]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-3.1-4.1.3-201507251419.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-3.1-4.1.3-201507251419.patch
1 diff --git a/Documentation/dontdiff b/Documentation/dontdiff
2 index 9de9813..1462492 100644
3 --- a/Documentation/dontdiff
4 +++ b/Documentation/dontdiff
5 @@ -3,9 +3,11 @@
6 *.bc
7 *.bin
8 *.bz2
9 +*.c.[012]*.*
10 *.cis
11 *.cpio
12 *.csp
13 +*.dbg
14 *.dsp
15 *.dvi
16 *.elf
17 @@ -15,6 +17,7 @@
18 *.gcov
19 *.gen.S
20 *.gif
21 +*.gmo
22 *.grep
23 *.grp
24 *.gz
25 @@ -51,14 +54,17 @@
26 *.tab.h
27 *.tex
28 *.ver
29 +*.vim
30 *.xml
31 *.xz
32 *_MODULES
33 +*_reg_safe.h
34 *_vga16.c
35 *~
36 \#*#
37 *.9
38 -.*
39 +.[^g]*
40 +.gen*
41 .*.d
42 .mm
43 53c700_d.h
44 @@ -72,9 +78,11 @@ Image
45 Module.markers
46 Module.symvers
47 PENDING
48 +PERF*
49 SCCS
50 System.map*
51 TAGS
52 +TRACEEVENT-CFLAGS
53 aconf
54 af_names.h
55 aic7*reg.h*
56 @@ -83,6 +91,7 @@ aic7*seq.h*
57 aicasm
58 aicdb.h*
59 altivec*.c
60 +ashldi3.S
61 asm-offsets.h
62 asm_offsets.h
63 autoconf.h*
64 @@ -95,32 +104,40 @@ bounds.h
65 bsetup
66 btfixupprep
67 build
68 +builtin-policy.h
69 bvmlinux
70 bzImage*
71 capability_names.h
72 capflags.c
73 classlist.h*
74 +clut_vga16.c
75 +common-cmds.h
76 comp*.log
77 compile.h*
78 conf
79 config
80 config-*
81 config_data.h*
82 +config.c
83 config.mak
84 config.mak.autogen
85 +config.tmp
86 conmakehash
87 consolemap_deftbl.c*
88 cpustr.h
89 crc32table.h*
90 cscope.*
91 defkeymap.c
92 +devicetable-offsets.h
93 devlist.h*
94 dnotify_test
95 docproc
96 dslm
97 +dtc-lexer.lex.c
98 elf2ecoff
99 elfconfig.h*
100 evergreen_reg_safe.h
101 +exception_policy.conf
102 fixdep
103 flask.h
104 fore200e_mkfirm
105 @@ -128,12 +145,15 @@ fore200e_pca_fw.c*
106 gconf
107 gconf.glade.h
108 gen-devlist
109 +gen-kdb_cmds.c
110 gen_crc32table
111 gen_init_cpio
112 generated
113 genheaders
114 genksyms
115 *_gray256.c
116 +hash
117 +hid-example
118 hpet_example
119 hugepage-mmap
120 hugepage-shm
121 @@ -148,14 +168,14 @@ int32.c
122 int4.c
123 int8.c
124 kallsyms
125 -kconfig
126 +kern_constants.h
127 keywords.c
128 ksym.c*
129 ksym.h*
130 kxgettext
131 lex.c
132 lex.*.c
133 -linux
134 +lib1funcs.S
135 logo_*.c
136 logo_*_clut224.c
137 logo_*_mono.c
138 @@ -165,14 +185,15 @@ mach-types.h
139 machtypes.h
140 map
141 map_hugetlb
142 -media
143 mconf
144 +mdp
145 miboot*
146 mk_elfconfig
147 mkboot
148 mkbugboot
149 mkcpustr
150 mkdep
151 +mkpiggy
152 mkprep
153 mkregtable
154 mktables
155 @@ -188,6 +209,8 @@ oui.c*
156 page-types
157 parse.c
158 parse.h
159 +parse-events*
160 +pasyms.h
161 patches*
162 pca200e.bin
163 pca200e_ecd.bin2
164 @@ -197,6 +220,7 @@ perf-archive
165 piggyback
166 piggy.gzip
167 piggy.S
168 +pmu-*
169 pnmtologo
170 ppc_defs.h*
171 pss_boot.h
172 @@ -206,7 +230,12 @@ r200_reg_safe.h
173 r300_reg_safe.h
174 r420_reg_safe.h
175 r600_reg_safe.h
176 +randomize_layout_hash.h
177 +randomize_layout_seed.h
178 +realmode.lds
179 +realmode.relocs
180 recordmcount
181 +regdb.c
182 relocs
183 rlim_names.h
184 rn50_reg_safe.h
185 @@ -216,8 +245,12 @@ series
186 setup
187 setup.bin
188 setup.elf
189 +signing_key*
190 +size_overflow_hash.h
191 sImage
192 +slabinfo
193 sm_tbl*
194 +sortextable
195 split-include
196 syscalltab.h
197 tables.c
198 @@ -227,6 +260,7 @@ tftpboot.img
199 timeconst.h
200 times.h*
201 trix_boot.h
202 +user_constants.h
203 utsrelease.h*
204 vdso-syms.lds
205 vdso.lds
206 @@ -238,13 +272,17 @@ vdso32.lds
207 vdso32.so.dbg
208 vdso64.lds
209 vdso64.so.dbg
210 +vdsox32.lds
211 +vdsox32-syms.lds
212 version.h*
213 vmImage
214 vmlinux
215 vmlinux-*
216 vmlinux.aout
217 vmlinux.bin.all
218 +vmlinux.bin.bz2
219 vmlinux.lds
220 +vmlinux.relocs
221 vmlinuz
222 voffset.h
223 vsyscall.lds
224 @@ -252,9 +290,12 @@ vsyscall_32.lds
225 wanxlfw.inc
226 uImage
227 unifdef
228 +utsrelease.h
229 wakeup.bin
230 wakeup.elf
231 wakeup.lds
232 +x509*
233 zImage*
234 zconf.hash.c
235 +zconf.lex.c
236 zoffset.h
237 diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
238 index 74b6c6d..eac0e77 100644
239 --- a/Documentation/kbuild/makefiles.txt
240 +++ b/Documentation/kbuild/makefiles.txt
241 @@ -23,10 +23,11 @@ This document describes the Linux kernel Makefiles.
242 === 4 Host Program support
243 --- 4.1 Simple Host Program
244 --- 4.2 Composite Host Programs
245 - --- 4.3 Using C++ for host programs
246 - --- 4.4 Controlling compiler options for host programs
247 - --- 4.5 When host programs are actually built
248 - --- 4.6 Using hostprogs-$(CONFIG_FOO)
249 + --- 4.3 Defining shared libraries
250 + --- 4.4 Using C++ for host programs
251 + --- 4.5 Controlling compiler options for host programs
252 + --- 4.6 When host programs are actually built
253 + --- 4.7 Using hostprogs-$(CONFIG_FOO)
254
255 === 5 Kbuild clean infrastructure
256
257 @@ -643,7 +644,29 @@ Both possibilities are described in the following.
258 Finally, the two .o files are linked to the executable, lxdialog.
259 Note: The syntax <executable>-y is not permitted for host-programs.
260
261 ---- 4.3 Using C++ for host programs
262 +--- 4.3 Defining shared libraries
263 +
264 + Objects with extension .so are considered shared libraries, and
265 + will be compiled as position independent objects.
266 + Kbuild provides support for shared libraries, but the usage
267 + shall be restricted.
268 + In the following example the libkconfig.so shared library is used
269 + to link the executable conf.
270 +
271 + Example:
272 + #scripts/kconfig/Makefile
273 + hostprogs-y := conf
274 + conf-objs := conf.o libkconfig.so
275 + libkconfig-objs := expr.o type.o
276 +
277 + Shared libraries always require a corresponding -objs line, and
278 + in the example above the shared library libkconfig is composed by
279 + the two objects expr.o and type.o.
280 + expr.o and type.o will be built as position independent code and
281 + linked as a shared library libkconfig.so. C++ is not supported for
282 + shared libraries.
283 +
284 +--- 4.4 Using C++ for host programs
285
286 kbuild offers support for host programs written in C++. This was
287 introduced solely to support kconfig, and is not recommended
288 @@ -666,7 +689,7 @@ Both possibilities are described in the following.
289 qconf-cxxobjs := qconf.o
290 qconf-objs := check.o
291
292 ---- 4.4 Controlling compiler options for host programs
293 +--- 4.5 Controlling compiler options for host programs
294
295 When compiling host programs, it is possible to set specific flags.
296 The programs will always be compiled utilising $(HOSTCC) passed
297 @@ -694,7 +717,7 @@ Both possibilities are described in the following.
298 When linking qconf, it will be passed the extra option
299 "-L$(QTDIR)/lib".
300
301 ---- 4.5 When host programs are actually built
302 +--- 4.6 When host programs are actually built
303
304 Kbuild will only build host-programs when they are referenced
305 as a prerequisite.
306 @@ -725,7 +748,7 @@ Both possibilities are described in the following.
307 This will tell kbuild to build lxdialog even if not referenced in
308 any rule.
309
310 ---- 4.6 Using hostprogs-$(CONFIG_FOO)
311 +--- 4.7 Using hostprogs-$(CONFIG_FOO)
312
313 A typical pattern in a Kbuild file looks like this:
314
315 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
316 index 6726139..c825c0a 100644
317 --- a/Documentation/kernel-parameters.txt
318 +++ b/Documentation/kernel-parameters.txt
319 @@ -1223,6 +1223,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
320 Format: <unsigned int> such that (rxsize & ~0x1fffc0) == 0.
321 Default: 1024
322
323 + grsec_proc_gid= [GRKERNSEC_PROC_USERGROUP] Chooses GID to
324 + ignore grsecurity's /proc restrictions
325 +
326 + grsec_sysfs_restrict= Format: 0 | 1
327 + Default: 1
328 + Disables GRKERNSEC_SYSFS_RESTRICT if enabled in config
329 +
330 hashdist= [KNL,NUMA] Large hashes allocated during boot
331 are distributed across NUMA nodes. Defaults on
332 for 64-bit NUMA, off otherwise.
333 @@ -2333,6 +2340,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
334 noexec=on: enable non-executable mappings (default)
335 noexec=off: disable non-executable mappings
336
337 + nopcid [X86-64]
338 + Disable PCID (Process-Context IDentifier) even if it
339 + is supported by the processor.
340 +
341 nosmap [X86]
342 Disable SMAP (Supervisor Mode Access Prevention)
343 even if it is supported by processor.
344 @@ -2631,6 +2642,30 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
345 the specified number of seconds. This is to be used if
346 your oopses keep scrolling off the screen.
347
348 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
349 + virtualization environments that don't cope well with the
350 + expand down segment used by UDEREF on X86-32 or the frequent
351 + page table updates on X86-64.
352 +
353 + pax_sanitize_slab=
354 + Format: { 0 | 1 | off | fast | full }
355 + Options '0' and '1' are only provided for backward
356 + compatibility, 'off' or 'fast' should be used instead.
357 + 0|off : disable slab object sanitization
358 + 1|fast: enable slab object sanitization excluding
359 + whitelisted slabs (default)
360 + full : sanitize all slabs, even the whitelisted ones
361 +
362 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
363 +
364 + pax_extra_latent_entropy
365 + Enable a very simple form of latent entropy extraction
366 + from the first 4GB of memory as the bootmem allocator
367 + passes the memory pages to the buddy allocator.
368 +
369 + pax_weakuderef [X86-64] enables the weaker but faster form of UDEREF
370 + when the processor supports PCID.
371 +
372 pcbit= [HW,ISDN]
373
374 pcd. [PARIDE]
375 diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
376 index c831001..1bfbbf6 100644
377 --- a/Documentation/sysctl/kernel.txt
378 +++ b/Documentation/sysctl/kernel.txt
379 @@ -41,6 +41,7 @@ show up in /proc/sys/kernel:
380 - kptr_restrict
381 - kstack_depth_to_print [ X86 only ]
382 - l2cr [ PPC only ]
383 +- modify_ldt [ X86 only ]
384 - modprobe ==> Documentation/debugging-modules.txt
385 - modules_disabled
386 - msg_next_id [ sysv ipc ]
387 @@ -391,6 +392,20 @@ This flag controls the L2 cache of G3 processor boards. If
388
389 ==============================================================
390
391 +modify_ldt: (X86 only)
392 +
393 +Enables (1) or disables (0) the modify_ldt syscall. Modifying the LDT
394 +(Local Descriptor Table) may be needed to run a 16-bit or segmented code
395 +such as Dosemu or Wine. This is done via a system call which is not needed
396 +to run portable applications, and which can sometimes be abused to exploit
397 +some weaknesses of the architecture, opening new vulnerabilities.
398 +
399 +This sysctl allows one to increase the system's security by disabling the
400 +system call, or to restore compatibility with specific applications when it
401 +was already disabled.
402 +
403 +==============================================================
404 +
405 modules_disabled:
406
407 A toggle value indicating if modules are allowed to be loaded
408 diff --git a/Makefile b/Makefile
409 index e3cdec4..56ae73d 100644
410 --- a/Makefile
411 +++ b/Makefile
412 @@ -299,7 +299,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
413 HOSTCC = gcc
414 HOSTCXX = g++
415 HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -std=gnu89
416 -HOSTCXXFLAGS = -O2
417 +HOSTCFLAGS = -W -Wno-unused-parameter -Wno-missing-field-initializers -fno-delete-null-pointer-checks
418 +HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
419 +HOSTCXXFLAGS = -O2 -Wall -W -Wno-array-bounds
420
421 ifeq ($(shell $(HOSTCC) -v 2>&1 | grep -c "clang version"), 1)
422 HOSTCFLAGS += -Wno-unused-value -Wno-unused-parameter \
423 @@ -444,8 +446,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \
424 # Rules shared between *config targets and build targets
425
426 # Basic helpers built in scripts/
427 -PHONY += scripts_basic
428 -scripts_basic:
429 +PHONY += scripts_basic gcc-plugins
430 +scripts_basic: gcc-plugins
431 $(Q)$(MAKE) $(build)=scripts/basic
432 $(Q)rm -f .tmp_quiet_recordmcount
433
434 @@ -620,6 +622,74 @@ endif
435 # Tell gcc to never replace conditional load with a non-conditional one
436 KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
437
438 +ifndef DISABLE_PAX_PLUGINS
439 +ifeq ($(call cc-ifversion, -ge, 0408, y), y)
440 +PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCXX)" "$(HOSTCXX)" "$(CC)")
441 +else
442 +PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(HOSTCXX)" "$(CC)")
443 +endif
444 +ifneq ($(PLUGINCC),)
445 +ifdef CONFIG_PAX_CONSTIFY_PLUGIN
446 +CONSTIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
447 +endif
448 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
449 +STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
450 +STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
451 +endif
452 +ifdef CONFIG_KALLOCSTAT_PLUGIN
453 +KALLOCSTAT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
454 +endif
455 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
456 +KERNEXEC_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
457 +KERNEXEC_PLUGIN_CFLAGS += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD) -DKERNEXEC_PLUGIN
458 +KERNEXEC_PLUGIN_AFLAGS := -DKERNEXEC_PLUGIN
459 +endif
460 +ifdef CONFIG_GRKERNSEC_RANDSTRUCT
461 +RANDSTRUCT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/randomize_layout_plugin.so -DRANDSTRUCT_PLUGIN
462 +ifdef CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE
463 +RANDSTRUCT_PLUGIN_CFLAGS += -fplugin-arg-randomize_layout_plugin-performance-mode
464 +endif
465 +endif
466 +ifdef CONFIG_CHECKER_PLUGIN
467 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
468 +CHECKER_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
469 +endif
470 +endif
471 +COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
472 +ifdef CONFIG_PAX_SIZE_OVERFLOW
473 +SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
474 +endif
475 +ifdef CONFIG_PAX_LATENT_ENTROPY
476 +LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
477 +endif
478 +ifdef CONFIG_PAX_MEMORY_STRUCTLEAK
479 +STRUCTLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/structleak_plugin.so -DSTRUCTLEAK_PLUGIN
480 +endif
481 +INITIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/initify_plugin.so -DINITIFY_PLUGIN
482 +GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
483 +GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
484 +GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS) $(STRUCTLEAK_PLUGIN_CFLAGS)
485 +GCC_PLUGINS_CFLAGS += $(INITIFY_PLUGIN_CFLAGS)
486 +GCC_PLUGINS_CFLAGS += $(RANDSTRUCT_PLUGIN_CFLAGS)
487 +GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS)
488 +export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS CONSTIFY_PLUGIN LATENT_ENTROPY_PLUGIN_CFLAGS
489 +ifeq ($(KBUILD_EXTMOD),)
490 +gcc-plugins:
491 + $(Q)$(MAKE) $(build)=tools/gcc
492 +else
493 +gcc-plugins: ;
494 +endif
495 +else
496 +gcc-plugins:
497 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
498 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
499 +else
500 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
501 +endif
502 + $(Q)echo "PAX_MEMORY_STACKLEAK, constification, PAX_LATENT_ENTROPY and other features will be less secure. PAX_SIZE_OVERFLOW will not be active."
503 +endif
504 +endif
505 +
506 ifdef CONFIG_READABLE_ASM
507 # Disable optimizations that make assembler listings hard to read.
508 # reorder blocks reorders the control in the function
509 @@ -712,7 +782,7 @@ KBUILD_CFLAGS += $(call cc-option, -gsplit-dwarf, -g)
510 else
511 KBUILD_CFLAGS += -g
512 endif
513 -KBUILD_AFLAGS += -Wa,-gdwarf-2
514 +KBUILD_AFLAGS += -Wa,--gdwarf-2
515 endif
516 ifdef CONFIG_DEBUG_INFO_DWARF4
517 KBUILD_CFLAGS += $(call cc-option, -gdwarf-4,)
518 @@ -883,7 +953,7 @@ export mod_sign_cmd
519
520
521 ifeq ($(KBUILD_EXTMOD),)
522 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
523 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
524
525 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
526 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
527 @@ -933,6 +1003,8 @@ endif
528
529 # The actual objects are generated when descending,
530 # make sure no implicit rule kicks in
531 +$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
532 +$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
533 $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
534
535 # Handle descending into subdirectories listed in $(vmlinux-dirs)
536 @@ -942,7 +1014,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
537 # Error messages still appears in the original language
538
539 PHONY += $(vmlinux-dirs)
540 -$(vmlinux-dirs): prepare scripts
541 +$(vmlinux-dirs): gcc-plugins prepare scripts
542 $(Q)$(MAKE) $(build)=$@
543
544 define filechk_kernel.release
545 @@ -985,10 +1057,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
546
547 archprepare: archheaders archscripts prepare1 scripts_basic
548
549 +prepare0: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
550 +prepare0: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
551 prepare0: archprepare FORCE
552 $(Q)$(MAKE) $(build)=.
553
554 # All the preparing..
555 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
556 prepare: prepare0
557
558 # Generate some files
559 @@ -1096,6 +1171,8 @@ all: modules
560 # using awk while concatenating to the final file.
561
562 PHONY += modules
563 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
564 +modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
565 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
566 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
567 @$(kecho) ' Building modules, stage 2.';
568 @@ -1111,7 +1188,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
569
570 # Target to prepare building external modules
571 PHONY += modules_prepare
572 -modules_prepare: prepare scripts
573 +modules_prepare: gcc-plugins prepare scripts
574
575 # Target to install modules
576 PHONY += modules_install
577 @@ -1177,7 +1254,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
578 Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
579 signing_key.priv signing_key.x509 x509.genkey \
580 extra_certificates signing_key.x509.keyid \
581 - signing_key.x509.signer vmlinux-gdb.py
582 + signing_key.x509.signer vmlinux-gdb.py \
583 + tools/gcc/size_overflow_plugin/size_overflow_hash_aux.h \
584 + tools/gcc/size_overflow_plugin/size_overflow_hash.h \
585 + tools/gcc/randomize_layout_seed.h
586
587 # clean - Delete most, but leave enough to build external modules
588 #
589 @@ -1216,7 +1296,7 @@ distclean: mrproper
590 @find $(srctree) $(RCS_FIND_IGNORE) \
591 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
592 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
593 - -o -name '.*.rej' -o -name '*%' -o -name 'core' \) \
594 + -o -name '.*.rej' -o -name '*.so' -o -name '*%' -o -name 'core' \) \
595 -type f -print | xargs rm -f
596
597
598 @@ -1382,6 +1462,8 @@ PHONY += $(module-dirs) modules
599 $(module-dirs): crmodverdir $(objtree)/Module.symvers
600 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
601
602 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
603 +modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
604 modules: $(module-dirs)
605 @$(kecho) ' Building modules, stage 2.';
606 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
607 @@ -1522,17 +1604,21 @@ else
608 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
609 endif
610
611 -%.s: %.c prepare scripts FORCE
612 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
613 +%.s: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
614 +%.s: %.c gcc-plugins prepare scripts FORCE
615 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
616 %.i: %.c prepare scripts FORCE
617 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
618 -%.o: %.c prepare scripts FORCE
619 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
620 +%.o: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
621 +%.o: %.c gcc-plugins prepare scripts FORCE
622 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
623 %.lst: %.c prepare scripts FORCE
624 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
625 -%.s: %.S prepare scripts FORCE
626 +%.s: %.S gcc-plugins prepare scripts FORCE
627 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
628 -%.o: %.S prepare scripts FORCE
629 +%.o: %.S gcc-plugins prepare scripts FORCE
630 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
631 %.symtypes: %.c prepare scripts FORCE
632 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
633 @@ -1544,11 +1630,15 @@ endif
634 $(build)=$(build-dir)
635 # Make sure the latest headers are built for Documentation
636 Documentation/: headers_install
637 -%/: prepare scripts FORCE
638 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
639 +%/: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
640 +%/: gcc-plugins prepare scripts FORCE
641 $(cmd_crmodverdir)
642 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
643 $(build)=$(build-dir)
644 -%.ko: prepare scripts FORCE
645 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
646 +%.ko: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
647 +%.ko: gcc-plugins prepare scripts FORCE
648 $(cmd_crmodverdir)
649 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
650 $(build)=$(build-dir) $(@:.ko=.o)
651 diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
652 index 8f8eafb..3405f46 100644
653 --- a/arch/alpha/include/asm/atomic.h
654 +++ b/arch/alpha/include/asm/atomic.h
655 @@ -239,4 +239,14 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
656 #define atomic_dec(v) atomic_sub(1,(v))
657 #define atomic64_dec(v) atomic64_sub(1,(v))
658
659 +#define atomic64_read_unchecked(v) atomic64_read(v)
660 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
661 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
662 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
663 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
664 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
665 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
666 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
667 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
668 +
669 #endif /* _ALPHA_ATOMIC_H */
670 diff --git a/arch/alpha/include/asm/cache.h b/arch/alpha/include/asm/cache.h
671 index ad368a9..fbe0f25 100644
672 --- a/arch/alpha/include/asm/cache.h
673 +++ b/arch/alpha/include/asm/cache.h
674 @@ -4,19 +4,19 @@
675 #ifndef __ARCH_ALPHA_CACHE_H
676 #define __ARCH_ALPHA_CACHE_H
677
678 +#include <linux/const.h>
679
680 /* Bytes per L1 (data) cache line. */
681 #if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_EV6)
682 -# define L1_CACHE_BYTES 64
683 # define L1_CACHE_SHIFT 6
684 #else
685 /* Both EV4 and EV5 are write-through, read-allocate,
686 direct-mapped, physical.
687 */
688 -# define L1_CACHE_BYTES 32
689 # define L1_CACHE_SHIFT 5
690 #endif
691
692 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
693 #define SMP_CACHE_BYTES L1_CACHE_BYTES
694
695 #endif
696 diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
697 index 968d999..d36b2df 100644
698 --- a/arch/alpha/include/asm/elf.h
699 +++ b/arch/alpha/include/asm/elf.h
700 @@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
701
702 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
703
704 +#ifdef CONFIG_PAX_ASLR
705 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
706 +
707 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
708 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
709 +#endif
710 +
711 /* $0 is set by ld.so to a pointer to a function which might be
712 registered using atexit. This provides a mean for the dynamic
713 linker to call DT_FINI functions for shared libraries that have
714 diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
715 index aab14a0..b4fa3e7 100644
716 --- a/arch/alpha/include/asm/pgalloc.h
717 +++ b/arch/alpha/include/asm/pgalloc.h
718 @@ -29,6 +29,12 @@ pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
719 pgd_set(pgd, pmd);
720 }
721
722 +static inline void
723 +pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
724 +{
725 + pgd_populate(mm, pgd, pmd);
726 +}
727 +
728 extern pgd_t *pgd_alloc(struct mm_struct *mm);
729
730 static inline void
731 diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
732 index a9a1195..e9b8417 100644
733 --- a/arch/alpha/include/asm/pgtable.h
734 +++ b/arch/alpha/include/asm/pgtable.h
735 @@ -101,6 +101,17 @@ struct vm_area_struct;
736 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
737 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
738 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
739 +
740 +#ifdef CONFIG_PAX_PAGEEXEC
741 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
742 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
743 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
744 +#else
745 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
746 +# define PAGE_COPY_NOEXEC PAGE_COPY
747 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
748 +#endif
749 +
750 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
751
752 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
753 diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
754 index 2fd00b7..cfd5069 100644
755 --- a/arch/alpha/kernel/module.c
756 +++ b/arch/alpha/kernel/module.c
757 @@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
758
759 /* The small sections were sorted to the end of the segment.
760 The following should definitely cover them. */
761 - gp = (u64)me->module_core + me->core_size - 0x8000;
762 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
763 got = sechdrs[me->arch.gotsecindex].sh_addr;
764
765 for (i = 0; i < n; i++) {
766 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
767 index 36dc91a..6769cb0 100644
768 --- a/arch/alpha/kernel/osf_sys.c
769 +++ b/arch/alpha/kernel/osf_sys.c
770 @@ -1295,10 +1295,11 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
771 generic version except that we know how to honor ADDR_LIMIT_32BIT. */
772
773 static unsigned long
774 -arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
775 - unsigned long limit)
776 +arch_get_unmapped_area_1(struct file *filp, unsigned long addr, unsigned long len,
777 + unsigned long limit, unsigned long flags)
778 {
779 struct vm_unmapped_area_info info;
780 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
781
782 info.flags = 0;
783 info.length = len;
784 @@ -1306,6 +1307,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
785 info.high_limit = limit;
786 info.align_mask = 0;
787 info.align_offset = 0;
788 + info.threadstack_offset = offset;
789 return vm_unmapped_area(&info);
790 }
791
792 @@ -1338,20 +1340,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
793 merely specific addresses, but regions of memory -- perhaps
794 this feature should be incorporated into all ports? */
795
796 +#ifdef CONFIG_PAX_RANDMMAP
797 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
798 +#endif
799 +
800 if (addr) {
801 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
802 + addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(addr), len, limit, flags);
803 if (addr != (unsigned long) -ENOMEM)
804 return addr;
805 }
806
807 /* Next, try allocating at TASK_UNMAPPED_BASE. */
808 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
809 - len, limit);
810 + addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(current->mm->mmap_base), len, limit, flags);
811 +
812 if (addr != (unsigned long) -ENOMEM)
813 return addr;
814
815 /* Finally, try allocating in low memory. */
816 - addr = arch_get_unmapped_area_1 (PAGE_SIZE, len, limit);
817 + addr = arch_get_unmapped_area_1 (filp, PAGE_SIZE, len, limit, flags);
818
819 return addr;
820 }
821 diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
822 index 9d0ac09..479a962 100644
823 --- a/arch/alpha/mm/fault.c
824 +++ b/arch/alpha/mm/fault.c
825 @@ -53,6 +53,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
826 __reload_thread(pcb);
827 }
828
829 +#ifdef CONFIG_PAX_PAGEEXEC
830 +/*
831 + * PaX: decide what to do with offenders (regs->pc = fault address)
832 + *
833 + * returns 1 when task should be killed
834 + * 2 when patched PLT trampoline was detected
835 + * 3 when unpatched PLT trampoline was detected
836 + */
837 +static int pax_handle_fetch_fault(struct pt_regs *regs)
838 +{
839 +
840 +#ifdef CONFIG_PAX_EMUPLT
841 + int err;
842 +
843 + do { /* PaX: patched PLT emulation #1 */
844 + unsigned int ldah, ldq, jmp;
845 +
846 + err = get_user(ldah, (unsigned int *)regs->pc);
847 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
848 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
849 +
850 + if (err)
851 + break;
852 +
853 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
854 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
855 + jmp == 0x6BFB0000U)
856 + {
857 + unsigned long r27, addr;
858 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
859 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
860 +
861 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
862 + err = get_user(r27, (unsigned long *)addr);
863 + if (err)
864 + break;
865 +
866 + regs->r27 = r27;
867 + regs->pc = r27;
868 + return 2;
869 + }
870 + } while (0);
871 +
872 + do { /* PaX: patched PLT emulation #2 */
873 + unsigned int ldah, lda, br;
874 +
875 + err = get_user(ldah, (unsigned int *)regs->pc);
876 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
877 + err |= get_user(br, (unsigned int *)(regs->pc+8));
878 +
879 + if (err)
880 + break;
881 +
882 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
883 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
884 + (br & 0xFFE00000U) == 0xC3E00000U)
885 + {
886 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
887 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
888 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
889 +
890 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
891 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
892 + return 2;
893 + }
894 + } while (0);
895 +
896 + do { /* PaX: unpatched PLT emulation */
897 + unsigned int br;
898 +
899 + err = get_user(br, (unsigned int *)regs->pc);
900 +
901 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
902 + unsigned int br2, ldq, nop, jmp;
903 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
904 +
905 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
906 + err = get_user(br2, (unsigned int *)addr);
907 + err |= get_user(ldq, (unsigned int *)(addr+4));
908 + err |= get_user(nop, (unsigned int *)(addr+8));
909 + err |= get_user(jmp, (unsigned int *)(addr+12));
910 + err |= get_user(resolver, (unsigned long *)(addr+16));
911 +
912 + if (err)
913 + break;
914 +
915 + if (br2 == 0xC3600000U &&
916 + ldq == 0xA77B000CU &&
917 + nop == 0x47FF041FU &&
918 + jmp == 0x6B7B0000U)
919 + {
920 + regs->r28 = regs->pc+4;
921 + regs->r27 = addr+16;
922 + regs->pc = resolver;
923 + return 3;
924 + }
925 + }
926 + } while (0);
927 +#endif
928 +
929 + return 1;
930 +}
931 +
932 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
933 +{
934 + unsigned long i;
935 +
936 + printk(KERN_ERR "PAX: bytes at PC: ");
937 + for (i = 0; i < 5; i++) {
938 + unsigned int c;
939 + if (get_user(c, (unsigned int *)pc+i))
940 + printk(KERN_CONT "???????? ");
941 + else
942 + printk(KERN_CONT "%08x ", c);
943 + }
944 + printk("\n");
945 +}
946 +#endif
947
948 /*
949 * This routine handles page faults. It determines the address,
950 @@ -133,8 +251,29 @@ retry:
951 good_area:
952 si_code = SEGV_ACCERR;
953 if (cause < 0) {
954 - if (!(vma->vm_flags & VM_EXEC))
955 + if (!(vma->vm_flags & VM_EXEC)) {
956 +
957 +#ifdef CONFIG_PAX_PAGEEXEC
958 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
959 + goto bad_area;
960 +
961 + up_read(&mm->mmap_sem);
962 + switch (pax_handle_fetch_fault(regs)) {
963 +
964 +#ifdef CONFIG_PAX_EMUPLT
965 + case 2:
966 + case 3:
967 + return;
968 +#endif
969 +
970 + }
971 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
972 + do_group_exit(SIGKILL);
973 +#else
974 goto bad_area;
975 +#endif
976 +
977 + }
978 } else if (!cause) {
979 /* Allow reads even for write-only mappings */
980 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
981 diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
982 index 45df48b..952017a 100644
983 --- a/arch/arm/Kconfig
984 +++ b/arch/arm/Kconfig
985 @@ -1716,7 +1716,7 @@ config ALIGNMENT_TRAP
986
987 config UACCESS_WITH_MEMCPY
988 bool "Use kernel mem{cpy,set}() for {copy_to,clear}_user()"
989 - depends on MMU
990 + depends on MMU && !PAX_MEMORY_UDEREF
991 default y if CPU_FEROCEON
992 help
993 Implement faster copy_to_user and clear_user methods for CPU
994 @@ -1951,6 +1951,7 @@ config XIP_PHYS_ADDR
995 config KEXEC
996 bool "Kexec system call (EXPERIMENTAL)"
997 depends on (!SMP || PM_SLEEP_SMP)
998 + depends on !GRKERNSEC_KMEM
999 help
1000 kexec is a system call that implements the ability to shutdown your
1001 current kernel, and to start another kernel. It is like a reboot
1002 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
1003 index e22c119..abe7041 100644
1004 --- a/arch/arm/include/asm/atomic.h
1005 +++ b/arch/arm/include/asm/atomic.h
1006 @@ -18,17 +18,41 @@
1007 #include <asm/barrier.h>
1008 #include <asm/cmpxchg.h>
1009
1010 +#ifdef CONFIG_GENERIC_ATOMIC64
1011 +#include <asm-generic/atomic64.h>
1012 +#endif
1013 +
1014 #define ATOMIC_INIT(i) { (i) }
1015
1016 #ifdef __KERNEL__
1017
1018 +#ifdef CONFIG_THUMB2_KERNEL
1019 +#define REFCOUNT_TRAP_INSN "bkpt 0xf1"
1020 +#else
1021 +#define REFCOUNT_TRAP_INSN "bkpt 0xf103"
1022 +#endif
1023 +
1024 +#define _ASM_EXTABLE(from, to) \
1025 +" .pushsection __ex_table,\"a\"\n"\
1026 +" .align 3\n" \
1027 +" .long " #from ", " #to"\n" \
1028 +" .popsection"
1029 +
1030 /*
1031 * On ARM, ordinary assignment (str instruction) doesn't clear the local
1032 * strex/ldrex monitor on some implementations. The reason we can use it for
1033 * atomic_set() is the clrex or dummy strex done on every exception return.
1034 */
1035 #define atomic_read(v) ACCESS_ONCE((v)->counter)
1036 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
1037 +{
1038 + return ACCESS_ONCE(v->counter);
1039 +}
1040 #define atomic_set(v,i) (((v)->counter) = (i))
1041 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
1042 +{
1043 + v->counter = i;
1044 +}
1045
1046 #if __LINUX_ARM_ARCH__ >= 6
1047
1048 @@ -38,26 +62,50 @@
1049 * to ensure that the update happens.
1050 */
1051
1052 -#define ATOMIC_OP(op, c_op, asm_op) \
1053 -static inline void atomic_##op(int i, atomic_t *v) \
1054 +#ifdef CONFIG_PAX_REFCOUNT
1055 +#define __OVERFLOW_POST \
1056 + " bvc 3f\n" \
1057 + "2: " REFCOUNT_TRAP_INSN "\n"\
1058 + "3:\n"
1059 +#define __OVERFLOW_POST_RETURN \
1060 + " bvc 3f\n" \
1061 +" mov %0, %1\n" \
1062 + "2: " REFCOUNT_TRAP_INSN "\n"\
1063 + "3:\n"
1064 +#define __OVERFLOW_EXTABLE \
1065 + "4:\n" \
1066 + _ASM_EXTABLE(2b, 4b)
1067 +#else
1068 +#define __OVERFLOW_POST
1069 +#define __OVERFLOW_POST_RETURN
1070 +#define __OVERFLOW_EXTABLE
1071 +#endif
1072 +
1073 +#define __ATOMIC_OP(op, suffix, c_op, asm_op, post_op, extable) \
1074 +static inline void atomic_##op##suffix(int i, atomic##suffix##_t *v) \
1075 { \
1076 unsigned long tmp; \
1077 int result; \
1078 \
1079 prefetchw(&v->counter); \
1080 - __asm__ __volatile__("@ atomic_" #op "\n" \
1081 + __asm__ __volatile__("@ atomic_" #op #suffix "\n" \
1082 "1: ldrex %0, [%3]\n" \
1083 " " #asm_op " %0, %0, %4\n" \
1084 + post_op \
1085 " strex %1, %0, [%3]\n" \
1086 " teq %1, #0\n" \
1087 -" bne 1b" \
1088 +" bne 1b\n" \
1089 + extable \
1090 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
1091 : "r" (&v->counter), "Ir" (i) \
1092 : "cc"); \
1093 } \
1094
1095 -#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
1096 -static inline int atomic_##op##_return(int i, atomic_t *v) \
1097 +#define ATOMIC_OP(op, c_op, asm_op) __ATOMIC_OP(op, _unchecked, c_op, asm_op, , )\
1098 + __ATOMIC_OP(op, , c_op, asm_op##s, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
1099 +
1100 +#define __ATOMIC_OP_RETURN(op, suffix, c_op, asm_op, post_op, extable) \
1101 +static inline int atomic_##op##_return##suffix(int i, atomic##suffix##_t *v)\
1102 { \
1103 unsigned long tmp; \
1104 int result; \
1105 @@ -65,12 +113,14 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
1106 smp_mb(); \
1107 prefetchw(&v->counter); \
1108 \
1109 - __asm__ __volatile__("@ atomic_" #op "_return\n" \
1110 + __asm__ __volatile__("@ atomic_" #op "_return" #suffix "\n" \
1111 "1: ldrex %0, [%3]\n" \
1112 " " #asm_op " %0, %0, %4\n" \
1113 + post_op \
1114 " strex %1, %0, [%3]\n" \
1115 " teq %1, #0\n" \
1116 -" bne 1b" \
1117 +" bne 1b\n" \
1118 + extable \
1119 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
1120 : "r" (&v->counter), "Ir" (i) \
1121 : "cc"); \
1122 @@ -80,6 +130,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
1123 return result; \
1124 }
1125
1126 +#define ATOMIC_OP_RETURN(op, c_op, asm_op) __ATOMIC_OP_RETURN(op, _unchecked, c_op, asm_op, , )\
1127 + __ATOMIC_OP_RETURN(op, , c_op, asm_op##s, __OVERFLOW_POST_RETURN, __OVERFLOW_EXTABLE)
1128 +
1129 static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
1130 {
1131 int oldval;
1132 @@ -115,12 +168,24 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1133 __asm__ __volatile__ ("@ atomic_add_unless\n"
1134 "1: ldrex %0, [%4]\n"
1135 " teq %0, %5\n"
1136 -" beq 2f\n"
1137 -" add %1, %0, %6\n"
1138 +" beq 4f\n"
1139 +" adds %1, %0, %6\n"
1140 +
1141 +#ifdef CONFIG_PAX_REFCOUNT
1142 +" bvc 3f\n"
1143 +"2: " REFCOUNT_TRAP_INSN "\n"
1144 +"3:\n"
1145 +#endif
1146 +
1147 " strex %2, %1, [%4]\n"
1148 " teq %2, #0\n"
1149 " bne 1b\n"
1150 -"2:"
1151 +"4:"
1152 +
1153 +#ifdef CONFIG_PAX_REFCOUNT
1154 + _ASM_EXTABLE(2b, 4b)
1155 +#endif
1156 +
1157 : "=&r" (oldval), "=&r" (newval), "=&r" (tmp), "+Qo" (v->counter)
1158 : "r" (&v->counter), "r" (u), "r" (a)
1159 : "cc");
1160 @@ -131,14 +196,36 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1161 return oldval;
1162 }
1163
1164 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *ptr, int old, int new)
1165 +{
1166 + unsigned long oldval, res;
1167 +
1168 + smp_mb();
1169 +
1170 + do {
1171 + __asm__ __volatile__("@ atomic_cmpxchg_unchecked\n"
1172 + "ldrex %1, [%3]\n"
1173 + "mov %0, #0\n"
1174 + "teq %1, %4\n"
1175 + "strexeq %0, %5, [%3]\n"
1176 + : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
1177 + : "r" (&ptr->counter), "Ir" (old), "r" (new)
1178 + : "cc");
1179 + } while (res);
1180 +
1181 + smp_mb();
1182 +
1183 + return oldval;
1184 +}
1185 +
1186 #else /* ARM_ARCH_6 */
1187
1188 #ifdef CONFIG_SMP
1189 #error SMP not supported on pre-ARMv6 CPUs
1190 #endif
1191
1192 -#define ATOMIC_OP(op, c_op, asm_op) \
1193 -static inline void atomic_##op(int i, atomic_t *v) \
1194 +#define __ATOMIC_OP(op, suffix, c_op, asm_op) \
1195 +static inline void atomic_##op##suffix(int i, atomic##suffix##_t *v) \
1196 { \
1197 unsigned long flags; \
1198 \
1199 @@ -147,8 +234,11 @@ static inline void atomic_##op(int i, atomic_t *v) \
1200 raw_local_irq_restore(flags); \
1201 } \
1202
1203 -#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
1204 -static inline int atomic_##op##_return(int i, atomic_t *v) \
1205 +#define ATOMIC_OP(op, c_op, asm_op) __ATOMIC_OP(op, , c_op, asm_op) \
1206 + __ATOMIC_OP(op, _unchecked, c_op, asm_op)
1207 +
1208 +#define __ATOMIC_OP_RETURN(op, suffix, c_op, asm_op) \
1209 +static inline int atomic_##op##_return##suffix(int i, atomic##suffix##_t *v)\
1210 { \
1211 unsigned long flags; \
1212 int val; \
1213 @@ -161,6 +251,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
1214 return val; \
1215 }
1216
1217 +#define ATOMIC_OP_RETURN(op, c_op, asm_op) __ATOMIC_OP_RETURN(op, , c_op, asm_op)\
1218 + __ATOMIC_OP_RETURN(op, _unchecked, c_op, asm_op)
1219 +
1220 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
1221 {
1222 int ret;
1223 @@ -175,6 +268,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
1224 return ret;
1225 }
1226
1227 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
1228 +{
1229 + return atomic_cmpxchg((atomic_t *)v, old, new);
1230 +}
1231 +
1232 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1233 {
1234 int c, old;
1235 @@ -196,16 +294,38 @@ ATOMIC_OPS(sub, -=, sub)
1236
1237 #undef ATOMIC_OPS
1238 #undef ATOMIC_OP_RETURN
1239 +#undef __ATOMIC_OP_RETURN
1240 #undef ATOMIC_OP
1241 +#undef __ATOMIC_OP
1242
1243 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
1244 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
1245 +{
1246 + return xchg(&v->counter, new);
1247 +}
1248
1249 #define atomic_inc(v) atomic_add(1, v)
1250 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
1251 +{
1252 + atomic_add_unchecked(1, v);
1253 +}
1254 #define atomic_dec(v) atomic_sub(1, v)
1255 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
1256 +{
1257 + atomic_sub_unchecked(1, v);
1258 +}
1259
1260 #define atomic_inc_and_test(v) (atomic_add_return(1, v) == 0)
1261 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
1262 +{
1263 + return atomic_add_return_unchecked(1, v) == 0;
1264 +}
1265 #define atomic_dec_and_test(v) (atomic_sub_return(1, v) == 0)
1266 #define atomic_inc_return(v) (atomic_add_return(1, v))
1267 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
1268 +{
1269 + return atomic_add_return_unchecked(1, v);
1270 +}
1271 #define atomic_dec_return(v) (atomic_sub_return(1, v))
1272 #define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
1273
1274 @@ -216,6 +336,14 @@ typedef struct {
1275 long long counter;
1276 } atomic64_t;
1277
1278 +#ifdef CONFIG_PAX_REFCOUNT
1279 +typedef struct {
1280 + long long counter;
1281 +} atomic64_unchecked_t;
1282 +#else
1283 +typedef atomic64_t atomic64_unchecked_t;
1284 +#endif
1285 +
1286 #define ATOMIC64_INIT(i) { (i) }
1287
1288 #ifdef CONFIG_ARM_LPAE
1289 @@ -232,6 +360,19 @@ static inline long long atomic64_read(const atomic64_t *v)
1290 return result;
1291 }
1292
1293 +static inline long long atomic64_read_unchecked(const atomic64_unchecked_t *v)
1294 +{
1295 + long long result;
1296 +
1297 + __asm__ __volatile__("@ atomic64_read_unchecked\n"
1298 +" ldrd %0, %H0, [%1]"
1299 + : "=&r" (result)
1300 + : "r" (&v->counter), "Qo" (v->counter)
1301 + );
1302 +
1303 + return result;
1304 +}
1305 +
1306 static inline void atomic64_set(atomic64_t *v, long long i)
1307 {
1308 __asm__ __volatile__("@ atomic64_set\n"
1309 @@ -240,6 +381,15 @@ static inline void atomic64_set(atomic64_t *v, long long i)
1310 : "r" (&v->counter), "r" (i)
1311 );
1312 }
1313 +
1314 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
1315 +{
1316 + __asm__ __volatile__("@ atomic64_set_unchecked\n"
1317 +" strd %2, %H2, [%1]"
1318 + : "=Qo" (v->counter)
1319 + : "r" (&v->counter), "r" (i)
1320 + );
1321 +}
1322 #else
1323 static inline long long atomic64_read(const atomic64_t *v)
1324 {
1325 @@ -254,6 +404,19 @@ static inline long long atomic64_read(const atomic64_t *v)
1326 return result;
1327 }
1328
1329 +static inline long long atomic64_read_unchecked(const atomic64_unchecked_t *v)
1330 +{
1331 + long long result;
1332 +
1333 + __asm__ __volatile__("@ atomic64_read_unchecked\n"
1334 +" ldrexd %0, %H0, [%1]"
1335 + : "=&r" (result)
1336 + : "r" (&v->counter), "Qo" (v->counter)
1337 + );
1338 +
1339 + return result;
1340 +}
1341 +
1342 static inline void atomic64_set(atomic64_t *v, long long i)
1343 {
1344 long long tmp;
1345 @@ -268,29 +431,57 @@ static inline void atomic64_set(atomic64_t *v, long long i)
1346 : "r" (&v->counter), "r" (i)
1347 : "cc");
1348 }
1349 +
1350 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
1351 +{
1352 + long long tmp;
1353 +
1354 + prefetchw(&v->counter);
1355 + __asm__ __volatile__("@ atomic64_set_unchecked\n"
1356 +"1: ldrexd %0, %H0, [%2]\n"
1357 +" strexd %0, %3, %H3, [%2]\n"
1358 +" teq %0, #0\n"
1359 +" bne 1b"
1360 + : "=&r" (tmp), "=Qo" (v->counter)
1361 + : "r" (&v->counter), "r" (i)
1362 + : "cc");
1363 +}
1364 #endif
1365
1366 -#define ATOMIC64_OP(op, op1, op2) \
1367 -static inline void atomic64_##op(long long i, atomic64_t *v) \
1368 +#undef __OVERFLOW_POST_RETURN
1369 +#define __OVERFLOW_POST_RETURN \
1370 + " bvc 3f\n" \
1371 +" mov %0, %1\n" \
1372 +" mov %H0, %H1\n" \
1373 + "2: " REFCOUNT_TRAP_INSN "\n"\
1374 + "3:\n"
1375 +
1376 +#define __ATOMIC64_OP(op, suffix, op1, op2, post_op, extable) \
1377 +static inline void atomic64_##op##suffix(long long i, atomic64##suffix##_t *v)\
1378 { \
1379 long long result; \
1380 unsigned long tmp; \
1381 \
1382 prefetchw(&v->counter); \
1383 - __asm__ __volatile__("@ atomic64_" #op "\n" \
1384 + __asm__ __volatile__("@ atomic64_" #op #suffix "\n" \
1385 "1: ldrexd %0, %H0, [%3]\n" \
1386 " " #op1 " %Q0, %Q0, %Q4\n" \
1387 " " #op2 " %R0, %R0, %R4\n" \
1388 + post_op \
1389 " strexd %1, %0, %H0, [%3]\n" \
1390 " teq %1, #0\n" \
1391 -" bne 1b" \
1392 +" bne 1b\n" \
1393 + extable \
1394 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
1395 : "r" (&v->counter), "r" (i) \
1396 : "cc"); \
1397 } \
1398
1399 -#define ATOMIC64_OP_RETURN(op, op1, op2) \
1400 -static inline long long atomic64_##op##_return(long long i, atomic64_t *v) \
1401 +#define ATOMIC64_OP(op, op1, op2) __ATOMIC64_OP(op, _unchecked, op1, op2, , ) \
1402 + __ATOMIC64_OP(op, , op1, op2##s, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
1403 +
1404 +#define __ATOMIC64_OP_RETURN(op, suffix, op1, op2, post_op, extable) \
1405 +static inline long long atomic64_##op##_return##suffix(long long i, atomic64##suffix##_t *v) \
1406 { \
1407 long long result; \
1408 unsigned long tmp; \
1409 @@ -298,13 +489,15 @@ static inline long long atomic64_##op##_return(long long i, atomic64_t *v) \
1410 smp_mb(); \
1411 prefetchw(&v->counter); \
1412 \
1413 - __asm__ __volatile__("@ atomic64_" #op "_return\n" \
1414 + __asm__ __volatile__("@ atomic64_" #op "_return" #suffix "\n" \
1415 "1: ldrexd %0, %H0, [%3]\n" \
1416 " " #op1 " %Q0, %Q0, %Q4\n" \
1417 " " #op2 " %R0, %R0, %R4\n" \
1418 + post_op \
1419 " strexd %1, %0, %H0, [%3]\n" \
1420 " teq %1, #0\n" \
1421 -" bne 1b" \
1422 +" bne 1b\n" \
1423 + extable \
1424 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
1425 : "r" (&v->counter), "r" (i) \
1426 : "cc"); \
1427 @@ -314,6 +507,9 @@ static inline long long atomic64_##op##_return(long long i, atomic64_t *v) \
1428 return result; \
1429 }
1430
1431 +#define ATOMIC64_OP_RETURN(op, op1, op2) __ATOMIC64_OP_RETURN(op, _unchecked, op1, op2, , ) \
1432 + __ATOMIC64_OP_RETURN(op, , op1, op2##s, __OVERFLOW_POST_RETURN, __OVERFLOW_EXTABLE)
1433 +
1434 #define ATOMIC64_OPS(op, op1, op2) \
1435 ATOMIC64_OP(op, op1, op2) \
1436 ATOMIC64_OP_RETURN(op, op1, op2)
1437 @@ -323,7 +519,12 @@ ATOMIC64_OPS(sub, subs, sbc)
1438
1439 #undef ATOMIC64_OPS
1440 #undef ATOMIC64_OP_RETURN
1441 +#undef __ATOMIC64_OP_RETURN
1442 #undef ATOMIC64_OP
1443 +#undef __ATOMIC64_OP
1444 +#undef __OVERFLOW_EXTABLE
1445 +#undef __OVERFLOW_POST_RETURN
1446 +#undef __OVERFLOW_POST
1447
1448 static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
1449 long long new)
1450 @@ -351,6 +552,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
1451 return oldval;
1452 }
1453
1454 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, long long old,
1455 + long long new)
1456 +{
1457 + long long oldval;
1458 + unsigned long res;
1459 +
1460 + smp_mb();
1461 +
1462 + do {
1463 + __asm__ __volatile__("@ atomic64_cmpxchg_unchecked\n"
1464 + "ldrexd %1, %H1, [%3]\n"
1465 + "mov %0, #0\n"
1466 + "teq %1, %4\n"
1467 + "teqeq %H1, %H4\n"
1468 + "strexdeq %0, %5, %H5, [%3]"
1469 + : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
1470 + : "r" (&ptr->counter), "r" (old), "r" (new)
1471 + : "cc");
1472 + } while (res);
1473 +
1474 + smp_mb();
1475 +
1476 + return oldval;
1477 +}
1478 +
1479 static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
1480 {
1481 long long result;
1482 @@ -376,21 +602,35 @@ static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
1483 static inline long long atomic64_dec_if_positive(atomic64_t *v)
1484 {
1485 long long result;
1486 - unsigned long tmp;
1487 + u64 tmp;
1488
1489 smp_mb();
1490 prefetchw(&v->counter);
1491
1492 __asm__ __volatile__("@ atomic64_dec_if_positive\n"
1493 -"1: ldrexd %0, %H0, [%3]\n"
1494 -" subs %Q0, %Q0, #1\n"
1495 -" sbc %R0, %R0, #0\n"
1496 +"1: ldrexd %1, %H1, [%3]\n"
1497 +" subs %Q0, %Q1, #1\n"
1498 +" sbcs %R0, %R1, #0\n"
1499 +
1500 +#ifdef CONFIG_PAX_REFCOUNT
1501 +" bvc 3f\n"
1502 +" mov %Q0, %Q1\n"
1503 +" mov %R0, %R1\n"
1504 +"2: " REFCOUNT_TRAP_INSN "\n"
1505 +"3:\n"
1506 +#endif
1507 +
1508 " teq %R0, #0\n"
1509 -" bmi 2f\n"
1510 +" bmi 4f\n"
1511 " strexd %1, %0, %H0, [%3]\n"
1512 " teq %1, #0\n"
1513 " bne 1b\n"
1514 -"2:"
1515 +"4:\n"
1516 +
1517 +#ifdef CONFIG_PAX_REFCOUNT
1518 + _ASM_EXTABLE(2b, 4b)
1519 +#endif
1520 +
1521 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1522 : "r" (&v->counter)
1523 : "cc");
1524 @@ -414,13 +654,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
1525 " teq %0, %5\n"
1526 " teqeq %H0, %H5\n"
1527 " moveq %1, #0\n"
1528 -" beq 2f\n"
1529 +" beq 4f\n"
1530 " adds %Q0, %Q0, %Q6\n"
1531 -" adc %R0, %R0, %R6\n"
1532 +" adcs %R0, %R0, %R6\n"
1533 +
1534 +#ifdef CONFIG_PAX_REFCOUNT
1535 +" bvc 3f\n"
1536 +"2: " REFCOUNT_TRAP_INSN "\n"
1537 +"3:\n"
1538 +#endif
1539 +
1540 " strexd %2, %0, %H0, [%4]\n"
1541 " teq %2, #0\n"
1542 " bne 1b\n"
1543 -"2:"
1544 +"4:\n"
1545 +
1546 +#ifdef CONFIG_PAX_REFCOUNT
1547 + _ASM_EXTABLE(2b, 4b)
1548 +#endif
1549 +
1550 : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
1551 : "r" (&v->counter), "r" (u), "r" (a)
1552 : "cc");
1553 @@ -433,10 +685,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
1554
1555 #define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0)
1556 #define atomic64_inc(v) atomic64_add(1LL, (v))
1557 +#define atomic64_inc_unchecked(v) atomic64_add_unchecked(1LL, (v))
1558 #define atomic64_inc_return(v) atomic64_add_return(1LL, (v))
1559 +#define atomic64_inc_return_unchecked(v) atomic64_add_return_unchecked(1LL, (v))
1560 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
1561 #define atomic64_sub_and_test(a, v) (atomic64_sub_return((a), (v)) == 0)
1562 #define atomic64_dec(v) atomic64_sub(1LL, (v))
1563 +#define atomic64_dec_unchecked(v) atomic64_sub_unchecked(1LL, (v))
1564 #define atomic64_dec_return(v) atomic64_sub_return(1LL, (v))
1565 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
1566 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
1567 diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h
1568 index d2f81e6..3c4dba5 100644
1569 --- a/arch/arm/include/asm/barrier.h
1570 +++ b/arch/arm/include/asm/barrier.h
1571 @@ -67,7 +67,7 @@
1572 do { \
1573 compiletime_assert_atomic_type(*p); \
1574 smp_mb(); \
1575 - ACCESS_ONCE(*p) = (v); \
1576 + ACCESS_ONCE_RW(*p) = (v); \
1577 } while (0)
1578
1579 #define smp_load_acquire(p) \
1580 diff --git a/arch/arm/include/asm/cache.h b/arch/arm/include/asm/cache.h
1581 index 75fe66b..ba3dee4 100644
1582 --- a/arch/arm/include/asm/cache.h
1583 +++ b/arch/arm/include/asm/cache.h
1584 @@ -4,8 +4,10 @@
1585 #ifndef __ASMARM_CACHE_H
1586 #define __ASMARM_CACHE_H
1587
1588 +#include <linux/const.h>
1589 +
1590 #define L1_CACHE_SHIFT CONFIG_ARM_L1_CACHE_SHIFT
1591 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
1592 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
1593
1594 /*
1595 * Memory returned by kmalloc() may be used for DMA, so we must make
1596 @@ -24,5 +26,6 @@
1597 #endif
1598
1599 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
1600 +#define __read_only __attribute__ ((__section__(".data..read_only")))
1601
1602 #endif
1603 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
1604 index 2d46862..a35415b 100644
1605 --- a/arch/arm/include/asm/cacheflush.h
1606 +++ b/arch/arm/include/asm/cacheflush.h
1607 @@ -116,7 +116,7 @@ struct cpu_cache_fns {
1608 void (*dma_unmap_area)(const void *, size_t, int);
1609
1610 void (*dma_flush_range)(const void *, const void *);
1611 -};
1612 +} __no_const;
1613
1614 /*
1615 * Select the calling method
1616 diff --git a/arch/arm/include/asm/checksum.h b/arch/arm/include/asm/checksum.h
1617 index 5233151..87a71fa 100644
1618 --- a/arch/arm/include/asm/checksum.h
1619 +++ b/arch/arm/include/asm/checksum.h
1620 @@ -37,7 +37,19 @@ __wsum
1621 csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum);
1622
1623 __wsum
1624 -csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr);
1625 +__csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr);
1626 +
1627 +static inline __wsum
1628 +csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr)
1629 +{
1630 + __wsum ret;
1631 + pax_open_userland();
1632 + ret = __csum_partial_copy_from_user(src, dst, len, sum, err_ptr);
1633 + pax_close_userland();
1634 + return ret;
1635 +}
1636 +
1637 +
1638
1639 /*
1640 * Fold a partial checksum without adding pseudo headers
1641 diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h
1642 index abb2c37..96db950 100644
1643 --- a/arch/arm/include/asm/cmpxchg.h
1644 +++ b/arch/arm/include/asm/cmpxchg.h
1645 @@ -104,6 +104,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
1646
1647 #define xchg(ptr,x) \
1648 ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
1649 +#define xchg_unchecked(ptr,x) \
1650 + ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
1651
1652 #include <asm-generic/cmpxchg-local.h>
1653
1654 diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h
1655 index 6ddbe44..b5e38b1a 100644
1656 --- a/arch/arm/include/asm/domain.h
1657 +++ b/arch/arm/include/asm/domain.h
1658 @@ -48,18 +48,37 @@
1659 * Domain types
1660 */
1661 #define DOMAIN_NOACCESS 0
1662 -#define DOMAIN_CLIENT 1
1663 #ifdef CONFIG_CPU_USE_DOMAINS
1664 +#define DOMAIN_USERCLIENT 1
1665 +#define DOMAIN_KERNELCLIENT 1
1666 #define DOMAIN_MANAGER 3
1667 +#define DOMAIN_VECTORS DOMAIN_USER
1668 #else
1669 +
1670 +#ifdef CONFIG_PAX_KERNEXEC
1671 #define DOMAIN_MANAGER 1
1672 +#define DOMAIN_KERNEXEC 3
1673 +#else
1674 +#define DOMAIN_MANAGER 1
1675 +#endif
1676 +
1677 +#ifdef CONFIG_PAX_MEMORY_UDEREF
1678 +#define DOMAIN_USERCLIENT 0
1679 +#define DOMAIN_UDEREF 1
1680 +#define DOMAIN_VECTORS DOMAIN_KERNEL
1681 +#else
1682 +#define DOMAIN_USERCLIENT 1
1683 +#define DOMAIN_VECTORS DOMAIN_USER
1684 +#endif
1685 +#define DOMAIN_KERNELCLIENT 1
1686 +
1687 #endif
1688
1689 #define domain_val(dom,type) ((type) << (2*(dom)))
1690
1691 #ifndef __ASSEMBLY__
1692
1693 -#ifdef CONFIG_CPU_USE_DOMAINS
1694 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
1695 static inline void set_domain(unsigned val)
1696 {
1697 asm volatile(
1698 @@ -68,15 +87,7 @@ static inline void set_domain(unsigned val)
1699 isb();
1700 }
1701
1702 -#define modify_domain(dom,type) \
1703 - do { \
1704 - struct thread_info *thread = current_thread_info(); \
1705 - unsigned int domain = thread->cpu_domain; \
1706 - domain &= ~domain_val(dom, DOMAIN_MANAGER); \
1707 - thread->cpu_domain = domain | domain_val(dom, type); \
1708 - set_domain(thread->cpu_domain); \
1709 - } while (0)
1710 -
1711 +extern void modify_domain(unsigned int dom, unsigned int type);
1712 #else
1713 static inline void set_domain(unsigned val) { }
1714 static inline void modify_domain(unsigned dom, unsigned type) { }
1715 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
1716 index d2315ff..f60b47b 100644
1717 --- a/arch/arm/include/asm/elf.h
1718 +++ b/arch/arm/include/asm/elf.h
1719 @@ -117,7 +117,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
1720 the loader. We need to make sure that it is out of the way of the program
1721 that it will "exec", and that there is sufficient room for the brk. */
1722
1723 -#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1724 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1725 +
1726 +#ifdef CONFIG_PAX_ASLR
1727 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
1728 +
1729 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
1730 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
1731 +#endif
1732
1733 /* When the program starts, a1 contains a pointer to a function to be
1734 registered with atexit, as per the SVR4 ABI. A value of 0 means we
1735 diff --git a/arch/arm/include/asm/fncpy.h b/arch/arm/include/asm/fncpy.h
1736 index de53547..52b9a28 100644
1737 --- a/arch/arm/include/asm/fncpy.h
1738 +++ b/arch/arm/include/asm/fncpy.h
1739 @@ -81,7 +81,9 @@
1740 BUG_ON((uintptr_t)(dest_buf) & (FNCPY_ALIGN - 1) || \
1741 (__funcp_address & ~(uintptr_t)1 & (FNCPY_ALIGN - 1))); \
1742 \
1743 + pax_open_kernel(); \
1744 memcpy(dest_buf, (void const *)(__funcp_address & ~1), size); \
1745 + pax_close_kernel(); \
1746 flush_icache_range((unsigned long)(dest_buf), \
1747 (unsigned long)(dest_buf) + (size)); \
1748 \
1749 diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
1750 index 4e78065..f265b48 100644
1751 --- a/arch/arm/include/asm/futex.h
1752 +++ b/arch/arm/include/asm/futex.h
1753 @@ -46,6 +46,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1754 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
1755 return -EFAULT;
1756
1757 + pax_open_userland();
1758 +
1759 smp_mb();
1760 /* Prefetching cannot fault */
1761 prefetchw(uaddr);
1762 @@ -63,6 +65,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1763 : "cc", "memory");
1764 smp_mb();
1765
1766 + pax_close_userland();
1767 +
1768 *uval = val;
1769 return ret;
1770 }
1771 @@ -93,6 +97,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1772 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
1773 return -EFAULT;
1774
1775 + pax_open_userland();
1776 +
1777 __asm__ __volatile__("@futex_atomic_cmpxchg_inatomic\n"
1778 "1: " TUSER(ldr) " %1, [%4]\n"
1779 " teq %1, %2\n"
1780 @@ -103,6 +109,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1781 : "r" (oldval), "r" (newval), "r" (uaddr), "Ir" (-EFAULT)
1782 : "cc", "memory");
1783
1784 + pax_close_userland();
1785 +
1786 *uval = val;
1787 return ret;
1788 }
1789 @@ -125,6 +133,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
1790 return -EFAULT;
1791
1792 pagefault_disable(); /* implies preempt_disable() */
1793 + pax_open_userland();
1794
1795 switch (op) {
1796 case FUTEX_OP_SET:
1797 @@ -146,6 +155,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
1798 ret = -ENOSYS;
1799 }
1800
1801 + pax_close_userland();
1802 pagefault_enable(); /* subsumes preempt_enable() */
1803
1804 if (!ret) {
1805 diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
1806 index 83eb2f7..ed77159 100644
1807 --- a/arch/arm/include/asm/kmap_types.h
1808 +++ b/arch/arm/include/asm/kmap_types.h
1809 @@ -4,6 +4,6 @@
1810 /*
1811 * This is the "bare minimum". AIO seems to require this.
1812 */
1813 -#define KM_TYPE_NR 16
1814 +#define KM_TYPE_NR 17
1815
1816 #endif
1817 diff --git a/arch/arm/include/asm/mach/dma.h b/arch/arm/include/asm/mach/dma.h
1818 index 9e614a1..3302cca 100644
1819 --- a/arch/arm/include/asm/mach/dma.h
1820 +++ b/arch/arm/include/asm/mach/dma.h
1821 @@ -22,7 +22,7 @@ struct dma_ops {
1822 int (*residue)(unsigned int, dma_t *); /* optional */
1823 int (*setspeed)(unsigned int, dma_t *, int); /* optional */
1824 const char *type;
1825 -};
1826 +} __do_const;
1827
1828 struct dma_struct {
1829 void *addr; /* single DMA address */
1830 diff --git a/arch/arm/include/asm/mach/map.h b/arch/arm/include/asm/mach/map.h
1831 index f98c7f3..e5c626d 100644
1832 --- a/arch/arm/include/asm/mach/map.h
1833 +++ b/arch/arm/include/asm/mach/map.h
1834 @@ -23,17 +23,19 @@ struct map_desc {
1835
1836 /* types 0-3 are defined in asm/io.h */
1837 enum {
1838 - MT_UNCACHED = 4,
1839 - MT_CACHECLEAN,
1840 - MT_MINICLEAN,
1841 + MT_UNCACHED_RW = 4,
1842 + MT_CACHECLEAN_RO,
1843 + MT_MINICLEAN_RO,
1844 MT_LOW_VECTORS,
1845 MT_HIGH_VECTORS,
1846 - MT_MEMORY_RWX,
1847 + __MT_MEMORY_RWX,
1848 MT_MEMORY_RW,
1849 - MT_ROM,
1850 - MT_MEMORY_RWX_NONCACHED,
1851 + MT_MEMORY_RX,
1852 + MT_ROM_RX,
1853 + MT_MEMORY_RW_NONCACHED,
1854 + MT_MEMORY_RX_NONCACHED,
1855 MT_MEMORY_RW_DTCM,
1856 - MT_MEMORY_RWX_ITCM,
1857 + MT_MEMORY_RX_ITCM,
1858 MT_MEMORY_RW_SO,
1859 MT_MEMORY_DMA_READY,
1860 };
1861 diff --git a/arch/arm/include/asm/outercache.h b/arch/arm/include/asm/outercache.h
1862 index 563b92f..689d58e 100644
1863 --- a/arch/arm/include/asm/outercache.h
1864 +++ b/arch/arm/include/asm/outercache.h
1865 @@ -39,7 +39,7 @@ struct outer_cache_fns {
1866 /* This is an ARM L2C thing */
1867 void (*write_sec)(unsigned long, unsigned);
1868 void (*configure)(const struct l2x0_regs *);
1869 -};
1870 +} __no_const;
1871
1872 extern struct outer_cache_fns outer_cache;
1873
1874 diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
1875 index 4355f0e..cd9168e 100644
1876 --- a/arch/arm/include/asm/page.h
1877 +++ b/arch/arm/include/asm/page.h
1878 @@ -23,6 +23,7 @@
1879
1880 #else
1881
1882 +#include <linux/compiler.h>
1883 #include <asm/glue.h>
1884
1885 /*
1886 @@ -114,7 +115,7 @@ struct cpu_user_fns {
1887 void (*cpu_clear_user_highpage)(struct page *page, unsigned long vaddr);
1888 void (*cpu_copy_user_highpage)(struct page *to, struct page *from,
1889 unsigned long vaddr, struct vm_area_struct *vma);
1890 -};
1891 +} __no_const;
1892
1893 #ifdef MULTI_USER
1894 extern struct cpu_user_fns cpu_user;
1895 diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
1896 index 19cfab5..3f5c7e9 100644
1897 --- a/arch/arm/include/asm/pgalloc.h
1898 +++ b/arch/arm/include/asm/pgalloc.h
1899 @@ -17,6 +17,7 @@
1900 #include <asm/processor.h>
1901 #include <asm/cacheflush.h>
1902 #include <asm/tlbflush.h>
1903 +#include <asm/system_info.h>
1904
1905 #define check_pgt_cache() do { } while (0)
1906
1907 @@ -43,6 +44,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1908 set_pud(pud, __pud(__pa(pmd) | PMD_TYPE_TABLE));
1909 }
1910
1911 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1912 +{
1913 + pud_populate(mm, pud, pmd);
1914 +}
1915 +
1916 #else /* !CONFIG_ARM_LPAE */
1917
1918 /*
1919 @@ -51,6 +57,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1920 #define pmd_alloc_one(mm,addr) ({ BUG(); ((pmd_t *)2); })
1921 #define pmd_free(mm, pmd) do { } while (0)
1922 #define pud_populate(mm,pmd,pte) BUG()
1923 +#define pud_populate_kernel(mm,pmd,pte) BUG()
1924
1925 #endif /* CONFIG_ARM_LPAE */
1926
1927 @@ -128,6 +135,19 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
1928 __free_page(pte);
1929 }
1930
1931 +static inline void __section_update(pmd_t *pmdp, unsigned long addr, pmdval_t prot)
1932 +{
1933 +#ifdef CONFIG_ARM_LPAE
1934 + pmdp[0] = __pmd(pmd_val(pmdp[0]) | prot);
1935 +#else
1936 + if (addr & SECTION_SIZE)
1937 + pmdp[1] = __pmd(pmd_val(pmdp[1]) | prot);
1938 + else
1939 + pmdp[0] = __pmd(pmd_val(pmdp[0]) | prot);
1940 +#endif
1941 + flush_pmd_entry(pmdp);
1942 +}
1943 +
1944 static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t pte,
1945 pmdval_t prot)
1946 {
1947 diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
1948 index 5e68278..1869bae 100644
1949 --- a/arch/arm/include/asm/pgtable-2level-hwdef.h
1950 +++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
1951 @@ -27,7 +27,7 @@
1952 /*
1953 * - section
1954 */
1955 -#define PMD_SECT_PXN (_AT(pmdval_t, 1) << 0) /* v7 */
1956 +#define PMD_SECT_PXN (_AT(pmdval_t, 1) << 0) /* v7 */
1957 #define PMD_SECT_BUFFERABLE (_AT(pmdval_t, 1) << 2)
1958 #define PMD_SECT_CACHEABLE (_AT(pmdval_t, 1) << 3)
1959 #define PMD_SECT_XN (_AT(pmdval_t, 1) << 4) /* v6 */
1960 @@ -39,6 +39,7 @@
1961 #define PMD_SECT_nG (_AT(pmdval_t, 1) << 17) /* v6 */
1962 #define PMD_SECT_SUPER (_AT(pmdval_t, 1) << 18) /* v6 */
1963 #define PMD_SECT_AF (_AT(pmdval_t, 0))
1964 +#define PMD_SECT_RDONLY (_AT(pmdval_t, 0))
1965
1966 #define PMD_SECT_UNCACHED (_AT(pmdval_t, 0))
1967 #define PMD_SECT_BUFFERED (PMD_SECT_BUFFERABLE)
1968 @@ -68,6 +69,7 @@
1969 * - extended small page/tiny page
1970 */
1971 #define PTE_EXT_XN (_AT(pteval_t, 1) << 0) /* v6 */
1972 +#define PTE_EXT_PXN (_AT(pteval_t, 1) << 2) /* v7 */
1973 #define PTE_EXT_AP_MASK (_AT(pteval_t, 3) << 4)
1974 #define PTE_EXT_AP0 (_AT(pteval_t, 1) << 4)
1975 #define PTE_EXT_AP1 (_AT(pteval_t, 2) << 4)
1976 diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
1977 index bfd662e..f6cbb02 100644
1978 --- a/arch/arm/include/asm/pgtable-2level.h
1979 +++ b/arch/arm/include/asm/pgtable-2level.h
1980 @@ -127,6 +127,9 @@
1981 #define L_PTE_SHARED (_AT(pteval_t, 1) << 10) /* shared(v6), coherent(xsc3) */
1982 #define L_PTE_NONE (_AT(pteval_t, 1) << 11)
1983
1984 +/* Two-level page tables only have PXN in the PGD, not in the PTE. */
1985 +#define L_PTE_PXN (_AT(pteval_t, 0))
1986 +
1987 /*
1988 * These are the memory types, defined to be compatible with
1989 * pre-ARMv6 CPUs cacheable and bufferable bits: XXCB
1990 diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
1991 index a745a2a..481350a 100644
1992 --- a/arch/arm/include/asm/pgtable-3level.h
1993 +++ b/arch/arm/include/asm/pgtable-3level.h
1994 @@ -80,6 +80,7 @@
1995 #define L_PTE_USER (_AT(pteval_t, 1) << 6) /* AP[1] */
1996 #define L_PTE_SHARED (_AT(pteval_t, 3) << 8) /* SH[1:0], inner shareable */
1997 #define L_PTE_YOUNG (_AT(pteval_t, 1) << 10) /* AF */
1998 +#define L_PTE_PXN (_AT(pteval_t, 1) << 53) /* PXN */
1999 #define L_PTE_XN (_AT(pteval_t, 1) << 54) /* XN */
2000 #define L_PTE_DIRTY (_AT(pteval_t, 1) << 55)
2001 #define L_PTE_SPECIAL (_AT(pteval_t, 1) << 56)
2002 @@ -91,10 +92,12 @@
2003 #define L_PMD_SECT_SPLITTING (_AT(pmdval_t, 1) << 56)
2004 #define L_PMD_SECT_NONE (_AT(pmdval_t, 1) << 57)
2005 #define L_PMD_SECT_RDONLY (_AT(pteval_t, 1) << 58)
2006 +#define PMD_SECT_RDONLY PMD_SECT_AP2
2007
2008 /*
2009 * To be used in assembly code with the upper page attributes.
2010 */
2011 +#define L_PTE_PXN_HIGH (1 << (53 - 32))
2012 #define L_PTE_XN_HIGH (1 << (54 - 32))
2013 #define L_PTE_DIRTY_HIGH (1 << (55 - 32))
2014
2015 diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
2016 index f403541..b10df68 100644
2017 --- a/arch/arm/include/asm/pgtable.h
2018 +++ b/arch/arm/include/asm/pgtable.h
2019 @@ -33,6 +33,9 @@
2020 #include <asm/pgtable-2level.h>
2021 #endif
2022
2023 +#define ktla_ktva(addr) (addr)
2024 +#define ktva_ktla(addr) (addr)
2025 +
2026 /*
2027 * Just any arbitrary offset to the start of the vmalloc VM area: the
2028 * current 8MB value just means that there will be a 8MB "hole" after the
2029 @@ -48,6 +51,9 @@
2030 #define LIBRARY_TEXT_START 0x0c000000
2031
2032 #ifndef __ASSEMBLY__
2033 +extern pteval_t __supported_pte_mask;
2034 +extern pmdval_t __supported_pmd_mask;
2035 +
2036 extern void __pte_error(const char *file, int line, pte_t);
2037 extern void __pmd_error(const char *file, int line, pmd_t);
2038 extern void __pgd_error(const char *file, int line, pgd_t);
2039 @@ -56,6 +62,48 @@ extern void __pgd_error(const char *file, int line, pgd_t);
2040 #define pmd_ERROR(pmd) __pmd_error(__FILE__, __LINE__, pmd)
2041 #define pgd_ERROR(pgd) __pgd_error(__FILE__, __LINE__, pgd)
2042
2043 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
2044 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
2045 +
2046 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2047 +#include <asm/domain.h>
2048 +#include <linux/thread_info.h>
2049 +#include <linux/preempt.h>
2050 +
2051 +static inline int test_domain(int domain, int domaintype)
2052 +{
2053 + return ((current_thread_info()->cpu_domain) & domain_val(domain, 3)) == domain_val(domain, domaintype);
2054 +}
2055 +#endif
2056 +
2057 +#ifdef CONFIG_PAX_KERNEXEC
2058 +static inline unsigned long pax_open_kernel(void) {
2059 +#ifdef CONFIG_ARM_LPAE
2060 + /* TODO */
2061 +#else
2062 + preempt_disable();
2063 + BUG_ON(test_domain(DOMAIN_KERNEL, DOMAIN_KERNEXEC));
2064 + modify_domain(DOMAIN_KERNEL, DOMAIN_KERNEXEC);
2065 +#endif
2066 + return 0;
2067 +}
2068 +
2069 +static inline unsigned long pax_close_kernel(void) {
2070 +#ifdef CONFIG_ARM_LPAE
2071 + /* TODO */
2072 +#else
2073 + BUG_ON(test_domain(DOMAIN_KERNEL, DOMAIN_MANAGER));
2074 + /* DOMAIN_MANAGER = "client" under KERNEXEC */
2075 + modify_domain(DOMAIN_KERNEL, DOMAIN_MANAGER);
2076 + preempt_enable_no_resched();
2077 +#endif
2078 + return 0;
2079 +}
2080 +#else
2081 +static inline unsigned long pax_open_kernel(void) { return 0; }
2082 +static inline unsigned long pax_close_kernel(void) { return 0; }
2083 +#endif
2084 +
2085 /*
2086 * This is the lowest virtual address we can permit any user space
2087 * mapping to be mapped at. This is particularly important for
2088 @@ -75,8 +123,8 @@ extern void __pgd_error(const char *file, int line, pgd_t);
2089 /*
2090 * The pgprot_* and protection_map entries will be fixed up in runtime
2091 * to include the cachable and bufferable bits based on memory policy,
2092 - * as well as any architecture dependent bits like global/ASID and SMP
2093 - * shared mapping bits.
2094 + * as well as any architecture dependent bits like global/ASID, PXN,
2095 + * and SMP shared mapping bits.
2096 */
2097 #define _L_PTE_DEFAULT L_PTE_PRESENT | L_PTE_YOUNG
2098
2099 @@ -307,7 +355,7 @@ static inline pte_t pte_mknexec(pte_t pte)
2100 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
2101 {
2102 const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
2103 - L_PTE_NONE | L_PTE_VALID;
2104 + L_PTE_NONE | L_PTE_VALID | __supported_pte_mask;
2105 pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
2106 return pte;
2107 }
2108 diff --git a/arch/arm/include/asm/psci.h b/arch/arm/include/asm/psci.h
2109 index c25ef3e..735f14b 100644
2110 --- a/arch/arm/include/asm/psci.h
2111 +++ b/arch/arm/include/asm/psci.h
2112 @@ -32,7 +32,7 @@ struct psci_operations {
2113 int (*affinity_info)(unsigned long target_affinity,
2114 unsigned long lowest_affinity_level);
2115 int (*migrate_info_type)(void);
2116 -};
2117 +} __no_const;
2118
2119 extern struct psci_operations psci_ops;
2120 extern struct smp_operations psci_smp_ops;
2121 diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h
2122 index 18f5a55..5072a40 100644
2123 --- a/arch/arm/include/asm/smp.h
2124 +++ b/arch/arm/include/asm/smp.h
2125 @@ -107,7 +107,7 @@ struct smp_operations {
2126 int (*cpu_disable)(unsigned int cpu);
2127 #endif
2128 #endif
2129 -};
2130 +} __no_const;
2131
2132 struct of_cpu_method {
2133 const char *method;
2134 diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
2135 index bd32ede..bd90a0b 100644
2136 --- a/arch/arm/include/asm/thread_info.h
2137 +++ b/arch/arm/include/asm/thread_info.h
2138 @@ -74,9 +74,9 @@ struct thread_info {
2139 .flags = 0, \
2140 .preempt_count = INIT_PREEMPT_COUNT, \
2141 .addr_limit = KERNEL_DS, \
2142 - .cpu_domain = domain_val(DOMAIN_USER, DOMAIN_MANAGER) | \
2143 - domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | \
2144 - domain_val(DOMAIN_IO, DOMAIN_CLIENT), \
2145 + .cpu_domain = domain_val(DOMAIN_USER, DOMAIN_USERCLIENT) | \
2146 + domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT) | \
2147 + domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT), \
2148 }
2149
2150 #define init_thread_info (init_thread_union.thread_info)
2151 @@ -152,7 +152,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
2152 #define TIF_SYSCALL_AUDIT 9
2153 #define TIF_SYSCALL_TRACEPOINT 10
2154 #define TIF_SECCOMP 11 /* seccomp syscall filtering active */
2155 -#define TIF_NOHZ 12 /* in adaptive nohz mode */
2156 +/* within 8 bits of TIF_SYSCALL_TRACE
2157 + * to meet flexible second operand requirements
2158 + */
2159 +#define TIF_GRSEC_SETXID 12
2160 +#define TIF_NOHZ 13 /* in adaptive nohz mode */
2161 #define TIF_USING_IWMMXT 17
2162 #define TIF_MEMDIE 18 /* is terminating due to OOM killer */
2163 #define TIF_RESTORE_SIGMASK 20
2164 @@ -166,10 +170,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
2165 #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
2166 #define _TIF_SECCOMP (1 << TIF_SECCOMP)
2167 #define _TIF_USING_IWMMXT (1 << TIF_USING_IWMMXT)
2168 +#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
2169
2170 /* Checks for any syscall work in entry-common.S */
2171 #define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
2172 - _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP)
2173 + _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | _TIF_GRSEC_SETXID)
2174
2175 /*
2176 * Change these and you break ASM code in entry-common.S
2177 diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h
2178 index 5f833f7..76e6644 100644
2179 --- a/arch/arm/include/asm/tls.h
2180 +++ b/arch/arm/include/asm/tls.h
2181 @@ -3,6 +3,7 @@
2182
2183 #include <linux/compiler.h>
2184 #include <asm/thread_info.h>
2185 +#include <asm/pgtable.h>
2186
2187 #ifdef __ASSEMBLY__
2188 #include <asm/asm-offsets.h>
2189 @@ -89,7 +90,9 @@ static inline void set_tls(unsigned long val)
2190 * at 0xffff0fe0 must be used instead. (see
2191 * entry-armv.S for details)
2192 */
2193 + pax_open_kernel();
2194 *((unsigned int *)0xffff0ff0) = val;
2195 + pax_close_kernel();
2196 #endif
2197 }
2198
2199 diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
2200 index 74b17d0..57a4bf4 100644
2201 --- a/arch/arm/include/asm/uaccess.h
2202 +++ b/arch/arm/include/asm/uaccess.h
2203 @@ -18,6 +18,7 @@
2204 #include <asm/domain.h>
2205 #include <asm/unified.h>
2206 #include <asm/compiler.h>
2207 +#include <asm/pgtable.h>
2208
2209 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2210 #include <asm-generic/uaccess-unaligned.h>
2211 @@ -70,11 +71,38 @@ extern int __put_user_bad(void);
2212 static inline void set_fs(mm_segment_t fs)
2213 {
2214 current_thread_info()->addr_limit = fs;
2215 - modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
2216 + modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_KERNELCLIENT : DOMAIN_MANAGER);
2217 }
2218
2219 #define segment_eq(a, b) ((a) == (b))
2220
2221 +#define __HAVE_ARCH_PAX_OPEN_USERLAND
2222 +#define __HAVE_ARCH_PAX_CLOSE_USERLAND
2223 +
2224 +static inline void pax_open_userland(void)
2225 +{
2226 +
2227 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2228 + if (segment_eq(get_fs(), USER_DS)) {
2229 + BUG_ON(test_domain(DOMAIN_USER, DOMAIN_UDEREF));
2230 + modify_domain(DOMAIN_USER, DOMAIN_UDEREF);
2231 + }
2232 +#endif
2233 +
2234 +}
2235 +
2236 +static inline void pax_close_userland(void)
2237 +{
2238 +
2239 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2240 + if (segment_eq(get_fs(), USER_DS)) {
2241 + BUG_ON(test_domain(DOMAIN_USER, DOMAIN_NOACCESS));
2242 + modify_domain(DOMAIN_USER, DOMAIN_NOACCESS);
2243 + }
2244 +#endif
2245 +
2246 +}
2247 +
2248 #define __addr_ok(addr) ({ \
2249 unsigned long flag; \
2250 __asm__("cmp %2, %0; movlo %0, #0" \
2251 @@ -198,8 +226,12 @@ extern int __get_user_64t_4(void *);
2252
2253 #define get_user(x, p) \
2254 ({ \
2255 + int __e; \
2256 might_fault(); \
2257 - __get_user_check(x, p); \
2258 + pax_open_userland(); \
2259 + __e = __get_user_check((x), (p)); \
2260 + pax_close_userland(); \
2261 + __e; \
2262 })
2263
2264 extern int __put_user_1(void *, unsigned int);
2265 @@ -244,8 +276,12 @@ extern int __put_user_8(void *, unsigned long long);
2266
2267 #define put_user(x, p) \
2268 ({ \
2269 + int __e; \
2270 might_fault(); \
2271 - __put_user_check(x, p); \
2272 + pax_open_userland(); \
2273 + __e = __put_user_check((x), (p)); \
2274 + pax_close_userland(); \
2275 + __e; \
2276 })
2277
2278 #else /* CONFIG_MMU */
2279 @@ -269,6 +305,7 @@ static inline void set_fs(mm_segment_t fs)
2280
2281 #endif /* CONFIG_MMU */
2282
2283 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
2284 #define access_ok(type, addr, size) (__range_ok(addr, size) == 0)
2285
2286 #define user_addr_max() \
2287 @@ -286,13 +323,17 @@ static inline void set_fs(mm_segment_t fs)
2288 #define __get_user(x, ptr) \
2289 ({ \
2290 long __gu_err = 0; \
2291 + pax_open_userland(); \
2292 __get_user_err((x), (ptr), __gu_err); \
2293 + pax_close_userland(); \
2294 __gu_err; \
2295 })
2296
2297 #define __get_user_error(x, ptr, err) \
2298 ({ \
2299 + pax_open_userland(); \
2300 __get_user_err((x), (ptr), err); \
2301 + pax_close_userland(); \
2302 (void) 0; \
2303 })
2304
2305 @@ -368,13 +409,17 @@ do { \
2306 #define __put_user(x, ptr) \
2307 ({ \
2308 long __pu_err = 0; \
2309 + pax_open_userland(); \
2310 __put_user_err((x), (ptr), __pu_err); \
2311 + pax_close_userland(); \
2312 __pu_err; \
2313 })
2314
2315 #define __put_user_error(x, ptr, err) \
2316 ({ \
2317 + pax_open_userland(); \
2318 __put_user_err((x), (ptr), err); \
2319 + pax_close_userland(); \
2320 (void) 0; \
2321 })
2322
2323 @@ -474,11 +519,44 @@ do { \
2324
2325
2326 #ifdef CONFIG_MMU
2327 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
2328 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
2329 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
2330 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
2331 +
2332 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
2333 +{
2334 + unsigned long ret;
2335 +
2336 + check_object_size(to, n, false);
2337 + pax_open_userland();
2338 + ret = ___copy_from_user(to, from, n);
2339 + pax_close_userland();
2340 + return ret;
2341 +}
2342 +
2343 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
2344 +{
2345 + unsigned long ret;
2346 +
2347 + check_object_size(from, n, true);
2348 + pax_open_userland();
2349 + ret = ___copy_to_user(to, from, n);
2350 + pax_close_userland();
2351 + return ret;
2352 +}
2353 +
2354 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
2355 -extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
2356 +extern unsigned long __must_check ___clear_user(void __user *addr, unsigned long n);
2357 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
2358 +
2359 +static inline unsigned long __must_check __clear_user(void __user *addr, unsigned long n)
2360 +{
2361 + unsigned long ret;
2362 + pax_open_userland();
2363 + ret = ___clear_user(addr, n);
2364 + pax_close_userland();
2365 + return ret;
2366 +}
2367 +
2368 #else
2369 #define __copy_from_user(to, from, n) (memcpy(to, (void __force *)from, n), 0)
2370 #define __copy_to_user(to, from, n) (memcpy((void __force *)to, from, n), 0)
2371 @@ -487,6 +565,9 @@ extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned l
2372
2373 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2374 {
2375 + if ((long)n < 0)
2376 + return n;
2377 +
2378 if (access_ok(VERIFY_READ, from, n))
2379 n = __copy_from_user(to, from, n);
2380 else /* security hole - plug it */
2381 @@ -496,6 +577,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
2382
2383 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2384 {
2385 + if ((long)n < 0)
2386 + return n;
2387 +
2388 if (access_ok(VERIFY_WRITE, to, n))
2389 n = __copy_to_user(to, from, n);
2390 return n;
2391 diff --git a/arch/arm/include/uapi/asm/ptrace.h b/arch/arm/include/uapi/asm/ptrace.h
2392 index 5af0ed1..cea83883 100644
2393 --- a/arch/arm/include/uapi/asm/ptrace.h
2394 +++ b/arch/arm/include/uapi/asm/ptrace.h
2395 @@ -92,7 +92,7 @@
2396 * ARMv7 groups of PSR bits
2397 */
2398 #define APSR_MASK 0xf80f0000 /* N, Z, C, V, Q and GE flags */
2399 -#define PSR_ISET_MASK 0x01000010 /* ISA state (J, T) mask */
2400 +#define PSR_ISET_MASK 0x01000020 /* ISA state (J, T) mask */
2401 #define PSR_IT_MASK 0x0600fc00 /* If-Then execution state mask */
2402 #define PSR_ENDIAN_MASK 0x00000200 /* Endianness state mask */
2403
2404 diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
2405 index a88671c..1cc895e 100644
2406 --- a/arch/arm/kernel/armksyms.c
2407 +++ b/arch/arm/kernel/armksyms.c
2408 @@ -55,7 +55,7 @@ EXPORT_SYMBOL(arm_delay_ops);
2409
2410 /* networking */
2411 EXPORT_SYMBOL(csum_partial);
2412 -EXPORT_SYMBOL(csum_partial_copy_from_user);
2413 +EXPORT_SYMBOL(__csum_partial_copy_from_user);
2414 EXPORT_SYMBOL(csum_partial_copy_nocheck);
2415 EXPORT_SYMBOL(__csum_ipv6_magic);
2416
2417 @@ -91,9 +91,9 @@ EXPORT_SYMBOL(__memzero);
2418 #ifdef CONFIG_MMU
2419 EXPORT_SYMBOL(copy_page);
2420
2421 -EXPORT_SYMBOL(__copy_from_user);
2422 -EXPORT_SYMBOL(__copy_to_user);
2423 -EXPORT_SYMBOL(__clear_user);
2424 +EXPORT_SYMBOL(___copy_from_user);
2425 +EXPORT_SYMBOL(___copy_to_user);
2426 +EXPORT_SYMBOL(___clear_user);
2427
2428 EXPORT_SYMBOL(__get_user_1);
2429 EXPORT_SYMBOL(__get_user_2);
2430 diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
2431 index 570306c..c87f193 100644
2432 --- a/arch/arm/kernel/entry-armv.S
2433 +++ b/arch/arm/kernel/entry-armv.S
2434 @@ -48,6 +48,87 @@
2435 9997:
2436 .endm
2437
2438 + .macro pax_enter_kernel
2439 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2440 + @ make aligned space for saved DACR
2441 + sub sp, sp, #8
2442 + @ save regs
2443 + stmdb sp!, {r1, r2}
2444 + @ read DACR from cpu_domain into r1
2445 + mov r2, sp
2446 + @ assume 8K pages, since we have to split the immediate in two
2447 + bic r2, r2, #(0x1fc0)
2448 + bic r2, r2, #(0x3f)
2449 + ldr r1, [r2, #TI_CPU_DOMAIN]
2450 + @ store old DACR on stack
2451 + str r1, [sp, #8]
2452 +#ifdef CONFIG_PAX_KERNEXEC
2453 + @ set type of DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
2454 + bic r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
2455 + orr r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
2456 +#endif
2457 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2458 + @ set current DOMAIN_USER to DOMAIN_NOACCESS
2459 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2460 +#endif
2461 + @ write r1 to current_thread_info()->cpu_domain
2462 + str r1, [r2, #TI_CPU_DOMAIN]
2463 + @ write r1 to DACR
2464 + mcr p15, 0, r1, c3, c0, 0
2465 + @ instruction sync
2466 + instr_sync
2467 + @ restore regs
2468 + ldmia sp!, {r1, r2}
2469 +#endif
2470 + .endm
2471 +
2472 + .macro pax_open_userland
2473 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2474 + @ save regs
2475 + stmdb sp!, {r0, r1}
2476 + @ read DACR from cpu_domain into r1
2477 + mov r0, sp
2478 + @ assume 8K pages, since we have to split the immediate in two
2479 + bic r0, r0, #(0x1fc0)
2480 + bic r0, r0, #(0x3f)
2481 + ldr r1, [r0, #TI_CPU_DOMAIN]
2482 + @ set current DOMAIN_USER to DOMAIN_CLIENT
2483 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2484 + orr r1, r1, #(domain_val(DOMAIN_USER, DOMAIN_UDEREF))
2485 + @ write r1 to current_thread_info()->cpu_domain
2486 + str r1, [r0, #TI_CPU_DOMAIN]
2487 + @ write r1 to DACR
2488 + mcr p15, 0, r1, c3, c0, 0
2489 + @ instruction sync
2490 + instr_sync
2491 + @ restore regs
2492 + ldmia sp!, {r0, r1}
2493 +#endif
2494 + .endm
2495 +
2496 + .macro pax_close_userland
2497 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2498 + @ save regs
2499 + stmdb sp!, {r0, r1}
2500 + @ read DACR from cpu_domain into r1
2501 + mov r0, sp
2502 + @ assume 8K pages, since we have to split the immediate in two
2503 + bic r0, r0, #(0x1fc0)
2504 + bic r0, r0, #(0x3f)
2505 + ldr r1, [r0, #TI_CPU_DOMAIN]
2506 + @ set current DOMAIN_USER to DOMAIN_NOACCESS
2507 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2508 + @ write r1 to current_thread_info()->cpu_domain
2509 + str r1, [r0, #TI_CPU_DOMAIN]
2510 + @ write r1 to DACR
2511 + mcr p15, 0, r1, c3, c0, 0
2512 + @ instruction sync
2513 + instr_sync
2514 + @ restore regs
2515 + ldmia sp!, {r0, r1}
2516 +#endif
2517 + .endm
2518 +
2519 .macro pabt_helper
2520 @ PABORT handler takes pt_regs in r2, fault address in r4 and psr in r5
2521 #ifdef MULTI_PABORT
2522 @@ -90,11 +171,15 @@
2523 * Invalid mode handlers
2524 */
2525 .macro inv_entry, reason
2526 +
2527 + pax_enter_kernel
2528 +
2529 sub sp, sp, #S_FRAME_SIZE
2530 ARM( stmib sp, {r1 - lr} )
2531 THUMB( stmia sp, {r0 - r12} )
2532 THUMB( str sp, [sp, #S_SP] )
2533 THUMB( str lr, [sp, #S_LR] )
2534 +
2535 mov r1, #\reason
2536 .endm
2537
2538 @@ -150,7 +235,11 @@ ENDPROC(__und_invalid)
2539 .macro svc_entry, stack_hole=0, trace=1
2540 UNWIND(.fnstart )
2541 UNWIND(.save {r0 - pc} )
2542 +
2543 + pax_enter_kernel
2544 +
2545 sub sp, sp, #(S_FRAME_SIZE + \stack_hole - 4)
2546 +
2547 #ifdef CONFIG_THUMB2_KERNEL
2548 SPFIX( str r0, [sp] ) @ temporarily saved
2549 SPFIX( mov r0, sp )
2550 @@ -165,7 +254,12 @@ ENDPROC(__und_invalid)
2551 ldmia r0, {r3 - r5}
2552 add r7, sp, #S_SP - 4 @ here for interlock avoidance
2553 mov r6, #-1 @ "" "" "" ""
2554 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2555 + @ offset sp by 8 as done in pax_enter_kernel
2556 + add r2, sp, #(S_FRAME_SIZE + \stack_hole + 4)
2557 +#else
2558 add r2, sp, #(S_FRAME_SIZE + \stack_hole - 4)
2559 +#endif
2560 SPFIX( addeq r2, r2, #4 )
2561 str r3, [sp, #-4]! @ save the "real" r0 copied
2562 @ from the exception stack
2563 @@ -369,6 +463,9 @@ ENDPROC(__fiq_abt)
2564 .macro usr_entry, trace=1
2565 UNWIND(.fnstart )
2566 UNWIND(.cantunwind ) @ don't unwind the user space
2567 +
2568 + pax_enter_kernel_user
2569 +
2570 sub sp, sp, #S_FRAME_SIZE
2571 ARM( stmib sp, {r1 - r12} )
2572 THUMB( stmia sp, {r0 - r12} )
2573 @@ -479,7 +576,9 @@ __und_usr:
2574 tst r3, #PSR_T_BIT @ Thumb mode?
2575 bne __und_usr_thumb
2576 sub r4, r2, #4 @ ARM instr at LR - 4
2577 + pax_open_userland
2578 1: ldrt r0, [r4]
2579 + pax_close_userland
2580 ARM_BE8(rev r0, r0) @ little endian instruction
2581
2582 @ r0 = 32-bit ARM instruction which caused the exception
2583 @@ -513,11 +612,15 @@ __und_usr_thumb:
2584 */
2585 .arch armv6t2
2586 #endif
2587 + pax_open_userland
2588 2: ldrht r5, [r4]
2589 + pax_close_userland
2590 ARM_BE8(rev16 r5, r5) @ little endian instruction
2591 cmp r5, #0xe800 @ 32bit instruction if xx != 0
2592 blo __und_usr_fault_16 @ 16bit undefined instruction
2593 + pax_open_userland
2594 3: ldrht r0, [r2]
2595 + pax_close_userland
2596 ARM_BE8(rev16 r0, r0) @ little endian instruction
2597 add r2, r2, #2 @ r2 is PC + 2, make it PC + 4
2598 str r2, [sp, #S_PC] @ it's a 2x16bit instr, update
2599 @@ -547,7 +650,8 @@ ENDPROC(__und_usr)
2600 */
2601 .pushsection .text.fixup, "ax"
2602 .align 2
2603 -4: str r4, [sp, #S_PC] @ retry current instruction
2604 +4: pax_close_userland
2605 + str r4, [sp, #S_PC] @ retry current instruction
2606 ret r9
2607 .popsection
2608 .pushsection __ex_table,"a"
2609 @@ -767,7 +871,7 @@ ENTRY(__switch_to)
2610 THUMB( str lr, [ip], #4 )
2611 ldr r4, [r2, #TI_TP_VALUE]
2612 ldr r5, [r2, #TI_TP_VALUE + 4]
2613 -#ifdef CONFIG_CPU_USE_DOMAINS
2614 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2615 ldr r6, [r2, #TI_CPU_DOMAIN]
2616 #endif
2617 switch_tls r1, r4, r5, r3, r7
2618 @@ -776,7 +880,7 @@ ENTRY(__switch_to)
2619 ldr r8, =__stack_chk_guard
2620 ldr r7, [r7, #TSK_STACK_CANARY]
2621 #endif
2622 -#ifdef CONFIG_CPU_USE_DOMAINS
2623 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2624 mcr p15, 0, r6, c3, c0, 0 @ Set domain register
2625 #endif
2626 mov r5, r0
2627 diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
2628 index 4e7f40c..0f9ee2c 100644
2629 --- a/arch/arm/kernel/entry-common.S
2630 +++ b/arch/arm/kernel/entry-common.S
2631 @@ -11,18 +11,46 @@
2632 #include <asm/assembler.h>
2633 #include <asm/unistd.h>
2634 #include <asm/ftrace.h>
2635 +#include <asm/domain.h>
2636 #include <asm/unwind.h>
2637
2638 +#include "entry-header.S"
2639 +
2640 #ifdef CONFIG_NEED_RET_TO_USER
2641 #include <mach/entry-macro.S>
2642 #else
2643 .macro arch_ret_to_user, tmp1, tmp2
2644 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2645 + @ save regs
2646 + stmdb sp!, {r1, r2}
2647 + @ read DACR from cpu_domain into r1
2648 + mov r2, sp
2649 + @ assume 8K pages, since we have to split the immediate in two
2650 + bic r2, r2, #(0x1fc0)
2651 + bic r2, r2, #(0x3f)
2652 + ldr r1, [r2, #TI_CPU_DOMAIN]
2653 +#ifdef CONFIG_PAX_KERNEXEC
2654 + @ set type of DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
2655 + bic r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
2656 + orr r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
2657 +#endif
2658 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2659 + @ set current DOMAIN_USER to DOMAIN_UDEREF
2660 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2661 + orr r1, r1, #(domain_val(DOMAIN_USER, DOMAIN_UDEREF))
2662 +#endif
2663 + @ write r1 to current_thread_info()->cpu_domain
2664 + str r1, [r2, #TI_CPU_DOMAIN]
2665 + @ write r1 to DACR
2666 + mcr p15, 0, r1, c3, c0, 0
2667 + @ instruction sync
2668 + instr_sync
2669 + @ restore regs
2670 + ldmia sp!, {r1, r2}
2671 +#endif
2672 .endm
2673 #endif
2674
2675 -#include "entry-header.S"
2676 -
2677 -
2678 .align 5
2679 /*
2680 * This is the fast syscall return path. We do as little as
2681 @@ -173,6 +201,12 @@ ENTRY(vector_swi)
2682 USER( ldr scno, [lr, #-4] ) @ get SWI instruction
2683 #endif
2684
2685 + /*
2686 + * do this here to avoid a performance hit of wrapping the code above
2687 + * that directly dereferences userland to parse the SWI instruction
2688 + */
2689 + pax_enter_kernel_user
2690 +
2691 adr tbl, sys_call_table @ load syscall table pointer
2692
2693 #if defined(CONFIG_OABI_COMPAT)
2694 diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
2695 index 1a0045a..9b4f34d 100644
2696 --- a/arch/arm/kernel/entry-header.S
2697 +++ b/arch/arm/kernel/entry-header.S
2698 @@ -196,6 +196,60 @@
2699 msr cpsr_c, \rtemp @ switch back to the SVC mode
2700 .endm
2701
2702 + .macro pax_enter_kernel_user
2703 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2704 + @ save regs
2705 + stmdb sp!, {r0, r1}
2706 + @ read DACR from cpu_domain into r1
2707 + mov r0, sp
2708 + @ assume 8K pages, since we have to split the immediate in two
2709 + bic r0, r0, #(0x1fc0)
2710 + bic r0, r0, #(0x3f)
2711 + ldr r1, [r0, #TI_CPU_DOMAIN]
2712 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2713 + @ set current DOMAIN_USER to DOMAIN_NOACCESS
2714 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2715 +#endif
2716 +#ifdef CONFIG_PAX_KERNEXEC
2717 + @ set current DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
2718 + bic r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
2719 + orr r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
2720 +#endif
2721 + @ write r1 to current_thread_info()->cpu_domain
2722 + str r1, [r0, #TI_CPU_DOMAIN]
2723 + @ write r1 to DACR
2724 + mcr p15, 0, r1, c3, c0, 0
2725 + @ instruction sync
2726 + instr_sync
2727 + @ restore regs
2728 + ldmia sp!, {r0, r1}
2729 +#endif
2730 + .endm
2731 +
2732 + .macro pax_exit_kernel
2733 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2734 + @ save regs
2735 + stmdb sp!, {r0, r1}
2736 + @ read old DACR from stack into r1
2737 + ldr r1, [sp, #(8 + S_SP)]
2738 + sub r1, r1, #8
2739 + ldr r1, [r1]
2740 +
2741 + @ write r1 to current_thread_info()->cpu_domain
2742 + mov r0, sp
2743 + @ assume 8K pages, since we have to split the immediate in two
2744 + bic r0, r0, #(0x1fc0)
2745 + bic r0, r0, #(0x3f)
2746 + str r1, [r0, #TI_CPU_DOMAIN]
2747 + @ write r1 to DACR
2748 + mcr p15, 0, r1, c3, c0, 0
2749 + @ instruction sync
2750 + instr_sync
2751 + @ restore regs
2752 + ldmia sp!, {r0, r1}
2753 +#endif
2754 + .endm
2755 +
2756 #ifndef CONFIG_THUMB2_KERNEL
2757 .macro svc_exit, rpsr, irq = 0
2758 .if \irq != 0
2759 @@ -215,6 +269,9 @@
2760 blne trace_hardirqs_off
2761 #endif
2762 .endif
2763 +
2764 + pax_exit_kernel
2765 +
2766 msr spsr_cxsf, \rpsr
2767 #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
2768 @ We must avoid clrex due to Cortex-A15 erratum #830321
2769 @@ -291,6 +348,9 @@
2770 blne trace_hardirqs_off
2771 #endif
2772 .endif
2773 +
2774 + pax_exit_kernel
2775 +
2776 ldr lr, [sp, #S_SP] @ top of the stack
2777 ldrd r0, r1, [sp, #S_LR] @ calling lr and pc
2778
2779 diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
2780 index 059c3da..8e45cfc 100644
2781 --- a/arch/arm/kernel/fiq.c
2782 +++ b/arch/arm/kernel/fiq.c
2783 @@ -95,7 +95,10 @@ void set_fiq_handler(void *start, unsigned int length)
2784 void *base = vectors_page;
2785 unsigned offset = FIQ_OFFSET;
2786
2787 + pax_open_kernel();
2788 memcpy(base + offset, start, length);
2789 + pax_close_kernel();
2790 +
2791 if (!cache_is_vipt_nonaliasing())
2792 flush_icache_range((unsigned long)base + offset, offset +
2793 length);
2794 diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
2795 index 3637973..cb29657 100644
2796 --- a/arch/arm/kernel/head.S
2797 +++ b/arch/arm/kernel/head.S
2798 @@ -444,7 +444,7 @@ __enable_mmu:
2799 mov r5, #(domain_val(DOMAIN_USER, DOMAIN_MANAGER) | \
2800 domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | \
2801 domain_val(DOMAIN_TABLE, DOMAIN_MANAGER) | \
2802 - domain_val(DOMAIN_IO, DOMAIN_CLIENT))
2803 + domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT))
2804 mcr p15, 0, r5, c3, c0, 0 @ load domain access register
2805 mcr p15, 0, r4, c2, c0, 0 @ load page table pointer
2806 #endif
2807 diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
2808 index af791f4..3ff9821 100644
2809 --- a/arch/arm/kernel/module.c
2810 +++ b/arch/arm/kernel/module.c
2811 @@ -38,12 +38,39 @@
2812 #endif
2813
2814 #ifdef CONFIG_MMU
2815 -void *module_alloc(unsigned long size)
2816 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
2817 {
2818 + if (!size || PAGE_ALIGN(size) > MODULES_END - MODULES_VADDR)
2819 + return NULL;
2820 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
2821 - GFP_KERNEL, PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
2822 + GFP_KERNEL, prot, 0, NUMA_NO_NODE,
2823 __builtin_return_address(0));
2824 }
2825 +
2826 +void *module_alloc(unsigned long size)
2827 +{
2828 +
2829 +#ifdef CONFIG_PAX_KERNEXEC
2830 + return __module_alloc(size, PAGE_KERNEL);
2831 +#else
2832 + return __module_alloc(size, PAGE_KERNEL_EXEC);
2833 +#endif
2834 +
2835 +}
2836 +
2837 +#ifdef CONFIG_PAX_KERNEXEC
2838 +void module_memfree_exec(void *module_region)
2839 +{
2840 + module_memfree(module_region);
2841 +}
2842 +EXPORT_SYMBOL(module_memfree_exec);
2843 +
2844 +void *module_alloc_exec(unsigned long size)
2845 +{
2846 + return __module_alloc(size, PAGE_KERNEL_EXEC);
2847 +}
2848 +EXPORT_SYMBOL(module_alloc_exec);
2849 +#endif
2850 #endif
2851
2852 int
2853 diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c
2854 index 69bda1a..755113a 100644
2855 --- a/arch/arm/kernel/patch.c
2856 +++ b/arch/arm/kernel/patch.c
2857 @@ -66,6 +66,7 @@ void __kprobes __patch_text_real(void *addr, unsigned int insn, bool remap)
2858 else
2859 __acquire(&patch_lock);
2860
2861 + pax_open_kernel();
2862 if (thumb2 && __opcode_is_thumb16(insn)) {
2863 *(u16 *)waddr = __opcode_to_mem_thumb16(insn);
2864 size = sizeof(u16);
2865 @@ -97,6 +98,7 @@ void __kprobes __patch_text_real(void *addr, unsigned int insn, bool remap)
2866 *(u32 *)waddr = insn;
2867 size = sizeof(u32);
2868 }
2869 + pax_close_kernel();
2870
2871 if (waddr != addr) {
2872 flush_kernel_vmap_range(waddr, twopage ? size / 2 : size);
2873 diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
2874 index f192a2a..1a40523 100644
2875 --- a/arch/arm/kernel/process.c
2876 +++ b/arch/arm/kernel/process.c
2877 @@ -105,8 +105,8 @@ void __show_regs(struct pt_regs *regs)
2878
2879 show_regs_print_info(KERN_DEFAULT);
2880
2881 - print_symbol("PC is at %s\n", instruction_pointer(regs));
2882 - print_symbol("LR is at %s\n", regs->ARM_lr);
2883 + printk("PC is at %pA\n", (void *)instruction_pointer(regs));
2884 + printk("LR is at %pA\n", (void *)regs->ARM_lr);
2885 printk("pc : [<%08lx>] lr : [<%08lx>] psr: %08lx\n"
2886 "sp : %08lx ip : %08lx fp : %08lx\n",
2887 regs->ARM_pc, regs->ARM_lr, regs->ARM_cpsr,
2888 @@ -283,12 +283,6 @@ unsigned long get_wchan(struct task_struct *p)
2889 return 0;
2890 }
2891
2892 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2893 -{
2894 - unsigned long range_end = mm->brk + 0x02000000;
2895 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
2896 -}
2897 -
2898 #ifdef CONFIG_MMU
2899 #ifdef CONFIG_KUSER_HELPERS
2900 /*
2901 @@ -304,7 +298,7 @@ static struct vm_area_struct gate_vma = {
2902
2903 static int __init gate_vma_init(void)
2904 {
2905 - gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
2906 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
2907 return 0;
2908 }
2909 arch_initcall(gate_vma_init);
2910 @@ -333,91 +327,13 @@ const char *arch_vma_name(struct vm_area_struct *vma)
2911 return is_gate_vma(vma) ? "[vectors]" : NULL;
2912 }
2913
2914 -/* If possible, provide a placement hint at a random offset from the
2915 - * stack for the sigpage and vdso pages.
2916 - */
2917 -static unsigned long sigpage_addr(const struct mm_struct *mm,
2918 - unsigned int npages)
2919 -{
2920 - unsigned long offset;
2921 - unsigned long first;
2922 - unsigned long last;
2923 - unsigned long addr;
2924 - unsigned int slots;
2925 -
2926 - first = PAGE_ALIGN(mm->start_stack);
2927 -
2928 - last = TASK_SIZE - (npages << PAGE_SHIFT);
2929 -
2930 - /* No room after stack? */
2931 - if (first > last)
2932 - return 0;
2933 -
2934 - /* Just enough room? */
2935 - if (first == last)
2936 - return first;
2937 -
2938 - slots = ((last - first) >> PAGE_SHIFT) + 1;
2939 -
2940 - offset = get_random_int() % slots;
2941 -
2942 - addr = first + (offset << PAGE_SHIFT);
2943 -
2944 - return addr;
2945 -}
2946 -
2947 -static struct page *signal_page;
2948 -extern struct page *get_signal_page(void);
2949 -
2950 -static const struct vm_special_mapping sigpage_mapping = {
2951 - .name = "[sigpage]",
2952 - .pages = &signal_page,
2953 -};
2954 -
2955 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2956 {
2957 struct mm_struct *mm = current->mm;
2958 - struct vm_area_struct *vma;
2959 - unsigned long npages;
2960 - unsigned long addr;
2961 - unsigned long hint;
2962 - int ret = 0;
2963 -
2964 - if (!signal_page)
2965 - signal_page = get_signal_page();
2966 - if (!signal_page)
2967 - return -ENOMEM;
2968 -
2969 - npages = 1; /* for sigpage */
2970 - npages += vdso_total_pages;
2971
2972 down_write(&mm->mmap_sem);
2973 - hint = sigpage_addr(mm, npages);
2974 - addr = get_unmapped_area(NULL, hint, npages << PAGE_SHIFT, 0, 0);
2975 - if (IS_ERR_VALUE(addr)) {
2976 - ret = addr;
2977 - goto up_fail;
2978 - }
2979 -
2980 - vma = _install_special_mapping(mm, addr, PAGE_SIZE,
2981 - VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
2982 - &sigpage_mapping);
2983 -
2984 - if (IS_ERR(vma)) {
2985 - ret = PTR_ERR(vma);
2986 - goto up_fail;
2987 - }
2988 -
2989 - mm->context.sigpage = addr;
2990 -
2991 - /* Unlike the sigpage, failure to install the vdso is unlikely
2992 - * to be fatal to the process, so no error check needed
2993 - * here.
2994 - */
2995 - arm_install_vdso(mm, addr + PAGE_SIZE);
2996 -
2997 - up_fail:
2998 + mm->context.sigpage = (PAGE_OFFSET + (get_random_int() % 0x3FFEFFE0)) & 0xFFFFFFFC;
2999 up_write(&mm->mmap_sem);
3000 - return ret;
3001 + return 0;
3002 }
3003 #endif
3004 diff --git a/arch/arm/kernel/psci.c b/arch/arm/kernel/psci.c
3005 index f90fdf4..24e8c84 100644
3006 --- a/arch/arm/kernel/psci.c
3007 +++ b/arch/arm/kernel/psci.c
3008 @@ -26,7 +26,7 @@
3009 #include <asm/psci.h>
3010 #include <asm/system_misc.h>
3011
3012 -struct psci_operations psci_ops;
3013 +struct psci_operations psci_ops __read_only;
3014
3015 static int (*invoke_psci_fn)(u32, u32, u32, u32);
3016 typedef int (*psci_initcall_t)(const struct device_node *);
3017 diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
3018 index ef9119f..31995a3 100644
3019 --- a/arch/arm/kernel/ptrace.c
3020 +++ b/arch/arm/kernel/ptrace.c
3021 @@ -928,10 +928,19 @@ static void tracehook_report_syscall(struct pt_regs *regs,
3022 regs->ARM_ip = ip;
3023 }
3024
3025 +#ifdef CONFIG_GRKERNSEC_SETXID
3026 +extern void gr_delayed_cred_worker(void);
3027 +#endif
3028 +
3029 asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
3030 {
3031 current_thread_info()->syscall = scno;
3032
3033 +#ifdef CONFIG_GRKERNSEC_SETXID
3034 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
3035 + gr_delayed_cred_worker();
3036 +#endif
3037 +
3038 /* Do the secure computing check first; failures should be fast. */
3039 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
3040 if (secure_computing() == -1)
3041 diff --git a/arch/arm/kernel/reboot.c b/arch/arm/kernel/reboot.c
3042 index 1a4d232..2677169 100644
3043 --- a/arch/arm/kernel/reboot.c
3044 +++ b/arch/arm/kernel/reboot.c
3045 @@ -122,6 +122,7 @@ void machine_power_off(void)
3046
3047 if (pm_power_off)
3048 pm_power_off();
3049 + while (1);
3050 }
3051
3052 /*
3053 diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
3054 index 6c777e9..3d2d0ca 100644
3055 --- a/arch/arm/kernel/setup.c
3056 +++ b/arch/arm/kernel/setup.c
3057 @@ -105,21 +105,23 @@ EXPORT_SYMBOL(elf_hwcap);
3058 unsigned int elf_hwcap2 __read_mostly;
3059 EXPORT_SYMBOL(elf_hwcap2);
3060
3061 +pteval_t __supported_pte_mask __read_only;
3062 +pmdval_t __supported_pmd_mask __read_only;
3063
3064 #ifdef MULTI_CPU
3065 -struct processor processor __read_mostly;
3066 +struct processor processor __read_only;
3067 #endif
3068 #ifdef MULTI_TLB
3069 -struct cpu_tlb_fns cpu_tlb __read_mostly;
3070 +struct cpu_tlb_fns cpu_tlb __read_only;
3071 #endif
3072 #ifdef MULTI_USER
3073 -struct cpu_user_fns cpu_user __read_mostly;
3074 +struct cpu_user_fns cpu_user __read_only;
3075 #endif
3076 #ifdef MULTI_CACHE
3077 -struct cpu_cache_fns cpu_cache __read_mostly;
3078 +struct cpu_cache_fns cpu_cache __read_only;
3079 #endif
3080 #ifdef CONFIG_OUTER_CACHE
3081 -struct outer_cache_fns outer_cache __read_mostly;
3082 +struct outer_cache_fns outer_cache __read_only;
3083 EXPORT_SYMBOL(outer_cache);
3084 #endif
3085
3086 @@ -250,9 +252,13 @@ static int __get_cpu_architecture(void)
3087 * Register 0 and check for VMSAv7 or PMSAv7 */
3088 unsigned int mmfr0 = read_cpuid_ext(CPUID_EXT_MMFR0);
3089 if ((mmfr0 & 0x0000000f) >= 0x00000003 ||
3090 - (mmfr0 & 0x000000f0) >= 0x00000030)
3091 + (mmfr0 & 0x000000f0) >= 0x00000030) {
3092 cpu_arch = CPU_ARCH_ARMv7;
3093 - else if ((mmfr0 & 0x0000000f) == 0x00000002 ||
3094 + if ((mmfr0 & 0x0000000f) == 0x00000005 || (mmfr0 & 0x0000000f) == 0x00000004) {
3095 + __supported_pte_mask |= L_PTE_PXN;
3096 + __supported_pmd_mask |= PMD_PXNTABLE;
3097 + }
3098 + } else if ((mmfr0 & 0x0000000f) == 0x00000002 ||
3099 (mmfr0 & 0x000000f0) == 0x00000020)
3100 cpu_arch = CPU_ARCH_ARMv6;
3101 else
3102 diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
3103 index 423663e..bfeb0ff 100644
3104 --- a/arch/arm/kernel/signal.c
3105 +++ b/arch/arm/kernel/signal.c
3106 @@ -24,8 +24,6 @@
3107
3108 extern const unsigned long sigreturn_codes[7];
3109
3110 -static unsigned long signal_return_offset;
3111 -
3112 #ifdef CONFIG_CRUNCH
3113 static int preserve_crunch_context(struct crunch_sigframe __user *frame)
3114 {
3115 @@ -385,8 +383,7 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
3116 * except when the MPU has protected the vectors
3117 * page from PL0
3118 */
3119 - retcode = mm->context.sigpage + signal_return_offset +
3120 - (idx << 2) + thumb;
3121 + retcode = mm->context.sigpage + (idx << 2) + thumb;
3122 } else
3123 #endif
3124 {
3125 @@ -592,33 +589,3 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
3126 } while (thread_flags & _TIF_WORK_MASK);
3127 return 0;
3128 }
3129 -
3130 -struct page *get_signal_page(void)
3131 -{
3132 - unsigned long ptr;
3133 - unsigned offset;
3134 - struct page *page;
3135 - void *addr;
3136 -
3137 - page = alloc_pages(GFP_KERNEL, 0);
3138 -
3139 - if (!page)
3140 - return NULL;
3141 -
3142 - addr = page_address(page);
3143 -
3144 - /* Give the signal return code some randomness */
3145 - offset = 0x200 + (get_random_int() & 0x7fc);
3146 - signal_return_offset = offset;
3147 -
3148 - /*
3149 - * Copy signal return handlers into the vector page, and
3150 - * set sigreturn to be a pointer to these.
3151 - */
3152 - memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
3153 -
3154 - ptr = (unsigned long)addr + offset;
3155 - flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
3156 -
3157 - return page;
3158 -}
3159 diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
3160 index cca5b87..68f0f73 100644
3161 --- a/arch/arm/kernel/smp.c
3162 +++ b/arch/arm/kernel/smp.c
3163 @@ -76,7 +76,7 @@ enum ipi_msg_type {
3164
3165 static DECLARE_COMPLETION(cpu_running);
3166
3167 -static struct smp_operations smp_ops;
3168 +static struct smp_operations smp_ops __read_only;
3169
3170 void __init smp_set_ops(struct smp_operations *ops)
3171 {
3172 diff --git a/arch/arm/kernel/tcm.c b/arch/arm/kernel/tcm.c
3173 index 7a3be1d..b00c7de 100644
3174 --- a/arch/arm/kernel/tcm.c
3175 +++ b/arch/arm/kernel/tcm.c
3176 @@ -61,7 +61,7 @@ static struct map_desc itcm_iomap[] __initdata = {
3177 .virtual = ITCM_OFFSET,
3178 .pfn = __phys_to_pfn(ITCM_OFFSET),
3179 .length = 0,
3180 - .type = MT_MEMORY_RWX_ITCM,
3181 + .type = MT_MEMORY_RX_ITCM,
3182 }
3183 };
3184
3185 @@ -267,7 +267,9 @@ no_dtcm:
3186 start = &__sitcm_text;
3187 end = &__eitcm_text;
3188 ram = &__itcm_start;
3189 + pax_open_kernel();
3190 memcpy(start, ram, itcm_code_sz);
3191 + pax_close_kernel();
3192 pr_debug("CPU ITCM: copied code from %p - %p\n",
3193 start, end);
3194 itcm_present = true;
3195 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
3196 index 3dce1a3..60e857f 100644
3197 --- a/arch/arm/kernel/traps.c
3198 +++ b/arch/arm/kernel/traps.c
3199 @@ -65,7 +65,7 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
3200 void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
3201 {
3202 #ifdef CONFIG_KALLSYMS
3203 - printk("[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", where, (void *)where, from, (void *)from);
3204 + printk("[<%08lx>] (%pA) from [<%08lx>] (%pA)\n", where, (void *)where, from, (void *)from);
3205 #else
3206 printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
3207 #endif
3208 @@ -267,6 +267,8 @@ static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED;
3209 static int die_owner = -1;
3210 static unsigned int die_nest_count;
3211
3212 +extern void gr_handle_kernel_exploit(void);
3213 +
3214 static unsigned long oops_begin(void)
3215 {
3216 int cpu;
3217 @@ -309,6 +311,9 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
3218 panic("Fatal exception in interrupt");
3219 if (panic_on_oops)
3220 panic("Fatal exception");
3221 +
3222 + gr_handle_kernel_exploit();
3223 +
3224 if (signr)
3225 do_exit(signr);
3226 }
3227 @@ -878,7 +883,11 @@ void __init early_trap_init(void *vectors_base)
3228 kuser_init(vectors_base);
3229
3230 flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
3231 - modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
3232 +
3233 +#ifndef CONFIG_PAX_MEMORY_UDEREF
3234 + modify_domain(DOMAIN_USER, DOMAIN_USERCLIENT);
3235 +#endif
3236 +
3237 #else /* ifndef CONFIG_CPU_V7M */
3238 /*
3239 * on V7-M there is no need to copy the vector table to a dedicated
3240 diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
3241 index 8b60fde..8d986dd 100644
3242 --- a/arch/arm/kernel/vmlinux.lds.S
3243 +++ b/arch/arm/kernel/vmlinux.lds.S
3244 @@ -37,7 +37,7 @@
3245 #endif
3246
3247 #if (defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)) || \
3248 - defined(CONFIG_GENERIC_BUG)
3249 + defined(CONFIG_GENERIC_BUG) || defined(CONFIG_PAX_REFCOUNT)
3250 #define ARM_EXIT_KEEP(x) x
3251 #define ARM_EXIT_DISCARD(x)
3252 #else
3253 @@ -120,6 +120,8 @@ SECTIONS
3254 #ifdef CONFIG_DEBUG_RODATA
3255 . = ALIGN(1<<SECTION_SHIFT);
3256 #endif
3257 + _etext = .; /* End of text section */
3258 +
3259 RO_DATA(PAGE_SIZE)
3260
3261 . = ALIGN(4);
3262 @@ -150,8 +152,6 @@ SECTIONS
3263
3264 NOTES
3265
3266 - _etext = .; /* End of text and rodata section */
3267 -
3268 #ifndef CONFIG_XIP_KERNEL
3269 # ifdef CONFIG_ARM_KERNMEM_PERMS
3270 . = ALIGN(1<<SECTION_SHIFT);
3271 diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
3272 index d9631ec..b0c966c 100644
3273 --- a/arch/arm/kvm/arm.c
3274 +++ b/arch/arm/kvm/arm.c
3275 @@ -57,7 +57,7 @@ static unsigned long hyp_default_vectors;
3276 static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
3277
3278 /* The VMID used in the VTTBR */
3279 -static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
3280 +static atomic64_unchecked_t kvm_vmid_gen = ATOMIC64_INIT(1);
3281 static u8 kvm_next_vmid;
3282 static DEFINE_SPINLOCK(kvm_vmid_lock);
3283
3284 @@ -373,7 +373,7 @@ void force_vm_exit(const cpumask_t *mask)
3285 */
3286 static bool need_new_vmid_gen(struct kvm *kvm)
3287 {
3288 - return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
3289 + return unlikely(kvm->arch.vmid_gen != atomic64_read_unchecked(&kvm_vmid_gen));
3290 }
3291
3292 /**
3293 @@ -406,7 +406,7 @@ static void update_vttbr(struct kvm *kvm)
3294
3295 /* First user of a new VMID generation? */
3296 if (unlikely(kvm_next_vmid == 0)) {
3297 - atomic64_inc(&kvm_vmid_gen);
3298 + atomic64_inc_unchecked(&kvm_vmid_gen);
3299 kvm_next_vmid = 1;
3300
3301 /*
3302 @@ -423,7 +423,7 @@ static void update_vttbr(struct kvm *kvm)
3303 kvm_call_hyp(__kvm_flush_vm_context);
3304 }
3305
3306 - kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
3307 + kvm->arch.vmid_gen = atomic64_read_unchecked(&kvm_vmid_gen);
3308 kvm->arch.vmid = kvm_next_vmid;
3309 kvm_next_vmid++;
3310
3311 @@ -1098,7 +1098,7 @@ struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr)
3312 /**
3313 * Initialize Hyp-mode and memory mappings on all CPUs.
3314 */
3315 -int kvm_arch_init(void *opaque)
3316 +int kvm_arch_init(const void *opaque)
3317 {
3318 int err;
3319 int ret, cpu;
3320 diff --git a/arch/arm/lib/clear_user.S b/arch/arm/lib/clear_user.S
3321 index 1710fd7..ec3e014 100644
3322 --- a/arch/arm/lib/clear_user.S
3323 +++ b/arch/arm/lib/clear_user.S
3324 @@ -12,14 +12,14 @@
3325
3326 .text
3327
3328 -/* Prototype: int __clear_user(void *addr, size_t sz)
3329 +/* Prototype: int ___clear_user(void *addr, size_t sz)
3330 * Purpose : clear some user memory
3331 * Params : addr - user memory address to clear
3332 * : sz - number of bytes to clear
3333 * Returns : number of bytes NOT cleared
3334 */
3335 ENTRY(__clear_user_std)
3336 -WEAK(__clear_user)
3337 +WEAK(___clear_user)
3338 stmfd sp!, {r1, lr}
3339 mov r2, #0
3340 cmp r1, #4
3341 @@ -44,7 +44,7 @@ WEAK(__clear_user)
3342 USER( strnebt r2, [r0])
3343 mov r0, #0
3344 ldmfd sp!, {r1, pc}
3345 -ENDPROC(__clear_user)
3346 +ENDPROC(___clear_user)
3347 ENDPROC(__clear_user_std)
3348
3349 .pushsection .text.fixup,"ax"
3350 diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
3351 index 7a235b9..73a0556 100644
3352 --- a/arch/arm/lib/copy_from_user.S
3353 +++ b/arch/arm/lib/copy_from_user.S
3354 @@ -17,7 +17,7 @@
3355 /*
3356 * Prototype:
3357 *
3358 - * size_t __copy_from_user(void *to, const void *from, size_t n)
3359 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
3360 *
3361 * Purpose:
3362 *
3363 @@ -89,11 +89,11 @@
3364
3365 .text
3366
3367 -ENTRY(__copy_from_user)
3368 +ENTRY(___copy_from_user)
3369
3370 #include "copy_template.S"
3371
3372 -ENDPROC(__copy_from_user)
3373 +ENDPROC(___copy_from_user)
3374
3375 .pushsection .fixup,"ax"
3376 .align 0
3377 diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
3378 index 6ee2f67..d1cce76 100644
3379 --- a/arch/arm/lib/copy_page.S
3380 +++ b/arch/arm/lib/copy_page.S
3381 @@ -10,6 +10,7 @@
3382 * ASM optimised string functions
3383 */
3384 #include <linux/linkage.h>
3385 +#include <linux/const.h>
3386 #include <asm/assembler.h>
3387 #include <asm/asm-offsets.h>
3388 #include <asm/cache.h>
3389 diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
3390 index 9648b06..19c333c 100644
3391 --- a/arch/arm/lib/copy_to_user.S
3392 +++ b/arch/arm/lib/copy_to_user.S
3393 @@ -17,7 +17,7 @@
3394 /*
3395 * Prototype:
3396 *
3397 - * size_t __copy_to_user(void *to, const void *from, size_t n)
3398 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
3399 *
3400 * Purpose:
3401 *
3402 @@ -93,11 +93,11 @@
3403 .text
3404
3405 ENTRY(__copy_to_user_std)
3406 -WEAK(__copy_to_user)
3407 +WEAK(___copy_to_user)
3408
3409 #include "copy_template.S"
3410
3411 -ENDPROC(__copy_to_user)
3412 +ENDPROC(___copy_to_user)
3413 ENDPROC(__copy_to_user_std)
3414
3415 .pushsection .text.fixup,"ax"
3416 diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
3417 index 1d0957e..f708846 100644
3418 --- a/arch/arm/lib/csumpartialcopyuser.S
3419 +++ b/arch/arm/lib/csumpartialcopyuser.S
3420 @@ -57,8 +57,8 @@
3421 * Returns : r0 = checksum, [[sp, #0], #0] = 0 or -EFAULT
3422 */
3423
3424 -#define FN_ENTRY ENTRY(csum_partial_copy_from_user)
3425 -#define FN_EXIT ENDPROC(csum_partial_copy_from_user)
3426 +#define FN_ENTRY ENTRY(__csum_partial_copy_from_user)
3427 +#define FN_EXIT ENDPROC(__csum_partial_copy_from_user)
3428
3429 #include "csumpartialcopygeneric.S"
3430
3431 diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
3432 index 8044591..c9b2609 100644
3433 --- a/arch/arm/lib/delay.c
3434 +++ b/arch/arm/lib/delay.c
3435 @@ -29,7 +29,7 @@
3436 /*
3437 * Default to the loop-based delay implementation.
3438 */
3439 -struct arm_delay_ops arm_delay_ops = {
3440 +struct arm_delay_ops arm_delay_ops __read_only = {
3441 .delay = __loop_delay,
3442 .const_udelay = __loop_const_udelay,
3443 .udelay = __loop_udelay,
3444 diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
3445 index 3e58d71..029817c 100644
3446 --- a/arch/arm/lib/uaccess_with_memcpy.c
3447 +++ b/arch/arm/lib/uaccess_with_memcpy.c
3448 @@ -136,7 +136,7 @@ out:
3449 }
3450
3451 unsigned long
3452 -__copy_to_user(void __user *to, const void *from, unsigned long n)
3453 +___copy_to_user(void __user *to, const void *from, unsigned long n)
3454 {
3455 /*
3456 * This test is stubbed out of the main function above to keep
3457 @@ -190,7 +190,7 @@ out:
3458 return n;
3459 }
3460
3461 -unsigned long __clear_user(void __user *addr, unsigned long n)
3462 +unsigned long ___clear_user(void __user *addr, unsigned long n)
3463 {
3464 /* See rational for this in __copy_to_user() above. */
3465 if (n < 64)
3466 diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
3467 index 7d23ce0..5ef383a 100644
3468 --- a/arch/arm/mach-exynos/suspend.c
3469 +++ b/arch/arm/mach-exynos/suspend.c
3470 @@ -738,8 +738,10 @@ void __init exynos_pm_init(void)
3471 tmp |= pm_data->wake_disable_mask;
3472 pmu_raw_writel(tmp, S5P_WAKEUP_MASK);
3473
3474 - exynos_pm_syscore_ops.suspend = pm_data->pm_suspend;
3475 - exynos_pm_syscore_ops.resume = pm_data->pm_resume;
3476 + pax_open_kernel();
3477 + *(void **)&exynos_pm_syscore_ops.suspend = pm_data->pm_suspend;
3478 + *(void **)&exynos_pm_syscore_ops.resume = pm_data->pm_resume;
3479 + pax_close_kernel();
3480
3481 register_syscore_ops(&exynos_pm_syscore_ops);
3482 suspend_set_ops(&exynos_suspend_ops);
3483 diff --git a/arch/arm/mach-keystone/keystone.c b/arch/arm/mach-keystone/keystone.c
3484 index 0662087..004d163 100644
3485 --- a/arch/arm/mach-keystone/keystone.c
3486 +++ b/arch/arm/mach-keystone/keystone.c
3487 @@ -27,7 +27,7 @@
3488
3489 #include "keystone.h"
3490
3491 -static struct notifier_block platform_nb;
3492 +static notifier_block_no_const platform_nb;
3493 static unsigned long keystone_dma_pfn_offset __read_mostly;
3494
3495 static int keystone_platform_notifier(struct notifier_block *nb,
3496 diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
3497 index e46e9ea..9141c83 100644
3498 --- a/arch/arm/mach-mvebu/coherency.c
3499 +++ b/arch/arm/mach-mvebu/coherency.c
3500 @@ -117,7 +117,7 @@ static void __init armada_370_coherency_init(struct device_node *np)
3501
3502 /*
3503 * This ioremap hook is used on Armada 375/38x to ensure that PCIe
3504 - * memory areas are mapped as MT_UNCACHED instead of MT_DEVICE. This
3505 + * memory areas are mapped as MT_UNCACHED_RW instead of MT_DEVICE. This
3506 * is needed as a workaround for a deadlock issue between the PCIe
3507 * interface and the cache controller.
3508 */
3509 @@ -130,7 +130,7 @@ armada_pcie_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
3510 mvebu_mbus_get_pcie_mem_aperture(&pcie_mem);
3511
3512 if (pcie_mem.start <= phys_addr && (phys_addr + size) <= pcie_mem.end)
3513 - mtype = MT_UNCACHED;
3514 + mtype = MT_UNCACHED_RW;
3515
3516 return __arm_ioremap_caller(phys_addr, size, mtype, caller);
3517 }
3518 diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
3519 index b6443a4..20a0b74 100644
3520 --- a/arch/arm/mach-omap2/board-n8x0.c
3521 +++ b/arch/arm/mach-omap2/board-n8x0.c
3522 @@ -569,7 +569,7 @@ static int n8x0_menelaus_late_init(struct device *dev)
3523 }
3524 #endif
3525
3526 -struct menelaus_platform_data n8x0_menelaus_platform_data __initdata = {
3527 +struct menelaus_platform_data n8x0_menelaus_platform_data __initconst = {
3528 .late_init = n8x0_menelaus_late_init,
3529 };
3530
3531 diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
3532 index 79f49d9..70bf184 100644
3533 --- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
3534 +++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
3535 @@ -86,7 +86,7 @@ struct cpu_pm_ops {
3536 void (*resume)(void);
3537 void (*scu_prepare)(unsigned int cpu_id, unsigned int cpu_state);
3538 void (*hotplug_restart)(void);
3539 -};
3540 +} __no_const;
3541
3542 static DEFINE_PER_CPU(struct omap4_cpu_pm_info, omap4_pm_info);
3543 static struct powerdomain *mpuss_pd;
3544 @@ -105,7 +105,7 @@ static void dummy_cpu_resume(void)
3545 static void dummy_scu_prepare(unsigned int cpu_id, unsigned int cpu_state)
3546 {}
3547
3548 -struct cpu_pm_ops omap_pm_ops = {
3549 +static struct cpu_pm_ops omap_pm_ops __read_only = {
3550 .finish_suspend = default_finish_suspend,
3551 .resume = dummy_cpu_resume,
3552 .scu_prepare = dummy_scu_prepare,
3553 diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
3554 index 5305ec7..6d74045 100644
3555 --- a/arch/arm/mach-omap2/omap-smp.c
3556 +++ b/arch/arm/mach-omap2/omap-smp.c
3557 @@ -19,6 +19,7 @@
3558 #include <linux/device.h>
3559 #include <linux/smp.h>
3560 #include <linux/io.h>
3561 +#include <linux/irq.h>
3562 #include <linux/irqchip/arm-gic.h>
3563
3564 #include <asm/smp_scu.h>
3565 diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
3566 index 3b56722..33ac281 100644
3567 --- a/arch/arm/mach-omap2/omap-wakeupgen.c
3568 +++ b/arch/arm/mach-omap2/omap-wakeupgen.c
3569 @@ -330,7 +330,7 @@ static int irq_cpu_hotplug_notify(struct notifier_block *self,
3570 return NOTIFY_OK;
3571 }
3572
3573 -static struct notifier_block __refdata irq_hotplug_notifier = {
3574 +static struct notifier_block irq_hotplug_notifier = {
3575 .notifier_call = irq_cpu_hotplug_notify,
3576 };
3577
3578 diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
3579 index 166b18f..f985f04 100644
3580 --- a/arch/arm/mach-omap2/omap_device.c
3581 +++ b/arch/arm/mach-omap2/omap_device.c
3582 @@ -510,7 +510,7 @@ void omap_device_delete(struct omap_device *od)
3583 struct platform_device __init *omap_device_build(const char *pdev_name,
3584 int pdev_id,
3585 struct omap_hwmod *oh,
3586 - void *pdata, int pdata_len)
3587 + const void *pdata, int pdata_len)
3588 {
3589 struct omap_hwmod *ohs[] = { oh };
3590
3591 @@ -538,7 +538,7 @@ struct platform_device __init *omap_device_build(const char *pdev_name,
3592 struct platform_device __init *omap_device_build_ss(const char *pdev_name,
3593 int pdev_id,
3594 struct omap_hwmod **ohs,
3595 - int oh_cnt, void *pdata,
3596 + int oh_cnt, const void *pdata,
3597 int pdata_len)
3598 {
3599 int ret = -ENOMEM;
3600 diff --git a/arch/arm/mach-omap2/omap_device.h b/arch/arm/mach-omap2/omap_device.h
3601 index 78c02b3..c94109a 100644
3602 --- a/arch/arm/mach-omap2/omap_device.h
3603 +++ b/arch/arm/mach-omap2/omap_device.h
3604 @@ -72,12 +72,12 @@ int omap_device_idle(struct platform_device *pdev);
3605 /* Core code interface */
3606
3607 struct platform_device *omap_device_build(const char *pdev_name, int pdev_id,
3608 - struct omap_hwmod *oh, void *pdata,
3609 + struct omap_hwmod *oh, const void *pdata,
3610 int pdata_len);
3611
3612 struct platform_device *omap_device_build_ss(const char *pdev_name, int pdev_id,
3613 struct omap_hwmod **oh, int oh_cnt,
3614 - void *pdata, int pdata_len);
3615 + const void *pdata, int pdata_len);
3616
3617 struct omap_device *omap_device_alloc(struct platform_device *pdev,
3618 struct omap_hwmod **ohs, int oh_cnt);
3619 diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
3620 index 752969f..a34b446 100644
3621 --- a/arch/arm/mach-omap2/omap_hwmod.c
3622 +++ b/arch/arm/mach-omap2/omap_hwmod.c
3623 @@ -199,10 +199,10 @@ struct omap_hwmod_soc_ops {
3624 int (*init_clkdm)(struct omap_hwmod *oh);
3625 void (*update_context_lost)(struct omap_hwmod *oh);
3626 int (*get_context_lost)(struct omap_hwmod *oh);
3627 -};
3628 +} __no_const;
3629
3630 /* soc_ops: adapts the omap_hwmod code to the currently-booted SoC */
3631 -static struct omap_hwmod_soc_ops soc_ops;
3632 +static struct omap_hwmod_soc_ops soc_ops __read_only;
3633
3634 /* omap_hwmod_list contains all registered struct omap_hwmods */
3635 static LIST_HEAD(omap_hwmod_list);
3636 diff --git a/arch/arm/mach-omap2/powerdomains43xx_data.c b/arch/arm/mach-omap2/powerdomains43xx_data.c
3637 index 95fee54..cfa9cf1 100644
3638 --- a/arch/arm/mach-omap2/powerdomains43xx_data.c
3639 +++ b/arch/arm/mach-omap2/powerdomains43xx_data.c
3640 @@ -10,6 +10,7 @@
3641
3642 #include <linux/kernel.h>
3643 #include <linux/init.h>
3644 +#include <asm/pgtable.h>
3645
3646 #include "powerdomain.h"
3647
3648 @@ -129,7 +130,9 @@ static int am43xx_check_vcvp(void)
3649
3650 void __init am43xx_powerdomains_init(void)
3651 {
3652 - omap4_pwrdm_operations.pwrdm_has_voltdm = am43xx_check_vcvp;
3653 + pax_open_kernel();
3654 + *(void **)&omap4_pwrdm_operations.pwrdm_has_voltdm = am43xx_check_vcvp;
3655 + pax_close_kernel();
3656 pwrdm_register_platform_funcs(&omap4_pwrdm_operations);
3657 pwrdm_register_pwrdms(powerdomains_am43xx);
3658 pwrdm_complete_init();
3659 diff --git a/arch/arm/mach-omap2/wd_timer.c b/arch/arm/mach-omap2/wd_timer.c
3660 index ff0a68c..b312aa0 100644
3661 --- a/arch/arm/mach-omap2/wd_timer.c
3662 +++ b/arch/arm/mach-omap2/wd_timer.c
3663 @@ -110,7 +110,9 @@ static int __init omap_init_wdt(void)
3664 struct omap_hwmod *oh;
3665 char *oh_name = "wd_timer2";
3666 char *dev_name = "omap_wdt";
3667 - struct omap_wd_timer_platform_data pdata;
3668 + static struct omap_wd_timer_platform_data pdata = {
3669 + .read_reset_sources = prm_read_reset_sources
3670 + };
3671
3672 if (!cpu_class_is_omap2() || of_have_populated_dt())
3673 return 0;
3674 @@ -121,8 +123,6 @@ static int __init omap_init_wdt(void)
3675 return -EINVAL;
3676 }
3677
3678 - pdata.read_reset_sources = prm_read_reset_sources;
3679 -
3680 pdev = omap_device_build(dev_name, id, oh, &pdata,
3681 sizeof(struct omap_wd_timer_platform_data));
3682 WARN(IS_ERR(pdev), "Can't build omap_device for %s:%s.\n",
3683 diff --git a/arch/arm/mach-tegra/cpuidle-tegra20.c b/arch/arm/mach-tegra/cpuidle-tegra20.c
3684 index 7469347..1ecc350 100644
3685 --- a/arch/arm/mach-tegra/cpuidle-tegra20.c
3686 +++ b/arch/arm/mach-tegra/cpuidle-tegra20.c
3687 @@ -177,7 +177,7 @@ static int tegra20_idle_lp2_coupled(struct cpuidle_device *dev,
3688 bool entered_lp2 = false;
3689
3690 if (tegra_pending_sgi())
3691 - ACCESS_ONCE(abort_flag) = true;
3692 + ACCESS_ONCE_RW(abort_flag) = true;
3693
3694 cpuidle_coupled_parallel_barrier(dev, &abort_barrier);
3695
3696 diff --git a/arch/arm/mach-tegra/irq.c b/arch/arm/mach-tegra/irq.c
3697 index 3b9098d..15b390f 100644
3698 --- a/arch/arm/mach-tegra/irq.c
3699 +++ b/arch/arm/mach-tegra/irq.c
3700 @@ -20,6 +20,7 @@
3701 #include <linux/cpu_pm.h>
3702 #include <linux/interrupt.h>
3703 #include <linux/io.h>
3704 +#include <linux/irq.h>
3705 #include <linux/irqchip/arm-gic.h>
3706 #include <linux/irq.h>
3707 #include <linux/kernel.h>
3708 diff --git a/arch/arm/mach-ux500/pm.c b/arch/arm/mach-ux500/pm.c
3709 index 2cb587b..6ddfebf 100644
3710 --- a/arch/arm/mach-ux500/pm.c
3711 +++ b/arch/arm/mach-ux500/pm.c
3712 @@ -10,6 +10,7 @@
3713 */
3714
3715 #include <linux/kernel.h>
3716 +#include <linux/irq.h>
3717 #include <linux/irqchip/arm-gic.h>
3718 #include <linux/delay.h>
3719 #include <linux/io.h>
3720 diff --git a/arch/arm/mach-ux500/setup.h b/arch/arm/mach-ux500/setup.h
3721 index 2dea8b5..6499da2 100644
3722 --- a/arch/arm/mach-ux500/setup.h
3723 +++ b/arch/arm/mach-ux500/setup.h
3724 @@ -33,13 +33,6 @@ extern void ux500_timer_init(void);
3725 .type = MT_DEVICE, \
3726 }
3727
3728 -#define __MEM_DEV_DESC(x, sz) { \
3729 - .virtual = IO_ADDRESS(x), \
3730 - .pfn = __phys_to_pfn(x), \
3731 - .length = sz, \
3732 - .type = MT_MEMORY_RWX, \
3733 -}
3734 -
3735 extern struct smp_operations ux500_smp_ops;
3736 extern void ux500_cpu_die(unsigned int cpu);
3737
3738 diff --git a/arch/arm/mach-zynq/platsmp.c b/arch/arm/mach-zynq/platsmp.c
3739 index 52d768f..5f93180 100644
3740 --- a/arch/arm/mach-zynq/platsmp.c
3741 +++ b/arch/arm/mach-zynq/platsmp.c
3742 @@ -24,6 +24,7 @@
3743 #include <linux/io.h>
3744 #include <asm/cacheflush.h>
3745 #include <asm/smp_scu.h>
3746 +#include <linux/irq.h>
3747 #include <linux/irqchip/arm-gic.h>
3748 #include "common.h"
3749
3750 diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
3751 index b4f92b9..ffefea9 100644
3752 --- a/arch/arm/mm/Kconfig
3753 +++ b/arch/arm/mm/Kconfig
3754 @@ -446,6 +446,7 @@ config CPU_32v5
3755
3756 config CPU_32v6
3757 bool
3758 + select CPU_USE_DOMAINS if CPU_V6 && MMU && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
3759 select TLS_REG_EMUL if !CPU_32v6K && !MMU
3760
3761 config CPU_32v6K
3762 @@ -600,6 +601,7 @@ config CPU_CP15_MPU
3763
3764 config CPU_USE_DOMAINS
3765 bool
3766 + depends on !ARM_LPAE && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
3767 help
3768 This option enables or disables the use of domain switching
3769 via the set_fs() function.
3770 @@ -798,7 +800,7 @@ config NEED_KUSER_HELPERS
3771
3772 config KUSER_HELPERS
3773 bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
3774 - depends on MMU
3775 + depends on MMU && (!(CPU_V6 || CPU_V6K || CPU_V7) || GRKERNSEC_OLD_ARM_USERLAND)
3776 default y
3777 help
3778 Warning: disabling this option may break user programs.
3779 @@ -812,7 +814,7 @@ config KUSER_HELPERS
3780 See Documentation/arm/kernel_user_helpers.txt for details.
3781
3782 However, the fixed address nature of these helpers can be used
3783 - by ROP (return orientated programming) authors when creating
3784 + by ROP (Return Oriented Programming) authors when creating
3785 exploits.
3786
3787 If all of the binaries and libraries which run on your platform
3788 diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
3789 index 9769f1e..16aaa55 100644
3790 --- a/arch/arm/mm/alignment.c
3791 +++ b/arch/arm/mm/alignment.c
3792 @@ -216,10 +216,12 @@ union offset_union {
3793 #define __get16_unaligned_check(ins,val,addr) \
3794 do { \
3795 unsigned int err = 0, v, a = addr; \
3796 + pax_open_userland(); \
3797 __get8_unaligned_check(ins,v,a,err); \
3798 val = v << ((BE) ? 8 : 0); \
3799 __get8_unaligned_check(ins,v,a,err); \
3800 val |= v << ((BE) ? 0 : 8); \
3801 + pax_close_userland(); \
3802 if (err) \
3803 goto fault; \
3804 } while (0)
3805 @@ -233,6 +235,7 @@ union offset_union {
3806 #define __get32_unaligned_check(ins,val,addr) \
3807 do { \
3808 unsigned int err = 0, v, a = addr; \
3809 + pax_open_userland(); \
3810 __get8_unaligned_check(ins,v,a,err); \
3811 val = v << ((BE) ? 24 : 0); \
3812 __get8_unaligned_check(ins,v,a,err); \
3813 @@ -241,6 +244,7 @@ union offset_union {
3814 val |= v << ((BE) ? 8 : 16); \
3815 __get8_unaligned_check(ins,v,a,err); \
3816 val |= v << ((BE) ? 0 : 24); \
3817 + pax_close_userland(); \
3818 if (err) \
3819 goto fault; \
3820 } while (0)
3821 @@ -254,6 +258,7 @@ union offset_union {
3822 #define __put16_unaligned_check(ins,val,addr) \
3823 do { \
3824 unsigned int err = 0, v = val, a = addr; \
3825 + pax_open_userland(); \
3826 __asm__( FIRST_BYTE_16 \
3827 ARM( "1: "ins" %1, [%2], #1\n" ) \
3828 THUMB( "1: "ins" %1, [%2]\n" ) \
3829 @@ -273,6 +278,7 @@ union offset_union {
3830 " .popsection\n" \
3831 : "=r" (err), "=&r" (v), "=&r" (a) \
3832 : "0" (err), "1" (v), "2" (a)); \
3833 + pax_close_userland(); \
3834 if (err) \
3835 goto fault; \
3836 } while (0)
3837 @@ -286,6 +292,7 @@ union offset_union {
3838 #define __put32_unaligned_check(ins,val,addr) \
3839 do { \
3840 unsigned int err = 0, v = val, a = addr; \
3841 + pax_open_userland(); \
3842 __asm__( FIRST_BYTE_32 \
3843 ARM( "1: "ins" %1, [%2], #1\n" ) \
3844 THUMB( "1: "ins" %1, [%2]\n" ) \
3845 @@ -315,6 +322,7 @@ union offset_union {
3846 " .popsection\n" \
3847 : "=r" (err), "=&r" (v), "=&r" (a) \
3848 : "0" (err), "1" (v), "2" (a)); \
3849 + pax_close_userland(); \
3850 if (err) \
3851 goto fault; \
3852 } while (0)
3853 diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
3854 index e309c8f..f8965e8 100644
3855 --- a/arch/arm/mm/cache-l2x0.c
3856 +++ b/arch/arm/mm/cache-l2x0.c
3857 @@ -43,7 +43,7 @@ struct l2c_init_data {
3858 void (*save)(void __iomem *);
3859 void (*configure)(void __iomem *);
3860 struct outer_cache_fns outer_cache;
3861 -};
3862 +} __do_const;
3863
3864 #define CACHE_LINE_SIZE 32
3865
3866 diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
3867 index 845769e..4278fd7 100644
3868 --- a/arch/arm/mm/context.c
3869 +++ b/arch/arm/mm/context.c
3870 @@ -43,7 +43,7 @@
3871 #define NUM_USER_ASIDS ASID_FIRST_VERSION
3872
3873 static DEFINE_RAW_SPINLOCK(cpu_asid_lock);
3874 -static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
3875 +static atomic64_unchecked_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
3876 static DECLARE_BITMAP(asid_map, NUM_USER_ASIDS);
3877
3878 static DEFINE_PER_CPU(atomic64_t, active_asids);
3879 @@ -178,7 +178,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
3880 {
3881 static u32 cur_idx = 1;
3882 u64 asid = atomic64_read(&mm->context.id);
3883 - u64 generation = atomic64_read(&asid_generation);
3884 + u64 generation = atomic64_read_unchecked(&asid_generation);
3885
3886 if (asid != 0) {
3887 /*
3888 @@ -208,7 +208,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
3889 */
3890 asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, cur_idx);
3891 if (asid == NUM_USER_ASIDS) {
3892 - generation = atomic64_add_return(ASID_FIRST_VERSION,
3893 + generation = atomic64_add_return_unchecked(ASID_FIRST_VERSION,
3894 &asid_generation);
3895 flush_context(cpu);
3896 asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
3897 @@ -240,14 +240,14 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
3898 cpu_set_reserved_ttbr0();
3899
3900 asid = atomic64_read(&mm->context.id);
3901 - if (!((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS)
3902 + if (!((asid ^ atomic64_read_unchecked(&asid_generation)) >> ASID_BITS)
3903 && atomic64_xchg(&per_cpu(active_asids, cpu), asid))
3904 goto switch_mm_fastpath;
3905
3906 raw_spin_lock_irqsave(&cpu_asid_lock, flags);
3907 /* Check that our ASID belongs to the current generation. */
3908 asid = atomic64_read(&mm->context.id);
3909 - if ((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS) {
3910 + if ((asid ^ atomic64_read_unchecked(&asid_generation)) >> ASID_BITS) {
3911 asid = new_context(mm, cpu);
3912 atomic64_set(&mm->context.id, asid);
3913 }
3914 diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
3915 index 6333d9c..3bb19f2 100644
3916 --- a/arch/arm/mm/fault.c
3917 +++ b/arch/arm/mm/fault.c
3918 @@ -25,6 +25,7 @@
3919 #include <asm/system_misc.h>
3920 #include <asm/system_info.h>
3921 #include <asm/tlbflush.h>
3922 +#include <asm/sections.h>
3923
3924 #include "fault.h"
3925
3926 @@ -138,6 +139,31 @@ __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
3927 if (fixup_exception(regs))
3928 return;
3929
3930 +#ifdef CONFIG_PAX_MEMORY_UDEREF
3931 + if (addr < TASK_SIZE) {
3932 + if (current->signal->curr_ip)
3933 + printk(KERN_EMERG "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
3934 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
3935 + else
3936 + printk(KERN_EMERG "PAX: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", current->comm, task_pid_nr(current),
3937 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
3938 + }
3939 +#endif
3940 +
3941 +#ifdef CONFIG_PAX_KERNEXEC
3942 + if ((fsr & FSR_WRITE) &&
3943 + (((unsigned long)_stext <= addr && addr < init_mm.end_code) ||
3944 + (MODULES_VADDR <= addr && addr < MODULES_END)))
3945 + {
3946 + if (current->signal->curr_ip)
3947 + printk(KERN_EMERG "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
3948 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
3949 + else
3950 + printk(KERN_EMERG "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", current->comm, task_pid_nr(current),
3951 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
3952 + }
3953 +#endif
3954 +
3955 /*
3956 * No handler, we'll have to terminate things with extreme prejudice.
3957 */
3958 @@ -173,6 +199,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
3959 }
3960 #endif
3961
3962 +#ifdef CONFIG_PAX_PAGEEXEC
3963 + if (fsr & FSR_LNX_PF) {
3964 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
3965 + do_group_exit(SIGKILL);
3966 + }
3967 +#endif
3968 +
3969 tsk->thread.address = addr;
3970 tsk->thread.error_code = fsr;
3971 tsk->thread.trap_no = 14;
3972 @@ -400,6 +433,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
3973 }
3974 #endif /* CONFIG_MMU */
3975
3976 +#ifdef CONFIG_PAX_PAGEEXEC
3977 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
3978 +{
3979 + long i;
3980 +
3981 + printk(KERN_ERR "PAX: bytes at PC: ");
3982 + for (i = 0; i < 20; i++) {
3983 + unsigned char c;
3984 + if (get_user(c, (__force unsigned char __user *)pc+i))
3985 + printk(KERN_CONT "?? ");
3986 + else
3987 + printk(KERN_CONT "%02x ", c);
3988 + }
3989 + printk("\n");
3990 +
3991 + printk(KERN_ERR "PAX: bytes at SP-4: ");
3992 + for (i = -1; i < 20; i++) {
3993 + unsigned long c;
3994 + if (get_user(c, (__force unsigned long __user *)sp+i))
3995 + printk(KERN_CONT "???????? ");
3996 + else
3997 + printk(KERN_CONT "%08lx ", c);
3998 + }
3999 + printk("\n");
4000 +}
4001 +#endif
4002 +
4003 /*
4004 * First Level Translation Fault Handler
4005 *
4006 @@ -547,9 +607,22 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
4007 const struct fsr_info *inf = fsr_info + fsr_fs(fsr);
4008 struct siginfo info;
4009
4010 +#ifdef CONFIG_PAX_MEMORY_UDEREF
4011 + if (addr < TASK_SIZE && is_domain_fault(fsr)) {
4012 + if (current->signal->curr_ip)
4013 + printk(KERN_EMERG "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
4014 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
4015 + else
4016 + printk(KERN_EMERG "PAX: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", current->comm, task_pid_nr(current),
4017 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
4018 + goto die;
4019 + }
4020 +#endif
4021 +
4022 if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs))
4023 return;
4024
4025 +die:
4026 pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
4027 inf->name, fsr, addr);
4028 show_pte(current->mm, addr);
4029 @@ -574,15 +647,104 @@ hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *
4030 ifsr_info[nr].name = name;
4031 }
4032
4033 +asmlinkage int sys_sigreturn(struct pt_regs *regs);
4034 +asmlinkage int sys_rt_sigreturn(struct pt_regs *regs);
4035 +
4036 asmlinkage void __exception
4037 do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
4038 {
4039 const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
4040 struct siginfo info;
4041 + unsigned long pc = instruction_pointer(regs);
4042 +
4043 + if (user_mode(regs)) {
4044 + unsigned long sigpage = current->mm->context.sigpage;
4045 +
4046 + if (sigpage <= pc && pc < sigpage + 7*4) {
4047 + if (pc < sigpage + 3*4)
4048 + sys_sigreturn(regs);
4049 + else
4050 + sys_rt_sigreturn(regs);
4051 + return;
4052 + }
4053 + if (pc == 0xffff0f60UL) {
4054 + /*
4055 + * PaX: __kuser_cmpxchg64 emulation
4056 + */
4057 + // TODO
4058 + //regs->ARM_pc = regs->ARM_lr;
4059 + //return;
4060 + }
4061 + if (pc == 0xffff0fa0UL) {
4062 + /*
4063 + * PaX: __kuser_memory_barrier emulation
4064 + */
4065 + // dmb(); implied by the exception
4066 + regs->ARM_pc = regs->ARM_lr;
4067 + return;
4068 + }
4069 + if (pc == 0xffff0fc0UL) {
4070 + /*
4071 + * PaX: __kuser_cmpxchg emulation
4072 + */
4073 + // TODO
4074 + //long new;
4075 + //int op;
4076 +
4077 + //op = FUTEX_OP_SET << 28;
4078 + //new = futex_atomic_op_inuser(op, regs->ARM_r2);
4079 + //regs->ARM_r0 = old != new;
4080 + //regs->ARM_pc = regs->ARM_lr;
4081 + //return;
4082 + }
4083 + if (pc == 0xffff0fe0UL) {
4084 + /*
4085 + * PaX: __kuser_get_tls emulation
4086 + */
4087 + regs->ARM_r0 = current_thread_info()->tp_value[0];
4088 + regs->ARM_pc = regs->ARM_lr;
4089 + return;
4090 + }
4091 + }
4092 +
4093 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
4094 + else if (is_domain_fault(ifsr) || is_xn_fault(ifsr)) {
4095 + if (current->signal->curr_ip)
4096 + printk(KERN_EMERG "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to execute %s memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
4097 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()),
4098 + pc >= TASK_SIZE ? "non-executable kernel" : "userland", pc);
4099 + else
4100 + printk(KERN_EMERG "PAX: %s:%d, uid/euid: %u/%u, attempted to execute %s memory at %08lx\n", current->comm, task_pid_nr(current),
4101 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()),
4102 + pc >= TASK_SIZE ? "non-executable kernel" : "userland", pc);
4103 + goto die;
4104 + }
4105 +#endif
4106 +
4107 +#ifdef CONFIG_PAX_REFCOUNT
4108 + if (fsr_fs(ifsr) == FAULT_CODE_DEBUG) {
4109 +#ifdef CONFIG_THUMB2_KERNEL
4110 + unsigned short bkpt;
4111 +
4112 + if (!probe_kernel_address(pc, bkpt) && cpu_to_le16(bkpt) == 0xbef1) {
4113 +#else
4114 + unsigned int bkpt;
4115 +
4116 + if (!probe_kernel_address(pc, bkpt) && cpu_to_le32(bkpt) == 0xe12f1073) {
4117 +#endif
4118 + current->thread.error_code = ifsr;
4119 + current->thread.trap_no = 0;
4120 + pax_report_refcount_overflow(regs);
4121 + fixup_exception(regs);
4122 + return;
4123 + }
4124 + }
4125 +#endif
4126
4127 if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
4128 return;
4129
4130 +die:
4131 pr_alert("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
4132 inf->name, ifsr, addr);
4133
4134 diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
4135 index cf08bdf..772656c 100644
4136 --- a/arch/arm/mm/fault.h
4137 +++ b/arch/arm/mm/fault.h
4138 @@ -3,6 +3,7 @@
4139
4140 /*
4141 * Fault status register encodings. We steal bit 31 for our own purposes.
4142 + * Set when the FSR value is from an instruction fault.
4143 */
4144 #define FSR_LNX_PF (1 << 31)
4145 #define FSR_WRITE (1 << 11)
4146 @@ -22,6 +23,17 @@ static inline int fsr_fs(unsigned int fsr)
4147 }
4148 #endif
4149
4150 +/* valid for LPAE and !LPAE */
4151 +static inline int is_xn_fault(unsigned int fsr)
4152 +{
4153 + return ((fsr_fs(fsr) & 0x3c) == 0xc);
4154 +}
4155 +
4156 +static inline int is_domain_fault(unsigned int fsr)
4157 +{
4158 + return ((fsr_fs(fsr) & 0xD) == 0x9);
4159 +}
4160 +
4161 void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
4162 unsigned long search_exception_table(unsigned long addr);
4163
4164 diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
4165 index be92fa0..5252d7e 100644
4166 --- a/arch/arm/mm/init.c
4167 +++ b/arch/arm/mm/init.c
4168 @@ -709,7 +709,46 @@ void free_tcmmem(void)
4169 {
4170 #ifdef CONFIG_HAVE_TCM
4171 extern char __tcm_start, __tcm_end;
4172 +#endif
4173
4174 +#ifdef CONFIG_PAX_KERNEXEC
4175 + unsigned long addr;
4176 + pgd_t *pgd;
4177 + pud_t *pud;
4178 + pmd_t *pmd;
4179 + int cpu_arch = cpu_architecture();
4180 + unsigned int cr = get_cr();
4181 +
4182 + if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) {
4183 + /* make pages tables, etc before .text NX */
4184 + for (addr = PAGE_OFFSET; addr < (unsigned long)_stext; addr += SECTION_SIZE) {
4185 + pgd = pgd_offset_k(addr);
4186 + pud = pud_offset(pgd, addr);
4187 + pmd = pmd_offset(pud, addr);
4188 + __section_update(pmd, addr, PMD_SECT_XN);
4189 + }
4190 + /* make init NX */
4191 + for (addr = (unsigned long)__init_begin; addr < (unsigned long)_sdata; addr += SECTION_SIZE) {
4192 + pgd = pgd_offset_k(addr);
4193 + pud = pud_offset(pgd, addr);
4194 + pmd = pmd_offset(pud, addr);
4195 + __section_update(pmd, addr, PMD_SECT_XN);
4196 + }
4197 + /* make kernel code/rodata RX */
4198 + for (addr = (unsigned long)_stext; addr < (unsigned long)__init_begin; addr += SECTION_SIZE) {
4199 + pgd = pgd_offset_k(addr);
4200 + pud = pud_offset(pgd, addr);
4201 + pmd = pmd_offset(pud, addr);
4202 +#ifdef CONFIG_ARM_LPAE
4203 + __section_update(pmd, addr, PMD_SECT_RDONLY);
4204 +#else
4205 + __section_update(pmd, addr, PMD_SECT_APX|PMD_SECT_AP_WRITE);
4206 +#endif
4207 + }
4208 + }
4209 +#endif
4210 +
4211 +#ifdef CONFIG_HAVE_TCM
4212 poison_init_mem(&__tcm_start, &__tcm_end - &__tcm_start);
4213 free_reserved_area(&__tcm_start, &__tcm_end, -1, "TCM link");
4214 #endif
4215 diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
4216 index d1e5ad7..84dcbf2 100644
4217 --- a/arch/arm/mm/ioremap.c
4218 +++ b/arch/arm/mm/ioremap.c
4219 @@ -392,9 +392,9 @@ __arm_ioremap_exec(phys_addr_t phys_addr, size_t size, bool cached)
4220 unsigned int mtype;
4221
4222 if (cached)
4223 - mtype = MT_MEMORY_RWX;
4224 + mtype = MT_MEMORY_RX;
4225 else
4226 - mtype = MT_MEMORY_RWX_NONCACHED;
4227 + mtype = MT_MEMORY_RX_NONCACHED;
4228
4229 return __arm_ioremap_caller(phys_addr, size, mtype,
4230 __builtin_return_address(0));
4231 diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
4232 index 407dc78..047ce9d 100644
4233 --- a/arch/arm/mm/mmap.c
4234 +++ b/arch/arm/mm/mmap.c
4235 @@ -59,6 +59,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4236 struct vm_area_struct *vma;
4237 int do_align = 0;
4238 int aliasing = cache_is_vipt_aliasing();
4239 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
4240 struct vm_unmapped_area_info info;
4241
4242 /*
4243 @@ -81,6 +82,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4244 if (len > TASK_SIZE)
4245 return -ENOMEM;
4246
4247 +#ifdef CONFIG_PAX_RANDMMAP
4248 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4249 +#endif
4250 +
4251 if (addr) {
4252 if (do_align)
4253 addr = COLOUR_ALIGN(addr, pgoff);
4254 @@ -88,8 +93,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4255 addr = PAGE_ALIGN(addr);
4256
4257 vma = find_vma(mm, addr);
4258 - if (TASK_SIZE - len >= addr &&
4259 - (!vma || addr + len <= vma->vm_start))
4260 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
4261 return addr;
4262 }
4263
4264 @@ -99,6 +103,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4265 info.high_limit = TASK_SIZE;
4266 info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
4267 info.align_offset = pgoff << PAGE_SHIFT;
4268 + info.threadstack_offset = offset;
4269 return vm_unmapped_area(&info);
4270 }
4271
4272 @@ -112,6 +117,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4273 unsigned long addr = addr0;
4274 int do_align = 0;
4275 int aliasing = cache_is_vipt_aliasing();
4276 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
4277 struct vm_unmapped_area_info info;
4278
4279 /*
4280 @@ -132,6 +138,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4281 return addr;
4282 }
4283
4284 +#ifdef CONFIG_PAX_RANDMMAP
4285 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4286 +#endif
4287 +
4288 /* requesting a specific address */
4289 if (addr) {
4290 if (do_align)
4291 @@ -139,8 +149,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4292 else
4293 addr = PAGE_ALIGN(addr);
4294 vma = find_vma(mm, addr);
4295 - if (TASK_SIZE - len >= addr &&
4296 - (!vma || addr + len <= vma->vm_start))
4297 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
4298 return addr;
4299 }
4300
4301 @@ -150,6 +159,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4302 info.high_limit = mm->mmap_base;
4303 info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
4304 info.align_offset = pgoff << PAGE_SHIFT;
4305 + info.threadstack_offset = offset;
4306 addr = vm_unmapped_area(&info);
4307
4308 /*
4309 @@ -183,14 +193,30 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4310 {
4311 unsigned long random_factor = 0UL;
4312
4313 +#ifdef CONFIG_PAX_RANDMMAP
4314 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4315 +#endif
4316 +
4317 if (current->flags & PF_RANDOMIZE)
4318 random_factor = arch_mmap_rnd();
4319
4320 if (mmap_is_legacy()) {
4321 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4322 +
4323 +#ifdef CONFIG_PAX_RANDMMAP
4324 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4325 + mm->mmap_base += mm->delta_mmap;
4326 +#endif
4327 +
4328 mm->get_unmapped_area = arch_get_unmapped_area;
4329 } else {
4330 mm->mmap_base = mmap_base(random_factor);
4331 +
4332 +#ifdef CONFIG_PAX_RANDMMAP
4333 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4334 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4335 +#endif
4336 +
4337 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4338 }
4339 }
4340 diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
4341 index 7186382..0c145cf 100644
4342 --- a/arch/arm/mm/mmu.c
4343 +++ b/arch/arm/mm/mmu.c
4344 @@ -41,6 +41,22 @@
4345 #include "mm.h"
4346 #include "tcm.h"
4347
4348 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
4349 +void modify_domain(unsigned int dom, unsigned int type)
4350 +{
4351 + struct thread_info *thread = current_thread_info();
4352 + unsigned int domain = thread->cpu_domain;
4353 + /*
4354 + * DOMAIN_MANAGER might be defined to some other value,
4355 + * use the arch-defined constant
4356 + */
4357 + domain &= ~domain_val(dom, 3);
4358 + thread->cpu_domain = domain | domain_val(dom, type);
4359 + set_domain(thread->cpu_domain);
4360 +}
4361 +EXPORT_SYMBOL(modify_domain);
4362 +#endif
4363 +
4364 /*
4365 * empty_zero_page is a special page that is used for
4366 * zero-initialized data and COW.
4367 @@ -242,7 +258,15 @@ __setup("noalign", noalign_setup);
4368 #define PROT_PTE_S2_DEVICE PROT_PTE_DEVICE
4369 #define PROT_SECT_DEVICE PMD_TYPE_SECT|PMD_SECT_AP_WRITE
4370
4371 -static struct mem_type mem_types[] = {
4372 +#ifdef CONFIG_PAX_KERNEXEC
4373 +#define L_PTE_KERNEXEC L_PTE_RDONLY
4374 +#define PMD_SECT_KERNEXEC PMD_SECT_RDONLY
4375 +#else
4376 +#define L_PTE_KERNEXEC L_PTE_DIRTY
4377 +#define PMD_SECT_KERNEXEC PMD_SECT_AP_WRITE
4378 +#endif
4379 +
4380 +static struct mem_type mem_types[] __read_only = {
4381 [MT_DEVICE] = { /* Strongly ordered / ARMv6 shared device */
4382 .prot_pte = PROT_PTE_DEVICE | L_PTE_MT_DEV_SHARED |
4383 L_PTE_SHARED,
4384 @@ -271,19 +295,19 @@ static struct mem_type mem_types[] = {
4385 .prot_sect = PROT_SECT_DEVICE,
4386 .domain = DOMAIN_IO,
4387 },
4388 - [MT_UNCACHED] = {
4389 + [MT_UNCACHED_RW] = {
4390 .prot_pte = PROT_PTE_DEVICE,
4391 .prot_l1 = PMD_TYPE_TABLE,
4392 .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
4393 .domain = DOMAIN_IO,
4394 },
4395 - [MT_CACHECLEAN] = {
4396 - .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
4397 + [MT_CACHECLEAN_RO] = {
4398 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN | PMD_SECT_RDONLY,
4399 .domain = DOMAIN_KERNEL,
4400 },
4401 #ifndef CONFIG_ARM_LPAE
4402 - [MT_MINICLEAN] = {
4403 - .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN | PMD_SECT_MINICACHE,
4404 + [MT_MINICLEAN_RO] = {
4405 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_MINICACHE | PMD_SECT_XN | PMD_SECT_RDONLY,
4406 .domain = DOMAIN_KERNEL,
4407 },
4408 #endif
4409 @@ -291,15 +315,15 @@ static struct mem_type mem_types[] = {
4410 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4411 L_PTE_RDONLY,
4412 .prot_l1 = PMD_TYPE_TABLE,
4413 - .domain = DOMAIN_USER,
4414 + .domain = DOMAIN_VECTORS,
4415 },
4416 [MT_HIGH_VECTORS] = {
4417 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4418 L_PTE_USER | L_PTE_RDONLY,
4419 .prot_l1 = PMD_TYPE_TABLE,
4420 - .domain = DOMAIN_USER,
4421 + .domain = DOMAIN_VECTORS,
4422 },
4423 - [MT_MEMORY_RWX] = {
4424 + [__MT_MEMORY_RWX] = {
4425 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
4426 .prot_l1 = PMD_TYPE_TABLE,
4427 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
4428 @@ -312,17 +336,30 @@ static struct mem_type mem_types[] = {
4429 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
4430 .domain = DOMAIN_KERNEL,
4431 },
4432 - [MT_ROM] = {
4433 - .prot_sect = PMD_TYPE_SECT,
4434 + [MT_MEMORY_RX] = {
4435 + .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC,
4436 + .prot_l1 = PMD_TYPE_TABLE,
4437 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
4438 + .domain = DOMAIN_KERNEL,
4439 + },
4440 + [MT_ROM_RX] = {
4441 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_RDONLY,
4442 .domain = DOMAIN_KERNEL,
4443 },
4444 - [MT_MEMORY_RWX_NONCACHED] = {
4445 + [MT_MEMORY_RW_NONCACHED] = {
4446 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4447 L_PTE_MT_BUFFERABLE,
4448 .prot_l1 = PMD_TYPE_TABLE,
4449 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
4450 .domain = DOMAIN_KERNEL,
4451 },
4452 + [MT_MEMORY_RX_NONCACHED] = {
4453 + .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC |
4454 + L_PTE_MT_BUFFERABLE,
4455 + .prot_l1 = PMD_TYPE_TABLE,
4456 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
4457 + .domain = DOMAIN_KERNEL,
4458 + },
4459 [MT_MEMORY_RW_DTCM] = {
4460 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4461 L_PTE_XN,
4462 @@ -330,9 +367,10 @@ static struct mem_type mem_types[] = {
4463 .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
4464 .domain = DOMAIN_KERNEL,
4465 },
4466 - [MT_MEMORY_RWX_ITCM] = {
4467 - .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
4468 + [MT_MEMORY_RX_ITCM] = {
4469 + .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC,
4470 .prot_l1 = PMD_TYPE_TABLE,
4471 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
4472 .domain = DOMAIN_KERNEL,
4473 },
4474 [MT_MEMORY_RW_SO] = {
4475 @@ -544,9 +582,14 @@ static void __init build_mem_type_table(void)
4476 * Mark cache clean areas and XIP ROM read only
4477 * from SVC mode and no access from userspace.
4478 */
4479 - mem_types[MT_ROM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4480 - mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4481 - mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4482 + mem_types[MT_ROM_RX].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4483 +#ifdef CONFIG_PAX_KERNEXEC
4484 + mem_types[MT_MEMORY_RX].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4485 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4486 + mem_types[MT_MEMORY_RX_ITCM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4487 +#endif
4488 + mem_types[MT_MINICLEAN_RO].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4489 + mem_types[MT_CACHECLEAN_RO].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4490 #endif
4491
4492 /*
4493 @@ -563,13 +606,17 @@ static void __init build_mem_type_table(void)
4494 mem_types[MT_DEVICE_WC].prot_pte |= L_PTE_SHARED;
4495 mem_types[MT_DEVICE_CACHED].prot_sect |= PMD_SECT_S;
4496 mem_types[MT_DEVICE_CACHED].prot_pte |= L_PTE_SHARED;
4497 - mem_types[MT_MEMORY_RWX].prot_sect |= PMD_SECT_S;
4498 - mem_types[MT_MEMORY_RWX].prot_pte |= L_PTE_SHARED;
4499 + mem_types[__MT_MEMORY_RWX].prot_sect |= PMD_SECT_S;
4500 + mem_types[__MT_MEMORY_RWX].prot_pte |= L_PTE_SHARED;
4501 mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_S;
4502 mem_types[MT_MEMORY_RW].prot_pte |= L_PTE_SHARED;
4503 + mem_types[MT_MEMORY_RX].prot_sect |= PMD_SECT_S;
4504 + mem_types[MT_MEMORY_RX].prot_pte |= L_PTE_SHARED;
4505 mem_types[MT_MEMORY_DMA_READY].prot_pte |= L_PTE_SHARED;
4506 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= PMD_SECT_S;
4507 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_pte |= L_PTE_SHARED;
4508 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |= PMD_SECT_S;
4509 + mem_types[MT_MEMORY_RW_NONCACHED].prot_pte |= L_PTE_SHARED;
4510 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= PMD_SECT_S;
4511 + mem_types[MT_MEMORY_RX_NONCACHED].prot_pte |= L_PTE_SHARED;
4512 }
4513 }
4514
4515 @@ -580,15 +627,20 @@ static void __init build_mem_type_table(void)
4516 if (cpu_arch >= CPU_ARCH_ARMv6) {
4517 if (cpu_arch >= CPU_ARCH_ARMv7 && (cr & CR_TRE)) {
4518 /* Non-cacheable Normal is XCB = 001 */
4519 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |=
4520 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |=
4521 + PMD_SECT_BUFFERED;
4522 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |=
4523 PMD_SECT_BUFFERED;
4524 } else {
4525 /* For both ARMv6 and non-TEX-remapping ARMv7 */
4526 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |=
4527 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |=
4528 + PMD_SECT_TEX(1);
4529 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |=
4530 PMD_SECT_TEX(1);
4531 }
4532 } else {
4533 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= PMD_SECT_BUFFERABLE;
4534 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |= PMD_SECT_BUFFERABLE;
4535 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= PMD_SECT_BUFFERABLE;
4536 }
4537
4538 #ifdef CONFIG_ARM_LPAE
4539 @@ -609,6 +661,8 @@ static void __init build_mem_type_table(void)
4540 user_pgprot |= PTE_EXT_PXN;
4541 #endif
4542
4543 + user_pgprot |= __supported_pte_mask;
4544 +
4545 for (i = 0; i < 16; i++) {
4546 pteval_t v = pgprot_val(protection_map[i]);
4547 protection_map[i] = __pgprot(v | user_pgprot);
4548 @@ -626,21 +680,24 @@ static void __init build_mem_type_table(void)
4549
4550 mem_types[MT_LOW_VECTORS].prot_l1 |= ecc_mask;
4551 mem_types[MT_HIGH_VECTORS].prot_l1 |= ecc_mask;
4552 - mem_types[MT_MEMORY_RWX].prot_sect |= ecc_mask | cp->pmd;
4553 - mem_types[MT_MEMORY_RWX].prot_pte |= kern_pgprot;
4554 + mem_types[__MT_MEMORY_RWX].prot_sect |= ecc_mask | cp->pmd;
4555 + mem_types[__MT_MEMORY_RWX].prot_pte |= kern_pgprot;
4556 mem_types[MT_MEMORY_RW].prot_sect |= ecc_mask | cp->pmd;
4557 mem_types[MT_MEMORY_RW].prot_pte |= kern_pgprot;
4558 + mem_types[MT_MEMORY_RX].prot_sect |= ecc_mask | cp->pmd;
4559 + mem_types[MT_MEMORY_RX].prot_pte |= kern_pgprot;
4560 mem_types[MT_MEMORY_DMA_READY].prot_pte |= kern_pgprot;
4561 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= ecc_mask;
4562 - mem_types[MT_ROM].prot_sect |= cp->pmd;
4563 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |= ecc_mask;
4564 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= ecc_mask;
4565 + mem_types[MT_ROM_RX].prot_sect |= cp->pmd;
4566
4567 switch (cp->pmd) {
4568 case PMD_SECT_WT:
4569 - mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_WT;
4570 + mem_types[MT_CACHECLEAN_RO].prot_sect |= PMD_SECT_WT;
4571 break;
4572 case PMD_SECT_WB:
4573 case PMD_SECT_WBWA:
4574 - mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_WB;
4575 + mem_types[MT_CACHECLEAN_RO].prot_sect |= PMD_SECT_WB;
4576 break;
4577 }
4578 pr_info("Memory policy: %sData cache %s\n",
4579 @@ -854,7 +911,7 @@ static void __init create_mapping(struct map_desc *md)
4580 return;
4581 }
4582
4583 - if ((md->type == MT_DEVICE || md->type == MT_ROM) &&
4584 + if ((md->type == MT_DEVICE || md->type == MT_ROM_RX) &&
4585 md->virtual >= PAGE_OFFSET &&
4586 (md->virtual < VMALLOC_START || md->virtual >= VMALLOC_END)) {
4587 pr_warn("BUG: mapping for 0x%08llx at 0x%08lx out of vmalloc space\n",
4588 @@ -1218,18 +1275,15 @@ void __init arm_mm_memblock_reserve(void)
4589 * called function. This means you can't use any function or debugging
4590 * method which may touch any device, otherwise the kernel _will_ crash.
4591 */
4592 +
4593 +static char vectors[PAGE_SIZE * 2] __read_only __aligned(PAGE_SIZE);
4594 +
4595 static void __init devicemaps_init(const struct machine_desc *mdesc)
4596 {
4597 struct map_desc map;
4598 unsigned long addr;
4599 - void *vectors;
4600
4601 - /*
4602 - * Allocate the vector page early.
4603 - */
4604 - vectors = early_alloc(PAGE_SIZE * 2);
4605 -
4606 - early_trap_init(vectors);
4607 + early_trap_init(&vectors);
4608
4609 for (addr = VMALLOC_START; addr; addr += PMD_SIZE)
4610 pmd_clear(pmd_off_k(addr));
4611 @@ -1242,7 +1296,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
4612 map.pfn = __phys_to_pfn(CONFIG_XIP_PHYS_ADDR & SECTION_MASK);
4613 map.virtual = MODULES_VADDR;
4614 map.length = ((unsigned long)_etext - map.virtual + ~SECTION_MASK) & SECTION_MASK;
4615 - map.type = MT_ROM;
4616 + map.type = MT_ROM_RX;
4617 create_mapping(&map);
4618 #endif
4619
4620 @@ -1253,14 +1307,14 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
4621 map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS);
4622 map.virtual = FLUSH_BASE;
4623 map.length = SZ_1M;
4624 - map.type = MT_CACHECLEAN;
4625 + map.type = MT_CACHECLEAN_RO;
4626 create_mapping(&map);
4627 #endif
4628 #ifdef FLUSH_BASE_MINICACHE
4629 map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS + SZ_1M);
4630 map.virtual = FLUSH_BASE_MINICACHE;
4631 map.length = SZ_1M;
4632 - map.type = MT_MINICLEAN;
4633 + map.type = MT_MINICLEAN_RO;
4634 create_mapping(&map);
4635 #endif
4636
4637 @@ -1269,7 +1323,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
4638 * location (0xffff0000). If we aren't using high-vectors, also
4639 * create a mapping at the low-vectors virtual address.
4640 */
4641 - map.pfn = __phys_to_pfn(virt_to_phys(vectors));
4642 + map.pfn = __phys_to_pfn(virt_to_phys(&vectors));
4643 map.virtual = 0xffff0000;
4644 map.length = PAGE_SIZE;
4645 #ifdef CONFIG_KUSER_HELPERS
4646 @@ -1329,8 +1383,10 @@ static void __init kmap_init(void)
4647 static void __init map_lowmem(void)
4648 {
4649 struct memblock_region *reg;
4650 +#ifndef CONFIG_PAX_KERNEXEC
4651 phys_addr_t kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
4652 phys_addr_t kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
4653 +#endif
4654
4655 /* Map all the lowmem memory banks. */
4656 for_each_memblock(memory, reg) {
4657 @@ -1343,11 +1399,48 @@ static void __init map_lowmem(void)
4658 if (start >= end)
4659 break;
4660
4661 +#ifdef CONFIG_PAX_KERNEXEC
4662 + map.pfn = __phys_to_pfn(start);
4663 + map.virtual = __phys_to_virt(start);
4664 + map.length = end - start;
4665 +
4666 + if (map.virtual <= (unsigned long)_stext && ((unsigned long)_end < (map.virtual + map.length))) {
4667 + struct map_desc kernel;
4668 + struct map_desc initmap;
4669 +
4670 + /* when freeing initmem we will make this RW */
4671 + initmap.pfn = __phys_to_pfn(__pa(__init_begin));
4672 + initmap.virtual = (unsigned long)__init_begin;
4673 + initmap.length = _sdata - __init_begin;
4674 + initmap.type = __MT_MEMORY_RWX;
4675 + create_mapping(&initmap);
4676 +
4677 + /* when freeing initmem we will make this RX */
4678 + kernel.pfn = __phys_to_pfn(__pa(_stext));
4679 + kernel.virtual = (unsigned long)_stext;
4680 + kernel.length = __init_begin - _stext;
4681 + kernel.type = __MT_MEMORY_RWX;
4682 + create_mapping(&kernel);
4683 +
4684 + if (map.virtual < (unsigned long)_stext) {
4685 + map.length = (unsigned long)_stext - map.virtual;
4686 + map.type = __MT_MEMORY_RWX;
4687 + create_mapping(&map);
4688 + }
4689 +
4690 + map.pfn = __phys_to_pfn(__pa(_sdata));
4691 + map.virtual = (unsigned long)_sdata;
4692 + map.length = end - __pa(_sdata);
4693 + }
4694 +
4695 + map.type = MT_MEMORY_RW;
4696 + create_mapping(&map);
4697 +#else
4698 if (end < kernel_x_start) {
4699 map.pfn = __phys_to_pfn(start);
4700 map.virtual = __phys_to_virt(start);
4701 map.length = end - start;
4702 - map.type = MT_MEMORY_RWX;
4703 + map.type = __MT_MEMORY_RWX;
4704
4705 create_mapping(&map);
4706 } else if (start >= kernel_x_end) {
4707 @@ -1371,7 +1464,7 @@ static void __init map_lowmem(void)
4708 map.pfn = __phys_to_pfn(kernel_x_start);
4709 map.virtual = __phys_to_virt(kernel_x_start);
4710 map.length = kernel_x_end - kernel_x_start;
4711 - map.type = MT_MEMORY_RWX;
4712 + map.type = __MT_MEMORY_RWX;
4713
4714 create_mapping(&map);
4715
4716 @@ -1384,6 +1477,7 @@ static void __init map_lowmem(void)
4717 create_mapping(&map);
4718 }
4719 }
4720 +#endif
4721 }
4722 }
4723
4724 diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
4725 index e0e2358..a4ee460 100644
4726 --- a/arch/arm/net/bpf_jit_32.c
4727 +++ b/arch/arm/net/bpf_jit_32.c
4728 @@ -20,6 +20,7 @@
4729 #include <asm/cacheflush.h>
4730 #include <asm/hwcap.h>
4731 #include <asm/opcodes.h>
4732 +#include <asm/pgtable.h>
4733
4734 #include "bpf_jit_32.h"
4735
4736 @@ -72,34 +73,58 @@ struct jit_ctx {
4737 #endif
4738 };
4739
4740 +#ifdef CONFIG_GRKERNSEC_BPF_HARDEN
4741 +int bpf_jit_enable __read_only;
4742 +#else
4743 int bpf_jit_enable __read_mostly;
4744 +#endif
4745
4746 -static u64 jit_get_skb_b(struct sk_buff *skb, unsigned offset)
4747 +static inline int call_neg_helper(struct sk_buff *skb, int offset, void *ret,
4748 + unsigned int size)
4749 +{
4750 + void *ptr = bpf_internal_load_pointer_neg_helper(skb, offset, size);
4751 +
4752 + if (!ptr)
4753 + return -EFAULT;
4754 + memcpy(ret, ptr, size);
4755 + return 0;
4756 +}
4757 +
4758 +static u64 jit_get_skb_b(struct sk_buff *skb, int offset)
4759 {
4760 u8 ret;
4761 int err;
4762
4763 - err = skb_copy_bits(skb, offset, &ret, 1);
4764 + if (offset < 0)
4765 + err = call_neg_helper(skb, offset, &ret, 1);
4766 + else
4767 + err = skb_copy_bits(skb, offset, &ret, 1);
4768
4769 return (u64)err << 32 | ret;
4770 }
4771
4772 -static u64 jit_get_skb_h(struct sk_buff *skb, unsigned offset)
4773 +static u64 jit_get_skb_h(struct sk_buff *skb, int offset)
4774 {
4775 u16 ret;
4776 int err;
4777
4778 - err = skb_copy_bits(skb, offset, &ret, 2);
4779 + if (offset < 0)
4780 + err = call_neg_helper(skb, offset, &ret, 2);
4781 + else
4782 + err = skb_copy_bits(skb, offset, &ret, 2);
4783
4784 return (u64)err << 32 | ntohs(ret);
4785 }
4786
4787 -static u64 jit_get_skb_w(struct sk_buff *skb, unsigned offset)
4788 +static u64 jit_get_skb_w(struct sk_buff *skb, int offset)
4789 {
4790 u32 ret;
4791 int err;
4792
4793 - err = skb_copy_bits(skb, offset, &ret, 4);
4794 + if (offset < 0)
4795 + err = call_neg_helper(skb, offset, &ret, 4);
4796 + else
4797 + err = skb_copy_bits(skb, offset, &ret, 4);
4798
4799 return (u64)err << 32 | ntohl(ret);
4800 }
4801 @@ -179,8 +204,10 @@ static void jit_fill_hole(void *area, unsigned int size)
4802 {
4803 u32 *ptr;
4804 /* We are guaranteed to have aligned memory. */
4805 + pax_open_kernel();
4806 for (ptr = area; size >= sizeof(u32); size -= sizeof(u32))
4807 *ptr++ = __opcode_to_mem_arm(ARM_INST_UDF);
4808 + pax_close_kernel();
4809 }
4810
4811 static void build_prologue(struct jit_ctx *ctx)
4812 @@ -536,9 +563,6 @@ static int build_body(struct jit_ctx *ctx)
4813 case BPF_LD | BPF_B | BPF_ABS:
4814 load_order = 0;
4815 load:
4816 - /* the interpreter will deal with the negative K */
4817 - if ((int)k < 0)
4818 - return -ENOTSUPP;
4819 emit_mov_i(r_off, k, ctx);
4820 load_common:
4821 ctx->seen |= SEEN_DATA | SEEN_CALL;
4822 @@ -547,12 +571,24 @@ load_common:
4823 emit(ARM_SUB_I(r_scratch, r_skb_hl,
4824 1 << load_order), ctx);
4825 emit(ARM_CMP_R(r_scratch, r_off), ctx);
4826 - condt = ARM_COND_HS;
4827 + condt = ARM_COND_GE;
4828 } else {
4829 emit(ARM_CMP_R(r_skb_hl, r_off), ctx);
4830 condt = ARM_COND_HI;
4831 }
4832
4833 + /*
4834 + * test for negative offset, only if we are
4835 + * currently scheduled to take the fast
4836 + * path. this will update the flags so that
4837 + * the slowpath instruction are ignored if the
4838 + * offset is negative.
4839 + *
4840 + * for loard_order == 0 the HI condition will
4841 + * make loads at offset 0 take the slow path too.
4842 + */
4843 + _emit(condt, ARM_CMP_I(r_off, 0), ctx);
4844 +
4845 _emit(condt, ARM_ADD_R(r_scratch, r_off, r_skb_data),
4846 ctx);
4847
4848 @@ -860,9 +896,11 @@ b_epilogue:
4849 off = offsetof(struct sk_buff, vlan_tci);
4850 emit(ARM_LDRH_I(r_A, r_skb, off), ctx);
4851 if (code == (BPF_ANC | SKF_AD_VLAN_TAG))
4852 - OP_IMM3(ARM_AND, r_A, r_A, VLAN_VID_MASK, ctx);
4853 - else
4854 - OP_IMM3(ARM_AND, r_A, r_A, VLAN_TAG_PRESENT, ctx);
4855 + OP_IMM3(ARM_AND, r_A, r_A, ~VLAN_TAG_PRESENT, ctx);
4856 + else {
4857 + OP_IMM3(ARM_LSR, r_A, r_A, 12, ctx);
4858 + OP_IMM3(ARM_AND, r_A, r_A, 0x1, ctx);
4859 + }
4860 break;
4861 case BPF_ANC | SKF_AD_QUEUE:
4862 ctx->seen |= SEEN_SKB;
4863 diff --git a/arch/arm/plat-iop/setup.c b/arch/arm/plat-iop/setup.c
4864 index 5b217f4..c23f40e 100644
4865 --- a/arch/arm/plat-iop/setup.c
4866 +++ b/arch/arm/plat-iop/setup.c
4867 @@ -24,7 +24,7 @@ static struct map_desc iop3xx_std_desc[] __initdata = {
4868 .virtual = IOP3XX_PERIPHERAL_VIRT_BASE,
4869 .pfn = __phys_to_pfn(IOP3XX_PERIPHERAL_PHYS_BASE),
4870 .length = IOP3XX_PERIPHERAL_SIZE,
4871 - .type = MT_UNCACHED,
4872 + .type = MT_UNCACHED_RW,
4873 },
4874 };
4875
4876 diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
4877 index a5bc92d..0bb4730 100644
4878 --- a/arch/arm/plat-omap/sram.c
4879 +++ b/arch/arm/plat-omap/sram.c
4880 @@ -93,6 +93,8 @@ void __init omap_map_sram(unsigned long start, unsigned long size,
4881 * Looks like we need to preserve some bootloader code at the
4882 * beginning of SRAM for jumping to flash for reboot to work...
4883 */
4884 + pax_open_kernel();
4885 memset_io(omap_sram_base + omap_sram_skip, 0,
4886 omap_sram_size - omap_sram_skip);
4887 + pax_close_kernel();
4888 }
4889 diff --git a/arch/arm64/include/asm/atomic.h b/arch/arm64/include/asm/atomic.h
4890 index 7047051..44e8675 100644
4891 --- a/arch/arm64/include/asm/atomic.h
4892 +++ b/arch/arm64/include/asm/atomic.h
4893 @@ -252,5 +252,15 @@ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
4894 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
4895 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
4896
4897 +#define atomic64_read_unchecked(v) atomic64_read(v)
4898 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
4899 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
4900 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
4901 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
4902 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
4903 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
4904 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
4905 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
4906 +
4907 #endif
4908 #endif
4909 diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
4910 index 71f19c4..2b13cfe 100644
4911 --- a/arch/arm64/include/asm/barrier.h
4912 +++ b/arch/arm64/include/asm/barrier.h
4913 @@ -44,7 +44,7 @@
4914 do { \
4915 compiletime_assert_atomic_type(*p); \
4916 barrier(); \
4917 - ACCESS_ONCE(*p) = (v); \
4918 + ACCESS_ONCE_RW(*p) = (v); \
4919 } while (0)
4920
4921 #define smp_load_acquire(p) \
4922 diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
4923 index 4fde8c1..441f84f 100644
4924 --- a/arch/arm64/include/asm/percpu.h
4925 +++ b/arch/arm64/include/asm/percpu.h
4926 @@ -135,16 +135,16 @@ static inline void __percpu_write(void *ptr, unsigned long val, int size)
4927 {
4928 switch (size) {
4929 case 1:
4930 - ACCESS_ONCE(*(u8 *)ptr) = (u8)val;
4931 + ACCESS_ONCE_RW(*(u8 *)ptr) = (u8)val;
4932 break;
4933 case 2:
4934 - ACCESS_ONCE(*(u16 *)ptr) = (u16)val;
4935 + ACCESS_ONCE_RW(*(u16 *)ptr) = (u16)val;
4936 break;
4937 case 4:
4938 - ACCESS_ONCE(*(u32 *)ptr) = (u32)val;
4939 + ACCESS_ONCE_RW(*(u32 *)ptr) = (u32)val;
4940 break;
4941 case 8:
4942 - ACCESS_ONCE(*(u64 *)ptr) = (u64)val;
4943 + ACCESS_ONCE_RW(*(u64 *)ptr) = (u64)val;
4944 break;
4945 default:
4946 BUILD_BUG();
4947 diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
4948 index 7642056..bffc904 100644
4949 --- a/arch/arm64/include/asm/pgalloc.h
4950 +++ b/arch/arm64/include/asm/pgalloc.h
4951 @@ -46,6 +46,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
4952 set_pud(pud, __pud(__pa(pmd) | PMD_TYPE_TABLE));
4953 }
4954
4955 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
4956 +{
4957 + pud_populate(mm, pud, pmd);
4958 +}
4959 +
4960 #endif /* CONFIG_PGTABLE_LEVELS > 2 */
4961
4962 #if CONFIG_PGTABLE_LEVELS > 3
4963 diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
4964 index 07e1ba44..ec8cbbb 100644
4965 --- a/arch/arm64/include/asm/uaccess.h
4966 +++ b/arch/arm64/include/asm/uaccess.h
4967 @@ -99,6 +99,7 @@ static inline void set_fs(mm_segment_t fs)
4968 flag; \
4969 })
4970
4971 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
4972 #define access_ok(type, addr, size) __range_ok(addr, size)
4973 #define user_addr_max get_fs
4974
4975 diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
4976 index b0bd4e5..54e82f6 100644
4977 --- a/arch/arm64/mm/dma-mapping.c
4978 +++ b/arch/arm64/mm/dma-mapping.c
4979 @@ -134,7 +134,7 @@ static void __dma_free_coherent(struct device *dev, size_t size,
4980 phys_to_page(paddr),
4981 size >> PAGE_SHIFT);
4982 if (!freed)
4983 - swiotlb_free_coherent(dev, size, vaddr, dma_handle);
4984 + swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs);
4985 }
4986
4987 static void *__dma_alloc(struct device *dev, size_t size,
4988 diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h
4989 index c3a58a1..78fbf54 100644
4990 --- a/arch/avr32/include/asm/cache.h
4991 +++ b/arch/avr32/include/asm/cache.h
4992 @@ -1,8 +1,10 @@
4993 #ifndef __ASM_AVR32_CACHE_H
4994 #define __ASM_AVR32_CACHE_H
4995
4996 +#include <linux/const.h>
4997 +
4998 #define L1_CACHE_SHIFT 5
4999 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5000 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5001
5002 /*
5003 * Memory returned by kmalloc() may be used for DMA, so we must make
5004 diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
5005 index 0388ece..87c8df1 100644
5006 --- a/arch/avr32/include/asm/elf.h
5007 +++ b/arch/avr32/include/asm/elf.h
5008 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
5009 the loader. We need to make sure that it is out of the way of the program
5010 that it will "exec", and that there is sufficient room for the brk. */
5011
5012 -#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
5013 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
5014
5015 +#ifdef CONFIG_PAX_ASLR
5016 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
5017 +
5018 +#define PAX_DELTA_MMAP_LEN 15
5019 +#define PAX_DELTA_STACK_LEN 15
5020 +#endif
5021
5022 /* This yields a mask that user programs can use to figure out what
5023 instruction set this CPU supports. This could be done in user space,
5024 diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
5025 index 479330b..53717a8 100644
5026 --- a/arch/avr32/include/asm/kmap_types.h
5027 +++ b/arch/avr32/include/asm/kmap_types.h
5028 @@ -2,9 +2,9 @@
5029 #define __ASM_AVR32_KMAP_TYPES_H
5030
5031 #ifdef CONFIG_DEBUG_HIGHMEM
5032 -# define KM_TYPE_NR 29
5033 +# define KM_TYPE_NR 30
5034 #else
5035 -# define KM_TYPE_NR 14
5036 +# define KM_TYPE_NR 15
5037 #endif
5038
5039 #endif /* __ASM_AVR32_KMAP_TYPES_H */
5040 diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
5041 index d223a8b..69c5210 100644
5042 --- a/arch/avr32/mm/fault.c
5043 +++ b/arch/avr32/mm/fault.c
5044 @@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
5045
5046 int exception_trace = 1;
5047
5048 +#ifdef CONFIG_PAX_PAGEEXEC
5049 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5050 +{
5051 + unsigned long i;
5052 +
5053 + printk(KERN_ERR "PAX: bytes at PC: ");
5054 + for (i = 0; i < 20; i++) {
5055 + unsigned char c;
5056 + if (get_user(c, (unsigned char *)pc+i))
5057 + printk(KERN_CONT "???????? ");
5058 + else
5059 + printk(KERN_CONT "%02x ", c);
5060 + }
5061 + printk("\n");
5062 +}
5063 +#endif
5064 +
5065 /*
5066 * This routine handles page faults. It determines the address and the
5067 * problem, and then passes it off to one of the appropriate routines.
5068 @@ -178,6 +195,16 @@ bad_area:
5069 up_read(&mm->mmap_sem);
5070
5071 if (user_mode(regs)) {
5072 +
5073 +#ifdef CONFIG_PAX_PAGEEXEC
5074 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
5075 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
5076 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
5077 + do_group_exit(SIGKILL);
5078 + }
5079 + }
5080 +#endif
5081 +
5082 if (exception_trace && printk_ratelimit())
5083 printk("%s%s[%d]: segfault at %08lx pc %08lx "
5084 "sp %08lx ecr %lu\n",
5085 diff --git a/arch/blackfin/include/asm/cache.h b/arch/blackfin/include/asm/cache.h
5086 index 568885a..f8008df 100644
5087 --- a/arch/blackfin/include/asm/cache.h
5088 +++ b/arch/blackfin/include/asm/cache.h
5089 @@ -7,6 +7,7 @@
5090 #ifndef __ARCH_BLACKFIN_CACHE_H
5091 #define __ARCH_BLACKFIN_CACHE_H
5092
5093 +#include <linux/const.h>
5094 #include <linux/linkage.h> /* for asmlinkage */
5095
5096 /*
5097 @@ -14,7 +15,7 @@
5098 * Blackfin loads 32 bytes for cache
5099 */
5100 #define L1_CACHE_SHIFT 5
5101 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5102 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5103 #define SMP_CACHE_BYTES L1_CACHE_BYTES
5104
5105 #define ARCH_DMA_MINALIGN L1_CACHE_BYTES
5106 diff --git a/arch/cris/include/arch-v10/arch/cache.h b/arch/cris/include/arch-v10/arch/cache.h
5107 index aea2718..3639a60 100644
5108 --- a/arch/cris/include/arch-v10/arch/cache.h
5109 +++ b/arch/cris/include/arch-v10/arch/cache.h
5110 @@ -1,8 +1,9 @@
5111 #ifndef _ASM_ARCH_CACHE_H
5112 #define _ASM_ARCH_CACHE_H
5113
5114 +#include <linux/const.h>
5115 /* Etrax 100LX have 32-byte cache-lines. */
5116 -#define L1_CACHE_BYTES 32
5117 #define L1_CACHE_SHIFT 5
5118 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5119
5120 #endif /* _ASM_ARCH_CACHE_H */
5121 diff --git a/arch/cris/include/arch-v32/arch/cache.h b/arch/cris/include/arch-v32/arch/cache.h
5122 index 7caf25d..ee65ac5 100644
5123 --- a/arch/cris/include/arch-v32/arch/cache.h
5124 +++ b/arch/cris/include/arch-v32/arch/cache.h
5125 @@ -1,11 +1,12 @@
5126 #ifndef _ASM_CRIS_ARCH_CACHE_H
5127 #define _ASM_CRIS_ARCH_CACHE_H
5128
5129 +#include <linux/const.h>
5130 #include <arch/hwregs/dma.h>
5131
5132 /* A cache-line is 32 bytes. */
5133 -#define L1_CACHE_BYTES 32
5134 #define L1_CACHE_SHIFT 5
5135 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5136
5137 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
5138
5139 diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
5140 index 102190a..5334cea 100644
5141 --- a/arch/frv/include/asm/atomic.h
5142 +++ b/arch/frv/include/asm/atomic.h
5143 @@ -181,6 +181,16 @@ static inline void atomic64_dec(atomic64_t *v)
5144 #define atomic64_cmpxchg(v, old, new) (__cmpxchg_64(old, new, &(v)->counter))
5145 #define atomic64_xchg(v, new) (__xchg_64(new, &(v)->counter))
5146
5147 +#define atomic64_read_unchecked(v) atomic64_read(v)
5148 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
5149 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
5150 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
5151 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
5152 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
5153 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
5154 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
5155 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
5156 +
5157 static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
5158 {
5159 int c, old;
5160 diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h
5161 index 2797163..c2a401df9 100644
5162 --- a/arch/frv/include/asm/cache.h
5163 +++ b/arch/frv/include/asm/cache.h
5164 @@ -12,10 +12,11 @@
5165 #ifndef __ASM_CACHE_H
5166 #define __ASM_CACHE_H
5167
5168 +#include <linux/const.h>
5169
5170 /* bytes per L1 cache line */
5171 #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT)
5172 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5173 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5174
5175 #define __cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES)))
5176 #define ____cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES)))
5177 diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
5178 index 43901f2..0d8b865 100644
5179 --- a/arch/frv/include/asm/kmap_types.h
5180 +++ b/arch/frv/include/asm/kmap_types.h
5181 @@ -2,6 +2,6 @@
5182 #ifndef _ASM_KMAP_TYPES_H
5183 #define _ASM_KMAP_TYPES_H
5184
5185 -#define KM_TYPE_NR 17
5186 +#define KM_TYPE_NR 18
5187
5188 #endif
5189 diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
5190 index 836f147..4cf23f5 100644
5191 --- a/arch/frv/mm/elf-fdpic.c
5192 +++ b/arch/frv/mm/elf-fdpic.c
5193 @@ -61,6 +61,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5194 {
5195 struct vm_area_struct *vma;
5196 struct vm_unmapped_area_info info;
5197 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
5198
5199 if (len > TASK_SIZE)
5200 return -ENOMEM;
5201 @@ -73,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5202 if (addr) {
5203 addr = PAGE_ALIGN(addr);
5204 vma = find_vma(current->mm, addr);
5205 - if (TASK_SIZE - len >= addr &&
5206 - (!vma || addr + len <= vma->vm_start))
5207 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
5208 goto success;
5209 }
5210
5211 @@ -85,6 +85,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5212 info.high_limit = (current->mm->start_stack - 0x00200000);
5213 info.align_mask = 0;
5214 info.align_offset = 0;
5215 + info.threadstack_offset = offset;
5216 addr = vm_unmapped_area(&info);
5217 if (!(addr & ~PAGE_MASK))
5218 goto success;
5219 diff --git a/arch/hexagon/include/asm/cache.h b/arch/hexagon/include/asm/cache.h
5220 index 69952c18..4fa2908 100644
5221 --- a/arch/hexagon/include/asm/cache.h
5222 +++ b/arch/hexagon/include/asm/cache.h
5223 @@ -21,9 +21,11 @@
5224 #ifndef __ASM_CACHE_H
5225 #define __ASM_CACHE_H
5226
5227 +#include <linux/const.h>
5228 +
5229 /* Bytes per L1 cache line */
5230 -#define L1_CACHE_SHIFT (5)
5231 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5232 +#define L1_CACHE_SHIFT 5
5233 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5234
5235 #define ARCH_DMA_MINALIGN L1_CACHE_BYTES
5236
5237 diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
5238 index 76d25b2..d3793a0f 100644
5239 --- a/arch/ia64/Kconfig
5240 +++ b/arch/ia64/Kconfig
5241 @@ -541,6 +541,7 @@ source "drivers/sn/Kconfig"
5242 config KEXEC
5243 bool "kexec system call"
5244 depends on !IA64_HP_SIM && (!SMP || HOTPLUG_CPU)
5245 + depends on !GRKERNSEC_KMEM
5246 help
5247 kexec is a system call that implements the ability to shutdown your
5248 current kernel, and to start another kernel. It is like a reboot
5249 diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
5250 index 970d0bd..e750b9b 100644
5251 --- a/arch/ia64/Makefile
5252 +++ b/arch/ia64/Makefile
5253 @@ -98,5 +98,6 @@ endef
5254 archprepare: make_nr_irqs_h FORCE
5255 PHONY += make_nr_irqs_h FORCE
5256
5257 +make_nr_irqs_h: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
5258 make_nr_irqs_h: FORCE
5259 $(Q)$(MAKE) $(build)=arch/ia64/kernel include/generated/nr-irqs.h
5260 diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
5261 index 0bf0350..2ad1957 100644
5262 --- a/arch/ia64/include/asm/atomic.h
5263 +++ b/arch/ia64/include/asm/atomic.h
5264 @@ -193,4 +193,14 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
5265 #define atomic64_inc(v) atomic64_add(1, (v))
5266 #define atomic64_dec(v) atomic64_sub(1, (v))
5267
5268 +#define atomic64_read_unchecked(v) atomic64_read(v)
5269 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
5270 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
5271 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
5272 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
5273 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
5274 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
5275 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
5276 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
5277 +
5278 #endif /* _ASM_IA64_ATOMIC_H */
5279 diff --git a/arch/ia64/include/asm/barrier.h b/arch/ia64/include/asm/barrier.h
5280 index f6769eb..1cdb590 100644
5281 --- a/arch/ia64/include/asm/barrier.h
5282 +++ b/arch/ia64/include/asm/barrier.h
5283 @@ -66,7 +66,7 @@
5284 do { \
5285 compiletime_assert_atomic_type(*p); \
5286 barrier(); \
5287 - ACCESS_ONCE(*p) = (v); \
5288 + ACCESS_ONCE_RW(*p) = (v); \
5289 } while (0)
5290
5291 #define smp_load_acquire(p) \
5292 diff --git a/arch/ia64/include/asm/cache.h b/arch/ia64/include/asm/cache.h
5293 index 988254a..e1ee885 100644
5294 --- a/arch/ia64/include/asm/cache.h
5295 +++ b/arch/ia64/include/asm/cache.h
5296 @@ -1,6 +1,7 @@
5297 #ifndef _ASM_IA64_CACHE_H
5298 #define _ASM_IA64_CACHE_H
5299
5300 +#include <linux/const.h>
5301
5302 /*
5303 * Copyright (C) 1998-2000 Hewlett-Packard Co
5304 @@ -9,7 +10,7 @@
5305
5306 /* Bytes per L1 (data) cache line. */
5307 #define L1_CACHE_SHIFT CONFIG_IA64_L1_CACHE_SHIFT
5308 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5309 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5310
5311 #ifdef CONFIG_SMP
5312 # define SMP_CACHE_SHIFT L1_CACHE_SHIFT
5313 diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
5314 index 5a83c5c..4d7f553 100644
5315 --- a/arch/ia64/include/asm/elf.h
5316 +++ b/arch/ia64/include/asm/elf.h
5317 @@ -42,6 +42,13 @@
5318 */
5319 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
5320
5321 +#ifdef CONFIG_PAX_ASLR
5322 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
5323 +
5324 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
5325 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
5326 +#endif
5327 +
5328 #define PT_IA_64_UNWIND 0x70000001
5329
5330 /* IA-64 relocations: */
5331 diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
5332 index f5e70e9..624fad5 100644
5333 --- a/arch/ia64/include/asm/pgalloc.h
5334 +++ b/arch/ia64/include/asm/pgalloc.h
5335 @@ -39,6 +39,12 @@ pgd_populate(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
5336 pgd_val(*pgd_entry) = __pa(pud);
5337 }
5338
5339 +static inline void
5340 +pgd_populate_kernel(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
5341 +{
5342 + pgd_populate(mm, pgd_entry, pud);
5343 +}
5344 +
5345 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
5346 {
5347 return quicklist_alloc(0, GFP_KERNEL, NULL);
5348 @@ -57,6 +63,12 @@ pud_populate(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
5349 pud_val(*pud_entry) = __pa(pmd);
5350 }
5351
5352 +static inline void
5353 +pud_populate_kernel(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
5354 +{
5355 + pud_populate(mm, pud_entry, pmd);
5356 +}
5357 +
5358 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
5359 {
5360 return quicklist_alloc(0, GFP_KERNEL, NULL);
5361 diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
5362 index 9f3ed9e..c99b418 100644
5363 --- a/arch/ia64/include/asm/pgtable.h
5364 +++ b/arch/ia64/include/asm/pgtable.h
5365 @@ -12,7 +12,7 @@
5366 * David Mosberger-Tang <davidm@hpl.hp.com>
5367 */
5368
5369 -
5370 +#include <linux/const.h>
5371 #include <asm/mman.h>
5372 #include <asm/page.h>
5373 #include <asm/processor.h>
5374 @@ -139,6 +139,17 @@
5375 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5376 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5377 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
5378 +
5379 +#ifdef CONFIG_PAX_PAGEEXEC
5380 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
5381 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5382 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5383 +#else
5384 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
5385 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
5386 +# define PAGE_COPY_NOEXEC PAGE_COPY
5387 +#endif
5388 +
5389 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
5390 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
5391 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
5392 diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
5393 index 45698cd..e8e2dbc 100644
5394 --- a/arch/ia64/include/asm/spinlock.h
5395 +++ b/arch/ia64/include/asm/spinlock.h
5396 @@ -71,7 +71,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
5397 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
5398
5399 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
5400 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
5401 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
5402 }
5403
5404 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
5405 diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
5406 index 4f3fb6cc..254055e 100644
5407 --- a/arch/ia64/include/asm/uaccess.h
5408 +++ b/arch/ia64/include/asm/uaccess.h
5409 @@ -70,6 +70,7 @@
5410 && ((segment).seg == KERNEL_DS.seg \
5411 || likely(REGION_OFFSET((unsigned long) (addr)) < RGN_MAP_LIMIT))); \
5412 })
5413 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
5414 #define access_ok(type, addr, size) __access_ok((addr), (size), get_fs())
5415
5416 /*
5417 @@ -241,12 +242,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
5418 static inline unsigned long
5419 __copy_to_user (void __user *to, const void *from, unsigned long count)
5420 {
5421 + if (count > INT_MAX)
5422 + return count;
5423 +
5424 + if (!__builtin_constant_p(count))
5425 + check_object_size(from, count, true);
5426 +
5427 return __copy_user(to, (__force void __user *) from, count);
5428 }
5429
5430 static inline unsigned long
5431 __copy_from_user (void *to, const void __user *from, unsigned long count)
5432 {
5433 + if (count > INT_MAX)
5434 + return count;
5435 +
5436 + if (!__builtin_constant_p(count))
5437 + check_object_size(to, count, false);
5438 +
5439 return __copy_user((__force void __user *) to, from, count);
5440 }
5441
5442 @@ -256,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
5443 ({ \
5444 void __user *__cu_to = (to); \
5445 const void *__cu_from = (from); \
5446 - long __cu_len = (n); \
5447 + unsigned long __cu_len = (n); \
5448 \
5449 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
5450 + if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) { \
5451 + if (!__builtin_constant_p(n)) \
5452 + check_object_size(__cu_from, __cu_len, true); \
5453 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
5454 + } \
5455 __cu_len; \
5456 })
5457
5458 @@ -267,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
5459 ({ \
5460 void *__cu_to = (to); \
5461 const void __user *__cu_from = (from); \
5462 - long __cu_len = (n); \
5463 + unsigned long __cu_len = (n); \
5464 \
5465 __chk_user_ptr(__cu_from); \
5466 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
5467 + if (__cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) { \
5468 + if (!__builtin_constant_p(n)) \
5469 + check_object_size(__cu_to, __cu_len, false); \
5470 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
5471 + } \
5472 __cu_len; \
5473 })
5474
5475 diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
5476 index 29754aa..06d2838 100644
5477 --- a/arch/ia64/kernel/module.c
5478 +++ b/arch/ia64/kernel/module.c
5479 @@ -492,15 +492,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
5480 }
5481
5482 static inline int
5483 +in_init_rx (const struct module *mod, uint64_t addr)
5484 +{
5485 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
5486 +}
5487 +
5488 +static inline int
5489 +in_init_rw (const struct module *mod, uint64_t addr)
5490 +{
5491 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
5492 +}
5493 +
5494 +static inline int
5495 in_init (const struct module *mod, uint64_t addr)
5496 {
5497 - return addr - (uint64_t) mod->module_init < mod->init_size;
5498 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
5499 +}
5500 +
5501 +static inline int
5502 +in_core_rx (const struct module *mod, uint64_t addr)
5503 +{
5504 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
5505 +}
5506 +
5507 +static inline int
5508 +in_core_rw (const struct module *mod, uint64_t addr)
5509 +{
5510 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
5511 }
5512
5513 static inline int
5514 in_core (const struct module *mod, uint64_t addr)
5515 {
5516 - return addr - (uint64_t) mod->module_core < mod->core_size;
5517 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
5518 }
5519
5520 static inline int
5521 @@ -683,7 +707,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
5522 break;
5523
5524 case RV_BDREL:
5525 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
5526 + if (in_init_rx(mod, val))
5527 + val -= (uint64_t) mod->module_init_rx;
5528 + else if (in_init_rw(mod, val))
5529 + val -= (uint64_t) mod->module_init_rw;
5530 + else if (in_core_rx(mod, val))
5531 + val -= (uint64_t) mod->module_core_rx;
5532 + else if (in_core_rw(mod, val))
5533 + val -= (uint64_t) mod->module_core_rw;
5534 break;
5535
5536 case RV_LTV:
5537 @@ -818,15 +849,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
5538 * addresses have been selected...
5539 */
5540 uint64_t gp;
5541 - if (mod->core_size > MAX_LTOFF)
5542 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
5543 /*
5544 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
5545 * at the end of the module.
5546 */
5547 - gp = mod->core_size - MAX_LTOFF / 2;
5548 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
5549 else
5550 - gp = mod->core_size / 2;
5551 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
5552 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
5553 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
5554 mod->arch.gp = gp;
5555 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
5556 }
5557 diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
5558 index c39c3cd..3c77738 100644
5559 --- a/arch/ia64/kernel/palinfo.c
5560 +++ b/arch/ia64/kernel/palinfo.c
5561 @@ -980,7 +980,7 @@ static int palinfo_cpu_callback(struct notifier_block *nfb,
5562 return NOTIFY_OK;
5563 }
5564
5565 -static struct notifier_block __refdata palinfo_cpu_notifier =
5566 +static struct notifier_block palinfo_cpu_notifier =
5567 {
5568 .notifier_call = palinfo_cpu_callback,
5569 .priority = 0,
5570 diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
5571 index 41e33f8..65180b2a 100644
5572 --- a/arch/ia64/kernel/sys_ia64.c
5573 +++ b/arch/ia64/kernel/sys_ia64.c
5574 @@ -28,6 +28,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
5575 unsigned long align_mask = 0;
5576 struct mm_struct *mm = current->mm;
5577 struct vm_unmapped_area_info info;
5578 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
5579
5580 if (len > RGN_MAP_LIMIT)
5581 return -ENOMEM;
5582 @@ -43,6 +44,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
5583 if (REGION_NUMBER(addr) == RGN_HPAGE)
5584 addr = 0;
5585 #endif
5586 +
5587 +#ifdef CONFIG_PAX_RANDMMAP
5588 + if (mm->pax_flags & MF_PAX_RANDMMAP)
5589 + addr = mm->free_area_cache;
5590 + else
5591 +#endif
5592 +
5593 if (!addr)
5594 addr = TASK_UNMAPPED_BASE;
5595
5596 @@ -61,6 +69,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
5597 info.high_limit = TASK_SIZE;
5598 info.align_mask = align_mask;
5599 info.align_offset = 0;
5600 + info.threadstack_offset = offset;
5601 return vm_unmapped_area(&info);
5602 }
5603
5604 diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
5605 index 84f8a52..7c76178 100644
5606 --- a/arch/ia64/kernel/vmlinux.lds.S
5607 +++ b/arch/ia64/kernel/vmlinux.lds.S
5608 @@ -192,7 +192,7 @@ SECTIONS {
5609 /* Per-cpu data: */
5610 . = ALIGN(PERCPU_PAGE_SIZE);
5611 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
5612 - __phys_per_cpu_start = __per_cpu_load;
5613 + __phys_per_cpu_start = per_cpu_load;
5614 /*
5615 * ensure percpu data fits
5616 * into percpu page size
5617 diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
5618 index ba5ba7a..36e9d3a 100644
5619 --- a/arch/ia64/mm/fault.c
5620 +++ b/arch/ia64/mm/fault.c
5621 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
5622 return pte_present(pte);
5623 }
5624
5625 +#ifdef CONFIG_PAX_PAGEEXEC
5626 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5627 +{
5628 + unsigned long i;
5629 +
5630 + printk(KERN_ERR "PAX: bytes at PC: ");
5631 + for (i = 0; i < 8; i++) {
5632 + unsigned int c;
5633 + if (get_user(c, (unsigned int *)pc+i))
5634 + printk(KERN_CONT "???????? ");
5635 + else
5636 + printk(KERN_CONT "%08x ", c);
5637 + }
5638 + printk("\n");
5639 +}
5640 +#endif
5641 +
5642 # define VM_READ_BIT 0
5643 # define VM_WRITE_BIT 1
5644 # define VM_EXEC_BIT 2
5645 @@ -151,8 +168,21 @@ retry:
5646 if (((isr >> IA64_ISR_R_BIT) & 1UL) && (!(vma->vm_flags & (VM_READ | VM_WRITE))))
5647 goto bad_area;
5648
5649 - if ((vma->vm_flags & mask) != mask)
5650 + if ((vma->vm_flags & mask) != mask) {
5651 +
5652 +#ifdef CONFIG_PAX_PAGEEXEC
5653 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
5654 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
5655 + goto bad_area;
5656 +
5657 + up_read(&mm->mmap_sem);
5658 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
5659 + do_group_exit(SIGKILL);
5660 + }
5661 +#endif
5662 +
5663 goto bad_area;
5664 + }
5665
5666 /*
5667 * If for any reason at all we couldn't handle the fault, make
5668 diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
5669 index 52b7604b..455cb85 100644
5670 --- a/arch/ia64/mm/hugetlbpage.c
5671 +++ b/arch/ia64/mm/hugetlbpage.c
5672 @@ -143,6 +143,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
5673 unsigned long pgoff, unsigned long flags)
5674 {
5675 struct vm_unmapped_area_info info;
5676 + unsigned long offset = gr_rand_threadstack_offset(current->mm, file, flags);
5677
5678 if (len > RGN_MAP_LIMIT)
5679 return -ENOMEM;
5680 @@ -166,6 +167,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
5681 info.high_limit = HPAGE_REGION_BASE + RGN_MAP_LIMIT;
5682 info.align_mask = PAGE_MASK & (HPAGE_SIZE - 1);
5683 info.align_offset = 0;
5684 + info.threadstack_offset = offset;
5685 return vm_unmapped_area(&info);
5686 }
5687
5688 diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
5689 index a9b65cf..49ae1cf 100644
5690 --- a/arch/ia64/mm/init.c
5691 +++ b/arch/ia64/mm/init.c
5692 @@ -120,6 +120,19 @@ ia64_init_addr_space (void)
5693 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
5694 vma->vm_end = vma->vm_start + PAGE_SIZE;
5695 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
5696 +
5697 +#ifdef CONFIG_PAX_PAGEEXEC
5698 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
5699 + vma->vm_flags &= ~VM_EXEC;
5700 +
5701 +#ifdef CONFIG_PAX_MPROTECT
5702 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
5703 + vma->vm_flags &= ~VM_MAYEXEC;
5704 +#endif
5705 +
5706 + }
5707 +#endif
5708 +
5709 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5710 down_write(&current->mm->mmap_sem);
5711 if (insert_vm_struct(current->mm, vma)) {
5712 @@ -286,7 +299,7 @@ static int __init gate_vma_init(void)
5713 gate_vma.vm_start = FIXADDR_USER_START;
5714 gate_vma.vm_end = FIXADDR_USER_END;
5715 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
5716 - gate_vma.vm_page_prot = __P101;
5717 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
5718
5719 return 0;
5720 }
5721 diff --git a/arch/m32r/include/asm/cache.h b/arch/m32r/include/asm/cache.h
5722 index 40b3ee98..8c2c112 100644
5723 --- a/arch/m32r/include/asm/cache.h
5724 +++ b/arch/m32r/include/asm/cache.h
5725 @@ -1,8 +1,10 @@
5726 #ifndef _ASM_M32R_CACHE_H
5727 #define _ASM_M32R_CACHE_H
5728
5729 +#include <linux/const.h>
5730 +
5731 /* L1 cache line size */
5732 #define L1_CACHE_SHIFT 4
5733 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5734 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5735
5736 #endif /* _ASM_M32R_CACHE_H */
5737 diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
5738 index 82abd15..d95ae5d 100644
5739 --- a/arch/m32r/lib/usercopy.c
5740 +++ b/arch/m32r/lib/usercopy.c
5741 @@ -14,6 +14,9 @@
5742 unsigned long
5743 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
5744 {
5745 + if ((long)n < 0)
5746 + return n;
5747 +
5748 prefetch(from);
5749 if (access_ok(VERIFY_WRITE, to, n))
5750 __copy_user(to,from,n);
5751 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
5752 unsigned long
5753 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
5754 {
5755 + if ((long)n < 0)
5756 + return n;
5757 +
5758 prefetchw(to);
5759 if (access_ok(VERIFY_READ, from, n))
5760 __copy_user_zeroing(to,from,n);
5761 diff --git a/arch/m68k/include/asm/cache.h b/arch/m68k/include/asm/cache.h
5762 index 0395c51..5f26031 100644
5763 --- a/arch/m68k/include/asm/cache.h
5764 +++ b/arch/m68k/include/asm/cache.h
5765 @@ -4,9 +4,11 @@
5766 #ifndef __ARCH_M68K_CACHE_H
5767 #define __ARCH_M68K_CACHE_H
5768
5769 +#include <linux/const.h>
5770 +
5771 /* bytes per L1 cache line */
5772 #define L1_CACHE_SHIFT 4
5773 -#define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT)
5774 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5775
5776 #define ARCH_DMA_MINALIGN L1_CACHE_BYTES
5777
5778 diff --git a/arch/metag/include/asm/barrier.h b/arch/metag/include/asm/barrier.h
5779 index d703d8e..a8e2d70 100644
5780 --- a/arch/metag/include/asm/barrier.h
5781 +++ b/arch/metag/include/asm/barrier.h
5782 @@ -90,7 +90,7 @@ static inline void fence(void)
5783 do { \
5784 compiletime_assert_atomic_type(*p); \
5785 smp_mb(); \
5786 - ACCESS_ONCE(*p) = (v); \
5787 + ACCESS_ONCE_RW(*p) = (v); \
5788 } while (0)
5789
5790 #define smp_load_acquire(p) \
5791 diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
5792 index 7ca80ac..794ba72 100644
5793 --- a/arch/metag/mm/hugetlbpage.c
5794 +++ b/arch/metag/mm/hugetlbpage.c
5795 @@ -194,6 +194,7 @@ hugetlb_get_unmapped_area_new_pmd(unsigned long len)
5796 info.high_limit = TASK_SIZE;
5797 info.align_mask = PAGE_MASK & HUGEPT_MASK;
5798 info.align_offset = 0;
5799 + info.threadstack_offset = 0;
5800 return vm_unmapped_area(&info);
5801 }
5802
5803 diff --git a/arch/microblaze/include/asm/cache.h b/arch/microblaze/include/asm/cache.h
5804 index 4efe96a..60e8699 100644
5805 --- a/arch/microblaze/include/asm/cache.h
5806 +++ b/arch/microblaze/include/asm/cache.h
5807 @@ -13,11 +13,12 @@
5808 #ifndef _ASM_MICROBLAZE_CACHE_H
5809 #define _ASM_MICROBLAZE_CACHE_H
5810
5811 +#include <linux/const.h>
5812 #include <asm/registers.h>
5813
5814 #define L1_CACHE_SHIFT 5
5815 /* word-granular cache in microblaze */
5816 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5817 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5818
5819 #define SMP_CACHE_BYTES L1_CACHE_BYTES
5820
5821 diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
5822 index f501665..b107753 100644
5823 --- a/arch/mips/Kconfig
5824 +++ b/arch/mips/Kconfig
5825 @@ -2585,6 +2585,7 @@ source "kernel/Kconfig.preempt"
5826
5827 config KEXEC
5828 bool "Kexec system call"
5829 + depends on !GRKERNSEC_KMEM
5830 help
5831 kexec is a system call that implements the ability to shutdown your
5832 current kernel, and to start another kernel. It is like a reboot
5833 diff --git a/arch/mips/cavium-octeon/dma-octeon.c b/arch/mips/cavium-octeon/dma-octeon.c
5834 index d8960d4..77dbd31 100644
5835 --- a/arch/mips/cavium-octeon/dma-octeon.c
5836 +++ b/arch/mips/cavium-octeon/dma-octeon.c
5837 @@ -199,7 +199,7 @@ static void octeon_dma_free_coherent(struct device *dev, size_t size,
5838 if (dma_release_from_coherent(dev, order, vaddr))
5839 return;
5840
5841 - swiotlb_free_coherent(dev, size, vaddr, dma_handle);
5842 + swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs);
5843 }
5844
5845 static dma_addr_t octeon_unity_phys_to_dma(struct device *dev, phys_addr_t paddr)
5846 diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
5847 index 26d4363..3c9a82e 100644
5848 --- a/arch/mips/include/asm/atomic.h
5849 +++ b/arch/mips/include/asm/atomic.h
5850 @@ -22,15 +22,39 @@
5851 #include <asm/cmpxchg.h>
5852 #include <asm/war.h>
5853
5854 +#ifdef CONFIG_GENERIC_ATOMIC64
5855 +#include <asm-generic/atomic64.h>
5856 +#endif
5857 +
5858 #define ATOMIC_INIT(i) { (i) }
5859
5860 +#ifdef CONFIG_64BIT
5861 +#define _ASM_EXTABLE(from, to) \
5862 +" .section __ex_table,\"a\"\n" \
5863 +" .dword " #from ", " #to"\n" \
5864 +" .previous\n"
5865 +#else
5866 +#define _ASM_EXTABLE(from, to) \
5867 +" .section __ex_table,\"a\"\n" \
5868 +" .word " #from ", " #to"\n" \
5869 +" .previous\n"
5870 +#endif
5871 +
5872 /*
5873 * atomic_read - read atomic variable
5874 * @v: pointer of type atomic_t
5875 *
5876 * Atomically reads the value of @v.
5877 */
5878 -#define atomic_read(v) ACCESS_ONCE((v)->counter)
5879 +static inline int atomic_read(const atomic_t *v)
5880 +{
5881 + return ACCESS_ONCE(v->counter);
5882 +}
5883 +
5884 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5885 +{
5886 + return ACCESS_ONCE(v->counter);
5887 +}
5888
5889 /*
5890 * atomic_set - set atomic variable
5891 @@ -39,47 +63,77 @@
5892 *
5893 * Atomically sets the value of @v to @i.
5894 */
5895 -#define atomic_set(v, i) ((v)->counter = (i))
5896 +static inline void atomic_set(atomic_t *v, int i)
5897 +{
5898 + v->counter = i;
5899 +}
5900
5901 -#define ATOMIC_OP(op, c_op, asm_op) \
5902 -static __inline__ void atomic_##op(int i, atomic_t * v) \
5903 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5904 +{
5905 + v->counter = i;
5906 +}
5907 +
5908 +#ifdef CONFIG_PAX_REFCOUNT
5909 +#define __OVERFLOW_POST \
5910 + " b 4f \n" \
5911 + " .set noreorder \n" \
5912 + "3: b 5f \n" \
5913 + " move %0, %1 \n" \
5914 + " .set reorder \n"
5915 +#define __OVERFLOW_EXTABLE \
5916 + "3:\n" \
5917 + _ASM_EXTABLE(2b, 3b)
5918 +#else
5919 +#define __OVERFLOW_POST
5920 +#define __OVERFLOW_EXTABLE
5921 +#endif
5922 +
5923 +#define __ATOMIC_OP(op, suffix, asm_op, extable) \
5924 +static inline void atomic_##op##suffix(int i, atomic##suffix##_t * v) \
5925 { \
5926 if (kernel_uses_llsc && R10000_LLSC_WAR) { \
5927 int temp; \
5928 \
5929 __asm__ __volatile__( \
5930 - " .set arch=r4000 \n" \
5931 - "1: ll %0, %1 # atomic_" #op " \n" \
5932 - " " #asm_op " %0, %2 \n" \
5933 + " .set mips3 \n" \
5934 + "1: ll %0, %1 # atomic_" #op #suffix "\n" \
5935 + "2: " #asm_op " %0, %2 \n" \
5936 " sc %0, %1 \n" \
5937 " beqzl %0, 1b \n" \
5938 + extable \
5939 " .set mips0 \n" \
5940 : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
5941 : "Ir" (i)); \
5942 } else if (kernel_uses_llsc) { \
5943 int temp; \
5944 \
5945 - do { \
5946 - __asm__ __volatile__( \
5947 - " .set "MIPS_ISA_LEVEL" \n" \
5948 - " ll %0, %1 # atomic_" #op "\n" \
5949 - " " #asm_op " %0, %2 \n" \
5950 - " sc %0, %1 \n" \
5951 - " .set mips0 \n" \
5952 - : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
5953 - : "Ir" (i)); \
5954 - } while (unlikely(!temp)); \
5955 + __asm__ __volatile__( \
5956 + " .set "MIPS_ISA_LEVEL" \n" \
5957 + "1: ll %0, %1 # atomic_" #op #suffix "\n" \
5958 + "2: " #asm_op " %0, %2 \n" \
5959 + " sc %0, %1 \n" \
5960 + " beqz %0, 1b \n" \
5961 + extable \
5962 + " .set mips0 \n" \
5963 + : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
5964 + : "Ir" (i)); \
5965 } else { \
5966 unsigned long flags; \
5967 \
5968 raw_local_irq_save(flags); \
5969 - v->counter c_op i; \
5970 + __asm__ __volatile__( \
5971 + "2: " #asm_op " %0, %1 \n" \
5972 + extable \
5973 + : "+r" (v->counter) : "Ir" (i)); \
5974 raw_local_irq_restore(flags); \
5975 } \
5976 }
5977
5978 -#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
5979 -static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
5980 +#define ATOMIC_OP(op, asm_op) __ATOMIC_OP(op, _unchecked, asm_op##u, ) \
5981 + __ATOMIC_OP(op, , asm_op, __OVERFLOW_EXTABLE)
5982 +
5983 +#define __ATOMIC_OP_RETURN(op, suffix, asm_op, post_op, extable) \
5984 +static inline int atomic_##op##_return##suffix(int i, atomic##suffix##_t * v) \
5985 { \
5986 int result; \
5987 \
5988 @@ -89,12 +143,15 @@ static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
5989 int temp; \
5990 \
5991 __asm__ __volatile__( \
5992 - " .set arch=r4000 \n" \
5993 - "1: ll %1, %2 # atomic_" #op "_return \n" \
5994 - " " #asm_op " %0, %1, %3 \n" \
5995 + " .set mips3 \n" \
5996 + "1: ll %1, %2 # atomic_" #op "_return" #suffix"\n" \
5997 + "2: " #asm_op " %0, %1, %3 \n" \
5998 " sc %0, %2 \n" \
5999 " beqzl %0, 1b \n" \
6000 - " " #asm_op " %0, %1, %3 \n" \
6001 + post_op \
6002 + extable \
6003 + "4: " #asm_op " %0, %1, %3 \n" \
6004 + "5: \n" \
6005 " .set mips0 \n" \
6006 : "=&r" (result), "=&r" (temp), \
6007 "+" GCC_OFF_SMALL_ASM() (v->counter) \
6008 @@ -102,26 +159,33 @@ static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
6009 } else if (kernel_uses_llsc) { \
6010 int temp; \
6011 \
6012 - do { \
6013 - __asm__ __volatile__( \
6014 - " .set "MIPS_ISA_LEVEL" \n" \
6015 - " ll %1, %2 # atomic_" #op "_return \n" \
6016 - " " #asm_op " %0, %1, %3 \n" \
6017 - " sc %0, %2 \n" \
6018 - " .set mips0 \n" \
6019 - : "=&r" (result), "=&r" (temp), \
6020 - "+" GCC_OFF_SMALL_ASM() (v->counter) \
6021 - : "Ir" (i)); \
6022 - } while (unlikely(!result)); \
6023 + __asm__ __volatile__( \
6024 + " .set "MIPS_ISA_LEVEL" \n" \
6025 + "1: ll %1, %2 # atomic_" #op "_return" #suffix "\n" \
6026 + "2: " #asm_op " %0, %1, %3 \n" \
6027 + " sc %0, %2 \n" \
6028 + post_op \
6029 + extable \
6030 + "4: " #asm_op " %0, %1, %3 \n" \
6031 + "5: \n" \
6032 + " .set mips0 \n" \
6033 + : "=&r" (result), "=&r" (temp), \
6034 + "+" GCC_OFF_SMALL_ASM() (v->counter) \
6035 + : "Ir" (i)); \
6036 \
6037 result = temp; result c_op i; \
6038 } else { \
6039 unsigned long flags; \
6040 \
6041 raw_local_irq_save(flags); \
6042 - result = v->counter; \
6043 - result c_op i; \
6044 - v->counter = result; \
6045 + __asm__ __volatile__( \
6046 + " lw %0, %1 \n" \
6047 + "2: " #asm_op " %0, %1, %2 \n" \
6048 + " sw %0, %1 \n" \
6049 + "3: \n" \
6050 + extable \
6051 + : "=&r" (result), "+" GCC_OFF_SMALL_ASM() (v->counter) \
6052 + : "Ir" (i)); \
6053 raw_local_irq_restore(flags); \
6054 } \
6055 \
6056 @@ -130,16 +194,21 @@ static __inline__ int atomic_##op##_return(int i, atomic_t * v) \
6057 return result; \
6058 }
6059
6060 -#define ATOMIC_OPS(op, c_op, asm_op) \
6061 - ATOMIC_OP(op, c_op, asm_op) \
6062 - ATOMIC_OP_RETURN(op, c_op, asm_op)
6063 +#define ATOMIC_OP_RETURN(op, asm_op) __ATOMIC_OP_RETURN(op, _unchecked, asm_op##u, , ) \
6064 + __ATOMIC_OP_RETURN(op, , asm_op, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
6065
6066 -ATOMIC_OPS(add, +=, addu)
6067 -ATOMIC_OPS(sub, -=, subu)
6068 +#define ATOMIC_OPS(op, asm_op) \
6069 + ATOMIC_OP(op, asm_op) \
6070 + ATOMIC_OP_RETURN(op, asm_op)
6071 +
6072 +ATOMIC_OPS(add, add)
6073 +ATOMIC_OPS(sub, sub)
6074
6075 #undef ATOMIC_OPS
6076 #undef ATOMIC_OP_RETURN
6077 +#undef __ATOMIC_OP_RETURN
6078 #undef ATOMIC_OP
6079 +#undef __ATOMIC_OP
6080
6081 /*
6082 * atomic_sub_if_positive - conditionally subtract integer from atomic variable
6083 @@ -149,7 +218,7 @@ ATOMIC_OPS(sub, -=, subu)
6084 * Atomically test @v and subtract @i if @v is greater or equal than @i.
6085 * The function returns the old value of @v minus @i.
6086 */
6087 -static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
6088 +static __inline__ int atomic_sub_if_positive(int i, atomic_t *v)
6089 {
6090 int result;
6091
6092 @@ -159,7 +228,7 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
6093 int temp;
6094
6095 __asm__ __volatile__(
6096 - " .set arch=r4000 \n"
6097 + " .set "MIPS_ISA_LEVEL" \n"
6098 "1: ll %1, %2 # atomic_sub_if_positive\n"
6099 " subu %0, %1, %3 \n"
6100 " bltz %0, 1f \n"
6101 @@ -208,8 +277,26 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
6102 return result;
6103 }
6104
6105 -#define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
6106 -#define atomic_xchg(v, new) (xchg(&((v)->counter), (new)))
6107 +static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
6108 +{
6109 + return cmpxchg(&v->counter, old, new);
6110 +}
6111 +
6112 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old,
6113 + int new)
6114 +{
6115 + return cmpxchg(&(v->counter), old, new);
6116 +}
6117 +
6118 +static inline int atomic_xchg(atomic_t *v, int new)
6119 +{
6120 + return xchg(&v->counter, new);
6121 +}
6122 +
6123 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
6124 +{
6125 + return xchg(&(v->counter), new);
6126 +}
6127
6128 /**
6129 * __atomic_add_unless - add unless the number is a given value
6130 @@ -237,6 +324,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6131
6132 #define atomic_dec_return(v) atomic_sub_return(1, (v))
6133 #define atomic_inc_return(v) atomic_add_return(1, (v))
6134 +static __inline__ int atomic_inc_return_unchecked(atomic_unchecked_t *v)
6135 +{
6136 + return atomic_add_return_unchecked(1, v);
6137 +}
6138
6139 /*
6140 * atomic_sub_and_test - subtract value from variable and test result
6141 @@ -258,6 +349,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6142 * other cases.
6143 */
6144 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
6145 +static __inline__ int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
6146 +{
6147 + return atomic_add_return_unchecked(1, v) == 0;
6148 +}
6149
6150 /*
6151 * atomic_dec_and_test - decrement by 1 and test
6152 @@ -282,6 +377,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6153 * Atomically increments @v by 1.
6154 */
6155 #define atomic_inc(v) atomic_add(1, (v))
6156 +static __inline__ void atomic_inc_unchecked(atomic_unchecked_t *v)
6157 +{
6158 + atomic_add_unchecked(1, v);
6159 +}
6160
6161 /*
6162 * atomic_dec - decrement and test
6163 @@ -290,6 +389,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6164 * Atomically decrements @v by 1.
6165 */
6166 #define atomic_dec(v) atomic_sub(1, (v))
6167 +static __inline__ void atomic_dec_unchecked(atomic_unchecked_t *v)
6168 +{
6169 + atomic_sub_unchecked(1, v);
6170 +}
6171
6172 /*
6173 * atomic_add_negative - add and test if negative
6174 @@ -311,54 +414,77 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6175 * @v: pointer of type atomic64_t
6176 *
6177 */
6178 -#define atomic64_read(v) ACCESS_ONCE((v)->counter)
6179 +static inline long atomic64_read(const atomic64_t *v)
6180 +{
6181 + return ACCESS_ONCE(v->counter);
6182 +}
6183 +
6184 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
6185 +{
6186 + return ACCESS_ONCE(v->counter);
6187 +}
6188
6189 /*
6190 * atomic64_set - set atomic variable
6191 * @v: pointer of type atomic64_t
6192 * @i: required value
6193 */
6194 -#define atomic64_set(v, i) ((v)->counter = (i))
6195 +static inline void atomic64_set(atomic64_t *v, long i)
6196 +{
6197 + v->counter = i;
6198 +}
6199
6200 -#define ATOMIC64_OP(op, c_op, asm_op) \
6201 -static __inline__ void atomic64_##op(long i, atomic64_t * v) \
6202 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
6203 +{
6204 + v->counter = i;
6205 +}
6206 +
6207 +#define __ATOMIC64_OP(op, suffix, asm_op, extable) \
6208 +static inline void atomic64_##op##suffix(long i, atomic64##suffix##_t * v) \
6209 { \
6210 if (kernel_uses_llsc && R10000_LLSC_WAR) { \
6211 long temp; \
6212 \
6213 __asm__ __volatile__( \
6214 - " .set arch=r4000 \n" \
6215 - "1: lld %0, %1 # atomic64_" #op " \n" \
6216 - " " #asm_op " %0, %2 \n" \
6217 + " .set "MIPS_ISA_LEVEL" \n" \
6218 + "1: lld %0, %1 # atomic64_" #op #suffix "\n" \
6219 + "2: " #asm_op " %0, %2 \n" \
6220 " scd %0, %1 \n" \
6221 " beqzl %0, 1b \n" \
6222 + extable \
6223 " .set mips0 \n" \
6224 : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
6225 : "Ir" (i)); \
6226 } else if (kernel_uses_llsc) { \
6227 long temp; \
6228 \
6229 - do { \
6230 - __asm__ __volatile__( \
6231 - " .set "MIPS_ISA_LEVEL" \n" \
6232 - " lld %0, %1 # atomic64_" #op "\n" \
6233 - " " #asm_op " %0, %2 \n" \
6234 - " scd %0, %1 \n" \
6235 - " .set mips0 \n" \
6236 - : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
6237 - : "Ir" (i)); \
6238 - } while (unlikely(!temp)); \
6239 + __asm__ __volatile__( \
6240 + " .set "MIPS_ISA_LEVEL" \n" \
6241 + "1: lld %0, %1 # atomic64_" #op #suffix "\n" \
6242 + "2: " #asm_op " %0, %2 \n" \
6243 + " scd %0, %1 \n" \
6244 + " beqz %0, 1b \n" \
6245 + extable \
6246 + " .set mips0 \n" \
6247 + : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
6248 + : "Ir" (i)); \
6249 } else { \
6250 unsigned long flags; \
6251 \
6252 raw_local_irq_save(flags); \
6253 - v->counter c_op i; \
6254 + __asm__ __volatile__( \
6255 + "2: " #asm_op " %0, %1 \n" \
6256 + extable \
6257 + : "+" GCC_OFF_SMALL_ASM() (v->counter) : "Ir" (i)); \
6258 raw_local_irq_restore(flags); \
6259 } \
6260 }
6261
6262 -#define ATOMIC64_OP_RETURN(op, c_op, asm_op) \
6263 -static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
6264 +#define ATOMIC64_OP(op, asm_op) __ATOMIC64_OP(op, _unchecked, asm_op##u, ) \
6265 + __ATOMIC64_OP(op, , asm_op, __OVERFLOW_EXTABLE)
6266 +
6267 +#define __ATOMIC64_OP_RETURN(op, suffix, asm_op, post_op, extable) \
6268 +static inline long atomic64_##op##_return##suffix(long i, atomic64##suffix##_t * v)\
6269 { \
6270 long result; \
6271 \
6272 @@ -368,12 +494,15 @@ static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
6273 long temp; \
6274 \
6275 __asm__ __volatile__( \
6276 - " .set arch=r4000 \n" \
6277 + " .set mips3 \n" \
6278 "1: lld %1, %2 # atomic64_" #op "_return\n" \
6279 - " " #asm_op " %0, %1, %3 \n" \
6280 + "2: " #asm_op " %0, %1, %3 \n" \
6281 " scd %0, %2 \n" \
6282 " beqzl %0, 1b \n" \
6283 - " " #asm_op " %0, %1, %3 \n" \
6284 + post_op \
6285 + extable \
6286 + "4: " #asm_op " %0, %1, %3 \n" \
6287 + "5: \n" \
6288 " .set mips0 \n" \
6289 : "=&r" (result), "=&r" (temp), \
6290 "+" GCC_OFF_SMALL_ASM() (v->counter) \
6291 @@ -381,27 +510,35 @@ static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
6292 } else if (kernel_uses_llsc) { \
6293 long temp; \
6294 \
6295 - do { \
6296 - __asm__ __volatile__( \
6297 - " .set "MIPS_ISA_LEVEL" \n" \
6298 - " lld %1, %2 # atomic64_" #op "_return\n" \
6299 - " " #asm_op " %0, %1, %3 \n" \
6300 - " scd %0, %2 \n" \
6301 - " .set mips0 \n" \
6302 - : "=&r" (result), "=&r" (temp), \
6303 - "=" GCC_OFF_SMALL_ASM() (v->counter) \
6304 - : "Ir" (i), GCC_OFF_SMALL_ASM() (v->counter) \
6305 - : "memory"); \
6306 - } while (unlikely(!result)); \
6307 + __asm__ __volatile__( \
6308 + " .set "MIPS_ISA_LEVEL" \n" \
6309 + "1: lld %1, %2 # atomic64_" #op "_return" #suffix "\n"\
6310 + "2: " #asm_op " %0, %1, %3 \n" \
6311 + " scd %0, %2 \n" \
6312 + " beqz %0, 1b \n" \
6313 + post_op \
6314 + extable \
6315 + "4: " #asm_op " %0, %1, %3 \n" \
6316 + "5: \n" \
6317 + " .set mips0 \n" \
6318 + : "=&r" (result), "=&r" (temp), \
6319 + "=" GCC_OFF_SMALL_ASM() (v->counter) \
6320 + : "Ir" (i), GCC_OFF_SMALL_ASM() (v->counter) \
6321 + : "memory"); \
6322 \
6323 result = temp; result c_op i; \
6324 } else { \
6325 unsigned long flags; \
6326 \
6327 raw_local_irq_save(flags); \
6328 - result = v->counter; \
6329 - result c_op i; \
6330 - v->counter = result; \
6331 + __asm__ __volatile__( \
6332 + " ld %0, %1 \n" \
6333 + "2: " #asm_op " %0, %1, %2 \n" \
6334 + " sd %0, %1 \n" \
6335 + "3: \n" \
6336 + extable \
6337 + : "=&r" (result), "+" GCC_OFF_SMALL_ASM() (v->counter) \
6338 + : "Ir" (i)); \
6339 raw_local_irq_restore(flags); \
6340 } \
6341 \
6342 @@ -410,16 +547,23 @@ static __inline__ long atomic64_##op##_return(long i, atomic64_t * v) \
6343 return result; \
6344 }
6345
6346 -#define ATOMIC64_OPS(op, c_op, asm_op) \
6347 - ATOMIC64_OP(op, c_op, asm_op) \
6348 - ATOMIC64_OP_RETURN(op, c_op, asm_op)
6349 +#define ATOMIC64_OP_RETURN(op, asm_op) __ATOMIC64_OP_RETURN(op, _unchecked, asm_op##u, , ) \
6350 + __ATOMIC64_OP_RETURN(op, , asm_op, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
6351
6352 -ATOMIC64_OPS(add, +=, daddu)
6353 -ATOMIC64_OPS(sub, -=, dsubu)
6354 +#define ATOMIC64_OPS(op, asm_op) \
6355 + ATOMIC64_OP(op, asm_op) \
6356 + ATOMIC64_OP_RETURN(op, asm_op)
6357 +
6358 +ATOMIC64_OPS(add, dadd)
6359 +ATOMIC64_OPS(sub, dsub)
6360
6361 #undef ATOMIC64_OPS
6362 #undef ATOMIC64_OP_RETURN
6363 +#undef __ATOMIC64_OP_RETURN
6364 #undef ATOMIC64_OP
6365 +#undef __ATOMIC64_OP
6366 +#undef __OVERFLOW_EXTABLE
6367 +#undef __OVERFLOW_POST
6368
6369 /*
6370 * atomic64_sub_if_positive - conditionally subtract integer from atomic
6371 @@ -430,7 +574,7 @@ ATOMIC64_OPS(sub, -=, dsubu)
6372 * Atomically test @v and subtract @i if @v is greater or equal than @i.
6373 * The function returns the old value of @v minus @i.
6374 */
6375 -static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
6376 +static __inline__ long atomic64_sub_if_positive(long i, atomic64_t *v)
6377 {
6378 long result;
6379
6380 @@ -440,7 +584,7 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
6381 long temp;
6382
6383 __asm__ __volatile__(
6384 - " .set arch=r4000 \n"
6385 + " .set "MIPS_ISA_LEVEL" \n"
6386 "1: lld %1, %2 # atomic64_sub_if_positive\n"
6387 " dsubu %0, %1, %3 \n"
6388 " bltz %0, 1f \n"
6389 @@ -489,9 +633,26 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
6390 return result;
6391 }
6392
6393 -#define atomic64_cmpxchg(v, o, n) \
6394 - ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
6395 -#define atomic64_xchg(v, new) (xchg(&((v)->counter), (new)))
6396 +static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
6397 +{
6398 + return cmpxchg(&v->counter, old, new);
6399 +}
6400 +
6401 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old,
6402 + long new)
6403 +{
6404 + return cmpxchg(&(v->counter), old, new);
6405 +}
6406 +
6407 +static inline long atomic64_xchg(atomic64_t *v, long new)
6408 +{
6409 + return xchg(&v->counter, new);
6410 +}
6411 +
6412 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
6413 +{
6414 + return xchg(&(v->counter), new);
6415 +}
6416
6417 /**
6418 * atomic64_add_unless - add unless the number is a given value
6419 @@ -521,6 +682,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6420
6421 #define atomic64_dec_return(v) atomic64_sub_return(1, (v))
6422 #define atomic64_inc_return(v) atomic64_add_return(1, (v))
6423 +#define atomic64_inc_return_unchecked(v) atomic64_add_return_unchecked(1, (v))
6424
6425 /*
6426 * atomic64_sub_and_test - subtract value from variable and test result
6427 @@ -542,6 +704,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6428 * other cases.
6429 */
6430 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
6431 +#define atomic64_inc_and_test_unchecked(v) atomic64_add_return_unchecked(1, (v)) == 0)
6432
6433 /*
6434 * atomic64_dec_and_test - decrement by 1 and test
6435 @@ -566,6 +729,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6436 * Atomically increments @v by 1.
6437 */
6438 #define atomic64_inc(v) atomic64_add(1, (v))
6439 +#define atomic64_inc_unchecked(v) atomic64_add_unchecked(1, (v))
6440
6441 /*
6442 * atomic64_dec - decrement and test
6443 @@ -574,6 +738,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6444 * Atomically decrements @v by 1.
