */
67399 + vma_prio_tree_add(tmp, mpnt);
67400 + flush_dcache_mmap_unlock(mapping);
67401 + spin_unlock(&mapping->i_mmap_lock);
67402 + }
67403 +
67404 + /*
67405 + * Clear hugetlb-related page reserves for children. This only
67406 + * affects MAP_PRIVATE mappings. Faults generated by the child
67407 + * are not guaranteed to succeed, even if read-only
67408 + */
67409 + if (is_vm_hugetlb_page(tmp))
67410 + reset_vma_resv_huge_pages(tmp);
67411 +
67412 + return tmp;
67413 +
67414 +fail_nomem_anon_vma_fork:
67415 + mpol_put(pol);
67416 +fail_nomem_policy:
67417 + kmem_cache_free(vm_area_cachep, tmp);
67418 +fail_nomem:
67419 + vm_unacct_memory(charge);
67420 + return NULL;
67421 +}
67422 +
67423 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
67424 {
67425 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
67426 struct rb_node **rb_link, *rb_parent;
67427 int retval;
67428 - unsigned long charge;
67429 - struct mempolicy *pol;
67430
67431 down_write(&oldmm->mmap_sem);
67432 flush_cache_dup_mm(oldmm);
67433 @@ -327,8 +392,8 @@ static int dup_mmap(struct mm_struct *mm
67434 mm->locked_vm = 0;
67435 mm->mmap = NULL;
67436 mm->mmap_cache = NULL;
67437 - mm->free_area_cache = oldmm->mmap_base;
67438 - mm->cached_hole_size = ~0UL;
67439 + mm->free_area_cache = oldmm->free_area_cache;
67440 + mm->cached_hole_size = oldmm->cached_hole_size;
67441 mm->map_count = 0;
67442 cpumask_clear(mm_cpumask(mm));
67443 mm->mm_rb = RB_ROOT;
67444 @@ -344,8 +409,6 @@ static int dup_mmap(struct mm_struct *mm
67445
67446 prev = NULL;
67447 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
67448 - struct file *file;
67449 -
67450 if (mpnt->vm_flags & VM_DONTCOPY) {
67451 long pages = vma_pages(mpnt);
67452 mm->total_vm -= pages;
67453 @@ -353,56 +416,13 @@ static int dup_mmap(struct mm_struct *mm
67454 -pages);
67455 continue;
67456 }
67457 - charge = 0;
67458 - if (mpnt->vm_flags & VM_ACCOUNT) {
67459 - unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67460 - if (security_vm_enough_memory(len))
67461 - goto fail_nomem;
67462 - charge = len;
67463 - }
67464 - tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67465 - if (!tmp)
67466 - goto fail_nomem;
67467 - *tmp = *mpnt;
67468 - INIT_LIST_HEAD(&tmp->anon_vma_chain);
67469 - pol = mpol_dup(vma_policy(mpnt));
67470 - retval = PTR_ERR(pol);
67471 - if (IS_ERR(pol))
67472 - goto fail_nomem_policy;
67473 - vma_set_policy(tmp, pol);
67474 - tmp->vm_mm = mm;
67475 - if (anon_vma_fork(tmp, mpnt))
67476 - goto fail_nomem_anon_vma_fork;
67477 - tmp->vm_flags &= ~VM_LOCKED;
67478 - tmp->vm_next = tmp->vm_prev = NULL;
67479 - file = tmp->vm_file;
67480 - if (file) {
67481 - struct inode *inode = file->f_path.dentry->d_inode;
67482 - struct address_space *mapping = file->f_mapping;
67483 -
67484 - get_file(file);
67485 - if (tmp->vm_flags & VM_DENYWRITE)
67486 - atomic_dec(&inode->i_writecount);
67487 - spin_lock(&mapping->i_mmap_lock);
67488 - if (tmp->vm_flags & VM_SHARED)
67489 - mapping->i_mmap_writable++;
67490 - tmp->vm_truncate_count = mpnt->vm_truncate_count;
67491 - flush_dcache_mmap_lock(mapping);
67492 - /* insert tmp into the share list, just after mpnt */
67493 - vma_prio_tree_add(tmp, mpnt);
67494 - flush_dcache_mmap_unlock(mapping);
67495 - spin_unlock(&mapping->i_mmap_lock);
67496 + tmp = dup_vma(mm, mpnt);
67497 + if (!tmp) {
67498 + retval = -ENOMEM;
67499 + goto out;
67500 }
67501
67502 /*
67503 - * Clear hugetlb-related page reserves for children. This only
67504 - * affects MAP_PRIVATE mappings. Faults generated by the child
67505 - * are not guaranteed to succeed, even if read-only
67506 - */
67507 - if (is_vm_hugetlb_page(tmp))
67508 - reset_vma_resv_huge_pages(tmp);
67509 -
67510 - /*
67511 * Link in the new vma and copy the page table entries.
67512 */
67513 *pprev = tmp;
67514 @@ -423,6 +443,31 @@ static int dup_mmap(struct mm_struct *mm
67515 if (retval)
67516 goto out;
67517 }
67518 +
67519 +#ifdef CONFIG_PAX_SEGMEXEC
67520 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
67521 + struct vm_area_struct *mpnt_m;
67522 +
67523 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
67524 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
67525 +
67526 + if (!mpnt->vm_mirror)
67527 + continue;
67528 +
67529 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
67530 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
67531 + mpnt->vm_mirror = mpnt_m;
67532 + } else {
67533 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
67534 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
67535 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
67536 + mpnt->vm_mirror->vm_mirror = mpnt;
67537 + }
67538 + }
67539 + BUG_ON(mpnt_m);
67540 + }
67541 +#endif
67542 +
67543 /* a new mm has just been created */
67544 arch_dup_mmap(oldmm, mm);
67545 retval = 0;
67546 @@ -431,14 +476,6 @@ out:
67547 flush_tlb_mm(oldmm);
67548 up_write(&oldmm->mmap_sem);
67549 return retval;
67550 -fail_nomem_anon_vma_fork:
67551 - mpol_put(pol);
67552 -fail_nomem_policy:
67553 - kmem_cache_free(vm_area_cachep, tmp);
67554 -fail_nomem:
67555 - retval = -ENOMEM;
67556 - vm_unacct_memory(charge);
67557 - goto out;
67558 }
67559
67560 static inline int mm_alloc_pgd(struct mm_struct * mm)
67561 @@ -785,13 +822,14 @@ static int copy_fs(unsigned long clone_f
67562 spin_unlock(&fs->lock);
67563 return -EAGAIN;
67564 }
67565 - fs->users++;
67566 + atomic_inc(&fs->users);
67567 spin_unlock(&fs->lock);
67568 return 0;
67569 }
67570 tsk->fs = copy_fs_struct(fs);
67571 if (!tsk->fs)
67572 return -ENOMEM;
67573 + gr_set_chroot_entries(tsk, &tsk->fs->root);
67574 return 0;
67575 }
67576
67577 @@ -1049,10 +1087,13 @@ static struct task_struct *copy_process(
67578 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
67579 #endif
67580 retval = -EAGAIN;
67581 +
67582 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
67583 +
67584 if (atomic_read(&p->real_cred->user->processes) >=
67585 task_rlimit(p, RLIMIT_NPROC)) {
67586 - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
67587 - p->real_cred->user != INIT_USER)
67588 + if (p->real_cred->user != INIT_USER &&
67589 + !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
67590 goto bad_fork_free;
67591 }
67592
67593 @@ -1200,6 +1241,8 @@ static struct task_struct *copy_process(
67594 goto bad_fork_free_pid;
67595 }
67596
67597 + gr_copy_label(p);
67598 +
67599 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
67600 /*
67601 * Clear TID on mm_release()?
67602 @@ -1360,6 +1403,8 @@ bad_fork_cleanup_count:
67603 bad_fork_free:
67604 free_task(p);
67605 fork_out:
67606 + gr_log_forkfail(retval);
67607 +
67608 return ERR_PTR(retval);
67609 }
67610
67611 @@ -1448,6 +1493,8 @@ long do_fork(unsigned long clone_flags,
67612 if (clone_flags & CLONE_PARENT_SETTID)
67613 put_user(nr, parent_tidptr);
67614
67615 + gr_handle_brute_check();
67616 +
67617 if (clone_flags & CLONE_VFORK) {
67618 p->vfork_done = &vfork;
67619 init_completion(&vfork);
67620 @@ -1549,7 +1596,7 @@ static int unshare_fs(unsigned long unsh
67621 return 0;
67622
67623 /* don't need lock here; in the worst case we'll do useless copy */
67624 - if (fs->users == 1)
67625 + if (atomic_read(&fs->users) == 1)
67626 return 0;
67627
67628 *new_fsp = copy_fs_struct(fs);
67629 @@ -1636,7 +1683,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
67630 fs = current->fs;
67631 spin_lock(&fs->lock);
67632 current->fs = new_fs;
67633 - if (--fs->users)
67634 + gr_set_chroot_entries(current, &current->fs->root);
67635 + if (atomic_dec_return(&fs->users))
67636 new_fs = NULL;
67637 else
67638 new_fs = fs;
67639 diff -urNp linux-2.6.39.1/kernel/futex.c linux-2.6.39.1/kernel/futex.c
67640 --- linux-2.6.39.1/kernel/futex.c 2011-05-19 00:06:34.000000000 -0400
67641 +++ linux-2.6.39.1/kernel/futex.c 2011-05-22 22:41:57.000000000 -0400
67642 @@ -54,6 +54,7 @@
67643 #include <linux/mount.h>
67644 #include <linux/pagemap.h>
67645 #include <linux/syscalls.h>
67646 +#include <linux/ptrace.h>
67647 #include <linux/signal.h>
67648 #include <linux/module.h>
67649 #include <linux/magic.h>
67650 @@ -236,6 +237,11 @@ get_futex_key(u32 __user *uaddr, int fsh
67651 struct page *page, *page_head;
67652 int err;
67653
67654 +#ifdef CONFIG_PAX_SEGMEXEC
67655 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
67656 + return -EFAULT;
67657 +#endif
67658 +
67659 /*
67660 * The futex address must be "naturally" aligned.
67661 */
67662 @@ -1833,6 +1839,8 @@ static int futex_wait(u32 __user *uaddr,
67663 struct futex_q q = futex_q_init;
67664 int ret;
67665
67666 + pax_track_stack();
67667 +
67668 if (!bitset)
67669 return -EINVAL;
67670 q.bitset = bitset;
67671 @@ -2229,6 +2237,8 @@ static int futex_wait_requeue_pi(u32 __u
67672 struct futex_q q = futex_q_init;
67673 int res, ret;
67674
67675 + pax_track_stack();
67676 +
67677 if (!bitset)
67678 return -EINVAL;
67679
67680 @@ -2401,7 +2411,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67681 {
67682 struct robust_list_head __user *head;
67683 unsigned long ret;
67684 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67685 const struct cred *cred = current_cred(), *pcred;
67686 +#endif
67687
67688 if (!futex_cmpxchg_enabled)
67689 return -ENOSYS;
67690 @@ -2417,6 +2429,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67691 if (!p)
67692 goto err_unlock;
67693 ret = -EPERM;
67694 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67695 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
67696 + goto err_unlock;
67697 +#else
67698 pcred = __task_cred(p);
67699 /* If victim is in different user_ns, then uids are not
67700 comparable, so we must have CAP_SYS_PTRACE */
67701 @@ -2431,6 +2447,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67702 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67703 goto err_unlock;
67704 ok:
67705 +#endif
67706 head = p->robust_list;
67707 rcu_read_unlock();
67708 }
67709 @@ -2682,6 +2699,7 @@ static int __init futex_init(void)
67710 {
67711 u32 curval;
67712 int i;
67713 + mm_segment_t oldfs;
67714
67715 /*
67716 * This will fail and we want it. Some arch implementations do
67717 @@ -2693,8 +2711,11 @@ static int __init futex_init(void)
67718 * implementation, the non-functional ones will return
67719 * -ENOSYS.
67720 */
67721 + oldfs = get_fs();
67722 + set_fs(USER_DS);
67723 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
67724 futex_cmpxchg_enabled = 1;
67725 + set_fs(oldfs);
67726
67727 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
67728 plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
67729 diff -urNp linux-2.6.39.1/kernel/futex_compat.c linux-2.6.39.1/kernel/futex_compat.c
67730 --- linux-2.6.39.1/kernel/futex_compat.c 2011-05-19 00:06:34.000000000 -0400
67731 +++ linux-2.6.39.1/kernel/futex_compat.c 2011-05-22 22:42:09.000000000 -0400
67732 @@ -10,6 +10,7 @@
67733 #include <linux/compat.h>
67734 #include <linux/nsproxy.h>
67735 #include <linux/futex.h>
67736 +#include <linux/ptrace.h>
67737
67738 #include <asm/uaccess.h>
67739
67740 @@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp
67741 {
67742 struct compat_robust_list_head __user *head;
67743 unsigned long ret;
67744 - const struct cred *cred = current_cred(), *pcred;
67745 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67746 + const struct cred *cred = current_cred();
67747 + const struct cred *pcred;
67748 +#endif
67749
67750 if (!futex_cmpxchg_enabled)
67751 return -ENOSYS;
67752 @@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp
67753 if (!p)
67754 goto err_unlock;
67755 ret = -EPERM;
67756 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67757 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
67758 + goto err_unlock;
67759 +#else
67760 pcred = __task_cred(p);
67761 /* If victim is in different user_ns, then uids are not
67762 comparable, so we must have CAP_SYS_PTRACE */
67763 @@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp
67764 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67765 goto err_unlock;
67766 ok:
67767 +#endif
67768 head = p->compat_robust_list;
67769 rcu_read_unlock();
67770 }
67771 diff -urNp linux-2.6.39.1/kernel/gcov/base.c linux-2.6.39.1/kernel/gcov/base.c
67772 --- linux-2.6.39.1/kernel/gcov/base.c 2011-05-19 00:06:34.000000000 -0400
67773 +++ linux-2.6.39.1/kernel/gcov/base.c 2011-05-22 19:36:33.000000000 -0400
67774 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
67775 }
67776
67777 #ifdef CONFIG_MODULES
67778 -static inline int within(void *addr, void *start, unsigned long size)
67779 -{
67780 - return ((addr >= start) && (addr < start + size));
67781 -}
67782 -
67783 /* Update list and generate events when modules are unloaded. */
67784 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67785 void *data)
67786 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
67787 prev = NULL;
67788 /* Remove entries located in module from linked list. */
67789 for (info = gcov_info_head; info; info = info->next) {
67790 - if (within(info, mod->module_core, mod->core_size)) {
67791 + if (within_module_core_rw((unsigned long)info, mod)) {
67792 if (prev)
67793 prev->next = info->next;
67794 else
67795 diff -urNp linux-2.6.39.1/kernel/hrtimer.c linux-2.6.39.1/kernel/hrtimer.c
67796 --- linux-2.6.39.1/kernel/hrtimer.c 2011-05-19 00:06:34.000000000 -0400
67797 +++ linux-2.6.39.1/kernel/hrtimer.c 2011-05-22 19:36:33.000000000 -0400
67798 @@ -1383,7 +1383,7 @@ void hrtimer_peek_ahead_timers(void)
67799 local_irq_restore(flags);
67800 }
67801
67802 -static void run_hrtimer_softirq(struct softirq_action *h)
67803 +static void run_hrtimer_softirq(void)
67804 {
67805 hrtimer_peek_ahead_timers();
67806 }
67807 diff -urNp linux-2.6.39.1/kernel/irq/manage.c linux-2.6.39.1/kernel/irq/manage.c
67808 --- linux-2.6.39.1/kernel/irq/manage.c 2011-05-19 00:06:34.000000000 -0400
67809 +++ linux-2.6.39.1/kernel/irq/manage.c 2011-06-13 17:09:06.000000000 -0400
67810 @@ -491,6 +491,9 @@ int irq_set_irq_wake(unsigned int irq, u
67811 struct irq_desc *desc = irq_get_desc_buslock(irq, &flags);
67812 int ret = 0;
67813
67814 + if (!desc)
67815 + return -EINVAL;
67816 +
67817 /* wakeup-capable irqs can be shared between drivers that
67818 * don't need to have the same sleep mode behaviors.
67819 */
67820 diff -urNp linux-2.6.39.1/kernel/jump_label.c linux-2.6.39.1/kernel/jump_label.c
67821 --- linux-2.6.39.1/kernel/jump_label.c 2011-05-19 00:06:34.000000000 -0400
67822 +++ linux-2.6.39.1/kernel/jump_label.c 2011-05-22 19:36:33.000000000 -0400
67823 @@ -49,6 +49,17 @@ void jump_label_unlock(void)
67824 mutex_unlock(&jump_label_mutex);
67825 }
67826
67827 +static void jump_label_swap(void *a, void *b, int size)
67828 +{
67829 + struct jump_entry t;
67830 +
67831 + t = *(struct jump_entry *)a;
67832 + pax_open_kernel();
67833 + *(struct jump_entry *)a = *(struct jump_entry *)b;
67834 + *(struct jump_entry *)b = t;
67835 + pax_close_kernel();
67836 +}
67837 +
67838 static int jump_label_cmp(const void *a, const void *b)
67839 {
67840 const struct jump_entry *jea = a;
67841 @@ -70,7 +81,7 @@ sort_jump_label_entries(struct jump_entr
67842
67843 size = (((unsigned long)stop - (unsigned long)start)
67844 / sizeof(struct jump_entry));
67845 - sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
67846 + sort(start, size, sizeof(struct jump_entry), jump_label_cmp, jump_label_swap);
67847 }
67848
67849 static struct jump_label_entry *get_jump_label_entry(jump_label_t key)
67850 @@ -407,8 +418,11 @@ static void remove_jump_label_module_ini
67851 count = e_module->nr_entries;
67852 iter = e_module->table;
67853 while (count--) {
67854 - if (within_module_init(iter->code, mod))
67855 + if (within_module_init(iter->code, mod)) {
67856 + pax_open_kernel();
67857 iter->key = 0;
67858 + pax_close_kernel();
67859 + }
67860 iter++;
67861 }
67862 }
67863 diff -urNp linux-2.6.39.1/kernel/kallsyms.c linux-2.6.39.1/kernel/kallsyms.c
67864 --- linux-2.6.39.1/kernel/kallsyms.c 2011-05-19 00:06:34.000000000 -0400
67865 +++ linux-2.6.39.1/kernel/kallsyms.c 2011-05-22 19:41:42.000000000 -0400
67866 @@ -11,6 +11,9 @@
67867 * Changed the compression method from stem compression to "table lookup"
67868 * compression (see scripts/kallsyms.c for a more complete description)
67869 */
67870 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67871 +#define __INCLUDED_BY_HIDESYM 1
67872 +#endif
67873 #include <linux/kallsyms.h>
67874 #include <linux/module.h>
67875 #include <linux/init.h>
67876 @@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark
67877
67878 static inline int is_kernel_inittext(unsigned long addr)
67879 {
67880 + if (system_state != SYSTEM_BOOTING)
67881 + return 0;
67882 +
67883 if (addr >= (unsigned long)_sinittext
67884 && addr <= (unsigned long)_einittext)
67885 return 1;
67886 return 0;
67887 }
67888
67889 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67890 +#ifdef CONFIG_MODULES
67891 +static inline int is_module_text(unsigned long addr)
67892 +{
67893 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
67894 + return 1;
67895 +
67896 + addr = ktla_ktva(addr);
67897 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
67898 +}
67899 +#else
67900 +static inline int is_module_text(unsigned long addr)
67901 +{
67902 + return 0;
67903 +}
67904 +#endif
67905 +#endif
67906 +
67907 static inline int is_kernel_text(unsigned long addr)
67908 {
67909 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
67910 @@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne
67911
67912 static inline int is_kernel(unsigned long addr)
67913 {
67914 +
67915 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67916 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
67917 + return 1;
67918 +
67919 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
67920 +#else
67921 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
67922 +#endif
67923 +
67924 return 1;
67925 return in_gate_area_no_mm(addr);
67926 }
67927
67928 static int is_ksym_addr(unsigned long addr)
67929 {
67930 +
67931 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67932 + if (is_module_text(addr))
67933 + return 0;
67934 +#endif
67935 +
67936 if (all_var)
67937 return is_kernel(addr);
67938
67939 @@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st
67940
67941 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
67942 {
67943 - iter->name[0] = '\0';
67944 iter->nameoff = get_symbol_offset(new_pos);
67945 iter->pos = new_pos;
67946 }
67947 @@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo
67948 {
67949 struct kallsym_iter *iter = m->private;
67950
67951 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67952 + if (current_uid())
67953 + return 0;
67954 +#endif
67955 +
67956 /* Some debugging symbols have no name. Ignore them. */
67957 if (!iter->name[0])
67958 return 0;
67959 @@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i
67960 struct kallsym_iter *iter;
67961 int ret;
67962
67963 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
67964 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
67965 if (!iter)
67966 return -ENOMEM;
67967 reset_iter(iter, 0);
67968 diff -urNp linux-2.6.39.1/kernel/kmod.c linux-2.6.39.1/kernel/kmod.c
67969 --- linux-2.6.39.1/kernel/kmod.c 2011-05-19 00:06:34.000000000 -0400
67970 +++ linux-2.6.39.1/kernel/kmod.c 2011-05-22 19:41:42.000000000 -0400
67971 @@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
67972 * If module auto-loading support is disabled then this function
67973 * becomes a no-operation.
67974 */
67975 -int __request_module(bool wait, const char *fmt, ...)
67976 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
67977 {
67978 - va_list args;
67979 char module_name[MODULE_NAME_LEN];
67980 unsigned int max_modprobes;
67981 int ret;
67982 - char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
67983 + char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
67984 static char *envp[] = { "HOME=/",
67985 "TERM=linux",
67986 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
67987 @@ -80,9 +79,7 @@ int __request_module(bool wait, const ch
67988 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
67989 static int kmod_loop_msg;
67990
67991 - va_start(args, fmt);
67992 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
67993 - va_end(args);
67994 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
67995 if (ret >= MODULE_NAME_LEN)
67996 return -ENAMETOOLONG;
67997
67998 @@ -90,6 +87,20 @@ int __request_module(bool wait, const ch
67999 if (ret)
68000 return ret;
68001
68002 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68003 + if (!current_uid()) {
68004 + /* hack to workaround consolekit/udisks stupidity */
68005 + read_lock(&tasklist_lock);
68006 + if (!strcmp(current->comm, "mount") &&
68007 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
68008 + read_unlock(&tasklist_lock);
68009 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
68010 + return -EPERM;
68011 + }
68012 + read_unlock(&tasklist_lock);
68013 + }
68014 +#endif
68015 +
68016 /* If modprobe needs a service that is in a module, we get a recursive
68017 * loop. Limit the number of running kmod threads to max_threads/2 or
68018 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
68019 @@ -123,6 +134,47 @@ int __request_module(bool wait, const ch
68020 atomic_dec(&kmod_concurrent);
68021 return ret;
68022 }
68023 +
68024 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
68025 +{
68026 + va_list args;
68027 + int ret;
68028 +
68029 + va_start(args, fmt);
68030 + ret = ____request_module(wait, module_param, fmt, args);
68031 + va_end(args);
68032 +
68033 + return ret;
68034 +}
68035 +
68036 +int __request_module(bool wait, const char *fmt, ...)
68037 +{
68038 + va_list args;
68039 + int ret;
68040 +
68041 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68042 + if (current_uid()) {
68043 + char module_param[MODULE_NAME_LEN];
68044 +
68045 + memset(module_param, 0, sizeof(module_param));
68046 +
68047 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
68048 +
68049 + va_start(args, fmt);
68050 + ret = ____request_module(wait, module_param, fmt, args);
68051 + va_end(args);
68052 +
68053 + return ret;
68054 + }
68055 +#endif
68056 +
68057 + va_start(args, fmt);
68058 + ret = ____request_module(wait, NULL, fmt, args);
68059 + va_end(args);
68060 +
68061 + return ret;
68062 +}
68063 +
68064 EXPORT_SYMBOL(__request_module);
68065 #endif /* CONFIG_MODULES */
68066
68067 diff -urNp linux-2.6.39.1/kernel/kprobes.c linux-2.6.39.1/kernel/kprobes.c
68068 --- linux-2.6.39.1/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
68069 +++ linux-2.6.39.1/kernel/kprobes.c 2011-05-22 19:36:33.000000000 -0400
68070 @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
68071 * kernel image and loaded module images reside. This is required
68072 * so x86_64 can correctly handle the %rip-relative fixups.
68073 */
68074 - kip->insns = module_alloc(PAGE_SIZE);
68075 + kip->insns = module_alloc_exec(PAGE_SIZE);
68076 if (!kip->insns) {
68077 kfree(kip);
68078 return NULL;
68079 @@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st
68080 */
68081 if (!list_is_singular(&kip->list)) {
68082 list_del(&kip->list);
68083 - module_free(NULL, kip->insns);
68084 + module_free_exec(NULL, kip->insns);
68085 kfree(kip);
68086 }
68087 return 1;
68088 @@ -1936,7 +1936,7 @@ static int __init init_kprobes(void)
68089 {
68090 int i, err = 0;
68091 unsigned long offset = 0, size = 0;
68092 - char *modname, namebuf[128];
68093 + char *modname, namebuf[KSYM_NAME_LEN];
68094 const char *symbol_name;
68095 void *addr;
68096 struct kprobe_blackpoint *kb;
68097 @@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st
68098 const char *sym = NULL;
68099 unsigned int i = *(loff_t *) v;
68100 unsigned long offset = 0;
68101 - char *modname, namebuf[128];
68102 + char *modname, namebuf[KSYM_NAME_LEN];
68103
68104 head = &kprobe_table[i];
68105 preempt_disable();
68106 diff -urNp linux-2.6.39.1/kernel/lockdep.c linux-2.6.39.1/kernel/lockdep.c
68107 --- linux-2.6.39.1/kernel/lockdep.c 2011-05-19 00:06:34.000000000 -0400
68108 +++ linux-2.6.39.1/kernel/lockdep.c 2011-05-22 19:36:33.000000000 -0400
68109 @@ -571,6 +571,10 @@ static int static_obj(void *obj)
68110 end = (unsigned long) &_end,
68111 addr = (unsigned long) obj;
68112
68113 +#ifdef CONFIG_PAX_KERNEXEC
68114 + start = ktla_ktva(start);
68115 +#endif
68116 +
68117 /*
68118 * static variable?
68119 */
68120 @@ -706,6 +710,7 @@ register_lock_class(struct lockdep_map *
68121 if (!static_obj(lock->key)) {
68122 debug_locks_off();
68123 printk("INFO: trying to register non-static key.\n");
68124 + printk("lock:%pS key:%pS.\n", lock, lock->key);
68125 printk("the code is fine but needs lockdep annotation.\n");
68126 printk("turning off the locking correctness validator.\n");
68127 dump_stack();
68128 @@ -2752,7 +2757,7 @@ static int __lock_acquire(struct lockdep
68129 if (!class)
68130 return 0;
68131 }
68132 - atomic_inc((atomic_t *)&class->ops);
68133 + atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
68134 if (very_verbose(class)) {
68135 printk("\nacquire class [%p] %s", class->key, class->name);
68136 if (class->name_version > 1)
68137 diff -urNp linux-2.6.39.1/kernel/lockdep_proc.c linux-2.6.39.1/kernel/lockdep_proc.c
68138 --- linux-2.6.39.1/kernel/lockdep_proc.c 2011-05-19 00:06:34.000000000 -0400
68139 +++ linux-2.6.39.1/kernel/lockdep_proc.c 2011-05-22 19:36:33.000000000 -0400
68140 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
68141
68142 static void print_name(struct seq_file *m, struct lock_class *class)
68143 {
68144 - char str[128];
68145 + char str[KSYM_NAME_LEN];
68146 const char *name = class->name;
68147
68148 if (!name) {
68149 diff -urNp linux-2.6.39.1/kernel/module.c linux-2.6.39.1/kernel/module.c
68150 --- linux-2.6.39.1/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
68151 +++ linux-2.6.39.1/kernel/module.c 2011-05-22 19:41:42.000000000 -0400
68152 @@ -57,6 +57,7 @@
68153 #include <linux/kmemleak.h>
68154 #include <linux/jump_label.h>
68155 #include <linux/pfn.h>
68156 +#include <linux/grsecurity.h>
68157
68158 #define CREATE_TRACE_POINTS
68159 #include <trace/events/module.h>
68160 @@ -118,7 +119,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
68161
68162 /* Bounds of module allocation, for speeding __module_address.
68163 * Protected by module_mutex. */
68164 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
68165 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
68166 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
68167
68168 int register_module_notifier(struct notifier_block * nb)
68169 {
68170 @@ -282,7 +284,7 @@ bool each_symbol(bool (*fn)(const struct
68171 return true;
68172
68173 list_for_each_entry_rcu(mod, &modules, list) {
68174 - struct symsearch arr[] = {
68175 + struct symsearch modarr[] = {
68176 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
68177 NOT_GPL_ONLY, false },
68178 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
68179 @@ -304,7 +306,7 @@ bool each_symbol(bool (*fn)(const struct
68180 #endif
68181 };
68182
68183 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
68184 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
68185 return true;
68186 }
68187 return false;
68188 @@ -415,7 +417,7 @@ static inline void __percpu *mod_percpu(
68189 static int percpu_modalloc(struct module *mod,
68190 unsigned long size, unsigned long align)
68191 {
68192 - if (align > PAGE_SIZE) {
68193 + if (align-1 >= PAGE_SIZE) {
68194 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
68195 mod->name, align, PAGE_SIZE);
68196 align = PAGE_SIZE;
68197 @@ -1143,7 +1145,7 @@ resolve_symbol_wait(struct module *mod,
68198 */
68199 #ifdef CONFIG_SYSFS
68200
68201 -#ifdef CONFIG_KALLSYMS
68202 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
68203 static inline bool sect_empty(const Elf_Shdr *sect)
68204 {
68205 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
68206 @@ -1612,17 +1614,17 @@ void unset_section_ro_nx(struct module *
68207 {
68208 unsigned long total_pages;
68209
68210 - if (mod->module_core == module_region) {
68211 + if (mod->module_core_rx == module_region) {
68212 /* Set core as NX+RW */
68213 - total_pages = MOD_NUMBER_OF_PAGES(mod->module_core, mod->core_size);
68214 - set_memory_nx((unsigned long)mod->module_core, total_pages);
68215 - set_memory_rw((unsigned long)mod->module_core, total_pages);
68216 + total_pages = MOD_NUMBER_OF_PAGES(mod->module_core_rx, mod->core_size_rx);
68217 + set_memory_nx((unsigned long)mod->module_core_rx, total_pages);
68218 + set_memory_rw((unsigned long)mod->module_core_rx, total_pages);
68219
68220 - } else if (mod->module_init == module_region) {
68221 + } else if (mod->module_init_rx == module_region) {
68222 /* Set init as NX+RW */
68223 - total_pages = MOD_NUMBER_OF_PAGES(mod->module_init, mod->init_size);
68224 - set_memory_nx((unsigned long)mod->module_init, total_pages);
68225 - set_memory_rw((unsigned long)mod->module_init, total_pages);
68226 + total_pages = MOD_NUMBER_OF_PAGES(mod->module_init_rx, mod->init_size_rx);
68227 + set_memory_nx((unsigned long)mod->module_init_rx, total_pages);
68228 + set_memory_rw((unsigned long)mod->module_init_rx, total_pages);
68229 }
68230 }
68231
68232 @@ -1633,14 +1635,14 @@ void set_all_modules_text_rw()
68233
68234 mutex_lock(&module_mutex);
68235 list_for_each_entry_rcu(mod, &modules, list) {
68236 - if ((mod->module_core) && (mod->core_text_size)) {
68237 - set_page_attributes(mod->module_core,
68238 - mod->module_core + mod->core_text_size,
68239 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
68240 + set_page_attributes(mod->module_core_rx,
68241 + mod->module_core_rx + mod->core_size_rx,
68242 set_memory_rw);
68243 }
68244 - if ((mod->module_init) && (mod->init_text_size)) {
68245 - set_page_attributes(mod->module_init,
68246 - mod->module_init + mod->init_text_size,
68247 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
68248 + set_page_attributes(mod->module_init_rx,
68249 + mod->module_init_rx + mod->init_size_rx,
68250 set_memory_rw);
68251 }
68252 }
68253 @@ -1654,14 +1656,14 @@ void set_all_modules_text_ro()
68254
68255 mutex_lock(&module_mutex);
68256 list_for_each_entry_rcu(mod, &modules, list) {
68257 - if ((mod->module_core) && (mod->core_text_size)) {
68258 - set_page_attributes(mod->module_core,
68259 - mod->module_core + mod->core_text_size,
68260 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
68261 + set_page_attributes(mod->module_core_rx,
68262 + mod->module_core_rx + mod->core_size_rx,
68263 set_memory_ro);
68264 }
68265 - if ((mod->module_init) && (mod->init_text_size)) {
68266 - set_page_attributes(mod->module_init,
68267 - mod->module_init + mod->init_text_size,
68268 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
68269 + set_page_attributes(mod->module_init_rx,
68270 + mod->module_init_rx + mod->init_size_rx,
68271 set_memory_ro);
68272 }
68273 }
68274 @@ -1696,17 +1698,20 @@ static void free_module(struct module *m
68275 destroy_params(mod->kp, mod->num_kp);
68276
68277 /* This may be NULL, but that's OK */
68278 - unset_section_ro_nx(mod, mod->module_init);
68279 - module_free(mod, mod->module_init);
68280 + unset_section_ro_nx(mod, mod->module_init_rx);
68281 + module_free(mod, mod->module_init_rw);
68282 + module_free_exec(mod, mod->module_init_rx);
68283 kfree(mod->args);
68284 percpu_modfree(mod);
68285
68286 /* Free lock-classes: */
68287 - lockdep_free_key_range(mod->module_core, mod->core_size);
68288 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
68289 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
68290
68291 /* Finally, free the core (containing the module structure) */
68292 - unset_section_ro_nx(mod, mod->module_core);
68293 - module_free(mod, mod->module_core);
68294 + unset_section_ro_nx(mod, mod->module_core_rx);
68295 + module_free_exec(mod, mod->module_core_rx);
68296 + module_free(mod, mod->module_core_rw);
68297
68298 #ifdef CONFIG_MPU
68299 update_protections(current->mm);
68300 @@ -1775,10 +1780,31 @@ static int simplify_symbols(struct modul
68301 unsigned int i;
68302 int ret = 0;
68303 const struct kernel_symbol *ksym;
68304 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68305 + int is_fs_load = 0;
68306 + int register_filesystem_found = 0;
68307 + char *p;
68308 +
68309 + p = strstr(mod->args, "grsec_modharden_fs");
68310 + if (p) {
68311 + char *endptr = p + strlen("grsec_modharden_fs");
68312 + /* copy \0 as well */
68313 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
68314 + is_fs_load = 1;
68315 + }
68316 +#endif
68317
68318 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
68319 const char *name = info->strtab + sym[i].st_name;
68320
68321 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68322 + /* it's a real shame this will never get ripped and copied
68323 + upstream! ;(
68324 + */
68325 + if (is_fs_load && !strcmp(name, "register_filesystem"))
68326 + register_filesystem_found = 1;
68327 +#endif
68328 +
68329 switch (sym[i].st_shndx) {
68330 case SHN_COMMON:
68331 /* We compiled with -fno-common. These are not
68332 @@ -1799,7 +1825,9 @@ static int simplify_symbols(struct modul
68333 ksym = resolve_symbol_wait(mod, info, name);
68334 /* Ok if resolved. */
68335 if (ksym && !IS_ERR(ksym)) {
68336 + pax_open_kernel();
68337 sym[i].st_value = ksym->value;
68338 + pax_close_kernel();
68339 break;
68340 }
68341
68342 @@ -1818,11 +1846,20 @@ static int simplify_symbols(struct modul
68343 secbase = (unsigned long)mod_percpu(mod);
68344 else
68345 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
68346 + pax_open_kernel();
68347 sym[i].st_value += secbase;
68348 + pax_close_kernel();
68349 break;
68350 }
68351 }
68352
68353 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68354 + if (is_fs_load && !register_filesystem_found) {
68355 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
68356 + ret = -EPERM;
68357 + }
68358 +#endif
68359 +
68360 return ret;
68361 }
68362
68363 @@ -1906,22 +1943,12 @@ static void layout_sections(struct modul
68364 || s->sh_entsize != ~0UL
68365 || strstarts(sname, ".init"))
68366 continue;
68367 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
68368 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68369 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
68370 + else
68371 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
68372 DEBUGP("\t%s\n", name);
68373 }
68374 - switch (m) {
68375 - case 0: /* executable */
68376 - mod->core_size = debug_align(mod->core_size);
68377 - mod->core_text_size = mod->core_size;
68378 - break;
68379 - case 1: /* RO: text and ro-data */
68380 - mod->core_size = debug_align(mod->core_size);
68381 - mod->core_ro_size = mod->core_size;
68382 - break;
68383 - case 3: /* whole core */
68384 - mod->core_size = debug_align(mod->core_size);
68385 - break;
68386 - }
68387 }
68388
68389 DEBUGP("Init section allocation order:\n");
68390 @@ -1935,23 +1962,13 @@ static void layout_sections(struct modul
68391 || s->sh_entsize != ~0UL
68392 || !strstarts(sname, ".init"))
68393 continue;
68394 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
68395 - | INIT_OFFSET_MASK);
68396 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68397 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
68398 + else
68399 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
68400 + s->sh_entsize |= INIT_OFFSET_MASK;
68401 DEBUGP("\t%s\n", sname);
68402 }
68403 - switch (m) {
68404 - case 0: /* executable */
68405 - mod->init_size = debug_align(mod->init_size);
68406 - mod->init_text_size = mod->init_size;
68407 - break;
68408 - case 1: /* RO: text and ro-data */
68409 - mod->init_size = debug_align(mod->init_size);
68410 - mod->init_ro_size = mod->init_size;
68411 - break;
68412 - case 3: /* whole init */
68413 - mod->init_size = debug_align(mod->init_size);
68414 - break;
68415 - }
68416 }
68417 }
68418
68419 @@ -2119,7 +2136,7 @@ static void layout_symtab(struct module
68420
68421 /* Put symbol section at end of init part of module. */
68422 symsect->sh_flags |= SHF_ALLOC;
68423 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
68424 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
68425 info->index.sym) | INIT_OFFSET_MASK;
68426 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
68427
68428 @@ -2136,19 +2153,19 @@ static void layout_symtab(struct module
68429 }
68430
68431 /* Append room for core symbols at end of core part. */
68432 - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
68433 - mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
68434 + info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
68435 + mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
68436
68437 /* Put string table section at end of init part of module. */
68438 strsect->sh_flags |= SHF_ALLOC;
68439 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
68440 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
68441 info->index.str) | INIT_OFFSET_MASK;
68442 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
68443
68444 /* Append room for core symbols' strings at end of core part. */
68445 - info->stroffs = mod->core_size;
68446 + info->stroffs = mod->core_size_rx;
68447 __set_bit(0, info->strmap);
68448 - mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
68449 + mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
68450 }
68451
68452 static void add_kallsyms(struct module *mod, const struct load_info *info)
68453 @@ -2164,11 +2181,13 @@ static void add_kallsyms(struct module *
68454 /* Make sure we get permanent strtab: don't use info->strtab. */
68455 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
68456
68457 + pax_open_kernel();
68458 +
68459 /* Set types up while we still have access to sections. */
68460 for (i = 0; i < mod->num_symtab; i++)
68461 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
68462
68463 - mod->core_symtab = dst = mod->module_core + info->symoffs;
68464 + mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
68465 src = mod->symtab;
68466 *dst = *src;
68467 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
68468 @@ -2181,10 +2200,12 @@ static void add_kallsyms(struct module *
68469 }
68470 mod->core_num_syms = ndst;
68471
68472 - mod->core_strtab = s = mod->module_core + info->stroffs;
68473 + mod->core_strtab = s = mod->module_core_rx + info->stroffs;
68474 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
68475 if (test_bit(i, info->strmap))
68476 *++s = mod->strtab[i];
68477 +
68478 + pax_close_kernel();
68479 }
68480 #else
68481 static inline void layout_symtab(struct module *mod, struct load_info *info)
68482 @@ -2213,17 +2234,33 @@ static void dynamic_debug_remove(struct
68483 ddebug_remove_module(debug->modname);
68484 }
68485
68486 -static void *module_alloc_update_bounds(unsigned long size)
68487 +static void *module_alloc_update_bounds_rw(unsigned long size)
68488 {
68489 void *ret = module_alloc(size);
68490
68491 if (ret) {
68492 mutex_lock(&module_mutex);
68493 /* Update module bounds. */
68494 - if ((unsigned long)ret < module_addr_min)
68495 - module_addr_min = (unsigned long)ret;
68496 - if ((unsigned long)ret + size > module_addr_max)
68497 - module_addr_max = (unsigned long)ret + size;
68498 + if ((unsigned long)ret < module_addr_min_rw)
68499 + module_addr_min_rw = (unsigned long)ret;
68500 + if ((unsigned long)ret + size > module_addr_max_rw)
68501 + module_addr_max_rw = (unsigned long)ret + size;
68502 + mutex_unlock(&module_mutex);
68503 + }
68504 + return ret;
68505 +}
68506 +
68507 +static void *module_alloc_update_bounds_rx(unsigned long size)
68508 +{
68509 + void *ret = module_alloc_exec(size);
68510 +
68511 + if (ret) {
68512 + mutex_lock(&module_mutex);
68513 + /* Update module bounds. */
68514 + if ((unsigned long)ret < module_addr_min_rx)
68515 + module_addr_min_rx = (unsigned long)ret;
68516 + if ((unsigned long)ret + size > module_addr_max_rx)
68517 + module_addr_max_rx = (unsigned long)ret + size;
68518 mutex_unlock(&module_mutex);
68519 }
68520 return ret;
68521 @@ -2516,7 +2553,7 @@ static int move_module(struct module *mo
68522 void *ptr;
68523
68524 /* Do the allocs. */
68525 - ptr = module_alloc_update_bounds(mod->core_size);
68526 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
68527 /*
68528 * The pointer to this block is stored in the module structure
68529 * which is inside the block. Just mark it as not being a
68530 @@ -2526,23 +2563,50 @@ static int move_module(struct module *mo
68531 if (!ptr)
68532 return -ENOMEM;
68533
68534 - memset(ptr, 0, mod->core_size);
68535 - mod->module_core = ptr;
68536 + memset(ptr, 0, mod->core_size_rw);
68537 + mod->module_core_rw = ptr;
68538
68539 - ptr = module_alloc_update_bounds(mod->init_size);
68540 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
68541 /*
68542 * The pointer to this block is stored in the module structure
68543 * which is inside the block. This block doesn't need to be
68544 * scanned as it contains data and code that will be freed
68545 * after the module is initialized.
68546 */
68547 - kmemleak_ignore(ptr);
68548 - if (!ptr && mod->init_size) {
68549 - module_free(mod, mod->module_core);
68550 + kmemleak_not_leak(ptr);
68551 + if (!ptr && mod->init_size_rw) {
68552 + module_free(mod, mod->module_core_rw);
68553 return -ENOMEM;
68554 }
68555 - memset(ptr, 0, mod->init_size);
68556 - mod->module_init = ptr;
68557 + memset(ptr, 0, mod->init_size_rw);
68558 + mod->module_init_rw = ptr;
68559 +
68560 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
68561 + kmemleak_not_leak(ptr);
68562 + if (!ptr) {
68563 + module_free(mod, mod->module_init_rw);
68564 + module_free(mod, mod->module_core_rw);
68565 + return -ENOMEM;
68566 + }
68567 +
68568 + pax_open_kernel();
68569 + memset(ptr, 0, mod->core_size_rx);
68570 + pax_close_kernel();
68571 + mod->module_core_rx = ptr;
68572 +
68573 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
68574 + kmemleak_not_leak(ptr);
68575 + if (!ptr && mod->init_size_rx) {
68576 + module_free_exec(mod, mod->module_core_rx);
68577 + module_free(mod, mod->module_init_rw);
68578 + module_free(mod, mod->module_core_rw);
68579 + return -ENOMEM;
68580 + }
68581 +
68582 + pax_open_kernel();
68583 + memset(ptr, 0, mod->init_size_rx);
68584 + pax_close_kernel();
68585 + mod->module_init_rx = ptr;
68586
68587 /* Transfer each section which specifies SHF_ALLOC */
68588 DEBUGP("final section addresses:\n");
68589 @@ -2553,16 +2617,45 @@ static int move_module(struct module *mo
68590 if (!(shdr->sh_flags & SHF_ALLOC))
68591 continue;
68592
68593 - if (shdr->sh_entsize & INIT_OFFSET_MASK)
68594 - dest = mod->module_init
68595 - + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68596 - else
68597 - dest = mod->module_core + shdr->sh_entsize;
68598 + if (shdr->sh_entsize & INIT_OFFSET_MASK) {
68599 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68600 + dest = mod->module_init_rw
68601 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68602 + else
68603 + dest = mod->module_init_rx
68604 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68605 + } else {
68606 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68607 + dest = mod->module_core_rw + shdr->sh_entsize;
68608 + else
68609 + dest = mod->module_core_rx + shdr->sh_entsize;
68610 + }
68611 +
68612 + if (shdr->sh_type != SHT_NOBITS) {
68613 +
68614 +#ifdef CONFIG_PAX_KERNEXEC
68615 +#ifdef CONFIG_X86_64
68616 + if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
68617 + set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
68618 +#endif
68619 + if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
68620 + pax_open_kernel();
68621 + memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68622 + pax_close_kernel();
68623 + } else
68624 +#endif
68625
68626 - if (shdr->sh_type != SHT_NOBITS)
68627 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68628 + }
68629 /* Update sh_addr to point to copy in image. */
68630 - shdr->sh_addr = (unsigned long)dest;
68631 +
68632 +#ifdef CONFIG_PAX_KERNEXEC
68633 + if (shdr->sh_flags & SHF_EXECINSTR)
68634 + shdr->sh_addr = ktva_ktla((unsigned long)dest);
68635 + else
68636 +#endif
68637 +
68638 + shdr->sh_addr = (unsigned long)dest;
68639 DEBUGP("\t0x%lx %s\n",
68640 shdr->sh_addr, info->secstrings + shdr->sh_name);
68641 }
68642 @@ -2613,12 +2706,12 @@ static void flush_module_icache(const st
68643 * Do it before processing of module parameters, so the module
68644 * can provide parameter accessor functions of its own.
68645 */
68646 - if (mod->module_init)
68647 - flush_icache_range((unsigned long)mod->module_init,
68648 - (unsigned long)mod->module_init
68649 - + mod->init_size);
68650 - flush_icache_range((unsigned long)mod->module_core,
68651 - (unsigned long)mod->module_core + mod->core_size);
68652 + if (mod->module_init_rx)
68653 + flush_icache_range((unsigned long)mod->module_init_rx,
68654 + (unsigned long)mod->module_init_rx
68655 + + mod->init_size_rx);
68656 + flush_icache_range((unsigned long)mod->module_core_rx,
68657 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
68658
68659 set_fs(old_fs);
68660 }
68661 @@ -2690,8 +2783,10 @@ static void module_deallocate(struct mod
68662 {
68663 kfree(info->strmap);
68664 percpu_modfree(mod);
68665 - module_free(mod, mod->module_init);
68666 - module_free(mod, mod->module_core);
68667 + module_free_exec(mod, mod->module_init_rx);
68668 + module_free_exec(mod, mod->module_core_rx);
68669 + module_free(mod, mod->module_init_rw);
68670 + module_free(mod, mod->module_core_rw);
68671 }
68672
68673 static int post_relocation(struct module *mod, const struct load_info *info)
68674 @@ -2748,9 +2843,38 @@ static struct module *load_module(void _
68675 if (err)
68676 goto free_unload;
68677
68678 + /* Now copy in args */
68679 + mod->args = strndup_user(uargs, ~0UL >> 1);
68680 + if (IS_ERR(mod->args)) {
68681 + err = PTR_ERR(mod->args);
68682 + goto free_unload;
68683 + }
68684 +
68685 /* Set up MODINFO_ATTR fields */
68686 setup_modinfo(mod, &info);
68687
68688 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68689 + {
68690 + char *p, *p2;
68691 +
68692 + if (strstr(mod->args, "grsec_modharden_netdev")) {
68693 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
68694 + err = -EPERM;
68695 + goto free_modinfo;
68696 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
68697 + p += strlen("grsec_modharden_normal");
68698 + p2 = strstr(p, "_");
68699 + if (p2) {
68700 + *p2 = '\0';
68701 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
68702 + *p2 = '_';
68703 + }
68704 + err = -EPERM;
68705 + goto free_modinfo;
68706 + }
68707 + }
68708 +#endif
68709 +
68710 /* Fix up syms, so that st_value is a pointer to location. */
68711 err = simplify_symbols(mod, &info);
68712 if (err < 0)
68713 @@ -2766,13 +2890,6 @@ static struct module *load_module(void _
68714
68715 flush_module_icache(mod);
68716
68717 - /* Now copy in args */
68718 - mod->args = strndup_user(uargs, ~0UL >> 1);
68719 - if (IS_ERR(mod->args)) {
68720 - err = PTR_ERR(mod->args);
68721 - goto free_arch_cleanup;
68722 - }
68723 -
68724 /* Mark state as coming so strong_try_module_get() ignores us. */
68725 mod->state = MODULE_STATE_COMING;
68726
68727 @@ -2832,11 +2949,10 @@ static struct module *load_module(void _
68728 unlock:
68729 mutex_unlock(&module_mutex);
68730 synchronize_sched();
68731 - kfree(mod->args);
68732 - free_arch_cleanup:
68733 module_arch_cleanup(mod);
68734 free_modinfo:
68735 free_modinfo(mod);
68736 + kfree(mod->args);
68737 free_unload:
68738 module_unload_free(mod);
68739 free_module:
68740 @@ -2877,16 +2993,16 @@ SYSCALL_DEFINE3(init_module, void __user
68741 MODULE_STATE_COMING, mod);
68742
68743 /* Set RO and NX regions for core */
68744 - set_section_ro_nx(mod->module_core,
68745 - mod->core_text_size,
68746 - mod->core_ro_size,
68747 - mod->core_size);
68748 + set_section_ro_nx(mod->module_core_rx,
68749 + mod->core_size_rx,
68750 + mod->core_size_rx,
68751 + mod->core_size_rx);
68752
68753 /* Set RO and NX regions for init */
68754 - set_section_ro_nx(mod->module_init,
68755 - mod->init_text_size,
68756 - mod->init_ro_size,
68757 - mod->init_size);
68758 + set_section_ro_nx(mod->module_init_rx,
68759 + mod->init_size_rx,
68760 + mod->init_size_rx,
68761 + mod->init_size_rx);
68762
68763 do_mod_ctors(mod);
68764 /* Start the module */
68765 @@ -2931,11 +3047,13 @@ SYSCALL_DEFINE3(init_module, void __user
68766 mod->symtab = mod->core_symtab;
68767 mod->strtab = mod->core_strtab;
68768 #endif
68769 - unset_section_ro_nx(mod, mod->module_init);
68770 - module_free(mod, mod->module_init);
68771 - mod->module_init = NULL;
68772 - mod->init_size = 0;
68773 - mod->init_text_size = 0;
68774 + unset_section_ro_nx(mod, mod->module_init_rx);
68775 + module_free(mod, mod->module_init_rw);
68776 + module_free_exec(mod, mod->module_init_rx);
68777 + mod->module_init_rw = NULL;
68778 + mod->module_init_rx = NULL;
68779 + mod->init_size_rw = 0;
68780 + mod->init_size_rx = 0;
68781 mutex_unlock(&module_mutex);
68782
68783 return 0;
68784 @@ -2966,10 +3084,16 @@ static const char *get_ksymbol(struct mo
68785 unsigned long nextval;
68786
68787 /* At worse, next value is at end of module */
68788 - if (within_module_init(addr, mod))
68789 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
68790 + if (within_module_init_rx(addr, mod))
68791 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68792 + else if (within_module_init_rw(addr, mod))
68793 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68794 + else if (within_module_core_rx(addr, mod))
68795 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68796 + else if (within_module_core_rw(addr, mod))
68797 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68798 else
68799 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
68800 + return NULL;
68801
68802 /* Scan for closest preceding symbol, and next symbol. (ELF
68803 starts real symbols at 1). */
68804 @@ -3215,7 +3339,7 @@ static int m_show(struct seq_file *m, vo
68805 char buf[8];
68806
68807 seq_printf(m, "%s %u",
68808 - mod->name, mod->init_size + mod->core_size);
68809 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68810 print_unload_info(m, mod);
68811
68812 /* Informative for users. */
68813 @@ -3224,7 +3348,7 @@ static int m_show(struct seq_file *m, vo
68814 mod->state == MODULE_STATE_COMING ? "Loading":
68815 "Live");
68816 /* Used by oprofile and other similar tools. */
68817 - seq_printf(m, " 0x%pK", mod->module_core);
68818 + seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
68819
68820 /* Taints info */
68821 if (mod->taints)
68822 @@ -3260,7 +3384,17 @@ static const struct file_operations proc
68823
68824 static int __init proc_modules_init(void)
68825 {
68826 +#ifndef CONFIG_GRKERNSEC_HIDESYM
68827 +#ifdef CONFIG_GRKERNSEC_PROC_USER
68828 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68829 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68830 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
68831 +#else
68832 proc_create("modules", 0, NULL, &proc_modules_operations);
68833 +#endif
68834 +#else
68835 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68836 +#endif
68837 return 0;
68838 }
68839 module_init(proc_modules_init);
68840 @@ -3319,12 +3453,12 @@ struct module *__module_address(unsigned
68841 {
68842 struct module *mod;
68843
68844 - if (addr < module_addr_min || addr > module_addr_max)
68845 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
68846 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
68847 return NULL;
68848
68849 list_for_each_entry_rcu(mod, &modules, list)
68850 - if (within_module_core(addr, mod)
68851 - || within_module_init(addr, mod))
68852 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
68853 return mod;
68854 return NULL;
68855 }
68856 @@ -3358,11 +3492,20 @@ bool is_module_text_address(unsigned lon
68857 */
68858 struct module *__module_text_address(unsigned long addr)
68859 {
68860 - struct module *mod = __module_address(addr);
68861 + struct module *mod;
68862 +
68863 +#ifdef CONFIG_X86_32
68864 + addr = ktla_ktva(addr);
68865 +#endif
68866 +
68867 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
68868 + return NULL;
68869 +
68870 + mod = __module_address(addr);
68871 +
68872 if (mod) {
68873 /* Make sure it's within the text section. */
68874 - if (!within(addr, mod->module_init, mod->init_text_size)
68875 - && !within(addr, mod->module_core, mod->core_text_size))
68876 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
68877 mod = NULL;
68878 }
68879 return mod;
68880 diff -urNp linux-2.6.39.1/kernel/mutex.c linux-2.6.39.1/kernel/mutex.c
68881 --- linux-2.6.39.1/kernel/mutex.c 2011-05-19 00:06:34.000000000 -0400
68882 +++ linux-2.6.39.1/kernel/mutex.c 2011-05-22 19:36:33.000000000 -0400
68883 @@ -160,7 +160,7 @@ __mutex_lock_common(struct mutex *lock,
68884 */
68885
68886 for (;;) {
68887 - struct thread_info *owner;
68888 + struct task_struct *owner;
68889
68890 /*
68891 * If we own the BKL, then don't spin. The owner of
68892 @@ -205,7 +205,7 @@ __mutex_lock_common(struct mutex *lock,
68893 spin_lock_mutex(&lock->wait_lock, flags);
68894
68895 debug_mutex_lock_common(lock, &waiter);
68896 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
68897 + debug_mutex_add_waiter(lock, &waiter, task);
68898
68899 /* add waiting tasks to the end of the waitqueue (FIFO): */
68900 list_add_tail(&waiter.list, &lock->wait_list);
68901 @@ -234,8 +234,7 @@ __mutex_lock_common(struct mutex *lock,
68902 * TASK_UNINTERRUPTIBLE case.)
68903 */
68904 if (unlikely(signal_pending_state(state, task))) {
68905 - mutex_remove_waiter(lock, &waiter,
68906 - task_thread_info(task));
68907 + mutex_remove_waiter(lock, &waiter, task);
68908 mutex_release(&lock->dep_map, 1, ip);
68909 spin_unlock_mutex(&lock->wait_lock, flags);
68910
68911 @@ -256,7 +255,7 @@ __mutex_lock_common(struct mutex *lock,
68912 done:
68913 lock_acquired(&lock->dep_map, ip);
68914 /* got the lock - rejoice! */
68915 - mutex_remove_waiter(lock, &waiter, current_thread_info());
68916 + mutex_remove_waiter(lock, &waiter, task);
68917 mutex_set_owner(lock);
68918
68919 /* set it to 0 if there are no waiters left: */
68920 diff -urNp linux-2.6.39.1/kernel/mutex-debug.c linux-2.6.39.1/kernel/mutex-debug.c
68921 --- linux-2.6.39.1/kernel/mutex-debug.c 2011-05-19 00:06:34.000000000 -0400
68922 +++ linux-2.6.39.1/kernel/mutex-debug.c 2011-05-22 19:36:33.000000000 -0400
68923 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
68924 }
68925
68926 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68927 - struct thread_info *ti)
68928 + struct task_struct *task)
68929 {
68930 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
68931
68932 /* Mark the current thread as blocked on the lock: */
68933 - ti->task->blocked_on = waiter;
68934 + task->blocked_on = waiter;
68935 }
68936
68937 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68938 - struct thread_info *ti)
68939 + struct task_struct *task)
68940 {
68941 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
68942 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
68943 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
68944 - ti->task->blocked_on = NULL;
68945 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
68946 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
68947 + task->blocked_on = NULL;
68948
68949 list_del_init(&waiter->list);
68950 waiter->task = NULL;
68951 @@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
68952 return;
68953
68954 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
68955 - DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
68956 + DEBUG_LOCKS_WARN_ON(lock->owner != current);
68957 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
68958 mutex_clear_owner(lock);
68959 }
68960 diff -urNp linux-2.6.39.1/kernel/mutex-debug.h linux-2.6.39.1/kernel/mutex-debug.h
68961 --- linux-2.6.39.1/kernel/mutex-debug.h 2011-05-19 00:06:34.000000000 -0400
68962 +++ linux-2.6.39.1/kernel/mutex-debug.h 2011-05-22 19:36:33.000000000 -0400
68963 @@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
68964 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
68965 extern void debug_mutex_add_waiter(struct mutex *lock,
68966 struct mutex_waiter *waiter,
68967 - struct thread_info *ti);
68968 + struct task_struct *task);
68969 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68970 - struct thread_info *ti);
68971 + struct task_struct *task);
68972 extern void debug_mutex_unlock(struct mutex *lock);
68973 extern void debug_mutex_init(struct mutex *lock, const char *name,
68974 struct lock_class_key *key);
68975
68976 static inline void mutex_set_owner(struct mutex *lock)
68977 {
68978 - lock->owner = current_thread_info();
68979 + lock->owner = current;
68980 }
68981
68982 static inline void mutex_clear_owner(struct mutex *lock)
68983 diff -urNp linux-2.6.39.1/kernel/mutex.h linux-2.6.39.1/kernel/mutex.h
68984 --- linux-2.6.39.1/kernel/mutex.h 2011-05-19 00:06:34.000000000 -0400
68985 +++ linux-2.6.39.1/kernel/mutex.h 2011-05-22 19:36:33.000000000 -0400
68986 @@ -19,7 +19,7 @@
68987 #ifdef CONFIG_SMP
68988 static inline void mutex_set_owner(struct mutex *lock)
68989 {
68990 - lock->owner = current_thread_info();
68991 + lock->owner = current;
68992 }
68993
68994 static inline void mutex_clear_owner(struct mutex *lock)
68995 diff -urNp linux-2.6.39.1/kernel/padata.c linux-2.6.39.1/kernel/padata.c
68996 --- linux-2.6.39.1/kernel/padata.c 2011-05-19 00:06:34.000000000 -0400
68997 +++ linux-2.6.39.1/kernel/padata.c 2011-05-22 19:36:33.000000000 -0400
68998 @@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
68999 padata->pd = pd;
69000 padata->cb_cpu = cb_cpu;
69001
69002 - if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
69003 - atomic_set(&pd->seq_nr, -1);
69004 + if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
69005 + atomic_set_unchecked(&pd->seq_nr, -1);
69006
69007 - padata->seq_nr = atomic_inc_return(&pd->seq_nr);
69008 + padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
69009
69010 target_cpu = padata_cpu_hash(padata);
69011 queue = per_cpu_ptr(pd->pqueue, target_cpu);
69012 @@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
69013 padata_init_pqueues(pd);
69014 padata_init_squeues(pd);
69015 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
69016 - atomic_set(&pd->seq_nr, -1);
69017 + atomic_set_unchecked(&pd->seq_nr, -1);
69018 atomic_set(&pd->reorder_objects, 0);
69019 atomic_set(&pd->refcnt, 0);
69020 pd->pinst = pinst;
69021 diff -urNp linux-2.6.39.1/kernel/panic.c linux-2.6.39.1/kernel/panic.c
69022 --- linux-2.6.39.1/kernel/panic.c 2011-05-19 00:06:34.000000000 -0400
69023 +++ linux-2.6.39.1/kernel/panic.c 2011-05-22 19:41:42.000000000 -0400
69024 @@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
69025 const char *board;
69026
69027 printk(KERN_WARNING "------------[ cut here ]------------\n");
69028 - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
69029 + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
69030 board = dmi_get_system_info(DMI_PRODUCT_NAME);
69031 if (board)
69032 printk(KERN_WARNING "Hardware name: %s\n", board);
69033 @@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
69034 */
69035 void __stack_chk_fail(void)
69036 {
69037 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
69038 + dump_stack();
69039 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
69040 __builtin_return_address(0));
69041 }
69042 EXPORT_SYMBOL(__stack_chk_fail);
69043 diff -urNp linux-2.6.39.1/kernel/params.c linux-2.6.39.1/kernel/params.c
69044 --- linux-2.6.39.1/kernel/params.c 2011-05-19 00:06:34.000000000 -0400
69045 +++ linux-2.6.39.1/kernel/params.c 2011-05-22 19:36:33.000000000 -0400
69046 @@ -234,7 +234,7 @@ int parse_args(const char *name,
69047 { \
69048 return sprintf(buffer, format, *((type *)kp->arg)); \
69049 } \
69050 - struct kernel_param_ops param_ops_##name = { \
69051 + const struct kernel_param_ops param_ops_##name = { \
69052 .set = param_set_##name, \
69053 .get = param_get_##name, \
69054 }; \
69055 @@ -286,7 +286,7 @@ static void param_free_charp(void *arg)
69056 maybe_kfree_parameter(*((char **)arg));
69057 }
69058
69059 -struct kernel_param_ops param_ops_charp = {
69060 +const struct kernel_param_ops param_ops_charp = {
69061 .set = param_set_charp,
69062 .get = param_get_charp,
69063 .free = param_free_charp,
69064 @@ -334,7 +334,7 @@ int param_get_bool(char *buffer, const s
69065 }
69066 EXPORT_SYMBOL(param_get_bool);
69067
69068 -struct kernel_param_ops param_ops_bool = {
69069 +const struct kernel_param_ops param_ops_bool = {
69070 .set = param_set_bool,
69071 .get = param_get_bool,
69072 };
69073 @@ -362,7 +362,7 @@ int param_get_invbool(char *buffer, cons
69074 }
69075 EXPORT_SYMBOL(param_get_invbool);
69076
69077 -struct kernel_param_ops param_ops_invbool = {
69078 +const struct kernel_param_ops param_ops_invbool = {
69079 .set = param_set_invbool,
69080 .get = param_get_invbool,
69081 };
69082 @@ -460,7 +460,7 @@ static void param_array_free(void *arg)
69083 arr->ops->free(arr->elem + arr->elemsize * i);
69084 }
69085
69086 -struct kernel_param_ops param_array_ops = {
69087 +const struct kernel_param_ops param_array_ops = {
69088 .set = param_array_set,
69089 .get = param_array_get,
69090 .free = param_array_free,
69091 @@ -488,7 +488,7 @@ int param_get_string(char *buffer, const
69092 }
69093 EXPORT_SYMBOL(param_get_string);
69094
69095 -struct kernel_param_ops param_ops_string = {
69096 +const struct kernel_param_ops param_ops_string = {
69097 .set = param_set_copystring,
69098 .get = param_get_string,
69099 };
69100 diff -urNp linux-2.6.39.1/kernel/perf_event.c linux-2.6.39.1/kernel/perf_event.c
69101 --- linux-2.6.39.1/kernel/perf_event.c 2011-05-19 00:06:34.000000000 -0400
69102 +++ linux-2.6.39.1/kernel/perf_event.c 2011-05-22 19:36:33.000000000 -0400
69103 @@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_
69104 return 0;
69105 }
69106
69107 -static atomic64_t perf_event_id;
69108 +static atomic64_unchecked_t perf_event_id;
69109
69110 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
69111 enum event_type_t event_type);
69112 @@ -2496,7 +2496,7 @@ static void __perf_event_read(void *info
69113
69114 static inline u64 perf_event_count(struct perf_event *event)
69115 {
69116 - return local64_read(&event->count) + atomic64_read(&event->child_count);
69117 + return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
69118 }
69119
69120 static u64 perf_event_read(struct perf_event *event)
69121 @@ -3031,9 +3031,9 @@ u64 perf_event_read_value(struct perf_ev
69122 mutex_lock(&event->child_mutex);
69123 total += perf_event_read(event);
69124 *enabled += event->total_time_enabled +
69125 - atomic64_read(&event->child_total_time_enabled);
69126 + atomic64_read_unchecked(&event->child_total_time_enabled);
69127 *running += event->total_time_running +
69128 - atomic64_read(&event->child_total_time_running);
69129 + atomic64_read_unchecked(&event->child_total_time_running);
69130
69131 list_for_each_entry(child, &event->child_list, child_list) {
69132 total += perf_event_read(child);
69133 @@ -3396,10 +3396,10 @@ void perf_event_update_userpage(struct p
69134 userpg->offset -= local64_read(&event->hw.prev_count);
69135
69136 userpg->time_enabled = event->total_time_enabled +
69137 - atomic64_read(&event->child_total_time_enabled);
69138 + atomic64_read_unchecked(&event->child_total_time_enabled);
69139
69140 userpg->time_running = event->total_time_running +
69141 - atomic64_read(&event->child_total_time_running);
69142 + atomic64_read_unchecked(&event->child_total_time_running);
69143
69144 barrier();
69145 ++userpg->lock;
69146 @@ -3884,16 +3884,16 @@ static void perf_pending_event(struct ir
69147 * Later on, we might change it to a list if there is
69148 * another virtualization implementation supporting the callbacks.
69149 */
69150 -struct perf_guest_info_callbacks *perf_guest_cbs;
69151 +const struct perf_guest_info_callbacks *perf_guest_cbs;
69152
69153 -int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
69154 +int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
69155 {
69156 perf_guest_cbs = cbs;
69157 return 0;
69158 }
69159 EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks);
69160
69161 -int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
69162 +int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
69163 {
69164 perf_guest_cbs = NULL;
69165 return 0;
69166 @@ -4196,11 +4196,11 @@ static void perf_output_read_one(struct
69167 values[n++] = perf_event_count(event);
69168 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
69169 values[n++] = enabled +
69170 - atomic64_read(&event->child_total_time_enabled);
69171 + atomic64_read_unchecked(&event->child_total_time_enabled);
69172 }
69173 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
69174 values[n++] = running +
69175 - atomic64_read(&event->child_total_time_running);
69176 + atomic64_read_unchecked(&event->child_total_time_running);
69177 }
69178 if (read_format & PERF_FORMAT_ID)
69179 values[n++] = primary_event_id(event);
69180 @@ -6201,7 +6201,7 @@ perf_event_alloc(struct perf_event_attr
69181 event->parent = parent_event;
69182
69183 event->ns = get_pid_ns(current->nsproxy->pid_ns);
69184 - event->id = atomic64_inc_return(&perf_event_id);
69185 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
69186
69187 event->state = PERF_EVENT_STATE_INACTIVE;
69188
69189 @@ -6724,10 +6724,10 @@ static void sync_child_event(struct perf
69190 /*
69191 * Add back the child's count to the parent's count:
69192 */
69193 - atomic64_add(child_val, &parent_event->child_count);
69194 - atomic64_add(child_event->total_time_enabled,
69195 + atomic64_add_unchecked(child_val, &parent_event->child_count);
69196 + atomic64_add_unchecked(child_event->total_time_enabled,
69197 &parent_event->child_total_time_enabled);
69198 - atomic64_add(child_event->total_time_running,
69199 + atomic64_add_unchecked(child_event->total_time_running,
69200 &parent_event->child_total_time_running);
69201
69202 /*
69203 diff -urNp linux-2.6.39.1/kernel/pid.c linux-2.6.39.1/kernel/pid.c
69204 --- linux-2.6.39.1/kernel/pid.c 2011-05-19 00:06:34.000000000 -0400
69205 +++ linux-2.6.39.1/kernel/pid.c 2011-05-22 19:41:42.000000000 -0400
69206 @@ -33,6 +33,7 @@
69207 #include <linux/rculist.h>
69208 #include <linux/bootmem.h>
69209 #include <linux/hash.h>
69210 +#include <linux/security.h>
69211 #include <linux/pid_namespace.h>
69212 #include <linux/init_task.h>
69213 #include <linux/syscalls.h>
69214 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
69215
69216 int pid_max = PID_MAX_DEFAULT;
69217
69218 -#define RESERVED_PIDS 300
69219 +#define RESERVED_PIDS 500
69220
69221 int pid_max_min = RESERVED_PIDS + 1;
69222 int pid_max_max = PID_MAX_LIMIT;
69223 @@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
69224 */
69225 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
69226 {
69227 + struct task_struct *task;
69228 +
69229 rcu_lockdep_assert(rcu_read_lock_held());
69230 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69231 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69232 +
69233 + if (gr_pid_is_chrooted(task))
69234 + return NULL;
69235 +
69236 + return task;
69237 }
69238
69239 struct task_struct *find_task_by_vpid(pid_t vnr)
69240 diff -urNp linux-2.6.39.1/kernel/posix-cpu-timers.c linux-2.6.39.1/kernel/posix-cpu-timers.c
69241 --- linux-2.6.39.1/kernel/posix-cpu-timers.c 2011-05-19 00:06:34.000000000 -0400
69242 +++ linux-2.6.39.1/kernel/posix-cpu-timers.c 2011-05-22 19:41:42.000000000 -0400
69243 @@ -6,6 +6,7 @@
69244 #include <linux/posix-timers.h>
69245 #include <linux/errno.h>
69246 #include <linux/math64.h>
69247 +#include <linux/security.h>
69248 #include <asm/uaccess.h>
69249 #include <linux/kernel_stat.h>
69250 #include <trace/events/timer.h>
69251 @@ -1590,7 +1591,7 @@ static int thread_cpu_timer_create(struc
69252 return posix_cpu_timer_create(timer);
69253 }
69254
69255 -struct k_clock clock_posix_cpu = {
69256 +const struct k_clock clock_posix_cpu = {
69257 .clock_getres = posix_cpu_clock_getres,
69258 .clock_set = posix_cpu_clock_set,
69259 .clock_get = posix_cpu_clock_get,
69260 @@ -1604,14 +1605,14 @@ struct k_clock clock_posix_cpu = {
69261
69262 static __init int init_posix_cpu_timers(void)
69263 {
69264 - struct k_clock process = {
69265 + const struct k_clock process = {
69266 .clock_getres = process_cpu_clock_getres,
69267 .clock_get = process_cpu_clock_get,
69268 .timer_create = process_cpu_timer_create,
69269 .nsleep = process_cpu_nsleep,
69270 .nsleep_restart = process_cpu_nsleep_restart,
69271 };
69272 - struct k_clock thread = {
69273 + const struct k_clock thread = {
69274 .clock_getres = thread_cpu_clock_getres,
69275 .clock_get = thread_cpu_clock_get,
69276 .timer_create = thread_cpu_timer_create,
69277 diff -urNp linux-2.6.39.1/kernel/posix-timers.c linux-2.6.39.1/kernel/posix-timers.c
69278 --- linux-2.6.39.1/kernel/posix-timers.c 2011-05-19 00:06:34.000000000 -0400
69279 +++ linux-2.6.39.1/kernel/posix-timers.c 2011-05-22 20:13:41.000000000 -0400
69280 @@ -43,6 +43,7 @@
69281 #include <linux/idr.h>
69282 #include <linux/posix-clock.h>
69283 #include <linux/posix-timers.h>
69284 +#include <linux/grsecurity.h>
69285 #include <linux/syscalls.h>
69286 #include <linux/wait.h>
69287 #include <linux/workqueue.h>
69288 @@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc
69289 */
69290 static __init int init_posix_timers(void)
69291 {
69292 - struct k_clock clock_realtime = {
69293 + const struct k_clock clock_realtime = {
69294 .clock_getres = hrtimer_get_res,
69295 .clock_get = posix_clock_realtime_get,
69296 .clock_set = posix_clock_realtime_set,
69297 @@ -239,7 +240,7 @@ static __init int init_posix_timers(void
69298 .timer_get = common_timer_get,
69299 .timer_del = common_timer_del,
69300 };
69301 - struct k_clock clock_monotonic = {
69302 + const struct k_clock clock_monotonic = {
69303 .clock_getres = hrtimer_get_res,
69304 .clock_get = posix_ktime_get_ts,
69305 .nsleep = common_nsleep,
69306 @@ -249,19 +250,19 @@ static __init int init_posix_timers(void
69307 .timer_get = common_timer_get,
69308 .timer_del = common_timer_del,
69309 };
69310 - struct k_clock clock_monotonic_raw = {
69311 + const struct k_clock clock_monotonic_raw = {
69312 .clock_getres = hrtimer_get_res,
69313 .clock_get = posix_get_monotonic_raw,
69314 };
69315 - struct k_clock clock_realtime_coarse = {
69316 + const struct k_clock clock_realtime_coarse = {
69317 .clock_getres = posix_get_coarse_res,
69318 .clock_get = posix_get_realtime_coarse,
69319 };
69320 - struct k_clock clock_monotonic_coarse = {
69321 + const struct k_clock clock_monotonic_coarse = {
69322 .clock_getres = posix_get_coarse_res,
69323 .clock_get = posix_get_monotonic_coarse,
69324 };
69325 - struct k_clock clock_boottime = {
69326 + const struct k_clock clock_boottime = {
69327 .clock_getres = hrtimer_get_res,
69328 .clock_get = posix_get_boottime,
69329 .nsleep = common_nsleep,
69330 @@ -272,6 +273,8 @@ static __init int init_posix_timers(void
69331 .timer_del = common_timer_del,
69332 };
69333
69334 + pax_track_stack();
69335 +
69336 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
69337 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
69338 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
69339 @@ -454,7 +457,7 @@ static struct pid *good_sigevent(sigeven
69340 }
69341
69342 void posix_timers_register_clock(const clockid_t clock_id,
69343 - struct k_clock *new_clock)
69344 + const struct k_clock *new_clock)
69345 {
69346 if ((unsigned) clock_id >= MAX_CLOCKS) {
69347 printk(KERN_WARNING "POSIX clock register failed for clock_id %d\n",
69348 @@ -506,7 +509,7 @@ static void release_posix_timer(struct k
69349 kmem_cache_free(posix_timers_cache, tmr);
69350 }
69351
69352 -static struct k_clock *clockid_to_kclock(const clockid_t id)
69353 +static const struct k_clock *clockid_to_kclock(const clockid_t id)
69354 {
69355 if (id < 0)
69356 return (id & CLOCKFD_MASK) == CLOCKFD ?
69357 @@ -529,7 +532,7 @@ SYSCALL_DEFINE3(timer_create, const cloc
69358 struct sigevent __user *, timer_event_spec,
69359 timer_t __user *, created_timer_id)
69360 {
69361 - struct k_clock *kc = clockid_to_kclock(which_clock);
69362 + const struct k_clock *kc = clockid_to_kclock(which_clock);
69363 struct k_itimer *new_timer;
69364 int error, new_timer_id;
69365 sigevent_t event;
69366 @@ -714,7 +717,7 @@ SYSCALL_DEFINE2(timer_gettime, timer_t,
69367 {
69368 struct itimerspec cur_setting;
69369 struct k_itimer *timr;
69370 - struct k_clock *kc;
69371 + const struct k_clock *kc;
69372 unsigned long flags;
69373 int ret = 0;
69374
69375 @@ -822,7 +825,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t,
69376 int error = 0;
69377 unsigned long flag;
69378 struct itimerspec *rtn = old_setting ? &old_spec : NULL;
69379 - struct k_clock *kc;
69380 + const struct k_clock *kc;
69381
69382 if (!new_setting)
69383 return -EINVAL;
69384 @@ -868,7 +871,7 @@ static int common_timer_del(struct k_iti
69385
69386 static inline int timer_delete_hook(struct k_itimer *timer)
69387 {
69388 - struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69389 + const struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69390
69391 if (WARN_ON_ONCE(!kc || !kc->timer_del))
69392 return -EINVAL;
69393 @@ -947,7 +950,7 @@ void exit_itimers(struct signal_struct *
69394 SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
69395 const struct timespec __user *, tp)
69396 {
69397 - struct k_clock *kc = clockid_to_kclock(which_clock);
69398 + const struct k_clock *kc = clockid_to_kclock(which_clock);
69399 struct timespec new_tp;
69400
69401 if (!kc || !kc->clock_set)
69402 @@ -956,13 +959,20 @@ SYSCALL_DEFINE2(clock_settime, const clo
69403 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
69404 return -EFAULT;
69405
69406 + /* only the CLOCK_REALTIME clock can be set, all other clocks
69407 + have their clock_set fptr set to a nosettime dummy function
69408 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
69409 + call common_clock_set, which calls do_sys_settimeofday, which
69410 + we hook
69411 + */
69412 +
69413 return kc->clock_set(which_clock, &new_tp);
69414 }
69415
69416 SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
69417 struct timespec __user *,tp)
69418 {
69419 - struct k_clock *kc = clockid_to_kclock(which_clock);
69420 + const struct k_clock *kc = clockid_to_kclock(which_clock);
69421 struct timespec kernel_tp;
69422 int error;
69423
69424 @@ -980,7 +990,7 @@ SYSCALL_DEFINE2(clock_gettime, const clo
69425 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
69426 struct timex __user *, utx)
69427 {
69428 - struct k_clock *kc = clockid_to_kclock(which_clock);
69429 + const struct k_clock *kc = clockid_to_kclock(which_clock);
69430 struct timex ktx;
69431 int err;
69432
69433 @@ -1003,7 +1013,7 @@ SYSCALL_DEFINE2(clock_adjtime, const clo
69434 SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
69435 struct timespec __user *, tp)
69436 {
69437 - struct k_clock *kc = clockid_to_kclock(which_clock);
69438 + const struct k_clock *kc = clockid_to_kclock(which_clock);
69439 struct timespec rtn_tp;
69440 int error;
69441
69442 @@ -1033,7 +1043,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69443 const struct timespec __user *, rqtp,
69444 struct timespec __user *, rmtp)
69445 {
69446 - struct k_clock *kc = clockid_to_kclock(which_clock);
69447 + const struct k_clock *kc = clockid_to_kclock(which_clock);
69448 struct timespec t;
69449
69450 if (!kc)
69451 @@ -1057,7 +1067,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69452 long clock_nanosleep_restart(struct restart_block *restart_block)
69453 {
69454 clockid_t which_clock = restart_block->nanosleep.index;
69455 - struct k_clock *kc = clockid_to_kclock(which_clock);
69456 + const struct k_clock *kc = clockid_to_kclock(which_clock);
69457
69458 if (WARN_ON_ONCE(!kc || !kc->nsleep_restart))
69459 return -EINVAL;
69460 diff -urNp linux-2.6.39.1/kernel/power/poweroff.c linux-2.6.39.1/kernel/power/poweroff.c
69461 --- linux-2.6.39.1/kernel/power/poweroff.c 2011-05-19 00:06:34.000000000 -0400
69462 +++ linux-2.6.39.1/kernel/power/poweroff.c 2011-05-22 19:36:33.000000000 -0400
69463 @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
69464 .enable_mask = SYSRQ_ENABLE_BOOT,
69465 };
69466
69467 -static int pm_sysrq_init(void)
69468 +static int __init pm_sysrq_init(void)
69469 {
69470 register_sysrq_key('o', &sysrq_poweroff_op);
69471 return 0;
69472 diff -urNp linux-2.6.39.1/kernel/power/process.c linux-2.6.39.1/kernel/power/process.c
69473 --- linux-2.6.39.1/kernel/power/process.c 2011-05-19 00:06:34.000000000 -0400
69474 +++ linux-2.6.39.1/kernel/power/process.c 2011-05-22 19:36:33.000000000 -0400
69475 @@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
69476 u64 elapsed_csecs64;
69477 unsigned int elapsed_csecs;
69478 bool wakeup = false;
69479 + bool timedout = false;
69480
69481 do_gettimeofday(&start);
69482
69483 @@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_
69484
69485 while (true) {
69486 todo = 0;
69487 + if (time_after(jiffies, end_time))
69488 + timedout = true;
69489 read_lock(&tasklist_lock);
69490 do_each_thread(g, p) {
69491 if (frozen(p) || !freezable(p))
69492 @@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_
69493 * try_to_stop() after schedule() in ptrace/signal
69494 * stop sees TIF_FREEZE.
69495 */
69496 - if (!task_is_stopped_or_traced(p) &&
69497 - !freezer_should_skip(p))
69498 + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
69499 todo++;
69500 + if (timedout) {
69501 + printk(KERN_ERR "Task refusing to freeze:\n");
69502 + sched_show_task(p);
69503 + }
69504 + }
69505 } while_each_thread(g, p);
69506 read_unlock(&tasklist_lock);
69507
69508 @@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_
69509 todo += wq_busy;
69510 }
69511
69512 - if (!todo || time_after(jiffies, end_time))
69513 + if (!todo || timedout)
69514 break;
69515
69516 if (pm_wakeup_pending()) {
69517 diff -urNp linux-2.6.39.1/kernel/printk.c linux-2.6.39.1/kernel/printk.c
69518 --- linux-2.6.39.1/kernel/printk.c 2011-05-19 00:06:34.000000000 -0400
69519 +++ linux-2.6.39.1/kernel/printk.c 2011-05-22 19:41:42.000000000 -0400
69520 @@ -284,12 +284,17 @@ static int check_syslog_permissions(int
69521 if (from_file && type != SYSLOG_ACTION_OPEN)
69522 return 0;
69523
69524 +#ifdef CONFIG_GRKERNSEC_DMESG
69525 + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
69526 + return -EPERM;
69527 +#endif
69528 +
69529 if (syslog_action_restricted(type)) {
69530 if (capable(CAP_SYSLOG))
69531 return 0;
69532 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
69533 if (capable(CAP_SYS_ADMIN)) {
69534 - WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
69535 + printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN "
69536 "but no CAP_SYSLOG (deprecated).\n");
69537 return 0;
69538 }
69539 diff -urNp linux-2.6.39.1/kernel/profile.c linux-2.6.39.1/kernel/profile.c
69540 --- linux-2.6.39.1/kernel/profile.c 2011-05-19 00:06:34.000000000 -0400
69541 +++ linux-2.6.39.1/kernel/profile.c 2011-05-22 19:36:33.000000000 -0400
69542 @@ -39,7 +39,7 @@ struct profile_hit {
69543 /* Oprofile timer tick hook */
69544 static int (*timer_hook)(struct pt_regs *) __read_mostly;
69545
69546 -static atomic_t *prof_buffer;
69547 +static atomic_unchecked_t *prof_buffer;
69548 static unsigned long prof_len, prof_shift;
69549
69550 int prof_on __read_mostly;
69551 @@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
69552 hits[i].pc = 0;
69553 continue;
69554 }
69555 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69556 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69557 hits[i].hits = hits[i].pc = 0;
69558 }
69559 }
69560 @@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
69561 * Add the current hit(s) and flush the write-queue out
69562 * to the global buffer:
69563 */
69564 - atomic_add(nr_hits, &prof_buffer[pc]);
69565 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
69566 for (i = 0; i < NR_PROFILE_HIT; ++i) {
69567 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69568 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69569 hits[i].pc = hits[i].hits = 0;
69570 }
69571 out:
69572 @@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
69573 if (prof_on != type || !prof_buffer)
69574 return;
69575 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
69576 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69577 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69578 }
69579 #endif /* !CONFIG_SMP */
69580 EXPORT_SYMBOL_GPL(profile_hits);
69581 @@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
69582 return -EFAULT;
69583 buf++; p++; count--; read++;
69584 }
69585 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
69586 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
69587 if (copy_to_user(buf, (void *)pnt, count))
69588 return -EFAULT;
69589 read += count;
69590 @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
69591 }
69592 #endif
69593 profile_discard_flip_buffers();
69594 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
69595 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
69596 return count;
69597 }
69598
69599 diff -urNp linux-2.6.39.1/kernel/ptrace.c linux-2.6.39.1/kernel/ptrace.c
69600 --- linux-2.6.39.1/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
69601 +++ linux-2.6.39.1/kernel/ptrace.c 2011-05-23 17:07:00.000000000 -0400
69602 @@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
69603 return ret;
69604 }
69605
69606 -int __ptrace_may_access(struct task_struct *task, unsigned int mode)
69607 +static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
69608 + unsigned int log)
69609 {
69610 const struct cred *cred = current_cred(), *tcred;
69611
69612 @@ -143,7 +144,8 @@ int __ptrace_may_access(struct task_stru
69613 cred->gid == tcred->sgid &&
69614 cred->gid == tcred->gid))
69615 goto ok;
69616 - if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
69617 + if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
69618 + (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
69619 goto ok;
69620 rcu_read_unlock();
69621 return -EPERM;
69622 @@ -152,7 +154,9 @@ ok:
69623 smp_rmb();
69624 if (task->mm)
69625 dumpable = get_dumpable(task->mm);
69626 - if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
69627 + if (!dumpable &&
69628 + ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
69629 + (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
69630 return -EPERM;
69631
69632 return security_ptrace_access_check(task, mode);
69633 @@ -162,7 +166,16 @@ bool ptrace_may_access(struct task_struc
69634 {
69635 int err;
69636 task_lock(task);
69637 - err = __ptrace_may_access(task, mode);
69638 + err = __ptrace_may_access(task, mode, 0);
69639 + task_unlock(task);
69640 + return !err;
69641 +}
69642 +
69643 +bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
69644 +{
69645 + int err;
69646 + task_lock(task);
69647 + err = __ptrace_may_access(task, mode, 1);
69648 task_unlock(task);
69649 return !err;
69650 }
69651 @@ -189,7 +202,7 @@ static int ptrace_attach(struct task_str
69652 goto out;
69653
69654 task_lock(task);
69655 - retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
69656 + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
69657 task_unlock(task);
69658 if (retval)
69659 goto unlock_creds;
69660 @@ -202,7 +215,7 @@ static int ptrace_attach(struct task_str
69661 goto unlock_tasklist;
69662
69663 task->ptrace = PT_PTRACED;
69664 - if (task_ns_capable(task, CAP_SYS_PTRACE))
69665 + if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
69666 task->ptrace |= PT_PTRACE_CAP;
69667
69668 __ptrace_link(task, current);
69669 @@ -362,6 +375,8 @@ int ptrace_readdata(struct task_struct *
69670 {
69671 int copied = 0;
69672
69673 + pax_track_stack();
69674 +
69675 while (len > 0) {
69676 char buf[128];
69677 int this_len, retval;
69678 @@ -373,7 +388,7 @@ int ptrace_readdata(struct task_struct *
69679 break;
69680 return -EIO;
69681 }
69682 - if (copy_to_user(dst, buf, retval))
69683 + if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
69684 return -EFAULT;
69685 copied += retval;
69686 src += retval;
69687 @@ -387,6 +402,8 @@ int ptrace_writedata(struct task_struct
69688 {
69689 int copied = 0;
69690
69691 + pax_track_stack();
69692 +
69693 while (len > 0) {
69694 char buf[128];
69695 int this_len, retval;
69696 @@ -569,9 +586,11 @@ int ptrace_request(struct task_struct *c
69697 {
69698 int ret = -EIO;
69699 siginfo_t siginfo;
69700 - void __user *datavp = (void __user *) data;
69701 + void __user *datavp = (__force void __user *) data;
69702 unsigned long __user *datalp = datavp;
69703
69704 + pax_track_stack();
69705 +
69706 switch (request) {
69707 case PTRACE_PEEKTEXT:
69708 case PTRACE_PEEKDATA:
69709 @@ -717,14 +736,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
69710 goto out;
69711 }
69712
69713 + if (gr_handle_ptrace(child, request)) {
69714 + ret = -EPERM;
69715 + goto out_put_task_struct;
69716 + }
69717 +
69718 if (request == PTRACE_ATTACH) {
69719 ret = ptrace_attach(child);
69720 /*
69721 * Some architectures need to do book-keeping after
69722 * a ptrace attach.
69723 */
69724 - if (!ret)
69725 + if (!ret) {
69726 arch_ptrace_attach(child);
69727 + gr_audit_ptrace(child);
69728 + }
69729 goto out_put_task_struct;
69730 }
69731
69732 @@ -749,7 +775,7 @@ int generic_ptrace_peekdata(struct task_
69733 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
69734 if (copied != sizeof(tmp))
69735 return -EIO;
69736 - return put_user(tmp, (unsigned long __user *)data);
69737 + return put_user(tmp, (__force unsigned long __user *)data);
69738 }
69739
69740 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
69741 @@ -772,6 +798,8 @@ int compat_ptrace_request(struct task_st
69742 siginfo_t siginfo;
69743 int ret;
69744
69745 + pax_track_stack();
69746 +
69747 switch (request) {
69748 case PTRACE_PEEKTEXT:
69749 case PTRACE_PEEKDATA:
69750 @@ -859,14 +887,21 @@ asmlinkage long compat_sys_ptrace(compat
69751 goto out;
69752 }
69753
69754 + if (gr_handle_ptrace(child, request)) {
69755 + ret = -EPERM;
69756 + goto out_put_task_struct;
69757 + }
69758 +
69759 if (request == PTRACE_ATTACH) {
69760 ret = ptrace_attach(child);
69761 /*
69762 * Some architectures need to do book-keeping after
69763 * a ptrace attach.
69764 */
69765 - if (!ret)
69766 + if (!ret) {
69767 arch_ptrace_attach(child);
69768 + gr_audit_ptrace(child);
69769 + }
69770 goto out_put_task_struct;
69771 }
69772
69773 diff -urNp linux-2.6.39.1/kernel/rcutorture.c linux-2.6.39.1/kernel/rcutorture.c
69774 --- linux-2.6.39.1/kernel/rcutorture.c 2011-05-19 00:06:34.000000000 -0400
69775 +++ linux-2.6.39.1/kernel/rcutorture.c 2011-05-22 19:36:33.000000000 -0400
69776 @@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
69777 { 0 };
69778 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
69779 { 0 };
69780 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69781 -static atomic_t n_rcu_torture_alloc;
69782 -static atomic_t n_rcu_torture_alloc_fail;
69783 -static atomic_t n_rcu_torture_free;
69784 -static atomic_t n_rcu_torture_mberror;
69785 -static atomic_t n_rcu_torture_error;
69786 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69787 +static atomic_unchecked_t n_rcu_torture_alloc;
69788 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
69789 +static atomic_unchecked_t n_rcu_torture_free;
69790 +static atomic_unchecked_t n_rcu_torture_mberror;
69791 +static atomic_unchecked_t n_rcu_torture_error;
69792 static long n_rcu_torture_boost_ktrerror;
69793 static long n_rcu_torture_boost_rterror;
69794 static long n_rcu_torture_boost_allocerror;
69795 @@ -225,11 +225,11 @@ rcu_torture_alloc(void)
69796
69797 spin_lock_bh(&rcu_torture_lock);
69798 if (list_empty(&rcu_torture_freelist)) {
69799 - atomic_inc(&n_rcu_torture_alloc_fail);
69800 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
69801 spin_unlock_bh(&rcu_torture_lock);
69802 return NULL;
69803 }
69804 - atomic_inc(&n_rcu_torture_alloc);
69805 + atomic_inc_unchecked(&n_rcu_torture_alloc);
69806 p = rcu_torture_freelist.next;
69807 list_del_init(p);
69808 spin_unlock_bh(&rcu_torture_lock);
69809 @@ -242,7 +242,7 @@ rcu_torture_alloc(void)
69810 static void
69811 rcu_torture_free(struct rcu_torture *p)
69812 {
69813 - atomic_inc(&n_rcu_torture_free);
69814 + atomic_inc_unchecked(&n_rcu_torture_free);
69815 spin_lock_bh(&rcu_torture_lock);
69816 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
69817 spin_unlock_bh(&rcu_torture_lock);
69818 @@ -362,7 +362,7 @@ rcu_torture_cb(struct rcu_head *p)
69819 i = rp->rtort_pipe_count;
69820 if (i > RCU_TORTURE_PIPE_LEN)
69821 i = RCU_TORTURE_PIPE_LEN;
69822 - atomic_inc(&rcu_torture_wcount[i]);
69823 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69824 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69825 rp->rtort_mbtest = 0;
69826 rcu_torture_free(rp);
69827 @@ -409,7 +409,7 @@ static void rcu_sync_torture_deferred_fr
69828 i = rp->rtort_pipe_count;
69829 if (i > RCU_TORTURE_PIPE_LEN)
69830 i = RCU_TORTURE_PIPE_LEN;
69831 - atomic_inc(&rcu_torture_wcount[i]);
69832 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69833 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69834 rp->rtort_mbtest = 0;
69835 list_del(&rp->rtort_free);
69836 @@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
69837 i = old_rp->rtort_pipe_count;
69838 if (i > RCU_TORTURE_PIPE_LEN)
69839 i = RCU_TORTURE_PIPE_LEN;
69840 - atomic_inc(&rcu_torture_wcount[i]);
69841 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69842 old_rp->rtort_pipe_count++;
69843 cur_ops->deferred_free(old_rp);
69844 }
69845 @@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l
69846 return;
69847 }
69848 if (p->rtort_mbtest == 0)
69849 - atomic_inc(&n_rcu_torture_mberror);
69850 + atomic_inc_unchecked(&n_rcu_torture_mberror);
69851 spin_lock(&rand_lock);
69852 cur_ops->read_delay(&rand);
69853 n_rcu_torture_timers++;
69854 @@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg)
69855 continue;
69856 }
69857 if (p->rtort_mbtest == 0)
69858 - atomic_inc(&n_rcu_torture_mberror);
69859 + atomic_inc_unchecked(&n_rcu_torture_mberror);
69860 cur_ops->read_delay(&rand);
69861 preempt_disable();
69862 pipe_count = p->rtort_pipe_count;
69863 @@ -1072,10 +1072,10 @@ rcu_torture_printk(char *page)
69864 rcu_torture_current,
69865 rcu_torture_current_version,
69866 list_empty(&rcu_torture_freelist),
69867 - atomic_read(&n_rcu_torture_alloc),
69868 - atomic_read(&n_rcu_torture_alloc_fail),
69869 - atomic_read(&n_rcu_torture_free),
69870 - atomic_read(&n_rcu_torture_mberror),
69871 + atomic_read_unchecked(&n_rcu_torture_alloc),
69872 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
69873 + atomic_read_unchecked(&n_rcu_torture_free),
69874 + atomic_read_unchecked(&n_rcu_torture_mberror),
69875 n_rcu_torture_boost_ktrerror,
69876 n_rcu_torture_boost_rterror,
69877 n_rcu_torture_boost_allocerror,
69878 @@ -1083,7 +1083,7 @@ rcu_torture_printk(char *page)
69879 n_rcu_torture_boost_failure,
69880 n_rcu_torture_boosts,
69881 n_rcu_torture_timers);
69882 - if (atomic_read(&n_rcu_torture_mberror) != 0 ||
69883 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
69884 n_rcu_torture_boost_ktrerror != 0 ||
69885 n_rcu_torture_boost_rterror != 0 ||
69886 n_rcu_torture_boost_allocerror != 0 ||
69887 @@ -1093,7 +1093,7 @@ rcu_torture_printk(char *page)
69888 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
69889 if (i > 1) {
69890 cnt += sprintf(&page[cnt], "!!! ");
69891 - atomic_inc(&n_rcu_torture_error);
69892 + atomic_inc_unchecked(&n_rcu_torture_error);
69893 WARN_ON_ONCE(1);
69894 }
69895 cnt += sprintf(&page[cnt], "Reader Pipe: ");
69896 @@ -1107,7 +1107,7 @@ rcu_torture_printk(char *page)
69897 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
69898 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69899 cnt += sprintf(&page[cnt], " %d",
69900 - atomic_read(&rcu_torture_wcount[i]));
69901 + atomic_read_unchecked(&rcu_torture_wcount[i]));
69902 }
69903 cnt += sprintf(&page[cnt], "\n");
69904 if (cur_ops->stats)
69905 @@ -1415,7 +1415,7 @@ rcu_torture_cleanup(void)
69906
69907 if (cur_ops->cleanup)
69908 cur_ops->cleanup();
69909 - if (atomic_read(&n_rcu_torture_error))
69910 + if (atomic_read_unchecked(&n_rcu_torture_error))
69911 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
69912 else
69913 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
69914 @@ -1479,11 +1479,11 @@ rcu_torture_init(void)
69915
69916 rcu_torture_current = NULL;
69917 rcu_torture_current_version = 0;
69918 - atomic_set(&n_rcu_torture_alloc, 0);
69919 - atomic_set(&n_rcu_torture_alloc_fail, 0);
69920 - atomic_set(&n_rcu_torture_free, 0);
69921 - atomic_set(&n_rcu_torture_mberror, 0);
69922 - atomic_set(&n_rcu_torture_error, 0);
69923 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
69924 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
69925 + atomic_set_unchecked(&n_rcu_torture_free, 0);
69926 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
69927 + atomic_set_unchecked(&n_rcu_torture_error, 0);
69928 n_rcu_torture_boost_ktrerror = 0;
69929 n_rcu_torture_boost_rterror = 0;
69930 n_rcu_torture_boost_allocerror = 0;
69931 @@ -1491,7 +1491,7 @@ rcu_torture_init(void)
69932 n_rcu_torture_boost_failure = 0;
69933 n_rcu_torture_boosts = 0;
69934 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
69935 - atomic_set(&rcu_torture_wcount[i], 0);
69936 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
69937 for_each_possible_cpu(cpu) {
69938 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69939 per_cpu(rcu_torture_count, cpu)[i] = 0;
69940 diff -urNp linux-2.6.39.1/kernel/rcutree.c linux-2.6.39.1/kernel/rcutree.c
69941 --- linux-2.6.39.1/kernel/rcutree.c 2011-05-19 00:06:34.000000000 -0400
69942 +++ linux-2.6.39.1/kernel/rcutree.c 2011-05-22 19:36:33.000000000 -0400
69943 @@ -1389,7 +1389,7 @@ __rcu_process_callbacks(struct rcu_state
69944 /*
69945 * Do softirq processing for the current CPU.
69946 */
69947 -static void rcu_process_callbacks(struct softirq_action *unused)
69948 +static void rcu_process_callbacks(void)
69949 {
69950 /*
69951 * Memory references from any prior RCU read-side critical sections
69952 diff -urNp linux-2.6.39.1/kernel/rcutree_plugin.h linux-2.6.39.1/kernel/rcutree_plugin.h
69953 --- linux-2.6.39.1/kernel/rcutree_plugin.h 2011-05-19 00:06:34.000000000 -0400
69954 +++ linux-2.6.39.1/kernel/rcutree_plugin.h 2011-05-22 19:36:33.000000000 -0400
69955 @@ -730,7 +730,7 @@ void synchronize_rcu_expedited(void)
69956
69957 /* Clean up and exit. */
69958 smp_mb(); /* ensure expedited GP seen before counter increment. */
69959 - ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
69960 + ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
69961 unlock_mb_ret:
69962 mutex_unlock(&sync_rcu_preempt_exp_mutex);
69963 mb_ret:
69964 @@ -1025,8 +1025,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
69965
69966 #else /* #ifndef CONFIG_SMP */
69967
69968 -static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
69969 -static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
69970 +static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
69971 +static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
69972
69973 static int synchronize_sched_expedited_cpu_stop(void *data)
69974 {
69975 @@ -1081,7 +1081,7 @@ void synchronize_sched_expedited(void)
69976 int firstsnap, s, snap, trycount = 0;
69977
69978 /* Note that atomic_inc_return() implies full memory barrier. */
69979 - firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
69980 + firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
69981 get_online_cpus();
69982
69983 /*
69984 @@ -1102,7 +1102,7 @@ void synchronize_sched_expedited(void)
69985 }
69986
69987 /* Check to see if someone else did our work for us. */
69988 - s = atomic_read(&sync_sched_expedited_done);
69989 + s = atomic_read_unchecked(&sync_sched_expedited_done);
69990 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
69991 smp_mb(); /* ensure test happens before caller kfree */
69992 return;
69993 @@ -1117,7 +1117,7 @@ void synchronize_sched_expedited(void)
69994 * grace period works for us.
69995 */
69996 get_online_cpus();
69997 - snap = atomic_read(&sync_sched_expedited_started) - 1;
69998 + snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
69999 smp_mb(); /* ensure read is before try_stop_cpus(). */
70000 }
70001
70002 @@ -1128,12 +1128,12 @@ void synchronize_sched_expedited(void)
70003 * than we did beat us to the punch.
70004 */
70005 do {
70006 - s = atomic_read(&sync_sched_expedited_done);
70007 + s = atomic_read_unchecked(&sync_sched_expedited_done);
70008 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
70009 smp_mb(); /* ensure test happens before caller kfree */
70010 break;
70011 }
70012 - } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
70013 + } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
70014
70015 put_online_cpus();
70016 }
70017 diff -urNp linux-2.6.39.1/kernel/relay.c linux-2.6.39.1/kernel/relay.c
70018 --- linux-2.6.39.1/kernel/relay.c 2011-05-19 00:06:34.000000000 -0400
70019 +++ linux-2.6.39.1/kernel/relay.c 2011-05-22 19:36:33.000000000 -0400
70020 @@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
70021 };
70022 ssize_t ret;
70023
70024 + pax_track_stack();
70025 +
70026 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
70027 return 0;
70028 if (splice_grow_spd(pipe, &spd))
70029 diff -urNp linux-2.6.39.1/kernel/resource.c linux-2.6.39.1/kernel/resource.c
70030 --- linux-2.6.39.1/kernel/resource.c 2011-05-19 00:06:34.000000000 -0400
70031 +++ linux-2.6.39.1/kernel/resource.c 2011-05-22 19:41:42.000000000 -0400
70032 @@ -133,8 +133,18 @@ static const struct file_operations proc
70033
70034 static int __init ioresources_init(void)
70035 {
70036 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70037 +#ifdef CONFIG_GRKERNSEC_PROC_USER
70038 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
70039 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
70040 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
70041 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
70042 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
70043 +#endif
70044 +#else
70045 proc_create("ioports", 0, NULL, &proc_ioports_operations);
70046 proc_create("iomem", 0, NULL, &proc_iomem_operations);
70047 +#endif
70048 return 0;
70049 }
70050 __initcall(ioresources_init);
70051 diff -urNp linux-2.6.39.1/kernel/rtmutex-tester.c linux-2.6.39.1/kernel/rtmutex-tester.c
70052 --- linux-2.6.39.1/kernel/rtmutex-tester.c 2011-05-19 00:06:34.000000000 -0400
70053 +++ linux-2.6.39.1/kernel/rtmutex-tester.c 2011-05-22 19:36:33.000000000 -0400
70054 @@ -20,7 +20,7 @@
70055 #define MAX_RT_TEST_MUTEXES 8
70056
70057 static spinlock_t rttest_lock;
70058 -static atomic_t rttest_event;
70059 +static atomic_unchecked_t rttest_event;
70060
70061 struct test_thread_data {
70062 int opcode;
70063 @@ -61,7 +61,7 @@ static int handle_op(struct test_thread_
70064
70065 case RTTEST_LOCKCONT:
70066 td->mutexes[td->opdata] = 1;
70067 - td->event = atomic_add_return(1, &rttest_event);
70068 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70069 return 0;
70070
70071 case RTTEST_RESET:
70072 @@ -74,7 +74,7 @@ static int handle_op(struct test_thread_
70073 return 0;
70074
70075 case RTTEST_RESETEVENT:
70076 - atomic_set(&rttest_event, 0);
70077 + atomic_set_unchecked(&rttest_event, 0);
70078 return 0;
70079
70080 default:
70081 @@ -91,9 +91,9 @@ static int handle_op(struct test_thread_
70082 return ret;
70083
70084 td->mutexes[id] = 1;
70085 - td->event = atomic_add_return(1, &rttest_event);
70086 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70087 rt_mutex_lock(&mutexes[id]);
70088 - td->event = atomic_add_return(1, &rttest_event);
70089 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70090 td->mutexes[id] = 4;
70091 return 0;
70092
70093 @@ -104,9 +104,9 @@ static int handle_op(struct test_thread_
70094 return ret;
70095
70096 td->mutexes[id] = 1;
70097 - td->event = atomic_add_return(1, &rttest_event);
70098 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70099 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
70100 - td->event = atomic_add_return(1, &rttest_event);
70101 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70102 td->mutexes[id] = ret ? 0 : 4;
70103 return ret ? -EINTR : 0;
70104
70105 @@ -115,9 +115,9 @@ static int handle_op(struct test_thread_
70106 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
70107 return ret;
70108
70109 - td->event = atomic_add_return(1, &rttest_event);
70110 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70111 rt_mutex_unlock(&mutexes[id]);
70112 - td->event = atomic_add_return(1, &rttest_event);
70113 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70114 td->mutexes[id] = 0;
70115 return 0;
70116
70117 @@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu
70118 break;
70119
70120 td->mutexes[dat] = 2;
70121 - td->event = atomic_add_return(1, &rttest_event);
70122 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70123 break;
70124
70125 default:
70126 @@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu
70127 return;
70128
70129 td->mutexes[dat] = 3;
70130 - td->event = atomic_add_return(1, &rttest_event);
70131 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70132 break;
70133
70134 case RTTEST_LOCKNOWAIT:
70135 @@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu
70136 return;
70137
70138 td->mutexes[dat] = 1;
70139 - td->event = atomic_add_return(1, &rttest_event);
70140 + td->event = atomic_add_return_unchecked(1, &rttest_event);
70141 return;
70142
70143 default:
70144 diff -urNp linux-2.6.39.1/kernel/sched_autogroup.c linux-2.6.39.1/kernel/sched_autogroup.c
70145 --- linux-2.6.39.1/kernel/sched_autogroup.c 2011-05-19 00:06:34.000000000 -0400
70146 +++ linux-2.6.39.1/kernel/sched_autogroup.c 2011-05-22 19:36:33.000000000 -0400
70147 @@ -7,7 +7,7 @@
70148
70149 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
70150 static struct autogroup autogroup_default;
70151 -static atomic_t autogroup_seq_nr;
70152 +static atomic_unchecked_t autogroup_seq_nr;
70153
70154 static void __init autogroup_init(struct task_struct *init_task)
70155 {
70156 @@ -78,7 +78,7 @@ static inline struct autogroup *autogrou
70157
70158 kref_init(&ag->kref);
70159 init_rwsem(&ag->lock);
70160 - ag->id = atomic_inc_return(&autogroup_seq_nr);
70161 + ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
70162 ag->tg = tg;
70163 #ifdef CONFIG_RT_GROUP_SCHED
70164 /*
70165 diff -urNp linux-2.6.39.1/kernel/sched.c linux-2.6.39.1/kernel/sched.c
70166 --- linux-2.6.39.1/kernel/sched.c 2011-05-19 00:06:34.000000000 -0400
70167 +++ linux-2.6.39.1/kernel/sched.c 2011-05-23 17:07:00.000000000 -0400
70168 @@ -4078,6 +4078,8 @@ asmlinkage void __sched schedule(void)
70169 struct rq *rq;
70170 int cpu;
70171
70172 + pax_track_stack();
70173 +
70174 need_resched:
70175 preempt_disable();
70176 cpu = smp_processor_id();
70177 @@ -4165,7 +4167,7 @@ EXPORT_SYMBOL(schedule);
70178 * Look out! "owner" is an entirely speculative pointer
70179 * access and not reliable.
70180 */
70181 -int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
70182 +int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
70183 {
70184 unsigned int cpu;
70185 struct rq *rq;
70186 @@ -4179,10 +4181,10 @@ int mutex_spin_on_owner(struct mutex *lo
70187 * DEBUG_PAGEALLOC could have unmapped it if
70188 * the mutex owner just released it and exited.
70189 */
70190 - if (probe_kernel_address(&owner->cpu, cpu))
70191 + if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
70192 return 0;
70193 #else
70194 - cpu = owner->cpu;
70195 + cpu = task_thread_info(owner)->cpu;
70196 #endif
70197
70198 /*
70199 @@ -4219,7 +4221,7 @@ int mutex_spin_on_owner(struct mutex *lo
70200 /*
70201 * Is that owner really running on that cpu?
70202 */
70203 - if (task_thread_info(rq->curr) != owner || need_resched())
70204 + if (rq->curr != owner || need_resched())
70205 return 0;
70206
70207 arch_mutex_cpu_relax();
70208 @@ -4778,6 +4780,8 @@ int can_nice(const struct task_struct *p
70209 /* convert nice value [19,-20] to rlimit style value [1,40] */
70210 int nice_rlim = 20 - nice;
70211
70212 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
70213 +
70214 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
70215 capable(CAP_SYS_NICE));
70216 }
70217 @@ -4811,7 +4815,8 @@ SYSCALL_DEFINE1(nice, int, increment)
70218 if (nice > 19)
70219 nice = 19;
70220
70221 - if (increment < 0 && !can_nice(current, nice))
70222 + if (increment < 0 && (!can_nice(current, nice) ||
70223 + gr_handle_chroot_nice()))
70224 return -EPERM;
70225
70226 retval = security_task_setnice(current, nice);
70227 @@ -4957,6 +4962,7 @@ recheck:
70228 unsigned long rlim_rtprio =
70229 task_rlimit(p, RLIMIT_RTPRIO);
70230
70231 + gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
70232 /* can't set/change the rt policy */
70233 if (policy != p->policy && !rlim_rtprio)
70234 return -EPERM;
70235 @@ -7164,7 +7170,7 @@ static void init_sched_groups_power(int
70236 long power;
70237 int weight;
70238
70239 - WARN_ON(!sd || !sd->groups);
70240 + BUG_ON(!sd || !sd->groups);
70241
70242 if (cpu != group_first_cpu(sd->groups))
70243 return;
70244 diff -urNp linux-2.6.39.1/kernel/sched_fair.c linux-2.6.39.1/kernel/sched_fair.c
70245 --- linux-2.6.39.1/kernel/sched_fair.c 2011-05-19 00:06:34.000000000 -0400
70246 +++ linux-2.6.39.1/kernel/sched_fair.c 2011-05-22 19:36:33.000000000 -0400
70247 @@ -3999,7 +3999,7 @@ static void nohz_idle_balance(int this_c
70248 * run_rebalance_domains is triggered when needed from the scheduler tick.
70249 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
70250 */
70251 -static void run_rebalance_domains(struct softirq_action *h)
70252 +static void run_rebalance_domains(void)
70253 {
70254 int this_cpu = smp_processor_id();
70255 struct rq *this_rq = cpu_rq(this_cpu);
70256 diff -urNp linux-2.6.39.1/kernel/signal.c linux-2.6.39.1/kernel/signal.c
70257 --- linux-2.6.39.1/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
70258 +++ linux-2.6.39.1/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
70259 @@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
70260
70261 int print_fatal_signals __read_mostly;
70262
70263 -static void __user *sig_handler(struct task_struct *t, int sig)
70264 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
70265 {
70266 return t->sighand->action[sig - 1].sa.sa_handler;
70267 }
70268
70269 -static int sig_handler_ignored(void __user *handler, int sig)
70270 +static int sig_handler_ignored(__sighandler_t handler, int sig)
70271 {
70272 /* Is it explicitly or implicitly ignored? */
70273 return handler == SIG_IGN ||
70274 @@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us
70275 static int sig_task_ignored(struct task_struct *t, int sig,
70276 int from_ancestor_ns)
70277 {
70278 - void __user *handler;
70279 + __sighandler_t handler;
70280
70281 handler = sig_handler(t, sig);
70282
70283 @@ -243,6 +243,9 @@ __sigqueue_alloc(int sig, struct task_st
70284 atomic_inc(&user->sigpending);
70285 rcu_read_unlock();
70286
70287 + if (!override_rlimit)
70288 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
70289 +
70290 if (override_rlimit ||
70291 atomic_read(&user->sigpending) <=
70292 task_rlimit(t, RLIMIT_SIGPENDING)) {
70293 @@ -367,7 +370,7 @@ flush_signal_handlers(struct task_struct
70294
70295 int unhandled_signal(struct task_struct *tsk, int sig)
70296 {
70297 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
70298 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
70299 if (is_global_init(tsk))
70300 return 1;
70301 if (handler != SIG_IGN && handler != SIG_DFL)
70302 @@ -693,6 +696,9 @@ static int check_kill_permission(int sig
70303 }
70304 }
70305
70306 + if (gr_handle_signal(t, sig))
70307 + return -EPERM;
70308 +
70309 return security_task_kill(t, info, sig, 0);
70310 }
70311
70312 @@ -1041,7 +1047,7 @@ __group_send_sig_info(int sig, struct si
70313 return send_signal(sig, info, p, 1);
70314 }
70315
70316 -static int
70317 +int
70318 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
70319 {
70320 return send_signal(sig, info, t, 0);
70321 @@ -1078,6 +1084,7 @@ force_sig_info(int sig, struct siginfo *
70322 unsigned long int flags;
70323 int ret, blocked, ignored;
70324 struct k_sigaction *action;
70325 + int is_unhandled = 0;
70326
70327 spin_lock_irqsave(&t->sighand->siglock, flags);
70328 action = &t->sighand->action[sig-1];
70329 @@ -1092,9 +1099,18 @@ force_sig_info(int sig, struct siginfo *
70330 }
70331 if (action->sa.sa_handler == SIG_DFL)
70332 t->signal->flags &= ~SIGNAL_UNKILLABLE;
70333 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
70334 + is_unhandled = 1;
70335 ret = specific_send_sig_info(sig, info, t);
70336 spin_unlock_irqrestore(&t->sighand->siglock, flags);
70337
70338 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
70339 + normal operation */
70340 + if (is_unhandled) {
70341 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
70342 + gr_handle_crash(t, sig);
70343 + }
70344 +
70345 return ret;
70346 }
70347
70348 @@ -1153,8 +1169,11 @@ int group_send_sig_info(int sig, struct
70349 ret = check_kill_permission(sig, info, p);
70350 rcu_read_unlock();
70351
70352 - if (!ret && sig)
70353 + if (!ret && sig) {
70354 ret = do_send_sig_info(sig, info, p, true);
70355 + if (!ret)
70356 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
70357 + }
70358
70359 return ret;
70360 }
70361 @@ -1718,6 +1737,8 @@ void ptrace_notify(int exit_code)
70362 {
70363 siginfo_t info;
70364
70365 + pax_track_stack();
70366 +
70367 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
70368
70369 memset(&info, 0, sizeof info);
70370 diff -urNp linux-2.6.39.1/kernel/smp.c linux-2.6.39.1/kernel/smp.c
70371 --- linux-2.6.39.1/kernel/smp.c 2011-05-19 00:06:34.000000000 -0400
70372 +++ linux-2.6.39.1/kernel/smp.c 2011-05-22 19:36:33.000000000 -0400
70373 @@ -583,22 +583,22 @@ int smp_call_function(smp_call_func_t fu
70374 }
70375 EXPORT_SYMBOL(smp_call_function);
70376
70377 -void ipi_call_lock(void)
70378 +void ipi_call_lock(void) __acquires(call_function.lock)
70379 {
70380 raw_spin_lock(&call_function.lock);
70381 }
70382
70383 -void ipi_call_unlock(void)
70384 +void ipi_call_unlock(void) __releases(call_function.lock)
70385 {
70386 raw_spin_unlock(&call_function.lock);
70387 }
70388
70389 -void ipi_call_lock_irq(void)
70390 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
70391 {
70392 raw_spin_lock_irq(&call_function.lock);
70393 }
70394
70395 -void ipi_call_unlock_irq(void)
70396 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
70397 {
70398 raw_spin_unlock_irq(&call_function.lock);
70399 }
70400 diff -urNp linux-2.6.39.1/kernel/softirq.c linux-2.6.39.1/kernel/softirq.c
70401 --- linux-2.6.39.1/kernel/softirq.c 2011-05-19 00:06:34.000000000 -0400
70402 +++ linux-2.6.39.1/kernel/softirq.c 2011-05-22 19:36:33.000000000 -0400
70403 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
70404
70405 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
70406
70407 -char *softirq_to_name[NR_SOFTIRQS] = {
70408 +const char * const softirq_to_name[NR_SOFTIRQS] = {
70409 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
70410 "TASKLET", "SCHED", "HRTIMER", "RCU"
70411 };
70412 @@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
70413
70414 asmlinkage void __do_softirq(void)
70415 {
70416 - struct softirq_action *h;
70417 + const struct softirq_action *h;
70418 __u32 pending;
70419 int max_restart = MAX_SOFTIRQ_RESTART;
70420 int cpu;
70421 @@ -235,7 +235,7 @@ restart:
70422 kstat_incr_softirqs_this_cpu(vec_nr);
70423
70424 trace_softirq_entry(vec_nr);
70425 - h->action(h);
70426 + h->action();
70427 trace_softirq_exit(vec_nr);
70428 if (unlikely(prev_count != preempt_count())) {
70429 printk(KERN_ERR "huh, entered softirq %u %s %p"
70430 @@ -377,7 +377,7 @@ void raise_softirq(unsigned int nr)
70431 local_irq_restore(flags);
70432 }
70433
70434 -void open_softirq(int nr, void (*action)(struct softirq_action *))
70435 +void open_softirq(int nr, void (*action)(void))
70436 {
70437 softirq_vec[nr].action = action;
70438 }
70439 @@ -433,7 +433,7 @@ void __tasklet_hi_schedule_first(struct
70440
70441 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
70442
70443 -static void tasklet_action(struct softirq_action *a)
70444 +static void tasklet_action(void)
70445 {
70446 struct tasklet_struct *list;
70447
70448 @@ -468,7 +468,7 @@ static void tasklet_action(struct softir
70449 }
70450 }
70451
70452 -static void tasklet_hi_action(struct softirq_action *a)
70453 +static void tasklet_hi_action(void)
70454 {
70455 struct tasklet_struct *list;
70456
70457 diff -urNp linux-2.6.39.1/kernel/sys.c linux-2.6.39.1/kernel/sys.c
70458 --- linux-2.6.39.1/kernel/sys.c 2011-05-19 00:06:34.000000000 -0400
70459 +++ linux-2.6.39.1/kernel/sys.c 2011-05-22 21:08:10.000000000 -0400
70460 @@ -154,6 +154,12 @@ static int set_one_prio(struct task_stru
70461 error = -EACCES;
70462 goto out;
70463 }
70464 +
70465 + if (gr_handle_chroot_setpriority(p, niceval)) {
70466 + error = -EACCES;
70467 + goto out;
70468 + }
70469 +
70470 no_nice = security_task_setnice(p, niceval);
70471 if (no_nice) {
70472 error = no_nice;
70473 @@ -538,6 +544,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
70474 goto error;
70475 }
70476
70477 + if (gr_check_group_change(new->gid, new->egid, -1))
70478 + goto error;
70479 +
70480 if (rgid != (gid_t) -1 ||
70481 (egid != (gid_t) -1 && egid != old->gid))
70482 new->sgid = new->egid;
70483 @@ -567,6 +576,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
70484 old = current_cred();
70485
70486 retval = -EPERM;
70487 +
70488 + if (gr_check_group_change(gid, gid, gid))
70489 + goto error;
70490 +
70491 if (nsown_capable(CAP_SETGID))
70492 new->gid = new->egid = new->sgid = new->fsgid = gid;
70493 else if (gid == old->gid || gid == old->sgid)
70494 @@ -647,6 +660,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
70495 goto error;
70496 }
70497
70498 + if (gr_check_user_change(new->uid, new->euid, -1))
70499 + goto error;
70500 +
70501 if (new->uid != old->uid) {
70502 retval = set_user(new);
70503 if (retval < 0)
70504 @@ -691,6 +707,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
70505 old = current_cred();
70506
70507 retval = -EPERM;
70508 +
70509 + if (gr_check_crash_uid(uid))
70510 + goto error;
70511 + if (gr_check_user_change(uid, uid, uid))
70512 + goto error;
70513 +
70514 if (nsown_capable(CAP_SETUID)) {
70515 new->suid = new->uid = uid;
70516 if (uid != old->uid) {
70517 @@ -745,6 +767,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
70518 goto error;
70519 }
70520
70521 + if (gr_check_user_change(ruid, euid, -1))
70522 + goto error;
70523 +
70524 if (ruid != (uid_t) -1) {
70525 new->uid = ruid;
70526 if (ruid != old->uid) {
70527 @@ -809,6 +834,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
70528 goto error;
70529 }
70530
70531 + if (gr_check_group_change(rgid, egid, -1))
70532 + goto error;
70533 +
70534 if (rgid != (gid_t) -1)
70535 new->gid = rgid;
70536 if (egid != (gid_t) -1)
70537 @@ -855,6 +883,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70538 old = current_cred();
70539 old_fsuid = old->fsuid;
70540
70541 + if (gr_check_user_change(-1, -1, uid))
70542 + goto error;
70543 +
70544 if (uid == old->uid || uid == old->euid ||
70545 uid == old->suid || uid == old->fsuid ||
70546 nsown_capable(CAP_SETUID)) {
70547 @@ -865,6 +896,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70548 }
70549 }
70550
70551 +error:
70552 abort_creds(new);
70553 return old_fsuid;
70554
70555 @@ -891,12 +923,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
70556 if (gid == old->gid || gid == old->egid ||
70557 gid == old->sgid || gid == old->fsgid ||
70558 nsown_capable(CAP_SETGID)) {
70559 + if (gr_check_group_change(-1, -1, gid))
70560 + goto error;
70561 +
70562 if (gid != old_fsgid) {
70563 new->fsgid = gid;
70564 goto change_okay;
70565 }
70566 }
70567
70568 +error:
70569 abort_creds(new);
70570 return old_fsgid;
70571
70572 @@ -1643,7 +1679,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
70573 error = get_dumpable(me->mm);
70574 break;
70575 case PR_SET_DUMPABLE:
70576 - if (arg2 < 0 || arg2 > 1) {
70577 + if (arg2 > 1) {
70578 error = -EINVAL;
70579 break;
70580 }
70581 diff -urNp linux-2.6.39.1/kernel/sysctl.c linux-2.6.39.1/kernel/sysctl.c
70582 --- linux-2.6.39.1/kernel/sysctl.c 2011-05-19 00:06:34.000000000 -0400
70583 +++ linux-2.6.39.1/kernel/sysctl.c 2011-05-22 20:23:10.000000000 -0400
70584 @@ -84,6 +84,13 @@
70585
70586
70587 #if defined(CONFIG_SYSCTL)
70588 +#include <linux/grsecurity.h>
70589 +#include <linux/grinternal.h>
70590 +
70591 +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
70592 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
70593 + const int op);
70594 +extern int gr_handle_chroot_sysctl(const int op);
70595
70596 /* External variables not in a header file. */
70597 extern int sysctl_overcommit_memory;
70598 @@ -196,6 +203,7 @@ static int sysrq_sysctl_handler(ctl_tabl
70599 }
70600
70601 #endif
70602 +extern struct ctl_table grsecurity_table[];
70603
70604 static struct ctl_table root_table[];
70605 static struct ctl_table_root sysctl_table_root;
70606 @@ -225,6 +233,20 @@ extern struct ctl_table epoll_table[];
70607 int sysctl_legacy_va_layout;
70608 #endif
70609
70610 +#ifdef CONFIG_PAX_SOFTMODE
70611 +static ctl_table pax_table[] = {
70612 + {
70613 + .procname = "softmode",
70614 + .data = &pax_softmode,
70615 + .maxlen = sizeof(unsigned int),
70616 + .mode = 0600,
70617 + .proc_handler = &proc_dointvec,
70618 + },
70619 +
70620 + { }
70621 +};
70622 +#endif
70623 +
70624 /* The default sysctl tables: */
70625
70626 static struct ctl_table root_table[] = {
70627 @@ -271,6 +293,22 @@ static int max_extfrag_threshold = 1000;
70628 #endif
70629
70630 static struct ctl_table kern_table[] = {
70631 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
70632 + {
70633 + .procname = "grsecurity",
70634 + .mode = 0500,
70635 + .child = grsecurity_table,
70636 + },
70637 +#endif
70638 +
70639 +#ifdef CONFIG_PAX_SOFTMODE
70640 + {
70641 + .procname = "pax",
70642 + .mode = 0500,
70643 + .child = pax_table,
70644 + },
70645 +#endif
70646 +
70647 {
70648 .procname = "sched_child_runs_first",
70649 .data = &sysctl_sched_child_runs_first,
70650 @@ -545,7 +583,7 @@ static struct ctl_table kern_table[] = {
70651 .data = &modprobe_path,
70652 .maxlen = KMOD_PATH_LEN,
70653 .mode = 0644,
70654 - .proc_handler = proc_dostring,
70655 + .proc_handler = proc_dostring_modpriv,
70656 },
70657 {
70658 .procname = "modules_disabled",
70659 @@ -707,16 +745,20 @@ static struct ctl_table kern_table[] = {
70660 .extra1 = &zero,
70661 .extra2 = &one,
70662 },
70663 +#endif
70664 {
70665 .procname = "kptr_restrict",
70666 .data = &kptr_restrict,
70667 .maxlen = sizeof(int),
70668 .mode = 0644,
70669 .proc_handler = proc_dmesg_restrict,
70670 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70671 + .extra1 = &two,
70672 +#else
70673 .extra1 = &zero,
70674 +#endif
70675 .extra2 = &two,
70676 },
70677 -#endif
70678 {
70679 .procname = "ngroups_max",
70680 .data = &ngroups_max,
70681 @@ -1189,6 +1231,13 @@ static struct ctl_table vm_table[] = {
70682 .proc_handler = proc_dointvec_minmax,
70683 .extra1 = &zero,
70684 },
70685 + {
70686 + .procname = "heap_stack_gap",
70687 + .data = &sysctl_heap_stack_gap,
70688 + .maxlen = sizeof(sysctl_heap_stack_gap),
70689 + .mode = 0644,
70690 + .proc_handler = proc_doulongvec_minmax,
70691 + },
70692 #else
70693 {
70694 .procname = "nr_trim_pages",
70695 @@ -1698,6 +1747,17 @@ static int test_perm(int mode, int op)
70696 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
70697 {
70698 int mode;
70699 + int error;
70700 +
70701 + if (table->parent != NULL && table->parent->procname != NULL &&
70702 + table->procname != NULL &&
70703 + gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
70704 + return -EACCES;
70705 + if (gr_handle_chroot_sysctl(op))
70706 + return -EACCES;
70707 + error = gr_handle_sysctl(table, op);
70708 + if (error)
70709 + return error;
70710
70711 if (root->permissions)
70712 mode = root->permissions(root, current->nsproxy, table);
70713 @@ -2102,6 +2162,16 @@ int proc_dostring(struct ctl_table *tabl
70714 buffer, lenp, ppos);
70715 }
70716
70717 +int proc_dostring_modpriv(struct ctl_table *table, int write,
70718 + void __user *buffer, size_t *lenp, loff_t *ppos)
70719 +{
70720 + if (write && !capable(CAP_SYS_MODULE))
70721 + return -EPERM;
70722 +
70723 + return _proc_do_string(table->data, table->maxlen, write,
70724 + buffer, lenp, ppos);
70725 +}
70726 +
70727 static size_t proc_skip_spaces(char **buf)
70728 {
70729 size_t ret;
70730 @@ -2207,6 +2277,8 @@ static int proc_put_long(void __user **b
70731 len = strlen(tmp);
70732 if (len > *size)
70733 len = *size;
70734 + if (len > sizeof(tmp))
70735 + len = sizeof(tmp);
70736 if (copy_to_user(*buf, tmp, len))
70737 return -EFAULT;
70738 *size -= len;
70739 @@ -2523,8 +2595,11 @@ static int __do_proc_doulongvec_minmax(v
70740 *i = val;
70741 } else {
70742 val = convdiv * (*i) / convmul;
70743 - if (!first)
70744 + if (!first) {
70745 err = proc_put_char(&buffer, &left, '\t');
70746 + if (err)
70747 + break;
70748 + }
70749 err = proc_put_long(&buffer, &left, val, false);
70750 if (err)
70751 break;
70752 @@ -2919,6 +2994,12 @@ int proc_dostring(struct ctl_table *tabl
70753 return -ENOSYS;
70754 }
70755
70756 +int proc_dostring_modpriv(struct ctl_table *table, int write,
70757 + void __user *buffer, size_t *lenp, loff_t *ppos)
70758 +{
70759 + return -ENOSYS;
70760 +}
70761 +
70762 int proc_dointvec(struct ctl_table *table, int write,
70763 void __user *buffer, size_t *lenp, loff_t *ppos)
70764 {
70765 @@ -2975,6 +3056,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
70766 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
70767 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
70768 EXPORT_SYMBOL(proc_dostring);
70769 +EXPORT_SYMBOL(proc_dostring_modpriv);
70770 EXPORT_SYMBOL(proc_doulongvec_minmax);
70771 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
70772 EXPORT_SYMBOL(register_sysctl_table);
70773 diff -urNp linux-2.6.39.1/kernel/sysctl_check.c linux-2.6.39.1/kernel/sysctl_check.c
70774 --- linux-2.6.39.1/kernel/sysctl_check.c 2011-05-19 00:06:34.000000000 -0400
70775 +++ linux-2.6.39.1/kernel/sysctl_check.c 2011-05-22 19:41:42.000000000 -0400
70776 @@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n
70777 set_fail(&fail, table, "Directory with extra2");
70778 } else {
70779 if ((table->proc_handler == proc_dostring) ||
70780 + (table->proc_handler == proc_dostring_modpriv) ||
70781 (table->proc_handler == proc_dointvec) ||
70782 (table->proc_handler == proc_dointvec_minmax) ||
70783 (table->proc_handler == proc_dointvec_jiffies) ||
70784 diff -urNp linux-2.6.39.1/kernel/taskstats.c linux-2.6.39.1/kernel/taskstats.c
70785 --- linux-2.6.39.1/kernel/taskstats.c 2011-05-19 00:06:34.000000000 -0400
70786 +++ linux-2.6.39.1/kernel/taskstats.c 2011-05-22 19:41:42.000000000 -0400
70787 @@ -27,9 +27,12 @@
70788 #include <linux/cgroup.h>
70789 #include <linux/fs.h>
70790 #include <linux/file.h>
70791 +#include <linux/grsecurity.h>
70792 #include <net/genetlink.h>
70793 #include <asm/atomic.h>
70794
70795 +extern int gr_is_taskstats_denied(int pid);
70796 +
70797 /*
70798 * Maximum length of a cpumask that can be specified in
70799 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
70800 @@ -549,6 +552,9 @@ err:
70801
70802 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
70803 {
70804 + if (gr_is_taskstats_denied(current->pid))
70805 + return -EACCES;
70806 +
70807 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
70808 return cmd_attr_register_cpumask(info);
70809 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
70810 diff -urNp linux-2.6.39.1/kernel/time/posix-clock.c linux-2.6.39.1/kernel/time/posix-clock.c
70811 --- linux-2.6.39.1/kernel/time/posix-clock.c 2011-05-19 00:06:34.000000000 -0400
70812 +++ linux-2.6.39.1/kernel/time/posix-clock.c 2011-05-22 19:36:33.000000000 -0400
70813 @@ -433,7 +433,7 @@ static int pc_timer_settime(struct k_iti
70814 return err;
70815 }
70816
70817 -struct k_clock clock_posix_dynamic = {
70818 +const struct k_clock clock_posix_dynamic = {
70819 .clock_getres = pc_clock_getres,
70820 .clock_set = pc_clock_settime,
70821 .clock_get = pc_clock_gettime,
70822 diff -urNp linux-2.6.39.1/kernel/time/tick-broadcast.c linux-2.6.39.1/kernel/time/tick-broadcast.c
70823 --- linux-2.6.39.1/kernel/time/tick-broadcast.c 2011-05-19 00:06:34.000000000 -0400
70824 +++ linux-2.6.39.1/kernel/time/tick-broadcast.c 2011-05-22 19:36:33.000000000 -0400
70825 @@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl
70826 * then clear the broadcast bit.
70827 */
70828 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
70829 - int cpu = smp_processor_id();
70830 + cpu = smp_processor_id();
70831
70832 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
70833 tick_broadcast_clear_oneshot(cpu);
70834 diff -urNp linux-2.6.39.1/kernel/time/timekeeping.c linux-2.6.39.1/kernel/time/timekeeping.c
70835 --- linux-2.6.39.1/kernel/time/timekeeping.c 2011-05-19 00:06:34.000000000 -0400
70836 +++ linux-2.6.39.1/kernel/time/timekeeping.c 2011-05-22 20:40:50.000000000 -0400
70837 @@ -14,6 +14,7 @@
70838 #include <linux/init.h>
70839 #include <linux/mm.h>
70840 #include <linux/sched.h>
70841 +#include <linux/grsecurity.h>
70842 #include <linux/syscore_ops.h>
70843 #include <linux/clocksource.h>
70844 #include <linux/jiffies.h>
70845 @@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe
70846 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
70847 return -EINVAL;
70848
70849 + gr_log_timechange();
70850 +
70851 write_seqlock_irqsave(&xtime_lock, flags);
70852
70853 timekeeping_forward_now();
70854 diff -urNp linux-2.6.39.1/kernel/time/timer_list.c linux-2.6.39.1/kernel/time/timer_list.c
70855 --- linux-2.6.39.1/kernel/time/timer_list.c 2011-05-19 00:06:34.000000000 -0400
70856 +++ linux-2.6.39.1/kernel/time/timer_list.c 2011-05-22 19:41:42.000000000 -0400
70857 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
70858
70859 static void print_name_offset(struct seq_file *m, void *sym)
70860 {
70861 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70862 + SEQ_printf(m, "<%p>", NULL);
70863 +#else
70864 char symname[KSYM_NAME_LEN];
70865
70866 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
70867 SEQ_printf(m, "<%pK>", sym);
70868 else
70869 SEQ_printf(m, "%s", symname);
70870 +#endif
70871 }
70872
70873 static void
70874 @@ -112,7 +116,11 @@ next_one:
70875 static void
70876 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
70877 {
70878 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70879 + SEQ_printf(m, " .base: %p\n", NULL);
70880 +#else
70881 SEQ_printf(m, " .base: %pK\n", base);
70882 +#endif
70883 SEQ_printf(m, " .index: %d\n",
70884 base->index);
70885 SEQ_printf(m, " .resolution: %Lu nsecs\n",
70886 @@ -293,7 +301,11 @@ static int __init init_timer_list_procfs
70887 {
70888 struct proc_dir_entry *pe;
70889
70890 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70891 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
70892 +#else
70893 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
70894 +#endif
70895 if (!pe)
70896 return -ENOMEM;
70897 return 0;
70898 diff -urNp linux-2.6.39.1/kernel/time/timer_stats.c linux-2.6.39.1/kernel/time/timer_stats.c
70899 --- linux-2.6.39.1/kernel/time/timer_stats.c 2011-05-19 00:06:34.000000000 -0400
70900 +++ linux-2.6.39.1/kernel/time/timer_stats.c 2011-05-22 19:41:42.000000000 -0400
70901 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
70902 static unsigned long nr_entries;
70903 static struct entry entries[MAX_ENTRIES];
70904
70905 -static atomic_t overflow_count;
70906 +static atomic_unchecked_t overflow_count;
70907
70908 /*
70909 * The entries are in a hash-table, for fast lookup:
70910 @@ -140,7 +140,7 @@ static void reset_entries(void)
70911 nr_entries = 0;
70912 memset(entries, 0, sizeof(entries));
70913 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
70914 - atomic_set(&overflow_count, 0);
70915 + atomic_set_unchecked(&overflow_count, 0);
70916 }
70917
70918 static struct entry *alloc_entry(void)
70919 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
70920 if (likely(entry))
70921 entry->count++;
70922 else
70923 - atomic_inc(&overflow_count);
70924 + atomic_inc_unchecked(&overflow_count);
70925
70926 out_unlock:
70927 raw_spin_unlock_irqrestore(lock, flags);
70928 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
70929
70930 static void print_name_offset(struct seq_file *m, unsigned long addr)
70931 {
70932 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70933 + seq_printf(m, "<%p>", NULL);
70934 +#else
70935 char symname[KSYM_NAME_LEN];
70936
70937 if (lookup_symbol_name(addr, symname) < 0)
70938 seq_printf(m, "<%p>", (void *)addr);
70939 else
70940 seq_printf(m, "%s", symname);
70941 +#endif
70942 }
70943
70944 static int tstats_show(struct seq_file *m, void *v)
70945 @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
70946
70947 seq_puts(m, "Timer Stats Version: v0.2\n");
70948 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
70949 - if (atomic_read(&overflow_count))
70950 + if (atomic_read_unchecked(&overflow_count))
70951 seq_printf(m, "Overflow: %d entries\n",
70952 - atomic_read(&overflow_count));
70953 + atomic_read_unchecked(&overflow_count));
70954
70955 for (i = 0; i < nr_entries; i++) {
70956 entry = entries + i;
70957 @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
70958 {
70959 struct proc_dir_entry *pe;
70960
70961 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70962 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
70963 +#else
70964 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
70965 +#endif
70966 if (!pe)
70967 return -ENOMEM;
70968 return 0;
70969 diff -urNp linux-2.6.39.1/kernel/time.c linux-2.6.39.1/kernel/time.c
70970 --- linux-2.6.39.1/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
70971 +++ linux-2.6.39.1/kernel/time.c 2011-05-22 19:41:42.000000000 -0400
70972 @@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim
70973 return error;
70974
70975 if (tz) {
70976 + /* we log in do_settimeofday called below, so don't log twice
70977 + */
70978 + if (!tv)
70979 + gr_log_timechange();
70980 +
70981 /* SMP safe, global irq locking makes it work. */
70982 sys_tz = *tz;
70983 update_vsyscall_tz();
70984 diff -urNp linux-2.6.39.1/kernel/timer.c linux-2.6.39.1/kernel/timer.c
70985 --- linux-2.6.39.1/kernel/timer.c 2011-05-19 00:06:34.000000000 -0400
70986 +++ linux-2.6.39.1/kernel/timer.c 2011-05-22 19:36:33.000000000 -0400
70987 @@ -1305,7 +1305,7 @@ void update_process_times(int user_tick)
70988 /*
70989 * This function runs timers and the timer-tq in bottom half context.
70990 */
70991 -static void run_timer_softirq(struct softirq_action *h)
70992 +static void run_timer_softirq(void)
70993 {
70994 struct tvec_base *base = __this_cpu_read(tvec_bases);
70995
70996 diff -urNp linux-2.6.39.1/kernel/trace/blktrace.c linux-2.6.39.1/kernel/trace/blktrace.c
70997 --- linux-2.6.39.1/kernel/trace/blktrace.c 2011-05-19 00:06:34.000000000 -0400
70998 +++ linux-2.6.39.1/kernel/trace/blktrace.c 2011-05-22 19:36:33.000000000 -0400
70999 @@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
71000 struct blk_trace *bt = filp->private_data;
71001 char buf[16];
71002
71003 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
71004 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
71005
71006 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
71007 }
71008 @@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
71009 return 1;
71010
71011 bt = buf->chan->private_data;
71012 - atomic_inc(&bt->dropped);
71013 + atomic_inc_unchecked(&bt->dropped);
71014 return 0;
71015 }
71016
71017 @@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
71018
71019 bt->dir = dir;
71020 bt->dev = dev;
71021 - atomic_set(&bt->dropped, 0);
71022 + atomic_set_unchecked(&bt->dropped, 0);
71023
71024 ret = -EIO;
71025 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
71026 diff -urNp linux-2.6.39.1/kernel/trace/ftrace.c linux-2.6.39.1/kernel/trace/ftrace.c
71027 --- linux-2.6.39.1/kernel/trace/ftrace.c 2011-06-03 00:04:14.000000000 -0400
71028 +++ linux-2.6.39.1/kernel/trace/ftrace.c 2011-06-03 00:32:08.000000000 -0400
71029 @@ -1107,13 +1107,18 @@ ftrace_code_disable(struct module *mod,
71030
71031 ip = rec->ip;
71032
71033 + ret = ftrace_arch_code_modify_prepare();
71034 + FTRACE_WARN_ON(ret);
71035 + if (ret)
71036 + return 0;
71037 +
71038 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
71039 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
71040 if (ret) {
71041 ftrace_bug(ret, ip);
71042 rec->flags |= FTRACE_FL_FAILED;
71043 - return 0;
71044 }
71045 - return 1;
71046 + return ret ? 0 : 1;
71047 }
71048
71049 /*
71050 @@ -2011,7 +2016,7 @@ static void ftrace_free_entry_rcu(struct
71051
71052 int
71053 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
71054 - void *data)
71055 + void *data)
71056 {
71057 struct ftrace_func_probe *entry;
71058 struct ftrace_page *pg;
71059 @@ -2083,7 +2088,7 @@ enum {
71060 };
71061
71062 static void
71063 -__unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
71064 +__unregister_ftrace_function_probe(char *glob, const struct ftrace_probe_ops *ops,
71065 void *data, int flags)
71066 {
71067 struct ftrace_func_probe *entry;
71068 @@ -2144,7 +2149,7 @@ unregister_ftrace_function_probe(char *g
71069 }
71070
71071 void
71072 -unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops)
71073 +unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops)
71074 {
71075 __unregister_ftrace_function_probe(glob, ops, NULL, PROBE_TEST_FUNC);
71076 }
71077 diff -urNp linux-2.6.39.1/kernel/trace/trace.c linux-2.6.39.1/kernel/trace/trace.c
71078 --- linux-2.6.39.1/kernel/trace/trace.c 2011-05-19 00:06:34.000000000 -0400
71079 +++ linux-2.6.39.1/kernel/trace/trace.c 2011-05-22 19:36:33.000000000 -0400
71080 @@ -3330,6 +3330,8 @@ static ssize_t tracing_splice_read_pipe(
71081 size_t rem;
71082 unsigned int i;
71083
71084 + pax_track_stack();
71085 +
71086 if (splice_grow_spd(pipe, &spd))
71087 return -ENOMEM;
71088
71089 @@ -3813,6 +3815,8 @@ tracing_buffers_splice_read(struct file
71090 int entries, size, i;
71091 size_t ret;
71092
71093 + pax_track_stack();
71094 +
71095 if (splice_grow_spd(pipe, &spd))
71096 return -ENOMEM;
71097
71098 @@ -3981,10 +3985,9 @@ static const struct file_operations trac
71099 };
71100 #endif
71101
71102 -static struct dentry *d_tracer;
71103 -
71104 struct dentry *tracing_init_dentry(void)
71105 {
71106 + static struct dentry *d_tracer;
71107 static int once;
71108
71109 if (d_tracer)
71110 @@ -4004,10 +4007,9 @@ struct dentry *tracing_init_dentry(void)
71111 return d_tracer;
71112 }
71113
71114 -static struct dentry *d_percpu;
71115 -
71116 struct dentry *tracing_dentry_percpu(void)
71117 {
71118 + static struct dentry *d_percpu;
71119 static int once;
71120 struct dentry *d_tracer;
71121
71122 diff -urNp linux-2.6.39.1/kernel/trace/trace_events.c linux-2.6.39.1/kernel/trace/trace_events.c
71123 --- linux-2.6.39.1/kernel/trace/trace_events.c 2011-05-19 00:06:34.000000000 -0400
71124 +++ linux-2.6.39.1/kernel/trace/trace_events.c 2011-05-22 19:36:33.000000000 -0400
71125 @@ -1241,10 +1241,10 @@ static LIST_HEAD(ftrace_module_file_list
71126 struct ftrace_module_file_ops {
71127 struct list_head list;
71128 struct module *mod;
71129 - struct file_operations id;
71130 - struct file_operations enable;
71131 - struct file_operations format;
71132 - struct file_operations filter;
71133 + struct file_operations id; /* cannot be const, see trace_create_file_ops() */
71134 + struct file_operations enable; /* cannot be const, see trace_create_file_ops() */
71135 + struct file_operations format; /* cannot be const, see trace_create_file_ops() */
71136 + struct file_operations filter; /* cannot be const, see trace_create_file_ops() */
71137 };
71138
71139 static struct ftrace_module_file_ops *
71140 diff -urNp linux-2.6.39.1/kernel/trace/trace_functions.c linux-2.6.39.1/kernel/trace/trace_functions.c
71141 --- linux-2.6.39.1/kernel/trace/trace_functions.c 2011-05-19 00:06:34.000000000 -0400
71142 +++ linux-2.6.39.1/kernel/trace/trace_functions.c 2011-05-22 19:36:33.000000000 -0400
71143 @@ -308,7 +308,7 @@ ftrace_trace_onoff_print(struct seq_file
71144 static int
71145 ftrace_trace_onoff_unreg(char *glob, char *cmd, char *param)
71146 {
71147 - struct ftrace_probe_ops *ops;
71148 + const struct ftrace_probe_ops *ops;
71149
71150 /* we register both traceon and traceoff to this callback */
71151 if (strcmp(cmd, "traceon") == 0)
71152 diff -urNp linux-2.6.39.1/kernel/trace/trace_mmiotrace.c linux-2.6.39.1/kernel/trace/trace_mmiotrace.c
71153 --- linux-2.6.39.1/kernel/trace/trace_mmiotrace.c 2011-05-19 00:06:34.000000000 -0400
71154 +++ linux-2.6.39.1/kernel/trace/trace_mmiotrace.c 2011-05-22 19:36:33.000000000 -0400
71155 @@ -24,7 +24,7 @@ struct header_iter {
71156 static struct trace_array *mmio_trace_array;
71157 static bool overrun_detected;
71158 static unsigned long prev_overruns;
71159 -static atomic_t dropped_count;
71160 +static atomic_unchecked_t dropped_count;
71161
71162 static void mmio_reset_data(struct trace_array *tr)
71163 {
71164 @@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
71165
71166 static unsigned long count_overruns(struct trace_iterator *iter)
71167 {
71168 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
71169 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
71170 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
71171
71172 if (over > prev_overruns)
71173 @@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct
71174 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
71175 sizeof(*entry), 0, pc);
71176 if (!event) {
71177 - atomic_inc(&dropped_count);
71178 + atomic_inc_unchecked(&dropped_count);
71179 return;
71180 }
71181 entry = ring_buffer_event_data(event);
71182 @@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
71183 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
71184 sizeof(*entry), 0, pc);
71185 if (!event) {
71186 - atomic_inc(&dropped_count);
71187 + atomic_inc_unchecked(&dropped_count);
71188 return;
71189 }
71190 entry = ring_buffer_event_data(event);
71191 diff -urNp linux-2.6.39.1/kernel/trace/trace_output.c linux-2.6.39.1/kernel/trace/trace_output.c
71192 --- linux-2.6.39.1/kernel/trace/trace_output.c 2011-05-19 00:06:34.000000000 -0400
71193 +++ linux-2.6.39.1/kernel/trace/trace_output.c 2011-05-22 19:36:33.000000000 -0400
71194 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s,
71195
71196 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
71197 if (!IS_ERR(p)) {
71198 - p = mangle_path(s->buffer + s->len, p, "\n");
71199 + p = mangle_path(s->buffer + s->len, p, "\n\\");
71200 if (p) {
71201 s->len = p - s->buffer;
71202 return 1;
71203 diff -urNp linux-2.6.39.1/kernel/trace/trace_stack.c linux-2.6.39.1/kernel/trace/trace_stack.c
71204 --- linux-2.6.39.1/kernel/trace/trace_stack.c 2011-05-19 00:06:34.000000000 -0400
71205 +++ linux-2.6.39.1/kernel/trace/trace_stack.c 2011-05-22 19:36:33.000000000 -0400
71206 @@ -50,7 +50,7 @@ static inline void check_stack(void)
71207 return;
71208
71209 /* we do not handle interrupt stacks yet */
71210 - if (!object_is_on_stack(&this_size))
71211 + if (!object_starts_on_stack(&this_size))
71212 return;
71213
71214 local_irq_save(flags);
71215 diff -urNp linux-2.6.39.1/kernel/trace/trace_workqueue.c linux-2.6.39.1/kernel/trace/trace_workqueue.c
71216 --- linux-2.6.39.1/kernel/trace/trace_workqueue.c 2011-05-19 00:06:34.000000000 -0400
71217 +++ linux-2.6.39.1/kernel/trace/trace_workqueue.c 2011-05-22 19:36:33.000000000 -0400
71218 @@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
71219 int cpu;
71220 pid_t pid;
71221 /* Can be inserted from interrupt or user context, need to be atomic */
71222 - atomic_t inserted;
71223 + atomic_unchecked_t inserted;
71224 /*
71225 * Don't need to be atomic, works are serialized in a single workqueue thread
71226 * on a single CPU.
71227 @@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
71228 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
71229 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
71230 if (node->pid == wq_thread->pid) {
71231 - atomic_inc(&node->inserted);
71232 + atomic_inc_unchecked(&node->inserted);
71233 goto found;
71234 }
71235 }
71236 @@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
71237 tsk = get_pid_task(pid, PIDTYPE_PID);
71238 if (tsk) {
71239 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
71240 - atomic_read(&cws->inserted), cws->executed,
71241 + atomic_read_unchecked(&cws->inserted), cws->executed,
71242 tsk->comm);
71243 put_task_struct(tsk);
71244 }
71245 diff -urNp linux-2.6.39.1/lib/bug.c linux-2.6.39.1/lib/bug.c
71246 --- linux-2.6.39.1/lib/bug.c 2011-05-19 00:06:34.000000000 -0400
71247 +++ linux-2.6.39.1/lib/bug.c 2011-05-22 19:36:33.000000000 -0400
71248 @@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
71249 return BUG_TRAP_TYPE_NONE;
71250
71251 bug = find_bug(bugaddr);
71252 + if (!bug)
71253 + return BUG_TRAP_TYPE_NONE;
71254
71255 file = NULL;
71256 line = 0;
71257 diff -urNp linux-2.6.39.1/lib/debugobjects.c linux-2.6.39.1/lib/debugobjects.c
71258 --- linux-2.6.39.1/lib/debugobjects.c 2011-05-19 00:06:34.000000000 -0400
71259 +++ linux-2.6.39.1/lib/debugobjects.c 2011-05-22 19:36:33.000000000 -0400
71260 @@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi
71261 if (limit > 4)
71262 return;
71263
71264 - is_on_stack = object_is_on_stack(addr);
71265 + is_on_stack = object_starts_on_stack(addr);
71266 if (is_on_stack == onstack)
71267 return;
71268
71269 diff -urNp linux-2.6.39.1/lib/dma-debug.c linux-2.6.39.1/lib/dma-debug.c
71270 --- linux-2.6.39.1/lib/dma-debug.c 2011-05-19 00:06:34.000000000 -0400
71271 +++ linux-2.6.39.1/lib/dma-debug.c 2011-05-22 19:36:33.000000000 -0400
71272 @@ -862,7 +862,7 @@ out:
71273
71274 static void check_for_stack(struct device *dev, void *addr)
71275 {
71276 - if (object_is_on_stack(addr))
71277 + if (object_starts_on_stack(addr))
71278 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
71279 "stack [addr=%p]\n", addr);
71280 }
71281 diff -urNp linux-2.6.39.1/lib/inflate.c linux-2.6.39.1/lib/inflate.c
71282 --- linux-2.6.39.1/lib/inflate.c 2011-05-19 00:06:34.000000000 -0400
71283 +++ linux-2.6.39.1/lib/inflate.c 2011-05-22 19:36:33.000000000 -0400
71284 @@ -269,7 +269,7 @@ static void free(void *where)
71285 malloc_ptr = free_mem_ptr;
71286 }
71287 #else
71288 -#define malloc(a) kmalloc(a, GFP_KERNEL)
71289 +#define malloc(a) kmalloc((a), GFP_KERNEL)
71290 #define free(a) kfree(a)
71291 #endif
71292
71293 diff -urNp linux-2.6.39.1/lib/Kconfig.debug linux-2.6.39.1/lib/Kconfig.debug
71294 --- linux-2.6.39.1/lib/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
71295 +++ linux-2.6.39.1/lib/Kconfig.debug 2011-05-22 19:41:42.000000000 -0400
71296 @@ -1078,6 +1078,7 @@ config LATENCYTOP
71297 depends on DEBUG_KERNEL
71298 depends on STACKTRACE_SUPPORT
71299 depends on PROC_FS
71300 + depends on !GRKERNSEC_HIDESYM
71301 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
71302 select KALLSYMS
71303 select KALLSYMS_ALL
71304 diff -urNp linux-2.6.39.1/lib/kref.c linux-2.6.39.1/lib/kref.c
71305 --- linux-2.6.39.1/lib/kref.c 2011-05-19 00:06:34.000000000 -0400
71306 +++ linux-2.6.39.1/lib/kref.c 2011-05-22 19:36:33.000000000 -0400
71307 @@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
71308 */
71309 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
71310 {
71311 - WARN_ON(release == NULL);
71312 + BUG_ON(release == NULL);
71313 WARN_ON(release == (void (*)(struct kref *))kfree);
71314
71315 if (atomic_dec_and_test(&kref->refcount)) {
71316 diff -urNp linux-2.6.39.1/lib/radix-tree.c linux-2.6.39.1/lib/radix-tree.c
71317 --- linux-2.6.39.1/lib/radix-tree.c 2011-05-19 00:06:34.000000000 -0400
71318 +++ linux-2.6.39.1/lib/radix-tree.c 2011-05-22 19:36:33.000000000 -0400
71319 @@ -80,7 +80,7 @@ struct radix_tree_preload {
71320 int nr;
71321 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
71322 };
71323 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
71324 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
71325
71326 static inline void *ptr_to_indirect(void *ptr)
71327 {
71328 diff -urNp linux-2.6.39.1/lib/vsprintf.c linux-2.6.39.1/lib/vsprintf.c
71329 --- linux-2.6.39.1/lib/vsprintf.c 2011-05-19 00:06:34.000000000 -0400
71330 +++ linux-2.6.39.1/lib/vsprintf.c 2011-05-22 20:54:59.000000000 -0400
71331 @@ -16,6 +16,9 @@
71332 * - scnprintf and vscnprintf
71333 */
71334
71335 +#ifdef CONFIG_GRKERNSEC_HIDESYM
71336 +#define __INCLUDED_BY_HIDESYM 1
71337 +#endif
71338 #include <stdarg.h>
71339 #include <linux/module.h>
71340 #include <linux/types.h>
71341 @@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end
71342 char sym[KSYM_SYMBOL_LEN];
71343 if (ext == 'B')
71344 sprint_backtrace(sym, value);
71345 - else if (ext != 'f' && ext != 's')
71346 + else if (ext != 'f' && ext != 's' && ext != 'a')
71347 sprint_symbol(sym, value);
71348 else
71349 kallsyms_lookup(value, NULL, NULL, NULL, sym);
71350 @@ -797,7 +800,11 @@ char *uuid_string(char *buf, char *end,
71351 return string(buf, end, uuid, spec);
71352 }
71353
71354 +#ifdef CONFIG_GRKERNSEC_HIDESYM
71355 +int kptr_restrict __read_mostly = 2;
71356 +#else
71357 int kptr_restrict __read_mostly;
71358 +#endif
71359
71360 /*
71361 * Show a '%p' thing. A kernel extension is that the '%p' is followed
71362 @@ -811,6 +818,8 @@ int kptr_restrict __read_mostly;
71363 * - 'S' For symbolic direct pointers with offset
71364 * - 's' For symbolic direct pointers without offset
71365 * - 'B' For backtraced symbolic direct pointers with offset
71366 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
71367 + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
71368 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
71369 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
71370 * - 'M' For a 6-byte MAC address, it prints the address in the
71371 @@ -855,12 +864,12 @@ char *pointer(const char *fmt, char *buf
71372 {
71373 if (!ptr && *fmt != 'K') {
71374 /*
71375 - * Print (null) with the same width as a pointer so it makes
71376 + * Print (nil) with the same width as a pointer so it makes
71377 * tabular output look nice.
71378 */
71379 if (spec.field_width == -1)
71380 spec.field_width = 2 * sizeof(void *);
71381 - return string(buf, end, "(null)", spec);
71382 + return string(buf, end, "(nil)", spec);
71383 }
71384
71385 switch (*fmt) {
71386 @@ -870,6 +879,13 @@ char *pointer(const char *fmt, char *buf
71387 /* Fallthrough */
71388 case 'S':
71389 case 's':
71390 +#ifdef CONFIG_GRKERNSEC_HIDESYM
71391 + break;
71392 +#else
71393 + return symbol_string(buf, end, ptr, spec, *fmt);
71394 +#endif
71395 + case 'A':
71396 + case 'a':
71397 case 'B':
71398 return symbol_string(buf, end, ptr, spec, *fmt);
71399 case 'R':
71400 @@ -1632,11 +1648,11 @@ int bstr_printf(char *buf, size_t size,
71401 typeof(type) value; \
71402 if (sizeof(type) == 8) { \
71403 args = PTR_ALIGN(args, sizeof(u32)); \
71404 - *(u32 *)&value = *(u32 *)args; \
71405 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
71406 + *(u32 *)&value = *(const u32 *)args; \
71407 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
71408 } else { \
71409 args = PTR_ALIGN(args, sizeof(type)); \
71410 - value = *(typeof(type) *)args; \
71411 + value = *(const typeof(type) *)args; \
71412 } \
71413 args += sizeof(type); \
71414 value; \
71415 @@ -1699,7 +1715,7 @@ int bstr_printf(char *buf, size_t size,
71416 case FORMAT_TYPE_STR: {
71417 const char *str_arg = args;
71418 args += strlen(str_arg) + 1;
71419 - str = string(str, end, (char *)str_arg, spec);
71420 + str = string(str, end, str_arg, spec);
71421 break;
71422 }
71423
71424 diff -urNp linux-2.6.39.1/localversion-grsec linux-2.6.39.1/localversion-grsec
71425 --- linux-2.6.39.1/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
71426 +++ linux-2.6.39.1/localversion-grsec 2011-05-22 19:41:42.000000000 -0400
71427 @@ -0,0 +1 @@
71428 +-grsec
71429 diff -urNp linux-2.6.39.1/Makefile linux-2.6.39.1/Makefile
71430 --- linux-2.6.39.1/Makefile 2011-06-03 00:04:13.000000000 -0400
71431 +++ linux-2.6.39.1/Makefile 2011-06-04 17:40:47.000000000 -0400
71432 @@ -237,8 +237,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
71433
71434 HOSTCC = gcc
71435 HOSTCXX = g++
71436 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
71437 -HOSTCXXFLAGS = -O2
71438 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
71439 +HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
71440 +HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
71441
71442 # Decide whether to build built-in, modular, or both.
71443 # Normally, just do built-in.
71444 @@ -356,10 +357,12 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h
71445 KBUILD_CPPFLAGS := -D__KERNEL__
71446
71447 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
71448 + -W -Wno-unused-parameter -Wno-missing-field-initializers \
71449 -fno-strict-aliasing -fno-common \
71450 -Werror-implicit-function-declaration \
71451 -Wno-format-security \
71452 -fno-delete-null-pointer-checks
71453 +KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
71454 KBUILD_AFLAGS_KERNEL :=
71455 KBUILD_CFLAGS_KERNEL :=
71456 KBUILD_AFLAGS := -D__ASSEMBLY__
71457 @@ -685,7 +688,7 @@ export mod_strip_cmd
71458
71459
71460 ifeq ($(KBUILD_EXTMOD),)
71461 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
71462 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
71463
71464 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
71465 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
71466 @@ -931,7 +934,19 @@ include/config/kernel.release: include/c
71467 # version.h and scripts_basic is processed / created.
71468
71469 # Listed in dependency order
71470 -PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
71471 +PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3 pax-plugin
71472 +
71473 +ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
71474 +KBUILD_CFLAGS += $(call cc-ifversion, -ge, 0405, -fplugin=$(objtree)/tools/gcc/pax_plugin.so -fplugin-arg-pax_plugin-track-lowest-sp=100)
71475 +endif
71476 +pax-plugin:
71477 +ifneq (,$(findstring pax_plugin, $(KBUILD_CFLAGS)))
71478 + $(Q)$(MAKE) $(build)=tools/gcc
71479 +else
71480 +ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
71481 + $(Q)echo "warning, your gcc does not support plugins, PAX_MEMORY_STACKLEAK will be less secure"
71482 +endif
71483 +endif
71484
71485 # prepare3 is used to check if we are building in a separate output directory,
71486 # and if so do:
71487 @@ -947,7 +962,7 @@ ifneq ($(KBUILD_SRC),)
71488 endif
71489
71490 # prepare2 creates a makefile if using a separate output directory
71491 -prepare2: prepare3 outputmakefile
71492 +prepare2: prepare3 outputmakefile pax-plugin
71493
71494 prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
71495 include/config/auto.conf
71496 diff -urNp linux-2.6.39.1/mm/filemap.c linux-2.6.39.1/mm/filemap.c
71497 --- linux-2.6.39.1/mm/filemap.c 2011-05-19 00:06:34.000000000 -0400
71498 +++ linux-2.6.39.1/mm/filemap.c 2011-05-22 19:41:42.000000000 -0400
71499 @@ -1724,7 +1724,7 @@ int generic_file_mmap(struct file * file
71500 struct address_space *mapping = file->f_mapping;
71501
71502 if (!mapping->a_ops->readpage)
71503 - return -ENOEXEC;
71504 + return -ENODEV;
71505 file_accessed(file);
71506 vma->vm_ops = &generic_file_vm_ops;
71507 vma->vm_flags |= VM_CAN_NONLINEAR;
71508 @@ -2120,6 +2120,7 @@ inline int generic_write_checks(struct f
71509 *pos = i_size_read(inode);
71510
71511 if (limit != RLIM_INFINITY) {
71512 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
71513 if (*pos >= limit) {
71514 send_sig(SIGXFSZ, current, 0);
71515 return -EFBIG;
71516 diff -urNp linux-2.6.39.1/mm/fremap.c linux-2.6.39.1/mm/fremap.c
71517 --- linux-2.6.39.1/mm/fremap.c 2011-05-19 00:06:34.000000000 -0400
71518 +++ linux-2.6.39.1/mm/fremap.c 2011-05-22 19:36:33.000000000 -0400
71519 @@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71520 retry:
71521 vma = find_vma(mm, start);
71522
71523 +#ifdef CONFIG_PAX_SEGMEXEC
71524 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
71525 + goto out;
71526 +#endif
71527 +
71528 /*
71529 * Make sure the vma is shared, that it supports prefaulting,
71530 * and that the remapped range is valid and fully within
71531 @@ -224,7 +229,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71532 /*
71533 * drop PG_Mlocked flag for over-mapped range
71534 */
71535 - unsigned int saved_flags = vma->vm_flags;
71536 + unsigned long saved_flags = vma->vm_flags;
71537 munlock_vma_pages_range(vma, start, start + size);
71538 vma->vm_flags = saved_flags;
71539 }
71540 diff -urNp linux-2.6.39.1/mm/highmem.c linux-2.6.39.1/mm/highmem.c
71541 --- linux-2.6.39.1/mm/highmem.c 2011-05-19 00:06:34.000000000 -0400
71542 +++ linux-2.6.39.1/mm/highmem.c 2011-05-22 19:36:33.000000000 -0400
71543 @@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
71544 * So no dangers, even with speculative execution.
71545 */
71546 page = pte_page(pkmap_page_table[i]);
71547 + pax_open_kernel();
71548 pte_clear(&init_mm, (unsigned long)page_address(page),
71549 &pkmap_page_table[i]);
71550 -
71551 + pax_close_kernel();
71552 set_page_address(page, NULL);
71553 need_flush = 1;
71554 }
71555 @@ -186,9 +187,11 @@ start:
71556 }
71557 }
71558 vaddr = PKMAP_ADDR(last_pkmap_nr);
71559 +
71560 + pax_open_kernel();
71561 set_pte_at(&init_mm, vaddr,
71562 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
71563 -
71564 + pax_close_kernel();
71565 pkmap_count[last_pkmap_nr] = 1;
71566 set_page_address(page, (void *)vaddr);
71567
71568 diff -urNp linux-2.6.39.1/mm/huge_memory.c linux-2.6.39.1/mm/huge_memory.c
71569 --- linux-2.6.39.1/mm/huge_memory.c 2011-05-19 00:06:34.000000000 -0400
71570 +++ linux-2.6.39.1/mm/huge_memory.c 2011-05-22 19:36:33.000000000 -0400
71571 @@ -702,7 +702,7 @@ out:
71572 * run pte_offset_map on the pmd, if an huge pmd could
71573 * materialize from under us from a different thread.
71574 */
71575 - if (unlikely(__pte_alloc(mm, vma, pmd, address)))
71576 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71577 return VM_FAULT_OOM;
71578 /* if an huge pmd materialized from under us just retry later */
71579 if (unlikely(pmd_trans_huge(*pmd)))
71580 diff -urNp linux-2.6.39.1/mm/hugetlb.c linux-2.6.39.1/mm/hugetlb.c
71581 --- linux-2.6.39.1/mm/hugetlb.c 2011-05-19 00:06:34.000000000 -0400
71582 +++ linux-2.6.39.1/mm/hugetlb.c 2011-05-22 19:36:33.000000000 -0400
71583 @@ -2331,6 +2331,27 @@ static int unmap_ref_private(struct mm_s
71584 return 1;
71585 }
71586
71587 +#ifdef CONFIG_PAX_SEGMEXEC
71588 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
71589 +{
71590 + struct mm_struct *mm = vma->vm_mm;
71591 + struct vm_area_struct *vma_m;
71592 + unsigned long address_m;
71593 + pte_t *ptep_m;
71594 +
71595 + vma_m = pax_find_mirror_vma(vma);
71596 + if (!vma_m)
71597 + return;
71598 +
71599 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71600 + address_m = address + SEGMEXEC_TASK_SIZE;
71601 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
71602 + get_page(page_m);
71603 + hugepage_add_anon_rmap(page_m, vma_m, address_m);
71604 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
71605 +}
71606 +#endif
71607 +
71608 /*
71609 * Hugetlb_cow() should be called with page lock of the original hugepage held.
71610 */
71611 @@ -2432,6 +2453,11 @@ retry_avoidcopy:
71612 make_huge_pte(vma, new_page, 1));
71613 page_remove_rmap(old_page);
71614 hugepage_add_new_anon_rmap(new_page, vma, address);
71615 +
71616 +#ifdef CONFIG_PAX_SEGMEXEC
71617 + pax_mirror_huge_pte(vma, address, new_page);
71618 +#endif
71619 +
71620 /* Make the old page be freed below */
71621 new_page = old_page;
71622 mmu_notifier_invalidate_range_end(mm,
71623 @@ -2583,6 +2609,10 @@ retry:
71624 && (vma->vm_flags & VM_SHARED)));
71625 set_huge_pte_at(mm, address, ptep, new_pte);
71626
71627 +#ifdef CONFIG_PAX_SEGMEXEC
71628 + pax_mirror_huge_pte(vma, address, page);
71629 +#endif
71630 +
71631 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
71632 /* Optimization, do the COW without a second fault */
71633 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
71634 @@ -2612,6 +2642,10 @@ int hugetlb_fault(struct mm_struct *mm,
71635 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
71636 struct hstate *h = hstate_vma(vma);
71637
71638 +#ifdef CONFIG_PAX_SEGMEXEC
71639 + struct vm_area_struct *vma_m;
71640 +#endif
71641 +
71642 ptep = huge_pte_offset(mm, address);
71643 if (ptep) {
71644 entry = huge_ptep_get(ptep);
71645 @@ -2623,6 +2657,26 @@ int hugetlb_fault(struct mm_struct *mm,
71646 VM_FAULT_SET_HINDEX(h - hstates);
71647 }
71648
71649 +#ifdef CONFIG_PAX_SEGMEXEC
71650 + vma_m = pax_find_mirror_vma(vma);
71651 + if (vma_m) {
71652 + unsigned long address_m;
71653 +
71654 + if (vma->vm_start > vma_m->vm_start) {
71655 + address_m = address;
71656 + address -= SEGMEXEC_TASK_SIZE;
71657 + vma = vma_m;
71658 + h = hstate_vma(vma);
71659 + } else
71660 + address_m = address + SEGMEXEC_TASK_SIZE;
71661 +
71662 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71663 + return VM_FAULT_OOM;
71664 + address_m &= HPAGE_MASK;
71665 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71666 + }
71667 +#endif
71668 +
71669 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71670 if (!ptep)
71671 return VM_FAULT_OOM;
71672 diff -urNp linux-2.6.39.1/mm/Kconfig linux-2.6.39.1/mm/Kconfig
71673 --- linux-2.6.39.1/mm/Kconfig 2011-05-19 00:06:34.000000000 -0400
71674 +++ linux-2.6.39.1/mm/Kconfig 2011-05-22 19:41:42.000000000 -0400
71675 @@ -240,7 +240,7 @@ config KSM
71676 config DEFAULT_MMAP_MIN_ADDR
71677 int "Low address space to protect from user allocation"
71678 depends on MMU
71679 - default 4096
71680 + default 65536
71681 help
71682 This is the portion of low virtual memory which should be protected
71683 from userspace allocation. Keeping a user from writing to low pages
71684 diff -urNp linux-2.6.39.1/mm/kmemleak.c linux-2.6.39.1/mm/kmemleak.c
71685 --- linux-2.6.39.1/mm/kmemleak.c 2011-06-03 00:04:14.000000000 -0400
71686 +++ linux-2.6.39.1/mm/kmemleak.c 2011-06-03 00:32:08.000000000 -0400
71687 @@ -357,7 +357,7 @@ static void print_unreferenced(struct se
71688
71689 for (i = 0; i < object->trace_len; i++) {
71690 void *ptr = (void *)object->trace[i];
71691 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71692 + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71693 }
71694 }
71695
71696 diff -urNp linux-2.6.39.1/mm/ksm.c linux-2.6.39.1/mm/ksm.c
71697 --- linux-2.6.39.1/mm/ksm.c 2011-05-19 00:06:34.000000000 -0400
71698 +++ linux-2.6.39.1/mm/ksm.c 2011-06-20 19:42:16.000000000 -0400
71699 @@ -1301,6 +1301,12 @@ static struct rmap_item *scan_get_next_r
71700 slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
71701 ksm_scan.mm_slot = slot;
71702 spin_unlock(&ksm_mmlist_lock);
71703 + /*
71704 + * Although we tested list_empty() above, a racing __ksm_exit
71705 + * of the last mm on the list may have removed it since then.
71706 + */
71707 + if (slot == &ksm_mm_head)
71708 + return NULL;
71709 next_mm:
71710 ksm_scan.address = 0;
71711 ksm_scan.rmap_list = &slot->rmap_list;
71712 diff -urNp linux-2.6.39.1/mm/maccess.c linux-2.6.39.1/mm/maccess.c
71713 --- linux-2.6.39.1/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
71714 +++ linux-2.6.39.1/mm/maccess.c 2011-05-22 19:36:33.000000000 -0400
71715 @@ -15,10 +15,10 @@
71716 * happens, handle that and return -EFAULT.
71717 */
71718
71719 -long __weak probe_kernel_read(void *dst, void *src, size_t size)
71720 +long __weak probe_kernel_read(void *dst, const void *src, size_t size)
71721 __attribute__((alias("__probe_kernel_read")));
71722
71723 -long __probe_kernel_read(void *dst, void *src, size_t size)
71724 +long __probe_kernel_read(void *dst, const void *src, size_t size)
71725 {
71726 long ret;
71727 mm_segment_t old_fs = get_fs();
71728 @@ -43,10 +43,10 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
71729 * Safely write to address @dst from the buffer at @src. If a kernel fault
71730 * happens, handle that and return -EFAULT.
71731 */
71732 -long __weak probe_kernel_write(void *dst, void *src, size_t size)
71733 +long __weak probe_kernel_write(void *dst, const void *src, size_t size)
71734 __attribute__((alias("__probe_kernel_write")));
71735
71736 -long __probe_kernel_write(void *dst, void *src, size_t size)
71737 +long __probe_kernel_write(void *dst, const void *src, size_t size)
71738 {
71739 long ret;
71740 mm_segment_t old_fs = get_fs();
71741 diff -urNp linux-2.6.39.1/mm/madvise.c linux-2.6.39.1/mm/madvise.c
71742 --- linux-2.6.39.1/mm/madvise.c 2011-05-19 00:06:34.000000000 -0400
71743 +++ linux-2.6.39.1/mm/madvise.c 2011-05-22 19:36:33.000000000 -0400
71744 @@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
71745 pgoff_t pgoff;
71746 unsigned long new_flags = vma->vm_flags;
71747
71748 +#ifdef CONFIG_PAX_SEGMEXEC
71749 + struct vm_area_struct *vma_m;
71750 +#endif
71751 +
71752 switch (behavior) {
71753 case MADV_NORMAL:
71754 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
71755 @@ -110,6 +114,13 @@ success:
71756 /*
71757 * vm_flags is protected by the mmap_sem held in write mode.
71758 */
71759 +
71760 +#ifdef CONFIG_PAX_SEGMEXEC
71761 + vma_m = pax_find_mirror_vma(vma);
71762 + if (vma_m)
71763 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71764 +#endif
71765 +
71766 vma->vm_flags = new_flags;
71767
71768 out:
71769 @@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a
71770 struct vm_area_struct ** prev,
71771 unsigned long start, unsigned long end)
71772 {
71773 +
71774 +#ifdef CONFIG_PAX_SEGMEXEC
71775 + struct vm_area_struct *vma_m;
71776 +#endif
71777 +
71778 *prev = vma;
71779 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71780 return -EINVAL;
71781 @@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a
71782 zap_page_range(vma, start, end - start, &details);
71783 } else
71784 zap_page_range(vma, start, end - start, NULL);
71785 +
71786 +#ifdef CONFIG_PAX_SEGMEXEC
71787 + vma_m = pax_find_mirror_vma(vma);
71788 + if (vma_m) {
71789 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71790 + struct zap_details details = {
71791 + .nonlinear_vma = vma_m,
71792 + .last_index = ULONG_MAX,
71793 + };
71794 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71795 + } else
71796 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71797 + }
71798 +#endif
71799 +
71800 return 0;
71801 }
71802
71803 @@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
71804 if (end < start)
71805 goto out;
71806
71807 +#ifdef CONFIG_PAX_SEGMEXEC
71808 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71809 + if (end > SEGMEXEC_TASK_SIZE)
71810 + goto out;
71811 + } else
71812 +#endif
71813 +
71814 + if (end > TASK_SIZE)
71815 + goto out;
71816 +
71817 error = 0;
71818 if (end == start)
71819 goto out;
71820 diff -urNp linux-2.6.39.1/mm/memory.c linux-2.6.39.1/mm/memory.c
71821 --- linux-2.6.39.1/mm/memory.c 2011-05-19 00:06:34.000000000 -0400
71822 +++ linux-2.6.39.1/mm/memory.c 2011-05-22 19:36:33.000000000 -0400
71823 @@ -259,8 +259,12 @@ static inline void free_pmd_range(struct
71824 return;
71825
71826 pmd = pmd_offset(pud, start);
71827 +
71828 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
71829 pud_clear(pud);
71830 pmd_free_tlb(tlb, pmd, start);
71831 +#endif
71832 +
71833 }
71834
71835 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71836 @@ -291,9 +295,12 @@ static inline void free_pud_range(struct
71837 if (end - 1 > ceiling - 1)
71838 return;
71839
71840 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
71841 pud = pud_offset(pgd, start);
71842 pgd_clear(pgd);
71843 pud_free_tlb(tlb, pud, start);
71844 +#endif
71845 +
71846 }
71847
71848 /*
71849 @@ -1410,12 +1417,6 @@ no_page_table:
71850 return page;
71851 }
71852
71853 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
71854 -{
71855 - return stack_guard_page_start(vma, addr) ||
71856 - stack_guard_page_end(vma, addr+PAGE_SIZE);
71857 -}
71858 -
71859 /**
71860 * __get_user_pages() - pin user pages in memory
71861 * @tsk: task_struct of target task
71862 @@ -1488,10 +1489,10 @@ int __get_user_pages(struct task_struct
71863 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
71864 i = 0;
71865
71866 - do {
71867 + while (nr_pages) {
71868 struct vm_area_struct *vma;
71869
71870 - vma = find_extend_vma(mm, start);
71871 + vma = find_vma(mm, start);
71872 if (!vma && in_gate_area(mm, start)) {
71873 unsigned long pg = start & PAGE_MASK;
71874 pgd_t *pgd;
71875 @@ -1539,7 +1540,7 @@ int __get_user_pages(struct task_struct
71876 goto next_page;
71877 }
71878
71879 - if (!vma ||
71880 + if (!vma || start < vma->vm_start ||
71881 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
71882 !(vm_flags & vma->vm_flags))
71883 return i ? : -EFAULT;
71884 @@ -1566,11 +1567,6 @@ int __get_user_pages(struct task_struct
71885 int ret;
71886 unsigned int fault_flags = 0;
71887
71888 - /* For mlock, just skip the stack guard page. */
71889 - if (foll_flags & FOLL_MLOCK) {
71890 - if (stack_guard_page(vma, start))
71891 - goto next_page;
71892 - }
71893 if (foll_flags & FOLL_WRITE)
71894 fault_flags |= FAULT_FLAG_WRITE;
71895 if (nonblocking)
71896 @@ -1644,7 +1640,7 @@ next_page:
71897 start += PAGE_SIZE;
71898 nr_pages--;
71899 } while (nr_pages && start < vma->vm_end);
71900 - } while (nr_pages);
71901 + }
71902 return i;
71903 }
71904 EXPORT_SYMBOL(__get_user_pages);
71905 @@ -1795,6 +1791,10 @@ static int insert_page(struct vm_area_st
71906 page_add_file_rmap(page);
71907 set_pte_at(mm, addr, pte, mk_pte(page, prot));
71908
71909 +#ifdef CONFIG_PAX_SEGMEXEC
71910 + pax_mirror_file_pte(vma, addr, page, ptl);
71911 +#endif
71912 +
71913 retval = 0;
71914 pte_unmap_unlock(pte, ptl);
71915 return retval;
71916 @@ -1829,10 +1829,22 @@ out:
71917 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
71918 struct page *page)
71919 {
71920 +
71921 +#ifdef CONFIG_PAX_SEGMEXEC
71922 + struct vm_area_struct *vma_m;
71923 +#endif
71924 +
71925 if (addr < vma->vm_start || addr >= vma->vm_end)
71926 return -EFAULT;
71927 if (!page_count(page))
71928 return -EINVAL;
71929 +
71930 +#ifdef CONFIG_PAX_SEGMEXEC
71931 + vma_m = pax_find_mirror_vma(vma);
71932 + if (vma_m)
71933 + vma_m->vm_flags |= VM_INSERTPAGE;
71934 +#endif
71935 +
71936 vma->vm_flags |= VM_INSERTPAGE;
71937 return insert_page(vma, addr, page, vma->vm_page_prot);
71938 }
71939 @@ -1918,6 +1930,7 @@ int vm_insert_mixed(struct vm_area_struc
71940 unsigned long pfn)
71941 {
71942 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
71943 + BUG_ON(vma->vm_mirror);
71944
71945 if (addr < vma->vm_start || addr >= vma->vm_end)
71946 return -EFAULT;
71947 @@ -2233,6 +2246,186 @@ static inline void cow_user_page(struct
71948 copy_user_highpage(dst, src, va, vma);
71949 }
71950
71951 +#ifdef CONFIG_PAX_SEGMEXEC
71952 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
71953 +{
71954 + struct mm_struct *mm = vma->vm_mm;
71955 + spinlock_t *ptl;
71956 + pte_t *pte, entry;
71957 +
71958 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
71959 + entry = *pte;
71960 + if (!pte_present(entry)) {
71961 + if (!pte_none(entry)) {
71962 + BUG_ON(pte_file(entry));
71963 + free_swap_and_cache(pte_to_swp_entry(entry));
71964 + pte_clear_not_present_full(mm, address, pte, 0);
71965 + }
71966 + } else {
71967 + struct page *page;
71968 +
71969 + flush_cache_page(vma, address, pte_pfn(entry));
71970 + entry = ptep_clear_flush(vma, address, pte);
71971 + BUG_ON(pte_dirty(entry));
71972 + page = vm_normal_page(vma, address, entry);
71973 + if (page) {
71974 + update_hiwater_rss(mm);
71975 + if (PageAnon(page))
71976 + dec_mm_counter_fast(mm, MM_ANONPAGES);
71977 + else
71978 + dec_mm_counter_fast(mm, MM_FILEPAGES);
71979 + page_remove_rmap(page);
71980 + page_cache_release(page);
71981 + }
71982 + }
71983 + pte_unmap_unlock(pte, ptl);
71984 +}
71985 +
71986 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
71987 + *
71988 + * the ptl of the lower mapped page is held on entry and is not released on exit
71989 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
71990 + */
71991 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71992 +{
71993 + struct mm_struct *mm = vma->vm_mm;
71994 + unsigned long address_m;
71995 + spinlock_t *ptl_m;
71996 + struct vm_area_struct *vma_m;
71997 + pmd_t *pmd_m;
71998 + pte_t *pte_m, entry_m;
71999 +
72000 + BUG_ON(!page_m || !PageAnon(page_m));
72001 +
72002 + vma_m = pax_find_mirror_vma(vma);
72003 + if (!vma_m)
72004 + return;
72005 +
72006 + BUG_ON(!PageLocked(page_m));
72007 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
72008 + address_m = address + SEGMEXEC_TASK_SIZE;
72009 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
72010 + pte_m = pte_offset_map(pmd_m, address_m);
72011 + ptl_m = pte_lockptr(mm, pmd_m);
72012 + if (ptl != ptl_m) {
72013 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
72014 + if (!pte_none(*pte_m))
72015 + goto out;
72016 + }
72017 +
72018 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
72019 + page_cache_get(page_m);
72020 + page_add_anon_rmap(page_m, vma_m, address_m);
72021 + inc_mm_counter_fast(mm, MM_ANONPAGES);
72022 + set_pte_at(mm, address_m, pte_m, entry_m);
72023 + update_mmu_cache(vma_m, address_m, entry_m);
72024 +out:
72025 + if (ptl != ptl_m)
72026 + spin_unlock(ptl_m);
72027 + pte_unmap(pte_m);
72028 + unlock_page(page_m);
72029 +}
72030 +
72031 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
72032 +{
72033 + struct mm_struct *mm = vma->vm_mm;
72034 + unsigned long address_m;
72035 + spinlock_t *ptl_m;
72036 + struct vm_area_struct *vma_m;
72037 + pmd_t *pmd_m;
72038 + pte_t *pte_m, entry_m;
72039 +
72040 + BUG_ON(!page_m || PageAnon(page_m));
72041 +
72042 + vma_m = pax_find_mirror_vma(vma);
72043 + if (!vma_m)
72044 + return;
72045 +
72046 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
72047 + address_m = address + SEGMEXEC_TASK_SIZE;
72048 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
72049 + pte_m = pte_offset_map(pmd_m, address_m);
72050 + ptl_m = pte_lockptr(mm, pmd_m);
72051 + if (ptl != ptl_m) {
72052 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
72053 + if (!pte_none(*pte_m))
72054 + goto out;
72055 + }
72056 +
72057 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
72058 + page_cache_get(page_m);
72059 + page_add_file_rmap(page_m);
72060 + inc_mm_counter_fast(mm, MM_FILEPAGES);
72061 + set_pte_at(mm, address_m, pte_m, entry_m);
72062 + update_mmu_cache(vma_m, address_m, entry_m);
72063 +out:
72064 + if (ptl != ptl_m)
72065 + spin_unlock(ptl_m);
72066 + pte_unmap(pte_m);
72067 +}
72068 +
72069 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
72070 +{
72071 + struct mm_struct *mm = vma->vm_mm;
72072 + unsigned long address_m;
72073 + spinlock_t *ptl_m;
72074 + struct vm_area_struct *vma_m;
72075 + pmd_t *pmd_m;
72076 + pte_t *pte_m, entry_m;
72077 +
72078 + vma_m = pax_find_mirror_vma(vma);
72079 + if (!vma_m)
72080 + return;
72081 +
72082 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
72083 + address_m = address + SEGMEXEC_TASK_SIZE;
72084 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
72085 + pte_m = pte_offset_map(pmd_m, address_m);
72086 + ptl_m = pte_lockptr(mm, pmd_m);
72087 + if (ptl != ptl_m) {
72088 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
72089 + if (!pte_none(*pte_m))
72090 + goto out;
72091 + }
72092 +
72093 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
72094 + set_pte_at(mm, address_m, pte_m, entry_m);
72095 +out:
72096 + if (ptl != ptl_m)
72097 + spin_unlock(ptl_m);
72098 + pte_unmap(pte_m);
72099 +}
72100 +
72101 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
72102 +{
72103 + struct page *page_m;
72104 + pte_t entry;
72105 +
72106 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
72107 + goto out;
72108 +
72109 + entry = *pte;
72110 + page_m = vm_normal_page(vma, address, entry);
72111 + if (!page_m)
72112 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
72113 + else if (PageAnon(page_m)) {
72114 + if (pax_find_mirror_vma(vma)) {
72115 + pte_unmap_unlock(pte, ptl);
72116 + lock_page(page_m);
72117 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
72118 + if (pte_same(entry, *pte))
72119 + pax_mirror_anon_pte(vma, address, page_m, ptl);
72120 + else
72121 + unlock_page(page_m);
72122 + }
72123 + } else
72124 + pax_mirror_file_pte(vma, address, page_m, ptl);
72125 +
72126 +out:
72127 + pte_unmap_unlock(pte, ptl);
72128 +}
72129 +#endif
72130 +
72131 /*
72132 * This routine handles present pages, when users try to write
72133 * to a shared page. It is done by copying the page to a new address
72134 @@ -2444,6 +2637,12 @@ gotten:
72135 */
72136 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72137 if (likely(pte_same(*page_table, orig_pte))) {
72138 +
72139 +#ifdef CONFIG_PAX_SEGMEXEC
72140 + if (pax_find_mirror_vma(vma))
72141 + BUG_ON(!trylock_page(new_page));
72142 +#endif
72143 +
72144 if (old_page) {
72145 if (!PageAnon(old_page)) {
72146 dec_mm_counter_fast(mm, MM_FILEPAGES);
72147 @@ -2495,6 +2694,10 @@ gotten:
72148 page_remove_rmap(old_page);
72149 }
72150
72151 +#ifdef CONFIG_PAX_SEGMEXEC
72152 + pax_mirror_anon_pte(vma, address, new_page, ptl);
72153 +#endif
72154 +
72155 /* Free the old page.. */
72156 new_page = old_page;
72157 ret |= VM_FAULT_WRITE;
72158 @@ -2905,6 +3108,11 @@ static int do_swap_page(struct mm_struct
72159 swap_free(entry);
72160 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
72161 try_to_free_swap(page);
72162 +
72163 +#ifdef CONFIG_PAX_SEGMEXEC
72164 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
72165 +#endif
72166 +
72167 unlock_page(page);
72168 if (swapcache) {
72169 /*
72170 @@ -2928,6 +3136,11 @@ static int do_swap_page(struct mm_struct
72171
72172 /* No need to invalidate - it was non-present before */
72173 update_mmu_cache(vma, address, page_table);
72174 +
72175 +#ifdef CONFIG_PAX_SEGMEXEC
72176 + pax_mirror_anon_pte(vma, address, page, ptl);
72177 +#endif
72178 +
72179 unlock:
72180 pte_unmap_unlock(page_table, ptl);
72181 out:
72182 @@ -2947,40 +3160,6 @@ out_release:
72183 }
72184
72185 /*
72186 - * This is like a special single-page "expand_{down|up}wards()",
72187 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
72188 - * doesn't hit another vma.
72189 - */
72190 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
72191 -{
72192 - address &= PAGE_MASK;
72193 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
72194 - struct vm_area_struct *prev = vma->vm_prev;
72195 -
72196 - /*
72197 - * Is there a mapping abutting this one below?
72198 - *
72199 - * That's only ok if it's the same stack mapping
72200 - * that has gotten split..
72201 - */
72202 - if (prev && prev->vm_end == address)
72203 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
72204 -
72205 - expand_stack(vma, address - PAGE_SIZE);
72206 - }
72207 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
72208 - struct vm_area_struct *next = vma->vm_next;
72209 -
72210 - /* As VM_GROWSDOWN but s/below/above/ */
72211 - if (next && next->vm_start == address + PAGE_SIZE)
72212 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
72213 -
72214 - expand_upwards(vma, address + PAGE_SIZE);
72215 - }
72216 - return 0;
72217 -}
72218 -
72219 -/*
72220 * We enter with non-exclusive mmap_sem (to exclude vma changes,
72221 * but allow concurrent faults), and pte mapped but not yet locked.
72222 * We return with mmap_sem still held, but pte unmapped and unlocked.
72223 @@ -2989,27 +3168,23 @@ static int do_anonymous_page(struct mm_s
72224 unsigned long address, pte_t *page_table, pmd_t *pmd,
72225 unsigned int flags)
72226 {
72227 - struct page *page;
72228 + struct page *page = NULL;
72229 spinlock_t *ptl;
72230 pte_t entry;
72231
72232 - pte_unmap(page_table);
72233 -
72234 - /* Check if we need to add a guard page to the stack */
72235 - if (check_stack_guard_page(vma, address) < 0)
72236 - return VM_FAULT_SIGBUS;
72237 -
72238 - /* Use the zero-page for reads */
72239 if (!(flags & FAULT_FLAG_WRITE)) {
72240 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
72241 vma->vm_page_prot));
72242 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72243 + ptl = pte_lockptr(mm, pmd);
72244 + spin_lock(ptl);
72245 if (!pte_none(*page_table))
72246 goto unlock;
72247 goto setpte;
72248 }
72249
72250 /* Allocate our own private page. */
72251 + pte_unmap(page_table);
72252 +
72253 if (unlikely(anon_vma_prepare(vma)))
72254 goto oom;
72255 page = alloc_zeroed_user_highpage_movable(vma, address);
72256 @@ -3028,6 +3203,11 @@ static int do_anonymous_page(struct mm_s
72257 if (!pte_none(*page_table))
72258 goto release;
72259
72260 +#ifdef CONFIG_PAX_SEGMEXEC
72261 + if (pax_find_mirror_vma(vma))
72262 + BUG_ON(!trylock_page(page));
72263 +#endif
72264 +
72265 inc_mm_counter_fast(mm, MM_ANONPAGES);
72266 page_add_new_anon_rmap(page, vma, address);
72267 setpte:
72268 @@ -3035,6 +3215,12 @@ setpte:
72269
72270 /* No need to invalidate - it was non-present before */
72271 update_mmu_cache(vma, address, page_table);
72272 +
72273 +#ifdef CONFIG_PAX_SEGMEXEC
72274 + if (page)
72275 + pax_mirror_anon_pte(vma, address, page, ptl);
72276 +#endif
72277 +
72278 unlock:
72279 pte_unmap_unlock(page_table, ptl);
72280 return 0;
72281 @@ -3172,6 +3358,12 @@ static int __do_fault(struct mm_struct *
72282 */
72283 /* Only go through if we didn't race with anybody else... */
72284 if (likely(pte_same(*page_table, orig_pte))) {
72285 +
72286 +#ifdef CONFIG_PAX_SEGMEXEC
72287 + if (anon && pax_find_mirror_vma(vma))
72288 + BUG_ON(!trylock_page(page));
72289 +#endif
72290 +
72291 flush_icache_page(vma, page);
72292 entry = mk_pte(page, vma->vm_page_prot);
72293 if (flags & FAULT_FLAG_WRITE)
72294 @@ -3191,6 +3383,14 @@ static int __do_fault(struct mm_struct *
72295
72296 /* no need to invalidate: a not-present page won't be cached */
72297 update_mmu_cache(vma, address, page_table);
72298 +
72299 +#ifdef CONFIG_PAX_SEGMEXEC
72300 + if (anon)
72301 + pax_mirror_anon_pte(vma, address, page, ptl);
72302 + else
72303 + pax_mirror_file_pte(vma, address, page, ptl);
72304 +#endif
72305 +
72306 } else {
72307 if (charged)
72308 mem_cgroup_uncharge_page(page);
72309 @@ -3338,6 +3538,12 @@ int handle_pte_fault(struct mm_struct *m
72310 if (flags & FAULT_FLAG_WRITE)
72311 flush_tlb_fix_spurious_fault(vma, address);
72312 }
72313 +
72314 +#ifdef CONFIG_PAX_SEGMEXEC
72315 + pax_mirror_pte(vma, address, pte, pmd, ptl);
72316 + return 0;
72317 +#endif
72318 +
72319 unlock:
72320 pte_unmap_unlock(pte, ptl);
72321 return 0;
72322 @@ -3354,6 +3560,10 @@ int handle_mm_fault(struct mm_struct *mm
72323 pmd_t *pmd;
72324 pte_t *pte;
72325
72326 +#ifdef CONFIG_PAX_SEGMEXEC
72327 + struct vm_area_struct *vma_m;
72328 +#endif
72329 +
72330 __set_current_state(TASK_RUNNING);
72331
72332 count_vm_event(PGFAULT);
72333 @@ -3364,6 +3574,34 @@ int handle_mm_fault(struct mm_struct *mm
72334 if (unlikely(is_vm_hugetlb_page(vma)))
72335 return hugetlb_fault(mm, vma, address, flags);
72336
72337 +#ifdef CONFIG_PAX_SEGMEXEC
72338 + vma_m = pax_find_mirror_vma(vma);
72339 + if (vma_m) {
72340 + unsigned long address_m;
72341 + pgd_t *pgd_m;
72342 + pud_t *pud_m;
72343 + pmd_t *pmd_m;
72344 +
72345 + if (vma->vm_start > vma_m->vm_start) {
72346 + address_m = address;
72347 + address -= SEGMEXEC_TASK_SIZE;
72348 + vma = vma_m;
72349 + } else
72350 + address_m = address + SEGMEXEC_TASK_SIZE;
72351 +
72352 + pgd_m = pgd_offset(mm, address_m);
72353 + pud_m = pud_alloc(mm, pgd_m, address_m);
72354 + if (!pud_m)
72355 + return VM_FAULT_OOM;
72356 + pmd_m = pmd_alloc(mm, pud_m, address_m);
72357 + if (!pmd_m)
72358 + return VM_FAULT_OOM;
72359 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
72360 + return VM_FAULT_OOM;
72361 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
72362 + }
72363 +#endif
72364 +
72365 pgd = pgd_offset(mm, address);
72366 pud = pud_alloc(mm, pgd, address);
72367 if (!pud)
72368 @@ -3393,7 +3631,7 @@ int handle_mm_fault(struct mm_struct *mm
72369 * run pte_offset_map on the pmd, if an huge pmd could
72370 * materialize from under us from a different thread.
72371 */
72372 - if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
72373 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
72374 return VM_FAULT_OOM;
72375 /* if an huge pmd materialized from under us just retry later */
72376 if (unlikely(pmd_trans_huge(*pmd)))
72377 @@ -3497,7 +3735,7 @@ static int __init gate_vma_init(void)
72378 gate_vma.vm_start = FIXADDR_USER_START;
72379 gate_vma.vm_end = FIXADDR_USER_END;
72380 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
72381 - gate_vma.vm_page_prot = __P101;
72382 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
72383 /*
72384 * Make sure the vDSO gets into every core dump.
72385 * Dumping its contents makes post-mortem fully interpretable later
72386 diff -urNp linux-2.6.39.1/mm/memory-failure.c linux-2.6.39.1/mm/memory-failure.c
72387 --- linux-2.6.39.1/mm/memory-failure.c 2011-05-19 00:06:34.000000000 -0400
72388 +++ linux-2.6.39.1/mm/memory-failure.c 2011-05-22 19:36:33.000000000 -0400
72389 @@ -58,7 +58,7 @@ int sysctl_memory_failure_early_kill __r
72390
72391 int sysctl_memory_failure_recovery __read_mostly = 1;
72392
72393 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72394 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72395
72396 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
72397
72398 @@ -1012,7 +1012,7 @@ int __memory_failure(unsigned long pfn,
72399 }
72400
72401 nr_pages = 1 << compound_trans_order(hpage);
72402 - atomic_long_add(nr_pages, &mce_bad_pages);
72403 + atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
72404
72405 /*
72406 * We need/can do nothing about count=0 pages.