6445 */
6446 #define atomic64_dec(v) atomic64_sub(1, (v))
6447 +#define atomic64_dec_unchecked(v) atomic64_sub_unchecked(1, (v))
6448
6449 /*
6450 * atomic64_add_negative - add and test if negative
6451 diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h
6452 index 2b8bbbc..4556df6 100644
6453 --- a/arch/mips/include/asm/barrier.h
6454 +++ b/arch/mips/include/asm/barrier.h
6455 @@ -133,7 +133,7 @@
6456 do { \
6457 compiletime_assert_atomic_type(*p); \
6458 smp_mb(); \
6459 - ACCESS_ONCE(*p) = (v); \
6460 + ACCESS_ONCE_RW(*p) = (v); \
6461 } while (0)
6462
6463 #define smp_load_acquire(p) \
6464 diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
6465 index b4db69f..8f3b093 100644
6466 --- a/arch/mips/include/asm/cache.h
6467 +++ b/arch/mips/include/asm/cache.h
6468 @@ -9,10 +9,11 @@
6469 #ifndef _ASM_CACHE_H
6470 #define _ASM_CACHE_H
6471
6472 +#include <linux/const.h>
6473 #include <kmalloc.h>
6474
6475 #define L1_CACHE_SHIFT CONFIG_MIPS_L1_CACHE_SHIFT
6476 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
6477 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
6478
6479 #define SMP_CACHE_SHIFT L1_CACHE_SHIFT
6480 #define SMP_CACHE_BYTES L1_CACHE_BYTES
6481 diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
6482 index f19e890..a4f8177 100644
6483 --- a/arch/mips/include/asm/elf.h
6484 +++ b/arch/mips/include/asm/elf.h
6485 @@ -417,6 +417,13 @@ extern const char *__elf_platform;
6486 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
6487 #endif
6488
6489 +#ifdef CONFIG_PAX_ASLR
6490 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
6491 +
6492 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6493 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6494 +#endif
6495 +
6496 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
6497 struct linux_binprm;
6498 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
6499 diff --git a/arch/mips/include/asm/exec.h b/arch/mips/include/asm/exec.h
6500 index c1f6afa..38cc6e9 100644
6501 --- a/arch/mips/include/asm/exec.h
6502 +++ b/arch/mips/include/asm/exec.h
6503 @@ -12,6 +12,6 @@
6504 #ifndef _ASM_EXEC_H
6505 #define _ASM_EXEC_H
6506
6507 -extern unsigned long arch_align_stack(unsigned long sp);
6508 +#define arch_align_stack(x) ((x) & ~0xfUL)
6509
6510 #endif /* _ASM_EXEC_H */
6511 diff --git a/arch/mips/include/asm/hw_irq.h b/arch/mips/include/asm/hw_irq.h
6512 index 9e8ef59..1139d6b 100644
6513 --- a/arch/mips/include/asm/hw_irq.h
6514 +++ b/arch/mips/include/asm/hw_irq.h
6515 @@ -10,7 +10,7 @@
6516
6517 #include <linux/atomic.h>
6518
6519 -extern atomic_t irq_err_count;
6520 +extern atomic_unchecked_t irq_err_count;
6521
6522 /*
6523 * interrupt-retrigger: NOP for now. This may not be appropriate for all
6524 diff --git a/arch/mips/include/asm/local.h b/arch/mips/include/asm/local.h
6525 index 8feaed6..1bd8a64 100644
6526 --- a/arch/mips/include/asm/local.h
6527 +++ b/arch/mips/include/asm/local.h
6528 @@ -13,15 +13,25 @@ typedef struct
6529 atomic_long_t a;
6530 } local_t;
6531
6532 +typedef struct {
6533 + atomic_long_unchecked_t a;
6534 +} local_unchecked_t;
6535 +
6536 #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
6537
6538 #define local_read(l) atomic_long_read(&(l)->a)
6539 +#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
6540 #define local_set(l, i) atomic_long_set(&(l)->a, (i))
6541 +#define local_set_unchecked(l, i) atomic_long_set_unchecked(&(l)->a, (i))
6542
6543 #define local_add(i, l) atomic_long_add((i), (&(l)->a))
6544 +#define local_add_unchecked(i, l) atomic_long_add_unchecked((i), (&(l)->a))
6545 #define local_sub(i, l) atomic_long_sub((i), (&(l)->a))
6546 +#define local_sub_unchecked(i, l) atomic_long_sub_unchecked((i), (&(l)->a))
6547 #define local_inc(l) atomic_long_inc(&(l)->a)
6548 +#define local_inc_unchecked(l) atomic_long_inc_unchecked(&(l)->a)
6549 #define local_dec(l) atomic_long_dec(&(l)->a)
6550 +#define local_dec_unchecked(l) atomic_long_dec_unchecked(&(l)->a)
6551
6552 /*
6553 * Same as above, but return the result value
6554 @@ -71,6 +81,51 @@ static __inline__ long local_add_return(long i, local_t * l)
6555 return result;
6556 }
6557
6558 +static __inline__ long local_add_return_unchecked(long i, local_unchecked_t * l)
6559 +{
6560 + unsigned long result;
6561 +
6562 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
6563 + unsigned long temp;
6564 +
6565 + __asm__ __volatile__(
6566 + " .set mips3 \n"
6567 + "1:" __LL "%1, %2 # local_add_return \n"
6568 + " addu %0, %1, %3 \n"
6569 + __SC "%0, %2 \n"
6570 + " beqzl %0, 1b \n"
6571 + " addu %0, %1, %3 \n"
6572 + " .set mips0 \n"
6573 + : "=&r" (result), "=&r" (temp), "=m" (l->a.counter)
6574 + : "Ir" (i), "m" (l->a.counter)
6575 + : "memory");
6576 + } else if (kernel_uses_llsc) {
6577 + unsigned long temp;
6578 +
6579 + __asm__ __volatile__(
6580 + " .set mips3 \n"
6581 + "1:" __LL "%1, %2 # local_add_return \n"
6582 + " addu %0, %1, %3 \n"
6583 + __SC "%0, %2 \n"
6584 + " beqz %0, 1b \n"
6585 + " addu %0, %1, %3 \n"
6586 + " .set mips0 \n"
6587 + : "=&r" (result), "=&r" (temp), "=m" (l->a.counter)
6588 + : "Ir" (i), "m" (l->a.counter)
6589 + : "memory");
6590 + } else {
6591 + unsigned long flags;
6592 +
6593 + local_irq_save(flags);
6594 + result = l->a.counter;
6595 + result += i;
6596 + l->a.counter = result;
6597 + local_irq_restore(flags);
6598 + }
6599 +
6600 + return result;
6601 +}
6602 +
6603 static __inline__ long local_sub_return(long i, local_t * l)
6604 {
6605 unsigned long result;
6606 @@ -118,6 +173,8 @@ static __inline__ long local_sub_return(long i, local_t * l)
6607
6608 #define local_cmpxchg(l, o, n) \
6609 ((long)cmpxchg_local(&((l)->a.counter), (o), (n)))
6610 +#define local_cmpxchg_unchecked(l, o, n) \
6611 + ((long)cmpxchg_local(&((l)->a.counter), (o), (n)))
6612 #define local_xchg(l, n) (atomic_long_xchg((&(l)->a), (n)))
6613
6614 /**
6615 diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
6616 index 89dd7fe..a123c97 100644
6617 --- a/arch/mips/include/asm/page.h
6618 +++ b/arch/mips/include/asm/page.h
6619 @@ -118,7 +118,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
6620 #ifdef CONFIG_CPU_MIPS32
6621 typedef struct { unsigned long pte_low, pte_high; } pte_t;
6622 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
6623 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
6624 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
6625 #else
6626 typedef struct { unsigned long long pte; } pte_t;
6627 #define pte_val(x) ((x).pte)
6628 diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
6629 index b336037..5b874cc 100644
6630 --- a/arch/mips/include/asm/pgalloc.h
6631 +++ b/arch/mips/include/asm/pgalloc.h
6632 @@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
6633 {
6634 set_pud(pud, __pud((unsigned long)pmd));
6635 }
6636 +
6637 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
6638 +{
6639 + pud_populate(mm, pud, pmd);
6640 +}
6641 #endif
6642
6643 /*
6644 diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
6645 index 819af9d..439839d 100644
6646 --- a/arch/mips/include/asm/pgtable.h
6647 +++ b/arch/mips/include/asm/pgtable.h
6648 @@ -20,6 +20,9 @@
6649 #include <asm/io.h>
6650 #include <asm/pgtable-bits.h>
6651
6652 +#define ktla_ktva(addr) (addr)
6653 +#define ktva_ktla(addr) (addr)
6654 +
6655 struct mm_struct;
6656 struct vm_area_struct;
6657
6658 diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
6659 index 9c0014e..5101ef5 100644
6660 --- a/arch/mips/include/asm/thread_info.h
6661 +++ b/arch/mips/include/asm/thread_info.h
6662 @@ -100,6 +100,9 @@ static inline struct thread_info *current_thread_info(void)
6663 #define TIF_SECCOMP 4 /* secure computing */
6664 #define TIF_NOTIFY_RESUME 5 /* callback before returning to user */
6665 #define TIF_RESTORE_SIGMASK 9 /* restore signal mask in do_signal() */
6666 +/* li takes a 32bit immediate */
6667 +#define TIF_GRSEC_SETXID 10 /* update credentials on syscall entry/exit */
6668 +
6669 #define TIF_USEDFPU 16 /* FPU was used by this task this quantum (SMP) */
6670 #define TIF_MEMDIE 18 /* is terminating due to OOM killer */
6671 #define TIF_NOHZ 19 /* in adaptive nohz mode */
6672 @@ -135,14 +138,16 @@ static inline struct thread_info *current_thread_info(void)
6673 #define _TIF_USEDMSA (1<<TIF_USEDMSA)
6674 #define _TIF_MSA_CTX_LIVE (1<<TIF_MSA_CTX_LIVE)
6675 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
6676 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
6677
6678 #define _TIF_WORK_SYSCALL_ENTRY (_TIF_NOHZ | _TIF_SYSCALL_TRACE | \
6679 _TIF_SYSCALL_AUDIT | \
6680 - _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP)
6681 + _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | \
6682 + _TIF_GRSEC_SETXID)
6683
6684 /* work to do in syscall_trace_leave() */
6685 #define _TIF_WORK_SYSCALL_EXIT (_TIF_NOHZ | _TIF_SYSCALL_TRACE | \
6686 - _TIF_SYSCALL_AUDIT | _TIF_SYSCALL_TRACEPOINT)
6687 + _TIF_SYSCALL_AUDIT | _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
6688
6689 /* work to do on interrupt/exception return */
6690 #define _TIF_WORK_MASK \
6691 @@ -150,7 +155,7 @@ static inline struct thread_info *current_thread_info(void)
6692 /* work to do on any return to u-space */
6693 #define _TIF_ALLWORK_MASK (_TIF_NOHZ | _TIF_WORK_MASK | \
6694 _TIF_WORK_SYSCALL_EXIT | \
6695 - _TIF_SYSCALL_TRACEPOINT)
6696 + _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
6697
6698 /*
6699 * We stash processor id into a COP0 register to retrieve it fast
6700 diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
6701 index bf8b324..cec5705 100644
6702 --- a/arch/mips/include/asm/uaccess.h
6703 +++ b/arch/mips/include/asm/uaccess.h
6704 @@ -130,6 +130,7 @@ extern u64 __ua_limit;
6705 __ok == 0; \
6706 })
6707
6708 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
6709 #define access_ok(type, addr, size) \
6710 likely(__access_ok((addr), (size), __access_mask))
6711
6712 diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
6713 index 1188e00..41cf144 100644
6714 --- a/arch/mips/kernel/binfmt_elfn32.c
6715 +++ b/arch/mips/kernel/binfmt_elfn32.c
6716 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
6717 #undef ELF_ET_DYN_BASE
6718 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
6719
6720 +#ifdef CONFIG_PAX_ASLR
6721 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
6722 +
6723 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6724 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6725 +#endif
6726 +
6727 #include <asm/processor.h>
6728 #include <linux/module.h>
6729 #include <linux/elfcore.h>
6730 diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
6731 index 9287678..f870e47 100644
6732 --- a/arch/mips/kernel/binfmt_elfo32.c
6733 +++ b/arch/mips/kernel/binfmt_elfo32.c
6734 @@ -70,6 +70,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
6735 #undef ELF_ET_DYN_BASE
6736 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
6737
6738 +#ifdef CONFIG_PAX_ASLR
6739 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
6740 +
6741 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6742 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6743 +#endif
6744 +
6745 #include <asm/processor.h>
6746
6747 #include <linux/module.h>
6748 diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
6749 index a74ec3a..4f06f18 100644
6750 --- a/arch/mips/kernel/i8259.c
6751 +++ b/arch/mips/kernel/i8259.c
6752 @@ -202,7 +202,7 @@ spurious_8259A_irq:
6753 printk(KERN_DEBUG "spurious 8259A interrupt: IRQ%d.\n", irq);
6754 spurious_irq_mask |= irqmask;
6755 }
6756 - atomic_inc(&irq_err_count);
6757 + atomic_inc_unchecked(&irq_err_count);
6758 /*
6759 * Theoretically we do not have to handle this IRQ,
6760 * but in Linux this does not cause problems and is
6761 diff --git a/arch/mips/kernel/irq-gt641xx.c b/arch/mips/kernel/irq-gt641xx.c
6762 index 44a1f79..2bd6aa3 100644
6763 --- a/arch/mips/kernel/irq-gt641xx.c
6764 +++ b/arch/mips/kernel/irq-gt641xx.c
6765 @@ -110,7 +110,7 @@ void gt641xx_irq_dispatch(void)
6766 }
6767 }
6768
6769 - atomic_inc(&irq_err_count);
6770 + atomic_inc_unchecked(&irq_err_count);
6771 }
6772
6773 void __init gt641xx_irq_init(void)
6774 diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
6775 index 3c8a18a..b4929b6 100644
6776 --- a/arch/mips/kernel/irq.c
6777 +++ b/arch/mips/kernel/irq.c
6778 @@ -76,17 +76,17 @@ void ack_bad_irq(unsigned int irq)
6779 printk("unexpected IRQ # %d\n", irq);
6780 }
6781
6782 -atomic_t irq_err_count;
6783 +atomic_unchecked_t irq_err_count;
6784
6785 int arch_show_interrupts(struct seq_file *p, int prec)
6786 {
6787 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
6788 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
6789 return 0;
6790 }
6791
6792 asmlinkage void spurious_interrupt(void)
6793 {
6794 - atomic_inc(&irq_err_count);
6795 + atomic_inc_unchecked(&irq_err_count);
6796 }
6797
6798 void __init init_IRQ(void)
6799 @@ -110,6 +110,8 @@ void __init init_IRQ(void)
6800 }
6801
6802 #ifdef CONFIG_DEBUG_STACKOVERFLOW
6803 +
6804 +extern void gr_handle_kernel_exploit(void);
6805 static inline void check_stack_overflow(void)
6806 {
6807 unsigned long sp;
6808 @@ -125,6 +127,7 @@ static inline void check_stack_overflow(void)
6809 printk("do_IRQ: stack overflow: %ld\n",
6810 sp - sizeof(struct thread_info));
6811 dump_stack();
6812 + gr_handle_kernel_exploit();
6813 }
6814 }
6815 #else
6816 diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c
6817 index 0614717..002fa43 100644
6818 --- a/arch/mips/kernel/pm-cps.c
6819 +++ b/arch/mips/kernel/pm-cps.c
6820 @@ -172,7 +172,7 @@ int cps_pm_enter_state(enum cps_pm_state state)
6821 nc_core_ready_count = nc_addr;
6822
6823 /* Ensure ready_count is zero-initialised before the assembly runs */
6824 - ACCESS_ONCE(*nc_core_ready_count) = 0;
6825 + ACCESS_ONCE_RW(*nc_core_ready_count) = 0;
6826 coupled_barrier(&per_cpu(pm_barrier, core), online);
6827
6828 /* Run the generated entry code */
6829 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
6830 index f2975d4..f61d355 100644
6831 --- a/arch/mips/kernel/process.c
6832 +++ b/arch/mips/kernel/process.c
6833 @@ -541,18 +541,6 @@ out:
6834 return pc;
6835 }
6836
6837 -/*
6838 - * Don't forget that the stack pointer must be aligned on a 8 bytes
6839 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
6840 - */
6841 -unsigned long arch_align_stack(unsigned long sp)
6842 -{
6843 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
6844 - sp -= get_random_int() & ~PAGE_MASK;
6845 -
6846 - return sp & ALMASK;
6847 -}
6848 -
6849 static void arch_dump_stack(void *info)
6850 {
6851 struct pt_regs *regs;
6852 diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
6853 index e933a30..0d02625 100644
6854 --- a/arch/mips/kernel/ptrace.c
6855 +++ b/arch/mips/kernel/ptrace.c
6856 @@ -785,6 +785,10 @@ long arch_ptrace(struct task_struct *child, long request,
6857 return ret;
6858 }
6859
6860 +#ifdef CONFIG_GRKERNSEC_SETXID
6861 +extern void gr_delayed_cred_worker(void);
6862 +#endif
6863 +
6864 /*
6865 * Notification of system call entry/exit
6866 * - triggered by current->work.syscall_trace
6867 @@ -803,6 +807,11 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
6868 tracehook_report_syscall_entry(regs))
6869 ret = -1;
6870
6871 +#ifdef CONFIG_GRKERNSEC_SETXID
6872 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
6873 + gr_delayed_cred_worker();
6874 +#endif
6875 +
6876 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
6877 trace_sys_enter(regs, regs->regs[2]);
6878
6879 diff --git a/arch/mips/kernel/sync-r4k.c b/arch/mips/kernel/sync-r4k.c
6880 index 2242bdd..b284048 100644
6881 --- a/arch/mips/kernel/sync-r4k.c
6882 +++ b/arch/mips/kernel/sync-r4k.c
6883 @@ -18,8 +18,8 @@
6884 #include <asm/mipsregs.h>
6885
6886 static atomic_t count_start_flag = ATOMIC_INIT(0);
6887 -static atomic_t count_count_start = ATOMIC_INIT(0);
6888 -static atomic_t count_count_stop = ATOMIC_INIT(0);
6889 +static atomic_unchecked_t count_count_start = ATOMIC_INIT(0);
6890 +static atomic_unchecked_t count_count_stop = ATOMIC_INIT(0);
6891 static atomic_t count_reference = ATOMIC_INIT(0);
6892
6893 #define COUNTON 100
6894 @@ -58,13 +58,13 @@ void synchronise_count_master(int cpu)
6895
6896 for (i = 0; i < NR_LOOPS; i++) {
6897 /* slaves loop on '!= 2' */
6898 - while (atomic_read(&count_count_start) != 1)
6899 + while (atomic_read_unchecked(&count_count_start) != 1)
6900 mb();
6901 - atomic_set(&count_count_stop, 0);
6902 + atomic_set_unchecked(&count_count_stop, 0);
6903 smp_wmb();
6904
6905 /* this lets the slaves write their count register */
6906 - atomic_inc(&count_count_start);
6907 + atomic_inc_unchecked(&count_count_start);
6908
6909 /*
6910 * Everyone initialises count in the last loop:
6911 @@ -75,11 +75,11 @@ void synchronise_count_master(int cpu)
6912 /*
6913 * Wait for all slaves to leave the synchronization point:
6914 */
6915 - while (atomic_read(&count_count_stop) != 1)
6916 + while (atomic_read_unchecked(&count_count_stop) != 1)
6917 mb();
6918 - atomic_set(&count_count_start, 0);
6919 + atomic_set_unchecked(&count_count_start, 0);
6920 smp_wmb();
6921 - atomic_inc(&count_count_stop);
6922 + atomic_inc_unchecked(&count_count_stop);
6923 }
6924 /* Arrange for an interrupt in a short while */
6925 write_c0_compare(read_c0_count() + COUNTON);
6926 @@ -112,8 +112,8 @@ void synchronise_count_slave(int cpu)
6927 initcount = atomic_read(&count_reference);
6928
6929 for (i = 0; i < NR_LOOPS; i++) {
6930 - atomic_inc(&count_count_start);
6931 - while (atomic_read(&count_count_start) != 2)
6932 + atomic_inc_unchecked(&count_count_start);
6933 + while (atomic_read_unchecked(&count_count_start) != 2)
6934 mb();
6935
6936 /*
6937 @@ -122,8 +122,8 @@ void synchronise_count_slave(int cpu)
6938 if (i == NR_LOOPS-1)
6939 write_c0_count(initcount);
6940
6941 - atomic_inc(&count_count_stop);
6942 - while (atomic_read(&count_count_stop) != 2)
6943 + atomic_inc_unchecked(&count_count_stop);
6944 + while (atomic_read_unchecked(&count_count_stop) != 2)
6945 mb();
6946 }
6947 /* Arrange for an interrupt in a short while */
6948 diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
6949 index d2d1c19..3e21d8d 100644
6950 --- a/arch/mips/kernel/traps.c
6951 +++ b/arch/mips/kernel/traps.c
6952 @@ -689,7 +689,18 @@ asmlinkage void do_ov(struct pt_regs *regs)
6953 siginfo_t info;
6954
6955 prev_state = exception_enter();
6956 - die_if_kernel("Integer overflow", regs);
6957 + if (unlikely(!user_mode(regs))) {
6958 +
6959 +#ifdef CONFIG_PAX_REFCOUNT
6960 + if (fixup_exception(regs)) {
6961 + pax_report_refcount_overflow(regs);
6962 + exception_exit(prev_state);
6963 + return;
6964 + }
6965 +#endif
6966 +
6967 + die("Integer overflow", regs);
6968 + }
6969
6970 info.si_code = FPE_INTOVF;
6971 info.si_signo = SIGFPE;
6972 diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
6973 index 52f205a..335927c 100644
6974 --- a/arch/mips/kvm/mips.c
6975 +++ b/arch/mips/kvm/mips.c
6976 @@ -1013,7 +1013,7 @@ long kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
6977 return r;
6978 }
6979
6980 -int kvm_arch_init(void *opaque)
6981 +int kvm_arch_init(const void *opaque)
6982 {
6983 if (kvm_mips_callbacks) {
6984 kvm_err("kvm: module already exists\n");
6985 diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
6986 index 7ff8637..6004edb 100644
6987 --- a/arch/mips/mm/fault.c
6988 +++ b/arch/mips/mm/fault.c
6989 @@ -31,6 +31,23 @@
6990
6991 int show_unhandled_signals = 1;
6992
6993 +#ifdef CONFIG_PAX_PAGEEXEC
6994 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
6995 +{
6996 + unsigned long i;
6997 +
6998 + printk(KERN_ERR "PAX: bytes at PC: ");
6999 + for (i = 0; i < 5; i++) {
7000 + unsigned int c;
7001 + if (get_user(c, (unsigned int *)pc+i))
7002 + printk(KERN_CONT "???????? ");
7003 + else
7004 + printk(KERN_CONT "%08x ", c);
7005 + }
7006 + printk("\n");
7007 +}
7008 +#endif
7009 +
7010 /*
7011 * This routine handles page faults. It determines the address,
7012 * and the problem, and then passes it off to one of the appropriate
7013 @@ -206,6 +223,14 @@ bad_area:
7014 bad_area_nosemaphore:
7015 /* User mode accesses just cause a SIGSEGV */
7016 if (user_mode(regs)) {
7017 +
7018 +#ifdef CONFIG_PAX_PAGEEXEC
7019 + if (cpu_has_rixi && (mm->pax_flags & MF_PAX_PAGEEXEC) && !write && address == instruction_pointer(regs)) {
7020 + pax_report_fault(regs, (void *)address, (void *)user_stack_pointer(regs));
7021 + do_group_exit(SIGKILL);
7022 + }
7023 +#endif
7024 +
7025 tsk->thread.cp0_badvaddr = address;
7026 tsk->thread.error_code = write;
7027 if (show_unhandled_signals &&
7028 diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
7029 index 5c81fdd..db158d3 100644
7030 --- a/arch/mips/mm/mmap.c
7031 +++ b/arch/mips/mm/mmap.c
7032 @@ -59,6 +59,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
7033 struct vm_area_struct *vma;
7034 unsigned long addr = addr0;
7035 int do_color_align;
7036 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
7037 struct vm_unmapped_area_info info;
7038
7039 if (unlikely(len > TASK_SIZE))
7040 @@ -84,6 +85,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
7041 do_color_align = 1;
7042
7043 /* requesting a specific address */
7044 +
7045 +#ifdef CONFIG_PAX_RANDMMAP
7046 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
7047 +#endif
7048 +
7049 if (addr) {
7050 if (do_color_align)
7051 addr = COLOUR_ALIGN(addr, pgoff);
7052 @@ -91,14 +97,14 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
7053 addr = PAGE_ALIGN(addr);
7054
7055 vma = find_vma(mm, addr);
7056 - if (TASK_SIZE - len >= addr &&
7057 - (!vma || addr + len <= vma->vm_start))
7058 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
7059 return addr;
7060 }
7061
7062 info.length = len;
7063 info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
7064 info.align_offset = pgoff << PAGE_SHIFT;
7065 + info.threadstack_offset = offset;
7066
7067 if (dir == DOWN) {
7068 info.flags = VM_UNMAPPED_AREA_TOPDOWN;
7069 @@ -160,45 +166,34 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
7070 {
7071 unsigned long random_factor = 0UL;
7072
7073 +#ifdef CONFIG_PAX_RANDMMAP
7074 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
7075 +#endif
7076 +
7077 if (current->flags & PF_RANDOMIZE)
7078 random_factor = arch_mmap_rnd();
7079
7080 if (mmap_is_legacy()) {
7081 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
7082 +
7083 +#ifdef CONFIG_PAX_RANDMMAP
7084 + if (mm->pax_flags & MF_PAX_RANDMMAP)
7085 + mm->mmap_base += mm->delta_mmap;
7086 +#endif
7087 +
7088 mm->get_unmapped_area = arch_get_unmapped_area;
7089 } else {
7090 mm->mmap_base = mmap_base(random_factor);
7091 +
7092 +#ifdef CONFIG_PAX_RANDMMAP
7093 + if (mm->pax_flags & MF_PAX_RANDMMAP)
7094 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
7095 +#endif
7096 +
7097 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
7098 }
7099 }
7100
7101 -static inline unsigned long brk_rnd(void)
7102 -{
7103 - unsigned long rnd = get_random_int();
7104 -
7105 - rnd = rnd << PAGE_SHIFT;
7106 - /* 8MB for 32bit, 256MB for 64bit */
7107 - if (TASK_IS_32BIT_ADDR)
7108 - rnd = rnd & 0x7ffffful;
7109 - else
7110 - rnd = rnd & 0xffffffful;
7111 -
7112 - return rnd;
7113 -}
7114 -
7115 -unsigned long arch_randomize_brk(struct mm_struct *mm)
7116 -{
7117 - unsigned long base = mm->brk;
7118 - unsigned long ret;
7119 -
7120 - ret = PAGE_ALIGN(base + brk_rnd());
7121 -
7122 - if (ret < mm->brk)
7123 - return mm->brk;
7124 -
7125 - return ret;
7126 -}
7127 -
7128 int __virt_addr_valid(const volatile void *kaddr)
7129 {
7130 return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
7131 diff --git a/arch/mips/sgi-ip27/ip27-nmi.c b/arch/mips/sgi-ip27/ip27-nmi.c
7132 index a2358b4..7cead4f 100644
7133 --- a/arch/mips/sgi-ip27/ip27-nmi.c
7134 +++ b/arch/mips/sgi-ip27/ip27-nmi.c
7135 @@ -187,9 +187,9 @@ void
7136 cont_nmi_dump(void)
7137 {
7138 #ifndef REAL_NMI_SIGNAL
7139 - static atomic_t nmied_cpus = ATOMIC_INIT(0);
7140 + static atomic_unchecked_t nmied_cpus = ATOMIC_INIT(0);
7141
7142 - atomic_inc(&nmied_cpus);
7143 + atomic_inc_unchecked(&nmied_cpus);
7144 #endif
7145 /*
7146 * Only allow 1 cpu to proceed
7147 @@ -233,7 +233,7 @@ cont_nmi_dump(void)
7148 udelay(10000);
7149 }
7150 #else
7151 - while (atomic_read(&nmied_cpus) != num_online_cpus());
7152 + while (atomic_read_unchecked(&nmied_cpus) != num_online_cpus());
7153 #endif
7154
7155 /*
7156 diff --git a/arch/mips/sni/rm200.c b/arch/mips/sni/rm200.c
7157 index a046b30..6799527 100644
7158 --- a/arch/mips/sni/rm200.c
7159 +++ b/arch/mips/sni/rm200.c
7160 @@ -270,7 +270,7 @@ spurious_8259A_irq:
7161 "spurious RM200 8259A interrupt: IRQ%d.\n", irq);
7162 spurious_irq_mask |= irqmask;
7163 }
7164 - atomic_inc(&irq_err_count);
7165 + atomic_inc_unchecked(&irq_err_count);
7166 /*
7167 * Theoretically we do not have to handle this IRQ,
7168 * but in Linux this does not cause problems and is
7169 diff --git a/arch/mips/vr41xx/common/icu.c b/arch/mips/vr41xx/common/icu.c
7170 index 41e873b..34d33a7 100644
7171 --- a/arch/mips/vr41xx/common/icu.c
7172 +++ b/arch/mips/vr41xx/common/icu.c
7173 @@ -653,7 +653,7 @@ static int icu_get_irq(unsigned int irq)
7174
7175 printk(KERN_ERR "spurious ICU interrupt: %04x,%04x\n", pend1, pend2);
7176
7177 - atomic_inc(&irq_err_count);
7178 + atomic_inc_unchecked(&irq_err_count);
7179
7180 return -1;
7181 }
7182 diff --git a/arch/mips/vr41xx/common/irq.c b/arch/mips/vr41xx/common/irq.c
7183 index ae0e4ee..e8f0692 100644
7184 --- a/arch/mips/vr41xx/common/irq.c
7185 +++ b/arch/mips/vr41xx/common/irq.c
7186 @@ -64,7 +64,7 @@ static void irq_dispatch(unsigned int irq)
7187 irq_cascade_t *cascade;
7188
7189 if (irq >= NR_IRQS) {
7190 - atomic_inc(&irq_err_count);
7191 + atomic_inc_unchecked(&irq_err_count);
7192 return;
7193 }
7194
7195 @@ -84,7 +84,7 @@ static void irq_dispatch(unsigned int irq)
7196 ret = cascade->get_irq(irq);
7197 irq = ret;
7198 if (ret < 0)
7199 - atomic_inc(&irq_err_count);
7200 + atomic_inc_unchecked(&irq_err_count);
7201 else
7202 irq_dispatch(irq);
7203 if (!irqd_irq_disabled(idata) && chip->irq_unmask)
7204 diff --git a/arch/mn10300/proc-mn103e010/include/proc/cache.h b/arch/mn10300/proc-mn103e010/include/proc/cache.h
7205 index 967d144..db12197 100644
7206 --- a/arch/mn10300/proc-mn103e010/include/proc/cache.h
7207 +++ b/arch/mn10300/proc-mn103e010/include/proc/cache.h
7208 @@ -11,12 +11,14 @@
7209 #ifndef _ASM_PROC_CACHE_H
7210 #define _ASM_PROC_CACHE_H
7211
7212 +#include <linux/const.h>
7213 +
7214 /* L1 cache */
7215
7216 #define L1_CACHE_NWAYS 4 /* number of ways in caches */
7217 #define L1_CACHE_NENTRIES 256 /* number of entries in each way */
7218 -#define L1_CACHE_BYTES 16 /* bytes per entry */
7219 #define L1_CACHE_SHIFT 4 /* shift for bytes per entry */
7220 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
7221 #define L1_CACHE_WAYDISP 0x1000 /* displacement of one way from the next */
7222
7223 #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
7224 diff --git a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
7225 index bcb5df2..84fabd2 100644
7226 --- a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
7227 +++ b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
7228 @@ -16,13 +16,15 @@
7229 #ifndef _ASM_PROC_CACHE_H
7230 #define _ASM_PROC_CACHE_H
7231
7232 +#include <linux/const.h>
7233 +
7234 /*
7235 * L1 cache
7236 */
7237 #define L1_CACHE_NWAYS 4 /* number of ways in caches */
7238 #define L1_CACHE_NENTRIES 128 /* number of entries in each way */
7239 -#define L1_CACHE_BYTES 32 /* bytes per entry */
7240 #define L1_CACHE_SHIFT 5 /* shift for bytes per entry */
7241 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
7242 #define L1_CACHE_WAYDISP 0x1000 /* distance from one way to the next */
7243
7244 #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
7245 diff --git a/arch/openrisc/include/asm/cache.h b/arch/openrisc/include/asm/cache.h
7246 index 4ce7a01..449202a 100644
7247 --- a/arch/openrisc/include/asm/cache.h
7248 +++ b/arch/openrisc/include/asm/cache.h
7249 @@ -19,11 +19,13 @@
7250 #ifndef __ASM_OPENRISC_CACHE_H
7251 #define __ASM_OPENRISC_CACHE_H
7252
7253 +#include <linux/const.h>
7254 +
7255 /* FIXME: How can we replace these with values from the CPU...
7256 * they shouldn't be hard-coded!
7257 */
7258
7259 -#define L1_CACHE_BYTES 16
7260 #define L1_CACHE_SHIFT 4
7261 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7262
7263 #endif /* __ASM_OPENRISC_CACHE_H */
7264 diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
7265 index 226f8ca9..9d9b87d 100644
7266 --- a/arch/parisc/include/asm/atomic.h
7267 +++ b/arch/parisc/include/asm/atomic.h
7268 @@ -273,6 +273,16 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
7269 return dec;
7270 }
7271
7272 +#define atomic64_read_unchecked(v) atomic64_read(v)
7273 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
7274 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
7275 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
7276 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
7277 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
7278 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
7279 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
7280 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
7281 +
7282 #endif /* !CONFIG_64BIT */
7283
7284
7285 diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
7286 index 47f11c7..3420df2 100644
7287 --- a/arch/parisc/include/asm/cache.h
7288 +++ b/arch/parisc/include/asm/cache.h
7289 @@ -5,6 +5,7 @@
7290 #ifndef __ARCH_PARISC_CACHE_H
7291 #define __ARCH_PARISC_CACHE_H
7292
7293 +#include <linux/const.h>
7294
7295 /*
7296 * PA 2.0 processors have 64-byte cachelines; PA 1.1 processors have
7297 @@ -15,13 +16,13 @@
7298 * just ruin performance.
7299 */
7300 #ifdef CONFIG_PA20
7301 -#define L1_CACHE_BYTES 64
7302 #define L1_CACHE_SHIFT 6
7303 #else
7304 -#define L1_CACHE_BYTES 32
7305 #define L1_CACHE_SHIFT 5
7306 #endif
7307
7308 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7309 +
7310 #ifndef __ASSEMBLY__
7311
7312 #define SMP_CACHE_BYTES L1_CACHE_BYTES
7313 diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
7314 index 78c9fd3..42fa66a 100644
7315 --- a/arch/parisc/include/asm/elf.h
7316 +++ b/arch/parisc/include/asm/elf.h
7317 @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration... */
7318
7319 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
7320
7321 +#ifdef CONFIG_PAX_ASLR
7322 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
7323 +
7324 +#define PAX_DELTA_MMAP_LEN 16
7325 +#define PAX_DELTA_STACK_LEN 16
7326 +#endif
7327 +
7328 /* This yields a mask that user programs can use to figure out what
7329 instruction set this CPU supports. This could be done in user space,
7330 but it's not easy, and we've already done it here. */
7331 diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
7332 index 3a08eae..08fef28 100644
7333 --- a/arch/parisc/include/asm/pgalloc.h
7334 +++ b/arch/parisc/include/asm/pgalloc.h
7335 @@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
7336 (__u32)(__pa((unsigned long)pmd) >> PxD_VALUE_SHIFT));
7337 }
7338
7339 +static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
7340 +{
7341 + pgd_populate(mm, pgd, pmd);
7342 +}
7343 +
7344 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
7345 {
7346 pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
7347 @@ -72,7 +77,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
7348
7349 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
7350 {
7351 - if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
7352 + if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
7353 /*
7354 * This is the permanent pmd attached to the pgd;
7355 * cannot free it.
7356 @@ -81,6 +86,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
7357 */
7358 mm_inc_nr_pmds(mm);
7359 return;
7360 + }
7361 free_pages((unsigned long)pmd, PMD_ORDER);
7362 }
7363
7364 @@ -96,6 +102,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
7365 #define pmd_alloc_one(mm, addr) ({ BUG(); ((pmd_t *)2); })
7366 #define pmd_free(mm, x) do { } while (0)
7367 #define pgd_populate(mm, pmd, pte) BUG()
7368 +#define pgd_populate_kernel(mm, pmd, pte) BUG()
7369
7370 #endif
7371
7372 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
7373 index 0a18375..d613939 100644
7374 --- a/arch/parisc/include/asm/pgtable.h
7375 +++ b/arch/parisc/include/asm/pgtable.h
7376 @@ -213,6 +213,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
7377 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
7378 #define PAGE_COPY PAGE_EXECREAD
7379 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
7380 +
7381 +#ifdef CONFIG_PAX_PAGEEXEC
7382 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
7383 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
7384 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
7385 +#else
7386 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
7387 +# define PAGE_COPY_NOEXEC PAGE_COPY
7388 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
7389 +#endif
7390 +
7391 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
7392 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
7393 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
7394 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
7395 index 0abdd4c..1af92f0 100644
7396 --- a/arch/parisc/include/asm/uaccess.h
7397 +++ b/arch/parisc/include/asm/uaccess.h
7398 @@ -243,10 +243,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
7399 const void __user *from,
7400 unsigned long n)
7401 {
7402 - int sz = __compiletime_object_size(to);
7403 + size_t sz = __compiletime_object_size(to);
7404 int ret = -EFAULT;
7405
7406 - if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
7407 + if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n))
7408 ret = __copy_from_user(to, from, n);
7409 else
7410 copy_from_user_overflow();
7411 diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
7412 index 3c63a82..b1d6ee9 100644
7413 --- a/arch/parisc/kernel/module.c
7414 +++ b/arch/parisc/kernel/module.c
7415 @@ -98,16 +98,38 @@
7416
7417 /* three functions to determine where in the module core
7418 * or init pieces the location is */
7419 +static inline int in_init_rx(struct module *me, void *loc)
7420 +{
7421 + return (loc >= me->module_init_rx &&
7422 + loc < (me->module_init_rx + me->init_size_rx));
7423 +}
7424 +
7425 +static inline int in_init_rw(struct module *me, void *loc)
7426 +{
7427 + return (loc >= me->module_init_rw &&
7428 + loc < (me->module_init_rw + me->init_size_rw));
7429 +}
7430 +
7431 static inline int in_init(struct module *me, void *loc)
7432 {
7433 - return (loc >= me->module_init &&
7434 - loc <= (me->module_init + me->init_size));
7435 + return in_init_rx(me, loc) || in_init_rw(me, loc);
7436 +}
7437 +
7438 +static inline int in_core_rx(struct module *me, void *loc)
7439 +{
7440 + return (loc >= me->module_core_rx &&
7441 + loc < (me->module_core_rx + me->core_size_rx));
7442 +}
7443 +
7444 +static inline int in_core_rw(struct module *me, void *loc)
7445 +{
7446 + return (loc >= me->module_core_rw &&
7447 + loc < (me->module_core_rw + me->core_size_rw));
7448 }
7449
7450 static inline int in_core(struct module *me, void *loc)
7451 {
7452 - return (loc >= me->module_core &&
7453 - loc <= (me->module_core + me->core_size));
7454 + return in_core_rx(me, loc) || in_core_rw(me, loc);
7455 }
7456
7457 static inline int in_local(struct module *me, void *loc)
7458 @@ -367,13 +389,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
7459 }
7460
7461 /* align things a bit */
7462 - me->core_size = ALIGN(me->core_size, 16);
7463 - me->arch.got_offset = me->core_size;
7464 - me->core_size += gots * sizeof(struct got_entry);
7465 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
7466 + me->arch.got_offset = me->core_size_rw;
7467 + me->core_size_rw += gots * sizeof(struct got_entry);
7468
7469 - me->core_size = ALIGN(me->core_size, 16);
7470 - me->arch.fdesc_offset = me->core_size;
7471 - me->core_size += fdescs * sizeof(Elf_Fdesc);
7472 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
7473 + me->arch.fdesc_offset = me->core_size_rw;
7474 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
7475
7476 me->arch.got_max = gots;
7477 me->arch.fdesc_max = fdescs;
7478 @@ -391,7 +413,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
7479
7480 BUG_ON(value == 0);
7481
7482 - got = me->module_core + me->arch.got_offset;
7483 + got = me->module_core_rw + me->arch.got_offset;
7484 for (i = 0; got[i].addr; i++)
7485 if (got[i].addr == value)
7486 goto out;
7487 @@ -409,7 +431,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
7488 #ifdef CONFIG_64BIT
7489 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
7490 {
7491 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
7492 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
7493
7494 if (!value) {
7495 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
7496 @@ -427,7 +449,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
7497
7498 /* Create new one */
7499 fdesc->addr = value;
7500 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
7501 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
7502 return (Elf_Addr)fdesc;
7503 }
7504 #endif /* CONFIG_64BIT */
7505 @@ -839,7 +861,7 @@ register_unwind_table(struct module *me,
7506
7507 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
7508 end = table + sechdrs[me->arch.unwind_section].sh_size;
7509 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
7510 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
7511
7512 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
7513 me->arch.unwind_section, table, end, gp);
7514 diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
7515 index 5aba01a..47cdd5a 100644
7516 --- a/arch/parisc/kernel/sys_parisc.c
7517 +++ b/arch/parisc/kernel/sys_parisc.c
7518 @@ -92,6 +92,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
7519 unsigned long task_size = TASK_SIZE;
7520 int do_color_align, last_mmap;
7521 struct vm_unmapped_area_info info;
7522 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
7523
7524 if (len > task_size)
7525 return -ENOMEM;
7526 @@ -109,6 +110,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
7527 goto found_addr;
7528 }
7529
7530 +#ifdef CONFIG_PAX_RANDMMAP
7531 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
7532 +#endif
7533 +
7534 if (addr) {
7535 if (do_color_align && last_mmap)
7536 addr = COLOR_ALIGN(addr, last_mmap, pgoff);
7537 @@ -127,6 +132,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
7538 info.high_limit = mmap_upper_limit();
7539 info.align_mask = last_mmap ? (PAGE_MASK & (SHM_COLOUR - 1)) : 0;
7540 info.align_offset = shared_align_offset(last_mmap, pgoff);
7541 + info.threadstack_offset = offset;
7542 addr = vm_unmapped_area(&info);
7543
7544 found_addr:
7545 @@ -146,6 +152,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7546 unsigned long addr = addr0;
7547 int do_color_align, last_mmap;
7548 struct vm_unmapped_area_info info;
7549 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
7550
7551 #ifdef CONFIG_64BIT
7552 /* This should only ever run for 32-bit processes. */
7553 @@ -170,6 +177,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7554 }
7555
7556 /* requesting a specific address */
7557 +#ifdef CONFIG_PAX_RANDMMAP
7558 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
7559 +#endif
7560 +
7561 if (addr) {
7562 if (do_color_align && last_mmap)
7563 addr = COLOR_ALIGN(addr, last_mmap, pgoff);
7564 @@ -187,6 +198,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7565 info.high_limit = mm->mmap_base;
7566 info.align_mask = last_mmap ? (PAGE_MASK & (SHM_COLOUR - 1)) : 0;
7567 info.align_offset = shared_align_offset(last_mmap, pgoff);
7568 + info.threadstack_offset = offset;
7569 addr = vm_unmapped_area(&info);
7570 if (!(addr & ~PAGE_MASK))
7571 goto found_addr;
7572 @@ -252,6 +264,13 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
7573 mm->mmap_legacy_base = mmap_legacy_base();
7574 mm->mmap_base = mmap_upper_limit();
7575
7576 +#ifdef CONFIG_PAX_RANDMMAP
7577 + if (mm->pax_flags & MF_PAX_RANDMMAP) {
7578 + mm->mmap_legacy_base += mm->delta_mmap;
7579 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
7580 + }
7581 +#endif
7582 +
7583 if (mmap_is_legacy()) {
7584 mm->mmap_base = mm->mmap_legacy_base;
7585 mm->get_unmapped_area = arch_get_unmapped_area;
7586 diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
7587 index 47ee620..1107387 100644
7588 --- a/arch/parisc/kernel/traps.c
7589 +++ b/arch/parisc/kernel/traps.c
7590 @@ -726,9 +726,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
7591
7592 down_read(&current->mm->mmap_sem);
7593 vma = find_vma(current->mm,regs->iaoq[0]);
7594 - if (vma && (regs->iaoq[0] >= vma->vm_start)
7595 - && (vma->vm_flags & VM_EXEC)) {
7596 -
7597 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
7598 fault_address = regs->iaoq[0];
7599 fault_space = regs->iasq[0];
7600
7601 diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
7602 index e5120e6..8ddb5cc 100644
7603 --- a/arch/parisc/mm/fault.c
7604 +++ b/arch/parisc/mm/fault.c
7605 @@ -15,6 +15,7 @@
7606 #include <linux/sched.h>
7607 #include <linux/interrupt.h>
7608 #include <linux/module.h>
7609 +#include <linux/unistd.h>
7610
7611 #include <asm/uaccess.h>
7612 #include <asm/traps.h>
7613 @@ -50,7 +51,7 @@ int show_unhandled_signals = 1;
7614 static unsigned long
7615 parisc_acctyp(unsigned long code, unsigned int inst)
7616 {
7617 - if (code == 6 || code == 16)
7618 + if (code == 6 || code == 7 || code == 16)
7619 return VM_EXEC;
7620
7621 switch (inst & 0xf0000000) {
7622 @@ -136,6 +137,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
7623 }
7624 #endif
7625
7626 +#ifdef CONFIG_PAX_PAGEEXEC
7627 +/*
7628 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
7629 + *
7630 + * returns 1 when task should be killed
7631 + * 2 when rt_sigreturn trampoline was detected
7632 + * 3 when unpatched PLT trampoline was detected
7633 + */
7634 +static int pax_handle_fetch_fault(struct pt_regs *regs)
7635 +{
7636 +
7637 +#ifdef CONFIG_PAX_EMUPLT
7638 + int err;
7639 +
7640 + do { /* PaX: unpatched PLT emulation */
7641 + unsigned int bl, depwi;
7642 +
7643 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
7644 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
7645 +
7646 + if (err)
7647 + break;
7648 +
7649 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
7650 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
7651 +
7652 + err = get_user(ldw, (unsigned int *)addr);
7653 + err |= get_user(bv, (unsigned int *)(addr+4));
7654 + err |= get_user(ldw2, (unsigned int *)(addr+8));
7655 +
7656 + if (err)
7657 + break;
7658 +
7659 + if (ldw == 0x0E801096U &&
7660 + bv == 0xEAC0C000U &&
7661 + ldw2 == 0x0E881095U)
7662 + {
7663 + unsigned int resolver, map;
7664 +
7665 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
7666 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
7667 + if (err)
7668 + break;
7669 +
7670 + regs->gr[20] = instruction_pointer(regs)+8;
7671 + regs->gr[21] = map;
7672 + regs->gr[22] = resolver;
7673 + regs->iaoq[0] = resolver | 3UL;
7674 + regs->iaoq[1] = regs->iaoq[0] + 4;
7675 + return 3;
7676 + }
7677 + }
7678 + } while (0);
7679 +#endif
7680 +
7681 +#ifdef CONFIG_PAX_EMUTRAMP
7682 +
7683 +#ifndef CONFIG_PAX_EMUSIGRT
7684 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
7685 + return 1;
7686 +#endif
7687 +
7688 + do { /* PaX: rt_sigreturn emulation */
7689 + unsigned int ldi1, ldi2, bel, nop;
7690 +
7691 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
7692 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
7693 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
7694 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
7695 +
7696 + if (err)
7697 + break;
7698 +
7699 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
7700 + ldi2 == 0x3414015AU &&
7701 + bel == 0xE4008200U &&
7702 + nop == 0x08000240U)
7703 + {
7704 + regs->gr[25] = (ldi1 & 2) >> 1;
7705 + regs->gr[20] = __NR_rt_sigreturn;
7706 + regs->gr[31] = regs->iaoq[1] + 16;
7707 + regs->sr[0] = regs->iasq[1];
7708 + regs->iaoq[0] = 0x100UL;
7709 + regs->iaoq[1] = regs->iaoq[0] + 4;
7710 + regs->iasq[0] = regs->sr[2];
7711 + regs->iasq[1] = regs->sr[2];
7712 + return 2;
7713 + }
7714 + } while (0);
7715 +#endif
7716 +
7717 + return 1;
7718 +}
7719 +
7720 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
7721 +{
7722 + unsigned long i;
7723 +
7724 + printk(KERN_ERR "PAX: bytes at PC: ");
7725 + for (i = 0; i < 5; i++) {
7726 + unsigned int c;
7727 + if (get_user(c, (unsigned int *)pc+i))
7728 + printk(KERN_CONT "???????? ");
7729 + else
7730 + printk(KERN_CONT "%08x ", c);
7731 + }
7732 + printk("\n");
7733 +}
7734 +#endif
7735 +
7736 int fixup_exception(struct pt_regs *regs)
7737 {
7738 const struct exception_table_entry *fix;
7739 @@ -234,8 +345,33 @@ retry:
7740
7741 good_area:
7742
7743 - if ((vma->vm_flags & acc_type) != acc_type)
7744 + if ((vma->vm_flags & acc_type) != acc_type) {
7745 +
7746 +#ifdef CONFIG_PAX_PAGEEXEC
7747 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
7748 + (address & ~3UL) == instruction_pointer(regs))
7749 + {
7750 + up_read(&mm->mmap_sem);
7751 + switch (pax_handle_fetch_fault(regs)) {
7752 +
7753 +#ifdef CONFIG_PAX_EMUPLT
7754 + case 3:
7755 + return;
7756 +#endif
7757 +
7758 +#ifdef CONFIG_PAX_EMUTRAMP
7759 + case 2:
7760 + return;
7761 +#endif
7762 +
7763 + }
7764 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
7765 + do_group_exit(SIGKILL);
7766 + }
7767 +#endif
7768 +
7769 goto bad_area;
7770 + }
7771
7772 /*
7773 * If for any reason at all we couldn't handle the fault, make
7774 diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
7775 index 190cc48..48439ce 100644
7776 --- a/arch/powerpc/Kconfig
7777 +++ b/arch/powerpc/Kconfig
7778 @@ -413,6 +413,7 @@ config PPC64_SUPPORTS_MEMORY_FAILURE
7779 config KEXEC
7780 bool "kexec system call"
7781 depends on (PPC_BOOK3S || FSL_BOOKE || (44x && !SMP))
7782 + depends on !GRKERNSEC_KMEM
7783 help
7784 kexec is a system call that implements the ability to shutdown your
7785 current kernel, and to start another kernel. It is like a reboot
7786 diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
7787 index 512d278..d31fadd 100644
7788 --- a/arch/powerpc/include/asm/atomic.h
7789 +++ b/arch/powerpc/include/asm/atomic.h
7790 @@ -12,6 +12,11 @@
7791
7792 #define ATOMIC_INIT(i) { (i) }
7793
7794 +#define _ASM_EXTABLE(from, to) \
7795 +" .section __ex_table,\"a\"\n" \
7796 + PPC_LONG" " #from ", " #to"\n" \
7797 +" .previous\n"
7798 +
7799 static __inline__ int atomic_read(const atomic_t *v)
7800 {
7801 int t;
7802 @@ -21,39 +26,80 @@ static __inline__ int atomic_read(const atomic_t *v)
7803 return t;
7804 }
7805
7806 +static __inline__ int atomic_read_unchecked(const atomic_unchecked_t *v)
7807 +{
7808 + int t;
7809 +
7810 + __asm__ __volatile__("lwz%U1%X1 %0,%1" : "=r"(t) : "m"(v->counter));
7811 +
7812 + return t;
7813 +}
7814 +
7815 static __inline__ void atomic_set(atomic_t *v, int i)
7816 {
7817 __asm__ __volatile__("stw%U0%X0 %1,%0" : "=m"(v->counter) : "r"(i));
7818 }
7819
7820 -#define ATOMIC_OP(op, asm_op) \
7821 -static __inline__ void atomic_##op(int a, atomic_t *v) \
7822 +static __inline__ void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7823 +{
7824 + __asm__ __volatile__("stw%U0%X0 %1,%0" : "=m"(v->counter) : "r"(i));
7825 +}
7826 +
7827 +#ifdef CONFIG_PAX_REFCOUNT
7828 +#define __REFCOUNT_OP(op) op##o.
7829 +#define __OVERFLOW_PRE \
7830 + " mcrxr cr0\n"
7831 +#define __OVERFLOW_POST \
7832 + " bf 4*cr0+so, 3f\n" \
7833 + "2: .long 0x00c00b00\n" \
7834 + "3:\n"
7835 +#define __OVERFLOW_EXTABLE \
7836 + "\n4:\n"
7837 + _ASM_EXTABLE(2b, 4b)
7838 +#else
7839 +#define __REFCOUNT_OP(op) op
7840 +#define __OVERFLOW_PRE
7841 +#define __OVERFLOW_POST
7842 +#define __OVERFLOW_EXTABLE
7843 +#endif
7844 +
7845 +#define __ATOMIC_OP(op, suffix, pre_op, asm_op, post_op, extable) \
7846 +static inline void atomic_##op##suffix(int a, atomic##suffix##_t *v) \
7847 { \
7848 int t; \
7849 \
7850 __asm__ __volatile__( \
7851 -"1: lwarx %0,0,%3 # atomic_" #op "\n" \
7852 +"1: lwarx %0,0,%3 # atomic_" #op #suffix "\n" \
7853 + pre_op \
7854 #asm_op " %0,%2,%0\n" \
7855 + post_op \
7856 PPC405_ERR77(0,%3) \
7857 " stwcx. %0,0,%3 \n" \
7858 " bne- 1b\n" \
7859 + extable \
7860 : "=&r" (t), "+m" (v->counter) \
7861 : "r" (a), "r" (&v->counter) \
7862 : "cc"); \
7863 } \
7864
7865 -#define ATOMIC_OP_RETURN(op, asm_op) \
7866 -static __inline__ int atomic_##op##_return(int a, atomic_t *v) \
7867 +#define ATOMIC_OP(op, asm_op) __ATOMIC_OP(op, , , asm_op, , ) \
7868 + __ATOMIC_OP(op, _unchecked, __OVERFLOW_PRE, __REFCOUNT_OP(asm_op), __OVERFLOW_POST, __OVERFLOW_EXTABLE)
7869 +
7870 +#define __ATOMIC_OP_RETURN(op, suffix, pre_op, asm_op, post_op, extable)\
7871 +static inline int atomic_##op##_return##suffix(int a, atomic##suffix##_t *v)\
7872 { \
7873 int t; \
7874 \
7875 __asm__ __volatile__( \
7876 PPC_ATOMIC_ENTRY_BARRIER \
7877 -"1: lwarx %0,0,%2 # atomic_" #op "_return\n" \
7878 +"1: lwarx %0,0,%2 # atomic_" #op "_return" #suffix "\n" \
7879 + pre_op \
7880 #asm_op " %0,%1,%0\n" \
7881 + post_op \
7882 PPC405_ERR77(0,%2) \
7883 " stwcx. %0,0,%2 \n" \
7884 " bne- 1b\n" \
7885 + extable \
7886 PPC_ATOMIC_EXIT_BARRIER \
7887 : "=&r" (t) \
7888 : "r" (a), "r" (&v->counter) \
7889 @@ -62,6 +108,9 @@ static __inline__ int atomic_##op##_return(int a, atomic_t *v) \
7890 return t; \
7891 }
7892
7893 +#define ATOMIC_OP_RETURN(op, asm_op) __ATOMIC_OP_RETURN(op, , , asm_op, , )\
7894 + __ATOMIC_OP_RETURN(op, _unchecked, __OVERFLOW_PRE, __REFCOUNT_OP(asm_op), __OVERFLOW_POST, __OVERFLOW_EXTABLE)
7895 +
7896 #define ATOMIC_OPS(op, asm_op) ATOMIC_OP(op, asm_op) ATOMIC_OP_RETURN(op, asm_op)
7897
7898 ATOMIC_OPS(add, add)
7899 @@ -69,42 +118,29 @@ ATOMIC_OPS(sub, subf)
7900
7901 #undef ATOMIC_OPS
7902 #undef ATOMIC_OP_RETURN
7903 +#undef __ATOMIC_OP_RETURN
7904 #undef ATOMIC_OP
7905 +#undef __ATOMIC_OP
7906
7907 #define atomic_add_negative(a, v) (atomic_add_return((a), (v)) < 0)
7908
7909 -static __inline__ void atomic_inc(atomic_t *v)
7910 -{
7911 - int t;
7912 +/*
7913 + * atomic_inc - increment atomic variable
7914 + * @v: pointer of type atomic_t
7915 + *
7916 + * Automatically increments @v by 1
7917 + */
7918 +#define atomic_inc(v) atomic_add(1, (v))
7919 +#define atomic_inc_return(v) atomic_add_return(1, (v))
7920
7921 - __asm__ __volatile__(
7922 -"1: lwarx %0,0,%2 # atomic_inc\n\
7923 - addic %0,%0,1\n"
7924 - PPC405_ERR77(0,%2)
7925 -" stwcx. %0,0,%2 \n\
7926 - bne- 1b"
7927 - : "=&r" (t), "+m" (v->counter)
7928 - : "r" (&v->counter)
7929 - : "cc", "xer");
7930 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7931 +{
7932 + atomic_add_unchecked(1, v);
7933 }
7934
7935 -static __inline__ int atomic_inc_return(atomic_t *v)
7936 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7937 {
7938 - int t;
7939 -
7940 - __asm__ __volatile__(
7941 - PPC_ATOMIC_ENTRY_BARRIER
7942 -"1: lwarx %0,0,%1 # atomic_inc_return\n\
7943 - addic %0,%0,1\n"
7944 - PPC405_ERR77(0,%1)
7945 -" stwcx. %0,0,%1 \n\
7946 - bne- 1b"
7947 - PPC_ATOMIC_EXIT_BARRIER
7948 - : "=&r" (t)
7949 - : "r" (&v->counter)
7950 - : "cc", "xer", "memory");
7951 -
7952 - return t;
7953 + return atomic_add_return_unchecked(1, v);
7954 }
7955
7956 /*
7957 @@ -117,43 +153,38 @@ static __inline__ int atomic_inc_return(atomic_t *v)
7958 */
7959 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
7960
7961 -static __inline__ void atomic_dec(atomic_t *v)
7962 +static __inline__ int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7963 {
7964 - int t;
7965 -
7966 - __asm__ __volatile__(
7967 -"1: lwarx %0,0,%2 # atomic_dec\n\
7968 - addic %0,%0,-1\n"
7969 - PPC405_ERR77(0,%2)\
7970 -" stwcx. %0,0,%2\n\
7971 - bne- 1b"
7972 - : "=&r" (t), "+m" (v->counter)
7973 - : "r" (&v->counter)
7974 - : "cc", "xer");
7975 + return atomic_add_return_unchecked(1, v) == 0;
7976 }
7977
7978 -static __inline__ int atomic_dec_return(atomic_t *v)
7979 +/*
7980 + * atomic_dec - decrement atomic variable
7981 + * @v: pointer of type atomic_t
7982 + *
7983 + * Atomically decrements @v by 1
7984 + */
7985 +#define atomic_dec(v) atomic_sub(1, (v))
7986 +#define atomic_dec_return(v) atomic_sub_return(1, (v))
7987 +
7988 +static __inline__ void atomic_dec_unchecked(atomic_unchecked_t *v)
7989 {
7990 - int t;
7991 -
7992 - __asm__ __volatile__(
7993 - PPC_ATOMIC_ENTRY_BARRIER
7994 -"1: lwarx %0,0,%1 # atomic_dec_return\n\
7995 - addic %0,%0,-1\n"
7996 - PPC405_ERR77(0,%1)
7997 -" stwcx. %0,0,%1\n\
7998 - bne- 1b"
7999 - PPC_ATOMIC_EXIT_BARRIER
8000 - : "=&r" (t)
8001 - : "r" (&v->counter)
8002 - : "cc", "xer", "memory");
8003 -
8004 - return t;
8005 + atomic_sub_unchecked(1, v);
8006 }
8007
8008 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
8009 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
8010
8011 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
8012 +{
8013 + return cmpxchg(&(v->counter), old, new);
8014 +}
8015 +
8016 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
8017 +{
8018 + return xchg(&(v->counter), new);
8019 +}
8020 +
8021 /**
8022 * __atomic_add_unless - add unless the number is a given value
8023 * @v: pointer of type atomic_t
8024 @@ -171,11 +202,27 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
8025 PPC_ATOMIC_ENTRY_BARRIER
8026 "1: lwarx %0,0,%1 # __atomic_add_unless\n\
8027 cmpw 0,%0,%3 \n\
8028 - beq- 2f \n\
8029 - add %0,%2,%0 \n"
8030 + beq- 2f \n"
8031 +
8032 +#ifdef CONFIG_PAX_REFCOUNT
8033 +" mcrxr cr0\n"
8034 +" addo. %0,%2,%0\n"
8035 +" bf 4*cr0+so, 4f\n"
8036 +"3:.long " "0x00c00b00""\n"
8037 +"4:\n"
8038 +#else
8039 + "add %0,%2,%0 \n"
8040 +#endif
8041 +
8042 PPC405_ERR77(0,%2)
8043 " stwcx. %0,0,%1 \n\
8044 bne- 1b \n"
8045 +"5:"
8046 +
8047 +#ifdef CONFIG_PAX_REFCOUNT
8048 + _ASM_EXTABLE(3b, 5b)
8049 +#endif
8050 +
8051 PPC_ATOMIC_EXIT_BARRIER
8052 " subf %0,%2,%0 \n\
8053 2:"
8054 @@ -248,6 +295,11 @@ static __inline__ int atomic_dec_if_positive(atomic_t *v)
8055 }
8056 #define atomic_dec_if_positive atomic_dec_if_positive
8057
8058 +#define smp_mb__before_atomic_dec() smp_mb()
8059 +#define smp_mb__after_atomic_dec() smp_mb()
8060 +#define smp_mb__before_atomic_inc() smp_mb()
8061 +#define smp_mb__after_atomic_inc() smp_mb()
8062 +
8063 #ifdef __powerpc64__
8064
8065 #define ATOMIC64_INIT(i) { (i) }
8066 @@ -261,37 +313,60 @@ static __inline__ long atomic64_read(const atomic64_t *v)
8067 return t;
8068 }
8069
8070 +static __inline__ long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8071 +{
8072 + long t;
8073 +
8074 + __asm__ __volatile__("ld%U1%X1 %0,%1" : "=r"(t) : "m"(v->counter));
8075 +
8076 + return t;
8077 +}
8078 +
8079 static __inline__ void atomic64_set(atomic64_t *v, long i)
8080 {
8081 __asm__ __volatile__("std%U0%X0 %1,%0" : "=m"(v->counter) : "r"(i));
8082 }
8083
8084 -#define ATOMIC64_OP(op, asm_op) \
8085 -static __inline__ void atomic64_##op(long a, atomic64_t *v) \
8086 +static __inline__ void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8087 +{
8088 + __asm__ __volatile__("std%U0%X0 %1,%0" : "=m"(v->counter) : "r"(i));
8089 +}
8090 +
8091 +#define __ATOMIC64_OP(op, suffix, pre_op, asm_op, post_op, extable) \
8092 +static inline void atomic64_##op##suffix(long a, atomic64##suffix##_t *v)\
8093 { \
8094 long t; \
8095 \
8096 __asm__ __volatile__( \
8097 "1: ldarx %0,0,%3 # atomic64_" #op "\n" \
8098 + pre_op \
8099 #asm_op " %0,%2,%0\n" \
8100 + post_op \
8101 " stdcx. %0,0,%3 \n" \
8102 " bne- 1b\n" \
8103 + extable \
8104 : "=&r" (t), "+m" (v->counter) \
8105 : "r" (a), "r" (&v->counter) \
8106 : "cc"); \
8107 }
8108
8109 -#define ATOMIC64_OP_RETURN(op, asm_op) \
8110 -static __inline__ long atomic64_##op##_return(long a, atomic64_t *v) \
8111 +#define ATOMIC64_OP(op, asm_op) __ATOMIC64_OP(op, , , asm_op, , ) \
8112 + __ATOMIC64_OP(op, _unchecked, __OVERFLOW_PRE, __REFCOUNT_OP(asm_op), __OVERFLOW_POST, __OVERFLOW_EXTABLE)
8113 +
8114 +#define __ATOMIC64_OP_RETURN(op, suffix, pre_op, asm_op, post_op, extable)\
8115 +static inline long atomic64_##op##_return##suffix(long a, atomic64##suffix##_t *v)\
8116 { \
8117 long t; \
8118 \
8119 __asm__ __volatile__( \
8120 PPC_ATOMIC_ENTRY_BARRIER \
8121 "1: ldarx %0,0,%2 # atomic64_" #op "_return\n" \
8122 + pre_op \
8123 #asm_op " %0,%1,%0\n" \
8124 + post_op \
8125 " stdcx. %0,0,%2 \n" \
8126 " bne- 1b\n" \
8127 + extable \
8128 PPC_ATOMIC_EXIT_BARRIER \
8129 : "=&r" (t) \
8130 : "r" (a), "r" (&v->counter) \
8131 @@ -300,6 +375,9 @@ static __inline__ long atomic64_##op##_return(long a, atomic64_t *v) \
8132 return t; \
8133 }
8134
8135 +#define ATOMIC64_OP_RETURN(op, asm_op) __ATOMIC64_OP_RETURN(op, , , asm_op, , )\
8136 + __ATOMIC64_OP_RETURN(op, _unchecked, __OVERFLOW_PRE, __REFCOUNT_OP(asm_op), __OVERFLOW_POST, __OVERFLOW_EXTABLE)
8137 +
8138 #define ATOMIC64_OPS(op, asm_op) ATOMIC64_OP(op, asm_op) ATOMIC64_OP_RETURN(op, asm_op)
8139
8140 ATOMIC64_OPS(add, add)
8141 @@ -307,40 +385,33 @@ ATOMIC64_OPS(sub, subf)
8142
8143 #undef ATOMIC64_OPS
8144 #undef ATOMIC64_OP_RETURN
8145 +#undef __ATOMIC64_OP_RETURN
8146 #undef ATOMIC64_OP
8147 +#undef __ATOMIC64_OP
8148 +#undef __OVERFLOW_EXTABLE
8149 +#undef __OVERFLOW_POST
8150 +#undef __OVERFLOW_PRE
8151 +#undef __REFCOUNT_OP
8152
8153 #define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0)
8154
8155 -static __inline__ void atomic64_inc(atomic64_t *v)
8156 -{
8157 - long t;
8158 +/*
8159 + * atomic64_inc - increment atomic variable
8160 + * @v: pointer of type atomic64_t
8161 + *
8162 + * Automatically increments @v by 1
8163 + */
8164 +#define atomic64_inc(v) atomic64_add(1, (v))
8165 +#define atomic64_inc_return(v) atomic64_add_return(1, (v))
8166
8167 - __asm__ __volatile__(
8168 -"1: ldarx %0,0,%2 # atomic64_inc\n\
8169 - addic %0,%0,1\n\
8170 - stdcx. %0,0,%2 \n\
8171 - bne- 1b"
8172 - : "=&r" (t), "+m" (v->counter)
8173 - : "r" (&v->counter)
8174 - : "cc", "xer");
8175 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8176 +{
8177 + atomic64_add_unchecked(1, v);
8178 }
8179
8180 -static __inline__ long atomic64_inc_return(atomic64_t *v)
8181 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8182 {
8183 - long t;
8184 -
8185 - __asm__ __volatile__(
8186 - PPC_ATOMIC_ENTRY_BARRIER
8187 -"1: ldarx %0,0,%1 # atomic64_inc_return\n\
8188 - addic %0,%0,1\n\
8189 - stdcx. %0,0,%1 \n\
8190 - bne- 1b"
8191 - PPC_ATOMIC_EXIT_BARRIER
8192 - : "=&r" (t)
8193 - : "r" (&v->counter)
8194 - : "cc", "xer", "memory");
8195 -
8196 - return t;
8197 + return atomic64_add_return_unchecked(1, v);
8198 }
8199
8200 /*
8201 @@ -353,36 +424,18 @@ static __inline__ long atomic64_inc_return(atomic64_t *v)
8202 */
8203 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
8204
8205 -static __inline__ void atomic64_dec(atomic64_t *v)
8206 +/*
8207 + * atomic64_dec - decrement atomic variable
8208 + * @v: pointer of type atomic64_t
8209 + *
8210 + * Atomically decrements @v by 1
8211 + */
8212 +#define atomic64_dec(v) atomic64_sub(1, (v))
8213 +#define atomic64_dec_return(v) atomic64_sub_return(1, (v))
8214 +
8215 +static __inline__ void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8216 {
8217 - long t;
8218 -
8219 - __asm__ __volatile__(
8220 -"1: ldarx %0,0,%2 # atomic64_dec\n\
8221 - addic %0,%0,-1\n\
8222 - stdcx. %0,0,%2\n\
8223 - bne- 1b"
8224 - : "=&r" (t), "+m" (v->counter)
8225 - : "r" (&v->counter)
8226 - : "cc", "xer");
8227 -}
8228 -
8229 -static __inline__ long atomic64_dec_return(atomic64_t *v)
8230 -{
8231 - long t;
8232 -
8233 - __asm__ __volatile__(
8234 - PPC_ATOMIC_ENTRY_BARRIER
8235 -"1: ldarx %0,0,%1 # atomic64_dec_return\n\
8236 - addic %0,%0,-1\n\
8237 - stdcx. %0,0,%1\n\
8238 - bne- 1b"
8239 - PPC_ATOMIC_EXIT_BARRIER
8240 - : "=&r" (t)
8241 - : "r" (&v->counter)
8242 - : "cc", "xer", "memory");
8243 -
8244 - return t;
8245 + atomic64_sub_unchecked(1, v);
8246 }
8247
8248 #define atomic64_sub_and_test(a, v) (atomic64_sub_return((a), (v)) == 0)
8249 @@ -415,6 +468,16 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
8250 #define atomic64_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
8251 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
8252
8253 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8254 +{
8255 + return cmpxchg(&(v->counter), old, new);
8256 +}
8257 +
8258 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
8259 +{
8260 + return xchg(&(v->counter), new);
8261 +}
8262 +
8263 /**
8264 * atomic64_add_unless - add unless the number is a given value
8265 * @v: pointer of type atomic64_t
8266 @@ -430,13 +493,29 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
8267
8268 __asm__ __volatile__ (
8269 PPC_ATOMIC_ENTRY_BARRIER
8270 -"1: ldarx %0,0,%1 # __atomic_add_unless\n\
8271 +"1: ldarx %0,0,%1 # atomic64_add_unless\n\
8272 cmpd 0,%0,%3 \n\
8273 - beq- 2f \n\
8274 - add %0,%2,%0 \n"
8275 + beq- 2f \n"
8276 +
8277 +#ifdef CONFIG_PAX_REFCOUNT
8278 +" mcrxr cr0\n"
8279 +" addo. %0,%2,%0\n"
8280 +" bf 4*cr0+so, 4f\n"
8281 +"3:.long " "0x00c00b00""\n"
8282 +"4:\n"
8283 +#else
8284 + "add %0,%2,%0 \n"
8285 +#endif
8286 +
8287 " stdcx. %0,0,%1 \n\
8288 bne- 1b \n"
8289 PPC_ATOMIC_EXIT_BARRIER
8290 +"5:"
8291 +
8292 +#ifdef CONFIG_PAX_REFCOUNT
8293 + _ASM_EXTABLE(3b, 5b)
8294 +#endif
8295 +
8296 " subf %0,%2,%0 \n\
8297 2:"
8298 : "=&r" (t)
8299 diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h
8300 index a3bf5be..e03ba81 100644
8301 --- a/arch/powerpc/include/asm/barrier.h
8302 +++ b/arch/powerpc/include/asm/barrier.h
8303 @@ -76,7 +76,7 @@
8304 do { \
8305 compiletime_assert_atomic_type(*p); \
8306 smp_lwsync(); \
8307 - ACCESS_ONCE(*p) = (v); \
8308 + ACCESS_ONCE_RW(*p) = (v); \
8309 } while (0)
8310
8311 #define smp_load_acquire(p) \
8312 diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h
8313 index 0dc42c5..b80a3a1 100644
8314 --- a/arch/powerpc/include/asm/cache.h
8315 +++ b/arch/powerpc/include/asm/cache.h
8316 @@ -4,6 +4,7 @@
8317 #ifdef __KERNEL__
8318
8319 #include <asm/reg.h>
8320 +#include <linux/const.h>
8321
8322 /* bytes per L1 cache line */
8323 #if defined(CONFIG_8xx) || defined(CONFIG_403GCX)
8324 @@ -23,7 +24,7 @@
8325 #define L1_CACHE_SHIFT 7
8326 #endif
8327
8328 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8329 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8330
8331 #define SMP_CACHE_BYTES L1_CACHE_BYTES
8332
8333 diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
8334 index ee46ffe..b36c98c 100644
8335 --- a/arch/powerpc/include/asm/elf.h
8336 +++ b/arch/powerpc/include/asm/elf.h
8337 @@ -30,6 +30,18 @@
8338
8339 #define ELF_ET_DYN_BASE 0x20000000
8340
8341 +#ifdef CONFIG_PAX_ASLR
8342 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
8343 +
8344 +#ifdef __powerpc64__
8345 +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
8346 +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
8347 +#else
8348 +#define PAX_DELTA_MMAP_LEN 15
8349 +#define PAX_DELTA_STACK_LEN 15
8350 +#endif
8351 +#endif
8352 +
8353 #define ELF_CORE_EFLAGS (is_elf2_task() ? 2 : 0)
8354
8355 /*
8356 diff --git a/arch/powerpc/include/asm/exec.h b/arch/powerpc/include/asm/exec.h
8357 index 8196e9c..d83a9f3 100644
8358 --- a/arch/powerpc/include/asm/exec.h
8359 +++ b/arch/powerpc/include/asm/exec.h
8360 @@ -4,6 +4,6 @@
8361 #ifndef _ASM_POWERPC_EXEC_H
8362 #define _ASM_POWERPC_EXEC_H
8363
8364 -extern unsigned long arch_align_stack(unsigned long sp);
8365 +#define arch_align_stack(x) ((x) & ~0xfUL)
8366
8367 #endif /* _ASM_POWERPC_EXEC_H */
8368 diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
8369 index 5acabbd..7ea14fa 100644
8370 --- a/arch/powerpc/include/asm/kmap_types.h
8371 +++ b/arch/powerpc/include/asm/kmap_types.h
8372 @@ -10,7 +10,7 @@
8373 * 2 of the License, or (at your option) any later version.
8374 */
8375
8376 -#define KM_TYPE_NR 16
8377 +#define KM_TYPE_NR 17
8378
8379 #endif /* __KERNEL__ */
8380 #endif /* _ASM_POWERPC_KMAP_TYPES_H */
8381 diff --git a/arch/powerpc/include/asm/local.h b/arch/powerpc/include/asm/local.h
8382 index b8da913..c02b593 100644
8383 --- a/arch/powerpc/include/asm/local.h
8384 +++ b/arch/powerpc/include/asm/local.h
8385 @@ -9,21 +9,65 @@ typedef struct
8386 atomic_long_t a;
8387 } local_t;
8388
8389 +typedef struct
8390 +{
8391 + atomic_long_unchecked_t a;
8392 +} local_unchecked_t;
8393 +
8394 #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
8395
8396 #define local_read(l) atomic_long_read(&(l)->a)
8397 +#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
8398 #define local_set(l,i) atomic_long_set(&(l)->a, (i))
8399 +#define local_set_unchecked(l,i) atomic_long_set_unchecked(&(l)->a, (i))
8400
8401 #define local_add(i,l) atomic_long_add((i),(&(l)->a))
8402 +#define local_add_unchecked(i,l) atomic_long_add_unchecked((i),(&(l)->a))
8403 #define local_sub(i,l) atomic_long_sub((i),(&(l)->a))
8404 +#define local_sub_unchecked(i,l) atomic_long_sub_unchecked((i),(&(l)->a))
8405 #define local_inc(l) atomic_long_inc(&(l)->a)
8406 +#define local_inc_unchecked(l) atomic_long_inc_unchecked(&(l)->a)
8407 #define local_dec(l) atomic_long_dec(&(l)->a)
8408 +#define local_dec_unchecked(l) atomic_long_dec_unchecked(&(l)->a)
8409
8410 static __inline__ long local_add_return(long a, local_t *l)
8411 {
8412 long t;
8413
8414 __asm__ __volatile__(
8415 +"1:" PPC_LLARX(%0,0,%2,0) " # local_add_return\n"
8416 +
8417 +#ifdef CONFIG_PAX_REFCOUNT
8418 +" mcrxr cr0\n"
8419 +" addo. %0,%1,%0\n"
8420 +" bf 4*cr0+so, 3f\n"
8421 +"2:.long " "0x00c00b00""\n"
8422 +#else
8423 +" add %0,%1,%0\n"
8424 +#endif
8425 +
8426 +"3:\n"
8427 + PPC405_ERR77(0,%2)
8428 + PPC_STLCX "%0,0,%2 \n\
8429 + bne- 1b"
8430 +
8431 +#ifdef CONFIG_PAX_REFCOUNT
8432 +"\n4:\n"
8433 + _ASM_EXTABLE(2b, 4b)
8434 +#endif
8435 +
8436 + : "=&r" (t)
8437 + : "r" (a), "r" (&(l->a.counter))
8438 + : "cc", "memory");
8439 +
8440 + return t;
8441 +}
8442 +
8443 +static __inline__ long local_add_return_unchecked(long a, local_unchecked_t *l)
8444 +{
8445 + long t;
8446 +
8447 + __asm__ __volatile__(
8448 "1:" PPC_LLARX(%0,0,%2,0) " # local_add_return\n\
8449 add %0,%1,%0\n"
8450 PPC405_ERR77(0,%2)
8451 @@ -101,6 +145,8 @@ static __inline__ long local_dec_return(local_t *l)
8452
8453 #define local_cmpxchg(l, o, n) \
8454 (cmpxchg_local(&((l)->a.counter), (o), (n)))
8455 +#define local_cmpxchg_unchecked(l, o, n) \
8456 + (cmpxchg_local(&((l)->a.counter), (o), (n)))
8457 #define local_xchg(l, n) (xchg_local(&((l)->a.counter), (n)))
8458
8459 /**
8460 diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
8461 index 8565c25..2865190 100644
8462 --- a/arch/powerpc/include/asm/mman.h
8463 +++ b/arch/powerpc/include/asm/mman.h
8464 @@ -24,7 +24,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
8465 }
8466 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
8467
8468 -static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
8469 +static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
8470 {
8471 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
8472 }
8473 diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
8474 index 69c0598..2c56964 100644
8475 --- a/arch/powerpc/include/asm/page.h
8476 +++ b/arch/powerpc/include/asm/page.h
8477 @@ -227,8 +227,9 @@ extern long long virt_phys_offset;
8478 * and needs to be executable. This means the whole heap ends
8479 * up being executable.
8480 */
8481 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
8482 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8483 +#define VM_DATA_DEFAULT_FLAGS32 \
8484 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
8485 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8486
8487 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
8488 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8489 @@ -256,6 +257,9 @@ extern long long virt_phys_offset;
8490 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
8491 #endif
8492
8493 +#define ktla_ktva(addr) (addr)
8494 +#define ktva_ktla(addr) (addr)
8495 +
8496 #ifndef CONFIG_PPC_BOOK3S_64
8497 /*
8498 * Use the top bit of the higher-level page table entries to indicate whether
8499 diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
8500 index d908a46..3753f71 100644
8501 --- a/arch/powerpc/include/asm/page_64.h
8502 +++ b/arch/powerpc/include/asm/page_64.h
8503 @@ -172,15 +172,18 @@ do { \
8504 * stack by default, so in the absence of a PT_GNU_STACK program header
8505 * we turn execute permission off.
8506 */
8507 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
8508 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8509 +#define VM_STACK_DEFAULT_FLAGS32 \
8510 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
8511 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8512
8513 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
8514 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8515
8516 +#ifndef CONFIG_PAX_PAGEEXEC
8517 #define VM_STACK_DEFAULT_FLAGS \
8518 (is_32bit_task() ? \
8519 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
8520 +#endif
8521
8522 #include <asm-generic/getorder.h>
8523
8524 diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
8525 index 4b0be20..c15a27d 100644
8526 --- a/arch/powerpc/include/asm/pgalloc-64.h
8527 +++ b/arch/powerpc/include/asm/pgalloc-64.h
8528 @@ -54,6 +54,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
8529 #ifndef CONFIG_PPC_64K_PAGES
8530
8531 #define pgd_populate(MM, PGD, PUD) pgd_set(PGD, PUD)
8532 +#define pgd_populate_kernel(MM, PGD, PUD) pgd_populate((MM), (PGD), (PUD))
8533
8534 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
8535 {
8536 @@ -71,6 +72,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
8537 pud_set(pud, (unsigned long)pmd);
8538 }
8539
8540 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
8541 +{
8542 + pud_populate(mm, pud, pmd);
8543 +}
8544 +
8545 #define pmd_populate(mm, pmd, pte_page) \
8546 pmd_populate_kernel(mm, pmd, page_address(pte_page))
8547 #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, (unsigned long)(pte))
8548 @@ -173,6 +179,7 @@ extern void __tlb_remove_table(void *_table);
8549 #endif
8550
8551 #define pud_populate(mm, pud, pmd) pud_set(pud, (unsigned long)pmd)
8552 +#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
8553
8554 static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
8555 pte_t *pte)
8556 diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
8557 index 11a3863..108f194 100644
8558 --- a/arch/powerpc/include/asm/pgtable.h
8559 +++ b/arch/powerpc/include/asm/pgtable.h
8560 @@ -2,6 +2,7 @@
8561 #define _ASM_POWERPC_PGTABLE_H
8562 #ifdef __KERNEL__
8563
8564 +#include <linux/const.h>
8565 #ifndef __ASSEMBLY__
8566 #include <linux/mmdebug.h>
8567 #include <linux/mmzone.h>
8568 diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
8569 index 62cfb0c..50c6402 100644
8570 --- a/arch/powerpc/include/asm/pte-hash32.h
8571 +++ b/arch/powerpc/include/asm/pte-hash32.h
8572 @@ -20,6 +20,7 @@
8573 #define _PAGE_HASHPTE 0x002 /* hash_page has made an HPTE for this pte */
8574 #define _PAGE_USER 0x004 /* usermode access allowed */
8575 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
8576 +#define _PAGE_EXEC _PAGE_GUARDED
8577 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
8578 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
8579 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
8580 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
8581 index af56b5c..f86f3f6 100644
8582 --- a/arch/powerpc/include/asm/reg.h
8583 +++ b/arch/powerpc/include/asm/reg.h
8584 @@ -253,6 +253,7 @@
8585 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
8586 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
8587 #define DSISR_NOHPTE 0x40000000 /* no translation found */
8588 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
8589 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
8590 #define DSISR_ISSTORE 0x02000000 /* access was a store */
8591 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
8592 diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
8593 index 825663c..f9e9134 100644
8594 --- a/arch/powerpc/include/asm/smp.h
8595 +++ b/arch/powerpc/include/asm/smp.h
8596 @@ -51,7 +51,7 @@ struct smp_ops_t {
8597 int (*cpu_disable)(void);
8598 void (*cpu_die)(unsigned int nr);
8599 int (*cpu_bootable)(unsigned int nr);
8600 -};
8601 +} __no_const;
8602
8603 extern void smp_send_debugger_break(void);
8604 extern void start_secondary_resume(void);
8605 diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
8606 index 4dbe072..b803275 100644
8607 --- a/arch/powerpc/include/asm/spinlock.h
8608 +++ b/arch/powerpc/include/asm/spinlock.h
8609 @@ -204,13 +204,29 @@ static inline long __arch_read_trylock(arch_rwlock_t *rw)
8610 __asm__ __volatile__(
8611 "1: " PPC_LWARX(%0,0,%1,1) "\n"
8612 __DO_SIGN_EXTEND
8613 -" addic. %0,%0,1\n\
8614 - ble- 2f\n"
8615 +
8616 +#ifdef CONFIG_PAX_REFCOUNT
8617 +" mcrxr cr0\n"
8618 +" addico. %0,%0,1\n"
8619 +" bf 4*cr0+so, 3f\n"
8620 +"2:.long " "0x00c00b00""\n"
8621 +#else
8622 +" addic. %0,%0,1\n"
8623 +#endif
8624 +
8625 +"3:\n"
8626 + "ble- 4f\n"
8627 PPC405_ERR77(0,%1)
8628 " stwcx. %0,0,%1\n\
8629 bne- 1b\n"
8630 PPC_ACQUIRE_BARRIER
8631 -"2:" : "=&r" (tmp)
8632 +"4:"
8633 +
8634 +#ifdef CONFIG_PAX_REFCOUNT
8635 + _ASM_EXTABLE(2b,4b)
8636 +#endif
8637 +
8638 + : "=&r" (tmp)
8639 : "r" (&rw->lock)
8640 : "cr0", "xer", "memory");
8641
8642 @@ -286,11 +302,27 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
8643 __asm__ __volatile__(
8644 "# read_unlock\n\t"
8645 PPC_RELEASE_BARRIER
8646 -"1: lwarx %0,0,%1\n\
8647 - addic %0,%0,-1\n"
8648 +"1: lwarx %0,0,%1\n"
8649 +
8650 +#ifdef CONFIG_PAX_REFCOUNT
8651 +" mcrxr cr0\n"
8652 +" addico. %0,%0,-1\n"
8653 +" bf 4*cr0+so, 3f\n"
8654 +"2:.long " "0x00c00b00""\n"
8655 +#else
8656 +" addic. %0,%0,-1\n"
8657 +#endif
8658 +
8659 +"3:\n"
8660 PPC405_ERR77(0,%1)
8661 " stwcx. %0,0,%1\n\
8662 bne- 1b"
8663 +
8664 +#ifdef CONFIG_PAX_REFCOUNT
8665 +"\n4:\n"
8666 + _ASM_EXTABLE(2b, 4b)
8667 +#endif
8668 +
8669 : "=&r"(tmp)
8670 : "r"(&rw->lock)
8671 : "cr0", "xer", "memory");
8672 diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
8673 index 7efee4a..48d47cc 100644
8674 --- a/arch/powerpc/include/asm/thread_info.h
8675 +++ b/arch/powerpc/include/asm/thread_info.h
8676 @@ -101,6 +101,8 @@ static inline struct thread_info *current_thread_info(void)
8677 #if defined(CONFIG_PPC64)
8678 #define TIF_ELF2ABI 18 /* function descriptors must die! */
8679 #endif
8680 +/* mask must be expressable within 16 bits to satisfy 'andi' instruction reqs */
8681 +#define TIF_GRSEC_SETXID 6 /* update credentials on syscall entry/exit */
8682
8683 /* as above, but as bit values */
8684 #define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE)
8685 @@ -119,9 +121,10 @@ static inline struct thread_info *current_thread_info(void)
8686 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
8687 #define _TIF_EMULATE_STACK_STORE (1<<TIF_EMULATE_STACK_STORE)
8688 #define _TIF_NOHZ (1<<TIF_NOHZ)
8689 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
8690 #define _TIF_SYSCALL_DOTRACE (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
8691 _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT | \
8692 - _TIF_NOHZ)
8693 + _TIF_NOHZ | _TIF_GRSEC_SETXID)
8694
8695 #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
8696 _TIF_NOTIFY_RESUME | _TIF_UPROBE | \
8697 diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
8698 index a0c071d..49cdc7f 100644
8699 --- a/arch/powerpc/include/asm/uaccess.h
8700 +++ b/arch/powerpc/include/asm/uaccess.h
8701 @@ -58,6 +58,7 @@
8702
8703 #endif
8704
8705 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
8706 #define access_ok(type, addr, size) \
8707 (__chk_user_ptr(addr), \
8708 __access_ok((__force unsigned long)(addr), (size), get_fs()))
8709 @@ -318,52 +319,6 @@ do { \
8710 extern unsigned long __copy_tofrom_user(void __user *to,
8711 const void __user *from, unsigned long size);
8712
8713 -#ifndef __powerpc64__
8714 -
8715 -static inline unsigned long copy_from_user(void *to,
8716 - const void __user *from, unsigned long n)
8717 -{
8718 - unsigned long over;
8719 -
8720 - if (access_ok(VERIFY_READ, from, n))
8721 - return __copy_tofrom_user((__force void __user *)to, from, n);
8722 - if ((unsigned long)from < TASK_SIZE) {
8723 - over = (unsigned long)from + n - TASK_SIZE;
8724 - return __copy_tofrom_user((__force void __user *)to, from,
8725 - n - over) + over;
8726 - }
8727 - return n;
8728 -}
8729 -
8730 -static inline unsigned long copy_to_user(void __user *to,
8731 - const void *from, unsigned long n)
8732 -{
8733 - unsigned long over;
8734 -
8735 - if (access_ok(VERIFY_WRITE, to, n))
8736 - return __copy_tofrom_user(to, (__force void __user *)from, n);
8737 - if ((unsigned long)to < TASK_SIZE) {
8738 - over = (unsigned long)to + n - TASK_SIZE;
8739 - return __copy_tofrom_user(to, (__force void __user *)from,
8740 - n - over) + over;
8741 - }
8742 - return n;
8743 -}
8744 -
8745 -#else /* __powerpc64__ */
8746 -
8747 -#define __copy_in_user(to, from, size) \
8748 - __copy_tofrom_user((to), (from), (size))
8749 -
8750 -extern unsigned long copy_from_user(void *to, const void __user *from,
8751 - unsigned long n);
8752 -extern unsigned long copy_to_user(void __user *to, const void *from,
8753 - unsigned long n);
8754 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
8755 - unsigned long n);
8756 -
8757 -#endif /* __powerpc64__ */
8758 -
8759 static inline unsigned long __copy_from_user_inatomic(void *to,
8760 const void __user *from, unsigned long n)
8761 {
8762 @@ -387,6 +342,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
8763 if (ret == 0)
8764 return 0;
8765 }
8766 +
8767 + if (!__builtin_constant_p(n))
8768 + check_object_size(to, n, false);
8769 +
8770 return __copy_tofrom_user((__force void __user *)to, from, n);
8771 }
8772
8773 @@ -413,6 +372,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
8774 if (ret == 0)
8775 return 0;
8776 }
8777 +
8778 + if (!__builtin_constant_p(n))
8779 + check_object_size(from, n, true);
8780 +
8781 return __copy_tofrom_user(to, (__force const void __user *)from, n);
8782 }
8783
8784 @@ -430,6 +393,92 @@ static inline unsigned long __copy_to_user(void __user *to,
8785 return __copy_to_user_inatomic(to, from, size);
8786 }
8787
8788 +#ifndef __powerpc64__
8789 +
8790 +static inline unsigned long __must_check copy_from_user(void *to,
8791 + const void __user *from, unsigned long n)
8792 +{
8793 + unsigned long over;
8794 +
8795 + if ((long)n < 0)
8796 + return n;
8797 +
8798 + if (access_ok(VERIFY_READ, from, n)) {
8799 + if (!__builtin_constant_p(n))
8800 + check_object_size(to, n, false);
8801 + return __copy_tofrom_user((__force void __user *)to, from, n);
8802 + }
8803 + if ((unsigned long)from < TASK_SIZE) {
8804 + over = (unsigned long)from + n - TASK_SIZE;
8805 + if (!__builtin_constant_p(n - over))
8806 + check_object_size(to, n - over, false);
8807 + return __copy_tofrom_user((__force void __user *)to, from,
8808 + n - over) + over;
8809 + }
8810 + return n;
8811 +}
8812 +
8813 +static inline unsigned long __must_check copy_to_user(void __user *to,
8814 + const void *from, unsigned long n)
8815 +{
8816 + unsigned long over;
8817 +
8818 + if ((long)n < 0)
8819 + return n;
8820 +
8821 + if (access_ok(VERIFY_WRITE, to, n)) {
8822 + if (!__builtin_constant_p(n))
8823 + check_object_size(from, n, true);
8824 + return __copy_tofrom_user(to, (__force void __user *)from, n);
8825 + }
8826 + if ((unsigned long)to < TASK_SIZE) {
8827 + over = (unsigned long)to + n - TASK_SIZE;
8828 + if (!__builtin_constant_p(n))
8829 + check_object_size(from, n - over, true);
8830 + return __copy_tofrom_user(to, (__force void __user *)from,
8831 + n - over) + over;
8832 + }
8833 + return n;
8834 +}
8835 +
8836 +#else /* __powerpc64__ */
8837 +
8838 +#define __copy_in_user(to, from, size) \
8839 + __copy_tofrom_user((to), (from), (size))
8840 +
8841 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
8842 +{
8843 + if ((long)n < 0 || n > INT_MAX)
8844 + return n;
8845 +
8846 + if (!__builtin_constant_p(n))
8847 + check_object_size(to, n, false);
8848 +
8849 + if (likely(access_ok(VERIFY_READ, from, n)))
8850 + n = __copy_from_user(to, from, n);
8851 + else
8852 + memset(to, 0, n);
8853 + return n;
8854 +}
8855 +
8856 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
8857 +{
8858 + if ((long)n < 0 || n > INT_MAX)
8859 + return n;
8860 +
8861 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
8862 + if (!__builtin_constant_p(n))
8863 + check_object_size(from, n, true);
8864 + n = __copy_to_user(to, from, n);
8865 + }
8866 + return n;
8867 +}
8868 +
8869 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
8870 + unsigned long n);
8871 +
8872 +#endif /* __powerpc64__ */
8873 +
8874 extern unsigned long __clear_user(void __user *addr, unsigned long size);
8875
8876 static inline unsigned long clear_user(void __user *addr, unsigned long size)
8877 diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
8878 index c1ebbda..fd8a98d 100644
8879 --- a/arch/powerpc/kernel/Makefile
8880 +++ b/arch/powerpc/kernel/Makefile
8881 @@ -15,6 +15,11 @@ CFLAGS_prom_init.o += -fPIC
8882 CFLAGS_btext.o += -fPIC
8883 endif
8884
8885 +CFLAGS_REMOVE_cputable.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
8886 +CFLAGS_REMOVE_prom_init.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
8887 +CFLAGS_REMOVE_btext.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
8888 +CFLAGS_REMOVE_prom.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
8889 +
8890 ifdef CONFIG_FUNCTION_TRACER
8891 # Do not trace early boot code
8892 CFLAGS_REMOVE_cputable.o = -pg -mno-sched-epilog
8893 @@ -27,6 +32,8 @@ CFLAGS_REMOVE_ftrace.o = -pg -mno-sched-epilog
8894 CFLAGS_REMOVE_time.o = -pg -mno-sched-epilog
8895 endif
8896
8897 +CFLAGS_REMOVE_prom_init.o += $(LATENT_ENTROPY_PLUGIN_CFLAGS)
8898 +
8899 obj-y := cputable.o ptrace.o syscalls.o \
8900 irq.o align.o signal_32.o pmc.o vdso.o \
8901 process.o systbl.o idle.o \
8902 diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
8903 index 3e68d1c..72a5ee6 100644
8904 --- a/arch/powerpc/kernel/exceptions-64e.S
8905 +++ b/arch/powerpc/kernel/exceptions-64e.S
8906 @@ -1010,6 +1010,7 @@ storage_fault_common:
8907 std r14,_DAR(r1)
8908 std r15,_DSISR(r1)
8909 addi r3,r1,STACK_FRAME_OVERHEAD
8910 + bl save_nvgprs
8911 mr r4,r14
8912 mr r5,r15
8913 ld r14,PACA_EXGEN+EX_R14(r13)
8914 @@ -1018,8 +1019,7 @@ storage_fault_common:
8915 cmpdi r3,0
8916 bne- 1f
8917 b ret_from_except_lite
8918 -1: bl save_nvgprs
8919 - mr r5,r3
8920 +1: mr r5,r3
8921 addi r3,r1,STACK_FRAME_OVERHEAD
8922 ld r4,_DAR(r1)
8923 bl bad_page_fault
8924 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
8925 index 9519e6b..13f6c38 100644
8926 --- a/arch/powerpc/kernel/exceptions-64s.S
8927 +++ b/arch/powerpc/kernel/exceptions-64s.S
8928 @@ -1599,10 +1599,10 @@ handle_page_fault:
8929 11: ld r4,_DAR(r1)
8930 ld r5,_DSISR(r1)
8931 addi r3,r1,STACK_FRAME_OVERHEAD
8932 + bl save_nvgprs
8933 bl do_page_fault
8934 cmpdi r3,0
8935 beq+ 12f
8936 - bl save_nvgprs
8937 mr r5,r3
8938 addi r3,r1,STACK_FRAME_OVERHEAD
8939 lwz r4,_DAR(r1)
8940 diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
8941 index 4509603..cdb491f 100644
8942 --- a/arch/powerpc/kernel/irq.c
8943 +++ b/arch/powerpc/kernel/irq.c
8944 @@ -460,6 +460,8 @@ void migrate_irqs(void)
8945 }
8946 #endif
8947
8948 +extern void gr_handle_kernel_exploit(void);
8949 +
8950 static inline void check_stack_overflow(void)
8951 {
8952 #ifdef CONFIG_DEBUG_STACKOVERFLOW
8953 @@ -472,6 +474,7 @@ static inline void check_stack_overflow(void)
8954 pr_err("do_IRQ: stack overflow: %ld\n",
8955 sp - sizeof(struct thread_info));
8956 dump_stack();
8957 + gr_handle_kernel_exploit();
8958 }
8959 #endif
8960 }
8961 diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
8962 index c94d2e0..992a9ce 100644
8963 --- a/arch/powerpc/kernel/module_32.c
8964 +++ b/arch/powerpc/kernel/module_32.c
8965 @@ -158,7 +158,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
8966 me->arch.core_plt_section = i;
8967 }
8968 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
8969 - pr_err("Module doesn't contain .plt or .init.plt sections.\n");
8970 + pr_err("Module $s doesn't contain .plt or .init.plt sections.\n", me->name);
8971 return -ENOEXEC;
8972 }
8973
8974 @@ -188,11 +188,16 @@ static uint32_t do_plt_call(void *location,
8975
8976 pr_debug("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
8977 /* Init, or core PLT? */
8978 - if (location >= mod->module_core
8979 - && location < mod->module_core + mod->core_size)
8980 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
8981 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
8982 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
8983 - else
8984 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
8985 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
8986 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
8987 + else {
8988 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
8989 + return ~0UL;
8990 + }
8991
8992 /* Find this entry, or if that fails, the next avail. entry */
8993 while (entry->jump[0]) {
8994 @@ -296,7 +301,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
8995 }
8996 #ifdef CONFIG_DYNAMIC_FTRACE
8997 module->arch.tramp =
8998 - do_plt_call(module->module_core,
8999 + do_plt_call(module->module_core_rx,
9000 (unsigned long)ftrace_caller,
9001 sechdrs, module);
9002 #endif
9003 diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
9004 index febb50d..bb10020 100644
9005 --- a/arch/powerpc/kernel/process.c
9006 +++ b/arch/powerpc/kernel/process.c
9007 @@ -1036,8 +1036,8 @@ void show_regs(struct pt_regs * regs)
9008 * Lookup NIP late so we have the best change of getting the
9009 * above info out without failing
9010 */
9011 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
9012 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
9013 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
9014 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
9015 #endif
9016 show_stack(current, (unsigned long *) regs->gpr[1]);
9017 if (!user_mode(regs))
9018 @@ -1554,10 +1554,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
9019 newsp = stack[0];
9020 ip = stack[STACK_FRAME_LR_SAVE];
9021 if (!firstframe || ip != lr) {
9022 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
9023 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
9024 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
9025 if ((ip == rth) && curr_frame >= 0) {
9026 - printk(" (%pS)",
9027 + printk(" (%pA)",
9028 (void *)current->ret_stack[curr_frame].ret);
9029 curr_frame--;
9030 }
9031 @@ -1577,7 +1577,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
9032 struct pt_regs *regs = (struct pt_regs *)
9033 (sp + STACK_FRAME_OVERHEAD);
9034 lr = regs->link;
9035 - printk("--- interrupt: %lx at %pS\n LR = %pS\n",
9036 + printk("--- interrupt: %lx at %pA\n LR = %pA\n",
9037 regs->trap, (void *)regs->nip, (void *)lr);
9038 firstframe = 1;
9039 }
9040 @@ -1613,49 +1613,3 @@ void notrace __ppc64_runlatch_off(void)
9041 mtspr(SPRN_CTRLT, ctrl);
9042 }
9043 #endif /* CONFIG_PPC64 */
9044 -
9045 -unsigned long arch_align_stack(unsigned long sp)
9046 -{
9047 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
9048 - sp -= get_random_int() & ~PAGE_MASK;
9049 - return sp & ~0xf;
9050 -}
9051 -
9052 -static inline unsigned long brk_rnd(void)
9053 -{
9054 - unsigned long rnd = 0;
9055 -
9056 - /* 8MB for 32bit, 1GB for 64bit */
9057 - if (is_32bit_task())
9058 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
9059 - else
9060 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
9061 -
9062 - return rnd << PAGE_SHIFT;
9063 -}
9064 -
9065 -unsigned long arch_randomize_brk(struct mm_struct *mm)
9066 -{
9067 - unsigned long base = mm->brk;
9068 - unsigned long ret;
9069 -
9070 -#ifdef CONFIG_PPC_STD_MMU_64
9071 - /*
9072 - * If we are using 1TB segments and we are allowed to randomise
9073 - * the heap, we can put it above 1TB so it is backed by a 1TB
9074 - * segment. Otherwise the heap will be in the bottom 1TB
9075 - * which always uses 256MB segments and this may result in a
9076 - * performance penalty.
9077 - */
9078 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
9079 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
9080 -#endif
9081 -
9082 - ret = PAGE_ALIGN(base + brk_rnd());
9083 -
9084 - if (ret < mm->brk)
9085 - return mm->brk;
9086 -
9087 - return ret;
9088 -}
9089 -
9090 diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
9091 index f21897b..28c0428 100644
9092 --- a/arch/powerpc/kernel/ptrace.c
9093 +++ b/arch/powerpc/kernel/ptrace.c
9094 @@ -1762,6 +1762,10 @@ long arch_ptrace(struct task_struct *child, long request,
9095 return ret;
9096 }
9097
9098 +#ifdef CONFIG_GRKERNSEC_SETXID
9099 +extern void gr_delayed_cred_worker(void);
9100 +#endif
9101 +
9102 /*
9103 * We must return the syscall number to actually look up in the table.
9104 * This can be -1L to skip running any syscall at all.
9105 @@ -1774,6 +1778,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
9106
9107 secure_computing_strict(regs->gpr[0]);
9108
9109 +#ifdef CONFIG_GRKERNSEC_SETXID
9110 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
9111 + gr_delayed_cred_worker();
9112 +#endif
9113 +
9114 if (test_thread_flag(TIF_SYSCALL_TRACE) &&
9115 tracehook_report_syscall_entry(regs))
9116 /*
9117 @@ -1805,6 +1814,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
9118 {
9119 int step;
9120
9121 +#ifdef CONFIG_GRKERNSEC_SETXID
9122 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
9123 + gr_delayed_cred_worker();
9124 +#endif
9125 +
9126 audit_syscall_exit(regs);
9127
9128 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
9129 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
9130 index d3a831a..3a33123 100644
9131 --- a/arch/powerpc/kernel/signal_32.c
9132 +++ b/arch/powerpc/kernel/signal_32.c
9133 @@ -1011,7 +1011,7 @@ int handle_rt_signal32(struct ksignal *ksig, sigset_t *oldset,
9134 /* Save user registers on the stack */
9135 frame = &rt_sf->uc.uc_mcontext;
9136 addr = frame;
9137 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
9138 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
9139 sigret = 0;
9140 tramp = current->mm->context.vdso_base + vdso32_rt_sigtramp;
9141 } else {
9142 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
9143 index c7c24d2..1bf7039 100644
9144 --- a/arch/powerpc/kernel/signal_64.c
9145 +++ b/arch/powerpc/kernel/signal_64.c
9146 @@ -754,7 +754,7 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs
9147 current->thread.fp_state.fpscr = 0;
9148
9149 /* Set up to return from userspace. */
9150 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
9151 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
9152 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
9153 } else {
9154 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
9155 diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
9156 index 19e4744..28a8d7b 100644
9157 --- a/arch/powerpc/kernel/traps.c
9158 +++ b/arch/powerpc/kernel/traps.c
9159 @@ -36,6 +36,7 @@
9160 #include <linux/debugfs.h>
9161 #include <linux/ratelimit.h>
9162 #include <linux/context_tracking.h>
9163 +#include <linux/uaccess.h>
9164
9165 #include <asm/emulated_ops.h>
9166 #include <asm/pgtable.h>
9167 @@ -142,6 +143,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
9168 return flags;
9169 }
9170
9171 +extern void gr_handle_kernel_exploit(void);
9172 +
9173 static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
9174 int signr)
9175 {
9176 @@ -191,6 +194,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
9177 panic("Fatal exception in interrupt");
9178 if (panic_on_oops)
9179 panic("Fatal exception");
9180 +
9181 + gr_handle_kernel_exploit();
9182 +
9183 do_exit(signr);
9184 }
9185
9186 @@ -1137,6 +1143,26 @@ void __kprobes program_check_exception(struct pt_regs *regs)
9187 enum ctx_state prev_state = exception_enter();
9188 unsigned int reason = get_reason(regs);
9189
9190 +#ifdef CONFIG_PAX_REFCOUNT
9191 + unsigned int bkpt;
9192 + const struct exception_table_entry *entry;
9193 +
9194 + if (reason & REASON_ILLEGAL) {
9195 + /* Check if PaX bad instruction */
9196 + if (!probe_kernel_address(regs->nip, bkpt) && bkpt == 0xc00b00) {
9197 + current->thread.trap_nr = 0;
9198 + pax_report_refcount_overflow(regs);
9199 + /* fixup_exception() for PowerPC does not exist, simulate its job */
9200 + if ((entry = search_exception_tables(regs->nip)) != NULL) {
9201 + regs->nip = entry->fixup;
9202 + return;
9203 + }
9204 + /* fixup_exception() could not handle */
9205 + goto bail;
9206 + }
9207 + }
9208 +#endif
9209 +
9210 /* We can now get here via a FP Unavailable exception if the core
9211 * has no FPU, in that case the reason flags will be 0 */
9212
9213 diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
9214 index 305eb0d..accc5b40 100644
9215 --- a/arch/powerpc/kernel/vdso.c
9216 +++ b/arch/powerpc/kernel/vdso.c
9217 @@ -34,6 +34,7 @@
9218 #include <asm/vdso.h>
9219 #include <asm/vdso_datapage.h>
9220 #include <asm/setup.h>
9221 +#include <asm/mman.h>
9222
9223 #undef DEBUG
9224
9225 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
9226 vdso_base = VDSO32_MBASE;
9227 #endif
9228
9229 - current->mm->context.vdso_base = 0;
9230 + current->mm->context.vdso_base = ~0UL;
9231
9232 /* vDSO has a problem and was disabled, just don't "enable" it for the
9233 * process
9234 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
9235 vdso_base = get_unmapped_area(NULL, vdso_base,
9236 (vdso_pages << PAGE_SHIFT) +
9237 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
9238 - 0, 0);
9239 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
9240 if (IS_ERR_VALUE(vdso_base)) {
9241 rc = vdso_base;
9242 goto fail_mmapsem;
9243 diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
9244 index ac3ddf1..9a54c76 100644
9245 --- a/arch/powerpc/kvm/powerpc.c
9246 +++ b/arch/powerpc/kvm/powerpc.c
9247 @@ -1403,7 +1403,7 @@ void kvmppc_init_lpid(unsigned long nr_lpids_param)
9248 }
9249 EXPORT_SYMBOL_GPL(kvmppc_init_lpid);
9250
9251 -int kvm_arch_init(void *opaque)
9252 +int kvm_arch_init(const void *opaque)
9253 {
9254 return 0;
9255 }
9256 diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
9257 index 5eea6f3..5d10396 100644
9258 --- a/arch/powerpc/lib/usercopy_64.c
9259 +++ b/arch/powerpc/lib/usercopy_64.c
9260 @@ -9,22 +9,6 @@
9261 #include <linux/module.h>
9262 #include <asm/uaccess.h>
9263
9264 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
9265 -{
9266 - if (likely(access_ok(VERIFY_READ, from, n)))
9267 - n = __copy_from_user(to, from, n);
9268 - else
9269 - memset(to, 0, n);
9270 - return n;
9271 -}
9272 -
9273 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
9274 -{
9275 - if (likely(access_ok(VERIFY_WRITE, to, n)))
9276 - n = __copy_to_user(to, from, n);
9277 - return n;
9278 -}
9279 -
9280 unsigned long copy_in_user(void __user *to, const void __user *from,
9281 unsigned long n)
9282 {
9283 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
9284 return n;
9285 }
9286
9287 -EXPORT_SYMBOL(copy_from_user);
9288 -EXPORT_SYMBOL(copy_to_user);
9289 EXPORT_SYMBOL(copy_in_user);
9290
9291 diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
9292 index b396868..3eb6b9f 100644
9293 --- a/arch/powerpc/mm/fault.c
9294 +++ b/arch/powerpc/mm/fault.c
9295 @@ -33,6 +33,10 @@
9296 #include <linux/ratelimit.h>
9297 #include <linux/context_tracking.h>
9298 #include <linux/hugetlb.h>
9299 +#include <linux/slab.h>
9300 +#include <linux/pagemap.h>
9301 +#include <linux/compiler.h>
9302 +#include <linux/unistd.h>
9303
9304 #include <asm/firmware.h>
9305 #include <asm/page.h>
9306 @@ -68,6 +72,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
9307 }
9308 #endif
9309
9310 +#ifdef CONFIG_PAX_PAGEEXEC
9311 +/*
9312 + * PaX: decide what to do with offenders (regs->nip = fault address)
9313 + *
9314 + * returns 1 when task should be killed
9315 + */
9316 +static int pax_handle_fetch_fault(struct pt_regs *regs)
9317 +{
9318 + return 1;
9319 +}
9320 +
9321 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
9322 +{
9323 + unsigned long i;
9324 +
9325 + printk(KERN_ERR "PAX: bytes at PC: ");
9326 + for (i = 0; i < 5; i++) {
9327 + unsigned int c;
9328 + if (get_user(c, (unsigned int __user *)pc+i))
9329 + printk(KERN_CONT "???????? ");
9330 + else
9331 + printk(KERN_CONT "%08x ", c);
9332 + }
9333 + printk("\n");
9334 +}
9335 +#endif
9336 +
9337 /*
9338 * Check whether the instruction at regs->nip is a store using
9339 * an update addressing form which will update r1.
9340 @@ -227,7 +258,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
9341 * indicate errors in DSISR but can validly be set in SRR1.
9342 */
9343 if (trap == 0x400)
9344 - error_code &= 0x48200000;
9345 + error_code &= 0x58200000;
9346 else
9347 is_write = error_code & DSISR_ISSTORE;
9348 #else
9349 @@ -383,12 +414,16 @@ good_area:
9350 * "undefined". Of those that can be set, this is the only
9351 * one which seems bad.
9352 */
9353 - if (error_code & 0x10000000)
9354 + if (error_code & DSISR_GUARDED)
9355 /* Guarded storage error. */
9356 goto bad_area;
9357 #endif /* CONFIG_8xx */
9358
9359 if (is_exec) {
9360 +#ifdef CONFIG_PPC_STD_MMU
9361 + if (error_code & DSISR_GUARDED)
9362 + goto bad_area;
9363 +#endif
9364 /*
9365 * Allow execution from readable areas if the MMU does not
9366 * provide separate controls over reading and executing.
9367 @@ -483,6 +518,23 @@ bad_area:
9368 bad_area_nosemaphore:
9369 /* User mode accesses cause a SIGSEGV */
9370 if (user_mode(regs)) {
9371 +
9372 +#ifdef CONFIG_PAX_PAGEEXEC
9373 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
9374 +#ifdef CONFIG_PPC_STD_MMU
9375 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
9376 +#else
9377 + if (is_exec && regs->nip == address) {
9378 +#endif
9379 + switch (pax_handle_fetch_fault(regs)) {
9380 + }
9381 +
9382 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
9383 + do_group_exit(SIGKILL);
9384 + }
9385 + }
9386 +#endif
9387 +
9388 _exception(SIGSEGV, regs, code, address);
9389 goto bail;
9390 }
9391 diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
9392 index 0f0502e..bc3e7a3 100644
9393 --- a/arch/powerpc/mm/mmap.c
9394 +++ b/arch/powerpc/mm/mmap.c
9395 @@ -86,6 +86,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
9396 {
9397 unsigned long random_factor = 0UL;
9398
9399 +#ifdef CONFIG_PAX_RANDMMAP
9400 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
9401 +#endif
9402 +
9403 if (current->flags & PF_RANDOMIZE)
9404 random_factor = arch_mmap_rnd();
9405
9406 @@ -95,9 +99,21 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
9407 */
9408 if (mmap_is_legacy()) {
9409 mm->mmap_base = TASK_UNMAPPED_BASE;
9410 +
9411 +#ifdef CONFIG_PAX_RANDMMAP
9412 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9413 + mm->mmap_base += mm->delta_mmap;
9414 +#endif
9415 +
9416 mm->get_unmapped_area = arch_get_unmapped_area;
9417 } else {
9418 mm->mmap_base = mmap_base(random_factor);
9419 +
9420 +#ifdef CONFIG_PAX_RANDMMAP
9421 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9422 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
9423 +#endif
9424 +
9425 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
9426 }
9427 }
9428 diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
9429 index 0f432a7..abfe841 100644
9430 --- a/arch/powerpc/mm/slice.c
9431 +++ b/arch/powerpc/mm/slice.c
9432 @@ -105,7 +105,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
9433 if ((mm->task_size - len) < addr)
9434 return 0;
9435 vma = find_vma(mm, addr);
9436 - return (!vma || (addr + len) <= vma->vm_start);
9437 + return check_heap_stack_gap(vma, addr, len, 0);
9438 }
9439
9440 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
9441 @@ -277,6 +277,12 @@ static unsigned long slice_find_area_bottomup(struct mm_struct *mm,
9442 info.align_offset = 0;
9443
9444 addr = TASK_UNMAPPED_BASE;
9445 +
9446 +#ifdef CONFIG_PAX_RANDMMAP
9447 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9448 + addr += mm->delta_mmap;
9449 +#endif
9450 +
9451 while (addr < TASK_SIZE) {
9452 info.low_limit = addr;
9453 if (!slice_scan_available(addr, available, 1, &addr))
9454 @@ -410,6 +416,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
9455 if (fixed && addr > (mm->task_size - len))
9456 return -ENOMEM;
9457
9458 +#ifdef CONFIG_PAX_RANDMMAP
9459 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
9460 + addr = 0;
9461 +#endif
9462 +
9463 /* If hint, make sure it matches our alignment restrictions */
9464 if (!fixed && addr) {
9465 addr = _ALIGN_UP(addr, 1ul << pshift);
9466 diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
9467 index d966bbe..372124a 100644
9468 --- a/arch/powerpc/platforms/cell/spufs/file.c
9469 +++ b/arch/powerpc/platforms/cell/spufs/file.c
9470 @@ -280,9 +280,9 @@ spufs_mem_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
9471 return VM_FAULT_NOPAGE;
9472 }
9473
9474 -static int spufs_mem_mmap_access(struct vm_area_struct *vma,
9475 +static ssize_t spufs_mem_mmap_access(struct vm_area_struct *vma,
9476 unsigned long address,
9477 - void *buf, int len, int write)
9478 + void *buf, size_t len, int write)
9479 {
9480 struct spu_context *ctx = vma->vm_file->private_data;
9481 unsigned long offset = address - vma->vm_start;
9482 diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
9483 index adbe380..adb7516 100644
9484 --- a/arch/s390/include/asm/atomic.h
9485 +++ b/arch/s390/include/asm/atomic.h
9486 @@ -317,4 +317,14 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
9487 #define atomic64_dec_and_test(_v) (atomic64_sub_return(1, _v) == 0)
9488 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
9489
9490 +#define atomic64_read_unchecked(v) atomic64_read(v)
9491 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
9492 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
9493 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
9494 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
9495 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
9496 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
9497 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
9498 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
9499 +
9500 #endif /* __ARCH_S390_ATOMIC__ */
9501 diff --git a/arch/s390/include/asm/barrier.h b/arch/s390/include/asm/barrier.h
9502 index 8d72471..5322500 100644
9503 --- a/arch/s390/include/asm/barrier.h
9504 +++ b/arch/s390/include/asm/barrier.h
9505 @@ -42,7 +42,7 @@
9506 do { \
9507 compiletime_assert_atomic_type(*p); \
9508 barrier(); \
9509 - ACCESS_ONCE(*p) = (v); \
9510 + ACCESS_ONCE_RW(*p) = (v); \
9511 } while (0)
9512
9513 #define smp_load_acquire(p) \
9514 diff --git a/arch/s390/include/asm/cache.h b/arch/s390/include/asm/cache.h
9515 index 4d7ccac..d03d0ad 100644
9516 --- a/arch/s390/include/asm/cache.h
9517 +++ b/arch/s390/include/asm/cache.h
9518 @@ -9,8 +9,10 @@
9519 #ifndef __ARCH_S390_CACHE_H
9520 #define __ARCH_S390_CACHE_H
9521
9522 -#define L1_CACHE_BYTES 256
9523 +#include <linux/const.h>
9524 +
9525 #define L1_CACHE_SHIFT 8
9526 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
9527 #define NET_SKB_PAD 32
9528
9529 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9530 diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
9531 index 3ad48f2..64cc6f3 100644
9532 --- a/arch/s390/include/asm/elf.h
9533 +++ b/arch/s390/include/asm/elf.h
9534 @@ -163,6 +163,13 @@ extern unsigned int vdso_enabled;
9535 (STACK_TOP / 3 * 2) : \
9536 (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
9537
9538 +#ifdef CONFIG_PAX_ASLR
9539 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
9540 +
9541 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
9542 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
9543 +#endif
9544 +
9545 /* This yields a mask that user programs can use to figure out what
9546 instruction set this CPU supports. */
9547
9548 diff --git a/arch/s390/include/asm/exec.h b/arch/s390/include/asm/exec.h
9549 index c4a93d6..4d2a9b4 100644
9550 --- a/arch/s390/include/asm/exec.h
9551 +++ b/arch/s390/include/asm/exec.h
9552 @@ -7,6 +7,6 @@
9553 #ifndef __ASM_EXEC_H
9554 #define __ASM_EXEC_H
9555
9556 -extern unsigned long arch_align_stack(unsigned long sp);
9557 +#define arch_align_stack(x) ((x) & ~0xfUL)
9558
9559 #endif /* __ASM_EXEC_H */
9560 diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
9561 index d64a7a6..0830329 100644
9562 --- a/arch/s390/include/asm/uaccess.h
9563 +++ b/arch/s390/include/asm/uaccess.h
9564 @@ -59,6 +59,7 @@ static inline int __range_ok(unsigned long addr, unsigned long size)
9565 __range_ok((unsigned long)(addr), (size)); \
9566 })
9567
9568 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
9569 #define access_ok(type, addr, size) __access_ok(addr, size)
9570
9571 /*
9572 @@ -275,6 +276,10 @@ static inline unsigned long __must_check
9573 copy_to_user(void __user *to, const void *from, unsigned long n)
9574 {
9575 might_fault();
9576 +
9577 + if ((long)n < 0)
9578 + return n;
9579 +
9580 return __copy_to_user(to, from, n);
9581 }
9582
9583 @@ -303,10 +308,14 @@ __compiletime_warning("copy_from_user() buffer size is not provably correct")
9584 static inline unsigned long __must_check
9585 copy_from_user(void *to, const void __user *from, unsigned long n)
9586 {
9587 - unsigned int sz = __compiletime_object_size(to);
9588 + size_t sz = __compiletime_object_size(to);
9589
9590 might_fault();
9591 - if (unlikely(sz != -1 && sz < n)) {
9592 +
9593 + if ((long)n < 0)
9594 + return n;
9595 +
9596 + if (unlikely(sz != (size_t)-1 && sz < n)) {
9597 copy_from_user_overflow();
9598 return n;
9599 }
9600 diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
9601 index 0c1a679..e1df357 100644
9602 --- a/arch/s390/kernel/module.c
9603 +++ b/arch/s390/kernel/module.c
9604 @@ -159,11 +159,11 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
9605
9606 /* Increase core size by size of got & plt and set start
9607 offsets for got and plt. */
9608 - me->core_size = ALIGN(me->core_size, 4);
9609 - me->arch.got_offset = me->core_size;
9610 - me->core_size += me->arch.got_size;
9611 - me->arch.plt_offset = me->core_size;
9612 - me->core_size += me->arch.plt_size;
9613 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
9614 + me->arch.got_offset = me->core_size_rw;
9615 + me->core_size_rw += me->arch.got_size;
9616 + me->arch.plt_offset = me->core_size_rx;
9617 + me->core_size_rx += me->arch.plt_size;
9618 return 0;
9619 }
9620
9621 @@ -279,7 +279,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9622 if (info->got_initialized == 0) {
9623 Elf_Addr *gotent;
9624
9625 - gotent = me->module_core + me->arch.got_offset +
9626 + gotent = me->module_core_rw + me->arch.got_offset +
9627 info->got_offset;
9628 *gotent = val;
9629 info->got_initialized = 1;
9630 @@ -302,7 +302,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9631 rc = apply_rela_bits(loc, val, 0, 64, 0);
9632 else if (r_type == R_390_GOTENT ||
9633 r_type == R_390_GOTPLTENT) {
9634 - val += (Elf_Addr) me->module_core - loc;
9635 + val += (Elf_Addr) me->module_core_rw - loc;
9636 rc = apply_rela_bits(loc, val, 1, 32, 1);
9637 }
9638 break;
9639 @@ -315,7 +315,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9640 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
9641 if (info->plt_initialized == 0) {
9642 unsigned int *ip;
9643 - ip = me->module_core + me->arch.plt_offset +
9644 + ip = me->module_core_rx + me->arch.plt_offset +
9645 info->plt_offset;
9646 ip[0] = 0x0d10e310; /* basr 1,0; lg 1,10(1); br 1 */
9647 ip[1] = 0x100a0004;
9648 @@ -334,7 +334,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9649 val - loc + 0xffffUL < 0x1ffffeUL) ||
9650 (r_type == R_390_PLT32DBL &&
9651 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
9652 - val = (Elf_Addr) me->module_core +
9653 + val = (Elf_Addr) me->module_core_rx +
9654 me->arch.plt_offset +
9655 info->plt_offset;
9656 val += rela->r_addend - loc;
9657 @@ -356,7 +356,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9658 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
9659 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
9660 val = val + rela->r_addend -
9661 - ((Elf_Addr) me->module_core + me->arch.got_offset);
9662 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
9663 if (r_type == R_390_GOTOFF16)
9664 rc = apply_rela_bits(loc, val, 0, 16, 0);
9665 else if (r_type == R_390_GOTOFF32)
9666 @@ -366,7 +366,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9667 break;
9668 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
9669 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
9670 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
9671 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
9672 rela->r_addend - loc;
9673 if (r_type == R_390_GOTPC)
9674 rc = apply_rela_bits(loc, val, 1, 32, 0);
9675 diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
9676 index dc5edc2..7d34ae3 100644
9677 --- a/arch/s390/kernel/process.c
9678 +++ b/arch/s390/kernel/process.c
9679 @@ -200,27 +200,3 @@ unsigned long get_wchan(struct task_struct *p)
9680 }
9681 return 0;
9682 }
9683 -
9684 -unsigned long arch_align_stack(unsigned long sp)
9685 -{
9686 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
9687 - sp -= get_random_int() & ~PAGE_MASK;
9688 - return sp & ~0xf;
9689 -}
9690 -
9691 -static inline unsigned long brk_rnd(void)
9692 -{
9693 - /* 8MB for 32bit, 1GB for 64bit */
9694 - if (is_32bit_task())
9695 - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
9696 - else
9697 - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
9698 -}
9699 -
9700 -unsigned long arch_randomize_brk(struct mm_struct *mm)
9701 -{
9702 - unsigned long ret;
9703 -
9704 - ret = PAGE_ALIGN(mm->brk + brk_rnd());
9705 - return (ret > mm->brk) ? ret : mm->brk;
9706 -}
9707 diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
9708 index 6e552af..3e608a1 100644
9709 --- a/arch/s390/mm/mmap.c
9710 +++ b/arch/s390/mm/mmap.c
9711 @@ -239,6 +239,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
9712 {
9713 unsigned long random_factor = 0UL;
9714
9715 +#ifdef CONFIG_PAX_RANDMMAP
9716 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
9717 +#endif
9718 +
9719 if (current->flags & PF_RANDOMIZE)
9720 random_factor = arch_mmap_rnd();
9721
9722 @@ -248,9 +252,21 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
9723 */
9724 if (mmap_is_legacy()) {
9725 mm->mmap_base = mmap_base_legacy(random_factor);
9726 +
9727 +#ifdef CONFIG_PAX_RANDMMAP
9728 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9729 + mm->mmap_base += mm->delta_mmap;
9730 +#endif
9731 +
9732 mm->get_unmapped_area = s390_get_unmapped_area;
9733 } else {
9734 mm->mmap_base = mmap_base(random_factor);
9735 +
9736 +#ifdef CONFIG_PAX_RANDMMAP
9737 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9738 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
9739 +#endif
9740 +
9741 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
9742 }
9743 }
9744 diff --git a/arch/score/include/asm/cache.h b/arch/score/include/asm/cache.h
9745 index ae3d59f..f65f075 100644
9746 --- a/arch/score/include/asm/cache.h
9747 +++ b/arch/score/include/asm/cache.h
9748 @@ -1,7 +1,9 @@
9749 #ifndef _ASM_SCORE_CACHE_H
9750 #define _ASM_SCORE_CACHE_H
9751
9752 +#include <linux/const.h>
9753 +
9754 #define L1_CACHE_SHIFT 4
9755 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9756 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
9757
9758 #endif /* _ASM_SCORE_CACHE_H */
9759 diff --git a/arch/score/include/asm/exec.h b/arch/score/include/asm/exec.h
9760 index f9f3cd5..58ff438 100644
9761 --- a/arch/score/include/asm/exec.h
9762 +++ b/arch/score/include/asm/exec.h
9763 @@ -1,6 +1,6 @@
9764 #ifndef _ASM_SCORE_EXEC_H
9765 #define _ASM_SCORE_EXEC_H
9766
9767 -extern unsigned long arch_align_stack(unsigned long sp);
9768 +#define arch_align_stack(x) (x)
9769
9770 #endif /* _ASM_SCORE_EXEC_H */
9771 diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
9772 index a1519ad3..e8ac1ff 100644
9773 --- a/arch/score/kernel/process.c
9774 +++ b/arch/score/kernel/process.c
9775 @@ -116,8 +116,3 @@ unsigned long get_wchan(struct task_struct *task)
9776
9777 return task_pt_regs(task)->cp0_epc;
9778 }
9779 -
9780 -unsigned long arch_align_stack(unsigned long sp)
9781 -{
9782 - return sp;
9783 -}
9784 diff --git a/arch/sh/include/asm/cache.h b/arch/sh/include/asm/cache.h
9785 index ef9e555..331bd29 100644
9786 --- a/arch/sh/include/asm/cache.h
9787 +++ b/arch/sh/include/asm/cache.h
9788 @@ -9,10 +9,11 @@
9789 #define __ASM_SH_CACHE_H
9790 #ifdef __KERNEL__
9791
9792 +#include <linux/const.h>
9793 #include <linux/init.h>
9794 #include <cpu/cache.h>
9795
9796 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9797 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
9798
9799 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9800
9801 diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
9802 index 6777177..cb5e44f 100644
9803 --- a/arch/sh/mm/mmap.c
9804 +++ b/arch/sh/mm/mmap.c
9805 @@ -36,6 +36,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
9806 struct mm_struct *mm = current->mm;
9807 struct vm_area_struct *vma;
9808 int do_colour_align;
9809 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
9810 struct vm_unmapped_area_info info;
9811
9812 if (flags & MAP_FIXED) {
9813 @@ -55,6 +56,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
9814 if (filp || (flags & MAP_SHARED))
9815 do_colour_align = 1;
9816
9817 +#ifdef CONFIG_PAX_RANDMMAP
9818 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
9819 +#endif
9820 +
9821 if (addr) {
9822 if (do_colour_align)
9823 addr = COLOUR_ALIGN(addr, pgoff);
9824 @@ -62,14 +67,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
9825 addr = PAGE_ALIGN(addr);
9826
9827 vma = find_vma(mm, addr);
9828 - if (TASK_SIZE - len >= addr &&
9829 - (!vma || addr + len <= vma->vm_start))
9830 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
9831 return addr;
9832 }
9833
9834 info.flags = 0;
9835 info.length = len;
9836 - info.low_limit = TASK_UNMAPPED_BASE;
9837 + info.low_limit = mm->mmap_base;
9838 info.high_limit = TASK_SIZE;
9839 info.align_mask = do_colour_align ? (PAGE_MASK & shm_align_mask) : 0;
9840 info.align_offset = pgoff << PAGE_SHIFT;
9841 @@ -85,6 +89,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9842 struct mm_struct *mm = current->mm;
9843 unsigned long addr = addr0;
9844 int do_colour_align;
9845 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
9846 struct vm_unmapped_area_info info;
9847
9848 if (flags & MAP_FIXED) {
9849 @@ -104,6 +109,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9850 if (filp || (flags & MAP_SHARED))
9851 do_colour_align = 1;
9852
9853 +#ifdef CONFIG_PAX_RANDMMAP
9854 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
9855 +#endif
9856 +
9857 /* requesting a specific address */
9858 if (addr) {
9859 if (do_colour_align)
9860 @@ -112,8 +121,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9861 addr = PAGE_ALIGN(addr);
9862
9863 vma = find_vma(mm, addr);
9864 - if (TASK_SIZE - len >= addr &&
9865 - (!vma || addr + len <= vma->vm_start))
9866 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
9867 return addr;
9868 }
9869
9870 @@ -135,6 +143,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9871 VM_BUG_ON(addr != -ENOMEM);
9872 info.flags = 0;
9873 info.low_limit = TASK_UNMAPPED_BASE;
9874 +
9875 +#ifdef CONFIG_PAX_RANDMMAP
9876 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9877 + info.low_limit += mm->delta_mmap;
9878 +#endif
9879 +
9880 info.high_limit = TASK_SIZE;
9881 addr = vm_unmapped_area(&info);
9882 }
9883 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
9884 index 4082749..fd97781 100644
9885 --- a/arch/sparc/include/asm/atomic_64.h
9886 +++ b/arch/sparc/include/asm/atomic_64.h
9887 @@ -15,18 +15,38 @@
9888 #define ATOMIC64_INIT(i) { (i) }
9889
9890 #define atomic_read(v) ACCESS_ONCE((v)->counter)
9891 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
9892 +{
9893 + return ACCESS_ONCE(v->counter);
9894 +}
9895 #define atomic64_read(v) ACCESS_ONCE((v)->counter)
9896 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
9897 +{
9898 + return ACCESS_ONCE(v->counter);
9899 +}
9900
9901 #define atomic_set(v, i) (((v)->counter) = i)
9902 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
9903 +{
9904 + v->counter = i;
9905 +}
9906 #define atomic64_set(v, i) (((v)->counter) = i)
9907 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
9908 +{
9909 + v->counter = i;
9910 +}
9911
9912 -#define ATOMIC_OP(op) \
9913 -void atomic_##op(int, atomic_t *); \
9914 -void atomic64_##op(long, atomic64_t *);
9915 +#define __ATOMIC_OP(op, suffix) \
9916 +void atomic_##op##suffix(int, atomic##suffix##_t *); \
9917 +void atomic64_##op##suffix(long, atomic64##suffix##_t *);
9918
9919 -#define ATOMIC_OP_RETURN(op) \
9920 -int atomic_##op##_return(int, atomic_t *); \
9921 -long atomic64_##op##_return(long, atomic64_t *);
9922 +#define ATOMIC_OP(op) __ATOMIC_OP(op, ) __ATOMIC_OP(op, _unchecked)
9923 +
9924 +#define __ATOMIC_OP_RETURN(op, suffix) \
9925 +int atomic_##op##_return##suffix(int, atomic##suffix##_t *); \
9926 +long atomic64_##op##_return##suffix(long, atomic64##suffix##_t *);
9927 +
9928 +#define ATOMIC_OP_RETURN(op) __ATOMIC_OP_RETURN(op, ) __ATOMIC_OP_RETURN(op, _unchecked)
9929
9930 #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op)
9931
9932 @@ -35,13 +55,23 @@ ATOMIC_OPS(sub)
9933
9934 #undef ATOMIC_OPS
9935 #undef ATOMIC_OP_RETURN
9936 +#undef __ATOMIC_OP_RETURN
9937 #undef ATOMIC_OP
9938 +#undef __ATOMIC_OP
9939
9940 #define atomic_dec_return(v) atomic_sub_return(1, v)
9941 #define atomic64_dec_return(v) atomic64_sub_return(1, v)
9942
9943 #define atomic_inc_return(v) atomic_add_return(1, v)
9944 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
9945 +{
9946 + return atomic_add_return_unchecked(1, v);
9947 +}
9948 #define atomic64_inc_return(v) atomic64_add_return(1, v)
9949 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
9950 +{
9951 + return atomic64_add_return_unchecked(1, v);
9952 +}
9953
9954 /*
9955 * atomic_inc_and_test - increment and test
9956 @@ -52,6 +82,10 @@ ATOMIC_OPS(sub)
9957 * other cases.
9958 */
9959 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
9960 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
9961 +{
9962 + return atomic_inc_return_unchecked(v) == 0;
9963 +}
9964 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
9965
9966 #define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
9967 @@ -61,25 +95,60 @@ ATOMIC_OPS(sub)
9968 #define atomic64_dec_and_test(v) (atomic64_sub_return(1, v) == 0)
9969
9970 #define atomic_inc(v) atomic_add(1, v)
9971 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
9972 +{
9973 + atomic_add_unchecked(1, v);
9974 +}
9975 #define atomic64_inc(v) atomic64_add(1, v)
9976 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
9977 +{
9978 + atomic64_add_unchecked(1, v);
9979 +}
9980
9981 #define atomic_dec(v) atomic_sub(1, v)
9982 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
9983 +{
9984 + atomic_sub_unchecked(1, v);
9985 +}
9986 #define atomic64_dec(v) atomic64_sub(1, v)
9987 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
9988 +{
9989 + atomic64_sub_unchecked(1, v);
9990 +}
9991
9992 #define atomic_add_negative(i, v) (atomic_add_return(i, v) < 0)
9993 #define atomic64_add_negative(i, v) (atomic64_add_return(i, v) < 0)
9994
9995 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
9996 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
9997 +{
9998 + return cmpxchg(&v->counter, old, new);
9999 +}
10000 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
10001 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
10002 +{
10003 + return xchg(&v->counter, new);
10004 +}
10005
10006 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
10007 {
10008 - int c, old;
10009 + int c, old, new;
10010 c = atomic_read(v);
10011 for (;;) {
10012 - if (unlikely(c == (u)))
10013 + if (unlikely(c == u))
10014 break;
10015 - old = atomic_cmpxchg((v), c, c + (a));
10016 +
10017 + asm volatile("addcc %2, %0, %0\n"
10018 +
10019 +#ifdef CONFIG_PAX_REFCOUNT
10020 + "tvs %%icc, 6\n"
10021 +#endif
10022 +
10023 + : "=r" (new)
10024 + : "0" (c), "ir" (a)
10025 + : "cc");
10026 +
10027 + old = atomic_cmpxchg(v, c, new);
10028 if (likely(old == c))
10029 break;
10030 c = old;
10031 @@ -90,20 +159,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
10032 #define atomic64_cmpxchg(v, o, n) \
10033 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
10034 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
10035 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
10036 +{
10037 + return xchg(&v->counter, new);
10038 +}
10039
10040 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
10041 {
10042 - long c, old;
10043 + long c, old, new;
10044 c = atomic64_read(v);
10045 for (;;) {
10046 - if (unlikely(c == (u)))
10047 + if (unlikely(c == u))
10048 break;
10049 - old = atomic64_cmpxchg((v), c, c + (a));
10050 +
10051 + asm volatile("addcc %2, %0, %0\n"
10052 +
10053 +#ifdef CONFIG_PAX_REFCOUNT
10054 + "tvs %%xcc, 6\n"
10055 +#endif
10056 +
10057 + : "=r" (new)
10058 + : "0" (c), "ir" (a)
10059 + : "cc");
10060 +
10061 + old = atomic64_cmpxchg(v, c, new);
10062 if (likely(old == c))
10063 break;
10064 c = old;
10065 }
10066 - return c != (u);
10067 + return c != u;
10068 }
10069
10070 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
10071 diff --git a/arch/sparc/include/asm/barrier_64.h b/arch/sparc/include/asm/barrier_64.h
10072 index 7664894..45a974b 100644
10073 --- a/arch/sparc/include/asm/barrier_64.h
10074 +++ b/arch/sparc/include/asm/barrier_64.h
10075 @@ -60,7 +60,7 @@ do { __asm__ __volatile__("ba,pt %%xcc, 1f\n\t" \
10076 do { \
10077 compiletime_assert_atomic_type(*p); \
10078 barrier(); \
10079 - ACCESS_ONCE(*p) = (v); \
10080 + ACCESS_ONCE_RW(*p) = (v); \
10081 } while (0)
10082
10083 #define smp_load_acquire(p) \
10084 diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
10085 index 5bb6991..5c2132e 100644
10086 --- a/arch/sparc/include/asm/cache.h
10087 +++ b/arch/sparc/include/asm/cache.h
10088 @@ -7,10 +7,12 @@
10089 #ifndef _SPARC_CACHE_H
10090 #define _SPARC_CACHE_H
10091
10092 +#include <linux/const.h>
10093 +
10094 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
10095
10096 #define L1_CACHE_SHIFT 5
10097 -#define L1_CACHE_BYTES 32
10098 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
10099
10100 #ifdef CONFIG_SPARC32
10101 #define SMP_CACHE_BYTES_SHIFT 5
10102 diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
10103 index a24e41f..47677ff 100644
10104 --- a/arch/sparc/include/asm/elf_32.h
10105 +++ b/arch/sparc/include/asm/elf_32.h
10106 @@ -114,6 +114,13 @@ typedef struct {
10107
10108 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
10109
10110 +#ifdef CONFIG_PAX_ASLR
10111 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
10112 +
10113 +#define PAX_DELTA_MMAP_LEN 16
10114 +#define PAX_DELTA_STACK_LEN 16
10115 +#endif
10116 +
10117 /* This yields a mask that user programs can use to figure out what
10118 instruction set this cpu supports. This can NOT be done in userspace
10119 on Sparc. */
10120 diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
10121 index 370ca1e..d4f4a98 100644
10122 --- a/arch/sparc/include/asm/elf_64.h
10123 +++ b/arch/sparc/include/asm/elf_64.h
10124 @@ -189,6 +189,13 @@ typedef struct {
10125 #define ELF_ET_DYN_BASE 0x0000010000000000UL
10126 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
10127
10128 +#ifdef CONFIG_PAX_ASLR
10129 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
10130 +
10131 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
10132 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
10133 +#endif
10134 +
10135 extern unsigned long sparc64_elf_hwcap;
10136 #define ELF_HWCAP sparc64_elf_hwcap
10137
10138 diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
10139 index a3890da..f6a408e 100644
10140 --- a/arch/sparc/include/asm/pgalloc_32.h
10141 +++ b/arch/sparc/include/asm/pgalloc_32.h
10142 @@ -35,6 +35,7 @@ static inline void pgd_set(pgd_t * pgdp, pmd_t * pmdp)
10143 }
10144
10145 #define pgd_populate(MM, PGD, PMD) pgd_set(PGD, PMD)
10146 +#define pgd_populate_kernel(MM, PGD, PMD) pgd_populate((MM), (PGD), (PMD))
10147
10148 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm,
10149 unsigned long address)
10150 diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
10151 index 5e31871..13469c6 100644
10152 --- a/arch/sparc/include/asm/pgalloc_64.h
10153 +++ b/arch/sparc/include/asm/pgalloc_64.h
10154 @@ -21,6 +21,7 @@ static inline void __pgd_populate(pgd_t *pgd, pud_t *pud)
10155 }
10156
10157 #define pgd_populate(MM, PGD, PUD) __pgd_populate(PGD, PUD)
10158 +#define pgd_populate_kernel(MM, PGD, PMD) pgd_populate((MM), (PGD), (PMD))
10159
10160 static inline pgd_t *pgd_alloc(struct mm_struct *mm)
10161 {
10162 @@ -38,6 +39,7 @@ static inline void __pud_populate(pud_t *pud, pmd_t *pmd)
10163 }
10164
10165 #define pud_populate(MM, PUD, PMD) __pud_populate(PUD, PMD)
10166 +#define pud_populate_kernel(MM, PUD, PMD) pud_populate((MM), (PUD), (PMD))
10167
10168 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
10169 {
10170 diff --git a/arch/sparc/include/asm/pgtable.h b/arch/sparc/include/asm/pgtable.h
10171 index 59ba6f6..4518128 100644
10172 --- a/arch/sparc/include/asm/pgtable.h
10173 +++ b/arch/sparc/include/asm/pgtable.h
10174 @@ -5,4 +5,8 @@
10175 #else
10176 #include <asm/pgtable_32.h>
10177 #endif
10178 +
10179 +#define ktla_ktva(addr) (addr)
10180 +#define ktva_ktla(addr) (addr)
10181 +
10182 #endif
10183 diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
10184 index f06b36a..bca3189 100644
10185 --- a/arch/sparc/include/asm/pgtable_32.h
10186 +++ b/arch/sparc/include/asm/pgtable_32.h
10187 @@ -51,6 +51,9 @@ unsigned long __init bootmem_init(unsigned long *pages_avail);
10188 #define PAGE_SHARED SRMMU_PAGE_SHARED
10189 #define PAGE_COPY SRMMU_PAGE_COPY
10190 #define PAGE_READONLY SRMMU_PAGE_RDONLY
10191 +#define PAGE_SHARED_NOEXEC SRMMU_PAGE_SHARED_NOEXEC
10192 +#define PAGE_COPY_NOEXEC SRMMU_PAGE_COPY_NOEXEC
10193 +#define PAGE_READONLY_NOEXEC SRMMU_PAGE_RDONLY_NOEXEC
10194 #define PAGE_KERNEL SRMMU_PAGE_KERNEL
10195
10196 /* Top-level page directory - dummy used by init-mm.
10197 @@ -63,18 +66,18 @@ extern unsigned long ptr_in_current_pgd;
10198
10199 /* xwr */
10200 #define __P000 PAGE_NONE
10201 -#define __P001 PAGE_READONLY
10202 -#define __P010 PAGE_COPY
10203 -#define __P011 PAGE_COPY
10204 +#define __P001 PAGE_READONLY_NOEXEC
10205 +#define __P010 PAGE_COPY_NOEXEC
10206 +#define __P011 PAGE_COPY_NOEXEC
10207 #define __P100 PAGE_READONLY
10208 #define __P101 PAGE_READONLY
10209 #define __P110 PAGE_COPY
10210 #define __P111 PAGE_COPY
10211
10212 #define __S000 PAGE_NONE
10213 -#define __S001 PAGE_READONLY
10214 -#define __S010 PAGE_SHARED
10215 -#define __S011 PAGE_SHARED
10216 +#define __S001 PAGE_READONLY_NOEXEC
10217 +#define __S010 PAGE_SHARED_NOEXEC
10218 +#define __S011 PAGE_SHARED_NOEXEC
10219 #define __S100 PAGE_READONLY
10220 #define __S101 PAGE_READONLY
10221 #define __S110 PAGE_SHARED
10222 diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
10223 index ae51a11..eadfd03 100644
10224 --- a/arch/sparc/include/asm/pgtsrmmu.h
10225 +++ b/arch/sparc/include/asm/pgtsrmmu.h
10226 @@ -111,6 +111,11 @@
10227 SRMMU_EXEC | SRMMU_REF)
10228 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
10229 SRMMU_EXEC | SRMMU_REF)
10230 +
10231 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
10232 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
10233 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
10234 +
10235 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
10236 SRMMU_DIRTY | SRMMU_REF)
10237
10238 diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h
10239 index 29d64b1..4272fe8 100644
10240 --- a/arch/sparc/include/asm/setup.h
10241 +++ b/arch/sparc/include/asm/setup.h
10242 @@ -55,8 +55,8 @@ int handle_ldf_stq(u32 insn, struct pt_regs *regs);
10243 void handle_ld_nf(u32 insn, struct pt_regs *regs);
10244
10245 /* init_64.c */
10246 -extern atomic_t dcpage_flushes;
10247 -extern atomic_t dcpage_flushes_xcall;
10248 +extern atomic_unchecked_t dcpage_flushes;
10249 +extern atomic_unchecked_t dcpage_flushes_xcall;
10250
10251 extern int sysctl_tsb_ratio;
10252 #endif
10253 diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
10254 index 9689176..63c18ea 100644
10255 --- a/arch/sparc/include/asm/spinlock_64.h
10256 +++ b/arch/sparc/include/asm/spinlock_64.h
10257 @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
10258
10259 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
10260
10261 -static void inline arch_read_lock(arch_rwlock_t *lock)
10262 +static inline void arch_read_lock(arch_rwlock_t *lock)
10263 {
10264 unsigned long tmp1, tmp2;
10265
10266 __asm__ __volatile__ (
10267 "1: ldsw [%2], %0\n"
10268 " brlz,pn %0, 2f\n"
10269 -"4: add %0, 1, %1\n"
10270 +"4: addcc %0, 1, %1\n"
10271 +
10272 +#ifdef CONFIG_PAX_REFCOUNT
10273 +" tvs %%icc, 6\n"
10274 +#endif
10275 +
10276 " cas [%2], %0, %1\n"
10277 " cmp %0, %1\n"
10278 " bne,pn %%icc, 1b\n"
10279 @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
10280 " .previous"
10281 : "=&r" (tmp1), "=&r" (tmp2)
10282 : "r" (lock)
10283 - : "memory");
10284 + : "memory", "cc");
10285 }
10286
10287 -static int inline arch_read_trylock(arch_rwlock_t *lock)
10288 +static inline int arch_read_trylock(arch_rwlock_t *lock)
10289 {
10290 int tmp1, tmp2;
10291
10292 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
10293 "1: ldsw [%2], %0\n"
10294 " brlz,a,pn %0, 2f\n"
10295 " mov 0, %0\n"
10296 -" add %0, 1, %1\n"
10297 +" addcc %0, 1, %1\n"
10298 +
10299 +#ifdef CONFIG_PAX_REFCOUNT
10300 +" tvs %%icc, 6\n"
10301 +#endif
10302 +
10303 " cas [%2], %0, %1\n"
10304 " cmp %0, %1\n"
10305 " bne,pn %%icc, 1b\n"
10306 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
10307 return tmp1;
10308 }
10309
10310 -static void inline arch_read_unlock(arch_rwlock_t *lock)
10311 +static inline void arch_read_unlock(arch_rwlock_t *lock)
10312 {
10313 unsigned long tmp1, tmp2;
10314
10315 __asm__ __volatile__(
10316 "1: lduw [%2], %0\n"
10317 -" sub %0, 1, %1\n"
10318 +" subcc %0, 1, %1\n"
10319 +
10320 +#ifdef CONFIG_PAX_REFCOUNT
10321 +" tvs %%icc, 6\n"
10322 +#endif
10323 +
10324 " cas [%2], %0, %1\n"
10325 " cmp %0, %1\n"
10326 " bne,pn %%xcc, 1b\n"
10327 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
10328 : "memory");
10329 }
10330
10331 -static void inline arch_write_lock(arch_rwlock_t *lock)
10332 +static inline void arch_write_lock(arch_rwlock_t *lock)
10333 {
10334 unsigned long mask, tmp1, tmp2;
10335
10336 @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
10337 : "memory");
10338 }
10339
10340 -static void inline arch_write_unlock(arch_rwlock_t *lock)
10341 +static inline void arch_write_unlock(arch_rwlock_t *lock)
10342 {
10343 __asm__ __volatile__(
10344 " stw %%g0, [%0]"
10345 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
10346 : "memory");
10347 }
10348
10349 -static int inline arch_write_trylock(arch_rwlock_t *lock)
10350 +static inline int arch_write_trylock(arch_rwlock_t *lock)
10351 {
10352 unsigned long mask, tmp1, tmp2, result;
10353
10354 diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
10355 index 229475f..2fca9163 100644
10356 --- a/arch/sparc/include/asm/thread_info_32.h
10357 +++ b/arch/sparc/include/asm/thread_info_32.h
10358 @@ -48,6 +48,7 @@ struct thread_info {
10359 struct reg_window32 reg_window[NSWINS]; /* align for ldd! */
10360 unsigned long rwbuf_stkptrs[NSWINS];
10361 unsigned long w_saved;
10362 + unsigned long lowest_stack;
10363 };
10364
10365 /*
10366 diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
10367 index bde5982..9cbb56d 100644
10368 --- a/arch/sparc/include/asm/thread_info_64.h
10369 +++ b/arch/sparc/include/asm/thread_info_64.h
10370 @@ -59,6 +59,8 @@ struct thread_info {
10371 struct pt_regs *kern_una_regs;
10372 unsigned int kern_una_insn;
10373
10374 + unsigned long lowest_stack;
10375 +
10376 unsigned long fpregs[(7 * 256) / sizeof(unsigned long)]
10377 __attribute__ ((aligned(64)));
10378 };
10379 @@ -180,12 +182,13 @@ register struct thread_info *current_thread_info_reg asm("g6");
10380 #define TIF_NEED_RESCHED 3 /* rescheduling necessary */
10381 /* flag bit 4 is available */
10382 #define TIF_UNALIGNED 5 /* allowed to do unaligned accesses */
10383 -/* flag bit 6 is available */
10384 +#define TIF_GRSEC_SETXID 6 /* update credentials on syscall entry/exit */
10385 #define TIF_32BIT 7 /* 32-bit binary */
10386 #define TIF_NOHZ 8 /* in adaptive nohz mode */
10387 #define TIF_SECCOMP 9 /* secure computing */
10388 #define TIF_SYSCALL_AUDIT 10 /* syscall auditing active */
10389 #define TIF_SYSCALL_TRACEPOINT 11 /* syscall tracepoint instrumentation */
10390 +
10391 /* NOTE: Thread flags >= 12 should be ones we have no interest
10392 * in using in assembly, else we can't use the mask as
10393 * an immediate value in instructions such as andcc.
10394 @@ -205,12 +208,17 @@ register struct thread_info *current_thread_info_reg asm("g6");
10395 #define _TIF_SYSCALL_AUDIT (1<<TIF_SYSCALL_AUDIT)
10396 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
10397 #define _TIF_POLLING_NRFLAG (1<<TIF_POLLING_NRFLAG)
10398 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
10399
10400 #define _TIF_USER_WORK_MASK ((0xff << TI_FLAG_WSAVED_SHIFT) | \
10401 _TIF_DO_NOTIFY_RESUME_MASK | \
10402 _TIF_NEED_RESCHED)
10403 #define _TIF_DO_NOTIFY_RESUME_MASK (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING)
10404
10405 +#define _TIF_WORK_SYSCALL \
10406 + (_TIF_SYSCALL_TRACE | _TIF_SECCOMP | _TIF_SYSCALL_AUDIT | \
10407 + _TIF_SYSCALL_TRACEPOINT | _TIF_NOHZ | _TIF_GRSEC_SETXID)
10408 +
10409 #define is_32bit_task() (test_thread_flag(TIF_32BIT))
10410
10411 /*
10412 diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
10413 index bd56c28..4b63d83 100644
10414 --- a/arch/sparc/include/asm/uaccess.h
10415 +++ b/arch/sparc/include/asm/uaccess.h
10416 @@ -1,5 +1,6 @@
10417 #ifndef ___ASM_SPARC_UACCESS_H
10418 #define ___ASM_SPARC_UACCESS_H
10419 +
10420 #if defined(__sparc__) && defined(__arch64__)
10421 #include <asm/uaccess_64.h>
10422 #else
10423 diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
10424 index 64ee103..388aef0 100644
10425 --- a/arch/sparc/include/asm/uaccess_32.h
10426 +++ b/arch/sparc/include/asm/uaccess_32.h
10427 @@ -47,6 +47,7 @@
10428 #define __user_ok(addr, size) ({ (void)(size); (addr) < STACK_TOP; })
10429 #define __kernel_ok (segment_eq(get_fs(), KERNEL_DS))
10430 #define __access_ok(addr, size) (__user_ok((addr) & get_fs().seg, (size)))
10431 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
10432 #define access_ok(type, addr, size) \
10433 ({ (void)(type); __access_ok((unsigned long)(addr), size); })
10434
10435 @@ -313,27 +314,46 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
10436
10437 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
10438 {
10439 - if (n && __access_ok((unsigned long) to, n))
10440 + if ((long)n < 0)
10441 + return n;
10442 +
10443 + if (n && __access_ok((unsigned long) to, n)) {
10444 + if (!__builtin_constant_p(n))
10445 + check_object_size(from, n, true);
10446 return __copy_user(to, (__force void __user *) from, n);
10447 - else
10448 + } else
10449 return n;
10450 }
10451
10452 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
10453 {
10454 + if ((long)n < 0)
10455 + return n;
10456 +
10457 + if (!__builtin_constant_p(n))
10458 + check_object_size(from, n, true);
10459 +
10460 return __copy_user(to, (__force void __user *) from, n);
10461 }
10462
10463 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
10464 {
10465 - if (n && __access_ok((unsigned long) from, n))
10466 + if ((long)n < 0)
10467 + return n;
10468 +
10469 + if (n && __access_ok((unsigned long) from, n)) {
10470 + if (!__builtin_constant_p(n))
10471 + check_object_size(to, n, false);
10472 return __copy_user((__force void __user *) to, from, n);
10473 - else
10474 + } else
10475 return n;
10476 }
10477
10478 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
10479 {
10480 + if ((long)n < 0)
10481 + return n;
10482 +
10483 return __copy_user((__force void __user *) to, from, n);
10484 }
10485
10486 diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
10487 index a35194b..47dabc0d 100644
10488 --- a/arch/sparc/include/asm/uaccess_64.h
10489 +++ b/arch/sparc/include/asm/uaccess_64.h
10490 @@ -10,6 +10,7 @@
10491 #include <linux/compiler.h>
10492 #include <linux/string.h>
10493 #include <linux/thread_info.h>
10494 +#include <linux/kernel.h>
10495 #include <asm/asi.h>
10496 #include <asm/spitfire.h>
10497 #include <asm-generic/uaccess-unaligned.h>
10498 @@ -54,6 +55,11 @@ static inline int __access_ok(const void __user * addr, unsigned long size)
10499 return 1;
10500 }
10501
10502 +static inline int access_ok_noprefault(int type, const void __user * addr, unsigned long size)
10503 +{
10504 + return 1;
10505 +}
10506 +
10507 static inline int access_ok(int type, const void __user * addr, unsigned long size)
10508 {
10509 return 1;
10510 @@ -228,8 +234,15 @@ unsigned long copy_from_user_fixup(void *to, const void __user *from,
10511 static inline unsigned long __must_check
10512 copy_from_user(void *to, const void __user *from, unsigned long size)
10513 {
10514 - unsigned long ret = ___copy_from_user(to, from, size);
10515 + unsigned long ret;
10516
10517 + if ((long)size < 0 || size > INT_MAX)
10518 + return size;
10519 +
10520 + if (!__builtin_constant_p(size))
10521 + check_object_size(to, size, false);
10522 +
10523 + ret = ___copy_from_user(to, from, size);
10524 if (unlikely(ret))
10525 ret = copy_from_user_fixup(to, from, size);
10526
10527 @@ -245,8 +258,15 @@ unsigned long copy_to_user_fixup(void __user *to, const void *from,
10528 static inline unsigned long __must_check
10529 copy_to_user(void __user *to, const void *from, unsigned long size)
10530 {
10531 - unsigned long ret = ___copy_to_user(to, from, size);
10532 + unsigned long ret;
10533
10534 + if ((long)size < 0 || size > INT_MAX)
10535 + return size;
10536 +
10537 + if (!__builtin_constant_p(size))
10538 + check_object_size(from, size, true);
10539 +
10540 + ret = ___copy_to_user(to, from, size);
10541 if (unlikely(ret))
10542 ret = copy_to_user_fixup(to, from, size);
10543 return ret;
10544 diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
10545 index 7cf9c6e..6206648 100644
10546 --- a/arch/sparc/kernel/Makefile
10547 +++ b/arch/sparc/kernel/Makefile
10548 @@ -4,7 +4,7 @@
10549 #
10550
10551 asflags-y := -ansi
10552 -ccflags-y := -Werror
10553 +#ccflags-y := -Werror
10554
10555 extra-y := head_$(BITS).o
10556
10557 diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
10558 index 50e7b62..79fae35 100644
10559 --- a/arch/sparc/kernel/process_32.c
10560 +++ b/arch/sparc/kernel/process_32.c
10561 @@ -123,14 +123,14 @@ void show_regs(struct pt_regs *r)
10562
10563 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
10564 r->psr, r->pc, r->npc, r->y, print_tainted());
10565 - printk("PC: <%pS>\n", (void *) r->pc);
10566 + printk("PC: <%pA>\n", (void *) r->pc);
10567 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
10568 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
10569 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
10570 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
10571 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
10572 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
10573 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
10574 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
10575
10576 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
10577 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
10578 @@ -167,7 +167,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
10579 rw = (struct reg_window32 *) fp;
10580 pc = rw->ins[7];
10581 printk("[%08lx : ", pc);
10582 - printk("%pS ] ", (void *) pc);
10583 + printk("%pA ] ", (void *) pc);
10584 fp = rw->ins[6];
10585 } while (++count < 16);
10586 printk("\n");
10587 diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
10588 index 46a5964..a35c62c 100644
10589 --- a/arch/sparc/kernel/process_64.c
10590 +++ b/arch/sparc/kernel/process_64.c
10591 @@ -161,7 +161,7 @@ static void show_regwindow(struct pt_regs *regs)
10592 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
10593 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
10594 if (regs->tstate & TSTATE_PRIV)
10595 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
10596 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
10597 }
10598
10599 void show_regs(struct pt_regs *regs)
10600 @@ -170,7 +170,7 @@ void show_regs(struct pt_regs *regs)
10601
10602 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
10603 regs->tpc, regs->tnpc, regs->y, print_tainted());
10604 - printk("TPC: <%pS>\n", (void *) regs->tpc);
10605 + printk("TPC: <%pA>\n", (void *) regs->tpc);
10606 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
10607 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
10608 regs->u_regs[3]);
10609 @@ -183,7 +183,7 @@ void show_regs(struct pt_regs *regs)
10610 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
10611 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
10612 regs->u_regs[15]);
10613 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
10614 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
10615 show_regwindow(regs);
10616 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
10617 }
10618 @@ -278,7 +278,7 @@ void arch_trigger_all_cpu_backtrace(bool include_self)
10619 ((tp && tp->task) ? tp->task->pid : -1));
10620
10621 if (gp->tstate & TSTATE_PRIV) {
10622 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
10623 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
10624 (void *) gp->tpc,
10625 (void *) gp->o7,
10626 (void *) gp->i7,
10627 diff --git a/arch/sparc/kernel/prom_common.c b/arch/sparc/kernel/prom_common.c
10628 index 79cc0d1..ec62734 100644
10629 --- a/arch/sparc/kernel/prom_common.c
10630 +++ b/arch/sparc/kernel/prom_common.c
10631 @@ -144,7 +144,7 @@ static int __init prom_common_nextprop(phandle node, char *prev, char *buf)
10632
10633 unsigned int prom_early_allocated __initdata;
10634
10635 -static struct of_pdt_ops prom_sparc_ops __initdata = {
10636 +static struct of_pdt_ops prom_sparc_ops __initconst = {
10637 .nextprop = prom_common_nextprop,
10638 .getproplen = prom_getproplen,
10639 .getproperty = prom_getproperty,
10640 diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
10641 index 9ddc492..27a5619 100644
10642 --- a/arch/sparc/kernel/ptrace_64.c
10643 +++ b/arch/sparc/kernel/ptrace_64.c
10644 @@ -1060,6 +1060,10 @@ long arch_ptrace(struct task_struct *child, long request,
10645 return ret;
10646 }
10647
10648 +#ifdef CONFIG_GRKERNSEC_SETXID
10649 +extern void gr_delayed_cred_worker(void);
10650 +#endif
10651 +
10652 asmlinkage int syscall_trace_enter(struct pt_regs *regs)
10653 {
10654 int ret = 0;
10655 @@ -1070,6 +1074,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
10656 if (test_thread_flag(TIF_NOHZ))
10657 user_exit();
10658
10659 +#ifdef CONFIG_GRKERNSEC_SETXID
10660 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
10661 + gr_delayed_cred_worker();
10662 +#endif
10663 +
10664 if (test_thread_flag(TIF_SYSCALL_TRACE))
10665 ret = tracehook_report_syscall_entry(regs);
10666
10667 @@ -1088,6 +1097,11 @@ asmlinkage void syscall_trace_leave(struct pt_regs *regs)
10668 if (test_thread_flag(TIF_NOHZ))
10669 user_exit();
10670
10671 +#ifdef CONFIG_GRKERNSEC_SETXID
10672 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
10673 + gr_delayed_cred_worker();
10674 +#endif
10675 +
10676 audit_syscall_exit(regs);
10677
10678 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
10679 diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
10680 index 19cd08d..ff21e99 100644
10681 --- a/arch/sparc/kernel/smp_64.c
10682 +++ b/arch/sparc/kernel/smp_64.c
10683 @@ -891,7 +891,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu)
10684 return;
10685
10686 #ifdef CONFIG_DEBUG_DCFLUSH
10687 - atomic_inc(&dcpage_flushes);
10688 + atomic_inc_unchecked(&dcpage_flushes);
10689 #endif
10690
10691 this_cpu = get_cpu();
10692 @@ -915,7 +915,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu)
10693 xcall_deliver(data0, __pa(pg_addr),
10694 (u64) pg_addr, cpumask_of(cpu));
10695 #ifdef CONFIG_DEBUG_DCFLUSH
10696 - atomic_inc(&dcpage_flushes_xcall);
10697 + atomic_inc_unchecked(&dcpage_flushes_xcall);
10698 #endif
10699 }
10700 }
10701 @@ -934,7 +934,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
10702 preempt_disable();
10703
10704 #ifdef CONFIG_DEBUG_DCFLUSH
10705 - atomic_inc(&dcpage_flushes);
10706 + atomic_inc_unchecked(&dcpage_flushes);
10707 #endif
10708 data0 = 0;
10709 pg_addr = page_address(page);
10710 @@ -951,7 +951,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
10711 xcall_deliver(data0, __pa(pg_addr),
10712 (u64) pg_addr, cpu_online_mask);
10713 #ifdef CONFIG_DEBUG_DCFLUSH
10714 - atomic_inc(&dcpage_flushes_xcall);
10715 + atomic_inc_unchecked(&dcpage_flushes_xcall);
10716 #endif
10717 }
10718 __local_flush_dcache_page(page);
10719 diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
10720 index 646988d..b88905f 100644
10721 --- a/arch/sparc/kernel/sys_sparc_32.c
10722 +++ b/arch/sparc/kernel/sys_sparc_32.c
10723 @@ -54,7 +54,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10724 if (len > TASK_SIZE - PAGE_SIZE)
10725 return -ENOMEM;
10726 if (!addr)
10727 - addr = TASK_UNMAPPED_BASE;
10728 + addr = current->mm->mmap_base;
10729
10730 info.flags = 0;
10731 info.length = len;
10732 diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
10733 index 30e7ddb..266a3b0 100644
10734 --- a/arch/sparc/kernel/sys_sparc_64.c
10735 +++ b/arch/sparc/kernel/sys_sparc_64.c
10736 @@ -89,13 +89,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10737 struct vm_area_struct * vma;
10738 unsigned long task_size = TASK_SIZE;
10739 int do_color_align;
10740 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
10741 struct vm_unmapped_area_info info;
10742
10743 if (flags & MAP_FIXED) {
10744 /* We do not accept a shared mapping if it would violate
10745 * cache aliasing constraints.
10746 */
10747 - if ((flags & MAP_SHARED) &&
10748 + if ((filp || (flags & MAP_SHARED)) &&
10749 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
10750 return -EINVAL;
10751 return addr;
10752 @@ -110,6 +111,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10753 if (filp || (flags & MAP_SHARED))
10754 do_color_align = 1;
10755
10756 +#ifdef CONFIG_PAX_RANDMMAP
10757 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
10758 +#endif
10759 +
10760 if (addr) {
10761 if (do_color_align)
10762 addr = COLOR_ALIGN(addr, pgoff);
10763 @@ -117,22 +122,28 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10764 addr = PAGE_ALIGN(addr);
10765
10766 vma = find_vma(mm, addr);
10767 - if (task_size - len >= addr &&
10768 - (!vma || addr + len <= vma->vm_start))
10769 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
10770 return addr;
10771 }
10772
10773 info.flags = 0;
10774 info.length = len;
10775 - info.low_limit = TASK_UNMAPPED_BASE;
10776 + info.low_limit = mm->mmap_base;
10777 info.high_limit = min(task_size, VA_EXCLUDE_START);
10778 info.align_mask = do_color_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
10779 info.align_offset = pgoff << PAGE_SHIFT;
10780 + info.threadstack_offset = offset;
10781 addr = vm_unmapped_area(&info);
10782
10783 if ((addr & ~PAGE_MASK) && task_size > VA_EXCLUDE_END) {
10784 VM_BUG_ON(addr != -ENOMEM);
10785 info.low_limit = VA_EXCLUDE_END;
10786 +
10787 +#ifdef CONFIG_PAX_RANDMMAP
10788 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10789 + info.low_limit += mm->delta_mmap;
10790 +#endif
10791 +
10792 info.high_limit = task_size;
10793 addr = vm_unmapped_area(&info);
10794 }
10795 @@ -150,6 +161,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10796 unsigned long task_size = STACK_TOP32;
10797 unsigned long addr = addr0;
10798 int do_color_align;
10799 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
10800 struct vm_unmapped_area_info info;
10801
10802 /* This should only ever run for 32-bit processes. */
10803 @@ -159,7 +171,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10804 /* We do not accept a shared mapping if it would violate
10805 * cache aliasing constraints.
10806 */
10807 - if ((flags & MAP_SHARED) &&
10808 + if ((filp || (flags & MAP_SHARED)) &&
10809 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
10810 return -EINVAL;
10811 return addr;
10812 @@ -172,6 +184,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10813 if (filp || (flags & MAP_SHARED))
10814 do_color_align = 1;
10815
10816 +#ifdef CONFIG_PAX_RANDMMAP
10817 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
10818 +#endif
10819 +
10820 /* requesting a specific address */
10821 if (addr) {
10822 if (do_color_align)
10823 @@ -180,8 +196,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10824 addr = PAGE_ALIGN(addr);
10825
10826 vma = find_vma(mm, addr);
10827 - if (task_size - len >= addr &&
10828 - (!vma || addr + len <= vma->vm_start))
10829 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
10830 return addr;
10831 }
10832
10833 @@ -191,6 +206,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10834 info.high_limit = mm->mmap_base;
10835 info.align_mask = do_color_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
10836 info.align_offset = pgoff << PAGE_SHIFT;
10837 + info.threadstack_offset = offset;
10838 addr = vm_unmapped_area(&info);
10839
10840 /*
10841 @@ -203,6 +219,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10842 VM_BUG_ON(addr != -ENOMEM);
10843 info.flags = 0;
10844 info.low_limit = TASK_UNMAPPED_BASE;
10845 +
10846 +#ifdef CONFIG_PAX_RANDMMAP
10847 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10848 + info.low_limit += mm->delta_mmap;
10849 +#endif
10850 +
10851 info.high_limit = STACK_TOP32;
10852 addr = vm_unmapped_area(&info);
10853 }
10854 @@ -259,10 +281,14 @@ unsigned long get_fb_unmapped_area(struct file *filp, unsigned long orig_addr, u
10855 EXPORT_SYMBOL(get_fb_unmapped_area);
10856
10857 /* Essentially the same as PowerPC. */
10858 -static unsigned long mmap_rnd(void)
10859 +static unsigned long mmap_rnd(struct mm_struct *mm)
10860 {
10861 unsigned long rnd = 0UL;
10862
10863 +#ifdef CONFIG_PAX_RANDMMAP
10864 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
10865 +#endif
10866 +
10867 if (current->flags & PF_RANDOMIZE) {
10868 unsigned long val = get_random_int();
10869 if (test_thread_flag(TIF_32BIT))
10870 @@ -275,7 +301,7 @@ static unsigned long mmap_rnd(void)
10871
10872 void arch_pick_mmap_layout(struct mm_struct *mm)
10873 {
10874 - unsigned long random_factor = mmap_rnd();
10875 + unsigned long random_factor = mmap_rnd(mm);
10876 unsigned long gap;
10877
10878 /*
10879 @@ -288,6 +314,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
10880 gap == RLIM_INFINITY ||
10881 sysctl_legacy_va_layout) {
10882 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
10883 +
10884 +#ifdef CONFIG_PAX_RANDMMAP
10885 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10886 + mm->mmap_base += mm->delta_mmap;
10887 +#endif
10888 +
10889 mm->get_unmapped_area = arch_get_unmapped_area;
10890 } else {
10891 /* We know it's 32-bit */
10892 @@ -299,6 +331,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
10893 gap = (task_size / 6 * 5);
10894
10895 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
10896 +
10897 +#ifdef CONFIG_PAX_RANDMMAP
10898 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10899 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
10900 +#endif
10901 +
10902 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
10903 }
10904 }
10905 diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
10906 index bb00089..e0ea580 100644
10907 --- a/arch/sparc/kernel/syscalls.S
10908 +++ b/arch/sparc/kernel/syscalls.S
10909 @@ -62,7 +62,7 @@ sys32_rt_sigreturn:
10910 #endif
10911 .align 32
10912 1: ldx [%g6 + TI_FLAGS], %l5
10913 - andcc %l5, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10914 + andcc %l5, _TIF_WORK_SYSCALL, %g0
10915 be,pt %icc, rtrap
10916 nop
10917 call syscall_trace_leave
10918 @@ -194,7 +194,7 @@ linux_sparc_syscall32:
10919
10920 srl %i3, 0, %o3 ! IEU0
10921 srl %i2, 0, %o2 ! IEU0 Group
10922 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10923 + andcc %l0, _TIF_WORK_SYSCALL, %g0
10924 bne,pn %icc, linux_syscall_trace32 ! CTI
10925 mov %i0, %l5 ! IEU1
10926 5: call %l7 ! CTI Group brk forced
10927 @@ -218,7 +218,7 @@ linux_sparc_syscall:
10928
10929 mov %i3, %o3 ! IEU1
10930 mov %i4, %o4 ! IEU0 Group
10931 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10932 + andcc %l0, _TIF_WORK_SYSCALL, %g0
10933 bne,pn %icc, linux_syscall_trace ! CTI Group
10934 mov %i0, %l5 ! IEU0
10935 2: call %l7 ! CTI Group brk forced
10936 @@ -233,7 +233,7 @@ ret_sys_call:
10937
10938 cmp %o0, -ERESTART_RESTARTBLOCK
10939 bgeu,pn %xcc, 1f
10940 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10941 + andcc %l0, _TIF_WORK_SYSCALL, %g0
10942 ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
10943
10944 2:
10945 diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
10946 index 4f21df7..0a374da 100644
10947 --- a/arch/sparc/kernel/traps_32.c
10948 +++ b/arch/sparc/kernel/traps_32.c
10949 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
10950 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
10951 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
10952
10953 +extern void gr_handle_kernel_exploit(void);
10954 +
10955 void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
10956 {
10957 static int die_counter;
10958 @@ -76,15 +78,17 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
10959 count++ < 30 &&
10960 (((unsigned long) rw) >= PAGE_OFFSET) &&
10961 !(((unsigned long) rw) & 0x7)) {
10962 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
10963 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
10964 (void *) rw->ins[7]);
10965 rw = (struct reg_window32 *)rw->ins[6];
10966 }
10967 }
10968 printk("Instruction DUMP:");
10969 instruction_dump ((unsigned long *) regs->pc);
10970 - if(regs->psr & PSR_PS)
10971 + if(regs->psr & PSR_PS) {
10972 + gr_handle_kernel_exploit();
10973 do_exit(SIGKILL);
10974 + }
10975 do_exit(SIGSEGV);
10976 }
10977
10978 diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
10979 index d21cd62..00a4a17 100644
10980 --- a/arch/sparc/kernel/traps_64.c
10981 +++ b/arch/sparc/kernel/traps_64.c
10982 @@ -79,7 +79,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
10983 i + 1,
10984 p->trapstack[i].tstate, p->trapstack[i].tpc,
10985 p->trapstack[i].tnpc, p->trapstack[i].tt);
10986 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
10987 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
10988 }
10989 }
10990
10991 @@ -99,6 +99,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
10992
10993 lvl -= 0x100;
10994 if (regs->tstate & TSTATE_PRIV) {
10995 +
10996 +#ifdef CONFIG_PAX_REFCOUNT
10997 + if (lvl == 6)
10998 + pax_report_refcount_overflow(regs);
10999 +#endif
11000 +
11001 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
11002 die_if_kernel(buffer, regs);
11003 }
11004 @@ -117,11 +123,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
11005 void bad_trap_tl1(struct pt_regs *regs, long lvl)
11006 {
11007 char buffer[32];
11008 -
11009 +
11010 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
11011 0, lvl, SIGTRAP) == NOTIFY_STOP)
11012 return;
11013
11014 +#ifdef CONFIG_PAX_REFCOUNT
11015 + if (lvl == 6)
11016 + pax_report_refcount_overflow(regs);
11017 +#endif
11018 +
11019 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
11020
11021 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
11022 @@ -1151,7 +1162,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
11023 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
11024 printk("%s" "ERROR(%d): ",
11025 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
11026 - printk("TPC<%pS>\n", (void *) regs->tpc);
11027 + printk("TPC<%pA>\n", (void *) regs->tpc);
11028 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
11029 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
11030 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
11031 @@ -1758,7 +1769,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
11032 smp_processor_id(),
11033 (type & 0x1) ? 'I' : 'D',
11034 regs->tpc);
11035 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
11036 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
11037 panic("Irrecoverable Cheetah+ parity error.");
11038 }
11039
11040 @@ -1766,7 +1777,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
11041 smp_processor_id(),
11042 (type & 0x1) ? 'I' : 'D',
11043 regs->tpc);
11044 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
11045 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
11046 }
11047
11048 struct sun4v_error_entry {
11049 @@ -1839,8 +1850,8 @@ struct sun4v_error_entry {
11050 /*0x38*/u64 reserved_5;
11051 };
11052
11053 -static atomic_t sun4v_resum_oflow_cnt = ATOMIC_INIT(0);
11054 -static atomic_t sun4v_nonresum_oflow_cnt = ATOMIC_INIT(0);
11055 +static atomic_unchecked_t sun4v_resum_oflow_cnt = ATOMIC_INIT(0);
11056 +static atomic_unchecked_t sun4v_nonresum_oflow_cnt = ATOMIC_INIT(0);
11057
11058 static const char *sun4v_err_type_to_str(u8 type)
11059 {
11060 @@ -1932,7 +1943,7 @@ static void sun4v_report_real_raddr(const char *pfx, struct pt_regs *regs)
11061 }
11062
11063 static void sun4v_log_error(struct pt_regs *regs, struct sun4v_error_entry *ent,
11064 - int cpu, const char *pfx, atomic_t *ocnt)
11065 + int cpu, const char *pfx, atomic_unchecked_t *ocnt)
11066 {
11067 u64 *raw_ptr = (u64 *) ent;
11068 u32 attrs;
11069 @@ -1990,8 +2001,8 @@ static void sun4v_log_error(struct pt_regs *regs, struct sun4v_error_entry *ent,
11070
11071 show_regs(regs);
11072
11073 - if ((cnt = atomic_read(ocnt)) != 0) {
11074 - atomic_set(ocnt, 0);
11075 + if ((cnt = atomic_read_unchecked(ocnt)) != 0) {
11076 + atomic_set_unchecked(ocnt, 0);
11077 wmb();
11078 printk("%s: Queue overflowed %d times.\n",
11079 pfx, cnt);
11080 @@ -2048,7 +2059,7 @@ out:
11081 */
11082 void sun4v_resum_overflow(struct pt_regs *regs)
11083 {
11084 - atomic_inc(&sun4v_resum_oflow_cnt);
11085 + atomic_inc_unchecked(&sun4v_resum_oflow_cnt);
11086 }
11087
11088 /* We run with %pil set to PIL_NORMAL_MAX and PSTATE_IE enabled in %pstate.
11089 @@ -2101,7 +2112,7 @@ void sun4v_nonresum_overflow(struct pt_regs *regs)
11090 /* XXX Actually even this can make not that much sense. Perhaps
11091 * XXX we should just pull the plug and panic directly from here?
11092 */
11093 - atomic_inc(&sun4v_nonresum_oflow_cnt);
11094 + atomic_inc_unchecked(&sun4v_nonresum_oflow_cnt);
11095 }
11096
11097 static void sun4v_tlb_error(struct pt_regs *regs)
11098 @@ -2120,9 +2131,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
11099
11100 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
11101 regs->tpc, tl);
11102 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
11103 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
11104 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
11105 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
11106 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
11107 (void *) regs->u_regs[UREG_I7]);
11108 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
11109 "pte[%lx] error[%lx]\n",
11110 @@ -2143,9 +2154,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
11111
11112 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
11113 regs->tpc, tl);
11114 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
11115 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
11116 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
11117 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
11118 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
11119 (void *) regs->u_regs[UREG_I7]);
11120 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
11121 "pte[%lx] error[%lx]\n",
11122 @@ -2362,13 +2373,13 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
11123 fp = (unsigned long)sf->fp + STACK_BIAS;
11124 }
11125
11126 - printk(" [%016lx] %pS\n", pc, (void *) pc);
11127 + printk(" [%016lx] %pA\n", pc, (void *) pc);
11128 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
11129 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
11130 int index = tsk->curr_ret_stack;
11131 if (tsk->ret_stack && index >= graph) {
11132 pc = tsk->ret_stack[index - graph].ret;
11133 - printk(" [%016lx] %pS\n", pc, (void *) pc);
11134 + printk(" [%016lx] %pA\n", pc, (void *) pc);
11135 graph++;
11136 }
11137 }
11138 @@ -2386,6 +2397,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
11139 return (struct reg_window *) (fp + STACK_BIAS);
11140 }
11141
11142 +extern void gr_handle_kernel_exploit(void);
11143 +
11144 void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
11145 {
11146 static int die_counter;
11147 @@ -2414,7 +2427,7 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
11148 while (rw &&
11149 count++ < 30 &&
11150 kstack_valid(tp, (unsigned long) rw)) {
11151 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
11152 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
11153 (void *) rw->ins[7]);
11154
11155 rw = kernel_stack_up(rw);
11156 @@ -2429,8 +2442,10 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
11157 }
11158 if (panic_on_oops)
11159 panic("Fatal exception");
11160 - if (regs->tstate & TSTATE_PRIV)
11161 + if (regs->tstate & TSTATE_PRIV) {
11162 + gr_handle_kernel_exploit();
11163 do_exit(SIGKILL);
11164 + }
11165 do_exit(SIGSEGV);
11166 }
11167 EXPORT_SYMBOL(die_if_kernel);
11168 diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
11169 index 62098a8..547ab2c 100644
11170 --- a/arch/sparc/kernel/unaligned_64.c
11171 +++ b/arch/sparc/kernel/unaligned_64.c
11172 @@ -297,7 +297,7 @@ static void log_unaligned(struct pt_regs *regs)
11173 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
11174
11175 if (__ratelimit(&ratelimit)) {
11176 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
11177 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
11178 regs->tpc, (void *) regs->tpc);
11179 }
11180 }
11181 diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
11182 index 3269b02..64f5231 100644
11183 --- a/arch/sparc/lib/Makefile
11184 +++ b/arch/sparc/lib/Makefile
11185 @@ -2,7 +2,7 @@
11186 #
11187
11188 asflags-y := -ansi -DST_DIV0=0x02
11189 -ccflags-y := -Werror
11190 +#ccflags-y := -Werror
11191
11192 lib-$(CONFIG_SPARC32) += ashrdi3.o
11193 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
11194 diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
11195 index 05dac43..76f8ed4 100644
11196 --- a/arch/sparc/lib/atomic_64.S
11197 +++ b/arch/sparc/lib/atomic_64.S
11198 @@ -15,11 +15,22 @@
11199 * a value and does the barriers.
11200 */
11201
11202 -#define ATOMIC_OP(op) \
11203 -ENTRY(atomic_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
11204 +#ifdef CONFIG_PAX_REFCOUNT
11205 +#define __REFCOUNT_OP(op) op##cc
11206 +#define __OVERFLOW_IOP tvs %icc, 6;
11207 +#define __OVERFLOW_XOP tvs %xcc, 6;
11208 +#else
11209 +#define __REFCOUNT_OP(op) op
11210 +#define __OVERFLOW_IOP
11211 +#define __OVERFLOW_XOP
11212 +#endif
11213 +
11214 +#define __ATOMIC_OP(op, suffix, asm_op, post_op) \
11215 +ENTRY(atomic_##op##suffix) /* %o0 = increment, %o1 = atomic_ptr */ \
11216 BACKOFF_SETUP(%o2); \
11217 1: lduw [%o1], %g1; \
11218 - op %g1, %o0, %g7; \
11219 + asm_op %g1, %o0, %g7; \
11220 + post_op \
11221 cas [%o1], %g1, %g7; \
11222 cmp %g1, %g7; \
11223 bne,pn %icc, BACKOFF_LABEL(2f, 1b); \
11224 @@ -29,11 +40,15 @@ ENTRY(atomic_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
11225 2: BACKOFF_SPIN(%o2, %o3, 1b); \
11226 ENDPROC(atomic_##op); \
11227
11228 -#define ATOMIC_OP_RETURN(op) \
11229 -ENTRY(atomic_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
11230 +#define ATOMIC_OP(op) __ATOMIC_OP(op, , op, ) \
11231 + __ATOMIC_OP(op, _unchecked, __REFCOUNT_OP(op), __OVERFLOW_IOP)
11232 +
11233 +#define __ATOMIC_OP_RETURN(op, suffix, asm_op, post_op) \
11234 +ENTRY(atomic_##op##_return##suffix) /* %o0 = increment, %o1 = atomic_ptr */\
11235 BACKOFF_SETUP(%o2); \
11236 1: lduw [%o1], %g1; \
11237 - op %g1, %o0, %g7; \
11238 + asm_op %g1, %o0, %g7; \
11239 + post_op \
11240 cas [%o1], %g1, %g7; \
11241 cmp %g1, %g7; \
11242 bne,pn %icc, BACKOFF_LABEL(2f, 1b); \
11243 @@ -43,6 +58,9 @@ ENTRY(atomic_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
11244 2: BACKOFF_SPIN(%o2, %o3, 1b); \
11245 ENDPROC(atomic_##op##_return);
11246
11247 +#define ATOMIC_OP_RETURN(op) __ATOMIC_OP_RETURN(op, , op, ) \
11248 + __ATOMIC_OP_RETURN(op, _unchecked, __REFCOUNT_OP(op), __OVERFLOW_IOP)
11249 +
11250 #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op)
11251
11252 ATOMIC_OPS(add)
11253 @@ -50,13 +68,16 @@ ATOMIC_OPS(sub)
11254
11255 #undef ATOMIC_OPS
11256 #undef ATOMIC_OP_RETURN
11257 +#undef __ATOMIC_OP_RETURN
11258 #undef ATOMIC_OP
11259 +#undef __ATOMIC_OP
11260
11261 -#define ATOMIC64_OP(op) \
11262 -ENTRY(atomic64_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
11263 +#define __ATOMIC64_OP(op, suffix, asm_op, post_op) \
11264 +ENTRY(atomic64_##op##suffix) /* %o0 = increment, %o1 = atomic_ptr */ \
11265 BACKOFF_SETUP(%o2); \
11266 1: ldx [%o1], %g1; \
11267 - op %g1, %o0, %g7; \
11268 + asm_op %g1, %o0, %g7; \
11269 + post_op \
11270 casx [%o1], %g1, %g7; \
11271 cmp %g1, %g7; \
11272 bne,pn %xcc, BACKOFF_LABEL(2f, 1b); \
11273 @@ -66,11 +87,15 @@ ENTRY(atomic64_##op) /* %o0 = increment, %o1 = atomic_ptr */ \
11274 2: BACKOFF_SPIN(%o2, %o3, 1b); \
11275 ENDPROC(atomic64_##op); \
11276
11277 -#define ATOMIC64_OP_RETURN(op) \
11278 -ENTRY(atomic64_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
11279 +#define ATOMIC64_OP(op) __ATOMIC64_OP(op, , op, ) \
11280 + __ATOMIC64_OP(op, _unchecked, __REFCOUNT_OP(op), __OVERFLOW_XOP)
11281 +
11282 +#define __ATOMIC64_OP_RETURN(op, suffix, asm_op, post_op) \
11283 +ENTRY(atomic64_##op##_return##suffix) /* %o0 = increment, %o1 = atomic_ptr */\
11284 BACKOFF_SETUP(%o2); \
11285 1: ldx [%o1], %g1; \
11286 - op %g1, %o0, %g7; \
11287 + asm_op %g1, %o0, %g7; \
11288 + post_op \
11289 casx [%o1], %g1, %g7; \
11290 cmp %g1, %g7; \
11291 bne,pn %xcc, BACKOFF_LABEL(2f, 1b); \
11292 @@ -80,6 +105,9 @@ ENTRY(atomic64_##op##_return) /* %o0 = increment, %o1 = atomic_ptr */ \
11293 2: BACKOFF_SPIN(%o2, %o3, 1b); \
11294 ENDPROC(atomic64_##op##_return);
11295
11296 +#define ATOMIC64_OP_RETURN(op) __ATOMIC64_OP_RETURN(op, , op, ) \
11297 +i __ATOMIC64_OP_RETURN(op, _unchecked, __REFCOUNT_OP(op), __OVERFLOW_XOP)
11298 +
11299 #define ATOMIC64_OPS(op) ATOMIC64_OP(op) ATOMIC64_OP_RETURN(op)
11300
11301 ATOMIC64_OPS(add)
11302 @@ -87,7 +115,12 @@ ATOMIC64_OPS(sub)
11303
11304 #undef ATOMIC64_OPS
11305 #undef ATOMIC64_OP_RETURN
11306 +#undef __ATOMIC64_OP_RETURN
11307 #undef ATOMIC64_OP
11308 +#undef __ATOMIC64_OP
11309 +#undef __OVERFLOW_XOP
11310 +#undef __OVERFLOW_IOP
11311 +#undef __REFCOUNT_OP
11312
11313 ENTRY(atomic64_dec_if_positive) /* %o0 = atomic_ptr */
11314 BACKOFF_SETUP(%o2)
11315 diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
11316 index 1d649a9..fbc5bfc 100644
11317 --- a/arch/sparc/lib/ksyms.c
11318 +++ b/arch/sparc/lib/ksyms.c
11319 @@ -101,7 +101,9 @@ EXPORT_SYMBOL(__clear_user);
11320 /* Atomic counter implementation. */
11321 #define ATOMIC_OP(op) \
11322 EXPORT_SYMBOL(atomic_##op); \
11323 -EXPORT_SYMBOL(atomic64_##op);
11324 +EXPORT_SYMBOL(atomic_##op##_unchecked); \
11325 +EXPORT_SYMBOL(atomic64_##op); \
11326 +EXPORT_SYMBOL(atomic64_##op##_unchecked);
11327
11328 #define ATOMIC_OP_RETURN(op) \
11329 EXPORT_SYMBOL(atomic_##op##_return); \
11330 @@ -110,6 +112,8 @@ EXPORT_SYMBOL(atomic64_##op##_return);
11331 #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op)
11332
11333 ATOMIC_OPS(add)
11334 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
11335 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
11336 ATOMIC_OPS(sub)
11337
11338 #undef ATOMIC_OPS
11339 diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
11340 index 30c3ecc..736f015 100644
11341 --- a/arch/sparc/mm/Makefile
11342 +++ b/arch/sparc/mm/Makefile
11343 @@ -2,7 +2,7 @@
11344 #
11345
11346 asflags-y := -ansi
11347 -ccflags-y := -Werror
11348 +#ccflags-y := -Werror
11349
11350 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
11351 obj-y += fault_$(BITS).o
11352 diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
11353 index 70d8171..274c6c0 100644
11354 --- a/arch/sparc/mm/fault_32.c
11355 +++ b/arch/sparc/mm/fault_32.c
11356 @@ -21,6 +21,9 @@
11357 #include <linux/perf_event.h>
11358 #include <linux/interrupt.h>
11359 #include <linux/kdebug.h>
11360 +#include <linux/slab.h>
11361 +#include <linux/pagemap.h>
11362 +#include <linux/compiler.h>
11363
11364 #include <asm/page.h>
11365 #include <asm/pgtable.h>
11366 @@ -156,6 +159,277 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
11367 return safe_compute_effective_address(regs, insn);
11368 }
11369
11370 +#ifdef CONFIG_PAX_PAGEEXEC
11371 +#ifdef CONFIG_PAX_DLRESOLVE
11372 +static void pax_emuplt_close(struct vm_area_struct *vma)
11373 +{
11374 + vma->vm_mm->call_dl_resolve = 0UL;
11375 +}
11376 +
11377 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
11378 +{
11379 + unsigned int *kaddr;
11380 +
11381 + vmf->page = alloc_page(GFP_HIGHUSER);
11382 + if (!vmf->page)
11383 + return VM_FAULT_OOM;
11384 +
11385 + kaddr = kmap(vmf->page);
11386 + memset(kaddr, 0, PAGE_SIZE);
11387 + kaddr[0] = 0x9DE3BFA8U; /* save */
11388 + flush_dcache_page(vmf->page);
11389 + kunmap(vmf->page);
11390 + return VM_FAULT_MAJOR;
11391 +}
11392 +
11393 +static const struct vm_operations_struct pax_vm_ops = {
11394 + .close = pax_emuplt_close,
11395 + .fault = pax_emuplt_fault
11396 +};
11397 +
11398 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
11399 +{
11400 + int ret;
11401 +
11402 + INIT_LIST_HEAD(&vma->anon_vma_chain);
11403 + vma->vm_mm = current->mm;
11404 + vma->vm_start = addr;
11405 + vma->vm_end = addr + PAGE_SIZE;
11406 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
11407 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
11408 + vma->vm_ops = &pax_vm_ops;
11409 +
11410 + ret = insert_vm_struct(current->mm, vma);
11411 + if (ret)
11412 + return ret;
11413 +
11414 + ++current->mm->total_vm;
11415 + return 0;
11416 +}
11417 +#endif
11418 +
11419 +/*
11420 + * PaX: decide what to do with offenders (regs->pc = fault address)
11421 + *
11422 + * returns 1 when task should be killed
11423 + * 2 when patched PLT trampoline was detected
11424 + * 3 when unpatched PLT trampoline was detected
11425 + */
11426 +static int pax_handle_fetch_fault(struct pt_regs *regs)
11427 +{
11428 +
11429 +#ifdef CONFIG_PAX_EMUPLT
11430 + int err;
11431 +
11432 + do { /* PaX: patched PLT emulation #1 */
11433 + unsigned int sethi1, sethi2, jmpl;
11434 +
11435 + err = get_user(sethi1, (unsigned int *)regs->pc);
11436 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
11437 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
11438 +
11439 + if (err)
11440 + break;
11441 +
11442 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
11443 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
11444 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
11445 + {
11446 + unsigned int addr;
11447 +
11448 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
11449 + addr = regs->u_regs[UREG_G1];
11450 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
11451 + regs->pc = addr;
11452 + regs->npc = addr+4;
11453 + return 2;
11454 + }
11455 + } while (0);
11456 +
11457 + do { /* PaX: patched PLT emulation #2 */
11458 + unsigned int ba;
11459 +
11460 + err = get_user(ba, (unsigned int *)regs->pc);
11461 +
11462 + if (err)
11463 + break;
11464 +
11465 + if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
11466 + unsigned int addr;
11467 +
11468 + if ((ba & 0xFFC00000U) == 0x30800000U)
11469 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
11470 + else
11471 + addr = regs->pc + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
11472 + regs->pc = addr;
11473 + regs->npc = addr+4;
11474 + return 2;
11475 + }
11476 + } while (0);
11477 +
11478 + do { /* PaX: patched PLT emulation #3 */
11479 + unsigned int sethi, bajmpl, nop;
11480 +
11481 + err = get_user(sethi, (unsigned int *)regs->pc);
11482 + err |= get_user(bajmpl, (unsigned int *)(regs->pc+4));
11483 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
11484 +
11485 + if (err)
11486 + break;
11487 +
11488 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11489 + ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
11490 + nop == 0x01000000U)
11491 + {
11492 + unsigned int addr;
11493 +
11494 + addr = (sethi & 0x003FFFFFU) << 10;
11495 + regs->u_regs[UREG_G1] = addr;
11496 + if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
11497 + addr += (((bajmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
11498 + else
11499 + addr = regs->pc + ((((bajmpl | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
11500 + regs->pc = addr;
11501 + regs->npc = addr+4;
11502 + return 2;
11503 + }
11504 + } while (0);
11505 +
11506 + do { /* PaX: unpatched PLT emulation step 1 */
11507 + unsigned int sethi, ba, nop;
11508 +
11509 + err = get_user(sethi, (unsigned int *)regs->pc);
11510 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
11511 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
11512 +
11513 + if (err)
11514 + break;
11515 +
11516 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11517 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
11518 + nop == 0x01000000U)
11519 + {
11520 + unsigned int addr, save, call;
11521 +
11522 + if ((ba & 0xFFC00000U) == 0x30800000U)
11523 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
11524 + else
11525 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
11526 +
11527 + err = get_user(save, (unsigned int *)addr);
11528 + err |= get_user(call, (unsigned int *)(addr+4));
11529 + err |= get_user(nop, (unsigned int *)(addr+8));
11530 + if (err)
11531 + break;
11532 +
11533 +#ifdef CONFIG_PAX_DLRESOLVE
11534 + if (save == 0x9DE3BFA8U &&
11535 + (call & 0xC0000000U) == 0x40000000U &&
11536 + nop == 0x01000000U)
11537 + {
11538 + struct vm_area_struct *vma;
11539 + unsigned long call_dl_resolve;
11540 +
11541 + down_read(&current->mm->mmap_sem);
11542 + call_dl_resolve = current->mm->call_dl_resolve;
11543 + up_read(&current->mm->mmap_sem);
11544 + if (likely(call_dl_resolve))
11545 + goto emulate;
11546 +
11547 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
11548 +
11549 + down_write(&current->mm->mmap_sem);
11550 + if (current->mm->call_dl_resolve) {
11551 + call_dl_resolve = current->mm->call_dl_resolve;
11552 + up_write(&current->mm->mmap_sem);
11553 + if (vma)
11554 + kmem_cache_free(vm_area_cachep, vma);
11555 + goto emulate;
11556 + }
11557 +
11558 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
11559 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
11560 + up_write(&current->mm->mmap_sem);
11561 + if (vma)
11562 + kmem_cache_free(vm_area_cachep, vma);
11563 + return 1;
11564 + }
11565 +
11566 + if (pax_insert_vma(vma, call_dl_resolve)) {
11567 + up_write(&current->mm->mmap_sem);
11568 + kmem_cache_free(vm_area_cachep, vma);
11569 + return 1;
11570 + }
11571 +
11572 + current->mm->call_dl_resolve = call_dl_resolve;
11573 + up_write(&current->mm->mmap_sem);
11574 +
11575 +emulate:
11576 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
11577 + regs->pc = call_dl_resolve;
11578 + regs->npc = addr+4;
11579 + return 3;
11580 + }
11581 +#endif
11582 +
11583 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
11584 + if ((save & 0xFFC00000U) == 0x05000000U &&
11585 + (call & 0xFFFFE000U) == 0x85C0A000U &&
11586 + nop == 0x01000000U)
11587 + {
11588 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
11589 + regs->u_regs[UREG_G2] = addr + 4;
11590 + addr = (save & 0x003FFFFFU) << 10;
11591 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
11592 + regs->pc = addr;
11593 + regs->npc = addr+4;
11594 + return 3;
11595 + }
11596 + }
11597 + } while (0);
11598 +
11599 + do { /* PaX: unpatched PLT emulation step 2 */
11600 + unsigned int save, call, nop;
11601 +
11602 + err = get_user(save, (unsigned int *)(regs->pc-4));
11603 + err |= get_user(call, (unsigned int *)regs->pc);
11604 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
11605 + if (err)
11606 + break;
11607 +
11608 + if (save == 0x9DE3BFA8U &&
11609 + (call & 0xC0000000U) == 0x40000000U &&
11610 + nop == 0x01000000U)
11611 + {
11612 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
11613 +
11614 + regs->u_regs[UREG_RETPC] = regs->pc;
11615 + regs->pc = dl_resolve;
11616 + regs->npc = dl_resolve+4;
11617 + return 3;
11618 + }
11619 + } while (0);
11620 +#endif
11621 +
11622 + return 1;
11623 +}
11624 +
11625 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
11626 +{
11627 + unsigned long i;
11628 +
11629 + printk(KERN_ERR "PAX: bytes at PC: ");
11630 + for (i = 0; i < 8; i++) {
11631 + unsigned int c;
11632 + if (get_user(c, (unsigned int *)pc+i))
11633 + printk(KERN_CONT "???????? ");
11634 + else
11635 + printk(KERN_CONT "%08x ", c);
11636 + }
11637 + printk("\n");
11638 +}
11639 +#endif
11640 +
11641 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
11642 int text_fault)
11643 {
11644 @@ -226,6 +500,24 @@ good_area:
11645 if (!(vma->vm_flags & VM_WRITE))
11646 goto bad_area;
11647 } else {
11648 +
11649 +#ifdef CONFIG_PAX_PAGEEXEC
11650 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
11651 + up_read(&mm->mmap_sem);
11652 + switch (pax_handle_fetch_fault(regs)) {
11653 +
11654 +#ifdef CONFIG_PAX_EMUPLT
11655 + case 2:
11656 + case 3:
11657 + return;
11658 +#endif
11659 +
11660 + }
11661 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
11662 + do_group_exit(SIGKILL);
11663 + }
11664 +#endif
11665 +
11666 /* Allow reads even for write-only mappings */
11667 if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
11668 goto bad_area;
11669 diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
11670 index 4798232..f76e3aa 100644
11671 --- a/arch/sparc/mm/fault_64.c
11672 +++ b/arch/sparc/mm/fault_64.c
11673 @@ -22,6 +22,9 @@
11674 #include <linux/kdebug.h>
11675 #include <linux/percpu.h>
11676 #include <linux/context_tracking.h>
11677 +#include <linux/slab.h>
11678 +#include <linux/pagemap.h>
11679 +#include <linux/compiler.h>
11680
11681 #include <asm/page.h>
11682 #include <asm/pgtable.h>
11683 @@ -76,7 +79,7 @@ static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
11684 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
11685 regs->tpc);
11686 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
11687 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
11688 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
11689 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
11690 dump_stack();
11691 unhandled_fault(regs->tpc, current, regs);
11692 @@ -279,6 +282,466 @@ static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs)
11693 show_regs(regs);
11694 }
11695
11696 +#ifdef CONFIG_PAX_PAGEEXEC
11697 +#ifdef CONFIG_PAX_DLRESOLVE
11698 +static void pax_emuplt_close(struct vm_area_struct *vma)
11699 +{
11700 + vma->vm_mm->call_dl_resolve = 0UL;
11701 +}
11702 +
11703 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
11704 +{
11705 + unsigned int *kaddr;
11706 +
11707 + vmf->page = alloc_page(GFP_HIGHUSER);
11708 + if (!vmf->page)
11709 + return VM_FAULT_OOM;
11710 +
11711 + kaddr = kmap(vmf->page);
11712 + memset(kaddr, 0, PAGE_SIZE);
11713 + kaddr[0] = 0x9DE3BFA8U; /* save */
11714 + flush_dcache_page(vmf->page);
11715 + kunmap(vmf->page);
11716 + return VM_FAULT_MAJOR;
11717 +}
11718 +
11719 +static const struct vm_operations_struct pax_vm_ops = {
11720 + .close = pax_emuplt_close,
11721 + .fault = pax_emuplt_fault
11722 +};
11723 +
11724 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
11725 +{
11726 + int ret;
11727 +
11728 + INIT_LIST_HEAD(&vma->anon_vma_chain);
11729 + vma->vm_mm = current->mm;
11730 + vma->vm_start = addr;
11731 + vma->vm_end = addr + PAGE_SIZE;
11732 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
11733 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
11734 + vma->vm_ops = &pax_vm_ops;
11735 +
11736 + ret = insert_vm_struct(current->mm, vma);
11737 + if (ret)
11738 + return ret;
11739 +
11740 + ++current->mm->total_vm;
11741 + return 0;
11742 +}
11743 +#endif
11744 +
11745 +/*
11746 + * PaX: decide what to do with offenders (regs->tpc = fault address)
11747 + *
11748 + * returns 1 when task should be killed
11749 + * 2 when patched PLT trampoline was detected
11750 + * 3 when unpatched PLT trampoline was detected
11751 + */
11752 +static int pax_handle_fetch_fault(struct pt_regs *regs)
11753 +{
11754 +
11755 +#ifdef CONFIG_PAX_EMUPLT
11756 + int err;
11757 +
11758 + do { /* PaX: patched PLT emulation #1 */
11759 + unsigned int sethi1, sethi2, jmpl;
11760 +
11761 + err = get_user(sethi1, (unsigned int *)regs->tpc);
11762 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
11763 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
11764 +
11765 + if (err)
11766 + break;
11767 +
11768 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
11769 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
11770 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
11771 + {
11772 + unsigned long addr;
11773 +
11774 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
11775 + addr = regs->u_regs[UREG_G1];
11776 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
11777 +
11778 + if (test_thread_flag(TIF_32BIT))
11779 + addr &= 0xFFFFFFFFUL;
11780 +
11781 + regs->tpc = addr;
11782 + regs->tnpc = addr+4;
11783 + return 2;
11784 + }
11785 + } while (0);
11786 +
11787 + do { /* PaX: patched PLT emulation #2 */
11788 + unsigned int ba;
11789 +
11790 + err = get_user(ba, (unsigned int *)regs->tpc);
11791 +
11792 + if (err)
11793 + break;
11794 +
11795 + if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
11796 + unsigned long addr;
11797 +
11798 + if ((ba & 0xFFC00000U) == 0x30800000U)
11799 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
11800 + else
11801 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
11802 +
11803 + if (test_thread_flag(TIF_32BIT))
11804 + addr &= 0xFFFFFFFFUL;
11805 +
11806 + regs->tpc = addr;
11807 + regs->tnpc = addr+4;
11808 + return 2;
11809 + }
11810 + } while (0);
11811 +
11812 + do { /* PaX: patched PLT emulation #3 */
11813 + unsigned int sethi, bajmpl, nop;
11814 +
11815 + err = get_user(sethi, (unsigned int *)regs->tpc);
11816 + err |= get_user(bajmpl, (unsigned int *)(regs->tpc+4));
11817 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
11818 +
11819 + if (err)
11820 + break;
11821 +
11822 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11823 + ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
11824 + nop == 0x01000000U)
11825 + {
11826 + unsigned long addr;
11827 +
11828 + addr = (sethi & 0x003FFFFFU) << 10;
11829 + regs->u_regs[UREG_G1] = addr;
11830 + if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
11831 + addr += (((bajmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
11832 + else
11833 + addr = regs->tpc + ((((bajmpl | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
11834 +
11835 + if (test_thread_flag(TIF_32BIT))
11836 + addr &= 0xFFFFFFFFUL;
11837 +
11838 + regs->tpc = addr;
11839 + regs->tnpc = addr+4;
11840 + return 2;
11841 + }
11842 + } while (0);
11843 +
11844 + do { /* PaX: patched PLT emulation #4 */
11845 + unsigned int sethi, mov1, call, mov2;
11846 +
11847 + err = get_user(sethi, (unsigned int *)regs->tpc);
11848 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
11849 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
11850 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
11851 +
11852 + if (err)
11853 + break;
11854 +
11855 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11856 + mov1 == 0x8210000FU &&
11857 + (call & 0xC0000000U) == 0x40000000U &&
11858 + mov2 == 0x9E100001U)
11859 + {
11860 + unsigned long addr;
11861 +
11862 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
11863 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
11864 +
11865 + if (test_thread_flag(TIF_32BIT))
11866 + addr &= 0xFFFFFFFFUL;
11867 +
11868 + regs->tpc = addr;
11869 + regs->tnpc = addr+4;
11870 + return 2;
11871 + }
11872 + } while (0);
11873 +
11874 + do { /* PaX: patched PLT emulation #5 */
11875 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
11876 +
11877 + err = get_user(sethi, (unsigned int *)regs->tpc);
11878 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
11879 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
11880 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
11881 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
11882 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
11883 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
11884 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
11885 +
11886 + if (err)
11887 + break;
11888 +
11889 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11890 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
11891 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
11892 + (or1 & 0xFFFFE000U) == 0x82106000U &&
11893 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
11894 + sllx == 0x83287020U &&
11895 + jmpl == 0x81C04005U &&
11896 + nop == 0x01000000U)
11897 + {
11898 + unsigned long addr;
11899 +
11900 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
11901 + regs->u_regs[UREG_G1] <<= 32;
11902 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
11903 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
11904 + regs->tpc = addr;
11905 + regs->tnpc = addr+4;
11906 + return 2;
11907 + }
11908 + } while (0);
11909 +
11910 + do { /* PaX: patched PLT emulation #6 */
11911 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
11912 +
11913 + err = get_user(sethi, (unsigned int *)regs->tpc);
11914 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
11915 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
11916 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
11917 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
11918 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
11919 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
11920 +
11921 + if (err)
11922 + break;
11923 +
11924 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11925 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
11926 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
11927 + sllx == 0x83287020U &&
11928 + (or & 0xFFFFE000U) == 0x8A116000U &&
11929 + jmpl == 0x81C04005U &&
11930 + nop == 0x01000000U)
11931 + {
11932 + unsigned long addr;
11933 +
11934 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
11935 + regs->u_regs[UREG_G1] <<= 32;
11936 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
11937 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
11938 + regs->tpc = addr;
11939 + regs->tnpc = addr+4;
11940 + return 2;
11941 + }
11942 + } while (0);
11943 +
11944 + do { /* PaX: unpatched PLT emulation step 1 */
11945 + unsigned int sethi, ba, nop;
11946 +
11947 + err = get_user(sethi, (unsigned int *)regs->tpc);
11948 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
11949 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
11950 +
11951 + if (err)
11952 + break;
11953 +
11954 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11955 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
11956 + nop == 0x01000000U)
11957 + {
11958 + unsigned long addr;
11959 + unsigned int save, call;
11960 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
11961 +
11962 + if ((ba & 0xFFC00000U) == 0x30800000U)
11963 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
11964 + else
11965 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
11966 +
11967 + if (test_thread_flag(TIF_32BIT))
11968 + addr &= 0xFFFFFFFFUL;
11969 +
11970 + err = get_user(save, (unsigned int *)addr);
11971 + err |= get_user(call, (unsigned int *)(addr+4));
11972 + err |= get_user(nop, (unsigned int *)(addr+8));
11973 + if (err)
11974 + break;
11975 +
11976 +#ifdef CONFIG_PAX_DLRESOLVE
11977 + if (save == 0x9DE3BFA8U &&
11978 + (call & 0xC0000000U) == 0x40000000U &&
11979 + nop == 0x01000000U)
11980 + {
11981 + struct vm_area_struct *vma;
11982 + unsigned long call_dl_resolve;
11983 +
11984 + down_read(&current->mm->mmap_sem);
11985 + call_dl_resolve = current->mm->call_dl_resolve;
11986 + up_read(&current->mm->mmap_sem);
11987 + if (likely(call_dl_resolve))
11988 + goto emulate;
11989 +
11990 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
11991 +
11992 + down_write(&current->mm->mmap_sem);
11993 + if (current->mm->call_dl_resolve) {
11994 + call_dl_resolve = current->mm->call_dl_resolve;
11995 + up_write(&current->mm->mmap_sem);
11996 + if (vma)
11997 + kmem_cache_free(vm_area_cachep, vma);
11998 + goto emulate;
11999 + }
12000 +
12001 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
12002 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
12003 + up_write(&current->mm->mmap_sem);
12004 + if (vma)
12005 + kmem_cache_free(vm_area_cachep, vma);
12006 + return 1;
12007 + }
12008 +
12009 + if (pax_insert_vma(vma, call_dl_resolve)) {
12010 + up_write(&current->mm->mmap_sem);
12011 + kmem_cache_free(vm_area_cachep, vma);
12012 + return 1;
12013 + }
12014 +
12015 + current->mm->call_dl_resolve = call_dl_resolve;
12016 + up_write(&current->mm->mmap_sem);
12017 +
12018 +emulate:
12019 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
12020 + regs->tpc = call_dl_resolve;
12021 + regs->tnpc = addr+4;
12022 + return 3;
12023 + }
12024 +#endif
12025 +
12026 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
12027 + if ((save & 0xFFC00000U) == 0x05000000U &&
12028 + (call & 0xFFFFE000U) == 0x85C0A000U &&
12029 + nop == 0x01000000U)
12030 + {
12031 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
12032 + regs->u_regs[UREG_G2] = addr + 4;
12033 + addr = (save & 0x003FFFFFU) << 10;
12034 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
12035 +
12036 + if (test_thread_flag(TIF_32BIT))
12037 + addr &= 0xFFFFFFFFUL;
12038 +
12039 + regs->tpc = addr;
12040 + regs->tnpc = addr+4;
12041 + return 3;
12042 + }
12043 +
12044 + /* PaX: 64-bit PLT stub */
12045 + err = get_user(sethi1, (unsigned int *)addr);
12046 + err |= get_user(sethi2, (unsigned int *)(addr+4));
12047 + err |= get_user(or1, (unsigned int *)(addr+8));
12048 + err |= get_user(or2, (unsigned int *)(addr+12));
12049 + err |= get_user(sllx, (unsigned int *)(addr+16));
12050 + err |= get_user(add, (unsigned int *)(addr+20));
12051 + err |= get_user(jmpl, (unsigned int *)(addr+24));
12052 + err |= get_user(nop, (unsigned int *)(addr+28));
12053 + if (err)
12054 + break;
12055 +
12056 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
12057 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
12058 + (or1 & 0xFFFFE000U) == 0x88112000U &&
12059 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
12060 + sllx == 0x89293020U &&
12061 + add == 0x8A010005U &&
12062 + jmpl == 0x89C14000U &&
12063 + nop == 0x01000000U)
12064 + {
12065 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
12066 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
12067 + regs->u_regs[UREG_G4] <<= 32;
12068 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
12069 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
12070 + regs->u_regs[UREG_G4] = addr + 24;
12071 + addr = regs->u_regs[UREG_G5];
12072 + regs->tpc = addr;
12073 + regs->tnpc = addr+4;
12074 + return 3;
12075 + }
12076 + }
12077 + } while (0);
12078 +
12079 +#ifdef CONFIG_PAX_DLRESOLVE
12080 + do { /* PaX: unpatched PLT emulation step 2 */
12081 + unsigned int save, call, nop;
12082 +
12083 + err = get_user(save, (unsigned int *)(regs->tpc-4));
12084 + err |= get_user(call, (unsigned int *)regs->tpc);
12085 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
12086 + if (err)
12087 + break;
12088 +
12089 + if (save == 0x9DE3BFA8U &&
12090 + (call & 0xC0000000U) == 0x40000000U &&
12091 + nop == 0x01000000U)
12092 + {
12093 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
12094 +
12095 + if (test_thread_flag(TIF_32BIT))
12096 + dl_resolve &= 0xFFFFFFFFUL;
12097 +
12098 + regs->u_regs[UREG_RETPC] = regs->tpc;
12099 + regs->tpc = dl_resolve;
12100 + regs->tnpc = dl_resolve+4;
12101 + return 3;
12102 + }
12103 + } while (0);
12104 +#endif
12105 +
12106 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
12107 + unsigned int sethi, ba, nop;
12108 +
12109 + err = get_user(sethi, (unsigned int *)regs->tpc);
12110 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
12111 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
12112 +
12113 + if (err)
12114 + break;
12115 +
12116 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
12117 + (ba & 0xFFF00000U) == 0x30600000U &&
12118 + nop == 0x01000000U)
12119 + {
12120 + unsigned long addr;
12121 +
12122 + addr = (sethi & 0x003FFFFFU) << 10;
12123 + regs->u_regs[UREG_G1] = addr;
12124 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
12125 +
12126 + if (test_thread_flag(TIF_32BIT))
12127 + addr &= 0xFFFFFFFFUL;
12128 +
12129 + regs->tpc = addr;
12130 + regs->tnpc = addr+4;
12131 + return 2;
12132 + }
12133 + } while (0);
12134 +
12135 +#endif
12136 +
12137 + return 1;
12138 +}
12139 +
12140 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
12141 +{
12142 + unsigned long i;
12143 +
12144 + printk(KERN_ERR "PAX: bytes at PC: ");
12145 + for (i = 0; i < 8; i++) {
12146 + unsigned int c;
12147 + if (get_user(c, (unsigned int *)pc+i))
12148 + printk(KERN_CONT "???????? ");
12149 + else
12150 + printk(KERN_CONT "%08x ", c);
12151 + }
12152 + printk("\n");
12153 +}
12154 +#endif
12155 +
12156 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
12157 {
12158 enum ctx_state prev_state = exception_enter();
12159 @@ -353,6 +816,29 @@ retry:
12160 if (!vma)
12161 goto bad_area;
12162
12163 +#ifdef CONFIG_PAX_PAGEEXEC
12164 + /* PaX: detect ITLB misses on non-exec pages */
12165 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
12166 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
12167 + {
12168 + if (address != regs->tpc)
12169 + goto good_area;
12170 +
12171 + up_read(&mm->mmap_sem);
12172 + switch (pax_handle_fetch_fault(regs)) {
12173 +
12174 +#ifdef CONFIG_PAX_EMUPLT
12175 + case 2:
12176 + case 3:
12177 + return;
12178 +#endif
12179 +
12180 + }
12181 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
12182 + do_group_exit(SIGKILL);
12183 + }
12184 +#endif
12185 +
12186 /* Pure DTLB misses do not tell us whether the fault causing
12187 * load/store/atomic was a write or not, it only says that there
12188 * was no match. So in such a case we (carefully) read the
12189 diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
12190 index 4242eab..9ae6360 100644
12191 --- a/arch/sparc/mm/hugetlbpage.c
12192 +++ b/arch/sparc/mm/hugetlbpage.c
12193 @@ -25,8 +25,10 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
12194 unsigned long addr,
12195 unsigned long len,
12196 unsigned long pgoff,
12197 - unsigned long flags)
12198 + unsigned long flags,
12199 + unsigned long offset)
12200 {
12201 + struct mm_struct *mm = current->mm;
12202 unsigned long task_size = TASK_SIZE;
12203 struct vm_unmapped_area_info info;
12204
12205 @@ -35,15 +37,22 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
12206
12207 info.flags = 0;
12208 info.length = len;
12209 - info.low_limit = TASK_UNMAPPED_BASE;
12210 + info.low_limit = mm->mmap_base;
12211 info.high_limit = min(task_size, VA_EXCLUDE_START);
12212 info.align_mask = PAGE_MASK & ~HPAGE_MASK;
12213 info.align_offset = 0;
12214 + info.threadstack_offset = offset;
12215 addr = vm_unmapped_area(&info);
12216
12217 if ((addr & ~PAGE_MASK) && task_size > VA_EXCLUDE_END) {
12218 VM_BUG_ON(addr != -ENOMEM);
12219 info.low_limit = VA_EXCLUDE_END;
12220 +
12221 +#ifdef CONFIG_PAX_RANDMMAP
12222 + if (mm->pax_flags & MF_PAX_RANDMMAP)
12223 + info.low_limit += mm->delta_mmap;
12224 +#endif
12225 +
12226 info.high_limit = task_size;
12227 addr = vm_unmapped_area(&info);
12228 }
12229 @@ -55,7 +64,8 @@ static unsigned long
12230 hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
12231 const unsigned long len,
12232 const unsigned long pgoff,
12233 - const unsigned long flags)
12234 + const unsigned long flags,
12235 + const unsigned long offset)
12236 {
12237 struct mm_struct *mm = current->mm;
12238 unsigned long addr = addr0;
12239 @@ -70,6 +80,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
12240 info.high_limit = mm->mmap_base;
12241 info.align_mask = PAGE_MASK & ~HPAGE_MASK;
12242 info.align_offset = 0;
12243 + info.threadstack_offset = offset;
12244 addr = vm_unmapped_area(&info);
12245
12246 /*
12247 @@ -82,6 +93,12 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
12248 VM_BUG_ON(addr != -ENOMEM);
12249 info.flags = 0;
12250 info.low_limit = TASK_UNMAPPED_BASE;
12251 +
12252 +#ifdef CONFIG_PAX_RANDMMAP
12253 + if (mm->pax_flags & MF_PAX_RANDMMAP)
12254 + info.low_limit += mm->delta_mmap;
12255 +#endif
12256 +
12257 info.high_limit = STACK_TOP32;
12258 addr = vm_unmapped_area(&info);
12259 }
12260 @@ -96,6 +113,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
12261 struct mm_struct *mm = current->mm;
12262 struct vm_area_struct *vma;
12263 unsigned long task_size = TASK_SIZE;
12264 + unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
12265
12266 if (test_thread_flag(TIF_32BIT))
12267 task_size = STACK_TOP32;
12268 @@ -111,19 +129,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
12269 return addr;
12270 }
12271
12272 +#ifdef CONFIG_PAX_RANDMMAP
12273 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
12274 +#endif
12275 +
12276 if (addr) {
12277 addr = ALIGN(addr, HPAGE_SIZE);
12278 vma = find_vma(mm, addr);
12279 - if (task_size - len >= addr &&
12280 - (!vma || addr + len <= vma->vm_start))
12281 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
12282 return addr;
12283 }
12284 if (mm->get_unmapped_area == arch_get_unmapped_area)
12285 return hugetlb_get_unmapped_area_bottomup(file, addr, len,
12286 - pgoff, flags);
12287 + pgoff, flags, offset);
12288 else
12289 return hugetlb_get_unmapped_area_topdown(file, addr, len,
12290 - pgoff, flags);
12291 + pgoff, flags, offset);
12292 }
12293
12294 pte_t *huge_pte_alloc(struct mm_struct *mm,
12295 diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
12296 index 559cb74..9e5f097 100644
12297 --- a/arch/sparc/mm/init_64.c
12298 +++ b/arch/sparc/mm/init_64.c
12299 @@ -187,9 +187,9 @@ unsigned long sparc64_kern_sec_context __read_mostly;
12300 int num_kernel_image_mappings;
12301
12302 #ifdef CONFIG_DEBUG_DCFLUSH
12303 -atomic_t dcpage_flushes = ATOMIC_INIT(0);
12304 +atomic_unchecked_t dcpage_flushes = ATOMIC_INIT(0);
12305 #ifdef CONFIG_SMP
12306 -atomic_t dcpage_flushes_xcall = ATOMIC_INIT(0);
12307 +atomic_unchecked_t dcpage_flushes_xcall = ATOMIC_INIT(0);
12308 #endif
12309 #endif
12310
12311 @@ -197,7 +197,7 @@ inline void flush_dcache_page_impl(struct page *page)
12312 {
12313 BUG_ON(tlb_type == hypervisor);
12314 #ifdef CONFIG_DEBUG_DCFLUSH
12315 - atomic_inc(&dcpage_flushes);
12316 + atomic_inc_unchecked(&dcpage_flushes);
12317 #endif
12318
12319 #ifdef DCACHE_ALIASING_POSSIBLE
12320 @@ -469,10 +469,10 @@ void mmu_info(struct seq_file *m)
12321
12322 #ifdef CONFIG_DEBUG_DCFLUSH
12323 seq_printf(m, "DCPageFlushes\t: %d\n",
12324 - atomic_read(&dcpage_flushes));
12325 + atomic_read_unchecked(&dcpage_flushes));
12326 #ifdef CONFIG_SMP
12327 seq_printf(m, "DCPageFlushesXC\t: %d\n",
12328 - atomic_read(&dcpage_flushes_xcall));
12329 + atomic_read_unchecked(&dcpage_flushes_xcall));
12330 #endif /* CONFIG_SMP */
12331 #endif /* CONFIG_DEBUG_DCFLUSH */
12332 }
12333 diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
12334 index a07e31b..85c9003 100644
12335 --- a/arch/tile/Kconfig
12336 +++ b/arch/tile/Kconfig
12337 @@ -198,6 +198,7 @@ source "kernel/Kconfig.hz"
12338
12339 config KEXEC
12340 bool "kexec system call"
12341 + depends on !GRKERNSEC_KMEM
12342 ---help---
12343 kexec is a system call that implements the ability to shutdown your
12344 current kernel, and to start another kernel. It is like a reboot
12345 diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
12346 index 7b11c5f..755a026 100644
12347 --- a/arch/tile/include/asm/atomic_64.h
12348 +++ b/arch/tile/include/asm/atomic_64.h
12349 @@ -105,6 +105,16 @@ static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
12350
12351 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
12352
12353 +#define atomic64_read_unchecked(v) atomic64_read(v)
12354 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
12355 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
12356 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
12357 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
12358 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
12359 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
12360 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
12361 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
12362 +
12363 /* Define this to indicate that cmpxchg is an efficient operation. */
12364 #define __HAVE_ARCH_CMPXCHG
12365
12366 diff --git a/arch/tile/include/asm/cache.h b/arch/tile/include/asm/cache.h
12367 index 6160761..00cac88 100644
12368 --- a/arch/tile/include/asm/cache.h
12369 +++ b/arch/tile/include/asm/cache.h
12370 @@ -15,11 +15,12 @@
12371 #ifndef _ASM_TILE_CACHE_H
12372 #define _ASM_TILE_CACHE_H
12373
12374 +#include <linux/const.h>
12375 #include <arch/chip.h>
12376
12377 /* bytes per L1 data cache line */
12378 #define L1_CACHE_SHIFT CHIP_L1D_LOG_LINE_SIZE()
12379 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
12380 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
12381
12382 /* bytes per L2 cache line */
12383 #define L2_CACHE_SHIFT CHIP_L2_LOG_LINE_SIZE()
12384 diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
12385 index f41cb53..31d3ab4 100644
12386 --- a/arch/tile/include/asm/uaccess.h
12387 +++ b/arch/tile/include/asm/uaccess.h
12388 @@ -417,9 +417,9 @@ static inline unsigned long __must_check copy_from_user(void *to,
12389 const void __user *from,
12390 unsigned long n)
12391 {
12392 - int sz = __compiletime_object_size(to);
12393 + size_t sz = __compiletime_object_size(to);
12394
12395 - if (likely(sz == -1 || sz >= n))
12396 + if (likely(sz == (size_t)-1 || sz >= n))
12397 n = _copy_from_user(to, from, n);
12398 else
12399 copy_from_user_overflow();
12400 diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
12401 index 8416240..a012fb7 100644
12402 --- a/arch/tile/mm/hugetlbpage.c
12403 +++ b/arch/tile/mm/hugetlbpage.c
12404 @@ -179,6 +179,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
12405 info.high_limit = TASK_SIZE;
12406 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
12407 info.align_offset = 0;
12408 + info.threadstack_offset = 0;
12409 return vm_unmapped_area(&info);
12410 }
12411
12412 @@ -196,6 +197,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
12413 info.high_limit = current->mm->mmap_base;
12414 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
12415 info.align_offset = 0;
12416 + info.threadstack_offset = 0;
12417 addr = vm_unmapped_area(&info);
12418
12419 /*
12420 diff --git a/arch/um/Makefile b/arch/um/Makefile
12421 index 17d4460..9d74338e3de4 100644
12422 --- a/arch/um/Makefile
12423 +++ b/arch/um/Makefile
12424 @@ -72,6 +72,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
12425 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
12426 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64 -idirafter include
12427
12428 +ifdef CONSTIFY_PLUGIN
12429 +USER_CFLAGS += -fplugin-arg-constify_plugin-no-constify
12430 +endif
12431 +
12432 #This will adjust *FLAGS accordingly to the platform.
12433 include $(ARCH_DIR)/Makefile-os-$(OS)
12434
12435 diff --git a/arch/um/include/asm/cache.h b/arch/um/include/asm/cache.h
12436 index 19e1bdd..3665b77 100644
12437 --- a/arch/um/include/asm/cache.h
12438 +++ b/arch/um/include/asm/cache.h
12439 @@ -1,6 +1,7 @@
12440 #ifndef __UM_CACHE_H
12441 #define __UM_CACHE_H
12442
12443 +#include <linux/const.h>
12444
12445 #if defined(CONFIG_UML_X86) && !defined(CONFIG_64BIT)
12446 # define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
12447 @@ -12,6 +13,6 @@
12448 # define L1_CACHE_SHIFT 5
12449 #endif
12450
12451 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
12452 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
12453
12454 #endif
12455 diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
12456 index 2e0a6b1..a64d0f5 100644
12457 --- a/arch/um/include/asm/kmap_types.h
12458 +++ b/arch/um/include/asm/kmap_types.h
12459 @@ -8,6 +8,6 @@
12460
12461 /* No more #include "asm/arch/kmap_types.h" ! */
12462
12463 -#define KM_TYPE_NR 14
12464 +#define KM_TYPE_NR 15
12465
12466 #endif
12467 diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
12468 index 71c5d13..4c7b9f1 100644
12469 --- a/arch/um/include/asm/page.h
12470 +++ b/arch/um/include/asm/page.h
12471 @@ -14,6 +14,9 @@
12472 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
12473 #define PAGE_MASK (~(PAGE_SIZE-1))
12474
12475 +#define ktla_ktva(addr) (addr)
12476 +#define ktva_ktla(addr) (addr)
12477 +
12478 #ifndef __ASSEMBLY__
12479
12480 struct page;
12481 diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
12482 index 2b4274e..754fe06 100644
12483 --- a/arch/um/include/asm/pgtable-3level.h
12484 +++ b/arch/um/include/asm/pgtable-3level.h
12485 @@ -58,6 +58,7 @@
12486 #define pud_present(x) (pud_val(x) & _PAGE_PRESENT)
12487 #define pud_populate(mm, pud, pmd) \
12488 set_pud(pud, __pud(_PAGE_TABLE + __pa(pmd)))
12489 +#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
12490
12491 #ifdef CONFIG_64BIT
12492 #define set_pud(pudptr, pudval) set_64bit((u64 *) (pudptr), pud_val(pudval))
12493 diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
12494 index 68b9119..f72353c 100644
12495 --- a/arch/um/kernel/process.c
12496 +++ b/arch/um/kernel/process.c
12497 @@ -345,22 +345,6 @@ int singlestepping(void * t)
12498 return 2;
12499 }
12500
12501 -/*
12502 - * Only x86 and x86_64 have an arch_align_stack().
12503 - * All other arches have "#define arch_align_stack(x) (x)"
12504 - * in their asm/exec.h
12505 - * As this is included in UML from asm-um/system-generic.h,
12506 - * we can use it to behave as the subarch does.
12507 - */
12508 -#ifndef arch_align_stack
12509 -unsigned long arch_align_stack(unsigned long sp)
12510 -{
12511 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
12512 - sp -= get_random_int() % 8192;
12513 - return sp & ~0xf;
12514 -}
12515 -#endif
12516 -
12517 unsigned long get_wchan(struct task_struct *p)
12518 {
12519 unsigned long stack_page, sp, ip;
12520 diff --git a/arch/unicore32/include/asm/cache.h b/arch/unicore32/include/asm/cache.h
12521 index ad8f795..2c7eec6 100644
12522 --- a/arch/unicore32/include/asm/cache.h
12523 +++ b/arch/unicore32/include/asm/cache.h
12524 @@ -12,8 +12,10 @@
12525 #ifndef __UNICORE_CACHE_H__
12526 #define __UNICORE_CACHE_H__
12527
12528 -#define L1_CACHE_SHIFT (5)
12529 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
12530 +#include <linux/const.h>
12531 +
12532 +#define L1_CACHE_SHIFT 5
12533 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
12534
12535 /*
12536 * Memory returned by kmalloc() may be used for DMA, so we must make
12537 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
12538 index 226d569..d420edc 100644
12539 --- a/arch/x86/Kconfig
12540 +++ b/arch/x86/Kconfig
12541 @@ -32,7 +32,7 @@ config X86
12542 select HAVE_AOUT if X86_32
12543 select HAVE_UNSTABLE_SCHED_CLOCK
12544 select ARCH_SUPPORTS_NUMA_BALANCING if X86_64
12545 - select ARCH_SUPPORTS_INT128 if X86_64
12546 + select ARCH_SUPPORTS_INT128 if X86_64 && !PAX_SIZE_OVERFLOW
12547 select HAVE_IDE
12548 select HAVE_OPROFILE
12549 select HAVE_PCSPKR_PLATFORM
12550 @@ -134,7 +134,7 @@ config X86
12551 select RTC_LIB
12552 select HAVE_DEBUG_STACKOVERFLOW
12553 select HAVE_IRQ_EXIT_ON_IRQ_STACK if X86_64
12554 - select HAVE_CC_STACKPROTECTOR
12555 + select HAVE_CC_STACKPROTECTOR if X86_64 || !PAX_MEMORY_UDEREF
12556 select GENERIC_CPU_AUTOPROBE
12557 select HAVE_ARCH_AUDITSYSCALL
12558 select ARCH_SUPPORTS_ATOMIC_RMW
12559 @@ -266,7 +266,7 @@ config X86_HT
12560
12561 config X86_32_LAZY_GS
12562 def_bool y
12563 - depends on X86_32 && !CC_STACKPROTECTOR
12564 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
12565
12566 config ARCH_HWEIGHT_CFLAGS
12567 string
12568 @@ -638,6 +638,7 @@ config SCHED_OMIT_FRAME_POINTER
12569
12570 menuconfig HYPERVISOR_GUEST
12571 bool "Linux guest support"
12572 + depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_GUEST || (GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN)
12573 ---help---
12574 Say Y here to enable options for running Linux under various hyper-
12575 visors. This option enables basic hypervisor detection and platform
12576 @@ -1005,6 +1006,7 @@ config VM86
12577
12578 config X86_16BIT
12579 bool "Enable support for 16-bit segments" if EXPERT
12580 + depends on !GRKERNSEC
12581 default y
12582 ---help---
12583 This option is required by programs like Wine to run 16-bit
12584 @@ -1178,6 +1180,7 @@ choice
12585
12586 config NOHIGHMEM
12587 bool "off"
12588 + depends on !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12589 ---help---
12590 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
12591 However, the address space of 32-bit x86 processors is only 4
12592 @@ -1214,6 +1217,7 @@ config NOHIGHMEM
12593
12594 config HIGHMEM4G
12595 bool "4GB"
12596 + depends on !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12597 ---help---
12598 Select this if you have a 32-bit processor and between 1 and 4
12599 gigabytes of physical RAM.
12600 @@ -1266,7 +1270,7 @@ config PAGE_OFFSET
12601 hex
12602 default 0xB0000000 if VMSPLIT_3G_OPT
12603 default 0x80000000 if VMSPLIT_2G
12604 - default 0x78000000 if VMSPLIT_2G_OPT
12605 + default 0x70000000 if VMSPLIT_2G_OPT
12606 default 0x40000000 if VMSPLIT_1G
12607 default 0xC0000000
12608 depends on X86_32
12609 @@ -1717,6 +1721,7 @@ source kernel/Kconfig.hz
12610
12611 config KEXEC
12612 bool "kexec system call"
12613 + depends on !GRKERNSEC_KMEM
12614 ---help---
12615 kexec is a system call that implements the ability to shutdown your
12616 current kernel, and to start another kernel. It is like a reboot
12617 @@ -1899,7 +1904,9 @@ config X86_NEED_RELOCS
12618
12619 config PHYSICAL_ALIGN
12620 hex "Alignment value to which kernel should be aligned"
12621 - default "0x200000"
12622 + default "0x1000000"
12623 + range 0x200000 0x1000000 if PAX_KERNEXEC && X86_PAE
12624 + range 0x400000 0x1000000 if PAX_KERNEXEC && !X86_PAE
12625 range 0x2000 0x1000000 if X86_32
12626 range 0x200000 0x1000000 if X86_64
12627 ---help---
12628 @@ -1982,6 +1989,7 @@ config COMPAT_VDSO
12629 def_bool n
12630 prompt "Disable the 32-bit vDSO (needed for glibc 2.3.3)"
12631 depends on X86_32 || IA32_EMULATION
12632 + depends on !PAX_PAGEEXEC && !PAX_SEGMEXEC && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
12633 ---help---
12634 Certain buggy versions of glibc will crash if they are
12635 presented with a 32-bit vDSO that is not mapped at the address
12636 @@ -2046,6 +2054,22 @@ config CMDLINE_OVERRIDE
12637 This is used to work around broken boot loaders. This should
12638 be set to 'N' under normal conditions.
12639
12640 +config DEFAULT_MODIFY_LDT_SYSCALL
12641 + bool "Allow userspace to modify the LDT by default"
12642 + default y
12643 +
12644 + ---help---
12645 + Modifying the LDT (Local Descriptor Table) may be needed to run a
12646 + 16-bit or segmented code such as Dosemu or Wine. This is done via
12647 + a system call which is not needed to run portable applications,
12648 + and which can sometimes be abused to exploit some weaknesses of
12649 + the architecture, opening new vulnerabilities.
12650 +
12651 + For this reason this option allows one to enable or disable the
12652 + feature at runtime. It is recommended to say 'N' here to leave
12653 + the system protected, and to enable it at runtime only if needed
12654 + by setting the sys.kernel.modify_ldt sysctl.
12655 +
12656 source "kernel/livepatch/Kconfig"
12657
12658 endmenu
12659 diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
12660 index 6983314..54ad7e8 100644
12661 --- a/arch/x86/Kconfig.cpu
12662 +++ b/arch/x86/Kconfig.cpu
12663 @@ -319,7 +319,7 @@ config X86_PPRO_FENCE
12664
12665 config X86_F00F_BUG
12666 def_bool y
12667 - depends on M586MMX || M586TSC || M586 || M486
12668 + depends on (M586MMX || M586TSC || M586 || M486) && !PAX_KERNEXEC
12669
12670 config X86_INVD_BUG
12671 def_bool y
12672 @@ -327,7 +327,7 @@ config X86_INVD_BUG
12673
12674 config X86_ALIGNMENT_16
12675 def_bool y
12676 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12677 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12678
12679 config X86_INTEL_USERCOPY
12680 def_bool y
12681 @@ -369,7 +369,7 @@ config X86_CMPXCHG64
12682 # generates cmov.
12683 config X86_CMOV
12684 def_bool y
12685 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12686 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12687
12688 config X86_MINIMUM_CPU_FAMILY
12689 int
12690 diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
12691 index 72484a6..83a4411 100644
12692 --- a/arch/x86/Kconfig.debug
12693 +++ b/arch/x86/Kconfig.debug
12694 @@ -89,7 +89,7 @@ config EFI_PGT_DUMP
12695 config DEBUG_RODATA
12696 bool "Write protect kernel read-only data structures"
12697 default y
12698 - depends on DEBUG_KERNEL
12699 + depends on DEBUG_KERNEL && BROKEN
12700 ---help---
12701 Mark the kernel read-only data as write-protected in the pagetables,
12702 in order to catch accidental (and incorrect) writes to such const
12703 @@ -107,7 +107,7 @@ config DEBUG_RODATA_TEST
12704
12705 config DEBUG_SET_MODULE_RONX
12706 bool "Set loadable kernel module data as NX and text as RO"
12707 - depends on MODULES
12708 + depends on MODULES && BROKEN
12709 ---help---
12710 This option helps catch unintended modifications to loadable
12711 kernel module's text and read-only data. It also prevents execution
12712 diff --git a/arch/x86/Makefile b/arch/x86/Makefile
12713 index 2fda005..2c72d40 100644
12714 --- a/arch/x86/Makefile
12715 +++ b/arch/x86/Makefile
12716 @@ -65,9 +65,6 @@ ifeq ($(CONFIG_X86_32),y)
12717 # CPU-specific tuning. Anything which can be shared with UML should go here.
12718 include arch/x86/Makefile_32.cpu
12719 KBUILD_CFLAGS += $(cflags-y)
12720 -
12721 - # temporary until string.h is fixed
12722 - KBUILD_CFLAGS += -ffreestanding
12723 else
12724 BITS := 64
12725 UTS_MACHINE := x86_64
12726 @@ -107,6 +104,9 @@ else
12727 KBUILD_CFLAGS += $(call cc-option,-maccumulate-outgoing-args)
12728 endif
12729
12730 +# temporary until string.h is fixed
12731 +KBUILD_CFLAGS += -ffreestanding
12732 +
12733 # Make sure compiler does not have buggy stack-protector support.
12734 ifdef CONFIG_CC_STACKPROTECTOR
12735 cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
12736 @@ -181,6 +181,7 @@ archheaders:
12737 $(Q)$(MAKE) $(build)=arch/x86/syscalls all
12738
12739 archprepare:
12740 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
12741 ifeq ($(CONFIG_KEXEC_FILE),y)
12742 $(Q)$(MAKE) $(build)=arch/x86/purgatory arch/x86/purgatory/kexec-purgatory.c
12743 endif
12744 @@ -264,3 +265,9 @@ define archhelp
12745 echo ' FDARGS="..." arguments for the booted kernel'
12746 echo ' FDINITRD=file initrd for the booted kernel'
12747 endef
12748 +
12749 +define OLD_LD
12750 +
12751 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
12752 +*** Please upgrade your binutils to 2.18 or newer
12753 +endef
12754 diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
12755 index 57bbf2f..b100fce 100644
12756 --- a/arch/x86/boot/Makefile
12757 +++ b/arch/x86/boot/Makefile
12758 @@ -58,6 +58,9 @@ clean-files += cpustr.h
12759 # ---------------------------------------------------------------------------
12760
12761 KBUILD_CFLAGS := $(USERINCLUDE) $(REALMODE_CFLAGS) -D_SETUP
12762 +ifdef CONSTIFY_PLUGIN
12763 +KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
12764 +endif
12765 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
12766 GCOV_PROFILE := n
12767
12768 diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
12769 index 878e4b9..20537ab 100644
12770 --- a/arch/x86/boot/bitops.h
12771 +++ b/arch/x86/boot/bitops.h
12772 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
12773 u8 v;
12774 const u32 *p = (const u32 *)addr;
12775
12776 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
12777 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
12778 return v;
12779 }
12780
12781 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
12782
12783 static inline void set_bit(int nr, void *addr)
12784 {
12785 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
12786 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
12787 }
12788
12789 #endif /* BOOT_BITOPS_H */
12790 diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
12791 index bd49ec6..94c7f58 100644
12792 --- a/arch/x86/boot/boot.h
12793 +++ b/arch/x86/boot/boot.h
12794 @@ -84,7 +84,7 @@ static inline void io_delay(void)
12795 static inline u16 ds(void)
12796 {
12797 u16 seg;
12798 - asm("movw %%ds,%0" : "=rm" (seg));
12799 + asm volatile("movw %%ds,%0" : "=rm" (seg));
12800 return seg;
12801 }
12802
12803 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
12804 index 0a291cd..9686efc 100644
12805 --- a/arch/x86/boot/compressed/Makefile
12806 +++ b/arch/x86/boot/compressed/Makefile
12807 @@ -30,6 +30,9 @@ KBUILD_CFLAGS += $(cflags-y)
12808 KBUILD_CFLAGS += -mno-mmx -mno-sse
12809 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
12810 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
12811 +ifdef CONSTIFY_PLUGIN
12812 +KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
12813 +endif
12814
12815 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
12816 GCOV_PROFILE := n
12817 diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
12818 index a53440e..c3dbf1e 100644
12819 --- a/arch/x86/boot/compressed/efi_stub_32.S
12820 +++ b/arch/x86/boot/compressed/efi_stub_32.S
12821 @@ -46,16 +46,13 @@ ENTRY(efi_call_phys)
12822 * parameter 2, ..., param n. To make things easy, we save the return
12823 * address of efi_call_phys in a global variable.
12824 */
12825 - popl %ecx
12826 - movl %ecx, saved_return_addr(%edx)
12827 - /* get the function pointer into ECX*/
12828 - popl %ecx
12829 - movl %ecx, efi_rt_function_ptr(%edx)
12830 + popl saved_return_addr(%edx)
12831 + popl efi_rt_function_ptr(%edx)
12832
12833 /*
12834 * 3. Call the physical function.
12835 */
12836 - call *%ecx
12837 + call *efi_rt_function_ptr(%edx)
12838
12839 /*
12840 * 4. Balance the stack. And because EAX contain the return value,
12841 @@ -67,15 +64,12 @@ ENTRY(efi_call_phys)
12842 1: popl %edx
12843 subl $1b, %edx
12844
12845 - movl efi_rt_function_ptr(%edx), %ecx
12846 - pushl %ecx
12847 + pushl efi_rt_function_ptr(%edx)
12848
12849 /*
12850 * 10. Push the saved return address onto the stack and return.
12851 */
12852 - movl saved_return_addr(%edx), %ecx
12853 - pushl %ecx
12854 - ret
12855 + jmpl *saved_return_addr(%edx)
12856 ENDPROC(efi_call_phys)
12857 .previous
12858
12859 diff --git a/arch/x86/boot/compressed/efi_thunk_64.S b/arch/x86/boot/compressed/efi_thunk_64.S
12860 index 630384a..278e788 100644
12861 --- a/arch/x86/boot/compressed/efi_thunk_64.S
12862 +++ b/arch/x86/boot/compressed/efi_thunk_64.S
12863 @@ -189,8 +189,8 @@ efi_gdt64:
12864 .long 0 /* Filled out by user */
12865 .word 0
12866 .quad 0x0000000000000000 /* NULL descriptor */
12867 - .quad 0x00af9a000000ffff /* __KERNEL_CS */
12868 - .quad 0x00cf92000000ffff /* __KERNEL_DS */
12869 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
12870 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
12871 .quad 0x0080890000000000 /* TS descriptor */
12872 .quad 0x0000000000000000 /* TS continued */
12873 efi_gdt64_end:
12874 diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
12875 index 8ef964d..fcfb8aa 100644
12876 --- a/arch/x86/boot/compressed/head_32.S
12877 +++ b/arch/x86/boot/compressed/head_32.S
12878 @@ -141,10 +141,10 @@ preferred_addr:
12879 addl %eax, %ebx
12880 notl %eax
12881 andl %eax, %ebx
12882 - cmpl $LOAD_PHYSICAL_ADDR, %ebx
12883 + cmpl $____LOAD_PHYSICAL_ADDR, %ebx
12884 jge 1f
12885 #endif
12886 - movl $LOAD_PHYSICAL_ADDR, %ebx
12887 + movl $____LOAD_PHYSICAL_ADDR, %ebx
12888 1:
12889
12890 /* Target address to relocate to for decompression */
12891 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
12892 index b0c0d16..3b44ff8 100644
12893 --- a/arch/x86/boot/compressed/head_64.S
12894 +++ b/arch/x86/boot/compressed/head_64.S
12895 @@ -95,10 +95,10 @@ ENTRY(startup_32)
12896 addl %eax, %ebx
12897 notl %eax
12898 andl %eax, %ebx
12899 - cmpl $LOAD_PHYSICAL_ADDR, %ebx
12900 + cmpl $____LOAD_PHYSICAL_ADDR, %ebx
12901 jge 1f
12902 #endif
12903 - movl $LOAD_PHYSICAL_ADDR, %ebx
12904 + movl $____LOAD_PHYSICAL_ADDR, %ebx
12905 1:
12906
12907 /* Target address to relocate to for decompression */
12908 @@ -323,10 +323,10 @@ preferred_addr:
12909 addq %rax, %rbp
12910 notq %rax
12911 andq %rax, %rbp
12912 - cmpq $LOAD_PHYSICAL_ADDR, %rbp
12913 + cmpq $____LOAD_PHYSICAL_ADDR, %rbp
12914 jge 1f
12915 #endif
12916 - movq $LOAD_PHYSICAL_ADDR, %rbp
12917 + movq $____LOAD_PHYSICAL_ADDR, %rbp
12918 1:
12919
12920 /* Target address to relocate to for decompression */
12921 @@ -435,8 +435,8 @@ gdt:
12922 .long gdt
12923 .word 0
12924 .quad 0x0000000000000000 /* NULL descriptor */
12925 - .quad 0x00af9a000000ffff /* __KERNEL_CS */
12926 - .quad 0x00cf92000000ffff /* __KERNEL_DS */
12927 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
12928 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
12929 .quad 0x0080890000000000 /* TS descriptor */
12930 .quad 0x0000000000000000 /* TS continued */
12931 gdt_end:
12932 diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
12933 index a107b93..55602de 100644
12934 --- a/arch/x86/boot/compressed/misc.c
12935 +++ b/arch/x86/boot/compressed/misc.c
12936 @@ -242,7 +242,7 @@ static void handle_relocations(void *output, unsigned long output_len)
12937 * Calculate the delta between where vmlinux was linked to load
12938 * and where it was actually loaded.
12939 */
12940 - delta = min_addr - LOAD_PHYSICAL_ADDR;
12941 + delta = min_addr - ____LOAD_PHYSICAL_ADDR;
12942 if (!delta) {
12943 debug_putstr("No relocation needed... ");
12944 return;
12945 @@ -324,7 +324,7 @@ static void parse_elf(void *output)
12946 Elf32_Ehdr ehdr;
12947 Elf32_Phdr *phdrs, *phdr;
12948 #endif
12949 - void *dest;
12950 + void *dest, *prev;
12951 int i;
12952
12953 memcpy(&ehdr, output, sizeof(ehdr));
12954 @@ -351,13 +351,16 @@ static void parse_elf(void *output)
12955 case PT_LOAD:
12956 #ifdef CONFIG_RELOCATABLE
12957 dest = output;
12958 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
12959 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
12960 #else
12961 dest = (void *)(phdr->p_paddr);
12962 #endif
12963 memcpy(dest,
12964 output + phdr->p_offset,
12965 phdr->p_filesz);
12966 + if (i)
12967 + memset(prev, 0xff, dest - prev);
12968 + prev = dest + phdr->p_filesz;
12969 break;
12970 default: /* Ignore other PT_* */ break;
12971 }
12972 @@ -419,7 +422,7 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
12973 error("Destination address too large");
12974 #endif
12975 #ifndef CONFIG_RELOCATABLE
12976 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
12977 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
12978 error("Wrong destination address");
12979 #endif
12980
12981 diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
12982 index 1fd7d57..0f7d096 100644
12983 --- a/arch/x86/boot/cpucheck.c
12984 +++ b/arch/x86/boot/cpucheck.c
12985 @@ -125,9 +125,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
12986 u32 ecx = MSR_K7_HWCR;
12987 u32 eax, edx;
12988
12989 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12990 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12991 eax &= ~(1 << 15);
12992 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12993 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12994
12995 get_cpuflags(); /* Make sure it really did something */
12996 err = check_cpuflags();
12997 @@ -140,9 +140,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
12998 u32 ecx = MSR_VIA_FCR;
12999 u32 eax, edx;
13000
13001 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
13002 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
13003 eax |= (1<<1)|(1<<7);
13004 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
13005 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
13006
13007 set_bit(X86_FEATURE_CX8, cpu.flags);
13008 err = check_cpuflags();
13009 @@ -153,12 +153,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
13010 u32 eax, edx;
13011 u32 level = 1;
13012
13013 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
13014 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
13015 - asm("cpuid"
13016 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
13017 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
13018 + asm volatile("cpuid"
13019 : "+a" (level), "=d" (cpu.flags[0])
13020 : : "ecx", "ebx");
13021 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
13022 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
13023
13024 err = check_cpuflags();
13025 } else if (err == 0x01 &&
13026 diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
13027 index 16ef025..91e033b 100644
13028 --- a/arch/x86/boot/header.S
13029 +++ b/arch/x86/boot/header.S
13030 @@ -438,10 +438,14 @@ setup_data: .quad 0 # 64-bit physical pointer to
13031 # single linked list of
13032 # struct setup_data
13033
13034 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
13035 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
13036
13037 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
13038 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13039 +#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR)
13040 +#else
13041 #define VO_INIT_SIZE (VO__end - VO__text)
13042 +#endif
13043 #if ZO_INIT_SIZE > VO_INIT_SIZE
13044 #define INIT_SIZE ZO_INIT_SIZE
13045 #else
13046 diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
13047 index db75d07..8e6d0af 100644
13048 --- a/arch/x86/boot/memory.c
13049 +++ b/arch/x86/boot/memory.c
13050 @@ -19,7 +19,7 @@
13051
13052 static int detect_memory_e820(void)
13053 {
13054 - int count = 0;
13055 + unsigned int count = 0;
13056 struct biosregs ireg, oreg;
13057 struct e820entry *desc = boot_params.e820_map;
13058 static struct e820entry buf; /* static so it is zeroed */
13059 diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
13060 index ba3e100..6501b8f 100644
13061 --- a/arch/x86/boot/video-vesa.c
13062 +++ b/arch/x86/boot/video-vesa.c
13063 @@ -201,6 +201,7 @@ static void vesa_store_pm_info(void)
13064
13065 boot_params.screen_info.vesapm_seg = oreg.es;
13066 boot_params.screen_info.vesapm_off = oreg.di;
13067 + boot_params.screen_info.vesapm_size = oreg.cx;
13068 }
13069
13070 /*
13071 diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
13072 index 05111bb..a1ae1f0 100644
13073 --- a/arch/x86/boot/video.c
13074 +++ b/arch/x86/boot/video.c
13075 @@ -98,7 +98,7 @@ static void store_mode_params(void)
13076 static unsigned int get_entry(void)
13077 {
13078 char entry_buf[4];
13079 - int i, len = 0;
13080 + unsigned int i, len = 0;
13081 int key;
13082 unsigned int v;
13083
13084 diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
13085 index 9105655..41779c1 100644
13086 --- a/arch/x86/crypto/aes-x86_64-asm_64.S
13087 +++ b/arch/x86/crypto/aes-x86_64-asm_64.S
13088 @@ -8,6 +8,8 @@
13089 * including this sentence is retained in full.
13090 */
13091
13092 +#include <asm/alternative-asm.h>
13093 +
13094 .extern crypto_ft_tab
13095 .extern crypto_it_tab
13096 .extern crypto_fl_tab
13097 @@ -70,6 +72,8 @@
13098 je B192; \
13099 leaq 32(r9),r9;
13100
13101 +#define ret pax_force_retaddr; ret
13102 +
13103 #define epilogue(FUNC,r1,r2,r3,r4,r5,r6,r7,r8,r9) \
13104 movq r1,r2; \
13105 movq r3,r4; \
13106 diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
13107 index 6bd2c6c..368c93e 100644
13108 --- a/arch/x86/crypto/aesni-intel_asm.S
13109 +++ b/arch/x86/crypto/aesni-intel_asm.S
13110 @@ -31,6 +31,7 @@
13111
13112 #include <linux/linkage.h>
13113 #include <asm/inst.h>
13114 +#include <asm/alternative-asm.h>
13115
13116 /*
13117 * The following macros are used to move an (un)aligned 16 byte value to/from
13118 @@ -217,7 +218,7 @@ enc: .octa 0x2
13119 * num_initial_blocks = b mod 4
13120 * encrypt the initial num_initial_blocks blocks and apply ghash on
13121 * the ciphertext
13122 -* %r10, %r11, %r12, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13123 +* %r10, %r11, %r15, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13124 * are clobbered
13125 * arg1, %arg2, %arg3, %r14 are used as a pointer only, not modified
13126 */
13127 @@ -227,8 +228,8 @@ enc: .octa 0x2
13128 XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
13129 MOVADQ SHUF_MASK(%rip), %xmm14
13130 mov arg7, %r10 # %r10 = AAD
13131 - mov arg8, %r12 # %r12 = aadLen
13132 - mov %r12, %r11
13133 + mov arg8, %r15 # %r15 = aadLen
13134 + mov %r15, %r11
13135 pxor %xmm\i, %xmm\i
13136
13137 _get_AAD_loop\num_initial_blocks\operation:
13138 @@ -237,17 +238,17 @@ _get_AAD_loop\num_initial_blocks\operation:
13139 psrldq $4, %xmm\i
13140 pxor \TMP1, %xmm\i
13141 add $4, %r10
13142 - sub $4, %r12
13143 + sub $4, %r15
13144 jne _get_AAD_loop\num_initial_blocks\operation
13145
13146 cmp $16, %r11
13147 je _get_AAD_loop2_done\num_initial_blocks\operation
13148
13149 - mov $16, %r12
13150 + mov $16, %r15
13151 _get_AAD_loop2\num_initial_blocks\operation:
13152 psrldq $4, %xmm\i
13153 - sub $4, %r12
13154 - cmp %r11, %r12
13155 + sub $4, %r15
13156 + cmp %r11, %r15
13157 jne _get_AAD_loop2\num_initial_blocks\operation
13158
13159 _get_AAD_loop2_done\num_initial_blocks\operation:
13160 @@ -442,7 +443,7 @@ _initial_blocks_done\num_initial_blocks\operation:
13161 * num_initial_blocks = b mod 4
13162 * encrypt the initial num_initial_blocks blocks and apply ghash on
13163 * the ciphertext
13164 -* %r10, %r11, %r12, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13165 +* %r10, %r11, %r15, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13166 * are clobbered
13167 * arg1, %arg2, %arg3, %r14 are used as a pointer only, not modified
13168 */
13169 @@ -452,8 +453,8 @@ _initial_blocks_done\num_initial_blocks\operation:
13170 XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
13171 MOVADQ SHUF_MASK(%rip), %xmm14
13172 mov arg7, %r10 # %r10 = AAD
13173 - mov arg8, %r12 # %r12 = aadLen
13174 - mov %r12, %r11
13175 + mov arg8, %r15 # %r15 = aadLen
13176 + mov %r15, %r11
13177 pxor %xmm\i, %xmm\i
13178 _get_AAD_loop\num_initial_blocks\operation:
13179 movd (%r10), \TMP1
13180 @@ -461,15 +462,15 @@ _get_AAD_loop\num_initial_blocks\operation:
13181 psrldq $4, %xmm\i
13182 pxor \TMP1, %xmm\i
13183 add $4, %r10
13184 - sub $4, %r12
13185 + sub $4, %r15
13186 jne _get_AAD_loop\num_initial_blocks\operation
13187 cmp $16, %r11
13188 je _get_AAD_loop2_done\num_initial_blocks\operation
13189 - mov $16, %r12
13190 + mov $16, %r15
13191 _get_AAD_loop2\num_initial_blocks\operation:
13192 psrldq $4, %xmm\i
13193 - sub $4, %r12
13194 - cmp %r11, %r12
13195 + sub $4, %r15
13196 + cmp %r11, %r15
13197 jne _get_AAD_loop2\num_initial_blocks\operation
13198 _get_AAD_loop2_done\num_initial_blocks\operation:
13199 PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
13200 @@ -1280,7 +1281,7 @@ _esb_loop_\@:
13201 *
13202 *****************************************************************************/
13203 ENTRY(aesni_gcm_dec)
13204 - push %r12
13205 + push %r15
13206 push %r13
13207 push %r14
13208 mov %rsp, %r14
13209 @@ -1290,8 +1291,8 @@ ENTRY(aesni_gcm_dec)
13210 */
13211 sub $VARIABLE_OFFSET, %rsp
13212 and $~63, %rsp # align rsp to 64 bytes
13213 - mov %arg6, %r12
13214 - movdqu (%r12), %xmm13 # %xmm13 = HashKey
13215 + mov %arg6, %r15
13216 + movdqu (%r15), %xmm13 # %xmm13 = HashKey
13217 movdqa SHUF_MASK(%rip), %xmm2
13218 PSHUFB_XMM %xmm2, %xmm13
13219
13220 @@ -1319,10 +1320,10 @@ ENTRY(aesni_gcm_dec)
13221 movdqa %xmm13, HashKey(%rsp) # store HashKey<<1 (mod poly)
13222 mov %arg4, %r13 # save the number of bytes of plaintext/ciphertext
13223 and $-16, %r13 # %r13 = %r13 - (%r13 mod 16)
13224 - mov %r13, %r12
13225 - and $(3<<4), %r12
13226 + mov %r13, %r15
13227 + and $(3<<4), %r15
13228 jz _initial_num_blocks_is_0_decrypt
13229 - cmp $(2<<4), %r12
13230 + cmp $(2<<4), %r15
13231 jb _initial_num_blocks_is_1_decrypt
13232 je _initial_num_blocks_is_2_decrypt
13233 _initial_num_blocks_is_3_decrypt:
13234 @@ -1372,16 +1373,16 @@ _zero_cipher_left_decrypt:
13235 sub $16, %r11
13236 add %r13, %r11
13237 movdqu (%arg3,%r11,1), %xmm1 # receive the last <16 byte block
13238 - lea SHIFT_MASK+16(%rip), %r12
13239 - sub %r13, %r12
13240 + lea SHIFT_MASK+16(%rip), %r15
13241 + sub %r13, %r15
13242 # adjust the shuffle mask pointer to be able to shift 16-%r13 bytes
13243 # (%r13 is the number of bytes in plaintext mod 16)
13244 - movdqu (%r12), %xmm2 # get the appropriate shuffle mask
13245 + movdqu (%r15), %xmm2 # get the appropriate shuffle mask
13246 PSHUFB_XMM %xmm2, %xmm1 # right shift 16-%r13 butes
13247
13248 movdqa %xmm1, %xmm2
13249 pxor %xmm1, %xmm0 # Ciphertext XOR E(K, Yn)
13250 - movdqu ALL_F-SHIFT_MASK(%r12), %xmm1
13251 + movdqu ALL_F-SHIFT_MASK(%r15), %xmm1
13252 # get the appropriate mask to mask out top 16-%r13 bytes of %xmm0
13253 pand %xmm1, %xmm0 # mask out top 16-%r13 bytes of %xmm0
13254 pand %xmm1, %xmm2
13255 @@ -1410,9 +1411,9 @@ _less_than_8_bytes_left_decrypt:
13256 sub $1, %r13
13257 jne _less_than_8_bytes_left_decrypt
13258 _multiple_of_16_bytes_decrypt:
13259 - mov arg8, %r12 # %r13 = aadLen (number of bytes)
13260 - shl $3, %r12 # convert into number of bits
13261 - movd %r12d, %xmm15 # len(A) in %xmm15
13262 + mov arg8, %r15 # %r13 = aadLen (number of bytes)
13263 + shl $3, %r15 # convert into number of bits
13264 + movd %r15d, %xmm15 # len(A) in %xmm15
13265 shl $3, %arg4 # len(C) in bits (*128)
13266 MOVQ_R64_XMM %arg4, %xmm1
13267 pslldq $8, %xmm15 # %xmm15 = len(A)||0x0000000000000000
13268 @@ -1451,7 +1452,8 @@ _return_T_done_decrypt:
13269 mov %r14, %rsp
13270 pop %r14
13271 pop %r13
13272 - pop %r12
13273 + pop %r15
13274 + pax_force_retaddr
13275 ret
13276 ENDPROC(aesni_gcm_dec)
13277
13278 @@ -1540,7 +1542,7 @@ ENDPROC(aesni_gcm_dec)
13279 * poly = x^128 + x^127 + x^126 + x^121 + 1
13280 ***************************************************************************/
13281 ENTRY(aesni_gcm_enc)
13282 - push %r12
13283 + push %r15
13284 push %r13
13285 push %r14
13286 mov %rsp, %r14
13287 @@ -1550,8 +1552,8 @@ ENTRY(aesni_gcm_enc)
13288 #
13289 sub $VARIABLE_OFFSET, %rsp
13290 and $~63, %rsp
13291 - mov %arg6, %r12
13292 - movdqu (%r12), %xmm13
13293 + mov %arg6, %r15
13294 + movdqu (%r15), %xmm13
13295 movdqa SHUF_MASK(%rip), %xmm2
13296 PSHUFB_XMM %xmm2, %xmm13
13297
13298 @@ -1575,13 +1577,13 @@ ENTRY(aesni_gcm_enc)
13299 movdqa %xmm13, HashKey(%rsp)
13300 mov %arg4, %r13 # %xmm13 holds HashKey<<1 (mod poly)
13301 and $-16, %r13
13302 - mov %r13, %r12
13303 + mov %r13, %r15
13304
13305 # Encrypt first few blocks
13306
13307 - and $(3<<4), %r12
13308 + and $(3<<4), %r15
13309 jz _initial_num_blocks_is_0_encrypt
13310 - cmp $(2<<4), %r12
13311 + cmp $(2<<4), %r15
13312 jb _initial_num_blocks_is_1_encrypt
13313 je _initial_num_blocks_is_2_encrypt
13314 _initial_num_blocks_is_3_encrypt:
13315 @@ -1634,14 +1636,14 @@ _zero_cipher_left_encrypt:
13316 sub $16, %r11
13317 add %r13, %r11
13318 movdqu (%arg3,%r11,1), %xmm1 # receive the last <16 byte blocks
13319 - lea SHIFT_MASK+16(%rip), %r12
13320 - sub %r13, %r12
13321 + lea SHIFT_MASK+16(%rip), %r15
13322 + sub %r13, %r15
13323 # adjust the shuffle mask pointer to be able to shift 16-r13 bytes
13324 # (%r13 is the number of bytes in plaintext mod 16)
13325 - movdqu (%r12), %xmm2 # get the appropriate shuffle mask
13326 + movdqu (%r15), %xmm2 # get the appropriate shuffle mask
13327 PSHUFB_XMM %xmm2, %xmm1 # shift right 16-r13 byte
13328 pxor %xmm1, %xmm0 # Plaintext XOR Encrypt(K, Yn)
13329 - movdqu ALL_F-SHIFT_MASK(%r12), %xmm1
13330 + movdqu ALL_F-SHIFT_MASK(%r15), %xmm1
13331 # get the appropriate mask to mask out top 16-r13 bytes of xmm0
13332 pand %xmm1, %xmm0 # mask out top 16-r13 bytes of xmm0
13333 movdqa SHUF_MASK(%rip), %xmm10
13334 @@ -1674,9 +1676,9 @@ _less_than_8_bytes_left_encrypt:
13335 sub $1, %r13
13336 jne _less_than_8_bytes_left_encrypt
13337 _multiple_of_16_bytes_encrypt:
13338 - mov arg8, %r12 # %r12 = addLen (number of bytes)
13339 - shl $3, %r12
13340 - movd %r12d, %xmm15 # len(A) in %xmm15
13341 + mov arg8, %r15 # %r15 = addLen (number of bytes)
13342 + shl $3, %r15
13343 + movd %r15d, %xmm15 # len(A) in %xmm15
13344 shl $3, %arg4 # len(C) in bits (*128)
13345 MOVQ_R64_XMM %arg4, %xmm1
13346 pslldq $8, %xmm15 # %xmm15 = len(A)||0x0000000000000000
13347 @@ -1715,7 +1717,8 @@ _return_T_done_encrypt:
13348 mov %r14, %rsp
13349 pop %r14
13350 pop %r13
13351 - pop %r12
13352 + pop %r15
13353 + pax_force_retaddr
13354 ret
13355 ENDPROC(aesni_gcm_enc)
13356
13357 @@ -1733,6 +1736,7 @@ _key_expansion_256a:
13358 pxor %xmm1, %xmm0
13359 movaps %xmm0, (TKEYP)
13360 add $0x10, TKEYP
13361 + pax_force_retaddr
13362 ret
13363 ENDPROC(_key_expansion_128)
13364 ENDPROC(_key_expansion_256a)
13365 @@ -1759,6 +1763,7 @@ _key_expansion_192a:
13366 shufps $0b01001110, %xmm2, %xmm1
13367 movaps %xmm1, 0x10(TKEYP)
13368 add $0x20, TKEYP
13369 + pax_force_retaddr
13370 ret
13371 ENDPROC(_key_expansion_192a)
13372
13373 @@ -1779,6 +1784,7 @@ _key_expansion_192b:
13374
13375 movaps %xmm0, (TKEYP)
13376 add $0x10, TKEYP
13377 + pax_force_retaddr
13378 ret
13379 ENDPROC(_key_expansion_192b)
13380
13381 @@ -1792,6 +1798,7 @@ _key_expansion_256b:
13382 pxor %xmm1, %xmm2
13383 movaps %xmm2, (TKEYP)
13384 add $0x10, TKEYP
13385 + pax_force_retaddr
13386 ret
13387 ENDPROC(_key_expansion_256b)
13388
13389 @@ -1905,6 +1912,7 @@ ENTRY(aesni_set_key)
13390 #ifndef __x86_64__
13391 popl KEYP
13392 #endif
13393 + pax_force_retaddr
13394 ret
13395 ENDPROC(aesni_set_key)
13396
13397 @@ -1927,6 +1935,7 @@ ENTRY(aesni_enc)
13398 popl KLEN
13399 popl KEYP
13400 #endif
13401 + pax_force_retaddr
13402 ret
13403 ENDPROC(aesni_enc)
13404
13405 @@ -1985,6 +1994,7 @@ _aesni_enc1:
13406 AESENC KEY STATE
13407 movaps 0x70(TKEYP), KEY
13408 AESENCLAST KEY STATE
13409 + pax_force_retaddr
13410 ret
13411 ENDPROC(_aesni_enc1)
13412
13413 @@ -2094,6 +2104,7 @@ _aesni_enc4:
13414 AESENCLAST KEY STATE2
13415 AESENCLAST KEY STATE3
13416 AESENCLAST KEY STATE4
13417 + pax_force_retaddr
13418 ret
13419 ENDPROC(_aesni_enc4)
13420
13421 @@ -2117,6 +2128,7 @@ ENTRY(aesni_dec)
13422 popl KLEN
13423 popl KEYP
13424 #endif
13425 + pax_force_retaddr
13426 ret
13427 ENDPROC(aesni_dec)
13428
13429 @@ -2175,6 +2187,7 @@ _aesni_dec1:
13430 AESDEC KEY STATE
13431 movaps 0x70(TKEYP), KEY
13432 AESDECLAST KEY STATE
13433 + pax_force_retaddr
13434 ret
13435 ENDPROC(_aesni_dec1)
13436
13437 @@ -2284,6 +2297,7 @@ _aesni_dec4:
13438 AESDECLAST KEY STATE2
13439 AESDECLAST KEY STATE3
13440 AESDECLAST KEY STATE4
13441 + pax_force_retaddr
13442 ret
13443 ENDPROC(_aesni_dec4)
13444
13445 @@ -2342,6 +2356,7 @@ ENTRY(aesni_ecb_enc)
13446 popl KEYP
13447 popl LEN
13448 #endif
13449 + pax_force_retaddr
13450 ret
13451 ENDPROC(aesni_ecb_enc)
13452
13453 @@ -2401,6 +2416,7 @@ ENTRY(aesni_ecb_dec)
13454 popl KEYP
13455 popl LEN
13456 #endif
13457 + pax_force_retaddr
13458 ret
13459 ENDPROC(aesni_ecb_dec)
13460
13461 @@ -2443,6 +2459,7 @@ ENTRY(aesni_cbc_enc)
13462 popl LEN
13463 popl IVP
13464 #endif
13465 + pax_force_retaddr
13466 ret
13467 ENDPROC(aesni_cbc_enc)
13468
13469 @@ -2534,6 +2551,7 @@ ENTRY(aesni_cbc_dec)
13470 popl LEN
13471 popl IVP
13472 #endif
13473 + pax_force_retaddr
13474 ret
13475 ENDPROC(aesni_cbc_dec)
13476
13477 @@ -2561,6 +2579,7 @@ _aesni_inc_init:
13478 mov $1, TCTR_LOW
13479 MOVQ_R64_XMM TCTR_LOW INC
13480 MOVQ_R64_XMM CTR TCTR_LOW
13481 + pax_force_retaddr
13482 ret
13483 ENDPROC(_aesni_inc_init)
13484
13485 @@ -2590,6 +2609,7 @@ _aesni_inc:
13486 .Linc_low:
13487 movaps CTR, IV
13488 PSHUFB_XMM BSWAP_MASK IV
13489 + pax_force_retaddr
13490 ret
13491 ENDPROC(_aesni_inc)
13492
13493 @@ -2651,6 +2671,7 @@ ENTRY(aesni_ctr_enc)
13494 .Lctr_enc_ret:
13495 movups IV, (IVP)
13496 .Lctr_enc_just_ret:
13497 + pax_force_retaddr
13498 ret
13499 ENDPROC(aesni_ctr_enc)
13500
13501 @@ -2777,6 +2798,7 @@ ENTRY(aesni_xts_crypt8)
13502 pxor INC, STATE4
13503 movdqu STATE4, 0x70(OUTP)
13504
13505 + pax_force_retaddr
13506 ret
13507 ENDPROC(aesni_xts_crypt8)
13508
13509 diff --git a/arch/x86/crypto/blowfish-x86_64-asm_64.S b/arch/x86/crypto/blowfish-x86_64-asm_64.S
13510 index 246c670..466e2d6 100644
13511 --- a/arch/x86/crypto/blowfish-x86_64-asm_64.S
13512 +++ b/arch/x86/crypto/blowfish-x86_64-asm_64.S
13513 @@ -21,6 +21,7 @@
13514 */
13515
13516 #include <linux/linkage.h>
13517 +#include <asm/alternative-asm.h>
13518
13519 .file "blowfish-x86_64-asm.S"
13520 .text
13521 @@ -149,9 +150,11 @@ ENTRY(__blowfish_enc_blk)
13522 jnz .L__enc_xor;
13523
13524 write_block();
13525 + pax_force_retaddr
13526 ret;
13527 .L__enc_xor:
13528 xor_block();
13529 + pax_force_retaddr
13530 ret;
13531 ENDPROC(__blowfish_enc_blk)
13532
13533 @@ -183,6 +186,7 @@ ENTRY(blowfish_dec_blk)
13534
13535 movq %r11, %rbp;
13536
13537 + pax_force_retaddr
13538 ret;
13539 ENDPROC(blowfish_dec_blk)
13540
13541 @@ -334,6 +338,7 @@ ENTRY(__blowfish_enc_blk_4way)
13542
13543 popq %rbx;
13544 popq %rbp;
13545 + pax_force_retaddr
13546 ret;
13547
13548 .L__enc_xor4:
13549 @@ -341,6 +346,7 @@ ENTRY(__blowfish_enc_blk_4way)
13550
13551 popq %rbx;
13552 popq %rbp;
13553 + pax_force_retaddr
13554 ret;
13555 ENDPROC(__blowfish_enc_blk_4way)
13556
13557 @@ -375,5 +381,6 @@ ENTRY(blowfish_dec_blk_4way)
13558 popq %rbx;
13559 popq %rbp;
13560
13561 + pax_force_retaddr
13562 ret;
13563 ENDPROC(blowfish_dec_blk_4way)
13564 diff --git a/arch/x86/crypto/camellia-aesni-avx-asm_64.S b/arch/x86/crypto/camellia-aesni-avx-asm_64.S
13565 index ce71f92..1dce7ec 100644
13566 --- a/arch/x86/crypto/camellia-aesni-avx-asm_64.S
13567 +++ b/arch/x86/crypto/camellia-aesni-avx-asm_64.S
13568 @@ -16,6 +16,7 @@
13569 */
13570
13571 #include <linux/linkage.h>
13572 +#include <asm/alternative-asm.h>
13573
13574 #define CAMELLIA_TABLE_BYTE_LEN 272
13575
13576 @@ -191,6 +192,7 @@ roundsm16_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd:
13577 roundsm16(%xmm0, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
13578 %xmm8, %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14, %xmm15,
13579 %rcx, (%r9));
13580 + pax_force_retaddr
13581 ret;
13582 ENDPROC(roundsm16_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd)
13583
13584 @@ -199,6 +201,7 @@ roundsm16_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab:
13585 roundsm16(%xmm4, %xmm5, %xmm6, %xmm7, %xmm0, %xmm1, %xmm2, %xmm3,
13586 %xmm12, %xmm13, %xmm14, %xmm15, %xmm8, %xmm9, %xmm10, %xmm11,
13587 %rax, (%r9));
13588 + pax_force_retaddr
13589 ret;
13590 ENDPROC(roundsm16_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab)
13591
13592 @@ -780,6 +783,7 @@ __camellia_enc_blk16:
13593 %xmm8, %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14,
13594 %xmm15, (key_table)(CTX, %r8, 8), (%rax), 1 * 16(%rax));
13595
13596 + pax_force_retaddr
13597 ret;
13598
13599 .align 8
13600 @@ -865,6 +869,7 @@ __camellia_dec_blk16:
13601 %xmm8, %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14,
13602 %xmm15, (key_table)(CTX), (%rax), 1 * 16(%rax));
13603
13604 + pax_force_retaddr
13605 ret;
13606
13607 .align 8
13608 @@ -904,6 +909,7 @@ ENTRY(camellia_ecb_enc_16way)
13609 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13610 %xmm8, %rsi);
13611
13612 + pax_force_retaddr
13613 ret;
13614 ENDPROC(camellia_ecb_enc_16way)
13615
13616 @@ -932,6 +938,7 @@ ENTRY(camellia_ecb_dec_16way)
13617 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13618 %xmm8, %rsi);
13619
13620 + pax_force_retaddr
13621 ret;
13622 ENDPROC(camellia_ecb_dec_16way)
13623
13624 @@ -981,6 +988,7 @@ ENTRY(camellia_cbc_dec_16way)
13625 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13626 %xmm8, %rsi);
13627
13628 + pax_force_retaddr
13629 ret;
13630 ENDPROC(camellia_cbc_dec_16way)
13631
13632 @@ -1092,6 +1100,7 @@ ENTRY(camellia_ctr_16way)
13633 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13634 %xmm8, %rsi);
13635
13636 + pax_force_retaddr
13637 ret;
13638 ENDPROC(camellia_ctr_16way)
13639
13640 @@ -1234,6 +1243,7 @@ camellia_xts_crypt_16way:
13641 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13642 %xmm8, %rsi);
13643
13644 + pax_force_retaddr
13645 ret;
13646 ENDPROC(camellia_xts_crypt_16way)
13647
13648 diff --git a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
13649 index 0e0b886..5a3123c 100644
13650 --- a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
13651 +++ b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
13652 @@ -11,6 +11,7 @@
13653 */
13654
13655 #include <linux/linkage.h>
13656 +#include <asm/alternative-asm.h>
13657
13658 #define CAMELLIA_TABLE_BYTE_LEN 272
13659
13660 @@ -230,6 +231,7 @@ roundsm32_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd:
13661 roundsm32(%ymm0, %ymm1, %ymm2, %ymm3, %ymm4, %ymm5, %ymm6, %ymm7,
13662 %ymm8, %ymm9, %ymm10, %ymm11, %ymm12, %ymm13, %ymm14, %ymm15,
13663 %rcx, (%r9));
13664 + pax_force_retaddr
13665 ret;
13666 ENDPROC(roundsm32_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd)
13667
13668 @@ -238,6 +240,7 @@ roundsm32_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab:
13669 roundsm32(%ymm4, %ymm5, %ymm6, %ymm7, %ymm0, %ymm1, %ymm2, %ymm3,
13670 %ymm12, %ymm13, %ymm14, %ymm15, %ymm8, %ymm9, %ymm10, %ymm11,
13671 %rax, (%r9));
13672 + pax_force_retaddr
13673 ret;
13674 ENDPROC(roundsm32_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab)
13675
13676 @@ -820,6 +823,7 @@ __camellia_enc_blk32:
13677 %ymm8, %ymm9, %ymm10, %ymm11, %ymm12, %ymm13, %ymm14,
13678 %ymm15, (key_table)(CTX, %r8, 8), (%rax), 1 * 32(%rax));
13679
13680 + pax_force_retaddr
13681 ret;
13682
13683 .align 8
13684 @@ -905,6 +909,7 @@ __camellia_dec_blk32:
13685 %ymm8, %ymm9, %ymm10, %ymm11, %ymm12, %ymm13, %ymm14,
13686 %ymm15, (key_table)(CTX), (%rax), 1 * 32(%rax));
13687
13688 + pax_force_retaddr
13689 ret;
13690
13691 .align 8
13692 @@ -948,6 +953,7 @@ ENTRY(camellia_ecb_enc_32way)
13693
13694 vzeroupper;
13695
13696 + pax_force_retaddr
13697 ret;
13698 ENDPROC(camellia_ecb_enc_32way)
13699
13700 @@ -980,6 +986,7 @@ ENTRY(camellia_ecb_dec_32way)
13701
13702 vzeroupper;
13703
13704 + pax_force_retaddr
13705 ret;
13706 ENDPROC(camellia_ecb_dec_32way)
13707
13708 @@ -1046,6 +1053,7 @@ ENTRY(camellia_cbc_dec_32way)
13709
13710 vzeroupper;
13711
13712 + pax_force_retaddr
13713 ret;
13714 ENDPROC(camellia_cbc_dec_32way)
13715
13716 @@ -1184,6 +1192,7 @@ ENTRY(camellia_ctr_32way)
13717
13718 vzeroupper;
13719
13720 + pax_force_retaddr
13721 ret;
13722 ENDPROC(camellia_ctr_32way)
13723
13724 @@ -1349,6 +1358,7 @@ camellia_xts_crypt_32way:
13725
13726 vzeroupper;
13727
13728 + pax_force_retaddr
13729 ret;
13730 ENDPROC(camellia_xts_crypt_32way)
13731
13732 diff --git a/arch/x86/crypto/camellia-x86_64-asm_64.S b/arch/x86/crypto/camellia-x86_64-asm_64.S
13733 index 310319c..db3d7b5 100644
13734 --- a/arch/x86/crypto/camellia-x86_64-asm_64.S
13735 +++ b/arch/x86/crypto/camellia-x86_64-asm_64.S
13736 @@ -21,6 +21,7 @@
13737 */
13738
13739 #include <linux/linkage.h>
13740 +#include <asm/alternative-asm.h>
13741
13742 .file "camellia-x86_64-asm_64.S"
13743 .text
13744 @@ -228,12 +229,14 @@ ENTRY(__camellia_enc_blk)
13745 enc_outunpack(mov, RT1);
13746
13747 movq RRBP, %rbp;
13748 + pax_force_retaddr
13749 ret;
13750
13751 .L__enc_xor:
13752 enc_outunpack(xor, RT1);
13753
13754 movq RRBP, %rbp;
13755 + pax_force_retaddr
13756 ret;
13757 ENDPROC(__camellia_enc_blk)
13758
13759 @@ -272,6 +275,7 @@ ENTRY(camellia_dec_blk)
13760 dec_outunpack();
13761
13762 movq RRBP, %rbp;
13763 + pax_force_retaddr
13764 ret;
13765 ENDPROC(camellia_dec_blk)
13766
13767 @@ -463,6 +467,7 @@ ENTRY(__camellia_enc_blk_2way)
13768
13769 movq RRBP, %rbp;
13770 popq %rbx;
13771 + pax_force_retaddr
13772 ret;
13773
13774 .L__enc2_xor:
13775 @@ -470,6 +475,7 @@ ENTRY(__camellia_enc_blk_2way)
13776
13777 movq RRBP, %rbp;
13778 popq %rbx;
13779 + pax_force_retaddr
13780 ret;
13781 ENDPROC(__camellia_enc_blk_2way)
13782
13783 @@ -510,5 +516,6 @@ ENTRY(camellia_dec_blk_2way)
13784
13785 movq RRBP, %rbp;
13786 movq RXOR, %rbx;
13787 + pax_force_retaddr
13788 ret;
13789 ENDPROC(camellia_dec_blk_2way)
13790 diff --git a/arch/x86/crypto/cast5-avx-x86_64-asm_64.S b/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
13791 index c35fd5d..2d8c7db 100644
13792 --- a/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
13793 +++ b/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
13794 @@ -24,6 +24,7 @@
13795 */
13796
13797 #include <linux/linkage.h>
13798 +#include <asm/alternative-asm.h>
13799
13800 .file "cast5-avx-x86_64-asm_64.S"
13801
13802 @@ -281,6 +282,7 @@ __cast5_enc_blk16:
13803 outunpack_blocks(RR3, RL3, RTMP, RX, RKM);
13804 outunpack_blocks(RR4, RL4, RTMP, RX, RKM);
13805
13806 + pax_force_retaddr
13807 ret;
13808 ENDPROC(__cast5_enc_blk16)
13809
13810 @@ -352,6 +354,7 @@ __cast5_dec_blk16:
13811 outunpack_blocks(RR3, RL3, RTMP, RX, RKM);
13812 outunpack_blocks(RR4, RL4, RTMP, RX, RKM);
13813
13814 + pax_force_retaddr
13815 ret;
13816
13817 .L__skip_dec:
13818 @@ -388,6 +391,7 @@ ENTRY(cast5_ecb_enc_16way)
13819 vmovdqu RR4, (6*4*4)(%r11);
13820 vmovdqu RL4, (7*4*4)(%r11);
13821
13822 + pax_force_retaddr
13823 ret;
13824 ENDPROC(cast5_ecb_enc_16way)
13825
13826 @@ -420,6 +424,7 @@ ENTRY(cast5_ecb_dec_16way)
13827 vmovdqu RR4, (6*4*4)(%r11);
13828 vmovdqu RL4, (7*4*4)(%r11);
13829
13830 + pax_force_retaddr
13831 ret;
13832 ENDPROC(cast5_ecb_dec_16way)
13833
13834 @@ -430,10 +435,10 @@ ENTRY(cast5_cbc_dec_16way)
13835 * %rdx: src
13836 */
13837
13838 - pushq %r12;
13839 + pushq %r14;
13840
13841 movq %rsi, %r11;
13842 - movq %rdx, %r12;
13843 + movq %rdx, %r14;
13844
13845 vmovdqu (0*16)(%rdx), RL1;
13846 vmovdqu (1*16)(%rdx), RR1;
13847 @@ -447,16 +452,16 @@ ENTRY(cast5_cbc_dec_16way)
13848 call __cast5_dec_blk16;
13849
13850 /* xor with src */
13851 - vmovq (%r12), RX;
13852 + vmovq (%r14), RX;
13853 vpshufd $0x4f, RX, RX;
13854 vpxor RX, RR1, RR1;
13855 - vpxor 0*16+8(%r12), RL1, RL1;
13856 - vpxor 1*16+8(%r12), RR2, RR2;
13857 - vpxor 2*16+8(%r12), RL2, RL2;
13858 - vpxor 3*16+8(%r12), RR3, RR3;
13859 - vpxor 4*16+8(%r12), RL3, RL3;
13860 - vpxor 5*16+8(%r12), RR4, RR4;
13861 - vpxor 6*16+8(%r12), RL4, RL4;
13862 + vpxor 0*16+8(%r14), RL1, RL1;
13863 + vpxor 1*16+8(%r14), RR2, RR2;
13864 + vpxor 2*16+8(%r14), RL2, RL2;
13865 + vpxor 3*16+8(%r14), RR3, RR3;
13866 + vpxor 4*16+8(%r14), RL3, RL3;
13867 + vpxor 5*16+8(%r14), RR4, RR4;
13868 + vpxor 6*16+8(%r14), RL4, RL4;
13869
13870 vmovdqu RR1, (0*16)(%r11);
13871 vmovdqu RL1, (1*16)(%r11);
13872 @@ -467,8 +472,9 @@ ENTRY(cast5_cbc_dec_16way)
13873 vmovdqu RR4, (6*16)(%r11);
13874 vmovdqu RL4, (7*16)(%r11);
13875
13876 - popq %r12;
13877 + popq %r14;
13878
13879 + pax_force_retaddr
13880 ret;
13881 ENDPROC(cast5_cbc_dec_16way)
13882
13883 @@ -480,10 +486,10 @@ ENTRY(cast5_ctr_16way)
13884 * %rcx: iv (big endian, 64bit)
13885 */
13886
13887 - pushq %r12;
13888 + pushq %r14;
13889
13890 movq %rsi, %r11;
13891 - movq %rdx, %r12;
13892 + movq %rdx, %r14;
13893
13894 vpcmpeqd RTMP, RTMP, RTMP;
13895 vpsrldq $8, RTMP, RTMP; /* low: -1, high: 0 */
13896 @@ -523,14 +529,14 @@ ENTRY(cast5_ctr_16way)
13897 call __cast5_enc_blk16;
13898
13899 /* dst = src ^ iv */
13900 - vpxor (0*16)(%r12), RR1, RR1;
13901 - vpxor (1*16)(%r12), RL1, RL1;
13902 - vpxor (2*16)(%r12), RR2, RR2;
13903 - vpxor (3*16)(%r12), RL2, RL2;
13904 - vpxor (4*16)(%r12), RR3, RR3;
13905 - vpxor (5*16)(%r12), RL3, RL3;
13906 - vpxor (6*16)(%r12), RR4, RR4;
13907 - vpxor (7*16)(%r12), RL4, RL4;
13908 + vpxor (0*16)(%r14), RR1, RR1;
13909 + vpxor (1*16)(%r14), RL1, RL1;
13910 + vpxor (2*16)(%r14), RR2, RR2;
13911 + vpxor (3*16)(%r14), RL2, RL2;
13912 + vpxor (4*16)(%r14), RR3, RR3;
13913 + vpxor (5*16)(%r14), RL3, RL3;
13914 + vpxor (6*16)(%r14), RR4, RR4;
13915 + vpxor (7*16)(%r14), RL4, RL4;
13916 vmovdqu RR1, (0*16)(%r11);
13917 vmovdqu RL1, (1*16)(%r11);
13918 vmovdqu RR2, (2*16)(%r11);
13919 @@ -540,7 +546,8 @@ ENTRY(cast5_ctr_16way)
13920 vmovdqu RR4, (6*16)(%r11);
13921 vmovdqu RL4, (7*16)(%r11);
13922
13923 - popq %r12;
13924 + popq %r14;
13925
13926 + pax_force_retaddr
13927 ret;
13928 ENDPROC(cast5_ctr_16way)
13929 diff --git a/arch/x86/crypto/cast6-avx-x86_64-asm_64.S b/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
13930 index e3531f8..e123f35 100644
13931 --- a/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
13932 +++ b/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
13933 @@ -24,6 +24,7 @@
13934 */
13935
13936 #include <linux/linkage.h>
13937 +#include <asm/alternative-asm.h>
13938 #include "glue_helper-asm-avx.S"
13939
13940 .file "cast6-avx-x86_64-asm_64.S"
13941 @@ -295,6 +296,7 @@ __cast6_enc_blk8:
13942 outunpack_blocks(RA1, RB1, RC1, RD1, RTMP, RX, RKRF, RKM);
13943 outunpack_blocks(RA2, RB2, RC2, RD2, RTMP, RX, RKRF, RKM);
13944
13945 + pax_force_retaddr
13946 ret;
13947 ENDPROC(__cast6_enc_blk8)
13948
13949 @@ -340,6 +342,7 @@ __cast6_dec_blk8:
13950 outunpack_blocks(RA1, RB1, RC1, RD1, RTMP, RX, RKRF, RKM);
13951 outunpack_blocks(RA2, RB2, RC2, RD2, RTMP, RX, RKRF, RKM);
13952
13953 + pax_force_retaddr
13954 ret;
13955 ENDPROC(__cast6_dec_blk8)
13956
13957 @@ -358,6 +361,7 @@ ENTRY(cast6_ecb_enc_8way)
13958
13959 store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13960
13961 + pax_force_retaddr
13962 ret;
13963 ENDPROC(cast6_ecb_enc_8way)
13964
13965 @@ -376,6 +380,7 @@ ENTRY(cast6_ecb_dec_8way)
13966
13967 store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13968
13969 + pax_force_retaddr
13970 ret;
13971 ENDPROC(cast6_ecb_dec_8way)
13972
13973 @@ -386,19 +391,20 @@ ENTRY(cast6_cbc_dec_8way)
13974 * %rdx: src
13975 */
13976
13977 - pushq %r12;
13978 + pushq %r14;
13979
13980 movq %rsi, %r11;
13981 - movq %rdx, %r12;
13982 + movq %rdx, %r14;
13983
13984 load_8way(%rdx, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13985
13986 call __cast6_dec_blk8;
13987
13988 - store_cbc_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13989 + store_cbc_8way(%r14, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13990
13991 - popq %r12;
13992 + popq %r14;
13993
13994 + pax_force_retaddr
13995 ret;
13996 ENDPROC(cast6_cbc_dec_8way)
13997
13998 @@ -410,20 +416,21 @@ ENTRY(cast6_ctr_8way)
13999 * %rcx: iv (little endian, 128bit)
14000 */
14001
14002 - pushq %r12;
14003 + pushq %r14;
14004
14005 movq %rsi, %r11;
14006 - movq %rdx, %r12;
14007 + movq %rdx, %r14;
14008
14009 load_ctr_8way(%rcx, .Lbswap128_mask, RA1, RB1, RC1, RD1, RA2, RB2, RC2,
14010 RD2, RX, RKR, RKM);
14011
14012 call __cast6_enc_blk8;
14013
14014 - store_ctr_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14015 + store_ctr_8way(%r14, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14016
14017 - popq %r12;
14018 + popq %r14;
14019
14020 + pax_force_retaddr
14021 ret;
14022 ENDPROC(cast6_ctr_8way)
14023
14024 @@ -446,6 +453,7 @@ ENTRY(cast6_xts_enc_8way)
14025 /* dst <= regs xor IVs(in dst) */
14026 store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14027
14028 + pax_force_retaddr
14029 ret;
14030 ENDPROC(cast6_xts_enc_8way)
14031
14032 @@ -468,5 +476,6 @@ ENTRY(cast6_xts_dec_8way)
14033 /* dst <= regs xor IVs(in dst) */
14034 store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14035
14036 + pax_force_retaddr
14037 ret;
14038 ENDPROC(cast6_xts_dec_8way)
14039 diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
14040 index 225be06..2885e731 100644
14041 --- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
14042 +++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
14043 @@ -45,6 +45,7 @@
14044
14045 #include <asm/inst.h>
14046 #include <linux/linkage.h>
14047 +#include <asm/alternative-asm.h>
14048
14049 ## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction
14050
14051 @@ -309,6 +310,7 @@ do_return:
14052 popq %rsi
14053 popq %rdi
14054 popq %rbx
14055 + pax_force_retaddr
14056 ret
14057
14058 ################################################################
14059 @@ -330,7 +332,7 @@ ENDPROC(crc_pcl)
14060 ## PCLMULQDQ tables
14061 ## Table is 128 entries x 2 words (8 bytes) each
14062 ################################################################
14063 -.section .rotata, "a", %progbits
14064 +.section .rodata, "a", %progbits
14065 .align 8
14066 K_table:
14067 .long 0x493c7d27, 0x00000001
14068 diff --git a/arch/x86/crypto/ghash-clmulni-intel_asm.S b/arch/x86/crypto/ghash-clmulni-intel_asm.S
14069 index 5d1e007..098cb4f 100644
14070 --- a/arch/x86/crypto/ghash-clmulni-intel_asm.S
14071 +++ b/arch/x86/crypto/ghash-clmulni-intel_asm.S
14072 @@ -18,6 +18,7 @@
14073
14074 #include <linux/linkage.h>
14075 #include <asm/inst.h>
14076 +#include <asm/alternative-asm.h>
14077
14078 .data
14079
14080 @@ -89,6 +90,7 @@ __clmul_gf128mul_ble:
14081 psrlq $1, T2
14082 pxor T2, T1
14083 pxor T1, DATA
14084 + pax_force_retaddr
14085 ret
14086 ENDPROC(__clmul_gf128mul_ble)
14087
14088 @@ -101,6 +103,7 @@ ENTRY(clmul_ghash_mul)
14089 call __clmul_gf128mul_ble
14090 PSHUFB_XMM BSWAP DATA
14091 movups DATA, (%rdi)
14092 + pax_force_retaddr
14093 ret
14094 ENDPROC(clmul_ghash_mul)
14095
14096 @@ -128,5 +131,6 @@ ENTRY(clmul_ghash_update)
14097 PSHUFB_XMM BSWAP DATA
14098 movups DATA, (%rdi)
14099 .Lupdate_just_ret:
14100 + pax_force_retaddr
14101 ret
14102 ENDPROC(clmul_ghash_update)
14103 diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
14104 index 9279e0b..c4b3d2c 100644
14105 --- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
14106 +++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
14107 @@ -1,4 +1,5 @@
14108 #include <linux/linkage.h>
14109 +#include <asm/alternative-asm.h>
14110
14111 # enter salsa20_encrypt_bytes
14112 ENTRY(salsa20_encrypt_bytes)
14113 @@ -789,6 +790,7 @@ ENTRY(salsa20_encrypt_bytes)
14114 add %r11,%rsp
14115 mov %rdi,%rax
14116 mov %rsi,%rdx
14117 + pax_force_retaddr
14118 ret
14119 # bytesatleast65:
14120 ._bytesatleast65:
14121 @@ -889,6 +891,7 @@ ENTRY(salsa20_keysetup)
14122 add %r11,%rsp
14123 mov %rdi,%rax
14124 mov %rsi,%rdx
14125 + pax_force_retaddr
14126 ret
14127 ENDPROC(salsa20_keysetup)
14128
14129 @@ -914,5 +917,6 @@ ENTRY(salsa20_ivsetup)
14130 add %r11,%rsp
14131 mov %rdi,%rax
14132 mov %rsi,%rdx
14133 + pax_force_retaddr
14134 ret
14135 ENDPROC(salsa20_ivsetup)
14136 diff --git a/arch/x86/crypto/serpent-avx-x86_64-asm_64.S b/arch/x86/crypto/serpent-avx-x86_64-asm_64.S
14137 index 2f202f4..d9164d6 100644
14138 --- a/arch/x86/crypto/serpent-avx-x86_64-asm_64.S
14139 +++ b/arch/x86/crypto/serpent-avx-x86_64-asm_64.S
14140 @@ -24,6 +24,7 @@
14141 */
14142
14143 #include <linux/linkage.h>
14144 +#include <asm/alternative-asm.h>
14145 #include "glue_helper-asm-avx.S"
14146
14147 .file "serpent-avx-x86_64-asm_64.S"
14148 @@ -618,6 +619,7 @@ __serpent_enc_blk8_avx:
14149 write_blocks(RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14150 write_blocks(RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14151
14152 + pax_force_retaddr
14153 ret;
14154 ENDPROC(__serpent_enc_blk8_avx)
14155
14156 @@ -672,6 +674,7 @@ __serpent_dec_blk8_avx:
14157 write_blocks(RC1, RD1, RB1, RE1, RK0, RK1, RK2);
14158 write_blocks(RC2, RD2, RB2, RE2, RK0, RK1, RK2);
14159
14160 + pax_force_retaddr
14161 ret;
14162 ENDPROC(__serpent_dec_blk8_avx)
14163
14164 @@ -688,6 +691,7 @@ ENTRY(serpent_ecb_enc_8way_avx)
14165
14166 store_8way(%rsi, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14167
14168 + pax_force_retaddr
14169 ret;
14170 ENDPROC(serpent_ecb_enc_8way_avx)
14171
14172 @@ -704,6 +708,7 @@ ENTRY(serpent_ecb_dec_8way_avx)
14173
14174 store_8way(%rsi, RC1, RD1, RB1, RE1, RC2, RD2, RB2, RE2);
14175
14176 + pax_force_retaddr
14177 ret;
14178 ENDPROC(serpent_ecb_dec_8way_avx)
14179
14180 @@ -720,6 +725,7 @@ ENTRY(serpent_cbc_dec_8way_avx)
14181
14182 store_cbc_8way(%rdx, %rsi, RC1, RD1, RB1, RE1, RC2, RD2, RB2, RE2);
14183
14184 + pax_force_retaddr
14185 ret;
14186 ENDPROC(serpent_cbc_dec_8way_avx)
14187
14188 @@ -738,6 +744,7 @@ ENTRY(serpent_ctr_8way_avx)
14189
14190 store_ctr_8way(%rdx, %rsi, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14191
14192 + pax_force_retaddr
14193 ret;
14194 ENDPROC(serpent_ctr_8way_avx)
14195
14196 @@ -758,6 +765,7 @@ ENTRY(serpent_xts_enc_8way_avx)
14197 /* dst <= regs xor IVs(in dst) */
14198 store_xts_8way(%rsi, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14199
14200 + pax_force_retaddr
14201 ret;
14202 ENDPROC(serpent_xts_enc_8way_avx)
14203
14204 @@ -778,5 +786,6 @@ ENTRY(serpent_xts_dec_8way_avx)
14205 /* dst <= regs xor IVs(in dst) */
14206 store_xts_8way(%rsi, RC1, RD1, RB1, RE1, RC2, RD2, RB2, RE2);
14207
14208 + pax_force_retaddr
14209 ret;
14210 ENDPROC(serpent_xts_dec_8way_avx)
14211 diff --git a/arch/x86/crypto/serpent-avx2-asm_64.S b/arch/x86/crypto/serpent-avx2-asm_64.S
14212 index b222085..abd483c 100644
14213 --- a/arch/x86/crypto/serpent-avx2-asm_64.S
14214 +++ b/arch/x86/crypto/serpent-avx2-asm_64.S
14215 @@ -15,6 +15,7 @@
14216 */
14217
14218 #include <linux/linkage.h>
14219 +#include <asm/alternative-asm.h>
14220 #include "glue_helper-asm-avx2.S"
14221
14222 .file "serpent-avx2-asm_64.S"
14223 @@ -610,6 +611,7 @@ __serpent_enc_blk16:
14224 write_blocks(RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14225 write_blocks(RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14226
14227 + pax_force_retaddr
14228 ret;
14229 ENDPROC(__serpent_enc_blk16)
14230
14231 @@ -664,6 +666,7 @@ __serpent_dec_blk16:
14232 write_blocks(RC1, RD1, RB1, RE1, RK0, RK1, RK2);
14233 write_blocks(RC2, RD2, RB2, RE2, RK0, RK1, RK2);
14234
14235 + pax_force_retaddr
14236 ret;
14237 ENDPROC(__serpent_dec_blk16)
14238
14239 @@ -684,6 +687,7 @@ ENTRY(serpent_ecb_enc_16way)
14240
14241 vzeroupper;
14242
14243 + pax_force_retaddr
14244 ret;
14245 ENDPROC(serpent_ecb_enc_16way)
14246
14247 @@ -704,6 +708,7 @@ ENTRY(serpent_ecb_dec_16way)
14248
14249 vzeroupper;
14250
14251 + pax_force_retaddr
14252 ret;
14253 ENDPROC(serpent_ecb_dec_16way)
14254
14255 @@ -725,6 +730,7 @@ ENTRY(serpent_cbc_dec_16way)
14256
14257 vzeroupper;
14258
14259 + pax_force_retaddr
14260 ret;
14261 ENDPROC(serpent_cbc_dec_16way)
14262
14263 @@ -748,6 +754,7 @@ ENTRY(serpent_ctr_16way)
14264
14265 vzeroupper;
14266
14267 + pax_force_retaddr
14268 ret;
14269 ENDPROC(serpent_ctr_16way)
14270
14271 @@ -772,6 +779,7 @@ ENTRY(serpent_xts_enc_16way)
14272
14273 vzeroupper;
14274
14275 + pax_force_retaddr
14276 ret;
14277 ENDPROC(serpent_xts_enc_16way)
14278
14279 @@ -796,5 +804,6 @@ ENTRY(serpent_xts_dec_16way)
14280
14281 vzeroupper;
14282
14283 + pax_force_retaddr
14284 ret;
14285 ENDPROC(serpent_xts_dec_16way)
14286 diff --git a/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S b/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
14287 index acc066c..1559cc4 100644
14288 --- a/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
14289 +++ b/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
14290 @@ -25,6 +25,7 @@
14291 */
14292
14293 #include <linux/linkage.h>
14294 +#include <asm/alternative-asm.h>
14295
14296 .file "serpent-sse2-x86_64-asm_64.S"
14297 .text
14298 @@ -690,12 +691,14 @@ ENTRY(__serpent_enc_blk_8way)
14299 write_blocks(%rsi, RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14300 write_blocks(%rax, RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14301
14302 + pax_force_retaddr
14303 ret;
14304
14305 .L__enc_xor8:
14306 xor_blocks(%rsi, RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14307 xor_blocks(%rax, RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14308
14309 + pax_force_retaddr
14310 ret;
14311 ENDPROC(__serpent_enc_blk_8way)
14312
14313 @@ -750,5 +753,6 @@ ENTRY(serpent_dec_blk_8way)
14314 write_blocks(%rsi, RC1, RD1, RB1, RE1, RK0, RK1, RK2);
14315 write_blocks(%rax, RC2, RD2, RB2, RE2, RK0, RK1, RK2);
14316
14317 + pax_force_retaddr
14318 ret;
14319 ENDPROC(serpent_dec_blk_8way)
14320 diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S
14321 index a410950..9dfe7ad 100644
14322 --- a/arch/x86/crypto/sha1_ssse3_asm.S
14323 +++ b/arch/x86/crypto/sha1_ssse3_asm.S
14324 @@ -29,6 +29,7 @@
14325 */
14326
14327 #include <linux/linkage.h>
14328 +#include <asm/alternative-asm.h>
14329
14330 #define CTX %rdi // arg1
14331 #define BUF %rsi // arg2
14332 @@ -75,9 +76,9 @@
14333
14334 push %rbx
14335 push %rbp
14336 - push %r12
14337 + push %r14
14338
14339 - mov %rsp, %r12
14340 + mov %rsp, %r14
14341 sub $64, %rsp # allocate workspace
14342 and $~15, %rsp # align stack
14343
14344 @@ -99,11 +100,12 @@
14345 xor %rax, %rax
14346 rep stosq
14347
14348 - mov %r12, %rsp # deallocate workspace
14349 + mov %r14, %rsp # deallocate workspace
14350
14351 - pop %r12
14352 + pop %r14
14353 pop %rbp
14354 pop %rbx
14355 + pax_force_retaddr
14356 ret
14357
14358 ENDPROC(\name)
14359 diff --git a/arch/x86/crypto/sha256-avx-asm.S b/arch/x86/crypto/sha256-avx-asm.S
14360 index 92b3b5d..0dc1dcb 100644
14361 --- a/arch/x86/crypto/sha256-avx-asm.S
14362 +++ b/arch/x86/crypto/sha256-avx-asm.S
14363 @@ -49,6 +49,7 @@
14364
14365 #ifdef CONFIG_AS_AVX
14366 #include <linux/linkage.h>
14367 +#include <asm/alternative-asm.h>
14368
14369 ## assume buffers not aligned
14370 #define VMOVDQ vmovdqu
14371 @@ -460,6 +461,7 @@ done_hash:
14372 popq %r13
14373 popq %rbp
14374 popq %rbx
14375 + pax_force_retaddr
14376 ret
14377 ENDPROC(sha256_transform_avx)
14378
14379 diff --git a/arch/x86/crypto/sha256-avx2-asm.S b/arch/x86/crypto/sha256-avx2-asm.S
14380 index 570ec5e..cf2b625 100644
14381 --- a/arch/x86/crypto/sha256-avx2-asm.S
14382 +++ b/arch/x86/crypto/sha256-avx2-asm.S
14383 @@ -50,6 +50,7 @@
14384
14385 #ifdef CONFIG_AS_AVX2
14386 #include <linux/linkage.h>
14387 +#include <asm/alternative-asm.h>
14388
14389 ## assume buffers not aligned
14390 #define VMOVDQ vmovdqu
14391 @@ -720,6 +721,7 @@ done_hash:
14392 popq %r12
14393 popq %rbp
14394 popq %rbx
14395 + pax_force_retaddr
14396 ret
14397 ENDPROC(sha256_transform_rorx)
14398
14399 diff --git a/arch/x86/crypto/sha256-ssse3-asm.S b/arch/x86/crypto/sha256-ssse3-asm.S
14400 index 2cedc44..5144899 100644
14401 --- a/arch/x86/crypto/sha256-ssse3-asm.S
14402 +++ b/arch/x86/crypto/sha256-ssse3-asm.S
14403 @@ -47,6 +47,7 @@
14404 ########################################################################
14405
14406 #include <linux/linkage.h>
14407 +#include <asm/alternative-asm.h>
14408
14409 ## assume buffers not aligned
14410 #define MOVDQ movdqu
14411 @@ -471,6 +472,7 @@ done_hash:
14412 popq %rbp
14413 popq %rbx
14414
14415 + pax_force_retaddr
14416 ret
14417 ENDPROC(sha256_transform_ssse3)
14418
14419 diff --git a/arch/x86/crypto/sha512-avx-asm.S b/arch/x86/crypto/sha512-avx-asm.S
14420 index 565274d..af6bc08 100644
14421 --- a/arch/x86/crypto/sha512-avx-asm.S
14422 +++ b/arch/x86/crypto/sha512-avx-asm.S
14423 @@ -49,6 +49,7 @@
14424
14425 #ifdef CONFIG_AS_AVX
14426 #include <linux/linkage.h>
14427 +#include <asm/alternative-asm.h>
14428
14429 .text
14430
14431 @@ -364,6 +365,7 @@ updateblock:
14432 mov frame_RSPSAVE(%rsp), %rsp
14433
14434 nowork:
14435 + pax_force_retaddr
14436 ret
14437 ENDPROC(sha512_transform_avx)
14438
14439 diff --git a/arch/x86/crypto/sha512-avx2-asm.S b/arch/x86/crypto/sha512-avx2-asm.S
14440 index 1f20b35..f25c8c1 100644
14441 --- a/arch/x86/crypto/sha512-avx2-asm.S
14442 +++ b/arch/x86/crypto/sha512-avx2-asm.S
14443 @@ -51,6 +51,7 @@
14444
14445 #ifdef CONFIG_AS_AVX2
14446 #include <linux/linkage.h>
14447 +#include <asm/alternative-asm.h>
14448
14449 .text
14450
14451 @@ -678,6 +679,7 @@ done_hash:
14452
14453 # Restore Stack Pointer
14454 mov frame_RSPSAVE(%rsp), %rsp
14455 + pax_force_retaddr
14456 ret
14457 ENDPROC(sha512_transform_rorx)
14458
14459 diff --git a/arch/x86/crypto/sha512-ssse3-asm.S b/arch/x86/crypto/sha512-ssse3-asm.S
14460 index e610e29..ffcb5ed 100644
14461 --- a/arch/x86/crypto/sha512-ssse3-asm.S
14462 +++ b/arch/x86/crypto/sha512-ssse3-asm.S
14463 @@ -48,6 +48,7 @@
14464 ########################################################################
14465
14466 #include <linux/linkage.h>
14467 +#include <asm/alternative-asm.h>
14468
14469 .text
14470
14471 @@ -363,6 +364,7 @@ updateblock:
14472 mov frame_RSPSAVE(%rsp), %rsp
14473
14474 nowork:
14475 + pax_force_retaddr
14476 ret
14477 ENDPROC(sha512_transform_ssse3)
14478
14479 diff --git a/arch/x86/crypto/twofish-avx-x86_64-asm_64.S b/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
14480 index 0505813..b067311 100644
14481 --- a/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
14482 +++ b/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
14483 @@ -24,6 +24,7 @@
14484 */
14485
14486 #include <linux/linkage.h>
14487 +#include <asm/alternative-asm.h>
14488 #include "glue_helper-asm-avx.S"
14489
14490 .file "twofish-avx-x86_64-asm_64.S"
14491 @@ -284,6 +285,7 @@ __twofish_enc_blk8:
14492 outunpack_blocks(RC1, RD1, RA1, RB1, RK1, RX0, RY0, RK2);
14493 outunpack_blocks(RC2, RD2, RA2, RB2, RK1, RX0, RY0, RK2);
14494
14495 + pax_force_retaddr
14496 ret;
14497 ENDPROC(__twofish_enc_blk8)
14498
14499 @@ -324,6 +326,7 @@ __twofish_dec_blk8:
14500 outunpack_blocks(RA1, RB1, RC1, RD1, RK1, RX0, RY0, RK2);
14501 outunpack_blocks(RA2, RB2, RC2, RD2, RK1, RX0, RY0, RK2);
14502
14503 + pax_force_retaddr
14504 ret;
14505 ENDPROC(__twofish_dec_blk8)
14506
14507 @@ -342,6 +345,7 @@ ENTRY(twofish_ecb_enc_8way)
14508
14509 store_8way(%r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14510
14511 + pax_force_retaddr
14512 ret;
14513 ENDPROC(twofish_ecb_enc_8way)
14514
14515 @@ -360,6 +364,7 @@ ENTRY(twofish_ecb_dec_8way)
14516
14517 store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14518
14519 + pax_force_retaddr
14520 ret;
14521 ENDPROC(twofish_ecb_dec_8way)
14522
14523 @@ -370,19 +375,20 @@ ENTRY(twofish_cbc_dec_8way)
14524 * %rdx: src
14525 */
14526
14527 - pushq %r12;
14528 + pushq %r14;
14529
14530 movq %rsi, %r11;
14531 - movq %rdx, %r12;
14532 + movq %rdx, %r14;
14533
14534 load_8way(%rdx, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14535
14536 call __twofish_dec_blk8;
14537
14538 - store_cbc_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14539 + store_cbc_8way(%r14, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14540
14541 - popq %r12;
14542 + popq %r14;
14543
14544 + pax_force_retaddr
14545 ret;
14546 ENDPROC(twofish_cbc_dec_8way)
14547
14548 @@ -394,20 +400,21 @@ ENTRY(twofish_ctr_8way)
14549 * %rcx: iv (little endian, 128bit)
14550 */
14551
14552 - pushq %r12;
14553 + pushq %r14;
14554
14555 movq %rsi, %r11;
14556 - movq %rdx, %r12;
14557 + movq %rdx, %r14;
14558
14559 load_ctr_8way(%rcx, .Lbswap128_mask, RA1, RB1, RC1, RD1, RA2, RB2, RC2,
14560 RD2, RX0, RX1, RY0);
14561
14562 call __twofish_enc_blk8;
14563
14564 - store_ctr_8way(%r12, %r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14565 + store_ctr_8way(%r14, %r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14566
14567 - popq %r12;
14568 + popq %r14;
14569
14570 + pax_force_retaddr
14571 ret;
14572 ENDPROC(twofish_ctr_8way)
14573
14574 @@ -430,6 +437,7 @@ ENTRY(twofish_xts_enc_8way)
14575 /* dst <= regs xor IVs(in dst) */
14576 store_xts_8way(%r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14577
14578 + pax_force_retaddr
14579 ret;
14580 ENDPROC(twofish_xts_enc_8way)
14581
14582 @@ -452,5 +460,6 @@ ENTRY(twofish_xts_dec_8way)
14583 /* dst <= regs xor IVs(in dst) */
14584 store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14585
14586 + pax_force_retaddr
14587 ret;
14588 ENDPROC(twofish_xts_dec_8way)
14589 diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
14590 index 1c3b7ce..02f578d 100644
14591 --- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
14592 +++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
14593 @@ -21,6 +21,7 @@
14594 */
14595
14596 #include <linux/linkage.h>
14597 +#include <asm/alternative-asm.h>
14598
14599 .file "twofish-x86_64-asm-3way.S"
14600 .text
14601 @@ -258,6 +259,7 @@ ENTRY(__twofish_enc_blk_3way)
14602 popq %r13;
14603 popq %r14;
14604 popq %r15;
14605 + pax_force_retaddr
14606 ret;
14607
14608 .L__enc_xor3:
14609 @@ -269,6 +271,7 @@ ENTRY(__twofish_enc_blk_3way)
14610 popq %r13;
14611 popq %r14;
14612 popq %r15;
14613 + pax_force_retaddr
14614 ret;
14615 ENDPROC(__twofish_enc_blk_3way)
14616
14617 @@ -308,5 +311,6 @@ ENTRY(twofish_dec_blk_3way)
14618 popq %r13;
14619 popq %r14;
14620 popq %r15;
14621 + pax_force_retaddr
14622 ret;
14623 ENDPROC(twofish_dec_blk_3way)
14624 diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
14625 index a350c99..c1bac24 100644
14626 --- a/arch/x86/crypto/twofish-x86_64-asm_64.S
14627 +++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
14628 @@ -22,6 +22,7 @@
14629
14630 #include <linux/linkage.h>
14631 #include <asm/asm-offsets.h>
14632 +#include <asm/alternative-asm.h>
14633
14634 #define a_offset 0
14635 #define b_offset 4
14636 @@ -265,6 +266,7 @@ ENTRY(twofish_enc_blk)
14637
14638 popq R1
14639 movl $1,%eax
14640 + pax_force_retaddr
14641 ret
14642 ENDPROC(twofish_enc_blk)
14643
14644 @@ -317,5 +319,6 @@ ENTRY(twofish_dec_blk)
14645
14646 popq R1
14647 movl $1,%eax
14648 + pax_force_retaddr
14649 ret
14650 ENDPROC(twofish_dec_blk)
14651 diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
14652 index ae6aad1..719d6d9 100644
14653 --- a/arch/x86/ia32/ia32_aout.c
14654 +++ b/arch/x86/ia32/ia32_aout.c
14655 @@ -153,6 +153,8 @@ static int aout_core_dump(struct coredump_params *cprm)
14656 unsigned long dump_start, dump_size;
14657 struct user32 dump;
14658
14659 + memset(&dump, 0, sizeof(dump));
14660 +
14661 fs = get_fs();
14662 set_fs(KERNEL_DS);
14663 has_dumped = 1;
14664 diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
14665 index c81d35e6..3500144 100644
14666 --- a/arch/x86/ia32/ia32_signal.c
14667 +++ b/arch/x86/ia32/ia32_signal.c
14668 @@ -216,7 +216,7 @@ asmlinkage long sys32_sigreturn(void)
14669 if (__get_user(set.sig[0], &frame->sc.oldmask)
14670 || (_COMPAT_NSIG_WORDS > 1
14671 && __copy_from_user((((char *) &set.sig) + 4),
14672 - &frame->extramask,
14673 + frame->extramask,
14674 sizeof(frame->extramask))))
14675 goto badframe;
14676
14677 @@ -335,7 +335,7 @@ static void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs,
14678 sp -= frame_size;
14679 /* Align the stack pointer according to the i386 ABI,
14680 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
14681 - sp = ((sp + 4) & -16ul) - 4;
14682 + sp = ((sp - 12) & -16ul) - 4;
14683 return (void __user *) sp;
14684 }
14685
14686 @@ -380,10 +380,10 @@ int ia32_setup_frame(int sig, struct ksignal *ksig,
14687 } else {
14688 /* Return stub is in 32bit vsyscall page */
14689 if (current->mm->context.vdso)
14690 - restorer = current->mm->context.vdso +
14691 - selected_vdso32->sym___kernel_sigreturn;
14692 + restorer = (void __force_user *)(current->mm->context.vdso +
14693 + selected_vdso32->sym___kernel_sigreturn);
14694 else
14695 - restorer = &frame->retcode;
14696 + restorer = frame->retcode;
14697 }
14698
14699 put_user_try {
14700 @@ -393,7 +393,7 @@ int ia32_setup_frame(int sig, struct ksignal *ksig,
14701 * These are actually not used anymore, but left because some
14702 * gdb versions depend on them as a marker.
14703 */
14704 - put_user_ex(*((u64 *)&code), (u64 __user *)frame->retcode);
14705 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
14706 } put_user_catch(err);
14707
14708 if (err)
14709 @@ -435,7 +435,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
14710 0xb8,
14711 __NR_ia32_rt_sigreturn,
14712 0x80cd,
14713 - 0,
14714 + 0
14715 };
14716
14717 frame = get_sigframe(ksig, regs, sizeof(*frame), &fpstate);
14718 @@ -458,16 +458,19 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
14719
14720 if (ksig->ka.sa.sa_flags & SA_RESTORER)
14721 restorer = ksig->ka.sa.sa_restorer;
14722 + else if (current->mm->context.vdso)
14723 + /* Return stub is in 32bit vsyscall page */
14724 + restorer = (void __force_user *)(current->mm->context.vdso +
14725 + selected_vdso32->sym___kernel_rt_sigreturn);
14726 else
14727 - restorer = current->mm->context.vdso +
14728 - selected_vdso32->sym___kernel_rt_sigreturn;
14729 + restorer = frame->retcode;
14730 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
14731
14732 /*
14733 * Not actually used anymore, but left because some gdb
14734 * versions need it.
14735 */
14736 - put_user_ex(*((u64 *)&code), (u64 __user *)frame->retcode);
14737 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
14738 } put_user_catch(err);
14739
14740 err |= copy_siginfo_to_user32(&frame->info, &ksig->info);
14741 diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
14742 index 72bf268..127572a 100644
14743 --- a/arch/x86/ia32/ia32entry.S
14744 +++ b/arch/x86/ia32/ia32entry.S
14745 @@ -15,8 +15,10 @@
14746 #include <asm/irqflags.h>
14747 #include <asm/asm.h>
14748 #include <asm/smap.h>
14749 +#include <asm/pgtable.h>
14750 #include <linux/linkage.h>
14751 #include <linux/err.h>
14752 +#include <asm/alternative-asm.h>
14753
14754 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14755 #include <linux/elf-em.h>
14756 @@ -85,6 +87,32 @@ ENTRY(native_irq_enable_sysexit)
14757 ENDPROC(native_irq_enable_sysexit)
14758 #endif
14759
14760 + .macro pax_enter_kernel_user
14761 + pax_set_fptr_mask
14762 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14763 + call pax_enter_kernel_user
14764 +#endif
14765 + .endm
14766 +
14767 + .macro pax_exit_kernel_user
14768 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14769 + call pax_exit_kernel_user
14770 +#endif
14771 +#ifdef CONFIG_PAX_RANDKSTACK
14772 + pushq %rax
14773 + pushq %r11
14774 + call pax_randomize_kstack
14775 + popq %r11
14776 + popq %rax
14777 +#endif
14778 + .endm
14779 +
14780 + .macro pax_erase_kstack
14781 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14782 + call pax_erase_kstack
14783 +#endif
14784 + .endm
14785 +
14786 /*
14787 * 32bit SYSENTER instruction entry.
14788 *
14789 @@ -119,23 +147,24 @@ ENTRY(ia32_sysenter_target)
14790 * it is too small to ever cause noticeable irq latency.
14791 */
14792 SWAPGS_UNSAFE_STACK
14793 - movq PER_CPU_VAR(cpu_tss + TSS_sp0), %rsp
14794 - ENABLE_INTERRUPTS(CLBR_NONE)
14795 + movq PER_CPU_VAR(kernel_stack), %rsp
14796
14797 /* Zero-extending 32-bit regs, do not remove */
14798 movl %ebp, %ebp
14799 movl %eax, %eax
14800
14801 - movl ASM_THREAD_INFO(TI_sysenter_return, %rsp, 0), %r10d
14802 - CFI_REGISTER rip,r10
14803 + GET_THREAD_INFO(%r11)
14804 + movl TI_sysenter_return(%r11), %r11d
14805 + CFI_REGISTER rip,r11
14806
14807 /* Construct struct pt_regs on stack */
14808 pushq_cfi $__USER32_DS /* pt_regs->ss */
14809 pushq_cfi %rbp /* pt_regs->sp */
14810 CFI_REL_OFFSET rsp,0
14811 pushfq_cfi /* pt_regs->flags */
14812 + orl $X86_EFLAGS_IF,(%rsp)
14813 pushq_cfi $__USER32_CS /* pt_regs->cs */
14814 - pushq_cfi %r10 /* pt_regs->ip = thread_info->sysenter_return */
14815 + pushq_cfi %r11 /* pt_regs->ip = thread_info->sysenter_return */
14816 CFI_REL_OFFSET rip,0
14817 pushq_cfi_reg rax /* pt_regs->orig_ax */
14818 pushq_cfi_reg rdi /* pt_regs->di */
14819 @@ -147,15 +176,37 @@ ENTRY(ia32_sysenter_target)
14820 sub $(10*8),%rsp /* pt_regs->r8-11,bp,bx,r12-15 not saved */
14821 CFI_ADJUST_CFA_OFFSET 10*8
14822
14823 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
14824 + movq_cfi r12, R12
14825 +#endif
14826 +
14827 + pax_enter_kernel_user
14828 +
14829 +#ifdef CONFIG_PAX_RANDKSTACK
14830 + pax_erase_kstack
14831 +#endif
14832 +
14833 + ENABLE_INTERRUPTS(CLBR_NONE)
14834 +
14835 /*
14836 * no need to do an access_ok check here because rbp has been
14837 * 32bit zero extended
14838 */
14839 +
14840 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14841 + addq pax_user_shadow_base,%rbp
14842 + ASM_PAX_OPEN_USERLAND
14843 +#endif
14844 +
14845 ASM_STAC
14846 1: movl (%rbp),%ebp
14847 _ASM_EXTABLE(1b,ia32_badarg)
14848 ASM_CLAC
14849
14850 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14851 + ASM_PAX_CLOSE_USERLAND
14852 +#endif
14853 +
14854 /*
14855 * Sysenter doesn't filter flags, so we need to clear NT
14856 * ourselves. To save a few cycles, we can check whether
14857 @@ -165,8 +216,9 @@ ENTRY(ia32_sysenter_target)
14858 jnz sysenter_fix_flags
14859 sysenter_flags_fixed:
14860
14861 - orl $TS_COMPAT, ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
14862 - testl $_TIF_WORK_SYSCALL_ENTRY, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
14863 + GET_THREAD_INFO(%r11)
14864 + orl $TS_COMPAT,TI_status(%r11)
14865 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
14866 CFI_REMEMBER_STATE
14867 jnz sysenter_tracesys
14868 cmpq $(IA32_NR_syscalls-1),%rax
14869 @@ -181,9 +233,10 @@ sysenter_do_call:
14870 sysenter_dispatch:
14871 call *ia32_sys_call_table(,%rax,8)
14872 movq %rax,RAX(%rsp)
14873 + GET_THREAD_INFO(%r11)
14874 DISABLE_INTERRUPTS(CLBR_NONE)
14875 TRACE_IRQS_OFF
14876 - testl $_TIF_ALLWORK_MASK, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
14877 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
14878 jnz sysexit_audit
14879 sysexit_from_sys_call:
14880 /*
14881 @@ -196,7 +249,9 @@ sysexit_from_sys_call:
14882 * This code path is still called 'sysexit' because it pairs
14883 * with 'sysenter' and it uses the SYSENTER calling convention.
14884 */
14885 - andl $~TS_COMPAT,ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
14886 + pax_exit_kernel_user
14887 + pax_erase_kstack
14888 + andl $~TS_COMPAT,TI_status(%r11)
14889 movl RIP(%rsp),%ecx /* User %eip */
14890 CFI_REGISTER rip,rcx
14891 RESTORE_RSI_RDI
14892 @@ -247,6 +302,9 @@ sysexit_from_sys_call:
14893 movl %ebx,%esi /* 2nd arg: 1st syscall arg */
14894 movl %eax,%edi /* 1st arg: syscall number */
14895 call __audit_syscall_entry
14896 +
14897 + pax_erase_kstack
14898 +
14899 movl RAX(%rsp),%eax /* reload syscall number */
14900 cmpq $(IA32_NR_syscalls-1),%rax
14901 ja ia32_badsys
14902 @@ -258,7 +316,7 @@ sysexit_from_sys_call:
14903 .endm
14904
14905 .macro auditsys_exit exit
14906 - testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT), ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
14907 + testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
14908 jnz ia32_ret_from_sys_call
14909 TRACE_IRQS_ON
14910 ENABLE_INTERRUPTS(CLBR_NONE)
14911 @@ -269,11 +327,12 @@ sysexit_from_sys_call:
14912 1: setbe %al /* 1 if error, 0 if not */
14913 movzbl %al,%edi /* zero-extend that into %edi */
14914 call __audit_syscall_exit
14915 + GET_THREAD_INFO(%r11)
14916 movq RAX(%rsp),%rax /* reload syscall return value */
14917 movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
14918 DISABLE_INTERRUPTS(CLBR_NONE)
14919 TRACE_IRQS_OFF
14920 - testl %edi, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
14921 + testl %edi,TI_flags(%r11)
14922 jz \exit
14923 CLEAR_RREGS
14924 jmp int_with_check
14925 @@ -295,7 +354,7 @@ sysenter_fix_flags:
14926
14927 sysenter_tracesys:
14928 #ifdef CONFIG_AUDITSYSCALL
14929 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT), ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
14930 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
14931 jz sysenter_auditsys
14932 #endif
14933 SAVE_EXTRA_REGS
14934 @@ -307,6 +366,9 @@ sysenter_tracesys:
14935 RESTORE_EXTRA_REGS
14936 cmpq $(IA32_NR_syscalls-1),%rax
14937 ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
14938 +
14939 + pax_erase_kstack
14940 +
14941 jmp sysenter_do_call
14942 CFI_ENDPROC
14943 ENDPROC(ia32_sysenter_target)
14944 @@ -357,7 +419,6 @@ ENTRY(ia32_cstar_target)
14945 movl %esp,%r8d
14946 CFI_REGISTER rsp,r8
14947 movq PER_CPU_VAR(kernel_stack),%rsp
14948 - ENABLE_INTERRUPTS(CLBR_NONE)
14949
14950 /* Zero-extending 32-bit regs, do not remove */
14951 movl %eax,%eax
14952 @@ -380,16 +441,41 @@ ENTRY(ia32_cstar_target)
14953 sub $(10*8),%rsp /* pt_regs->r8-11,bp,bx,r12-15 not saved */
14954 CFI_ADJUST_CFA_OFFSET 10*8
14955
14956 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
14957 + movq_cfi r12, R12
14958 +#endif
14959 +
14960 + pax_enter_kernel_user
14961 +
14962 +#ifdef CONFIG_PAX_RANDKSTACK
14963 + pax_erase_kstack
14964 +#endif
14965 +
14966 + ENABLE_INTERRUPTS(CLBR_NONE)
14967 +
14968 /*
14969 * no need to do an access_ok check here because r8 has been
14970 * 32bit zero extended
14971 */
14972 +
14973 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14974 + ASM_PAX_OPEN_USERLAND
14975 + movq pax_user_shadow_base,%r8
14976 + addq RSP(%rsp),%r8
14977 +#endif
14978 +
14979 ASM_STAC
14980 1: movl (%r8),%r9d
14981 _ASM_EXTABLE(1b,ia32_badarg)
14982 ASM_CLAC
14983 - orl $TS_COMPAT, ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
14984 - testl $_TIF_WORK_SYSCALL_ENTRY, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
14985 +
14986 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14987 + ASM_PAX_CLOSE_USERLAND
14988 +#endif
14989 +
14990 + GET_THREAD_INFO(%r11)
14991 + orl $TS_COMPAT,TI_status(%r11)
14992 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
14993 CFI_REMEMBER_STATE
14994 jnz cstar_tracesys
14995 cmpq $IA32_NR_syscalls-1,%rax
14996 @@ -404,12 +490,15 @@ cstar_do_call:
14997 cstar_dispatch:
14998 call *ia32_sys_call_table(,%rax,8)
14999 movq %rax,RAX(%rsp)
15000 + GET_THREAD_INFO(%r11)
15001 DISABLE_INTERRUPTS(CLBR_NONE)
15002 TRACE_IRQS_OFF
15003 - testl $_TIF_ALLWORK_MASK, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
15004 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
15005 jnz sysretl_audit
15006 sysretl_from_sys_call:
15007 - andl $~TS_COMPAT, ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
15008 + pax_exit_kernel_user
15009 + pax_erase_kstack
15010 + andl $~TS_COMPAT,TI_status(%r11)
15011 RESTORE_RSI_RDI_RDX
15012 movl RIP(%rsp),%ecx
15013 CFI_REGISTER rip,rcx
15014 @@ -451,7 +540,7 @@ sysretl_audit:
15015
15016 cstar_tracesys:
15017 #ifdef CONFIG_AUDITSYSCALL
15018 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT), ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
15019 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
15020 jz cstar_auditsys
15021 #endif
15022 xchgl %r9d,%ebp
15023 @@ -465,11 +554,19 @@ cstar_tracesys:
15024 xchgl %ebp,%r9d
15025 cmpq $(IA32_NR_syscalls-1),%rax
15026 ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
15027 +
15028 + pax_erase_kstack
15029 +
15030 jmp cstar_do_call
15031 END(ia32_cstar_target)
15032
15033 ia32_badarg:
15034 ASM_CLAC
15035 +
15036 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15037 + ASM_PAX_CLOSE_USERLAND
15038 +#endif
15039 +
15040 movq $-EFAULT,%rax
15041 jmp ia32_sysret
15042 CFI_ENDPROC
15043 @@ -505,14 +602,8 @@ ENTRY(ia32_syscall)
15044 /*CFI_REL_OFFSET cs,1*8 */
15045 CFI_REL_OFFSET rip,0*8
15046
15047 - /*
15048 - * Interrupts are off on entry.
15049 - * We do not frame this tiny irq-off block with TRACE_IRQS_OFF/ON,
15050 - * it is too small to ever cause noticeable irq latency.
15051 - */
15052 PARAVIRT_ADJUST_EXCEPTION_FRAME
15053 SWAPGS
15054 - ENABLE_INTERRUPTS(CLBR_NONE)
15055
15056 /* Zero-extending 32-bit regs, do not remove */
15057 movl %eax,%eax
15058 @@ -528,8 +619,26 @@ ENTRY(ia32_syscall)
15059 sub $(10*8),%rsp /* pt_regs->r8-11,bp,bx,r12-15 not saved */
15060 CFI_ADJUST_CFA_OFFSET 10*8
15061
15062 - orl $TS_COMPAT, ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
15063 - testl $_TIF_WORK_SYSCALL_ENTRY, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
15064 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
15065 + movq_cfi r12, R12
15066 +#endif
15067 +
15068 + pax_enter_kernel_user
15069 +
15070 +#ifdef CONFIG_PAX_RANDKSTACK
15071 + pax_erase_kstack
15072 +#endif
15073 +
15074 + /*
15075 + * Interrupts are off on entry.
15076 + * We do not frame this tiny irq-off block with TRACE_IRQS_OFF/ON,
15077 + * it is too small to ever cause noticeable irq latency.
15078 + */
15079 + ENABLE_INTERRUPTS(CLBR_NONE)
15080 +
15081 + GET_THREAD_INFO(%r11)
15082 + orl $TS_COMPAT,TI_status(%r11)
15083 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
15084 jnz ia32_tracesys
15085 cmpq $(IA32_NR_syscalls-1),%rax
15086 ja ia32_badsys
15087 @@ -557,6 +666,9 @@ ia32_tracesys:
15088 RESTORE_EXTRA_REGS
15089 cmpq $(IA32_NR_syscalls-1),%rax
15090 ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
15091 +
15092 + pax_erase_kstack
15093 +
15094 jmp ia32_do_call
15095 END(ia32_syscall)
15096
15097 diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
15098 index 719cd70..69d576b 100644
15099 --- a/arch/x86/ia32/sys_ia32.c
15100 +++ b/arch/x86/ia32/sys_ia32.c
15101 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
15102 */
15103 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
15104 {
15105 - typeof(ubuf->st_uid) uid = 0;
15106 - typeof(ubuf->st_gid) gid = 0;
15107 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
15108 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
15109 SET_UID(uid, from_kuid_munged(current_user_ns(), stat->uid));
15110 SET_GID(gid, from_kgid_munged(current_user_ns(), stat->gid));
15111 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
15112 diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
15113 index bdf02ee..51a4656 100644
15114 --- a/arch/x86/include/asm/alternative-asm.h
15115 +++ b/arch/x86/include/asm/alternative-asm.h
15116 @@ -18,6 +18,45 @@
15117 .endm
15118 #endif
15119
15120 +#ifdef KERNEXEC_PLUGIN
15121 + .macro pax_force_retaddr_bts rip=0
15122 + btsq $63,\rip(%rsp)
15123 + .endm
15124 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
15125 + .macro pax_force_retaddr rip=0, reload=0
15126 + btsq $63,\rip(%rsp)
15127 + .endm
15128 + .macro pax_force_fptr ptr
15129 + btsq $63,\ptr
15130 + .endm
15131 + .macro pax_set_fptr_mask
15132 + .endm
15133 +#endif
15134 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
15135 + .macro pax_force_retaddr rip=0, reload=0
15136 + .if \reload
15137 + pax_set_fptr_mask
15138 + .endif
15139 + orq %r12,\rip(%rsp)
15140 + .endm
15141 + .macro pax_force_fptr ptr
15142 + orq %r12,\ptr
15143 + .endm
15144 + .macro pax_set_fptr_mask
15145 + movabs $0x8000000000000000,%r12
15146 + .endm
15147 +#endif
15148 +#else
15149 + .macro pax_force_retaddr rip=0, reload=0
15150 + .endm
15151 + .macro pax_force_fptr ptr
15152 + .endm
15153 + .macro pax_force_retaddr_bts rip=0
15154 + .endm
15155 + .macro pax_set_fptr_mask
15156 + .endm
15157 +#endif
15158 +
15159 .macro altinstruction_entry orig alt feature orig_len alt_len pad_len
15160 .long \orig - .
15161 .long \alt - .
15162 @@ -38,7 +77,7 @@
15163 altinstruction_entry 140b,143f,\feature,142b-140b,144f-143f,142b-141b
15164 .popsection
15165
15166 - .pushsection .altinstr_replacement,"ax"
15167 + .pushsection .altinstr_replacement,"a"
15168 143:
15169 \newinstr
15170 144:
15171 @@ -68,7 +107,7 @@
15172 altinstruction_entry 140b,144f,\feature2,142b-140b,145f-144f,142b-141b
15173 .popsection
15174
15175 - .pushsection .altinstr_replacement,"ax"
15176 + .pushsection .altinstr_replacement,"a"
15177 143:
15178 \newinstr1
15179 144:
15180 diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
15181 index ba32af0..ff42fc0 100644
15182 --- a/arch/x86/include/asm/alternative.h
15183 +++ b/arch/x86/include/asm/alternative.h
15184 @@ -130,7 +130,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
15185 ".pushsection .altinstructions,\"a\"\n" \
15186 ALTINSTR_ENTRY(feature, 1) \
15187 ".popsection\n" \
15188 - ".pushsection .altinstr_replacement, \"ax\"\n" \
15189 + ".pushsection .altinstr_replacement, \"a\"\n" \
15190 ALTINSTR_REPLACEMENT(newinstr, feature, 1) \
15191 ".popsection"
15192
15193 @@ -140,7 +140,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
15194 ALTINSTR_ENTRY(feature1, 1) \
15195 ALTINSTR_ENTRY(feature2, 2) \
15196 ".popsection\n" \
15197 - ".pushsection .altinstr_replacement, \"ax\"\n" \
15198 + ".pushsection .altinstr_replacement, \"a\"\n" \
15199 ALTINSTR_REPLACEMENT(newinstr1, feature1, 1) \
15200 ALTINSTR_REPLACEMENT(newinstr2, feature2, 2) \
15201 ".popsection"
15202 diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
15203 index 976b86a..f3bc83a 100644
15204 --- a/arch/x86/include/asm/apic.h
15205 +++ b/arch/x86/include/asm/apic.h
15206 @@ -45,7 +45,7 @@ static inline void generic_apic_probe(void)
15207
15208 #ifdef CONFIG_X86_LOCAL_APIC
15209
15210 -extern unsigned int apic_verbosity;
15211 +extern int apic_verbosity;
15212 extern int local_apic_timer_c2_ok;
15213
15214 extern int disable_apic;
15215 diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
15216 index 20370c6..a2eb9b0 100644
15217 --- a/arch/x86/include/asm/apm.h
15218 +++ b/arch/x86/include/asm/apm.h
15219 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
15220 __asm__ __volatile__(APM_DO_ZERO_SEGS
15221 "pushl %%edi\n\t"
15222 "pushl %%ebp\n\t"
15223 - "lcall *%%cs:apm_bios_entry\n\t"
15224 + "lcall *%%ss:apm_bios_entry\n\t"
15225 "setc %%al\n\t"
15226 "popl %%ebp\n\t"
15227 "popl %%edi\n\t"
15228 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
15229 __asm__ __volatile__(APM_DO_ZERO_SEGS
15230 "pushl %%edi\n\t"
15231 "pushl %%ebp\n\t"
15232 - "lcall *%%cs:apm_bios_entry\n\t"
15233 + "lcall *%%ss:apm_bios_entry\n\t"
15234 "setc %%bl\n\t"
15235 "popl %%ebp\n\t"
15236 "popl %%edi\n\t"
15237 diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
15238 index 5e5cd12..51cdc93 100644
15239 --- a/arch/x86/include/asm/atomic.h
15240 +++ b/arch/x86/include/asm/atomic.h
15241 @@ -28,6 +28,17 @@ static inline int atomic_read(const atomic_t *v)
15242 }
15243
15244 /**
15245 + * atomic_read_unchecked - read atomic variable
15246 + * @v: pointer of type atomic_unchecked_t
15247 + *
15248 + * Atomically reads the value of @v.
15249 + */
15250 +static inline int __intentional_overflow(-1) atomic_read_unchecked(const atomic_unchecked_t *v)
15251 +{
15252 + return ACCESS_ONCE((v)->counter);
15253 +}
15254 +
15255 +/**
15256 * atomic_set - set atomic variable
15257 * @v: pointer of type atomic_t
15258 * @i: required value
15259 @@ -40,6 +51,18 @@ static inline void atomic_set(atomic_t *v, int i)
15260 }
15261
15262 /**
15263 + * atomic_set_unchecked - set atomic variable
15264 + * @v: pointer of type atomic_unchecked_t
15265 + * @i: required value
15266 + *
15267 + * Atomically sets the value of @v to @i.
15268 + */
15269 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
15270 +{
15271 + v->counter = i;
15272 +}
15273 +
15274 +/**
15275 * atomic_add - add integer to atomic variable
15276 * @i: integer value to add
15277 * @v: pointer of type atomic_t
15278 @@ -48,7 +71,29 @@ static inline void atomic_set(atomic_t *v, int i)
15279 */
15280 static inline void atomic_add(int i, atomic_t *v)
15281 {
15282 - asm volatile(LOCK_PREFIX "addl %1,%0"
15283 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
15284 +
15285 +#ifdef CONFIG_PAX_REFCOUNT
15286 + "jno 0f\n"
15287 + LOCK_PREFIX "subl %1,%0\n"
15288 + "int $4\n0:\n"
15289 + _ASM_EXTABLE(0b, 0b)
15290 +#endif
15291 +
15292 + : "+m" (v->counter)
15293 + : "ir" (i));
15294 +}
15295 +
15296 +/**
15297 + * atomic_add_unchecked - add integer to atomic variable
15298 + * @i: integer value to add
15299 + * @v: pointer of type atomic_unchecked_t
15300 + *
15301 + * Atomically adds @i to @v.
15302 + */
15303 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
15304 +{
15305 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
15306 : "+m" (v->counter)
15307 : "ir" (i));
15308 }
15309 @@ -62,7 +107,29 @@ static inline void atomic_add(int i, atomic_t *v)
15310 */
15311 static inline void atomic_sub(int i, atomic_t *v)
15312 {
15313 - asm volatile(LOCK_PREFIX "subl %1,%0"
15314 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
15315 +
15316 +#ifdef CONFIG_PAX_REFCOUNT
15317 + "jno 0f\n"
15318 + LOCK_PREFIX "addl %1,%0\n"
15319 + "int $4\n0:\n"
15320 + _ASM_EXTABLE(0b, 0b)
15321 +#endif
15322 +
15323 + : "+m" (v->counter)
15324 + : "ir" (i));
15325 +}
15326 +
15327 +/**
15328 + * atomic_sub_unchecked - subtract integer from atomic variable
15329 + * @i: integer value to subtract
15330 + * @v: pointer of type atomic_unchecked_t
15331 + *
15332 + * Atomically subtracts @i from @v.
15333 + */
15334 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
15335 +{
15336 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
15337 : "+m" (v->counter)
15338 : "ir" (i));
15339 }
15340 @@ -78,7 +145,7 @@ static inline void atomic_sub(int i, atomic_t *v)
15341 */
15342 static inline int atomic_sub_and_test(int i, atomic_t *v)
15343 {
15344 - GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, "er", i, "%0", "e");
15345 + GEN_BINARY_RMWcc(LOCK_PREFIX "subl", LOCK_PREFIX "addl", v->counter, "er", i, "%0", "e");
15346 }
15347
15348 /**
15349 @@ -89,7 +156,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
15350 */
15351 static inline void atomic_inc(atomic_t *v)
15352 {
15353 - asm volatile(LOCK_PREFIX "incl %0"
15354 + asm volatile(LOCK_PREFIX "incl %0\n"
15355 +
15356 +#ifdef CONFIG_PAX_REFCOUNT
15357 + "jno 0f\n"
15358 + LOCK_PREFIX "decl %0\n"
15359 + "int $4\n0:\n"
15360 + _ASM_EXTABLE(0b, 0b)
15361 +#endif
15362 +
15363 + : "+m" (v->counter));
15364 +}
15365 +
15366 +/**
15367 + * atomic_inc_unchecked - increment atomic variable
15368 + * @v: pointer of type atomic_unchecked_t
15369 + *
15370 + * Atomically increments @v by 1.
15371 + */
15372 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
15373 +{
15374 + asm volatile(LOCK_PREFIX "incl %0\n"
15375 : "+m" (v->counter));
15376 }
15377
15378 @@ -101,7 +188,27 @@ static inline void atomic_inc(atomic_t *v)
15379 */
15380 static inline void atomic_dec(atomic_t *v)
15381 {
15382 - asm volatile(LOCK_PREFIX "decl %0"
15383 + asm volatile(LOCK_PREFIX "decl %0\n"
15384 +
15385 +#ifdef CONFIG_PAX_REFCOUNT
15386 + "jno 0f\n"
15387 + LOCK_PREFIX "incl %0\n"
15388 + "int $4\n0:\n"
15389 + _ASM_EXTABLE(0b, 0b)
15390 +#endif
15391 +
15392 + : "+m" (v->counter));
15393 +}
15394 +
15395 +/**
15396 + * atomic_dec_unchecked - decrement atomic variable
15397 + * @v: pointer of type atomic_unchecked_t
15398 + *
15399 + * Atomically decrements @v by 1.
15400 + */
15401 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
15402 +{
15403 + asm volatile(LOCK_PREFIX "decl %0\n"
15404 : "+m" (v->counter));
15405 }
15406
15407 @@ -115,7 +222,7 @@ static inline void atomic_dec(atomic_t *v)
15408 */
15409 static inline int atomic_dec_and_test(atomic_t *v)
15410 {
15411 - GEN_UNARY_RMWcc(LOCK_PREFIX "decl", v->counter, "%0", "e");
15412 + GEN_UNARY_RMWcc(LOCK_PREFIX "decl", LOCK_PREFIX "incl", v->counter, "%0", "e");
15413 }
15414
15415 /**
15416 @@ -128,7 +235,20 @@ static inline int atomic_dec_and_test(atomic_t *v)
15417 */
15418 static inline int atomic_inc_and_test(atomic_t *v)
15419 {
15420 - GEN_UNARY_RMWcc(LOCK_PREFIX "incl", v->counter, "%0", "e");
15421 + GEN_UNARY_RMWcc(LOCK_PREFIX "incl", LOCK_PREFIX "decl", v->counter, "%0", "e");
15422 +}
15423 +
15424 +/**
15425 + * atomic_inc_and_test_unchecked - increment and test
15426 + * @v: pointer of type atomic_unchecked_t
15427 + *
15428 + * Atomically increments @v by 1
15429 + * and returns true if the result is zero, or false for all
15430 + * other cases.
15431 + */
15432 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
15433 +{
15434 + GEN_UNARY_RMWcc_unchecked(LOCK_PREFIX "incl", v->counter, "%0", "e");
15435 }
15436
15437 /**
15438 @@ -142,7 +262,7 @@ static inline int atomic_inc_and_test(atomic_t *v)
15439 */
15440 static inline int atomic_add_negative(int i, atomic_t *v)
15441 {
15442 - GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, "er", i, "%0", "s");
15443 + GEN_BINARY_RMWcc(LOCK_PREFIX "addl", LOCK_PREFIX "subl", v->counter, "er", i, "%0", "s");
15444 }
15445
15446 /**
15447 @@ -152,7 +272,19 @@ static inline int atomic_add_negative(int i, atomic_t *v)
15448 *
15449 * Atomically adds @i to @v and returns @i + @v
15450 */
15451 -static inline int atomic_add_return(int i, atomic_t *v)
15452 +static inline int __intentional_overflow(-1) atomic_add_return(int i, atomic_t *v)
15453 +{
15454 + return i + xadd_check_overflow(&v->counter, i);
15455 +}
15456 +
15457 +/**
15458 + * atomic_add_return_unchecked - add integer and return
15459 + * @i: integer value to add
15460 + * @v: pointer of type atomic_unchecked_t
15461 + *
15462 + * Atomically adds @i to @v and returns @i + @v
15463 + */
15464 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
15465 {
15466 return i + xadd(&v->counter, i);
15467 }
15468 @@ -164,15 +296,24 @@ static inline int atomic_add_return(int i, atomic_t *v)
15469 *
15470 * Atomically subtracts @i from @v and returns @v - @i
15471 */
15472 -static inline int atomic_sub_return(int i, atomic_t *v)
15473 +static inline int __intentional_overflow(-1) atomic_sub_return(int i, atomic_t *v)
15474 {
15475 return atomic_add_return(-i, v);
15476 }
15477
15478 #define atomic_inc_return(v) (atomic_add_return(1, v))
15479 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
15480 +{
15481 + return atomic_add_return_unchecked(1, v);
15482 +}
15483 #define atomic_dec_return(v) (atomic_sub_return(1, v))
15484
15485 -static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
15486 +static inline int __intentional_overflow(-1) atomic_cmpxchg(atomic_t *v, int old, int new)
15487 +{
15488 + return cmpxchg(&v->counter, old, new);
15489 +}
15490 +
15491 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
15492 {
15493 return cmpxchg(&v->counter, old, new);
15494 }
15495 @@ -182,6 +323,11 @@ static inline int atomic_xchg(atomic_t *v, int new)
15496 return xchg(&v->counter, new);
15497 }
15498
15499 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
15500 +{
15501 + return xchg(&v->counter, new);
15502 +}
15503 +
15504 /**
15505 * __atomic_add_unless - add unless the number is already a given value
15506 * @v: pointer of type atomic_t
15507 @@ -193,12 +339,25 @@ static inline int atomic_xchg(atomic_t *v, int new)
15508 */
15509 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
15510 {
15511 - int c, old;
15512 + int c, old, new;
15513 c = atomic_read(v);
15514 for (;;) {
15515 - if (unlikely(c == (u)))
15516 + if (unlikely(c == u))
15517 break;
15518 - old = atomic_cmpxchg((v), c, c + (a));
15519 +
15520 + asm volatile("addl %2,%0\n"
15521 +
15522 +#ifdef CONFIG_PAX_REFCOUNT
15523 + "jno 0f\n"
15524 + "subl %2,%0\n"
15525 + "int $4\n0:\n"
15526 + _ASM_EXTABLE(0b, 0b)
15527 +#endif
15528 +
15529 + : "=r" (new)
15530 + : "0" (c), "ir" (a));
15531 +
15532 + old = atomic_cmpxchg(v, c, new);
15533 if (likely(old == c))
15534 break;
15535 c = old;
15536 @@ -207,6 +366,49 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
15537 }
15538
15539 /**
15540 + * atomic_inc_not_zero_hint - increment if not null
15541 + * @v: pointer of type atomic_t
15542 + * @hint: probable value of the atomic before the increment
15543 + *
15544 + * This version of atomic_inc_not_zero() gives a hint of probable
15545 + * value of the atomic. This helps processor to not read the memory
15546 + * before doing the atomic read/modify/write cycle, lowering
15547 + * number of bus transactions on some arches.
15548 + *
15549 + * Returns: 0 if increment was not done, 1 otherwise.
15550 + */
15551 +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
15552 +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
15553 +{
15554 + int val, c = hint, new;
15555 +
15556 + /* sanity test, should be removed by compiler if hint is a constant */
15557 + if (!hint)
15558 + return __atomic_add_unless(v, 1, 0);
15559 +
15560 + do {
15561 + asm volatile("incl %0\n"
15562 +
15563 +#ifdef CONFIG_PAX_REFCOUNT
15564 + "jno 0f\n"
15565 + "decl %0\n"
15566 + "int $4\n0:\n"
15567 + _ASM_EXTABLE(0b, 0b)
15568 +#endif
15569 +
15570 + : "=r" (new)
15571 + : "0" (c));
15572 +
15573 + val = atomic_cmpxchg(v, c, new);
15574 + if (val == c)
15575 + return 1;
15576 + c = val;
15577 + } while (c);
15578 +
15579 + return 0;
15580 +}
15581 +
15582 +/**
15583 * atomic_inc_short - increment of a short integer
15584 * @v: pointer to type int
15585 *
15586 @@ -220,14 +422,37 @@ static inline short int atomic_inc_short(short int *v)
15587 }
15588
15589 /* These are x86-specific, used by some header files */
15590 -#define atomic_clear_mask(mask, addr) \
15591 - asm volatile(LOCK_PREFIX "andl %0,%1" \
15592 - : : "r" (~(mask)), "m" (*(addr)) : "memory")
15593 +static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
15594 +{
15595 + asm volatile(LOCK_PREFIX "andl %1,%0"
15596 + : "+m" (v->counter)
15597 + : "r" (~(mask))
15598 + : "memory");
15599 +}
15600
15601 -#define atomic_set_mask(mask, addr) \
15602 - asm volatile(LOCK_PREFIX "orl %0,%1" \
15603 - : : "r" ((unsigned)(mask)), "m" (*(addr)) \
15604 - : "memory")
15605 +static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
15606 +{
15607 + asm volatile(LOCK_PREFIX "andl %1,%0"
15608 + : "+m" (v->counter)
15609 + : "r" (~(mask))
15610 + : "memory");
15611 +}
15612 +
15613 +static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
15614 +{
15615 + asm volatile(LOCK_PREFIX "orl %1,%0"
15616 + : "+m" (v->counter)
15617 + : "r" (mask)
15618 + : "memory");
15619 +}
15620 +
15621 +static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
15622 +{
15623 + asm volatile(LOCK_PREFIX "orl %1,%0"
15624 + : "+m" (v->counter)
15625 + : "r" (mask)
15626 + : "memory");
15627 +}
15628
15629 #ifdef CONFIG_X86_32
15630 # include <asm/atomic64_32.h>
15631 diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
15632 index b154de7..bf18a5a 100644
15633 --- a/arch/x86/include/asm/atomic64_32.h
15634 +++ b/arch/x86/include/asm/atomic64_32.h
15635 @@ -12,6 +12,14 @@ typedef struct {
15636 u64 __aligned(8) counter;
15637 } atomic64_t;
15638
15639 +#ifdef CONFIG_PAX_REFCOUNT
15640 +typedef struct {
15641 + u64 __aligned(8) counter;
15642 +} atomic64_unchecked_t;
15643 +#else
15644 +typedef atomic64_t atomic64_unchecked_t;
15645 +#endif
15646 +
15647 #define ATOMIC64_INIT(val) { (val) }
15648
15649 #define __ATOMIC64_DECL(sym) void atomic64_##sym(atomic64_t *, ...)
15650 @@ -37,21 +45,31 @@ typedef struct {
15651 ATOMIC64_DECL_ONE(sym##_386)
15652
15653 ATOMIC64_DECL_ONE(add_386);
15654 +ATOMIC64_DECL_ONE(add_unchecked_386);
15655 ATOMIC64_DECL_ONE(sub_386);
15656 +ATOMIC64_DECL_ONE(sub_unchecked_386);
15657 ATOMIC64_DECL_ONE(inc_386);
15658 +ATOMIC64_DECL_ONE(inc_unchecked_386);
15659 ATOMIC64_DECL_ONE(dec_386);
15660 +ATOMIC64_DECL_ONE(dec_unchecked_386);
15661 #endif
15662
15663 #define alternative_atomic64(f, out, in...) \
15664 __alternative_atomic64(f, f, ASM_OUTPUT2(out), ## in)
15665
15666 ATOMIC64_DECL(read);
15667 +ATOMIC64_DECL(read_unchecked);
15668 ATOMIC64_DECL(set);
15669 +ATOMIC64_DECL(set_unchecked);
15670 ATOMIC64_DECL(xchg);
15671 ATOMIC64_DECL(add_return);
15672 +ATOMIC64_DECL(add_return_unchecked);
15673 ATOMIC64_DECL(sub_return);
15674 +ATOMIC64_DECL(sub_return_unchecked);
15675 ATOMIC64_DECL(inc_return);
15676 +ATOMIC64_DECL(inc_return_unchecked);
15677 ATOMIC64_DECL(dec_return);
15678 +ATOMIC64_DECL(dec_return_unchecked);
15679 ATOMIC64_DECL(dec_if_positive);
15680 ATOMIC64_DECL(inc_not_zero);
15681 ATOMIC64_DECL(add_unless);
15682 @@ -77,6 +95,21 @@ static inline long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n
15683 }
15684
15685 /**
15686 + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
15687 + * @p: pointer to type atomic64_unchecked_t
15688 + * @o: expected value
15689 + * @n: new value
15690 + *
15691 + * Atomically sets @v to @n if it was equal to @o and returns
15692 + * the old value.
15693 + */
15694 +
15695 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
15696 +{
15697 + return cmpxchg64(&v->counter, o, n);
15698 +}
15699 +
15700 +/**
15701 * atomic64_xchg - xchg atomic64 variable
15702 * @v: pointer to type atomic64_t
15703 * @n: value to assign
15704 @@ -112,6 +145,22 @@ static inline void atomic64_set(atomic64_t *v, long long i)
15705 }
15706
15707 /**
15708 + * atomic64_set_unchecked - set atomic64 variable
15709 + * @v: pointer to type atomic64_unchecked_t
15710 + * @n: value to assign
15711 + *
15712 + * Atomically sets the value of @v to @n.
15713 + */
15714 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
15715 +{
15716 + unsigned high = (unsigned)(i >> 32);
15717 + unsigned low = (unsigned)i;
15718 + alternative_atomic64(set, /* no output */,
15719 + "S" (v), "b" (low), "c" (high)
15720 + : "eax", "edx", "memory");
15721 +}
15722 +
15723 +/**
15724 * atomic64_read - read atomic64 variable
15725 * @v: pointer to type atomic64_t
15726 *
15727 @@ -125,6 +174,19 @@ static inline long long atomic64_read(const atomic64_t *v)
15728 }
15729
15730 /**
15731 + * atomic64_read_unchecked - read atomic64 variable
15732 + * @v: pointer to type atomic64_unchecked_t
15733 + *
15734 + * Atomically reads the value of @v and returns it.
15735 + */
15736 +static inline long long __intentional_overflow(-1) atomic64_read_unchecked(atomic64_unchecked_t *v)
15737 +{
15738 + long long r;
15739 + alternative_atomic64(read, "=&A" (r), "c" (v) : "memory");
15740 + return r;
15741 + }
15742 +
15743 +/**
15744 * atomic64_add_return - add and return
15745 * @i: integer value to add
15746 * @v: pointer to type atomic64_t
15747 @@ -139,6 +201,21 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
15748 return i;
15749 }
15750
15751 +/**
15752 + * atomic64_add_return_unchecked - add and return
15753 + * @i: integer value to add
15754 + * @v: pointer to type atomic64_unchecked_t
15755 + *
15756 + * Atomically adds @i to @v and returns @i + *@v
15757 + */
15758 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
15759 +{
15760 + alternative_atomic64(add_return_unchecked,
15761 + ASM_OUTPUT2("+A" (i), "+c" (v)),
15762 + ASM_NO_INPUT_CLOBBER("memory"));
15763 + return i;
15764 +}
15765 +
15766 /*
15767 * Other variants with different arithmetic operators:
15768 */
15769 @@ -158,6 +235,14 @@ static inline long long atomic64_inc_return(atomic64_t *v)
15770 return a;
15771 }
15772
15773 +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
15774 +{
15775 + long long a;
15776 + alternative_atomic64(inc_return_unchecked, "=&A" (a),
15777 + "S" (v) : "memory", "ecx");
15778 + return a;
15779 +}
15780 +
15781 static inline long long atomic64_dec_return(atomic64_t *v)
15782 {
15783 long long a;
15784 @@ -182,6 +267,21 @@ static inline long long atomic64_add(long long i, atomic64_t *v)
15785 }
15786
15787 /**
15788 + * atomic64_add_unchecked - add integer to atomic64 variable
15789 + * @i: integer value to add
15790 + * @v: pointer to type atomic64_unchecked_t
15791 + *
15792 + * Atomically adds @i to @v.
15793 + */
15794 +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
15795 +{
15796 + __alternative_atomic64(add_unchecked, add_return_unchecked,
15797 + ASM_OUTPUT2("+A" (i), "+c" (v)),
15798 + ASM_NO_INPUT_CLOBBER("memory"));
15799 + return i;
15800 +}
15801 +
15802 +/**
15803 * atomic64_sub - subtract the atomic64 variable
15804 * @i: integer value to subtract
15805 * @v: pointer to type atomic64_t
15806 diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
15807 index f8d273e..02f39f3 100644
15808 --- a/arch/x86/include/asm/atomic64_64.h
15809 +++ b/arch/x86/include/asm/atomic64_64.h
15810 @@ -22,6 +22,18 @@ static inline long atomic64_read(const atomic64_t *v)
15811 }
15812
15813 /**
15814 + * atomic64_read_unchecked - read atomic64 variable
15815 + * @v: pointer of type atomic64_unchecked_t
15816 + *
15817 + * Atomically reads the value of @v.
15818 + * Doesn't imply a read memory barrier.
15819 + */
15820 +static inline long __intentional_overflow(-1) atomic64_read_unchecked(const atomic64_unchecked_t *v)
15821 +{
15822 + return ACCESS_ONCE((v)->counter);
15823 +}
15824 +
15825 +/**
15826 * atomic64_set - set atomic64 variable
15827 * @v: pointer to type atomic64_t
15828 * @i: required value
15829 @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
15830 }
15831
15832 /**
15833 + * atomic64_set_unchecked - set atomic64 variable
15834 + * @v: pointer to type atomic64_unchecked_t
15835 + * @i: required value
15836 + *
15837 + * Atomically sets the value of @v to @i.
15838 + */
15839 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
15840 +{
15841 + v->counter = i;
15842 +}
15843 +
15844 +/**
15845 * atomic64_add - add integer to atomic64 variable
15846 * @i: integer value to add
15847 * @v: pointer to type atomic64_t
15848 @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
15849 */
15850 static inline void atomic64_add(long i, atomic64_t *v)
15851 {
15852 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
15853 +
15854 +#ifdef CONFIG_PAX_REFCOUNT
15855 + "jno 0f\n"
15856 + LOCK_PREFIX "subq %1,%0\n"
15857 + "int $4\n0:\n"
15858 + _ASM_EXTABLE(0b, 0b)
15859 +#endif
15860 +
15861 + : "=m" (v->counter)
15862 + : "er" (i), "m" (v->counter));
15863 +}
15864 +
15865 +/**
15866 + * atomic64_add_unchecked - add integer to atomic64 variable
15867 + * @i: integer value to add
15868 + * @v: pointer to type atomic64_unchecked_t
15869 + *
15870 + * Atomically adds @i to @v.
15871 + */
15872 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
15873 +{
15874 asm volatile(LOCK_PREFIX "addq %1,%0"
15875 : "=m" (v->counter)
15876 : "er" (i), "m" (v->counter));
15877 @@ -56,7 +102,29 @@ static inline void atomic64_add(long i, atomic64_t *v)
15878 */
15879 static inline void atomic64_sub(long i, atomic64_t *v)
15880 {
15881 - asm volatile(LOCK_PREFIX "subq %1,%0"
15882 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
15883 +
15884 +#ifdef CONFIG_PAX_REFCOUNT
15885 + "jno 0f\n"
15886 + LOCK_PREFIX "addq %1,%0\n"
15887 + "int $4\n0:\n"
15888 + _ASM_EXTABLE(0b, 0b)
15889 +#endif
15890 +
15891 + : "=m" (v->counter)
15892 + : "er" (i), "m" (v->counter));
15893 +}
15894 +
15895 +/**
15896 + * atomic64_sub_unchecked - subtract the atomic64 variable
15897 + * @i: integer value to subtract
15898 + * @v: pointer to type atomic64_unchecked_t
15899 + *
15900 + * Atomically subtracts @i from @v.
15901 + */
15902 +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
15903 +{
15904 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
15905 : "=m" (v->counter)
15906 : "er" (i), "m" (v->counter));
15907 }
15908 @@ -72,7 +140,7 @@ static inline void atomic64_sub(long i, atomic64_t *v)
15909 */
15910 static inline int atomic64_sub_and_test(long i, atomic64_t *v)
15911 {
15912 - GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, "er", i, "%0", "e");
15913 + GEN_BINARY_RMWcc(LOCK_PREFIX "subq", LOCK_PREFIX "addq", v->counter, "er", i, "%0", "e");
15914 }
15915
15916 /**
15917 @@ -83,6 +151,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
15918 */
15919 static inline void atomic64_inc(atomic64_t *v)
15920 {
15921 + asm volatile(LOCK_PREFIX "incq %0\n"
15922 +
15923 +#ifdef CONFIG_PAX_REFCOUNT
15924 + "jno 0f\n"
15925 + LOCK_PREFIX "decq %0\n"
15926 + "int $4\n0:\n"
15927 + _ASM_EXTABLE(0b, 0b)
15928 +#endif
15929 +
15930 + : "=m" (v->counter)
15931 + : "m" (v->counter));
15932 +}
15933 +
15934 +/**
15935 + * atomic64_inc_unchecked - increment atomic64 variable
15936 + * @v: pointer to type atomic64_unchecked_t
15937 + *
15938 + * Atomically increments @v by 1.
15939 + */
15940 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
15941 +{
15942 asm volatile(LOCK_PREFIX "incq %0"
15943 : "=m" (v->counter)
15944 : "m" (v->counter));
15945 @@ -96,7 +185,28 @@ static inline void atomic64_inc(atomic64_t *v)
15946 */
15947 static inline void atomic64_dec(atomic64_t *v)
15948 {
15949 - asm volatile(LOCK_PREFIX "decq %0"
15950 + asm volatile(LOCK_PREFIX "decq %0\n"
15951 +
15952 +#ifdef CONFIG_PAX_REFCOUNT
15953 + "jno 0f\n"
15954 + LOCK_PREFIX "incq %0\n"
15955 + "int $4\n0:\n"
15956 + _ASM_EXTABLE(0b, 0b)
15957 +#endif
15958 +
15959 + : "=m" (v->counter)
15960 + : "m" (v->counter));
15961 +}
15962 +
15963 +/**
15964 + * atomic64_dec_unchecked - decrement atomic64 variable
15965 + * @v: pointer to type atomic64_t
15966 + *
15967 + * Atomically decrements @v by 1.
15968 + */
15969 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
15970 +{
15971 + asm volatile(LOCK_PREFIX "decq %0\n"
15972 : "=m" (v->counter)
15973 : "m" (v->counter));
15974 }
15975 @@ -111,7 +221,7 @@ static inline void atomic64_dec(atomic64_t *v)
15976 */
15977 static inline int atomic64_dec_and_test(atomic64_t *v)
15978 {
15979 - GEN_UNARY_RMWcc(LOCK_PREFIX "decq", v->counter, "%0", "e");
15980 + GEN_UNARY_RMWcc(LOCK_PREFIX "decq", LOCK_PREFIX "incq", v->counter, "%0", "e");
15981 }
15982
15983 /**
15984 @@ -124,7 +234,7 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
15985 */
15986 static inline int atomic64_inc_and_test(atomic64_t *v)
15987 {
15988 - GEN_UNARY_RMWcc(LOCK_PREFIX "incq", v->counter, "%0", "e");
15989 + GEN_UNARY_RMWcc(LOCK_PREFIX "incq", LOCK_PREFIX "decq", v->counter, "%0", "e");
15990 }
15991
15992 /**
15993 @@ -138,7 +248,7 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
15994 */
15995 static inline int atomic64_add_negative(long i, atomic64_t *v)
15996 {
15997 - GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, "er", i, "%0", "s");
15998 + GEN_BINARY_RMWcc(LOCK_PREFIX "addq", LOCK_PREFIX "subq", v->counter, "er", i, "%0", "s");
15999 }
16000
16001 /**
16002 @@ -150,6 +260,18 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
16003 */
16004 static inline long atomic64_add_return(long i, atomic64_t *v)
16005 {
16006 + return i + xadd_check_overflow(&v->counter, i);
16007 +}
16008 +
16009 +/**
16010 + * atomic64_add_return_unchecked - add and return
16011 + * @i: integer value to add
16012 + * @v: pointer to type atomic64_unchecked_t
16013 + *
16014 + * Atomically adds @i to @v and returns @i + @v
16015 + */
16016 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
16017 +{
16018 return i + xadd(&v->counter, i);
16019 }
16020
16021 @@ -159,6 +281,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
16022 }
16023
16024 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
16025 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
16026 +{
16027 + return atomic64_add_return_unchecked(1, v);
16028 +}
16029 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
16030
16031 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
16032 @@ -166,6 +292,11 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
16033 return cmpxchg(&v->counter, old, new);
16034 }
16035
16036 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
16037 +{
16038 + return cmpxchg(&v->counter, old, new);
16039 +}
16040 +
16041 static inline long atomic64_xchg(atomic64_t *v, long new)
16042 {
16043 return xchg(&v->counter, new);
16044 @@ -182,17 +313,30 @@ static inline long atomic64_xchg(atomic64_t *v, long new)
16045 */
16046 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
16047 {
16048 - long c, old;
16049 + long c, old, new;
16050 c = atomic64_read(v);
16051 for (;;) {
16052 - if (unlikely(c == (u)))
16053 + if (unlikely(c == u))
16054 break;
16055 - old = atomic64_cmpxchg((v), c, c + (a));
16056 +
16057 + asm volatile("add %2,%0\n"
16058 +
16059 +#ifdef CONFIG_PAX_REFCOUNT
16060 + "jno 0f\n"
16061 + "sub %2,%0\n"
16062 + "int $4\n0:\n"
16063 + _ASM_EXTABLE(0b, 0b)
16064 +#endif
16065 +
16066 + : "=r" (new)
16067 + : "0" (c), "ir" (a));
16068 +
16069 + old = atomic64_cmpxchg(v, c, new);
16070 if (likely(old == c))
16071 break;
16072 c = old;
16073 }
16074 - return c != (u);
16075 + return c != u;
16076 }
16077
16078 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
16079 diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
16080 index 959e45b..6ea9bf6 100644
16081 --- a/arch/x86/include/asm/barrier.h
16082 +++ b/arch/x86/include/asm/barrier.h
16083 @@ -57,7 +57,7 @@
16084 do { \
16085 compiletime_assert_atomic_type(*p); \
16086 smp_mb(); \
16087 - ACCESS_ONCE(*p) = (v); \
16088 + ACCESS_ONCE_RW(*p) = (v); \
16089 } while (0)
16090
16091 #define smp_load_acquire(p) \
16092 @@ -74,7 +74,7 @@ do { \
16093 do { \
16094 compiletime_assert_atomic_type(*p); \
16095 barrier(); \
16096 - ACCESS_ONCE(*p) = (v); \
16097 + ACCESS_ONCE_RW(*p) = (v); \
16098 } while (0)
16099
16100 #define smp_load_acquire(p) \
16101 diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
16102 index cfe3b95..d01b118 100644
16103 --- a/arch/x86/include/asm/bitops.h
16104 +++ b/arch/x86/include/asm/bitops.h
16105 @@ -50,7 +50,7 @@
16106 * a mask operation on a byte.
16107 */
16108 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
16109 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
16110 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
16111 #define CONST_MASK(nr) (1 << ((nr) & 7))
16112
16113 /**
16114 @@ -203,7 +203,7 @@ static inline void change_bit(long nr, volatile unsigned long *addr)
16115 */
16116 static inline int test_and_set_bit(long nr, volatile unsigned long *addr)
16117 {
16118 - GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", "c");
16119 + GEN_BINARY_RMWcc_unchecked(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", "c");
16120 }
16121
16122 /**
16123 @@ -249,7 +249,7 @@ static inline int __test_and_set_bit(long nr, volatile unsigned long *addr)
16124 */
16125 static inline int test_and_clear_bit(long nr, volatile unsigned long *addr)
16126 {
16127 - GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", "c");
16128 + GEN_BINARY_RMWcc_unchecked(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", "c");
16129 }
16130
16131 /**
16132 @@ -302,7 +302,7 @@ static inline int __test_and_change_bit(long nr, volatile unsigned long *addr)
16133 */
16134 static inline int test_and_change_bit(long nr, volatile unsigned long *addr)
16135 {
16136 - GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", "c");
16137 + GEN_BINARY_RMWcc_unchecked(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", "c");
16138 }
16139
16140 static __always_inline int constant_test_bit(long nr, const volatile unsigned long *addr)
16141 @@ -343,7 +343,7 @@ static int test_bit(int nr, const volatile unsigned long *addr);
16142 *
16143 * Undefined if no bit exists, so code should check against 0 first.
16144 */
16145 -static inline unsigned long __ffs(unsigned long word)
16146 +static inline unsigned long __intentional_overflow(-1) __ffs(unsigned long word)
16147 {
16148 asm("rep; bsf %1,%0"
16149 : "=r" (word)
16150 @@ -357,7 +357,7 @@ static inline unsigned long __ffs(unsigned long word)
16151 *
16152 * Undefined if no zero exists, so code should check against ~0UL first.
16153 */
16154 -static inline unsigned long ffz(unsigned long word)
16155 +static inline unsigned long __intentional_overflow(-1) ffz(unsigned long word)
16156 {
16157 asm("rep; bsf %1,%0"
16158 : "=r" (word)
16159 @@ -371,7 +371,7 @@ static inline unsigned long ffz(unsigned long word)
16160 *
16161 * Undefined if no set bit exists, so code should check against 0 first.
16162 */
16163 -static inline unsigned long __fls(unsigned long word)
16164 +static inline unsigned long __intentional_overflow(-1) __fls(unsigned long word)
16165 {
16166 asm("bsr %1,%0"
16167 : "=r" (word)
16168 @@ -434,7 +434,7 @@ static inline int ffs(int x)
16169 * set bit if value is nonzero. The last (most significant) bit is
16170 * at position 32.
16171 */
16172 -static inline int fls(int x)
16173 +static inline int __intentional_overflow(-1) fls(int x)
16174 {
16175 int r;
16176
16177 @@ -476,7 +476,7 @@ static inline int fls(int x)
16178 * at position 64.
16179 */
16180 #ifdef CONFIG_X86_64
16181 -static __always_inline int fls64(__u64 x)
16182 +static __always_inline __intentional_overflow(-1) int fls64(__u64 x)
16183 {
16184 int bitpos = -1;
16185 /*
16186 diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
16187 index 4fa687a..60f2d39 100644
16188 --- a/arch/x86/include/asm/boot.h
16189 +++ b/arch/x86/include/asm/boot.h
16190 @@ -6,10 +6,15 @@
16191 #include <uapi/asm/boot.h>
16192
16193 /* Physical address where kernel should be loaded. */
16194 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
16195 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
16196 + (CONFIG_PHYSICAL_ALIGN - 1)) \
16197 & ~(CONFIG_PHYSICAL_ALIGN - 1))
16198
16199 +#ifndef __ASSEMBLY__
16200 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
16201 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
16202 +#endif
16203 +
16204 /* Minimum kernel alignment, as a power of two */
16205 #ifdef CONFIG_X86_64
16206 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
16207 diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
16208 index 48f99f1..d78ebf9 100644
16209 --- a/arch/x86/include/asm/cache.h
16210 +++ b/arch/x86/include/asm/cache.h
16211 @@ -5,12 +5,13 @@
16212
16213 /* L1 cache line size */
16214 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
16215 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
16216 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
16217
16218 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
16219 +#define __read_only __attribute__((__section__(".data..read_only")))
16220
16221 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
16222 -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
16223 +#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
16224
16225 #ifdef CONFIG_X86_VSMP
16226 #ifdef CONFIG_SMP
16227 diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
16228 index 1c8b50e..166bcaa 100644
16229 --- a/arch/x86/include/asm/calling.h
16230 +++ b/arch/x86/include/asm/calling.h
16231 @@ -96,23 +96,26 @@ For 32-bit we have the following conventions - kernel is built with
16232 .endm
16233
16234 .macro SAVE_C_REGS_HELPER offset=0 rax=1 rcx=1 r8910=1 r11=1
16235 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16236 + movq_cfi r12, R12+\offset
16237 +#endif
16238 .if \r11
16239 - movq_cfi r11, 6*8+\offset
16240 + movq_cfi r11, R11+\offset
16241 .endif
16242 .if \r8910
16243 - movq_cfi r10, 7*8+\offset
16244 - movq_cfi r9, 8*8+\offset
16245 - movq_cfi r8, 9*8+\offset
16246 + movq_cfi r10, R10+\offset
16247 + movq_cfi r9, R9+\offset
16248 + movq_cfi r8, R8+\offset
16249 .endif
16250 .if \rax
16251 - movq_cfi rax, 10*8+\offset
16252 + movq_cfi rax, RAX+\offset
16253 .endif
16254 .if \rcx
16255 - movq_cfi rcx, 11*8+\offset
16256 + movq_cfi rcx, RCX+\offset
16257 .endif
16258 - movq_cfi rdx, 12*8+\offset
16259 - movq_cfi rsi, 13*8+\offset
16260 - movq_cfi rdi, 14*8+\offset
16261 + movq_cfi rdx, RDX+\offset
16262 + movq_cfi rsi, RSI+\offset
16263 + movq_cfi rdi, RDI+\offset
16264 .endm
16265 .macro SAVE_C_REGS offset=0
16266 SAVE_C_REGS_HELPER \offset, 1, 1, 1, 1
16267 @@ -131,76 +134,87 @@ For 32-bit we have the following conventions - kernel is built with
16268 .endm
16269
16270 .macro SAVE_EXTRA_REGS offset=0
16271 - movq_cfi r15, 0*8+\offset
16272 - movq_cfi r14, 1*8+\offset
16273 - movq_cfi r13, 2*8+\offset
16274 - movq_cfi r12, 3*8+\offset
16275 - movq_cfi rbp, 4*8+\offset
16276 - movq_cfi rbx, 5*8+\offset
16277 + movq_cfi r15, R15+\offset
16278 + movq_cfi r14, R14+\offset
16279 + movq_cfi r13, R13+\offset
16280 +#ifndef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16281 + movq_cfi r12, R12+\offset
16282 +#endif
16283 + movq_cfi rbp, RBP+\offset
16284 + movq_cfi rbx, RBX+\offset
16285 .endm
16286 .macro SAVE_EXTRA_REGS_RBP offset=0
16287 - movq_cfi rbp, 4*8+\offset
16288 + movq_cfi rbp, RBP+\offset
16289 .endm
16290
16291 .macro RESTORE_EXTRA_REGS offset=0
16292 - movq_cfi_restore 0*8+\offset, r15
16293 - movq_cfi_restore 1*8+\offset, r14
16294 - movq_cfi_restore 2*8+\offset, r13
16295 - movq_cfi_restore 3*8+\offset, r12
16296 - movq_cfi_restore 4*8+\offset, rbp
16297 - movq_cfi_restore 5*8+\offset, rbx
16298 + movq_cfi_restore R15+\offset, r15
16299 + movq_cfi_restore R14+\offset, r14
16300 + movq_cfi_restore R13+\offset, r13
16301 +#ifndef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16302 + movq_cfi_restore R12+\offset, r12
16303 +#endif
16304 + movq_cfi_restore RBP+\offset, rbp
16305 + movq_cfi_restore RBX+\offset, rbx
16306 .endm
16307
16308 .macro ZERO_EXTRA_REGS
16309 xorl %r15d, %r15d
16310 xorl %r14d, %r14d
16311 xorl %r13d, %r13d
16312 +#ifndef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16313 xorl %r12d, %r12d
16314 +#endif
16315 xorl %ebp, %ebp
16316 xorl %ebx, %ebx
16317 .endm
16318
16319 - .macro RESTORE_C_REGS_HELPER rstor_rax=1, rstor_rcx=1, rstor_r11=1, rstor_r8910=1, rstor_rdx=1
16320 + .macro RESTORE_C_REGS_HELPER rstor_rax=1, rstor_rcx=1, rstor_r11=1, rstor_r8910=1, rstor_rdx=1, rstor_r12=1
16321 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16322 + .if \rstor_r12
16323 + movq_cfi_restore R12, r12
16324 + .endif
16325 +#endif
16326 .if \rstor_r11
16327 - movq_cfi_restore 6*8, r11
16328 + movq_cfi_restore R11, r11
16329 .endif
16330 .if \rstor_r8910
16331 - movq_cfi_restore 7*8, r10
16332 - movq_cfi_restore 8*8, r9
16333 - movq_cfi_restore 9*8, r8
16334 + movq_cfi_restore R10, r10
16335 + movq_cfi_restore R9, r9
16336 + movq_cfi_restore R8, r8
16337 .endif
16338 .if \rstor_rax
16339 - movq_cfi_restore 10*8, rax
16340 + movq_cfi_restore RAX, rax
16341 .endif
16342 .if \rstor_rcx
16343 - movq_cfi_restore 11*8, rcx
16344 + movq_cfi_restore RCX, rcx
16345 .endif
16346 .if \rstor_rdx
16347 - movq_cfi_restore 12*8, rdx
16348 + movq_cfi_restore RDX, rdx
16349 .endif
16350 - movq_cfi_restore 13*8, rsi
16351 - movq_cfi_restore 14*8, rdi
16352 + movq_cfi_restore RSI, rsi
16353 + movq_cfi_restore RDI, rdi
16354 .endm
16355 .macro RESTORE_C_REGS
16356 - RESTORE_C_REGS_HELPER 1,1,1,1,1
16357 + RESTORE_C_REGS_HELPER 1,1,1,1,1,1
16358 .endm
16359 .macro RESTORE_C_REGS_EXCEPT_RAX
16360 - RESTORE_C_REGS_HELPER 0,1,1,1,1
16361 + RESTORE_C_REGS_HELPER 0,1,1,1,1,0
16362 .endm
16363 .macro RESTORE_C_REGS_EXCEPT_RCX
16364 - RESTORE_C_REGS_HELPER 1,0,1,1,1
16365 + RESTORE_C_REGS_HELPER 1,0,1,1,1,0
16366 .endm
16367 .macro RESTORE_C_REGS_EXCEPT_R11
16368 - RESTORE_C_REGS_HELPER 1,1,0,1,1
16369 + RESTORE_C_REGS_HELPER 1,1,0,1,1,1
16370 .endm
16371 .macro RESTORE_C_REGS_EXCEPT_RCX_R11
16372 - RESTORE_C_REGS_HELPER 1,0,0,1,1
16373 + RESTORE_C_REGS_HELPER 1,0,0,1,1,1
16374 .endm
16375 .macro RESTORE_RSI_RDI
16376 - RESTORE_C_REGS_HELPER 0,0,0,0,0
16377 + RESTORE_C_REGS_HELPER 0,0,0,0,0,1
16378 .endm
16379 .macro RESTORE_RSI_RDI_RDX
16380 - RESTORE_C_REGS_HELPER 0,0,0,0,1
16381 + RESTORE_C_REGS_HELPER 0,0,0,0,1,1
16382 .endm
16383
16384 .macro REMOVE_PT_GPREGS_FROM_STACK addskip=0
16385 diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
16386 index f50de69..2b0a458 100644
16387 --- a/arch/x86/include/asm/checksum_32.h
16388 +++ b/arch/x86/include/asm/checksum_32.h
16389 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
16390 int len, __wsum sum,
16391 int *src_err_ptr, int *dst_err_ptr);
16392
16393 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
16394 + int len, __wsum sum,
16395 + int *src_err_ptr, int *dst_err_ptr);
16396 +
16397 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
16398 + int len, __wsum sum,
16399 + int *src_err_ptr, int *dst_err_ptr);
16400 +
16401 /*
16402 * Note: when you get a NULL pointer exception here this means someone
16403 * passed in an incorrect kernel address to one of these functions.
16404 @@ -53,7 +61,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
16405
16406 might_sleep();
16407 stac();
16408 - ret = csum_partial_copy_generic((__force void *)src, dst,
16409 + ret = csum_partial_copy_generic_from_user((__force void *)src, dst,
16410 len, sum, err_ptr, NULL);
16411 clac();
16412
16413 @@ -187,7 +195,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
16414 might_sleep();
16415 if (access_ok(VERIFY_WRITE, dst, len)) {
16416 stac();
16417 - ret = csum_partial_copy_generic(src, (__force void *)dst,
16418 + ret = csum_partial_copy_generic_to_user(src, (__force void *)dst,
16419 len, sum, NULL, err_ptr);
16420 clac();
16421 return ret;
16422 diff --git a/arch/x86/include/asm/cmpxchg.h b/arch/x86/include/asm/cmpxchg.h
16423 index 99c105d7..2f667ac 100644
16424 --- a/arch/x86/include/asm/cmpxchg.h
16425 +++ b/arch/x86/include/asm/cmpxchg.h
16426 @@ -16,8 +16,12 @@ extern void __cmpxchg_wrong_size(void)
16427 __compiletime_error("Bad argument size for cmpxchg");
16428 extern void __xadd_wrong_size(void)
16429 __compiletime_error("Bad argument size for xadd");
16430 +extern void __xadd_check_overflow_wrong_size(void)
16431 + __compiletime_error("Bad argument size for xadd_check_overflow");
16432 extern void __add_wrong_size(void)
16433 __compiletime_error("Bad argument size for add");
16434 +extern void __add_check_overflow_wrong_size(void)
16435 + __compiletime_error("Bad argument size for add_check_overflow");
16436
16437 /*
16438 * Constants for operation sizes. On 32-bit, the 64-bit size it set to
16439 @@ -69,6 +73,38 @@ extern void __add_wrong_size(void)
16440 __ret; \
16441 })
16442
16443 +#ifdef CONFIG_PAX_REFCOUNT
16444 +#define __xchg_op_check_overflow(ptr, arg, op, lock) \
16445 + ({ \
16446 + __typeof__ (*(ptr)) __ret = (arg); \
16447 + switch (sizeof(*(ptr))) { \
16448 + case __X86_CASE_L: \
16449 + asm volatile (lock #op "l %0, %1\n" \
16450 + "jno 0f\n" \
16451 + "mov %0,%1\n" \
16452 + "int $4\n0:\n" \
16453 + _ASM_EXTABLE(0b, 0b) \
16454 + : "+r" (__ret), "+m" (*(ptr)) \
16455 + : : "memory", "cc"); \
16456 + break; \
16457 + case __X86_CASE_Q: \
16458 + asm volatile (lock #op "q %q0, %1\n" \
16459 + "jno 0f\n" \
16460 + "mov %0,%1\n" \
16461 + "int $4\n0:\n" \
16462 + _ASM_EXTABLE(0b, 0b) \
16463 + : "+r" (__ret), "+m" (*(ptr)) \
16464 + : : "memory", "cc"); \
16465 + break; \
16466 + default: \
16467 + __ ## op ## _check_overflow_wrong_size(); \
16468 + } \
16469 + __ret; \
16470 + })
16471 +#else
16472 +#define __xchg_op_check_overflow(ptr, arg, op, lock) __xchg_op(ptr, arg, op, lock)
16473 +#endif
16474 +
16475 /*
16476 * Note: no "lock" prefix even on SMP: xchg always implies lock anyway.
16477 * Since this is generally used to protect other memory information, we
16478 @@ -167,6 +203,9 @@ extern void __add_wrong_size(void)
16479 #define xadd_sync(ptr, inc) __xadd((ptr), (inc), "lock; ")
16480 #define xadd_local(ptr, inc) __xadd((ptr), (inc), "")
16481
16482 +#define __xadd_check_overflow(ptr, inc, lock) __xchg_op_check_overflow((ptr), (inc), xadd, lock)
16483 +#define xadd_check_overflow(ptr, inc) __xadd_check_overflow((ptr), (inc), LOCK_PREFIX)
16484 +
16485 #define __add(ptr, inc, lock) \
16486 ({ \
16487 __typeof__ (*(ptr)) __ret = (inc); \
16488 diff --git a/arch/x86/include/asm/compat.h b/arch/x86/include/asm/compat.h
16489 index acdee09..a553db3 100644
16490 --- a/arch/x86/include/asm/compat.h
16491 +++ b/arch/x86/include/asm/compat.h
16492 @@ -41,7 +41,7 @@ typedef s64 __attribute__((aligned(4))) compat_s64;
16493 typedef u32 compat_uint_t;
16494 typedef u32 compat_ulong_t;
16495 typedef u64 __attribute__((aligned(4))) compat_u64;
16496 -typedef u32 compat_uptr_t;
16497 +typedef u32 __user compat_uptr_t;
16498
16499 struct compat_timespec {
16500 compat_time_t tv_sec;
16501 diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
16502 index 3d6606f..91703f1 100644
16503 --- a/arch/x86/include/asm/cpufeature.h
16504 +++ b/arch/x86/include/asm/cpufeature.h
16505 @@ -214,7 +214,7 @@
16506 #define X86_FEATURE_PAUSEFILTER ( 8*32+13) /* AMD filtered pause intercept */
16507 #define X86_FEATURE_PFTHRESHOLD ( 8*32+14) /* AMD pause filter threshold */
16508 #define X86_FEATURE_VMMCALL ( 8*32+15) /* Prefer vmmcall to vmcall */
16509 -
16510 +#define X86_FEATURE_STRONGUDEREF (8*32+31) /* PaX PCID based strong UDEREF */
16511
16512 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
16513 #define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/
16514 @@ -222,7 +222,7 @@
16515 #define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */
16516 #define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */
16517 #define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */
16518 -#define X86_FEATURE_SMEP ( 9*32+ 7) /* Supervisor Mode Execution Protection */
16519 +#define X86_FEATURE_SMEP ( 9*32+ 7) /* Supervisor Mode Execution Prevention */
16520 #define X86_FEATURE_BMI2 ( 9*32+ 8) /* 2nd group bit manipulation extensions */
16521 #define X86_FEATURE_ERMS ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB */
16522 #define X86_FEATURE_INVPCID ( 9*32+10) /* Invalidate Processor Context ID */
16523 @@ -401,6 +401,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
16524 #define cpu_has_eager_fpu boot_cpu_has(X86_FEATURE_EAGER_FPU)
16525 #define cpu_has_topoext boot_cpu_has(X86_FEATURE_TOPOEXT)
16526 #define cpu_has_bpext boot_cpu_has(X86_FEATURE_BPEXT)
16527 +#define cpu_has_pcid boot_cpu_has(X86_FEATURE_PCID)
16528
16529 #if __GNUC__ >= 4
16530 extern void warn_pre_alternatives(void);
16531 @@ -454,7 +455,8 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
16532
16533 #ifdef CONFIG_X86_DEBUG_STATIC_CPU_HAS
16534 t_warn:
16535 - warn_pre_alternatives();
16536 + if (bit != X86_FEATURE_PCID && bit != X86_FEATURE_INVPCID)
16537 + warn_pre_alternatives();
16538 return false;
16539 #endif
16540
16541 @@ -475,7 +477,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
16542 ".section .discard,\"aw\",@progbits\n"
16543 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
16544 ".previous\n"
16545 - ".section .altinstr_replacement,\"ax\"\n"
16546 + ".section .altinstr_replacement,\"a\"\n"
16547 "3: movb $1,%0\n"
16548 "4:\n"
16549 ".previous\n"
16550 @@ -510,7 +512,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
16551 " .byte 5f - 4f\n" /* repl len */
16552 " .byte 3b - 2b\n" /* pad len */
16553 ".previous\n"
16554 - ".section .altinstr_replacement,\"ax\"\n"
16555 + ".section .altinstr_replacement,\"a\"\n"
16556 "4: jmp %l[t_no]\n"
16557 "5:\n"
16558 ".previous\n"
16559 @@ -545,7 +547,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
16560 ".section .discard,\"aw\",@progbits\n"
16561 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
16562 ".previous\n"
16563 - ".section .altinstr_replacement,\"ax\"\n"
16564 + ".section .altinstr_replacement,\"a\"\n"
16565 "3: movb $0,%0\n"
16566 "4:\n"
16567 ".previous\n"
16568 @@ -560,7 +562,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
16569 ".section .discard,\"aw\",@progbits\n"
16570 " .byte 0xff + (6f-5f) - (4b-3b)\n" /* size check */
16571 ".previous\n"
16572 - ".section .altinstr_replacement,\"ax\"\n"
16573 + ".section .altinstr_replacement,\"a\"\n"
16574 "5: movb $1,%0\n"
16575 "6:\n"
16576 ".previous\n"
16577 diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
16578 index a0bf89f..56f0b2a 100644
16579 --- a/arch/x86/include/asm/desc.h
16580 +++ b/arch/x86/include/asm/desc.h
16581 @@ -4,6 +4,7 @@
16582 #include <asm/desc_defs.h>
16583 #include <asm/ldt.h>
16584 #include <asm/mmu.h>
16585 +#include <asm/pgtable.h>
16586
16587 #include <linux/smp.h>
16588 #include <linux/percpu.h>
16589 @@ -17,6 +18,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
16590
16591 desc->type = (info->read_exec_only ^ 1) << 1;
16592 desc->type |= info->contents << 2;
16593 + desc->type |= info->seg_not_present ^ 1;
16594
16595 desc->s = 1;
16596 desc->dpl = 0x3;
16597 @@ -35,19 +37,14 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
16598 }
16599
16600 extern struct desc_ptr idt_descr;
16601 -extern gate_desc idt_table[];
16602 -extern struct desc_ptr debug_idt_descr;
16603 -extern gate_desc debug_idt_table[];
16604 -
16605 -struct gdt_page {
16606 - struct desc_struct gdt[GDT_ENTRIES];
16607 -} __attribute__((aligned(PAGE_SIZE)));
16608 -
16609 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
16610 +extern gate_desc idt_table[IDT_ENTRIES];
16611 +extern const struct desc_ptr debug_idt_descr;
16612 +extern gate_desc debug_idt_table[IDT_ENTRIES];
16613
16614 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
16615 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
16616 {
16617 - return per_cpu(gdt_page, cpu).gdt;
16618 + return cpu_gdt_table[cpu];
16619 }
16620
16621 #ifdef CONFIG_X86_64
16622 @@ -72,8 +69,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
16623 unsigned long base, unsigned dpl, unsigned flags,
16624 unsigned short seg)
16625 {
16626 - gate->a = (seg << 16) | (base & 0xffff);
16627 - gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
16628 + gate->gate.offset_low = base;
16629 + gate->gate.seg = seg;
16630 + gate->gate.reserved = 0;
16631 + gate->gate.type = type;
16632 + gate->gate.s = 0;
16633 + gate->gate.dpl = dpl;
16634 + gate->gate.p = 1;
16635 + gate->gate.offset_high = base >> 16;
16636 }
16637
16638 #endif
16639 @@ -118,12 +121,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
16640
16641 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
16642 {
16643 + pax_open_kernel();
16644 memcpy(&idt[entry], gate, sizeof(*gate));
16645 + pax_close_kernel();
16646 }
16647
16648 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
16649 {
16650 + pax_open_kernel();
16651 memcpy(&ldt[entry], desc, 8);
16652 + pax_close_kernel();
16653 }
16654
16655 static inline void
16656 @@ -137,7 +144,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int
16657 default: size = sizeof(*gdt); break;
16658 }
16659
16660 + pax_open_kernel();
16661 memcpy(&gdt[entry], desc, size);
16662 + pax_close_kernel();
16663 }
16664
16665 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
16666 @@ -210,7 +219,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
16667
16668 static inline void native_load_tr_desc(void)
16669 {
16670 + pax_open_kernel();
16671 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
16672 + pax_close_kernel();
16673 }
16674
16675 static inline void native_load_gdt(const struct desc_ptr *dtr)
16676 @@ -247,8 +258,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
16677 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
16678 unsigned int i;
16679
16680 + pax_open_kernel();
16681 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
16682 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
16683 + pax_close_kernel();
16684 }
16685
16686 /* This intentionally ignores lm, since 32-bit apps don't have that field. */
16687 @@ -295,7 +308,7 @@ static inline void load_LDT(mm_context_t *pc)
16688 preempt_enable();
16689 }
16690
16691 -static inline unsigned long get_desc_base(const struct desc_struct *desc)
16692 +static inline unsigned long __intentional_overflow(-1) get_desc_base(const struct desc_struct *desc)
16693 {
16694 return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
16695 }
16696 @@ -319,7 +332,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
16697 }
16698
16699 #ifdef CONFIG_X86_64
16700 -static inline void set_nmi_gate(int gate, void *addr)
16701 +static inline void set_nmi_gate(int gate, const void *addr)
16702 {
16703 gate_desc s;
16704
16705 @@ -329,14 +342,14 @@ static inline void set_nmi_gate(int gate, void *addr)
16706 #endif
16707
16708 #ifdef CONFIG_TRACING
16709 -extern struct desc_ptr trace_idt_descr;
16710 -extern gate_desc trace_idt_table[];
16711 +extern const struct desc_ptr trace_idt_descr;
16712 +extern gate_desc trace_idt_table[IDT_ENTRIES];
16713 static inline void write_trace_idt_entry(int entry, const gate_desc *gate)
16714 {
16715 write_idt_entry(trace_idt_table, entry, gate);
16716 }
16717
16718 -static inline void _trace_set_gate(int gate, unsigned type, void *addr,
16719 +static inline void _trace_set_gate(int gate, unsigned type, const void *addr,
16720 unsigned dpl, unsigned ist, unsigned seg)
16721 {
16722 gate_desc s;
16723 @@ -356,7 +369,7 @@ static inline void write_trace_idt_entry(int entry, const gate_desc *gate)
16724 #define _trace_set_gate(gate, type, addr, dpl, ist, seg)
16725 #endif
16726
16727 -static inline void _set_gate(int gate, unsigned type, void *addr,
16728 +static inline void _set_gate(int gate, unsigned type, const void *addr,
16729 unsigned dpl, unsigned ist, unsigned seg)
16730 {
16731 gate_desc s;
16732 @@ -379,14 +392,14 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
16733 #define set_intr_gate_notrace(n, addr) \
16734 do { \
16735 BUG_ON((unsigned)n > 0xFF); \
16736 - _set_gate(n, GATE_INTERRUPT, (void *)addr, 0, 0, \
16737 + _set_gate(n, GATE_INTERRUPT, (const void *)addr, 0, 0, \
16738 __KERNEL_CS); \
16739 } while (0)
16740
16741 #define set_intr_gate(n, addr) \
16742 do { \
16743 set_intr_gate_notrace(n, addr); \
16744 - _trace_set_gate(n, GATE_INTERRUPT, (void *)trace_##addr,\
16745 + _trace_set_gate(n, GATE_INTERRUPT, (const void *)trace_##addr,\
16746 0, 0, __KERNEL_CS); \
16747 } while (0)
16748
16749 @@ -414,19 +427,19 @@ static inline void alloc_system_vector(int vector)
16750 /*
16751 * This routine sets up an interrupt gate at directory privilege level 3.
16752 */
16753 -static inline void set_system_intr_gate(unsigned int n, void *addr)
16754 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
16755 {
16756 BUG_ON((unsigned)n > 0xFF);
16757 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
16758 }
16759
16760 -static inline void set_system_trap_gate(unsigned int n, void *addr)
16761 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
16762 {
16763 BUG_ON((unsigned)n > 0xFF);
16764 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
16765 }
16766
16767 -static inline void set_trap_gate(unsigned int n, void *addr)
16768 +static inline void set_trap_gate(unsigned int n, const void *addr)
16769 {
16770 BUG_ON((unsigned)n > 0xFF);
16771 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
16772 @@ -435,16 +448,16 @@ static inline void set_trap_gate(unsigned int n, void *addr)
16773 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
16774 {
16775 BUG_ON((unsigned)n > 0xFF);
16776 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
16777 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
16778 }
16779
16780 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
16781 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
16782 {
16783 BUG_ON((unsigned)n > 0xFF);
16784 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
16785 }
16786
16787 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
16788 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
16789 {
16790 BUG_ON((unsigned)n > 0xFF);
16791 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
16792 @@ -516,4 +529,17 @@ static inline void load_current_idt(void)
16793 else
16794 load_idt((const struct desc_ptr *)&idt_descr);
16795 }
16796 +
16797 +#ifdef CONFIG_X86_32
16798 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
16799 +{
16800 + struct desc_struct d;
16801 +
16802 + if (likely(limit))
16803 + limit = (limit - 1UL) >> PAGE_SHIFT;
16804 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
16805 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
16806 +}
16807 +#endif
16808 +
16809 #endif /* _ASM_X86_DESC_H */
16810 diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
16811 index 278441f..b95a174 100644
16812 --- a/arch/x86/include/asm/desc_defs.h
16813 +++ b/arch/x86/include/asm/desc_defs.h
16814 @@ -31,6 +31,12 @@ struct desc_struct {
16815 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
16816 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
16817 };
16818 + struct {
16819 + u16 offset_low;
16820 + u16 seg;
16821 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
16822 + unsigned offset_high: 16;
16823 + } gate;
16824 };
16825 } __attribute__((packed));
16826
16827 diff --git a/arch/x86/include/asm/div64.h b/arch/x86/include/asm/div64.h
16828 index ced283a..ffe04cc 100644
16829 --- a/arch/x86/include/asm/div64.h
16830 +++ b/arch/x86/include/asm/div64.h
16831 @@ -39,7 +39,7 @@
16832 __mod; \
16833 })
16834
16835 -static inline u64 div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
16836 +static inline u64 __intentional_overflow(-1) div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
16837 {
16838 union {
16839 u64 v64;
16840 diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
16841 index f161c18..97d43e8 100644
16842 --- a/arch/x86/include/asm/elf.h
16843 +++ b/arch/x86/include/asm/elf.h
16844 @@ -75,9 +75,6 @@ typedef struct user_fxsr_struct elf_fpxregset_t;
16845
16846 #include <asm/vdso.h>
16847
16848 -#ifdef CONFIG_X86_64
16849 -extern unsigned int vdso64_enabled;
16850 -#endif
16851 #if defined(CONFIG_X86_32) || defined(CONFIG_COMPAT)
16852 extern unsigned int vdso32_enabled;
16853 #endif
16854 @@ -250,7 +247,25 @@ extern int force_personality32;
16855 the loader. We need to make sure that it is out of the way of the program
16856 that it will "exec", and that there is sufficient room for the brk. */
16857
16858 +#ifdef CONFIG_PAX_SEGMEXEC
16859 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
16860 +#else
16861 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
16862 +#endif
16863 +
16864 +#ifdef CONFIG_PAX_ASLR
16865 +#ifdef CONFIG_X86_32
16866 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
16867 +
16868 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
16869 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
16870 +#else
16871 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
16872 +
16873 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_ADDR32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
16874 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_ADDR32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
16875 +#endif
16876 +#endif
16877
16878 /* This yields a mask that user programs can use to figure out what
16879 instruction set this CPU supports. This could be done in user space,
16880 @@ -299,17 +314,13 @@ do { \
16881
16882 #define ARCH_DLINFO \
16883 do { \
16884 - if (vdso64_enabled) \
16885 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
16886 - (unsigned long __force)current->mm->context.vdso); \
16887 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
16888 } while (0)
16889
16890 /* As a historical oddity, the x32 and x86_64 vDSOs are controlled together. */
16891 #define ARCH_DLINFO_X32 \
16892 do { \
16893 - if (vdso64_enabled) \
16894 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
16895 - (unsigned long __force)current->mm->context.vdso); \
16896 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
16897 } while (0)
16898
16899 #define AT_SYSINFO 32
16900 @@ -324,10 +335,10 @@ else \
16901
16902 #endif /* !CONFIG_X86_32 */
16903
16904 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
16905 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
16906
16907 #define VDSO_ENTRY \
16908 - ((unsigned long)current->mm->context.vdso + \
16909 + (current->mm->context.vdso + \
16910 selected_vdso32->sym___kernel_vsyscall)
16911
16912 struct linux_binprm;
16913 diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
16914 index 77a99ac..39ff7f5 100644
16915 --- a/arch/x86/include/asm/emergency-restart.h
16916 +++ b/arch/x86/include/asm/emergency-restart.h
16917 @@ -1,6 +1,6 @@
16918 #ifndef _ASM_X86_EMERGENCY_RESTART_H
16919 #define _ASM_X86_EMERGENCY_RESTART_H
16920
16921 -extern void machine_emergency_restart(void);
16922 +extern void machine_emergency_restart(void) __noreturn;
16923
16924 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
16925 diff --git a/arch/x86/include/asm/floppy.h b/arch/x86/include/asm/floppy.h
16926 index 1c7eefe..d0e4702 100644
16927 --- a/arch/x86/include/asm/floppy.h
16928 +++ b/arch/x86/include/asm/floppy.h
16929 @@ -229,18 +229,18 @@ static struct fd_routine_l {
16930 int (*_dma_setup)(char *addr, unsigned long size, int mode, int io);
16931 } fd_routine[] = {
16932 {
16933 - request_dma,
16934 - free_dma,
16935 - get_dma_residue,
16936 - dma_mem_alloc,
16937 - hard_dma_setup
16938 + ._request_dma = request_dma,
16939 + ._free_dma = free_dma,
16940 + ._get_dma_residue = get_dma_residue,
16941 + ._dma_mem_alloc = dma_mem_alloc,
16942 + ._dma_setup = hard_dma_setup
16943 },
16944 {
16945 - vdma_request_dma,
16946 - vdma_nop,
16947 - vdma_get_dma_residue,
16948 - vdma_mem_alloc,
16949 - vdma_dma_setup
16950 + ._request_dma = vdma_request_dma,
16951 + ._free_dma = vdma_nop,
16952 + ._get_dma_residue = vdma_get_dma_residue,
16953 + ._dma_mem_alloc = vdma_mem_alloc,
16954 + ._dma_setup = vdma_dma_setup
16955 }
16956 };
16957
16958 diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
16959 index da5e967..ab07eec 100644
16960 --- a/arch/x86/include/asm/fpu-internal.h
16961 +++ b/arch/x86/include/asm/fpu-internal.h
16962 @@ -151,8 +151,11 @@ static inline void sanitize_i387_state(struct task_struct *tsk)
16963 #define user_insn(insn, output, input...) \
16964 ({ \
16965 int err; \
16966 + pax_open_userland(); \
16967 asm volatile(ASM_STAC "\n" \
16968 - "1:" #insn "\n\t" \
16969 + "1:" \
16970 + __copyuser_seg \
16971 + #insn "\n\t" \
16972 "2: " ASM_CLAC "\n" \
16973 ".section .fixup,\"ax\"\n" \
16974 "3: movl $-1,%[err]\n" \
16975 @@ -161,6 +164,7 @@ static inline void sanitize_i387_state(struct task_struct *tsk)
16976 _ASM_EXTABLE(1b, 3b) \
16977 : [err] "=r" (err), output \
16978 : "0"(0), input); \
16979 + pax_close_userland(); \
16980 err; \
16981 })
16982
16983 @@ -327,7 +331,7 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
16984 "fnclex\n\t"
16985 "emms\n\t"
16986 "fildl %P[addr]" /* set F?P to defined value */
16987 - : : [addr] "m" (tsk->thread.fpu.has_fpu));
16988 + : : [addr] "m" (cpu_tss[raw_smp_processor_id()].x86_tss.sp0));
16989 }
16990
16991 return fpu_restore_checking(&tsk->thread.fpu);
16992 diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
16993 index b4c1f54..e290c08 100644
16994 --- a/arch/x86/include/asm/futex.h
16995 +++ b/arch/x86/include/asm/futex.h
16996 @@ -12,6 +12,7 @@
16997 #include <asm/smap.h>
16998
16999 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
17000 + typecheck(u32 __user *, uaddr); \
17001 asm volatile("\t" ASM_STAC "\n" \
17002 "1:\t" insn "\n" \
17003 "2:\t" ASM_CLAC "\n" \
17004 @@ -20,15 +21,16 @@
17005 "\tjmp\t2b\n" \
17006 "\t.previous\n" \
17007 _ASM_EXTABLE(1b, 3b) \
17008 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
17009 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr)) \
17010 : "i" (-EFAULT), "0" (oparg), "1" (0))
17011
17012 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
17013 + typecheck(u32 __user *, uaddr); \
17014 asm volatile("\t" ASM_STAC "\n" \
17015 "1:\tmovl %2, %0\n" \
17016 "\tmovl\t%0, %3\n" \
17017 "\t" insn "\n" \
17018 - "2:\t" LOCK_PREFIX "cmpxchgl %3, %2\n" \
17019 + "2:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %2\n" \
17020 "\tjnz\t1b\n" \
17021 "3:\t" ASM_CLAC "\n" \
17022 "\t.section .fixup,\"ax\"\n" \
17023 @@ -38,7 +40,7 @@
17024 _ASM_EXTABLE(1b, 4b) \
17025 _ASM_EXTABLE(2b, 4b) \
17026 : "=&a" (oldval), "=&r" (ret), \
17027 - "+m" (*uaddr), "=&r" (tem) \
17028 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
17029 : "r" (oparg), "i" (-EFAULT), "1" (0))
17030
17031 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
17032 @@ -57,12 +59,13 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
17033
17034 pagefault_disable();
17035
17036 + pax_open_userland();
17037 switch (op) {
17038 case FUTEX_OP_SET:
17039 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
17040 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
17041 break;
17042 case FUTEX_OP_ADD:
17043 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
17044 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
17045 uaddr, oparg);
17046 break;
17047 case FUTEX_OP_OR:
17048 @@ -77,6 +80,7 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
17049 default:
17050 ret = -ENOSYS;
17051 }
17052 + pax_close_userland();
17053
17054 pagefault_enable();
17055
17056 diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
17057 index e9571dd..df5f542 100644
17058 --- a/arch/x86/include/asm/hw_irq.h
17059 +++ b/arch/x86/include/asm/hw_irq.h
17060 @@ -160,8 +160,8 @@ static inline void unlock_vector_lock(void) {}
17061 #endif /* CONFIG_X86_LOCAL_APIC */
17062
17063 /* Statistics */
17064 -extern atomic_t irq_err_count;
17065 -extern atomic_t irq_mis_count;
17066 +extern atomic_unchecked_t irq_err_count;
17067 +extern atomic_unchecked_t irq_mis_count;
17068
17069 /* EISA */
17070 extern void eisa_set_level_irq(unsigned int irq);
17071 diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h
17072 index ccffa53..3c90c87 100644
17073 --- a/arch/x86/include/asm/i8259.h
17074 +++ b/arch/x86/include/asm/i8259.h
17075 @@ -62,7 +62,7 @@ struct legacy_pic {
17076 void (*init)(int auto_eoi);
17077 int (*irq_pending)(unsigned int irq);
17078 void (*make_irq)(unsigned int irq);
17079 -};
17080 +} __do_const;
17081
17082 extern struct legacy_pic *legacy_pic;
17083 extern struct legacy_pic null_legacy_pic;
17084 diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
17085 index 34a5b93..27e40a6 100644
17086 --- a/arch/x86/include/asm/io.h
17087 +++ b/arch/x86/include/asm/io.h
17088 @@ -52,12 +52,12 @@ static inline void name(type val, volatile void __iomem *addr) \
17089 "m" (*(volatile type __force *)addr) barrier); }
17090
17091 build_mmio_read(readb, "b", unsigned char, "=q", :"memory")
17092 -build_mmio_read(readw, "w", unsigned short, "=r", :"memory")
17093 -build_mmio_read(readl, "l", unsigned int, "=r", :"memory")
17094 +build_mmio_read(__intentional_overflow(-1) readw, "w", unsigned short, "=r", :"memory")
17095 +build_mmio_read(__intentional_overflow(-1) readl, "l", unsigned int, "=r", :"memory")
17096
17097 build_mmio_read(__readb, "b", unsigned char, "=q", )
17098 -build_mmio_read(__readw, "w", unsigned short, "=r", )
17099 -build_mmio_read(__readl, "l", unsigned int, "=r", )
17100 +build_mmio_read(__intentional_overflow(-1) __readw, "w", unsigned short, "=r", )
17101 +build_mmio_read(__intentional_overflow(-1) __readl, "l", unsigned int, "=r", )
17102
17103 build_mmio_write(writeb, "b", unsigned char, "q", :"memory")
17104 build_mmio_write(writew, "w", unsigned short, "r", :"memory")
17105 @@ -113,7 +113,7 @@ build_mmio_write(writeq, "q", unsigned long, "r", :"memory")
17106 * this function
17107 */
17108
17109 -static inline phys_addr_t virt_to_phys(volatile void *address)
17110 +static inline phys_addr_t __intentional_overflow(-1) virt_to_phys(volatile void *address)
17111 {
17112 return __pa(address);
17113 }
17114 @@ -189,7 +189,7 @@ static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
17115 return ioremap_nocache(offset, size);
17116 }
17117
17118 -extern void iounmap(volatile void __iomem *addr);
17119 +extern void iounmap(const volatile void __iomem *addr);
17120
17121 extern void set_iounmap_nonlazy(void);
17122
17123 @@ -199,6 +199,17 @@ extern void set_iounmap_nonlazy(void);
17124
17125 #include <linux/vmalloc.h>
17126
17127 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
17128 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
17129 +{
17130 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
17131 +}
17132 +
17133 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
17134 +{
17135 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
17136 +}
17137 +
17138 /*
17139 * Convert a virtual cached pointer to an uncached pointer
17140 */
17141 diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
17142 index b77f5ed..a2f791e 100644
17143 --- a/arch/x86/include/asm/irqflags.h
17144 +++ b/arch/x86/include/asm/irqflags.h
17145 @@ -137,6 +137,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
17146 swapgs; \
17147 sysretl
17148
17149 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
17150 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
17151 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
17152 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
17153 +
17154 #else
17155 #define INTERRUPT_RETURN iret
17156 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
17157 diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
17158 index 4421b5d..8543006 100644
17159 --- a/arch/x86/include/asm/kprobes.h
17160 +++ b/arch/x86/include/asm/kprobes.h
17161 @@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
17162 #define RELATIVEJUMP_SIZE 5
17163 #define RELATIVECALL_OPCODE 0xe8
17164 #define RELATIVE_ADDR_SIZE 4
17165 -#define MAX_STACK_SIZE 64
17166 -#define MIN_STACK_SIZE(ADDR) \
17167 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
17168 - THREAD_SIZE - (unsigned long)(ADDR))) \
17169 - ? (MAX_STACK_SIZE) \
17170 - : (((unsigned long)current_thread_info()) + \
17171 - THREAD_SIZE - (unsigned long)(ADDR)))
17172 +#define MAX_STACK_SIZE 64UL
17173 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
17174
17175 #define flush_insn_slot(p) do { } while (0)
17176
17177 diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
17178 index 4ad6560..75c7bdd 100644
17179 --- a/arch/x86/include/asm/local.h
17180 +++ b/arch/x86/include/asm/local.h
17181 @@ -10,33 +10,97 @@ typedef struct {
17182 atomic_long_t a;
17183 } local_t;
17184
17185 +typedef struct {
17186 + atomic_long_unchecked_t a;
17187 +} local_unchecked_t;
17188 +
17189 #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
17190
17191 #define local_read(l) atomic_long_read(&(l)->a)
17192 +#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
17193 #define local_set(l, i) atomic_long_set(&(l)->a, (i))
17194 +#define local_set_unchecked(l, i) atomic_long_set_unchecked(&(l)->a, (i))
17195
17196 static inline void local_inc(local_t *l)
17197 {
17198 - asm volatile(_ASM_INC "%0"
17199 + asm volatile(_ASM_INC "%0\n"
17200 +
17201 +#ifdef CONFIG_PAX_REFCOUNT
17202 + "jno 0f\n"
17203 + _ASM_DEC "%0\n"
17204 + "int $4\n0:\n"
17205 + _ASM_EXTABLE(0b, 0b)
17206 +#endif
17207 +
17208 + : "+m" (l->a.counter));
17209 +}
17210 +
17211 +static inline void local_inc_unchecked(local_unchecked_t *l)
17212 +{
17213 + asm volatile(_ASM_INC "%0\n"
17214 : "+m" (l->a.counter));
17215 }
17216
17217 static inline void local_dec(local_t *l)
17218 {
17219 - asm volatile(_ASM_DEC "%0"
17220 + asm volatile(_ASM_DEC "%0\n"
17221 +
17222 +#ifdef CONFIG_PAX_REFCOUNT
17223 + "jno 0f\n"
17224 + _ASM_INC "%0\n"
17225 + "int $4\n0:\n"
17226 + _ASM_EXTABLE(0b, 0b)
17227 +#endif
17228 +
17229 + : "+m" (l->a.counter));
17230 +}
17231 +
17232 +static inline void local_dec_unchecked(local_unchecked_t *l)
17233 +{
17234 + asm volatile(_ASM_DEC "%0\n"
17235 : "+m" (l->a.counter));
17236 }
17237
17238 static inline void local_add(long i, local_t *l)
17239 {
17240 - asm volatile(_ASM_ADD "%1,%0"
17241 + asm volatile(_ASM_ADD "%1,%0\n"
17242 +
17243 +#ifdef CONFIG_PAX_REFCOUNT
17244 + "jno 0f\n"
17245 + _ASM_SUB "%1,%0\n"
17246 + "int $4\n0:\n"
17247 + _ASM_EXTABLE(0b, 0b)
17248 +#endif
17249 +
17250 + : "+m" (l->a.counter)
17251 + : "ir" (i));
17252 +}
17253 +
17254 +static inline void local_add_unchecked(long i, local_unchecked_t *l)
17255 +{
17256 + asm volatile(_ASM_ADD "%1,%0\n"
17257 : "+m" (l->a.counter)
17258 : "ir" (i));
17259 }
17260
17261 static inline void local_sub(long i, local_t *l)
17262 {
17263 - asm volatile(_ASM_SUB "%1,%0"
17264 + asm volatile(_ASM_SUB "%1,%0\n"
17265 +
17266 +#ifdef CONFIG_PAX_REFCOUNT
17267 + "jno 0f\n"
17268 + _ASM_ADD "%1,%0\n"
17269 + "int $4\n0:\n"
17270 + _ASM_EXTABLE(0b, 0b)
17271 +#endif
17272 +
17273 + : "+m" (l->a.counter)
17274 + : "ir" (i));
17275 +}
17276 +
17277 +static inline void local_sub_unchecked(long i, local_unchecked_t *l)
17278 +{
17279 + asm volatile(_ASM_SUB "%1,%0\n"
17280 : "+m" (l->a.counter)
17281 : "ir" (i));
17282 }
17283 @@ -52,7 +116,7 @@ static inline void local_sub(long i, local_t *l)
17284 */
17285 static inline int local_sub_and_test(long i, local_t *l)
17286 {
17287 - GEN_BINARY_RMWcc(_ASM_SUB, l->a.counter, "er", i, "%0", "e");
17288 + GEN_BINARY_RMWcc(_ASM_SUB, _ASM_ADD, l->a.counter, "er", i, "%0", "e");
17289 }
17290
17291 /**
17292 @@ -65,7 +129,7 @@ static inline int local_sub_and_test(long i, local_t *l)
17293 */
17294 static inline int local_dec_and_test(local_t *l)
17295 {
17296 - GEN_UNARY_RMWcc(_ASM_DEC, l->a.counter, "%0", "e");
17297 + GEN_UNARY_RMWcc(_ASM_DEC, _ASM_INC, l->a.counter, "%0", "e");
17298 }
17299
17300 /**
17301 @@ -78,7 +142,7 @@ static inline int local_dec_and_test(local_t *l)
17302 */
17303 static inline int local_inc_and_test(local_t *l)
17304 {
17305 - GEN_UNARY_RMWcc(_ASM_INC, l->a.counter, "%0", "e");
17306 + GEN_UNARY_RMWcc(_ASM_INC, _ASM_DEC, l->a.counter, "%0", "e");
17307 }
17308
17309 /**
17310 @@ -92,7 +156,7 @@ static inline int local_inc_and_test(local_t *l)
17311 */
17312 static inline int local_add_negative(long i, local_t *l)
17313 {
17314 - GEN_BINARY_RMWcc(_ASM_ADD, l->a.counter, "er", i, "%0", "s");
17315 + GEN_BINARY_RMWcc(_ASM_ADD, _ASM_SUB, l->a.counter, "er", i, "%0", "s");
17316 }
17317
17318 /**
17319 @@ -105,6 +169,30 @@ static inline int local_add_negative(long i, local_t *l)
17320 static inline long local_add_return(long i, local_t *l)
17321 {
17322 long __i = i;
17323 + asm volatile(_ASM_XADD "%0, %1\n"
17324 +
17325 +#ifdef CONFIG_PAX_REFCOUNT
17326 + "jno 0f\n"
17327 + _ASM_MOV "%0,%1\n"
17328 + "int $4\n0:\n"
17329 + _ASM_EXTABLE(0b, 0b)
17330 +#endif
17331 +
17332 + : "+r" (i), "+m" (l->a.counter)
17333 + : : "memory");
17334 + return i + __i;
17335 +}
17336 +
17337 +/**
17338 + * local_add_return_unchecked - add and return
17339 + * @i: integer value to add
17340 + * @l: pointer to type local_unchecked_t
17341 + *
17342 + * Atomically adds @i to @l and returns @i + @l
17343 + */
17344 +static inline long local_add_return_unchecked(long i, local_unchecked_t *l)
17345 +{
17346 + long __i = i;
17347 asm volatile(_ASM_XADD "%0, %1;"
17348 : "+r" (i), "+m" (l->a.counter)
17349 : : "memory");
17350 @@ -121,6 +209,8 @@ static inline long local_sub_return(long i, local_t *l)
17351
17352 #define local_cmpxchg(l, o, n) \
17353 (cmpxchg_local(&((l)->a.counter), (o), (n)))
17354 +#define local_cmpxchg_unchecked(l, o, n) \
17355 + (cmpxchg_local(&((l)->a.counter), (o), (n)))
17356 /* Always has a lock prefix */
17357 #define local_xchg(l, n) (xchg(&((l)->a.counter), (n)))
17358
17359 diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
17360 new file mode 100644
17361 index 0000000..2bfd3ba
17362 --- /dev/null
17363 +++ b/arch/x86/include/asm/mman.h
17364 @@ -0,0 +1,15 @@
17365 +#ifndef _X86_MMAN_H
17366 +#define _X86_MMAN_H
17367 +
17368 +#include <uapi/asm/mman.h>
17369 +
17370 +#ifdef __KERNEL__
17371 +#ifndef __ASSEMBLY__
17372 +#ifdef CONFIG_X86_32
17373 +#define arch_mmap_check i386_mmap_check
17374 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags);
17375 +#endif
17376 +#endif
17377 +#endif
17378 +
17379 +#endif /* X86_MMAN_H */
17380 diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
17381 index 09b9620..923aecd 100644
17382 --- a/arch/x86/include/asm/mmu.h
17383 +++ b/arch/x86/include/asm/mmu.h
17384 @@ -9,7 +9,7 @@
17385 * we put the segment information here.
17386 */
17387 typedef struct {
17388 - void *ldt;
17389 + struct desc_struct *ldt;
17390 int size;
17391
17392 #ifdef CONFIG_X86_64
17393 @@ -18,7 +18,19 @@ typedef struct {
17394 #endif
17395
17396 struct mutex lock;
17397 - void __user *vdso;
17398 + unsigned long vdso;
17399 +
17400 +#ifdef CONFIG_X86_32
17401 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
17402 + unsigned long user_cs_base;
17403 + unsigned long user_cs_limit;
17404 +
17405 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
17406 + cpumask_t cpu_user_cs_mask;
17407 +#endif
17408 +
17409 +#endif
17410 +#endif
17411
17412 atomic_t perf_rdpmc_allowed; /* nonzero if rdpmc is allowed */
17413 } mm_context_t;
17414 diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
17415 index 883f6b93..bb405b5 100644
17416 --- a/arch/x86/include/asm/mmu_context.h
17417 +++ b/arch/x86/include/asm/mmu_context.h
17418 @@ -42,6 +42,20 @@ void destroy_context(struct mm_struct *mm);
17419
17420 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
17421 {
17422 +
17423 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17424 + if (!(static_cpu_has(X86_FEATURE_PCID))) {
17425 + unsigned int i;
17426 + pgd_t *pgd;
17427 +
17428 + pax_open_kernel();
17429 + pgd = get_cpu_pgd(smp_processor_id(), kernel);
17430 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
17431 + set_pgd_batched(pgd+i, native_make_pgd(0));
17432 + pax_close_kernel();
17433 + }
17434 +#endif
17435 +
17436 #ifdef CONFIG_SMP
17437 if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
17438 this_cpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
17439 @@ -52,16 +66,59 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
17440 struct task_struct *tsk)
17441 {
17442 unsigned cpu = smp_processor_id();
17443 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17444 + int tlbstate = TLBSTATE_OK;
17445 +#endif
17446
17447 if (likely(prev != next)) {
17448 #ifdef CONFIG_SMP
17449 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17450 + tlbstate = this_cpu_read(cpu_tlbstate.state);
17451 +#endif
17452 this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
17453 this_cpu_write(cpu_tlbstate.active_mm, next);
17454 #endif
17455 cpumask_set_cpu(cpu, mm_cpumask(next));
17456
17457 /* Re-load page tables */
17458 +#ifdef CONFIG_PAX_PER_CPU_PGD
17459 + pax_open_kernel();
17460 +
17461 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17462 + if (static_cpu_has(X86_FEATURE_PCID))
17463 + __clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
17464 + else
17465 +#endif
17466 +
17467 + __clone_user_pgds(get_cpu_pgd(cpu, kernel), next->pgd);
17468 + __shadow_user_pgds(get_cpu_pgd(cpu, kernel) + USER_PGD_PTRS, next->pgd);
17469 + pax_close_kernel();
17470 + BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
17471 +
17472 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17473 + if (static_cpu_has(X86_FEATURE_PCID)) {
17474 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
17475 + u64 descriptor[2];
17476 + descriptor[0] = PCID_USER;
17477 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17478 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF)) {
17479 + descriptor[0] = PCID_KERNEL;
17480 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17481 + }
17482 + } else {
17483 + write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
17484 + if (static_cpu_has(X86_FEATURE_STRONGUDEREF))
17485 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
17486 + else
17487 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL);
17488 + }
17489 + } else
17490 +#endif
17491 +
17492 + load_cr3(get_cpu_pgd(cpu, kernel));
17493 +#else
17494 load_cr3(next->pgd);
17495 +#endif
17496 trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
17497
17498 /* Stop flush ipis for the previous mm */
17499 @@ -84,9 +141,67 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
17500 */
17501 if (unlikely(prev->context.ldt != next->context.ldt))
17502 load_LDT_nolock(&next->context);
17503 +
17504 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
17505 + if (!(__supported_pte_mask & _PAGE_NX)) {
17506 + smp_mb__before_atomic();
17507 + cpumask_clear_cpu(cpu, &prev->context.cpu_user_cs_mask);
17508 + smp_mb__after_atomic();
17509 + cpumask_set_cpu(cpu, &next->context.cpu_user_cs_mask);
17510 + }
17511 +#endif
17512 +
17513 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17514 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
17515 + prev->context.user_cs_limit != next->context.user_cs_limit))
17516 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
17517 +#ifdef CONFIG_SMP
17518 + else if (unlikely(tlbstate != TLBSTATE_OK))
17519 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
17520 +#endif
17521 +#endif
17522 +
17523 }
17524 + else {
17525 +
17526 +#ifdef CONFIG_PAX_PER_CPU_PGD
17527 + pax_open_kernel();
17528 +
17529 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17530 + if (static_cpu_has(X86_FEATURE_PCID))
17531 + __clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
17532 + else
17533 +#endif
17534 +
17535 + __clone_user_pgds(get_cpu_pgd(cpu, kernel), next->pgd);
17536 + __shadow_user_pgds(get_cpu_pgd(cpu, kernel) + USER_PGD_PTRS, next->pgd);
17537 + pax_close_kernel();
17538 + BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
17539 +
17540 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17541 + if (static_cpu_has(X86_FEATURE_PCID)) {
17542 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
17543 + u64 descriptor[2];
17544 + descriptor[0] = PCID_USER;
17545 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17546 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF)) {
17547 + descriptor[0] = PCID_KERNEL;
17548 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17549 + }
17550 + } else {
17551 + write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
17552 + if (static_cpu_has(X86_FEATURE_STRONGUDEREF))
17553 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
17554 + else
17555 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL);
17556 + }
17557 + } else
17558 +#endif
17559 +
17560 + load_cr3(get_cpu_pgd(cpu, kernel));
17561 +#endif
17562 +
17563 #ifdef CONFIG_SMP
17564 - else {
17565 this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
17566 BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
17567
17568 @@ -103,13 +218,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
17569 * tlb flush IPI delivery. We must reload CR3
17570 * to make sure to use no freed page tables.
17571 */
17572 +
17573 +#ifndef CONFIG_PAX_PER_CPU_PGD
17574 load_cr3(next->pgd);
17575 trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
17576 +#endif
17577 +
17578 load_mm_cr4(next);
17579 load_LDT_nolock(&next->context);
17580 +
17581 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17582 + if (!(__supported_pte_mask & _PAGE_NX))
17583 + cpumask_set_cpu(cpu, &next->context.cpu_user_cs_mask);
17584 +#endif
17585 +
17586 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17587 +#ifdef CONFIG_PAX_PAGEEXEC
17588 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
17589 +#endif
17590 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
17591 +#endif
17592 +
17593 }
17594 +#endif
17595 }
17596 -#endif
17597 }
17598
17599 #define activate_mm(prev, next) \
17600 diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
17601 index e3b7819..b257c64 100644
17602 --- a/arch/x86/include/asm/module.h
17603 +++ b/arch/x86/include/asm/module.h
17604 @@ -5,6 +5,7 @@
17605
17606 #ifdef CONFIG_X86_64
17607 /* X86_64 does not define MODULE_PROC_FAMILY */
17608 +#define MODULE_PROC_FAMILY ""
17609 #elif defined CONFIG_M486
17610 #define MODULE_PROC_FAMILY "486 "
17611 #elif defined CONFIG_M586
17612 @@ -57,8 +58,20 @@
17613 #error unknown processor family
17614 #endif
17615
17616 -#ifdef CONFIG_X86_32
17617 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
17618 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
17619 +#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
17620 +#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
17621 +#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
17622 +#else
17623 +#define MODULE_PAX_KERNEXEC ""
17624 #endif
17625
17626 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17627 +#define MODULE_PAX_UDEREF "UDEREF "
17628 +#else
17629 +#define MODULE_PAX_UDEREF ""
17630 +#endif
17631 +
17632 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
17633 +
17634 #endif /* _ASM_X86_MODULE_H */
17635 diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
17636 index 5f2fc44..106caa6 100644
17637 --- a/arch/x86/include/asm/nmi.h
17638 +++ b/arch/x86/include/asm/nmi.h
17639 @@ -36,26 +36,35 @@ enum {
17640
17641 typedef int (*nmi_handler_t)(unsigned int, struct pt_regs *);
17642
17643 +struct nmiaction;
17644 +
17645 +struct nmiwork {
17646 + const struct nmiaction *action;
17647 + u64 max_duration;
17648 + struct irq_work irq_work;
17649 +};
17650 +
17651 struct nmiaction {
17652 struct list_head list;
17653 nmi_handler_t handler;
17654 - u64 max_duration;
17655 - struct irq_work irq_work;
17656 unsigned long flags;
17657 const char *name;
17658 -};
17659 + struct nmiwork *work;
17660 +} __do_const;
17661
17662 #define register_nmi_handler(t, fn, fg, n, init...) \
17663 ({ \
17664 - static struct nmiaction init fn##_na = { \
17665 + static struct nmiwork fn##_nw; \
17666 + static const struct nmiaction init fn##_na = { \
17667 .handler = (fn), \
17668 .name = (n), \
17669 .flags = (fg), \
17670 + .work = &fn##_nw, \
17671 }; \
17672 __register_nmi_handler((t), &fn##_na); \
17673 })
17674
17675 -int __register_nmi_handler(unsigned int, struct nmiaction *);
17676 +int __register_nmi_handler(unsigned int, const struct nmiaction *);
17677
17678 void unregister_nmi_handler(unsigned int, const char *);
17679
17680 diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h
17681 index 802dde3..9183e68 100644
17682 --- a/arch/x86/include/asm/page.h
17683 +++ b/arch/x86/include/asm/page.h
17684 @@ -52,6 +52,7 @@ static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
17685 __phys_addr_symbol(__phys_reloc_hide((unsigned long)(x)))
17686
17687 #define __va(x) ((void *)((unsigned long)(x)+PAGE_OFFSET))
17688 +#define __early_va(x) ((void *)((unsigned long)(x)+__START_KERNEL_map - phys_base))
17689
17690 #define __boot_va(x) __va(x)
17691 #define __boot_pa(x) __pa(x)
17692 @@ -60,11 +61,21 @@ static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
17693 * virt_to_page(kaddr) returns a valid pointer if and only if
17694 * virt_addr_valid(kaddr) returns true.
17695 */
17696 -#define virt_to_page(kaddr) pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
17697 #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT)
17698 extern bool __virt_addr_valid(unsigned long kaddr);
17699 #define virt_addr_valid(kaddr) __virt_addr_valid((unsigned long) (kaddr))
17700
17701 +#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
17702 +#define virt_to_page(kaddr) \
17703 + ({ \
17704 + const void *__kaddr = (const void *)(kaddr); \
17705 + BUG_ON(!virt_addr_valid(__kaddr)); \
17706 + pfn_to_page(__pa(__kaddr) >> PAGE_SHIFT); \
17707 + })
17708 +#else
17709 +#define virt_to_page(kaddr) pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
17710 +#endif
17711 +
17712 #endif /* __ASSEMBLY__ */
17713
17714 #include <asm-generic/memory_model.h>
17715 diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
17716 index b3bebf9..13ac22e 100644
17717 --- a/arch/x86/include/asm/page_64.h
17718 +++ b/arch/x86/include/asm/page_64.h
17719 @@ -7,9 +7,9 @@
17720
17721 /* duplicated to the one in bootmem.h */
17722 extern unsigned long max_pfn;
17723 -extern unsigned long phys_base;
17724 +extern const unsigned long phys_base;
17725
17726 -static inline unsigned long __phys_addr_nodebug(unsigned long x)
17727 +static inline unsigned long __intentional_overflow(-1) __phys_addr_nodebug(unsigned long x)
17728 {
17729 unsigned long y = x - __START_KERNEL_map;
17730
17731 @@ -20,8 +20,8 @@ static inline unsigned long __phys_addr_nodebug(unsigned long x)
17732 }
17733
17734 #ifdef CONFIG_DEBUG_VIRTUAL
17735 -extern unsigned long __phys_addr(unsigned long);
17736 -extern unsigned long __phys_addr_symbol(unsigned long);
17737 +extern unsigned long __intentional_overflow(-1) __phys_addr(unsigned long);
17738 +extern unsigned long __intentional_overflow(-1) __phys_addr_symbol(unsigned long);
17739 #else
17740 #define __phys_addr(x) __phys_addr_nodebug(x)
17741 #define __phys_addr_symbol(x) \
17742 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
17743 index 8957810..f34efb4 100644
17744 --- a/arch/x86/include/asm/paravirt.h
17745 +++ b/arch/x86/include/asm/paravirt.h
17746 @@ -560,7 +560,7 @@ static inline pmd_t __pmd(pmdval_t val)
17747 return (pmd_t) { ret };
17748 }
17749
17750 -static inline pmdval_t pmd_val(pmd_t pmd)
17751 +static inline __intentional_overflow(-1) pmdval_t pmd_val(pmd_t pmd)
17752 {
17753 pmdval_t ret;
17754
17755 @@ -626,6 +626,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
17756 val);
17757 }
17758
17759 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
17760 +{
17761 + pgdval_t val = native_pgd_val(pgd);
17762 +
17763 + if (sizeof(pgdval_t) > sizeof(long))
17764 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
17765 + val, (u64)val >> 32);
17766 + else
17767 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
17768 + val);
17769 +}
17770 +
17771 static inline void pgd_clear(pgd_t *pgdp)
17772 {
17773 set_pgd(pgdp, __pgd(0));
17774 @@ -710,6 +722,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
17775 pv_mmu_ops.set_fixmap(idx, phys, flags);
17776 }
17777
17778 +#ifdef CONFIG_PAX_KERNEXEC
17779 +static inline unsigned long pax_open_kernel(void)
17780 +{
17781 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
17782 +}
17783 +
17784 +static inline unsigned long pax_close_kernel(void)
17785 +{
17786 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
17787 +}
17788 +#else
17789 +static inline unsigned long pax_open_kernel(void) { return 0; }
17790 +static inline unsigned long pax_close_kernel(void) { return 0; }
17791 +#endif
17792 +
17793 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
17794
17795 static __always_inline void __ticket_lock_spinning(struct arch_spinlock *lock,
17796 @@ -906,7 +933,7 @@ extern void default_banner(void);
17797
17798 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
17799 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
17800 -#define PARA_INDIRECT(addr) *%cs:addr
17801 +#define PARA_INDIRECT(addr) *%ss:addr
17802 #endif
17803
17804 #define INTERRUPT_RETURN \
17805 @@ -976,6 +1003,21 @@ extern void default_banner(void);
17806 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64), \
17807 CLBR_NONE, \
17808 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64))
17809 +
17810 +#define GET_CR0_INTO_RDI \
17811 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
17812 + mov %rax,%rdi
17813 +
17814 +#define SET_RDI_INTO_CR0 \
17815 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
17816 +
17817 +#define GET_CR3_INTO_RDI \
17818 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
17819 + mov %rax,%rdi
17820 +
17821 +#define SET_RDI_INTO_CR3 \
17822 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
17823 +
17824 #endif /* CONFIG_X86_32 */
17825
17826 #endif /* __ASSEMBLY__ */
17827 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
17828 index f7b0b5c..cdd33f9 100644
17829 --- a/arch/x86/include/asm/paravirt_types.h
17830 +++ b/arch/x86/include/asm/paravirt_types.h
17831 @@ -84,7 +84,7 @@ struct pv_init_ops {
17832 */
17833 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
17834 unsigned long addr, unsigned len);
17835 -};
17836 +} __no_const __no_randomize_layout;
17837
17838
17839 struct pv_lazy_ops {
17840 @@ -92,13 +92,13 @@ struct pv_lazy_ops {
17841 void (*enter)(void);
17842 void (*leave)(void);
17843 void (*flush)(void);
17844 -};
17845 +} __no_randomize_layout;
17846
17847 struct pv_time_ops {
17848 unsigned long long (*sched_clock)(void);
17849 unsigned long long (*steal_clock)(int cpu);
17850 unsigned long (*get_tsc_khz)(void);
17851 -};
17852 +} __no_const __no_randomize_layout;
17853
17854 struct pv_cpu_ops {
17855 /* hooks for various privileged instructions */
17856 @@ -192,7 +192,7 @@ struct pv_cpu_ops {
17857
17858 void (*start_context_switch)(struct task_struct *prev);
17859 void (*end_context_switch)(struct task_struct *next);
17860 -};
17861 +} __no_const __no_randomize_layout;
17862
17863 struct pv_irq_ops {
17864 /*
17865 @@ -215,7 +215,7 @@ struct pv_irq_ops {
17866 #ifdef CONFIG_X86_64
17867 void (*adjust_exception_frame)(void);
17868 #endif
17869 -};
17870 +} __no_randomize_layout;
17871
17872 struct pv_apic_ops {
17873 #ifdef CONFIG_X86_LOCAL_APIC
17874 @@ -223,7 +223,7 @@ struct pv_apic_ops {
17875 unsigned long start_eip,
17876 unsigned long start_esp);
17877 #endif
17878 -};
17879 +} __no_const __no_randomize_layout;
17880
17881 struct pv_mmu_ops {
17882 unsigned long (*read_cr2)(void);
17883 @@ -313,6 +313,7 @@ struct pv_mmu_ops {
17884 struct paravirt_callee_save make_pud;
17885
17886 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
17887 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
17888 #endif /* CONFIG_PGTABLE_LEVELS == 4 */
17889 #endif /* CONFIG_PGTABLE_LEVELS >= 3 */
17890
17891 @@ -324,7 +325,13 @@ struct pv_mmu_ops {
17892 an mfn. We can tell which is which from the index. */
17893 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
17894 phys_addr_t phys, pgprot_t flags);
17895 -};
17896 +
17897 +#ifdef CONFIG_PAX_KERNEXEC
17898 + unsigned long (*pax_open_kernel)(void);
17899 + unsigned long (*pax_close_kernel)(void);
17900 +#endif
17901 +
17902 +} __no_randomize_layout;
17903
17904 struct arch_spinlock;
17905 #ifdef CONFIG_SMP
17906 @@ -336,11 +343,14 @@ typedef u16 __ticket_t;
17907 struct pv_lock_ops {
17908 struct paravirt_callee_save lock_spinning;
17909 void (*unlock_kick)(struct arch_spinlock *lock, __ticket_t ticket);
17910 -};
17911 +} __no_randomize_layout;
17912
17913 /* This contains all the paravirt structures: we get a convenient
17914 * number for each function using the offset which we use to indicate
17915 - * what to patch. */
17916 + * what to patch.
17917 + * shouldn't be randomized due to the "NEAT TRICK" in paravirt.c
17918 + */
17919 +
17920 struct paravirt_patch_template {
17921 struct pv_init_ops pv_init_ops;
17922 struct pv_time_ops pv_time_ops;
17923 @@ -349,7 +359,7 @@ struct paravirt_patch_template {
17924 struct pv_apic_ops pv_apic_ops;
17925 struct pv_mmu_ops pv_mmu_ops;
17926 struct pv_lock_ops pv_lock_ops;
17927 -};
17928 +} __no_randomize_layout;
17929
17930 extern struct pv_info pv_info;
17931 extern struct pv_init_ops pv_init_ops;
17932 diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
17933 index bf7f8b5..ca5799d 100644
17934 --- a/arch/x86/include/asm/pgalloc.h
17935 +++ b/arch/x86/include/asm/pgalloc.h
17936 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
17937 pmd_t *pmd, pte_t *pte)
17938 {
17939 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
17940 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
17941 +}
17942 +
17943 +static inline void pmd_populate_user(struct mm_struct *mm,
17944 + pmd_t *pmd, pte_t *pte)
17945 +{
17946 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
17947 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
17948 }
17949
17950 @@ -108,12 +115,22 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
17951
17952 #ifdef CONFIG_X86_PAE
17953 extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
17954 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
17955 +{
17956 + pud_populate(mm, pudp, pmd);
17957 +}
17958 #else /* !CONFIG_X86_PAE */
17959 static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
17960 {
17961 paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
17962 set_pud(pud, __pud(_PAGE_TABLE | __pa(pmd)));
17963 }
17964 +
17965 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
17966 +{
17967 + paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
17968 + set_pud(pud, __pud(_KERNPG_TABLE | __pa(pmd)));
17969 +}
17970 #endif /* CONFIG_X86_PAE */
17971
17972 #if CONFIG_PGTABLE_LEVELS > 3
17973 @@ -123,6 +140,12 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
17974 set_pgd(pgd, __pgd(_PAGE_TABLE | __pa(pud)));
17975 }
17976
17977 +static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
17978 +{
17979 + paravirt_alloc_pud(mm, __pa(pud) >> PAGE_SHIFT);
17980 + set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(pud)));
17981 +}
17982 +
17983 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
17984 {
17985 return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
17986 diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
17987 index fd74a11..35fd5af 100644
17988 --- a/arch/x86/include/asm/pgtable-2level.h
17989 +++ b/arch/x86/include/asm/pgtable-2level.h
17990 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
17991
17992 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
17993 {
17994 + pax_open_kernel();
17995 *pmdp = pmd;
17996 + pax_close_kernel();
17997 }
17998
17999 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
18000 diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
18001 index cdaa58c..e61122b 100644
18002 --- a/arch/x86/include/asm/pgtable-3level.h
18003 +++ b/arch/x86/include/asm/pgtable-3level.h
18004 @@ -92,12 +92,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
18005
18006 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
18007 {
18008 + pax_open_kernel();
18009 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
18010 + pax_close_kernel();
18011 }
18012
18013 static inline void native_set_pud(pud_t *pudp, pud_t pud)
18014 {
18015 + pax_open_kernel();
18016 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
18017 + pax_close_kernel();
18018 }
18019
18020 /*
18021 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
18022 index fe57e7a..0573d42 100644
18023 --- a/arch/x86/include/asm/pgtable.h
18024 +++ b/arch/x86/include/asm/pgtable.h
18025 @@ -47,6 +47,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
18026
18027 #ifndef __PAGETABLE_PUD_FOLDED
18028 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
18029 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
18030 #define pgd_clear(pgd) native_pgd_clear(pgd)
18031 #endif
18032
18033 @@ -84,12 +85,53 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
18034
18035 #define arch_end_context_switch(prev) do {} while(0)
18036
18037 +#define pax_open_kernel() native_pax_open_kernel()
18038 +#define pax_close_kernel() native_pax_close_kernel()
18039 #endif /* CONFIG_PARAVIRT */
18040
18041 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
18042 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
18043 +
18044 +#ifdef CONFIG_PAX_KERNEXEC
18045 +static inline unsigned long native_pax_open_kernel(void)
18046 +{
18047 + unsigned long cr0;
18048 +
18049 + preempt_disable();
18050 + barrier();
18051 + cr0 = read_cr0() ^ X86_CR0_WP;
18052 + BUG_ON(cr0 & X86_CR0_WP);
18053 + write_cr0(cr0);
18054 + barrier();
18055 + return cr0 ^ X86_CR0_WP;
18056 +}
18057 +
18058 +static inline unsigned long native_pax_close_kernel(void)
18059 +{
18060 + unsigned long cr0;
18061 +
18062 + barrier();
18063 + cr0 = read_cr0() ^ X86_CR0_WP;
18064 + BUG_ON(!(cr0 & X86_CR0_WP));
18065 + write_cr0(cr0);
18066 + barrier();
18067 + preempt_enable_no_resched();
18068 + return cr0 ^ X86_CR0_WP;
18069 +}
18070 +#else
18071 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
18072 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
18073 +#endif
18074 +
18075 /*
18076 * The following only work if pte_present() is true.
18077 * Undefined behaviour if not..
18078 */
18079 +static inline int pte_user(pte_t pte)
18080 +{
18081 + return pte_val(pte) & _PAGE_USER;
18082 +}
18083 +
18084 static inline int pte_dirty(pte_t pte)
18085 {
18086 return pte_flags(pte) & _PAGE_DIRTY;
18087 @@ -150,6 +192,11 @@ static inline unsigned long pud_pfn(pud_t pud)
18088 return (pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT;
18089 }
18090
18091 +static inline unsigned long pgd_pfn(pgd_t pgd)
18092 +{
18093 + return (pgd_val(pgd) & PTE_PFN_MASK) >> PAGE_SHIFT;
18094 +}
18095 +
18096 #define pte_page(pte) pfn_to_page(pte_pfn(pte))
18097
18098 static inline int pmd_large(pmd_t pte)
18099 @@ -203,9 +250,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
18100 return pte_clear_flags(pte, _PAGE_RW);
18101 }
18102
18103 +static inline pte_t pte_mkread(pte_t pte)
18104 +{
18105 + return __pte(pte_val(pte) | _PAGE_USER);
18106 +}
18107 +
18108 static inline pte_t pte_mkexec(pte_t pte)
18109 {
18110 - return pte_clear_flags(pte, _PAGE_NX);
18111 +#ifdef CONFIG_X86_PAE
18112 + if (__supported_pte_mask & _PAGE_NX)
18113 + return pte_clear_flags(pte, _PAGE_NX);
18114 + else
18115 +#endif
18116 + return pte_set_flags(pte, _PAGE_USER);
18117 +}
18118 +
18119 +static inline pte_t pte_exprotect(pte_t pte)
18120 +{
18121 +#ifdef CONFIG_X86_PAE
18122 + if (__supported_pte_mask & _PAGE_NX)
18123 + return pte_set_flags(pte, _PAGE_NX);
18124 + else
18125 +#endif
18126 + return pte_clear_flags(pte, _PAGE_USER);
18127 }
18128
18129 static inline pte_t pte_mkdirty(pte_t pte)
18130 @@ -420,6 +487,16 @@ pte_t *populate_extra_pte(unsigned long vaddr);
18131 #endif
18132
18133 #ifndef __ASSEMBLY__
18134 +
18135 +#ifdef CONFIG_PAX_PER_CPU_PGD
18136 +extern pgd_t cpu_pgd[NR_CPUS][2][PTRS_PER_PGD];
18137 +enum cpu_pgd_type {kernel = 0, user = 1};
18138 +static inline pgd_t *get_cpu_pgd(unsigned int cpu, enum cpu_pgd_type type)
18139 +{
18140 + return cpu_pgd[cpu][type];
18141 +}
18142 +#endif
18143 +
18144 #include <linux/mm_types.h>
18145 #include <linux/mmdebug.h>
18146 #include <linux/log2.h>
18147 @@ -571,7 +648,7 @@ static inline unsigned long pud_page_vaddr(pud_t pud)
18148 * Currently stuck as a macro due to indirect forward reference to
18149 * linux/mmzone.h's __section_mem_map_addr() definition:
18150 */
18151 -#define pud_page(pud) pfn_to_page(pud_val(pud) >> PAGE_SHIFT)
18152 +#define pud_page(pud) pfn_to_page((pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT)
18153
18154 /* Find an entry in the second-level page table.. */
18155 static inline pmd_t *pmd_offset(pud_t *pud, unsigned long address)
18156 @@ -611,7 +688,7 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
18157 * Currently stuck as a macro due to indirect forward reference to
18158 * linux/mmzone.h's __section_mem_map_addr() definition:
18159 */
18160 -#define pgd_page(pgd) pfn_to_page(pgd_val(pgd) >> PAGE_SHIFT)
18161 +#define pgd_page(pgd) pfn_to_page((pgd_val(pgd) & PTE_PFN_MASK) >> PAGE_SHIFT)
18162
18163 /* to find an entry in a page-table-directory. */
18164 static inline unsigned long pud_index(unsigned long address)
18165 @@ -626,7 +703,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
18166
18167 static inline int pgd_bad(pgd_t pgd)
18168 {
18169 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
18170 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
18171 }
18172
18173 static inline int pgd_none(pgd_t pgd)
18174 @@ -649,7 +726,12 @@ static inline int pgd_none(pgd_t pgd)
18175 * pgd_offset() returns a (pgd_t *)
18176 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
18177 */
18178 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
18179 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
18180 +
18181 +#ifdef CONFIG_PAX_PER_CPU_PGD
18182 +#define pgd_offset_cpu(cpu, type, address) (get_cpu_pgd(cpu, type) + pgd_index(address))
18183 +#endif
18184 +
18185 /*
18186 * a shortcut which implies the use of the kernel's pgd, instead
18187 * of a process's
18188 @@ -660,6 +742,25 @@ static inline int pgd_none(pgd_t pgd)
18189 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
18190 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
18191
18192 +#ifdef CONFIG_X86_32
18193 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
18194 +#else
18195 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
18196 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
18197 +
18198 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18199 +#ifdef __ASSEMBLY__
18200 +#define pax_user_shadow_base pax_user_shadow_base(%rip)
18201 +#else
18202 +extern unsigned long pax_user_shadow_base;
18203 +extern pgdval_t clone_pgd_mask;
18204 +#endif
18205 +#else
18206 +#define pax_user_shadow_base (0UL)
18207 +#endif
18208 +
18209 +#endif
18210 +
18211 #ifndef __ASSEMBLY__
18212
18213 extern int direct_gbpages;
18214 @@ -826,11 +927,24 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
18215 * dst and src can be on the same page, but the range must not overlap,
18216 * and must not cross a page boundary.
18217 */
18218 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
18219 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
18220 {
18221 - memcpy(dst, src, count * sizeof(pgd_t));
18222 + pax_open_kernel();
18223 + while (count--)
18224 + *dst++ = *src++;
18225 + pax_close_kernel();
18226 }
18227
18228 +#ifdef CONFIG_PAX_PER_CPU_PGD
18229 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src);
18230 +#endif
18231 +
18232 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18233 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src);
18234 +#else
18235 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src) {}
18236 +#endif
18237 +
18238 #define PTE_SHIFT ilog2(PTRS_PER_PTE)
18239 static inline int page_level_shift(enum pg_level level)
18240 {
18241 diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
18242 index b6c0b40..3535d47 100644
18243 --- a/arch/x86/include/asm/pgtable_32.h
18244 +++ b/arch/x86/include/asm/pgtable_32.h
18245 @@ -25,9 +25,6 @@
18246 struct mm_struct;
18247 struct vm_area_struct;
18248
18249 -extern pgd_t swapper_pg_dir[1024];
18250 -extern pgd_t initial_page_table[1024];
18251 -
18252 static inline void pgtable_cache_init(void) { }
18253 static inline void check_pgt_cache(void) { }
18254 void paging_init(void);
18255 @@ -45,6 +42,12 @@ void paging_init(void);
18256 # include <asm/pgtable-2level.h>
18257 #endif
18258
18259 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
18260 +extern pgd_t initial_page_table[PTRS_PER_PGD];
18261 +#ifdef CONFIG_X86_PAE
18262 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
18263 +#endif
18264 +
18265 #if defined(CONFIG_HIGHPTE)
18266 #define pte_offset_map(dir, address) \
18267 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
18268 @@ -59,12 +62,17 @@ void paging_init(void);
18269 /* Clear a kernel PTE and flush it from the TLB */
18270 #define kpte_clear_flush(ptep, vaddr) \
18271 do { \
18272 + pax_open_kernel(); \
18273 pte_clear(&init_mm, (vaddr), (ptep)); \
18274 + pax_close_kernel(); \
18275 __flush_tlb_one((vaddr)); \
18276 } while (0)
18277
18278 #endif /* !__ASSEMBLY__ */
18279
18280 +#define HAVE_ARCH_UNMAPPED_AREA
18281 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
18282 +
18283 /*
18284 * kern_addr_valid() is (1) for FLATMEM and (0) for
18285 * SPARSEMEM and DISCONTIGMEM
18286 diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
18287 index 9fb2f2b..b04b4bf 100644
18288 --- a/arch/x86/include/asm/pgtable_32_types.h
18289 +++ b/arch/x86/include/asm/pgtable_32_types.h
18290 @@ -8,7 +8,7 @@
18291 */
18292 #ifdef CONFIG_X86_PAE
18293 # include <asm/pgtable-3level_types.h>
18294 -# define PMD_SIZE (1UL << PMD_SHIFT)
18295 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
18296 # define PMD_MASK (~(PMD_SIZE - 1))
18297 #else
18298 # include <asm/pgtable-2level_types.h>
18299 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
18300 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
18301 #endif
18302
18303 +#ifdef CONFIG_PAX_KERNEXEC
18304 +#ifndef __ASSEMBLY__
18305 +extern unsigned char MODULES_EXEC_VADDR[];
18306 +extern unsigned char MODULES_EXEC_END[];
18307 +#endif
18308 +#include <asm/boot.h>
18309 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
18310 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
18311 +#else
18312 +#define ktla_ktva(addr) (addr)
18313 +#define ktva_ktla(addr) (addr)
18314 +#endif
18315 +
18316 #define MODULES_VADDR VMALLOC_START
18317 #define MODULES_END VMALLOC_END
18318 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
18319 diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
18320 index 2ee7811..55aca24 100644
18321 --- a/arch/x86/include/asm/pgtable_64.h
18322 +++ b/arch/x86/include/asm/pgtable_64.h
18323 @@ -16,11 +16,16 @@
18324
18325 extern pud_t level3_kernel_pgt[512];
18326 extern pud_t level3_ident_pgt[512];
18327 +extern pud_t level3_vmalloc_start_pgt[512];
18328 +extern pud_t level3_vmalloc_end_pgt[512];
18329 +extern pud_t level3_vmemmap_pgt[512];
18330 +extern pud_t level2_vmemmap_pgt[512];
18331 extern pmd_t level2_kernel_pgt[512];
18332 extern pmd_t level2_fixmap_pgt[512];
18333 -extern pmd_t level2_ident_pgt[512];
18334 -extern pte_t level1_fixmap_pgt[512];
18335 -extern pgd_t init_level4_pgt[];
18336 +extern pmd_t level2_ident_pgt[2][512];
18337 +extern pte_t level1_fixmap_pgt[3][512];
18338 +extern pte_t level1_vsyscall_pgt[512];
18339 +extern pgd_t init_level4_pgt[512];
18340
18341 #define swapper_pg_dir init_level4_pgt
18342
18343 @@ -62,7 +67,9 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
18344
18345 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
18346 {
18347 + pax_open_kernel();
18348 *pmdp = pmd;
18349 + pax_close_kernel();
18350 }
18351
18352 static inline void native_pmd_clear(pmd_t *pmd)
18353 @@ -98,7 +105,9 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
18354
18355 static inline void native_set_pud(pud_t *pudp, pud_t pud)
18356 {
18357 + pax_open_kernel();
18358 *pudp = pud;
18359 + pax_close_kernel();
18360 }
18361
18362 static inline void native_pud_clear(pud_t *pud)
18363 @@ -108,6 +117,13 @@ static inline void native_pud_clear(pud_t *pud)
18364
18365 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
18366 {
18367 + pax_open_kernel();
18368 + *pgdp = pgd;
18369 + pax_close_kernel();
18370 +}
18371 +
18372 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
18373 +{
18374 *pgdp = pgd;
18375 }
18376
18377 diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
18378 index e6844df..432b56e 100644
18379 --- a/arch/x86/include/asm/pgtable_64_types.h
18380 +++ b/arch/x86/include/asm/pgtable_64_types.h
18381 @@ -60,11 +60,16 @@ typedef struct { pteval_t pte; } pte_t;
18382 #define MODULES_VADDR (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
18383 #define MODULES_END _AC(0xffffffffff000000, UL)
18384 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
18385 +#define MODULES_EXEC_VADDR MODULES_VADDR
18386 +#define MODULES_EXEC_END MODULES_END
18387 #define ESPFIX_PGD_ENTRY _AC(-2, UL)
18388 #define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << PGDIR_SHIFT)
18389 #define EFI_VA_START ( -4 * (_AC(1, UL) << 30))
18390 #define EFI_VA_END (-68 * (_AC(1, UL) << 30))
18391
18392 +#define ktla_ktva(addr) (addr)
18393 +#define ktva_ktla(addr) (addr)
18394 +
18395 #define EARLY_DYNAMIC_PAGE_TABLES 64
18396
18397 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
18398 diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
18399 index 78f0c8c..4424bb0 100644
18400 --- a/arch/x86/include/asm/pgtable_types.h
18401 +++ b/arch/x86/include/asm/pgtable_types.h
18402 @@ -85,8 +85,10 @@
18403
18404 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
18405 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
18406 -#else
18407 +#elif defined(CONFIG_KMEMCHECK) || defined(CONFIG_MEM_SOFT_DIRTY)
18408 #define _PAGE_NX (_AT(pteval_t, 0))
18409 +#else
18410 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
18411 #endif
18412
18413 #define _PAGE_PROTNONE (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE)
18414 @@ -141,6 +143,9 @@ enum page_cache_mode {
18415 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
18416 _PAGE_ACCESSED)
18417
18418 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
18419 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
18420 +
18421 #define __PAGE_KERNEL_EXEC \
18422 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
18423 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
18424 @@ -148,7 +153,7 @@ enum page_cache_mode {
18425 #define __PAGE_KERNEL_RO (__PAGE_KERNEL & ~_PAGE_RW)
18426 #define __PAGE_KERNEL_RX (__PAGE_KERNEL_EXEC & ~_PAGE_RW)
18427 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_NOCACHE)
18428 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
18429 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
18430 #define __PAGE_KERNEL_VVAR (__PAGE_KERNEL_RO | _PAGE_USER)
18431 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
18432 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
18433 @@ -194,7 +199,7 @@ enum page_cache_mode {
18434 #ifdef CONFIG_X86_64
18435 #define __PAGE_KERNEL_IDENT_LARGE_EXEC __PAGE_KERNEL_LARGE_EXEC
18436 #else
18437 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
18438 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
18439 #define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
18440 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
18441 #endif
18442 @@ -233,7 +238,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
18443 {
18444 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
18445 }
18446 +#endif
18447
18448 +#if CONFIG_PGTABLE_LEVELS == 3
18449 +#include <asm-generic/pgtable-nopud.h>
18450 +#endif
18451 +
18452 +#if CONFIG_PGTABLE_LEVELS == 2
18453 +#include <asm-generic/pgtable-nopmd.h>
18454 +#endif
18455 +
18456 +#ifndef __ASSEMBLY__
18457 #if CONFIG_PGTABLE_LEVELS > 3
18458 typedef struct { pudval_t pud; } pud_t;
18459
18460 @@ -247,8 +262,6 @@ static inline pudval_t native_pud_val(pud_t pud)
18461 return pud.pud;
18462 }
18463 #else
18464 -#include <asm-generic/pgtable-nopud.h>
18465 -
18466 static inline pudval_t native_pud_val(pud_t pud)
18467 {
18468 return native_pgd_val(pud.pgd);
18469 @@ -268,8 +281,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
18470 return pmd.pmd;
18471 }
18472 #else
18473 -#include <asm-generic/pgtable-nopmd.h>
18474 -
18475 static inline pmdval_t native_pmd_val(pmd_t pmd)
18476 {
18477 return native_pgd_val(pmd.pud.pgd);
18478 @@ -362,7 +373,6 @@ typedef struct page *pgtable_t;
18479
18480 extern pteval_t __supported_pte_mask;
18481 extern void set_nx(void);
18482 -extern int nx_enabled;
18483
18484 #define pgprot_writecombine pgprot_writecombine
18485 extern pgprot_t pgprot_writecombine(pgprot_t prot);
18486 diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h
18487 index 8f327184..368fb29 100644
18488 --- a/arch/x86/include/asm/preempt.h
18489 +++ b/arch/x86/include/asm/preempt.h
18490 @@ -84,7 +84,7 @@ static __always_inline void __preempt_count_sub(int val)
18491 */
18492 static __always_inline bool __preempt_count_dec_and_test(void)
18493 {
18494 - GEN_UNARY_RMWcc("decl", __preempt_count, __percpu_arg(0), "e");
18495 + GEN_UNARY_RMWcc("decl", "incl", __preempt_count, __percpu_arg(0), "e");
18496 }
18497
18498 /*
18499 diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
18500 index 23ba676..6584489 100644
18501 --- a/arch/x86/include/asm/processor.h
18502 +++ b/arch/x86/include/asm/processor.h
18503 @@ -130,7 +130,7 @@ struct cpuinfo_x86 {
18504 /* Index into per_cpu list: */
18505 u16 cpu_index;
18506 u32 microcode;
18507 -};
18508 +} __randomize_layout;
18509
18510 #define X86_VENDOR_INTEL 0
18511 #define X86_VENDOR_CYRIX 1
18512 @@ -201,9 +201,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
18513 : "memory");
18514 }
18515
18516 +/* invpcid (%rdx),%rax */
18517 +#define __ASM_INVPCID ".byte 0x66,0x0f,0x38,0x82,0x02"
18518 +
18519 +#define INVPCID_SINGLE_ADDRESS 0UL
18520 +#define INVPCID_SINGLE_CONTEXT 1UL
18521 +#define INVPCID_ALL_GLOBAL 2UL
18522 +#define INVPCID_ALL_NONGLOBAL 3UL
18523 +
18524 +#define PCID_KERNEL 0UL
18525 +#define PCID_USER 1UL
18526 +#define PCID_NOFLUSH (1UL << 63)
18527 +
18528 static inline void load_cr3(pgd_t *pgdir)
18529 {
18530 - write_cr3(__pa(pgdir));
18531 + write_cr3(__pa(pgdir) | PCID_KERNEL);
18532 }
18533
18534 #ifdef CONFIG_X86_32
18535 @@ -300,7 +312,7 @@ struct tss_struct {
18536
18537 } ____cacheline_aligned;
18538
18539 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss);
18540 +extern struct tss_struct cpu_tss[NR_CPUS];
18541
18542 #ifdef CONFIG_X86_32
18543 DECLARE_PER_CPU(unsigned long, cpu_current_top_of_stack);
18544 @@ -500,6 +512,7 @@ struct thread_struct {
18545 unsigned short ds;
18546 unsigned short fsindex;
18547 unsigned short gsindex;
18548 + unsigned short ss;
18549 #endif
18550 #ifdef CONFIG_X86_32
18551 unsigned long ip;
18552 @@ -585,10 +598,10 @@ static inline void native_swapgs(void)
18553 #endif
18554 }
18555
18556 -static inline unsigned long current_top_of_stack(void)
18557 +static inline unsigned long current_top_of_stack(unsigned int cpu)
18558 {
18559 #ifdef CONFIG_X86_64
18560 - return this_cpu_read_stable(cpu_tss.x86_tss.sp0);
18561 + return cpu_tss[cpu].x86_tss.sp0;
18562 #else
18563 /* sp0 on x86_32 is special in and around vm86 mode. */
18564 return this_cpu_read_stable(cpu_current_top_of_stack);
18565 @@ -837,8 +850,15 @@ static inline void spin_lock_prefetch(const void *x)
18566 */
18567 #define TASK_SIZE PAGE_OFFSET
18568 #define TASK_SIZE_MAX TASK_SIZE
18569 +
18570 +#ifdef CONFIG_PAX_SEGMEXEC
18571 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
18572 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
18573 +#else
18574 #define STACK_TOP TASK_SIZE
18575 -#define STACK_TOP_MAX STACK_TOP
18576 +#endif
18577 +
18578 +#define STACK_TOP_MAX TASK_SIZE
18579
18580 #define INIT_THREAD { \
18581 .sp0 = TOP_OF_INIT_STACK, \
18582 @@ -859,12 +879,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
18583 * "struct pt_regs" is possible, but they may contain the
18584 * completely wrong values.
18585 */
18586 -#define task_pt_regs(task) \
18587 -({ \
18588 - unsigned long __ptr = (unsigned long)task_stack_page(task); \
18589 - __ptr += THREAD_SIZE - TOP_OF_KERNEL_STACK_PADDING; \
18590 - ((struct pt_regs *)__ptr) - 1; \
18591 -})
18592 +#define task_pt_regs(tsk) ((struct pt_regs *)(tsk)->thread.sp0 - 1)
18593
18594 #define KSTK_ESP(task) (task_pt_regs(task)->sp)
18595
18596 @@ -878,13 +893,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
18597 * particular problem by preventing anything from being mapped
18598 * at the maximum canonical address.
18599 */
18600 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
18601 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
18602
18603 /* This decides where the kernel will search for a free chunk of vm
18604 * space during mmap's.
18605 */
18606 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
18607 - 0xc0000000 : 0xFFFFe000)
18608 + 0xc0000000 : 0xFFFFf000)
18609
18610 #define TASK_SIZE (test_thread_flag(TIF_ADDR32) ? \
18611 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
18612 @@ -918,6 +933,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
18613 */
18614 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
18615
18616 +#ifdef CONFIG_PAX_SEGMEXEC
18617 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
18618 +#endif
18619 +
18620 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
18621
18622 /* Get/set a process' ability to use the timestamp counter instruction */
18623 @@ -962,7 +981,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
18624 return 0;
18625 }
18626
18627 -extern unsigned long arch_align_stack(unsigned long sp);
18628 +#define arch_align_stack(x) ((x) & ~0xfUL)
18629 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
18630
18631 void default_idle(void);
18632 @@ -972,6 +991,6 @@ bool xen_set_default_idle(void);
18633 #define xen_set_default_idle 0
18634 #endif
18635
18636 -void stop_this_cpu(void *dummy);
18637 +void stop_this_cpu(void *dummy) __noreturn;
18638 void df_debug(struct pt_regs *regs, long error_code);
18639 #endif /* _ASM_X86_PROCESSOR_H */
18640 diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
18641 index 5fabf13..7388158 100644
18642 --- a/arch/x86/include/asm/ptrace.h
18643 +++ b/arch/x86/include/asm/ptrace.h
18644 @@ -125,15 +125,16 @@ static inline int v8086_mode(struct pt_regs *regs)
18645 #ifdef CONFIG_X86_64
18646 static inline bool user_64bit_mode(struct pt_regs *regs)
18647 {
18648 + unsigned long cs = regs->cs & 0xffff;
18649 #ifndef CONFIG_PARAVIRT
18650 /*
18651 * On non-paravirt systems, this is the only long mode CPL 3
18652 * selector. We do not allow long mode selectors in the LDT.
18653 */
18654 - return regs->cs == __USER_CS;
18655 + return cs == __USER_CS;
18656 #else
18657 /* Headers are too twisted for this to go in paravirt.h. */
18658 - return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
18659 + return cs == __USER_CS || cs == pv_info.extra_user_64bit_cs;
18660 #endif
18661 }
18662
18663 @@ -180,9 +181,11 @@ static inline unsigned long regs_get_register(struct pt_regs *regs,
18664 * Traps from the kernel do not save sp and ss.
18665 * Use the helper function to retrieve sp.
18666 */
18667 - if (offset == offsetof(struct pt_regs, sp) &&
18668 - regs->cs == __KERNEL_CS)
18669 - return kernel_stack_pointer(regs);
18670 + if (offset == offsetof(struct pt_regs, sp)) {
18671 + unsigned long cs = regs->cs & 0xffff;
18672 + if (cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS)
18673 + return kernel_stack_pointer(regs);
18674 + }
18675 #endif
18676 return *(unsigned long *)((unsigned long)regs + offset);
18677 }
18678 diff --git a/arch/x86/include/asm/qrwlock.h b/arch/x86/include/asm/qrwlock.h
18679 index ae0e241..e80b10b 100644
18680 --- a/arch/x86/include/asm/qrwlock.h
18681 +++ b/arch/x86/include/asm/qrwlock.h
18682 @@ -7,8 +7,8 @@
18683 #define queue_write_unlock queue_write_unlock
18684 static inline void queue_write_unlock(struct qrwlock *lock)
18685 {
18686 - barrier();
18687 - ACCESS_ONCE(*(u8 *)&lock->cnts) = 0;
18688 + barrier();
18689 + ACCESS_ONCE_RW(*(u8 *)&lock->cnts) = 0;
18690 }
18691 #endif
18692
18693 diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h
18694 index 9c6b890..5305f53 100644
18695 --- a/arch/x86/include/asm/realmode.h
18696 +++ b/arch/x86/include/asm/realmode.h
18697 @@ -22,16 +22,14 @@ struct real_mode_header {
18698 #endif
18699 /* APM/BIOS reboot */
18700 u32 machine_real_restart_asm;
18701 -#ifdef CONFIG_X86_64
18702 u32 machine_real_restart_seg;
18703 -#endif
18704 };
18705
18706 /* This must match data at trampoline_32/64.S */
18707 struct trampoline_header {
18708 #ifdef CONFIG_X86_32
18709 u32 start;
18710 - u16 gdt_pad;
18711 + u16 boot_cs;
18712 u16 gdt_limit;
18713 u32 gdt_base;
18714 #else
18715 diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
18716 index a82c4f1..ac45053 100644
18717 --- a/arch/x86/include/asm/reboot.h
18718 +++ b/arch/x86/include/asm/reboot.h
18719 @@ -6,13 +6,13 @@
18720 struct pt_regs;
18721
18722 struct machine_ops {
18723 - void (*restart)(char *cmd);
18724 - void (*halt)(void);
18725 - void (*power_off)(void);
18726 + void (* __noreturn restart)(char *cmd);
18727 + void (* __noreturn halt)(void);
18728 + void (* __noreturn power_off)(void);
18729 void (*shutdown)(void);
18730 void (*crash_shutdown)(struct pt_regs *);
18731 - void (*emergency_restart)(void);
18732 -};
18733 + void (* __noreturn emergency_restart)(void);
18734 +} __no_const;
18735
18736 extern struct machine_ops machine_ops;
18737
18738 diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h
18739 index 8f7866a..e442f20 100644
18740 --- a/arch/x86/include/asm/rmwcc.h
18741 +++ b/arch/x86/include/asm/rmwcc.h
18742 @@ -3,7 +3,34 @@
18743
18744 #ifdef CC_HAVE_ASM_GOTO
18745
18746 -#define __GEN_RMWcc(fullop, var, cc, ...) \
18747 +#ifdef CONFIG_PAX_REFCOUNT
18748 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18749 +do { \
18750 + asm_volatile_goto (fullop \
18751 + ";jno 0f\n" \
18752 + fullantiop \
18753 + ";int $4\n0:\n" \
18754 + _ASM_EXTABLE(0b, 0b) \
18755 + ";j" cc " %l[cc_label]" \
18756 + : : "m" (var), ## __VA_ARGS__ \
18757 + : "memory" : cc_label); \
18758 + return 0; \
18759 +cc_label: \
18760 + return 1; \
18761 +} while (0)
18762 +#else
18763 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18764 +do { \
18765 + asm_volatile_goto (fullop ";j" cc " %l[cc_label]" \
18766 + : : "m" (var), ## __VA_ARGS__ \
18767 + : "memory" : cc_label); \
18768 + return 0; \
18769 +cc_label: \
18770 + return 1; \
18771 +} while (0)
18772 +#endif
18773 +
18774 +#define __GEN_RMWcc_unchecked(fullop, var, cc, ...) \
18775 do { \
18776 asm_volatile_goto (fullop "; j" cc " %l[cc_label]" \
18777 : : "m" (var), ## __VA_ARGS__ \
18778 @@ -13,15 +40,46 @@ cc_label: \
18779 return 1; \
18780 } while (0)
18781
18782 -#define GEN_UNARY_RMWcc(op, var, arg0, cc) \
18783 - __GEN_RMWcc(op " " arg0, var, cc)
18784 +#define GEN_UNARY_RMWcc(op, antiop, var, arg0, cc) \
18785 + __GEN_RMWcc(op " " arg0, antiop " " arg0, var, cc)
18786
18787 -#define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \
18788 - __GEN_RMWcc(op " %1, " arg0, var, cc, vcon (val))
18789 +#define GEN_UNARY_RMWcc_unchecked(op, var, arg0, cc) \
18790 + __GEN_RMWcc_unchecked(op " " arg0, var, cc)
18791 +
18792 +#define GEN_BINARY_RMWcc(op, antiop, var, vcon, val, arg0, cc) \
18793 + __GEN_RMWcc(op " %1, " arg0, antiop " %1, " arg0, var, cc, vcon (val))
18794 +
18795 +#define GEN_BINARY_RMWcc_unchecked(op, var, vcon, val, arg0, cc) \
18796 + __GEN_RMWcc_unchecked(op " %1, " arg0, var, cc, vcon (val))
18797
18798 #else /* !CC_HAVE_ASM_GOTO */
18799
18800 -#define __GEN_RMWcc(fullop, var, cc, ...) \
18801 +#ifdef CONFIG_PAX_REFCOUNT
18802 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18803 +do { \
18804 + char c; \
18805 + asm volatile (fullop \
18806 + ";jno 0f\n" \
18807 + fullantiop \
18808 + ";int $4\n0:\n" \
18809 + _ASM_EXTABLE(0b, 0b) \
18810 + "; set" cc " %1" \
18811 + : "+m" (var), "=qm" (c) \
18812 + : __VA_ARGS__ : "memory"); \
18813 + return c != 0; \
18814 +} while (0)
18815 +#else
18816 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18817 +do { \
18818 + char c; \
18819 + asm volatile (fullop "; set" cc " %1" \
18820 + : "+m" (var), "=qm" (c) \
18821 + : __VA_ARGS__ : "memory"); \
18822 + return c != 0; \
18823 +} while (0)
18824 +#endif
18825 +
18826 +#define __GEN_RMWcc_unchecked(fullop, var, cc, ...) \
18827 do { \
18828 char c; \
18829 asm volatile (fullop "; set" cc " %1" \
18830 @@ -30,11 +88,17 @@ do { \
18831 return c != 0; \
18832 } while (0)
18833
18834 -#define GEN_UNARY_RMWcc(op, var, arg0, cc) \
18835 - __GEN_RMWcc(op " " arg0, var, cc)
18836 +#define GEN_UNARY_RMWcc(op, antiop, var, arg0, cc) \
18837 + __GEN_RMWcc(op " " arg0, antiop " " arg0, var, cc)
18838 +
18839 +#define GEN_UNARY_RMWcc_unchecked(op, var, arg0, cc) \
18840 + __GEN_RMWcc_unchecked(op " " arg0, var, cc)
18841 +
18842 +#define GEN_BINARY_RMWcc(op, antiop, var, vcon, val, arg0, cc) \
18843 + __GEN_RMWcc(op " %2, " arg0, antiop " %2, " arg0, var, cc, vcon (val))
18844
18845 -#define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \
18846 - __GEN_RMWcc(op " %2, " arg0, var, cc, vcon (val))
18847 +#define GEN_BINARY_RMWcc_unchecked(op, var, vcon, val, arg0, cc) \
18848 + __GEN_RMWcc_unchecked(op " %2, " arg0, var, cc, vcon (val))
18849
18850 #endif /* CC_HAVE_ASM_GOTO */
18851
18852 diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
18853 index cad82c9..2e5c5c1 100644
18854 --- a/arch/x86/include/asm/rwsem.h
18855 +++ b/arch/x86/include/asm/rwsem.h
18856 @@ -64,6 +64,14 @@ static inline void __down_read(struct rw_semaphore *sem)
18857 {
18858 asm volatile("# beginning down_read\n\t"
18859 LOCK_PREFIX _ASM_INC "(%1)\n\t"
18860 +
18861 +#ifdef CONFIG_PAX_REFCOUNT
18862 + "jno 0f\n"
18863 + LOCK_PREFIX _ASM_DEC "(%1)\n"
18864 + "int $4\n0:\n"
18865 + _ASM_EXTABLE(0b, 0b)
18866 +#endif
18867 +
18868 /* adds 0x00000001 */
18869 " jns 1f\n"
18870 " call call_rwsem_down_read_failed\n"
18871 @@ -85,6 +93,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
18872 "1:\n\t"
18873 " mov %1,%2\n\t"
18874 " add %3,%2\n\t"
18875 +
18876 +#ifdef CONFIG_PAX_REFCOUNT
18877 + "jno 0f\n"
18878 + "sub %3,%2\n"
18879 + "int $4\n0:\n"
18880 + _ASM_EXTABLE(0b, 0b)
18881 +#endif
18882 +
18883 " jle 2f\n\t"
18884 LOCK_PREFIX " cmpxchg %2,%0\n\t"
18885 " jnz 1b\n\t"
18886 @@ -104,6 +120,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
18887 long tmp;
18888 asm volatile("# beginning down_write\n\t"
18889 LOCK_PREFIX " xadd %1,(%2)\n\t"
18890 +
18891 +#ifdef CONFIG_PAX_REFCOUNT
18892 + "jno 0f\n"
18893 + "mov %1,(%2)\n"
18894 + "int $4\n0:\n"
18895 + _ASM_EXTABLE(0b, 0b)
18896 +#endif
18897 +
18898 /* adds 0xffff0001, returns the old value */
18899 " test " __ASM_SEL(%w1,%k1) "," __ASM_SEL(%w1,%k1) "\n\t"
18900 /* was the active mask 0 before? */
18901 @@ -155,6 +179,14 @@ static inline void __up_read(struct rw_semaphore *sem)
18902 long tmp;
18903 asm volatile("# beginning __up_read\n\t"
18904 LOCK_PREFIX " xadd %1,(%2)\n\t"
18905 +
18906 +#ifdef CONFIG_PAX_REFCOUNT
18907 + "jno 0f\n"
18908 + "mov %1,(%2)\n"
18909 + "int $4\n0:\n"
18910 + _ASM_EXTABLE(0b, 0b)
18911 +#endif
18912 +
18913 /* subtracts 1, returns the old value */
18914 " jns 1f\n\t"
18915 " call call_rwsem_wake\n" /* expects old value in %edx */
18916 @@ -173,6 +205,14 @@ static inline void __up_write(struct rw_semaphore *sem)
18917 long tmp;
18918 asm volatile("# beginning __up_write\n\t"
18919 LOCK_PREFIX " xadd %1,(%2)\n\t"
18920 +
18921 +#ifdef CONFIG_PAX_REFCOUNT
18922 + "jno 0f\n"
18923 + "mov %1,(%2)\n"
18924 + "int $4\n0:\n"
18925 + _ASM_EXTABLE(0b, 0b)
18926 +#endif
18927 +
18928 /* subtracts 0xffff0001, returns the old value */
18929 " jns 1f\n\t"
18930 " call call_rwsem_wake\n" /* expects old value in %edx */
18931 @@ -190,6 +230,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
18932 {
18933 asm volatile("# beginning __downgrade_write\n\t"
18934 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
18935 +
18936 +#ifdef CONFIG_PAX_REFCOUNT
18937 + "jno 0f\n"
18938 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
18939 + "int $4\n0:\n"
18940 + _ASM_EXTABLE(0b, 0b)
18941 +#endif
18942 +
18943 /*
18944 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
18945 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
18946 @@ -208,7 +256,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
18947 */
18948 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
18949 {
18950 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
18951 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
18952 +
18953 +#ifdef CONFIG_PAX_REFCOUNT
18954 + "jno 0f\n"
18955 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
18956 + "int $4\n0:\n"
18957 + _ASM_EXTABLE(0b, 0b)
18958 +#endif
18959 +
18960 : "+m" (sem->count)
18961 : "er" (delta));
18962 }
18963 @@ -218,7 +274,7 @@ static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
18964 */
18965 static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
18966 {
18967 - return delta + xadd(&sem->count, delta);
18968 + return delta + xadd_check_overflow(&sem->count, delta);
18969 }
18970
18971 #endif /* __KERNEL__ */
18972 diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
18973 index 7d5a192..23ef1aa 100644
18974 --- a/arch/x86/include/asm/segment.h
18975 +++ b/arch/x86/include/asm/segment.h
18976 @@ -82,14 +82,20 @@
18977 * 26 - ESPFIX small SS
18978 * 27 - per-cpu [ offset to per-cpu data area ]
18979 * 28 - stack_canary-20 [ for stack protector ] <=== cacheline #8
18980 - * 29 - unused
18981 - * 30 - unused
18982 + * 29 - PCI BIOS CS
18983 + * 30 - PCI BIOS DS
18984 * 31 - TSS for double fault handler
18985 */
18986 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
18987 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
18988 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
18989 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
18990 +
18991 #define GDT_ENTRY_TLS_MIN 6
18992 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
18993
18994 #define GDT_ENTRY_KERNEL_CS 12
18995 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 4
18996 #define GDT_ENTRY_KERNEL_DS 13
18997 #define GDT_ENTRY_DEFAULT_USER_CS 14
18998 #define GDT_ENTRY_DEFAULT_USER_DS 15
18999 @@ -106,6 +112,12 @@
19000 #define GDT_ENTRY_PERCPU 27
19001 #define GDT_ENTRY_STACK_CANARY 28
19002
19003 +#define GDT_ENTRY_PCIBIOS_CS 29
19004 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
19005 +
19006 +#define GDT_ENTRY_PCIBIOS_DS 30
19007 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
19008 +
19009 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
19010
19011 /*
19012 @@ -118,6 +130,7 @@
19013 */
19014
19015 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
19016 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
19017 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
19018 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8 + 3)
19019 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8 + 3)
19020 @@ -129,7 +142,7 @@
19021 #define PNP_CS16 (GDT_ENTRY_PNPBIOS_CS16*8)
19022
19023 /* "Is this PNP code selector (PNP_CS32 or PNP_CS16)?" */
19024 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == PNP_CS32)
19025 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
19026
19027 /* data segment for BIOS: */
19028 #define PNP_DS (GDT_ENTRY_PNPBIOS_DS*8)
19029 @@ -176,6 +189,8 @@
19030 #define GDT_ENTRY_DEFAULT_USER_DS 5
19031 #define GDT_ENTRY_DEFAULT_USER_CS 6
19032
19033 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
19034 +
19035 /* Needs two entries */
19036 #define GDT_ENTRY_TSS 8
19037 /* Needs two entries */
19038 @@ -187,10 +202,12 @@
19039 /* Abused to load per CPU data from limit */
19040 #define GDT_ENTRY_PER_CPU 15
19041
19042 +#define GDT_ENTRY_UDEREF_KERNEL_DS 16
19043 +
19044 /*
19045 * Number of entries in the GDT table:
19046 */
19047 -#define GDT_ENTRIES 16
19048 +#define GDT_ENTRIES 17
19049
19050 /*
19051 * Segment selector values corresponding to the above entries:
19052 @@ -200,7 +217,9 @@
19053 */
19054 #define __KERNEL32_CS (GDT_ENTRY_KERNEL32_CS*8)
19055 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
19056 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
19057 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
19058 +#define __UDEREF_KERNEL_DS (GDT_ENTRY_UDEREF_KERNEL_DS*8)
19059 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8 + 3)
19060 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8 + 3)
19061 #define __USER32_DS __USER_DS
19062 diff --git a/arch/x86/include/asm/smap.h b/arch/x86/include/asm/smap.h
19063 index ba665eb..0f72938 100644
19064 --- a/arch/x86/include/asm/smap.h
19065 +++ b/arch/x86/include/asm/smap.h
19066 @@ -25,6 +25,18 @@
19067
19068 #include <asm/alternative-asm.h>
19069
19070 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19071 +#define ASM_PAX_OPEN_USERLAND \
19072 + ALTERNATIVE "", "call __pax_open_userland", X86_FEATURE_STRONGUDEREF
19073 +
19074 +#define ASM_PAX_CLOSE_USERLAND \
19075 + ALTERNATIVE "", "call __pax_close_userland", X86_FEATURE_STRONGUDEREF
19076 +
19077 +#else
19078 +#define ASM_PAX_OPEN_USERLAND
19079 +#define ASM_PAX_CLOSE_USERLAND
19080 +#endif
19081 +
19082 #ifdef CONFIG_X86_SMAP
19083
19084 #define ASM_CLAC \
19085 @@ -44,6 +56,37 @@
19086
19087 #include <asm/alternative.h>
19088
19089 +#define __HAVE_ARCH_PAX_OPEN_USERLAND
19090 +#define __HAVE_ARCH_PAX_CLOSE_USERLAND
19091 +
19092 +extern void __pax_open_userland(void);
19093 +static __always_inline unsigned long pax_open_userland(void)
19094 +{
19095 +
19096 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19097 + asm volatile(ALTERNATIVE("", "call %P[open]", X86_FEATURE_STRONGUDEREF)
19098 + :
19099 + : [open] "i" (__pax_open_userland)
19100 + : "memory", "rax");
19101 +#endif
19102 +
19103 + return 0;
19104 +}
19105 +
19106 +extern void __pax_close_userland(void);
19107 +static __always_inline unsigned long pax_close_userland(void)
19108 +{
19109 +
19110 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19111 + asm volatile(ALTERNATIVE("", "call %P[close]", X86_FEATURE_STRONGUDEREF)
19112 + :
19113 + : [close] "i" (__pax_close_userland)
19114 + : "memory", "rax");
19115 +#endif
19116 +
19117 + return 0;
19118 +}
19119 +
19120 #ifdef CONFIG_X86_SMAP
19121
19122 static __always_inline void clac(void)
19123 diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
19124 index 17a8dce..79f7280 100644
19125 --- a/arch/x86/include/asm/smp.h
19126 +++ b/arch/x86/include/asm/smp.h
19127 @@ -35,7 +35,7 @@ DECLARE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_core_map);
19128 /* cpus sharing the last level cache: */
19129 DECLARE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_llc_shared_map);
19130 DECLARE_PER_CPU_READ_MOSTLY(u16, cpu_llc_id);
19131 -DECLARE_PER_CPU_READ_MOSTLY(int, cpu_number);
19132 +DECLARE_PER_CPU_READ_MOSTLY(unsigned int, cpu_number);
19133
19134 static inline struct cpumask *cpu_sibling_mask(int cpu)
19135 {
19136 @@ -78,7 +78,7 @@ struct smp_ops {
19137
19138 void (*send_call_func_ipi)(const struct cpumask *mask);
19139 void (*send_call_func_single_ipi)(int cpu);
19140 -};
19141 +} __no_const;
19142
19143 /* Globals due to paravirt */
19144 extern void set_cpu_sibling_map(int cpu);
19145 @@ -192,14 +192,8 @@ extern unsigned disabled_cpus;
19146 extern int safe_smp_processor_id(void);
19147
19148 #elif defined(CONFIG_X86_64_SMP)
19149 -#define raw_smp_processor_id() (this_cpu_read(cpu_number))
19150 -
19151 -#define stack_smp_processor_id() \
19152 -({ \
19153 - struct thread_info *ti; \
19154 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
19155 - ti->cpu; \
19156 -})
19157 +#define raw_smp_processor_id() (this_cpu_read(cpu_number))
19158 +#define stack_smp_processor_id() raw_smp_processor_id()
19159 #define safe_smp_processor_id() smp_processor_id()
19160
19161 #endif
19162 diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
19163 index 6a99859..03cb807 100644
19164 --- a/arch/x86/include/asm/stackprotector.h
19165 +++ b/arch/x86/include/asm/stackprotector.h
19166 @@ -47,7 +47,7 @@
19167 * head_32 for boot CPU and setup_per_cpu_areas() for others.
19168 */
19169 #define GDT_STACK_CANARY_INIT \
19170 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
19171 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
19172
19173 /*
19174 * Initialize the stackprotector canary value.
19175 @@ -112,7 +112,7 @@ static inline void setup_stack_canary_segment(int cpu)
19176
19177 static inline void load_stack_canary_segment(void)
19178 {
19179 -#ifdef CONFIG_X86_32
19180 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
19181 asm volatile ("mov %0, %%gs" : : "r" (0));
19182 #endif
19183 }
19184 diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
19185 index 70bbe39..4ae2bd4 100644
19186 --- a/arch/x86/include/asm/stacktrace.h
19187 +++ b/arch/x86/include/asm/stacktrace.h
19188 @@ -11,28 +11,20 @@
19189
19190 extern int kstack_depth_to_print;
19191
19192 -struct thread_info;
19193 +struct task_struct;
19194 struct stacktrace_ops;
19195
19196 -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
19197 - unsigned long *stack,
19198 - unsigned long bp,
19199 - const struct stacktrace_ops *ops,
19200 - void *data,
19201 - unsigned long *end,
19202 - int *graph);
19203 +typedef unsigned long walk_stack_t(struct task_struct *task,
19204 + void *stack_start,
19205 + unsigned long *stack,
19206 + unsigned long bp,
19207 + const struct stacktrace_ops *ops,
19208 + void *data,
19209 + unsigned long *end,
19210 + int *graph);
19211
19212 -extern unsigned long
19213 -print_context_stack(struct thread_info *tinfo,
19214 - unsigned long *stack, unsigned long bp,
19215 - const struct stacktrace_ops *ops, void *data,
19216 - unsigned long *end, int *graph);
19217 -
19218 -extern unsigned long
19219 -print_context_stack_bp(struct thread_info *tinfo,
19220 - unsigned long *stack, unsigned long bp,
19221 - const struct stacktrace_ops *ops, void *data,
19222 - unsigned long *end, int *graph);
19223 +extern walk_stack_t print_context_stack;
19224 +extern walk_stack_t print_context_stack_bp;
19225
19226 /* Generic stack tracer with callbacks */
19227
19228 @@ -40,7 +32,7 @@ struct stacktrace_ops {
19229 void (*address)(void *data, unsigned long address, int reliable);
19230 /* On negative return stop dumping */
19231 int (*stack)(void *data, char *name);
19232 - walk_stack_t walk_stack;
19233 + walk_stack_t *walk_stack;
19234 };
19235
19236 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
19237 diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
19238 index 751bf4b..a1278b5 100644
19239 --- a/arch/x86/include/asm/switch_to.h
19240 +++ b/arch/x86/include/asm/switch_to.h
19241 @@ -112,7 +112,7 @@ do { \
19242 "call __switch_to\n\t" \
19243 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
19244 __switch_canary \
19245 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
19246 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
19247 "movq %%rax,%%rdi\n\t" \
19248 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
19249 "jnz ret_from_fork\n\t" \
19250 @@ -123,7 +123,7 @@ do { \
19251 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
19252 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
19253 [_tif_fork] "i" (_TIF_FORK), \
19254 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
19255 + [thread_info] "m" (current_tinfo), \
19256 [current_task] "m" (current_task) \
19257 __switch_canary_iparam \
19258 : "memory", "cc" __EXTRA_CLOBBER)
19259 diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
19260 index b4bdec3..e8af9bc 100644
19261 --- a/arch/x86/include/asm/thread_info.h
19262 +++ b/arch/x86/include/asm/thread_info.h
19263 @@ -36,7 +36,7 @@
19264 #ifdef CONFIG_X86_32
19265 # define TOP_OF_KERNEL_STACK_PADDING 8
19266 #else
19267 -# define TOP_OF_KERNEL_STACK_PADDING 0
19268 +# define TOP_OF_KERNEL_STACK_PADDING 16
19269 #endif
19270
19271 /*
19272 @@ -50,27 +50,26 @@ struct task_struct;
19273 #include <linux/atomic.h>
19274
19275 struct thread_info {
19276 - struct task_struct *task; /* main task structure */
19277 __u32 flags; /* low level flags */
19278 __u32 status; /* thread synchronous flags */
19279 __u32 cpu; /* current CPU */
19280 int saved_preempt_count;
19281 mm_segment_t addr_limit;
19282 void __user *sysenter_return;
19283 + unsigned long lowest_stack;
19284 unsigned int sig_on_uaccess_error:1;
19285 unsigned int uaccess_err:1; /* uaccess failed */
19286 };
19287
19288 -#define INIT_THREAD_INFO(tsk) \
19289 +#define INIT_THREAD_INFO \
19290 { \
19291 - .task = &tsk, \
19292 .flags = 0, \
19293 .cpu = 0, \
19294 .saved_preempt_count = INIT_PREEMPT_COUNT, \
19295 .addr_limit = KERNEL_DS, \
19296 }
19297
19298 -#define init_thread_info (init_thread_union.thread_info)
19299 +#define init_thread_info (init_thread_union.stack)
19300 #define init_stack (init_thread_union.stack)
19301
19302 #else /* !__ASSEMBLY__ */
19303 @@ -110,6 +109,7 @@ struct thread_info {
19304 #define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */
19305 #define TIF_ADDR32 29 /* 32-bit address space on 64 bits */
19306 #define TIF_X32 30 /* 32-bit native x86-64 binary */
19307 +#define TIF_GRSEC_SETXID 31 /* update credentials on syscall entry/exit */
19308
19309 #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
19310 #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
19311 @@ -133,17 +133,18 @@ struct thread_info {
19312 #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
19313 #define _TIF_ADDR32 (1 << TIF_ADDR32)
19314 #define _TIF_X32 (1 << TIF_X32)
19315 +#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
19316
19317 /* work to do in syscall_trace_enter() */
19318 #define _TIF_WORK_SYSCALL_ENTRY \
19319 (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT | \
19320 _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT | \
19321 - _TIF_NOHZ)
19322 + _TIF_NOHZ | _TIF_GRSEC_SETXID)
19323
19324 /* work to do in syscall_trace_leave() */
19325 #define _TIF_WORK_SYSCALL_EXIT \
19326 (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP | \
19327 - _TIF_SYSCALL_TRACEPOINT | _TIF_NOHZ)
19328 + _TIF_SYSCALL_TRACEPOINT | _TIF_NOHZ | _TIF_GRSEC_SETXID)
19329
19330 /* work to do on interrupt/exception return */
19331 #define _TIF_WORK_MASK \
19332 @@ -154,7 +155,7 @@ struct thread_info {
19333 /* work to do on any return to user space */
19334 #define _TIF_ALLWORK_MASK \
19335 ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT | \
19336 - _TIF_NOHZ)
19337 + _TIF_NOHZ | _TIF_GRSEC_SETXID)
19338
19339 /* Only used for 64 bit */
19340 #define _TIF_DO_NOTIFY_MASK \
19341 @@ -179,9 +180,11 @@ struct thread_info {
19342
19343 DECLARE_PER_CPU(unsigned long, kernel_stack);
19344
19345 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
19346 +
19347 static inline struct thread_info *current_thread_info(void)
19348 {
19349 - return (struct thread_info *)(current_top_of_stack() - THREAD_SIZE);
19350 + return this_cpu_read_stable(current_tinfo);
19351 }
19352
19353 static inline unsigned long current_stack_pointer(void)
19354 @@ -199,8 +202,7 @@ static inline unsigned long current_stack_pointer(void)
19355
19356 /* Load thread_info address into "reg" */
19357 #define GET_THREAD_INFO(reg) \
19358 - _ASM_MOV PER_CPU_VAR(kernel_stack),reg ; \
19359 - _ASM_SUB $(THREAD_SIZE),reg ;
19360 + _ASM_MOV PER_CPU_VAR(current_tinfo),reg ;
19361
19362 /*
19363 * ASM operand which evaluates to a 'thread_info' address of
19364 @@ -293,5 +295,12 @@ static inline bool is_ia32_task(void)
19365 extern void arch_task_cache_init(void);
19366 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
19367 extern void arch_release_task_struct(struct task_struct *tsk);
19368 +
19369 +#define __HAVE_THREAD_FUNCTIONS
19370 +#define task_thread_info(task) (&(task)->tinfo)
19371 +#define task_stack_page(task) ((task)->stack)
19372 +#define setup_thread_stack(p, org) do {} while (0)
19373 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
19374 +
19375 #endif
19376 #endif /* _ASM_X86_THREAD_INFO_H */
19377 diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
19378 index cd79194..e7a9491 100644
19379 --- a/arch/x86/include/asm/tlbflush.h
19380 +++ b/arch/x86/include/asm/tlbflush.h
19381 @@ -86,18 +86,44 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
19382
19383 static inline void __native_flush_tlb(void)
19384 {
19385 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
19386 + u64 descriptor[2];
19387 +
19388 + descriptor[0] = PCID_KERNEL;
19389 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_ALL_NONGLOBAL) : "memory");
19390 + return;
19391 + }
19392 +
19393 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19394 + if (static_cpu_has(X86_FEATURE_PCID)) {
19395 + unsigned int cpu = raw_get_cpu();
19396 +
19397 + native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
19398 + native_write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL);
19399 + raw_put_cpu_no_resched();
19400 + return;
19401 + }
19402 +#endif
19403 +
19404 native_write_cr3(native_read_cr3());
19405 }
19406
19407 static inline void __native_flush_tlb_global_irq_disabled(void)
19408 {
19409 - unsigned long cr4;
19410 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
19411 + u64 descriptor[2];
19412
19413 - cr4 = this_cpu_read(cpu_tlbstate.cr4);
19414 - /* clear PGE */
19415 - native_write_cr4(cr4 & ~X86_CR4_PGE);
19416 - /* write old PGE again and flush TLBs */
19417 - native_write_cr4(cr4);
19418 + descriptor[0] = PCID_KERNEL;
19419 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_ALL_GLOBAL) : "memory");
19420 + } else {
19421 + unsigned long cr4;
19422 +
19423 + cr4 = this_cpu_read(cpu_tlbstate.cr4);
19424 + /* clear PGE */
19425 + native_write_cr4(cr4 & ~X86_CR4_PGE);
19426 + /* write old PGE again and flush TLBs */
19427 + native_write_cr4(cr4);
19428 + }
19429 }
19430
19431 static inline void __native_flush_tlb_global(void)
19432 @@ -118,6 +144,41 @@ static inline void __native_flush_tlb_global(void)
19433
19434 static inline void __native_flush_tlb_single(unsigned long addr)
19435 {
19436 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
19437 + u64 descriptor[2];
19438 +
19439 + descriptor[0] = PCID_KERNEL;
19440 + descriptor[1] = addr;
19441 +
19442 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19443 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) || addr >= TASK_SIZE_MAX) {
19444 + if (addr < TASK_SIZE_MAX)
19445 + descriptor[1] += pax_user_shadow_base;
19446 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
19447 + }
19448 +
19449 + descriptor[0] = PCID_USER;
19450 + descriptor[1] = addr;
19451 +#endif
19452 +
19453 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
19454 + return;
19455 + }
19456 +
19457 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19458 + if (static_cpu_has(X86_FEATURE_PCID)) {
19459 + unsigned int cpu = raw_get_cpu();
19460 +
19461 + native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER | PCID_NOFLUSH);
19462 + asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
19463 + native_write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
19464 + raw_put_cpu_no_resched();
19465 +
19466 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) && addr < TASK_SIZE_MAX)
19467 + addr += pax_user_shadow_base;
19468 + }
19469 +#endif
19470 +
19471 asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
19472 }
19473
19474 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
19475 index ace9dec..3f9e253 100644
19476 --- a/arch/x86/include/asm/uaccess.h
19477 +++ b/arch/x86/include/asm/uaccess.h
19478 @@ -7,6 +7,7 @@
19479 #include <linux/compiler.h>
19480 #include <linux/thread_info.h>
19481 #include <linux/string.h>
19482 +#include <linux/spinlock.h>
19483 #include <asm/asm.h>
19484 #include <asm/page.h>
19485 #include <asm/smap.h>
19486 @@ -29,7 +30,12 @@
19487
19488 #define get_ds() (KERNEL_DS)
19489 #define get_fs() (current_thread_info()->addr_limit)
19490 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19491 +void __set_fs(mm_segment_t x);
19492 +void set_fs(mm_segment_t x);
19493 +#else
19494 #define set_fs(x) (current_thread_info()->addr_limit = (x))
19495 +#endif
19496
19497 #define segment_eq(a, b) ((a).seg == (b).seg)
19498
19499 @@ -85,8 +91,36 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un
19500 * checks that the pointer is in the user space range - after calling
19501 * this function, memory access functions may still return -EFAULT.
19502 */
19503 -#define access_ok(type, addr, size) \
19504 - likely(!__range_not_ok(addr, size, user_addr_max()))
19505 +extern int _cond_resched(void);
19506 +#define access_ok_noprefault(type, addr, size) (likely(!__range_not_ok(addr, size, user_addr_max())))
19507 +#define access_ok(type, addr, size) \
19508 +({ \
19509 + unsigned long __size = size; \
19510 + unsigned long __addr = (unsigned long)addr; \
19511 + bool __ret_ao = __range_not_ok(__addr, __size, user_addr_max()) == 0;\
19512 + if (__ret_ao && __size) { \
19513 + unsigned long __addr_ao = __addr & PAGE_MASK; \
19514 + unsigned long __end_ao = __addr + __size - 1; \
19515 + if (unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
19516 + while (__addr_ao <= __end_ao) { \
19517 + char __c_ao; \
19518 + __addr_ao += PAGE_SIZE; \
19519 + if (__size > PAGE_SIZE) \
19520 + _cond_resched(); \
19521 + if (__get_user(__c_ao, (char __user *)__addr)) \
19522 + break; \
19523 + if (type != VERIFY_WRITE) { \
19524 + __addr = __addr_ao; \
19525 + continue; \
19526 + } \
19527 + if (__put_user(__c_ao, (char __user *)__addr)) \
19528 + break; \
19529 + __addr = __addr_ao; \
19530 + } \
19531 + } \
19532 + } \
19533 + __ret_ao; \
19534 +})
19535
19536 /*
19537 * The exception table consists of pairs of addresses relative to the
19538 @@ -134,11 +168,13 @@ extern int __get_user_8(void);
19539 extern int __get_user_bad(void);
19540
19541 /*
19542 - * This is a type: either unsigned long, if the argument fits into
19543 - * that type, or otherwise unsigned long long.
19544 + * This is a type: either (un)signed int, if the argument fits into
19545 + * that type, or otherwise (un)signed long long.
19546 */
19547 #define __inttype(x) \
19548 -__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
19549 +__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0U), \
19550 + __builtin_choose_expr(__type_is_unsigned(__typeof__(x)), 0ULL, 0LL),\
19551 + __builtin_choose_expr(__type_is_unsigned(__typeof__(x)), 0U, 0)))
19552
19553 /**
19554 * get_user: - Get a simple variable from user space.
19555 @@ -176,10 +212,12 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
19556 register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX); \
19557 __chk_user_ptr(ptr); \
19558 might_fault(); \
19559 + pax_open_userland(); \
19560 asm volatile("call __get_user_%P3" \
19561 : "=a" (__ret_gu), "=r" (__val_gu) \
19562 : "0" (ptr), "i" (sizeof(*(ptr)))); \
19563 (x) = (__force __typeof__(*(ptr))) __val_gu; \
19564 + pax_close_userland(); \
19565 __ret_gu; \
19566 })
19567
19568 @@ -187,13 +225,21 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
19569 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
19570 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
19571
19572 -
19573 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19574 +#define __copyuser_seg "gs;"
19575 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
19576 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
19577 +#else
19578 +#define __copyuser_seg
19579 +#define __COPYUSER_SET_ES
19580 +#define __COPYUSER_RESTORE_ES
19581 +#endif
19582
19583 #ifdef CONFIG_X86_32
19584 #define __put_user_asm_u64(x, addr, err, errret) \
19585 asm volatile(ASM_STAC "\n" \
19586 - "1: movl %%eax,0(%2)\n" \
19587 - "2: movl %%edx,4(%2)\n" \
19588 + "1: "__copyuser_seg"movl %%eax,0(%2)\n" \
19589 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
19590 "3: " ASM_CLAC "\n" \
19591 ".section .fixup,\"ax\"\n" \
19592 "4: movl %3,%0\n" \
19593 @@ -206,8 +252,8 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
19594
19595 #define __put_user_asm_ex_u64(x, addr) \
19596 asm volatile(ASM_STAC "\n" \
19597 - "1: movl %%eax,0(%1)\n" \
19598 - "2: movl %%edx,4(%1)\n" \
19599 + "1: "__copyuser_seg"movl %%eax,0(%1)\n" \
19600 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
19601 "3: " ASM_CLAC "\n" \
19602 _ASM_EXTABLE_EX(1b, 2b) \
19603 _ASM_EXTABLE_EX(2b, 3b) \
19604 @@ -257,7 +303,8 @@ extern void __put_user_8(void);
19605 __typeof__(*(ptr)) __pu_val; \
19606 __chk_user_ptr(ptr); \
19607 might_fault(); \
19608 - __pu_val = x; \
19609 + __pu_val = (x); \
19610 + pax_open_userland(); \
19611 switch (sizeof(*(ptr))) { \
19612 case 1: \
19613 __put_user_x(1, __pu_val, ptr, __ret_pu); \
19614 @@ -275,6 +322,7 @@ extern void __put_user_8(void);
19615 __put_user_x(X, __pu_val, ptr, __ret_pu); \
19616 break; \
19617 } \
19618 + pax_close_userland(); \
19619 __ret_pu; \
19620 })
19621
19622 @@ -355,8 +403,10 @@ do { \
19623 } while (0)
19624
19625 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
19626 +do { \
19627 + pax_open_userland(); \
19628 asm volatile(ASM_STAC "\n" \
19629 - "1: mov"itype" %2,%"rtype"1\n" \
19630 + "1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
19631 "2: " ASM_CLAC "\n" \
19632 ".section .fixup,\"ax\"\n" \
19633 "3: mov %3,%0\n" \
19634 @@ -364,8 +414,10 @@ do { \
19635 " jmp 2b\n" \
19636 ".previous\n" \
19637 _ASM_EXTABLE(1b, 3b) \
19638 - : "=r" (err), ltype(x) \
19639 - : "m" (__m(addr)), "i" (errret), "0" (err))
19640 + : "=r" (err), ltype (x) \
19641 + : "m" (__m(addr)), "i" (errret), "0" (err)); \
19642 + pax_close_userland(); \
19643 +} while (0)
19644
19645 #define __get_user_size_ex(x, ptr, size) \
19646 do { \
19647 @@ -389,7 +441,7 @@ do { \
19648 } while (0)
19649
19650 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
19651 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
19652 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
19653 "2:\n" \
19654 _ASM_EXTABLE_EX(1b, 2b) \
19655 : ltype(x) : "m" (__m(addr)))
19656 @@ -406,13 +458,24 @@ do { \
19657 int __gu_err; \
19658 unsigned long __gu_val; \
19659 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
19660 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
19661 + (x) = (__typeof__(*(ptr)))__gu_val; \
19662 __gu_err; \
19663 })
19664
19665 /* FIXME: this hack is definitely wrong -AK */
19666 struct __large_struct { unsigned long buf[100]; };
19667 -#define __m(x) (*(struct __large_struct __user *)(x))
19668 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19669 +#define ____m(x) \
19670 +({ \
19671 + unsigned long ____x = (unsigned long)(x); \
19672 + if (____x < pax_user_shadow_base) \
19673 + ____x += pax_user_shadow_base; \
19674 + (typeof(x))____x; \
19675 +})
19676 +#else
19677 +#define ____m(x) (x)
19678 +#endif
19679 +#define __m(x) (*(struct __large_struct __user *)____m(x))
19680
19681 /*
19682 * Tell gcc we read from memory instead of writing: this is because
19683 @@ -420,8 +483,10 @@ struct __large_struct { unsigned long buf[100]; };
19684 * aliasing issues.
19685 */
19686 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
19687 +do { \
19688 + pax_open_userland(); \
19689 asm volatile(ASM_STAC "\n" \
19690 - "1: mov"itype" %"rtype"1,%2\n" \
19691 + "1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
19692 "2: " ASM_CLAC "\n" \
19693 ".section .fixup,\"ax\"\n" \
19694 "3: mov %3,%0\n" \
19695 @@ -429,10 +494,12 @@ struct __large_struct { unsigned long buf[100]; };
19696 ".previous\n" \
19697 _ASM_EXTABLE(1b, 3b) \
19698 : "=r"(err) \
19699 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
19700 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err));\
19701 + pax_close_userland(); \
19702 +} while (0)
19703
19704 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
19705 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
19706 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
19707 "2:\n" \
19708 _ASM_EXTABLE_EX(1b, 2b) \
19709 : : ltype(x), "m" (__m(addr)))
19710 @@ -442,11 +509,13 @@ struct __large_struct { unsigned long buf[100]; };
19711 */
19712 #define uaccess_try do { \
19713 current_thread_info()->uaccess_err = 0; \
19714 + pax_open_userland(); \
19715 stac(); \
19716 barrier();
19717
19718 #define uaccess_catch(err) \
19719 clac(); \
19720 + pax_close_userland(); \
19721 (err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \
19722 } while (0)
19723
19724 @@ -471,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; };
19725 * On error, the variable @x is set to zero.
19726 */
19727
19728 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19729 +#define __get_user(x, ptr) get_user((x), (ptr))
19730 +#else
19731 #define __get_user(x, ptr) \
19732 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
19733 +#endif
19734
19735 /**
19736 * __put_user: - Write a simple value into user space, with less checking.
19737 @@ -494,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; };
19738 * Returns zero on success, or -EFAULT on error.
19739 */
19740
19741 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19742 +#define __put_user(x, ptr) put_user((x), (ptr))
19743 +#else
19744 #define __put_user(x, ptr) \
19745 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
19746 +#endif
19747
19748 #define __get_user_unaligned __get_user
19749 #define __put_user_unaligned __put_user
19750 @@ -513,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; };
19751 #define get_user_ex(x, ptr) do { \
19752 unsigned long __gue_val; \
19753 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
19754 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
19755 + (x) = (__typeof__(*(ptr)))__gue_val; \
19756 } while (0)
19757
19758 #define put_user_try uaccess_try
19759 @@ -531,7 +608,7 @@ extern __must_check long strlen_user(const char __user *str);
19760 extern __must_check long strnlen_user(const char __user *str, long n);
19761
19762 unsigned long __must_check clear_user(void __user *mem, unsigned long len);
19763 -unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
19764 +unsigned long __must_check __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
19765
19766 extern void __cmpxchg_wrong_size(void)
19767 __compiletime_error("Bad argument size for cmpxchg");
19768 @@ -542,18 +619,19 @@ extern void __cmpxchg_wrong_size(void)
19769 __typeof__(ptr) __uval = (uval); \
19770 __typeof__(*(ptr)) __old = (old); \
19771 __typeof__(*(ptr)) __new = (new); \
19772 + pax_open_userland(); \
19773 switch (size) { \
19774 case 1: \
19775 { \
19776 asm volatile("\t" ASM_STAC "\n" \
19777 - "1:\t" LOCK_PREFIX "cmpxchgb %4, %2\n" \
19778 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgb %4, %2\n"\
19779 "2:\t" ASM_CLAC "\n" \
19780 "\t.section .fixup, \"ax\"\n" \
19781 "3:\tmov %3, %0\n" \
19782 "\tjmp 2b\n" \
19783 "\t.previous\n" \
19784 _ASM_EXTABLE(1b, 3b) \
19785 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19786 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19787 : "i" (-EFAULT), "q" (__new), "1" (__old) \
19788 : "memory" \
19789 ); \
19790 @@ -562,14 +640,14 @@ extern void __cmpxchg_wrong_size(void)
19791 case 2: \
19792 { \
19793 asm volatile("\t" ASM_STAC "\n" \
19794 - "1:\t" LOCK_PREFIX "cmpxchgw %4, %2\n" \
19795 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgw %4, %2\n"\
19796 "2:\t" ASM_CLAC "\n" \
19797 "\t.section .fixup, \"ax\"\n" \
19798 "3:\tmov %3, %0\n" \
19799 "\tjmp 2b\n" \
19800 "\t.previous\n" \
19801 _ASM_EXTABLE(1b, 3b) \
19802 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19803 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19804 : "i" (-EFAULT), "r" (__new), "1" (__old) \
19805 : "memory" \
19806 ); \
19807 @@ -578,14 +656,14 @@ extern void __cmpxchg_wrong_size(void)
19808 case 4: \
19809 { \
19810 asm volatile("\t" ASM_STAC "\n" \
19811 - "1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n" \
19812 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"\
19813 "2:\t" ASM_CLAC "\n" \
19814 "\t.section .fixup, \"ax\"\n" \
19815 "3:\tmov %3, %0\n" \
19816 "\tjmp 2b\n" \
19817 "\t.previous\n" \
19818 _ASM_EXTABLE(1b, 3b) \
19819 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19820 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19821 : "i" (-EFAULT), "r" (__new), "1" (__old) \
19822 : "memory" \
19823 ); \
19824 @@ -597,14 +675,14 @@ extern void __cmpxchg_wrong_size(void)
19825 __cmpxchg_wrong_size(); \
19826 \
19827 asm volatile("\t" ASM_STAC "\n" \
19828 - "1:\t" LOCK_PREFIX "cmpxchgq %4, %2\n" \
19829 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgq %4, %2\n"\
19830 "2:\t" ASM_CLAC "\n" \
19831 "\t.section .fixup, \"ax\"\n" \
19832 "3:\tmov %3, %0\n" \
19833 "\tjmp 2b\n" \
19834 "\t.previous\n" \
19835 _ASM_EXTABLE(1b, 3b) \
19836 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19837 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19838 : "i" (-EFAULT), "r" (__new), "1" (__old) \
19839 : "memory" \
19840 ); \
19841 @@ -613,6 +691,7 @@ extern void __cmpxchg_wrong_size(void)
19842 default: \
19843 __cmpxchg_wrong_size(); \
19844 } \
19845 + pax_close_userland(); \
19846 *__uval = __old; \
19847 __ret; \
19848 })
19849 @@ -636,17 +715,6 @@ extern struct movsl_mask {
19850
19851 #define ARCH_HAS_NOCACHE_UACCESS 1
19852
19853 -#ifdef CONFIG_X86_32
19854 -# include <asm/uaccess_32.h>
19855 -#else
19856 -# include <asm/uaccess_64.h>
19857 -#endif
19858 -
19859 -unsigned long __must_check _copy_from_user(void *to, const void __user *from,
19860 - unsigned n);
19861 -unsigned long __must_check _copy_to_user(void __user *to, const void *from,
19862 - unsigned n);
19863 -
19864 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
19865 # define copy_user_diag __compiletime_error
19866 #else
19867 @@ -656,7 +724,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
19868 extern void copy_user_diag("copy_from_user() buffer size is too small")
19869 copy_from_user_overflow(void);
19870 extern void copy_user_diag("copy_to_user() buffer size is too small")
19871 -copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
19872 +copy_to_user_overflow(void);
19873
19874 #undef copy_user_diag
19875
19876 @@ -669,7 +737,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
19877
19878 extern void
19879 __compiletime_warning("copy_to_user() buffer size is not provably correct")
19880 -__copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
19881 +__copy_to_user_overflow(void) __asm__("copy_to_user_overflow");
19882 #define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
19883
19884 #else
19885 @@ -684,10 +752,16 @@ __copy_from_user_overflow(int size, unsigned long count)
19886
19887 #endif
19888
19889 +#ifdef CONFIG_X86_32
19890 +# include <asm/uaccess_32.h>
19891 +#else
19892 +# include <asm/uaccess_64.h>
19893 +#endif
19894 +
19895 static inline unsigned long __must_check
19896 copy_from_user(void *to, const void __user *from, unsigned long n)
19897 {
19898 - int sz = __compiletime_object_size(to);
19899 + size_t sz = __compiletime_object_size(to);
19900
19901 might_fault();
19902
19903 @@ -709,12 +783,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
19904 * case, and do only runtime checking for non-constant sizes.
19905 */
19906
19907 - if (likely(sz < 0 || sz >= n))
19908 - n = _copy_from_user(to, from, n);
19909 - else if(__builtin_constant_p(n))
19910 - copy_from_user_overflow();
19911 - else
19912 - __copy_from_user_overflow(sz, n);
19913 + if (likely(sz != (size_t)-1 && sz < n)) {
19914 + if(__builtin_constant_p(n))
19915 + copy_from_user_overflow();
19916 + else
19917 + __copy_from_user_overflow(sz, n);
19918 + } else if (access_ok(VERIFY_READ, from, n))
19919 + n = __copy_from_user(to, from, n);
19920 + else if ((long)n > 0)
19921 + memset(to, 0, n);
19922
19923 return n;
19924 }
19925 @@ -722,17 +799,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
19926 static inline unsigned long __must_check
19927 copy_to_user(void __user *to, const void *from, unsigned long n)
19928 {
19929 - int sz = __compiletime_object_size(from);
19930 + size_t sz = __compiletime_object_size(from);
19931
19932 might_fault();
19933
19934 /* See the comment in copy_from_user() above. */
19935 - if (likely(sz < 0 || sz >= n))
19936 - n = _copy_to_user(to, from, n);
19937 - else if(__builtin_constant_p(n))
19938 - copy_to_user_overflow();
19939 - else
19940 - __copy_to_user_overflow(sz, n);
19941 + if (likely(sz != (size_t)-1 && sz < n)) {
19942 + if(__builtin_constant_p(n))
19943 + copy_to_user_overflow();
19944 + else
19945 + __copy_to_user_overflow(sz, n);
19946 + } else if (access_ok(VERIFY_WRITE, to, n))
19947 + n = __copy_to_user(to, from, n);
19948
19949 return n;
19950 }
19951 diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
19952 index 3c03a5d..edb68ae 100644
19953 --- a/arch/x86/include/asm/uaccess_32.h
19954 +++ b/arch/x86/include/asm/uaccess_32.h
19955 @@ -40,9 +40,14 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
19956 * anything, so this is accurate.
19957 */
19958
19959 -static __always_inline unsigned long __must_check
19960 +static __always_inline __size_overflow(3) unsigned long __must_check
19961 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
19962 {
19963 + if ((long)n < 0)
19964 + return n;
19965 +
19966 + check_object_size(from, n, true);
19967 +
19968 if (__builtin_constant_p(n)) {
19969 unsigned long ret;
19970
19971 @@ -82,12 +87,16 @@ static __always_inline unsigned long __must_check
19972 __copy_to_user(void __user *to, const void *from, unsigned long n)
19973 {
19974 might_fault();
19975 +
19976 return __copy_to_user_inatomic(to, from, n);
19977 }
19978
19979 -static __always_inline unsigned long
19980 +static __always_inline __size_overflow(3) unsigned long
19981 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
19982 {
19983 + if ((long)n < 0)
19984 + return n;
19985 +
19986 /* Avoid zeroing the tail if the copy fails..
19987 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
19988 * but as the zeroing behaviour is only significant when n is not
19989 @@ -137,6 +146,12 @@ static __always_inline unsigned long
19990 __copy_from_user(void *to, const void __user *from, unsigned long n)
19991 {
19992 might_fault();
19993 +
19994 + if ((long)n < 0)
19995 + return n;
19996 +
19997 + check_object_size(to, n, false);
19998 +
19999 if (__builtin_constant_p(n)) {
20000 unsigned long ret;
20001
20002 @@ -159,6 +174,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
20003 const void __user *from, unsigned long n)
20004 {
20005 might_fault();
20006 +
20007 + if ((long)n < 0)
20008 + return n;
20009 +
20010 if (__builtin_constant_p(n)) {
20011 unsigned long ret;
20012
20013 @@ -181,7 +200,10 @@ static __always_inline unsigned long
20014 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
20015 unsigned long n)
20016 {
20017 - return __copy_from_user_ll_nocache_nozero(to, from, n);
20018 + if ((long)n < 0)
20019 + return n;
20020 +
20021 + return __copy_from_user_ll_nocache_nozero(to, from, n);
20022 }
20023
20024 #endif /* _ASM_X86_UACCESS_32_H */
20025 diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
20026 index f2f9b39..2ae1bf8 100644
20027 --- a/arch/x86/include/asm/uaccess_64.h
20028 +++ b/arch/x86/include/asm/uaccess_64.h
20029 @@ -10,6 +10,9 @@
20030 #include <asm/alternative.h>
20031 #include <asm/cpufeature.h>
20032 #include <asm/page.h>
20033 +#include <asm/pgtable.h>
20034 +
20035 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
20036
20037 /*
20038 * Copy To/From Userspace
20039 @@ -23,8 +26,8 @@ copy_user_generic_string(void *to, const void *from, unsigned len);
20040 __must_check unsigned long
20041 copy_user_generic_unrolled(void *to, const void *from, unsigned len);
20042
20043 -static __always_inline __must_check unsigned long
20044 -copy_user_generic(void *to, const void *from, unsigned len)
20045 +static __always_inline __must_check __size_overflow(3) unsigned long
20046 +copy_user_generic(void *to, const void *from, unsigned long len)
20047 {
20048 unsigned ret;
20049
20050 @@ -46,121 +49,170 @@ copy_user_generic(void *to, const void *from, unsigned len)
20051 }
20052
20053 __must_check unsigned long
20054 -copy_in_user(void __user *to, const void __user *from, unsigned len);
20055 +copy_in_user(void __user *to, const void __user *from, unsigned long len);
20056
20057 static __always_inline __must_check
20058 -int __copy_from_user_nocheck(void *dst, const void __user *src, unsigned size)
20059 +unsigned long __copy_from_user_nocheck(void *dst, const void __user *src, unsigned long size)
20060 {
20061 - int ret = 0;
20062 + size_t sz = __compiletime_object_size(dst);
20063 + unsigned ret = 0;
20064 +
20065 + if (size > INT_MAX)
20066 + return size;
20067 +
20068 + check_object_size(dst, size, false);
20069 +
20070 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20071 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20072 + return size;
20073 +#endif
20074 +
20075 + if (unlikely(sz != (size_t)-1 && sz < size)) {
20076 + if(__builtin_constant_p(size))
20077 + copy_from_user_overflow();
20078 + else
20079 + __copy_from_user_overflow(sz, size);
20080 + return size;
20081 + }
20082
20083 if (!__builtin_constant_p(size))
20084 - return copy_user_generic(dst, (__force void *)src, size);
20085 + return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
20086 switch (size) {
20087 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
20088 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
20089 ret, "b", "b", "=q", 1);
20090 return ret;
20091 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
20092 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
20093 ret, "w", "w", "=r", 2);
20094 return ret;
20095 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
20096 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
20097 ret, "l", "k", "=r", 4);
20098 return ret;
20099 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
20100 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
20101 ret, "q", "", "=r", 8);
20102 return ret;
20103 case 10:
20104 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
20105 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
20106 ret, "q", "", "=r", 10);
20107 if (unlikely(ret))
20108 return ret;
20109 __get_user_asm(*(u16 *)(8 + (char *)dst),
20110 - (u16 __user *)(8 + (char __user *)src),
20111 + (const u16 __user *)(8 + (const char __user *)src),
20112 ret, "w", "w", "=r", 2);
20113 return ret;
20114 case 16:
20115 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
20116 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
20117 ret, "q", "", "=r", 16);
20118 if (unlikely(ret))
20119 return ret;
20120 __get_user_asm(*(u64 *)(8 + (char *)dst),
20121 - (u64 __user *)(8 + (char __user *)src),
20122 + (const u64 __user *)(8 + (const char __user *)src),
20123 ret, "q", "", "=r", 8);
20124 return ret;
20125 default:
20126 - return copy_user_generic(dst, (__force void *)src, size);
20127 + return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
20128 }
20129 }
20130
20131 static __always_inline __must_check
20132 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
20133 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
20134 {
20135 might_fault();
20136 return __copy_from_user_nocheck(dst, src, size);
20137 }
20138
20139 static __always_inline __must_check
20140 -int __copy_to_user_nocheck(void __user *dst, const void *src, unsigned size)
20141 +unsigned long __copy_to_user_nocheck(void __user *dst, const void *src, unsigned long size)
20142 {
20143 - int ret = 0;
20144 + size_t sz = __compiletime_object_size(src);
20145 + unsigned ret = 0;
20146 +
20147 + if (size > INT_MAX)
20148 + return size;
20149 +
20150 + check_object_size(src, size, true);
20151 +
20152 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20153 + if (!access_ok_noprefault(VERIFY_WRITE, dst, size))
20154 + return size;
20155 +#endif
20156 +
20157 + if (unlikely(sz != (size_t)-1 && sz < size)) {
20158 + if(__builtin_constant_p(size))
20159 + copy_to_user_overflow();
20160 + else
20161 + __copy_to_user_overflow(sz, size);
20162 + return size;
20163 + }
20164
20165 if (!__builtin_constant_p(size))
20166 - return copy_user_generic((__force void *)dst, src, size);
20167 + return copy_user_generic((__force_kernel void *)____m(dst), src, size);
20168 switch (size) {
20169 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
20170 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
20171 ret, "b", "b", "iq", 1);
20172 return ret;
20173 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
20174 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
20175 ret, "w", "w", "ir", 2);
20176 return ret;
20177 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
20178 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
20179 ret, "l", "k", "ir", 4);
20180 return ret;
20181 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
20182 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
20183 ret, "q", "", "er", 8);
20184 return ret;
20185 case 10:
20186 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
20187 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
20188 ret, "q", "", "er", 10);
20189 if (unlikely(ret))
20190 return ret;
20191 asm("":::"memory");
20192 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
20193 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
20194 ret, "w", "w", "ir", 2);
20195 return ret;
20196 case 16:
20197 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
20198 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
20199 ret, "q", "", "er", 16);
20200 if (unlikely(ret))
20201 return ret;
20202 asm("":::"memory");
20203 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
20204 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
20205 ret, "q", "", "er", 8);
20206 return ret;
20207 default:
20208 - return copy_user_generic((__force void *)dst, src, size);
20209 + return copy_user_generic((__force_kernel void *)____m(dst), src, size);
20210 }
20211 }
20212
20213 static __always_inline __must_check
20214 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
20215 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
20216 {
20217 might_fault();
20218 return __copy_to_user_nocheck(dst, src, size);
20219 }
20220
20221 static __always_inline __must_check
20222 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20223 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20224 {
20225 - int ret = 0;
20226 + unsigned ret = 0;
20227
20228 might_fault();
20229 +
20230 + if (size > INT_MAX)
20231 + return size;
20232 +
20233 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20234 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20235 + return size;
20236 + if (!access_ok_noprefault(VERIFY_WRITE, dst, size))
20237 + return size;
20238 +#endif
20239 +
20240 if (!__builtin_constant_p(size))
20241 - return copy_user_generic((__force void *)dst,
20242 - (__force void *)src, size);
20243 + return copy_user_generic((__force_kernel void *)____m(dst),
20244 + (__force_kernel const void *)____m(src), size);
20245 switch (size) {
20246 case 1: {
20247 u8 tmp;
20248 - __get_user_asm(tmp, (u8 __user *)src,
20249 + __get_user_asm(tmp, (const u8 __user *)src,
20250 ret, "b", "b", "=q", 1);
20251 if (likely(!ret))
20252 __put_user_asm(tmp, (u8 __user *)dst,
20253 @@ -169,7 +221,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20254 }
20255 case 2: {
20256 u16 tmp;
20257 - __get_user_asm(tmp, (u16 __user *)src,
20258 + __get_user_asm(tmp, (const u16 __user *)src,
20259 ret, "w", "w", "=r", 2);
20260 if (likely(!ret))
20261 __put_user_asm(tmp, (u16 __user *)dst,
20262 @@ -179,7 +231,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20263
20264 case 4: {
20265 u32 tmp;
20266 - __get_user_asm(tmp, (u32 __user *)src,
20267 + __get_user_asm(tmp, (const u32 __user *)src,
20268 ret, "l", "k", "=r", 4);
20269 if (likely(!ret))
20270 __put_user_asm(tmp, (u32 __user *)dst,
20271 @@ -188,7 +240,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20272 }
20273 case 8: {
20274 u64 tmp;
20275 - __get_user_asm(tmp, (u64 __user *)src,
20276 + __get_user_asm(tmp, (const u64 __user *)src,
20277 ret, "q", "", "=r", 8);
20278 if (likely(!ret))
20279 __put_user_asm(tmp, (u64 __user *)dst,
20280 @@ -196,41 +248,58 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20281 return ret;
20282 }
20283 default:
20284 - return copy_user_generic((__force void *)dst,
20285 - (__force void *)src, size);
20286 + return copy_user_generic((__force_kernel void *)____m(dst),
20287 + (__force_kernel const void *)____m(src), size);
20288 }
20289 }
20290
20291 -static __must_check __always_inline int
20292 -__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
20293 +static __must_check __always_inline unsigned long
20294 +__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
20295 {
20296 return __copy_from_user_nocheck(dst, src, size);
20297 }
20298
20299 -static __must_check __always_inline int
20300 -__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
20301 +static __must_check __always_inline unsigned long
20302 +__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
20303 {
20304 return __copy_to_user_nocheck(dst, src, size);
20305 }
20306
20307 -extern long __copy_user_nocache(void *dst, const void __user *src,
20308 - unsigned size, int zerorest);
20309 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
20310 + unsigned long size, int zerorest);
20311
20312 -static inline int
20313 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
20314 +static inline unsigned long
20315 +__copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
20316 {
20317 might_fault();
20318 +
20319 + if (size > INT_MAX)
20320 + return size;
20321 +
20322 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20323 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20324 + return size;
20325 +#endif
20326 +
20327 return __copy_user_nocache(dst, src, size, 1);
20328 }
20329
20330 -static inline int
20331 +static inline unsigned long
20332 __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
20333 - unsigned size)
20334 + unsigned long size)
20335 {
20336 + if (size > INT_MAX)
20337 + return size;
20338 +
20339 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20340 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20341 + return size;
20342 +#endif
20343 +
20344 return __copy_user_nocache(dst, src, size, 0);
20345 }
20346
20347 unsigned long
20348 -copy_user_handle_tail(char *to, char *from, unsigned len);
20349 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len) __size_overflow(3);
20350
20351 #endif /* _ASM_X86_UACCESS_64_H */
20352 diff --git a/arch/x86/include/asm/word-at-a-time.h b/arch/x86/include/asm/word-at-a-time.h
20353 index 5b238981..77fdd78 100644
20354 --- a/arch/x86/include/asm/word-at-a-time.h
20355 +++ b/arch/x86/include/asm/word-at-a-time.h
20356 @@ -11,7 +11,7 @@
20357 * and shift, for example.
20358 */
20359 struct word_at_a_time {
20360 - const unsigned long one_bits, high_bits;
20361 + unsigned long one_bits, high_bits;
20362 };
20363
20364 #define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
20365 diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
20366 index f58a9c7..dc378042a 100644
20367 --- a/arch/x86/include/asm/x86_init.h
20368 +++ b/arch/x86/include/asm/x86_init.h
20369 @@ -129,7 +129,7 @@ struct x86_init_ops {
20370 struct x86_init_timers timers;
20371 struct x86_init_iommu iommu;
20372 struct x86_init_pci pci;
20373 -};
20374 +} __no_const;
20375
20376 /**
20377 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
20378 @@ -140,7 +140,7 @@ struct x86_cpuinit_ops {
20379 void (*setup_percpu_clockev)(void);
20380 void (*early_percpu_clock_init)(void);
20381 void (*fixup_cpu_id)(struct cpuinfo_x86 *c, int node);
20382 -};
20383 +} __no_const;
20384
20385 struct timespec;
20386
20387 @@ -168,7 +168,7 @@ struct x86_platform_ops {
20388 void (*save_sched_clock_state)(void);
20389 void (*restore_sched_clock_state)(void);
20390 void (*apic_post_init)(void);
20391 -};
20392 +} __no_const;
20393
20394 struct pci_dev;
20395 struct msi_msg;
20396 @@ -182,7 +182,7 @@ struct x86_msi_ops {
20397 void (*teardown_msi_irqs)(struct pci_dev *dev);
20398 void (*restore_msi_irqs)(struct pci_dev *dev);
20399 int (*setup_hpet_msi)(unsigned int irq, unsigned int id);
20400 -};
20401 +} __no_const;
20402
20403 struct IO_APIC_route_entry;
20404 struct io_apic_irq_attr;
20405 @@ -203,7 +203,7 @@ struct x86_io_apic_ops {
20406 unsigned int destination, int vector,
20407 struct io_apic_irq_attr *attr);
20408 void (*eoi_ioapic_pin)(int apic, int pin, int vector);
20409 -};
20410 +} __no_const;
20411
20412 extern struct x86_init_ops x86_init;
20413 extern struct x86_cpuinit_ops x86_cpuinit;
20414 diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
20415 index c44a5d5..7f83cfc 100644
20416 --- a/arch/x86/include/asm/xen/page.h
20417 +++ b/arch/x86/include/asm/xen/page.h
20418 @@ -82,7 +82,7 @@ static inline int xen_safe_read_ulong(unsigned long *addr, unsigned long *val)
20419 * - get_phys_to_machine() is to be called by __pfn_to_mfn() only in special
20420 * cases needing an extended handling.
20421 */
20422 -static inline unsigned long __pfn_to_mfn(unsigned long pfn)
20423 +static inline unsigned long __intentional_overflow(-1) __pfn_to_mfn(unsigned long pfn)
20424 {
20425 unsigned long mfn;
20426
20427 diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
20428 index c9a6d68..cb57f42 100644
20429 --- a/arch/x86/include/asm/xsave.h
20430 +++ b/arch/x86/include/asm/xsave.h
20431 @@ -223,12 +223,16 @@ static inline int xsave_user(struct xsave_struct __user *buf)
20432 if (unlikely(err))
20433 return -EFAULT;
20434
20435 + pax_open_userland();
20436 __asm__ __volatile__(ASM_STAC "\n"
20437 - "1:"XSAVE"\n"
20438 + "1:"
20439 + __copyuser_seg
20440 + XSAVE"\n"
20441 "2: " ASM_CLAC "\n"
20442 xstate_fault
20443 : "D" (buf), "a" (-1), "d" (-1), "0" (0)
20444 : "memory");
20445 + pax_close_userland();
20446 return err;
20447 }
20448
20449 @@ -238,16 +242,20 @@ static inline int xsave_user(struct xsave_struct __user *buf)
20450 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
20451 {
20452 int err = 0;
20453 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
20454 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
20455 u32 lmask = mask;
20456 u32 hmask = mask >> 32;
20457
20458 + pax_open_userland();
20459 __asm__ __volatile__(ASM_STAC "\n"
20460 - "1:"XRSTOR"\n"
20461 + "1:"
20462 + __copyuser_seg
20463 + XRSTOR"\n"
20464 "2: " ASM_CLAC "\n"
20465 xstate_fault
20466 : "D" (xstate), "a" (lmask), "d" (hmask), "0" (0)
20467 : "memory"); /* memory required? */
20468 + pax_close_userland();
20469 return err;
20470 }
20471
20472 diff --git a/arch/x86/include/uapi/asm/e820.h b/arch/x86/include/uapi/asm/e820.h
20473 index 960a8a9..404daf7 100644
20474 --- a/arch/x86/include/uapi/asm/e820.h
20475 +++ b/arch/x86/include/uapi/asm/e820.h
20476 @@ -68,7 +68,7 @@ struct e820map {
20477 #define ISA_START_ADDRESS 0xa0000
20478 #define ISA_END_ADDRESS 0x100000
20479
20480 -#define BIOS_BEGIN 0x000a0000
20481 +#define BIOS_BEGIN 0x000c0000
20482 #define BIOS_END 0x00100000
20483
20484 #define BIOS_ROM_BASE 0xffe00000
20485 diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
20486 index 9bcd0b5..750f1b7 100644
20487 --- a/arch/x86/kernel/Makefile
20488 +++ b/arch/x86/kernel/Makefile
20489 @@ -28,7 +28,7 @@ obj-y += time.o ioport.o ldt.o dumpstack.o nmi.o
20490 obj-y += setup.o x86_init.o i8259.o irqinit.o jump_label.o
20491 obj-$(CONFIG_IRQ_WORK) += irq_work.o
20492 obj-y += probe_roms.o
20493 -obj-$(CONFIG_X86_32) += i386_ksyms_32.o
20494 +obj-$(CONFIG_X86_32) += sys_i386_32.o i386_ksyms_32.o
20495 obj-$(CONFIG_X86_64) += sys_x86_64.o x8664_ksyms_64.o
20496 obj-$(CONFIG_X86_64) += mcount_64.o
20497 obj-y += syscall_$(BITS).o vsyscall_gtod.o
20498 diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
20499 index dbe76a1..e2ec334 100644
20500 --- a/arch/x86/kernel/acpi/boot.c
20501 +++ b/arch/x86/kernel/acpi/boot.c
20502 @@ -1361,7 +1361,7 @@ static void __init acpi_reduced_hw_init(void)
20503 * If your system is blacklisted here, but you find that acpi=force
20504 * works for you, please contact linux-acpi@vger.kernel.org
20505 */
20506 -static struct dmi_system_id __initdata acpi_dmi_table[] = {
20507 +static const struct dmi_system_id __initconst acpi_dmi_table[] = {
20508 /*
20509 * Boxes that need ACPI disabled
20510 */
20511 @@ -1436,7 +1436,7 @@ static struct dmi_system_id __initdata acpi_dmi_table[] = {
20512 };
20513
20514 /* second table for DMI checks that should run after early-quirks */
20515 -static struct dmi_system_id __initdata acpi_dmi_table_late[] = {
20516 +static const struct dmi_system_id __initconst acpi_dmi_table_late[] = {
20517 /*
20518 * HP laptops which use a DSDT reporting as HP/SB400/10000,
20519 * which includes some code which overrides all temperature
20520 diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
20521 index d1daead..acd77e2 100644
20522 --- a/arch/x86/kernel/acpi/sleep.c
20523 +++ b/arch/x86/kernel/acpi/sleep.c
20524 @@ -99,8 +99,12 @@ int x86_acpi_suspend_lowlevel(void)
20525 #else /* CONFIG_64BIT */
20526 #ifdef CONFIG_SMP
20527 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
20528 +
20529 + pax_open_kernel();
20530 early_gdt_descr.address =
20531 (unsigned long)get_cpu_gdt_table(smp_processor_id());
20532 + pax_close_kernel();
20533 +
20534 initial_gs = per_cpu_offset(smp_processor_id());
20535 #endif
20536 initial_code = (unsigned long)wakeup_long64;
20537 diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
20538 index 665c6b7..eae4d56 100644
20539 --- a/arch/x86/kernel/acpi/wakeup_32.S
20540 +++ b/arch/x86/kernel/acpi/wakeup_32.S
20541 @@ -29,13 +29,11 @@ wakeup_pmode_return:
20542 # and restore the stack ... but you need gdt for this to work
20543 movl saved_context_esp, %esp
20544
20545 - movl %cs:saved_magic, %eax
20546 - cmpl $0x12345678, %eax
20547 + cmpl $0x12345678, saved_magic
20548 jne bogus_magic
20549
20550 # jump to place where we left off
20551 - movl saved_eip, %eax
20552 - jmp *%eax
20553 + jmp *(saved_eip)
20554
20555 bogus_magic:
20556 jmp bogus_magic
20557 diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
20558 index aef6531..2044b66 100644
20559 --- a/arch/x86/kernel/alternative.c
20560 +++ b/arch/x86/kernel/alternative.c
20561 @@ -248,7 +248,9 @@ static void __init_or_module add_nops(void *insns, unsigned int len)
20562 unsigned int noplen = len;
20563 if (noplen > ASM_NOP_MAX)
20564 noplen = ASM_NOP_MAX;
20565 + pax_open_kernel();
20566 memcpy(insns, ideal_nops[noplen], noplen);
20567 + pax_close_kernel();
20568 insns += noplen;
20569 len -= noplen;
20570 }
20571 @@ -276,6 +278,11 @@ recompute_jump(struct alt_instr *a, u8 *orig_insn, u8 *repl_insn, u8 *insnbuf)
20572 if (a->replacementlen != 5)
20573 return;
20574
20575 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20576 + if (orig_insn < (u8 *)_text || (u8 *)_einittext <= orig_insn)
20577 + orig_insn = ktva_ktla(orig_insn);
20578 +#endif
20579 +
20580 o_dspl = *(s32 *)(insnbuf + 1);
20581
20582 /* next_rip of the replacement JMP */
20583 @@ -362,7 +369,23 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
20584 int insnbuf_sz = 0;
20585
20586 instr = (u8 *)&a->instr_offset + a->instr_offset;
20587 +
20588 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20589 + if ((u8 *)_text <= instr && instr < (u8 *)_einittext) {
20590 + instr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20591 + instr = ktla_ktva(instr);
20592 + }
20593 +#endif
20594 +
20595 replacement = (u8 *)&a->repl_offset + a->repl_offset;
20596 +
20597 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20598 + if ((u8 *)_text <= replacement && replacement < (u8 *)_einittext) {
20599 + replacement += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20600 + replacement = ktla_ktva(replacement);
20601 + }
20602 +#endif
20603 +
20604 BUG_ON(a->instrlen > sizeof(insnbuf));
20605 BUG_ON(a->cpuid >= (NCAPINTS + NBUGINTS) * 32);
20606 if (!boot_cpu_has(a->cpuid)) {
20607 @@ -402,6 +425,11 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
20608 }
20609 DUMP_BYTES(insnbuf, insnbuf_sz, "%p: final_insn: ", instr);
20610
20611 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20612 + if (instr < (u8 *)_text || (u8 *)_einittext <= instr)
20613 + instr = ktva_ktla(instr);
20614 +#endif
20615 +
20616 text_poke_early(instr, insnbuf, insnbuf_sz);
20617 }
20618 }
20619 @@ -416,10 +444,16 @@ static void alternatives_smp_lock(const s32 *start, const s32 *end,
20620 for (poff = start; poff < end; poff++) {
20621 u8 *ptr = (u8 *)poff + *poff;
20622
20623 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20624 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20625 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
20626 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20627 +#endif
20628 +
20629 if (!*poff || ptr < text || ptr >= text_end)
20630 continue;
20631 /* turn DS segment override prefix into lock prefix */
20632 - if (*ptr == 0x3e)
20633 + if (*ktla_ktva(ptr) == 0x3e)
20634 text_poke(ptr, ((unsigned char []){0xf0}), 1);
20635 }
20636 mutex_unlock(&text_mutex);
20637 @@ -434,10 +468,16 @@ static void alternatives_smp_unlock(const s32 *start, const s32 *end,
20638 for (poff = start; poff < end; poff++) {
20639 u8 *ptr = (u8 *)poff + *poff;
20640
20641 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20642 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20643 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
20644 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20645 +#endif
20646 +
20647 if (!*poff || ptr < text || ptr >= text_end)
20648 continue;
20649 /* turn lock prefix into DS segment override prefix */
20650 - if (*ptr == 0xf0)
20651 + if (*ktla_ktva(ptr) == 0xf0)
20652 text_poke(ptr, ((unsigned char []){0x3E}), 1);
20653 }
20654 mutex_unlock(&text_mutex);
20655 @@ -574,7 +614,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
20656
20657 BUG_ON(p->len > MAX_PATCH_LEN);
20658 /* prep the buffer with the original instructions */
20659 - memcpy(insnbuf, p->instr, p->len);
20660 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
20661 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
20662 (unsigned long)p->instr, p->len);
20663
20664 @@ -621,7 +661,7 @@ void __init alternative_instructions(void)
20665 if (!uniproc_patched || num_possible_cpus() == 1)
20666 free_init_pages("SMP alternatives",
20667 (unsigned long)__smp_locks,
20668 - (unsigned long)__smp_locks_end);
20669 + PAGE_ALIGN((unsigned long)__smp_locks_end));
20670 #endif
20671
20672 apply_paravirt(__parainstructions, __parainstructions_end);
20673 @@ -641,13 +681,17 @@ void __init alternative_instructions(void)
20674 * instructions. And on the local CPU you need to be protected again NMI or MCE
20675 * handlers seeing an inconsistent instruction while you patch.