72407 @@ -1042,7 +1042,7 @@ int __memory_failure(unsigned long pfn,
72408 if (!PageHWPoison(hpage)
72409 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
72410 || (p != hpage && TestSetPageHWPoison(hpage))) {
72411 - atomic_long_sub(nr_pages, &mce_bad_pages);
72412 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72413 return 0;
72414 }
72415 set_page_hwpoison_huge_page(hpage);
72416 @@ -1100,7 +1100,7 @@ int __memory_failure(unsigned long pfn,
72417 }
72418 if (hwpoison_filter(p)) {
72419 if (TestClearPageHWPoison(p))
72420 - atomic_long_sub(nr_pages, &mce_bad_pages);
72421 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72422 unlock_page(hpage);
72423 put_page(hpage);
72424 return 0;
72425 @@ -1226,7 +1226,7 @@ int unpoison_memory(unsigned long pfn)
72426 return 0;
72427 }
72428 if (TestClearPageHWPoison(p))
72429 - atomic_long_sub(nr_pages, &mce_bad_pages);
72430 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72431 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
72432 return 0;
72433 }
72434 @@ -1240,7 +1240,7 @@ int unpoison_memory(unsigned long pfn)
72435 */
72436 if (TestClearPageHWPoison(page)) {
72437 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
72438 - atomic_long_sub(nr_pages, &mce_bad_pages);
72439 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72440 freeit = 1;
72441 if (PageHuge(page))
72442 clear_page_hwpoison_huge_page(page);
72443 @@ -1353,7 +1353,7 @@ static int soft_offline_huge_page(struct
72444 }
72445 done:
72446 if (!PageHWPoison(hpage))
72447 - atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
72448 + atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
72449 set_page_hwpoison_huge_page(hpage);
72450 dequeue_hwpoisoned_huge_page(hpage);
72451 /* keep elevated page count for bad page */
72452 @@ -1482,7 +1482,7 @@ int soft_offline_page(struct page *page,
72453 return ret;
72454
72455 done:
72456 - atomic_long_add(1, &mce_bad_pages);
72457 + atomic_long_add_unchecked(1, &mce_bad_pages);
72458 SetPageHWPoison(page);
72459 /* keep elevated page count for bad page */
72460 return ret;
72461 diff -urNp linux-2.6.39.1/mm/mempolicy.c linux-2.6.39.1/mm/mempolicy.c
72462 --- linux-2.6.39.1/mm/mempolicy.c 2011-05-19 00:06:34.000000000 -0400
72463 +++ linux-2.6.39.1/mm/mempolicy.c 2011-05-22 19:41:42.000000000 -0400
72464 @@ -643,6 +643,10 @@ static int mbind_range(struct mm_struct
72465 unsigned long vmstart;
72466 unsigned long vmend;
72467
72468 +#ifdef CONFIG_PAX_SEGMEXEC
72469 + struct vm_area_struct *vma_m;
72470 +#endif
72471 +
72472 vma = find_vma_prev(mm, start, &prev);
72473 if (!vma || vma->vm_start > start)
72474 return -EFAULT;
72475 @@ -673,6 +677,16 @@ static int mbind_range(struct mm_struct
72476 err = policy_vma(vma, new_pol);
72477 if (err)
72478 goto out;
72479 +
72480 +#ifdef CONFIG_PAX_SEGMEXEC
72481 + vma_m = pax_find_mirror_vma(vma);
72482 + if (vma_m) {
72483 + err = policy_vma(vma_m, new_pol);
72484 + if (err)
72485 + goto out;
72486 + }
72487 +#endif
72488 +
72489 }
72490
72491 out:
72492 @@ -1106,6 +1120,17 @@ static long do_mbind(unsigned long start
72493
72494 if (end < start)
72495 return -EINVAL;
72496 +
72497 +#ifdef CONFIG_PAX_SEGMEXEC
72498 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72499 + if (end > SEGMEXEC_TASK_SIZE)
72500 + return -EINVAL;
72501 + } else
72502 +#endif
72503 +
72504 + if (end > TASK_SIZE)
72505 + return -EINVAL;
72506 +
72507 if (end == start)
72508 return 0;
72509
72510 @@ -1324,6 +1349,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72511 if (!mm)
72512 goto out;
72513
72514 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72515 + if (mm != current->mm &&
72516 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72517 + err = -EPERM;
72518 + goto out;
72519 + }
72520 +#endif
72521 +
72522 /*
72523 * Check if this process has the right to modify the specified
72524 * process. The right exists if the process has administrative
72525 @@ -1333,8 +1366,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72526 rcu_read_lock();
72527 tcred = __task_cred(task);
72528 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72529 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
72530 - !capable(CAP_SYS_NICE)) {
72531 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72532 rcu_read_unlock();
72533 err = -EPERM;
72534 goto out;
72535 @@ -2634,7 +2666,7 @@ int show_numa_map(struct seq_file *m, vo
72536
72537 if (file) {
72538 seq_printf(m, " file=");
72539 - seq_path(m, &file->f_path, "\n\t= ");
72540 + seq_path(m, &file->f_path, "\n\t\\= ");
72541 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
72542 seq_printf(m, " heap");
72543 } else if (vma->vm_start <= mm->start_stack &&
72544 diff -urNp linux-2.6.39.1/mm/migrate.c linux-2.6.39.1/mm/migrate.c
72545 --- linux-2.6.39.1/mm/migrate.c 2011-05-19 00:06:34.000000000 -0400
72546 +++ linux-2.6.39.1/mm/migrate.c 2011-05-22 19:41:42.000000000 -0400
72547 @@ -1133,6 +1133,8 @@ static int do_pages_move(struct mm_struc
72548 unsigned long chunk_start;
72549 int err;
72550
72551 + pax_track_stack();
72552 +
72553 task_nodes = cpuset_mems_allowed(task);
72554
72555 err = -ENOMEM;
72556 @@ -1317,6 +1319,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72557 if (!mm)
72558 return -EINVAL;
72559
72560 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72561 + if (mm != current->mm &&
72562 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72563 + err = -EPERM;
72564 + goto out;
72565 + }
72566 +#endif
72567 +
72568 /*
72569 * Check if this process has the right to modify the specified
72570 * process. The right exists if the process has administrative
72571 @@ -1326,8 +1336,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72572 rcu_read_lock();
72573 tcred = __task_cred(task);
72574 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72575 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
72576 - !capable(CAP_SYS_NICE)) {
72577 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72578 rcu_read_unlock();
72579 err = -EPERM;
72580 goto out;
72581 diff -urNp linux-2.6.39.1/mm/mlock.c linux-2.6.39.1/mm/mlock.c
72582 --- linux-2.6.39.1/mm/mlock.c 2011-05-19 00:06:34.000000000 -0400
72583 +++ linux-2.6.39.1/mm/mlock.c 2011-05-22 19:41:42.000000000 -0400
72584 @@ -13,6 +13,7 @@
72585 #include <linux/pagemap.h>
72586 #include <linux/mempolicy.h>
72587 #include <linux/syscalls.h>
72588 +#include <linux/security.h>
72589 #include <linux/sched.h>
72590 #include <linux/module.h>
72591 #include <linux/rmap.h>
72592 @@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
72593 return -EINVAL;
72594 if (end == start)
72595 return 0;
72596 + if (end > TASK_SIZE)
72597 + return -EINVAL;
72598 +
72599 vma = find_vma_prev(current->mm, start, &prev);
72600 if (!vma || vma->vm_start > start)
72601 return -ENOMEM;
72602 @@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
72603 for (nstart = start ; ; ) {
72604 unsigned int newflags;
72605
72606 +#ifdef CONFIG_PAX_SEGMEXEC
72607 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72608 + break;
72609 +#endif
72610 +
72611 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
72612
72613 newflags = vma->vm_flags | VM_LOCKED;
72614 @@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
72615 lock_limit >>= PAGE_SHIFT;
72616
72617 /* check against resource limits */
72618 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
72619 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
72620 error = do_mlock(start, len, 1);
72621 up_write(&current->mm->mmap_sem);
72622 @@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
72623 static int do_mlockall(int flags)
72624 {
72625 struct vm_area_struct * vma, * prev = NULL;
72626 - unsigned int def_flags = 0;
72627
72628 if (flags & MCL_FUTURE)
72629 - def_flags = VM_LOCKED;
72630 - current->mm->def_flags = def_flags;
72631 + current->mm->def_flags |= VM_LOCKED;
72632 + else
72633 + current->mm->def_flags &= ~VM_LOCKED;
72634 if (flags == MCL_FUTURE)
72635 goto out;
72636
72637 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
72638 - unsigned int newflags;
72639 + unsigned long newflags;
72640 +
72641 +#ifdef CONFIG_PAX_SEGMEXEC
72642 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72643 + break;
72644 +#endif
72645
72646 + BUG_ON(vma->vm_end > TASK_SIZE);
72647 newflags = vma->vm_flags | VM_LOCKED;
72648 if (!(flags & MCL_CURRENT))
72649 newflags &= ~VM_LOCKED;
72650 @@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
72651 lock_limit >>= PAGE_SHIFT;
72652
72653 ret = -ENOMEM;
72654 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
72655 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
72656 capable(CAP_IPC_LOCK))
72657 ret = do_mlockall(flags);
72658 diff -urNp linux-2.6.39.1/mm/mmap.c linux-2.6.39.1/mm/mmap.c
72659 --- linux-2.6.39.1/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
72660 +++ linux-2.6.39.1/mm/mmap.c 2011-05-22 19:41:42.000000000 -0400
72661 @@ -46,6 +46,16 @@
72662 #define arch_rebalance_pgtables(addr, len) (addr)
72663 #endif
72664
72665 +static inline void verify_mm_writelocked(struct mm_struct *mm)
72666 +{
72667 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72668 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72669 + up_read(&mm->mmap_sem);
72670 + BUG();
72671 + }
72672 +#endif
72673 +}
72674 +
72675 static void unmap_region(struct mm_struct *mm,
72676 struct vm_area_struct *vma, struct vm_area_struct *prev,
72677 unsigned long start, unsigned long end);
72678 @@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc
72679 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72680 *
72681 */
72682 -pgprot_t protection_map[16] = {
72683 +pgprot_t protection_map[16] __read_only = {
72684 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72685 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72686 };
72687
72688 pgprot_t vm_get_page_prot(unsigned long vm_flags)
72689 {
72690 - return __pgprot(pgprot_val(protection_map[vm_flags &
72691 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72692 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72693 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72694 +
72695 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72696 + if (!(__supported_pte_mask & _PAGE_NX) &&
72697 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72698 + (vm_flags & (VM_READ | VM_WRITE)))
72699 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72700 +#endif
72701 +
72702 + return prot;
72703 }
72704 EXPORT_SYMBOL(vm_get_page_prot);
72705
72706 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72707 int sysctl_overcommit_ratio = 50; /* default is 50% */
72708 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72709 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72710 struct percpu_counter vm_committed_as;
72711
72712 /*
72713 @@ -232,6 +252,7 @@ static struct vm_area_struct *remove_vma
72714 struct vm_area_struct *next = vma->vm_next;
72715
72716 might_sleep();
72717 + BUG_ON(vma->vm_mirror);
72718 if (vma->vm_ops && vma->vm_ops->close)
72719 vma->vm_ops->close(vma);
72720 if (vma->vm_file) {
72721 @@ -276,6 +297,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
72722 * not page aligned -Ram Gupta
72723 */
72724 rlim = rlimit(RLIMIT_DATA);
72725 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72726 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72727 (mm->end_data - mm->start_data) > rlim)
72728 goto out;
72729 @@ -719,6 +741,12 @@ static int
72730 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72731 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72732 {
72733 +
72734 +#ifdef CONFIG_PAX_SEGMEXEC
72735 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72736 + return 0;
72737 +#endif
72738 +
72739 if (is_mergeable_vma(vma, file, vm_flags) &&
72740 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72741 if (vma->vm_pgoff == vm_pgoff)
72742 @@ -738,6 +766,12 @@ static int
72743 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72744 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72745 {
72746 +
72747 +#ifdef CONFIG_PAX_SEGMEXEC
72748 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72749 + return 0;
72750 +#endif
72751 +
72752 if (is_mergeable_vma(vma, file, vm_flags) &&
72753 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72754 pgoff_t vm_pglen;
72755 @@ -780,13 +814,20 @@ can_vma_merge_after(struct vm_area_struc
72756 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72757 struct vm_area_struct *prev, unsigned long addr,
72758 unsigned long end, unsigned long vm_flags,
72759 - struct anon_vma *anon_vma, struct file *file,
72760 + struct anon_vma *anon_vma, struct file *file,
72761 pgoff_t pgoff, struct mempolicy *policy)
72762 {
72763 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72764 struct vm_area_struct *area, *next;
72765 int err;
72766
72767 +#ifdef CONFIG_PAX_SEGMEXEC
72768 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72769 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72770 +
72771 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72772 +#endif
72773 +
72774 /*
72775 * We later require that vma->vm_flags == vm_flags,
72776 * so this tests vma->vm_flags & VM_SPECIAL, too.
72777 @@ -802,6 +843,15 @@ struct vm_area_struct *vma_merge(struct
72778 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72779 next = next->vm_next;
72780
72781 +#ifdef CONFIG_PAX_SEGMEXEC
72782 + if (prev)
72783 + prev_m = pax_find_mirror_vma(prev);
72784 + if (area)
72785 + area_m = pax_find_mirror_vma(area);
72786 + if (next)
72787 + next_m = pax_find_mirror_vma(next);
72788 +#endif
72789 +
72790 /*
72791 * Can it merge with the predecessor?
72792 */
72793 @@ -821,9 +871,24 @@ struct vm_area_struct *vma_merge(struct
72794 /* cases 1, 6 */
72795 err = vma_adjust(prev, prev->vm_start,
72796 next->vm_end, prev->vm_pgoff, NULL);
72797 - } else /* cases 2, 5, 7 */
72798 +
72799 +#ifdef CONFIG_PAX_SEGMEXEC
72800 + if (!err && prev_m)
72801 + err = vma_adjust(prev_m, prev_m->vm_start,
72802 + next_m->vm_end, prev_m->vm_pgoff, NULL);
72803 +#endif
72804 +
72805 + } else { /* cases 2, 5, 7 */
72806 err = vma_adjust(prev, prev->vm_start,
72807 end, prev->vm_pgoff, NULL);
72808 +
72809 +#ifdef CONFIG_PAX_SEGMEXEC
72810 + if (!err && prev_m)
72811 + err = vma_adjust(prev_m, prev_m->vm_start,
72812 + end_m, prev_m->vm_pgoff, NULL);
72813 +#endif
72814 +
72815 + }
72816 if (err)
72817 return NULL;
72818 khugepaged_enter_vma_merge(prev);
72819 @@ -837,12 +902,27 @@ struct vm_area_struct *vma_merge(struct
72820 mpol_equal(policy, vma_policy(next)) &&
72821 can_vma_merge_before(next, vm_flags,
72822 anon_vma, file, pgoff+pglen)) {
72823 - if (prev && addr < prev->vm_end) /* case 4 */
72824 + if (prev && addr < prev->vm_end) { /* case 4 */
72825 err = vma_adjust(prev, prev->vm_start,
72826 addr, prev->vm_pgoff, NULL);
72827 - else /* cases 3, 8 */
72828 +
72829 +#ifdef CONFIG_PAX_SEGMEXEC
72830 + if (!err && prev_m)
72831 + err = vma_adjust(prev_m, prev_m->vm_start,
72832 + addr_m, prev_m->vm_pgoff, NULL);
72833 +#endif
72834 +
72835 + } else { /* cases 3, 8 */
72836 err = vma_adjust(area, addr, next->vm_end,
72837 next->vm_pgoff - pglen, NULL);
72838 +
72839 +#ifdef CONFIG_PAX_SEGMEXEC
72840 + if (!err && area_m)
72841 + err = vma_adjust(area_m, addr_m, next_m->vm_end,
72842 + next_m->vm_pgoff - pglen, NULL);
72843 +#endif
72844 +
72845 + }
72846 if (err)
72847 return NULL;
72848 khugepaged_enter_vma_merge(area);
72849 @@ -958,14 +1038,11 @@ none:
72850 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
72851 struct file *file, long pages)
72852 {
72853 - const unsigned long stack_flags
72854 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
72855 -
72856 if (file) {
72857 mm->shared_vm += pages;
72858 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
72859 mm->exec_vm += pages;
72860 - } else if (flags & stack_flags)
72861 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
72862 mm->stack_vm += pages;
72863 if (flags & (VM_RESERVED|VM_IO))
72864 mm->reserved_vm += pages;
72865 @@ -992,7 +1069,7 @@ unsigned long do_mmap_pgoff(struct file
72866 * (the exception is when the underlying filesystem is noexec
72867 * mounted, in which case we dont add PROT_EXEC.)
72868 */
72869 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72870 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72871 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
72872 prot |= PROT_EXEC;
72873
72874 @@ -1018,7 +1095,7 @@ unsigned long do_mmap_pgoff(struct file
72875 /* Obtain the address to map to. we verify (or select) it and ensure
72876 * that it represents a valid section of the address space.
72877 */
72878 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
72879 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
72880 if (addr & ~PAGE_MASK)
72881 return addr;
72882
72883 @@ -1029,6 +1106,36 @@ unsigned long do_mmap_pgoff(struct file
72884 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
72885 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
72886
72887 +#ifdef CONFIG_PAX_MPROTECT
72888 + if (mm->pax_flags & MF_PAX_MPROTECT) {
72889 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
72890 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
72891 + gr_log_rwxmmap(file);
72892 +
72893 +#ifdef CONFIG_PAX_EMUPLT
72894 + vm_flags &= ~VM_EXEC;
72895 +#else
72896 + return -EPERM;
72897 +#endif
72898 +
72899 + }
72900 +
72901 + if (!(vm_flags & VM_EXEC))
72902 + vm_flags &= ~VM_MAYEXEC;
72903 +#else
72904 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72905 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72906 +#endif
72907 + else
72908 + vm_flags &= ~VM_MAYWRITE;
72909 + }
72910 +#endif
72911 +
72912 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72913 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
72914 + vm_flags &= ~VM_PAGEEXEC;
72915 +#endif
72916 +
72917 if (flags & MAP_LOCKED)
72918 if (!can_do_mlock())
72919 return -EPERM;
72920 @@ -1040,6 +1147,7 @@ unsigned long do_mmap_pgoff(struct file
72921 locked += mm->locked_vm;
72922 lock_limit = rlimit(RLIMIT_MEMLOCK);
72923 lock_limit >>= PAGE_SHIFT;
72924 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72925 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
72926 return -EAGAIN;
72927 }
72928 @@ -1110,6 +1218,9 @@ unsigned long do_mmap_pgoff(struct file
72929 if (error)
72930 return error;
72931
72932 + if (!gr_acl_handle_mmap(file, prot))
72933 + return -EACCES;
72934 +
72935 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
72936 }
72937 EXPORT_SYMBOL(do_mmap_pgoff);
72938 @@ -1187,10 +1298,10 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_ar
72939 */
72940 int vma_wants_writenotify(struct vm_area_struct *vma)
72941 {
72942 - unsigned int vm_flags = vma->vm_flags;
72943 + unsigned long vm_flags = vma->vm_flags;
72944
72945 /* If it was private or non-writable, the write bit is already clear */
72946 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
72947 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
72948 return 0;
72949
72950 /* The backer wishes to know when pages are first written to? */
72951 @@ -1239,14 +1350,24 @@ unsigned long mmap_region(struct file *f
72952 unsigned long charged = 0;
72953 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
72954
72955 +#ifdef CONFIG_PAX_SEGMEXEC
72956 + struct vm_area_struct *vma_m = NULL;
72957 +#endif
72958 +
72959 + /*
72960 + * mm->mmap_sem is required to protect against another thread
72961 + * changing the mappings in case we sleep.
72962 + */
72963 + verify_mm_writelocked(mm);
72964 +
72965 /* Clear old maps */
72966 error = -ENOMEM;
72967 -munmap_back:
72968 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72969 if (vma && vma->vm_start < addr + len) {
72970 if (do_munmap(mm, addr, len))
72971 return -ENOMEM;
72972 - goto munmap_back;
72973 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72974 + BUG_ON(vma && vma->vm_start < addr + len);
72975 }
72976
72977 /* Check against address space limit. */
72978 @@ -1295,6 +1416,16 @@ munmap_back:
72979 goto unacct_error;
72980 }
72981
72982 +#ifdef CONFIG_PAX_SEGMEXEC
72983 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
72984 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72985 + if (!vma_m) {
72986 + error = -ENOMEM;
72987 + goto free_vma;
72988 + }
72989 + }
72990 +#endif
72991 +
72992 vma->vm_mm = mm;
72993 vma->vm_start = addr;
72994 vma->vm_end = addr + len;
72995 @@ -1318,6 +1449,19 @@ munmap_back:
72996 error = file->f_op->mmap(file, vma);
72997 if (error)
72998 goto unmap_and_free_vma;
72999 +
73000 +#ifdef CONFIG_PAX_SEGMEXEC
73001 + if (vma_m && (vm_flags & VM_EXECUTABLE))
73002 + added_exe_file_vma(mm);
73003 +#endif
73004 +
73005 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
73006 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
73007 + vma->vm_flags |= VM_PAGEEXEC;
73008 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73009 + }
73010 +#endif
73011 +
73012 if (vm_flags & VM_EXECUTABLE)
73013 added_exe_file_vma(mm);
73014
73015 @@ -1353,6 +1497,11 @@ munmap_back:
73016 vma_link(mm, vma, prev, rb_link, rb_parent);
73017 file = vma->vm_file;
73018
73019 +#ifdef CONFIG_PAX_SEGMEXEC
73020 + if (vma_m)
73021 + BUG_ON(pax_mirror_vma(vma_m, vma));
73022 +#endif
73023 +
73024 /* Once vma denies write, undo our temporary denial count */
73025 if (correct_wcount)
73026 atomic_inc(&inode->i_writecount);
73027 @@ -1361,6 +1510,7 @@ out:
73028
73029 mm->total_vm += len >> PAGE_SHIFT;
73030 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
73031 + track_exec_limit(mm, addr, addr + len, vm_flags);
73032 if (vm_flags & VM_LOCKED) {
73033 if (!mlock_vma_pages_range(vma, addr, addr + len))
73034 mm->locked_vm += (len >> PAGE_SHIFT);
73035 @@ -1378,6 +1528,12 @@ unmap_and_free_vma:
73036 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
73037 charged = 0;
73038 free_vma:
73039 +
73040 +#ifdef CONFIG_PAX_SEGMEXEC
73041 + if (vma_m)
73042 + kmem_cache_free(vm_area_cachep, vma_m);
73043 +#endif
73044 +
73045 kmem_cache_free(vm_area_cachep, vma);
73046 unacct_error:
73047 if (charged)
73048 @@ -1385,6 +1541,44 @@ unacct_error:
73049 return error;
73050 }
73051
73052 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
73053 +{
73054 + if (!vma) {
73055 +#ifdef CONFIG_STACK_GROWSUP
73056 + if (addr > sysctl_heap_stack_gap)
73057 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
73058 + else
73059 + vma = find_vma(current->mm, 0);
73060 + if (vma && (vma->vm_flags & VM_GROWSUP))
73061 + return false;
73062 +#endif
73063 + return true;
73064 + }
73065 +
73066 + if (addr + len > vma->vm_start)
73067 + return false;
73068 +
73069 + if (vma->vm_flags & VM_GROWSDOWN)
73070 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
73071 +#ifdef CONFIG_STACK_GROWSUP
73072 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
73073 + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
73074 +#endif
73075 +
73076 + return true;
73077 +}
73078 +
73079 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
73080 +{
73081 + if (vma->vm_start < len)
73082 + return -ENOMEM;
73083 + if (!(vma->vm_flags & VM_GROWSDOWN))
73084 + return vma->vm_start - len;
73085 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
73086 + return vma->vm_start - len - sysctl_heap_stack_gap;
73087 + return -ENOMEM;
73088 +}
73089 +
73090 /* Get an address range which is currently unmapped.
73091 * For shmat() with addr=0.
73092 *
73093 @@ -1411,18 +1605,23 @@ arch_get_unmapped_area(struct file *filp
73094 if (flags & MAP_FIXED)
73095 return addr;
73096
73097 +#ifdef CONFIG_PAX_RANDMMAP
73098 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
73099 +#endif
73100 +
73101 if (addr) {
73102 addr = PAGE_ALIGN(addr);
73103 - vma = find_vma(mm, addr);
73104 - if (TASK_SIZE - len >= addr &&
73105 - (!vma || addr + len <= vma->vm_start))
73106 - return addr;
73107 + if (TASK_SIZE - len >= addr) {
73108 + vma = find_vma(mm, addr);
73109 + if (check_heap_stack_gap(vma, addr, len))
73110 + return addr;
73111 + }
73112 }
73113 if (len > mm->cached_hole_size) {
73114 - start_addr = addr = mm->free_area_cache;
73115 + start_addr = addr = mm->free_area_cache;
73116 } else {
73117 - start_addr = addr = TASK_UNMAPPED_BASE;
73118 - mm->cached_hole_size = 0;
73119 + start_addr = addr = mm->mmap_base;
73120 + mm->cached_hole_size = 0;
73121 }
73122
73123 full_search:
73124 @@ -1433,34 +1632,40 @@ full_search:
73125 * Start a new search - just in case we missed
73126 * some holes.
73127 */
73128 - if (start_addr != TASK_UNMAPPED_BASE) {
73129 - addr = TASK_UNMAPPED_BASE;
73130 - start_addr = addr;
73131 + if (start_addr != mm->mmap_base) {
73132 + start_addr = addr = mm->mmap_base;
73133 mm->cached_hole_size = 0;
73134 goto full_search;
73135 }
73136 return -ENOMEM;
73137 }
73138 - if (!vma || addr + len <= vma->vm_start) {
73139 - /*
73140 - * Remember the place where we stopped the search:
73141 - */
73142 - mm->free_area_cache = addr + len;
73143 - return addr;
73144 - }
73145 + if (check_heap_stack_gap(vma, addr, len))
73146 + break;
73147 if (addr + mm->cached_hole_size < vma->vm_start)
73148 mm->cached_hole_size = vma->vm_start - addr;
73149 addr = vma->vm_end;
73150 }
73151 +
73152 + /*
73153 + * Remember the place where we stopped the search:
73154 + */
73155 + mm->free_area_cache = addr + len;
73156 + return addr;
73157 }
73158 #endif
73159
73160 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
73161 {
73162 +
73163 +#ifdef CONFIG_PAX_SEGMEXEC
73164 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73165 + return;
73166 +#endif
73167 +
73168 /*
73169 * Is this a new hole at the lowest possible address?
73170 */
73171 - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
73172 + if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
73173 mm->free_area_cache = addr;
73174 mm->cached_hole_size = ~0UL;
73175 }
73176 @@ -1478,7 +1683,7 @@ arch_get_unmapped_area_topdown(struct fi
73177 {
73178 struct vm_area_struct *vma;
73179 struct mm_struct *mm = current->mm;
73180 - unsigned long addr = addr0;
73181 + unsigned long base = mm->mmap_base, addr = addr0;
73182
73183 /* requested length too big for entire address space */
73184 if (len > TASK_SIZE)
73185 @@ -1487,13 +1692,18 @@ arch_get_unmapped_area_topdown(struct fi
73186 if (flags & MAP_FIXED)
73187 return addr;
73188
73189 +#ifdef CONFIG_PAX_RANDMMAP
73190 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
73191 +#endif
73192 +
73193 /* requesting a specific address */
73194 if (addr) {
73195 addr = PAGE_ALIGN(addr);
73196 - vma = find_vma(mm, addr);
73197 - if (TASK_SIZE - len >= addr &&
73198 - (!vma || addr + len <= vma->vm_start))
73199 - return addr;
73200 + if (TASK_SIZE - len >= addr) {
73201 + vma = find_vma(mm, addr);
73202 + if (check_heap_stack_gap(vma, addr, len))
73203 + return addr;
73204 + }
73205 }
73206
73207 /* check if free_area_cache is useful for us */
73208 @@ -1508,7 +1718,7 @@ arch_get_unmapped_area_topdown(struct fi
73209 /* make sure it can fit in the remaining address space */
73210 if (addr > len) {
73211 vma = find_vma(mm, addr-len);
73212 - if (!vma || addr <= vma->vm_start)
73213 + if (check_heap_stack_gap(vma, addr - len, len))
73214 /* remember the address as a hint for next time */
73215 return (mm->free_area_cache = addr-len);
73216 }
73217 @@ -1525,7 +1735,7 @@ arch_get_unmapped_area_topdown(struct fi
73218 * return with success:
73219 */
73220 vma = find_vma(mm, addr);
73221 - if (!vma || addr+len <= vma->vm_start)
73222 + if (check_heap_stack_gap(vma, addr, len))
73223 /* remember the address as a hint for next time */
73224 return (mm->free_area_cache = addr);
73225
73226 @@ -1534,8 +1744,8 @@ arch_get_unmapped_area_topdown(struct fi
73227 mm->cached_hole_size = vma->vm_start - addr;
73228
73229 /* try just below the current vma->vm_start */
73230 - addr = vma->vm_start-len;
73231 - } while (len < vma->vm_start);
73232 + addr = skip_heap_stack_gap(vma, len);
73233 + } while (!IS_ERR_VALUE(addr));
73234
73235 bottomup:
73236 /*
73237 @@ -1544,13 +1754,21 @@ bottomup:
73238 * can happen with large stack limits and large mmap()
73239 * allocations.
73240 */
73241 + mm->mmap_base = TASK_UNMAPPED_BASE;
73242 +
73243 +#ifdef CONFIG_PAX_RANDMMAP
73244 + if (mm->pax_flags & MF_PAX_RANDMMAP)
73245 + mm->mmap_base += mm->delta_mmap;
73246 +#endif
73247 +
73248 + mm->free_area_cache = mm->mmap_base;
73249 mm->cached_hole_size = ~0UL;
73250 - mm->free_area_cache = TASK_UNMAPPED_BASE;
73251 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
73252 /*
73253 * Restore the topdown base:
73254 */
73255 - mm->free_area_cache = mm->mmap_base;
73256 + mm->mmap_base = base;
73257 + mm->free_area_cache = base;
73258 mm->cached_hole_size = ~0UL;
73259
73260 return addr;
73261 @@ -1559,6 +1777,12 @@ bottomup:
73262
73263 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
73264 {
73265 +
73266 +#ifdef CONFIG_PAX_SEGMEXEC
73267 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73268 + return;
73269 +#endif
73270 +
73271 /*
73272 * Is this a new hole at the highest possible address?
73273 */
73274 @@ -1566,8 +1790,10 @@ void arch_unmap_area_topdown(struct mm_s
73275 mm->free_area_cache = addr;
73276
73277 /* dont allow allocations above current base */
73278 - if (mm->free_area_cache > mm->mmap_base)
73279 + if (mm->free_area_cache > mm->mmap_base) {
73280 mm->free_area_cache = mm->mmap_base;
73281 + mm->cached_hole_size = ~0UL;
73282 + }
73283 }
73284
73285 unsigned long
73286 @@ -1675,6 +1901,28 @@ out:
73287 return prev ? prev->vm_next : vma;
73288 }
73289
73290 +#ifdef CONFIG_PAX_SEGMEXEC
73291 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
73292 +{
73293 + struct vm_area_struct *vma_m;
73294 +
73295 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
73296 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
73297 + BUG_ON(vma->vm_mirror);
73298 + return NULL;
73299 + }
73300 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
73301 + vma_m = vma->vm_mirror;
73302 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
73303 + BUG_ON(vma->vm_file != vma_m->vm_file);
73304 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
73305 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
73306 + BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
73307 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
73308 + return vma_m;
73309 +}
73310 +#endif
73311 +
73312 /*
73313 * Verify that the stack growth is acceptable and
73314 * update accounting. This is shared with both the
73315 @@ -1691,6 +1939,7 @@ static int acct_stack_growth(struct vm_a
73316 return -ENOMEM;
73317
73318 /* Stack limit test */
73319 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
73320 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
73321 return -ENOMEM;
73322
73323 @@ -1701,6 +1950,7 @@ static int acct_stack_growth(struct vm_a
73324 locked = mm->locked_vm + grow;
73325 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
73326 limit >>= PAGE_SHIFT;
73327 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
73328 if (locked > limit && !capable(CAP_IPC_LOCK))
73329 return -ENOMEM;
73330 }
73331 @@ -1731,37 +1981,48 @@ static int acct_stack_growth(struct vm_a
73332 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
73333 * vma is the last one with address > vma->vm_end. Have to extend vma.
73334 */
73335 +#ifndef CONFIG_IA64
73336 +static
73337 +#endif
73338 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
73339 {
73340 int error;
73341 + bool locknext;
73342
73343 if (!(vma->vm_flags & VM_GROWSUP))
73344 return -EFAULT;
73345
73346 + /* Also guard against wrapping around to address 0. */
73347 + if (address < PAGE_ALIGN(address+1))
73348 + address = PAGE_ALIGN(address+1);
73349 + else
73350 + return -ENOMEM;
73351 +
73352 /*
73353 * We must make sure the anon_vma is allocated
73354 * so that the anon_vma locking is not a noop.
73355 */
73356 if (unlikely(anon_vma_prepare(vma)))
73357 return -ENOMEM;
73358 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
73359 + if (locknext && anon_vma_prepare(vma->vm_next))
73360 + return -ENOMEM;
73361 vma_lock_anon_vma(vma);
73362 + if (locknext)
73363 + vma_lock_anon_vma(vma->vm_next);
73364
73365 /*
73366 * vma->vm_start/vm_end cannot change under us because the caller
73367 * is required to hold the mmap_sem in read mode. We need the
73368 - * anon_vma lock to serialize against concurrent expand_stacks.
73369 - * Also guard against wrapping around to address 0.
73370 + * anon_vma locks to serialize against concurrent expand_stacks
73371 + * and expand_upwards.
73372 */
73373 - if (address < PAGE_ALIGN(address+4))
73374 - address = PAGE_ALIGN(address+4);
73375 - else {
73376 - vma_unlock_anon_vma(vma);
73377 - return -ENOMEM;
73378 - }
73379 error = 0;
73380
73381 /* Somebody else might have raced and expanded it already */
73382 - if (address > vma->vm_end) {
73383 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
73384 + error = -ENOMEM;
73385 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
73386 unsigned long size, grow;
73387
73388 size = address - vma->vm_start;
73389 @@ -1776,6 +2037,8 @@ int expand_upwards(struct vm_area_struct
73390 }
73391 }
73392 }
73393 + if (locknext)
73394 + vma_unlock_anon_vma(vma->vm_next);
73395 vma_unlock_anon_vma(vma);
73396 khugepaged_enter_vma_merge(vma);
73397 return error;
73398 @@ -1789,6 +2052,8 @@ static int expand_downwards(struct vm_ar
73399 unsigned long address)
73400 {
73401 int error;
73402 + bool lockprev = false;
73403 + struct vm_area_struct *prev;
73404
73405 /*
73406 * We must make sure the anon_vma is allocated
73407 @@ -1802,6 +2067,15 @@ static int expand_downwards(struct vm_ar
73408 if (error)
73409 return error;
73410
73411 + prev = vma->vm_prev;
73412 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
73413 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
73414 +#endif
73415 + if (lockprev && anon_vma_prepare(prev))
73416 + return -ENOMEM;
73417 + if (lockprev)
73418 + vma_lock_anon_vma(prev);
73419 +
73420 vma_lock_anon_vma(vma);
73421
73422 /*
73423 @@ -1811,9 +2085,17 @@ static int expand_downwards(struct vm_ar
73424 */
73425
73426 /* Somebody else might have raced and expanded it already */
73427 - if (address < vma->vm_start) {
73428 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
73429 + error = -ENOMEM;
73430 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
73431 unsigned long size, grow;
73432
73433 +#ifdef CONFIG_PAX_SEGMEXEC
73434 + struct vm_area_struct *vma_m;
73435 +
73436 + vma_m = pax_find_mirror_vma(vma);
73437 +#endif
73438 +
73439 size = vma->vm_end - address;
73440 grow = (vma->vm_start - address) >> PAGE_SHIFT;
73441
73442 @@ -1823,11 +2105,22 @@ static int expand_downwards(struct vm_ar
73443 if (!error) {
73444 vma->vm_start = address;
73445 vma->vm_pgoff -= grow;
73446 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
73447 +
73448 +#ifdef CONFIG_PAX_SEGMEXEC
73449 + if (vma_m) {
73450 + vma_m->vm_start -= grow << PAGE_SHIFT;
73451 + vma_m->vm_pgoff -= grow;
73452 + }
73453 +#endif
73454 +
73455 perf_event_mmap(vma);
73456 }
73457 }
73458 }
73459 vma_unlock_anon_vma(vma);
73460 + if (lockprev)
73461 + vma_unlock_anon_vma(prev);
73462 khugepaged_enter_vma_merge(vma);
73463 return error;
73464 }
73465 @@ -1902,6 +2195,13 @@ static void remove_vma_list(struct mm_st
73466 do {
73467 long nrpages = vma_pages(vma);
73468
73469 +#ifdef CONFIG_PAX_SEGMEXEC
73470 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
73471 + vma = remove_vma(vma);
73472 + continue;
73473 + }
73474 +#endif
73475 +
73476 mm->total_vm -= nrpages;
73477 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
73478 vma = remove_vma(vma);
73479 @@ -1947,6 +2247,16 @@ detach_vmas_to_be_unmapped(struct mm_str
73480 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
73481 vma->vm_prev = NULL;
73482 do {
73483 +
73484 +#ifdef CONFIG_PAX_SEGMEXEC
73485 + if (vma->vm_mirror) {
73486 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
73487 + vma->vm_mirror->vm_mirror = NULL;
73488 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
73489 + vma->vm_mirror = NULL;
73490 + }
73491 +#endif
73492 +
73493 rb_erase(&vma->vm_rb, &mm->mm_rb);
73494 mm->map_count--;
73495 tail_vma = vma;
73496 @@ -1975,14 +2285,33 @@ static int __split_vma(struct mm_struct
73497 struct vm_area_struct *new;
73498 int err = -ENOMEM;
73499
73500 +#ifdef CONFIG_PAX_SEGMEXEC
73501 + struct vm_area_struct *vma_m, *new_m = NULL;
73502 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
73503 +#endif
73504 +
73505 if (is_vm_hugetlb_page(vma) && (addr &
73506 ~(huge_page_mask(hstate_vma(vma)))))
73507 return -EINVAL;
73508
73509 +#ifdef CONFIG_PAX_SEGMEXEC
73510 + vma_m = pax_find_mirror_vma(vma);
73511 +#endif
73512 +
73513 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73514 if (!new)
73515 goto out_err;
73516
73517 +#ifdef CONFIG_PAX_SEGMEXEC
73518 + if (vma_m) {
73519 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73520 + if (!new_m) {
73521 + kmem_cache_free(vm_area_cachep, new);
73522 + goto out_err;
73523 + }
73524 + }
73525 +#endif
73526 +
73527 /* most fields are the same, copy all, and then fixup */
73528 *new = *vma;
73529
73530 @@ -1995,6 +2324,22 @@ static int __split_vma(struct mm_struct
73531 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
73532 }
73533
73534 +#ifdef CONFIG_PAX_SEGMEXEC
73535 + if (vma_m) {
73536 + *new_m = *vma_m;
73537 + INIT_LIST_HEAD(&new_m->anon_vma_chain);
73538 + new_m->vm_mirror = new;
73539 + new->vm_mirror = new_m;
73540 +
73541 + if (new_below)
73542 + new_m->vm_end = addr_m;
73543 + else {
73544 + new_m->vm_start = addr_m;
73545 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
73546 + }
73547 + }
73548 +#endif
73549 +
73550 pol = mpol_dup(vma_policy(vma));
73551 if (IS_ERR(pol)) {
73552 err = PTR_ERR(pol);
73553 @@ -2020,6 +2365,42 @@ static int __split_vma(struct mm_struct
73554 else
73555 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
73556
73557 +#ifdef CONFIG_PAX_SEGMEXEC
73558 + if (!err && vma_m) {
73559 + if (anon_vma_clone(new_m, vma_m))
73560 + goto out_free_mpol;
73561 +
73562 + mpol_get(pol);
73563 + vma_set_policy(new_m, pol);
73564 +
73565 + if (new_m->vm_file) {
73566 + get_file(new_m->vm_file);
73567 + if (vma_m->vm_flags & VM_EXECUTABLE)
73568 + added_exe_file_vma(mm);
73569 + }
73570 +
73571 + if (new_m->vm_ops && new_m->vm_ops->open)
73572 + new_m->vm_ops->open(new_m);
73573 +
73574 + if (new_below)
73575 + err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
73576 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
73577 + else
73578 + err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
73579 +
73580 + if (err) {
73581 + if (new_m->vm_ops && new_m->vm_ops->close)
73582 + new_m->vm_ops->close(new_m);
73583 + if (new_m->vm_file) {
73584 + if (vma_m->vm_flags & VM_EXECUTABLE)
73585 + removed_exe_file_vma(mm);
73586 + fput(new_m->vm_file);
73587 + }
73588 + mpol_put(pol);
73589 + }
73590 + }
73591 +#endif
73592 +
73593 /* Success. */
73594 if (!err)
73595 return 0;
73596 @@ -2032,10 +2413,18 @@ static int __split_vma(struct mm_struct
73597 removed_exe_file_vma(mm);
73598 fput(new->vm_file);
73599 }
73600 - unlink_anon_vmas(new);
73601 out_free_mpol:
73602 mpol_put(pol);
73603 out_free_vma:
73604 +
73605 +#ifdef CONFIG_PAX_SEGMEXEC
73606 + if (new_m) {
73607 + unlink_anon_vmas(new_m);
73608 + kmem_cache_free(vm_area_cachep, new_m);
73609 + }
73610 +#endif
73611 +
73612 + unlink_anon_vmas(new);
73613 kmem_cache_free(vm_area_cachep, new);
73614 out_err:
73615 return err;
73616 @@ -2048,6 +2437,15 @@ static int __split_vma(struct mm_struct
73617 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73618 unsigned long addr, int new_below)
73619 {
73620 +
73621 +#ifdef CONFIG_PAX_SEGMEXEC
73622 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73623 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
73624 + if (mm->map_count >= sysctl_max_map_count-1)
73625 + return -ENOMEM;
73626 + } else
73627 +#endif
73628 +
73629 if (mm->map_count >= sysctl_max_map_count)
73630 return -ENOMEM;
73631
73632 @@ -2059,11 +2457,30 @@ int split_vma(struct mm_struct *mm, stru
73633 * work. This now handles partial unmappings.
73634 * Jeremy Fitzhardinge <jeremy@goop.org>
73635 */
73636 +#ifdef CONFIG_PAX_SEGMEXEC
73637 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73638 +{
73639 + int ret = __do_munmap(mm, start, len);
73640 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
73641 + return ret;
73642 +
73643 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
73644 +}
73645 +
73646 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73647 +#else
73648 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73649 +#endif
73650 {
73651 unsigned long end;
73652 struct vm_area_struct *vma, *prev, *last;
73653
73654 + /*
73655 + * mm->mmap_sem is required to protect against another thread
73656 + * changing the mappings in case we sleep.
73657 + */
73658 + verify_mm_writelocked(mm);
73659 +
73660 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
73661 return -EINVAL;
73662
73663 @@ -2137,6 +2554,8 @@ int do_munmap(struct mm_struct *mm, unsi
73664 /* Fix up all other VM information */
73665 remove_vma_list(mm, vma);
73666
73667 + track_exec_limit(mm, start, end, 0UL);
73668 +
73669 return 0;
73670 }
73671
73672 @@ -2149,22 +2568,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
73673
73674 profile_munmap(addr);
73675
73676 +#ifdef CONFIG_PAX_SEGMEXEC
73677 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73678 + (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
73679 + return -EINVAL;
73680 +#endif
73681 +
73682 down_write(&mm->mmap_sem);
73683 ret = do_munmap(mm, addr, len);
73684 up_write(&mm->mmap_sem);
73685 return ret;
73686 }
73687
73688 -static inline void verify_mm_writelocked(struct mm_struct *mm)
73689 -{
73690 -#ifdef CONFIG_DEBUG_VM
73691 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73692 - WARN_ON(1);
73693 - up_read(&mm->mmap_sem);
73694 - }
73695 -#endif
73696 -}
73697 -
73698 /*
73699 * this is really a simplified "do_mmap". it only handles
73700 * anonymous maps. eventually we may be able to do some
73701 @@ -2178,6 +2593,7 @@ unsigned long do_brk(unsigned long addr,
73702 struct rb_node ** rb_link, * rb_parent;
73703 pgoff_t pgoff = addr >> PAGE_SHIFT;
73704 int error;
73705 + unsigned long charged;
73706
73707 len = PAGE_ALIGN(len);
73708 if (!len)
73709 @@ -2189,16 +2605,30 @@ unsigned long do_brk(unsigned long addr,
73710
73711 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73712
73713 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73714 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73715 + flags &= ~VM_EXEC;
73716 +
73717 +#ifdef CONFIG_PAX_MPROTECT
73718 + if (mm->pax_flags & MF_PAX_MPROTECT)
73719 + flags &= ~VM_MAYEXEC;
73720 +#endif
73721 +
73722 + }
73723 +#endif
73724 +
73725 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73726 if (error & ~PAGE_MASK)
73727 return error;
73728
73729 + charged = len >> PAGE_SHIFT;
73730 +
73731 /*
73732 * mlock MCL_FUTURE?
73733 */
73734 if (mm->def_flags & VM_LOCKED) {
73735 unsigned long locked, lock_limit;
73736 - locked = len >> PAGE_SHIFT;
73737 + locked = charged;
73738 locked += mm->locked_vm;
73739 lock_limit = rlimit(RLIMIT_MEMLOCK);
73740 lock_limit >>= PAGE_SHIFT;
73741 @@ -2215,22 +2645,22 @@ unsigned long do_brk(unsigned long addr,
73742 /*
73743 * Clear old maps. this also does some error checking for us
73744 */
73745 - munmap_back:
73746 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73747 if (vma && vma->vm_start < addr + len) {
73748 if (do_munmap(mm, addr, len))
73749 return -ENOMEM;
73750 - goto munmap_back;
73751 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73752 + BUG_ON(vma && vma->vm_start < addr + len);
73753 }
73754
73755 /* Check against address space limits *after* clearing old maps... */
73756 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73757 + if (!may_expand_vm(mm, charged))
73758 return -ENOMEM;
73759
73760 if (mm->map_count > sysctl_max_map_count)
73761 return -ENOMEM;
73762
73763 - if (security_vm_enough_memory(len >> PAGE_SHIFT))
73764 + if (security_vm_enough_memory(charged))
73765 return -ENOMEM;
73766
73767 /* Can we just expand an old private anonymous mapping? */
73768 @@ -2244,7 +2674,7 @@ unsigned long do_brk(unsigned long addr,
73769 */
73770 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73771 if (!vma) {
73772 - vm_unacct_memory(len >> PAGE_SHIFT);
73773 + vm_unacct_memory(charged);
73774 return -ENOMEM;
73775 }
73776
73777 @@ -2258,11 +2688,12 @@ unsigned long do_brk(unsigned long addr,
73778 vma_link(mm, vma, prev, rb_link, rb_parent);
73779 out:
73780 perf_event_mmap(vma);
73781 - mm->total_vm += len >> PAGE_SHIFT;
73782 + mm->total_vm += charged;
73783 if (flags & VM_LOCKED) {
73784 if (!mlock_vma_pages_range(vma, addr, addr + len))
73785 - mm->locked_vm += (len >> PAGE_SHIFT);
73786 + mm->locked_vm += charged;
73787 }
73788 + track_exec_limit(mm, addr, addr + len, flags);
73789 return addr;
73790 }
73791
73792 @@ -2309,8 +2740,10 @@ void exit_mmap(struct mm_struct *mm)
73793 * Walk the list again, actually closing and freeing it,
73794 * with preemption enabled, without holding any MM locks.
73795 */
73796 - while (vma)
73797 + while (vma) {
73798 + vma->vm_mirror = NULL;
73799 vma = remove_vma(vma);
73800 + }
73801
73802 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
73803 }
73804 @@ -2324,6 +2757,13 @@ int insert_vm_struct(struct mm_struct *
73805 struct vm_area_struct * __vma, * prev;
73806 struct rb_node ** rb_link, * rb_parent;
73807
73808 +#ifdef CONFIG_PAX_SEGMEXEC
73809 + struct vm_area_struct *vma_m = NULL;
73810 +#endif
73811 +
73812 + if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
73813 + return -EPERM;
73814 +
73815 /*
73816 * The vm_pgoff of a purely anonymous vma should be irrelevant
73817 * until its first write fault, when page's anon_vma and index
73818 @@ -2346,7 +2786,22 @@ int insert_vm_struct(struct mm_struct *
73819 if ((vma->vm_flags & VM_ACCOUNT) &&
73820 security_vm_enough_memory_mm(mm, vma_pages(vma)))
73821 return -ENOMEM;
73822 +
73823 +#ifdef CONFIG_PAX_SEGMEXEC
73824 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
73825 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73826 + if (!vma_m)
73827 + return -ENOMEM;
73828 + }
73829 +#endif
73830 +
73831 vma_link(mm, vma, prev, rb_link, rb_parent);
73832 +
73833 +#ifdef CONFIG_PAX_SEGMEXEC
73834 + if (vma_m)
73835 + BUG_ON(pax_mirror_vma(vma_m, vma));
73836 +#endif
73837 +
73838 return 0;
73839 }
73840
73841 @@ -2364,6 +2819,8 @@ struct vm_area_struct *copy_vma(struct v
73842 struct rb_node **rb_link, *rb_parent;
73843 struct mempolicy *pol;
73844
73845 + BUG_ON(vma->vm_mirror);
73846 +
73847 /*
73848 * If anonymous vma has not yet been faulted, update new pgoff
73849 * to match new location, to increase its chance of merging.
73850 @@ -2413,6 +2870,39 @@ struct vm_area_struct *copy_vma(struct v
73851 kmem_cache_free(vm_area_cachep, new_vma);
73852 return NULL;
73853 }
73854 +
73855 +#ifdef CONFIG_PAX_SEGMEXEC
73856 +long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
73857 +{
73858 + struct vm_area_struct *prev_m;
73859 + struct rb_node **rb_link_m, *rb_parent_m;
73860 + struct mempolicy *pol_m;
73861 +
73862 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
73863 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
73864 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
73865 + *vma_m = *vma;
73866 + INIT_LIST_HEAD(&vma_m->anon_vma_chain);
73867 + if (anon_vma_clone(vma_m, vma))
73868 + return -ENOMEM;
73869 + pol_m = vma_policy(vma_m);
73870 + mpol_get(pol_m);
73871 + vma_set_policy(vma_m, pol_m);
73872 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
73873 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
73874 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
73875 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
73876 + if (vma_m->vm_file)
73877 + get_file(vma_m->vm_file);
73878 + if (vma_m->vm_ops && vma_m->vm_ops->open)
73879 + vma_m->vm_ops->open(vma_m);
73880 + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
73881 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
73882 + vma_m->vm_mirror = vma;
73883 + vma->vm_mirror = vma_m;
73884 + return 0;
73885 +}
73886 +#endif
73887
73888 /*
73889 * Return true if the calling process may expand its vm space by the passed
73890 @@ -2424,7 +2914,7 @@ int may_expand_vm(struct mm_struct *mm,
73891 unsigned long lim;
73892
73893 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
73894 -
73895 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
73896 if (cur + npages > lim)
73897 return 0;
73898 return 1;
73899 @@ -2495,6 +2985,22 @@ int install_special_mapping(struct mm_st
73900 vma->vm_start = addr;
73901 vma->vm_end = addr + len;
73902
73903 +#ifdef CONFIG_PAX_MPROTECT
73904 + if (mm->pax_flags & MF_PAX_MPROTECT) {
73905 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
73906 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
73907 + return -EPERM;
73908 + if (!(vm_flags & VM_EXEC))
73909 + vm_flags &= ~VM_MAYEXEC;
73910 +#else
73911 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73912 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73913 +#endif
73914 + else
73915 + vm_flags &= ~VM_MAYWRITE;
73916 + }
73917 +#endif
73918 +
73919 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
73920 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73921
73922 diff -urNp linux-2.6.39.1/mm/mprotect.c linux-2.6.39.1/mm/mprotect.c
73923 --- linux-2.6.39.1/mm/mprotect.c 2011-05-19 00:06:34.000000000 -0400
73924 +++ linux-2.6.39.1/mm/mprotect.c 2011-05-22 19:41:42.000000000 -0400
73925 @@ -23,10 +23,16 @@
73926 #include <linux/mmu_notifier.h>
73927 #include <linux/migrate.h>
73928 #include <linux/perf_event.h>
73929 +
73930 +#ifdef CONFIG_PAX_MPROTECT
73931 +#include <linux/elf.h>
73932 +#endif
73933 +
73934 #include <asm/uaccess.h>
73935 #include <asm/pgtable.h>
73936 #include <asm/cacheflush.h>
73937 #include <asm/tlbflush.h>
73938 +#include <asm/mmu_context.h>
73939
73940 #ifndef pgprot_modify
73941 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
73942 @@ -141,6 +147,48 @@ static void change_protection(struct vm_
73943 flush_tlb_range(vma, start, end);
73944 }
73945
73946 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73947 +/* called while holding the mmap semaphor for writing except stack expansion */
73948 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
73949 +{
73950 + unsigned long oldlimit, newlimit = 0UL;
73951 +
73952 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
73953 + return;
73954 +
73955 + spin_lock(&mm->page_table_lock);
73956 + oldlimit = mm->context.user_cs_limit;
73957 + if ((prot & VM_EXEC) && oldlimit < end)
73958 + /* USER_CS limit moved up */
73959 + newlimit = end;
73960 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
73961 + /* USER_CS limit moved down */
73962 + newlimit = start;
73963 +
73964 + if (newlimit) {
73965 + mm->context.user_cs_limit = newlimit;
73966 +
73967 +#ifdef CONFIG_SMP
73968 + wmb();
73969 + cpus_clear(mm->context.cpu_user_cs_mask);
73970 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
73971 +#endif
73972 +
73973 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
73974 + }
73975 + spin_unlock(&mm->page_table_lock);
73976 + if (newlimit == end) {
73977 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
73978 +
73979 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
73980 + if (is_vm_hugetlb_page(vma))
73981 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
73982 + else
73983 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
73984 + }
73985 +}
73986 +#endif
73987 +
73988 int
73989 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73990 unsigned long start, unsigned long end, unsigned long newflags)
73991 @@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm
73992 int error;
73993 int dirty_accountable = 0;
73994
73995 +#ifdef CONFIG_PAX_SEGMEXEC
73996 + struct vm_area_struct *vma_m = NULL;
73997 + unsigned long start_m, end_m;
73998 +
73999 + start_m = start + SEGMEXEC_TASK_SIZE;
74000 + end_m = end + SEGMEXEC_TASK_SIZE;
74001 +#endif
74002 +
74003 if (newflags == oldflags) {
74004 *pprev = vma;
74005 return 0;
74006 }
74007
74008 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
74009 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
74010 +
74011 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
74012 + return -ENOMEM;
74013 +
74014 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
74015 + return -ENOMEM;
74016 + }
74017 +
74018 /*
74019 * If we make a private mapping writable we increase our commit;
74020 * but (without finer accounting) cannot reduce our commit if we
74021 @@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm
74022 }
74023 }
74024
74025 +#ifdef CONFIG_PAX_SEGMEXEC
74026 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
74027 + if (start != vma->vm_start) {
74028 + error = split_vma(mm, vma, start, 1);
74029 + if (error)
74030 + goto fail;
74031 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
74032 + *pprev = (*pprev)->vm_next;
74033 + }
74034 +
74035 + if (end != vma->vm_end) {
74036 + error = split_vma(mm, vma, end, 0);
74037 + if (error)
74038 + goto fail;
74039 + }
74040 +
74041 + if (pax_find_mirror_vma(vma)) {
74042 + error = __do_munmap(mm, start_m, end_m - start_m);
74043 + if (error)
74044 + goto fail;
74045 + } else {
74046 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
74047 + if (!vma_m) {
74048 + error = -ENOMEM;
74049 + goto fail;
74050 + }
74051 + vma->vm_flags = newflags;
74052 + error = pax_mirror_vma(vma_m, vma);
74053 + if (error) {
74054 + vma->vm_flags = oldflags;
74055 + goto fail;
74056 + }
74057 + }
74058 + }
74059 +#endif
74060 +
74061 /*
74062 * First try to merge with previous and/or next vma.
74063 */
74064 @@ -204,9 +306,21 @@ success:
74065 * vm_flags and vm_page_prot are protected by the mmap_sem
74066 * held in write mode.
74067 */
74068 +
74069 +#ifdef CONFIG_PAX_SEGMEXEC
74070 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
74071 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
74072 +#endif
74073 +
74074 vma->vm_flags = newflags;
74075 +
74076 +#ifdef CONFIG_PAX_MPROTECT
74077 + if (mm->binfmt && mm->binfmt->handle_mprotect)
74078 + mm->binfmt->handle_mprotect(vma, newflags);
74079 +#endif
74080 +
74081 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
74082 - vm_get_page_prot(newflags));
74083 + vm_get_page_prot(vma->vm_flags));
74084
74085 if (vma_wants_writenotify(vma)) {
74086 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
74087 @@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74088 end = start + len;
74089 if (end <= start)
74090 return -ENOMEM;
74091 +
74092 +#ifdef CONFIG_PAX_SEGMEXEC
74093 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
74094 + if (end > SEGMEXEC_TASK_SIZE)
74095 + return -EINVAL;
74096 + } else
74097 +#endif
74098 +
74099 + if (end > TASK_SIZE)
74100 + return -EINVAL;
74101 +
74102 if (!arch_validate_prot(prot))
74103 return -EINVAL;
74104
74105 @@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74106 /*
74107 * Does the application expect PROT_READ to imply PROT_EXEC:
74108 */
74109 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
74110 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
74111 prot |= PROT_EXEC;
74112
74113 vm_flags = calc_vm_prot_bits(prot);
74114 @@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74115 if (start > vma->vm_start)
74116 prev = vma;
74117
74118 +#ifdef CONFIG_PAX_MPROTECT
74119 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
74120 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
74121 +#endif
74122 +
74123 for (nstart = start ; ; ) {
74124 unsigned long newflags;
74125
74126 @@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74127
74128 /* newflags >> 4 shift VM_MAY% in place of VM_% */
74129 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
74130 + if (prot & (PROT_WRITE | PROT_EXEC))
74131 + gr_log_rwxmprotect(vma->vm_file);
74132 +
74133 + error = -EACCES;
74134 + goto out;
74135 + }
74136 +
74137 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
74138 error = -EACCES;
74139 goto out;
74140 }
74141 @@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74142 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
74143 if (error)
74144 goto out;
74145 +
74146 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
74147 +
74148 nstart = tmp;
74149
74150 if (nstart < prev->vm_end)
74151 diff -urNp linux-2.6.39.1/mm/mremap.c linux-2.6.39.1/mm/mremap.c
74152 --- linux-2.6.39.1/mm/mremap.c 2011-05-19 00:06:34.000000000 -0400
74153 +++ linux-2.6.39.1/mm/mremap.c 2011-05-22 19:36:33.000000000 -0400
74154 @@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
74155 continue;
74156 pte = ptep_clear_flush(vma, old_addr, old_pte);
74157 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
74158 +
74159 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
74160 + if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
74161 + pte = pte_exprotect(pte);
74162 +#endif
74163 +
74164 set_pte_at(mm, new_addr, new_pte, pte);
74165 }
74166
74167 @@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
74168 if (is_vm_hugetlb_page(vma))
74169 goto Einval;
74170
74171 +#ifdef CONFIG_PAX_SEGMEXEC
74172 + if (pax_find_mirror_vma(vma))
74173 + goto Einval;
74174 +#endif
74175 +
74176 /* We can't remap across vm area boundaries */
74177 if (old_len > vma->vm_end - addr)
74178 goto Efault;
74179 @@ -329,20 +340,25 @@ static unsigned long mremap_to(unsigned
74180 unsigned long ret = -EINVAL;
74181 unsigned long charged = 0;
74182 unsigned long map_flags;
74183 + unsigned long pax_task_size = TASK_SIZE;
74184
74185 if (new_addr & ~PAGE_MASK)
74186 goto out;
74187
74188 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
74189 +#ifdef CONFIG_PAX_SEGMEXEC
74190 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
74191 + pax_task_size = SEGMEXEC_TASK_SIZE;
74192 +#endif
74193 +
74194 + pax_task_size -= PAGE_SIZE;
74195 +
74196 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
74197 goto out;
74198
74199 /* Check if the location we're moving into overlaps the
74200 * old location at all, and fail if it does.
74201 */
74202 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
74203 - goto out;
74204 -
74205 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
74206 + if (addr + old_len > new_addr && new_addr + new_len > addr)
74207 goto out;
74208
74209 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74210 @@ -414,6 +430,7 @@ unsigned long do_mremap(unsigned long ad
74211 struct vm_area_struct *vma;
74212 unsigned long ret = -EINVAL;
74213 unsigned long charged = 0;
74214 + unsigned long pax_task_size = TASK_SIZE;
74215
74216 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
74217 goto out;
74218 @@ -432,6 +449,17 @@ unsigned long do_mremap(unsigned long ad
74219 if (!new_len)
74220 goto out;
74221
74222 +#ifdef CONFIG_PAX_SEGMEXEC
74223 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
74224 + pax_task_size = SEGMEXEC_TASK_SIZE;
74225 +#endif
74226 +
74227 + pax_task_size -= PAGE_SIZE;
74228 +
74229 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
74230 + old_len > pax_task_size || addr > pax_task_size-old_len)
74231 + goto out;
74232 +
74233 if (flags & MREMAP_FIXED) {
74234 if (flags & MREMAP_MAYMOVE)
74235 ret = mremap_to(addr, old_len, new_addr, new_len);
74236 @@ -481,6 +509,7 @@ unsigned long do_mremap(unsigned long ad
74237 addr + new_len);
74238 }
74239 ret = addr;
74240 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
74241 goto out;
74242 }
74243 }
74244 @@ -507,7 +536,13 @@ unsigned long do_mremap(unsigned long ad
74245 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74246 if (ret)
74247 goto out;
74248 +
74249 + map_flags = vma->vm_flags;
74250 ret = move_vma(vma, addr, old_len, new_len, new_addr);
74251 + if (!(ret & ~PAGE_MASK)) {
74252 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
74253 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
74254 + }
74255 }
74256 out:
74257 if (ret & ~PAGE_MASK)
74258 diff -urNp linux-2.6.39.1/mm/nobootmem.c linux-2.6.39.1/mm/nobootmem.c
74259 --- linux-2.6.39.1/mm/nobootmem.c 2011-05-19 00:06:34.000000000 -0400
74260 +++ linux-2.6.39.1/mm/nobootmem.c 2011-05-22 19:36:33.000000000 -0400
74261 @@ -110,19 +110,30 @@ static void __init __free_pages_memory(u
74262 unsigned long __init free_all_memory_core_early(int nodeid)
74263 {
74264 int i;
74265 - u64 start, end;
74266 + u64 start, end, startrange, endrange;
74267 unsigned long count = 0;
74268 - struct range *range = NULL;
74269 + struct range *range = NULL, rangerange = { 0, 0 };
74270 int nr_range;
74271
74272 nr_range = get_free_all_memory_range(&range, nodeid);
74273 + startrange = __pa(range) >> PAGE_SHIFT;
74274 + endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
74275
74276 for (i = 0; i < nr_range; i++) {
74277 start = range[i].start;
74278 end = range[i].end;
74279 + if (start <= endrange && startrange < end) {
74280 + BUG_ON(rangerange.start | rangerange.end);
74281 + rangerange = range[i];
74282 + continue;
74283 + }
74284 count += end - start;
74285 __free_pages_memory(start, end);
74286 }
74287 + start = rangerange.start;
74288 + end = rangerange.end;
74289 + count += end - start;
74290 + __free_pages_memory(start, end);
74291
74292 return count;
74293 }
74294 diff -urNp linux-2.6.39.1/mm/nommu.c linux-2.6.39.1/mm/nommu.c
74295 --- linux-2.6.39.1/mm/nommu.c 2011-05-19 00:06:34.000000000 -0400
74296 +++ linux-2.6.39.1/mm/nommu.c 2011-05-22 19:36:33.000000000 -0400
74297 @@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
74298 int sysctl_overcommit_ratio = 50; /* default is 50% */
74299 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
74300 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
74301 -int heap_stack_gap = 0;
74302
74303 atomic_long_t mmap_pages_allocated;
74304
74305 @@ -833,15 +832,6 @@ struct vm_area_struct *find_vma(struct m
74306 EXPORT_SYMBOL(find_vma);
74307
74308 /*
74309 - * find a VMA
74310 - * - we don't extend stack VMAs under NOMMU conditions
74311 - */
74312 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
74313 -{
74314 - return find_vma(mm, addr);
74315 -}
74316 -
74317 -/*
74318 * expand a stack to a given address
74319 * - not supported under NOMMU conditions
74320 */
74321 @@ -1563,6 +1553,7 @@ int split_vma(struct mm_struct *mm, stru
74322
74323 /* most fields are the same, copy all, and then fixup */
74324 *new = *vma;
74325 + INIT_LIST_HEAD(&new->anon_vma_chain);
74326 *region = *vma->vm_region;
74327 new->vm_region = region;
74328
74329 diff -urNp linux-2.6.39.1/mm/page_alloc.c linux-2.6.39.1/mm/page_alloc.c
74330 --- linux-2.6.39.1/mm/page_alloc.c 2011-06-03 00:04:14.000000000 -0400
74331 +++ linux-2.6.39.1/mm/page_alloc.c 2011-06-03 00:32:08.000000000 -0400
74332 @@ -650,6 +650,10 @@ static bool free_pages_prepare(struct pa
74333 int i;
74334 int bad = 0;
74335
74336 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
74337 + unsigned long index = 1UL << order;
74338 +#endif
74339 +
74340 trace_mm_page_free_direct(page, order);
74341 kmemcheck_free_shadow(page, order);
74342
74343 @@ -665,6 +669,12 @@ static bool free_pages_prepare(struct pa
74344 debug_check_no_obj_freed(page_address(page),
74345 PAGE_SIZE << order);
74346 }
74347 +
74348 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
74349 + for (; index; --index)
74350 + sanitize_highpage(page + index - 1);
74351 +#endif
74352 +
74353 arch_free_page(page, order);
74354 kernel_map_pages(page, 1 << order, 0);
74355
74356 @@ -780,8 +790,10 @@ static int prep_new_page(struct page *pa
74357 arch_alloc_page(page, order);
74358 kernel_map_pages(page, 1 << order, 1);
74359
74360 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
74361 if (gfp_flags & __GFP_ZERO)
74362 prep_zero_page(page, order, gfp_flags);
74363 +#endif
74364
74365 if (order && (gfp_flags & __GFP_COMP))
74366 prep_compound_page(page, order);
74367 @@ -2504,6 +2516,8 @@ void __show_free_areas(unsigned int filt
74368 int cpu;
74369 struct zone *zone;
74370
74371 + pax_track_stack();
74372 +
74373 for_each_populated_zone(zone) {
74374 if (skip_free_areas_zone(filter, zone))
74375 continue;
74376 diff -urNp linux-2.6.39.1/mm/percpu.c linux-2.6.39.1/mm/percpu.c
74377 --- linux-2.6.39.1/mm/percpu.c 2011-05-19 00:06:34.000000000 -0400
74378 +++ linux-2.6.39.1/mm/percpu.c 2011-05-22 19:36:33.000000000 -0400
74379 @@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu
74380 static unsigned int pcpu_last_unit_cpu __read_mostly;
74381
74382 /* the address of the first chunk which starts with the kernel static area */
74383 -void *pcpu_base_addr __read_mostly;
74384 +void *pcpu_base_addr __read_only;
74385 EXPORT_SYMBOL_GPL(pcpu_base_addr);
74386
74387 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
74388 diff -urNp linux-2.6.39.1/mm/rmap.c linux-2.6.39.1/mm/rmap.c
74389 --- linux-2.6.39.1/mm/rmap.c 2011-05-19 00:06:34.000000000 -0400
74390 +++ linux-2.6.39.1/mm/rmap.c 2011-05-22 19:36:33.000000000 -0400
74391 @@ -131,6 +131,10 @@ int anon_vma_prepare(struct vm_area_stru
74392 struct anon_vma *anon_vma = vma->anon_vma;
74393 struct anon_vma_chain *avc;
74394
74395 +#ifdef CONFIG_PAX_SEGMEXEC
74396 + struct anon_vma_chain *avc_m = NULL;
74397 +#endif
74398 +
74399 might_sleep();
74400 if (unlikely(!anon_vma)) {
74401 struct mm_struct *mm = vma->vm_mm;
74402 @@ -140,6 +144,12 @@ int anon_vma_prepare(struct vm_area_stru
74403 if (!avc)
74404 goto out_enomem;
74405
74406 +#ifdef CONFIG_PAX_SEGMEXEC
74407 + avc_m = anon_vma_chain_alloc();
74408 + if (!avc_m)
74409 + goto out_enomem_free_avc;
74410 +#endif
74411 +
74412 anon_vma = find_mergeable_anon_vma(vma);
74413 allocated = NULL;
74414 if (!anon_vma) {
74415 @@ -153,6 +163,21 @@ int anon_vma_prepare(struct vm_area_stru
74416 /* page_table_lock to protect against threads */
74417 spin_lock(&mm->page_table_lock);
74418 if (likely(!vma->anon_vma)) {
74419 +
74420 +#ifdef CONFIG_PAX_SEGMEXEC
74421 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
74422 +
74423 + if (vma_m) {
74424 + BUG_ON(vma_m->anon_vma);
74425 + vma_m->anon_vma = anon_vma;
74426 + avc_m->anon_vma = anon_vma;
74427 + avc_m->vma = vma;
74428 + list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
74429 + list_add(&avc_m->same_anon_vma, &anon_vma->head);
74430 + avc_m = NULL;
74431 + }
74432 +#endif
74433 +
74434 vma->anon_vma = anon_vma;
74435 avc->anon_vma = anon_vma;
74436 avc->vma = vma;
74437 @@ -166,12 +191,24 @@ int anon_vma_prepare(struct vm_area_stru
74438
74439 if (unlikely(allocated))
74440 put_anon_vma(allocated);
74441 +
74442 +#ifdef CONFIG_PAX_SEGMEXEC
74443 + if (unlikely(avc_m))
74444 + anon_vma_chain_free(avc_m);
74445 +#endif
74446 +
74447 if (unlikely(avc))
74448 anon_vma_chain_free(avc);
74449 }
74450 return 0;
74451
74452 out_enomem_free_avc:
74453 +
74454 +#ifdef CONFIG_PAX_SEGMEXEC
74455 + if (avc_m)
74456 + anon_vma_chain_free(avc_m);
74457 +#endif
74458 +
74459 anon_vma_chain_free(avc);
74460 out_enomem:
74461 return -ENOMEM;
74462 @@ -198,7 +235,7 @@ static void anon_vma_chain_link(struct v
74463 * Attach the anon_vmas from src to dst.
74464 * Returns 0 on success, -ENOMEM on failure.
74465 */
74466 -int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
74467 +int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
74468 {
74469 struct anon_vma_chain *avc, *pavc;
74470
74471 @@ -220,7 +257,7 @@ int anon_vma_clone(struct vm_area_struct
74472 * the corresponding VMA in the parent process is attached to.
74473 * Returns 0 on success, non-zero on failure.
74474 */
74475 -int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
74476 +int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
74477 {
74478 struct anon_vma_chain *avc;
74479 struct anon_vma *anon_vma;
74480 diff -urNp linux-2.6.39.1/mm/shmem.c linux-2.6.39.1/mm/shmem.c
74481 --- linux-2.6.39.1/mm/shmem.c 2011-06-03 00:04:14.000000000 -0400
74482 +++ linux-2.6.39.1/mm/shmem.c 2011-06-03 00:32:08.000000000 -0400
74483 @@ -31,7 +31,7 @@
74484 #include <linux/percpu_counter.h>
74485 #include <linux/swap.h>
74486
74487 -static struct vfsmount *shm_mnt;
74488 +struct vfsmount *shm_mnt;
74489
74490 #ifdef CONFIG_SHMEM
74491 /*
74492 @@ -1087,6 +1087,8 @@ static int shmem_writepage(struct page *
74493 goto unlock;
74494 }
74495 entry = shmem_swp_entry(info, index, NULL);
74496 + if (!entry)
74497 + goto unlock;
74498 if (entry->val) {
74499 /*
74500 * The more uptodate page coming down from a stacked
74501 @@ -1158,6 +1160,8 @@ static struct page *shmem_swapin(swp_ent
74502 struct vm_area_struct pvma;
74503 struct page *page;
74504
74505 + pax_track_stack();
74506 +
74507 spol = mpol_cond_copy(&mpol,
74508 mpol_shared_policy_lookup(&info->policy, idx));
74509
74510 @@ -2014,7 +2018,7 @@ static int shmem_symlink(struct inode *d
74511
74512 info = SHMEM_I(inode);
74513 inode->i_size = len-1;
74514 - if (len <= (char *)inode - (char *)info) {
74515 + if (len <= (char *)inode - (char *)info && len <= 64) {
74516 /* do it inline */
74517 memcpy(info, symname, len);
74518 inode->i_op = &shmem_symlink_inline_operations;
74519 @@ -2362,8 +2366,7 @@ int shmem_fill_super(struct super_block
74520 int err = -ENOMEM;
74521
74522 /* Round up to L1_CACHE_BYTES to resist false sharing */
74523 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
74524 - L1_CACHE_BYTES), GFP_KERNEL);
74525 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
74526 if (!sbinfo)
74527 return -ENOMEM;
74528
74529 diff -urNp linux-2.6.39.1/mm/slab.c linux-2.6.39.1/mm/slab.c
74530 --- linux-2.6.39.1/mm/slab.c 2011-05-19 00:06:34.000000000 -0400
74531 +++ linux-2.6.39.1/mm/slab.c 2011-05-22 19:41:42.000000000 -0400
74532 @@ -150,7 +150,7 @@
74533
74534 /* Legal flag mask for kmem_cache_create(). */
74535 #if DEBUG
74536 -# define CREATE_MASK (SLAB_RED_ZONE | \
74537 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
74538 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
74539 SLAB_CACHE_DMA | \
74540 SLAB_STORE_USER | \
74541 @@ -158,7 +158,7 @@
74542 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74543 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
74544 #else
74545 -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
74546 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
74547 SLAB_CACHE_DMA | \
74548 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
74549 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74550 @@ -287,7 +287,7 @@ struct kmem_list3 {
74551 * Need this for bootstrapping a per node allocator.
74552 */
74553 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
74554 -static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
74555 +static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
74556 #define CACHE_CACHE 0
74557 #define SIZE_AC MAX_NUMNODES
74558 #define SIZE_L3 (2 * MAX_NUMNODES)
74559 @@ -388,10 +388,10 @@ static void kmem_list3_init(struct kmem_
74560 if ((x)->max_freeable < i) \
74561 (x)->max_freeable = i; \
74562 } while (0)
74563 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
74564 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
74565 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
74566 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
74567 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
74568 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
74569 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
74570 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
74571 #else
74572 #define STATS_INC_ACTIVE(x) do { } while (0)
74573 #define STATS_DEC_ACTIVE(x) do { } while (0)
74574 @@ -537,7 +537,7 @@ static inline void *index_to_obj(struct
74575 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
74576 */
74577 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
74578 - const struct slab *slab, void *obj)
74579 + const struct slab *slab, const void *obj)
74580 {
74581 u32 offset = (obj - slab->s_mem);
74582 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
74583 @@ -563,7 +563,7 @@ struct cache_names {
74584 static struct cache_names __initdata cache_names[] = {
74585 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
74586 #include <linux/kmalloc_sizes.h>
74587 - {NULL,}
74588 + {NULL}
74589 #undef CACHE
74590 };
74591
74592 @@ -1529,7 +1529,7 @@ void __init kmem_cache_init(void)
74593 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
74594 sizes[INDEX_AC].cs_size,
74595 ARCH_KMALLOC_MINALIGN,
74596 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74597 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74598 NULL);
74599
74600 if (INDEX_AC != INDEX_L3) {
74601 @@ -1537,7 +1537,7 @@ void __init kmem_cache_init(void)
74602 kmem_cache_create(names[INDEX_L3].name,
74603 sizes[INDEX_L3].cs_size,
74604 ARCH_KMALLOC_MINALIGN,
74605 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74606 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74607 NULL);
74608 }
74609
74610 @@ -1555,7 +1555,7 @@ void __init kmem_cache_init(void)
74611 sizes->cs_cachep = kmem_cache_create(names->name,
74612 sizes->cs_size,
74613 ARCH_KMALLOC_MINALIGN,
74614 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74615 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74616 NULL);
74617 }
74618 #ifdef CONFIG_ZONE_DMA
74619 @@ -4270,10 +4270,10 @@ static int s_show(struct seq_file *m, vo
74620 }
74621 /* cpu stats */
74622 {
74623 - unsigned long allochit = atomic_read(&cachep->allochit);
74624 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
74625 - unsigned long freehit = atomic_read(&cachep->freehit);
74626 - unsigned long freemiss = atomic_read(&cachep->freemiss);
74627 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
74628 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
74629 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
74630 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
74631
74632 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
74633 allochit, allocmiss, freehit, freemiss);
74634 @@ -4530,15 +4530,66 @@ static const struct file_operations proc
74635
74636 static int __init slab_proc_init(void)
74637 {
74638 - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
74639 + mode_t gr_mode = S_IRUGO;
74640 +
74641 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
74642 + gr_mode = S_IRUSR;
74643 +#endif
74644 +
74645 + proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
74646 #ifdef CONFIG_DEBUG_SLAB_LEAK
74647 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74648 + proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
74649 #endif
74650 return 0;
74651 }
74652 module_init(slab_proc_init);
74653 #endif
74654
74655 +void check_object_size(const void *ptr, unsigned long n, bool to)
74656 +{
74657 +
74658 +#ifdef CONFIG_PAX_USERCOPY
74659 + struct page *page;
74660 + struct kmem_cache *cachep = NULL;
74661 + struct slab *slabp;
74662 + unsigned int objnr;
74663 + unsigned long offset;
74664 +
74665 + if (!n)
74666 + return;
74667 +
74668 + if (ZERO_OR_NULL_PTR(ptr))
74669 + goto report;
74670 +
74671 + if (!virt_addr_valid(ptr))
74672 + return;
74673 +
74674 + page = virt_to_head_page(ptr);
74675 +
74676 + if (!PageSlab(page)) {
74677 + if (object_is_on_stack(ptr, n) == -1)
74678 + goto report;
74679 + return;
74680 + }
74681 +
74682 + cachep = page_get_cache(page);
74683 + if (!(cachep->flags & SLAB_USERCOPY))
74684 + goto report;
74685 +
74686 + slabp = page_get_slab(page);
74687 + objnr = obj_to_index(cachep, slabp, ptr);
74688 + BUG_ON(objnr >= cachep->num);
74689 + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74690 + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74691 + return;
74692 +
74693 +report:
74694 + pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
74695 +#endif
74696 +
74697 +}
74698 +EXPORT_SYMBOL(check_object_size);
74699 +
74700 /**
74701 * ksize - get the actual amount of memory allocated for a given object
74702 * @objp: Pointer to the object
74703 diff -urNp linux-2.6.39.1/mm/slob.c linux-2.6.39.1/mm/slob.c
74704 --- linux-2.6.39.1/mm/slob.c 2011-05-19 00:06:34.000000000 -0400
74705 +++ linux-2.6.39.1/mm/slob.c 2011-05-22 19:36:33.000000000 -0400
74706 @@ -29,7 +29,7 @@
74707 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74708 * alloc_pages() directly, allocating compound pages so the page order
74709 * does not have to be separately tracked, and also stores the exact
74710 - * allocation size in page->private so that it can be used to accurately
74711 + * allocation size in slob_page->size so that it can be used to accurately
74712 * provide ksize(). These objects are detected in kfree() because slob_page()
74713 * is false for them.
74714 *
74715 @@ -58,6 +58,7 @@
74716 */
74717
74718 #include <linux/kernel.h>
74719 +#include <linux/sched.h>
74720 #include <linux/slab.h>
74721 #include <linux/mm.h>
74722 #include <linux/swap.h> /* struct reclaim_state */
74723 @@ -102,7 +103,8 @@ struct slob_page {
74724 unsigned long flags; /* mandatory */
74725 atomic_t _count; /* mandatory */
74726 slobidx_t units; /* free units left in page */
74727 - unsigned long pad[2];
74728 + unsigned long pad[1];
74729 + unsigned long size; /* size when >=PAGE_SIZE */
74730 slob_t *free; /* first free slob_t in page */
74731 struct list_head list; /* linked list of free pages */
74732 };
74733 @@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
74734 */
74735 static inline int is_slob_page(struct slob_page *sp)
74736 {
74737 - return PageSlab((struct page *)sp);
74738 + return PageSlab((struct page *)sp) && !sp->size;
74739 }
74740
74741 static inline void set_slob_page(struct slob_page *sp)
74742 @@ -150,7 +152,7 @@ static inline void clear_slob_page(struc
74743
74744 static inline struct slob_page *slob_page(const void *addr)
74745 {
74746 - return (struct slob_page *)virt_to_page(addr);
74747 + return (struct slob_page *)virt_to_head_page(addr);
74748 }
74749
74750 /*
74751 @@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_
74752 /*
74753 * Return the size of a slob block.
74754 */
74755 -static slobidx_t slob_units(slob_t *s)
74756 +static slobidx_t slob_units(const slob_t *s)
74757 {
74758 if (s->units > 0)
74759 return s->units;
74760 @@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
74761 /*
74762 * Return the next free slob block pointer after this one.
74763 */
74764 -static slob_t *slob_next(slob_t *s)
74765 +static slob_t *slob_next(const slob_t *s)
74766 {
74767 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74768 slobidx_t next;
74769 @@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
74770 /*
74771 * Returns true if s is the last free block in its page.
74772 */
74773 -static int slob_last(slob_t *s)
74774 +static int slob_last(const slob_t *s)
74775 {
74776 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74777 }
74778 @@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i
74779 if (!page)
74780 return NULL;
74781
74782 + set_slob_page(page);
74783 return page_address(page);
74784 }
74785
74786 @@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp
74787 if (!b)
74788 return NULL;
74789 sp = slob_page(b);
74790 - set_slob_page(sp);
74791
74792 spin_lock_irqsave(&slob_lock, flags);
74793 sp->units = SLOB_UNITS(PAGE_SIZE);
74794 sp->free = b;
74795 + sp->size = 0;
74796 INIT_LIST_HEAD(&sp->list);
74797 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74798 set_slob_page_free(sp, slob_list);
74799 @@ -476,10 +479,9 @@ out:
74800 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
74801 */
74802
74803 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74804 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74805 {
74806 - unsigned int *m;
74807 - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74808 + slob_t *m;
74809 void *ret;
74810
74811 lockdep_trace_alloc(gfp);
74812 @@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t
74813
74814 if (!m)
74815 return NULL;
74816 - *m = size;
74817 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74818 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74819 + m[0].units = size;
74820 + m[1].units = align;
74821 ret = (void *)m + align;
74822
74823 trace_kmalloc_node(_RET_IP_, ret,
74824 @@ -504,9 +509,9 @@ void *__kmalloc_node(size_t size, gfp_t
74825 gfp |= __GFP_COMP;
74826 ret = slob_new_pages(gfp, order, node);
74827 if (ret) {
74828 - struct page *page;
74829 - page = virt_to_page(ret);
74830 - page->private = size;
74831 + struct slob_page *sp;
74832 + sp = slob_page(ret);
74833 + sp->size = size;
74834 }
74835
74836 trace_kmalloc_node(_RET_IP_, ret,
74837 @@ -516,6 +521,13 @@ void *__kmalloc_node(size_t size, gfp_t
74838 kmemleak_alloc(ret, size, 1, gfp);
74839 return ret;
74840 }
74841 +
74842 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74843 +{
74844 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74845 +
74846 + return __kmalloc_node_align(size, gfp, node, align);
74847 +}
74848 EXPORT_SYMBOL(__kmalloc_node);
74849
74850 void kfree(const void *block)
74851 @@ -531,13 +543,81 @@ void kfree(const void *block)
74852 sp = slob_page(block);
74853 if (is_slob_page(sp)) {
74854 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74855 - unsigned int *m = (unsigned int *)(block - align);
74856 - slob_free(m, *m + align);
74857 - } else
74858 + slob_t *m = (slob_t *)(block - align);
74859 + slob_free(m, m[0].units + align);
74860 + } else {
74861 + clear_slob_page(sp);
74862 + free_slob_page(sp);
74863 + sp->size = 0;
74864 put_page(&sp->page);
74865 + }
74866 }
74867 EXPORT_SYMBOL(kfree);
74868
74869 +void check_object_size(const void *ptr, unsigned long n, bool to)
74870 +{
74871 +
74872 +#ifdef CONFIG_PAX_USERCOPY
74873 + struct slob_page *sp;
74874 + const slob_t *free;
74875 + const void *base;
74876 +
74877 + if (!n)
74878 + return;
74879 +
74880 + if (ZERO_OR_NULL_PTR(ptr))
74881 + goto report;
74882 +
74883 + if (!virt_addr_valid(ptr))
74884 + return;
74885 +
74886 + sp = slob_page(ptr);
74887 + if (!PageSlab((struct page*)sp)) {
74888 + if (object_is_on_stack(ptr, n) == -1)
74889 + goto report;
74890 + return;
74891 + }
74892 +
74893 + if (sp->size) {
74894 + base = page_address(&sp->page);
74895 + if (base <= ptr && n <= sp->size - (ptr - base))
74896 + return;
74897 + goto report;
74898 + }
74899 +
74900 + /* some tricky double walking to find the chunk */
74901 + base = (void *)((unsigned long)ptr & PAGE_MASK);
74902 + free = sp->free;
74903 +
74904 + while (!slob_last(free) && (void *)free <= ptr) {
74905 + base = free + slob_units(free);
74906 + free = slob_next(free);
74907 + }
74908 +
74909 + while (base < (void *)free) {
74910 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
74911 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
74912 + int offset;
74913 +
74914 + if (ptr < base + align)
74915 + goto report;
74916 +
74917 + offset = ptr - base - align;
74918 + if (offset < m) {
74919 + if (n <= m - offset)
74920 + return;
74921 + goto report;
74922 + }
74923 + base += size;
74924 + }
74925 +
74926 +report:
74927 + pax_report_usercopy(ptr, n, to, NULL);
74928 +#endif
74929 +
74930 +}
74931 +EXPORT_SYMBOL(check_object_size);
74932 +
74933 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
74934 size_t ksize(const void *block)
74935 {
74936 @@ -550,10 +630,10 @@ size_t ksize(const void *block)
74937 sp = slob_page(block);
74938 if (is_slob_page(sp)) {
74939 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74940 - unsigned int *m = (unsigned int *)(block - align);
74941 - return SLOB_UNITS(*m) * SLOB_UNIT;
74942 + slob_t *m = (slob_t *)(block - align);
74943 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
74944 } else
74945 - return sp->page.private;
74946 + return sp->size;
74947 }
74948 EXPORT_SYMBOL(ksize);
74949
74950 @@ -608,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
74951 {
74952 void *b;
74953
74954 +#ifdef CONFIG_PAX_USERCOPY
74955 + b = __kmalloc_node_align(c->size, flags, node, c->align);
74956 +#else
74957 if (c->size < PAGE_SIZE) {
74958 b = slob_alloc(c->size, flags, c->align, node);
74959 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74960 SLOB_UNITS(c->size) * SLOB_UNIT,
74961 flags, node);
74962 } else {
74963 + struct slob_page *sp;
74964 +
74965 b = slob_new_pages(flags, get_order(c->size), node);
74966 + sp = slob_page(b);
74967 + sp->size = c->size;
74968 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74969 PAGE_SIZE << get_order(c->size),
74970 flags, node);
74971 }
74972 +#endif
74973
74974 if (c->ctor)
74975 c->ctor(b);
74976 @@ -630,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
74977
74978 static void __kmem_cache_free(void *b, int size)
74979 {
74980 - if (size < PAGE_SIZE)
74981 + struct slob_page *sp = slob_page(b);
74982 +
74983 + if (is_slob_page(sp))
74984 slob_free(b, size);
74985 - else
74986 + else {
74987 + clear_slob_page(sp);
74988 + free_slob_page(sp);
74989 + sp->size = 0;
74990 slob_free_pages(b, get_order(size));
74991 + }
74992 }
74993
74994 static void kmem_rcu_free(struct rcu_head *head)
74995 @@ -646,14 +740,23 @@ static void kmem_rcu_free(struct rcu_hea
74996
74997 void kmem_cache_free(struct kmem_cache *c, void *b)
74998 {
74999 + int size = c->size;
75000 +
75001 +#ifdef CONFIG_PAX_USERCOPY
75002 + if (size + c->align < PAGE_SIZE) {
75003 + size += c->align;
75004 + b -= c->align;
75005 + }
75006 +#endif
75007 +
75008 kmemleak_free_recursive(b, c->flags);
75009 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
75010 struct slob_rcu *slob_rcu;
75011 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
75012 - slob_rcu->size = c->size;
75013 + slob_rcu = b + (size - sizeof(struct slob_rcu));
75014 + slob_rcu->size = size;
75015 call_rcu(&slob_rcu->head, kmem_rcu_free);
75016 } else {
75017 - __kmem_cache_free(b, c->size);
75018 + __kmem_cache_free(b, size);
75019 }
75020
75021 trace_kmem_cache_free(_RET_IP_, b);
75022 diff -urNp linux-2.6.39.1/mm/slub.c linux-2.6.39.1/mm/slub.c
75023 --- linux-2.6.39.1/mm/slub.c 2011-06-03 00:04:14.000000000 -0400
75024 +++ linux-2.6.39.1/mm/slub.c 2011-06-03 00:32:08.000000000 -0400
75025 @@ -431,7 +431,7 @@ static void print_track(const char *s, s
75026 if (!t->addr)
75027 return;
75028
75029 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
75030 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
75031 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
75032 }
75033
75034 @@ -2183,6 +2183,8 @@ void kmem_cache_free(struct kmem_cache *
75035
75036 page = virt_to_head_page(x);
75037
75038 + BUG_ON(!PageSlab(page));
75039 +
75040 slab_free(s, page, x, _RET_IP_);
75041
75042 trace_kmem_cache_free(_RET_IP_, x);
75043 @@ -2216,7 +2218,7 @@ static int slub_min_objects;
75044 * Merge control. If this is set then no merging of slab caches will occur.
75045 * (Could be removed. This was introduced to pacify the merge skeptics.)
75046 */
75047 -static int slub_nomerge;
75048 +static int slub_nomerge = 1;
75049
75050 /*
75051 * Calculate the order of allocation given an slab object size.
75052 @@ -2644,7 +2646,7 @@ static int kmem_cache_open(struct kmem_c
75053 * list to avoid pounding the page allocator excessively.
75054 */
75055 set_min_partial(s, ilog2(s->size));
75056 - s->refcount = 1;
75057 + atomic_set(&s->refcount, 1);
75058 #ifdef CONFIG_NUMA
75059 s->remote_node_defrag_ratio = 1000;
75060 #endif
75061 @@ -2750,8 +2752,7 @@ static inline int kmem_cache_close(struc
75062 void kmem_cache_destroy(struct kmem_cache *s)
75063 {
75064 down_write(&slub_lock);
75065 - s->refcount--;
75066 - if (!s->refcount) {
75067 + if (atomic_dec_and_test(&s->refcount)) {
75068 list_del(&s->list);
75069 if (kmem_cache_close(s)) {
75070 printk(KERN_ERR "SLUB %s: %s called for cache that "
75071 @@ -2961,6 +2962,46 @@ void *__kmalloc_node(size_t size, gfp_t
75072 EXPORT_SYMBOL(__kmalloc_node);
75073 #endif
75074
75075 +void check_object_size(const void *ptr, unsigned long n, bool to)
75076 +{
75077 +
75078 +#ifdef CONFIG_PAX_USERCOPY
75079 + struct page *page;
75080 + struct kmem_cache *s = NULL;
75081 + unsigned long offset;
75082 +
75083 + if (!n)
75084 + return;
75085 +
75086 + if (ZERO_OR_NULL_PTR(ptr))
75087 + goto report;
75088 +
75089 + if (!virt_addr_valid(ptr))
75090 + return;
75091 +
75092 + page = virt_to_head_page(ptr);
75093 +
75094 + if (!PageSlab(page)) {
75095 + if (object_is_on_stack(ptr, n) == -1)
75096 + goto report;
75097 + return;
75098 + }
75099 +
75100 + s = page->slab;
75101 + if (!(s->flags & SLAB_USERCOPY))
75102 + goto report;
75103 +
75104 + offset = (ptr - page_address(page)) % s->size;
75105 + if (offset <= s->objsize && n <= s->objsize - offset)
75106 + return;
75107 +
75108 +report:
75109 + pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
75110 +#endif
75111 +
75112 +}
75113 +EXPORT_SYMBOL(check_object_size);
75114 +
75115 size_t ksize(const void *object)
75116 {
75117 struct page *page;
75118 @@ -3205,7 +3246,7 @@ static void __init kmem_cache_bootstrap_
75119 int node;
75120
75121 list_add(&s->list, &slab_caches);
75122 - s->refcount = -1;
75123 + atomic_set(&s->refcount, -1);
75124
75125 for_each_node_state(node, N_NORMAL_MEMORY) {
75126 struct kmem_cache_node *n = get_node(s, node);
75127 @@ -3322,17 +3363,17 @@ void __init kmem_cache_init(void)
75128
75129 /* Caches that are not of the two-to-the-power-of size */
75130 if (KMALLOC_MIN_SIZE <= 32) {
75131 - kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
75132 + kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
75133 caches++;
75134 }
75135
75136 if (KMALLOC_MIN_SIZE <= 64) {
75137 - kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
75138 + kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
75139 caches++;
75140 }
75141
75142 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
75143 - kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
75144 + kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
75145 caches++;
75146 }
75147
75148 @@ -3400,7 +3441,7 @@ static int slab_unmergeable(struct kmem_
75149 /*
75150 * We may have set a slab to be unmergeable during bootstrap.
75151 */
75152 - if (s->refcount < 0)
75153 + if (atomic_read(&s->refcount) < 0)
75154 return 1;
75155
75156 return 0;
75157 @@ -3459,7 +3500,7 @@ struct kmem_cache *kmem_cache_create(con
75158 down_write(&slub_lock);
75159 s = find_mergeable(size, align, flags, name, ctor);
75160 if (s) {
75161 - s->refcount++;
75162 + atomic_inc(&s->refcount);
75163 /*
75164 * Adjust the object sizes so that we clear
75165 * the complete object on kzalloc.
75166 @@ -3468,7 +3509,7 @@ struct kmem_cache *kmem_cache_create(con
75167 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
75168
75169 if (sysfs_slab_alias(s, name)) {
75170 - s->refcount--;
75171 + atomic_dec(&s->refcount);
75172 goto err;
75173 }
75174 up_write(&slub_lock);
75175 @@ -4201,7 +4242,7 @@ SLAB_ATTR_RO(ctor);
75176
75177 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
75178 {
75179 - return sprintf(buf, "%d\n", s->refcount - 1);
75180 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
75181 }
75182 SLAB_ATTR_RO(aliases);
75183
75184 @@ -4945,7 +4986,13 @@ static const struct file_operations proc
75185
75186 static int __init slab_proc_init(void)
75187 {
75188 - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
75189 + mode_t gr_mode = S_IRUGO;
75190 +
75191 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
75192 + gr_mode = S_IRUSR;
75193 +#endif
75194 +
75195 + proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
75196 return 0;
75197 }
75198 module_init(slab_proc_init);
75199 diff -urNp linux-2.6.39.1/mm/swapfile.c linux-2.6.39.1/mm/swapfile.c
75200 --- linux-2.6.39.1/mm/swapfile.c 2011-05-19 00:06:34.000000000 -0400
75201 +++ linux-2.6.39.1/mm/swapfile.c 2011-05-22 19:36:33.000000000 -0400
75202 @@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
75203
75204 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
75205 /* Activity counter to indicate that a swapon or swapoff has occurred */
75206 -static atomic_t proc_poll_event = ATOMIC_INIT(0);
75207 +static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
75208
75209 static inline unsigned char swap_count(unsigned char ent)
75210 {
75211 @@ -1669,7 +1669,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
75212 }
75213 filp_close(swap_file, NULL);
75214 err = 0;
75215 - atomic_inc(&proc_poll_event);
75216 + atomic_inc_unchecked(&proc_poll_event);
75217 wake_up_interruptible(&proc_poll_wait);
75218
75219 out_dput:
75220 @@ -1690,8 +1690,8 @@ static unsigned swaps_poll(struct file *
75221
75222 poll_wait(file, &proc_poll_wait, wait);
75223
75224 - if (s->event != atomic_read(&proc_poll_event)) {
75225 - s->event = atomic_read(&proc_poll_event);
75226 + if (s->event != atomic_read_unchecked(&proc_poll_event)) {
75227 + s->event = atomic_read_unchecked(&proc_poll_event);
75228 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
75229 }
75230
75231 @@ -1797,7 +1797,7 @@ static int swaps_open(struct inode *inod
75232 }
75233
75234 s->seq.private = s;
75235 - s->event = atomic_read(&proc_poll_event);
75236 + s->event = atomic_read_unchecked(&proc_poll_event);
75237 return ret;
75238 }
75239
75240 @@ -2131,7 +2131,7 @@ SYSCALL_DEFINE2(swapon, const char __use
75241 (p->flags & SWP_DISCARDABLE) ? "D" : "");
75242
75243 mutex_unlock(&swapon_mutex);
75244 - atomic_inc(&proc_poll_event);
75245 + atomic_inc_unchecked(&proc_poll_event);
75246 wake_up_interruptible(&proc_poll_wait);
75247
75248 if (S_ISREG(inode->i_mode))
75249 diff -urNp linux-2.6.39.1/mm/util.c linux-2.6.39.1/mm/util.c
75250 --- linux-2.6.39.1/mm/util.c 2011-05-19 00:06:34.000000000 -0400
75251 +++ linux-2.6.39.1/mm/util.c 2011-05-23 17:07:00.000000000 -0400
75252 @@ -112,6 +112,7 @@ EXPORT_SYMBOL(memdup_user);
75253 * allocated buffer. Use this if you don't want to free the buffer immediately
75254 * like, for example, with RCU.
75255 */
75256 +#undef __krealloc
75257 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
75258 {
75259 void *ret;
75260 @@ -145,6 +146,7 @@ EXPORT_SYMBOL(__krealloc);
75261 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
75262 * %NULL pointer, the object pointed to is freed.
75263 */
75264 +#undef krealloc
75265 void *krealloc(const void *p, size_t new_size, gfp_t flags)
75266 {
75267 void *ret;
75268 @@ -219,6 +221,12 @@ EXPORT_SYMBOL(strndup_user);
75269 void arch_pick_mmap_layout(struct mm_struct *mm)
75270 {
75271 mm->mmap_base = TASK_UNMAPPED_BASE;
75272 +
75273 +#ifdef CONFIG_PAX_RANDMMAP
75274 + if (mm->pax_flags & MF_PAX_RANDMMAP)
75275 + mm->mmap_base += mm->delta_mmap;
75276 +#endif
75277 +
75278 mm->get_unmapped_area = arch_get_unmapped_area;
75279 mm->unmap_area = arch_unmap_area;
75280 }
75281 diff -urNp linux-2.6.39.1/mm/vmalloc.c linux-2.6.39.1/mm/vmalloc.c
75282 --- linux-2.6.39.1/mm/vmalloc.c 2011-05-19 00:06:34.000000000 -0400
75283 +++ linux-2.6.39.1/mm/vmalloc.c 2011-05-22 19:36:33.000000000 -0400
75284 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
75285
75286 pte = pte_offset_kernel(pmd, addr);
75287 do {
75288 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75289 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75290 +
75291 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75292 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
75293 + BUG_ON(!pte_exec(*pte));
75294 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
75295 + continue;
75296 + }
75297 +#endif
75298 +
75299 + {
75300 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75301 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75302 + }
75303 } while (pte++, addr += PAGE_SIZE, addr != end);
75304 }
75305
75306 @@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un
75307 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
75308 {
75309 pte_t *pte;
75310 + int ret = -ENOMEM;
75311
75312 /*
75313 * nr is a running index into the array which helps higher level
75314 @@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un
75315 pte = pte_alloc_kernel(pmd, addr);
75316 if (!pte)
75317 return -ENOMEM;
75318 +
75319 + pax_open_kernel();
75320 do {
75321 struct page *page = pages[*nr];
75322
75323 - if (WARN_ON(!pte_none(*pte)))
75324 - return -EBUSY;
75325 - if (WARN_ON(!page))
75326 - return -ENOMEM;
75327 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75328 + if (pgprot_val(prot) & _PAGE_NX)
75329 +#endif
75330 +
75331 + if (WARN_ON(!pte_none(*pte))) {
75332 + ret = -EBUSY;
75333 + goto out;
75334 + }
75335 + if (WARN_ON(!page)) {
75336 + ret = -ENOMEM;
75337 + goto out;
75338 + }
75339 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
75340 (*nr)++;
75341 } while (pte++, addr += PAGE_SIZE, addr != end);
75342 - return 0;
75343 + ret = 0;
75344 +out:
75345 + pax_close_kernel();
75346 + return ret;
75347 }
75348
75349 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
75350 @@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void
75351 * and fall back on vmalloc() if that fails. Others
75352 * just put it in the vmalloc space.
75353 */
75354 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
75355 +#ifdef CONFIG_MODULES
75356 +#ifdef MODULES_VADDR
75357 unsigned long addr = (unsigned long)x;
75358 if (addr >= MODULES_VADDR && addr < MODULES_END)
75359 return 1;
75360 #endif
75361 +
75362 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75363 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
75364 + return 1;
75365 +#endif
75366 +
75367 +#endif
75368 +
75369 return is_vmalloc_addr(x);
75370 }
75371
75372 @@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void
75373
75374 if (!pgd_none(*pgd)) {
75375 pud_t *pud = pud_offset(pgd, addr);
75376 +#ifdef CONFIG_X86
75377 + if (!pud_large(*pud))
75378 +#endif
75379 if (!pud_none(*pud)) {
75380 pmd_t *pmd = pmd_offset(pud, addr);
75381 +#ifdef CONFIG_X86
75382 + if (!pmd_large(*pmd))
75383 +#endif
75384 if (!pmd_none(*pmd)) {
75385 pte_t *ptep, pte;
75386
75387 @@ -1296,6 +1336,16 @@ static struct vm_struct *__get_vm_area_n
75388 struct vm_struct *area;
75389
75390 BUG_ON(in_interrupt());
75391 +
75392 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75393 + if (flags & VM_KERNEXEC) {
75394 + if (start != VMALLOC_START || end != VMALLOC_END)
75395 + return NULL;
75396 + start = (unsigned long)MODULES_EXEC_VADDR;
75397 + end = (unsigned long)MODULES_EXEC_END;
75398 + }
75399 +#endif
75400 +
75401 if (flags & VM_IOREMAP) {
75402 int bit = fls(size);
75403
75404 @@ -1514,6 +1564,11 @@ void *vmap(struct page **pages, unsigned
75405 if (count > totalram_pages)
75406 return NULL;
75407
75408 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75409 + if (!(pgprot_val(prot) & _PAGE_NX))
75410 + flags |= VM_KERNEXEC;
75411 +#endif
75412 +
75413 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
75414 __builtin_return_address(0));
75415 if (!area)
75416 @@ -1610,6 +1665,13 @@ void *__vmalloc_node_range(unsigned long
75417 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
75418 return NULL;
75419
75420 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75421 + if (!(pgprot_val(prot) & _PAGE_NX))
75422 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
75423 + node, gfp_mask, caller);
75424 + else
75425 +#endif
75426 +
75427 area = __get_vm_area_node(size, align, VM_ALLOC, start, end, node,
75428 gfp_mask, caller);
75429
75430 @@ -1649,6 +1711,7 @@ static void *__vmalloc_node(unsigned lon
75431 gfp_mask, prot, node, caller);
75432 }
75433
75434 +#undef __vmalloc
75435 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
75436 {
75437 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
75438 @@ -1672,6 +1735,7 @@ static inline void *__vmalloc_node_flags
75439 * For tight control over page level allocator and protection flags
75440 * use __vmalloc() instead.
75441 */
75442 +#undef vmalloc
75443 void *vmalloc(unsigned long size)
75444 {
75445 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
75446 @@ -1688,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc);
75447 * For tight control over page level allocator and protection flags
75448 * use __vmalloc() instead.
75449 */
75450 +#undef vzalloc
75451 void *vzalloc(unsigned long size)
75452 {
75453 return __vmalloc_node_flags(size, -1,
75454 @@ -1702,6 +1767,7 @@ EXPORT_SYMBOL(vzalloc);
75455 * The resulting memory area is zeroed so it can be mapped to userspace
75456 * without leaking data.