20676 */
20677 -void *__init_or_module text_poke_early(void *addr, const void *opcode,
20678 +void *__kprobes text_poke_early(void *addr, const void *opcode,
20679 size_t len)
20680 {
20681 unsigned long flags;
20682 local_irq_save(flags);
20683 - memcpy(addr, opcode, len);
20684 +
20685 + pax_open_kernel();
20686 + memcpy(ktla_ktva(addr), opcode, len);
20687 sync_core();
20688 + pax_close_kernel();
20689 +
20690 local_irq_restore(flags);
20691 /* Could also do a CLFLUSH here to speed up CPU recovery; but
20692 that causes hangs on some VIA CPUs. */
20693 @@ -669,36 +713,22 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
20694 */
20695 void *text_poke(void *addr, const void *opcode, size_t len)
20696 {
20697 - unsigned long flags;
20698 - char *vaddr;
20699 + unsigned char *vaddr = ktla_ktva(addr);
20700 struct page *pages[2];
20701 - int i;
20702 + size_t i;
20703
20704 if (!core_kernel_text((unsigned long)addr)) {
20705 - pages[0] = vmalloc_to_page(addr);
20706 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
20707 + pages[0] = vmalloc_to_page(vaddr);
20708 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
20709 } else {
20710 - pages[0] = virt_to_page(addr);
20711 + pages[0] = virt_to_page(vaddr);
20712 WARN_ON(!PageReserved(pages[0]));
20713 - pages[1] = virt_to_page(addr + PAGE_SIZE);
20714 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
20715 }
20716 BUG_ON(!pages[0]);
20717 - local_irq_save(flags);
20718 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
20719 - if (pages[1])
20720 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
20721 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
20722 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
20723 - clear_fixmap(FIX_TEXT_POKE0);
20724 - if (pages[1])
20725 - clear_fixmap(FIX_TEXT_POKE1);
20726 - local_flush_tlb();
20727 - sync_core();
20728 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
20729 - that causes hangs on some VIA CPUs. */
20730 + text_poke_early(addr, opcode, len);
20731 for (i = 0; i < len; i++)
20732 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
20733 - local_irq_restore(flags);
20734 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
20735 return addr;
20736 }
20737
20738 @@ -752,7 +782,7 @@ int poke_int3_handler(struct pt_regs *regs)
20739 */
20740 void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
20741 {
20742 - unsigned char int3 = 0xcc;
20743 + const unsigned char int3 = 0xcc;
20744
20745 bp_int3_handler = handler;
20746 bp_int3_addr = (u8 *)addr + sizeof(int3);
20747 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
20748 index dcb5285..cc79e9d 100644
20749 --- a/arch/x86/kernel/apic/apic.c
20750 +++ b/arch/x86/kernel/apic/apic.c
20751 @@ -171,7 +171,7 @@ int first_system_vector = FIRST_SYSTEM_VECTOR;
20752 /*
20753 * Debug level, exported for io_apic.c
20754 */
20755 -unsigned int apic_verbosity;
20756 +int apic_verbosity;
20757
20758 int pic_mode;
20759
20760 @@ -1857,7 +1857,7 @@ static inline void __smp_error_interrupt(struct pt_regs *regs)
20761 apic_write(APIC_ESR, 0);
20762 v = apic_read(APIC_ESR);
20763 ack_APIC_irq();
20764 - atomic_inc(&irq_err_count);
20765 + atomic_inc_unchecked(&irq_err_count);
20766
20767 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x",
20768 smp_processor_id(), v);
20769 diff --git a/arch/x86/kernel/apic/apic_flat_64.c b/arch/x86/kernel/apic/apic_flat_64.c
20770 index de918c4..32eed23 100644
20771 --- a/arch/x86/kernel/apic/apic_flat_64.c
20772 +++ b/arch/x86/kernel/apic/apic_flat_64.c
20773 @@ -154,7 +154,7 @@ static int flat_probe(void)
20774 return 1;
20775 }
20776
20777 -static struct apic apic_flat = {
20778 +static struct apic apic_flat __read_only = {
20779 .name = "flat",
20780 .probe = flat_probe,
20781 .acpi_madt_oem_check = flat_acpi_madt_oem_check,
20782 @@ -260,7 +260,7 @@ static int physflat_probe(void)
20783 return 0;
20784 }
20785
20786 -static struct apic apic_physflat = {
20787 +static struct apic apic_physflat __read_only = {
20788
20789 .name = "physical flat",
20790 .probe = physflat_probe,
20791 diff --git a/arch/x86/kernel/apic/apic_noop.c b/arch/x86/kernel/apic/apic_noop.c
20792 index b205cdb..d8503ff 100644
20793 --- a/arch/x86/kernel/apic/apic_noop.c
20794 +++ b/arch/x86/kernel/apic/apic_noop.c
20795 @@ -108,7 +108,7 @@ static void noop_apic_write(u32 reg, u32 v)
20796 WARN_ON_ONCE(cpu_has_apic && !disable_apic);
20797 }
20798
20799 -struct apic apic_noop = {
20800 +struct apic apic_noop __read_only = {
20801 .name = "noop",
20802 .probe = noop_probe,
20803 .acpi_madt_oem_check = NULL,
20804 diff --git a/arch/x86/kernel/apic/bigsmp_32.c b/arch/x86/kernel/apic/bigsmp_32.c
20805 index c4a8d63..fe893ac 100644
20806 --- a/arch/x86/kernel/apic/bigsmp_32.c
20807 +++ b/arch/x86/kernel/apic/bigsmp_32.c
20808 @@ -147,7 +147,7 @@ static int probe_bigsmp(void)
20809 return dmi_bigsmp;
20810 }
20811
20812 -static struct apic apic_bigsmp = {
20813 +static struct apic apic_bigsmp __read_only = {
20814
20815 .name = "bigsmp",
20816 .probe = probe_bigsmp,
20817 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
20818 index f4dc246..fbab133 100644
20819 --- a/arch/x86/kernel/apic/io_apic.c
20820 +++ b/arch/x86/kernel/apic/io_apic.c
20821 @@ -1862,7 +1862,7 @@ int native_ioapic_set_affinity(struct irq_data *data,
20822 return ret;
20823 }
20824
20825 -atomic_t irq_mis_count;
20826 +atomic_unchecked_t irq_mis_count;
20827
20828 #ifdef CONFIG_GENERIC_PENDING_IRQ
20829 static bool io_apic_level_ack_pending(struct irq_cfg *cfg)
20830 @@ -2003,7 +2003,7 @@ static void ack_ioapic_level(struct irq_data *data)
20831 * at the cpu.
20832 */
20833 if (!(v & (1 << (i & 0x1f)))) {
20834 - atomic_inc(&irq_mis_count);
20835 + atomic_inc_unchecked(&irq_mis_count);
20836
20837 eoi_ioapic_irq(irq, cfg);
20838 }
20839 @@ -2011,7 +2011,7 @@ static void ack_ioapic_level(struct irq_data *data)
20840 ioapic_irqd_unmask(data, cfg, masked);
20841 }
20842
20843 -static struct irq_chip ioapic_chip __read_mostly = {
20844 +static struct irq_chip ioapic_chip = {
20845 .name = "IO-APIC",
20846 .irq_startup = startup_ioapic_irq,
20847 .irq_mask = mask_ioapic_irq,
20848 @@ -2070,7 +2070,7 @@ static void ack_lapic_irq(struct irq_data *data)
20849 ack_APIC_irq();
20850 }
20851
20852 -static struct irq_chip lapic_chip __read_mostly = {
20853 +static struct irq_chip lapic_chip = {
20854 .name = "local-APIC",
20855 .irq_mask = mask_lapic_irq,
20856 .irq_unmask = unmask_lapic_irq,
20857 diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
20858 index bda4886..f9c7195 100644
20859 --- a/arch/x86/kernel/apic/probe_32.c
20860 +++ b/arch/x86/kernel/apic/probe_32.c
20861 @@ -72,7 +72,7 @@ static int probe_default(void)
20862 return 1;
20863 }
20864
20865 -static struct apic apic_default = {
20866 +static struct apic apic_default __read_only = {
20867
20868 .name = "default",
20869 .probe = probe_default,
20870 diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
20871 index 6cedd79..023ff8e 100644
20872 --- a/arch/x86/kernel/apic/vector.c
20873 +++ b/arch/x86/kernel/apic/vector.c
20874 @@ -21,7 +21,7 @@
20875
20876 static DEFINE_RAW_SPINLOCK(vector_lock);
20877
20878 -void lock_vector_lock(void)
20879 +void lock_vector_lock(void) __acquires(vector_lock)
20880 {
20881 /* Used to the online set of cpus does not change
20882 * during assign_irq_vector.
20883 @@ -29,7 +29,7 @@ void lock_vector_lock(void)
20884 raw_spin_lock(&vector_lock);
20885 }
20886
20887 -void unlock_vector_lock(void)
20888 +void unlock_vector_lock(void) __releases(vector_lock)
20889 {
20890 raw_spin_unlock(&vector_lock);
20891 }
20892 diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
20893 index ab3219b..e8033eb 100644
20894 --- a/arch/x86/kernel/apic/x2apic_cluster.c
20895 +++ b/arch/x86/kernel/apic/x2apic_cluster.c
20896 @@ -182,7 +182,7 @@ update_clusterinfo(struct notifier_block *nfb, unsigned long action, void *hcpu)
20897 return notifier_from_errno(err);
20898 }
20899
20900 -static struct notifier_block __refdata x2apic_cpu_notifier = {
20901 +static struct notifier_block x2apic_cpu_notifier = {
20902 .notifier_call = update_clusterinfo,
20903 };
20904
20905 @@ -234,7 +234,7 @@ static void cluster_vector_allocation_domain(int cpu, struct cpumask *retmask,
20906 cpumask_and(retmask, mask, per_cpu(cpus_in_cluster, cpu));
20907 }
20908
20909 -static struct apic apic_x2apic_cluster = {
20910 +static struct apic apic_x2apic_cluster __read_only = {
20911
20912 .name = "cluster x2apic",
20913 .probe = x2apic_cluster_probe,
20914 diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
20915 index 6fae733..5ca17af 100644
20916 --- a/arch/x86/kernel/apic/x2apic_phys.c
20917 +++ b/arch/x86/kernel/apic/x2apic_phys.c
20918 @@ -88,7 +88,7 @@ static int x2apic_phys_probe(void)
20919 return apic == &apic_x2apic_phys;
20920 }
20921
20922 -static struct apic apic_x2apic_phys = {
20923 +static struct apic apic_x2apic_phys __read_only = {
20924
20925 .name = "physical x2apic",
20926 .probe = x2apic_phys_probe,
20927 diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
20928 index c8d9295..9af2d03 100644
20929 --- a/arch/x86/kernel/apic/x2apic_uv_x.c
20930 +++ b/arch/x86/kernel/apic/x2apic_uv_x.c
20931 @@ -375,7 +375,7 @@ static int uv_probe(void)
20932 return apic == &apic_x2apic_uv_x;
20933 }
20934
20935 -static struct apic __refdata apic_x2apic_uv_x = {
20936 +static struct apic apic_x2apic_uv_x __read_only = {
20937
20938 .name = "UV large system",
20939 .probe = uv_probe,
20940 diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
20941 index 927ec92..de68f32 100644
20942 --- a/arch/x86/kernel/apm_32.c
20943 +++ b/arch/x86/kernel/apm_32.c
20944 @@ -432,7 +432,7 @@ static DEFINE_MUTEX(apm_mutex);
20945 * This is for buggy BIOS's that refer to (real mode) segment 0x40
20946 * even though they are called in protected mode.
20947 */
20948 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
20949 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
20950 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
20951
20952 static const char driver_version[] = "1.16ac"; /* no spaces */
20953 @@ -610,7 +610,10 @@ static long __apm_bios_call(void *_call)
20954 BUG_ON(cpu != 0);
20955 gdt = get_cpu_gdt_table(cpu);
20956 save_desc_40 = gdt[0x40 / 8];
20957 +
20958 + pax_open_kernel();
20959 gdt[0x40 / 8] = bad_bios_desc;
20960 + pax_close_kernel();
20961
20962 apm_irq_save(flags);
20963 APM_DO_SAVE_SEGS;
20964 @@ -619,7 +622,11 @@ static long __apm_bios_call(void *_call)
20965 &call->esi);
20966 APM_DO_RESTORE_SEGS;
20967 apm_irq_restore(flags);
20968 +
20969 + pax_open_kernel();
20970 gdt[0x40 / 8] = save_desc_40;
20971 + pax_close_kernel();
20972 +
20973 put_cpu();
20974
20975 return call->eax & 0xff;
20976 @@ -686,7 +693,10 @@ static long __apm_bios_call_simple(void *_call)
20977 BUG_ON(cpu != 0);
20978 gdt = get_cpu_gdt_table(cpu);
20979 save_desc_40 = gdt[0x40 / 8];
20980 +
20981 + pax_open_kernel();
20982 gdt[0x40 / 8] = bad_bios_desc;
20983 + pax_close_kernel();
20984
20985 apm_irq_save(flags);
20986 APM_DO_SAVE_SEGS;
20987 @@ -694,7 +704,11 @@ static long __apm_bios_call_simple(void *_call)
20988 &call->eax);
20989 APM_DO_RESTORE_SEGS;
20990 apm_irq_restore(flags);
20991 +
20992 + pax_open_kernel();
20993 gdt[0x40 / 8] = save_desc_40;
20994 + pax_close_kernel();
20995 +
20996 put_cpu();
20997 return error;
20998 }
20999 @@ -2039,7 +2053,7 @@ static int __init swab_apm_power_in_minutes(const struct dmi_system_id *d)
21000 return 0;
21001 }
21002
21003 -static struct dmi_system_id __initdata apm_dmi_table[] = {
21004 +static const struct dmi_system_id __initconst apm_dmi_table[] = {
21005 {
21006 print_if_true,
21007 KERN_WARNING "IBM T23 - BIOS 1.03b+ and controller firmware 1.02+ may be needed for Linux APM.",
21008 @@ -2349,12 +2363,15 @@ static int __init apm_init(void)
21009 * code to that CPU.
21010 */
21011 gdt = get_cpu_gdt_table(0);
21012 +
21013 + pax_open_kernel();
21014 set_desc_base(&gdt[APM_CS >> 3],
21015 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
21016 set_desc_base(&gdt[APM_CS_16 >> 3],
21017 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
21018 set_desc_base(&gdt[APM_DS >> 3],
21019 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
21020 + pax_close_kernel();
21021
21022 proc_create("apm", 0, NULL, &apm_file_ops);
21023
21024 diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
21025 index 9f6b934..cf5ffb3 100644
21026 --- a/arch/x86/kernel/asm-offsets.c
21027 +++ b/arch/x86/kernel/asm-offsets.c
21028 @@ -32,6 +32,8 @@ void common(void) {
21029 OFFSET(TI_flags, thread_info, flags);
21030 OFFSET(TI_status, thread_info, status);
21031 OFFSET(TI_addr_limit, thread_info, addr_limit);
21032 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
21033 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
21034
21035 BLANK();
21036 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
21037 @@ -52,8 +54,26 @@ void common(void) {
21038 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
21039 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
21040 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
21041 +
21042 +#ifdef CONFIG_PAX_KERNEXEC
21043 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
21044 #endif
21045
21046 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21047 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
21048 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
21049 +#ifdef CONFIG_X86_64
21050 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
21051 +#endif
21052 +#endif
21053 +
21054 +#endif
21055 +
21056 + BLANK();
21057 + DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
21058 + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
21059 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
21060 +
21061 #ifdef CONFIG_XEN
21062 BLANK();
21063 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
21064 diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
21065 index 5ce6f2d..9e738f3 100644
21066 --- a/arch/x86/kernel/asm-offsets_64.c
21067 +++ b/arch/x86/kernel/asm-offsets_64.c
21068 @@ -80,6 +80,7 @@ int main(void)
21069 BLANK();
21070 #undef ENTRY
21071
21072 + DEFINE(TSS_size, sizeof(struct tss_struct));
21073 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
21074 OFFSET(TSS_sp0, tss_struct, x86_tss.sp0);
21075 BLANK();
21076 diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
21077 index 9bff687..5b899fb 100644
21078 --- a/arch/x86/kernel/cpu/Makefile
21079 +++ b/arch/x86/kernel/cpu/Makefile
21080 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
21081 CFLAGS_REMOVE_perf_event.o = -pg
21082 endif
21083
21084 -# Make sure load_percpu_segment has no stackprotector
21085 -nostackp := $(call cc-option, -fno-stack-protector)
21086 -CFLAGS_common.o := $(nostackp)
21087 -
21088 obj-y := intel_cacheinfo.o scattered.o topology.o
21089 obj-y += common.o
21090 obj-y += rdrand.o
21091 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
21092 index e4cf633..941f450 100644
21093 --- a/arch/x86/kernel/cpu/amd.c
21094 +++ b/arch/x86/kernel/cpu/amd.c
21095 @@ -729,7 +729,7 @@ static void init_amd(struct cpuinfo_x86 *c)
21096 static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
21097 {
21098 /* AMD errata T13 (order #21922) */
21099 - if ((c->x86 == 6)) {
21100 + if (c->x86 == 6) {
21101 /* Duron Rev A0 */
21102 if (c->x86_model == 3 && c->x86_mask == 0)
21103 size = 64;
21104 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
21105 index a62cf04..041e39c 100644
21106 --- a/arch/x86/kernel/cpu/common.c
21107 +++ b/arch/x86/kernel/cpu/common.c
21108 @@ -91,60 +91,6 @@ static const struct cpu_dev default_cpu = {
21109
21110 static const struct cpu_dev *this_cpu = &default_cpu;
21111
21112 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
21113 -#ifdef CONFIG_X86_64
21114 - /*
21115 - * We need valid kernel segments for data and code in long mode too
21116 - * IRET will check the segment types kkeil 2000/10/28
21117 - * Also sysret mandates a special GDT layout
21118 - *
21119 - * TLS descriptors are currently at a different place compared to i386.
21120 - * Hopefully nobody expects them at a fixed place (Wine?)
21121 - */
21122 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
21123 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
21124 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
21125 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
21126 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
21127 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
21128 -#else
21129 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
21130 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
21131 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
21132 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
21133 - /*
21134 - * Segments used for calling PnP BIOS have byte granularity.
21135 - * They code segments and data segments have fixed 64k limits,
21136 - * the transfer segment sizes are set at run time.
21137 - */
21138 - /* 32-bit code */
21139 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
21140 - /* 16-bit code */
21141 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
21142 - /* 16-bit data */
21143 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
21144 - /* 16-bit data */
21145 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
21146 - /* 16-bit data */
21147 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
21148 - /*
21149 - * The APM segments have byte granularity and their bases
21150 - * are set at run time. All have 64k limits.
21151 - */
21152 - /* 32-bit code */
21153 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
21154 - /* 16-bit code */
21155 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
21156 - /* data */
21157 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
21158 -
21159 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
21160 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
21161 - GDT_STACK_CANARY_INIT
21162 -#endif
21163 -} };
21164 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
21165 -
21166 static int __init x86_xsave_setup(char *s)
21167 {
21168 if (strlen(s))
21169 @@ -306,6 +252,59 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
21170 }
21171 }
21172
21173 +#ifdef CONFIG_X86_64
21174 +static __init int setup_disable_pcid(char *arg)
21175 +{
21176 + setup_clear_cpu_cap(X86_FEATURE_PCID);
21177 + setup_clear_cpu_cap(X86_FEATURE_INVPCID);
21178 +
21179 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21180 + if (clone_pgd_mask != ~(pgdval_t)0UL)
21181 + pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
21182 +#endif
21183 +
21184 + return 1;
21185 +}
21186 +__setup("nopcid", setup_disable_pcid);
21187 +
21188 +static void setup_pcid(struct cpuinfo_x86 *c)
21189 +{
21190 + if (!cpu_has(c, X86_FEATURE_PCID)) {
21191 + clear_cpu_cap(c, X86_FEATURE_INVPCID);
21192 +
21193 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21194 + if (clone_pgd_mask != ~(pgdval_t)0UL) {
21195 + pax_open_kernel();
21196 + pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
21197 + pax_close_kernel();
21198 + printk("PAX: slow and weak UDEREF enabled\n");
21199 + } else
21200 + printk("PAX: UDEREF disabled\n");
21201 +#endif
21202 +
21203 + return;
21204 + }
21205 +
21206 + printk("PAX: PCID detected\n");
21207 + cr4_set_bits(X86_CR4_PCIDE);
21208 +
21209 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21210 + pax_open_kernel();
21211 + clone_pgd_mask = ~(pgdval_t)0UL;
21212 + pax_close_kernel();
21213 + if (pax_user_shadow_base)
21214 + printk("PAX: weak UDEREF enabled\n");
21215 + else {
21216 + set_cpu_cap(c, X86_FEATURE_STRONGUDEREF);
21217 + printk("PAX: strong UDEREF enabled\n");
21218 + }
21219 +#endif
21220 +
21221 + if (cpu_has(c, X86_FEATURE_INVPCID))
21222 + printk("PAX: INVPCID detected\n");
21223 +}
21224 +#endif
21225 +
21226 /*
21227 * Some CPU features depend on higher CPUID levels, which may not always
21228 * be available due to CPUID level capping or broken virtualization
21229 @@ -406,7 +405,7 @@ void switch_to_new_gdt(int cpu)
21230 {
21231 struct desc_ptr gdt_descr;
21232
21233 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
21234 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
21235 gdt_descr.size = GDT_SIZE - 1;
21236 load_gdt(&gdt_descr);
21237 /* Reload the per-cpu base */
21238 @@ -935,6 +934,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
21239 setup_smep(c);
21240 setup_smap(c);
21241
21242 +#ifdef CONFIG_X86_32
21243 +#ifdef CONFIG_PAX_PAGEEXEC
21244 + if (!(__supported_pte_mask & _PAGE_NX))
21245 + clear_cpu_cap(c, X86_FEATURE_PSE);
21246 +#endif
21247 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
21248 + clear_cpu_cap(c, X86_FEATURE_SEP);
21249 +#endif
21250 +#endif
21251 +
21252 +#ifdef CONFIG_X86_64
21253 + setup_pcid(c);
21254 +#endif
21255 +
21256 /*
21257 * The vendor-specific functions might have changed features.
21258 * Now we do "generic changes."
21259 @@ -1009,7 +1022,7 @@ void enable_sep_cpu(void)
21260 int cpu;
21261
21262 cpu = get_cpu();
21263 - tss = &per_cpu(cpu_tss, cpu);
21264 + tss = cpu_tss + cpu;
21265
21266 if (!boot_cpu_has(X86_FEATURE_SEP))
21267 goto out;
21268 @@ -1155,14 +1168,16 @@ static __init int setup_disablecpuid(char *arg)
21269 }
21270 __setup("clearcpuid=", setup_disablecpuid);
21271
21272 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
21273 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
21274 +
21275 DEFINE_PER_CPU(unsigned long, kernel_stack) =
21276 - (unsigned long)&init_thread_union + THREAD_SIZE;
21277 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
21278 EXPORT_PER_CPU_SYMBOL(kernel_stack);
21279
21280 #ifdef CONFIG_X86_64
21281 -struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
21282 -struct desc_ptr debug_idt_descr = { NR_VECTORS * 16 - 1,
21283 - (unsigned long) debug_idt_table };
21284 +struct desc_ptr idt_descr __read_only = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
21285 +const struct desc_ptr debug_idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) debug_idt_table };
21286
21287 DEFINE_PER_CPU_FIRST(union irq_stack_union,
21288 irq_stack_union) __aligned(PAGE_SIZE) __visible;
21289 @@ -1367,7 +1382,7 @@ void cpu_init(void)
21290 */
21291 load_ucode_ap();
21292
21293 - t = &per_cpu(cpu_tss, cpu);
21294 + t = cpu_tss + cpu;
21295 oist = &per_cpu(orig_ist, cpu);
21296
21297 #ifdef CONFIG_NUMA
21298 @@ -1399,7 +1414,6 @@ void cpu_init(void)
21299 wrmsrl(MSR_KERNEL_GS_BASE, 0);
21300 barrier();
21301
21302 - x86_configure_nx();
21303 x2apic_setup();
21304
21305 /*
21306 @@ -1451,7 +1465,7 @@ void cpu_init(void)
21307 {
21308 int cpu = smp_processor_id();
21309 struct task_struct *curr = current;
21310 - struct tss_struct *t = &per_cpu(cpu_tss, cpu);
21311 + struct tss_struct *t = cpu_tss + cpu;
21312 struct thread_struct *thread = &curr->thread;
21313
21314 wait_for_master_cpu(cpu);
21315 diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
21316 index edcb0e2..a138233 100644
21317 --- a/arch/x86/kernel/cpu/intel_cacheinfo.c
21318 +++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
21319 @@ -519,25 +519,23 @@ cache_private_attrs_is_visible(struct kobject *kobj,
21320 return 0;
21321 }
21322
21323 +static struct attribute *amd_l3_attrs[4];
21324 +
21325 static struct attribute_group cache_private_group = {
21326 .is_visible = cache_private_attrs_is_visible,
21327 + .attrs = amd_l3_attrs,
21328 };
21329
21330 static void init_amd_l3_attrs(void)
21331 {
21332 int n = 1;
21333 - static struct attribute **amd_l3_attrs;
21334 -
21335 - if (amd_l3_attrs) /* already initialized */
21336 - return;
21337
21338 if (amd_nb_has_feature(AMD_NB_L3_INDEX_DISABLE))
21339 n += 2;
21340 if (amd_nb_has_feature(AMD_NB_L3_PARTITIONING))
21341 n += 1;
21342
21343 - amd_l3_attrs = kcalloc(n, sizeof(*amd_l3_attrs), GFP_KERNEL);
21344 - if (!amd_l3_attrs)
21345 + if (n > 1 && amd_l3_attrs[0]) /* already initialized */
21346 return;
21347
21348 n = 0;
21349 @@ -547,8 +545,6 @@ static void init_amd_l3_attrs(void)
21350 }
21351 if (amd_nb_has_feature(AMD_NB_L3_PARTITIONING))
21352 amd_l3_attrs[n++] = &dev_attr_subcaches.attr;
21353 -
21354 - cache_private_group.attrs = amd_l3_attrs;
21355 }
21356
21357 const struct attribute_group *
21358 @@ -559,7 +555,7 @@ cache_get_priv_group(struct cacheinfo *this_leaf)
21359 if (this_leaf->level < 3 || !nb)
21360 return NULL;
21361
21362 - if (nb && nb->l3_cache.indices)
21363 + if (nb->l3_cache.indices)
21364 init_amd_l3_attrs();
21365
21366 return &cache_private_group;
21367 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
21368 index 20190bd..cadb2ab 100644
21369 --- a/arch/x86/kernel/cpu/mcheck/mce.c
21370 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
21371 @@ -47,6 +47,7 @@
21372 #include <asm/tlbflush.h>
21373 #include <asm/mce.h>
21374 #include <asm/msr.h>
21375 +#include <asm/local.h>
21376
21377 #include "mce-internal.h"
21378
21379 @@ -256,7 +257,7 @@ static void print_mce(struct mce *m)
21380 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
21381 m->cs, m->ip);
21382
21383 - if (m->cs == __KERNEL_CS)
21384 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
21385 print_symbol("{%s}", m->ip);
21386 pr_cont("\n");
21387 }
21388 @@ -289,10 +290,10 @@ static void print_mce(struct mce *m)
21389
21390 #define PANIC_TIMEOUT 5 /* 5 seconds */
21391
21392 -static atomic_t mce_panicked;
21393 +static atomic_unchecked_t mce_panicked;
21394
21395 static int fake_panic;
21396 -static atomic_t mce_fake_panicked;
21397 +static atomic_unchecked_t mce_fake_panicked;
21398
21399 /* Panic in progress. Enable interrupts and wait for final IPI */
21400 static void wait_for_panic(void)
21401 @@ -316,7 +317,7 @@ static void mce_panic(const char *msg, struct mce *final, char *exp)
21402 /*
21403 * Make sure only one CPU runs in machine check panic
21404 */
21405 - if (atomic_inc_return(&mce_panicked) > 1)
21406 + if (atomic_inc_return_unchecked(&mce_panicked) > 1)
21407 wait_for_panic();
21408 barrier();
21409
21410 @@ -324,7 +325,7 @@ static void mce_panic(const char *msg, struct mce *final, char *exp)
21411 console_verbose();
21412 } else {
21413 /* Don't log too much for fake panic */
21414 - if (atomic_inc_return(&mce_fake_panicked) > 1)
21415 + if (atomic_inc_return_unchecked(&mce_fake_panicked) > 1)
21416 return;
21417 }
21418 /* First print corrected ones that are still unlogged */
21419 @@ -363,7 +364,7 @@ static void mce_panic(const char *msg, struct mce *final, char *exp)
21420 if (!fake_panic) {
21421 if (panic_timeout == 0)
21422 panic_timeout = mca_cfg.panic_timeout;
21423 - panic(msg);
21424 + panic("%s", msg);
21425 } else
21426 pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg);
21427 }
21428 @@ -749,7 +750,7 @@ static int mce_timed_out(u64 *t, const char *msg)
21429 * might have been modified by someone else.
21430 */
21431 rmb();
21432 - if (atomic_read(&mce_panicked))
21433 + if (atomic_read_unchecked(&mce_panicked))
21434 wait_for_panic();
21435 if (!mca_cfg.monarch_timeout)
21436 goto out;
21437 @@ -1679,7 +1680,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
21438 }
21439
21440 /* Call the installed machine check handler for this CPU setup. */
21441 -void (*machine_check_vector)(struct pt_regs *, long error_code) =
21442 +void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
21443 unexpected_machine_check;
21444
21445 /*
21446 @@ -1702,7 +1703,9 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
21447 return;
21448 }
21449
21450 + pax_open_kernel();
21451 machine_check_vector = do_machine_check;
21452 + pax_close_kernel();
21453
21454 __mcheck_cpu_init_generic();
21455 __mcheck_cpu_init_vendor(c);
21456 @@ -1716,7 +1719,7 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
21457 */
21458
21459 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
21460 -static int mce_chrdev_open_count; /* #times opened */
21461 +static local_t mce_chrdev_open_count; /* #times opened */
21462 static int mce_chrdev_open_exclu; /* already open exclusive? */
21463
21464 static int mce_chrdev_open(struct inode *inode, struct file *file)
21465 @@ -1724,7 +1727,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
21466 spin_lock(&mce_chrdev_state_lock);
21467
21468 if (mce_chrdev_open_exclu ||
21469 - (mce_chrdev_open_count && (file->f_flags & O_EXCL))) {
21470 + (local_read(&mce_chrdev_open_count) && (file->f_flags & O_EXCL))) {
21471 spin_unlock(&mce_chrdev_state_lock);
21472
21473 return -EBUSY;
21474 @@ -1732,7 +1735,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
21475
21476 if (file->f_flags & O_EXCL)
21477 mce_chrdev_open_exclu = 1;
21478 - mce_chrdev_open_count++;
21479 + local_inc(&mce_chrdev_open_count);
21480
21481 spin_unlock(&mce_chrdev_state_lock);
21482
21483 @@ -1743,7 +1746,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
21484 {
21485 spin_lock(&mce_chrdev_state_lock);
21486
21487 - mce_chrdev_open_count--;
21488 + local_dec(&mce_chrdev_open_count);
21489 mce_chrdev_open_exclu = 0;
21490
21491 spin_unlock(&mce_chrdev_state_lock);
21492 @@ -2419,7 +2422,7 @@ static __init void mce_init_banks(void)
21493
21494 for (i = 0; i < mca_cfg.banks; i++) {
21495 struct mce_bank *b = &mce_banks[i];
21496 - struct device_attribute *a = &b->attr;
21497 + device_attribute_no_const *a = &b->attr;
21498
21499 sysfs_attr_init(&a->attr);
21500 a->attr.name = b->attrname;
21501 @@ -2526,7 +2529,7 @@ struct dentry *mce_get_debugfs_dir(void)
21502 static void mce_reset(void)
21503 {
21504 cpu_missing = 0;
21505 - atomic_set(&mce_fake_panicked, 0);
21506 + atomic_set_unchecked(&mce_fake_panicked, 0);
21507 atomic_set(&mce_executing, 0);
21508 atomic_set(&mce_callin, 0);
21509 atomic_set(&global_nwo, 0);
21510 diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
21511 index 737b0ad..09ec66e 100644
21512 --- a/arch/x86/kernel/cpu/mcheck/p5.c
21513 +++ b/arch/x86/kernel/cpu/mcheck/p5.c
21514 @@ -12,6 +12,7 @@
21515 #include <asm/tlbflush.h>
21516 #include <asm/mce.h>
21517 #include <asm/msr.h>
21518 +#include <asm/pgtable.h>
21519
21520 /* By default disabled */
21521 int mce_p5_enabled __read_mostly;
21522 @@ -55,7 +56,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
21523 if (!cpu_has(c, X86_FEATURE_MCE))
21524 return;
21525
21526 + pax_open_kernel();
21527 machine_check_vector = pentium_machine_check;
21528 + pax_close_kernel();
21529 /* Make sure the vector pointer is visible before we enable MCEs: */
21530 wmb();
21531
21532 diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
21533 index 44f1382..315b292 100644
21534 --- a/arch/x86/kernel/cpu/mcheck/winchip.c
21535 +++ b/arch/x86/kernel/cpu/mcheck/winchip.c
21536 @@ -11,6 +11,7 @@
21537 #include <asm/tlbflush.h>
21538 #include <asm/mce.h>
21539 #include <asm/msr.h>
21540 +#include <asm/pgtable.h>
21541
21542 /* Machine check handler for WinChip C6: */
21543 static void winchip_machine_check(struct pt_regs *regs, long error_code)
21544 @@ -28,7 +29,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
21545 {
21546 u32 lo, hi;
21547
21548 + pax_open_kernel();
21549 machine_check_vector = winchip_machine_check;
21550 + pax_close_kernel();
21551 /* Make sure the vector pointer is visible before we enable MCEs: */
21552 wmb();
21553
21554 diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
21555 index 36a8361..e7058c2 100644
21556 --- a/arch/x86/kernel/cpu/microcode/core.c
21557 +++ b/arch/x86/kernel/cpu/microcode/core.c
21558 @@ -518,7 +518,7 @@ mc_cpu_callback(struct notifier_block *nb, unsigned long action, void *hcpu)
21559 return NOTIFY_OK;
21560 }
21561
21562 -static struct notifier_block __refdata mc_cpu_notifier = {
21563 +static struct notifier_block mc_cpu_notifier = {
21564 .notifier_call = mc_cpu_callback,
21565 };
21566
21567 diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
21568 index a41bead..4e3685b 100644
21569 --- a/arch/x86/kernel/cpu/microcode/intel.c
21570 +++ b/arch/x86/kernel/cpu/microcode/intel.c
21571 @@ -298,13 +298,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
21572
21573 static int get_ucode_user(void *to, const void *from, size_t n)
21574 {
21575 - return copy_from_user(to, from, n);
21576 + return copy_from_user(to, (const void __force_user *)from, n);
21577 }
21578
21579 static enum ucode_state
21580 request_microcode_user(int cpu, const void __user *buf, size_t size)
21581 {
21582 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
21583 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
21584 }
21585
21586 static void microcode_fini_cpu(int cpu)
21587 diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
21588 index ea5f363..cb0e905 100644
21589 --- a/arch/x86/kernel/cpu/mtrr/main.c
21590 +++ b/arch/x86/kernel/cpu/mtrr/main.c
21591 @@ -66,7 +66,7 @@ static DEFINE_MUTEX(mtrr_mutex);
21592 u64 size_or_mask, size_and_mask;
21593 static bool mtrr_aps_delayed_init;
21594
21595 -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
21596 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
21597
21598 const struct mtrr_ops *mtrr_if;
21599
21600 diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
21601 index df5e41f..816c719 100644
21602 --- a/arch/x86/kernel/cpu/mtrr/mtrr.h
21603 +++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
21604 @@ -25,7 +25,7 @@ struct mtrr_ops {
21605 int (*validate_add_page)(unsigned long base, unsigned long size,
21606 unsigned int type);
21607 int (*have_wrcomb)(void);
21608 -};
21609 +} __do_const;
21610
21611 extern int generic_get_free_region(unsigned long base, unsigned long size,
21612 int replace_reg);
21613 diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
21614 index aa4e3a7..469370f 100644
21615 --- a/arch/x86/kernel/cpu/perf_event.c
21616 +++ b/arch/x86/kernel/cpu/perf_event.c
21617 @@ -1509,7 +1509,7 @@ static void __init pmu_check_apic(void)
21618
21619 }
21620
21621 -static struct attribute_group x86_pmu_format_group = {
21622 +static attribute_group_no_const x86_pmu_format_group = {
21623 .name = "format",
21624 .attrs = NULL,
21625 };
21626 @@ -1608,7 +1608,7 @@ static struct attribute *events_attr[] = {
21627 NULL,
21628 };
21629
21630 -static struct attribute_group x86_pmu_events_group = {
21631 +static attribute_group_no_const x86_pmu_events_group = {
21632 .name = "events",
21633 .attrs = events_attr,
21634 };
21635 @@ -2181,7 +2181,7 @@ static unsigned long get_segment_base(unsigned int segment)
21636 if (idx > GDT_ENTRIES)
21637 return 0;
21638
21639 - desc = raw_cpu_ptr(gdt_page.gdt);
21640 + desc = get_cpu_gdt_table(smp_processor_id());
21641 }
21642
21643 return get_desc_base(desc + idx);
21644 @@ -2271,7 +2271,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
21645 break;
21646
21647 perf_callchain_store(entry, frame.return_address);
21648 - fp = frame.next_frame;
21649 + fp = (const void __force_user *)frame.next_frame;
21650 }
21651 }
21652
21653 diff --git a/arch/x86/kernel/cpu/perf_event_amd_iommu.c b/arch/x86/kernel/cpu/perf_event_amd_iommu.c
21654 index 97242a9..cf9c30e 100644
21655 --- a/arch/x86/kernel/cpu/perf_event_amd_iommu.c
21656 +++ b/arch/x86/kernel/cpu/perf_event_amd_iommu.c
21657 @@ -402,7 +402,7 @@ static void perf_iommu_del(struct perf_event *event, int flags)
21658 static __init int _init_events_attrs(struct perf_amd_iommu *perf_iommu)
21659 {
21660 struct attribute **attrs;
21661 - struct attribute_group *attr_group;
21662 + attribute_group_no_const *attr_group;
21663 int i = 0, j;
21664
21665 while (amd_iommu_v2_event_descs[i].attr.attr.name)
21666 diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
21667 index 2813ea0..3ef5969c8 100644
21668 --- a/arch/x86/kernel/cpu/perf_event_intel.c
21669 +++ b/arch/x86/kernel/cpu/perf_event_intel.c
21670 @@ -3033,10 +3033,10 @@ __init int intel_pmu_init(void)
21671 x86_pmu.num_counters_fixed = max((int)edx.split.num_counters_fixed, 3);
21672
21673 if (boot_cpu_has(X86_FEATURE_PDCM)) {
21674 - u64 capabilities;
21675 + u64 capabilities = x86_pmu.intel_cap.capabilities;
21676
21677 - rdmsrl(MSR_IA32_PERF_CAPABILITIES, capabilities);
21678 - x86_pmu.intel_cap.capabilities = capabilities;
21679 + if (rdmsrl_safe(MSR_IA32_PERF_CAPABILITIES, &x86_pmu.intel_cap.capabilities))
21680 + x86_pmu.intel_cap.capabilities = capabilities;
21681 }
21682
21683 intel_ds_init();
21684 diff --git a/arch/x86/kernel/cpu/perf_event_intel_bts.c b/arch/x86/kernel/cpu/perf_event_intel_bts.c
21685 index 7795f3f..3535b76 100644
21686 --- a/arch/x86/kernel/cpu/perf_event_intel_bts.c
21687 +++ b/arch/x86/kernel/cpu/perf_event_intel_bts.c
21688 @@ -252,7 +252,7 @@ static void bts_event_start(struct perf_event *event, int flags)
21689 __bts_event_start(event);
21690
21691 /* PMI handler: this counter is running and likely generating PMIs */
21692 - ACCESS_ONCE(bts->started) = 1;
21693 + ACCESS_ONCE_RW(bts->started) = 1;
21694 }
21695
21696 static void __bts_event_stop(struct perf_event *event)
21697 @@ -266,7 +266,7 @@ static void __bts_event_stop(struct perf_event *event)
21698 if (event->hw.state & PERF_HES_STOPPED)
21699 return;
21700
21701 - ACCESS_ONCE(event->hw.state) |= PERF_HES_STOPPED;
21702 + ACCESS_ONCE_RW(event->hw.state) |= PERF_HES_STOPPED;
21703 }
21704
21705 static void bts_event_stop(struct perf_event *event, int flags)
21706 @@ -274,7 +274,7 @@ static void bts_event_stop(struct perf_event *event, int flags)
21707 struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
21708
21709 /* PMI handler: don't restart this counter */
21710 - ACCESS_ONCE(bts->started) = 0;
21711 + ACCESS_ONCE_RW(bts->started) = 0;
21712
21713 __bts_event_stop(event);
21714
21715 diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
21716 index e4d1b8b..2c6ffa0 100644
21717 --- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
21718 +++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
21719 @@ -1352,7 +1352,9 @@ static int __init intel_cqm_init(void)
21720 goto out;
21721 }
21722
21723 - event_attr_intel_cqm_llc_scale.event_str = str;
21724 + pax_open_kernel();
21725 + *(const char **)&event_attr_intel_cqm_llc_scale.event_str = str;
21726 + pax_close_kernel();
21727
21728 ret = intel_cqm_setup_rmid_cache();
21729 if (ret)
21730 diff --git a/arch/x86/kernel/cpu/perf_event_intel_pt.c b/arch/x86/kernel/cpu/perf_event_intel_pt.c
21731 index 123ff1b..d53e500 100644
21732 --- a/arch/x86/kernel/cpu/perf_event_intel_pt.c
21733 +++ b/arch/x86/kernel/cpu/perf_event_intel_pt.c
21734 @@ -116,16 +116,12 @@ static const struct attribute_group *pt_attr_groups[] = {
21735
21736 static int __init pt_pmu_hw_init(void)
21737 {
21738 - struct dev_ext_attribute *de_attrs;
21739 - struct attribute **attrs;
21740 - size_t size;
21741 - int ret;
21742 + static struct dev_ext_attribute de_attrs[ARRAY_SIZE(pt_caps)];
21743 + static struct attribute *attrs[ARRAY_SIZE(pt_caps)];
21744 long i;
21745
21746 - attrs = NULL;
21747 - ret = -ENODEV;
21748 if (!test_cpu_cap(&boot_cpu_data, X86_FEATURE_INTEL_PT))
21749 - goto fail;
21750 + return -ENODEV;
21751
21752 for (i = 0; i < PT_CPUID_LEAVES; i++) {
21753 cpuid_count(20, i,
21754 @@ -135,39 +131,25 @@ static int __init pt_pmu_hw_init(void)
21755 &pt_pmu.caps[CR_EDX + i*4]);
21756 }
21757
21758 - ret = -ENOMEM;
21759 - size = sizeof(struct attribute *) * (ARRAY_SIZE(pt_caps)+1);
21760 - attrs = kzalloc(size, GFP_KERNEL);
21761 - if (!attrs)
21762 - goto fail;
21763 -
21764 - size = sizeof(struct dev_ext_attribute) * (ARRAY_SIZE(pt_caps)+1);
21765 - de_attrs = kzalloc(size, GFP_KERNEL);
21766 - if (!de_attrs)
21767 - goto fail;
21768 -
21769 + pax_open_kernel();
21770 for (i = 0; i < ARRAY_SIZE(pt_caps); i++) {
21771 - struct dev_ext_attribute *de_attr = de_attrs + i;
21772 + struct dev_ext_attribute *de_attr = &de_attrs[i];
21773
21774 - de_attr->attr.attr.name = pt_caps[i].name;
21775 + *(const char **)&de_attr->attr.attr.name = pt_caps[i].name;
21776
21777 sysfs_attr_init(&de_attr->attr.attr);
21778
21779 - de_attr->attr.attr.mode = S_IRUGO;
21780 - de_attr->attr.show = pt_cap_show;
21781 - de_attr->var = (void *)i;
21782 + *(umode_t *)&de_attr->attr.attr.mode = S_IRUGO;
21783 + *(void **)&de_attr->attr.show = pt_cap_show;
21784 + *(void **)&de_attr->var = (void *)i;
21785
21786 attrs[i] = &de_attr->attr.attr;
21787 }
21788
21789 - pt_cap_group.attrs = attrs;
21790 + *(struct attribute ***)&pt_cap_group.attrs = attrs;
21791 + pax_close_kernel();
21792
21793 return 0;
21794 -
21795 -fail:
21796 - kfree(attrs);
21797 -
21798 - return ret;
21799 }
21800
21801 #define PT_CONFIG_MASK (RTIT_CTL_TSC_EN | RTIT_CTL_DISRETC)
21802 @@ -928,7 +910,7 @@ static void pt_event_start(struct perf_event *event, int mode)
21803 return;
21804 }
21805
21806 - ACCESS_ONCE(pt->handle_nmi) = 1;
21807 + ACCESS_ONCE_RW(pt->handle_nmi) = 1;
21808 event->hw.state = 0;
21809
21810 pt_config_buffer(buf->cur->table, buf->cur_idx,
21811 @@ -945,7 +927,7 @@ static void pt_event_stop(struct perf_event *event, int mode)
21812 * Protect against the PMI racing with disabling wrmsr,
21813 * see comment in intel_pt_interrupt().
21814 */
21815 - ACCESS_ONCE(pt->handle_nmi) = 0;
21816 + ACCESS_ONCE_RW(pt->handle_nmi) = 0;
21817 pt_config_start(false);
21818
21819 if (event->hw.state == PERF_HES_STOPPED)
21820 diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
21821 index 358c54a..f068235 100644
21822 --- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
21823 +++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
21824 @@ -487,7 +487,7 @@ static struct attribute *rapl_events_hsw_attr[] = {
21825 NULL,
21826 };
21827
21828 -static struct attribute_group rapl_pmu_events_group = {
21829 +static attribute_group_no_const rapl_pmu_events_group __read_only = {
21830 .name = "events",
21831 .attrs = NULL, /* patched at runtime */
21832 };
21833 diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
21834 index 90b7c50..7863ae3 100644
21835 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
21836 +++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
21837 @@ -732,7 +732,7 @@ static void __init uncore_types_exit(struct intel_uncore_type **types)
21838 static int __init uncore_type_init(struct intel_uncore_type *type)
21839 {
21840 struct intel_uncore_pmu *pmus;
21841 - struct attribute_group *attr_group;
21842 + attribute_group_no_const *attr_group;
21843 struct attribute **attrs;
21844 int i, j;
21845
21846 diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
21847 index ceac8f5..a562de7 100644
21848 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
21849 +++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
21850 @@ -115,7 +115,7 @@ struct intel_uncore_box {
21851 struct uncore_event_desc {
21852 struct kobj_attribute attr;
21853 const char *config;
21854 -};
21855 +} __do_const;
21856
21857 ssize_t uncore_event_show(struct kobject *kobj,
21858 struct kobj_attribute *attr, char *buf);
21859 diff --git a/arch/x86/kernel/cpuid.c b/arch/x86/kernel/cpuid.c
21860 index 83741a7..bd3507d 100644
21861 --- a/arch/x86/kernel/cpuid.c
21862 +++ b/arch/x86/kernel/cpuid.c
21863 @@ -170,7 +170,7 @@ static int cpuid_class_cpu_callback(struct notifier_block *nfb,
21864 return notifier_from_errno(err);
21865 }
21866
21867 -static struct notifier_block __refdata cpuid_class_cpu_notifier =
21868 +static struct notifier_block cpuid_class_cpu_notifier =
21869 {
21870 .notifier_call = cpuid_class_cpu_callback,
21871 };
21872 diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
21873 index afa64ad..dce67dd 100644
21874 --- a/arch/x86/kernel/crash_dump_64.c
21875 +++ b/arch/x86/kernel/crash_dump_64.c
21876 @@ -36,7 +36,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
21877 return -ENOMEM;
21878
21879 if (userbuf) {
21880 - if (copy_to_user(buf, vaddr + offset, csize)) {
21881 + if (copy_to_user((char __force_user *)buf, vaddr + offset, csize)) {
21882 iounmap(vaddr);
21883 return -EFAULT;
21884 }
21885 diff --git a/arch/x86/kernel/doublefault.c b/arch/x86/kernel/doublefault.c
21886 index f6dfd93..892ade4 100644
21887 --- a/arch/x86/kernel/doublefault.c
21888 +++ b/arch/x86/kernel/doublefault.c
21889 @@ -12,7 +12,7 @@
21890
21891 #define DOUBLEFAULT_STACKSIZE (1024)
21892 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
21893 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
21894 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
21895
21896 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
21897
21898 @@ -22,7 +22,7 @@ static void doublefault_fn(void)
21899 unsigned long gdt, tss;
21900
21901 native_store_gdt(&gdt_desc);
21902 - gdt = gdt_desc.address;
21903 + gdt = (unsigned long)gdt_desc.address;
21904
21905 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
21906
21907 @@ -59,10 +59,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
21908 /* 0x2 bit is always set */
21909 .flags = X86_EFLAGS_SF | 0x2,
21910 .sp = STACK_START,
21911 - .es = __USER_DS,
21912 + .es = __KERNEL_DS,
21913 .cs = __KERNEL_CS,
21914 .ss = __KERNEL_DS,
21915 - .ds = __USER_DS,
21916 + .ds = __KERNEL_DS,
21917 .fs = __KERNEL_PERCPU,
21918
21919 .__cr3 = __pa_nodebug(swapper_pg_dir),
21920 diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
21921 index 9c30acf..8cf2411 100644
21922 --- a/arch/x86/kernel/dumpstack.c
21923 +++ b/arch/x86/kernel/dumpstack.c
21924 @@ -2,6 +2,9 @@
21925 * Copyright (C) 1991, 1992 Linus Torvalds
21926 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
21927 */
21928 +#ifdef CONFIG_GRKERNSEC_HIDESYM
21929 +#define __INCLUDED_BY_HIDESYM 1
21930 +#endif
21931 #include <linux/kallsyms.h>
21932 #include <linux/kprobes.h>
21933 #include <linux/uaccess.h>
21934 @@ -35,23 +38,21 @@ static void printk_stack_address(unsigned long address, int reliable,
21935
21936 void printk_address(unsigned long address)
21937 {
21938 - pr_cont(" [<%p>] %pS\n", (void *)address, (void *)address);
21939 + pr_cont(" [<%p>] %pA\n", (void *)address, (void *)address);
21940 }
21941
21942 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
21943 static void
21944 print_ftrace_graph_addr(unsigned long addr, void *data,
21945 const struct stacktrace_ops *ops,
21946 - struct thread_info *tinfo, int *graph)
21947 + struct task_struct *task, int *graph)
21948 {
21949 - struct task_struct *task;
21950 unsigned long ret_addr;
21951 int index;
21952
21953 if (addr != (unsigned long)return_to_handler)
21954 return;
21955
21956 - task = tinfo->task;
21957 index = task->curr_ret_stack;
21958
21959 if (!task->ret_stack || index < *graph)
21960 @@ -68,7 +69,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
21961 static inline void
21962 print_ftrace_graph_addr(unsigned long addr, void *data,
21963 const struct stacktrace_ops *ops,
21964 - struct thread_info *tinfo, int *graph)
21965 + struct task_struct *task, int *graph)
21966 { }
21967 #endif
21968
21969 @@ -79,10 +80,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
21970 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
21971 */
21972
21973 -static inline int valid_stack_ptr(struct thread_info *tinfo,
21974 - void *p, unsigned int size, void *end)
21975 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
21976 {
21977 - void *t = tinfo;
21978 if (end) {
21979 if (p < end && p >= (end-THREAD_SIZE))
21980 return 1;
21981 @@ -93,14 +92,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
21982 }
21983
21984 unsigned long
21985 -print_context_stack(struct thread_info *tinfo,
21986 +print_context_stack(struct task_struct *task, void *stack_start,
21987 unsigned long *stack, unsigned long bp,
21988 const struct stacktrace_ops *ops, void *data,
21989 unsigned long *end, int *graph)
21990 {
21991 struct stack_frame *frame = (struct stack_frame *)bp;
21992
21993 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
21994 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
21995 unsigned long addr;
21996
21997 addr = *stack;
21998 @@ -112,7 +111,7 @@ print_context_stack(struct thread_info *tinfo,
21999 } else {
22000 ops->address(data, addr, 0);
22001 }
22002 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
22003 + print_ftrace_graph_addr(addr, data, ops, task, graph);
22004 }
22005 stack++;
22006 }
22007 @@ -121,7 +120,7 @@ print_context_stack(struct thread_info *tinfo,
22008 EXPORT_SYMBOL_GPL(print_context_stack);
22009
22010 unsigned long
22011 -print_context_stack_bp(struct thread_info *tinfo,
22012 +print_context_stack_bp(struct task_struct *task, void *stack_start,
22013 unsigned long *stack, unsigned long bp,
22014 const struct stacktrace_ops *ops, void *data,
22015 unsigned long *end, int *graph)
22016 @@ -129,7 +128,7 @@ print_context_stack_bp(struct thread_info *tinfo,
22017 struct stack_frame *frame = (struct stack_frame *)bp;
22018 unsigned long *ret_addr = &frame->return_address;
22019
22020 - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
22021 + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
22022 unsigned long addr = *ret_addr;
22023
22024 if (!__kernel_text_address(addr))
22025 @@ -138,7 +137,7 @@ print_context_stack_bp(struct thread_info *tinfo,
22026 ops->address(data, addr, 1);
22027 frame = frame->next_frame;
22028 ret_addr = &frame->return_address;
22029 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
22030 + print_ftrace_graph_addr(addr, data, ops, task, graph);
22031 }
22032
22033 return (unsigned long)frame;
22034 @@ -226,6 +225,8 @@ unsigned long oops_begin(void)
22035 EXPORT_SYMBOL_GPL(oops_begin);
22036 NOKPROBE_SYMBOL(oops_begin);
22037
22038 +extern void gr_handle_kernel_exploit(void);
22039 +
22040 void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
22041 {
22042 if (regs && kexec_should_crash(current))
22043 @@ -247,7 +248,10 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
22044 panic("Fatal exception in interrupt");
22045 if (panic_on_oops)
22046 panic("Fatal exception");
22047 - do_exit(signr);
22048 +
22049 + gr_handle_kernel_exploit();
22050 +
22051 + do_group_exit(signr);
22052 }
22053 NOKPROBE_SYMBOL(oops_end);
22054
22055 diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
22056 index 464ffd6..01f2cda 100644
22057 --- a/arch/x86/kernel/dumpstack_32.c
22058 +++ b/arch/x86/kernel/dumpstack_32.c
22059 @@ -61,15 +61,14 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22060 bp = stack_frame(task, regs);
22061
22062 for (;;) {
22063 - struct thread_info *context;
22064 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
22065 void *end_stack;
22066
22067 end_stack = is_hardirq_stack(stack, cpu);
22068 if (!end_stack)
22069 end_stack = is_softirq_stack(stack, cpu);
22070
22071 - context = task_thread_info(task);
22072 - bp = ops->walk_stack(context, stack, bp, ops, data,
22073 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data,
22074 end_stack, &graph);
22075
22076 /* Stop if not on irq stack */
22077 @@ -137,16 +136,17 @@ void show_regs(struct pt_regs *regs)
22078 unsigned int code_len = code_bytes;
22079 unsigned char c;
22080 u8 *ip;
22081 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(0)[(0xffff & regs->cs) >> 3]);
22082
22083 pr_emerg("Stack:\n");
22084 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
22085
22086 pr_emerg("Code:");
22087
22088 - ip = (u8 *)regs->ip - code_prologue;
22089 + ip = (u8 *)regs->ip - code_prologue + cs_base;
22090 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
22091 /* try starting at IP */
22092 - ip = (u8 *)regs->ip;
22093 + ip = (u8 *)regs->ip + cs_base;
22094 code_len = code_len - code_prologue + 1;
22095 }
22096 for (i = 0; i < code_len; i++, ip++) {
22097 @@ -155,7 +155,7 @@ void show_regs(struct pt_regs *regs)
22098 pr_cont(" Bad EIP value.");
22099 break;
22100 }
22101 - if (ip == (u8 *)regs->ip)
22102 + if (ip == (u8 *)regs->ip + cs_base)
22103 pr_cont(" <%02x>", c);
22104 else
22105 pr_cont(" %02x", c);
22106 @@ -168,6 +168,7 @@ int is_valid_bugaddr(unsigned long ip)
22107 {
22108 unsigned short ud2;
22109
22110 + ip = ktla_ktva(ip);
22111 if (ip < PAGE_OFFSET)
22112 return 0;
22113 if (probe_kernel_address((unsigned short *)ip, ud2))
22114 @@ -175,3 +176,15 @@ int is_valid_bugaddr(unsigned long ip)
22115
22116 return ud2 == 0x0b0f;
22117 }
22118 +
22119 +#if defined(CONFIG_PAX_MEMORY_STACKLEAK) || defined(CONFIG_PAX_USERCOPY)
22120 +void __used pax_check_alloca(unsigned long size)
22121 +{
22122 + unsigned long sp = (unsigned long)&sp, stack_left;
22123 +
22124 + /* all kernel stacks are of the same size */
22125 + stack_left = sp & (THREAD_SIZE - 1);
22126 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22127 +}
22128 +EXPORT_SYMBOL(pax_check_alloca);
22129 +#endif
22130 diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
22131 index 5f1c626..1cba97e 100644
22132 --- a/arch/x86/kernel/dumpstack_64.c
22133 +++ b/arch/x86/kernel/dumpstack_64.c
22134 @@ -153,12 +153,12 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22135 const struct stacktrace_ops *ops, void *data)
22136 {
22137 const unsigned cpu = get_cpu();
22138 - struct thread_info *tinfo;
22139 unsigned long *irq_stack = (unsigned long *)per_cpu(irq_stack_ptr, cpu);
22140 unsigned long dummy;
22141 unsigned used = 0;
22142 int graph = 0;
22143 int done = 0;
22144 + void *stack_start;
22145
22146 if (!task)
22147 task = current;
22148 @@ -179,7 +179,6 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22149 * current stack address. If the stacks consist of nested
22150 * exceptions
22151 */
22152 - tinfo = task_thread_info(task);
22153 while (!done) {
22154 unsigned long *stack_end;
22155 enum stack_type stype;
22156 @@ -202,7 +201,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22157 if (ops->stack(data, id) < 0)
22158 break;
22159
22160 - bp = ops->walk_stack(tinfo, stack, bp, ops,
22161 + bp = ops->walk_stack(task, stack_end - EXCEPTION_STKSZ, stack, bp, ops,
22162 data, stack_end, &graph);
22163 ops->stack(data, "<EOE>");
22164 /*
22165 @@ -210,6 +209,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22166 * second-to-last pointer (index -2 to end) in the
22167 * exception stack:
22168 */
22169 + if ((u16)stack_end[-1] != __KERNEL_DS)
22170 + goto out;
22171 stack = (unsigned long *) stack_end[-2];
22172 done = 0;
22173 break;
22174 @@ -218,7 +219,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22175
22176 if (ops->stack(data, "IRQ") < 0)
22177 break;
22178 - bp = ops->walk_stack(tinfo, stack, bp,
22179 + bp = ops->walk_stack(task, irq_stack, stack, bp,
22180 ops, data, stack_end, &graph);
22181 /*
22182 * We link to the next stack (which would be
22183 @@ -240,7 +241,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22184 /*
22185 * This handles the process stack:
22186 */
22187 - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
22188 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
22189 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
22190 +out:
22191 put_cpu();
22192 }
22193 EXPORT_SYMBOL(dump_trace);
22194 @@ -347,8 +350,55 @@ int is_valid_bugaddr(unsigned long ip)
22195 {
22196 unsigned short ud2;
22197
22198 - if (__copy_from_user(&ud2, (const void __user *) ip, sizeof(ud2)))
22199 + if (probe_kernel_address((unsigned short *)ip, ud2))
22200 return 0;
22201
22202 return ud2 == 0x0b0f;
22203 }
22204 +
22205 +#if defined(CONFIG_PAX_MEMORY_STACKLEAK) || defined(CONFIG_PAX_USERCOPY)
22206 +void __used pax_check_alloca(unsigned long size)
22207 +{
22208 + unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
22209 + unsigned cpu, used;
22210 + char *id;
22211 +
22212 + /* check the process stack first */
22213 + stack_start = (unsigned long)task_stack_page(current);
22214 + stack_end = stack_start + THREAD_SIZE;
22215 + if (likely(stack_start <= sp && sp < stack_end)) {
22216 + unsigned long stack_left = sp & (THREAD_SIZE - 1);
22217 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22218 + return;
22219 + }
22220 +
22221 + cpu = get_cpu();
22222 +
22223 + /* check the irq stacks */
22224 + stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
22225 + stack_start = stack_end - IRQ_STACK_SIZE;
22226 + if (stack_start <= sp && sp < stack_end) {
22227 + unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
22228 + put_cpu();
22229 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22230 + return;
22231 + }
22232 +
22233 + /* check the exception stacks */
22234 + used = 0;
22235 + stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
22236 + stack_start = stack_end - EXCEPTION_STKSZ;
22237 + if (stack_end && stack_start <= sp && sp < stack_end) {
22238 + unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
22239 + put_cpu();
22240 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22241 + return;
22242 + }
22243 +
22244 + put_cpu();
22245 +
22246 + /* unknown stack */
22247 + BUG();
22248 +}
22249 +EXPORT_SYMBOL(pax_check_alloca);
22250 +#endif
22251 diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
22252 index e2ce85d..00ccad0 100644
22253 --- a/arch/x86/kernel/e820.c
22254 +++ b/arch/x86/kernel/e820.c
22255 @@ -802,8 +802,8 @@ unsigned long __init e820_end_of_low_ram_pfn(void)
22256
22257 static void early_panic(char *msg)
22258 {
22259 - early_printk(msg);
22260 - panic(msg);
22261 + early_printk("%s", msg);
22262 + panic("%s", msg);
22263 }
22264
22265 static int userdef __initdata;
22266 diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
22267 index 89427d8..00c0d52 100644
22268 --- a/arch/x86/kernel/early_printk.c
22269 +++ b/arch/x86/kernel/early_printk.c
22270 @@ -7,6 +7,7 @@
22271 #include <linux/pci_regs.h>
22272 #include <linux/pci_ids.h>
22273 #include <linux/errno.h>
22274 +#include <linux/sched.h>
22275 #include <asm/io.h>
22276 #include <asm/processor.h>
22277 #include <asm/fcntl.h>
22278 diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
22279 index 1c30976..71b41b9 100644
22280 --- a/arch/x86/kernel/entry_32.S
22281 +++ b/arch/x86/kernel/entry_32.S
22282 @@ -177,13 +177,154 @@
22283 /*CFI_REL_OFFSET gs, PT_GS*/
22284 .endm
22285 .macro SET_KERNEL_GS reg
22286 +
22287 +#ifdef CONFIG_CC_STACKPROTECTOR
22288 movl $(__KERNEL_STACK_CANARY), \reg
22289 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
22290 + movl $(__USER_DS), \reg
22291 +#else
22292 + xorl \reg, \reg
22293 +#endif
22294 +
22295 movl \reg, %gs
22296 .endm
22297
22298 #endif /* CONFIG_X86_32_LAZY_GS */
22299
22300 -.macro SAVE_ALL
22301 +.macro pax_enter_kernel
22302 +#ifdef CONFIG_PAX_KERNEXEC
22303 + call pax_enter_kernel
22304 +#endif
22305 +.endm
22306 +
22307 +.macro pax_exit_kernel
22308 +#ifdef CONFIG_PAX_KERNEXEC
22309 + call pax_exit_kernel
22310 +#endif
22311 +.endm
22312 +
22313 +#ifdef CONFIG_PAX_KERNEXEC
22314 +ENTRY(pax_enter_kernel)
22315 +#ifdef CONFIG_PARAVIRT
22316 + pushl %eax
22317 + pushl %ecx
22318 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
22319 + mov %eax, %esi
22320 +#else
22321 + mov %cr0, %esi
22322 +#endif
22323 + bts $X86_CR0_WP_BIT, %esi
22324 + jnc 1f
22325 + mov %cs, %esi
22326 + cmp $__KERNEL_CS, %esi
22327 + jz 3f
22328 + ljmp $__KERNEL_CS, $3f
22329 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
22330 +2:
22331 +#ifdef CONFIG_PARAVIRT
22332 + mov %esi, %eax
22333 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
22334 +#else
22335 + mov %esi, %cr0
22336 +#endif
22337 +3:
22338 +#ifdef CONFIG_PARAVIRT
22339 + popl %ecx
22340 + popl %eax
22341 +#endif
22342 + ret
22343 +ENDPROC(pax_enter_kernel)
22344 +
22345 +ENTRY(pax_exit_kernel)
22346 +#ifdef CONFIG_PARAVIRT
22347 + pushl %eax
22348 + pushl %ecx
22349 +#endif
22350 + mov %cs, %esi
22351 + cmp $__KERNEXEC_KERNEL_CS, %esi
22352 + jnz 2f
22353 +#ifdef CONFIG_PARAVIRT
22354 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
22355 + mov %eax, %esi
22356 +#else
22357 + mov %cr0, %esi
22358 +#endif
22359 + btr $X86_CR0_WP_BIT, %esi
22360 + ljmp $__KERNEL_CS, $1f
22361 +1:
22362 +#ifdef CONFIG_PARAVIRT
22363 + mov %esi, %eax
22364 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
22365 +#else
22366 + mov %esi, %cr0
22367 +#endif
22368 +2:
22369 +#ifdef CONFIG_PARAVIRT
22370 + popl %ecx
22371 + popl %eax
22372 +#endif
22373 + ret
22374 +ENDPROC(pax_exit_kernel)
22375 +#endif
22376 +
22377 + .macro pax_erase_kstack
22378 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
22379 + call pax_erase_kstack
22380 +#endif
22381 + .endm
22382 +
22383 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
22384 +/*
22385 + * ebp: thread_info
22386 + */
22387 +ENTRY(pax_erase_kstack)
22388 + pushl %edi
22389 + pushl %ecx
22390 + pushl %eax
22391 +
22392 + mov TI_lowest_stack(%ebp), %edi
22393 + mov $-0xBEEF, %eax
22394 + std
22395 +
22396 +1: mov %edi, %ecx
22397 + and $THREAD_SIZE_asm - 1, %ecx
22398 + shr $2, %ecx
22399 + repne scasl
22400 + jecxz 2f
22401 +
22402 + cmp $2*16, %ecx
22403 + jc 2f
22404 +
22405 + mov $2*16, %ecx
22406 + repe scasl
22407 + jecxz 2f
22408 + jne 1b
22409 +
22410 +2: cld
22411 + or $2*4, %edi
22412 + mov %esp, %ecx
22413 + sub %edi, %ecx
22414 +
22415 + cmp $THREAD_SIZE_asm, %ecx
22416 + jb 3f
22417 + ud2
22418 +3:
22419 +
22420 + shr $2, %ecx
22421 + rep stosl
22422 +
22423 + mov TI_task_thread_sp0(%ebp), %edi
22424 + sub $128, %edi
22425 + mov %edi, TI_lowest_stack(%ebp)
22426 +
22427 + popl %eax
22428 + popl %ecx
22429 + popl %edi
22430 + ret
22431 +ENDPROC(pax_erase_kstack)
22432 +#endif
22433 +
22434 +.macro __SAVE_ALL _DS
22435 cld
22436 PUSH_GS
22437 pushl_cfi %fs
22438 @@ -206,7 +347,7 @@
22439 CFI_REL_OFFSET ecx, 0
22440 pushl_cfi %ebx
22441 CFI_REL_OFFSET ebx, 0
22442 - movl $(__USER_DS), %edx
22443 + movl $\_DS, %edx
22444 movl %edx, %ds
22445 movl %edx, %es
22446 movl $(__KERNEL_PERCPU), %edx
22447 @@ -214,6 +355,15 @@
22448 SET_KERNEL_GS %edx
22449 .endm
22450
22451 +.macro SAVE_ALL
22452 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
22453 + __SAVE_ALL __KERNEL_DS
22454 + pax_enter_kernel
22455 +#else
22456 + __SAVE_ALL __USER_DS
22457 +#endif
22458 +.endm
22459 +
22460 .macro RESTORE_INT_REGS
22461 popl_cfi %ebx
22462 CFI_RESTORE ebx
22463 @@ -297,7 +447,7 @@ ENTRY(ret_from_fork)
22464 popfl_cfi
22465 jmp syscall_exit
22466 CFI_ENDPROC
22467 -END(ret_from_fork)
22468 +ENDPROC(ret_from_fork)
22469
22470 ENTRY(ret_from_kernel_thread)
22471 CFI_STARTPROC
22472 @@ -340,7 +490,15 @@ ret_from_intr:
22473 andl $SEGMENT_RPL_MASK, %eax
22474 #endif
22475 cmpl $USER_RPL, %eax
22476 +
22477 +#ifdef CONFIG_PAX_KERNEXEC
22478 + jae resume_userspace
22479 +
22480 + pax_exit_kernel
22481 + jmp resume_kernel
22482 +#else
22483 jb resume_kernel # not returning to v8086 or userspace
22484 +#endif
22485
22486 ENTRY(resume_userspace)
22487 LOCKDEP_SYS_EXIT
22488 @@ -352,8 +510,8 @@ ENTRY(resume_userspace)
22489 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
22490 # int/exception return?
22491 jne work_pending
22492 - jmp restore_all
22493 -END(ret_from_exception)
22494 + jmp restore_all_pax
22495 +ENDPROC(ret_from_exception)
22496
22497 #ifdef CONFIG_PREEMPT
22498 ENTRY(resume_kernel)
22499 @@ -365,7 +523,7 @@ need_resched:
22500 jz restore_all
22501 call preempt_schedule_irq
22502 jmp need_resched
22503 -END(resume_kernel)
22504 +ENDPROC(resume_kernel)
22505 #endif
22506 CFI_ENDPROC
22507
22508 @@ -395,33 +553,45 @@ sysenter_past_esp:
22509 /*CFI_REL_OFFSET cs, 0*/
22510 /*
22511 * Push current_thread_info()->sysenter_return to the stack.
22512 - * A tiny bit of offset fixup is necessary: TI_sysenter_return
22513 - * is relative to thread_info, which is at the bottom of the
22514 - * kernel stack page. 4*4 means the 4 words pushed above;
22515 - * TOP_OF_KERNEL_STACK_PADDING takes us to the top of the stack;
22516 - * and THREAD_SIZE takes us to the bottom.
22517 */
22518 - pushl_cfi ((TI_sysenter_return) - THREAD_SIZE + TOP_OF_KERNEL_STACK_PADDING + 4*4)(%esp)
22519 + pushl_cfi $0
22520 CFI_REL_OFFSET eip, 0
22521
22522 pushl_cfi %eax
22523 SAVE_ALL
22524 + GET_THREAD_INFO(%ebp)
22525 + movl TI_sysenter_return(%ebp),%ebp
22526 + movl %ebp,PT_EIP(%esp)
22527 ENABLE_INTERRUPTS(CLBR_NONE)
22528
22529 /*
22530 * Load the potential sixth argument from user stack.
22531 * Careful about security.
22532 */
22533 + movl PT_OLDESP(%esp),%ebp
22534 +
22535 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22536 + mov PT_OLDSS(%esp),%ds
22537 +1: movl %ds:(%ebp),%ebp
22538 + push %ss
22539 + pop %ds
22540 +#else
22541 cmpl $__PAGE_OFFSET-3,%ebp
22542 jae syscall_fault
22543 ASM_STAC
22544 1: movl (%ebp),%ebp
22545 ASM_CLAC
22546 +#endif
22547 +
22548 movl %ebp,PT_EBP(%esp)
22549 _ASM_EXTABLE(1b,syscall_fault)
22550
22551 GET_THREAD_INFO(%ebp)
22552
22553 +#ifdef CONFIG_PAX_RANDKSTACK
22554 + pax_erase_kstack
22555 +#endif
22556 +
22557 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
22558 jnz sysenter_audit
22559 sysenter_do_call:
22560 @@ -437,12 +607,24 @@ sysenter_after_call:
22561 testl $_TIF_ALLWORK_MASK, %ecx
22562 jnz sysexit_audit
22563 sysenter_exit:
22564 +
22565 +#ifdef CONFIG_PAX_RANDKSTACK
22566 + pushl_cfi %eax
22567 + movl %esp, %eax
22568 + call pax_randomize_kstack
22569 + popl_cfi %eax
22570 +#endif
22571 +
22572 + pax_erase_kstack
22573 +
22574 /* if something modifies registers it must also disable sysexit */
22575 movl PT_EIP(%esp), %edx
22576 movl PT_OLDESP(%esp), %ecx
22577 xorl %ebp,%ebp
22578 TRACE_IRQS_ON
22579 1: mov PT_FS(%esp), %fs
22580 +2: mov PT_DS(%esp), %ds
22581 +3: mov PT_ES(%esp), %es
22582 PTGS_TO_GS
22583 ENABLE_INTERRUPTS_SYSEXIT
22584
22585 @@ -456,6 +638,9 @@ sysenter_audit:
22586 pushl_cfi PT_ESI(%esp) /* a3: 5th arg */
22587 pushl_cfi PT_EDX+4(%esp) /* a2: 4th arg */
22588 call __audit_syscall_entry
22589 +
22590 + pax_erase_kstack
22591 +
22592 popl_cfi %ecx /* get that remapped edx off the stack */
22593 popl_cfi %ecx /* get that remapped esi off the stack */
22594 movl PT_EAX(%esp),%eax /* reload syscall number */
22595 @@ -482,10 +667,16 @@ sysexit_audit:
22596
22597 CFI_ENDPROC
22598 .pushsection .fixup,"ax"
22599 -2: movl $0,PT_FS(%esp)
22600 +4: movl $0,PT_FS(%esp)
22601 + jmp 1b
22602 +5: movl $0,PT_DS(%esp)
22603 + jmp 1b
22604 +6: movl $0,PT_ES(%esp)
22605 jmp 1b
22606 .popsection
22607 - _ASM_EXTABLE(1b,2b)
22608 + _ASM_EXTABLE(1b,4b)
22609 + _ASM_EXTABLE(2b,5b)
22610 + _ASM_EXTABLE(3b,6b)
22611 PTGS_TO_GS_EX
22612 ENDPROC(ia32_sysenter_target)
22613
22614 @@ -496,6 +687,11 @@ ENTRY(system_call)
22615 pushl_cfi %eax # save orig_eax
22616 SAVE_ALL
22617 GET_THREAD_INFO(%ebp)
22618 +
22619 +#ifdef CONFIG_PAX_RANDKSTACK
22620 + pax_erase_kstack
22621 +#endif
22622 +
22623 # system call tracing in operation / emulation
22624 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
22625 jnz syscall_trace_entry
22626 @@ -515,6 +711,15 @@ syscall_exit:
22627 testl $_TIF_ALLWORK_MASK, %ecx # current->work
22628 jnz syscall_exit_work
22629
22630 +restore_all_pax:
22631 +
22632 +#ifdef CONFIG_PAX_RANDKSTACK
22633 + movl %esp, %eax
22634 + call pax_randomize_kstack
22635 +#endif
22636 +
22637 + pax_erase_kstack
22638 +
22639 restore_all:
22640 TRACE_IRQS_IRET
22641 restore_all_notrace:
22642 @@ -569,14 +774,34 @@ ldt_ss:
22643 * compensating for the offset by changing to the ESPFIX segment with
22644 * a base address that matches for the difference.
22645 */
22646 -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
22647 +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
22648 mov %esp, %edx /* load kernel esp */
22649 mov PT_OLDESP(%esp), %eax /* load userspace esp */
22650 mov %dx, %ax /* eax: new kernel esp */
22651 sub %eax, %edx /* offset (low word is 0) */
22652 +#ifdef CONFIG_SMP
22653 + movl PER_CPU_VAR(cpu_number), %ebx
22654 + shll $PAGE_SHIFT_asm, %ebx
22655 + addl $cpu_gdt_table, %ebx
22656 +#else
22657 + movl $cpu_gdt_table, %ebx
22658 +#endif
22659 shr $16, %edx
22660 - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
22661 - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
22662 +
22663 +#ifdef CONFIG_PAX_KERNEXEC
22664 + mov %cr0, %esi
22665 + btr $X86_CR0_WP_BIT, %esi
22666 + mov %esi, %cr0
22667 +#endif
22668 +
22669 + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
22670 + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
22671 +
22672 +#ifdef CONFIG_PAX_KERNEXEC
22673 + bts $X86_CR0_WP_BIT, %esi
22674 + mov %esi, %cr0
22675 +#endif
22676 +
22677 pushl_cfi $__ESPFIX_SS
22678 pushl_cfi %eax /* new kernel esp */
22679 /* Disable interrupts, but do not irqtrace this section: we
22680 @@ -606,20 +831,18 @@ work_resched:
22681 movl TI_flags(%ebp), %ecx
22682 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
22683 # than syscall tracing?
22684 - jz restore_all
22685 + jz restore_all_pax
22686 testb $_TIF_NEED_RESCHED, %cl
22687 jnz work_resched
22688
22689 work_notifysig: # deal with pending signals and
22690 # notify-resume requests
22691 + movl %esp, %eax
22692 #ifdef CONFIG_VM86
22693 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
22694 - movl %esp, %eax
22695 jnz work_notifysig_v86 # returning to kernel-space or
22696 # vm86-space
22697 1:
22698 -#else
22699 - movl %esp, %eax
22700 #endif
22701 TRACE_IRQS_ON
22702 ENABLE_INTERRUPTS(CLBR_NONE)
22703 @@ -640,7 +863,7 @@ work_notifysig_v86:
22704 movl %eax, %esp
22705 jmp 1b
22706 #endif
22707 -END(work_pending)
22708 +ENDPROC(work_pending)
22709
22710 # perform syscall exit tracing
22711 ALIGN
22712 @@ -648,11 +871,14 @@ syscall_trace_entry:
22713 movl $-ENOSYS,PT_EAX(%esp)
22714 movl %esp, %eax
22715 call syscall_trace_enter
22716 +
22717 + pax_erase_kstack
22718 +
22719 /* What it returned is what we'll actually use. */
22720 cmpl $(NR_syscalls), %eax
22721 jnae syscall_call
22722 jmp syscall_exit
22723 -END(syscall_trace_entry)
22724 +ENDPROC(syscall_trace_entry)
22725
22726 # perform syscall exit tracing
22727 ALIGN
22728 @@ -665,26 +891,30 @@ syscall_exit_work:
22729 movl %esp, %eax
22730 call syscall_trace_leave
22731 jmp resume_userspace
22732 -END(syscall_exit_work)
22733 +ENDPROC(syscall_exit_work)
22734 CFI_ENDPROC
22735
22736 RING0_INT_FRAME # can't unwind into user space anyway
22737 syscall_fault:
22738 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22739 + push %ss
22740 + pop %ds
22741 +#endif
22742 ASM_CLAC
22743 GET_THREAD_INFO(%ebp)
22744 movl $-EFAULT,PT_EAX(%esp)
22745 jmp resume_userspace
22746 -END(syscall_fault)
22747 +ENDPROC(syscall_fault)
22748
22749 syscall_badsys:
22750 movl $-ENOSYS,%eax
22751 jmp syscall_after_call
22752 -END(syscall_badsys)
22753 +ENDPROC(syscall_badsys)
22754
22755 sysenter_badsys:
22756 movl $-ENOSYS,%eax
22757 jmp sysenter_after_call
22758 -END(sysenter_badsys)
22759 +ENDPROC(sysenter_badsys)
22760 CFI_ENDPROC
22761
22762 .macro FIXUP_ESPFIX_STACK
22763 @@ -697,8 +927,15 @@ END(sysenter_badsys)
22764 */
22765 #ifdef CONFIG_X86_ESPFIX32
22766 /* fixup the stack */
22767 - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
22768 - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
22769 +#ifdef CONFIG_SMP
22770 + movl PER_CPU_VAR(cpu_number), %ebx
22771 + shll $PAGE_SHIFT_asm, %ebx
22772 + addl $cpu_gdt_table, %ebx
22773 +#else
22774 + movl $cpu_gdt_table, %ebx
22775 +#endif
22776 + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
22777 + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
22778 shl $16, %eax
22779 addl %esp, %eax /* the adjusted stack pointer */
22780 pushl_cfi $__KERNEL_DS
22781 @@ -737,7 +974,7 @@ ENTRY(irq_entries_start)
22782 CFI_ADJUST_CFA_OFFSET -4
22783 .align 8
22784 .endr
22785 -END(irq_entries_start)
22786 +ENDPROC(irq_entries_start)
22787
22788 /*
22789 * the CPU automatically disables interrupts when executing an IRQ vector,
22790 @@ -790,7 +1027,7 @@ ENTRY(coprocessor_error)
22791 pushl_cfi $do_coprocessor_error
22792 jmp error_code
22793 CFI_ENDPROC
22794 -END(coprocessor_error)
22795 +ENDPROC(coprocessor_error)
22796
22797 ENTRY(simd_coprocessor_error)
22798 RING0_INT_FRAME
22799 @@ -806,7 +1043,7 @@ ENTRY(simd_coprocessor_error)
22800 #endif
22801 jmp error_code
22802 CFI_ENDPROC
22803 -END(simd_coprocessor_error)
22804 +ENDPROC(simd_coprocessor_error)
22805
22806 ENTRY(device_not_available)
22807 RING0_INT_FRAME
22808 @@ -815,18 +1052,18 @@ ENTRY(device_not_available)
22809 pushl_cfi $do_device_not_available
22810 jmp error_code
22811 CFI_ENDPROC
22812 -END(device_not_available)
22813 +ENDPROC(device_not_available)
22814
22815 #ifdef CONFIG_PARAVIRT
22816 ENTRY(native_iret)
22817 iret
22818 _ASM_EXTABLE(native_iret, iret_exc)
22819 -END(native_iret)
22820 +ENDPROC(native_iret)
22821
22822 ENTRY(native_irq_enable_sysexit)
22823 sti
22824 sysexit
22825 -END(native_irq_enable_sysexit)
22826 +ENDPROC(native_irq_enable_sysexit)
22827 #endif
22828
22829 ENTRY(overflow)
22830 @@ -836,7 +1073,7 @@ ENTRY(overflow)
22831 pushl_cfi $do_overflow
22832 jmp error_code
22833 CFI_ENDPROC
22834 -END(overflow)
22835 +ENDPROC(overflow)
22836
22837 ENTRY(bounds)
22838 RING0_INT_FRAME
22839 @@ -845,7 +1082,7 @@ ENTRY(bounds)
22840 pushl_cfi $do_bounds
22841 jmp error_code
22842 CFI_ENDPROC
22843 -END(bounds)
22844 +ENDPROC(bounds)
22845
22846 ENTRY(invalid_op)
22847 RING0_INT_FRAME
22848 @@ -854,7 +1091,7 @@ ENTRY(invalid_op)
22849 pushl_cfi $do_invalid_op
22850 jmp error_code
22851 CFI_ENDPROC
22852 -END(invalid_op)
22853 +ENDPROC(invalid_op)
22854
22855 ENTRY(coprocessor_segment_overrun)
22856 RING0_INT_FRAME
22857 @@ -863,7 +1100,7 @@ ENTRY(coprocessor_segment_overrun)
22858 pushl_cfi $do_coprocessor_segment_overrun
22859 jmp error_code
22860 CFI_ENDPROC
22861 -END(coprocessor_segment_overrun)
22862 +ENDPROC(coprocessor_segment_overrun)
22863
22864 ENTRY(invalid_TSS)
22865 RING0_EC_FRAME
22866 @@ -871,7 +1108,7 @@ ENTRY(invalid_TSS)
22867 pushl_cfi $do_invalid_TSS
22868 jmp error_code
22869 CFI_ENDPROC
22870 -END(invalid_TSS)
22871 +ENDPROC(invalid_TSS)
22872
22873 ENTRY(segment_not_present)
22874 RING0_EC_FRAME
22875 @@ -879,7 +1116,7 @@ ENTRY(segment_not_present)
22876 pushl_cfi $do_segment_not_present
22877 jmp error_code
22878 CFI_ENDPROC
22879 -END(segment_not_present)
22880 +ENDPROC(segment_not_present)
22881
22882 ENTRY(stack_segment)
22883 RING0_EC_FRAME
22884 @@ -887,7 +1124,7 @@ ENTRY(stack_segment)
22885 pushl_cfi $do_stack_segment
22886 jmp error_code
22887 CFI_ENDPROC
22888 -END(stack_segment)
22889 +ENDPROC(stack_segment)
22890
22891 ENTRY(alignment_check)
22892 RING0_EC_FRAME
22893 @@ -895,7 +1132,7 @@ ENTRY(alignment_check)
22894 pushl_cfi $do_alignment_check
22895 jmp error_code
22896 CFI_ENDPROC
22897 -END(alignment_check)
22898 +ENDPROC(alignment_check)
22899
22900 ENTRY(divide_error)
22901 RING0_INT_FRAME
22902 @@ -904,7 +1141,7 @@ ENTRY(divide_error)
22903 pushl_cfi $do_divide_error
22904 jmp error_code
22905 CFI_ENDPROC
22906 -END(divide_error)
22907 +ENDPROC(divide_error)
22908
22909 #ifdef CONFIG_X86_MCE
22910 ENTRY(machine_check)
22911 @@ -914,7 +1151,7 @@ ENTRY(machine_check)
22912 pushl_cfi machine_check_vector
22913 jmp error_code
22914 CFI_ENDPROC
22915 -END(machine_check)
22916 +ENDPROC(machine_check)
22917 #endif
22918
22919 ENTRY(spurious_interrupt_bug)
22920 @@ -924,7 +1161,7 @@ ENTRY(spurious_interrupt_bug)
22921 pushl_cfi $do_spurious_interrupt_bug
22922 jmp error_code
22923 CFI_ENDPROC
22924 -END(spurious_interrupt_bug)
22925 +ENDPROC(spurious_interrupt_bug)
22926
22927 #ifdef CONFIG_XEN
22928 /* Xen doesn't set %esp to be precisely what the normal sysenter
22929 @@ -1033,7 +1270,7 @@ BUILD_INTERRUPT3(hyperv_callback_vector, HYPERVISOR_CALLBACK_VECTOR,
22930
22931 ENTRY(mcount)
22932 ret
22933 -END(mcount)
22934 +ENDPROC(mcount)
22935
22936 ENTRY(ftrace_caller)
22937 pushl %eax
22938 @@ -1063,7 +1300,7 @@ ftrace_graph_call:
22939 .globl ftrace_stub
22940 ftrace_stub:
22941 ret
22942 -END(ftrace_caller)
22943 +ENDPROC(ftrace_caller)
22944
22945 ENTRY(ftrace_regs_caller)
22946 pushf /* push flags before compare (in cs location) */
22947 @@ -1161,7 +1398,7 @@ trace:
22948 popl %ecx
22949 popl %eax
22950 jmp ftrace_stub
22951 -END(mcount)
22952 +ENDPROC(mcount)
22953 #endif /* CONFIG_DYNAMIC_FTRACE */
22954 #endif /* CONFIG_FUNCTION_TRACER */
22955
22956 @@ -1179,7 +1416,7 @@ ENTRY(ftrace_graph_caller)
22957 popl %ecx
22958 popl %eax
22959 ret
22960 -END(ftrace_graph_caller)
22961 +ENDPROC(ftrace_graph_caller)
22962
22963 .globl return_to_handler
22964 return_to_handler:
22965 @@ -1233,15 +1470,18 @@ error_code:
22966 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
22967 REG_TO_PTGS %ecx
22968 SET_KERNEL_GS %ecx
22969 - movl $(__USER_DS), %ecx
22970 + movl $(__KERNEL_DS), %ecx
22971 movl %ecx, %ds
22972 movl %ecx, %es
22973 +
22974 + pax_enter_kernel
22975 +
22976 TRACE_IRQS_OFF
22977 movl %esp,%eax # pt_regs pointer
22978 call *%edi
22979 jmp ret_from_exception
22980 CFI_ENDPROC
22981 -END(page_fault)
22982 +ENDPROC(page_fault)
22983
22984 /*
22985 * Debug traps and NMI can happen at the one SYSENTER instruction
22986 @@ -1284,7 +1524,7 @@ debug_stack_correct:
22987 call do_debug
22988 jmp ret_from_exception
22989 CFI_ENDPROC
22990 -END(debug)
22991 +ENDPROC(debug)
22992
22993 /*
22994 * NMI is doubly nasty. It can happen _while_ we're handling
22995 @@ -1324,6 +1564,9 @@ nmi_stack_correct:
22996 xorl %edx,%edx # zero error code
22997 movl %esp,%eax # pt_regs pointer
22998 call do_nmi
22999 +
23000 + pax_exit_kernel
23001 +
23002 jmp restore_all_notrace
23003 CFI_ENDPROC
23004
23005 @@ -1361,13 +1604,16 @@ nmi_espfix_stack:
23006 FIXUP_ESPFIX_STACK # %eax == %esp
23007 xorl %edx,%edx # zero error code
23008 call do_nmi
23009 +
23010 + pax_exit_kernel
23011 +
23012 RESTORE_REGS
23013 lss 12+4(%esp), %esp # back to espfix stack
23014 CFI_ADJUST_CFA_OFFSET -24
23015 jmp irq_return
23016 #endif
23017 CFI_ENDPROC
23018 -END(nmi)
23019 +ENDPROC(nmi)
23020
23021 ENTRY(int3)
23022 RING0_INT_FRAME
23023 @@ -1380,14 +1626,14 @@ ENTRY(int3)
23024 call do_int3
23025 jmp ret_from_exception
23026 CFI_ENDPROC
23027 -END(int3)
23028 +ENDPROC(int3)
23029
23030 ENTRY(general_protection)
23031 RING0_EC_FRAME
23032 pushl_cfi $do_general_protection
23033 jmp error_code
23034 CFI_ENDPROC
23035 -END(general_protection)
23036 +ENDPROC(general_protection)
23037
23038 #ifdef CONFIG_KVM_GUEST
23039 ENTRY(async_page_fault)
23040 @@ -1396,6 +1642,6 @@ ENTRY(async_page_fault)
23041 pushl_cfi $do_async_page_fault
23042 jmp error_code
23043 CFI_ENDPROC
23044 -END(async_page_fault)
23045 +ENDPROC(async_page_fault)
23046 #endif
23047
23048 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
23049 index 02c2eff..bd9cb4d 100644
23050 --- a/arch/x86/kernel/entry_64.S
23051 +++ b/arch/x86/kernel/entry_64.S
23052 @@ -46,6 +46,8 @@
23053 #include <asm/smap.h>
23054 #include <asm/pgtable_types.h>
23055 #include <linux/err.h>
23056 +#include <asm/pgtable.h>
23057 +#include <asm/alternative-asm.h>
23058
23059 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
23060 #include <linux/elf-em.h>
23061 @@ -64,6 +66,401 @@ ENTRY(native_usergs_sysret64)
23062 ENDPROC(native_usergs_sysret64)
23063 #endif /* CONFIG_PARAVIRT */
23064
23065 + .macro ljmpq sel, off
23066 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
23067 + .byte 0x48; ljmp *1234f(%rip)
23068 + .pushsection .rodata
23069 + .align 16
23070 + 1234: .quad \off; .word \sel
23071 + .popsection
23072 +#else
23073 + pushq $\sel
23074 + pushq $\off
23075 + lretq
23076 +#endif
23077 + .endm
23078 +
23079 + .macro pax_enter_kernel
23080 + pax_set_fptr_mask
23081 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
23082 + call pax_enter_kernel
23083 +#endif
23084 + .endm
23085 +
23086 + .macro pax_exit_kernel
23087 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
23088 + call pax_exit_kernel
23089 +#endif
23090 +
23091 + .endm
23092 +
23093 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
23094 +ENTRY(pax_enter_kernel)
23095 + pushq %rdi
23096 +
23097 +#ifdef CONFIG_PARAVIRT
23098 + PV_SAVE_REGS(CLBR_RDI)
23099 +#endif
23100 +
23101 +#ifdef CONFIG_PAX_KERNEXEC
23102 + GET_CR0_INTO_RDI
23103 + bts $X86_CR0_WP_BIT,%rdi
23104 + jnc 3f
23105 + mov %cs,%edi
23106 + cmp $__KERNEL_CS,%edi
23107 + jnz 2f
23108 +1:
23109 +#endif
23110 +
23111 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23112 + ALTERNATIVE "jmp 111f", "", X86_FEATURE_PCID
23113 + GET_CR3_INTO_RDI
23114 + cmp $0,%dil
23115 + jnz 112f
23116 + mov $__KERNEL_DS,%edi
23117 + mov %edi,%ss
23118 + jmp 111f
23119 +112: cmp $1,%dil
23120 + jz 113f
23121 + ud2
23122 +113: sub $4097,%rdi
23123 + bts $63,%rdi
23124 + SET_RDI_INTO_CR3
23125 + mov $__UDEREF_KERNEL_DS,%edi
23126 + mov %edi,%ss
23127 +111:
23128 +#endif
23129 +
23130 +#ifdef CONFIG_PARAVIRT
23131 + PV_RESTORE_REGS(CLBR_RDI)
23132 +#endif
23133 +
23134 + popq %rdi
23135 + pax_force_retaddr
23136 + retq
23137 +
23138 +#ifdef CONFIG_PAX_KERNEXEC
23139 +2: ljmpq __KERNEL_CS,1b
23140 +3: ljmpq __KERNEXEC_KERNEL_CS,4f
23141 +4: SET_RDI_INTO_CR0
23142 + jmp 1b
23143 +#endif
23144 +ENDPROC(pax_enter_kernel)
23145 +
23146 +ENTRY(pax_exit_kernel)
23147 + pushq %rdi
23148 +
23149 +#ifdef CONFIG_PARAVIRT
23150 + PV_SAVE_REGS(CLBR_RDI)
23151 +#endif
23152 +
23153 +#ifdef CONFIG_PAX_KERNEXEC
23154 + mov %cs,%rdi
23155 + cmp $__KERNEXEC_KERNEL_CS,%edi
23156 + jz 2f
23157 + GET_CR0_INTO_RDI
23158 + bts $X86_CR0_WP_BIT,%rdi
23159 + jnc 4f
23160 +1:
23161 +#endif
23162 +
23163 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23164 + ALTERNATIVE "jmp 111f", "", X86_FEATURE_PCID
23165 + mov %ss,%edi
23166 + cmp $__UDEREF_KERNEL_DS,%edi
23167 + jnz 111f
23168 + GET_CR3_INTO_RDI
23169 + cmp $0,%dil
23170 + jz 112f
23171 + ud2
23172 +112: add $4097,%rdi
23173 + bts $63,%rdi
23174 + SET_RDI_INTO_CR3
23175 + mov $__KERNEL_DS,%edi
23176 + mov %edi,%ss
23177 +111:
23178 +#endif
23179 +
23180 +#ifdef CONFIG_PARAVIRT
23181 + PV_RESTORE_REGS(CLBR_RDI);
23182 +#endif
23183 +
23184 + popq %rdi
23185 + pax_force_retaddr
23186 + retq
23187 +
23188 +#ifdef CONFIG_PAX_KERNEXEC
23189 +2: GET_CR0_INTO_RDI
23190 + btr $X86_CR0_WP_BIT,%rdi
23191 + jnc 4f
23192 + ljmpq __KERNEL_CS,3f
23193 +3: SET_RDI_INTO_CR0
23194 + jmp 1b
23195 +4: ud2
23196 + jmp 4b
23197 +#endif
23198 +ENDPROC(pax_exit_kernel)
23199 +#endif
23200 +
23201 + .macro pax_enter_kernel_user
23202 + pax_set_fptr_mask
23203 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23204 + call pax_enter_kernel_user
23205 +#endif
23206 + .endm
23207 +
23208 + .macro pax_exit_kernel_user
23209 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23210 + call pax_exit_kernel_user
23211 +#endif
23212 +#ifdef CONFIG_PAX_RANDKSTACK
23213 + pushq %rax
23214 + pushq %r11
23215 + call pax_randomize_kstack
23216 + popq %r11
23217 + popq %rax
23218 +#endif
23219 + .endm
23220 +
23221 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23222 +ENTRY(pax_enter_kernel_user)
23223 + pushq %rdi
23224 + pushq %rbx
23225 +
23226 +#ifdef CONFIG_PARAVIRT
23227 + PV_SAVE_REGS(CLBR_RDI)
23228 +#endif
23229 +
23230 + ALTERNATIVE "jmp 111f", "", X86_FEATURE_PCID
23231 + GET_CR3_INTO_RDI
23232 + cmp $1,%dil
23233 + jnz 4f
23234 + sub $4097,%rdi
23235 + bts $63,%rdi
23236 + SET_RDI_INTO_CR3
23237 + jmp 3f
23238 +111:
23239 +
23240 + GET_CR3_INTO_RDI
23241 + mov %rdi,%rbx
23242 + add $__START_KERNEL_map,%rbx
23243 + sub phys_base(%rip),%rbx
23244 +
23245 +#ifdef CONFIG_PARAVIRT
23246 + cmpl $0, pv_info+PARAVIRT_enabled
23247 + jz 1f
23248 + pushq %rdi
23249 + i = 0
23250 + .rept USER_PGD_PTRS
23251 + mov i*8(%rbx),%rsi
23252 + mov $0,%sil
23253 + lea i*8(%rbx),%rdi
23254 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
23255 + i = i + 1
23256 + .endr
23257 + popq %rdi
23258 + jmp 2f
23259 +1:
23260 +#endif
23261 +
23262 + i = 0
23263 + .rept USER_PGD_PTRS
23264 + movb $0,i*8(%rbx)
23265 + i = i + 1
23266 + .endr
23267 +
23268 +2: SET_RDI_INTO_CR3
23269 +
23270 +#ifdef CONFIG_PAX_KERNEXEC
23271 + GET_CR0_INTO_RDI
23272 + bts $X86_CR0_WP_BIT,%rdi
23273 + SET_RDI_INTO_CR0
23274 +#endif
23275 +
23276 +3:
23277 +
23278 +#ifdef CONFIG_PARAVIRT
23279 + PV_RESTORE_REGS(CLBR_RDI)
23280 +#endif
23281 +
23282 + popq %rbx
23283 + popq %rdi
23284 + pax_force_retaddr
23285 + retq
23286 +4: ud2
23287 +ENDPROC(pax_enter_kernel_user)
23288 +
23289 +ENTRY(pax_exit_kernel_user)
23290 + pushq %rdi
23291 + pushq %rbx
23292 +
23293 +#ifdef CONFIG_PARAVIRT
23294 + PV_SAVE_REGS(CLBR_RDI)
23295 +#endif
23296 +
23297 + GET_CR3_INTO_RDI
23298 + ALTERNATIVE "jmp 1f", "", X86_FEATURE_PCID
23299 + cmp $0,%dil
23300 + jnz 3f
23301 + add $4097,%rdi
23302 + bts $63,%rdi
23303 + SET_RDI_INTO_CR3
23304 + jmp 2f
23305 +1:
23306 +
23307 + mov %rdi,%rbx
23308 +
23309 +#ifdef CONFIG_PAX_KERNEXEC
23310 + GET_CR0_INTO_RDI
23311 + btr $X86_CR0_WP_BIT,%rdi
23312 + jnc 3f
23313 + SET_RDI_INTO_CR0
23314 +#endif
23315 +
23316 + add $__START_KERNEL_map,%rbx
23317 + sub phys_base(%rip),%rbx
23318 +
23319 +#ifdef CONFIG_PARAVIRT
23320 + cmpl $0, pv_info+PARAVIRT_enabled
23321 + jz 1f
23322 + i = 0
23323 + .rept USER_PGD_PTRS
23324 + mov i*8(%rbx),%rsi
23325 + mov $0x67,%sil
23326 + lea i*8(%rbx),%rdi
23327 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
23328 + i = i + 1
23329 + .endr
23330 + jmp 2f
23331 +1:
23332 +#endif
23333 +
23334 + i = 0
23335 + .rept USER_PGD_PTRS
23336 + movb $0x67,i*8(%rbx)
23337 + i = i + 1
23338 + .endr
23339 +2:
23340 +
23341 +#ifdef CONFIG_PARAVIRT
23342 + PV_RESTORE_REGS(CLBR_RDI)
23343 +#endif
23344 +
23345 + popq %rbx
23346 + popq %rdi
23347 + pax_force_retaddr
23348 + retq
23349 +3: ud2
23350 +ENDPROC(pax_exit_kernel_user)
23351 +#endif
23352 +
23353 + .macro pax_enter_kernel_nmi
23354 + pax_set_fptr_mask
23355 +
23356 +#ifdef CONFIG_PAX_KERNEXEC
23357 + GET_CR0_INTO_RDI
23358 + bts $X86_CR0_WP_BIT,%rdi
23359 + jc 110f
23360 + SET_RDI_INTO_CR0
23361 + or $2,%ebx
23362 +110:
23363 +#endif
23364 +
23365 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23366 + ALTERNATIVE "jmp 111f", "", X86_FEATURE_PCID
23367 + GET_CR3_INTO_RDI
23368 + cmp $0,%dil
23369 + jz 111f
23370 + sub $4097,%rdi
23371 + or $4,%ebx
23372 + bts $63,%rdi
23373 + SET_RDI_INTO_CR3
23374 + mov $__UDEREF_KERNEL_DS,%edi
23375 + mov %edi,%ss
23376 +111:
23377 +#endif
23378 + .endm
23379 +
23380 + .macro pax_exit_kernel_nmi
23381 +#ifdef CONFIG_PAX_KERNEXEC
23382 + btr $1,%ebx
23383 + jnc 110f
23384 + GET_CR0_INTO_RDI
23385 + btr $X86_CR0_WP_BIT,%rdi
23386 + SET_RDI_INTO_CR0
23387 +110:
23388 +#endif
23389 +
23390 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23391 + btr $2,%ebx
23392 + jnc 111f
23393 + GET_CR3_INTO_RDI
23394 + add $4097,%rdi
23395 + bts $63,%rdi
23396 + SET_RDI_INTO_CR3
23397 + mov $__KERNEL_DS,%edi
23398 + mov %edi,%ss
23399 +111:
23400 +#endif
23401 + .endm
23402 +
23403 + .macro pax_erase_kstack
23404 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
23405 + call pax_erase_kstack
23406 +#endif
23407 + .endm
23408 +
23409 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
23410 +ENTRY(pax_erase_kstack)
23411 + pushq %rdi
23412 + pushq %rcx
23413 + pushq %rax
23414 + pushq %r11
23415 +
23416 + GET_THREAD_INFO(%r11)
23417 + mov TI_lowest_stack(%r11), %rdi
23418 + mov $-0xBEEF, %rax
23419 + std
23420 +
23421 +1: mov %edi, %ecx
23422 + and $THREAD_SIZE_asm - 1, %ecx
23423 + shr $3, %ecx
23424 + repne scasq
23425 + jecxz 2f
23426 +
23427 + cmp $2*8, %ecx
23428 + jc 2f
23429 +
23430 + mov $2*8, %ecx
23431 + repe scasq
23432 + jecxz 2f
23433 + jne 1b
23434 +
23435 +2: cld
23436 + or $2*8, %rdi
23437 + mov %esp, %ecx
23438 + sub %edi, %ecx
23439 +
23440 + cmp $THREAD_SIZE_asm, %rcx
23441 + jb 3f
23442 + ud2
23443 +3:
23444 +
23445 + shr $3, %ecx
23446 + rep stosq
23447 +
23448 + mov TI_task_thread_sp0(%r11), %rdi
23449 + sub $256, %rdi
23450 + mov %rdi, TI_lowest_stack(%r11)
23451 +
23452 + popq %r11
23453 + popq %rax
23454 + popq %rcx
23455 + popq %rdi
23456 + pax_force_retaddr
23457 + ret
23458 +ENDPROC(pax_erase_kstack)
23459 +#endif
23460
23461 .macro TRACE_IRQS_IRETQ
23462 #ifdef CONFIG_TRACE_IRQFLAGS
23463 @@ -100,7 +497,7 @@ ENDPROC(native_usergs_sysret64)
23464 .endm
23465
23466 .macro TRACE_IRQS_IRETQ_DEBUG
23467 - bt $9,EFLAGS(%rsp) /* interrupts off? */
23468 + bt $X86_EFLAGS_IF_BIT,EFLAGS(%rsp) /* interrupts off? */
23469 jnc 1f
23470 TRACE_IRQS_ON_DEBUG
23471 1:
23472 @@ -221,14 +618,6 @@ GLOBAL(system_call_after_swapgs)
23473 /* Construct struct pt_regs on stack */
23474 pushq_cfi $__USER_DS /* pt_regs->ss */
23475 pushq_cfi PER_CPU_VAR(rsp_scratch) /* pt_regs->sp */
23476 - /*
23477 - * Re-enable interrupts.
23478 - * We use 'rsp_scratch' as a scratch space, hence irq-off block above
23479 - * must execute atomically in the face of possible interrupt-driven
23480 - * task preemption. We must enable interrupts only after we're done
23481 - * with using rsp_scratch:
23482 - */
23483 - ENABLE_INTERRUPTS(CLBR_NONE)
23484 pushq_cfi %r11 /* pt_regs->flags */
23485 pushq_cfi $__USER_CS /* pt_regs->cs */
23486 pushq_cfi %rcx /* pt_regs->ip */
23487 @@ -246,7 +635,27 @@ GLOBAL(system_call_after_swapgs)
23488 sub $(6*8),%rsp /* pt_regs->bp,bx,r12-15 not saved */
23489 CFI_ADJUST_CFA_OFFSET 6*8
23490
23491 - testl $_TIF_WORK_SYSCALL_ENTRY, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
23492 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
23493 + movq_cfi r12, R12
23494 +#endif
23495 +
23496 + pax_enter_kernel_user
23497 +
23498 +#ifdef CONFIG_PAX_RANDKSTACK
23499 + pax_erase_kstack
23500 +#endif
23501 +
23502 + /*
23503 + * Re-enable interrupts.
23504 + * We use 'rsp_scratch' as a scratch space, hence irq-off block above
23505 + * must execute atomically in the face of possible interrupt-driven
23506 + * task preemption. We must enable interrupts only after we're done
23507 + * with using rsp_scratch:
23508 + */
23509 + ENABLE_INTERRUPTS(CLBR_NONE)
23510 +
23511 + GET_THREAD_INFO(%rcx)
23512 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%rcx)
23513 jnz tracesys
23514 system_call_fastpath:
23515 #if __SYSCALL_MASK == ~0
23516 @@ -279,10 +688,13 @@ system_call_fastpath:
23517 * flags (TIF_NOTIFY_RESUME, TIF_USER_RETURN_NOTIFY, etc) set is
23518 * very bad.
23519 */
23520 - testl $_TIF_ALLWORK_MASK, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
23521 + GET_THREAD_INFO(%rcx)
23522 + testl $_TIF_ALLWORK_MASK,TI_flags(%rcx)
23523 jnz int_ret_from_sys_call_irqs_off /* Go to the slow path */
23524
23525 CFI_REMEMBER_STATE
23526 + pax_exit_kernel_user
23527 + pax_erase_kstack
23528
23529 RESTORE_C_REGS_EXCEPT_RCX_R11
23530 movq RIP(%rsp),%rcx
23531 @@ -316,6 +728,9 @@ tracesys:
23532 call syscall_trace_enter_phase1
23533 test %rax, %rax
23534 jnz tracesys_phase2 /* if needed, run the slow path */
23535 +
23536 + pax_erase_kstack
23537 +
23538 RESTORE_C_REGS_EXCEPT_RAX /* else restore clobbered regs */
23539 movq ORIG_RAX(%rsp), %rax
23540 jmp system_call_fastpath /* and return to the fast path */
23541 @@ -327,6 +742,8 @@ tracesys_phase2:
23542 movq %rax,%rdx
23543 call syscall_trace_enter_phase2
23544
23545 + pax_erase_kstack
23546 +
23547 /*
23548 * Reload registers from stack in case ptrace changed them.
23549 * We don't reload %rax because syscall_trace_entry_phase2() returned
23550 @@ -364,6 +781,8 @@ GLOBAL(int_with_check)
23551 andl %edi,%edx
23552 jnz int_careful
23553 andl $~TS_COMPAT,TI_status(%rcx)
23554 + pax_exit_kernel_user
23555 + pax_erase_kstack
23556 jmp syscall_return
23557
23558 /* Either reschedule or signal or syscall exit tracking needed. */
23559 @@ -485,7 +904,7 @@ opportunistic_sysret_failed:
23560 SWAPGS
23561 jmp restore_c_regs_and_iret
23562 CFI_ENDPROC
23563 -END(system_call)
23564 +ENDPROC(system_call)
23565
23566
23567 .macro FORK_LIKE func
23568 @@ -495,7 +914,7 @@ ENTRY(stub_\func)
23569 SAVE_EXTRA_REGS 8
23570 jmp sys_\func
23571 CFI_ENDPROC
23572 -END(stub_\func)
23573 +ENDPROC(stub_\func)
23574 .endm
23575
23576 FORK_LIKE clone
23577 @@ -519,7 +938,7 @@ return_from_execve:
23578 movq %rax,RAX(%rsp)
23579 jmp int_ret_from_sys_call
23580 CFI_ENDPROC
23581 -END(stub_execve)
23582 +ENDPROC(stub_execve)
23583 /*
23584 * Remaining execve stubs are only 7 bytes long.
23585 * ENTRY() often aligns to 16 bytes, which in this case has no benefits.
23586 @@ -531,7 +950,7 @@ GLOBAL(stub_execveat)
23587 call sys_execveat
23588 jmp return_from_execve
23589 CFI_ENDPROC
23590 -END(stub_execveat)
23591 +ENDPROC(stub_execveat)
23592
23593 #ifdef CONFIG_X86_X32_ABI
23594 .align 8
23595 @@ -541,7 +960,7 @@ GLOBAL(stub_x32_execve)
23596 call compat_sys_execve
23597 jmp return_from_execve
23598 CFI_ENDPROC
23599 -END(stub_x32_execve)
23600 +ENDPROC(stub_x32_execve)
23601 .align 8
23602 GLOBAL(stub_x32_execveat)
23603 CFI_STARTPROC
23604 @@ -549,7 +968,7 @@ GLOBAL(stub_x32_execveat)
23605 call compat_sys_execveat
23606 jmp return_from_execve
23607 CFI_ENDPROC
23608 -END(stub_x32_execveat)
23609 +ENDPROC(stub_x32_execveat)
23610 #endif
23611
23612 #ifdef CONFIG_IA32_EMULATION
23613 @@ -592,7 +1011,7 @@ return_from_stub:
23614 movq %rax,RAX(%rsp)
23615 jmp int_ret_from_sys_call
23616 CFI_ENDPROC
23617 -END(stub_rt_sigreturn)
23618 +ENDPROC(stub_rt_sigreturn)
23619
23620 #ifdef CONFIG_X86_X32_ABI
23621 ENTRY(stub_x32_rt_sigreturn)
23622 @@ -602,7 +1021,7 @@ ENTRY(stub_x32_rt_sigreturn)
23623 call sys32_x32_rt_sigreturn
23624 jmp return_from_stub
23625 CFI_ENDPROC
23626 -END(stub_x32_rt_sigreturn)
23627 +ENDPROC(stub_x32_rt_sigreturn)
23628 #endif
23629
23630 /*
23631 @@ -622,7 +1041,7 @@ ENTRY(ret_from_fork)
23632
23633 RESTORE_EXTRA_REGS
23634
23635 - testl $3,CS(%rsp) # from kernel_thread?
23636 + testb $3,CS(%rsp) # from kernel_thread?
23637
23638 /*
23639 * By the time we get here, we have no idea whether our pt_regs,
23640 @@ -641,7 +1060,7 @@ ENTRY(ret_from_fork)
23641 RESTORE_EXTRA_REGS
23642 jmp int_ret_from_sys_call
23643 CFI_ENDPROC
23644 -END(ret_from_fork)
23645 +ENDPROC(ret_from_fork)
23646
23647 /*
23648 * Build the entry stubs with some assembler magic.
23649 @@ -659,7 +1078,7 @@ ENTRY(irq_entries_start)
23650 .align 8
23651 .endr
23652 CFI_ENDPROC
23653 -END(irq_entries_start)
23654 +ENDPROC(irq_entries_start)
23655
23656 /*
23657 * Interrupt entry/exit.
23658 @@ -672,21 +1091,13 @@ END(irq_entries_start)
23659 /* 0(%rsp): ~(interrupt number) */
23660 .macro interrupt func
23661 cld
23662 - /*
23663 - * Since nothing in interrupt handling code touches r12...r15 members
23664 - * of "struct pt_regs", and since interrupts can nest, we can save
23665 - * four stack slots and simultaneously provide
23666 - * an unwind-friendly stack layout by saving "truncated" pt_regs
23667 - * exactly up to rbp slot, without these members.
23668 - */
23669 - ALLOC_PT_GPREGS_ON_STACK -RBP
23670 - SAVE_C_REGS -RBP
23671 - /* this goes to 0(%rsp) for unwinder, not for saving the value: */
23672 - SAVE_EXTRA_REGS_RBP -RBP
23673 + ALLOC_PT_GPREGS_ON_STACK
23674 + SAVE_C_REGS
23675 + SAVE_EXTRA_REGS
23676
23677 - leaq -RBP(%rsp),%rdi /* arg1 for \func (pointer to pt_regs) */
23678 + movq %rsp,%rdi /* arg1 for \func (pointer to pt_regs) */
23679
23680 - testl $3, CS-RBP(%rsp)
23681 + testb $3, CS(%rsp)
23682 je 1f
23683 SWAPGS
23684 1:
23685 @@ -709,8 +1120,20 @@ END(irq_entries_start)
23686 CFI_ESCAPE 0x0f /* DW_CFA_def_cfa_expression */, 6, \
23687 0x77 /* DW_OP_breg7 (rsp) */, 0, \
23688 0x06 /* DW_OP_deref */, \
23689 - 0x08 /* DW_OP_const1u */, SIZEOF_PTREGS-RBP, \
23690 + 0x08 /* DW_OP_const1u */, SIZEOF_PTREGS, \
23691 0x22 /* DW_OP_plus */
23692 +
23693 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23694 + testb $3, CS(%rdi)
23695 + jnz 1f
23696 + pax_enter_kernel
23697 + jmp 2f
23698 +1: pax_enter_kernel_user
23699 +2:
23700 +#else
23701 + pax_enter_kernel
23702 +#endif
23703 +
23704 /* We entered an interrupt context - irqs are off: */
23705 TRACE_IRQS_OFF
23706
23707 @@ -735,13 +1158,12 @@ ret_from_intr:
23708
23709 /* Restore saved previous stack */
23710 popq %rsi
23711 - CFI_DEF_CFA rsi,SIZEOF_PTREGS-RBP /* reg/off reset after def_cfa_expr */
23712 - /* return code expects complete pt_regs - adjust rsp accordingly: */
23713 - leaq -RBP(%rsi),%rsp
23714 + CFI_DEF_CFA rsi,SIZEOF_PTREGS /* reg/off reset after def_cfa_expr */
23715 + movq %rsi, %rsp
23716 CFI_DEF_CFA_REGISTER rsp
23717 - CFI_ADJUST_CFA_OFFSET RBP
23718 + CFI_ADJUST_CFA_OFFSET 0
23719
23720 - testl $3,CS(%rsp)
23721 + testb $3,CS(%rsp)
23722 je retint_kernel
23723 /* Interrupt came from user space */
23724
23725 @@ -763,6 +1185,8 @@ retint_swapgs: /* return to user-space */
23726 * The iretq could re-enable interrupts:
23727 */
23728 DISABLE_INTERRUPTS(CLBR_ANY)
23729 + pax_exit_kernel_user
23730 +# pax_erase_kstack
23731 TRACE_IRQS_IRETQ
23732
23733 SWAPGS
23734 @@ -781,6 +1205,21 @@ retint_kernel:
23735 jmp 0b
23736 1:
23737 #endif
23738 +
23739 + pax_exit_kernel
23740 +
23741 +#if defined(CONFIG_EFI) && defined(CONFIG_PAX_KERNEXEC)
23742 + /* This is a quirk to allow IRQs/NMIs/MCEs during early EFI setup,
23743 + * namely calling EFI runtime services with a phys mapping. We're
23744 + * starting off with NOPs and patch in the real instrumentation
23745 + * (BTS/OR) before starting any userland process; even before starting
23746 + * up the APs.
23747 + */
23748 + ALTERNATIVE "", "pax_force_retaddr 16*8", X86_FEATURE_ALWAYS
23749 +#else
23750 + pax_force_retaddr RIP
23751 +#endif
23752 +
23753 /*
23754 * The iretq could re-enable interrupts:
23755 */
23756 @@ -793,8 +1232,6 @@ retint_kernel:
23757 restore_c_regs_and_iret:
23758 RESTORE_C_REGS
23759 REMOVE_PT_GPREGS_FROM_STACK 8
23760 -
23761 -irq_return:
23762 INTERRUPT_RETURN
23763
23764 ENTRY(native_iret)
23765 @@ -824,15 +1261,15 @@ native_irq_return_ldt:
23766 SWAPGS
23767 movq PER_CPU_VAR(espfix_waddr),%rdi
23768 movq %rax,(0*8)(%rdi) /* RAX */
23769 - movq (2*8)(%rsp),%rax /* RIP */
23770 + movq (2*8 + RIP-RIP)(%rsp),%rax /* RIP */
23771 movq %rax,(1*8)(%rdi)
23772 - movq (3*8)(%rsp),%rax /* CS */
23773 + movq (2*8 + CS-RIP)(%rsp),%rax /* CS */
23774 movq %rax,(2*8)(%rdi)
23775 - movq (4*8)(%rsp),%rax /* RFLAGS */
23776 + movq (2*8 + EFLAGS-RIP)(%rsp),%rax /* RFLAGS */
23777 movq %rax,(3*8)(%rdi)
23778 - movq (6*8)(%rsp),%rax /* SS */
23779 + movq (2*8 + SS-RIP)(%rsp),%rax /* SS */
23780 movq %rax,(5*8)(%rdi)
23781 - movq (5*8)(%rsp),%rax /* RSP */
23782 + movq (2*8 + RSP-RIP)(%rsp),%rax /* RSP */
23783 movq %rax,(4*8)(%rdi)
23784 andl $0xffff0000,%eax
23785 popq_cfi %rdi
23786 @@ -875,7 +1312,7 @@ retint_signal:
23787 jmp retint_with_reschedule
23788
23789 CFI_ENDPROC
23790 -END(common_interrupt)
23791 +ENDPROC(common_interrupt)
23792
23793 /*
23794 * APIC interrupts.
23795 @@ -889,7 +1326,7 @@ ENTRY(\sym)
23796 interrupt \do_sym
23797 jmp ret_from_intr
23798 CFI_ENDPROC
23799 -END(\sym)
23800 +ENDPROC(\sym)
23801 .endm
23802
23803 #ifdef CONFIG_TRACING
23804 @@ -962,7 +1399,7 @@ apicinterrupt IRQ_WORK_VECTOR \
23805 /*
23806 * Exception entry points.
23807 */
23808 -#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss) + (TSS_ist + ((x) - 1) * 8)
23809 +#define CPU_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r13)
23810
23811 .macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
23812 ENTRY(\sym)
23813 @@ -1018,6 +1455,12 @@ ENTRY(\sym)
23814 .endif
23815
23816 .if \shift_ist != -1
23817 +#ifdef CONFIG_SMP
23818 + imul $TSS_size, PER_CPU_VAR(cpu_number), %r13d
23819 + lea cpu_tss(%r13), %r13
23820 +#else
23821 + lea cpu_tss(%rip), %r13
23822 +#endif
23823 subq $EXCEPTION_STKSZ, CPU_TSS_IST(\shift_ist)
23824 .endif
23825
23826 @@ -1065,7 +1508,7 @@ ENTRY(\sym)
23827 .endif
23828
23829 CFI_ENDPROC
23830 -END(\sym)
23831 +ENDPROC(\sym)
23832 .endm
23833
23834 #ifdef CONFIG_TRACING
23835 @@ -1106,9 +1549,10 @@ gs_change:
23836 2: mfence /* workaround */
23837 SWAPGS
23838 popfq_cfi
23839 + pax_force_retaddr
23840 ret
23841 CFI_ENDPROC
23842 -END(native_load_gs_index)
23843 +ENDPROC(native_load_gs_index)
23844
23845 _ASM_EXTABLE(gs_change,bad_gs)
23846 .section .fixup,"ax"
23847 @@ -1136,9 +1580,10 @@ ENTRY(do_softirq_own_stack)
23848 CFI_DEF_CFA_REGISTER rsp
23849 CFI_ADJUST_CFA_OFFSET -8
23850 decl PER_CPU_VAR(irq_count)
23851 + pax_force_retaddr
23852 ret
23853 CFI_ENDPROC
23854 -END(do_softirq_own_stack)
23855 +ENDPROC(do_softirq_own_stack)
23856
23857 #ifdef CONFIG_XEN
23858 idtentry xen_hypervisor_callback xen_do_hypervisor_callback has_error_code=0
23859 @@ -1179,7 +1624,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
23860 #endif
23861 jmp error_exit
23862 CFI_ENDPROC
23863 -END(xen_do_hypervisor_callback)
23864 +ENDPROC(xen_do_hypervisor_callback)
23865
23866 /*
23867 * Hypervisor uses this for application faults while it executes.
23868 @@ -1240,7 +1685,7 @@ ENTRY(xen_failsafe_callback)
23869 SAVE_EXTRA_REGS
23870 jmp error_exit
23871 CFI_ENDPROC
23872 -END(xen_failsafe_callback)
23873 +ENDPROC(xen_failsafe_callback)
23874
23875 apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
23876 xen_hvm_callback_vector xen_evtchn_do_upcall
23877 @@ -1286,9 +1731,39 @@ ENTRY(paranoid_entry)
23878 js 1f /* negative -> in kernel */
23879 SWAPGS
23880 xorl %ebx,%ebx
23881 -1: ret
23882 +1:
23883 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23884 + testb $3, CS+8(%rsp)
23885 + jnz 1f
23886 + pax_enter_kernel
23887 + jmp 2f
23888 +1: pax_enter_kernel_user
23889 +2:
23890 +#else
23891 + pax_enter_kernel
23892 +#endif
23893 + pax_force_retaddr
23894 + ret
23895 CFI_ENDPROC
23896 -END(paranoid_entry)
23897 +ENDPROC(paranoid_entry)
23898 +
23899 +ENTRY(paranoid_entry_nmi)
23900 + XCPT_FRAME 1 15*8
23901 + cld
23902 + SAVE_C_REGS 8
23903 + SAVE_EXTRA_REGS 8
23904 + movl $1,%ebx
23905 + movl $MSR_GS_BASE,%ecx
23906 + rdmsr
23907 + testl %edx,%edx
23908 + js 1f /* negative -> in kernel */
23909 + SWAPGS
23910 + xorl %ebx,%ebx
23911 +1: pax_enter_kernel_nmi
23912 + pax_force_retaddr
23913 + ret
23914 + CFI_ENDPROC
23915 +ENDPROC(paranoid_entry_nmi)
23916
23917 /*
23918 * "Paranoid" exit path from exception stack. This is invoked
23919 @@ -1305,20 +1780,27 @@ ENTRY(paranoid_exit)
23920 DEFAULT_FRAME
23921 DISABLE_INTERRUPTS(CLBR_NONE)
23922 TRACE_IRQS_OFF_DEBUG
23923 - testl %ebx,%ebx /* swapgs needed? */
23924 + testl $1,%ebx /* swapgs needed? */
23925 jnz paranoid_exit_no_swapgs
23926 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23927 + pax_exit_kernel_user
23928 +#else
23929 + pax_exit_kernel
23930 +#endif
23931 TRACE_IRQS_IRETQ
23932 SWAPGS_UNSAFE_STACK
23933 jmp paranoid_exit_restore
23934 paranoid_exit_no_swapgs:
23935 + pax_exit_kernel
23936 TRACE_IRQS_IRETQ_DEBUG
23937 paranoid_exit_restore:
23938 RESTORE_EXTRA_REGS
23939 RESTORE_C_REGS
23940 REMOVE_PT_GPREGS_FROM_STACK 8
23941 + pax_force_retaddr_bts
23942 INTERRUPT_RETURN
23943 CFI_ENDPROC
23944 -END(paranoid_exit)
23945 +ENDPROC(paranoid_exit)
23946
23947 /*
23948 * Save all registers in pt_regs, and switch gs if needed.
23949 @@ -1330,12 +1812,23 @@ ENTRY(error_entry)
23950 SAVE_C_REGS 8
23951 SAVE_EXTRA_REGS 8
23952 xorl %ebx,%ebx
23953 - testl $3,CS+8(%rsp)
23954 + testb $3,CS+8(%rsp)
23955 je error_kernelspace
23956 error_swapgs:
23957 SWAPGS
23958 error_sti:
23959 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23960 + testb $3, CS+8(%rsp)
23961 + jnz 1f
23962 + pax_enter_kernel
23963 + jmp 2f
23964 +1: pax_enter_kernel_user
23965 +2:
23966 +#else
23967 + pax_enter_kernel
23968 +#endif
23969 TRACE_IRQS_OFF
23970 + pax_force_retaddr
23971 ret
23972
23973 /*
23974 @@ -1370,7 +1863,7 @@ error_bad_iret:
23975 decl %ebx /* Return to usergs */
23976 jmp error_sti
23977 CFI_ENDPROC
23978 -END(error_entry)
23979 +ENDPROC(error_entry)
23980
23981
23982 /* On entry, ebx is "no swapgs" flag (1: don't need swapgs, 0: need it) */
23983 @@ -1381,7 +1874,7 @@ ENTRY(error_exit)
23984 DISABLE_INTERRUPTS(CLBR_NONE)
23985 TRACE_IRQS_OFF
23986 GET_THREAD_INFO(%rcx)
23987 - testl %eax,%eax
23988 + testl $1,%eax
23989 jne retint_kernel
23990 LOCKDEP_SYS_EXIT_IRQ
23991 movl TI_flags(%rcx),%edx
23992 @@ -1390,7 +1883,7 @@ ENTRY(error_exit)
23993 jnz retint_careful
23994 jmp retint_swapgs
23995 CFI_ENDPROC
23996 -END(error_exit)
23997 +ENDPROC(error_exit)
23998
23999 /* Runs on exception stack */
24000 ENTRY(nmi)
24001 @@ -1413,11 +1906,12 @@ ENTRY(nmi)
24002 * If the variable is not set and the stack is not the NMI
24003 * stack then:
24004 * o Set the special variable on the stack
24005 - * o Copy the interrupt frame into a "saved" location on the stack
24006 - * o Copy the interrupt frame into a "copy" location on the stack
24007 + * o Copy the interrupt frame into an "outermost" location on the
24008 + * stack
24009 + * o Copy the interrupt frame into an "iret" location on the stack
24010 * o Continue processing the NMI
24011 * If the variable is set or the previous stack is the NMI stack:
24012 - * o Modify the "copy" location to jump to the repeate_nmi
24013 + * o Modify the "iret" location to jump to the repeat_nmi
24014 * o return back to the first NMI
24015 *
24016 * Now on exit of the first NMI, we first clear the stack variable
24017 @@ -1426,32 +1920,177 @@ ENTRY(nmi)
24018 * a nested NMI that updated the copy interrupt stack frame, a
24019 * jump will be made to the repeat_nmi code that will handle the second
24020 * NMI.
24021 + *
24022 + * However, espfix prevents us from directly returning to userspace
24023 + * with a single IRET instruction. Similarly, IRET to user mode
24024 + * can fault. We therefore handle NMIs from user space like
24025 + * other IST entries.
24026 */
24027
24028 /* Use %rdx as our temp variable throughout */
24029 pushq_cfi %rdx
24030 CFI_REL_OFFSET rdx, 0
24031
24032 + testb $3, CS-RIP+8(%rsp)
24033 + jz .Lnmi_from_kernel
24034 +
24035 + /*
24036 + * NMI from user mode. We need to run on the thread stack, but we
24037 + * can't go through the normal entry paths: NMIs are masked, and
24038 + * we don't want to enable interrupts, because then we'll end
24039 + * up in an awkward situation in which IRQs are on but NMIs
24040 + * are off.
24041 + */
24042 +
24043 + SWAPGS
24044 + cld
24045 + movq %rsp, %rdx
24046 + movq PER_CPU_VAR(kernel_stack), %rsp
24047 + pushq 5*8(%rdx) /* pt_regs->ss */
24048 + pushq 4*8(%rdx) /* pt_regs->rsp */
24049 + pushq 3*8(%rdx) /* pt_regs->flags */
24050 + pushq 2*8(%rdx) /* pt_regs->cs */
24051 + pushq 1*8(%rdx) /* pt_regs->rip */
24052 + pushq $-1 /* pt_regs->orig_ax */
24053 + pushq %rdi /* pt_regs->di */
24054 + pushq %rsi /* pt_regs->si */
24055 + pushq (%rdx) /* pt_regs->dx */
24056 + pushq %rcx /* pt_regs->cx */
24057 + pushq %rax /* pt_regs->ax */
24058 + pushq %r8 /* pt_regs->r8 */
24059 + pushq %r9 /* pt_regs->r9 */
24060 + pushq %r10 /* pt_regs->r10 */
24061 + pushq %r11 /* pt_regs->r11 */
24062 + pushq %rbx /* pt_regs->rbx */
24063 + pushq %rbp /* pt_regs->rbp */
24064 + pushq %r12 /* pt_regs->r12 */
24065 + pushq %r13 /* pt_regs->r13 */
24066 + pushq %r14 /* pt_regs->r14 */
24067 + pushq %r15 /* pt_regs->r15 */
24068 +
24069 + pax_enter_kernel_nmi
24070 +
24071 /*
24072 - * If %cs was not the kernel segment, then the NMI triggered in user
24073 - * space, which means it is definitely not nested.
24074 + * At this point we no longer need to worry about stack damage
24075 + * due to nesting -- we're on the normal thread stack and we're
24076 + * done with the NMI stack.
24077 */
24078 - cmpl $__KERNEL_CS, 16(%rsp)
24079 - jne first_nmi
24080 +
24081 + movq %rsp, %rdi
24082 + movq $-1, %rsi
24083 + call do_nmi
24084 +
24085 + pax_exit_kernel_nmi
24086 +
24087 + /*
24088 + * Return back to user mode. We must *not* do the normal exit
24089 + * work, because we don't want to enable interrupts. Fortunately,
24090 + * do_nmi doesn't modify pt_regs.
24091 + */
24092 + SWAPGS
24093 +
24094 + /*
24095 + * Open-code the entire return process for compatibility with varying
24096 + * register layouts across different kernel versions.
24097 + */
24098 +
24099 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
24100 + movq R12(%rsp), %r12
24101 +#endif
24102 +
24103 + addq $6*8, %rsp /* skip bx, bp, and r12-r15 */
24104 + popq %r11 /* pt_regs->r11 */
24105 + popq %r10 /* pt_regs->r10 */
24106 + popq %r9 /* pt_regs->r9 */
24107 + popq %r8 /* pt_regs->r8 */
24108 + popq %rax /* pt_regs->ax */
24109 + popq %rcx /* pt_regs->cx */
24110 + popq %rdx /* pt_regs->dx */
24111 + popq %rsi /* pt_regs->si */
24112 + popq %rdi /* pt_regs->di */
24113 + addq $8, %rsp /* skip orig_ax */
24114 + INTERRUPT_RETURN
24115 +
24116 +.Lnmi_from_kernel:
24117 + /*
24118 + * Here's what our stack frame will look like:
24119 + * +---------------------------------------------------------+
24120 + * | original SS |
24121 + * | original Return RSP |
24122 + * | original RFLAGS |
24123 + * | original CS |
24124 + * | original RIP |
24125 + * +---------------------------------------------------------+
24126 + * | temp storage for rdx |
24127 + * +---------------------------------------------------------+
24128 + * | "NMI executing" variable |
24129 + * +---------------------------------------------------------+
24130 + * | iret SS } Copied from "outermost" frame |
24131 + * | iret Return RSP } on each loop iteration; overwritten |
24132 + * | iret RFLAGS } by a nested NMI to force another |
24133 + * | iret CS } iteration if needed. |
24134 + * | iret RIP } |
24135 + * +---------------------------------------------------------+
24136 + * | outermost SS } initialized in first_nmi; |
24137 + * | outermost Return RSP } will not be changed before |
24138 + * | outermost RFLAGS } NMI processing is done. |
24139 + * | outermost CS } Copied to "iret" frame on each |
24140 + * | outermost RIP } iteration. |
24141 + * +---------------------------------------------------------+
24142 + * | pt_regs |
24143 + * +---------------------------------------------------------+
24144 + *
24145 + * The "original" frame is used by hardware. Before re-enabling
24146 + * NMIs, we need to be done with it, and we need to leave enough
24147 + * space for the asm code here.
24148 + *
24149 + * We return by executing IRET while RSP points to the "iret" frame.
24150 + * That will either return for real or it will loop back into NMI
24151 + * processing.
24152 + *
24153 + * The "outermost" frame is copied to the "iret" frame on each
24154 + * iteration of the loop, so each iteration starts with the "iret"
24155 + * frame pointing to the final return target.
24156 + */
24157 +
24158 + /*
24159 + * If we interrupted kernel code between repeat_nmi and
24160 + * end_repeat_nmi, then we are a nested NMI. We must not
24161 + * modify the "iret" frame because it's being written by
24162 + * the outer NMI. That's okay: the outer NMI handler is
24163 + * about to about to call do_nmi anyway, so we can just
24164 + * resume the outer NMI.
24165 + */
24166 +
24167 + movq $repeat_nmi, %rdx
24168 + cmpq 8(%rsp), %rdx
24169 + ja 1f
24170 + movq $end_repeat_nmi, %rdx
24171 + cmpq 8(%rsp), %rdx
24172 + ja nested_nmi_out
24173 +1:
24174
24175 /*
24176 - * Check the special variable on the stack to see if NMIs are
24177 - * executing.
24178 + * Now check "NMI executing". If it's set, then we're nested.
24179 + *
24180 + * First check "NMI executing". If it's set, then we're nested.
24181 + * This will not detect if we interrupted an outer NMI just
24182 + * before IRET.
24183 */
24184 cmpl $1, -8(%rsp)
24185 je nested_nmi
24186
24187 /*
24188 - * Now test if the previous stack was an NMI stack.
24189 - * We need the double check. We check the NMI stack to satisfy the
24190 - * race when the first NMI clears the variable before returning.
24191 - * We check the variable because the first NMI could be in a
24192 - * breakpoint routine using a breakpoint stack.
24193 + * Now test if the previous stack was an NMI stack. This covers
24194 + * the case where we interrupt an outer NMI after it clears
24195 + * "NMI executing" but before IRET. We need to be careful, though:
24196 + * there is one case in which RSP could point to the NMI stack
24197 + * despite there being no NMI active: naughty userspace controls
24198 + * RSP at the very beginning of the SYSCALL targets. We can
24199 + * pull a fast one on naughty userspace, though: we program
24200 + * SYSCALL to mask DF, so userspace cannot cause DF to be set
24201 + * if it controls the kernel's RSP. We set DF before we clear
24202 + * "NMI executing".
24203 */
24204 lea 6*8(%rsp), %rdx
24205 /* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */
24206 @@ -1462,27 +2101,22 @@ ENTRY(nmi)
24207 cmpq %rdx, 4*8(%rsp)
24208 /* If it is below the NMI stack, it is a normal NMI */
24209 jb first_nmi
24210 - /* Ah, it is within the NMI stack, treat it as nested */
24211 +
24212 + /* Ah, it is within the NMI stack. */
24213 +
24214 + testb $(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp)
24215 + jz first_nmi /* RSP was user controlled. */
24216
24217 CFI_REMEMBER_STATE
24218
24219 + /* This is a nested NMI. */
24220 +
24221 nested_nmi:
24222 /*
24223 - * Do nothing if we interrupted the fixup in repeat_nmi.
24224 - * It's about to repeat the NMI handler, so we are fine
24225 - * with ignoring this one.
24226 + * Modify the "iret" frame to point to repeat_nmi, forcing another
24227 + * iteration of NMI handling.
24228 */
24229 - movq $repeat_nmi, %rdx
24230 - cmpq 8(%rsp), %rdx
24231 - ja 1f
24232 - movq $end_repeat_nmi, %rdx
24233 - cmpq 8(%rsp), %rdx
24234 - ja nested_nmi_out
24235 -
24236 -1:
24237 - /* Set up the interrupted NMIs stack to jump to repeat_nmi */
24238 - leaq -1*8(%rsp), %rdx
24239 - movq %rdx, %rsp
24240 + subq $8, %rsp
24241 CFI_ADJUST_CFA_OFFSET 1*8
24242 leaq -10*8(%rsp), %rdx
24243 pushq_cfi $__KERNEL_DS
24244 @@ -1499,60 +2133,24 @@ nested_nmi_out:
24245 popq_cfi %rdx
24246 CFI_RESTORE rdx
24247
24248 - /* No need to check faults here */
24249 + /* We are returning to kernel mode, so this cannot result in a fault. */
24250 +# pax_force_retaddr_bts
24251 INTERRUPT_RETURN
24252
24253 CFI_RESTORE_STATE
24254 first_nmi:
24255 - /*
24256 - * Because nested NMIs will use the pushed location that we
24257 - * stored in rdx, we must keep that space available.
24258 - * Here's what our stack frame will look like:
24259 - * +-------------------------+
24260 - * | original SS |
24261 - * | original Return RSP |
24262 - * | original RFLAGS |
24263 - * | original CS |
24264 - * | original RIP |
24265 - * +-------------------------+
24266 - * | temp storage for rdx |
24267 - * +-------------------------+
24268 - * | NMI executing variable |
24269 - * +-------------------------+
24270 - * | copied SS |
24271 - * | copied Return RSP |
24272 - * | copied RFLAGS |
24273 - * | copied CS |
24274 - * | copied RIP |
24275 - * +-------------------------+
24276 - * | Saved SS |
24277 - * | Saved Return RSP |
24278 - * | Saved RFLAGS |
24279 - * | Saved CS |
24280 - * | Saved RIP |
24281 - * +-------------------------+
24282 - * | pt_regs |
24283 - * +-------------------------+
24284 - *
24285 - * The saved stack frame is used to fix up the copied stack frame
24286 - * that a nested NMI may change to make the interrupted NMI iret jump
24287 - * to the repeat_nmi. The original stack frame and the temp storage
24288 - * is also used by nested NMIs and can not be trusted on exit.
24289 - */
24290 - /* Do not pop rdx, nested NMIs will corrupt that part of the stack */
24291 + /* Restore rdx. */
24292 movq (%rsp), %rdx
24293 CFI_RESTORE rdx
24294
24295 /* Set the NMI executing variable on the stack. */
24296 pushq_cfi $1
24297
24298 - /*
24299 - * Leave room for the "copied" frame
24300 - */
24301 + /* Leave room for the "iret" frame */
24302 subq $(5*8), %rsp
24303 CFI_ADJUST_CFA_OFFSET 5*8
24304
24305 - /* Copy the stack frame to the Saved frame */
24306 + /* Copy the "original" frame to the "outermost" frame */
24307 .rept 5
24308 pushq_cfi 11*8(%rsp)
24309 .endr
24310 @@ -1560,6 +2158,7 @@ first_nmi:
24311
24312 /* Everything up to here is safe from nested NMIs */
24313
24314 +repeat_nmi:
24315 /*
24316 * If there was a nested NMI, the first NMI's iret will return
24317 * here. But NMIs are still enabled and we can take another
24318 @@ -1568,16 +2167,21 @@ first_nmi:
24319 * it will just return, as we are about to repeat an NMI anyway.
24320 * This makes it safe to copy to the stack frame that a nested
24321 * NMI will update.
24322 - */
24323 -repeat_nmi:
24324 - /*
24325 - * Update the stack variable to say we are still in NMI (the update
24326 - * is benign for the non-repeat case, where 1 was pushed just above
24327 - * to this very stack slot).
24328 + *
24329 + * RSP is pointing to "outermost RIP". gsbase is unknown, but, if
24330 + * we're repeating an NMI, gsbase has the same value that it had on
24331 + * the first iteration. paranoid_entry will load the kernel
24332 + * gsbase if needed before we call do_nmi.
24333 + *
24334 + * Set "NMI executing" in case we came back here via IRET.
24335 */
24336 movq $1, 10*8(%rsp)
24337
24338 - /* Make another copy, this one may be modified by nested NMIs */
24339 + /*
24340 + * Copy the "outermost" frame to the "iret" frame. NMIs that nest
24341 + * here must not modify the "iret" frame while we're writing to
24342 + * it or it will end up containing garbage.
24343 + */
24344 addq $(10*8), %rsp
24345 CFI_ADJUST_CFA_OFFSET -10*8
24346 .rept 5
24347 @@ -1588,66 +2192,65 @@ repeat_nmi:
24348 end_repeat_nmi:
24349
24350 /*
24351 - * Everything below this point can be preempted by a nested
24352 - * NMI if the first NMI took an exception and reset our iret stack
24353 - * so that we repeat another NMI.
24354 + * Everything below this point can be preempted by a nested NMI.
24355 + * If this happens, then the inner NMI will change the "iret"
24356 + * frame to point back to repeat_nmi.
24357 */
24358 pushq_cfi $-1 /* ORIG_RAX: no syscall to restart */
24359 ALLOC_PT_GPREGS_ON_STACK
24360
24361 /*
24362 - * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
24363 + * Use paranoid_entry_nmi to handle SWAPGS, but no need to use paranoid_exit
24364 * as we should not be calling schedule in NMI context.
24365 * Even with normal interrupts enabled. An NMI should not be
24366 * setting NEED_RESCHED or anything that normal interrupts and
24367 * exceptions might do.
24368 */
24369 - call paranoid_entry
24370 + call paranoid_entry_nmi
24371 DEFAULT_FRAME 0
24372
24373 - /*
24374 - * Save off the CR2 register. If we take a page fault in the NMI then
24375 - * it could corrupt the CR2 value. If the NMI preempts a page fault
24376 - * handler before it was able to read the CR2 register, and then the
24377 - * NMI itself takes a page fault, the page fault that was preempted
24378 - * will read the information from the NMI page fault and not the
24379 - * origin fault. Save it off and restore it if it changes.
24380 - * Use the r12 callee-saved register.
24381 - */
24382 - movq %cr2, %r12
24383 -
24384 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
24385 movq %rsp,%rdi
24386 movq $-1,%rsi
24387 call do_nmi
24388
24389 - /* Did the NMI take a page fault? Restore cr2 if it did */
24390 - movq %cr2, %rcx
24391 - cmpq %rcx, %r12
24392 - je 1f
24393 - movq %r12, %cr2
24394 -1:
24395 -
24396 - testl %ebx,%ebx /* swapgs needed? */
24397 + testl $1,%ebx /* swapgs needed? */
24398 jnz nmi_restore
24399 nmi_swapgs:
24400 SWAPGS_UNSAFE_STACK
24401 nmi_restore:
24402 + pax_exit_kernel_nmi
24403 RESTORE_EXTRA_REGS
24404 RESTORE_C_REGS
24405 - /* Pop the extra iret frame at once */
24406 +
24407 REMOVE_PT_GPREGS_FROM_STACK 6*8
24408
24409 - /* Clear the NMI executing stack variable */
24410 - movq $0, 5*8(%rsp)
24411 - jmp irq_return
24412 + pax_force_retaddr_bts
24413 +
24414 + /*
24415 + * Clear "NMI executing". Set DF first so that we can easily
24416 + * distinguish the remaining code between here and IRET from
24417 + * the SYSCALL entry and exit paths. On a native kernel, we
24418 + * could just inspect RIP, but, on paravirt kernels,
24419 + * INTERRUPT_RETURN can translate into a jump into a
24420 + * hypercall page.
24421 + */
24422 + std
24423 + movq $0, 5*8(%rsp) /* clear "NMI executing" */
24424 +
24425 + /*
24426 + * INTERRUPT_RETURN reads the "iret" frame and exits the NMI
24427 + * stack in a single instruction. We are returning to kernel
24428 + * mode, so this cannot result in a fault.
24429 + */
24430 + INTERRUPT_RETURN
24431 CFI_ENDPROC
24432 -END(nmi)
24433 +ENDPROC(nmi)
24434
24435 ENTRY(ignore_sysret)
24436 CFI_STARTPROC
24437 mov $-ENOSYS,%eax
24438 sysret
24439 CFI_ENDPROC
24440 -END(ignore_sysret)
24441 +ENDPROC(ignore_sysret)
24442
24443 diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
24444 index f5d0730..5bce89c 100644
24445 --- a/arch/x86/kernel/espfix_64.c
24446 +++ b/arch/x86/kernel/espfix_64.c
24447 @@ -70,8 +70,7 @@ static DEFINE_MUTEX(espfix_init_mutex);
24448 #define ESPFIX_MAX_PAGES DIV_ROUND_UP(CONFIG_NR_CPUS, ESPFIX_STACKS_PER_PAGE)
24449 static void *espfix_pages[ESPFIX_MAX_PAGES];
24450
24451 -static __page_aligned_bss pud_t espfix_pud_page[PTRS_PER_PUD]
24452 - __aligned(PAGE_SIZE);
24453 +static pud_t espfix_pud_page[PTRS_PER_PUD] __page_aligned_rodata;
24454
24455 static unsigned int page_random, slot_random;
24456
24457 @@ -122,11 +121,17 @@ static void init_espfix_random(void)
24458 void __init init_espfix_bsp(void)
24459 {
24460 pgd_t *pgd_p;
24461 + unsigned long index = pgd_index(ESPFIX_BASE_ADDR);
24462
24463 /* Install the espfix pud into the kernel page directory */
24464 - pgd_p = &init_level4_pgt[pgd_index(ESPFIX_BASE_ADDR)];
24465 + pgd_p = &init_level4_pgt[index];
24466 pgd_populate(&init_mm, pgd_p, (pud_t *)espfix_pud_page);
24467
24468 +#ifdef CONFIG_PAX_PER_CPU_PGD
24469 + clone_pgd_range(get_cpu_pgd(0, kernel) + index, swapper_pg_dir + index, 1);
24470 + clone_pgd_range(get_cpu_pgd(0, user) + index, swapper_pg_dir + index, 1);
24471 +#endif
24472 +
24473 /* Randomize the locations */
24474 init_espfix_random();
24475
24476 @@ -194,7 +199,7 @@ void init_espfix_ap(void)
24477 set_pte(&pte_p[n*PTE_STRIDE], pte);
24478
24479 /* Job is done for this CPU and any CPU which shares this page */
24480 - ACCESS_ONCE(espfix_pages[page]) = stack_page;
24481 + ACCESS_ONCE_RW(espfix_pages[page]) = stack_page;
24482
24483 unlock_done:
24484 mutex_unlock(&espfix_init_mutex);
24485 diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
24486 index 8b7b0a5..02219db 100644
24487 --- a/arch/x86/kernel/ftrace.c
24488 +++ b/arch/x86/kernel/ftrace.c
24489 @@ -89,7 +89,7 @@ static unsigned long text_ip_addr(unsigned long ip)
24490 * kernel identity mapping to modify code.
24491 */
24492 if (within(ip, (unsigned long)_text, (unsigned long)_etext))
24493 - ip = (unsigned long)__va(__pa_symbol(ip));
24494 + ip = (unsigned long)__va(__pa_symbol(ktla_ktva(ip)));
24495
24496 return ip;
24497 }
24498 @@ -105,6 +105,8 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code,
24499 {
24500 unsigned char replaced[MCOUNT_INSN_SIZE];
24501
24502 + ip = ktla_ktva(ip);
24503 +
24504 /*
24505 * Note: Due to modules and __init, code can
24506 * disappear and change, we need to protect against faulting
24507 @@ -230,7 +232,7 @@ static int update_ftrace_func(unsigned long ip, void *new)
24508 unsigned char old[MCOUNT_INSN_SIZE];
24509 int ret;
24510
24511 - memcpy(old, (void *)ip, MCOUNT_INSN_SIZE);
24512 + memcpy(old, (void *)ktla_ktva(ip), MCOUNT_INSN_SIZE);
24513
24514 ftrace_update_func = ip;
24515 /* Make sure the breakpoints see the ftrace_update_func update */
24516 @@ -311,7 +313,7 @@ static int add_break(unsigned long ip, const char *old)
24517 unsigned char replaced[MCOUNT_INSN_SIZE];
24518 unsigned char brk = BREAKPOINT_INSTRUCTION;
24519
24520 - if (probe_kernel_read(replaced, (void *)ip, MCOUNT_INSN_SIZE))
24521 + if (probe_kernel_read(replaced, (void *)ktla_ktva(ip), MCOUNT_INSN_SIZE))
24522 return -EFAULT;
24523
24524 /* Make sure it is what we expect it to be */
24525 @@ -670,11 +672,11 @@ static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr)
24526 /* Module allocation simplifies allocating memory for code */
24527 static inline void *alloc_tramp(unsigned long size)
24528 {
24529 - return module_alloc(size);
24530 + return module_alloc_exec(size);
24531 }
24532 static inline void tramp_free(void *tramp)
24533 {
24534 - module_memfree(tramp);
24535 + module_memfree_exec(tramp);
24536 }
24537 #else
24538 /* Trampolines can only be created if modules are supported */
24539 @@ -753,7 +755,9 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
24540 *tramp_size = size + MCOUNT_INSN_SIZE + sizeof(void *);
24541
24542 /* Copy ftrace_caller onto the trampoline memory */
24543 + pax_open_kernel();
24544 ret = probe_kernel_read(trampoline, (void *)start_offset, size);
24545 + pax_close_kernel();
24546 if (WARN_ON(ret < 0)) {
24547 tramp_free(trampoline);
24548 return 0;
24549 @@ -763,6 +767,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
24550
24551 /* The trampoline ends with a jmp to ftrace_return */
24552 jmp = ftrace_jmp_replace(ip, (unsigned long)ftrace_return);
24553 + pax_open_kernel();
24554 memcpy(trampoline + size, jmp, MCOUNT_INSN_SIZE);
24555
24556 /*
24557 @@ -775,6 +780,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
24558
24559 ptr = (unsigned long *)(trampoline + size + MCOUNT_INSN_SIZE);
24560 *ptr = (unsigned long)ops;
24561 + pax_close_kernel();
24562
24563 op_offset -= start_offset;
24564 memcpy(&op_ptr, trampoline + op_offset, OP_REF_SIZE);
24565 @@ -792,7 +798,9 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
24566 op_ptr.offset = offset;
24567
24568 /* put in the new offset to the ftrace_ops */
24569 + pax_open_kernel();
24570 memcpy(trampoline + op_offset, &op_ptr, OP_REF_SIZE);
24571 + pax_close_kernel();
24572
24573 /* ALLOC_TRAMP flags lets us know we created it */
24574 ops->flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
24575 diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
24576 index 5a46681..1ef7ffa 100644
24577 --- a/arch/x86/kernel/head64.c
24578 +++ b/arch/x86/kernel/head64.c
24579 @@ -68,12 +68,12 @@ again:
24580 pgd = *pgd_p;
24581
24582 /*
24583 - * The use of __START_KERNEL_map rather than __PAGE_OFFSET here is
24584 - * critical -- __PAGE_OFFSET would point us back into the dynamic
24585 + * The use of __early_va rather than __va here is critical:
24586 + * __va would point us back into the dynamic
24587 * range and we might end up looping forever...
24588 */
24589 if (pgd)
24590 - pud_p = (pudval_t *)((pgd & PTE_PFN_MASK) + __START_KERNEL_map - phys_base);
24591 + pud_p = (pudval_t *)(__early_va(pgd & PTE_PFN_MASK));
24592 else {
24593 if (next_early_pgt >= EARLY_DYNAMIC_PAGE_TABLES) {
24594 reset_early_page_tables();
24595 @@ -83,13 +83,13 @@ again:
24596 pud_p = (pudval_t *)early_dynamic_pgts[next_early_pgt++];
24597 for (i = 0; i < PTRS_PER_PUD; i++)
24598 pud_p[i] = 0;
24599 - *pgd_p = (pgdval_t)pud_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
24600 + *pgd_p = (pgdval_t)__pa(pud_p) + _KERNPG_TABLE;
24601 }
24602 pud_p += pud_index(address);
24603 pud = *pud_p;
24604
24605 if (pud)
24606 - pmd_p = (pmdval_t *)((pud & PTE_PFN_MASK) + __START_KERNEL_map - phys_base);
24607 + pmd_p = (pmdval_t *)(__early_va(pud & PTE_PFN_MASK));
24608 else {
24609 if (next_early_pgt >= EARLY_DYNAMIC_PAGE_TABLES) {
24610 reset_early_page_tables();
24611 @@ -99,7 +99,7 @@ again:
24612 pmd_p = (pmdval_t *)early_dynamic_pgts[next_early_pgt++];
24613 for (i = 0; i < PTRS_PER_PMD; i++)
24614 pmd_p[i] = 0;
24615 - *pud_p = (pudval_t)pmd_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
24616 + *pud_p = (pudval_t)__pa(pmd_p) + _KERNPG_TABLE;
24617 }
24618 pmd = (physaddr & PMD_MASK) + early_pmd_flags;
24619 pmd_p[pmd_index(address)] = pmd;
24620 @@ -177,7 +177,6 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
24621 */
24622 load_ucode_bsp();
24623
24624 - clear_page(init_level4_pgt);
24625 /* set init_level4_pgt kernel high mapping*/
24626 init_level4_pgt[511] = early_level4_pgt[511];
24627
24628 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
24629 index 7e429c9..7244a52 100644
24630 --- a/arch/x86/kernel/head_32.S
24631 +++ b/arch/x86/kernel/head_32.S
24632 @@ -27,6 +27,12 @@
24633 /* Physical address */
24634 #define pa(X) ((X) - __PAGE_OFFSET)
24635
24636 +#ifdef CONFIG_PAX_KERNEXEC
24637 +#define ta(X) (X)
24638 +#else
24639 +#define ta(X) ((X) - __PAGE_OFFSET)
24640 +#endif
24641 +
24642 /*
24643 * References to members of the new_cpu_data structure.
24644 */
24645 @@ -56,11 +62,7 @@
24646 * and small than max_low_pfn, otherwise will waste some page table entries
24647 */
24648
24649 -#if PTRS_PER_PMD > 1
24650 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
24651 -#else
24652 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
24653 -#endif
24654 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
24655
24656 /*
24657 * Number of possible pages in the lowmem region.
24658 @@ -86,6 +88,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE
24659 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
24660
24661 /*
24662 + * Real beginning of normal "text" segment
24663 + */
24664 +ENTRY(stext)
24665 +ENTRY(_stext)
24666 +
24667 +/*
24668 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
24669 * %esi points to the real-mode code as a 32-bit pointer.
24670 * CS and DS must be 4 GB flat segments, but we don't depend on
24671 @@ -93,6 +101,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
24672 * can.
24673 */
24674 __HEAD
24675 +
24676 +#ifdef CONFIG_PAX_KERNEXEC
24677 + jmp startup_32
24678 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
24679 +.fill PAGE_SIZE-5,1,0xcc
24680 +#endif
24681 +
24682 ENTRY(startup_32)
24683 movl pa(stack_start),%ecx
24684
24685 @@ -114,6 +129,59 @@ ENTRY(startup_32)
24686 2:
24687 leal -__PAGE_OFFSET(%ecx),%esp
24688
24689 +#ifdef CONFIG_SMP
24690 + movl $pa(cpu_gdt_table),%edi
24691 + movl $__per_cpu_load,%eax
24692 + movw %ax,GDT_ENTRY_PERCPU * 8 + 2(%edi)
24693 + rorl $16,%eax
24694 + movb %al,GDT_ENTRY_PERCPU * 8 + 4(%edi)
24695 + movb %ah,GDT_ENTRY_PERCPU * 8 + 7(%edi)
24696 + movl $__per_cpu_end - 1,%eax
24697 + subl $__per_cpu_start,%eax
24698 + movw %ax,GDT_ENTRY_PERCPU * 8 + 0(%edi)
24699 +#endif
24700 +
24701 +#ifdef CONFIG_PAX_MEMORY_UDEREF
24702 + movl $NR_CPUS,%ecx
24703 + movl $pa(cpu_gdt_table),%edi
24704 +1:
24705 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
24706 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
24707 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
24708 + addl $PAGE_SIZE_asm,%edi
24709 + loop 1b
24710 +#endif
24711 +
24712 +#ifdef CONFIG_PAX_KERNEXEC
24713 + movl $pa(boot_gdt),%edi
24714 + movl $__LOAD_PHYSICAL_ADDR,%eax
24715 + movw %ax,GDT_ENTRY_BOOT_CS * 8 + 2(%edi)
24716 + rorl $16,%eax
24717 + movb %al,GDT_ENTRY_BOOT_CS * 8 + 4(%edi)
24718 + movb %ah,GDT_ENTRY_BOOT_CS * 8 + 7(%edi)
24719 + rorl $16,%eax
24720 +
24721 + ljmp $(__BOOT_CS),$1f
24722 +1:
24723 +
24724 + movl $NR_CPUS,%ecx
24725 + movl $pa(cpu_gdt_table),%edi
24726 + addl $__PAGE_OFFSET,%eax
24727 +1:
24728 + movb $0xc0,GDT_ENTRY_KERNEL_CS * 8 + 6(%edi)
24729 + movb $0xc0,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 6(%edi)
24730 + movw %ax,GDT_ENTRY_KERNEL_CS * 8 + 2(%edi)
24731 + movw %ax,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 2(%edi)
24732 + rorl $16,%eax
24733 + movb %al,GDT_ENTRY_KERNEL_CS * 8 + 4(%edi)
24734 + movb %al,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 4(%edi)
24735 + movb %ah,GDT_ENTRY_KERNEL_CS * 8 + 7(%edi)
24736 + movb %ah,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 7(%edi)
24737 + rorl $16,%eax
24738 + addl $PAGE_SIZE_asm,%edi
24739 + loop 1b
24740 +#endif
24741 +
24742 /*
24743 * Clear BSS first so that there are no surprises...
24744 */
24745 @@ -209,8 +277,11 @@ ENTRY(startup_32)
24746 movl %eax, pa(max_pfn_mapped)
24747
24748 /* Do early initialization of the fixmap area */
24749 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
24750 - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
24751 +#ifdef CONFIG_COMPAT_VDSO
24752 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
24753 +#else
24754 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
24755 +#endif
24756 #else /* Not PAE */
24757
24758 page_pde_offset = (__PAGE_OFFSET >> 20);
24759 @@ -240,8 +311,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
24760 movl %eax, pa(max_pfn_mapped)
24761
24762 /* Do early initialization of the fixmap area */
24763 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
24764 - movl %eax,pa(initial_page_table+0xffc)
24765 +#ifdef CONFIG_COMPAT_VDSO
24766 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
24767 +#else
24768 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
24769 +#endif
24770 #endif
24771
24772 #ifdef CONFIG_PARAVIRT
24773 @@ -255,9 +329,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
24774 cmpl $num_subarch_entries, %eax
24775 jae bad_subarch
24776
24777 - movl pa(subarch_entries)(,%eax,4), %eax
24778 - subl $__PAGE_OFFSET, %eax
24779 - jmp *%eax
24780 + jmp *pa(subarch_entries)(,%eax,4)
24781
24782 bad_subarch:
24783 WEAK(lguest_entry)
24784 @@ -269,10 +341,10 @@ WEAK(xen_entry)
24785 __INITDATA
24786
24787 subarch_entries:
24788 - .long default_entry /* normal x86/PC */
24789 - .long lguest_entry /* lguest hypervisor */
24790 - .long xen_entry /* Xen hypervisor */
24791 - .long default_entry /* Moorestown MID */
24792 + .long ta(default_entry) /* normal x86/PC */
24793 + .long ta(lguest_entry) /* lguest hypervisor */
24794 + .long ta(xen_entry) /* Xen hypervisor */
24795 + .long ta(default_entry) /* Moorestown MID */
24796 num_subarch_entries = (. - subarch_entries) / 4
24797 .previous
24798 #else
24799 @@ -362,6 +434,7 @@ default_entry:
24800 movl pa(mmu_cr4_features),%eax
24801 movl %eax,%cr4
24802
24803 +#ifdef CONFIG_X86_PAE
24804 testb $X86_CR4_PAE, %al # check if PAE is enabled
24805 jz enable_paging
24806
24807 @@ -390,6 +463,9 @@ default_entry:
24808 /* Make changes effective */
24809 wrmsr
24810
24811 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
24812 +#endif
24813 +
24814 enable_paging:
24815
24816 /*
24817 @@ -457,14 +533,20 @@ is486:
24818 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
24819 movl %eax,%ss # after changing gdt.
24820
24821 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
24822 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
24823 movl %eax,%ds
24824 movl %eax,%es
24825
24826 movl $(__KERNEL_PERCPU), %eax
24827 movl %eax,%fs # set this cpu's percpu
24828
24829 +#ifdef CONFIG_CC_STACKPROTECTOR
24830 movl $(__KERNEL_STACK_CANARY),%eax
24831 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
24832 + movl $(__USER_DS),%eax
24833 +#else
24834 + xorl %eax,%eax
24835 +#endif
24836 movl %eax,%gs
24837
24838 xorl %eax,%eax # Clear LDT
24839 @@ -521,8 +603,11 @@ setup_once:
24840 * relocation. Manually set base address in stack canary
24841 * segment descriptor.
24842 */
24843 - movl $gdt_page,%eax
24844 + movl $cpu_gdt_table,%eax
24845 movl $stack_canary,%ecx
24846 +#ifdef CONFIG_SMP
24847 + addl $__per_cpu_load,%ecx
24848 +#endif
24849 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
24850 shrl $16, %ecx
24851 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
24852 @@ -559,7 +644,7 @@ early_idt_handler_common:
24853 cmpl $2,(%esp) # X86_TRAP_NMI
24854 je is_nmi # Ignore NMI
24855
24856 - cmpl $2,%ss:early_recursion_flag
24857 + cmpl $1,%ss:early_recursion_flag
24858 je hlt_loop
24859 incl %ss:early_recursion_flag
24860
24861 @@ -597,8 +682,8 @@ early_idt_handler_common:
24862 pushl (20+6*4)(%esp) /* trapno */
24863 pushl $fault_msg
24864 call printk
24865 -#endif
24866 call dump_stack
24867 +#endif
24868 hlt_loop:
24869 hlt
24870 jmp hlt_loop
24871 @@ -618,8 +703,11 @@ ENDPROC(early_idt_handler_common)
24872 /* This is the default interrupt "handler" :-) */
24873 ALIGN
24874 ignore_int:
24875 - cld
24876 #ifdef CONFIG_PRINTK
24877 + cmpl $2,%ss:early_recursion_flag
24878 + je hlt_loop
24879 + incl %ss:early_recursion_flag
24880 + cld
24881 pushl %eax
24882 pushl %ecx
24883 pushl %edx
24884 @@ -628,9 +716,6 @@ ignore_int:
24885 movl $(__KERNEL_DS),%eax
24886 movl %eax,%ds
24887 movl %eax,%es
24888 - cmpl $2,early_recursion_flag
24889 - je hlt_loop
24890 - incl early_recursion_flag
24891 pushl 16(%esp)
24892 pushl 24(%esp)
24893 pushl 32(%esp)
24894 @@ -664,29 +749,34 @@ ENTRY(setup_once_ref)
24895 /*
24896 * BSS section
24897 */
24898 -__PAGE_ALIGNED_BSS
24899 - .align PAGE_SIZE
24900 #ifdef CONFIG_X86_PAE
24901 +.section .initial_pg_pmd,"a",@progbits
24902 initial_pg_pmd:
24903 .fill 1024*KPMDS,4,0
24904 #else
24905 +.section .initial_page_table,"a",@progbits
24906 ENTRY(initial_page_table)
24907 .fill 1024,4,0
24908 #endif
24909 +.section .initial_pg_fixmap,"a",@progbits
24910 initial_pg_fixmap:
24911 .fill 1024,4,0
24912 +.section .empty_zero_page,"a",@progbits
24913 ENTRY(empty_zero_page)
24914 .fill 4096,1,0
24915 +.section .swapper_pg_dir,"a",@progbits
24916 ENTRY(swapper_pg_dir)
24917 +#ifdef CONFIG_X86_PAE
24918 + .fill 4,8,0
24919 +#else
24920 .fill 1024,4,0
24921 +#endif
24922
24923 /*
24924 * This starts the data section.
24925 */
24926 #ifdef CONFIG_X86_PAE
24927 -__PAGE_ALIGNED_DATA
24928 - /* Page-aligned for the benefit of paravirt? */
24929 - .align PAGE_SIZE
24930 +.section .initial_page_table,"a",@progbits
24931 ENTRY(initial_page_table)
24932 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
24933 # if KPMDS == 3
24934 @@ -705,12 +795,20 @@ ENTRY(initial_page_table)
24935 # error "Kernel PMDs should be 1, 2 or 3"
24936 # endif
24937 .align PAGE_SIZE /* needs to be page-sized too */
24938 +
24939 +#ifdef CONFIG_PAX_PER_CPU_PGD
24940 +ENTRY(cpu_pgd)
24941 + .rept 2*NR_CPUS
24942 + .fill 4,8,0
24943 + .endr
24944 +#endif
24945 +
24946 #endif
24947
24948 .data
24949 .balign 4
24950 ENTRY(stack_start)
24951 - .long init_thread_union+THREAD_SIZE
24952 + .long init_thread_union+THREAD_SIZE-8
24953
24954 __INITRODATA
24955 int_msg:
24956 @@ -738,7 +836,7 @@ fault_msg:
24957 * segment size, and 32-bit linear address value:
24958 */
24959
24960 - .data
24961 +.section .rodata,"a",@progbits
24962 .globl boot_gdt_descr
24963 .globl idt_descr
24964
24965 @@ -747,7 +845,7 @@ fault_msg:
24966 .word 0 # 32 bit align gdt_desc.address
24967 boot_gdt_descr:
24968 .word __BOOT_DS+7
24969 - .long boot_gdt - __PAGE_OFFSET
24970 + .long pa(boot_gdt)
24971
24972 .word 0 # 32-bit align idt_desc.address
24973 idt_descr:
24974 @@ -758,7 +856,7 @@ idt_descr:
24975 .word 0 # 32 bit align gdt_desc.address
24976 ENTRY(early_gdt_descr)
24977 .word GDT_ENTRIES*8-1
24978 - .long gdt_page /* Overwritten for secondary CPUs */
24979 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
24980
24981 /*
24982 * The boot_gdt must mirror the equivalent in setup.S and is
24983 @@ -767,5 +865,65 @@ ENTRY(early_gdt_descr)
24984 .align L1_CACHE_BYTES
24985 ENTRY(boot_gdt)
24986 .fill GDT_ENTRY_BOOT_CS,8,0
24987 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
24988 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
24989 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
24990 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
24991 +
24992 + .align PAGE_SIZE_asm
24993 +ENTRY(cpu_gdt_table)
24994 + .rept NR_CPUS
24995 + .quad 0x0000000000000000 /* NULL descriptor */
24996 + .quad 0x0000000000000000 /* 0x0b reserved */
24997 + .quad 0x0000000000000000 /* 0x13 reserved */
24998 + .quad 0x0000000000000000 /* 0x1b reserved */
24999 +
25000 +#ifdef CONFIG_PAX_KERNEXEC
25001 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
25002 +#else
25003 + .quad 0x0000000000000000 /* 0x20 unused */
25004 +#endif
25005 +
25006 + .quad 0x0000000000000000 /* 0x28 unused */
25007 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
25008 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
25009 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
25010 + .quad 0x0000000000000000 /* 0x4b reserved */
25011 + .quad 0x0000000000000000 /* 0x53 reserved */
25012 + .quad 0x0000000000000000 /* 0x5b reserved */
25013 +
25014 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
25015 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
25016 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
25017 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
25018 +
25019 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
25020 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
25021 +
25022 + /*
25023 + * Segments used for calling PnP BIOS have byte granularity.
25024 + * The code segments and data segments have fixed 64k limits,
25025 + * the transfer segment sizes are set at run time.
25026 + */
25027 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
25028 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
25029 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
25030 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
25031 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
25032 +
25033 + /*
25034 + * The APM segments have byte granularity and their bases
25035 + * are set at run time. All have 64k limits.
25036 + */
25037 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
25038 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
25039 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
25040 +
25041 + .quad 0x00c093000000ffff /* 0xd0 - ESPFIX SS */
25042 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
25043 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
25044 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
25045 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
25046 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
25047 +
25048 + /* Be sure this is zeroed to avoid false validations in Xen */
25049 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
25050 + .endr
25051 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
25052 index df7e780..e97a497 100644
25053 --- a/arch/x86/kernel/head_64.S
25054 +++ b/arch/x86/kernel/head_64.S
25055 @@ -20,6 +20,8 @@
25056 #include <asm/processor-flags.h>
25057 #include <asm/percpu.h>
25058 #include <asm/nops.h>
25059 +#include <asm/cpufeature.h>
25060 +#include <asm/alternative-asm.h>
25061
25062 #ifdef CONFIG_PARAVIRT
25063 #include <asm/asm-offsets.h>
25064 @@ -41,6 +43,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
25065 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
25066 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
25067 L3_START_KERNEL = pud_index(__START_KERNEL_map)
25068 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
25069 +L3_VMALLOC_START = pud_index(VMALLOC_START)
25070 +L4_VMALLOC_END = pgd_index(VMALLOC_END)
25071 +L3_VMALLOC_END = pud_index(VMALLOC_END)
25072 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
25073 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
25074
25075 .text
25076 __HEAD
25077 @@ -89,11 +97,26 @@ startup_64:
25078 * Fixup the physical addresses in the page table
25079 */
25080 addq %rbp, early_level4_pgt + (L4_START_KERNEL*8)(%rip)
25081 + addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
25082 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
25083 + addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
25084 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
25085 + addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
25086
25087 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
25088 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
25089 + addq %rbp, level3_ident_pgt + (0*8)(%rip)
25090 +#ifndef CONFIG_XEN
25091 + addq %rbp, level3_ident_pgt + (1*8)(%rip)
25092 +#endif
25093
25094 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
25095 +
25096 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
25097 + addq %rbp, level3_kernel_pgt + ((L3_START_KERNEL+1)*8)(%rip)
25098 +
25099 + addq %rbp, level2_fixmap_pgt + (504*8)(%rip)
25100 + addq %rbp, level2_fixmap_pgt + (505*8)(%rip)
25101 addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
25102 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
25103
25104 /*
25105 * Set up the identity mapping for the switchover. These
25106 @@ -174,11 +197,12 @@ ENTRY(secondary_startup_64)
25107 * after the boot processor executes this code.
25108 */
25109
25110 + orq $-1, %rbp
25111 movq $(init_level4_pgt - __START_KERNEL_map), %rax
25112 1:
25113
25114 - /* Enable PAE mode and PGE */
25115 - movl $(X86_CR4_PAE | X86_CR4_PGE), %ecx
25116 + /* Enable PAE mode and PSE/PGE */
25117 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %ecx
25118 movq %rcx, %cr4
25119
25120 /* Setup early boot stage 4 level pagetables. */
25121 @@ -199,10 +223,21 @@ ENTRY(secondary_startup_64)
25122 movl $MSR_EFER, %ecx
25123 rdmsr
25124 btsl $_EFER_SCE, %eax /* Enable System Call */
25125 - btl $20,%edi /* No Execute supported? */
25126 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
25127 jnc 1f
25128 btsl $_EFER_NX, %eax
25129 + cmpq $-1, %rbp
25130 + je 1f
25131 btsq $_PAGE_BIT_NX,early_pmd_flags(%rip)
25132 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_PAGE_OFFSET(%rip)
25133 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_VMALLOC_START(%rip)
25134 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_VMALLOC_END(%rip)
25135 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_VMEMMAP_START(%rip)
25136 + btsq $_PAGE_BIT_NX, level2_fixmap_pgt + 8*504(%rip)
25137 + btsq $_PAGE_BIT_NX, level2_fixmap_pgt + 8*505(%rip)
25138 + btsq $_PAGE_BIT_NX, level2_fixmap_pgt + 8*506(%rip)
25139 + btsq $_PAGE_BIT_NX, level2_fixmap_pgt + 8*507(%rip)
25140 + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
25141 1: wrmsr /* Make changes effective */
25142
25143 /* Setup cr0 */
25144 @@ -282,6 +317,7 @@ ENTRY(secondary_startup_64)
25145 * REX.W + FF /5 JMP m16:64 Jump far, absolute indirect,
25146 * address given in m16:64.
25147 */
25148 + pax_set_fptr_mask
25149 movq initial_code(%rip),%rax
25150 pushq $0 # fake return address to stop unwinder
25151 pushq $__KERNEL_CS # set correct cs
25152 @@ -313,7 +349,7 @@ ENDPROC(start_cpu0)
25153 .quad INIT_PER_CPU_VAR(irq_stack_union)
25154
25155 GLOBAL(stack_start)
25156 - .quad init_thread_union+THREAD_SIZE-8
25157 + .quad init_thread_union+THREAD_SIZE-16
25158 .word 0
25159 __FINITDATA
25160
25161 @@ -393,7 +429,7 @@ early_idt_handler_common:
25162 call dump_stack
25163 #ifdef CONFIG_KALLSYMS
25164 leaq early_idt_ripmsg(%rip),%rdi
25165 - movq 40(%rsp),%rsi # %rip again
25166 + movq 88(%rsp),%rsi # %rip again
25167 call __print_symbol
25168 #endif
25169 #endif /* EARLY_PRINTK */
25170 @@ -422,6 +458,7 @@ ENDPROC(early_idt_handler_common)
25171 early_recursion_flag:
25172 .long 0
25173
25174 + .section .rodata,"a",@progbits
25175 #ifdef CONFIG_EARLY_PRINTK
25176 early_idt_msg:
25177 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
25178 @@ -449,29 +486,52 @@ NEXT_PAGE(early_level4_pgt)
25179 NEXT_PAGE(early_dynamic_pgts)
25180 .fill 512*EARLY_DYNAMIC_PAGE_TABLES,8,0
25181
25182 - .data
25183 + .section .rodata,"a",@progbits
25184
25185 -#ifndef CONFIG_XEN
25186 NEXT_PAGE(init_level4_pgt)
25187 - .fill 512,8,0
25188 -#else
25189 -NEXT_PAGE(init_level4_pgt)
25190 - .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
25191 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
25192 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
25193 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
25194 + .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
25195 + .org init_level4_pgt + L4_VMALLOC_END*8, 0
25196 + .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
25197 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
25198 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
25199 .org init_level4_pgt + L4_START_KERNEL*8, 0
25200 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
25201 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
25202
25203 +#ifdef CONFIG_PAX_PER_CPU_PGD
25204 +NEXT_PAGE(cpu_pgd)
25205 + .rept 2*NR_CPUS
25206 + .fill 512,8,0
25207 + .endr
25208 +#endif
25209 +
25210 NEXT_PAGE(level3_ident_pgt)
25211 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
25212 +#ifdef CONFIG_XEN
25213 .fill 511, 8, 0
25214 +#else
25215 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
25216 + .fill 510,8,0
25217 +#endif
25218 +
25219 +NEXT_PAGE(level3_vmalloc_start_pgt)
25220 + .fill 512,8,0
25221 +
25222 +NEXT_PAGE(level3_vmalloc_end_pgt)
25223 + .fill 512,8,0
25224 +
25225 +NEXT_PAGE(level3_vmemmap_pgt)
25226 + .fill L3_VMEMMAP_START,8,0
25227 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
25228 +
25229 NEXT_PAGE(level2_ident_pgt)
25230 - /* Since I easily can, map the first 1G.
25231 + /* Since I easily can, map the first 2G.
25232 * Don't set NX because code runs from these pages.
25233 */
25234 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
25235 -#endif
25236 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
25237
25238 NEXT_PAGE(level3_kernel_pgt)
25239 .fill L3_START_KERNEL,8,0
25240 @@ -479,6 +539,9 @@ NEXT_PAGE(level3_kernel_pgt)
25241 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
25242 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
25243
25244 +NEXT_PAGE(level2_vmemmap_pgt)
25245 + .fill 512,8,0
25246 +
25247 NEXT_PAGE(level2_kernel_pgt)
25248 /*
25249 * 512 MB kernel mapping. We spend a full page on this pagetable
25250 @@ -494,23 +557,61 @@ NEXT_PAGE(level2_kernel_pgt)
25251 KERNEL_IMAGE_SIZE/PMD_SIZE)
25252
25253 NEXT_PAGE(level2_fixmap_pgt)
25254 - .fill 506,8,0
25255 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
25256 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
25257 - .fill 5,8,0
25258 + .fill 504,8,0
25259 + .quad level1_fixmap_pgt - __START_KERNEL_map + 0 * PAGE_SIZE + _PAGE_TABLE
25260 + .quad level1_fixmap_pgt - __START_KERNEL_map + 1 * PAGE_SIZE + _PAGE_TABLE
25261 + .quad level1_fixmap_pgt - __START_KERNEL_map + 2 * PAGE_SIZE + _PAGE_TABLE
25262 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
25263 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
25264 + .fill 4,8,0
25265
25266 NEXT_PAGE(level1_fixmap_pgt)
25267 + .fill 3*512,8,0
25268 +
25269 +NEXT_PAGE(level1_vsyscall_pgt)
25270 .fill 512,8,0
25271
25272 #undef PMDS
25273
25274 - .data
25275 + .align PAGE_SIZE
25276 +ENTRY(cpu_gdt_table)
25277 + .rept NR_CPUS
25278 + .quad 0x0000000000000000 /* NULL descriptor */
25279 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
25280 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
25281 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
25282 + .quad 0x00cffb000000ffff /* __USER32_CS */
25283 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
25284 + .quad 0x00affb000000ffff /* __USER_CS */
25285 +
25286 +#ifdef CONFIG_PAX_KERNEXEC
25287 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
25288 +#else
25289 + .quad 0x0 /* unused */
25290 +#endif
25291 +
25292 + .quad 0,0 /* TSS */
25293 + .quad 0,0 /* LDT */
25294 + .quad 0,0,0 /* three TLS descriptors */
25295 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
25296 + /* asm/segment.h:GDT_ENTRIES must match this */
25297 +
25298 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25299 + .quad 0x00cf93000000ffff /* __UDEREF_KERNEL_DS */
25300 +#else
25301 + .quad 0x0 /* unused */
25302 +#endif
25303 +
25304 + /* zero the remaining page */
25305 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
25306 + .endr
25307 +
25308 .align 16
25309 .globl early_gdt_descr
25310 early_gdt_descr:
25311 .word GDT_ENTRIES*8-1
25312 early_gdt_descr_base:
25313 - .quad INIT_PER_CPU_VAR(gdt_page)
25314 + .quad cpu_gdt_table
25315
25316 ENTRY(phys_base)
25317 /* This must match the first entry in level2_kernel_pgt */
25318 @@ -534,8 +635,8 @@ NEXT_PAGE(kasan_zero_pud)
25319
25320
25321 #include "../../x86/xen/xen-head.S"
25322 -
25323 - __PAGE_ALIGNED_BSS
25324 +
25325 + .section .rodata,"a",@progbits
25326 NEXT_PAGE(empty_zero_page)
25327 .skip PAGE_SIZE
25328
25329 diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
25330 index 05fd74f..c3548b1 100644
25331 --- a/arch/x86/kernel/i386_ksyms_32.c
25332 +++ b/arch/x86/kernel/i386_ksyms_32.c
25333 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
25334 EXPORT_SYMBOL(cmpxchg8b_emu);
25335 #endif
25336
25337 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
25338 +
25339 /* Networking helper routines. */
25340 EXPORT_SYMBOL(csum_partial_copy_generic);
25341 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
25342 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
25343
25344 EXPORT_SYMBOL(__get_user_1);
25345 EXPORT_SYMBOL(__get_user_2);
25346 @@ -44,3 +48,11 @@ EXPORT_SYMBOL(___preempt_schedule);
25347 EXPORT_SYMBOL(___preempt_schedule_context);
25348 #endif
25349 #endif
25350 +
25351 +#ifdef CONFIG_PAX_KERNEXEC
25352 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
25353 +#endif
25354 +
25355 +#ifdef CONFIG_PAX_PER_CPU_PGD
25356 +EXPORT_SYMBOL(cpu_pgd);
25357 +#endif
25358 diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
25359 index e7cc537..67d7372 100644
25360 --- a/arch/x86/kernel/i8259.c
25361 +++ b/arch/x86/kernel/i8259.c
25362 @@ -110,7 +110,7 @@ static int i8259A_irq_pending(unsigned int irq)
25363 static void make_8259A_irq(unsigned int irq)
25364 {
25365 disable_irq_nosync(irq);
25366 - io_apic_irqs &= ~(1<<irq);
25367 + io_apic_irqs &= ~(1UL<<irq);
25368 irq_set_chip_and_handler(irq, &i8259A_chip, handle_level_irq);
25369 enable_irq(irq);
25370 }
25371 @@ -208,7 +208,7 @@ spurious_8259A_irq:
25372 "spurious 8259A interrupt: IRQ%d.\n", irq);
25373 spurious_irq_mask |= irqmask;
25374 }
25375 - atomic_inc(&irq_err_count);
25376 + atomic_inc_unchecked(&irq_err_count);
25377 /*
25378 * Theoretically we do not have to handle this IRQ,
25379 * but in Linux this does not cause problems and is
25380 @@ -349,14 +349,16 @@ static void init_8259A(int auto_eoi)
25381 /* (slave's support for AEOI in flat mode is to be investigated) */
25382 outb_pic(SLAVE_ICW4_DEFAULT, PIC_SLAVE_IMR);
25383
25384 + pax_open_kernel();
25385 if (auto_eoi)
25386 /*
25387 * In AEOI mode we just have to mask the interrupt
25388 * when acking.
25389 */
25390 - i8259A_chip.irq_mask_ack = disable_8259A_irq;
25391 + *(void **)&i8259A_chip.irq_mask_ack = disable_8259A_irq;
25392 else
25393 - i8259A_chip.irq_mask_ack = mask_and_ack_8259A;
25394 + *(void **)&i8259A_chip.irq_mask_ack = mask_and_ack_8259A;
25395 + pax_close_kernel();
25396
25397 udelay(100); /* wait for 8259A to initialize */
25398
25399 diff --git a/arch/x86/kernel/io_delay.c b/arch/x86/kernel/io_delay.c
25400 index a979b5b..1d6db75 100644
25401 --- a/arch/x86/kernel/io_delay.c
25402 +++ b/arch/x86/kernel/io_delay.c
25403 @@ -58,7 +58,7 @@ static int __init dmi_io_delay_0xed_port(const struct dmi_system_id *id)
25404 * Quirk table for systems that misbehave (lock up, etc.) if port
25405 * 0x80 is used:
25406 */
25407 -static struct dmi_system_id __initdata io_delay_0xed_port_dmi_table[] = {
25408 +static const struct dmi_system_id __initconst io_delay_0xed_port_dmi_table[] = {
25409 {
25410 .callback = dmi_io_delay_0xed_port,
25411 .ident = "Compaq Presario V6000",
25412 diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
25413 index 37dae79..620dd84 100644
25414 --- a/arch/x86/kernel/ioport.c
25415 +++ b/arch/x86/kernel/ioport.c
25416 @@ -6,6 +6,7 @@
25417 #include <linux/sched.h>
25418 #include <linux/kernel.h>
25419 #include <linux/capability.h>
25420 +#include <linux/security.h>
25421 #include <linux/errno.h>
25422 #include <linux/types.h>
25423 #include <linux/ioport.h>
25424 @@ -30,6 +31,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
25425 return -EINVAL;
25426 if (turn_on && !capable(CAP_SYS_RAWIO))
25427 return -EPERM;
25428 +#ifdef CONFIG_GRKERNSEC_IO
25429 + if (turn_on && grsec_disable_privio) {
25430 + gr_handle_ioperm();
25431 + return -ENODEV;
25432 + }
25433 +#endif
25434
25435 /*
25436 * If it's the first ioperm() call in this thread's lifetime, set the
25437 @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
25438 * because the ->io_bitmap_max value must match the bitmap
25439 * contents:
25440 */
25441 - tss = &per_cpu(cpu_tss, get_cpu());
25442 + tss = cpu_tss + get_cpu();
25443
25444 if (turn_on)
25445 bitmap_clear(t->io_bitmap_ptr, from, num);
25446 @@ -105,6 +112,12 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
25447 if (level > old) {
25448 if (!capable(CAP_SYS_RAWIO))
25449 return -EPERM;
25450 +#ifdef CONFIG_GRKERNSEC_IO
25451 + if (grsec_disable_privio) {
25452 + gr_handle_iopl();
25453 + return -ENODEV;
25454 + }
25455 +#endif
25456 }
25457 regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
25458 t->iopl = level << 12;
25459 diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
25460 index e5952c2..11c3a54 100644
25461 --- a/arch/x86/kernel/irq.c
25462 +++ b/arch/x86/kernel/irq.c
25463 @@ -22,7 +22,7 @@
25464 #define CREATE_TRACE_POINTS
25465 #include <asm/trace/irq_vectors.h>
25466
25467 -atomic_t irq_err_count;
25468 +atomic_unchecked_t irq_err_count;
25469
25470 /* Function pointer for generic interrupt vector handling */
25471 void (*x86_platform_ipi_callback)(void) = NULL;
25472 @@ -132,9 +132,9 @@ int arch_show_interrupts(struct seq_file *p, int prec)
25473 seq_printf(p, "%10u ", irq_stats(j)->irq_hv_callback_count);
25474 seq_puts(p, " Hypervisor callback interrupts\n");
25475 #endif
25476 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
25477 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
25478 #if defined(CONFIG_X86_IO_APIC)
25479 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
25480 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
25481 #endif
25482 return 0;
25483 }
25484 @@ -174,7 +174,7 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
25485
25486 u64 arch_irq_stat(void)
25487 {
25488 - u64 sum = atomic_read(&irq_err_count);
25489 + u64 sum = atomic_read_unchecked(&irq_err_count);
25490 return sum;
25491 }
25492
25493 diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
25494 index f9fd86a..e6cc9ae 100644
25495 --- a/arch/x86/kernel/irq_32.c
25496 +++ b/arch/x86/kernel/irq_32.c
25497 @@ -29,6 +29,8 @@ EXPORT_PER_CPU_SYMBOL(irq_regs);
25498
25499 #ifdef CONFIG_DEBUG_STACKOVERFLOW
25500
25501 +extern void gr_handle_kernel_exploit(void);
25502 +
25503 int sysctl_panic_on_stackoverflow __read_mostly;
25504
25505 /* Debugging check for stack overflow: is there less than 1KB free? */
25506 @@ -39,13 +41,14 @@ static int check_stack_overflow(void)
25507 __asm__ __volatile__("andl %%esp,%0" :
25508 "=r" (sp) : "0" (THREAD_SIZE - 1));
25509
25510 - return sp < (sizeof(struct thread_info) + STACK_WARN);
25511 + return sp < STACK_WARN;
25512 }
25513
25514 static void print_stack_overflow(void)
25515 {
25516 printk(KERN_WARNING "low stack detected by irq handler\n");
25517 dump_stack();
25518 + gr_handle_kernel_exploit();
25519 if (sysctl_panic_on_stackoverflow)
25520 panic("low stack detected by irq handler - check messages\n");
25521 }
25522 @@ -77,10 +80,9 @@ static inline void *current_stack(void)
25523 static inline int
25524 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25525 {
25526 - struct irq_stack *curstk, *irqstk;
25527 + struct irq_stack *irqstk;
25528 u32 *isp, *prev_esp, arg1, arg2;
25529
25530 - curstk = (struct irq_stack *) current_stack();
25531 irqstk = __this_cpu_read(hardirq_stack);
25532
25533 /*
25534 @@ -89,15 +91,19 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25535 * handler) we can't do that and just have to keep using the
25536 * current stack (which is the irq stack already after all)
25537 */
25538 - if (unlikely(curstk == irqstk))
25539 + if (unlikely((void *)current_stack_pointer - (void *)irqstk < THREAD_SIZE))
25540 return 0;
25541
25542 - isp = (u32 *) ((char *)irqstk + sizeof(*irqstk));
25543 + isp = (u32 *) ((char *)irqstk + sizeof(*irqstk) - 8);
25544
25545 /* Save the next esp at the bottom of the stack */
25546 prev_esp = (u32 *)irqstk;
25547 *prev_esp = current_stack_pointer();
25548
25549 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25550 + __set_fs(MAKE_MM_SEG(0));
25551 +#endif
25552 +
25553 if (unlikely(overflow))
25554 call_on_stack(print_stack_overflow, isp);
25555
25556 @@ -108,6 +114,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25557 : "0" (irq), "1" (desc), "2" (isp),
25558 "D" (desc->handle_irq)
25559 : "memory", "cc", "ecx");
25560 +
25561 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25562 + __set_fs(current_thread_info()->addr_limit);
25563 +#endif
25564 +
25565 return 1;
25566 }
25567
25568 @@ -116,32 +127,18 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25569 */
25570 void irq_ctx_init(int cpu)
25571 {
25572 - struct irq_stack *irqstk;
25573 -
25574 if (per_cpu(hardirq_stack, cpu))
25575 return;
25576
25577 - irqstk = page_address(alloc_pages_node(cpu_to_node(cpu),
25578 - THREADINFO_GFP,
25579 - THREAD_SIZE_ORDER));
25580 - per_cpu(hardirq_stack, cpu) = irqstk;
25581 -
25582 - irqstk = page_address(alloc_pages_node(cpu_to_node(cpu),
25583 - THREADINFO_GFP,
25584 - THREAD_SIZE_ORDER));
25585 - per_cpu(softirq_stack, cpu) = irqstk;
25586 -
25587 - printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
25588 - cpu, per_cpu(hardirq_stack, cpu), per_cpu(softirq_stack, cpu));
25589 + per_cpu(hardirq_stack, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER));
25590 + per_cpu(softirq_stack, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER));
25591 }
25592
25593 void do_softirq_own_stack(void)
25594 {
25595 - struct thread_info *curstk;
25596 struct irq_stack *irqstk;
25597 u32 *isp, *prev_esp;
25598
25599 - curstk = current_stack();
25600 irqstk = __this_cpu_read(softirq_stack);
25601
25602 /* build the stack frame on the softirq stack */
25603 @@ -151,7 +148,16 @@ void do_softirq_own_stack(void)
25604 prev_esp = (u32 *)irqstk;
25605 *prev_esp = current_stack_pointer();
25606
25607 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25608 + __set_fs(MAKE_MM_SEG(0));
25609 +#endif
25610 +
25611 call_on_stack(__do_softirq, isp);
25612 +
25613 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25614 + __set_fs(current_thread_info()->addr_limit);
25615 +#endif
25616 +
25617 }
25618
25619 bool handle_irq(unsigned irq, struct pt_regs *regs)
25620 diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
25621 index 394e643..824fce8 100644
25622 --- a/arch/x86/kernel/irq_64.c
25623 +++ b/arch/x86/kernel/irq_64.c
25624 @@ -26,6 +26,8 @@ EXPORT_PER_CPU_SYMBOL(irq_stat);
25625 DEFINE_PER_CPU(struct pt_regs *, irq_regs);
25626 EXPORT_PER_CPU_SYMBOL(irq_regs);
25627
25628 +extern void gr_handle_kernel_exploit(void);
25629 +
25630 int sysctl_panic_on_stackoverflow;
25631
25632 /*
25633 @@ -69,6 +71,8 @@ static inline void stack_overflow_check(struct pt_regs *regs)
25634 irq_stack_top, irq_stack_bottom,
25635 estack_top, estack_bottom);
25636
25637 + gr_handle_kernel_exploit();
25638 +
25639 if (sysctl_panic_on_stackoverflow)
25640 panic("low stack detected by irq handler - check messages\n");
25641 #endif
25642 diff --git a/arch/x86/kernel/jump_label.c b/arch/x86/kernel/jump_label.c
25643 index 26d5a55..a01160a 100644
25644 --- a/arch/x86/kernel/jump_label.c
25645 +++ b/arch/x86/kernel/jump_label.c
25646 @@ -51,7 +51,7 @@ static void __jump_label_transform(struct jump_entry *entry,
25647 * Jump label is enabled for the first time.
25648 * So we expect a default_nop...
25649 */
25650 - if (unlikely(memcmp((void *)entry->code, default_nop, 5)
25651 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), default_nop, 5)
25652 != 0))
25653 bug_at((void *)entry->code, __LINE__);
25654 } else {
25655 @@ -59,7 +59,7 @@ static void __jump_label_transform(struct jump_entry *entry,
25656 * ...otherwise expect an ideal_nop. Otherwise
25657 * something went horribly wrong.
25658 */
25659 - if (unlikely(memcmp((void *)entry->code, ideal_nop, 5)
25660 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), ideal_nop, 5)
25661 != 0))
25662 bug_at((void *)entry->code, __LINE__);
25663 }
25664 @@ -75,13 +75,13 @@ static void __jump_label_transform(struct jump_entry *entry,
25665 * are converting the default nop to the ideal nop.
25666 */
25667 if (init) {
25668 - if (unlikely(memcmp((void *)entry->code, default_nop, 5) != 0))
25669 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), default_nop, 5) != 0))
25670 bug_at((void *)entry->code, __LINE__);
25671 } else {
25672 code.jump = 0xe9;
25673 code.offset = entry->target -
25674 (entry->code + JUMP_LABEL_NOP_SIZE);
25675 - if (unlikely(memcmp((void *)entry->code, &code, 5) != 0))
25676 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), &code, 5) != 0))
25677 bug_at((void *)entry->code, __LINE__);
25678 }
25679 memcpy(&code, ideal_nops[NOP_ATOMIC5], JUMP_LABEL_NOP_SIZE);
25680 diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
25681 index d6178d9..e12482f 100644
25682 --- a/arch/x86/kernel/kgdb.c
25683 +++ b/arch/x86/kernel/kgdb.c
25684 @@ -228,7 +228,10 @@ static void kgdb_correct_hw_break(void)
25685 bp->attr.bp_addr = breakinfo[breakno].addr;
25686 bp->attr.bp_len = breakinfo[breakno].len;
25687 bp->attr.bp_type = breakinfo[breakno].type;
25688 - info->address = breakinfo[breakno].addr;
25689 + if (breakinfo[breakno].type == X86_BREAKPOINT_EXECUTE)
25690 + info->address = ktla_ktva(breakinfo[breakno].addr);
25691 + else
25692 + info->address = breakinfo[breakno].addr;
25693 info->len = breakinfo[breakno].len;
25694 info->type = breakinfo[breakno].type;
25695 val = arch_install_hw_breakpoint(bp);
25696 @@ -475,12 +478,12 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
25697 case 'k':
25698 /* clear the trace bit */
25699 linux_regs->flags &= ~X86_EFLAGS_TF;
25700 - atomic_set(&kgdb_cpu_doing_single_step, -1);
25701 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
25702
25703 /* set the trace bit if we're stepping */
25704 if (remcomInBuffer[0] == 's') {
25705 linux_regs->flags |= X86_EFLAGS_TF;
25706 - atomic_set(&kgdb_cpu_doing_single_step,
25707 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
25708 raw_smp_processor_id());
25709 }
25710
25711 @@ -545,7 +548,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
25712
25713 switch (cmd) {
25714 case DIE_DEBUG:
25715 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
25716 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
25717 if (user_mode(regs))
25718 return single_step_cont(regs, args);
25719 break;
25720 @@ -750,11 +753,11 @@ int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
25721 #endif /* CONFIG_DEBUG_RODATA */
25722
25723 bpt->type = BP_BREAKPOINT;
25724 - err = probe_kernel_read(bpt->saved_instr, (char *)bpt->bpt_addr,
25725 + err = probe_kernel_read(bpt->saved_instr, ktla_ktva((char *)bpt->bpt_addr),
25726 BREAK_INSTR_SIZE);
25727 if (err)
25728 return err;
25729 - err = probe_kernel_write((char *)bpt->bpt_addr,
25730 + err = probe_kernel_write(ktla_ktva((char *)bpt->bpt_addr),
25731 arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE);
25732 #ifdef CONFIG_DEBUG_RODATA
25733 if (!err)
25734 @@ -767,7 +770,7 @@ int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
25735 return -EBUSY;
25736 text_poke((void *)bpt->bpt_addr, arch_kgdb_ops.gdb_bpt_instr,
25737 BREAK_INSTR_SIZE);
25738 - err = probe_kernel_read(opc, (char *)bpt->bpt_addr, BREAK_INSTR_SIZE);
25739 + err = probe_kernel_read(opc, ktla_ktva((char *)bpt->bpt_addr), BREAK_INSTR_SIZE);
25740 if (err)
25741 return err;
25742 if (memcmp(opc, arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE))
25743 @@ -792,13 +795,13 @@ int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
25744 if (mutex_is_locked(&text_mutex))
25745 goto knl_write;
25746 text_poke((void *)bpt->bpt_addr, bpt->saved_instr, BREAK_INSTR_SIZE);
25747 - err = probe_kernel_read(opc, (char *)bpt->bpt_addr, BREAK_INSTR_SIZE);
25748 + err = probe_kernel_read(opc, ktla_ktva((char *)bpt->bpt_addr), BREAK_INSTR_SIZE);
25749 if (err || memcmp(opc, bpt->saved_instr, BREAK_INSTR_SIZE))
25750 goto knl_write;
25751 return err;
25752 knl_write:
25753 #endif /* CONFIG_DEBUG_RODATA */
25754 - return probe_kernel_write((char *)bpt->bpt_addr,
25755 + return probe_kernel_write(ktla_ktva((char *)bpt->bpt_addr),
25756 (char *)bpt->saved_instr, BREAK_INSTR_SIZE);
25757 }
25758
25759 diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
25760 index 1deffe6..4705700 100644
25761 --- a/arch/x86/kernel/kprobes/core.c
25762 +++ b/arch/x86/kernel/kprobes/core.c
25763 @@ -120,9 +120,12 @@ __synthesize_relative_insn(void *from, void *to, u8 op)
25764 s32 raddr;
25765 } __packed *insn;
25766
25767 - insn = (struct __arch_relative_insn *)from;
25768 + insn = (struct __arch_relative_insn *)ktla_ktva(from);
25769 +
25770 + pax_open_kernel();
25771 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
25772 insn->op = op;
25773 + pax_close_kernel();
25774 }
25775
25776 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
25777 @@ -168,7 +171,7 @@ int can_boost(kprobe_opcode_t *opcodes)
25778 kprobe_opcode_t opcode;
25779 kprobe_opcode_t *orig_opcodes = opcodes;
25780
25781 - if (search_exception_tables((unsigned long)opcodes))
25782 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
25783 return 0; /* Page fault may occur on this address. */
25784
25785 retry:
25786 @@ -260,12 +263,12 @@ __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr)
25787 * Fortunately, we know that the original code is the ideal 5-byte
25788 * long NOP.
25789 */
25790 - memcpy(buf, (void *)addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
25791 + memcpy(buf, (void *)ktla_ktva(addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
25792 if (faddr)
25793 memcpy(buf, ideal_nops[NOP_ATOMIC5], 5);
25794 else
25795 buf[0] = kp->opcode;
25796 - return (unsigned long)buf;
25797 + return ktva_ktla((unsigned long)buf);
25798 }
25799
25800 /*
25801 @@ -367,7 +370,9 @@ int __copy_instruction(u8 *dest, u8 *src)
25802 /* Another subsystem puts a breakpoint, failed to recover */
25803 if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
25804 return 0;
25805 + pax_open_kernel();
25806 memcpy(dest, insn.kaddr, length);
25807 + pax_close_kernel();
25808
25809 #ifdef CONFIG_X86_64
25810 if (insn_rip_relative(&insn)) {
25811 @@ -394,7 +399,9 @@ int __copy_instruction(u8 *dest, u8 *src)
25812 return 0;
25813 }
25814 disp = (u8 *) dest + insn_offset_displacement(&insn);
25815 + pax_open_kernel();
25816 *(s32 *) disp = (s32) newdisp;
25817 + pax_close_kernel();
25818 }
25819 #endif
25820 return length;
25821 @@ -536,7 +543,7 @@ static void setup_singlestep(struct kprobe *p, struct pt_regs *regs,
25822 * nor set current_kprobe, because it doesn't use single
25823 * stepping.
25824 */
25825 - regs->ip = (unsigned long)p->ainsn.insn;
25826 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
25827 preempt_enable_no_resched();
25828 return;
25829 }
25830 @@ -553,9 +560,9 @@ static void setup_singlestep(struct kprobe *p, struct pt_regs *regs,
25831 regs->flags &= ~X86_EFLAGS_IF;
25832 /* single step inline if the instruction is an int3 */
25833 if (p->opcode == BREAKPOINT_INSTRUCTION)
25834 - regs->ip = (unsigned long)p->addr;
25835 + regs->ip = ktla_ktva((unsigned long)p->addr);
25836 else
25837 - regs->ip = (unsigned long)p->ainsn.insn;
25838 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
25839 }
25840 NOKPROBE_SYMBOL(setup_singlestep);
25841
25842 @@ -640,7 +647,7 @@ int kprobe_int3_handler(struct pt_regs *regs)
25843 setup_singlestep(p, regs, kcb, 0);
25844 return 1;
25845 }
25846 - } else if (*addr != BREAKPOINT_INSTRUCTION) {
25847 + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
25848 /*
25849 * The breakpoint instruction was removed right
25850 * after we hit it. Another cpu has removed
25851 @@ -687,6 +694,9 @@ static void __used kretprobe_trampoline_holder(void)
25852 " movq %rax, 152(%rsp)\n"
25853 RESTORE_REGS_STRING
25854 " popfq\n"
25855 +#ifdef KERNEXEC_PLUGIN
25856 + " btsq $63,(%rsp)\n"
25857 +#endif
25858 #else
25859 " pushf\n"
25860 SAVE_REGS_STRING
25861 @@ -827,7 +837,7 @@ static void resume_execution(struct kprobe *p, struct pt_regs *regs,
25862 struct kprobe_ctlblk *kcb)
25863 {
25864 unsigned long *tos = stack_addr(regs);
25865 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
25866 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
25867 unsigned long orig_ip = (unsigned long)p->addr;
25868 kprobe_opcode_t *insn = p->ainsn.insn;
25869
25870 diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
25871 index 7b3b9d1..e2478b91 100644
25872 --- a/arch/x86/kernel/kprobes/opt.c
25873 +++ b/arch/x86/kernel/kprobes/opt.c
25874 @@ -79,6 +79,7 @@ found:
25875 /* Insert a move instruction which sets a pointer to eax/rdi (1st arg). */
25876 static void synthesize_set_arg1(kprobe_opcode_t *addr, unsigned long val)
25877 {
25878 + pax_open_kernel();
25879 #ifdef CONFIG_X86_64
25880 *addr++ = 0x48;
25881 *addr++ = 0xbf;
25882 @@ -86,6 +87,7 @@ static void synthesize_set_arg1(kprobe_opcode_t *addr, unsigned long val)
25883 *addr++ = 0xb8;
25884 #endif
25885 *(unsigned long *)addr = val;
25886 + pax_close_kernel();
25887 }
25888
25889 asm (
25890 @@ -342,7 +344,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op,
25891 * Verify if the address gap is in 2GB range, because this uses
25892 * a relative jump.
25893 */
25894 - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
25895 + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
25896 if (abs(rel) > 0x7fffffff) {
25897 __arch_remove_optimized_kprobe(op, 0);
25898 return -ERANGE;
25899 @@ -359,16 +361,18 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op,
25900 op->optinsn.size = ret;
25901
25902 /* Copy arch-dep-instance from template */
25903 - memcpy(buf, &optprobe_template_entry, TMPL_END_IDX);
25904 + pax_open_kernel();
25905 + memcpy(buf, ktla_ktva(&optprobe_template_entry), TMPL_END_IDX);
25906 + pax_close_kernel();
25907
25908 /* Set probe information */
25909 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
25910
25911 /* Set probe function call */
25912 - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
25913 + synthesize_relcall(ktva_ktla(buf) + TMPL_CALL_IDX, optimized_callback);
25914
25915 /* Set returning jmp instruction at the tail of out-of-line buffer */
25916 - synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
25917 + synthesize_reljump(ktva_ktla(buf) + TMPL_END_IDX + op->optinsn.size,
25918 (u8 *)op->kp.addr + op->optinsn.size);
25919
25920 flush_icache_range((unsigned long) buf,
25921 @@ -393,7 +397,7 @@ void arch_optimize_kprobes(struct list_head *oplist)
25922 WARN_ON(kprobe_disabled(&op->kp));
25923
25924 /* Backup instructions which will be replaced by jump address */
25925 - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
25926 + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
25927 RELATIVE_ADDR_SIZE);
25928
25929 insn_buf[0] = RELATIVEJUMP_OPCODE;
25930 @@ -441,7 +445,7 @@ int setup_detour_execution(struct kprobe *p, struct pt_regs *regs, int reenter)
25931 /* This kprobe is really able to run optimized path. */
25932 op = container_of(p, struct optimized_kprobe, kp);
25933 /* Detour through copied instructions */
25934 - regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX;
25935 + regs->ip = ktva_ktla((unsigned long)op->optinsn.insn) + TMPL_END_IDX;
25936 if (!reenter)
25937 reset_current_kprobe();
25938 preempt_enable_no_resched();
25939 diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
25940 index c2bedae..25e7ab60 100644
25941 --- a/arch/x86/kernel/ksysfs.c
25942 +++ b/arch/x86/kernel/ksysfs.c
25943 @@ -184,7 +184,7 @@ out:
25944
25945 static struct kobj_attribute type_attr = __ATTR_RO(type);
25946
25947 -static struct bin_attribute data_attr = {
25948 +static bin_attribute_no_const data_attr __read_only = {
25949 .attr = {
25950 .name = "data",
25951 .mode = S_IRUGO,
25952 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
25953 index c37886d..f43b63d 100644
25954 --- a/arch/x86/kernel/ldt.c
25955 +++ b/arch/x86/kernel/ldt.c
25956 @@ -11,6 +11,7 @@
25957 #include <linux/sched.h>
25958 #include <linux/string.h>
25959 #include <linux/mm.h>
25960 +#include <linux/ratelimit.h>
25961 #include <linux/smp.h>
25962 #include <linux/vmalloc.h>
25963 #include <linux/uaccess.h>
25964 @@ -20,6 +21,14 @@
25965 #include <asm/mmu_context.h>
25966 #include <asm/syscalls.h>
25967
25968 +#ifdef CONFIG_GRKERNSEC
25969 +int sysctl_modify_ldt __read_only = 0;
25970 +#elif defined(CONFIG_DEFAULT_MODIFY_LDT_SYSCALL)
25971 +int sysctl_modify_ldt __read_only = 1;
25972 +#else
25973 +int sysctl_modify_ldt __read_only = 0;
25974 +#endif
25975 +
25976 #ifdef CONFIG_SMP
25977 static void flush_ldt(void *current_mm)
25978 {
25979 @@ -66,13 +75,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
25980 if (reload) {
25981 #ifdef CONFIG_SMP
25982 preempt_disable();
25983 - load_LDT(pc);
25984 + load_LDT_nolock(pc);
25985 if (!cpumask_equal(mm_cpumask(current->mm),
25986 cpumask_of(smp_processor_id())))
25987 smp_call_function(flush_ldt, current->mm, 1);
25988 preempt_enable();
25989 #else
25990 - load_LDT(pc);
25991 + load_LDT_nolock(pc);
25992 #endif
25993 }
25994 if (oldsize) {
25995 @@ -94,7 +103,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
25996 return err;
25997
25998 for (i = 0; i < old->size; i++)
25999 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
26000 + write_ldt_entry(new->ldt, i, old->ldt + i);
26001 return 0;
26002 }
26003
26004 @@ -115,6 +124,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
26005 retval = copy_ldt(&mm->context, &old_mm->context);
26006 mutex_unlock(&old_mm->context.lock);
26007 }
26008 +
26009 + if (tsk == current) {
26010 + mm->context.vdso = 0;
26011 +
26012 +#ifdef CONFIG_X86_32
26013 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
26014 + mm->context.user_cs_base = 0UL;
26015 + mm->context.user_cs_limit = ~0UL;
26016 +
26017 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
26018 + cpumask_clear(&mm->context.cpu_user_cs_mask);
26019 +#endif
26020 +
26021 +#endif
26022 +#endif
26023 +
26024 + }
26025 +
26026 return retval;
26027 }
26028
26029 @@ -229,6 +256,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
26030 }
26031 }
26032
26033 +#ifdef CONFIG_PAX_SEGMEXEC
26034 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
26035 + error = -EINVAL;
26036 + goto out_unlock;
26037 + }
26038 +#endif
26039 +
26040 if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
26041 error = -EINVAL;
26042 goto out_unlock;
26043 @@ -254,6 +288,15 @@ asmlinkage int sys_modify_ldt(int func, void __user *ptr,
26044 {
26045 int ret = -ENOSYS;
26046
26047 + if (!sysctl_modify_ldt) {
26048 + printk_ratelimited(KERN_INFO
26049 + "Denied a call to modify_ldt() from %s[%d] (uid: %d)."
26050 + " Adjust sysctl if this was not an exploit attempt.\n",
26051 + current->comm, task_pid_nr(current),
26052 + from_kuid_munged(current_user_ns(), current_uid()));
26053 + return ret;
26054 + }
26055 +
26056 switch (func) {
26057 case 0:
26058 ret = read_ldt(ptr, bytecount);
26059 diff --git a/arch/x86/kernel/livepatch.c b/arch/x86/kernel/livepatch.c
26060 index ff3c3101d..d7c0cd8 100644
26061 --- a/arch/x86/kernel/livepatch.c
26062 +++ b/arch/x86/kernel/livepatch.c
26063 @@ -41,9 +41,10 @@ int klp_write_module_reloc(struct module *mod, unsigned long type,
26064 int ret, numpages, size = 4;
26065 bool readonly;
26066 unsigned long val;
26067 - unsigned long core = (unsigned long)mod->module_core;
26068 - unsigned long core_ro_size = mod->core_ro_size;
26069 - unsigned long core_size = mod->core_size;
26070 + unsigned long core_rx = (unsigned long)mod->module_core_rx;
26071 + unsigned long core_rw = (unsigned long)mod->module_core_rw;
26072 + unsigned long core_size_rx = mod->core_size_rx;
26073 + unsigned long core_size_rw = mod->core_size_rw;
26074
26075 switch (type) {
26076 case R_X86_64_NONE:
26077 @@ -66,11 +67,12 @@ int klp_write_module_reloc(struct module *mod, unsigned long type,
26078 return -EINVAL;
26079 }
26080
26081 - if (loc < core || loc >= core + core_size)
26082 + if ((loc < core_rx || loc >= core_rx + core_size_rx) &&
26083 + (loc < core_rw || loc >= core_rw + core_size_rw))
26084 /* loc does not point to any symbol inside the module */
26085 return -EINVAL;
26086
26087 - if (loc < core + core_ro_size)
26088 + if (loc < core_rx + core_size_rx)
26089 readonly = true;
26090 else
26091 readonly = false;
26092 diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
26093 index 469b23d..5449cfe 100644
26094 --- a/arch/x86/kernel/machine_kexec_32.c
26095 +++ b/arch/x86/kernel/machine_kexec_32.c
26096 @@ -26,7 +26,7 @@
26097 #include <asm/cacheflush.h>
26098 #include <asm/debugreg.h>
26099
26100 -static void set_idt(void *newidt, __u16 limit)
26101 +static void set_idt(struct desc_struct *newidt, __u16 limit)
26102 {
26103 struct desc_ptr curidt;
26104
26105 @@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 limit)
26106 }
26107
26108
26109 -static void set_gdt(void *newgdt, __u16 limit)
26110 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
26111 {
26112 struct desc_ptr curgdt;
26113
26114 @@ -216,7 +216,7 @@ void machine_kexec(struct kimage *image)
26115 }
26116
26117 control_page = page_address(image->control_code_page);
26118 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
26119 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
26120
26121 relocate_kernel_ptr = control_page;
26122 page_list[PA_CONTROL_PAGE] = __pa(control_page);
26123 diff --git a/arch/x86/kernel/mcount_64.S b/arch/x86/kernel/mcount_64.S
26124 index 94ea120..4154cea 100644
26125 --- a/arch/x86/kernel/mcount_64.S
26126 +++ b/arch/x86/kernel/mcount_64.S
26127 @@ -7,7 +7,7 @@
26128 #include <linux/linkage.h>
26129 #include <asm/ptrace.h>
26130 #include <asm/ftrace.h>
26131 -
26132 +#include <asm/alternative-asm.h>
26133
26134 .code64
26135 .section .entry.text, "ax"
26136 @@ -148,8 +148,9 @@
26137 #ifdef CONFIG_DYNAMIC_FTRACE
26138
26139 ENTRY(function_hook)
26140 + pax_force_retaddr
26141 retq
26142 -END(function_hook)
26143 +ENDPROC(function_hook)
26144
26145 ENTRY(ftrace_caller)
26146 /* save_mcount_regs fills in first two parameters */
26147 @@ -181,8 +182,9 @@ GLOBAL(ftrace_graph_call)
26148 #endif
26149
26150 GLOBAL(ftrace_stub)
26151 + pax_force_retaddr
26152 retq
26153 -END(ftrace_caller)
26154 +ENDPROC(ftrace_caller)
26155
26156 ENTRY(ftrace_regs_caller)
26157 /* Save the current flags before any operations that can change them */
26158 @@ -253,7 +255,7 @@ GLOBAL(ftrace_regs_caller_end)
26159
26160 jmp ftrace_return
26161
26162 -END(ftrace_regs_caller)
26163 +ENDPROC(ftrace_regs_caller)
26164
26165
26166 #else /* ! CONFIG_DYNAMIC_FTRACE */
26167 @@ -272,18 +274,20 @@ fgraph_trace:
26168 #endif
26169
26170 GLOBAL(ftrace_stub)
26171 + pax_force_retaddr
26172 retq
26173
26174 trace:
26175 /* save_mcount_regs fills in first two parameters */
26176 save_mcount_regs
26177
26178 + pax_force_fptr ftrace_trace_function
26179 call *ftrace_trace_function
26180
26181 restore_mcount_regs
26182
26183 jmp fgraph_trace
26184 -END(function_hook)
26185 +ENDPROC(function_hook)
26186 #endif /* CONFIG_DYNAMIC_FTRACE */
26187 #endif /* CONFIG_FUNCTION_TRACER */
26188
26189 @@ -305,8 +309,9 @@ ENTRY(ftrace_graph_caller)
26190
26191 restore_mcount_regs
26192
26193 + pax_force_retaddr
26194 retq
26195 -END(ftrace_graph_caller)
26196 +ENDPROC(ftrace_graph_caller)
26197
26198 GLOBAL(return_to_handler)
26199 subq $24, %rsp
26200 @@ -322,5 +327,7 @@ GLOBAL(return_to_handler)
26201 movq 8(%rsp), %rdx
26202 movq (%rsp), %rax
26203 addq $24, %rsp
26204 + pax_force_fptr %rdi
26205 jmp *%rdi
26206 +ENDPROC(return_to_handler)
26207 #endif
26208 diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
26209 index 005c03e..2f440cd 100644
26210 --- a/arch/x86/kernel/module.c
26211 +++ b/arch/x86/kernel/module.c
26212 @@ -75,17 +75,17 @@ static unsigned long int get_module_load_offset(void)
26213 }
26214 #endif
26215
26216 -void *module_alloc(unsigned long size)
26217 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
26218 {
26219 void *p;
26220
26221 - if (PAGE_ALIGN(size) > MODULES_LEN)
26222 + if (!size || PAGE_ALIGN(size) > MODULES_LEN)
26223 return NULL;
26224
26225 p = __vmalloc_node_range(size, MODULE_ALIGN,
26226 MODULES_VADDR + get_module_load_offset(),
26227 - MODULES_END, GFP_KERNEL | __GFP_HIGHMEM,
26228 - PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
26229 + MODULES_END, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
26230 + prot, 0, NUMA_NO_NODE,
26231 __builtin_return_address(0));
26232 if (p && (kasan_module_alloc(p, size) < 0)) {
26233 vfree(p);
26234 @@ -95,6 +95,51 @@ void *module_alloc(unsigned long size)
26235 return p;
26236 }
26237
26238 +void *module_alloc(unsigned long size)
26239 +{
26240 +
26241 +#ifdef CONFIG_PAX_KERNEXEC
26242 + return __module_alloc(size, PAGE_KERNEL);
26243 +#else
26244 + return __module_alloc(size, PAGE_KERNEL_EXEC);
26245 +#endif
26246 +
26247 +}
26248 +
26249 +#ifdef CONFIG_PAX_KERNEXEC
26250 +#ifdef CONFIG_X86_32
26251 +void *module_alloc_exec(unsigned long size)
26252 +{
26253 + struct vm_struct *area;
26254 +
26255 + if (size == 0)
26256 + return NULL;
26257 +
26258 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
26259 +return area ? area->addr : NULL;
26260 +}
26261 +EXPORT_SYMBOL(module_alloc_exec);
26262 +
26263 +void module_memfree_exec(void *module_region)
26264 +{
26265 + vunmap(module_region);
26266 +}
26267 +EXPORT_SYMBOL(module_memfree_exec);
26268 +#else
26269 +void module_memfree_exec(void *module_region)
26270 +{
26271 + module_memfree(module_region);
26272 +}
26273 +EXPORT_SYMBOL(module_memfree_exec);
26274 +
26275 +void *module_alloc_exec(unsigned long size)
26276 +{
26277 + return __module_alloc(size, PAGE_KERNEL_RX);
26278 +}
26279 +EXPORT_SYMBOL(module_alloc_exec);
26280 +#endif
26281 +#endif
26282 +
26283 #ifdef CONFIG_X86_32
26284 int apply_relocate(Elf32_Shdr *sechdrs,
26285 const char *strtab,
26286 @@ -105,14 +150,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
26287 unsigned int i;
26288 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
26289 Elf32_Sym *sym;
26290 - uint32_t *location;
26291 + uint32_t *plocation, location;
26292
26293 DEBUGP("Applying relocate section %u to %u\n",
26294 relsec, sechdrs[relsec].sh_info);
26295 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
26296 /* This is where to make the change */
26297 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
26298 - + rel[i].r_offset;
26299 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
26300 + location = (uint32_t)plocation;
26301 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
26302 + plocation = ktla_ktva((void *)plocation);
26303 /* This is the symbol it is referring to. Note that all
26304 undefined symbols have been resolved. */
26305 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
26306 @@ -121,11 +168,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
26307 switch (ELF32_R_TYPE(rel[i].r_info)) {
26308 case R_386_32:
26309 /* We add the value into the location given */
26310 - *location += sym->st_value;
26311 + pax_open_kernel();
26312 + *plocation += sym->st_value;
26313 + pax_close_kernel();
26314 break;
26315 case R_386_PC32:
26316 /* Add the value, subtract its position */
26317 - *location += sym->st_value - (uint32_t)location;
26318 + pax_open_kernel();
26319 + *plocation += sym->st_value - location;
26320 + pax_close_kernel();
26321 break;
26322 default:
26323 pr_err("%s: Unknown relocation: %u\n",
26324 @@ -170,21 +221,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
26325 case R_X86_64_NONE:
26326 break;
26327 case R_X86_64_64:
26328 + pax_open_kernel();
26329 *(u64 *)loc = val;
26330 + pax_close_kernel();
26331 break;
26332 case R_X86_64_32:
26333 + pax_open_kernel();
26334 *(u32 *)loc = val;
26335 + pax_close_kernel();
26336 if (val != *(u32 *)loc)
26337 goto overflow;
26338 break;
26339 case R_X86_64_32S:
26340 + pax_open_kernel();
26341 *(s32 *)loc = val;
26342 + pax_close_kernel();
26343 if ((s64)val != *(s32 *)loc)
26344 goto overflow;
26345 break;
26346 case R_X86_64_PC32:
26347 val -= (u64)loc;
26348 + pax_open_kernel();
26349 *(u32 *)loc = val;
26350 + pax_close_kernel();
26351 +
26352 #if 0
26353 if ((s64)val != *(s32 *)loc)
26354 goto overflow;
26355 diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
26356 index 113e707..0a690e1 100644
26357 --- a/arch/x86/kernel/msr.c
26358 +++ b/arch/x86/kernel/msr.c
26359 @@ -39,6 +39,7 @@
26360 #include <linux/notifier.h>
26361 #include <linux/uaccess.h>
26362 #include <linux/gfp.h>
26363 +#include <linux/grsecurity.h>
26364
26365 #include <asm/processor.h>
26366 #include <asm/msr.h>
26367 @@ -105,6 +106,11 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
26368 int err = 0;
26369 ssize_t bytes = 0;
26370
26371 +#ifdef CONFIG_GRKERNSEC_KMEM
26372 + gr_handle_msr_write();
26373 + return -EPERM;
26374 +#endif
26375 +
26376 if (count % 8)
26377 return -EINVAL; /* Invalid chunk size */
26378
26379 @@ -152,6 +158,10 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
26380 err = -EBADF;
26381 break;
26382 }
26383 +#ifdef CONFIG_GRKERNSEC_KMEM
26384 + gr_handle_msr_write();
26385 + return -EPERM;
26386 +#endif
26387 if (copy_from_user(&regs, uregs, sizeof regs)) {
26388 err = -EFAULT;
26389 break;
26390 @@ -235,7 +245,7 @@ static int msr_class_cpu_callback(struct notifier_block *nfb,
26391 return notifier_from_errno(err);
26392 }
26393
26394 -static struct notifier_block __refdata msr_class_cpu_notifier = {
26395 +static struct notifier_block msr_class_cpu_notifier = {
26396 .notifier_call = msr_class_cpu_callback,
26397 };
26398
26399 diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
26400 index c3e985d..f690edd 100644
26401 --- a/arch/x86/kernel/nmi.c
26402 +++ b/arch/x86/kernel/nmi.c
26403 @@ -98,16 +98,16 @@ fs_initcall(nmi_warning_debugfs);
26404
26405 static void nmi_max_handler(struct irq_work *w)
26406 {
26407 - struct nmiaction *a = container_of(w, struct nmiaction, irq_work);
26408 + struct nmiwork *n = container_of(w, struct nmiwork, irq_work);
26409 int remainder_ns, decimal_msecs;
26410 - u64 whole_msecs = ACCESS_ONCE(a->max_duration);
26411 + u64 whole_msecs = ACCESS_ONCE(n->max_duration);
26412
26413 remainder_ns = do_div(whole_msecs, (1000 * 1000));
26414 decimal_msecs = remainder_ns / 1000;
26415
26416 printk_ratelimited(KERN_INFO
26417 "INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n",
26418 - a->handler, whole_msecs, decimal_msecs);
26419 + n->action->handler, whole_msecs, decimal_msecs);
26420 }
26421
26422 static int nmi_handle(unsigned int type, struct pt_regs *regs, bool b2b)
26423 @@ -134,11 +134,11 @@ static int nmi_handle(unsigned int type, struct pt_regs *regs, bool b2b)
26424 delta = sched_clock() - delta;
26425 trace_nmi_handler(a->handler, (int)delta, thishandled);
26426
26427 - if (delta < nmi_longest_ns || delta < a->max_duration)
26428 + if (delta < nmi_longest_ns || delta < a->work->max_duration)
26429 continue;
26430
26431 - a->max_duration = delta;
26432 - irq_work_queue(&a->irq_work);
26433 + a->work->max_duration = delta;
26434 + irq_work_queue(&a->work->irq_work);
26435 }
26436
26437 rcu_read_unlock();
26438 @@ -148,7 +148,7 @@ static int nmi_handle(unsigned int type, struct pt_regs *regs, bool b2b)
26439 }
26440 NOKPROBE_SYMBOL(nmi_handle);
26441
26442 -int __register_nmi_handler(unsigned int type, struct nmiaction *action)
26443 +int __register_nmi_handler(unsigned int type, const struct nmiaction *action)
26444 {
26445 struct nmi_desc *desc = nmi_to_desc(type);
26446 unsigned long flags;
26447 @@ -156,7 +156,8 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
26448 if (!action->handler)
26449 return -EINVAL;
26450
26451 - init_irq_work(&action->irq_work, nmi_max_handler);
26452 + action->work->action = action;
26453 + init_irq_work(&action->work->irq_work, nmi_max_handler);
26454
26455 spin_lock_irqsave(&desc->lock, flags);
26456
26457 @@ -174,9 +175,9 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
26458 * event confuses some handlers (kdump uses this flag)
26459 */
26460 if (action->flags & NMI_FLAG_FIRST)
26461 - list_add_rcu(&action->list, &desc->head);
26462 + pax_list_add_rcu((struct list_head *)&action->list, &desc->head);
26463 else
26464 - list_add_tail_rcu(&action->list, &desc->head);
26465 + pax_list_add_tail_rcu((struct list_head *)&action->list, &desc->head);
26466
26467 spin_unlock_irqrestore(&desc->lock, flags);
26468 return 0;
26469 @@ -199,7 +200,7 @@ void unregister_nmi_handler(unsigned int type, const char *name)
26470 if (!strcmp(n->name, name)) {
26471 WARN(in_nmi(),
26472 "Trying to free NMI (%s) from NMI context!\n", n->name);
26473 - list_del_rcu(&n->list);
26474 + pax_list_del_rcu((struct list_head *)&n->list);
26475 break;
26476 }
26477 }
26478 @@ -408,15 +409,15 @@ static void default_do_nmi(struct pt_regs *regs)
26479 NOKPROBE_SYMBOL(default_do_nmi);
26480
26481 /*
26482 - * NMIs can hit breakpoints which will cause it to lose its
26483 - * NMI context with the CPU when the breakpoint does an iret.
26484 - */
26485 -#ifdef CONFIG_X86_32
26486 -/*
26487 - * For i386, NMIs use the same stack as the kernel, and we can
26488 - * add a workaround to the iret problem in C (preventing nested
26489 - * NMIs if an NMI takes a trap). Simply have 3 states the NMI
26490 - * can be in:
26491 + * NMIs can page fault or hit breakpoints which will cause it to lose
26492 + * its NMI context with the CPU when the breakpoint or page fault does an IRET.
26493 + *
26494 + * As a result, NMIs can nest if NMIs get unmasked due an IRET during
26495 + * NMI processing. On x86_64, the asm glue protects us from nested NMIs
26496 + * if the outer NMI came from kernel mode, but we can still nest if the
26497 + * outer NMI came from user mode.
26498 + *
26499 + * To handle these nested NMIs, we have three states:
26500 *
26501 * 1) not running
26502 * 2) executing
26503 @@ -430,15 +431,14 @@ NOKPROBE_SYMBOL(default_do_nmi);
26504 * (Note, the latch is binary, thus multiple NMIs triggering,
26505 * when one is running, are ignored. Only one NMI is restarted.)
26506 *
26507 - * If an NMI hits a breakpoint that executes an iret, another
26508 - * NMI can preempt it. We do not want to allow this new NMI
26509 - * to run, but we want to execute it when the first one finishes.
26510 - * We set the state to "latched", and the exit of the first NMI will
26511 - * perform a dec_return, if the result is zero (NOT_RUNNING), then
26512 - * it will simply exit the NMI handler. If not, the dec_return
26513 - * would have set the state to NMI_EXECUTING (what we want it to
26514 - * be when we are running). In this case, we simply jump back
26515 - * to rerun the NMI handler again, and restart the 'latched' NMI.
26516 + * If an NMI executes an iret, another NMI can preempt it. We do not
26517 + * want to allow this new NMI to run, but we want to execute it when the
26518 + * first one finishes. We set the state to "latched", and the exit of
26519 + * the first NMI will perform a dec_return, if the result is zero
26520 + * (NOT_RUNNING), then it will simply exit the NMI handler. If not, the
26521 + * dec_return would have set the state to NMI_EXECUTING (what we want it
26522 + * to be when we are running). In this case, we simply jump back to
26523 + * rerun the NMI handler again, and restart the 'latched' NMI.
26524 *
26525 * No trap (breakpoint or page fault) should be hit before nmi_restart,
26526 * thus there is no race between the first check of state for NOT_RUNNING
26527 @@ -461,49 +461,47 @@ enum nmi_states {
26528 static DEFINE_PER_CPU(enum nmi_states, nmi_state);
26529 static DEFINE_PER_CPU(unsigned long, nmi_cr2);
26530
26531 -#define nmi_nesting_preprocess(regs) \
26532 - do { \
26533 - if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) { \
26534 - this_cpu_write(nmi_state, NMI_LATCHED); \
26535 - return; \
26536 - } \
26537 - this_cpu_write(nmi_state, NMI_EXECUTING); \
26538 - this_cpu_write(nmi_cr2, read_cr2()); \
26539 - } while (0); \
26540 - nmi_restart:
26541 -
26542 -#define nmi_nesting_postprocess() \
26543 - do { \
26544 - if (unlikely(this_cpu_read(nmi_cr2) != read_cr2())) \
26545 - write_cr2(this_cpu_read(nmi_cr2)); \
26546 - if (this_cpu_dec_return(nmi_state)) \
26547 - goto nmi_restart; \
26548 - } while (0)
26549 -#else /* x86_64 */
26550 +#ifdef CONFIG_X86_64
26551 /*
26552 - * In x86_64 things are a bit more difficult. This has the same problem
26553 - * where an NMI hitting a breakpoint that calls iret will remove the
26554 - * NMI context, allowing a nested NMI to enter. What makes this more
26555 - * difficult is that both NMIs and breakpoints have their own stack.
26556 - * When a new NMI or breakpoint is executed, the stack is set to a fixed
26557 - * point. If an NMI is nested, it will have its stack set at that same
26558 - * fixed address that the first NMI had, and will start corrupting the
26559 - * stack. This is handled in entry_64.S, but the same problem exists with
26560 - * the breakpoint stack.
26561 + * In x86_64, we need to handle breakpoint -> NMI -> breakpoint. Without
26562 + * some care, the inner breakpoint will clobber the outer breakpoint's
26563 + * stack.
26564 *
26565 - * If a breakpoint is being processed, and the debug stack is being used,
26566 - * if an NMI comes in and also hits a breakpoint, the stack pointer
26567 - * will be set to the same fixed address as the breakpoint that was
26568 - * interrupted, causing that stack to be corrupted. To handle this case,
26569 - * check if the stack that was interrupted is the debug stack, and if
26570 - * so, change the IDT so that new breakpoints will use the current stack
26571 - * and not switch to the fixed address. On return of the NMI, switch back
26572 - * to the original IDT.
26573 + * If a breakpoint is being processed, and the debug stack is being
26574 + * used, if an NMI comes in and also hits a breakpoint, the stack
26575 + * pointer will be set to the same fixed address as the breakpoint that
26576 + * was interrupted, causing that stack to be corrupted. To handle this
26577 + * case, check if the stack that was interrupted is the debug stack, and
26578 + * if so, change the IDT so that new breakpoints will use the current
26579 + * stack and not switch to the fixed address. On return of the NMI,
26580 + * switch back to the original IDT.
26581 */
26582 static DEFINE_PER_CPU(int, update_debug_stack);
26583 +#endif
26584
26585 -static inline void nmi_nesting_preprocess(struct pt_regs *regs)
26586 +dotraplinkage notrace void
26587 +do_nmi(struct pt_regs *regs, long error_code)
26588 {
26589 +
26590 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
26591 + if (!user_mode(regs)) {
26592 + unsigned long cs = regs->cs & 0xFFFF;
26593 + unsigned long ip = ktva_ktla(regs->ip);
26594 +
26595 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
26596 + regs->ip = ip;
26597 + }
26598 +#endif
26599 +
26600 + if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {
26601 + this_cpu_write(nmi_state, NMI_LATCHED);
26602 + return;
26603 + }
26604 + this_cpu_write(nmi_state, NMI_EXECUTING);
26605 + this_cpu_write(nmi_cr2, read_cr2());
26606 +nmi_restart:
26607 +
26608 +#ifdef CONFIG_X86_64
26609 /*
26610 * If we interrupted a breakpoint, it is possible that
26611 * the nmi handler will have breakpoints too. We need to
26612 @@ -514,22 +512,8 @@ static inline void nmi_nesting_preprocess(struct pt_regs *regs)
26613 debug_stack_set_zero();
26614 this_cpu_write(update_debug_stack, 1);
26615 }
26616 -}
26617 -
26618 -static inline void nmi_nesting_postprocess(void)
26619 -{
26620 - if (unlikely(this_cpu_read(update_debug_stack))) {
26621 - debug_stack_reset();
26622 - this_cpu_write(update_debug_stack, 0);
26623 - }
26624 -}
26625 #endif
26626
26627 -dotraplinkage notrace void
26628 -do_nmi(struct pt_regs *regs, long error_code)
26629 -{
26630 - nmi_nesting_preprocess(regs);
26631 -
26632 nmi_enter();
26633
26634 inc_irq_stat(__nmi_count);
26635 @@ -539,8 +523,17 @@ do_nmi(struct pt_regs *regs, long error_code)
26636
26637 nmi_exit();
26638
26639 - /* On i386, may loop back to preprocess */
26640 - nmi_nesting_postprocess();
26641 +#ifdef CONFIG_X86_64
26642 + if (unlikely(this_cpu_read(update_debug_stack))) {
26643 + debug_stack_reset();
26644 + this_cpu_write(update_debug_stack, 0);
26645 + }
26646 +#endif
26647 +
26648 + if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))
26649 + write_cr2(this_cpu_read(nmi_cr2));
26650 + if (this_cpu_dec_return(nmi_state))
26651 + goto nmi_restart;
26652 }
26653 NOKPROBE_SYMBOL(do_nmi);
26654
26655 diff --git a/arch/x86/kernel/nmi_selftest.c b/arch/x86/kernel/nmi_selftest.c
26656 index 6d9582e..f746287 100644
26657 --- a/arch/x86/kernel/nmi_selftest.c
26658 +++ b/arch/x86/kernel/nmi_selftest.c
26659 @@ -43,7 +43,7 @@ static void __init init_nmi_testsuite(void)
26660 {
26661 /* trap all the unknown NMIs we may generate */
26662 register_nmi_handler(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk",
26663 - __initdata);
26664 + __initconst);
26665 }
26666
26667 static void __init cleanup_nmi_testsuite(void)
26668 @@ -66,7 +66,7 @@ static void __init test_nmi_ipi(struct cpumask *mask)
26669 unsigned long timeout;
26670
26671 if (register_nmi_handler(NMI_LOCAL, test_nmi_ipi_callback,
26672 - NMI_FLAG_FIRST, "nmi_selftest", __initdata)) {
26673 + NMI_FLAG_FIRST, "nmi_selftest", __initconst)) {
26674 nmi_fail = FAILURE;
26675 return;
26676 }
26677 diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
26678 index bbb6c73..24a58ef 100644
26679 --- a/arch/x86/kernel/paravirt-spinlocks.c
26680 +++ b/arch/x86/kernel/paravirt-spinlocks.c
26681 @@ -8,7 +8,7 @@
26682
26683 #include <asm/paravirt.h>
26684
26685 -struct pv_lock_ops pv_lock_ops = {
26686 +struct pv_lock_ops pv_lock_ops __read_only = {
26687 #ifdef CONFIG_SMP
26688 .lock_spinning = __PV_IS_CALLEE_SAVE(paravirt_nop),
26689 .unlock_kick = paravirt_nop,
26690 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
26691 index c614dd4..9ad659e 100644
26692 --- a/arch/x86/kernel/paravirt.c
26693 +++ b/arch/x86/kernel/paravirt.c
26694 @@ -56,6 +56,9 @@ u64 _paravirt_ident_64(u64 x)
26695 {
26696 return x;
26697 }
26698 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
26699 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
26700 +#endif
26701
26702 void __init default_banner(void)
26703 {
26704 @@ -142,16 +145,20 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
26705
26706 if (opfunc == NULL)
26707 /* If there's no function, patch it with a ud2a (BUG) */
26708 - ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
26709 - else if (opfunc == _paravirt_nop)
26710 + ret = paravirt_patch_insns(insnbuf, len, ktva_ktla(ud2a), ud2a+sizeof(ud2a));
26711 + else if (opfunc == (void *)_paravirt_nop)
26712 /* If the operation is a nop, then nop the callsite */
26713 ret = paravirt_patch_nop();
26714
26715 /* identity functions just return their single argument */
26716 - else if (opfunc == _paravirt_ident_32)
26717 + else if (opfunc == (void *)_paravirt_ident_32)
26718 ret = paravirt_patch_ident_32(insnbuf, len);
26719 - else if (opfunc == _paravirt_ident_64)
26720 + else if (opfunc == (void *)_paravirt_ident_64)
26721 ret = paravirt_patch_ident_64(insnbuf, len);
26722 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
26723 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
26724 + ret = paravirt_patch_ident_64(insnbuf, len);
26725 +#endif
26726
26727 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
26728 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
26729 @@ -176,7 +183,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
26730 if (insn_len > len || start == NULL)
26731 insn_len = len;
26732 else
26733 - memcpy(insnbuf, start, insn_len);
26734 + memcpy(insnbuf, ktla_ktva(start), insn_len);
26735
26736 return insn_len;
26737 }
26738 @@ -300,7 +307,7 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
26739 return this_cpu_read(paravirt_lazy_mode);
26740 }
26741
26742 -struct pv_info pv_info = {
26743 +struct pv_info pv_info __read_only = {
26744 .name = "bare hardware",
26745 .paravirt_enabled = 0,
26746 .kernel_rpl = 0,
26747 @@ -311,16 +318,16 @@ struct pv_info pv_info = {
26748 #endif
26749 };
26750
26751 -struct pv_init_ops pv_init_ops = {
26752 +struct pv_init_ops pv_init_ops __read_only = {
26753 .patch = native_patch,
26754 };
26755
26756 -struct pv_time_ops pv_time_ops = {
26757 +struct pv_time_ops pv_time_ops __read_only = {
26758 .sched_clock = native_sched_clock,
26759 .steal_clock = native_steal_clock,
26760 };
26761
26762 -__visible struct pv_irq_ops pv_irq_ops = {
26763 +__visible struct pv_irq_ops pv_irq_ops __read_only = {
26764 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
26765 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
26766 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
26767 @@ -332,7 +339,7 @@ __visible struct pv_irq_ops pv_irq_ops = {
26768 #endif
26769 };
26770
26771 -__visible struct pv_cpu_ops pv_cpu_ops = {
26772 +__visible struct pv_cpu_ops pv_cpu_ops __read_only = {
26773 .cpuid = native_cpuid,
26774 .get_debugreg = native_get_debugreg,
26775 .set_debugreg = native_set_debugreg,
26776 @@ -395,21 +402,26 @@ NOKPROBE_SYMBOL(native_get_debugreg);
26777 NOKPROBE_SYMBOL(native_set_debugreg);
26778 NOKPROBE_SYMBOL(native_load_idt);
26779
26780 -struct pv_apic_ops pv_apic_ops = {
26781 +struct pv_apic_ops pv_apic_ops __read_only= {
26782 #ifdef CONFIG_X86_LOCAL_APIC
26783 .startup_ipi_hook = paravirt_nop,
26784 #endif
26785 };
26786
26787 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
26788 +#ifdef CONFIG_X86_32
26789 +#ifdef CONFIG_X86_PAE
26790 +/* 64-bit pagetable entries */
26791 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
26792 +#else
26793 /* 32-bit pagetable entries */
26794 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
26795 +#endif
26796 #else
26797 /* 64-bit pagetable entries */
26798 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
26799 #endif
26800
26801 -struct pv_mmu_ops pv_mmu_ops = {
26802 +struct pv_mmu_ops pv_mmu_ops __read_only = {
26803
26804 .read_cr2 = native_read_cr2,
26805 .write_cr2 = native_write_cr2,
26806 @@ -459,6 +471,7 @@ struct pv_mmu_ops pv_mmu_ops = {
26807 .make_pud = PTE_IDENT,
26808
26809 .set_pgd = native_set_pgd,
26810 + .set_pgd_batched = native_set_pgd_batched,
26811 #endif
26812 #endif /* CONFIG_PGTABLE_LEVELS >= 3 */
26813
26814 @@ -479,6 +492,12 @@ struct pv_mmu_ops pv_mmu_ops = {
26815 },
26816
26817 .set_fixmap = native_set_fixmap,
26818 +
26819 +#ifdef CONFIG_PAX_KERNEXEC
26820 + .pax_open_kernel = native_pax_open_kernel,
26821 + .pax_close_kernel = native_pax_close_kernel,
26822 +#endif
26823 +
26824 };
26825
26826 EXPORT_SYMBOL_GPL(pv_time_ops);
26827 diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
26828 index a1da673..b6f5831 100644
26829 --- a/arch/x86/kernel/paravirt_patch_64.c
26830 +++ b/arch/x86/kernel/paravirt_patch_64.c
26831 @@ -9,7 +9,11 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
26832 DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
26833 DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
26834 DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
26835 +
26836 +#ifndef CONFIG_PAX_MEMORY_UDEREF
26837 DEF_NATIVE(pv_mmu_ops, flush_tlb_single, "invlpg (%rdi)");
26838 +#endif
26839 +
26840 DEF_NATIVE(pv_cpu_ops, clts, "clts");
26841 DEF_NATIVE(pv_cpu_ops, wbinvd, "wbinvd");
26842
26843 @@ -57,7 +61,11 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
26844 PATCH_SITE(pv_mmu_ops, read_cr3);
26845 PATCH_SITE(pv_mmu_ops, write_cr3);
26846 PATCH_SITE(pv_cpu_ops, clts);
26847 +
26848 +#ifndef CONFIG_PAX_MEMORY_UDEREF
26849 PATCH_SITE(pv_mmu_ops, flush_tlb_single);
26850 +#endif
26851 +
26852 PATCH_SITE(pv_cpu_ops, wbinvd);
26853
26854 patch_site:
26855 diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
26856 index 0497f71..7186c0d 100644
26857 --- a/arch/x86/kernel/pci-calgary_64.c
26858 +++ b/arch/x86/kernel/pci-calgary_64.c
26859 @@ -1347,7 +1347,7 @@ static void __init get_tce_space_from_tar(void)
26860 tce_space = be64_to_cpu(readq(target));
26861 tce_space = tce_space & TAR_SW_BITS;
26862
26863 - tce_space = tce_space & (~specified_table_size);
26864 + tce_space = tce_space & (~(unsigned long)specified_table_size);
26865 info->tce_space = (u64 *)__va(tce_space);
26866 }
26867 }
26868 diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
26869 index 35ccf75..7a15747 100644
26870 --- a/arch/x86/kernel/pci-iommu_table.c
26871 +++ b/arch/x86/kernel/pci-iommu_table.c
26872 @@ -2,7 +2,7 @@
26873 #include <asm/iommu_table.h>
26874 #include <linux/string.h>
26875 #include <linux/kallsyms.h>
26876 -
26877 +#include <linux/sched.h>
26878
26879 #define DEBUG 1
26880
26881 diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
26882 index 77dd0ad..9ec4723 100644
26883 --- a/arch/x86/kernel/pci-swiotlb.c
26884 +++ b/arch/x86/kernel/pci-swiotlb.c
26885 @@ -33,7 +33,7 @@ void x86_swiotlb_free_coherent(struct device *dev, size_t size,
26886 struct dma_attrs *attrs)
26887 {
26888 if (is_swiotlb_buffer(dma_to_phys(dev, dma_addr)))
26889 - swiotlb_free_coherent(dev, size, vaddr, dma_addr);
26890 + swiotlb_free_coherent(dev, size, vaddr, dma_addr, attrs);
26891 else
26892 dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs);
26893 }
26894 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
26895 index 6e338e3..82f946e 100644
26896 --- a/arch/x86/kernel/process.c
26897 +++ b/arch/x86/kernel/process.c
26898 @@ -38,7 +38,8 @@
26899 * section. Since TSS's are completely CPU-local, we want them
26900 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
26901 */
26902 -__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss) = {
26903 +struct tss_struct cpu_tss[NR_CPUS] __visible ____cacheline_internodealigned_in_smp = {
26904 + [0 ... NR_CPUS-1] = {
26905 .x86_tss = {
26906 .sp0 = TOP_OF_INIT_STACK,
26907 #ifdef CONFIG_X86_32
26908 @@ -56,6 +57,7 @@ __visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss) = {
26909 */
26910 .io_bitmap = { [0 ... IO_BITMAP_LONGS] = ~0 },
26911 #endif
26912 +}
26913 };
26914 EXPORT_PER_CPU_SYMBOL(cpu_tss);
26915
26916 @@ -115,7 +117,7 @@ void arch_task_cache_init(void)
26917 task_xstate_cachep =
26918 kmem_cache_create("task_xstate", xstate_size,
26919 __alignof__(union thread_xstate),
26920 - SLAB_PANIC | SLAB_NOTRACK, NULL);
26921 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
26922 setup_xstate_comp();
26923 }
26924
26925 @@ -129,7 +131,7 @@ void exit_thread(void)
26926 unsigned long *bp = t->io_bitmap_ptr;
26927
26928 if (bp) {
26929 - struct tss_struct *tss = &per_cpu(cpu_tss, get_cpu());
26930 + struct tss_struct *tss = cpu_tss + get_cpu();
26931
26932 t->io_bitmap_ptr = NULL;
26933 clear_thread_flag(TIF_IO_BITMAP);
26934 @@ -149,6 +151,9 @@ void flush_thread(void)
26935 {
26936 struct task_struct *tsk = current;
26937
26938 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
26939 + loadsegment(gs, 0);
26940 +#endif
26941 flush_ptrace_hw_breakpoint(tsk);
26942 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
26943
26944 @@ -302,7 +307,7 @@ static void __exit_idle(void)
26945 void exit_idle(void)
26946 {
26947 /* idle loop has pid 0 */
26948 - if (current->pid)
26949 + if (task_pid_nr(current))
26950 return;
26951 __exit_idle();
26952 }
26953 @@ -355,7 +360,7 @@ bool xen_set_default_idle(void)
26954 return ret;
26955 }
26956 #endif
26957 -void stop_this_cpu(void *dummy)
26958 +__noreturn void stop_this_cpu(void *dummy)
26959 {
26960 local_irq_disable();
26961 /*
26962 @@ -531,16 +536,43 @@ static int __init idle_setup(char *str)
26963 }
26964 early_param("idle", idle_setup);
26965
26966 -unsigned long arch_align_stack(unsigned long sp)
26967 -{
26968 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
26969 - sp -= get_random_int() % 8192;
26970 - return sp & ~0xf;
26971 -}
26972 -
26973 unsigned long arch_randomize_brk(struct mm_struct *mm)
26974 {
26975 unsigned long range_end = mm->brk + 0x02000000;
26976 return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
26977 }
26978
26979 +#ifdef CONFIG_PAX_RANDKSTACK
26980 +void pax_randomize_kstack(struct pt_regs *regs)
26981 +{
26982 + struct thread_struct *thread = &current->thread;
26983 + unsigned long time;
26984 +
26985 + if (!randomize_va_space)
26986 + return;
26987 +
26988 + if (v8086_mode(regs))
26989 + return;
26990 +
26991 + rdtscl(time);
26992 +
26993 + /* P4 seems to return a 0 LSB, ignore it */
26994 +#ifdef CONFIG_MPENTIUM4
26995 + time &= 0x3EUL;
26996 + time <<= 2;
26997 +#elif defined(CONFIG_X86_64)
26998 + time &= 0xFUL;
26999 + time <<= 4;
27000 +#else
27001 + time &= 0x1FUL;
27002 + time <<= 3;
27003 +#endif
27004 +
27005 + thread->sp0 ^= time;
27006 + load_sp0(cpu_tss + smp_processor_id(), thread);
27007 +
27008 +#ifdef CONFIG_X86_64
27009 + this_cpu_write(kernel_stack, thread->sp0);
27010 +#endif
27011 +}
27012 +#endif
27013 diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
27014 index 8ed2106..1345704 100644
27015 --- a/arch/x86/kernel/process_32.c
27016 +++ b/arch/x86/kernel/process_32.c
27017 @@ -64,6 +64,7 @@ asmlinkage void ret_from_kernel_thread(void) __asm__("ret_from_kernel_thread");
27018 unsigned long thread_saved_pc(struct task_struct *tsk)
27019 {
27020 return ((unsigned long *)tsk->thread.sp)[3];
27021 +//XXX return tsk->thread.eip;
27022 }
27023
27024 void __show_regs(struct pt_regs *regs, int all)
27025 @@ -76,16 +77,15 @@ void __show_regs(struct pt_regs *regs, int all)
27026 if (user_mode(regs)) {
27027 sp = regs->sp;
27028 ss = regs->ss & 0xffff;
27029 - gs = get_user_gs(regs);
27030 } else {
27031 sp = kernel_stack_pointer(regs);
27032 savesegment(ss, ss);
27033 - savesegment(gs, gs);
27034 }
27035 + gs = get_user_gs(regs);
27036
27037 printk(KERN_DEFAULT "EIP: %04x:[<%08lx>] EFLAGS: %08lx CPU: %d\n",
27038 (u16)regs->cs, regs->ip, regs->flags,
27039 - smp_processor_id());
27040 + raw_smp_processor_id());
27041 print_symbol("EIP is at %s\n", regs->ip);
27042
27043 printk(KERN_DEFAULT "EAX: %08lx EBX: %08lx ECX: %08lx EDX: %08lx\n",
27044 @@ -132,21 +132,22 @@ void release_thread(struct task_struct *dead_task)
27045 int copy_thread(unsigned long clone_flags, unsigned long sp,
27046 unsigned long arg, struct task_struct *p)
27047 {
27048 - struct pt_regs *childregs = task_pt_regs(p);
27049 + struct pt_regs *childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
27050 struct task_struct *tsk;
27051 int err;
27052
27053 p->thread.sp = (unsigned long) childregs;
27054 p->thread.sp0 = (unsigned long) (childregs+1);
27055 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p) + 2 * sizeof(unsigned long);
27056 memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
27057
27058 if (unlikely(p->flags & PF_KTHREAD)) {
27059 /* kernel thread */
27060 memset(childregs, 0, sizeof(struct pt_regs));
27061 p->thread.ip = (unsigned long) ret_from_kernel_thread;
27062 - task_user_gs(p) = __KERNEL_STACK_CANARY;
27063 - childregs->ds = __USER_DS;
27064 - childregs->es = __USER_DS;
27065 + savesegment(gs, childregs->gs);
27066 + childregs->ds = __KERNEL_DS;
27067 + childregs->es = __KERNEL_DS;
27068 childregs->fs = __KERNEL_PERCPU;
27069 childregs->bx = sp; /* function */
27070 childregs->bp = arg;
27071 @@ -244,7 +245,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27072 struct thread_struct *prev = &prev_p->thread,
27073 *next = &next_p->thread;
27074 int cpu = smp_processor_id();
27075 - struct tss_struct *tss = &per_cpu(cpu_tss, cpu);
27076 + struct tss_struct *tss = cpu_tss + cpu;
27077 fpu_switch_t fpu;
27078
27079 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
27080 @@ -263,6 +264,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27081 */
27082 lazy_save_gs(prev->gs);
27083
27084 +#ifdef CONFIG_PAX_MEMORY_UDEREF
27085 + __set_fs(task_thread_info(next_p)->addr_limit);
27086 +#endif
27087 +
27088 /*
27089 * Load the per-thread Thread-Local Storage descriptor.
27090 */
27091 @@ -306,12 +311,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27092 * current_thread_info().
27093 */
27094 load_sp0(tss, next);
27095 - this_cpu_write(kernel_stack,
27096 - (unsigned long)task_stack_page(next_p) +
27097 - THREAD_SIZE);
27098 - this_cpu_write(cpu_current_top_of_stack,
27099 - (unsigned long)task_stack_page(next_p) +
27100 - THREAD_SIZE);
27101 + this_cpu_write(current_task, next_p);
27102 + this_cpu_write(current_tinfo, &next_p->tinfo);
27103 + this_cpu_write(kernel_stack, next->sp0);
27104 + this_cpu_write(cpu_current_top_of_stack, next->sp0);
27105
27106 /*
27107 * Restore %gs if needed (which is common)
27108 @@ -321,8 +324,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27109
27110 switch_fpu_finish(next_p, fpu);
27111
27112 - this_cpu_write(current_task, next_p);
27113 -
27114 return prev_p;
27115 }
27116
27117 @@ -352,4 +353,3 @@ unsigned long get_wchan(struct task_struct *p)
27118 } while (count++ < 16);
27119 return 0;
27120 }
27121 -
27122 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
27123 index ddfdbf7..625417c 100644
27124 --- a/arch/x86/kernel/process_64.c
27125 +++ b/arch/x86/kernel/process_64.c
27126 @@ -158,9 +158,10 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
27127 struct pt_regs *childregs;
27128 struct task_struct *me = current;
27129
27130 - p->thread.sp0 = (unsigned long)task_stack_page(p) + THREAD_SIZE;
27131 + p->thread.sp0 = (unsigned long)task_stack_page(p) + THREAD_SIZE - 16;
27132 childregs = task_pt_regs(p);
27133 p->thread.sp = (unsigned long) childregs;
27134 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p) + 2 * sizeof(unsigned long);
27135 set_tsk_thread_flag(p, TIF_FORK);
27136 p->thread.io_bitmap_ptr = NULL;
27137
27138 @@ -170,6 +171,8 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
27139 p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs;
27140 savesegment(es, p->thread.es);
27141 savesegment(ds, p->thread.ds);
27142 + savesegment(ss, p->thread.ss);
27143 + BUG_ON(p->thread.ss == __UDEREF_KERNEL_DS);
27144 memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
27145
27146 if (unlikely(p->flags & PF_KTHREAD)) {
27147 @@ -275,7 +278,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27148 struct thread_struct *prev = &prev_p->thread;
27149 struct thread_struct *next = &next_p->thread;
27150 int cpu = smp_processor_id();
27151 - struct tss_struct *tss = &per_cpu(cpu_tss, cpu);
27152 + struct tss_struct *tss = cpu_tss + cpu;
27153 unsigned fsindex, gsindex;
27154 fpu_switch_t fpu;
27155
27156 @@ -326,6 +329,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27157 if (unlikely(next->ds | prev->ds))
27158 loadsegment(ds, next->ds);
27159
27160 + savesegment(ss, prev->ss);
27161 + if (unlikely(next->ss != prev->ss))
27162 + loadsegment(ss, next->ss);
27163 +
27164 /*
27165 * Switch FS and GS.
27166 *
27167 @@ -397,6 +404,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27168 * Switch the PDA and FPU contexts.
27169 */
27170 this_cpu_write(current_task, next_p);
27171 + this_cpu_write(current_tinfo, &next_p->tinfo);
27172
27173 /*
27174 * If it were not for PREEMPT_ACTIVE we could guarantee that the
27175 @@ -409,8 +417,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
27176 /* Reload esp0 and ss1. This changes current_thread_info(). */
27177 load_sp0(tss, next);
27178
27179 - this_cpu_write(kernel_stack,
27180 - (unsigned long)task_stack_page(next_p) + THREAD_SIZE);
27181 + this_cpu_write(kernel_stack, next->sp0);
27182
27183 /*
27184 * Now maybe reload the debug registers and handle I/O bitmaps
27185 @@ -508,12 +515,11 @@ unsigned long get_wchan(struct task_struct *p)
27186 if (!p || p == current || p->state == TASK_RUNNING)
27187 return 0;
27188 stack = (unsigned long)task_stack_page(p);
27189 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
27190 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
27191 return 0;
27192 fp = *(u64 *)(p->thread.sp);
27193 do {
27194 - if (fp < (unsigned long)stack ||
27195 - fp >= (unsigned long)stack+THREAD_SIZE)
27196 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
27197 return 0;
27198 ip = *(u64 *)(fp+8);
27199 if (!in_sched_functions(ip))
27200 diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
27201 index a7bc794..094ee8e 100644
27202 --- a/arch/x86/kernel/ptrace.c
27203 +++ b/arch/x86/kernel/ptrace.c
27204 @@ -186,10 +186,10 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
27205 unsigned long sp = (unsigned long)&regs->sp;
27206 u32 *prev_esp;
27207
27208 - if (context == (sp & ~(THREAD_SIZE - 1)))
27209 + if (context == ((sp + 8) & ~(THREAD_SIZE - 1)))
27210 return sp;
27211
27212 - prev_esp = (u32 *)(context);
27213 + prev_esp = *(u32 **)(context);
27214 if (prev_esp)
27215 return (unsigned long)prev_esp;
27216
27217 @@ -446,6 +446,20 @@ static int putreg(struct task_struct *child,
27218 if (child->thread.gs != value)
27219 return do_arch_prctl(child, ARCH_SET_GS, value);
27220 return 0;
27221 +
27222 + case offsetof(struct user_regs_struct,ip):
27223 + /*
27224 + * Protect against any attempt to set ip to an
27225 + * impossible address. There are dragons lurking if the
27226 + * address is noncanonical. (This explicitly allows
27227 + * setting ip to TASK_SIZE_MAX, because user code can do
27228 + * that all by itself by running off the end of its
27229 + * address space.
27230 + */
27231 + if (value > TASK_SIZE_MAX)
27232 + return -EIO;
27233 + break;
27234 +
27235 #endif
27236 }
27237
27238 @@ -582,7 +596,7 @@ static void ptrace_triggered(struct perf_event *bp,
27239 static unsigned long ptrace_get_dr7(struct perf_event *bp[])
27240 {
27241 int i;
27242 - int dr7 = 0;
27243 + unsigned long dr7 = 0;
27244 struct arch_hw_breakpoint *info;
27245
27246 for (i = 0; i < HBP_NUM; i++) {
27247 @@ -816,7 +830,7 @@ long arch_ptrace(struct task_struct *child, long request,
27248 unsigned long addr, unsigned long data)
27249 {
27250 int ret;
27251 - unsigned long __user *datap = (unsigned long __user *)data;
27252 + unsigned long __user *datap = (__force unsigned long __user *)data;
27253
27254 switch (request) {
27255 /* read the word at location addr in the USER area. */
27256 @@ -901,14 +915,14 @@ long arch_ptrace(struct task_struct *child, long request,
27257 if ((int) addr < 0)
27258 return -EIO;
27259 ret = do_get_thread_area(child, addr,
27260 - (struct user_desc __user *)data);
27261 + (__force struct user_desc __user *) data);
27262 break;
27263
27264 case PTRACE_SET_THREAD_AREA:
27265 if ((int) addr < 0)
27266 return -EIO;
27267 ret = do_set_thread_area(child, addr,
27268 - (struct user_desc __user *)data, 0);
27269 + (__force struct user_desc __user *) data, 0);
27270 break;
27271 #endif
27272
27273 @@ -1286,7 +1300,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
27274
27275 #ifdef CONFIG_X86_64
27276
27277 -static struct user_regset x86_64_regsets[] __read_mostly = {
27278 +static user_regset_no_const x86_64_regsets[] __read_only = {
27279 [REGSET_GENERAL] = {
27280 .core_note_type = NT_PRSTATUS,
27281 .n = sizeof(struct user_regs_struct) / sizeof(long),
27282 @@ -1327,7 +1341,7 @@ static const struct user_regset_view user_x86_64_view = {
27283 #endif /* CONFIG_X86_64 */
27284
27285 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
27286 -static struct user_regset x86_32_regsets[] __read_mostly = {
27287 +static user_regset_no_const x86_32_regsets[] __read_only = {
27288 [REGSET_GENERAL] = {
27289 .core_note_type = NT_PRSTATUS,
27290 .n = sizeof(struct user_regs_struct32) / sizeof(u32),
27291 @@ -1380,7 +1394,7 @@ static const struct user_regset_view user_x86_32_view = {
27292 */
27293 u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
27294
27295 -void update_regset_xstate_info(unsigned int size, u64 xstate_mask)
27296 +void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
27297 {
27298 #ifdef CONFIG_X86_64
27299 x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
27300 @@ -1415,7 +1429,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
27301 memset(info, 0, sizeof(*info));
27302 info->si_signo = SIGTRAP;
27303 info->si_code = si_code;
27304 - info->si_addr = user_mode(regs) ? (void __user *)regs->ip : NULL;
27305 + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
27306 }
27307
27308 void user_single_step_siginfo(struct task_struct *tsk,
27309 @@ -1449,6 +1463,10 @@ static void do_audit_syscall_entry(struct pt_regs *regs, u32 arch)
27310 }
27311 }
27312
27313 +#ifdef CONFIG_GRKERNSEC_SETXID
27314 +extern void gr_delayed_cred_worker(void);
27315 +#endif
27316 +
27317 /*
27318 * We can return 0 to resume the syscall or anything else to go to phase
27319 * 2. If we resume the syscall, we need to put something appropriate in
27320 @@ -1556,6 +1574,11 @@ long syscall_trace_enter_phase2(struct pt_regs *regs, u32 arch,
27321
27322 BUG_ON(regs != task_pt_regs(current));
27323
27324 +#ifdef CONFIG_GRKERNSEC_SETXID
27325 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
27326 + gr_delayed_cred_worker();
27327 +#endif
27328 +
27329 /*
27330 * If we stepped into a sysenter/syscall insn, it trapped in
27331 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
27332 @@ -1614,6 +1637,11 @@ void syscall_trace_leave(struct pt_regs *regs)
27333 */
27334 user_exit();
27335
27336 +#ifdef CONFIG_GRKERNSEC_SETXID
27337 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
27338 + gr_delayed_cred_worker();
27339 +#endif
27340 +
27341 audit_syscall_exit(regs);
27342
27343 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
27344 diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
27345 index 2f355d2..e75ed0a 100644
27346 --- a/arch/x86/kernel/pvclock.c
27347 +++ b/arch/x86/kernel/pvclock.c
27348 @@ -51,11 +51,11 @@ void pvclock_touch_watchdogs(void)
27349 reset_hung_task_detector();
27350 }
27351
27352 -static atomic64_t last_value = ATOMIC64_INIT(0);
27353 +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
27354
27355 void pvclock_resume(void)
27356 {
27357 - atomic64_set(&last_value, 0);
27358 + atomic64_set_unchecked(&last_value, 0);
27359 }
27360
27361 u8 pvclock_read_flags(struct pvclock_vcpu_time_info *src)
27362 @@ -105,11 +105,11 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
27363 * updating at the same time, and one of them could be slightly behind,
27364 * making the assumption that last_value always go forward fail to hold.
27365 */
27366 - last = atomic64_read(&last_value);
27367 + last = atomic64_read_unchecked(&last_value);
27368 do {
27369 if (ret < last)
27370 return last;
27371 - last = atomic64_cmpxchg(&last_value, last, ret);
27372 + last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
27373 } while (unlikely(last != ret));
27374
27375 return ret;
27376 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
27377 index 86db4bc..a50a54a 100644
27378 --- a/arch/x86/kernel/reboot.c
27379 +++ b/arch/x86/kernel/reboot.c
27380 @@ -70,6 +70,11 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
27381
27382 void __noreturn machine_real_restart(unsigned int type)
27383 {
27384 +
27385 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
27386 + struct desc_struct *gdt;
27387 +#endif
27388 +
27389 local_irq_disable();
27390
27391 /*
27392 @@ -97,7 +102,29 @@ void __noreturn machine_real_restart(unsigned int type)
27393
27394 /* Jump to the identity-mapped low memory code */
27395 #ifdef CONFIG_X86_32
27396 - asm volatile("jmpl *%0" : :
27397 +
27398 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
27399 + gdt = get_cpu_gdt_table(smp_processor_id());
27400 + pax_open_kernel();
27401 +#ifdef CONFIG_PAX_MEMORY_UDEREF
27402 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
27403 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
27404 + loadsegment(ds, __KERNEL_DS);
27405 + loadsegment(es, __KERNEL_DS);
27406 + loadsegment(ss, __KERNEL_DS);
27407 +#endif
27408 +#ifdef CONFIG_PAX_KERNEXEC
27409 + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
27410 + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
27411 + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
27412 + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
27413 + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
27414 + gdt[GDT_ENTRY_KERNEL_CS].g = 1;
27415 +#endif
27416 + pax_close_kernel();
27417 +#endif
27418 +
27419 + asm volatile("ljmpl *%0" : :
27420 "rm" (real_mode_header->machine_real_restart_asm),
27421 "a" (type));
27422 #else
27423 @@ -137,7 +164,7 @@ static int __init set_kbd_reboot(const struct dmi_system_id *d)
27424 /*
27425 * This is a single dmi_table handling all reboot quirks.
27426 */
27427 -static struct dmi_system_id __initdata reboot_dmi_table[] = {
27428 +static const struct dmi_system_id __initconst reboot_dmi_table[] = {
27429
27430 /* Acer */
27431 { /* Handle reboot issue on Acer Aspire one */
27432 @@ -511,7 +538,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
27433 * This means that this function can never return, it can misbehave
27434 * by not rebooting properly and hanging.
27435 */
27436 -static void native_machine_emergency_restart(void)
27437 +static void __noreturn native_machine_emergency_restart(void)
27438 {
27439 int i;
27440 int attempt = 0;
27441 @@ -631,13 +658,13 @@ void native_machine_shutdown(void)
27442 #endif
27443 }
27444
27445 -static void __machine_emergency_restart(int emergency)
27446 +static void __noreturn __machine_emergency_restart(int emergency)
27447 {
27448 reboot_emergency = emergency;
27449 machine_ops.emergency_restart();
27450 }
27451
27452 -static void native_machine_restart(char *__unused)
27453 +static void __noreturn native_machine_restart(char *__unused)
27454 {
27455 pr_notice("machine restart\n");
27456
27457 @@ -646,7 +673,7 @@ static void native_machine_restart(char *__unused)
27458 __machine_emergency_restart(0);
27459 }
27460
27461 -static void native_machine_halt(void)
27462 +static void __noreturn native_machine_halt(void)
27463 {
27464 /* Stop other cpus and apics */
27465 machine_shutdown();
27466 @@ -656,7 +683,7 @@ static void native_machine_halt(void)
27467 stop_this_cpu(NULL);
27468 }
27469
27470 -static void native_machine_power_off(void)
27471 +static void __noreturn native_machine_power_off(void)
27472 {
27473 if (pm_power_off) {
27474 if (!reboot_force)
27475 @@ -665,9 +692,10 @@ static void native_machine_power_off(void)
27476 }
27477 /* A fallback in case there is no PM info available */
27478 tboot_shutdown(TB_SHUTDOWN_HALT);
27479 + unreachable();
27480 }
27481
27482 -struct machine_ops machine_ops = {
27483 +struct machine_ops machine_ops __read_only = {
27484 .power_off = native_machine_power_off,
27485 .shutdown = native_machine_shutdown,
27486 .emergency_restart = native_machine_emergency_restart,
27487 diff --git a/arch/x86/kernel/reboot_fixups_32.c b/arch/x86/kernel/reboot_fixups_32.c
27488 index c8e41e9..64049ef 100644
27489 --- a/arch/x86/kernel/reboot_fixups_32.c
27490 +++ b/arch/x86/kernel/reboot_fixups_32.c
27491 @@ -57,7 +57,7 @@ struct device_fixup {
27492 unsigned int vendor;
27493 unsigned int device;
27494 void (*reboot_fixup)(struct pci_dev *);
27495 -};
27496 +} __do_const;
27497
27498 /*
27499 * PCI ids solely used for fixups_table go here
27500 diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
27501 index 98111b3..73ca125 100644
27502 --- a/arch/x86/kernel/relocate_kernel_64.S
27503 +++ b/arch/x86/kernel/relocate_kernel_64.S
27504 @@ -96,8 +96,7 @@ relocate_kernel:
27505
27506 /* jump to identity mapped page */
27507 addq $(identity_mapped - relocate_kernel), %r8
27508 - pushq %r8
27509 - ret
27510 + jmp *%r8
27511
27512 identity_mapped:
27513 /* set return address to 0 if not preserving context */
27514 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
27515 index d74ac33..d9efe04 100644
27516 --- a/arch/x86/kernel/setup.c
27517 +++ b/arch/x86/kernel/setup.c
27518 @@ -111,6 +111,7 @@
27519 #include <asm/mce.h>
27520 #include <asm/alternative.h>
27521 #include <asm/prom.h>
27522 +#include <asm/boot.h>
27523
27524 /*
27525 * max_low_pfn_mapped: highest direct mapped pfn under 4GB
27526 @@ -206,10 +207,12 @@ EXPORT_SYMBOL(boot_cpu_data);
27527 #endif
27528
27529
27530 -#if !defined(CONFIG_X86_PAE) || defined(CONFIG_X86_64)
27531 -__visible unsigned long mmu_cr4_features;
27532 +#ifdef CONFIG_X86_64
27533 +__visible unsigned long mmu_cr4_features __read_only = X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE;
27534 +#elif defined(CONFIG_X86_PAE)
27535 +__visible unsigned long mmu_cr4_features __read_only = X86_CR4_PAE;
27536 #else
27537 -__visible unsigned long mmu_cr4_features = X86_CR4_PAE;
27538 +__visible unsigned long mmu_cr4_features __read_only;
27539 #endif
27540
27541 /* Boot loader ID and version as integers, for the benefit of proc_dointvec */
27542 @@ -771,7 +774,7 @@ static void __init trim_bios_range(void)
27543 * area (640->1Mb) as ram even though it is not.
27544 * take them out.
27545 */
27546 - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
27547 + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
27548
27549 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
27550 }
27551 @@ -779,7 +782,7 @@ static void __init trim_bios_range(void)
27552 /* called before trim_bios_range() to spare extra sanitize */
27553 static void __init e820_add_kernel_range(void)
27554 {
27555 - u64 start = __pa_symbol(_text);
27556 + u64 start = __pa_symbol(ktla_ktva(_text));
27557 u64 size = __pa_symbol(_end) - start;
27558
27559 /*
27560 @@ -860,8 +863,12 @@ dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
27561
27562 void __init setup_arch(char **cmdline_p)
27563 {
27564 +#ifdef CONFIG_X86_32
27565 + memblock_reserve(LOAD_PHYSICAL_ADDR, __pa_symbol(__bss_stop) - LOAD_PHYSICAL_ADDR);
27566 +#else
27567 memblock_reserve(__pa_symbol(_text),
27568 (unsigned long)__bss_stop - (unsigned long)_text);
27569 +#endif
27570
27571 early_reserve_initrd();
27572
27573 @@ -959,16 +966,16 @@ void __init setup_arch(char **cmdline_p)
27574
27575 if (!boot_params.hdr.root_flags)
27576 root_mountflags &= ~MS_RDONLY;
27577 - init_mm.start_code = (unsigned long) _text;
27578 - init_mm.end_code = (unsigned long) _etext;
27579 + init_mm.start_code = ktla_ktva((unsigned long) _text);
27580 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
27581 init_mm.end_data = (unsigned long) _edata;
27582 init_mm.brk = _brk_end;
27583
27584 mpx_mm_init(&init_mm);
27585
27586 - code_resource.start = __pa_symbol(_text);
27587 - code_resource.end = __pa_symbol(_etext)-1;
27588 - data_resource.start = __pa_symbol(_etext);
27589 + code_resource.start = __pa_symbol(ktla_ktva(_text));
27590 + code_resource.end = __pa_symbol(ktla_ktva(_etext))-1;
27591 + data_resource.start = __pa_symbol(_sdata);
27592 data_resource.end = __pa_symbol(_edata)-1;
27593 bss_resource.start = __pa_symbol(__bss_start);
27594 bss_resource.end = __pa_symbol(__bss_stop)-1;
27595 diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
27596 index e4fcb87..9c06c55 100644
27597 --- a/arch/x86/kernel/setup_percpu.c
27598 +++ b/arch/x86/kernel/setup_percpu.c
27599 @@ -21,19 +21,17 @@
27600 #include <asm/cpu.h>
27601 #include <asm/stackprotector.h>
27602
27603 -DEFINE_PER_CPU_READ_MOSTLY(int, cpu_number);
27604 +#ifdef CONFIG_SMP
27605 +DEFINE_PER_CPU_READ_MOSTLY(unsigned int, cpu_number);
27606 EXPORT_PER_CPU_SYMBOL(cpu_number);
27607 +#endif
27608
27609 -#ifdef CONFIG_X86_64
27610 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
27611 -#else
27612 -#define BOOT_PERCPU_OFFSET 0
27613 -#endif
27614
27615 DEFINE_PER_CPU_READ_MOSTLY(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
27616 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
27617
27618 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
27619 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
27620 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
27621 };
27622 EXPORT_SYMBOL(__per_cpu_offset);
27623 @@ -66,7 +64,7 @@ static bool __init pcpu_need_numa(void)
27624 {
27625 #ifdef CONFIG_NEED_MULTIPLE_NODES
27626 pg_data_t *last = NULL;
27627 - unsigned int cpu;
27628 + int cpu;
27629
27630 for_each_possible_cpu(cpu) {
27631 int node = early_cpu_to_node(cpu);
27632 @@ -155,10 +153,10 @@ static inline void setup_percpu_segment(int cpu)
27633 {
27634 #ifdef CONFIG_X86_32
27635 struct desc_struct gdt;
27636 + unsigned long base = per_cpu_offset(cpu);
27637
27638 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
27639 - 0x2 | DESCTYPE_S, 0x8);
27640 - gdt.s = 1;
27641 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
27642 + 0x83 | DESCTYPE_S, 0xC);
27643 write_gdt_entry(get_cpu_gdt_table(cpu),
27644 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
27645 #endif
27646 @@ -219,6 +217,11 @@ void __init setup_per_cpu_areas(void)
27647 /* alrighty, percpu areas up and running */
27648 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
27649 for_each_possible_cpu(cpu) {
27650 +#ifdef CONFIG_CC_STACKPROTECTOR
27651 +#ifdef CONFIG_X86_32
27652 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
27653 +#endif
27654 +#endif
27655 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
27656 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
27657 per_cpu(cpu_number, cpu) = cpu;
27658 @@ -259,6 +262,12 @@ void __init setup_per_cpu_areas(void)
27659 */
27660 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
27661 #endif
27662 +#ifdef CONFIG_CC_STACKPROTECTOR
27663 +#ifdef CONFIG_X86_32
27664 + if (!cpu)
27665 + per_cpu(stack_canary.canary, cpu) = canary;
27666 +#endif
27667 +#endif
27668 /*
27669 * Up to this point, the boot CPU has been using .init.data
27670 * area. Reload any changed state for the boot CPU.
27671 diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
27672 index 1ea14fd..b16147f 100644
27673 --- a/arch/x86/kernel/signal.c
27674 +++ b/arch/x86/kernel/signal.c
27675 @@ -183,7 +183,7 @@ static unsigned long align_sigframe(unsigned long sp)
27676 * Align the stack pointer according to the i386 ABI,
27677 * i.e. so that on function entry ((sp + 4) & 15) == 0.
27678 */
27679 - sp = ((sp + 4) & -16ul) - 4;
27680 + sp = ((sp - 12) & -16ul) - 4;
27681 #else /* !CONFIG_X86_32 */
27682 sp = round_down(sp, 16) - 8;
27683 #endif
27684 @@ -291,10 +291,9 @@ __setup_frame(int sig, struct ksignal *ksig, sigset_t *set,
27685 }
27686
27687 if (current->mm->context.vdso)
27688 - restorer = current->mm->context.vdso +
27689 - selected_vdso32->sym___kernel_sigreturn;
27690 + restorer = (void __force_user *)(current->mm->context.vdso + selected_vdso32->sym___kernel_sigreturn);
27691 else
27692 - restorer = &frame->retcode;
27693 + restorer = (void __user *)&frame->retcode;
27694 if (ksig->ka.sa.sa_flags & SA_RESTORER)
27695 restorer = ksig->ka.sa.sa_restorer;
27696
27697 @@ -308,7 +307,7 @@ __setup_frame(int sig, struct ksignal *ksig, sigset_t *set,
27698 * reasons and because gdb uses it as a signature to notice
27699 * signal handler stack frames.
27700 */
27701 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
27702 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
27703
27704 if (err)
27705 return -EFAULT;
27706 @@ -355,8 +354,10 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
27707 save_altstack_ex(&frame->uc.uc_stack, regs->sp);
27708
27709 /* Set up to return from userspace. */
27710 - restorer = current->mm->context.vdso +
27711 - selected_vdso32->sym___kernel_rt_sigreturn;
27712 + if (current->mm->context.vdso)
27713 + restorer = (void __force_user *)(current->mm->context.vdso + selected_vdso32->sym___kernel_rt_sigreturn);
27714 + else
27715 + restorer = (void __user *)&frame->retcode;
27716 if (ksig->ka.sa.sa_flags & SA_RESTORER)
27717 restorer = ksig->ka.sa.sa_restorer;
27718 put_user_ex(restorer, &frame->pretcode);
27719 @@ -368,7 +369,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
27720 * reasons and because gdb uses it as a signature to notice
27721 * signal handler stack frames.
27722 */
27723 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
27724 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
27725 } put_user_catch(err);
27726
27727 err |= copy_siginfo_to_user(&frame->info, &ksig->info);
27728 @@ -598,7 +599,12 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
27729 {
27730 int usig = ksig->sig;
27731 sigset_t *set = sigmask_to_save();
27732 - compat_sigset_t *cset = (compat_sigset_t *) set;
27733 + sigset_t sigcopy;
27734 + compat_sigset_t *cset;
27735 +
27736 + sigcopy = *set;
27737 +
27738 + cset = (compat_sigset_t *) &sigcopy;
27739
27740 /* Set up the stack frame */
27741 if (is_ia32_frame()) {
27742 @@ -609,7 +615,7 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
27743 } else if (is_x32_frame()) {
27744 return x32_setup_rt_frame(ksig, cset, regs);
27745 } else {
27746 - return __setup_rt_frame(ksig->sig, ksig, set, regs);
27747 + return __setup_rt_frame(ksig->sig, ksig, &sigcopy, regs);
27748 }
27749 }
27750
27751 diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
27752 index be8e1bd..a3d93fa 100644
27753 --- a/arch/x86/kernel/smp.c
27754 +++ b/arch/x86/kernel/smp.c
27755 @@ -341,7 +341,7 @@ static int __init nonmi_ipi_setup(char *str)
27756
27757 __setup("nonmi_ipi", nonmi_ipi_setup);
27758
27759 -struct smp_ops smp_ops = {
27760 +struct smp_ops smp_ops __read_only = {
27761 .smp_prepare_boot_cpu = native_smp_prepare_boot_cpu,
27762 .smp_prepare_cpus = native_smp_prepare_cpus,
27763 .smp_cpus_done = native_smp_cpus_done,
27764 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
27765 index 50e547e..d59d06a 100644
27766 --- a/arch/x86/kernel/smpboot.c
27767 +++ b/arch/x86/kernel/smpboot.c
27768 @@ -226,14 +226,17 @@ static void notrace start_secondary(void *unused)
27769
27770 enable_start_cpu0 = 0;
27771
27772 -#ifdef CONFIG_X86_32
27773 + /* otherwise gcc will move up smp_processor_id before the cpu_init */
27774 + barrier();
27775 +
27776 /* switch away from the initial page table */
27777 +#ifdef CONFIG_PAX_PER_CPU_PGD
27778 + load_cr3(get_cpu_pgd(smp_processor_id(), kernel));
27779 +#else
27780 load_cr3(swapper_pg_dir);
27781 +#endif
27782 __flush_tlb_all();
27783 -#endif
27784
27785 - /* otherwise gcc will move up smp_processor_id before the cpu_init */
27786 - barrier();
27787 /*
27788 * Check TSC synchronization with the BP:
27789 */
27790 @@ -782,18 +785,17 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
27791 alternatives_enable_smp();
27792
27793 per_cpu(current_task, cpu) = idle;
27794 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
27795
27796 #ifdef CONFIG_X86_32
27797 /* Stack for startup_32 can be just as for start_secondary onwards */
27798 irq_ctx_init(cpu);
27799 - per_cpu(cpu_current_top_of_stack, cpu) =
27800 - (unsigned long)task_stack_page(idle) + THREAD_SIZE;
27801 + per_cpu(cpu_current_top_of_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
27802 #else
27803 clear_tsk_thread_flag(idle, TIF_FORK);
27804 initial_gs = per_cpu_offset(cpu);
27805 #endif
27806 - per_cpu(kernel_stack, cpu) =
27807 - (unsigned long)task_stack_page(idle) + THREAD_SIZE;
27808 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
27809 }
27810
27811 /*
27812 @@ -814,9 +816,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
27813 unsigned long timeout;
27814
27815 idle->thread.sp = (unsigned long) (((struct pt_regs *)
27816 - (THREAD_SIZE + task_stack_page(idle))) - 1);
27817 + (THREAD_SIZE - 16 + task_stack_page(idle))) - 1);
27818
27819 + pax_open_kernel();
27820 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
27821 + pax_close_kernel();
27822 initial_code = (unsigned long)start_secondary;
27823 stack_start = idle->thread.sp;
27824
27825 @@ -961,6 +965,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
27826
27827 common_cpu_up(cpu, tidle);
27828
27829 +#ifdef CONFIG_PAX_PER_CPU_PGD
27830 + clone_pgd_range(get_cpu_pgd(cpu, kernel) + KERNEL_PGD_BOUNDARY,
27831 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
27832 + KERNEL_PGD_PTRS);
27833 + clone_pgd_range(get_cpu_pgd(cpu, user) + KERNEL_PGD_BOUNDARY,
27834 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
27835 + KERNEL_PGD_PTRS);
27836 +#endif
27837 +
27838 err = do_boot_cpu(apicid, cpu, tidle);
27839 if (err) {
27840 pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
27841 diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
27842 index 9b4d51d..5d28b58 100644
27843 --- a/arch/x86/kernel/step.c
27844 +++ b/arch/x86/kernel/step.c
27845 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
27846 struct desc_struct *desc;
27847 unsigned long base;
27848
27849 - seg &= ~7UL;
27850 + seg >>= 3;
27851
27852 mutex_lock(&child->mm->context.lock);
27853 - if (unlikely((seg >> 3) >= child->mm->context.size))
27854 + if (unlikely(seg >= child->mm->context.size))
27855 addr = -1L; /* bogus selector, access would fault */
27856 else {
27857 desc = child->mm->context.ldt + seg;
27858 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
27859 addr += base;
27860 }
27861 mutex_unlock(&child->mm->context.lock);
27862 - }
27863 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
27864 + addr = ktla_ktva(addr);
27865
27866 return addr;
27867 }
27868 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
27869 unsigned char opcode[15];
27870 unsigned long addr = convert_ip_to_linear(child, regs);
27871
27872 + if (addr == -EINVAL)
27873 + return 0;
27874 +
27875 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
27876 for (i = 0; i < copied; i++) {
27877 switch (opcode[i]) {
27878 diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
27879 new file mode 100644
27880 index 0000000..5877189
27881 --- /dev/null
27882 +++ b/arch/x86/kernel/sys_i386_32.c
27883 @@ -0,0 +1,189 @@
27884 +/*
27885 + * This file contains various random system calls that
27886 + * have a non-standard calling sequence on the Linux/i386
27887 + * platform.
27888 + */
27889 +
27890 +#include <linux/errno.h>
27891 +#include <linux/sched.h>
27892 +#include <linux/mm.h>
27893 +#include <linux/fs.h>
27894 +#include <linux/smp.h>
27895 +#include <linux/sem.h>
27896 +#include <linux/msg.h>
27897 +#include <linux/shm.h>
27898 +#include <linux/stat.h>
27899 +#include <linux/syscalls.h>
27900 +#include <linux/mman.h>
27901 +#include <linux/file.h>
27902 +#include <linux/utsname.h>
27903 +#include <linux/ipc.h>
27904 +#include <linux/elf.h>
27905 +
27906 +#include <linux/uaccess.h>
27907 +#include <linux/unistd.h>
27908 +
27909 +#include <asm/syscalls.h>
27910 +
27911 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
27912 +{
27913 + unsigned long pax_task_size = TASK_SIZE;
27914 +
27915 +#ifdef CONFIG_PAX_SEGMEXEC
27916 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
27917 + pax_task_size = SEGMEXEC_TASK_SIZE;
27918 +#endif
27919 +
27920 + if (flags & MAP_FIXED)
27921 + if (len > pax_task_size || addr > pax_task_size - len)
27922 + return -EINVAL;
27923 +
27924 + return 0;
27925 +}
27926 +
27927 +/*
27928 + * Align a virtual address to avoid aliasing in the I$ on AMD F15h.
27929 + */
27930 +static unsigned long get_align_mask(void)
27931 +{
27932 + if (va_align.flags < 0 || !(va_align.flags & ALIGN_VA_32))
27933 + return 0;
27934 +
27935 + if (!(current->flags & PF_RANDOMIZE))
27936 + return 0;
27937 +
27938 + return va_align.mask;
27939 +}
27940 +
27941 +unsigned long
27942 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
27943 + unsigned long len, unsigned long pgoff, unsigned long flags)
27944 +{
27945 + struct mm_struct *mm = current->mm;
27946 + struct vm_area_struct *vma;
27947 + unsigned long pax_task_size = TASK_SIZE;
27948 + struct vm_unmapped_area_info info;
27949 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
27950 +
27951 +#ifdef CONFIG_PAX_SEGMEXEC
27952 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
27953 + pax_task_size = SEGMEXEC_TASK_SIZE;
27954 +#endif
27955 +
27956 + pax_task_size -= PAGE_SIZE;
27957 +
27958 + if (len > pax_task_size)
27959 + return -ENOMEM;
27960 +
27961 + if (flags & MAP_FIXED)
27962 + return addr;
27963 +
27964 +#ifdef CONFIG_PAX_RANDMMAP
27965 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
27966 +#endif
27967 +
27968 + if (addr) {
27969 + addr = PAGE_ALIGN(addr);
27970 + if (pax_task_size - len >= addr) {
27971 + vma = find_vma(mm, addr);
27972 + if (check_heap_stack_gap(vma, addr, len, offset))
27973 + return addr;
27974 + }
27975 + }
27976 +
27977 + info.flags = 0;
27978 + info.length = len;
27979 + info.align_mask = filp ? get_align_mask() : 0;
27980 + info.align_offset = pgoff << PAGE_SHIFT;
27981 + info.threadstack_offset = offset;
27982 +
27983 +#ifdef CONFIG_PAX_PAGEEXEC
27984 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE)) {
27985 + info.low_limit = 0x00110000UL;
27986 + info.high_limit = mm->start_code;
27987 +
27988 +#ifdef CONFIG_PAX_RANDMMAP
27989 + if (mm->pax_flags & MF_PAX_RANDMMAP)
27990 + info.low_limit += mm->delta_mmap & 0x03FFF000UL;
27991 +#endif
27992 +
27993 + if (info.low_limit < info.high_limit) {
27994 + addr = vm_unmapped_area(&info);
27995 + if (!IS_ERR_VALUE(addr))
27996 + return addr;
27997 + }
27998 + } else
27999 +#endif
28000 +
28001 + info.low_limit = mm->mmap_base;
28002 + info.high_limit = pax_task_size;
28003 +
28004 + return vm_unmapped_area(&info);
28005 +}
28006 +
28007 +unsigned long
28008 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
28009 + const unsigned long len, const unsigned long pgoff,
28010 + const unsigned long flags)
28011 +{
28012 + struct vm_area_struct *vma;
28013 + struct mm_struct *mm = current->mm;
28014 + unsigned long addr = addr0, pax_task_size = TASK_SIZE;
28015 + struct vm_unmapped_area_info info;
28016 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
28017 +
28018 +#ifdef CONFIG_PAX_SEGMEXEC
28019 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
28020 + pax_task_size = SEGMEXEC_TASK_SIZE;
28021 +#endif
28022 +
28023 + pax_task_size -= PAGE_SIZE;
28024 +
28025 + /* requested length too big for entire address space */
28026 + if (len > pax_task_size)
28027 + return -ENOMEM;
28028 +
28029 + if (flags & MAP_FIXED)
28030 + return addr;
28031 +
28032 +#ifdef CONFIG_PAX_PAGEEXEC
28033 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
28034 + goto bottomup;
28035 +#endif
28036 +
28037 +#ifdef CONFIG_PAX_RANDMMAP
28038 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
28039 +#endif
28040 +
28041 + /* requesting a specific address */
28042 + if (addr) {
28043 + addr = PAGE_ALIGN(addr);
28044 + if (pax_task_size - len >= addr) {
28045 + vma = find_vma(mm, addr);
28046 + if (check_heap_stack_gap(vma, addr, len, offset))
28047 + return addr;
28048 + }
28049 + }
28050 +
28051 + info.flags = VM_UNMAPPED_AREA_TOPDOWN;
28052 + info.length = len;
28053 + info.low_limit = PAGE_SIZE;
28054 + info.high_limit = mm->mmap_base;
28055 + info.align_mask = filp ? get_align_mask() : 0;
28056 + info.align_offset = pgoff << PAGE_SHIFT;
28057 + info.threadstack_offset = offset;
28058 +
28059 + addr = vm_unmapped_area(&info);
28060 + if (!(addr & ~PAGE_MASK))
28061 + return addr;
28062 + VM_BUG_ON(addr != -ENOMEM);
28063 +
28064 +bottomup:
28065 + /*
28066 + * A failed mmap() very likely causes application failure,
28067 + * so fall back to the bottom-up function here. This scenario
28068 + * can happen with large stack limits and large mmap()
28069 + * allocations.
28070 + */
28071 + return arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
28072 +}
28073 diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
28074 index 10e0272..b4bb9a7 100644
28075 --- a/arch/x86/kernel/sys_x86_64.c
28076 +++ b/arch/x86/kernel/sys_x86_64.c
28077 @@ -97,8 +97,8 @@ out:
28078 return error;
28079 }
28080
28081 -static void find_start_end(unsigned long flags, unsigned long *begin,
28082 - unsigned long *end)
28083 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
28084 + unsigned long *begin, unsigned long *end)
28085 {
28086 if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) {
28087 unsigned long new_begin;
28088 @@ -117,7 +117,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
28089 *begin = new_begin;
28090 }
28091 } else {
28092 - *begin = current->mm->mmap_legacy_base;
28093 + *begin = mm->mmap_legacy_base;
28094 *end = TASK_SIZE;
28095 }
28096 }
28097 @@ -130,20 +130,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
28098 struct vm_area_struct *vma;
28099 struct vm_unmapped_area_info info;
28100 unsigned long begin, end;
28101 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
28102
28103 if (flags & MAP_FIXED)
28104 return addr;
28105
28106 - find_start_end(flags, &begin, &end);
28107 + find_start_end(mm, flags, &begin, &end);
28108
28109 if (len > end)
28110 return -ENOMEM;
28111
28112 +#ifdef CONFIG_PAX_RANDMMAP
28113 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
28114 +#endif
28115 +
28116 if (addr) {
28117 addr = PAGE_ALIGN(addr);
28118 vma = find_vma(mm, addr);
28119 - if (end - len >= addr &&
28120 - (!vma || addr + len <= vma->vm_start))
28121 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
28122 return addr;
28123 }
28124
28125 @@ -157,6 +161,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
28126 info.align_mask = get_align_mask();
28127 info.align_offset += get_align_bits();
28128 }
28129 + info.threadstack_offset = offset;
28130 return vm_unmapped_area(&info);
28131 }
28132
28133 @@ -169,6 +174,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
28134 struct mm_struct *mm = current->mm;
28135 unsigned long addr = addr0;
28136 struct vm_unmapped_area_info info;
28137 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
28138
28139 /* requested length too big for entire address space */
28140 if (len > TASK_SIZE)
28141 @@ -181,12 +187,15 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
28142 if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT))
28143 goto bottomup;
28144
28145 +#ifdef CONFIG_PAX_RANDMMAP
28146 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
28147 +#endif
28148 +
28149 /* requesting a specific address */
28150 if (addr) {
28151 addr = PAGE_ALIGN(addr);
28152 vma = find_vma(mm, addr);
28153 - if (TASK_SIZE - len >= addr &&
28154 - (!vma || addr + len <= vma->vm_start))
28155 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
28156 return addr;
28157 }
28158
28159 @@ -200,6 +209,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
28160 info.align_mask = get_align_mask();
28161 info.align_offset += get_align_bits();
28162 }
28163 + info.threadstack_offset = offset;
28164 addr = vm_unmapped_area(&info);
28165 if (!(addr & ~PAGE_MASK))
28166 return addr;
28167 diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
28168 index 91a4496..42fc304 100644
28169 --- a/arch/x86/kernel/tboot.c
28170 +++ b/arch/x86/kernel/tboot.c
28171 @@ -44,6 +44,7 @@
28172 #include <asm/setup.h>
28173 #include <asm/e820.h>
28174 #include <asm/io.h>
28175 +#include <asm/tlbflush.h>
28176
28177 #include "../realmode/rm/wakeup.h"
28178
28179 @@ -221,7 +222,7 @@ static int tboot_setup_sleep(void)
28180
28181 void tboot_shutdown(u32 shutdown_type)
28182 {
28183 - void (*shutdown)(void);
28184 + void (* __noreturn shutdown)(void);
28185
28186 if (!tboot_enabled())
28187 return;
28188 @@ -242,8 +243,9 @@ void tboot_shutdown(u32 shutdown_type)
28189 tboot->shutdown_type = shutdown_type;
28190
28191 switch_to_tboot_pt();
28192 + cr4_clear_bits(X86_CR4_PCIDE);
28193
28194 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
28195 + shutdown = (void *)(unsigned long)tboot->shutdown_entry;
28196 shutdown();
28197
28198 /* should not reach here */
28199 @@ -310,7 +312,7 @@ static int tboot_extended_sleep(u8 sleep_state, u32 val_a, u32 val_b)
28200 return -ENODEV;
28201 }
28202
28203 -static atomic_t ap_wfs_count;
28204 +static atomic_unchecked_t ap_wfs_count;
28205
28206 static int tboot_wait_for_aps(int num_aps)
28207 {
28208 @@ -334,9 +336,9 @@ static int tboot_cpu_callback(struct notifier_block *nfb, unsigned long action,
28209 {
28210 switch (action) {
28211 case CPU_DYING:
28212 - atomic_inc(&ap_wfs_count);
28213 + atomic_inc_unchecked(&ap_wfs_count);
28214 if (num_online_cpus() == 1)
28215 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
28216 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
28217 return NOTIFY_BAD;
28218 break;
28219 }
28220 @@ -422,7 +424,7 @@ static __init int tboot_late_init(void)
28221
28222 tboot_create_trampoline();
28223
28224 - atomic_set(&ap_wfs_count, 0);
28225 + atomic_set_unchecked(&ap_wfs_count, 0);
28226 register_hotcpu_notifier(&tboot_cpu_notifier);
28227
28228 #ifdef CONFIG_DEBUG_FS
28229 diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
28230 index d39c091..1df4349 100644
28231 --- a/arch/x86/kernel/time.c
28232 +++ b/arch/x86/kernel/time.c
28233 @@ -32,7 +32,7 @@ unsigned long profile_pc(struct pt_regs *regs)
28234
28235 if (!user_mode(regs) && in_lock_functions(pc)) {
28236 #ifdef CONFIG_FRAME_POINTER
28237 - return *(unsigned long *)(regs->bp + sizeof(long));
28238 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
28239 #else
28240 unsigned long *sp =
28241 (unsigned long *)kernel_stack_pointer(regs);
28242 @@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
28243 * or above a saved flags. Eflags has bits 22-31 zero,
28244 * kernel addresses don't.
28245 */
28246 +
28247 +#ifdef CONFIG_PAX_KERNEXEC
28248 + return ktla_ktva(sp[0]);
28249 +#else
28250 if (sp[0] >> 22)
28251 return sp[0];
28252 if (sp[1] >> 22)
28253 return sp[1];
28254 #endif
28255 +
28256 +#endif
28257 }
28258 return pc;
28259 }
28260 diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
28261 index 7fc5e84..c6e445a 100644
28262 --- a/arch/x86/kernel/tls.c
28263 +++ b/arch/x86/kernel/tls.c
28264 @@ -139,6 +139,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
28265 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
28266 return -EINVAL;
28267
28268 +#ifdef CONFIG_PAX_SEGMEXEC
28269 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
28270 + return -EINVAL;
28271 +#endif
28272 +
28273 set_tls_desc(p, idx, &info, 1);
28274
28275 return 0;
28276 @@ -256,7 +261,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
28277
28278 if (kbuf)
28279 info = kbuf;
28280 - else if (__copy_from_user(infobuf, ubuf, count))
28281 + else if (count > sizeof infobuf || __copy_from_user(infobuf, ubuf, count))
28282 return -EFAULT;
28283 else
28284 info = infobuf;
28285 diff --git a/arch/x86/kernel/tracepoint.c b/arch/x86/kernel/tracepoint.c
28286 index 1c113db..287b42e 100644
28287 --- a/arch/x86/kernel/tracepoint.c
28288 +++ b/arch/x86/kernel/tracepoint.c
28289 @@ -9,11 +9,11 @@
28290 #include <linux/atomic.h>
28291
28292 atomic_t trace_idt_ctr = ATOMIC_INIT(0);
28293 -struct desc_ptr trace_idt_descr = { NR_VECTORS * 16 - 1,
28294 +const struct desc_ptr trace_idt_descr = { NR_VECTORS * 16 - 1,
28295 (unsigned long) trace_idt_table };
28296
28297 /* No need to be aligned, but done to keep all IDTs defined the same way. */
28298 -gate_desc trace_idt_table[NR_VECTORS] __page_aligned_bss;
28299 +gate_desc trace_idt_table[NR_VECTORS] __page_aligned_rodata;
28300
28301 static int trace_irq_vector_refcount;
28302 static DEFINE_MUTEX(irq_vector_mutex);
28303 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
28304 index 324ab52..0cfd2d05 100644
28305 --- a/arch/x86/kernel/traps.c
28306 +++ b/arch/x86/kernel/traps.c
28307 @@ -68,7 +68,7 @@
28308 #include <asm/proto.h>
28309
28310 /* No need to be aligned, but done to keep all IDTs defined the same way. */
28311 -gate_desc debug_idt_table[NR_VECTORS] __page_aligned_bss;
28312 +gate_desc debug_idt_table[NR_VECTORS] __page_aligned_rodata;
28313 #else
28314 #include <asm/processor-flags.h>
28315 #include <asm/setup.h>
28316 @@ -77,7 +77,7 @@ asmlinkage int system_call(void);
28317 #endif
28318
28319 /* Must be page-aligned because the real IDT is used in a fixmap. */
28320 -gate_desc idt_table[NR_VECTORS] __page_aligned_bss;
28321 +gate_desc idt_table[NR_VECTORS] __page_aligned_rodata;
28322
28323 DECLARE_BITMAP(used_vectors, NR_VECTORS);
28324 EXPORT_SYMBOL_GPL(used_vectors);
28325 @@ -174,7 +174,7 @@ void ist_begin_non_atomic(struct pt_regs *regs)
28326 * will catch asm bugs and any attempt to use ist_preempt_enable
28327 * from double_fault.
28328 */
28329 - BUG_ON((unsigned long)(current_top_of_stack() -
28330 + BUG_ON((unsigned long)(current_top_of_stack(smp_processor_id()) -
28331 current_stack_pointer()) >= THREAD_SIZE);
28332
28333 preempt_count_sub(HARDIRQ_OFFSET);
28334 @@ -191,7 +191,7 @@ void ist_end_non_atomic(void)
28335 }
28336
28337 static nokprobe_inline int
28338 -do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
28339 +do_trap_no_signal(struct task_struct *tsk, int trapnr, const char *str,
28340 struct pt_regs *regs, long error_code)
28341 {
28342 if (v8086_mode(regs)) {
28343 @@ -211,8 +211,20 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
28344 if (!fixup_exception(regs)) {
28345 tsk->thread.error_code = error_code;
28346 tsk->thread.trap_nr = trapnr;
28347 +
28348 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
28349 + if (trapnr == X86_TRAP_SS && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
28350 + str = "PAX: suspicious stack segment fault";
28351 +#endif
28352 +
28353 die(str, regs, error_code);
28354 }
28355 +
28356 +#ifdef CONFIG_PAX_REFCOUNT
28357 + if (trapnr == X86_TRAP_OF)
28358 + pax_report_refcount_overflow(regs);
28359 +#endif
28360 +
28361 return 0;
28362 }
28363
28364 @@ -251,7 +263,7 @@ static siginfo_t *fill_trap_info(struct pt_regs *regs, int signr, int trapnr,
28365 }
28366
28367 static void
28368 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
28369 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
28370 long error_code, siginfo_t *info)
28371 {
28372 struct task_struct *tsk = current;
28373 @@ -275,7 +287,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
28374 if (show_unhandled_signals && unhandled_signal(tsk, signr) &&
28375 printk_ratelimit()) {
28376 pr_info("%s[%d] trap %s ip:%lx sp:%lx error:%lx",
28377 - tsk->comm, tsk->pid, str,
28378 + tsk->comm, task_pid_nr(tsk), str,
28379 regs->ip, regs->sp, error_code);
28380 print_vma_addr(" in ", regs->ip);
28381 pr_cont("\n");
28382 @@ -357,6 +369,11 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
28383 tsk->thread.error_code = error_code;
28384 tsk->thread.trap_nr = X86_TRAP_DF;
28385
28386 +#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
28387 + if ((unsigned long)tsk->stack - regs->sp <= PAGE_SIZE)
28388 + die("grsec: kernel stack overflow detected", regs, error_code);
28389 +#endif
28390 +
28391 #ifdef CONFIG_DOUBLEFAULT
28392 df_debug(regs, error_code);
28393 #endif
28394 @@ -475,11 +492,35 @@ do_general_protection(struct pt_regs *regs, long error_code)
28395 tsk->thread.error_code = error_code;
28396 tsk->thread.trap_nr = X86_TRAP_GP;
28397 if (notify_die(DIE_GPF, "general protection fault", regs, error_code,
28398 - X86_TRAP_GP, SIGSEGV) != NOTIFY_STOP)
28399 + X86_TRAP_GP, SIGSEGV) != NOTIFY_STOP) {
28400 +
28401 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
28402 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
28403 + die("PAX: suspicious general protection fault", regs, error_code);
28404 + else
28405 +#endif
28406 +
28407 die("general protection fault", regs, error_code);
28408 + }
28409 goto exit;
28410 }
28411
28412 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
28413 + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
28414 + struct mm_struct *mm = tsk->mm;
28415 + unsigned long limit;
28416 +
28417 + down_write(&mm->mmap_sem);
28418 + limit = mm->context.user_cs_limit;
28419 + if (limit < TASK_SIZE) {
28420 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
28421 + up_write(&mm->mmap_sem);
28422 + return;
28423 + }
28424 + up_write(&mm->mmap_sem);
28425 + }
28426 +#endif
28427 +
28428 tsk->thread.error_code = error_code;
28429 tsk->thread.trap_nr = X86_TRAP_GP;
28430
28431 @@ -578,6 +619,9 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
28432 container_of(task_pt_regs(current),
28433 struct bad_iret_stack, regs);
28434
28435 + if ((current->thread.sp0 ^ (unsigned long)s) < THREAD_SIZE)
28436 + new_stack = s;
28437 +
28438 /* Copy the IRET target to the new stack. */
28439 memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
28440
28441 diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
28442 index 5054497..139f8f8 100644
28443 --- a/arch/x86/kernel/tsc.c
28444 +++ b/arch/x86/kernel/tsc.c
28445 @@ -150,7 +150,7 @@ static void cyc2ns_write_end(int cpu, struct cyc2ns_data *data)
28446 */
28447 smp_wmb();
28448
28449 - ACCESS_ONCE(c2n->head) = data;
28450 + ACCESS_ONCE_RW(c2n->head) = data;
28451 }
28452
28453 /*
28454 diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
28455 index 0b81ad6..fff670e 100644
28456 --- a/arch/x86/kernel/uprobes.c
28457 +++ b/arch/x86/kernel/uprobes.c
28458 @@ -986,7 +986,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
28459
28460 if (nleft != rasize) {
28461 pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, "
28462 - "%%ip=%#lx\n", current->pid, regs->sp, regs->ip);
28463 + "%%ip=%#lx\n", task_pid_nr(current), regs->sp, regs->ip);
28464
28465 force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
28466 }
28467 diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
28468 index b9242ba..50c5edd 100644
28469 --- a/arch/x86/kernel/verify_cpu.S
28470 +++ b/arch/x86/kernel/verify_cpu.S
28471 @@ -20,6 +20,7 @@
28472 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
28473 * arch/x86/kernel/trampoline_64.S: secondary processor verification
28474 * arch/x86/kernel/head_32.S: processor startup
28475 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
28476 *
28477 * verify_cpu, returns the status of longmode and SSE in register %eax.
28478 * 0: Success 1: Failure
28479 diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
28480 index fc9db6e..2c5865d 100644
28481 --- a/arch/x86/kernel/vm86_32.c
28482 +++ b/arch/x86/kernel/vm86_32.c
28483 @@ -44,6 +44,7 @@
28484 #include <linux/ptrace.h>
28485 #include <linux/audit.h>
28486 #include <linux/stddef.h>
28487 +#include <linux/grsecurity.h>
28488
28489 #include <asm/uaccess.h>
28490 #include <asm/io.h>
28491 @@ -150,7 +151,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
28492 do_exit(SIGSEGV);
28493 }
28494
28495 - tss = &per_cpu(cpu_tss, get_cpu());
28496 + tss = cpu_tss + get_cpu();
28497 current->thread.sp0 = current->thread.saved_sp0;
28498 current->thread.sysenter_cs = __KERNEL_CS;
28499 load_sp0(tss, &current->thread);
28500 @@ -214,6 +215,14 @@ SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, v86)
28501
28502 if (tsk->thread.saved_sp0)
28503 return -EPERM;
28504 +
28505 +#ifdef CONFIG_GRKERNSEC_VM86
28506 + if (!capable(CAP_SYS_RAWIO)) {
28507 + gr_handle_vm86();
28508 + return -EPERM;
28509 + }
28510 +#endif
28511 +
28512 tmp = copy_vm86_regs_from_user(&info.regs, &v86->regs,
28513 offsetof(struct kernel_vm86_struct, vm86plus) -
28514 sizeof(info.regs));
28515 @@ -238,6 +247,13 @@ SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
28516 int tmp;
28517 struct vm86plus_struct __user *v86;
28518
28519 +#ifdef CONFIG_GRKERNSEC_VM86
28520 + if (!capable(CAP_SYS_RAWIO)) {
28521 + gr_handle_vm86();
28522 + return -EPERM;
28523 + }
28524 +#endif
28525 +
28526 tsk = current;
28527 switch (cmd) {
28528 case VM86_REQUEST_IRQ:
28529 @@ -318,7 +334,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
28530 tsk->thread.saved_fs = info->regs32->fs;
28531 tsk->thread.saved_gs = get_user_gs(info->regs32);
28532
28533 - tss = &per_cpu(cpu_tss, get_cpu());
28534 + tss = cpu_tss + get_cpu();
28535 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
28536 if (cpu_has_sep)
28537 tsk->thread.sysenter_cs = 0;
28538 @@ -525,7 +541,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
28539 goto cannot_handle;
28540 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
28541 goto cannot_handle;
28542 - intr_ptr = (unsigned long __user *) (i << 2);
28543 + intr_ptr = (__force unsigned long __user *) (i << 2);
28544 if (get_user(segoffs, intr_ptr))
28545 goto cannot_handle;
28546 if ((segoffs >> 16) == BIOSSEG)
28547 diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
28548 index 00bf300..129df8e 100644
28549 --- a/arch/x86/kernel/vmlinux.lds.S
28550 +++ b/arch/x86/kernel/vmlinux.lds.S
28551 @@ -26,6 +26,13 @@
28552 #include <asm/page_types.h>
28553 #include <asm/cache.h>
28554 #include <asm/boot.h>
28555 +#include <asm/segment.h>
28556 +
28557 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
28558 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
28559 +#else
28560 +#define __KERNEL_TEXT_OFFSET 0
28561 +#endif
28562
28563 #undef i386 /* in case the preprocessor is a 32bit one */
28564
28565 @@ -69,30 +76,43 @@ jiffies_64 = jiffies;
28566
28567 PHDRS {
28568 text PT_LOAD FLAGS(5); /* R_E */
28569 +#ifdef CONFIG_X86_32
28570 + module PT_LOAD FLAGS(5); /* R_E */
28571 +#endif
28572 +#ifdef CONFIG_XEN
28573 + rodata PT_LOAD FLAGS(5); /* R_E */
28574 +#else
28575 + rodata PT_LOAD FLAGS(4); /* R__ */
28576 +#endif
28577 data PT_LOAD FLAGS(6); /* RW_ */
28578 -#ifdef CONFIG_X86_64
28579 + init.begin PT_LOAD FLAGS(6); /* RW_ */
28580 #ifdef CONFIG_SMP
28581 percpu PT_LOAD FLAGS(6); /* RW_ */
28582 #endif
28583 + text.init PT_LOAD FLAGS(5); /* R_E */
28584 + text.exit PT_LOAD FLAGS(5); /* R_E */
28585 init PT_LOAD FLAGS(7); /* RWE */
28586 -#endif
28587 note PT_NOTE FLAGS(0); /* ___ */
28588 }
28589
28590 SECTIONS
28591 {
28592 #ifdef CONFIG_X86_32
28593 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
28594 - phys_startup_32 = startup_32 - LOAD_OFFSET;
28595 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
28596 #else
28597 - . = __START_KERNEL;
28598 - phys_startup_64 = startup_64 - LOAD_OFFSET;
28599 + . = __START_KERNEL;
28600 #endif
28601
28602 /* Text and read-only data */
28603 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
28604 - _text = .;
28605 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
28606 /* bootstrapping code */
28607 +#ifdef CONFIG_X86_32
28608 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
28609 +#else
28610 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
28611 +#endif
28612 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
28613 + _text = .;
28614 HEAD_TEXT
28615 . = ALIGN(8);
28616 _stext = .;
28617 @@ -104,13 +124,47 @@ SECTIONS
28618 IRQENTRY_TEXT
28619 *(.fixup)
28620 *(.gnu.warning)
28621 - /* End of text section */
28622 - _etext = .;
28623 } :text = 0x9090
28624
28625 - NOTES :text :note
28626 + . += __KERNEL_TEXT_OFFSET;
28627
28628 - EXCEPTION_TABLE(16) :text = 0x9090
28629 +#ifdef CONFIG_X86_32
28630 + . = ALIGN(PAGE_SIZE);
28631 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
28632 +
28633 +#ifdef CONFIG_PAX_KERNEXEC
28634 + MODULES_EXEC_VADDR = .;
28635 + BYTE(0)
28636 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
28637 + . = ALIGN(HPAGE_SIZE) - 1;
28638 + MODULES_EXEC_END = .;
28639 +#endif
28640 +
28641 + } :module
28642 +#endif
28643 +
28644 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
28645 + /* End of text section */
28646 + BYTE(0)
28647 + _etext = . - __KERNEL_TEXT_OFFSET;
28648 + }
28649 +
28650 +#ifdef CONFIG_X86_32
28651 + . = ALIGN(PAGE_SIZE);
28652 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
28653 + . = ALIGN(PAGE_SIZE);
28654 + *(.empty_zero_page)
28655 + *(.initial_pg_fixmap)
28656 + *(.initial_pg_pmd)
28657 + *(.initial_page_table)
28658 + *(.swapper_pg_dir)
28659 + } :rodata
28660 +#endif
28661 +
28662 + . = ALIGN(PAGE_SIZE);
28663 + NOTES :rodata :note
28664 +
28665 + EXCEPTION_TABLE(16) :rodata
28666
28667 #if defined(CONFIG_DEBUG_RODATA)
28668 /* .text should occupy whole number of pages */
28669 @@ -122,16 +176,20 @@ SECTIONS
28670
28671 /* Data */
28672 .data : AT(ADDR(.data) - LOAD_OFFSET) {
28673 +
28674 +#ifdef CONFIG_PAX_KERNEXEC
28675 + . = ALIGN(HPAGE_SIZE);
28676 +#else
28677 + . = ALIGN(PAGE_SIZE);
28678 +#endif
28679 +
28680 /* Start of data section */
28681 _sdata = .;
28682
28683 /* init_task */
28684 INIT_TASK_DATA(THREAD_SIZE)
28685
28686 -#ifdef CONFIG_X86_32
28687 - /* 32 bit has nosave before _edata */
28688 NOSAVE_DATA
28689 -#endif
28690
28691 PAGE_ALIGNED_DATA(PAGE_SIZE)
28692
28693 @@ -174,12 +232,19 @@ SECTIONS
28694 . = ALIGN(__vvar_page + PAGE_SIZE, PAGE_SIZE);
28695
28696 /* Init code and data - will be freed after init */
28697 - . = ALIGN(PAGE_SIZE);
28698 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
28699 + BYTE(0)
28700 +
28701 +#ifdef CONFIG_PAX_KERNEXEC
28702 + . = ALIGN(HPAGE_SIZE);
28703 +#else
28704 + . = ALIGN(PAGE_SIZE);
28705 +#endif
28706 +
28707 __init_begin = .; /* paired with __init_end */
28708 - }
28709 + } :init.begin
28710
28711 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
28712 +#ifdef CONFIG_SMP
28713 /*
28714 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
28715 * output PHDR, so the next output section - .init.text - should
28716 @@ -190,12 +255,27 @@ SECTIONS
28717 "per-CPU data too large - increase CONFIG_PHYSICAL_START")
28718 #endif
28719
28720 - INIT_TEXT_SECTION(PAGE_SIZE)
28721 -#ifdef CONFIG_X86_64
28722 - :init
28723 -#endif
28724 + . = ALIGN(PAGE_SIZE);
28725 + init_begin = .;
28726 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
28727 + VMLINUX_SYMBOL(_sinittext) = .;
28728 + INIT_TEXT
28729 + . = ALIGN(PAGE_SIZE);
28730 + } :text.init
28731
28732 - INIT_DATA_SECTION(16)
28733 + /*
28734 + * .exit.text is discard at runtime, not link time, to deal with
28735 + * references from .altinstructions and .eh_frame
28736 + */
28737 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
28738 + EXIT_TEXT
28739 + VMLINUX_SYMBOL(_einittext) = .;
28740 + . = ALIGN(16);
28741 + } :text.exit
28742 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
28743 +
28744 + . = ALIGN(PAGE_SIZE);
28745 + INIT_DATA_SECTION(16) :init
28746
28747 .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
28748 __x86_cpu_dev_start = .;
28749 @@ -266,19 +346,12 @@ SECTIONS
28750 }
28751
28752 . = ALIGN(8);
28753 - /*
28754 - * .exit.text is discard at runtime, not link time, to deal with
28755 - * references from .altinstructions and .eh_frame
28756 - */
28757 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
28758 - EXIT_TEXT
28759 - }
28760
28761 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
28762 EXIT_DATA
28763 }
28764
28765 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
28766 +#ifndef CONFIG_SMP
28767 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
28768 #endif
28769
28770 @@ -297,16 +370,10 @@ SECTIONS
28771 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
28772 __smp_locks = .;
28773 *(.smp_locks)
28774 - . = ALIGN(PAGE_SIZE);
28775 __smp_locks_end = .;
28776 + . = ALIGN(PAGE_SIZE);
28777 }
28778
28779 -#ifdef CONFIG_X86_64
28780 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
28781 - NOSAVE_DATA
28782 - }
28783 -#endif
28784 -
28785 /* BSS */
28786 . = ALIGN(PAGE_SIZE);
28787 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
28788 @@ -322,6 +389,7 @@ SECTIONS
28789 __brk_base = .;
28790 . += 64 * 1024; /* 64k alignment slop space */
28791 *(.brk_reservation) /* areas brk users have reserved */
28792 + . = ALIGN(HPAGE_SIZE);
28793 __brk_limit = .;
28794 }
28795
28796 @@ -348,13 +416,12 @@ SECTIONS
28797 * for the boot processor.
28798 */
28799 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
28800 -INIT_PER_CPU(gdt_page);
28801 INIT_PER_CPU(irq_stack_union);
28802
28803 /*
28804 * Build-time check on the image size:
28805 */
28806 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
28807 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
28808 "kernel image bigger than KERNEL_IMAGE_SIZE");
28809
28810 #ifdef CONFIG_SMP
28811 diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
28812 index 2dcc6ff..082dc7a 100644
28813 --- a/arch/x86/kernel/vsyscall_64.c
28814 +++ b/arch/x86/kernel/vsyscall_64.c
28815 @@ -38,15 +38,13 @@
28816 #define CREATE_TRACE_POINTS
28817 #include "vsyscall_trace.h"
28818
28819 -static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
28820 +static enum { EMULATE, NONE } vsyscall_mode = EMULATE;
28821
28822 static int __init vsyscall_setup(char *str)
28823 {
28824 if (str) {
28825 if (!strcmp("emulate", str))
28826 vsyscall_mode = EMULATE;
28827 - else if (!strcmp("native", str))
28828 - vsyscall_mode = NATIVE;
28829 else if (!strcmp("none", str))
28830 vsyscall_mode = NONE;
28831 else
28832 @@ -264,8 +262,7 @@ do_ret:
28833 return true;
28834
28835 sigsegv:
28836 - force_sig(SIGSEGV, current);
28837 - return true;
28838 + do_group_exit(SIGKILL);
28839 }
28840
28841 /*
28842 @@ -283,8 +280,8 @@ static struct vm_operations_struct gate_vma_ops = {
28843 static struct vm_area_struct gate_vma = {
28844 .vm_start = VSYSCALL_ADDR,
28845 .vm_end = VSYSCALL_ADDR + PAGE_SIZE,
28846 - .vm_page_prot = PAGE_READONLY_EXEC,
28847 - .vm_flags = VM_READ | VM_EXEC,
28848 + .vm_page_prot = PAGE_READONLY,
28849 + .vm_flags = VM_READ,
28850 .vm_ops = &gate_vma_ops,
28851 };
28852
28853 @@ -325,10 +322,7 @@ void __init map_vsyscall(void)
28854 unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
28855
28856 if (vsyscall_mode != NONE)
28857 - __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
28858 - vsyscall_mode == NATIVE
28859 - ? PAGE_KERNEL_VSYSCALL
28860 - : PAGE_KERNEL_VVAR);
28861 + __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall, PAGE_KERNEL_VVAR);
28862
28863 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
28864 (unsigned long)VSYSCALL_ADDR);
28865 diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
28866 index 37d8fa4..66e319a 100644
28867 --- a/arch/x86/kernel/x8664_ksyms_64.c
28868 +++ b/arch/x86/kernel/x8664_ksyms_64.c
28869 @@ -34,8 +34,6 @@ EXPORT_SYMBOL(copy_user_generic_string);
28870 EXPORT_SYMBOL(copy_user_generic_unrolled);
28871 EXPORT_SYMBOL(copy_user_enhanced_fast_string);
28872 EXPORT_SYMBOL(__copy_user_nocache);
28873 -EXPORT_SYMBOL(_copy_from_user);
28874 -EXPORT_SYMBOL(_copy_to_user);
28875
28876 EXPORT_SYMBOL(copy_page);
28877 EXPORT_SYMBOL(clear_page);
28878 @@ -79,3 +77,7 @@ EXPORT_SYMBOL(___preempt_schedule);
28879 EXPORT_SYMBOL(___preempt_schedule_context);
28880 #endif
28881 #endif
28882 +
28883 +#ifdef CONFIG_PAX_PER_CPU_PGD
28884 +EXPORT_SYMBOL(cpu_pgd);
28885 +#endif
28886 diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c
28887 index 234b072..b7ab191 100644
28888 --- a/arch/x86/kernel/x86_init.c
28889 +++ b/arch/x86/kernel/x86_init.c
28890 @@ -93,7 +93,7 @@ struct x86_cpuinit_ops x86_cpuinit = {
28891 static void default_nmi_init(void) { };
28892 static int default_i8042_detect(void) { return 1; };
28893
28894 -struct x86_platform_ops x86_platform = {
28895 +struct x86_platform_ops x86_platform __read_only = {
28896 .calibrate_tsc = native_calibrate_tsc,
28897 .get_wallclock = mach_get_cmos_time,
28898 .set_wallclock = mach_set_rtc_mmss,
28899 @@ -109,7 +109,7 @@ struct x86_platform_ops x86_platform = {
28900 EXPORT_SYMBOL_GPL(x86_platform);
28901
28902 #if defined(CONFIG_PCI_MSI)
28903 -struct x86_msi_ops x86_msi = {
28904 +struct x86_msi_ops x86_msi __read_only = {
28905 .setup_msi_irqs = native_setup_msi_irqs,
28906 .compose_msi_msg = native_compose_msi_msg,
28907 .teardown_msi_irq = native_teardown_msi_irq,
28908 @@ -140,7 +140,7 @@ void arch_restore_msi_irqs(struct pci_dev *dev)
28909 }
28910 #endif
28911
28912 -struct x86_io_apic_ops x86_io_apic_ops = {
28913 +struct x86_io_apic_ops x86_io_apic_ops __read_only = {
28914 .init = native_io_apic_init_mappings,
28915 .read = native_io_apic_read,
28916 .write = native_io_apic_write,
28917 diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
28918 index 87a815b..727dbe6 100644
28919 --- a/arch/x86/kernel/xsave.c
28920 +++ b/arch/x86/kernel/xsave.c
28921 @@ -168,18 +168,18 @@ static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
28922
28923 /* Setup the bytes not touched by the [f]xsave and reserved for SW. */
28924 sw_bytes = ia32_frame ? &fx_sw_reserved_ia32 : &fx_sw_reserved;
28925 - err = __copy_to_user(&x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));
28926 + err = __copy_to_user(x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));
28927
28928 if (!use_xsave())
28929 return err;
28930
28931 - err |= __put_user(FP_XSTATE_MAGIC2, (__u32 *)(buf + xstate_size));
28932 + err |= __put_user(FP_XSTATE_MAGIC2, (__u32 __user *)(buf + xstate_size));
28933
28934 /*
28935 * Read the xstate_bv which we copied (directly from the cpu or
28936 * from the state in task struct) to the user buffers.
28937 */
28938 - err |= __get_user(xstate_bv, (__u32 *)&x->xsave_hdr.xstate_bv);
28939 + err |= __get_user(xstate_bv, (__u32 __user *)&x->xsave_hdr.xstate_bv);
28940
28941 /*
28942 * For legacy compatible, we always set FP/SSE bits in the bit
28943 @@ -194,7 +194,7 @@ static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
28944 */
28945 xstate_bv |= XSTATE_FPSSE;
28946
28947 - err |= __put_user(xstate_bv, (__u32 *)&x->xsave_hdr.xstate_bv);
28948 + err |= __put_user(xstate_bv, (__u32 __user *)&x->xsave_hdr.xstate_bv);
28949
28950 return err;
28951 }
28952 @@ -203,6 +203,7 @@ static inline int save_user_xstate(struct xsave_struct __user *buf)
28953 {
28954 int err;
28955
28956 + buf = (struct xsave_struct __user *)____m(buf);
28957 if (use_xsave())
28958 err = xsave_user(buf);
28959 else if (use_fxsr())
28960 @@ -313,6 +314,7 @@ sanitize_restored_xstate(struct task_struct *tsk,
28961 */
28962 static inline int restore_user_xstate(void __user *buf, u64 xbv, int fx_only)
28963 {
28964 + buf = (void __user *)____m(buf);
28965 if (use_xsave()) {
28966 if ((unsigned long)buf % 64 || fx_only) {
28967 u64 init_bv = pcntxt_mask & ~XSTATE_FPSSE;
28968 diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
28969 index 1d08ad3..c6a4faf 100644
28970 --- a/arch/x86/kvm/cpuid.c
28971 +++ b/arch/x86/kvm/cpuid.c
28972 @@ -204,15 +204,20 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
28973 struct kvm_cpuid2 *cpuid,
28974 struct kvm_cpuid_entry2 __user *entries)
28975 {
28976 - int r;
28977 + int r, i;
28978
28979 r = -E2BIG;
28980 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
28981 goto out;
28982 r = -EFAULT;
28983 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
28984 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
28985 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
28986 goto out;
28987 + for (i = 0; i < cpuid->nent; ++i) {
28988 + struct kvm_cpuid_entry2 cpuid_entry;
28989 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
28990 + goto out;
28991 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
28992 + }
28993 vcpu->arch.cpuid_nent = cpuid->nent;
28994 kvm_apic_set_version(vcpu);
28995 kvm_x86_ops->cpuid_update(vcpu);
28996 @@ -225,15 +230,19 @@ int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
28997 struct kvm_cpuid2 *cpuid,
28998 struct kvm_cpuid_entry2 __user *entries)
28999 {
29000 - int r;
29001 + int r, i;
29002
29003 r = -E2BIG;
29004 if (cpuid->nent < vcpu->arch.cpuid_nent)
29005 goto out;
29006 r = -EFAULT;
29007 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
29008 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
29009 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
29010 goto out;
29011 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
29012 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
29013 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
29014 + goto out;
29015 + }
29016 return 0;
29017
29018 out:
29019 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
29020 index 630bcb0..a7f6d9e 100644
29021 --- a/arch/x86/kvm/emulate.c
29022 +++ b/arch/x86/kvm/emulate.c
29023 @@ -3569,7 +3569,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
29024 int cr = ctxt->modrm_reg;
29025 u64 efer = 0;
29026
29027 - static u64 cr_reserved_bits[] = {
29028 + static const u64 cr_reserved_bits[] = {
29029 0xffffffff00000000ULL,
29030 0, 0, 0, /* CR3 checked later */
29031 CR4_RESERVED_BITS,
29032 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
29033 index 67d07e0..10769d5 100644
29034 --- a/arch/x86/kvm/lapic.c
29035 +++ b/arch/x86/kvm/lapic.c
29036 @@ -56,7 +56,7 @@
29037 #define APIC_BUS_CYCLE_NS 1
29038
29039 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
29040 -#define apic_debug(fmt, arg...)
29041 +#define apic_debug(fmt, arg...) do {} while (0)
29042
29043 #define APIC_LVT_NUM 6
29044 /* 14 is the version for Xeon and Pentium 8.4.8*/
29045 diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
29046 index 9d28383..c4ea87e 100644
29047 --- a/arch/x86/kvm/lapic.h
29048 +++ b/arch/x86/kvm/lapic.h
29049 @@ -150,7 +150,7 @@ static inline bool kvm_apic_vid_enabled(struct kvm *kvm)
29050
29051 static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
29052 {
29053 - return vcpu->arch.apic->pending_events;
29054 + return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events;
29055 }
29056
29057 bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector);
29058 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
29059 index 6e6d115..43fecbf 100644
29060 --- a/arch/x86/kvm/paging_tmpl.h
29061 +++ b/arch/x86/kvm/paging_tmpl.h
29062 @@ -343,7 +343,7 @@ retry_walk:
29063 if (unlikely(kvm_is_error_hva(host_addr)))
29064 goto error;
29065
29066 - ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
29067 + ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
29068 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte))))
29069 goto error;
29070 walker->ptep_user[walker->level - 1] = ptep_user;
29071 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
29072 index 4911bf1..e7d3ed2 100644
29073 --- a/arch/x86/kvm/svm.c
29074 +++ b/arch/x86/kvm/svm.c
29075 @@ -3577,7 +3577,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
29076 int cpu = raw_smp_processor_id();
29077
29078 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
29079 +
29080 + pax_open_kernel();
29081 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
29082 + pax_close_kernel();
29083 +
29084 load_TR_desc();
29085 }
29086
29087 @@ -3973,6 +3977,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
29088 #endif
29089 #endif
29090
29091 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
29092 + __set_fs(current_thread_info()->addr_limit);
29093 +#endif
29094 +
29095 reload_tss(vcpu);
29096
29097 local_irq_disable();
29098 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
29099 index 2d73807..84a0e59 100644
29100 --- a/arch/x86/kvm/vmx.c
29101 +++ b/arch/x86/kvm/vmx.c
29102 @@ -1440,12 +1440,12 @@ static void vmcs_write64(unsigned long field, u64 value)
29103 #endif
29104 }
29105
29106 -static void vmcs_clear_bits(unsigned long field, u32 mask)
29107 +static void vmcs_clear_bits(unsigned long field, unsigned long mask)
29108 {
29109 vmcs_writel(field, vmcs_readl(field) & ~mask);
29110 }
29111
29112 -static void vmcs_set_bits(unsigned long field, u32 mask)
29113 +static void vmcs_set_bits(unsigned long field, unsigned long mask)
29114 {
29115 vmcs_writel(field, vmcs_readl(field) | mask);
29116 }
29117 @@ -1705,7 +1705,11 @@ static void reload_tss(void)
29118 struct desc_struct *descs;
29119
29120 descs = (void *)gdt->address;
29121 +
29122 + pax_open_kernel();
29123 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
29124 + pax_close_kernel();
29125 +
29126 load_TR_desc();
29127 }
29128
29129 @@ -1941,6 +1945,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
29130 vmcs_writel(HOST_TR_BASE, kvm_read_tr_base()); /* 22.2.4 */
29131 vmcs_writel(HOST_GDTR_BASE, gdt->address); /* 22.2.4 */
29132
29133 +#ifdef CONFIG_PAX_PER_CPU_PGD
29134 + vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
29135 +#endif
29136 +
29137 rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
29138 vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
29139 vmx->loaded_vmcs->cpu = cpu;
29140 @@ -2233,7 +2241,7 @@ static void setup_msrs(struct vcpu_vmx *vmx)
29141 * reads and returns guest's timestamp counter "register"
29142 * guest_tsc = host_tsc + tsc_offset -- 21.3
29143 */
29144 -static u64 guest_read_tsc(void)
29145 +static u64 __intentional_overflow(-1) guest_read_tsc(void)
29146 {
29147 u64 host_tsc, tsc_offset;
29148
29149 @@ -4467,7 +4475,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
29150 unsigned long cr4;
29151
29152 vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */
29153 +
29154 +#ifndef CONFIG_PAX_PER_CPU_PGD
29155 vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
29156 +#endif
29157
29158 /* Save the most likely value for this task's CR4 in the VMCS. */
29159 cr4 = cr4_read_shadow();
29160 @@ -4494,7 +4505,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
29161 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
29162 vmx->host_idt_base = dt.address;
29163
29164 - vmcs_writel(HOST_RIP, vmx_return); /* 22.2.5 */
29165 + vmcs_writel(HOST_RIP, ktla_ktva(vmx_return)); /* 22.2.5 */
29166
29167 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
29168 vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
29169 @@ -6107,11 +6118,17 @@ static __init int hardware_setup(void)
29170 * page upon invalidation. No need to do anything if not
29171 * using the APIC_ACCESS_ADDR VMCS field.
29172 */
29173 - if (!flexpriority_enabled)
29174 - kvm_x86_ops->set_apic_access_page_addr = NULL;
29175 + if (!flexpriority_enabled) {
29176 + pax_open_kernel();
29177 + *(void **)&kvm_x86_ops->set_apic_access_page_addr = NULL;
29178 + pax_close_kernel();
29179 + }
29180
29181 - if (!cpu_has_vmx_tpr_shadow())
29182 - kvm_x86_ops->update_cr8_intercept = NULL;
29183 + if (!cpu_has_vmx_tpr_shadow()) {
29184 + pax_open_kernel();
29185 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
29186 + pax_close_kernel();
29187 + }
29188
29189 if (enable_ept && !cpu_has_vmx_ept_2m_page())
29190 kvm_disable_largepages();
29191 @@ -6122,14 +6139,16 @@ static __init int hardware_setup(void)
29192 if (!cpu_has_vmx_apicv())
29193 enable_apicv = 0;
29194
29195 + pax_open_kernel();
29196 if (enable_apicv)
29197 - kvm_x86_ops->update_cr8_intercept = NULL;
29198 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
29199 else {
29200 - kvm_x86_ops->hwapic_irr_update = NULL;
29201 - kvm_x86_ops->hwapic_isr_update = NULL;
29202 - kvm_x86_ops->deliver_posted_interrupt = NULL;
29203 - kvm_x86_ops->sync_pir_to_irr = vmx_sync_pir_to_irr_dummy;
29204 + *(void **)&kvm_x86_ops->hwapic_irr_update = NULL;
29205 + *(void **)&kvm_x86_ops->hwapic_isr_update = NULL;
29206 + *(void **)&kvm_x86_ops->deliver_posted_interrupt = NULL;
29207 + *(void **)&kvm_x86_ops->sync_pir_to_irr = vmx_sync_pir_to_irr_dummy;
29208 }
29209 + pax_close_kernel();
29210
29211 vmx_disable_intercept_for_msr(MSR_FS_BASE, false);
29212 vmx_disable_intercept_for_msr(MSR_GS_BASE, false);
29213 @@ -6182,10 +6201,12 @@ static __init int hardware_setup(void)
29214 enable_pml = 0;
29215
29216 if (!enable_pml) {
29217 - kvm_x86_ops->slot_enable_log_dirty = NULL;
29218 - kvm_x86_ops->slot_disable_log_dirty = NULL;
29219 - kvm_x86_ops->flush_log_dirty = NULL;
29220 - kvm_x86_ops->enable_log_dirty_pt_masked = NULL;
29221 + pax_open_kernel();
29222 + *(void **)&kvm_x86_ops->slot_enable_log_dirty = NULL;
29223 + *(void **)&kvm_x86_ops->slot_disable_log_dirty = NULL;
29224 + *(void **)&kvm_x86_ops->flush_log_dirty = NULL;
29225 + *(void **)&kvm_x86_ops->enable_log_dirty_pt_masked = NULL;
29226 + pax_close_kernel();
29227 }
29228
29229 return alloc_kvm_area();
29230 @@ -8230,6 +8251,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
29231 "jmp 2f \n\t"
29232 "1: " __ex(ASM_VMX_VMRESUME) "\n\t"
29233 "2: "
29234 +
29235 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
29236 + "ljmp %[cs],$3f\n\t"
29237 + "3: "
29238 +#endif
29239 +
29240 /* Save guest registers, load host registers, keep flags */
29241 "mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
29242 "pop %0 \n\t"
29243 @@ -8282,6 +8309,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
29244 #endif
29245 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
29246 [wordsize]"i"(sizeof(ulong))
29247 +
29248 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
29249 + ,[cs]"i"(__KERNEL_CS)
29250 +#endif
29251 +
29252 : "cc", "memory"
29253 #ifdef CONFIG_X86_64
29254 , "rax", "rbx", "rdi", "rsi"
29255 @@ -8295,7 +8327,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
29256 if (debugctlmsr)
29257 update_debugctlmsr(debugctlmsr);
29258
29259 -#ifndef CONFIG_X86_64
29260 +#ifdef CONFIG_X86_32
29261 /*
29262 * The sysexit path does not restore ds/es, so we must set them to
29263 * a reasonable value ourselves.
29264 @@ -8304,8 +8336,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
29265 * may be executed in interrupt context, which saves and restore segments
29266 * around it, nullifying its effect.
29267 */
29268 - loadsegment(ds, __USER_DS);
29269 - loadsegment(es, __USER_DS);
29270 + loadsegment(ds, __KERNEL_DS);
29271 + loadsegment(es, __KERNEL_DS);
29272 + loadsegment(ss, __KERNEL_DS);
29273 +
29274 +#ifdef CONFIG_PAX_KERNEXEC
29275 + loadsegment(fs, __KERNEL_PERCPU);
29276 +#endif
29277 +
29278 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29279 + __set_fs(current_thread_info()->addr_limit);
29280 +#endif
29281 +
29282 #endif
29283
29284 vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
29285 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
29286 index ea306ad..669f42d 100644
29287 --- a/arch/x86/kvm/x86.c
29288 +++ b/arch/x86/kvm/x86.c
29289 @@ -1929,8 +1929,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
29290 {
29291 struct kvm *kvm = vcpu->kvm;
29292 int lm = is_long_mode(vcpu);
29293 - u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
29294 - : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
29295 + u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
29296 + : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
29297 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
29298 : kvm->arch.xen_hvm_config.blob_size_32;
29299 u32 page_num = data & ~PAGE_MASK;
29300 @@ -2867,6 +2867,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
29301 if (n < msr_list.nmsrs)
29302 goto out;
29303 r = -EFAULT;
29304 + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
29305 + goto out;
29306 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
29307 num_msrs_to_save * sizeof(u32)))
29308 goto out;
29309 @@ -5784,7 +5786,7 @@ static struct notifier_block pvclock_gtod_notifier = {
29310 };
29311 #endif
29312
29313 -int kvm_arch_init(void *opaque)
29314 +int kvm_arch_init(const void *opaque)
29315 {
29316 int r;
29317 struct kvm_x86_ops *ops = opaque;
29318 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
29319 index 8f9a133..3c7694b 100644
29320 --- a/arch/x86/lguest/boot.c
29321 +++ b/arch/x86/lguest/boot.c
29322 @@ -1341,9 +1341,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
29323 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
29324 * Launcher to reboot us.
29325 */
29326 -static void lguest_restart(char *reason)
29327 +static __noreturn void lguest_restart(char *reason)
29328 {
29329 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
29330 + BUG();
29331 }
29332
29333 /*G:050
29334 diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
29335 index 00933d5..3a64af9 100644
29336 --- a/arch/x86/lib/atomic64_386_32.S
29337 +++ b/arch/x86/lib/atomic64_386_32.S
29338 @@ -48,6 +48,10 @@ BEGIN(read)
29339 movl (v), %eax
29340 movl 4(v), %edx
29341 RET_ENDP
29342 +BEGIN(read_unchecked)
29343 + movl (v), %eax
29344 + movl 4(v), %edx
29345 +RET_ENDP
29346 #undef v
29347
29348 #define v %esi
29349 @@ -55,6 +59,10 @@ BEGIN(set)
29350 movl %ebx, (v)
29351 movl %ecx, 4(v)
29352 RET_ENDP
29353 +BEGIN(set_unchecked)
29354 + movl %ebx, (v)
29355 + movl %ecx, 4(v)
29356 +RET_ENDP
29357 #undef v
29358
29359 #define v %esi
29360 @@ -70,6 +78,20 @@ RET_ENDP
29361 BEGIN(add)
29362 addl %eax, (v)
29363 adcl %edx, 4(v)
29364 +
29365 +#ifdef CONFIG_PAX_REFCOUNT
29366 + jno 0f
29367 + subl %eax, (v)
29368 + sbbl %edx, 4(v)
29369 + int $4
29370 +0:
29371 + _ASM_EXTABLE(0b, 0b)
29372 +#endif
29373 +
29374 +RET_ENDP
29375 +BEGIN(add_unchecked)
29376 + addl %eax, (v)
29377 + adcl %edx, 4(v)
29378 RET_ENDP
29379 #undef v
29380
29381 @@ -77,6 +99,24 @@ RET_ENDP
29382 BEGIN(add_return)
29383 addl (v), %eax
29384 adcl 4(v), %edx
29385 +
29386 +#ifdef CONFIG_PAX_REFCOUNT
29387 + into
29388 +1234:
29389 + _ASM_EXTABLE(1234b, 2f)
29390 +#endif
29391 +
29392 + movl %eax, (v)
29393 + movl %edx, 4(v)
29394 +
29395 +#ifdef CONFIG_PAX_REFCOUNT
29396 +2:
29397 +#endif
29398 +
29399 +RET_ENDP
29400 +BEGIN(add_return_unchecked)
29401 + addl (v), %eax
29402 + adcl 4(v), %edx
29403 movl %eax, (v)
29404 movl %edx, 4(v)
29405 RET_ENDP
29406 @@ -86,6 +126,20 @@ RET_ENDP
29407 BEGIN(sub)
29408 subl %eax, (v)
29409 sbbl %edx, 4(v)
29410 +
29411 +#ifdef CONFIG_PAX_REFCOUNT
29412 + jno 0f
29413 + addl %eax, (v)
29414 + adcl %edx, 4(v)
29415 + int $4
29416 +0:
29417 + _ASM_EXTABLE(0b, 0b)
29418 +#endif
29419 +
29420 +RET_ENDP
29421 +BEGIN(sub_unchecked)
29422 + subl %eax, (v)
29423 + sbbl %edx, 4(v)
29424 RET_ENDP
29425 #undef v
29426
29427 @@ -96,6 +150,27 @@ BEGIN(sub_return)
29428 sbbl $0, %edx
29429 addl (v), %eax
29430 adcl 4(v), %edx
29431 +
29432 +#ifdef CONFIG_PAX_REFCOUNT
29433 + into
29434 +1234:
29435 + _ASM_EXTABLE(1234b, 2f)
29436 +#endif
29437 +
29438 + movl %eax, (v)
29439 + movl %edx, 4(v)
29440 +
29441 +#ifdef CONFIG_PAX_REFCOUNT
29442 +2:
29443 +#endif
29444 +
29445 +RET_ENDP
29446 +BEGIN(sub_return_unchecked)
29447 + negl %edx
29448 + negl %eax
29449 + sbbl $0, %edx
29450 + addl (v), %eax
29451 + adcl 4(v), %edx
29452 movl %eax, (v)
29453 movl %edx, 4(v)
29454 RET_ENDP
29455 @@ -105,6 +180,20 @@ RET_ENDP
29456 BEGIN(inc)
29457 addl $1, (v)
29458 adcl $0, 4(v)
29459 +
29460 +#ifdef CONFIG_PAX_REFCOUNT
29461 + jno 0f
29462 + subl $1, (v)
29463 + sbbl $0, 4(v)
29464 + int $4
29465 +0:
29466 + _ASM_EXTABLE(0b, 0b)
29467 +#endif
29468 +
29469 +RET_ENDP
29470 +BEGIN(inc_unchecked)
29471 + addl $1, (v)
29472 + adcl $0, 4(v)
29473 RET_ENDP
29474 #undef v
29475
29476 @@ -114,6 +203,26 @@ BEGIN(inc_return)
29477 movl 4(v), %edx
29478 addl $1, %eax
29479 adcl $0, %edx
29480 +
29481 +#ifdef CONFIG_PAX_REFCOUNT
29482 + into
29483 +1234:
29484 + _ASM_EXTABLE(1234b, 2f)
29485 +#endif
29486 +
29487 + movl %eax, (v)
29488 + movl %edx, 4(v)
29489 +
29490 +#ifdef CONFIG_PAX_REFCOUNT
29491 +2:
29492 +#endif
29493 +
29494 +RET_ENDP
29495 +BEGIN(inc_return_unchecked)
29496 + movl (v), %eax
29497 + movl 4(v), %edx
29498 + addl $1, %eax
29499 + adcl $0, %edx
29500 movl %eax, (v)
29501 movl %edx, 4(v)
29502 RET_ENDP
29503 @@ -123,6 +232,20 @@ RET_ENDP
29504 BEGIN(dec)
29505 subl $1, (v)
29506 sbbl $0, 4(v)
29507 +
29508 +#ifdef CONFIG_PAX_REFCOUNT
29509 + jno 0f
29510 + addl $1, (v)
29511 + adcl $0, 4(v)
29512 + int $4
29513 +0:
29514 + _ASM_EXTABLE(0b, 0b)
29515 +#endif
29516 +
29517 +RET_ENDP
29518 +BEGIN(dec_unchecked)
29519 + subl $1, (v)
29520 + sbbl $0, 4(v)
29521 RET_ENDP
29522 #undef v
29523
29524 @@ -132,6 +255,26 @@ BEGIN(dec_return)
29525 movl 4(v), %edx
29526 subl $1, %eax
29527 sbbl $0, %edx
29528 +
29529 +#ifdef CONFIG_PAX_REFCOUNT
29530 + into
29531 +1234:
29532 + _ASM_EXTABLE(1234b, 2f)
29533 +#endif
29534 +
29535 + movl %eax, (v)
29536 + movl %edx, 4(v)
29537 +
29538 +#ifdef CONFIG_PAX_REFCOUNT
29539 +2:
29540 +#endif
29541 +
29542 +RET_ENDP
29543 +BEGIN(dec_return_unchecked)
29544 + movl (v), %eax
29545 + movl 4(v), %edx
29546 + subl $1, %eax
29547 + sbbl $0, %edx
29548 movl %eax, (v)
29549 movl %edx, 4(v)
29550 RET_ENDP
29551 @@ -143,6 +286,13 @@ BEGIN(add_unless)
29552 adcl %edx, %edi
29553 addl (v), %eax
29554 adcl 4(v), %edx
29555 +
29556 +#ifdef CONFIG_PAX_REFCOUNT
29557 + into
29558 +1234:
29559 + _ASM_EXTABLE(1234b, 2f)
29560 +#endif
29561 +
29562 cmpl %eax, %ecx
29563 je 3f
29564 1:
29565 @@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
29566 1:
29567 addl $1, %eax
29568 adcl $0, %edx
29569 +
29570 +#ifdef CONFIG_PAX_REFCOUNT
29571 + into
29572 +1234:
29573 + _ASM_EXTABLE(1234b, 2f)
29574 +#endif
29575 +
29576 movl %eax, (v)
29577 movl %edx, 4(v)
29578 movl $1, %eax
29579 @@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
29580 movl 4(v), %edx
29581 subl $1, %eax
29582 sbbl $0, %edx
29583 +
29584 +#ifdef CONFIG_PAX_REFCOUNT
29585 + into
29586 +1234:
29587 + _ASM_EXTABLE(1234b, 1f)
29588 +#endif
29589 +
29590 js 1f
29591 movl %eax, (v)
29592 movl %edx, 4(v)
29593 diff --git a/arch/x86/lib/atomic64_cx8_32.S b/arch/x86/lib/atomic64_cx8_32.S
29594 index 082a851..6a963bc 100644
29595 --- a/arch/x86/lib/atomic64_cx8_32.S
29596 +++ b/arch/x86/lib/atomic64_cx8_32.S
29597 @@ -25,10 +25,20 @@ ENTRY(atomic64_read_cx8)
29598 CFI_STARTPROC
29599
29600 read64 %ecx
29601 + pax_force_retaddr
29602 ret
29603 CFI_ENDPROC
29604 ENDPROC(atomic64_read_cx8)
29605
29606 +ENTRY(atomic64_read_unchecked_cx8)
29607 + CFI_STARTPROC
29608 +
29609 + read64 %ecx
29610 + pax_force_retaddr
29611 + ret
29612 + CFI_ENDPROC
29613 +ENDPROC(atomic64_read_unchecked_cx8)
29614 +
29615 ENTRY(atomic64_set_cx8)
29616 CFI_STARTPROC
29617
29618 @@ -38,10 +48,25 @@ ENTRY(atomic64_set_cx8)
29619 cmpxchg8b (%esi)
29620 jne 1b
29621
29622 + pax_force_retaddr
29623 ret
29624 CFI_ENDPROC
29625 ENDPROC(atomic64_set_cx8)
29626
29627 +ENTRY(atomic64_set_unchecked_cx8)
29628 + CFI_STARTPROC
29629 +
29630 +1:
29631 +/* we don't need LOCK_PREFIX since aligned 64-bit writes
29632 + * are atomic on 586 and newer */
29633 + cmpxchg8b (%esi)
29634 + jne 1b
29635 +
29636 + pax_force_retaddr
29637 + ret
29638 + CFI_ENDPROC
29639 +ENDPROC(atomic64_set_unchecked_cx8)
29640 +
29641 ENTRY(atomic64_xchg_cx8)
29642 CFI_STARTPROC
29643
29644 @@ -50,12 +75,13 @@ ENTRY(atomic64_xchg_cx8)
29645 cmpxchg8b (%esi)
29646 jne 1b
29647
29648 + pax_force_retaddr
29649 ret
29650 CFI_ENDPROC
29651 ENDPROC(atomic64_xchg_cx8)
29652
29653 -.macro addsub_return func ins insc
29654 -ENTRY(atomic64_\func\()_return_cx8)
29655 +.macro addsub_return func ins insc unchecked=""
29656 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
29657 CFI_STARTPROC
29658 pushl_cfi_reg ebp
29659 pushl_cfi_reg ebx
29660 @@ -72,27 +98,44 @@ ENTRY(atomic64_\func\()_return_cx8)
29661 movl %edx, %ecx
29662 \ins\()l %esi, %ebx
29663 \insc\()l %edi, %ecx
29664 +
29665 +.ifb \unchecked
29666 +#ifdef CONFIG_PAX_REFCOUNT
29667 + into
29668 +2:
29669 + _ASM_EXTABLE(2b, 3f)
29670 +#endif
29671 +.endif
29672 +
29673 LOCK_PREFIX
29674 cmpxchg8b (%ebp)
29675 jne 1b
29676 -
29677 -10:
29678 movl %ebx, %eax
29679 movl %ecx, %edx
29680 +
29681 +.ifb \unchecked
29682 +#ifdef CONFIG_PAX_REFCOUNT
29683 +3:
29684 +#endif
29685 +.endif
29686 +
29687 popl_cfi_reg edi
29688 popl_cfi_reg esi
29689 popl_cfi_reg ebx
29690 popl_cfi_reg ebp
29691 + pax_force_retaddr
29692 ret
29693 CFI_ENDPROC
29694 -ENDPROC(atomic64_\func\()_return_cx8)
29695 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
29696 .endm
29697
29698 addsub_return add add adc
29699 addsub_return sub sub sbb
29700 +addsub_return add add adc _unchecked
29701 +addsub_return sub sub sbb _unchecked
29702
29703 -.macro incdec_return func ins insc
29704 -ENTRY(atomic64_\func\()_return_cx8)
29705 +.macro incdec_return func ins insc unchecked=""
29706 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
29707 CFI_STARTPROC
29708 pushl_cfi_reg ebx
29709
29710 @@ -102,21 +145,38 @@ ENTRY(atomic64_\func\()_return_cx8)
29711 movl %edx, %ecx
29712 \ins\()l $1, %ebx
29713 \insc\()l $0, %ecx
29714 +
29715 +.ifb \unchecked
29716 +#ifdef CONFIG_PAX_REFCOUNT
29717 + into
29718 +2:
29719 + _ASM_EXTABLE(2b, 3f)
29720 +#endif
29721 +.endif
29722 +
29723 LOCK_PREFIX
29724 cmpxchg8b (%esi)
29725 jne 1b
29726 -
29727 -10:
29728 movl %ebx, %eax
29729 movl %ecx, %edx
29730 +
29731 +.ifb \unchecked
29732 +#ifdef CONFIG_PAX_REFCOUNT
29733 +3:
29734 +#endif
29735 +.endif
29736 +
29737 popl_cfi_reg ebx
29738 + pax_force_retaddr
29739 ret
29740 CFI_ENDPROC
29741 -ENDPROC(atomic64_\func\()_return_cx8)
29742 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
29743 .endm
29744
29745 incdec_return inc add adc
29746 incdec_return dec sub sbb
29747 +incdec_return inc add adc _unchecked
29748 +incdec_return dec sub sbb _unchecked
29749
29750 ENTRY(atomic64_dec_if_positive_cx8)
29751 CFI_STARTPROC
29752 @@ -128,6 +188,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
29753 movl %edx, %ecx
29754 subl $1, %ebx
29755 sbb $0, %ecx
29756 +
29757 +#ifdef CONFIG_PAX_REFCOUNT
29758 + into
29759 +1234:
29760 + _ASM_EXTABLE(1234b, 2f)
29761 +#endif
29762 +
29763 js 2f
29764 LOCK_PREFIX
29765 cmpxchg8b (%esi)
29766 @@ -137,6 +204,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
29767 movl %ebx, %eax
29768 movl %ecx, %edx
29769 popl_cfi_reg ebx
29770 + pax_force_retaddr
29771 ret
29772 CFI_ENDPROC
29773 ENDPROC(atomic64_dec_if_positive_cx8)
29774 @@ -161,6 +229,13 @@ ENTRY(atomic64_add_unless_cx8)
29775 movl %edx, %ecx
29776 addl %ebp, %ebx
29777 adcl %edi, %ecx
29778 +
29779 +#ifdef CONFIG_PAX_REFCOUNT
29780 + into
29781 +1234:
29782 + _ASM_EXTABLE(1234b, 3f)
29783 +#endif
29784 +
29785 LOCK_PREFIX
29786 cmpxchg8b (%esi)
29787 jne 1b
29788 @@ -171,6 +246,7 @@ ENTRY(atomic64_add_unless_cx8)
29789 CFI_ADJUST_CFA_OFFSET -8
29790 popl_cfi_reg ebx
29791 popl_cfi_reg ebp
29792 + pax_force_retaddr
29793 ret
29794 4:
29795 cmpl %edx, 4(%esp)
29796 @@ -193,6 +269,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
29797 xorl %ecx, %ecx
29798 addl $1, %ebx
29799 adcl %edx, %ecx
29800 +
29801 +#ifdef CONFIG_PAX_REFCOUNT
29802 + into
29803 +1234:
29804 + _ASM_EXTABLE(1234b, 3f)
29805 +#endif
29806 +
29807 LOCK_PREFIX
29808 cmpxchg8b (%esi)
29809 jne 1b
29810 @@ -200,6 +283,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
29811 movl $1, %eax
29812 3:
29813 popl_cfi_reg ebx
29814 + pax_force_retaddr
29815 ret
29816 CFI_ENDPROC
29817 ENDPROC(atomic64_inc_not_zero_cx8)
29818 diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
29819 index 9bc944a..e52be6c 100644
29820 --- a/arch/x86/lib/checksum_32.S
29821 +++ b/arch/x86/lib/checksum_32.S
29822 @@ -29,7 +29,8 @@
29823 #include <asm/dwarf2.h>
29824 #include <asm/errno.h>
29825 #include <asm/asm.h>
29826 -
29827 +#include <asm/segment.h>
29828 +
29829 /*
29830 * computes a partial checksum, e.g. for TCP/UDP fragments
29831 */
29832 @@ -285,9 +286,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
29833
29834 #define ARGBASE 16
29835 #define FP 12
29836 -
29837 -ENTRY(csum_partial_copy_generic)
29838 +
29839 +ENTRY(csum_partial_copy_generic_to_user)
29840 CFI_STARTPROC
29841 +
29842 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29843 + pushl_cfi %gs
29844 + popl_cfi %es
29845 + jmp csum_partial_copy_generic
29846 +#endif
29847 +
29848 +ENTRY(csum_partial_copy_generic_from_user)
29849 +
29850 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29851 + pushl_cfi %gs
29852 + popl_cfi %ds
29853 +#endif
29854 +
29855 +ENTRY(csum_partial_copy_generic)
29856 subl $4,%esp
29857 CFI_ADJUST_CFA_OFFSET 4
29858 pushl_cfi_reg edi
29859 @@ -306,7 +322,7 @@ ENTRY(csum_partial_copy_generic)
29860 jmp 4f
29861 SRC(1: movw (%esi), %bx )
29862 addl $2, %esi
29863 -DST( movw %bx, (%edi) )
29864 +DST( movw %bx, %es:(%edi) )
29865 addl $2, %edi
29866 addw %bx, %ax
29867 adcl $0, %eax
29868 @@ -318,30 +334,30 @@ DST( movw %bx, (%edi) )
29869 SRC(1: movl (%esi), %ebx )
29870 SRC( movl 4(%esi), %edx )
29871 adcl %ebx, %eax
29872 -DST( movl %ebx, (%edi) )
29873 +DST( movl %ebx, %es:(%edi) )
29874 adcl %edx, %eax
29875 -DST( movl %edx, 4(%edi) )
29876 +DST( movl %edx, %es:4(%edi) )
29877
29878 SRC( movl 8(%esi), %ebx )
29879 SRC( movl 12(%esi), %edx )
29880 adcl %ebx, %eax
29881 -DST( movl %ebx, 8(%edi) )
29882 +DST( movl %ebx, %es:8(%edi) )
29883 adcl %edx, %eax
29884 -DST( movl %edx, 12(%edi) )
29885 +DST( movl %edx, %es:12(%edi) )
29886
29887 SRC( movl 16(%esi), %ebx )
29888 SRC( movl 20(%esi), %edx )
29889 adcl %ebx, %eax
29890 -DST( movl %ebx, 16(%edi) )
29891 +DST( movl %ebx, %es:16(%edi) )
29892 adcl %edx, %eax
29893 -DST( movl %edx, 20(%edi) )
29894 +DST( movl %edx, %es:20(%edi) )
29895
29896 SRC( movl 24(%esi), %ebx )
29897 SRC( movl 28(%esi), %edx )
29898 adcl %ebx, %eax
29899 -DST( movl %ebx, 24(%edi) )
29900 +DST( movl %ebx, %es:24(%edi) )
29901 adcl %edx, %eax
29902 -DST( movl %edx, 28(%edi) )
29903 +DST( movl %edx, %es:28(%edi) )
29904
29905 lea 32(%esi), %esi
29906 lea 32(%edi), %edi
29907 @@ -355,7 +371,7 @@ DST( movl %edx, 28(%edi) )
29908 shrl $2, %edx # This clears CF
29909 SRC(3: movl (%esi), %ebx )
29910 adcl %ebx, %eax
29911 -DST( movl %ebx, (%edi) )
29912 +DST( movl %ebx, %es:(%edi) )
29913 lea 4(%esi), %esi
29914 lea 4(%edi), %edi
29915 dec %edx
29916 @@ -367,12 +383,12 @@ DST( movl %ebx, (%edi) )
29917 jb 5f
29918 SRC( movw (%esi), %cx )
29919 leal 2(%esi), %esi
29920 -DST( movw %cx, (%edi) )
29921 +DST( movw %cx, %es:(%edi) )
29922 leal 2(%edi), %edi
29923 je 6f
29924 shll $16,%ecx
29925 SRC(5: movb (%esi), %cl )
29926 -DST( movb %cl, (%edi) )
29927 +DST( movb %cl, %es:(%edi) )
29928 6: addl %ecx, %eax
29929 adcl $0, %eax
29930 7:
29931 @@ -383,7 +399,7 @@ DST( movb %cl, (%edi) )
29932
29933 6001:
29934 movl ARGBASE+20(%esp), %ebx # src_err_ptr
29935 - movl $-EFAULT, (%ebx)
29936 + movl $-EFAULT, %ss:(%ebx)
29937
29938 # zero the complete destination - computing the rest
29939 # is too much work
29940 @@ -396,37 +412,58 @@ DST( movb %cl, (%edi) )
29941
29942 6002:
29943 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
29944 - movl $-EFAULT,(%ebx)
29945 + movl $-EFAULT,%ss:(%ebx)
29946 jmp 5000b
29947
29948 .previous
29949
29950 + pushl_cfi %ss
29951 + popl_cfi %ds
29952 + pushl_cfi %ss
29953 + popl_cfi %es
29954 popl_cfi_reg ebx
29955 popl_cfi_reg esi
29956 popl_cfi_reg edi
29957 popl_cfi %ecx # equivalent to addl $4,%esp
29958 ret
29959 CFI_ENDPROC
29960 -ENDPROC(csum_partial_copy_generic)
29961 +ENDPROC(csum_partial_copy_generic_to_user)
29962
29963 #else
29964
29965 /* Version for PentiumII/PPro */
29966
29967 #define ROUND1(x) \
29968 + nop; nop; nop; \
29969 SRC(movl x(%esi), %ebx ) ; \
29970 addl %ebx, %eax ; \
29971 - DST(movl %ebx, x(%edi) ) ;
29972 + DST(movl %ebx, %es:x(%edi)) ;
29973
29974 #define ROUND(x) \
29975 + nop; nop; nop; \
29976 SRC(movl x(%esi), %ebx ) ; \
29977 adcl %ebx, %eax ; \
29978 - DST(movl %ebx, x(%edi) ) ;
29979 + DST(movl %ebx, %es:x(%edi)) ;
29980
29981 #define ARGBASE 12
29982 -
29983 -ENTRY(csum_partial_copy_generic)
29984 +
29985 +ENTRY(csum_partial_copy_generic_to_user)
29986 CFI_STARTPROC
29987 +
29988 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29989 + pushl_cfi %gs
29990 + popl_cfi %es
29991 + jmp csum_partial_copy_generic
29992 +#endif
29993 +
29994 +ENTRY(csum_partial_copy_generic_from_user)
29995 +
29996 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29997 + pushl_cfi %gs
29998 + popl_cfi %ds
29999 +#endif
30000 +
30001 +ENTRY(csum_partial_copy_generic)
30002 pushl_cfi_reg ebx
30003 pushl_cfi_reg edi
30004 pushl_cfi_reg esi
30005 @@ -444,7 +481,7 @@ ENTRY(csum_partial_copy_generic)
30006 subl %ebx, %edi
30007 lea -1(%esi),%edx
30008 andl $-32,%edx
30009 - lea 3f(%ebx,%ebx), %ebx
30010 + lea 3f(%ebx,%ebx,2), %ebx
30011 testl %esi, %esi
30012 jmp *%ebx
30013 1: addl $64,%esi
30014 @@ -465,19 +502,19 @@ ENTRY(csum_partial_copy_generic)
30015 jb 5f
30016 SRC( movw (%esi), %dx )
30017 leal 2(%esi), %esi
30018 -DST( movw %dx, (%edi) )
30019 +DST( movw %dx, %es:(%edi) )
30020 leal 2(%edi), %edi
30021 je 6f
30022 shll $16,%edx
30023 5:
30024 SRC( movb (%esi), %dl )
30025 -DST( movb %dl, (%edi) )
30026 +DST( movb %dl, %es:(%edi) )
30027 6: addl %edx, %eax
30028 adcl $0, %eax
30029 7:
30030 .section .fixup, "ax"
30031 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
30032 - movl $-EFAULT, (%ebx)
30033 + movl $-EFAULT, %ss:(%ebx)
30034 # zero the complete destination (computing the rest is too much work)
30035 movl ARGBASE+8(%esp),%edi # dst
30036 movl ARGBASE+12(%esp),%ecx # len
30037 @@ -485,16 +522,23 @@ DST( movb %dl, (%edi) )
30038 rep; stosb
30039 jmp 7b
30040 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
30041 - movl $-EFAULT, (%ebx)
30042 + movl $-EFAULT, %ss:(%ebx)
30043 jmp 7b
30044 .previous
30045
30046 +#ifdef CONFIG_PAX_MEMORY_UDEREF
30047 + pushl_cfi %ss
30048 + popl_cfi %ds
30049 + pushl_cfi %ss
30050 + popl_cfi %es
30051 +#endif
30052 +
30053 popl_cfi_reg esi
30054 popl_cfi_reg edi
30055 popl_cfi_reg ebx
30056 ret
30057 CFI_ENDPROC
30058 -ENDPROC(csum_partial_copy_generic)
30059 +ENDPROC(csum_partial_copy_generic_to_user)
30060
30061 #undef ROUND
30062 #undef ROUND1
30063 diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
30064 index e67e579..4782449 100644
30065 --- a/arch/x86/lib/clear_page_64.S
30066 +++ b/arch/x86/lib/clear_page_64.S
30067 @@ -23,6 +23,7 @@ ENTRY(clear_page)
30068 movl $4096/8,%ecx
30069 xorl %eax,%eax
30070 rep stosq
30071 + pax_force_retaddr
30072 ret
30073 CFI_ENDPROC
30074 ENDPROC(clear_page)
30075 @@ -47,6 +48,7 @@ ENTRY(clear_page_orig)
30076 leaq 64(%rdi),%rdi
30077 jnz .Lloop
30078 nop
30079 + pax_force_retaddr
30080 ret
30081 CFI_ENDPROC
30082 ENDPROC(clear_page_orig)
30083 @@ -56,6 +58,7 @@ ENTRY(clear_page_c_e)
30084 movl $4096,%ecx
30085 xorl %eax,%eax
30086 rep stosb
30087 + pax_force_retaddr
30088 ret
30089 CFI_ENDPROC
30090 ENDPROC(clear_page_c_e)
30091 diff --git a/arch/x86/lib/cmpxchg16b_emu.S b/arch/x86/lib/cmpxchg16b_emu.S
30092 index 40a1725..5d12ac4 100644
30093 --- a/arch/x86/lib/cmpxchg16b_emu.S
30094 +++ b/arch/x86/lib/cmpxchg16b_emu.S
30095 @@ -8,6 +8,7 @@
30096 #include <linux/linkage.h>
30097 #include <asm/dwarf2.h>
30098 #include <asm/percpu.h>
30099 +#include <asm/alternative-asm.h>
30100
30101 .text
30102
30103 @@ -46,12 +47,14 @@ CFI_STARTPROC
30104 CFI_REMEMBER_STATE
30105 popfq_cfi
30106 mov $1, %al
30107 + pax_force_retaddr
30108 ret
30109
30110 CFI_RESTORE_STATE
30111 .Lnot_same:
30112 popfq_cfi
30113 xor %al,%al
30114 + pax_force_retaddr
30115 ret
30116
30117 CFI_ENDPROC
30118 diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
30119 index 8239dbc..e714d2a 100644
30120 --- a/arch/x86/lib/copy_page_64.S
30121 +++ b/arch/x86/lib/copy_page_64.S
30122 @@ -17,6 +17,7 @@ ENTRY(copy_page)
30123 ALTERNATIVE "jmp copy_page_regs", "", X86_FEATURE_REP_GOOD
30124 movl $4096/8, %ecx
30125 rep movsq
30126 + pax_force_retaddr
30127 ret
30128 CFI_ENDPROC
30129 ENDPROC(copy_page)
30130 @@ -27,8 +28,8 @@ ENTRY(copy_page_regs)
30131 CFI_ADJUST_CFA_OFFSET 2*8
30132 movq %rbx, (%rsp)
30133 CFI_REL_OFFSET rbx, 0
30134 - movq %r12, 1*8(%rsp)
30135 - CFI_REL_OFFSET r12, 1*8
30136 + movq %r13, 1*8(%rsp)
30137 + CFI_REL_OFFSET r13, 1*8
30138
30139 movl $(4096/64)-5, %ecx
30140 .p2align 4
30141 @@ -41,7 +42,7 @@ ENTRY(copy_page_regs)
30142 movq 0x8*4(%rsi), %r9
30143 movq 0x8*5(%rsi), %r10
30144 movq 0x8*6(%rsi), %r11
30145 - movq 0x8*7(%rsi), %r12
30146 + movq 0x8*7(%rsi), %r13
30147
30148 prefetcht0 5*64(%rsi)
30149
30150 @@ -52,7 +53,7 @@ ENTRY(copy_page_regs)
30151 movq %r9, 0x8*4(%rdi)
30152 movq %r10, 0x8*5(%rdi)
30153 movq %r11, 0x8*6(%rdi)
30154 - movq %r12, 0x8*7(%rdi)
30155 + movq %r13, 0x8*7(%rdi)
30156
30157 leaq 64 (%rsi), %rsi
30158 leaq 64 (%rdi), %rdi
30159 @@ -71,7 +72,7 @@ ENTRY(copy_page_regs)
30160 movq 0x8*4(%rsi), %r9
30161 movq 0x8*5(%rsi), %r10
30162 movq 0x8*6(%rsi), %r11
30163 - movq 0x8*7(%rsi), %r12
30164 + movq 0x8*7(%rsi), %r13
30165
30166 movq %rax, 0x8*0(%rdi)
30167 movq %rbx, 0x8*1(%rdi)
30168 @@ -80,7 +81,7 @@ ENTRY(copy_page_regs)
30169 movq %r9, 0x8*4(%rdi)
30170 movq %r10, 0x8*5(%rdi)
30171 movq %r11, 0x8*6(%rdi)
30172 - movq %r12, 0x8*7(%rdi)
30173 + movq %r13, 0x8*7(%rdi)
30174
30175 leaq 64(%rdi), %rdi
30176 leaq 64(%rsi), %rsi
30177 @@ -88,10 +89,11 @@ ENTRY(copy_page_regs)
30178
30179 movq (%rsp), %rbx
30180 CFI_RESTORE rbx
30181 - movq 1*8(%rsp), %r12
30182 - CFI_RESTORE r12
30183 + movq 1*8(%rsp), %r13
30184 + CFI_RESTORE r13
30185 addq $2*8, %rsp
30186 CFI_ADJUST_CFA_OFFSET -2*8
30187 + pax_force_retaddr
30188 ret
30189 CFI_ENDPROC
30190 ENDPROC(copy_page_regs)
30191 diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
30192 index fa997df..060ab18 100644
30193 --- a/arch/x86/lib/copy_user_64.S
30194 +++ b/arch/x86/lib/copy_user_64.S
30195 @@ -15,6 +15,7 @@
30196 #include <asm/alternative-asm.h>
30197 #include <asm/asm.h>
30198 #include <asm/smap.h>
30199 +#include <asm/pgtable.h>
30200
30201 .macro ALIGN_DESTINATION
30202 /* check for bad alignment of destination */
30203 @@ -40,56 +41,6 @@
30204 _ASM_EXTABLE(101b,103b)
30205 .endm
30206
30207 -/* Standard copy_to_user with segment limit checking */
30208 -ENTRY(_copy_to_user)
30209 - CFI_STARTPROC
30210 - GET_THREAD_INFO(%rax)
30211 - movq %rdi,%rcx
30212 - addq %rdx,%rcx
30213 - jc bad_to_user
30214 - cmpq TI_addr_limit(%rax),%rcx
30215 - ja bad_to_user
30216 - ALTERNATIVE_2 "jmp copy_user_generic_unrolled", \
30217 - "jmp copy_user_generic_string", \
30218 - X86_FEATURE_REP_GOOD, \
30219 - "jmp copy_user_enhanced_fast_string", \
30220 - X86_FEATURE_ERMS
30221 - CFI_ENDPROC
30222 -ENDPROC(_copy_to_user)
30223 -
30224 -/* Standard copy_from_user with segment limit checking */
30225 -ENTRY(_copy_from_user)
30226 - CFI_STARTPROC
30227 - GET_THREAD_INFO(%rax)
30228 - movq %rsi,%rcx
30229 - addq %rdx,%rcx
30230 - jc bad_from_user
30231 - cmpq TI_addr_limit(%rax),%rcx
30232 - ja bad_from_user
30233 - ALTERNATIVE_2 "jmp copy_user_generic_unrolled", \
30234 - "jmp copy_user_generic_string", \
30235 - X86_FEATURE_REP_GOOD, \
30236 - "jmp copy_user_enhanced_fast_string", \
30237 - X86_FEATURE_ERMS
30238 - CFI_ENDPROC
30239 -ENDPROC(_copy_from_user)
30240 -
30241 - .section .fixup,"ax"
30242 - /* must zero dest */
30243 -ENTRY(bad_from_user)
30244 -bad_from_user:
30245 - CFI_STARTPROC
30246 - movl %edx,%ecx
30247 - xorl %eax,%eax
30248 - rep
30249 - stosb
30250 -bad_to_user:
30251 - movl %edx,%eax
30252 - ret
30253 - CFI_ENDPROC
30254 -ENDPROC(bad_from_user)
30255 - .previous
30256 -
30257 /*
30258 * copy_user_generic_unrolled - memory copy with exception handling.
30259 * This version is for CPUs like P4 that don't have efficient micro
30260 @@ -105,6 +56,7 @@ ENDPROC(bad_from_user)
30261 */
30262 ENTRY(copy_user_generic_unrolled)
30263 CFI_STARTPROC
30264 + ASM_PAX_OPEN_USERLAND
30265 ASM_STAC
30266 cmpl $8,%edx
30267 jb 20f /* less then 8 bytes, go to byte copy loop */
30268 @@ -154,6 +106,8 @@ ENTRY(copy_user_generic_unrolled)
30269 jnz 21b
30270 23: xor %eax,%eax
30271 ASM_CLAC
30272 + ASM_PAX_CLOSE_USERLAND
30273 + pax_force_retaddr
30274 ret
30275
30276 .section .fixup,"ax"
30277 @@ -209,6 +163,7 @@ ENDPROC(copy_user_generic_unrolled)
30278 */
30279 ENTRY(copy_user_generic_string)
30280 CFI_STARTPROC
30281 + ASM_PAX_OPEN_USERLAND
30282 ASM_STAC
30283 cmpl $8,%edx
30284 jb 2f /* less than 8 bytes, go to byte copy loop */
30285 @@ -223,6 +178,8 @@ ENTRY(copy_user_generic_string)
30286 movsb
30287 xorl %eax,%eax
30288 ASM_CLAC
30289 + ASM_PAX_CLOSE_USERLAND
30290 + pax_force_retaddr
30291 ret
30292
30293 .section .fixup,"ax"
30294 @@ -250,12 +207,15 @@ ENDPROC(copy_user_generic_string)
30295 */
30296 ENTRY(copy_user_enhanced_fast_string)
30297 CFI_STARTPROC
30298 + ASM_PAX_OPEN_USERLAND
30299 ASM_STAC
30300 movl %edx,%ecx
30301 1: rep
30302 movsb
30303 xorl %eax,%eax
30304 ASM_CLAC
30305 + ASM_PAX_CLOSE_USERLAND
30306 + pax_force_retaddr
30307 ret
30308
30309 .section .fixup,"ax"
30310 diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
30311 index 6a4f43c..c70fb52 100644
30312 --- a/arch/x86/lib/copy_user_nocache_64.S
30313 +++ b/arch/x86/lib/copy_user_nocache_64.S
30314 @@ -8,6 +8,7 @@
30315
30316 #include <linux/linkage.h>
30317 #include <asm/dwarf2.h>
30318 +#include <asm/alternative-asm.h>
30319
30320 #define FIX_ALIGNMENT 1
30321
30322 @@ -16,6 +17,7 @@
30323 #include <asm/thread_info.h>
30324 #include <asm/asm.h>
30325 #include <asm/smap.h>
30326 +#include <asm/pgtable.h>
30327
30328 .macro ALIGN_DESTINATION
30329 #ifdef FIX_ALIGNMENT
30330 @@ -49,6 +51,16 @@
30331 */
30332 ENTRY(__copy_user_nocache)
30333 CFI_STARTPROC
30334 +
30335 +#ifdef CONFIG_PAX_MEMORY_UDEREF
30336 + mov pax_user_shadow_base,%rcx
30337 + cmp %rcx,%rsi
30338 + jae 1f
30339 + add %rcx,%rsi
30340 +1:
30341 +#endif
30342 +
30343 + ASM_PAX_OPEN_USERLAND
30344 ASM_STAC
30345 cmpl $8,%edx
30346 jb 20f /* less then 8 bytes, go to byte copy loop */
30347 @@ -98,7 +110,9 @@ ENTRY(__copy_user_nocache)
30348 jnz 21b
30349 23: xorl %eax,%eax
30350 ASM_CLAC
30351 + ASM_PAX_CLOSE_USERLAND
30352 sfence
30353 + pax_force_retaddr
30354 ret
30355
30356 .section .fixup,"ax"
30357 diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
30358 index 9734182..dbee61c 100644
30359 --- a/arch/x86/lib/csum-copy_64.S
30360 +++ b/arch/x86/lib/csum-copy_64.S
30361 @@ -9,6 +9,7 @@
30362 #include <asm/dwarf2.h>
30363 #include <asm/errno.h>
30364 #include <asm/asm.h>
30365 +#include <asm/alternative-asm.h>
30366
30367 /*
30368 * Checksum copy with exception handling.
30369 @@ -56,8 +57,8 @@ ENTRY(csum_partial_copy_generic)
30370 CFI_ADJUST_CFA_OFFSET 7*8
30371 movq %rbx, 2*8(%rsp)
30372 CFI_REL_OFFSET rbx, 2*8
30373 - movq %r12, 3*8(%rsp)
30374 - CFI_REL_OFFSET r12, 3*8
30375 + movq %r15, 3*8(%rsp)
30376 + CFI_REL_OFFSET r15, 3*8
30377 movq %r14, 4*8(%rsp)
30378 CFI_REL_OFFSET r14, 4*8
30379 movq %r13, 5*8(%rsp)
30380 @@ -72,16 +73,16 @@ ENTRY(csum_partial_copy_generic)
30381 movl %edx, %ecx
30382
30383 xorl %r9d, %r9d
30384 - movq %rcx, %r12
30385 + movq %rcx, %r15
30386
30387 - shrq $6, %r12
30388 + shrq $6, %r15
30389 jz .Lhandle_tail /* < 64 */
30390
30391 clc
30392
30393 /* main loop. clear in 64 byte blocks */
30394 /* r9: zero, r8: temp2, rbx: temp1, rax: sum, rcx: saved length */
30395 - /* r11: temp3, rdx: temp4, r12 loopcnt */
30396 + /* r11: temp3, rdx: temp4, r15 loopcnt */
30397 /* r10: temp5, rbp: temp6, r14 temp7, r13 temp8 */
30398 .p2align 4
30399 .Lloop:
30400 @@ -115,7 +116,7 @@ ENTRY(csum_partial_copy_generic)
30401 adcq %r14, %rax
30402 adcq %r13, %rax
30403
30404 - decl %r12d
30405 + decl %r15d
30406
30407 dest
30408 movq %rbx, (%rsi)
30409 @@ -210,8 +211,8 @@ ENTRY(csum_partial_copy_generic)
30410 .Lende:
30411 movq 2*8(%rsp), %rbx
30412 CFI_RESTORE rbx
30413 - movq 3*8(%rsp), %r12
30414 - CFI_RESTORE r12
30415 + movq 3*8(%rsp), %r15
30416 + CFI_RESTORE r15
30417 movq 4*8(%rsp), %r14
30418 CFI_RESTORE r14
30419 movq 5*8(%rsp), %r13
30420 @@ -220,6 +221,7 @@ ENTRY(csum_partial_copy_generic)
30421 CFI_RESTORE rbp
30422 addq $7*8, %rsp
30423 CFI_ADJUST_CFA_OFFSET -7*8
30424 + pax_force_retaddr
30425 ret
30426 CFI_RESTORE_STATE
30427
30428 diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
30429 index 1318f75..44c30fd 100644
30430 --- a/arch/x86/lib/csum-wrappers_64.c
30431 +++ b/arch/x86/lib/csum-wrappers_64.c
30432 @@ -52,10 +52,12 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
30433 len -= 2;
30434 }
30435 }
30436 + pax_open_userland();
30437 stac();
30438 - isum = csum_partial_copy_generic((__force const void *)src,
30439 + isum = csum_partial_copy_generic((const void __force_kernel *)____m(src),
30440 dst, len, isum, errp, NULL);
30441 clac();
30442 + pax_close_userland();
30443 if (unlikely(*errp))
30444 goto out_err;
30445
30446 @@ -109,10 +111,12 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
30447 }
30448
30449 *errp = 0;
30450 + pax_open_userland();
30451 stac();
30452 - ret = csum_partial_copy_generic(src, (void __force *)dst,
30453 + ret = csum_partial_copy_generic(src, (void __force_kernel *)____m(dst),
30454 len, isum, NULL, errp);
30455 clac();
30456 + pax_close_userland();
30457 return ret;
30458 }
30459 EXPORT_SYMBOL(csum_partial_copy_to_user);
30460 diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
30461 index a451235..a74bfa3 100644
30462 --- a/arch/x86/lib/getuser.S
30463 +++ b/arch/x86/lib/getuser.S
30464 @@ -33,17 +33,40 @@
30465 #include <asm/thread_info.h>
30466 #include <asm/asm.h>
30467 #include <asm/smap.h>
30468 +#include <asm/segment.h>
30469 +#include <asm/pgtable.h>
30470 +#include <asm/alternative-asm.h>
30471 +
30472 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
30473 +#define __copyuser_seg gs;
30474 +#else
30475 +#define __copyuser_seg
30476 +#endif
30477
30478 .text
30479 ENTRY(__get_user_1)
30480 CFI_STARTPROC
30481 +
30482 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30483 GET_THREAD_INFO(%_ASM_DX)
30484 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30485 jae bad_get_user
30486 +
30487 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30488 + mov pax_user_shadow_base,%_ASM_DX
30489 + cmp %_ASM_DX,%_ASM_AX
30490 + jae 1234f
30491 + add %_ASM_DX,%_ASM_AX
30492 +1234:
30493 +#endif
30494 +
30495 +#endif
30496 +
30497 ASM_STAC
30498 -1: movzbl (%_ASM_AX),%edx
30499 +1: __copyuser_seg movzbl (%_ASM_AX),%edx
30500 xor %eax,%eax
30501 ASM_CLAC
30502 + pax_force_retaddr
30503 ret
30504 CFI_ENDPROC
30505 ENDPROC(__get_user_1)
30506 @@ -51,14 +74,28 @@ ENDPROC(__get_user_1)
30507 ENTRY(__get_user_2)
30508 CFI_STARTPROC
30509 add $1,%_ASM_AX
30510 +
30511 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30512 jc bad_get_user
30513 GET_THREAD_INFO(%_ASM_DX)
30514 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30515 jae bad_get_user
30516 +
30517 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30518 + mov pax_user_shadow_base,%_ASM_DX
30519 + cmp %_ASM_DX,%_ASM_AX
30520 + jae 1234f
30521 + add %_ASM_DX,%_ASM_AX
30522 +1234:
30523 +#endif
30524 +
30525 +#endif
30526 +
30527 ASM_STAC
30528 -2: movzwl -1(%_ASM_AX),%edx
30529 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
30530 xor %eax,%eax
30531 ASM_CLAC
30532 + pax_force_retaddr
30533 ret
30534 CFI_ENDPROC
30535 ENDPROC(__get_user_2)
30536 @@ -66,14 +103,28 @@ ENDPROC(__get_user_2)
30537 ENTRY(__get_user_4)
30538 CFI_STARTPROC
30539 add $3,%_ASM_AX
30540 +
30541 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30542 jc bad_get_user
30543 GET_THREAD_INFO(%_ASM_DX)
30544 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30545 jae bad_get_user
30546 +
30547 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30548 + mov pax_user_shadow_base,%_ASM_DX
30549 + cmp %_ASM_DX,%_ASM_AX
30550 + jae 1234f
30551 + add %_ASM_DX,%_ASM_AX
30552 +1234:
30553 +#endif
30554 +
30555 +#endif
30556 +
30557 ASM_STAC
30558 -3: movl -3(%_ASM_AX),%edx
30559 +3: __copyuser_seg movl -3(%_ASM_AX),%edx
30560 xor %eax,%eax
30561 ASM_CLAC
30562 + pax_force_retaddr
30563 ret
30564 CFI_ENDPROC
30565 ENDPROC(__get_user_4)
30566 @@ -86,10 +137,20 @@ ENTRY(__get_user_8)
30567 GET_THREAD_INFO(%_ASM_DX)
30568 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30569 jae bad_get_user
30570 +
30571 +#ifdef CONFIG_PAX_MEMORY_UDEREF
30572 + mov pax_user_shadow_base,%_ASM_DX
30573 + cmp %_ASM_DX,%_ASM_AX
30574 + jae 1234f
30575 + add %_ASM_DX,%_ASM_AX
30576 +1234:
30577 +#endif
30578 +
30579 ASM_STAC
30580 4: movq -7(%_ASM_AX),%rdx
30581 xor %eax,%eax
30582 ASM_CLAC
30583 + pax_force_retaddr
30584 ret
30585 #else
30586 add $7,%_ASM_AX
30587 @@ -98,10 +159,11 @@ ENTRY(__get_user_8)
30588 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30589 jae bad_get_user_8
30590 ASM_STAC
30591 -4: movl -7(%_ASM_AX),%edx
30592 -5: movl -3(%_ASM_AX),%ecx
30593 +4: __copyuser_seg movl -7(%_ASM_AX),%edx
30594 +5: __copyuser_seg movl -3(%_ASM_AX),%ecx
30595 xor %eax,%eax
30596 ASM_CLAC
30597 + pax_force_retaddr
30598 ret
30599 #endif
30600 CFI_ENDPROC
30601 @@ -113,6 +175,7 @@ bad_get_user:
30602 xor %edx,%edx
30603 mov $(-EFAULT),%_ASM_AX
30604 ASM_CLAC
30605 + pax_force_retaddr
30606 ret
30607 CFI_ENDPROC
30608 END(bad_get_user)
30609 @@ -124,6 +187,7 @@ bad_get_user_8:
30610 xor %ecx,%ecx
30611 mov $(-EFAULT),%_ASM_AX
30612 ASM_CLAC
30613 + pax_force_retaddr
30614 ret
30615 CFI_ENDPROC
30616 END(bad_get_user_8)
30617 diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
30618 index 8f72b33..a43d9969 100644
30619 --- a/arch/x86/lib/insn.c
30620 +++ b/arch/x86/lib/insn.c
30621 @@ -20,8 +20,10 @@
30622
30623 #ifdef __KERNEL__
30624 #include <linux/string.h>
30625 +#include <asm/pgtable_types.h>
30626 #else
30627 #include <string.h>
30628 +#define ktla_ktva(addr) addr
30629 #endif
30630 #include <asm/inat.h>
30631 #include <asm/insn.h>
30632 @@ -60,9 +62,9 @@ void insn_init(struct insn *insn, const void *kaddr, int buf_len, int x86_64)
30633 buf_len = MAX_INSN_SIZE;
30634
30635 memset(insn, 0, sizeof(*insn));
30636 - insn->kaddr = kaddr;
30637 - insn->end_kaddr = kaddr + buf_len;
30638 - insn->next_byte = kaddr;
30639 + insn->kaddr = ktla_ktva(kaddr);
30640 + insn->end_kaddr = insn->kaddr + buf_len;
30641 + insn->next_byte = insn->kaddr;
30642 insn->x86_64 = x86_64 ? 1 : 0;
30643 insn->opnd_bytes = 4;
30644 if (x86_64)
30645 diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
30646 index 05a95e7..326f2fa 100644
30647 --- a/arch/x86/lib/iomap_copy_64.S
30648 +++ b/arch/x86/lib/iomap_copy_64.S
30649 @@ -17,6 +17,7 @@
30650
30651 #include <linux/linkage.h>
30652 #include <asm/dwarf2.h>
30653 +#include <asm/alternative-asm.h>
30654
30655 /*
30656 * override generic version in lib/iomap_copy.c
30657 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
30658 CFI_STARTPROC
30659 movl %edx,%ecx
30660 rep movsd
30661 + pax_force_retaddr
30662 ret
30663 CFI_ENDPROC
30664 ENDPROC(__iowrite32_copy)
30665 diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
30666 index b046664..dec9465 100644
30667 --- a/arch/x86/lib/memcpy_64.S
30668 +++ b/arch/x86/lib/memcpy_64.S
30669 @@ -37,6 +37,7 @@ ENTRY(memcpy)
30670 rep movsq
30671 movl %edx, %ecx
30672 rep movsb
30673 + pax_force_retaddr
30674 ret
30675 ENDPROC(memcpy)
30676 ENDPROC(__memcpy)
30677 @@ -49,6 +50,7 @@ ENTRY(memcpy_erms)
30678 movq %rdi, %rax
30679 movq %rdx, %rcx
30680 rep movsb
30681 + pax_force_retaddr
30682 ret
30683 ENDPROC(memcpy_erms)
30684
30685 @@ -134,6 +136,7 @@ ENTRY(memcpy_orig)
30686 movq %r9, 1*8(%rdi)
30687 movq %r10, -2*8(%rdi, %rdx)
30688 movq %r11, -1*8(%rdi, %rdx)
30689 + pax_force_retaddr
30690 retq
30691 .p2align 4
30692 .Lless_16bytes:
30693 @@ -146,6 +149,7 @@ ENTRY(memcpy_orig)
30694 movq -1*8(%rsi, %rdx), %r9
30695 movq %r8, 0*8(%rdi)
30696 movq %r9, -1*8(%rdi, %rdx)
30697 + pax_force_retaddr
30698 retq
30699 .p2align 4
30700 .Lless_8bytes:
30701 @@ -159,6 +163,7 @@ ENTRY(memcpy_orig)
30702 movl -4(%rsi, %rdx), %r8d
30703 movl %ecx, (%rdi)
30704 movl %r8d, -4(%rdi, %rdx)
30705 + pax_force_retaddr
30706 retq
30707 .p2align 4
30708 .Lless_3bytes:
30709 @@ -177,6 +182,7 @@ ENTRY(memcpy_orig)
30710 movb %cl, (%rdi)
30711
30712 .Lend:
30713 + pax_force_retaddr
30714 retq
30715 CFI_ENDPROC
30716 ENDPROC(memcpy_orig)
30717 diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
30718 index 0f8a0d0..f6e0ea4 100644
30719 --- a/arch/x86/lib/memmove_64.S
30720 +++ b/arch/x86/lib/memmove_64.S
30721 @@ -43,7 +43,7 @@ ENTRY(__memmove)
30722 jg 2f
30723
30724 .Lmemmove_begin_forward:
30725 - ALTERNATIVE "", "movq %rdx, %rcx; rep movsb; retq", X86_FEATURE_ERMS
30726 + ALTERNATIVE "", "movq %rdx, %rcx; rep movsb; pax_force_retaddr; retq", X86_FEATURE_ERMS
30727
30728 /*
30729 * movsq instruction have many startup latency
30730 @@ -206,6 +206,7 @@ ENTRY(__memmove)
30731 movb (%rsi), %r11b
30732 movb %r11b, (%rdi)
30733 13:
30734 + pax_force_retaddr
30735 retq
30736 CFI_ENDPROC
30737 ENDPROC(__memmove)
30738 diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
30739 index 93118fb..386ed2a 100644
30740 --- a/arch/x86/lib/memset_64.S
30741 +++ b/arch/x86/lib/memset_64.S
30742 @@ -41,6 +41,7 @@ ENTRY(__memset)
30743 movl %edx,%ecx
30744 rep stosb
30745 movq %r9,%rax
30746 + pax_force_retaddr
30747 ret
30748 ENDPROC(memset)
30749 ENDPROC(__memset)
30750 @@ -62,6 +63,7 @@ ENTRY(memset_erms)
30751 movq %rdx,%rcx
30752 rep stosb
30753 movq %r9,%rax
30754 + pax_force_retaddr
30755 ret
30756 ENDPROC(memset_erms)
30757
30758 @@ -126,6 +128,7 @@ ENTRY(memset_orig)
30759
30760 .Lende:
30761 movq %r10,%rax
30762 + pax_force_retaddr
30763 ret
30764
30765 CFI_RESTORE_STATE
30766 diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
30767 index c9f2d9b..e7fd2c0 100644
30768 --- a/arch/x86/lib/mmx_32.c
30769 +++ b/arch/x86/lib/mmx_32.c
30770 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
30771 {
30772 void *p;
30773 int i;
30774 + unsigned long cr0;
30775
30776 if (unlikely(in_interrupt()))
30777 return __memcpy(to, from, len);
30778 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
30779 kernel_fpu_begin();
30780
30781 __asm__ __volatile__ (
30782 - "1: prefetch (%0)\n" /* This set is 28 bytes */
30783 - " prefetch 64(%0)\n"
30784 - " prefetch 128(%0)\n"
30785 - " prefetch 192(%0)\n"
30786 - " prefetch 256(%0)\n"
30787 + "1: prefetch (%1)\n" /* This set is 28 bytes */
30788 + " prefetch 64(%1)\n"
30789 + " prefetch 128(%1)\n"
30790 + " prefetch 192(%1)\n"
30791 + " prefetch 256(%1)\n"
30792 "2: \n"
30793 ".section .fixup, \"ax\"\n"
30794 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30795 + "3: \n"
30796 +
30797 +#ifdef CONFIG_PAX_KERNEXEC
30798 + " movl %%cr0, %0\n"
30799 + " movl %0, %%eax\n"
30800 + " andl $0xFFFEFFFF, %%eax\n"
30801 + " movl %%eax, %%cr0\n"
30802 +#endif
30803 +
30804 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30805 +
30806 +#ifdef CONFIG_PAX_KERNEXEC
30807 + " movl %0, %%cr0\n"
30808 +#endif
30809 +
30810 " jmp 2b\n"
30811 ".previous\n"
30812 _ASM_EXTABLE(1b, 3b)
30813 - : : "r" (from));
30814 + : "=&r" (cr0) : "r" (from) : "ax");
30815
30816 for ( ; i > 5; i--) {
30817 __asm__ __volatile__ (
30818 - "1: prefetch 320(%0)\n"
30819 - "2: movq (%0), %%mm0\n"
30820 - " movq 8(%0), %%mm1\n"
30821 - " movq 16(%0), %%mm2\n"
30822 - " movq 24(%0), %%mm3\n"
30823 - " movq %%mm0, (%1)\n"
30824 - " movq %%mm1, 8(%1)\n"
30825 - " movq %%mm2, 16(%1)\n"
30826 - " movq %%mm3, 24(%1)\n"
30827 - " movq 32(%0), %%mm0\n"
30828 - " movq 40(%0), %%mm1\n"
30829 - " movq 48(%0), %%mm2\n"
30830 - " movq 56(%0), %%mm3\n"
30831 - " movq %%mm0, 32(%1)\n"
30832 - " movq %%mm1, 40(%1)\n"
30833 - " movq %%mm2, 48(%1)\n"
30834 - " movq %%mm3, 56(%1)\n"
30835 + "1: prefetch 320(%1)\n"
30836 + "2: movq (%1), %%mm0\n"
30837 + " movq 8(%1), %%mm1\n"
30838 + " movq 16(%1), %%mm2\n"
30839 + " movq 24(%1), %%mm3\n"
30840 + " movq %%mm0, (%2)\n"
30841 + " movq %%mm1, 8(%2)\n"
30842 + " movq %%mm2, 16(%2)\n"
30843 + " movq %%mm3, 24(%2)\n"
30844 + " movq 32(%1), %%mm0\n"
30845 + " movq 40(%1), %%mm1\n"
30846 + " movq 48(%1), %%mm2\n"
30847 + " movq 56(%1), %%mm3\n"
30848 + " movq %%mm0, 32(%2)\n"
30849 + " movq %%mm1, 40(%2)\n"
30850 + " movq %%mm2, 48(%2)\n"
30851 + " movq %%mm3, 56(%2)\n"
30852 ".section .fixup, \"ax\"\n"
30853 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30854 + "3:\n"
30855 +
30856 +#ifdef CONFIG_PAX_KERNEXEC
30857 + " movl %%cr0, %0\n"
30858 + " movl %0, %%eax\n"
30859 + " andl $0xFFFEFFFF, %%eax\n"
30860 + " movl %%eax, %%cr0\n"
30861 +#endif
30862 +
30863 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30864 +
30865 +#ifdef CONFIG_PAX_KERNEXEC
30866 + " movl %0, %%cr0\n"
30867 +#endif
30868 +
30869 " jmp 2b\n"
30870 ".previous\n"
30871 _ASM_EXTABLE(1b, 3b)
30872 - : : "r" (from), "r" (to) : "memory");
30873 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
30874
30875 from += 64;
30876 to += 64;
30877 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
30878 static void fast_copy_page(void *to, void *from)
30879 {
30880 int i;
30881 + unsigned long cr0;
30882
30883 kernel_fpu_begin();
30884
30885 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
30886 * but that is for later. -AV
30887 */
30888 __asm__ __volatile__(
30889 - "1: prefetch (%0)\n"
30890 - " prefetch 64(%0)\n"
30891 - " prefetch 128(%0)\n"
30892 - " prefetch 192(%0)\n"
30893 - " prefetch 256(%0)\n"
30894 + "1: prefetch (%1)\n"
30895 + " prefetch 64(%1)\n"
30896 + " prefetch 128(%1)\n"
30897 + " prefetch 192(%1)\n"
30898 + " prefetch 256(%1)\n"
30899 "2: \n"
30900 ".section .fixup, \"ax\"\n"
30901 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30902 + "3: \n"
30903 +
30904 +#ifdef CONFIG_PAX_KERNEXEC
30905 + " movl %%cr0, %0\n"
30906 + " movl %0, %%eax\n"
30907 + " andl $0xFFFEFFFF, %%eax\n"
30908 + " movl %%eax, %%cr0\n"
30909 +#endif
30910 +
30911 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30912 +
30913 +#ifdef CONFIG_PAX_KERNEXEC
30914 + " movl %0, %%cr0\n"
30915 +#endif
30916 +
30917 " jmp 2b\n"
30918 ".previous\n"
30919 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
30920 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
30921
30922 for (i = 0; i < (4096-320)/64; i++) {
30923 __asm__ __volatile__ (
30924 - "1: prefetch 320(%0)\n"
30925 - "2: movq (%0), %%mm0\n"
30926 - " movntq %%mm0, (%1)\n"
30927 - " movq 8(%0), %%mm1\n"
30928 - " movntq %%mm1, 8(%1)\n"
30929 - " movq 16(%0), %%mm2\n"
30930 - " movntq %%mm2, 16(%1)\n"
30931 - " movq 24(%0), %%mm3\n"
30932 - " movntq %%mm3, 24(%1)\n"
30933 - " movq 32(%0), %%mm4\n"
30934 - " movntq %%mm4, 32(%1)\n"
30935 - " movq 40(%0), %%mm5\n"
30936 - " movntq %%mm5, 40(%1)\n"
30937 - " movq 48(%0), %%mm6\n"
30938 - " movntq %%mm6, 48(%1)\n"
30939 - " movq 56(%0), %%mm7\n"
30940 - " movntq %%mm7, 56(%1)\n"
30941 + "1: prefetch 320(%1)\n"
30942 + "2: movq (%1), %%mm0\n"
30943 + " movntq %%mm0, (%2)\n"
30944 + " movq 8(%1), %%mm1\n"
30945 + " movntq %%mm1, 8(%2)\n"
30946 + " movq 16(%1), %%mm2\n"
30947 + " movntq %%mm2, 16(%2)\n"
30948 + " movq 24(%1), %%mm3\n"
30949 + " movntq %%mm3, 24(%2)\n"
30950 + " movq 32(%1), %%mm4\n"
30951 + " movntq %%mm4, 32(%2)\n"
30952 + " movq 40(%1), %%mm5\n"
30953 + " movntq %%mm5, 40(%2)\n"
30954 + " movq 48(%1), %%mm6\n"
30955 + " movntq %%mm6, 48(%2)\n"
30956 + " movq 56(%1), %%mm7\n"
30957 + " movntq %%mm7, 56(%2)\n"
30958 ".section .fixup, \"ax\"\n"
30959 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30960 + "3:\n"
30961 +
30962 +#ifdef CONFIG_PAX_KERNEXEC
30963 + " movl %%cr0, %0\n"
30964 + " movl %0, %%eax\n"
30965 + " andl $0xFFFEFFFF, %%eax\n"
30966 + " movl %%eax, %%cr0\n"
30967 +#endif
30968 +
30969 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30970 +
30971 +#ifdef CONFIG_PAX_KERNEXEC
30972 + " movl %0, %%cr0\n"
30973 +#endif
30974 +
30975 " jmp 2b\n"
30976 ".previous\n"
30977 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
30978 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
30979
30980 from += 64;
30981 to += 64;
30982 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
30983 static void fast_copy_page(void *to, void *from)
30984 {
30985 int i;
30986 + unsigned long cr0;
30987
30988 kernel_fpu_begin();
30989
30990 __asm__ __volatile__ (
30991 - "1: prefetch (%0)\n"
30992 - " prefetch 64(%0)\n"
30993 - " prefetch 128(%0)\n"
30994 - " prefetch 192(%0)\n"
30995 - " prefetch 256(%0)\n"
30996 + "1: prefetch (%1)\n"
30997 + " prefetch 64(%1)\n"
30998 + " prefetch 128(%1)\n"
30999 + " prefetch 192(%1)\n"
31000 + " prefetch 256(%1)\n"
31001 "2: \n"
31002 ".section .fixup, \"ax\"\n"
31003 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
31004 + "3: \n"
31005 +
31006 +#ifdef CONFIG_PAX_KERNEXEC
31007 + " movl %%cr0, %0\n"
31008 + " movl %0, %%eax\n"
31009 + " andl $0xFFFEFFFF, %%eax\n"
31010 + " movl %%eax, %%cr0\n"
31011 +#endif
31012 +
31013 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
31014 +
31015 +#ifdef CONFIG_PAX_KERNEXEC
31016 + " movl %0, %%cr0\n"
31017 +#endif
31018 +
31019 " jmp 2b\n"
31020 ".previous\n"
31021 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
31022 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
31023
31024 for (i = 0; i < 4096/64; i++) {
31025 __asm__ __volatile__ (
31026 - "1: prefetch 320(%0)\n"
31027 - "2: movq (%0), %%mm0\n"
31028 - " movq 8(%0), %%mm1\n"
31029 - " movq 16(%0), %%mm2\n"
31030 - " movq 24(%0), %%mm3\n"
31031 - " movq %%mm0, (%1)\n"
31032 - " movq %%mm1, 8(%1)\n"
31033 - " movq %%mm2, 16(%1)\n"
31034 - " movq %%mm3, 24(%1)\n"
31035 - " movq 32(%0), %%mm0\n"
31036 - " movq 40(%0), %%mm1\n"
31037 - " movq 48(%0), %%mm2\n"
31038 - " movq 56(%0), %%mm3\n"
31039 - " movq %%mm0, 32(%1)\n"
31040 - " movq %%mm1, 40(%1)\n"
31041 - " movq %%mm2, 48(%1)\n"
31042 - " movq %%mm3, 56(%1)\n"
31043 + "1: prefetch 320(%1)\n"
31044 + "2: movq (%1), %%mm0\n"
31045 + " movq 8(%1), %%mm1\n"
31046 + " movq 16(%1), %%mm2\n"
31047 + " movq 24(%1), %%mm3\n"
31048 + " movq %%mm0, (%2)\n"
31049 + " movq %%mm1, 8(%2)\n"
31050 + " movq %%mm2, 16(%2)\n"
31051 + " movq %%mm3, 24(%2)\n"
31052 + " movq 32(%1), %%mm0\n"
31053 + " movq 40(%1), %%mm1\n"
31054 + " movq 48(%1), %%mm2\n"
31055 + " movq 56(%1), %%mm3\n"
31056 + " movq %%mm0, 32(%2)\n"
31057 + " movq %%mm1, 40(%2)\n"
31058 + " movq %%mm2, 48(%2)\n"
31059 + " movq %%mm3, 56(%2)\n"
31060 ".section .fixup, \"ax\"\n"
31061 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
31062 + "3:\n"
31063 +
31064 +#ifdef CONFIG_PAX_KERNEXEC
31065 + " movl %%cr0, %0\n"
31066 + " movl %0, %%eax\n"
31067 + " andl $0xFFFEFFFF, %%eax\n"
31068 + " movl %%eax, %%cr0\n"
31069 +#endif
31070 +
31071 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
31072 +
31073 +#ifdef CONFIG_PAX_KERNEXEC
31074 + " movl %0, %%cr0\n"
31075 +#endif
31076 +
31077 " jmp 2b\n"
31078 ".previous\n"
31079 _ASM_EXTABLE(1b, 3b)
31080 - : : "r" (from), "r" (to) : "memory");
31081 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
31082
31083 from += 64;
31084 to += 64;
31085 diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
31086 index 3ca5218..c2ae6bc 100644
31087 --- a/arch/x86/lib/msr-reg.S
31088 +++ b/arch/x86/lib/msr-reg.S
31089 @@ -3,6 +3,7 @@
31090 #include <asm/dwarf2.h>
31091 #include <asm/asm.h>
31092 #include <asm/msr.h>
31093 +#include <asm/alternative-asm.h>
31094
31095 #ifdef CONFIG_X86_64
31096 /*
31097 @@ -37,6 +38,7 @@ ENTRY(\op\()_safe_regs)
31098 movl %edi, 28(%r10)
31099 popq_cfi_reg rbp
31100 popq_cfi_reg rbx
31101 + pax_force_retaddr
31102 ret
31103 3:
31104 CFI_RESTORE_STATE
31105 diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
31106 index fc6ba17..14ad9a5 100644
31107 --- a/arch/x86/lib/putuser.S
31108 +++ b/arch/x86/lib/putuser.S
31109 @@ -16,7 +16,9 @@
31110 #include <asm/errno.h>
31111 #include <asm/asm.h>
31112 #include <asm/smap.h>
31113 -
31114 +#include <asm/segment.h>
31115 +#include <asm/pgtable.h>
31116 +#include <asm/alternative-asm.h>
31117
31118 /*
31119 * __put_user_X
31120 @@ -30,57 +32,125 @@
31121 * as they get called from within inline assembly.
31122 */
31123
31124 -#define ENTER CFI_STARTPROC ; \
31125 - GET_THREAD_INFO(%_ASM_BX)
31126 -#define EXIT ASM_CLAC ; \
31127 - ret ; \
31128 +#define ENTER CFI_STARTPROC
31129 +#define EXIT ASM_CLAC ; \
31130 + pax_force_retaddr ; \
31131 + ret ; \
31132 CFI_ENDPROC
31133
31134 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
31135 +#define _DEST %_ASM_CX,%_ASM_BX
31136 +#else
31137 +#define _DEST %_ASM_CX
31138 +#endif
31139 +
31140 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
31141 +#define __copyuser_seg gs;
31142 +#else
31143 +#define __copyuser_seg
31144 +#endif
31145 +
31146 .text
31147 ENTRY(__put_user_1)
31148 ENTER
31149 +
31150 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
31151 + GET_THREAD_INFO(%_ASM_BX)
31152 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
31153 jae bad_put_user
31154 +
31155 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
31156 + mov pax_user_shadow_base,%_ASM_BX
31157 + cmp %_ASM_BX,%_ASM_CX
31158 + jb 1234f
31159 + xor %ebx,%ebx
31160 +1234:
31161 +#endif
31162 +
31163 +#endif
31164 +
31165 ASM_STAC
31166 -1: movb %al,(%_ASM_CX)
31167 +1: __copyuser_seg movb %al,(_DEST)
31168 xor %eax,%eax
31169 EXIT
31170 ENDPROC(__put_user_1)
31171
31172 ENTRY(__put_user_2)
31173 ENTER
31174 +
31175 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
31176 + GET_THREAD_INFO(%_ASM_BX)
31177 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
31178 sub $1,%_ASM_BX
31179 cmp %_ASM_BX,%_ASM_CX
31180 jae bad_put_user
31181 +
31182 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
31183 + mov pax_user_shadow_base,%_ASM_BX
31184 + cmp %_ASM_BX,%_ASM_CX
31185 + jb 1234f
31186 + xor %ebx,%ebx
31187 +1234:
31188 +#endif
31189 +
31190 +#endif
31191 +
31192 ASM_STAC
31193 -2: movw %ax,(%_ASM_CX)
31194 +2: __copyuser_seg movw %ax,(_DEST)
31195 xor %eax,%eax
31196 EXIT
31197 ENDPROC(__put_user_2)
31198
31199 ENTRY(__put_user_4)
31200 ENTER
31201 +
31202 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
31203 + GET_THREAD_INFO(%_ASM_BX)
31204 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
31205 sub $3,%_ASM_BX
31206 cmp %_ASM_BX,%_ASM_CX
31207 jae bad_put_user
31208 +
31209 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
31210 + mov pax_user_shadow_base,%_ASM_BX
31211 + cmp %_ASM_BX,%_ASM_CX
31212 + jb 1234f
31213 + xor %ebx,%ebx
31214 +1234:
31215 +#endif
31216 +
31217 +#endif
31218 +
31219 ASM_STAC
31220 -3: movl %eax,(%_ASM_CX)
31221 +3: __copyuser_seg movl %eax,(_DEST)
31222 xor %eax,%eax
31223 EXIT
31224 ENDPROC(__put_user_4)
31225
31226 ENTRY(__put_user_8)
31227 ENTER
31228 +
31229 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
31230 + GET_THREAD_INFO(%_ASM_BX)
31231 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
31232 sub $7,%_ASM_BX
31233 cmp %_ASM_BX,%_ASM_CX
31234 jae bad_put_user
31235 +
31236 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
31237 + mov pax_user_shadow_base,%_ASM_BX
31238 + cmp %_ASM_BX,%_ASM_CX
31239 + jb 1234f
31240 + xor %ebx,%ebx
31241 +1234:
31242 +#endif
31243 +
31244 +#endif
31245 +
31246 ASM_STAC
31247 -4: mov %_ASM_AX,(%_ASM_CX)
31248 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
31249 #ifdef CONFIG_X86_32
31250 -5: movl %edx,4(%_ASM_CX)
31251 +5: __copyuser_seg movl %edx,4(_DEST)
31252 #endif
31253 xor %eax,%eax
31254 EXIT
31255 diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S
31256 index 2322abe..1e78a75 100644
31257 --- a/arch/x86/lib/rwsem.S
31258 +++ b/arch/x86/lib/rwsem.S
31259 @@ -92,6 +92,7 @@ ENTRY(call_rwsem_down_read_failed)
31260 call rwsem_down_read_failed
31261 __ASM_SIZE(pop,_cfi_reg) __ASM_REG(dx)
31262 restore_common_regs
31263 + pax_force_retaddr
31264 ret
31265 CFI_ENDPROC
31266 ENDPROC(call_rwsem_down_read_failed)
31267 @@ -102,6 +103,7 @@ ENTRY(call_rwsem_down_write_failed)
31268 movq %rax,%rdi
31269 call rwsem_down_write_failed
31270 restore_common_regs
31271 + pax_force_retaddr
31272 ret
31273 CFI_ENDPROC
31274 ENDPROC(call_rwsem_down_write_failed)
31275 @@ -115,7 +117,8 @@ ENTRY(call_rwsem_wake)
31276 movq %rax,%rdi
31277 call rwsem_wake
31278 restore_common_regs
31279 -1: ret
31280 +1: pax_force_retaddr
31281 + ret
31282 CFI_ENDPROC
31283 ENDPROC(call_rwsem_wake)
31284
31285 @@ -127,6 +130,7 @@ ENTRY(call_rwsem_downgrade_wake)
31286 call rwsem_downgrade_wake
31287 __ASM_SIZE(pop,_cfi_reg) __ASM_REG(dx)
31288 restore_common_regs
31289 + pax_force_retaddr
31290 ret
31291 CFI_ENDPROC
31292 ENDPROC(call_rwsem_downgrade_wake)
31293 diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
31294 index f89ba4e9..512b2de 100644
31295 --- a/arch/x86/lib/thunk_64.S
31296 +++ b/arch/x86/lib/thunk_64.S
31297 @@ -9,6 +9,7 @@
31298 #include <asm/dwarf2.h>
31299 #include <asm/calling.h>
31300 #include <asm/asm.h>
31301 +#include <asm/alternative-asm.h>
31302
31303 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
31304 .macro THUNK name, func, put_ret_addr_in_rdi=0
31305 @@ -69,6 +70,7 @@ restore:
31306 popq_cfi_reg rdx
31307 popq_cfi_reg rsi
31308 popq_cfi_reg rdi
31309 + pax_force_retaddr
31310 ret
31311 CFI_ENDPROC
31312 _ASM_NOKPROBE(restore)
31313 diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
31314 index ddf9ecb..e342586 100644
31315 --- a/arch/x86/lib/usercopy.c
31316 +++ b/arch/x86/lib/usercopy.c
31317 @@ -20,7 +20,7 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
31318 unsigned long ret;
31319
31320 if (__range_not_ok(from, n, TASK_SIZE))
31321 - return 0;
31322 + return n;
31323
31324 /*
31325 * Even though this function is typically called from NMI/IRQ context
31326 diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
31327 index e2f5e21..4b22130 100644
31328 --- a/arch/x86/lib/usercopy_32.c
31329 +++ b/arch/x86/lib/usercopy_32.c
31330 @@ -42,11 +42,13 @@ do { \
31331 int __d0; \
31332 might_fault(); \
31333 __asm__ __volatile__( \
31334 + __COPYUSER_SET_ES \
31335 ASM_STAC "\n" \
31336 "0: rep; stosl\n" \
31337 " movl %2,%0\n" \
31338 "1: rep; stosb\n" \
31339 "2: " ASM_CLAC "\n" \
31340 + __COPYUSER_RESTORE_ES \
31341 ".section .fixup,\"ax\"\n" \
31342 "3: lea 0(%2,%0,4),%0\n" \
31343 " jmp 2b\n" \
31344 @@ -98,7 +100,7 @@ EXPORT_SYMBOL(__clear_user);
31345
31346 #ifdef CONFIG_X86_INTEL_USERCOPY
31347 static unsigned long
31348 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
31349 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
31350 {
31351 int d0, d1;
31352 __asm__ __volatile__(
31353 @@ -110,36 +112,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
31354 " .align 2,0x90\n"
31355 "3: movl 0(%4), %%eax\n"
31356 "4: movl 4(%4), %%edx\n"
31357 - "5: movl %%eax, 0(%3)\n"
31358 - "6: movl %%edx, 4(%3)\n"
31359 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
31360 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
31361 "7: movl 8(%4), %%eax\n"
31362 "8: movl 12(%4),%%edx\n"
31363 - "9: movl %%eax, 8(%3)\n"
31364 - "10: movl %%edx, 12(%3)\n"
31365 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
31366 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
31367 "11: movl 16(%4), %%eax\n"
31368 "12: movl 20(%4), %%edx\n"
31369 - "13: movl %%eax, 16(%3)\n"
31370 - "14: movl %%edx, 20(%3)\n"
31371 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
31372 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
31373 "15: movl 24(%4), %%eax\n"
31374 "16: movl 28(%4), %%edx\n"
31375 - "17: movl %%eax, 24(%3)\n"
31376 - "18: movl %%edx, 28(%3)\n"
31377 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
31378 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
31379 "19: movl 32(%4), %%eax\n"
31380 "20: movl 36(%4), %%edx\n"
31381 - "21: movl %%eax, 32(%3)\n"
31382 - "22: movl %%edx, 36(%3)\n"
31383 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
31384 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
31385 "23: movl 40(%4), %%eax\n"
31386 "24: movl 44(%4), %%edx\n"
31387 - "25: movl %%eax, 40(%3)\n"
31388 - "26: movl %%edx, 44(%3)\n"
31389 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
31390 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
31391 "27: movl 48(%4), %%eax\n"
31392 "28: movl 52(%4), %%edx\n"
31393 - "29: movl %%eax, 48(%3)\n"
31394 - "30: movl %%edx, 52(%3)\n"
31395 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
31396 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
31397 "31: movl 56(%4), %%eax\n"
31398 "32: movl 60(%4), %%edx\n"
31399 - "33: movl %%eax, 56(%3)\n"
31400 - "34: movl %%edx, 60(%3)\n"
31401 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
31402 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
31403 " addl $-64, %0\n"
31404 " addl $64, %4\n"
31405 " addl $64, %3\n"
31406 @@ -149,10 +151,116 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
31407 " shrl $2, %0\n"
31408 " andl $3, %%eax\n"
31409 " cld\n"
31410 + __COPYUSER_SET_ES
31411 "99: rep; movsl\n"
31412 "36: movl %%eax, %0\n"
31413 "37: rep; movsb\n"
31414 "100:\n"
31415 + __COPYUSER_RESTORE_ES
31416 + ".section .fixup,\"ax\"\n"
31417 + "101: lea 0(%%eax,%0,4),%0\n"
31418 + " jmp 100b\n"
31419 + ".previous\n"
31420 + _ASM_EXTABLE(1b,100b)
31421 + _ASM_EXTABLE(2b,100b)
31422 + _ASM_EXTABLE(3b,100b)
31423 + _ASM_EXTABLE(4b,100b)
31424 + _ASM_EXTABLE(5b,100b)
31425 + _ASM_EXTABLE(6b,100b)
31426 + _ASM_EXTABLE(7b,100b)
31427 + _ASM_EXTABLE(8b,100b)
31428 + _ASM_EXTABLE(9b,100b)
31429 + _ASM_EXTABLE(10b,100b)
31430 + _ASM_EXTABLE(11b,100b)
31431 + _ASM_EXTABLE(12b,100b)
31432 + _ASM_EXTABLE(13b,100b)
31433 + _ASM_EXTABLE(14b,100b)
31434 + _ASM_EXTABLE(15b,100b)
31435 + _ASM_EXTABLE(16b,100b)
31436 + _ASM_EXTABLE(17b,100b)
31437 + _ASM_EXTABLE(18b,100b)
31438 + _ASM_EXTABLE(19b,100b)
31439 + _ASM_EXTABLE(20b,100b)
31440 + _ASM_EXTABLE(21b,100b)
31441 + _ASM_EXTABLE(22b,100b)
31442 + _ASM_EXTABLE(23b,100b)
31443 + _ASM_EXTABLE(24b,100b)
31444 + _ASM_EXTABLE(25b,100b)
31445 + _ASM_EXTABLE(26b,100b)
31446 + _ASM_EXTABLE(27b,100b)
31447 + _ASM_EXTABLE(28b,100b)
31448 + _ASM_EXTABLE(29b,100b)
31449 + _ASM_EXTABLE(30b,100b)
31450 + _ASM_EXTABLE(31b,100b)
31451 + _ASM_EXTABLE(32b,100b)
31452 + _ASM_EXTABLE(33b,100b)
31453 + _ASM_EXTABLE(34b,100b)
31454 + _ASM_EXTABLE(35b,100b)
31455 + _ASM_EXTABLE(36b,100b)
31456 + _ASM_EXTABLE(37b,100b)
31457 + _ASM_EXTABLE(99b,101b)
31458 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
31459 + : "1"(to), "2"(from), "0"(size)
31460 + : "eax", "edx", "memory");
31461 + return size;
31462 +}
31463 +
31464 +static unsigned long
31465 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
31466 +{
31467 + int d0, d1;
31468 + __asm__ __volatile__(
31469 + " .align 2,0x90\n"
31470 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
31471 + " cmpl $67, %0\n"
31472 + " jbe 3f\n"
31473 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
31474 + " .align 2,0x90\n"
31475 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
31476 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
31477 + "5: movl %%eax, 0(%3)\n"
31478 + "6: movl %%edx, 4(%3)\n"
31479 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
31480 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
31481 + "9: movl %%eax, 8(%3)\n"
31482 + "10: movl %%edx, 12(%3)\n"
31483 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
31484 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
31485 + "13: movl %%eax, 16(%3)\n"
31486 + "14: movl %%edx, 20(%3)\n"
31487 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
31488 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
31489 + "17: movl %%eax, 24(%3)\n"
31490 + "18: movl %%edx, 28(%3)\n"
31491 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
31492 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
31493 + "21: movl %%eax, 32(%3)\n"
31494 + "22: movl %%edx, 36(%3)\n"
31495 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
31496 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
31497 + "25: movl %%eax, 40(%3)\n"
31498 + "26: movl %%edx, 44(%3)\n"
31499 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
31500 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
31501 + "29: movl %%eax, 48(%3)\n"
31502 + "30: movl %%edx, 52(%3)\n"
31503 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
31504 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
31505 + "33: movl %%eax, 56(%3)\n"
31506 + "34: movl %%edx, 60(%3)\n"
31507 + " addl $-64, %0\n"
31508 + " addl $64, %4\n"
31509 + " addl $64, %3\n"
31510 + " cmpl $63, %0\n"
31511 + " ja 1b\n"
31512 + "35: movl %0, %%eax\n"
31513 + " shrl $2, %0\n"
31514 + " andl $3, %%eax\n"
31515 + " cld\n"
31516 + "99: rep; "__copyuser_seg" movsl\n"
31517 + "36: movl %%eax, %0\n"
31518 + "37: rep; "__copyuser_seg" movsb\n"
31519 + "100:\n"
31520 ".section .fixup,\"ax\"\n"
31521 "101: lea 0(%%eax,%0,4),%0\n"
31522 " jmp 100b\n"
31523 @@ -207,41 +315,41 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
31524 int d0, d1;
31525 __asm__ __volatile__(
31526 " .align 2,0x90\n"
31527 - "0: movl 32(%4), %%eax\n"
31528 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
31529 " cmpl $67, %0\n"
31530 " jbe 2f\n"
31531 - "1: movl 64(%4), %%eax\n"
31532 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
31533 " .align 2,0x90\n"
31534 - "2: movl 0(%4), %%eax\n"
31535 - "21: movl 4(%4), %%edx\n"
31536 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
31537 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
31538 " movl %%eax, 0(%3)\n"
31539 " movl %%edx, 4(%3)\n"
31540 - "3: movl 8(%4), %%eax\n"
31541 - "31: movl 12(%4),%%edx\n"
31542 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
31543 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
31544 " movl %%eax, 8(%3)\n"
31545 " movl %%edx, 12(%3)\n"
31546 - "4: movl 16(%4), %%eax\n"
31547 - "41: movl 20(%4), %%edx\n"
31548 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
31549 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
31550 " movl %%eax, 16(%3)\n"
31551 " movl %%edx, 20(%3)\n"
31552 - "10: movl 24(%4), %%eax\n"
31553 - "51: movl 28(%4), %%edx\n"
31554 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
31555 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
31556 " movl %%eax, 24(%3)\n"
31557 " movl %%edx, 28(%3)\n"
31558 - "11: movl 32(%4), %%eax\n"
31559 - "61: movl 36(%4), %%edx\n"
31560 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
31561 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
31562 " movl %%eax, 32(%3)\n"
31563 " movl %%edx, 36(%3)\n"
31564 - "12: movl 40(%4), %%eax\n"
31565 - "71: movl 44(%4), %%edx\n"
31566 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
31567 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
31568 " movl %%eax, 40(%3)\n"
31569 " movl %%edx, 44(%3)\n"
31570 - "13: movl 48(%4), %%eax\n"
31571 - "81: movl 52(%4), %%edx\n"
31572 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
31573 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
31574 " movl %%eax, 48(%3)\n"
31575 " movl %%edx, 52(%3)\n"
31576 - "14: movl 56(%4), %%eax\n"
31577 - "91: movl 60(%4), %%edx\n"
31578 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
31579 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
31580 " movl %%eax, 56(%3)\n"
31581 " movl %%edx, 60(%3)\n"
31582 " addl $-64, %0\n"
31583 @@ -253,9 +361,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
31584 " shrl $2, %0\n"
31585 " andl $3, %%eax\n"
31586 " cld\n"
31587 - "6: rep; movsl\n"
31588 + "6: rep; "__copyuser_seg" movsl\n"
31589 " movl %%eax,%0\n"
31590 - "7: rep; movsb\n"
31591 + "7: rep; "__copyuser_seg" movsb\n"
31592 "8:\n"
31593 ".section .fixup,\"ax\"\n"
31594 "9: lea 0(%%eax,%0,4),%0\n"
31595 @@ -305,41 +413,41 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
31596
31597 __asm__ __volatile__(
31598 " .align 2,0x90\n"
31599 - "0: movl 32(%4), %%eax\n"
31600 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
31601 " cmpl $67, %0\n"
31602 " jbe 2f\n"
31603 - "1: movl 64(%4), %%eax\n"
31604 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
31605 " .align 2,0x90\n"
31606 - "2: movl 0(%4), %%eax\n"
31607 - "21: movl 4(%4), %%edx\n"
31608 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
31609 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
31610 " movnti %%eax, 0(%3)\n"
31611 " movnti %%edx, 4(%3)\n"
31612 - "3: movl 8(%4), %%eax\n"
31613 - "31: movl 12(%4),%%edx\n"
31614 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
31615 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
31616 " movnti %%eax, 8(%3)\n"
31617 " movnti %%edx, 12(%3)\n"
31618 - "4: movl 16(%4), %%eax\n"
31619 - "41: movl 20(%4), %%edx\n"
31620 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
31621 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
31622 " movnti %%eax, 16(%3)\n"
31623 " movnti %%edx, 20(%3)\n"
31624 - "10: movl 24(%4), %%eax\n"
31625 - "51: movl 28(%4), %%edx\n"
31626 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
31627 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
31628 " movnti %%eax, 24(%3)\n"
31629 " movnti %%edx, 28(%3)\n"
31630 - "11: movl 32(%4), %%eax\n"
31631 - "61: movl 36(%4), %%edx\n"
31632 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
31633 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
31634 " movnti %%eax, 32(%3)\n"
31635 " movnti %%edx, 36(%3)\n"
31636 - "12: movl 40(%4), %%eax\n"
31637 - "71: movl 44(%4), %%edx\n"
31638 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
31639 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
31640 " movnti %%eax, 40(%3)\n"
31641 " movnti %%edx, 44(%3)\n"
31642 - "13: movl 48(%4), %%eax\n"
31643 - "81: movl 52(%4), %%edx\n"
31644 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
31645 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
31646 " movnti %%eax, 48(%3)\n"
31647 " movnti %%edx, 52(%3)\n"
31648 - "14: movl 56(%4), %%eax\n"
31649 - "91: movl 60(%4), %%edx\n"
31650 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
31651 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
31652 " movnti %%eax, 56(%3)\n"
31653 " movnti %%edx, 60(%3)\n"
31654 " addl $-64, %0\n"
31655 @@ -352,9 +460,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
31656 " shrl $2, %0\n"
31657 " andl $3, %%eax\n"
31658 " cld\n"
31659 - "6: rep; movsl\n"
31660 + "6: rep; "__copyuser_seg" movsl\n"
31661 " movl %%eax,%0\n"
31662 - "7: rep; movsb\n"
31663 + "7: rep; "__copyuser_seg" movsb\n"
31664 "8:\n"
31665 ".section .fixup,\"ax\"\n"
31666 "9: lea 0(%%eax,%0,4),%0\n"
31667 @@ -399,41 +507,41 @@ static unsigned long __copy_user_intel_nocache(void *to,
31668
31669 __asm__ __volatile__(
31670 " .align 2,0x90\n"
31671 - "0: movl 32(%4), %%eax\n"
31672 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
31673 " cmpl $67, %0\n"
31674 " jbe 2f\n"
31675 - "1: movl 64(%4), %%eax\n"
31676 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
31677 " .align 2,0x90\n"
31678 - "2: movl 0(%4), %%eax\n"
31679 - "21: movl 4(%4), %%edx\n"
31680 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
31681 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
31682 " movnti %%eax, 0(%3)\n"
31683 " movnti %%edx, 4(%3)\n"
31684 - "3: movl 8(%4), %%eax\n"
31685 - "31: movl 12(%4),%%edx\n"
31686 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
31687 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
31688 " movnti %%eax, 8(%3)\n"
31689 " movnti %%edx, 12(%3)\n"
31690 - "4: movl 16(%4), %%eax\n"
31691 - "41: movl 20(%4), %%edx\n"
31692 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
31693 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
31694 " movnti %%eax, 16(%3)\n"
31695 " movnti %%edx, 20(%3)\n"
31696 - "10: movl 24(%4), %%eax\n"
31697 - "51: movl 28(%4), %%edx\n"
31698 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
31699 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
31700 " movnti %%eax, 24(%3)\n"
31701 " movnti %%edx, 28(%3)\n"
31702 - "11: movl 32(%4), %%eax\n"
31703 - "61: movl 36(%4), %%edx\n"
31704 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
31705 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
31706 " movnti %%eax, 32(%3)\n"
31707 " movnti %%edx, 36(%3)\n"
31708 - "12: movl 40(%4), %%eax\n"
31709 - "71: movl 44(%4), %%edx\n"
31710 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
31711 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
31712 " movnti %%eax, 40(%3)\n"
31713 " movnti %%edx, 44(%3)\n"
31714 - "13: movl 48(%4), %%eax\n"
31715 - "81: movl 52(%4), %%edx\n"
31716 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
31717 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
31718 " movnti %%eax, 48(%3)\n"
31719 " movnti %%edx, 52(%3)\n"
31720 - "14: movl 56(%4), %%eax\n"
31721 - "91: movl 60(%4), %%edx\n"
31722 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
31723 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
31724 " movnti %%eax, 56(%3)\n"
31725 " movnti %%edx, 60(%3)\n"
31726 " addl $-64, %0\n"
31727 @@ -446,9 +554,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
31728 " shrl $2, %0\n"
31729 " andl $3, %%eax\n"
31730 " cld\n"
31731 - "6: rep; movsl\n"
31732 + "6: rep; "__copyuser_seg" movsl\n"
31733 " movl %%eax,%0\n"
31734 - "7: rep; movsb\n"
31735 + "7: rep; "__copyuser_seg" movsb\n"
31736 "8:\n"
31737 ".section .fixup,\"ax\"\n"
31738 "9: lea 0(%%eax,%0,4),%0\n"
31739 @@ -488,32 +596,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
31740 */
31741 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
31742 unsigned long size);
31743 -unsigned long __copy_user_intel(void __user *to, const void *from,
31744 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
31745 + unsigned long size);
31746 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
31747 unsigned long size);
31748 unsigned long __copy_user_zeroing_intel_nocache(void *to,
31749 const void __user *from, unsigned long size);
31750 #endif /* CONFIG_X86_INTEL_USERCOPY */
31751
31752 /* Generic arbitrary sized copy. */
31753 -#define __copy_user(to, from, size) \
31754 +#define __copy_user(to, from, size, prefix, set, restore) \
31755 do { \
31756 int __d0, __d1, __d2; \
31757 __asm__ __volatile__( \
31758 + set \
31759 " cmp $7,%0\n" \
31760 " jbe 1f\n" \
31761 " movl %1,%0\n" \
31762 " negl %0\n" \
31763 " andl $7,%0\n" \
31764 " subl %0,%3\n" \
31765 - "4: rep; movsb\n" \
31766 + "4: rep; "prefix"movsb\n" \
31767 " movl %3,%0\n" \
31768 " shrl $2,%0\n" \
31769 " andl $3,%3\n" \
31770 " .align 2,0x90\n" \
31771 - "0: rep; movsl\n" \
31772 + "0: rep; "prefix"movsl\n" \
31773 " movl %3,%0\n" \
31774 - "1: rep; movsb\n" \
31775 + "1: rep; "prefix"movsb\n" \
31776 "2:\n" \
31777 + restore \
31778 ".section .fixup,\"ax\"\n" \
31779 "5: addl %3,%0\n" \
31780 " jmp 2b\n" \
31781 @@ -538,14 +650,14 @@ do { \
31782 " negl %0\n" \
31783 " andl $7,%0\n" \
31784 " subl %0,%3\n" \
31785 - "4: rep; movsb\n" \
31786 + "4: rep; "__copyuser_seg"movsb\n" \
31787 " movl %3,%0\n" \
31788 " shrl $2,%0\n" \
31789 " andl $3,%3\n" \
31790 " .align 2,0x90\n" \
31791 - "0: rep; movsl\n" \
31792 + "0: rep; "__copyuser_seg"movsl\n" \
31793 " movl %3,%0\n" \
31794 - "1: rep; movsb\n" \
31795 + "1: rep; "__copyuser_seg"movsb\n" \
31796 "2:\n" \
31797 ".section .fixup,\"ax\"\n" \
31798 "5: addl %3,%0\n" \
31799 @@ -572,9 +684,9 @@ unsigned long __copy_to_user_ll(void __user *to, const void *from,
31800 {
31801 stac();
31802 if (movsl_is_ok(to, from, n))
31803 - __copy_user(to, from, n);
31804 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
31805 else
31806 - n = __copy_user_intel(to, from, n);
31807 + n = __generic_copy_to_user_intel(to, from, n);
31808 clac();
31809 return n;
31810 }
31811 @@ -598,10 +710,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
31812 {
31813 stac();
31814 if (movsl_is_ok(to, from, n))
31815 - __copy_user(to, from, n);
31816 + __copy_user(to, from, n, __copyuser_seg, "", "");
31817 else
31818 - n = __copy_user_intel((void __user *)to,
31819 - (const void *)from, n);
31820 + n = __generic_copy_from_user_intel(to, from, n);
31821 clac();
31822 return n;
31823 }
31824 @@ -632,58 +743,38 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
31825 if (n > 64 && cpu_has_xmm2)
31826 n = __copy_user_intel_nocache(to, from, n);
31827 else
31828 - __copy_user(to, from, n);
31829 + __copy_user(to, from, n, __copyuser_seg, "", "");
31830 #else
31831 - __copy_user(to, from, n);
31832 + __copy_user(to, from, n, __copyuser_seg, "", "");
31833 #endif
31834 clac();
31835 return n;
31836 }
31837 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
31838
31839 -/**
31840 - * copy_to_user: - Copy a block of data into user space.
31841 - * @to: Destination address, in user space.
31842 - * @from: Source address, in kernel space.
31843 - * @n: Number of bytes to copy.
31844 - *
31845 - * Context: User context only. This function may sleep.
31846 - *
31847 - * Copy data from kernel space to user space.
31848 - *
31849 - * Returns number of bytes that could not be copied.
31850 - * On success, this will be zero.
31851 - */
31852 -unsigned long _copy_to_user(void __user *to, const void *from, unsigned n)
31853 +#ifdef CONFIG_PAX_MEMORY_UDEREF
31854 +void __set_fs(mm_segment_t x)
31855 {
31856 - if (access_ok(VERIFY_WRITE, to, n))
31857 - n = __copy_to_user(to, from, n);
31858 - return n;
31859 + switch (x.seg) {
31860 + case 0:
31861 + loadsegment(gs, 0);
31862 + break;
31863 + case TASK_SIZE_MAX:
31864 + loadsegment(gs, __USER_DS);
31865 + break;
31866 + case -1UL:
31867 + loadsegment(gs, __KERNEL_DS);
31868 + break;
31869 + default:
31870 + BUG();
31871 + }
31872 }
31873 -EXPORT_SYMBOL(_copy_to_user);
31874 +EXPORT_SYMBOL(__set_fs);
31875
31876 -/**
31877 - * copy_from_user: - Copy a block of data from user space.
31878 - * @to: Destination address, in kernel space.
31879 - * @from: Source address, in user space.
31880 - * @n: Number of bytes to copy.
31881 - *
31882 - * Context: User context only. This function may sleep.
31883 - *
31884 - * Copy data from user space to kernel space.
31885 - *
31886 - * Returns number of bytes that could not be copied.
31887 - * On success, this will be zero.
31888 - *
31889 - * If some data could not be copied, this function will pad the copied
31890 - * data to the requested size using zero bytes.
31891 - */
31892 -unsigned long _copy_from_user(void *to, const void __user *from, unsigned n)
31893 +void set_fs(mm_segment_t x)
31894 {
31895 - if (access_ok(VERIFY_READ, from, n))
31896 - n = __copy_from_user(to, from, n);
31897 - else
31898 - memset(to, 0, n);
31899 - return n;
31900 + current_thread_info()->addr_limit = x;
31901 + __set_fs(x);
31902 }
31903 -EXPORT_SYMBOL(_copy_from_user);
31904 +EXPORT_SYMBOL(set_fs);
31905 +#endif
31906 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
31907 index 0a42327..7a82465 100644
31908 --- a/arch/x86/lib/usercopy_64.c
31909 +++ b/arch/x86/lib/usercopy_64.c
31910 @@ -18,6 +18,7 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
31911 might_fault();
31912 /* no memory constraint because it doesn't change any memory gcc knows
31913 about */
31914 + pax_open_userland();
31915 stac();
31916 asm volatile(
31917 " testq %[size8],%[size8]\n"
31918 @@ -39,9 +40,10 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
31919 _ASM_EXTABLE(0b,3b)
31920 _ASM_EXTABLE(1b,2b)
31921 : [size8] "=&c"(size), [dst] "=&D" (__d0)
31922 - : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(addr),
31923 + : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(____m(addr)),
31924 [zero] "r" (0UL), [eight] "r" (8UL));
31925 clac();
31926 + pax_close_userland();
31927 return size;
31928 }
31929 EXPORT_SYMBOL(__clear_user);
31930 @@ -54,12 +56,11 @@ unsigned long clear_user(void __user *to, unsigned long n)
31931 }
31932 EXPORT_SYMBOL(clear_user);
31933
31934 -unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
31935 +unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
31936 {
31937 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
31938 - return copy_user_generic((__force void *)to, (__force void *)from, len);
31939 - }
31940 - return len;
31941 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len))
31942 + return copy_user_generic((void __force_kernel *)____m(to), (void __force_kernel *)____m(from), len);
31943 + return len;
31944 }
31945 EXPORT_SYMBOL(copy_in_user);
31946
31947 @@ -69,8 +70,10 @@ EXPORT_SYMBOL(copy_in_user);
31948 * it is not necessary to optimize tail handling.
31949 */
31950 __visible unsigned long
31951 -copy_user_handle_tail(char *to, char *from, unsigned len)
31952 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len)
31953 {
31954 + clac();
31955 + pax_close_userland();
31956 for (; len; --len, to++) {
31957 char c;
31958
31959 @@ -79,10 +82,9 @@ copy_user_handle_tail(char *to, char *from, unsigned len)
31960 if (__put_user_nocheck(c, to, sizeof(char)))
31961 break;
31962 }
31963 - clac();
31964
31965 /* If the destination is a kernel buffer, we always clear the end */
31966 - if (!__addr_ok(to))
31967 + if (!__addr_ok(to) && (unsigned long)to >= TASK_SIZE_MAX + pax_user_shadow_base)
31968 memset(to, 0, len);
31969 return len;
31970 }
31971 diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
31972 index a482d10..1a6edb5 100644
31973 --- a/arch/x86/mm/Makefile
31974 +++ b/arch/x86/mm/Makefile
31975 @@ -33,3 +33,7 @@ obj-$(CONFIG_ACPI_NUMA) += srat.o
31976 obj-$(CONFIG_NUMA_EMU) += numa_emulation.o
31977
31978 obj-$(CONFIG_X86_INTEL_MPX) += mpx.o
31979 +
31980 +quote:="
31981 +obj-$(CONFIG_X86_64) += uderef_64.o
31982 +CFLAGS_uderef_64.o := $(subst $(quote),,$(CONFIG_ARCH_HWEIGHT_CFLAGS)) -fcall-saved-rax
31983 diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
31984 index 903ec1e..c4166b2 100644
31985 --- a/arch/x86/mm/extable.c
31986 +++ b/arch/x86/mm/extable.c
31987 @@ -6,12 +6,24 @@
31988 static inline unsigned long
31989 ex_insn_addr(const struct exception_table_entry *x)
31990 {
31991 - return (unsigned long)&x->insn + x->insn;
31992 + unsigned long reloc = 0;
31993 +
31994 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31995 + reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
31996 +#endif
31997 +
31998 + return (unsigned long)&x->insn + x->insn + reloc;
31999 }
32000 static inline unsigned long
32001 ex_fixup_addr(const struct exception_table_entry *x)
32002 {
32003 - return (unsigned long)&x->fixup + x->fixup;
32004 + unsigned long reloc = 0;
32005 +
32006 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
32007 + reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
32008 +#endif
32009 +
32010 + return (unsigned long)&x->fixup + x->fixup + reloc;
32011 }
32012
32013 int fixup_exception(struct pt_regs *regs)
32014 @@ -20,7 +32,7 @@ int fixup_exception(struct pt_regs *regs)
32015 unsigned long new_ip;
32016
32017 #ifdef CONFIG_PNPBIOS
32018 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
32019 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
32020 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
32021 extern u32 pnp_bios_is_utter_crap;
32022 pnp_bios_is_utter_crap = 1;
32023 @@ -145,6 +157,13 @@ void sort_extable(struct exception_table_entry *start,
32024 i += 4;
32025 p->fixup -= i;
32026 i += 4;
32027 +
32028 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
32029 + BUILD_BUG_ON(!IS_ENABLED(CONFIG_BUILDTIME_EXTABLE_SORT));
32030 + p->insn -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
32031 + p->fixup -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
32032 +#endif
32033 +
32034 }
32035 }
32036
32037 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
32038 index 181c53b..d336596 100644
32039 --- a/arch/x86/mm/fault.c
32040 +++ b/arch/x86/mm/fault.c
32041 @@ -13,12 +13,19 @@
32042 #include <linux/hugetlb.h> /* hstate_index_to_shift */
32043 #include <linux/prefetch.h> /* prefetchw */
32044 #include <linux/context_tracking.h> /* exception_enter(), ... */
32045 +#include <linux/unistd.h>
32046 +#include <linux/compiler.h>
32047
32048 #include <asm/traps.h> /* dotraplinkage, ... */
32049 #include <asm/pgalloc.h> /* pgd_*(), ... */
32050 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
32051 #include <asm/fixmap.h> /* VSYSCALL_ADDR */
32052 #include <asm/vsyscall.h> /* emulate_vsyscall */
32053 +#include <asm/tlbflush.h>
32054 +
32055 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
32056 +#include <asm/stacktrace.h>
32057 +#endif
32058
32059 #define CREATE_TRACE_POINTS
32060 #include <asm/trace/exceptions.h>
32061 @@ -120,7 +127,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
32062 return !instr_lo || (instr_lo>>1) == 1;
32063 case 0x00:
32064 /* Prefetch instruction is 0x0F0D or 0x0F18 */
32065 - if (probe_kernel_address(instr, opcode))
32066 + if (user_mode(regs)) {
32067 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
32068 + return 0;
32069 + } else if (probe_kernel_address(instr, opcode))
32070 return 0;
32071
32072 *prefetch = (instr_lo == 0xF) &&
32073 @@ -154,7 +164,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
32074 while (instr < max_instr) {
32075 unsigned char opcode;
32076
32077 - if (probe_kernel_address(instr, opcode))
32078 + if (user_mode(regs)) {
32079 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
32080 + break;
32081 + } else if (probe_kernel_address(instr, opcode))
32082 break;
32083
32084 instr++;
32085 @@ -185,6 +198,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
32086 force_sig_info(si_signo, &info, tsk);
32087 }
32088
32089 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
32090 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
32091 +#endif
32092 +
32093 +#ifdef CONFIG_PAX_EMUTRAMP
32094 +static int pax_handle_fetch_fault(struct pt_regs *regs);
32095 +#endif
32096 +
32097 +#ifdef CONFIG_PAX_PAGEEXEC
32098 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
32099 +{
32100 + pgd_t *pgd;
32101 + pud_t *pud;
32102 + pmd_t *pmd;
32103 +
32104 + pgd = pgd_offset(mm, address);
32105 + if (!pgd_present(*pgd))
32106 + return NULL;
32107 + pud = pud_offset(pgd, address);
32108 + if (!pud_present(*pud))
32109 + return NULL;
32110 + pmd = pmd_offset(pud, address);
32111 + if (!pmd_present(*pmd))
32112 + return NULL;
32113 + return pmd;
32114 +}
32115 +#endif
32116 +
32117 DEFINE_SPINLOCK(pgd_lock);
32118 LIST_HEAD(pgd_list);
32119
32120 @@ -235,10 +276,27 @@ void vmalloc_sync_all(void)
32121 for (address = VMALLOC_START & PMD_MASK;
32122 address >= TASK_SIZE && address < FIXADDR_TOP;
32123 address += PMD_SIZE) {
32124 +
32125 +#ifdef CONFIG_PAX_PER_CPU_PGD
32126 + unsigned long cpu;
32127 +#else
32128 struct page *page;
32129 +#endif
32130
32131 spin_lock(&pgd_lock);
32132 +
32133 +#ifdef CONFIG_PAX_PER_CPU_PGD
32134 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
32135 + pgd_t *pgd = get_cpu_pgd(cpu, user);
32136 + pmd_t *ret;
32137 +
32138 + ret = vmalloc_sync_one(pgd, address);
32139 + if (!ret)
32140 + break;
32141 + pgd = get_cpu_pgd(cpu, kernel);
32142 +#else
32143 list_for_each_entry(page, &pgd_list, lru) {
32144 + pgd_t *pgd;
32145 spinlock_t *pgt_lock;
32146 pmd_t *ret;
32147
32148 @@ -246,8 +304,14 @@ void vmalloc_sync_all(void)
32149 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
32150
32151 spin_lock(pgt_lock);
32152 - ret = vmalloc_sync_one(page_address(page), address);
32153 + pgd = page_address(page);
32154 +#endif
32155 +
32156 + ret = vmalloc_sync_one(pgd, address);
32157 +
32158 +#ifndef CONFIG_PAX_PER_CPU_PGD
32159 spin_unlock(pgt_lock);
32160 +#endif
32161
32162 if (!ret)
32163 break;
32164 @@ -281,6 +345,12 @@ static noinline int vmalloc_fault(unsigned long address)
32165 * an interrupt in the middle of a task switch..
32166 */
32167 pgd_paddr = read_cr3();
32168 +
32169 +#ifdef CONFIG_PAX_PER_CPU_PGD
32170 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id(), kernel)) != (pgd_paddr & __PHYSICAL_MASK));
32171 + vmalloc_sync_one(__va(pgd_paddr + PAGE_SIZE), address);
32172 +#endif
32173 +
32174 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
32175 if (!pmd_k)
32176 return -1;
32177 @@ -377,11 +447,25 @@ static noinline int vmalloc_fault(unsigned long address)
32178 * happen within a race in page table update. In the later
32179 * case just flush:
32180 */
32181 - pgd = pgd_offset(current->active_mm, address);
32182 +
32183 pgd_ref = pgd_offset_k(address);
32184 if (pgd_none(*pgd_ref))
32185 return -1;
32186
32187 +#ifdef CONFIG_PAX_PER_CPU_PGD
32188 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id(), kernel)) != (read_cr3() & __PHYSICAL_MASK));
32189 + pgd = pgd_offset_cpu(smp_processor_id(), user, address);
32190 + if (pgd_none(*pgd)) {
32191 + set_pgd(pgd, *pgd_ref);
32192 + arch_flush_lazy_mmu_mode();
32193 + } else {
32194 + BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
32195 + }
32196 + pgd = pgd_offset_cpu(smp_processor_id(), kernel, address);
32197 +#else
32198 + pgd = pgd_offset(current->active_mm, address);
32199 +#endif
32200 +
32201 if (pgd_none(*pgd)) {
32202 set_pgd(pgd, *pgd_ref);
32203 arch_flush_lazy_mmu_mode();
32204 @@ -548,7 +632,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
32205 static int is_errata100(struct pt_regs *regs, unsigned long address)
32206 {
32207 #ifdef CONFIG_X86_64
32208 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
32209 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
32210 return 1;
32211 #endif
32212 return 0;
32213 @@ -575,9 +659,9 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
32214 }
32215
32216 static const char nx_warning[] = KERN_CRIT
32217 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
32218 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
32219 static const char smep_warning[] = KERN_CRIT
32220 -"unable to execute userspace code (SMEP?) (uid: %d)\n";
32221 +"unable to execute userspace code (SMEP?) (uid: %d, task: %s, pid: %d)\n";
32222
32223 static void
32224 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
32225 @@ -586,7 +670,7 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
32226 if (!oops_may_print())
32227 return;
32228
32229 - if (error_code & PF_INSTR) {
32230 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
32231 unsigned int level;
32232 pgd_t *pgd;
32233 pte_t *pte;
32234 @@ -597,13 +681,25 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
32235 pte = lookup_address_in_pgd(pgd, address, &level);
32236
32237 if (pte && pte_present(*pte) && !pte_exec(*pte))
32238 - printk(nx_warning, from_kuid(&init_user_ns, current_uid()));
32239 + printk(nx_warning, from_kuid_munged(&init_user_ns, current_uid()), current->comm, task_pid_nr(current));
32240 if (pte && pte_present(*pte) && pte_exec(*pte) &&
32241 (pgd_flags(*pgd) & _PAGE_USER) &&
32242 (__read_cr4() & X86_CR4_SMEP))
32243 - printk(smep_warning, from_kuid(&init_user_ns, current_uid()));
32244 + printk(smep_warning, from_kuid(&init_user_ns, current_uid()), current->comm, task_pid_nr(current));
32245 }
32246
32247 +#ifdef CONFIG_PAX_KERNEXEC
32248 + if (init_mm.start_code <= address && address < init_mm.end_code) {
32249 + if (current->signal->curr_ip)
32250 + printk(KERN_EMERG "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
32251 + &current->signal->curr_ip, current->comm, task_pid_nr(current),
32252 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
32253 + else
32254 + printk(KERN_EMERG "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", current->comm, task_pid_nr(current),
32255 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
32256 + }
32257 +#endif
32258 +
32259 printk(KERN_ALERT "BUG: unable to handle kernel ");
32260 if (address < PAGE_SIZE)
32261 printk(KERN_CONT "NULL pointer dereference");
32262 @@ -782,6 +878,22 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
32263 return;
32264 }
32265 #endif
32266 +
32267 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
32268 + if (pax_is_fetch_fault(regs, error_code, address)) {
32269 +
32270 +#ifdef CONFIG_PAX_EMUTRAMP
32271 + switch (pax_handle_fetch_fault(regs)) {
32272 + case 2:
32273 + return;
32274 + }
32275 +#endif
32276 +
32277 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
32278 + do_group_exit(SIGKILL);
32279 + }
32280 +#endif
32281 +
32282 /* Kernel addresses are always protection faults: */
32283 if (address >= TASK_SIZE)
32284 error_code |= PF_PROT;
32285 @@ -864,7 +976,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
32286 if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
32287 printk(KERN_ERR
32288 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
32289 - tsk->comm, tsk->pid, address);
32290 + tsk->comm, task_pid_nr(tsk), address);
32291 code = BUS_MCEERR_AR;
32292 }
32293 #endif
32294 @@ -916,6 +1028,107 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
32295 return 1;
32296 }
32297
32298 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
32299 +static inline unsigned long get_limit(unsigned long segment)
32300 +{
32301 + unsigned long __limit;
32302 +
32303 + asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
32304 + return __limit + 1;
32305 +}
32306 +
32307 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
32308 +{
32309 + pte_t *pte;
32310 + pmd_t *pmd;
32311 + spinlock_t *ptl;
32312 + unsigned char pte_mask;
32313 +
32314 + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
32315 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
32316 + return 0;
32317 +
32318 + /* PaX: it's our fault, let's handle it if we can */
32319 +
32320 + /* PaX: take a look at read faults before acquiring any locks */
32321 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
32322 + /* instruction fetch attempt from a protected page in user mode */
32323 + up_read(&mm->mmap_sem);
32324 +
32325 +#ifdef CONFIG_PAX_EMUTRAMP
32326 + switch (pax_handle_fetch_fault(regs)) {
32327 + case 2:
32328 + return 1;
32329 + }
32330 +#endif
32331 +
32332 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
32333 + do_group_exit(SIGKILL);
32334 + }
32335 +
32336 + pmd = pax_get_pmd(mm, address);
32337 + if (unlikely(!pmd))
32338 + return 0;
32339 +
32340 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
32341 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
32342 + pte_unmap_unlock(pte, ptl);
32343 + return 0;
32344 + }
32345 +
32346 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
32347 + /* write attempt to a protected page in user mode */
32348 + pte_unmap_unlock(pte, ptl);
32349 + return 0;
32350 + }
32351 +
32352 +#ifdef CONFIG_SMP
32353 + if (likely(address > get_limit(regs->cs) && cpumask_test_cpu(smp_processor_id(), &mm->context.cpu_user_cs_mask)))
32354 +#else
32355 + if (likely(address > get_limit(regs->cs)))
32356 +#endif
32357 + {
32358 + set_pte(pte, pte_mkread(*pte));
32359 + __flush_tlb_one(address);
32360 + pte_unmap_unlock(pte, ptl);
32361 + up_read(&mm->mmap_sem);
32362 + return 1;
32363 + }
32364 +
32365 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
32366 +
32367 + /*
32368 + * PaX: fill DTLB with user rights and retry
32369 + */
32370 + __asm__ __volatile__ (
32371 + "orb %2,(%1)\n"
32372 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
32373 +/*
32374 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
32375 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
32376 + * page fault when examined during a TLB load attempt. this is true not only
32377 + * for PTEs holding a non-present entry but also present entries that will
32378 + * raise a page fault (such as those set up by PaX, or the copy-on-write
32379 + * mechanism). in effect it means that we do *not* need to flush the TLBs
32380 + * for our target pages since their PTEs are simply not in the TLBs at all.
32381 +
32382 + * the best thing in omitting it is that we gain around 15-20% speed in the
32383 + * fast path of the page fault handler and can get rid of tracing since we
32384 + * can no longer flush unintended entries.
32385 + */
32386 + "invlpg (%0)\n"
32387 +#endif
32388 + __copyuser_seg"testb $0,(%0)\n"
32389 + "xorb %3,(%1)\n"
32390 + :
32391 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
32392 + : "memory", "cc");
32393 + pte_unmap_unlock(pte, ptl);
32394 + up_read(&mm->mmap_sem);
32395 + return 1;
32396 +}
32397 +#endif
32398 +
32399 /*
32400 * Handle a spurious fault caused by a stale TLB entry.
32401 *
32402 @@ -1001,6 +1214,9 @@ int show_unhandled_signals = 1;
32403 static inline int
32404 access_error(unsigned long error_code, struct vm_area_struct *vma)
32405 {
32406 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
32407 + return 1;
32408 +
32409 if (error_code & PF_WRITE) {
32410 /* write, present and write, not present: */
32411 if (unlikely(!(vma->vm_flags & VM_WRITE)))
32412 @@ -1063,6 +1279,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
32413 tsk = current;
32414 mm = tsk->mm;
32415
32416 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
32417 + if (!user_mode(regs) && address < 2 * pax_user_shadow_base) {
32418 + if (!search_exception_tables(regs->ip)) {
32419 + printk(KERN_EMERG "PAX: please report this to pageexec@freemail.hu\n");
32420 + bad_area_nosemaphore(regs, error_code, address);
32421 + return;
32422 + }
32423 + if (address < pax_user_shadow_base) {
32424 + printk(KERN_EMERG "PAX: please report this to pageexec@freemail.hu\n");
32425 + printk(KERN_EMERG "PAX: faulting IP: %pS\n", (void *)regs->ip);
32426 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_EMERG);
32427 + } else
32428 + address -= pax_user_shadow_base;
32429 + }
32430 +#endif
32431 +
32432 /*
32433 * Detect and handle instructions that would cause a page fault for
32434 * both a tracked kernel page and a userspace page.
32435 @@ -1187,6 +1419,11 @@ retry:
32436 might_sleep();
32437 }
32438
32439 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
32440 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
32441 + return;
32442 +#endif
32443 +
32444 vma = find_vma(mm, address);
32445 if (unlikely(!vma)) {
32446 bad_area(regs, error_code, address);
32447 @@ -1198,18 +1435,24 @@ retry:
32448 bad_area(regs, error_code, address);
32449 return;
32450 }
32451 - if (error_code & PF_USER) {
32452 - /*
32453 - * Accessing the stack below %sp is always a bug.
32454 - * The large cushion allows instructions like enter
32455 - * and pusha to work. ("enter $65535, $31" pushes
32456 - * 32 pointers and then decrements %sp by 65535.)
32457 - */
32458 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
32459 - bad_area(regs, error_code, address);
32460 - return;
32461 - }
32462 + /*
32463 + * Accessing the stack below %sp is always a bug.
32464 + * The large cushion allows instructions like enter
32465 + * and pusha to work. ("enter $65535, $31" pushes
32466 + * 32 pointers and then decrements %sp by 65535.)
32467 + */
32468 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
32469 + bad_area(regs, error_code, address);
32470 + return;
32471 }
32472 +
32473 +#ifdef CONFIG_PAX_SEGMEXEC
32474 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
32475 + bad_area(regs, error_code, address);
32476 + return;
32477 + }
32478 +#endif
32479 +
32480 if (unlikely(expand_stack(vma, address))) {
32481 bad_area(regs, error_code, address);
32482 return;
32483 @@ -1329,3 +1572,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
32484 }
32485 NOKPROBE_SYMBOL(trace_do_page_fault);
32486 #endif /* CONFIG_TRACING */
32487 +
32488 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
32489 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
32490 +{
32491 + struct mm_struct *mm = current->mm;
32492 + unsigned long ip = regs->ip;
32493 +
32494 + if (v8086_mode(regs))
32495 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
32496 +
32497 +#ifdef CONFIG_PAX_PAGEEXEC
32498 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
32499 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
32500 + return true;
32501 + if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
32502 + return true;
32503 + return false;
32504 + }
32505 +#endif
32506 +
32507 +#ifdef CONFIG_PAX_SEGMEXEC
32508 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
32509 + if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
32510 + return true;
32511 + return false;
32512 + }
32513 +#endif
32514 +
32515 + return false;
32516 +}
32517 +#endif
32518 +
32519 +#ifdef CONFIG_PAX_EMUTRAMP
32520 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
32521 +{
32522 + int err;
32523 +
32524 + do { /* PaX: libffi trampoline emulation */
32525 + unsigned char mov, jmp;
32526 + unsigned int addr1, addr2;
32527 +
32528 +#ifdef CONFIG_X86_64
32529 + if ((regs->ip + 9) >> 32)
32530 + break;
32531 +#endif
32532 +
32533 + err = get_user(mov, (unsigned char __user *)regs->ip);
32534 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
32535 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
32536 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
32537 +
32538 + if (err)
32539 + break;
32540 +
32541 + if (mov == 0xB8 && jmp == 0xE9) {
32542 + regs->ax = addr1;
32543 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
32544 + return 2;
32545 + }
32546 + } while (0);
32547 +
32548 + do { /* PaX: gcc trampoline emulation #1 */
32549 + unsigned char mov1, mov2;
32550 + unsigned short jmp;
32551 + unsigned int addr1, addr2;
32552 +
32553 +#ifdef CONFIG_X86_64
32554 + if ((regs->ip + 11) >> 32)
32555 + break;
32556 +#endif
32557 +
32558 + err = get_user(mov1, (unsigned char __user *)regs->ip);
32559 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
32560 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
32561 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
32562 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
32563 +
32564 + if (err)
32565 + break;
32566 +
32567 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
32568 + regs->cx = addr1;
32569 + regs->ax = addr2;
32570 + regs->ip = addr2;
32571 + return 2;
32572 + }
32573 + } while (0);
32574 +
32575 + do { /* PaX: gcc trampoline emulation #2 */
32576 + unsigned char mov, jmp;
32577 + unsigned int addr1, addr2;
32578 +
32579 +#ifdef CONFIG_X86_64
32580 + if ((regs->ip + 9) >> 32)
32581 + break;
32582 +#endif
32583 +
32584 + err = get_user(mov, (unsigned char __user *)regs->ip);
32585 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
32586 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
32587 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
32588 +
32589 + if (err)
32590 + break;
32591 +
32592 + if (mov == 0xB9 && jmp == 0xE9) {
32593 + regs->cx = addr1;
32594 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
32595 + return 2;
32596 + }
32597 + } while (0);
32598 +
32599 + return 1; /* PaX in action */
32600 +}
32601 +
32602 +#ifdef CONFIG_X86_64
32603 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
32604 +{
32605 + int err;
32606 +
32607 + do { /* PaX: libffi trampoline emulation */
32608 + unsigned short mov1, mov2, jmp1;
32609 + unsigned char stcclc, jmp2;
32610 + unsigned long addr1, addr2;
32611 +
32612 + err = get_user(mov1, (unsigned short __user *)regs->ip);
32613 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
32614 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
32615 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
32616 + err |= get_user(stcclc, (unsigned char __user *)(regs->ip + 20));
32617 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 21));
32618 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 23));
32619 +
32620 + if (err)
32621 + break;
32622 +
32623 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && (stcclc == 0xF8 || stcclc == 0xF9) && jmp1 == 0xFF49 && jmp2 == 0xE3) {
32624 + regs->r11 = addr1;
32625 + regs->r10 = addr2;
32626 + if (stcclc == 0xF8)
32627 + regs->flags &= ~X86_EFLAGS_CF;
32628 + else
32629 + regs->flags |= X86_EFLAGS_CF;
32630 + regs->ip = addr1;
32631 + return 2;
32632 + }
32633 + } while (0);
32634 +
32635 + do { /* PaX: gcc trampoline emulation #1 */
32636 + unsigned short mov1, mov2, jmp1;
32637 + unsigned char jmp2;
32638 + unsigned int addr1;
32639 + unsigned long addr2;
32640 +
32641 + err = get_user(mov1, (unsigned short __user *)regs->ip);
32642 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
32643 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
32644 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
32645 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
32646 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
32647 +
32648 + if (err)
32649 + break;
32650 +
32651 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
32652 + regs->r11 = addr1;
32653 + regs->r10 = addr2;
32654 + regs->ip = addr1;
32655 + return 2;
32656 + }
32657 + } while (0);
32658 +
32659 + do { /* PaX: gcc trampoline emulation #2 */
32660 + unsigned short mov1, mov2, jmp1;
32661 + unsigned char jmp2;
32662 + unsigned long addr1, addr2;
32663 +
32664 + err = get_user(mov1, (unsigned short __user *)regs->ip);
32665 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
32666 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
32667 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
32668 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
32669 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
32670 +
32671 + if (err)
32672 + break;
32673 +
32674 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
32675 + regs->r11 = addr1;
32676 + regs->r10 = addr2;
32677 + regs->ip = addr1;
32678 + return 2;
32679 + }
32680 + } while (0);
32681 +
32682 + return 1; /* PaX in action */
32683 +}
32684 +#endif
32685 +
32686 +/*
32687 + * PaX: decide what to do with offenders (regs->ip = fault address)
32688 + *
32689 + * returns 1 when task should be killed
32690 + * 2 when gcc trampoline was detected
32691 + */
32692 +static int pax_handle_fetch_fault(struct pt_regs *regs)
32693 +{
32694 + if (v8086_mode(regs))
32695 + return 1;
32696 +
32697 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
32698 + return 1;
32699 +
32700 +#ifdef CONFIG_X86_32
32701 + return pax_handle_fetch_fault_32(regs);
32702 +#else
32703 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
32704 + return pax_handle_fetch_fault_32(regs);
32705 + else
32706 + return pax_handle_fetch_fault_64(regs);
32707 +#endif
32708 +}
32709 +#endif
32710 +
32711 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
32712 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
32713 +{
32714 + long i;
32715 +
32716 + printk(KERN_ERR "PAX: bytes at PC: ");
32717 + for (i = 0; i < 20; i++) {
32718 + unsigned char c;
32719 + if (get_user(c, (unsigned char __force_user *)pc+i))
32720 + printk(KERN_CONT "?? ");
32721 + else
32722 + printk(KERN_CONT "%02x ", c);
32723 + }
32724 + printk("\n");
32725 +
32726 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
32727 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
32728 + unsigned long c;
32729 + if (get_user(c, (unsigned long __force_user *)sp+i)) {
32730 +#ifdef CONFIG_X86_32
32731 + printk(KERN_CONT "???????? ");
32732 +#else
32733 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
32734 + printk(KERN_CONT "???????? ???????? ");
32735 + else
32736 + printk(KERN_CONT "???????????????? ");
32737 +#endif
32738 + } else {
32739 +#ifdef CONFIG_X86_64
32740 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
32741 + printk(KERN_CONT "%08x ", (unsigned int)c);
32742 + printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
32743 + } else
32744 +#endif
32745 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
32746 + }
32747 + }
32748 + printk("\n");
32749 +}
32750 +#endif
32751 +
32752 +/**
32753 + * probe_kernel_write(): safely attempt to write to a location
32754 + * @dst: address to write to
32755 + * @src: pointer to the data that shall be written
32756 + * @size: size of the data chunk
32757 + *
32758 + * Safely write to address @dst from the buffer at @src. If a kernel fault
32759 + * happens, handle that and return -EFAULT.
32760 + */
32761 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
32762 +{
32763 + long ret;
32764 + mm_segment_t old_fs = get_fs();
32765 +
32766 + set_fs(KERNEL_DS);
32767 + pagefault_disable();
32768 + pax_open_kernel();
32769 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
32770 + pax_close_kernel();
32771 + pagefault_enable();
32772 + set_fs(old_fs);
32773 +
32774 + return ret ? -EFAULT : 0;
32775 +}
32776 diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
32777 index 81bf3d2..7ef25c2 100644
32778 --- a/arch/x86/mm/gup.c
32779 +++ b/arch/x86/mm/gup.c
32780 @@ -268,7 +268,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
32781 addr = start;
32782 len = (unsigned long) nr_pages << PAGE_SHIFT;
32783 end = start + len;
32784 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
32785 + if (unlikely(!access_ok_noprefault(write ? VERIFY_WRITE : VERIFY_READ,
32786 (void __user *)start, len)))
32787 return 0;
32788
32789 @@ -344,6 +344,10 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
32790 goto slow_irqon;
32791 #endif
32792
32793 + if (unlikely(!access_ok_noprefault(write ? VERIFY_WRITE : VERIFY_READ,
32794 + (void __user *)start, len)))
32795 + return 0;
32796 +
32797 /*
32798 * XXX: batch / limit 'nr', to avoid large irq off latency
32799 * needs some instrumenting to determine the common sizes used by
32800 diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
32801 index 4500142..53a363c 100644
32802 --- a/arch/x86/mm/highmem_32.c
32803 +++ b/arch/x86/mm/highmem_32.c
32804 @@ -45,7 +45,11 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
32805 idx = type + KM_TYPE_NR*smp_processor_id();
32806 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
32807 BUG_ON(!pte_none(*(kmap_pte-idx)));
32808 +
32809 + pax_open_kernel();
32810 set_pte(kmap_pte-idx, mk_pte(page, prot));
32811 + pax_close_kernel();
32812 +
32813 arch_flush_lazy_mmu_mode();
32814
32815 return (void *)vaddr;
32816 diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
32817 index 42982b2..7168fc3 100644
32818 --- a/arch/x86/mm/hugetlbpage.c
32819 +++ b/arch/x86/mm/hugetlbpage.c
32820 @@ -74,23 +74,24 @@ int pud_huge(pud_t pud)
32821 #ifdef CONFIG_HUGETLB_PAGE
32822 static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
32823 unsigned long addr, unsigned long len,
32824 - unsigned long pgoff, unsigned long flags)
32825 + unsigned long pgoff, unsigned long flags, unsigned long offset)
32826 {
32827 struct hstate *h = hstate_file(file);
32828 struct vm_unmapped_area_info info;
32829 -
32830 +
32831 info.flags = 0;
32832 info.length = len;
32833 info.low_limit = current->mm->mmap_legacy_base;
32834 info.high_limit = TASK_SIZE;
32835 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
32836 info.align_offset = 0;
32837 + info.threadstack_offset = offset;
32838 return vm_unmapped_area(&info);
32839 }
32840
32841 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
32842 unsigned long addr0, unsigned long len,
32843 - unsigned long pgoff, unsigned long flags)
32844 + unsigned long pgoff, unsigned long flags, unsigned long offset)
32845 {
32846 struct hstate *h = hstate_file(file);
32847 struct vm_unmapped_area_info info;
32848 @@ -102,6 +103,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
32849 info.high_limit = current->mm->mmap_base;
32850 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
32851 info.align_offset = 0;
32852 + info.threadstack_offset = offset;
32853 addr = vm_unmapped_area(&info);
32854
32855 /*
32856 @@ -114,6 +116,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
32857 VM_BUG_ON(addr != -ENOMEM);
32858 info.flags = 0;
32859 info.low_limit = TASK_UNMAPPED_BASE;
32860 +
32861 +#ifdef CONFIG_PAX_RANDMMAP
32862 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
32863 + info.low_limit += current->mm->delta_mmap;
32864 +#endif
32865 +
32866 info.high_limit = TASK_SIZE;
32867 addr = vm_unmapped_area(&info);
32868 }
32869 @@ -128,10 +136,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
32870 struct hstate *h = hstate_file(file);
32871 struct mm_struct *mm = current->mm;
32872 struct vm_area_struct *vma;
32873 + unsigned long pax_task_size = TASK_SIZE;
32874 + unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
32875
32876 if (len & ~huge_page_mask(h))
32877 return -EINVAL;
32878 - if (len > TASK_SIZE)
32879 +
32880 +#ifdef CONFIG_PAX_SEGMEXEC
32881 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
32882 + pax_task_size = SEGMEXEC_TASK_SIZE;
32883 +#endif
32884 +
32885 + pax_task_size -= PAGE_SIZE;
32886 +
32887 + if (len > pax_task_size)
32888 return -ENOMEM;
32889
32890 if (flags & MAP_FIXED) {
32891 @@ -140,19 +158,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
32892 return addr;
32893 }
32894
32895 +#ifdef CONFIG_PAX_RANDMMAP
32896 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
32897 +#endif
32898 +
32899 if (addr) {
32900 addr = ALIGN(addr, huge_page_size(h));
32901 vma = find_vma(mm, addr);
32902 - if (TASK_SIZE - len >= addr &&
32903 - (!vma || addr + len <= vma->vm_start))
32904 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
32905 return addr;
32906 }
32907 if (mm->get_unmapped_area == arch_get_unmapped_area)
32908 return hugetlb_get_unmapped_area_bottomup(file, addr, len,
32909 - pgoff, flags);
32910 + pgoff, flags, offset);
32911 else
32912 return hugetlb_get_unmapped_area_topdown(file, addr, len,
32913 - pgoff, flags);
32914 + pgoff, flags, offset);
32915 }
32916 #endif /* CONFIG_HUGETLB_PAGE */
32917
32918 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
32919 index 1d55318..d58fd6a 100644
32920 --- a/arch/x86/mm/init.c
32921 +++ b/arch/x86/mm/init.c
32922 @@ -4,6 +4,7 @@
32923 #include <linux/swap.h>
32924 #include <linux/memblock.h>
32925 #include <linux/bootmem.h> /* for max_low_pfn */
32926 +#include <linux/tboot.h>
32927
32928 #include <asm/cacheflush.h>
32929 #include <asm/e820.h>
32930 @@ -17,6 +18,8 @@
32931 #include <asm/proto.h>
32932 #include <asm/dma.h> /* for MAX_DMA_PFN */
32933 #include <asm/microcode.h>
32934 +#include <asm/desc.h>
32935 +#include <asm/bios_ebda.h>
32936
32937 /*
32938 * We need to define the tracepoints somewhere, and tlb.c
32939 @@ -615,7 +618,18 @@ void __init init_mem_mapping(void)
32940 early_ioremap_page_table_range_init();
32941 #endif
32942
32943 +#ifdef CONFIG_PAX_PER_CPU_PGD
32944 + clone_pgd_range(get_cpu_pgd(0, kernel) + KERNEL_PGD_BOUNDARY,
32945 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
32946 + KERNEL_PGD_PTRS);
32947 + clone_pgd_range(get_cpu_pgd(0, user) + KERNEL_PGD_BOUNDARY,
32948 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
32949 + KERNEL_PGD_PTRS);
32950 + load_cr3(get_cpu_pgd(0, kernel));
32951 +#else
32952 load_cr3(swapper_pg_dir);
32953 +#endif
32954 +
32955 __flush_tlb_all();
32956
32957 early_memtest(0, max_pfn_mapped << PAGE_SHIFT);
32958 @@ -631,10 +645,40 @@ void __init init_mem_mapping(void)
32959 * Access has to be given to non-kernel-ram areas as well, these contain the PCI
32960 * mmio resources as well as potential bios/acpi data regions.
32961 */
32962 +
32963 +#ifdef CONFIG_GRKERNSEC_KMEM
32964 +static unsigned int ebda_start __read_only;
32965 +static unsigned int ebda_end __read_only;
32966 +#endif
32967 +
32968 int devmem_is_allowed(unsigned long pagenr)
32969 {
32970 - if (pagenr < 256)
32971 +#ifdef CONFIG_GRKERNSEC_KMEM
32972 + /* allow BDA */
32973 + if (!pagenr)
32974 return 1;
32975 + /* allow EBDA */
32976 + if (pagenr >= ebda_start && pagenr < ebda_end)
32977 + return 1;
32978 + /* if tboot is in use, allow access to its hardcoded serial log range */
32979 + if (tboot_enabled() && ((0x60000 >> PAGE_SHIFT) <= pagenr) && (pagenr < (0x68000 >> PAGE_SHIFT)))
32980 + return 1;
32981 +#else
32982 + if (!pagenr)
32983 + return 1;
32984 +#ifdef CONFIG_VM86
32985 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
32986 + return 1;
32987 +#endif
32988 +#endif
32989 +
32990 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
32991 + return 1;
32992 +#ifdef CONFIG_GRKERNSEC_KMEM
32993 + /* throw out everything else below 1MB */
32994 + if (pagenr <= 256)
32995 + return 0;
32996 +#endif
32997 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
32998 return 0;
32999 if (!page_is_ram(pagenr))
33000 @@ -680,8 +724,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
33001 #endif
33002 }
33003
33004 +#ifdef CONFIG_GRKERNSEC_KMEM
33005 +static inline void gr_init_ebda(void)
33006 +{
33007 + unsigned int ebda_addr;
33008 + unsigned int ebda_size = 0;
33009 +
33010 + ebda_addr = get_bios_ebda();
33011 + if (ebda_addr) {
33012 + ebda_size = *(unsigned char *)phys_to_virt(ebda_addr);
33013 + ebda_size <<= 10;
33014 + }
33015 + if (ebda_addr && ebda_size) {
33016 + ebda_start = ebda_addr >> PAGE_SHIFT;
33017 + ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
33018 + } else {
33019 + ebda_start = 0x9f000 >> PAGE_SHIFT;
33020 + ebda_end = 0xa0000 >> PAGE_SHIFT;
33021 + }
33022 +}
33023 +#else
33024 +static inline void gr_init_ebda(void) { }
33025 +#endif
33026 +
33027 void free_initmem(void)
33028 {
33029 +#ifdef CONFIG_PAX_KERNEXEC
33030 +#ifdef CONFIG_X86_32
33031 + /* PaX: limit KERNEL_CS to actual size */
33032 + unsigned long addr, limit;
33033 + struct desc_struct d;
33034 + int cpu;
33035 +#else
33036 + pgd_t *pgd;
33037 + pud_t *pud;
33038 + pmd_t *pmd;
33039 + unsigned long addr, end;
33040 +#endif
33041 +#endif
33042 +
33043 + gr_init_ebda();
33044 +
33045 +#ifdef CONFIG_PAX_KERNEXEC
33046 +#ifdef CONFIG_X86_32
33047 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
33048 + limit = (limit - 1UL) >> PAGE_SHIFT;
33049 +
33050 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
33051 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
33052 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
33053 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
33054 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEXEC_KERNEL_CS, &d, DESCTYPE_S);
33055 + }
33056 +
33057 + /* PaX: make KERNEL_CS read-only */
33058 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
33059 + if (!paravirt_enabled())
33060 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
33061 +/*
33062 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
33063 + pgd = pgd_offset_k(addr);
33064 + pud = pud_offset(pgd, addr);
33065 + pmd = pmd_offset(pud, addr);
33066 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
33067 + }
33068 +*/
33069 +#ifdef CONFIG_X86_PAE
33070 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
33071 +/*
33072 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
33073 + pgd = pgd_offset_k(addr);
33074 + pud = pud_offset(pgd, addr);
33075 + pmd = pmd_offset(pud, addr);
33076 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
33077 + }
33078 +*/
33079 +#endif
33080 +
33081 +#ifdef CONFIG_MODULES
33082 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
33083 +#endif
33084 +
33085 +#else
33086 + /* PaX: make kernel code/rodata read-only, rest non-executable */
33087 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
33088 + pgd = pgd_offset_k(addr);
33089 + pud = pud_offset(pgd, addr);
33090 + pmd = pmd_offset(pud, addr);
33091 + if (!pmd_present(*pmd))
33092 + continue;
33093 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
33094 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
33095 + else
33096 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
33097 + }
33098 +
33099 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
33100 + end = addr + KERNEL_IMAGE_SIZE;
33101 + for (; addr < end; addr += PMD_SIZE) {
33102 + pgd = pgd_offset_k(addr);
33103 + pud = pud_offset(pgd, addr);
33104 + pmd = pmd_offset(pud, addr);
33105 + if (!pmd_present(*pmd))
33106 + continue;
33107 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
33108 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
33109 + }
33110 +#endif
33111 +
33112 + flush_tlb_all();
33113 +#endif
33114 +
33115 free_init_pages("unused kernel",
33116 (unsigned long)(&__init_begin),
33117 (unsigned long)(&__init_end));
33118 diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
33119 index c8140e1..59257fc 100644
33120 --- a/arch/x86/mm/init_32.c
33121 +++ b/arch/x86/mm/init_32.c
33122 @@ -62,33 +62,6 @@ static noinline int do_test_wp_bit(void);
33123 bool __read_mostly __vmalloc_start_set = false;
33124
33125 /*
33126 - * Creates a middle page table and puts a pointer to it in the
33127 - * given global directory entry. This only returns the gd entry
33128 - * in non-PAE compilation mode, since the middle layer is folded.
33129 - */
33130 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
33131 -{
33132 - pud_t *pud;
33133 - pmd_t *pmd_table;
33134 -
33135 -#ifdef CONFIG_X86_PAE
33136 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
33137 - pmd_table = (pmd_t *)alloc_low_page();
33138 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
33139 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
33140 - pud = pud_offset(pgd, 0);
33141 - BUG_ON(pmd_table != pmd_offset(pud, 0));
33142 -
33143 - return pmd_table;
33144 - }
33145 -#endif
33146 - pud = pud_offset(pgd, 0);
33147 - pmd_table = pmd_offset(pud, 0);
33148 -
33149 - return pmd_table;
33150 -}
33151 -
33152 -/*
33153 * Create a page table and place a pointer to it in a middle page
33154 * directory entry:
33155 */
33156 @@ -98,13 +71,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
33157 pte_t *page_table = (pte_t *)alloc_low_page();
33158
33159 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
33160 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
33161 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
33162 +#else
33163 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
33164 +#endif
33165 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
33166 }
33167
33168 return pte_offset_kernel(pmd, 0);
33169 }
33170
33171 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
33172 +{
33173 + pud_t *pud;
33174 + pmd_t *pmd_table;
33175 +
33176 + pud = pud_offset(pgd, 0);
33177 + pmd_table = pmd_offset(pud, 0);
33178 +
33179 + return pmd_table;
33180 +}
33181 +
33182 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
33183 {
33184 int pgd_idx = pgd_index(vaddr);
33185 @@ -208,6 +196,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
33186 int pgd_idx, pmd_idx;
33187 unsigned long vaddr;
33188 pgd_t *pgd;
33189 + pud_t *pud;
33190 pmd_t *pmd;
33191 pte_t *pte = NULL;
33192 unsigned long count = page_table_range_init_count(start, end);
33193 @@ -222,8 +211,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
33194 pgd = pgd_base + pgd_idx;
33195
33196 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
33197 - pmd = one_md_table_init(pgd);
33198 - pmd = pmd + pmd_index(vaddr);
33199 + pud = pud_offset(pgd, vaddr);
33200 + pmd = pmd_offset(pud, vaddr);
33201 +
33202 +#ifdef CONFIG_X86_PAE
33203 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
33204 +#endif
33205 +
33206 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
33207 pmd++, pmd_idx++) {
33208 pte = page_table_kmap_check(one_page_table_init(pmd),
33209 @@ -235,11 +229,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
33210 }
33211 }
33212
33213 -static inline int is_kernel_text(unsigned long addr)
33214 +static inline int is_kernel_text(unsigned long start, unsigned long end)
33215 {
33216 - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
33217 - return 1;
33218 - return 0;
33219 + if ((start >= ktla_ktva((unsigned long)_etext) ||
33220 + end <= ktla_ktva((unsigned long)_stext)) &&
33221 + (start >= ktla_ktva((unsigned long)_einittext) ||
33222 + end <= ktla_ktva((unsigned long)_sinittext)) &&
33223 +
33224 +#ifdef CONFIG_ACPI_SLEEP
33225 + (start >= (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
33226 +#endif
33227 +
33228 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
33229 + return 0;
33230 + return 1;
33231 }
33232
33233 /*
33234 @@ -256,9 +259,10 @@ kernel_physical_mapping_init(unsigned long start,
33235 unsigned long last_map_addr = end;
33236 unsigned long start_pfn, end_pfn;
33237 pgd_t *pgd_base = swapper_pg_dir;
33238 - int pgd_idx, pmd_idx, pte_ofs;
33239 + unsigned int pgd_idx, pmd_idx, pte_ofs;
33240 unsigned long pfn;
33241 pgd_t *pgd;
33242 + pud_t *pud;
33243 pmd_t *pmd;
33244 pte_t *pte;
33245 unsigned pages_2m, pages_4k;
33246 @@ -291,8 +295,13 @@ repeat:
33247 pfn = start_pfn;
33248 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
33249 pgd = pgd_base + pgd_idx;
33250 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
33251 - pmd = one_md_table_init(pgd);
33252 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
33253 + pud = pud_offset(pgd, 0);
33254 + pmd = pmd_offset(pud, 0);
33255 +
33256 +#ifdef CONFIG_X86_PAE
33257 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
33258 +#endif
33259
33260 if (pfn >= end_pfn)
33261 continue;
33262 @@ -304,14 +313,13 @@ repeat:
33263 #endif
33264 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
33265 pmd++, pmd_idx++) {
33266 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
33267 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
33268
33269 /*
33270 * Map with big pages if possible, otherwise
33271 * create normal page tables:
33272 */
33273 if (use_pse) {
33274 - unsigned int addr2;
33275 pgprot_t prot = PAGE_KERNEL_LARGE;
33276 /*
33277 * first pass will use the same initial
33278 @@ -322,11 +330,7 @@ repeat:
33279 _PAGE_PSE);
33280
33281 pfn &= PMD_MASK >> PAGE_SHIFT;
33282 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
33283 - PAGE_OFFSET + PAGE_SIZE-1;
33284 -
33285 - if (is_kernel_text(addr) ||
33286 - is_kernel_text(addr2))
33287 + if (is_kernel_text(address, address + PMD_SIZE))
33288 prot = PAGE_KERNEL_LARGE_EXEC;
33289
33290 pages_2m++;
33291 @@ -343,7 +347,7 @@ repeat:
33292 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
33293 pte += pte_ofs;
33294 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
33295 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
33296 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
33297 pgprot_t prot = PAGE_KERNEL;
33298 /*
33299 * first pass will use the same initial
33300 @@ -351,7 +355,7 @@ repeat:
33301 */
33302 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
33303
33304 - if (is_kernel_text(addr))
33305 + if (is_kernel_text(address, address + PAGE_SIZE))
33306 prot = PAGE_KERNEL_EXEC;
33307
33308 pages_4k++;
33309 @@ -474,7 +478,7 @@ void __init native_pagetable_init(void)
33310
33311 pud = pud_offset(pgd, va);
33312 pmd = pmd_offset(pud, va);
33313 - if (!pmd_present(*pmd))
33314 + if (!pmd_present(*pmd)) // PAX TODO || pmd_large(*pmd))
33315 break;
33316
33317 /* should not be large page here */
33318 @@ -532,12 +536,10 @@ void __init early_ioremap_page_table_range_init(void)
33319
33320 static void __init pagetable_init(void)
33321 {
33322 - pgd_t *pgd_base = swapper_pg_dir;
33323 -
33324 - permanent_kmaps_init(pgd_base);
33325 + permanent_kmaps_init(swapper_pg_dir);
33326 }
33327
33328 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL);
33329 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL);
33330 EXPORT_SYMBOL_GPL(__supported_pte_mask);
33331
33332 /* user-defined highmem size */
33333 @@ -787,10 +789,10 @@ void __init mem_init(void)
33334 ((unsigned long)&__init_end -
33335 (unsigned long)&__init_begin) >> 10,
33336
33337 - (unsigned long)&_etext, (unsigned long)&_edata,
33338 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
33339 + (unsigned long)&_sdata, (unsigned long)&_edata,
33340 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
33341
33342 - (unsigned long)&_text, (unsigned long)&_etext,
33343 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
33344 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
33345
33346 /*
33347 @@ -884,6 +886,7 @@ void set_kernel_text_rw(void)
33348 if (!kernel_set_to_readonly)
33349 return;
33350
33351 + start = ktla_ktva(start);
33352 pr_debug("Set kernel text: %lx - %lx for read write\n",
33353 start, start+size);
33354
33355 @@ -898,6 +901,7 @@ void set_kernel_text_ro(void)
33356 if (!kernel_set_to_readonly)
33357 return;
33358
33359 + start = ktla_ktva(start);
33360 pr_debug("Set kernel text: %lx - %lx for read only\n",
33361 start, start+size);
33362
33363 @@ -926,6 +930,7 @@ void mark_rodata_ro(void)
33364 unsigned long start = PFN_ALIGN(_text);
33365 unsigned long size = PFN_ALIGN(_etext) - start;
33366
33367 + start = ktla_ktva(start);
33368 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
33369 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
33370 size >> 10);
33371 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
33372 index 3fba623..5ee9802 100644
33373 --- a/arch/x86/mm/init_64.c
33374 +++ b/arch/x86/mm/init_64.c
33375 @@ -136,7 +136,7 @@ int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page,
33376 * around without checking the pgd every time.
33377 */
33378
33379 -pteval_t __supported_pte_mask __read_mostly = ~0;
33380 +pteval_t __supported_pte_mask __read_only = ~_PAGE_NX;
33381 EXPORT_SYMBOL_GPL(__supported_pte_mask);
33382
33383 int force_personality32;
33384 @@ -169,7 +169,12 @@ void sync_global_pgds(unsigned long start, unsigned long end, int removed)
33385
33386 for (address = start; address <= end; address += PGDIR_SIZE) {
33387 const pgd_t *pgd_ref = pgd_offset_k(address);
33388 +
33389 +#ifdef CONFIG_PAX_PER_CPU_PGD
33390 + unsigned long cpu;
33391 +#else
33392 struct page *page;
33393 +#endif
33394
33395 /*
33396 * When it is called after memory hot remove, pgd_none()
33397 @@ -180,6 +185,25 @@ void sync_global_pgds(unsigned long start, unsigned long end, int removed)
33398 continue;
33399
33400 spin_lock(&pgd_lock);
33401 +
33402 +#ifdef CONFIG_PAX_PER_CPU_PGD
33403 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
33404 + pgd_t *pgd = pgd_offset_cpu(cpu, user, address);
33405 +
33406 + if (!pgd_none(*pgd_ref) && !pgd_none(*pgd))
33407 + BUG_ON(pgd_page_vaddr(*pgd)
33408 + != pgd_page_vaddr(*pgd_ref));
33409 +
33410 + if (removed) {
33411 + if (pgd_none(*pgd_ref) && !pgd_none(*pgd))
33412 + pgd_clear(pgd);
33413 + } else {
33414 + if (pgd_none(*pgd))
33415 + set_pgd(pgd, *pgd_ref);
33416 + }
33417 +
33418 + pgd = pgd_offset_cpu(cpu, kernel, address);
33419 +#else
33420 list_for_each_entry(page, &pgd_list, lru) {
33421 pgd_t *pgd;
33422 spinlock_t *pgt_lock;
33423 @@ -188,6 +212,7 @@ void sync_global_pgds(unsigned long start, unsigned long end, int removed)
33424 /* the pgt_lock only for Xen */
33425 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
33426 spin_lock(pgt_lock);
33427 +#endif
33428
33429 if (!pgd_none(*pgd_ref) && !pgd_none(*pgd))
33430 BUG_ON(pgd_page_vaddr(*pgd)
33431 @@ -201,7 +226,10 @@ void sync_global_pgds(unsigned long start, unsigned long end, int removed)
33432 set_pgd(pgd, *pgd_ref);
33433 }
33434
33435 +#ifndef CONFIG_PAX_PER_CPU_PGD
33436 spin_unlock(pgt_lock);
33437 +#endif
33438 +
33439 }
33440 spin_unlock(&pgd_lock);
33441 }
33442 @@ -234,7 +262,7 @@ static pud_t *fill_pud(pgd_t *pgd, unsigned long vaddr)
33443 {
33444 if (pgd_none(*pgd)) {
33445 pud_t *pud = (pud_t *)spp_getpage();
33446 - pgd_populate(&init_mm, pgd, pud);
33447 + pgd_populate_kernel(&init_mm, pgd, pud);
33448 if (pud != pud_offset(pgd, 0))
33449 printk(KERN_ERR "PAGETABLE BUG #00! %p <-> %p\n",
33450 pud, pud_offset(pgd, 0));
33451 @@ -246,7 +274,7 @@ static pmd_t *fill_pmd(pud_t *pud, unsigned long vaddr)
33452 {
33453 if (pud_none(*pud)) {
33454 pmd_t *pmd = (pmd_t *) spp_getpage();
33455 - pud_populate(&init_mm, pud, pmd);
33456 + pud_populate_kernel(&init_mm, pud, pmd);
33457 if (pmd != pmd_offset(pud, 0))
33458 printk(KERN_ERR "PAGETABLE BUG #01! %p <-> %p\n",
33459 pmd, pmd_offset(pud, 0));
33460 @@ -275,7 +303,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
33461 pmd = fill_pmd(pud, vaddr);
33462 pte = fill_pte(pmd, vaddr);
33463
33464 + pax_open_kernel();
33465 set_pte(pte, new_pte);
33466 + pax_close_kernel();
33467
33468 /*
33469 * It's enough to flush this one mapping.
33470 @@ -337,14 +367,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
33471 pgd = pgd_offset_k((unsigned long)__va(phys));
33472 if (pgd_none(*pgd)) {
33473 pud = (pud_t *) spp_getpage();
33474 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
33475 - _PAGE_USER));
33476 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
33477 }
33478 pud = pud_offset(pgd, (unsigned long)__va(phys));
33479 if (pud_none(*pud)) {
33480 pmd = (pmd_t *) spp_getpage();
33481 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
33482 - _PAGE_USER));
33483 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
33484 }
33485 pmd = pmd_offset(pud, phys);
33486 BUG_ON(!pmd_none(*pmd));
33487 @@ -585,7 +613,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
33488 prot);
33489
33490 spin_lock(&init_mm.page_table_lock);
33491 - pud_populate(&init_mm, pud, pmd);
33492 + pud_populate_kernel(&init_mm, pud, pmd);
33493 spin_unlock(&init_mm.page_table_lock);
33494 }
33495 __flush_tlb_all();
33496 @@ -626,7 +654,7 @@ kernel_physical_mapping_init(unsigned long start,
33497 page_size_mask);
33498
33499 spin_lock(&init_mm.page_table_lock);
33500 - pgd_populate(&init_mm, pgd, pud);
33501 + pgd_populate_kernel(&init_mm, pgd, pud);
33502 spin_unlock(&init_mm.page_table_lock);
33503 pgd_changed = true;
33504 }
33505 diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
33506 index 9ca35fc..4b2b7b7 100644
33507 --- a/arch/x86/mm/iomap_32.c
33508 +++ b/arch/x86/mm/iomap_32.c
33509 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
33510 type = kmap_atomic_idx_push();
33511 idx = type + KM_TYPE_NR * smp_processor_id();
33512 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
33513 +
33514 + pax_open_kernel();
33515 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
33516 + pax_close_kernel();
33517 +
33518 arch_flush_lazy_mmu_mode();
33519
33520 return (void *)vaddr;
33521 diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
33522 index 70e7444..75b9a13 100644
33523 --- a/arch/x86/mm/ioremap.c
33524 +++ b/arch/x86/mm/ioremap.c
33525 @@ -56,8 +56,8 @@ static int __ioremap_check_ram(unsigned long start_pfn, unsigned long nr_pages,
33526 unsigned long i;
33527
33528 for (i = 0; i < nr_pages; ++i)
33529 - if (pfn_valid(start_pfn + i) &&
33530 - !PageReserved(pfn_to_page(start_pfn + i)))
33531 + if (pfn_valid(start_pfn + i) && (start_pfn + i >= 0x100 ||
33532 + !PageReserved(pfn_to_page(start_pfn + i))))
33533 return 1;
33534
33535 WARN_ONCE(1, "ioremap on RAM pfn 0x%lx\n", start_pfn);
33536 @@ -288,7 +288,7 @@ EXPORT_SYMBOL(ioremap_prot);
33537 *
33538 * Caller must ensure there is only one unmapping for the same pointer.
33539 */
33540 -void iounmap(volatile void __iomem *addr)
33541 +void iounmap(const volatile void __iomem *addr)
33542 {
33543 struct vm_struct *p, *o;
33544
33545 @@ -351,32 +351,36 @@ int arch_ioremap_pmd_supported(void)
33546 */
33547 void *xlate_dev_mem_ptr(phys_addr_t phys)
33548 {
33549 - unsigned long start = phys & PAGE_MASK;
33550 - unsigned long offset = phys & ~PAGE_MASK;
33551 - unsigned long vaddr;
33552 + phys_addr_t pfn = phys >> PAGE_SHIFT;
33553
33554 - /* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
33555 - if (page_is_ram(start >> PAGE_SHIFT))
33556 - return __va(phys);
33557 + if (page_is_ram(pfn)) {
33558 +#ifdef CONFIG_HIGHMEM
33559 + if (pfn >= max_low_pfn)
33560 + return kmap_high(pfn_to_page(pfn));
33561 + else
33562 +#endif
33563 + return __va(phys);
33564 + }
33565
33566 - vaddr = (unsigned long)ioremap_cache(start, PAGE_SIZE);
33567 - /* Only add the offset on success and return NULL if the ioremap() failed: */
33568 - if (vaddr)
33569 - vaddr += offset;
33570 -
33571 - return (void *)vaddr;
33572 + return (void __force *)ioremap_cache(phys, 1);
33573 }
33574
33575 void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
33576 {
33577 - if (page_is_ram(phys >> PAGE_SHIFT))
33578 + phys_addr_t pfn = phys >> PAGE_SHIFT;
33579 +
33580 + if (page_is_ram(pfn)) {
33581 +#ifdef CONFIG_HIGHMEM
33582 + if (pfn >= max_low_pfn)
33583 + kunmap_high(pfn_to_page(pfn));
33584 +#endif
33585 return;
33586 + }
33587
33588 - iounmap((void __iomem *)((unsigned long)addr & PAGE_MASK));
33589 - return;
33590 + iounmap((void __iomem __force *)addr);
33591 }
33592
33593 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
33594 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
33595
33596 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
33597 {
33598 @@ -412,8 +416,7 @@ void __init early_ioremap_init(void)
33599 early_ioremap_setup();
33600
33601 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
33602 - memset(bm_pte, 0, sizeof(bm_pte));
33603 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
33604 + pmd_populate_user(&init_mm, pmd, bm_pte);
33605
33606 /*
33607 * The boot-ioremap range spans multiple pmds, for which
33608 diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
33609 index b4f2e7e..96c9c3e 100644
33610 --- a/arch/x86/mm/kmemcheck/kmemcheck.c
33611 +++ b/arch/x86/mm/kmemcheck/kmemcheck.c
33612 @@ -628,9 +628,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
33613 * memory (e.g. tracked pages)? For now, we need this to avoid
33614 * invoking kmemcheck for PnP BIOS calls.
33615 */
33616 - if (regs->flags & X86_VM_MASK)
33617 + if (v8086_mode(regs))
33618 return false;
33619 - if (regs->cs != __KERNEL_CS)
33620 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
33621 return false;
33622
33623 pte = kmemcheck_pte_lookup(address);
33624 diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
33625 index 9d518d6..8a091f5 100644
33626 --- a/arch/x86/mm/mmap.c
33627 +++ b/arch/x86/mm/mmap.c
33628 @@ -52,7 +52,7 @@ static unsigned long stack_maxrandom_size(void)
33629 * Leave an at least ~128 MB hole with possible stack randomization.
33630 */
33631 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
33632 -#define MAX_GAP (TASK_SIZE/6*5)
33633 +#define MAX_GAP (pax_task_size/6*5)
33634
33635 static int mmap_is_legacy(void)
33636 {
33637 @@ -81,27 +81,40 @@ unsigned long arch_mmap_rnd(void)
33638 return rnd << PAGE_SHIFT;
33639 }
33640
33641 -static unsigned long mmap_base(unsigned long rnd)
33642 +static unsigned long mmap_base(struct mm_struct *mm, unsigned long rnd)
33643 {
33644 unsigned long gap = rlimit(RLIMIT_STACK);
33645 + unsigned long pax_task_size = TASK_SIZE;
33646 +
33647 +#ifdef CONFIG_PAX_SEGMEXEC
33648 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
33649 + pax_task_size = SEGMEXEC_TASK_SIZE;
33650 +#endif
33651
33652 if (gap < MIN_GAP)
33653 gap = MIN_GAP;
33654 else if (gap > MAX_GAP)
33655 gap = MAX_GAP;
33656
33657 - return PAGE_ALIGN(TASK_SIZE - gap - rnd);
33658 + return PAGE_ALIGN(pax_task_size - gap - rnd);
33659 }
33660
33661 /*
33662 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
33663 * does, but not when emulating X86_32
33664 */
33665 -static unsigned long mmap_legacy_base(unsigned long rnd)
33666 +static unsigned long mmap_legacy_base(struct mm_struct *mm, unsigned long rnd)
33667 {
33668 - if (mmap_is_ia32())
33669 + if (mmap_is_ia32()) {
33670 +
33671 +#ifdef CONFIG_PAX_SEGMEXEC
33672 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
33673 + return SEGMEXEC_TASK_UNMAPPED_BASE;
33674 + else
33675 +#endif
33676 +
33677 return TASK_UNMAPPED_BASE;
33678 - else
33679 + } else
33680 return TASK_UNMAPPED_BASE + rnd;
33681 }
33682
33683 @@ -113,16 +126,27 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
33684 {
33685 unsigned long random_factor = 0UL;
33686
33687 +#ifdef CONFIG_PAX_RANDMMAP
33688 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
33689 +#endif
33690 if (current->flags & PF_RANDOMIZE)
33691 random_factor = arch_mmap_rnd();
33692
33693 - mm->mmap_legacy_base = mmap_legacy_base(random_factor);
33694 + mm->mmap_legacy_base = mmap_legacy_base(mm, random_factor);
33695
33696 if (mmap_is_legacy()) {
33697 mm->mmap_base = mm->mmap_legacy_base;
33698 mm->get_unmapped_area = arch_get_unmapped_area;
33699 } else {
33700 - mm->mmap_base = mmap_base(random_factor);
33701 + mm->mmap_base = mmap_base(mm, random_factor);
33702 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
33703 }
33704 +
33705 +#ifdef CONFIG_PAX_RANDMMAP
33706 + if (mm->pax_flags & MF_PAX_RANDMMAP) {
33707 + mm->mmap_legacy_base += mm->delta_mmap;
33708 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
33709 + }
33710 +#endif
33711 +
33712 }
33713 diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
33714 index 0057a7a..95c7edd 100644
33715 --- a/arch/x86/mm/mmio-mod.c
33716 +++ b/arch/x86/mm/mmio-mod.c
33717 @@ -194,7 +194,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
33718 break;
33719 default:
33720 {
33721 - unsigned char *ip = (unsigned char *)instptr;
33722 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
33723 my_trace->opcode = MMIO_UNKNOWN_OP;
33724 my_trace->width = 0;
33725 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
33726 @@ -234,7 +234,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
33727 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
33728 void __iomem *addr)
33729 {
33730 - static atomic_t next_id;
33731 + static atomic_unchecked_t next_id;
33732 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
33733 /* These are page-unaligned. */
33734 struct mmiotrace_map map = {
33735 @@ -258,7 +258,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
33736 .private = trace
33737 },
33738 .phys = offset,
33739 - .id = atomic_inc_return(&next_id)
33740 + .id = atomic_inc_return_unchecked(&next_id)
33741 };
33742 map.map_id = trace->id;
33743
33744 @@ -290,7 +290,7 @@ void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
33745 ioremap_trace_core(offset, size, addr);
33746 }
33747
33748 -static void iounmap_trace_core(volatile void __iomem *addr)
33749 +static void iounmap_trace_core(const volatile void __iomem *addr)
33750 {
33751 struct mmiotrace_map map = {
33752 .phys = 0,
33753 @@ -328,7 +328,7 @@ not_enabled:
33754 }
33755 }
33756
33757 -void mmiotrace_iounmap(volatile void __iomem *addr)
33758 +void mmiotrace_iounmap(const volatile void __iomem *addr)
33759 {
33760 might_sleep();
33761 if (is_enabled()) /* recheck and proper locking in *_core() */
33762 diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
33763 index 4053bb5..b1ad3dc 100644
33764 --- a/arch/x86/mm/numa.c
33765 +++ b/arch/x86/mm/numa.c
33766 @@ -506,7 +506,7 @@ static void __init numa_clear_kernel_node_hotplug(void)
33767 }
33768 }
33769
33770 -static int __init numa_register_memblks(struct numa_meminfo *mi)
33771 +static int __init __intentional_overflow(-1) numa_register_memblks(struct numa_meminfo *mi)
33772 {
33773 unsigned long uninitialized_var(pfn_align);
33774 int i, nid;
33775 diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
33776 index 89af288..05381957 100644
33777 --- a/arch/x86/mm/pageattr.c
33778 +++ b/arch/x86/mm/pageattr.c
33779 @@ -260,7 +260,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33780 */
33781 #ifdef CONFIG_PCI_BIOS
33782 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
33783 - pgprot_val(forbidden) |= _PAGE_NX;
33784 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
33785 #endif
33786
33787 /*
33788 @@ -268,9 +268,10 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33789 * Does not cover __inittext since that is gone later on. On
33790 * 64bit we do not enforce !NX on the low mapping
33791 */
33792 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
33793 - pgprot_val(forbidden) |= _PAGE_NX;
33794 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
33795 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
33796
33797 +#ifdef CONFIG_DEBUG_RODATA
33798 /*
33799 * The .rodata section needs to be read-only. Using the pfn
33800 * catches all aliases.
33801 @@ -278,6 +279,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33802 if (within(pfn, __pa_symbol(__start_rodata) >> PAGE_SHIFT,
33803 __pa_symbol(__end_rodata) >> PAGE_SHIFT))
33804 pgprot_val(forbidden) |= _PAGE_RW;
33805 +#endif
33806
33807 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
33808 /*
33809 @@ -316,6 +318,13 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33810 }
33811 #endif
33812
33813 +#ifdef CONFIG_PAX_KERNEXEC
33814 + if (within(pfn, __pa(ktla_ktva((unsigned long)&_text)), __pa((unsigned long)&_sdata))) {
33815 + pgprot_val(forbidden) |= _PAGE_RW;
33816 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
33817 + }
33818 +#endif
33819 +
33820 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
33821
33822 return prot;
33823 @@ -438,23 +447,37 @@ EXPORT_SYMBOL_GPL(slow_virt_to_phys);
33824 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
33825 {
33826 /* change init_mm */
33827 + pax_open_kernel();
33828 set_pte_atomic(kpte, pte);
33829 +
33830 #ifdef CONFIG_X86_32
33831 if (!SHARED_KERNEL_PMD) {
33832 +
33833 +#ifdef CONFIG_PAX_PER_CPU_PGD
33834 + unsigned long cpu;
33835 +#else
33836 struct page *page;
33837 +#endif
33838
33839 +#ifdef CONFIG_PAX_PER_CPU_PGD
33840 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
33841 + pgd_t *pgd = get_cpu_pgd(cpu, kernel);
33842 +#else
33843 list_for_each_entry(page, &pgd_list, lru) {
33844 - pgd_t *pgd;
33845 + pgd_t *pgd = (pgd_t *)page_address(page);
33846 +#endif
33847 +
33848 pud_t *pud;
33849 pmd_t *pmd;
33850
33851 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
33852 + pgd += pgd_index(address);
33853 pud = pud_offset(pgd, address);
33854 pmd = pmd_offset(pud, address);
33855 set_pte_atomic((pte_t *)pmd, pte);
33856 }
33857 }
33858 #endif
33859 + pax_close_kernel();
33860 }
33861
33862 static int
33863 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
33864 index 35af677..e7bf11f 100644
33865 --- a/arch/x86/mm/pat.c
33866 +++ b/arch/x86/mm/pat.c
33867 @@ -89,7 +89,7 @@ static inline enum page_cache_mode get_page_memtype(struct page *pg)
33868 unsigned long pg_flags = pg->flags & _PGMT_MASK;
33869
33870 if (pg_flags == _PGMT_DEFAULT)
33871 - return -1;
33872 + return _PAGE_CACHE_MODE_NUM;
33873 else if (pg_flags == _PGMT_WC)
33874 return _PAGE_CACHE_MODE_WC;
33875 else if (pg_flags == _PGMT_UC_MINUS)
33876 @@ -346,7 +346,7 @@ static int reserve_ram_pages_type(u64 start, u64 end,
33877
33878 page = pfn_to_page(pfn);
33879 type = get_page_memtype(page);
33880 - if (type != -1) {
33881 + if (type != _PAGE_CACHE_MODE_NUM) {
33882 pr_info("reserve_ram_pages_type failed [mem %#010Lx-%#010Lx], track 0x%x, req 0x%x\n",
33883 start, end - 1, type, req_type);
33884 if (new_type)
33885 @@ -498,7 +498,7 @@ int free_memtype(u64 start, u64 end)
33886
33887 if (!entry) {
33888 printk(KERN_INFO "%s:%d freeing invalid memtype [mem %#010Lx-%#010Lx]\n",
33889 - current->comm, current->pid, start, end - 1);
33890 + current->comm, task_pid_nr(current), start, end - 1);
33891 return -EINVAL;
33892 }
33893
33894 @@ -532,10 +532,10 @@ static enum page_cache_mode lookup_memtype(u64 paddr)
33895 page = pfn_to_page(paddr >> PAGE_SHIFT);
33896 rettype = get_page_memtype(page);
33897 /*
33898 - * -1 from get_page_memtype() implies RAM page is in its
33899 + * _PAGE_CACHE_MODE_NUM from get_page_memtype() implies RAM page is in its
33900 * default state and not reserved, and hence of type WB
33901 */
33902 - if (rettype == -1)
33903 + if (rettype == _PAGE_CACHE_MODE_NUM)
33904 rettype = _PAGE_CACHE_MODE_WB;
33905
33906 return rettype;
33907 @@ -628,8 +628,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
33908
33909 while (cursor < to) {
33910 if (!devmem_is_allowed(pfn)) {
33911 - printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx], PAT prevents it\n",
33912 - current->comm, from, to - 1);
33913 + printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx] (%#010Lx), PAT prevents it\n",
33914 + current->comm, from, to - 1, cursor);
33915 return 0;
33916 }
33917 cursor += PAGE_SIZE;
33918 @@ -700,7 +700,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size,
33919 if (ioremap_change_attr((unsigned long)__va(base), id_sz, pcm) < 0) {
33920 printk(KERN_INFO "%s:%d ioremap_change_attr failed %s "
33921 "for [mem %#010Lx-%#010Lx]\n",
33922 - current->comm, current->pid,
33923 + current->comm, task_pid_nr(current),
33924 cattr_name(pcm),
33925 base, (unsigned long long)(base + size-1));
33926 return -EINVAL;
33927 @@ -735,7 +735,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
33928 pcm = lookup_memtype(paddr);
33929 if (want_pcm != pcm) {
33930 printk(KERN_WARNING "%s:%d map pfn RAM range req %s for [mem %#010Lx-%#010Lx], got %s\n",
33931 - current->comm, current->pid,
33932 + current->comm, task_pid_nr(current),
33933 cattr_name(want_pcm),
33934 (unsigned long long)paddr,
33935 (unsigned long long)(paddr + size - 1),
33936 @@ -757,7 +757,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
33937 free_memtype(paddr, paddr + size);
33938 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
33939 " for [mem %#010Lx-%#010Lx], got %s\n",
33940 - current->comm, current->pid,
33941 + current->comm, task_pid_nr(current),
33942 cattr_name(want_pcm),
33943 (unsigned long long)paddr,
33944 (unsigned long long)(paddr + size - 1),
33945 diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
33946 index 6582adc..fcc5d0b 100644
33947 --- a/arch/x86/mm/pat_rbtree.c
33948 +++ b/arch/x86/mm/pat_rbtree.c
33949 @@ -161,7 +161,7 @@ success:
33950
33951 failure:
33952 printk(KERN_INFO "%s:%d conflicting memory types "
33953 - "%Lx-%Lx %s<->%s\n", current->comm, current->pid, start,
33954 + "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), start,
33955 end, cattr_name(found_type), cattr_name(match->type));
33956 return -EBUSY;
33957 }
33958 diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
33959 index 9f0614d..92ae64a 100644
33960 --- a/arch/x86/mm/pf_in.c
33961 +++ b/arch/x86/mm/pf_in.c
33962 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
33963 int i;
33964 enum reason_type rv = OTHERS;
33965
33966 - p = (unsigned char *)ins_addr;
33967 + p = (unsigned char *)ktla_ktva(ins_addr);
33968 p += skip_prefix(p, &prf);
33969 p += get_opcode(p, &opcode);
33970
33971 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
33972 struct prefix_bits prf;
33973 int i;
33974
33975 - p = (unsigned char *)ins_addr;
33976 + p = (unsigned char *)ktla_ktva(ins_addr);
33977 p += skip_prefix(p, &prf);
33978 p += get_opcode(p, &opcode);
33979
33980 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
33981 struct prefix_bits prf;
33982 int i;
33983
33984 - p = (unsigned char *)ins_addr;
33985 + p = (unsigned char *)ktla_ktva(ins_addr);
33986 p += skip_prefix(p, &prf);
33987 p += get_opcode(p, &opcode);
33988
33989 @@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
33990 struct prefix_bits prf;
33991 int i;
33992
33993 - p = (unsigned char *)ins_addr;
33994 + p = (unsigned char *)ktla_ktva(ins_addr);
33995 p += skip_prefix(p, &prf);
33996 p += get_opcode(p, &opcode);
33997 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
33998 @@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
33999 struct prefix_bits prf;
34000 int i;
34001
34002 - p = (unsigned char *)ins_addr;
34003 + p = (unsigned char *)ktla_ktva(ins_addr);
34004 p += skip_prefix(p, &prf);
34005 p += get_opcode(p, &opcode);
34006 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
34007 diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
34008 index 0b97d2c..597bb38 100644
34009 --- a/arch/x86/mm/pgtable.c
34010 +++ b/arch/x86/mm/pgtable.c
34011 @@ -98,10 +98,75 @@ static inline void pgd_list_del(pgd_t *pgd)
34012 list_del(&page->lru);
34013 }
34014
34015 -#define UNSHARED_PTRS_PER_PGD \
34016 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
34017 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
34018 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
34019
34020 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src)
34021 +{
34022 + unsigned int count = USER_PGD_PTRS;
34023
34024 + if (!pax_user_shadow_base)
34025 + return;
34026 +
34027 + while (count--)
34028 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
34029 +}
34030 +#endif
34031 +
34032 +#ifdef CONFIG_PAX_PER_CPU_PGD
34033 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src)
34034 +{
34035 + unsigned int count = USER_PGD_PTRS;
34036 +
34037 + while (count--) {
34038 + pgd_t pgd;
34039 +
34040 +#ifdef CONFIG_X86_64
34041 + pgd = __pgd(pgd_val(*src++) | _PAGE_USER);
34042 +#else
34043 + pgd = *src++;
34044 +#endif
34045 +
34046 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
34047 + pgd = __pgd(pgd_val(pgd) & clone_pgd_mask);
34048 +#endif
34049 +
34050 + *dst++ = pgd;
34051 + }
34052 +
34053 +}
34054 +#endif
34055 +
34056 +#ifdef CONFIG_X86_64
34057 +#define pxd_t pud_t
34058 +#define pyd_t pgd_t
34059 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
34060 +#define pgtable_pxd_page_ctor(page) true
34061 +#define pgtable_pxd_page_dtor(page) do {} while (0)
34062 +#define pxd_free(mm, pud) pud_free((mm), (pud))
34063 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
34064 +#define pyd_offset(mm, address) pgd_offset((mm), (address))
34065 +#define PYD_SIZE PGDIR_SIZE
34066 +#define mm_inc_nr_pxds(mm) do {} while (0)
34067 +#define mm_dec_nr_pxds(mm) do {} while (0)
34068 +#else
34069 +#define pxd_t pmd_t
34070 +#define pyd_t pud_t
34071 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
34072 +#define pgtable_pxd_page_ctor(page) pgtable_pmd_page_ctor(page)
34073 +#define pgtable_pxd_page_dtor(page) pgtable_pmd_page_dtor(page)
34074 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
34075 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
34076 +#define pyd_offset(mm, address) pud_offset((mm), (address))
34077 +#define PYD_SIZE PUD_SIZE
34078 +#define mm_inc_nr_pxds(mm) mm_inc_nr_pmds(mm)
34079 +#define mm_dec_nr_pxds(mm) mm_dec_nr_pmds(mm)
34080 +#endif
34081 +
34082 +#ifdef CONFIG_PAX_PER_CPU_PGD
34083 +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
34084 +static inline void pgd_dtor(pgd_t *pgd) {}
34085 +#else
34086 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
34087 {
34088 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
34089 @@ -142,6 +207,7 @@ static void pgd_dtor(pgd_t *pgd)
34090 pgd_list_del(pgd);
34091 spin_unlock(&pgd_lock);
34092 }
34093 +#endif
34094
34095 /*
34096 * List of all pgd's needed for non-PAE so it can invalidate entries
34097 @@ -154,7 +220,7 @@ static void pgd_dtor(pgd_t *pgd)
34098 * -- nyc
34099 */
34100
34101 -#ifdef CONFIG_X86_PAE
34102 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
34103 /*
34104 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
34105 * updating the top-level pagetable entries to guarantee the
34106 @@ -166,7 +232,7 @@ static void pgd_dtor(pgd_t *pgd)
34107 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
34108 * and initialize the kernel pmds here.
34109 */
34110 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
34111 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
34112
34113 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
34114 {
34115 @@ -184,46 +250,48 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
34116 */
34117 flush_tlb_mm(mm);
34118 }
34119 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
34120 +#define PREALLOCATED_PXDS USER_PGD_PTRS
34121 #else /* !CONFIG_X86_PAE */
34122
34123 /* No need to prepopulate any pagetable entries in non-PAE modes. */
34124 -#define PREALLOCATED_PMDS 0
34125 +#define PREALLOCATED_PXDS 0
34126
34127 #endif /* CONFIG_X86_PAE */
34128
34129 -static void free_pmds(struct mm_struct *mm, pmd_t *pmds[])
34130 +static void free_pxds(struct mm_struct *mm, pxd_t *pxds[])
34131 {
34132 int i;
34133
34134 - for(i = 0; i < PREALLOCATED_PMDS; i++)
34135 - if (pmds[i]) {
34136 - pgtable_pmd_page_dtor(virt_to_page(pmds[i]));
34137 - free_page((unsigned long)pmds[i]);
34138 - mm_dec_nr_pmds(mm);
34139 + for(i = 0; i < PREALLOCATED_PXDS; i++)
34140 + if (pxds[i]) {
34141 + pgtable_pxd_page_dtor(virt_to_page(pxds[i]));
34142 + free_page((unsigned long)pxds[i]);
34143 + mm_dec_nr_pxds(mm);
34144 }
34145 }
34146
34147 -static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[])
34148 +static int preallocate_pxds(struct mm_struct *mm, pxd_t *pxds[])
34149 {
34150 int i;
34151 bool failed = false;
34152
34153 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
34154 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
34155 - if (!pmd)
34156 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
34157 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
34158 + if (!pxd)
34159 failed = true;
34160 - if (pmd && !pgtable_pmd_page_ctor(virt_to_page(pmd))) {
34161 - free_page((unsigned long)pmd);
34162 - pmd = NULL;
34163 + if (pxd && !pgtable_pxd_page_ctor(virt_to_page(pxd))) {
34164 + free_page((unsigned long)pxd);
34165 + pxd = NULL;
34166 failed = true;
34167 }
34168 - if (pmd)
34169 - mm_inc_nr_pmds(mm);
34170 - pmds[i] = pmd;
34171 + if (pxd)
34172 + mm_inc_nr_pxds(mm);
34173 + pxds[i] = pxd;
34174 }
34175
34176 if (failed) {
34177 - free_pmds(mm, pmds);
34178 + free_pxds(mm, pxds);
34179 return -ENOMEM;
34180 }
34181
34182 @@ -236,43 +304,47 @@ static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[])
34183 * preallocate which never got a corresponding vma will need to be
34184 * freed manually.
34185 */
34186 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
34187 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
34188 {
34189 int i;
34190
34191 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
34192 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
34193 pgd_t pgd = pgdp[i];
34194
34195 if (pgd_val(pgd) != 0) {
34196 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
34197 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
34198
34199 - pgdp[i] = native_make_pgd(0);
34200 + set_pgd(pgdp + i, native_make_pgd(0));
34201
34202 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
34203 - pmd_free(mm, pmd);
34204 - mm_dec_nr_pmds(mm);
34205 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
34206 + pxd_free(mm, pxd);
34207 + mm_dec_nr_pxds(mm);
34208 }
34209 }
34210 }
34211
34212 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
34213 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
34214 {
34215 - pud_t *pud;
34216 + pyd_t *pyd;
34217 int i;
34218
34219 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
34220 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
34221 return;
34222
34223 - pud = pud_offset(pgd, 0);
34224 +#ifdef CONFIG_X86_64
34225 + pyd = pyd_offset(mm, 0L);
34226 +#else
34227 + pyd = pyd_offset(pgd, 0L);
34228 +#endif
34229
34230 - for (i = 0; i < PREALLOCATED_PMDS; i++, pud++) {
34231 - pmd_t *pmd = pmds[i];
34232 + for (i = 0; i < PREALLOCATED_PXDS; i++, pyd++) {
34233 + pxd_t *pxd = pxds[i];
34234
34235 if (i >= KERNEL_PGD_BOUNDARY)
34236 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
34237 - sizeof(pmd_t) * PTRS_PER_PMD);
34238 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
34239 + sizeof(pxd_t) * PTRS_PER_PMD);
34240
34241 - pud_populate(mm, pud, pmd);
34242 + pyd_populate(mm, pyd, pxd);
34243 }
34244 }
34245
34246 @@ -354,7 +426,7 @@ static inline void _pgd_free(pgd_t *pgd)
34247 pgd_t *pgd_alloc(struct mm_struct *mm)
34248 {
34249 pgd_t *pgd;
34250 - pmd_t *pmds[PREALLOCATED_PMDS];
34251 + pxd_t *pxds[PREALLOCATED_PXDS];
34252
34253 pgd = _pgd_alloc();
34254
34255 @@ -363,11 +435,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
34256
34257 mm->pgd = pgd;
34258
34259 - if (preallocate_pmds(mm, pmds) != 0)
34260 + if (preallocate_pxds(mm, pxds) != 0)
34261 goto out_free_pgd;
34262
34263 if (paravirt_pgd_alloc(mm) != 0)
34264 - goto out_free_pmds;
34265 + goto out_free_pxds;
34266
34267 /*
34268 * Make sure that pre-populating the pmds is atomic with
34269 @@ -377,14 +449,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
34270 spin_lock(&pgd_lock);
34271
34272 pgd_ctor(mm, pgd);
34273 - pgd_prepopulate_pmd(mm, pgd, pmds);
34274 + pgd_prepopulate_pxd(mm, pgd, pxds);
34275
34276 spin_unlock(&pgd_lock);
34277
34278 return pgd;
34279
34280 -out_free_pmds:
34281 - free_pmds(mm, pmds);
34282 +out_free_pxds:
34283 + free_pxds(mm, pxds);
34284 out_free_pgd:
34285 _pgd_free(pgd);
34286 out:
34287 @@ -393,7 +465,7 @@ out:
34288
34289 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
34290 {
34291 - pgd_mop_up_pmds(mm, pgd);
34292 + pgd_mop_up_pxds(mm, pgd);
34293 pgd_dtor(pgd);
34294 paravirt_pgd_free(mm, pgd);
34295 _pgd_free(pgd);
34296 diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
34297 index 75cc097..79a097f 100644
34298 --- a/arch/x86/mm/pgtable_32.c
34299 +++ b/arch/x86/mm/pgtable_32.c
34300 @@ -47,10 +47,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
34301 return;
34302 }
34303 pte = pte_offset_kernel(pmd, vaddr);
34304 +
34305 + pax_open_kernel();
34306 if (pte_val(pteval))
34307 set_pte_at(&init_mm, vaddr, pte, pteval);
34308 else
34309 pte_clear(&init_mm, vaddr, pte);
34310 + pax_close_kernel();
34311
34312 /*
34313 * It's enough to flush this one mapping.
34314 diff --git a/arch/x86/mm/physaddr.c b/arch/x86/mm/physaddr.c
34315 index e666cbb..61788c45 100644
34316 --- a/arch/x86/mm/physaddr.c
34317 +++ b/arch/x86/mm/physaddr.c
34318 @@ -10,7 +10,7 @@
34319 #ifdef CONFIG_X86_64
34320
34321 #ifdef CONFIG_DEBUG_VIRTUAL
34322 -unsigned long __phys_addr(unsigned long x)
34323 +unsigned long __intentional_overflow(-1) __phys_addr(unsigned long x)
34324 {
34325 unsigned long y = x - __START_KERNEL_map;
34326
34327 @@ -67,7 +67,7 @@ EXPORT_SYMBOL(__virt_addr_valid);
34328 #else
34329
34330 #ifdef CONFIG_DEBUG_VIRTUAL
34331 -unsigned long __phys_addr(unsigned long x)
34332 +unsigned long __intentional_overflow(-1) __phys_addr(unsigned long x)
34333 {
34334 unsigned long phys_addr = x - PAGE_OFFSET;
34335 /* VMALLOC_* aren't constants */
34336 diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
34337 index 90555bf..f5f1828 100644
34338 --- a/arch/x86/mm/setup_nx.c
34339 +++ b/arch/x86/mm/setup_nx.c
34340 @@ -5,8 +5,10 @@
34341 #include <asm/pgtable.h>
34342 #include <asm/proto.h>
34343
34344 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
34345 static int disable_nx;
34346
34347 +#ifndef CONFIG_PAX_PAGEEXEC
34348 /*
34349 * noexec = on|off
34350 *
34351 @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str)
34352 return 0;
34353 }
34354 early_param("noexec", noexec_setup);
34355 +#endif
34356 +
34357 +#endif
34358
34359 void x86_configure_nx(void)
34360 {
34361 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
34362 if (cpu_has_nx && !disable_nx)
34363 __supported_pte_mask |= _PAGE_NX;
34364 else
34365 +#endif
34366 __supported_pte_mask &= ~_PAGE_NX;
34367 }
34368
34369 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
34370 index 3250f23..7a97ba2 100644
34371 --- a/arch/x86/mm/tlb.c
34372 +++ b/arch/x86/mm/tlb.c
34373 @@ -45,7 +45,11 @@ void leave_mm(int cpu)
34374 BUG();
34375 if (cpumask_test_cpu(cpu, mm_cpumask(active_mm))) {
34376 cpumask_clear_cpu(cpu, mm_cpumask(active_mm));
34377 +
34378 +#ifndef CONFIG_PAX_PER_CPU_PGD
34379 load_cr3(swapper_pg_dir);
34380 +#endif
34381 +
34382 /*
34383 * This gets called in the idle path where RCU
34384 * functions differently. Tracing normally
34385 diff --git a/arch/x86/mm/uderef_64.c b/arch/x86/mm/uderef_64.c
34386 new file mode 100644
34387 index 0000000..3fda3f3
34388 --- /dev/null
34389 +++ b/arch/x86/mm/uderef_64.c
34390 @@ -0,0 +1,37 @@
34391 +#include <linux/mm.h>
34392 +#include <asm/pgtable.h>
34393 +#include <asm/uaccess.h>
34394 +
34395 +#ifdef CONFIG_PAX_MEMORY_UDEREF
34396 +/* PaX: due to the special call convention these functions must
34397 + * - remain leaf functions under all configurations,
34398 + * - never be called directly, only dereferenced from the wrappers.