75457 */
75458 +#undef vmalloc_user
75459 void *vmalloc_user(unsigned long size)
75460 {
75461 struct vm_struct *area;
75462 @@ -1729,6 +1795,7 @@ EXPORT_SYMBOL(vmalloc_user);
75463 * For tight control over page level allocator and protection flags
75464 * use __vmalloc() instead.
75465 */
75466 +#undef vmalloc_node
75467 void *vmalloc_node(unsigned long size, int node)
75468 {
75469 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
75470 @@ -1748,6 +1815,7 @@ EXPORT_SYMBOL(vmalloc_node);
75471 * For tight control over page level allocator and protection flags
75472 * use __vmalloc_node() instead.
75473 */
75474 +#undef vzalloc_node
75475 void *vzalloc_node(unsigned long size, int node)
75476 {
75477 return __vmalloc_node_flags(size, node,
75478 @@ -1770,10 +1838,10 @@ EXPORT_SYMBOL(vzalloc_node);
75479 * For tight control over page level allocator and protection flags
75480 * use __vmalloc() instead.
75481 */
75482 -
75483 +#undef vmalloc_exec
75484 void *vmalloc_exec(unsigned long size)
75485 {
75486 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
75487 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
75488 -1, __builtin_return_address(0));
75489 }
75490
75491 @@ -1792,6 +1860,7 @@ void *vmalloc_exec(unsigned long size)
75492 * Allocate enough 32bit PA addressable pages to cover @size from the
75493 * page level allocator and map them into contiguous kernel virtual space.
75494 */
75495 +#undef vmalloc_32
75496 void *vmalloc_32(unsigned long size)
75497 {
75498 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
75499 @@ -1806,6 +1875,7 @@ EXPORT_SYMBOL(vmalloc_32);
75500 * The resulting memory area is 32bit addressable and zeroed so it can be
75501 * mapped to userspace without leaking data.
75502 */
75503 +#undef vmalloc_32_user
75504 void *vmalloc_32_user(unsigned long size)
75505 {
75506 struct vm_struct *area;
75507 @@ -2068,6 +2138,8 @@ int remap_vmalloc_range(struct vm_area_s
75508 unsigned long uaddr = vma->vm_start;
75509 unsigned long usize = vma->vm_end - vma->vm_start;
75510
75511 + BUG_ON(vma->vm_mirror);
75512 +
75513 if ((PAGE_SIZE-1) & (unsigned long)addr)
75514 return -EINVAL;
75515
75516 diff -urNp linux-2.6.39.1/mm/vmstat.c linux-2.6.39.1/mm/vmstat.c
75517 --- linux-2.6.39.1/mm/vmstat.c 2011-05-19 00:06:34.000000000 -0400
75518 +++ linux-2.6.39.1/mm/vmstat.c 2011-05-22 19:41:42.000000000 -0400
75519 @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
75520 *
75521 * vm_stat contains the global counters
75522 */
75523 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75524 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75525 EXPORT_SYMBOL(vm_stat);
75526
75527 #ifdef CONFIG_SMP
75528 @@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
75529 v = p->vm_stat_diff[i];
75530 p->vm_stat_diff[i] = 0;
75531 local_irq_restore(flags);
75532 - atomic_long_add(v, &zone->vm_stat[i]);
75533 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75534 global_diff[i] += v;
75535 #ifdef CONFIG_NUMA
75536 /* 3 seconds idle till flush */
75537 @@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
75538
75539 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75540 if (global_diff[i])
75541 - atomic_long_add(global_diff[i], &vm_stat[i]);
75542 + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75543 }
75544
75545 #endif
75546 @@ -1205,10 +1205,20 @@ static int __init setup_vmstat(void)
75547 start_cpu_timer(cpu);
75548 #endif
75549 #ifdef CONFIG_PROC_FS
75550 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75551 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75552 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75553 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75554 + {
75555 + mode_t gr_mode = S_IRUGO;
75556 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
75557 + gr_mode = S_IRUSR;
75558 +#endif
75559 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75560 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
75561 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75562 + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75563 +#else
75564 + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
75565 +#endif
75566 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75567 + }
75568 #endif
75569 return 0;
75570 }
75571 diff -urNp linux-2.6.39.1/net/8021q/vlan.c linux-2.6.39.1/net/8021q/vlan.c
75572 --- linux-2.6.39.1/net/8021q/vlan.c 2011-05-19 00:06:34.000000000 -0400
75573 +++ linux-2.6.39.1/net/8021q/vlan.c 2011-05-22 19:36:33.000000000 -0400
75574 @@ -592,8 +592,7 @@ static int vlan_ioctl_handler(struct net
75575 err = -EPERM;
75576 if (!capable(CAP_NET_ADMIN))
75577 break;
75578 - if ((args.u.name_type >= 0) &&
75579 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75580 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75581 struct vlan_net *vn;
75582
75583 vn = net_generic(net, vlan_net_id);
75584 diff -urNp linux-2.6.39.1/net/atm/atm_misc.c linux-2.6.39.1/net/atm/atm_misc.c
75585 --- linux-2.6.39.1/net/atm/atm_misc.c 2011-05-19 00:06:34.000000000 -0400
75586 +++ linux-2.6.39.1/net/atm/atm_misc.c 2011-05-22 19:36:33.000000000 -0400
75587 @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int
75588 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75589 return 1;
75590 atm_return(vcc, truesize);
75591 - atomic_inc(&vcc->stats->rx_drop);
75592 + atomic_inc_unchecked(&vcc->stats->rx_drop);
75593 return 0;
75594 }
75595 EXPORT_SYMBOL(atm_charge);
75596 @@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct
75597 }
75598 }
75599 atm_return(vcc, guess);
75600 - atomic_inc(&vcc->stats->rx_drop);
75601 + atomic_inc_unchecked(&vcc->stats->rx_drop);
75602 return NULL;
75603 }
75604 EXPORT_SYMBOL(atm_alloc_charge);
75605 @@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
75606
75607 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75608 {
75609 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75610 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75611 __SONET_ITEMS
75612 #undef __HANDLE_ITEM
75613 }
75614 @@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
75615
75616 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75617 {
75618 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75619 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75620 __SONET_ITEMS
75621 #undef __HANDLE_ITEM
75622 }
75623 diff -urNp linux-2.6.39.1/net/atm/mpoa_caches.c linux-2.6.39.1/net/atm/mpoa_caches.c
75624 --- linux-2.6.39.1/net/atm/mpoa_caches.c 2011-05-19 00:06:34.000000000 -0400
75625 +++ linux-2.6.39.1/net/atm/mpoa_caches.c 2011-05-22 19:36:33.000000000 -0400
75626 @@ -255,6 +255,8 @@ static void check_resolving_entries(stru
75627 struct timeval now;
75628 struct k_message msg;
75629
75630 + pax_track_stack();
75631 +
75632 do_gettimeofday(&now);
75633
75634 read_lock_bh(&client->ingress_lock);
75635 diff -urNp linux-2.6.39.1/net/atm/proc.c linux-2.6.39.1/net/atm/proc.c
75636 --- linux-2.6.39.1/net/atm/proc.c 2011-05-19 00:06:34.000000000 -0400
75637 +++ linux-2.6.39.1/net/atm/proc.c 2011-05-22 19:41:42.000000000 -0400
75638 @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
75639 const struct k_atm_aal_stats *stats)
75640 {
75641 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
75642 - atomic_read(&stats->tx), atomic_read(&stats->tx_err),
75643 - atomic_read(&stats->rx), atomic_read(&stats->rx_err),
75644 - atomic_read(&stats->rx_drop));
75645 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75646 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75647 + atomic_read_unchecked(&stats->rx_drop));
75648 }
75649
75650 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
75651 @@ -191,7 +191,12 @@ static void vcc_info(struct seq_file *se
75652 {
75653 struct sock *sk = sk_atm(vcc);
75654
75655 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75656 + seq_printf(seq, "%p ", NULL);
75657 +#else
75658 seq_printf(seq, "%p ", vcc);
75659 +#endif
75660 +
75661 if (!vcc->dev)
75662 seq_printf(seq, "Unassigned ");
75663 else
75664 @@ -218,7 +223,11 @@ static void svc_info(struct seq_file *se
75665 {
75666 if (!vcc->dev)
75667 seq_printf(seq, sizeof(void *) == 4 ?
75668 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75669 + "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
75670 +#else
75671 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
75672 +#endif
75673 else
75674 seq_printf(seq, "%3d %3d %5d ",
75675 vcc->dev->number, vcc->vpi, vcc->vci);
75676 diff -urNp linux-2.6.39.1/net/atm/resources.c linux-2.6.39.1/net/atm/resources.c
75677 --- linux-2.6.39.1/net/atm/resources.c 2011-05-19 00:06:34.000000000 -0400
75678 +++ linux-2.6.39.1/net/atm/resources.c 2011-05-22 19:36:33.000000000 -0400
75679 @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
75680 static void copy_aal_stats(struct k_atm_aal_stats *from,
75681 struct atm_aal_stats *to)
75682 {
75683 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75684 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75685 __AAL_STAT_ITEMS
75686 #undef __HANDLE_ITEM
75687 }
75688 @@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_
75689 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75690 struct atm_aal_stats *to)
75691 {
75692 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75693 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75694 __AAL_STAT_ITEMS
75695 #undef __HANDLE_ITEM
75696 }
75697 diff -urNp linux-2.6.39.1/net/batman-adv/hard-interface.c linux-2.6.39.1/net/batman-adv/hard-interface.c
75698 --- linux-2.6.39.1/net/batman-adv/hard-interface.c 2011-05-19 00:06:34.000000000 -0400
75699 +++ linux-2.6.39.1/net/batman-adv/hard-interface.c 2011-05-22 19:36:33.000000000 -0400
75700 @@ -339,8 +339,8 @@ int hardif_enable_interface(struct hard_
75701 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
75702 dev_add_pack(&hard_iface->batman_adv_ptype);
75703
75704 - atomic_set(&hard_iface->seqno, 1);
75705 - atomic_set(&hard_iface->frag_seqno, 1);
75706 + atomic_set_unchecked(&hard_iface->seqno, 1);
75707 + atomic_set_unchecked(&hard_iface->frag_seqno, 1);
75708 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
75709 hard_iface->net_dev->name);
75710
75711 diff -urNp linux-2.6.39.1/net/batman-adv/routing.c linux-2.6.39.1/net/batman-adv/routing.c
75712 --- linux-2.6.39.1/net/batman-adv/routing.c 2011-05-19 00:06:34.000000000 -0400
75713 +++ linux-2.6.39.1/net/batman-adv/routing.c 2011-05-22 19:36:33.000000000 -0400
75714 @@ -625,7 +625,7 @@ void receive_bat_packet(struct ethhdr *e
75715 return;
75716
75717 /* could be changed by schedule_own_packet() */
75718 - if_incoming_seqno = atomic_read(&if_incoming->seqno);
75719 + if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
75720
75721 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
75722
75723 diff -urNp linux-2.6.39.1/net/batman-adv/send.c linux-2.6.39.1/net/batman-adv/send.c
75724 --- linux-2.6.39.1/net/batman-adv/send.c 2011-05-19 00:06:34.000000000 -0400
75725 +++ linux-2.6.39.1/net/batman-adv/send.c 2011-05-22 19:36:33.000000000 -0400
75726 @@ -277,7 +277,7 @@ void schedule_own_packet(struct hard_ifa
75727
75728 /* change sequence number to network order */
75729 batman_packet->seqno =
75730 - htonl((uint32_t)atomic_read(&hard_iface->seqno));
75731 + htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
75732
75733 if (vis_server == VIS_TYPE_SERVER_SYNC)
75734 batman_packet->flags |= VIS_SERVER;
75735 @@ -291,7 +291,7 @@ void schedule_own_packet(struct hard_ifa
75736 else
75737 batman_packet->gw_flags = 0;
75738
75739 - atomic_inc(&hard_iface->seqno);
75740 + atomic_inc_unchecked(&hard_iface->seqno);
75741
75742 slide_own_bcast_window(hard_iface);
75743 send_time = own_send_time(bat_priv);
75744 diff -urNp linux-2.6.39.1/net/batman-adv/soft-interface.c linux-2.6.39.1/net/batman-adv/soft-interface.c
75745 --- linux-2.6.39.1/net/batman-adv/soft-interface.c 2011-05-19 00:06:34.000000000 -0400
75746 +++ linux-2.6.39.1/net/batman-adv/soft-interface.c 2011-05-22 19:36:33.000000000 -0400
75747 @@ -386,7 +386,7 @@ int interface_tx(struct sk_buff *skb, st
75748
75749 /* set broadcast sequence number */
75750 bcast_packet->seqno =
75751 - htonl(atomic_inc_return(&bat_priv->bcast_seqno));
75752 + htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
75753
75754 add_bcast_packet_to_list(bat_priv, skb);
75755
75756 @@ -579,7 +579,7 @@ struct net_device *softif_create(char *n
75757 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
75758
75759 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
75760 - atomic_set(&bat_priv->bcast_seqno, 1);
75761 + atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
75762 atomic_set(&bat_priv->hna_local_changed, 0);
75763
75764 bat_priv->primary_if = NULL;
75765 diff -urNp linux-2.6.39.1/net/batman-adv/types.h linux-2.6.39.1/net/batman-adv/types.h
75766 --- linux-2.6.39.1/net/batman-adv/types.h 2011-05-19 00:06:34.000000000 -0400
75767 +++ linux-2.6.39.1/net/batman-adv/types.h 2011-05-22 19:36:33.000000000 -0400
75768 @@ -38,8 +38,8 @@ struct hard_iface {
75769 int16_t if_num;
75770 char if_status;
75771 struct net_device *net_dev;
75772 - atomic_t seqno;
75773 - atomic_t frag_seqno;
75774 + atomic_unchecked_t seqno;
75775 + atomic_unchecked_t frag_seqno;
75776 unsigned char *packet_buff;
75777 int packet_len;
75778 struct kobject *hardif_obj;
75779 @@ -141,7 +141,7 @@ struct bat_priv {
75780 atomic_t orig_interval; /* uint */
75781 atomic_t hop_penalty; /* uint */
75782 atomic_t log_level; /* uint */
75783 - atomic_t bcast_seqno;
75784 + atomic_unchecked_t bcast_seqno;
75785 atomic_t bcast_queue_left;
75786 atomic_t batman_queue_left;
75787 char num_ifaces;
75788 diff -urNp linux-2.6.39.1/net/batman-adv/unicast.c linux-2.6.39.1/net/batman-adv/unicast.c
75789 --- linux-2.6.39.1/net/batman-adv/unicast.c 2011-05-19 00:06:34.000000000 -0400
75790 +++ linux-2.6.39.1/net/batman-adv/unicast.c 2011-05-22 19:36:33.000000000 -0400
75791 @@ -263,7 +263,7 @@ int frag_send_skb(struct sk_buff *skb, s
75792 frag1->flags = UNI_FRAG_HEAD | large_tail;
75793 frag2->flags = large_tail;
75794
75795 - seqno = atomic_add_return(2, &hard_iface->frag_seqno);
75796 + seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
75797 frag1->seqno = htons(seqno - 1);
75798 frag2->seqno = htons(seqno);
75799
75800 diff -urNp linux-2.6.39.1/net/bluetooth/l2cap_sock.c linux-2.6.39.1/net/bluetooth/l2cap_sock.c
75801 --- linux-2.6.39.1/net/bluetooth/l2cap_sock.c 2011-05-19 00:06:34.000000000 -0400
75802 +++ linux-2.6.39.1/net/bluetooth/l2cap_sock.c 2011-06-12 06:36:08.000000000 -0400
75803 @@ -446,6 +446,7 @@ static int l2cap_sock_getsockopt_old(str
75804 break;
75805 }
75806
75807 + memset(&cinfo, 0, sizeof(cinfo));
75808 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
75809 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
75810
75811 diff -urNp linux-2.6.39.1/net/bluetooth/rfcomm/sock.c linux-2.6.39.1/net/bluetooth/rfcomm/sock.c
75812 --- linux-2.6.39.1/net/bluetooth/rfcomm/sock.c 2011-05-19 00:06:34.000000000 -0400
75813 +++ linux-2.6.39.1/net/bluetooth/rfcomm/sock.c 2011-06-12 06:36:42.000000000 -0400
75814 @@ -787,6 +787,7 @@ static int rfcomm_sock_getsockopt_old(st
75815
75816 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
75817
75818 + memset(&cinfo, 0, sizeof(cinfo));
75819 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
75820 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
75821
75822 diff -urNp linux-2.6.39.1/net/bridge/br_multicast.c linux-2.6.39.1/net/bridge/br_multicast.c
75823 --- linux-2.6.39.1/net/bridge/br_multicast.c 2011-05-19 00:06:34.000000000 -0400
75824 +++ linux-2.6.39.1/net/bridge/br_multicast.c 2011-05-22 19:36:33.000000000 -0400
75825 @@ -1482,7 +1482,7 @@ static int br_multicast_ipv6_rcv(struct
75826 nexthdr = ip6h->nexthdr;
75827 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
75828
75829 - if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
75830 + if (nexthdr != IPPROTO_ICMPV6)
75831 return 0;
75832
75833 /* Okay, we found ICMPv6 header */
75834 diff -urNp linux-2.6.39.1/net/bridge/netfilter/ebtables.c linux-2.6.39.1/net/bridge/netfilter/ebtables.c
75835 --- linux-2.6.39.1/net/bridge/netfilter/ebtables.c 2011-05-19 00:06:34.000000000 -0400
75836 +++ linux-2.6.39.1/net/bridge/netfilter/ebtables.c 2011-05-22 19:36:33.000000000 -0400
75837 @@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
75838 tmp.valid_hooks = t->table->valid_hooks;
75839 }
75840 mutex_unlock(&ebt_mutex);
75841 - if (copy_to_user(user, &tmp, *len) != 0){
75842 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
75843 BUGPRINT("c2u Didn't work\n");
75844 ret = -EFAULT;
75845 break;
75846 @@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use
75847 int ret;
75848 void __user *pos;
75849
75850 + pax_track_stack();
75851 +
75852 memset(&tinfo, 0, sizeof(tinfo));
75853
75854 if (cmd == EBT_SO_GET_ENTRIES) {
75855 diff -urNp linux-2.6.39.1/net/caif/caif_socket.c linux-2.6.39.1/net/caif/caif_socket.c
75856 --- linux-2.6.39.1/net/caif/caif_socket.c 2011-05-19 00:06:34.000000000 -0400
75857 +++ linux-2.6.39.1/net/caif/caif_socket.c 2011-05-22 19:36:33.000000000 -0400
75858 @@ -48,18 +48,19 @@ static struct dentry *debugfsdir;
75859 #ifdef CONFIG_DEBUG_FS
75860 struct debug_fs_counter {
75861 atomic_t caif_nr_socks;
75862 - atomic_t num_connect_req;
75863 - atomic_t num_connect_resp;
75864 - atomic_t num_connect_fail_resp;
75865 - atomic_t num_disconnect;
75866 - atomic_t num_remote_shutdown_ind;
75867 - atomic_t num_tx_flow_off_ind;
75868 - atomic_t num_tx_flow_on_ind;
75869 - atomic_t num_rx_flow_off;
75870 - atomic_t num_rx_flow_on;
75871 + atomic_unchecked_t num_connect_req;
75872 + atomic_unchecked_t num_connect_resp;
75873 + atomic_unchecked_t num_connect_fail_resp;
75874 + atomic_unchecked_t num_disconnect;
75875 + atomic_unchecked_t num_remote_shutdown_ind;
75876 + atomic_unchecked_t num_tx_flow_off_ind;
75877 + atomic_unchecked_t num_tx_flow_on_ind;
75878 + atomic_unchecked_t num_rx_flow_off;
75879 + atomic_unchecked_t num_rx_flow_on;
75880 };
75881 static struct debug_fs_counter cnt;
75882 #define dbfs_atomic_inc(v) atomic_inc(v)
75883 +#define dbfs_atomic_inc_unchecked(v) atomic_inc_unchecked(v)
75884 #define dbfs_atomic_dec(v) atomic_dec(v)
75885 #else
75886 #define dbfs_atomic_inc(v)
75887 @@ -159,7 +160,7 @@ static int caif_queue_rcv_skb(struct soc
75888 atomic_read(&cf_sk->sk.sk_rmem_alloc),
75889 sk_rcvbuf_lowwater(cf_sk));
75890 set_rx_flow_off(cf_sk);
75891 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
75892 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75893 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75894 }
75895
75896 @@ -169,7 +170,7 @@ static int caif_queue_rcv_skb(struct soc
75897 if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
75898 set_rx_flow_off(cf_sk);
75899 pr_debug("sending flow OFF due to rmem_schedule\n");
75900 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
75901 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75902 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75903 }
75904 skb->dev = NULL;
75905 @@ -218,21 +219,21 @@ static void caif_ctrl_cb(struct cflayer
75906 switch (flow) {
75907 case CAIF_CTRLCMD_FLOW_ON_IND:
75908 /* OK from modem to start sending again */
75909 - dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
75910 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
75911 set_tx_flow_on(cf_sk);
75912 cf_sk->sk.sk_state_change(&cf_sk->sk);
75913 break;
75914
75915 case CAIF_CTRLCMD_FLOW_OFF_IND:
75916 /* Modem asks us to shut up */
75917 - dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
75918 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
75919 set_tx_flow_off(cf_sk);
75920 cf_sk->sk.sk_state_change(&cf_sk->sk);
75921 break;
75922
75923 case CAIF_CTRLCMD_INIT_RSP:
75924 /* We're now connected */
75925 - dbfs_atomic_inc(&cnt.num_connect_resp);
75926 + dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
75927 cf_sk->sk.sk_state = CAIF_CONNECTED;
75928 set_tx_flow_on(cf_sk);
75929 cf_sk->sk.sk_state_change(&cf_sk->sk);
75930 @@ -247,7 +248,7 @@ static void caif_ctrl_cb(struct cflayer
75931
75932 case CAIF_CTRLCMD_INIT_FAIL_RSP:
75933 /* Connect request failed */
75934 - dbfs_atomic_inc(&cnt.num_connect_fail_resp);
75935 + dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
75936 cf_sk->sk.sk_err = ECONNREFUSED;
75937 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
75938 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75939 @@ -261,7 +262,7 @@ static void caif_ctrl_cb(struct cflayer
75940
75941 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
75942 /* Modem has closed this connection, or device is down. */
75943 - dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
75944 + dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
75945 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75946 cf_sk->sk.sk_err = ECONNRESET;
75947 set_rx_flow_on(cf_sk);
75948 @@ -281,7 +282,7 @@ static void caif_check_flow_release(stru
75949 return;
75950
75951 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
75952 - dbfs_atomic_inc(&cnt.num_rx_flow_on);
75953 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
75954 set_rx_flow_on(cf_sk);
75955 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
75956 }
75957 @@ -864,7 +865,7 @@ static int caif_connect(struct socket *s
75958 /*ifindex = id of the interface.*/
75959 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
75960
75961 - dbfs_atomic_inc(&cnt.num_connect_req);
75962 + dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
75963 cf_sk->layer.receive = caif_sktrecv_cb;
75964 err = caif_connect_client(&cf_sk->conn_req,
75965 &cf_sk->layer, &ifindex, &headroom, &tailroom);
75966 @@ -952,7 +953,7 @@ static int caif_release(struct socket *s
75967 spin_unlock(&sk->sk_receive_queue.lock);
75968 sock->sk = NULL;
75969
75970 - dbfs_atomic_inc(&cnt.num_disconnect);
75971 + dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
75972
75973 if (cf_sk->debugfs_socket_dir != NULL)
75974 debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
75975 diff -urNp linux-2.6.39.1/net/caif/cfctrl.c linux-2.6.39.1/net/caif/cfctrl.c
75976 --- linux-2.6.39.1/net/caif/cfctrl.c 2011-05-19 00:06:34.000000000 -0400
75977 +++ linux-2.6.39.1/net/caif/cfctrl.c 2011-05-22 19:36:33.000000000 -0400
75978 @@ -9,6 +9,7 @@
75979 #include <linux/stddef.h>
75980 #include <linux/spinlock.h>
75981 #include <linux/slab.h>
75982 +#include <linux/sched.h>
75983 #include <net/caif/caif_layer.h>
75984 #include <net/caif/cfpkt.h>
75985 #include <net/caif/cfctrl.h>
75986 @@ -46,8 +47,8 @@ struct cflayer *cfctrl_create(void)
75987 dev_info.id = 0xff;
75988 memset(this, 0, sizeof(*this));
75989 cfsrvl_init(&this->serv, 0, &dev_info, false);
75990 - atomic_set(&this->req_seq_no, 1);
75991 - atomic_set(&this->rsp_seq_no, 1);
75992 + atomic_set_unchecked(&this->req_seq_no, 1);
75993 + atomic_set_unchecked(&this->rsp_seq_no, 1);
75994 this->serv.layer.receive = cfctrl_recv;
75995 sprintf(this->serv.layer.name, "ctrl");
75996 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
75997 @@ -116,8 +117,8 @@ void cfctrl_insert_req(struct cfctrl *ct
75998 struct cfctrl_request_info *req)
75999 {
76000 spin_lock(&ctrl->info_list_lock);
76001 - atomic_inc(&ctrl->req_seq_no);
76002 - req->sequence_no = atomic_read(&ctrl->req_seq_no);
76003 + atomic_inc_unchecked(&ctrl->req_seq_no);
76004 + req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
76005 list_add_tail(&req->list, &ctrl->list);
76006 spin_unlock(&ctrl->info_list_lock);
76007 }
76008 @@ -136,7 +137,7 @@ struct cfctrl_request_info *cfctrl_remov
76009 if (p != first)
76010 pr_warn("Requests are not received in order\n");
76011
76012 - atomic_set(&ctrl->rsp_seq_no,
76013 + atomic_set_unchecked(&ctrl->rsp_seq_no,
76014 p->sequence_no);
76015 list_del(&p->list);
76016 goto out;
76017 @@ -385,6 +386,7 @@ static int cfctrl_recv(struct cflayer *l
76018 struct cfctrl *cfctrl = container_obj(layer);
76019 struct cfctrl_request_info rsp, *req;
76020
76021 + pax_track_stack();
76022
76023 cfpkt_extr_head(pkt, &cmdrsp, 1);
76024 cmd = cmdrsp & CFCTRL_CMD_MASK;
76025 diff -urNp linux-2.6.39.1/net/can/bcm.c linux-2.6.39.1/net/can/bcm.c
76026 --- linux-2.6.39.1/net/can/bcm.c 2011-05-19 00:06:34.000000000 -0400
76027 +++ linux-2.6.39.1/net/can/bcm.c 2011-05-22 19:41:42.000000000 -0400
76028 @@ -165,9 +165,15 @@ static int bcm_proc_show(struct seq_file
76029 struct bcm_sock *bo = bcm_sk(sk);
76030 struct bcm_op *op;
76031
76032 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76033 + seq_printf(m, ">>> socket %p", NULL);
76034 + seq_printf(m, " / sk %p", NULL);
76035 + seq_printf(m, " / bo %p", NULL);
76036 +#else
76037 seq_printf(m, ">>> socket %p", sk->sk_socket);
76038 seq_printf(m, " / sk %p", sk);
76039 seq_printf(m, " / bo %p", bo);
76040 +#endif
76041 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
76042 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
76043 seq_printf(m, " <<<\n");
76044 diff -urNp linux-2.6.39.1/net/core/datagram.c linux-2.6.39.1/net/core/datagram.c
76045 --- linux-2.6.39.1/net/core/datagram.c 2011-05-19 00:06:34.000000000 -0400
76046 +++ linux-2.6.39.1/net/core/datagram.c 2011-05-22 19:36:33.000000000 -0400
76047 @@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
76048 }
76049
76050 kfree_skb(skb);
76051 - atomic_inc(&sk->sk_drops);
76052 + atomic_inc_unchecked(&sk->sk_drops);
76053 sk_mem_reclaim_partial(sk);
76054
76055 return err;
76056 diff -urNp linux-2.6.39.1/net/core/dev.c linux-2.6.39.1/net/core/dev.c
76057 --- linux-2.6.39.1/net/core/dev.c 2011-06-03 00:04:14.000000000 -0400
76058 +++ linux-2.6.39.1/net/core/dev.c 2011-06-03 00:32:08.000000000 -0400
76059 @@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha
76060 if (no_module && capable(CAP_NET_ADMIN))
76061 no_module = request_module("netdev-%s", name);
76062 if (no_module && capable(CAP_SYS_MODULE)) {
76063 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
76064 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
76065 +#else
76066 if (!request_module("%s", name))
76067 pr_err("Loading kernel module for a network device "
76068 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
76069 "instead\n", name);
76070 +#endif
76071 }
76072 }
76073 EXPORT_SYMBOL(dev_load);
76074 @@ -1957,7 +1961,7 @@ struct dev_gso_cb {
76075
76076 static void dev_gso_skb_destructor(struct sk_buff *skb)
76077 {
76078 - struct dev_gso_cb *cb;
76079 + const struct dev_gso_cb *cb;
76080
76081 do {
76082 struct sk_buff *nskb = skb->next;
76083 @@ -2901,7 +2905,7 @@ int netif_rx_ni(struct sk_buff *skb)
76084 }
76085 EXPORT_SYMBOL(netif_rx_ni);
76086
76087 -static void net_tx_action(struct softirq_action *h)
76088 +static void net_tx_action(void)
76089 {
76090 struct softnet_data *sd = &__get_cpu_var(softnet_data);
76091
76092 @@ -3765,7 +3769,7 @@ void netif_napi_del(struct napi_struct *
76093 }
76094 EXPORT_SYMBOL(netif_napi_del);
76095
76096 -static void net_rx_action(struct softirq_action *h)
76097 +static void net_rx_action(void)
76098 {
76099 struct softnet_data *sd = &__get_cpu_var(softnet_data);
76100 unsigned long time_limit = jiffies + 2;
76101 diff -urNp linux-2.6.39.1/net/core/flow.c linux-2.6.39.1/net/core/flow.c
76102 --- linux-2.6.39.1/net/core/flow.c 2011-05-19 00:06:34.000000000 -0400
76103 +++ linux-2.6.39.1/net/core/flow.c 2011-05-22 19:36:34.000000000 -0400
76104 @@ -60,7 +60,7 @@ struct flow_cache {
76105 struct timer_list rnd_timer;
76106 };
76107
76108 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
76109 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
76110 EXPORT_SYMBOL(flow_cache_genid);
76111 static struct flow_cache flow_cache_global;
76112 static struct kmem_cache *flow_cachep __read_mostly;
76113 @@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
76114
76115 static int flow_entry_valid(struct flow_cache_entry *fle)
76116 {
76117 - if (atomic_read(&flow_cache_genid) != fle->genid)
76118 + if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
76119 return 0;
76120 if (fle->object && !fle->object->ops->check(fle->object))
76121 return 0;
76122 @@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, const
76123 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
76124 fcp->hash_count++;
76125 }
76126 - } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
76127 + } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
76128 flo = fle->object;
76129 if (!flo)
76130 goto ret_object;
76131 @@ -274,7 +274,7 @@ nocache:
76132 }
76133 flo = resolver(net, key, family, dir, flo, ctx);
76134 if (fle) {
76135 - fle->genid = atomic_read(&flow_cache_genid);
76136 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
76137 if (!IS_ERR(flo))
76138 fle->object = flo;
76139 else
76140 diff -urNp linux-2.6.39.1/net/core/skbuff.c linux-2.6.39.1/net/core/skbuff.c
76141 --- linux-2.6.39.1/net/core/skbuff.c 2011-06-03 00:04:14.000000000 -0400
76142 +++ linux-2.6.39.1/net/core/skbuff.c 2011-06-03 00:32:08.000000000 -0400
76143 @@ -1542,6 +1542,8 @@ int skb_splice_bits(struct sk_buff *skb,
76144 struct sock *sk = skb->sk;
76145 int ret = 0;
76146
76147 + pax_track_stack();
76148 +
76149 if (splice_grow_spd(pipe, &spd))
76150 return -ENOMEM;
76151
76152 diff -urNp linux-2.6.39.1/net/core/sock.c linux-2.6.39.1/net/core/sock.c
76153 --- linux-2.6.39.1/net/core/sock.c 2011-05-19 00:06:34.000000000 -0400
76154 +++ linux-2.6.39.1/net/core/sock.c 2011-05-22 19:36:34.000000000 -0400
76155 @@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76156 */
76157 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
76158 (unsigned)sk->sk_rcvbuf) {
76159 - atomic_inc(&sk->sk_drops);
76160 + atomic_inc_unchecked(&sk->sk_drops);
76161 return -ENOMEM;
76162 }
76163
76164 @@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76165 return err;
76166
76167 if (!sk_rmem_schedule(sk, skb->truesize)) {
76168 - atomic_inc(&sk->sk_drops);
76169 + atomic_inc_unchecked(&sk->sk_drops);
76170 return -ENOBUFS;
76171 }
76172
76173 @@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76174 skb_dst_force(skb);
76175
76176 spin_lock_irqsave(&list->lock, flags);
76177 - skb->dropcount = atomic_read(&sk->sk_drops);
76178 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
76179 __skb_queue_tail(list, skb);
76180 spin_unlock_irqrestore(&list->lock, flags);
76181
76182 @@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
76183 skb->dev = NULL;
76184
76185 if (sk_rcvqueues_full(sk, skb)) {
76186 - atomic_inc(&sk->sk_drops);
76187 + atomic_inc_unchecked(&sk->sk_drops);
76188 goto discard_and_relse;
76189 }
76190 if (nested)
76191 @@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
76192 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
76193 } else if (sk_add_backlog(sk, skb)) {
76194 bh_unlock_sock(sk);
76195 - atomic_inc(&sk->sk_drops);
76196 + atomic_inc_unchecked(&sk->sk_drops);
76197 goto discard_and_relse;
76198 }
76199
76200 @@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
76201 return -ENOTCONN;
76202 if (lv < len)
76203 return -EINVAL;
76204 - if (copy_to_user(optval, address, len))
76205 + if (len > sizeof(address) || copy_to_user(optval, address, len))
76206 return -EFAULT;
76207 goto lenout;
76208 }
76209 @@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock,
76210
76211 if (len > lv)
76212 len = lv;
76213 - if (copy_to_user(optval, &v, len))
76214 + if (len > sizeof(v) || copy_to_user(optval, &v, len))
76215 return -EFAULT;
76216 lenout:
76217 if (put_user(len, optlen))
76218 @@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock,
76219 */
76220 smp_wmb();
76221 atomic_set(&sk->sk_refcnt, 1);
76222 - atomic_set(&sk->sk_drops, 0);
76223 + atomic_set_unchecked(&sk->sk_drops, 0);
76224 }
76225 EXPORT_SYMBOL(sock_init_data);
76226
76227 diff -urNp linux-2.6.39.1/net/decnet/sysctl_net_decnet.c linux-2.6.39.1/net/decnet/sysctl_net_decnet.c
76228 --- linux-2.6.39.1/net/decnet/sysctl_net_decnet.c 2011-05-19 00:06:34.000000000 -0400
76229 +++ linux-2.6.39.1/net/decnet/sysctl_net_decnet.c 2011-05-22 19:36:34.000000000 -0400
76230 @@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
76231
76232 if (len > *lenp) len = *lenp;
76233
76234 - if (copy_to_user(buffer, addr, len))
76235 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
76236 return -EFAULT;
76237
76238 *lenp = len;
76239 @@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
76240
76241 if (len > *lenp) len = *lenp;
76242
76243 - if (copy_to_user(buffer, devname, len))
76244 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
76245 return -EFAULT;
76246
76247 *lenp = len;
76248 diff -urNp linux-2.6.39.1/net/econet/Kconfig linux-2.6.39.1/net/econet/Kconfig
76249 --- linux-2.6.39.1/net/econet/Kconfig 2011-05-19 00:06:34.000000000 -0400
76250 +++ linux-2.6.39.1/net/econet/Kconfig 2011-05-22 19:41:42.000000000 -0400
76251 @@ -4,7 +4,7 @@
76252
76253 config ECONET
76254 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
76255 - depends on EXPERIMENTAL && INET
76256 + depends on EXPERIMENTAL && INET && BROKEN
76257 ---help---
76258 Econet is a fairly old and slow networking protocol mainly used by
76259 Acorn computers to access file and print servers. It uses native
76260 diff -urNp linux-2.6.39.1/net/ipv4/fib_frontend.c linux-2.6.39.1/net/ipv4/fib_frontend.c
76261 --- linux-2.6.39.1/net/ipv4/fib_frontend.c 2011-05-19 00:06:34.000000000 -0400
76262 +++ linux-2.6.39.1/net/ipv4/fib_frontend.c 2011-05-22 19:36:34.000000000 -0400
76263 @@ -968,12 +968,12 @@ static int fib_inetaddr_event(struct not
76264 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76265 fib_sync_up(dev);
76266 #endif
76267 - atomic_inc(&net->ipv4.dev_addr_genid);
76268 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76269 rt_cache_flush(dev_net(dev), -1);
76270 break;
76271 case NETDEV_DOWN:
76272 fib_del_ifaddr(ifa, NULL);
76273 - atomic_inc(&net->ipv4.dev_addr_genid);
76274 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76275 if (ifa->ifa_dev->ifa_list == NULL) {
76276 /* Last address was deleted from this interface.
76277 * Disable IP.
76278 @@ -1009,7 +1009,7 @@ static int fib_netdev_event(struct notif
76279 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76280 fib_sync_up(dev);
76281 #endif
76282 - atomic_inc(&net->ipv4.dev_addr_genid);
76283 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76284 rt_cache_flush(dev_net(dev), -1);
76285 break;
76286 case NETDEV_DOWN:
76287 diff -urNp linux-2.6.39.1/net/ipv4/fib_semantics.c linux-2.6.39.1/net/ipv4/fib_semantics.c
76288 --- linux-2.6.39.1/net/ipv4/fib_semantics.c 2011-05-19 00:06:34.000000000 -0400
76289 +++ linux-2.6.39.1/net/ipv4/fib_semantics.c 2011-05-22 19:36:34.000000000 -0400
76290 @@ -701,7 +701,7 @@ __be32 fib_info_update_nh_saddr(struct n
76291 nh->nh_saddr = inet_select_addr(nh->nh_dev,
76292 nh->nh_gw,
76293 nh->nh_parent->fib_scope);
76294 - nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
76295 + nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
76296
76297 return nh->nh_saddr;
76298 }
76299 diff -urNp linux-2.6.39.1/net/ipv4/inet_diag.c linux-2.6.39.1/net/ipv4/inet_diag.c
76300 --- linux-2.6.39.1/net/ipv4/inet_diag.c 2011-05-19 00:06:34.000000000 -0400
76301 +++ linux-2.6.39.1/net/ipv4/inet_diag.c 2011-06-20 19:27:58.000000000 -0400
76302 @@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
76303 r->idiag_retrans = 0;
76304
76305 r->id.idiag_if = sk->sk_bound_dev_if;
76306 +
76307 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76308 + r->id.idiag_cookie[0] = 0;
76309 + r->id.idiag_cookie[1] = 0;
76310 +#else
76311 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
76312 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
76313 +#endif
76314
76315 r->id.idiag_sport = inet->inet_sport;
76316 r->id.idiag_dport = inet->inet_dport;
76317 @@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in
76318 r->idiag_family = tw->tw_family;
76319 r->idiag_retrans = 0;
76320 r->id.idiag_if = tw->tw_bound_dev_if;
76321 +
76322 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76323 + r->id.idiag_cookie[0] = 0;
76324 + r->id.idiag_cookie[1] = 0;
76325 +#else
76326 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
76327 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
76328 +#endif
76329 +
76330 r->id.idiag_sport = tw->tw_sport;
76331 r->id.idiag_dport = tw->tw_dport;
76332 r->id.idiag_src[0] = tw->tw_rcv_saddr;
76333 @@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk
76334 if (sk == NULL)
76335 goto unlock;
76336
76337 +#ifndef CONFIG_GRKERNSEC_HIDESYM
76338 err = -ESTALE;
76339 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
76340 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
76341 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
76342 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
76343 goto out;
76344 +#endif
76345
76346 err = -ENOMEM;
76347 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
76348 @@ -437,7 +452,7 @@ static int valid_cc(const void *bc, int
76349 return 0;
76350 if (cc == len)
76351 return 1;
76352 - if (op->yes < 4)
76353 + if (op->yes < 4 || op->yes & 3)
76354 return 0;
76355 len -= op->yes;
76356 bc += op->yes;
76357 @@ -447,11 +462,11 @@ static int valid_cc(const void *bc, int
76358
76359 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
76360 {
76361 - const unsigned char *bc = bytecode;
76362 + const void *bc = bytecode;
76363 int len = bytecode_len;
76364
76365 while (len > 0) {
76366 - struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
76367 + const struct inet_diag_bc_op *op = bc;
76368
76369 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
76370 switch (op->code) {
76371 @@ -462,22 +477,20 @@ static int inet_diag_bc_audit(const void
76372 case INET_DIAG_BC_S_LE:
76373 case INET_DIAG_BC_D_GE:
76374 case INET_DIAG_BC_D_LE:
76375 - if (op->yes < 4 || op->yes > len + 4)
76376 - return -EINVAL;
76377 case INET_DIAG_BC_JMP:
76378 - if (op->no < 4 || op->no > len + 4)
76379 + if (op->no < 4 || op->no > len + 4 || op->no & 3)
76380 return -EINVAL;
76381 if (op->no < len &&
76382 !valid_cc(bytecode, bytecode_len, len - op->no))
76383 return -EINVAL;
76384 break;
76385 case INET_DIAG_BC_NOP:
76386 - if (op->yes < 4 || op->yes > len + 4)
76387 - return -EINVAL;
76388 break;
76389 default:
76390 return -EINVAL;
76391 }
76392 + if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
76393 + return -EINVAL;
76394 bc += op->yes;
76395 len -= op->yes;
76396 }
76397 @@ -582,8 +595,14 @@ static int inet_diag_fill_req(struct sk_
76398 r->idiag_retrans = req->retrans;
76399
76400 r->id.idiag_if = sk->sk_bound_dev_if;
76401 +
76402 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76403 + r->id.idiag_cookie[0] = 0;
76404 + r->id.idiag_cookie[1] = 0;
76405 +#else
76406 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
76407 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
76408 +#endif
76409
76410 tmo = req->expires - jiffies;
76411 if (tmo < 0)
76412 diff -urNp linux-2.6.39.1/net/ipv4/inet_hashtables.c linux-2.6.39.1/net/ipv4/inet_hashtables.c
76413 --- linux-2.6.39.1/net/ipv4/inet_hashtables.c 2011-05-19 00:06:34.000000000 -0400
76414 +++ linux-2.6.39.1/net/ipv4/inet_hashtables.c 2011-05-22 19:41:42.000000000 -0400
76415 @@ -18,11 +18,14 @@
76416 #include <linux/sched.h>
76417 #include <linux/slab.h>
76418 #include <linux/wait.h>
76419 +#include <linux/security.h>
76420
76421 #include <net/inet_connection_sock.h>
76422 #include <net/inet_hashtables.h>
76423 #include <net/ip.h>
76424
76425 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76426 +
76427 /*
76428 * Allocate and initialize a new local port bind bucket.
76429 * The bindhash mutex for snum's hash chain must be held here.
76430 @@ -529,6 +532,8 @@ ok:
76431 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
76432 spin_unlock(&head->lock);
76433
76434 + gr_update_task_in_ip_table(current, inet_sk(sk));
76435 +
76436 if (tw) {
76437 inet_twsk_deschedule(tw, death_row);
76438 while (twrefcnt) {
76439 diff -urNp linux-2.6.39.1/net/ipv4/inetpeer.c linux-2.6.39.1/net/ipv4/inetpeer.c
76440 --- linux-2.6.39.1/net/ipv4/inetpeer.c 2011-05-19 00:06:34.000000000 -0400
76441 +++ linux-2.6.39.1/net/ipv4/inetpeer.c 2011-05-22 19:36:34.000000000 -0400
76442 @@ -467,6 +467,8 @@ struct inet_peer *inet_getpeer(struct in
76443 unsigned int sequence;
76444 int invalidated;
76445
76446 + pax_track_stack();
76447 +
76448 /* Look up for the address quickly, lockless.
76449 * Because of a concurrent writer, we might not find an existing entry.
76450 */
76451 @@ -504,8 +506,8 @@ struct inet_peer *inet_getpeer(struct in
76452 if (p) {
76453 p->daddr = *daddr;
76454 atomic_set(&p->refcnt, 1);
76455 - atomic_set(&p->rid, 0);
76456 - atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76457 + atomic_set_unchecked(&p->rid, 0);
76458 + atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76459 p->tcp_ts_stamp = 0;
76460 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
76461 p->rate_tokens = 0;
76462 diff -urNp linux-2.6.39.1/net/ipv4/ip_fragment.c linux-2.6.39.1/net/ipv4/ip_fragment.c
76463 --- linux-2.6.39.1/net/ipv4/ip_fragment.c 2011-05-19 00:06:34.000000000 -0400
76464 +++ linux-2.6.39.1/net/ipv4/ip_fragment.c 2011-05-22 19:36:34.000000000 -0400
76465 @@ -297,7 +297,7 @@ static inline int ip_frag_too_far(struct
76466 return 0;
76467
76468 start = qp->rid;
76469 - end = atomic_inc_return(&peer->rid);
76470 + end = atomic_inc_return_unchecked(&peer->rid);
76471 qp->rid = end;
76472
76473 rc = qp->q.fragments && (end - start) > max;
76474 diff -urNp linux-2.6.39.1/net/ipv4/ip_sockglue.c linux-2.6.39.1/net/ipv4/ip_sockglue.c
76475 --- linux-2.6.39.1/net/ipv4/ip_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76476 +++ linux-2.6.39.1/net/ipv4/ip_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76477 @@ -1064,6 +1064,8 @@ static int do_ip_getsockopt(struct sock
76478 int val;
76479 int len;
76480
76481 + pax_track_stack();
76482 +
76483 if (level != SOL_IP)
76484 return -EOPNOTSUPP;
76485
76486 diff -urNp linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c
76487 --- linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-19 00:06:34.000000000 -0400
76488 +++ linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-22 19:36:34.000000000 -0400
76489 @@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(
76490
76491 *len = 0;
76492
76493 - *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
76494 + *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
76495 if (*octets == NULL) {
76496 if (net_ratelimit())
76497 pr_notice("OOM in bsalg (%d)\n", __LINE__);
76498 diff -urNp linux-2.6.39.1/net/ipv4/raw.c linux-2.6.39.1/net/ipv4/raw.c
76499 --- linux-2.6.39.1/net/ipv4/raw.c 2011-05-19 00:06:34.000000000 -0400
76500 +++ linux-2.6.39.1/net/ipv4/raw.c 2011-05-22 19:41:42.000000000 -0400
76501 @@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
76502 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76503 {
76504 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76505 - atomic_inc(&sk->sk_drops);
76506 + atomic_inc_unchecked(&sk->sk_drops);
76507 kfree_skb(skb);
76508 return NET_RX_DROP;
76509 }
76510 @@ -730,15 +730,19 @@ static int raw_init(struct sock *sk)
76511
76512 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76513 {
76514 + struct icmp_filter filter;
76515 +
76516 if (optlen > sizeof(struct icmp_filter))
76517 optlen = sizeof(struct icmp_filter);
76518 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76519 + if (copy_from_user(&filter, optval, optlen))
76520 return -EFAULT;
76521 + memcpy(&raw_sk(sk)->filter, &filter, sizeof(filter));
76522 return 0;
76523 }
76524
76525 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76526 {
76527 + struct icmp_filter filter;
76528 int len, ret = -EFAULT;
76529
76530 if (get_user(len, optlen))
76531 @@ -749,8 +753,9 @@ static int raw_geticmpfilter(struct sock
76532 if (len > sizeof(struct icmp_filter))
76533 len = sizeof(struct icmp_filter);
76534 ret = -EFAULT;
76535 + memcpy(&filter, &raw_sk(sk)->filter, len);
76536 if (put_user(len, optlen) ||
76537 - copy_to_user(optval, &raw_sk(sk)->filter, len))
76538 + copy_to_user(optval, &filter, len))
76539 goto out;
76540 ret = 0;
76541 out: return ret;
76542 @@ -978,7 +983,13 @@ static void raw_sock_seq_show(struct seq
76543 sk_wmem_alloc_get(sp),
76544 sk_rmem_alloc_get(sp),
76545 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76546 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76547 + atomic_read(&sp->sk_refcnt),
76548 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76549 + NULL,
76550 +#else
76551 + sp,
76552 +#endif
76553 + atomic_read_unchecked(&sp->sk_drops));
76554 }
76555
76556 static int raw_seq_show(struct seq_file *seq, void *v)
76557 diff -urNp linux-2.6.39.1/net/ipv4/route.c linux-2.6.39.1/net/ipv4/route.c
76558 --- linux-2.6.39.1/net/ipv4/route.c 2011-05-19 00:06:34.000000000 -0400
76559 +++ linux-2.6.39.1/net/ipv4/route.c 2011-05-22 19:36:34.000000000 -0400
76560 @@ -303,7 +303,7 @@ static inline unsigned int rt_hash(__be3
76561
76562 static inline int rt_genid(struct net *net)
76563 {
76564 - return atomic_read(&net->ipv4.rt_genid);
76565 + return atomic_read_unchecked(&net->ipv4.rt_genid);
76566 }
76567
76568 #ifdef CONFIG_PROC_FS
76569 @@ -831,7 +831,7 @@ static void rt_cache_invalidate(struct n
76570 unsigned char shuffle;
76571
76572 get_random_bytes(&shuffle, sizeof(shuffle));
76573 - atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76574 + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76575 }
76576
76577 /*
76578 @@ -2835,7 +2835,7 @@ static int rt_fill_info(struct net *net,
76579 rt->peer->pmtu_expires - jiffies : 0;
76580 if (rt->peer) {
76581 inet_peer_refcheck(rt->peer);
76582 - id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
76583 + id = atomic_read_unchecked(&rt->peer->ip_id_count) & 0xffff;
76584 if (rt->peer->tcp_ts_stamp) {
76585 ts = rt->peer->tcp_ts;
76586 tsage = get_seconds() - rt->peer->tcp_ts_stamp;
76587 diff -urNp linux-2.6.39.1/net/ipv4/tcp.c linux-2.6.39.1/net/ipv4/tcp.c
76588 --- linux-2.6.39.1/net/ipv4/tcp.c 2011-05-19 00:06:34.000000000 -0400
76589 +++ linux-2.6.39.1/net/ipv4/tcp.c 2011-05-22 19:36:34.000000000 -0400
76590 @@ -2121,6 +2121,8 @@ static int do_tcp_setsockopt(struct sock
76591 int val;
76592 int err = 0;
76593
76594 + pax_track_stack();
76595 +
76596 /* These are data/string values, all the others are ints */
76597 switch (optname) {
76598 case TCP_CONGESTION: {
76599 @@ -2500,6 +2502,8 @@ static int do_tcp_getsockopt(struct sock
76600 struct tcp_sock *tp = tcp_sk(sk);
76601 int val, len;
76602
76603 + pax_track_stack();
76604 +
76605 if (get_user(len, optlen))
76606 return -EFAULT;
76607
76608 diff -urNp linux-2.6.39.1/net/ipv4/tcp_ipv4.c linux-2.6.39.1/net/ipv4/tcp_ipv4.c
76609 --- linux-2.6.39.1/net/ipv4/tcp_ipv4.c 2011-05-19 00:06:34.000000000 -0400
76610 +++ linux-2.6.39.1/net/ipv4/tcp_ipv4.c 2011-05-22 19:41:42.000000000 -0400
76611 @@ -86,6 +86,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
76612 int sysctl_tcp_low_latency __read_mostly;
76613 EXPORT_SYMBOL(sysctl_tcp_low_latency);
76614
76615 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76616 +extern int grsec_enable_blackhole;
76617 +#endif
76618
76619 #ifdef CONFIG_TCP_MD5SIG
76620 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
76621 @@ -1594,6 +1597,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
76622 return 0;
76623
76624 reset:
76625 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76626 + if (!grsec_enable_blackhole)
76627 +#endif
76628 tcp_v4_send_reset(rsk, skb);
76629 discard:
76630 kfree_skb(skb);
76631 @@ -1656,12 +1662,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
76632 TCP_SKB_CB(skb)->sacked = 0;
76633
76634 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76635 - if (!sk)
76636 + if (!sk) {
76637 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76638 + ret = 1;
76639 +#endif
76640 goto no_tcp_socket;
76641 -
76642 + }
76643 process:
76644 - if (sk->sk_state == TCP_TIME_WAIT)
76645 + if (sk->sk_state == TCP_TIME_WAIT) {
76646 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76647 + ret = 2;
76648 +#endif
76649 goto do_time_wait;
76650 + }
76651
76652 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
76653 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76654 @@ -1711,6 +1724,10 @@ no_tcp_socket:
76655 bad_packet:
76656 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76657 } else {
76658 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76659 + if (!grsec_enable_blackhole || (ret == 1 &&
76660 + (skb->dev->flags & IFF_LOOPBACK)))
76661 +#endif
76662 tcp_v4_send_reset(NULL, skb);
76663 }
76664
76665 @@ -2374,7 +2391,11 @@ static void get_openreq4(struct sock *sk
76666 0, /* non standard timer */
76667 0, /* open_requests have no inode */
76668 atomic_read(&sk->sk_refcnt),
76669 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76670 + NULL,
76671 +#else
76672 req,
76673 +#endif
76674 len);
76675 }
76676
76677 @@ -2424,7 +2445,12 @@ static void get_tcp4_sock(struct sock *s
76678 sock_i_uid(sk),
76679 icsk->icsk_probes_out,
76680 sock_i_ino(sk),
76681 - atomic_read(&sk->sk_refcnt), sk,
76682 + atomic_read(&sk->sk_refcnt),
76683 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76684 + NULL,
76685 +#else
76686 + sk,
76687 +#endif
76688 jiffies_to_clock_t(icsk->icsk_rto),
76689 jiffies_to_clock_t(icsk->icsk_ack.ato),
76690 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
76691 @@ -2452,7 +2478,13 @@ static void get_timewait4_sock(struct in
76692 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
76693 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76694 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76695 - atomic_read(&tw->tw_refcnt), tw, len);
76696 + atomic_read(&tw->tw_refcnt),
76697 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76698 + NULL,
76699 +#else
76700 + tw,
76701 +#endif
76702 + len);
76703 }
76704
76705 #define TMPSZ 150
76706 diff -urNp linux-2.6.39.1/net/ipv4/tcp_minisocks.c linux-2.6.39.1/net/ipv4/tcp_minisocks.c
76707 --- linux-2.6.39.1/net/ipv4/tcp_minisocks.c 2011-05-19 00:06:34.000000000 -0400
76708 +++ linux-2.6.39.1/net/ipv4/tcp_minisocks.c 2011-05-22 19:41:42.000000000 -0400
76709 @@ -27,6 +27,10 @@
76710 #include <net/inet_common.h>
76711 #include <net/xfrm.h>
76712
76713 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76714 +extern int grsec_enable_blackhole;
76715 +#endif
76716 +
76717 int sysctl_tcp_syncookies __read_mostly = 1;
76718 EXPORT_SYMBOL(sysctl_tcp_syncookies);
76719
76720 @@ -745,6 +749,10 @@ listen_overflow:
76721
76722 embryonic_reset:
76723 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76724 +
76725 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76726 + if (!grsec_enable_blackhole)
76727 +#endif
76728 if (!(flg & TCP_FLAG_RST))
76729 req->rsk_ops->send_reset(sk, skb);
76730
76731 diff -urNp linux-2.6.39.1/net/ipv4/tcp_output.c linux-2.6.39.1/net/ipv4/tcp_output.c
76732 --- linux-2.6.39.1/net/ipv4/tcp_output.c 2011-05-19 00:06:34.000000000 -0400
76733 +++ linux-2.6.39.1/net/ipv4/tcp_output.c 2011-05-22 19:36:34.000000000 -0400
76734 @@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s
76735 int mss;
76736 int s_data_desired = 0;
76737
76738 + pax_track_stack();
76739 +
76740 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
76741 s_data_desired = cvp->s_data_desired;
76742 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
76743 diff -urNp linux-2.6.39.1/net/ipv4/tcp_probe.c linux-2.6.39.1/net/ipv4/tcp_probe.c
76744 --- linux-2.6.39.1/net/ipv4/tcp_probe.c 2011-05-19 00:06:34.000000000 -0400
76745 +++ linux-2.6.39.1/net/ipv4/tcp_probe.c 2011-05-22 19:36:34.000000000 -0400
76746 @@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
76747 if (cnt + width >= len)
76748 break;
76749
76750 - if (copy_to_user(buf + cnt, tbuf, width))
76751 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
76752 return -EFAULT;
76753 cnt += width;
76754 }
76755 diff -urNp linux-2.6.39.1/net/ipv4/tcp_timer.c linux-2.6.39.1/net/ipv4/tcp_timer.c
76756 --- linux-2.6.39.1/net/ipv4/tcp_timer.c 2011-05-19 00:06:34.000000000 -0400
76757 +++ linux-2.6.39.1/net/ipv4/tcp_timer.c 2011-05-22 19:41:42.000000000 -0400
76758 @@ -22,6 +22,10 @@
76759 #include <linux/gfp.h>
76760 #include <net/tcp.h>
76761
76762 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76763 +extern int grsec_lastack_retries;
76764 +#endif
76765 +
76766 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76767 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76768 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
76769 @@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock
76770 }
76771 }
76772
76773 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76774 + if ((sk->sk_state == TCP_LAST_ACK) &&
76775 + (grsec_lastack_retries > 0) &&
76776 + (grsec_lastack_retries < retry_until))
76777 + retry_until = grsec_lastack_retries;
76778 +#endif
76779 +
76780 if (retransmits_timed_out(sk, retry_until,
76781 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
76782 /* Has it gone just too far? */
76783 diff -urNp linux-2.6.39.1/net/ipv4/udp.c linux-2.6.39.1/net/ipv4/udp.c
76784 --- linux-2.6.39.1/net/ipv4/udp.c 2011-05-19 00:06:34.000000000 -0400
76785 +++ linux-2.6.39.1/net/ipv4/udp.c 2011-05-22 19:41:42.000000000 -0400
76786 @@ -86,6 +86,7 @@
76787 #include <linux/types.h>
76788 #include <linux/fcntl.h>
76789 #include <linux/module.h>
76790 +#include <linux/security.h>
76791 #include <linux/socket.h>
76792 #include <linux/sockios.h>
76793 #include <linux/igmp.h>
76794 @@ -107,6 +108,10 @@
76795 #include <net/xfrm.h>
76796 #include "udp_impl.h"
76797
76798 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76799 +extern int grsec_enable_blackhole;
76800 +#endif
76801 +
76802 struct udp_table udp_table __read_mostly;
76803 EXPORT_SYMBOL(udp_table);
76804
76805 @@ -564,6 +569,9 @@ found:
76806 return s;
76807 }
76808
76809 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76810 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76811 +
76812 /*
76813 * This routine is called by the ICMP module when it gets some
76814 * sort of error condition. If err < 0 then the socket should
76815 @@ -853,9 +861,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
76816 dport = usin->sin_port;
76817 if (dport == 0)
76818 return -EINVAL;
76819 +
76820 + err = gr_search_udp_sendmsg(sk, usin);
76821 + if (err)
76822 + return err;
76823 } else {
76824 if (sk->sk_state != TCP_ESTABLISHED)
76825 return -EDESTADDRREQ;
76826 +
76827 + err = gr_search_udp_sendmsg(sk, NULL);
76828 + if (err)
76829 + return err;
76830 +
76831 daddr = inet->inet_daddr;
76832 dport = inet->inet_dport;
76833 /* Open fast path for connected socket.
76834 @@ -1090,7 +1107,7 @@ static unsigned int first_packet_length(
76835 udp_lib_checksum_complete(skb)) {
76836 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76837 IS_UDPLITE(sk));
76838 - atomic_inc(&sk->sk_drops);
76839 + atomic_inc_unchecked(&sk->sk_drops);
76840 __skb_unlink(skb, rcvq);
76841 __skb_queue_tail(&list_kill, skb);
76842 }
76843 @@ -1176,6 +1193,10 @@ try_again:
76844 if (!skb)
76845 goto out;
76846
76847 + err = gr_search_udp_recvmsg(sk, skb);
76848 + if (err)
76849 + goto out_free;
76850 +
76851 ulen = skb->len - sizeof(struct udphdr);
76852 if (len > ulen)
76853 len = ulen;
76854 @@ -1472,7 +1493,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
76855
76856 drop:
76857 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76858 - atomic_inc(&sk->sk_drops);
76859 + atomic_inc_unchecked(&sk->sk_drops);
76860 kfree_skb(skb);
76861 return -1;
76862 }
76863 @@ -1491,7 +1512,7 @@ static void flush_stack(struct sock **st
76864 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
76865
76866 if (!skb1) {
76867 - atomic_inc(&sk->sk_drops);
76868 + atomic_inc_unchecked(&sk->sk_drops);
76869 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
76870 IS_UDPLITE(sk));
76871 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76872 @@ -1660,6 +1681,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
76873 goto csum_error;
76874
76875 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
76876 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76877 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76878 +#endif
76879 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
76880
76881 /*
76882 @@ -2087,8 +2111,13 @@ static void udp4_format_sock(struct sock
76883 sk_wmem_alloc_get(sp),
76884 sk_rmem_alloc_get(sp),
76885 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76886 - atomic_read(&sp->sk_refcnt), sp,
76887 - atomic_read(&sp->sk_drops), len);
76888 + atomic_read(&sp->sk_refcnt),
76889 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76890 + NULL,
76891 +#else
76892 + sp,
76893 +#endif
76894 + atomic_read_unchecked(&sp->sk_drops), len);
76895 }
76896
76897 int udp4_seq_show(struct seq_file *seq, void *v)
76898 diff -urNp linux-2.6.39.1/net/ipv6/inet6_connection_sock.c linux-2.6.39.1/net/ipv6/inet6_connection_sock.c
76899 --- linux-2.6.39.1/net/ipv6/inet6_connection_sock.c 2011-05-19 00:06:34.000000000 -0400
76900 +++ linux-2.6.39.1/net/ipv6/inet6_connection_sock.c 2011-05-22 19:36:34.000000000 -0400
76901 @@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *
76902 #ifdef CONFIG_XFRM
76903 {
76904 struct rt6_info *rt = (struct rt6_info *)dst;
76905 - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
76906 + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
76907 }
76908 #endif
76909 }
76910 @@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(
76911 #ifdef CONFIG_XFRM
76912 if (dst) {
76913 struct rt6_info *rt = (struct rt6_info *)dst;
76914 - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
76915 + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
76916 __sk_dst_reset(sk);
76917 dst = NULL;
76918 }
76919 diff -urNp linux-2.6.39.1/net/ipv6/ipv6_sockglue.c linux-2.6.39.1/net/ipv6/ipv6_sockglue.c
76920 --- linux-2.6.39.1/net/ipv6/ipv6_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76921 +++ linux-2.6.39.1/net/ipv6/ipv6_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76922 @@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
76923 int val, valbool;
76924 int retv = -ENOPROTOOPT;
76925
76926 + pax_track_stack();
76927 +
76928 if (optval == NULL)
76929 val=0;
76930 else {
76931 @@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
76932 int len;
76933 int val;
76934
76935 + pax_track_stack();
76936 +
76937 if (ip6_mroute_opt(optname))
76938 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
76939
76940 diff -urNp linux-2.6.39.1/net/ipv6/raw.c linux-2.6.39.1/net/ipv6/raw.c
76941 --- linux-2.6.39.1/net/ipv6/raw.c 2011-05-19 00:06:34.000000000 -0400
76942 +++ linux-2.6.39.1/net/ipv6/raw.c 2011-05-22 19:41:42.000000000 -0400
76943 @@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
76944 {
76945 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
76946 skb_checksum_complete(skb)) {
76947 - atomic_inc(&sk->sk_drops);
76948 + atomic_inc_unchecked(&sk->sk_drops);
76949 kfree_skb(skb);
76950 return NET_RX_DROP;
76951 }
76952 @@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76953 struct raw6_sock *rp = raw6_sk(sk);
76954
76955 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
76956 - atomic_inc(&sk->sk_drops);
76957 + atomic_inc_unchecked(&sk->sk_drops);
76958 kfree_skb(skb);
76959 return NET_RX_DROP;
76960 }
76961 @@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76962
76963 if (inet->hdrincl) {
76964 if (skb_checksum_complete(skb)) {
76965 - atomic_inc(&sk->sk_drops);
76966 + atomic_inc_unchecked(&sk->sk_drops);
76967 kfree_skb(skb);
76968 return NET_RX_DROP;
76969 }
76970 @@ -601,7 +601,7 @@ out:
76971 return err;
76972 }
76973
76974 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76975 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76976 struct flowi6 *fl6, struct dst_entry **dstp,
76977 unsigned int flags)
76978 {
76979 @@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i
76980 u16 proto;
76981 int err;
76982
76983 + pax_track_stack();
76984 +
76985 /* Rough check on arithmetic overflow,
76986 better check is made in ip6_append_data().
76987 */
76988 @@ -909,12 +911,15 @@ do_confirm:
76989 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76990 char __user *optval, int optlen)
76991 {
76992 + struct icmp6_filter filter;
76993 +
76994 switch (optname) {
76995 case ICMPV6_FILTER:
76996 if (optlen > sizeof(struct icmp6_filter))
76997 optlen = sizeof(struct icmp6_filter);
76998 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76999 + if (copy_from_user(&filter, optval, optlen))
77000 return -EFAULT;
77001 + memcpy(&raw6_sk(sk)->filter, &filter, optlen);
77002 return 0;
77003 default:
77004 return -ENOPROTOOPT;
77005 @@ -926,6 +931,7 @@ static int rawv6_seticmpfilter(struct so
77006 static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
77007 char __user *optval, int __user *optlen)
77008 {
77009 + struct icmp6_filter filter;
77010 int len;
77011
77012 switch (optname) {
77013 @@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so
77014 len = sizeof(struct icmp6_filter);
77015 if (put_user(len, optlen))
77016 return -EFAULT;
77017 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
77018 + memcpy(&filter, &raw6_sk(sk)->filter, len);
77019 + if (copy_to_user(optval, &filter, len))
77020 return -EFAULT;
77021 return 0;
77022 default:
77023 @@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se
77024 0, 0L, 0,
77025 sock_i_uid(sp), 0,
77026 sock_i_ino(sp),
77027 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
77028 + atomic_read(&sp->sk_refcnt),
77029 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77030 + NULL,
77031 +#else
77032 + sp,
77033 +#endif
77034 + atomic_read_unchecked(&sp->sk_drops));
77035 }
77036
77037 static int raw6_seq_show(struct seq_file *seq, void *v)
77038 diff -urNp linux-2.6.39.1/net/ipv6/tcp_ipv6.c linux-2.6.39.1/net/ipv6/tcp_ipv6.c
77039 --- linux-2.6.39.1/net/ipv6/tcp_ipv6.c 2011-05-19 00:06:34.000000000 -0400
77040 +++ linux-2.6.39.1/net/ipv6/tcp_ipv6.c 2011-05-22 19:41:42.000000000 -0400
77041 @@ -92,6 +92,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
77042 }
77043 #endif
77044
77045 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77046 +extern int grsec_enable_blackhole;
77047 +#endif
77048 +
77049 static void tcp_v6_hash(struct sock *sk)
77050 {
77051 if (sk->sk_state != TCP_CLOSE) {
77052 @@ -1660,6 +1664,9 @@ static int tcp_v6_do_rcv(struct sock *sk
77053 return 0;
77054
77055 reset:
77056 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77057 + if (!grsec_enable_blackhole)
77058 +#endif
77059 tcp_v6_send_reset(sk, skb);
77060 discard:
77061 if (opt_skb)
77062 @@ -1739,12 +1746,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
77063 TCP_SKB_CB(skb)->sacked = 0;
77064
77065 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
77066 - if (!sk)
77067 + if (!sk) {
77068 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77069 + ret = 1;
77070 +#endif
77071 goto no_tcp_socket;
77072 + }
77073
77074 process:
77075 - if (sk->sk_state == TCP_TIME_WAIT)
77076 + if (sk->sk_state == TCP_TIME_WAIT) {
77077 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77078 + ret = 2;
77079 +#endif
77080 goto do_time_wait;
77081 + }
77082
77083 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
77084 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
77085 @@ -1792,6 +1807,10 @@ no_tcp_socket:
77086 bad_packet:
77087 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
77088 } else {
77089 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77090 + if (!grsec_enable_blackhole || (ret == 1 &&
77091 + (skb->dev->flags & IFF_LOOPBACK)))
77092 +#endif
77093 tcp_v6_send_reset(NULL, skb);
77094 }
77095
77096 @@ -2052,7 +2071,13 @@ static void get_openreq6(struct seq_file
77097 uid,
77098 0, /* non standard timer */
77099 0, /* open_requests have no inode */
77100 - 0, req);
77101 + 0,
77102 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77103 + NULL
77104 +#else
77105 + req
77106 +#endif
77107 + );
77108 }
77109
77110 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
77111 @@ -2102,7 +2127,12 @@ static void get_tcp6_sock(struct seq_fil
77112 sock_i_uid(sp),
77113 icsk->icsk_probes_out,
77114 sock_i_ino(sp),
77115 - atomic_read(&sp->sk_refcnt), sp,
77116 + atomic_read(&sp->sk_refcnt),
77117 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77118 + NULL,
77119 +#else
77120 + sp,
77121 +#endif
77122 jiffies_to_clock_t(icsk->icsk_rto),
77123 jiffies_to_clock_t(icsk->icsk_ack.ato),
77124 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
77125 @@ -2137,7 +2167,13 @@ static void get_timewait6_sock(struct se
77126 dest->s6_addr32[2], dest->s6_addr32[3], destp,
77127 tw->tw_substate, 0, 0,
77128 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
77129 - atomic_read(&tw->tw_refcnt), tw);
77130 + atomic_read(&tw->tw_refcnt),
77131 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77132 + NULL
77133 +#else
77134 + tw
77135 +#endif
77136 + );
77137 }
77138
77139 static int tcp6_seq_show(struct seq_file *seq, void *v)
77140 diff -urNp linux-2.6.39.1/net/ipv6/udp.c linux-2.6.39.1/net/ipv6/udp.c
77141 --- linux-2.6.39.1/net/ipv6/udp.c 2011-05-19 00:06:34.000000000 -0400
77142 +++ linux-2.6.39.1/net/ipv6/udp.c 2011-05-22 19:41:42.000000000 -0400
77143 @@ -50,6 +50,10 @@
77144 #include <linux/seq_file.h>
77145 #include "udp_impl.h"
77146
77147 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77148 +extern int grsec_enable_blackhole;
77149 +#endif
77150 +
77151 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
77152 {
77153 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
77154 @@ -545,7 +549,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
77155
77156 return 0;
77157 drop:
77158 - atomic_inc(&sk->sk_drops);
77159 + atomic_inc_unchecked(&sk->sk_drops);
77160 drop_no_sk_drops_inc:
77161 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
77162 kfree_skb(skb);
77163 @@ -621,7 +625,7 @@ static void flush_stack(struct sock **st
77164 continue;
77165 }
77166 drop:
77167 - atomic_inc(&sk->sk_drops);
77168 + atomic_inc_unchecked(&sk->sk_drops);
77169 UDP6_INC_STATS_BH(sock_net(sk),
77170 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
77171 UDP6_INC_STATS_BH(sock_net(sk),
77172 @@ -776,6 +780,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
77173 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
77174 proto == IPPROTO_UDPLITE);
77175
77176 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77177 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
77178 +#endif
77179 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
77180
77181 kfree_skb(skb);
77182 @@ -792,7 +799,7 @@ int __udp6_lib_rcv(struct sk_buff *skb,
77183 if (!sock_owned_by_user(sk))
77184 udpv6_queue_rcv_skb(sk, skb);
77185 else if (sk_add_backlog(sk, skb)) {
77186 - atomic_inc(&sk->sk_drops);
77187 + atomic_inc_unchecked(&sk->sk_drops);
77188 bh_unlock_sock(sk);
77189 sock_put(sk);
77190 goto discard;
77191 @@ -1403,8 +1410,13 @@ static void udp6_sock_seq_show(struct se
77192 0, 0L, 0,
77193 sock_i_uid(sp), 0,
77194 sock_i_ino(sp),
77195 - atomic_read(&sp->sk_refcnt), sp,
77196 - atomic_read(&sp->sk_drops));
77197 + atomic_read(&sp->sk_refcnt),
77198 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77199 + NULL,
77200 +#else
77201 + sp,
77202 +#endif
77203 + atomic_read_unchecked(&sp->sk_drops));
77204 }
77205
77206 int udp6_seq_show(struct seq_file *seq, void *v)
77207 diff -urNp linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c
77208 --- linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c 2011-05-19 00:06:34.000000000 -0400
77209 +++ linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c 2011-05-22 19:36:34.000000000 -0400
77210 @@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(st
77211 add_wait_queue(&self->open_wait, &wait);
77212
77213 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
77214 - __FILE__,__LINE__, tty->driver->name, self->open_count );
77215 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77216
77217 /* As far as I can see, we protect open_count - Jean II */
77218 spin_lock_irqsave(&self->spinlock, flags);
77219 if (!tty_hung_up_p(filp)) {
77220 extra_count = 1;
77221 - self->open_count--;
77222 + local_dec(&self->open_count);
77223 }
77224 spin_unlock_irqrestore(&self->spinlock, flags);
77225 - self->blocked_open++;
77226 + local_inc(&self->blocked_open);
77227
77228 while (1) {
77229 if (tty->termios->c_cflag & CBAUD) {
77230 @@ -330,7 +330,7 @@ static int ircomm_tty_block_til_ready(st
77231 }
77232
77233 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
77234 - __FILE__,__LINE__, tty->driver->name, self->open_count );
77235 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77236
77237 schedule();
77238 }
77239 @@ -341,13 +341,13 @@ static int ircomm_tty_block_til_ready(st
77240 if (extra_count) {
77241 /* ++ is not atomic, so this should be protected - Jean II */
77242 spin_lock_irqsave(&self->spinlock, flags);
77243 - self->open_count++;
77244 + local_inc(&self->open_count);
77245 spin_unlock_irqrestore(&self->spinlock, flags);
77246 }
77247 - self->blocked_open--;
77248 + local_dec(&self->blocked_open);
77249
77250 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
77251 - __FILE__,__LINE__, tty->driver->name, self->open_count);
77252 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
77253
77254 if (!retval)
77255 self->flags |= ASYNC_NORMAL_ACTIVE;
77256 @@ -416,14 +416,14 @@ static int ircomm_tty_open(struct tty_st
77257 }
77258 /* ++ is not atomic, so this should be protected - Jean II */
77259 spin_lock_irqsave(&self->spinlock, flags);
77260 - self->open_count++;
77261 + local_inc(&self->open_count);
77262
77263 tty->driver_data = self;
77264 self->tty = tty;
77265 spin_unlock_irqrestore(&self->spinlock, flags);
77266
77267 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
77268 - self->line, self->open_count);
77269 + self->line, local_read(&self->open_count));
77270
77271 /* Not really used by us, but lets do it anyway */
77272 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
77273 @@ -509,7 +509,7 @@ static void ircomm_tty_close(struct tty_
77274 return;
77275 }
77276
77277 - if ((tty->count == 1) && (self->open_count != 1)) {
77278 + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
77279 /*
77280 * Uh, oh. tty->count is 1, which means that the tty
77281 * structure will be freed. state->count should always
77282 @@ -519,16 +519,16 @@ static void ircomm_tty_close(struct tty_
77283 */
77284 IRDA_DEBUG(0, "%s(), bad serial port count; "
77285 "tty->count is 1, state->count is %d\n", __func__ ,
77286 - self->open_count);
77287 - self->open_count = 1;
77288 + local_read(&self->open_count));
77289 + local_set(&self->open_count, 1);
77290 }
77291
77292 - if (--self->open_count < 0) {
77293 + if (local_dec_return(&self->open_count) < 0) {
77294 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
77295 - __func__, self->line, self->open_count);
77296 - self->open_count = 0;
77297 + __func__, self->line, local_read(&self->open_count));
77298 + local_set(&self->open_count, 0);
77299 }
77300 - if (self->open_count) {
77301 + if (local_read(&self->open_count)) {
77302 spin_unlock_irqrestore(&self->spinlock, flags);
77303
77304 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
77305 @@ -560,7 +560,7 @@ static void ircomm_tty_close(struct tty_
77306 tty->closing = 0;
77307 self->tty = NULL;
77308
77309 - if (self->blocked_open) {
77310 + if (local_read(&self->blocked_open)) {
77311 if (self->close_delay)
77312 schedule_timeout_interruptible(self->close_delay);
77313 wake_up_interruptible(&self->open_wait);
77314 @@ -1012,7 +1012,7 @@ static void ircomm_tty_hangup(struct tty
77315 spin_lock_irqsave(&self->spinlock, flags);
77316 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77317 self->tty = NULL;
77318 - self->open_count = 0;
77319 + local_set(&self->open_count, 0);
77320 spin_unlock_irqrestore(&self->spinlock, flags);
77321
77322 wake_up_interruptible(&self->open_wait);
77323 @@ -1364,7 +1364,7 @@ static void ircomm_tty_line_info(struct
77324 seq_putc(m, '\n');
77325
77326 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77327 - seq_printf(m, "Open count: %d\n", self->open_count);
77328 + seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
77329 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77330 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77331
77332 diff -urNp linux-2.6.39.1/net/iucv/af_iucv.c linux-2.6.39.1/net/iucv/af_iucv.c
77333 --- linux-2.6.39.1/net/iucv/af_iucv.c 2011-05-19 00:06:34.000000000 -0400
77334 +++ linux-2.6.39.1/net/iucv/af_iucv.c 2011-05-22 19:36:34.000000000 -0400
77335 @@ -653,10 +653,10 @@ static int iucv_sock_autobind(struct soc
77336
77337 write_lock_bh(&iucv_sk_list.lock);
77338
77339 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77340 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77341 while (__iucv_get_sock_by_name(name)) {
77342 sprintf(name, "%08x",
77343 - atomic_inc_return(&iucv_sk_list.autobind_name));
77344 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77345 }
77346
77347 write_unlock_bh(&iucv_sk_list.lock);
77348 diff -urNp linux-2.6.39.1/net/key/af_key.c linux-2.6.39.1/net/key/af_key.c
77349 --- linux-2.6.39.1/net/key/af_key.c 2011-05-19 00:06:34.000000000 -0400
77350 +++ linux-2.6.39.1/net/key/af_key.c 2011-05-22 19:41:42.000000000 -0400
77351 @@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk
77352 struct xfrm_migrate m[XFRM_MAX_DEPTH];
77353 struct xfrm_kmaddress k;
77354
77355 + pax_track_stack();
77356 +
77357 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
77358 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
77359 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
77360 @@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru
77361 static u32 get_acqseq(void)
77362 {
77363 u32 res;
77364 - static atomic_t acqseq;
77365 + static atomic_unchecked_t acqseq;
77366
77367 do {
77368 - res = atomic_inc_return(&acqseq);
77369 + res = atomic_inc_return_unchecked(&acqseq);
77370 } while (!res);
77371 return res;
77372 }
77373 @@ -3657,7 +3659,11 @@ static int pfkey_seq_show(struct seq_fil
77374 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
77375 else
77376 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
77377 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77378 + NULL,
77379 +#else
77380 s,
77381 +#endif
77382 atomic_read(&s->sk_refcnt),
77383 sk_rmem_alloc_get(s),
77384 sk_wmem_alloc_get(s),
77385 diff -urNp linux-2.6.39.1/net/l2tp/l2tp_ip.c linux-2.6.39.1/net/l2tp/l2tp_ip.c
77386 --- linux-2.6.39.1/net/l2tp/l2tp_ip.c 2011-05-19 00:06:34.000000000 -0400
77387 +++ linux-2.6.39.1/net/l2tp/l2tp_ip.c 2011-05-22 19:36:34.000000000 -0400
77388 @@ -625,7 +625,7 @@ static struct inet_protosw l2tp_ip_proto
77389 .no_check = 0,
77390 };
77391
77392 -static struct net_protocol l2tp_ip_protocol __read_mostly = {
77393 +static const struct net_protocol l2tp_ip_protocol = {
77394 .handler = l2tp_ip_recv,
77395 };
77396
77397 diff -urNp linux-2.6.39.1/net/lapb/lapb_iface.c linux-2.6.39.1/net/lapb/lapb_iface.c
77398 --- linux-2.6.39.1/net/lapb/lapb_iface.c 2011-05-19 00:06:34.000000000 -0400
77399 +++ linux-2.6.39.1/net/lapb/lapb_iface.c 2011-05-22 19:36:34.000000000 -0400
77400 @@ -138,8 +138,7 @@ static struct lapb_cb *lapb_create_cb(vo
77401 out:
77402 return lapb;
77403 }
77404 -
77405 -int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks)
77406 +int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks)
77407 {
77408 struct lapb_cb *lapb;
77409 int rc = LAPB_BADTOKEN;
77410 diff -urNp linux-2.6.39.1/net/mac80211/cfg.c linux-2.6.39.1/net/mac80211/cfg.c
77411 --- linux-2.6.39.1/net/mac80211/cfg.c 2011-06-03 00:04:14.000000000 -0400
77412 +++ linux-2.6.39.1/net/mac80211/cfg.c 2011-06-03 00:32:08.000000000 -0400
77413 @@ -2031,7 +2031,7 @@ static void ieee80211_get_ringparam(stru
77414 drv_get_ringparam(local, tx, tx_max, rx, rx_max);
77415 }
77416
77417 -struct cfg80211_ops mac80211_config_ops = {
77418 +const struct cfg80211_ops mac80211_config_ops = {
77419 .add_virtual_intf = ieee80211_add_iface,
77420 .del_virtual_intf = ieee80211_del_iface,
77421 .change_virtual_intf = ieee80211_change_iface,
77422 diff -urNp linux-2.6.39.1/net/mac80211/cfg.h linux-2.6.39.1/net/mac80211/cfg.h
77423 --- linux-2.6.39.1/net/mac80211/cfg.h 2011-05-19 00:06:34.000000000 -0400
77424 +++ linux-2.6.39.1/net/mac80211/cfg.h 2011-05-22 19:36:34.000000000 -0400
77425 @@ -4,6 +4,6 @@
77426 #ifndef __CFG_H
77427 #define __CFG_H
77428
77429 -extern struct cfg80211_ops mac80211_config_ops;
77430 +extern const struct cfg80211_ops mac80211_config_ops;
77431
77432 #endif /* __CFG_H */
77433 diff -urNp linux-2.6.39.1/net/mac80211/debugfs_sta.c linux-2.6.39.1/net/mac80211/debugfs_sta.c
77434 --- linux-2.6.39.1/net/mac80211/debugfs_sta.c 2011-05-19 00:06:34.000000000 -0400
77435 +++ linux-2.6.39.1/net/mac80211/debugfs_sta.c 2011-05-22 19:36:34.000000000 -0400
77436 @@ -115,6 +115,8 @@ static ssize_t sta_agg_status_read(struc
77437 struct tid_ampdu_rx *tid_rx;
77438 struct tid_ampdu_tx *tid_tx;
77439
77440 + pax_track_stack();
77441 +
77442 rcu_read_lock();
77443
77444 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
77445 @@ -215,6 +217,8 @@ static ssize_t sta_ht_capa_read(struct f
77446 struct sta_info *sta = file->private_data;
77447 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
77448
77449 + pax_track_stack();
77450 +
77451 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
77452 htc->ht_supported ? "" : "not ");
77453 if (htc->ht_supported) {
77454 diff -urNp linux-2.6.39.1/net/mac80211/ieee80211_i.h linux-2.6.39.1/net/mac80211/ieee80211_i.h
77455 --- linux-2.6.39.1/net/mac80211/ieee80211_i.h 2011-05-19 00:06:34.000000000 -0400
77456 +++ linux-2.6.39.1/net/mac80211/ieee80211_i.h 2011-05-22 19:36:34.000000000 -0400
77457 @@ -27,6 +27,7 @@
77458 #include <net/ieee80211_radiotap.h>
77459 #include <net/cfg80211.h>
77460 #include <net/mac80211.h>
77461 +#include <asm/local.h>
77462 #include "key.h"
77463 #include "sta_info.h"
77464
77465 @@ -714,7 +715,7 @@ struct ieee80211_local {
77466 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
77467 spinlock_t queue_stop_reason_lock;
77468
77469 - int open_count;
77470 + local_t open_count;
77471 int monitors, cooked_mntrs;
77472 /* number of interfaces with corresponding FIF_ flags */
77473 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
77474 diff -urNp linux-2.6.39.1/net/mac80211/iface.c linux-2.6.39.1/net/mac80211/iface.c
77475 --- linux-2.6.39.1/net/mac80211/iface.c 2011-05-19 00:06:34.000000000 -0400
77476 +++ linux-2.6.39.1/net/mac80211/iface.c 2011-05-22 19:36:34.000000000 -0400
77477 @@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
77478 break;
77479 }
77480
77481 - if (local->open_count == 0) {
77482 + if (local_read(&local->open_count) == 0) {
77483 res = drv_start(local);
77484 if (res)
77485 goto err_del_bss;
77486 @@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_
77487 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
77488
77489 if (!is_valid_ether_addr(dev->dev_addr)) {
77490 - if (!local->open_count)
77491 + if (!local_read(&local->open_count))
77492 drv_stop(local);
77493 return -EADDRNOTAVAIL;
77494 }
77495 @@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_
77496 mutex_unlock(&local->mtx);
77497
77498 if (coming_up)
77499 - local->open_count++;
77500 + local_inc(&local->open_count);
77501
77502 if (hw_reconf_flags) {
77503 ieee80211_hw_config(local, hw_reconf_flags);
77504 @@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_
77505 err_del_interface:
77506 drv_remove_interface(local, &sdata->vif);
77507 err_stop:
77508 - if (!local->open_count)
77509 + if (!local_read(&local->open_count))
77510 drv_stop(local);
77511 err_del_bss:
77512 sdata->bss = NULL;
77513 @@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct iee
77514 }
77515
77516 if (going_down)
77517 - local->open_count--;
77518 + local_dec(&local->open_count);
77519
77520 switch (sdata->vif.type) {
77521 case NL80211_IFTYPE_AP_VLAN:
77522 @@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct iee
77523
77524 ieee80211_recalc_ps(local, -1);
77525
77526 - if (local->open_count == 0) {
77527 + if (local_read(&local->open_count) == 0) {
77528 if (local->ops->napi_poll)
77529 napi_disable(&local->napi);
77530 ieee80211_clear_tx_pending(local);
77531 diff -urNp linux-2.6.39.1/net/mac80211/main.c linux-2.6.39.1/net/mac80211/main.c
77532 --- linux-2.6.39.1/net/mac80211/main.c 2011-05-19 00:06:34.000000000 -0400
77533 +++ linux-2.6.39.1/net/mac80211/main.c 2011-05-22 19:36:34.000000000 -0400
77534 @@ -215,7 +215,7 @@ int ieee80211_hw_config(struct ieee80211
77535 local->hw.conf.power_level = power;
77536 }
77537
77538 - if (changed && local->open_count) {
77539 + if (changed && local_read(&local->open_count)) {
77540 ret = drv_config(local, changed);
77541 /*
77542 * Goal:
77543 diff -urNp linux-2.6.39.1/net/mac80211/mlme.c linux-2.6.39.1/net/mac80211/mlme.c
77544 --- linux-2.6.39.1/net/mac80211/mlme.c 2011-06-03 00:04:14.000000000 -0400
77545 +++ linux-2.6.39.1/net/mac80211/mlme.c 2011-06-03 00:32:08.000000000 -0400
77546 @@ -1431,6 +1431,8 @@ static bool ieee80211_assoc_success(stru
77547 bool have_higher_than_11mbit = false;
77548 u16 ap_ht_cap_flags;
77549
77550 + pax_track_stack();
77551 +
77552 /* AssocResp and ReassocResp have identical structure */
77553
77554 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
77555 diff -urNp linux-2.6.39.1/net/mac80211/pm.c linux-2.6.39.1/net/mac80211/pm.c
77556 --- linux-2.6.39.1/net/mac80211/pm.c 2011-05-19 00:06:34.000000000 -0400
77557 +++ linux-2.6.39.1/net/mac80211/pm.c 2011-05-22 19:36:34.000000000 -0400
77558 @@ -95,7 +95,7 @@ int __ieee80211_suspend(struct ieee80211
77559 }
77560
77561 /* stop hardware - this must stop RX */
77562 - if (local->open_count)
77563 + if (local_read(&local->open_count))
77564 ieee80211_stop_device(local);
77565
77566 local->suspended = true;
77567 diff -urNp linux-2.6.39.1/net/mac80211/rate.c linux-2.6.39.1/net/mac80211/rate.c
77568 --- linux-2.6.39.1/net/mac80211/rate.c 2011-05-19 00:06:34.000000000 -0400
77569 +++ linux-2.6.39.1/net/mac80211/rate.c 2011-05-22 19:36:34.000000000 -0400
77570 @@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct
77571
77572 ASSERT_RTNL();
77573
77574 - if (local->open_count)
77575 + if (local_read(&local->open_count))
77576 return -EBUSY;
77577
77578 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
77579 diff -urNp linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c
77580 --- linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c 2011-05-19 00:06:34.000000000 -0400
77581 +++ linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c 2011-05-22 19:36:34.000000000 -0400
77582 @@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
77583
77584 spin_unlock_irqrestore(&events->lock, status);
77585
77586 - if (copy_to_user(buf, pb, p))
77587 + if (p > sizeof(pb) || copy_to_user(buf, pb, p))
77588 return -EFAULT;
77589
77590 return p;
77591 diff -urNp linux-2.6.39.1/net/mac80211/util.c linux-2.6.39.1/net/mac80211/util.c
77592 --- linux-2.6.39.1/net/mac80211/util.c 2011-05-19 00:06:34.000000000 -0400
77593 +++ linux-2.6.39.1/net/mac80211/util.c 2011-05-22 19:36:34.000000000 -0400
77594 @@ -1129,7 +1129,7 @@ int ieee80211_reconfig(struct ieee80211_
77595 local->resuming = true;
77596
77597 /* restart hardware */
77598 - if (local->open_count) {
77599 + if (local_read(&local->open_count)) {
77600 /*
77601 * Upon resume hardware can sometimes be goofy due to
77602 * various platform / driver / bus issues, so restarting
77603 diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c
77604 --- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c 2011-05-19 00:06:34.000000000 -0400
77605 +++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c 2011-05-22 19:36:34.000000000 -0400
77606 @@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
77607 /* Increase the refcnt counter of the dest */
77608 atomic_inc(&dest->refcnt);
77609
77610 - conn_flags = atomic_read(&dest->conn_flags);
77611 + conn_flags = atomic_read_unchecked(&dest->conn_flags);
77612 if (cp->protocol != IPPROTO_UDP)
77613 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
77614 /* Bind with the destination and its corresponding transmitter */
77615 @@ -861,7 +861,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
77616 atomic_set(&cp->refcnt, 1);
77617
77618 atomic_set(&cp->n_control, 0);
77619 - atomic_set(&cp->in_pkts, 0);
77620 + atomic_set_unchecked(&cp->in_pkts, 0);
77621
77622 atomic_inc(&ipvs->conn_count);
77623 if (flags & IP_VS_CONN_F_NO_CPORT)
77624 @@ -1141,7 +1141,7 @@ static inline int todrop_entry(struct ip
77625
77626 /* Don't drop the entry if its number of incoming packets is not
77627 located in [0, 8] */
77628 - i = atomic_read(&cp->in_pkts);
77629 + i = atomic_read_unchecked(&cp->in_pkts);
77630 if (i > 8 || i < 0) return 0;
77631
77632 if (!todrop_rate[i]) return 0;
77633 diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c
77634 --- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c 2011-05-19 00:06:34.000000000 -0400
77635 +++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c 2011-05-22 19:36:34.000000000 -0400
77636 @@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv
77637 ret = cp->packet_xmit(skb, cp, pd->pp);
77638 /* do not touch skb anymore */
77639
77640 - atomic_inc(&cp->in_pkts);
77641 + atomic_inc_unchecked(&cp->in_pkts);
77642 ip_vs_conn_put(cp);
77643 return ret;
77644 }
77645 @@ -1633,7 +1633,7 @@ ip_vs_in(unsigned int hooknum, struct sk
77646 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
77647 pkts = sysctl_sync_threshold(ipvs);
77648 else
77649 - pkts = atomic_add_return(1, &cp->in_pkts);
77650 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77651
77652 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
77653 cp->protocol == IPPROTO_SCTP) {
77654 diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c
77655 --- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-19 00:06:34.000000000 -0400
77656 +++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-22 19:36:34.000000000 -0400
77657 @@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service
77658 ip_vs_rs_hash(ipvs, dest);
77659 write_unlock_bh(&ipvs->rs_lock);
77660 }
77661 - atomic_set(&dest->conn_flags, conn_flags);
77662 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
77663
77664 /* bind the service */
77665 if (!dest->svc) {
77666 @@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se
77667 " %-7s %-6d %-10d %-10d\n",
77668 &dest->addr.in6,
77669 ntohs(dest->port),
77670 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77671 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77672 atomic_read(&dest->weight),
77673 atomic_read(&dest->activeconns),
77674 atomic_read(&dest->inactconns));
77675 @@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se
77676 "%-7s %-6d %-10d %-10d\n",
77677 ntohl(dest->addr.ip),
77678 ntohs(dest->port),
77679 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77680 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77681 atomic_read(&dest->weight),
77682 atomic_read(&dest->activeconns),
77683 atomic_read(&dest->inactconns));
77684 @@ -2287,6 +2287,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
77685 struct ip_vs_dest_user *udest_compat;
77686 struct ip_vs_dest_user_kern udest;
77687
77688 + pax_track_stack();
77689 +
77690 if (!capable(CAP_NET_ADMIN))
77691 return -EPERM;
77692
77693 @@ -2501,7 +2503,7 @@ __ip_vs_get_dest_entries(struct net *net
77694
77695 entry.addr = dest->addr.ip;
77696 entry.port = dest->port;
77697 - entry.conn_flags = atomic_read(&dest->conn_flags);
77698 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77699 entry.weight = atomic_read(&dest->weight);
77700 entry.u_threshold = dest->u_threshold;
77701 entry.l_threshold = dest->l_threshold;
77702 @@ -3029,7 +3031,7 @@ static int ip_vs_genl_fill_dest(struct s
77703 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
77704
77705 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77706 - atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77707 + atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77708 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
77709 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
77710 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
77711 diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c
77712 --- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c 2011-05-19 00:06:34.000000000 -0400
77713 +++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c 2011-05-22 19:36:34.000000000 -0400
77714 @@ -648,7 +648,7 @@ control:
77715 * i.e only increment in_pkts for Templates.
77716 */
77717 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
77718 - int pkts = atomic_add_return(1, &cp->in_pkts);
77719 + int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77720
77721 if (pkts % sysctl_sync_period(ipvs) != 1)
77722 return;
77723 @@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net *
77724
77725 if (opt)
77726 memcpy(&cp->in_seq, opt, sizeof(*opt));
77727 - atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77728 + atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77729 cp->state = state;
77730 cp->old_state = cp->state;
77731 /*
77732 diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c
77733 --- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-19 00:06:34.000000000 -0400
77734 +++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-22 19:36:34.000000000 -0400
77735 @@ -1127,7 +1127,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
77736 else
77737 rc = NF_ACCEPT;
77738 /* do not touch skb anymore */
77739 - atomic_inc(&cp->in_pkts);
77740 + atomic_inc_unchecked(&cp->in_pkts);
77741 goto out;
77742 }
77743
77744 @@ -1245,7 +1245,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
77745 else
77746 rc = NF_ACCEPT;
77747 /* do not touch skb anymore */
77748 - atomic_inc(&cp->in_pkts);
77749 + atomic_inc_unchecked(&cp->in_pkts);
77750 goto out;
77751 }
77752
77753 diff -urNp linux-2.6.39.1/net/netfilter/Kconfig linux-2.6.39.1/net/netfilter/Kconfig
77754 --- linux-2.6.39.1/net/netfilter/Kconfig 2011-05-19 00:06:34.000000000 -0400
77755 +++ linux-2.6.39.1/net/netfilter/Kconfig 2011-05-22 19:41:42.000000000 -0400
77756 @@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
77757
77758 To compile it as a module, choose M here. If unsure, say N.
77759
77760 +config NETFILTER_XT_MATCH_GRADM
77761 + tristate '"gradm" match support'
77762 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77763 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77764 + ---help---
77765 + The gradm match allows to match on grsecurity RBAC being enabled.
77766 + It is useful when iptables rules are applied early on bootup to
77767 + prevent connections to the machine (except from a trusted host)
77768 + while the RBAC system is disabled.
77769 +
77770 config NETFILTER_XT_MATCH_HASHLIMIT
77771 tristate '"hashlimit" match support'
77772 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
77773 diff -urNp linux-2.6.39.1/net/netfilter/Makefile linux-2.6.39.1/net/netfilter/Makefile
77774 --- linux-2.6.39.1/net/netfilter/Makefile 2011-05-19 00:06:34.000000000 -0400
77775 +++ linux-2.6.39.1/net/netfilter/Makefile 2011-05-22 20:40:16.000000000 -0400
77776 @@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) +=
77777 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
77778 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77779 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77780 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77781 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77782 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77783 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
77784 diff -urNp linux-2.6.39.1/net/netfilter/nfnetlink_log.c linux-2.6.39.1/net/netfilter/nfnetlink_log.c
77785 --- linux-2.6.39.1/net/netfilter/nfnetlink_log.c 2011-05-19 00:06:34.000000000 -0400
77786 +++ linux-2.6.39.1/net/netfilter/nfnetlink_log.c 2011-05-22 19:36:35.000000000 -0400
77787 @@ -70,7 +70,7 @@ struct nfulnl_instance {
77788 };
77789
77790 static DEFINE_SPINLOCK(instances_lock);
77791 -static atomic_t global_seq;
77792 +static atomic_unchecked_t global_seq;
77793
77794 #define INSTANCE_BUCKETS 16
77795 static struct hlist_head instance_table[INSTANCE_BUCKETS];
77796 @@ -506,7 +506,7 @@ __build_packet_message(struct nfulnl_ins
77797 /* global sequence number */
77798 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
77799 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
77800 - htonl(atomic_inc_return(&global_seq)));
77801 + htonl(atomic_inc_return_unchecked(&global_seq)));
77802
77803 if (data_len) {
77804 struct nlattr *nla;
77805 diff -urNp linux-2.6.39.1/net/netfilter/nfnetlink_queue.c linux-2.6.39.1/net/netfilter/nfnetlink_queue.c
77806 --- linux-2.6.39.1/net/netfilter/nfnetlink_queue.c 2011-05-19 00:06:34.000000000 -0400
77807 +++ linux-2.6.39.1/net/netfilter/nfnetlink_queue.c 2011-05-22 19:36:35.000000000 -0400
77808 @@ -58,7 +58,7 @@ struct nfqnl_instance {
77809 */
77810 spinlock_t lock;
77811 unsigned int queue_total;
77812 - atomic_t id_sequence; /* 'sequence' of pkt ids */
77813 + atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */
77814 struct list_head queue_list; /* packets in queue */
77815 };
77816
77817 @@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
77818 nfmsg->version = NFNETLINK_V0;
77819 nfmsg->res_id = htons(queue->queue_num);
77820
77821 - entry->id = atomic_inc_return(&queue->id_sequence);
77822 + entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
77823 pmsg.packet_id = htonl(entry->id);
77824 pmsg.hw_protocol = entskb->protocol;
77825 pmsg.hook = entry->hook;
77826 @@ -869,7 +869,7 @@ static int seq_show(struct seq_file *s,
77827 inst->peer_pid, inst->queue_total,
77828 inst->copy_mode, inst->copy_range,
77829 inst->queue_dropped, inst->queue_user_dropped,
77830 - atomic_read(&inst->id_sequence), 1);
77831 + atomic_read_unchecked(&inst->id_sequence), 1);
77832 }
77833
77834 static const struct seq_operations nfqnl_seq_ops = {
77835 diff -urNp linux-2.6.39.1/net/netfilter/xt_gradm.c linux-2.6.39.1/net/netfilter/xt_gradm.c
77836 --- linux-2.6.39.1/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
77837 +++ linux-2.6.39.1/net/netfilter/xt_gradm.c 2011-05-22 19:41:42.000000000 -0400
77838 @@ -0,0 +1,51 @@
77839 +/*
77840 + * gradm match for netfilter
77841 + * Copyright © Zbigniew Krzystolik, 2010
77842 + *
77843 + * This program is free software; you can redistribute it and/or modify
77844 + * it under the terms of the GNU General Public License; either version
77845 + * 2 or 3 as published by the Free Software Foundation.
77846 + */
77847 +#include <linux/module.h>
77848 +#include <linux/moduleparam.h>
77849 +#include <linux/skbuff.h>
77850 +#include <linux/netfilter/x_tables.h>
77851 +#include <linux/grsecurity.h>
77852 +#include <linux/netfilter/xt_gradm.h>
77853 +
77854 +static bool
77855 +gradm_mt(const struct sk_buff *skb, struct xt_action_param *par)
77856 +{
77857 + const struct xt_gradm_mtinfo *info = par->matchinfo;
77858 + bool retval = false;
77859 + if (gr_acl_is_enabled())
77860 + retval = true;
77861 + return retval ^ info->invflags;
77862 +}
77863 +
77864 +static struct xt_match gradm_mt_reg __read_mostly = {
77865 + .name = "gradm",
77866 + .revision = 0,
77867 + .family = NFPROTO_UNSPEC,
77868 + .match = gradm_mt,
77869 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
77870 + .me = THIS_MODULE,
77871 +};
77872 +
77873 +static int __init gradm_mt_init(void)
77874 +{
77875 + return xt_register_match(&gradm_mt_reg);
77876 +}
77877 +
77878 +static void __exit gradm_mt_exit(void)
77879 +{
77880 + xt_unregister_match(&gradm_mt_reg);
77881 +}
77882 +
77883 +module_init(gradm_mt_init);
77884 +module_exit(gradm_mt_exit);
77885 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
77886 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
77887 +MODULE_LICENSE("GPL");
77888 +MODULE_ALIAS("ipt_gradm");
77889 +MODULE_ALIAS("ip6t_gradm");
77890 diff -urNp linux-2.6.39.1/net/netfilter/xt_statistic.c linux-2.6.39.1/net/netfilter/xt_statistic.c
77891 --- linux-2.6.39.1/net/netfilter/xt_statistic.c 2011-05-19 00:06:34.000000000 -0400
77892 +++ linux-2.6.39.1/net/netfilter/xt_statistic.c 2011-05-22 19:36:35.000000000 -0400
77893 @@ -18,7 +18,7 @@
77894 #include <linux/netfilter/x_tables.h>
77895
77896 struct xt_statistic_priv {
77897 - atomic_t count;
77898 + atomic_unchecked_t count;
77899 } ____cacheline_aligned_in_smp;
77900
77901 MODULE_LICENSE("GPL");
77902 @@ -41,9 +41,9 @@ statistic_mt(const struct sk_buff *skb,
77903 break;
77904 case XT_STATISTIC_MODE_NTH:
77905 do {
77906 - oval = atomic_read(&info->master->count);
77907 + oval = atomic_read_unchecked(&info->master->count);
77908 nval = (oval == info->u.nth.every) ? 0 : oval + 1;
77909 - } while (atomic_cmpxchg(&info->master->count, oval, nval) != oval);
77910 + } while (atomic_cmpxchg_unchecked(&info->master->count, oval, nval) != oval);
77911 if (nval == 0)
77912 ret = !ret;
77913 break;
77914 @@ -63,7 +63,7 @@ static int statistic_mt_check(const stru
77915 info->master = kzalloc(sizeof(*info->master), GFP_KERNEL);
77916 if (info->master == NULL)
77917 return -ENOMEM;
77918 - atomic_set(&info->master->count, info->u.nth.count);
77919 + atomic_set_unchecked(&info->master->count, info->u.nth.count);
77920
77921 return 0;
77922 }
77923 diff -urNp linux-2.6.39.1/net/netlink/af_netlink.c linux-2.6.39.1/net/netlink/af_netlink.c
77924 --- linux-2.6.39.1/net/netlink/af_netlink.c 2011-05-19 00:06:34.000000000 -0400
77925 +++ linux-2.6.39.1/net/netlink/af_netlink.c 2011-05-22 19:41:42.000000000 -0400
77926 @@ -742,7 +742,7 @@ static void netlink_overrun(struct sock
77927 sk->sk_error_report(sk);
77928 }
77929 }
77930 - atomic_inc(&sk->sk_drops);
77931 + atomic_inc_unchecked(&sk->sk_drops);
77932 }
77933
77934 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
77935 @@ -1992,15 +1992,23 @@ static int netlink_seq_show(struct seq_f
77936 struct netlink_sock *nlk = nlk_sk(s);
77937
77938 seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d %-8lu\n",
77939 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77940 + NULL,
77941 +#else
77942 s,
77943 +#endif
77944 s->sk_protocol,
77945 nlk->pid,
77946 nlk->groups ? (u32)nlk->groups[0] : 0,
77947 sk_rmem_alloc_get(s),
77948 sk_wmem_alloc_get(s),
77949 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77950 + NULL,
77951 +#else
77952 nlk->cb,
77953 +#endif
77954 atomic_read(&s->sk_refcnt),
77955 - atomic_read(&s->sk_drops),
77956 + atomic_read_unchecked(&s->sk_drops),
77957 sock_i_ino(s)
77958 );
77959
77960 diff -urNp linux-2.6.39.1/net/netrom/af_netrom.c linux-2.6.39.1/net/netrom/af_netrom.c
77961 --- linux-2.6.39.1/net/netrom/af_netrom.c 2011-05-19 00:06:34.000000000 -0400
77962 +++ linux-2.6.39.1/net/netrom/af_netrom.c 2011-05-22 19:41:42.000000000 -0400
77963 @@ -840,6 +840,7 @@ static int nr_getname(struct socket *soc
77964 struct sock *sk = sock->sk;
77965 struct nr_sock *nr = nr_sk(sk);
77966
77967 + memset(sax, 0, sizeof(*sax));
77968 lock_sock(sk);
77969 if (peer != 0) {
77970 if (sk->sk_state != TCP_ESTABLISHED) {
77971 @@ -854,7 +855,6 @@ static int nr_getname(struct socket *soc
77972 *uaddr_len = sizeof(struct full_sockaddr_ax25);
77973 } else {
77974 sax->fsa_ax25.sax25_family = AF_NETROM;
77975 - sax->fsa_ax25.sax25_ndigis = 0;
77976 sax->fsa_ax25.sax25_call = nr->source_addr;
77977 *uaddr_len = sizeof(struct sockaddr_ax25);
77978 }
77979 diff -urNp linux-2.6.39.1/net/packet/af_packet.c linux-2.6.39.1/net/packet/af_packet.c
77980 --- linux-2.6.39.1/net/packet/af_packet.c 2011-05-19 00:06:34.000000000 -0400
77981 +++ linux-2.6.39.1/net/packet/af_packet.c 2011-05-22 19:41:42.000000000 -0400
77982 @@ -647,14 +647,14 @@ static int packet_rcv(struct sk_buff *sk
77983
77984 spin_lock(&sk->sk_receive_queue.lock);
77985 po->stats.tp_packets++;
77986 - skb->dropcount = atomic_read(&sk->sk_drops);
77987 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
77988 __skb_queue_tail(&sk->sk_receive_queue, skb);
77989 spin_unlock(&sk->sk_receive_queue.lock);
77990 sk->sk_data_ready(sk, skb->len);
77991 return 0;
77992
77993 drop_n_acct:
77994 - po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
77995 + po->stats.tp_drops = atomic_inc_return_unchecked(&sk->sk_drops);
77996
77997 drop_n_restore:
77998 if (skb_head != skb->data && skb_shared(skb)) {
77999 @@ -2157,7 +2157,7 @@ static int packet_getsockopt(struct sock
78000 case PACKET_HDRLEN:
78001 if (len > sizeof(int))
78002 len = sizeof(int);
78003 - if (copy_from_user(&val, optval, len))
78004 + if (len > sizeof(val) || copy_from_user(&val, optval, len))
78005 return -EFAULT;
78006 switch (val) {
78007 case TPACKET_V1:
78008 @@ -2195,7 +2195,7 @@ static int packet_getsockopt(struct sock
78009
78010 if (put_user(len, optlen))
78011 return -EFAULT;
78012 - if (copy_to_user(optval, data, len))
78013 + if (len > sizeof(st) || copy_to_user(optval, data, len))
78014 return -EFAULT;
78015 return 0;
78016 }
78017 @@ -2707,7 +2707,11 @@ static int packet_seq_show(struct seq_fi
78018
78019 seq_printf(seq,
78020 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
78021 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78022 + NULL,
78023 +#else
78024 s,
78025 +#endif
78026 atomic_read(&s->sk_refcnt),
78027 s->sk_type,
78028 ntohs(po->num),
78029 diff -urNp linux-2.6.39.1/net/phonet/af_phonet.c linux-2.6.39.1/net/phonet/af_phonet.c
78030 --- linux-2.6.39.1/net/phonet/af_phonet.c 2011-05-19 00:06:34.000000000 -0400
78031 +++ linux-2.6.39.1/net/phonet/af_phonet.c 2011-05-22 19:41:42.000000000 -0400
78032 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
78033 {
78034 struct phonet_protocol *pp;
78035
78036 - if (protocol >= PHONET_NPROTO)
78037 + if (protocol < 0 || protocol >= PHONET_NPROTO)
78038 return NULL;
78039
78040 rcu_read_lock();
78041 @@ -149,7 +149,7 @@ static int pn_header_parse(const struct
78042 return 1;
78043 }
78044
78045 -struct header_ops phonet_header_ops = {
78046 +const struct header_ops phonet_header_ops = {
78047 .create = pn_header_create,
78048 .parse = pn_header_parse,
78049 };
78050 @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_regist
78051 {
78052 int err = 0;
78053
78054 - if (protocol >= PHONET_NPROTO)
78055 + if (protocol < 0 || protocol >= PHONET_NPROTO)
78056 return -EINVAL;
78057
78058 err = proto_register(pp->prot, 1);
78059 diff -urNp linux-2.6.39.1/net/phonet/pep.c linux-2.6.39.1/net/phonet/pep.c
78060 --- linux-2.6.39.1/net/phonet/pep.c 2011-05-19 00:06:34.000000000 -0400
78061 +++ linux-2.6.39.1/net/phonet/pep.c 2011-05-22 19:36:35.000000000 -0400
78062 @@ -387,7 +387,7 @@ static int pipe_do_rcv(struct sock *sk,
78063
78064 case PNS_PEP_CTRL_REQ:
78065 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
78066 - atomic_inc(&sk->sk_drops);
78067 + atomic_inc_unchecked(&sk->sk_drops);
78068 break;
78069 }
78070 __skb_pull(skb, 4);
78071 @@ -408,7 +408,7 @@ static int pipe_do_rcv(struct sock *sk,
78072 }
78073
78074 if (pn->rx_credits == 0) {
78075 - atomic_inc(&sk->sk_drops);
78076 + atomic_inc_unchecked(&sk->sk_drops);
78077 err = -ENOBUFS;
78078 break;
78079 }
78080 @@ -556,7 +556,7 @@ static int pipe_handler_do_rcv(struct so
78081 }
78082
78083 if (pn->rx_credits == 0) {
78084 - atomic_inc(&sk->sk_drops);
78085 + atomic_inc_unchecked(&sk->sk_drops);
78086 err = NET_RX_DROP;
78087 break;
78088 }
78089 diff -urNp linux-2.6.39.1/net/phonet/socket.c linux-2.6.39.1/net/phonet/socket.c
78090 --- linux-2.6.39.1/net/phonet/socket.c 2011-05-19 00:06:34.000000000 -0400
78091 +++ linux-2.6.39.1/net/phonet/socket.c 2011-05-22 20:39:26.000000000 -0400
78092 @@ -613,8 +613,13 @@ static int pn_sock_seq_show(struct seq_f
78093 pn->resource, sk->sk_state,
78094 sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
78095 sock_i_uid(sk), sock_i_ino(sk),
78096 - atomic_read(&sk->sk_refcnt), sk,
78097 - atomic_read(&sk->sk_drops), &len);
78098 + atomic_read(&sk->sk_refcnt),
78099 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78100 + NULL,
78101 +#else
78102 + sk,
78103 +#endif
78104 + atomic_read_unchecked(&sk->sk_drops), &len);
78105 }
78106 seq_printf(seq, "%*s\n", 127 - len, "");
78107 return 0;
78108 diff -urNp linux-2.6.39.1/net/rds/cong.c linux-2.6.39.1/net/rds/cong.c
78109 --- linux-2.6.39.1/net/rds/cong.c 2011-05-19 00:06:34.000000000 -0400
78110 +++ linux-2.6.39.1/net/rds/cong.c 2011-05-22 19:36:35.000000000 -0400
78111 @@ -77,7 +77,7 @@
78112 * finds that the saved generation number is smaller than the global generation
78113 * number, it wakes up the process.
78114 */
78115 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
78116 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
78117
78118 /*
78119 * Congestion monitoring
78120 @@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_con
78121 rdsdebug("waking map %p for %pI4\n",
78122 map, &map->m_addr);
78123 rds_stats_inc(s_cong_update_received);
78124 - atomic_inc(&rds_cong_generation);
78125 + atomic_inc_unchecked(&rds_cong_generation);
78126 if (waitqueue_active(&map->m_waitq))
78127 wake_up(&map->m_waitq);
78128 if (waitqueue_active(&rds_poll_waitq))
78129 @@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
78130
78131 int rds_cong_updated_since(unsigned long *recent)
78132 {
78133 - unsigned long gen = atomic_read(&rds_cong_generation);
78134 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
78135
78136 if (likely(*recent == gen))
78137 return 0;
78138 diff -urNp linux-2.6.39.1/net/rds/ib_cm.c linux-2.6.39.1/net/rds/ib_cm.c
78139 --- linux-2.6.39.1/net/rds/ib_cm.c 2011-05-19 00:06:34.000000000 -0400
78140 +++ linux-2.6.39.1/net/rds/ib_cm.c 2011-05-22 19:36:35.000000000 -0400
78141 @@ -720,7 +720,7 @@ void rds_ib_conn_shutdown(struct rds_con
78142 /* Clear the ACK state */
78143 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
78144 #ifdef KERNEL_HAS_ATOMIC64
78145 - atomic64_set(&ic->i_ack_next, 0);
78146 + atomic64_set_unchecked(&ic->i_ack_next, 0);
78147 #else
78148 ic->i_ack_next = 0;
78149 #endif
78150 diff -urNp linux-2.6.39.1/net/rds/ib.h linux-2.6.39.1/net/rds/ib.h
78151 --- linux-2.6.39.1/net/rds/ib.h 2011-05-19 00:06:34.000000000 -0400
78152 +++ linux-2.6.39.1/net/rds/ib.h 2011-05-22 19:36:35.000000000 -0400
78153 @@ -127,7 +127,7 @@ struct rds_ib_connection {
78154 /* sending acks */
78155 unsigned long i_ack_flags;
78156 #ifdef KERNEL_HAS_ATOMIC64
78157 - atomic64_t i_ack_next; /* next ACK to send */
78158 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
78159 #else
78160 spinlock_t i_ack_lock; /* protect i_ack_next */
78161 u64 i_ack_next; /* next ACK to send */
78162 diff -urNp linux-2.6.39.1/net/rds/ib_recv.c linux-2.6.39.1/net/rds/ib_recv.c
78163 --- linux-2.6.39.1/net/rds/ib_recv.c 2011-05-19 00:06:34.000000000 -0400
78164 +++ linux-2.6.39.1/net/rds/ib_recv.c 2011-05-22 19:36:35.000000000 -0400
78165 @@ -592,7 +592,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
78166 static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
78167 int ack_required)
78168 {
78169 - atomic64_set(&ic->i_ack_next, seq);
78170 + atomic64_set_unchecked(&ic->i_ack_next, seq);
78171 if (ack_required) {
78172 smp_mb__before_clear_bit();
78173 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78174 @@ -604,7 +604,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
78175 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78176 smp_mb__after_clear_bit();
78177
78178 - return atomic64_read(&ic->i_ack_next);
78179 + return atomic64_read_unchecked(&ic->i_ack_next);
78180 }
78181 #endif
78182
78183 diff -urNp linux-2.6.39.1/net/rds/iw_cm.c linux-2.6.39.1/net/rds/iw_cm.c
78184 --- linux-2.6.39.1/net/rds/iw_cm.c 2011-05-19 00:06:34.000000000 -0400
78185 +++ linux-2.6.39.1/net/rds/iw_cm.c 2011-05-22 19:36:35.000000000 -0400
78186 @@ -664,7 +664,7 @@ void rds_iw_conn_shutdown(struct rds_con
78187 /* Clear the ACK state */
78188 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
78189 #ifdef KERNEL_HAS_ATOMIC64
78190 - atomic64_set(&ic->i_ack_next, 0);
78191 + atomic64_set_unchecked(&ic->i_ack_next, 0);
78192 #else
78193 ic->i_ack_next = 0;
78194 #endif
78195 diff -urNp linux-2.6.39.1/net/rds/iw.h linux-2.6.39.1/net/rds/iw.h
78196 --- linux-2.6.39.1/net/rds/iw.h 2011-05-19 00:06:34.000000000 -0400
78197 +++ linux-2.6.39.1/net/rds/iw.h 2011-05-22 19:36:35.000000000 -0400
78198 @@ -133,7 +133,7 @@ struct rds_iw_connection {
78199 /* sending acks */
78200 unsigned long i_ack_flags;
78201 #ifdef KERNEL_HAS_ATOMIC64
78202 - atomic64_t i_ack_next; /* next ACK to send */
78203 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
78204 #else
78205 spinlock_t i_ack_lock; /* protect i_ack_next */
78206 u64 i_ack_next; /* next ACK to send */
78207 diff -urNp linux-2.6.39.1/net/rds/iw_rdma.c linux-2.6.39.1/net/rds/iw_rdma.c
78208 --- linux-2.6.39.1/net/rds/iw_rdma.c 2011-05-19 00:06:34.000000000 -0400
78209 +++ linux-2.6.39.1/net/rds/iw_rdma.c 2011-05-22 19:36:35.000000000 -0400
78210 @@ -182,6 +182,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
78211 struct rdma_cm_id *pcm_id;
78212 int rc;
78213
78214 + pax_track_stack();
78215 +
78216 src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
78217 dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
78218
78219 diff -urNp linux-2.6.39.1/net/rds/iw_recv.c linux-2.6.39.1/net/rds/iw_recv.c
78220 --- linux-2.6.39.1/net/rds/iw_recv.c 2011-05-19 00:06:34.000000000 -0400
78221 +++ linux-2.6.39.1/net/rds/iw_recv.c 2011-05-22 19:36:35.000000000 -0400
78222 @@ -427,7 +427,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
78223 static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
78224 int ack_required)
78225 {
78226 - atomic64_set(&ic->i_ack_next, seq);
78227 + atomic64_set_unchecked(&ic->i_ack_next, seq);
78228 if (ack_required) {
78229 smp_mb__before_clear_bit();
78230 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78231 @@ -439,7 +439,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
78232 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78233 smp_mb__after_clear_bit();
78234
78235 - return atomic64_read(&ic->i_ack_next);
78236 + return atomic64_read_unchecked(&ic->i_ack_next);
78237 }
78238 #endif
78239
78240 diff -urNp linux-2.6.39.1/net/rxrpc/af_rxrpc.c linux-2.6.39.1/net/rxrpc/af_rxrpc.c
78241 --- linux-2.6.39.1/net/rxrpc/af_rxrpc.c 2011-05-19 00:06:34.000000000 -0400
78242 +++ linux-2.6.39.1/net/rxrpc/af_rxrpc.c 2011-05-22 19:36:35.000000000 -0400
78243 @@ -39,7 +39,7 @@ static const struct proto_ops rxrpc_rpc_
78244 __be32 rxrpc_epoch;
78245
78246 /* current debugging ID */
78247 -atomic_t rxrpc_debug_id;
78248 +atomic_unchecked_t rxrpc_debug_id;
78249
78250 /* count of skbs currently in use */
78251 atomic_t rxrpc_n_skbs;
78252 diff -urNp linux-2.6.39.1/net/rxrpc/ar-ack.c linux-2.6.39.1/net/rxrpc/ar-ack.c
78253 --- linux-2.6.39.1/net/rxrpc/ar-ack.c 2011-05-19 00:06:34.000000000 -0400
78254 +++ linux-2.6.39.1/net/rxrpc/ar-ack.c 2011-05-22 19:36:35.000000000 -0400
78255 @@ -175,7 +175,7 @@ static void rxrpc_resend(struct rxrpc_ca
78256
78257 _enter("{%d,%d,%d,%d},",
78258 call->acks_hard, call->acks_unacked,
78259 - atomic_read(&call->sequence),
78260 + atomic_read_unchecked(&call->sequence),
78261 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
78262
78263 stop = 0;
78264 @@ -199,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_ca
78265
78266 /* each Tx packet has a new serial number */
78267 sp->hdr.serial =
78268 - htonl(atomic_inc_return(&call->conn->serial));
78269 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
78270
78271 hdr = (struct rxrpc_header *) txb->head;
78272 hdr->serial = sp->hdr.serial;
78273 @@ -405,7 +405,7 @@ static void rxrpc_rotate_tx_window(struc
78274 */
78275 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
78276 {
78277 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
78278 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
78279 }
78280
78281 /*
78282 @@ -631,7 +631,7 @@ process_further:
78283
78284 latest = ntohl(sp->hdr.serial);
78285 hard = ntohl(ack.firstPacket);
78286 - tx = atomic_read(&call->sequence);
78287 + tx = atomic_read_unchecked(&call->sequence);
78288
78289 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
78290 latest,
78291 @@ -844,6 +844,8 @@ void rxrpc_process_call(struct work_stru
78292 u32 abort_code = RX_PROTOCOL_ERROR;
78293 u8 *acks = NULL;
78294
78295 + pax_track_stack();
78296 +
78297 //printk("\n--------------------\n");
78298 _enter("{%d,%s,%lx} [%lu]",
78299 call->debug_id, rxrpc_call_states[call->state], call->events,
78300 @@ -1163,7 +1165,7 @@ void rxrpc_process_call(struct work_stru
78301 goto maybe_reschedule;
78302
78303 send_ACK_with_skew:
78304 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
78305 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
78306 ntohl(ack.serial));
78307 send_ACK:
78308 mtu = call->conn->trans->peer->if_mtu;
78309 @@ -1175,7 +1177,7 @@ send_ACK:
78310 ackinfo.rxMTU = htonl(5692);
78311 ackinfo.jumbo_max = htonl(4);
78312
78313 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
78314 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
78315 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
78316 ntohl(hdr.serial),
78317 ntohs(ack.maxSkew),
78318 @@ -1193,7 +1195,7 @@ send_ACK:
78319 send_message:
78320 _debug("send message");
78321
78322 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
78323 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
78324 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
78325 send_message_2:
78326
78327 diff -urNp linux-2.6.39.1/net/rxrpc/ar-call.c linux-2.6.39.1/net/rxrpc/ar-call.c
78328 --- linux-2.6.39.1/net/rxrpc/ar-call.c 2011-05-19 00:06:34.000000000 -0400
78329 +++ linux-2.6.39.1/net/rxrpc/ar-call.c 2011-05-22 19:36:35.000000000 -0400
78330 @@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
78331 spin_lock_init(&call->lock);
78332 rwlock_init(&call->state_lock);
78333 atomic_set(&call->usage, 1);
78334 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
78335 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78336 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
78337
78338 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
78339 diff -urNp linux-2.6.39.1/net/rxrpc/ar-connection.c linux-2.6.39.1/net/rxrpc/ar-connection.c
78340 --- linux-2.6.39.1/net/rxrpc/ar-connection.c 2011-05-19 00:06:34.000000000 -0400
78341 +++ linux-2.6.39.1/net/rxrpc/ar-connection.c 2011-05-22 19:36:35.000000000 -0400
78342 @@ -206,7 +206,7 @@ static struct rxrpc_connection *rxrpc_al
78343 rwlock_init(&conn->lock);
78344 spin_lock_init(&conn->state_lock);
78345 atomic_set(&conn->usage, 1);
78346 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
78347 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78348 conn->avail_calls = RXRPC_MAXCALLS;
78349 conn->size_align = 4;
78350 conn->header_size = sizeof(struct rxrpc_header);
78351 diff -urNp linux-2.6.39.1/net/rxrpc/ar-connevent.c linux-2.6.39.1/net/rxrpc/ar-connevent.c
78352 --- linux-2.6.39.1/net/rxrpc/ar-connevent.c 2011-05-19 00:06:34.000000000 -0400
78353 +++ linux-2.6.39.1/net/rxrpc/ar-connevent.c 2011-05-22 19:36:35.000000000 -0400
78354 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
78355
78356 len = iov[0].iov_len + iov[1].iov_len;
78357
78358 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
78359 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78360 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
78361
78362 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
78363 diff -urNp linux-2.6.39.1/net/rxrpc/ar-input.c linux-2.6.39.1/net/rxrpc/ar-input.c
78364 --- linux-2.6.39.1/net/rxrpc/ar-input.c 2011-05-19 00:06:34.000000000 -0400
78365 +++ linux-2.6.39.1/net/rxrpc/ar-input.c 2011-05-22 19:36:35.000000000 -0400
78366 @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rx
78367 /* track the latest serial number on this connection for ACK packet
78368 * information */
78369 serial = ntohl(sp->hdr.serial);
78370 - hi_serial = atomic_read(&call->conn->hi_serial);
78371 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
78372 while (serial > hi_serial)
78373 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
78374 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
78375 serial);
78376
78377 /* request ACK generation for any ACK or DATA packet that requests
78378 diff -urNp linux-2.6.39.1/net/rxrpc/ar-internal.h linux-2.6.39.1/net/rxrpc/ar-internal.h
78379 --- linux-2.6.39.1/net/rxrpc/ar-internal.h 2011-05-19 00:06:34.000000000 -0400
78380 +++ linux-2.6.39.1/net/rxrpc/ar-internal.h 2011-05-22 19:36:35.000000000 -0400
78381 @@ -272,8 +272,8 @@ struct rxrpc_connection {
78382 int error; /* error code for local abort */
78383 int debug_id; /* debug ID for printks */
78384 unsigned call_counter; /* call ID counter */
78385 - atomic_t serial; /* packet serial number counter */
78386 - atomic_t hi_serial; /* highest serial number received */
78387 + atomic_unchecked_t serial; /* packet serial number counter */
78388 + atomic_unchecked_t hi_serial; /* highest serial number received */
78389 u8 avail_calls; /* number of calls available */
78390 u8 size_align; /* data size alignment (for security) */
78391 u8 header_size; /* rxrpc + security header size */
78392 @@ -346,7 +346,7 @@ struct rxrpc_call {
78393 spinlock_t lock;
78394 rwlock_t state_lock; /* lock for state transition */
78395 atomic_t usage;
78396 - atomic_t sequence; /* Tx data packet sequence counter */
78397 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
78398 u32 abort_code; /* local/remote abort code */
78399 enum { /* current state of call */
78400 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
78401 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(stru
78402 */
78403 extern atomic_t rxrpc_n_skbs;
78404 extern __be32 rxrpc_epoch;
78405 -extern atomic_t rxrpc_debug_id;
78406 +extern atomic_unchecked_t rxrpc_debug_id;
78407 extern struct workqueue_struct *rxrpc_workqueue;
78408
78409 /*
78410 diff -urNp linux-2.6.39.1/net/rxrpc/ar-local.c linux-2.6.39.1/net/rxrpc/ar-local.c
78411 --- linux-2.6.39.1/net/rxrpc/ar-local.c 2011-05-19 00:06:34.000000000 -0400
78412 +++ linux-2.6.39.1/net/rxrpc/ar-local.c 2011-05-22 19:36:35.000000000 -0400
78413 @@ -45,7 +45,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
78414 spin_lock_init(&local->lock);
78415 rwlock_init(&local->services_lock);
78416 atomic_set(&local->usage, 1);
78417 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
78418 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78419 memcpy(&local->srx, srx, sizeof(*srx));
78420 }
78421
78422 diff -urNp linux-2.6.39.1/net/rxrpc/ar-output.c linux-2.6.39.1/net/rxrpc/ar-output.c
78423 --- linux-2.6.39.1/net/rxrpc/ar-output.c 2011-05-19 00:06:34.000000000 -0400
78424 +++ linux-2.6.39.1/net/rxrpc/ar-output.c 2011-05-22 19:36:35.000000000 -0400
78425 @@ -681,9 +681,9 @@ static int rxrpc_send_data(struct kiocb
78426 sp->hdr.cid = call->cid;
78427 sp->hdr.callNumber = call->call_id;
78428 sp->hdr.seq =
78429 - htonl(atomic_inc_return(&call->sequence));
78430 + htonl(atomic_inc_return_unchecked(&call->sequence));
78431 sp->hdr.serial =
78432 - htonl(atomic_inc_return(&conn->serial));
78433 + htonl(atomic_inc_return_unchecked(&conn->serial));
78434 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
78435 sp->hdr.userStatus = 0;
78436 sp->hdr.securityIndex = conn->security_ix;
78437 diff -urNp linux-2.6.39.1/net/rxrpc/ar-peer.c linux-2.6.39.1/net/rxrpc/ar-peer.c
78438 --- linux-2.6.39.1/net/rxrpc/ar-peer.c 2011-05-19 00:06:34.000000000 -0400
78439 +++ linux-2.6.39.1/net/rxrpc/ar-peer.c 2011-05-22 19:36:35.000000000 -0400
78440 @@ -71,7 +71,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
78441 INIT_LIST_HEAD(&peer->error_targets);
78442 spin_lock_init(&peer->lock);
78443 atomic_set(&peer->usage, 1);
78444 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
78445 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78446 memcpy(&peer->srx, srx, sizeof(*srx));
78447
78448 rxrpc_assess_MTU_size(peer);
78449 diff -urNp linux-2.6.39.1/net/rxrpc/ar-proc.c linux-2.6.39.1/net/rxrpc/ar-proc.c
78450 --- linux-2.6.39.1/net/rxrpc/ar-proc.c 2011-05-19 00:06:34.000000000 -0400
78451 +++ linux-2.6.39.1/net/rxrpc/ar-proc.c 2011-05-22 19:36:35.000000000 -0400
78452 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
78453 atomic_read(&conn->usage),
78454 rxrpc_conn_states[conn->state],
78455 key_serial(conn->key),
78456 - atomic_read(&conn->serial),
78457 - atomic_read(&conn->hi_serial));
78458 + atomic_read_unchecked(&conn->serial),
78459 + atomic_read_unchecked(&conn->hi_serial));
78460
78461 return 0;
78462 }
78463 diff -urNp linux-2.6.39.1/net/rxrpc/ar-transport.c linux-2.6.39.1/net/rxrpc/ar-transport.c
78464 --- linux-2.6.39.1/net/rxrpc/ar-transport.c 2011-05-19 00:06:34.000000000 -0400
78465 +++ linux-2.6.39.1/net/rxrpc/ar-transport.c 2011-05-22 19:36:35.000000000 -0400
78466 @@ -47,7 +47,7 @@ static struct rxrpc_transport *rxrpc_all
78467 spin_lock_init(&trans->client_lock);
78468 rwlock_init(&trans->conn_lock);
78469 atomic_set(&trans->usage, 1);
78470 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
78471 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78472
78473 if (peer->srx.transport.family == AF_INET) {
78474 switch (peer->srx.transport_type) {
78475 diff -urNp linux-2.6.39.1/net/rxrpc/rxkad.c linux-2.6.39.1/net/rxrpc/rxkad.c
78476 --- linux-2.6.39.1/net/rxrpc/rxkad.c 2011-05-19 00:06:34.000000000 -0400
78477 +++ linux-2.6.39.1/net/rxrpc/rxkad.c 2011-05-22 19:36:35.000000000 -0400
78478 @@ -211,6 +211,8 @@ static int rxkad_secure_packet_encrypt(c
78479 u16 check;
78480 int nsg;
78481
78482 + pax_track_stack();
78483 +
78484 sp = rxrpc_skb(skb);
78485
78486 _enter("");
78487 @@ -338,6 +340,8 @@ static int rxkad_verify_packet_auth(cons
78488 u16 check;
78489 int nsg;
78490
78491 + pax_track_stack();
78492 +
78493 _enter("");
78494
78495 sp = rxrpc_skb(skb);
78496 @@ -610,7 +614,7 @@ static int rxkad_issue_challenge(struct
78497
78498 len = iov[0].iov_len + iov[1].iov_len;
78499
78500 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
78501 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78502 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
78503
78504 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
78505 @@ -660,7 +664,7 @@ static int rxkad_send_response(struct rx
78506
78507 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
78508
78509 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
78510 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78511 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
78512
78513 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
78514 diff -urNp linux-2.6.39.1/net/sched/em_meta.c linux-2.6.39.1/net/sched/em_meta.c
78515 --- linux-2.6.39.1/net/sched/em_meta.c 2011-05-19 00:06:34.000000000 -0400
78516 +++ linux-2.6.39.1/net/sched/em_meta.c 2011-05-22 19:36:35.000000000 -0400
78517 @@ -832,7 +832,7 @@ static int em_meta_dump(struct sk_buff *
78518 {
78519 struct meta_match *meta = (struct meta_match *) em->data;
78520 struct tcf_meta_hdr hdr;
78521 - struct meta_type_ops *ops;
78522 + const struct meta_type_ops *ops;
78523
78524 memset(&hdr, 0, sizeof(hdr));
78525 memcpy(&hdr.left, &meta->lvalue.hdr, sizeof(hdr.left));
78526 diff -urNp linux-2.6.39.1/net/sctp/proc.c linux-2.6.39.1/net/sctp/proc.c
78527 --- linux-2.6.39.1/net/sctp/proc.c 2011-05-19 00:06:34.000000000 -0400
78528 +++ linux-2.6.39.1/net/sctp/proc.c 2011-05-22 19:41:42.000000000 -0400
78529 @@ -212,7 +212,12 @@ static int sctp_eps_seq_show(struct seq_
78530 sctp_for_each_hentry(epb, node, &head->chain) {
78531 ep = sctp_ep(epb);
78532 sk = epb->sk;
78533 - seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
78534 + seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
78535 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78536 + NULL, NULL,
78537 +#else
78538 + ep, sk,
78539 +#endif
78540 sctp_sk(sk)->type, sk->sk_state, hash,
78541 epb->bind_addr.port,
78542 sock_i_uid(sk), sock_i_ino(sk));
78543 @@ -318,7 +323,12 @@ static int sctp_assocs_seq_show(struct s
78544 seq_printf(seq,
78545 "%8p %8p %-3d %-3d %-2d %-4d "
78546 "%4d %8d %8d %7d %5lu %-5d %5d ",
78547 - assoc, sk, sctp_sk(sk)->type, sk->sk_state,
78548 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78549 + NULL, NULL,
78550 +#else
78551 + assoc, sk,
78552 +#endif
78553 + sctp_sk(sk)->type, sk->sk_state,
78554 assoc->state, hash,
78555 assoc->assoc_id,
78556 assoc->sndbuf_used,
78557 diff -urNp linux-2.6.39.1/net/sctp/socket.c linux-2.6.39.1/net/sctp/socket.c
78558 --- linux-2.6.39.1/net/sctp/socket.c 2011-05-19 00:06:34.000000000 -0400
78559 +++ linux-2.6.39.1/net/sctp/socket.c 2011-05-22 19:36:35.000000000 -0400
78560 @@ -4433,7 +4433,7 @@ static int sctp_getsockopt_peer_addrs(st
78561 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
78562 if (space_left < addrlen)
78563 return -ENOMEM;
78564 - if (copy_to_user(to, &temp, addrlen))
78565 + if (addrlen > sizeof(temp) || copy_to_user(to, &temp, addrlen))
78566 return -EFAULT;
78567 to += addrlen;
78568 cnt++;
78569 diff -urNp linux-2.6.39.1/net/socket.c linux-2.6.39.1/net/socket.c
78570 --- linux-2.6.39.1/net/socket.c 2011-06-03 00:04:14.000000000 -0400
78571 +++ linux-2.6.39.1/net/socket.c 2011-06-03 00:32:08.000000000 -0400
78572 @@ -88,6 +88,7 @@
78573 #include <linux/nsproxy.h>
78574 #include <linux/magic.h>
78575 #include <linux/slab.h>
78576 +#include <linux/in.h>
78577
78578 #include <asm/uaccess.h>
78579 #include <asm/unistd.h>
78580 @@ -105,6 +106,8 @@
78581 #include <linux/sockios.h>
78582 #include <linux/atalk.h>
78583
78584 +#include <linux/grsock.h>
78585 +
78586 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
78587 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
78588 unsigned long nr_segs, loff_t pos);
78589 @@ -330,7 +333,7 @@ static struct dentry *sockfs_mount(struc
78590 &sockfs_dentry_operations, SOCKFS_MAGIC);
78591 }
78592
78593 -static struct vfsmount *sock_mnt __read_mostly;
78594 +struct vfsmount *sock_mnt __read_mostly;
78595
78596 static struct file_system_type sock_fs_type = {
78597 .name = "sockfs",
78598 @@ -1179,6 +1182,8 @@ int __sock_create(struct net *net, int f
78599 return -EAFNOSUPPORT;
78600 if (type < 0 || type >= SOCK_MAX)
78601 return -EINVAL;
78602 + if (protocol < 0)
78603 + return -EINVAL;
78604
78605 /* Compatibility.
78606
78607 @@ -1311,6 +1316,16 @@ SYSCALL_DEFINE3(socket, int, family, int
78608 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
78609 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
78610
78611 + if(!gr_search_socket(family, type, protocol)) {
78612 + retval = -EACCES;
78613 + goto out;
78614 + }
78615 +
78616 + if (gr_handle_sock_all(family, type, protocol)) {
78617 + retval = -EACCES;
78618 + goto out;
78619 + }
78620 +
78621 retval = sock_create(family, type, protocol, &sock);
78622 if (retval < 0)
78623 goto out;
78624 @@ -1423,6 +1438,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
78625 if (sock) {
78626 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
78627 if (err >= 0) {
78628 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
78629 + err = -EACCES;
78630 + goto error;
78631 + }
78632 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
78633 + if (err)
78634 + goto error;
78635 +
78636 err = security_socket_bind(sock,
78637 (struct sockaddr *)&address,
78638 addrlen);
78639 @@ -1431,6 +1454,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
78640 (struct sockaddr *)
78641 &address, addrlen);
78642 }
78643 +error:
78644 fput_light(sock->file, fput_needed);
78645 }
78646 return err;
78647 @@ -1454,10 +1478,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
78648 if ((unsigned)backlog > somaxconn)
78649 backlog = somaxconn;
78650
78651 + if (gr_handle_sock_server_other(sock->sk)) {
78652 + err = -EPERM;
78653 + goto error;
78654 + }
78655 +
78656 + err = gr_search_listen(sock);
78657 + if (err)
78658 + goto error;
78659 +
78660 err = security_socket_listen(sock, backlog);
78661 if (!err)
78662 err = sock->ops->listen(sock, backlog);
78663
78664 +error:
78665 fput_light(sock->file, fput_needed);
78666 }
78667 return err;
78668 @@ -1501,6 +1535,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
78669 newsock->type = sock->type;
78670 newsock->ops = sock->ops;
78671
78672 + if (gr_handle_sock_server_other(sock->sk)) {
78673 + err = -EPERM;
78674 + sock_release(newsock);
78675 + goto out_put;
78676 + }
78677 +
78678 + err = gr_search_accept(sock);
78679 + if (err) {
78680 + sock_release(newsock);
78681 + goto out_put;
78682 + }
78683 +
78684 /*
78685 * We don't need try_module_get here, as the listening socket (sock)
78686 * has the protocol module (sock->ops->owner) held.
78687 @@ -1539,6 +1585,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
78688 fd_install(newfd, newfile);
78689 err = newfd;
78690
78691 + gr_attach_curr_ip(newsock->sk);
78692 +
78693 out_put:
78694 fput_light(sock->file, fput_needed);
78695 out:
78696 @@ -1571,6 +1619,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
78697 int, addrlen)
78698 {
78699 struct socket *sock;
78700 + struct sockaddr *sck;
78701 struct sockaddr_storage address;
78702 int err, fput_needed;
78703
78704 @@ -1581,6 +1630,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
78705 if (err < 0)
78706 goto out_put;
78707
78708 + sck = (struct sockaddr *)&address;
78709 +
78710 + if (gr_handle_sock_client(sck)) {
78711 + err = -EACCES;
78712 + goto out_put;
78713 + }
78714 +
78715 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
78716 + if (err)
78717 + goto out_put;
78718 +
78719 err =
78720 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
78721 if (err)
78722 @@ -1882,6 +1942,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
78723 int err, ctl_len, iov_size, total_len;
78724 int fput_needed;
78725
78726 + pax_track_stack();
78727 +
78728 err = -EFAULT;
78729 if (MSG_CMSG_COMPAT & flags) {
78730 if (get_compat_msghdr(&msg_sys, msg_compat))
78731 diff -urNp linux-2.6.39.1/net/sunrpc/sched.c linux-2.6.39.1/net/sunrpc/sched.c
78732 --- linux-2.6.39.1/net/sunrpc/sched.c 2011-05-19 00:06:34.000000000 -0400
78733 +++ linux-2.6.39.1/net/sunrpc/sched.c 2011-05-22 19:36:35.000000000 -0400
78734 @@ -234,9 +234,9 @@ static int rpc_wait_bit_killable(void *w
78735 #ifdef RPC_DEBUG
78736 static void rpc_task_set_debuginfo(struct rpc_task *task)
78737 {
78738 - static atomic_t rpc_pid;
78739 + static atomic_unchecked_t rpc_pid;
78740
78741 - task->tk_pid = atomic_inc_return(&rpc_pid);
78742 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
78743 }
78744 #else
78745 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
78746 diff -urNp linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma.c
78747 --- linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma.c 2011-05-19 00:06:34.000000000 -0400
78748 +++ linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma.c 2011-05-22 19:36:35.000000000 -0400
78749 @@ -61,15 +61,15 @@ unsigned int svcrdma_max_req_size = RPCR
78750 static unsigned int min_max_inline = 4096;
78751 static unsigned int max_max_inline = 65536;
78752
78753 -atomic_t rdma_stat_recv;
78754 -atomic_t rdma_stat_read;
78755 -atomic_t rdma_stat_write;
78756 -atomic_t rdma_stat_sq_starve;
78757 -atomic_t rdma_stat_rq_starve;
78758 -atomic_t rdma_stat_rq_poll;
78759 -atomic_t rdma_stat_rq_prod;
78760 -atomic_t rdma_stat_sq_poll;
78761 -atomic_t rdma_stat_sq_prod;
78762 +atomic_unchecked_t rdma_stat_recv;
78763 +atomic_unchecked_t rdma_stat_read;
78764 +atomic_unchecked_t rdma_stat_write;
78765 +atomic_unchecked_t rdma_stat_sq_starve;
78766 +atomic_unchecked_t rdma_stat_rq_starve;
78767 +atomic_unchecked_t rdma_stat_rq_poll;
78768 +atomic_unchecked_t rdma_stat_rq_prod;
78769 +atomic_unchecked_t rdma_stat_sq_poll;
78770 +atomic_unchecked_t rdma_stat_sq_prod;
78771
78772 /* Temporary NFS request map and context caches */
78773 struct kmem_cache *svc_rdma_map_cachep;
78774 @@ -109,7 +109,7 @@ static int read_reset_stat(ctl_table *ta
78775 len -= *ppos;
78776 if (len > *lenp)
78777 len = *lenp;
78778 - if (len && copy_to_user(buffer, str_buf, len))
78779 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
78780 return -EFAULT;
78781 *lenp = len;
78782 *ppos += len;
78783 @@ -150,63 +150,63 @@ static ctl_table svcrdma_parm_table[] =
78784 {
78785 .procname = "rdma_stat_read",
78786 .data = &rdma_stat_read,
78787 - .maxlen = sizeof(atomic_t),
78788 + .maxlen = sizeof(atomic_unchecked_t),
78789 .mode = 0644,
78790 .proc_handler = read_reset_stat,
78791 },
78792 {
78793 .procname = "rdma_stat_recv",
78794 .data = &rdma_stat_recv,
78795 - .maxlen = sizeof(atomic_t),
78796 + .maxlen = sizeof(atomic_unchecked_t),
78797 .mode = 0644,
78798 .proc_handler = read_reset_stat,
78799 },
78800 {
78801 .procname = "rdma_stat_write",
78802 .data = &rdma_stat_write,
78803 - .maxlen = sizeof(atomic_t),
78804 + .maxlen = sizeof(atomic_unchecked_t),
78805 .mode = 0644,
78806 .proc_handler = read_reset_stat,
78807 },
78808 {
78809 .procname = "rdma_stat_sq_starve",
78810 .data = &rdma_stat_sq_starve,
78811 - .maxlen = sizeof(atomic_t),
78812 + .maxlen = sizeof(atomic_unchecked_t),
78813 .mode = 0644,
78814 .proc_handler = read_reset_stat,
78815 },
78816 {
78817 .procname = "rdma_stat_rq_starve",
78818 .data = &rdma_stat_rq_starve,
78819 - .maxlen = sizeof(atomic_t),
78820 + .maxlen = sizeof(atomic_unchecked_t),
78821 .mode = 0644,
78822 .proc_handler = read_reset_stat,
78823 },
78824 {
78825 .procname = "rdma_stat_rq_poll",
78826 .data = &rdma_stat_rq_poll,
78827 - .maxlen = sizeof(atomic_t),
78828 + .maxlen = sizeof(atomic_unchecked_t),
78829 .mode = 0644,
78830 .proc_handler = read_reset_stat,
78831 },
78832 {
78833 .procname = "rdma_stat_rq_prod",
78834 .data = &rdma_stat_rq_prod,
78835 - .maxlen = sizeof(atomic_t),
78836 + .maxlen = sizeof(atomic_unchecked_t),
78837 .mode = 0644,
78838 .proc_handler = read_reset_stat,
78839 },
78840 {
78841 .procname = "rdma_stat_sq_poll",
78842 .data = &rdma_stat_sq_poll,
78843 - .maxlen = sizeof(atomic_t),
78844 + .maxlen = sizeof(atomic_unchecked_t),
78845 .mode = 0644,
78846 .proc_handler = read_reset_stat,
78847 },
78848 {
78849 .procname = "rdma_stat_sq_prod",
78850 .data = &rdma_stat_sq_prod,
78851 - .maxlen = sizeof(atomic_t),
78852 + .maxlen = sizeof(atomic_unchecked_t),
78853 .mode = 0644,
78854 .proc_handler = read_reset_stat,
78855 },
78856 diff -urNp linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78857 --- linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-05-19 00:06:34.000000000 -0400
78858 +++ linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-05-22 19:36:35.000000000 -0400
78859 @@ -499,7 +499,7 @@ next_sge:
78860 svc_rdma_put_context(ctxt, 0);
78861 goto out;
78862 }
78863 - atomic_inc(&rdma_stat_read);
78864 + atomic_inc_unchecked(&rdma_stat_read);
78865
78866 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
78867 chl_map->ch[ch_no].count -= read_wr.num_sge;
78868 @@ -609,7 +609,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
78869 dto_q);
78870 list_del_init(&ctxt->dto_q);
78871 } else {
78872 - atomic_inc(&rdma_stat_rq_starve);
78873 + atomic_inc_unchecked(&rdma_stat_rq_starve);
78874 clear_bit(XPT_DATA, &xprt->xpt_flags);
78875 ctxt = NULL;
78876 }
78877 @@ -629,7 +629,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
78878 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
78879 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
78880 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
78881 - atomic_inc(&rdma_stat_recv);
78882 + atomic_inc_unchecked(&rdma_stat_recv);
78883
78884 /* Build up the XDR from the receive buffers. */
78885 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
78886 diff -urNp linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78887 --- linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-05-19 00:06:34.000000000 -0400
78888 +++ linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-05-22 19:36:35.000000000 -0400
78889 @@ -362,7 +362,7 @@ static int send_write(struct svcxprt_rdm
78890 write_wr.wr.rdma.remote_addr = to;
78891
78892 /* Post It */
78893 - atomic_inc(&rdma_stat_write);
78894 + atomic_inc_unchecked(&rdma_stat_write);
78895 if (svc_rdma_send(xprt, &write_wr))
78896 goto err;
78897 return 0;
78898 diff -urNp linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_transport.c
78899 --- linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-05-19 00:06:34.000000000 -0400
78900 +++ linux-2.6.39.1/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-05-22 19:36:35.000000000 -0400
78901 @@ -298,7 +298,7 @@ static void rq_cq_reap(struct svcxprt_rd
78902 return;
78903
78904 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
78905 - atomic_inc(&rdma_stat_rq_poll);
78906 + atomic_inc_unchecked(&rdma_stat_rq_poll);
78907
78908 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
78909 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
78910 @@ -320,7 +320,7 @@ static void rq_cq_reap(struct svcxprt_rd
78911 }
78912
78913 if (ctxt)
78914 - atomic_inc(&rdma_stat_rq_prod);
78915 + atomic_inc_unchecked(&rdma_stat_rq_prod);
78916
78917 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
78918 /*
78919 @@ -392,7 +392,7 @@ static void sq_cq_reap(struct svcxprt_rd
78920 return;
78921
78922 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
78923 - atomic_inc(&rdma_stat_sq_poll);
78924 + atomic_inc_unchecked(&rdma_stat_sq_poll);
78925 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
78926 if (wc.status != IB_WC_SUCCESS)
78927 /* Close the transport */
78928 @@ -410,7 +410,7 @@ static void sq_cq_reap(struct svcxprt_rd
78929 }
78930
78931 if (ctxt)
78932 - atomic_inc(&rdma_stat_sq_prod);
78933 + atomic_inc_unchecked(&rdma_stat_sq_prod);
78934 }
78935
78936 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
78937 @@ -1271,7 +1271,7 @@ int svc_rdma_send(struct svcxprt_rdma *x
78938 spin_lock_bh(&xprt->sc_lock);
78939 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
78940 spin_unlock_bh(&xprt->sc_lock);
78941 - atomic_inc(&rdma_stat_sq_starve);
78942 + atomic_inc_unchecked(&rdma_stat_sq_starve);
78943
78944 /* See if we can opportunistically reap SQ WR to make room */
78945 sq_cq_reap(xprt);
78946 diff -urNp linux-2.6.39.1/net/sysctl_net.c linux-2.6.39.1/net/sysctl_net.c
78947 --- linux-2.6.39.1/net/sysctl_net.c 2011-05-19 00:06:34.000000000 -0400
78948 +++ linux-2.6.39.1/net/sysctl_net.c 2011-05-22 19:41:42.000000000 -0400
78949 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
78950 struct ctl_table *table)
78951 {
78952 /* Allow network administrator to have same access as root. */
78953 - if (capable(CAP_NET_ADMIN)) {
78954 + if (capable_nolog(CAP_NET_ADMIN)) {
78955 int mode = (table->mode >> 6) & 7;
78956 return (mode << 6) | (mode << 3) | mode;
78957 }
78958 diff -urNp linux-2.6.39.1/net/unix/af_unix.c linux-2.6.39.1/net/unix/af_unix.c
78959 --- linux-2.6.39.1/net/unix/af_unix.c 2011-05-19 00:06:34.000000000 -0400
78960 +++ linux-2.6.39.1/net/unix/af_unix.c 2011-05-22 19:41:42.000000000 -0400
78961 @@ -767,6 +767,12 @@ static struct sock *unix_find_other(stru
78962 err = -ECONNREFUSED;
78963 if (!S_ISSOCK(inode->i_mode))
78964 goto put_fail;
78965 +
78966 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
78967 + err = -EACCES;
78968 + goto put_fail;
78969 + }
78970 +
78971 u = unix_find_socket_byinode(inode);
78972 if (!u)
78973 goto put_fail;
78974 @@ -787,6 +793,13 @@ static struct sock *unix_find_other(stru
78975 if (u) {
78976 struct dentry *dentry;
78977 dentry = unix_sk(u)->dentry;
78978 +
78979 + if (!gr_handle_chroot_unix(u->sk_peer_pid)) {
78980 + err = -EPERM;
78981 + sock_put(u);
78982 + goto fail;
78983 + }
78984 +
78985 if (dentry)
78986 touch_atime(unix_sk(u)->mnt, dentry);
78987 } else
78988 @@ -872,11 +885,18 @@ static int unix_bind(struct socket *sock
78989 err = security_path_mknod(&nd.path, dentry, mode, 0);
78990 if (err)
78991 goto out_mknod_drop_write;
78992 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
78993 + err = -EACCES;
78994 + goto out_mknod_drop_write;
78995 + }
78996 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
78997 out_mknod_drop_write:
78998 mnt_drop_write(nd.path.mnt);
78999 if (err)
79000 goto out_mknod_dput;
79001 +
79002 + gr_handle_create(dentry, nd.path.mnt);
79003 +
79004 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
79005 dput(nd.path.dentry);
79006 nd.path.dentry = dentry;
79007 @@ -894,6 +914,11 @@ out_mknod_drop_write:
79008 goto out_unlock;
79009 }
79010
79011 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
79012 + put_pid(sk->sk_peer_pid);
79013 + sk->sk_peer_pid = get_pid(task_tgid(current));
79014 +#endif
79015 +
79016 list = &unix_socket_table[addr->hash];
79017 } else {
79018 list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
79019 @@ -2255,7 +2280,11 @@ static int unix_seq_show(struct seq_file
79020 unix_state_lock(s);
79021
79022 seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
79023 +#ifdef CONFIG_GRKERNSEC_HIDESYM
79024 + NULL,
79025 +#else
79026 s,
79027 +#endif
79028 atomic_read(&s->sk_refcnt),
79029 0,
79030 s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
79031 diff -urNp linux-2.6.39.1/net/wireless/wext-core.c linux-2.6.39.1/net/wireless/wext-core.c
79032 --- linux-2.6.39.1/net/wireless/wext-core.c 2011-05-19 00:06:34.000000000 -0400
79033 +++ linux-2.6.39.1/net/wireless/wext-core.c 2011-05-22 19:36:35.000000000 -0400
79034 @@ -746,8 +746,7 @@ static int ioctl_standard_iw_point(struc
79035 */
79036
79037 /* Support for very large requests */
79038 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
79039 - (user_length > descr->max_tokens)) {
79040 + if (user_length > descr->max_tokens) {
79041 /* Allow userspace to GET more than max so
79042 * we can support any size GET requests.
79043 * There is still a limit : -ENOMEM.
79044 @@ -784,22 +783,6 @@ static int ioctl_standard_iw_point(struc
79045 }
79046 }
79047
79048 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
79049 - /*
79050 - * If this is a GET, but not NOMAX, it means that the extra
79051 - * data is not bounded by userspace, but by max_tokens. Thus
79052 - * set the length to max_tokens. This matches the extra data
79053 - * allocation.
79054 - * The driver should fill it with the number of tokens it
79055 - * provided, and it may check iwp->length rather than having
79056 - * knowledge of max_tokens. If the driver doesn't change the
79057 - * iwp->length, this ioctl just copies back max_token tokens
79058 - * filled with zeroes. Hopefully the driver isn't claiming
79059 - * them to be valid data.
79060 - */
79061 - iwp->length = descr->max_tokens;
79062 - }
79063 -
79064 err = handler(dev, info, (union iwreq_data *) iwp, extra);
79065
79066 iwp->length += essid_compat;
79067 diff -urNp linux-2.6.39.1/net/xfrm/xfrm_policy.c linux-2.6.39.1/net/xfrm/xfrm_policy.c
79068 --- linux-2.6.39.1/net/xfrm/xfrm_policy.c 2011-05-19 00:06:34.000000000 -0400
79069 +++ linux-2.6.39.1/net/xfrm/xfrm_policy.c 2011-05-22 19:36:35.000000000 -0400
79070 @@ -299,7 +299,7 @@ static void xfrm_policy_kill(struct xfrm
79071 {
79072 policy->walk.dead = 1;
79073
79074 - atomic_inc(&policy->genid);
79075 + atomic_inc_unchecked(&policy->genid);
79076
79077 if (del_timer(&policy->timer))
79078 xfrm_pol_put(policy);
79079 @@ -583,7 +583,7 @@ int xfrm_policy_insert(int dir, struct x
79080 hlist_add_head(&policy->bydst, chain);
79081 xfrm_pol_hold(policy);
79082 net->xfrm.policy_count[dir]++;
79083 - atomic_inc(&flow_cache_genid);
79084 + atomic_inc_unchecked(&flow_cache_genid);
79085 if (delpol)
79086 __xfrm_policy_unlink(delpol, dir);
79087 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
79088 @@ -1527,7 +1527,7 @@ free_dst:
79089 goto out;
79090 }
79091
79092 -static int inline
79093 +static inline int
79094 xfrm_dst_alloc_copy(void **target, const void *src, int size)
79095 {
79096 if (!*target) {
79097 @@ -1539,7 +1539,7 @@ xfrm_dst_alloc_copy(void **target, const
79098 return 0;
79099 }
79100
79101 -static int inline
79102 +static inline int
79103 xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
79104 {
79105 #ifdef CONFIG_XFRM_SUB_POLICY
79106 @@ -1551,7 +1551,7 @@ xfrm_dst_update_parent(struct dst_entry
79107 #endif
79108 }
79109
79110 -static int inline
79111 +static inline int
79112 xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl)
79113 {
79114 #ifdef CONFIG_XFRM_SUB_POLICY
79115 @@ -1645,7 +1645,7 @@ xfrm_resolve_and_create_bundle(struct xf
79116
79117 xdst->num_pols = num_pols;
79118 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols);
79119 - xdst->policy_genid = atomic_read(&pols[0]->genid);
79120 + xdst->policy_genid = atomic_read_unchecked(&pols[0]->genid);
79121
79122 return xdst;
79123 }
79124 @@ -2332,7 +2332,7 @@ static int xfrm_bundle_ok(struct xfrm_ds
79125 if (xdst->xfrm_genid != dst->xfrm->genid)
79126 return 0;
79127 if (xdst->num_pols > 0 &&
79128 - xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
79129 + xdst->policy_genid != atomic_read_unchecked(&xdst->pols[0]->genid))
79130 return 0;
79131
79132 mtu = dst_mtu(dst->child);
79133 @@ -2860,7 +2860,7 @@ static int xfrm_policy_migrate(struct xf
79134 sizeof(pol->xfrm_vec[i].saddr));
79135 pol->xfrm_vec[i].encap_family = mp->new_family;
79136 /* flush bundles */
79137 - atomic_inc(&pol->genid);
79138 + atomic_inc_unchecked(&pol->genid);
79139 }
79140 }
79141
79142 diff -urNp linux-2.6.39.1/net/xfrm/xfrm_user.c linux-2.6.39.1/net/xfrm/xfrm_user.c
79143 --- linux-2.6.39.1/net/xfrm/xfrm_user.c 2011-05-19 00:06:34.000000000 -0400
79144 +++ linux-2.6.39.1/net/xfrm/xfrm_user.c 2011-05-22 19:36:35.000000000 -0400
79145 @@ -1394,6 +1394,8 @@ static int copy_to_user_tmpl(struct xfrm
79146 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
79147 int i;
79148
79149 + pax_track_stack();
79150 +
79151 if (xp->xfrm_nr == 0)
79152 return 0;
79153
79154 @@ -2062,6 +2064,8 @@ static int xfrm_do_migrate(struct sk_buf
79155 int err;
79156 int n = 0;
79157
79158 + pax_track_stack();
79159 +
79160 if (attrs[XFRMA_MIGRATE] == NULL)
79161 return -EINVAL;
79162
79163 diff -urNp linux-2.6.39.1/scripts/basic/fixdep.c linux-2.6.39.1/scripts/basic/fixdep.c
79164 --- linux-2.6.39.1/scripts/basic/fixdep.c 2011-05-19 00:06:34.000000000 -0400
79165 +++ linux-2.6.39.1/scripts/basic/fixdep.c 2011-05-22 19:36:35.000000000 -0400
79166 @@ -235,9 +235,9 @@ static void use_config(const char *m, in
79167
79168 static void parse_config_file(const char *map, size_t len)
79169 {
79170 - const int *end = (const int *) (map + len);
79171 + const unsigned int *end = (const unsigned int *) (map + len);
79172 /* start at +1, so that p can never be < map */
79173 - const int *m = (const int *) map + 1;
79174 + const unsigned int *m = (const unsigned int *) map + 1;
79175 const char *p, *q;
79176
79177 for (; m < end; m++) {
79178 @@ -405,7 +405,7 @@ static void print_deps(void)
79179 static void traps(void)
79180 {
79181 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
79182 - int *p = (int *)test;
79183 + unsigned int *p = (unsigned int *)test;
79184
79185 if (*p != INT_CONF) {
79186 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
79187 diff -urNp linux-2.6.39.1/scripts/dtc/flattree.c linux-2.6.39.1/scripts/dtc/flattree.c
79188 --- linux-2.6.39.1/scripts/dtc/flattree.c 2011-05-19 00:06:34.000000000 -0400
79189 +++ linux-2.6.39.1/scripts/dtc/flattree.c 2011-05-22 19:36:35.000000000 -0400
79190 @@ -104,7 +104,7 @@ static void bin_emit_property(void *e, s
79191 bin_emit_cell(e, FDT_PROP);
79192 }
79193
79194 -static struct emitter bin_emitter = {
79195 +static const struct emitter bin_emitter = {
79196 .cell = bin_emit_cell,
79197 .string = bin_emit_string,
79198 .align = bin_emit_align,
79199 @@ -230,7 +230,7 @@ static void asm_emit_property(void *e, s
79200 asm_emit_cell(e, FDT_PROP);
79201 }
79202
79203 -static struct emitter asm_emitter = {
79204 +static const struct emitter asm_emitter = {
79205 .cell = asm_emit_cell,
79206 .string = asm_emit_string,
79207 .align = asm_emit_align,
79208 diff -urNp linux-2.6.39.1/scripts/Makefile.build linux-2.6.39.1/scripts/Makefile.build
79209 --- linux-2.6.39.1/scripts/Makefile.build 2011-05-19 00:06:34.000000000 -0400
79210 +++ linux-2.6.39.1/scripts/Makefile.build 2011-06-03 01:15:00.000000000 -0400
79211 @@ -93,7 +93,7 @@ endif
79212 endif
79213
79214 # Do not include host rules unless needed
79215 -ifneq ($(hostprogs-y)$(hostprogs-m),)
79216 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
79217 include scripts/Makefile.host
79218 endif
79219
79220 diff -urNp linux-2.6.39.1/scripts/Makefile.clean linux-2.6.39.1/scripts/Makefile.clean
79221 --- linux-2.6.39.1/scripts/Makefile.clean 2011-05-19 00:06:34.000000000 -0400
79222 +++ linux-2.6.39.1/scripts/Makefile.clean 2011-06-03 01:16:02.000000000 -0400
79223 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subd
79224 __clean-files := $(extra-y) $(always) \
79225 $(targets) $(clean-files) \
79226 $(host-progs) \
79227 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
79228 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
79229 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
79230
79231 __clean-files := $(filter-out $(no-clean-files), $(__clean-files))
79232
79233 diff -urNp linux-2.6.39.1/scripts/Makefile.host linux-2.6.39.1/scripts/Makefile.host
79234 --- linux-2.6.39.1/scripts/Makefile.host 2011-05-19 00:06:34.000000000 -0400
79235 +++ linux-2.6.39.1/scripts/Makefile.host 2011-06-03 01:17:12.000000000 -0400
79236 @@ -31,6 +31,7 @@
79237 # Note: Shared libraries consisting of C++ files are not supported
79238
79239 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
79240 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
79241
79242 # C code
79243 # Executables compiled from a single .c file
79244 @@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(hos
79245 # Shared libaries (only .c supported)
79246 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
79247 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
79248 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
79249 # Remove .so files from "xxx-objs"
79250 host-cobjs := $(filter-out %.so,$(host-cobjs))
79251
79252 diff -urNp linux-2.6.39.1/scripts/mod/file2alias.c linux-2.6.39.1/scripts/mod/file2alias.c
79253 --- linux-2.6.39.1/scripts/mod/file2alias.c 2011-05-19 00:06:34.000000000 -0400
79254 +++ linux-2.6.39.1/scripts/mod/file2alias.c 2011-05-22 19:36:35.000000000 -0400
79255 @@ -72,7 +72,7 @@ static void device_id_check(const char *
79256 unsigned long size, unsigned long id_size,
79257 void *symval)
79258 {
79259 - int i;
79260 + unsigned int i;
79261
79262 if (size % id_size || size < id_size) {
79263 if (cross_build != 0)
79264 @@ -102,7 +102,7 @@ static void device_id_check(const char *
79265 /* USB is special because the bcdDevice can be matched against a numeric range */
79266 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
79267 static void do_usb_entry(struct usb_device_id *id,
79268 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
79269 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
79270 unsigned char range_lo, unsigned char range_hi,
79271 unsigned char max, struct module *mod)
79272 {
79273 @@ -437,7 +437,7 @@ static void do_pnp_device_entry(void *sy
79274 for (i = 0; i < count; i++) {
79275 const char *id = (char *)devs[i].id;
79276 char acpi_id[sizeof(devs[0].id)];
79277 - int j;
79278 + unsigned int j;
79279
79280 buf_printf(&mod->dev_table_buf,
79281 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
79282 @@ -467,7 +467,7 @@ static void do_pnp_card_entries(void *sy
79283
79284 for (j = 0; j < PNP_MAX_DEVICES; j++) {
79285 const char *id = (char *)card->devs[j].id;
79286 - int i2, j2;
79287 + unsigned int i2, j2;
79288 int dup = 0;
79289
79290 if (!id[0])
79291 @@ -493,7 +493,7 @@ static void do_pnp_card_entries(void *sy
79292 /* add an individual alias for every device entry */
79293 if (!dup) {
79294 char acpi_id[sizeof(card->devs[0].id)];
79295 - int k;
79296 + unsigned int k;
79297
79298 buf_printf(&mod->dev_table_buf,
79299 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
79300 @@ -768,7 +768,7 @@ static void dmi_ascii_filter(char *d, co
79301 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
79302 char *alias)
79303 {
79304 - int i, j;
79305 + unsigned int i, j;
79306
79307 sprintf(alias, "dmi*");
79308
79309 diff -urNp linux-2.6.39.1/scripts/mod/modpost.c linux-2.6.39.1/scripts/mod/modpost.c
79310 --- linux-2.6.39.1/scripts/mod/modpost.c 2011-05-19 00:06:34.000000000 -0400
79311 +++ linux-2.6.39.1/scripts/mod/modpost.c 2011-05-22 19:36:35.000000000 -0400
79312 @@ -896,6 +896,7 @@ enum mismatch {
79313 ANY_INIT_TO_ANY_EXIT,
79314 ANY_EXIT_TO_ANY_INIT,
79315 EXPORT_TO_INIT_EXIT,
79316 + DATA_TO_TEXT
79317 };
79318
79319 struct sectioncheck {
79320 @@ -1004,6 +1005,12 @@ const struct sectioncheck sectioncheck[]
79321 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
79322 .mismatch = EXPORT_TO_INIT_EXIT,
79323 .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
79324 +},
79325 +/* Do not reference code from writable data */
79326 +{
79327 + .fromsec = { DATA_SECTIONS, NULL },
79328 + .tosec = { TEXT_SECTIONS, NULL },
79329 + .mismatch = DATA_TO_TEXT
79330 }
79331 };
79332
79333 @@ -1126,10 +1133,10 @@ static Elf_Sym *find_elf_symbol(struct e
79334 continue;
79335 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
79336 continue;
79337 - if (sym->st_value == addr)
79338 - return sym;
79339 /* Find a symbol nearby - addr are maybe negative */
79340 d = sym->st_value - addr;
79341 + if (d == 0)
79342 + return sym;
79343 if (d < 0)
79344 d = addr - sym->st_value;
79345 if (d < distance) {
79346 @@ -1408,6 +1415,14 @@ static void report_sec_mismatch(const ch
79347 tosym, prl_to, prl_to, tosym);
79348 free(prl_to);
79349 break;
79350 + case DATA_TO_TEXT:
79351 +/*
79352 + fprintf(stderr,
79353 + "The variable %s references\n"
79354 + "the %s %s%s%s\n",
79355 + fromsym, to, sec2annotation(tosec), tosym, to_p);
79356 +*/
79357 + break;
79358 }
79359 fprintf(stderr, "\n");
79360 }
79361 @@ -1731,7 +1746,7 @@ void __attribute__((format(printf, 2, 3)
79362 va_end(ap);
79363 }
79364
79365 -void buf_write(struct buffer *buf, const char *s, int len)
79366 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
79367 {
79368 if (buf->size - buf->pos < len) {
79369 buf->size += len + SZ;
79370 @@ -1943,7 +1958,7 @@ static void write_if_changed(struct buff
79371 if (fstat(fileno(file), &st) < 0)
79372 goto close_write;
79373
79374 - if (st.st_size != b->pos)
79375 + if (st.st_size != (off_t)b->pos)
79376 goto close_write;
79377
79378 tmp = NOFAIL(malloc(b->pos));
79379 diff -urNp linux-2.6.39.1/scripts/mod/modpost.h linux-2.6.39.1/scripts/mod/modpost.h
79380 --- linux-2.6.39.1/scripts/mod/modpost.h 2011-05-19 00:06:34.000000000 -0400
79381 +++ linux-2.6.39.1/scripts/mod/modpost.h 2011-05-22 19:36:35.000000000 -0400
79382 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
79383
79384 struct buffer {
79385 char *p;
79386 - int pos;
79387 - int size;
79388 + unsigned int pos;
79389 + unsigned int size;
79390 };
79391
79392 void __attribute__((format(printf, 2, 3)))
79393 buf_printf(struct buffer *buf, const char *fmt, ...);
79394
79395 void
79396 -buf_write(struct buffer *buf, const char *s, int len);
79397 +buf_write(struct buffer *buf, const char *s, unsigned int len);
79398
79399 struct module {
79400 struct module *next;
79401 diff -urNp linux-2.6.39.1/scripts/mod/sumversion.c linux-2.6.39.1/scripts/mod/sumversion.c
79402 --- linux-2.6.39.1/scripts/mod/sumversion.c 2011-05-19 00:06:34.000000000 -0400
79403 +++ linux-2.6.39.1/scripts/mod/sumversion.c 2011-05-22 19:36:35.000000000 -0400
79404 @@ -470,7 +470,7 @@ static void write_version(const char *fi
79405 goto out;
79406 }
79407
79408 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
79409 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
79410 warn("writing sum in %s failed: %s\n",
79411 filename, strerror(errno));
79412 goto out;
79413 diff -urNp linux-2.6.39.1/scripts/pnmtologo.c linux-2.6.39.1/scripts/pnmtologo.c
79414 --- linux-2.6.39.1/scripts/pnmtologo.c 2011-05-19 00:06:34.000000000 -0400
79415 +++ linux-2.6.39.1/scripts/pnmtologo.c 2011-05-22 19:36:35.000000000 -0400
79416 @@ -237,14 +237,14 @@ static void write_header(void)
79417 fprintf(out, " * Linux logo %s\n", logoname);
79418 fputs(" */\n\n", out);
79419 fputs("#include <linux/linux_logo.h>\n\n", out);
79420 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
79421 + fprintf(out, "static unsigned char %s_data[] = {\n",
79422 logoname);
79423 }
79424
79425 static void write_footer(void)
79426 {
79427 fputs("\n};\n\n", out);
79428 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
79429 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
79430 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
79431 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
79432 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
79433 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
79434 fputs("\n};\n\n", out);
79435
79436 /* write logo clut */
79437 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
79438 + fprintf(out, "static unsigned char %s_clut[] = {\n",
79439 logoname);
79440 write_hex_cnt = 0;
79441 for (i = 0; i < logo_clutsize; i++) {
79442 diff -urNp linux-2.6.39.1/security/apparmor/lsm.c linux-2.6.39.1/security/apparmor/lsm.c
79443 --- linux-2.6.39.1/security/apparmor/lsm.c 2011-06-03 00:04:14.000000000 -0400
79444 +++ linux-2.6.39.1/security/apparmor/lsm.c 2011-06-03 00:32:08.000000000 -0400
79445 @@ -621,7 +621,7 @@ static int apparmor_task_setrlimit(struc
79446 return error;
79447 }
79448
79449 -static struct security_operations apparmor_ops = {
79450 +static struct security_operations apparmor_ops __read_only = {
79451 .name = "apparmor",
79452
79453 .ptrace_access_check = apparmor_ptrace_access_check,
79454 @@ -672,7 +672,7 @@ static struct security_operations apparm
79455 static int param_set_aabool(const char *val, const struct kernel_param *kp);
79456 static int param_get_aabool(char *buffer, const struct kernel_param *kp);
79457 #define param_check_aabool(name, p) __param_check(name, p, int)
79458 -static struct kernel_param_ops param_ops_aabool = {
79459 +static const struct kernel_param_ops param_ops_aabool = {
79460 .set = param_set_aabool,
79461 .get = param_get_aabool
79462 };
79463 @@ -680,7 +680,7 @@ static struct kernel_param_ops param_ops
79464 static int param_set_aauint(const char *val, const struct kernel_param *kp);
79465 static int param_get_aauint(char *buffer, const struct kernel_param *kp);
79466 #define param_check_aauint(name, p) __param_check(name, p, int)
79467 -static struct kernel_param_ops param_ops_aauint = {
79468 +static const struct kernel_param_ops param_ops_aauint = {
79469 .set = param_set_aauint,
79470 .get = param_get_aauint
79471 };
79472 @@ -688,7 +688,7 @@ static struct kernel_param_ops param_ops
79473 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
79474 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
79475 #define param_check_aalockpolicy(name, p) __param_check(name, p, int)
79476 -static struct kernel_param_ops param_ops_aalockpolicy = {
79477 +static const struct kernel_param_ops param_ops_aalockpolicy = {
79478 .set = param_set_aalockpolicy,
79479 .get = param_get_aalockpolicy
79480 };
79481 diff -urNp linux-2.6.39.1/security/commoncap.c linux-2.6.39.1/security/commoncap.c
79482 --- linux-2.6.39.1/security/commoncap.c 2011-05-19 00:06:34.000000000 -0400
79483 +++ linux-2.6.39.1/security/commoncap.c 2011-05-22 20:28:59.000000000 -0400
79484 @@ -28,6 +28,7 @@
79485 #include <linux/prctl.h>
79486 #include <linux/securebits.h>
79487 #include <linux/user_namespace.h>
79488 +#include <net/sock.h>
79489
79490 /*
79491 * If a non-root user executes a setuid-root binary in
79492 @@ -58,7 +59,7 @@ int cap_netlink_send(struct sock *sk, st
79493
79494 int cap_netlink_recv(struct sk_buff *skb, int cap)
79495 {
79496 - if (!cap_raised(current_cap(), cap))
79497 + if (!cap_raised(current_cap(), cap) || !gr_is_capable(cap))
79498 return -EPERM;
79499 return 0;
79500 }
79501 @@ -580,6 +581,9 @@ int cap_bprm_secureexec(struct linux_bin
79502 {
79503 const struct cred *cred = current_cred();
79504
79505 + if (gr_acl_enable_at_secure())
79506 + return 1;
79507 +
79508 if (cred->uid != 0) {
79509 if (bprm->cap_effective)
79510 return 1;
79511 diff -urNp linux-2.6.39.1/security/integrity/ima/ima_api.c linux-2.6.39.1/security/integrity/ima/ima_api.c
79512 --- linux-2.6.39.1/security/integrity/ima/ima_api.c 2011-05-19 00:06:34.000000000 -0400
79513 +++ linux-2.6.39.1/security/integrity/ima/ima_api.c 2011-05-22 19:36:35.000000000 -0400
79514 @@ -75,7 +75,7 @@ void ima_add_violation(struct inode *ino
79515 int result;
79516
79517 /* can overflow, only indicator */
79518 - atomic_long_inc(&ima_htable.violations);
79519 + atomic_long_inc_unchecked(&ima_htable.violations);
79520
79521 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
79522 if (!entry) {
79523 diff -urNp linux-2.6.39.1/security/integrity/ima/ima_fs.c linux-2.6.39.1/security/integrity/ima/ima_fs.c
79524 --- linux-2.6.39.1/security/integrity/ima/ima_fs.c 2011-05-19 00:06:34.000000000 -0400
79525 +++ linux-2.6.39.1/security/integrity/ima/ima_fs.c 2011-05-22 19:36:35.000000000 -0400
79526 @@ -28,12 +28,12 @@
79527 static int valid_policy = 1;
79528 #define TMPBUFLEN 12
79529 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
79530 - loff_t *ppos, atomic_long_t *val)
79531 + loff_t *ppos, atomic_long_unchecked_t *val)
79532 {
79533 char tmpbuf[TMPBUFLEN];
79534 ssize_t len;
79535
79536 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
79537 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
79538 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
79539 }
79540
79541 diff -urNp linux-2.6.39.1/security/integrity/ima/ima.h linux-2.6.39.1/security/integrity/ima/ima.h
79542 --- linux-2.6.39.1/security/integrity/ima/ima.h 2011-05-19 00:06:34.000000000 -0400
79543 +++ linux-2.6.39.1/security/integrity/ima/ima.h 2011-05-22 19:36:35.000000000 -0400
79544 @@ -85,8 +85,8 @@ void ima_add_violation(struct inode *ino
79545 extern spinlock_t ima_queue_lock;
79546
79547 struct ima_h_table {
79548 - atomic_long_t len; /* number of stored measurements in the list */
79549 - atomic_long_t violations;
79550 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
79551 + atomic_long_unchecked_t violations;
79552 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
79553 };
79554 extern struct ima_h_table ima_htable;
79555 diff -urNp linux-2.6.39.1/security/integrity/ima/ima_queue.c linux-2.6.39.1/security/integrity/ima/ima_queue.c
79556 --- linux-2.6.39.1/security/integrity/ima/ima_queue.c 2011-05-19 00:06:34.000000000 -0400
79557 +++ linux-2.6.39.1/security/integrity/ima/ima_queue.c 2011-05-22 19:36:35.000000000 -0400
79558 @@ -79,7 +79,7 @@ static int ima_add_digest_entry(struct i
79559 INIT_LIST_HEAD(&qe->later);
79560 list_add_tail_rcu(&qe->later, &ima_measurements);
79561
79562 - atomic_long_inc(&ima_htable.len);
79563 + atomic_long_inc_unchecked(&ima_htable.len);
79564 key = ima_hash_key(entry->digest);
79565 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
79566 return 0;
79567 diff -urNp linux-2.6.39.1/security/Kconfig linux-2.6.39.1/security/Kconfig
79568 --- linux-2.6.39.1/security/Kconfig 2011-05-19 00:06:34.000000000 -0400
79569 +++ linux-2.6.39.1/security/Kconfig 2011-06-03 01:13:26.000000000 -0400
79570 @@ -4,6 +4,554 @@
79571
79572 menu "Security options"
79573
79574 +source grsecurity/Kconfig
79575 +
79576 +menu "PaX"
79577 +
79578 + config ARCH_TRACK_EXEC_LIMIT
79579 + bool
79580 +
79581 + config PAX_PER_CPU_PGD
79582 + bool
79583 +
79584 + config TASK_SIZE_MAX_SHIFT
79585 + int
79586 + depends on X86_64
79587 + default 47 if !PAX_PER_CPU_PGD
79588 + default 42 if PAX_PER_CPU_PGD
79589 +
79590 + config PAX_ENABLE_PAE
79591 + bool
79592 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
79593 +
79594 +config PAX
79595 + bool "Enable various PaX features"
79596 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
79597 + help
79598 + This allows you to enable various PaX features. PaX adds
79599 + intrusion prevention mechanisms to the kernel that reduce
79600 + the risks posed by exploitable memory corruption bugs.
79601 +
79602 +menu "PaX Control"
79603 + depends on PAX
79604 +
79605 +config PAX_SOFTMODE
79606 + bool 'Support soft mode'
79607 + select PAX_PT_PAX_FLAGS
79608 + help
79609 + Enabling this option will allow you to run PaX in soft mode, that
79610 + is, PaX features will not be enforced by default, only on executables
79611 + marked explicitly. You must also enable PT_PAX_FLAGS support as it
79612 + is the only way to mark executables for soft mode use.
79613 +
79614 + Soft mode can be activated by using the "pax_softmode=1" kernel command
79615 + line option on boot. Furthermore you can control various PaX features
79616 + at runtime via the entries in /proc/sys/kernel/pax.
79617 +
79618 +config PAX_EI_PAX
79619 + bool 'Use legacy ELF header marking'
79620 + help
79621 + Enabling this option will allow you to control PaX features on
79622 + a per executable basis via the 'chpax' utility available at
79623 + http://pax.grsecurity.net/. The control flags will be read from
79624 + an otherwise reserved part of the ELF header. This marking has
79625 + numerous drawbacks (no support for soft-mode, toolchain does not
79626 + know about the non-standard use of the ELF header) therefore it
79627 + has been deprecated in favour of PT_PAX_FLAGS support.
79628 +
79629 + Note that if you enable PT_PAX_FLAGS marking support as well,
79630 + the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
79631 +
79632 +config PAX_PT_PAX_FLAGS
79633 + bool 'Use ELF program header marking'
79634 + help
79635 + Enabling this option will allow you to control PaX features on
79636 + a per executable basis via the 'paxctl' utility available at
79637 + http://pax.grsecurity.net/. The control flags will be read from
79638 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
79639 + has the benefits of supporting both soft mode and being fully
79640 + integrated into the toolchain (the binutils patch is available
79641 + from http://pax.grsecurity.net).
79642 +
79643 + If your toolchain does not support PT_PAX_FLAGS markings,
79644 + you can create one in most cases with 'paxctl -C'.
79645 +
79646 + Note that if you enable the legacy EI_PAX marking support as well,
79647 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
79648 +
79649 +choice
79650 + prompt 'MAC system integration'
79651 + default PAX_HAVE_ACL_FLAGS
79652 + help
79653 + Mandatory Access Control systems have the option of controlling
79654 + PaX flags on a per executable basis, choose the method supported
79655 + by your particular system.
79656 +
79657 + - "none": if your MAC system does not interact with PaX,
79658 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
79659 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
79660 +
79661 + NOTE: this option is for developers/integrators only.
79662 +
79663 + config PAX_NO_ACL_FLAGS
79664 + bool 'none'
79665 +
79666 + config PAX_HAVE_ACL_FLAGS
79667 + bool 'direct'
79668 +
79669 + config PAX_HOOK_ACL_FLAGS
79670 + bool 'hook'
79671 +endchoice
79672 +
79673 +endmenu
79674 +
79675 +menu "Non-executable pages"
79676 + depends on PAX
79677 +
79678 +config PAX_NOEXEC
79679 + bool "Enforce non-executable pages"
79680 + depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
79681 + help
79682 + By design some architectures do not allow for protecting memory
79683 + pages against execution or even if they do, Linux does not make
79684 + use of this feature. In practice this means that if a page is
79685 + readable (such as the stack or heap) it is also executable.
79686 +
79687 + There is a well known exploit technique that makes use of this
79688 + fact and a common programming mistake where an attacker can
79689 + introduce code of his choice somewhere in the attacked program's
79690 + memory (typically the stack or the heap) and then execute it.
79691 +
79692 + If the attacked program was running with different (typically
79693 + higher) privileges than that of the attacker, then he can elevate
79694 + his own privilege level (e.g. get a root shell, write to files for
79695 + which he does not have write access to, etc).
79696 +
79697 + Enabling this option will let you choose from various features
79698 + that prevent the injection and execution of 'foreign' code in
79699 + a program.
79700 +
79701 + This will also break programs that rely on the old behaviour and
79702 + expect that dynamically allocated memory via the malloc() family
79703 + of functions is executable (which it is not). Notable examples
79704 + are the XFree86 4.x server, the java runtime and wine.
79705 +
79706 +config PAX_PAGEEXEC
79707 + bool "Paging based non-executable pages"
79708 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
79709 + select S390_SWITCH_AMODE if S390
79710 + select S390_EXEC_PROTECT if S390
79711 + select ARCH_TRACK_EXEC_LIMIT if X86_32
79712 + help
79713 + This implementation is based on the paging feature of the CPU.
79714 + On i386 without hardware non-executable bit support there is a
79715 + variable but usually low performance impact, however on Intel's
79716 + P4 core based CPUs it is very high so you should not enable this
79717 + for kernels meant to be used on such CPUs.
79718 +
79719 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
79720 + with hardware non-executable bit support there is no performance
79721 + impact, on ppc the impact is negligible.
79722 +
79723 + Note that several architectures require various emulations due to
79724 + badly designed userland ABIs, this will cause a performance impact
79725 + but will disappear as soon as userland is fixed. For example, ppc
79726 + userland MUST have been built with secure-plt by a recent toolchain.
79727 +
79728 +config PAX_SEGMEXEC
79729 + bool "Segmentation based non-executable pages"
79730 + depends on PAX_NOEXEC && X86_32
79731 + help
79732 + This implementation is based on the segmentation feature of the
79733 + CPU and has a very small performance impact, however applications
79734 + will be limited to a 1.5 GB address space instead of the normal
79735 + 3 GB.
79736 +
79737 +config PAX_EMUTRAMP
79738 + bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
79739 + default y if PARISC
79740 + help
79741 + There are some programs and libraries that for one reason or
79742 + another attempt to execute special small code snippets from
79743 + non-executable memory pages. Most notable examples are the
79744 + signal handler return code generated by the kernel itself and
79745 + the GCC trampolines.
79746 +
79747 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
79748 + such programs will no longer work under your kernel.
79749 +
79750 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
79751 + utilities to enable trampoline emulation for the affected programs
79752 + yet still have the protection provided by the non-executable pages.
79753 +
79754 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
79755 + your system will not even boot.
79756 +
79757 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
79758 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
79759 + for the affected files.
79760 +
79761 + NOTE: enabling this feature *may* open up a loophole in the
79762 + protection provided by non-executable pages that an attacker
79763 + could abuse. Therefore the best solution is to not have any
79764 + files on your system that would require this option. This can
79765 + be achieved by not using libc5 (which relies on the kernel
79766 + signal handler return code) and not using or rewriting programs
79767 + that make use of the nested function implementation of GCC.
79768 + Skilled users can just fix GCC itself so that it implements
79769 + nested function calls in a way that does not interfere with PaX.
79770 +
79771 +config PAX_EMUSIGRT
79772 + bool "Automatically emulate sigreturn trampolines"
79773 + depends on PAX_EMUTRAMP && PARISC
79774 + default y
79775 + help
79776 + Enabling this option will have the kernel automatically detect
79777 + and emulate signal return trampolines executing on the stack
79778 + that would otherwise lead to task termination.
79779 +
79780 + This solution is intended as a temporary one for users with
79781 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
79782 + Modula-3 runtime, etc) or executables linked to such, basically
79783 + everything that does not specify its own SA_RESTORER function in
79784 + normal executable memory like glibc 2.1+ does.
79785 +
79786 + On parisc you MUST enable this option, otherwise your system will
79787 + not even boot.
79788 +
79789 + NOTE: this feature cannot be disabled on a per executable basis
79790 + and since it *does* open up a loophole in the protection provided
79791 + by non-executable pages, the best solution is to not have any
79792 + files on your system that would require this option.
79793 +
79794 +config PAX_MPROTECT
79795 + bool "Restrict mprotect()"
79796 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
79797 + help
79798 + Enabling this option will prevent programs from
79799 + - changing the executable status of memory pages that were
79800 + not originally created as executable,
79801 + - making read-only executable pages writable again,
79802 + - creating executable pages from anonymous memory,
79803 + - making read-only-after-relocations (RELRO) data pages writable again.
79804 +
79805 + You should say Y here to complete the protection provided by
79806 + the enforcement of non-executable pages.
79807 +
79808 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
79809 + this feature on a per file basis.
79810 +
79811 +config PAX_MPROTECT_COMPAT
79812 + bool "Use legacy/compat protection demoting (read help)"
79813 + depends on PAX_MPROTECT
79814 + default n
79815 + help
79816 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
79817 + by sending the proper error code to the application. For some broken
79818 + userland, this can cause problems with Python or other applications. The
79819 + current implementation however allows for applications like clamav to
79820 + detect if JIT compilation/execution is allowed and to fall back gracefully
79821 + to an interpreter-based mode if it does not. While we encourage everyone
79822 + to use the current implementation as-is and push upstream to fix broken
79823 + userland (note that the RWX logging option can assist with this), in some
79824 + environments this may not be possible. Having to disable MPROTECT
79825 + completely on certain binaries reduces the security benefit of PaX,
79826 + so this option is provided for those environments to revert to the old
79827 + behavior.
79828 +
79829 +config PAX_ELFRELOCS
79830 + bool "Allow ELF text relocations (read help)"
79831 + depends on PAX_MPROTECT
79832 + default n
79833 + help
79834 + Non-executable pages and mprotect() restrictions are effective
79835 + in preventing the introduction of new executable code into an
79836 + attacked task's address space. There remain only two venues
79837 + for this kind of attack: if the attacker can execute already
79838 + existing code in the attacked task then he can either have it
79839 + create and mmap() a file containing his code or have it mmap()
79840 + an already existing ELF library that does not have position
79841 + independent code in it and use mprotect() on it to make it
79842 + writable and copy his code there. While protecting against
79843 + the former approach is beyond PaX, the latter can be prevented
79844 + by having only PIC ELF libraries on one's system (which do not
79845 + need to relocate their code). If you are sure this is your case,
79846 + as is the case with all modern Linux distributions, then leave
79847 + this option disabled. You should say 'n' here.
79848 +
79849 +config PAX_ETEXECRELOCS
79850 + bool "Allow ELF ET_EXEC text relocations"
79851 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
79852 + select PAX_ELFRELOCS
79853 + default y
79854 + help
79855 + On some architectures there are incorrectly created applications
79856 + that require text relocations and would not work without enabling
79857 + this option. If you are an alpha, ia64 or parisc user, you should
79858 + enable this option and disable it once you have made sure that
79859 + none of your applications need it.
79860 +
79861 +config PAX_EMUPLT
79862 + bool "Automatically emulate ELF PLT"
79863 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
79864 + default y
79865 + help
79866 + Enabling this option will have the kernel automatically detect
79867 + and emulate the Procedure Linkage Table entries in ELF files.
79868 + On some architectures such entries are in writable memory, and
79869 + become non-executable leading to task termination. Therefore
79870 + it is mandatory that you enable this option on alpha, parisc,
79871 + sparc and sparc64, otherwise your system would not even boot.
79872 +
79873 + NOTE: this feature *does* open up a loophole in the protection
79874 + provided by the non-executable pages, therefore the proper
79875 + solution is to modify the toolchain to produce a PLT that does
79876 + not need to be writable.
79877 +
79878 +config PAX_DLRESOLVE
79879 + bool 'Emulate old glibc resolver stub'
79880 + depends on PAX_EMUPLT && SPARC
79881 + default n
79882 + help
79883 + This option is needed if userland has an old glibc (before 2.4)
79884 + that puts a 'save' instruction into the runtime generated resolver
79885 + stub that needs special emulation.
79886 +
79887 +config PAX_KERNEXEC
79888 + bool "Enforce non-executable kernel pages"
79889 + depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
79890 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
79891 + help
79892 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
79893 + that is, enabling this option will make it harder to inject
79894 + and execute 'foreign' code in kernel memory itself.
79895 +
79896 + Note that on x86_64 kernels there is a known regression when
79897 + this feature and KVM/VMX are both enabled in the host kernel.
79898 +
79899 +config PAX_KERNEXEC_MODULE_TEXT
79900 + int "Minimum amount of memory reserved for module code"
79901 + default "4"
79902 + depends on PAX_KERNEXEC && X86_32 && MODULES
79903 + help
79904 + Due to implementation details the kernel must reserve a fixed
79905 + amount of memory for module code at compile time that cannot be
79906 + changed at runtime. Here you can specify the minimum amount
79907 + in MB that will be reserved. Due to the same implementation
79908 + details this size will always be rounded up to the next 2/4 MB
79909 + boundary (depends on PAE) so the actually available memory for
79910 + module code will usually be more than this minimum.
79911 +
79912 + The default 4 MB should be enough for most users but if you have
79913 + an excessive number of modules (e.g., most distribution configs
79914 + compile many drivers as modules) or use huge modules such as
79915 + nvidia's kernel driver, you will need to adjust this amount.
79916 + A good rule of thumb is to look at your currently loaded kernel
79917 + modules and add up their sizes.
79918 +
79919 +endmenu
79920 +
79921 +menu "Address Space Layout Randomization"
79922 + depends on PAX
79923 +
79924 +config PAX_ASLR
79925 + bool "Address Space Layout Randomization"
79926 + depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
79927 + help
79928 + Many if not most exploit techniques rely on the knowledge of
79929 + certain addresses in the attacked program. The following options
79930 + will allow the kernel to apply a certain amount of randomization
79931 + to specific parts of the program thereby forcing an attacker to
79932 + guess them in most cases. Any failed guess will most likely crash
79933 + the attacked program which allows the kernel to detect such attempts
79934 + and react on them. PaX itself provides no reaction mechanisms,
79935 + instead it is strongly encouraged that you make use of Nergal's
79936 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
79937 + (http://www.grsecurity.net/) built-in crash detection features or
79938 + develop one yourself.
79939 +
79940 + By saying Y here you can choose to randomize the following areas:
79941 + - top of the task's kernel stack
79942 + - top of the task's userland stack
79943 + - base address for mmap() requests that do not specify one
79944 + (this includes all libraries)
79945 + - base address of the main executable
79946 +
79947 + It is strongly recommended to say Y here as address space layout
79948 + randomization has negligible impact on performance yet it provides
79949 + a very effective protection.
79950 +
79951 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
79952 + this feature on a per file basis.
79953 +
79954 +config PAX_RANDKSTACK
79955 + bool "Randomize kernel stack base"
79956 + depends on PAX_ASLR && X86_TSC && X86
79957 + help
79958 + By saying Y here the kernel will randomize every task's kernel
79959 + stack on every system call. This will not only force an attacker
79960 + to guess it but also prevent him from making use of possible
79961 + leaked information about it.
79962 +
79963 + Since the kernel stack is a rather scarce resource, randomization
79964 + may cause unexpected stack overflows, therefore you should very
79965 + carefully test your system. Note that once enabled in the kernel
79966 + configuration, this feature cannot be disabled on a per file basis.
79967 +
79968 +config PAX_RANDUSTACK
79969 + bool "Randomize user stack base"
79970 + depends on PAX_ASLR
79971 + help
79972 + By saying Y here the kernel will randomize every task's userland
79973 + stack. The randomization is done in two steps where the second
79974 + one may apply a big amount of shift to the top of the stack and
79975 + cause problems for programs that want to use lots of memory (more
79976 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
79977 + For this reason the second step can be controlled by 'chpax' or
79978 + 'paxctl' on a per file basis.
79979 +
79980 +config PAX_RANDMMAP
79981 + bool "Randomize mmap() base"
79982 + depends on PAX_ASLR
79983 + help
79984 + By saying Y here the kernel will use a randomized base address for
79985 + mmap() requests that do not specify one themselves. As a result
79986 + all dynamically loaded libraries will appear at random addresses
79987 + and therefore be harder to exploit by a technique where an attacker
79988 + attempts to execute library code for his purposes (e.g. spawn a
79989 + shell from an exploited program that is running at an elevated
79990 + privilege level).
79991 +
79992 + Furthermore, if a program is relinked as a dynamic ELF file, its
79993 + base address will be randomized as well, completing the full
79994 + randomization of the address space layout. Attacking such programs
79995 + becomes a guess game. You can find an example of doing this at
79996 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
79997 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
79998 +
79999 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
80000 + feature on a per file basis.
80001 +
80002 +endmenu
80003 +
80004 +menu "Miscellaneous hardening features"
80005 +
80006 +config PAX_MEMORY_SANITIZE
80007 + bool "Sanitize all freed memory"
80008 + help
80009 + By saying Y here the kernel will erase memory pages as soon as they
80010 + are freed. This in turn reduces the lifetime of data stored in the
80011 + pages, making it less likely that sensitive information such as
80012 + passwords, cryptographic secrets, etc stay in memory for too long.
80013 +
80014 + This is especially useful for programs whose runtime is short, long
80015 + lived processes and the kernel itself benefit from this as long as
80016 + they operate on whole memory pages and ensure timely freeing of pages
80017 + that may hold sensitive information.
80018 +
80019 + The tradeoff is performance impact, on a single CPU system kernel
80020 + compilation sees a 3% slowdown, other systems and workloads may vary
80021 + and you are advised to test this feature on your expected workload
80022 + before deploying it.
80023 +
80024 + Note that this feature does not protect data stored in live pages,
80025 + e.g., process memory swapped to disk may stay there for a long time.
80026 +
80027 +config PAX_MEMORY_STACKLEAK
80028 + bool "Sanitize kernel stack"
80029 + depends on X86
80030 + help
80031 + By saying Y here the kernel will erase the kernel stack before it
80032 + returns from a system call. This in turn reduces the information
80033 + that a kernel stack leak bug can reveal.
80034 +
80035 + Note that such a bug can still leak information that was put on
80036 + the stack by the current system call (the one eventually triggering
80037 + the bug) but traces of earlier system calls on the kernel stack
80038 + cannot leak anymore.
80039 +
80040 + The tradeoff is performance impact: on a single CPU system kernel
80041 + compilation sees a 1% slowdown, other systems and workloads may vary
80042 + and you are advised to test this feature on your expected workload
80043 + before deploying it.
80044 +
80045 + Note: full support for this feature requires gcc with plugin support
80046 + so make sure your compiler is at least gcc 4.5.0 (cross compilation
80047 + is not supported). Using older gcc versions means that functions
80048 + with large enough stack frames may leave uninitialized memory behind
80049 + that may be exposed to a later syscall leaking the stack.
80050 +
80051 +config PAX_MEMORY_UDEREF
80052 + bool "Prevent invalid userland pointer dereference"
80053 + depends on X86 && !UML_X86 && !XEN
80054 + select PAX_PER_CPU_PGD if X86_64
80055 + help
80056 + By saying Y here the kernel will be prevented from dereferencing
80057 + userland pointers in contexts where the kernel expects only kernel
80058 + pointers. This is both a useful runtime debugging feature and a
80059 + security measure that prevents exploiting a class of kernel bugs.
80060 +
80061 + The tradeoff is that some virtualization solutions may experience
80062 + a huge slowdown and therefore you should not enable this feature
80063 + for kernels meant to run in such environments. Whether a given VM
80064 + solution is affected or not is best determined by simply trying it
80065 + out, the performance impact will be obvious right on boot as this
80066 + mechanism engages from very early on. A good rule of thumb is that
80067 + VMs running on CPUs without hardware virtualization support (i.e.,
80068 + the majority of IA-32 CPUs) will likely experience the slowdown.
80069 +
80070 +config PAX_REFCOUNT
80071 + bool "Prevent various kernel object reference counter overflows"
80072 + depends on GRKERNSEC && (X86 || SPARC64)
80073 + help
80074 + By saying Y here the kernel will detect and prevent overflowing
80075 + various (but not all) kinds of object reference counters. Such
80076 + overflows can normally occur due to bugs only and are often, if
80077 + not always, exploitable.
80078 +
80079 + The tradeoff is that data structures protected by an overflowed
80080 + refcount will never be freed and therefore will leak memory. Note
80081 + that this leak also happens even without this protection but in
80082 + that case the overflow can eventually trigger the freeing of the
80083 + data structure while it is still being used elsewhere, resulting
80084 + in the exploitable situation that this feature prevents.
80085 +
80086 + Since this has a negligible performance impact, you should enable
80087 + this feature.
80088 +
80089 +config PAX_USERCOPY
80090 + bool "Harden heap object copies between kernel and userland"
80091 + depends on X86 || PPC || SPARC
80092 + depends on GRKERNSEC && (SLAB || SLUB)
80093 + help
80094 + By saying Y here the kernel will enforce the size of heap objects
80095 + when they are copied in either direction between the kernel and
80096 + userland, even if only a part of the heap object is copied.
80097 +
80098 + Specifically, this checking prevents information leaking from the
80099 + kernel heap during kernel to userland copies (if the kernel heap
80100 + object is otherwise fully initialized) and prevents kernel heap
80101 + overflows during userland to kernel copies.
80102 +
80103 + Note that the current implementation provides the strictest bounds
80104 + checks for the SLUB allocator.
80105 +
80106 + Enabling this option also enables per-slab cache protection against
80107 + data in a given cache being copied into/out of via userland
80108 + accessors. Though the whitelist of regions will be reduced over
80109 + time, it notably protects important data structures like task structs.
80110 +
80111 + If frame pointers are enabled on x86, this option will also restrict
80112 + copies into and out of the kernel stack to local variables within a
80113 + single frame.
80114 +
80115 + Since this has a negligible performance impact, you should enable
80116 + this feature.