34399 + */
34400 +void __used __pax_open_userland(void)
34401 +{
34402 + unsigned int cpu;
34403 +
34404 + if (unlikely(!segment_eq(get_fs(), USER_DS)))
34405 + return;
34406 +
34407 + cpu = raw_get_cpu();
34408 + BUG_ON((read_cr3() & ~PAGE_MASK) != PCID_KERNEL);
34409 + write_cr3(__pa_nodebug(get_cpu_pgd(cpu, user)) | PCID_USER | PCID_NOFLUSH);
34410 + raw_put_cpu_no_resched();
34411 +}
34412 +EXPORT_SYMBOL(__pax_open_userland);
34413 +
34414 +void __used __pax_close_userland(void)
34415 +{
34416 + unsigned int cpu;
34417 +
34418 + if (unlikely(!segment_eq(get_fs(), USER_DS)))
34419 + return;
34420 +
34421 + cpu = raw_get_cpu();
34422 + BUG_ON((read_cr3() & ~PAGE_MASK) != PCID_USER);
34423 + write_cr3(__pa_nodebug(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
34424 + raw_put_cpu_no_resched();
34425 +}
34426 +EXPORT_SYMBOL(__pax_close_userland);
34427 +#endif
34428 diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
34429 index 6440221..f84b5c7 100644
34430 --- a/arch/x86/net/bpf_jit.S
34431 +++ b/arch/x86/net/bpf_jit.S
34432 @@ -9,6 +9,7 @@
34433 */
34434 #include <linux/linkage.h>
34435 #include <asm/dwarf2.h>
34436 +#include <asm/alternative-asm.h>
34437
34438 /*
34439 * Calling convention :
34440 @@ -38,6 +39,7 @@ sk_load_word_positive_offset:
34441 jle bpf_slow_path_word
34442 mov (SKBDATA,%rsi),%eax
34443 bswap %eax /* ntohl() */
34444 + pax_force_retaddr
34445 ret
34446
34447 sk_load_half:
34448 @@ -55,6 +57,7 @@ sk_load_half_positive_offset:
34449 jle bpf_slow_path_half
34450 movzwl (SKBDATA,%rsi),%eax
34451 rol $8,%ax # ntohs()
34452 + pax_force_retaddr
34453 ret
34454
34455 sk_load_byte:
34456 @@ -69,6 +72,7 @@ sk_load_byte_positive_offset:
34457 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
34458 jle bpf_slow_path_byte
34459 movzbl (SKBDATA,%rsi),%eax
34460 + pax_force_retaddr
34461 ret
34462
34463 /* rsi contains offset and can be scratched */
34464 @@ -90,6 +94,7 @@ bpf_slow_path_word:
34465 js bpf_error
34466 mov - MAX_BPF_STACK + 32(%rbp),%eax
34467 bswap %eax
34468 + pax_force_retaddr
34469 ret
34470
34471 bpf_slow_path_half:
34472 @@ -98,12 +103,14 @@ bpf_slow_path_half:
34473 mov - MAX_BPF_STACK + 32(%rbp),%ax
34474 rol $8,%ax
34475 movzwl %ax,%eax
34476 + pax_force_retaddr
34477 ret
34478
34479 bpf_slow_path_byte:
34480 bpf_slow_path_common(1)
34481 js bpf_error
34482 movzbl - MAX_BPF_STACK + 32(%rbp),%eax
34483 + pax_force_retaddr
34484 ret
34485
34486 #define sk_negative_common(SIZE) \
34487 @@ -126,6 +133,7 @@ sk_load_word_negative_offset:
34488 sk_negative_common(4)
34489 mov (%rax), %eax
34490 bswap %eax
34491 + pax_force_retaddr
34492 ret
34493
34494 bpf_slow_path_half_neg:
34495 @@ -137,6 +145,7 @@ sk_load_half_negative_offset:
34496 mov (%rax),%ax
34497 rol $8,%ax
34498 movzwl %ax,%eax
34499 + pax_force_retaddr
34500 ret
34501
34502 bpf_slow_path_byte_neg:
34503 @@ -146,6 +155,7 @@ sk_load_byte_negative_offset:
34504 .globl sk_load_byte_negative_offset
34505 sk_negative_common(1)
34506 movzbl (%rax), %eax
34507 + pax_force_retaddr
34508 ret
34509
34510 bpf_error:
34511 @@ -156,4 +166,5 @@ bpf_error:
34512 mov - MAX_BPF_STACK + 16(%rbp),%r14
34513 mov - MAX_BPF_STACK + 24(%rbp),%r15
34514 leaveq
34515 + pax_force_retaddr
34516 ret
34517 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
34518 index ddeff48..877ead6 100644
34519 --- a/arch/x86/net/bpf_jit_comp.c
34520 +++ b/arch/x86/net/bpf_jit_comp.c
34521 @@ -13,7 +13,11 @@
34522 #include <linux/if_vlan.h>
34523 #include <asm/cacheflush.h>
34524
34525 +#ifdef CONFIG_GRKERNSEC_BPF_HARDEN
34526 +int bpf_jit_enable __read_only;
34527 +#else
34528 int bpf_jit_enable __read_mostly;
34529 +#endif
34530
34531 /*
34532 * assembly code in arch/x86/net/bpf_jit.S
34533 @@ -174,7 +178,9 @@ static u8 add_2reg(u8 byte, u32 dst_reg, u32 src_reg)
34534 static void jit_fill_hole(void *area, unsigned int size)
34535 {
34536 /* fill whole space with int3 instructions */
34537 + pax_open_kernel();
34538 memset(area, 0xcc, size);
34539 + pax_close_kernel();
34540 }
34541
34542 struct jit_context {
34543 @@ -924,7 +930,9 @@ common_load:
34544 pr_err("bpf_jit_compile fatal error\n");
34545 return -EFAULT;
34546 }
34547 + pax_open_kernel();
34548 memcpy(image + proglen, temp, ilen);
34549 + pax_close_kernel();
34550 }
34551 proglen += ilen;
34552 addrs[i] = proglen;
34553 @@ -1001,7 +1009,6 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
34554
34555 if (image) {
34556 bpf_flush_icache(header, image + proglen);
34557 - set_memory_ro((unsigned long)header, header->pages);
34558 prog->bpf_func = (void *)image;
34559 prog->jited = true;
34560 }
34561 @@ -1014,12 +1021,8 @@ void bpf_jit_free(struct bpf_prog *fp)
34562 unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
34563 struct bpf_binary_header *header = (void *)addr;
34564
34565 - if (!fp->jited)
34566 - goto free_filter;
34567 + if (fp->jited)
34568 + bpf_jit_binary_free(header);
34569
34570 - set_memory_rw(addr, header->pages);
34571 - bpf_jit_binary_free(header);
34572 -
34573 -free_filter:
34574 bpf_prog_unlock_free(fp);
34575 }
34576 diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
34577 index 4e664bd..2beeaa2 100644
34578 --- a/arch/x86/oprofile/backtrace.c
34579 +++ b/arch/x86/oprofile/backtrace.c
34580 @@ -46,11 +46,11 @@ dump_user_backtrace_32(struct stack_frame_ia32 *head)
34581 struct stack_frame_ia32 *fp;
34582 unsigned long bytes;
34583
34584 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
34585 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
34586 if (bytes != 0)
34587 return NULL;
34588
34589 - fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
34590 + fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
34591
34592 oprofile_add_trace(bufhead[0].return_address);
34593
34594 @@ -92,7 +92,7 @@ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
34595 struct stack_frame bufhead[2];
34596 unsigned long bytes;
34597
34598 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
34599 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
34600 if (bytes != 0)
34601 return NULL;
34602
34603 diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
34604 index 1d2e639..f6ef82a 100644
34605 --- a/arch/x86/oprofile/nmi_int.c
34606 +++ b/arch/x86/oprofile/nmi_int.c
34607 @@ -23,6 +23,7 @@
34608 #include <asm/nmi.h>
34609 #include <asm/msr.h>
34610 #include <asm/apic.h>
34611 +#include <asm/pgtable.h>
34612
34613 #include "op_counter.h"
34614 #include "op_x86_model.h"
34615 @@ -785,8 +786,11 @@ int __init op_nmi_init(struct oprofile_operations *ops)
34616 if (ret)
34617 return ret;
34618
34619 - if (!model->num_virt_counters)
34620 - model->num_virt_counters = model->num_counters;
34621 + if (!model->num_virt_counters) {
34622 + pax_open_kernel();
34623 + *(unsigned int *)&model->num_virt_counters = model->num_counters;
34624 + pax_close_kernel();
34625 + }
34626
34627 mux_init(ops);
34628
34629 diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c
34630 index 50d86c0..7985318 100644
34631 --- a/arch/x86/oprofile/op_model_amd.c
34632 +++ b/arch/x86/oprofile/op_model_amd.c
34633 @@ -519,9 +519,11 @@ static int op_amd_init(struct oprofile_operations *ops)
34634 num_counters = AMD64_NUM_COUNTERS;
34635 }
34636
34637 - op_amd_spec.num_counters = num_counters;
34638 - op_amd_spec.num_controls = num_counters;
34639 - op_amd_spec.num_virt_counters = max(num_counters, NUM_VIRT_COUNTERS);
34640 + pax_open_kernel();
34641 + *(unsigned int *)&op_amd_spec.num_counters = num_counters;
34642 + *(unsigned int *)&op_amd_spec.num_controls = num_counters;
34643 + *(unsigned int *)&op_amd_spec.num_virt_counters = max(num_counters, NUM_VIRT_COUNTERS);
34644 + pax_close_kernel();
34645
34646 return 0;
34647 }
34648 diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c
34649 index d90528e..0127e2b 100644
34650 --- a/arch/x86/oprofile/op_model_ppro.c
34651 +++ b/arch/x86/oprofile/op_model_ppro.c
34652 @@ -19,6 +19,7 @@
34653 #include <asm/msr.h>
34654 #include <asm/apic.h>
34655 #include <asm/nmi.h>
34656 +#include <asm/pgtable.h>
34657
34658 #include "op_x86_model.h"
34659 #include "op_counter.h"
34660 @@ -221,8 +222,10 @@ static void arch_perfmon_setup_counters(void)
34661
34662 num_counters = min((int)eax.split.num_counters, OP_MAX_COUNTER);
34663
34664 - op_arch_perfmon_spec.num_counters = num_counters;
34665 - op_arch_perfmon_spec.num_controls = num_counters;
34666 + pax_open_kernel();
34667 + *(unsigned int *)&op_arch_perfmon_spec.num_counters = num_counters;
34668 + *(unsigned int *)&op_arch_perfmon_spec.num_controls = num_counters;
34669 + pax_close_kernel();
34670 }
34671
34672 static int arch_perfmon_init(struct oprofile_operations *ignore)
34673 diff --git a/arch/x86/oprofile/op_x86_model.h b/arch/x86/oprofile/op_x86_model.h
34674 index 71e8a67..6a313bb 100644
34675 --- a/arch/x86/oprofile/op_x86_model.h
34676 +++ b/arch/x86/oprofile/op_x86_model.h
34677 @@ -52,7 +52,7 @@ struct op_x86_model_spec {
34678 void (*switch_ctrl)(struct op_x86_model_spec const *model,
34679 struct op_msrs const * const msrs);
34680 #endif
34681 -};
34682 +} __do_const;
34683
34684 struct op_counter_config;
34685
34686 diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
34687 index 852aa4c..71613f2 100644
34688 --- a/arch/x86/pci/intel_mid_pci.c
34689 +++ b/arch/x86/pci/intel_mid_pci.c
34690 @@ -258,7 +258,7 @@ int __init intel_mid_pci_init(void)
34691 pci_mmcfg_late_init();
34692 pcibios_enable_irq = intel_mid_pci_irq_enable;
34693 pcibios_disable_irq = intel_mid_pci_irq_disable;
34694 - pci_root_ops = intel_mid_pci_ops;
34695 + memcpy((void *)&pci_root_ops, &intel_mid_pci_ops, sizeof pci_root_ops);
34696 pci_soc_mode = 1;
34697 /* Continue with standard init */
34698 return 1;
34699 diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
34700 index 5dc6ca5..25c03f5 100644
34701 --- a/arch/x86/pci/irq.c
34702 +++ b/arch/x86/pci/irq.c
34703 @@ -51,7 +51,7 @@ struct irq_router {
34704 struct irq_router_handler {
34705 u16 vendor;
34706 int (*probe)(struct irq_router *r, struct pci_dev *router, u16 device);
34707 -};
34708 +} __do_const;
34709
34710 int (*pcibios_enable_irq)(struct pci_dev *dev) = pirq_enable_irq;
34711 void (*pcibios_disable_irq)(struct pci_dev *dev) = pirq_disable_irq;
34712 @@ -791,7 +791,7 @@ static __init int pico_router_probe(struct irq_router *r, struct pci_dev *router
34713 return 0;
34714 }
34715
34716 -static __initdata struct irq_router_handler pirq_routers[] = {
34717 +static __initconst const struct irq_router_handler pirq_routers[] = {
34718 { PCI_VENDOR_ID_INTEL, intel_router_probe },
34719 { PCI_VENDOR_ID_AL, ali_router_probe },
34720 { PCI_VENDOR_ID_ITE, ite_router_probe },
34721 @@ -818,7 +818,7 @@ static struct pci_dev *pirq_router_dev;
34722 static void __init pirq_find_router(struct irq_router *r)
34723 {
34724 struct irq_routing_table *rt = pirq_table;
34725 - struct irq_router_handler *h;
34726 + const struct irq_router_handler *h;
34727
34728 #ifdef CONFIG_PCI_BIOS
34729 if (!rt->signature) {
34730 @@ -1091,7 +1091,7 @@ static int __init fix_acer_tm360_irqrouting(const struct dmi_system_id *d)
34731 return 0;
34732 }
34733
34734 -static struct dmi_system_id __initdata pciirq_dmi_table[] = {
34735 +static const struct dmi_system_id __initconst pciirq_dmi_table[] = {
34736 {
34737 .callback = fix_broken_hp_bios_irq9,
34738 .ident = "HP Pavilion N5400 Series Laptop",
34739 diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
34740 index 9b83b90..4112152 100644
34741 --- a/arch/x86/pci/pcbios.c
34742 +++ b/arch/x86/pci/pcbios.c
34743 @@ -79,7 +79,7 @@ union bios32 {
34744 static struct {
34745 unsigned long address;
34746 unsigned short segment;
34747 -} bios32_indirect __initdata = { 0, __KERNEL_CS };
34748 +} bios32_indirect __initconst = { 0, __PCIBIOS_CS };
34749
34750 /*
34751 * Returns the entry point for the given service, NULL on error
34752 @@ -92,37 +92,80 @@ static unsigned long __init bios32_service(unsigned long service)
34753 unsigned long length; /* %ecx */
34754 unsigned long entry; /* %edx */
34755 unsigned long flags;
34756 + struct desc_struct d, *gdt;
34757
34758 local_irq_save(flags);
34759 - __asm__("lcall *(%%edi); cld"
34760 +
34761 + gdt = get_cpu_gdt_table(smp_processor_id());
34762 +
34763 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
34764 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
34765 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
34766 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
34767 +
34768 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
34769 : "=a" (return_code),
34770 "=b" (address),
34771 "=c" (length),
34772 "=d" (entry)
34773 : "0" (service),
34774 "1" (0),
34775 - "D" (&bios32_indirect));
34776 + "D" (&bios32_indirect),
34777 + "r"(__PCIBIOS_DS)
34778 + : "memory");
34779 +
34780 + pax_open_kernel();
34781 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
34782 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
34783 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
34784 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
34785 + pax_close_kernel();
34786 +
34787 local_irq_restore(flags);
34788
34789 switch (return_code) {
34790 - case 0:
34791 - return address + entry;
34792 - case 0x80: /* Not present */
34793 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
34794 - return 0;
34795 - default: /* Shouldn't happen */
34796 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
34797 - service, return_code);
34798 + case 0: {
34799 + int cpu;
34800 + unsigned char flags;
34801 +
34802 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
34803 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
34804 + printk(KERN_WARNING "bios32_service: not valid\n");
34805 return 0;
34806 + }
34807 + address = address + PAGE_OFFSET;
34808 + length += 16UL; /* some BIOSs underreport this... */
34809 + flags = 4;
34810 + if (length >= 64*1024*1024) {
34811 + length >>= PAGE_SHIFT;
34812 + flags |= 8;
34813 + }
34814 +
34815 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
34816 + gdt = get_cpu_gdt_table(cpu);
34817 + pack_descriptor(&d, address, length, 0x9b, flags);
34818 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
34819 + pack_descriptor(&d, address, length, 0x93, flags);
34820 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
34821 + }
34822 + return entry;
34823 + }
34824 + case 0x80: /* Not present */
34825 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
34826 + return 0;
34827 + default: /* Shouldn't happen */
34828 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
34829 + service, return_code);
34830 + return 0;
34831 }
34832 }
34833
34834 static struct {
34835 unsigned long address;
34836 unsigned short segment;
34837 -} pci_indirect = { 0, __KERNEL_CS };
34838 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
34839
34840 -static int pci_bios_present;
34841 +static int pci_bios_present __read_only;
34842
34843 static int __init check_pcibios(void)
34844 {
34845 @@ -131,11 +174,13 @@ static int __init check_pcibios(void)
34846 unsigned long flags, pcibios_entry;
34847
34848 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
34849 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
34850 + pci_indirect.address = pcibios_entry;
34851
34852 local_irq_save(flags);
34853 - __asm__(
34854 - "lcall *(%%edi); cld\n\t"
34855 + __asm__("movw %w6, %%ds\n\t"
34856 + "lcall *%%ss:(%%edi); cld\n\t"
34857 + "push %%ss\n\t"
34858 + "pop %%ds\n\t"
34859 "jc 1f\n\t"
34860 "xor %%ah, %%ah\n"
34861 "1:"
34862 @@ -144,7 +189,8 @@ static int __init check_pcibios(void)
34863 "=b" (ebx),
34864 "=c" (ecx)
34865 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
34866 - "D" (&pci_indirect)
34867 + "D" (&pci_indirect),
34868 + "r" (__PCIBIOS_DS)
34869 : "memory");
34870 local_irq_restore(flags);
34871
34872 @@ -189,7 +235,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34873
34874 switch (len) {
34875 case 1:
34876 - __asm__("lcall *(%%esi); cld\n\t"
34877 + __asm__("movw %w6, %%ds\n\t"
34878 + "lcall *%%ss:(%%esi); cld\n\t"
34879 + "push %%ss\n\t"
34880 + "pop %%ds\n\t"
34881 "jc 1f\n\t"
34882 "xor %%ah, %%ah\n"
34883 "1:"
34884 @@ -198,7 +247,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34885 : "1" (PCIBIOS_READ_CONFIG_BYTE),
34886 "b" (bx),
34887 "D" ((long)reg),
34888 - "S" (&pci_indirect));
34889 + "S" (&pci_indirect),
34890 + "r" (__PCIBIOS_DS));
34891 /*
34892 * Zero-extend the result beyond 8 bits, do not trust the
34893 * BIOS having done it:
34894 @@ -206,7 +256,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34895 *value &= 0xff;
34896 break;
34897 case 2:
34898 - __asm__("lcall *(%%esi); cld\n\t"
34899 + __asm__("movw %w6, %%ds\n\t"
34900 + "lcall *%%ss:(%%esi); cld\n\t"
34901 + "push %%ss\n\t"
34902 + "pop %%ds\n\t"
34903 "jc 1f\n\t"
34904 "xor %%ah, %%ah\n"
34905 "1:"
34906 @@ -215,7 +268,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34907 : "1" (PCIBIOS_READ_CONFIG_WORD),
34908 "b" (bx),
34909 "D" ((long)reg),
34910 - "S" (&pci_indirect));
34911 + "S" (&pci_indirect),
34912 + "r" (__PCIBIOS_DS));
34913 /*
34914 * Zero-extend the result beyond 16 bits, do not trust the
34915 * BIOS having done it:
34916 @@ -223,7 +277,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34917 *value &= 0xffff;
34918 break;
34919 case 4:
34920 - __asm__("lcall *(%%esi); cld\n\t"
34921 + __asm__("movw %w6, %%ds\n\t"
34922 + "lcall *%%ss:(%%esi); cld\n\t"
34923 + "push %%ss\n\t"
34924 + "pop %%ds\n\t"
34925 "jc 1f\n\t"
34926 "xor %%ah, %%ah\n"
34927 "1:"
34928 @@ -232,7 +289,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34929 : "1" (PCIBIOS_READ_CONFIG_DWORD),
34930 "b" (bx),
34931 "D" ((long)reg),
34932 - "S" (&pci_indirect));
34933 + "S" (&pci_indirect),
34934 + "r" (__PCIBIOS_DS));
34935 break;
34936 }
34937
34938 @@ -256,7 +314,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34939
34940 switch (len) {
34941 case 1:
34942 - __asm__("lcall *(%%esi); cld\n\t"
34943 + __asm__("movw %w6, %%ds\n\t"
34944 + "lcall *%%ss:(%%esi); cld\n\t"
34945 + "push %%ss\n\t"
34946 + "pop %%ds\n\t"
34947 "jc 1f\n\t"
34948 "xor %%ah, %%ah\n"
34949 "1:"
34950 @@ -265,10 +326,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34951 "c" (value),
34952 "b" (bx),
34953 "D" ((long)reg),
34954 - "S" (&pci_indirect));
34955 + "S" (&pci_indirect),
34956 + "r" (__PCIBIOS_DS));
34957 break;
34958 case 2:
34959 - __asm__("lcall *(%%esi); cld\n\t"
34960 + __asm__("movw %w6, %%ds\n\t"
34961 + "lcall *%%ss:(%%esi); cld\n\t"
34962 + "push %%ss\n\t"
34963 + "pop %%ds\n\t"
34964 "jc 1f\n\t"
34965 "xor %%ah, %%ah\n"
34966 "1:"
34967 @@ -277,10 +342,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34968 "c" (value),
34969 "b" (bx),
34970 "D" ((long)reg),
34971 - "S" (&pci_indirect));
34972 + "S" (&pci_indirect),
34973 + "r" (__PCIBIOS_DS));
34974 break;
34975 case 4:
34976 - __asm__("lcall *(%%esi); cld\n\t"
34977 + __asm__("movw %w6, %%ds\n\t"
34978 + "lcall *%%ss:(%%esi); cld\n\t"
34979 + "push %%ss\n\t"
34980 + "pop %%ds\n\t"
34981 "jc 1f\n\t"
34982 "xor %%ah, %%ah\n"
34983 "1:"
34984 @@ -289,7 +358,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34985 "c" (value),
34986 "b" (bx),
34987 "D" ((long)reg),
34988 - "S" (&pci_indirect));
34989 + "S" (&pci_indirect),
34990 + "r" (__PCIBIOS_DS));
34991 break;
34992 }
34993
34994 @@ -394,10 +464,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
34995
34996 DBG("PCI: Fetching IRQ routing table... ");
34997 __asm__("push %%es\n\t"
34998 + "movw %w8, %%ds\n\t"
34999 "push %%ds\n\t"
35000 "pop %%es\n\t"
35001 - "lcall *(%%esi); cld\n\t"
35002 + "lcall *%%ss:(%%esi); cld\n\t"
35003 "pop %%es\n\t"
35004 + "push %%ss\n\t"
35005 + "pop %%ds\n"
35006 "jc 1f\n\t"
35007 "xor %%ah, %%ah\n"
35008 "1:"
35009 @@ -408,7 +481,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
35010 "1" (0),
35011 "D" ((long) &opt),
35012 "S" (&pci_indirect),
35013 - "m" (opt)
35014 + "m" (opt),
35015 + "r" (__PCIBIOS_DS)
35016 : "memory");
35017 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
35018 if (ret & 0xff00)
35019 @@ -432,7 +506,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
35020 {
35021 int ret;
35022
35023 - __asm__("lcall *(%%esi); cld\n\t"
35024 + __asm__("movw %w5, %%ds\n\t"
35025 + "lcall *%%ss:(%%esi); cld\n\t"
35026 + "push %%ss\n\t"
35027 + "pop %%ds\n"
35028 "jc 1f\n\t"
35029 "xor %%ah, %%ah\n"
35030 "1:"
35031 @@ -440,7 +517,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
35032 : "0" (PCIBIOS_SET_PCI_HW_INT),
35033 "b" ((dev->bus->number << 8) | dev->devfn),
35034 "c" ((irq << 8) | (pin + 10)),
35035 - "S" (&pci_indirect));
35036 + "S" (&pci_indirect),
35037 + "r" (__PCIBIOS_DS));
35038 return !(ret & 0xff00);
35039 }
35040 EXPORT_SYMBOL(pcibios_set_irq_routing);
35041 diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
35042 index ed5b673..24d2d53 100644
35043 --- a/arch/x86/platform/efi/efi_32.c
35044 +++ b/arch/x86/platform/efi/efi_32.c
35045 @@ -61,11 +61,27 @@ pgd_t * __init efi_call_phys_prolog(void)
35046 struct desc_ptr gdt_descr;
35047 pgd_t *save_pgd;
35048
35049 +#ifdef CONFIG_PAX_KERNEXEC
35050 + struct desc_struct d;
35051 +#endif
35052 +
35053 /* Current pgd is swapper_pg_dir, we'll restore it later: */
35054 +#ifdef CONFIG_PAX_PER_CPU_PGD
35055 + save_pgd = get_cpu_pgd(smp_processor_id(), kernel);
35056 +#else
35057 save_pgd = swapper_pg_dir;
35058 +#endif
35059 +
35060 load_cr3(initial_page_table);
35061 __flush_tlb_all();
35062
35063 +#ifdef CONFIG_PAX_KERNEXEC
35064 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
35065 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
35066 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
35067 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
35068 +#endif
35069 +
35070 gdt_descr.address = __pa(get_cpu_gdt_table(0));
35071 gdt_descr.size = GDT_SIZE - 1;
35072 load_gdt(&gdt_descr);
35073 @@ -77,6 +93,14 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd)
35074 {
35075 struct desc_ptr gdt_descr;
35076
35077 +#ifdef CONFIG_PAX_KERNEXEC
35078 + struct desc_struct d;
35079 +
35080 + memset(&d, 0, sizeof d);
35081 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
35082 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
35083 +#endif
35084 +
35085 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
35086 gdt_descr.size = GDT_SIZE - 1;
35087 load_gdt(&gdt_descr);
35088 diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
35089 index a0ac0f9..f41d324 100644
35090 --- a/arch/x86/platform/efi/efi_64.c
35091 +++ b/arch/x86/platform/efi/efi_64.c
35092 @@ -96,6 +96,11 @@ pgd_t * __init efi_call_phys_prolog(void)
35093 vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
35094 set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
35095 }
35096 +
35097 +#ifdef CONFIG_PAX_PER_CPU_PGD
35098 + load_cr3(swapper_pg_dir);
35099 +#endif
35100 +
35101 __flush_tlb_all();
35102
35103 return save_pgd;
35104 @@ -119,6 +124,10 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd)
35105
35106 kfree(save_pgd);
35107
35108 +#ifdef CONFIG_PAX_PER_CPU_PGD
35109 + load_cr3(get_cpu_pgd(smp_processor_id(), kernel));
35110 +#endif
35111 +
35112 __flush_tlb_all();
35113 early_code_mapping_set_exec(0);
35114 }
35115 @@ -148,8 +157,23 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
35116 unsigned npages;
35117 pgd_t *pgd;
35118
35119 - if (efi_enabled(EFI_OLD_MEMMAP))
35120 + if (efi_enabled(EFI_OLD_MEMMAP)) {
35121 + /* PaX: We need to disable the NX bit in the PGD, otherwise we won't be
35122 + * able to execute the EFI services.
35123 + */
35124 + if (__supported_pte_mask & _PAGE_NX) {
35125 + unsigned long addr = (unsigned long) __va(0);
35126 + pgd_t pe = __pgd(pgd_val(*pgd_offset_k(addr)) & ~_PAGE_NX);
35127 +
35128 + pr_alert("PAX: Disabling NX protection for low memory map. Try booting without \"efi=old_map\"\n");
35129 +#ifdef CONFIG_PAX_PER_CPU_PGD
35130 + set_pgd(pgd_offset_cpu(0, kernel, addr), pe);
35131 +#endif
35132 + set_pgd(pgd_offset_k(addr), pe);
35133 + }
35134 +
35135 return 0;
35136 + }
35137
35138 efi_scratch.efi_pgt = (pgd_t *)(unsigned long)real_mode_header->trampoline_pgd;
35139 pgd = __va(efi_scratch.efi_pgt);
35140 diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
35141 index 040192b..7d3300f 100644
35142 --- a/arch/x86/platform/efi/efi_stub_32.S
35143 +++ b/arch/x86/platform/efi/efi_stub_32.S
35144 @@ -6,7 +6,9 @@
35145 */
35146
35147 #include <linux/linkage.h>
35148 +#include <linux/init.h>
35149 #include <asm/page_types.h>
35150 +#include <asm/segment.h>
35151
35152 /*
35153 * efi_call_phys(void *, ...) is a function with variable parameters.
35154 @@ -20,7 +22,7 @@
35155 * service functions will comply with gcc calling convention, too.
35156 */
35157
35158 -.text
35159 +__INIT
35160 ENTRY(efi_call_phys)
35161 /*
35162 * 0. The function can only be called in Linux kernel. So CS has been
35163 @@ -36,10 +38,24 @@ ENTRY(efi_call_phys)
35164 * The mapping of lower virtual memory has been created in prolog and
35165 * epilog.
35166 */
35167 - movl $1f, %edx
35168 - subl $__PAGE_OFFSET, %edx
35169 - jmp *%edx
35170 +#ifdef CONFIG_PAX_KERNEXEC
35171 + movl $(__KERNEXEC_EFI_DS), %edx
35172 + mov %edx, %ds
35173 + mov %edx, %es
35174 + mov %edx, %ss
35175 + addl $2f,(1f)
35176 + ljmp *(1f)
35177 +
35178 +__INITDATA
35179 +1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS
35180 +.previous
35181 +
35182 +2:
35183 + subl $2b,(1b)
35184 +#else
35185 + jmp 1f-__PAGE_OFFSET
35186 1:
35187 +#endif
35188
35189 /*
35190 * 2. Now on the top of stack is the return
35191 @@ -47,14 +63,8 @@ ENTRY(efi_call_phys)
35192 * parameter 2, ..., param n. To make things easy, we save the return
35193 * address of efi_call_phys in a global variable.
35194 */
35195 - popl %edx
35196 - movl %edx, saved_return_addr
35197 - /* get the function pointer into ECX*/
35198 - popl %ecx
35199 - movl %ecx, efi_rt_function_ptr
35200 - movl $2f, %edx
35201 - subl $__PAGE_OFFSET, %edx
35202 - pushl %edx
35203 + popl (saved_return_addr)
35204 + popl (efi_rt_function_ptr)
35205
35206 /*
35207 * 3. Clear PG bit in %CR0.
35208 @@ -73,9 +83,8 @@ ENTRY(efi_call_phys)
35209 /*
35210 * 5. Call the physical function.
35211 */
35212 - jmp *%ecx
35213 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
35214
35215 -2:
35216 /*
35217 * 6. After EFI runtime service returns, control will return to
35218 * following instruction. We'd better readjust stack pointer first.
35219 @@ -88,35 +97,36 @@ ENTRY(efi_call_phys)
35220 movl %cr0, %edx
35221 orl $0x80000000, %edx
35222 movl %edx, %cr0
35223 - jmp 1f
35224 -1:
35225 +
35226 /*
35227 * 8. Now restore the virtual mode from flat mode by
35228 * adding EIP with PAGE_OFFSET.
35229 */
35230 - movl $1f, %edx
35231 - jmp *%edx
35232 +#ifdef CONFIG_PAX_KERNEXEC
35233 + movl $(__KERNEL_DS), %edx
35234 + mov %edx, %ds
35235 + mov %edx, %es
35236 + mov %edx, %ss
35237 + ljmp $(__KERNEL_CS),$1f
35238 +#else
35239 + jmp 1f+__PAGE_OFFSET
35240 +#endif
35241 1:
35242
35243 /*
35244 * 9. Balance the stack. And because EAX contain the return value,
35245 * we'd better not clobber it.
35246 */
35247 - leal efi_rt_function_ptr, %edx
35248 - movl (%edx), %ecx
35249 - pushl %ecx
35250 + pushl (efi_rt_function_ptr)
35251
35252 /*
35253 - * 10. Push the saved return address onto the stack and return.
35254 + * 10. Return to the saved return address.
35255 */
35256 - leal saved_return_addr, %edx
35257 - movl (%edx), %ecx
35258 - pushl %ecx
35259 - ret
35260 + jmpl *(saved_return_addr)
35261 ENDPROC(efi_call_phys)
35262 .previous
35263
35264 -.data
35265 +__INITDATA
35266 saved_return_addr:
35267 .long 0
35268 efi_rt_function_ptr:
35269 diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
35270 index 86d0f9e..6d499f4 100644
35271 --- a/arch/x86/platform/efi/efi_stub_64.S
35272 +++ b/arch/x86/platform/efi/efi_stub_64.S
35273 @@ -11,6 +11,7 @@
35274 #include <asm/msr.h>
35275 #include <asm/processor-flags.h>
35276 #include <asm/page_types.h>
35277 +#include <asm/alternative-asm.h>
35278
35279 #define SAVE_XMM \
35280 mov %rsp, %rax; \
35281 @@ -88,6 +89,7 @@ ENTRY(efi_call)
35282 RESTORE_PGT
35283 addq $48, %rsp
35284 RESTORE_XMM
35285 + pax_force_retaddr 0, 1
35286 ret
35287 ENDPROC(efi_call)
35288
35289 diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c
35290 index 3005f0c..d06aeb0 100644
35291 --- a/arch/x86/platform/intel-mid/intel-mid.c
35292 +++ b/arch/x86/platform/intel-mid/intel-mid.c
35293 @@ -63,7 +63,7 @@ enum intel_mid_timer_options intel_mid_timer_options;
35294 /* intel_mid_ops to store sub arch ops */
35295 struct intel_mid_ops *intel_mid_ops;
35296 /* getter function for sub arch ops*/
35297 -static void *(*get_intel_mid_ops[])(void) = INTEL_MID_OPS_INIT;
35298 +static const void *(*get_intel_mid_ops[])(void) = INTEL_MID_OPS_INIT;
35299 enum intel_mid_cpu_type __intel_mid_cpu_chip;
35300 EXPORT_SYMBOL_GPL(__intel_mid_cpu_chip);
35301
35302 @@ -71,9 +71,10 @@ static void intel_mid_power_off(void)
35303 {
35304 };
35305
35306 -static void intel_mid_reboot(void)
35307 +static void __noreturn intel_mid_reboot(void)
35308 {
35309 intel_scu_ipc_simple_command(IPCMSG_COLD_BOOT, 0);
35310 + BUG();
35311 }
35312
35313 static unsigned long __init intel_mid_calibrate_tsc(void)
35314 diff --git a/arch/x86/platform/intel-mid/intel_mid_weak_decls.h b/arch/x86/platform/intel-mid/intel_mid_weak_decls.h
35315 index 3c1c386..59a68ed 100644
35316 --- a/arch/x86/platform/intel-mid/intel_mid_weak_decls.h
35317 +++ b/arch/x86/platform/intel-mid/intel_mid_weak_decls.h
35318 @@ -13,6 +13,6 @@
35319 /* For every CPU addition a new get_<cpuname>_ops interface needs
35320 * to be added.
35321 */
35322 -extern void *get_penwell_ops(void);
35323 -extern void *get_cloverview_ops(void);
35324 -extern void *get_tangier_ops(void);
35325 +extern const void *get_penwell_ops(void);
35326 +extern const void *get_cloverview_ops(void);
35327 +extern const void *get_tangier_ops(void);
35328 diff --git a/arch/x86/platform/intel-mid/mfld.c b/arch/x86/platform/intel-mid/mfld.c
35329 index 23381d2..8ddc10e 100644
35330 --- a/arch/x86/platform/intel-mid/mfld.c
35331 +++ b/arch/x86/platform/intel-mid/mfld.c
35332 @@ -64,12 +64,12 @@ static void __init penwell_arch_setup(void)
35333 pm_power_off = mfld_power_off;
35334 }
35335
35336 -void *get_penwell_ops(void)
35337 +const void *get_penwell_ops(void)
35338 {
35339 return &penwell_ops;
35340 }
35341
35342 -void *get_cloverview_ops(void)
35343 +const void *get_cloverview_ops(void)
35344 {
35345 return &penwell_ops;
35346 }
35347 diff --git a/arch/x86/platform/intel-mid/mrfl.c b/arch/x86/platform/intel-mid/mrfl.c
35348 index aaca917..66eadbc 100644
35349 --- a/arch/x86/platform/intel-mid/mrfl.c
35350 +++ b/arch/x86/platform/intel-mid/mrfl.c
35351 @@ -97,7 +97,7 @@ static struct intel_mid_ops tangier_ops = {
35352 .arch_setup = tangier_arch_setup,
35353 };
35354
35355 -void *get_tangier_ops(void)
35356 +const void *get_tangier_ops(void)
35357 {
35358 return &tangier_ops;
35359 }
35360 diff --git a/arch/x86/platform/intel-quark/imr_selftest.c b/arch/x86/platform/intel-quark/imr_selftest.c
35361 index 278e4da..55e8d8a 100644
35362 --- a/arch/x86/platform/intel-quark/imr_selftest.c
35363 +++ b/arch/x86/platform/intel-quark/imr_selftest.c
35364 @@ -55,7 +55,7 @@ static void __init imr_self_test_result(int res, const char *fmt, ...)
35365 */
35366 static void __init imr_self_test(void)
35367 {
35368 - phys_addr_t base = virt_to_phys(&_text);
35369 + phys_addr_t base = virt_to_phys(ktla_ktva(_text));
35370 size_t size = virt_to_phys(&__end_rodata) - base;
35371 const char *fmt_over = "overlapped IMR @ (0x%08lx - 0x%08lx)\n";
35372 int ret;
35373 diff --git a/arch/x86/platform/olpc/olpc_dt.c b/arch/x86/platform/olpc/olpc_dt.c
35374 index d6ee929..3637cb5 100644
35375 --- a/arch/x86/platform/olpc/olpc_dt.c
35376 +++ b/arch/x86/platform/olpc/olpc_dt.c
35377 @@ -156,7 +156,7 @@ void * __init prom_early_alloc(unsigned long size)
35378 return res;
35379 }
35380
35381 -static struct of_pdt_ops prom_olpc_ops __initdata = {
35382 +static struct of_pdt_ops prom_olpc_ops __initconst = {
35383 .nextprop = olpc_dt_nextprop,
35384 .getproplen = olpc_dt_getproplen,
35385 .getproperty = olpc_dt_getproperty,
35386 diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
35387 index 757678f..9895d9b 100644
35388 --- a/arch/x86/power/cpu.c
35389 +++ b/arch/x86/power/cpu.c
35390 @@ -134,11 +134,8 @@ static void do_fpu_end(void)
35391 static void fix_processor_context(void)
35392 {
35393 int cpu = smp_processor_id();
35394 - struct tss_struct *t = &per_cpu(cpu_tss, cpu);
35395 -#ifdef CONFIG_X86_64
35396 - struct desc_struct *desc = get_cpu_gdt_table(cpu);
35397 - tss_desc tss;
35398 -#endif
35399 + struct tss_struct *t = cpu_tss + cpu;
35400 +
35401 set_tss_desc(cpu, t); /*
35402 * This just modifies memory; should not be
35403 * necessary. But... This is necessary, because
35404 @@ -147,10 +144,6 @@ static void fix_processor_context(void)
35405 */
35406
35407 #ifdef CONFIG_X86_64
35408 - memcpy(&tss, &desc[GDT_ENTRY_TSS], sizeof(tss_desc));
35409 - tss.type = 0x9; /* The available 64-bit TSS (see AMD vol 2, pg 91 */
35410 - write_gdt_entry(desc, GDT_ENTRY_TSS, &tss, DESC_TSS);
35411 -
35412 syscall_init(); /* This sets MSR_*STAR and related */
35413 #endif
35414 load_TR_desc(); /* This does ltr */
35415 diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
35416 index 0b7a63d..0d0f2c2 100644
35417 --- a/arch/x86/realmode/init.c
35418 +++ b/arch/x86/realmode/init.c
35419 @@ -68,7 +68,13 @@ void __init setup_real_mode(void)
35420 __va(real_mode_header->trampoline_header);
35421
35422 #ifdef CONFIG_X86_32
35423 - trampoline_header->start = __pa_symbol(startup_32_smp);
35424 + trampoline_header->start = __pa_symbol(ktla_ktva(startup_32_smp));
35425 +
35426 +#ifdef CONFIG_PAX_KERNEXEC
35427 + trampoline_header->start -= LOAD_PHYSICAL_ADDR;
35428 +#endif
35429 +
35430 + trampoline_header->boot_cs = __BOOT_CS;
35431 trampoline_header->gdt_limit = __BOOT_DS + 7;
35432 trampoline_header->gdt_base = __pa_symbol(boot_gdt);
35433 #else
35434 @@ -84,7 +90,7 @@ void __init setup_real_mode(void)
35435 *trampoline_cr4_features = __read_cr4();
35436
35437 trampoline_pgd = (u64 *) __va(real_mode_header->trampoline_pgd);
35438 - trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd;
35439 + trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd & ~_PAGE_NX;
35440 trampoline_pgd[511] = init_level4_pgt[511].pgd;
35441 #endif
35442 }
35443 diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
35444 index 2730d77..2e4cd19 100644
35445 --- a/arch/x86/realmode/rm/Makefile
35446 +++ b/arch/x86/realmode/rm/Makefile
35447 @@ -68,5 +68,8 @@ $(obj)/realmode.relocs: $(obj)/realmode.elf FORCE
35448
35449 KBUILD_CFLAGS := $(LINUXINCLUDE) $(REALMODE_CFLAGS) -D_SETUP -D_WAKEUP \
35450 -I$(srctree)/arch/x86/boot
35451 +ifdef CONSTIFY_PLUGIN
35452 +KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
35453 +endif
35454 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
35455 GCOV_PROFILE := n
35456 diff --git a/arch/x86/realmode/rm/header.S b/arch/x86/realmode/rm/header.S
35457 index a28221d..93c40f1 100644
35458 --- a/arch/x86/realmode/rm/header.S
35459 +++ b/arch/x86/realmode/rm/header.S
35460 @@ -30,7 +30,9 @@ GLOBAL(real_mode_header)
35461 #endif
35462 /* APM/BIOS reboot */
35463 .long pa_machine_real_restart_asm
35464 -#ifdef CONFIG_X86_64
35465 +#ifdef CONFIG_X86_32
35466 + .long __KERNEL_CS
35467 +#else
35468 .long __KERNEL32_CS
35469 #endif
35470 END(real_mode_header)
35471 diff --git a/arch/x86/realmode/rm/reboot.S b/arch/x86/realmode/rm/reboot.S
35472 index d66c607..3def845 100644
35473 --- a/arch/x86/realmode/rm/reboot.S
35474 +++ b/arch/x86/realmode/rm/reboot.S
35475 @@ -27,6 +27,10 @@ ENTRY(machine_real_restart_asm)
35476 lgdtl pa_tr_gdt
35477
35478 /* Disable paging to drop us out of long mode */
35479 + movl %cr4, %eax
35480 + andl $~X86_CR4_PCIDE, %eax
35481 + movl %eax, %cr4
35482 +
35483 movl %cr0, %eax
35484 andl $~X86_CR0_PG, %eax
35485 movl %eax, %cr0
35486 diff --git a/arch/x86/realmode/rm/trampoline_32.S b/arch/x86/realmode/rm/trampoline_32.S
35487 index 48ddd76..c26749f 100644
35488 --- a/arch/x86/realmode/rm/trampoline_32.S
35489 +++ b/arch/x86/realmode/rm/trampoline_32.S
35490 @@ -24,6 +24,12 @@
35491 #include <asm/page_types.h>
35492 #include "realmode.h"
35493
35494 +#ifdef CONFIG_PAX_KERNEXEC
35495 +#define ta(X) (X)
35496 +#else
35497 +#define ta(X) (pa_ ## X)
35498 +#endif
35499 +
35500 .text
35501 .code16
35502
35503 @@ -38,8 +44,6 @@ ENTRY(trampoline_start)
35504
35505 cli # We should be safe anyway
35506
35507 - movl tr_start, %eax # where we need to go
35508 -
35509 movl $0xA5A5A5A5, trampoline_status
35510 # write marker for master knows we're running
35511
35512 @@ -55,7 +59,7 @@ ENTRY(trampoline_start)
35513 movw $1, %dx # protected mode (PE) bit
35514 lmsw %dx # into protected mode
35515
35516 - ljmpl $__BOOT_CS, $pa_startup_32
35517 + ljmpl *(trampoline_header)
35518
35519 .section ".text32","ax"
35520 .code32
35521 @@ -66,7 +70,7 @@ ENTRY(startup_32) # note: also used from wakeup_asm.S
35522 .balign 8
35523 GLOBAL(trampoline_header)
35524 tr_start: .space 4
35525 - tr_gdt_pad: .space 2
35526 + tr_boot_cs: .space 2
35527 tr_gdt: .space 6
35528 END(trampoline_header)
35529
35530 diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S
35531 index dac7b20..72dbaca 100644
35532 --- a/arch/x86/realmode/rm/trampoline_64.S
35533 +++ b/arch/x86/realmode/rm/trampoline_64.S
35534 @@ -93,6 +93,7 @@ ENTRY(startup_32)
35535 movl %edx, %gs
35536
35537 movl pa_tr_cr4, %eax
35538 + andl $~X86_CR4_PCIDE, %eax
35539 movl %eax, %cr4 # Enable PAE mode
35540
35541 # Setup trampoline 4 level pagetables
35542 @@ -106,7 +107,7 @@ ENTRY(startup_32)
35543 wrmsr
35544
35545 # Enable paging and in turn activate Long Mode
35546 - movl $(X86_CR0_PG | X86_CR0_WP | X86_CR0_PE), %eax
35547 + movl $(X86_CR0_PG | X86_CR0_PE), %eax
35548 movl %eax, %cr0
35549
35550 /*
35551 diff --git a/arch/x86/realmode/rm/wakeup_asm.S b/arch/x86/realmode/rm/wakeup_asm.S
35552 index 9e7e147..25a4158 100644
35553 --- a/arch/x86/realmode/rm/wakeup_asm.S
35554 +++ b/arch/x86/realmode/rm/wakeup_asm.S
35555 @@ -126,11 +126,10 @@ ENTRY(wakeup_start)
35556 lgdtl pmode_gdt
35557
35558 /* This really couldn't... */
35559 - movl pmode_entry, %eax
35560 movl pmode_cr0, %ecx
35561 movl %ecx, %cr0
35562 - ljmpl $__KERNEL_CS, $pa_startup_32
35563 - /* -> jmp *%eax in trampoline_32.S */
35564 +
35565 + ljmpl *pmode_entry
35566 #else
35567 jmp trampoline_start
35568 #endif
35569 diff --git a/arch/x86/tools/Makefile b/arch/x86/tools/Makefile
35570 index 604a37e..e49702a 100644
35571 --- a/arch/x86/tools/Makefile
35572 +++ b/arch/x86/tools/Makefile
35573 @@ -37,7 +37,7 @@ $(obj)/test_get_len.o: $(srctree)/arch/x86/lib/insn.c $(srctree)/arch/x86/lib/in
35574
35575 $(obj)/insn_sanity.o: $(srctree)/arch/x86/lib/insn.c $(srctree)/arch/x86/lib/inat.c $(srctree)/arch/x86/include/asm/inat_types.h $(srctree)/arch/x86/include/asm/inat.h $(srctree)/arch/x86/include/asm/insn.h $(objtree)/arch/x86/lib/inat-tables.c
35576
35577 -HOST_EXTRACFLAGS += -I$(srctree)/tools/include
35578 +HOST_EXTRACFLAGS += -I$(srctree)/tools/include -ggdb
35579 hostprogs-y += relocs
35580 relocs-objs := relocs_32.o relocs_64.o relocs_common.o
35581 PHONY += relocs
35582 diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
35583 index 0c2fae8..88036b7 100644
35584 --- a/arch/x86/tools/relocs.c
35585 +++ b/arch/x86/tools/relocs.c
35586 @@ -1,5 +1,7 @@
35587 /* This is included from relocs_32/64.c */
35588
35589 +#include "../../../include/generated/autoconf.h"
35590 +
35591 #define ElfW(type) _ElfW(ELF_BITS, type)
35592 #define _ElfW(bits, type) __ElfW(bits, type)
35593 #define __ElfW(bits, type) Elf##bits##_##type
35594 @@ -11,6 +13,7 @@
35595 #define Elf_Sym ElfW(Sym)
35596
35597 static Elf_Ehdr ehdr;
35598 +static Elf_Phdr *phdr;
35599
35600 struct relocs {
35601 uint32_t *offset;
35602 @@ -386,9 +389,39 @@ static void read_ehdr(FILE *fp)
35603 }
35604 }
35605
35606 +static void read_phdrs(FILE *fp)
35607 +{
35608 + unsigned int i;
35609 +
35610 + phdr = calloc(ehdr.e_phnum, sizeof(Elf_Phdr));
35611 + if (!phdr) {
35612 + die("Unable to allocate %d program headers\n",
35613 + ehdr.e_phnum);
35614 + }
35615 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
35616 + die("Seek to %d failed: %s\n",
35617 + ehdr.e_phoff, strerror(errno));
35618 + }
35619 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
35620 + die("Cannot read ELF program headers: %s\n",
35621 + strerror(errno));
35622 + }
35623 + for(i = 0; i < ehdr.e_phnum; i++) {
35624 + phdr[i].p_type = elf_word_to_cpu(phdr[i].p_type);
35625 + phdr[i].p_offset = elf_off_to_cpu(phdr[i].p_offset);
35626 + phdr[i].p_vaddr = elf_addr_to_cpu(phdr[i].p_vaddr);
35627 + phdr[i].p_paddr = elf_addr_to_cpu(phdr[i].p_paddr);
35628 + phdr[i].p_filesz = elf_word_to_cpu(phdr[i].p_filesz);
35629 + phdr[i].p_memsz = elf_word_to_cpu(phdr[i].p_memsz);
35630 + phdr[i].p_flags = elf_word_to_cpu(phdr[i].p_flags);
35631 + phdr[i].p_align = elf_word_to_cpu(phdr[i].p_align);
35632 + }
35633 +
35634 +}
35635 +
35636 static void read_shdrs(FILE *fp)
35637 {
35638 - int i;
35639 + unsigned int i;
35640 Elf_Shdr shdr;
35641
35642 secs = calloc(ehdr.e_shnum, sizeof(struct section));
35643 @@ -423,7 +456,7 @@ static void read_shdrs(FILE *fp)
35644
35645 static void read_strtabs(FILE *fp)
35646 {
35647 - int i;
35648 + unsigned int i;
35649 for (i = 0; i < ehdr.e_shnum; i++) {
35650 struct section *sec = &secs[i];
35651 if (sec->shdr.sh_type != SHT_STRTAB) {
35652 @@ -448,7 +481,7 @@ static void read_strtabs(FILE *fp)
35653
35654 static void read_symtabs(FILE *fp)
35655 {
35656 - int i,j;
35657 + unsigned int i,j;
35658 for (i = 0; i < ehdr.e_shnum; i++) {
35659 struct section *sec = &secs[i];
35660 if (sec->shdr.sh_type != SHT_SYMTAB) {
35661 @@ -479,9 +512,11 @@ static void read_symtabs(FILE *fp)
35662 }
35663
35664
35665 -static void read_relocs(FILE *fp)
35666 +static void read_relocs(FILE *fp, int use_real_mode)
35667 {
35668 - int i,j;
35669 + unsigned int i,j;
35670 + uint32_t base;
35671 +
35672 for (i = 0; i < ehdr.e_shnum; i++) {
35673 struct section *sec = &secs[i];
35674 if (sec->shdr.sh_type != SHT_REL_TYPE) {
35675 @@ -501,9 +536,22 @@ static void read_relocs(FILE *fp)
35676 die("Cannot read symbol table: %s\n",
35677 strerror(errno));
35678 }
35679 + base = 0;
35680 +
35681 +#ifdef CONFIG_X86_32
35682 + for (j = 0; !use_real_mode && j < ehdr.e_phnum; j++) {
35683 + if (phdr[j].p_type != PT_LOAD )
35684 + continue;
35685 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
35686 + continue;
35687 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
35688 + break;
35689 + }
35690 +#endif
35691 +
35692 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {
35693 Elf_Rel *rel = &sec->reltab[j];
35694 - rel->r_offset = elf_addr_to_cpu(rel->r_offset);
35695 + rel->r_offset = elf_addr_to_cpu(rel->r_offset) + base;
35696 rel->r_info = elf_xword_to_cpu(rel->r_info);
35697 #if (SHT_REL_TYPE == SHT_RELA)
35698 rel->r_addend = elf_xword_to_cpu(rel->r_addend);
35699 @@ -515,7 +563,7 @@ static void read_relocs(FILE *fp)
35700
35701 static void print_absolute_symbols(void)
35702 {
35703 - int i;
35704 + unsigned int i;
35705 const char *format;
35706
35707 if (ELF_BITS == 64)
35708 @@ -528,7 +576,7 @@ static void print_absolute_symbols(void)
35709 for (i = 0; i < ehdr.e_shnum; i++) {
35710 struct section *sec = &secs[i];
35711 char *sym_strtab;
35712 - int j;
35713 + unsigned int j;
35714
35715 if (sec->shdr.sh_type != SHT_SYMTAB) {
35716 continue;
35717 @@ -555,7 +603,7 @@ static void print_absolute_symbols(void)
35718
35719 static void print_absolute_relocs(void)
35720 {
35721 - int i, printed = 0;
35722 + unsigned int i, printed = 0;
35723 const char *format;
35724
35725 if (ELF_BITS == 64)
35726 @@ -568,7 +616,7 @@ static void print_absolute_relocs(void)
35727 struct section *sec_applies, *sec_symtab;
35728 char *sym_strtab;
35729 Elf_Sym *sh_symtab;
35730 - int j;
35731 + unsigned int j;
35732 if (sec->shdr.sh_type != SHT_REL_TYPE) {
35733 continue;
35734 }
35735 @@ -645,13 +693,13 @@ static void add_reloc(struct relocs *r, uint32_t offset)
35736 static void walk_relocs(int (*process)(struct section *sec, Elf_Rel *rel,
35737 Elf_Sym *sym, const char *symname))
35738 {
35739 - int i;
35740 + unsigned int i;
35741 /* Walk through the relocations */
35742 for (i = 0; i < ehdr.e_shnum; i++) {
35743 char *sym_strtab;
35744 Elf_Sym *sh_symtab;
35745 struct section *sec_applies, *sec_symtab;
35746 - int j;
35747 + unsigned int j;
35748 struct section *sec = &secs[i];
35749
35750 if (sec->shdr.sh_type != SHT_REL_TYPE) {
35751 @@ -830,6 +878,23 @@ static int do_reloc32(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
35752 {
35753 unsigned r_type = ELF32_R_TYPE(rel->r_info);
35754 int shn_abs = (sym->st_shndx == SHN_ABS) && !is_reloc(S_REL, symname);
35755 + char *sym_strtab = sec->link->link->strtab;
35756 +
35757 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
35758 + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
35759 + return 0;
35760 +
35761 +#ifdef CONFIG_PAX_KERNEXEC
35762 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
35763 + if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
35764 + return 0;
35765 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
35766 + return 0;
35767 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
35768 + return 0;
35769 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
35770 + return 0;
35771 +#endif
35772
35773 switch (r_type) {
35774 case R_386_NONE:
35775 @@ -968,7 +1033,7 @@ static int write32_as_text(uint32_t v, FILE *f)
35776
35777 static void emit_relocs(int as_text, int use_real_mode)
35778 {
35779 - int i;
35780 + unsigned int i;
35781 int (*write_reloc)(uint32_t, FILE *) = write32;
35782 int (*do_reloc)(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
35783 const char *symname);
35784 @@ -1078,10 +1143,11 @@ void process(FILE *fp, int use_real_mode, int as_text,
35785 {
35786 regex_init(use_real_mode);
35787 read_ehdr(fp);
35788 + read_phdrs(fp);
35789 read_shdrs(fp);
35790 read_strtabs(fp);
35791 read_symtabs(fp);
35792 - read_relocs(fp);
35793 + read_relocs(fp, use_real_mode);
35794 if (ELF_BITS == 64)
35795 percpu_init();
35796 if (show_absolute_syms) {
35797 diff --git a/arch/x86/um/mem_32.c b/arch/x86/um/mem_32.c
35798 index f40281e..92728c9 100644
35799 --- a/arch/x86/um/mem_32.c
35800 +++ b/arch/x86/um/mem_32.c
35801 @@ -21,7 +21,7 @@ static int __init gate_vma_init(void)
35802 gate_vma.vm_start = FIXADDR_USER_START;
35803 gate_vma.vm_end = FIXADDR_USER_END;
35804 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
35805 - gate_vma.vm_page_prot = __P101;
35806 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
35807
35808 return 0;
35809 }
35810 diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c
35811 index 80ffa5b..a33bd15 100644
35812 --- a/arch/x86/um/tls_32.c
35813 +++ b/arch/x86/um/tls_32.c
35814 @@ -260,7 +260,7 @@ out:
35815 if (unlikely(task == current &&
35816 !t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed)) {
35817 printk(KERN_ERR "get_tls_entry: task with pid %d got here "
35818 - "without flushed TLS.", current->pid);
35819 + "without flushed TLS.", task_pid_nr(current));
35820 }
35821
35822 return 0;
35823 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
35824 index e970320..c006fea 100644
35825 --- a/arch/x86/vdso/Makefile
35826 +++ b/arch/x86/vdso/Makefile
35827 @@ -175,7 +175,7 @@ quiet_cmd_vdso = VDSO $@
35828 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
35829 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
35830
35831 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) \
35832 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) \
35833 $(call cc-ldoption, -Wl$(comma)--build-id) -Wl,-Bsymbolic $(LTO_CFLAGS)
35834 GCOV_PROFILE := n
35835
35836 diff --git a/arch/x86/vdso/vdso2c.h b/arch/x86/vdso/vdso2c.h
35837 index 0224987..c7d65a5 100644
35838 --- a/arch/x86/vdso/vdso2c.h
35839 +++ b/arch/x86/vdso/vdso2c.h
35840 @@ -12,7 +12,7 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
35841 unsigned long load_size = -1; /* Work around bogus warning */
35842 unsigned long mapping_size;
35843 ELF(Ehdr) *hdr = (ELF(Ehdr) *)raw_addr;
35844 - int i;
35845 + unsigned int i;
35846 unsigned long j;
35847 ELF(Shdr) *symtab_hdr = NULL, *strtab_hdr, *secstrings_hdr,
35848 *alt_sec = NULL;
35849 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
35850 index e904c27..b9eaa03 100644
35851 --- a/arch/x86/vdso/vdso32-setup.c
35852 +++ b/arch/x86/vdso/vdso32-setup.c
35853 @@ -14,6 +14,7 @@
35854 #include <asm/cpufeature.h>
35855 #include <asm/processor.h>
35856 #include <asm/vdso.h>
35857 +#include <asm/mman.h>
35858
35859 #ifdef CONFIG_COMPAT_VDSO
35860 #define VDSO_DEFAULT 0
35861 diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
35862 index 1c9f750..cfddb1a 100644
35863 --- a/arch/x86/vdso/vma.c
35864 +++ b/arch/x86/vdso/vma.c
35865 @@ -19,10 +19,7 @@
35866 #include <asm/page.h>
35867 #include <asm/hpet.h>
35868 #include <asm/desc.h>
35869 -
35870 -#if defined(CONFIG_X86_64)
35871 -unsigned int __read_mostly vdso64_enabled = 1;
35872 -#endif
35873 +#include <asm/mman.h>
35874
35875 void __init init_vdso_image(const struct vdso_image *image)
35876 {
35877 @@ -101,6 +98,11 @@ static int map_vdso(const struct vdso_image *image, bool calculate_addr)
35878 .pages = no_pages,
35879 };
35880
35881 +#ifdef CONFIG_PAX_RANDMMAP
35882 + if (mm->pax_flags & MF_PAX_RANDMMAP)
35883 + calculate_addr = false;
35884 +#endif
35885 +
35886 if (calculate_addr) {
35887 addr = vdso_addr(current->mm->start_stack,
35888 image->size - image->sym_vvar_start);
35889 @@ -111,14 +113,14 @@ static int map_vdso(const struct vdso_image *image, bool calculate_addr)
35890 down_write(&mm->mmap_sem);
35891
35892 addr = get_unmapped_area(NULL, addr,
35893 - image->size - image->sym_vvar_start, 0, 0);
35894 + image->size - image->sym_vvar_start, 0, MAP_EXECUTABLE);
35895 if (IS_ERR_VALUE(addr)) {
35896 ret = addr;
35897 goto up_fail;
35898 }
35899
35900 text_start = addr - image->sym_vvar_start;
35901 - current->mm->context.vdso = (void __user *)text_start;
35902 + mm->context.vdso = text_start;
35903
35904 /*
35905 * MAYWRITE to allow gdb to COW and set breakpoints
35906 @@ -163,15 +165,12 @@ static int map_vdso(const struct vdso_image *image, bool calculate_addr)
35907 hpet_address >> PAGE_SHIFT,
35908 PAGE_SIZE,
35909 pgprot_noncached(PAGE_READONLY));
35910 -
35911 - if (ret)
35912 - goto up_fail;
35913 }
35914 #endif
35915
35916 up_fail:
35917 if (ret)
35918 - current->mm->context.vdso = NULL;
35919 + current->mm->context.vdso = 0;
35920
35921 up_write(&mm->mmap_sem);
35922 return ret;
35923 @@ -191,8 +190,8 @@ static int load_vdso32(void)
35924
35925 if (selected_vdso32->sym_VDSO32_SYSENTER_RETURN)
35926 current_thread_info()->sysenter_return =
35927 - current->mm->context.vdso +
35928 - selected_vdso32->sym_VDSO32_SYSENTER_RETURN;
35929 + (void __force_user *)(current->mm->context.vdso +
35930 + selected_vdso32->sym_VDSO32_SYSENTER_RETURN);
35931
35932 return 0;
35933 }
35934 @@ -201,9 +200,6 @@ static int load_vdso32(void)
35935 #ifdef CONFIG_X86_64
35936 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
35937 {
35938 - if (!vdso64_enabled)
35939 - return 0;
35940 -
35941 return map_vdso(&vdso_image_64, true);
35942 }
35943
35944 @@ -212,12 +208,8 @@ int compat_arch_setup_additional_pages(struct linux_binprm *bprm,
35945 int uses_interp)
35946 {
35947 #ifdef CONFIG_X86_X32_ABI
35948 - if (test_thread_flag(TIF_X32)) {
35949 - if (!vdso64_enabled)
35950 - return 0;
35951 -
35952 + if (test_thread_flag(TIF_X32))
35953 return map_vdso(&vdso_image_x32, true);
35954 - }
35955 #endif
35956
35957 return load_vdso32();
35958 @@ -231,15 +223,6 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
35959 #endif
35960
35961 #ifdef CONFIG_X86_64
35962 -static __init int vdso_setup(char *s)
35963 -{
35964 - vdso64_enabled = simple_strtoul(s, NULL, 0);
35965 - return 0;
35966 -}
35967 -__setup("vdso=", vdso_setup);
35968 -#endif
35969 -
35970 -#ifdef CONFIG_X86_64
35971 static void vgetcpu_cpu_init(void *arg)
35972 {
35973 int cpu = smp_processor_id();
35974 diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
35975 index e88fda8..76ce7ce 100644
35976 --- a/arch/x86/xen/Kconfig
35977 +++ b/arch/x86/xen/Kconfig
35978 @@ -9,6 +9,7 @@ config XEN
35979 select XEN_HAVE_PVMMU
35980 depends on X86_64 || (X86_32 && X86_PAE)
35981 depends on X86_TSC
35982 + depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_XEN
35983 help
35984 This is the Linux Xen port. Enabling this will allow the
35985 kernel to boot in a paravirtualized environment under the
35986 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
35987 index 46957ea..ef7b714 100644
35988 --- a/arch/x86/xen/enlighten.c
35989 +++ b/arch/x86/xen/enlighten.c
35990 @@ -125,8 +125,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
35991
35992 struct shared_info xen_dummy_shared_info;
35993
35994 -void *xen_initial_gdt;
35995 -
35996 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
35997 __read_mostly int xen_have_vector_callback;
35998 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
35999 @@ -544,8 +542,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
36000 {
36001 unsigned long va = dtr->address;
36002 unsigned int size = dtr->size + 1;
36003 - unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
36004 - unsigned long frames[pages];
36005 + unsigned long frames[65536 / PAGE_SIZE];
36006 int f;
36007
36008 /*
36009 @@ -593,8 +590,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
36010 {
36011 unsigned long va = dtr->address;
36012 unsigned int size = dtr->size + 1;
36013 - unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
36014 - unsigned long frames[pages];
36015 + unsigned long frames[(GDT_SIZE + PAGE_SIZE - 1) / PAGE_SIZE];
36016 int f;
36017
36018 /*
36019 @@ -602,7 +598,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
36020 * 8-byte entries, or 16 4k pages..
36021 */
36022
36023 - BUG_ON(size > 65536);
36024 + BUG_ON(size > GDT_SIZE);
36025 BUG_ON(va & ~PAGE_MASK);
36026
36027 for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
36028 @@ -1223,30 +1219,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
36029 #endif
36030 };
36031
36032 -static void xen_reboot(int reason)
36033 +static __noreturn void xen_reboot(int reason)
36034 {
36035 struct sched_shutdown r = { .reason = reason };
36036
36037 - if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
36038 - BUG();
36039 + HYPERVISOR_sched_op(SCHEDOP_shutdown, &r);
36040 + BUG();
36041 }
36042
36043 -static void xen_restart(char *msg)
36044 +static __noreturn void xen_restart(char *msg)
36045 {
36046 xen_reboot(SHUTDOWN_reboot);
36047 }
36048
36049 -static void xen_emergency_restart(void)
36050 +static __noreturn void xen_emergency_restart(void)
36051 {
36052 xen_reboot(SHUTDOWN_reboot);
36053 }
36054
36055 -static void xen_machine_halt(void)
36056 +static __noreturn void xen_machine_halt(void)
36057 {
36058 xen_reboot(SHUTDOWN_poweroff);
36059 }
36060
36061 -static void xen_machine_power_off(void)
36062 +static __noreturn void xen_machine_power_off(void)
36063 {
36064 if (pm_power_off)
36065 pm_power_off();
36066 @@ -1399,8 +1395,11 @@ static void __ref xen_setup_gdt(int cpu)
36067 pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
36068 pv_cpu_ops.load_gdt = xen_load_gdt_boot;
36069
36070 - setup_stack_canary_segment(0);
36071 - switch_to_new_gdt(0);
36072 + setup_stack_canary_segment(cpu);
36073 +#ifdef CONFIG_X86_64
36074 + load_percpu_segment(cpu);
36075 +#endif
36076 + switch_to_new_gdt(cpu);
36077
36078 pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
36079 pv_cpu_ops.load_gdt = xen_load_gdt;
36080 @@ -1515,7 +1514,17 @@ asmlinkage __visible void __init xen_start_kernel(void)
36081 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
36082
36083 /* Work out if we support NX */
36084 - x86_configure_nx();
36085 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
36086 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
36087 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
36088 + unsigned l, h;
36089 +
36090 + __supported_pte_mask |= _PAGE_NX;
36091 + rdmsr(MSR_EFER, l, h);
36092 + l |= EFER_NX;
36093 + wrmsr(MSR_EFER, l, h);
36094 + }
36095 +#endif
36096
36097 /* Get mfn list */
36098 xen_build_dynamic_phys_to_machine();
36099 @@ -1543,13 +1552,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
36100
36101 machine_ops = xen_machine_ops;
36102
36103 - /*
36104 - * The only reliable way to retain the initial address of the
36105 - * percpu gdt_page is to remember it here, so we can go and
36106 - * mark it RW later, when the initial percpu area is freed.
36107 - */
36108 - xen_initial_gdt = &per_cpu(gdt_page, 0);
36109 -
36110 xen_smp_init();
36111
36112 #ifdef CONFIG_ACPI_NUMA
36113 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
36114 index dd151b2..d5ab952 100644
36115 --- a/arch/x86/xen/mmu.c
36116 +++ b/arch/x86/xen/mmu.c
36117 @@ -379,7 +379,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
36118 return val;
36119 }
36120
36121 -static pteval_t pte_pfn_to_mfn(pteval_t val)
36122 +static pteval_t __intentional_overflow(-1) pte_pfn_to_mfn(pteval_t val)
36123 {
36124 if (val & _PAGE_PRESENT) {
36125 unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
36126 @@ -1835,7 +1835,11 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
36127 * L3_k[511] -> level2_fixmap_pgt */
36128 convert_pfn_mfn(level3_kernel_pgt);
36129
36130 + convert_pfn_mfn(level3_vmalloc_start_pgt);
36131 + convert_pfn_mfn(level3_vmalloc_end_pgt);
36132 + convert_pfn_mfn(level3_vmemmap_pgt);
36133 /* L3_k[511][506] -> level1_fixmap_pgt */
36134 + /* L3_k[511][507] -> level1_vsyscall_pgt */
36135 convert_pfn_mfn(level2_fixmap_pgt);
36136 }
36137 /* We get [511][511] and have Xen's version of level2_kernel_pgt */
36138 @@ -1860,11 +1864,18 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
36139 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
36140 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
36141 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
36142 + set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
36143 + set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
36144 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
36145 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
36146 set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
36147 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
36148 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
36149 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
36150 - set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO);
36151 + set_page_prot(level1_fixmap_pgt[0], PAGE_KERNEL_RO);
36152 + set_page_prot(level1_fixmap_pgt[1], PAGE_KERNEL_RO);
36153 + set_page_prot(level1_fixmap_pgt[2], PAGE_KERNEL_RO);
36154 + set_page_prot(level1_vsyscall_pgt, PAGE_KERNEL_RO);
36155
36156 /* Pin down new L4 */
36157 pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
36158 @@ -2048,6 +2059,7 @@ static void __init xen_post_allocator_init(void)
36159 pv_mmu_ops.set_pud = xen_set_pud;
36160 #if CONFIG_PGTABLE_LEVELS == 4
36161 pv_mmu_ops.set_pgd = xen_set_pgd;
36162 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
36163 #endif
36164
36165 /* This will work as long as patching hasn't happened yet
36166 @@ -2126,6 +2138,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
36167 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
36168 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
36169 .set_pgd = xen_set_pgd_hyper,
36170 + .set_pgd_batched = xen_set_pgd_hyper,
36171
36172 .alloc_pud = xen_alloc_pmd_init,
36173 .release_pud = xen_release_pmd_init,
36174 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
36175 index 8648438..18bac20 100644
36176 --- a/arch/x86/xen/smp.c
36177 +++ b/arch/x86/xen/smp.c
36178 @@ -284,17 +284,13 @@ static void __init xen_smp_prepare_boot_cpu(void)
36179
36180 if (xen_pv_domain()) {
36181 if (!xen_feature(XENFEAT_writable_page_tables))
36182 - /* We've switched to the "real" per-cpu gdt, so make
36183 - * sure the old memory can be recycled. */
36184 - make_lowmem_page_readwrite(xen_initial_gdt);
36185 -
36186 #ifdef CONFIG_X86_32
36187 /*
36188 * Xen starts us with XEN_FLAT_RING1_DS, but linux code
36189 * expects __USER_DS
36190 */
36191 - loadsegment(ds, __USER_DS);
36192 - loadsegment(es, __USER_DS);
36193 + loadsegment(ds, __KERNEL_DS);
36194 + loadsegment(es, __KERNEL_DS);
36195 #endif
36196
36197 xen_filter_cpu_maps();
36198 @@ -375,7 +371,7 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
36199 #ifdef CONFIG_X86_32
36200 /* Note: PVH is not yet supported on x86_32. */
36201 ctxt->user_regs.fs = __KERNEL_PERCPU;
36202 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
36203 + savesegment(gs, ctxt->user_regs.gs);
36204 #endif
36205 memset(&ctxt->fpu_ctxt, 0, sizeof(ctxt->fpu_ctxt));
36206
36207 @@ -383,8 +379,8 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
36208 ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle;
36209 ctxt->flags = VGCF_IN_KERNEL;
36210 ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */
36211 - ctxt->user_regs.ds = __USER_DS;
36212 - ctxt->user_regs.es = __USER_DS;
36213 + ctxt->user_regs.ds = __KERNEL_DS;
36214 + ctxt->user_regs.es = __KERNEL_DS;
36215 ctxt->user_regs.ss = __KERNEL_DS;
36216
36217 xen_copy_trap_info(ctxt->trap_ctxt);
36218 @@ -720,7 +716,7 @@ static const struct smp_ops xen_smp_ops __initconst = {
36219
36220 void __init xen_smp_init(void)
36221 {
36222 - smp_ops = xen_smp_ops;
36223 + memcpy((void *)&smp_ops, &xen_smp_ops, sizeof smp_ops);
36224 xen_fill_possible_map();
36225 }
36226
36227 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
36228 index fd92a64..1f72641 100644
36229 --- a/arch/x86/xen/xen-asm_32.S
36230 +++ b/arch/x86/xen/xen-asm_32.S
36231 @@ -99,7 +99,7 @@ ENTRY(xen_iret)
36232 pushw %fs
36233 movl $(__KERNEL_PERCPU), %eax
36234 movl %eax, %fs
36235 - movl %fs:xen_vcpu, %eax
36236 + mov PER_CPU_VAR(xen_vcpu), %eax
36237 POP_FS
36238 #else
36239 movl %ss:xen_vcpu, %eax
36240 diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
36241 index 8afdfcc..79239db 100644
36242 --- a/arch/x86/xen/xen-head.S
36243 +++ b/arch/x86/xen/xen-head.S
36244 @@ -41,6 +41,17 @@ ENTRY(startup_xen)
36245 #ifdef CONFIG_X86_32
36246 mov %esi,xen_start_info
36247 mov $init_thread_union+THREAD_SIZE,%esp
36248 +#ifdef CONFIG_SMP
36249 + movl $cpu_gdt_table,%edi
36250 + movl $__per_cpu_load,%eax
36251 + movw %ax,__KERNEL_PERCPU + 2(%edi)
36252 + rorl $16,%eax
36253 + movb %al,__KERNEL_PERCPU + 4(%edi)
36254 + movb %ah,__KERNEL_PERCPU + 7(%edi)
36255 + movl $__per_cpu_end - 1,%eax
36256 + subl $__per_cpu_start,%eax
36257 + movw %ax,__KERNEL_PERCPU + 0(%edi)
36258 +#endif
36259 #else
36260 mov %rsi,xen_start_info
36261 mov $init_thread_union+THREAD_SIZE,%rsp
36262 diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
36263 index 9e195c6..523ed36 100644
36264 --- a/arch/x86/xen/xen-ops.h
36265 +++ b/arch/x86/xen/xen-ops.h
36266 @@ -16,8 +16,6 @@ void xen_syscall_target(void);
36267 void xen_syscall32_target(void);
36268 #endif
36269
36270 -extern void *xen_initial_gdt;
36271 -
36272 struct trap_info;
36273 void xen_copy_trap_info(struct trap_info *traps);
36274
36275 diff --git a/arch/xtensa/variants/dc232b/include/variant/core.h b/arch/xtensa/variants/dc232b/include/variant/core.h
36276 index 525bd3d..ef888b1 100644
36277 --- a/arch/xtensa/variants/dc232b/include/variant/core.h
36278 +++ b/arch/xtensa/variants/dc232b/include/variant/core.h
36279 @@ -119,9 +119,9 @@
36280 ----------------------------------------------------------------------*/
36281
36282 #define XCHAL_ICACHE_LINESIZE 32 /* I-cache line size in bytes */
36283 -#define XCHAL_DCACHE_LINESIZE 32 /* D-cache line size in bytes */
36284 #define XCHAL_ICACHE_LINEWIDTH 5 /* log2(I line size in bytes) */
36285 #define XCHAL_DCACHE_LINEWIDTH 5 /* log2(D line size in bytes) */
36286 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
36287
36288 #define XCHAL_ICACHE_SIZE 16384 /* I-cache size in bytes or 0 */
36289 #define XCHAL_DCACHE_SIZE 16384 /* D-cache size in bytes or 0 */
36290 diff --git a/arch/xtensa/variants/fsf/include/variant/core.h b/arch/xtensa/variants/fsf/include/variant/core.h
36291 index 2f33760..835e50a 100644
36292 --- a/arch/xtensa/variants/fsf/include/variant/core.h
36293 +++ b/arch/xtensa/variants/fsf/include/variant/core.h
36294 @@ -11,6 +11,7 @@
36295 #ifndef _XTENSA_CORE_H
36296 #define _XTENSA_CORE_H
36297
36298 +#include <linux/const.h>
36299
36300 /****************************************************************************
36301 Parameters Useful for Any Code, USER or PRIVILEGED
36302 @@ -112,9 +113,9 @@
36303 ----------------------------------------------------------------------*/
36304
36305 #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
36306 -#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
36307 #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
36308 #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
36309 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
36310
36311 #define XCHAL_ICACHE_SIZE 8192 /* I-cache size in bytes or 0 */
36312 #define XCHAL_DCACHE_SIZE 8192 /* D-cache size in bytes or 0 */
36313 diff --git a/block/bio.c b/block/bio.c
36314 index f66a4ea..73ddf55 100644
36315 --- a/block/bio.c
36316 +++ b/block/bio.c
36317 @@ -1172,7 +1172,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
36318 /*
36319 * Overflow, abort
36320 */
36321 - if (end < start)
36322 + if (end < start || end - start > INT_MAX - nr_pages)
36323 return ERR_PTR(-EINVAL);
36324
36325 nr_pages += end - start;
36326 @@ -1297,7 +1297,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
36327 /*
36328 * Overflow, abort
36329 */
36330 - if (end < start)
36331 + if (end < start || end - start > INT_MAX - nr_pages)
36332 return ERR_PTR(-EINVAL);
36333
36334 nr_pages += end - start;
36335 diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
36336 index 0736729..2ec3b48 100644
36337 --- a/block/blk-iopoll.c
36338 +++ b/block/blk-iopoll.c
36339 @@ -74,7 +74,7 @@ void blk_iopoll_complete(struct blk_iopoll *iop)
36340 }
36341 EXPORT_SYMBOL(blk_iopoll_complete);
36342
36343 -static void blk_iopoll_softirq(struct softirq_action *h)
36344 +static __latent_entropy void blk_iopoll_softirq(void)
36345 {
36346 struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll);
36347 int rearm = 0, budget = blk_iopoll_budget;
36348 diff --git a/block/blk-map.c b/block/blk-map.c
36349 index da310a1..213b5c9 100644
36350 --- a/block/blk-map.c
36351 +++ b/block/blk-map.c
36352 @@ -192,7 +192,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
36353 if (!len || !kbuf)
36354 return -EINVAL;
36355
36356 - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
36357 + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
36358 if (do_copy)
36359 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
36360 else
36361 diff --git a/block/blk-mq.c b/block/blk-mq.c
36362 index 594eea0..2dc1fd6 100644
36363 --- a/block/blk-mq.c
36364 +++ b/block/blk-mq.c
36365 @@ -1968,7 +1968,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
36366 goto err_hctxs;
36367
36368 setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
36369 - blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
36370 + blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
36371
36372 q->nr_queues = nr_cpu_ids;
36373 q->nr_hw_queues = set->nr_hw_queues;
36374 diff --git a/block/blk-softirq.c b/block/blk-softirq.c
36375 index 53b1737..08177d2e 100644
36376 --- a/block/blk-softirq.c
36377 +++ b/block/blk-softirq.c
36378 @@ -18,7 +18,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
36379 * Softirq action handler - move entries to local list and loop over them
36380 * while passing them to the queue registered handler.
36381 */
36382 -static void blk_done_softirq(struct softirq_action *h)
36383 +static __latent_entropy void blk_done_softirq(void)
36384 {
36385 struct list_head *cpu_list, local_list;
36386
36387 diff --git a/block/bsg.c b/block/bsg.c
36388 index d214e92..9649863 100644
36389 --- a/block/bsg.c
36390 +++ b/block/bsg.c
36391 @@ -140,16 +140,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
36392 struct sg_io_v4 *hdr, struct bsg_device *bd,
36393 fmode_t has_write_perm)
36394 {
36395 + unsigned char tmpcmd[sizeof(rq->__cmd)];
36396 + unsigned char *cmdptr;
36397 +
36398 if (hdr->request_len > BLK_MAX_CDB) {
36399 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
36400 if (!rq->cmd)
36401 return -ENOMEM;
36402 - }
36403 + cmdptr = rq->cmd;
36404 + } else
36405 + cmdptr = tmpcmd;
36406
36407 - if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
36408 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
36409 hdr->request_len))
36410 return -EFAULT;
36411
36412 + if (cmdptr != rq->cmd)
36413 + memcpy(rq->cmd, cmdptr, hdr->request_len);
36414 +
36415 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
36416 if (blk_verify_command(rq->cmd, has_write_perm))
36417 return -EPERM;
36418 diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
36419 index f678c73..f35aa18 100644
36420 --- a/block/compat_ioctl.c
36421 +++ b/block/compat_ioctl.c
36422 @@ -156,7 +156,7 @@ static int compat_cdrom_generic_command(struct block_device *bdev, fmode_t mode,
36423 cgc = compat_alloc_user_space(sizeof(*cgc));
36424 cgc32 = compat_ptr(arg);
36425
36426 - if (copy_in_user(&cgc->cmd, &cgc32->cmd, sizeof(cgc->cmd)) ||
36427 + if (copy_in_user(cgc->cmd, cgc32->cmd, sizeof(cgc->cmd)) ||
36428 get_user(data, &cgc32->buffer) ||
36429 put_user(compat_ptr(data), &cgc->buffer) ||
36430 copy_in_user(&cgc->buflen, &cgc32->buflen,
36431 @@ -341,7 +341,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
36432 err |= __get_user(f->spec1, &uf->spec1);
36433 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
36434 err |= __get_user(name, &uf->name);
36435 - f->name = compat_ptr(name);
36436 + f->name = (void __force_kernel *)compat_ptr(name);
36437 if (err) {
36438 err = -EFAULT;
36439 goto out;
36440 diff --git a/block/genhd.c b/block/genhd.c
36441 index ea982ea..86e0f9e 100644
36442 --- a/block/genhd.c
36443 +++ b/block/genhd.c
36444 @@ -469,21 +469,24 @@ static char *bdevt_str(dev_t devt, char *buf)
36445
36446 /*
36447 * Register device numbers dev..(dev+range-1)
36448 - * range must be nonzero
36449 + * Noop if @range is zero.
36450 * The hash chain is sorted on range, so that subranges can override.
36451 */
36452 void blk_register_region(dev_t devt, unsigned long range, struct module *module,
36453 struct kobject *(*probe)(dev_t, int *, void *),
36454 int (*lock)(dev_t, void *), void *data)
36455 {
36456 - kobj_map(bdev_map, devt, range, module, probe, lock, data);
36457 + if (range)
36458 + kobj_map(bdev_map, devt, range, module, probe, lock, data);
36459 }
36460
36461 EXPORT_SYMBOL(blk_register_region);
36462
36463 +/* undo blk_register_region(), noop if @range is zero */
36464 void blk_unregister_region(dev_t devt, unsigned long range)
36465 {
36466 - kobj_unmap(bdev_map, devt, range);
36467 + if (range)
36468 + kobj_unmap(bdev_map, devt, range);
36469 }
36470
36471 EXPORT_SYMBOL(blk_unregister_region);
36472 diff --git a/block/partitions/efi.c b/block/partitions/efi.c
36473 index 26cb624..a49c3a5 100644
36474 --- a/block/partitions/efi.c
36475 +++ b/block/partitions/efi.c
36476 @@ -293,14 +293,14 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
36477 if (!gpt)
36478 return NULL;
36479
36480 + if (!le32_to_cpu(gpt->num_partition_entries))
36481 + return NULL;
36482 + pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
36483 + if (!pte)
36484 + return NULL;
36485 +
36486 count = le32_to_cpu(gpt->num_partition_entries) *
36487 le32_to_cpu(gpt->sizeof_partition_entry);
36488 - if (!count)
36489 - return NULL;
36490 - pte = kmalloc(count, GFP_KERNEL);
36491 - if (!pte)
36492 - return NULL;
36493 -
36494 if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
36495 (u8 *) pte, count) < count) {
36496 kfree(pte);
36497 diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
36498 index 55b6f15..b602c9a 100644
36499 --- a/block/scsi_ioctl.c
36500 +++ b/block/scsi_ioctl.c
36501 @@ -67,7 +67,7 @@ static int scsi_get_bus(struct request_queue *q, int __user *p)
36502 return put_user(0, p);
36503 }
36504
36505 -static int sg_get_timeout(struct request_queue *q)
36506 +static int __intentional_overflow(-1) sg_get_timeout(struct request_queue *q)
36507 {
36508 return jiffies_to_clock_t(q->sg_timeout);
36509 }
36510 @@ -227,8 +227,20 @@ EXPORT_SYMBOL(blk_verify_command);
36511 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
36512 struct sg_io_hdr *hdr, fmode_t mode)
36513 {
36514 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
36515 + unsigned char tmpcmd[sizeof(rq->__cmd)];
36516 + unsigned char *cmdptr;
36517 +
36518 + if (rq->cmd != rq->__cmd)
36519 + cmdptr = rq->cmd;
36520 + else
36521 + cmdptr = tmpcmd;
36522 +
36523 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
36524 return -EFAULT;
36525 +
36526 + if (cmdptr != rq->cmd)
36527 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
36528 +
36529 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
36530 return -EPERM;
36531
36532 @@ -420,6 +432,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
36533 int err;
36534 unsigned int in_len, out_len, bytes, opcode, cmdlen;
36535 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
36536 + unsigned char tmpcmd[sizeof(rq->__cmd)];
36537 + unsigned char *cmdptr;
36538
36539 if (!sic)
36540 return -EINVAL;
36541 @@ -458,9 +472,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
36542 */
36543 err = -EFAULT;
36544 rq->cmd_len = cmdlen;
36545 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
36546 +
36547 + if (rq->cmd != rq->__cmd)
36548 + cmdptr = rq->cmd;
36549 + else
36550 + cmdptr = tmpcmd;
36551 +
36552 + if (copy_from_user(cmdptr, sic->data, cmdlen))
36553 goto error;
36554
36555 + if (rq->cmd != cmdptr)
36556 + memcpy(rq->cmd, cmdptr, cmdlen);
36557 +
36558 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
36559 goto error;
36560
36561 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
36562 index b0602ba..fb71850 100644
36563 --- a/crypto/cryptd.c
36564 +++ b/crypto/cryptd.c
36565 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
36566
36567 struct cryptd_blkcipher_request_ctx {
36568 crypto_completion_t complete;
36569 -};
36570 +} __no_const;
36571
36572 struct cryptd_hash_ctx {
36573 struct crypto_shash *child;
36574 @@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
36575
36576 struct cryptd_aead_request_ctx {
36577 crypto_completion_t complete;
36578 -};
36579 +} __no_const;
36580
36581 static void cryptd_queue_worker(struct work_struct *work);
36582
36583 diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
36584 index c305d41..a96de79 100644
36585 --- a/crypto/pcrypt.c
36586 +++ b/crypto/pcrypt.c
36587 @@ -440,7 +440,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
36588 int ret;
36589
36590 pinst->kobj.kset = pcrypt_kset;
36591 - ret = kobject_add(&pinst->kobj, NULL, name);
36592 + ret = kobject_add(&pinst->kobj, NULL, "%s", name);
36593 if (!ret)
36594 kobject_uevent(&pinst->kobj, KOBJ_ADD);
36595
36596 diff --git a/crypto/zlib.c b/crypto/zlib.c
36597 index 0eefa9d..0fa3d29 100644
36598 --- a/crypto/zlib.c
36599 +++ b/crypto/zlib.c
36600 @@ -95,10 +95,10 @@ static int zlib_compress_setup(struct crypto_pcomp *tfm, void *params,
36601 zlib_comp_exit(ctx);
36602
36603 window_bits = tb[ZLIB_COMP_WINDOWBITS]
36604 - ? nla_get_u32(tb[ZLIB_COMP_WINDOWBITS])
36605 + ? nla_get_s32(tb[ZLIB_COMP_WINDOWBITS])
36606 : MAX_WBITS;
36607 mem_level = tb[ZLIB_COMP_MEMLEVEL]
36608 - ? nla_get_u32(tb[ZLIB_COMP_MEMLEVEL])
36609 + ? nla_get_s32(tb[ZLIB_COMP_MEMLEVEL])
36610 : DEF_MEM_LEVEL;
36611
36612 workspacesize = zlib_deflate_workspacesize(window_bits, mem_level);
36613 diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
36614 index 3b37676..898edfa 100644
36615 --- a/drivers/acpi/acpica/hwxfsleep.c
36616 +++ b/drivers/acpi/acpica/hwxfsleep.c
36617 @@ -63,11 +63,12 @@ static acpi_status acpi_hw_sleep_dispatch(u8 sleep_state, u32 function_id);
36618 /* Legacy functions are optional, based upon ACPI_REDUCED_HARDWARE */
36619
36620 static struct acpi_sleep_functions acpi_sleep_dispatch[] = {
36621 - {ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_sleep),
36622 - acpi_hw_extended_sleep},
36623 - {ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake_prep),
36624 - acpi_hw_extended_wake_prep},
36625 - {ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake), acpi_hw_extended_wake}
36626 + {.legacy_function = ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_sleep),
36627 + .extended_function = acpi_hw_extended_sleep},
36628 + {.legacy_function = ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake_prep),
36629 + .extended_function = acpi_hw_extended_wake_prep},
36630 + {.legacy_function = ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake),
36631 + .extended_function = acpi_hw_extended_wake}
36632 };
36633
36634 /*
36635 diff --git a/drivers/acpi/apei/apei-internal.h b/drivers/acpi/apei/apei-internal.h
36636 index 16129c7..8b675cd 100644
36637 --- a/drivers/acpi/apei/apei-internal.h
36638 +++ b/drivers/acpi/apei/apei-internal.h
36639 @@ -19,7 +19,7 @@ typedef int (*apei_exec_ins_func_t)(struct apei_exec_context *ctx,
36640 struct apei_exec_ins_type {
36641 u32 flags;
36642 apei_exec_ins_func_t run;
36643 -};
36644 +} __do_const;
36645
36646 struct apei_exec_context {
36647 u32 ip;
36648 diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
36649 index e82d097..0c855c1 100644
36650 --- a/drivers/acpi/apei/ghes.c
36651 +++ b/drivers/acpi/apei/ghes.c
36652 @@ -478,7 +478,7 @@ static void __ghes_print_estatus(const char *pfx,
36653 const struct acpi_hest_generic *generic,
36654 const struct acpi_hest_generic_status *estatus)
36655 {
36656 - static atomic_t seqno;
36657 + static atomic_unchecked_t seqno;
36658 unsigned int curr_seqno;
36659 char pfx_seq[64];
36660
36661 @@ -489,7 +489,7 @@ static void __ghes_print_estatus(const char *pfx,
36662 else
36663 pfx = KERN_ERR;
36664 }
36665 - curr_seqno = atomic_inc_return(&seqno);
36666 + curr_seqno = atomic_inc_return_unchecked(&seqno);
36667 snprintf(pfx_seq, sizeof(pfx_seq), "%s{%u}" HW_ERR, pfx, curr_seqno);
36668 printk("%s""Hardware error from APEI Generic Hardware Error Source: %d\n",
36669 pfx_seq, generic->header.source_id);
36670 diff --git a/drivers/acpi/bgrt.c b/drivers/acpi/bgrt.c
36671 index a83e3c6..c3d617f 100644
36672 --- a/drivers/acpi/bgrt.c
36673 +++ b/drivers/acpi/bgrt.c
36674 @@ -86,8 +86,10 @@ static int __init bgrt_init(void)
36675 if (!bgrt_image)
36676 return -ENODEV;
36677
36678 - bin_attr_image.private = bgrt_image;
36679 - bin_attr_image.size = bgrt_image_size;
36680 + pax_open_kernel();
36681 + *(void **)&bin_attr_image.private = bgrt_image;
36682 + *(size_t *)&bin_attr_image.size = bgrt_image_size;
36683 + pax_close_kernel();
36684
36685 bgrt_kobj = kobject_create_and_add("bgrt", acpi_kobj);
36686 if (!bgrt_kobj)
36687 diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
36688 index 1d17919..315e955 100644
36689 --- a/drivers/acpi/blacklist.c
36690 +++ b/drivers/acpi/blacklist.c
36691 @@ -51,7 +51,7 @@ struct acpi_blacklist_item {
36692 u32 is_critical_error;
36693 };
36694
36695 -static struct dmi_system_id acpi_osi_dmi_table[] __initdata;
36696 +static const struct dmi_system_id acpi_osi_dmi_table[] __initconst;
36697
36698 /*
36699 * POLICY: If *anything* doesn't work, put it on the blacklist.
36700 @@ -163,7 +163,7 @@ static int __init dmi_disable_osi_win8(const struct dmi_system_id *d)
36701 return 0;
36702 }
36703
36704 -static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
36705 +static const struct dmi_system_id acpi_osi_dmi_table[] __initconst = {
36706 {
36707 .callback = dmi_disable_osi_vista,
36708 .ident = "Fujitsu Siemens",
36709 diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
36710 index 513e7230e..802015a 100644
36711 --- a/drivers/acpi/bus.c
36712 +++ b/drivers/acpi/bus.c
36713 @@ -67,7 +67,7 @@ static int set_copy_dsdt(const struct dmi_system_id *id)
36714 }
36715 #endif
36716
36717 -static struct dmi_system_id dsdt_dmi_table[] __initdata = {
36718 +static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
36719 /*
36720 * Invoke DSDT corruption work-around on all Toshiba Satellite.
36721 * https://bugzilla.kernel.org/show_bug.cgi?id=14679
36722 @@ -83,7 +83,7 @@ static struct dmi_system_id dsdt_dmi_table[] __initdata = {
36723 {}
36724 };
36725 #else
36726 -static struct dmi_system_id dsdt_dmi_table[] __initdata = {
36727 +static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
36728 {}
36729 };
36730 #endif
36731 diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
36732 index c68e724..e863008 100644
36733 --- a/drivers/acpi/custom_method.c
36734 +++ b/drivers/acpi/custom_method.c
36735 @@ -29,6 +29,10 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
36736 struct acpi_table_header table;
36737 acpi_status status;
36738
36739 +#ifdef CONFIG_GRKERNSEC_KMEM
36740 + return -EPERM;
36741 +#endif
36742 +
36743 if (!(*ppos)) {
36744 /* parse the table header to get the table length */
36745 if (count <= sizeof(struct acpi_table_header))
36746 diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
36747 index 8217e0b..3294cb6 100644
36748 --- a/drivers/acpi/device_pm.c
36749 +++ b/drivers/acpi/device_pm.c
36750 @@ -1026,6 +1026,8 @@ EXPORT_SYMBOL_GPL(acpi_subsys_freeze);
36751
36752 #endif /* CONFIG_PM_SLEEP */
36753
36754 +static void acpi_dev_pm_detach(struct device *dev, bool power_off);
36755 +
36756 static struct dev_pm_domain acpi_general_pm_domain = {
36757 .ops = {
36758 .runtime_suspend = acpi_subsys_runtime_suspend,
36759 @@ -1042,6 +1044,7 @@ static struct dev_pm_domain acpi_general_pm_domain = {
36760 .restore_early = acpi_subsys_resume_early,
36761 #endif
36762 },
36763 + .detach = acpi_dev_pm_detach
36764 };
36765
36766 /**
36767 @@ -1111,7 +1114,6 @@ int acpi_dev_pm_attach(struct device *dev, bool power_on)
36768 acpi_device_wakeup(adev, ACPI_STATE_S0, false);
36769 }
36770
36771 - dev->pm_domain->detach = acpi_dev_pm_detach;
36772 return 0;
36773 }
36774 EXPORT_SYMBOL_GPL(acpi_dev_pm_attach);
36775 diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
36776 index 5e8fed4..d9bb545 100644
36777 --- a/drivers/acpi/ec.c
36778 +++ b/drivers/acpi/ec.c
36779 @@ -1293,7 +1293,7 @@ static int ec_clear_on_resume(const struct dmi_system_id *id)
36780 return 0;
36781 }
36782
36783 -static struct dmi_system_id ec_dmi_table[] __initdata = {
36784 +static const struct dmi_system_id ec_dmi_table[] __initconst = {
36785 {
36786 ec_skip_dsdt_scan, "Compal JFL92", {
36787 DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
36788 diff --git a/drivers/acpi/pci_slot.c b/drivers/acpi/pci_slot.c
36789 index 139d9e4..9a9d799 100644
36790 --- a/drivers/acpi/pci_slot.c
36791 +++ b/drivers/acpi/pci_slot.c
36792 @@ -195,7 +195,7 @@ static int do_sta_before_sun(const struct dmi_system_id *d)
36793 return 0;
36794 }
36795
36796 -static struct dmi_system_id acpi_pci_slot_dmi_table[] __initdata = {
36797 +static const struct dmi_system_id acpi_pci_slot_dmi_table[] __initconst = {
36798 /*
36799 * Fujitsu Primequest machines will return 1023 to indicate an
36800 * error if the _SUN method is evaluated on SxFy objects that
36801 diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
36802 index d9f7158..168e742 100644
36803 --- a/drivers/acpi/processor_driver.c
36804 +++ b/drivers/acpi/processor_driver.c
36805 @@ -159,7 +159,7 @@ static int acpi_cpu_soft_notify(struct notifier_block *nfb,
36806 return NOTIFY_OK;
36807 }
36808
36809 -static struct notifier_block __refdata acpi_cpu_notifier = {
36810 +static struct notifier_block __refconst acpi_cpu_notifier = {
36811 .notifier_call = acpi_cpu_soft_notify,
36812 };
36813
36814 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
36815 index 39e0c8e..b5ae20c 100644
36816 --- a/drivers/acpi/processor_idle.c
36817 +++ b/drivers/acpi/processor_idle.c
36818 @@ -910,7 +910,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
36819 {
36820 int i, count = CPUIDLE_DRIVER_STATE_START;
36821 struct acpi_processor_cx *cx;
36822 - struct cpuidle_state *state;
36823 + cpuidle_state_no_const *state;
36824 struct cpuidle_driver *drv = &acpi_idle_driver;
36825
36826 if (!pr->flags.power_setup_done)
36827 diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
36828 index e5dd808..1eceed1 100644
36829 --- a/drivers/acpi/processor_pdc.c
36830 +++ b/drivers/acpi/processor_pdc.c
36831 @@ -176,7 +176,7 @@ static int __init set_no_mwait(const struct dmi_system_id *id)
36832 return 0;
36833 }
36834
36835 -static struct dmi_system_id processor_idle_dmi_table[] __initdata = {
36836 +static const struct dmi_system_id processor_idle_dmi_table[] __initconst = {
36837 {
36838 set_no_mwait, "Extensa 5220", {
36839 DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
36840 diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
36841 index 2f0d4db..b9e9b15 100644
36842 --- a/drivers/acpi/sleep.c
36843 +++ b/drivers/acpi/sleep.c
36844 @@ -148,7 +148,7 @@ static int __init init_nvs_nosave(const struct dmi_system_id *d)
36845 return 0;
36846 }
36847
36848 -static struct dmi_system_id acpisleep_dmi_table[] __initdata = {
36849 +static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
36850 {
36851 .callback = init_old_suspend_ordering,
36852 .ident = "Abit KN9 (nForce4 variant)",
36853 diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
36854 index 0876d77b..3ba0127 100644
36855 --- a/drivers/acpi/sysfs.c
36856 +++ b/drivers/acpi/sysfs.c
36857 @@ -423,11 +423,11 @@ static u32 num_counters;
36858 static struct attribute **all_attrs;
36859 static u32 acpi_gpe_count;
36860
36861 -static struct attribute_group interrupt_stats_attr_group = {
36862 +static attribute_group_no_const interrupt_stats_attr_group = {
36863 .name = "interrupts",
36864 };
36865
36866 -static struct kobj_attribute *counter_attrs;
36867 +static kobj_attribute_no_const *counter_attrs;
36868
36869 static void delete_gpe_attr_array(void)
36870 {
36871 diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
36872 index d24fa19..782f1e6 100644
36873 --- a/drivers/acpi/thermal.c
36874 +++ b/drivers/acpi/thermal.c
36875 @@ -1209,7 +1209,7 @@ static int thermal_psv(const struct dmi_system_id *d) {
36876 return 0;
36877 }
36878
36879 -static struct dmi_system_id thermal_dmi_table[] __initdata = {
36880 +static const struct dmi_system_id thermal_dmi_table[] __initconst = {
36881 /*
36882 * Award BIOS on this AOpen makes thermal control almost worthless.
36883 * http://bugzilla.kernel.org/show_bug.cgi?id=8842
36884 diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
36885 index cc79d3f..28adb33 100644
36886 --- a/drivers/acpi/video.c
36887 +++ b/drivers/acpi/video.c
36888 @@ -431,7 +431,7 @@ static int __init video_enable_native_backlight(const struct dmi_system_id *d)
36889 return 0;
36890 }
36891
36892 -static struct dmi_system_id video_dmi_table[] __initdata = {
36893 +static const struct dmi_system_id video_dmi_table[] __initconst = {
36894 /*
36895 * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
36896 */
36897 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
36898 index 287c4ba..6a600bc 100644
36899 --- a/drivers/ata/libahci.c
36900 +++ b/drivers/ata/libahci.c
36901 @@ -1252,7 +1252,7 @@ int ahci_kick_engine(struct ata_port *ap)
36902 }
36903 EXPORT_SYMBOL_GPL(ahci_kick_engine);
36904
36905 -static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
36906 +static int __intentional_overflow(-1) ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
36907 struct ata_taskfile *tf, int is_cmd, u16 flags,
36908 unsigned long timeout_msec)
36909 {
36910 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
36911 index 577849c..920847c 100644
36912 --- a/drivers/ata/libata-core.c
36913 +++ b/drivers/ata/libata-core.c
36914 @@ -102,7 +102,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
36915 static void ata_dev_xfermask(struct ata_device *dev);
36916 static unsigned long ata_dev_blacklisted(const struct ata_device *dev);
36917
36918 -atomic_t ata_print_id = ATOMIC_INIT(0);
36919 +atomic_unchecked_t ata_print_id = ATOMIC_INIT(0);
36920
36921 struct ata_force_param {
36922 const char *name;
36923 @@ -4801,7 +4801,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
36924 struct ata_port *ap;
36925 unsigned int tag;
36926
36927 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36928 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36929 ap = qc->ap;
36930
36931 qc->flags = 0;
36932 @@ -4818,7 +4818,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
36933 struct ata_port *ap;
36934 struct ata_link *link;
36935
36936 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36937 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36938 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
36939 ap = qc->ap;
36940 link = qc->dev->link;
36941 @@ -5925,6 +5925,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
36942 return;
36943
36944 spin_lock(&lock);
36945 + pax_open_kernel();
36946
36947 for (cur = ops->inherits; cur; cur = cur->inherits) {
36948 void **inherit = (void **)cur;
36949 @@ -5938,8 +5939,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
36950 if (IS_ERR(*pp))
36951 *pp = NULL;
36952
36953 - ops->inherits = NULL;
36954 + *(struct ata_port_operations **)&ops->inherits = NULL;
36955
36956 + pax_close_kernel();
36957 spin_unlock(&lock);
36958 }
36959
36960 @@ -6135,7 +6137,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
36961
36962 /* give ports names and add SCSI hosts */
36963 for (i = 0; i < host->n_ports; i++) {
36964 - host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
36965 + host->ports[i]->print_id = atomic_inc_return_unchecked(&ata_print_id);
36966 host->ports[i]->local_port_no = i + 1;
36967 }
36968
36969 diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
36970 index 3131adc..93e7aa0 100644
36971 --- a/drivers/ata/libata-scsi.c
36972 +++ b/drivers/ata/libata-scsi.c
36973 @@ -4209,7 +4209,7 @@ int ata_sas_port_init(struct ata_port *ap)
36974
36975 if (rc)
36976 return rc;
36977 - ap->print_id = atomic_inc_return(&ata_print_id);
36978 + ap->print_id = atomic_inc_return_unchecked(&ata_print_id);
36979 return 0;
36980 }
36981 EXPORT_SYMBOL_GPL(ata_sas_port_init);
36982 diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
36983 index a998a17..8de4bf4 100644
36984 --- a/drivers/ata/libata.h
36985 +++ b/drivers/ata/libata.h
36986 @@ -53,7 +53,7 @@ enum {
36987 ATA_DNXFER_QUIET = (1 << 31),
36988 };
36989
36990 -extern atomic_t ata_print_id;
36991 +extern atomic_unchecked_t ata_print_id;
36992 extern int atapi_passthru16;
36993 extern int libata_fua;
36994 extern int libata_noacpi;
36995 diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
36996 index a9b0c82..207d97d 100644
36997 --- a/drivers/ata/pata_arasan_cf.c
36998 +++ b/drivers/ata/pata_arasan_cf.c
36999 @@ -865,7 +865,9 @@ static int arasan_cf_probe(struct platform_device *pdev)
37000 /* Handle platform specific quirks */
37001 if (quirk) {
37002 if (quirk & CF_BROKEN_PIO) {
37003 - ap->ops->set_piomode = NULL;
37004 + pax_open_kernel();
37005 + *(void **)&ap->ops->set_piomode = NULL;
37006 + pax_close_kernel();
37007 ap->pio_mask = 0;
37008 }
37009 if (quirk & CF_BROKEN_MWDMA)
37010 diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
37011 index f9b983a..887b9d8 100644
37012 --- a/drivers/atm/adummy.c
37013 +++ b/drivers/atm/adummy.c
37014 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
37015 vcc->pop(vcc, skb);
37016 else
37017 dev_kfree_skb_any(skb);
37018 - atomic_inc(&vcc->stats->tx);
37019 + atomic_inc_unchecked(&vcc->stats->tx);
37020
37021 return 0;
37022 }
37023 diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
37024 index f1a9198..f466a4a 100644
37025 --- a/drivers/atm/ambassador.c
37026 +++ b/drivers/atm/ambassador.c
37027 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
37028 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
37029
37030 // VC layer stats
37031 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
37032 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
37033
37034 // free the descriptor
37035 kfree (tx_descr);
37036 @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
37037 dump_skb ("<<<", vc, skb);
37038
37039 // VC layer stats
37040 - atomic_inc(&atm_vcc->stats->rx);
37041 + atomic_inc_unchecked(&atm_vcc->stats->rx);
37042 __net_timestamp(skb);
37043 // end of our responsibility
37044 atm_vcc->push (atm_vcc, skb);
37045 @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
37046 } else {
37047 PRINTK (KERN_INFO, "dropped over-size frame");
37048 // should we count this?
37049 - atomic_inc(&atm_vcc->stats->rx_drop);
37050 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
37051 }
37052
37053 } else {
37054 @@ -1338,7 +1338,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
37055 }
37056
37057 if (check_area (skb->data, skb->len)) {
37058 - atomic_inc(&atm_vcc->stats->tx_err);
37059 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
37060 return -ENOMEM; // ?
37061 }
37062
37063 diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
37064 index 480fa6f..947067c 100644
37065 --- a/drivers/atm/atmtcp.c
37066 +++ b/drivers/atm/atmtcp.c
37067 @@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
37068 if (vcc->pop) vcc->pop(vcc,skb);
37069 else dev_kfree_skb(skb);
37070 if (dev_data) return 0;
37071 - atomic_inc(&vcc->stats->tx_err);
37072 + atomic_inc_unchecked(&vcc->stats->tx_err);
37073 return -ENOLINK;
37074 }
37075 size = skb->len+sizeof(struct atmtcp_hdr);
37076 @@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
37077 if (!new_skb) {
37078 if (vcc->pop) vcc->pop(vcc,skb);
37079 else dev_kfree_skb(skb);
37080 - atomic_inc(&vcc->stats->tx_err);
37081 + atomic_inc_unchecked(&vcc->stats->tx_err);
37082 return -ENOBUFS;
37083 }
37084 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
37085 @@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
37086 if (vcc->pop) vcc->pop(vcc,skb);
37087 else dev_kfree_skb(skb);
37088 out_vcc->push(out_vcc,new_skb);
37089 - atomic_inc(&vcc->stats->tx);
37090 - atomic_inc(&out_vcc->stats->rx);
37091 + atomic_inc_unchecked(&vcc->stats->tx);
37092 + atomic_inc_unchecked(&out_vcc->stats->rx);
37093 return 0;
37094 }
37095
37096 @@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
37097 read_unlock(&vcc_sklist_lock);
37098 if (!out_vcc) {
37099 result = -EUNATCH;
37100 - atomic_inc(&vcc->stats->tx_err);
37101 + atomic_inc_unchecked(&vcc->stats->tx_err);
37102 goto done;
37103 }
37104 skb_pull(skb,sizeof(struct atmtcp_hdr));
37105 @@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
37106 __net_timestamp(new_skb);
37107 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
37108 out_vcc->push(out_vcc,new_skb);
37109 - atomic_inc(&vcc->stats->tx);
37110 - atomic_inc(&out_vcc->stats->rx);
37111 + atomic_inc_unchecked(&vcc->stats->tx);
37112 + atomic_inc_unchecked(&out_vcc->stats->rx);
37113 done:
37114 if (vcc->pop) vcc->pop(vcc,skb);
37115 else dev_kfree_skb(skb);
37116 diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
37117 index 6339efd..2b441d5 100644
37118 --- a/drivers/atm/eni.c
37119 +++ b/drivers/atm/eni.c
37120 @@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
37121 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
37122 vcc->dev->number);
37123 length = 0;
37124 - atomic_inc(&vcc->stats->rx_err);
37125 + atomic_inc_unchecked(&vcc->stats->rx_err);
37126 }
37127 else {
37128 length = ATM_CELL_SIZE-1; /* no HEC */
37129 @@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
37130 size);
37131 }
37132 eff = length = 0;
37133 - atomic_inc(&vcc->stats->rx_err);
37134 + atomic_inc_unchecked(&vcc->stats->rx_err);
37135 }
37136 else {
37137 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
37138 @@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
37139 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
37140 vcc->dev->number,vcc->vci,length,size << 2,descr);
37141 length = eff = 0;
37142 - atomic_inc(&vcc->stats->rx_err);
37143 + atomic_inc_unchecked(&vcc->stats->rx_err);
37144 }
37145 }
37146 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
37147 @@ -770,7 +770,7 @@ rx_dequeued++;
37148 vcc->push(vcc,skb);
37149 pushed++;
37150 }
37151 - atomic_inc(&vcc->stats->rx);
37152 + atomic_inc_unchecked(&vcc->stats->rx);
37153 }
37154 wake_up(&eni_dev->rx_wait);
37155 }
37156 @@ -1230,7 +1230,7 @@ static void dequeue_tx(struct atm_dev *dev)
37157 DMA_TO_DEVICE);
37158 if (vcc->pop) vcc->pop(vcc,skb);
37159 else dev_kfree_skb_irq(skb);
37160 - atomic_inc(&vcc->stats->tx);
37161 + atomic_inc_unchecked(&vcc->stats->tx);
37162 wake_up(&eni_dev->tx_wait);
37163 dma_complete++;
37164 }
37165 diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
37166 index 82f2ae0..f205c02 100644
37167 --- a/drivers/atm/firestream.c
37168 +++ b/drivers/atm/firestream.c
37169 @@ -749,7 +749,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
37170 }
37171 }
37172
37173 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
37174 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
37175
37176 fs_dprintk (FS_DEBUG_TXMEM, "i");
37177 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
37178 @@ -816,7 +816,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
37179 #endif
37180 skb_put (skb, qe->p1 & 0xffff);
37181 ATM_SKB(skb)->vcc = atm_vcc;
37182 - atomic_inc(&atm_vcc->stats->rx);
37183 + atomic_inc_unchecked(&atm_vcc->stats->rx);
37184 __net_timestamp(skb);
37185 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
37186 atm_vcc->push (atm_vcc, skb);
37187 @@ -837,12 +837,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
37188 kfree (pe);
37189 }
37190 if (atm_vcc)
37191 - atomic_inc(&atm_vcc->stats->rx_drop);
37192 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
37193 break;
37194 case 0x1f: /* Reassembly abort: no buffers. */
37195 /* Silently increment error counter. */
37196 if (atm_vcc)
37197 - atomic_inc(&atm_vcc->stats->rx_drop);
37198 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
37199 break;
37200 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
37201 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
37202 diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
37203 index 75dde90..4309ead 100644
37204 --- a/drivers/atm/fore200e.c
37205 +++ b/drivers/atm/fore200e.c
37206 @@ -932,9 +932,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
37207 #endif
37208 /* check error condition */
37209 if (*entry->status & STATUS_ERROR)
37210 - atomic_inc(&vcc->stats->tx_err);
37211 + atomic_inc_unchecked(&vcc->stats->tx_err);
37212 else
37213 - atomic_inc(&vcc->stats->tx);
37214 + atomic_inc_unchecked(&vcc->stats->tx);
37215 }
37216 }
37217
37218 @@ -1083,7 +1083,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
37219 if (skb == NULL) {
37220 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
37221
37222 - atomic_inc(&vcc->stats->rx_drop);
37223 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37224 return -ENOMEM;
37225 }
37226
37227 @@ -1126,14 +1126,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
37228
37229 dev_kfree_skb_any(skb);
37230
37231 - atomic_inc(&vcc->stats->rx_drop);
37232 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37233 return -ENOMEM;
37234 }
37235
37236 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
37237
37238 vcc->push(vcc, skb);
37239 - atomic_inc(&vcc->stats->rx);
37240 + atomic_inc_unchecked(&vcc->stats->rx);
37241
37242 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
37243
37244 @@ -1211,7 +1211,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
37245 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
37246 fore200e->atm_dev->number,
37247 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
37248 - atomic_inc(&vcc->stats->rx_err);
37249 + atomic_inc_unchecked(&vcc->stats->rx_err);
37250 }
37251 }
37252
37253 @@ -1656,7 +1656,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
37254 goto retry_here;
37255 }
37256
37257 - atomic_inc(&vcc->stats->tx_err);
37258 + atomic_inc_unchecked(&vcc->stats->tx_err);
37259
37260 fore200e->tx_sat++;
37261 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
37262 diff --git a/drivers/atm/he.c b/drivers/atm/he.c
37263 index 93dca2e..c5daa69 100644
37264 --- a/drivers/atm/he.c
37265 +++ b/drivers/atm/he.c
37266 @@ -1692,7 +1692,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
37267
37268 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
37269 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
37270 - atomic_inc(&vcc->stats->rx_drop);
37271 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37272 goto return_host_buffers;
37273 }
37274
37275 @@ -1719,7 +1719,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
37276 RBRQ_LEN_ERR(he_dev->rbrq_head)
37277 ? "LEN_ERR" : "",
37278 vcc->vpi, vcc->vci);
37279 - atomic_inc(&vcc->stats->rx_err);
37280 + atomic_inc_unchecked(&vcc->stats->rx_err);
37281 goto return_host_buffers;
37282 }
37283
37284 @@ -1771,7 +1771,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
37285 vcc->push(vcc, skb);
37286 spin_lock(&he_dev->global_lock);
37287
37288 - atomic_inc(&vcc->stats->rx);
37289 + atomic_inc_unchecked(&vcc->stats->rx);
37290
37291 return_host_buffers:
37292 ++pdus_assembled;
37293 @@ -2097,7 +2097,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
37294 tpd->vcc->pop(tpd->vcc, tpd->skb);
37295 else
37296 dev_kfree_skb_any(tpd->skb);
37297 - atomic_inc(&tpd->vcc->stats->tx_err);
37298 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
37299 }
37300 dma_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
37301 return;
37302 @@ -2509,7 +2509,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37303 vcc->pop(vcc, skb);
37304 else
37305 dev_kfree_skb_any(skb);
37306 - atomic_inc(&vcc->stats->tx_err);
37307 + atomic_inc_unchecked(&vcc->stats->tx_err);
37308 return -EINVAL;
37309 }
37310
37311 @@ -2520,7 +2520,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37312 vcc->pop(vcc, skb);
37313 else
37314 dev_kfree_skb_any(skb);
37315 - atomic_inc(&vcc->stats->tx_err);
37316 + atomic_inc_unchecked(&vcc->stats->tx_err);
37317 return -EINVAL;
37318 }
37319 #endif
37320 @@ -2532,7 +2532,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37321 vcc->pop(vcc, skb);
37322 else
37323 dev_kfree_skb_any(skb);
37324 - atomic_inc(&vcc->stats->tx_err);
37325 + atomic_inc_unchecked(&vcc->stats->tx_err);
37326 spin_unlock_irqrestore(&he_dev->global_lock, flags);
37327 return -ENOMEM;
37328 }
37329 @@ -2574,7 +2574,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37330 vcc->pop(vcc, skb);
37331 else
37332 dev_kfree_skb_any(skb);
37333 - atomic_inc(&vcc->stats->tx_err);
37334 + atomic_inc_unchecked(&vcc->stats->tx_err);
37335 spin_unlock_irqrestore(&he_dev->global_lock, flags);
37336 return -ENOMEM;
37337 }
37338 @@ -2605,7 +2605,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37339 __enqueue_tpd(he_dev, tpd, cid);
37340 spin_unlock_irqrestore(&he_dev->global_lock, flags);
37341
37342 - atomic_inc(&vcc->stats->tx);
37343 + atomic_inc_unchecked(&vcc->stats->tx);
37344
37345 return 0;
37346 }
37347 diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
37348 index 527bbd5..96570c8 100644
37349 --- a/drivers/atm/horizon.c
37350 +++ b/drivers/atm/horizon.c
37351 @@ -1018,7 +1018,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
37352 {
37353 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
37354 // VC layer stats
37355 - atomic_inc(&vcc->stats->rx);
37356 + atomic_inc_unchecked(&vcc->stats->rx);
37357 __net_timestamp(skb);
37358 // end of our responsibility
37359 vcc->push (vcc, skb);
37360 @@ -1170,7 +1170,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
37361 dev->tx_iovec = NULL;
37362
37363 // VC layer stats
37364 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
37365 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
37366
37367 // free the skb
37368 hrz_kfree_skb (skb);
37369 diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
37370 index 074616b..d6b3d5f 100644
37371 --- a/drivers/atm/idt77252.c
37372 +++ b/drivers/atm/idt77252.c
37373 @@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
37374 else
37375 dev_kfree_skb(skb);
37376
37377 - atomic_inc(&vcc->stats->tx);
37378 + atomic_inc_unchecked(&vcc->stats->tx);
37379 }
37380
37381 atomic_dec(&scq->used);
37382 @@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37383 if ((sb = dev_alloc_skb(64)) == NULL) {
37384 printk("%s: Can't allocate buffers for aal0.\n",
37385 card->name);
37386 - atomic_add(i, &vcc->stats->rx_drop);
37387 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
37388 break;
37389 }
37390 if (!atm_charge(vcc, sb->truesize)) {
37391 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
37392 card->name);
37393 - atomic_add(i - 1, &vcc->stats->rx_drop);
37394 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
37395 dev_kfree_skb(sb);
37396 break;
37397 }
37398 @@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37399 ATM_SKB(sb)->vcc = vcc;
37400 __net_timestamp(sb);
37401 vcc->push(vcc, sb);
37402 - atomic_inc(&vcc->stats->rx);
37403 + atomic_inc_unchecked(&vcc->stats->rx);
37404
37405 cell += ATM_CELL_PAYLOAD;
37406 }
37407 @@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37408 "(CDC: %08x)\n",
37409 card->name, len, rpp->len, readl(SAR_REG_CDC));
37410 recycle_rx_pool_skb(card, rpp);
37411 - atomic_inc(&vcc->stats->rx_err);
37412 + atomic_inc_unchecked(&vcc->stats->rx_err);
37413 return;
37414 }
37415 if (stat & SAR_RSQE_CRC) {
37416 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
37417 recycle_rx_pool_skb(card, rpp);
37418 - atomic_inc(&vcc->stats->rx_err);
37419 + atomic_inc_unchecked(&vcc->stats->rx_err);
37420 return;
37421 }
37422 if (skb_queue_len(&rpp->queue) > 1) {
37423 @@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37424 RXPRINTK("%s: Can't alloc RX skb.\n",
37425 card->name);
37426 recycle_rx_pool_skb(card, rpp);
37427 - atomic_inc(&vcc->stats->rx_err);
37428 + atomic_inc_unchecked(&vcc->stats->rx_err);
37429 return;
37430 }
37431 if (!atm_charge(vcc, skb->truesize)) {
37432 @@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37433 __net_timestamp(skb);
37434
37435 vcc->push(vcc, skb);
37436 - atomic_inc(&vcc->stats->rx);
37437 + atomic_inc_unchecked(&vcc->stats->rx);
37438
37439 return;
37440 }
37441 @@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37442 __net_timestamp(skb);
37443
37444 vcc->push(vcc, skb);
37445 - atomic_inc(&vcc->stats->rx);
37446 + atomic_inc_unchecked(&vcc->stats->rx);
37447
37448 if (skb->truesize > SAR_FB_SIZE_3)
37449 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
37450 @@ -1302,14 +1302,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
37451 if (vcc->qos.aal != ATM_AAL0) {
37452 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
37453 card->name, vpi, vci);
37454 - atomic_inc(&vcc->stats->rx_drop);
37455 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37456 goto drop;
37457 }
37458
37459 if ((sb = dev_alloc_skb(64)) == NULL) {
37460 printk("%s: Can't allocate buffers for AAL0.\n",
37461 card->name);
37462 - atomic_inc(&vcc->stats->rx_err);
37463 + atomic_inc_unchecked(&vcc->stats->rx_err);
37464 goto drop;
37465 }
37466
37467 @@ -1328,7 +1328,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
37468 ATM_SKB(sb)->vcc = vcc;
37469 __net_timestamp(sb);
37470 vcc->push(vcc, sb);
37471 - atomic_inc(&vcc->stats->rx);
37472 + atomic_inc_unchecked(&vcc->stats->rx);
37473
37474 drop:
37475 skb_pull(queue, 64);
37476 @@ -1953,13 +1953,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
37477
37478 if (vc == NULL) {
37479 printk("%s: NULL connection in send().\n", card->name);
37480 - atomic_inc(&vcc->stats->tx_err);
37481 + atomic_inc_unchecked(&vcc->stats->tx_err);
37482 dev_kfree_skb(skb);
37483 return -EINVAL;
37484 }
37485 if (!test_bit(VCF_TX, &vc->flags)) {
37486 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
37487 - atomic_inc(&vcc->stats->tx_err);
37488 + atomic_inc_unchecked(&vcc->stats->tx_err);
37489 dev_kfree_skb(skb);
37490 return -EINVAL;
37491 }
37492 @@ -1971,14 +1971,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
37493 break;
37494 default:
37495 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
37496 - atomic_inc(&vcc->stats->tx_err);
37497 + atomic_inc_unchecked(&vcc->stats->tx_err);
37498 dev_kfree_skb(skb);
37499 return -EINVAL;
37500 }
37501
37502 if (skb_shinfo(skb)->nr_frags != 0) {
37503 printk("%s: No scatter-gather yet.\n", card->name);
37504 - atomic_inc(&vcc->stats->tx_err);
37505 + atomic_inc_unchecked(&vcc->stats->tx_err);
37506 dev_kfree_skb(skb);
37507 return -EINVAL;
37508 }
37509 @@ -1986,7 +1986,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
37510
37511 err = queue_skb(card, vc, skb, oam);
37512 if (err) {
37513 - atomic_inc(&vcc->stats->tx_err);
37514 + atomic_inc_unchecked(&vcc->stats->tx_err);
37515 dev_kfree_skb(skb);
37516 return err;
37517 }
37518 @@ -2009,7 +2009,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
37519 skb = dev_alloc_skb(64);
37520 if (!skb) {
37521 printk("%s: Out of memory in send_oam().\n", card->name);
37522 - atomic_inc(&vcc->stats->tx_err);
37523 + atomic_inc_unchecked(&vcc->stats->tx_err);
37524 return -ENOMEM;
37525 }
37526 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
37527 diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
37528 index 924f8e2..3375a3e 100644
37529 --- a/drivers/atm/iphase.c
37530 +++ b/drivers/atm/iphase.c
37531 @@ -1145,7 +1145,7 @@ static int rx_pkt(struct atm_dev *dev)
37532 status = (u_short) (buf_desc_ptr->desc_mode);
37533 if (status & (RX_CER | RX_PTE | RX_OFL))
37534 {
37535 - atomic_inc(&vcc->stats->rx_err);
37536 + atomic_inc_unchecked(&vcc->stats->rx_err);
37537 IF_ERR(printk("IA: bad packet, dropping it");)
37538 if (status & RX_CER) {
37539 IF_ERR(printk(" cause: packet CRC error\n");)
37540 @@ -1168,7 +1168,7 @@ static int rx_pkt(struct atm_dev *dev)
37541 len = dma_addr - buf_addr;
37542 if (len > iadev->rx_buf_sz) {
37543 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
37544 - atomic_inc(&vcc->stats->rx_err);
37545 + atomic_inc_unchecked(&vcc->stats->rx_err);
37546 goto out_free_desc;
37547 }
37548
37549 @@ -1318,7 +1318,7 @@ static void rx_dle_intr(struct atm_dev *dev)
37550 ia_vcc = INPH_IA_VCC(vcc);
37551 if (ia_vcc == NULL)
37552 {
37553 - atomic_inc(&vcc->stats->rx_err);
37554 + atomic_inc_unchecked(&vcc->stats->rx_err);
37555 atm_return(vcc, skb->truesize);
37556 dev_kfree_skb_any(skb);
37557 goto INCR_DLE;
37558 @@ -1330,7 +1330,7 @@ static void rx_dle_intr(struct atm_dev *dev)
37559 if ((length > iadev->rx_buf_sz) || (length >
37560 (skb->len - sizeof(struct cpcs_trailer))))
37561 {
37562 - atomic_inc(&vcc->stats->rx_err);
37563 + atomic_inc_unchecked(&vcc->stats->rx_err);
37564 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
37565 length, skb->len);)
37566 atm_return(vcc, skb->truesize);
37567 @@ -1346,7 +1346,7 @@ static void rx_dle_intr(struct atm_dev *dev)
37568
37569 IF_RX(printk("rx_dle_intr: skb push");)
37570 vcc->push(vcc,skb);
37571 - atomic_inc(&vcc->stats->rx);
37572 + atomic_inc_unchecked(&vcc->stats->rx);
37573 iadev->rx_pkt_cnt++;
37574 }
37575 INCR_DLE:
37576 @@ -2828,15 +2828,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
37577 {
37578 struct k_sonet_stats *stats;
37579 stats = &PRIV(_ia_dev[board])->sonet_stats;
37580 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
37581 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
37582 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
37583 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
37584 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
37585 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
37586 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
37587 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
37588 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
37589 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
37590 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
37591 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
37592 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
37593 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
37594 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
37595 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
37596 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
37597 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
37598 }
37599 ia_cmds.status = 0;
37600 break;
37601 @@ -2941,7 +2941,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
37602 if ((desc == 0) || (desc > iadev->num_tx_desc))
37603 {
37604 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
37605 - atomic_inc(&vcc->stats->tx);
37606 + atomic_inc_unchecked(&vcc->stats->tx);
37607 if (vcc->pop)
37608 vcc->pop(vcc, skb);
37609 else
37610 @@ -3046,14 +3046,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
37611 ATM_DESC(skb) = vcc->vci;
37612 skb_queue_tail(&iadev->tx_dma_q, skb);
37613
37614 - atomic_inc(&vcc->stats->tx);
37615 + atomic_inc_unchecked(&vcc->stats->tx);
37616 iadev->tx_pkt_cnt++;
37617 /* Increment transaction counter */
37618 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
37619
37620 #if 0
37621 /* add flow control logic */
37622 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
37623 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
37624 if (iavcc->vc_desc_cnt > 10) {
37625 vcc->tx_quota = vcc->tx_quota * 3 / 4;
37626 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
37627 diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
37628 index ce43ae3..969de38 100644
37629 --- a/drivers/atm/lanai.c
37630 +++ b/drivers/atm/lanai.c
37631 @@ -1295,7 +1295,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
37632 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
37633 lanai_endtx(lanai, lvcc);
37634 lanai_free_skb(lvcc->tx.atmvcc, skb);
37635 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
37636 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
37637 }
37638
37639 /* Try to fill the buffer - don't call unless there is backlog */
37640 @@ -1418,7 +1418,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
37641 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
37642 __net_timestamp(skb);
37643 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
37644 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
37645 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
37646 out:
37647 lvcc->rx.buf.ptr = end;
37648 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
37649 @@ -1659,7 +1659,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37650 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
37651 "vcc %d\n", lanai->number, (unsigned int) s, vci);
37652 lanai->stats.service_rxnotaal5++;
37653 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37654 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37655 return 0;
37656 }
37657 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
37658 @@ -1671,7 +1671,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37659 int bytes;
37660 read_unlock(&vcc_sklist_lock);
37661 DPRINTK("got trashed rx pdu on vci %d\n", vci);
37662 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37663 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37664 lvcc->stats.x.aal5.service_trash++;
37665 bytes = (SERVICE_GET_END(s) * 16) -
37666 (((unsigned long) lvcc->rx.buf.ptr) -
37667 @@ -1683,7 +1683,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37668 }
37669 if (s & SERVICE_STREAM) {
37670 read_unlock(&vcc_sklist_lock);
37671 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37672 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37673 lvcc->stats.x.aal5.service_stream++;
37674 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
37675 "PDU on VCI %d!\n", lanai->number, vci);
37676 @@ -1691,7 +1691,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37677 return 0;
37678 }
37679 DPRINTK("got rx crc error on vci %d\n", vci);
37680 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37681 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37682 lvcc->stats.x.aal5.service_rxcrc++;
37683 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
37684 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
37685 diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
37686 index ddc4ceb..36e29aa 100644
37687 --- a/drivers/atm/nicstar.c
37688 +++ b/drivers/atm/nicstar.c
37689 @@ -1632,7 +1632,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37690 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
37691 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
37692 card->index);
37693 - atomic_inc(&vcc->stats->tx_err);
37694 + atomic_inc_unchecked(&vcc->stats->tx_err);
37695 dev_kfree_skb_any(skb);
37696 return -EINVAL;
37697 }
37698 @@ -1640,7 +1640,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37699 if (!vc->tx) {
37700 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
37701 card->index);
37702 - atomic_inc(&vcc->stats->tx_err);
37703 + atomic_inc_unchecked(&vcc->stats->tx_err);
37704 dev_kfree_skb_any(skb);
37705 return -EINVAL;
37706 }
37707 @@ -1648,14 +1648,14 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37708 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
37709 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
37710 card->index);
37711 - atomic_inc(&vcc->stats->tx_err);
37712 + atomic_inc_unchecked(&vcc->stats->tx_err);
37713 dev_kfree_skb_any(skb);
37714 return -EINVAL;
37715 }
37716
37717 if (skb_shinfo(skb)->nr_frags != 0) {
37718 printk("nicstar%d: No scatter-gather yet.\n", card->index);
37719 - atomic_inc(&vcc->stats->tx_err);
37720 + atomic_inc_unchecked(&vcc->stats->tx_err);
37721 dev_kfree_skb_any(skb);
37722 return -EINVAL;
37723 }
37724 @@ -1703,11 +1703,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37725 }
37726
37727 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
37728 - atomic_inc(&vcc->stats->tx_err);
37729 + atomic_inc_unchecked(&vcc->stats->tx_err);
37730 dev_kfree_skb_any(skb);
37731 return -EIO;
37732 }
37733 - atomic_inc(&vcc->stats->tx);
37734 + atomic_inc_unchecked(&vcc->stats->tx);
37735
37736 return 0;
37737 }
37738 @@ -2024,14 +2024,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37739 printk
37740 ("nicstar%d: Can't allocate buffers for aal0.\n",
37741 card->index);
37742 - atomic_add(i, &vcc->stats->rx_drop);
37743 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
37744 break;
37745 }
37746 if (!atm_charge(vcc, sb->truesize)) {
37747 RXPRINTK
37748 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
37749 card->index);
37750 - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
37751 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
37752 dev_kfree_skb_any(sb);
37753 break;
37754 }
37755 @@ -2046,7 +2046,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37756 ATM_SKB(sb)->vcc = vcc;
37757 __net_timestamp(sb);
37758 vcc->push(vcc, sb);
37759 - atomic_inc(&vcc->stats->rx);
37760 + atomic_inc_unchecked(&vcc->stats->rx);
37761 cell += ATM_CELL_PAYLOAD;
37762 }
37763
37764 @@ -2063,7 +2063,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37765 if (iovb == NULL) {
37766 printk("nicstar%d: Out of iovec buffers.\n",
37767 card->index);
37768 - atomic_inc(&vcc->stats->rx_drop);
37769 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37770 recycle_rx_buf(card, skb);
37771 return;
37772 }
37773 @@ -2087,7 +2087,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37774 small or large buffer itself. */
37775 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
37776 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
37777 - atomic_inc(&vcc->stats->rx_err);
37778 + atomic_inc_unchecked(&vcc->stats->rx_err);
37779 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
37780 NS_MAX_IOVECS);
37781 NS_PRV_IOVCNT(iovb) = 0;
37782 @@ -2107,7 +2107,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37783 ("nicstar%d: Expected a small buffer, and this is not one.\n",
37784 card->index);
37785 which_list(card, skb);
37786 - atomic_inc(&vcc->stats->rx_err);
37787 + atomic_inc_unchecked(&vcc->stats->rx_err);
37788 recycle_rx_buf(card, skb);
37789 vc->rx_iov = NULL;
37790 recycle_iov_buf(card, iovb);
37791 @@ -2120,7 +2120,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37792 ("nicstar%d: Expected a large buffer, and this is not one.\n",
37793 card->index);
37794 which_list(card, skb);
37795 - atomic_inc(&vcc->stats->rx_err);
37796 + atomic_inc_unchecked(&vcc->stats->rx_err);
37797 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
37798 NS_PRV_IOVCNT(iovb));
37799 vc->rx_iov = NULL;
37800 @@ -2143,7 +2143,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37801 printk(" - PDU size mismatch.\n");
37802 else
37803 printk(".\n");
37804 - atomic_inc(&vcc->stats->rx_err);
37805 + atomic_inc_unchecked(&vcc->stats->rx_err);
37806 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
37807 NS_PRV_IOVCNT(iovb));
37808 vc->rx_iov = NULL;
37809 @@ -2157,14 +2157,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37810 /* skb points to a small buffer */
37811 if (!atm_charge(vcc, skb->truesize)) {
37812 push_rxbufs(card, skb);
37813 - atomic_inc(&vcc->stats->rx_drop);
37814 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37815 } else {
37816 skb_put(skb, len);
37817 dequeue_sm_buf(card, skb);
37818 ATM_SKB(skb)->vcc = vcc;
37819 __net_timestamp(skb);
37820 vcc->push(vcc, skb);
37821 - atomic_inc(&vcc->stats->rx);
37822 + atomic_inc_unchecked(&vcc->stats->rx);
37823 }
37824 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
37825 struct sk_buff *sb;
37826 @@ -2175,14 +2175,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37827 if (len <= NS_SMBUFSIZE) {
37828 if (!atm_charge(vcc, sb->truesize)) {
37829 push_rxbufs(card, sb);
37830 - atomic_inc(&vcc->stats->rx_drop);
37831 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37832 } else {
37833 skb_put(sb, len);
37834 dequeue_sm_buf(card, sb);
37835 ATM_SKB(sb)->vcc = vcc;
37836 __net_timestamp(sb);
37837 vcc->push(vcc, sb);
37838 - atomic_inc(&vcc->stats->rx);
37839 + atomic_inc_unchecked(&vcc->stats->rx);
37840 }
37841
37842 push_rxbufs(card, skb);
37843 @@ -2191,7 +2191,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37844
37845 if (!atm_charge(vcc, skb->truesize)) {
37846 push_rxbufs(card, skb);
37847 - atomic_inc(&vcc->stats->rx_drop);
37848 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37849 } else {
37850 dequeue_lg_buf(card, skb);
37851 skb_push(skb, NS_SMBUFSIZE);
37852 @@ -2201,7 +2201,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37853 ATM_SKB(skb)->vcc = vcc;
37854 __net_timestamp(skb);
37855 vcc->push(vcc, skb);
37856 - atomic_inc(&vcc->stats->rx);
37857 + atomic_inc_unchecked(&vcc->stats->rx);
37858 }
37859
37860 push_rxbufs(card, sb);
37861 @@ -2222,7 +2222,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37862 printk
37863 ("nicstar%d: Out of huge buffers.\n",
37864 card->index);
37865 - atomic_inc(&vcc->stats->rx_drop);
37866 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37867 recycle_iovec_rx_bufs(card,
37868 (struct iovec *)
37869 iovb->data,
37870 @@ -2273,7 +2273,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37871 card->hbpool.count++;
37872 } else
37873 dev_kfree_skb_any(hb);
37874 - atomic_inc(&vcc->stats->rx_drop);
37875 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37876 } else {
37877 /* Copy the small buffer to the huge buffer */
37878 sb = (struct sk_buff *)iov->iov_base;
37879 @@ -2307,7 +2307,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37880 ATM_SKB(hb)->vcc = vcc;
37881 __net_timestamp(hb);
37882 vcc->push(vcc, hb);
37883 - atomic_inc(&vcc->stats->rx);
37884 + atomic_inc_unchecked(&vcc->stats->rx);
37885 }
37886 }
37887
37888 diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
37889 index 74e18b0..f16afa0 100644
37890 --- a/drivers/atm/solos-pci.c
37891 +++ b/drivers/atm/solos-pci.c
37892 @@ -838,7 +838,7 @@ static void solos_bh(unsigned long card_arg)
37893 }
37894 atm_charge(vcc, skb->truesize);
37895 vcc->push(vcc, skb);
37896 - atomic_inc(&vcc->stats->rx);
37897 + atomic_inc_unchecked(&vcc->stats->rx);
37898 break;
37899
37900 case PKT_STATUS:
37901 @@ -1116,7 +1116,7 @@ static uint32_t fpga_tx(struct solos_card *card)
37902 vcc = SKB_CB(oldskb)->vcc;
37903
37904 if (vcc) {
37905 - atomic_inc(&vcc->stats->tx);
37906 + atomic_inc_unchecked(&vcc->stats->tx);
37907 solos_pop(vcc, oldskb);
37908 } else {
37909 dev_kfree_skb_irq(oldskb);
37910 diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
37911 index 0215934..ce9f5b1 100644
37912 --- a/drivers/atm/suni.c
37913 +++ b/drivers/atm/suni.c
37914 @@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
37915
37916
37917 #define ADD_LIMITED(s,v) \
37918 - atomic_add((v),&stats->s); \
37919 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
37920 + atomic_add_unchecked((v),&stats->s); \
37921 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
37922
37923
37924 static void suni_hz(unsigned long from_timer)
37925 diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
37926 index 5120a96..e2572bd 100644
37927 --- a/drivers/atm/uPD98402.c
37928 +++ b/drivers/atm/uPD98402.c
37929 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
37930 struct sonet_stats tmp;
37931 int error = 0;
37932
37933 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
37934 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
37935 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
37936 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
37937 if (zero && !error) {
37938 @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
37939
37940
37941 #define ADD_LIMITED(s,v) \
37942 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
37943 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
37944 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
37945 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
37946 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
37947 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
37948
37949
37950 static void stat_event(struct atm_dev *dev)
37951 @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev *dev)
37952 if (reason & uPD98402_INT_PFM) stat_event(dev);
37953 if (reason & uPD98402_INT_PCO) {
37954 (void) GET(PCOCR); /* clear interrupt cause */
37955 - atomic_add(GET(HECCT),
37956 + atomic_add_unchecked(GET(HECCT),
37957 &PRIV(dev)->sonet_stats.uncorr_hcs);
37958 }
37959 if ((reason & uPD98402_INT_RFO) &&
37960 @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev *dev)
37961 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
37962 uPD98402_INT_LOS),PIMR); /* enable them */
37963 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
37964 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
37965 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
37966 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
37967 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
37968 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
37969 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
37970 return 0;
37971 }
37972
37973 diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
37974 index cecfb94..87009ec 100644
37975 --- a/drivers/atm/zatm.c
37976 +++ b/drivers/atm/zatm.c
37977 @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
37978 }
37979 if (!size) {
37980 dev_kfree_skb_irq(skb);
37981 - if (vcc) atomic_inc(&vcc->stats->rx_err);
37982 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
37983 continue;
37984 }
37985 if (!atm_charge(vcc,skb->truesize)) {
37986 @@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
37987 skb->len = size;
37988 ATM_SKB(skb)->vcc = vcc;
37989 vcc->push(vcc,skb);
37990 - atomic_inc(&vcc->stats->rx);
37991 + atomic_inc_unchecked(&vcc->stats->rx);
37992 }
37993 zout(pos & 0xffff,MTA(mbx));
37994 #if 0 /* probably a stupid idea */
37995 @@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
37996 skb_queue_head(&zatm_vcc->backlog,skb);
37997 break;
37998 }
37999 - atomic_inc(&vcc->stats->tx);
38000 + atomic_inc_unchecked(&vcc->stats->tx);
38001 wake_up(&zatm_vcc->tx_wait);
38002 }
38003
38004 diff --git a/drivers/base/bus.c b/drivers/base/bus.c
38005 index 79bc203..fa3945b 100644
38006 --- a/drivers/base/bus.c
38007 +++ b/drivers/base/bus.c
38008 @@ -1126,7 +1126,7 @@ int subsys_interface_register(struct subsys_interface *sif)
38009 return -EINVAL;
38010
38011 mutex_lock(&subsys->p->mutex);
38012 - list_add_tail(&sif->node, &subsys->p->interfaces);
38013 + pax_list_add_tail((struct list_head *)&sif->node, &subsys->p->interfaces);
38014 if (sif->add_dev) {
38015 subsys_dev_iter_init(&iter, subsys, NULL, NULL);
38016 while ((dev = subsys_dev_iter_next(&iter)))
38017 @@ -1151,7 +1151,7 @@ void subsys_interface_unregister(struct subsys_interface *sif)
38018 subsys = sif->subsys;
38019
38020 mutex_lock(&subsys->p->mutex);
38021 - list_del_init(&sif->node);
38022 + pax_list_del_init((struct list_head *)&sif->node);
38023 if (sif->remove_dev) {
38024 subsys_dev_iter_init(&iter, subsys, NULL, NULL);
38025 while ((dev = subsys_dev_iter_next(&iter)))
38026 diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
38027 index 68f0314..ca2a609 100644
38028 --- a/drivers/base/devtmpfs.c
38029 +++ b/drivers/base/devtmpfs.c
38030 @@ -354,7 +354,7 @@ int devtmpfs_mount(const char *mntdir)
38031 if (!thread)
38032 return 0;
38033
38034 - err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
38035 + err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
38036 if (err)
38037 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
38038 else
38039 @@ -380,11 +380,11 @@ static int devtmpfsd(void *p)
38040 *err = sys_unshare(CLONE_NEWNS);
38041 if (*err)
38042 goto out;
38043 - *err = sys_mount("devtmpfs", "/", "devtmpfs", MS_SILENT, options);
38044 + *err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)"/", (char __force_user *)"devtmpfs", MS_SILENT, (char __force_user *)options);
38045 if (*err)
38046 goto out;
38047 - sys_chdir("/.."); /* will traverse into overmounted root */
38048 - sys_chroot(".");
38049 + sys_chdir((char __force_user *)"/.."); /* will traverse into overmounted root */
38050 + sys_chroot((char __force_user *)".");
38051 complete(&setup_done);
38052 while (1) {
38053 spin_lock(&req_lock);
38054 diff --git a/drivers/base/node.c b/drivers/base/node.c
38055 index a2aa65b..8831326 100644
38056 --- a/drivers/base/node.c
38057 +++ b/drivers/base/node.c
38058 @@ -613,7 +613,7 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
38059 struct node_attr {
38060 struct device_attribute attr;
38061 enum node_states state;
38062 -};
38063 +} __do_const;
38064
38065 static ssize_t show_node_state(struct device *dev,
38066 struct device_attribute *attr, char *buf)
38067 diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
38068 index 2327613..211d7f5 100644
38069 --- a/drivers/base/power/domain.c
38070 +++ b/drivers/base/power/domain.c
38071 @@ -1725,7 +1725,7 @@ int pm_genpd_attach_cpuidle(struct generic_pm_domain *genpd, int state)
38072 {
38073 struct cpuidle_driver *cpuidle_drv;
38074 struct gpd_cpuidle_data *cpuidle_data;
38075 - struct cpuidle_state *idle_state;
38076 + cpuidle_state_no_const *idle_state;
38077 int ret = 0;
38078
38079 if (IS_ERR_OR_NULL(genpd) || state < 0)
38080 @@ -1793,7 +1793,7 @@ int pm_genpd_name_attach_cpuidle(const char *name, int state)
38081 int pm_genpd_detach_cpuidle(struct generic_pm_domain *genpd)
38082 {
38083 struct gpd_cpuidle_data *cpuidle_data;
38084 - struct cpuidle_state *idle_state;
38085 + cpuidle_state_no_const *idle_state;
38086 int ret = 0;
38087
38088 if (IS_ERR_OR_NULL(genpd))
38089 @@ -2222,8 +2222,11 @@ int genpd_dev_pm_attach(struct device *dev)
38090 return ret;
38091 }
38092
38093 - dev->pm_domain->detach = genpd_dev_pm_detach;
38094 - dev->pm_domain->sync = genpd_dev_pm_sync;
38095 + pax_open_kernel();
38096 + *(void **)&dev->pm_domain->detach = genpd_dev_pm_detach;
38097 + *(void **)&dev->pm_domain->sync = genpd_dev_pm_sync;
38098 + pax_close_kernel();
38099 +
38100 pm_genpd_poweron(pd);
38101
38102 return 0;
38103 diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c
38104 index d2be3f9..0a3167a 100644
38105 --- a/drivers/base/power/sysfs.c
38106 +++ b/drivers/base/power/sysfs.c
38107 @@ -181,7 +181,7 @@ static ssize_t rtpm_status_show(struct device *dev,
38108 return -EIO;
38109 }
38110 }
38111 - return sprintf(buf, p);
38112 + return sprintf(buf, "%s", p);
38113 }
38114
38115 static DEVICE_ATTR(runtime_status, 0444, rtpm_status_show, NULL);
38116 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
38117 index 7726200..a417da7 100644
38118 --- a/drivers/base/power/wakeup.c
38119 +++ b/drivers/base/power/wakeup.c
38120 @@ -32,14 +32,14 @@ static bool pm_abort_suspend __read_mostly;
38121 * They need to be modified together atomically, so it's better to use one
38122 * atomic variable to hold them both.
38123 */
38124 -static atomic_t combined_event_count = ATOMIC_INIT(0);
38125 +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
38126
38127 #define IN_PROGRESS_BITS (sizeof(int) * 4)
38128 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
38129
38130 static void split_counters(unsigned int *cnt, unsigned int *inpr)
38131 {
38132 - unsigned int comb = atomic_read(&combined_event_count);
38133 + unsigned int comb = atomic_read_unchecked(&combined_event_count);
38134
38135 *cnt = (comb >> IN_PROGRESS_BITS);
38136 *inpr = comb & MAX_IN_PROGRESS;
38137 @@ -404,7 +404,7 @@ static void wakeup_source_activate(struct wakeup_source *ws)
38138 ws->start_prevent_time = ws->last_time;
38139
38140 /* Increment the counter of events in progress. */
38141 - cec = atomic_inc_return(&combined_event_count);
38142 + cec = atomic_inc_return_unchecked(&combined_event_count);
38143
38144 trace_wakeup_source_activate(ws->name, cec);
38145 }
38146 @@ -530,7 +530,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
38147 * Increment the counter of registered wakeup events and decrement the
38148 * couter of wakeup events in progress simultaneously.
38149 */
38150 - cec = atomic_add_return(MAX_IN_PROGRESS, &combined_event_count);
38151 + cec = atomic_add_return_unchecked(MAX_IN_PROGRESS, &combined_event_count);
38152 trace_wakeup_source_deactivate(ws->name, cec);
38153
38154 split_counters(&cnt, &inpr);
38155 diff --git a/drivers/base/syscore.c b/drivers/base/syscore.c
38156 index 8d98a32..61d3165 100644
38157 --- a/drivers/base/syscore.c
38158 +++ b/drivers/base/syscore.c
38159 @@ -22,7 +22,7 @@ static DEFINE_MUTEX(syscore_ops_lock);
38160 void register_syscore_ops(struct syscore_ops *ops)
38161 {
38162 mutex_lock(&syscore_ops_lock);
38163 - list_add_tail(&ops->node, &syscore_ops_list);
38164 + pax_list_add_tail((struct list_head *)&ops->node, &syscore_ops_list);
38165 mutex_unlock(&syscore_ops_lock);
38166 }
38167 EXPORT_SYMBOL_GPL(register_syscore_ops);
38168 @@ -34,7 +34,7 @@ EXPORT_SYMBOL_GPL(register_syscore_ops);
38169 void unregister_syscore_ops(struct syscore_ops *ops)
38170 {
38171 mutex_lock(&syscore_ops_lock);
38172 - list_del(&ops->node);
38173 + pax_list_del((struct list_head *)&ops->node);
38174 mutex_unlock(&syscore_ops_lock);
38175 }
38176 EXPORT_SYMBOL_GPL(unregister_syscore_ops);
38177 diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
38178 index ff20f19..018f1da 100644
38179 --- a/drivers/block/cciss.c
38180 +++ b/drivers/block/cciss.c
38181 @@ -3008,7 +3008,7 @@ static void start_io(ctlr_info_t *h)
38182 while (!list_empty(&h->reqQ)) {
38183 c = list_entry(h->reqQ.next, CommandList_struct, list);
38184 /* can't do anything if fifo is full */
38185 - if ((h->access.fifo_full(h))) {
38186 + if ((h->access->fifo_full(h))) {
38187 dev_warn(&h->pdev->dev, "fifo full\n");
38188 break;
38189 }
38190 @@ -3018,7 +3018,7 @@ static void start_io(ctlr_info_t *h)
38191 h->Qdepth--;
38192
38193 /* Tell the controller execute command */
38194 - h->access.submit_command(h, c);
38195 + h->access->submit_command(h, c);
38196
38197 /* Put job onto the completed Q */
38198 addQ(&h->cmpQ, c);
38199 @@ -3444,17 +3444,17 @@ startio:
38200
38201 static inline unsigned long get_next_completion(ctlr_info_t *h)
38202 {
38203 - return h->access.command_completed(h);
38204 + return h->access->command_completed(h);
38205 }
38206
38207 static inline int interrupt_pending(ctlr_info_t *h)
38208 {
38209 - return h->access.intr_pending(h);
38210 + return h->access->intr_pending(h);
38211 }
38212
38213 static inline long interrupt_not_for_us(ctlr_info_t *h)
38214 {
38215 - return ((h->access.intr_pending(h) == 0) ||
38216 + return ((h->access->intr_pending(h) == 0) ||
38217 (h->interrupts_enabled == 0));
38218 }
38219
38220 @@ -3487,7 +3487,7 @@ static inline u32 next_command(ctlr_info_t *h)
38221 u32 a;
38222
38223 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
38224 - return h->access.command_completed(h);
38225 + return h->access->command_completed(h);
38226
38227 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
38228 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
38229 @@ -4044,7 +4044,7 @@ static void cciss_put_controller_into_performant_mode(ctlr_info_t *h)
38230 trans_support & CFGTBL_Trans_use_short_tags);
38231
38232 /* Change the access methods to the performant access methods */
38233 - h->access = SA5_performant_access;
38234 + h->access = &SA5_performant_access;
38235 h->transMethod = CFGTBL_Trans_Performant;
38236
38237 return;
38238 @@ -4318,7 +4318,7 @@ static int cciss_pci_init(ctlr_info_t *h)
38239 if (prod_index < 0)
38240 return -ENODEV;
38241 h->product_name = products[prod_index].product_name;
38242 - h->access = *(products[prod_index].access);
38243 + h->access = products[prod_index].access;
38244
38245 if (cciss_board_disabled(h)) {
38246 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
38247 @@ -5050,7 +5050,7 @@ reinit_after_soft_reset:
38248 }
38249
38250 /* make sure the board interrupts are off */
38251 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
38252 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
38253 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
38254 if (rc)
38255 goto clean2;
38256 @@ -5100,7 +5100,7 @@ reinit_after_soft_reset:
38257 * fake ones to scoop up any residual completions.
38258 */
38259 spin_lock_irqsave(&h->lock, flags);
38260 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
38261 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
38262 spin_unlock_irqrestore(&h->lock, flags);
38263 free_irq(h->intr[h->intr_mode], h);
38264 rc = cciss_request_irq(h, cciss_msix_discard_completions,
38265 @@ -5120,9 +5120,9 @@ reinit_after_soft_reset:
38266 dev_info(&h->pdev->dev, "Board READY.\n");
38267 dev_info(&h->pdev->dev,
38268 "Waiting for stale completions to drain.\n");
38269 - h->access.set_intr_mask(h, CCISS_INTR_ON);
38270 + h->access->set_intr_mask(h, CCISS_INTR_ON);
38271 msleep(10000);
38272 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
38273 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
38274
38275 rc = controller_reset_failed(h->cfgtable);
38276 if (rc)
38277 @@ -5145,7 +5145,7 @@ reinit_after_soft_reset:
38278 cciss_scsi_setup(h);
38279
38280 /* Turn the interrupts on so we can service requests */
38281 - h->access.set_intr_mask(h, CCISS_INTR_ON);
38282 + h->access->set_intr_mask(h, CCISS_INTR_ON);
38283
38284 /* Get the firmware version */
38285 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
38286 @@ -5217,7 +5217,7 @@ static void cciss_shutdown(struct pci_dev *pdev)
38287 kfree(flush_buf);
38288 if (return_code != IO_OK)
38289 dev_warn(&h->pdev->dev, "Error flushing cache\n");
38290 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
38291 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
38292 free_irq(h->intr[h->intr_mode], h);
38293 }
38294
38295 diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
38296 index 7fda30e..2f27946 100644
38297 --- a/drivers/block/cciss.h
38298 +++ b/drivers/block/cciss.h
38299 @@ -101,7 +101,7 @@ struct ctlr_info
38300 /* information about each logical volume */
38301 drive_info_struct *drv[CISS_MAX_LUN];
38302
38303 - struct access_method access;
38304 + struct access_method *access;
38305
38306 /* queue and queue Info */
38307 struct list_head reqQ;
38308 @@ -402,27 +402,27 @@ static bool SA5_performant_intr_pending(ctlr_info_t *h)
38309 }
38310
38311 static struct access_method SA5_access = {
38312 - SA5_submit_command,
38313 - SA5_intr_mask,
38314 - SA5_fifo_full,
38315 - SA5_intr_pending,
38316 - SA5_completed,
38317 + .submit_command = SA5_submit_command,
38318 + .set_intr_mask = SA5_intr_mask,
38319 + .fifo_full = SA5_fifo_full,
38320 + .intr_pending = SA5_intr_pending,
38321 + .command_completed = SA5_completed,
38322 };
38323
38324 static struct access_method SA5B_access = {
38325 - SA5_submit_command,
38326 - SA5B_intr_mask,
38327 - SA5_fifo_full,
38328 - SA5B_intr_pending,
38329 - SA5_completed,
38330 + .submit_command = SA5_submit_command,
38331 + .set_intr_mask = SA5B_intr_mask,
38332 + .fifo_full = SA5_fifo_full,
38333 + .intr_pending = SA5B_intr_pending,
38334 + .command_completed = SA5_completed,
38335 };
38336
38337 static struct access_method SA5_performant_access = {
38338 - SA5_submit_command,
38339 - SA5_performant_intr_mask,
38340 - SA5_fifo_full,
38341 - SA5_performant_intr_pending,
38342 - SA5_performant_completed,
38343 + .submit_command = SA5_submit_command,
38344 + .set_intr_mask = SA5_performant_intr_mask,
38345 + .fifo_full = SA5_fifo_full,
38346 + .intr_pending = SA5_performant_intr_pending,
38347 + .command_completed = SA5_performant_completed,
38348 };
38349
38350 struct board_type {
38351 diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
38352 index f749df9..5f8b9c4 100644
38353 --- a/drivers/block/cpqarray.c
38354 +++ b/drivers/block/cpqarray.c
38355 @@ -404,7 +404,7 @@ static int cpqarray_register_ctlr(int i, struct pci_dev *pdev)
38356 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
38357 goto Enomem4;
38358 }
38359 - hba[i]->access.set_intr_mask(hba[i], 0);
38360 + hba[i]->access->set_intr_mask(hba[i], 0);
38361 if (request_irq(hba[i]->intr, do_ida_intr, IRQF_SHARED,
38362 hba[i]->devname, hba[i]))
38363 {
38364 @@ -459,7 +459,7 @@ static int cpqarray_register_ctlr(int i, struct pci_dev *pdev)
38365 add_timer(&hba[i]->timer);
38366
38367 /* Enable IRQ now that spinlock and rate limit timer are set up */
38368 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
38369 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
38370
38371 for(j=0; j<NWD; j++) {
38372 struct gendisk *disk = ida_gendisk[i][j];
38373 @@ -694,7 +694,7 @@ DBGINFO(
38374 for(i=0; i<NR_PRODUCTS; i++) {
38375 if (board_id == products[i].board_id) {
38376 c->product_name = products[i].product_name;
38377 - c->access = *(products[i].access);
38378 + c->access = products[i].access;
38379 break;
38380 }
38381 }
38382 @@ -792,7 +792,7 @@ static int cpqarray_eisa_detect(void)
38383 hba[ctlr]->intr = intr;
38384 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
38385 hba[ctlr]->product_name = products[j].product_name;
38386 - hba[ctlr]->access = *(products[j].access);
38387 + hba[ctlr]->access = products[j].access;
38388 hba[ctlr]->ctlr = ctlr;
38389 hba[ctlr]->board_id = board_id;
38390 hba[ctlr]->pci_dev = NULL; /* not PCI */
38391 @@ -978,7 +978,7 @@ static void start_io(ctlr_info_t *h)
38392
38393 while((c = h->reqQ) != NULL) {
38394 /* Can't do anything if we're busy */
38395 - if (h->access.fifo_full(h) == 0)
38396 + if (h->access->fifo_full(h) == 0)
38397 return;
38398
38399 /* Get the first entry from the request Q */
38400 @@ -986,7 +986,7 @@ static void start_io(ctlr_info_t *h)
38401 h->Qdepth--;
38402
38403 /* Tell the controller to do our bidding */
38404 - h->access.submit_command(h, c);
38405 + h->access->submit_command(h, c);
38406
38407 /* Get onto the completion Q */
38408 addQ(&h->cmpQ, c);
38409 @@ -1048,7 +1048,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
38410 unsigned long flags;
38411 __u32 a,a1;
38412
38413 - istat = h->access.intr_pending(h);
38414 + istat = h->access->intr_pending(h);
38415 /* Is this interrupt for us? */
38416 if (istat == 0)
38417 return IRQ_NONE;
38418 @@ -1059,7 +1059,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
38419 */
38420 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
38421 if (istat & FIFO_NOT_EMPTY) {
38422 - while((a = h->access.command_completed(h))) {
38423 + while((a = h->access->command_completed(h))) {
38424 a1 = a; a &= ~3;
38425 if ((c = h->cmpQ) == NULL)
38426 {
38427 @@ -1448,11 +1448,11 @@ static int sendcmd(
38428 /*
38429 * Disable interrupt
38430 */
38431 - info_p->access.set_intr_mask(info_p, 0);
38432 + info_p->access->set_intr_mask(info_p, 0);
38433 /* Make sure there is room in the command FIFO */
38434 /* Actually it should be completely empty at this time. */
38435 for (i = 200000; i > 0; i--) {
38436 - temp = info_p->access.fifo_full(info_p);
38437 + temp = info_p->access->fifo_full(info_p);
38438 if (temp != 0) {
38439 break;
38440 }
38441 @@ -1465,7 +1465,7 @@ DBG(
38442 /*
38443 * Send the cmd
38444 */
38445 - info_p->access.submit_command(info_p, c);
38446 + info_p->access->submit_command(info_p, c);
38447 complete = pollcomplete(ctlr);
38448
38449 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
38450 @@ -1548,9 +1548,9 @@ static int revalidate_allvol(ctlr_info_t *host)
38451 * we check the new geometry. Then turn interrupts back on when
38452 * we're done.
38453 */
38454 - host->access.set_intr_mask(host, 0);
38455 + host->access->set_intr_mask(host, 0);
38456 getgeometry(ctlr);
38457 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
38458 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
38459
38460 for(i=0; i<NWD; i++) {
38461 struct gendisk *disk = ida_gendisk[ctlr][i];
38462 @@ -1590,7 +1590,7 @@ static int pollcomplete(int ctlr)
38463 /* Wait (up to 2 seconds) for a command to complete */
38464
38465 for (i = 200000; i > 0; i--) {
38466 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
38467 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
38468 if (done == 0) {
38469 udelay(10); /* a short fixed delay */
38470 } else
38471 diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
38472 index be73e9d..7fbf140 100644
38473 --- a/drivers/block/cpqarray.h
38474 +++ b/drivers/block/cpqarray.h
38475 @@ -99,7 +99,7 @@ struct ctlr_info {
38476 drv_info_t drv[NWD];
38477 struct proc_dir_entry *proc;
38478
38479 - struct access_method access;
38480 + struct access_method *access;
38481
38482 cmdlist_t *reqQ;
38483 cmdlist_t *cmpQ;
38484 diff --git a/drivers/block/drbd/drbd_bitmap.c b/drivers/block/drbd/drbd_bitmap.c
38485 index 434c77d..6d3219a 100644
38486 --- a/drivers/block/drbd/drbd_bitmap.c
38487 +++ b/drivers/block/drbd/drbd_bitmap.c
38488 @@ -1036,7 +1036,7 @@ static void bm_page_io_async(struct drbd_bm_aio_ctx *ctx, int page_nr) __must_ho
38489 submit_bio(rw, bio);
38490 /* this should not count as user activity and cause the
38491 * resync to throttle -- see drbd_rs_should_slow_down(). */
38492 - atomic_add(len >> 9, &device->rs_sect_ev);
38493 + atomic_add_unchecked(len >> 9, &device->rs_sect_ev);
38494 }
38495 }
38496
38497 diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
38498 index b905e98..0812ed8 100644
38499 --- a/drivers/block/drbd/drbd_int.h
38500 +++ b/drivers/block/drbd/drbd_int.h
38501 @@ -385,7 +385,7 @@ struct drbd_epoch {
38502 struct drbd_connection *connection;
38503 struct list_head list;
38504 unsigned int barrier_nr;
38505 - atomic_t epoch_size; /* increased on every request added. */
38506 + atomic_unchecked_t epoch_size; /* increased on every request added. */
38507 atomic_t active; /* increased on every req. added, and dec on every finished. */
38508 unsigned long flags;
38509 };
38510 @@ -946,7 +946,7 @@ struct drbd_device {
38511 unsigned int al_tr_number;
38512 int al_tr_cycle;
38513 wait_queue_head_t seq_wait;
38514 - atomic_t packet_seq;
38515 + atomic_unchecked_t packet_seq;
38516 unsigned int peer_seq;
38517 spinlock_t peer_seq_lock;
38518 unsigned long comm_bm_set; /* communicated number of set bits. */
38519 @@ -955,8 +955,8 @@ struct drbd_device {
38520 struct mutex own_state_mutex;
38521 struct mutex *state_mutex; /* either own_state_mutex or first_peer_device(device)->connection->cstate_mutex */
38522 char congestion_reason; /* Why we where congested... */
38523 - atomic_t rs_sect_in; /* for incoming resync data rate, SyncTarget */
38524 - atomic_t rs_sect_ev; /* for submitted resync data rate, both */
38525 + atomic_unchecked_t rs_sect_in; /* for incoming resync data rate, SyncTarget */
38526 + atomic_unchecked_t rs_sect_ev; /* for submitted resync data rate, both */
38527 int rs_last_sect_ev; /* counter to compare with */
38528 int rs_last_events; /* counter of read or write "events" (unit sectors)
38529 * on the lower level device when we last looked. */
38530 diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
38531 index 81fde9e..9948c05 100644
38532 --- a/drivers/block/drbd/drbd_main.c
38533 +++ b/drivers/block/drbd/drbd_main.c
38534 @@ -1328,7 +1328,7 @@ static int _drbd_send_ack(struct drbd_peer_device *peer_device, enum drbd_packet
38535 p->sector = sector;
38536 p->block_id = block_id;
38537 p->blksize = blksize;
38538 - p->seq_num = cpu_to_be32(atomic_inc_return(&peer_device->device->packet_seq));
38539 + p->seq_num = cpu_to_be32(atomic_inc_return_unchecked(&peer_device->device->packet_seq));
38540 return drbd_send_command(peer_device, sock, cmd, sizeof(*p), NULL, 0);
38541 }
38542
38543 @@ -1634,7 +1634,7 @@ int drbd_send_dblock(struct drbd_peer_device *peer_device, struct drbd_request *
38544 return -EIO;
38545 p->sector = cpu_to_be64(req->i.sector);
38546 p->block_id = (unsigned long)req;
38547 - p->seq_num = cpu_to_be32(atomic_inc_return(&device->packet_seq));
38548 + p->seq_num = cpu_to_be32(atomic_inc_return_unchecked(&device->packet_seq));
38549 dp_flags = bio_flags_to_wire(peer_device->connection, req->master_bio->bi_rw);
38550 if (device->state.conn >= C_SYNC_SOURCE &&
38551 device->state.conn <= C_PAUSED_SYNC_T)
38552 @@ -1915,8 +1915,8 @@ void drbd_init_set_defaults(struct drbd_device *device)
38553 atomic_set(&device->unacked_cnt, 0);
38554 atomic_set(&device->local_cnt, 0);
38555 atomic_set(&device->pp_in_use_by_net, 0);
38556 - atomic_set(&device->rs_sect_in, 0);
38557 - atomic_set(&device->rs_sect_ev, 0);
38558 + atomic_set_unchecked(&device->rs_sect_in, 0);
38559 + atomic_set_unchecked(&device->rs_sect_ev, 0);
38560 atomic_set(&device->ap_in_flight, 0);
38561 atomic_set(&device->md_io.in_use, 0);
38562
38563 @@ -2683,8 +2683,8 @@ void drbd_destroy_connection(struct kref *kref)
38564 struct drbd_connection *connection = container_of(kref, struct drbd_connection, kref);
38565 struct drbd_resource *resource = connection->resource;
38566
38567 - if (atomic_read(&connection->current_epoch->epoch_size) != 0)
38568 - drbd_err(connection, "epoch_size:%d\n", atomic_read(&connection->current_epoch->epoch_size));
38569 + if (atomic_read_unchecked(&connection->current_epoch->epoch_size) != 0)
38570 + drbd_err(connection, "epoch_size:%d\n", atomic_read_unchecked(&connection->current_epoch->epoch_size));
38571 kfree(connection->current_epoch);
38572
38573 idr_destroy(&connection->peer_devices);
38574 diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
38575 index 74df8cf..e41fc24 100644
38576 --- a/drivers/block/drbd/drbd_nl.c
38577 +++ b/drivers/block/drbd/drbd_nl.c
38578 @@ -3637,13 +3637,13 @@ finish:
38579
38580 void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib)
38581 {
38582 - static atomic_t drbd_genl_seq = ATOMIC_INIT(2); /* two. */
38583 + static atomic_unchecked_t drbd_genl_seq = ATOMIC_INIT(2); /* two. */
38584 struct sk_buff *msg;
38585 struct drbd_genlmsghdr *d_out;
38586 unsigned seq;
38587 int err = -ENOMEM;
38588
38589 - seq = atomic_inc_return(&drbd_genl_seq);
38590 + seq = atomic_inc_return_unchecked(&drbd_genl_seq);
38591 msg = genlmsg_new(NLMSG_GOODSIZE, GFP_NOIO);
38592 if (!msg)
38593 goto failed;
38594 diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
38595 index cee2035..22f66bd 100644
38596 --- a/drivers/block/drbd/drbd_receiver.c
38597 +++ b/drivers/block/drbd/drbd_receiver.c
38598 @@ -870,7 +870,7 @@ int drbd_connected(struct drbd_peer_device *peer_device)
38599 struct drbd_device *device = peer_device->device;
38600 int err;
38601
38602 - atomic_set(&device->packet_seq, 0);
38603 + atomic_set_unchecked(&device->packet_seq, 0);
38604 device->peer_seq = 0;
38605
38606 device->state_mutex = peer_device->connection->agreed_pro_version < 100 ?
38607 @@ -1233,7 +1233,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_connection *connectio
38608 do {
38609 next_epoch = NULL;
38610
38611 - epoch_size = atomic_read(&epoch->epoch_size);
38612 + epoch_size = atomic_read_unchecked(&epoch->epoch_size);
38613
38614 switch (ev & ~EV_CLEANUP) {
38615 case EV_PUT:
38616 @@ -1273,7 +1273,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_connection *connectio
38617 rv = FE_DESTROYED;
38618 } else {
38619 epoch->flags = 0;
38620 - atomic_set(&epoch->epoch_size, 0);
38621 + atomic_set_unchecked(&epoch->epoch_size, 0);
38622 /* atomic_set(&epoch->active, 0); is already zero */
38623 if (rv == FE_STILL_LIVE)
38624 rv = FE_RECYCLED;
38625 @@ -1550,7 +1550,7 @@ static int receive_Barrier(struct drbd_connection *connection, struct packet_inf
38626 conn_wait_active_ee_empty(connection);
38627 drbd_flush(connection);
38628
38629 - if (atomic_read(&connection->current_epoch->epoch_size)) {
38630 + if (atomic_read_unchecked(&connection->current_epoch->epoch_size)) {
38631 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
38632 if (epoch)
38633 break;
38634 @@ -1564,11 +1564,11 @@ static int receive_Barrier(struct drbd_connection *connection, struct packet_inf
38635 }
38636
38637 epoch->flags = 0;
38638 - atomic_set(&epoch->epoch_size, 0);
38639 + atomic_set_unchecked(&epoch->epoch_size, 0);
38640 atomic_set(&epoch->active, 0);
38641
38642 spin_lock(&connection->epoch_lock);
38643 - if (atomic_read(&connection->current_epoch->epoch_size)) {
38644 + if (atomic_read_unchecked(&connection->current_epoch->epoch_size)) {
38645 list_add(&epoch->list, &connection->current_epoch->list);
38646 connection->current_epoch = epoch;
38647 connection->epochs++;
38648 @@ -1802,7 +1802,7 @@ static int recv_resync_read(struct drbd_peer_device *peer_device, sector_t secto
38649 list_add_tail(&peer_req->w.list, &device->sync_ee);
38650 spin_unlock_irq(&device->resource->req_lock);
38651
38652 - atomic_add(pi->size >> 9, &device->rs_sect_ev);
38653 + atomic_add_unchecked(pi->size >> 9, &device->rs_sect_ev);
38654 if (drbd_submit_peer_request(device, peer_req, WRITE, DRBD_FAULT_RS_WR) == 0)
38655 return 0;
38656
38657 @@ -1900,7 +1900,7 @@ static int receive_RSDataReply(struct drbd_connection *connection, struct packet
38658 drbd_send_ack_dp(peer_device, P_NEG_ACK, p, pi->size);
38659 }
38660
38661 - atomic_add(pi->size >> 9, &device->rs_sect_in);
38662 + atomic_add_unchecked(pi->size >> 9, &device->rs_sect_in);
38663
38664 return err;
38665 }
38666 @@ -2290,7 +2290,7 @@ static int receive_Data(struct drbd_connection *connection, struct packet_info *
38667
38668 err = wait_for_and_update_peer_seq(peer_device, peer_seq);
38669 drbd_send_ack_dp(peer_device, P_NEG_ACK, p, pi->size);
38670 - atomic_inc(&connection->current_epoch->epoch_size);
38671 + atomic_inc_unchecked(&connection->current_epoch->epoch_size);
38672 err2 = drbd_drain_block(peer_device, pi->size);
38673 if (!err)
38674 err = err2;
38675 @@ -2334,7 +2334,7 @@ static int receive_Data(struct drbd_connection *connection, struct packet_info *
38676
38677 spin_lock(&connection->epoch_lock);
38678 peer_req->epoch = connection->current_epoch;
38679 - atomic_inc(&peer_req->epoch->epoch_size);
38680 + atomic_inc_unchecked(&peer_req->epoch->epoch_size);
38681 atomic_inc(&peer_req->epoch->active);
38682 spin_unlock(&connection->epoch_lock);
38683
38684 @@ -2479,7 +2479,7 @@ bool drbd_rs_c_min_rate_throttle(struct drbd_device *device)
38685
38686 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
38687 (int)part_stat_read(&disk->part0, sectors[1]) -
38688 - atomic_read(&device->rs_sect_ev);
38689 + atomic_read_unchecked(&device->rs_sect_ev);
38690
38691 if (atomic_read(&device->ap_actlog_cnt)
38692 || curr_events - device->rs_last_events > 64) {
38693 @@ -2618,7 +2618,7 @@ static int receive_DataRequest(struct drbd_connection *connection, struct packet
38694 device->use_csums = true;
38695 } else if (pi->cmd == P_OV_REPLY) {
38696 /* track progress, we may need to throttle */
38697 - atomic_add(size >> 9, &device->rs_sect_in);
38698 + atomic_add_unchecked(size >> 9, &device->rs_sect_in);
38699 peer_req->w.cb = w_e_end_ov_reply;
38700 dec_rs_pending(device);
38701 /* drbd_rs_begin_io done when we sent this request,
38702 @@ -2691,7 +2691,7 @@ static int receive_DataRequest(struct drbd_connection *connection, struct packet
38703 goto out_free_e;
38704
38705 submit_for_resync:
38706 - atomic_add(size >> 9, &device->rs_sect_ev);
38707 + atomic_add_unchecked(size >> 9, &device->rs_sect_ev);
38708
38709 submit:
38710 update_receiver_timing_details(connection, drbd_submit_peer_request);
38711 @@ -4564,7 +4564,7 @@ struct data_cmd {
38712 int expect_payload;
38713 size_t pkt_size;
38714 int (*fn)(struct drbd_connection *, struct packet_info *);
38715 -};
38716 +} __do_const;
38717
38718 static struct data_cmd drbd_cmd_handler[] = {
38719 [P_DATA] = { 1, sizeof(struct p_data), receive_Data },
38720 @@ -4678,7 +4678,7 @@ static void conn_disconnect(struct drbd_connection *connection)
38721 if (!list_empty(&connection->current_epoch->list))
38722 drbd_err(connection, "ASSERTION FAILED: connection->current_epoch->list not empty\n");
38723 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
38724 - atomic_set(&connection->current_epoch->epoch_size, 0);
38725 + atomic_set_unchecked(&connection->current_epoch->epoch_size, 0);
38726 connection->send.seen_any_write_yet = false;
38727
38728 drbd_info(connection, "Connection closed\n");
38729 @@ -5182,7 +5182,7 @@ static int got_IsInSync(struct drbd_connection *connection, struct packet_info *
38730 put_ldev(device);
38731 }
38732 dec_rs_pending(device);
38733 - atomic_add(blksize >> 9, &device->rs_sect_in);
38734 + atomic_add_unchecked(blksize >> 9, &device->rs_sect_in);
38735
38736 return 0;
38737 }
38738 @@ -5470,7 +5470,7 @@ static int connection_finish_peer_reqs(struct drbd_connection *connection)
38739 struct asender_cmd {
38740 size_t pkt_size;
38741 int (*fn)(struct drbd_connection *connection, struct packet_info *);
38742 -};
38743 +} __do_const;
38744
38745 static struct asender_cmd asender_tbl[] = {
38746 [P_PING] = { 0, got_Ping },
38747 diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c
38748 index d0fae55..4469096 100644
38749 --- a/drivers/block/drbd/drbd_worker.c
38750 +++ b/drivers/block/drbd/drbd_worker.c
38751 @@ -408,7 +408,7 @@ static int read_for_csum(struct drbd_peer_device *peer_device, sector_t sector,
38752 list_add_tail(&peer_req->w.list, &device->read_ee);
38753 spin_unlock_irq(&device->resource->req_lock);
38754
38755 - atomic_add(size >> 9, &device->rs_sect_ev);
38756 + atomic_add_unchecked(size >> 9, &device->rs_sect_ev);
38757 if (drbd_submit_peer_request(device, peer_req, READ, DRBD_FAULT_RS_RD) == 0)
38758 return 0;
38759
38760 @@ -553,7 +553,7 @@ static int drbd_rs_number_requests(struct drbd_device *device)
38761 unsigned int sect_in; /* Number of sectors that came in since the last turn */
38762 int number, mxb;
38763
38764 - sect_in = atomic_xchg(&device->rs_sect_in, 0);
38765 + sect_in = atomic_xchg_unchecked(&device->rs_sect_in, 0);
38766 device->rs_in_flight -= sect_in;
38767
38768 rcu_read_lock();
38769 @@ -1595,8 +1595,8 @@ void drbd_rs_controller_reset(struct drbd_device *device)
38770 struct gendisk *disk = device->ldev->backing_bdev->bd_contains->bd_disk;
38771 struct fifo_buffer *plan;
38772
38773 - atomic_set(&device->rs_sect_in, 0);
38774 - atomic_set(&device->rs_sect_ev, 0);
38775 + atomic_set_unchecked(&device->rs_sect_in, 0);
38776 + atomic_set_unchecked(&device->rs_sect_ev, 0);
38777 device->rs_in_flight = 0;
38778 device->rs_last_events =
38779 (int)part_stat_read(&disk->part0, sectors[0]) +
38780 diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
38781 index 09e628da..7607aaa 100644
38782 --- a/drivers/block/pktcdvd.c
38783 +++ b/drivers/block/pktcdvd.c
38784 @@ -108,7 +108,7 @@ static int pkt_seq_show(struct seq_file *m, void *p);
38785
38786 static sector_t get_zone(sector_t sector, struct pktcdvd_device *pd)
38787 {
38788 - return (sector + pd->offset) & ~(sector_t)(pd->settings.size - 1);
38789 + return (sector + pd->offset) & ~(sector_t)(pd->settings.size - 1UL);
38790 }
38791
38792 /*
38793 @@ -1890,7 +1890,7 @@ static noinline_for_stack int pkt_probe_settings(struct pktcdvd_device *pd)
38794 return -EROFS;
38795 }
38796 pd->settings.fp = ti.fp;
38797 - pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1);
38798 + pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1UL);
38799
38800 if (ti.nwa_v) {
38801 pd->nwa = be32_to_cpu(ti.next_writable);
38802 diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
38803 index ec6c5c6..820ee2abc 100644
38804 --- a/drivers/block/rbd.c
38805 +++ b/drivers/block/rbd.c
38806 @@ -64,7 +64,7 @@
38807 * If the counter is already at its maximum value returns
38808 * -EINVAL without updating it.
38809 */
38810 -static int atomic_inc_return_safe(atomic_t *v)
38811 +static int __intentional_overflow(-1) atomic_inc_return_safe(atomic_t *v)
38812 {
38813 unsigned int counter;
38814
38815 diff --git a/drivers/block/smart1,2.h b/drivers/block/smart1,2.h
38816 index e5565fb..71be10b4 100644
38817 --- a/drivers/block/smart1,2.h
38818 +++ b/drivers/block/smart1,2.h
38819 @@ -108,11 +108,11 @@ static unsigned long smart4_intr_pending(ctlr_info_t *h)
38820 }
38821
38822 static struct access_method smart4_access = {
38823 - smart4_submit_command,
38824 - smart4_intr_mask,
38825 - smart4_fifo_full,
38826 - smart4_intr_pending,
38827 - smart4_completed,
38828 + .submit_command = smart4_submit_command,
38829 + .set_intr_mask = smart4_intr_mask,
38830 + .fifo_full = smart4_fifo_full,
38831 + .intr_pending = smart4_intr_pending,
38832 + .command_completed = smart4_completed,
38833 };
38834
38835 /*
38836 @@ -144,11 +144,11 @@ static unsigned long smart2_intr_pending(ctlr_info_t *h)
38837 }
38838
38839 static struct access_method smart2_access = {
38840 - smart2_submit_command,
38841 - smart2_intr_mask,
38842 - smart2_fifo_full,
38843 - smart2_intr_pending,
38844 - smart2_completed,
38845 + .submit_command = smart2_submit_command,
38846 + .set_intr_mask = smart2_intr_mask,
38847 + .fifo_full = smart2_fifo_full,
38848 + .intr_pending = smart2_intr_pending,
38849 + .command_completed = smart2_completed,
38850 };
38851
38852 /*
38853 @@ -180,11 +180,11 @@ static unsigned long smart2e_intr_pending(ctlr_info_t *h)
38854 }
38855
38856 static struct access_method smart2e_access = {
38857 - smart2e_submit_command,
38858 - smart2e_intr_mask,
38859 - smart2e_fifo_full,
38860 - smart2e_intr_pending,
38861 - smart2e_completed,
38862 + .submit_command = smart2e_submit_command,
38863 + .set_intr_mask = smart2e_intr_mask,
38864 + .fifo_full = smart2e_fifo_full,
38865 + .intr_pending = smart2e_intr_pending,
38866 + .command_completed = smart2e_completed,
38867 };
38868
38869 /*
38870 @@ -270,9 +270,9 @@ static unsigned long smart1_intr_pending(ctlr_info_t *h)
38871 }
38872
38873 static struct access_method smart1_access = {
38874 - smart1_submit_command,
38875 - smart1_intr_mask,
38876 - smart1_fifo_full,
38877 - smart1_intr_pending,
38878 - smart1_completed,
38879 + .submit_command = smart1_submit_command,
38880 + .set_intr_mask = smart1_intr_mask,
38881 + .fifo_full = smart1_fifo_full,
38882 + .intr_pending = smart1_intr_pending,
38883 + .command_completed = smart1_completed,
38884 };
38885 diff --git a/drivers/bluetooth/btwilink.c b/drivers/bluetooth/btwilink.c
38886 index 55c135b..9f8d60c 100644
38887 --- a/drivers/bluetooth/btwilink.c
38888 +++ b/drivers/bluetooth/btwilink.c
38889 @@ -288,7 +288,7 @@ static int ti_st_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
38890
38891 static int bt_ti_probe(struct platform_device *pdev)
38892 {
38893 - static struct ti_st *hst;
38894 + struct ti_st *hst;
38895 struct hci_dev *hdev;
38896 int err;
38897
38898 diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
38899 index 5d28a45..a538f90 100644
38900 --- a/drivers/cdrom/cdrom.c
38901 +++ b/drivers/cdrom/cdrom.c
38902 @@ -610,7 +610,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
38903 ENSURE(reset, CDC_RESET);
38904 ENSURE(generic_packet, CDC_GENERIC_PACKET);
38905 cdi->mc_flags = 0;
38906 - cdo->n_minors = 0;
38907 cdi->options = CDO_USE_FFLAGS;
38908
38909 if (autoclose == 1 && CDROM_CAN(CDC_CLOSE_TRAY))
38910 @@ -630,8 +629,11 @@ int register_cdrom(struct cdrom_device_info *cdi)
38911 else
38912 cdi->cdda_method = CDDA_OLD;
38913
38914 - if (!cdo->generic_packet)
38915 - cdo->generic_packet = cdrom_dummy_generic_packet;
38916 + if (!cdo->generic_packet) {
38917 + pax_open_kernel();
38918 + *(void **)&cdo->generic_packet = cdrom_dummy_generic_packet;
38919 + pax_close_kernel();
38920 + }
38921
38922 cd_dbg(CD_REG_UNREG, "drive \"/dev/%s\" registered\n", cdi->name);
38923 mutex_lock(&cdrom_mutex);
38924 @@ -652,7 +654,6 @@ void unregister_cdrom(struct cdrom_device_info *cdi)
38925 if (cdi->exit)
38926 cdi->exit(cdi);
38927
38928 - cdi->ops->n_minors--;
38929 cd_dbg(CD_REG_UNREG, "drive \"/dev/%s\" unregistered\n", cdi->name);
38930 }
38931
38932 @@ -2126,7 +2127,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
38933 */
38934 nr = nframes;
38935 do {
38936 - cgc.buffer = kmalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
38937 + cgc.buffer = kzalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
38938 if (cgc.buffer)
38939 break;
38940
38941 @@ -3434,7 +3435,7 @@ static int cdrom_print_info(const char *header, int val, char *info,
38942 struct cdrom_device_info *cdi;
38943 int ret;
38944
38945 - ret = scnprintf(info + *pos, max_size - *pos, header);
38946 + ret = scnprintf(info + *pos, max_size - *pos, "%s", header);
38947 if (!ret)
38948 return 1;
38949
38950 diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
38951 index 584bc31..e64a12c 100644
38952 --- a/drivers/cdrom/gdrom.c
38953 +++ b/drivers/cdrom/gdrom.c
38954 @@ -491,7 +491,6 @@ static struct cdrom_device_ops gdrom_ops = {
38955 .audio_ioctl = gdrom_audio_ioctl,
38956 .capability = CDC_MULTI_SESSION | CDC_MEDIA_CHANGED |
38957 CDC_RESET | CDC_DRIVE_STATUS | CDC_CD_R,
38958 - .n_minors = 1,
38959 };
38960
38961 static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
38962 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
38963 index a4af822..ed58cd1 100644
38964 --- a/drivers/char/Kconfig
38965 +++ b/drivers/char/Kconfig
38966 @@ -17,7 +17,8 @@ config DEVMEM
38967
38968 config DEVKMEM
38969 bool "/dev/kmem virtual device support"
38970 - default y
38971 + default n
38972 + depends on !GRKERNSEC_KMEM
38973 help
38974 Say Y here if you want to support the /dev/kmem device. The
38975 /dev/kmem device is rarely used, but can be used for certain
38976 @@ -586,6 +587,7 @@ config DEVPORT
38977 bool
38978 depends on !M68K
38979 depends on ISA || PCI
38980 + depends on !GRKERNSEC_KMEM
38981 default y
38982
38983 source "drivers/s390/char/Kconfig"
38984 diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
38985 index a48e05b..6bac831 100644
38986 --- a/drivers/char/agp/compat_ioctl.c
38987 +++ b/drivers/char/agp/compat_ioctl.c
38988 @@ -108,7 +108,7 @@ static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user
38989 return -ENOMEM;
38990 }
38991
38992 - if (copy_from_user(usegment, (void __user *) ureserve.seg_list,
38993 + if (copy_from_user(usegment, (void __force_user *) ureserve.seg_list,
38994 sizeof(*usegment) * ureserve.seg_count)) {
38995 kfree(usegment);
38996 kfree(ksegment);
38997 diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
38998 index 09f17eb..8531d2f 100644
38999 --- a/drivers/char/agp/frontend.c
39000 +++ b/drivers/char/agp/frontend.c
39001 @@ -806,7 +806,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
39002 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
39003 return -EFAULT;
39004
39005 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
39006 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
39007 return -EFAULT;
39008
39009 client = agp_find_client_by_pid(reserve.pid);
39010 @@ -836,7 +836,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
39011 if (segment == NULL)
39012 return -ENOMEM;
39013
39014 - if (copy_from_user(segment, (void __user *) reserve.seg_list,
39015 + if (copy_from_user(segment, (void __force_user *) reserve.seg_list,
39016 sizeof(struct agp_segment) * reserve.seg_count)) {
39017 kfree(segment);
39018 return -EFAULT;
39019 diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
39020 index 4f94375..413694e 100644
39021 --- a/drivers/char/genrtc.c
39022 +++ b/drivers/char/genrtc.c
39023 @@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *file,
39024 switch (cmd) {
39025
39026 case RTC_PLL_GET:
39027 + memset(&pll, 0, sizeof(pll));
39028 if (get_rtc_pll(&pll))
39029 return -EINVAL;
39030 else
39031 diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
39032 index 5c0baa9..44011b1 100644
39033 --- a/drivers/char/hpet.c
39034 +++ b/drivers/char/hpet.c
39035 @@ -575,7 +575,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
39036 }
39037
39038 static int
39039 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
39040 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
39041 struct hpet_info *info)
39042 {
39043 struct hpet_timer __iomem *timer;
39044 diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
39045 index a43048b..14724d5 100644
39046 --- a/drivers/char/i8k.c
39047 +++ b/drivers/char/i8k.c
39048 @@ -790,7 +790,7 @@ static const struct i8k_config_data i8k_config_data[] = {
39049 },
39050 };
39051
39052 -static struct dmi_system_id i8k_dmi_table[] __initdata = {
39053 +static const struct dmi_system_id i8k_dmi_table[] __initconst = {
39054 {
39055 .ident = "Dell Inspiron",
39056 .matches = {
39057 diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
39058 index bf75f63..359fa10 100644
39059 --- a/drivers/char/ipmi/ipmi_msghandler.c
39060 +++ b/drivers/char/ipmi/ipmi_msghandler.c
39061 @@ -436,7 +436,7 @@ struct ipmi_smi {
39062 struct proc_dir_entry *proc_dir;
39063 char proc_dir_name[10];
39064
39065 - atomic_t stats[IPMI_NUM_STATS];
39066 + atomic_unchecked_t stats[IPMI_NUM_STATS];
39067
39068 /*
39069 * run_to_completion duplicate of smb_info, smi_info
39070 @@ -468,9 +468,9 @@ static LIST_HEAD(smi_watchers);
39071 static DEFINE_MUTEX(smi_watchers_mutex);
39072
39073 #define ipmi_inc_stat(intf, stat) \
39074 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
39075 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
39076 #define ipmi_get_stat(intf, stat) \
39077 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
39078 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
39079
39080 static char *addr_src_to_str[] = { "invalid", "hotmod", "hardcoded", "SPMI",
39081 "ACPI", "SMBIOS", "PCI",
39082 @@ -2828,7 +2828,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
39083 INIT_LIST_HEAD(&intf->cmd_rcvrs);
39084 init_waitqueue_head(&intf->waitq);
39085 for (i = 0; i < IPMI_NUM_STATS; i++)
39086 - atomic_set(&intf->stats[i], 0);
39087 + atomic_set_unchecked(&intf->stats[i], 0);
39088
39089 intf->proc_dir = NULL;
39090
39091 diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
39092 index 8a45e92..e41b1c7 100644
39093 --- a/drivers/char/ipmi/ipmi_si_intf.c
39094 +++ b/drivers/char/ipmi/ipmi_si_intf.c
39095 @@ -289,7 +289,7 @@ struct smi_info {
39096 unsigned char slave_addr;
39097
39098 /* Counters and things for the proc filesystem. */
39099 - atomic_t stats[SI_NUM_STATS];
39100 + atomic_unchecked_t stats[SI_NUM_STATS];
39101
39102 struct task_struct *thread;
39103
39104 @@ -298,9 +298,9 @@ struct smi_info {
39105 };
39106
39107 #define smi_inc_stat(smi, stat) \
39108 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
39109 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
39110 #define smi_get_stat(smi, stat) \
39111 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
39112 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
39113
39114 #define SI_MAX_PARMS 4
39115
39116 @@ -3500,7 +3500,7 @@ static int try_smi_init(struct smi_info *new_smi)
39117 atomic_set(&new_smi->req_events, 0);
39118 new_smi->run_to_completion = false;
39119 for (i = 0; i < SI_NUM_STATS; i++)
39120 - atomic_set(&new_smi->stats[i], 0);
39121 + atomic_set_unchecked(&new_smi->stats[i], 0);
39122
39123 new_smi->interrupt_disabled = true;
39124 atomic_set(&new_smi->need_watch, 0);
39125 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
39126 index 6b1721f..fda9398 100644
39127 --- a/drivers/char/mem.c
39128 +++ b/drivers/char/mem.c
39129 @@ -18,6 +18,7 @@
39130 #include <linux/raw.h>
39131 #include <linux/tty.h>
39132 #include <linux/capability.h>
39133 +#include <linux/security.h>
39134 #include <linux/ptrace.h>
39135 #include <linux/device.h>
39136 #include <linux/highmem.h>
39137 @@ -36,6 +37,10 @@
39138
39139 #define DEVPORT_MINOR 4
39140
39141 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
39142 +extern const struct file_operations grsec_fops;
39143 +#endif
39144 +
39145 static inline unsigned long size_inside_page(unsigned long start,
39146 unsigned long size)
39147 {
39148 @@ -67,9 +72,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
39149
39150 while (cursor < to) {
39151 if (!devmem_is_allowed(pfn)) {
39152 +#ifdef CONFIG_GRKERNSEC_KMEM
39153 + gr_handle_mem_readwrite(from, to);
39154 +#else
39155 printk(KERN_INFO
39156 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
39157 current->comm, from, to);
39158 +#endif
39159 return 0;
39160 }
39161 cursor += PAGE_SIZE;
39162 @@ -77,6 +86,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
39163 }
39164 return 1;
39165 }
39166 +#elif defined(CONFIG_GRKERNSEC_KMEM)
39167 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
39168 +{
39169 + return 0;
39170 +}
39171 #else
39172 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
39173 {
39174 @@ -124,7 +138,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
39175 #endif
39176
39177 while (count > 0) {
39178 - unsigned long remaining;
39179 + unsigned long remaining = 0;
39180 + char *temp;
39181
39182 sz = size_inside_page(p, count);
39183
39184 @@ -140,7 +155,24 @@ static ssize_t read_mem(struct file *file, char __user *buf,
39185 if (!ptr)
39186 return -EFAULT;
39187
39188 - remaining = copy_to_user(buf, ptr, sz);
39189 +#ifdef CONFIG_PAX_USERCOPY
39190 + temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
39191 + if (!temp) {
39192 + unxlate_dev_mem_ptr(p, ptr);
39193 + return -ENOMEM;
39194 + }
39195 + remaining = probe_kernel_read(temp, ptr, sz);
39196 +#else
39197 + temp = ptr;
39198 +#endif
39199 +
39200 + if (!remaining)
39201 + remaining = copy_to_user(buf, temp, sz);
39202 +
39203 +#ifdef CONFIG_PAX_USERCOPY
39204 + kfree(temp);
39205 +#endif
39206 +
39207 unxlate_dev_mem_ptr(p, ptr);
39208 if (remaining)
39209 return -EFAULT;
39210 @@ -380,9 +412,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
39211 size_t count, loff_t *ppos)
39212 {
39213 unsigned long p = *ppos;
39214 - ssize_t low_count, read, sz;
39215 + ssize_t low_count, read, sz, err = 0;
39216 char *kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
39217 - int err = 0;
39218
39219 read = 0;
39220 if (p < (unsigned long) high_memory) {
39221 @@ -404,6 +435,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
39222 }
39223 #endif
39224 while (low_count > 0) {
39225 + char *temp;
39226 +
39227 sz = size_inside_page(p, low_count);
39228
39229 /*
39230 @@ -413,7 +446,23 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
39231 */
39232 kbuf = xlate_dev_kmem_ptr((void *)p);
39233
39234 - if (copy_to_user(buf, kbuf, sz))
39235 +#ifdef CONFIG_PAX_USERCOPY
39236 + temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
39237 + if (!temp)
39238 + return -ENOMEM;
39239 + err = probe_kernel_read(temp, kbuf, sz);
39240 +#else
39241 + temp = kbuf;
39242 +#endif
39243 +
39244 + if (!err)
39245 + err = copy_to_user(buf, temp, sz);
39246 +
39247 +#ifdef CONFIG_PAX_USERCOPY
39248 + kfree(temp);
39249 +#endif
39250 +
39251 + if (err)
39252 return -EFAULT;
39253 buf += sz;
39254 p += sz;
39255 @@ -802,6 +851,9 @@ static const struct memdev {
39256 #ifdef CONFIG_PRINTK
39257 [11] = { "kmsg", 0644, &kmsg_fops, 0 },
39258 #endif
39259 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
39260 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, 0 },
39261 +#endif
39262 };
39263
39264 static int memory_open(struct inode *inode, struct file *filp)
39265 @@ -863,7 +915,7 @@ static int __init chr_dev_init(void)
39266 continue;
39267
39268 device_create(mem_class, NULL, MKDEV(MEM_MAJOR, minor),
39269 - NULL, devlist[minor].name);
39270 + NULL, "%s", devlist[minor].name);
39271 }
39272
39273 return tty_init();
39274 diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
39275 index 9df78e2..01ba9ae 100644
39276 --- a/drivers/char/nvram.c
39277 +++ b/drivers/char/nvram.c
39278 @@ -247,7 +247,7 @@ static ssize_t nvram_read(struct file *file, char __user *buf,
39279
39280 spin_unlock_irq(&rtc_lock);
39281
39282 - if (copy_to_user(buf, contents, tmp - contents))
39283 + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
39284 return -EFAULT;
39285
39286 *ppos = i;
39287 diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
39288 index 0ea9986..e7b07e4 100644
39289 --- a/drivers/char/pcmcia/synclink_cs.c
39290 +++ b/drivers/char/pcmcia/synclink_cs.c
39291 @@ -2345,7 +2345,7 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp)
39292
39293 if (debug_level >= DEBUG_LEVEL_INFO)
39294 printk("%s(%d):mgslpc_close(%s) entry, count=%d\n",
39295 - __FILE__, __LINE__, info->device_name, port->count);
39296 + __FILE__, __LINE__, info->device_name, atomic_read(&port->count));
39297
39298 if (tty_port_close_start(port, tty, filp) == 0)
39299 goto cleanup;
39300 @@ -2363,7 +2363,7 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp)
39301 cleanup:
39302 if (debug_level >= DEBUG_LEVEL_INFO)
39303 printk("%s(%d):mgslpc_close(%s) exit, count=%d\n", __FILE__, __LINE__,
39304 - tty->driver->name, port->count);
39305 + tty->driver->name, atomic_read(&port->count));
39306 }
39307
39308 /* Wait until the transmitter is empty.
39309 @@ -2505,7 +2505,7 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp)
39310
39311 if (debug_level >= DEBUG_LEVEL_INFO)
39312 printk("%s(%d):mgslpc_open(%s), old ref count = %d\n",
39313 - __FILE__, __LINE__, tty->driver->name, port->count);
39314 + __FILE__, __LINE__, tty->driver->name, atomic_read(&port->count));
39315
39316 /* If port is closing, signal caller to try again */
39317 if (port->flags & ASYNC_CLOSING){
39318 @@ -2525,11 +2525,11 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp)
39319 goto cleanup;
39320 }
39321 spin_lock(&port->lock);
39322 - port->count++;
39323 + atomic_inc(&port->count);
39324 spin_unlock(&port->lock);
39325 spin_unlock_irqrestore(&info->netlock, flags);
39326
39327 - if (port->count == 1) {
39328 + if (atomic_read(&port->count) == 1) {
39329 /* 1st open on this device, init hardware */
39330 retval = startup(info, tty);
39331 if (retval < 0)
39332 @@ -3918,7 +3918,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
39333 unsigned short new_crctype;
39334
39335 /* return error if TTY interface open */
39336 - if (info->port.count)
39337 + if (atomic_read(&info->port.count))
39338 return -EBUSY;
39339
39340 switch (encoding)
39341 @@ -4022,7 +4022,7 @@ static int hdlcdev_open(struct net_device *dev)
39342
39343 /* arbitrate between network and tty opens */
39344 spin_lock_irqsave(&info->netlock, flags);
39345 - if (info->port.count != 0 || info->netcount != 0) {
39346 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
39347 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
39348 spin_unlock_irqrestore(&info->netlock, flags);
39349 return -EBUSY;
39350 @@ -4112,7 +4112,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
39351 printk("%s:hdlcdev_ioctl(%s)\n", __FILE__, dev->name);
39352
39353 /* return error if TTY interface open */
39354 - if (info->port.count)
39355 + if (atomic_read(&info->port.count))
39356 return -EBUSY;
39357
39358 if (cmd != SIOCWANDEV)
39359 diff --git a/drivers/char/random.c b/drivers/char/random.c
39360 index 9cd6968..6416f00 100644
39361 --- a/drivers/char/random.c
39362 +++ b/drivers/char/random.c
39363 @@ -289,9 +289,6 @@
39364 /*
39365 * To allow fractional bits to be tracked, the entropy_count field is
39366 * denominated in units of 1/8th bits.
39367 - *
39368 - * 2*(ENTROPY_SHIFT + log2(poolbits)) must <= 31, or the multiply in
39369 - * credit_entropy_bits() needs to be 64 bits wide.
39370 */
39371 #define ENTROPY_SHIFT 3
39372 #define ENTROPY_BITS(r) ((r)->entropy_count >> ENTROPY_SHIFT)
39373 @@ -439,9 +436,9 @@ struct entropy_store {
39374 };
39375
39376 static void push_to_pool(struct work_struct *work);
39377 -static __u32 input_pool_data[INPUT_POOL_WORDS];
39378 -static __u32 blocking_pool_data[OUTPUT_POOL_WORDS];
39379 -static __u32 nonblocking_pool_data[OUTPUT_POOL_WORDS];
39380 +static __u32 input_pool_data[INPUT_POOL_WORDS] __latent_entropy;
39381 +static __u32 blocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
39382 +static __u32 nonblocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
39383
39384 static struct entropy_store input_pool = {
39385 .poolinfo = &poolinfo_table[0],
39386 @@ -635,7 +632,7 @@ retry:
39387 /* The +2 corresponds to the /4 in the denominator */
39388
39389 do {
39390 - unsigned int anfrac = min(pnfrac, pool_size/2);
39391 + u64 anfrac = min(pnfrac, pool_size/2);
39392 unsigned int add =
39393 ((pool_size - entropy_count)*anfrac*3) >> s;
39394
39395 @@ -1207,7 +1204,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
39396
39397 extract_buf(r, tmp);
39398 i = min_t(int, nbytes, EXTRACT_SIZE);
39399 - if (copy_to_user(buf, tmp, i)) {
39400 + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
39401 ret = -EFAULT;
39402 break;
39403 }
39404 @@ -1590,7 +1587,7 @@ static char sysctl_bootid[16];
39405 static int proc_do_uuid(struct ctl_table *table, int write,
39406 void __user *buffer, size_t *lenp, loff_t *ppos)
39407 {
39408 - struct ctl_table fake_table;
39409 + ctl_table_no_const fake_table;
39410 unsigned char buf[64], tmp_uuid[16], *uuid;
39411
39412 uuid = table->data;
39413 @@ -1620,7 +1617,7 @@ static int proc_do_uuid(struct ctl_table *table, int write,
39414 static int proc_do_entropy(struct ctl_table *table, int write,
39415 void __user *buffer, size_t *lenp, loff_t *ppos)
39416 {
39417 - struct ctl_table fake_table;
39418 + ctl_table_no_const fake_table;
39419 int entropy_count;
39420
39421 entropy_count = *(int *)table->data >> ENTROPY_SHIFT;
39422 diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
39423 index e496dae..3db53b6 100644
39424 --- a/drivers/char/sonypi.c
39425 +++ b/drivers/char/sonypi.c
39426 @@ -54,6 +54,7 @@
39427
39428 #include <asm/uaccess.h>
39429 #include <asm/io.h>
39430 +#include <asm/local.h>
39431
39432 #include <linux/sonypi.h>
39433
39434 @@ -490,7 +491,7 @@ static struct sonypi_device {
39435 spinlock_t fifo_lock;
39436 wait_queue_head_t fifo_proc_list;
39437 struct fasync_struct *fifo_async;
39438 - int open_count;
39439 + local_t open_count;
39440 int model;
39441 struct input_dev *input_jog_dev;
39442 struct input_dev *input_key_dev;
39443 @@ -892,7 +893,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
39444 static int sonypi_misc_release(struct inode *inode, struct file *file)
39445 {
39446 mutex_lock(&sonypi_device.lock);
39447 - sonypi_device.open_count--;
39448 + local_dec(&sonypi_device.open_count);
39449 mutex_unlock(&sonypi_device.lock);
39450 return 0;
39451 }
39452 @@ -901,9 +902,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
39453 {
39454 mutex_lock(&sonypi_device.lock);
39455 /* Flush input queue on first open */
39456 - if (!sonypi_device.open_count)
39457 + if (!local_read(&sonypi_device.open_count))
39458 kfifo_reset(&sonypi_device.fifo);
39459 - sonypi_device.open_count++;
39460 + local_inc(&sonypi_device.open_count);
39461 mutex_unlock(&sonypi_device.lock);
39462
39463 return 0;
39464 @@ -1491,7 +1492,7 @@ static struct platform_driver sonypi_driver = {
39465
39466 static struct platform_device *sonypi_platform_device;
39467
39468 -static struct dmi_system_id __initdata sonypi_dmi_table[] = {
39469 +static const struct dmi_system_id __initconst sonypi_dmi_table[] = {
39470 {
39471 .ident = "Sony Vaio",
39472 .matches = {
39473 diff --git a/drivers/char/tpm/tpm_acpi.c b/drivers/char/tpm/tpm_acpi.c
39474 index 565a947..dcdc06e 100644
39475 --- a/drivers/char/tpm/tpm_acpi.c
39476 +++ b/drivers/char/tpm/tpm_acpi.c
39477 @@ -98,11 +98,12 @@ int read_log(struct tpm_bios_log *log)
39478 virt = acpi_os_map_iomem(start, len);
39479 if (!virt) {
39480 kfree(log->bios_event_log);
39481 + log->bios_event_log = NULL;
39482 printk("%s: ERROR - Unable to map memory\n", __func__);
39483 return -EIO;
39484 }
39485
39486 - memcpy_fromio(log->bios_event_log, virt, len);
39487 + memcpy_fromio(log->bios_event_log, (const char __force_kernel *)virt, len);
39488
39489 acpi_os_unmap_iomem(virt, len);
39490 return 0;
39491 diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c
39492 index 3a56a13..f8cbd25 100644
39493 --- a/drivers/char/tpm/tpm_eventlog.c
39494 +++ b/drivers/char/tpm/tpm_eventlog.c
39495 @@ -95,7 +95,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
39496 event = addr;
39497
39498 if ((event->event_type == 0 && event->event_size == 0) ||
39499 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
39500 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
39501 return NULL;
39502
39503 return addr;
39504 @@ -120,7 +120,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
39505 return NULL;
39506
39507 if ((event->event_type == 0 && event->event_size == 0) ||
39508 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
39509 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
39510 return NULL;
39511
39512 (*pos)++;
39513 @@ -213,7 +213,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
39514 int i;
39515
39516 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
39517 - seq_putc(m, data[i]);
39518 + if (!seq_putc(m, data[i]))
39519 + return -EFAULT;
39520
39521 return 0;
39522 }
39523 diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
39524 index 50754d20..9561cdc 100644
39525 --- a/drivers/char/virtio_console.c
39526 +++ b/drivers/char/virtio_console.c
39527 @@ -685,7 +685,7 @@ static ssize_t fill_readbuf(struct port *port, char __user *out_buf,
39528 if (to_user) {
39529 ssize_t ret;
39530
39531 - ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
39532 + ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
39533 if (ret)
39534 return -EFAULT;
39535 } else {
39536 @@ -789,7 +789,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
39537 if (!port_has_data(port) && !port->host_connected)
39538 return 0;
39539
39540 - return fill_readbuf(port, ubuf, count, true);
39541 + return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
39542 }
39543
39544 static int wait_port_writable(struct port *port, bool nonblock)
39545 diff --git a/drivers/clk/clk-composite.c b/drivers/clk/clk-composite.c
39546 index 956b7e5..b655045 100644
39547 --- a/drivers/clk/clk-composite.c
39548 +++ b/drivers/clk/clk-composite.c
39549 @@ -197,7 +197,7 @@ struct clk *clk_register_composite(struct device *dev, const char *name,
39550 struct clk *clk;
39551 struct clk_init_data init;
39552 struct clk_composite *composite;
39553 - struct clk_ops *clk_composite_ops;
39554 + clk_ops_no_const *clk_composite_ops;
39555
39556 composite = kzalloc(sizeof(*composite), GFP_KERNEL);
39557 if (!composite) {
39558 diff --git a/drivers/clk/samsung/clk.h b/drivers/clk/samsung/clk.h
39559 index e4c7538..99c50cd 100644
39560 --- a/drivers/clk/samsung/clk.h
39561 +++ b/drivers/clk/samsung/clk.h
39562 @@ -260,7 +260,7 @@ struct samsung_gate_clock {
39563 #define GATE_DA(_id, dname, cname, pname, o, b, f, gf, a) \
39564 __GATE(_id, dname, cname, pname, o, b, f, gf, a)
39565
39566 -#define PNAME(x) static const char *x[] __initdata
39567 +#define PNAME(x) static const char * const x[] __initconst
39568
39569 /**
39570 * struct samsung_clk_reg_dump: register dump of clock controller registers.
39571 diff --git a/drivers/clk/socfpga/clk-gate.c b/drivers/clk/socfpga/clk-gate.c
39572 index dd3a78c..386d49c 100644
39573 --- a/drivers/clk/socfpga/clk-gate.c
39574 +++ b/drivers/clk/socfpga/clk-gate.c
39575 @@ -22,6 +22,7 @@
39576 #include <linux/mfd/syscon.h>
39577 #include <linux/of.h>
39578 #include <linux/regmap.h>
39579 +#include <asm/pgtable.h>
39580
39581 #include "clk.h"
39582
39583 @@ -174,7 +175,7 @@ static int socfpga_clk_prepare(struct clk_hw *hwclk)
39584 return 0;
39585 }
39586
39587 -static struct clk_ops gateclk_ops = {
39588 +static clk_ops_no_const gateclk_ops __read_only = {
39589 .prepare = socfpga_clk_prepare,
39590 .recalc_rate = socfpga_clk_recalc_rate,
39591 .get_parent = socfpga_clk_get_parent,
39592 @@ -208,8 +209,10 @@ static void __init __socfpga_gate_init(struct device_node *node,
39593 socfpga_clk->hw.reg = clk_mgr_base_addr + clk_gate[0];
39594 socfpga_clk->hw.bit_idx = clk_gate[1];
39595
39596 - gateclk_ops.enable = clk_gate_ops.enable;
39597 - gateclk_ops.disable = clk_gate_ops.disable;
39598 + pax_open_kernel();
39599 + *(void **)&gateclk_ops.enable = clk_gate_ops.enable;
39600 + *(void **)&gateclk_ops.disable = clk_gate_ops.disable;
39601 + pax_close_kernel();
39602 }
39603
39604 rc = of_property_read_u32(node, "fixed-divider", &fixed_div);
39605 diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
39606 index de6da95..c98278b 100644
39607 --- a/drivers/clk/socfpga/clk-pll.c
39608 +++ b/drivers/clk/socfpga/clk-pll.c
39609 @@ -21,6 +21,7 @@
39610 #include <linux/io.h>
39611 #include <linux/of.h>
39612 #include <linux/of_address.h>
39613 +#include <asm/pgtable.h>
39614
39615 #include "clk.h"
39616
39617 @@ -76,7 +77,7 @@ static u8 clk_pll_get_parent(struct clk_hw *hwclk)
39618 CLK_MGR_PLL_CLK_SRC_MASK;
39619 }
39620
39621 -static struct clk_ops clk_pll_ops = {
39622 +static clk_ops_no_const clk_pll_ops __read_only = {
39623 .recalc_rate = clk_pll_recalc_rate,
39624 .get_parent = clk_pll_get_parent,
39625 };
39626 @@ -120,8 +121,10 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
39627 pll_clk->hw.hw.init = &init;
39628
39629 pll_clk->hw.bit_idx = SOCFPGA_PLL_EXT_ENA;
39630 - clk_pll_ops.enable = clk_gate_ops.enable;
39631 - clk_pll_ops.disable = clk_gate_ops.disable;
39632 + pax_open_kernel();
39633 + *(void **)&clk_pll_ops.enable = clk_gate_ops.enable;
39634 + *(void **)&clk_pll_ops.disable = clk_gate_ops.disable;
39635 + pax_close_kernel();
39636
39637 clk = clk_register(NULL, &pll_clk->hw.hw);
39638 if (WARN_ON(IS_ERR(clk))) {
39639 diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
39640 index b0c18ed..1713a80 100644
39641 --- a/drivers/cpufreq/acpi-cpufreq.c
39642 +++ b/drivers/cpufreq/acpi-cpufreq.c
39643 @@ -675,8 +675,11 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
39644 data->acpi_data = per_cpu_ptr(acpi_perf_data, cpu);
39645 per_cpu(acfreq_data, cpu) = data;
39646
39647 - if (cpu_has(c, X86_FEATURE_CONSTANT_TSC))
39648 - acpi_cpufreq_driver.flags |= CPUFREQ_CONST_LOOPS;
39649 + if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) {
39650 + pax_open_kernel();
39651 + *(u8 *)&acpi_cpufreq_driver.flags |= CPUFREQ_CONST_LOOPS;
39652 + pax_close_kernel();
39653 + }
39654
39655 result = acpi_processor_register_performance(data->acpi_data, cpu);
39656 if (result)
39657 @@ -809,7 +812,9 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
39658 policy->cur = acpi_cpufreq_guess_freq(data, policy->cpu);
39659 break;
39660 case ACPI_ADR_SPACE_FIXED_HARDWARE:
39661 - acpi_cpufreq_driver.get = get_cur_freq_on_cpu;
39662 + pax_open_kernel();
39663 + *(void **)&acpi_cpufreq_driver.get = get_cur_freq_on_cpu;
39664 + pax_close_kernel();
39665 break;
39666 default:
39667 break;
39668 @@ -903,8 +908,10 @@ static void __init acpi_cpufreq_boost_init(void)
39669 if (!msrs)
39670 return;
39671
39672 - acpi_cpufreq_driver.boost_supported = true;
39673 - acpi_cpufreq_driver.boost_enabled = boost_state(0);
39674 + pax_open_kernel();
39675 + *(bool *)&acpi_cpufreq_driver.boost_supported = true;
39676 + *(bool *)&acpi_cpufreq_driver.boost_enabled = boost_state(0);
39677 + pax_close_kernel();
39678
39679 cpu_notifier_register_begin();
39680
39681 diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
39682 index bab67db..91af7e3 100644
39683 --- a/drivers/cpufreq/cpufreq-dt.c
39684 +++ b/drivers/cpufreq/cpufreq-dt.c
39685 @@ -392,7 +392,9 @@ static int dt_cpufreq_probe(struct platform_device *pdev)
39686 if (!IS_ERR(cpu_reg))
39687 regulator_put(cpu_reg);
39688
39689 - dt_cpufreq_driver.driver_data = dev_get_platdata(&pdev->dev);
39690 + pax_open_kernel();
39691 + *(void **)&dt_cpufreq_driver.driver_data = dev_get_platdata(&pdev->dev);
39692 + pax_close_kernel();
39693
39694 ret = cpufreq_register_driver(&dt_cpufreq_driver);
39695 if (ret)
39696 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
39697 index 8ae655c..3141442 100644
39698 --- a/drivers/cpufreq/cpufreq.c
39699 +++ b/drivers/cpufreq/cpufreq.c
39700 @@ -2108,7 +2108,7 @@ void cpufreq_unregister_governor(struct cpufreq_governor *governor)
39701 }
39702
39703 mutex_lock(&cpufreq_governor_mutex);
39704 - list_del(&governor->governor_list);
39705 + pax_list_del(&governor->governor_list);
39706 mutex_unlock(&cpufreq_governor_mutex);
39707 return;
39708 }
39709 @@ -2323,7 +2323,7 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
39710 return NOTIFY_OK;
39711 }
39712
39713 -static struct notifier_block __refdata cpufreq_cpu_notifier = {
39714 +static struct notifier_block cpufreq_cpu_notifier = {
39715 .notifier_call = cpufreq_cpu_callback,
39716 };
39717
39718 @@ -2363,13 +2363,17 @@ int cpufreq_boost_trigger_state(int state)
39719 return 0;
39720
39721 write_lock_irqsave(&cpufreq_driver_lock, flags);
39722 - cpufreq_driver->boost_enabled = state;
39723 + pax_open_kernel();
39724 + *(bool *)&cpufreq_driver->boost_enabled = state;
39725 + pax_close_kernel();
39726 write_unlock_irqrestore(&cpufreq_driver_lock, flags);
39727
39728 ret = cpufreq_driver->set_boost(state);
39729 if (ret) {
39730 write_lock_irqsave(&cpufreq_driver_lock, flags);
39731 - cpufreq_driver->boost_enabled = !state;
39732 + pax_open_kernel();
39733 + *(bool *)&cpufreq_driver->boost_enabled = !state;
39734 + pax_close_kernel();
39735 write_unlock_irqrestore(&cpufreq_driver_lock, flags);
39736
39737 pr_err("%s: Cannot %s BOOST\n",
39738 @@ -2434,16 +2438,22 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
39739 cpufreq_driver = driver_data;
39740 write_unlock_irqrestore(&cpufreq_driver_lock, flags);
39741
39742 - if (driver_data->setpolicy)
39743 - driver_data->flags |= CPUFREQ_CONST_LOOPS;
39744 + if (driver_data->setpolicy) {
39745 + pax_open_kernel();
39746 + *(u8 *)&driver_data->flags |= CPUFREQ_CONST_LOOPS;
39747 + pax_close_kernel();
39748 + }
39749
39750 if (cpufreq_boost_supported()) {
39751 /*
39752 * Check if driver provides function to enable boost -
39753 * if not, use cpufreq_boost_set_sw as default
39754 */
39755 - if (!cpufreq_driver->set_boost)
39756 - cpufreq_driver->set_boost = cpufreq_boost_set_sw;
39757 + if (!cpufreq_driver->set_boost) {
39758 + pax_open_kernel();
39759 + *(void **)&cpufreq_driver->set_boost = cpufreq_boost_set_sw;
39760 + pax_close_kernel();
39761 + }
39762
39763 ret = cpufreq_sysfs_create_file(&boost.attr);
39764 if (ret) {
39765 diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
39766 index 1b44496..b80ff5e 100644
39767 --- a/drivers/cpufreq/cpufreq_governor.c
39768 +++ b/drivers/cpufreq/cpufreq_governor.c
39769 @@ -245,7 +245,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
39770 struct dbs_data *dbs_data;
39771 struct od_cpu_dbs_info_s *od_dbs_info = NULL;
39772 struct cs_cpu_dbs_info_s *cs_dbs_info = NULL;
39773 - struct od_ops *od_ops = NULL;
39774 + const struct od_ops *od_ops = NULL;
39775 struct od_dbs_tuners *od_tuners = NULL;
39776 struct cs_dbs_tuners *cs_tuners = NULL;
39777 struct cpu_dbs_common_info *cpu_cdbs;
39778 @@ -311,7 +311,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
39779
39780 if ((cdata->governor == GOV_CONSERVATIVE) &&
39781 (!policy->governor->initialized)) {
39782 - struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39783 + const struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39784
39785 cpufreq_register_notifier(cs_ops->notifier_block,
39786 CPUFREQ_TRANSITION_NOTIFIER);
39787 @@ -331,7 +331,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
39788
39789 if ((dbs_data->cdata->governor == GOV_CONSERVATIVE) &&
39790 (policy->governor->initialized == 1)) {
39791 - struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39792 + const struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39793
39794 cpufreq_unregister_notifier(cs_ops->notifier_block,
39795 CPUFREQ_TRANSITION_NOTIFIER);
39796 diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
39797 index cc401d1..8197340 100644
39798 --- a/drivers/cpufreq/cpufreq_governor.h
39799 +++ b/drivers/cpufreq/cpufreq_governor.h
39800 @@ -212,7 +212,7 @@ struct common_dbs_data {
39801 void (*exit)(struct dbs_data *dbs_data);
39802
39803 /* Governor specific ops, see below */
39804 - void *gov_ops;
39805 + const void *gov_ops;
39806 };
39807
39808 /* Governor Per policy data */
39809 @@ -232,7 +232,7 @@ struct od_ops {
39810 unsigned int (*powersave_bias_target)(struct cpufreq_policy *policy,
39811 unsigned int freq_next, unsigned int relation);
39812 void (*freq_increase)(struct cpufreq_policy *policy, unsigned int freq);
39813 -};
39814 +} __no_const;
39815
39816 struct cs_ops {
39817 struct notifier_block *notifier_block;
39818 diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
39819 index ad3f38f..8f086cd 100644
39820 --- a/drivers/cpufreq/cpufreq_ondemand.c
39821 +++ b/drivers/cpufreq/cpufreq_ondemand.c
39822 @@ -524,7 +524,7 @@ static void od_exit(struct dbs_data *dbs_data)
39823
39824 define_get_cpu_dbs_routines(od_cpu_dbs_info);
39825
39826 -static struct od_ops od_ops = {
39827 +static struct od_ops od_ops __read_only = {
39828 .powersave_bias_init_cpu = ondemand_powersave_bias_init_cpu,
39829 .powersave_bias_target = generic_powersave_bias_target,
39830 .freq_increase = dbs_freq_increase,
39831 @@ -579,14 +579,18 @@ void od_register_powersave_bias_handler(unsigned int (*f)
39832 (struct cpufreq_policy *, unsigned int, unsigned int),
39833 unsigned int powersave_bias)
39834 {
39835 - od_ops.powersave_bias_target = f;
39836 + pax_open_kernel();
39837 + *(void **)&od_ops.powersave_bias_target = f;
39838 + pax_close_kernel();
39839 od_set_powersave_bias(powersave_bias);
39840 }
39841 EXPORT_SYMBOL_GPL(od_register_powersave_bias_handler);
39842
39843 void od_unregister_powersave_bias_handler(void)
39844 {
39845 - od_ops.powersave_bias_target = generic_powersave_bias_target;
39846 + pax_open_kernel();
39847 + *(void **)&od_ops.powersave_bias_target = generic_powersave_bias_target;
39848 + pax_close_kernel();
39849 od_set_powersave_bias(0);
39850 }
39851 EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler);
39852 diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
39853 index c45d274..0f469f7 100644
39854 --- a/drivers/cpufreq/intel_pstate.c
39855 +++ b/drivers/cpufreq/intel_pstate.c
39856 @@ -134,10 +134,10 @@ struct pstate_funcs {
39857 struct cpu_defaults {
39858 struct pstate_adjust_policy pid_policy;
39859 struct pstate_funcs funcs;
39860 -};
39861 +} __do_const;
39862
39863 static struct pstate_adjust_policy pid_params;
39864 -static struct pstate_funcs pstate_funcs;
39865 +static struct pstate_funcs *pstate_funcs;
39866 static int hwp_active;
39867
39868 struct perf_limits {
39869 @@ -721,18 +721,18 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
39870
39871 cpu->pstate.current_pstate = pstate;
39872
39873 - pstate_funcs.set(cpu, pstate);
39874 + pstate_funcs->set(cpu, pstate);
39875 }
39876
39877 static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
39878 {
39879 - cpu->pstate.min_pstate = pstate_funcs.get_min();
39880 - cpu->pstate.max_pstate = pstate_funcs.get_max();
39881 - cpu->pstate.turbo_pstate = pstate_funcs.get_turbo();
39882 - cpu->pstate.scaling = pstate_funcs.get_scaling();
39883 + cpu->pstate.min_pstate = pstate_funcs->get_min();
39884 + cpu->pstate.max_pstate = pstate_funcs->get_max();
39885 + cpu->pstate.turbo_pstate = pstate_funcs->get_turbo();
39886 + cpu->pstate.scaling = pstate_funcs->get_scaling();
39887
39888 - if (pstate_funcs.get_vid)
39889 - pstate_funcs.get_vid(cpu);
39890 + if (pstate_funcs->get_vid)
39891 + pstate_funcs->get_vid(cpu);
39892 intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
39893 }
39894
39895 @@ -1056,15 +1056,15 @@ static unsigned int force_load;
39896
39897 static int intel_pstate_msrs_not_valid(void)
39898 {
39899 - if (!pstate_funcs.get_max() ||
39900 - !pstate_funcs.get_min() ||
39901 - !pstate_funcs.get_turbo())
39902 + if (!pstate_funcs->get_max() ||
39903 + !pstate_funcs->get_min() ||
39904 + !pstate_funcs->get_turbo())
39905 return -ENODEV;
39906
39907 return 0;
39908 }
39909
39910 -static void copy_pid_params(struct pstate_adjust_policy *policy)
39911 +static void copy_pid_params(const struct pstate_adjust_policy *policy)
39912 {
39913 pid_params.sample_rate_ms = policy->sample_rate_ms;
39914 pid_params.p_gain_pct = policy->p_gain_pct;
39915 @@ -1076,12 +1076,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
39916
39917 static void copy_cpu_funcs(struct pstate_funcs *funcs)
39918 {
39919 - pstate_funcs.get_max = funcs->get_max;
39920 - pstate_funcs.get_min = funcs->get_min;
39921 - pstate_funcs.get_turbo = funcs->get_turbo;
39922 - pstate_funcs.get_scaling = funcs->get_scaling;
39923 - pstate_funcs.set = funcs->set;
39924 - pstate_funcs.get_vid = funcs->get_vid;
39925 + pstate_funcs = funcs;
39926 }
39927
39928 #if IS_ENABLED(CONFIG_ACPI)
39929 diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
39930 index 529cfd9..0e28fff 100644
39931 --- a/drivers/cpufreq/p4-clockmod.c
39932 +++ b/drivers/cpufreq/p4-clockmod.c
39933 @@ -134,10 +134,14 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
39934 case 0x0F: /* Core Duo */
39935 case 0x16: /* Celeron Core */
39936 case 0x1C: /* Atom */
39937 - p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39938 + pax_open_kernel();
39939 + *(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39940 + pax_close_kernel();
39941 return speedstep_get_frequency(SPEEDSTEP_CPU_PCORE);
39942 case 0x0D: /* Pentium M (Dothan) */
39943 - p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39944 + pax_open_kernel();
39945 + *(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39946 + pax_close_kernel();
39947 /* fall through */
39948 case 0x09: /* Pentium M (Banias) */
39949 return speedstep_get_frequency(SPEEDSTEP_CPU_PM);
39950 @@ -149,7 +153,9 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
39951
39952 /* on P-4s, the TSC runs with constant frequency independent whether
39953 * throttling is active or not. */
39954 - p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39955 + pax_open_kernel();
39956 + *(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39957 + pax_close_kernel();
39958
39959 if (speedstep_detect_processor() == SPEEDSTEP_CPU_P4M) {
39960 printk(KERN_WARNING PFX "Warning: Pentium 4-M detected. "
39961 diff --git a/drivers/cpufreq/sparc-us3-cpufreq.c b/drivers/cpufreq/sparc-us3-cpufreq.c
39962 index 9bb42ba..b01b4a2 100644
39963 --- a/drivers/cpufreq/sparc-us3-cpufreq.c
39964 +++ b/drivers/cpufreq/sparc-us3-cpufreq.c
39965 @@ -18,14 +18,12 @@
39966 #include <asm/head.h>
39967 #include <asm/timer.h>
39968
39969 -static struct cpufreq_driver *cpufreq_us3_driver;
39970 -
39971 struct us3_freq_percpu_info {
39972 struct cpufreq_frequency_table table[4];
39973 };
39974
39975 /* Indexed by cpu number. */
39976 -static struct us3_freq_percpu_info *us3_freq_table;
39977 +static struct us3_freq_percpu_info us3_freq_table[NR_CPUS];
39978
39979 /* UltraSPARC-III has three dividers: 1, 2, and 32. These are controlled
39980 * in the Safari config register.
39981 @@ -156,16 +154,27 @@ static int __init us3_freq_cpu_init(struct cpufreq_policy *policy)
39982
39983 static int us3_freq_cpu_exit(struct cpufreq_policy *policy)
39984 {
39985 - if (cpufreq_us3_driver)
39986 - us3_freq_target(policy, 0);
39987 + us3_freq_target(policy, 0);
39988
39989 return 0;
39990 }
39991
39992 +static int __init us3_freq_init(void);
39993 +static void __exit us3_freq_exit(void);
39994 +
39995 +static struct cpufreq_driver cpufreq_us3_driver = {
39996 + .init = us3_freq_cpu_init,
39997 + .verify = cpufreq_generic_frequency_table_verify,
39998 + .target_index = us3_freq_target,
39999 + .get = us3_freq_get,
40000 + .exit = us3_freq_cpu_exit,
40001 + .name = "UltraSPARC-III",
40002 +
40003 +};
40004 +
40005 static int __init us3_freq_init(void)
40006 {
40007 unsigned long manuf, impl, ver;
40008 - int ret;
40009
40010 if (tlb_type != cheetah && tlb_type != cheetah_plus)
40011 return -ENODEV;
40012 @@ -178,55 +187,15 @@ static int __init us3_freq_init(void)
40013 (impl == CHEETAH_IMPL ||
40014 impl == CHEETAH_PLUS_IMPL ||
40015 impl == JAGUAR_IMPL ||
40016 - impl == PANTHER_IMPL)) {
40017 - struct cpufreq_driver *driver;
40018 -
40019 - ret = -ENOMEM;
40020 - driver = kzalloc(sizeof(*driver), GFP_KERNEL);
40021 - if (!driver)
40022 - goto err_out;
40023 -
40024 - us3_freq_table = kzalloc((NR_CPUS * sizeof(*us3_freq_table)),
40025 - GFP_KERNEL);
40026 - if (!us3_freq_table)
40027 - goto err_out;
40028 -
40029 - driver->init = us3_freq_cpu_init;
40030 - driver->verify = cpufreq_generic_frequency_table_verify;
40031 - driver->target_index = us3_freq_target;
40032 - driver->get = us3_freq_get;
40033 - driver->exit = us3_freq_cpu_exit;
40034 - strcpy(driver->name, "UltraSPARC-III");
40035 -
40036 - cpufreq_us3_driver = driver;
40037 - ret = cpufreq_register_driver(driver);
40038 - if (ret)
40039 - goto err_out;
40040 -
40041 - return 0;
40042 -
40043 -err_out:
40044 - if (driver) {
40045 - kfree(driver);
40046 - cpufreq_us3_driver = NULL;
40047 - }
40048 - kfree(us3_freq_table);
40049 - us3_freq_table = NULL;
40050 - return ret;
40051 - }
40052 + impl == PANTHER_IMPL))
40053 + return cpufreq_register_driver(&cpufreq_us3_driver);
40054
40055 return -ENODEV;
40056 }
40057
40058 static void __exit us3_freq_exit(void)
40059 {
40060 - if (cpufreq_us3_driver) {
40061 - cpufreq_unregister_driver(cpufreq_us3_driver);
40062 - kfree(cpufreq_us3_driver);
40063 - cpufreq_us3_driver = NULL;
40064 - kfree(us3_freq_table);
40065 - us3_freq_table = NULL;
40066 - }
40067 + cpufreq_unregister_driver(&cpufreq_us3_driver);
40068 }
40069
40070 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
40071 diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
40072 index 7d4a315..21bb886 100644
40073 --- a/drivers/cpufreq/speedstep-centrino.c
40074 +++ b/drivers/cpufreq/speedstep-centrino.c
40075 @@ -351,8 +351,11 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
40076 !cpu_has(cpu, X86_FEATURE_EST))
40077 return -ENODEV;
40078
40079 - if (cpu_has(cpu, X86_FEATURE_CONSTANT_TSC))
40080 - centrino_driver.flags |= CPUFREQ_CONST_LOOPS;
40081 + if (cpu_has(cpu, X86_FEATURE_CONSTANT_TSC)) {
40082 + pax_open_kernel();
40083 + *(u8 *)&centrino_driver.flags |= CPUFREQ_CONST_LOOPS;
40084 + pax_close_kernel();
40085 + }
40086
40087 if (policy->cpu != 0)
40088 return -ENODEV;
40089 diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
40090 index 5db1478..e90e25e 100644
40091 --- a/drivers/cpuidle/driver.c
40092 +++ b/drivers/cpuidle/driver.c
40093 @@ -193,7 +193,7 @@ static int poll_idle(struct cpuidle_device *dev,
40094
40095 static void poll_idle_init(struct cpuidle_driver *drv)
40096 {
40097 - struct cpuidle_state *state = &drv->states[0];
40098 + cpuidle_state_no_const *state = &drv->states[0];
40099
40100 snprintf(state->name, CPUIDLE_NAME_LEN, "POLL");
40101 snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
40102 diff --git a/drivers/cpuidle/governor.c b/drivers/cpuidle/governor.c
40103 index fb9f511..213e6cc 100644
40104 --- a/drivers/cpuidle/governor.c
40105 +++ b/drivers/cpuidle/governor.c
40106 @@ -87,7 +87,7 @@ int cpuidle_register_governor(struct cpuidle_governor *gov)
40107 mutex_lock(&cpuidle_lock);
40108 if (__cpuidle_find_governor(gov->name) == NULL) {
40109 ret = 0;
40110 - list_add_tail(&gov->governor_list, &cpuidle_governors);
40111 + pax_list_add_tail((struct list_head *)&gov->governor_list, &cpuidle_governors);
40112 if (!cpuidle_curr_governor ||
40113 cpuidle_curr_governor->rating < gov->rating)
40114 cpuidle_switch_governor(gov);
40115 diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
40116 index 832a2c3..1794080 100644
40117 --- a/drivers/cpuidle/sysfs.c
40118 +++ b/drivers/cpuidle/sysfs.c
40119 @@ -135,7 +135,7 @@ static struct attribute *cpuidle_switch_attrs[] = {
40120 NULL
40121 };
40122
40123 -static struct attribute_group cpuidle_attr_group = {
40124 +static attribute_group_no_const cpuidle_attr_group = {
40125 .attrs = cpuidle_default_attrs,
40126 .name = "cpuidle",
40127 };
40128 diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
40129 index 8d2a772..33826c9 100644
40130 --- a/drivers/crypto/hifn_795x.c
40131 +++ b/drivers/crypto/hifn_795x.c
40132 @@ -51,7 +51,7 @@ module_param_string(hifn_pll_ref, hifn_pll_ref, sizeof(hifn_pll_ref), 0444);
40133 MODULE_PARM_DESC(hifn_pll_ref,
40134 "PLL reference clock (pci[freq] or ext[freq], default ext)");
40135
40136 -static atomic_t hifn_dev_number;
40137 +static atomic_unchecked_t hifn_dev_number;
40138
40139 #define ACRYPTO_OP_DECRYPT 0
40140 #define ACRYPTO_OP_ENCRYPT 1
40141 @@ -2577,7 +2577,7 @@ static int hifn_probe(struct pci_dev *pdev, const struct pci_device_id *id)
40142 goto err_out_disable_pci_device;
40143
40144 snprintf(name, sizeof(name), "hifn%d",
40145 - atomic_inc_return(&hifn_dev_number)-1);
40146 + atomic_inc_return_unchecked(&hifn_dev_number)-1);
40147
40148 err = pci_request_regions(pdev, name);
40149 if (err)
40150 diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
40151 index 4630709..0a70e46 100644
40152 --- a/drivers/crypto/omap-des.c
40153 +++ b/drivers/crypto/omap-des.c
40154 @@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
40155 dmaengine_terminate_all(dd->dma_lch_in);
40156 dmaengine_terminate_all(dd->dma_lch_out);
40157
40158 - dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
40159 - dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
40160 -
40161 return err;
40162 }
40163
40164 diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
40165 index ca1b362..01cae6a 100644
40166 --- a/drivers/devfreq/devfreq.c
40167 +++ b/drivers/devfreq/devfreq.c
40168 @@ -672,7 +672,7 @@ int devfreq_add_governor(struct devfreq_governor *governor)
40169 goto err_out;
40170 }
40171
40172 - list_add(&governor->node, &devfreq_governor_list);
40173 + pax_list_add((struct list_head *)&governor->node, &devfreq_governor_list);
40174
40175 list_for_each_entry(devfreq, &devfreq_list, node) {
40176 int ret = 0;
40177 @@ -760,7 +760,7 @@ int devfreq_remove_governor(struct devfreq_governor *governor)
40178 }
40179 }
40180
40181 - list_del(&governor->node);
40182 + pax_list_del((struct list_head *)&governor->node);
40183 err_out:
40184 mutex_unlock(&devfreq_list_lock);
40185
40186 diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
40187 index 10fcaba..326f709 100644
40188 --- a/drivers/dma/sh/shdma-base.c
40189 +++ b/drivers/dma/sh/shdma-base.c
40190 @@ -227,8 +227,8 @@ static int shdma_alloc_chan_resources(struct dma_chan *chan)
40191 schan->slave_id = -EINVAL;
40192 }
40193
40194 - schan->desc = kcalloc(NR_DESCS_PER_CHANNEL,
40195 - sdev->desc_size, GFP_KERNEL);
40196 + schan->desc = kcalloc(sdev->desc_size,
40197 + NR_DESCS_PER_CHANNEL, GFP_KERNEL);
40198 if (!schan->desc) {
40199 ret = -ENOMEM;
40200 goto edescalloc;
40201 diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
40202 index 11707df..2ea96f7 100644
40203 --- a/drivers/dma/sh/shdmac.c
40204 +++ b/drivers/dma/sh/shdmac.c
40205 @@ -513,7 +513,7 @@ static int sh_dmae_nmi_handler(struct notifier_block *self,
40206 return ret;
40207 }
40208
40209 -static struct notifier_block sh_dmae_nmi_notifier __read_mostly = {
40210 +static struct notifier_block sh_dmae_nmi_notifier = {
40211 .notifier_call = sh_dmae_nmi_handler,
40212
40213 /* Run before NMI debug handler and KGDB */
40214 diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
40215 index 592af5f..bb1d583 100644
40216 --- a/drivers/edac/edac_device.c
40217 +++ b/drivers/edac/edac_device.c
40218 @@ -477,9 +477,9 @@ void edac_device_reset_delay_period(struct edac_device_ctl_info *edac_dev,
40219 */
40220 int edac_device_alloc_index(void)
40221 {
40222 - static atomic_t device_indexes = ATOMIC_INIT(0);
40223 + static atomic_unchecked_t device_indexes = ATOMIC_INIT(0);
40224
40225 - return atomic_inc_return(&device_indexes) - 1;
40226 + return atomic_inc_return_unchecked(&device_indexes) - 1;
40227 }
40228 EXPORT_SYMBOL_GPL(edac_device_alloc_index);
40229
40230 diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
40231 index 112d63a..5443a61 100644
40232 --- a/drivers/edac/edac_mc_sysfs.c
40233 +++ b/drivers/edac/edac_mc_sysfs.c
40234 @@ -154,7 +154,7 @@ static const char * const edac_caps[] = {
40235 struct dev_ch_attribute {
40236 struct device_attribute attr;
40237 int channel;
40238 -};
40239 +} __do_const;
40240
40241 #define DEVICE_CHANNEL(_name, _mode, _show, _store, _var) \
40242 static struct dev_ch_attribute dev_attr_legacy_##_name = \
40243 diff --git a/drivers/edac/edac_pci.c b/drivers/edac/edac_pci.c
40244 index 2cf44b4d..6dd2dc7 100644
40245 --- a/drivers/edac/edac_pci.c
40246 +++ b/drivers/edac/edac_pci.c
40247 @@ -29,7 +29,7 @@
40248
40249 static DEFINE_MUTEX(edac_pci_ctls_mutex);
40250 static LIST_HEAD(edac_pci_list);
40251 -static atomic_t pci_indexes = ATOMIC_INIT(0);
40252 +static atomic_unchecked_t pci_indexes = ATOMIC_INIT(0);
40253
40254 /*
40255 * edac_pci_alloc_ctl_info
40256 @@ -315,7 +315,7 @@ EXPORT_SYMBOL_GPL(edac_pci_reset_delay_period);
40257 */
40258 int edac_pci_alloc_index(void)
40259 {
40260 - return atomic_inc_return(&pci_indexes) - 1;
40261 + return atomic_inc_return_unchecked(&pci_indexes) - 1;
40262 }
40263 EXPORT_SYMBOL_GPL(edac_pci_alloc_index);
40264
40265 diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
40266 index 24d877f..4e30133 100644
40267 --- a/drivers/edac/edac_pci_sysfs.c
40268 +++ b/drivers/edac/edac_pci_sysfs.c
40269 @@ -23,8 +23,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
40270 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
40271 static int edac_pci_poll_msec = 1000; /* one second workq period */
40272
40273 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
40274 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
40275 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
40276 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
40277
40278 static struct kobject *edac_pci_top_main_kobj;
40279 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
40280 @@ -232,7 +232,7 @@ struct edac_pci_dev_attribute {
40281 void *value;
40282 ssize_t(*show) (void *, char *);
40283 ssize_t(*store) (void *, const char *, size_t);
40284 -};
40285 +} __do_const;
40286
40287 /* Set of show/store abstract level functions for PCI Parity object */
40288 static ssize_t edac_pci_dev_show(struct kobject *kobj, struct attribute *attr,
40289 @@ -576,7 +576,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
40290 edac_printk(KERN_CRIT, EDAC_PCI,
40291 "Signaled System Error on %s\n",
40292 pci_name(dev));
40293 - atomic_inc(&pci_nonparity_count);
40294 + atomic_inc_unchecked(&pci_nonparity_count);
40295 }
40296
40297 if (status & (PCI_STATUS_PARITY)) {
40298 @@ -584,7 +584,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
40299 "Master Data Parity Error on %s\n",
40300 pci_name(dev));
40301
40302 - atomic_inc(&pci_parity_count);
40303 + atomic_inc_unchecked(&pci_parity_count);
40304 }
40305
40306 if (status & (PCI_STATUS_DETECTED_PARITY)) {
40307 @@ -592,7 +592,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
40308 "Detected Parity Error on %s\n",
40309 pci_name(dev));
40310
40311 - atomic_inc(&pci_parity_count);
40312 + atomic_inc_unchecked(&pci_parity_count);
40313 }
40314 }
40315
40316 @@ -615,7 +615,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
40317 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
40318 "Signaled System Error on %s\n",
40319 pci_name(dev));
40320 - atomic_inc(&pci_nonparity_count);
40321 + atomic_inc_unchecked(&pci_nonparity_count);
40322 }
40323
40324 if (status & (PCI_STATUS_PARITY)) {
40325 @@ -623,7 +623,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
40326 "Master Data Parity Error on "
40327 "%s\n", pci_name(dev));
40328
40329 - atomic_inc(&pci_parity_count);
40330 + atomic_inc_unchecked(&pci_parity_count);
40331 }
40332
40333 if (status & (PCI_STATUS_DETECTED_PARITY)) {
40334 @@ -631,7 +631,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
40335 "Detected Parity Error on %s\n",
40336 pci_name(dev));
40337
40338 - atomic_inc(&pci_parity_count);
40339 + atomic_inc_unchecked(&pci_parity_count);
40340 }
40341 }
40342 }
40343 @@ -669,7 +669,7 @@ void edac_pci_do_parity_check(void)
40344 if (!check_pci_errors)
40345 return;
40346
40347 - before_count = atomic_read(&pci_parity_count);
40348 + before_count = atomic_read_unchecked(&pci_parity_count);
40349
40350 /* scan all PCI devices looking for a Parity Error on devices and
40351 * bridges.
40352 @@ -681,7 +681,7 @@ void edac_pci_do_parity_check(void)
40353 /* Only if operator has selected panic on PCI Error */
40354 if (edac_pci_get_panic_on_pe()) {
40355 /* If the count is different 'after' from 'before' */
40356 - if (before_count != atomic_read(&pci_parity_count))
40357 + if (before_count != atomic_read_unchecked(&pci_parity_count))
40358 panic("EDAC: PCI Parity Error");
40359 }
40360 }
40361 diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
40362 index c2359a1..8bd119d 100644
40363 --- a/drivers/edac/mce_amd.h
40364 +++ b/drivers/edac/mce_amd.h
40365 @@ -74,7 +74,7 @@ struct amd_decoder_ops {
40366 bool (*mc0_mce)(u16, u8);
40367 bool (*mc1_mce)(u16, u8);
40368 bool (*mc2_mce)(u16, u8);
40369 -};
40370 +} __no_const;
40371
40372 void amd_report_gart_errors(bool);
40373 void amd_register_ecc_decoder(void (*f)(int, struct mce *));
40374 diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
40375 index 57ea7f4..af06b76 100644
40376 --- a/drivers/firewire/core-card.c
40377 +++ b/drivers/firewire/core-card.c
40378 @@ -528,9 +528,9 @@ void fw_card_initialize(struct fw_card *card,
40379 const struct fw_card_driver *driver,
40380 struct device *device)
40381 {
40382 - static atomic_t index = ATOMIC_INIT(-1);
40383 + static atomic_unchecked_t index = ATOMIC_INIT(-1);
40384
40385 - card->index = atomic_inc_return(&index);
40386 + card->index = atomic_inc_return_unchecked(&index);
40387 card->driver = driver;
40388 card->device = device;
40389 card->current_tlabel = 0;
40390 @@ -680,7 +680,7 @@ EXPORT_SYMBOL_GPL(fw_card_release);
40391
40392 void fw_core_remove_card(struct fw_card *card)
40393 {
40394 - struct fw_card_driver dummy_driver = dummy_driver_template;
40395 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
40396
40397 card->driver->update_phy_reg(card, 4,
40398 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
40399 diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
40400 index f9e3aee..269dbdb 100644
40401 --- a/drivers/firewire/core-device.c
40402 +++ b/drivers/firewire/core-device.c
40403 @@ -256,7 +256,7 @@ EXPORT_SYMBOL(fw_device_enable_phys_dma);
40404 struct config_rom_attribute {
40405 struct device_attribute attr;
40406 u32 key;
40407 -};
40408 +} __do_const;
40409
40410 static ssize_t show_immediate(struct device *dev,
40411 struct device_attribute *dattr, char *buf)
40412 diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
40413 index d6a09b9..18e90dd 100644
40414 --- a/drivers/firewire/core-transaction.c
40415 +++ b/drivers/firewire/core-transaction.c
40416 @@ -38,6 +38,7 @@
40417 #include <linux/timer.h>
40418 #include <linux/types.h>
40419 #include <linux/workqueue.h>
40420 +#include <linux/sched.h>
40421
40422 #include <asm/byteorder.h>
40423
40424 diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
40425 index e1480ff6..1a429bd 100644
40426 --- a/drivers/firewire/core.h
40427 +++ b/drivers/firewire/core.h
40428 @@ -111,6 +111,7 @@ struct fw_card_driver {
40429
40430 int (*stop_iso)(struct fw_iso_context *ctx);
40431 };
40432 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
40433
40434 void fw_card_initialize(struct fw_card *card,
40435 const struct fw_card_driver *driver, struct device *device);
40436 diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
40437 index f51d376..b118e40 100644
40438 --- a/drivers/firewire/ohci.c
40439 +++ b/drivers/firewire/ohci.c
40440 @@ -2049,10 +2049,12 @@ static void bus_reset_work(struct work_struct *work)
40441 be32_to_cpu(ohci->next_header));
40442 }
40443
40444 +#ifndef CONFIG_GRKERNSEC
40445 if (param_remote_dma) {
40446 reg_write(ohci, OHCI1394_PhyReqFilterHiSet, ~0);
40447 reg_write(ohci, OHCI1394_PhyReqFilterLoSet, ~0);
40448 }
40449 +#endif
40450
40451 spin_unlock_irq(&ohci->lock);
40452
40453 @@ -2584,8 +2586,10 @@ static int ohci_enable_phys_dma(struct fw_card *card,
40454 unsigned long flags;
40455 int n, ret = 0;
40456
40457 +#ifndef CONFIG_GRKERNSEC
40458 if (param_remote_dma)
40459 return 0;
40460 +#endif
40461
40462 /*
40463 * FIXME: Make sure this bitmask is cleared when we clear the busReset
40464 diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
40465 index 94a58a0..f5eba42 100644
40466 --- a/drivers/firmware/dmi-id.c
40467 +++ b/drivers/firmware/dmi-id.c
40468 @@ -16,7 +16,7 @@
40469 struct dmi_device_attribute{
40470 struct device_attribute dev_attr;
40471 int field;
40472 -};
40473 +} __do_const;
40474 #define to_dmi_dev_attr(_dev_attr) \
40475 container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
40476
40477 diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
40478 index 4fd9961..52d60ce 100644
40479 --- a/drivers/firmware/efi/cper.c
40480 +++ b/drivers/firmware/efi/cper.c
40481 @@ -44,12 +44,12 @@ static char rcd_decode_str[CPER_REC_LEN];
40482 */
40483 u64 cper_next_record_id(void)
40484 {
40485 - static atomic64_t seq;
40486 + static atomic64_unchecked_t seq;
40487
40488 - if (!atomic64_read(&seq))
40489 - atomic64_set(&seq, ((u64)get_seconds()) << 32);
40490 + if (!atomic64_read_unchecked(&seq))
40491 + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
40492
40493 - return atomic64_inc_return(&seq);
40494 + return atomic64_inc_return_unchecked(&seq);
40495 }
40496 EXPORT_SYMBOL_GPL(cper_next_record_id);
40497
40498 diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
40499 index e14363d..c3d5d84 100644
40500 --- a/drivers/firmware/efi/efi.c
40501 +++ b/drivers/firmware/efi/efi.c
40502 @@ -159,14 +159,16 @@ static struct attribute_group efi_subsys_attr_group = {
40503 };
40504
40505 static struct efivars generic_efivars;
40506 -static struct efivar_operations generic_ops;
40507 +static efivar_operations_no_const generic_ops __read_only;
40508
40509 static int generic_ops_register(void)
40510 {
40511 - generic_ops.get_variable = efi.get_variable;
40512 - generic_ops.set_variable = efi.set_variable;
40513 - generic_ops.get_next_variable = efi.get_next_variable;
40514 - generic_ops.query_variable_store = efi_query_variable_store;
40515 + pax_open_kernel();
40516 + *(void **)&generic_ops.get_variable = efi.get_variable;
40517 + *(void **)&generic_ops.set_variable = efi.set_variable;
40518 + *(void **)&generic_ops.get_next_variable = efi.get_next_variable;
40519 + *(void **)&generic_ops.query_variable_store = efi_query_variable_store;
40520 + pax_close_kernel();
40521
40522 return efivars_register(&generic_efivars, &generic_ops, efi_kobj);
40523 }
40524 diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
40525 index 7b2e049..a253334 100644
40526 --- a/drivers/firmware/efi/efivars.c
40527 +++ b/drivers/firmware/efi/efivars.c
40528 @@ -589,7 +589,7 @@ efivar_create_sysfs_entry(struct efivar_entry *new_var)
40529 static int
40530 create_efivars_bin_attributes(void)
40531 {
40532 - struct bin_attribute *attr;
40533 + bin_attribute_no_const *attr;
40534 int error;
40535
40536 /* new_var */
40537 diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
40538 index 5c55227..97f4978 100644
40539 --- a/drivers/firmware/efi/runtime-map.c
40540 +++ b/drivers/firmware/efi/runtime-map.c
40541 @@ -97,7 +97,7 @@ static void map_release(struct kobject *kobj)
40542 kfree(entry);
40543 }
40544
40545 -static struct kobj_type __refdata map_ktype = {
40546 +static const struct kobj_type __refconst map_ktype = {
40547 .sysfs_ops = &map_attr_ops,
40548 .default_attrs = def_attrs,
40549 .release = map_release,
40550 diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
40551 index f1ab05e..ab51228 100644
40552 --- a/drivers/firmware/google/gsmi.c
40553 +++ b/drivers/firmware/google/gsmi.c
40554 @@ -709,7 +709,7 @@ static u32 __init hash_oem_table_id(char s[8])
40555 return local_hash_64(input, 32);
40556 }
40557
40558 -static struct dmi_system_id gsmi_dmi_table[] __initdata = {
40559 +static const struct dmi_system_id gsmi_dmi_table[] __initconst = {
40560 {
40561 .ident = "Google Board",
40562 .matches = {
40563 diff --git a/drivers/firmware/google/memconsole.c b/drivers/firmware/google/memconsole.c
40564 index 2f569aa..26e4f39 100644
40565 --- a/drivers/firmware/google/memconsole.c
40566 +++ b/drivers/firmware/google/memconsole.c
40567 @@ -136,7 +136,7 @@ static bool __init found_memconsole(void)
40568 return false;
40569 }
40570
40571 -static struct dmi_system_id memconsole_dmi_table[] __initdata = {
40572 +static const struct dmi_system_id memconsole_dmi_table[] __initconst = {
40573 {
40574 .ident = "Google Board",
40575 .matches = {
40576 @@ -155,7 +155,10 @@ static int __init memconsole_init(void)
40577 if (!found_memconsole())
40578 return -ENODEV;
40579
40580 - memconsole_bin_attr.size = memconsole_length;
40581 + pax_open_kernel();
40582 + *(size_t *)&memconsole_bin_attr.size = memconsole_length;
40583 + pax_close_kernel();
40584 +
40585 return sysfs_create_bin_file(firmware_kobj, &memconsole_bin_attr);
40586 }
40587
40588 diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
40589 index cc016c61..d35279e 100644
40590 --- a/drivers/firmware/memmap.c
40591 +++ b/drivers/firmware/memmap.c
40592 @@ -124,7 +124,7 @@ static void __meminit release_firmware_map_entry(struct kobject *kobj)
40593 kfree(entry);
40594 }
40595
40596 -static struct kobj_type __refdata memmap_ktype = {
40597 +static const struct kobj_type __refconst memmap_ktype = {
40598 .release = release_firmware_map_entry,
40599 .sysfs_ops = &memmap_attr_ops,
40600 .default_attrs = def_attrs,
40601 diff --git a/drivers/gpio/gpio-em.c b/drivers/gpio/gpio-em.c
40602 index 3cfcfc6..09d6f117 100644
40603 --- a/drivers/gpio/gpio-em.c
40604 +++ b/drivers/gpio/gpio-em.c
40605 @@ -278,7 +278,7 @@ static int em_gio_probe(struct platform_device *pdev)
40606 struct em_gio_priv *p;
40607 struct resource *io[2], *irq[2];
40608 struct gpio_chip *gpio_chip;
40609 - struct irq_chip *irq_chip;
40610 + irq_chip_no_const *irq_chip;
40611 const char *name = dev_name(&pdev->dev);
40612 int ret;
40613
40614 diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
40615 index 4ba7ed5..1536b5d 100644
40616 --- a/drivers/gpio/gpio-ich.c
40617 +++ b/drivers/gpio/gpio-ich.c
40618 @@ -94,7 +94,7 @@ struct ichx_desc {
40619 * this option allows driver caching written output values
40620 */
40621 bool use_outlvl_cache;
40622 -};
40623 +} __do_const;
40624
40625 static struct {
40626 spinlock_t lock;
40627 diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
40628 index b232397..a3ccece 100644
40629 --- a/drivers/gpio/gpio-omap.c
40630 +++ b/drivers/gpio/gpio-omap.c
40631 @@ -1137,7 +1137,7 @@ static int omap_gpio_probe(struct platform_device *pdev)
40632 const struct omap_gpio_platform_data *pdata;
40633 struct resource *res;
40634 struct gpio_bank *bank;
40635 - struct irq_chip *irqc;
40636 + irq_chip_no_const *irqc;
40637 int ret;
40638
40639 match = of_match_device(of_match_ptr(omap_gpio_match), dev);
40640 diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
40641 index 1e14a6c..0442450 100644
40642 --- a/drivers/gpio/gpio-rcar.c
40643 +++ b/drivers/gpio/gpio-rcar.c
40644 @@ -379,7 +379,7 @@ static int gpio_rcar_probe(struct platform_device *pdev)
40645 struct gpio_rcar_priv *p;
40646 struct resource *io, *irq;
40647 struct gpio_chip *gpio_chip;
40648 - struct irq_chip *irq_chip;
40649 + irq_chip_no_const *irq_chip;
40650 struct device *dev = &pdev->dev;
40651 const char *name = dev_name(dev);
40652 int ret;
40653 diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
40654 index c1caa45..f0f97d2 100644
40655 --- a/drivers/gpio/gpio-vr41xx.c
40656 +++ b/drivers/gpio/gpio-vr41xx.c
40657 @@ -224,7 +224,7 @@ static int giu_get_irq(unsigned int irq)
40658 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
40659 maskl, pendl, maskh, pendh);
40660
40661 - atomic_inc(&irq_err_count);
40662 + atomic_inc_unchecked(&irq_err_count);
40663
40664 return -EINVAL;
40665 }
40666 diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
40667 index 6bc612b..3932464 100644
40668 --- a/drivers/gpio/gpiolib.c
40669 +++ b/drivers/gpio/gpiolib.c
40670 @@ -558,8 +558,10 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
40671 }
40672
40673 if (gpiochip->irqchip) {
40674 - gpiochip->irqchip->irq_request_resources = NULL;
40675 - gpiochip->irqchip->irq_release_resources = NULL;
40676 + pax_open_kernel();
40677 + *(void **)&gpiochip->irqchip->irq_request_resources = NULL;
40678 + *(void **)&gpiochip->irqchip->irq_release_resources = NULL;
40679 + pax_close_kernel();
40680 gpiochip->irqchip = NULL;
40681 }
40682 }
40683 @@ -625,8 +627,11 @@ int gpiochip_irqchip_add(struct gpio_chip *gpiochip,
40684 gpiochip->irqchip = NULL;
40685 return -EINVAL;
40686 }
40687 - irqchip->irq_request_resources = gpiochip_irq_reqres;
40688 - irqchip->irq_release_resources = gpiochip_irq_relres;
40689 +
40690 + pax_open_kernel();
40691 + *(void **)&irqchip->irq_request_resources = gpiochip_irq_reqres;
40692 + *(void **)&irqchip->irq_release_resources = gpiochip_irq_relres;
40693 + pax_close_kernel();
40694
40695 /*
40696 * Prepare the mapping since the irqchip shall be orthogonal to
40697 diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
40698 index 488f51d..301d462 100644
40699 --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
40700 +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
40701 @@ -118,7 +118,7 @@ struct device_queue_manager_ops {
40702 enum cache_policy alternate_policy,
40703 void __user *alternate_aperture_base,
40704 uint64_t alternate_aperture_size);
40705 -};
40706 +} __no_const;
40707
40708 /**
40709 * struct device_queue_manager
40710 diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h
40711 index 5940531..a75b0e5 100644
40712 --- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h
40713 +++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h
40714 @@ -62,7 +62,7 @@ struct kernel_queue_ops {
40715
40716 void (*submit_packet)(struct kernel_queue *kq);
40717 void (*rollback_packet)(struct kernel_queue *kq);
40718 -};
40719 +} __no_const;
40720
40721 struct kernel_queue {
40722 struct kernel_queue_ops ops;
40723 diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
40724 index 9b23525..65f4110 100644
40725 --- a/drivers/gpu/drm/drm_context.c
40726 +++ b/drivers/gpu/drm/drm_context.c
40727 @@ -53,6 +53,9 @@ struct drm_ctx_list {
40728 */
40729 void drm_legacy_ctxbitmap_free(struct drm_device * dev, int ctx_handle)
40730 {
40731 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40732 + return;
40733 +
40734 mutex_lock(&dev->struct_mutex);
40735 idr_remove(&dev->ctx_idr, ctx_handle);
40736 mutex_unlock(&dev->struct_mutex);
40737 @@ -87,6 +90,9 @@ static int drm_legacy_ctxbitmap_next(struct drm_device * dev)
40738 */
40739 int drm_legacy_ctxbitmap_init(struct drm_device * dev)
40740 {
40741 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40742 + return -EINVAL;
40743 +
40744 idr_init(&dev->ctx_idr);
40745 return 0;
40746 }
40747 @@ -101,6 +107,9 @@ int drm_legacy_ctxbitmap_init(struct drm_device * dev)
40748 */
40749 void drm_legacy_ctxbitmap_cleanup(struct drm_device * dev)
40750 {
40751 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40752 + return;
40753 +
40754 mutex_lock(&dev->struct_mutex);
40755 idr_destroy(&dev->ctx_idr);
40756 mutex_unlock(&dev->struct_mutex);
40757 @@ -119,11 +128,14 @@ void drm_legacy_ctxbitmap_flush(struct drm_device *dev, struct drm_file *file)
40758 {
40759 struct drm_ctx_list *pos, *tmp;
40760
40761 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40762 + return;
40763 +
40764 mutex_lock(&dev->ctxlist_mutex);
40765
40766 list_for_each_entry_safe(pos, tmp, &dev->ctxlist, head) {
40767 if (pos->tag == file &&
40768 - pos->handle != DRM_KERNEL_CONTEXT) {
40769 + _DRM_LOCKING_CONTEXT(pos->handle) != DRM_KERNEL_CONTEXT) {
40770 if (dev->driver->context_dtor)
40771 dev->driver->context_dtor(dev, pos->handle);
40772
40773 @@ -161,6 +173,9 @@ int drm_legacy_getsareactx(struct drm_device *dev, void *data,
40774 struct drm_local_map *map;
40775 struct drm_map_list *_entry;
40776
40777 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40778 + return -EINVAL;
40779 +
40780 mutex_lock(&dev->struct_mutex);
40781
40782 map = idr_find(&dev->ctx_idr, request->ctx_id);
40783 @@ -205,6 +220,9 @@ int drm_legacy_setsareactx(struct drm_device *dev, void *data,
40784 struct drm_local_map *map = NULL;
40785 struct drm_map_list *r_list = NULL;
40786
40787 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40788 + return -EINVAL;
40789 +
40790 mutex_lock(&dev->struct_mutex);
40791 list_for_each_entry(r_list, &dev->maplist, head) {
40792 if (r_list->map
40793 @@ -277,7 +295,13 @@ static int drm_context_switch_complete(struct drm_device *dev,
40794 {
40795 dev->last_context = new; /* PRE/POST: This is the _only_ writer. */
40796
40797 - if (!_DRM_LOCK_IS_HELD(file_priv->master->lock.hw_lock->lock)) {
40798 + if (file_priv->master->lock.hw_lock == NULL) {
40799 + DRM_ERROR(
40800 + "Device has been unregistered. Hard exit. Process %d\n",
40801 + task_pid_nr(current));
40802 + send_sig(SIGTERM, current, 0);
40803 + return -EPERM;
40804 + } else if (!_DRM_LOCK_IS_HELD(file_priv->master->lock.hw_lock->lock)) {
40805 DRM_ERROR("Lock isn't held after context switch\n");
40806 }
40807
40808 @@ -305,6 +329,9 @@ int drm_legacy_resctx(struct drm_device *dev, void *data,
40809 struct drm_ctx ctx;
40810 int i;
40811
40812 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40813 + return -EINVAL;
40814 +
40815 if (res->count >= DRM_RESERVED_CONTEXTS) {
40816 memset(&ctx, 0, sizeof(ctx));
40817 for (i = 0; i < DRM_RESERVED_CONTEXTS; i++) {
40818 @@ -335,8 +362,11 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
40819 struct drm_ctx_list *ctx_entry;
40820 struct drm_ctx *ctx = data;
40821
40822 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40823 + return -EINVAL;
40824 +
40825 ctx->handle = drm_legacy_ctxbitmap_next(dev);
40826 - if (ctx->handle == DRM_KERNEL_CONTEXT) {
40827 + if (_DRM_LOCKING_CONTEXT(ctx->handle) == DRM_KERNEL_CONTEXT) {
40828 /* Skip kernel's context and get a new one. */
40829 ctx->handle = drm_legacy_ctxbitmap_next(dev);
40830 }
40831 @@ -378,6 +408,9 @@ int drm_legacy_getctx(struct drm_device *dev, void *data,
40832 {
40833 struct drm_ctx *ctx = data;
40834
40835 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40836 + return -EINVAL;
40837 +
40838 /* This is 0, because we don't handle any context flags */
40839 ctx->flags = 0;
40840
40841 @@ -400,6 +433,9 @@ int drm_legacy_switchctx(struct drm_device *dev, void *data,
40842 {
40843 struct drm_ctx *ctx = data;
40844
40845 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40846 + return -EINVAL;
40847 +
40848 DRM_DEBUG("%d\n", ctx->handle);
40849 return drm_context_switch(dev, dev->last_context, ctx->handle);
40850 }
40851 @@ -420,6 +456,9 @@ int drm_legacy_newctx(struct drm_device *dev, void *data,
40852 {
40853 struct drm_ctx *ctx = data;
40854
40855 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40856 + return -EINVAL;
40857 +
40858 DRM_DEBUG("%d\n", ctx->handle);
40859 drm_context_switch_complete(dev, file_priv, ctx->handle);
40860
40861 @@ -442,8 +481,11 @@ int drm_legacy_rmctx(struct drm_device *dev, void *data,
40862 {
40863 struct drm_ctx *ctx = data;
40864
40865 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
40866 + return -EINVAL;
40867 +
40868 DRM_DEBUG("%d\n", ctx->handle);
40869 - if (ctx->handle != DRM_KERNEL_CONTEXT) {
40870 + if (_DRM_LOCKING_CONTEXT(ctx->handle) != DRM_KERNEL_CONTEXT) {
40871 if (dev->driver->context_dtor)
40872 dev->driver->context_dtor(dev, ctx->handle);
40873 drm_legacy_ctxbitmap_free(dev, ctx->handle);
40874 diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
40875 index 3007b44..420b4a3 100644
40876 --- a/drivers/gpu/drm/drm_crtc.c
40877 +++ b/drivers/gpu/drm/drm_crtc.c
40878 @@ -4176,7 +4176,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
40879 goto done;
40880 }
40881
40882 - if (copy_to_user(&enum_ptr[copied].name,
40883 + if (copy_to_user(enum_ptr[copied].name,
40884 &prop_enum->name, DRM_PROP_NAME_LEN)) {
40885 ret = -EFAULT;
40886 goto done;
40887 diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
40888 index 48f7359..8c3b594 100644
40889 --- a/drivers/gpu/drm/drm_drv.c
40890 +++ b/drivers/gpu/drm/drm_drv.c
40891 @@ -448,7 +448,7 @@ void drm_unplug_dev(struct drm_device *dev)
40892
40893 drm_device_set_unplugged(dev);
40894
40895 - if (dev->open_count == 0) {
40896 + if (local_read(&dev->open_count) == 0) {
40897 drm_put_dev(dev);
40898 }
40899 mutex_unlock(&drm_global_mutex);
40900 @@ -596,10 +596,13 @@ struct drm_device *drm_dev_alloc(struct drm_driver *driver,
40901 if (drm_ht_create(&dev->map_hash, 12))
40902 goto err_minors;
40903
40904 - ret = drm_legacy_ctxbitmap_init(dev);
40905 - if (ret) {
40906 - DRM_ERROR("Cannot allocate memory for context bitmap.\n");
40907 - goto err_ht;
40908 + if (drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT)) {
40909 + ret = drm_legacy_ctxbitmap_init(dev);
40910 + if (ret) {
40911 + DRM_ERROR(
40912 + "Cannot allocate memory for context bitmap.\n");
40913 + goto err_ht;
40914 + }
40915 }
40916
40917 if (drm_core_check_feature(dev, DRIVER_GEM)) {
40918 diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
40919 index 076dd60..e4a4ba7 100644
40920 --- a/drivers/gpu/drm/drm_fops.c
40921 +++ b/drivers/gpu/drm/drm_fops.c
40922 @@ -89,7 +89,7 @@ int drm_open(struct inode *inode, struct file *filp)
40923 return PTR_ERR(minor);
40924
40925 dev = minor->dev;
40926 - if (!dev->open_count++)
40927 + if (local_inc_return(&dev->open_count) == 1)
40928 need_setup = 1;
40929
40930 /* share address_space across all char-devs of a single device */
40931 @@ -106,7 +106,7 @@ int drm_open(struct inode *inode, struct file *filp)
40932 return 0;
40933
40934 err_undo:
40935 - dev->open_count--;
40936 + local_dec(&dev->open_count);
40937 drm_minor_release(minor);
40938 return retcode;
40939 }
40940 @@ -376,7 +376,7 @@ int drm_release(struct inode *inode, struct file *filp)
40941
40942 mutex_lock(&drm_global_mutex);
40943
40944 - DRM_DEBUG("open_count = %d\n", dev->open_count);
40945 + DRM_DEBUG("open_count = %ld\n", local_read(&dev->open_count));
40946
40947 mutex_lock(&dev->struct_mutex);
40948 list_del(&file_priv->lhead);
40949 @@ -389,10 +389,10 @@ int drm_release(struct inode *inode, struct file *filp)
40950 * Begin inline drm_release
40951 */
40952
40953 - DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
40954 + DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %ld\n",
40955 task_pid_nr(current),
40956 (long)old_encode_dev(file_priv->minor->kdev->devt),
40957 - dev->open_count);
40958 + local_read(&dev->open_count));
40959
40960 /* Release any auth tokens that might point to this file_priv,
40961 (do that under the drm_global_mutex) */
40962 @@ -465,7 +465,7 @@ int drm_release(struct inode *inode, struct file *filp)
40963 * End inline drm_release
40964 */
40965
40966 - if (!--dev->open_count) {
40967 + if (local_dec_and_test(&dev->open_count)) {
40968 retcode = drm_lastclose(dev);
40969 if (drm_device_is_unplugged(dev))
40970 drm_put_dev(dev);
40971 diff --git a/drivers/gpu/drm/drm_global.c b/drivers/gpu/drm/drm_global.c
40972 index 3d2e91c..d31c4c9 100644
40973 --- a/drivers/gpu/drm/drm_global.c
40974 +++ b/drivers/gpu/drm/drm_global.c
40975 @@ -36,7 +36,7 @@
40976 struct drm_global_item {
40977 struct mutex mutex;
40978 void *object;
40979 - int refcount;
40980 + atomic_t refcount;
40981 };
40982
40983 static struct drm_global_item glob[DRM_GLOBAL_NUM];
40984 @@ -49,7 +49,7 @@ void drm_global_init(void)
40985 struct drm_global_item *item = &glob[i];
40986 mutex_init(&item->mutex);
40987 item->object = NULL;
40988 - item->refcount = 0;
40989 + atomic_set(&item->refcount, 0);
40990 }
40991 }
40992
40993 @@ -59,7 +59,7 @@ void drm_global_release(void)
40994 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
40995 struct drm_global_item *item = &glob[i];
40996 BUG_ON(item->object != NULL);
40997 - BUG_ON(item->refcount != 0);
40998 + BUG_ON(atomic_read(&item->refcount) != 0);
40999 }
41000 }
41001
41002 @@ -69,7 +69,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
41003 struct drm_global_item *item = &glob[ref->global_type];
41004
41005 mutex_lock(&item->mutex);
41006 - if (item->refcount == 0) {
41007 + if (atomic_read(&item->refcount) == 0) {
41008 item->object = kzalloc(ref->size, GFP_KERNEL);
41009 if (unlikely(item->object == NULL)) {
41010 ret = -ENOMEM;
41011 @@ -82,7 +82,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
41012 goto out_err;
41013
41014 }
41015 - ++item->refcount;
41016 + atomic_inc(&item->refcount);
41017 ref->object = item->object;
41018 mutex_unlock(&item->mutex);
41019 return 0;
41020 @@ -98,9 +98,9 @@ void drm_global_item_unref(struct drm_global_reference *ref)
41021 struct drm_global_item *item = &glob[ref->global_type];
41022
41023 mutex_lock(&item->mutex);
41024 - BUG_ON(item->refcount == 0);
41025 + BUG_ON(atomic_read(&item->refcount) == 0);
41026 BUG_ON(ref->object != item->object);
41027 - if (--item->refcount == 0) {
41028 + if (atomic_dec_and_test(&item->refcount)) {
41029 ref->release(ref);
41030 item->object = NULL;
41031 }
41032 diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
41033 index cbb4fc0..5c756cb9 100644
41034 --- a/drivers/gpu/drm/drm_info.c
41035 +++ b/drivers/gpu/drm/drm_info.c
41036 @@ -77,10 +77,13 @@ int drm_vm_info(struct seq_file *m, void *data)
41037 struct drm_local_map *map;
41038 struct drm_map_list *r_list;
41039
41040 - /* Hardcoded from _DRM_FRAME_BUFFER,
41041 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
41042 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
41043 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
41044 + static const char * const types[] = {
41045 + [_DRM_FRAME_BUFFER] = "FB",
41046 + [_DRM_REGISTERS] = "REG",
41047 + [_DRM_SHM] = "SHM",
41048 + [_DRM_AGP] = "AGP",
41049 + [_DRM_SCATTER_GATHER] = "SG",
41050 + [_DRM_CONSISTENT] = "PCI"};
41051 const char *type;
41052 int i;
41053
41054 @@ -91,7 +94,7 @@ int drm_vm_info(struct seq_file *m, void *data)
41055 map = r_list->map;
41056 if (!map)
41057 continue;
41058 - if (map->type < 0 || map->type > 5)
41059 + if (map->type >= ARRAY_SIZE(types))
41060 type = "??";
41061 else
41062 type = types[map->type];
41063 diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
41064 index aa8bbb4..0f62630 100644
41065 --- a/drivers/gpu/drm/drm_ioc32.c
41066 +++ b/drivers/gpu/drm/drm_ioc32.c
41067 @@ -457,7 +457,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
41068 request = compat_alloc_user_space(nbytes);
41069 if (!access_ok(VERIFY_WRITE, request, nbytes))
41070 return -EFAULT;
41071 - list = (struct drm_buf_desc *) (request + 1);
41072 + list = (struct drm_buf_desc __user *) (request + 1);
41073
41074 if (__put_user(count, &request->count)
41075 || __put_user(list, &request->list))
41076 @@ -518,7 +518,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
41077 request = compat_alloc_user_space(nbytes);
41078 if (!access_ok(VERIFY_WRITE, request, nbytes))
41079 return -EFAULT;
41080 - list = (struct drm_buf_pub *) (request + 1);
41081 + list = (struct drm_buf_pub __user *) (request + 1);
41082
41083 if (__put_user(count, &request->count)
41084 || __put_user(list, &request->list))
41085 @@ -1016,7 +1016,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
41086 return 0;
41087 }
41088
41089 -static drm_ioctl_compat_t *drm_compat_ioctls[] = {
41090 +static drm_ioctl_compat_t drm_compat_ioctls[] = {
41091 [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
41092 [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
41093 [DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)] = compat_drm_getmap,
41094 @@ -1062,7 +1062,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
41095 long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41096 {
41097 unsigned int nr = DRM_IOCTL_NR(cmd);
41098 - drm_ioctl_compat_t *fn;
41099 int ret;
41100
41101 /* Assume that ioctls without an explicit compat routine will just
41102 @@ -1072,10 +1071,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41103 if (nr >= ARRAY_SIZE(drm_compat_ioctls))
41104 return drm_ioctl(filp, cmd, arg);
41105
41106 - fn = drm_compat_ioctls[nr];
41107 -
41108 - if (fn != NULL)
41109 - ret = (*fn) (filp, cmd, arg);
41110 + if (drm_compat_ioctls[nr] != NULL)
41111 + ret = (*drm_compat_ioctls[nr]) (filp, cmd, arg);
41112 else
41113 ret = drm_ioctl(filp, cmd, arg);
41114
41115 diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
41116 index 266dcd6..d0194d9 100644
41117 --- a/drivers/gpu/drm/drm_ioctl.c
41118 +++ b/drivers/gpu/drm/drm_ioctl.c
41119 @@ -663,7 +663,7 @@ long drm_ioctl(struct file *filp,
41120 struct drm_file *file_priv = filp->private_data;
41121 struct drm_device *dev;
41122 const struct drm_ioctl_desc *ioctl = NULL;
41123 - drm_ioctl_t *func;
41124 + drm_ioctl_no_const_t func;
41125 unsigned int nr = DRM_IOCTL_NR(cmd);
41126 int retcode = -EINVAL;
41127 char stack_kdata[128];
41128 diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
41129 index f861361..b61d4c7 100644
41130 --- a/drivers/gpu/drm/drm_lock.c
41131 +++ b/drivers/gpu/drm/drm_lock.c
41132 @@ -61,9 +61,12 @@ int drm_legacy_lock(struct drm_device *dev, void *data,
41133 struct drm_master *master = file_priv->master;
41134 int ret = 0;
41135
41136 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
41137 + return -EINVAL;
41138 +
41139 ++file_priv->lock_count;
41140
41141 - if (lock->context == DRM_KERNEL_CONTEXT) {
41142 + if (_DRM_LOCKING_CONTEXT(lock->context) == DRM_KERNEL_CONTEXT) {
41143 DRM_ERROR("Process %d using kernel context %d\n",
41144 task_pid_nr(current), lock->context);
41145 return -EINVAL;
41146 @@ -153,12 +156,23 @@ int drm_legacy_unlock(struct drm_device *dev, void *data, struct drm_file *file_
41147 struct drm_lock *lock = data;
41148 struct drm_master *master = file_priv->master;
41149
41150 - if (lock->context == DRM_KERNEL_CONTEXT) {
41151 + if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT))
41152 + return -EINVAL;
41153 +
41154 + if (_DRM_LOCKING_CONTEXT(lock->context) == DRM_KERNEL_CONTEXT) {
41155 DRM_ERROR("Process %d using kernel context %d\n",
41156 task_pid_nr(current), lock->context);
41157 return -EINVAL;
41158 }
41159
41160 + if (!master->lock.hw_lock) {
41161 + DRM_ERROR(
41162 + "Device has been unregistered. Hard exit. Process %d\n",
41163 + task_pid_nr(current));
41164 + send_sig(SIGTERM, current, 0);
41165 + return -EPERM;
41166 + }
41167 +
41168 if (drm_legacy_lock_free(&master->lock, lock->context)) {
41169 /* FIXME: Should really bail out here. */
41170 }
41171 diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
41172 index d4813e0..6c1ab4d 100644
41173 --- a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
41174 +++ b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
41175 @@ -825,10 +825,16 @@ void mdfld_dsi_dpi_mode_set(struct drm_encoder *encoder,
41176 u32 pipeconf_reg = PIPEACONF;
41177 u32 dspcntr_reg = DSPACNTR;
41178
41179 - u32 pipeconf = dev_priv->pipeconf[pipe];
41180 - u32 dspcntr = dev_priv->dspcntr[pipe];
41181 + u32 pipeconf;
41182 + u32 dspcntr;
41183 u32 mipi = MIPI_PORT_EN | PASS_FROM_SPHY_TO_AFE | SEL_FLOPPED_HSTX;
41184
41185 + if (pipe == -1)
41186 + return;
41187 +
41188 + pipeconf = dev_priv->pipeconf[pipe];
41189 + dspcntr = dev_priv->dspcntr[pipe];
41190 +
41191 if (pipe) {
41192 pipeconf_reg = PIPECCONF;
41193 dspcntr_reg = DSPCCNTR;
41194 diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
41195 index 93ec5dc..82acbaf 100644
41196 --- a/drivers/gpu/drm/i810/i810_drv.h
41197 +++ b/drivers/gpu/drm/i810/i810_drv.h
41198 @@ -110,8 +110,8 @@ typedef struct drm_i810_private {
41199 int page_flipping;
41200
41201 wait_queue_head_t irq_queue;
41202 - atomic_t irq_received;
41203 - atomic_t irq_emitted;
41204 + atomic_unchecked_t irq_received;
41205 + atomic_unchecked_t irq_emitted;
41206
41207 int front_offset;
41208 } drm_i810_private_t;
41209 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
41210 index 68e0c85..3303192 100644
41211 --- a/drivers/gpu/drm/i915/i915_dma.c
41212 +++ b/drivers/gpu/drm/i915/i915_dma.c
41213 @@ -162,6 +162,8 @@ static int i915_getparam(struct drm_device *dev, void *data,
41214 value = INTEL_INFO(dev)->eu_total;
41215 if (!value)
41216 return -ENODEV;
41217 + case I915_PARAM_HAS_LEGACY_CONTEXT:
41218 + value = drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT);
41219 break;
41220 default:
41221 DRM_DEBUG("Unknown parameter %d\n", param->param);
41222 @@ -376,7 +378,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
41223 * locking inversion with the driver load path. And the access here is
41224 * completely racy anyway. So don't bother with locking for now.