80117 +
80118 +endmenu
80119 +
80120 +endmenu
80121 +
80122 config KEYS
80123 bool "Enable access key retention support"
80124 help
80125 @@ -167,7 +715,7 @@ config INTEL_TXT
80126 config LSM_MMAP_MIN_ADDR
80127 int "Low address space for LSM to protect from user allocation"
80128 depends on SECURITY && SECURITY_SELINUX
80129 - default 65536
80130 + default 32768
80131 help
80132 This is the portion of low virtual memory which should be protected
80133 from userspace allocation. Keeping a user from writing to low pages
80134 diff -urNp linux-2.6.39.1/security/keys/keyring.c linux-2.6.39.1/security/keys/keyring.c
80135 --- linux-2.6.39.1/security/keys/keyring.c 2011-05-19 00:06:34.000000000 -0400
80136 +++ linux-2.6.39.1/security/keys/keyring.c 2011-05-22 19:36:35.000000000 -0400
80137 @@ -213,15 +213,15 @@ static long keyring_read(const struct ke
80138 ret = -EFAULT;
80139
80140 for (loop = 0; loop < klist->nkeys; loop++) {
80141 + key_serial_t serial;
80142 key = klist->keys[loop];
80143 + serial = key->serial;
80144
80145 tmp = sizeof(key_serial_t);
80146 if (tmp > buflen)
80147 tmp = buflen;
80148
80149 - if (copy_to_user(buffer,
80150 - &key->serial,
80151 - tmp) != 0)
80152 + if (copy_to_user(buffer, &serial, tmp))
80153 goto error;
80154
80155 buflen -= tmp;
80156 diff -urNp linux-2.6.39.1/security/min_addr.c linux-2.6.39.1/security/min_addr.c
80157 --- linux-2.6.39.1/security/min_addr.c 2011-05-19 00:06:34.000000000 -0400
80158 +++ linux-2.6.39.1/security/min_addr.c 2011-05-22 19:41:42.000000000 -0400
80159 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
80160 */
80161 static void update_mmap_min_addr(void)
80162 {
80163 +#ifndef SPARC
80164 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
80165 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
80166 mmap_min_addr = dac_mmap_min_addr;
80167 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
80168 #else
80169 mmap_min_addr = dac_mmap_min_addr;
80170 #endif
80171 +#endif
80172 }
80173
80174 /*
80175 diff -urNp linux-2.6.39.1/security/security.c linux-2.6.39.1/security/security.c
80176 --- linux-2.6.39.1/security/security.c 2011-05-19 00:06:34.000000000 -0400
80177 +++ linux-2.6.39.1/security/security.c 2011-05-22 19:41:42.000000000 -0400
80178 @@ -25,8 +25,8 @@ static __initdata char chosen_lsm[SECURI
80179 /* things that live in capability.c */
80180 extern void __init security_fixup_ops(struct security_operations *ops);
80181
80182 -static struct security_operations *security_ops;
80183 -static struct security_operations default_security_ops = {
80184 +static struct security_operations *security_ops __read_only;
80185 +static struct security_operations default_security_ops __read_only = {
80186 .name = "default",
80187 };
80188
80189 @@ -67,7 +67,9 @@ int __init security_init(void)
80190
80191 void reset_security_ops(void)
80192 {
80193 + pax_open_kernel();
80194 security_ops = &default_security_ops;
80195 + pax_close_kernel();
80196 }
80197
80198 /* Save user chosen LSM */
80199 diff -urNp linux-2.6.39.1/security/selinux/hooks.c linux-2.6.39.1/security/selinux/hooks.c
80200 --- linux-2.6.39.1/security/selinux/hooks.c 2011-05-19 00:06:34.000000000 -0400
80201 +++ linux-2.6.39.1/security/selinux/hooks.c 2011-05-22 19:41:42.000000000 -0400
80202 @@ -93,7 +93,6 @@
80203 #define NUM_SEL_MNT_OPTS 5
80204
80205 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
80206 -extern struct security_operations *security_ops;
80207
80208 /* SECMARK reference count */
80209 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
80210 @@ -5431,7 +5430,7 @@ static int selinux_key_getsecurity(struc
80211
80212 #endif
80213
80214 -static struct security_operations selinux_ops = {
80215 +static struct security_operations selinux_ops __read_only = {
80216 .name = "selinux",
80217
80218 .ptrace_access_check = selinux_ptrace_access_check,
80219 diff -urNp linux-2.6.39.1/security/selinux/include/xfrm.h linux-2.6.39.1/security/selinux/include/xfrm.h
80220 --- linux-2.6.39.1/security/selinux/include/xfrm.h 2011-05-19 00:06:34.000000000 -0400
80221 +++ linux-2.6.39.1/security/selinux/include/xfrm.h 2011-05-22 19:36:35.000000000 -0400
80222 @@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
80223
80224 static inline void selinux_xfrm_notify_policyload(void)
80225 {
80226 - atomic_inc(&flow_cache_genid);
80227 + atomic_inc_unchecked(&flow_cache_genid);
80228 }
80229 #else
80230 static inline int selinux_xfrm_enabled(void)
80231 diff -urNp linux-2.6.39.1/security/selinux/ss/services.c linux-2.6.39.1/security/selinux/ss/services.c
80232 --- linux-2.6.39.1/security/selinux/ss/services.c 2011-05-19 00:06:34.000000000 -0400
80233 +++ linux-2.6.39.1/security/selinux/ss/services.c 2011-05-22 19:36:35.000000000 -0400
80234 @@ -1806,6 +1806,8 @@ int security_load_policy(void *data, siz
80235 int rc = 0;
80236 struct policy_file file = { data, len }, *fp = &file;
80237
80238 + pax_track_stack();
80239 +
80240 if (!ss_initialized) {
80241 avtab_cache_init();
80242 rc = policydb_read(&policydb, fp);
80243 diff -urNp linux-2.6.39.1/security/smack/smack_lsm.c linux-2.6.39.1/security/smack/smack_lsm.c
80244 --- linux-2.6.39.1/security/smack/smack_lsm.c 2011-05-19 00:06:34.000000000 -0400
80245 +++ linux-2.6.39.1/security/smack/smack_lsm.c 2011-05-22 19:36:35.000000000 -0400
80246 @@ -3386,7 +3386,7 @@ static int smack_inode_getsecctx(struct
80247 return 0;
80248 }
80249
80250 -struct security_operations smack_ops = {
80251 +struct security_operations smack_ops __read_only = {
80252 .name = "smack",
80253
80254 .ptrace_access_check = smack_ptrace_access_check,
80255 diff -urNp linux-2.6.39.1/security/tomoyo/mount.c linux-2.6.39.1/security/tomoyo/mount.c
80256 --- linux-2.6.39.1/security/tomoyo/mount.c 2011-05-19 00:06:34.000000000 -0400
80257 +++ linux-2.6.39.1/security/tomoyo/mount.c 2011-06-20 19:40:22.000000000 -0400
80258 @@ -138,7 +138,7 @@ static int tomoyo_mount_acl(struct tomoy
80259 }
80260 if (need_dev) {
80261 /* Get mount point or device file. */
80262 - if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
80263 + if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
80264 error = -ENOENT;
80265 goto out;
80266 }
80267 diff -urNp linux-2.6.39.1/security/tomoyo/tomoyo.c linux-2.6.39.1/security/tomoyo/tomoyo.c
80268 --- linux-2.6.39.1/security/tomoyo/tomoyo.c 2011-05-19 00:06:34.000000000 -0400
80269 +++ linux-2.6.39.1/security/tomoyo/tomoyo.c 2011-05-22 19:36:35.000000000 -0400
80270 @@ -240,7 +240,7 @@ static int tomoyo_sb_pivotroot(struct pa
80271 * tomoyo_security_ops is a "struct security_operations" which is used for
80272 * registering TOMOYO.
80273 */
80274 -static struct security_operations tomoyo_security_ops = {
80275 +static struct security_operations tomoyo_security_ops __read_only = {
80276 .name = "tomoyo",
80277 .cred_alloc_blank = tomoyo_cred_alloc_blank,
80278 .cred_prepare = tomoyo_cred_prepare,
80279 diff -urNp linux-2.6.39.1/sound/aoa/aoa.h linux-2.6.39.1/sound/aoa/aoa.h
80280 --- linux-2.6.39.1/sound/aoa/aoa.h 2011-05-19 00:06:34.000000000 -0400
80281 +++ linux-2.6.39.1/sound/aoa/aoa.h 2011-05-22 19:36:35.000000000 -0400
80282 @@ -122,8 +122,8 @@ extern struct snd_card *aoa_get_card(voi
80283 extern int aoa_snd_ctl_add(struct snd_kcontrol* control);
80284
80285 /* GPIO stuff */
80286 -extern struct gpio_methods *pmf_gpio_methods;
80287 -extern struct gpio_methods *ftr_gpio_methods;
80288 +extern const struct gpio_methods *pmf_gpio_methods;
80289 +extern const struct gpio_methods *ftr_gpio_methods;
80290 /* extern struct gpio_methods *map_gpio_methods; */
80291
80292 #endif /* __AOA_H */
80293 diff -urNp linux-2.6.39.1/sound/aoa/codecs/onyx.c linux-2.6.39.1/sound/aoa/codecs/onyx.c
80294 --- linux-2.6.39.1/sound/aoa/codecs/onyx.c 2011-05-19 00:06:34.000000000 -0400
80295 +++ linux-2.6.39.1/sound/aoa/codecs/onyx.c 2011-05-22 19:36:35.000000000 -0400
80296 @@ -54,7 +54,7 @@ struct onyx {
80297 spdif_locked:1,
80298 analog_locked:1,
80299 original_mute:2;
80300 - int open_count;
80301 + local_t open_count;
80302 struct codec_info *codec_info;
80303
80304 /* mutex serializes concurrent access to the device
80305 @@ -753,7 +753,7 @@ static int onyx_open(struct codec_info_i
80306 struct onyx *onyx = cii->codec_data;
80307
80308 mutex_lock(&onyx->mutex);
80309 - onyx->open_count++;
80310 + local_inc(&onyx->open_count);
80311 mutex_unlock(&onyx->mutex);
80312
80313 return 0;
80314 @@ -765,8 +765,7 @@ static int onyx_close(struct codec_info_
80315 struct onyx *onyx = cii->codec_data;
80316
80317 mutex_lock(&onyx->mutex);
80318 - onyx->open_count--;
80319 - if (!onyx->open_count)
80320 + if (local_dec_and_test(&onyx->open_count))
80321 onyx->spdif_locked = onyx->analog_locked = 0;
80322 mutex_unlock(&onyx->mutex);
80323
80324 diff -urNp linux-2.6.39.1/sound/aoa/codecs/onyx.h linux-2.6.39.1/sound/aoa/codecs/onyx.h
80325 --- linux-2.6.39.1/sound/aoa/codecs/onyx.h 2011-05-19 00:06:34.000000000 -0400
80326 +++ linux-2.6.39.1/sound/aoa/codecs/onyx.h 2011-05-22 19:36:35.000000000 -0400
80327 @@ -11,6 +11,7 @@
80328 #include <linux/i2c.h>
80329 #include <asm/pmac_low_i2c.h>
80330 #include <asm/prom.h>
80331 +#include <asm/local.h>
80332
80333 /* PCM3052 register definitions */
80334
80335 diff -urNp linux-2.6.39.1/sound/arm/aaci.c linux-2.6.39.1/sound/arm/aaci.c
80336 --- linux-2.6.39.1/sound/arm/aaci.c 2011-05-19 00:06:34.000000000 -0400
80337 +++ linux-2.6.39.1/sound/arm/aaci.c 2011-05-22 19:36:35.000000000 -0400
80338 @@ -635,7 +635,7 @@ static int aaci_pcm_playback_trigger(str
80339 return ret;
80340 }
80341
80342 -static struct snd_pcm_ops aaci_playback_ops = {
80343 +static const struct snd_pcm_ops aaci_playback_ops = {
80344 .open = aaci_pcm_open,
80345 .close = aaci_pcm_close,
80346 .ioctl = snd_pcm_lib_ioctl,
80347 @@ -738,7 +738,7 @@ static int aaci_pcm_capture_prepare(stru
80348 return 0;
80349 }
80350
80351 -static struct snd_pcm_ops aaci_capture_ops = {
80352 +static const struct snd_pcm_ops aaci_capture_ops = {
80353 .open = aaci_pcm_open,
80354 .close = aaci_pcm_close,
80355 .ioctl = snd_pcm_lib_ioctl,
80356 @@ -827,7 +827,7 @@ static struct ac97_pcm ac97_defs[] __dev
80357 }
80358 };
80359
80360 -static struct snd_ac97_bus_ops aaci_bus_ops = {
80361 +static const struct snd_ac97_bus_ops aaci_bus_ops = {
80362 .write = aaci_ac97_write,
80363 .read = aaci_ac97_read,
80364 };
80365 diff -urNp linux-2.6.39.1/sound/arm/pxa2xx-ac97.c linux-2.6.39.1/sound/arm/pxa2xx-ac97.c
80366 --- linux-2.6.39.1/sound/arm/pxa2xx-ac97.c 2011-05-19 00:06:34.000000000 -0400
80367 +++ linux-2.6.39.1/sound/arm/pxa2xx-ac97.c 2011-05-22 19:36:35.000000000 -0400
80368 @@ -34,7 +34,7 @@ static void pxa2xx_ac97_reset(struct snd
80369 pxa2xx_ac97_finish_reset(ac97);
80370 }
80371
80372 -static struct snd_ac97_bus_ops pxa2xx_ac97_ops = {
80373 +static const struct snd_ac97_bus_ops pxa2xx_ac97_ops = {
80374 .read = pxa2xx_ac97_read,
80375 .write = pxa2xx_ac97_write,
80376 .reset = pxa2xx_ac97_reset,
80377 diff -urNp linux-2.6.39.1/sound/atmel/abdac.c linux-2.6.39.1/sound/atmel/abdac.c
80378 --- linux-2.6.39.1/sound/atmel/abdac.c 2011-05-19 00:06:34.000000000 -0400
80379 +++ linux-2.6.39.1/sound/atmel/abdac.c 2011-05-22 19:36:35.000000000 -0400
80380 @@ -297,7 +297,7 @@ static irqreturn_t abdac_interrupt(int i
80381 return IRQ_HANDLED;
80382 }
80383
80384 -static struct snd_pcm_ops atmel_abdac_ops = {
80385 +static const struct snd_pcm_ops atmel_abdac_ops = {
80386 .open = atmel_abdac_open,
80387 .close = atmel_abdac_close,
80388 .ioctl = snd_pcm_lib_ioctl,
80389 diff -urNp linux-2.6.39.1/sound/atmel/ac97c.c linux-2.6.39.1/sound/atmel/ac97c.c
80390 --- linux-2.6.39.1/sound/atmel/ac97c.c 2011-05-19 00:06:34.000000000 -0400
80391 +++ linux-2.6.39.1/sound/atmel/ac97c.c 2011-05-22 19:36:35.000000000 -0400
80392 @@ -626,7 +626,7 @@ atmel_ac97c_capture_pointer(struct snd_p
80393 return frames;
80394 }
80395
80396 -static struct snd_pcm_ops atmel_ac97_playback_ops = {
80397 +static const struct snd_pcm_ops atmel_ac97_playback_ops = {
80398 .open = atmel_ac97c_playback_open,
80399 .close = atmel_ac97c_playback_close,
80400 .ioctl = snd_pcm_lib_ioctl,
80401 @@ -637,7 +637,7 @@ static struct snd_pcm_ops atmel_ac97_pla
80402 .pointer = atmel_ac97c_playback_pointer,
80403 };
80404
80405 -static struct snd_pcm_ops atmel_ac97_capture_ops = {
80406 +static const struct snd_pcm_ops atmel_ac97_capture_ops = {
80407 .open = atmel_ac97c_capture_open,
80408 .close = atmel_ac97c_capture_close,
80409 .ioctl = snd_pcm_lib_ioctl,
80410 @@ -909,7 +909,7 @@ static int __devinit atmel_ac97c_probe(s
80411 struct resource *regs;
80412 struct ac97c_platform_data *pdata;
80413 struct clk *pclk;
80414 - static struct snd_ac97_bus_ops ops = {
80415 + static const struct snd_ac97_bus_ops ops = {
80416 .write = atmel_ac97c_write,
80417 .read = atmel_ac97c_read,
80418 };
80419 diff -urNp linux-2.6.39.1/sound/core/control.c linux-2.6.39.1/sound/core/control.c
80420 --- linux-2.6.39.1/sound/core/control.c 2011-05-19 00:06:34.000000000 -0400
80421 +++ linux-2.6.39.1/sound/core/control.c 2011-05-22 19:36:35.000000000 -0400
80422 @@ -1520,7 +1520,7 @@ static int snd_ctl_dev_free(struct snd_d
80423 */
80424 int snd_ctl_create(struct snd_card *card)
80425 {
80426 - static struct snd_device_ops ops = {
80427 + static const struct snd_device_ops ops = {
80428 .dev_free = snd_ctl_dev_free,
80429 .dev_register = snd_ctl_dev_register,
80430 .dev_disconnect = snd_ctl_dev_disconnect,
80431 diff -urNp linux-2.6.39.1/sound/core/device.c linux-2.6.39.1/sound/core/device.c
80432 --- linux-2.6.39.1/sound/core/device.c 2011-05-19 00:06:34.000000000 -0400
80433 +++ linux-2.6.39.1/sound/core/device.c 2011-05-22 19:36:35.000000000 -0400
80434 @@ -41,7 +41,7 @@
80435 * Returns zero if successful, or a negative error code on failure.
80436 */
80437 int snd_device_new(struct snd_card *card, snd_device_type_t type,
80438 - void *device_data, struct snd_device_ops *ops)
80439 + void *device_data, const struct snd_device_ops *ops)
80440 {
80441 struct snd_device *dev;
80442
80443 diff -urNp linux-2.6.39.1/sound/core/hwdep.c linux-2.6.39.1/sound/core/hwdep.c
80444 --- linux-2.6.39.1/sound/core/hwdep.c 2011-05-19 00:06:34.000000000 -0400
80445 +++ linux-2.6.39.1/sound/core/hwdep.c 2011-05-22 19:36:35.000000000 -0400
80446 @@ -348,7 +348,7 @@ int snd_hwdep_new(struct snd_card *card,
80447 {
80448 struct snd_hwdep *hwdep;
80449 int err;
80450 - static struct snd_device_ops ops = {
80451 + static const struct snd_device_ops ops = {
80452 .dev_free = snd_hwdep_dev_free,
80453 .dev_register = snd_hwdep_dev_register,
80454 .dev_disconnect = snd_hwdep_dev_disconnect,
80455 diff -urNp linux-2.6.39.1/sound/core/info.c linux-2.6.39.1/sound/core/info.c
80456 --- linux-2.6.39.1/sound/core/info.c 2011-05-19 00:06:34.000000000 -0400
80457 +++ linux-2.6.39.1/sound/core/info.c 2011-05-22 19:36:35.000000000 -0400
80458 @@ -897,7 +897,7 @@ static int snd_info_dev_register_entry(s
80459 int snd_card_proc_new(struct snd_card *card, const char *name,
80460 struct snd_info_entry **entryp)
80461 {
80462 - static struct snd_device_ops ops = {
80463 + static const struct snd_device_ops ops = {
80464 .dev_free = snd_info_dev_free_entry,
80465 .dev_register = snd_info_dev_register_entry,
80466 /* disconnect is done via snd_info_card_disconnect() */
80467 diff -urNp linux-2.6.39.1/sound/core/jack.c linux-2.6.39.1/sound/core/jack.c
80468 --- linux-2.6.39.1/sound/core/jack.c 2011-05-19 00:06:34.000000000 -0400
80469 +++ linux-2.6.39.1/sound/core/jack.c 2011-05-22 19:36:35.000000000 -0400
80470 @@ -105,7 +105,7 @@ int snd_jack_new(struct snd_card *card,
80471 struct snd_jack *jack;
80472 int err;
80473 int i;
80474 - static struct snd_device_ops ops = {
80475 + static const struct snd_device_ops ops = {
80476 .dev_free = snd_jack_dev_free,
80477 .dev_register = snd_jack_dev_register,
80478 };
80479 diff -urNp linux-2.6.39.1/sound/core/pcm.c linux-2.6.39.1/sound/core/pcm.c
80480 --- linux-2.6.39.1/sound/core/pcm.c 2011-05-19 00:06:34.000000000 -0400
80481 +++ linux-2.6.39.1/sound/core/pcm.c 2011-05-22 19:36:35.000000000 -0400
80482 @@ -717,7 +717,7 @@ int snd_pcm_new(struct snd_card *card, c
80483 {
80484 struct snd_pcm *pcm;
80485 int err;
80486 - static struct snd_device_ops ops = {
80487 + static const struct snd_device_ops ops = {
80488 .dev_free = snd_pcm_dev_free,
80489 .dev_register = snd_pcm_dev_register,
80490 .dev_disconnect = snd_pcm_dev_disconnect,
80491 diff -urNp linux-2.6.39.1/sound/core/pcm_lib.c linux-2.6.39.1/sound/core/pcm_lib.c
80492 --- linux-2.6.39.1/sound/core/pcm_lib.c 2011-05-19 00:06:34.000000000 -0400
80493 +++ linux-2.6.39.1/sound/core/pcm_lib.c 2011-05-22 19:36:35.000000000 -0400
80494 @@ -505,7 +505,7 @@ int snd_pcm_update_hw_ptr(struct snd_pcm
80495 *
80496 * Sets the given PCM operators to the pcm instance.
80497 */
80498 -void snd_pcm_set_ops(struct snd_pcm *pcm, int direction, struct snd_pcm_ops *ops)
80499 +void snd_pcm_set_ops(struct snd_pcm *pcm, int direction, const struct snd_pcm_ops *ops)
80500 {
80501 struct snd_pcm_str *stream = &pcm->streams[direction];
80502 struct snd_pcm_substream *substream;
80503 diff -urNp linux-2.6.39.1/sound/core/pcm_native.c linux-2.6.39.1/sound/core/pcm_native.c
80504 --- linux-2.6.39.1/sound/core/pcm_native.c 2011-05-19 00:06:34.000000000 -0400
80505 +++ linux-2.6.39.1/sound/core/pcm_native.c 2011-05-22 19:36:35.000000000 -0400
80506 @@ -702,7 +702,7 @@ struct action_ops {
80507 * Note: the stream state might be changed also on failure
80508 * Note2: call with calling stream lock + link lock
80509 */
80510 -static int snd_pcm_action_group(struct action_ops *ops,
80511 +static int snd_pcm_action_group(const struct action_ops *ops,
80512 struct snd_pcm_substream *substream,
80513 int state, int do_lock)
80514 {
80515 @@ -751,7 +751,7 @@ static int snd_pcm_action_group(struct a
80516 /*
80517 * Note: call with stream lock
80518 */
80519 -static int snd_pcm_action_single(struct action_ops *ops,
80520 +static int snd_pcm_action_single(const struct action_ops *ops,
80521 struct snd_pcm_substream *substream,
80522 int state)
80523 {
80524 @@ -771,7 +771,7 @@ static int snd_pcm_action_single(struct
80525 /*
80526 * Note: call with stream lock
80527 */
80528 -static int snd_pcm_action(struct action_ops *ops,
80529 +static int snd_pcm_action(const struct action_ops *ops,
80530 struct snd_pcm_substream *substream,
80531 int state)
80532 {
80533 @@ -794,7 +794,7 @@ static int snd_pcm_action(struct action_
80534 /*
80535 * Note: don't use any locks before
80536 */
80537 -static int snd_pcm_action_lock_irq(struct action_ops *ops,
80538 +static int snd_pcm_action_lock_irq(const struct action_ops *ops,
80539 struct snd_pcm_substream *substream,
80540 int state)
80541 {
80542 @@ -818,7 +818,7 @@ static int snd_pcm_action_lock_irq(struc
80543
80544 /*
80545 */
80546 -static int snd_pcm_action_nonatomic(struct action_ops *ops,
80547 +static int snd_pcm_action_nonatomic(const struct action_ops *ops,
80548 struct snd_pcm_substream *substream,
80549 int state)
80550 {
80551 @@ -877,7 +877,7 @@ static void snd_pcm_post_start(struct sn
80552 &runtime->trigger_tstamp);
80553 }
80554
80555 -static struct action_ops snd_pcm_action_start = {
80556 +static const struct action_ops snd_pcm_action_start = {
80557 .pre_action = snd_pcm_pre_start,
80558 .do_action = snd_pcm_do_start,
80559 .undo_action = snd_pcm_undo_start,
80560 @@ -928,7 +928,7 @@ static void snd_pcm_post_stop(struct snd
80561 wake_up(&runtime->tsleep);
80562 }
80563
80564 -static struct action_ops snd_pcm_action_stop = {
80565 +static const struct action_ops snd_pcm_action_stop = {
80566 .pre_action = snd_pcm_pre_stop,
80567 .do_action = snd_pcm_do_stop,
80568 .post_action = snd_pcm_post_stop
80569 @@ -1025,7 +1025,7 @@ static void snd_pcm_post_pause(struct sn
80570 }
80571 }
80572
80573 -static struct action_ops snd_pcm_action_pause = {
80574 +static const struct action_ops snd_pcm_action_pause = {
80575 .pre_action = snd_pcm_pre_pause,
80576 .do_action = snd_pcm_do_pause,
80577 .undo_action = snd_pcm_undo_pause,
80578 @@ -1076,7 +1076,7 @@ static void snd_pcm_post_suspend(struct
80579 wake_up(&runtime->tsleep);
80580 }
80581
80582 -static struct action_ops snd_pcm_action_suspend = {
80583 +static const struct action_ops snd_pcm_action_suspend = {
80584 .pre_action = snd_pcm_pre_suspend,
80585 .do_action = snd_pcm_do_suspend,
80586 .post_action = snd_pcm_post_suspend
80587 @@ -1175,7 +1175,7 @@ static void snd_pcm_post_resume(struct s
80588 runtime->status->state = runtime->status->suspended_state;
80589 }
80590
80591 -static struct action_ops snd_pcm_action_resume = {
80592 +static const struct action_ops snd_pcm_action_resume = {
80593 .pre_action = snd_pcm_pre_resume,
80594 .do_action = snd_pcm_do_resume,
80595 .undo_action = snd_pcm_undo_resume,
80596 @@ -1278,7 +1278,7 @@ static void snd_pcm_post_reset(struct sn
80597 snd_pcm_playback_silence(substream, ULONG_MAX);
80598 }
80599
80600 -static struct action_ops snd_pcm_action_reset = {
80601 +static const struct action_ops snd_pcm_action_reset = {
80602 .pre_action = snd_pcm_pre_reset,
80603 .do_action = snd_pcm_do_reset,
80604 .post_action = snd_pcm_post_reset
80605 @@ -1322,7 +1322,7 @@ static void snd_pcm_post_prepare(struct
80606 runtime->status->state = SNDRV_PCM_STATE_PREPARED;
80607 }
80608
80609 -static struct action_ops snd_pcm_action_prepare = {
80610 +static const struct action_ops snd_pcm_action_prepare = {
80611 .pre_action = snd_pcm_pre_prepare,
80612 .do_action = snd_pcm_do_prepare,
80613 .post_action = snd_pcm_post_prepare
80614 @@ -1397,7 +1397,7 @@ static void snd_pcm_post_drain_init(stru
80615 {
80616 }
80617
80618 -static struct action_ops snd_pcm_action_drain_init = {
80619 +static const struct action_ops snd_pcm_action_drain_init = {
80620 .pre_action = snd_pcm_pre_drain_init,
80621 .do_action = snd_pcm_do_drain_init,
80622 .post_action = snd_pcm_post_drain_init
80623 diff -urNp linux-2.6.39.1/sound/core/rawmidi.c linux-2.6.39.1/sound/core/rawmidi.c
80624 --- linux-2.6.39.1/sound/core/rawmidi.c 2011-05-19 00:06:34.000000000 -0400
80625 +++ linux-2.6.39.1/sound/core/rawmidi.c 2011-05-22 19:36:35.000000000 -0400
80626 @@ -1449,7 +1449,7 @@ int snd_rawmidi_new(struct snd_card *car
80627 {
80628 struct snd_rawmidi *rmidi;
80629 int err;
80630 - static struct snd_device_ops ops = {
80631 + static const struct snd_device_ops ops = {
80632 .dev_free = snd_rawmidi_dev_free,
80633 .dev_register = snd_rawmidi_dev_register,
80634 .dev_disconnect = snd_rawmidi_dev_disconnect,
80635 @@ -1654,7 +1654,7 @@ static int snd_rawmidi_dev_disconnect(st
80636 * Sets the rawmidi operators for the given stream direction.
80637 */
80638 void snd_rawmidi_set_ops(struct snd_rawmidi *rmidi, int stream,
80639 - struct snd_rawmidi_ops *ops)
80640 + const struct snd_rawmidi_ops *ops)
80641 {
80642 struct snd_rawmidi_substream *substream;
80643
80644 diff -urNp linux-2.6.39.1/sound/core/seq/seq_device.c linux-2.6.39.1/sound/core/seq/seq_device.c
80645 --- linux-2.6.39.1/sound/core/seq/seq_device.c 2011-05-19 00:06:34.000000000 -0400
80646 +++ linux-2.6.39.1/sound/core/seq/seq_device.c 2011-05-22 19:36:35.000000000 -0400
80647 @@ -178,7 +178,7 @@ int snd_seq_device_new(struct snd_card *
80648 struct snd_seq_device *dev;
80649 struct ops_list *ops;
80650 int err;
80651 - static struct snd_device_ops dops = {
80652 + static const struct snd_device_ops dops = {
80653 .dev_free = snd_seq_device_dev_free,
80654 .dev_register = snd_seq_device_dev_register,
80655 .dev_disconnect = snd_seq_device_dev_disconnect,
80656 @@ -307,7 +307,7 @@ static int snd_seq_device_dev_disconnect
80657 * id = driver id
80658 * entry = driver operators - duplicated to each instance
80659 */
80660 -int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry,
80661 +int snd_seq_device_register_driver(char *id, const struct snd_seq_dev_ops *entry,
80662 int argsize)
80663 {
80664 struct ops_list *ops;
80665 diff -urNp linux-2.6.39.1/sound/core/seq/seq_midi.c linux-2.6.39.1/sound/core/seq/seq_midi.c
80666 --- linux-2.6.39.1/sound/core/seq/seq_midi.c 2011-05-19 00:06:34.000000000 -0400
80667 +++ linux-2.6.39.1/sound/core/seq/seq_midi.c 2011-05-22 19:36:35.000000000 -0400
80668 @@ -461,7 +461,7 @@ snd_seq_midisynth_unregister_port(struct
80669
80670 static int __init alsa_seq_midi_init(void)
80671 {
80672 - static struct snd_seq_dev_ops ops = {
80673 + static const struct snd_seq_dev_ops ops = {
80674 snd_seq_midisynth_register_port,
80675 snd_seq_midisynth_unregister_port,
80676 };
80677 diff -urNp linux-2.6.39.1/sound/core/seq/seq_virmidi.c linux-2.6.39.1/sound/core/seq/seq_virmidi.c
80678 --- linux-2.6.39.1/sound/core/seq/seq_virmidi.c 2011-05-19 00:06:34.000000000 -0400
80679 +++ linux-2.6.39.1/sound/core/seq/seq_virmidi.c 2011-05-22 19:36:35.000000000 -0400
80680 @@ -337,13 +337,13 @@ static int snd_virmidi_unuse(void *priva
80681 * Register functions
80682 */
80683
80684 -static struct snd_rawmidi_ops snd_virmidi_input_ops = {
80685 +static const struct snd_rawmidi_ops snd_virmidi_input_ops = {
80686 .open = snd_virmidi_input_open,
80687 .close = snd_virmidi_input_close,
80688 .trigger = snd_virmidi_input_trigger,
80689 };
80690
80691 -static struct snd_rawmidi_ops snd_virmidi_output_ops = {
80692 +static const struct snd_rawmidi_ops snd_virmidi_output_ops = {
80693 .open = snd_virmidi_output_open,
80694 .close = snd_virmidi_output_close,
80695 .trigger = snd_virmidi_output_trigger,
80696 @@ -467,7 +467,7 @@ static int snd_virmidi_dev_unregister(st
80697 /*
80698 *
80699 */
80700 -static struct snd_rawmidi_global_ops snd_virmidi_global_ops = {
80701 +static const struct snd_rawmidi_global_ops snd_virmidi_global_ops = {
80702 .dev_register = snd_virmidi_dev_register,
80703 .dev_unregister = snd_virmidi_dev_unregister,
80704 };
80705 diff -urNp linux-2.6.39.1/sound/core/timer.c linux-2.6.39.1/sound/core/timer.c
80706 --- linux-2.6.39.1/sound/core/timer.c 2011-05-19 00:06:34.000000000 -0400
80707 +++ linux-2.6.39.1/sound/core/timer.c 2011-05-22 19:36:35.000000000 -0400
80708 @@ -756,7 +756,7 @@ int snd_timer_new(struct snd_card *card,
80709 {
80710 struct snd_timer *timer;
80711 int err;
80712 - static struct snd_device_ops ops = {
80713 + static const struct snd_device_ops ops = {
80714 .dev_free = snd_timer_dev_free,
80715 .dev_register = snd_timer_dev_register,
80716 .dev_disconnect = snd_timer_dev_disconnect,
80717 diff -urNp linux-2.6.39.1/sound/drivers/aloop.c linux-2.6.39.1/sound/drivers/aloop.c
80718 --- linux-2.6.39.1/sound/drivers/aloop.c 2011-05-19 00:06:34.000000000 -0400
80719 +++ linux-2.6.39.1/sound/drivers/aloop.c 2011-05-22 19:36:35.000000000 -0400
80720 @@ -731,7 +731,7 @@ static int loopback_close(struct snd_pcm
80721 return 0;
80722 }
80723
80724 -static struct snd_pcm_ops loopback_playback_ops = {
80725 +static const struct snd_pcm_ops loopback_playback_ops = {
80726 .open = loopback_open,
80727 .close = loopback_close,
80728 .ioctl = snd_pcm_lib_ioctl,
80729 @@ -742,7 +742,7 @@ static struct snd_pcm_ops loopback_playb
80730 .pointer = loopback_pointer,
80731 };
80732
80733 -static struct snd_pcm_ops loopback_capture_ops = {
80734 +static const struct snd_pcm_ops loopback_capture_ops = {
80735 .open = loopback_open,
80736 .close = loopback_close,
80737 .ioctl = snd_pcm_lib_ioctl,
80738 diff -urNp linux-2.6.39.1/sound/drivers/dummy.c linux-2.6.39.1/sound/drivers/dummy.c
80739 --- linux-2.6.39.1/sound/drivers/dummy.c 2011-05-19 00:06:34.000000000 -0400
80740 +++ linux-2.6.39.1/sound/drivers/dummy.c 2011-05-22 19:36:35.000000000 -0400
80741 @@ -350,7 +350,7 @@ static void dummy_systimer_free(struct s
80742 kfree(substream->runtime->private_data);
80743 }
80744
80745 -static struct dummy_timer_ops dummy_systimer_ops = {
80746 +static const struct dummy_timer_ops dummy_systimer_ops = {
80747 .create = dummy_systimer_create,
80748 .free = dummy_systimer_free,
80749 .prepare = dummy_systimer_prepare,
80750 @@ -474,7 +474,7 @@ static void dummy_hrtimer_free(struct sn
80751 kfree(dpcm);
80752 }
80753
80754 -static struct dummy_timer_ops dummy_hrtimer_ops = {
80755 +static const struct dummy_timer_ops dummy_hrtimer_ops = {
80756 .create = dummy_hrtimer_create,
80757 .free = dummy_hrtimer_free,
80758 .prepare = dummy_hrtimer_prepare,
80759 @@ -660,7 +660,7 @@ static struct page *dummy_pcm_page(struc
80760 return virt_to_page(dummy_page[substream->stream]); /* the same page */
80761 }
80762
80763 -static struct snd_pcm_ops dummy_pcm_ops = {
80764 +static const struct snd_pcm_ops dummy_pcm_ops = {
80765 .open = dummy_pcm_open,
80766 .close = dummy_pcm_close,
80767 .ioctl = snd_pcm_lib_ioctl,
80768 @@ -671,7 +671,7 @@ static struct snd_pcm_ops dummy_pcm_ops
80769 .pointer = dummy_pcm_pointer,
80770 };
80771
80772 -static struct snd_pcm_ops dummy_pcm_ops_no_buf = {
80773 +static const struct snd_pcm_ops dummy_pcm_ops_no_buf = {
80774 .open = dummy_pcm_open,
80775 .close = dummy_pcm_close,
80776 .ioctl = snd_pcm_lib_ioctl,
80777 @@ -689,7 +689,7 @@ static int __devinit snd_card_dummy_pcm(
80778 int substreams)
80779 {
80780 struct snd_pcm *pcm;
80781 - struct snd_pcm_ops *ops;
80782 + const struct snd_pcm_ops *ops;
80783 int err;
80784
80785 err = snd_pcm_new(dummy->card, "Dummy PCM", device,
80786 diff -urNp linux-2.6.39.1/sound/drivers/ml403-ac97cr.c linux-2.6.39.1/sound/drivers/ml403-ac97cr.c
80787 --- linux-2.6.39.1/sound/drivers/ml403-ac97cr.c 2011-05-19 00:06:34.000000000 -0400
80788 +++ linux-2.6.39.1/sound/drivers/ml403-ac97cr.c 2011-05-22 19:36:35.000000000 -0400
80789 @@ -759,7 +759,7 @@ static int snd_ml403_ac97cr_capture_clos
80790 return 0;
80791 }
80792
80793 -static struct snd_pcm_ops snd_ml403_ac97cr_playback_ops = {
80794 +static const struct snd_pcm_ops snd_ml403_ac97cr_playback_ops = {
80795 .open = snd_ml403_ac97cr_playback_open,
80796 .close = snd_ml403_ac97cr_playback_close,
80797 .ioctl = snd_pcm_lib_ioctl,
80798 @@ -770,7 +770,7 @@ static struct snd_pcm_ops snd_ml403_ac97
80799 .pointer = snd_ml403_ac97cr_pcm_pointer,
80800 };
80801
80802 -static struct snd_pcm_ops snd_ml403_ac97cr_capture_ops = {
80803 +static const struct snd_pcm_ops snd_ml403_ac97cr_capture_ops = {
80804 .open = snd_ml403_ac97cr_capture_open,
80805 .close = snd_ml403_ac97cr_capture_close,
80806 .ioctl = snd_pcm_lib_ioctl,
80807 @@ -1114,7 +1114,7 @@ snd_ml403_ac97cr_create(struct snd_card
80808 {
80809 struct snd_ml403_ac97cr *ml403_ac97cr;
80810 int err;
80811 - static struct snd_device_ops ops = {
80812 + static const struct snd_device_ops ops = {
80813 .dev_free = snd_ml403_ac97cr_dev_free,
80814 };
80815 struct resource *resource;
80816 @@ -1210,7 +1210,7 @@ snd_ml403_ac97cr_mixer(struct snd_ml403_
80817 struct snd_ac97_bus *bus;
80818 struct snd_ac97_template ac97;
80819 int err;
80820 - static struct snd_ac97_bus_ops ops = {
80821 + static const struct snd_ac97_bus_ops ops = {
80822 .write = snd_ml403_ac97cr_codec_write,
80823 .read = snd_ml403_ac97cr_codec_read,
80824 };
80825 diff -urNp linux-2.6.39.1/sound/drivers/mtpav.c linux-2.6.39.1/sound/drivers/mtpav.c
80826 --- linux-2.6.39.1/sound/drivers/mtpav.c 2011-05-19 00:06:34.000000000 -0400
80827 +++ linux-2.6.39.1/sound/drivers/mtpav.c 2011-05-22 19:36:35.000000000 -0400
80828 @@ -601,13 +601,13 @@ static int __devinit snd_mtpav_get_ISA(s
80829 /*
80830 */
80831
80832 -static struct snd_rawmidi_ops snd_mtpav_output = {
80833 +static const struct snd_rawmidi_ops snd_mtpav_output = {
80834 .open = snd_mtpav_output_open,
80835 .close = snd_mtpav_output_close,
80836 .trigger = snd_mtpav_output_trigger,
80837 };
80838
80839 -static struct snd_rawmidi_ops snd_mtpav_input = {
80840 +static const struct snd_rawmidi_ops snd_mtpav_input = {
80841 .open = snd_mtpav_input_open,
80842 .close = snd_mtpav_input_close,
80843 .trigger = snd_mtpav_input_trigger,
80844 diff -urNp linux-2.6.39.1/sound/drivers/mts64.c linux-2.6.39.1/sound/drivers/mts64.c
80845 --- linux-2.6.39.1/sound/drivers/mts64.c 2011-05-19 00:06:34.000000000 -0400
80846 +++ linux-2.6.39.1/sound/drivers/mts64.c 2011-05-22 19:36:35.000000000 -0400
80847 @@ -28,6 +28,7 @@
80848 #include <sound/initval.h>
80849 #include <sound/rawmidi.h>
80850 #include <sound/control.h>
80851 +#include <asm/local.h>
80852
80853 #define CARD_NAME "Miditerminal 4140"
80854 #define DRIVER_NAME "MTS64"
80855 @@ -66,7 +67,7 @@ struct mts64 {
80856 struct pardevice *pardev;
80857 int pardev_claimed;
80858
80859 - int open_count;
80860 + local_t open_count;
80861 int current_midi_output_port;
80862 int current_midi_input_port;
80863 u8 mode[MTS64_NUM_INPUT_PORTS];
80864 @@ -696,7 +697,7 @@ static int snd_mts64_rawmidi_open(struct
80865 {
80866 struct mts64 *mts = substream->rmidi->private_data;
80867
80868 - if (mts->open_count == 0) {
80869 + if (local_read(&mts->open_count) == 0) {
80870 /* We don't need a spinlock here, because this is just called
80871 if the device has not been opened before.
80872 So there aren't any IRQs from the device */
80873 @@ -704,7 +705,7 @@ static int snd_mts64_rawmidi_open(struct
80874
80875 msleep(50);
80876 }
80877 - ++(mts->open_count);
80878 + local_inc(&mts->open_count);
80879
80880 return 0;
80881 }
80882 @@ -714,8 +715,7 @@ static int snd_mts64_rawmidi_close(struc
80883 struct mts64 *mts = substream->rmidi->private_data;
80884 unsigned long flags;
80885
80886 - --(mts->open_count);
80887 - if (mts->open_count == 0) {
80888 + if (local_dec_return(&mts->open_count) == 0) {
80889 /* We need the spinlock_irqsave here because we can still
80890 have IRQs at this point */
80891 spin_lock_irqsave(&mts->lock, flags);
80892 @@ -724,8 +724,8 @@ static int snd_mts64_rawmidi_close(struc
80893
80894 msleep(500);
80895
80896 - } else if (mts->open_count < 0)
80897 - mts->open_count = 0;
80898 + } else if (local_read(&mts->open_count) < 0)
80899 + local_set(&mts->open_count, 0);
80900
80901 return 0;
80902 }
80903 @@ -760,13 +760,13 @@ static void snd_mts64_rawmidi_input_trig
80904 spin_unlock_irqrestore(&mts->lock, flags);
80905 }
80906
80907 -static struct snd_rawmidi_ops snd_mts64_rawmidi_output_ops = {
80908 +static const struct snd_rawmidi_ops snd_mts64_rawmidi_output_ops = {
80909 .open = snd_mts64_rawmidi_open,
80910 .close = snd_mts64_rawmidi_close,
80911 .trigger = snd_mts64_rawmidi_output_trigger
80912 };
80913
80914 -static struct snd_rawmidi_ops snd_mts64_rawmidi_input_ops = {
80915 +static const struct snd_rawmidi_ops snd_mts64_rawmidi_input_ops = {
80916 .open = snd_mts64_rawmidi_open,
80917 .close = snd_mts64_rawmidi_close,
80918 .trigger = snd_mts64_rawmidi_input_trigger
80919 diff -urNp linux-2.6.39.1/sound/drivers/pcsp/pcsp.c linux-2.6.39.1/sound/drivers/pcsp/pcsp.c
80920 --- linux-2.6.39.1/sound/drivers/pcsp/pcsp.c 2011-05-19 00:06:34.000000000 -0400
80921 +++ linux-2.6.39.1/sound/drivers/pcsp/pcsp.c 2011-05-22 19:36:35.000000000 -0400
80922 @@ -41,7 +41,7 @@ struct snd_pcsp pcsp_chip;
80923
80924 static int __devinit snd_pcsp_create(struct snd_card *card)
80925 {
80926 - static struct snd_device_ops ops = { };
80927 + static const struct snd_device_ops ops = { };
80928 struct timespec tp;
80929 int err;
80930 int div, min_div, order;
80931 diff -urNp linux-2.6.39.1/sound/drivers/pcsp/pcsp_lib.c linux-2.6.39.1/sound/drivers/pcsp/pcsp_lib.c
80932 --- linux-2.6.39.1/sound/drivers/pcsp/pcsp_lib.c 2011-05-19 00:06:34.000000000 -0400
80933 +++ linux-2.6.39.1/sound/drivers/pcsp/pcsp_lib.c 2011-05-22 19:36:35.000000000 -0400
80934 @@ -323,7 +323,7 @@ static int snd_pcsp_playback_open(struct
80935 return 0;
80936 }
80937
80938 -static struct snd_pcm_ops snd_pcsp_playback_ops = {
80939 +static const struct snd_pcm_ops snd_pcsp_playback_ops = {
80940 .open = snd_pcsp_playback_open,
80941 .close = snd_pcsp_playback_close,
80942 .ioctl = snd_pcm_lib_ioctl,
80943 diff -urNp linux-2.6.39.1/sound/drivers/portman2x4.c linux-2.6.39.1/sound/drivers/portman2x4.c
80944 --- linux-2.6.39.1/sound/drivers/portman2x4.c 2011-05-19 00:06:34.000000000 -0400
80945 +++ linux-2.6.39.1/sound/drivers/portman2x4.c 2011-05-22 19:36:35.000000000 -0400
80946 @@ -47,6 +47,7 @@
80947 #include <sound/initval.h>
80948 #include <sound/rawmidi.h>
80949 #include <sound/control.h>
80950 +#include <asm/local.h>
80951
80952 #define CARD_NAME "Portman 2x4"
80953 #define DRIVER_NAME "portman"
80954 @@ -84,7 +85,7 @@ struct portman {
80955 struct pardevice *pardev;
80956 int pardev_claimed;
80957
80958 - int open_count;
80959 + local_t open_count;
80960 int mode[PORTMAN_NUM_INPUT_PORTS];
80961 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
80962 };
80963 @@ -547,13 +548,13 @@ static void snd_portman_midi_output_trig
80964 spin_unlock_irqrestore(&pm->reg_lock, flags);
80965 }
80966
80967 -static struct snd_rawmidi_ops snd_portman_midi_output = {
80968 +static const struct snd_rawmidi_ops snd_portman_midi_output = {
80969 .open = snd_portman_midi_open,
80970 .close = snd_portman_midi_close,
80971 .trigger = snd_portman_midi_output_trigger,
80972 };
80973
80974 -static struct snd_rawmidi_ops snd_portman_midi_input = {
80975 +static const struct snd_rawmidi_ops snd_portman_midi_input = {
80976 .open = snd_portman_midi_open,
80977 .close = snd_portman_midi_close,
80978 .trigger = snd_portman_midi_input_trigger,
80979 diff -urNp linux-2.6.39.1/sound/drivers/serial-u16550.c linux-2.6.39.1/sound/drivers/serial-u16550.c
80980 --- linux-2.6.39.1/sound/drivers/serial-u16550.c 2011-05-19 00:06:34.000000000 -0400
80981 +++ linux-2.6.39.1/sound/drivers/serial-u16550.c 2011-05-22 19:36:35.000000000 -0400
80982 @@ -754,15 +754,13 @@ static void snd_uart16550_output_trigger
80983 snd_uart16550_output_write(substream);
80984 }
80985
80986 -static struct snd_rawmidi_ops snd_uart16550_output =
80987 -{
80988 +static const struct snd_rawmidi_ops snd_uart16550_output = {
80989 .open = snd_uart16550_output_open,
80990 .close = snd_uart16550_output_close,
80991 .trigger = snd_uart16550_output_trigger,
80992 };
80993
80994 -static struct snd_rawmidi_ops snd_uart16550_input =
80995 -{
80996 +static const struct snd_rawmidi_ops snd_uart16550_input = {
80997 .open = snd_uart16550_input_open,
80998 .close = snd_uart16550_input_close,
80999 .trigger = snd_uart16550_input_trigger,
81000 @@ -792,7 +790,7 @@ static int __devinit snd_uart16550_creat
81001 int droponfull,
81002 struct snd_uart16550 **ruart)
81003 {
81004 - static struct snd_device_ops ops = {
81005 + static const struct snd_device_ops ops = {
81006 .dev_free = snd_uart16550_dev_free,
81007 };
81008 struct snd_uart16550 *uart;
81009 diff -urNp linux-2.6.39.1/sound/drivers/vx/vx_pcm.c linux-2.6.39.1/sound/drivers/vx/vx_pcm.c
81010 --- linux-2.6.39.1/sound/drivers/vx/vx_pcm.c 2011-05-19 00:06:34.000000000 -0400
81011 +++ linux-2.6.39.1/sound/drivers/vx/vx_pcm.c 2011-05-22 19:36:35.000000000 -0400
81012 @@ -895,7 +895,7 @@ static int vx_pcm_prepare(struct snd_pcm
81013 /*
81014 * operators for PCM playback
81015 */
81016 -static struct snd_pcm_ops vx_pcm_playback_ops = {
81017 +static const struct snd_pcm_ops vx_pcm_playback_ops = {
81018 .open = vx_pcm_playback_open,
81019 .close = vx_pcm_playback_close,
81020 .ioctl = snd_pcm_lib_ioctl,
81021 @@ -1116,7 +1116,7 @@ static snd_pcm_uframes_t vx_pcm_capture_
81022 /*
81023 * operators for PCM capture
81024 */
81025 -static struct snd_pcm_ops vx_pcm_capture_ops = {
81026 +static const struct snd_pcm_ops vx_pcm_capture_ops = {
81027 .open = vx_pcm_capture_open,
81028 .close = vx_pcm_capture_close,
81029 .ioctl = snd_pcm_lib_ioctl,
81030 diff -urNp linux-2.6.39.1/sound/firewire/amdtp.c linux-2.6.39.1/sound/firewire/amdtp.c
81031 --- linux-2.6.39.1/sound/firewire/amdtp.c 2011-05-19 00:06:34.000000000 -0400
81032 +++ linux-2.6.39.1/sound/firewire/amdtp.c 2011-05-22 19:36:35.000000000 -0400
81033 @@ -371,7 +371,7 @@ static void queue_out_packet(struct amdt
81034 ptr = s->pcm_buffer_pointer + data_blocks;
81035 if (ptr >= pcm->runtime->buffer_size)
81036 ptr -= pcm->runtime->buffer_size;
81037 - ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
81038 + ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
81039
81040 s->pcm_period_pointer += data_blocks;
81041 if (s->pcm_period_pointer >= pcm->runtime->period_size) {
81042 @@ -510,7 +510,7 @@ EXPORT_SYMBOL(amdtp_out_stream_start);
81043 */
81044 void amdtp_out_stream_update(struct amdtp_out_stream *s)
81045 {
81046 - ACCESS_ONCE(s->source_node_id_field) =
81047 + ACCESS_ONCE_RW(s->source_node_id_field) =
81048 (fw_parent_device(s->unit)->card->node_id & 0x3f) << 24;
81049 }
81050 EXPORT_SYMBOL(amdtp_out_stream_update);
81051 diff -urNp linux-2.6.39.1/sound/firewire/amdtp.h linux-2.6.39.1/sound/firewire/amdtp.h
81052 --- linux-2.6.39.1/sound/firewire/amdtp.h 2011-05-19 00:06:34.000000000 -0400
81053 +++ linux-2.6.39.1/sound/firewire/amdtp.h 2011-05-22 19:36:35.000000000 -0400
81054 @@ -146,7 +146,7 @@ static inline void amdtp_out_stream_pcm_
81055 static inline void amdtp_out_stream_pcm_trigger(struct amdtp_out_stream *s,
81056 struct snd_pcm_substream *pcm)
81057 {
81058 - ACCESS_ONCE(s->pcm) = pcm;
81059 + ACCESS_ONCE_RW(s->pcm) = pcm;
81060 }
81061
81062 /**
81063 diff -urNp linux-2.6.39.1/sound/i2c/i2c.c linux-2.6.39.1/sound/i2c/i2c.c
81064 --- linux-2.6.39.1/sound/i2c/i2c.c 2011-05-19 00:06:34.000000000 -0400
81065 +++ linux-2.6.39.1/sound/i2c/i2c.c 2011-05-22 19:36:35.000000000 -0400
81066 @@ -80,7 +80,7 @@ int snd_i2c_bus_create(struct snd_card *
81067 {
81068 struct snd_i2c_bus *bus;
81069 int err;
81070 - static struct snd_device_ops ops = {
81071 + static const struct snd_device_ops ops = {
81072 .dev_free = snd_i2c_bus_dev_free,
81073 };
81074
81075 diff -urNp linux-2.6.39.1/sound/i2c/other/ak4113.c linux-2.6.39.1/sound/i2c/other/ak4113.c
81076 --- linux-2.6.39.1/sound/i2c/other/ak4113.c 2011-05-19 00:06:34.000000000 -0400
81077 +++ linux-2.6.39.1/sound/i2c/other/ak4113.c 2011-05-22 19:36:35.000000000 -0400
81078 @@ -75,7 +75,7 @@ int snd_ak4113_create(struct snd_card *c
81079 struct ak4113 *chip;
81080 int err = 0;
81081 unsigned char reg;
81082 - static struct snd_device_ops ops = {
81083 + static const struct snd_device_ops ops = {
81084 .dev_free = snd_ak4113_dev_free,
81085 };
81086
81087 diff -urNp linux-2.6.39.1/sound/i2c/other/ak4114.c linux-2.6.39.1/sound/i2c/other/ak4114.c
81088 --- linux-2.6.39.1/sound/i2c/other/ak4114.c 2011-05-19 00:06:34.000000000 -0400
81089 +++ linux-2.6.39.1/sound/i2c/other/ak4114.c 2011-05-22 19:36:35.000000000 -0400
81090 @@ -86,7 +86,7 @@ int snd_ak4114_create(struct snd_card *c
81091 struct ak4114 *chip;
81092 int err = 0;
81093 unsigned char reg;
81094 - static struct snd_device_ops ops = {
81095 + static const struct snd_device_ops ops = {
81096 .dev_free = snd_ak4114_dev_free,
81097 };
81098
81099 diff -urNp linux-2.6.39.1/sound/i2c/other/ak4117.c linux-2.6.39.1/sound/i2c/other/ak4117.c
81100 --- linux-2.6.39.1/sound/i2c/other/ak4117.c 2011-05-19 00:06:34.000000000 -0400
81101 +++ linux-2.6.39.1/sound/i2c/other/ak4117.c 2011-05-22 19:36:35.000000000 -0400
81102 @@ -78,7 +78,7 @@ int snd_ak4117_create(struct snd_card *c
81103 struct ak4117 *chip;
81104 int err = 0;
81105 unsigned char reg;
81106 - static struct snd_device_ops ops = {
81107 + static const struct snd_device_ops ops = {
81108 .dev_free = snd_ak4117_dev_free,
81109 };
81110
81111 diff -urNp linux-2.6.39.1/sound/isa/ad1816a/ad1816a_lib.c linux-2.6.39.1/sound/isa/ad1816a/ad1816a_lib.c
81112 --- linux-2.6.39.1/sound/isa/ad1816a/ad1816a_lib.c 2011-05-19 00:06:34.000000000 -0400
81113 +++ linux-2.6.39.1/sound/isa/ad1816a/ad1816a_lib.c 2011-05-22 19:36:35.000000000 -0400
81114 @@ -575,7 +575,7 @@ int __devinit snd_ad1816a_create(struct
81115 unsigned long port, int irq, int dma1, int dma2,
81116 struct snd_ad1816a **rchip)
81117 {
81118 - static struct snd_device_ops ops = {
81119 + static const struct snd_device_ops ops = {
81120 .dev_free = snd_ad1816a_dev_free,
81121 };
81122 int error;
81123 diff -urNp linux-2.6.39.1/sound/isa/es1688/es1688_lib.c linux-2.6.39.1/sound/isa/es1688/es1688_lib.c
81124 --- linux-2.6.39.1/sound/isa/es1688/es1688_lib.c 2011-05-19 00:06:34.000000000 -0400
81125 +++ linux-2.6.39.1/sound/isa/es1688/es1688_lib.c 2011-05-22 19:36:35.000000000 -0400
81126 @@ -646,7 +646,7 @@ int snd_es1688_create(struct snd_card *c
81127 int dma8,
81128 unsigned short hardware)
81129 {
81130 - static struct snd_device_ops ops = {
81131 + static const struct snd_device_ops ops = {
81132 .dev_free = snd_es1688_dev_free,
81133 };
81134
81135 diff -urNp linux-2.6.39.1/sound/isa/es18xx.c linux-2.6.39.1/sound/isa/es18xx.c
81136 --- linux-2.6.39.1/sound/isa/es18xx.c 2011-05-19 00:06:34.000000000 -0400
81137 +++ linux-2.6.39.1/sound/isa/es18xx.c 2011-05-22 19:36:35.000000000 -0400
81138 @@ -1658,7 +1658,7 @@ static int __devinit snd_es18xx_probe(st
81139 return snd_es18xx_initialize(chip, mpu_port, fm_port);
81140 }
81141
81142 -static struct snd_pcm_ops snd_es18xx_playback_ops = {
81143 +static const struct snd_pcm_ops snd_es18xx_playback_ops = {
81144 .open = snd_es18xx_playback_open,
81145 .close = snd_es18xx_playback_close,
81146 .ioctl = snd_pcm_lib_ioctl,
81147 @@ -1669,7 +1669,7 @@ static struct snd_pcm_ops snd_es18xx_pla
81148 .pointer = snd_es18xx_playback_pointer,
81149 };
81150
81151 -static struct snd_pcm_ops snd_es18xx_capture_ops = {
81152 +static const struct snd_pcm_ops snd_es18xx_capture_ops = {
81153 .open = snd_es18xx_capture_open,
81154 .close = snd_es18xx_capture_close,
81155 .ioctl = snd_pcm_lib_ioctl,
81156 @@ -1784,7 +1784,7 @@ static int __devinit snd_es18xx_new_devi
81157 int irq, int dma1, int dma2)
81158 {
81159 struct snd_es18xx *chip = card->private_data;
81160 - static struct snd_device_ops ops = {
81161 + static const struct snd_device_ops ops = {
81162 .dev_free = snd_es18xx_dev_free,
81163 };
81164 int err;
81165 diff -urNp linux-2.6.39.1/sound/isa/gus/gus_main.c linux-2.6.39.1/sound/isa/gus/gus_main.c
81166 --- linux-2.6.39.1/sound/isa/gus/gus_main.c 2011-05-19 00:06:34.000000000 -0400
81167 +++ linux-2.6.39.1/sound/isa/gus/gus_main.c 2011-05-22 19:36:35.000000000 -0400
81168 @@ -139,7 +139,7 @@ int snd_gus_create(struct snd_card *card
81169 {
81170 struct snd_gus_card *gus;
81171 int err;
81172 - static struct snd_device_ops ops = {
81173 + static const struct snd_device_ops ops = {
81174 .dev_free = snd_gus_dev_free,
81175 };
81176
81177 diff -urNp linux-2.6.39.1/sound/isa/msnd/msnd.c linux-2.6.39.1/sound/isa/msnd/msnd.c
81178 --- linux-2.6.39.1/sound/isa/msnd/msnd.c 2011-05-19 00:06:34.000000000 -0400
81179 +++ linux-2.6.39.1/sound/isa/msnd/msnd.c 2011-05-22 19:36:35.000000000 -0400
81180 @@ -570,7 +570,7 @@ snd_msnd_playback_pointer(struct snd_pcm
81181 }
81182
81183
81184 -static struct snd_pcm_ops snd_msnd_playback_ops = {
81185 +static const struct snd_pcm_ops snd_msnd_playback_ops = {
81186 .open = snd_msnd_playback_open,
81187 .close = snd_msnd_playback_close,
81188 .ioctl = snd_pcm_lib_ioctl,
81189 @@ -667,7 +667,7 @@ static int snd_msnd_capture_hw_params(st
81190 }
81191
81192
81193 -static struct snd_pcm_ops snd_msnd_capture_ops = {
81194 +static const struct snd_pcm_ops snd_msnd_capture_ops = {
81195 .open = snd_msnd_capture_open,
81196 .close = snd_msnd_capture_close,
81197 .ioctl = snd_pcm_lib_ioctl,
81198 diff -urNp linux-2.6.39.1/sound/isa/msnd/msnd_midi.c linux-2.6.39.1/sound/isa/msnd/msnd_midi.c
81199 --- linux-2.6.39.1/sound/isa/msnd/msnd_midi.c 2011-05-19 00:06:34.000000000 -0400
81200 +++ linux-2.6.39.1/sound/isa/msnd/msnd_midi.c 2011-05-22 19:36:35.000000000 -0400
81201 @@ -141,7 +141,7 @@ void snd_msndmidi_input_read(void *mpuv)
81202 }
81203 EXPORT_SYMBOL(snd_msndmidi_input_read);
81204
81205 -static struct snd_rawmidi_ops snd_msndmidi_input = {
81206 +static const struct snd_rawmidi_ops snd_msndmidi_input = {
81207 .open = snd_msndmidi_input_open,
81208 .close = snd_msndmidi_input_close,
81209 .trigger = snd_msndmidi_input_trigger,
81210 diff -urNp linux-2.6.39.1/sound/isa/msnd/msnd_pinnacle.c linux-2.6.39.1/sound/isa/msnd/msnd_pinnacle.c
81211 --- linux-2.6.39.1/sound/isa/msnd/msnd_pinnacle.c 2011-05-19 00:06:34.000000000 -0400
81212 +++ linux-2.6.39.1/sound/isa/msnd/msnd_pinnacle.c 2011-05-22 19:36:35.000000000 -0400
81213 @@ -539,7 +539,7 @@ static int __devinit snd_msnd_attach(str
81214 {
81215 struct snd_msnd *chip = card->private_data;
81216 int err;
81217 - static struct snd_device_ops ops = {
81218 + static const struct snd_device_ops ops = {
81219 .dev_free = snd_msnd_dev_free,
81220 };
81221
81222 diff -urNp linux-2.6.39.1/sound/isa/sb/emu8000.c linux-2.6.39.1/sound/isa/sb/emu8000.c
81223 --- linux-2.6.39.1/sound/isa/sb/emu8000.c 2011-05-19 00:06:34.000000000 -0400
81224 +++ linux-2.6.39.1/sound/isa/sb/emu8000.c 2011-05-22 19:36:35.000000000 -0400
81225 @@ -1079,7 +1079,7 @@ snd_emu8000_new(struct snd_card *card, i
81226 struct snd_seq_device *awe;
81227 struct snd_emu8000 *hw;
81228 int err;
81229 - static struct snd_device_ops ops = {
81230 + static const struct snd_device_ops ops = {
81231 .dev_free = snd_emu8000_dev_free,
81232 };
81233
81234 diff -urNp linux-2.6.39.1/sound/isa/sb/emu8000_pcm.c linux-2.6.39.1/sound/isa/sb/emu8000_pcm.c
81235 --- linux-2.6.39.1/sound/isa/sb/emu8000_pcm.c 2011-05-19 00:06:34.000000000 -0400
81236 +++ linux-2.6.39.1/sound/isa/sb/emu8000_pcm.c 2011-05-22 19:36:35.000000000 -0400
81237 @@ -667,7 +667,7 @@ static snd_pcm_uframes_t emu8k_pcm_point
81238 }
81239
81240
81241 -static struct snd_pcm_ops emu8k_pcm_ops = {
81242 +static const struct snd_pcm_ops emu8k_pcm_ops = {
81243 .open = emu8k_pcm_open,
81244 .close = emu8k_pcm_close,
81245 .ioctl = snd_pcm_lib_ioctl,
81246 diff -urNp linux-2.6.39.1/sound/isa/sb/sb_common.c linux-2.6.39.1/sound/isa/sb/sb_common.c
81247 --- linux-2.6.39.1/sound/isa/sb/sb_common.c 2011-05-19 00:06:34.000000000 -0400
81248 +++ linux-2.6.39.1/sound/isa/sb/sb_common.c 2011-05-22 19:36:35.000000000 -0400
81249 @@ -218,7 +218,7 @@ int snd_sbdsp_create(struct snd_card *ca
81250 {
81251 struct snd_sb *chip;
81252 int err;
81253 - static struct snd_device_ops ops = {
81254 + static const struct snd_device_ops ops = {
81255 .dev_free = snd_sbdsp_dev_free,
81256 };
81257
81258 diff -urNp linux-2.6.39.1/sound/isa/wavefront/wavefront_midi.c linux-2.6.39.1/sound/isa/wavefront/wavefront_midi.c
81259 --- linux-2.6.39.1/sound/isa/wavefront/wavefront_midi.c 2011-05-19 00:06:34.000000000 -0400
81260 +++ linux-2.6.39.1/sound/isa/wavefront/wavefront_midi.c 2011-05-22 19:36:35.000000000 -0400
81261 @@ -561,14 +561,14 @@ snd_wavefront_midi_start (snd_wavefront_
81262 return 0;
81263 }
81264
81265 -struct snd_rawmidi_ops snd_wavefront_midi_output =
81266 +const struct snd_rawmidi_ops snd_wavefront_midi_output =
81267 {
81268 .open = snd_wavefront_midi_output_open,
81269 .close = snd_wavefront_midi_output_close,
81270 .trigger = snd_wavefront_midi_output_trigger,
81271 };
81272
81273 -struct snd_rawmidi_ops snd_wavefront_midi_input =
81274 +const struct snd_rawmidi_ops snd_wavefront_midi_input =
81275 {
81276 .open = snd_wavefront_midi_input_open,
81277 .close = snd_wavefront_midi_input_close,
81278 diff -urNp linux-2.6.39.1/sound/isa/wss/wss_lib.c linux-2.6.39.1/sound/isa/wss/wss_lib.c
81279 --- linux-2.6.39.1/sound/isa/wss/wss_lib.c 2011-05-19 00:06:34.000000000 -0400
81280 +++ linux-2.6.39.1/sound/isa/wss/wss_lib.c 2011-05-22 19:36:35.000000000 -0400
81281 @@ -1801,7 +1801,7 @@ int snd_wss_create(struct snd_card *card
81282 unsigned short hwshare,
81283 struct snd_wss **rchip)
81284 {
81285 - static struct snd_device_ops ops = {
81286 + static const struct snd_device_ops ops = {
81287 .dev_free = snd_wss_dev_free,
81288 };
81289 struct snd_wss *chip;
81290 diff -urNp linux-2.6.39.1/sound/mips/au1x00.c linux-2.6.39.1/sound/mips/au1x00.c
81291 --- linux-2.6.39.1/sound/mips/au1x00.c 2011-05-19 00:06:34.000000000 -0400
81292 +++ linux-2.6.39.1/sound/mips/au1x00.c 2011-05-22 19:36:35.000000000 -0400
81293 @@ -416,7 +416,7 @@ snd_au1000_pointer(struct snd_pcm_substr
81294 return bytes_to_frames(runtime,location);
81295 }
81296
81297 -static struct snd_pcm_ops snd_card_au1000_playback_ops = {
81298 +static const struct snd_pcm_ops snd_card_au1000_playback_ops = {
81299 .open = snd_au1000_playback_open,
81300 .close = snd_au1000_playback_close,
81301 .ioctl = snd_pcm_lib_ioctl,
81302 @@ -427,7 +427,7 @@ static struct snd_pcm_ops snd_card_au100
81303 .pointer = snd_au1000_pointer,
81304 };
81305
81306 -static struct snd_pcm_ops snd_card_au1000_capture_ops = {
81307 +static const struct snd_pcm_ops snd_card_au1000_capture_ops = {
81308 .open = snd_au1000_capture_open,
81309 .close = snd_au1000_capture_close,
81310 .ioctl = snd_pcm_lib_ioctl,
81311 @@ -557,7 +557,7 @@ snd_au1000_ac97_new(struct snd_au1000 *a
81312 int err;
81313 struct snd_ac97_bus *pbus;
81314 struct snd_ac97_template ac97;
81315 - static struct snd_ac97_bus_ops ops = {
81316 + static const struct snd_ac97_bus_ops ops = {
81317 .write = snd_au1000_ac97_write,
81318 .read = snd_au1000_ac97_read,
81319 };
81320 diff -urNp linux-2.6.39.1/sound/mips/hal2.c linux-2.6.39.1/sound/mips/hal2.c
81321 --- linux-2.6.39.1/sound/mips/hal2.c 2011-05-19 00:06:34.000000000 -0400
81322 +++ linux-2.6.39.1/sound/mips/hal2.c 2011-05-22 19:36:35.000000000 -0400
81323 @@ -708,7 +708,7 @@ static int hal2_capture_ack(struct snd_p
81324 return 0;
81325 }
81326
81327 -static struct snd_pcm_ops hal2_playback_ops = {
81328 +static const struct snd_pcm_ops hal2_playback_ops = {
81329 .open = hal2_playback_open,
81330 .close = hal2_playback_close,
81331 .ioctl = snd_pcm_lib_ioctl,
81332 @@ -720,7 +720,7 @@ static struct snd_pcm_ops hal2_playback_
81333 .ack = hal2_playback_ack,
81334 };
81335
81336 -static struct snd_pcm_ops hal2_capture_ops = {
81337 +static const struct snd_pcm_ops hal2_capture_ops = {
81338 .open = hal2_capture_open,
81339 .close = hal2_capture_close,
81340 .ioctl = snd_pcm_lib_ioctl,
81341 @@ -766,7 +766,7 @@ static int hal2_dev_free(struct snd_devi
81342 return 0;
81343 }
81344
81345 -static struct snd_device_ops hal2_ops = {
81346 +static const struct snd_device_ops hal2_ops = {
81347 .dev_free = hal2_dev_free,
81348 };
81349
81350 diff -urNp linux-2.6.39.1/sound/mips/sgio2audio.c linux-2.6.39.1/sound/mips/sgio2audio.c
81351 --- linux-2.6.39.1/sound/mips/sgio2audio.c 2011-05-19 00:06:34.000000000 -0400
81352 +++ linux-2.6.39.1/sound/mips/sgio2audio.c 2011-05-22 19:36:35.000000000 -0400
81353 @@ -681,7 +681,7 @@ snd_sgio2audio_pcm_pointer(struct snd_pc
81354 }
81355
81356 /* operators */
81357 -static struct snd_pcm_ops snd_sgio2audio_playback1_ops = {
81358 +static const struct snd_pcm_ops snd_sgio2audio_playback1_ops = {
81359 .open = snd_sgio2audio_playback1_open,
81360 .close = snd_sgio2audio_pcm_close,
81361 .ioctl = snd_pcm_lib_ioctl,
81362 @@ -694,7 +694,7 @@ static struct snd_pcm_ops snd_sgio2audio
81363 .mmap = snd_pcm_lib_mmap_vmalloc,
81364 };
81365
81366 -static struct snd_pcm_ops snd_sgio2audio_playback2_ops = {
81367 +static const struct snd_pcm_ops snd_sgio2audio_playback2_ops = {
81368 .open = snd_sgio2audio_playback2_open,
81369 .close = snd_sgio2audio_pcm_close,
81370 .ioctl = snd_pcm_lib_ioctl,
81371 @@ -707,7 +707,7 @@ static struct snd_pcm_ops snd_sgio2audio
81372 .mmap = snd_pcm_lib_mmap_vmalloc,
81373 };
81374
81375 -static struct snd_pcm_ops snd_sgio2audio_capture_ops = {
81376 +static const struct snd_pcm_ops snd_sgio2audio_capture_ops = {
81377 .open = snd_sgio2audio_capture_open,
81378 .close = snd_sgio2audio_pcm_close,
81379 .ioctl = snd_pcm_lib_ioctl,
81380 @@ -829,7 +829,7 @@ static int snd_sgio2audio_dev_free(struc
81381 return snd_sgio2audio_free(chip);
81382 }
81383
81384 -static struct snd_device_ops ops = {
81385 +static const struct snd_device_ops ops = {
81386 .dev_free = snd_sgio2audio_dev_free,
81387 };
81388
81389 diff -urNp linux-2.6.39.1/sound/oss/ac97_codec.c linux-2.6.39.1/sound/oss/ac97_codec.c
81390 --- linux-2.6.39.1/sound/oss/ac97_codec.c 2011-05-19 00:06:34.000000000 -0400
81391 +++ linux-2.6.39.1/sound/oss/ac97_codec.c 2011-05-22 19:36:35.000000000 -0400
81392 @@ -99,23 +99,23 @@ static int generic_digital_control(struc
81393 * operations yet
81394 */
81395
81396 -static struct ac97_ops null_ops = { NULL, NULL, NULL };
81397 -static struct ac97_ops default_ops = { NULL, eapd_control, NULL };
81398 -static struct ac97_ops default_digital_ops = { NULL, eapd_control, generic_digital_control};
81399 -static struct ac97_ops wolfson_ops03 = { wolfson_init03, NULL, NULL };
81400 -static struct ac97_ops wolfson_ops04 = { wolfson_init04, NULL, NULL };
81401 -static struct ac97_ops wolfson_ops05 = { wolfson_init05, NULL, NULL };
81402 -static struct ac97_ops wolfson_ops11 = { wolfson_init11, NULL, NULL };
81403 -static struct ac97_ops wolfson_ops13 = { wolfson_init13, NULL, NULL };
81404 -static struct ac97_ops tritech_ops = { tritech_init, NULL, NULL };
81405 -static struct ac97_ops tritech_m_ops = { tritech_maestro_init, NULL, NULL };
81406 -static struct ac97_ops sigmatel_9708_ops = { sigmatel_9708_init, NULL, NULL };
81407 -static struct ac97_ops sigmatel_9721_ops = { sigmatel_9721_init, NULL, NULL };
81408 -static struct ac97_ops sigmatel_9744_ops = { sigmatel_9744_init, NULL, NULL };
81409 -static struct ac97_ops crystal_digital_ops = { NULL, eapd_control, crystal_digital_control };
81410 -static struct ac97_ops ad1886_ops = { ad1886_init, eapd_control, NULL };
81411 -static struct ac97_ops cmedia_ops = { NULL, eapd_control, NULL};
81412 -static struct ac97_ops cmedia_digital_ops = { cmedia_init, eapd_control, cmedia_digital_control};
81413 +static const struct ac97_ops null_ops = { NULL, NULL, NULL };
81414 +static const struct ac97_ops default_ops = { NULL, eapd_control, NULL };
81415 +static const struct ac97_ops default_digital_ops = { NULL, eapd_control, generic_digital_control};
81416 +static const struct ac97_ops wolfson_ops03 = { wolfson_init03, NULL, NULL };
81417 +static const struct ac97_ops wolfson_ops04 = { wolfson_init04, NULL, NULL };
81418 +static const struct ac97_ops wolfson_ops05 = { wolfson_init05, NULL, NULL };
81419 +static const struct ac97_ops wolfson_ops11 = { wolfson_init11, NULL, NULL };
81420 +static const struct ac97_ops wolfson_ops13 = { wolfson_init13, NULL, NULL };
81421 +static const struct ac97_ops tritech_ops = { tritech_init, NULL, NULL };
81422 +static const struct ac97_ops tritech_m_ops = { tritech_maestro_init, NULL, NULL };
81423 +static const struct ac97_ops sigmatel_9708_ops = { sigmatel_9708_init, NULL, NULL };
81424 +static const struct ac97_ops sigmatel_9721_ops = { sigmatel_9721_init, NULL, NULL };
81425 +static const struct ac97_ops sigmatel_9744_ops = { sigmatel_9744_init, NULL, NULL };
81426 +static const struct ac97_ops crystal_digital_ops = { NULL, eapd_control, crystal_digital_control };
81427 +static const struct ac97_ops ad1886_ops = { ad1886_init, eapd_control, NULL };
81428 +static const struct ac97_ops cmedia_ops = { NULL, eapd_control, NULL};
81429 +static const struct ac97_ops cmedia_digital_ops = { cmedia_init, eapd_control, cmedia_digital_control};
81430
81431 /* sorted by vendor/device id */
81432 static const struct {
81433 diff -urNp linux-2.6.39.1/sound/oss/sb_audio.c linux-2.6.39.1/sound/oss/sb_audio.c
81434 --- linux-2.6.39.1/sound/oss/sb_audio.c 2011-05-19 00:06:34.000000000 -0400
81435 +++ linux-2.6.39.1/sound/oss/sb_audio.c 2011-05-22 19:36:35.000000000 -0400
81436 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
81437 buf16 = (signed short *)(localbuf + localoffs);
81438 while (c)
81439 {
81440 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
81441 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
81442 if (copy_from_user(lbuf8,
81443 userbuf+useroffs + p,
81444 locallen))
81445 diff -urNp linux-2.6.39.1/sound/oss/swarm_cs4297a.c linux-2.6.39.1/sound/oss/swarm_cs4297a.c
81446 --- linux-2.6.39.1/sound/oss/swarm_cs4297a.c 2011-05-19 00:06:34.000000000 -0400
81447 +++ linux-2.6.39.1/sound/oss/swarm_cs4297a.c 2011-05-22 19:36:35.000000000 -0400
81448 @@ -2606,7 +2606,6 @@ static int __init cs4297a_init(void)
81449 {
81450 struct cs4297a_state *s;
81451 u32 pwr, id;
81452 - mm_segment_t fs;
81453 int rval;
81454 #ifndef CONFIG_BCM_CS4297A_CSWARM
81455 u64 cfg;
81456 @@ -2696,22 +2695,23 @@ static int __init cs4297a_init(void)
81457 if (!rval) {
81458 char *sb1250_duart_present;
81459
81460 +#if 0
81461 + mm_segment_t fs;
81462 fs = get_fs();
81463 set_fs(KERNEL_DS);
81464 -#if 0
81465 val = SOUND_MASK_LINE;
81466 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
81467 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
81468 val = initvol[i].vol;
81469 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
81470 }
81471 + set_fs(fs);
81472 // cs4297a_write_ac97(s, 0x18, 0x0808);
81473 #else
81474 // cs4297a_write_ac97(s, 0x5e, 0x180);
81475 cs4297a_write_ac97(s, 0x02, 0x0808);
81476 cs4297a_write_ac97(s, 0x18, 0x0808);
81477 #endif
81478 - set_fs(fs);
81479
81480 list_add(&s->list, &cs4297a_devs);
81481
81482 diff -urNp linux-2.6.39.1/sound/parisc/harmony.c linux-2.6.39.1/sound/parisc/harmony.c
81483 --- linux-2.6.39.1/sound/parisc/harmony.c 2011-05-19 00:06:34.000000000 -0400
81484 +++ linux-2.6.39.1/sound/parisc/harmony.c 2011-05-22 19:36:35.000000000 -0400
81485 @@ -596,7 +596,7 @@ snd_harmony_hw_free(struct snd_pcm_subst
81486 return snd_pcm_lib_free_pages(ss);
81487 }
81488
81489 -static struct snd_pcm_ops snd_harmony_playback_ops = {
81490 +static const struct snd_pcm_ops snd_harmony_playback_ops = {
81491 .open = snd_harmony_playback_open,
81492 .close = snd_harmony_playback_close,
81493 .ioctl = snd_pcm_lib_ioctl,
81494 @@ -607,7 +607,7 @@ static struct snd_pcm_ops snd_harmony_pl
81495 .pointer = snd_harmony_playback_pointer,
81496 };
81497
81498 -static struct snd_pcm_ops snd_harmony_capture_ops = {
81499 +static const struct snd_pcm_ops snd_harmony_capture_ops = {
81500 .open = snd_harmony_capture_open,
81501 .close = snd_harmony_capture_close,
81502 .ioctl = snd_pcm_lib_ioctl,
81503 @@ -922,7 +922,7 @@ snd_harmony_create(struct snd_card *card
81504 {
81505 int err;
81506 struct snd_harmony *h;
81507 - static struct snd_device_ops ops = {
81508 + static const struct snd_device_ops ops = {
81509 .dev_free = snd_harmony_dev_free,
81510 };
81511
81512 diff -urNp linux-2.6.39.1/sound/pci/ac97/ac97_codec.c linux-2.6.39.1/sound/pci/ac97/ac97_codec.c
81513 --- linux-2.6.39.1/sound/pci/ac97/ac97_codec.c 2011-05-19 00:06:34.000000000 -0400
81514 +++ linux-2.6.39.1/sound/pci/ac97/ac97_codec.c 2011-05-22 19:36:35.000000000 -0400
81515 @@ -1910,12 +1910,12 @@ static int ac97_reset_wait(struct snd_ac
81516 *
81517 * Returns zero if successful, or a negative error code on failure.
81518 */
81519 -int snd_ac97_bus(struct snd_card *card, int num, struct snd_ac97_bus_ops *ops,
81520 +int snd_ac97_bus(struct snd_card *card, int num, const struct snd_ac97_bus_ops *ops,
81521 void *private_data, struct snd_ac97_bus **rbus)
81522 {
81523 int err;
81524 struct snd_ac97_bus *bus;
81525 - static struct snd_device_ops dev_ops = {
81526 + static const struct snd_device_ops dev_ops = {
81527 .dev_free = snd_ac97_bus_dev_free,
81528 };
81529
81530 @@ -2015,7 +2015,7 @@ int snd_ac97_mixer(struct snd_ac97_bus *
81531 unsigned long end_time;
81532 unsigned int reg;
81533 const struct ac97_codec_id *pid;
81534 - static struct snd_device_ops ops = {
81535 + static const struct snd_device_ops ops = {
81536 .dev_free = snd_ac97_dev_free,
81537 .dev_register = snd_ac97_dev_register,
81538 .dev_disconnect = snd_ac97_dev_disconnect,
81539 diff -urNp linux-2.6.39.1/sound/pci/ad1889.c linux-2.6.39.1/sound/pci/ad1889.c
81540 --- linux-2.6.39.1/sound/pci/ad1889.c 2011-05-19 00:06:34.000000000 -0400
81541 +++ linux-2.6.39.1/sound/pci/ad1889.c 2011-05-22 19:36:35.000000000 -0400
81542 @@ -574,7 +574,7 @@ snd_ad1889_capture_pointer(struct snd_pc
81543 return bytes_to_frames(ss->runtime, ptr);
81544 }
81545
81546 -static struct snd_pcm_ops snd_ad1889_playback_ops = {
81547 +static const struct snd_pcm_ops snd_ad1889_playback_ops = {
81548 .open = snd_ad1889_playback_open,
81549 .close = snd_ad1889_playback_close,
81550 .ioctl = snd_pcm_lib_ioctl,
81551 @@ -585,7 +585,7 @@ static struct snd_pcm_ops snd_ad1889_pla
81552 .pointer = snd_ad1889_playback_pointer,
81553 };
81554
81555 -static struct snd_pcm_ops snd_ad1889_capture_ops = {
81556 +static const struct snd_pcm_ops snd_ad1889_capture_ops = {
81557 .open = snd_ad1889_capture_open,
81558 .close = snd_ad1889_capture_close,
81559 .ioctl = snd_pcm_lib_ioctl,
81560 @@ -809,7 +809,7 @@ snd_ad1889_ac97_init(struct snd_ad1889 *
81561 {
81562 int err;
81563 struct snd_ac97_template ac97;
81564 - static struct snd_ac97_bus_ops ops = {
81565 + static const struct snd_ac97_bus_ops ops = {
81566 .write = snd_ad1889_ac97_write,
81567 .read = snd_ad1889_ac97_read,
81568 };
81569 @@ -899,7 +899,7 @@ snd_ad1889_create(struct snd_card *card,
81570 int err;
81571
81572 struct snd_ad1889 *chip;
81573 - static struct snd_device_ops ops = {
81574 + static const struct snd_device_ops ops = {
81575 .dev_free = snd_ad1889_dev_free,
81576 };
81577
81578 diff -urNp linux-2.6.39.1/sound/pci/ak4531_codec.c linux-2.6.39.1/sound/pci/ak4531_codec.c
81579 --- linux-2.6.39.1/sound/pci/ak4531_codec.c 2011-05-19 00:06:34.000000000 -0400
81580 +++ linux-2.6.39.1/sound/pci/ak4531_codec.c 2011-05-22 19:36:35.000000000 -0400
81581 @@ -389,7 +389,7 @@ int __devinit snd_ak4531_mixer(struct sn
81582 unsigned int idx;
81583 int err;
81584 struct snd_ak4531 *ak4531;
81585 - static struct snd_device_ops ops = {
81586 + static const struct snd_device_ops ops = {
81587 .dev_free = snd_ak4531_dev_free,
81588 };
81589
81590 diff -urNp linux-2.6.39.1/sound/pci/ali5451/ali5451.c linux-2.6.39.1/sound/pci/ali5451/ali5451.c
81591 --- linux-2.6.39.1/sound/pci/ali5451/ali5451.c 2011-05-19 00:06:34.000000000 -0400
81592 +++ linux-2.6.39.1/sound/pci/ali5451/ali5451.c 2011-05-22 19:36:35.000000000 -0400
81593 @@ -1847,7 +1847,7 @@ static int __devinit snd_ali_mixer(struc
81594 struct snd_ac97_template ac97;
81595 unsigned int idx;
81596 int i, err;
81597 - static struct snd_ac97_bus_ops ops = {
81598 + static const struct snd_ac97_bus_ops ops = {
81599 .write = snd_ali_codec_write,
81600 .read = snd_ali_codec_read,
81601 };
81602 @@ -2114,7 +2114,7 @@ static int __devinit snd_ali_create(stru
81603 struct snd_ali *codec;
81604 int i, err;
81605 unsigned short cmdw;
81606 - static struct snd_device_ops ops = {
81607 + static const struct snd_device_ops ops = {
81608 .dev_free = snd_ali_dev_free,
81609 };
81610
81611 diff -urNp linux-2.6.39.1/sound/pci/als300.c linux-2.6.39.1/sound/pci/als300.c
81612 --- linux-2.6.39.1/sound/pci/als300.c 2011-05-19 00:06:34.000000000 -0400
81613 +++ linux-2.6.39.1/sound/pci/als300.c 2011-05-22 19:36:35.000000000 -0400
81614 @@ -319,7 +319,7 @@ static int snd_als300_ac97(struct snd_al
81615 struct snd_ac97_bus *bus;
81616 struct snd_ac97_template ac97;
81617 int err;
81618 - static struct snd_ac97_bus_ops ops = {
81619 + static const struct snd_ac97_bus_ops ops = {
81620 .write = snd_als300_ac97_write,
81621 .read = snd_als300_ac97_read,
81622 };
81623 @@ -589,7 +589,7 @@ static snd_pcm_uframes_t snd_als300_poin
81624 return bytes_to_frames(substream->runtime, current_ptr);
81625 }
81626
81627 -static struct snd_pcm_ops snd_als300_playback_ops = {
81628 +static const struct snd_pcm_ops snd_als300_playback_ops = {
81629 .open = snd_als300_playback_open,
81630 .close = snd_als300_playback_close,
81631 .ioctl = snd_pcm_lib_ioctl,
81632 @@ -600,7 +600,7 @@ static struct snd_pcm_ops snd_als300_pla
81633 .pointer = snd_als300_pointer,
81634 };
81635
81636 -static struct snd_pcm_ops snd_als300_capture_ops = {
81637 +static const struct snd_pcm_ops snd_als300_capture_ops = {
81638 .open = snd_als300_capture_open,
81639 .close = snd_als300_capture_close,
81640 .ioctl = snd_pcm_lib_ioctl,
81641 @@ -680,7 +680,7 @@ static int __devinit snd_als300_create(s
81642 void *irq_handler;
81643 int err;
81644
81645 - static struct snd_device_ops ops = {
81646 + static const struct snd_device_ops ops = {
81647 .dev_free = snd_als300_dev_free,
81648 };
81649 *rchip = NULL;
81650 diff -urNp linux-2.6.39.1/sound/pci/als4000.c linux-2.6.39.1/sound/pci/als4000.c
81651 --- linux-2.6.39.1/sound/pci/als4000.c 2011-05-19 00:06:34.000000000 -0400
81652 +++ linux-2.6.39.1/sound/pci/als4000.c 2011-05-22 19:36:35.000000000 -0400
81653 @@ -672,7 +672,7 @@ static int snd_als4000_capture_close(str
81654
81655 /******************************************************************/
81656
81657 -static struct snd_pcm_ops snd_als4000_playback_ops = {
81658 +static const struct snd_pcm_ops snd_als4000_playback_ops = {
81659 .open = snd_als4000_playback_open,
81660 .close = snd_als4000_playback_close,
81661 .ioctl = snd_pcm_lib_ioctl,
81662 @@ -683,7 +683,7 @@ static struct snd_pcm_ops snd_als4000_pl
81663 .pointer = snd_als4000_playback_pointer
81664 };
81665
81666 -static struct snd_pcm_ops snd_als4000_capture_ops = {
81667 +static const struct snd_pcm_ops snd_als4000_capture_ops = {
81668 .open = snd_als4000_capture_open,
81669 .close = snd_als4000_capture_close,
81670 .ioctl = snd_pcm_lib_ioctl,
81671 diff -urNp linux-2.6.39.1/sound/pci/asihpi/asihpi.c linux-2.6.39.1/sound/pci/asihpi/asihpi.c
81672 --- linux-2.6.39.1/sound/pci/asihpi/asihpi.c 2011-05-19 00:06:34.000000000 -0400
81673 +++ linux-2.6.39.1/sound/pci/asihpi/asihpi.c 2011-05-22 19:36:35.000000000 -0400
81674 @@ -1067,7 +1067,7 @@ static int snd_card_asihpi_playback_sile
81675 return 0;
81676 }
81677
81678 -static struct snd_pcm_ops snd_card_asihpi_playback_ops = {
81679 +static const struct snd_pcm_ops snd_card_asihpi_playback_ops = {
81680 .open = snd_card_asihpi_playback_open,
81681 .close = snd_card_asihpi_playback_close,
81682 .ioctl = snd_card_asihpi_playback_ioctl,
81683 @@ -1080,7 +1080,7 @@ static struct snd_pcm_ops snd_card_asihp
81684 .silence = snd_card_asihpi_playback_silence,
81685 };
81686
81687 -static struct snd_pcm_ops snd_card_asihpi_playback_mmap_ops = {
81688 +static const struct snd_pcm_ops snd_card_asihpi_playback_mmap_ops = {
81689 .open = snd_card_asihpi_playback_open,
81690 .close = snd_card_asihpi_playback_close,
81691 .ioctl = snd_card_asihpi_playback_ioctl,
81692 @@ -1268,7 +1268,7 @@ static int snd_card_asihpi_capture_copy(
81693 return 0;
81694 }
81695
81696 -static struct snd_pcm_ops snd_card_asihpi_capture_mmap_ops = {
81697 +static const struct snd_pcm_ops snd_card_asihpi_capture_mmap_ops = {
81698 .open = snd_card_asihpi_capture_open,
81699 .close = snd_card_asihpi_capture_close,
81700 .ioctl = snd_card_asihpi_capture_ioctl,
81701 @@ -1279,7 +1279,7 @@ static struct snd_pcm_ops snd_card_asihp
81702 .pointer = snd_card_asihpi_capture_pointer,
81703 };
81704
81705 -static struct snd_pcm_ops snd_card_asihpi_capture_ops = {
81706 +static const struct snd_pcm_ops snd_card_asihpi_capture_ops = {
81707 .open = snd_card_asihpi_capture_open,
81708 .close = snd_card_asihpi_capture_close,
81709 .ioctl = snd_card_asihpi_capture_ioctl,
81710 diff -urNp linux-2.6.39.1/sound/pci/atiixp.c linux-2.6.39.1/sound/pci/atiixp.c
81711 --- linux-2.6.39.1/sound/pci/atiixp.c 2011-05-19 00:06:34.000000000 -0400
81712 +++ linux-2.6.39.1/sound/pci/atiixp.c 2011-05-22 19:36:35.000000000 -0400
81713 @@ -1148,7 +1148,7 @@ static int snd_atiixp_spdif_close(struct
81714 }
81715
81716 /* AC97 playback */
81717 -static struct snd_pcm_ops snd_atiixp_playback_ops = {
81718 +static const struct snd_pcm_ops snd_atiixp_playback_ops = {
81719 .open = snd_atiixp_playback_open,
81720 .close = snd_atiixp_playback_close,
81721 .ioctl = snd_pcm_lib_ioctl,
81722 @@ -1160,7 +1160,7 @@ static struct snd_pcm_ops snd_atiixp_pla
81723 };
81724
81725 /* AC97 capture */
81726 -static struct snd_pcm_ops snd_atiixp_capture_ops = {
81727 +static const struct snd_pcm_ops snd_atiixp_capture_ops = {
81728 .open = snd_atiixp_capture_open,
81729 .close = snd_atiixp_capture_close,
81730 .ioctl = snd_pcm_lib_ioctl,
81731 @@ -1172,7 +1172,7 @@ static struct snd_pcm_ops snd_atiixp_cap
81732 };
81733
81734 /* SPDIF playback */
81735 -static struct snd_pcm_ops snd_atiixp_spdif_ops = {
81736 +static const struct snd_pcm_ops snd_atiixp_spdif_ops = {
81737 .open = snd_atiixp_spdif_open,
81738 .close = snd_atiixp_spdif_close,
81739 .ioctl = snd_pcm_lib_ioctl,
81740 @@ -1410,7 +1410,7 @@ static int __devinit snd_atiixp_mixer_ne
81741 struct snd_ac97_template ac97;
81742 int i, err;
81743 int codec_count;
81744 - static struct snd_ac97_bus_ops ops = {
81745 + static const struct snd_ac97_bus_ops ops = {
81746 .write = snd_atiixp_ac97_write,
81747 .read = snd_atiixp_ac97_read,
81748 };
81749 @@ -1590,7 +1590,7 @@ static int __devinit snd_atiixp_create(s
81750 struct pci_dev *pci,
81751 struct atiixp **r_chip)
81752 {
81753 - static struct snd_device_ops ops = {
81754 + static const struct snd_device_ops ops = {
81755 .dev_free = snd_atiixp_dev_free,
81756 };
81757 struct atiixp *chip;
81758 diff -urNp linux-2.6.39.1/sound/pci/atiixp_modem.c linux-2.6.39.1/sound/pci/atiixp_modem.c
81759 --- linux-2.6.39.1/sound/pci/atiixp_modem.c 2011-05-19 00:06:34.000000000 -0400
81760 +++ linux-2.6.39.1/sound/pci/atiixp_modem.c 2011-05-22 19:36:35.000000000 -0400
81761 @@ -947,7 +947,7 @@ static int snd_atiixp_capture_close(stru
81762
81763
81764 /* AC97 playback */
81765 -static struct snd_pcm_ops snd_atiixp_playback_ops = {
81766 +static const struct snd_pcm_ops snd_atiixp_playback_ops = {
81767 .open = snd_atiixp_playback_open,
81768 .close = snd_atiixp_playback_close,
81769 .ioctl = snd_pcm_lib_ioctl,
81770 @@ -959,7 +959,7 @@ static struct snd_pcm_ops snd_atiixp_pla
81771 };
81772
81773 /* AC97 capture */
81774 -static struct snd_pcm_ops snd_atiixp_capture_ops = {
81775 +static const struct snd_pcm_ops snd_atiixp_capture_ops = {
81776 .open = snd_atiixp_capture_open,
81777 .close = snd_atiixp_capture_close,
81778 .ioctl = snd_pcm_lib_ioctl,
81779 @@ -1067,7 +1067,7 @@ static int __devinit snd_atiixp_mixer_ne
81780 struct snd_ac97_template ac97;
81781 int i, err;
81782 int codec_count;
81783 - static struct snd_ac97_bus_ops ops = {
81784 + static const struct snd_ac97_bus_ops ops = {
81785 .write = snd_atiixp_ac97_write,
81786 .read = snd_atiixp_ac97_read,
81787 };
81788 @@ -1226,7 +1226,7 @@ static int __devinit snd_atiixp_create(s
81789 struct pci_dev *pci,
81790 struct atiixp_modem **r_chip)
81791 {
81792 - static struct snd_device_ops ops = {
81793 + static const struct snd_device_ops ops = {
81794 .dev_free = snd_atiixp_dev_free,
81795 };
81796 struct atiixp_modem *chip;
81797 diff -urNp linux-2.6.39.1/sound/pci/au88x0/au88x0_pcm.c linux-2.6.39.1/sound/pci/au88x0/au88x0_pcm.c
81798 --- linux-2.6.39.1/sound/pci/au88x0/au88x0_pcm.c 2011-05-19 00:06:34.000000000 -0400
81799 +++ linux-2.6.39.1/sound/pci/au88x0/au88x0_pcm.c 2011-05-22 19:36:35.000000000 -0400
81800 @@ -409,7 +409,7 @@ static snd_pcm_uframes_t snd_vortex_pcm_
81801 }
81802
81803 /* operators */
81804 -static struct snd_pcm_ops snd_vortex_playback_ops = {
81805 +static const struct snd_pcm_ops snd_vortex_playback_ops = {
81806 .open = snd_vortex_pcm_open,
81807 .close = snd_vortex_pcm_close,
81808 .ioctl = snd_pcm_lib_ioctl,
81809 diff -urNp linux-2.6.39.1/sound/pci/aw2/aw2-alsa.c linux-2.6.39.1/sound/pci/aw2/aw2-alsa.c
81810 --- linux-2.6.39.1/sound/pci/aw2/aw2-alsa.c 2011-05-19 00:06:34.000000000 -0400
81811 +++ linux-2.6.39.1/sound/pci/aw2/aw2-alsa.c 2011-05-22 19:36:35.000000000 -0400
81812 @@ -178,7 +178,7 @@ static struct pci_driver driver = {
81813 };
81814
81815 /* operators for playback PCM alsa interface */
81816 -static struct snd_pcm_ops snd_aw2_playback_ops = {
81817 +static const struct snd_pcm_ops snd_aw2_playback_ops = {
81818 .open = snd_aw2_pcm_playback_open,
81819 .close = snd_aw2_pcm_playback_close,
81820 .ioctl = snd_pcm_lib_ioctl,
81821 @@ -190,7 +190,7 @@ static struct snd_pcm_ops snd_aw2_playba
81822 };
81823
81824 /* operators for capture PCM alsa interface */
81825 -static struct snd_pcm_ops snd_aw2_capture_ops = {
81826 +static const struct snd_pcm_ops snd_aw2_capture_ops = {
81827 .open = snd_aw2_pcm_capture_open,
81828 .close = snd_aw2_pcm_capture_close,
81829 .ioctl = snd_pcm_lib_ioctl,
81830 @@ -263,7 +263,7 @@ static int __devinit snd_aw2_create(stru
81831 {
81832 struct aw2 *chip;
81833 int err;
81834 - static struct snd_device_ops ops = {
81835 + static const struct snd_device_ops ops = {
81836 .dev_free = snd_aw2_dev_free,
81837 };
81838
81839 diff -urNp linux-2.6.39.1/sound/pci/azt3328.c linux-2.6.39.1/sound/pci/azt3328.c
81840 --- linux-2.6.39.1/sound/pci/azt3328.c 2011-05-19 00:06:34.000000000 -0400
81841 +++ linux-2.6.39.1/sound/pci/azt3328.c 2011-05-22 19:36:35.000000000 -0400
81842 @@ -822,7 +822,7 @@ snd_azf3328_mixer_new(struct snd_azf3328
81843 {
81844 struct snd_ac97_bus *bus;
81845 struct snd_ac97_template ac97;
81846 - static struct snd_ac97_bus_ops ops = {
81847 + static const struct snd_ac97_bus_ops ops = {
81848 .write = snd_azf3328_mixer_ac97_write,
81849 .read = snd_azf3328_mixer_ac97_read,
81850 };
81851 @@ -2179,7 +2179,7 @@ snd_azf3328_pcm_close(struct snd_pcm_sub
81852
81853 /******************************************************************/
81854
81855 -static struct snd_pcm_ops snd_azf3328_playback_ops = {
81856 +static const struct snd_pcm_ops snd_azf3328_playback_ops = {
81857 .open = snd_azf3328_pcm_playback_open,
81858 .close = snd_azf3328_pcm_close,
81859 .ioctl = snd_pcm_lib_ioctl,
81860 @@ -2190,7 +2190,7 @@ static struct snd_pcm_ops snd_azf3328_pl
81861 .pointer = snd_azf3328_pcm_pointer
81862 };
81863
81864 -static struct snd_pcm_ops snd_azf3328_capture_ops = {
81865 +static const struct snd_pcm_ops snd_azf3328_capture_ops = {
81866 .open = snd_azf3328_pcm_capture_open,
81867 .close = snd_azf3328_pcm_close,
81868 .ioctl = snd_pcm_lib_ioctl,
81869 @@ -2201,7 +2201,7 @@ static struct snd_pcm_ops snd_azf3328_ca
81870 .pointer = snd_azf3328_pcm_pointer
81871 };
81872
81873 -static struct snd_pcm_ops snd_azf3328_i2s_out_ops = {
81874 +static const struct snd_pcm_ops snd_azf3328_i2s_out_ops = {
81875 .open = snd_azf3328_pcm_i2s_out_open,
81876 .close = snd_azf3328_pcm_close,
81877 .ioctl = snd_pcm_lib_ioctl,
81878 @@ -2497,7 +2497,7 @@ snd_azf3328_create(struct snd_card *card
81879 {
81880 struct snd_azf3328 *chip;
81881 int err;
81882 - static struct snd_device_ops ops = {
81883 + static const struct snd_device_ops ops = {
81884 .dev_free = snd_azf3328_dev_free,
81885 };
81886 u8 dma_init;
81887 diff -urNp linux-2.6.39.1/sound/pci/bt87x.c linux-2.6.39.1/sound/pci/bt87x.c
81888 --- linux-2.6.39.1/sound/pci/bt87x.c 2011-05-19 00:06:34.000000000 -0400
81889 +++ linux-2.6.39.1/sound/pci/bt87x.c 2011-05-22 19:36:35.000000000 -0400
81890 @@ -542,7 +542,7 @@ static snd_pcm_uframes_t snd_bt87x_point
81891 return (snd_pcm_uframes_t)bytes_to_frames(runtime, chip->current_line * chip->line_bytes);
81892 }
81893
81894 -static struct snd_pcm_ops snd_bt87x_pcm_ops = {
81895 +static const struct snd_pcm_ops snd_bt87x_pcm_ops = {
81896 .open = snd_bt87x_pcm_open,
81897 .close = snd_bt87x_close,
81898 .ioctl = snd_pcm_lib_ioctl,
81899 @@ -720,7 +720,7 @@ static int __devinit snd_bt87x_create(st
81900 {
81901 struct snd_bt87x *chip;
81902 int err;
81903 - static struct snd_device_ops ops = {
81904 + static const struct snd_device_ops ops = {
81905 .dev_free = snd_bt87x_dev_free
81906 };
81907
81908 diff -urNp linux-2.6.39.1/sound/pci/ca0106/ca0106_main.c linux-2.6.39.1/sound/pci/ca0106/ca0106_main.c
81909 --- linux-2.6.39.1/sound/pci/ca0106/ca0106_main.c 2011-05-19 00:06:34.000000000 -0400
81910 +++ linux-2.6.39.1/sound/pci/ca0106/ca0106_main.c 2011-05-22 19:36:35.000000000 -0400
81911 @@ -1103,7 +1103,7 @@ snd_ca0106_pcm_pointer_capture(struct sn
81912 }
81913
81914 /* operators */
81915 -static struct snd_pcm_ops snd_ca0106_playback_front_ops = {
81916 +static const struct snd_pcm_ops snd_ca0106_playback_front_ops = {
81917 .open = snd_ca0106_pcm_open_playback_front,
81918 .close = snd_ca0106_pcm_close_playback,
81919 .ioctl = snd_pcm_lib_ioctl,
81920 @@ -1114,7 +1114,7 @@ static struct snd_pcm_ops snd_ca0106_pla
81921 .pointer = snd_ca0106_pcm_pointer_playback,
81922 };
81923
81924 -static struct snd_pcm_ops snd_ca0106_capture_0_ops = {
81925 +static const struct snd_pcm_ops snd_ca0106_capture_0_ops = {
81926 .open = snd_ca0106_pcm_open_0_capture,
81927 .close = snd_ca0106_pcm_close_capture,
81928 .ioctl = snd_pcm_lib_ioctl,
81929 @@ -1125,7 +1125,7 @@ static struct snd_pcm_ops snd_ca0106_cap
81930 .pointer = snd_ca0106_pcm_pointer_capture,
81931 };
81932
81933 -static struct snd_pcm_ops snd_ca0106_capture_1_ops = {
81934 +static const struct snd_pcm_ops snd_ca0106_capture_1_ops = {
81935 .open = snd_ca0106_pcm_open_1_capture,
81936 .close = snd_ca0106_pcm_close_capture,
81937 .ioctl = snd_pcm_lib_ioctl,
81938 @@ -1136,7 +1136,7 @@ static struct snd_pcm_ops snd_ca0106_cap
81939 .pointer = snd_ca0106_pcm_pointer_capture,
81940 };
81941
81942 -static struct snd_pcm_ops snd_ca0106_capture_2_ops = {
81943 +static const struct snd_pcm_ops snd_ca0106_capture_2_ops = {
81944 .open = snd_ca0106_pcm_open_2_capture,
81945 .close = snd_ca0106_pcm_close_capture,
81946 .ioctl = snd_pcm_lib_ioctl,
81947 @@ -1147,7 +1147,7 @@ static struct snd_pcm_ops snd_ca0106_cap
81948 .pointer = snd_ca0106_pcm_pointer_capture,
81949 };
81950
81951 -static struct snd_pcm_ops snd_ca0106_capture_3_ops = {
81952 +static const struct snd_pcm_ops snd_ca0106_capture_3_ops = {
81953 .open = snd_ca0106_pcm_open_3_capture,
81954 .close = snd_ca0106_pcm_close_capture,
81955 .ioctl = snd_pcm_lib_ioctl,
81956 @@ -1158,7 +1158,7 @@ static struct snd_pcm_ops snd_ca0106_cap
81957 .pointer = snd_ca0106_pcm_pointer_capture,
81958 };
81959
81960 -static struct snd_pcm_ops snd_ca0106_playback_center_lfe_ops = {
81961 +static const struct snd_pcm_ops snd_ca0106_playback_center_lfe_ops = {
81962 .open = snd_ca0106_pcm_open_playback_center_lfe,
81963 .close = snd_ca0106_pcm_close_playback,
81964 .ioctl = snd_pcm_lib_ioctl,
81965 @@ -1169,7 +1169,7 @@ static struct snd_pcm_ops snd_ca0106_pla
81966 .pointer = snd_ca0106_pcm_pointer_playback,
81967 };
81968
81969 -static struct snd_pcm_ops snd_ca0106_playback_unknown_ops = {
81970 +static const struct snd_pcm_ops snd_ca0106_playback_unknown_ops = {
81971 .open = snd_ca0106_pcm_open_playback_unknown,
81972 .close = snd_ca0106_pcm_close_playback,
81973 .ioctl = snd_pcm_lib_ioctl,
81974 @@ -1180,7 +1180,7 @@ static struct snd_pcm_ops snd_ca0106_pla
81975 .pointer = snd_ca0106_pcm_pointer_playback,
81976 };
81977
81978 -static struct snd_pcm_ops snd_ca0106_playback_rear_ops = {
81979 +static const struct snd_pcm_ops snd_ca0106_playback_rear_ops = {
81980 .open = snd_ca0106_pcm_open_playback_rear,
81981 .close = snd_ca0106_pcm_close_playback,
81982 .ioctl = snd_pcm_lib_ioctl,
81983 @@ -1223,7 +1223,7 @@ static int snd_ca0106_ac97(struct snd_ca
81984 struct snd_ac97_bus *pbus;
81985 struct snd_ac97_template ac97;
81986 int err;
81987 - static struct snd_ac97_bus_ops ops = {
81988 + static const struct snd_ac97_bus_ops ops = {
81989 .write = snd_ca0106_ac97_write,
81990 .read = snd_ca0106_ac97_read,
81991 };
81992 @@ -1629,7 +1629,7 @@ static int __devinit snd_ca0106_create(i
81993 struct snd_ca0106 *chip;
81994 struct snd_ca0106_details *c;
81995 int err;
81996 - static struct snd_device_ops ops = {
81997 + static const struct snd_device_ops ops = {
81998 .dev_free = snd_ca0106_dev_free,
81999 };
82000
82001 diff -urNp linux-2.6.39.1/sound/pci/ca0106/ca_midi.c linux-2.6.39.1/sound/pci/ca0106/ca_midi.c
82002 --- linux-2.6.39.1/sound/pci/ca0106/ca_midi.c 2011-05-19 00:06:34.000000000 -0400
82003 +++ linux-2.6.39.1/sound/pci/ca0106/ca_midi.c 2011-05-22 19:36:35.000000000 -0400
82004 @@ -255,15 +255,13 @@ static void ca_midi_output_trigger(struc
82005 }
82006 }
82007
82008 -static struct snd_rawmidi_ops ca_midi_output =
82009 -{
82010 +static const struct snd_rawmidi_ops ca_midi_output = {
82011 .open = ca_midi_output_open,
82012 .close = ca_midi_output_close,
82013 .trigger = ca_midi_output_trigger,
82014 };
82015
82016 -static struct snd_rawmidi_ops ca_midi_input =
82017 -{
82018 +static const struct snd_rawmidi_ops ca_midi_input = {
82019 .open = ca_midi_input_open,
82020 .close = ca_midi_input_close,
82021 .trigger = ca_midi_input_trigger,
82022 diff -urNp linux-2.6.39.1/sound/pci/cmipci.c linux-2.6.39.1/sound/pci/cmipci.c
82023 --- linux-2.6.39.1/sound/pci/cmipci.c 2011-05-19 00:06:34.000000000 -0400
82024 +++ linux-2.6.39.1/sound/pci/cmipci.c 2011-05-22 19:36:35.000000000 -0400
82025 @@ -1838,7 +1838,7 @@ static int snd_cmipci_capture_spdif_clos
82026 /*
82027 */
82028
82029 -static struct snd_pcm_ops snd_cmipci_playback_ops = {
82030 +static const struct snd_pcm_ops snd_cmipci_playback_ops = {
82031 .open = snd_cmipci_playback_open,
82032 .close = snd_cmipci_playback_close,
82033 .ioctl = snd_pcm_lib_ioctl,
82034 @@ -1849,7 +1849,7 @@ static struct snd_pcm_ops snd_cmipci_pla
82035 .pointer = snd_cmipci_playback_pointer,
82036 };
82037
82038 -static struct snd_pcm_ops snd_cmipci_capture_ops = {
82039 +static const struct snd_pcm_ops snd_cmipci_capture_ops = {
82040 .open = snd_cmipci_capture_open,
82041 .close = snd_cmipci_capture_close,
82042 .ioctl = snd_pcm_lib_ioctl,
82043 @@ -1860,7 +1860,7 @@ static struct snd_pcm_ops snd_cmipci_cap
82044 .pointer = snd_cmipci_capture_pointer,
82045 };
82046
82047 -static struct snd_pcm_ops snd_cmipci_playback2_ops = {
82048 +static const struct snd_pcm_ops snd_cmipci_playback2_ops = {
82049 .open = snd_cmipci_playback2_open,
82050 .close = snd_cmipci_playback2_close,
82051 .ioctl = snd_pcm_lib_ioctl,
82052 @@ -1871,7 +1871,7 @@ static struct snd_pcm_ops snd_cmipci_pla
82053 .pointer = snd_cmipci_capture_pointer, /* channel B */
82054 };
82055
82056 -static struct snd_pcm_ops snd_cmipci_playback_spdif_ops = {
82057 +static const struct snd_pcm_ops snd_cmipci_playback_spdif_ops = {
82058 .open = snd_cmipci_playback_spdif_open,
82059 .close = snd_cmipci_playback_spdif_close,
82060 .ioctl = snd_pcm_lib_ioctl,
82061 @@ -1882,7 +1882,7 @@ static struct snd_pcm_ops snd_cmipci_pla
82062 .pointer = snd_cmipci_playback_pointer,
82063 };
82064
82065 -static struct snd_pcm_ops snd_cmipci_capture_spdif_ops = {
82066 +static const struct snd_pcm_ops snd_cmipci_capture_spdif_ops = {
82067 .open = snd_cmipci_capture_spdif_open,
82068 .close = snd_cmipci_capture_spdif_close,
82069 .ioctl = snd_pcm_lib_ioctl,
82070 @@ -3011,7 +3011,7 @@ static int __devinit snd_cmipci_create(s
82071 {
82072 struct cmipci *cm;
82073 int err;
82074 - static struct snd_device_ops ops = {
82075 + static const struct snd_device_ops ops = {
82076 .dev_free = snd_cmipci_dev_free,
82077 };
82078 unsigned int val;
82079 diff -urNp linux-2.6.39.1/sound/pci/cs4281.c linux-2.6.39.1/sound/pci/cs4281.c
82080 --- linux-2.6.39.1/sound/pci/cs4281.c 2011-05-19 00:06:34.000000000 -0400
82081 +++ linux-2.6.39.1/sound/pci/cs4281.c 2011-05-22 19:36:35.000000000 -0400
82082 @@ -947,7 +947,7 @@ static int snd_cs4281_capture_close(stru
82083 return 0;
82084 }
82085
82086 -static struct snd_pcm_ops snd_cs4281_playback_ops = {
82087 +static const struct snd_pcm_ops snd_cs4281_playback_ops = {
82088 .open = snd_cs4281_playback_open,
82089 .close = snd_cs4281_playback_close,
82090 .ioctl = snd_pcm_lib_ioctl,
82091 @@ -958,7 +958,7 @@ static struct snd_pcm_ops snd_cs4281_pla
82092 .pointer = snd_cs4281_pointer,
82093 };
82094
82095 -static struct snd_pcm_ops snd_cs4281_capture_ops = {
82096 +static const struct snd_pcm_ops snd_cs4281_capture_ops = {
82097 .open = snd_cs4281_capture_open,
82098 .close = snd_cs4281_capture_close,
82099 .ioctl = snd_pcm_lib_ioctl,
82100 @@ -1098,7 +1098,7 @@ static int __devinit snd_cs4281_mixer(st
82101 struct snd_card *card = chip->card;
82102 struct snd_ac97_template ac97;
82103 int err;
82104 - static struct snd_ac97_bus_ops ops = {
82105 + static const struct snd_ac97_bus_ops ops = {
82106 .write = snd_cs4281_ac97_write,
82107 .read = snd_cs4281_ac97_read,
82108 };
82109 @@ -1343,7 +1343,7 @@ static int __devinit snd_cs4281_create(s
82110 struct cs4281 *chip;
82111 unsigned int tmp;
82112 int err;
82113 - static struct snd_device_ops ops = {
82114 + static const struct snd_device_ops ops = {
82115 .dev_free = snd_cs4281_dev_free,
82116 };
82117
82118 @@ -1765,15 +1765,13 @@ static void snd_cs4281_midi_output_trigg
82119 spin_unlock_irqrestore(&chip->reg_lock, flags);
82120 }
82121
82122 -static struct snd_rawmidi_ops snd_cs4281_midi_output =
82123 -{
82124 +static const struct snd_rawmidi_ops snd_cs4281_midi_output = {
82125 .open = snd_cs4281_midi_output_open,
82126 .close = snd_cs4281_midi_output_close,
82127 .trigger = snd_cs4281_midi_output_trigger,
82128 };
82129
82130 -static struct snd_rawmidi_ops snd_cs4281_midi_input =
82131 -{
82132 +static const struct snd_rawmidi_ops snd_cs4281_midi_input = {
82133 .open = snd_cs4281_midi_input_open,
82134 .close = snd_cs4281_midi_input_close,
82135 .trigger = snd_cs4281_midi_input_trigger,
82136 diff -urNp linux-2.6.39.1/sound/pci/cs46xx/cs46xx_lib.c linux-2.6.39.1/sound/pci/cs46xx/cs46xx_lib.c
82137 --- linux-2.6.39.1/sound/pci/cs46xx/cs46xx_lib.c 2011-05-19 00:06:34.000000000 -0400
82138 +++ linux-2.6.39.1/sound/pci/cs46xx/cs46xx_lib.c 2011-05-22 19:36:35.000000000 -0400
82139 @@ -3722,7 +3722,7 @@ int __devinit snd_cs46xx_create(struct s
82140 struct snd_cs46xx_region *region;
82141 struct cs_card_type *cp;
82142 u16 ss_card, ss_vendor;
82143 - static struct snd_device_ops ops = {
82144 + static const struct snd_device_ops ops = {
82145 .dev_free = snd_cs46xx_dev_free,
82146 };
82147
82148 diff -urNp linux-2.6.39.1/sound/pci/cs5530.c linux-2.6.39.1/sound/pci/cs5530.c
82149 --- linux-2.6.39.1/sound/pci/cs5530.c 2011-05-19 00:06:34.000000000 -0400
82150 +++ linux-2.6.39.1/sound/pci/cs5530.c 2011-05-22 19:36:35.000000000 -0400
82151 @@ -107,7 +107,7 @@ static int __devinit snd_cs5530_create(s
82152 void __iomem *mem;
82153 int err;
82154
82155 - static struct snd_device_ops ops = {
82156 + static const struct snd_device_ops ops = {
82157 .dev_free = snd_cs5530_dev_free,
82158 };
82159 *rchip = NULL;
82160 diff -urNp linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio.c linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio.c
82161 --- linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio.c 2011-05-19 00:06:34.000000000 -0400
82162 +++ linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio.c 2011-05-22 19:36:35.000000000 -0400
82163 @@ -150,7 +150,7 @@ static int __devinit snd_cs5535audio_mix
82164 struct snd_ac97_bus *pbus;
82165 struct snd_ac97_template ac97;
82166 int err;
82167 - static struct snd_ac97_bus_ops ops = {
82168 + static const struct snd_ac97_bus_ops ops = {
82169 .write = snd_cs5535audio_ac97_codec_write,
82170 .read = snd_cs5535audio_ac97_codec_read,
82171 };
82172 @@ -277,7 +277,7 @@ static int __devinit snd_cs5535audio_cre
82173 struct cs5535audio *cs5535au;
82174
82175 int err;
82176 - static struct snd_device_ops ops = {
82177 + static const struct snd_device_ops ops = {
82178 .dev_free = snd_cs5535audio_dev_free,
82179 };
82180
82181 diff -urNp linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio_pcm.c linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio_pcm.c
82182 --- linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio_pcm.c 2011-05-19 00:06:34.000000000 -0400
82183 +++ linux-2.6.39.1/sound/pci/cs5535audio/cs5535audio_pcm.c 2011-05-22 19:36:35.000000000 -0400
82184 @@ -380,7 +380,7 @@ static int snd_cs5535audio_capture_prepa
82185 substream->runtime->rate);
82186 }
82187
82188 -static struct snd_pcm_ops snd_cs5535audio_playback_ops = {
82189 +static const struct snd_pcm_ops snd_cs5535audio_playback_ops = {
82190 .open = snd_cs5535audio_playback_open,
82191 .close = snd_cs5535audio_playback_close,
82192 .ioctl = snd_pcm_lib_ioctl,
82193 @@ -391,7 +391,7 @@ static struct snd_pcm_ops snd_cs5535audi
82194 .pointer = snd_cs5535audio_pcm_pointer,
82195 };
82196
82197 -static struct snd_pcm_ops snd_cs5535audio_capture_ops = {
82198 +static const struct snd_pcm_ops snd_cs5535audio_capture_ops = {
82199 .open = snd_cs5535audio_capture_open,
82200 .close = snd_cs5535audio_capture_close,
82201 .ioctl = snd_pcm_lib_ioctl,
82202 diff -urNp linux-2.6.39.1/sound/pci/ctxfi/ctpcm.c linux-2.6.39.1/sound/pci/ctxfi/ctpcm.c
82203 --- linux-2.6.39.1/sound/pci/ctxfi/ctpcm.c 2011-05-19 00:06:34.000000000 -0400
82204 +++ linux-2.6.39.1/sound/pci/ctxfi/ctpcm.c 2011-05-22 19:36:35.000000000 -0400
82205 @@ -370,7 +370,7 @@ ct_pcm_capture_pointer(struct snd_pcm_su
82206 }
82207
82208 /* PCM operators for playback */
82209 -static struct snd_pcm_ops ct_pcm_playback_ops = {
82210 +static const struct snd_pcm_ops ct_pcm_playback_ops = {
82211 .open = ct_pcm_playback_open,
82212 .close = ct_pcm_playback_close,
82213 .ioctl = snd_pcm_lib_ioctl,
82214 @@ -383,7 +383,7 @@ static struct snd_pcm_ops ct_pcm_playbac
82215 };
82216
82217 /* PCM operators for capture */
82218 -static struct snd_pcm_ops ct_pcm_capture_ops = {
82219 +static const struct snd_pcm_ops ct_pcm_capture_ops = {
82220 .open = ct_pcm_capture_open,
82221 .close = ct_pcm_capture_close,
82222 .ioctl = snd_pcm_lib_ioctl,
82223 diff -urNp linux-2.6.39.1/sound/pci/echoaudio/echoaudio.c linux-2.6.39.1/sound/pci/echoaudio/echoaudio.c
82224 --- linux-2.6.39.1/sound/pci/echoaudio/echoaudio.c 2011-05-19 00:06:34.000000000 -0400
82225 +++ linux-2.6.39.1/sound/pci/echoaudio/echoaudio.c 2011-05-22 19:36:35.000000000 -0400
82226 @@ -831,7 +831,7 @@ static snd_pcm_uframes_t pcm_pointer(str
82227
82228
82229 /* pcm *_ops structures */
82230 -static struct snd_pcm_ops analog_playback_ops = {
82231 +static const struct snd_pcm_ops analog_playback_ops = {
82232 .open = pcm_analog_out_open,
82233 .close = pcm_close,
82234 .ioctl = snd_pcm_lib_ioctl,
82235 @@ -842,7 +842,7 @@ static struct snd_pcm_ops analog_playbac
82236 .pointer = pcm_pointer,
82237 .page = snd_pcm_sgbuf_ops_page,
82238 };
82239 -static struct snd_pcm_ops analog_capture_ops = {
82240 +static const struct snd_pcm_ops analog_capture_ops = {
82241 .open = pcm_analog_in_open,
82242 .close = pcm_close,
82243 .ioctl = snd_pcm_lib_ioctl,
82244 @@ -855,7 +855,7 @@ static struct snd_pcm_ops analog_capture
82245 };
82246 #ifdef ECHOCARD_HAS_DIGITAL_IO
82247 #ifndef ECHOCARD_HAS_VMIXER
82248 -static struct snd_pcm_ops digital_playback_ops = {
82249 +static const struct snd_pcm_ops digital_playback_ops = {
82250 .open = pcm_digital_out_open,
82251 .close = pcm_close,
82252 .ioctl = snd_pcm_lib_ioctl,
82253 @@ -867,7 +867,7 @@ static struct snd_pcm_ops digital_playba
82254 .page = snd_pcm_sgbuf_ops_page,
82255 };
82256 #endif /* !ECHOCARD_HAS_VMIXER */
82257 -static struct snd_pcm_ops digital_capture_ops = {
82258 +static const struct snd_pcm_ops digital_capture_ops = {
82259 .open = pcm_digital_in_open,
82260 .close = pcm_close,
82261 .ioctl = snd_pcm_lib_ioctl,
82262 @@ -1945,7 +1945,7 @@ static __devinit int snd_echo_create(str
82263 struct echoaudio *chip;
82264 int err;
82265 size_t sz;
82266 - static struct snd_device_ops ops = {
82267 + static const struct snd_device_ops ops = {
82268 .dev_free = snd_echo_dev_free,
82269 };
82270
82271 diff -urNp linux-2.6.39.1/sound/pci/echoaudio/midi.c linux-2.6.39.1/sound/pci/echoaudio/midi.c
82272 --- linux-2.6.39.1/sound/pci/echoaudio/midi.c 2011-05-19 00:06:34.000000000 -0400
82273 +++ linux-2.6.39.1/sound/pci/echoaudio/midi.c 2011-05-22 19:36:35.000000000 -0400
82274 @@ -292,13 +292,13 @@ static int snd_echo_midi_output_close(st
82275
82276
82277
82278 -static struct snd_rawmidi_ops snd_echo_midi_input = {
82279 +static const struct snd_rawmidi_ops snd_echo_midi_input = {
82280 .open = snd_echo_midi_input_open,
82281 .close = snd_echo_midi_input_close,
82282 .trigger = snd_echo_midi_input_trigger,
82283 };
82284
82285 -static struct snd_rawmidi_ops snd_echo_midi_output = {
82286 +static const struct snd_rawmidi_ops snd_echo_midi_output = {
82287 .open = snd_echo_midi_output_open,
82288 .close = snd_echo_midi_output_close,
82289 .trigger = snd_echo_midi_output_trigger,
82290 diff -urNp linux-2.6.39.1/sound/pci/emu10k1/emu10k1_main.c linux-2.6.39.1/sound/pci/emu10k1/emu10k1_main.c
82291 --- linux-2.6.39.1/sound/pci/emu10k1/emu10k1_main.c 2011-05-19 00:06:34.000000000 -0400
82292 +++ linux-2.6.39.1/sound/pci/emu10k1/emu10k1_main.c 2011-05-22 19:36:35.000000000 -0400
82293 @@ -1722,7 +1722,7 @@ int __devinit snd_emu10k1_create(struct
82294 int is_audigy;
82295 unsigned int silent_page;
82296 const struct snd_emu_chip_details *c;
82297 - static struct snd_device_ops ops = {
82298 + static const struct snd_device_ops ops = {
82299 .dev_free = snd_emu10k1_dev_free,
82300 };
82301
82302 diff -urNp linux-2.6.39.1/sound/pci/emu10k1/emu10k1x.c linux-2.6.39.1/sound/pci/emu10k1/emu10k1x.c
82303 --- linux-2.6.39.1/sound/pci/emu10k1/emu10k1x.c 2011-05-19 00:06:34.000000000 -0400
82304 +++ linux-2.6.39.1/sound/pci/emu10k1/emu10k1x.c 2011-05-22 19:36:35.000000000 -0400
82305 @@ -543,7 +543,7 @@ snd_emu10k1x_pcm_pointer(struct snd_pcm_
82306 }
82307
82308 /* operators */
82309 -static struct snd_pcm_ops snd_emu10k1x_playback_ops = {
82310 +static const struct snd_pcm_ops snd_emu10k1x_playback_ops = {
82311 .open = snd_emu10k1x_playback_open,
82312 .close = snd_emu10k1x_playback_close,
82313 .ioctl = snd_pcm_lib_ioctl,
82314 @@ -689,7 +689,7 @@ snd_emu10k1x_pcm_pointer_capture(struct
82315 return ptr;
82316 }
82317
82318 -static struct snd_pcm_ops snd_emu10k1x_capture_ops = {
82319 +static const struct snd_pcm_ops snd_emu10k1x_capture_ops = {
82320 .open = snd_emu10k1x_pcm_open_capture,
82321 .close = snd_emu10k1x_pcm_close_capture,
82322 .ioctl = snd_pcm_lib_ioctl,
82323 @@ -731,7 +731,7 @@ static int snd_emu10k1x_ac97(struct emu1
82324 struct snd_ac97_bus *pbus;
82325 struct snd_ac97_template ac97;
82326 int err;
82327 - static struct snd_ac97_bus_ops ops = {
82328 + static const struct snd_ac97_bus_ops ops = {
82329 .write = snd_emu10k1x_ac97_write,
82330 .read = snd_emu10k1x_ac97_read,
82331 };
82332 @@ -888,7 +888,7 @@ static int __devinit snd_emu10k1x_create
82333 struct emu10k1x *chip;
82334 int err;
82335 int ch;
82336 - static struct snd_device_ops ops = {
82337 + static const struct snd_device_ops ops = {
82338 .dev_free = snd_emu10k1x_dev_free,
82339 };
82340
82341 @@ -1465,15 +1465,13 @@ static void snd_emu10k1x_midi_output_tri
82342
82343 */
82344
82345 -static struct snd_rawmidi_ops snd_emu10k1x_midi_output =
82346 -{
82347 +static const struct snd_rawmidi_ops snd_emu10k1x_midi_output = {
82348 .open = snd_emu10k1x_midi_output_open,
82349 .close = snd_emu10k1x_midi_output_close,
82350 .trigger = snd_emu10k1x_midi_output_trigger,
82351 };
82352
82353 -static struct snd_rawmidi_ops snd_emu10k1x_midi_input =
82354 -{
82355 +static const struct snd_rawmidi_ops snd_emu10k1x_midi_input = {
82356 .open = snd_emu10k1x_midi_input_open,
82357 .close = snd_emu10k1x_midi_input_close,
82358 .trigger = snd_emu10k1x_midi_input_trigger,
82359 diff -urNp linux-2.6.39.1/sound/pci/emu10k1/p16v.c linux-2.6.39.1/sound/pci/emu10k1/p16v.c
82360 --- linux-2.6.39.1/sound/pci/emu10k1/p16v.c 2011-05-19 00:06:34.000000000 -0400
82361 +++ linux-2.6.39.1/sound/pci/emu10k1/p16v.c 2011-05-22 19:36:35.000000000 -0400
82362 @@ -601,7 +601,7 @@ snd_p16v_pcm_pointer_capture(struct snd_
82363 }
82364
82365 /* operators */
82366 -static struct snd_pcm_ops snd_p16v_playback_front_ops = {
82367 +static const struct snd_pcm_ops snd_p16v_playback_front_ops = {
82368 .open = snd_p16v_pcm_open_playback_front,
82369 .close = snd_p16v_pcm_close_playback,
82370 .ioctl = snd_pcm_lib_ioctl,
82371 @@ -612,7 +612,7 @@ static struct snd_pcm_ops snd_p16v_playb
82372 .pointer = snd_p16v_pcm_pointer_playback,
82373 };
82374
82375 -static struct snd_pcm_ops snd_p16v_capture_ops = {
82376 +static const struct snd_pcm_ops snd_p16v_capture_ops = {
82377 .open = snd_p16v_pcm_open_capture,
82378 .close = snd_p16v_pcm_close_capture,
82379 .ioctl = snd_pcm_lib_ioctl,
82380 diff -urNp linux-2.6.39.1/sound/pci/ens1370.c linux-2.6.39.1/sound/pci/ens1370.c
82381 --- linux-2.6.39.1/sound/pci/ens1370.c 2011-05-19 00:06:34.000000000 -0400
82382 +++ linux-2.6.39.1/sound/pci/ens1370.c 2011-05-22 19:36:35.000000000 -0400
82383 @@ -1225,7 +1225,7 @@ static int snd_ensoniq_capture_close(str
82384 return 0;
82385 }
82386
82387 -static struct snd_pcm_ops snd_ensoniq_playback1_ops = {
82388 +static const struct snd_pcm_ops snd_ensoniq_playback1_ops = {
82389 .open = snd_ensoniq_playback1_open,
82390 .close = snd_ensoniq_playback1_close,
82391 .ioctl = snd_pcm_lib_ioctl,
82392 @@ -1236,7 +1236,7 @@ static struct snd_pcm_ops snd_ensoniq_pl
82393 .pointer = snd_ensoniq_playback1_pointer,
82394 };
82395
82396 -static struct snd_pcm_ops snd_ensoniq_playback2_ops = {
82397 +static const struct snd_pcm_ops snd_ensoniq_playback2_ops = {
82398 .open = snd_ensoniq_playback2_open,
82399 .close = snd_ensoniq_playback2_close,
82400 .ioctl = snd_pcm_lib_ioctl,
82401 @@ -1247,7 +1247,7 @@ static struct snd_pcm_ops snd_ensoniq_pl
82402 .pointer = snd_ensoniq_playback2_pointer,
82403 };
82404
82405 -static struct snd_pcm_ops snd_ensoniq_capture_ops = {
82406 +static const struct snd_pcm_ops snd_ensoniq_capture_ops = {
82407 .open = snd_ensoniq_capture_open,
82408 .close = snd_ensoniq_capture_close,
82409 .ioctl = snd_pcm_lib_ioctl,
82410 @@ -1633,7 +1633,7 @@ static int __devinit snd_ensoniq_1371_mi
82411 struct snd_ac97_bus *pbus;
82412 struct snd_ac97_template ac97;
82413 int err;
82414 - static struct snd_ac97_bus_ops ops = {
82415 + static const struct snd_ac97_bus_ops ops = {
82416 .write = snd_es1371_codec_write,
82417 .read = snd_es1371_codec_read,
82418 .wait = snd_es1371_codec_wait,
82419 @@ -2096,7 +2096,7 @@ static int __devinit snd_ensoniq_create(
82420 {
82421 struct ensoniq *ensoniq;
82422 int err;
82423 - static struct snd_device_ops ops = {
82424 + static const struct snd_device_ops ops = {
82425 .dev_free = snd_ensoniq_dev_free,
82426 };
82427
82428 @@ -2331,15 +2331,13 @@ static void snd_ensoniq_midi_output_trig
82429 spin_unlock_irqrestore(&ensoniq->reg_lock, flags);
82430 }
82431
82432 -static struct snd_rawmidi_ops snd_ensoniq_midi_output =
82433 -{
82434 +static const struct snd_rawmidi_ops snd_ensoniq_midi_output = {
82435 .open = snd_ensoniq_midi_output_open,
82436 .close = snd_ensoniq_midi_output_close,
82437 .trigger = snd_ensoniq_midi_output_trigger,
82438 };
82439
82440 -static struct snd_rawmidi_ops snd_ensoniq_midi_input =
82441 -{
82442 +static const struct snd_rawmidi_ops snd_ensoniq_midi_input = {
82443 .open = snd_ensoniq_midi_input_open,
82444 .close = snd_ensoniq_midi_input_close,
82445 .trigger = snd_ensoniq_midi_input_trigger,
82446 diff -urNp linux-2.6.39.1/sound/pci/es1938.c linux-2.6.39.1/sound/pci/es1938.c
82447 --- linux-2.6.39.1/sound/pci/es1938.c 2011-05-19 00:06:34.000000000 -0400
82448 +++ linux-2.6.39.1/sound/pci/es1938.c 2011-05-22 19:36:35.000000000 -0400
82449 @@ -1004,7 +1004,7 @@ static int snd_es1938_playback_close(str
82450 return 0;
82451 }
82452
82453 -static struct snd_pcm_ops snd_es1938_playback_ops = {
82454 +static const struct snd_pcm_ops snd_es1938_playback_ops = {
82455 .open = snd_es1938_playback_open,
82456 .close = snd_es1938_playback_close,
82457 .ioctl = snd_pcm_lib_ioctl,
82458 @@ -1015,7 +1015,7 @@ static struct snd_pcm_ops snd_es1938_pla
82459 .pointer = snd_es1938_playback_pointer,
82460 };
82461
82462 -static struct snd_pcm_ops snd_es1938_capture_ops = {
82463 +static const struct snd_pcm_ops snd_es1938_capture_ops = {
82464 .open = snd_es1938_capture_open,
82465 .close = snd_es1938_capture_close,
82466 .ioctl = snd_pcm_lib_ioctl,
82467 @@ -1598,7 +1598,7 @@ static int __devinit snd_es1938_create(s
82468 {
82469 struct es1938 *chip;
82470 int err;
82471 - static struct snd_device_ops ops = {
82472 + static const struct snd_device_ops ops = {
82473 .dev_free = snd_es1938_dev_free,
82474 };
82475
82476 diff -urNp linux-2.6.39.1/sound/pci/es1968.c linux-2.6.39.1/sound/pci/es1968.c
82477 --- linux-2.6.39.1/sound/pci/es1968.c 2011-05-19 00:06:34.000000000 -0400
82478 +++ linux-2.6.39.1/sound/pci/es1968.c 2011-05-22 19:36:35.000000000 -0400
82479 @@ -1682,7 +1682,7 @@ static int snd_es1968_capture_close(stru
82480 return 0;
82481 }
82482
82483 -static struct snd_pcm_ops snd_es1968_playback_ops = {
82484 +static const struct snd_pcm_ops snd_es1968_playback_ops = {
82485 .open = snd_es1968_playback_open,
82486 .close = snd_es1968_playback_close,
82487 .ioctl = snd_pcm_lib_ioctl,
82488 @@ -1693,7 +1693,7 @@ static struct snd_pcm_ops snd_es1968_pla
82489 .pointer = snd_es1968_pcm_pointer,
82490 };
82491
82492 -static struct snd_pcm_ops snd_es1968_capture_ops = {
82493 +static const struct snd_pcm_ops snd_es1968_capture_ops = {
82494 .open = snd_es1968_capture_open,
82495 .close = snd_es1968_capture_close,
82496 .ioctl = snd_pcm_lib_ioctl,
82497 @@ -2053,7 +2053,7 @@ snd_es1968_mixer(struct es1968 *chip)
82498 struct snd_ctl_elem_id elem_id;
82499 #endif
82500 int err;
82501 - static struct snd_ac97_bus_ops ops = {
82502 + static const struct snd_ac97_bus_ops ops = {
82503 .write = snd_es1968_ac97_write,
82504 .read = snd_es1968_ac97_read,
82505 };
82506 @@ -2627,7 +2627,7 @@ static int __devinit snd_es1968_create(s
82507 int do_pm,
82508 struct es1968 **chip_ret)
82509 {
82510 - static struct snd_device_ops ops = {
82511 + static const struct snd_device_ops ops = {
82512 .dev_free = snd_es1968_dev_free,
82513 };
82514 struct es1968 *chip;
82515 diff -urNp linux-2.6.39.1/sound/pci/fm801.c linux-2.6.39.1/sound/pci/fm801.c
82516 --- linux-2.6.39.1/sound/pci/fm801.c 2011-05-19 00:06:34.000000000 -0400
82517 +++ linux-2.6.39.1/sound/pci/fm801.c 2011-05-22 19:36:35.000000000 -0400
82518 @@ -662,7 +662,7 @@ static int snd_fm801_capture_close(struc
82519 return 0;
82520 }
82521
82522 -static struct snd_pcm_ops snd_fm801_playback_ops = {
82523 +static const struct snd_pcm_ops snd_fm801_playback_ops = {
82524 .open = snd_fm801_playback_open,
82525 .close = snd_fm801_playback_close,
82526 .ioctl = snd_pcm_lib_ioctl,
82527 @@ -673,7 +673,7 @@ static struct snd_pcm_ops snd_fm801_play
82528 .pointer = snd_fm801_playback_pointer,
82529 };
82530
82531 -static struct snd_pcm_ops snd_fm801_capture_ops = {
82532 +static const struct snd_pcm_ops snd_fm801_capture_ops = {
82533 .open = snd_fm801_capture_open,
82534 .close = snd_fm801_capture_close,
82535 .ioctl = snd_pcm_lib_ioctl,
82536 @@ -1236,7 +1236,7 @@ static int __devinit snd_fm801_mixer(str
82537 struct snd_ac97_template ac97;
82538 unsigned int i;
82539 int err;
82540 - static struct snd_ac97_bus_ops ops = {
82541 + static const struct snd_ac97_bus_ops ops = {
82542 .write = snd_fm801_codec_write,
82543 .read = snd_fm801_codec_read,
82544 };
82545 @@ -1396,7 +1396,7 @@ static int __devinit snd_fm801_create(st
82546 {
82547 struct fm801 *chip;
82548 int err;
82549 - static struct snd_device_ops ops = {
82550 + static const struct snd_device_ops ops = {
82551 .dev_free = snd_fm801_dev_free,
82552 };
82553
82554 diff -urNp linux-2.6.39.1/sound/pci/hda/hda_generic.c linux-2.6.39.1/sound/pci/hda/hda_generic.c
82555 --- linux-2.6.39.1/sound/pci/hda/hda_generic.c 2011-05-19 00:06:34.000000000 -0400
82556 +++ linux-2.6.39.1/sound/pci/hda/hda_generic.c 2011-05-22 19:36:35.000000000 -0400
82557 @@ -1038,7 +1038,7 @@ static int generic_check_power_status(st
82558
82559 /*
82560 */
82561 -static struct hda_codec_ops generic_patch_ops = {
82562 +static const struct hda_codec_ops generic_patch_ops = {
82563 .build_controls = build_generic_controls,
82564 .build_pcms = build_generic_pcms,
82565 .free = snd_hda_generic_free,
82566 diff -urNp linux-2.6.39.1/sound/pci/hda/hda_intel.c linux-2.6.39.1/sound/pci/hda/hda_intel.c
82567 --- linux-2.6.39.1/sound/pci/hda/hda_intel.c 2011-06-03 00:04:14.000000000 -0400
82568 +++ linux-2.6.39.1/sound/pci/hda/hda_intel.c 2011-06-03 00:32:08.000000000 -0400
82569 @@ -2459,7 +2459,7 @@ static int __devinit azx_create(struct s
82570 struct azx *chip;
82571 int i, err;
82572 unsigned short gcap;
82573 - static struct snd_device_ops ops = {
82574 + static const struct snd_device_ops ops = {
82575 .dev_free = azx_dev_free,
82576 };
82577
82578 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_ca0110.c linux-2.6.39.1/sound/pci/hda/patch_ca0110.c
82579 --- linux-2.6.39.1/sound/pci/hda/patch_ca0110.c 2011-05-19 00:06:34.000000000 -0400
82580 +++ linux-2.6.39.1/sound/pci/hda/patch_ca0110.c 2011-05-22 19:36:35.000000000 -0400
82581 @@ -389,7 +389,7 @@ static void ca0110_free(struct hda_codec
82582 kfree(codec->spec);
82583 }
82584
82585 -static struct hda_codec_ops ca0110_patch_ops = {
82586 +static const struct hda_codec_ops ca0110_patch_ops = {
82587 .build_controls = ca0110_build_controls,
82588 .build_pcms = ca0110_build_pcms,
82589 .init = ca0110_init,
82590 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_cirrus.c linux-2.6.39.1/sound/pci/hda/patch_cirrus.c
82591 --- linux-2.6.39.1/sound/pci/hda/patch_cirrus.c 2011-05-19 00:06:34.000000000 -0400
82592 +++ linux-2.6.39.1/sound/pci/hda/patch_cirrus.c 2011-05-22 19:36:35.000000000 -0400
82593 @@ -1126,7 +1126,7 @@ static void cs_unsol_event(struct hda_co
82594 }
82595 }
82596
82597 -static struct hda_codec_ops cs_patch_ops = {
82598 +static const struct hda_codec_ops cs_patch_ops = {
82599 .build_controls = cs_build_controls,
82600 .build_pcms = cs_build_pcms,
82601 .init = cs_init,
82602 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_cmedia.c linux-2.6.39.1/sound/pci/hda/patch_cmedia.c
82603 --- linux-2.6.39.1/sound/pci/hda/patch_cmedia.c 2011-05-19 00:06:34.000000000 -0400
82604 +++ linux-2.6.39.1/sound/pci/hda/patch_cmedia.c 2011-05-22 19:36:35.000000000 -0400
82605 @@ -624,7 +624,7 @@ static struct snd_pci_quirk cmi9880_cfg_
82606 {} /* terminator */
82607 };
82608
82609 -static struct hda_codec_ops cmi9880_patch_ops = {
82610 +static const struct hda_codec_ops cmi9880_patch_ops = {
82611 .build_controls = cmi9880_build_controls,
82612 .build_pcms = cmi9880_build_pcms,
82613 .init = cmi9880_init,
82614 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_conexant.c linux-2.6.39.1/sound/pci/hda/patch_conexant.c
82615 --- linux-2.6.39.1/sound/pci/hda/patch_conexant.c 2011-06-03 00:04:14.000000000 -0400
82616 +++ linux-2.6.39.1/sound/pci/hda/patch_conexant.c 2011-06-03 00:32:08.000000000 -0400
82617 @@ -546,7 +546,7 @@ static int conexant_suspend(struct hda_c
82618 }
82619 #endif
82620
82621 -static struct hda_codec_ops conexant_patch_ops = {
82622 +static const struct hda_codec_ops conexant_patch_ops = {
82623 .build_controls = conexant_build_controls,
82624 .build_pcms = conexant_build_pcms,
82625 .init = conexant_init,
82626 @@ -3792,7 +3792,7 @@ static int cx_auto_build_controls(struct
82627 return conexant_build_controls(codec);
82628 }
82629
82630 -static struct hda_codec_ops cx_auto_patch_ops = {
82631 +static const struct hda_codec_ops cx_auto_patch_ops = {
82632 .build_controls = cx_auto_build_controls,
82633 .build_pcms = conexant_build_pcms,
82634 .init = cx_auto_init,
82635 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_hdmi.c linux-2.6.39.1/sound/pci/hda/patch_hdmi.c
82636 --- linux-2.6.39.1/sound/pci/hda/patch_hdmi.c 2011-05-19 00:06:34.000000000 -0400
82637 +++ linux-2.6.39.1/sound/pci/hda/patch_hdmi.c 2011-05-22 19:36:35.000000000 -0400
82638 @@ -1124,7 +1124,7 @@ static void generic_hdmi_free(struct hda
82639 kfree(spec);
82640 }
82641
82642 -static struct hda_codec_ops generic_hdmi_patch_ops = {
82643 +static const struct hda_codec_ops generic_hdmi_patch_ops = {
82644 .init = generic_hdmi_init,
82645 .free = generic_hdmi_free,
82646 .build_pcms = generic_hdmi_build_pcms,
82647 @@ -1465,14 +1465,14 @@ static struct hda_pcm_stream nvhdmi_pcm_
82648 },
82649 };
82650
82651 -static struct hda_codec_ops nvhdmi_patch_ops_8ch_7x = {
82652 +static const struct hda_codec_ops nvhdmi_patch_ops_8ch_7x = {
82653 .build_controls = generic_hdmi_build_controls,
82654 .build_pcms = generic_hdmi_build_pcms,
82655 .init = nvhdmi_7x_init,
82656 .free = generic_hdmi_free,
82657 };
82658
82659 -static struct hda_codec_ops nvhdmi_patch_ops_2ch = {
82660 +static const struct hda_codec_ops nvhdmi_patch_ops_2ch = {
82661 .build_controls = generic_hdmi_build_controls,
82662 .build_pcms = generic_hdmi_build_pcms,
82663 .init = nvhdmi_7x_init,
82664 @@ -1599,7 +1599,7 @@ static int atihdmi_init(struct hda_codec
82665 return 0;
82666 }
82667
82668 -static struct hda_codec_ops atihdmi_patch_ops = {
82669 +static const struct hda_codec_ops atihdmi_patch_ops = {
82670 .build_controls = generic_hdmi_build_controls,
82671 .build_pcms = generic_hdmi_build_pcms,
82672 .init = atihdmi_init,
82673 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_realtek.c linux-2.6.39.1/sound/pci/hda/patch_realtek.c
82674 --- linux-2.6.39.1/sound/pci/hda/patch_realtek.c 2011-05-19 00:06:34.000000000 -0400
82675 +++ linux-2.6.39.1/sound/pci/hda/patch_realtek.c 2011-05-22 19:36:35.000000000 -0400
82676 @@ -4273,7 +4273,7 @@ static int alc_resume(struct hda_codec *
82677
82678 /*
82679 */
82680 -static struct hda_codec_ops alc_patch_ops = {
82681 +static const struct hda_codec_ops alc_patch_ops = {
82682 .build_controls = alc_build_controls,
82683 .build_pcms = alc_build_pcms,
82684 .init = alc_init,
82685 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_si3054.c linux-2.6.39.1/sound/pci/hda/patch_si3054.c
82686 --- linux-2.6.39.1/sound/pci/hda/patch_si3054.c 2011-05-19 00:06:34.000000000 -0400
82687 +++ linux-2.6.39.1/sound/pci/hda/patch_si3054.c 2011-05-22 19:36:35.000000000 -0400
82688 @@ -263,7 +263,7 @@ static void si3054_free(struct hda_codec
82689 /*
82690 */
82691
82692 -static struct hda_codec_ops si3054_patch_ops = {
82693 +static const struct hda_codec_ops si3054_patch_ops = {
82694 .build_controls = si3054_build_controls,
82695 .build_pcms = si3054_build_pcms,
82696 .init = si3054_init,
82697 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_sigmatel.c linux-2.6.39.1/sound/pci/hda/patch_sigmatel.c
82698 --- linux-2.6.39.1/sound/pci/hda/patch_sigmatel.c 2011-06-03 00:04:14.000000000 -0400
82699 +++ linux-2.6.39.1/sound/pci/hda/patch_sigmatel.c 2011-06-03 00:32:08.000000000 -0400
82700 @@ -4968,7 +4968,7 @@ static int stac92xx_suspend(struct hda_c
82701 }
82702 #endif
82703
82704 -static struct hda_codec_ops stac92xx_patch_ops = {
82705 +static const struct hda_codec_ops stac92xx_patch_ops = {
82706 .build_controls = stac92xx_build_controls,
82707 .build_pcms = stac92xx_build_pcms,
82708 .init = stac92xx_init,
82709 diff -urNp linux-2.6.39.1/sound/pci/hda/patch_via.c linux-2.6.39.1/sound/pci/hda/patch_via.c
82710 --- linux-2.6.39.1/sound/pci/hda/patch_via.c 2011-05-19 00:06:34.000000000 -0400
82711 +++ linux-2.6.39.1/sound/pci/hda/patch_via.c 2011-05-22 19:36:35.000000000 -0400
82712 @@ -2254,7 +2254,7 @@ static int via_check_power_status(struct
82713
82714 /*
82715 */
82716 -static struct hda_codec_ops via_patch_ops = {
82717 +static const struct hda_codec_ops via_patch_ops = {
82718 .build_controls = via_build_controls,
82719 .build_pcms = via_build_pcms,
82720 .init = via_init,
82721 diff -urNp linux-2.6.39.1/sound/pci/ice1712/ice1712.c linux-2.6.39.1/sound/pci/ice1712/ice1712.c
82722 --- linux-2.6.39.1/sound/pci/ice1712/ice1712.c 2011-05-19 00:06:34.000000000 -0400
82723 +++ linux-2.6.39.1/sound/pci/ice1712/ice1712.c 2011-05-22 19:36:35.000000000 -0400
82724 @@ -2541,7 +2541,7 @@ static int __devinit snd_ice1712_create(
82725 {
82726 struct snd_ice1712 *ice;
82727 int err;
82728 - static struct snd_device_ops ops = {
82729 + static const struct snd_device_ops ops = {
82730 .dev_free = snd_ice1712_dev_free,
82731 };
82732
82733 diff -urNp linux-2.6.39.1/sound/pci/ice1712/ice1724.c linux-2.6.39.1/sound/pci/ice1712/ice1724.c
82734 --- linux-2.6.39.1/sound/pci/ice1712/ice1724.c 2011-05-19 00:06:34.000000000 -0400
82735 +++ linux-2.6.39.1/sound/pci/ice1712/ice1724.c 2011-05-22 19:36:35.000000000 -0400
82736 @@ -367,7 +367,7 @@ static void vt1724_midi_output_drain(str
82737 } while (time_after(timeout, jiffies));
82738 }
82739
82740 -static struct snd_rawmidi_ops vt1724_midi_output_ops = {
82741 +static const struct snd_rawmidi_ops vt1724_midi_output_ops = {
82742 .open = vt1724_midi_output_open,
82743 .close = vt1724_midi_output_close,
82744 .trigger = vt1724_midi_output_trigger,
82745 @@ -402,7 +402,7 @@ static void vt1724_midi_input_trigger(st
82746 spin_unlock_irqrestore(&ice->reg_lock, flags);
82747 }
82748
82749 -static struct snd_rawmidi_ops vt1724_midi_input_ops = {
82750 +static const struct snd_rawmidi_ops vt1724_midi_input_ops = {
82751 .open = vt1724_midi_input_open,
82752 .close = vt1724_midi_input_close,
82753 .trigger = vt1724_midi_input_trigger,
82754 @@ -2463,7 +2463,7 @@ static int __devinit snd_vt1724_create(s
82755 {
82756 struct snd_ice1712 *ice;
82757 int err;
82758 - static struct snd_device_ops ops = {
82759 + static const struct snd_device_ops ops = {
82760 .dev_free = snd_vt1724_dev_free,
82761 };
82762
82763 diff -urNp linux-2.6.39.1/sound/pci/intel8x0.c linux-2.6.39.1/sound/pci/intel8x0.c
82764 --- linux-2.6.39.1/sound/pci/intel8x0.c 2011-05-19 00:06:34.000000000 -0400
82765 +++ linux-2.6.39.1/sound/pci/intel8x0.c 2011-05-22 19:36:35.000000000 -0400
82766 @@ -2152,12 +2152,12 @@ static int __devinit snd_intel8x0_mixer(
82767 int err;
82768 unsigned int i, codecs;
82769 unsigned int glob_sta = 0;
82770 - struct snd_ac97_bus_ops *ops;
82771 - static struct snd_ac97_bus_ops standard_bus_ops = {
82772 + const struct snd_ac97_bus_ops *ops;
82773 + static const struct snd_ac97_bus_ops standard_bus_ops = {
82774 .write = snd_intel8x0_codec_write,
82775 .read = snd_intel8x0_codec_read,
82776 };
82777 - static struct snd_ac97_bus_ops ali_bus_ops = {
82778 + static const struct snd_ac97_bus_ops ali_bus_ops = {
82779 .write = snd_intel8x0_ali_codec_write,
82780 .read = snd_intel8x0_ali_codec_read,
82781 };
82782 @@ -2921,7 +2921,7 @@ static int __devinit snd_intel8x0_create
82783 unsigned int i;
82784 unsigned int int_sta_masks;
82785 struct ichdev *ichdev;
82786 - static struct snd_device_ops ops = {
82787 + static const struct snd_device_ops ops = {
82788 .dev_free = snd_intel8x0_dev_free,
82789 };
82790
82791 diff -urNp linux-2.6.39.1/sound/pci/intel8x0m.c linux-2.6.39.1/sound/pci/intel8x0m.c
82792 --- linux-2.6.39.1/sound/pci/intel8x0m.c 2011-05-19 00:06:34.000000000 -0400
82793 +++ linux-2.6.39.1/sound/pci/intel8x0m.c 2011-05-22 19:36:35.000000000 -0400
82794 @@ -826,7 +826,7 @@ static int __devinit snd_intel8x0m_mixer
82795 struct snd_ac97 *x97;
82796 int err;
82797 unsigned int glob_sta = 0;
82798 - static struct snd_ac97_bus_ops ops = {
82799 + static const struct snd_ac97_bus_ops ops = {
82800 .write = snd_intel8x0m_codec_write,
82801 .read = snd_intel8x0m_codec_read,
82802 };
82803 @@ -1116,7 +1116,7 @@ static int __devinit snd_intel8x0m_creat
82804 unsigned int i;
82805 unsigned int int_sta_masks;
82806 struct ichdev *ichdev;
82807 - static struct snd_device_ops ops = {
82808 + static const struct snd_device_ops ops = {
82809 .dev_free = snd_intel8x0m_dev_free,
82810 };
82811 static struct ich_reg_info intel_regs[2] = {
82812 @@ -1265,7 +1265,7 @@ static struct shortname_table {
82813 { 0x5455, "ALi M5455" },
82814 { 0x746d, "AMD AMD8111" },
82815 #endif
82816 - { 0 },
82817 + { 0, },
82818 };
82819
82820 static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
82821 diff -urNp linux-2.6.39.1/sound/pci/korg1212/korg1212.c linux-2.6.39.1/sound/pci/korg1212/korg1212.c
82822 --- linux-2.6.39.1/sound/pci/korg1212/korg1212.c 2011-05-19 00:06:34.000000000 -0400
82823 +++ linux-2.6.39.1/sound/pci/korg1212/korg1212.c 2011-05-22 19:36:35.000000000 -0400
82824 @@ -1682,7 +1682,7 @@ static int snd_korg1212_capture_copy(str
82825 return snd_korg1212_copy_to(korg1212, dst, pos, count, 0, korg1212->channels * 2);
82826 }
82827
82828 -static struct snd_pcm_ops snd_korg1212_playback_ops = {
82829 +static const struct snd_pcm_ops snd_korg1212_playback_ops = {
82830 .open = snd_korg1212_playback_open,
82831 .close = snd_korg1212_playback_close,
82832 .ioctl = snd_korg1212_ioctl,
82833 @@ -1694,7 +1694,7 @@ static struct snd_pcm_ops snd_korg1212_p
82834 .silence = snd_korg1212_playback_silence,
82835 };
82836
82837 -static struct snd_pcm_ops snd_korg1212_capture_ops = {
82838 +static const struct snd_pcm_ops snd_korg1212_capture_ops = {
82839 .open = snd_korg1212_capture_open,
82840 .close = snd_korg1212_capture_close,
82841 .ioctl = snd_korg1212_ioctl,
82842 @@ -2164,7 +2164,7 @@ static int __devinit snd_korg1212_create
82843 struct snd_korg1212 * korg1212;
82844 const struct firmware *dsp_code;
82845
82846 - static struct snd_device_ops ops = {
82847 + static const struct snd_device_ops ops = {
82848 .dev_free = snd_korg1212_dev_free,
82849 };
82850
82851 diff -urNp linux-2.6.39.1/sound/pci/maestro3.c linux-2.6.39.1/sound/pci/maestro3.c
82852 --- linux-2.6.39.1/sound/pci/maestro3.c 2011-05-19 00:06:34.000000000 -0400
82853 +++ linux-2.6.39.1/sound/pci/maestro3.c 2011-05-22 19:36:35.000000000 -0400
82854 @@ -1926,7 +1926,7 @@ snd_m3_capture_close(struct snd_pcm_subs
82855 * create pcm instance
82856 */
82857
82858 -static struct snd_pcm_ops snd_m3_playback_ops = {
82859 +static const struct snd_pcm_ops snd_m3_playback_ops = {
82860 .open = snd_m3_playback_open,
82861 .close = snd_m3_playback_close,
82862 .ioctl = snd_pcm_lib_ioctl,
82863 @@ -1937,7 +1937,7 @@ static struct snd_pcm_ops snd_m3_playbac
82864 .pointer = snd_m3_pcm_pointer,
82865 };
82866
82867 -static struct snd_pcm_ops snd_m3_capture_ops = {
82868 +static const struct snd_pcm_ops snd_m3_capture_ops = {
82869 .open = snd_m3_capture_open,
82870 .close = snd_m3_capture_close,
82871 .ioctl = snd_pcm_lib_ioctl,
82872 @@ -2150,7 +2150,7 @@ static int __devinit snd_m3_mixer(struct
82873 struct snd_ctl_elem_id elem_id;
82874 #endif
82875 int err;
82876 - static struct snd_ac97_bus_ops ops = {
82877 + static const struct snd_ac97_bus_ops ops = {
82878 .write = snd_m3_ac97_write,
82879 .read = snd_m3_ac97_read,
82880 };
82881 @@ -2643,7 +2643,7 @@ snd_m3_create(struct snd_card *card, str
82882 struct snd_m3 *chip;
82883 int i, err;
82884 const struct snd_pci_quirk *quirk;
82885 - static struct snd_device_ops ops = {
82886 + static const struct snd_device_ops ops = {
82887 .dev_free = snd_m3_dev_free,
82888 };
82889
82890 diff -urNp linux-2.6.39.1/sound/pci/mixart/mixart.c linux-2.6.39.1/sound/pci/mixart/mixart.c
82891 --- linux-2.6.39.1/sound/pci/mixart/mixart.c 2011-05-19 00:06:34.000000000 -0400
82892 +++ linux-2.6.39.1/sound/pci/mixart/mixart.c 2011-05-22 19:36:35.000000000 -0400
82893 @@ -887,7 +887,7 @@ static snd_pcm_uframes_t snd_mixart_stre
82894
82895
82896
82897 -static struct snd_pcm_ops snd_mixart_playback_ops = {
82898 +static const struct snd_pcm_ops snd_mixart_playback_ops = {
82899 .open = snd_mixart_playback_open,
82900 .close = snd_mixart_close,
82901 .ioctl = snd_pcm_lib_ioctl,
82902 @@ -898,7 +898,7 @@ static struct snd_pcm_ops snd_mixart_pla
82903 .pointer = snd_mixart_stream_pointer,
82904 };
82905
82906 -static struct snd_pcm_ops snd_mixart_capture_ops = {
82907 +static const struct snd_pcm_ops snd_mixart_capture_ops = {
82908 .open = snd_mixart_capture_open,
82909 .close = snd_mixart_close,
82910 .ioctl = snd_pcm_lib_ioctl,
82911 @@ -1008,7 +1008,7 @@ static int __devinit snd_mixart_create(s
82912 {
82913 int err;
82914 struct snd_mixart *chip;
82915 - static struct snd_device_ops ops = {
82916 + static const struct snd_device_ops ops = {
82917 .dev_free = snd_mixart_chip_dev_free,
82918 };
82919
82920 diff -urNp linux-2.6.39.1/sound/pci/nm256/nm256.c linux-2.6.39.1/sound/pci/nm256/nm256.c
82921 --- linux-2.6.39.1/sound/pci/nm256/nm256.c 2011-05-19 00:06:34.000000000 -0400
82922 +++ linux-2.6.39.1/sound/pci/nm256/nm256.c 2011-05-22 19:36:35.000000000 -0400
82923 @@ -899,7 +899,7 @@ snd_nm256_capture_close(struct snd_pcm_s
82924 /*
82925 * create a pcm instance
82926 */
82927 -static struct snd_pcm_ops snd_nm256_playback_ops = {
82928 +static const struct snd_pcm_ops snd_nm256_playback_ops = {
82929 .open = snd_nm256_playback_open,
82930 .close = snd_nm256_playback_close,
82931 .ioctl = snd_pcm_lib_ioctl,
82932 @@ -914,7 +914,7 @@ static struct snd_pcm_ops snd_nm256_play
82933 .mmap = snd_pcm_lib_mmap_iomem,
82934 };
82935
82936 -static struct snd_pcm_ops snd_nm256_capture_ops = {
82937 +static const struct snd_pcm_ops snd_nm256_capture_ops = {
82938 .open = snd_nm256_capture_open,
82939 .close = snd_nm256_capture_close,
82940 .ioctl = snd_pcm_lib_ioctl,
82941 @@ -1301,7 +1301,7 @@ snd_nm256_mixer(struct nm256 *chip)
82942 struct snd_ac97_bus *pbus;
82943 struct snd_ac97_template ac97;
82944 int err;
82945 - static struct snd_ac97_bus_ops ops = {
82946 + static const struct snd_ac97_bus_ops ops = {
82947 .reset = snd_nm256_ac97_reset,
82948 .write = snd_nm256_ac97_write,
82949 .read = snd_nm256_ac97_read,
82950 @@ -1471,7 +1471,7 @@ snd_nm256_create(struct snd_card *card,
82951 {
82952 struct nm256 *chip;
82953 int err, pval;
82954 - static struct snd_device_ops ops = {
82955 + static const struct snd_device_ops ops = {
82956 .dev_free = snd_nm256_dev_free,
82957 };
82958 u32 addr;
82959 diff -urNp linux-2.6.39.1/sound/pci/oxygen/oxygen_pcm.c linux-2.6.39.1/sound/pci/oxygen/oxygen_pcm.c
82960 --- linux-2.6.39.1/sound/pci/oxygen/oxygen_pcm.c 2011-05-19 00:06:34.000000000 -0400
82961 +++ linux-2.6.39.1/sound/pci/oxygen/oxygen_pcm.c 2011-05-22 19:36:35.000000000 -0400
82962 @@ -606,7 +606,7 @@ static snd_pcm_uframes_t oxygen_pointer(
82963 return bytes_to_frames(runtime, curr_addr - (u32)runtime->dma_addr);
82964 }
82965
82966 -static struct snd_pcm_ops oxygen_rec_a_ops = {
82967 +static const struct snd_pcm_ops oxygen_rec_a_ops = {
82968 .open = oxygen_rec_a_open,
82969 .close = oxygen_close,
82970 .ioctl = snd_pcm_lib_ioctl,
82971 @@ -617,7 +617,7 @@ static struct snd_pcm_ops oxygen_rec_a_o
82972 .pointer = oxygen_pointer,
82973 };
82974
82975 -static struct snd_pcm_ops oxygen_rec_b_ops = {
82976 +static const struct snd_pcm_ops oxygen_rec_b_ops = {
82977 .open = oxygen_rec_b_open,
82978 .close = oxygen_close,
82979 .ioctl = snd_pcm_lib_ioctl,
82980 @@ -628,7 +628,7 @@ static struct snd_pcm_ops oxygen_rec_b_o
82981 .pointer = oxygen_pointer,
82982 };
82983
82984 -static struct snd_pcm_ops oxygen_rec_c_ops = {
82985 +static const struct snd_pcm_ops oxygen_rec_c_ops = {
82986 .open = oxygen_rec_c_open,
82987 .close = oxygen_close,
82988 .ioctl = snd_pcm_lib_ioctl,
82989 @@ -639,7 +639,7 @@ static struct snd_pcm_ops oxygen_rec_c_o
82990 .pointer = oxygen_pointer,
82991 };
82992
82993 -static struct snd_pcm_ops oxygen_spdif_ops = {
82994 +static const struct snd_pcm_ops oxygen_spdif_ops = {
82995 .open = oxygen_spdif_open,
82996 .close = oxygen_close,
82997 .ioctl = snd_pcm_lib_ioctl,
82998 @@ -650,7 +650,7 @@ static struct snd_pcm_ops oxygen_spdif_o
82999 .pointer = oxygen_pointer,
83000 };
83001
83002 -static struct snd_pcm_ops oxygen_multich_ops = {
83003 +static const struct snd_pcm_ops oxygen_multich_ops = {
83004 .open = oxygen_multich_open,
83005 .close = oxygen_close,
83006 .ioctl = snd_pcm_lib_ioctl,
83007 @@ -661,7 +661,7 @@ static struct snd_pcm_ops oxygen_multich
83008 .pointer = oxygen_pointer,
83009 };
83010
83011 -static struct snd_pcm_ops oxygen_ac97_ops = {
83012 +static const struct snd_pcm_ops oxygen_ac97_ops = {
83013 .open = oxygen_ac97_open,
83014 .close = oxygen_close,
83015 .ioctl = snd_pcm_lib_ioctl,
83016 diff -urNp linux-2.6.39.1/sound/pci/pcxhr/pcxhr.c linux-2.6.39.1/sound/pci/pcxhr/pcxhr.c
83017 --- linux-2.6.39.1/sound/pci/pcxhr/pcxhr.c 2011-05-19 00:06:34.000000000 -0400
83018 +++ linux-2.6.39.1/sound/pci/pcxhr/pcxhr.c 2011-05-22 19:36:35.000000000 -0400
83019 @@ -1121,7 +1121,7 @@ static snd_pcm_uframes_t pcxhr_stream_po
83020 }
83021
83022
83023 -static struct snd_pcm_ops pcxhr_ops = {
83024 +static const struct snd_pcm_ops pcxhr_ops = {
83025 .open = pcxhr_open,
83026 .close = pcxhr_close,
83027 .ioctl = snd_pcm_lib_ioctl,
83028 @@ -1184,7 +1184,7 @@ static int __devinit pcxhr_create(struct
83029 {
83030 int err;
83031 struct snd_pcxhr *chip;
83032 - static struct snd_device_ops ops = {
83033 + static const struct snd_device_ops ops = {
83034 .dev_free = pcxhr_chip_dev_free,
83035 };
83036
83037 diff -urNp linux-2.6.39.1/sound/pci/riptide/riptide.c linux-2.6.39.1/sound/pci/riptide/riptide.c
83038 --- linux-2.6.39.1/sound/pci/riptide/riptide.c 2011-05-19 00:06:34.000000000 -0400
83039 +++ linux-2.6.39.1/sound/pci/riptide/riptide.c 2011-05-22 19:36:35.000000000 -0400
83040 @@ -1675,7 +1675,7 @@ static int snd_riptide_capture_close(str
83041 return 0;
83042 }
83043
83044 -static struct snd_pcm_ops snd_riptide_playback_ops = {
83045 +static const struct snd_pcm_ops snd_riptide_playback_ops = {
83046 .open = snd_riptide_playback_open,
83047 .close = snd_riptide_playback_close,
83048 .ioctl = snd_pcm_lib_ioctl,
83049 @@ -1686,7 +1686,7 @@ static struct snd_pcm_ops snd_riptide_pl
83050 .trigger = snd_riptide_trigger,
83051 .pointer = snd_riptide_pointer,
83052 };
83053 -static struct snd_pcm_ops snd_riptide_capture_ops = {
83054 +static const struct snd_pcm_ops snd_riptide_capture_ops = {
83055 .open = snd_riptide_capture_open,
83056 .close = snd_riptide_capture_close,
83057 .ioctl = snd_pcm_lib_ioctl,
83058 @@ -1857,7 +1857,7 @@ snd_riptide_create(struct snd_card *card
83059 struct snd_riptide *chip;
83060 struct riptideport *hwport;
83061 int err;
83062 - static struct snd_device_ops ops = {
83063 + static const struct snd_device_ops ops = {
83064 .dev_free = snd_riptide_dev_free,
83065 };
83066
83067 @@ -1999,7 +1999,7 @@ static int __devinit snd_riptide_mixer(s
83068 struct snd_ac97_bus *pbus;
83069 struct snd_ac97_template ac97;
83070 int err = 0;
83071 - static struct snd_ac97_bus_ops ops = {
83072 + static const struct snd_ac97_bus_ops ops = {
83073 .write = snd_riptide_codec_write,
83074 .read = snd_riptide_codec_read,
83075 };
83076 diff -urNp linux-2.6.39.1/sound/pci/rme32.c linux-2.6.39.1/sound/pci/rme32.c
83077 --- linux-2.6.39.1/sound/pci/rme32.c 2011-05-19 00:06:34.000000000 -0400
83078 +++ linux-2.6.39.1/sound/pci/rme32.c 2011-05-22 19:36:35.000000000 -0400
83079 @@ -1197,7 +1197,7 @@ snd_rme32_capture_fd_pointer(struct snd_
83080 }
83081
83082 /* for halfduplex mode */
83083 -static struct snd_pcm_ops snd_rme32_playback_spdif_ops = {
83084 +static const struct snd_pcm_ops snd_rme32_playback_spdif_ops = {
83085 .open = snd_rme32_playback_spdif_open,
83086 .close = snd_rme32_playback_close,
83087 .ioctl = snd_pcm_lib_ioctl,
83088 @@ -1211,7 +1211,7 @@ static struct snd_pcm_ops snd_rme32_play
83089 .mmap = snd_pcm_lib_mmap_iomem,
83090 };
83091
83092 -static struct snd_pcm_ops snd_rme32_capture_spdif_ops = {
83093 +static const struct snd_pcm_ops snd_rme32_capture_spdif_ops = {
83094 .open = snd_rme32_capture_spdif_open,
83095 .close = snd_rme32_capture_close,
83096 .ioctl = snd_pcm_lib_ioctl,
83097 @@ -1224,7 +1224,7 @@ static struct snd_pcm_ops snd_rme32_capt
83098 .mmap = snd_pcm_lib_mmap_iomem,
83099 };
83100
83101 -static struct snd_pcm_ops snd_rme32_playback_adat_ops = {
83102 +static const struct snd_pcm_ops snd_rme32_playback_adat_ops = {
83103 .open = snd_rme32_playback_adat_open,
83104 .close = snd_rme32_playback_close,
83105 .ioctl = snd_pcm_lib_ioctl,
83106 @@ -1237,7 +1237,7 @@ static struct snd_pcm_ops snd_rme32_play
83107 .mmap = snd_pcm_lib_mmap_iomem,
83108 };
83109
83110 -static struct snd_pcm_ops snd_rme32_capture_adat_ops = {
83111 +static const struct snd_pcm_ops snd_rme32_capture_adat_ops = {
83112 .open = snd_rme32_capture_adat_open,
83113 .close = snd_rme32_capture_close,
83114 .ioctl = snd_pcm_lib_ioctl,
83115 @@ -1250,7 +1250,7 @@ static struct snd_pcm_ops snd_rme32_capt
83116 };
83117
83118 /* for fullduplex mode */
83119 -static struct snd_pcm_ops snd_rme32_playback_spdif_fd_ops = {
83120 +static const struct snd_pcm_ops snd_rme32_playback_spdif_fd_ops = {
83121 .open = snd_rme32_playback_spdif_open,
83122 .close = snd_rme32_playback_close,
83123 .ioctl = snd_pcm_lib_ioctl,
83124 @@ -1262,7 +1262,7 @@ static struct snd_pcm_ops snd_rme32_play
83125 .ack = snd_rme32_playback_fd_ack,
83126 };
83127
83128 -static struct snd_pcm_ops snd_rme32_capture_spdif_fd_ops = {
83129 +static const struct snd_pcm_ops snd_rme32_capture_spdif_fd_ops = {
83130 .open = snd_rme32_capture_spdif_open,
83131 .close = snd_rme32_capture_close,
83132 .ioctl = snd_pcm_lib_ioctl,
83133 @@ -1274,7 +1274,7 @@ static struct snd_pcm_ops snd_rme32_capt
83134 .ack = snd_rme32_capture_fd_ack,
83135 };
83136
83137 -static struct snd_pcm_ops snd_rme32_playback_adat_fd_ops = {
83138 +static const struct snd_pcm_ops snd_rme32_playback_adat_fd_ops = {
83139 .open = snd_rme32_playback_adat_open,
83140 .close = snd_rme32_playback_close,
83141 .ioctl = snd_pcm_lib_ioctl,
83142 @@ -1285,7 +1285,7 @@ static struct snd_pcm_ops snd_rme32_play
83143 .ack = snd_rme32_playback_fd_ack,
83144 };
83145
83146 -static struct snd_pcm_ops snd_rme32_capture_adat_fd_ops = {
83147 +static const struct snd_pcm_ops snd_rme32_capture_adat_fd_ops = {
83148 .open = snd_rme32_capture_adat_open,
83149 .close = snd_rme32_capture_close,
83150 .ioctl = snd_pcm_lib_ioctl,
83151 diff -urNp linux-2.6.39.1/sound/pci/rme9652/hdsp.c linux-2.6.39.1/sound/pci/rme9652/hdsp.c
83152 --- linux-2.6.39.1/sound/pci/rme9652/hdsp.c 2011-05-19 00:06:34.000000000 -0400
83153 +++ linux-2.6.39.1/sound/pci/rme9652/hdsp.c 2011-05-22 19:36:35.000000000 -0400
83154 @@ -1469,15 +1469,13 @@ static int snd_hdsp_midi_output_close(st
83155 return 0;
83156 }
83157
83158 -static struct snd_rawmidi_ops snd_hdsp_midi_output =
83159 -{
83160 +static const struct snd_rawmidi_ops snd_hdsp_midi_output = {
83161 .open = snd_hdsp_midi_output_open,
83162 .close = snd_hdsp_midi_output_close,
83163 .trigger = snd_hdsp_midi_output_trigger,
83164 };
83165
83166 -static struct snd_rawmidi_ops snd_hdsp_midi_input =
83167 -{
83168 +static const struct snd_rawmidi_ops snd_hdsp_midi_input = {
83169 .open = snd_hdsp_midi_input_open,
83170 .close = snd_hdsp_midi_input_close,
83171 .trigger = snd_hdsp_midi_input_trigger,
83172 @@ -5135,7 +5133,7 @@ static int snd_hdsp_hwdep_ioctl(struct s
83173 return 0;
83174 }
83175
83176 -static struct snd_pcm_ops snd_hdsp_playback_ops = {
83177 +static const struct snd_pcm_ops snd_hdsp_playback_ops = {
83178 .open = snd_hdsp_playback_open,
83179 .close = snd_hdsp_playback_release,
83180 .ioctl = snd_hdsp_ioctl,
83181 @@ -5147,7 +5145,7 @@ static struct snd_pcm_ops snd_hdsp_playb
83182 .silence = snd_hdsp_hw_silence,
83183 };
83184
83185 -static struct snd_pcm_ops snd_hdsp_capture_ops = {
83186 +static const struct snd_pcm_ops snd_hdsp_capture_ops = {
83187 .open = snd_hdsp_capture_open,
83188 .close = snd_hdsp_capture_release,
83189 .ioctl = snd_hdsp_ioctl,
83190 diff -urNp linux-2.6.39.1/sound/pci/rme9652/hdspm.c linux-2.6.39.1/sound/pci/rme9652/hdspm.c
83191 --- linux-2.6.39.1/sound/pci/rme9652/hdspm.c 2011-05-19 00:06:34.000000000 -0400
83192 +++ linux-2.6.39.1/sound/pci/rme9652/hdspm.c 2011-05-22 19:36:35.000000000 -0400
83193 @@ -1773,15 +1773,13 @@ static int snd_hdspm_midi_output_close(s
83194 return 0;
83195 }
83196
83197 -static struct snd_rawmidi_ops snd_hdspm_midi_output =
83198 -{
83199 +static const struct snd_rawmidi_ops snd_hdspm_midi_output = {
83200 .open = snd_hdspm_midi_output_open,
83201 .close = snd_hdspm_midi_output_close,
83202 .trigger = snd_hdspm_midi_output_trigger,
83203 };
83204
83205 -static struct snd_rawmidi_ops snd_hdspm_midi_input =
83206 -{
83207 +static const struct snd_rawmidi_ops snd_hdspm_midi_input = {
83208 .open = snd_hdspm_midi_input_open,
83209 .close = snd_hdspm_midi_input_close,
83210 .trigger = snd_hdspm_midi_input_trigger,
83211 @@ -6172,7 +6170,7 @@ static int snd_hdspm_hwdep_ioctl(struct
83212 return 0;
83213 }
83214
83215 -static struct snd_pcm_ops snd_hdspm_playback_ops = {
83216 +static const struct snd_pcm_ops snd_hdspm_playback_ops = {
83217 .open = snd_hdspm_playback_open,
83218 .close = snd_hdspm_playback_release,
83219 .ioctl = snd_hdspm_ioctl,
83220 @@ -6184,7 +6182,7 @@ static struct snd_pcm_ops snd_hdspm_play
83221 .page = snd_pcm_sgbuf_ops_page,
83222 };
83223
83224 -static struct snd_pcm_ops snd_hdspm_capture_ops = {
83225 +static const struct snd_pcm_ops snd_hdspm_capture_ops = {
83226 .open = snd_hdspm_capture_open,
83227 .close = snd_hdspm_capture_release,
83228 .ioctl = snd_hdspm_ioctl,
83229 diff -urNp linux-2.6.39.1/sound/pci/rme9652/rme9652.c linux-2.6.39.1/sound/pci/rme9652/rme9652.c
83230 --- linux-2.6.39.1/sound/pci/rme9652/rme9652.c 2011-05-19 00:06:34.000000000 -0400
83231 +++ linux-2.6.39.1/sound/pci/rme9652/rme9652.c 2011-05-22 19:36:35.000000000 -0400
83232 @@ -2391,7 +2391,7 @@ static int snd_rme9652_capture_release(s
83233 return 0;
83234 }
83235
83236 -static struct snd_pcm_ops snd_rme9652_playback_ops = {
83237 +static const struct snd_pcm_ops snd_rme9652_playback_ops = {
83238 .open = snd_rme9652_playback_open,
83239 .close = snd_rme9652_playback_release,
83240 .ioctl = snd_rme9652_ioctl,
83241 @@ -2403,7 +2403,7 @@ static struct snd_pcm_ops snd_rme9652_pl
83242 .silence = snd_rme9652_hw_silence,
83243 };
83244
83245 -static struct snd_pcm_ops snd_rme9652_capture_ops = {
83246 +static const struct snd_pcm_ops snd_rme9652_capture_ops = {
83247 .open = snd_rme9652_capture_open,
83248 .close = snd_rme9652_capture_release,
83249 .ioctl = snd_rme9652_ioctl,
83250 diff -urNp linux-2.6.39.1/sound/pci/rme96.c linux-2.6.39.1/sound/pci/rme96.c
83251 --- linux-2.6.39.1/sound/pci/rme96.c 2011-05-19 00:06:34.000000000 -0400
83252 +++ linux-2.6.39.1/sound/pci/rme96.c 2011-05-22 19:36:35.000000000 -0400
83253 @@ -1447,7 +1447,7 @@ snd_rme96_capture_pointer(struct snd_pcm
83254 return snd_rme96_capture_ptr(rme96);
83255 }
83256
83257 -static struct snd_pcm_ops snd_rme96_playback_spdif_ops = {
83258 +static const struct snd_pcm_ops snd_rme96_playback_spdif_ops = {
83259 .open = snd_rme96_playback_spdif_open,
83260 .close = snd_rme96_playback_close,
83261 .ioctl = snd_pcm_lib_ioctl,
83262 @@ -1460,7 +1460,7 @@ static struct snd_pcm_ops snd_rme96_play
83263 .mmap = snd_pcm_lib_mmap_iomem,
83264 };
83265
83266 -static struct snd_pcm_ops snd_rme96_capture_spdif_ops = {
83267 +static const struct snd_pcm_ops snd_rme96_capture_spdif_ops = {
83268 .open = snd_rme96_capture_spdif_open,
83269 .close = snd_rme96_capture_close,
83270 .ioctl = snd_pcm_lib_ioctl,
83271 @@ -1472,7 +1472,7 @@ static struct snd_pcm_ops snd_rme96_capt
83272 .mmap = snd_pcm_lib_mmap_iomem,
83273 };
83274
83275 -static struct snd_pcm_ops snd_rme96_playback_adat_ops = {
83276 +static const struct snd_pcm_ops snd_rme96_playback_adat_ops = {
83277 .open = snd_rme96_playback_adat_open,
83278 .close = snd_rme96_playback_close,
83279 .ioctl = snd_pcm_lib_ioctl,
83280 @@ -1485,7 +1485,7 @@ static struct snd_pcm_ops snd_rme96_play
83281 .mmap = snd_pcm_lib_mmap_iomem,
83282 };
83283
83284 -static struct snd_pcm_ops snd_rme96_capture_adat_ops = {
83285 +static const struct snd_pcm_ops snd_rme96_capture_adat_ops = {
83286 .open = snd_rme96_capture_adat_open,
83287 .close = snd_rme96_capture_close,
83288 .ioctl = snd_pcm_lib_ioctl,
83289 diff -urNp linux-2.6.39.1/sound/pci/sis7019.c linux-2.6.39.1/sound/pci/sis7019.c
83290 --- linux-2.6.39.1/sound/pci/sis7019.c 2011-05-19 00:06:34.000000000 -0400
83291 +++ linux-2.6.39.1/sound/pci/sis7019.c 2011-05-22 19:36:35.000000000 -0400
83292 @@ -1011,7 +1011,7 @@ static int __devinit sis_mixer_create(st
83293 {
83294 struct snd_ac97_bus *bus;
83295 struct snd_ac97_template ac97;
83296 - static struct snd_ac97_bus_ops ops = {
83297 + static const struct snd_ac97_bus_ops ops = {
83298 .write = sis_ac97_write,
83299 .read = sis_ac97_read,
83300 };
83301 @@ -1293,7 +1293,7 @@ static int __devinit sis_chip_create(str
83302 {
83303 struct sis7019 *sis = card->private_data;
83304 struct voice *voice;
83305 - static struct snd_device_ops ops = {
83306 + static const struct snd_device_ops ops = {
83307 .dev_free = sis_dev_free,
83308 };
83309 int rc;
83310 diff -urNp linux-2.6.39.1/sound/pci/sonicvibes.c linux-2.6.39.1/sound/pci/sonicvibes.c
83311 --- linux-2.6.39.1/sound/pci/sonicvibes.c 2011-05-19 00:06:34.000000000 -0400
83312 +++ linux-2.6.39.1/sound/pci/sonicvibes.c 2011-05-22 19:36:35.000000000 -0400
83313 @@ -855,7 +855,7 @@ static int snd_sonicvibes_capture_close(
83314 return 0;
83315 }
83316
83317 -static struct snd_pcm_ops snd_sonicvibes_playback_ops = {
83318 +static const struct snd_pcm_ops snd_sonicvibes_playback_ops = {
83319 .open = snd_sonicvibes_playback_open,
83320 .close = snd_sonicvibes_playback_close,
83321 .ioctl = snd_pcm_lib_ioctl,
83322 @@ -866,7 +866,7 @@ static struct snd_pcm_ops snd_sonicvibes
83323 .pointer = snd_sonicvibes_playback_pointer,
83324 };
83325
83326 -static struct snd_pcm_ops snd_sonicvibes_capture_ops = {
83327 +static const struct snd_pcm_ops snd_sonicvibes_capture_ops = {
83328 .open = snd_sonicvibes_capture_open,
83329 .close = snd_sonicvibes_capture_close,
83330 .ioctl = snd_pcm_lib_ioctl,
83331 @@ -1255,7 +1255,7 @@ static int __devinit snd_sonicvibes_crea
83332 struct sonicvibes *sonic;
83333 unsigned int dmaa, dmac;
83334 int err;
83335 - static struct snd_device_ops ops = {
83336 + static const struct snd_device_ops ops = {
83337 .dev_free = snd_sonicvibes_dev_free,
83338 };
83339
83340 diff -urNp linux-2.6.39.1/sound/pci/trident/trident_main.c linux-2.6.39.1/sound/pci/trident/trident_main.c
83341 --- linux-2.6.39.1/sound/pci/trident/trident_main.c 2011-05-19 00:06:34.000000000 -0400
83342 +++ linux-2.6.39.1/sound/pci/trident/trident_main.c 2011-05-22 19:36:35.000000000 -0400
83343 @@ -3549,7 +3549,7 @@ int __devinit snd_trident_create(struct
83344 int i, err;
83345 struct snd_trident_voice *voice;
83346 struct snd_trident_pcm_mixer *tmix;
83347 - static struct snd_device_ops ops = {
83348 + static const struct snd_device_ops ops = {
83349 .dev_free = snd_trident_dev_free,
83350 };
83351
83352 diff -urNp linux-2.6.39.1/sound/pci/via82xx.c linux-2.6.39.1/sound/pci/via82xx.c
83353 --- linux-2.6.39.1/sound/pci/via82xx.c 2011-05-19 00:06:34.000000000 -0400
83354 +++ linux-2.6.39.1/sound/pci/via82xx.c 2011-05-22 19:36:35.000000000 -0400
83355 @@ -1352,7 +1352,7 @@ static int snd_via8233_playback_close(st
83356
83357
83358 /* via686 playback callbacks */
83359 -static struct snd_pcm_ops snd_via686_playback_ops = {
83360 +static const struct snd_pcm_ops snd_via686_playback_ops = {
83361 .open = snd_via686_playback_open,
83362 .close = snd_via82xx_pcm_close,
83363 .ioctl = snd_pcm_lib_ioctl,
83364 @@ -1365,7 +1365,7 @@ static struct snd_pcm_ops snd_via686_pla
83365 };
83366
83367 /* via686 capture callbacks */
83368 -static struct snd_pcm_ops snd_via686_capture_ops = {
83369 +static const struct snd_pcm_ops snd_via686_capture_ops = {
83370 .open = snd_via82xx_capture_open,
83371 .close = snd_via82xx_pcm_close,
83372 .ioctl = snd_pcm_lib_ioctl,
83373 @@ -1378,7 +1378,7 @@ static struct snd_pcm_ops snd_via686_cap
83374 };
83375
83376 /* via823x DSX playback callbacks */
83377 -static struct snd_pcm_ops snd_via8233_playback_ops = {
83378 +static const struct snd_pcm_ops snd_via8233_playback_ops = {
83379 .open = snd_via8233_playback_open,
83380 .close = snd_via8233_playback_close,
83381 .ioctl = snd_pcm_lib_ioctl,
83382 @@ -1391,7 +1391,7 @@ static struct snd_pcm_ops snd_via8233_pl
83383 };
83384
83385 /* via823x multi-channel playback callbacks */
83386 -static struct snd_pcm_ops snd_via8233_multi_ops = {
83387 +static const struct snd_pcm_ops snd_via8233_multi_ops = {
83388 .open = snd_via8233_multi_open,
83389 .close = snd_via82xx_pcm_close,
83390 .ioctl = snd_pcm_lib_ioctl,
83391 @@ -1404,7 +1404,7 @@ static struct snd_pcm_ops snd_via8233_mu
83392 };
83393
83394 /* via823x capture callbacks */
83395 -static struct snd_pcm_ops snd_via8233_capture_ops = {
83396 +static const struct snd_pcm_ops snd_via8233_capture_ops = {
83397 .open = snd_via82xx_capture_open,
83398 .close = snd_via82xx_pcm_close,
83399 .ioctl = snd_pcm_lib_ioctl,
83400 @@ -1868,7 +1868,7 @@ static int __devinit snd_via82xx_mixer_n
83401 {
83402 struct snd_ac97_template ac97;
83403 int err;
83404 - static struct snd_ac97_bus_ops ops = {
83405 + static const struct snd_ac97_bus_ops ops = {
83406 .write = snd_via82xx_codec_write,
83407 .read = snd_via82xx_codec_read,
83408 .wait = snd_via82xx_codec_wait,
83409 @@ -2340,7 +2340,7 @@ static int __devinit snd_via82xx_create(
83410 {
83411 struct via82xx *chip;
83412 int err;
83413 - static struct snd_device_ops ops = {
83414 + static const struct snd_device_ops ops = {
83415 .dev_free = snd_via82xx_dev_free,
83416 };
83417
83418 diff -urNp linux-2.6.39.1/sound/pci/via82xx_modem.c linux-2.6.39.1/sound/pci/via82xx_modem.c
83419 --- linux-2.6.39.1/sound/pci/via82xx_modem.c 2011-05-19 00:06:34.000000000 -0400
83420 +++ linux-2.6.39.1/sound/pci/via82xx_modem.c 2011-05-22 19:36:35.000000000 -0400
83421 @@ -799,7 +799,7 @@ static int snd_via82xx_pcm_close(struct
83422
83423
83424 /* via686 playback callbacks */
83425 -static struct snd_pcm_ops snd_via686_playback_ops = {
83426 +static const struct snd_pcm_ops snd_via686_playback_ops = {
83427 .open = snd_via82xx_playback_open,
83428 .close = snd_via82xx_pcm_close,
83429 .ioctl = snd_pcm_lib_ioctl,
83430 @@ -812,7 +812,7 @@ static struct snd_pcm_ops snd_via686_pla
83431 };
83432
83433 /* via686 capture callbacks */
83434 -static struct snd_pcm_ops snd_via686_capture_ops = {
83435 +static const struct snd_pcm_ops snd_via686_capture_ops = {
83436 .open = snd_via82xx_capture_open,
83437 .close = snd_via82xx_pcm_close,
83438 .ioctl = snd_pcm_lib_ioctl,
83439 @@ -889,7 +889,7 @@ static int __devinit snd_via82xx_mixer_n
83440 {
83441 struct snd_ac97_template ac97;
83442 int err;
83443 - static struct snd_ac97_bus_ops ops = {
83444 + static const struct snd_ac97_bus_ops ops = {
83445 .write = snd_via82xx_codec_write,
83446 .read = snd_via82xx_codec_read,
83447 .wait = snd_via82xx_codec_wait,
83448 @@ -1105,7 +1105,7 @@ static int __devinit snd_via82xx_create(
83449 {
83450 struct via82xx_modem *chip;
83451 int err;
83452 - static struct snd_device_ops ops = {
83453 + static const struct snd_device_ops ops = {
83454 .dev_free = snd_via82xx_dev_free,
83455 };
83456
83457 diff -urNp linux-2.6.39.1/sound/pci/vx222/vx222.c linux-2.6.39.1/sound/pci/vx222/vx222.c
83458 --- linux-2.6.39.1/sound/pci/vx222/vx222.c 2011-05-19 00:06:34.000000000 -0400