41225 */
41226 - return dev->open_count == 0;
41227 + return local_read(&dev->open_count) == 0;
41228 }
41229
41230 static const struct vga_switcheroo_client_ops i915_switcheroo_ops = {
41231 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
41232 index a3190e79..86b06cb 100644
41233 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
41234 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
41235 @@ -936,12 +936,12 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
41236 static int
41237 validate_exec_list(struct drm_device *dev,
41238 struct drm_i915_gem_exec_object2 *exec,
41239 - int count)
41240 + unsigned int count)
41241 {
41242 unsigned relocs_total = 0;
41243 unsigned relocs_max = UINT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
41244 unsigned invalid_flags;
41245 - int i;
41246 + unsigned int i;
41247
41248 invalid_flags = __EXEC_OBJECT_UNKNOWN_FLAGS;
41249 if (USES_FULL_PPGTT(dev))
41250 diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
41251 index 176de63..b50b66a 100644
41252 --- a/drivers/gpu/drm/i915/i915_ioc32.c
41253 +++ b/drivers/gpu/drm/i915/i915_ioc32.c
41254 @@ -62,7 +62,7 @@ static int compat_i915_batchbuffer(struct file *file, unsigned int cmd,
41255 || __put_user(batchbuffer32.DR4, &batchbuffer->DR4)
41256 || __put_user(batchbuffer32.num_cliprects,
41257 &batchbuffer->num_cliprects)
41258 - || __put_user((int __user *)(unsigned long)batchbuffer32.cliprects,
41259 + || __put_user((struct drm_clip_rect __user *)(unsigned long)batchbuffer32.cliprects,
41260 &batchbuffer->cliprects))
41261 return -EFAULT;
41262
41263 @@ -91,13 +91,13 @@ static int compat_i915_cmdbuffer(struct file *file, unsigned int cmd,
41264
41265 cmdbuffer = compat_alloc_user_space(sizeof(*cmdbuffer));
41266 if (!access_ok(VERIFY_WRITE, cmdbuffer, sizeof(*cmdbuffer))
41267 - || __put_user((int __user *)(unsigned long)cmdbuffer32.buf,
41268 + || __put_user((char __user *)(unsigned long)cmdbuffer32.buf,
41269 &cmdbuffer->buf)
41270 || __put_user(cmdbuffer32.sz, &cmdbuffer->sz)
41271 || __put_user(cmdbuffer32.DR1, &cmdbuffer->DR1)
41272 || __put_user(cmdbuffer32.DR4, &cmdbuffer->DR4)
41273 || __put_user(cmdbuffer32.num_cliprects, &cmdbuffer->num_cliprects)
41274 - || __put_user((int __user *)(unsigned long)cmdbuffer32.cliprects,
41275 + || __put_user((struct drm_clip_rect __user *)(unsigned long)cmdbuffer32.cliprects,
41276 &cmdbuffer->cliprects))
41277 return -EFAULT;
41278
41279 @@ -181,7 +181,7 @@ static int compat_i915_alloc(struct file *file, unsigned int cmd,
41280 (unsigned long)request);
41281 }
41282
41283 -static drm_ioctl_compat_t *i915_compat_ioctls[] = {
41284 +static drm_ioctl_compat_t i915_compat_ioctls[] = {
41285 [DRM_I915_BATCHBUFFER] = compat_i915_batchbuffer,
41286 [DRM_I915_CMDBUFFER] = compat_i915_cmdbuffer,
41287 [DRM_I915_GETPARAM] = compat_i915_getparam,
41288 @@ -201,17 +201,13 @@ static drm_ioctl_compat_t *i915_compat_ioctls[] = {
41289 long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41290 {
41291 unsigned int nr = DRM_IOCTL_NR(cmd);
41292 - drm_ioctl_compat_t *fn = NULL;
41293 int ret;
41294
41295 if (nr < DRM_COMMAND_BASE)
41296 return drm_compat_ioctl(filp, cmd, arg);
41297
41298 - if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls))
41299 - fn = i915_compat_ioctls[nr - DRM_COMMAND_BASE];
41300 -
41301 - if (fn != NULL)
41302 - ret = (*fn) (filp, cmd, arg);
41303 + if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls) && i915_compat_ioctls[nr - DRM_COMMAND_BASE])
41304 + ret = (*i915_compat_ioctls[nr - DRM_COMMAND_BASE])(filp, cmd, arg);
41305 else
41306 ret = drm_ioctl(filp, cmd, arg);
41307
41308 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
41309 index d0f3cbc..f3ab4cc 100644
41310 --- a/drivers/gpu/drm/i915/intel_display.c
41311 +++ b/drivers/gpu/drm/i915/intel_display.c
41312 @@ -13604,13 +13604,13 @@ struct intel_quirk {
41313 int subsystem_vendor;
41314 int subsystem_device;
41315 void (*hook)(struct drm_device *dev);
41316 -};
41317 +} __do_const;
41318
41319 /* For systems that don't have a meaningful PCI subdevice/subvendor ID */
41320 struct intel_dmi_quirk {
41321 void (*hook)(struct drm_device *dev);
41322 const struct dmi_system_id (*dmi_id_list)[];
41323 -};
41324 +} __do_const;
41325
41326 static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
41327 {
41328 @@ -13618,18 +13618,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
41329 return 1;
41330 }
41331
41332 -static const struct intel_dmi_quirk intel_dmi_quirks[] = {
41333 +static const struct dmi_system_id intel_dmi_quirks_table[] = {
41334 {
41335 - .dmi_id_list = &(const struct dmi_system_id[]) {
41336 - {
41337 - .callback = intel_dmi_reverse_brightness,
41338 - .ident = "NCR Corporation",
41339 - .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
41340 - DMI_MATCH(DMI_PRODUCT_NAME, ""),
41341 - },
41342 - },
41343 - { } /* terminating entry */
41344 + .callback = intel_dmi_reverse_brightness,
41345 + .ident = "NCR Corporation",
41346 + .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
41347 + DMI_MATCH(DMI_PRODUCT_NAME, ""),
41348 },
41349 + },
41350 + { } /* terminating entry */
41351 +};
41352 +
41353 +static const struct intel_dmi_quirk intel_dmi_quirks[] = {
41354 + {
41355 + .dmi_id_list = &intel_dmi_quirks_table,
41356 .hook = quirk_invert_brightness,
41357 },
41358 };
41359 diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
41360 index 74f505b..21f6914 100644
41361 --- a/drivers/gpu/drm/imx/imx-drm-core.c
41362 +++ b/drivers/gpu/drm/imx/imx-drm-core.c
41363 @@ -355,7 +355,7 @@ int imx_drm_add_crtc(struct drm_device *drm, struct drm_crtc *crtc,
41364 if (imxdrm->pipes >= MAX_CRTC)
41365 return -EINVAL;
41366
41367 - if (imxdrm->drm->open_count)
41368 + if (local_read(&imxdrm->drm->open_count))
41369 return -EBUSY;
41370
41371 imx_drm_crtc = kzalloc(sizeof(*imx_drm_crtc), GFP_KERNEL);
41372 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
41373 index b4a20149..219ab78 100644
41374 --- a/drivers/gpu/drm/mga/mga_drv.h
41375 +++ b/drivers/gpu/drm/mga/mga_drv.h
41376 @@ -122,9 +122,9 @@ typedef struct drm_mga_private {
41377 u32 clear_cmd;
41378 u32 maccess;
41379
41380 - atomic_t vbl_received; /**< Number of vblanks received. */
41381 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
41382 wait_queue_head_t fence_queue;
41383 - atomic_t last_fence_retired;
41384 + atomic_unchecked_t last_fence_retired;
41385 u32 next_fence_to_post;
41386
41387 unsigned int fb_cpp;
41388 diff --git a/drivers/gpu/drm/mga/mga_ioc32.c b/drivers/gpu/drm/mga/mga_ioc32.c
41389 index 729bfd5..14bae78 100644
41390 --- a/drivers/gpu/drm/mga/mga_ioc32.c
41391 +++ b/drivers/gpu/drm/mga/mga_ioc32.c
41392 @@ -190,7 +190,7 @@ static int compat_mga_dma_bootstrap(struct file *file, unsigned int cmd,
41393 return 0;
41394 }
41395
41396 -drm_ioctl_compat_t *mga_compat_ioctls[] = {
41397 +drm_ioctl_compat_t mga_compat_ioctls[] = {
41398 [DRM_MGA_INIT] = compat_mga_init,
41399 [DRM_MGA_GETPARAM] = compat_mga_getparam,
41400 [DRM_MGA_DMA_BOOTSTRAP] = compat_mga_dma_bootstrap,
41401 @@ -208,17 +208,13 @@ drm_ioctl_compat_t *mga_compat_ioctls[] = {
41402 long mga_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41403 {
41404 unsigned int nr = DRM_IOCTL_NR(cmd);
41405 - drm_ioctl_compat_t *fn = NULL;
41406 int ret;
41407
41408 if (nr < DRM_COMMAND_BASE)
41409 return drm_compat_ioctl(filp, cmd, arg);
41410
41411 - if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(mga_compat_ioctls))
41412 - fn = mga_compat_ioctls[nr - DRM_COMMAND_BASE];
41413 -
41414 - if (fn != NULL)
41415 - ret = (*fn) (filp, cmd, arg);
41416 + if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(mga_compat_ioctls) && mga_compat_ioctls[nr - DRM_COMMAND_BASE])
41417 + ret = (*mga_compat_ioctls[nr - DRM_COMMAND_BASE]) (filp, cmd, arg);
41418 else
41419 ret = drm_ioctl(filp, cmd, arg);
41420
41421 diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
41422 index 1b071b8..de8601a 100644
41423 --- a/drivers/gpu/drm/mga/mga_irq.c
41424 +++ b/drivers/gpu/drm/mga/mga_irq.c
41425 @@ -43,7 +43,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
41426 if (crtc != 0)
41427 return 0;
41428
41429 - return atomic_read(&dev_priv->vbl_received);
41430 + return atomic_read_unchecked(&dev_priv->vbl_received);
41431 }
41432
41433
41434 @@ -59,7 +59,7 @@ irqreturn_t mga_driver_irq_handler(int irq, void *arg)
41435 /* VBLANK interrupt */
41436 if (status & MGA_VLINEPEN) {
41437 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
41438 - atomic_inc(&dev_priv->vbl_received);
41439 + atomic_inc_unchecked(&dev_priv->vbl_received);
41440 drm_handle_vblank(dev, 0);
41441 handled = 1;
41442 }
41443 @@ -78,7 +78,7 @@ irqreturn_t mga_driver_irq_handler(int irq, void *arg)
41444 if ((prim_start & ~0x03) != (prim_end & ~0x03))
41445 MGA_WRITE(MGA_PRIMEND, prim_end);
41446
41447 - atomic_inc(&dev_priv->last_fence_retired);
41448 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
41449 wake_up(&dev_priv->fence_queue);
41450 handled = 1;
41451 }
41452 @@ -129,7 +129,7 @@ int mga_driver_fence_wait(struct drm_device *dev, unsigned int *sequence)
41453 * using fences.
41454 */
41455 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * HZ,
41456 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
41457 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
41458 - *sequence) <= (1 << 23)));
41459
41460 *sequence = cur_fence;
41461 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
41462 index 0190b69..60c3eaf 100644
41463 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
41464 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
41465 @@ -963,7 +963,7 @@ static int parse_bit_tmds_tbl_entry(struct drm_device *dev, struct nvbios *bios,
41466 struct bit_table {
41467 const char id;
41468 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
41469 -};
41470 +} __no_const;
41471
41472 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
41473
41474 diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
41475 index 8904933..9624b38 100644
41476 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c
41477 +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
41478 @@ -941,7 +941,8 @@ static struct drm_driver
41479 driver_stub = {
41480 .driver_features =
41481 DRIVER_USE_AGP |
41482 - DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER,
41483 + DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER |
41484 + DRIVER_KMS_LEGACY_CONTEXT,
41485
41486 .load = nouveau_drm_load,
41487 .unload = nouveau_drm_unload,
41488 diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h
41489 index dd72652..1fd2368 100644
41490 --- a/drivers/gpu/drm/nouveau/nouveau_drm.h
41491 +++ b/drivers/gpu/drm/nouveau/nouveau_drm.h
41492 @@ -123,7 +123,6 @@ struct nouveau_drm {
41493 struct drm_global_reference mem_global_ref;
41494 struct ttm_bo_global_ref bo_global_ref;
41495 struct ttm_bo_device bdev;
41496 - atomic_t validate_sequence;
41497 int (*move)(struct nouveau_channel *,
41498 struct ttm_buffer_object *,
41499 struct ttm_mem_reg *, struct ttm_mem_reg *);
41500 diff --git a/drivers/gpu/drm/nouveau/nouveau_ioc32.c b/drivers/gpu/drm/nouveau/nouveau_ioc32.c
41501 index 462679a..88e32a7 100644
41502 --- a/drivers/gpu/drm/nouveau/nouveau_ioc32.c
41503 +++ b/drivers/gpu/drm/nouveau/nouveau_ioc32.c
41504 @@ -50,7 +50,7 @@ long nouveau_compat_ioctl(struct file *filp, unsigned int cmd,
41505 unsigned long arg)
41506 {
41507 unsigned int nr = DRM_IOCTL_NR(cmd);
41508 - drm_ioctl_compat_t *fn = NULL;
41509 + drm_ioctl_compat_t fn = NULL;
41510 int ret;
41511
41512 if (nr < DRM_COMMAND_BASE)
41513 diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
41514 index 18f4497..10f6025 100644
41515 --- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
41516 +++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
41517 @@ -130,11 +130,11 @@ nouveau_vram_manager_debug(struct ttm_mem_type_manager *man, const char *prefix)
41518 }
41519
41520 const struct ttm_mem_type_manager_func nouveau_vram_manager = {
41521 - nouveau_vram_manager_init,
41522 - nouveau_vram_manager_fini,
41523 - nouveau_vram_manager_new,
41524 - nouveau_vram_manager_del,
41525 - nouveau_vram_manager_debug
41526 + .init = nouveau_vram_manager_init,
41527 + .takedown = nouveau_vram_manager_fini,
41528 + .get_node = nouveau_vram_manager_new,
41529 + .put_node = nouveau_vram_manager_del,
41530 + .debug = nouveau_vram_manager_debug
41531 };
41532
41533 static int
41534 @@ -198,11 +198,11 @@ nouveau_gart_manager_debug(struct ttm_mem_type_manager *man, const char *prefix)
41535 }
41536
41537 const struct ttm_mem_type_manager_func nouveau_gart_manager = {
41538 - nouveau_gart_manager_init,
41539 - nouveau_gart_manager_fini,
41540 - nouveau_gart_manager_new,
41541 - nouveau_gart_manager_del,
41542 - nouveau_gart_manager_debug
41543 + .init = nouveau_gart_manager_init,
41544 + .takedown = nouveau_gart_manager_fini,
41545 + .get_node = nouveau_gart_manager_new,
41546 + .put_node = nouveau_gart_manager_del,
41547 + .debug = nouveau_gart_manager_debug
41548 };
41549
41550 /*XXX*/
41551 @@ -271,11 +271,11 @@ nv04_gart_manager_debug(struct ttm_mem_type_manager *man, const char *prefix)
41552 }
41553
41554 const struct ttm_mem_type_manager_func nv04_gart_manager = {
41555 - nv04_gart_manager_init,
41556 - nv04_gart_manager_fini,
41557 - nv04_gart_manager_new,
41558 - nv04_gart_manager_del,
41559 - nv04_gart_manager_debug
41560 + .init = nv04_gart_manager_init,
41561 + .takedown = nv04_gart_manager_fini,
41562 + .get_node = nv04_gart_manager_new,
41563 + .put_node = nv04_gart_manager_del,
41564 + .debug = nv04_gart_manager_debug
41565 };
41566
41567 int
41568 diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
41569 index c7592ec..dd45ebc 100644
41570 --- a/drivers/gpu/drm/nouveau/nouveau_vga.c
41571 +++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
41572 @@ -72,7 +72,7 @@ nouveau_switcheroo_can_switch(struct pci_dev *pdev)
41573 * locking inversion with the driver load path. And the access here is
41574 * completely racy anyway. So don't bother with locking for now.
41575 */
41576 - return dev->open_count == 0;
41577 + return local_read(&dev->open_count) == 0;
41578 }
41579
41580 static const struct vga_switcheroo_client_ops
41581 diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
41582 index 9782364..89bd954 100644
41583 --- a/drivers/gpu/drm/qxl/qxl_cmd.c
41584 +++ b/drivers/gpu/drm/qxl/qxl_cmd.c
41585 @@ -285,27 +285,27 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port,
41586 int ret;
41587
41588 mutex_lock(&qdev->async_io_mutex);
41589 - irq_num = atomic_read(&qdev->irq_received_io_cmd);
41590 + irq_num = atomic_read_unchecked(&qdev->irq_received_io_cmd);
41591 if (qdev->last_sent_io_cmd > irq_num) {
41592 if (intr)
41593 ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
41594 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41595 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41596 else
41597 ret = wait_event_timeout(qdev->io_cmd_event,
41598 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41599 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41600 /* 0 is timeout, just bail the "hw" has gone away */
41601 if (ret <= 0)
41602 goto out;
41603 - irq_num = atomic_read(&qdev->irq_received_io_cmd);
41604 + irq_num = atomic_read_unchecked(&qdev->irq_received_io_cmd);
41605 }
41606 outb(val, addr);
41607 qdev->last_sent_io_cmd = irq_num + 1;
41608 if (intr)
41609 ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
41610 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41611 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41612 else
41613 ret = wait_event_timeout(qdev->io_cmd_event,
41614 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41615 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41616 out:
41617 if (ret > 0)
41618 ret = 0;
41619 diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c
41620 index 6911b8c..89d6867 100644
41621 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c
41622 +++ b/drivers/gpu/drm/qxl/qxl_debugfs.c
41623 @@ -42,10 +42,10 @@ qxl_debugfs_irq_received(struct seq_file *m, void *data)
41624 struct drm_info_node *node = (struct drm_info_node *) m->private;
41625 struct qxl_device *qdev = node->minor->dev->dev_private;
41626
41627 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received));
41628 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received_display));
41629 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received_cursor));
41630 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received_io_cmd));
41631 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received));
41632 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received_display));
41633 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received_cursor));
41634 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received_io_cmd));
41635 seq_printf(m, "%d\n", qdev->irq_received_error);
41636 return 0;
41637 }
41638 diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
41639 index 7c6cafe..460f542 100644
41640 --- a/drivers/gpu/drm/qxl/qxl_drv.h
41641 +++ b/drivers/gpu/drm/qxl/qxl_drv.h
41642 @@ -290,10 +290,10 @@ struct qxl_device {
41643 unsigned int last_sent_io_cmd;
41644
41645 /* interrupt handling */
41646 - atomic_t irq_received;
41647 - atomic_t irq_received_display;
41648 - atomic_t irq_received_cursor;
41649 - atomic_t irq_received_io_cmd;
41650 + atomic_unchecked_t irq_received;
41651 + atomic_unchecked_t irq_received_display;
41652 + atomic_unchecked_t irq_received_cursor;
41653 + atomic_unchecked_t irq_received_io_cmd;
41654 unsigned irq_received_error;
41655 wait_queue_head_t display_event;
41656 wait_queue_head_t cursor_event;
41657 diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
41658 index b110883..dd06418 100644
41659 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c
41660 +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
41661 @@ -181,7 +181,7 @@ static int qxl_process_single_command(struct qxl_device *qdev,
41662
41663 /* TODO copy slow path code from i915 */
41664 fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
41665 - unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)cmd->command, cmd->command_size);
41666 + unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void __force_user *)(unsigned long)cmd->command, cmd->command_size);
41667
41668 {
41669 struct qxl_drawable *draw = fb_cmd;
41670 @@ -201,7 +201,7 @@ static int qxl_process_single_command(struct qxl_device *qdev,
41671 struct drm_qxl_reloc reloc;
41672
41673 if (copy_from_user(&reloc,
41674 - &((struct drm_qxl_reloc *)(uintptr_t)cmd->relocs)[i],
41675 + &((struct drm_qxl_reloc __force_user *)(uintptr_t)cmd->relocs)[i],
41676 sizeof(reloc))) {
41677 ret = -EFAULT;
41678 goto out_free_bos;
41679 @@ -294,10 +294,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
41680
41681 for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) {
41682
41683 - struct drm_qxl_command *commands =
41684 - (struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
41685 + struct drm_qxl_command __user *commands =
41686 + (struct drm_qxl_command __user *)(uintptr_t)execbuffer->commands;
41687
41688 - if (copy_from_user(&user_cmd, &commands[cmd_num],
41689 + if (copy_from_user(&user_cmd, (struct drm_qxl_command __force_user *)&commands[cmd_num],
41690 sizeof(user_cmd)))
41691 return -EFAULT;
41692
41693 diff --git a/drivers/gpu/drm/qxl/qxl_irq.c b/drivers/gpu/drm/qxl/qxl_irq.c
41694 index 0bf1e20..42a7310 100644
41695 --- a/drivers/gpu/drm/qxl/qxl_irq.c
41696 +++ b/drivers/gpu/drm/qxl/qxl_irq.c
41697 @@ -36,19 +36,19 @@ irqreturn_t qxl_irq_handler(int irq, void *arg)
41698 if (!pending)
41699 return IRQ_NONE;
41700
41701 - atomic_inc(&qdev->irq_received);
41702 + atomic_inc_unchecked(&qdev->irq_received);
41703
41704 if (pending & QXL_INTERRUPT_DISPLAY) {
41705 - atomic_inc(&qdev->irq_received_display);
41706 + atomic_inc_unchecked(&qdev->irq_received_display);
41707 wake_up_all(&qdev->display_event);
41708 qxl_queue_garbage_collect(qdev, false);
41709 }
41710 if (pending & QXL_INTERRUPT_CURSOR) {
41711 - atomic_inc(&qdev->irq_received_cursor);
41712 + atomic_inc_unchecked(&qdev->irq_received_cursor);
41713 wake_up_all(&qdev->cursor_event);
41714 }
41715 if (pending & QXL_INTERRUPT_IO_CMD) {
41716 - atomic_inc(&qdev->irq_received_io_cmd);
41717 + atomic_inc_unchecked(&qdev->irq_received_io_cmd);
41718 wake_up_all(&qdev->io_cmd_event);
41719 }
41720 if (pending & QXL_INTERRUPT_ERROR) {
41721 @@ -85,10 +85,10 @@ int qxl_irq_init(struct qxl_device *qdev)
41722 init_waitqueue_head(&qdev->io_cmd_event);
41723 INIT_WORK(&qdev->client_monitors_config_work,
41724 qxl_client_monitors_config_work_func);
41725 - atomic_set(&qdev->irq_received, 0);
41726 - atomic_set(&qdev->irq_received_display, 0);
41727 - atomic_set(&qdev->irq_received_cursor, 0);
41728 - atomic_set(&qdev->irq_received_io_cmd, 0);
41729 + atomic_set_unchecked(&qdev->irq_received, 0);
41730 + atomic_set_unchecked(&qdev->irq_received_display, 0);
41731 + atomic_set_unchecked(&qdev->irq_received_cursor, 0);
41732 + atomic_set_unchecked(&qdev->irq_received_io_cmd, 0);
41733 qdev->irq_received_error = 0;
41734 ret = drm_irq_install(qdev->ddev, qdev->ddev->pdev->irq);
41735 qdev->ram_header->int_mask = QXL_INTERRUPT_MASK;
41736 diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
41737 index 0cbc4c9..0e46686 100644
41738 --- a/drivers/gpu/drm/qxl/qxl_ttm.c
41739 +++ b/drivers/gpu/drm/qxl/qxl_ttm.c
41740 @@ -103,7 +103,7 @@ static void qxl_ttm_global_fini(struct qxl_device *qdev)
41741 }
41742 }
41743
41744 -static struct vm_operations_struct qxl_ttm_vm_ops;
41745 +static vm_operations_struct_no_const qxl_ttm_vm_ops __read_only;
41746 static const struct vm_operations_struct *ttm_vm_ops;
41747
41748 static int qxl_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
41749 @@ -145,8 +145,10 @@ int qxl_mmap(struct file *filp, struct vm_area_struct *vma)
41750 return r;
41751 if (unlikely(ttm_vm_ops == NULL)) {
41752 ttm_vm_ops = vma->vm_ops;
41753 + pax_open_kernel();
41754 qxl_ttm_vm_ops = *ttm_vm_ops;
41755 qxl_ttm_vm_ops.fault = &qxl_ttm_fault;
41756 + pax_close_kernel();
41757 }
41758 vma->vm_ops = &qxl_ttm_vm_ops;
41759 return 0;
41760 @@ -464,25 +466,23 @@ static int qxl_mm_dump_table(struct seq_file *m, void *data)
41761 static int qxl_ttm_debugfs_init(struct qxl_device *qdev)
41762 {
41763 #if defined(CONFIG_DEBUG_FS)
41764 - static struct drm_info_list qxl_mem_types_list[QXL_DEBUGFS_MEM_TYPES];
41765 - static char qxl_mem_types_names[QXL_DEBUGFS_MEM_TYPES][32];
41766 - unsigned i;
41767 + static struct drm_info_list qxl_mem_types_list[QXL_DEBUGFS_MEM_TYPES] = {
41768 + {
41769 + .name = "qxl_mem_mm",
41770 + .show = &qxl_mm_dump_table,
41771 + },
41772 + {
41773 + .name = "qxl_surf_mm",
41774 + .show = &qxl_mm_dump_table,
41775 + }
41776 + };
41777
41778 - for (i = 0; i < QXL_DEBUGFS_MEM_TYPES; i++) {
41779 - if (i == 0)
41780 - sprintf(qxl_mem_types_names[i], "qxl_mem_mm");
41781 - else
41782 - sprintf(qxl_mem_types_names[i], "qxl_surf_mm");
41783 - qxl_mem_types_list[i].name = qxl_mem_types_names[i];
41784 - qxl_mem_types_list[i].show = &qxl_mm_dump_table;
41785 - qxl_mem_types_list[i].driver_features = 0;
41786 - if (i == 0)
41787 - qxl_mem_types_list[i].data = qdev->mman.bdev.man[TTM_PL_VRAM].priv;
41788 - else
41789 - qxl_mem_types_list[i].data = qdev->mman.bdev.man[TTM_PL_PRIV0].priv;
41790 + pax_open_kernel();
41791 + *(void **)&qxl_mem_types_list[0].data = qdev->mman.bdev.man[TTM_PL_VRAM].priv;
41792 + *(void **)&qxl_mem_types_list[1].data = qdev->mman.bdev.man[TTM_PL_PRIV0].priv;
41793 + pax_close_kernel();
41794
41795 - }
41796 - return qxl_debugfs_add_files(qdev, qxl_mem_types_list, i);
41797 + return qxl_debugfs_add_files(qdev, qxl_mem_types_list, QXL_DEBUGFS_MEM_TYPES);
41798 #else
41799 return 0;
41800 #endif
41801 diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
41802 index 2c45ac9..5d740f8 100644
41803 --- a/drivers/gpu/drm/r128/r128_cce.c
41804 +++ b/drivers/gpu/drm/r128/r128_cce.c
41805 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device *dev, drm_r128_init_t *init)
41806
41807 /* GH: Simple idle check.
41808 */
41809 - atomic_set(&dev_priv->idle_count, 0);
41810 + atomic_set_unchecked(&dev_priv->idle_count, 0);
41811
41812 /* We don't support anything other than bus-mastering ring mode,
41813 * but the ring can be in either AGP or PCI space for the ring
41814 diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
41815 index 723e5d6..102dbaf 100644
41816 --- a/drivers/gpu/drm/r128/r128_drv.h
41817 +++ b/drivers/gpu/drm/r128/r128_drv.h
41818 @@ -93,14 +93,14 @@ typedef struct drm_r128_private {
41819 int is_pci;
41820 unsigned long cce_buffers_offset;
41821
41822 - atomic_t idle_count;
41823 + atomic_unchecked_t idle_count;
41824
41825 int page_flipping;
41826 int current_page;
41827 u32 crtc_offset;
41828 u32 crtc_offset_cntl;
41829
41830 - atomic_t vbl_received;
41831 + atomic_unchecked_t vbl_received;
41832
41833 u32 color_fmt;
41834 unsigned int front_offset;
41835 diff --git a/drivers/gpu/drm/r128/r128_ioc32.c b/drivers/gpu/drm/r128/r128_ioc32.c
41836 index 663f38c..ec159a1 100644
41837 --- a/drivers/gpu/drm/r128/r128_ioc32.c
41838 +++ b/drivers/gpu/drm/r128/r128_ioc32.c
41839 @@ -178,7 +178,7 @@ static int compat_r128_getparam(struct file *file, unsigned int cmd,
41840 return drm_ioctl(file, DRM_IOCTL_R128_GETPARAM, (unsigned long)getparam);
41841 }
41842
41843 -drm_ioctl_compat_t *r128_compat_ioctls[] = {
41844 +drm_ioctl_compat_t r128_compat_ioctls[] = {
41845 [DRM_R128_INIT] = compat_r128_init,
41846 [DRM_R128_DEPTH] = compat_r128_depth,
41847 [DRM_R128_STIPPLE] = compat_r128_stipple,
41848 @@ -197,17 +197,13 @@ drm_ioctl_compat_t *r128_compat_ioctls[] = {
41849 long r128_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41850 {
41851 unsigned int nr = DRM_IOCTL_NR(cmd);
41852 - drm_ioctl_compat_t *fn = NULL;
41853 int ret;
41854
41855 if (nr < DRM_COMMAND_BASE)
41856 return drm_compat_ioctl(filp, cmd, arg);
41857
41858 - if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(r128_compat_ioctls))
41859 - fn = r128_compat_ioctls[nr - DRM_COMMAND_BASE];
41860 -
41861 - if (fn != NULL)
41862 - ret = (*fn) (filp, cmd, arg);
41863 + if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(r128_compat_ioctls) && r128_compat_ioctls[nr - DRM_COMMAND_BASE])
41864 + ret = (*r128_compat_ioctls[nr - DRM_COMMAND_BASE]) (filp, cmd, arg);
41865 else
41866 ret = drm_ioctl(filp, cmd, arg);
41867
41868 diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
41869 index c2ae496..30b5993 100644
41870 --- a/drivers/gpu/drm/r128/r128_irq.c
41871 +++ b/drivers/gpu/drm/r128/r128_irq.c
41872 @@ -41,7 +41,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
41873 if (crtc != 0)
41874 return 0;
41875
41876 - return atomic_read(&dev_priv->vbl_received);
41877 + return atomic_read_unchecked(&dev_priv->vbl_received);
41878 }
41879
41880 irqreturn_t r128_driver_irq_handler(int irq, void *arg)
41881 @@ -55,7 +55,7 @@ irqreturn_t r128_driver_irq_handler(int irq, void *arg)
41882 /* VBLANK interrupt */
41883 if (status & R128_CRTC_VBLANK_INT) {
41884 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
41885 - atomic_inc(&dev_priv->vbl_received);
41886 + atomic_inc_unchecked(&dev_priv->vbl_received);
41887 drm_handle_vblank(dev, 0);
41888 return IRQ_HANDLED;
41889 }
41890 diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
41891 index 8fd2d9f..18c9660 100644
41892 --- a/drivers/gpu/drm/r128/r128_state.c
41893 +++ b/drivers/gpu/drm/r128/r128_state.c
41894 @@ -320,10 +320,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
41895
41896 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
41897 {
41898 - if (atomic_read(&dev_priv->idle_count) == 0)
41899 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
41900 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
41901 else
41902 - atomic_set(&dev_priv->idle_count, 0);
41903 + atomic_set_unchecked(&dev_priv->idle_count, 0);
41904 }
41905
41906 #endif
41907 diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
41908 index b928c17..e5d9400 100644
41909 --- a/drivers/gpu/drm/radeon/mkregtable.c
41910 +++ b/drivers/gpu/drm/radeon/mkregtable.c
41911 @@ -624,14 +624,14 @@ static int parser_auth(struct table *t, const char *filename)
41912 regex_t mask_rex;
41913 regmatch_t match[4];
41914 char buf[1024];
41915 - size_t end;
41916 + long end;
41917 int len;
41918 int done = 0;
41919 int r;
41920 unsigned o;
41921 struct offset *offset;
41922 char last_reg_s[10];
41923 - int last_reg;
41924 + unsigned long last_reg;
41925
41926 if (regcomp
41927 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
41928 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
41929 index a7fdfa4..04a3964 100644
41930 --- a/drivers/gpu/drm/radeon/radeon_device.c
41931 +++ b/drivers/gpu/drm/radeon/radeon_device.c
41932 @@ -1247,7 +1247,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
41933 * locking inversion with the driver load path. And the access here is
41934 * completely racy anyway. So don't bother with locking for now.
41935 */
41936 - return dev->open_count == 0;
41937 + return local_read(&dev->open_count) == 0;
41938 }
41939
41940 static const struct vga_switcheroo_client_ops radeon_switcheroo_ops = {
41941 diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
41942 index 46bd393..6ae4719 100644
41943 --- a/drivers/gpu/drm/radeon/radeon_drv.h
41944 +++ b/drivers/gpu/drm/radeon/radeon_drv.h
41945 @@ -264,7 +264,7 @@ typedef struct drm_radeon_private {
41946
41947 /* SW interrupt */
41948 wait_queue_head_t swi_queue;
41949 - atomic_t swi_emitted;
41950 + atomic_unchecked_t swi_emitted;
41951 int vblank_crtc;
41952 uint32_t irq_enable_reg;
41953 uint32_t r500_disp_irq_reg;
41954 diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
41955 index 0b98ea1..a3c770f 100644
41956 --- a/drivers/gpu/drm/radeon/radeon_ioc32.c
41957 +++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
41958 @@ -358,7 +358,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
41959 request = compat_alloc_user_space(sizeof(*request));
41960 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
41961 || __put_user(req32.param, &request->param)
41962 - || __put_user((void __user *)(unsigned long)req32.value,
41963 + || __put_user((unsigned long)req32.value,
41964 &request->value))
41965 return -EFAULT;
41966
41967 @@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
41968 #define compat_radeon_cp_setparam NULL
41969 #endif /* X86_64 || IA64 */
41970
41971 -static drm_ioctl_compat_t *radeon_compat_ioctls[] = {
41972 +static drm_ioctl_compat_t radeon_compat_ioctls[] = {
41973 [DRM_RADEON_CP_INIT] = compat_radeon_cp_init,
41974 [DRM_RADEON_CLEAR] = compat_radeon_cp_clear,
41975 [DRM_RADEON_STIPPLE] = compat_radeon_cp_stipple,
41976 @@ -393,17 +393,13 @@ static drm_ioctl_compat_t *radeon_compat_ioctls[] = {
41977 long radeon_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41978 {
41979 unsigned int nr = DRM_IOCTL_NR(cmd);
41980 - drm_ioctl_compat_t *fn = NULL;
41981 int ret;
41982
41983 if (nr < DRM_COMMAND_BASE)
41984 return drm_compat_ioctl(filp, cmd, arg);
41985
41986 - if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(radeon_compat_ioctls))
41987 - fn = radeon_compat_ioctls[nr - DRM_COMMAND_BASE];
41988 -
41989 - if (fn != NULL)
41990 - ret = (*fn) (filp, cmd, arg);
41991 + if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(radeon_compat_ioctls) && radeon_compat_ioctls[nr - DRM_COMMAND_BASE])
41992 + ret = (*radeon_compat_ioctls[nr - DRM_COMMAND_BASE]) (filp, cmd, arg);
41993 else
41994 ret = drm_ioctl(filp, cmd, arg);
41995
41996 diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
41997 index 244b19b..c19226d 100644
41998 --- a/drivers/gpu/drm/radeon/radeon_irq.c
41999 +++ b/drivers/gpu/drm/radeon/radeon_irq.c
42000 @@ -226,8 +226,8 @@ static int radeon_emit_irq(struct drm_device * dev)
42001 unsigned int ret;
42002 RING_LOCALS;
42003
42004 - atomic_inc(&dev_priv->swi_emitted);
42005 - ret = atomic_read(&dev_priv->swi_emitted);
42006 + atomic_inc_unchecked(&dev_priv->swi_emitted);
42007 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
42008
42009 BEGIN_RING(4);
42010 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
42011 @@ -353,7 +353,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
42012 drm_radeon_private_t *dev_priv =
42013 (drm_radeon_private_t *) dev->dev_private;
42014
42015 - atomic_set(&dev_priv->swi_emitted, 0);
42016 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
42017 init_waitqueue_head(&dev_priv->swi_queue);
42018
42019 dev->max_vblank_count = 0x001fffff;
42020 diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
42021 index 15aee72..cda326e 100644
42022 --- a/drivers/gpu/drm/radeon/radeon_state.c
42023 +++ b/drivers/gpu/drm/radeon/radeon_state.c
42024 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
42025 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
42026 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
42027
42028 - if (copy_from_user(&depth_boxes, clear->depth_boxes,
42029 + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || copy_from_user(&depth_boxes, clear->depth_boxes,
42030 sarea_priv->nbox * sizeof(depth_boxes[0])))
42031 return -EFAULT;
42032
42033 @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
42034 {
42035 drm_radeon_private_t *dev_priv = dev->dev_private;
42036 drm_radeon_getparam_t *param = data;
42037 - int value;
42038 + int value = 0;
42039
42040 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
42041
42042 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
42043 index edafd3c..3af7c9c 100644
42044 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
42045 +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
42046 @@ -961,7 +961,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
42047 man->size = size >> PAGE_SHIFT;
42048 }
42049
42050 -static struct vm_operations_struct radeon_ttm_vm_ops;
42051 +static vm_operations_struct_no_const radeon_ttm_vm_ops __read_only;
42052 static const struct vm_operations_struct *ttm_vm_ops = NULL;
42053
42054 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
42055 @@ -1002,8 +1002,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
42056 }
42057 if (unlikely(ttm_vm_ops == NULL)) {
42058 ttm_vm_ops = vma->vm_ops;
42059 + pax_open_kernel();
42060 radeon_ttm_vm_ops = *ttm_vm_ops;
42061 radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
42062 + pax_close_kernel();
42063 }
42064 vma->vm_ops = &radeon_ttm_vm_ops;
42065 return 0;
42066 diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
42067 index a287e4f..df1d5dd 100644
42068 --- a/drivers/gpu/drm/tegra/dc.c
42069 +++ b/drivers/gpu/drm/tegra/dc.c
42070 @@ -1594,7 +1594,7 @@ static int tegra_dc_debugfs_init(struct tegra_dc *dc, struct drm_minor *minor)
42071 }
42072
42073 for (i = 0; i < ARRAY_SIZE(debugfs_files); i++)
42074 - dc->debugfs_files[i].data = dc;
42075 + *(void **)&dc->debugfs_files[i].data = dc;
42076
42077 err = drm_debugfs_create_files(dc->debugfs_files,
42078 ARRAY_SIZE(debugfs_files),
42079 diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
42080 index ed970f6..4eeea42 100644
42081 --- a/drivers/gpu/drm/tegra/dsi.c
42082 +++ b/drivers/gpu/drm/tegra/dsi.c
42083 @@ -62,7 +62,7 @@ struct tegra_dsi {
42084 struct clk *clk_lp;
42085 struct clk *clk;
42086
42087 - struct drm_info_list *debugfs_files;
42088 + drm_info_list_no_const *debugfs_files;
42089 struct drm_minor *minor;
42090 struct dentry *debugfs;
42091
42092 diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
42093 index 06ab178..b5324e4 100644
42094 --- a/drivers/gpu/drm/tegra/hdmi.c
42095 +++ b/drivers/gpu/drm/tegra/hdmi.c
42096 @@ -64,7 +64,7 @@ struct tegra_hdmi {
42097 bool stereo;
42098 bool dvi;
42099
42100 - struct drm_info_list *debugfs_files;
42101 + drm_info_list_no_const *debugfs_files;
42102 struct drm_minor *minor;
42103 struct dentry *debugfs;
42104 };
42105 diff --git a/drivers/gpu/drm/ttm/ttm_bo_manager.c b/drivers/gpu/drm/ttm/ttm_bo_manager.c
42106 index aa0bd054..aea6a01 100644
42107 --- a/drivers/gpu/drm/ttm/ttm_bo_manager.c
42108 +++ b/drivers/gpu/drm/ttm/ttm_bo_manager.c
42109 @@ -148,10 +148,10 @@ static void ttm_bo_man_debug(struct ttm_mem_type_manager *man,
42110 }
42111
42112 const struct ttm_mem_type_manager_func ttm_bo_manager_func = {
42113 - ttm_bo_man_init,
42114 - ttm_bo_man_takedown,
42115 - ttm_bo_man_get_node,
42116 - ttm_bo_man_put_node,
42117 - ttm_bo_man_debug
42118 + .init = ttm_bo_man_init,
42119 + .takedown = ttm_bo_man_takedown,
42120 + .get_node = ttm_bo_man_get_node,
42121 + .put_node = ttm_bo_man_put_node,
42122 + .debug = ttm_bo_man_debug
42123 };
42124 EXPORT_SYMBOL(ttm_bo_manager_func);
42125 diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
42126 index a1803fb..c53f6b0 100644
42127 --- a/drivers/gpu/drm/ttm/ttm_memory.c
42128 +++ b/drivers/gpu/drm/ttm/ttm_memory.c
42129 @@ -264,7 +264,7 @@ static int ttm_mem_init_kernel_zone(struct ttm_mem_global *glob,
42130 zone->glob = glob;
42131 glob->zone_kernel = zone;
42132 ret = kobject_init_and_add(
42133 - &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, zone->name);
42134 + &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, "%s", zone->name);
42135 if (unlikely(ret != 0)) {
42136 kobject_put(&zone->kobj);
42137 return ret;
42138 @@ -348,7 +348,7 @@ static int ttm_mem_init_dma32_zone(struct ttm_mem_global *glob,
42139 zone->glob = glob;
42140 glob->zone_dma32 = zone;
42141 ret = kobject_init_and_add(
42142 - &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, zone->name);
42143 + &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, "%s", zone->name);
42144 if (unlikely(ret != 0)) {
42145 kobject_put(&zone->kobj);
42146 return ret;
42147 diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
42148 index 025c429..314062f 100644
42149 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
42150 +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
42151 @@ -54,7 +54,7 @@
42152
42153 #define NUM_PAGES_TO_ALLOC (PAGE_SIZE/sizeof(struct page *))
42154 #define SMALL_ALLOCATION 16
42155 -#define FREE_ALL_PAGES (~0U)
42156 +#define FREE_ALL_PAGES (~0UL)
42157 /* times are in msecs */
42158 #define PAGE_FREE_INTERVAL 1000
42159
42160 @@ -299,15 +299,14 @@ static void ttm_pool_update_free_locked(struct ttm_page_pool *pool,
42161 * @free_all: If set to true will free all pages in pool
42162 * @use_static: Safe to use static buffer
42163 **/
42164 -static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
42165 +static unsigned long ttm_page_pool_free(struct ttm_page_pool *pool, unsigned long nr_free,
42166 bool use_static)
42167 {
42168 static struct page *static_buf[NUM_PAGES_TO_ALLOC];
42169 unsigned long irq_flags;
42170 struct page *p;
42171 struct page **pages_to_free;
42172 - unsigned freed_pages = 0,
42173 - npages_to_free = nr_free;
42174 + unsigned long freed_pages = 0, npages_to_free = nr_free;
42175
42176 if (NUM_PAGES_TO_ALLOC < nr_free)
42177 npages_to_free = NUM_PAGES_TO_ALLOC;
42178 @@ -371,7 +370,8 @@ restart:
42179 __list_del(&p->lru, &pool->list);
42180
42181 ttm_pool_update_free_locked(pool, freed_pages);
42182 - nr_free -= freed_pages;
42183 + if (likely(nr_free != FREE_ALL_PAGES))
42184 + nr_free -= freed_pages;
42185 }
42186
42187 spin_unlock_irqrestore(&pool->lock, irq_flags);
42188 @@ -399,7 +399,7 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
42189 unsigned i;
42190 unsigned pool_offset;
42191 struct ttm_page_pool *pool;
42192 - int shrink_pages = sc->nr_to_scan;
42193 + unsigned long shrink_pages = sc->nr_to_scan;
42194 unsigned long freed = 0;
42195
42196 if (!mutex_trylock(&lock))
42197 @@ -407,7 +407,7 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
42198 pool_offset = ++start_pool % NUM_POOLS;
42199 /* select start pool in round robin fashion */
42200 for (i = 0; i < NUM_POOLS; ++i) {
42201 - unsigned nr_free = shrink_pages;
42202 + unsigned long nr_free = shrink_pages;
42203 if (shrink_pages == 0)
42204 break;
42205 pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
42206 @@ -673,7 +673,7 @@ out:
42207 }
42208
42209 /* Put all pages in pages list to correct pool to wait for reuse */
42210 -static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
42211 +static void ttm_put_pages(struct page **pages, unsigned long npages, int flags,
42212 enum ttm_caching_state cstate)
42213 {
42214 unsigned long irq_flags;
42215 @@ -728,7 +728,7 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
42216 struct list_head plist;
42217 struct page *p = NULL;
42218 gfp_t gfp_flags = GFP_USER;
42219 - unsigned count;
42220 + unsigned long count;
42221 int r;
42222
42223 /* set zero flag for page allocation if required */
42224 diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
42225 index 01e1d27..aaa018a 100644
42226 --- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
42227 +++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
42228 @@ -56,7 +56,7 @@
42229
42230 #define NUM_PAGES_TO_ALLOC (PAGE_SIZE/sizeof(struct page *))
42231 #define SMALL_ALLOCATION 4
42232 -#define FREE_ALL_PAGES (~0U)
42233 +#define FREE_ALL_PAGES (~0UL)
42234 /* times are in msecs */
42235 #define IS_UNDEFINED (0)
42236 #define IS_WC (1<<1)
42237 @@ -413,7 +413,7 @@ static void ttm_dma_page_put(struct dma_pool *pool, struct dma_page *d_page)
42238 * @nr_free: If set to true will free all pages in pool
42239 * @use_static: Safe to use static buffer
42240 **/
42241 -static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
42242 +static unsigned long ttm_dma_page_pool_free(struct dma_pool *pool, unsigned long nr_free,
42243 bool use_static)
42244 {
42245 static struct page *static_buf[NUM_PAGES_TO_ALLOC];
42246 @@ -421,8 +421,7 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
42247 struct dma_page *dma_p, *tmp;
42248 struct page **pages_to_free;
42249 struct list_head d_pages;
42250 - unsigned freed_pages = 0,
42251 - npages_to_free = nr_free;
42252 + unsigned long freed_pages = 0, npages_to_free = nr_free;
42253
42254 if (NUM_PAGES_TO_ALLOC < nr_free)
42255 npages_to_free = NUM_PAGES_TO_ALLOC;
42256 @@ -499,7 +498,8 @@ restart:
42257 /* remove range of pages from the pool */
42258 if (freed_pages) {
42259 ttm_pool_update_free_locked(pool, freed_pages);
42260 - nr_free -= freed_pages;
42261 + if (likely(nr_free != FREE_ALL_PAGES))
42262 + nr_free -= freed_pages;
42263 }
42264
42265 spin_unlock_irqrestore(&pool->lock, irq_flags);
42266 @@ -936,7 +936,7 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev)
42267 struct dma_page *d_page, *next;
42268 enum pool_type type;
42269 bool is_cached = false;
42270 - unsigned count = 0, i, npages = 0;
42271 + unsigned long count = 0, i, npages = 0;
42272 unsigned long irq_flags;
42273
42274 type = ttm_to_type(ttm->page_flags, ttm->caching_state);
42275 @@ -1012,7 +1012,7 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
42276 static unsigned start_pool;
42277 unsigned idx = 0;
42278 unsigned pool_offset;
42279 - unsigned shrink_pages = sc->nr_to_scan;
42280 + unsigned long shrink_pages = sc->nr_to_scan;
42281 struct device_pools *p;
42282 unsigned long freed = 0;
42283
42284 @@ -1025,7 +1025,7 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
42285 goto out;
42286 pool_offset = ++start_pool % _manager->npools;
42287 list_for_each_entry(p, &_manager->pools, pools) {
42288 - unsigned nr_free;
42289 + unsigned long nr_free;
42290
42291 if (!p->dev)
42292 continue;
42293 @@ -1039,7 +1039,7 @@ ttm_dma_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
42294 shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, true);
42295 freed += nr_free - shrink_pages;
42296
42297 - pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
42298 + pr_debug("%s: (%s:%d) Asked to shrink %lu, have %lu more to go\n",
42299 p->pool->dev_name, p->pool->name, current->pid,
42300 nr_free, shrink_pages);
42301 }
42302 diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
42303 index 5fc16ce..1bd84ec 100644
42304 --- a/drivers/gpu/drm/udl/udl_fb.c
42305 +++ b/drivers/gpu/drm/udl/udl_fb.c
42306 @@ -367,7 +367,6 @@ static int udl_fb_release(struct fb_info *info, int user)
42307 fb_deferred_io_cleanup(info);
42308 kfree(info->fbdefio);
42309 info->fbdefio = NULL;
42310 - info->fbops->fb_mmap = udl_fb_mmap;
42311 }
42312
42313 pr_warn("released /dev/fb%d user=%d count=%d\n",
42314 diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
42315 index ef8c500..01030c8 100644
42316 --- a/drivers/gpu/drm/via/via_drv.h
42317 +++ b/drivers/gpu/drm/via/via_drv.h
42318 @@ -53,7 +53,7 @@ typedef struct drm_via_ring_buffer {
42319 typedef uint32_t maskarray_t[5];
42320
42321 typedef struct drm_via_irq {
42322 - atomic_t irq_received;
42323 + atomic_unchecked_t irq_received;
42324 uint32_t pending_mask;
42325 uint32_t enable_mask;
42326 wait_queue_head_t irq_queue;
42327 @@ -77,7 +77,7 @@ typedef struct drm_via_private {
42328 struct timeval last_vblank;
42329 int last_vblank_valid;
42330 unsigned usec_per_vblank;
42331 - atomic_t vbl_received;
42332 + atomic_unchecked_t vbl_received;
42333 drm_via_state_t hc_state;
42334 char pci_buf[VIA_PCI_BUF_SIZE];
42335 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
42336 diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
42337 index 1319433..a993b0c 100644
42338 --- a/drivers/gpu/drm/via/via_irq.c
42339 +++ b/drivers/gpu/drm/via/via_irq.c
42340 @@ -101,7 +101,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
42341 if (crtc != 0)
42342 return 0;
42343
42344 - return atomic_read(&dev_priv->vbl_received);
42345 + return atomic_read_unchecked(&dev_priv->vbl_received);
42346 }
42347
42348 irqreturn_t via_driver_irq_handler(int irq, void *arg)
42349 @@ -116,8 +116,8 @@ irqreturn_t via_driver_irq_handler(int irq, void *arg)
42350
42351 status = VIA_READ(VIA_REG_INTERRUPT);
42352 if (status & VIA_IRQ_VBLANK_PENDING) {
42353 - atomic_inc(&dev_priv->vbl_received);
42354 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
42355 + atomic_inc_unchecked(&dev_priv->vbl_received);
42356 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
42357 do_gettimeofday(&cur_vblank);
42358 if (dev_priv->last_vblank_valid) {
42359 dev_priv->usec_per_vblank =
42360 @@ -127,7 +127,7 @@ irqreturn_t via_driver_irq_handler(int irq, void *arg)
42361 dev_priv->last_vblank = cur_vblank;
42362 dev_priv->last_vblank_valid = 1;
42363 }
42364 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
42365 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
42366 DRM_DEBUG("US per vblank is: %u\n",
42367 dev_priv->usec_per_vblank);
42368 }
42369 @@ -137,7 +137,7 @@ irqreturn_t via_driver_irq_handler(int irq, void *arg)
42370
42371 for (i = 0; i < dev_priv->num_irqs; ++i) {
42372 if (status & cur_irq->pending_mask) {
42373 - atomic_inc(&cur_irq->irq_received);
42374 + atomic_inc_unchecked(&cur_irq->irq_received);
42375 wake_up(&cur_irq->irq_queue);
42376 handled = 1;
42377 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
42378 @@ -242,11 +242,11 @@ via_driver_irq_wait(struct drm_device *dev, unsigned int irq, int force_sequence
42379 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * HZ,
42380 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
42381 masks[irq][4]));
42382 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
42383 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
42384 } else {
42385 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * HZ,
42386 (((cur_irq_sequence =
42387 - atomic_read(&cur_irq->irq_received)) -
42388 + atomic_read_unchecked(&cur_irq->irq_received)) -
42389 *sequence) <= (1 << 23)));
42390 }
42391 *sequence = cur_irq_sequence;
42392 @@ -284,7 +284,7 @@ void via_driver_irq_preinstall(struct drm_device *dev)
42393 }
42394
42395 for (i = 0; i < dev_priv->num_irqs; ++i) {
42396 - atomic_set(&cur_irq->irq_received, 0);
42397 + atomic_set_unchecked(&cur_irq->irq_received, 0);
42398 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
42399 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
42400 init_waitqueue_head(&cur_irq->irq_queue);
42401 @@ -366,7 +366,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
42402 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
42403 case VIA_IRQ_RELATIVE:
42404 irqwait->request.sequence +=
42405 - atomic_read(&cur_irq->irq_received);
42406 + atomic_read_unchecked(&cur_irq->irq_received);
42407 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
42408 case VIA_IRQ_ABSOLUTE:
42409 break;
42410 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
42411 index d26a6da..5fa41ed 100644
42412 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
42413 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
42414 @@ -447,7 +447,7 @@ struct vmw_private {
42415 * Fencing and IRQs.
42416 */
42417
42418 - atomic_t marker_seq;
42419 + atomic_unchecked_t marker_seq;
42420 wait_queue_head_t fence_queue;
42421 wait_queue_head_t fifo_queue;
42422 spinlock_t waiter_lock;
42423 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
42424 index 39f2b03..d1b0a64 100644
42425 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
42426 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
42427 @@ -152,7 +152,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
42428 (unsigned int) min,
42429 (unsigned int) fifo->capabilities);
42430
42431 - atomic_set(&dev_priv->marker_seq, dev_priv->last_read_seqno);
42432 + atomic_set_unchecked(&dev_priv->marker_seq, dev_priv->last_read_seqno);
42433 iowrite32(dev_priv->last_read_seqno, fifo_mem + SVGA_FIFO_FENCE);
42434 vmw_marker_queue_init(&fifo->marker_queue);
42435 return vmw_fifo_send_fence(dev_priv, &dummy);
42436 @@ -372,7 +372,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
42437 if (reserveable)
42438 iowrite32(bytes, fifo_mem +
42439 SVGA_FIFO_RESERVED);
42440 - return fifo_mem + (next_cmd >> 2);
42441 + return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
42442 } else {
42443 need_bounce = true;
42444 }
42445 @@ -492,7 +492,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
42446
42447 fm = vmw_fifo_reserve(dev_priv, bytes);
42448 if (unlikely(fm == NULL)) {
42449 - *seqno = atomic_read(&dev_priv->marker_seq);
42450 + *seqno = atomic_read_unchecked(&dev_priv->marker_seq);
42451 ret = -ENOMEM;
42452 (void)vmw_fallback_wait(dev_priv, false, true, *seqno,
42453 false, 3*HZ);
42454 @@ -500,7 +500,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
42455 }
42456
42457 do {
42458 - *seqno = atomic_add_return(1, &dev_priv->marker_seq);
42459 + *seqno = atomic_add_return_unchecked(1, &dev_priv->marker_seq);
42460 } while (*seqno == 0);
42461
42462 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
42463 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
42464 index 170b61b..fec7348 100644
42465 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
42466 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
42467 @@ -164,9 +164,9 @@ static void vmw_gmrid_man_debug(struct ttm_mem_type_manager *man,
42468 }
42469
42470 const struct ttm_mem_type_manager_func vmw_gmrid_manager_func = {
42471 - vmw_gmrid_man_init,
42472 - vmw_gmrid_man_takedown,
42473 - vmw_gmrid_man_get_node,
42474 - vmw_gmrid_man_put_node,
42475 - vmw_gmrid_man_debug
42476 + .init = vmw_gmrid_man_init,
42477 + .takedown = vmw_gmrid_man_takedown,
42478 + .get_node = vmw_gmrid_man_get_node,
42479 + .put_node = vmw_gmrid_man_put_node,
42480 + .debug = vmw_gmrid_man_debug
42481 };
42482 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
42483 index 69c8ce2..cacb0ab 100644
42484 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
42485 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
42486 @@ -235,7 +235,7 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
42487 int ret;
42488
42489 num_clips = arg->num_clips;
42490 - clips_ptr = (struct drm_vmw_rect *)(unsigned long)arg->clips_ptr;
42491 + clips_ptr = (struct drm_vmw_rect __user *)(unsigned long)arg->clips_ptr;
42492
42493 if (unlikely(num_clips == 0))
42494 return 0;
42495 @@ -318,7 +318,7 @@ int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
42496 int ret;
42497
42498 num_clips = arg->num_clips;
42499 - clips_ptr = (struct drm_vmw_rect *)(unsigned long)arg->clips_ptr;
42500 + clips_ptr = (struct drm_vmw_rect __user *)(unsigned long)arg->clips_ptr;
42501
42502 if (unlikely(num_clips == 0))
42503 return 0;
42504 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
42505 index 9fe9827..0aa2fc0 100644
42506 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
42507 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
42508 @@ -102,7 +102,7 @@ bool vmw_seqno_passed(struct vmw_private *dev_priv,
42509 * emitted. Then the fence is stale and signaled.
42510 */
42511
42512 - ret = ((atomic_read(&dev_priv->marker_seq) - seqno)
42513 + ret = ((atomic_read_unchecked(&dev_priv->marker_seq) - seqno)
42514 > VMW_FENCE_WRAP);
42515
42516 return ret;
42517 @@ -133,7 +133,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
42518
42519 if (fifo_idle)
42520 down_read(&fifo_state->rwsem);
42521 - signal_seq = atomic_read(&dev_priv->marker_seq);
42522 + signal_seq = atomic_read_unchecked(&dev_priv->marker_seq);
42523 ret = 0;
42524
42525 for (;;) {
42526 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c b/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
42527 index efd1ffd..0ae13ca 100644
42528 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
42529 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
42530 @@ -135,7 +135,7 @@ int vmw_wait_lag(struct vmw_private *dev_priv,
42531 while (!vmw_lag_lt(queue, us)) {
42532 spin_lock(&queue->lock);
42533 if (list_empty(&queue->head))
42534 - seqno = atomic_read(&dev_priv->marker_seq);
42535 + seqno = atomic_read_unchecked(&dev_priv->marker_seq);
42536 else {
42537 marker = list_first_entry(&queue->head,
42538 struct vmw_marker, head);
42539 diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
42540 index 37ac7b5..d52a5c9 100644
42541 --- a/drivers/gpu/vga/vga_switcheroo.c
42542 +++ b/drivers/gpu/vga/vga_switcheroo.c
42543 @@ -644,7 +644,7 @@ static int vga_switcheroo_runtime_resume(struct device *dev)
42544
42545 /* this version is for the case where the power switch is separate
42546 to the device being powered down. */
42547 -int vga_switcheroo_init_domain_pm_ops(struct device *dev, struct dev_pm_domain *domain)
42548 +int vga_switcheroo_init_domain_pm_ops(struct device *dev, dev_pm_domain_no_const *domain)
42549 {
42550 /* copy over all the bus versions */
42551 if (dev->bus && dev->bus->pm) {
42552 @@ -695,7 +695,7 @@ static int vga_switcheroo_runtime_resume_hdmi_audio(struct device *dev)
42553 return ret;
42554 }
42555
42556 -int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, struct dev_pm_domain *domain)
42557 +int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, dev_pm_domain_no_const *domain)
42558 {
42559 /* copy over all the bus versions */
42560 if (dev->bus && dev->bus->pm) {
42561 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
42562 index 722a925..594c312 100644
42563 --- a/drivers/hid/hid-core.c
42564 +++ b/drivers/hid/hid-core.c
42565 @@ -2552,7 +2552,7 @@ EXPORT_SYMBOL_GPL(hid_ignore);
42566
42567 int hid_add_device(struct hid_device *hdev)
42568 {
42569 - static atomic_t id = ATOMIC_INIT(0);
42570 + static atomic_unchecked_t id = ATOMIC_INIT(0);
42571 int ret;
42572
42573 if (WARN_ON(hdev->status & HID_STAT_ADDED))
42574 @@ -2595,7 +2595,7 @@ int hid_add_device(struct hid_device *hdev)
42575 /* XXX hack, any other cleaner solution after the driver core
42576 * is converted to allow more than 20 bytes as the device name? */
42577 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
42578 - hdev->vendor, hdev->product, atomic_inc_return(&id));
42579 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
42580
42581 hid_debug_register(hdev, dev_name(&hdev->dev));
42582 ret = device_add(&hdev->dev);
42583 diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
42584 index 5614fee..8301fbf 100644
42585 --- a/drivers/hid/hid-sensor-custom.c
42586 +++ b/drivers/hid/hid-sensor-custom.c
42587 @@ -34,7 +34,7 @@ struct hid_sensor_custom_field {
42588 int report_id;
42589 char group_name[HID_CUSTOM_NAME_LENGTH];
42590 struct hid_sensor_hub_attribute_info attribute;
42591 - struct device_attribute sd_attrs[HID_CUSTOM_MAX_CORE_ATTRS];
42592 + device_attribute_no_const sd_attrs[HID_CUSTOM_MAX_CORE_ATTRS];
42593 char attr_name[HID_CUSTOM_TOTAL_ATTRS][HID_CUSTOM_NAME_LENGTH];
42594 struct attribute *attrs[HID_CUSTOM_TOTAL_ATTRS];
42595 struct attribute_group hid_custom_attribute_group;
42596 @@ -590,7 +590,7 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom
42597 j = 0;
42598 while (j < HID_CUSTOM_TOTAL_ATTRS &&
42599 hid_custom_attrs[j].name) {
42600 - struct device_attribute *device_attr;
42601 + device_attribute_no_const *device_attr;
42602
42603 device_attr = &sensor_inst->fields[i].sd_attrs[j];
42604
42605 diff --git a/drivers/hid/hid-wiimote-debug.c b/drivers/hid/hid-wiimote-debug.c
42606 index c13fb5b..55a3802 100644
42607 --- a/drivers/hid/hid-wiimote-debug.c
42608 +++ b/drivers/hid/hid-wiimote-debug.c
42609 @@ -66,7 +66,7 @@ static ssize_t wiidebug_eeprom_read(struct file *f, char __user *u, size_t s,
42610 else if (size == 0)
42611 return -EIO;
42612
42613 - if (copy_to_user(u, buf, size))
42614 + if (size > sizeof(buf) || copy_to_user(u, buf, size))
42615 return -EFAULT;
42616
42617 *off += size;
42618 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
42619 index 54da66d..aa3a3d7 100644
42620 --- a/drivers/hv/channel.c
42621 +++ b/drivers/hv/channel.c
42622 @@ -373,7 +373,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
42623 int ret = 0;
42624
42625 next_gpadl_handle =
42626 - (atomic_inc_return(&vmbus_connection.next_gpadl_handle) - 1);
42627 + (atomic_inc_return_unchecked(&vmbus_connection.next_gpadl_handle) - 1);
42628
42629 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
42630 if (ret)
42631 diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
42632 index d3943bc..3de28a9 100644
42633 --- a/drivers/hv/hv.c
42634 +++ b/drivers/hv/hv.c
42635 @@ -118,7 +118,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
42636 u64 output_address = (output) ? virt_to_phys(output) : 0;
42637 u32 output_address_hi = output_address >> 32;
42638 u32 output_address_lo = output_address & 0xFFFFFFFF;
42639 - void *hypercall_page = hv_context.hypercall_page;
42640 + void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
42641
42642 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
42643 "=a"(hv_status_lo) : "d" (control_hi),
42644 @@ -164,7 +164,7 @@ int hv_init(void)
42645 /* See if the hypercall page is already set */
42646 rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
42647
42648 - virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
42649 + virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX);
42650
42651 if (!virtaddr)
42652 goto cleanup;
42653 diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
42654 index cb5b7dc..6052f22 100644
42655 --- a/drivers/hv/hv_balloon.c
42656 +++ b/drivers/hv/hv_balloon.c
42657 @@ -469,7 +469,7 @@ MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add");
42658
42659 module_param(pressure_report_delay, uint, (S_IRUGO | S_IWUSR));
42660 MODULE_PARM_DESC(pressure_report_delay, "Delay in secs in reporting pressure");
42661 -static atomic_t trans_id = ATOMIC_INIT(0);
42662 +static atomic_unchecked_t trans_id = ATOMIC_INIT(0);
42663
42664 static int dm_ring_size = (5 * PAGE_SIZE);
42665
42666 @@ -941,7 +941,7 @@ static void hot_add_req(struct work_struct *dummy)
42667 pr_info("Memory hot add failed\n");
42668
42669 dm->state = DM_INITIALIZED;
42670 - resp.hdr.trans_id = atomic_inc_return(&trans_id);
42671 + resp.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42672 vmbus_sendpacket(dm->dev->channel, &resp,
42673 sizeof(struct dm_hot_add_response),
42674 (unsigned long)NULL,
42675 @@ -1022,7 +1022,7 @@ static void post_status(struct hv_dynmem_device *dm)
42676 memset(&status, 0, sizeof(struct dm_status));
42677 status.hdr.type = DM_STATUS_REPORT;
42678 status.hdr.size = sizeof(struct dm_status);
42679 - status.hdr.trans_id = atomic_inc_return(&trans_id);
42680 + status.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42681
42682 /*
42683 * The host expects the guest to report free and committed memory.
42684 @@ -1046,7 +1046,7 @@ static void post_status(struct hv_dynmem_device *dm)
42685 * send the status. This can happen if we were interrupted
42686 * after we picked our transaction ID.
42687 */
42688 - if (status.hdr.trans_id != atomic_read(&trans_id))
42689 + if (status.hdr.trans_id != atomic_read_unchecked(&trans_id))
42690 return;
42691
42692 /*
42693 @@ -1191,7 +1191,7 @@ static void balloon_up(struct work_struct *dummy)
42694 */
42695
42696 do {
42697 - bl_resp->hdr.trans_id = atomic_inc_return(&trans_id);
42698 + bl_resp->hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42699 ret = vmbus_sendpacket(dm_device.dev->channel,
42700 bl_resp,
42701 bl_resp->hdr.size,
42702 @@ -1237,7 +1237,7 @@ static void balloon_down(struct hv_dynmem_device *dm,
42703
42704 memset(&resp, 0, sizeof(struct dm_unballoon_response));
42705 resp.hdr.type = DM_UNBALLOON_RESPONSE;
42706 - resp.hdr.trans_id = atomic_inc_return(&trans_id);
42707 + resp.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42708 resp.hdr.size = sizeof(struct dm_unballoon_response);
42709
42710 vmbus_sendpacket(dm_device.dev->channel, &resp,
42711 @@ -1298,7 +1298,7 @@ static void version_resp(struct hv_dynmem_device *dm,
42712 memset(&version_req, 0, sizeof(struct dm_version_request));
42713 version_req.hdr.type = DM_VERSION_REQUEST;
42714 version_req.hdr.size = sizeof(struct dm_version_request);
42715 - version_req.hdr.trans_id = atomic_inc_return(&trans_id);
42716 + version_req.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42717 version_req.version.version = DYNMEM_PROTOCOL_VERSION_WIN7;
42718 version_req.is_last_attempt = 1;
42719
42720 @@ -1471,7 +1471,7 @@ static int balloon_probe(struct hv_device *dev,
42721 memset(&version_req, 0, sizeof(struct dm_version_request));
42722 version_req.hdr.type = DM_VERSION_REQUEST;
42723 version_req.hdr.size = sizeof(struct dm_version_request);
42724 - version_req.hdr.trans_id = atomic_inc_return(&trans_id);
42725 + version_req.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42726 version_req.version.version = DYNMEM_PROTOCOL_VERSION_WIN8;
42727 version_req.is_last_attempt = 0;
42728
42729 @@ -1502,7 +1502,7 @@ static int balloon_probe(struct hv_device *dev,
42730 memset(&cap_msg, 0, sizeof(struct dm_capabilities));
42731 cap_msg.hdr.type = DM_CAPABILITIES_REPORT;
42732 cap_msg.hdr.size = sizeof(struct dm_capabilities);
42733 - cap_msg.hdr.trans_id = atomic_inc_return(&trans_id);
42734 + cap_msg.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42735
42736 cap_msg.caps.cap_bits.balloon = 1;
42737 cap_msg.caps.cap_bits.hot_add = 1;
42738 diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
42739 index 887287a..238a626 100644
42740 --- a/drivers/hv/hyperv_vmbus.h
42741 +++ b/drivers/hv/hyperv_vmbus.h
42742 @@ -645,7 +645,7 @@ enum vmbus_connect_state {
42743 struct vmbus_connection {
42744 enum vmbus_connect_state conn_state;
42745
42746 - atomic_t next_gpadl_handle;
42747 + atomic_unchecked_t next_gpadl_handle;
42748
42749 /*
42750 * Represents channel interrupts. Each bit position represents a
42751 diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
42752 index 579bdf9..0dac21d5 100644
42753 --- a/drivers/hwmon/acpi_power_meter.c
42754 +++ b/drivers/hwmon/acpi_power_meter.c
42755 @@ -116,7 +116,7 @@ struct sensor_template {
42756 struct device_attribute *devattr,
42757 const char *buf, size_t count);
42758 int index;
42759 -};
42760 +} __do_const;
42761
42762 /* Averaging interval */
42763 static int update_avg_interval(struct acpi_power_meter_resource *resource)
42764 @@ -631,7 +631,7 @@ static int register_attrs(struct acpi_power_meter_resource *resource,
42765 struct sensor_template *attrs)
42766 {
42767 struct device *dev = &resource->acpi_dev->dev;
42768 - struct sensor_device_attribute *sensors =
42769 + sensor_device_attribute_no_const *sensors =
42770 &resource->sensors[resource->num_sensors];
42771 int res = 0;
42772
42773 @@ -973,7 +973,7 @@ static int __init enable_cap_knobs(const struct dmi_system_id *d)
42774 return 0;
42775 }
42776
42777 -static struct dmi_system_id __initdata pm_dmi_table[] = {
42778 +static const struct dmi_system_id __initconst pm_dmi_table[] = {
42779 {
42780 enable_cap_knobs, "IBM Active Energy Manager",
42781 {
42782 diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
42783 index 0af63da..05a183a 100644
42784 --- a/drivers/hwmon/applesmc.c
42785 +++ b/drivers/hwmon/applesmc.c
42786 @@ -1105,7 +1105,7 @@ static int applesmc_create_nodes(struct applesmc_node_group *groups, int num)
42787 {
42788 struct applesmc_node_group *grp;
42789 struct applesmc_dev_attr *node;
42790 - struct attribute *attr;
42791 + attribute_no_const *attr;
42792 int ret, i;
42793
42794 for (grp = groups; grp->format; grp++) {
42795 diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
42796 index cccef87..06ce8ec 100644
42797 --- a/drivers/hwmon/asus_atk0110.c
42798 +++ b/drivers/hwmon/asus_atk0110.c
42799 @@ -147,10 +147,10 @@ MODULE_DEVICE_TABLE(acpi, atk_ids);
42800 struct atk_sensor_data {
42801 struct list_head list;
42802 struct atk_data *data;
42803 - struct device_attribute label_attr;
42804 - struct device_attribute input_attr;
42805 - struct device_attribute limit1_attr;
42806 - struct device_attribute limit2_attr;
42807 + device_attribute_no_const label_attr;
42808 + device_attribute_no_const input_attr;
42809 + device_attribute_no_const limit1_attr;
42810 + device_attribute_no_const limit2_attr;
42811 char label_attr_name[ATTR_NAME_SIZE];
42812 char input_attr_name[ATTR_NAME_SIZE];
42813 char limit1_attr_name[ATTR_NAME_SIZE];
42814 @@ -270,7 +270,7 @@ static ssize_t atk_name_show(struct device *dev,
42815 static struct device_attribute atk_name_attr =
42816 __ATTR(name, 0444, atk_name_show, NULL);
42817
42818 -static void atk_init_attribute(struct device_attribute *attr, char *name,
42819 +static void atk_init_attribute(device_attribute_no_const *attr, char *name,
42820 sysfs_show_func show)
42821 {
42822 sysfs_attr_init(&attr->attr);
42823 diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
42824 index ed303ba..e24bd26f 100644
42825 --- a/drivers/hwmon/coretemp.c
42826 +++ b/drivers/hwmon/coretemp.c
42827 @@ -782,7 +782,7 @@ static int coretemp_cpu_callback(struct notifier_block *nfb,
42828 return NOTIFY_OK;
42829 }
42830
42831 -static struct notifier_block coretemp_cpu_notifier __refdata = {
42832 +static struct notifier_block coretemp_cpu_notifier = {
42833 .notifier_call = coretemp_cpu_callback,
42834 };
42835
42836 diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
42837 index 7a8a6fb..015c1fd 100644
42838 --- a/drivers/hwmon/ibmaem.c
42839 +++ b/drivers/hwmon/ibmaem.c
42840 @@ -924,7 +924,7 @@ static int aem_register_sensors(struct aem_data *data,
42841 struct aem_rw_sensor_template *rw)
42842 {
42843 struct device *dev = &data->pdev->dev;
42844 - struct sensor_device_attribute *sensors = data->sensors;
42845 + sensor_device_attribute_no_const *sensors = data->sensors;
42846 int err;
42847
42848 /* Set up read-only sensors */
42849 diff --git a/drivers/hwmon/iio_hwmon.c b/drivers/hwmon/iio_hwmon.c
42850 index 17ae2eb..21b71dd 100644
42851 --- a/drivers/hwmon/iio_hwmon.c
42852 +++ b/drivers/hwmon/iio_hwmon.c
42853 @@ -61,7 +61,7 @@ static int iio_hwmon_probe(struct platform_device *pdev)
42854 {
42855 struct device *dev = &pdev->dev;
42856 struct iio_hwmon_state *st;
42857 - struct sensor_device_attribute *a;
42858 + sensor_device_attribute_no_const *a;
42859 int ret, i;
42860 int in_i = 1, temp_i = 1, curr_i = 1, humidity_i = 1;
42861 enum iio_chan_type type;
42862 diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
42863 index 37f0170..414ec2c 100644
42864 --- a/drivers/hwmon/nct6683.c
42865 +++ b/drivers/hwmon/nct6683.c
42866 @@ -397,11 +397,11 @@ static struct attribute_group *
42867 nct6683_create_attr_group(struct device *dev, struct sensor_template_group *tg,
42868 int repeat)
42869 {
42870 - struct sensor_device_attribute_2 *a2;
42871 - struct sensor_device_attribute *a;
42872 + sensor_device_attribute_2_no_const *a2;
42873 + sensor_device_attribute_no_const *a;
42874 struct sensor_device_template **t;
42875 struct sensor_device_attr_u *su;
42876 - struct attribute_group *group;
42877 + attribute_group_no_const *group;
42878 struct attribute **attrs;
42879 int i, j, count;
42880
42881 diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
42882 index bd1c99d..2fa55ad 100644
42883 --- a/drivers/hwmon/nct6775.c
42884 +++ b/drivers/hwmon/nct6775.c
42885 @@ -953,10 +953,10 @@ static struct attribute_group *
42886 nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg,
42887 int repeat)
42888 {
42889 - struct attribute_group *group;
42890 + attribute_group_no_const *group;
42891 struct sensor_device_attr_u *su;
42892 - struct sensor_device_attribute *a;
42893 - struct sensor_device_attribute_2 *a2;
42894 + sensor_device_attribute_no_const *a;
42895 + sensor_device_attribute_2_no_const *a2;
42896 struct attribute **attrs;
42897 struct sensor_device_template **t;
42898 int i, count;
42899 diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
42900 index f2e47c7..45d7941 100644
42901 --- a/drivers/hwmon/pmbus/pmbus_core.c
42902 +++ b/drivers/hwmon/pmbus/pmbus_core.c
42903 @@ -816,7 +816,7 @@ static int pmbus_add_attribute(struct pmbus_data *data, struct attribute *attr)
42904 return 0;
42905 }
42906
42907 -static void pmbus_dev_attr_init(struct device_attribute *dev_attr,
42908 +static void pmbus_dev_attr_init(device_attribute_no_const *dev_attr,
42909 const char *name,
42910 umode_t mode,
42911 ssize_t (*show)(struct device *dev,
42912 @@ -833,7 +833,7 @@ static void pmbus_dev_attr_init(struct device_attribute *dev_attr,
42913 dev_attr->store = store;
42914 }
42915
42916 -static void pmbus_attr_init(struct sensor_device_attribute *a,
42917 +static void pmbus_attr_init(sensor_device_attribute_no_const *a,
42918 const char *name,
42919 umode_t mode,
42920 ssize_t (*show)(struct device *dev,
42921 @@ -855,7 +855,7 @@ static int pmbus_add_boolean(struct pmbus_data *data,
42922 u16 reg, u8 mask)
42923 {
42924 struct pmbus_boolean *boolean;
42925 - struct sensor_device_attribute *a;
42926 + sensor_device_attribute_no_const *a;
42927
42928 boolean = devm_kzalloc(data->dev, sizeof(*boolean), GFP_KERNEL);
42929 if (!boolean)
42930 @@ -880,7 +880,7 @@ static struct pmbus_sensor *pmbus_add_sensor(struct pmbus_data *data,
42931 bool update, bool readonly)
42932 {
42933 struct pmbus_sensor *sensor;
42934 - struct device_attribute *a;
42935 + device_attribute_no_const *a;
42936
42937 sensor = devm_kzalloc(data->dev, sizeof(*sensor), GFP_KERNEL);
42938 if (!sensor)
42939 @@ -911,7 +911,7 @@ static int pmbus_add_label(struct pmbus_data *data,
42940 const char *lstring, int index)
42941 {
42942 struct pmbus_label *label;
42943 - struct device_attribute *a;
42944 + device_attribute_no_const *a;
42945
42946 label = devm_kzalloc(data->dev, sizeof(*label), GFP_KERNEL);
42947 if (!label)
42948 diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
42949 index d4f0935..7420593 100644
42950 --- a/drivers/hwmon/sht15.c
42951 +++ b/drivers/hwmon/sht15.c
42952 @@ -169,7 +169,7 @@ struct sht15_data {
42953 int supply_uv;
42954 bool supply_uv_valid;
42955 struct work_struct update_supply_work;
42956 - atomic_t interrupt_handled;
42957 + atomic_unchecked_t interrupt_handled;
42958 };
42959
42960 /**
42961 @@ -542,13 +542,13 @@ static int sht15_measurement(struct sht15_data *data,
42962 ret = gpio_direction_input(data->pdata->gpio_data);
42963 if (ret)
42964 return ret;
42965 - atomic_set(&data->interrupt_handled, 0);
42966 + atomic_set_unchecked(&data->interrupt_handled, 0);
42967
42968 enable_irq(gpio_to_irq(data->pdata->gpio_data));
42969 if (gpio_get_value(data->pdata->gpio_data) == 0) {
42970 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
42971 /* Only relevant if the interrupt hasn't occurred. */
42972 - if (!atomic_read(&data->interrupt_handled))
42973 + if (!atomic_read_unchecked(&data->interrupt_handled))
42974 schedule_work(&data->read_work);
42975 }
42976 ret = wait_event_timeout(data->wait_queue,
42977 @@ -820,7 +820,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
42978
42979 /* First disable the interrupt */
42980 disable_irq_nosync(irq);
42981 - atomic_inc(&data->interrupt_handled);
42982 + atomic_inc_unchecked(&data->interrupt_handled);
42983 /* Then schedule a reading work struct */
42984 if (data->state != SHT15_READING_NOTHING)
42985 schedule_work(&data->read_work);
42986 @@ -842,11 +842,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
42987 * If not, then start the interrupt again - care here as could
42988 * have gone low in meantime so verify it hasn't!
42989 */
42990 - atomic_set(&data->interrupt_handled, 0);
42991 + atomic_set_unchecked(&data->interrupt_handled, 0);
42992 enable_irq(gpio_to_irq(data->pdata->gpio_data));
42993 /* If still not occurred or another handler was scheduled */
42994 if (gpio_get_value(data->pdata->gpio_data)
42995 - || atomic_read(&data->interrupt_handled))
42996 + || atomic_read_unchecked(&data->interrupt_handled))
42997 return;
42998 }
42999
43000 diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c
43001 index ac91c07..8e69663 100644
43002 --- a/drivers/hwmon/via-cputemp.c
43003 +++ b/drivers/hwmon/via-cputemp.c
43004 @@ -295,7 +295,7 @@ static int via_cputemp_cpu_callback(struct notifier_block *nfb,
43005 return NOTIFY_OK;
43006 }
43007
43008 -static struct notifier_block via_cputemp_cpu_notifier __refdata = {
43009 +static struct notifier_block via_cputemp_cpu_notifier = {
43010 .notifier_call = via_cputemp_cpu_callback,
43011 };
43012
43013 diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
43014 index 65e3240..e6c511d 100644
43015 --- a/drivers/i2c/busses/i2c-amd756-s4882.c
43016 +++ b/drivers/i2c/busses/i2c-amd756-s4882.c
43017 @@ -39,7 +39,7 @@
43018 extern struct i2c_adapter amd756_smbus;
43019
43020 static struct i2c_adapter *s4882_adapter;
43021 -static struct i2c_algorithm *s4882_algo;
43022 +static i2c_algorithm_no_const *s4882_algo;
43023
43024 /* Wrapper access functions for multiplexed SMBus */
43025 static DEFINE_MUTEX(amd756_lock);
43026 diff --git a/drivers/i2c/busses/i2c-diolan-u2c.c b/drivers/i2c/busses/i2c-diolan-u2c.c
43027 index b19a310..d6eece0 100644
43028 --- a/drivers/i2c/busses/i2c-diolan-u2c.c
43029 +++ b/drivers/i2c/busses/i2c-diolan-u2c.c
43030 @@ -98,7 +98,7 @@ MODULE_PARM_DESC(frequency, "I2C clock frequency in hertz");
43031 /* usb layer */
43032
43033 /* Send command to device, and get response. */
43034 -static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
43035 +static int __intentional_overflow(-1) diolan_usb_transfer(struct i2c_diolan_u2c *dev)
43036 {
43037 int ret = 0;
43038 int actual;
43039 diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
43040 index 88eda09..cf40434 100644
43041 --- a/drivers/i2c/busses/i2c-nforce2-s4985.c
43042 +++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
43043 @@ -37,7 +37,7 @@
43044 extern struct i2c_adapter *nforce2_smbus;
43045
43046 static struct i2c_adapter *s4985_adapter;
43047 -static struct i2c_algorithm *s4985_algo;
43048 +static i2c_algorithm_no_const *s4985_algo;
43049
43050 /* Wrapper access functions for multiplexed SMBus */
43051 static DEFINE_MUTEX(nforce2_lock);
43052 diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
43053 index 71c7a39..71dd3e0 100644
43054 --- a/drivers/i2c/i2c-dev.c
43055 +++ b/drivers/i2c/i2c-dev.c
43056 @@ -272,7 +272,7 @@ static noinline int i2cdev_ioctl_rdrw(struct i2c_client *client,
43057 break;
43058 }
43059
43060 - data_ptrs[i] = (u8 __user *)rdwr_pa[i].buf;
43061 + data_ptrs[i] = (u8 __force_user *)rdwr_pa[i].buf;
43062 rdwr_pa[i].buf = memdup_user(data_ptrs[i], rdwr_pa[i].len);
43063 if (IS_ERR(rdwr_pa[i].buf)) {
43064 res = PTR_ERR(rdwr_pa[i].buf);
43065 diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
43066 index 0b510ba..4fbb5085 100644
43067 --- a/drivers/ide/ide-cd.c
43068 +++ b/drivers/ide/ide-cd.c
43069 @@ -768,7 +768,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
43070 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
43071 if ((unsigned long)buf & alignment
43072 || blk_rq_bytes(rq) & q->dma_pad_mask
43073 - || object_is_on_stack(buf))
43074 + || object_starts_on_stack(buf))
43075 drive->dma = 0;
43076 }
43077 }
43078 diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
43079 index 4df97f6..c751151 100644
43080 --- a/drivers/iio/industrialio-core.c
43081 +++ b/drivers/iio/industrialio-core.c
43082 @@ -570,7 +570,7 @@ static ssize_t iio_write_channel_info(struct device *dev,
43083 }
43084
43085 static
43086 -int __iio_device_attr_init(struct device_attribute *dev_attr,
43087 +int __iio_device_attr_init(device_attribute_no_const *dev_attr,
43088 const char *postfix,
43089 struct iio_chan_spec const *chan,
43090 ssize_t (*readfunc)(struct device *dev,
43091 diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
43092 index 0271608..81998c5 100644
43093 --- a/drivers/infiniband/core/cm.c
43094 +++ b/drivers/infiniband/core/cm.c
43095 @@ -115,7 +115,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
43096
43097 struct cm_counter_group {
43098 struct kobject obj;
43099 - atomic_long_t counter[CM_ATTR_COUNT];
43100 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
43101 };
43102
43103 struct cm_counter_attribute {
43104 @@ -1397,7 +1397,7 @@ static void cm_dup_req_handler(struct cm_work *work,
43105 struct ib_mad_send_buf *msg = NULL;
43106 int ret;
43107
43108 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43109 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43110 counter[CM_REQ_COUNTER]);
43111
43112 /* Quick state check to discard duplicate REQs. */
43113 @@ -1784,7 +1784,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
43114 if (!cm_id_priv)
43115 return;
43116
43117 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43118 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43119 counter[CM_REP_COUNTER]);
43120 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
43121 if (ret)
43122 @@ -1951,7 +1951,7 @@ static int cm_rtu_handler(struct cm_work *work)
43123 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
43124 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
43125 spin_unlock_irq(&cm_id_priv->lock);
43126 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43127 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43128 counter[CM_RTU_COUNTER]);
43129 goto out;
43130 }
43131 @@ -2134,7 +2134,7 @@ static int cm_dreq_handler(struct cm_work *work)
43132 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
43133 dreq_msg->local_comm_id);
43134 if (!cm_id_priv) {
43135 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43136 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43137 counter[CM_DREQ_COUNTER]);
43138 cm_issue_drep(work->port, work->mad_recv_wc);
43139 return -EINVAL;
43140 @@ -2159,7 +2159,7 @@ static int cm_dreq_handler(struct cm_work *work)
43141 case IB_CM_MRA_REP_RCVD:
43142 break;
43143 case IB_CM_TIMEWAIT:
43144 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43145 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43146 counter[CM_DREQ_COUNTER]);
43147 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
43148 goto unlock;
43149 @@ -2173,7 +2173,7 @@ static int cm_dreq_handler(struct cm_work *work)
43150 cm_free_msg(msg);
43151 goto deref;
43152 case IB_CM_DREQ_RCVD:
43153 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43154 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43155 counter[CM_DREQ_COUNTER]);
43156 goto unlock;
43157 default:
43158 @@ -2540,7 +2540,7 @@ static int cm_mra_handler(struct cm_work *work)
43159 ib_modify_mad(cm_id_priv->av.port->mad_agent,
43160 cm_id_priv->msg, timeout)) {
43161 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
43162 - atomic_long_inc(&work->port->
43163 + atomic_long_inc_unchecked(&work->port->
43164 counter_group[CM_RECV_DUPLICATES].
43165 counter[CM_MRA_COUNTER]);
43166 goto out;
43167 @@ -2549,7 +2549,7 @@ static int cm_mra_handler(struct cm_work *work)
43168 break;
43169 case IB_CM_MRA_REQ_RCVD:
43170 case IB_CM_MRA_REP_RCVD:
43171 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43172 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43173 counter[CM_MRA_COUNTER]);
43174 /* fall through */
43175 default:
43176 @@ -2711,7 +2711,7 @@ static int cm_lap_handler(struct cm_work *work)
43177 case IB_CM_LAP_IDLE:
43178 break;
43179 case IB_CM_MRA_LAP_SENT:
43180 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43181 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43182 counter[CM_LAP_COUNTER]);
43183 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
43184 goto unlock;
43185 @@ -2727,7 +2727,7 @@ static int cm_lap_handler(struct cm_work *work)
43186 cm_free_msg(msg);
43187 goto deref;
43188 case IB_CM_LAP_RCVD:
43189 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43190 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43191 counter[CM_LAP_COUNTER]);
43192 goto unlock;
43193 default:
43194 @@ -3011,7 +3011,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
43195 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
43196 if (cur_cm_id_priv) {
43197 spin_unlock_irq(&cm.lock);
43198 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
43199 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
43200 counter[CM_SIDR_REQ_COUNTER]);
43201 goto out; /* Duplicate message. */
43202 }
43203 @@ -3223,10 +3223,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
43204 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
43205 msg->retries = 1;
43206
43207 - atomic_long_add(1 + msg->retries,
43208 + atomic_long_add_unchecked(1 + msg->retries,
43209 &port->counter_group[CM_XMIT].counter[attr_index]);
43210 if (msg->retries)
43211 - atomic_long_add(msg->retries,
43212 + atomic_long_add_unchecked(msg->retries,
43213 &port->counter_group[CM_XMIT_RETRIES].
43214 counter[attr_index]);
43215
43216 @@ -3436,7 +3436,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
43217 }
43218
43219 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
43220 - atomic_long_inc(&port->counter_group[CM_RECV].
43221 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
43222 counter[attr_id - CM_ATTR_ID_OFFSET]);
43223
43224 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
43225 @@ -3667,7 +3667,7 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
43226 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
43227
43228 return sprintf(buf, "%ld\n",
43229 - atomic_long_read(&group->counter[cm_attr->index]));
43230 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
43231 }
43232
43233 static const struct sysfs_ops cm_counter_ops = {
43234 diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
43235 index 9f5ad7c..588cd84 100644
43236 --- a/drivers/infiniband/core/fmr_pool.c
43237 +++ b/drivers/infiniband/core/fmr_pool.c
43238 @@ -98,8 +98,8 @@ struct ib_fmr_pool {
43239
43240 struct task_struct *thread;
43241
43242 - atomic_t req_ser;
43243 - atomic_t flush_ser;
43244 + atomic_unchecked_t req_ser;
43245 + atomic_unchecked_t flush_ser;
43246
43247 wait_queue_head_t force_wait;
43248 };
43249 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
43250 struct ib_fmr_pool *pool = pool_ptr;
43251
43252 do {
43253 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
43254 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
43255 ib_fmr_batch_release(pool);
43256
43257 - atomic_inc(&pool->flush_ser);
43258 + atomic_inc_unchecked(&pool->flush_ser);
43259 wake_up_interruptible(&pool->force_wait);
43260
43261 if (pool->flush_function)
43262 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
43263 }
43264
43265 set_current_state(TASK_INTERRUPTIBLE);
43266 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
43267 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
43268 !kthread_should_stop())
43269 schedule();
43270 __set_current_state(TASK_RUNNING);
43271 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
43272 pool->dirty_watermark = params->dirty_watermark;
43273 pool->dirty_len = 0;
43274 spin_lock_init(&pool->pool_lock);
43275 - atomic_set(&pool->req_ser, 0);
43276 - atomic_set(&pool->flush_ser, 0);
43277 + atomic_set_unchecked(&pool->req_ser, 0);
43278 + atomic_set_unchecked(&pool->flush_ser, 0);
43279 init_waitqueue_head(&pool->force_wait);
43280
43281 pool->thread = kthread_run(ib_fmr_cleanup_thread,
43282 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
43283 }
43284 spin_unlock_irq(&pool->pool_lock);
43285
43286 - serial = atomic_inc_return(&pool->req_ser);
43287 + serial = atomic_inc_return_unchecked(&pool->req_ser);
43288 wake_up_process(pool->thread);
43289
43290 if (wait_event_interruptible(pool->force_wait,
43291 - atomic_read(&pool->flush_ser) - serial >= 0))
43292 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
43293 return -EINTR;
43294
43295 return 0;
43296 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
43297 } else {
43298 list_add_tail(&fmr->list, &pool->dirty_list);
43299 if (++pool->dirty_len >= pool->dirty_watermark) {
43300 - atomic_inc(&pool->req_ser);
43301 + atomic_inc_unchecked(&pool->req_ser);
43302 wake_up_process(pool->thread);
43303 }
43304 }
43305 diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
43306 index a9f0489..27a161b 100644
43307 --- a/drivers/infiniband/core/uverbs_cmd.c
43308 +++ b/drivers/infiniband/core/uverbs_cmd.c
43309 @@ -951,6 +951,9 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file,
43310 if (copy_from_user(&cmd, buf, sizeof cmd))
43311 return -EFAULT;
43312
43313 + if (!access_ok_noprefault(VERIFY_READ, cmd.start, cmd.length))
43314 + return -EFAULT;
43315 +
43316 INIT_UDATA(&udata, buf + sizeof cmd,
43317 (unsigned long) cmd.response + sizeof resp,
43318 in_len - sizeof cmd, out_len - sizeof resp);
43319 diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
43320 index cff815b..75576dd 100644
43321 --- a/drivers/infiniband/hw/cxgb4/mem.c
43322 +++ b/drivers/infiniband/hw/cxgb4/mem.c
43323 @@ -256,7 +256,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
43324 int err;
43325 struct fw_ri_tpte tpt;
43326 u32 stag_idx;
43327 - static atomic_t key;
43328 + static atomic_unchecked_t key;
43329
43330 if (c4iw_fatal_error(rdev))
43331 return -EIO;
43332 @@ -277,7 +277,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
43333 if (rdev->stats.stag.cur > rdev->stats.stag.max)
43334 rdev->stats.stag.max = rdev->stats.stag.cur;
43335 mutex_unlock(&rdev->stats.lock);
43336 - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
43337 + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
43338 }
43339 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
43340 __func__, stag_state, type, pdid, stag_idx);
43341 diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
43342 index 79b3dbc..96e5fcc 100644
43343 --- a/drivers/infiniband/hw/ipath/ipath_rc.c
43344 +++ b/drivers/infiniband/hw/ipath/ipath_rc.c
43345 @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
43346 struct ib_atomic_eth *ateth;
43347 struct ipath_ack_entry *e;
43348 u64 vaddr;
43349 - atomic64_t *maddr;
43350 + atomic64_unchecked_t *maddr;
43351 u64 sdata;
43352 u32 rkey;
43353 u8 next;
43354 @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
43355 IB_ACCESS_REMOTE_ATOMIC)))
43356 goto nack_acc_unlck;
43357 /* Perform atomic OP and save result. */
43358 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
43359 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
43360 sdata = be64_to_cpu(ateth->swap_data);
43361 e = &qp->s_ack_queue[qp->r_head_ack_queue];
43362 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
43363 - (u64) atomic64_add_return(sdata, maddr) - sdata :
43364 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
43365 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
43366 be64_to_cpu(ateth->compare_data),
43367 sdata);
43368 diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
43369 index 1f95bba..9530f87 100644
43370 --- a/drivers/infiniband/hw/ipath/ipath_ruc.c
43371 +++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
43372 @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
43373 unsigned long flags;
43374 struct ib_wc wc;
43375 u64 sdata;
43376 - atomic64_t *maddr;
43377 + atomic64_unchecked_t *maddr;
43378 enum ib_wc_status send_status;
43379
43380 /*
43381 @@ -382,11 +382,11 @@ again:
43382 IB_ACCESS_REMOTE_ATOMIC)))
43383 goto acc_err;
43384 /* Perform atomic OP and save result. */
43385 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
43386 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
43387 sdata = wqe->wr.wr.atomic.compare_add;
43388 *(u64 *) sqp->s_sge.sge.vaddr =
43389 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
43390 - (u64) atomic64_add_return(sdata, maddr) - sdata :
43391 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
43392 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
43393 sdata, wqe->wr.wr.atomic.swap);
43394 goto send_comp;
43395 diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
43396 index 9cd2b00..7486df4 100644
43397 --- a/drivers/infiniband/hw/mlx4/mad.c
43398 +++ b/drivers/infiniband/hw/mlx4/mad.c
43399 @@ -106,7 +106,7 @@ __be64 mlx4_ib_gen_node_guid(void)
43400
43401 __be64 mlx4_ib_get_new_demux_tid(struct mlx4_ib_demux_ctx *ctx)
43402 {
43403 - return cpu_to_be64(atomic_inc_return(&ctx->tid)) |
43404 + return cpu_to_be64(atomic_inc_return_unchecked(&ctx->tid)) |
43405 cpu_to_be64(0xff00000000000000LL);
43406 }
43407
43408 diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
43409 index ed327e6..ca1739e0 100644
43410 --- a/drivers/infiniband/hw/mlx4/mcg.c
43411 +++ b/drivers/infiniband/hw/mlx4/mcg.c
43412 @@ -1041,7 +1041,7 @@ int mlx4_ib_mcg_port_init(struct mlx4_ib_demux_ctx *ctx)
43413 {
43414 char name[20];
43415
43416 - atomic_set(&ctx->tid, 0);
43417 + atomic_set_unchecked(&ctx->tid, 0);
43418 sprintf(name, "mlx4_ib_mcg%d", ctx->port);
43419 ctx->mcg_wq = create_singlethread_workqueue(name);
43420 if (!ctx->mcg_wq)
43421 diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
43422 index fce39343..9d8fdff 100644
43423 --- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
43424 +++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
43425 @@ -435,7 +435,7 @@ struct mlx4_ib_demux_ctx {
43426 struct list_head mcg_mgid0_list;
43427 struct workqueue_struct *mcg_wq;
43428 struct mlx4_ib_demux_pv_ctx **tun;
43429 - atomic_t tid;
43430 + atomic_unchecked_t tid;
43431 int flushing; /* flushing the work queue */
43432 };
43433
43434 diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
43435 index 9d3e5c1..6f166df 100644
43436 --- a/drivers/infiniband/hw/mthca/mthca_cmd.c
43437 +++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
43438 @@ -772,7 +772,7 @@ static void mthca_setup_cmd_doorbells(struct mthca_dev *dev, u64 base)
43439 mthca_dbg(dev, "Mapped doorbell page for posting FW commands\n");
43440 }
43441
43442 -int mthca_QUERY_FW(struct mthca_dev *dev)
43443 +int __intentional_overflow(-1) mthca_QUERY_FW(struct mthca_dev *dev)
43444 {
43445 struct mthca_mailbox *mailbox;
43446 u32 *outbox;
43447 @@ -1612,7 +1612,7 @@ int mthca_HW2SW_MPT(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
43448 CMD_TIME_CLASS_B);
43449 }
43450
43451 -int mthca_WRITE_MTT(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
43452 +int __intentional_overflow(-1) mthca_WRITE_MTT(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
43453 int num_mtt)
43454 {
43455 return mthca_cmd(dev, mailbox->dma, num_mtt, 0, CMD_WRITE_MTT,
43456 @@ -1634,7 +1634,7 @@ int mthca_MAP_EQ(struct mthca_dev *dev, u64 event_mask, int unmap,
43457 0, CMD_MAP_EQ, CMD_TIME_CLASS_B);
43458 }
43459
43460 -int mthca_SW2HW_EQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
43461 +int __intentional_overflow(-1) mthca_SW2HW_EQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
43462 int eq_num)
43463 {
43464 return mthca_cmd(dev, mailbox->dma, eq_num, 0, CMD_SW2HW_EQ,
43465 @@ -1857,7 +1857,7 @@ int mthca_CONF_SPECIAL_QP(struct mthca_dev *dev, int type, u32 qpn)
43466 CMD_TIME_CLASS_B);
43467 }
43468
43469 -int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
43470 +int __intentional_overflow(-1) mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
43471 int port, struct ib_wc *in_wc, struct ib_grh *in_grh,
43472 void *in_mad, void *response_mad)
43473 {
43474 diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
43475 index ded76c1..0cf0a08 100644
43476 --- a/drivers/infiniband/hw/mthca/mthca_main.c
43477 +++ b/drivers/infiniband/hw/mthca/mthca_main.c
43478 @@ -692,7 +692,7 @@ err_close:
43479 return err;
43480 }
43481
43482 -static int mthca_setup_hca(struct mthca_dev *dev)
43483 +static int __intentional_overflow(-1) mthca_setup_hca(struct mthca_dev *dev)
43484 {
43485 int err;
43486
43487 diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
43488 index ed9a989..6aa5dc2 100644
43489 --- a/drivers/infiniband/hw/mthca/mthca_mr.c
43490 +++ b/drivers/infiniband/hw/mthca/mthca_mr.c
43491 @@ -81,7 +81,7 @@ struct mthca_mpt_entry {
43492 * through the bitmaps)
43493 */
43494
43495 -static u32 mthca_buddy_alloc(struct mthca_buddy *buddy, int order)
43496 +static u32 __intentional_overflow(-1) mthca_buddy_alloc(struct mthca_buddy *buddy, int order)
43497 {
43498 int o;
43499 int m;
43500 @@ -426,7 +426,7 @@ static inline u32 adjust_key(struct mthca_dev *dev, u32 key)
43501 return key;
43502 }
43503
43504 -int mthca_mr_alloc(struct mthca_dev *dev, u32 pd, int buffer_size_shift,
43505 +int __intentional_overflow(-1) mthca_mr_alloc(struct mthca_dev *dev, u32 pd, int buffer_size_shift,
43506 u64 iova, u64 total_size, u32 access, struct mthca_mr *mr)
43507 {
43508 struct mthca_mailbox *mailbox;
43509 @@ -516,7 +516,7 @@ int mthca_mr_alloc_notrans(struct mthca_dev *dev, u32 pd,
43510 return mthca_mr_alloc(dev, pd, 12, 0, ~0ULL, access, mr);
43511 }
43512
43513 -int mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd,
43514 +int __intentional_overflow(-1) mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd,
43515 u64 *buffer_list, int buffer_size_shift,
43516 int list_len, u64 iova, u64 total_size,
43517 u32 access, struct mthca_mr *mr)
43518 diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
43519 index 415f8e1..e34214e 100644
43520 --- a/drivers/infiniband/hw/mthca/mthca_provider.c
43521 +++ b/drivers/infiniband/hw/mthca/mthca_provider.c
43522 @@ -764,7 +764,7 @@ unlock:
43523 return 0;
43524 }
43525
43526 -static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
43527 +static int __intentional_overflow(-1) mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
43528 {
43529 struct mthca_dev *dev = to_mdev(ibcq->device);
43530 struct mthca_cq *cq = to_mcq(ibcq);
43531 diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
43532 index 9f9d5c5..3c19aac 100644
43533 --- a/drivers/infiniband/hw/nes/nes.c
43534 +++ b/drivers/infiniband/hw/nes/nes.c
43535 @@ -97,7 +97,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
43536 LIST_HEAD(nes_adapter_list);
43537 static LIST_HEAD(nes_dev_list);
43538
43539 -atomic_t qps_destroyed;
43540 +atomic_unchecked_t qps_destroyed;
43541
43542 static unsigned int ee_flsh_adapter;
43543 static unsigned int sysfs_nonidx_addr;
43544 @@ -279,7 +279,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
43545 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
43546 struct nes_adapter *nesadapter = nesdev->nesadapter;
43547
43548 - atomic_inc(&qps_destroyed);
43549 + atomic_inc_unchecked(&qps_destroyed);
43550
43551 /* Free the control structures */
43552
43553 diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
43554 index bd9d132..70d84f4 100644
43555 --- a/drivers/infiniband/hw/nes/nes.h
43556 +++ b/drivers/infiniband/hw/nes/nes.h
43557 @@ -180,17 +180,17 @@ extern unsigned int nes_debug_level;
43558 extern unsigned int wqm_quanta;
43559 extern struct list_head nes_adapter_list;
43560
43561 -extern atomic_t cm_connects;
43562 -extern atomic_t cm_accepts;
43563 -extern atomic_t cm_disconnects;
43564 -extern atomic_t cm_closes;
43565 -extern atomic_t cm_connecteds;
43566 -extern atomic_t cm_connect_reqs;
43567 -extern atomic_t cm_rejects;
43568 -extern atomic_t mod_qp_timouts;
43569 -extern atomic_t qps_created;
43570 -extern atomic_t qps_destroyed;
43571 -extern atomic_t sw_qps_destroyed;
43572 +extern atomic_unchecked_t cm_connects;
43573 +extern atomic_unchecked_t cm_accepts;
43574 +extern atomic_unchecked_t cm_disconnects;
43575 +extern atomic_unchecked_t cm_closes;
43576 +extern atomic_unchecked_t cm_connecteds;
43577 +extern atomic_unchecked_t cm_connect_reqs;
43578 +extern atomic_unchecked_t cm_rejects;
43579 +extern atomic_unchecked_t mod_qp_timouts;
43580 +extern atomic_unchecked_t qps_created;
43581 +extern atomic_unchecked_t qps_destroyed;
43582 +extern atomic_unchecked_t sw_qps_destroyed;
43583 extern u32 mh_detected;
43584 extern u32 mh_pauses_sent;
43585 extern u32 cm_packets_sent;
43586 @@ -199,16 +199,16 @@ extern u32 cm_packets_created;
43587 extern u32 cm_packets_received;
43588 extern u32 cm_packets_dropped;
43589 extern u32 cm_packets_retrans;
43590 -extern atomic_t cm_listens_created;
43591 -extern atomic_t cm_listens_destroyed;
43592 +extern atomic_unchecked_t cm_listens_created;
43593 +extern atomic_unchecked_t cm_listens_destroyed;
43594 extern u32 cm_backlog_drops;
43595 -extern atomic_t cm_loopbacks;
43596 -extern atomic_t cm_nodes_created;
43597 -extern atomic_t cm_nodes_destroyed;
43598 -extern atomic_t cm_accel_dropped_pkts;
43599 -extern atomic_t cm_resets_recvd;
43600 -extern atomic_t pau_qps_created;
43601 -extern atomic_t pau_qps_destroyed;
43602 +extern atomic_unchecked_t cm_loopbacks;
43603 +extern atomic_unchecked_t cm_nodes_created;
43604 +extern atomic_unchecked_t cm_nodes_destroyed;
43605 +extern atomic_unchecked_t cm_accel_dropped_pkts;
43606 +extern atomic_unchecked_t cm_resets_recvd;
43607 +extern atomic_unchecked_t pau_qps_created;
43608 +extern atomic_unchecked_t pau_qps_destroyed;
43609
43610 extern u32 int_mod_timer_init;
43611 extern u32 int_mod_cq_depth_256;
43612 diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
43613 index 72b4341..2600332 100644
43614 --- a/drivers/infiniband/hw/nes/nes_cm.c
43615 +++ b/drivers/infiniband/hw/nes/nes_cm.c
43616 @@ -69,14 +69,14 @@ u32 cm_packets_dropped;
43617 u32 cm_packets_retrans;
43618 u32 cm_packets_created;
43619 u32 cm_packets_received;
43620 -atomic_t cm_listens_created;
43621 -atomic_t cm_listens_destroyed;
43622 +atomic_unchecked_t cm_listens_created;
43623 +atomic_unchecked_t cm_listens_destroyed;
43624 u32 cm_backlog_drops;
43625 -atomic_t cm_loopbacks;
43626 -atomic_t cm_nodes_created;
43627 -atomic_t cm_nodes_destroyed;
43628 -atomic_t cm_accel_dropped_pkts;
43629 -atomic_t cm_resets_recvd;
43630 +atomic_unchecked_t cm_loopbacks;
43631 +atomic_unchecked_t cm_nodes_created;
43632 +atomic_unchecked_t cm_nodes_destroyed;
43633 +atomic_unchecked_t cm_accel_dropped_pkts;
43634 +atomic_unchecked_t cm_resets_recvd;
43635
43636 static inline int mini_cm_accelerated(struct nes_cm_core *, struct nes_cm_node *);
43637 static struct nes_cm_listener *mini_cm_listen(struct nes_cm_core *, struct nes_vnic *, struct nes_cm_info *);
43638 @@ -135,28 +135,28 @@ static void record_ird_ord(struct nes_cm_node *, u16, u16);
43639 /* instance of function pointers for client API */
43640 /* set address of this instance to cm_core->cm_ops at cm_core alloc */
43641 static struct nes_cm_ops nes_cm_api = {
43642 - mini_cm_accelerated,
43643 - mini_cm_listen,
43644 - mini_cm_del_listen,
43645 - mini_cm_connect,
43646 - mini_cm_close,
43647 - mini_cm_accept,
43648 - mini_cm_reject,
43649 - mini_cm_recv_pkt,
43650 - mini_cm_dealloc_core,
43651 - mini_cm_get,
43652 - mini_cm_set
43653 + .accelerated = mini_cm_accelerated,
43654 + .listen = mini_cm_listen,
43655 + .stop_listener = mini_cm_del_listen,
43656 + .connect = mini_cm_connect,
43657 + .close = mini_cm_close,
43658 + .accept = mini_cm_accept,
43659 + .reject = mini_cm_reject,
43660 + .recv_pkt = mini_cm_recv_pkt,
43661 + .destroy_cm_core = mini_cm_dealloc_core,
43662 + .get = mini_cm_get,
43663 + .set = mini_cm_set
43664 };
43665
43666 static struct nes_cm_core *g_cm_core;
43667
43668 -atomic_t cm_connects;
43669 -atomic_t cm_accepts;
43670 -atomic_t cm_disconnects;
43671 -atomic_t cm_closes;
43672 -atomic_t cm_connecteds;
43673 -atomic_t cm_connect_reqs;
43674 -atomic_t cm_rejects;
43675 +atomic_unchecked_t cm_connects;
43676 +atomic_unchecked_t cm_accepts;
43677 +atomic_unchecked_t cm_disconnects;
43678 +atomic_unchecked_t cm_closes;
43679 +atomic_unchecked_t cm_connecteds;
43680 +atomic_unchecked_t cm_connect_reqs;
43681 +atomic_unchecked_t cm_rejects;
43682
43683 int nes_add_ref_cm_node(struct nes_cm_node *cm_node)
43684 {
43685 @@ -1461,7 +1461,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
43686 kfree(listener);
43687 listener = NULL;
43688 ret = 0;
43689 - atomic_inc(&cm_listens_destroyed);
43690 + atomic_inc_unchecked(&cm_listens_destroyed);
43691 } else {
43692 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
43693 }
43694 @@ -1667,7 +1667,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
43695 cm_node->rem_mac);
43696
43697 add_hte_node(cm_core, cm_node);
43698 - atomic_inc(&cm_nodes_created);
43699 + atomic_inc_unchecked(&cm_nodes_created);
43700
43701 return cm_node;
43702 }
43703 @@ -1728,7 +1728,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
43704 }
43705
43706 atomic_dec(&cm_core->node_cnt);
43707 - atomic_inc(&cm_nodes_destroyed);
43708 + atomic_inc_unchecked(&cm_nodes_destroyed);
43709 nesqp = cm_node->nesqp;
43710 if (nesqp) {
43711 nesqp->cm_node = NULL;
43712 @@ -1792,7 +1792,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
43713
43714 static void drop_packet(struct sk_buff *skb)
43715 {
43716 - atomic_inc(&cm_accel_dropped_pkts);
43717 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
43718 dev_kfree_skb_any(skb);
43719 }
43720
43721 @@ -1855,7 +1855,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
43722 {
43723
43724 int reset = 0; /* whether to send reset in case of err.. */
43725 - atomic_inc(&cm_resets_recvd);
43726 + atomic_inc_unchecked(&cm_resets_recvd);
43727 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
43728 " refcnt=%d\n", cm_node, cm_node->state,
43729 atomic_read(&cm_node->ref_count));
43730 @@ -2523,7 +2523,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
43731 rem_ref_cm_node(cm_node->cm_core, cm_node);
43732 return NULL;
43733 }
43734 - atomic_inc(&cm_loopbacks);
43735 + atomic_inc_unchecked(&cm_loopbacks);
43736 loopbackremotenode->loopbackpartner = cm_node;
43737 loopbackremotenode->tcp_cntxt.rcv_wscale =
43738 NES_CM_DEFAULT_RCV_WND_SCALE;
43739 @@ -2804,7 +2804,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
43740 nes_queue_mgt_skbs(skb, nesvnic, cm_node->nesqp);
43741 else {
43742 rem_ref_cm_node(cm_core, cm_node);
43743 - atomic_inc(&cm_accel_dropped_pkts);
43744 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
43745 dev_kfree_skb_any(skb);
43746 }
43747 break;
43748 @@ -3112,7 +3112,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
43749
43750 if ((cm_id) && (cm_id->event_handler)) {
43751 if (issue_disconn) {
43752 - atomic_inc(&cm_disconnects);
43753 + atomic_inc_unchecked(&cm_disconnects);
43754 cm_event.event = IW_CM_EVENT_DISCONNECT;
43755 cm_event.status = disconn_status;
43756 cm_event.local_addr = cm_id->local_addr;
43757 @@ -3134,7 +3134,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
43758 }
43759
43760 if (issue_close) {
43761 - atomic_inc(&cm_closes);
43762 + atomic_inc_unchecked(&cm_closes);
43763 nes_disconnect(nesqp, 1);
43764
43765 cm_id->provider_data = nesqp;
43766 @@ -3272,7 +3272,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
43767
43768 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
43769 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
43770 - atomic_inc(&cm_accepts);
43771 + atomic_inc_unchecked(&cm_accepts);
43772
43773 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
43774 netdev_refcnt_read(nesvnic->netdev));
43775 @@ -3470,7 +3470,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
43776 struct nes_cm_core *cm_core;
43777 u8 *start_buff;
43778
43779 - atomic_inc(&cm_rejects);
43780 + atomic_inc_unchecked(&cm_rejects);
43781 cm_node = (struct nes_cm_node *)cm_id->provider_data;
43782 loopback = cm_node->loopbackpartner;
43783 cm_core = cm_node->cm_core;
43784 @@ -3535,7 +3535,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
43785 ntohs(raddr->sin_port), ntohl(laddr->sin_addr.s_addr),
43786 ntohs(laddr->sin_port));
43787
43788 - atomic_inc(&cm_connects);
43789 + atomic_inc_unchecked(&cm_connects);
43790 nesqp->active_conn = 1;
43791
43792 /* cache the cm_id in the qp */
43793 @@ -3680,7 +3680,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog)
43794 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
43795 return err;
43796 }
43797 - atomic_inc(&cm_listens_created);
43798 + atomic_inc_unchecked(&cm_listens_created);
43799 }
43800
43801 cm_id->add_ref(cm_id);
43802 @@ -3787,7 +3787,7 @@ static void cm_event_connected(struct nes_cm_event *event)
43803
43804 if (nesqp->destroyed)
43805 return;
43806 - atomic_inc(&cm_connecteds);
43807 + atomic_inc_unchecked(&cm_connecteds);
43808 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
43809 " local port 0x%04X. jiffies = %lu.\n",
43810 nesqp->hwqp.qp_id, ntohl(raddr->sin_addr.s_addr),
43811 @@ -3972,7 +3972,7 @@ static void cm_event_reset(struct nes_cm_event *event)
43812
43813 cm_id->add_ref(cm_id);
43814 ret = cm_id->event_handler(cm_id, &cm_event);
43815 - atomic_inc(&cm_closes);
43816 + atomic_inc_unchecked(&cm_closes);
43817 cm_event.event = IW_CM_EVENT_CLOSE;
43818 cm_event.status = 0;
43819 cm_event.provider_data = cm_id->provider_data;
43820 @@ -4012,7 +4012,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
43821 return;
43822 cm_id = cm_node->cm_id;
43823
43824 - atomic_inc(&cm_connect_reqs);
43825 + atomic_inc_unchecked(&cm_connect_reqs);
43826 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
43827 cm_node, cm_id, jiffies);
43828
43829 @@ -4061,7 +4061,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
43830 return;
43831 cm_id = cm_node->cm_id;
43832
43833 - atomic_inc(&cm_connect_reqs);
43834 + atomic_inc_unchecked(&cm_connect_reqs);
43835 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
43836 cm_node, cm_id, jiffies);
43837
43838 diff --git a/drivers/infiniband/hw/nes/nes_mgt.c b/drivers/infiniband/hw/nes/nes_mgt.c
43839 index 4166452..fc952c3 100644
43840 --- a/drivers/infiniband/hw/nes/nes_mgt.c
43841 +++ b/drivers/infiniband/hw/nes/nes_mgt.c
43842 @@ -40,8 +40,8 @@
43843 #include "nes.h"
43844 #include "nes_mgt.h"
43845
43846 -atomic_t pau_qps_created;
43847 -atomic_t pau_qps_destroyed;
43848 +atomic_unchecked_t pau_qps_created;
43849 +atomic_unchecked_t pau_qps_destroyed;
43850
43851 static void nes_replenish_mgt_rq(struct nes_vnic_mgt *mgtvnic)
43852 {
43853 @@ -621,7 +621,7 @@ void nes_destroy_pau_qp(struct nes_device *nesdev, struct nes_qp *nesqp)
43854 {
43855 struct sk_buff *skb;
43856 unsigned long flags;
43857 - atomic_inc(&pau_qps_destroyed);
43858 + atomic_inc_unchecked(&pau_qps_destroyed);
43859
43860 /* Free packets that have not yet been forwarded */
43861 /* Lock is acquired by skb_dequeue when removing the skb */
43862 @@ -810,7 +810,7 @@ static void nes_mgt_ce_handler(struct nes_device *nesdev, struct nes_hw_nic_cq *
43863 cq->cq_vbase[head].cqe_words[NES_NIC_CQE_HASH_RCVNXT]);
43864 skb_queue_head_init(&nesqp->pau_list);
43865 spin_lock_init(&nesqp->pau_lock);
43866 - atomic_inc(&pau_qps_created);
43867 + atomic_inc_unchecked(&pau_qps_created);
43868 nes_change_quad_hash(nesdev, mgtvnic->nesvnic, nesqp);
43869 }
43870
43871 diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
43872 index 70acda9..a96de9d 100644
43873 --- a/drivers/infiniband/hw/nes/nes_nic.c
43874 +++ b/drivers/infiniband/hw/nes/nes_nic.c
43875 @@ -1274,39 +1274,39 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
43876 target_stat_values[++index] = mh_detected;
43877 target_stat_values[++index] = mh_pauses_sent;
43878 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
43879 - target_stat_values[++index] = atomic_read(&cm_connects);
43880 - target_stat_values[++index] = atomic_read(&cm_accepts);
43881 - target_stat_values[++index] = atomic_read(&cm_disconnects);
43882 - target_stat_values[++index] = atomic_read(&cm_connecteds);
43883 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
43884 - target_stat_values[++index] = atomic_read(&cm_rejects);
43885 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
43886 - target_stat_values[++index] = atomic_read(&qps_created);
43887 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
43888 - target_stat_values[++index] = atomic_read(&qps_destroyed);
43889 - target_stat_values[++index] = atomic_read(&cm_closes);
43890 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
43891 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
43892 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
43893 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
43894 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
43895 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
43896 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
43897 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
43898 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
43899 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
43900 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
43901 target_stat_values[++index] = cm_packets_sent;
43902 target_stat_values[++index] = cm_packets_bounced;
43903 target_stat_values[++index] = cm_packets_created;
43904 target_stat_values[++index] = cm_packets_received;
43905 target_stat_values[++index] = cm_packets_dropped;
43906 target_stat_values[++index] = cm_packets_retrans;
43907 - target_stat_values[++index] = atomic_read(&cm_listens_created);
43908 - target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
43909 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
43910 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
43911 target_stat_values[++index] = cm_backlog_drops;
43912 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
43913 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
43914 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
43915 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
43916 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
43917 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
43918 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
43919 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
43920 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
43921 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
43922 target_stat_values[++index] = nesadapter->free_4kpbl;
43923 target_stat_values[++index] = nesadapter->free_256pbl;
43924 target_stat_values[++index] = int_mod_timer_init;
43925 target_stat_values[++index] = nesvnic->lro_mgr.stats.aggregated;
43926 target_stat_values[++index] = nesvnic->lro_mgr.stats.flushed;
43927 target_stat_values[++index] = nesvnic->lro_mgr.stats.no_desc;
43928 - target_stat_values[++index] = atomic_read(&pau_qps_created);
43929 - target_stat_values[++index] = atomic_read(&pau_qps_destroyed);
43930 + target_stat_values[++index] = atomic_read_unchecked(&pau_qps_created);
43931 + target_stat_values[++index] = atomic_read_unchecked(&pau_qps_destroyed);
43932 }
43933
43934 /**
43935 diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
43936 index c0d0296..3185f57 100644
43937 --- a/drivers/infiniband/hw/nes/nes_verbs.c
43938 +++ b/drivers/infiniband/hw/nes/nes_verbs.c
43939 @@ -46,9 +46,9 @@
43940
43941 #include <rdma/ib_umem.h>
43942
43943 -atomic_t mod_qp_timouts;
43944 -atomic_t qps_created;
43945 -atomic_t sw_qps_destroyed;
43946 +atomic_unchecked_t mod_qp_timouts;
43947 +atomic_unchecked_t qps_created;
43948 +atomic_unchecked_t sw_qps_destroyed;
43949
43950 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
43951
43952 @@ -1134,7 +1134,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
43953 if (init_attr->create_flags)
43954 return ERR_PTR(-EINVAL);
43955
43956 - atomic_inc(&qps_created);
43957 + atomic_inc_unchecked(&qps_created);
43958 switch (init_attr->qp_type) {
43959 case IB_QPT_RC:
43960 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
43961 @@ -1468,7 +1468,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
43962 struct iw_cm_event cm_event;
43963 int ret = 0;
43964
43965 - atomic_inc(&sw_qps_destroyed);
43966 + atomic_inc_unchecked(&sw_qps_destroyed);
43967 nesqp->destroyed = 1;
43968
43969 /* Blow away the connection if it exists. */
43970 diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
43971 index 7df16f7..7e1b21e 100644
43972 --- a/drivers/infiniband/hw/qib/qib.h
43973 +++ b/drivers/infiniband/hw/qib/qib.h
43974 @@ -52,6 +52,7 @@
43975 #include <linux/kref.h>
43976 #include <linux/sched.h>
43977 #include <linux/kthread.h>
43978 +#include <linux/slab.h>
43979
43980 #include "qib_common.h"
43981 #include "qib_verbs.h"
43982 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
43983 index cdc7df4..a2fdfdb 100644
43984 --- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
43985 +++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
43986 @@ -156,7 +156,7 @@ static size_t ipoib_get_size(const struct net_device *dev)
43987 nla_total_size(2); /* IFLA_IPOIB_UMCAST */
43988 }
43989
43990 -static struct rtnl_link_ops ipoib_link_ops __read_mostly = {
43991 +static struct rtnl_link_ops ipoib_link_ops = {
43992 .kind = "ipoib",
43993 .maxtype = IFLA_IPOIB_MAX,
43994 .policy = ipoib_policy,
43995 diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
43996 index e853a21..56fc5a8 100644
43997 --- a/drivers/input/gameport/gameport.c
43998 +++ b/drivers/input/gameport/gameport.c
43999 @@ -527,14 +527,14 @@ EXPORT_SYMBOL(gameport_set_phys);
44000 */
44001 static void gameport_init_port(struct gameport *gameport)
44002 {
44003 - static atomic_t gameport_no = ATOMIC_INIT(-1);
44004 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(-1);
44005
44006 __module_get(THIS_MODULE);
44007
44008 mutex_init(&gameport->drv_mutex);
44009 device_initialize(&gameport->dev);
44010 dev_set_name(&gameport->dev, "gameport%lu",
44011 - (unsigned long)atomic_inc_return(&gameport_no));
44012 + (unsigned long)atomic_inc_return_unchecked(&gameport_no));
44013 gameport->dev.bus = &gameport_bus;
44014 gameport->dev.release = gameport_release_port;
44015 if (gameport->parent)
44016 diff --git a/drivers/input/input.c b/drivers/input/input.c
44017 index cc357f1..ee42fbc 100644
44018 --- a/drivers/input/input.c
44019 +++ b/drivers/input/input.c
44020 @@ -1781,7 +1781,7 @@ EXPORT_SYMBOL_GPL(input_class);
44021 */
44022 struct input_dev *input_allocate_device(void)
44023 {
44024 - static atomic_t input_no = ATOMIC_INIT(-1);
44025 + static atomic_unchecked_t input_no = ATOMIC_INIT(-1);
44026 struct input_dev *dev;
44027
44028 dev = kzalloc(sizeof(struct input_dev), GFP_KERNEL);
44029 @@ -1796,7 +1796,7 @@ struct input_dev *input_allocate_device(void)
44030 INIT_LIST_HEAD(&dev->node);
44031
44032 dev_set_name(&dev->dev, "input%lu",
44033 - (unsigned long)atomic_inc_return(&input_no));
44034 + (unsigned long)atomic_inc_return_unchecked(&input_no));
44035
44036 __module_get(THIS_MODULE);
44037 }
44038 diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
44039 index 4a95b22..874c182 100644
44040 --- a/drivers/input/joystick/sidewinder.c
44041 +++ b/drivers/input/joystick/sidewinder.c
44042 @@ -30,6 +30,7 @@
44043 #include <linux/kernel.h>
44044 #include <linux/module.h>
44045 #include <linux/slab.h>
44046 +#include <linux/sched.h>
44047 #include <linux/input.h>
44048 #include <linux/gameport.h>
44049 #include <linux/jiffies.h>
44050 diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
44051 index 61c7611..e1bfa38 100644
44052 --- a/drivers/input/joystick/xpad.c
44053 +++ b/drivers/input/joystick/xpad.c
44054 @@ -905,7 +905,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
44055
44056 static int xpad_led_probe(struct usb_xpad *xpad)
44057 {
44058 - static atomic_t led_seq = ATOMIC_INIT(-1);
44059 + static atomic_unchecked_t led_seq = ATOMIC_INIT(-1);
44060 unsigned long led_no;
44061 struct xpad_led *led;
44062 struct led_classdev *led_cdev;
44063 @@ -918,7 +918,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
44064 if (!led)
44065 return -ENOMEM;
44066
44067 - led_no = atomic_inc_return(&led_seq);
44068 + led_no = atomic_inc_return_unchecked(&led_seq);
44069
44070 snprintf(led->name, sizeof(led->name), "xpad%lu", led_no);
44071 led->xpad = xpad;
44072 diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
44073 index ac1fa5f..5f7502c 100644
44074 --- a/drivers/input/misc/ims-pcu.c
44075 +++ b/drivers/input/misc/ims-pcu.c
44076 @@ -1851,7 +1851,7 @@ static int ims_pcu_identify_type(struct ims_pcu *pcu, u8 *device_id)
44077
44078 static int ims_pcu_init_application_mode(struct ims_pcu *pcu)
44079 {
44080 - static atomic_t device_no = ATOMIC_INIT(-1);
44081 + static atomic_unchecked_t device_no = ATOMIC_INIT(-1);
44082
44083 const struct ims_pcu_device_info *info;
44084 int error;
44085 @@ -1882,7 +1882,7 @@ static int ims_pcu_init_application_mode(struct ims_pcu *pcu)
44086 }
44087
44088 /* Device appears to be operable, complete initialization */
44089 - pcu->device_no = atomic_inc_return(&device_no);
44090 + pcu->device_no = atomic_inc_return_unchecked(&device_no);
44091
44092 /*
44093 * PCU-B devices, both GEN_1 and GEN_2 do not have OFN sensor
44094 diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
44095 index ad5a5a1..5eac214 100644
44096 --- a/drivers/input/mouse/psmouse.h
44097 +++ b/drivers/input/mouse/psmouse.h
44098 @@ -125,7 +125,7 @@ struct psmouse_attribute {
44099 ssize_t (*set)(struct psmouse *psmouse, void *data,
44100 const char *buf, size_t count);
44101 bool protect;
44102 -};
44103 +} __do_const;
44104 #define to_psmouse_attr(a) container_of((a), struct psmouse_attribute, dattr)
44105
44106 ssize_t psmouse_attr_show_helper(struct device *dev, struct device_attribute *attr,
44107 diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
44108 index b604564..3f14ae4 100644
44109 --- a/drivers/input/mousedev.c
44110 +++ b/drivers/input/mousedev.c
44111 @@ -744,7 +744,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
44112
44113 spin_unlock_irq(&client->packet_lock);
44114
44115 - if (copy_to_user(buffer, data, count))
44116 + if (count > sizeof(data) || copy_to_user(buffer, data, count))
44117 return -EFAULT;
44118
44119 return count;
44120 diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
44121 index a05a517..323a2fd 100644
44122 --- a/drivers/input/serio/serio.c
44123 +++ b/drivers/input/serio/serio.c
44124 @@ -514,7 +514,7 @@ static void serio_release_port(struct device *dev)
44125 */
44126 static void serio_init_port(struct serio *serio)
44127 {
44128 - static atomic_t serio_no = ATOMIC_INIT(-1);
44129 + static atomic_unchecked_t serio_no = ATOMIC_INIT(-1);
44130
44131 __module_get(THIS_MODULE);
44132
44133 @@ -525,7 +525,7 @@ static void serio_init_port(struct serio *serio)
44134 mutex_init(&serio->drv_mutex);
44135 device_initialize(&serio->dev);
44136 dev_set_name(&serio->dev, "serio%lu",
44137 - (unsigned long)atomic_inc_return(&serio_no));
44138 + (unsigned long)atomic_inc_return_unchecked(&serio_no));
44139 serio->dev.bus = &serio_bus;
44140 serio->dev.release = serio_release_port;
44141 serio->dev.groups = serio_device_attr_groups;
44142 diff --git a/drivers/input/serio/serio_raw.c b/drivers/input/serio/serio_raw.c
44143 index 71ef5d6..93380a9 100644
44144 --- a/drivers/input/serio/serio_raw.c
44145 +++ b/drivers/input/serio/serio_raw.c
44146 @@ -292,7 +292,7 @@ static irqreturn_t serio_raw_interrupt(struct serio *serio, unsigned char data,
44147
44148 static int serio_raw_connect(struct serio *serio, struct serio_driver *drv)
44149 {
44150 - static atomic_t serio_raw_no = ATOMIC_INIT(-1);
44151 + static atomic_unchecked_t serio_raw_no = ATOMIC_INIT(-1);
44152 struct serio_raw *serio_raw;
44153 int err;
44154
44155 @@ -303,7 +303,7 @@ static int serio_raw_connect(struct serio *serio, struct serio_driver *drv)
44156 }
44157
44158 snprintf(serio_raw->name, sizeof(serio_raw->name),
44159 - "serio_raw%ld", (long)atomic_inc_return(&serio_raw_no));
44160 + "serio_raw%ld", (long)atomic_inc_return_unchecked(&serio_raw_no));
44161 kref_init(&serio_raw->kref);
44162 INIT_LIST_HEAD(&serio_raw->client_list);
44163 init_waitqueue_head(&serio_raw->wait);
44164 diff --git a/drivers/input/touchscreen/htcpen.c b/drivers/input/touchscreen/htcpen.c
44165 index 92e2243..8fd9092 100644
44166 --- a/drivers/input/touchscreen/htcpen.c
44167 +++ b/drivers/input/touchscreen/htcpen.c
44168 @@ -219,7 +219,7 @@ static struct isa_driver htcpen_isa_driver = {
44169 }
44170 };
44171
44172 -static struct dmi_system_id htcshift_dmi_table[] __initdata = {
44173 +static const struct dmi_system_id htcshift_dmi_table[] __initconst = {
44174 {
44175 .ident = "Shift",
44176 .matches = {
44177 diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
44178 index ca9f4ed..b860ff1 100644
44179 --- a/drivers/iommu/amd_iommu.c
44180 +++ b/drivers/iommu/amd_iommu.c
44181 @@ -829,11 +829,21 @@ static void copy_cmd_to_buffer(struct amd_iommu *iommu,
44182
44183 static void build_completion_wait(struct iommu_cmd *cmd, u64 address)
44184 {
44185 + phys_addr_t physaddr;
44186 WARN_ON(address & 0x7ULL);
44187
44188 memset(cmd, 0, sizeof(*cmd));
44189 - cmd->data[0] = lower_32_bits(__pa(address)) | CMD_COMPL_WAIT_STORE_MASK;
44190 - cmd->data[1] = upper_32_bits(__pa(address));
44191 +
44192 +#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
44193 + if (object_starts_on_stack((void *)address)) {
44194 + void *adjbuf = (void *)address - current->stack + current->lowmem_stack;
44195 + physaddr = __pa((u64)adjbuf);
44196 + } else
44197 +#endif
44198 + physaddr = __pa(address);
44199 +
44200 + cmd->data[0] = lower_32_bits(physaddr) | CMD_COMPL_WAIT_STORE_MASK;
44201 + cmd->data[1] = upper_32_bits(physaddr);
44202 cmd->data[2] = 1;
44203 CMD_SET_TYPE(cmd, CMD_COMPL_WAIT);
44204 }
44205 diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
44206 index 65075ef..53823f9 100644
44207 --- a/drivers/iommu/arm-smmu.c
44208 +++ b/drivers/iommu/arm-smmu.c
44209 @@ -331,7 +331,7 @@ enum arm_smmu_domain_stage {
44210
44211 struct arm_smmu_domain {
44212 struct arm_smmu_device *smmu;
44213 - struct io_pgtable_ops *pgtbl_ops;
44214 + struct io_pgtable *pgtbl;
44215 spinlock_t pgtbl_lock;
44216 struct arm_smmu_cfg cfg;
44217 enum arm_smmu_domain_stage stage;
44218 @@ -817,7 +817,7 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain,
44219 {
44220 int irq, start, ret = 0;
44221 unsigned long ias, oas;
44222 - struct io_pgtable_ops *pgtbl_ops;
44223 + struct io_pgtable *pgtbl;
44224 struct io_pgtable_cfg pgtbl_cfg;
44225 enum io_pgtable_fmt fmt;
44226 struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
44227 @@ -902,14 +902,16 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain,
44228 };
44229
44230 smmu_domain->smmu = smmu;
44231 - pgtbl_ops = alloc_io_pgtable_ops(fmt, &pgtbl_cfg, smmu_domain);
44232 - if (!pgtbl_ops) {
44233 + pgtbl = alloc_io_pgtable(fmt, &pgtbl_cfg, smmu_domain);
44234 + if (!pgtbl) {
44235 ret = -ENOMEM;
44236 goto out_clear_smmu;
44237 }
44238
44239 /* Update our support page sizes to reflect the page table format */
44240 - arm_smmu_ops.pgsize_bitmap = pgtbl_cfg.pgsize_bitmap;
44241 + pax_open_kernel();
44242 + *(unsigned long *)&arm_smmu_ops.pgsize_bitmap = pgtbl_cfg.pgsize_bitmap;
44243 + pax_close_kernel();
44244
44245 /* Initialise the context bank with our page table cfg */
44246 arm_smmu_init_context_bank(smmu_domain, &pgtbl_cfg);
44247 @@ -930,7 +932,7 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain,
44248 mutex_unlock(&smmu_domain->init_mutex);
44249
44250 /* Publish page table ops for map/unmap */
44251 - smmu_domain->pgtbl_ops = pgtbl_ops;
44252 + smmu_domain->pgtbl = pgtbl;
44253 return 0;
44254
44255 out_clear_smmu:
44256 @@ -963,8 +965,7 @@ static void arm_smmu_destroy_domain_context(struct iommu_domain *domain)
44257 free_irq(irq, domain);
44258 }
44259
44260 - if (smmu_domain->pgtbl_ops)
44261 - free_io_pgtable_ops(smmu_domain->pgtbl_ops);
44262 + free_io_pgtable(smmu_domain->pgtbl);
44263
44264 __arm_smmu_free_bitmap(smmu->context_map, cfg->cbndx);
44265 }
44266 @@ -1190,13 +1191,13 @@ static int arm_smmu_map(struct iommu_domain *domain, unsigned long iova,
44267 int ret;
44268 unsigned long flags;
44269 struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
44270 - struct io_pgtable_ops *ops= smmu_domain->pgtbl_ops;
44271 + struct io_pgtable *iop = smmu_domain->pgtbl;
44272
44273 - if (!ops)
44274 + if (!iop)
44275 return -ENODEV;
44276
44277 spin_lock_irqsave(&smmu_domain->pgtbl_lock, flags);
44278 - ret = ops->map(ops, iova, paddr, size, prot);
44279 + ret = iop->ops->map(iop, iova, paddr, size, prot);
44280 spin_unlock_irqrestore(&smmu_domain->pgtbl_lock, flags);
44281 return ret;
44282 }
44283 @@ -1207,13 +1208,13 @@ static size_t arm_smmu_unmap(struct iommu_domain *domain, unsigned long iova,
44284 size_t ret;
44285 unsigned long flags;
44286 struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
44287 - struct io_pgtable_ops *ops= smmu_domain->pgtbl_ops;
44288 + struct io_pgtable *iop = smmu_domain->pgtbl;
44289
44290 - if (!ops)
44291 + if (!iop)
44292 return 0;
44293
44294 spin_lock_irqsave(&smmu_domain->pgtbl_lock, flags);
44295 - ret = ops->unmap(ops, iova, size);
44296 + ret = iop->ops->unmap(iop, iova, size);
44297 spin_unlock_irqrestore(&smmu_domain->pgtbl_lock, flags);
44298 return ret;
44299 }
44300 @@ -1224,7 +1225,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain,
44301 struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
44302 struct arm_smmu_device *smmu = smmu_domain->smmu;
44303 struct arm_smmu_cfg *cfg = &smmu_domain->cfg;
44304 - struct io_pgtable_ops *ops= smmu_domain->pgtbl_ops;
44305 + struct io_pgtable *iop = smmu_domain->pgtbl;
44306 struct device *dev = smmu->dev;
44307 void __iomem *cb_base;
44308 u32 tmp;
44309 @@ -1247,7 +1248,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain,
44310 dev_err(dev,
44311 "iova to phys timed out on 0x%pad. Falling back to software table walk.\n",
44312 &iova);
44313 - return ops->iova_to_phys(ops, iova);
44314 + return iop->ops->iova_to_phys(iop, iova);
44315 }
44316
44317 phys = readl_relaxed(cb_base + ARM_SMMU_CB_PAR_LO);
44318 @@ -1268,9 +1269,9 @@ static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
44319 phys_addr_t ret;
44320 unsigned long flags;
44321 struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
44322 - struct io_pgtable_ops *ops= smmu_domain->pgtbl_ops;
44323 + struct io_pgtable *iop = smmu_domain->pgtbl;
44324
44325 - if (!ops)
44326 + if (!iop)
44327 return 0;
44328
44329 spin_lock_irqsave(&smmu_domain->pgtbl_lock, flags);
44330 @@ -1278,7 +1279,7 @@ static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
44331 smmu_domain->stage == ARM_SMMU_DOMAIN_S1) {
44332 ret = arm_smmu_iova_to_phys_hard(domain, iova);
44333 } else {
44334 - ret = ops->iova_to_phys(ops, iova);
44335 + ret = iop->ops->iova_to_phys(iop, iova);
44336 }
44337
44338 spin_unlock_irqrestore(&smmu_domain->pgtbl_lock, flags);
44339 @@ -1668,7 +1669,9 @@ static int arm_smmu_device_cfg_probe(struct arm_smmu_device *smmu)
44340 size |= SZ_64K | SZ_512M;
44341 }
44342
44343 - arm_smmu_ops.pgsize_bitmap &= size;
44344 + pax_open_kernel();
44345 + *(unsigned long *)&arm_smmu_ops.pgsize_bitmap &= size;
44346 + pax_close_kernel();
44347 dev_notice(smmu->dev, "\tSupported page sizes: 0x%08lx\n", size);
44348
44349 if (smmu->features & ARM_SMMU_FEAT_TRANS_S1)
44350 diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
44351 index 5ecfaf2..c87c4b1 100644
44352 --- a/drivers/iommu/intel-iommu.c
44353 +++ b/drivers/iommu/intel-iommu.c
44354 @@ -1756,8 +1756,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
44355
44356 static void domain_exit(struct dmar_domain *domain)
44357 {
44358 + struct dmar_drhd_unit *drhd;
44359 + struct intel_iommu *iommu;
44360 struct page *freelist = NULL;
44361 - int i;
44362
44363 /* Domain 0 is reserved, so dont process it */
44364 if (!domain)
44365 @@ -1777,8 +1778,10 @@ static void domain_exit(struct dmar_domain *domain)
44366
44367 /* clear attached or cached domains */
44368 rcu_read_lock();
44369 - for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
44370 - iommu_detach_domain(domain, g_iommus[i]);
44371 + for_each_active_iommu(iommu, drhd)
44372 + if (domain_type_is_vm(domain) ||
44373 + test_bit(iommu->seq_id, domain->iommu_bmp))
44374 + iommu_detach_domain(domain, iommu);
44375 rcu_read_unlock();
44376
44377 dma_free_pagelist(freelist);
44378 diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
44379 index 4e46021..f0a24fef 100644
44380 --- a/drivers/iommu/io-pgtable-arm.c
44381 +++ b/drivers/iommu/io-pgtable-arm.c
44382 @@ -36,12 +36,6 @@
44383 #define io_pgtable_to_data(x) \
44384 container_of((x), struct arm_lpae_io_pgtable, iop)
44385
44386 -#define io_pgtable_ops_to_pgtable(x) \
44387 - container_of((x), struct io_pgtable, ops)
44388 -
44389 -#define io_pgtable_ops_to_data(x) \
44390 - io_pgtable_to_data(io_pgtable_ops_to_pgtable(x))
44391 -
44392 /*
44393 * For consistency with the architecture, we always consider
44394 * ARM_LPAE_MAX_LEVELS levels, with the walk starting at level n >=0
44395 @@ -304,10 +298,10 @@ static arm_lpae_iopte arm_lpae_prot_to_pte(struct arm_lpae_io_pgtable *data,
44396 return pte;
44397 }
44398
44399 -static int arm_lpae_map(struct io_pgtable_ops *ops, unsigned long iova,
44400 +static int arm_lpae_map(struct io_pgtable *iop, unsigned long iova,
44401 phys_addr_t paddr, size_t size, int iommu_prot)
44402 {
44403 - struct arm_lpae_io_pgtable *data = io_pgtable_ops_to_data(ops);
44404 + struct arm_lpae_io_pgtable *data = io_pgtable_to_data(iop);
44405 arm_lpae_iopte *ptep = data->pgd;
44406 int lvl = ARM_LPAE_START_LVL(data);
44407 arm_lpae_iopte prot;
44408 @@ -447,12 +441,11 @@ static int __arm_lpae_unmap(struct arm_lpae_io_pgtable *data,
44409 return __arm_lpae_unmap(data, iova, size, lvl + 1, ptep);
44410 }
44411
44412 -static int arm_lpae_unmap(struct io_pgtable_ops *ops, unsigned long iova,
44413 +static int arm_lpae_unmap(struct io_pgtable *iop, unsigned long iova,
44414 size_t size)
44415 {
44416 size_t unmapped;
44417 - struct arm_lpae_io_pgtable *data = io_pgtable_ops_to_data(ops);
44418 - struct io_pgtable *iop = &data->iop;
44419 + struct arm_lpae_io_pgtable *data = io_pgtable_to_data(iop);
44420 arm_lpae_iopte *ptep = data->pgd;
44421 int lvl = ARM_LPAE_START_LVL(data);
44422
44423 @@ -463,10 +456,10 @@ static int arm_lpae_unmap(struct io_pgtable_ops *ops, unsigned long iova,
44424 return unmapped;
44425 }
44426
44427 -static phys_addr_t arm_lpae_iova_to_phys(struct io_pgtable_ops *ops,
44428 +static phys_addr_t arm_lpae_iova_to_phys(struct io_pgtable *iop,
44429 unsigned long iova)
44430 {
44431 - struct arm_lpae_io_pgtable *data = io_pgtable_ops_to_data(ops);
44432 + struct arm_lpae_io_pgtable *data = io_pgtable_to_data(iop);
44433 arm_lpae_iopte pte, *ptep = data->pgd;
44434 int lvl = ARM_LPAE_START_LVL(data);
44435
44436 @@ -533,6 +526,12 @@ static void arm_lpae_restrict_pgsizes(struct io_pgtable_cfg *cfg)
44437 }
44438 }
44439
44440 +static struct io_pgtable_ops arm_lpae_io_pgtable_ops = {
44441 + .map = arm_lpae_map,
44442 + .unmap = arm_lpae_unmap,
44443 + .iova_to_phys = arm_lpae_iova_to_phys,
44444 +};
44445 +
44446 static struct arm_lpae_io_pgtable *
44447 arm_lpae_alloc_pgtable(struct io_pgtable_cfg *cfg)
44448 {
44449 @@ -564,11 +563,7 @@ arm_lpae_alloc_pgtable(struct io_pgtable_cfg *cfg)
44450 pgd_bits = va_bits - (data->bits_per_level * (data->levels - 1));
44451 data->pgd_size = 1UL << (pgd_bits + ilog2(sizeof(arm_lpae_iopte)));
44452
44453 - data->iop.ops = (struct io_pgtable_ops) {
44454 - .map = arm_lpae_map,
44455 - .unmap = arm_lpae_unmap,
44456 - .iova_to_phys = arm_lpae_iova_to_phys,
44457 - };
44458 + data->iop.ops = &arm_lpae_io_pgtable_ops;
44459
44460 return data;
44461 }
44462 @@ -830,9 +825,9 @@ static struct iommu_gather_ops dummy_tlb_ops __initdata = {
44463 .flush_pgtable = dummy_flush_pgtable,
44464 };
44465
44466 -static void __init arm_lpae_dump_ops(struct io_pgtable_ops *ops)
44467 +static void __init arm_lpae_dump_ops(struct io_pgtable *iop)
44468 {
44469 - struct arm_lpae_io_pgtable *data = io_pgtable_ops_to_data(ops);
44470 + struct arm_lpae_io_pgtable *data = io_pgtable_to_data(iop);
44471 struct io_pgtable_cfg *cfg = &data->iop.cfg;
44472
44473 pr_err("cfg: pgsize_bitmap 0x%lx, ias %u-bit\n",
44474 @@ -842,9 +837,9 @@ static void __init arm_lpae_dump_ops(struct io_pgtable_ops *ops)
44475 data->bits_per_level, data->pgd);
44476 }
44477
44478 -#define __FAIL(ops, i) ({ \
44479 +#define __FAIL(iop, i) ({ \
44480 WARN(1, "selftest: test failed for fmt idx %d\n", (i)); \
44481 - arm_lpae_dump_ops(ops); \
44482 + arm_lpae_dump_ops(iop); \
44483 selftest_running = false; \
44484 -EFAULT; \
44485 })
44486 @@ -859,30 +854,32 @@ static int __init arm_lpae_run_tests(struct io_pgtable_cfg *cfg)
44487 int i, j;
44488 unsigned long iova;
44489 size_t size;
44490 - struct io_pgtable_ops *ops;
44491 + struct io_pgtable *iop;
44492 + const struct io_pgtable_ops *ops;
44493
44494 selftest_running = true;
44495
44496 for (i = 0; i < ARRAY_SIZE(fmts); ++i) {
44497 cfg_cookie = cfg;
44498 - ops = alloc_io_pgtable_ops(fmts[i], cfg, cfg);
44499 - if (!ops) {
44500 + iop = alloc_io_pgtable(fmts[i], cfg, cfg);
44501 + if (!iop) {
44502 pr_err("selftest: failed to allocate io pgtable ops\n");
44503 return -ENOMEM;
44504 }
44505 + ops = iop->ops;
44506
44507 /*
44508 * Initial sanity checks.
44509 * Empty page tables shouldn't provide any translations.
44510 */
44511 - if (ops->iova_to_phys(ops, 42))
44512 - return __FAIL(ops, i);
44513 + if (ops->iova_to_phys(iop, 42))
44514 + return __FAIL(iop, i);
44515
44516 - if (ops->iova_to_phys(ops, SZ_1G + 42))
44517 - return __FAIL(ops, i);
44518 + if (ops->iova_to_phys(iop, SZ_1G + 42))
44519 + return __FAIL(iop, i);
44520
44521 - if (ops->iova_to_phys(ops, SZ_2G + 42))
44522 - return __FAIL(ops, i);
44523 + if (ops->iova_to_phys(iop, SZ_2G + 42))
44524 + return __FAIL(iop, i);
44525
44526 /*
44527 * Distinct mappings of different granule sizes.
44528 @@ -892,19 +889,19 @@ static int __init arm_lpae_run_tests(struct io_pgtable_cfg *cfg)
44529 while (j != BITS_PER_LONG) {
44530 size = 1UL << j;
44531
44532 - if (ops->map(ops, iova, iova, size, IOMMU_READ |
44533 + if (ops->map(iop, iova, iova, size, IOMMU_READ |
44534 IOMMU_WRITE |
44535 IOMMU_NOEXEC |
44536 IOMMU_CACHE))
44537 - return __FAIL(ops, i);
44538 + return __FAIL(iop, i);
44539
44540 /* Overlapping mappings */
44541 - if (!ops->map(ops, iova, iova + size, size,
44542 + if (!ops->map(iop, iova, iova + size, size,
44543 IOMMU_READ | IOMMU_NOEXEC))
44544 - return __FAIL(ops, i);
44545 + return __FAIL(iop, i);
44546
44547 - if (ops->iova_to_phys(ops, iova + 42) != (iova + 42))
44548 - return __FAIL(ops, i);
44549 + if (ops->iova_to_phys(iop, iova + 42) != (iova + 42))
44550 + return __FAIL(iop, i);
44551
44552 iova += SZ_1G;
44553 j++;
44554 @@ -913,15 +910,15 @@ static int __init arm_lpae_run_tests(struct io_pgtable_cfg *cfg)
44555
44556 /* Partial unmap */
44557 size = 1UL << __ffs(cfg->pgsize_bitmap);
44558 - if (ops->unmap(ops, SZ_1G + size, size) != size)
44559 - return __FAIL(ops, i);
44560 + if (ops->unmap(iop, SZ_1G + size, size) != size)
44561 + return __FAIL(iop, i);
44562
44563 /* Remap of partial unmap */
44564 - if (ops->map(ops, SZ_1G + size, size, size, IOMMU_READ))
44565 - return __FAIL(ops, i);
44566 + if (ops->map(iop, SZ_1G + size, size, size, IOMMU_READ))
44567 + return __FAIL(iop, i);
44568
44569 - if (ops->iova_to_phys(ops, SZ_1G + size + 42) != (size + 42))
44570 - return __FAIL(ops, i);
44571 + if (ops->iova_to_phys(iop, SZ_1G + size + 42) != (size + 42))
44572 + return __FAIL(iop, i);
44573
44574 /* Full unmap */
44575 iova = 0;
44576 @@ -929,25 +926,25 @@ static int __init arm_lpae_run_tests(struct io_pgtable_cfg *cfg)
44577 while (j != BITS_PER_LONG) {
44578 size = 1UL << j;
44579
44580 - if (ops->unmap(ops, iova, size) != size)
44581 - return __FAIL(ops, i);
44582 + if (ops->unmap(iop, iova, size) != size)
44583 + return __FAIL(iop, i);
44584
44585 - if (ops->iova_to_phys(ops, iova + 42))
44586 - return __FAIL(ops, i);
44587 + if (ops->iova_to_phys(iop, iova + 42))
44588 + return __FAIL(iop, i);
44589
44590 /* Remap full block */
44591 - if (ops->map(ops, iova, iova, size, IOMMU_WRITE))
44592 - return __FAIL(ops, i);
44593 + if (ops->map(iop, iova, iova, size, IOMMU_WRITE))
44594 + return __FAIL(iop, i);
44595
44596 - if (ops->iova_to_phys(ops, iova + 42) != (iova + 42))
44597 - return __FAIL(ops, i);
44598 + if (ops->iova_to_phys(iop, iova + 42) != (iova + 42))
44599 + return __FAIL(iop, i);
44600
44601 iova += SZ_1G;
44602 j++;
44603 j = find_next_bit(&cfg->pgsize_bitmap, BITS_PER_LONG, j);
44604 }
44605
44606 - free_io_pgtable_ops(ops);
44607 + free_io_pgtable(iop);
44608 }
44609
44610 selftest_running = false;
44611 diff --git a/drivers/iommu/io-pgtable.c b/drivers/iommu/io-pgtable.c
44612 index 6436fe2..088c965 100644
44613 --- a/drivers/iommu/io-pgtable.c
44614 +++ b/drivers/iommu/io-pgtable.c
44615 @@ -40,7 +40,7 @@ io_pgtable_init_table[IO_PGTABLE_NUM_FMTS] =
44616 #endif
44617 };
44618
44619 -struct io_pgtable_ops *alloc_io_pgtable_ops(enum io_pgtable_fmt fmt,
44620 +struct io_pgtable *alloc_io_pgtable(enum io_pgtable_fmt fmt,
44621 struct io_pgtable_cfg *cfg,
44622 void *cookie)
44623 {
44624 @@ -62,21 +62,18 @@ struct io_pgtable_ops *alloc_io_pgtable_ops(enum io_pgtable_fmt fmt,
44625 iop->cookie = cookie;
44626 iop->cfg = *cfg;
44627
44628 - return &iop->ops;
44629 + return iop;
44630 }
44631
44632 /*
44633 * It is the IOMMU driver's responsibility to ensure that the page table
44634 * is no longer accessible to the walker by this point.
44635 */
44636 -void free_io_pgtable_ops(struct io_pgtable_ops *ops)
44637 +void free_io_pgtable(struct io_pgtable *iop)
44638 {
44639 - struct io_pgtable *iop;
44640 -
44641 - if (!ops)
44642 + if (!iop)
44643 return;
44644
44645 - iop = container_of(ops, struct io_pgtable, ops);
44646 iop->cfg.tlb->tlb_flush_all(iop->cookie);
44647 io_pgtable_init_table[iop->fmt]->free(iop);
44648 }
44649 diff --git a/drivers/iommu/io-pgtable.h b/drivers/iommu/io-pgtable.h
44650 index 10e32f6..0b276c8 100644
44651 --- a/drivers/iommu/io-pgtable.h
44652 +++ b/drivers/iommu/io-pgtable.h
44653 @@ -75,17 +75,18 @@ struct io_pgtable_cfg {
44654 * These functions map directly onto the iommu_ops member functions with
44655 * the same names.
44656 */
44657 +struct io_pgtable;
44658 struct io_pgtable_ops {
44659 - int (*map)(struct io_pgtable_ops *ops, unsigned long iova,
44660 + int (*map)(struct io_pgtable *iop, unsigned long iova,
44661 phys_addr_t paddr, size_t size, int prot);
44662 - int (*unmap)(struct io_pgtable_ops *ops, unsigned long iova,
44663 + int (*unmap)(struct io_pgtable *iop, unsigned long iova,
44664 size_t size);
44665 - phys_addr_t (*iova_to_phys)(struct io_pgtable_ops *ops,
44666 + phys_addr_t (*iova_to_phys)(struct io_pgtable *iop,
44667 unsigned long iova);
44668 };
44669
44670 /**
44671 - * alloc_io_pgtable_ops() - Allocate a page table allocator for use by an IOMMU.
44672 + * alloc_io_pgtable() - Allocate a page table allocator for use by an IOMMU.
44673 *
44674 * @fmt: The page table format.
44675 * @cfg: The page table configuration. This will be modified to represent
44676 @@ -94,9 +95,9 @@ struct io_pgtable_ops {
44677 * @cookie: An opaque token provided by the IOMMU driver and passed back to
44678 * the callback routines in cfg->tlb.
44679 */
44680 -struct io_pgtable_ops *alloc_io_pgtable_ops(enum io_pgtable_fmt fmt,
44681 - struct io_pgtable_cfg *cfg,
44682 - void *cookie);
44683 +struct io_pgtable *alloc_io_pgtable(enum io_pgtable_fmt fmt,
44684 + struct io_pgtable_cfg *cfg,
44685 + void *cookie);
44686
44687 /**
44688 * free_io_pgtable_ops() - Free an io_pgtable_ops structure. The caller
44689 @@ -105,7 +106,7 @@ struct io_pgtable_ops *alloc_io_pgtable_ops(enum io_pgtable_fmt fmt,
44690 *
44691 * @ops: The ops returned from alloc_io_pgtable_ops.
44692 */
44693 -void free_io_pgtable_ops(struct io_pgtable_ops *ops);
44694 +void free_io_pgtable(struct io_pgtable *iop);
44695
44696
44697 /*
44698 @@ -125,7 +126,7 @@ struct io_pgtable {
44699 enum io_pgtable_fmt fmt;
44700 void *cookie;
44701 struct io_pgtable_cfg cfg;
44702 - struct io_pgtable_ops ops;
44703 + const struct io_pgtable_ops *ops;
44704 };
44705
44706 /**
44707 diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
44708 index d4f527e..8e4a4fd 100644
44709 --- a/drivers/iommu/iommu.c
44710 +++ b/drivers/iommu/iommu.c
44711 @@ -802,7 +802,7 @@ static int iommu_bus_notifier(struct notifier_block *nb,
44712 static int iommu_bus_init(struct bus_type *bus, const struct iommu_ops *ops)
44713 {
44714 int err;
44715 - struct notifier_block *nb;
44716 + notifier_block_no_const *nb;
44717 struct iommu_callback_data cb = {
44718 .ops = ops,
44719 };
44720 diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
44721 index 1a67c53..23181d8 100644
44722 --- a/drivers/iommu/ipmmu-vmsa.c
44723 +++ b/drivers/iommu/ipmmu-vmsa.c
44724 @@ -41,7 +41,7 @@ struct ipmmu_vmsa_domain {
44725 struct iommu_domain io_domain;
44726
44727 struct io_pgtable_cfg cfg;
44728 - struct io_pgtable_ops *iop;
44729 + struct io_pgtable *iop;
44730
44731 unsigned int context_id;
44732 spinlock_t lock; /* Protects mappings */
44733 @@ -328,8 +328,7 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
44734 domain->cfg.oas = 40;
44735 domain->cfg.tlb = &ipmmu_gather_ops;
44736
44737 - domain->iop = alloc_io_pgtable_ops(ARM_32_LPAE_S1, &domain->cfg,
44738 - domain);
44739 + domain->iop = alloc_io_pgtable(ARM_32_LPAE_S1, &domain->cfg, domain);
44740 if (!domain->iop)
44741 return -EINVAL;
44742
44743 @@ -487,7 +486,7 @@ static void ipmmu_domain_free(struct iommu_domain *io_domain)
44744 * been detached.
44745 */
44746 ipmmu_domain_destroy_context(domain);
44747 - free_io_pgtable_ops(domain->iop);
44748 + free_io_pgtable(domain->iop);
44749 kfree(domain);
44750 }
44751
44752 @@ -556,7 +555,7 @@ static int ipmmu_map(struct iommu_domain *io_domain, unsigned long iova,
44753 if (!domain)
44754 return -ENODEV;
44755
44756 - return domain->iop->map(domain->iop, iova, paddr, size, prot);
44757 + return domain->iop->ops->map(domain->iop, iova, paddr, size, prot);
44758 }
44759
44760 static size_t ipmmu_unmap(struct iommu_domain *io_domain, unsigned long iova,
44761 @@ -564,7 +563,7 @@ static size_t ipmmu_unmap(struct iommu_domain *io_domain, unsigned long iova,
44762 {
44763 struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain);
44764
44765 - return domain->iop->unmap(domain->iop, iova, size);
44766 + return domain->iop->ops->unmap(domain->iop, iova, size);
44767 }
44768
44769 static phys_addr_t ipmmu_iova_to_phys(struct iommu_domain *io_domain,
44770 @@ -574,7 +573,7 @@ static phys_addr_t ipmmu_iova_to_phys(struct iommu_domain *io_domain,
44771
44772 /* TODO: Is locking needed ? */
44773
44774 - return domain->iop->iova_to_phys(domain->iop, iova);
44775 + return domain->iop->ops->iova_to_phys(domain->iop, iova);
44776 }
44777
44778 static int ipmmu_find_utlbs(struct ipmmu_vmsa_device *mmu, struct device *dev,
44779 diff --git a/drivers/iommu/irq_remapping.c b/drivers/iommu/irq_remapping.c
44780 index 390079e..1da9d6c 100644
44781 --- a/drivers/iommu/irq_remapping.c
44782 +++ b/drivers/iommu/irq_remapping.c
44783 @@ -329,7 +329,7 @@ int setup_hpet_msi_remapped(unsigned int irq, unsigned int id)
44784 void panic_if_irq_remap(const char *msg)
44785 {
44786 if (irq_remapping_enabled)
44787 - panic(msg);
44788 + panic("%s", msg);
44789 }
44790
44791 static void ir_ack_apic_edge(struct irq_data *data)
44792 @@ -350,10 +350,12 @@ static void ir_print_prefix(struct irq_data *data, struct seq_file *p)
44793
44794 void irq_remap_modify_chip_defaults(struct irq_chip *chip)
44795 {
44796 - chip->irq_print_chip = ir_print_prefix;
44797 - chip->irq_ack = ir_ack_apic_edge;
44798 - chip->irq_eoi = ir_ack_apic_level;
44799 - chip->irq_set_affinity = x86_io_apic_ops.set_affinity;
44800 + pax_open_kernel();
44801 + *(void **)&chip->irq_print_chip = ir_print_prefix;
44802 + *(void **)&chip->irq_ack = ir_ack_apic_edge;
44803 + *(void **)&chip->irq_eoi = ir_ack_apic_level;
44804 + *(void **)&chip->irq_set_affinity = x86_io_apic_ops.set_affinity;
44805 + pax_close_kernel();
44806 }
44807
44808 bool setup_remapped_irq(int irq, struct irq_cfg *cfg, struct irq_chip *chip)
44809 diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
44810 index 01999d7..4f14bb7 100644
44811 --- a/drivers/irqchip/irq-gic.c
44812 +++ b/drivers/irqchip/irq-gic.c
44813 @@ -313,7 +313,7 @@ static void gic_handle_cascade_irq(unsigned int irq, struct irq_desc *desc)
44814 chained_irq_exit(chip, desc);
44815 }
44816
44817 -static struct irq_chip gic_chip = {
44818 +static irq_chip_no_const gic_chip __read_only = {
44819 .name = "GIC",
44820 .irq_mask = gic_mask_irq,
44821 .irq_unmask = gic_unmask_irq,
44822 diff --git a/drivers/irqchip/irq-renesas-intc-irqpin.c b/drivers/irqchip/irq-renesas-intc-irqpin.c
44823 index 9a0767b..5e5f86f 100644
44824 --- a/drivers/irqchip/irq-renesas-intc-irqpin.c
44825 +++ b/drivers/irqchip/irq-renesas-intc-irqpin.c
44826 @@ -373,7 +373,7 @@ static int intc_irqpin_probe(struct platform_device *pdev)
44827 struct intc_irqpin_iomem *i;
44828 struct resource *io[INTC_IRQPIN_REG_NR];
44829 struct resource *irq;
44830 - struct irq_chip *irq_chip;
44831 + irq_chip_no_const *irq_chip;
44832 void (*enable_fn)(struct irq_data *d);
44833 void (*disable_fn)(struct irq_data *d);
44834 const char *name = dev_name(dev);
44835 diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
44836 index cdf80b7..e5c3ade 100644
44837 --- a/drivers/irqchip/irq-renesas-irqc.c
44838 +++ b/drivers/irqchip/irq-renesas-irqc.c
44839 @@ -179,7 +179,7 @@ static int irqc_probe(struct platform_device *pdev)
44840 struct irqc_priv *p;
44841 struct resource *io;
44842 struct resource *irq;
44843 - struct irq_chip *irq_chip;
44844 + irq_chip_no_const *irq_chip;
44845 const char *name = dev_name(&pdev->dev);
44846 int ret;
44847 int k;
44848 diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
44849 index 6a2df32..dc962f1 100644
44850 --- a/drivers/isdn/capi/capi.c
44851 +++ b/drivers/isdn/capi/capi.c
44852 @@ -81,8 +81,8 @@ struct capiminor {
44853
44854 struct capi20_appl *ap;
44855 u32 ncci;
44856 - atomic_t datahandle;
44857 - atomic_t msgid;
44858 + atomic_unchecked_t datahandle;
44859 + atomic_unchecked_t msgid;
44860
44861 struct tty_port port;
44862 int ttyinstop;
44863 @@ -391,7 +391,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
44864 capimsg_setu16(s, 2, mp->ap->applid);
44865 capimsg_setu8 (s, 4, CAPI_DATA_B3);
44866 capimsg_setu8 (s, 5, CAPI_RESP);
44867 - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
44868 + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
44869 capimsg_setu32(s, 8, mp->ncci);
44870 capimsg_setu16(s, 12, datahandle);
44871 }
44872 @@ -512,14 +512,14 @@ static void handle_minor_send(struct capiminor *mp)
44873 mp->outbytes -= len;
44874 spin_unlock_bh(&mp->outlock);
44875
44876 - datahandle = atomic_inc_return(&mp->datahandle);
44877 + datahandle = atomic_inc_return_unchecked(&mp->datahandle);
44878 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
44879 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
44880 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
44881 capimsg_setu16(skb->data, 2, mp->ap->applid);
44882 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
44883 capimsg_setu8 (skb->data, 5, CAPI_REQ);
44884 - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
44885 + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
44886 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
44887 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
44888 capimsg_setu16(skb->data, 16, len); /* Data length */
44889 diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
44890 index aecec6d..11e13c5 100644
44891 --- a/drivers/isdn/gigaset/bas-gigaset.c
44892 +++ b/drivers/isdn/gigaset/bas-gigaset.c
44893 @@ -2565,22 +2565,22 @@ static int gigaset_post_reset(struct usb_interface *intf)
44894
44895
44896 static const struct gigaset_ops gigops = {
44897 - gigaset_write_cmd,
44898 - gigaset_write_room,
44899 - gigaset_chars_in_buffer,
44900 - gigaset_brkchars,
44901 - gigaset_init_bchannel,
44902 - gigaset_close_bchannel,
44903 - gigaset_initbcshw,
44904 - gigaset_freebcshw,
44905 - gigaset_reinitbcshw,
44906 - gigaset_initcshw,
44907 - gigaset_freecshw,
44908 - gigaset_set_modem_ctrl,
44909 - gigaset_baud_rate,
44910 - gigaset_set_line_ctrl,
44911 - gigaset_isoc_send_skb,
44912 - gigaset_isoc_input,
44913 + .write_cmd = gigaset_write_cmd,
44914 + .write_room = gigaset_write_room,
44915 + .chars_in_buffer = gigaset_chars_in_buffer,
44916 + .brkchars = gigaset_brkchars,
44917 + .init_bchannel = gigaset_init_bchannel,
44918 + .close_bchannel = gigaset_close_bchannel,
44919 + .initbcshw = gigaset_initbcshw,
44920 + .freebcshw = gigaset_freebcshw,
44921 + .reinitbcshw = gigaset_reinitbcshw,
44922 + .initcshw = gigaset_initcshw,
44923 + .freecshw = gigaset_freecshw,
44924 + .set_modem_ctrl = gigaset_set_modem_ctrl,
44925 + .baud_rate = gigaset_baud_rate,
44926 + .set_line_ctrl = gigaset_set_line_ctrl,
44927 + .send_skb = gigaset_isoc_send_skb,
44928 + .handle_input = gigaset_isoc_input,
44929 };
44930
44931 /* bas_gigaset_init
44932 diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
44933 index 600c79b..3752bab 100644
44934 --- a/drivers/isdn/gigaset/interface.c
44935 +++ b/drivers/isdn/gigaset/interface.c
44936 @@ -130,9 +130,9 @@ static int if_open(struct tty_struct *tty, struct file *filp)
44937 }
44938 tty->driver_data = cs;
44939
44940 - ++cs->port.count;
44941 + atomic_inc(&cs->port.count);
44942
44943 - if (cs->port.count == 1) {
44944 + if (atomic_read(&cs->port.count) == 1) {
44945 tty_port_tty_set(&cs->port, tty);
44946 cs->port.low_latency = 1;
44947 }
44948 @@ -156,9 +156,9 @@ static void if_close(struct tty_struct *tty, struct file *filp)
44949
44950 if (!cs->connected)
44951 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
44952 - else if (!cs->port.count)
44953 + else if (!atomic_read(&cs->port.count))
44954 dev_warn(cs->dev, "%s: device not opened\n", __func__);
44955 - else if (!--cs->port.count)
44956 + else if (!atomic_dec_return(&cs->port.count))
44957 tty_port_tty_set(&cs->port, NULL);
44958
44959 mutex_unlock(&cs->mutex);
44960 diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
44961 index 8c91fd5..14f13ce 100644
44962 --- a/drivers/isdn/gigaset/ser-gigaset.c
44963 +++ b/drivers/isdn/gigaset/ser-gigaset.c
44964 @@ -453,22 +453,22 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
44965 }
44966
44967 static const struct gigaset_ops ops = {
44968 - gigaset_write_cmd,
44969 - gigaset_write_room,
44970 - gigaset_chars_in_buffer,
44971 - gigaset_brkchars,
44972 - gigaset_init_bchannel,
44973 - gigaset_close_bchannel,
44974 - gigaset_initbcshw,
44975 - gigaset_freebcshw,
44976 - gigaset_reinitbcshw,
44977 - gigaset_initcshw,
44978 - gigaset_freecshw,
44979 - gigaset_set_modem_ctrl,
44980 - gigaset_baud_rate,
44981 - gigaset_set_line_ctrl,
44982 - gigaset_m10x_send_skb, /* asyncdata.c */
44983 - gigaset_m10x_input, /* asyncdata.c */
44984 + .write_cmd = gigaset_write_cmd,
44985 + .write_room = gigaset_write_room,
44986 + .chars_in_buffer = gigaset_chars_in_buffer,
44987 + .brkchars = gigaset_brkchars,
44988 + .init_bchannel = gigaset_init_bchannel,
44989 + .close_bchannel = gigaset_close_bchannel,
44990 + .initbcshw = gigaset_initbcshw,
44991 + .freebcshw = gigaset_freebcshw,
44992 + .reinitbcshw = gigaset_reinitbcshw,
44993 + .initcshw = gigaset_initcshw,
44994 + .freecshw = gigaset_freecshw,
44995 + .set_modem_ctrl = gigaset_set_modem_ctrl,
44996 + .baud_rate = gigaset_baud_rate,
44997 + .set_line_ctrl = gigaset_set_line_ctrl,
44998 + .send_skb = gigaset_m10x_send_skb, /* asyncdata.c */
44999 + .handle_input = gigaset_m10x_input, /* asyncdata.c */
45000 };
45001
45002
45003 diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
45004 index 5f306e2..5342f88 100644
45005 --- a/drivers/isdn/gigaset/usb-gigaset.c
45006 +++ b/drivers/isdn/gigaset/usb-gigaset.c
45007 @@ -543,7 +543,7 @@ static int gigaset_brkchars(struct cardstate *cs, const unsigned char buf[6])
45008 gigaset_dbg_buffer(DEBUG_USBREQ, "brkchars", 6, buf);
45009 memcpy(cs->hw.usb->bchars, buf, 6);
45010 return usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x19, 0x41,
45011 - 0, 0, &buf, 6, 2000);
45012 + 0, 0, buf, 6, 2000);
45013 }
45014
45015 static void gigaset_freebcshw(struct bc_state *bcs)
45016 @@ -862,22 +862,22 @@ static int gigaset_pre_reset(struct usb_interface *intf)
45017 }
45018
45019 static const struct gigaset_ops ops = {
45020 - gigaset_write_cmd,
45021 - gigaset_write_room,
45022 - gigaset_chars_in_buffer,
45023 - gigaset_brkchars,
45024 - gigaset_init_bchannel,
45025 - gigaset_close_bchannel,
45026 - gigaset_initbcshw,
45027 - gigaset_freebcshw,
45028 - gigaset_reinitbcshw,
45029 - gigaset_initcshw,
45030 - gigaset_freecshw,
45031 - gigaset_set_modem_ctrl,
45032 - gigaset_baud_rate,
45033 - gigaset_set_line_ctrl,
45034 - gigaset_m10x_send_skb,
45035 - gigaset_m10x_input,
45036 + .write_cmd = gigaset_write_cmd,
45037 + .write_room = gigaset_write_room,
45038 + .chars_in_buffer = gigaset_chars_in_buffer,
45039 + .brkchars = gigaset_brkchars,
45040 + .init_bchannel = gigaset_init_bchannel,
45041 + .close_bchannel = gigaset_close_bchannel,
45042 + .initbcshw = gigaset_initbcshw,
45043 + .freebcshw = gigaset_freebcshw,
45044 + .reinitbcshw = gigaset_reinitbcshw,
45045 + .initcshw = gigaset_initcshw,
45046 + .freecshw = gigaset_freecshw,
45047 + .set_modem_ctrl = gigaset_set_modem_ctrl,
45048 + .baud_rate = gigaset_baud_rate,
45049 + .set_line_ctrl = gigaset_set_line_ctrl,
45050 + .send_skb = gigaset_m10x_send_skb,
45051 + .handle_input = gigaset_m10x_input,
45052 };
45053
45054 /*
45055 diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
45056 index 4d9b195..455075c 100644
45057 --- a/drivers/isdn/hardware/avm/b1.c
45058 +++ b/drivers/isdn/hardware/avm/b1.c
45059 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart *t4file)
45060 }
45061 if (left) {
45062 if (t4file->user) {
45063 - if (copy_from_user(buf, dp, left))
45064 + if (left > sizeof buf || copy_from_user(buf, dp, left))
45065 return -EFAULT;
45066 } else {
45067 memcpy(buf, dp, left);
45068 @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capiloaddatapart *config)
45069 }
45070 if (left) {
45071 if (config->user) {
45072 - if (copy_from_user(buf, dp, left))
45073 + if (left > sizeof buf || copy_from_user(buf, dp, left))
45074 return -EFAULT;
45075 } else {
45076 memcpy(buf, dp, left);
45077 diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
45078 index 9b856e1..fa03c92 100644
45079 --- a/drivers/isdn/i4l/isdn_common.c
45080 +++ b/drivers/isdn/i4l/isdn_common.c
45081 @@ -1654,6 +1654,8 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
45082 } else
45083 return -EINVAL;
45084 case IIOCDBGVAR:
45085 + if (!capable(CAP_SYS_RAWIO))
45086 + return -EPERM;
45087 if (arg) {
45088 if (copy_to_user(argp, &dev, sizeof(ulong)))
45089 return -EFAULT;
45090 diff --git a/drivers/isdn/i4l/isdn_concap.c b/drivers/isdn/i4l/isdn_concap.c
45091 index 91d5730..336523e 100644
45092 --- a/drivers/isdn/i4l/isdn_concap.c
45093 +++ b/drivers/isdn/i4l/isdn_concap.c
45094 @@ -80,9 +80,9 @@ static int isdn_concap_dl_disconn_req(struct concap_proto *concap)
45095 }
45096
45097 struct concap_device_ops isdn_concap_reliable_dl_dops = {
45098 - &isdn_concap_dl_data_req,
45099 - &isdn_concap_dl_connect_req,
45100 - &isdn_concap_dl_disconn_req
45101 + .data_req = &isdn_concap_dl_data_req,
45102 + .connect_req = &isdn_concap_dl_connect_req,
45103 + .disconn_req = &isdn_concap_dl_disconn_req
45104 };
45105
45106 /* The following should better go into a dedicated source file such that
45107 diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
45108 index bc91261..2ef7e36 100644
45109 --- a/drivers/isdn/i4l/isdn_tty.c
45110 +++ b/drivers/isdn/i4l/isdn_tty.c
45111 @@ -1503,9 +1503,9 @@ isdn_tty_open(struct tty_struct *tty, struct file *filp)
45112
45113 #ifdef ISDN_DEBUG_MODEM_OPEN
45114 printk(KERN_DEBUG "isdn_tty_open %s, count = %d\n", tty->name,
45115 - port->count);
45116 + atomic_read(&port->count));
45117 #endif
45118 - port->count++;
45119 + atomic_inc(&port->count);
45120 port->tty = tty;
45121 /*
45122 * Start up serial port
45123 @@ -1549,7 +1549,7 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp)
45124 #endif
45125 return;
45126 }
45127 - if ((tty->count == 1) && (port->count != 1)) {
45128 + if ((tty->count == 1) && (atomic_read(&port->count) != 1)) {
45129 /*
45130 * Uh, oh. tty->count is 1, which means that the tty
45131 * structure will be freed. Info->count should always
45132 @@ -1558,15 +1558,15 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp)
45133 * serial port won't be shutdown.
45134 */
45135 printk(KERN_ERR "isdn_tty_close: bad port count; tty->count is 1, "
45136 - "info->count is %d\n", port->count);
45137 - port->count = 1;
45138 + "info->count is %d\n", atomic_read(&port->count));
45139 + atomic_set(&port->count, 1);
45140 }
45141 - if (--port->count < 0) {
45142 + if (atomic_dec_return(&port->count) < 0) {
45143 printk(KERN_ERR "isdn_tty_close: bad port count for ttyi%d: %d\n",
45144 - info->line, port->count);
45145 - port->count = 0;
45146 + info->line, atomic_read(&port->count));
45147 + atomic_set(&port->count, 0);
45148 }
45149 - if (port->count) {
45150 + if (atomic_read(&port->count)) {
45151 #ifdef ISDN_DEBUG_MODEM_OPEN
45152 printk(KERN_DEBUG "isdn_tty_close after info->count != 0\n");
45153 #endif
45154 @@ -1620,7 +1620,7 @@ isdn_tty_hangup(struct tty_struct *tty)
45155 if (isdn_tty_paranoia_check(info, tty->name, "isdn_tty_hangup"))
45156 return;
45157 isdn_tty_shutdown(info);
45158 - port->count = 0;
45159 + atomic_set(&port->count, 0);
45160 port->flags &= ~ASYNC_NORMAL_ACTIVE;
45161 port->tty = NULL;
45162 wake_up_interruptible(&port->open_wait);
45163 @@ -1965,7 +1965,7 @@ isdn_tty_find_icall(int di, int ch, setup_parm *setup)
45164 for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
45165 modem_info *info = &dev->mdm.info[i];
45166
45167 - if (info->port.count == 0)
45168 + if (atomic_read(&info->port.count) == 0)
45169 continue;
45170 if ((info->emu.mdmreg[REG_SI1] & si2bit[si1]) && /* SI1 is matching */
45171 (info->emu.mdmreg[REG_SI2] == si2)) { /* SI2 is matching */
45172 diff --git a/drivers/isdn/i4l/isdn_x25iface.c b/drivers/isdn/i4l/isdn_x25iface.c
45173 index e2d4e58..40cd045 100644
45174 --- a/drivers/isdn/i4l/isdn_x25iface.c
45175 +++ b/drivers/isdn/i4l/isdn_x25iface.c
45176 @@ -53,14 +53,14 @@ static int isdn_x25iface_disconn_ind(struct concap_proto *);
45177
45178
45179 static struct concap_proto_ops ix25_pops = {
45180 - &isdn_x25iface_proto_new,
45181 - &isdn_x25iface_proto_del,
45182 - &isdn_x25iface_proto_restart,
45183 - &isdn_x25iface_proto_close,
45184 - &isdn_x25iface_xmit,
45185 - &isdn_x25iface_receive,
45186 - &isdn_x25iface_connect_ind,
45187 - &isdn_x25iface_disconn_ind
45188 + .proto_new = &isdn_x25iface_proto_new,
45189 + .proto_del = &isdn_x25iface_proto_del,
45190 + .restart = &isdn_x25iface_proto_restart,
45191 + .close = &isdn_x25iface_proto_close,
45192 + .encap_and_xmit = &isdn_x25iface_xmit,
45193 + .data_ind = &isdn_x25iface_receive,
45194 + .connect_ind = &isdn_x25iface_connect_ind,
45195 + .disconn_ind = &isdn_x25iface_disconn_ind
45196 };
45197
45198 /* error message helper function */
45199 diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
45200 index 358a574..b4987ea 100644
45201 --- a/drivers/isdn/icn/icn.c
45202 +++ b/drivers/isdn/icn/icn.c
45203 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char *buf, int len, int user, icn_card *card)
45204 if (count > len)
45205 count = len;
45206 if (user) {
45207 - if (copy_from_user(msg, buf, count))
45208 + if (count > sizeof msg || copy_from_user(msg, buf, count))
45209 return -EFAULT;
45210 } else
45211 memcpy(msg, buf, count);
45212 diff --git a/drivers/isdn/mISDN/dsp_cmx.c b/drivers/isdn/mISDN/dsp_cmx.c
45213 index 52c4382..09e0c7c 100644
45214 --- a/drivers/isdn/mISDN/dsp_cmx.c
45215 +++ b/drivers/isdn/mISDN/dsp_cmx.c
45216 @@ -1625,7 +1625,7 @@ unsigned long dsp_spl_jiffies; /* calculate the next time to fire */
45217 static u16 dsp_count; /* last sample count */
45218 static int dsp_count_valid; /* if we have last sample count */
45219
45220 -void
45221 +void __intentional_overflow(-1)
45222 dsp_cmx_send(void *arg)
45223 {
45224 struct dsp_conf *conf;
45225 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
45226 index 312ffd3..9263d05 100644
45227 --- a/drivers/lguest/core.c
45228 +++ b/drivers/lguest/core.c
45229 @@ -96,9 +96,17 @@ static __init int map_switcher(void)
45230 * The end address needs +1 because __get_vm_area allocates an
45231 * extra guard page, so we need space for that.
45232 */
45233 +
45234 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
45235 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
45236 + VM_ALLOC | VM_KERNEXEC, switcher_addr, switcher_addr
45237 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
45238 +#else
45239 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
45240 VM_ALLOC, switcher_addr, switcher_addr
45241 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
45242 +#endif
45243 +
45244 if (!switcher_vma) {
45245 err = -ENOMEM;
45246 printk("lguest: could not map switcher pages high\n");
45247 @@ -121,7 +129,7 @@ static __init int map_switcher(void)
45248 * Now the Switcher is mapped at the right address, we can't fail!
45249 * Copy in the compiled-in Switcher code (from x86/switcher_32.S).
45250 */
45251 - memcpy(switcher_vma->addr, start_switcher_text,
45252 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
45253 end_switcher_text - start_switcher_text);
45254
45255 printk(KERN_INFO "lguest: mapped switcher at %p\n",
45256 diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
45257 index e3abebc9..6a35328 100644
45258 --- a/drivers/lguest/page_tables.c
45259 +++ b/drivers/lguest/page_tables.c
45260 @@ -585,7 +585,7 @@ void pin_page(struct lg_cpu *cpu, unsigned long vaddr)
45261 /*:*/
45262
45263 #ifdef CONFIG_X86_PAE
45264 -static void release_pmd(pmd_t *spmd)
45265 +static void __intentional_overflow(-1) release_pmd(pmd_t *spmd)
45266 {
45267 /* If the entry's not present, there's nothing to release. */
45268 if (pmd_flags(*spmd) & _PAGE_PRESENT) {
45269 diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
45270 index 30f2aef..391c748 100644
45271 --- a/drivers/lguest/x86/core.c
45272 +++ b/drivers/lguest/x86/core.c
45273 @@ -60,7 +60,7 @@ static struct {
45274 /* Offset from where switcher.S was compiled to where we've copied it */
45275 static unsigned long switcher_offset(void)
45276 {
45277 - return switcher_addr - (unsigned long)start_switcher_text;
45278 + return switcher_addr - (unsigned long)ktla_ktva(start_switcher_text);
45279 }
45280
45281 /* This cpu's struct lguest_pages (after the Switcher text page) */
45282 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
45283 * These copies are pretty cheap, so we do them unconditionally: */
45284 /* Save the current Host top-level page directory.
45285 */
45286 +
45287 +#ifdef CONFIG_PAX_PER_CPU_PGD
45288 + pages->state.host_cr3 = read_cr3();
45289 +#else
45290 pages->state.host_cr3 = __pa(current->mm->pgd);
45291 +#endif
45292 +
45293 /*
45294 * Set up the Guest's page tables to see this CPU's pages (and no
45295 * other CPU's pages).
45296 @@ -494,7 +500,7 @@ void __init lguest_arch_host_init(void)
45297 * compiled-in switcher code and the high-mapped copy we just made.
45298 */
45299 for (i = 0; i < IDT_ENTRIES; i++)
45300 - default_idt_entries[i] += switcher_offset();
45301 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
45302
45303 /*
45304 * Set up the Switcher's per-cpu areas.
45305 @@ -577,7 +583,7 @@ void __init lguest_arch_host_init(void)
45306 * it will be undisturbed when we switch. To change %cs and jump we
45307 * need this structure to feed to Intel's "lcall" instruction.
45308 */
45309 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
45310 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
45311 lguest_entry.segment = LGUEST_CS;
45312
45313 /*
45314 diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
45315 index 40634b0..4f5855e 100644
45316 --- a/drivers/lguest/x86/switcher_32.S
45317 +++ b/drivers/lguest/x86/switcher_32.S
45318 @@ -87,6 +87,7 @@
45319 #include <asm/page.h>
45320 #include <asm/segment.h>
45321 #include <asm/lguest.h>
45322 +#include <asm/processor-flags.h>
45323
45324 // We mark the start of the code to copy
45325 // It's placed in .text tho it's never run here
45326 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
45327 // Changes type when we load it: damn Intel!
45328 // For after we switch over our page tables
45329 // That entry will be read-only: we'd crash.
45330 +
45331 +#ifdef CONFIG_PAX_KERNEXEC
45332 + mov %cr0, %edx
45333 + xor $X86_CR0_WP, %edx
45334 + mov %edx, %cr0
45335 +#endif
45336 +
45337 movl $(GDT_ENTRY_TSS*8), %edx
45338 ltr %dx
45339
45340 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
45341 // Let's clear it again for our return.
45342 // The GDT descriptor of the Host
45343 // Points to the table after two "size" bytes
45344 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
45345 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
45346 // Clear "used" from type field (byte 5, bit 2)
45347 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
45348 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
45349 +
45350 +#ifdef CONFIG_PAX_KERNEXEC
45351 + mov %cr0, %eax
45352 + xor $X86_CR0_WP, %eax
45353 + mov %eax, %cr0
45354 +#endif
45355
45356 // Once our page table's switched, the Guest is live!
45357 // The Host fades as we run this final step.
45358 @@ -295,13 +309,12 @@ deliver_to_host:
45359 // I consulted gcc, and it gave
45360 // These instructions, which I gladly credit:
45361 leal (%edx,%ebx,8), %eax
45362 - movzwl (%eax),%edx
45363 - movl 4(%eax), %eax
45364 - xorw %ax, %ax
45365 - orl %eax, %edx
45366 + movl 4(%eax), %edx
45367 + movw (%eax), %dx
45368 // Now the address of the handler's in %edx
45369 // We call it now: its "iret" drops us home.
45370 - jmp *%edx
45371 + ljmp $__KERNEL_CS, $1f
45372 +1: jmp *%edx
45373
45374 // Every interrupt can come to us here
45375 // But we must truly tell each apart.
45376 diff --git a/drivers/md/bcache/closure.h b/drivers/md/bcache/closure.h
45377 index a08e3ee..df8ade2 100644
45378 --- a/drivers/md/bcache/closure.h
45379 +++ b/drivers/md/bcache/closure.h
45380 @@ -238,7 +238,7 @@ static inline void closure_set_stopped(struct closure *cl)
45381 static inline void set_closure_fn(struct closure *cl, closure_fn *fn,
45382 struct workqueue_struct *wq)
45383 {
45384 - BUG_ON(object_is_on_stack(cl));
45385 + BUG_ON(object_starts_on_stack(cl));
45386 closure_set_ip(cl);
45387 cl->fn = fn;
45388 cl->wq = wq;
45389 diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
45390 index 135a090..f7872f6 100644
45391 --- a/drivers/md/bitmap.c
45392 +++ b/drivers/md/bitmap.c
45393 @@ -1927,7 +1927,7 @@ void bitmap_status(struct seq_file *seq, struct bitmap *bitmap)
45394 chunk_kb ? "KB" : "B");
45395 if (bitmap->storage.file) {
45396 seq_printf(seq, ", file: ");
45397 - seq_path(seq, &bitmap->storage.file->f_path, " \t\n");
45398 + seq_path(seq, &bitmap->storage.file->f_path, " \t\n\\");
45399 }
45400
45401 seq_printf(seq, "\n");
45402 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
45403 index 720ceeb..030f1d4 100644
45404 --- a/drivers/md/dm-ioctl.c
45405 +++ b/drivers/md/dm-ioctl.c
45406 @@ -1773,7 +1773,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
45407 cmd == DM_LIST_VERSIONS_CMD)
45408 return 0;
45409
45410 - if ((cmd == DM_DEV_CREATE_CMD)) {
45411 + if (cmd == DM_DEV_CREATE_CMD) {
45412 if (!*param->name) {
45413 DMWARN("name not supplied when creating device");
45414 return -EINVAL;
45415 diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
45416 index 089d627..ef7352e 100644
45417 --- a/drivers/md/dm-raid1.c
45418 +++ b/drivers/md/dm-raid1.c
45419 @@ -40,7 +40,7 @@ enum dm_raid1_error {
45420
45421 struct mirror {
45422 struct mirror_set *ms;
45423 - atomic_t error_count;
45424 + atomic_unchecked_t error_count;
45425 unsigned long error_type;
45426 struct dm_dev *dev;
45427 sector_t offset;
45428 @@ -186,7 +186,7 @@ static struct mirror *get_valid_mirror(struct mirror_set *ms)
45429 struct mirror *m;
45430
45431 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
45432 - if (!atomic_read(&m->error_count))
45433 + if (!atomic_read_unchecked(&m->error_count))
45434 return m;
45435
45436 return NULL;
45437 @@ -218,7 +218,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
45438 * simple way to tell if a device has encountered
45439 * errors.
45440 */
45441 - atomic_inc(&m->error_count);
45442 + atomic_inc_unchecked(&m->error_count);
45443
45444 if (test_and_set_bit(error_type, &m->error_type))
45445 return;
45446 @@ -409,7 +409,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
45447 struct mirror *m = get_default_mirror(ms);
45448
45449 do {
45450 - if (likely(!atomic_read(&m->error_count)))
45451 + if (likely(!atomic_read_unchecked(&m->error_count)))
45452 return m;
45453
45454 if (m-- == ms->mirror)
45455 @@ -423,7 +423,7 @@ static int default_ok(struct mirror *m)
45456 {
45457 struct mirror *default_mirror = get_default_mirror(m->ms);
45458
45459 - return !atomic_read(&default_mirror->error_count);
45460 + return !atomic_read_unchecked(&default_mirror->error_count);
45461 }
45462
45463 static int mirror_available(struct mirror_set *ms, struct bio *bio)
45464 @@ -560,7 +560,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
45465 */
45466 if (likely(region_in_sync(ms, region, 1)))
45467 m = choose_mirror(ms, bio->bi_iter.bi_sector);
45468 - else if (m && atomic_read(&m->error_count))
45469 + else if (m && atomic_read_unchecked(&m->error_count))
45470 m = NULL;
45471
45472 if (likely(m))
45473 @@ -936,7 +936,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
45474 }
45475
45476 ms->mirror[mirror].ms = ms;
45477 - atomic_set(&(ms->mirror[mirror].error_count), 0);
45478 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
45479 ms->mirror[mirror].error_type = 0;
45480 ms->mirror[mirror].offset = offset;
45481
45482 @@ -1351,7 +1351,7 @@ static void mirror_resume(struct dm_target *ti)
45483 */
45484 static char device_status_char(struct mirror *m)
45485 {
45486 - if (!atomic_read(&(m->error_count)))
45487 + if (!atomic_read_unchecked(&(m->error_count)))
45488 return 'A';
45489
45490 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
45491 diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
45492 index f478a4c..4b8e5ef 100644
45493 --- a/drivers/md/dm-stats.c
45494 +++ b/drivers/md/dm-stats.c
45495 @@ -382,7 +382,7 @@ do_sync_free:
45496 synchronize_rcu_expedited();
45497 dm_stat_free(&s->rcu_head);
45498 } else {
45499 - ACCESS_ONCE(dm_stat_need_rcu_barrier) = 1;
45500 + ACCESS_ONCE_RW(dm_stat_need_rcu_barrier) = 1;
45501 call_rcu(&s->rcu_head, dm_stat_free);
45502 }
45503 return 0;
45504 @@ -554,8 +554,8 @@ void dm_stats_account_io(struct dm_stats *stats, unsigned long bi_rw,
45505 ((bi_rw & (REQ_WRITE | REQ_DISCARD)) ==
45506 (ACCESS_ONCE(last->last_rw) & (REQ_WRITE | REQ_DISCARD)))
45507 ));
45508 - ACCESS_ONCE(last->last_sector) = end_sector;
45509 - ACCESS_ONCE(last->last_rw) = bi_rw;
45510 + ACCESS_ONCE_RW(last->last_sector) = end_sector;
45511 + ACCESS_ONCE_RW(last->last_rw) = bi_rw;
45512 }
45513
45514 rcu_read_lock();
45515 diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
45516 index f8b37d4..5c5cafd 100644
45517 --- a/drivers/md/dm-stripe.c
45518 +++ b/drivers/md/dm-stripe.c
45519 @@ -21,7 +21,7 @@ struct stripe {
45520 struct dm_dev *dev;
45521 sector_t physical_start;
45522
45523 - atomic_t error_count;
45524 + atomic_unchecked_t error_count;
45525 };
45526
45527 struct stripe_c {
45528 @@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
45529 kfree(sc);
45530 return r;
45531 }
45532 - atomic_set(&(sc->stripe[i].error_count), 0);
45533 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
45534 }
45535
45536 ti->private = sc;
45537 @@ -332,7 +332,7 @@ static void stripe_status(struct dm_target *ti, status_type_t type,
45538 DMEMIT("%d ", sc->stripes);
45539 for (i = 0; i < sc->stripes; i++) {
45540 DMEMIT("%s ", sc->stripe[i].dev->name);
45541 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
45542 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
45543 'D' : 'A';
45544 }
45545 buffer[i] = '\0';
45546 @@ -377,8 +377,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio, int error)
45547 */
45548 for (i = 0; i < sc->stripes; i++)
45549 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
45550 - atomic_inc(&(sc->stripe[i].error_count));
45551 - if (atomic_read(&(sc->stripe[i].error_count)) <
45552 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
45553 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
45554 DM_IO_ERROR_THRESHOLD)
45555 schedule_work(&sc->trigger_event);
45556 }
45557 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
45558 index 16ba55a..31af906 100644
45559 --- a/drivers/md/dm-table.c
45560 +++ b/drivers/md/dm-table.c
45561 @@ -305,7 +305,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
45562 if (!dev_size)
45563 return 0;
45564
45565 - if ((start >= dev_size) || (start + len > dev_size)) {
45566 + if ((start >= dev_size) || (len > dev_size - start)) {
45567 DMWARN("%s: %s too small for target: "
45568 "start=%llu, len=%llu, dev_size=%llu",
45569 dm_device_name(ti->table->md), bdevname(bdev, b),
45570 diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
45571 index 79f6941..b33b4e0 100644
45572 --- a/drivers/md/dm-thin-metadata.c
45573 +++ b/drivers/md/dm-thin-metadata.c
45574 @@ -404,7 +404,7 @@ static void __setup_btree_details(struct dm_pool_metadata *pmd)
45575 {
45576 pmd->info.tm = pmd->tm;
45577 pmd->info.levels = 2;
45578 - pmd->info.value_type.context = pmd->data_sm;
45579 + pmd->info.value_type.context = (dm_space_map_no_const *)pmd->data_sm;
45580 pmd->info.value_type.size = sizeof(__le64);
45581 pmd->info.value_type.inc = data_block_inc;
45582 pmd->info.value_type.dec = data_block_dec;
45583 @@ -423,7 +423,7 @@ static void __setup_btree_details(struct dm_pool_metadata *pmd)
45584
45585 pmd->bl_info.tm = pmd->tm;
45586 pmd->bl_info.levels = 1;
45587 - pmd->bl_info.value_type.context = pmd->data_sm;
45588 + pmd->bl_info.value_type.context = (dm_space_map_no_const *)pmd->data_sm;
45589 pmd->bl_info.value_type.size = sizeof(__le64);
45590 pmd->bl_info.value_type.inc = data_block_inc;
45591 pmd->bl_info.value_type.dec = data_block_dec;
45592 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
45593 index 2caf492..0c0dcac 100644
45594 --- a/drivers/md/dm.c
45595 +++ b/drivers/md/dm.c
45596 @@ -191,9 +191,9 @@ struct mapped_device {
45597 /*
45598 * Event handling.
45599 */
45600 - atomic_t event_nr;
45601 + atomic_unchecked_t event_nr;
45602 wait_queue_head_t eventq;
45603 - atomic_t uevent_seq;
45604 + atomic_unchecked_t uevent_seq;
45605 struct list_head uevent_list;
45606 spinlock_t uevent_lock; /* Protect access to uevent_list */
45607
45608 @@ -2298,8 +2298,8 @@ static struct mapped_device *alloc_dev(int minor)
45609 spin_lock_init(&md->deferred_lock);
45610 atomic_set(&md->holders, 1);
45611 atomic_set(&md->open_count, 0);
45612 - atomic_set(&md->event_nr, 0);
45613 - atomic_set(&md->uevent_seq, 0);
45614 + atomic_set_unchecked(&md->event_nr, 0);
45615 + atomic_set_unchecked(&md->uevent_seq, 0);
45616 INIT_LIST_HEAD(&md->uevent_list);
45617 INIT_LIST_HEAD(&md->table_devices);
45618 spin_lock_init(&md->uevent_lock);
45619 @@ -2466,7 +2466,7 @@ static void event_callback(void *context)
45620
45621 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
45622
45623 - atomic_inc(&md->event_nr);
45624 + atomic_inc_unchecked(&md->event_nr);
45625 wake_up(&md->eventq);
45626 }
45627
45628 @@ -3465,18 +3465,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
45629
45630 uint32_t dm_next_uevent_seq(struct mapped_device *md)
45631 {
45632 - return atomic_add_return(1, &md->uevent_seq);
45633 + return atomic_add_return_unchecked(1, &md->uevent_seq);
45634 }
45635
45636 uint32_t dm_get_event_nr(struct mapped_device *md)
45637 {
45638 - return atomic_read(&md->event_nr);
45639 + return atomic_read_unchecked(&md->event_nr);
45640 }
45641
45642 int dm_wait_event(struct mapped_device *md, int event_nr)
45643 {
45644 return wait_event_interruptible(md->eventq,
45645 - (event_nr != atomic_read(&md->event_nr)));
45646 + (event_nr != atomic_read_unchecked(&md->event_nr)));
45647 }
45648
45649 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
45650 diff --git a/drivers/md/md.c b/drivers/md/md.c
45651 index 4dbed4a..bed2a6a 100644
45652 --- a/drivers/md/md.c
45653 +++ b/drivers/md/md.c
45654 @@ -197,10 +197,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
45655 * start build, activate spare
45656 */
45657 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
45658 -static atomic_t md_event_count;
45659 +static atomic_unchecked_t md_event_count;
45660 void md_new_event(struct mddev *mddev)
45661 {
45662 - atomic_inc(&md_event_count);
45663 + atomic_inc_unchecked(&md_event_count);
45664 wake_up(&md_event_waiters);
45665 }
45666 EXPORT_SYMBOL_GPL(md_new_event);
45667 @@ -210,7 +210,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
45668 */
45669 static void md_new_event_inintr(struct mddev *mddev)
45670 {
45671 - atomic_inc(&md_event_count);
45672 + atomic_inc_unchecked(&md_event_count);
45673 wake_up(&md_event_waiters);
45674 }
45675
45676 @@ -1449,7 +1449,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
45677 if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_RESHAPE_ACTIVE) &&
45678 (le32_to_cpu(sb->feature_map) & MD_FEATURE_NEW_OFFSET))
45679 rdev->new_data_offset += (s32)le32_to_cpu(sb->new_offset);
45680 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
45681 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
45682
45683 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
45684 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
45685 @@ -1700,7 +1700,7 @@ static void super_1_sync(struct mddev *mddev, struct md_rdev *rdev)
45686 else
45687 sb->resync_offset = cpu_to_le64(0);
45688
45689 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
45690 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
45691
45692 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
45693 sb->size = cpu_to_le64(mddev->dev_sectors);
45694 @@ -2624,7 +2624,7 @@ __ATTR_PREALLOC(state, S_IRUGO|S_IWUSR, state_show, state_store);
45695 static ssize_t
45696 errors_show(struct md_rdev *rdev, char *page)
45697 {
45698 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
45699 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
45700 }
45701
45702 static ssize_t
45703 @@ -2633,7 +2633,7 @@ errors_store(struct md_rdev *rdev, const char *buf, size_t len)
45704 char *e;
45705 unsigned long n = simple_strtoul(buf, &e, 10);
45706 if (*buf && (*e == 0 || *e == '\n')) {
45707 - atomic_set(&rdev->corrected_errors, n);
45708 + atomic_set_unchecked(&rdev->corrected_errors, n);
45709 return len;
45710 }
45711 return -EINVAL;
45712 @@ -3069,8 +3069,8 @@ int md_rdev_init(struct md_rdev *rdev)
45713 rdev->sb_loaded = 0;
45714 rdev->bb_page = NULL;
45715 atomic_set(&rdev->nr_pending, 0);
45716 - atomic_set(&rdev->read_errors, 0);
45717 - atomic_set(&rdev->corrected_errors, 0);
45718 + atomic_set_unchecked(&rdev->read_errors, 0);
45719 + atomic_set_unchecked(&rdev->corrected_errors, 0);
45720
45721 INIT_LIST_HEAD(&rdev->same_set);
45722 init_waitqueue_head(&rdev->blocked_wait);
45723 @@ -7232,7 +7232,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
45724
45725 spin_unlock(&pers_lock);
45726 seq_printf(seq, "\n");
45727 - seq->poll_event = atomic_read(&md_event_count);
45728 + seq->poll_event = atomic_read_unchecked(&md_event_count);
45729 return 0;
45730 }
45731 if (v == (void*)2) {
45732 @@ -7335,7 +7335,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
45733 return error;
45734
45735 seq = file->private_data;
45736 - seq->poll_event = atomic_read(&md_event_count);
45737 + seq->poll_event = atomic_read_unchecked(&md_event_count);
45738 return error;
45739 }
45740
45741 @@ -7352,7 +7352,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
45742 /* always allow read */
45743 mask = POLLIN | POLLRDNORM;
45744
45745 - if (seq->poll_event != atomic_read(&md_event_count))
45746 + if (seq->poll_event != atomic_read_unchecked(&md_event_count))
45747 mask |= POLLERR | POLLPRI;
45748 return mask;
45749 }
45750 @@ -7448,7 +7448,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
45751 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
45752 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
45753 (int)part_stat_read(&disk->part0, sectors[1]) -
45754 - atomic_read(&disk->sync_io);
45755 + atomic_read_unchecked(&disk->sync_io);
45756 /* sync IO will cause sync_io to increase before the disk_stats
45757 * as sync_io is counted when a request starts, and
45758 * disk_stats is counted when it completes.
45759 diff --git a/drivers/md/md.h b/drivers/md/md.h
45760 index 4046a6c..e2f2997 100644
45761 --- a/drivers/md/md.h
45762 +++ b/drivers/md/md.h
45763 @@ -95,13 +95,13 @@ struct md_rdev {
45764 * only maintained for arrays that
45765 * support hot removal
45766 */
45767 - atomic_t read_errors; /* number of consecutive read errors that
45768 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
45769 * we have tried to ignore.
45770 */
45771 struct timespec last_read_error; /* monotonic time since our
45772 * last read error
45773 */
45774 - atomic_t corrected_errors; /* number of corrected read errors,
45775 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
45776 * for reporting to userspace and storing
45777 * in superblock.
45778 */
45779 @@ -486,7 +486,7 @@ extern void mddev_unlock(struct mddev *mddev);
45780
45781 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
45782 {
45783 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
45784 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
45785 }
45786
45787 struct md_personality
45788 diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
45789 index e8a9042..35bd145 100644
45790 --- a/drivers/md/persistent-data/dm-space-map-metadata.c
45791 +++ b/drivers/md/persistent-data/dm-space-map-metadata.c
45792 @@ -683,7 +683,7 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
45793 * Flick into a mode where all blocks get allocated in the new area.
45794 */
45795 smm->begin = old_len;
45796 - memcpy(sm, &bootstrap_ops, sizeof(*sm));
45797 + memcpy((void *)sm, &bootstrap_ops, sizeof(*sm));
45798
45799 /*
45800 * Extend.
45801 @@ -714,7 +714,7 @@ out:
45802 /*
45803 * Switch back to normal behaviour.
45804 */
45805 - memcpy(sm, &ops, sizeof(*sm));
45806 + memcpy((void *)sm, &ops, sizeof(*sm));
45807 return r;
45808 }
45809
45810 diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h
45811 index 3e6d115..ffecdeb 100644
45812 --- a/drivers/md/persistent-data/dm-space-map.h
45813 +++ b/drivers/md/persistent-data/dm-space-map.h
45814 @@ -71,6 +71,7 @@ struct dm_space_map {
45815 dm_sm_threshold_fn fn,
45816 void *context);
45817 };
45818 +typedef struct dm_space_map __no_const dm_space_map_no_const;
45819
45820 /*----------------------------------------------------------------*/
45821
45822 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
45823 index 9157a29..0d462f0 100644
45824 --- a/drivers/md/raid1.c
45825 +++ b/drivers/md/raid1.c
45826 @@ -1934,7 +1934,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
45827 if (r1_sync_page_io(rdev, sect, s,
45828 bio->bi_io_vec[idx].bv_page,
45829 READ) != 0)
45830 - atomic_add(s, &rdev->corrected_errors);
45831 + atomic_add_unchecked(s, &rdev->corrected_errors);
45832 }
45833 sectors -= s;
45834 sect += s;
45835 @@ -2167,7 +2167,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
45836 !test_bit(Faulty, &rdev->flags)) {
45837 if (r1_sync_page_io(rdev, sect, s,
45838 conf->tmppage, READ)) {
45839 - atomic_add(s, &rdev->corrected_errors);
45840 + atomic_add_unchecked(s, &rdev->corrected_errors);
45841 printk(KERN_INFO
45842 "md/raid1:%s: read error corrected "
45843 "(%d sectors at %llu on %s)\n",
45844 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
45845 index f55c3f3..4cca8c8 100644
45846 --- a/drivers/md/raid10.c
45847 +++ b/drivers/md/raid10.c
45848 @@ -1934,7 +1934,7 @@ static void end_sync_read(struct bio *bio, int error)
45849 /* The write handler will notice the lack of
45850 * R10BIO_Uptodate and record any errors etc
45851 */
45852 - atomic_add(r10_bio->sectors,
45853 + atomic_add_unchecked(r10_bio->sectors,
45854 &conf->mirrors[d].rdev->corrected_errors);
45855
45856 /* for reconstruct, we always reschedule after a read.
45857 @@ -2291,7 +2291,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
45858 {
45859 struct timespec cur_time_mon;
45860 unsigned long hours_since_last;
45861 - unsigned int read_errors = atomic_read(&rdev->read_errors);
45862 + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
45863
45864 ktime_get_ts(&cur_time_mon);
45865
45866 @@ -2313,9 +2313,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
45867 * overflowing the shift of read_errors by hours_since_last.
45868 */
45869 if (hours_since_last >= 8 * sizeof(read_errors))
45870 - atomic_set(&rdev->read_errors, 0);
45871 + atomic_set_unchecked(&rdev->read_errors, 0);
45872 else
45873 - atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
45874 + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
45875 }
45876
45877 static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector,
45878 @@ -2369,8 +2369,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
45879 return;
45880
45881 check_decay_read_errors(mddev, rdev);
45882 - atomic_inc(&rdev->read_errors);
45883 - if (atomic_read(&rdev->read_errors) > max_read_errors) {
45884 + atomic_inc_unchecked(&rdev->read_errors);
45885 + if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
45886 char b[BDEVNAME_SIZE];
45887 bdevname(rdev->bdev, b);
45888
45889 @@ -2378,7 +2378,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
45890 "md/raid10:%s: %s: Raid device exceeded "
45891 "read_error threshold [cur %d:max %d]\n",
45892 mdname(mddev), b,
45893 - atomic_read(&rdev->read_errors), max_read_errors);
45894 + atomic_read_unchecked(&rdev->read_errors), max_read_errors);
45895 printk(KERN_NOTICE
45896 "md/raid10:%s: %s: Failing raid device\n",
45897 mdname(mddev), b);
45898 @@ -2533,7 +2533,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
45899 sect +
45900 choose_data_offset(r10_bio, rdev)),
45901 bdevname(rdev->bdev, b));
45902 - atomic_add(s, &rdev->corrected_errors);
45903 + atomic_add_unchecked(s, &rdev->corrected_errors);
45904 }
45905
45906 rdev_dec_pending(rdev, mddev);
45907 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
45908 index b6793d2..92be2bc 100644
45909 --- a/drivers/md/raid5.c
45910 +++ b/drivers/md/raid5.c
45911 @@ -1108,23 +1108,23 @@ async_copy_data(int frombio, struct bio *bio, struct page **page,
45912 struct bio_vec bvl;
45913 struct bvec_iter iter;
45914 struct page *bio_page;
45915 - int page_offset;
45916 + s64 page_offset;
45917 struct async_submit_ctl submit;
45918 enum async_tx_flags flags = 0;
45919
45920 if (bio->bi_iter.bi_sector >= sector)
45921 - page_offset = (signed)(bio->bi_iter.bi_sector - sector) * 512;
45922 + page_offset = (s64)(bio->bi_iter.bi_sector - sector) * 512;
45923 else
45924 - page_offset = (signed)(sector - bio->bi_iter.bi_sector) * -512;
45925 + page_offset = (s64)(sector - bio->bi_iter.bi_sector) * -512;
45926
45927 if (frombio)
45928 flags |= ASYNC_TX_FENCE;
45929 init_async_submit(&submit, flags, tx, NULL, NULL, NULL);
45930
45931 bio_for_each_segment(bvl, bio, iter) {
45932 - int len = bvl.bv_len;
45933 - int clen;
45934 - int b_offset = 0;
45935 + s64 len = bvl.bv_len;
45936 + s64 clen;
45937 + s64 b_offset = 0;
45938
45939 if (page_offset < 0) {
45940 b_offset = -page_offset;
45941 @@ -2017,6 +2017,10 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
45942 return 1;
45943 }
45944
45945 +#ifdef CONFIG_GRKERNSEC_HIDESYM
45946 +static atomic_unchecked_t raid5_cache_id = ATOMIC_INIT(0);
45947 +#endif
45948 +
45949 static int grow_stripes(struct r5conf *conf, int num)
45950 {
45951 struct kmem_cache *sc;
45952 @@ -2027,7 +2031,11 @@ static int grow_stripes(struct r5conf *conf, int num)
45953 "raid%d-%s", conf->level, mdname(conf->mddev));
45954 else
45955 sprintf(conf->cache_name[0],
45956 +#ifdef CONFIG_GRKERNSEC_HIDESYM
45957 + "raid%d-%08lx", conf->level, atomic_inc_return_unchecked(&raid5_cache_id));
45958 +#else
45959 "raid%d-%p", conf->level, conf->mddev);
45960 +#endif
45961 sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
45962
45963 conf->active_name = 0;
45964 @@ -2315,21 +2323,21 @@ static void raid5_end_read_request(struct bio * bi, int error)
45965 mdname(conf->mddev), STRIPE_SECTORS,
45966 (unsigned long long)s,
45967 bdevname(rdev->bdev, b));
45968 - atomic_add(STRIPE_SECTORS, &rdev->corrected_errors);
45969 + atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors);
45970 clear_bit(R5_ReadError, &sh->dev[i].flags);
45971 clear_bit(R5_ReWrite, &sh->dev[i].flags);
45972 } else if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
45973 clear_bit(R5_ReadNoMerge, &sh->dev[i].flags);
45974
45975 - if (atomic_read(&rdev->read_errors))
45976 - atomic_set(&rdev->read_errors, 0);
45977 + if (atomic_read_unchecked(&rdev->read_errors))
45978 + atomic_set_unchecked(&rdev->read_errors, 0);
45979 } else {
45980 const char *bdn = bdevname(rdev->bdev, b);
45981 int retry = 0;
45982 int set_bad = 0;
45983
45984 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
45985 - atomic_inc(&rdev->read_errors);
45986 + atomic_inc_unchecked(&rdev->read_errors);
45987 if (test_bit(R5_ReadRepl, &sh->dev[i].flags))
45988 printk_ratelimited(
45989 KERN_WARNING
45990 @@ -2357,7 +2365,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
45991 mdname(conf->mddev),
45992 (unsigned long long)s,
45993 bdn);
45994 - } else if (atomic_read(&rdev->read_errors)
45995 + } else if (atomic_read_unchecked(&rdev->read_errors)
45996 > conf->max_nr_stripes)
45997 printk(KERN_WARNING
45998 "md/raid:%s: Too many read errors, failing device %s.\n",
45999 diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
46000 index 13bb57f..0ca21b2 100644
46001 --- a/drivers/media/dvb-core/dvbdev.c
46002 +++ b/drivers/media/dvb-core/dvbdev.c
46003 @@ -272,7 +272,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
46004 const struct dvb_device *template, void *priv, int type)
46005 {
46006 struct dvb_device *dvbdev;
46007 - struct file_operations *dvbdevfops;
46008 + file_operations_no_const *dvbdevfops;
46009 struct device *clsdev;
46010 int minor;
46011 int id;
46012 diff --git a/drivers/media/dvb-frontends/af9033.h b/drivers/media/dvb-frontends/af9033.h
46013 index 6ad22b6..6e90e2a 100644
46014 --- a/drivers/media/dvb-frontends/af9033.h
46015 +++ b/drivers/media/dvb-frontends/af9033.h
46016 @@ -96,6 +96,6 @@ struct af9033_ops {
46017 int (*pid_filter_ctrl)(struct dvb_frontend *fe, int onoff);
46018 int (*pid_filter)(struct dvb_frontend *fe, int index, u16 pid,
46019 int onoff);
46020 -};
46021 +} __no_const;
46022
46023 #endif /* AF9033_H */
46024 diff --git a/drivers/media/dvb-frontends/dib3000.h b/drivers/media/dvb-frontends/dib3000.h
46025 index 6ae9899..07d8543 100644
46026 --- a/drivers/media/dvb-frontends/dib3000.h
46027 +++ b/drivers/media/dvb-frontends/dib3000.h
46028 @@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
46029 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
46030 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
46031 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
46032 -};
46033 +} __no_const;
46034
46035 #if IS_REACHABLE(CONFIG_DVB_DIB3000MB)
46036 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
46037 diff --git a/drivers/media/dvb-frontends/dib7000p.h b/drivers/media/dvb-frontends/dib7000p.h
46038 index baa2789..c8de7fe 100644
46039 --- a/drivers/media/dvb-frontends/dib7000p.h
46040 +++ b/drivers/media/dvb-frontends/dib7000p.h
46041 @@ -64,7 +64,7 @@ struct dib7000p_ops {
46042 int (*get_adc_power)(struct dvb_frontend *fe);
46043 int (*slave_reset)(struct dvb_frontend *fe);
46044 struct dvb_frontend *(*init)(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib7000p_config *cfg);
46045 -};
46046 +} __no_const;
46047
46048 #if IS_REACHABLE(CONFIG_DVB_DIB7000P)
46049 void *dib7000p_attach(struct dib7000p_ops *ops);
46050 diff --git a/drivers/media/dvb-frontends/dib8000.h b/drivers/media/dvb-frontends/dib8000.h
46051 index 780c37b..50e2620 100644
46052 --- a/drivers/media/dvb-frontends/dib8000.h
46053 +++ b/drivers/media/dvb-frontends/dib8000.h
46054 @@ -61,7 +61,7 @@ struct dib8000_ops {
46055 int (*pid_filter_ctrl)(struct dvb_frontend *fe, u8 onoff);
46056 int (*pid_filter)(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff);
46057 struct dvb_frontend *(*init)(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib8000_config *cfg);
46058 -};
46059 +} __no_const;
46060
46061 #if IS_REACHABLE(CONFIG_DVB_DIB8000)
46062 void *dib8000_attach(struct dib8000_ops *ops);
46063 diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
46064 index c9decd8..7849cec 100644
46065 --- a/drivers/media/pci/cx88/cx88-video.c
46066 +++ b/drivers/media/pci/cx88/cx88-video.c
46067 @@ -50,9 +50,9 @@ MODULE_VERSION(CX88_VERSION);
46068
46069 /* ------------------------------------------------------------------ */
46070
46071 -static unsigned int video_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
46072 -static unsigned int vbi_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
46073 -static unsigned int radio_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
46074 +static int video_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
46075 +static int vbi_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
46076 +static int radio_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
46077
46078 module_param_array(video_nr, int, NULL, 0444);
46079 module_param_array(vbi_nr, int, NULL, 0444);
46080 diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
46081 index c2e60b4..5eeccc0 100644
46082 --- a/drivers/media/pci/ivtv/ivtv-driver.c
46083 +++ b/drivers/media/pci/ivtv/ivtv-driver.c
46084 @@ -83,7 +83,7 @@ static struct pci_device_id ivtv_pci_tbl[] = {
46085 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
46086
46087 /* ivtv instance counter */
46088 -static atomic_t ivtv_instance = ATOMIC_INIT(0);
46089 +static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
46090
46091 /* Parameter declarations */
46092 static int cardtype[IVTV_MAX_CARDS];
46093 diff --git a/drivers/media/pci/solo6x10/solo6x10-core.c b/drivers/media/pci/solo6x10/solo6x10-core.c
46094 index 570d119..ed25830 100644
46095 --- a/drivers/media/pci/solo6x10/solo6x10-core.c
46096 +++ b/drivers/media/pci/solo6x10/solo6x10-core.c
46097 @@ -424,7 +424,7 @@ static void solo_device_release(struct device *dev)
46098
46099 static int solo_sysfs_init(struct solo_dev *solo_dev)
46100 {
46101 - struct bin_attribute *sdram_attr = &solo_dev->sdram_attr;
46102 + bin_attribute_no_const *sdram_attr = &solo_dev->sdram_attr;
46103 struct device *dev = &solo_dev->dev;
46104 const char *driver;
46105 int i;
46106 diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
46107 index 7ddc767..1c24361 100644
46108 --- a/drivers/media/pci/solo6x10/solo6x10-g723.c
46109 +++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
46110 @@ -351,7 +351,7 @@ static int solo_snd_pcm_init(struct solo_dev *solo_dev)
46111
46112 int solo_g723_init(struct solo_dev *solo_dev)
46113 {
46114 - static struct snd_device_ops ops = { NULL };
46115 + static struct snd_device_ops ops = { };
46116 struct snd_card *card;
46117 struct snd_kcontrol_new kctl;
46118 char name[32];
46119 diff --git a/drivers/media/pci/solo6x10/solo6x10-p2m.c b/drivers/media/pci/solo6x10/solo6x10-p2m.c
46120 index 8c84846..27b4f83 100644
46121 --- a/drivers/media/pci/solo6x10/solo6x10-p2m.c
46122 +++ b/drivers/media/pci/solo6x10/solo6x10-p2m.c
46123 @@ -73,7 +73,7 @@ int solo_p2m_dma_desc(struct solo_dev *solo_dev,
46124
46125 /* Get next ID. According to Softlogic, 6110 has problems on !=0 P2M */
46126 if (solo_dev->type != SOLO_DEV_6110 && multi_p2m) {
46127 - p2m_id = atomic_inc_return(&solo_dev->p2m_count) % SOLO_NR_P2M;
46128 + p2m_id = atomic_inc_return_unchecked(&solo_dev->p2m_count) % SOLO_NR_P2M;
46129 if (p2m_id < 0)
46130 p2m_id = -p2m_id;
46131 }
46132 diff --git a/drivers/media/pci/solo6x10/solo6x10.h b/drivers/media/pci/solo6x10/solo6x10.h
46133 index 1ca54b0..7d7cb9a 100644
46134 --- a/drivers/media/pci/solo6x10/solo6x10.h
46135 +++ b/drivers/media/pci/solo6x10/solo6x10.h
46136 @@ -218,7 +218,7 @@ struct solo_dev {
46137
46138 /* P2M DMA Engine */
46139 struct solo_p2m_dev p2m_dev[SOLO_NR_P2M];
46140 - atomic_t p2m_count;
46141 + atomic_unchecked_t p2m_count;
46142 int p2m_jiffies;
46143 unsigned int p2m_timeouts;
46144
46145 diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
46146 index c135165..dc69499 100644
46147 --- a/drivers/media/pci/tw68/tw68-core.c
46148 +++ b/drivers/media/pci/tw68/tw68-core.c
46149 @@ -60,7 +60,7 @@ static unsigned int card[] = {[0 ... (TW68_MAXBOARDS - 1)] = UNSET };
46150 module_param_array(card, int, NULL, 0444);
46151 MODULE_PARM_DESC(card, "card type");
46152
46153 -static atomic_t tw68_instance = ATOMIC_INIT(0);
46154 +static atomic_unchecked_t tw68_instance = ATOMIC_INIT(0);
46155
46156 /* ------------------------------------------------------------------ */
46157
46158 diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
46159 index 17b189a..b78aa6b 100644
46160 --- a/drivers/media/platform/omap/omap_vout.c
46161 +++ b/drivers/media/platform/omap/omap_vout.c
46162 @@ -63,7 +63,6 @@ enum omap_vout_channels {
46163 OMAP_VIDEO2,
46164 };
46165
46166 -static struct videobuf_queue_ops video_vbq_ops;
46167 /* Variables configurable through module params*/
46168 static u32 video1_numbuffers = 3;
46169 static u32 video2_numbuffers = 3;
46170 @@ -1012,6 +1011,12 @@ static int omap_vout_open(struct file *file)
46171 {
46172 struct videobuf_queue *q;
46173 struct omap_vout_device *vout = NULL;
46174 + static struct videobuf_queue_ops video_vbq_ops = {
46175 + .buf_setup = omap_vout_buffer_setup,
46176 + .buf_prepare = omap_vout_buffer_prepare,
46177 + .buf_release = omap_vout_buffer_release,
46178 + .buf_queue = omap_vout_buffer_queue,
46179 + };
46180
46181 vout = video_drvdata(file);
46182 v4l2_dbg(1, debug, &vout->vid_dev->v4l2_dev, "Entering %s\n", __func__);
46183 @@ -1029,10 +1034,6 @@ static int omap_vout_open(struct file *file)
46184 vout->type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
46185
46186 q = &vout->vbq;
46187 - video_vbq_ops.buf_setup = omap_vout_buffer_setup;
46188 - video_vbq_ops.buf_prepare = omap_vout_buffer_prepare;
46189 - video_vbq_ops.buf_release = omap_vout_buffer_release;
46190 - video_vbq_ops.buf_queue = omap_vout_buffer_queue;
46191 spin_lock_init(&vout->vbq_lock);
46192
46193 videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev,
46194 diff --git a/drivers/media/platform/s5p-tv/mixer.h b/drivers/media/platform/s5p-tv/mixer.h
46195 index fb2acc5..a2fcbdc4 100644
46196 --- a/drivers/media/platform/s5p-tv/mixer.h
46197 +++ b/drivers/media/platform/s5p-tv/mixer.h
46198 @@ -156,7 +156,7 @@ struct mxr_layer {
46199 /** layer index (unique identifier) */
46200 int idx;
46201 /** callbacks for layer methods */
46202 - struct mxr_layer_ops ops;
46203 + struct mxr_layer_ops *ops;
46204 /** format array */
46205 const struct mxr_format **fmt_array;
46206 /** size of format array */
46207 diff --git a/drivers/media/platform/s5p-tv/mixer_grp_layer.c b/drivers/media/platform/s5p-tv/mixer_grp_layer.c
46208 index 74344c7..a39e70e 100644
46209 --- a/drivers/media/platform/s5p-tv/mixer_grp_layer.c
46210 +++ b/drivers/media/platform/s5p-tv/mixer_grp_layer.c
46211 @@ -235,7 +235,7 @@ struct mxr_layer *mxr_graph_layer_create(struct mxr_device *mdev, int idx)
46212 {
46213 struct mxr_layer *layer;
46214 int ret;
46215 - struct mxr_layer_ops ops = {
46216 + static struct mxr_layer_ops ops = {
46217 .release = mxr_graph_layer_release,
46218 .buffer_set = mxr_graph_buffer_set,
46219 .stream_set = mxr_graph_stream_set,
46220 diff --git a/drivers/media/platform/s5p-tv/mixer_reg.c b/drivers/media/platform/s5p-tv/mixer_reg.c
46221 index b713403..53cb5ad 100644
46222 --- a/drivers/media/platform/s5p-tv/mixer_reg.c
46223 +++ b/drivers/media/platform/s5p-tv/mixer_reg.c
46224 @@ -276,7 +276,7 @@ static void mxr_irq_layer_handle(struct mxr_layer *layer)
46225 layer->update_buf = next;
46226 }
46227
46228 - layer->ops.buffer_set(layer, layer->update_buf);
46229 + layer->ops->buffer_set(layer, layer->update_buf);
46230
46231 if (done && done != layer->shadow_buf)
46232 vb2_buffer_done(&done->vb, VB2_BUF_STATE_DONE);
46233 diff --git a/drivers/media/platform/s5p-tv/mixer_video.c b/drivers/media/platform/s5p-tv/mixer_video.c
46234 index 751f3b6..d829203 100644
46235 --- a/drivers/media/platform/s5p-tv/mixer_video.c
46236 +++ b/drivers/media/platform/s5p-tv/mixer_video.c
46237 @@ -210,7 +210,7 @@ static void mxr_layer_default_geo(struct mxr_layer *layer)
46238 layer->geo.src.height = layer->geo.src.full_height;
46239
46240 mxr_geometry_dump(mdev, &layer->geo);
46241 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
46242 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
46243 mxr_geometry_dump(mdev, &layer->geo);
46244 }
46245
46246 @@ -228,7 +228,7 @@ static void mxr_layer_update_output(struct mxr_layer *layer)
46247 layer->geo.dst.full_width = mbus_fmt.width;
46248 layer->geo.dst.full_height = mbus_fmt.height;
46249 layer->geo.dst.field = mbus_fmt.field;
46250 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
46251 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
46252
46253 mxr_geometry_dump(mdev, &layer->geo);
46254 }
46255 @@ -334,7 +334,7 @@ static int mxr_s_fmt(struct file *file, void *priv,
46256 /* set source size to highest accepted value */
46257 geo->src.full_width = max(geo->dst.full_width, pix->width);
46258 geo->src.full_height = max(geo->dst.full_height, pix->height);
46259 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
46260 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
46261 mxr_geometry_dump(mdev, &layer->geo);
46262 /* set cropping to total visible screen */
46263 geo->src.width = pix->width;
46264 @@ -342,12 +342,12 @@ static int mxr_s_fmt(struct file *file, void *priv,
46265 geo->src.x_offset = 0;
46266 geo->src.y_offset = 0;
46267 /* assure consistency of geometry */
46268 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_CROP, MXR_NO_OFFSET);
46269 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_CROP, MXR_NO_OFFSET);
46270 mxr_geometry_dump(mdev, &layer->geo);
46271 /* set full size to lowest possible value */
46272 geo->src.full_width = 0;
46273 geo->src.full_height = 0;
46274 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
46275 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
46276 mxr_geometry_dump(mdev, &layer->geo);
46277
46278 /* returning results */
46279 @@ -474,7 +474,7 @@ static int mxr_s_selection(struct file *file, void *fh,
46280 target->width = s->r.width;
46281 target->height = s->r.height;
46282
46283 - layer->ops.fix_geometry(layer, stage, s->flags);
46284 + layer->ops->fix_geometry(layer, stage, s->flags);
46285
46286 /* retrieve update selection rectangle */
46287 res.left = target->x_offset;
46288 @@ -938,13 +938,13 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
46289 mxr_output_get(mdev);
46290
46291 mxr_layer_update_output(layer);
46292 - layer->ops.format_set(layer);
46293 + layer->ops->format_set(layer);
46294 /* enabling layer in hardware */
46295 spin_lock_irqsave(&layer->enq_slock, flags);
46296 layer->state = MXR_LAYER_STREAMING;
46297 spin_unlock_irqrestore(&layer->enq_slock, flags);
46298
46299 - layer->ops.stream_set(layer, MXR_ENABLE);
46300 + layer->ops->stream_set(layer, MXR_ENABLE);
46301 mxr_streamer_get(mdev);
46302
46303 return 0;
46304 @@ -1014,7 +1014,7 @@ static void stop_streaming(struct vb2_queue *vq)
46305 spin_unlock_irqrestore(&layer->enq_slock, flags);
46306
46307 /* disabling layer in hardware */
46308 - layer->ops.stream_set(layer, MXR_DISABLE);
46309 + layer->ops->stream_set(layer, MXR_DISABLE);
46310 /* remove one streamer */
46311 mxr_streamer_put(mdev);
46312 /* allow changes in output configuration */
46313 @@ -1052,8 +1052,8 @@ void mxr_base_layer_unregister(struct mxr_layer *layer)
46314
46315 void mxr_layer_release(struct mxr_layer *layer)
46316 {
46317 - if (layer->ops.release)
46318 - layer->ops.release(layer);
46319 + if (layer->ops->release)
46320 + layer->ops->release(layer);
46321 }
46322
46323 void mxr_base_layer_release(struct mxr_layer *layer)
46324 @@ -1079,7 +1079,7 @@ struct mxr_layer *mxr_base_layer_create(struct mxr_device *mdev,
46325
46326 layer->mdev = mdev;
46327 layer->idx = idx;
46328 - layer->ops = *ops;
46329 + layer->ops = ops;
46330
46331 spin_lock_init(&layer->enq_slock);
46332 INIT_LIST_HEAD(&layer->enq_list);
46333 diff --git a/drivers/media/platform/s5p-tv/mixer_vp_layer.c b/drivers/media/platform/s5p-tv/mixer_vp_layer.c
46334 index c9388c4..ce71ece 100644
46335 --- a/drivers/media/platform/s5p-tv/mixer_vp_layer.c
46336 +++ b/drivers/media/platform/s5p-tv/mixer_vp_layer.c
46337 @@ -206,7 +206,7 @@ struct mxr_layer *mxr_vp_layer_create(struct mxr_device *mdev, int idx)
46338 {
46339 struct mxr_layer *layer;
46340 int ret;
46341 - struct mxr_layer_ops ops = {
46342 + static struct mxr_layer_ops ops = {
46343 .release = mxr_vp_layer_release,
46344 .buffer_set = mxr_vp_buffer_set,
46345 .stream_set = mxr_vp_stream_set,
46346 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
46347 index 82affae..42833ec 100644
46348 --- a/drivers/media/radio/radio-cadet.c
46349 +++ b/drivers/media/radio/radio-cadet.c
46350 @@ -333,6 +333,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
46351 unsigned char readbuf[RDS_BUFFER];
46352 int i = 0;
46353
46354 + if (count > RDS_BUFFER)
46355 + return -EFAULT;
46356 mutex_lock(&dev->lock);
46357 if (dev->rdsstat == 0)
46358 cadet_start_rds(dev);
46359 @@ -349,8 +351,9 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
46360 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
46361 mutex_unlock(&dev->lock);
46362
46363 - if (i && copy_to_user(data, readbuf, i))
46364 - return -EFAULT;
46365 + if (i > sizeof(readbuf) || (i && copy_to_user(data, readbuf, i)))
46366 + i = -EFAULT;
46367 +
46368 return i;
46369 }
46370
46371 diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
46372 index 5236035..c622c74 100644
46373 --- a/drivers/media/radio/radio-maxiradio.c
46374 +++ b/drivers/media/radio/radio-maxiradio.c
46375 @@ -61,7 +61,7 @@ MODULE_PARM_DESC(radio_nr, "Radio device number");
46376 /* TEA5757 pin mappings */
46377 static const int clk = 1, data = 2, wren = 4, mo_st = 8, power = 16;
46378
46379 -static atomic_t maxiradio_instance = ATOMIC_INIT(0);
46380 +static atomic_unchecked_t maxiradio_instance = ATOMIC_INIT(0);
46381
46382 #define PCI_VENDOR_ID_GUILLEMOT 0x5046
46383 #define PCI_DEVICE_ID_GUILLEMOT_MAXIRADIO 0x1001
46384 diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
46385 index 050b3bb..79f62b9 100644
46386 --- a/drivers/media/radio/radio-shark.c
46387 +++ b/drivers/media/radio/radio-shark.c
46388 @@ -79,7 +79,7 @@ struct shark_device {
46389 u32 last_val;
46390 };
46391
46392 -static atomic_t shark_instance = ATOMIC_INIT(0);
46393 +static atomic_unchecked_t shark_instance = ATOMIC_INIT(0);
46394
46395 static void shark_write_val(struct snd_tea575x *tea, u32 val)
46396 {
46397 diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
46398 index 8654e0d..0608a64 100644
46399 --- a/drivers/media/radio/radio-shark2.c
46400 +++ b/drivers/media/radio/radio-shark2.c
46401 @@ -74,7 +74,7 @@ struct shark_device {
46402 u8 *transfer_buffer;
46403 };
46404
46405 -static atomic_t shark_instance = ATOMIC_INIT(0);
46406 +static atomic_unchecked_t shark_instance = ATOMIC_INIT(0);
46407
46408 static int shark_write_reg(struct radio_tea5777 *tea, u64 reg)
46409 {
46410 diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
46411 index dccf586..d5db411 100644
46412 --- a/drivers/media/radio/radio-si476x.c
46413 +++ b/drivers/media/radio/radio-si476x.c
46414 @@ -1445,7 +1445,7 @@ static int si476x_radio_probe(struct platform_device *pdev)
46415 struct si476x_radio *radio;
46416 struct v4l2_ctrl *ctrl;
46417
46418 - static atomic_t instance = ATOMIC_INIT(0);
46419 + static atomic_unchecked_t instance = ATOMIC_INIT(0);
46420
46421 radio = devm_kzalloc(&pdev->dev, sizeof(*radio), GFP_KERNEL);
46422 if (!radio)
46423 diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
46424 index 704397f..4d05977 100644
46425 --- a/drivers/media/radio/wl128x/fmdrv_common.c
46426 +++ b/drivers/media/radio/wl128x/fmdrv_common.c
46427 @@ -71,7 +71,7 @@ module_param(default_rds_buf, uint, 0444);
46428 MODULE_PARM_DESC(rds_buf, "RDS buffer entries");
46429
46430 /* Radio Nr */
46431 -static u32 radio_nr = -1;
46432 +static int radio_nr = -1;
46433 module_param(radio_nr, int, 0444);
46434 MODULE_PARM_DESC(radio_nr, "Radio Nr");
46435
46436 diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c
46437 index 9fd1527..8927230 100644
46438 --- a/drivers/media/usb/dvb-usb/cinergyT2-core.c
46439 +++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c
46440 @@ -50,29 +50,73 @@ static struct dvb_usb_device_properties cinergyt2_properties;
46441
46442 static int cinergyt2_streaming_ctrl(struct dvb_usb_adapter *adap, int enable)
46443 {
46444 - char buf[] = { CINERGYT2_EP1_CONTROL_STREAM_TRANSFER, enable ? 1 : 0 };
46445 - char result[64];
46446 - return dvb_usb_generic_rw(adap->dev, buf, sizeof(buf), result,
46447 - sizeof(result), 0);
46448 + char *buf;
46449 + char *result;
46450 + int retval;
46451 +
46452 + buf = kmalloc(2, GFP_KERNEL);
46453 + if (buf == NULL)
46454 + return -ENOMEM;
46455 + result = kmalloc(64, GFP_KERNEL);
46456 + if (result == NULL) {
46457 + kfree(buf);
46458 + return -ENOMEM;
46459 + }
46460 +
46461 + buf[0] = CINERGYT2_EP1_CONTROL_STREAM_TRANSFER;
46462 + buf[1] = enable ? 1 : 0;
46463 +
46464 + retval = dvb_usb_generic_rw(adap->dev, buf, 2, result, 64, 0);
46465 +
46466 + kfree(buf);
46467 + kfree(result);
46468 + return retval;
46469 }
46470
46471 static int cinergyt2_power_ctrl(struct dvb_usb_device *d, int enable)
46472 {
46473 - char buf[] = { CINERGYT2_EP1_SLEEP_MODE, enable ? 0 : 1 };
46474 - char state[3];
46475 - return dvb_usb_generic_rw(d, buf, sizeof(buf), state, sizeof(state), 0);
46476 + char *buf;
46477 + char *state;
46478 + int retval;
46479 +
46480 + buf = kmalloc(2, GFP_KERNEL);
46481 + if (buf == NULL)
46482 + return -ENOMEM;
46483 + state = kmalloc(3, GFP_KERNEL);
46484 + if (state == NULL) {
46485 + kfree(buf);
46486 + return -ENOMEM;
46487 + }
46488 +
46489 + buf[0] = CINERGYT2_EP1_SLEEP_MODE;
46490 + buf[1] = enable ? 1 : 0;
46491 +
46492 + retval = dvb_usb_generic_rw(d, buf, 2, state, 3, 0);
46493 +
46494 + kfree(buf);
46495 + kfree(state);
46496 + return retval;
46497 }
46498
46499 static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap)
46500 {
46501 - char query[] = { CINERGYT2_EP1_GET_FIRMWARE_VERSION };
46502 - char state[3];
46503 + char *query;
46504 + char *state;
46505 int ret;
46506 + query = kmalloc(1, GFP_KERNEL);
46507 + if (query == NULL)
46508 + return -ENOMEM;
46509 + state = kmalloc(3, GFP_KERNEL);
46510 + if (state == NULL) {
46511 + kfree(query);
46512 + return -ENOMEM;
46513 + }
46514 +
46515 + query[0] = CINERGYT2_EP1_GET_FIRMWARE_VERSION;
46516
46517 adap->fe_adap[0].fe = cinergyt2_fe_attach(adap->dev);
46518
46519 - ret = dvb_usb_generic_rw(adap->dev, query, sizeof(query), state,
46520 - sizeof(state), 0);
46521 + ret = dvb_usb_generic_rw(adap->dev, query, 1, state, 3, 0);
46522 if (ret < 0) {
46523 deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep "
46524 "state info\n");
46525 @@ -80,7 +124,8 @@ static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap)
46526
46527 /* Copy this pointer as we are gonna need it in the release phase */
46528 cinergyt2_usb_device = adap->dev;
46529 -
46530 + kfree(query);
46531 + kfree(state);
46532 return 0;
46533 }
46534
46535 @@ -141,12 +186,23 @@ static int repeatable_keys[] = {
46536 static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
46537 {
46538 struct cinergyt2_state *st = d->priv;
46539 - u8 key[5] = {0, 0, 0, 0, 0}, cmd = CINERGYT2_EP1_GET_RC_EVENTS;
46540 + u8 *key, *cmd;
46541 int i;
46542
46543 + cmd = kmalloc(1, GFP_KERNEL);
46544 + if (cmd == NULL)
46545 + return -EINVAL;
46546 + key = kzalloc(5, GFP_KERNEL);
46547 + if (key == NULL) {
46548 + kfree(cmd);
46549 + return -EINVAL;
46550 + }
46551 +
46552 + cmd[0] = CINERGYT2_EP1_GET_RC_EVENTS;
46553 +
46554 *state = REMOTE_NO_KEY_PRESSED;
46555
46556 - dvb_usb_generic_rw(d, &cmd, 1, key, sizeof(key), 0);
46557 + dvb_usb_generic_rw(d, cmd, 1, key, 5, 0);
46558 if (key[4] == 0xff) {
46559 /* key repeat */
46560 st->rc_counter++;
46561 @@ -157,12 +213,12 @@ static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
46562 *event = d->last_event;
46563 deb_rc("repeat key, event %x\n",
46564 *event);
46565 - return 0;
46566 + goto out;
46567 }
46568 }
46569 deb_rc("repeated key (non repeatable)\n");
46570 }
46571 - return 0;
46572 + goto out;
46573 }
46574
46575 /* hack to pass checksum on the custom field */
46576 @@ -174,6 +230,9 @@ static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
46577
46578 deb_rc("key: %*ph\n", 5, key);
46579 }
46580 +out:
46581 + kfree(cmd);
46582 + kfree(key);
46583 return 0;
46584 }
46585
46586 diff --git a/drivers/media/usb/dvb-usb/cinergyT2-fe.c b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
46587 index c890fe4..f9b2ae6 100644
46588 --- a/drivers/media/usb/dvb-usb/cinergyT2-fe.c
46589 +++ b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
46590 @@ -145,103 +145,176 @@ static int cinergyt2_fe_read_status(struct dvb_frontend *fe,
46591 fe_status_t *status)
46592 {
46593 struct cinergyt2_fe_state *state = fe->demodulator_priv;
46594 - struct dvbt_get_status_msg result;
46595 - u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
46596 + struct dvbt_get_status_msg *result;
46597 + u8 *cmd;
46598 int ret;
46599
46600 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&result,
46601 - sizeof(result), 0);
46602 + cmd = kmalloc(1, GFP_KERNEL);
46603 + if (cmd == NULL)
46604 + return -ENOMEM;
46605 + result = kmalloc(sizeof(*result), GFP_KERNEL);
46606 + if (result == NULL) {
46607 + kfree(cmd);
46608 + return -ENOMEM;
46609 + }
46610 +
46611 + cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS;
46612 +
46613 + ret = dvb_usb_generic_rw(state->d, cmd, 1, (u8 *)result,
46614 + sizeof(*result), 0);
46615 if (ret < 0)
46616 - return ret;
46617 + goto out;
46618
46619 *status = 0;
46620
46621 - if (0xffff - le16_to_cpu(result.gain) > 30)
46622 + if (0xffff - le16_to_cpu(result->gain) > 30)
46623 *status |= FE_HAS_SIGNAL;
46624 - if (result.lock_bits & (1 << 6))
46625 + if (result->lock_bits & (1 << 6))
46626 *status |= FE_HAS_LOCK;
46627 - if (result.lock_bits & (1 << 5))
46628 + if (result->lock_bits & (1 << 5))
46629 *status |= FE_HAS_SYNC;
46630 - if (result.lock_bits & (1 << 4))
46631 + if (result->lock_bits & (1 << 4))
46632 *status |= FE_HAS_CARRIER;
46633 - if (result.lock_bits & (1 << 1))
46634 + if (result->lock_bits & (1 << 1))
46635 *status |= FE_HAS_VITERBI;
46636
46637 if ((*status & (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) !=
46638 (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC))
46639 *status &= ~FE_HAS_LOCK;
46640
46641 - return 0;
46642 +out:
46643 + kfree(cmd);
46644 + kfree(result);
46645 + return ret;
46646 }
46647
46648 static int cinergyt2_fe_read_ber(struct dvb_frontend *fe, u32 *ber)
46649 {
46650 struct cinergyt2_fe_state *state = fe->demodulator_priv;
46651 - struct dvbt_get_status_msg status;
46652 - char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
46653 + struct dvbt_get_status_msg *status;
46654 + char *cmd;
46655 int ret;
46656
46657 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
46658 - sizeof(status), 0);
46659 + cmd = kmalloc(1, GFP_KERNEL);
46660 + if (cmd == NULL)
46661 + return -ENOMEM;
46662 + status = kmalloc(sizeof(*status), GFP_KERNEL);
46663 + if (status == NULL) {
46664 + kfree(cmd);
46665 + return -ENOMEM;
46666 + }
46667 +
46668 + cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS;
46669 +
46670 + ret = dvb_usb_generic_rw(state->d, cmd, 1, (char *)status,
46671 + sizeof(*status), 0);
46672 if (ret < 0)
46673 - return ret;
46674 + goto out;
46675
46676 - *ber = le32_to_cpu(status.viterbi_error_rate);
46677 + *ber = le32_to_cpu(status->viterbi_error_rate);
46678 +out:
46679 + kfree(cmd);
46680 + kfree(status);
46681 return 0;
46682 }
46683
46684 static int cinergyt2_fe_read_unc_blocks(struct dvb_frontend *fe, u32 *unc)
46685 {
46686 struct cinergyt2_fe_state *state = fe->demodulator_priv;
46687 - struct dvbt_get_status_msg status;
46688 - u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
46689 + struct dvbt_get_status_msg *status;
46690 + u8 *cmd;
46691 int ret;
46692
46693 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&status,
46694 - sizeof(status), 0);
46695 + cmd = kmalloc(1, GFP_KERNEL);
46696 + if (cmd == NULL)
46697 + return -ENOMEM;
46698 + status = kmalloc(sizeof(*status), GFP_KERNEL);
46699 + if (status == NULL) {
46700 + kfree(cmd);
46701 + return -ENOMEM;
46702 + }
46703 +
46704 + cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS;
46705 +
46706 + ret = dvb_usb_generic_rw(state->d, cmd, 1, (u8 *)status,
46707 + sizeof(*status), 0);
46708 if (ret < 0) {
46709 err("cinergyt2_fe_read_unc_blocks() Failed! (Error=%d)\n",
46710 ret);
46711 - return ret;
46712 + goto out;
46713 }
46714 - *unc = le32_to_cpu(status.uncorrected_block_count);
46715 - return 0;
46716 + *unc = le32_to_cpu(status->uncorrected_block_count);
46717 +
46718 +out:
46719 + kfree(cmd);
46720 + kfree(status);
46721 + return ret;
46722 }
46723
46724 static int cinergyt2_fe_read_signal_strength(struct dvb_frontend *fe,
46725 u16 *strength)
46726 {
46727 struct cinergyt2_fe_state *state = fe->demodulator_priv;
46728 - struct dvbt_get_status_msg status;
46729 - char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
46730 + struct dvbt_get_status_msg *status;
46731 + char *cmd;
46732 int ret;
46733
46734 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
46735 - sizeof(status), 0);
46736 + cmd = kmalloc(1, GFP_KERNEL);
46737 + if (cmd == NULL)
46738 + return -ENOMEM;
46739 + status = kmalloc(sizeof(*status), GFP_KERNEL);
46740 + if (status == NULL) {
46741 + kfree(cmd);
46742 + return -ENOMEM;
46743 + }
46744 +
46745 + cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS;
46746 +
46747 + ret = dvb_usb_generic_rw(state->d, cmd, 1, (char *)status,
46748 + sizeof(*status), 0);
46749 if (ret < 0) {
46750 err("cinergyt2_fe_read_signal_strength() Failed!"