83459 +++ linux-2.6.39.1/sound/pci/vx222/vx222.c 2011-05-22 19:36:35.000000000 -0400
83460 @@ -141,7 +141,7 @@ static int __devinit snd_vx222_create(st
83461 struct vx_core *chip;
83462 struct snd_vx222 *vx;
83463 int i, err;
83464 - static struct snd_device_ops ops = {
83465 + static const struct snd_device_ops ops = {
83466 .dev_free = snd_vx222_dev_free,
83467 };
83468 struct snd_vx_ops *vx_ops;
83469 diff -urNp linux-2.6.39.1/sound/pci/ymfpci/ymfpci_main.c linux-2.6.39.1/sound/pci/ymfpci/ymfpci_main.c
83470 --- linux-2.6.39.1/sound/pci/ymfpci/ymfpci_main.c 2011-05-19 00:06:34.000000000 -0400
83471 +++ linux-2.6.39.1/sound/pci/ymfpci/ymfpci_main.c 2011-05-22 19:36:35.000000000 -0400
83472 @@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
83473 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
83474 break;
83475 }
83476 - if (atomic_read(&chip->interrupt_sleep_count)) {
83477 - atomic_set(&chip->interrupt_sleep_count, 0);
83478 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
83479 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
83480 wake_up(&chip->interrupt_sleep);
83481 }
83482 __end:
83483 @@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct s
83484 continue;
83485 init_waitqueue_entry(&wait, current);
83486 add_wait_queue(&chip->interrupt_sleep, &wait);
83487 - atomic_inc(&chip->interrupt_sleep_count);
83488 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
83489 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
83490 remove_wait_queue(&chip->interrupt_sleep, &wait);
83491 }
83492 @@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(
83493 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
83494 spin_unlock(&chip->reg_lock);
83495
83496 - if (atomic_read(&chip->interrupt_sleep_count)) {
83497 - atomic_set(&chip->interrupt_sleep_count, 0);
83498 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
83499 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
83500 wake_up(&chip->interrupt_sleep);
83501 }
83502 }
83503 @@ -2344,7 +2344,7 @@ int __devinit snd_ymfpci_create(struct s
83504 {
83505 struct snd_ymfpci *chip;
83506 int err;
83507 - static struct snd_device_ops ops = {
83508 + static const struct snd_device_ops ops = {
83509 .dev_free = snd_ymfpci_dev_free,
83510 };
83511
83512 @@ -2363,7 +2363,7 @@ int __devinit snd_ymfpci_create(struct s
83513 spin_lock_init(&chip->reg_lock);
83514 spin_lock_init(&chip->voice_lock);
83515 init_waitqueue_head(&chip->interrupt_sleep);
83516 - atomic_set(&chip->interrupt_sleep_count, 0);
83517 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
83518 chip->card = card;
83519 chip->pci = pci;
83520 chip->irq = -1;
83521 diff -urNp linux-2.6.39.1/sound/pcmcia/pdaudiocf/pdaudiocf.c linux-2.6.39.1/sound/pcmcia/pdaudiocf/pdaudiocf.c
83522 --- linux-2.6.39.1/sound/pcmcia/pdaudiocf/pdaudiocf.c 2011-05-19 00:06:34.000000000 -0400
83523 +++ linux-2.6.39.1/sound/pcmcia/pdaudiocf/pdaudiocf.c 2011-05-22 19:36:35.000000000 -0400
83524 @@ -94,7 +94,7 @@ static int snd_pdacf_probe(struct pcmcia
83525 int i, err;
83526 struct snd_pdacf *pdacf;
83527 struct snd_card *card;
83528 - static struct snd_device_ops ops = {
83529 + static const struct snd_device_ops ops = {
83530 .dev_free = snd_pdacf_dev_free,
83531 };
83532
83533 diff -urNp linux-2.6.39.1/sound/pcmcia/vx/vxpocket.c linux-2.6.39.1/sound/pcmcia/vx/vxpocket.c
83534 --- linux-2.6.39.1/sound/pcmcia/vx/vxpocket.c 2011-05-19 00:06:34.000000000 -0400
83535 +++ linux-2.6.39.1/sound/pcmcia/vx/vxpocket.c 2011-05-22 19:36:35.000000000 -0400
83536 @@ -137,7 +137,7 @@ static int snd_vxpocket_new(struct snd_c
83537 {
83538 struct vx_core *chip;
83539 struct snd_vxpocket *vxp;
83540 - static struct snd_device_ops ops = {
83541 + static const struct snd_device_ops ops = {
83542 .dev_free = snd_vxpocket_dev_free,
83543 };
83544 int err;
83545 diff -urNp linux-2.6.39.1/sound/ppc/pmac.c linux-2.6.39.1/sound/ppc/pmac.c
83546 --- linux-2.6.39.1/sound/ppc/pmac.c 2011-05-19 00:06:34.000000000 -0400
83547 +++ linux-2.6.39.1/sound/ppc/pmac.c 2011-05-22 19:36:35.000000000 -0400
83548 @@ -1186,7 +1186,7 @@ int __devinit snd_pmac_new(struct snd_ca
83549 int i, err;
83550 unsigned int irq;
83551 unsigned long ctrl_addr, txdma_addr, rxdma_addr;
83552 - static struct snd_device_ops ops = {
83553 + static const struct snd_device_ops ops = {
83554 .dev_free = snd_pmac_dev_free,
83555 };
83556
83557 diff -urNp linux-2.6.39.1/sound/ppc/snd_ps3.c linux-2.6.39.1/sound/ppc/snd_ps3.c
83558 --- linux-2.6.39.1/sound/ppc/snd_ps3.c 2011-05-19 00:06:34.000000000 -0400
83559 +++ linux-2.6.39.1/sound/ppc/snd_ps3.c 2011-05-22 19:36:35.000000000 -0400
83560 @@ -773,7 +773,7 @@ static struct snd_kcontrol_new spdif_ctl
83561 },
83562 };
83563
83564 -static struct snd_pcm_ops snd_ps3_pcm_spdif_ops = {
83565 +static const struct snd_pcm_ops snd_ps3_pcm_spdif_ops = {
83566 .open = snd_ps3_pcm_open,
83567 .close = snd_ps3_pcm_close,
83568 .ioctl = snd_pcm_lib_ioctl,
83569 diff -urNp linux-2.6.39.1/sound/sh/aica.c linux-2.6.39.1/sound/sh/aica.c
83570 --- linux-2.6.39.1/sound/sh/aica.c 2011-05-19 00:06:34.000000000 -0400
83571 +++ linux-2.6.39.1/sound/sh/aica.c 2011-05-22 19:36:35.000000000 -0400
83572 @@ -441,7 +441,7 @@ static unsigned long snd_aicapcm_pcm_poi
83573 return readl(AICA_CONTROL_CHANNEL_SAMPLE_NUMBER);
83574 }
83575
83576 -static struct snd_pcm_ops snd_aicapcm_playback_ops = {
83577 +static const struct snd_pcm_ops snd_aicapcm_playback_ops = {
83578 .open = snd_aicapcm_pcm_open,
83579 .close = snd_aicapcm_pcm_close,
83580 .ioctl = snd_pcm_lib_ioctl,
83581 diff -urNp linux-2.6.39.1/sound/sh/sh_dac_audio.c linux-2.6.39.1/sound/sh/sh_dac_audio.c
83582 --- linux-2.6.39.1/sound/sh/sh_dac_audio.c 2011-05-19 00:06:34.000000000 -0400
83583 +++ linux-2.6.39.1/sound/sh/sh_dac_audio.c 2011-05-22 19:36:35.000000000 -0400
83584 @@ -246,7 +246,7 @@ snd_pcm_uframes_t snd_sh_dac_pcm_pointer
83585 }
83586
83587 /* pcm ops */
83588 -static struct snd_pcm_ops snd_sh_dac_pcm_ops = {
83589 +static const struct snd_pcm_ops snd_sh_dac_pcm_ops = {
83590 .open = snd_sh_dac_pcm_open,
83591 .close = snd_sh_dac_pcm_close,
83592 .ioctl = snd_pcm_lib_ioctl,
83593 @@ -352,7 +352,7 @@ static int __devinit snd_sh_dac_create(s
83594 struct snd_sh_dac *chip;
83595 int err;
83596
83597 - static struct snd_device_ops ops = {
83598 + static const struct snd_device_ops ops = {
83599 .dev_free = snd_sh_dac_dev_free,
83600 };
83601
83602 diff -urNp linux-2.6.39.1/sound/soc/atmel/atmel-pcm.c linux-2.6.39.1/sound/soc/atmel/atmel-pcm.c
83603 --- linux-2.6.39.1/sound/soc/atmel/atmel-pcm.c 2011-05-19 00:06:34.000000000 -0400
83604 +++ linux-2.6.39.1/sound/soc/atmel/atmel-pcm.c 2011-05-22 19:36:35.000000000 -0400
83605 @@ -346,7 +346,7 @@ static int atmel_pcm_mmap(struct snd_pcm
83606 vma->vm_end - vma->vm_start, vma->vm_page_prot);
83607 }
83608
83609 -static struct snd_pcm_ops atmel_pcm_ops = {
83610 +static const struct snd_pcm_ops atmel_pcm_ops = {
83611 .open = atmel_pcm_open,
83612 .close = atmel_pcm_close,
83613 .ioctl = snd_pcm_lib_ioctl,
83614 diff -urNp linux-2.6.39.1/sound/soc/atmel/playpaq_wm8510.c linux-2.6.39.1/sound/soc/atmel/playpaq_wm8510.c
83615 --- linux-2.6.39.1/sound/soc/atmel/playpaq_wm8510.c 2011-05-19 00:06:34.000000000 -0400
83616 +++ linux-2.6.39.1/sound/soc/atmel/playpaq_wm8510.c 2011-05-22 19:36:35.000000000 -0400
83617 @@ -289,7 +289,7 @@ static int playpaq_wm8510_hw_params(stru
83618
83619
83620
83621 -static struct snd_soc_ops playpaq_wm8510_ops = {
83622 +static const struct snd_soc_ops playpaq_wm8510_ops = {
83623 .hw_params = playpaq_wm8510_hw_params,
83624 };
83625
83626 diff -urNp linux-2.6.39.1/sound/soc/atmel/sam9g20_wm8731.c linux-2.6.39.1/sound/soc/atmel/sam9g20_wm8731.c
83627 --- linux-2.6.39.1/sound/soc/atmel/sam9g20_wm8731.c 2011-05-19 00:06:34.000000000 -0400
83628 +++ linux-2.6.39.1/sound/soc/atmel/sam9g20_wm8731.c 2011-05-22 19:36:35.000000000 -0400
83629 @@ -87,7 +87,7 @@ static int at91sam9g20ek_hw_params(struc
83630 return 0;
83631 }
83632
83633 -static struct snd_soc_ops at91sam9g20ek_ops = {
83634 +static const struct snd_soc_ops at91sam9g20ek_ops = {
83635 .hw_params = at91sam9g20ek_hw_params,
83636 };
83637
83638 diff -urNp linux-2.6.39.1/sound/soc/atmel/snd-soc-afeb9260.c linux-2.6.39.1/sound/soc/atmel/snd-soc-afeb9260.c
83639 --- linux-2.6.39.1/sound/soc/atmel/snd-soc-afeb9260.c 2011-05-19 00:06:34.000000000 -0400
83640 +++ linux-2.6.39.1/sound/soc/atmel/snd-soc-afeb9260.c 2011-05-22 19:36:35.000000000 -0400
83641 @@ -81,7 +81,7 @@ static int afeb9260_hw_params(struct snd
83642 return err;
83643 }
83644
83645 -static struct snd_soc_ops afeb9260_ops = {
83646 +static const struct snd_soc_ops afeb9260_ops = {
83647 .hw_params = afeb9260_hw_params,
83648 };
83649
83650 diff -urNp linux-2.6.39.1/sound/soc/au1x/db1200.c linux-2.6.39.1/sound/soc/au1x/db1200.c
83651 --- linux-2.6.39.1/sound/soc/au1x/db1200.c 2011-05-19 00:06:34.000000000 -0400
83652 +++ linux-2.6.39.1/sound/soc/au1x/db1200.c 2011-05-22 19:36:35.000000000 -0400
83653 @@ -67,7 +67,7 @@ out:
83654 return ret;
83655 }
83656
83657 -static struct snd_soc_ops db1200_i2s_wm8731_ops = {
83658 +static const struct snd_soc_ops db1200_i2s_wm8731_ops = {
83659 .startup = db1200_i2s_startup,
83660 };
83661
83662 diff -urNp linux-2.6.39.1/sound/soc/au1x/dbdma2.c linux-2.6.39.1/sound/soc/au1x/dbdma2.c
83663 --- linux-2.6.39.1/sound/soc/au1x/dbdma2.c 2011-05-19 00:06:34.000000000 -0400
83664 +++ linux-2.6.39.1/sound/soc/au1x/dbdma2.c 2011-05-22 19:36:35.000000000 -0400
83665 @@ -303,7 +303,7 @@ static int au1xpsc_pcm_close(struct snd_
83666 return 0;
83667 }
83668
83669 -static struct snd_pcm_ops au1xpsc_pcm_ops = {
83670 +static const struct snd_pcm_ops au1xpsc_pcm_ops = {
83671 .open = au1xpsc_pcm_open,
83672 .close = au1xpsc_pcm_close,
83673 .ioctl = snd_pcm_lib_ioctl,
83674 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.c
83675 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.c 2011-05-19 00:06:34.000000000 -0400
83676 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.c 2011-05-22 19:36:35.000000000 -0400
83677 @@ -244,7 +244,7 @@ static void bf5xx_ac97_cold_reset(struct
83678 #endif
83679 }
83680
83681 -struct snd_ac97_bus_ops soc_ac97_ops = {
83682 +const struct snd_ac97_bus_ops soc_ac97_ops = {
83683 .read = bf5xx_ac97_read,
83684 .write = bf5xx_ac97_write,
83685 .warm_reset = bf5xx_ac97_warm_reset,
83686 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.h linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.h
83687 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.h 2011-05-19 00:06:34.000000000 -0400
83688 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97.h 2011-05-22 19:36:35.000000000 -0400
83689 @@ -9,7 +9,7 @@
83690 #ifndef _BF5XX_AC97_H
83691 #define _BF5XX_AC97_H
83692
83693 -extern struct snd_ac97_bus_ops bf5xx_ac97_ops;
83694 +extern const struct snd_ac97_bus_ops bf5xx_ac97_ops;
83695 extern struct snd_ac97 *ac97;
83696 /* Frame format in memory, only support stereo currently */
83697 struct ac97_frame {
83698 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97-pcm.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97-pcm.c
83699 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97-pcm.c 2011-05-19 00:06:34.000000000 -0400
83700 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ac97-pcm.c 2011-05-22 19:36:35.000000000 -0400
83701 @@ -297,7 +297,7 @@ static int bf5xx_pcm_copy(struct snd_pcm
83702 }
83703 #endif
83704
83705 -static struct snd_pcm_ops bf5xx_pcm_ac97_ops = {
83706 +static const struct snd_pcm_ops bf5xx_pcm_ac97_ops = {
83707 .open = bf5xx_pcm_open,
83708 .ioctl = snd_pcm_lib_ioctl,
83709 .hw_params = bf5xx_pcm_hw_params,
83710 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1836.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1836.c
83711 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1836.c 2011-05-19 00:06:34.000000000 -0400
83712 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1836.c 2011-05-22 19:36:35.000000000 -0400
83713 @@ -74,7 +74,7 @@ static int bf5xx_ad1836_hw_params(struct
83714 return 0;
83715 }
83716
83717 -static struct snd_soc_ops bf5xx_ad1836_ops = {
83718 +static const struct snd_soc_ops bf5xx_ad1836_ops = {
83719 .startup = bf5xx_ad1836_startup,
83720 .hw_params = bf5xx_ad1836_hw_params,
83721 };
83722 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad193x.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad193x.c
83723 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad193x.c 2011-05-19 00:06:34.000000000 -0400
83724 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad193x.c 2011-05-22 19:36:35.000000000 -0400
83725 @@ -88,7 +88,7 @@ static int bf5xx_ad193x_hw_params(struct
83726 return 0;
83727 }
83728
83729 -static struct snd_soc_ops bf5xx_ad193x_ops = {
83730 +static const struct snd_soc_ops bf5xx_ad193x_ops = {
83731 .startup = bf5xx_ad193x_startup,
83732 .hw_params = bf5xx_ad193x_hw_params,
83733 };
83734 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1980.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1980.c
83735 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1980.c 2011-05-19 00:06:34.000000000 -0400
83736 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad1980.c 2011-05-22 19:36:35.000000000 -0400
83737 @@ -63,7 +63,7 @@ static int bf5xx_board_startup(struct sn
83738 return 0;
83739 }
83740
83741 -static struct snd_soc_ops bf5xx_board_ops = {
83742 +static const struct snd_soc_ops bf5xx_board_ops = {
83743 .startup = bf5xx_board_startup,
83744 };
83745
83746 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad73311.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad73311.c
83747 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad73311.c 2011-05-19 00:06:34.000000000 -0400
83748 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ad73311.c 2011-05-22 19:36:35.000000000 -0400
83749 @@ -175,7 +175,7 @@ static int bf5xx_ad73311_hw_params(struc
83750 }
83751
83752
83753 -static struct snd_soc_ops bf5xx_ad73311_ops = {
83754 +static const struct snd_soc_ops bf5xx_ad73311_ops = {
83755 .startup = bf5xx_ad73311_startup,
83756 .hw_params = bf5xx_ad73311_hw_params,
83757 };
83758 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-i2s-pcm.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-i2s-pcm.c
83759 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-i2s-pcm.c 2011-05-19 00:06:34.000000000 -0400
83760 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-i2s-pcm.c 2011-05-22 19:36:35.000000000 -0400
83761 @@ -183,7 +183,7 @@ static int bf5xx_pcm_mmap(struct snd_pcm
83762 return 0 ;
83763 }
83764
83765 -static struct snd_pcm_ops bf5xx_pcm_i2s_ops = {
83766 +static const struct snd_pcm_ops bf5xx_pcm_i2s_ops = {
83767 .open = bf5xx_pcm_open,
83768 .ioctl = snd_pcm_lib_ioctl,
83769 .hw_params = bf5xx_pcm_hw_params,
83770 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-ssm2602.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-ssm2602.c
83771 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-ssm2602.c 2011-05-19 00:06:34.000000000 -0400
83772 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-ssm2602.c 2011-05-22 19:36:35.000000000 -0400
83773 @@ -108,7 +108,7 @@ static int bf5xx_ssm2602_hw_params(struc
83774 return 0;
83775 }
83776
83777 -static struct snd_soc_ops bf5xx_ssm2602_ops = {
83778 +static const struct snd_soc_ops bf5xx_ssm2602_ops = {
83779 .startup = bf5xx_ssm2602_startup,
83780 .hw_params = bf5xx_ssm2602_hw_params,
83781 };
83782 diff -urNp linux-2.6.39.1/sound/soc/blackfin/bf5xx-tdm-pcm.c linux-2.6.39.1/sound/soc/blackfin/bf5xx-tdm-pcm.c
83783 --- linux-2.6.39.1/sound/soc/blackfin/bf5xx-tdm-pcm.c 2011-05-19 00:06:34.000000000 -0400
83784 +++ linux-2.6.39.1/sound/soc/blackfin/bf5xx-tdm-pcm.c 2011-05-22 19:36:35.000000000 -0400
83785 @@ -220,7 +220,7 @@ static int bf5xx_pcm_silence(struct snd_
83786 }
83787
83788
83789 -struct snd_pcm_ops bf5xx_pcm_tdm_ops = {
83790 +const struct snd_pcm_ops bf5xx_pcm_tdm_ops = {
83791 .open = bf5xx_pcm_open,
83792 .ioctl = snd_pcm_lib_ioctl,
83793 .hw_params = bf5xx_pcm_hw_params,
83794 diff -urNp linux-2.6.39.1/sound/soc/davinci/davinci-evm.c linux-2.6.39.1/sound/soc/davinci/davinci-evm.c
83795 --- linux-2.6.39.1/sound/soc/davinci/davinci-evm.c 2011-05-19 00:06:34.000000000 -0400
83796 +++ linux-2.6.39.1/sound/soc/davinci/davinci-evm.c 2011-05-22 19:36:35.000000000 -0400
83797 @@ -88,11 +88,11 @@ static int evm_spdif_hw_params(struct sn
83798 return snd_soc_dai_set_fmt(cpu_dai, AUDIO_FORMAT);
83799 }
83800
83801 -static struct snd_soc_ops evm_ops = {
83802 +static const struct snd_soc_ops evm_ops = {
83803 .hw_params = evm_hw_params,
83804 };
83805
83806 -static struct snd_soc_ops evm_spdif_ops = {
83807 +static const struct snd_soc_ops evm_spdif_ops = {
83808 .hw_params = evm_spdif_hw_params,
83809 };
83810
83811 diff -urNp linux-2.6.39.1/sound/soc/davinci/davinci-pcm.c linux-2.6.39.1/sound/soc/davinci/davinci-pcm.c
83812 --- linux-2.6.39.1/sound/soc/davinci/davinci-pcm.c 2011-05-19 00:06:34.000000000 -0400
83813 +++ linux-2.6.39.1/sound/soc/davinci/davinci-pcm.c 2011-05-22 19:36:35.000000000 -0400
83814 @@ -748,7 +748,7 @@ static int davinci_pcm_mmap(struct snd_p
83815 runtime->dma_bytes);
83816 }
83817
83818 -static struct snd_pcm_ops davinci_pcm_ops = {
83819 +static const struct snd_pcm_ops davinci_pcm_ops = {
83820 .open = davinci_pcm_open,
83821 .close = davinci_pcm_close,
83822 .ioctl = snd_pcm_lib_ioctl,
83823 diff -urNp linux-2.6.39.1/sound/soc/davinci/davinci-sffsdr.c linux-2.6.39.1/sound/soc/davinci/davinci-sffsdr.c
83824 --- linux-2.6.39.1/sound/soc/davinci/davinci-sffsdr.c 2011-05-19 00:06:34.000000000 -0400
83825 +++ linux-2.6.39.1/sound/soc/davinci/davinci-sffsdr.c 2011-05-22 19:36:35.000000000 -0400
83826 @@ -75,7 +75,7 @@ static int sffsdr_hw_params(struct snd_p
83827 #endif
83828 }
83829
83830 -static struct snd_soc_ops sffsdr_ops = {
83831 +static const struct snd_soc_ops sffsdr_ops = {
83832 .hw_params = sffsdr_hw_params,
83833 };
83834
83835 diff -urNp linux-2.6.39.1/sound/soc/ep93xx/edb93xx.c linux-2.6.39.1/sound/soc/ep93xx/edb93xx.c
83836 --- linux-2.6.39.1/sound/soc/ep93xx/edb93xx.c 2011-05-19 00:06:34.000000000 -0400
83837 +++ linux-2.6.39.1/sound/soc/ep93xx/edb93xx.c 2011-05-22 19:36:35.000000000 -0400
83838 @@ -74,7 +74,7 @@ static int edb93xx_hw_params(struct snd_
83839 SND_SOC_CLOCK_OUT);
83840 }
83841
83842 -static struct snd_soc_ops edb93xx_ops = {
83843 +static const struct snd_soc_ops edb93xx_ops = {
83844 .hw_params = edb93xx_hw_params,
83845 };
83846
83847 diff -urNp linux-2.6.39.1/sound/soc/ep93xx/ep93xx-ac97.c linux-2.6.39.1/sound/soc/ep93xx/ep93xx-ac97.c
83848 --- linux-2.6.39.1/sound/soc/ep93xx/ep93xx-ac97.c 2011-05-19 00:06:34.000000000 -0400
83849 +++ linux-2.6.39.1/sound/soc/ep93xx/ep93xx-ac97.c 2011-05-22 19:36:35.000000000 -0400
83850 @@ -239,7 +239,7 @@ static irqreturn_t ep93xx_ac97_interrupt
83851 return IRQ_HANDLED;
83852 }
83853
83854 -struct snd_ac97_bus_ops soc_ac97_ops = {
83855 +const struct snd_ac97_bus_ops soc_ac97_ops = {
83856 .read = ep93xx_ac97_read,
83857 .write = ep93xx_ac97_write,
83858 .reset = ep93xx_ac97_cold_reset,
83859 diff -urNp linux-2.6.39.1/sound/soc/ep93xx/ep93xx-pcm.c linux-2.6.39.1/sound/soc/ep93xx/ep93xx-pcm.c
83860 --- linux-2.6.39.1/sound/soc/ep93xx/ep93xx-pcm.c 2011-05-19 00:06:34.000000000 -0400
83861 +++ linux-2.6.39.1/sound/soc/ep93xx/ep93xx-pcm.c 2011-05-22 19:36:35.000000000 -0400
83862 @@ -216,7 +216,7 @@ static int ep93xx_pcm_mmap(struct snd_pc
83863 runtime->dma_bytes);
83864 }
83865
83866 -static struct snd_pcm_ops ep93xx_pcm_ops = {
83867 +static const struct snd_pcm_ops ep93xx_pcm_ops = {
83868 .open = ep93xx_pcm_open,
83869 .close = ep93xx_pcm_close,
83870 .ioctl = snd_pcm_lib_ioctl,
83871 diff -urNp linux-2.6.39.1/sound/soc/ep93xx/snappercl15.c linux-2.6.39.1/sound/soc/ep93xx/snappercl15.c
83872 --- linux-2.6.39.1/sound/soc/ep93xx/snappercl15.c 2011-05-19 00:06:34.000000000 -0400
83873 +++ linux-2.6.39.1/sound/soc/ep93xx/snappercl15.c 2011-05-22 19:36:35.000000000 -0400
83874 @@ -55,7 +55,7 @@ static int snappercl15_hw_params(struct
83875 return 0;
83876 }
83877
83878 -static struct snd_soc_ops snappercl15_ops = {
83879 +static const struct snd_soc_ops snappercl15_ops = {
83880 .hw_params = snappercl15_hw_params,
83881 };
83882
83883 diff -urNp linux-2.6.39.1/sound/soc/fsl/fsl_dma.c linux-2.6.39.1/sound/soc/fsl/fsl_dma.c
83884 --- linux-2.6.39.1/sound/soc/fsl/fsl_dma.c 2011-05-19 00:06:34.000000000 -0400
83885 +++ linux-2.6.39.1/sound/soc/fsl/fsl_dma.c 2011-05-22 19:36:35.000000000 -0400
83886 @@ -887,7 +887,7 @@ static struct device_node *find_ssi_node
83887 return NULL;
83888 }
83889
83890 -static struct snd_pcm_ops fsl_dma_ops = {
83891 +static const struct snd_pcm_ops fsl_dma_ops = {
83892 .open = fsl_dma_open,
83893 .close = fsl_dma_close,
83894 .ioctl = snd_pcm_lib_ioctl,
83895 diff -urNp linux-2.6.39.1/sound/soc/fsl/mpc8610_hpcd.c linux-2.6.39.1/sound/soc/fsl/mpc8610_hpcd.c
83896 --- linux-2.6.39.1/sound/soc/fsl/mpc8610_hpcd.c 2011-05-19 00:06:34.000000000 -0400
83897 +++ linux-2.6.39.1/sound/soc/fsl/mpc8610_hpcd.c 2011-05-22 19:36:35.000000000 -0400
83898 @@ -175,7 +175,7 @@ static int mpc8610_hpcd_machine_remove(s
83899 /**
83900 * mpc8610_hpcd_ops: ASoC machine driver operations
83901 */
83902 -static struct snd_soc_ops mpc8610_hpcd_ops = {
83903 +static const struct snd_soc_ops mpc8610_hpcd_ops = {
83904 .startup = mpc8610_hpcd_startup,
83905 };
83906
83907 diff -urNp linux-2.6.39.1/sound/soc/fsl/p1022_ds.c linux-2.6.39.1/sound/soc/fsl/p1022_ds.c
83908 --- linux-2.6.39.1/sound/soc/fsl/p1022_ds.c 2011-05-19 00:06:34.000000000 -0400
83909 +++ linux-2.6.39.1/sound/soc/fsl/p1022_ds.c 2011-05-22 19:36:35.000000000 -0400
83910 @@ -185,7 +185,7 @@ static int p1022_ds_machine_remove(struc
83911 /**
83912 * p1022_ds_ops: ASoC machine driver operations
83913 */
83914 -static struct snd_soc_ops p1022_ds_ops = {
83915 +static const struct snd_soc_ops p1022_ds_ops = {
83916 .startup = p1022_ds_startup,
83917 };
83918
83919 diff -urNp linux-2.6.39.1/sound/soc/imx/eukrea-tlv320.c linux-2.6.39.1/sound/soc/imx/eukrea-tlv320.c
83920 --- linux-2.6.39.1/sound/soc/imx/eukrea-tlv320.c 2011-05-19 00:06:34.000000000 -0400
83921 +++ linux-2.6.39.1/sound/soc/imx/eukrea-tlv320.c 2011-05-22 19:36:35.000000000 -0400
83922 @@ -71,7 +71,7 @@ static int eukrea_tlv320_hw_params(struc
83923 return 0;
83924 }
83925
83926 -static struct snd_soc_ops eukrea_tlv320_snd_ops = {
83927 +static const struct snd_soc_ops eukrea_tlv320_snd_ops = {
83928 .hw_params = eukrea_tlv320_hw_params,
83929 };
83930
83931 diff -urNp linux-2.6.39.1/sound/soc/imx/imx-pcm-dma-mx2.c linux-2.6.39.1/sound/soc/imx/imx-pcm-dma-mx2.c
83932 --- linux-2.6.39.1/sound/soc/imx/imx-pcm-dma-mx2.c 2011-05-19 00:06:34.000000000 -0400
83933 +++ linux-2.6.39.1/sound/soc/imx/imx-pcm-dma-mx2.c 2011-05-22 19:36:35.000000000 -0400
83934 @@ -283,7 +283,7 @@ static int snd_imx_close(struct snd_pcm_
83935 return 0;
83936 }
83937
83938 -static struct snd_pcm_ops imx_pcm_ops = {
83939 +static const struct snd_pcm_ops imx_pcm_ops = {
83940 .open = snd_imx_open,
83941 .close = snd_imx_close,
83942 .ioctl = snd_pcm_lib_ioctl,
83943 diff -urNp linux-2.6.39.1/sound/soc/imx/imx-pcm-fiq.c linux-2.6.39.1/sound/soc/imx/imx-pcm-fiq.c
83944 --- linux-2.6.39.1/sound/soc/imx/imx-pcm-fiq.c 2011-05-19 00:06:34.000000000 -0400
83945 +++ linux-2.6.39.1/sound/soc/imx/imx-pcm-fiq.c 2011-05-22 19:36:35.000000000 -0400
83946 @@ -225,7 +225,7 @@ static int snd_imx_close(struct snd_pcm_
83947 return 0;
83948 }
83949
83950 -static struct snd_pcm_ops imx_pcm_ops = {
83951 +static const struct snd_pcm_ops imx_pcm_ops = {
83952 .open = snd_imx_open,
83953 .close = snd_imx_close,
83954 .ioctl = snd_pcm_lib_ioctl,
83955 diff -urNp linux-2.6.39.1/sound/soc/imx/mx27vis-aic32x4.c linux-2.6.39.1/sound/soc/imx/mx27vis-aic32x4.c
83956 --- linux-2.6.39.1/sound/soc/imx/mx27vis-aic32x4.c 2011-05-19 00:06:34.000000000 -0400
83957 +++ linux-2.6.39.1/sound/soc/imx/mx27vis-aic32x4.c 2011-05-22 19:36:35.000000000 -0400
83958 @@ -70,7 +70,7 @@ static int mx27vis_aic32x4_hw_params(str
83959 return 0;
83960 }
83961
83962 -static struct snd_soc_ops mx27vis_aic32x4_snd_ops = {
83963 +static const struct snd_soc_ops mx27vis_aic32x4_snd_ops = {
83964 .hw_params = mx27vis_aic32x4_hw_params,
83965 };
83966
83967 diff -urNp linux-2.6.39.1/sound/soc/imx/phycore-ac97.c linux-2.6.39.1/sound/soc/imx/phycore-ac97.c
83968 --- linux-2.6.39.1/sound/soc/imx/phycore-ac97.c 2011-05-19 00:06:34.000000000 -0400
83969 +++ linux-2.6.39.1/sound/soc/imx/phycore-ac97.c 2011-05-22 19:36:35.000000000 -0400
83970 @@ -21,7 +21,7 @@
83971
83972 static struct snd_soc_card imx_phycore;
83973
83974 -static struct snd_soc_ops imx_phycore_hifi_ops = {
83975 +static const struct snd_soc_ops imx_phycore_hifi_ops = {
83976 };
83977
83978 static struct snd_soc_dai_link imx_phycore_dai_ac97[] = {
83979 diff -urNp linux-2.6.39.1/sound/soc/imx/wm1133-ev1.c linux-2.6.39.1/sound/soc/imx/wm1133-ev1.c
83980 --- linux-2.6.39.1/sound/soc/imx/wm1133-ev1.c 2011-05-19 00:06:34.000000000 -0400
83981 +++ linux-2.6.39.1/sound/soc/imx/wm1133-ev1.c 2011-05-22 19:36:35.000000000 -0400
83982 @@ -149,7 +149,7 @@ static int wm1133_ev1_hw_params(struct s
83983 return 0;
83984 }
83985
83986 -static struct snd_soc_ops wm1133_ev1_ops = {
83987 +static const struct snd_soc_ops wm1133_ev1_ops = {
83988 .hw_params = wm1133_ev1_hw_params,
83989 };
83990
83991 diff -urNp linux-2.6.39.1/sound/soc/jz4740/jz4740-pcm.c linux-2.6.39.1/sound/soc/jz4740/jz4740-pcm.c
83992 --- linux-2.6.39.1/sound/soc/jz4740/jz4740-pcm.c 2011-05-19 00:06:34.000000000 -0400
83993 +++ linux-2.6.39.1/sound/soc/jz4740/jz4740-pcm.c 2011-05-22 19:36:35.000000000 -0400
83994 @@ -244,7 +244,7 @@ static int jz4740_pcm_mmap(struct snd_pc
83995 vma->vm_end - vma->vm_start, vma->vm_page_prot);
83996 }
83997
83998 -static struct snd_pcm_ops jz4740_pcm_ops = {
83999 +static const struct snd_pcm_ops jz4740_pcm_ops = {
84000 .open = jz4740_pcm_open,
84001 .close = jz4740_pcm_close,
84002 .ioctl = snd_pcm_lib_ioctl,
84003 diff -urNp linux-2.6.39.1/sound/soc/kirkwood/kirkwood-openrd.c linux-2.6.39.1/sound/soc/kirkwood/kirkwood-openrd.c
84004 --- linux-2.6.39.1/sound/soc/kirkwood/kirkwood-openrd.c 2011-05-19 00:06:34.000000000 -0400
84005 +++ linux-2.6.39.1/sound/soc/kirkwood/kirkwood-openrd.c 2011-05-22 19:36:35.000000000 -0400
84006 @@ -56,7 +56,7 @@ static int openrd_client_hw_params(struc
84007
84008 }
84009
84010 -static struct snd_soc_ops openrd_client_ops = {
84011 +static const struct snd_soc_ops openrd_client_ops = {
84012 .hw_params = openrd_client_hw_params,
84013 };
84014
84015 diff -urNp linux-2.6.39.1/sound/soc/kirkwood/kirkwood-t5325.c linux-2.6.39.1/sound/soc/kirkwood/kirkwood-t5325.c
84016 --- linux-2.6.39.1/sound/soc/kirkwood/kirkwood-t5325.c 2011-05-19 00:06:34.000000000 -0400
84017 +++ linux-2.6.39.1/sound/soc/kirkwood/kirkwood-t5325.c 2011-05-22 19:36:35.000000000 -0400
84018 @@ -44,7 +44,7 @@ static int t5325_hw_params(struct snd_pc
84019
84020 }
84021
84022 -static struct snd_soc_ops t5325_ops = {
84023 +static const struct snd_soc_ops t5325_ops = {
84024 .hw_params = t5325_hw_params,
84025 };
84026
84027 diff -urNp linux-2.6.39.1/sound/soc/mid-x86/sst_platform.c linux-2.6.39.1/sound/soc/mid-x86/sst_platform.c
84028 --- linux-2.6.39.1/sound/soc/mid-x86/sst_platform.c 2011-05-19 00:06:34.000000000 -0400
84029 +++ linux-2.6.39.1/sound/soc/mid-x86/sst_platform.c 2011-05-22 19:36:35.000000000 -0400
84030 @@ -381,7 +381,7 @@ static int sst_platform_pcm_hw_free(stru
84031 return snd_pcm_lib_free_pages(substream);
84032 }
84033
84034 -static struct snd_pcm_ops sst_platform_ops = {
84035 +static const struct snd_pcm_ops sst_platform_ops = {
84036 .open = sst_platform_open,
84037 .close = sst_platform_close,
84038 .ioctl = snd_pcm_lib_ioctl,
84039 diff -urNp linux-2.6.39.1/sound/soc/nuc900/nuc900-pcm.c linux-2.6.39.1/sound/soc/nuc900/nuc900-pcm.c
84040 --- linux-2.6.39.1/sound/soc/nuc900/nuc900-pcm.c 2011-05-19 00:06:34.000000000 -0400
84041 +++ linux-2.6.39.1/sound/soc/nuc900/nuc900-pcm.c 2011-05-22 19:36:35.000000000 -0400
84042 @@ -297,7 +297,7 @@ static int nuc900_dma_mmap(struct snd_pc
84043 runtime->dma_bytes);
84044 }
84045
84046 -static struct snd_pcm_ops nuc900_dma_ops = {
84047 +static const struct snd_pcm_ops nuc900_dma_ops = {
84048 .open = nuc900_dma_open,
84049 .close = nuc900_dma_close,
84050 .ioctl = snd_pcm_lib_ioctl,
84051 diff -urNp linux-2.6.39.1/sound/soc/omap/am3517evm.c linux-2.6.39.1/sound/soc/omap/am3517evm.c
84052 --- linux-2.6.39.1/sound/soc/omap/am3517evm.c 2011-05-19 00:06:34.000000000 -0400
84053 +++ linux-2.6.39.1/sound/soc/omap/am3517evm.c 2011-05-22 19:36:35.000000000 -0400
84054 @@ -88,7 +88,7 @@ static int am3517evm_hw_params(struct sn
84055 return 0;
84056 }
84057
84058 -static struct snd_soc_ops am3517evm_ops = {
84059 +static const struct snd_soc_ops am3517evm_ops = {
84060 .hw_params = am3517evm_hw_params,
84061 };
84062
84063 diff -urNp linux-2.6.39.1/sound/soc/omap/ams-delta.c linux-2.6.39.1/sound/soc/omap/ams-delta.c
84064 --- linux-2.6.39.1/sound/soc/omap/ams-delta.c 2011-05-19 00:06:34.000000000 -0400
84065 +++ linux-2.6.39.1/sound/soc/omap/ams-delta.c 2011-05-22 19:36:35.000000000 -0400
84066 @@ -420,7 +420,7 @@ static int ams_delta_hw_params(struct sn
84067 SND_SOC_DAIFMT_CBM_CFM);
84068 }
84069
84070 -static struct snd_soc_ops ams_delta_ops = {
84071 +static const struct snd_soc_ops ams_delta_ops = {
84072 .hw_params = ams_delta_hw_params,
84073 };
84074
84075 diff -urNp linux-2.6.39.1/sound/soc/omap/igep0020.c linux-2.6.39.1/sound/soc/omap/igep0020.c
84076 --- linux-2.6.39.1/sound/soc/omap/igep0020.c 2011-05-19 00:06:34.000000000 -0400
84077 +++ linux-2.6.39.1/sound/soc/omap/igep0020.c 2011-05-22 19:36:35.000000000 -0400
84078 @@ -72,7 +72,7 @@ static int igep2_hw_params(struct snd_pc
84079 return 0;
84080 }
84081
84082 -static struct snd_soc_ops igep2_ops = {
84083 +static const struct snd_soc_ops igep2_ops = {
84084 .hw_params = igep2_hw_params,
84085 };
84086
84087 diff -urNp linux-2.6.39.1/sound/soc/omap/n810.c linux-2.6.39.1/sound/soc/omap/n810.c
84088 --- linux-2.6.39.1/sound/soc/omap/n810.c 2011-05-19 00:06:34.000000000 -0400
84089 +++ linux-2.6.39.1/sound/soc/omap/n810.c 2011-05-22 19:36:35.000000000 -0400
84090 @@ -141,7 +141,7 @@ static int n810_hw_params(struct snd_pcm
84091 return err;
84092 }
84093
84094 -static struct snd_soc_ops n810_ops = {
84095 +static const struct snd_soc_ops n810_ops = {
84096 .startup = n810_startup,
84097 .hw_params = n810_hw_params,
84098 .shutdown = n810_shutdown,
84099 diff -urNp linux-2.6.39.1/sound/soc/omap/omap2evm.c linux-2.6.39.1/sound/soc/omap/omap2evm.c
84100 --- linux-2.6.39.1/sound/soc/omap/omap2evm.c 2011-05-19 00:06:34.000000000 -0400
84101 +++ linux-2.6.39.1/sound/soc/omap/omap2evm.c 2011-05-22 19:36:35.000000000 -0400
84102 @@ -74,7 +74,7 @@ static int omap2evm_hw_params(struct snd
84103 return 0;
84104 }
84105
84106 -static struct snd_soc_ops omap2evm_ops = {
84107 +static const struct snd_soc_ops omap2evm_ops = {
84108 .hw_params = omap2evm_hw_params,
84109 };
84110
84111 diff -urNp linux-2.6.39.1/sound/soc/omap/omap3beagle.c linux-2.6.39.1/sound/soc/omap/omap3beagle.c
84112 --- linux-2.6.39.1/sound/soc/omap/omap3beagle.c 2011-05-19 00:06:34.000000000 -0400
84113 +++ linux-2.6.39.1/sound/soc/omap/omap3beagle.c 2011-05-22 19:36:35.000000000 -0400
84114 @@ -82,7 +82,7 @@ static int omap3beagle_hw_params(struct
84115 return 0;
84116 }
84117
84118 -static struct snd_soc_ops omap3beagle_ops = {
84119 +static const struct snd_soc_ops omap3beagle_ops = {
84120 .hw_params = omap3beagle_hw_params,
84121 };
84122
84123 diff -urNp linux-2.6.39.1/sound/soc/omap/omap3evm.c linux-2.6.39.1/sound/soc/omap/omap3evm.c
84124 --- linux-2.6.39.1/sound/soc/omap/omap3evm.c 2011-05-19 00:06:34.000000000 -0400
84125 +++ linux-2.6.39.1/sound/soc/omap/omap3evm.c 2011-05-22 19:36:35.000000000 -0400
84126 @@ -70,7 +70,7 @@ static int omap3evm_hw_params(struct snd
84127 return 0;
84128 }
84129
84130 -static struct snd_soc_ops omap3evm_ops = {
84131 +static const struct snd_soc_ops omap3evm_ops = {
84132 .hw_params = omap3evm_hw_params,
84133 };
84134
84135 diff -urNp linux-2.6.39.1/sound/soc/omap/omap3pandora.c linux-2.6.39.1/sound/soc/omap/omap3pandora.c
84136 --- linux-2.6.39.1/sound/soc/omap/omap3pandora.c 2011-05-19 00:06:34.000000000 -0400
84137 +++ linux-2.6.39.1/sound/soc/omap/omap3pandora.c 2011-05-22 19:36:35.000000000 -0400
84138 @@ -218,7 +218,7 @@ static int omap3pandora_in_init(struct s
84139 return snd_soc_dapm_sync(dapm);
84140 }
84141
84142 -static struct snd_soc_ops omap3pandora_ops = {
84143 +static const struct snd_soc_ops omap3pandora_ops = {
84144 .hw_params = omap3pandora_hw_params,
84145 };
84146
84147 diff -urNp linux-2.6.39.1/sound/soc/omap/omap-pcm.c linux-2.6.39.1/sound/soc/omap/omap-pcm.c
84148 --- linux-2.6.39.1/sound/soc/omap/omap-pcm.c 2011-05-19 00:06:34.000000000 -0400
84149 +++ linux-2.6.39.1/sound/soc/omap/omap-pcm.c 2011-05-22 19:36:35.000000000 -0400
84150 @@ -311,7 +311,7 @@ static int omap_pcm_mmap(struct snd_pcm_
84151 runtime->dma_bytes);
84152 }
84153
84154 -static struct snd_pcm_ops omap_pcm_ops = {
84155 +static const struct snd_pcm_ops omap_pcm_ops = {
84156 .open = omap_pcm_open,
84157 .close = omap_pcm_close,
84158 .ioctl = snd_pcm_lib_ioctl,
84159 diff -urNp linux-2.6.39.1/sound/soc/omap/osk5912.c linux-2.6.39.1/sound/soc/omap/osk5912.c
84160 --- linux-2.6.39.1/sound/soc/omap/osk5912.c 2011-05-19 00:06:34.000000000 -0400
84161 +++ linux-2.6.39.1/sound/soc/omap/osk5912.c 2011-05-22 19:36:35.000000000 -0400
84162 @@ -90,7 +90,7 @@ static int osk_hw_params(struct snd_pcm_
84163 return err;
84164 }
84165
84166 -static struct snd_soc_ops osk_ops = {
84167 +static const struct snd_soc_ops osk_ops = {
84168 .startup = osk_startup,
84169 .hw_params = osk_hw_params,
84170 .shutdown = osk_shutdown,
84171 diff -urNp linux-2.6.39.1/sound/soc/omap/overo.c linux-2.6.39.1/sound/soc/omap/overo.c
84172 --- linux-2.6.39.1/sound/soc/omap/overo.c 2011-05-19 00:06:34.000000000 -0400
84173 +++ linux-2.6.39.1/sound/soc/omap/overo.c 2011-05-22 19:36:35.000000000 -0400
84174 @@ -72,7 +72,7 @@ static int overo_hw_params(struct snd_pc
84175 return 0;
84176 }
84177
84178 -static struct snd_soc_ops overo_ops = {
84179 +static const struct snd_soc_ops overo_ops = {
84180 .hw_params = overo_hw_params,
84181 };
84182
84183 diff -urNp linux-2.6.39.1/sound/soc/omap/rx51.c linux-2.6.39.1/sound/soc/omap/rx51.c
84184 --- linux-2.6.39.1/sound/soc/omap/rx51.c 2011-05-19 00:06:34.000000000 -0400
84185 +++ linux-2.6.39.1/sound/soc/omap/rx51.c 2011-05-22 19:36:35.000000000 -0400
84186 @@ -139,7 +139,7 @@ static int rx51_hw_params(struct snd_pcm
84187 SND_SOC_CLOCK_IN);
84188 }
84189
84190 -static struct snd_soc_ops rx51_ops = {
84191 +static const struct snd_soc_ops rx51_ops = {
84192 .startup = rx51_startup,
84193 .hw_params = rx51_hw_params,
84194 };
84195 diff -urNp linux-2.6.39.1/sound/soc/omap/sdp3430.c linux-2.6.39.1/sound/soc/omap/sdp3430.c
84196 --- linux-2.6.39.1/sound/soc/omap/sdp3430.c 2011-05-19 00:06:34.000000000 -0400
84197 +++ linux-2.6.39.1/sound/soc/omap/sdp3430.c 2011-05-22 19:36:35.000000000 -0400
84198 @@ -87,7 +87,7 @@ static int sdp3430_hw_params(struct snd_
84199 return 0;
84200 }
84201
84202 -static struct snd_soc_ops sdp3430_ops = {
84203 +static const struct snd_soc_ops sdp3430_ops = {
84204 .hw_params = sdp3430_hw_params,
84205 };
84206
84207 @@ -130,7 +130,7 @@ static int sdp3430_hw_voice_params(struc
84208 return 0;
84209 }
84210
84211 -static struct snd_soc_ops sdp3430_voice_ops = {
84212 +static const struct snd_soc_ops sdp3430_voice_ops = {
84213 .hw_params = sdp3430_hw_voice_params,
84214 };
84215
84216 diff -urNp linux-2.6.39.1/sound/soc/omap/sdp4430.c linux-2.6.39.1/sound/soc/omap/sdp4430.c
84217 --- linux-2.6.39.1/sound/soc/omap/sdp4430.c 2011-05-19 00:06:34.000000000 -0400
84218 +++ linux-2.6.39.1/sound/soc/omap/sdp4430.c 2011-05-22 19:36:35.000000000 -0400
84219 @@ -62,7 +62,7 @@ static int sdp4430_hw_params(struct snd_
84220 return ret;
84221 }
84222
84223 -static struct snd_soc_ops sdp4430_ops = {
84224 +static const struct snd_soc_ops sdp4430_ops = {
84225 .hw_params = sdp4430_hw_params,
84226 };
84227
84228 diff -urNp linux-2.6.39.1/sound/soc/omap/zoom2.c linux-2.6.39.1/sound/soc/omap/zoom2.c
84229 --- linux-2.6.39.1/sound/soc/omap/zoom2.c 2011-05-19 00:06:34.000000000 -0400
84230 +++ linux-2.6.39.1/sound/soc/omap/zoom2.c 2011-05-22 19:36:35.000000000 -0400
84231 @@ -78,7 +78,7 @@ static int zoom2_hw_params(struct snd_pc
84232 return 0;
84233 }
84234
84235 -static struct snd_soc_ops zoom2_ops = {
84236 +static const struct snd_soc_ops zoom2_ops = {
84237 .hw_params = zoom2_hw_params,
84238 };
84239
84240 @@ -121,7 +121,7 @@ static int zoom2_hw_voice_params(struct
84241 return 0;
84242 }
84243
84244 -static struct snd_soc_ops zoom2_voice_ops = {
84245 +static const struct snd_soc_ops zoom2_voice_ops = {
84246 .hw_params = zoom2_hw_voice_params,
84247 };
84248
84249 diff -urNp linux-2.6.39.1/sound/soc/pxa/corgi.c linux-2.6.39.1/sound/soc/pxa/corgi.c
84250 --- linux-2.6.39.1/sound/soc/pxa/corgi.c 2011-05-19 00:06:34.000000000 -0400
84251 +++ linux-2.6.39.1/sound/soc/pxa/corgi.c 2011-05-22 19:36:35.000000000 -0400
84252 @@ -169,7 +169,7 @@ static int corgi_hw_params(struct snd_pc
84253 return 0;
84254 }
84255
84256 -static struct snd_soc_ops corgi_ops = {
84257 +static const struct snd_soc_ops corgi_ops = {
84258 .startup = corgi_startup,
84259 .hw_params = corgi_hw_params,
84260 .shutdown = corgi_shutdown,
84261 diff -urNp linux-2.6.39.1/sound/soc/pxa/imote2.c linux-2.6.39.1/sound/soc/pxa/imote2.c
84262 --- linux-2.6.39.1/sound/soc/pxa/imote2.c 2011-05-19 00:06:34.000000000 -0400
84263 +++ linux-2.6.39.1/sound/soc/pxa/imote2.c 2011-05-22 19:36:35.000000000 -0400
84264 @@ -56,7 +56,7 @@ static int imote2_asoc_hw_params(struct
84265 return ret;
84266 }
84267
84268 -static struct snd_soc_ops imote2_asoc_ops = {
84269 +static const struct snd_soc_ops imote2_asoc_ops = {
84270 .hw_params = imote2_asoc_hw_params,
84271 };
84272
84273 diff -urNp linux-2.6.39.1/sound/soc/pxa/magician.c linux-2.6.39.1/sound/soc/pxa/magician.c
84274 --- linux-2.6.39.1/sound/soc/pxa/magician.c 2011-05-19 00:06:34.000000000 -0400
84275 +++ linux-2.6.39.1/sound/soc/pxa/magician.c 2011-05-22 19:36:35.000000000 -0400
84276 @@ -258,12 +258,12 @@ static int magician_capture_hw_params(st
84277 return 0;
84278 }
84279
84280 -static struct snd_soc_ops magician_capture_ops = {
84281 +static const struct snd_soc_ops magician_capture_ops = {
84282 .startup = magician_startup,
84283 .hw_params = magician_capture_hw_params,
84284 };
84285
84286 -static struct snd_soc_ops magician_playback_ops = {
84287 +static const struct snd_soc_ops magician_playback_ops = {
84288 .startup = magician_startup,
84289 .hw_params = magician_playback_hw_params,
84290 };
84291 diff -urNp linux-2.6.39.1/sound/soc/pxa/mioa701_wm9713.c linux-2.6.39.1/sound/soc/pxa/mioa701_wm9713.c
84292 --- linux-2.6.39.1/sound/soc/pxa/mioa701_wm9713.c 2011-05-19 00:06:34.000000000 -0400
84293 +++ linux-2.6.39.1/sound/soc/pxa/mioa701_wm9713.c 2011-05-22 19:36:35.000000000 -0400
84294 @@ -156,7 +156,7 @@ static int mioa701_wm9713_init(struct sn
84295 return 0;
84296 }
84297
84298 -static struct snd_soc_ops mioa701_ops;
84299 +static const struct snd_soc_ops mioa701_ops;
84300
84301 static struct snd_soc_dai_link mioa701_dai[] = {
84302 {
84303 diff -urNp linux-2.6.39.1/sound/soc/pxa/poodle.c linux-2.6.39.1/sound/soc/pxa/poodle.c
84304 --- linux-2.6.39.1/sound/soc/pxa/poodle.c 2011-05-19 00:06:34.000000000 -0400
84305 +++ linux-2.6.39.1/sound/soc/pxa/poodle.c 2011-05-22 19:36:35.000000000 -0400
84306 @@ -148,7 +148,7 @@ static int poodle_hw_params(struct snd_p
84307 return 0;
84308 }
84309
84310 -static struct snd_soc_ops poodle_ops = {
84311 +static const struct snd_soc_ops poodle_ops = {
84312 .startup = poodle_startup,
84313 .hw_params = poodle_hw_params,
84314 .shutdown = poodle_shutdown,
84315 diff -urNp linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.c linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.c
84316 --- linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.c 2011-05-19 00:06:34.000000000 -0400
84317 +++ linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.c 2011-05-22 19:36:35.000000000 -0400
84318 @@ -40,7 +40,7 @@ static void pxa2xx_ac97_cold_reset(struc
84319 pxa2xx_ac97_finish_reset(ac97);
84320 }
84321
84322 -struct snd_ac97_bus_ops soc_ac97_ops = {
84323 +const struct snd_ac97_bus_ops soc_ac97_ops = {
84324 .read = pxa2xx_ac97_read,
84325 .write = pxa2xx_ac97_write,
84326 .warm_reset = pxa2xx_ac97_warm_reset,
84327 diff -urNp linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.h linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.h
84328 --- linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.h 2011-05-19 00:06:34.000000000 -0400
84329 +++ linux-2.6.39.1/sound/soc/pxa/pxa2xx-ac97.h 2011-05-22 19:36:35.000000000 -0400
84330 @@ -15,6 +15,6 @@
84331 #define PXA2XX_DAI_AC97_MIC 2
84332
84333 /* platform data */
84334 -extern struct snd_ac97_bus_ops pxa2xx_ac97_ops;
84335 +extern const struct snd_ac97_bus_ops pxa2xx_ac97_ops;
84336
84337 #endif
84338 diff -urNp linux-2.6.39.1/sound/soc/pxa/raumfeld.c linux-2.6.39.1/sound/soc/pxa/raumfeld.c
84339 --- linux-2.6.39.1/sound/soc/pxa/raumfeld.c 2011-06-03 00:04:14.000000000 -0400
84340 +++ linux-2.6.39.1/sound/soc/pxa/raumfeld.c 2011-06-03 00:32:09.000000000 -0400
84341 @@ -145,7 +145,7 @@ static int raumfeld_cs4270_hw_params(str
84342 return 0;
84343 }
84344
84345 -static struct snd_soc_ops raumfeld_cs4270_ops = {
84346 +static const struct snd_soc_ops raumfeld_cs4270_ops = {
84347 .startup = raumfeld_cs4270_startup,
84348 .shutdown = raumfeld_cs4270_shutdown,
84349 .hw_params = raumfeld_cs4270_hw_params,
84350 @@ -221,7 +221,7 @@ static int raumfeld_ak4104_hw_params(str
84351 return 0;
84352 }
84353
84354 -static struct snd_soc_ops raumfeld_ak4104_ops = {
84355 +static const struct snd_soc_ops raumfeld_ak4104_ops = {
84356 .hw_params = raumfeld_ak4104_hw_params,
84357 };
84358
84359 diff -urNp linux-2.6.39.1/sound/soc/pxa/saarb.c linux-2.6.39.1/sound/soc/pxa/saarb.c
84360 --- linux-2.6.39.1/sound/soc/pxa/saarb.c 2011-05-19 00:06:34.000000000 -0400
84361 +++ linux-2.6.39.1/sound/soc/pxa/saarb.c 2011-05-22 19:36:35.000000000 -0400
84362 @@ -106,7 +106,7 @@ static int saarb_i2s_hw_params(struct sn
84363 return ret;
84364 }
84365
84366 -static struct snd_soc_ops saarb_i2s_ops = {
84367 +static const struct snd_soc_ops saarb_i2s_ops = {
84368 .hw_params = saarb_i2s_hw_params,
84369 };
84370
84371 diff -urNp linux-2.6.39.1/sound/soc/pxa/spitz.c linux-2.6.39.1/sound/soc/pxa/spitz.c
84372 --- linux-2.6.39.1/sound/soc/pxa/spitz.c 2011-05-19 00:06:34.000000000 -0400
84373 +++ linux-2.6.39.1/sound/soc/pxa/spitz.c 2011-05-22 19:36:35.000000000 -0400
84374 @@ -169,7 +169,7 @@ static int spitz_hw_params(struct snd_pc
84375 return 0;
84376 }
84377
84378 -static struct snd_soc_ops spitz_ops = {
84379 +static const struct snd_soc_ops spitz_ops = {
84380 .startup = spitz_startup,
84381 .hw_params = spitz_hw_params,
84382 };
84383 diff -urNp linux-2.6.39.1/sound/soc/pxa/tavorevb3.c linux-2.6.39.1/sound/soc/pxa/tavorevb3.c
84384 --- linux-2.6.39.1/sound/soc/pxa/tavorevb3.c 2011-05-19 00:06:34.000000000 -0400
84385 +++ linux-2.6.39.1/sound/soc/pxa/tavorevb3.c 2011-05-22 19:36:35.000000000 -0400
84386 @@ -106,7 +106,7 @@ static int evb3_i2s_hw_params(struct snd
84387 return ret;
84388 }
84389
84390 -static struct snd_soc_ops evb3_i2s_ops = {
84391 +static const struct snd_soc_ops evb3_i2s_ops = {
84392 .hw_params = evb3_i2s_hw_params,
84393 };
84394
84395 diff -urNp linux-2.6.39.1/sound/soc/pxa/tosa.c linux-2.6.39.1/sound/soc/pxa/tosa.c
84396 --- linux-2.6.39.1/sound/soc/pxa/tosa.c 2011-05-19 00:06:34.000000000 -0400
84397 +++ linux-2.6.39.1/sound/soc/pxa/tosa.c 2011-05-22 19:36:35.000000000 -0400
84398 @@ -92,7 +92,7 @@ static int tosa_startup(struct snd_pcm_s
84399 return 0;
84400 }
84401
84402 -static struct snd_soc_ops tosa_ops = {
84403 +static const struct snd_soc_ops tosa_ops = {
84404 .startup = tosa_startup,
84405 };
84406
84407 diff -urNp linux-2.6.39.1/sound/soc/pxa/z2.c linux-2.6.39.1/sound/soc/pxa/z2.c
84408 --- linux-2.6.39.1/sound/soc/pxa/z2.c 2011-05-19 00:06:34.000000000 -0400
84409 +++ linux-2.6.39.1/sound/soc/pxa/z2.c 2011-05-22 19:36:35.000000000 -0400
84410 @@ -187,7 +187,7 @@ err:
84411 return ret;
84412 }
84413
84414 -static struct snd_soc_ops z2_ops = {
84415 +static const struct snd_soc_ops z2_ops = {
84416 .hw_params = z2_hw_params,
84417 };
84418
84419 diff -urNp linux-2.6.39.1/sound/soc/pxa/zylonite.c linux-2.6.39.1/sound/soc/pxa/zylonite.c
84420 --- linux-2.6.39.1/sound/soc/pxa/zylonite.c 2011-05-19 00:06:34.000000000 -0400
84421 +++ linux-2.6.39.1/sound/soc/pxa/zylonite.c 2011-05-22 19:36:35.000000000 -0400
84422 @@ -156,7 +156,7 @@ static int zylonite_voice_hw_params(stru
84423 return 0;
84424 }
84425
84426 -static struct snd_soc_ops zylonite_voice_ops = {
84427 +static const struct snd_soc_ops zylonite_voice_ops = {
84428 .hw_params = zylonite_voice_hw_params,
84429 };
84430
84431 diff -urNp linux-2.6.39.1/sound/soc/s6000/s6000-pcm.c linux-2.6.39.1/sound/soc/s6000/s6000-pcm.c
84432 --- linux-2.6.39.1/sound/soc/s6000/s6000-pcm.c 2011-05-19 00:06:34.000000000 -0400
84433 +++ linux-2.6.39.1/sound/soc/s6000/s6000-pcm.c 2011-05-22 19:36:35.000000000 -0400
84434 @@ -420,7 +420,7 @@ static int s6000_pcm_hw_free(struct snd_
84435 return snd_pcm_lib_free_pages(substream);
84436 }
84437
84438 -static struct snd_pcm_ops s6000_pcm_ops = {
84439 +static const struct snd_pcm_ops s6000_pcm_ops = {
84440 .open = s6000_pcm_open,
84441 .close = s6000_pcm_close,
84442 .ioctl = snd_pcm_lib_ioctl,
84443 diff -urNp linux-2.6.39.1/sound/soc/s6000/s6105-ipcam.c linux-2.6.39.1/sound/soc/s6000/s6105-ipcam.c
84444 --- linux-2.6.39.1/sound/soc/s6000/s6105-ipcam.c 2011-05-19 00:06:34.000000000 -0400
84445 +++ linux-2.6.39.1/sound/soc/s6000/s6105-ipcam.c 2011-05-22 19:36:35.000000000 -0400
84446 @@ -55,7 +55,7 @@ static int s6105_hw_params(struct snd_pc
84447 return 0;
84448 }
84449
84450 -static struct snd_soc_ops s6105_ops = {
84451 +static const struct snd_soc_ops s6105_ops = {
84452 .hw_params = s6105_hw_params,
84453 };
84454
84455 diff -urNp linux-2.6.39.1/sound/soc/samsung/goni_wm8994.c linux-2.6.39.1/sound/soc/samsung/goni_wm8994.c
84456 --- linux-2.6.39.1/sound/soc/samsung/goni_wm8994.c 2011-05-19 00:06:34.000000000 -0400
84457 +++ linux-2.6.39.1/sound/soc/samsung/goni_wm8994.c 2011-05-22 19:36:35.000000000 -0400
84458 @@ -176,7 +176,7 @@ static int goni_hifi_hw_params(struct sn
84459 return 0;
84460 }
84461
84462 -static struct snd_soc_ops goni_hifi_ops = {
84463 +static const struct snd_soc_ops goni_hifi_ops = {
84464 .hw_params = goni_hifi_hw_params,
84465 };
84466
84467 @@ -227,7 +227,7 @@ static struct snd_soc_dai_driver voice_d
84468 .formats = SNDRV_PCM_FMTBIT_S16_LE,},
84469 };
84470
84471 -static struct snd_soc_ops goni_voice_ops = {
84472 +static const struct snd_soc_ops goni_voice_ops = {
84473 .hw_params = goni_voice_hw_params,
84474 };
84475
84476 diff -urNp linux-2.6.39.1/sound/soc/samsung/h1940_uda1380.c linux-2.6.39.1/sound/soc/samsung/h1940_uda1380.c
84477 --- linux-2.6.39.1/sound/soc/samsung/h1940_uda1380.c 2011-05-19 00:06:34.000000000 -0400
84478 +++ linux-2.6.39.1/sound/soc/samsung/h1940_uda1380.c 2011-05-22 19:36:35.000000000 -0400
84479 @@ -136,7 +136,7 @@ static int h1940_hw_params(struct snd_pc
84480 return 0;
84481 }
84482
84483 -static struct snd_soc_ops h1940_ops = {
84484 +static const struct snd_soc_ops h1940_ops = {
84485 .startup = h1940_startup,
84486 .hw_params = h1940_hw_params,
84487 };
84488 diff -urNp linux-2.6.39.1/sound/soc/samsung/jive_wm8750.c linux-2.6.39.1/sound/soc/samsung/jive_wm8750.c
84489 --- linux-2.6.39.1/sound/soc/samsung/jive_wm8750.c 2011-05-19 00:06:34.000000000 -0400
84490 +++ linux-2.6.39.1/sound/soc/samsung/jive_wm8750.c 2011-05-22 19:36:35.000000000 -0400
84491 @@ -92,7 +92,7 @@ static int jive_hw_params(struct snd_pcm
84492 return 0;
84493 }
84494
84495 -static struct snd_soc_ops jive_ops = {
84496 +static const struct snd_soc_ops jive_ops = {
84497 .hw_params = jive_hw_params,
84498 };
84499
84500 diff -urNp linux-2.6.39.1/sound/soc/samsung/neo1973_wm8753.c linux-2.6.39.1/sound/soc/samsung/neo1973_wm8753.c
84501 --- linux-2.6.39.1/sound/soc/samsung/neo1973_wm8753.c 2011-05-19 00:06:34.000000000 -0400
84502 +++ linux-2.6.39.1/sound/soc/samsung/neo1973_wm8753.c 2011-05-22 19:36:35.000000000 -0400
84503 @@ -128,7 +128,7 @@ static int neo1973_hifi_hw_free(struct s
84504 /*
84505 * Neo1973 WM8753 HiFi DAI opserations.
84506 */
84507 -static struct snd_soc_ops neo1973_hifi_ops = {
84508 +static const struct snd_soc_ops neo1973_hifi_ops = {
84509 .hw_params = neo1973_hifi_hw_params,
84510 .hw_free = neo1973_hifi_hw_free,
84511 };
84512 @@ -187,7 +187,7 @@ static int neo1973_voice_hw_free(struct
84513 return snd_soc_dai_set_pll(codec_dai, WM8753_PLL2, 0, 0, 0);
84514 }
84515
84516 -static struct snd_soc_ops neo1973_voice_ops = {
84517 +static const struct snd_soc_ops neo1973_voice_ops = {
84518 .hw_params = neo1973_voice_hw_params,
84519 .hw_free = neo1973_voice_hw_free,
84520 };
84521 diff -urNp linux-2.6.39.1/sound/soc/samsung/rx1950_uda1380.c linux-2.6.39.1/sound/soc/samsung/rx1950_uda1380.c
84522 --- linux-2.6.39.1/sound/soc/samsung/rx1950_uda1380.c 2011-05-19 00:06:34.000000000 -0400
84523 +++ linux-2.6.39.1/sound/soc/samsung/rx1950_uda1380.c 2011-05-22 19:36:35.000000000 -0400
84524 @@ -70,7 +70,7 @@ static struct snd_soc_jack_gpio hp_jack_
84525 },
84526 };
84527
84528 -static struct snd_soc_ops rx1950_ops = {
84529 +static const struct snd_soc_ops rx1950_ops = {
84530 .startup = rx1950_startup,
84531 .hw_params = rx1950_hw_params,
84532 };
84533 diff -urNp linux-2.6.39.1/sound/soc/samsung/s3c24xx_simtec.c linux-2.6.39.1/sound/soc/samsung/s3c24xx_simtec.c
84534 --- linux-2.6.39.1/sound/soc/samsung/s3c24xx_simtec.c 2011-05-19 00:06:34.000000000 -0400
84535 +++ linux-2.6.39.1/sound/soc/samsung/s3c24xx_simtec.c 2011-05-22 19:36:35.000000000 -0400
84536 @@ -228,7 +228,7 @@ static int simtec_call_startup(struct s3
84537 return 0;
84538 }
84539
84540 -static struct snd_soc_ops simtec_snd_ops = {
84541 +static const struct snd_soc_ops simtec_snd_ops = {
84542 .hw_params = simtec_hw_params,
84543 };
84544
84545 diff -urNp linux-2.6.39.1/sound/soc/samsung/s3c24xx_uda134x.c linux-2.6.39.1/sound/soc/samsung/s3c24xx_uda134x.c
84546 --- linux-2.6.39.1/sound/soc/samsung/s3c24xx_uda134x.c 2011-05-19 00:06:34.000000000 -0400
84547 +++ linux-2.6.39.1/sound/soc/samsung/s3c24xx_uda134x.c 2011-05-22 19:36:35.000000000 -0400
84548 @@ -210,7 +210,7 @@ static int s3c24xx_uda134x_hw_params(str
84549 return 0;
84550 }
84551
84552 -static struct snd_soc_ops s3c24xx_uda134x_ops = {
84553 +static const struct snd_soc_ops s3c24xx_uda134x_ops = {
84554 .startup = s3c24xx_uda134x_startup,
84555 .shutdown = s3c24xx_uda134x_shutdown,
84556 .hw_params = s3c24xx_uda134x_hw_params,
84557 diff -urNp linux-2.6.39.1/sound/soc/samsung/smartq_wm8987.c linux-2.6.39.1/sound/soc/samsung/smartq_wm8987.c
84558 --- linux-2.6.39.1/sound/soc/samsung/smartq_wm8987.c 2011-05-19 00:06:34.000000000 -0400
84559 +++ linux-2.6.39.1/sound/soc/samsung/smartq_wm8987.c 2011-05-22 19:36:35.000000000 -0400
84560 @@ -92,7 +92,7 @@ static int smartq_hifi_hw_params(struct
84561 /*
84562 * SmartQ WM8987 HiFi DAI operations.
84563 */
84564 -static struct snd_soc_ops smartq_hifi_ops = {
84565 +static const struct snd_soc_ops smartq_hifi_ops = {
84566 .hw_params = smartq_hifi_hw_params,
84567 };
84568
84569 diff -urNp linux-2.6.39.1/sound/soc/samsung/smdk_spdif.c linux-2.6.39.1/sound/soc/samsung/smdk_spdif.c
84570 --- linux-2.6.39.1/sound/soc/samsung/smdk_spdif.c 2011-05-19 00:06:34.000000000 -0400
84571 +++ linux-2.6.39.1/sound/soc/samsung/smdk_spdif.c 2011-05-22 19:36:35.000000000 -0400
84572 @@ -143,7 +143,7 @@ static int smdk_hw_params(struct snd_pcm
84573 return ret;
84574 }
84575
84576 -static struct snd_soc_ops smdk_spdif_ops = {
84577 +static const struct snd_soc_ops smdk_spdif_ops = {
84578 .hw_params = smdk_hw_params,
84579 };
84580
84581 diff -urNp linux-2.6.39.1/sound/soc/samsung/smdk_wm8580.c linux-2.6.39.1/sound/soc/samsung/smdk_wm8580.c
84582 --- linux-2.6.39.1/sound/soc/samsung/smdk_wm8580.c 2011-05-19 00:06:34.000000000 -0400
84583 +++ linux-2.6.39.1/sound/soc/samsung/smdk_wm8580.c 2011-05-22 19:36:35.000000000 -0400
84584 @@ -114,7 +114,7 @@ static int smdk_hw_params(struct snd_pcm
84585 /*
84586 * SMDK WM8580 DAI operations.
84587 */
84588 -static struct snd_soc_ops smdk_ops = {
84589 +static const struct snd_soc_ops smdk_ops = {
84590 .hw_params = smdk_hw_params,
84591 };
84592
84593 diff -urNp linux-2.6.39.1/sound/soc/sh/dma-sh7760.c linux-2.6.39.1/sound/soc/sh/dma-sh7760.c
84594 --- linux-2.6.39.1/sound/soc/sh/dma-sh7760.c 2011-05-19 00:06:34.000000000 -0400
84595 +++ linux-2.6.39.1/sound/soc/sh/dma-sh7760.c 2011-05-22 19:36:35.000000000 -0400
84596 @@ -311,7 +311,7 @@ static snd_pcm_uframes_t camelot_pos(str
84597 return bytes_to_frames(runtime, pos);
84598 }
84599
84600 -static struct snd_pcm_ops camelot_pcm_ops = {
84601 +static const struct snd_pcm_ops camelot_pcm_ops = {
84602 .open = camelot_pcm_open,
84603 .close = camelot_pcm_close,
84604 .ioctl = snd_pcm_lib_ioctl,
84605 diff -urNp linux-2.6.39.1/sound/soc/sh/hac.c linux-2.6.39.1/sound/soc/sh/hac.c
84606 --- linux-2.6.39.1/sound/soc/sh/hac.c 2011-05-19 00:06:34.000000000 -0400
84607 +++ linux-2.6.39.1/sound/soc/sh/hac.c 2011-05-22 19:36:35.000000000 -0400
84608 @@ -227,7 +227,7 @@ static void hac_ac97_coldrst(struct snd_
84609 hac_ac97_warmrst(ac97);
84610 }
84611
84612 -struct snd_ac97_bus_ops soc_ac97_ops = {
84613 +const struct snd_ac97_bus_ops soc_ac97_ops = {
84614 .read = hac_ac97_read,
84615 .write = hac_ac97_write,
84616 .reset = hac_ac97_coldrst,
84617 diff -urNp linux-2.6.39.1/sound/soc/sh/migor.c linux-2.6.39.1/sound/soc/sh/migor.c
84618 --- linux-2.6.39.1/sound/soc/sh/migor.c 2011-05-19 00:06:34.000000000 -0400
84619 +++ linux-2.6.39.1/sound/soc/sh/migor.c 2011-05-22 19:36:35.000000000 -0400
84620 @@ -108,7 +108,7 @@ static int migor_hw_free(struct snd_pcm_
84621 return 0;
84622 }
84623
84624 -static struct snd_soc_ops migor_dai_ops = {
84625 +static const struct snd_soc_ops migor_dai_ops = {
84626 .hw_params = migor_hw_params,
84627 .hw_free = migor_hw_free,
84628 };
84629 diff -urNp linux-2.6.39.1/sound/soc/sh/siu_pcm.c linux-2.6.39.1/sound/soc/sh/siu_pcm.c
84630 --- linux-2.6.39.1/sound/soc/sh/siu_pcm.c 2011-05-19 00:06:34.000000000 -0400
84631 +++ linux-2.6.39.1/sound/soc/sh/siu_pcm.c 2011-05-22 19:36:35.000000000 -0400
84632 @@ -597,7 +597,7 @@ static void siu_pcm_free(struct snd_pcm
84633 dev_dbg(pcm->card->dev, "%s\n", __func__);
84634 }
84635
84636 -static struct snd_pcm_ops siu_pcm_ops = {
84637 +static const struct snd_pcm_ops siu_pcm_ops = {
84638 .open = siu_pcm_open,
84639 .close = siu_pcm_close,
84640 .ioctl = snd_pcm_lib_ioctl,
84641 diff -urNp linux-2.6.39.1/sound/soc/tegra/harmony.c linux-2.6.39.1/sound/soc/tegra/harmony.c
84642 --- linux-2.6.39.1/sound/soc/tegra/harmony.c 2011-05-19 00:06:34.000000000 -0400
84643 +++ linux-2.6.39.1/sound/soc/tegra/harmony.c 2011-05-22 19:36:35.000000000 -0400
84644 @@ -126,7 +126,7 @@ static int harmony_asoc_hw_params(struct
84645 return 0;
84646 }
84647
84648 -static struct snd_soc_ops harmony_asoc_ops = {
84649 +static const struct snd_soc_ops harmony_asoc_ops = {
84650 .hw_params = harmony_asoc_hw_params,
84651 };
84652
84653 diff -urNp linux-2.6.39.1/sound/soc/tegra/tegra_pcm.c linux-2.6.39.1/sound/soc/tegra/tegra_pcm.c
84654 --- linux-2.6.39.1/sound/soc/tegra/tegra_pcm.c 2011-05-19 00:06:34.000000000 -0400
84655 +++ linux-2.6.39.1/sound/soc/tegra/tegra_pcm.c 2011-05-22 19:36:36.000000000 -0400
84656 @@ -277,7 +277,7 @@ static int tegra_pcm_mmap(struct snd_pcm
84657 runtime->dma_bytes);
84658 }
84659
84660 -static struct snd_pcm_ops tegra_pcm_ops = {
84661 +static const struct snd_pcm_ops tegra_pcm_ops = {
84662 .open = tegra_pcm_open,
84663 .close = tegra_pcm_close,
84664 .ioctl = snd_pcm_lib_ioctl,
84665 diff -urNp linux-2.6.39.1/sound/soc/txx9/txx9aclc.c linux-2.6.39.1/sound/soc/txx9/txx9aclc.c
84666 --- linux-2.6.39.1/sound/soc/txx9/txx9aclc.c 2011-05-19 00:06:34.000000000 -0400
84667 +++ linux-2.6.39.1/sound/soc/txx9/txx9aclc.c 2011-05-22 19:36:36.000000000 -0400
84668 @@ -272,7 +272,7 @@ static int txx9aclc_pcm_close(struct snd
84669 return 0;
84670 }
84671
84672 -static struct snd_pcm_ops txx9aclc_pcm_ops = {
84673 +static const struct snd_pcm_ops txx9aclc_pcm_ops = {
84674 .open = txx9aclc_pcm_open,
84675 .close = txx9aclc_pcm_close,
84676 .ioctl = snd_pcm_lib_ioctl,
84677 diff -urNp linux-2.6.39.1/sound/sparc/amd7930.c linux-2.6.39.1/sound/sparc/amd7930.c
84678 --- linux-2.6.39.1/sound/sparc/amd7930.c 2011-05-19 00:06:34.000000000 -0400
84679 +++ linux-2.6.39.1/sound/sparc/amd7930.c 2011-05-22 19:36:36.000000000 -0400
84680 @@ -733,7 +733,7 @@ static int snd_amd7930_hw_free(struct sn
84681 return snd_pcm_lib_free_pages(substream);
84682 }
84683
84684 -static struct snd_pcm_ops snd_amd7930_playback_ops = {
84685 +static const struct snd_pcm_ops snd_amd7930_playback_ops = {
84686 .open = snd_amd7930_playback_open,
84687 .close = snd_amd7930_playback_close,
84688 .ioctl = snd_pcm_lib_ioctl,
84689 @@ -744,7 +744,7 @@ static struct snd_pcm_ops snd_amd7930_pl
84690 .pointer = snd_amd7930_playback_pointer,
84691 };
84692
84693 -static struct snd_pcm_ops snd_amd7930_capture_ops = {
84694 +static const struct snd_pcm_ops snd_amd7930_capture_ops = {
84695 .open = snd_amd7930_capture_open,
84696 .close = snd_amd7930_capture_close,
84697 .ioctl = snd_pcm_lib_ioctl,
84698 @@ -929,7 +929,7 @@ static int snd_amd7930_dev_free(struct s
84699 return snd_amd7930_free(amd);
84700 }
84701
84702 -static struct snd_device_ops snd_amd7930_dev_ops = {
84703 +static const struct snd_device_ops snd_amd7930_dev_ops = {
84704 .dev_free = snd_amd7930_dev_free,
84705 };
84706
84707 diff -urNp linux-2.6.39.1/sound/sparc/cs4231.c linux-2.6.39.1/sound/sparc/cs4231.c
84708 --- linux-2.6.39.1/sound/sparc/cs4231.c 2011-05-19 00:06:34.000000000 -0400
84709 +++ linux-2.6.39.1/sound/sparc/cs4231.c 2011-05-22 19:36:36.000000000 -0400
84710 @@ -1196,7 +1196,7 @@ static int snd_cs4231_capture_close(stru
84711 * XXX the audio AUXIO register...
84712 */
84713
84714 -static struct snd_pcm_ops snd_cs4231_playback_ops = {
84715 +static const struct snd_pcm_ops snd_cs4231_playback_ops = {
84716 .open = snd_cs4231_playback_open,
84717 .close = snd_cs4231_playback_close,
84718 .ioctl = snd_pcm_lib_ioctl,
84719 @@ -1207,7 +1207,7 @@ static struct snd_pcm_ops snd_cs4231_pla
84720 .pointer = snd_cs4231_playback_pointer,
84721 };
84722
84723 -static struct snd_pcm_ops snd_cs4231_capture_ops = {
84724 +static const struct snd_pcm_ops snd_cs4231_capture_ops = {
84725 .open = snd_cs4231_capture_open,
84726 .close = snd_cs4231_capture_close,
84727 .ioctl = snd_pcm_lib_ioctl,
84728 @@ -1789,7 +1789,7 @@ static int snd_cs4231_sbus_dev_free(stru
84729 return snd_cs4231_sbus_free(cp);
84730 }
84731
84732 -static struct snd_device_ops snd_cs4231_sbus_dev_ops = {
84733 +static const struct snd_device_ops snd_cs4231_sbus_dev_ops = {
84734 .dev_free = snd_cs4231_sbus_dev_free,
84735 };
84736
84737 @@ -1955,7 +1955,7 @@ static int snd_cs4231_ebus_dev_free(stru
84738 return snd_cs4231_ebus_free(cp);
84739 }
84740
84741 -static struct snd_device_ops snd_cs4231_ebus_dev_ops = {
84742 +static const struct snd_device_ops snd_cs4231_ebus_dev_ops = {
84743 .dev_free = snd_cs4231_ebus_dev_free,
84744 };
84745
84746 diff -urNp linux-2.6.39.1/sound/sparc/dbri.c linux-2.6.39.1/sound/sparc/dbri.c
84747 --- linux-2.6.39.1/sound/sparc/dbri.c 2011-05-19 00:06:34.000000000 -0400
84748 +++ linux-2.6.39.1/sound/sparc/dbri.c 2011-05-22 19:36:36.000000000 -0400
84749 @@ -2205,7 +2205,7 @@ static snd_pcm_uframes_t snd_dbri_pointe
84750 return ret;
84751 }
84752
84753 -static struct snd_pcm_ops snd_dbri_ops = {
84754 +static const struct snd_pcm_ops snd_dbri_ops = {
84755 .open = snd_dbri_open,
84756 .close = snd_dbri_close,
84757 .ioctl = snd_pcm_lib_ioctl,
84758 diff -urNp linux-2.6.39.1/sound/spi/at73c213.c linux-2.6.39.1/sound/spi/at73c213.c
84759 --- linux-2.6.39.1/sound/spi/at73c213.c 2011-05-19 00:06:34.000000000 -0400
84760 +++ linux-2.6.39.1/sound/spi/at73c213.c 2011-05-22 19:36:36.000000000 -0400
84761 @@ -319,7 +319,7 @@ snd_at73c213_pcm_pointer(struct snd_pcm_
84762 return pos;
84763 }
84764
84765 -static struct snd_pcm_ops at73c213_playback_ops = {
84766 +static const struct snd_pcm_ops at73c213_playback_ops = {
84767 .open = snd_at73c213_pcm_open,
84768 .close = snd_at73c213_pcm_close,
84769 .ioctl = snd_pcm_lib_ioctl,
84770 @@ -882,7 +882,7 @@ static int snd_at73c213_dev_free(struct
84771 static int __devinit snd_at73c213_dev_init(struct snd_card *card,
84772 struct spi_device *spi)
84773 {
84774 - static struct snd_device_ops ops = {
84775 + static const struct snd_device_ops ops = {
84776 .dev_free = snd_at73c213_dev_free,
84777 };
84778 struct snd_at73c213 *chip = get_chip(card);
84779 diff -urNp linux-2.6.39.1/sound/usb/6fire/midi.c linux-2.6.39.1/sound/usb/6fire/midi.c
84780 --- linux-2.6.39.1/sound/usb/6fire/midi.c 2011-05-19 00:06:34.000000000 -0400
84781 +++ linux-2.6.39.1/sound/usb/6fire/midi.c 2011-05-22 19:36:36.000000000 -0400
84782 @@ -134,14 +134,14 @@ static void usb6fire_midi_in_trigger(
84783 spin_unlock_irqrestore(&rt->in_lock, flags);
84784 }
84785
84786 -static struct snd_rawmidi_ops out_ops = {
84787 +static const struct snd_rawmidi_ops out_ops = {
84788 .open = usb6fire_midi_out_open,
84789 .close = usb6fire_midi_out_close,
84790 .trigger = usb6fire_midi_out_trigger,
84791 .drain = usb6fire_midi_out_drain
84792 };
84793
84794 -static struct snd_rawmidi_ops in_ops = {
84795 +static const struct snd_rawmidi_ops in_ops = {
84796 .open = usb6fire_midi_in_open,
84797 .close = usb6fire_midi_in_close,
84798 .trigger = usb6fire_midi_in_trigger
84799 diff -urNp linux-2.6.39.1/sound/usb/caiaq/audio.c linux-2.6.39.1/sound/usb/caiaq/audio.c
84800 --- linux-2.6.39.1/sound/usb/caiaq/audio.c 2011-05-19 00:06:34.000000000 -0400
84801 +++ linux-2.6.39.1/sound/usb/caiaq/audio.c 2011-05-22 19:36:36.000000000 -0400
84802 @@ -322,7 +322,7 @@ snd_usb_caiaq_pcm_pointer(struct snd_pcm
84803 }
84804
84805 /* operators for both playback and capture */
84806 -static struct snd_pcm_ops snd_usb_caiaq_ops = {
84807 +static const struct snd_pcm_ops snd_usb_caiaq_ops = {
84808 .open = snd_usb_caiaq_substream_open,
84809 .close = snd_usb_caiaq_substream_close,
84810 .ioctl = snd_pcm_lib_ioctl,
84811 diff -urNp linux-2.6.39.1/sound/usb/caiaq/midi.c linux-2.6.39.1/sound/usb/caiaq/midi.c
84812 --- linux-2.6.39.1/sound/usb/caiaq/midi.c 2011-05-19 00:06:34.000000000 -0400
84813 +++ linux-2.6.39.1/sound/usb/caiaq/midi.c 2011-05-22 19:36:36.000000000 -0400
84814 @@ -100,15 +100,13 @@ static void snd_usb_caiaq_midi_output_tr
84815 }
84816
84817
84818 -static struct snd_rawmidi_ops snd_usb_caiaq_midi_output =
84819 -{
84820 +static const struct snd_rawmidi_ops snd_usb_caiaq_midi_output = {
84821 .open = snd_usb_caiaq_midi_output_open,
84822 .close = snd_usb_caiaq_midi_output_close,
84823 .trigger = snd_usb_caiaq_midi_output_trigger,
84824 };
84825
84826 -static struct snd_rawmidi_ops snd_usb_caiaq_midi_input =
84827 -{
84828 +static const struct snd_rawmidi_ops snd_usb_caiaq_midi_input = {
84829 .open = snd_usb_caiaq_midi_input_open,
84830 .close = snd_usb_caiaq_midi_input_close,
84831 .trigger = snd_usb_caiaq_midi_input_trigger,
84832 diff -urNp linux-2.6.39.1/sound/usb/card.c linux-2.6.39.1/sound/usb/card.c
84833 --- linux-2.6.39.1/sound/usb/card.c 2011-05-19 00:06:34.000000000 -0400
84834 +++ linux-2.6.39.1/sound/usb/card.c 2011-05-22 19:36:36.000000000 -0400
84835 @@ -305,7 +305,7 @@ static int snd_usb_audio_create(struct u
84836 struct snd_usb_audio *chip;
84837 int err, len;
84838 char component[14];
84839 - static struct snd_device_ops ops = {
84840 + static const struct snd_device_ops ops = {
84841 .dev_free = snd_usb_audio_dev_free,
84842 };
84843
84844 diff -urNp linux-2.6.39.1/sound/usb/midi.c linux-2.6.39.1/sound/usb/midi.c
84845 --- linux-2.6.39.1/sound/usb/midi.c 2011-05-19 00:06:34.000000000 -0400
84846 +++ linux-2.6.39.1/sound/usb/midi.c 2011-05-22 19:36:36.000000000 -0400
84847 @@ -1146,14 +1146,14 @@ static void snd_usbmidi_input_trigger(st
84848 clear_bit(substream->number, &umidi->input_triggered);
84849 }
84850
84851 -static struct snd_rawmidi_ops snd_usbmidi_output_ops = {
84852 +static const struct snd_rawmidi_ops snd_usbmidi_output_ops = {
84853 .open = snd_usbmidi_output_open,
84854 .close = snd_usbmidi_output_close,
84855 .trigger = snd_usbmidi_output_trigger,
84856 .drain = snd_usbmidi_output_drain,
84857 };
84858
84859 -static struct snd_rawmidi_ops snd_usbmidi_input_ops = {
84860 +static const struct snd_rawmidi_ops snd_usbmidi_input_ops = {
84861 .open = snd_usbmidi_input_open,
84862 .close = snd_usbmidi_input_close,
84863 .trigger = snd_usbmidi_input_trigger
84864 diff -urNp linux-2.6.39.1/sound/usb/misc/ua101.c linux-2.6.39.1/sound/usb/misc/ua101.c
84865 --- linux-2.6.39.1/sound/usb/misc/ua101.c 2011-05-19 00:06:34.000000000 -0400
84866 +++ linux-2.6.39.1/sound/usb/misc/ua101.c 2011-05-22 19:36:36.000000000 -0400
84867 @@ -886,7 +886,7 @@ static snd_pcm_uframes_t playback_pcm_po
84868 return ua101_pcm_pointer(ua, &ua->playback);
84869 }
84870
84871 -static struct snd_pcm_ops capture_pcm_ops = {
84872 +static const struct snd_pcm_ops capture_pcm_ops = {
84873 .open = capture_pcm_open,
84874 .close = capture_pcm_close,
84875 .ioctl = snd_pcm_lib_ioctl,
84876 @@ -899,7 +899,7 @@ static struct snd_pcm_ops capture_pcm_op
84877 .mmap = snd_pcm_lib_mmap_vmalloc,
84878 };
84879
84880 -static struct snd_pcm_ops playback_pcm_ops = {
84881 +static const struct snd_pcm_ops playback_pcm_ops = {
84882 .open = playback_pcm_open,
84883 .close = playback_pcm_close,
84884 .ioctl = snd_pcm_lib_ioctl,
84885 diff -urNp linux-2.6.39.1/sound/usb/mixer.c linux-2.6.39.1/sound/usb/mixer.c
84886 --- linux-2.6.39.1/sound/usb/mixer.c 2011-05-19 00:06:34.000000000 -0400
84887 +++ linux-2.6.39.1/sound/usb/mixer.c 2011-05-22 19:36:36.000000000 -0400
84888 @@ -2201,7 +2201,7 @@ static int snd_usb_mixer_status_create(s
84889 int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
84890 int ignore_error)
84891 {
84892 - static struct snd_device_ops dev_ops = {
84893 + static const struct snd_device_ops dev_ops = {
84894 .dev_free = snd_usb_mixer_dev_free
84895 };
84896 struct usb_mixer_interface *mixer;
84897 diff -urNp linux-2.6.39.1/sound/usb/pcm.c linux-2.6.39.1/sound/usb/pcm.c
84898 --- linux-2.6.39.1/sound/usb/pcm.c 2011-05-19 00:06:34.000000000 -0400
84899 +++ linux-2.6.39.1/sound/usb/pcm.c 2011-05-22 19:36:36.000000000 -0400
84900 @@ -844,7 +844,7 @@ static int snd_usb_capture_close(struct
84901 return snd_usb_pcm_close(substream, SNDRV_PCM_STREAM_CAPTURE);
84902 }
84903
84904 -static struct snd_pcm_ops snd_usb_playback_ops = {
84905 +static const struct snd_pcm_ops snd_usb_playback_ops = {
84906 .open = snd_usb_playback_open,
84907 .close = snd_usb_playback_close,
84908 .ioctl = snd_pcm_lib_ioctl,
84909 @@ -857,7 +857,7 @@ static struct snd_pcm_ops snd_usb_playba
84910 .mmap = snd_pcm_lib_mmap_vmalloc,
84911 };
84912
84913 -static struct snd_pcm_ops snd_usb_capture_ops = {
84914 +static const struct snd_pcm_ops snd_usb_capture_ops = {
84915 .open = snd_usb_capture_open,
84916 .close = snd_usb_capture_close,
84917 .ioctl = snd_pcm_lib_ioctl,
84918 diff -urNp linux-2.6.39.1/sound/usb/usx2y/usbusx2yaudio.c linux-2.6.39.1/sound/usb/usx2y/usbusx2yaudio.c
84919 --- linux-2.6.39.1/sound/usb/usx2y/usbusx2yaudio.c 2011-05-19 00:06:34.000000000 -0400
84920 +++ linux-2.6.39.1/sound/usb/usx2y/usbusx2yaudio.c 2011-05-22 19:36:36.000000000 -0400
84921 @@ -919,8 +919,7 @@ static int snd_usX2Y_pcm_close(struct sn
84922 }
84923
84924
84925 -static struct snd_pcm_ops snd_usX2Y_pcm_ops =
84926 -{
84927 +static const struct snd_pcm_ops snd_usX2Y_pcm_ops = {
84928 .open = snd_usX2Y_pcm_open,
84929 .close = snd_usX2Y_pcm_close,
84930 .ioctl = snd_pcm_lib_ioctl,
84931 diff -urNp linux-2.6.39.1/tools/gcc/Makefile linux-2.6.39.1/tools/gcc/Makefile
84932 --- linux-2.6.39.1/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
84933 +++ linux-2.6.39.1/tools/gcc/Makefile 2011-06-03 01:19:01.000000000 -0400
84934 @@ -0,0 +1,11 @@
84935 +#CC := gcc
84936 +#PLUGIN_SOURCE_FILES := pax_plugin.c
84937 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
84938 +GCCPLUGINS_DIR := $(shell $(HOSTCC) -print-file-name=plugin)
84939 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
84940 +
84941 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
84942 +
84943 +hostlibs-y := pax_plugin.so
84944 +always := $(hostlibs-y)
84945 +pax_plugin-objs := pax_plugin.o
84946 diff -urNp linux-2.6.39.1/tools/gcc/pax_plugin.c linux-2.6.39.1/tools/gcc/pax_plugin.c
84947 --- linux-2.6.39.1/tools/gcc/pax_plugin.c 1969-12-31 19:00:00.000000000 -0500
84948 +++ linux-2.6.39.1/tools/gcc/pax_plugin.c 2011-06-03 23:14:36.000000000 -0400
84949 @@ -0,0 +1,242 @@
84950 +/*
84951 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
84952 + * Licensed under the GPL v2
84953 + *
84954 + * Note: the choice of the license means that the compilation process is
84955 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
84956 + * but for the kernel it doesn't matter since it doesn't link against
84957 + * any of the gcc libraries
84958 + *
84959 + * gcc plugin to help implement various PaX features
84960 + *
84961 + * - track lowest stack pointer
84962 + *
84963 + * TODO:
84964 + * - initialize all local variables
84965 + *
84966 + * BUGS:
84967 + */
84968 +#include "gcc-plugin.h"
84969 +#include "plugin-version.h"
84970 +#include "config.h"
84971 +#include "system.h"
84972 +#include "coretypes.h"
84973 +#include "tm.h"
84974 +#include "toplev.h"
84975 +#include "basic-block.h"
84976 +#include "gimple.h"
84977 +//#include "expr.h" where are you...
84978 +#include "diagnostic.h"
84979 +#include "rtl.h"
84980 +#include "emit-rtl.h"
84981 +#include "function.h"
84982 +#include "tree.h"
84983 +#include "tree-pass.h"
84984 +#include "intl.h"
84985 +
84986 +int plugin_is_GPL_compatible;
84987 +
84988 +static int track_frame_size = -1;
84989 +static const char track_function[] = "pax_track_stack";
84990 +static bool init_locals;
84991 +
84992 +static struct plugin_info pax_plugin_info = {
84993 + .version = "201106030000",
84994 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
84995 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
84996 +};
84997 +
84998 +static bool gate_pax_track_stack(void);
84999 +static unsigned int execute_pax_tree_instrument(void);
85000 +static unsigned int execute_pax_final(void);
85001 +
85002 +static struct gimple_opt_pass pax_tree_instrument_pass = {
85003 + .pass = {
85004 + .type = GIMPLE_PASS,
85005 + .name = "pax_tree_instrument",
85006 + .gate = gate_pax_track_stack,
85007 + .execute = execute_pax_tree_instrument,
85008 + .sub = NULL,
85009 + .next = NULL,
85010 + .static_pass_number = 0,
85011 + .tv_id = TV_NONE,
85012 + .properties_required = PROP_gimple_leh | PROP_cfg,
85013 + .properties_provided = 0,
85014 + .properties_destroyed = 0,
85015 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
85016 + .todo_flags_finish = TODO_verify_stmts // | TODO_dump_func
85017 + }
85018 +};
85019 +
85020 +static struct rtl_opt_pass pax_final_rtl_opt_pass = {
85021 + .pass = {
85022 + .type = RTL_PASS,
85023 + .name = "pax_final",
85024 + .gate = gate_pax_track_stack,
85025 + .execute = execute_pax_final,
85026 + .sub = NULL,
85027 + .next = NULL,
85028 + .static_pass_number = 0,
85029 + .tv_id = TV_NONE,
85030 + .properties_required = 0,
85031 + .properties_provided = 0,
85032 + .properties_destroyed = 0,
85033 + .todo_flags_start = 0,
85034 + .todo_flags_finish = 0
85035 + }
85036 +};
85037 +
85038 +static bool gate_pax_track_stack(void)
85039 +{
85040 + return track_frame_size >= 0;
85041 +}
85042 +
85043 +static void pax_add_instrumentation(gimple_stmt_iterator *gsi, bool before)
85044 +{
85045 + gimple call;
85046 + tree decl, type;
85047 +
85048 + // insert call to void pax_track_stack(void)
85049 + type = build_function_type_list(void_type_node, NULL_TREE);
85050 + decl = build_fn_decl(track_function, type);
85051 + DECL_ASSEMBLER_NAME(decl); // for LTO
85052 + call = gimple_build_call(decl, 0);
85053 + if (before)
85054 + gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING);
85055 + else
85056 + gsi_insert_after(gsi, call, GSI_CONTINUE_LINKING);
85057 +}
85058 +
85059 +static unsigned int execute_pax_tree_instrument(void)
85060 +{
85061 + basic_block bb;
85062 + gimple_stmt_iterator gsi;
85063 +
85064 + // 1. loop through BBs and GIMPLE statements
85065 + FOR_EACH_BB(bb) {
85066 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
85067 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
85068 + tree decl;
85069 + gimple stmt = gsi_stmt(gsi);
85070 +
85071 + if (!is_gimple_call(stmt))
85072 + continue;
85073 + decl = gimple_call_fndecl(stmt);
85074 + if (!decl)
85075 + continue;
85076 + if (TREE_CODE(decl) != FUNCTION_DECL)
85077 + continue;
85078 + if (!DECL_BUILT_IN(decl))
85079 + continue;
85080 + if (DECL_BUILT_IN_CLASS(decl) != BUILT_IN_NORMAL)
85081 + continue;
85082 + if (DECL_FUNCTION_CODE(decl) != BUILT_IN_ALLOCA)
85083 + continue;
85084 +
85085 + // 2. insert track call after each __builtin_alloca call
85086 + pax_add_instrumentation(&gsi, false);
85087 +// print_node(stderr, "pax", decl, 4);
85088 + }
85089 + }
85090 +
85091 + // 3. insert track call at the beginning
85092 + bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
85093 + gsi = gsi_start_bb(bb);
85094 + pax_add_instrumentation(&gsi, true);
85095 +
85096 + return 0;
85097 +}
85098 +
85099 +static unsigned int execute_pax_final(void)
85100 +{
85101 + rtx insn;
85102 +
85103 + if (cfun->calls_alloca)
85104 + return 0;
85105 +
85106 + // 1. find pax_track_stack calls
85107 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
85108 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
85109 + rtx body;
85110 +
85111 + if (!CALL_P(insn))
85112 + continue;
85113 + body = PATTERN(insn);
85114 + if (GET_CODE(body) != CALL)
85115 + continue;
85116 + body = XEXP(body, 0);
85117 + if (GET_CODE(body) != MEM)
85118 + continue;
85119 + body = XEXP(body, 0);
85120 + if (GET_CODE(body) != SYMBOL_REF)
85121 + continue;
85122 + if (strcmp(XSTR(body, 0), track_function))
85123 + continue;
85124 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
85125 + // 2. delete call if function frame is not big enough
85126 + if (get_frame_size() >= track_frame_size)
85127 + continue;
85128 + delete_insn_and_edges(insn);
85129 + }
85130 +
85131 +// print_simple_rtl(stderr, get_insns());
85132 +// print_rtl(stderr, get_insns());
85133 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
85134 +
85135 + return 0;
85136 +}
85137 +
85138 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
85139 +{
85140 + const char * const plugin_name = plugin_info->base_name;
85141 + const int argc = plugin_info->argc;
85142 + const struct plugin_argument * const argv = plugin_info->argv;
85143 + int i;
85144 + struct register_pass_info pax_tree_instrument_pass_info = {
85145 + .pass = &pax_tree_instrument_pass.pass,
85146 +// .reference_pass_name = "tree_profile",
85147 + .reference_pass_name = "optimized",
85148 + .ref_pass_instance_number = 0,
85149 + .pos_op = PASS_POS_INSERT_AFTER
85150 + };
85151 + struct register_pass_info pax_final_pass_info = {
85152 + .pass = &pax_final_rtl_opt_pass.pass,
85153 + .reference_pass_name = "final",
85154 + .ref_pass_instance_number = 0,
85155 + .pos_op = PASS_POS_INSERT_BEFORE
85156 + };
85157 +
85158 + if (!plugin_default_version_check(version, &gcc_version)) {
85159 + error(G_("incompatible gcc/plugin versions"));
85160 + return 1;
85161 + }
85162 +
85163 + register_callback(plugin_name, PLUGIN_INFO, NULL, &pax_plugin_info);
85164 +
85165 + for (i = 0; i < argc; ++i) {
85166 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
85167 + if (!argv[i].value) {
85168 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
85169 + continue;
85170 + }
85171 + track_frame_size = atoi(argv[i].value);
85172 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
85173 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
85174 + continue;
85175 + }
85176 + if (!strcmp(argv[i].key, "initialize-locals")) {
85177 + if (argv[i].value) {
85178 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
85179 + continue;
85180 + }
85181 + init_locals = true;
85182 + continue;
85183 + }
85184 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
85185 + }
85186 +
85187 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &pax_tree_instrument_pass_info);
85188 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &pax_final_pass_info);
85189 +
85190 + return 0;
85191 +}
85192 Binary files linux-2.6.39.1/tools/gcc/pax_plugin.so and linux-2.6.39.1/tools/gcc/pax_plugin.so differ
85193 diff -urNp linux-2.6.39.1/tools/perf/builtin-lock.c linux-2.6.39.1/tools/perf/builtin-lock.c
85194 --- linux-2.6.39.1/tools/perf/builtin-lock.c 2011-05-19 00:06:34.000000000 -0400
85195 +++ linux-2.6.39.1/tools/perf/builtin-lock.c 2011-05-22 19:36:36.000000000 -0400
85196 @@ -635,14 +635,14 @@ end:
85197
85198 /* lock oriented handlers */
85199 /* TODO: handlers for CPU oriented, thread oriented */
85200 -static struct trace_lock_handler report_lock_ops = {
85201 +static const struct trace_lock_handler report_lock_ops = {
85202 .acquire_event = report_lock_acquire_event,
85203 .acquired_event = report_lock_acquired_event,
85204 .contended_event = report_lock_contended_event,
85205 .release_event = report_lock_release_event,
85206 };
85207
85208 -static struct trace_lock_handler *trace_handler;
85209 +static const struct trace_lock_handler *trace_handler;
85210
85211 static void
85212 process_lock_acquire_event(void *data,
85213 diff -urNp linux-2.6.39.1/tools/perf/builtin-sched.c linux-2.6.39.1/tools/perf/builtin-sched.c
85214 --- linux-2.6.39.1/tools/perf/builtin-sched.c 2011-05-19 00:06:34.000000000 -0400
85215 +++ linux-2.6.39.1/tools/perf/builtin-sched.c 2011-05-22 19:36:36.000000000 -0400
85216 @@ -845,7 +845,7 @@ replay_fork_event(struct trace_fork_even
85217 register_pid(fork_event->child_pid, fork_event->child_comm);
85218 }
85219
85220 -static struct trace_sched_handler replay_ops = {
85221 +static const struct trace_sched_handler replay_ops = {
85222 .wakeup_event = replay_wakeup_event,
85223 .switch_event = replay_switch_event,
85224 .fork_event = replay_fork_event,
85225 @@ -1183,7 +1183,7 @@ latency_migrate_task_event(struct trace_
85226 nr_unordered_timestamps++;
85227 }
85228
85229 -static struct trace_sched_handler lat_ops = {
85230 +static const struct trace_sched_handler lat_ops = {
85231 .wakeup_event = latency_wakeup_event,
85232 .switch_event = latency_switch_event,
85233 .runtime_event = latency_runtime_event,
85234 @@ -1353,7 +1353,7 @@ static void sort_lat(void)
85235 }
85236 }
85237
85238 -static struct trace_sched_handler *trace_handler;
85239 +static const struct trace_sched_handler *trace_handler;
85240
85241 static void
85242 process_sched_wakeup_event(void *data, struct perf_session *session,
85243 @@ -1719,7 +1719,7 @@ static void __cmd_lat(void)
85244
85245 }
85246
85247 -static struct trace_sched_handler map_ops = {
85248 +static const struct trace_sched_handler map_ops = {
85249 .wakeup_event = NULL,
85250 .switch_event = map_switch_event,
85251 .runtime_event = NULL,
85252 diff -urNp linux-2.6.39.1/usr/gen_init_cpio.c linux-2.6.39.1/usr/gen_init_cpio.c
85253 --- linux-2.6.39.1/usr/gen_init_cpio.c 2011-05-19 00:06:34.000000000 -0400
85254 +++ linux-2.6.39.1/usr/gen_init_cpio.c 2011-05-22 19:36:36.000000000 -0400
85255 @@ -305,7 +305,7 @@ static int cpio_mkfile(const char *name,
85256 int retval;
85257 int rc = -1;
85258 int namesize;
85259 - int i;
85260 + unsigned int i;
85261
85262 mode |= S_IFREG;
85263
85264 @@ -394,9 +394,10 @@ static char *cpio_replace_env(char *new_
85265 *env_var = *expanded = '\0';
85266 strncat(env_var, start + 2, end - start - 2);
85267 strncat(expanded, new_location, start - new_location);
85268 - strncat(expanded, getenv(env_var), PATH_MAX);
85269 - strncat(expanded, end + 1, PATH_MAX);
85270 + strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
85271 + strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
85272 strncpy(new_location, expanded, PATH_MAX);
85273 + new_location[PATH_MAX] = 0;
85274 } else
85275 break;
85276 }
85277 diff -urNp linux-2.6.39.1/virt/kvm/kvm_main.c linux-2.6.39.1/virt/kvm/kvm_main.c
85278 --- linux-2.6.39.1/virt/kvm/kvm_main.c 2011-05-19 00:06:34.000000000 -0400
85279 +++ linux-2.6.39.1/virt/kvm/kvm_main.c 2011-05-22 19:36:36.000000000 -0400
85280 @@ -73,7 +73,7 @@ LIST_HEAD(vm_list);
85281
85282 static cpumask_var_t cpus_hardware_enabled;
85283 static int kvm_usage_count = 0;
85284 -static atomic_t hardware_enable_failed;
85285 +static atomic_unchecked_t hardware_enable_failed;
85286
85287 struct kmem_cache *kvm_vcpu_cache;
85288 EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
85289 @@ -1594,7 +1594,7 @@ static int kvm_vcpu_release(struct inode
85290 return 0;
85291 }
85292
85293 -static struct file_operations kvm_vcpu_fops = {
85294 +static struct file_operations kvm_vcpu_fops = { /* cannot be const */
85295 .release = kvm_vcpu_release,
85296 .unlocked_ioctl = kvm_vcpu_ioctl,
85297 .compat_ioctl = kvm_vcpu_ioctl,
85298 @@ -2063,7 +2063,7 @@ static int kvm_vm_mmap(struct file *file
85299 return 0;
85300 }
85301
85302 -static struct file_operations kvm_vm_fops = {
85303 +static struct file_operations kvm_vm_fops = { /* cannot be const */
85304 .release = kvm_vm_release,
85305 .unlocked_ioctl = kvm_vm_ioctl,
85306 #ifdef CONFIG_COMPAT
85307 @@ -2161,7 +2161,7 @@ out:
85308 return r;
85309 }
85310
85311 -static struct file_operations kvm_chardev_ops = {
85312 +static struct file_operations kvm_chardev_ops = { /* cannot be const */
85313 .unlocked_ioctl = kvm_dev_ioctl,
85314 .compat_ioctl = kvm_dev_ioctl,
85315 .llseek = noop_llseek,
85316 @@ -2187,7 +2187,7 @@ static void hardware_enable_nolock(void
85317
85318 if (r) {
85319 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
85320 - atomic_inc(&hardware_enable_failed);
85321 + atomic_inc_unchecked(&hardware_enable_failed);
85322 printk(KERN_INFO "kvm: enabling virtualization on "
85323 "CPU%d failed\n", cpu);
85324 }
85325 @@ -2241,10 +2241,10 @@ static int hardware_enable_all(void)
85326
85327 kvm_usage_count++;
85328 if (kvm_usage_count == 1) {
85329 - atomic_set(&hardware_enable_failed, 0);
85330 + atomic_set_unchecked(&hardware_enable_failed, 0);
85331 on_each_cpu(hardware_enable_nolock, NULL, 1);
85332
85333 - if (atomic_read(&hardware_enable_failed)) {
85334 + if (atomic_read_unchecked(&hardware_enable_failed)) {
85335 hardware_disable_all_nolock();
85336 r = -EBUSY;
85337 }
85338 @@ -2509,7 +2509,7 @@ static void kvm_sched_out(struct preempt
85339 kvm_arch_vcpu_put(vcpu);
85340 }
85341
85342 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
85343 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
85344 struct module *module)
85345 {
85346 int r;
85347 @@ -2572,7 +2572,7 @@ int kvm_init(void *opaque, unsigned vcpu
85348 if (!vcpu_align)
85349 vcpu_align = __alignof__(struct kvm_vcpu);
85350 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
85351 - 0, NULL);
85352 + SLAB_USERCOPY, NULL);
85353 if (!kvm_vcpu_cache) {
85354 r = -ENOMEM;
85355 goto out_free_3;
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)