46751 " (Error=%d)\n", ret);
46752 - return ret;
46753 + goto out;
46754 }
46755 - *strength = (0xffff - le16_to_cpu(status.gain));
46756 + *strength = (0xffff - le16_to_cpu(status->gain));
46757 +
46758 +out:
46759 + kfree(cmd);
46760 + kfree(status);
46761 return 0;
46762 }
46763
46764 static int cinergyt2_fe_read_snr(struct dvb_frontend *fe, u16 *snr)
46765 {
46766 struct cinergyt2_fe_state *state = fe->demodulator_priv;
46767 - struct dvbt_get_status_msg status;
46768 - char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
46769 + struct dvbt_get_status_msg *status;
46770 + char *cmd;
46771 int ret;
46772
46773 - ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
46774 - sizeof(status), 0);
46775 + cmd = kmalloc(1, GFP_KERNEL);
46776 + if (cmd == NULL)
46777 + return -ENOMEM;
46778 + status = kmalloc(sizeof(*status), GFP_KERNEL);
46779 + if (status == NULL) {
46780 + kfree(cmd);
46781 + return -ENOMEM;
46782 + }
46783 +
46784 + cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS;
46785 +
46786 + ret = dvb_usb_generic_rw(state->d, cmd, 1, (char *)status,
46787 + sizeof(*status), 0);
46788 if (ret < 0) {
46789 err("cinergyt2_fe_read_snr() Failed! (Error=%d)\n", ret);
46790 - return ret;
46791 + goto out;
46792 }
46793 - *snr = (status.snr << 8) | status.snr;
46794 - return 0;
46795 + *snr = (status->snr << 8) | status->snr;
46796 +
46797 +out:
46798 + kfree(cmd);
46799 + kfree(status);
46800 + return ret;
46801 }
46802
46803 static int cinergyt2_fe_init(struct dvb_frontend *fe)
46804 @@ -266,35 +339,46 @@ static int cinergyt2_fe_set_frontend(struct dvb_frontend *fe)
46805 {
46806 struct dtv_frontend_properties *fep = &fe->dtv_property_cache;
46807 struct cinergyt2_fe_state *state = fe->demodulator_priv;
46808 - struct dvbt_set_parameters_msg param;
46809 - char result[2];
46810 + struct dvbt_set_parameters_msg *param;
46811 + char *result;
46812 int err;
46813
46814 - param.cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS;
46815 - param.tps = cpu_to_le16(compute_tps(fep));
46816 - param.freq = cpu_to_le32(fep->frequency / 1000);
46817 - param.flags = 0;
46818 + result = kmalloc(2, GFP_KERNEL);
46819 + if (result == NULL)
46820 + return -ENOMEM;
46821 + param = kmalloc(sizeof(*param), GFP_KERNEL);
46822 + if (param == NULL) {
46823 + kfree(result);
46824 + return -ENOMEM;
46825 + }
46826 +
46827 + param->cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS;
46828 + param->tps = cpu_to_le16(compute_tps(fep));
46829 + param->freq = cpu_to_le32(fep->frequency / 1000);
46830 + param->flags = 0;
46831
46832 switch (fep->bandwidth_hz) {
46833 default:
46834 case 8000000:
46835 - param.bandwidth = 8;
46836 + param->bandwidth = 8;
46837 break;
46838 case 7000000:
46839 - param.bandwidth = 7;
46840 + param->bandwidth = 7;
46841 break;
46842 case 6000000:
46843 - param.bandwidth = 6;
46844 + param->bandwidth = 6;
46845 break;
46846 }
46847
46848 err = dvb_usb_generic_rw(state->d,
46849 - (char *)&param, sizeof(param),
46850 - result, sizeof(result), 0);
46851 + (char *)param, sizeof(*param),
46852 + result, 2, 0);
46853 if (err < 0)
46854 err("cinergyt2_fe_set_frontend() Failed! err=%d\n", err);
46855
46856 - return (err < 0) ? err : 0;
46857 + kfree(result);
46858 + kfree(param);
46859 + return err;
46860 }
46861
46862 static void cinergyt2_fe_release(struct dvb_frontend *fe)
46863 diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
46864 index 733a7ff..f8b52e3 100644
46865 --- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
46866 +++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
46867 @@ -35,42 +35,57 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
46868
46869 int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
46870 {
46871 - struct hexline hx;
46872 - u8 reset;
46873 + struct hexline *hx;
46874 + u8 *reset;
46875 int ret,pos=0;
46876
46877 + reset = kmalloc(1, GFP_KERNEL);
46878 + if (reset == NULL)
46879 + return -ENOMEM;
46880 +
46881 + hx = kmalloc(sizeof(struct hexline), GFP_KERNEL);
46882 + if (hx == NULL) {
46883 + kfree(reset);
46884 + return -ENOMEM;
46885 + }
46886 +
46887 /* stop the CPU */
46888 - reset = 1;
46889 - if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
46890 + reset[0] = 1;
46891 + if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1)) != 1)
46892 err("could not stop the USB controller CPU.");
46893
46894 - while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
46895 - deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
46896 - ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
46897 + while ((ret = dvb_usb_get_hexline(fw,hx,&pos)) > 0) {
46898 + deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx->addr,hx->len,hx->chk);
46899 + ret = usb_cypress_writemem(udev,hx->addr,hx->data,hx->len);
46900
46901 - if (ret != hx.len) {
46902 + if (ret != hx->len) {
46903 err("error while transferring firmware "
46904 "(transferred size: %d, block size: %d)",
46905 - ret,hx.len);
46906 + ret,hx->len);
46907 ret = -EINVAL;
46908 break;
46909 }
46910 }
46911 if (ret < 0) {
46912 err("firmware download failed at %d with %d",pos,ret);
46913 + kfree(reset);
46914 + kfree(hx);
46915 return ret;
46916 }
46917
46918 if (ret == 0) {
46919 /* restart the CPU */
46920 - reset = 0;
46921 - if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
46922 + reset[0] = 0;
46923 + if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1) != 1) {
46924 err("could not restart the USB controller CPU.");
46925 ret = -EINVAL;
46926 }
46927 } else
46928 ret = -EIO;
46929
46930 + kfree(reset);
46931 + kfree(hx);
46932 +
46933 return ret;
46934 }
46935 EXPORT_SYMBOL(usb_cypress_load_firmware);
46936 diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
46937 index 5801ae7..83f71fa 100644
46938 --- a/drivers/media/usb/dvb-usb/technisat-usb2.c
46939 +++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
46940 @@ -87,8 +87,11 @@ struct technisat_usb2_state {
46941 static int technisat_usb2_i2c_access(struct usb_device *udev,
46942 u8 device_addr, u8 *tx, u8 txlen, u8 *rx, u8 rxlen)
46943 {
46944 - u8 b[64];
46945 - int ret, actual_length;
46946 + u8 *b = kmalloc(64, GFP_KERNEL);
46947 + int ret, actual_length, error = 0;
46948 +
46949 + if (b == NULL)
46950 + return -ENOMEM;
46951
46952 deb_i2c("i2c-access: %02x, tx: ", device_addr);
46953 debug_dump(tx, txlen, deb_i2c);
46954 @@ -121,7 +124,8 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
46955
46956 if (ret < 0) {
46957 err("i2c-error: out failed %02x = %d", device_addr, ret);
46958 - return -ENODEV;
46959 + error = -ENODEV;
46960 + goto out;
46961 }
46962
46963 ret = usb_bulk_msg(udev,
46964 @@ -129,7 +133,8 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
46965 b, 64, &actual_length, 1000);
46966 if (ret < 0) {
46967 err("i2c-error: in failed %02x = %d", device_addr, ret);
46968 - return -ENODEV;
46969 + error = -ENODEV;
46970 + goto out;
46971 }
46972
46973 if (b[0] != I2C_STATUS_OK) {
46974 @@ -137,8 +142,10 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
46975 /* handle tuner-i2c-nak */
46976 if (!(b[0] == I2C_STATUS_NAK &&
46977 device_addr == 0x60
46978 - /* && device_is_technisat_usb2 */))
46979 - return -ENODEV;
46980 + /* && device_is_technisat_usb2 */)) {
46981 + error = -ENODEV;
46982 + goto out;
46983 + }
46984 }
46985
46986 deb_i2c("status: %d, ", b[0]);
46987 @@ -152,7 +159,9 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
46988
46989 deb_i2c("\n");
46990
46991 - return 0;
46992 +out:
46993 + kfree(b);
46994 + return error;
46995 }
46996
46997 static int technisat_usb2_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
46998 @@ -224,14 +233,16 @@ static int technisat_usb2_set_led(struct dvb_usb_device *d, int red, enum techni
46999 {
47000 int ret;
47001
47002 - u8 led[8] = {
47003 - red ? SET_RED_LED_VENDOR_REQUEST : SET_GREEN_LED_VENDOR_REQUEST,
47004 - 0
47005 - };
47006 + u8 *led = kzalloc(8, GFP_KERNEL);
47007 +
47008 + if (led == NULL)
47009 + return -ENOMEM;
47010
47011 if (disable_led_control && state != TECH_LED_OFF)
47012 return 0;
47013
47014 + led[0] = red ? SET_RED_LED_VENDOR_REQUEST : SET_GREEN_LED_VENDOR_REQUEST;
47015 +
47016 switch (state) {
47017 case TECH_LED_ON:
47018 led[1] = 0x82;
47019 @@ -263,16 +274,22 @@ static int technisat_usb2_set_led(struct dvb_usb_device *d, int red, enum techni
47020 red ? SET_RED_LED_VENDOR_REQUEST : SET_GREEN_LED_VENDOR_REQUEST,
47021 USB_TYPE_VENDOR | USB_DIR_OUT,
47022 0, 0,
47023 - led, sizeof(led), 500);
47024 + led, 8, 500);
47025
47026 mutex_unlock(&d->i2c_mutex);
47027 +
47028 + kfree(led);
47029 +
47030 return ret;
47031 }
47032
47033 static int technisat_usb2_set_led_timer(struct dvb_usb_device *d, u8 red, u8 green)
47034 {
47035 int ret;
47036 - u8 b = 0;
47037 + u8 *b = kzalloc(1, GFP_KERNEL);
47038 +
47039 + if (b == NULL)
47040 + return -ENOMEM;
47041
47042 if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
47043 return -EAGAIN;
47044 @@ -281,10 +298,12 @@ static int technisat_usb2_set_led_timer(struct dvb_usb_device *d, u8 red, u8 gre
47045 SET_LED_TIMER_DIVIDER_VENDOR_REQUEST,
47046 USB_TYPE_VENDOR | USB_DIR_OUT,
47047 (red << 8) | green, 0,
47048 - &b, 1, 500);
47049 + b, 1, 500);
47050
47051 mutex_unlock(&d->i2c_mutex);
47052
47053 + kfree(b);
47054 +
47055 return ret;
47056 }
47057
47058 @@ -328,7 +347,7 @@ static int technisat_usb2_identify_state(struct usb_device *udev,
47059 struct dvb_usb_device_description **desc, int *cold)
47060 {
47061 int ret;
47062 - u8 version[3];
47063 + u8 *version = kmalloc(3, GFP_KERNEL);
47064
47065 /* first select the interface */
47066 if (usb_set_interface(udev, 0, 1) != 0)
47067 @@ -338,11 +357,14 @@ static int technisat_usb2_identify_state(struct usb_device *udev,
47068
47069 *cold = 0; /* by default do not download a firmware - just in case something is wrong */
47070
47071 + if (version == NULL)
47072 + return 0;
47073 +
47074 ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
47075 GET_VERSION_INFO_VENDOR_REQUEST,
47076 USB_TYPE_VENDOR | USB_DIR_IN,
47077 0, 0,
47078 - version, sizeof(version), 500);
47079 + version, 3, 500);
47080
47081 if (ret < 0)
47082 *cold = 1;
47083 @@ -351,6 +373,8 @@ static int technisat_usb2_identify_state(struct usb_device *udev,
47084 *cold = 0;
47085 }
47086
47087 + kfree(version);
47088 +
47089 return 0;
47090 }
47091
47092 @@ -594,10 +618,15 @@ static int technisat_usb2_frontend_attach(struct dvb_usb_adapter *a)
47093
47094 static int technisat_usb2_get_ir(struct dvb_usb_device *d)
47095 {
47096 - u8 buf[62], *b;
47097 + u8 *buf, *b;
47098 int ret;
47099 struct ir_raw_event ev;
47100
47101 + buf = kmalloc(62, GFP_KERNEL);
47102 +
47103 + if (buf == NULL)
47104 + return -ENOMEM;
47105 +
47106 buf[0] = GET_IR_DATA_VENDOR_REQUEST;
47107 buf[1] = 0x08;
47108 buf[2] = 0x8f;
47109 @@ -620,16 +649,20 @@ static int technisat_usb2_get_ir(struct dvb_usb_device *d)
47110 GET_IR_DATA_VENDOR_REQUEST,
47111 USB_TYPE_VENDOR | USB_DIR_IN,
47112 0x8080, 0,
47113 - buf, sizeof(buf), 500);
47114 + buf, 62, 500);
47115
47116 unlock:
47117 mutex_unlock(&d->i2c_mutex);
47118
47119 - if (ret < 0)
47120 + if (ret < 0) {
47121 + kfree(buf);
47122 return ret;
47123 + }
47124
47125 - if (ret == 1)
47126 + if (ret == 1) {
47127 + kfree(buf);
47128 return 0; /* no key pressed */
47129 + }
47130
47131 /* decoding */
47132 b = buf+1;
47133 @@ -656,6 +689,8 @@ unlock:
47134
47135 ir_raw_event_handle(d->rc_dev);
47136
47137 + kfree(buf);
47138 +
47139 return 1;
47140 }
47141
47142 diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
47143 index af63543..0436f20 100644
47144 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
47145 +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
47146 @@ -429,7 +429,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
47147 * by passing a very big num_planes value */
47148 uplane = compat_alloc_user_space(num_planes *
47149 sizeof(struct v4l2_plane));
47150 - kp->m.planes = (__force struct v4l2_plane *)uplane;
47151 + kp->m.planes = (__force_kernel struct v4l2_plane *)uplane;
47152
47153 while (--num_planes >= 0) {
47154 ret = get_v4l2_plane32(uplane, uplane32, kp->memory);
47155 @@ -500,7 +500,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
47156 if (num_planes == 0)
47157 return 0;
47158
47159 - uplane = (__force struct v4l2_plane __user *)kp->m.planes;
47160 + uplane = (struct v4l2_plane __force_user *)kp->m.planes;
47161 if (get_user(p, &up->m.planes))
47162 return -EFAULT;
47163 uplane32 = compat_ptr(p);
47164 @@ -564,7 +564,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
47165 get_user(kp->flags, &up->flags) ||
47166 copy_from_user(&kp->fmt, &up->fmt, sizeof(up->fmt)))
47167 return -EFAULT;
47168 - kp->base = (__force void *)compat_ptr(tmp);
47169 + kp->base = (__force_kernel void *)compat_ptr(tmp);
47170 return 0;
47171 }
47172
47173 @@ -669,7 +669,7 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
47174 n * sizeof(struct v4l2_ext_control32)))
47175 return -EFAULT;
47176 kcontrols = compat_alloc_user_space(n * sizeof(struct v4l2_ext_control));
47177 - kp->controls = (__force struct v4l2_ext_control *)kcontrols;
47178 + kp->controls = (__force_kernel struct v4l2_ext_control *)kcontrols;
47179 while (--n >= 0) {
47180 u32 id;
47181
47182 @@ -696,7 +696,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
47183 {
47184 struct v4l2_ext_control32 __user *ucontrols;
47185 struct v4l2_ext_control __user *kcontrols =
47186 - (__force struct v4l2_ext_control __user *)kp->controls;
47187 + (struct v4l2_ext_control __force_user *)kp->controls;
47188 int n = kp->count;
47189 compat_caddr_t p;
47190
47191 @@ -780,7 +780,7 @@ static int get_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up)
47192 get_user(tmp, &up->edid) ||
47193 copy_from_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
47194 return -EFAULT;
47195 - kp->edid = (__force u8 *)compat_ptr(tmp);
47196 + kp->edid = (__force_kernel u8 *)compat_ptr(tmp);
47197 return 0;
47198 }
47199
47200 diff --git a/drivers/media/v4l2-core/v4l2-device.c b/drivers/media/v4l2-core/v4l2-device.c
47201 index 5b0a30b..1974b38 100644
47202 --- a/drivers/media/v4l2-core/v4l2-device.c
47203 +++ b/drivers/media/v4l2-core/v4l2-device.c
47204 @@ -74,9 +74,9 @@ int v4l2_device_put(struct v4l2_device *v4l2_dev)
47205 EXPORT_SYMBOL_GPL(v4l2_device_put);
47206
47207 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
47208 - atomic_t *instance)
47209 + atomic_unchecked_t *instance)
47210 {
47211 - int num = atomic_inc_return(instance) - 1;
47212 + int num = atomic_inc_return_unchecked(instance) - 1;
47213 int len = strlen(basename);
47214
47215 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
47216 diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
47217 index aa407cb..ee847d4 100644
47218 --- a/drivers/media/v4l2-core/v4l2-ioctl.c
47219 +++ b/drivers/media/v4l2-core/v4l2-ioctl.c
47220 @@ -2151,7 +2151,8 @@ struct v4l2_ioctl_info {
47221 struct file *file, void *fh, void *p);
47222 } u;
47223 void (*debug)(const void *arg, bool write_only);
47224 -};
47225 +} __do_const;
47226 +typedef struct v4l2_ioctl_info __no_const v4l2_ioctl_info_no_const;
47227
47228 /* This control needs a priority check */
47229 #define INFO_FL_PRIO (1 << 0)
47230 @@ -2335,7 +2336,7 @@ static long __video_do_ioctl(struct file *file,
47231 struct video_device *vfd = video_devdata(file);
47232 const struct v4l2_ioctl_ops *ops = vfd->ioctl_ops;
47233 bool write_only = false;
47234 - struct v4l2_ioctl_info default_info;
47235 + v4l2_ioctl_info_no_const default_info;
47236 const struct v4l2_ioctl_info *info;
47237 void *fh = file->private_data;
47238 struct v4l2_fh *vfh = NULL;
47239 @@ -2426,7 +2427,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
47240 ret = -EINVAL;
47241 break;
47242 }
47243 - *user_ptr = (void __user *)buf->m.planes;
47244 + *user_ptr = (void __force_user *)buf->m.planes;
47245 *kernel_ptr = (void **)&buf->m.planes;
47246 *array_size = sizeof(struct v4l2_plane) * buf->length;
47247 ret = 1;
47248 @@ -2443,7 +2444,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
47249 ret = -EINVAL;
47250 break;
47251 }
47252 - *user_ptr = (void __user *)edid->edid;
47253 + *user_ptr = (void __force_user *)edid->edid;
47254 *kernel_ptr = (void **)&edid->edid;
47255 *array_size = edid->blocks * 128;
47256 ret = 1;
47257 @@ -2461,7 +2462,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
47258 ret = -EINVAL;
47259 break;
47260 }
47261 - *user_ptr = (void __user *)ctrls->controls;
47262 + *user_ptr = (void __force_user *)ctrls->controls;
47263 *kernel_ptr = (void **)&ctrls->controls;
47264 *array_size = sizeof(struct v4l2_ext_control)
47265 * ctrls->count;
47266 @@ -2562,7 +2563,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
47267 }
47268
47269 if (has_array_args) {
47270 - *kernel_ptr = (void __force *)user_ptr;
47271 + *kernel_ptr = (void __force_kernel *)user_ptr;
47272 if (copy_to_user(user_ptr, mbuf, array_size))
47273 err = -EFAULT;
47274 goto out_array_args;
47275 diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
47276 index c94ea0d..b8a9f88 100644
47277 --- a/drivers/memory/omap-gpmc.c
47278 +++ b/drivers/memory/omap-gpmc.c
47279 @@ -232,7 +232,6 @@ struct omap3_gpmc_regs {
47280 };
47281
47282 static struct gpmc_client_irq gpmc_client_irq[GPMC_NR_IRQ];
47283 -static struct irq_chip gpmc_irq_chip;
47284 static int gpmc_irq_start;
47285
47286 static struct resource gpmc_mem_root;
47287 @@ -1146,6 +1145,17 @@ static void gpmc_irq_noop(struct irq_data *data) { }
47288
47289 static unsigned int gpmc_irq_noop_ret(struct irq_data *data) { return 0; }
47290
47291 +static struct irq_chip gpmc_irq_chip = {
47292 + .name = "gpmc",
47293 + .irq_startup = gpmc_irq_noop_ret,
47294 + .irq_enable = gpmc_irq_enable,
47295 + .irq_disable = gpmc_irq_disable,
47296 + .irq_shutdown = gpmc_irq_noop,
47297 + .irq_ack = gpmc_irq_noop,
47298 + .irq_mask = gpmc_irq_noop,
47299 + .irq_unmask = gpmc_irq_noop,
47300 +};
47301 +
47302 static int gpmc_setup_irq(void)
47303 {
47304 int i;
47305 @@ -1160,15 +1170,6 @@ static int gpmc_setup_irq(void)
47306 return gpmc_irq_start;
47307 }
47308
47309 - gpmc_irq_chip.name = "gpmc";
47310 - gpmc_irq_chip.irq_startup = gpmc_irq_noop_ret;
47311 - gpmc_irq_chip.irq_enable = gpmc_irq_enable;
47312 - gpmc_irq_chip.irq_disable = gpmc_irq_disable;
47313 - gpmc_irq_chip.irq_shutdown = gpmc_irq_noop;
47314 - gpmc_irq_chip.irq_ack = gpmc_irq_noop;
47315 - gpmc_irq_chip.irq_mask = gpmc_irq_noop;
47316 - gpmc_irq_chip.irq_unmask = gpmc_irq_noop;
47317 -
47318 gpmc_client_irq[0].bitmask = GPMC_IRQ_FIFOEVENTENABLE;
47319 gpmc_client_irq[1].bitmask = GPMC_IRQ_COUNT_EVENT;
47320
47321 diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
47322 index 187f836..679544b 100644
47323 --- a/drivers/message/fusion/mptbase.c
47324 +++ b/drivers/message/fusion/mptbase.c
47325 @@ -6746,8 +6746,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
47326 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
47327 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
47328
47329 +#ifdef CONFIG_GRKERNSEC_HIDESYM
47330 + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
47331 +#else
47332 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
47333 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
47334 +#endif
47335 +
47336 /*
47337 * Rounding UP to nearest 4-kB boundary here...
47338 */
47339 @@ -6760,7 +6765,11 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
47340 ioc->facts.GlobalCredits);
47341
47342 seq_printf(m, " Frames @ 0x%p (Dma @ 0x%p)\n",
47343 +#ifdef CONFIG_GRKERNSEC_HIDESYM
47344 + NULL, NULL);
47345 +#else
47346 (void *)ioc->alloc, (void *)(ulong)ioc->alloc_dma);
47347 +#endif
47348 sz = (ioc->reply_sz * ioc->reply_depth) + 128;
47349 seq_printf(m, " {CurRepSz=%d} x {CurRepDepth=%d} = %d bytes ^= 0x%x\n",
47350 ioc->reply_sz, ioc->reply_depth, ioc->reply_sz*ioc->reply_depth, sz);
47351 diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
47352 index 5bdaae1..eced16f 100644
47353 --- a/drivers/message/fusion/mptsas.c
47354 +++ b/drivers/message/fusion/mptsas.c
47355 @@ -446,6 +446,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
47356 return 0;
47357 }
47358
47359 +static inline void
47360 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
47361 +{
47362 + if (phy_info->port_details) {
47363 + phy_info->port_details->rphy = rphy;
47364 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
47365 + ioc->name, rphy));
47366 + }
47367 +
47368 + if (rphy) {
47369 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
47370 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
47371 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
47372 + ioc->name, rphy, rphy->dev.release));
47373 + }
47374 +}
47375 +
47376 /* no mutex */
47377 static void
47378 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
47379 @@ -484,23 +501,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
47380 return NULL;
47381 }
47382
47383 -static inline void
47384 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
47385 -{
47386 - if (phy_info->port_details) {
47387 - phy_info->port_details->rphy = rphy;
47388 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
47389 - ioc->name, rphy));
47390 - }
47391 -
47392 - if (rphy) {
47393 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
47394 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
47395 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
47396 - ioc->name, rphy, rphy->dev.release));
47397 - }
47398 -}
47399 -
47400 static inline struct sas_port *
47401 mptsas_get_port(struct mptsas_phyinfo *phy_info)
47402 {
47403 diff --git a/drivers/mfd/ab8500-debugfs.c b/drivers/mfd/ab8500-debugfs.c
47404 index cdd6f3d..1907a98 100644
47405 --- a/drivers/mfd/ab8500-debugfs.c
47406 +++ b/drivers/mfd/ab8500-debugfs.c
47407 @@ -100,7 +100,7 @@ static int irq_last;
47408 static u32 *irq_count;
47409 static int num_irqs;
47410
47411 -static struct device_attribute **dev_attr;
47412 +static device_attribute_no_const **dev_attr;
47413 static char **event_name;
47414
47415 static u8 avg_sample = SAMPLE_16;
47416 diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
47417 index 8057849..0550fdf 100644
47418 --- a/drivers/mfd/kempld-core.c
47419 +++ b/drivers/mfd/kempld-core.c
47420 @@ -499,7 +499,7 @@ static struct platform_driver kempld_driver = {
47421 .remove = kempld_remove,
47422 };
47423
47424 -static struct dmi_system_id kempld_dmi_table[] __initdata = {
47425 +static const struct dmi_system_id kempld_dmi_table[] __initconst = {
47426 {
47427 .ident = "BHL6",
47428 .matches = {
47429 diff --git a/drivers/mfd/max8925-i2c.c b/drivers/mfd/max8925-i2c.c
47430 index c880c89..45a7c68 100644
47431 --- a/drivers/mfd/max8925-i2c.c
47432 +++ b/drivers/mfd/max8925-i2c.c
47433 @@ -152,7 +152,7 @@ static int max8925_probe(struct i2c_client *client,
47434 const struct i2c_device_id *id)
47435 {
47436 struct max8925_platform_data *pdata = dev_get_platdata(&client->dev);
47437 - static struct max8925_chip *chip;
47438 + struct max8925_chip *chip;
47439 struct device_node *node = client->dev.of_node;
47440
47441 if (node && !pdata) {
47442 diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
47443 index 7612d89..70549c2 100644
47444 --- a/drivers/mfd/tps65910.c
47445 +++ b/drivers/mfd/tps65910.c
47446 @@ -230,7 +230,7 @@ static int tps65910_irq_init(struct tps65910 *tps65910, int irq,
47447 struct tps65910_platform_data *pdata)
47448 {
47449 int ret = 0;
47450 - static struct regmap_irq_chip *tps6591x_irqs_chip;
47451 + struct regmap_irq_chip *tps6591x_irqs_chip;
47452
47453 if (!irq) {
47454 dev_warn(tps65910->dev, "No interrupt support, no core IRQ\n");
47455 diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
47456 index 1b772ef..01e77d33 100644
47457 --- a/drivers/mfd/twl4030-irq.c
47458 +++ b/drivers/mfd/twl4030-irq.c
47459 @@ -34,6 +34,7 @@
47460 #include <linux/of.h>
47461 #include <linux/irqdomain.h>
47462 #include <linux/i2c/twl.h>
47463 +#include <asm/pgtable.h>
47464
47465 #include "twl-core.h"
47466
47467 @@ -729,10 +730,12 @@ int twl4030_init_irq(struct device *dev, int irq_num)
47468 * Install an irq handler for each of the SIH modules;
47469 * clone dummy irq_chip since PIH can't *do* anything
47470 */
47471 - twl4030_irq_chip = dummy_irq_chip;
47472 - twl4030_irq_chip.name = "twl4030";
47473 + pax_open_kernel();
47474 + memcpy((void *)&twl4030_irq_chip, &dummy_irq_chip, sizeof twl4030_irq_chip);
47475 + *(const char **)&twl4030_irq_chip.name = "twl4030";
47476
47477 - twl4030_sih_irq_chip.irq_ack = dummy_irq_chip.irq_ack;
47478 + *(void **)&twl4030_sih_irq_chip.irq_ack = dummy_irq_chip.irq_ack;
47479 + pax_close_kernel();
47480
47481 for (i = irq_base; i < irq_end; i++) {
47482 irq_set_chip_and_handler(i, &twl4030_irq_chip,
47483 diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
47484 index 464419b..64bae8d 100644
47485 --- a/drivers/misc/c2port/core.c
47486 +++ b/drivers/misc/c2port/core.c
47487 @@ -922,7 +922,9 @@ struct c2port_device *c2port_device_register(char *name,
47488 goto error_idr_alloc;
47489 c2dev->id = ret;
47490
47491 - bin_attr_flash_data.size = ops->blocks_num * ops->block_size;
47492 + pax_open_kernel();
47493 + *(size_t *)&bin_attr_flash_data.size = ops->blocks_num * ops->block_size;
47494 + pax_close_kernel();
47495
47496 c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
47497 "c2port%d", c2dev->id);
47498 diff --git a/drivers/misc/eeprom/sunxi_sid.c b/drivers/misc/eeprom/sunxi_sid.c
47499 index 8385177..2f54635 100644
47500 --- a/drivers/misc/eeprom/sunxi_sid.c
47501 +++ b/drivers/misc/eeprom/sunxi_sid.c
47502 @@ -126,7 +126,9 @@ static int sunxi_sid_probe(struct platform_device *pdev)
47503
47504 platform_set_drvdata(pdev, sid_data);
47505
47506 - sid_bin_attr.size = sid_data->keysize;
47507 + pax_open_kernel();
47508 + *(size_t *)&sid_bin_attr.size = sid_data->keysize;
47509 + pax_close_kernel();
47510 if (device_create_bin_file(&pdev->dev, &sid_bin_attr))
47511 return -ENODEV;
47512
47513 diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
47514 index 36f5d52..32311c3 100644
47515 --- a/drivers/misc/kgdbts.c
47516 +++ b/drivers/misc/kgdbts.c
47517 @@ -834,7 +834,7 @@ static void run_plant_and_detach_test(int is_early)
47518 char before[BREAK_INSTR_SIZE];
47519 char after[BREAK_INSTR_SIZE];
47520
47521 - probe_kernel_read(before, (char *)kgdbts_break_test,
47522 + probe_kernel_read(before, ktla_ktva((char *)kgdbts_break_test),
47523 BREAK_INSTR_SIZE);
47524 init_simple_test();
47525 ts.tst = plant_and_detach_test;
47526 @@ -842,7 +842,7 @@ static void run_plant_and_detach_test(int is_early)
47527 /* Activate test with initial breakpoint */
47528 if (!is_early)
47529 kgdb_breakpoint();
47530 - probe_kernel_read(after, (char *)kgdbts_break_test,
47531 + probe_kernel_read(after, ktla_ktva((char *)kgdbts_break_test),
47532 BREAK_INSTR_SIZE);
47533 if (memcmp(before, after, BREAK_INSTR_SIZE)) {
47534 printk(KERN_CRIT "kgdbts: ERROR kgdb corrupted memory\n");
47535 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
47536 index 4739689..8a52950 100644
47537 --- a/drivers/misc/lis3lv02d/lis3lv02d.c
47538 +++ b/drivers/misc/lis3lv02d/lis3lv02d.c
47539 @@ -497,7 +497,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *data)
47540 * the lid is closed. This leads to interrupts as soon as a little move
47541 * is done.
47542 */
47543 - atomic_inc(&lis3->count);
47544 + atomic_inc_unchecked(&lis3->count);
47545
47546 wake_up_interruptible(&lis3->misc_wait);
47547 kill_fasync(&lis3->async_queue, SIGIO, POLL_IN);
47548 @@ -583,7 +583,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
47549 if (lis3->pm_dev)
47550 pm_runtime_get_sync(lis3->pm_dev);
47551
47552 - atomic_set(&lis3->count, 0);
47553 + atomic_set_unchecked(&lis3->count, 0);
47554 return 0;
47555 }
47556
47557 @@ -615,7 +615,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
47558 add_wait_queue(&lis3->misc_wait, &wait);
47559 while (true) {
47560 set_current_state(TASK_INTERRUPTIBLE);
47561 - data = atomic_xchg(&lis3->count, 0);
47562 + data = atomic_xchg_unchecked(&lis3->count, 0);
47563 if (data)
47564 break;
47565
47566 @@ -656,7 +656,7 @@ static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
47567 struct lis3lv02d, miscdev);
47568
47569 poll_wait(file, &lis3->misc_wait, wait);
47570 - if (atomic_read(&lis3->count))
47571 + if (atomic_read_unchecked(&lis3->count))
47572 return POLLIN | POLLRDNORM;
47573 return 0;
47574 }
47575 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
47576 index c439c82..1f20f57 100644
47577 --- a/drivers/misc/lis3lv02d/lis3lv02d.h
47578 +++ b/drivers/misc/lis3lv02d/lis3lv02d.h
47579 @@ -297,7 +297,7 @@ struct lis3lv02d {
47580 struct input_polled_dev *idev; /* input device */
47581 struct platform_device *pdev; /* platform device */
47582 struct regulator_bulk_data regulators[2];
47583 - atomic_t count; /* interrupt count after last read */
47584 + atomic_unchecked_t count; /* interrupt count after last read */
47585 union axis_conversion ac; /* hw -> logical axis */
47586 int mapped_btns[3];
47587
47588 diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
47589 index 2f30bad..c4c13d0 100644
47590 --- a/drivers/misc/sgi-gru/gruhandles.c
47591 +++ b/drivers/misc/sgi-gru/gruhandles.c
47592 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
47593 unsigned long nsec;
47594
47595 nsec = CLKS2NSEC(clks);
47596 - atomic_long_inc(&mcs_op_statistics[op].count);
47597 - atomic_long_add(nsec, &mcs_op_statistics[op].total);
47598 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
47599 + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
47600 if (mcs_op_statistics[op].max < nsec)
47601 mcs_op_statistics[op].max = nsec;
47602 }
47603 diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
47604 index 4f76359..cdfcb2e 100644
47605 --- a/drivers/misc/sgi-gru/gruprocfs.c
47606 +++ b/drivers/misc/sgi-gru/gruprocfs.c
47607 @@ -32,9 +32,9 @@
47608
47609 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
47610
47611 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
47612 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
47613 {
47614 - unsigned long val = atomic_long_read(v);
47615 + unsigned long val = atomic_long_read_unchecked(v);
47616
47617 seq_printf(s, "%16lu %s\n", val, id);
47618 }
47619 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
47620
47621 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
47622 for (op = 0; op < mcsop_last; op++) {
47623 - count = atomic_long_read(&mcs_op_statistics[op].count);
47624 - total = atomic_long_read(&mcs_op_statistics[op].total);
47625 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
47626 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
47627 max = mcs_op_statistics[op].max;
47628 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
47629 count ? total / count : 0, max);
47630 diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
47631 index 5c3ce24..4915ccb 100644
47632 --- a/drivers/misc/sgi-gru/grutables.h
47633 +++ b/drivers/misc/sgi-gru/grutables.h
47634 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
47635 * GRU statistics.
47636 */
47637 struct gru_stats_s {
47638 - atomic_long_t vdata_alloc;
47639 - atomic_long_t vdata_free;
47640 - atomic_long_t gts_alloc;
47641 - atomic_long_t gts_free;
47642 - atomic_long_t gms_alloc;
47643 - atomic_long_t gms_free;
47644 - atomic_long_t gts_double_allocate;
47645 - atomic_long_t assign_context;
47646 - atomic_long_t assign_context_failed;
47647 - atomic_long_t free_context;
47648 - atomic_long_t load_user_context;
47649 - atomic_long_t load_kernel_context;
47650 - atomic_long_t lock_kernel_context;
47651 - atomic_long_t unlock_kernel_context;
47652 - atomic_long_t steal_user_context;
47653 - atomic_long_t steal_kernel_context;
47654 - atomic_long_t steal_context_failed;
47655 - atomic_long_t nopfn;
47656 - atomic_long_t asid_new;
47657 - atomic_long_t asid_next;
47658 - atomic_long_t asid_wrap;
47659 - atomic_long_t asid_reuse;
47660 - atomic_long_t intr;
47661 - atomic_long_t intr_cbr;
47662 - atomic_long_t intr_tfh;
47663 - atomic_long_t intr_spurious;
47664 - atomic_long_t intr_mm_lock_failed;
47665 - atomic_long_t call_os;
47666 - atomic_long_t call_os_wait_queue;
47667 - atomic_long_t user_flush_tlb;
47668 - atomic_long_t user_unload_context;
47669 - atomic_long_t user_exception;
47670 - atomic_long_t set_context_option;
47671 - atomic_long_t check_context_retarget_intr;
47672 - atomic_long_t check_context_unload;
47673 - atomic_long_t tlb_dropin;
47674 - atomic_long_t tlb_preload_page;
47675 - atomic_long_t tlb_dropin_fail_no_asid;
47676 - atomic_long_t tlb_dropin_fail_upm;
47677 - atomic_long_t tlb_dropin_fail_invalid;
47678 - atomic_long_t tlb_dropin_fail_range_active;
47679 - atomic_long_t tlb_dropin_fail_idle;
47680 - atomic_long_t tlb_dropin_fail_fmm;
47681 - atomic_long_t tlb_dropin_fail_no_exception;
47682 - atomic_long_t tfh_stale_on_fault;
47683 - atomic_long_t mmu_invalidate_range;
47684 - atomic_long_t mmu_invalidate_page;
47685 - atomic_long_t flush_tlb;
47686 - atomic_long_t flush_tlb_gru;
47687 - atomic_long_t flush_tlb_gru_tgh;
47688 - atomic_long_t flush_tlb_gru_zero_asid;
47689 + atomic_long_unchecked_t vdata_alloc;
47690 + atomic_long_unchecked_t vdata_free;
47691 + atomic_long_unchecked_t gts_alloc;
47692 + atomic_long_unchecked_t gts_free;
47693 + atomic_long_unchecked_t gms_alloc;
47694 + atomic_long_unchecked_t gms_free;
47695 + atomic_long_unchecked_t gts_double_allocate;
47696 + atomic_long_unchecked_t assign_context;
47697 + atomic_long_unchecked_t assign_context_failed;
47698 + atomic_long_unchecked_t free_context;
47699 + atomic_long_unchecked_t load_user_context;
47700 + atomic_long_unchecked_t load_kernel_context;
47701 + atomic_long_unchecked_t lock_kernel_context;
47702 + atomic_long_unchecked_t unlock_kernel_context;
47703 + atomic_long_unchecked_t steal_user_context;
47704 + atomic_long_unchecked_t steal_kernel_context;
47705 + atomic_long_unchecked_t steal_context_failed;
47706 + atomic_long_unchecked_t nopfn;
47707 + atomic_long_unchecked_t asid_new;
47708 + atomic_long_unchecked_t asid_next;
47709 + atomic_long_unchecked_t asid_wrap;
47710 + atomic_long_unchecked_t asid_reuse;
47711 + atomic_long_unchecked_t intr;
47712 + atomic_long_unchecked_t intr_cbr;
47713 + atomic_long_unchecked_t intr_tfh;
47714 + atomic_long_unchecked_t intr_spurious;
47715 + atomic_long_unchecked_t intr_mm_lock_failed;
47716 + atomic_long_unchecked_t call_os;
47717 + atomic_long_unchecked_t call_os_wait_queue;
47718 + atomic_long_unchecked_t user_flush_tlb;
47719 + atomic_long_unchecked_t user_unload_context;
47720 + atomic_long_unchecked_t user_exception;
47721 + atomic_long_unchecked_t set_context_option;
47722 + atomic_long_unchecked_t check_context_retarget_intr;
47723 + atomic_long_unchecked_t check_context_unload;
47724 + atomic_long_unchecked_t tlb_dropin;
47725 + atomic_long_unchecked_t tlb_preload_page;
47726 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
47727 + atomic_long_unchecked_t tlb_dropin_fail_upm;
47728 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
47729 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
47730 + atomic_long_unchecked_t tlb_dropin_fail_idle;
47731 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
47732 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
47733 + atomic_long_unchecked_t tfh_stale_on_fault;
47734 + atomic_long_unchecked_t mmu_invalidate_range;
47735 + atomic_long_unchecked_t mmu_invalidate_page;
47736 + atomic_long_unchecked_t flush_tlb;
47737 + atomic_long_unchecked_t flush_tlb_gru;
47738 + atomic_long_unchecked_t flush_tlb_gru_tgh;
47739 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
47740
47741 - atomic_long_t copy_gpa;
47742 - atomic_long_t read_gpa;
47743 + atomic_long_unchecked_t copy_gpa;
47744 + atomic_long_unchecked_t read_gpa;
47745
47746 - atomic_long_t mesq_receive;
47747 - atomic_long_t mesq_receive_none;
47748 - atomic_long_t mesq_send;
47749 - atomic_long_t mesq_send_failed;
47750 - atomic_long_t mesq_noop;
47751 - atomic_long_t mesq_send_unexpected_error;
47752 - atomic_long_t mesq_send_lb_overflow;
47753 - atomic_long_t mesq_send_qlimit_reached;
47754 - atomic_long_t mesq_send_amo_nacked;
47755 - atomic_long_t mesq_send_put_nacked;
47756 - atomic_long_t mesq_page_overflow;
47757 - atomic_long_t mesq_qf_locked;
47758 - atomic_long_t mesq_qf_noop_not_full;
47759 - atomic_long_t mesq_qf_switch_head_failed;
47760 - atomic_long_t mesq_qf_unexpected_error;
47761 - atomic_long_t mesq_noop_unexpected_error;
47762 - atomic_long_t mesq_noop_lb_overflow;
47763 - atomic_long_t mesq_noop_qlimit_reached;
47764 - atomic_long_t mesq_noop_amo_nacked;
47765 - atomic_long_t mesq_noop_put_nacked;
47766 - atomic_long_t mesq_noop_page_overflow;
47767 + atomic_long_unchecked_t mesq_receive;
47768 + atomic_long_unchecked_t mesq_receive_none;
47769 + atomic_long_unchecked_t mesq_send;
47770 + atomic_long_unchecked_t mesq_send_failed;
47771 + atomic_long_unchecked_t mesq_noop;
47772 + atomic_long_unchecked_t mesq_send_unexpected_error;
47773 + atomic_long_unchecked_t mesq_send_lb_overflow;
47774 + atomic_long_unchecked_t mesq_send_qlimit_reached;
47775 + atomic_long_unchecked_t mesq_send_amo_nacked;
47776 + atomic_long_unchecked_t mesq_send_put_nacked;
47777 + atomic_long_unchecked_t mesq_page_overflow;
47778 + atomic_long_unchecked_t mesq_qf_locked;
47779 + atomic_long_unchecked_t mesq_qf_noop_not_full;
47780 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
47781 + atomic_long_unchecked_t mesq_qf_unexpected_error;
47782 + atomic_long_unchecked_t mesq_noop_unexpected_error;
47783 + atomic_long_unchecked_t mesq_noop_lb_overflow;
47784 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
47785 + atomic_long_unchecked_t mesq_noop_amo_nacked;
47786 + atomic_long_unchecked_t mesq_noop_put_nacked;
47787 + atomic_long_unchecked_t mesq_noop_page_overflow;
47788
47789 };
47790
47791 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
47792 tghop_invalidate, mcsop_last};
47793
47794 struct mcs_op_statistic {
47795 - atomic_long_t count;
47796 - atomic_long_t total;
47797 + atomic_long_unchecked_t count;
47798 + atomic_long_unchecked_t total;
47799 unsigned long max;
47800 };
47801
47802 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
47803
47804 #define STAT(id) do { \
47805 if (gru_options & OPT_STATS) \
47806 - atomic_long_inc(&gru_stats.id); \
47807 + atomic_long_inc_unchecked(&gru_stats.id); \
47808 } while (0)
47809
47810 #ifdef CONFIG_SGI_GRU_DEBUG
47811 diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
47812 index c862cd4..0d176fe 100644
47813 --- a/drivers/misc/sgi-xp/xp.h
47814 +++ b/drivers/misc/sgi-xp/xp.h
47815 @@ -288,7 +288,7 @@ struct xpc_interface {
47816 xpc_notify_func, void *);
47817 void (*received) (short, int, void *);
47818 enum xp_retval (*partid_to_nasids) (short, void *);
47819 -};
47820 +} __no_const;
47821
47822 extern struct xpc_interface xpc_interface;
47823
47824 diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
47825 index 01be66d..e3a0c7e 100644
47826 --- a/drivers/misc/sgi-xp/xp_main.c
47827 +++ b/drivers/misc/sgi-xp/xp_main.c
47828 @@ -78,13 +78,13 @@ xpc_notloaded(void)
47829 }
47830
47831 struct xpc_interface xpc_interface = {
47832 - (void (*)(int))xpc_notloaded,
47833 - (void (*)(int))xpc_notloaded,
47834 - (enum xp_retval(*)(short, int, u32, void *, u16))xpc_notloaded,
47835 - (enum xp_retval(*)(short, int, u32, void *, u16, xpc_notify_func,
47836 + .connect = (void (*)(int))xpc_notloaded,
47837 + .disconnect = (void (*)(int))xpc_notloaded,
47838 + .send = (enum xp_retval(*)(short, int, u32, void *, u16))xpc_notloaded,
47839 + .send_notify = (enum xp_retval(*)(short, int, u32, void *, u16, xpc_notify_func,
47840 void *))xpc_notloaded,
47841 - (void (*)(short, int, void *))xpc_notloaded,
47842 - (enum xp_retval(*)(short, void *))xpc_notloaded
47843 + .received = (void (*)(short, int, void *))xpc_notloaded,
47844 + .partid_to_nasids = (enum xp_retval(*)(short, void *))xpc_notloaded
47845 };
47846 EXPORT_SYMBOL_GPL(xpc_interface);
47847
47848 diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
47849 index b94d5f7..7f494c5 100644
47850 --- a/drivers/misc/sgi-xp/xpc.h
47851 +++ b/drivers/misc/sgi-xp/xpc.h
47852 @@ -835,6 +835,7 @@ struct xpc_arch_operations {
47853 void (*received_payload) (struct xpc_channel *, void *);
47854 void (*notify_senders_of_disconnect) (struct xpc_channel *);
47855 };
47856 +typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
47857
47858 /* struct xpc_partition act_state values (for XPC HB) */
47859
47860 @@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
47861 /* found in xpc_main.c */
47862 extern struct device *xpc_part;
47863 extern struct device *xpc_chan;
47864 -extern struct xpc_arch_operations xpc_arch_ops;
47865 +extern xpc_arch_operations_no_const xpc_arch_ops;
47866 extern int xpc_disengage_timelimit;
47867 extern int xpc_disengage_timedout;
47868 extern int xpc_activate_IRQ_rcvd;
47869 diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
47870 index 7f32712..8539ab2 100644
47871 --- a/drivers/misc/sgi-xp/xpc_main.c
47872 +++ b/drivers/misc/sgi-xp/xpc_main.c
47873 @@ -166,7 +166,7 @@ static struct notifier_block xpc_die_notifier = {
47874 .notifier_call = xpc_system_die,
47875 };
47876
47877 -struct xpc_arch_operations xpc_arch_ops;
47878 +xpc_arch_operations_no_const xpc_arch_ops;
47879
47880 /*
47881 * Timer function to enforce the timelimit on the partition disengage.
47882 diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
47883 index 60f7141..ba97c1a 100644
47884 --- a/drivers/mmc/card/block.c
47885 +++ b/drivers/mmc/card/block.c
47886 @@ -577,7 +577,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
47887 if (idata->ic.postsleep_min_us)
47888 usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
47889
47890 - if (copy_to_user(&(ic_ptr->response), cmd.resp, sizeof(cmd.resp))) {
47891 + if (copy_to_user(ic_ptr->response, cmd.resp, sizeof(cmd.resp))) {
47892 err = -EFAULT;
47893 goto cmd_rel_host;
47894 }
47895 diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h
47896 index f45ab91..9f50d8f 100644
47897 --- a/drivers/mmc/host/dw_mmc.h
47898 +++ b/drivers/mmc/host/dw_mmc.h
47899 @@ -287,5 +287,5 @@ struct dw_mci_drv_data {
47900 int (*execute_tuning)(struct dw_mci_slot *slot);
47901 int (*prepare_hs400_tuning)(struct dw_mci *host,
47902 struct mmc_ios *ios);
47903 -};
47904 +} __do_const;
47905 #endif /* _DW_MMC_H_ */
47906 diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
47907 index fb26674..3172c2b 100644
47908 --- a/drivers/mmc/host/mmci.c
47909 +++ b/drivers/mmc/host/mmci.c
47910 @@ -1633,7 +1633,9 @@ static int mmci_probe(struct amba_device *dev,
47911 mmc->caps |= MMC_CAP_CMD23;
47912
47913 if (variant->busy_detect) {
47914 - mmci_ops.card_busy = mmci_card_busy;
47915 + pax_open_kernel();
47916 + *(void **)&mmci_ops.card_busy = mmci_card_busy;
47917 + pax_close_kernel();
47918 mmci_write_datactrlreg(host, MCI_ST_DPSM_BUSYMODE);
47919 mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
47920 mmc->max_busy_timeout = 0;
47921 diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
47922 index 9df2b68..6d5ed1a 100644
47923 --- a/drivers/mmc/host/omap_hsmmc.c
47924 +++ b/drivers/mmc/host/omap_hsmmc.c
47925 @@ -2004,7 +2004,9 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
47926
47927 if (host->pdata->controller_flags & OMAP_HSMMC_BROKEN_MULTIBLOCK_READ) {
47928 dev_info(&pdev->dev, "multiblock reads disabled due to 35xx erratum 2.1.1.128; MMC read performance may suffer\n");
47929 - omap_hsmmc_ops.multi_io_quirk = omap_hsmmc_multi_io_quirk;
47930 + pax_open_kernel();
47931 + *(void **)&omap_hsmmc_ops.multi_io_quirk = omap_hsmmc_multi_io_quirk;
47932 + pax_close_kernel();
47933 }
47934
47935 pm_runtime_enable(host->dev);
47936 diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
47937 index 82f512d..5a228bb 100644
47938 --- a/drivers/mmc/host/sdhci-esdhc-imx.c
47939 +++ b/drivers/mmc/host/sdhci-esdhc-imx.c
47940 @@ -993,9 +993,12 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
47941 host->mmc->caps |= MMC_CAP_1_8V_DDR;
47942 }
47943
47944 - if (imx_data->socdata->flags & ESDHC_FLAG_MAN_TUNING)
47945 - sdhci_esdhc_ops.platform_execute_tuning =
47946 + if (imx_data->socdata->flags & ESDHC_FLAG_MAN_TUNING) {
47947 + pax_open_kernel();
47948 + *(void **)&sdhci_esdhc_ops.platform_execute_tuning =
47949 esdhc_executing_tuning;
47950 + pax_close_kernel();
47951 + }
47952
47953 if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING)
47954 writel(readl(host->ioaddr + ESDHC_TUNING_CTRL) |
47955 diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
47956 index c6d2dd7..81b1ca3 100644
47957 --- a/drivers/mmc/host/sdhci-s3c.c
47958 +++ b/drivers/mmc/host/sdhci-s3c.c
47959 @@ -598,9 +598,11 @@ static int sdhci_s3c_probe(struct platform_device *pdev)
47960 * we can use overriding functions instead of default.
47961 */
47962 if (sc->no_divider) {
47963 - sdhci_s3c_ops.set_clock = sdhci_cmu_set_clock;
47964 - sdhci_s3c_ops.get_min_clock = sdhci_cmu_get_min_clock;
47965 - sdhci_s3c_ops.get_max_clock = sdhci_cmu_get_max_clock;
47966 + pax_open_kernel();
47967 + *(void **)&sdhci_s3c_ops.set_clock = sdhci_cmu_set_clock;
47968 + *(void **)&sdhci_s3c_ops.get_min_clock = sdhci_cmu_get_min_clock;
47969 + *(void **)&sdhci_s3c_ops.get_max_clock = sdhci_cmu_get_max_clock;
47970 + pax_close_kernel();
47971 }
47972
47973 /* It supports additional host capabilities if needed */
47974 diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
47975 index 9a1a6ff..b8f1a57 100644
47976 --- a/drivers/mtd/chips/cfi_cmdset_0020.c
47977 +++ b/drivers/mtd/chips/cfi_cmdset_0020.c
47978 @@ -666,7 +666,7 @@ cfi_staa_writev(struct mtd_info *mtd, const struct kvec *vecs,
47979 size_t totlen = 0, thislen;
47980 int ret = 0;
47981 size_t buflen = 0;
47982 - static char *buffer;
47983 + char *buffer;
47984
47985 if (!ECCBUF_SIZE) {
47986 /* We should fall back to a general writev implementation.
47987 diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
47988 index 870c7fc..c7d6440 100644
47989 --- a/drivers/mtd/nand/denali.c
47990 +++ b/drivers/mtd/nand/denali.c
47991 @@ -24,6 +24,7 @@
47992 #include <linux/slab.h>
47993 #include <linux/mtd/mtd.h>
47994 #include <linux/module.h>
47995 +#include <linux/slab.h>
47996
47997 #include "denali.h"
47998
47999 diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
48000 index 1b8f350..990f2e9 100644
48001 --- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
48002 +++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
48003 @@ -386,7 +386,7 @@ void prepare_data_dma(struct gpmi_nand_data *this, enum dma_data_direction dr)
48004
48005 /* first try to map the upper buffer directly */
48006 if (virt_addr_valid(this->upper_buf) &&
48007 - !object_is_on_stack(this->upper_buf)) {
48008 + !object_starts_on_stack(this->upper_buf)) {
48009 sg_init_one(sgl, this->upper_buf, this->upper_len);
48010 ret = dma_map_sg(this->dev, sgl, 1, dr);
48011 if (ret == 0)
48012 diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
48013 index a5dfbfb..8042ab4 100644
48014 --- a/drivers/mtd/nftlmount.c
48015 +++ b/drivers/mtd/nftlmount.c
48016 @@ -24,6 +24,7 @@
48017 #include <asm/errno.h>
48018 #include <linux/delay.h>
48019 #include <linux/slab.h>
48020 +#include <linux/sched.h>
48021 #include <linux/mtd/mtd.h>
48022 #include <linux/mtd/nand.h>
48023 #include <linux/mtd/nftl.h>
48024 diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
48025 index c23184a..4115c41 100644
48026 --- a/drivers/mtd/sm_ftl.c
48027 +++ b/drivers/mtd/sm_ftl.c
48028 @@ -56,7 +56,7 @@ static ssize_t sm_attr_show(struct device *dev, struct device_attribute *attr,
48029 #define SM_CIS_VENDOR_OFFSET 0x59
48030 static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
48031 {
48032 - struct attribute_group *attr_group;
48033 + attribute_group_no_const *attr_group;
48034 struct attribute **attributes;
48035 struct sm_sysfs_attribute *vendor_attribute;
48036 char *vendor;
48037 diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
48038 index 7b11243..b3278a3 100644
48039 --- a/drivers/net/bonding/bond_netlink.c
48040 +++ b/drivers/net/bonding/bond_netlink.c
48041 @@ -585,7 +585,7 @@ nla_put_failure:
48042 return -EMSGSIZE;
48043 }
48044
48045 -struct rtnl_link_ops bond_link_ops __read_mostly = {
48046 +struct rtnl_link_ops bond_link_ops = {
48047 .kind = "bond",
48048 .priv_size = sizeof(struct bonding),
48049 .setup = bond_setup,
48050 diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
48051 index b3b922a..80bba38 100644
48052 --- a/drivers/net/caif/caif_hsi.c
48053 +++ b/drivers/net/caif/caif_hsi.c
48054 @@ -1444,7 +1444,7 @@ err:
48055 return -ENODEV;
48056 }
48057
48058 -static struct rtnl_link_ops caif_hsi_link_ops __read_mostly = {
48059 +static struct rtnl_link_ops caif_hsi_link_ops = {
48060 .kind = "cfhsi",
48061 .priv_size = sizeof(struct cfhsi),
48062 .setup = cfhsi_setup,
48063 diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
48064 index e8c96b8..516a96c 100644
48065 --- a/drivers/net/can/Kconfig
48066 +++ b/drivers/net/can/Kconfig
48067 @@ -98,7 +98,7 @@ config CAN_JANZ_ICAN3
48068
48069 config CAN_FLEXCAN
48070 tristate "Support for Freescale FLEXCAN based chips"
48071 - depends on ARM || PPC
48072 + depends on (ARM && CPU_LITTLE_ENDIAN) || PPC
48073 ---help---
48074 Say Y here if you want to support for Freescale FlexCAN.
48075
48076 diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
48077 index e9b1810..5c2f3f9 100644
48078 --- a/drivers/net/can/dev.c
48079 +++ b/drivers/net/can/dev.c
48080 @@ -964,7 +964,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
48081 return -EOPNOTSUPP;
48082 }
48083
48084 -static struct rtnl_link_ops can_link_ops __read_mostly = {
48085 +static struct rtnl_link_ops can_link_ops = {
48086 .kind = "can",
48087 .maxtype = IFLA_CAN_MAX,
48088 .policy = can_policy,
48089 diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
48090 index 0ce868d..e5dc8bd 100644
48091 --- a/drivers/net/can/vcan.c
48092 +++ b/drivers/net/can/vcan.c
48093 @@ -166,7 +166,7 @@ static void vcan_setup(struct net_device *dev)
48094 dev->destructor = free_netdev;
48095 }
48096
48097 -static struct rtnl_link_ops vcan_link_ops __read_mostly = {
48098 +static struct rtnl_link_ops vcan_link_ops = {
48099 .kind = "vcan",
48100 .setup = vcan_setup,
48101 };
48102 diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
48103 index 49adbf1..fff7ff8 100644
48104 --- a/drivers/net/dummy.c
48105 +++ b/drivers/net/dummy.c
48106 @@ -164,7 +164,7 @@ static int dummy_validate(struct nlattr *tb[], struct nlattr *data[])
48107 return 0;
48108 }
48109
48110 -static struct rtnl_link_ops dummy_link_ops __read_mostly = {
48111 +static struct rtnl_link_ops dummy_link_ops = {
48112 .kind = DRV_NAME,
48113 .setup = dummy_setup,
48114 .validate = dummy_validate,
48115 diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
48116 index 0443654..4f0aa18 100644
48117 --- a/drivers/net/ethernet/8390/ax88796.c
48118 +++ b/drivers/net/ethernet/8390/ax88796.c
48119 @@ -889,9 +889,11 @@ static int ax_probe(struct platform_device *pdev)
48120 if (ax->plat->reg_offsets)
48121 ei_local->reg_offset = ax->plat->reg_offsets;
48122 else {
48123 + resource_size_t _mem_size = mem_size;
48124 + do_div(_mem_size, 0x18);
48125 ei_local->reg_offset = ax->reg_offsets;
48126 for (ret = 0; ret < 0x18; ret++)
48127 - ax->reg_offsets[ret] = (mem_size / 0x18) * ret;
48128 + ax->reg_offsets[ret] = _mem_size * ret;
48129 }
48130
48131 if (!request_mem_region(mem->start, mem_size, pdev->name)) {
48132 diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
48133 index da48e66..2dbec80 100644
48134 --- a/drivers/net/ethernet/altera/altera_tse_main.c
48135 +++ b/drivers/net/ethernet/altera/altera_tse_main.c
48136 @@ -1256,7 +1256,7 @@ static int tse_shutdown(struct net_device *dev)
48137 return 0;
48138 }
48139
48140 -static struct net_device_ops altera_tse_netdev_ops = {
48141 +static net_device_ops_no_const altera_tse_netdev_ops __read_only = {
48142 .ndo_open = tse_open,
48143 .ndo_stop = tse_shutdown,
48144 .ndo_start_xmit = tse_start_xmit,
48145 @@ -1493,11 +1493,13 @@ static int altera_tse_probe(struct platform_device *pdev)
48146 ndev->netdev_ops = &altera_tse_netdev_ops;
48147 altera_tse_set_ethtool_ops(ndev);
48148
48149 + pax_open_kernel();
48150 altera_tse_netdev_ops.ndo_set_rx_mode = tse_set_rx_mode;
48151
48152 if (priv->hash_filter)
48153 altera_tse_netdev_ops.ndo_set_rx_mode =
48154 tse_set_rx_mode_hashfilter;
48155 + pax_close_kernel();
48156
48157 /* Scatter/gather IO is not supported,
48158 * so it is turned off
48159 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
48160 index 34c28aa..5e06567 100644
48161 --- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
48162 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
48163 @@ -1124,14 +1124,14 @@ do { \
48164 * operations, everything works on mask values.
48165 */
48166 #define XMDIO_READ(_pdata, _mmd, _reg) \
48167 - ((_pdata)->hw_if.read_mmd_regs((_pdata), 0, \
48168 + ((_pdata)->hw_if->read_mmd_regs((_pdata), 0, \
48169 MII_ADDR_C45 | (_mmd << 16) | ((_reg) & 0xffff)))
48170
48171 #define XMDIO_READ_BITS(_pdata, _mmd, _reg, _mask) \
48172 (XMDIO_READ((_pdata), _mmd, _reg) & _mask)
48173
48174 #define XMDIO_WRITE(_pdata, _mmd, _reg, _val) \
48175 - ((_pdata)->hw_if.write_mmd_regs((_pdata), 0, \
48176 + ((_pdata)->hw_if->write_mmd_regs((_pdata), 0, \
48177 MII_ADDR_C45 | (_mmd << 16) | ((_reg) & 0xffff), (_val)))
48178
48179 #define XMDIO_WRITE_BITS(_pdata, _mmd, _reg, _mask, _val) \
48180 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dcb.c b/drivers/net/ethernet/amd/xgbe/xgbe-dcb.c
48181 index 8a50b01..39c1ad0 100644
48182 --- a/drivers/net/ethernet/amd/xgbe/xgbe-dcb.c
48183 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-dcb.c
48184 @@ -187,7 +187,7 @@ static int xgbe_dcb_ieee_setets(struct net_device *netdev,
48185
48186 memcpy(pdata->ets, ets, sizeof(*pdata->ets));
48187
48188 - pdata->hw_if.config_dcb_tc(pdata);
48189 + pdata->hw_if->config_dcb_tc(pdata);
48190
48191 return 0;
48192 }
48193 @@ -226,7 +226,7 @@ static int xgbe_dcb_ieee_setpfc(struct net_device *netdev,
48194
48195 memcpy(pdata->pfc, pfc, sizeof(*pdata->pfc));
48196
48197 - pdata->hw_if.config_dcb_pfc(pdata);
48198 + pdata->hw_if->config_dcb_pfc(pdata);
48199
48200 return 0;
48201 }
48202 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
48203 index 5c92fb7..08be735 100644
48204 --- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
48205 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
48206 @@ -347,7 +347,7 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
48207
48208 static void xgbe_wrapper_tx_descriptor_init(struct xgbe_prv_data *pdata)
48209 {
48210 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48211 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48212 struct xgbe_channel *channel;
48213 struct xgbe_ring *ring;
48214 struct xgbe_ring_data *rdata;
48215 @@ -388,7 +388,7 @@ static void xgbe_wrapper_tx_descriptor_init(struct xgbe_prv_data *pdata)
48216
48217 static void xgbe_wrapper_rx_descriptor_init(struct xgbe_prv_data *pdata)
48218 {
48219 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48220 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48221 struct xgbe_channel *channel;
48222 struct xgbe_ring *ring;
48223 struct xgbe_ring_desc *rdesc;
48224 @@ -620,17 +620,12 @@ err_out:
48225 return 0;
48226 }
48227
48228 -void xgbe_init_function_ptrs_desc(struct xgbe_desc_if *desc_if)
48229 -{
48230 - DBGPR("-->xgbe_init_function_ptrs_desc\n");
48231 -
48232 - desc_if->alloc_ring_resources = xgbe_alloc_ring_resources;
48233 - desc_if->free_ring_resources = xgbe_free_ring_resources;
48234 - desc_if->map_tx_skb = xgbe_map_tx_skb;
48235 - desc_if->map_rx_buffer = xgbe_map_rx_buffer;
48236 - desc_if->unmap_rdata = xgbe_unmap_rdata;
48237 - desc_if->wrapper_tx_desc_init = xgbe_wrapper_tx_descriptor_init;
48238 - desc_if->wrapper_rx_desc_init = xgbe_wrapper_rx_descriptor_init;
48239 -
48240 - DBGPR("<--xgbe_init_function_ptrs_desc\n");
48241 -}
48242 +struct xgbe_desc_if default_xgbe_desc_if = {
48243 + .alloc_ring_resources = xgbe_alloc_ring_resources,
48244 + .free_ring_resources = xgbe_free_ring_resources,
48245 + .map_tx_skb = xgbe_map_tx_skb,
48246 + .map_rx_buffer = xgbe_map_rx_buffer,
48247 + .unmap_rdata = xgbe_unmap_rdata,
48248 + .wrapper_tx_desc_init = xgbe_wrapper_tx_descriptor_init,
48249 + .wrapper_rx_desc_init = xgbe_wrapper_rx_descriptor_init,
48250 +};
48251 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
48252 index 21d9497..c74b40f 100644
48253 --- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
48254 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
48255 @@ -2772,7 +2772,7 @@ static void xgbe_powerdown_rx(struct xgbe_prv_data *pdata)
48256
48257 static int xgbe_init(struct xgbe_prv_data *pdata)
48258 {
48259 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48260 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48261 int ret;
48262
48263 DBGPR("-->xgbe_init\n");
48264 @@ -2838,106 +2838,101 @@ static int xgbe_init(struct xgbe_prv_data *pdata)
48265 return 0;
48266 }
48267
48268 -void xgbe_init_function_ptrs_dev(struct xgbe_hw_if *hw_if)
48269 -{
48270 - DBGPR("-->xgbe_init_function_ptrs\n");
48271 -
48272 - hw_if->tx_complete = xgbe_tx_complete;
48273 -
48274 - hw_if->set_mac_address = xgbe_set_mac_address;
48275 - hw_if->config_rx_mode = xgbe_config_rx_mode;
48276 -
48277 - hw_if->enable_rx_csum = xgbe_enable_rx_csum;
48278 - hw_if->disable_rx_csum = xgbe_disable_rx_csum;
48279 -
48280 - hw_if->enable_rx_vlan_stripping = xgbe_enable_rx_vlan_stripping;
48281 - hw_if->disable_rx_vlan_stripping = xgbe_disable_rx_vlan_stripping;
48282 - hw_if->enable_rx_vlan_filtering = xgbe_enable_rx_vlan_filtering;
48283 - hw_if->disable_rx_vlan_filtering = xgbe_disable_rx_vlan_filtering;
48284 - hw_if->update_vlan_hash_table = xgbe_update_vlan_hash_table;
48285 -
48286 - hw_if->read_mmd_regs = xgbe_read_mmd_regs;
48287 - hw_if->write_mmd_regs = xgbe_write_mmd_regs;
48288 -
48289 - hw_if->set_gmii_speed = xgbe_set_gmii_speed;
48290 - hw_if->set_gmii_2500_speed = xgbe_set_gmii_2500_speed;
48291 - hw_if->set_xgmii_speed = xgbe_set_xgmii_speed;
48292 -
48293 - hw_if->enable_tx = xgbe_enable_tx;
48294 - hw_if->disable_tx = xgbe_disable_tx;
48295 - hw_if->enable_rx = xgbe_enable_rx;
48296 - hw_if->disable_rx = xgbe_disable_rx;
48297 -
48298 - hw_if->powerup_tx = xgbe_powerup_tx;
48299 - hw_if->powerdown_tx = xgbe_powerdown_tx;
48300 - hw_if->powerup_rx = xgbe_powerup_rx;
48301 - hw_if->powerdown_rx = xgbe_powerdown_rx;
48302 -
48303 - hw_if->dev_xmit = xgbe_dev_xmit;
48304 - hw_if->dev_read = xgbe_dev_read;
48305 - hw_if->enable_int = xgbe_enable_int;
48306 - hw_if->disable_int = xgbe_disable_int;
48307 - hw_if->init = xgbe_init;
48308 - hw_if->exit = xgbe_exit;
48309 +struct xgbe_hw_if default_xgbe_hw_if = {
48310 + .tx_complete = xgbe_tx_complete,
48311 +
48312 + .set_mac_address = xgbe_set_mac_address,
48313 + .config_rx_mode = xgbe_config_rx_mode,
48314 +
48315 + .enable_rx_csum = xgbe_enable_rx_csum,
48316 + .disable_rx_csum = xgbe_disable_rx_csum,
48317 +
48318 + .enable_rx_vlan_stripping = xgbe_enable_rx_vlan_stripping,
48319 + .disable_rx_vlan_stripping = xgbe_disable_rx_vlan_stripping,
48320 + .enable_rx_vlan_filtering = xgbe_enable_rx_vlan_filtering,
48321 + .disable_rx_vlan_filtering = xgbe_disable_rx_vlan_filtering,
48322 + .update_vlan_hash_table = xgbe_update_vlan_hash_table,
48323 +
48324 + .read_mmd_regs = xgbe_read_mmd_regs,
48325 + .write_mmd_regs = xgbe_write_mmd_regs,
48326 +
48327 + .set_gmii_speed = xgbe_set_gmii_speed,
48328 + .set_gmii_2500_speed = xgbe_set_gmii_2500_speed,
48329 + .set_xgmii_speed = xgbe_set_xgmii_speed,
48330 +
48331 + .enable_tx = xgbe_enable_tx,
48332 + .disable_tx = xgbe_disable_tx,
48333 + .enable_rx = xgbe_enable_rx,
48334 + .disable_rx = xgbe_disable_rx,
48335 +
48336 + .powerup_tx = xgbe_powerup_tx,
48337 + .powerdown_tx = xgbe_powerdown_tx,
48338 + .powerup_rx = xgbe_powerup_rx,
48339 + .powerdown_rx = xgbe_powerdown_rx,
48340 +
48341 + .dev_xmit = xgbe_dev_xmit,
48342 + .dev_read = xgbe_dev_read,
48343 + .enable_int = xgbe_enable_int,
48344 + .disable_int = xgbe_disable_int,
48345 + .init = xgbe_init,
48346 + .exit = xgbe_exit,
48347
48348 /* Descriptor related Sequences have to be initialized here */
48349 - hw_if->tx_desc_init = xgbe_tx_desc_init;
48350 - hw_if->rx_desc_init = xgbe_rx_desc_init;
48351 - hw_if->tx_desc_reset = xgbe_tx_desc_reset;
48352 - hw_if->rx_desc_reset = xgbe_rx_desc_reset;
48353 - hw_if->is_last_desc = xgbe_is_last_desc;
48354 - hw_if->is_context_desc = xgbe_is_context_desc;
48355 - hw_if->tx_start_xmit = xgbe_tx_start_xmit;
48356 + .tx_desc_init = xgbe_tx_desc_init,
48357 + .rx_desc_init = xgbe_rx_desc_init,
48358 + .tx_desc_reset = xgbe_tx_desc_reset,
48359 + .rx_desc_reset = xgbe_rx_desc_reset,
48360 + .is_last_desc = xgbe_is_last_desc,
48361 + .is_context_desc = xgbe_is_context_desc,
48362 + .tx_start_xmit = xgbe_tx_start_xmit,
48363
48364 /* For FLOW ctrl */
48365 - hw_if->config_tx_flow_control = xgbe_config_tx_flow_control;
48366 - hw_if->config_rx_flow_control = xgbe_config_rx_flow_control;
48367 + .config_tx_flow_control = xgbe_config_tx_flow_control,
48368 + .config_rx_flow_control = xgbe_config_rx_flow_control,
48369
48370 /* For RX coalescing */
48371 - hw_if->config_rx_coalesce = xgbe_config_rx_coalesce;
48372 - hw_if->config_tx_coalesce = xgbe_config_tx_coalesce;
48373 - hw_if->usec_to_riwt = xgbe_usec_to_riwt;
48374 - hw_if->riwt_to_usec = xgbe_riwt_to_usec;
48375 + .config_rx_coalesce = xgbe_config_rx_coalesce,
48376 + .config_tx_coalesce = xgbe_config_tx_coalesce,
48377 + .usec_to_riwt = xgbe_usec_to_riwt,
48378 + .riwt_to_usec = xgbe_riwt_to_usec,
48379
48380 /* For RX and TX threshold config */
48381 - hw_if->config_rx_threshold = xgbe_config_rx_threshold;
48382 - hw_if->config_tx_threshold = xgbe_config_tx_threshold;
48383 + .config_rx_threshold = xgbe_config_rx_threshold,
48384 + .config_tx_threshold = xgbe_config_tx_threshold,
48385
48386 /* For RX and TX Store and Forward Mode config */
48387 - hw_if->config_rsf_mode = xgbe_config_rsf_mode;
48388 - hw_if->config_tsf_mode = xgbe_config_tsf_mode;
48389 + .config_rsf_mode = xgbe_config_rsf_mode,
48390 + .config_tsf_mode = xgbe_config_tsf_mode,
48391
48392 /* For TX DMA Operating on Second Frame config */
48393 - hw_if->config_osp_mode = xgbe_config_osp_mode;
48394 + .config_osp_mode = xgbe_config_osp_mode,
48395
48396 /* For RX and TX PBL config */
48397 - hw_if->config_rx_pbl_val = xgbe_config_rx_pbl_val;
48398 - hw_if->get_rx_pbl_val = xgbe_get_rx_pbl_val;
48399 - hw_if->config_tx_pbl_val = xgbe_config_tx_pbl_val;
48400 - hw_if->get_tx_pbl_val = xgbe_get_tx_pbl_val;
48401 - hw_if->config_pblx8 = xgbe_config_pblx8;
48402 + .config_rx_pbl_val = xgbe_config_rx_pbl_val,
48403 + .get_rx_pbl_val = xgbe_get_rx_pbl_val,
48404 + .config_tx_pbl_val = xgbe_config_tx_pbl_val,
48405 + .get_tx_pbl_val = xgbe_get_tx_pbl_val,
48406 + .config_pblx8 = xgbe_config_pblx8,
48407
48408 /* For MMC statistics support */
48409 - hw_if->tx_mmc_int = xgbe_tx_mmc_int;
48410 - hw_if->rx_mmc_int = xgbe_rx_mmc_int;
48411 - hw_if->read_mmc_stats = xgbe_read_mmc_stats;
48412 + .tx_mmc_int = xgbe_tx_mmc_int,
48413 + .rx_mmc_int = xgbe_rx_mmc_int,
48414 + .read_mmc_stats = xgbe_read_mmc_stats,
48415
48416 /* For PTP config */
48417 - hw_if->config_tstamp = xgbe_config_tstamp;
48418 - hw_if->update_tstamp_addend = xgbe_update_tstamp_addend;
48419 - hw_if->set_tstamp_time = xgbe_set_tstamp_time;
48420 - hw_if->get_tstamp_time = xgbe_get_tstamp_time;
48421 - hw_if->get_tx_tstamp = xgbe_get_tx_tstamp;
48422 + .config_tstamp = xgbe_config_tstamp,
48423 + .update_tstamp_addend = xgbe_update_tstamp_addend,
48424 + .set_tstamp_time = xgbe_set_tstamp_time,
48425 + .get_tstamp_time = xgbe_get_tstamp_time,
48426 + .get_tx_tstamp = xgbe_get_tx_tstamp,
48427
48428 /* For Data Center Bridging config */
48429 - hw_if->config_dcb_tc = xgbe_config_dcb_tc;
48430 - hw_if->config_dcb_pfc = xgbe_config_dcb_pfc;
48431 + .config_dcb_tc = xgbe_config_dcb_tc,
48432 + .config_dcb_pfc = xgbe_config_dcb_pfc,
48433
48434 /* For Receive Side Scaling */
48435 - hw_if->enable_rss = xgbe_enable_rss;
48436 - hw_if->disable_rss = xgbe_disable_rss;
48437 - hw_if->set_rss_hash_key = xgbe_set_rss_hash_key;
48438 - hw_if->set_rss_lookup_table = xgbe_set_rss_lookup_table;
48439 -
48440 - DBGPR("<--xgbe_init_function_ptrs\n");
48441 -}
48442 + .enable_rss = xgbe_enable_rss,
48443 + .disable_rss = xgbe_disable_rss,
48444 + .set_rss_hash_key = xgbe_set_rss_hash_key,
48445 + .set_rss_lookup_table = xgbe_set_rss_lookup_table,
48446 +};
48447 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
48448 index 9fd6c69..588ff02 100644
48449 --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
48450 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
48451 @@ -243,7 +243,7 @@ static int xgbe_maybe_stop_tx_queue(struct xgbe_channel *channel,
48452 * support, tell it now
48453 */
48454 if (ring->tx.xmit_more)
48455 - pdata->hw_if.tx_start_xmit(channel, ring);
48456 + pdata->hw_if->tx_start_xmit(channel, ring);
48457
48458 return NETDEV_TX_BUSY;
48459 }
48460 @@ -271,7 +271,7 @@ static int xgbe_calc_rx_buf_size(struct net_device *netdev, unsigned int mtu)
48461
48462 static void xgbe_enable_rx_tx_ints(struct xgbe_prv_data *pdata)
48463 {
48464 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48465 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48466 struct xgbe_channel *channel;
48467 enum xgbe_int int_id;
48468 unsigned int i;
48469 @@ -293,7 +293,7 @@ static void xgbe_enable_rx_tx_ints(struct xgbe_prv_data *pdata)
48470
48471 static void xgbe_disable_rx_tx_ints(struct xgbe_prv_data *pdata)
48472 {
48473 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48474 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48475 struct xgbe_channel *channel;
48476 enum xgbe_int int_id;
48477 unsigned int i;
48478 @@ -316,7 +316,7 @@ static void xgbe_disable_rx_tx_ints(struct xgbe_prv_data *pdata)
48479 static irqreturn_t xgbe_isr(int irq, void *data)
48480 {
48481 struct xgbe_prv_data *pdata = data;
48482 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48483 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48484 struct xgbe_channel *channel;
48485 unsigned int dma_isr, dma_ch_isr;
48486 unsigned int mac_isr, mac_tssr;
48487 @@ -682,7 +682,7 @@ static void xgbe_free_irqs(struct xgbe_prv_data *pdata)
48488
48489 void xgbe_init_tx_coalesce(struct xgbe_prv_data *pdata)
48490 {
48491 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48492 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48493
48494 DBGPR("-->xgbe_init_tx_coalesce\n");
48495
48496 @@ -696,7 +696,7 @@ void xgbe_init_tx_coalesce(struct xgbe_prv_data *pdata)
48497
48498 void xgbe_init_rx_coalesce(struct xgbe_prv_data *pdata)
48499 {
48500 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48501 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48502
48503 DBGPR("-->xgbe_init_rx_coalesce\n");
48504
48505 @@ -711,7 +711,7 @@ void xgbe_init_rx_coalesce(struct xgbe_prv_data *pdata)
48506
48507 static void xgbe_free_tx_data(struct xgbe_prv_data *pdata)
48508 {
48509 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48510 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48511 struct xgbe_channel *channel;
48512 struct xgbe_ring *ring;
48513 struct xgbe_ring_data *rdata;
48514 @@ -736,7 +736,7 @@ static void xgbe_free_tx_data(struct xgbe_prv_data *pdata)
48515
48516 static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
48517 {
48518 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48519 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48520 struct xgbe_channel *channel;
48521 struct xgbe_ring *ring;
48522 struct xgbe_ring_data *rdata;
48523 @@ -762,7 +762,7 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
48524 static void xgbe_adjust_link(struct net_device *netdev)
48525 {
48526 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48527 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48528 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48529 struct phy_device *phydev = pdata->phydev;
48530 int new_state = 0;
48531
48532 @@ -870,7 +870,7 @@ static void xgbe_phy_exit(struct xgbe_prv_data *pdata)
48533 int xgbe_powerdown(struct net_device *netdev, unsigned int caller)
48534 {
48535 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48536 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48537 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48538 unsigned long flags;
48539
48540 DBGPR("-->xgbe_powerdown\n");
48541 @@ -908,7 +908,7 @@ int xgbe_powerdown(struct net_device *netdev, unsigned int caller)
48542 int xgbe_powerup(struct net_device *netdev, unsigned int caller)
48543 {
48544 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48545 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48546 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48547 unsigned long flags;
48548
48549 DBGPR("-->xgbe_powerup\n");
48550 @@ -945,7 +945,7 @@ int xgbe_powerup(struct net_device *netdev, unsigned int caller)
48551
48552 static int xgbe_start(struct xgbe_prv_data *pdata)
48553 {
48554 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48555 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48556 struct net_device *netdev = pdata->netdev;
48557 int ret;
48558
48559 @@ -984,7 +984,7 @@ err_napi:
48560
48561 static void xgbe_stop(struct xgbe_prv_data *pdata)
48562 {
48563 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48564 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48565 struct xgbe_channel *channel;
48566 struct net_device *netdev = pdata->netdev;
48567 struct netdev_queue *txq;
48568 @@ -1211,7 +1211,7 @@ static int xgbe_set_hwtstamp_settings(struct xgbe_prv_data *pdata,
48569 return -ERANGE;
48570 }
48571
48572 - pdata->hw_if.config_tstamp(pdata, mac_tscr);
48573 + pdata->hw_if->config_tstamp(pdata, mac_tscr);
48574
48575 memcpy(&pdata->tstamp_config, &config, sizeof(config));
48576
48577 @@ -1360,7 +1360,7 @@ static void xgbe_packet_info(struct xgbe_prv_data *pdata,
48578 static int xgbe_open(struct net_device *netdev)
48579 {
48580 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48581 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48582 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48583 int ret;
48584
48585 DBGPR("-->xgbe_open\n");
48586 @@ -1432,7 +1432,7 @@ err_phy_init:
48587 static int xgbe_close(struct net_device *netdev)
48588 {
48589 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48590 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48591 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48592
48593 DBGPR("-->xgbe_close\n");
48594
48595 @@ -1460,8 +1460,8 @@ static int xgbe_close(struct net_device *netdev)
48596 static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
48597 {
48598 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48599 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48600 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48601 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48602 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48603 struct xgbe_channel *channel;
48604 struct xgbe_ring *ring;
48605 struct xgbe_packet_data *packet;
48606 @@ -1529,7 +1529,7 @@ tx_netdev_return:
48607 static void xgbe_set_rx_mode(struct net_device *netdev)
48608 {
48609 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48610 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48611 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48612
48613 DBGPR("-->xgbe_set_rx_mode\n");
48614
48615 @@ -1541,7 +1541,7 @@ static void xgbe_set_rx_mode(struct net_device *netdev)
48616 static int xgbe_set_mac_address(struct net_device *netdev, void *addr)
48617 {
48618 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48619 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48620 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48621 struct sockaddr *saddr = addr;
48622
48623 DBGPR("-->xgbe_set_mac_address\n");
48624 @@ -1616,7 +1616,7 @@ static struct rtnl_link_stats64 *xgbe_get_stats64(struct net_device *netdev,
48625
48626 DBGPR("-->%s\n", __func__);
48627
48628 - pdata->hw_if.read_mmc_stats(pdata);
48629 + pdata->hw_if->read_mmc_stats(pdata);
48630
48631 s->rx_packets = pstats->rxframecount_gb;
48632 s->rx_bytes = pstats->rxoctetcount_gb;
48633 @@ -1643,7 +1643,7 @@ static int xgbe_vlan_rx_add_vid(struct net_device *netdev, __be16 proto,
48634 u16 vid)
48635 {
48636 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48637 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48638 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48639
48640 DBGPR("-->%s\n", __func__);
48641
48642 @@ -1659,7 +1659,7 @@ static int xgbe_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto,
48643 u16 vid)
48644 {
48645 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48646 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48647 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48648
48649 DBGPR("-->%s\n", __func__);
48650
48651 @@ -1725,7 +1725,7 @@ static int xgbe_set_features(struct net_device *netdev,
48652 netdev_features_t features)
48653 {
48654 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48655 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48656 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48657 netdev_features_t rxhash, rxcsum, rxvlan, rxvlan_filter;
48658 int ret = 0;
48659
48660 @@ -1791,8 +1791,8 @@ struct net_device_ops *xgbe_get_netdev_ops(void)
48661 static void xgbe_rx_refresh(struct xgbe_channel *channel)
48662 {
48663 struct xgbe_prv_data *pdata = channel->pdata;
48664 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48665 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48666 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48667 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48668 struct xgbe_ring *ring = channel->rx_ring;
48669 struct xgbe_ring_data *rdata;
48670
48671 @@ -1847,8 +1847,8 @@ static struct sk_buff *xgbe_create_skb(struct napi_struct *napi,
48672 static int xgbe_tx_poll(struct xgbe_channel *channel)
48673 {
48674 struct xgbe_prv_data *pdata = channel->pdata;
48675 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48676 - struct xgbe_desc_if *desc_if = &pdata->desc_if;
48677 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48678 + struct xgbe_desc_if *desc_if = pdata->desc_if;
48679 struct xgbe_ring *ring = channel->tx_ring;
48680 struct xgbe_ring_data *rdata;
48681 struct xgbe_ring_desc *rdesc;
48682 @@ -1913,7 +1913,7 @@ static int xgbe_tx_poll(struct xgbe_channel *channel)
48683 static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
48684 {
48685 struct xgbe_prv_data *pdata = channel->pdata;
48686 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48687 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48688 struct xgbe_ring *ring = channel->rx_ring;
48689 struct xgbe_ring_data *rdata;
48690 struct xgbe_packet_data *packet;
48691 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
48692 index 5f149e8..6736bf4 100644
48693 --- a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
48694 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
48695 @@ -203,7 +203,7 @@ static void xgbe_get_ethtool_stats(struct net_device *netdev,
48696
48697 DBGPR("-->%s\n", __func__);
48698
48699 - pdata->hw_if.read_mmc_stats(pdata);
48700 + pdata->hw_if->read_mmc_stats(pdata);
48701 for (i = 0; i < XGBE_STATS_COUNT; i++) {
48702 stat = (u8 *)pdata + xgbe_gstring_stats[i].stat_offset;
48703 *data++ = *(u64 *)stat;
48704 @@ -396,7 +396,7 @@ static int xgbe_set_coalesce(struct net_device *netdev,
48705 struct ethtool_coalesce *ec)
48706 {
48707 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48708 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48709 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48710 unsigned int rx_frames, rx_riwt, rx_usecs;
48711 unsigned int tx_frames;
48712
48713 @@ -521,7 +521,7 @@ static int xgbe_set_rxfh(struct net_device *netdev, const u32 *indir,
48714 const u8 *key, const u8 hfunc)
48715 {
48716 struct xgbe_prv_data *pdata = netdev_priv(netdev);
48717 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48718 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48719 unsigned int ret;
48720
48721 if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
48722 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
48723 index 7149053..889c5492 100644
48724 --- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
48725 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
48726 @@ -159,12 +159,6 @@ static void xgbe_default_config(struct xgbe_prv_data *pdata)
48727 DBGPR("<--xgbe_default_config\n");
48728 }
48729
48730 -static void xgbe_init_all_fptrs(struct xgbe_prv_data *pdata)
48731 -{
48732 - xgbe_init_function_ptrs_dev(&pdata->hw_if);
48733 - xgbe_init_function_ptrs_desc(&pdata->desc_if);
48734 -}
48735 -
48736 #ifdef CONFIG_ACPI
48737 static int xgbe_acpi_support(struct xgbe_prv_data *pdata)
48738 {
48739 @@ -387,9 +381,8 @@ static int xgbe_probe(struct platform_device *pdev)
48740 memcpy(netdev->dev_addr, pdata->mac_addr, netdev->addr_len);
48741
48742 /* Set all the function pointers */
48743 - xgbe_init_all_fptrs(pdata);
48744 - hw_if = &pdata->hw_if;
48745 - desc_if = &pdata->desc_if;
48746 + hw_if = pdata->hw_if = &default_xgbe_hw_if;
48747 + desc_if = pdata->desc_if = &default_xgbe_desc_if;
48748
48749 /* Issue software reset to device */
48750 hw_if->exit(pdata);
48751 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
48752 index 59e267f..0842a88 100644
48753 --- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
48754 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
48755 @@ -126,7 +126,7 @@
48756 static int xgbe_mdio_read(struct mii_bus *mii, int prtad, int mmd_reg)
48757 {
48758 struct xgbe_prv_data *pdata = mii->priv;
48759 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48760 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48761 int mmd_data;
48762
48763 DBGPR_MDIO("-->xgbe_mdio_read: prtad=%#x mmd_reg=%#x\n",
48764 @@ -143,7 +143,7 @@ static int xgbe_mdio_write(struct mii_bus *mii, int prtad, int mmd_reg,
48765 u16 mmd_val)
48766 {
48767 struct xgbe_prv_data *pdata = mii->priv;
48768 - struct xgbe_hw_if *hw_if = &pdata->hw_if;
48769 + struct xgbe_hw_if *hw_if = pdata->hw_if;
48770 int mmd_data = mmd_val;
48771
48772 DBGPR_MDIO("-->xgbe_mdio_write: prtad=%#x mmd_reg=%#x mmd_data=%#x\n",
48773 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-ptp.c b/drivers/net/ethernet/amd/xgbe/xgbe-ptp.c
48774 index b03e4f5..78e4cc4 100644
48775 --- a/drivers/net/ethernet/amd/xgbe/xgbe-ptp.c
48776 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-ptp.c
48777 @@ -129,7 +129,7 @@ static cycle_t xgbe_cc_read(const struct cyclecounter *cc)
48778 tstamp_cc);
48779 u64 nsec;
48780
48781 - nsec = pdata->hw_if.get_tstamp_time(pdata);
48782 + nsec = pdata->hw_if->get_tstamp_time(pdata);
48783
48784 return nsec;
48785 }
48786 @@ -158,7 +158,7 @@ static int xgbe_adjfreq(struct ptp_clock_info *info, s32 delta)
48787
48788 spin_lock_irqsave(&pdata->tstamp_lock, flags);
48789
48790 - pdata->hw_if.update_tstamp_addend(pdata, addend);
48791 + pdata->hw_if->update_tstamp_addend(pdata, addend);
48792
48793 spin_unlock_irqrestore(&pdata->tstamp_lock, flags);
48794
48795 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
48796 index e62dfa2..7df28d5 100644
48797 --- a/drivers/net/ethernet/amd/xgbe/xgbe.h
48798 +++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
48799 @@ -673,8 +673,8 @@ struct xgbe_prv_data {
48800 int dev_irq;
48801 unsigned int per_channel_irq;
48802
48803 - struct xgbe_hw_if hw_if;
48804 - struct xgbe_desc_if desc_if;
48805 + struct xgbe_hw_if *hw_if;
48806 + struct xgbe_desc_if *desc_if;
48807
48808 /* AXI DMA settings */
48809 unsigned int coherent;
48810 @@ -797,6 +797,9 @@ struct xgbe_prv_data {
48811 #endif
48812 };
48813
48814 +extern struct xgbe_hw_if default_xgbe_hw_if;
48815 +extern struct xgbe_desc_if default_xgbe_desc_if;
48816 +
48817 /* Function prototypes*/
48818
48819 void xgbe_init_function_ptrs_dev(struct xgbe_hw_if *);
48820 diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
48821 index 783543a..a472348 100644
48822 --- a/drivers/net/ethernet/broadcom/bcmsysport.c
48823 +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
48824 @@ -1721,7 +1721,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
48825 macaddr = of_get_mac_address(dn);
48826 if (!macaddr || !is_valid_ether_addr(macaddr)) {
48827 dev_warn(&pdev->dev, "using random Ethernet MAC\n");
48828 - random_ether_addr(dev->dev_addr);
48829 + eth_hw_addr_random(dev);
48830 } else {
48831 ether_addr_copy(dev->dev_addr, macaddr);
48832 }
48833 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
48834 index d7a7175..7011194 100644
48835 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
48836 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
48837 @@ -1065,7 +1065,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp)
48838 static inline void bnx2x_init_bp_objs(struct bnx2x *bp)
48839 {
48840 /* RX_MODE controlling object */
48841 - bnx2x_init_rx_mode_obj(bp, &bp->rx_mode_obj);
48842 + bnx2x_init_rx_mode_obj(bp);
48843
48844 /* multicast configuration controlling object */
48845 bnx2x_init_mcast_obj(bp, &bp->mcast_obj, bp->fp->cl_id, bp->fp->cid,
48846 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
48847 index 07cdf9b..b08ecc7 100644
48848 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
48849 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
48850 @@ -2329,15 +2329,14 @@ int bnx2x_config_rx_mode(struct bnx2x *bp,
48851 return rc;
48852 }
48853
48854 -void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
48855 - struct bnx2x_rx_mode_obj *o)
48856 +void bnx2x_init_rx_mode_obj(struct bnx2x *bp)
48857 {
48858 if (CHIP_IS_E1x(bp)) {
48859 - o->wait_comp = bnx2x_empty_rx_mode_wait;
48860 - o->config_rx_mode = bnx2x_set_rx_mode_e1x;
48861 + bp->rx_mode_obj.wait_comp = bnx2x_empty_rx_mode_wait;
48862 + bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e1x;
48863 } else {
48864 - o->wait_comp = bnx2x_wait_rx_mode_comp_e2;
48865 - o->config_rx_mode = bnx2x_set_rx_mode_e2;
48866 + bp->rx_mode_obj.wait_comp = bnx2x_wait_rx_mode_comp_e2;
48867 + bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e2;
48868 }
48869 }
48870
48871 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
48872 index 86baecb..ff3bb46 100644
48873 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
48874 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
48875 @@ -1411,8 +1411,7 @@ int bnx2x_vlan_mac_move(struct bnx2x *bp,
48876
48877 /********************* RX MODE ****************/
48878
48879 -void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
48880 - struct bnx2x_rx_mode_obj *o);
48881 +void bnx2x_init_rx_mode_obj(struct bnx2x *bp);
48882
48883 /**
48884 * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
48885 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
48886 index 31c9f82..e65e986 100644
48887 --- a/drivers/net/ethernet/broadcom/tg3.h
48888 +++ b/drivers/net/ethernet/broadcom/tg3.h
48889 @@ -150,6 +150,7 @@
48890 #define CHIPREV_ID_5750_A0 0x4000
48891 #define CHIPREV_ID_5750_A1 0x4001
48892 #define CHIPREV_ID_5750_A3 0x4003
48893 +#define CHIPREV_ID_5750_C1 0x4201
48894 #define CHIPREV_ID_5750_C2 0x4202
48895 #define CHIPREV_ID_5752_A0_HW 0x5000
48896 #define CHIPREV_ID_5752_A0 0x6000
48897 diff --git a/drivers/net/ethernet/brocade/bna/bna_enet.c b/drivers/net/ethernet/brocade/bna/bna_enet.c
48898 index deb8da6..45d473b 100644
48899 --- a/drivers/net/ethernet/brocade/bna/bna_enet.c
48900 +++ b/drivers/net/ethernet/brocade/bna/bna_enet.c
48901 @@ -1694,10 +1694,10 @@ bna_cb_ioceth_reset(void *arg)
48902 }
48903
48904 static struct bfa_ioc_cbfn bna_ioceth_cbfn = {
48905 - bna_cb_ioceth_enable,
48906 - bna_cb_ioceth_disable,
48907 - bna_cb_ioceth_hbfail,
48908 - bna_cb_ioceth_reset
48909 + .enable_cbfn = bna_cb_ioceth_enable,
48910 + .disable_cbfn = bna_cb_ioceth_disable,
48911 + .hbfail_cbfn = bna_cb_ioceth_hbfail,
48912 + .reset_cbfn = bna_cb_ioceth_reset
48913 };
48914
48915 static void bna_attr_init(struct bna_ioceth *ioceth)
48916 diff --git a/drivers/net/ethernet/chelsio/cxgb3/l2t.h b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
48917 index 8cffcdf..aadf043 100644
48918 --- a/drivers/net/ethernet/chelsio/cxgb3/l2t.h
48919 +++ b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
48920 @@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
48921 */
48922 struct l2t_skb_cb {
48923 arp_failure_handler_func arp_failure_handler;
48924 -};
48925 +} __no_const;
48926
48927 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
48928
48929 diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
48930 index badff18..e15c4ec 100644
48931 --- a/drivers/net/ethernet/dec/tulip/de4x5.c
48932 +++ b/drivers/net/ethernet/dec/tulip/de4x5.c
48933 @@ -5373,7 +5373,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
48934 for (i=0; i<ETH_ALEN; i++) {
48935 tmp.addr[i] = dev->dev_addr[i];
48936 }
48937 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
48938 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
48939 break;
48940
48941 case DE4X5_SET_HWADDR: /* Set the hardware address */
48942 @@ -5413,7 +5413,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
48943 spin_lock_irqsave(&lp->lock, flags);
48944 memcpy(&statbuf, &lp->pktStats, ioc->len);
48945 spin_unlock_irqrestore(&lp->lock, flags);
48946 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
48947 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
48948 return -EFAULT;
48949 break;
48950 }
48951 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
48952 index e43cc8a..f1cf67c 100644
48953 --- a/drivers/net/ethernet/emulex/benet/be_main.c
48954 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
48955 @@ -539,7 +539,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
48956
48957 if (wrapped)
48958 newacc += 65536;
48959 - ACCESS_ONCE(*acc) = newacc;
48960 + ACCESS_ONCE_RW(*acc) = newacc;
48961 }
48962
48963 static void populate_erx_stats(struct be_adapter *adapter,
48964 diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
48965 index 6d0c5d5..55be363 100644
48966 --- a/drivers/net/ethernet/faraday/ftgmac100.c
48967 +++ b/drivers/net/ethernet/faraday/ftgmac100.c
48968 @@ -30,6 +30,8 @@
48969 #include <linux/netdevice.h>
48970 #include <linux/phy.h>
48971 #include <linux/platform_device.h>
48972 +#include <linux/interrupt.h>
48973 +#include <linux/irqreturn.h>
48974 #include <net/ip.h>
48975
48976 #include "ftgmac100.h"
48977 diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
48978 index dce5f7b..2433466 100644
48979 --- a/drivers/net/ethernet/faraday/ftmac100.c
48980 +++ b/drivers/net/ethernet/faraday/ftmac100.c
48981 @@ -31,6 +31,8 @@
48982 #include <linux/module.h>
48983 #include <linux/netdevice.h>
48984 #include <linux/platform_device.h>
48985 +#include <linux/interrupt.h>
48986 +#include <linux/irqreturn.h>
48987
48988 #include "ftmac100.h"
48989
48990 diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
48991 index a92b772..250fe69 100644
48992 --- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
48993 +++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
48994 @@ -419,7 +419,7 @@ void i40e_ptp_set_increment(struct i40e_pf *pf)
48995 wr32(hw, I40E_PRTTSYN_INC_H, incval >> 32);
48996
48997 /* Update the base adjustement value. */
48998 - ACCESS_ONCE(pf->ptp_base_adj) = incval;
48999 + ACCESS_ONCE_RW(pf->ptp_base_adj) = incval;
49000 smp_mb(); /* Force the above update. */
49001 }
49002
49003 diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
49004 index e5ba040..d47531c 100644
49005 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
49006 +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
49007 @@ -782,7 +782,7 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
49008 }
49009
49010 /* update the base incval used to calculate frequency adjustment */
49011 - ACCESS_ONCE(adapter->base_incval) = incval;
49012 + ACCESS_ONCE_RW(adapter->base_incval) = incval;
49013 smp_mb();
49014
49015 /* need lock to prevent incorrect read while modifying cyclecounter */
49016 diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
49017 index 74d0389..086ac03 100644
49018 --- a/drivers/net/ethernet/marvell/mvneta.c
49019 +++ b/drivers/net/ethernet/marvell/mvneta.c
49020 @@ -1462,7 +1462,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
49021 struct mvneta_rx_queue *rxq)
49022 {
49023 struct net_device *dev = pp->dev;
49024 - int rx_done, rx_filled;
49025 + int rx_done;
49026 u32 rcvd_pkts = 0;
49027 u32 rcvd_bytes = 0;
49028
49029 @@ -1473,7 +1473,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
49030 rx_todo = rx_done;
49031
49032 rx_done = 0;
49033 - rx_filled = 0;
49034
49035 /* Fairness NAPI loop */
49036 while (rx_done < rx_todo) {
49037 @@ -1484,7 +1483,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
49038 int rx_bytes, err;
49039
49040 rx_done++;
49041 - rx_filled++;
49042 rx_status = rx_desc->status;
49043 rx_bytes = rx_desc->data_size - (ETH_FCS_LEN + MVNETA_MH_SIZE);
49044 data = (unsigned char *)rx_desc->buf_cookie;
49045 @@ -1524,6 +1522,14 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
49046 continue;
49047 }
49048
49049 + /* Refill processing */
49050 + err = mvneta_rx_refill(pp, rx_desc);
49051 + if (err) {
49052 + netdev_err(dev, "Linux processing - Can't refill\n");
49053 + rxq->missed++;
49054 + goto err_drop_frame;
49055 + }
49056 +
49057 skb = build_skb(data, pp->frag_size > PAGE_SIZE ? 0 : pp->frag_size);
49058 if (!skb)
49059 goto err_drop_frame;
49060 @@ -1543,14 +1549,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
49061 mvneta_rx_csum(pp, rx_status, skb);
49062
49063 napi_gro_receive(&pp->napi, skb);
49064 -
49065 - /* Refill processing */
49066 - err = mvneta_rx_refill(pp, rx_desc);
49067 - if (err) {
49068 - netdev_err(dev, "Linux processing - Can't refill\n");
49069 - rxq->missed++;
49070 - rx_filled--;
49071 - }
49072 }
49073
49074 if (rcvd_pkts) {
49075 @@ -1563,7 +1561,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
49076 }
49077
49078 /* Update rxq management counters */
49079 - mvneta_rxq_desc_num_update(pp, rxq, rx_done, rx_filled);
49080 + mvneta_rxq_desc_num_update(pp, rxq, rx_done, rx_done);
49081
49082 return rx_done;
49083 }
49084 diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
49085 index c10d98f..72914c6 100644
49086 --- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
49087 +++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
49088 @@ -475,8 +475,8 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev,
49089 wmb();
49090
49091 /* we want to dirty this cache line once */
49092 - ACCESS_ONCE(ring->last_nr_txbb) = last_nr_txbb;
49093 - ACCESS_ONCE(ring->cons) = ring_cons + txbbs_skipped;
49094 + ACCESS_ONCE_RW(ring->last_nr_txbb) = last_nr_txbb;
49095 + ACCESS_ONCE_RW(ring->cons) = ring_cons + txbbs_skipped;
49096
49097 netdev_tx_completed_queue(ring->tx_queue, packets, bytes);
49098
49099 diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
49100 index 6223930..975033d 100644
49101 --- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
49102 +++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
49103 @@ -3457,7 +3457,10 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
49104 struct __vxge_hw_fifo *fifo;
49105 struct vxge_hw_fifo_config *config;
49106 u32 txdl_size, txdl_per_memblock;
49107 - struct vxge_hw_mempool_cbs fifo_mp_callback;
49108 + static struct vxge_hw_mempool_cbs fifo_mp_callback = {
49109 + .item_func_alloc = __vxge_hw_fifo_mempool_item_alloc,
49110 + };
49111 +
49112 struct __vxge_hw_virtualpath *vpath;
49113
49114 if ((vp == NULL) || (attr == NULL)) {
49115 @@ -3540,8 +3543,6 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
49116 goto exit;
49117 }
49118
49119 - fifo_mp_callback.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc;
49120 -
49121 fifo->mempool =
49122 __vxge_hw_mempool_create(vpath->hldev,
49123 fifo->config->memblock_size,
49124 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
49125 index 33669c2..a29c75e 100644
49126 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
49127 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
49128 @@ -2324,7 +2324,9 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
49129 max_tx_rings = QLCNIC_MAX_VNIC_TX_RINGS;
49130 } else if (ret == QLC_83XX_DEFAULT_OPMODE) {
49131 ahw->nic_mode = QLCNIC_DEFAULT_MODE;
49132 - adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
49133 + pax_open_kernel();
49134 + *(void **)&adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
49135 + pax_close_kernel();
49136 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
49137 max_sds_rings = QLCNIC_MAX_SDS_RINGS;
49138 max_tx_rings = QLCNIC_MAX_TX_RINGS;
49139 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
49140 index be7d7a6..a8983f8 100644
49141 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
49142 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
49143 @@ -207,17 +207,23 @@ int qlcnic_83xx_config_vnic_opmode(struct qlcnic_adapter *adapter)
49144 case QLCNIC_NON_PRIV_FUNC:
49145 ahw->op_mode = QLCNIC_NON_PRIV_FUNC;
49146 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
49147 - nic_ops->init_driver = qlcnic_83xx_init_non_privileged_vnic;
49148 + pax_open_kernel();
49149 + *(void **)&nic_ops->init_driver = qlcnic_83xx_init_non_privileged_vnic;
49150 + pax_close_kernel();
49151 break;
49152 case QLCNIC_PRIV_FUNC:
49153 ahw->op_mode = QLCNIC_PRIV_FUNC;
49154 ahw->idc.state_entry = qlcnic_83xx_idc_vnic_pf_entry;
49155 - nic_ops->init_driver = qlcnic_83xx_init_privileged_vnic;
49156 + pax_open_kernel();
49157 + *(void **)&nic_ops->init_driver = qlcnic_83xx_init_privileged_vnic;
49158 + pax_close_kernel();
49159 break;
49160 case QLCNIC_MGMT_FUNC:
49161 ahw->op_mode = QLCNIC_MGMT_FUNC;
49162 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
49163 - nic_ops->init_driver = qlcnic_83xx_init_mgmt_vnic;
49164 + pax_open_kernel();
49165 + *(void **)&nic_ops->init_driver = qlcnic_83xx_init_mgmt_vnic;
49166 + pax_close_kernel();
49167 break;
49168 default:
49169 dev_err(&adapter->pdev->dev, "Invalid Virtual NIC opmode\n");
49170 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
49171 index 332bb8a..e6adcd1 100644
49172 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
49173 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
49174 @@ -1285,7 +1285,7 @@ flash_temp:
49175 int qlcnic_dump_fw(struct qlcnic_adapter *adapter)
49176 {
49177 struct qlcnic_fw_dump *fw_dump = &adapter->ahw->fw_dump;
49178 - static const struct qlcnic_dump_operations *fw_dump_ops;
49179 + const struct qlcnic_dump_operations *fw_dump_ops;
49180 struct qlcnic_83xx_dump_template_hdr *hdr_83xx;
49181 u32 entry_offset, dump, no_entries, buf_offset = 0;
49182 int i, k, ops_cnt, ops_index, dump_size = 0;
49183 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
49184 index 3df51fa..e9b517f 100644
49185 --- a/drivers/net/ethernet/realtek/r8169.c
49186 +++ b/drivers/net/ethernet/realtek/r8169.c
49187 @@ -788,22 +788,22 @@ struct rtl8169_private {
49188 struct mdio_ops {
49189 void (*write)(struct rtl8169_private *, int, int);
49190 int (*read)(struct rtl8169_private *, int);
49191 - } mdio_ops;
49192 + } __no_const mdio_ops;
49193
49194 struct pll_power_ops {
49195 void (*down)(struct rtl8169_private *);
49196 void (*up)(struct rtl8169_private *);
49197 - } pll_power_ops;
49198 + } __no_const pll_power_ops;
49199
49200 struct jumbo_ops {
49201 void (*enable)(struct rtl8169_private *);
49202 void (*disable)(struct rtl8169_private *);
49203 - } jumbo_ops;
49204 + } __no_const jumbo_ops;
49205
49206 struct csi_ops {
49207 void (*write)(struct rtl8169_private *, int, int);
49208 u32 (*read)(struct rtl8169_private *, int);
49209 - } csi_ops;
49210 + } __no_const csi_ops;
49211
49212 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
49213 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
49214 diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
49215 index a2e9aee..af41a0e 100644
49216 --- a/drivers/net/ethernet/sfc/ptp.c
49217 +++ b/drivers/net/ethernet/sfc/ptp.c
49218 @@ -822,7 +822,7 @@ static int efx_ptp_synchronize(struct efx_nic *efx, unsigned int num_readings)
49219 ptp->start.dma_addr);
49220
49221 /* Clear flag that signals MC ready */
49222 - ACCESS_ONCE(*start) = 0;
49223 + ACCESS_ONCE_RW(*start) = 0;
49224 rc = efx_mcdi_rpc_start(efx, MC_CMD_PTP, synch_buf,
49225 MC_CMD_PTP_IN_SYNCHRONIZE_LEN);
49226 EFX_BUG_ON_PARANOID(rc);
49227 diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
49228 index 08c483b..2c4a553 100644
49229 --- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
49230 +++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
49231 @@ -140,8 +140,8 @@ void dwmac_mmc_ctrl(void __iomem *ioaddr, unsigned int mode)
49232
49233 writel(value, ioaddr + MMC_CNTRL);
49234
49235 - pr_debug("stmmac: MMC ctrl register (offset 0x%x): 0x%08x\n",
49236 - MMC_CNTRL, value);
49237 +// pr_debug("stmmac: MMC ctrl register (offset 0x%x): 0x%08x\n",
49238 +// MMC_CNTRL, value);
49239 }
49240
49241 /* To mask all all interrupts.*/
49242 diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
49243 index de28504..7f1c1cd 100644
49244 --- a/drivers/net/ethernet/via/via-rhine.c
49245 +++ b/drivers/net/ethernet/via/via-rhine.c
49246 @@ -2525,7 +2525,7 @@ static struct platform_driver rhine_driver_platform = {
49247 }
49248 };
49249
49250 -static struct dmi_system_id rhine_dmi_table[] __initdata = {
49251 +static const struct dmi_system_id rhine_dmi_table[] __initconst = {
49252 {
49253 .ident = "EPIA-M",
49254 .matches = {
49255 diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
49256 index 41071d3..6e362e1 100644
49257 --- a/drivers/net/hyperv/hyperv_net.h
49258 +++ b/drivers/net/hyperv/hyperv_net.h
49259 @@ -176,7 +176,7 @@ struct rndis_device {
49260 enum rndis_device_state state;
49261 bool link_state;
49262 bool link_change;
49263 - atomic_t new_req_id;
49264 + atomic_unchecked_t new_req_id;
49265
49266 spinlock_t request_lock;
49267 struct list_head req_list;
49268 diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
49269 index 9118cea..1a8e06a 100644
49270 --- a/drivers/net/hyperv/rndis_filter.c
49271 +++ b/drivers/net/hyperv/rndis_filter.c
49272 @@ -100,7 +100,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev,
49273 * template
49274 */
49275 set = &rndis_msg->msg.set_req;
49276 - set->req_id = atomic_inc_return(&dev->new_req_id);
49277 + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
49278
49279 /* Add to the request list */
49280 spin_lock_irqsave(&dev->request_lock, flags);
49281 @@ -923,7 +923,7 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
49282
49283 /* Setup the rndis set */
49284 halt = &request->request_msg.msg.halt_req;
49285 - halt->req_id = atomic_inc_return(&dev->new_req_id);
49286 + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
49287
49288 /* Ignore return since this msg is optional. */
49289 rndis_filter_send_request(dev, request);
49290 diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
49291 index 94570aa..1a798e1 100644
49292 --- a/drivers/net/ifb.c
49293 +++ b/drivers/net/ifb.c
49294 @@ -253,7 +253,7 @@ static int ifb_validate(struct nlattr *tb[], struct nlattr *data[])
49295 return 0;
49296 }
49297
49298 -static struct rtnl_link_ops ifb_link_ops __read_mostly = {
49299 +static struct rtnl_link_ops ifb_link_ops = {
49300 .kind = "ifb",
49301 .priv_size = sizeof(struct ifb_private),
49302 .setup = ifb_setup,
49303 diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h
49304 index 54549a6..0799442 100644
49305 --- a/drivers/net/ipvlan/ipvlan.h
49306 +++ b/drivers/net/ipvlan/ipvlan.h
49307 @@ -102,6 +102,11 @@ static inline struct ipvl_port *ipvlan_port_get_rcu(const struct net_device *d)
49308 return rcu_dereference(d->rx_handler_data);
49309 }
49310
49311 +static inline struct ipvl_port *ipvlan_port_get_rcu_bh(const struct net_device *d)
49312 +{
49313 + return rcu_dereference_bh(d->rx_handler_data);
49314 +}
49315 +
49316 static inline struct ipvl_port *ipvlan_port_get_rtnl(const struct net_device *d)
49317 {
49318 return rtnl_dereference(d->rx_handler_data);
49319 diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
49320 index c30b5c3..b349dad 100644
49321 --- a/drivers/net/ipvlan/ipvlan_core.c
49322 +++ b/drivers/net/ipvlan/ipvlan_core.c
49323 @@ -507,7 +507,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
49324 int ipvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
49325 {
49326 struct ipvl_dev *ipvlan = netdev_priv(dev);
49327 - struct ipvl_port *port = ipvlan_port_get_rcu(ipvlan->phy_dev);
49328 + struct ipvl_port *port = ipvlan_port_get_rcu_bh(ipvlan->phy_dev);
49329
49330 if (!port)
49331 goto out;
49332 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
49333 index 9f59f17..52cb38f 100644
49334 --- a/drivers/net/macvlan.c
49335 +++ b/drivers/net/macvlan.c
49336 @@ -335,7 +335,7 @@ static void macvlan_broadcast_enqueue(struct macvlan_port *port,
49337 free_nskb:
49338 kfree_skb(nskb);
49339 err:
49340 - atomic_long_inc(&skb->dev->rx_dropped);
49341 + atomic_long_inc_unchecked(&skb->dev->rx_dropped);
49342 }
49343
49344 static void macvlan_flush_sources(struct macvlan_port *port,
49345 @@ -1480,13 +1480,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
49346 int macvlan_link_register(struct rtnl_link_ops *ops)
49347 {
49348 /* common fields */
49349 - ops->priv_size = sizeof(struct macvlan_dev);
49350 - ops->validate = macvlan_validate;
49351 - ops->maxtype = IFLA_MACVLAN_MAX;
49352 - ops->policy = macvlan_policy;
49353 - ops->changelink = macvlan_changelink;
49354 - ops->get_size = macvlan_get_size;
49355 - ops->fill_info = macvlan_fill_info;
49356 + pax_open_kernel();
49357 + *(size_t *)&ops->priv_size = sizeof(struct macvlan_dev);
49358 + *(void **)&ops->validate = macvlan_validate;
49359 + *(int *)&ops->maxtype = IFLA_MACVLAN_MAX;
49360 + *(const void **)&ops->policy = macvlan_policy;
49361 + *(void **)&ops->changelink = macvlan_changelink;
49362 + *(void **)&ops->get_size = macvlan_get_size;
49363 + *(void **)&ops->fill_info = macvlan_fill_info;
49364 + pax_close_kernel();
49365
49366 return rtnl_link_register(ops);
49367 };
49368 @@ -1572,7 +1574,7 @@ static int macvlan_device_event(struct notifier_block *unused,
49369 return NOTIFY_DONE;
49370 }
49371
49372 -static struct notifier_block macvlan_notifier_block __read_mostly = {
49373 +static struct notifier_block macvlan_notifier_block = {
49374 .notifier_call = macvlan_device_event,
49375 };
49376
49377 diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
49378 index 8c350c5..30fdc98 100644
49379 --- a/drivers/net/macvtap.c
49380 +++ b/drivers/net/macvtap.c
49381 @@ -436,7 +436,7 @@ static void macvtap_setup(struct net_device *dev)
49382 dev->tx_queue_len = TUN_READQ_SIZE;
49383 }
49384
49385 -static struct rtnl_link_ops macvtap_link_ops __read_mostly = {
49386 +static struct rtnl_link_ops macvtap_link_ops = {
49387 .kind = "macvtap",
49388 .setup = macvtap_setup,
49389 .newlink = macvtap_newlink,
49390 @@ -1033,7 +1033,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
49391
49392 ret = 0;
49393 u = q->flags;
49394 - if (copy_to_user(&ifr->ifr_name, vlan->dev->name, IFNAMSIZ) ||
49395 + if (copy_to_user(ifr->ifr_name, vlan->dev->name, IFNAMSIZ) ||
49396 put_user(u, &ifr->ifr_flags))
49397 ret = -EFAULT;
49398 macvtap_put_vlan(vlan);
49399 @@ -1214,7 +1214,7 @@ static int macvtap_device_event(struct notifier_block *unused,
49400 return NOTIFY_DONE;
49401 }
49402
49403 -static struct notifier_block macvtap_notifier_block __read_mostly = {
49404 +static struct notifier_block macvtap_notifier_block = {
49405 .notifier_call = macvtap_device_event,
49406 };
49407
49408 @@ -1268,6 +1268,7 @@ static void macvtap_exit(void)
49409 class_unregister(macvtap_class);
49410 cdev_del(&macvtap_cdev);
49411 unregister_chrdev_region(macvtap_major, MACVTAP_NUM_DEVS);
49412 + idr_destroy(&minor_idr);
49413 }
49414 module_exit(macvtap_exit);
49415
49416 diff --git a/drivers/net/nlmon.c b/drivers/net/nlmon.c
49417 index 34924df..a747360 100644
49418 --- a/drivers/net/nlmon.c
49419 +++ b/drivers/net/nlmon.c
49420 @@ -154,7 +154,7 @@ static int nlmon_validate(struct nlattr *tb[], struct nlattr *data[])
49421 return 0;
49422 }
49423
49424 -static struct rtnl_link_ops nlmon_link_ops __read_mostly = {
49425 +static struct rtnl_link_ops nlmon_link_ops = {
49426 .kind = "nlmon",
49427 .priv_size = sizeof(struct nlmon),
49428 .setup = nlmon_setup,
49429 diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
49430 index d551df6..fa4c2df 100644
49431 --- a/drivers/net/phy/phy_device.c
49432 +++ b/drivers/net/phy/phy_device.c
49433 @@ -218,7 +218,7 @@ EXPORT_SYMBOL(phy_device_create);
49434 * zero on success.
49435 *
49436 */
49437 -static int get_phy_c45_ids(struct mii_bus *bus, int addr, u32 *phy_id,
49438 +static int get_phy_c45_ids(struct mii_bus *bus, int addr, int *phy_id,
49439 struct phy_c45_device_ids *c45_ids) {
49440 int phy_reg;
49441 int i, reg_addr;
49442 @@ -288,7 +288,7 @@ static int get_phy_c45_ids(struct mii_bus *bus, int addr, u32 *phy_id,
49443 * its return value is in turn returned.
49444 *
49445 */
49446 -static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id,
49447 +static int get_phy_id(struct mii_bus *bus, int addr, int *phy_id,
49448 bool is_c45, struct phy_c45_device_ids *c45_ids)
49449 {
49450 int phy_reg;
49451 @@ -326,7 +326,7 @@ static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id,
49452 struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45)
49453 {
49454 struct phy_c45_device_ids c45_ids = {0};
49455 - u32 phy_id = 0;
49456 + int phy_id = 0;
49457 int r;
49458
49459 r = get_phy_id(bus, addr, &phy_id, is_c45, &c45_ids);
49460 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
49461 index 9d15566..5ad4ef6 100644
49462 --- a/drivers/net/ppp/ppp_generic.c
49463 +++ b/drivers/net/ppp/ppp_generic.c
49464 @@ -1022,7 +1022,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
49465 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
49466 struct ppp_stats stats;
49467 struct ppp_comp_stats cstats;
49468 - char *vers;
49469
49470 switch (cmd) {
49471 case SIOCGPPPSTATS:
49472 @@ -1044,8 +1043,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
49473 break;
49474
49475 case SIOCGPPPVER:
49476 - vers = PPP_VERSION;
49477 - if (copy_to_user(addr, vers, strlen(vers) + 1))
49478 + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
49479 break;
49480 err = 0;
49481 break;
49482 diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
49483 index 079f7ad..b2a2bfa7 100644
49484 --- a/drivers/net/slip/slhc.c
49485 +++ b/drivers/net/slip/slhc.c
49486 @@ -487,7 +487,7 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize)
49487 register struct tcphdr *thp;
49488 register struct iphdr *ip;
49489 register struct cstate *cs;
49490 - int len, hdrlen;
49491 + long len, hdrlen;
49492 unsigned char *cp = icp;
49493
49494 /* We've got a compressed packet; read the change byte */
49495 diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
49496 index 6928448..e30c57f 100644
49497 --- a/drivers/net/team/team.c
49498 +++ b/drivers/net/team/team.c
49499 @@ -2103,7 +2103,7 @@ static unsigned int team_get_num_rx_queues(void)
49500 return TEAM_DEFAULT_NUM_RX_QUEUES;
49501 }
49502
49503 -static struct rtnl_link_ops team_link_ops __read_mostly = {
49504 +static struct rtnl_link_ops team_link_ops = {
49505 .kind = DRV_NAME,
49506 .priv_size = sizeof(struct team),
49507 .setup = team_setup,
49508 @@ -2893,7 +2893,7 @@ static int team_device_event(struct notifier_block *unused,
49509 return NOTIFY_DONE;
49510 }
49511
49512 -static struct notifier_block team_notifier_block __read_mostly = {
49513 +static struct notifier_block team_notifier_block = {
49514 .notifier_call = team_device_event,
49515 };
49516
49517 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
49518 index e470ae5..e812f5e 100644
49519 --- a/drivers/net/tun.c
49520 +++ b/drivers/net/tun.c
49521 @@ -1421,7 +1421,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
49522 return -EINVAL;
49523 }
49524
49525 -static struct rtnl_link_ops tun_link_ops __read_mostly = {
49526 +static struct rtnl_link_ops tun_link_ops = {
49527 .kind = DRV_NAME,
49528 .priv_size = sizeof(struct tun_struct),
49529 .setup = tun_setup,
49530 @@ -1828,7 +1828,7 @@ unlock:
49531 }
49532
49533 static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
49534 - unsigned long arg, int ifreq_len)
49535 + unsigned long arg, size_t ifreq_len)
49536 {
49537 struct tun_file *tfile = file->private_data;
49538 struct tun_struct *tun;
49539 @@ -1842,6 +1842,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
49540 int le;
49541 int ret;
49542
49543 + if (ifreq_len > sizeof ifr)
49544 + return -EFAULT;
49545 +
49546 if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
49547 if (copy_from_user(&ifr, argp, ifreq_len))
49548 return -EFAULT;
49549 diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
49550 index 111d907..1ee643e 100644
49551 --- a/drivers/net/usb/hso.c
49552 +++ b/drivers/net/usb/hso.c
49553 @@ -70,7 +70,7 @@
49554 #include <asm/byteorder.h>
49555 #include <linux/serial_core.h>
49556 #include <linux/serial.h>
49557 -
49558 +#include <asm/local.h>
49559
49560 #define MOD_AUTHOR "Option Wireless"
49561 #define MOD_DESCRIPTION "USB High Speed Option driver"
49562 @@ -1183,7 +1183,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
49563 struct urb *urb;
49564
49565 urb = serial->rx_urb[0];
49566 - if (serial->port.count > 0) {
49567 + if (atomic_read(&serial->port.count) > 0) {
49568 count = put_rxbuf_data(urb, serial);
49569 if (count == -1)
49570 return;
49571 @@ -1221,7 +1221,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
49572 DUMP1(urb->transfer_buffer, urb->actual_length);
49573
49574 /* Anyone listening? */
49575 - if (serial->port.count == 0)
49576 + if (atomic_read(&serial->port.count) == 0)
49577 return;
49578
49579 if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
49580 @@ -1282,8 +1282,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
49581 tty_port_tty_set(&serial->port, tty);
49582
49583 /* check for port already opened, if not set the termios */
49584 - serial->port.count++;
49585 - if (serial->port.count == 1) {
49586 + if (atomic_inc_return(&serial->port.count) == 1) {
49587 serial->rx_state = RX_IDLE;
49588 /* Force default termio settings */
49589 _hso_serial_set_termios(tty, NULL);
49590 @@ -1293,7 +1292,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
49591 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
49592 if (result) {
49593 hso_stop_serial_device(serial->parent);
49594 - serial->port.count--;
49595 + atomic_dec(&serial->port.count);
49596 } else {
49597 kref_get(&serial->parent->ref);
49598 }
49599 @@ -1331,10 +1330,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
49600
49601 /* reset the rts and dtr */
49602 /* do the actual close */
49603 - serial->port.count--;
49604 + atomic_dec(&serial->port.count);
49605
49606 - if (serial->port.count <= 0) {
49607 - serial->port.count = 0;
49608 + if (atomic_read(&serial->port.count) <= 0) {
49609 + atomic_set(&serial->port.count, 0);
49610 tty_port_tty_set(&serial->port, NULL);
49611 if (!usb_gone)
49612 hso_stop_serial_device(serial->parent);
49613 @@ -1417,7 +1416,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
49614
49615 /* the actual setup */
49616 spin_lock_irqsave(&serial->serial_lock, flags);
49617 - if (serial->port.count)
49618 + if (atomic_read(&serial->port.count))
49619 _hso_serial_set_termios(tty, old);
49620 else
49621 tty->termios = *old;
49622 @@ -1891,7 +1890,7 @@ static void intr_callback(struct urb *urb)
49623 D1("Pending read interrupt on port %d\n", i);
49624 spin_lock(&serial->serial_lock);
49625 if (serial->rx_state == RX_IDLE &&
49626 - serial->port.count > 0) {
49627 + atomic_read(&serial->port.count) > 0) {
49628 /* Setup and send a ctrl req read on
49629 * port i */
49630 if (!serial->rx_urb_filled[0]) {
49631 @@ -3058,7 +3057,7 @@ static int hso_resume(struct usb_interface *iface)
49632 /* Start all serial ports */
49633 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
49634 if (serial_table[i] && (serial_table[i]->interface == iface)) {
49635 - if (dev2ser(serial_table[i])->port.count) {
49636 + if (atomic_read(&dev2ser(serial_table[i])->port.count)) {
49637 result =
49638 hso_start_serial_device(serial_table[i], GFP_NOIO);
49639 hso_kick_transmit(dev2ser(serial_table[i]));
49640 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
49641 index aafa1a1..f59c651 100644
49642 --- a/drivers/net/usb/r8152.c
49643 +++ b/drivers/net/usb/r8152.c
49644 @@ -602,7 +602,7 @@ struct r8152 {
49645 void (*unload)(struct r8152 *);
49646 int (*eee_get)(struct r8152 *, struct ethtool_eee *);
49647 int (*eee_set)(struct r8152 *, struct ethtool_eee *);
49648 - } rtl_ops;
49649 + } __no_const rtl_ops;
49650
49651 int intr_interval;
49652 u32 saved_wolopts;
49653 diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
49654 index a2515887..6d13233 100644
49655 --- a/drivers/net/usb/sierra_net.c
49656 +++ b/drivers/net/usb/sierra_net.c
49657 @@ -51,7 +51,7 @@ static const char driver_name[] = "sierra_net";
49658 /* atomic counter partially included in MAC address to make sure 2 devices
49659 * do not end up with the same MAC - concept breaks in case of > 255 ifaces
49660 */
49661 -static atomic_t iface_counter = ATOMIC_INIT(0);
49662 +static atomic_unchecked_t iface_counter = ATOMIC_INIT(0);
49663
49664 /*
49665 * SYNC Timer Delay definition used to set the expiry time
49666 @@ -697,7 +697,7 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
49667 dev->net->netdev_ops = &sierra_net_device_ops;
49668
49669 /* change MAC addr to include, ifacenum, and to be unique */
49670 - dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
49671 + dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return_unchecked(&iface_counter);
49672 dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
49673
49674 /* we will have to manufacture ethernet headers, prepare template */
49675 diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
49676 index 63c7810..4ad33aa 100644
49677 --- a/drivers/net/virtio_net.c
49678 +++ b/drivers/net/virtio_net.c
49679 @@ -48,7 +48,7 @@ module_param(gso, bool, 0444);
49680 #define RECEIVE_AVG_WEIGHT 64
49681
49682 /* Minimum alignment for mergeable packet buffers. */
49683 -#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, 256)
49684 +#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, 256UL)
49685
49686 #define VIRTNET_DRIVER_VERSION "1.0.0"
49687
49688 diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
49689 index 61c0840..92e7f7e 100644
49690 --- a/drivers/net/vmxnet3/vmxnet3_drv.c
49691 +++ b/drivers/net/vmxnet3/vmxnet3_drv.c
49692 @@ -1167,7 +1167,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
49693 static const u32 rxprod_reg[2] = {
49694 VMXNET3_REG_RXPROD, VMXNET3_REG_RXPROD2
49695 };
49696 - u32 num_rxd = 0;
49697 + u32 num_pkts = 0;
49698 bool skip_page_frags = false;
49699 struct Vmxnet3_RxCompDesc *rcd;
49700 struct vmxnet3_rx_ctx *ctx = &rq->rx_ctx;
49701 @@ -1185,13 +1185,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
49702 struct Vmxnet3_RxDesc *rxd;
49703 u32 idx, ring_idx;
49704 struct vmxnet3_cmd_ring *ring = NULL;
49705 - if (num_rxd >= quota) {
49706 + if (num_pkts >= quota) {
49707 /* we may stop even before we see the EOP desc of
49708 * the current pkt
49709 */
49710 break;
49711 }
49712 - num_rxd++;
49713 BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2);
49714 idx = rcd->rxdIdx;
49715 ring_idx = rcd->rqID < adapter->num_rx_queues ? 0 : 1;
49716 @@ -1323,6 +1322,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
49717 napi_gro_receive(&rq->napi, skb);
49718
49719 ctx->skb = NULL;
49720 + num_pkts++;
49721 }
49722
49723 rcd_done:
49724 @@ -1353,7 +1353,7 @@ rcd_done:
49725 &rq->comp_ring.base[rq->comp_ring.next2proc].rcd, &rxComp);
49726 }
49727
49728 - return num_rxd;
49729 + return num_pkts;
49730 }
49731
49732
49733 diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
49734 index 21a0fbf..055b54f 100644
49735 --- a/drivers/net/vxlan.c
49736 +++ b/drivers/net/vxlan.c
49737 @@ -2878,7 +2878,7 @@ static struct net *vxlan_get_link_net(const struct net_device *dev)
49738 return vxlan->net;
49739 }
49740
49741 -static struct rtnl_link_ops vxlan_link_ops __read_mostly = {
49742 +static struct rtnl_link_ops vxlan_link_ops = {
49743 .kind = "vxlan",
49744 .maxtype = IFLA_VXLAN_MAX,
49745 .policy = vxlan_policy,
49746 @@ -2926,7 +2926,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused,
49747 return NOTIFY_DONE;
49748 }
49749
49750 -static struct notifier_block vxlan_notifier_block __read_mostly = {
49751 +static struct notifier_block vxlan_notifier_block = {
49752 .notifier_call = vxlan_lowerdev_event,
49753 };
49754
49755 diff --git a/drivers/net/wan/lmc/lmc_media.c b/drivers/net/wan/lmc/lmc_media.c
49756 index 5920c99..ff2e4a5 100644
49757 --- a/drivers/net/wan/lmc/lmc_media.c
49758 +++ b/drivers/net/wan/lmc/lmc_media.c
49759 @@ -95,62 +95,63 @@ static inline void write_av9110_bit (lmc_softc_t *, int);
49760 static void write_av9110(lmc_softc_t *, u32, u32, u32, u32, u32);
49761
49762 lmc_media_t lmc_ds3_media = {
49763 - lmc_ds3_init, /* special media init stuff */
49764 - lmc_ds3_default, /* reset to default state */
49765 - lmc_ds3_set_status, /* reset status to state provided */
49766 - lmc_dummy_set_1, /* set clock source */
49767 - lmc_dummy_set2_1, /* set line speed */
49768 - lmc_ds3_set_100ft, /* set cable length */
49769 - lmc_ds3_set_scram, /* set scrambler */
49770 - lmc_ds3_get_link_status, /* get link status */
49771 - lmc_dummy_set_1, /* set link status */
49772 - lmc_ds3_set_crc_length, /* set CRC length */
49773 - lmc_dummy_set_1, /* set T1 or E1 circuit type */
49774 - lmc_ds3_watchdog
49775 + .init = lmc_ds3_init, /* special media init stuff */
49776 + .defaults = lmc_ds3_default, /* reset to default state */
49777 + .set_status = lmc_ds3_set_status, /* reset status to state provided */
49778 + .set_clock_source = lmc_dummy_set_1, /* set clock source */
49779 + .set_speed = lmc_dummy_set2_1, /* set line speed */
49780 + .set_cable_length = lmc_ds3_set_100ft, /* set cable length */
49781 + .set_scrambler = lmc_ds3_set_scram, /* set scrambler */
49782 + .get_link_status = lmc_ds3_get_link_status, /* get link status */
49783 + .set_link_status = lmc_dummy_set_1, /* set link status */
49784 + .set_crc_length = lmc_ds3_set_crc_length, /* set CRC length */
49785 + .set_circuit_type = lmc_dummy_set_1, /* set T1 or E1 circuit type */
49786 + .watchdog = lmc_ds3_watchdog
49787 };
49788
49789 lmc_media_t lmc_hssi_media = {
49790 - lmc_hssi_init, /* special media init stuff */
49791 - lmc_hssi_default, /* reset to default state */
49792 - lmc_hssi_set_status, /* reset status to state provided */
49793 - lmc_hssi_set_clock, /* set clock source */
49794 - lmc_dummy_set2_1, /* set line speed */
49795 - lmc_dummy_set_1, /* set cable length */
49796 - lmc_dummy_set_1, /* set scrambler */
49797 - lmc_hssi_get_link_status, /* get link status */
49798 - lmc_hssi_set_link_status, /* set link status */
49799 - lmc_hssi_set_crc_length, /* set CRC length */
49800 - lmc_dummy_set_1, /* set T1 or E1 circuit type */
49801 - lmc_hssi_watchdog
49802 + .init = lmc_hssi_init, /* special media init stuff */
49803 + .defaults = lmc_hssi_default, /* reset to default state */
49804 + .set_status = lmc_hssi_set_status, /* reset status to state provided */
49805 + .set_clock_source = lmc_hssi_set_clock, /* set clock source */
49806 + .set_speed = lmc_dummy_set2_1, /* set line speed */
49807 + .set_cable_length = lmc_dummy_set_1, /* set cable length */
49808 + .set_scrambler = lmc_dummy_set_1, /* set scrambler */
49809 + .get_link_status = lmc_hssi_get_link_status, /* get link status */
49810 + .set_link_status = lmc_hssi_set_link_status, /* set link status */
49811 + .set_crc_length = lmc_hssi_set_crc_length, /* set CRC length */
49812 + .set_circuit_type = lmc_dummy_set_1, /* set T1 or E1 circuit type */
49813 + .watchdog = lmc_hssi_watchdog
49814 };
49815
49816 -lmc_media_t lmc_ssi_media = { lmc_ssi_init, /* special media init stuff */
49817 - lmc_ssi_default, /* reset to default state */
49818 - lmc_ssi_set_status, /* reset status to state provided */
49819 - lmc_ssi_set_clock, /* set clock source */
49820 - lmc_ssi_set_speed, /* set line speed */
49821 - lmc_dummy_set_1, /* set cable length */
49822 - lmc_dummy_set_1, /* set scrambler */
49823 - lmc_ssi_get_link_status, /* get link status */
49824 - lmc_ssi_set_link_status, /* set link status */
49825 - lmc_ssi_set_crc_length, /* set CRC length */
49826 - lmc_dummy_set_1, /* set T1 or E1 circuit type */
49827 - lmc_ssi_watchdog
49828 +lmc_media_t lmc_ssi_media = {
49829 + .init = lmc_ssi_init, /* special media init stuff */
49830 + .defaults = lmc_ssi_default, /* reset to default state */
49831 + .set_status = lmc_ssi_set_status, /* reset status to state provided */
49832 + .set_clock_source = lmc_ssi_set_clock, /* set clock source */
49833 + .set_speed = lmc_ssi_set_speed, /* set line speed */
49834 + .set_cable_length = lmc_dummy_set_1, /* set cable length */
49835 + .set_scrambler = lmc_dummy_set_1, /* set scrambler */
49836 + .get_link_status = lmc_ssi_get_link_status, /* get link status */
49837 + .set_link_status = lmc_ssi_set_link_status, /* set link status */
49838 + .set_crc_length = lmc_ssi_set_crc_length, /* set CRC length */
49839 + .set_circuit_type = lmc_dummy_set_1, /* set T1 or E1 circuit type */
49840 + .watchdog = lmc_ssi_watchdog
49841 };
49842
49843 lmc_media_t lmc_t1_media = {
49844 - lmc_t1_init, /* special media init stuff */
49845 - lmc_t1_default, /* reset to default state */
49846 - lmc_t1_set_status, /* reset status to state provided */
49847 - lmc_t1_set_clock, /* set clock source */
49848 - lmc_dummy_set2_1, /* set line speed */
49849 - lmc_dummy_set_1, /* set cable length */
49850 - lmc_dummy_set_1, /* set scrambler */
49851 - lmc_t1_get_link_status, /* get link status */
49852 - lmc_dummy_set_1, /* set link status */
49853 - lmc_t1_set_crc_length, /* set CRC length */
49854 - lmc_t1_set_circuit_type, /* set T1 or E1 circuit type */
49855 - lmc_t1_watchdog
49856 + .init = lmc_t1_init, /* special media init stuff */
49857 + .defaults = lmc_t1_default, /* reset to default state */
49858 + .set_status = lmc_t1_set_status, /* reset status to state provided */
49859 + .set_clock_source = lmc_t1_set_clock, /* set clock source */
49860 + .set_speed = lmc_dummy_set2_1, /* set line speed */
49861 + .set_cable_length = lmc_dummy_set_1, /* set cable length */
49862 + .set_scrambler = lmc_dummy_set_1, /* set scrambler */
49863 + .get_link_status = lmc_t1_get_link_status, /* get link status */
49864 + .set_link_status = lmc_dummy_set_1, /* set link status */
49865 + .set_crc_length = lmc_t1_set_crc_length, /* set CRC length */
49866 + .set_circuit_type = lmc_t1_set_circuit_type, /* set T1 or E1 circuit type */
49867 + .watchdog = lmc_t1_watchdog
49868 };
49869
49870 static void
49871 diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
49872 index feacc3b..5bac0de 100644
49873 --- a/drivers/net/wan/z85230.c
49874 +++ b/drivers/net/wan/z85230.c
49875 @@ -485,9 +485,9 @@ static void z8530_status(struct z8530_channel *chan)
49876
49877 struct z8530_irqhandler z8530_sync =
49878 {
49879 - z8530_rx,
49880 - z8530_tx,
49881 - z8530_status
49882 + .rx = z8530_rx,
49883 + .tx = z8530_tx,
49884 + .status = z8530_status
49885 };
49886
49887 EXPORT_SYMBOL(z8530_sync);
49888 @@ -605,15 +605,15 @@ static void z8530_dma_status(struct z8530_channel *chan)
49889 }
49890
49891 static struct z8530_irqhandler z8530_dma_sync = {
49892 - z8530_dma_rx,
49893 - z8530_dma_tx,
49894 - z8530_dma_status
49895 + .rx = z8530_dma_rx,
49896 + .tx = z8530_dma_tx,
49897 + .status = z8530_dma_status
49898 };
49899
49900 static struct z8530_irqhandler z8530_txdma_sync = {
49901 - z8530_rx,
49902 - z8530_dma_tx,
49903 - z8530_dma_status
49904 + .rx = z8530_rx,
49905 + .tx = z8530_dma_tx,
49906 + .status = z8530_dma_status
49907 };
49908
49909 /**
49910 @@ -680,9 +680,9 @@ static void z8530_status_clear(struct z8530_channel *chan)
49911
49912 struct z8530_irqhandler z8530_nop=
49913 {
49914 - z8530_rx_clear,
49915 - z8530_tx_clear,
49916 - z8530_status_clear
49917 + .rx = z8530_rx_clear,
49918 + .tx = z8530_tx_clear,
49919 + .status = z8530_status_clear
49920 };
49921
49922
49923 diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
49924 index 0b60295..b8bfa5b 100644
49925 --- a/drivers/net/wimax/i2400m/rx.c
49926 +++ b/drivers/net/wimax/i2400m/rx.c
49927 @@ -1359,7 +1359,7 @@ int i2400m_rx_setup(struct i2400m *i2400m)
49928 if (i2400m->rx_roq == NULL)
49929 goto error_roq_alloc;
49930
49931 - rd = kcalloc(I2400M_RO_CIN + 1, sizeof(*i2400m->rx_roq[0].log),
49932 + rd = kcalloc(sizeof(*i2400m->rx_roq[0].log), I2400M_RO_CIN + 1,
49933 GFP_KERNEL);
49934 if (rd == NULL) {
49935 result = -ENOMEM;
49936 diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
49937 index d0c97c2..108f59b 100644
49938 --- a/drivers/net/wireless/airo.c
49939 +++ b/drivers/net/wireless/airo.c
49940 @@ -7846,7 +7846,7 @@ static int writerids(struct net_device *dev, aironet_ioctl *comp) {
49941 struct airo_info *ai = dev->ml_priv;
49942 int ridcode;
49943 int enabled;
49944 - static int (* writer)(struct airo_info *, u16 rid, const void *, int, int);
49945 + int (* writer)(struct airo_info *, u16 rid, const void *, int, int);
49946 unsigned char *iobuf;
49947
49948 /* Only super-user can write RIDs */
49949 diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
49950 index 49219c5..3625441 100644
49951 --- a/drivers/net/wireless/at76c50x-usb.c
49952 +++ b/drivers/net/wireless/at76c50x-usb.c
49953 @@ -353,7 +353,7 @@ static int at76_dfu_get_state(struct usb_device *udev, u8 *state)
49954 }
49955
49956 /* Convert timeout from the DFU status to jiffies */
49957 -static inline unsigned long at76_get_timeout(struct dfu_status *s)
49958 +static inline unsigned long __intentional_overflow(-1) at76_get_timeout(struct dfu_status *s)
49959 {
49960 return msecs_to_jiffies((s->poll_timeout[2] << 16)
49961 | (s->poll_timeout[1] << 8)
49962 diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
49963 index 2fd9e18..3f55bdd 100644
49964 --- a/drivers/net/wireless/ath/ath10k/htc.c
49965 +++ b/drivers/net/wireless/ath/ath10k/htc.c
49966 @@ -849,7 +849,10 @@ int ath10k_htc_start(struct ath10k_htc *htc)
49967 /* registered target arrival callback from the HIF layer */
49968 int ath10k_htc_init(struct ath10k *ar)
49969 {
49970 - struct ath10k_hif_cb htc_callbacks;
49971 + static struct ath10k_hif_cb htc_callbacks = {
49972 + .rx_completion = ath10k_htc_rx_completion_handler,
49973 + .tx_completion = ath10k_htc_tx_completion_handler,
49974 + };
49975 struct ath10k_htc_ep *ep = NULL;
49976 struct ath10k_htc *htc = &ar->htc;
49977
49978 @@ -858,8 +861,6 @@ int ath10k_htc_init(struct ath10k *ar)
49979 ath10k_htc_reset_endpoint_states(htc);
49980
49981 /* setup HIF layer callbacks */
49982 - htc_callbacks.rx_completion = ath10k_htc_rx_completion_handler;
49983 - htc_callbacks.tx_completion = ath10k_htc_tx_completion_handler;
49984 htc->ar = ar;
49985
49986 /* Get HIF default pipe for HTC message exchange */
49987 diff --git a/drivers/net/wireless/ath/ath10k/htc.h b/drivers/net/wireless/ath/ath10k/htc.h
49988 index 527179c..a890150 100644
49989 --- a/drivers/net/wireless/ath/ath10k/htc.h
49990 +++ b/drivers/net/wireless/ath/ath10k/htc.h
49991 @@ -270,13 +270,13 @@ enum ath10k_htc_ep_id {
49992
49993 struct ath10k_htc_ops {
49994 void (*target_send_suspend_complete)(struct ath10k *ar);
49995 -};
49996 +} __no_const;
49997
49998 struct ath10k_htc_ep_ops {
49999 void (*ep_tx_complete)(struct ath10k *, struct sk_buff *);
50000 void (*ep_rx_complete)(struct ath10k *, struct sk_buff *);
50001 void (*ep_tx_credits)(struct ath10k *);
50002 -};
50003 +} __no_const;
50004
50005 /* service connection information */
50006 struct ath10k_htc_svc_conn_req {
50007 diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
50008 index f816909..e56cd8b 100644
50009 --- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
50010 +++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
50011 @@ -220,8 +220,8 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
50012 ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
50013 ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
50014
50015 - ACCESS_ONCE(ads->ds_link) = i->link;
50016 - ACCESS_ONCE(ads->ds_data) = i->buf_addr[0];
50017 + ACCESS_ONCE_RW(ads->ds_link) = i->link;
50018 + ACCESS_ONCE_RW(ads->ds_data) = i->buf_addr[0];
50019
50020 ctl1 = i->buf_len[0] | (i->is_last ? 0 : AR_TxMore);
50021 ctl6 = SM(i->keytype, AR_EncrType);
50022 @@ -235,26 +235,26 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
50023
50024 if ((i->is_first || i->is_last) &&
50025 i->aggr != AGGR_BUF_MIDDLE && i->aggr != AGGR_BUF_LAST) {
50026 - ACCESS_ONCE(ads->ds_ctl2) = set11nTries(i->rates, 0)
50027 + ACCESS_ONCE_RW(ads->ds_ctl2) = set11nTries(i->rates, 0)
50028 | set11nTries(i->rates, 1)
50029 | set11nTries(i->rates, 2)
50030 | set11nTries(i->rates, 3)
50031 | (i->dur_update ? AR_DurUpdateEna : 0)
50032 | SM(0, AR_BurstDur);
50033
50034 - ACCESS_ONCE(ads->ds_ctl3) = set11nRate(i->rates, 0)
50035 + ACCESS_ONCE_RW(ads->ds_ctl3) = set11nRate(i->rates, 0)
50036 | set11nRate(i->rates, 1)
50037 | set11nRate(i->rates, 2)
50038 | set11nRate(i->rates, 3);
50039 } else {
50040 - ACCESS_ONCE(ads->ds_ctl2) = 0;
50041 - ACCESS_ONCE(ads->ds_ctl3) = 0;
50042 + ACCESS_ONCE_RW(ads->ds_ctl2) = 0;
50043 + ACCESS_ONCE_RW(ads->ds_ctl3) = 0;
50044 }
50045
50046 if (!i->is_first) {
50047 - ACCESS_ONCE(ads->ds_ctl0) = 0;
50048 - ACCESS_ONCE(ads->ds_ctl1) = ctl1;
50049 - ACCESS_ONCE(ads->ds_ctl6) = ctl6;
50050 + ACCESS_ONCE_RW(ads->ds_ctl0) = 0;
50051 + ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1;
50052 + ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6;
50053 return;
50054 }
50055
50056 @@ -279,7 +279,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
50057 break;
50058 }
50059
50060 - ACCESS_ONCE(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
50061 + ACCESS_ONCE_RW(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
50062 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
50063 | SM(i->txpower[0], AR_XmitPower0)
50064 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
50065 @@ -289,27 +289,27 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
50066 | (i->flags & ATH9K_TXDESC_RTSENA ? AR_RTSEnable :
50067 (i->flags & ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0));
50068
50069 - ACCESS_ONCE(ads->ds_ctl1) = ctl1;
50070 - ACCESS_ONCE(ads->ds_ctl6) = ctl6;
50071 + ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1;
50072 + ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6;
50073
50074 if (i->aggr == AGGR_BUF_MIDDLE || i->aggr == AGGR_BUF_LAST)
50075 return;
50076
50077 - ACCESS_ONCE(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0)
50078 + ACCESS_ONCE_RW(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0)
50079 | set11nPktDurRTSCTS(i->rates, 1);
50080
50081 - ACCESS_ONCE(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2)
50082 + ACCESS_ONCE_RW(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2)
50083 | set11nPktDurRTSCTS(i->rates, 3);
50084
50085 - ACCESS_ONCE(ads->ds_ctl7) = set11nRateFlags(i->rates, 0)
50086 + ACCESS_ONCE_RW(ads->ds_ctl7) = set11nRateFlags(i->rates, 0)
50087 | set11nRateFlags(i->rates, 1)
50088 | set11nRateFlags(i->rates, 2)
50089 | set11nRateFlags(i->rates, 3)
50090 | SM(i->rtscts_rate, AR_RTSCTSRate);
50091
50092 - ACCESS_ONCE(ads->ds_ctl9) = SM(i->txpower[1], AR_XmitPower1);
50093 - ACCESS_ONCE(ads->ds_ctl10) = SM(i->txpower[2], AR_XmitPower2);
50094 - ACCESS_ONCE(ads->ds_ctl11) = SM(i->txpower[3], AR_XmitPower3);
50095 + ACCESS_ONCE_RW(ads->ds_ctl9) = SM(i->txpower[1], AR_XmitPower1);
50096 + ACCESS_ONCE_RW(ads->ds_ctl10) = SM(i->txpower[2], AR_XmitPower2);
50097 + ACCESS_ONCE_RW(ads->ds_ctl11) = SM(i->txpower[3], AR_XmitPower3);
50098 }
50099
50100 static int ar9002_hw_proc_txdesc(struct ath_hw *ah, void *ds,
50101 diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
50102 index da84b70..83e4978 100644
50103 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
50104 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
50105 @@ -39,47 +39,47 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
50106 (i->qcu << AR_TxQcuNum_S) | desc_len;
50107
50108 checksum += val;
50109 - ACCESS_ONCE(ads->info) = val;
50110 + ACCESS_ONCE_RW(ads->info) = val;
50111
50112 checksum += i->link;
50113 - ACCESS_ONCE(ads->link) = i->link;
50114 + ACCESS_ONCE_RW(ads->link) = i->link;
50115
50116 checksum += i->buf_addr[0];
50117 - ACCESS_ONCE(ads->data0) = i->buf_addr[0];
50118 + ACCESS_ONCE_RW(ads->data0) = i->buf_addr[0];
50119 checksum += i->buf_addr[1];
50120 - ACCESS_ONCE(ads->data1) = i->buf_addr[1];
50121 + ACCESS_ONCE_RW(ads->data1) = i->buf_addr[1];
50122 checksum += i->buf_addr[2];
50123 - ACCESS_ONCE(ads->data2) = i->buf_addr[2];
50124 + ACCESS_ONCE_RW(ads->data2) = i->buf_addr[2];
50125 checksum += i->buf_addr[3];
50126 - ACCESS_ONCE(ads->data3) = i->buf_addr[3];
50127 + ACCESS_ONCE_RW(ads->data3) = i->buf_addr[3];
50128
50129 checksum += (val = (i->buf_len[0] << AR_BufLen_S) & AR_BufLen);
50130 - ACCESS_ONCE(ads->ctl3) = val;
50131 + ACCESS_ONCE_RW(ads->ctl3) = val;
50132 checksum += (val = (i->buf_len[1] << AR_BufLen_S) & AR_BufLen);
50133 - ACCESS_ONCE(ads->ctl5) = val;
50134 + ACCESS_ONCE_RW(ads->ctl5) = val;
50135 checksum += (val = (i->buf_len[2] << AR_BufLen_S) & AR_BufLen);
50136 - ACCESS_ONCE(ads->ctl7) = val;
50137 + ACCESS_ONCE_RW(ads->ctl7) = val;
50138 checksum += (val = (i->buf_len[3] << AR_BufLen_S) & AR_BufLen);
50139 - ACCESS_ONCE(ads->ctl9) = val;
50140 + ACCESS_ONCE_RW(ads->ctl9) = val;
50141
50142 checksum = (u16) (((checksum & 0xffff) + (checksum >> 16)) & 0xffff);
50143 - ACCESS_ONCE(ads->ctl10) = checksum;
50144 + ACCESS_ONCE_RW(ads->ctl10) = checksum;
50145
50146 if (i->is_first || i->is_last) {
50147 - ACCESS_ONCE(ads->ctl13) = set11nTries(i->rates, 0)
50148 + ACCESS_ONCE_RW(ads->ctl13) = set11nTries(i->rates, 0)
50149 | set11nTries(i->rates, 1)
50150 | set11nTries(i->rates, 2)
50151 | set11nTries(i->rates, 3)
50152 | (i->dur_update ? AR_DurUpdateEna : 0)
50153 | SM(0, AR_BurstDur);
50154
50155 - ACCESS_ONCE(ads->ctl14) = set11nRate(i->rates, 0)
50156 + ACCESS_ONCE_RW(ads->ctl14) = set11nRate(i->rates, 0)
50157 | set11nRate(i->rates, 1)
50158 | set11nRate(i->rates, 2)
50159 | set11nRate(i->rates, 3);
50160 } else {
50161 - ACCESS_ONCE(ads->ctl13) = 0;
50162 - ACCESS_ONCE(ads->ctl14) = 0;
50163 + ACCESS_ONCE_RW(ads->ctl13) = 0;
50164 + ACCESS_ONCE_RW(ads->ctl14) = 0;
50165 }
50166
50167 ads->ctl20 = 0;
50168 @@ -89,17 +89,17 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
50169
50170 ctl17 = SM(i->keytype, AR_EncrType);
50171 if (!i->is_first) {
50172 - ACCESS_ONCE(ads->ctl11) = 0;
50173 - ACCESS_ONCE(ads->ctl12) = i->is_last ? 0 : AR_TxMore;
50174 - ACCESS_ONCE(ads->ctl15) = 0;
50175 - ACCESS_ONCE(ads->ctl16) = 0;
50176 - ACCESS_ONCE(ads->ctl17) = ctl17;
50177 - ACCESS_ONCE(ads->ctl18) = 0;
50178 - ACCESS_ONCE(ads->ctl19) = 0;
50179 + ACCESS_ONCE_RW(ads->ctl11) = 0;
50180 + ACCESS_ONCE_RW(ads->ctl12) = i->is_last ? 0 : AR_TxMore;
50181 + ACCESS_ONCE_RW(ads->ctl15) = 0;
50182 + ACCESS_ONCE_RW(ads->ctl16) = 0;
50183 + ACCESS_ONCE_RW(ads->ctl17) = ctl17;
50184 + ACCESS_ONCE_RW(ads->ctl18) = 0;
50185 + ACCESS_ONCE_RW(ads->ctl19) = 0;
50186 return;
50187 }
50188
50189 - ACCESS_ONCE(ads->ctl11) = (i->pkt_len & AR_FrameLen)
50190 + ACCESS_ONCE_RW(ads->ctl11) = (i->pkt_len & AR_FrameLen)
50191 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
50192 | SM(i->txpower[0], AR_XmitPower0)
50193 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
50194 @@ -135,26 +135,26 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
50195 val = (i->flags & ATH9K_TXDESC_PAPRD) >> ATH9K_TXDESC_PAPRD_S;
50196 ctl12 |= SM(val, AR_PAPRDChainMask);
50197
50198 - ACCESS_ONCE(ads->ctl12) = ctl12;
50199 - ACCESS_ONCE(ads->ctl17) = ctl17;
50200 + ACCESS_ONCE_RW(ads->ctl12) = ctl12;
50201 + ACCESS_ONCE_RW(ads->ctl17) = ctl17;
50202
50203 - ACCESS_ONCE(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0)
50204 + ACCESS_ONCE_RW(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0)
50205 | set11nPktDurRTSCTS(i->rates, 1);
50206
50207 - ACCESS_ONCE(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2)
50208 + ACCESS_ONCE_RW(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2)
50209 | set11nPktDurRTSCTS(i->rates, 3);
50210
50211 - ACCESS_ONCE(ads->ctl18) = set11nRateFlags(i->rates, 0)
50212 + ACCESS_ONCE_RW(ads->ctl18) = set11nRateFlags(i->rates, 0)
50213 | set11nRateFlags(i->rates, 1)
50214 | set11nRateFlags(i->rates, 2)
50215 | set11nRateFlags(i->rates, 3)
50216 | SM(i->rtscts_rate, AR_RTSCTSRate);
50217
50218 - ACCESS_ONCE(ads->ctl19) = AR_Not_Sounding;
50219 + ACCESS_ONCE_RW(ads->ctl19) = AR_Not_Sounding;
50220
50221 - ACCESS_ONCE(ads->ctl20) = SM(i->txpower[1], AR_XmitPower1);
50222 - ACCESS_ONCE(ads->ctl21) = SM(i->txpower[2], AR_XmitPower2);
50223 - ACCESS_ONCE(ads->ctl22) = SM(i->txpower[3], AR_XmitPower3);
50224 + ACCESS_ONCE_RW(ads->ctl20) = SM(i->txpower[1], AR_XmitPower1);
50225 + ACCESS_ONCE_RW(ads->ctl21) = SM(i->txpower[2], AR_XmitPower2);
50226 + ACCESS_ONCE_RW(ads->ctl22) = SM(i->txpower[3], AR_XmitPower3);
50227 }
50228
50229 static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
50230 diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
50231 index c1d2d03..08352db 100644
50232 --- a/drivers/net/wireless/ath/ath9k/hw.h
50233 +++ b/drivers/net/wireless/ath/ath9k/hw.h
50234 @@ -671,7 +671,7 @@ struct ath_hw_private_ops {
50235 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
50236 bool (*is_aic_enabled)(struct ath_hw *ah);
50237 #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
50238 -};
50239 +} __no_const;
50240
50241 /**
50242 * struct ath_spec_scan - parameters for Atheros spectral scan
50243 @@ -747,7 +747,7 @@ struct ath_hw_ops {
50244 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
50245 void (*set_bt_ant_diversity)(struct ath_hw *hw, bool enable);
50246 #endif
50247 -};
50248 +} __no_const;
50249
50250 struct ath_nf_limits {
50251 s16 max;
50252 diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
50253 index b0badef..3e3464c 100644
50254 --- a/drivers/net/wireless/ath/ath9k/main.c
50255 +++ b/drivers/net/wireless/ath/ath9k/main.c
50256 @@ -2573,16 +2573,18 @@ void ath9k_fill_chanctx_ops(void)
50257 if (!ath9k_is_chanctx_enabled())
50258 return;
50259
50260 - ath9k_ops.hw_scan = ath9k_hw_scan;
50261 - ath9k_ops.cancel_hw_scan = ath9k_cancel_hw_scan;
50262 - ath9k_ops.remain_on_channel = ath9k_remain_on_channel;
50263 - ath9k_ops.cancel_remain_on_channel = ath9k_cancel_remain_on_channel;
50264 - ath9k_ops.add_chanctx = ath9k_add_chanctx;
50265 - ath9k_ops.remove_chanctx = ath9k_remove_chanctx;
50266 - ath9k_ops.change_chanctx = ath9k_change_chanctx;
50267 - ath9k_ops.assign_vif_chanctx = ath9k_assign_vif_chanctx;
50268 - ath9k_ops.unassign_vif_chanctx = ath9k_unassign_vif_chanctx;
50269 - ath9k_ops.mgd_prepare_tx = ath9k_mgd_prepare_tx;
50270 + pax_open_kernel();
50271 + *(void **)&ath9k_ops.hw_scan = ath9k_hw_scan;
50272 + *(void **)&ath9k_ops.cancel_hw_scan = ath9k_cancel_hw_scan;
50273 + *(void **)&ath9k_ops.remain_on_channel = ath9k_remain_on_channel;
50274 + *(void **)&ath9k_ops.cancel_remain_on_channel = ath9k_cancel_remain_on_channel;
50275 + *(void **)&ath9k_ops.add_chanctx = ath9k_add_chanctx;
50276 + *(void **)&ath9k_ops.remove_chanctx = ath9k_remove_chanctx;
50277 + *(void **)&ath9k_ops.change_chanctx = ath9k_change_chanctx;
50278 + *(void **)&ath9k_ops.assign_vif_chanctx = ath9k_assign_vif_chanctx;
50279 + *(void **)&ath9k_ops.unassign_vif_chanctx = ath9k_unassign_vif_chanctx;
50280 + *(void **)&ath9k_ops.mgd_prepare_tx = ath9k_mgd_prepare_tx;
50281 + pax_close_kernel();
50282 }
50283
50284 #endif
50285 diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c
50286 index 058a9f2..d5cb1ba 100644
50287 --- a/drivers/net/wireless/b43/phy_lp.c
50288 +++ b/drivers/net/wireless/b43/phy_lp.c
50289 @@ -2502,7 +2502,7 @@ static int lpphy_b2063_tune(struct b43_wldev *dev,
50290 {
50291 struct ssb_bus *bus = dev->dev->sdev->bus;
50292
50293 - static const struct b206x_channel *chandata = NULL;
50294 + const struct b206x_channel *chandata = NULL;
50295 u32 crystal_freq = bus->chipco.pmu.crystalfreq * 1000;
50296 u32 freqref, vco_freq, val1, val2, val3, timeout, timeoutref, count;
50297 u16 old_comm15, scale;
50298 diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
50299 index e566580..2c218ca 100644
50300 --- a/drivers/net/wireless/iwlegacy/3945-mac.c
50301 +++ b/drivers/net/wireless/iwlegacy/3945-mac.c
50302 @@ -3631,7 +3631,9 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
50303 */
50304 if (il3945_mod_params.disable_hw_scan) {
50305 D_INFO("Disabling hw_scan\n");
50306 - il3945_mac_ops.hw_scan = NULL;
50307 + pax_open_kernel();
50308 + *(void **)&il3945_mac_ops.hw_scan = NULL;
50309 + pax_close_kernel();
50310 }
50311
50312 D_INFO("*** LOAD DRIVER ***\n");
50313 diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
50314 index 0ffb6ff..c0b7f0e 100644
50315 --- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
50316 +++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
50317 @@ -188,7 +188,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
50318 {
50319 struct iwl_priv *priv = file->private_data;
50320 char buf[64];
50321 - int buf_size;
50322 + size_t buf_size;
50323 u32 offset, len;
50324
50325 memset(buf, 0, sizeof(buf));
50326 @@ -458,7 +458,7 @@ static ssize_t iwl_dbgfs_rx_handlers_write(struct file *file,
50327 struct iwl_priv *priv = file->private_data;
50328
50329 char buf[8];
50330 - int buf_size;
50331 + size_t buf_size;
50332 u32 reset_flag;
50333
50334 memset(buf, 0, sizeof(buf));
50335 @@ -539,7 +539,7 @@ static ssize_t iwl_dbgfs_disable_ht40_write(struct file *file,
50336 {
50337 struct iwl_priv *priv = file->private_data;
50338 char buf[8];
50339 - int buf_size;
50340 + size_t buf_size;
50341 int ht40;
50342
50343 memset(buf, 0, sizeof(buf));
50344 @@ -591,7 +591,7 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
50345 {
50346 struct iwl_priv *priv = file->private_data;
50347 char buf[8];
50348 - int buf_size;
50349 + size_t buf_size;
50350 int value;
50351
50352 memset(buf, 0, sizeof(buf));
50353 @@ -683,10 +683,10 @@ DEBUGFS_READ_FILE_OPS(temperature);
50354 DEBUGFS_READ_WRITE_FILE_OPS(sleep_level_override);
50355 DEBUGFS_READ_FILE_OPS(current_sleep_command);
50356
50357 -static const char *fmt_value = " %-30s %10u\n";
50358 -static const char *fmt_hex = " %-30s 0x%02X\n";
50359 -static const char *fmt_table = " %-30s %10u %10u %10u %10u\n";
50360 -static const char *fmt_header =
50361 +static const char fmt_value[] = " %-30s %10u\n";
50362 +static const char fmt_hex[] = " %-30s 0x%02X\n";
50363 +static const char fmt_table[] = " %-30s %10u %10u %10u %10u\n";
50364 +static const char fmt_header[] =
50365 "%-32s current cumulative delta max\n";
50366
50367 static int iwl_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
50368 @@ -1856,7 +1856,7 @@ static ssize_t iwl_dbgfs_clear_ucode_statistics_write(struct file *file,
50369 {
50370 struct iwl_priv *priv = file->private_data;
50371 char buf[8];
50372 - int buf_size;
50373 + size_t buf_size;
50374 int clear;
50375
50376 memset(buf, 0, sizeof(buf));
50377 @@ -1901,7 +1901,7 @@ static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
50378 {
50379 struct iwl_priv *priv = file->private_data;
50380 char buf[8];
50381 - int buf_size;
50382 + size_t buf_size;
50383 int trace;
50384
50385 memset(buf, 0, sizeof(buf));
50386 @@ -1972,7 +1972,7 @@ static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
50387 {
50388 struct iwl_priv *priv = file->private_data;
50389 char buf[8];
50390 - int buf_size;
50391 + size_t buf_size;
50392 int missed;
50393
50394 memset(buf, 0, sizeof(buf));
50395 @@ -2013,7 +2013,7 @@ static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
50396
50397 struct iwl_priv *priv = file->private_data;
50398 char buf[8];
50399 - int buf_size;
50400 + size_t buf_size;
50401 int plcp;
50402
50403 memset(buf, 0, sizeof(buf));
50404 @@ -2073,7 +2073,7 @@ static ssize_t iwl_dbgfs_txfifo_flush_write(struct file *file,
50405
50406 struct iwl_priv *priv = file->private_data;
50407 char buf[8];
50408 - int buf_size;
50409 + size_t buf_size;
50410 int flush;
50411
50412 memset(buf, 0, sizeof(buf));
50413 @@ -2163,7 +2163,7 @@ static ssize_t iwl_dbgfs_protection_mode_write(struct file *file,
50414
50415 struct iwl_priv *priv = file->private_data;
50416 char buf[8];
50417 - int buf_size;
50418 + size_t buf_size;
50419 int rts;
50420
50421 if (!priv->cfg->ht_params)
50422 @@ -2204,7 +2204,7 @@ static ssize_t iwl_dbgfs_echo_test_write(struct file *file,
50423 {
50424 struct iwl_priv *priv = file->private_data;
50425 char buf[8];
50426 - int buf_size;
50427 + size_t buf_size;
50428
50429 memset(buf, 0, sizeof(buf));
50430 buf_size = min(count, sizeof(buf) - 1);
50431 @@ -2238,7 +2238,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
50432 struct iwl_priv *priv = file->private_data;
50433 u32 event_log_flag;
50434 char buf[8];
50435 - int buf_size;
50436 + size_t buf_size;
50437
50438 /* check that the interface is up */
50439 if (!iwl_is_ready(priv))
50440 @@ -2292,7 +2292,7 @@ static ssize_t iwl_dbgfs_calib_disabled_write(struct file *file,
50441 struct iwl_priv *priv = file->private_data;
50442 char buf[8];
50443 u32 calib_disabled;
50444 - int buf_size;
50445 + size_t buf_size;
50446
50447 memset(buf, 0, sizeof(buf));
50448 buf_size = min(count, sizeof(buf) - 1);
50449 diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
50450 index dc17909..989c9fb 100644
50451 --- a/drivers/net/wireless/iwlwifi/pcie/trans.c
50452 +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
50453 @@ -1919,7 +1919,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
50454 struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
50455
50456 char buf[8];
50457 - int buf_size;
50458 + size_t buf_size;
50459 u32 reset_flag;
50460
50461 memset(buf, 0, sizeof(buf));
50462 @@ -1940,7 +1940,7 @@ static ssize_t iwl_dbgfs_csr_write(struct file *file,
50463 {
50464 struct iwl_trans *trans = file->private_data;
50465 char buf[8];
50466 - int buf_size;
50467 + size_t buf_size;
50468 int csr;
50469
50470 memset(buf, 0, sizeof(buf));
50471 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
50472 index d5c0a1a..d056b20 100644
50473 --- a/drivers/net/wireless/mac80211_hwsim.c
50474 +++ b/drivers/net/wireless/mac80211_hwsim.c
50475 @@ -3149,20 +3149,20 @@ static int __init init_mac80211_hwsim(void)
50476 if (channels < 1)
50477 return -EINVAL;
50478
50479 - mac80211_hwsim_mchan_ops = mac80211_hwsim_ops;
50480 - mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan;
50481 - mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan;
50482 - mac80211_hwsim_mchan_ops.sw_scan_start = NULL;
50483 - mac80211_hwsim_mchan_ops.sw_scan_complete = NULL;
50484 - mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc;
50485 - mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc;
50486 - mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx;
50487 - mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx;
50488 - mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx;
50489 - mac80211_hwsim_mchan_ops.assign_vif_chanctx =
50490 - mac80211_hwsim_assign_vif_chanctx;
50491 - mac80211_hwsim_mchan_ops.unassign_vif_chanctx =
50492 - mac80211_hwsim_unassign_vif_chanctx;
50493 + pax_open_kernel();
50494 + memcpy((void *)&mac80211_hwsim_mchan_ops, &mac80211_hwsim_ops, sizeof mac80211_hwsim_mchan_ops);
50495 + *(void **)&mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan;
50496 + *(void **)&mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan;
50497 + *(void **)&mac80211_hwsim_mchan_ops.sw_scan_start = NULL;
50498 + *(void **)&mac80211_hwsim_mchan_ops.sw_scan_complete = NULL;
50499 + *(void **)&mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc;
50500 + *(void **)&mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc;
50501 + *(void **)&mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx;
50502 + *(void **)&mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx;
50503 + *(void **)&mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx;
50504 + *(void **)&mac80211_hwsim_mchan_ops.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx;
50505 + *(void **)&mac80211_hwsim_mchan_ops.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx;
50506 + pax_close_kernel();
50507
50508 spin_lock_init(&hwsim_radio_lock);
50509 INIT_LIST_HEAD(&hwsim_radios);
50510 diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
50511 index d72ff8e..c209a45 100644
50512 --- a/drivers/net/wireless/rndis_wlan.c
50513 +++ b/drivers/net/wireless/rndis_wlan.c
50514 @@ -1236,7 +1236,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
50515
50516 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
50517
50518 - if (rts_threshold < 0 || rts_threshold > 2347)
50519 + if (rts_threshold > 2347)
50520 rts_threshold = 2347;
50521
50522 tmp = cpu_to_le32(rts_threshold);
50523 diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
50524 index 9bb398b..b0cc047 100644
50525 --- a/drivers/net/wireless/rt2x00/rt2x00.h
50526 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
50527 @@ -375,7 +375,7 @@ struct rt2x00_intf {
50528 * for hardware which doesn't support hardware
50529 * sequence counting.
50530 */
50531 - atomic_t seqno;
50532 + atomic_unchecked_t seqno;
50533 };
50534
50535 static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
50536 diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
50537 index 68b620b..92ecd9e 100644
50538 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
50539 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
50540 @@ -224,9 +224,9 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
50541 * sequence counter given by mac80211.
50542 */
50543 if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
50544 - seqno = atomic_add_return(0x10, &intf->seqno);
50545 + seqno = atomic_add_return_unchecked(0x10, &intf->seqno);
50546 else
50547 - seqno = atomic_read(&intf->seqno);
50548 + seqno = atomic_read_unchecked(&intf->seqno);
50549
50550 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
50551 hdr->seq_ctrl |= cpu_to_le16(seqno);
50552 diff --git a/drivers/net/wireless/ti/wl1251/sdio.c b/drivers/net/wireless/ti/wl1251/sdio.c
50553 index b661f896..ddf7d2b 100644
50554 --- a/drivers/net/wireless/ti/wl1251/sdio.c
50555 +++ b/drivers/net/wireless/ti/wl1251/sdio.c
50556 @@ -282,13 +282,17 @@ static int wl1251_sdio_probe(struct sdio_func *func,
50557
50558 irq_set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
50559
50560 - wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
50561 - wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
50562 + pax_open_kernel();
50563 + *(void **)&wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
50564 + *(void **)&wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
50565 + pax_close_kernel();
50566
50567 wl1251_info("using dedicated interrupt line");
50568 } else {
50569 - wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
50570 - wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
50571 + pax_open_kernel();
50572 + *(void **)&wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
50573 + *(void **)&wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
50574 + pax_close_kernel();
50575
50576 wl1251_info("using SDIO interrupt");
50577 }
50578 diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
50579 index af0fe2e..d04986b 100644
50580 --- a/drivers/net/wireless/ti/wl12xx/main.c
50581 +++ b/drivers/net/wireless/ti/wl12xx/main.c
50582 @@ -655,7 +655,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
50583 sizeof(wl->conf.mem));
50584
50585 /* read data preparation is only needed by wl127x */
50586 - wl->ops->prepare_read = wl127x_prepare_read;
50587 + pax_open_kernel();
50588 + *(void **)&wl->ops->prepare_read = wl127x_prepare_read;
50589 + pax_close_kernel();
50590
50591 wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
50592 WL127X_IFTYPE_SR_VER, WL127X_MAJOR_SR_VER,
50593 @@ -680,7 +682,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
50594 sizeof(wl->conf.mem));
50595
50596 /* read data preparation is only needed by wl127x */
50597 - wl->ops->prepare_read = wl127x_prepare_read;
50598 + pax_open_kernel();
50599 + *(void **)&wl->ops->prepare_read = wl127x_prepare_read;
50600 + pax_close_kernel();
50601
50602 wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
50603 WL127X_IFTYPE_SR_VER, WL127X_MAJOR_SR_VER,
50604 diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
50605 index 717c4f5..a813aeb 100644
50606 --- a/drivers/net/wireless/ti/wl18xx/main.c
50607 +++ b/drivers/net/wireless/ti/wl18xx/main.c
50608 @@ -1923,8 +1923,10 @@ static int wl18xx_setup(struct wl1271 *wl)
50609 }
50610
50611 if (!checksum_param) {
50612 - wl18xx_ops.set_rx_csum = NULL;
50613 - wl18xx_ops.init_vif = NULL;
50614 + pax_open_kernel();
50615 + *(void **)&wl18xx_ops.set_rx_csum = NULL;
50616 + *(void **)&wl18xx_ops.init_vif = NULL;
50617 + pax_close_kernel();
50618 }
50619
50620 /* Enable 11a Band only if we have 5G antennas */
50621 diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
50622 index a912dc0..a8225ba 100644
50623 --- a/drivers/net/wireless/zd1211rw/zd_usb.c
50624 +++ b/drivers/net/wireless/zd1211rw/zd_usb.c
50625 @@ -385,7 +385,7 @@ static inline void handle_regs_int(struct urb *urb)
50626 {
50627 struct zd_usb *usb = urb->context;
50628 struct zd_usb_interrupt *intr = &usb->intr;
50629 - int len;
50630 + unsigned int len;
50631 u16 int_num;
50632
50633 ZD_ASSERT(in_interrupt());
50634 diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
50635 index 0d25943..0866c5d 100644
50636 --- a/drivers/net/xen-netback/netback.c
50637 +++ b/drivers/net/xen-netback/netback.c
50638 @@ -1571,13 +1571,13 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
50639 smp_rmb();
50640
50641 while (dc != dp) {
50642 - BUG_ON(gop - queue->tx_unmap_ops > MAX_PENDING_REQS);
50643 + BUG_ON(gop - queue->tx_unmap_ops >= MAX_PENDING_REQS);
50644 pending_idx =
50645 queue->dealloc_ring[pending_index(dc++)];
50646
50647 - pending_idx_release[gop-queue->tx_unmap_ops] =
50648 + pending_idx_release[gop - queue->tx_unmap_ops] =
50649 pending_idx;
50650 - queue->pages_to_unmap[gop-queue->tx_unmap_ops] =
50651 + queue->pages_to_unmap[gop - queue->tx_unmap_ops] =
50652 queue->mmap_pages[pending_idx];
50653 gnttab_set_unmap_op(gop,
50654 idx_to_kaddr(queue, pending_idx),
50655 diff --git a/drivers/nfc/nfcwilink.c b/drivers/nfc/nfcwilink.c
50656 index ce2e2cf..f81e500 100644
50657 --- a/drivers/nfc/nfcwilink.c
50658 +++ b/drivers/nfc/nfcwilink.c
50659 @@ -497,7 +497,7 @@ static struct nci_ops nfcwilink_ops = {
50660
50661 static int nfcwilink_probe(struct platform_device *pdev)
50662 {
50663 - static struct nfcwilink *drv;
50664 + struct nfcwilink *drv;
50665 int rc;
50666 __u32 protocols;
50667
50668 diff --git a/drivers/nfc/st21nfca/st21nfca.c b/drivers/nfc/st21nfca/st21nfca.c
50669 index d251f72..0512865 100644
50670 --- a/drivers/nfc/st21nfca/st21nfca.c
50671 +++ b/drivers/nfc/st21nfca/st21nfca.c
50672 @@ -148,14 +148,14 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev *hdev)
50673 ST21NFCA_DEVICE_MGNT_GATE,
50674 ST21NFCA_DEVICE_MGNT_PIPE);
50675 if (r < 0)
50676 - goto free_info;
50677 + return r;
50678
50679 /* Get pipe list */
50680 r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE,
50681 ST21NFCA_DM_GETINFO, pipe_list, sizeof(pipe_list),
50682 &skb_pipe_list);
50683 if (r < 0)
50684 - goto free_info;
50685 + return r;
50686
50687 /* Complete the existing gate_pipe table */
50688 for (i = 0; i < skb_pipe_list->len; i++) {
50689 @@ -181,6 +181,7 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev *hdev)
50690 info->src_host_id != ST21NFCA_ESE_HOST_ID) {
50691 pr_err("Unexpected apdu_reader pipe on host %x\n",
50692 info->src_host_id);
50693 + kfree_skb(skb_pipe_info);
50694 continue;
50695 }
50696
50697 @@ -200,6 +201,7 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev *hdev)
50698 hdev->pipes[st21nfca_gates[j].pipe].dest_host =
50699 info->src_host_id;
50700 }
50701 + kfree_skb(skb_pipe_info);
50702 }
50703
50704 /*
50705 @@ -214,13 +216,12 @@ static int st21nfca_hci_load_session(struct nfc_hci_dev *hdev)
50706 st21nfca_gates[i].gate,
50707 st21nfca_gates[i].pipe);
50708 if (r < 0)
50709 - goto free_info;
50710 + goto free_list;
50711 }
50712 }
50713
50714 memcpy(hdev->init_data.gates, st21nfca_gates, sizeof(st21nfca_gates));
50715 -free_info:
50716 - kfree_skb(skb_pipe_info);
50717 +free_list:
50718 kfree_skb(skb_pipe_list);
50719 return r;
50720 }
50721 diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
50722 index cde35c5d01..2dbfdbbf 100644
50723 --- a/drivers/of/fdt.c
50724 +++ b/drivers/of/fdt.c
50725 @@ -1136,7 +1136,9 @@ static int __init of_fdt_raw_init(void)
50726 pr_warn("fdt: not creating '/sys/firmware/fdt': CRC check failed\n");
50727 return 0;
50728 }
50729 - of_fdt_raw_attr.size = fdt_totalsize(initial_boot_params);
50730 + pax_open_kernel();
50731 + *(size_t *)&of_fdt_raw_attr.size = fdt_totalsize(initial_boot_params);
50732 + pax_close_kernel();
50733 return sysfs_create_bin_file(firmware_kobj, &of_fdt_raw_attr);
50734 }
50735 late_initcall(of_fdt_raw_init);
50736 diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
50737 index 82f7000..d6d0447 100644
50738 --- a/drivers/oprofile/buffer_sync.c
50739 +++ b/drivers/oprofile/buffer_sync.c
50740 @@ -345,7 +345,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
50741 if (cookie == NO_COOKIE)
50742 offset = pc;
50743 if (cookie == INVALID_COOKIE) {
50744 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
50745 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
50746 offset = pc;
50747 }
50748 if (cookie != last_cookie) {
50749 @@ -389,14 +389,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
50750 /* add userspace sample */
50751
50752 if (!mm) {
50753 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
50754 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
50755 return 0;
50756 }
50757
50758 cookie = lookup_dcookie(mm, s->eip, &offset);
50759
50760 if (cookie == INVALID_COOKIE) {
50761 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
50762 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
50763 return 0;
50764 }
50765
50766 @@ -554,7 +554,7 @@ void sync_buffer(int cpu)
50767 /* ignore backtraces if failed to add a sample */
50768 if (state == sb_bt_start) {
50769 state = sb_bt_ignore;
50770 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
50771 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
50772 }
50773 }
50774 release_mm(mm);
50775 diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
50776 index c0cc4e7..44d4e54 100644
50777 --- a/drivers/oprofile/event_buffer.c
50778 +++ b/drivers/oprofile/event_buffer.c
50779 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
50780 }
50781
50782 if (buffer_pos == buffer_size) {
50783 - atomic_inc(&oprofile_stats.event_lost_overflow);
50784 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
50785 return;
50786 }
50787
50788 diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
50789 index ed2c3ec..deda85a 100644
50790 --- a/drivers/oprofile/oprof.c
50791 +++ b/drivers/oprofile/oprof.c
50792 @@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
50793 if (oprofile_ops.switch_events())
50794 return;
50795
50796 - atomic_inc(&oprofile_stats.multiplex_counter);
50797 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
50798 start_switch_worker();
50799 }
50800
50801 diff --git a/drivers/oprofile/oprofile_files.c b/drivers/oprofile/oprofile_files.c
50802 index ee2cfce..7f8f699 100644
50803 --- a/drivers/oprofile/oprofile_files.c
50804 +++ b/drivers/oprofile/oprofile_files.c
50805 @@ -27,7 +27,7 @@ unsigned long oprofile_time_slice;
50806
50807 #ifdef CONFIG_OPROFILE_EVENT_MULTIPLEX
50808
50809 -static ssize_t timeout_read(struct file *file, char __user *buf,
50810 +static ssize_t __intentional_overflow(-1) timeout_read(struct file *file, char __user *buf,
50811 size_t count, loff_t *offset)
50812 {
50813 return oprofilefs_ulong_to_user(jiffies_to_msecs(oprofile_time_slice),
50814 diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
50815 index 59659ce..6c860a0 100644
50816 --- a/drivers/oprofile/oprofile_stats.c
50817 +++ b/drivers/oprofile/oprofile_stats.c
50818 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
50819 cpu_buf->sample_invalid_eip = 0;
50820 }
50821
50822 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
50823 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
50824 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
50825 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
50826 - atomic_set(&oprofile_stats.multiplex_counter, 0);
50827 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
50828 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
50829 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
50830 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
50831 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
50832 }
50833
50834
50835 diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
50836 index 1fc622b..8c48fc3 100644
50837 --- a/drivers/oprofile/oprofile_stats.h
50838 +++ b/drivers/oprofile/oprofile_stats.h
50839 @@ -13,11 +13,11 @@
50840 #include <linux/atomic.h>
50841
50842 struct oprofile_stat_struct {
50843 - atomic_t sample_lost_no_mm;
50844 - atomic_t sample_lost_no_mapping;
50845 - atomic_t bt_lost_no_mapping;
50846 - atomic_t event_lost_overflow;
50847 - atomic_t multiplex_counter;
50848 + atomic_unchecked_t sample_lost_no_mm;
50849 + atomic_unchecked_t sample_lost_no_mapping;
50850 + atomic_unchecked_t bt_lost_no_mapping;
50851 + atomic_unchecked_t event_lost_overflow;
50852 + atomic_unchecked_t multiplex_counter;
50853 };
50854
50855 extern struct oprofile_stat_struct oprofile_stats;
50856 diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
50857 index dd92c5e..dfc04b5 100644
50858 --- a/drivers/oprofile/oprofilefs.c
50859 +++ b/drivers/oprofile/oprofilefs.c
50860 @@ -176,8 +176,8 @@ int oprofilefs_create_ro_ulong(struct dentry *root,
50861
50862 static ssize_t atomic_read_file(struct file *file, char __user *buf, size_t count, loff_t *offset)
50863 {
50864 - atomic_t *val = file->private_data;
50865 - return oprofilefs_ulong_to_user(atomic_read(val), buf, count, offset);
50866 + atomic_unchecked_t *val = file->private_data;
50867 + return oprofilefs_ulong_to_user(atomic_read_unchecked(val), buf, count, offset);
50868 }
50869
50870
50871 @@ -189,7 +189,7 @@ static const struct file_operations atomic_ro_fops = {
50872
50873
50874 int oprofilefs_create_ro_atomic(struct dentry *root,
50875 - char const *name, atomic_t *val)
50876 + char const *name, atomic_unchecked_t *val)
50877 {
50878 return __oprofilefs_create_file(root, name,
50879 &atomic_ro_fops, 0444, val);
50880 diff --git a/drivers/oprofile/timer_int.c b/drivers/oprofile/timer_int.c
50881 index bdef916..88c7dee 100644
50882 --- a/drivers/oprofile/timer_int.c
50883 +++ b/drivers/oprofile/timer_int.c
50884 @@ -93,7 +93,7 @@ static int oprofile_cpu_notify(struct notifier_block *self,
50885 return NOTIFY_OK;
50886 }
50887
50888 -static struct notifier_block __refdata oprofile_cpu_notifier = {
50889 +static struct notifier_block oprofile_cpu_notifier = {
50890 .notifier_call = oprofile_cpu_notify,
50891 };
50892
50893 diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
50894 index 3b47080..6cd05dd 100644
50895 --- a/drivers/parport/procfs.c
50896 +++ b/drivers/parport/procfs.c
50897 @@ -64,7 +64,7 @@ static int do_active_device(struct ctl_table *table, int write,
50898
50899 *ppos += len;
50900
50901 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
50902 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
50903 }
50904
50905 #ifdef CONFIG_PARPORT_1284
50906 @@ -106,7 +106,7 @@ static int do_autoprobe(struct ctl_table *table, int write,
50907
50908 *ppos += len;
50909
50910 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
50911 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
50912 }
50913 #endif /* IEEE1284.3 support. */
50914
50915 diff --git a/drivers/pci/host/pci-host-generic.c b/drivers/pci/host/pci-host-generic.c
50916 index ba46e58..90cfc24 100644
50917 --- a/drivers/pci/host/pci-host-generic.c
50918 +++ b/drivers/pci/host/pci-host-generic.c
50919 @@ -26,9 +26,9 @@
50920 #include <linux/platform_device.h>
50921
50922 struct gen_pci_cfg_bus_ops {
50923 + struct pci_ops ops;
50924 u32 bus_shift;
50925 - void __iomem *(*map_bus)(struct pci_bus *, unsigned int, int);
50926 -};
50927 +} __do_const;
50928
50929 struct gen_pci_cfg_windows {
50930 struct resource res;
50931 @@ -56,8 +56,12 @@ static void __iomem *gen_pci_map_cfg_bus_cam(struct pci_bus *bus,
50932 }
50933
50934 static struct gen_pci_cfg_bus_ops gen_pci_cfg_cam_bus_ops = {
50935 + .ops = {
50936 + .map_bus = gen_pci_map_cfg_bus_cam,
50937 + .read = pci_generic_config_read,
50938 + .write = pci_generic_config_write,
50939 + },
50940 .bus_shift = 16,
50941 - .map_bus = gen_pci_map_cfg_bus_cam,
50942 };
50943
50944 static void __iomem *gen_pci_map_cfg_bus_ecam(struct pci_bus *bus,
50945 @@ -72,13 +76,12 @@ static void __iomem *gen_pci_map_cfg_bus_ecam(struct pci_bus *bus,
50946 }
50947
50948 static struct gen_pci_cfg_bus_ops gen_pci_cfg_ecam_bus_ops = {
50949 + .ops = {
50950 + .map_bus = gen_pci_map_cfg_bus_ecam,
50951 + .read = pci_generic_config_read,
50952 + .write = pci_generic_config_write,
50953 + },
50954 .bus_shift = 20,
50955 - .map_bus = gen_pci_map_cfg_bus_ecam,
50956 -};
50957 -
50958 -static struct pci_ops gen_pci_ops = {
50959 - .read = pci_generic_config_read,
50960 - .write = pci_generic_config_write,
50961 };
50962
50963 static const struct of_device_id gen_pci_of_match[] = {
50964 @@ -219,7 +222,6 @@ static int gen_pci_probe(struct platform_device *pdev)
50965 .private_data = (void **)&pci,
50966 .setup = gen_pci_setup,
50967 .map_irq = of_irq_parse_and_map_pci,
50968 - .ops = &gen_pci_ops,
50969 };
50970
50971 if (!pci)
50972 @@ -241,7 +243,7 @@ static int gen_pci_probe(struct platform_device *pdev)
50973
50974 of_id = of_match_node(gen_pci_of_match, np);
50975 pci->cfg.ops = of_id->data;
50976 - gen_pci_ops.map_bus = pci->cfg.ops->map_bus;
50977 + hw.ops = &pci->cfg.ops->ops;
50978 pci->host.dev.parent = dev;
50979 INIT_LIST_HEAD(&pci->host.windows);
50980 INIT_LIST_HEAD(&pci->resources);
50981 diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
50982 index 6ca2399..68d866b 100644
50983 --- a/drivers/pci/hotplug/acpiphp_ibm.c
50984 +++ b/drivers/pci/hotplug/acpiphp_ibm.c
50985 @@ -452,7 +452,9 @@ static int __init ibm_acpiphp_init(void)
50986 goto init_cleanup;
50987 }
50988
50989 - ibm_apci_table_attr.size = ibm_get_table_from_acpi(NULL);
50990 + pax_open_kernel();
50991 + *(size_t *)&ibm_apci_table_attr.size = ibm_get_table_from_acpi(NULL);
50992 + pax_close_kernel();
50993 retval = sysfs_create_bin_file(sysdir, &ibm_apci_table_attr);
50994
50995 return retval;
50996 diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
50997 index 66b7bbe..26bee78 100644
50998 --- a/drivers/pci/hotplug/cpcihp_generic.c
50999 +++ b/drivers/pci/hotplug/cpcihp_generic.c
51000 @@ -73,7 +73,6 @@ static u16 port;
51001 static unsigned int enum_bit;
51002 static u8 enum_mask;
51003
51004 -static struct cpci_hp_controller_ops generic_hpc_ops;
51005 static struct cpci_hp_controller generic_hpc;
51006
51007 static int __init validate_parameters(void)
51008 @@ -139,6 +138,10 @@ static int query_enum(void)
51009 return ((value & enum_mask) == enum_mask);
51010 }
51011
51012 +static struct cpci_hp_controller_ops generic_hpc_ops = {
51013 + .query_enum = query_enum,
51014 +};
51015 +
51016 static int __init cpcihp_generic_init(void)
51017 {
51018 int status;
51019 @@ -165,7 +168,6 @@ static int __init cpcihp_generic_init(void)
51020 pci_dev_put(dev);
51021
51022 memset(&generic_hpc, 0, sizeof (struct cpci_hp_controller));
51023 - generic_hpc_ops.query_enum = query_enum;
51024 generic_hpc.ops = &generic_hpc_ops;
51025
51026 status = cpci_hp_register_controller(&generic_hpc);
51027 diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
51028 index 7ecf34e..effed62 100644
51029 --- a/drivers/pci/hotplug/cpcihp_zt5550.c
51030 +++ b/drivers/pci/hotplug/cpcihp_zt5550.c
51031 @@ -59,7 +59,6 @@
51032 /* local variables */
51033 static bool debug;
51034 static bool poll;
51035 -static struct cpci_hp_controller_ops zt5550_hpc_ops;
51036 static struct cpci_hp_controller zt5550_hpc;
51037
51038 /* Primary cPCI bus bridge device */
51039 @@ -204,6 +203,10 @@ static int zt5550_hc_disable_irq(void)
51040 return 0;
51041 }
51042
51043 +static struct cpci_hp_controller_ops zt5550_hpc_ops = {
51044 + .query_enum = zt5550_hc_query_enum,
51045 +};
51046 +
51047 static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
51048 {
51049 int status;
51050 @@ -215,16 +218,17 @@ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id
51051 dbg("returned from zt5550_hc_config");
51052
51053 memset(&zt5550_hpc, 0, sizeof (struct cpci_hp_controller));
51054 - zt5550_hpc_ops.query_enum = zt5550_hc_query_enum;
51055 zt5550_hpc.ops = &zt5550_hpc_ops;
51056 if (!poll) {
51057 zt5550_hpc.irq = hc_dev->irq;
51058 zt5550_hpc.irq_flags = IRQF_SHARED;
51059 zt5550_hpc.dev_id = hc_dev;
51060
51061 - zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
51062 - zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
51063 - zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
51064 + pax_open_kernel();
51065 + *(void **)&zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
51066 + *(void **)&zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
51067 + *(void **)&zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
51068 + pax_open_kernel();
51069 } else {
51070 info("using ENUM# polling mode");
51071 }
51072 diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
51073 index 1e08ff8c..3cd145f 100644
51074 --- a/drivers/pci/hotplug/cpqphp_nvram.c
51075 +++ b/drivers/pci/hotplug/cpqphp_nvram.c
51076 @@ -425,8 +425,10 @@ static u32 store_HRT (void __iomem *rom_start)
51077
51078 void compaq_nvram_init (void __iomem *rom_start)
51079 {
51080 +#ifndef CONFIG_PAX_KERNEXEC
51081 if (rom_start)
51082 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
51083 +#endif
51084
51085 dbg("int15 entry = %p\n", compaq_int15_entry_point);
51086
51087 diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
51088 index 56d8486..f26113f 100644
51089 --- a/drivers/pci/hotplug/pci_hotplug_core.c
51090 +++ b/drivers/pci/hotplug/pci_hotplug_core.c
51091 @@ -436,8 +436,10 @@ int __pci_hp_register(struct hotplug_slot *slot, struct pci_bus *bus,
51092 return -EINVAL;
51093 }
51094
51095 - slot->ops->owner = owner;
51096 - slot->ops->mod_name = mod_name;
51097 + pax_open_kernel();
51098 + *(struct module **)&slot->ops->owner = owner;
51099 + *(const char **)&slot->ops->mod_name = mod_name;
51100 + pax_close_kernel();
51101
51102 mutex_lock(&pci_hp_mutex);
51103 /*
51104 diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
51105 index 07aa722..84514b4 100644
51106 --- a/drivers/pci/hotplug/pciehp_core.c
51107 +++ b/drivers/pci/hotplug/pciehp_core.c
51108 @@ -92,7 +92,7 @@ static int init_slot(struct controller *ctrl)
51109 struct slot *slot = ctrl->slot;
51110 struct hotplug_slot *hotplug = NULL;
51111 struct hotplug_slot_info *info = NULL;
51112 - struct hotplug_slot_ops *ops = NULL;
51113 + hotplug_slot_ops_no_const *ops = NULL;
51114 char name[SLOT_NAME_SIZE];
51115 int retval = -ENOMEM;
51116
51117 diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
51118 index c3e7dfc..cbd9625 100644
51119 --- a/drivers/pci/msi.c
51120 +++ b/drivers/pci/msi.c
51121 @@ -513,8 +513,8 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
51122 {
51123 struct attribute **msi_attrs;
51124 struct attribute *msi_attr;
51125 - struct device_attribute *msi_dev_attr;
51126 - struct attribute_group *msi_irq_group;
51127 + device_attribute_no_const *msi_dev_attr;
51128 + attribute_group_no_const *msi_irq_group;
51129 const struct attribute_group **msi_irq_groups;
51130 struct msi_desc *entry;
51131 int ret = -ENOMEM;
51132 @@ -573,7 +573,7 @@ error_attrs:
51133 count = 0;
51134 msi_attr = msi_attrs[count];
51135 while (msi_attr) {
51136 - msi_dev_attr = container_of(msi_attr, struct device_attribute, attr);
51137 + msi_dev_attr = container_of(msi_attr, device_attribute_no_const, attr);
51138 kfree(msi_attr->name);
51139 kfree(msi_dev_attr);
51140 ++count;
51141 diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
51142 index 312f23a..d21181c 100644
51143 --- a/drivers/pci/pci-sysfs.c
51144 +++ b/drivers/pci/pci-sysfs.c
51145 @@ -1140,7 +1140,7 @@ static int pci_create_attr(struct pci_dev *pdev, int num, int write_combine)
51146 {
51147 /* allocate attribute structure, piggyback attribute name */
51148 int name_len = write_combine ? 13 : 10;
51149 - struct bin_attribute *res_attr;
51150 + bin_attribute_no_const *res_attr;
51151 int retval;
51152
51153 res_attr = kzalloc(sizeof(*res_attr) + name_len, GFP_ATOMIC);
51154 @@ -1317,7 +1317,7 @@ static struct device_attribute reset_attr = __ATTR(reset, 0200, NULL, reset_stor
51155 static int pci_create_capabilities_sysfs(struct pci_dev *dev)
51156 {
51157 int retval;
51158 - struct bin_attribute *attr;
51159 + bin_attribute_no_const *attr;
51160
51161 /* If the device has VPD, try to expose it in sysfs. */
51162 if (dev->vpd) {
51163 @@ -1364,7 +1364,7 @@ int __must_check pci_create_sysfs_dev_files(struct pci_dev *pdev)
51164 {
51165 int retval;
51166 int rom_size = 0;
51167 - struct bin_attribute *attr;
51168 + bin_attribute_no_const *attr;
51169
51170 if (!sysfs_initialized)
51171 return -EACCES;
51172 diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
51173 index 9bd762c2..6fb9504 100644
51174 --- a/drivers/pci/pci.h
51175 +++ b/drivers/pci/pci.h
51176 @@ -99,7 +99,7 @@ struct pci_vpd_ops {
51177 struct pci_vpd {
51178 unsigned int len;
51179 const struct pci_vpd_ops *ops;
51180 - struct bin_attribute *attr; /* descriptor for sysfs VPD entry */
51181 + bin_attribute_no_const *attr; /* descriptor for sysfs VPD entry */
51182 };
51183
51184 int pci_vpd_pci22_init(struct pci_dev *dev);
51185 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
51186 index 7d4fcdc..2f6d8f8 100644
51187 --- a/drivers/pci/pcie/aspm.c
51188 +++ b/drivers/pci/pcie/aspm.c
51189 @@ -27,9 +27,9 @@
51190 #define MODULE_PARAM_PREFIX "pcie_aspm."
51191
51192 /* Note: those are not register definitions */
51193 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
51194 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
51195 -#define ASPM_STATE_L1 (4) /* L1 state */
51196 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
51197 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
51198 +#define ASPM_STATE_L1 (4U) /* L1 state */
51199 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
51200 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
51201
51202 diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
51203 index be35da2..ec16cdb 100644
51204 --- a/drivers/pci/pcie/portdrv_pci.c
51205 +++ b/drivers/pci/pcie/portdrv_pci.c
51206 @@ -324,7 +324,7 @@ static int __init dmi_pcie_pme_disable_msi(const struct dmi_system_id *d)
51207 return 0;
51208 }
51209
51210 -static struct dmi_system_id __initdata pcie_portdrv_dmi_table[] = {
51211 +static const struct dmi_system_id __initconst pcie_portdrv_dmi_table[] = {
51212 /*
51213 * Boxes that should not use MSI for PCIe PME signaling.
51214 */
51215 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
51216 index c911857..56f3f9d 100644
51217 --- a/drivers/pci/probe.c
51218 +++ b/drivers/pci/probe.c
51219 @@ -176,7 +176,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
51220 u16 orig_cmd;
51221 struct pci_bus_region region, inverted_region;
51222
51223 - mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
51224 + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
51225
51226 /* No printks while decoding is disabled! */
51227 if (!dev->mmio_always_on) {
51228 diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
51229 index 3f155e7..0f4b1f0 100644
51230 --- a/drivers/pci/proc.c
51231 +++ b/drivers/pci/proc.c
51232 @@ -434,7 +434,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
51233 static int __init pci_proc_init(void)
51234 {
51235 struct pci_dev *dev = NULL;
51236 +
51237 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
51238 +#ifdef CONFIG_GRKERNSEC_PROC_USER
51239 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
51240 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51241 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
51242 +#endif
51243 +#else
51244 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
51245 +#endif
51246 proc_create("devices", 0, proc_bus_pci_dir,
51247 &proc_bus_pci_dev_operations);
51248 proc_initialized = 1;
51249 diff --git a/drivers/platform/chrome/chromeos_pstore.c b/drivers/platform/chrome/chromeos_pstore.c
51250 index 3474920..acc9581 100644
51251 --- a/drivers/platform/chrome/chromeos_pstore.c
51252 +++ b/drivers/platform/chrome/chromeos_pstore.c
51253 @@ -13,7 +13,7 @@
51254 #include <linux/platform_device.h>
51255 #include <linux/pstore_ram.h>
51256
51257 -static struct dmi_system_id chromeos_pstore_dmi_table[] __initdata = {
51258 +static const struct dmi_system_id chromeos_pstore_dmi_table[] __initconst = {
51259 {
51260 /*
51261 * Today all Chromebooks/boxes ship with Google_* as version and
51262 diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
51263 index 1e1e594..8fe59c5 100644
51264 --- a/drivers/platform/x86/alienware-wmi.c
51265 +++ b/drivers/platform/x86/alienware-wmi.c
51266 @@ -150,7 +150,7 @@ struct wmax_led_args {
51267 } __packed;
51268
51269 static struct platform_device *platform_device;
51270 -static struct device_attribute *zone_dev_attrs;
51271 +static device_attribute_no_const *zone_dev_attrs;
51272 static struct attribute **zone_attrs;
51273 static struct platform_zone *zone_data;
51274
51275 @@ -160,7 +160,7 @@ static struct platform_driver platform_driver = {
51276 }
51277 };
51278
51279 -static struct attribute_group zone_attribute_group = {
51280 +static attribute_group_no_const zone_attribute_group = {
51281 .name = "rgb_zones",
51282 };
51283
51284 diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
51285 index 7543a56..367ca8ed 100644
51286 --- a/drivers/platform/x86/asus-wmi.c
51287 +++ b/drivers/platform/x86/asus-wmi.c
51288 @@ -1589,6 +1589,10 @@ static int show_dsts(struct seq_file *m, void *data)
51289 int err;
51290 u32 retval = -1;
51291
51292 +#ifdef CONFIG_GRKERNSEC_KMEM
51293 + return -EPERM;
51294 +#endif
51295 +
51296 err = asus_wmi_get_devstate(asus, asus->debug.dev_id, &retval);
51297
51298 if (err < 0)
51299 @@ -1605,6 +1609,10 @@ static int show_devs(struct seq_file *m, void *data)
51300 int err;
51301 u32 retval = -1;
51302
51303 +#ifdef CONFIG_GRKERNSEC_KMEM
51304 + return -EPERM;
51305 +#endif
51306 +
51307 err = asus_wmi_set_devstate(asus->debug.dev_id, asus->debug.ctrl_param,
51308 &retval);
51309
51310 @@ -1629,6 +1637,10 @@ static int show_call(struct seq_file *m, void *data)
51311 union acpi_object *obj;
51312 acpi_status status;
51313
51314 +#ifdef CONFIG_GRKERNSEC_KMEM
51315 + return -EPERM;
51316 +#endif
51317 +
51318 status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID,
51319 1, asus->debug.method_id,
51320 &input, &output);
51321 diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
51322 index b4e9447..9dc6ec34 100644
51323 --- a/drivers/platform/x86/compal-laptop.c
51324 +++ b/drivers/platform/x86/compal-laptop.c
51325 @@ -765,7 +765,7 @@ static int dmi_check_cb_extra(const struct dmi_system_id *id)
51326 return 1;
51327 }
51328
51329 -static struct dmi_system_id __initdata compal_dmi_table[] = {
51330 +static const struct dmi_system_id __initconst compal_dmi_table[] = {
51331 {
51332 .ident = "FL90/IFL90",
51333 .matches = {
51334 diff --git a/drivers/platform/x86/hdaps.c b/drivers/platform/x86/hdaps.c
51335 index 458e6c9..089aee7 100644
51336 --- a/drivers/platform/x86/hdaps.c
51337 +++ b/drivers/platform/x86/hdaps.c
51338 @@ -514,7 +514,7 @@ static int __init hdaps_dmi_match_invert(const struct dmi_system_id *id)
51339 "ThinkPad T42p", so the order of the entries matters.
51340 If your ThinkPad is not recognized, please update to latest
51341 BIOS. This is especially the case for some R52 ThinkPads. */
51342 -static struct dmi_system_id __initdata hdaps_whitelist[] = {
51343 +static const struct dmi_system_id __initconst hdaps_whitelist[] = {
51344 HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad R50p", HDAPS_BOTH_AXES),
51345 HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R50"),
51346 HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R51"),
51347 diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
51348 index 97c2be1..2ee50ce 100644
51349 --- a/drivers/platform/x86/ibm_rtl.c
51350 +++ b/drivers/platform/x86/ibm_rtl.c
51351 @@ -227,7 +227,7 @@ static void rtl_teardown_sysfs(void) {
51352 }
51353
51354
51355 -static struct dmi_system_id __initdata ibm_rtl_dmi_table[] = {
51356 +static const struct dmi_system_id __initconst ibm_rtl_dmi_table[] = {
51357 { \
51358 .matches = { \
51359 DMI_MATCH(DMI_SYS_VENDOR, "IBM"), \
51360 diff --git a/drivers/platform/x86/intel_oaktrail.c b/drivers/platform/x86/intel_oaktrail.c
51361 index 8037c8b..f88445c 100644
51362 --- a/drivers/platform/x86/intel_oaktrail.c
51363 +++ b/drivers/platform/x86/intel_oaktrail.c
51364 @@ -298,7 +298,7 @@ static int dmi_check_cb(const struct dmi_system_id *id)
51365 return 0;
51366 }
51367
51368 -static struct dmi_system_id __initdata oaktrail_dmi_table[] = {
51369 +static const struct dmi_system_id __initconst oaktrail_dmi_table[] = {
51370 {
51371 .ident = "OakTrail platform",
51372 .matches = {
51373 diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
51374 index 0859877..59d596d 100644
51375 --- a/drivers/platform/x86/msi-laptop.c
51376 +++ b/drivers/platform/x86/msi-laptop.c
51377 @@ -604,7 +604,7 @@ static int dmi_check_cb(const struct dmi_system_id *dmi)
51378 return 1;
51379 }
51380
51381 -static struct dmi_system_id __initdata msi_dmi_table[] = {
51382 +static const struct dmi_system_id __initconst msi_dmi_table[] = {
51383 {
51384 .ident = "MSI S270",
51385 .matches = {
51386 @@ -999,12 +999,14 @@ static int __init load_scm_model_init(struct platform_device *sdev)
51387
51388 if (!quirks->ec_read_only) {
51389 /* allow userland write sysfs file */
51390 - dev_attr_bluetooth.store = store_bluetooth;
51391 - dev_attr_wlan.store = store_wlan;
51392 - dev_attr_threeg.store = store_threeg;
51393 - dev_attr_bluetooth.attr.mode |= S_IWUSR;
51394 - dev_attr_wlan.attr.mode |= S_IWUSR;
51395 - dev_attr_threeg.attr.mode |= S_IWUSR;
51396 + pax_open_kernel();
51397 + *(void **)&dev_attr_bluetooth.store = store_bluetooth;
51398 + *(void **)&dev_attr_wlan.store = store_wlan;
51399 + *(void **)&dev_attr_threeg.store = store_threeg;
51400 + *(umode_t *)&dev_attr_bluetooth.attr.mode |= S_IWUSR;
51401 + *(umode_t *)&dev_attr_wlan.attr.mode |= S_IWUSR;
51402 + *(umode_t *)&dev_attr_threeg.attr.mode |= S_IWUSR;
51403 + pax_close_kernel();
51404 }
51405
51406 /* disable hardware control by fn key */
51407 diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
51408 index 6d2bac0..ec2b029 100644
51409 --- a/drivers/platform/x86/msi-wmi.c
51410 +++ b/drivers/platform/x86/msi-wmi.c
51411 @@ -183,7 +183,7 @@ static const struct backlight_ops msi_backlight_ops = {
51412 static void msi_wmi_notify(u32 value, void *context)
51413 {
51414 struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
51415 - static struct key_entry *key;
51416 + struct key_entry *key;
51417 union acpi_object *obj;
51418 acpi_status status;
51419
51420 diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
51421 index 9e701b2..c68a7b5 100644
51422 --- a/drivers/platform/x86/samsung-laptop.c
51423 +++ b/drivers/platform/x86/samsung-laptop.c
51424 @@ -1567,7 +1567,7 @@ static int __init samsung_dmi_matched(const struct dmi_system_id *d)
51425 return 0;
51426 }
51427
51428 -static struct dmi_system_id __initdata samsung_dmi_table[] = {
51429 +static const struct dmi_system_id __initconst samsung_dmi_table[] = {
51430 {
51431 .matches = {
51432 DMI_MATCH(DMI_SYS_VENDOR,
51433 diff --git a/drivers/platform/x86/samsung-q10.c b/drivers/platform/x86/samsung-q10.c
51434 index e6aac72..e11ff24 100644
51435 --- a/drivers/platform/x86/samsung-q10.c
51436 +++ b/drivers/platform/x86/samsung-q10.c
51437 @@ -95,7 +95,7 @@ static int __init dmi_check_callback(const struct dmi_system_id *id)
51438 return 1;
51439 }
51440
51441 -static struct dmi_system_id __initdata samsungq10_dmi_table[] = {
51442 +static const struct dmi_system_id __initconst samsungq10_dmi_table[] = {
51443 {
51444 .ident = "Samsung Q10",
51445 .matches = {
51446 diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
51447 index e51c1e7..71bb385 100644
51448 --- a/drivers/platform/x86/sony-laptop.c
51449 +++ b/drivers/platform/x86/sony-laptop.c
51450 @@ -2526,7 +2526,7 @@ static void sony_nc_gfx_switch_cleanup(struct platform_device *pd)
51451 }
51452
51453 /* High speed charging function */
51454 -static struct device_attribute *hsc_handle;
51455 +static device_attribute_no_const *hsc_handle;
51456
51457 static ssize_t sony_nc_highspeed_charging_store(struct device *dev,
51458 struct device_attribute *attr,
51459 @@ -2600,7 +2600,7 @@ static void sony_nc_highspeed_charging_cleanup(struct platform_device *pd)
51460 }
51461
51462 /* low battery function */
51463 -static struct device_attribute *lowbatt_handle;
51464 +static device_attribute_no_const *lowbatt_handle;
51465
51466 static ssize_t sony_nc_lowbatt_store(struct device *dev,
51467 struct device_attribute *attr,
51468 @@ -2666,7 +2666,7 @@ static void sony_nc_lowbatt_cleanup(struct platform_device *pd)
51469 }
51470
51471 /* fan speed function */
51472 -static struct device_attribute *fan_handle, *hsf_handle;
51473 +static device_attribute_no_const *fan_handle, *hsf_handle;
51474
51475 static ssize_t sony_nc_hsfan_store(struct device *dev,
51476 struct device_attribute *attr,
51477 @@ -2773,7 +2773,7 @@ static void sony_nc_fanspeed_cleanup(struct platform_device *pd)
51478 }
51479
51480 /* USB charge function */
51481 -static struct device_attribute *uc_handle;
51482 +static device_attribute_no_const *uc_handle;
51483
51484 static ssize_t sony_nc_usb_charge_store(struct device *dev,
51485 struct device_attribute *attr,
51486 @@ -2847,7 +2847,7 @@ static void sony_nc_usb_charge_cleanup(struct platform_device *pd)
51487 }
51488
51489 /* Panel ID function */
51490 -static struct device_attribute *panel_handle;
51491 +static device_attribute_no_const *panel_handle;
51492
51493 static ssize_t sony_nc_panelid_show(struct device *dev,
51494 struct device_attribute *attr, char *buffer)
51495 @@ -2894,7 +2894,7 @@ static void sony_nc_panelid_cleanup(struct platform_device *pd)
51496 }
51497
51498 /* smart connect function */
51499 -static struct device_attribute *sc_handle;
51500 +static device_attribute_no_const *sc_handle;
51501
51502 static ssize_t sony_nc_smart_conn_store(struct device *dev,
51503 struct device_attribute *attr,
51504 @@ -4854,7 +4854,7 @@ static struct acpi_driver sony_pic_driver = {
51505 .drv.pm = &sony_pic_pm,
51506 };
51507
51508 -static struct dmi_system_id __initdata sonypi_dmi_table[] = {
51509 +static const struct dmi_system_id __initconst sonypi_dmi_table[] = {
51510 {
51511 .ident = "Sony Vaio",
51512 .matches = {
51513 diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
51514 index 28f3281..171d8c3 100644
51515 --- a/drivers/platform/x86/thinkpad_acpi.c
51516 +++ b/drivers/platform/x86/thinkpad_acpi.c
51517 @@ -2459,10 +2459,10 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
51518 && !tp_features.bright_unkfw)
51519 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
51520 }
51521 +}
51522
51523 #undef TPACPI_COMPARE_KEY
51524 #undef TPACPI_MAY_SEND_KEY
51525 -}
51526
51527 /*
51528 * Polling driver
51529 diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
51530 index 438d4c7..ca8a2fb 100644
51531 --- a/drivers/pnp/pnpbios/bioscalls.c
51532 +++ b/drivers/pnp/pnpbios/bioscalls.c
51533 @@ -59,7 +59,7 @@ do { \
51534 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
51535 } while(0)
51536
51537 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
51538 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
51539 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
51540
51541 /*
51542 @@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
51543
51544 cpu = get_cpu();
51545 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
51546 +
51547 + pax_open_kernel();
51548 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
51549 + pax_close_kernel();
51550
51551 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
51552 spin_lock_irqsave(&pnp_bios_lock, flags);
51553 @@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
51554 :"memory");
51555 spin_unlock_irqrestore(&pnp_bios_lock, flags);
51556
51557 + pax_open_kernel();
51558 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
51559 + pax_close_kernel();
51560 +
51561 put_cpu();
51562
51563 /* If we get here and this is set then the PnP BIOS faulted on us. */
51564 @@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
51565 return status;
51566 }
51567
51568 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
51569 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
51570 {
51571 int i;
51572
51573 @@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
51574 pnp_bios_callpoint.offset = header->fields.pm16offset;
51575 pnp_bios_callpoint.segment = PNP_CS16;
51576
51577 + pax_open_kernel();
51578 +
51579 for_each_possible_cpu(i) {
51580 struct desc_struct *gdt = get_cpu_gdt_table(i);
51581 if (!gdt)
51582 @@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
51583 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
51584 (unsigned long)__va(header->fields.pm16dseg));
51585 }
51586 +
51587 + pax_close_kernel();
51588 }
51589 diff --git a/drivers/pnp/pnpbios/core.c b/drivers/pnp/pnpbios/core.c
51590 index facd43b..b291260 100644
51591 --- a/drivers/pnp/pnpbios/core.c
51592 +++ b/drivers/pnp/pnpbios/core.c
51593 @@ -494,7 +494,7 @@ static int __init exploding_pnp_bios(const struct dmi_system_id *d)
51594 return 0;
51595 }
51596
51597 -static struct dmi_system_id pnpbios_dmi_table[] __initdata = {
51598 +static const struct dmi_system_id pnpbios_dmi_table[] __initconst = {
51599 { /* PnPBIOS GPF on boot */
51600 .callback = exploding_pnp_bios,
51601 .ident = "Higraded P14H",
51602 diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c
51603 index dfe1ee8..67e820c 100644
51604 --- a/drivers/power/pda_power.c
51605 +++ b/drivers/power/pda_power.c
51606 @@ -38,7 +38,11 @@ static struct power_supply *pda_psy_ac, *pda_psy_usb;
51607
51608 #if IS_ENABLED(CONFIG_USB_PHY)
51609 static struct usb_phy *transceiver;
51610 -static struct notifier_block otg_nb;
51611 +static int otg_handle_notification(struct notifier_block *nb,
51612 + unsigned long event, void *unused);
51613 +static struct notifier_block otg_nb = {
51614 + .notifier_call = otg_handle_notification
51615 +};
51616 #endif
51617
51618 static struct regulator *ac_draw;
51619 @@ -373,7 +377,6 @@ static int pda_power_probe(struct platform_device *pdev)
51620
51621 #if IS_ENABLED(CONFIG_USB_PHY)
51622 if (!IS_ERR_OR_NULL(transceiver) && pdata->use_otg_notifier) {
51623 - otg_nb.notifier_call = otg_handle_notification;
51624 ret = usb_register_notifier(transceiver, &otg_nb);
51625 if (ret) {
51626 dev_err(dev, "failure to register otg notifier\n");
51627 diff --git a/drivers/power/power_supply.h b/drivers/power/power_supply.h
51628 index cc439fd..8fa30df 100644
51629 --- a/drivers/power/power_supply.h
51630 +++ b/drivers/power/power_supply.h
51631 @@ -16,12 +16,12 @@ struct power_supply;
51632
51633 #ifdef CONFIG_SYSFS
51634
51635 -extern void power_supply_init_attrs(struct device_type *dev_type);
51636 +extern void power_supply_init_attrs(void);
51637 extern int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env);
51638
51639 #else
51640
51641 -static inline void power_supply_init_attrs(struct device_type *dev_type) {}
51642 +static inline void power_supply_init_attrs(void) {}
51643 #define power_supply_uevent NULL
51644
51645 #endif /* CONFIG_SYSFS */
51646 diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
51647 index 4bc0c7f..198c99d 100644
51648 --- a/drivers/power/power_supply_core.c
51649 +++ b/drivers/power/power_supply_core.c
51650 @@ -28,7 +28,10 @@ EXPORT_SYMBOL_GPL(power_supply_class);
51651 ATOMIC_NOTIFIER_HEAD(power_supply_notifier);
51652 EXPORT_SYMBOL_GPL(power_supply_notifier);
51653
51654 -static struct device_type power_supply_dev_type;
51655 +extern const struct attribute_group *power_supply_attr_groups[];
51656 +static struct device_type power_supply_dev_type = {
51657 + .groups = power_supply_attr_groups,
51658 +};
51659
51660 #define POWER_SUPPLY_DEFERRED_REGISTER_TIME msecs_to_jiffies(10)
51661
51662 @@ -921,7 +924,7 @@ static int __init power_supply_class_init(void)
51663 return PTR_ERR(power_supply_class);
51664
51665 power_supply_class->dev_uevent = power_supply_uevent;
51666 - power_supply_init_attrs(&power_supply_dev_type);
51667 + power_supply_init_attrs();
51668
51669 return 0;
51670 }
51671 diff --git a/drivers/power/power_supply_sysfs.c b/drivers/power/power_supply_sysfs.c
51672 index 9134e3d..45eee1e 100644
51673 --- a/drivers/power/power_supply_sysfs.c
51674 +++ b/drivers/power/power_supply_sysfs.c
51675 @@ -238,17 +238,15 @@ static struct attribute_group power_supply_attr_group = {
51676 .is_visible = power_supply_attr_is_visible,
51677 };
51678
51679 -static const struct attribute_group *power_supply_attr_groups[] = {
51680 +const struct attribute_group *power_supply_attr_groups[] = {
51681 &power_supply_attr_group,
51682 NULL,
51683 };
51684
51685 -void power_supply_init_attrs(struct device_type *dev_type)
51686 +void power_supply_init_attrs(void)
51687 {
51688 int i;
51689
51690 - dev_type->groups = power_supply_attr_groups;
51691 -
51692 for (i = 0; i < ARRAY_SIZE(power_supply_attrs); i++)
51693 __power_supply_attrs[i] = &power_supply_attrs[i].attr;
51694 }
51695 diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
51696 index 84419af..268ede8 100644
51697 --- a/drivers/powercap/powercap_sys.c
51698 +++ b/drivers/powercap/powercap_sys.c
51699 @@ -154,8 +154,77 @@ struct powercap_constraint_attr {
51700 struct device_attribute name_attr;
51701 };
51702
51703 +static ssize_t show_constraint_name(struct device *dev,
51704 + struct device_attribute *dev_attr,
51705 + char *buf);
51706 +
51707 static struct powercap_constraint_attr
51708 - constraint_attrs[MAX_CONSTRAINTS_PER_ZONE];
51709 + constraint_attrs[MAX_CONSTRAINTS_PER_ZONE] = {
51710 + [0 ... MAX_CONSTRAINTS_PER_ZONE - 1] = {
51711 + .power_limit_attr = {
51712 + .attr = {
51713 + .name = NULL,
51714 + .mode = S_IWUSR | S_IRUGO
51715 + },
51716 + .show = show_constraint_power_limit_uw,
51717 + .store = store_constraint_power_limit_uw
51718 + },
51719 +
51720 + .time_window_attr = {
51721 + .attr = {
51722 + .name = NULL,
51723 + .mode = S_IWUSR | S_IRUGO
51724 + },
51725 + .show = show_constraint_time_window_us,
51726 + .store = store_constraint_time_window_us
51727 + },
51728 +
51729 + .max_power_attr = {
51730 + .attr = {
51731 + .name = NULL,
51732 + .mode = S_IRUGO
51733 + },
51734 + .show = show_constraint_max_power_uw,
51735 + .store = NULL
51736 + },
51737 +
51738 + .min_power_attr = {
51739 + .attr = {
51740 + .name = NULL,
51741 + .mode = S_IRUGO
51742 + },
51743 + .show = show_constraint_min_power_uw,
51744 + .store = NULL
51745 + },
51746 +
51747 + .max_time_window_attr = {
51748 + .attr = {
51749 + .name = NULL,
51750 + .mode = S_IRUGO
51751 + },
51752 + .show = show_constraint_max_time_window_us,
51753 + .store = NULL
51754 + },
51755 +
51756 + .min_time_window_attr = {
51757 + .attr = {
51758 + .name = NULL,
51759 + .mode = S_IRUGO
51760 + },
51761 + .show = show_constraint_min_time_window_us,
51762 + .store = NULL
51763 + },
51764 +
51765 + .name_attr = {
51766 + .attr = {
51767 + .name = NULL,
51768 + .mode = S_IRUGO
51769 + },
51770 + .show = show_constraint_name,
51771 + .store = NULL
51772 + }
51773 + }
51774 +};
51775
51776 /* A list of powercap control_types */
51777 static LIST_HEAD(powercap_cntrl_list);
51778 @@ -193,23 +262,16 @@ static ssize_t show_constraint_name(struct device *dev,
51779 }
51780
51781 static int create_constraint_attribute(int id, const char *name,
51782 - int mode,
51783 - struct device_attribute *dev_attr,
51784 - ssize_t (*show)(struct device *,
51785 - struct device_attribute *, char *),
51786 - ssize_t (*store)(struct device *,
51787 - struct device_attribute *,
51788 - const char *, size_t)
51789 - )
51790 + struct device_attribute *dev_attr)
51791 {
51792 + name = kasprintf(GFP_KERNEL, "constraint_%d_%s", id, name);
51793
51794 - dev_attr->attr.name = kasprintf(GFP_KERNEL, "constraint_%d_%s",
51795 - id, name);
51796 - if (!dev_attr->attr.name)
51797 + if (!name)
51798 return -ENOMEM;
51799 - dev_attr->attr.mode = mode;
51800 - dev_attr->show = show;
51801 - dev_attr->store = store;
51802 +
51803 + pax_open_kernel();
51804 + *(const char **)&dev_attr->attr.name = name;
51805 + pax_close_kernel();
51806
51807 return 0;
51808 }
51809 @@ -236,49 +298,31 @@ static int seed_constraint_attributes(void)
51810
51811 for (i = 0; i < MAX_CONSTRAINTS_PER_ZONE; ++i) {
51812 ret = create_constraint_attribute(i, "power_limit_uw",
51813 - S_IWUSR | S_IRUGO,
51814 - &constraint_attrs[i].power_limit_attr,
51815 - show_constraint_power_limit_uw,
51816 - store_constraint_power_limit_uw);
51817 + &constraint_attrs[i].power_limit_attr);
51818 if (ret)
51819 goto err_alloc;
51820 ret = create_constraint_attribute(i, "time_window_us",
51821 - S_IWUSR | S_IRUGO,
51822 - &constraint_attrs[i].time_window_attr,
51823 - show_constraint_time_window_us,
51824 - store_constraint_time_window_us);
51825 + &constraint_attrs[i].time_window_attr);
51826 if (ret)
51827 goto err_alloc;
51828 - ret = create_constraint_attribute(i, "name", S_IRUGO,
51829 - &constraint_attrs[i].name_attr,
51830 - show_constraint_name,
51831 - NULL);
51832 + ret = create_constraint_attribute(i, "name",
51833 + &constraint_attrs[i].name_attr);
51834 if (ret)
51835 goto err_alloc;
51836 - ret = create_constraint_attribute(i, "max_power_uw", S_IRUGO,
51837 - &constraint_attrs[i].max_power_attr,
51838 - show_constraint_max_power_uw,
51839 - NULL);
51840 + ret = create_constraint_attribute(i, "max_power_uw",
51841 + &constraint_attrs[i].max_power_attr);
51842 if (ret)
51843 goto err_alloc;
51844 - ret = create_constraint_attribute(i, "min_power_uw", S_IRUGO,
51845 - &constraint_attrs[i].min_power_attr,
51846 - show_constraint_min_power_uw,
51847 - NULL);
51848 + ret = create_constraint_attribute(i, "min_power_uw",
51849 + &constraint_attrs[i].min_power_attr);
51850 if (ret)
51851 goto err_alloc;
51852 ret = create_constraint_attribute(i, "max_time_window_us",
51853 - S_IRUGO,
51854 - &constraint_attrs[i].max_time_window_attr,
51855 - show_constraint_max_time_window_us,
51856 - NULL);
51857 + &constraint_attrs[i].max_time_window_attr);
51858 if (ret)
51859 goto err_alloc;
51860 ret = create_constraint_attribute(i, "min_time_window_us",
51861 - S_IRUGO,
51862 - &constraint_attrs[i].min_time_window_attr,
51863 - show_constraint_min_time_window_us,
51864 - NULL);
51865 + &constraint_attrs[i].min_time_window_attr);
51866 if (ret)
51867 goto err_alloc;
51868
51869 @@ -378,10 +422,12 @@ static void create_power_zone_common_attributes(
51870 power_zone->zone_dev_attrs[count++] =
51871 &dev_attr_max_energy_range_uj.attr;
51872 if (power_zone->ops->get_energy_uj) {
51873 + pax_open_kernel();
51874 if (power_zone->ops->reset_energy_uj)
51875 - dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
51876 + *(umode_t *)&dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
51877 else
51878 - dev_attr_energy_uj.attr.mode = S_IRUGO;
51879 + *(umode_t *)&dev_attr_energy_uj.attr.mode = S_IRUGO;
51880 + pax_close_kernel();
51881 power_zone->zone_dev_attrs[count++] =
51882 &dev_attr_energy_uj.attr;
51883 }
51884 diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
51885 index 9c5d414..c7900ce 100644
51886 --- a/drivers/ptp/ptp_private.h
51887 +++ b/drivers/ptp/ptp_private.h
51888 @@ -51,7 +51,7 @@ struct ptp_clock {
51889 struct mutex pincfg_mux; /* protect concurrent info->pin_config access */
51890 wait_queue_head_t tsev_wq;
51891 int defunct; /* tells readers to go away when clock is being removed */
51892 - struct device_attribute *pin_dev_attr;
51893 + device_attribute_no_const *pin_dev_attr;
51894 struct attribute **pin_attr;
51895 struct attribute_group pin_attr_group;
51896 };
51897 diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
51898 index 302e626..12579af 100644
51899 --- a/drivers/ptp/ptp_sysfs.c
51900 +++ b/drivers/ptp/ptp_sysfs.c
51901 @@ -280,7 +280,7 @@ static int ptp_populate_pins(struct ptp_clock *ptp)
51902 goto no_pin_attr;
51903
51904 for (i = 0; i < n_pins; i++) {
51905 - struct device_attribute *da = &ptp->pin_dev_attr[i];
51906 + device_attribute_no_const *da = &ptp->pin_dev_attr[i];
51907 sysfs_attr_init(&da->attr);
51908 da->attr.name = info->pin_config[i].name;
51909 da->attr.mode = 0644;
51910 diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
51911 index 8a28116..05b0ad5 100644
51912 --- a/drivers/regulator/core.c
51913 +++ b/drivers/regulator/core.c
51914 @@ -3603,7 +3603,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
51915 const struct regulation_constraints *constraints = NULL;
51916 const struct regulator_init_data *init_data;
51917 struct regulator_config *config = NULL;
51918 - static atomic_t regulator_no = ATOMIC_INIT(-1);
51919 + static atomic_unchecked_t regulator_no = ATOMIC_INIT(-1);
51920 struct regulator_dev *rdev;
51921 struct device *dev;
51922 int ret, i;
51923 @@ -3686,7 +3686,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
51924 rdev->dev.class = &regulator_class;
51925 rdev->dev.parent = dev;
51926 dev_set_name(&rdev->dev, "regulator.%lu",
51927 - (unsigned long) atomic_inc_return(&regulator_no));
51928 + (unsigned long) atomic_inc_return_unchecked(&regulator_no));
51929 ret = device_register(&rdev->dev);
51930 if (ret != 0) {
51931 put_device(&rdev->dev);
51932 diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
51933 index 4071d74..260b15a 100644
51934 --- a/drivers/regulator/max8660.c
51935 +++ b/drivers/regulator/max8660.c
51936 @@ -423,8 +423,10 @@ static int max8660_probe(struct i2c_client *client,
51937 max8660->shadow_regs[MAX8660_OVER1] = 5;
51938 } else {
51939 /* Otherwise devices can be toggled via software */
51940 - max8660_dcdc_ops.enable = max8660_dcdc_enable;
51941 - max8660_dcdc_ops.disable = max8660_dcdc_disable;
51942 + pax_open_kernel();
51943 + *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
51944 + *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
51945 + pax_close_kernel();
51946 }
51947
51948 /*
51949 diff --git a/drivers/regulator/max8973-regulator.c b/drivers/regulator/max8973-regulator.c
51950 index c3d55c2..0dddfe6 100644
51951 --- a/drivers/regulator/max8973-regulator.c
51952 +++ b/drivers/regulator/max8973-regulator.c
51953 @@ -403,9 +403,11 @@ static int max8973_probe(struct i2c_client *client,
51954 if (!pdata || !pdata->enable_ext_control) {
51955 max->desc.enable_reg = MAX8973_VOUT;
51956 max->desc.enable_mask = MAX8973_VOUT_ENABLE;
51957 - max->ops.enable = regulator_enable_regmap;
51958 - max->ops.disable = regulator_disable_regmap;
51959 - max->ops.is_enabled = regulator_is_enabled_regmap;
51960 + pax_open_kernel();
51961 + *(void **)&max->ops.enable = regulator_enable_regmap;
51962 + *(void **)&max->ops.disable = regulator_disable_regmap;
51963 + *(void **)&max->ops.is_enabled = regulator_is_enabled_regmap;
51964 + pax_close_kernel();
51965 }
51966
51967 if (pdata) {
51968 diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
51969 index 0d17c92..a29f627 100644
51970 --- a/drivers/regulator/mc13892-regulator.c
51971 +++ b/drivers/regulator/mc13892-regulator.c
51972 @@ -584,10 +584,12 @@ static int mc13892_regulator_probe(struct platform_device *pdev)
51973 mc13xxx_unlock(mc13892);
51974
51975 /* update mc13892_vcam ops */
51976 - memcpy(&mc13892_vcam_ops, mc13892_regulators[MC13892_VCAM].desc.ops,
51977 + pax_open_kernel();
51978 + memcpy((void *)&mc13892_vcam_ops, mc13892_regulators[MC13892_VCAM].desc.ops,
51979 sizeof(struct regulator_ops));
51980 - mc13892_vcam_ops.set_mode = mc13892_vcam_set_mode,
51981 - mc13892_vcam_ops.get_mode = mc13892_vcam_get_mode,
51982 + *(void **)&mc13892_vcam_ops.set_mode = mc13892_vcam_set_mode,
51983 + *(void **)&mc13892_vcam_ops.get_mode = mc13892_vcam_get_mode,
51984 + pax_close_kernel();
51985 mc13892_regulators[MC13892_VCAM].desc.ops = &mc13892_vcam_ops;
51986
51987 mc13xxx_data = mc13xxx_parse_regulators_dt(pdev, mc13892_regulators,
51988 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
51989 index a82556a0..e842923 100644
51990 --- a/drivers/rtc/rtc-cmos.c
51991 +++ b/drivers/rtc/rtc-cmos.c
51992 @@ -793,7 +793,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
51993 hpet_rtc_timer_init();
51994
51995 /* export at least the first block of NVRAM */
51996 - nvram.size = address_space - NVRAM_OFFSET;
51997 + pax_open_kernel();
51998 + *(size_t *)&nvram.size = address_space - NVRAM_OFFSET;
51999 + pax_close_kernel();
52000 retval = sysfs_create_bin_file(&dev->kobj, &nvram);
52001 if (retval < 0) {
52002 dev_dbg(dev, "can't create nvram file? %d\n", retval);
52003 diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
52004 index 799c34b..8e9786a 100644
52005 --- a/drivers/rtc/rtc-dev.c
52006 +++ b/drivers/rtc/rtc-dev.c
52007 @@ -16,6 +16,7 @@
52008 #include <linux/module.h>
52009 #include <linux/rtc.h>
52010 #include <linux/sched.h>
52011 +#include <linux/grsecurity.h>
52012 #include "rtc-core.h"
52013
52014 static dev_t rtc_devt;
52015 @@ -347,6 +348,8 @@ static long rtc_dev_ioctl(struct file *file,
52016 if (copy_from_user(&tm, uarg, sizeof(tm)))
52017 return -EFAULT;
52018
52019 + gr_log_timechange();
52020 +
52021 return rtc_set_time(rtc, &tm);
52022
52023 case RTC_PIE_ON:
52024 diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
52025 index 4ffabb3..1f87fca 100644
52026 --- a/drivers/rtc/rtc-ds1307.c
52027 +++ b/drivers/rtc/rtc-ds1307.c
52028 @@ -107,7 +107,7 @@ struct ds1307 {
52029 u8 offset; /* register's offset */
52030 u8 regs[11];
52031 u16 nvram_offset;
52032 - struct bin_attribute *nvram;
52033 + bin_attribute_no_const *nvram;
52034 enum ds_type type;
52035 unsigned long flags;
52036 #define HAS_NVRAM 0 /* bit 0 == sysfs file active */
52037 diff --git a/drivers/rtc/rtc-m48t59.c b/drivers/rtc/rtc-m48t59.c
52038 index 90abb5b..e0bf6dd 100644
52039 --- a/drivers/rtc/rtc-m48t59.c
52040 +++ b/drivers/rtc/rtc-m48t59.c
52041 @@ -483,7 +483,9 @@ static int m48t59_rtc_probe(struct platform_device *pdev)
52042 if (IS_ERR(m48t59->rtc))
52043 return PTR_ERR(m48t59->rtc);
52044
52045 - m48t59_nvram_attr.size = pdata->offset;
52046 + pax_open_kernel();
52047 + *(size_t *)&m48t59_nvram_attr.size = pdata->offset;
52048 + pax_close_kernel();
52049
52050 ret = sysfs_create_bin_file(&pdev->dev.kobj, &m48t59_nvram_attr);
52051 if (ret)
52052 diff --git a/drivers/rtc/rtc-test.c b/drivers/rtc/rtc-test.c
52053 index 3a2da4c..e88493c 100644
52054 --- a/drivers/rtc/rtc-test.c
52055 +++ b/drivers/rtc/rtc-test.c
52056 @@ -112,8 +112,10 @@ static int test_probe(struct platform_device *plat_dev)
52057 struct rtc_device *rtc;
52058
52059 if (test_mmss64) {
52060 - test_rtc_ops.set_mmss64 = test_rtc_set_mmss64;
52061 - test_rtc_ops.set_mmss = NULL;
52062 + pax_open_kernel();
52063 + *(void **)&test_rtc_ops.set_mmss64 = test_rtc_set_mmss64;
52064 + *(void **)&test_rtc_ops.set_mmss = NULL;
52065 + pax_close_kernel();
52066 }
52067
52068 rtc = devm_rtc_device_register(&plat_dev->dev, "test",
52069 diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
52070 index e693af6..2e525b6 100644
52071 --- a/drivers/scsi/bfa/bfa_fcpim.h
52072 +++ b/drivers/scsi/bfa/bfa_fcpim.h
52073 @@ -36,7 +36,7 @@ struct bfa_iotag_s {
52074
52075 struct bfa_itn_s {
52076 bfa_isr_func_t isr;
52077 -};
52078 +} __no_const;
52079
52080 void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
52081 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
52082 diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c
52083 index 0f19455..ef7adb5 100644
52084 --- a/drivers/scsi/bfa/bfa_fcs.c
52085 +++ b/drivers/scsi/bfa/bfa_fcs.c
52086 @@ -38,10 +38,21 @@ struct bfa_fcs_mod_s {
52087 #define BFA_FCS_MODULE(_mod) { _mod ## _modinit, _mod ## _modexit }
52088
52089 static struct bfa_fcs_mod_s fcs_modules[] = {
52090 - { bfa_fcs_port_attach, NULL, NULL },
52091 - { bfa_fcs_uf_attach, NULL, NULL },
52092 - { bfa_fcs_fabric_attach, bfa_fcs_fabric_modinit,
52093 - bfa_fcs_fabric_modexit },
52094 + {
52095 + .attach = bfa_fcs_port_attach,
52096 + .modinit = NULL,
52097 + .modexit = NULL
52098 + },
52099 + {
52100 + .attach = bfa_fcs_uf_attach,
52101 + .modinit = NULL,
52102 + .modexit = NULL
52103 + },
52104 + {
52105 + .attach = bfa_fcs_fabric_attach,
52106 + .modinit = bfa_fcs_fabric_modinit,
52107 + .modexit = bfa_fcs_fabric_modexit
52108 + },
52109 };
52110
52111 /*
52112 diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
52113 index ff75ef8..2dfe00a 100644
52114 --- a/drivers/scsi/bfa/bfa_fcs_lport.c
52115 +++ b/drivers/scsi/bfa/bfa_fcs_lport.c
52116 @@ -89,15 +89,26 @@ static struct {
52117 void (*offline) (struct bfa_fcs_lport_s *port);
52118 } __port_action[] = {
52119 {
52120 - bfa_fcs_lport_unknown_init, bfa_fcs_lport_unknown_online,
52121 - bfa_fcs_lport_unknown_offline}, {
52122 - bfa_fcs_lport_fab_init, bfa_fcs_lport_fab_online,
52123 - bfa_fcs_lport_fab_offline}, {
52124 - bfa_fcs_lport_n2n_init, bfa_fcs_lport_n2n_online,
52125 - bfa_fcs_lport_n2n_offline}, {
52126 - bfa_fcs_lport_loop_init, bfa_fcs_lport_loop_online,
52127 - bfa_fcs_lport_loop_offline},
52128 - };
52129 + .init = bfa_fcs_lport_unknown_init,
52130 + .online = bfa_fcs_lport_unknown_online,
52131 + .offline = bfa_fcs_lport_unknown_offline
52132 + },
52133 + {
52134 + .init = bfa_fcs_lport_fab_init,
52135 + .online = bfa_fcs_lport_fab_online,
52136 + .offline = bfa_fcs_lport_fab_offline
52137 + },
52138 + {
52139 + .init = bfa_fcs_lport_n2n_init,
52140 + .online = bfa_fcs_lport_n2n_online,
52141 + .offline = bfa_fcs_lport_n2n_offline
52142 + },
52143 + {
52144 + .init = bfa_fcs_lport_loop_init,
52145 + .online = bfa_fcs_lport_loop_online,
52146 + .offline = bfa_fcs_lport_loop_offline
52147 + },
52148 +};
52149
52150 /*
52151 * fcs_port_sm FCS logical port state machine
52152 diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
52153 index a38aafa0..fe8f03b 100644
52154 --- a/drivers/scsi/bfa/bfa_ioc.h
52155 +++ b/drivers/scsi/bfa/bfa_ioc.h
52156 @@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
52157 bfa_ioc_disable_cbfn_t disable_cbfn;
52158 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
52159 bfa_ioc_reset_cbfn_t reset_cbfn;
52160 -};
52161 +} __no_const;
52162
52163 /*
52164 * IOC event notification mechanism.
52165 @@ -352,7 +352,7 @@ struct bfa_ioc_hwif_s {
52166 void (*ioc_set_alt_fwstate) (struct bfa_ioc_s *ioc,
52167 enum bfi_ioc_state fwstate);
52168 enum bfi_ioc_state (*ioc_get_alt_fwstate) (struct bfa_ioc_s *ioc);
52169 -};
52170 +} __no_const;
52171
52172 /*
52173 * Queue element to wait for room in request queue. FIFO order is
52174 diff --git a/drivers/scsi/bfa/bfa_modules.h b/drivers/scsi/bfa/bfa_modules.h
52175 index a14c784..6de6790 100644
52176 --- a/drivers/scsi/bfa/bfa_modules.h
52177 +++ b/drivers/scsi/bfa/bfa_modules.h
52178 @@ -78,12 +78,12 @@ enum {
52179 \
52180 extern struct bfa_module_s hal_mod_ ## __mod; \
52181 struct bfa_module_s hal_mod_ ## __mod = { \
52182 - bfa_ ## __mod ## _meminfo, \
52183 - bfa_ ## __mod ## _attach, \
52184 - bfa_ ## __mod ## _detach, \
52185 - bfa_ ## __mod ## _start, \
52186 - bfa_ ## __mod ## _stop, \
52187 - bfa_ ## __mod ## _iocdisable, \
52188 + .meminfo = bfa_ ## __mod ## _meminfo, \
52189 + .attach = bfa_ ## __mod ## _attach, \
52190 + .detach = bfa_ ## __mod ## _detach, \
52191 + .start = bfa_ ## __mod ## _start, \
52192 + .stop = bfa_ ## __mod ## _stop, \
52193 + .iocdisable = bfa_ ## __mod ## _iocdisable, \
52194 }
52195
52196 #define BFA_CACHELINE_SZ (256)
52197 diff --git a/drivers/scsi/fcoe/fcoe_sysfs.c b/drivers/scsi/fcoe/fcoe_sysfs.c
52198 index 045c4e1..13de803 100644
52199 --- a/drivers/scsi/fcoe/fcoe_sysfs.c
52200 +++ b/drivers/scsi/fcoe/fcoe_sysfs.c
52201 @@ -33,8 +33,8 @@
52202 */
52203 #include "libfcoe.h"
52204
52205 -static atomic_t ctlr_num;
52206 -static atomic_t fcf_num;
52207 +static atomic_unchecked_t ctlr_num;
52208 +static atomic_unchecked_t fcf_num;
52209
52210 /*
52211 * fcoe_fcf_dev_loss_tmo: the default number of seconds that fcoe sysfs
52212 @@ -685,7 +685,7 @@ struct fcoe_ctlr_device *fcoe_ctlr_device_add(struct device *parent,
52213 if (!ctlr)
52214 goto out;
52215
52216 - ctlr->id = atomic_inc_return(&ctlr_num) - 1;
52217 + ctlr->id = atomic_inc_return_unchecked(&ctlr_num) - 1;
52218 ctlr->f = f;
52219 ctlr->mode = FIP_CONN_TYPE_FABRIC;
52220 INIT_LIST_HEAD(&ctlr->fcfs);
52221 @@ -902,7 +902,7 @@ struct fcoe_fcf_device *fcoe_fcf_device_add(struct fcoe_ctlr_device *ctlr,
52222 fcf->dev.parent = &ctlr->dev;
52223 fcf->dev.bus = &fcoe_bus_type;
52224 fcf->dev.type = &fcoe_fcf_device_type;
52225 - fcf->id = atomic_inc_return(&fcf_num) - 1;
52226 + fcf->id = atomic_inc_return_unchecked(&fcf_num) - 1;
52227 fcf->state = FCOE_FCF_STATE_UNKNOWN;
52228
52229 fcf->dev_loss_tmo = ctlr->fcf_dev_loss_tmo;
52230 @@ -938,8 +938,8 @@ int __init fcoe_sysfs_setup(void)
52231 {
52232 int error;
52233
52234 - atomic_set(&ctlr_num, 0);
52235 - atomic_set(&fcf_num, 0);
52236 + atomic_set_unchecked(&ctlr_num, 0);
52237 + atomic_set_unchecked(&fcf_num, 0);
52238
52239 error = bus_register(&fcoe_bus_type);
52240 if (error)
52241 diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
52242 index 8bb173e..20236b4 100644
52243 --- a/drivers/scsi/hosts.c
52244 +++ b/drivers/scsi/hosts.c
52245 @@ -42,7 +42,7 @@
52246 #include "scsi_logging.h"
52247
52248
52249 -static atomic_t scsi_host_next_hn = ATOMIC_INIT(0); /* host_no for next new host */
52250 +static atomic_unchecked_t scsi_host_next_hn = ATOMIC_INIT(0); /* host_no for next new host */
52251
52252
52253 static void scsi_host_cls_release(struct device *dev)
52254 @@ -392,7 +392,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
52255 * subtract one because we increment first then return, but we need to
52256 * know what the next host number was before increment
52257 */
52258 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
52259 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
52260 shost->dma_channel = 0xff;
52261
52262 /* These three are default values which can be overridden */
52263 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
52264 index 8eab107..599cd79 100644
52265 --- a/drivers/scsi/hpsa.c
52266 +++ b/drivers/scsi/hpsa.c
52267 @@ -697,10 +697,10 @@ static inline u32 next_command(struct ctlr_info *h, u8 q)
52268 struct reply_queue_buffer *rq = &h->reply_queue[q];
52269
52270 if (h->transMethod & CFGTBL_Trans_io_accel1)
52271 - return h->access.command_completed(h, q);
52272 + return h->access->command_completed(h, q);
52273
52274 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
52275 - return h->access.command_completed(h, q);
52276 + return h->access->command_completed(h, q);
52277
52278 if ((rq->head[rq->current_entry] & 1) == rq->wraparound) {
52279 a = rq->head[rq->current_entry];
52280 @@ -837,7 +837,7 @@ static void enqueue_cmd_and_start_io(struct ctlr_info *h,
52281 break;
52282 default:
52283 set_performant_mode(h, c);
52284 - h->access.submit_command(h, c);
52285 + h->access->submit_command(h, c);
52286 }
52287 }
52288
52289 @@ -5369,17 +5369,17 @@ static void __iomem *remap_pci_mem(ulong base, ulong size)
52290
52291 static inline unsigned long get_next_completion(struct ctlr_info *h, u8 q)
52292 {
52293 - return h->access.command_completed(h, q);
52294 + return h->access->command_completed(h, q);
52295 }
52296
52297 static inline bool interrupt_pending(struct ctlr_info *h)
52298 {
52299 - return h->access.intr_pending(h);
52300 + return h->access->intr_pending(h);
52301 }
52302
52303 static inline long interrupt_not_for_us(struct ctlr_info *h)
52304 {
52305 - return (h->access.intr_pending(h) == 0) ||
52306 + return (h->access->intr_pending(h) == 0) ||
52307 (h->interrupts_enabled == 0);
52308 }
52309
52310 @@ -6270,7 +6270,7 @@ static int hpsa_pci_init(struct ctlr_info *h)
52311 if (prod_index < 0)
52312 return prod_index;
52313 h->product_name = products[prod_index].product_name;
52314 - h->access = *(products[prod_index].access);
52315 + h->access = products[prod_index].access;
52316
52317 pci_disable_link_state(h->pdev, PCIE_LINK_STATE_L0S |
52318 PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
52319 @@ -6647,7 +6647,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
52320 unsigned long flags;
52321 u32 lockup_detected;
52322
52323 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
52324 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
52325 spin_lock_irqsave(&h->lock, flags);
52326 lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
52327 if (!lockup_detected) {
52328 @@ -6922,7 +6922,7 @@ reinit_after_soft_reset:
52329 }
52330
52331 /* make sure the board interrupts are off */
52332 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
52333 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
52334
52335 if (hpsa_request_irqs(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
52336 goto clean2;
52337 @@ -6958,7 +6958,7 @@ reinit_after_soft_reset:
52338 * fake ones to scoop up any residual completions.
52339 */
52340 spin_lock_irqsave(&h->lock, flags);
52341 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
52342 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
52343 spin_unlock_irqrestore(&h->lock, flags);
52344 hpsa_free_irqs(h);
52345 rc = hpsa_request_irqs(h, hpsa_msix_discard_completions,
52346 @@ -6977,9 +6977,9 @@ reinit_after_soft_reset:
52347 dev_info(&h->pdev->dev, "Board READY.\n");
52348 dev_info(&h->pdev->dev,
52349 "Waiting for stale completions to drain.\n");
52350 - h->access.set_intr_mask(h, HPSA_INTR_ON);
52351 + h->access->set_intr_mask(h, HPSA_INTR_ON);
52352 msleep(10000);
52353 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
52354 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
52355
52356 rc = controller_reset_failed(h->cfgtable);
52357 if (rc)
52358 @@ -7004,7 +7004,7 @@ reinit_after_soft_reset:
52359
52360
52361 /* Turn the interrupts on so we can service requests */
52362 - h->access.set_intr_mask(h, HPSA_INTR_ON);
52363 + h->access->set_intr_mask(h, HPSA_INTR_ON);
52364
52365 hpsa_hba_inquiry(h);
52366 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
52367 @@ -7077,7 +7077,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
52368 * To write all data in the battery backed cache to disks
52369 */
52370 hpsa_flush_cache(h);
52371 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
52372 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
52373 hpsa_free_irqs_and_disable_msix(h);
52374 }
52375
52376 @@ -7198,7 +7198,7 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support)
52377 CFGTBL_Trans_enable_directed_msix |
52378 (trans_support & (CFGTBL_Trans_io_accel1 |
52379 CFGTBL_Trans_io_accel2));
52380 - struct access_method access = SA5_performant_access;
52381 + struct access_method *access = &SA5_performant_access;
52382
52383 /* This is a bit complicated. There are 8 registers on
52384 * the controller which we write to to tell it 8 different
52385 @@ -7240,7 +7240,7 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support)
52386 * perform the superfluous readl() after each command submission.
52387 */
52388 if (trans_support & (CFGTBL_Trans_io_accel1 | CFGTBL_Trans_io_accel2))
52389 - access = SA5_performant_access_no_read;
52390 + access = &SA5_performant_access_no_read;
52391
52392 /* Controller spec: zero out this buffer. */
52393 for (i = 0; i < h->nreply_queues; i++)
52394 @@ -7270,12 +7270,12 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support)
52395 * enable outbound interrupt coalescing in accelerator mode;
52396 */
52397 if (trans_support & CFGTBL_Trans_io_accel1) {
52398 - access = SA5_ioaccel_mode1_access;
52399 + access = &SA5_ioaccel_mode1_access;
52400 writel(10, &h->cfgtable->HostWrite.CoalIntDelay);
52401 writel(4, &h->cfgtable->HostWrite.CoalIntCount);
52402 } else {
52403 if (trans_support & CFGTBL_Trans_io_accel2) {
52404 - access = SA5_ioaccel_mode2_access;
52405 + access = &SA5_ioaccel_mode2_access;
52406 writel(10, &h->cfgtable->HostWrite.CoalIntDelay);
52407 writel(4, &h->cfgtable->HostWrite.CoalIntCount);
52408 }
52409 diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
52410 index 6577130..955f9a4 100644
52411 --- a/drivers/scsi/hpsa.h
52412 +++ b/drivers/scsi/hpsa.h
52413 @@ -143,7 +143,7 @@ struct ctlr_info {
52414 unsigned int msix_vector;
52415 unsigned int msi_vector;
52416 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
52417 - struct access_method access;
52418 + struct access_method *access;
52419 char hba_mode_enabled;
52420
52421 /* queue and queue Info */
52422 @@ -525,38 +525,38 @@ static unsigned long SA5_ioaccel_mode1_completed(struct ctlr_info *h, u8 q)
52423 }
52424
52425 static struct access_method SA5_access = {
52426 - SA5_submit_command,
52427 - SA5_intr_mask,
52428 - SA5_intr_pending,
52429 - SA5_completed,
52430 + .submit_command = SA5_submit_command,
52431 + .set_intr_mask = SA5_intr_mask,
52432 + .intr_pending = SA5_intr_pending,
52433 + .command_completed = SA5_completed,
52434 };
52435
52436 static struct access_method SA5_ioaccel_mode1_access = {
52437 - SA5_submit_command,
52438 - SA5_performant_intr_mask,
52439 - SA5_ioaccel_mode1_intr_pending,
52440 - SA5_ioaccel_mode1_completed,
52441 + .submit_command = SA5_submit_command,
52442 + .set_intr_mask = SA5_performant_intr_mask,
52443 + .intr_pending = SA5_ioaccel_mode1_intr_pending,
52444 + .command_completed = SA5_ioaccel_mode1_completed,
52445 };
52446
52447 static struct access_method SA5_ioaccel_mode2_access = {
52448 - SA5_submit_command_ioaccel2,
52449 - SA5_performant_intr_mask,
52450 - SA5_performant_intr_pending,
52451 - SA5_performant_completed,
52452 + .submit_command = SA5_submit_command_ioaccel2,
52453 + .set_intr_mask = SA5_performant_intr_mask,
52454 + .intr_pending = SA5_performant_intr_pending,
52455 + .command_completed = SA5_performant_completed,
52456 };
52457
52458 static struct access_method SA5_performant_access = {
52459 - SA5_submit_command,
52460 - SA5_performant_intr_mask,
52461 - SA5_performant_intr_pending,
52462 - SA5_performant_completed,
52463 + .submit_command = SA5_submit_command,
52464 + .set_intr_mask = SA5_performant_intr_mask,
52465 + .intr_pending = SA5_performant_intr_pending,
52466 + .command_completed = SA5_performant_completed,
52467 };
52468
52469 static struct access_method SA5_performant_access_no_read = {
52470 - SA5_submit_command_no_read,
52471 - SA5_performant_intr_mask,
52472 - SA5_performant_intr_pending,
52473 - SA5_performant_completed,
52474 + .submit_command = SA5_submit_command_no_read,
52475 + .set_intr_mask = SA5_performant_intr_mask,
52476 + .intr_pending = SA5_performant_intr_pending,
52477 + .command_completed = SA5_performant_completed,
52478 };
52479
52480 struct board_type {
52481 diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
52482 index 1b3a094..068e683 100644
52483 --- a/drivers/scsi/libfc/fc_exch.c
52484 +++ b/drivers/scsi/libfc/fc_exch.c
52485 @@ -101,12 +101,12 @@ struct fc_exch_mgr {
52486 u16 pool_max_index;
52487
52488 struct {
52489 - atomic_t no_free_exch;
52490 - atomic_t no_free_exch_xid;
52491 - atomic_t xid_not_found;
52492 - atomic_t xid_busy;
52493 - atomic_t seq_not_found;
52494 - atomic_t non_bls_resp;
52495 + atomic_unchecked_t no_free_exch;
52496 + atomic_unchecked_t no_free_exch_xid;
52497 + atomic_unchecked_t xid_not_found;
52498 + atomic_unchecked_t xid_busy;
52499 + atomic_unchecked_t seq_not_found;
52500 + atomic_unchecked_t non_bls_resp;
52501 } stats;
52502 };
52503
52504 @@ -811,7 +811,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
52505 /* allocate memory for exchange */
52506 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
52507 if (!ep) {
52508 - atomic_inc(&mp->stats.no_free_exch);
52509 + atomic_inc_unchecked(&mp->stats.no_free_exch);
52510 goto out;
52511 }
52512 memset(ep, 0, sizeof(*ep));
52513 @@ -874,7 +874,7 @@ out:
52514 return ep;
52515 err:
52516 spin_unlock_bh(&pool->lock);
52517 - atomic_inc(&mp->stats.no_free_exch_xid);
52518 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
52519 mempool_free(ep, mp->ep_pool);
52520 return NULL;
52521 }
52522 @@ -1023,7 +1023,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
52523 xid = ntohs(fh->fh_ox_id); /* we originated exch */
52524 ep = fc_exch_find(mp, xid);
52525 if (!ep) {
52526 - atomic_inc(&mp->stats.xid_not_found);
52527 + atomic_inc_unchecked(&mp->stats.xid_not_found);
52528 reject = FC_RJT_OX_ID;
52529 goto out;
52530 }
52531 @@ -1053,7 +1053,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
52532 ep = fc_exch_find(mp, xid);
52533 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
52534 if (ep) {
52535 - atomic_inc(&mp->stats.xid_busy);
52536 + atomic_inc_unchecked(&mp->stats.xid_busy);
52537 reject = FC_RJT_RX_ID;
52538 goto rel;
52539 }
52540 @@ -1064,7 +1064,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
52541 }
52542 xid = ep->xid; /* get our XID */
52543 } else if (!ep) {
52544 - atomic_inc(&mp->stats.xid_not_found);
52545 + atomic_inc_unchecked(&mp->stats.xid_not_found);
52546 reject = FC_RJT_RX_ID; /* XID not found */
52547 goto out;
52548 }
52549 @@ -1082,7 +1082,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
52550 } else {
52551 sp = &ep->seq;
52552 if (sp->id != fh->fh_seq_id) {
52553 - atomic_inc(&mp->stats.seq_not_found);
52554 + atomic_inc_unchecked(&mp->stats.seq_not_found);
52555 if (f_ctl & FC_FC_END_SEQ) {
52556 /*
52557 * Update sequence_id based on incoming last
52558 @@ -1533,22 +1533,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
52559
52560 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
52561 if (!ep) {
52562 - atomic_inc(&mp->stats.xid_not_found);
52563 + atomic_inc_unchecked(&mp->stats.xid_not_found);
52564 goto out;
52565 }
52566 if (ep->esb_stat & ESB_ST_COMPLETE) {
52567 - atomic_inc(&mp->stats.xid_not_found);
52568 + atomic_inc_unchecked(&mp->stats.xid_not_found);
52569 goto rel;
52570 }
52571 if (ep->rxid == FC_XID_UNKNOWN)
52572 ep->rxid = ntohs(fh->fh_rx_id);
52573 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
52574 - atomic_inc(&mp->stats.xid_not_found);
52575 + atomic_inc_unchecked(&mp->stats.xid_not_found);
52576 goto rel;
52577 }
52578 if (ep->did != ntoh24(fh->fh_s_id) &&
52579 ep->did != FC_FID_FLOGI) {
52580 - atomic_inc(&mp->stats.xid_not_found);
52581 + atomic_inc_unchecked(&mp->stats.xid_not_found);
52582 goto rel;
52583 }
52584 sof = fr_sof(fp);
52585 @@ -1557,7 +1557,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
52586 sp->ssb_stat |= SSB_ST_RESP;
52587 sp->id = fh->fh_seq_id;
52588 } else if (sp->id != fh->fh_seq_id) {
52589 - atomic_inc(&mp->stats.seq_not_found);
52590 + atomic_inc_unchecked(&mp->stats.seq_not_found);
52591 goto rel;
52592 }
52593
52594 @@ -1619,9 +1619,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
52595 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
52596
52597 if (!sp)
52598 - atomic_inc(&mp->stats.xid_not_found);
52599 + atomic_inc_unchecked(&mp->stats.xid_not_found);
52600 else
52601 - atomic_inc(&mp->stats.non_bls_resp);
52602 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
52603
52604 fc_frame_free(fp);
52605 }
52606 @@ -2261,13 +2261,13 @@ void fc_exch_update_stats(struct fc_lport *lport)
52607
52608 list_for_each_entry(ema, &lport->ema_list, ema_list) {
52609 mp = ema->mp;
52610 - st->fc_no_free_exch += atomic_read(&mp->stats.no_free_exch);
52611 + st->fc_no_free_exch += atomic_read_unchecked(&mp->stats.no_free_exch);
52612 st->fc_no_free_exch_xid +=
52613 - atomic_read(&mp->stats.no_free_exch_xid);
52614 - st->fc_xid_not_found += atomic_read(&mp->stats.xid_not_found);
52615 - st->fc_xid_busy += atomic_read(&mp->stats.xid_busy);
52616 - st->fc_seq_not_found += atomic_read(&mp->stats.seq_not_found);
52617 - st->fc_non_bls_resp += atomic_read(&mp->stats.non_bls_resp);
52618 + atomic_read_unchecked(&mp->stats.no_free_exch_xid);
52619 + st->fc_xid_not_found += atomic_read_unchecked(&mp->stats.xid_not_found);
52620 + st->fc_xid_busy += atomic_read_unchecked(&mp->stats.xid_busy);
52621 + st->fc_seq_not_found += atomic_read_unchecked(&mp->stats.seq_not_found);
52622 + st->fc_non_bls_resp += atomic_read_unchecked(&mp->stats.non_bls_resp);
52623 }
52624 }
52625 EXPORT_SYMBOL(fc_exch_update_stats);
52626 diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
52627 index 9c706d8..d3e3ed2 100644
52628 --- a/drivers/scsi/libsas/sas_ata.c
52629 +++ b/drivers/scsi/libsas/sas_ata.c
52630 @@ -535,7 +535,7 @@ static struct ata_port_operations sas_sata_ops = {
52631 .postreset = ata_std_postreset,
52632 .error_handler = ata_std_error_handler,
52633 .post_internal_cmd = sas_ata_post_internal,
52634 - .qc_defer = ata_std_qc_defer,
52635 + .qc_defer = ata_std_qc_defer,
52636 .qc_prep = ata_noop_qc_prep,
52637 .qc_issue = sas_ata_qc_issue,
52638 .qc_fill_rtf = sas_ata_qc_fill_rtf,
52639 diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
52640 index 9b81a34..a9b7b8c 100644
52641 --- a/drivers/scsi/lpfc/lpfc.h
52642 +++ b/drivers/scsi/lpfc/lpfc.h
52643 @@ -433,7 +433,7 @@ struct lpfc_vport {
52644 struct dentry *debug_nodelist;
52645 struct dentry *vport_debugfs_root;
52646 struct lpfc_debugfs_trc *disc_trc;
52647 - atomic_t disc_trc_cnt;
52648 + atomic_unchecked_t disc_trc_cnt;
52649 #endif
52650 uint8_t stat_data_enabled;
52651 uint8_t stat_data_blocked;
52652 @@ -883,8 +883,8 @@ struct lpfc_hba {
52653 struct timer_list fabric_block_timer;
52654 unsigned long bit_flags;
52655 #define FABRIC_COMANDS_BLOCKED 0
52656 - atomic_t num_rsrc_err;
52657 - atomic_t num_cmd_success;
52658 + atomic_unchecked_t num_rsrc_err;
52659 + atomic_unchecked_t num_cmd_success;
52660 unsigned long last_rsrc_error_time;
52661 unsigned long last_ramp_down_time;
52662 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
52663 @@ -919,7 +919,7 @@ struct lpfc_hba {
52664
52665 struct dentry *debug_slow_ring_trc;
52666 struct lpfc_debugfs_trc *slow_ring_trc;
52667 - atomic_t slow_ring_trc_cnt;
52668 + atomic_unchecked_t slow_ring_trc_cnt;
52669 /* iDiag debugfs sub-directory */
52670 struct dentry *idiag_root;
52671 struct dentry *idiag_pci_cfg;
52672 diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
52673 index 513edcb..805c6a8 100644
52674 --- a/drivers/scsi/lpfc/lpfc_debugfs.c
52675 +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
52676 @@ -106,7 +106,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
52677
52678 #include <linux/debugfs.h>
52679
52680 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
52681 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
52682 static unsigned long lpfc_debugfs_start_time = 0L;
52683
52684 /* iDiag */
52685 @@ -147,7 +147,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
52686 lpfc_debugfs_enable = 0;
52687
52688 len = 0;
52689 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
52690 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
52691 (lpfc_debugfs_max_disc_trc - 1);
52692 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
52693 dtp = vport->disc_trc + i;
52694 @@ -213,7 +213,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
52695 lpfc_debugfs_enable = 0;
52696
52697 len = 0;
52698 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
52699 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
52700 (lpfc_debugfs_max_slow_ring_trc - 1);
52701 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
52702 dtp = phba->slow_ring_trc + i;
52703 @@ -646,14 +646,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
52704 !vport || !vport->disc_trc)
52705 return;
52706
52707 - index = atomic_inc_return(&vport->disc_trc_cnt) &
52708 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
52709 (lpfc_debugfs_max_disc_trc - 1);
52710 dtp = vport->disc_trc + index;
52711 dtp->fmt = fmt;
52712 dtp->data1 = data1;
52713 dtp->data2 = data2;
52714 dtp->data3 = data3;
52715 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
52716 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
52717 dtp->jif = jiffies;
52718 #endif
52719 return;
52720 @@ -684,14 +684,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
52721 !phba || !phba->slow_ring_trc)
52722 return;
52723
52724 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
52725 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
52726 (lpfc_debugfs_max_slow_ring_trc - 1);
52727 dtp = phba->slow_ring_trc + index;
52728 dtp->fmt = fmt;
52729 dtp->data1 = data1;
52730 dtp->data2 = data2;
52731 dtp->data3 = data3;
52732 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
52733 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
52734 dtp->jif = jiffies;
52735 #endif
52736 return;
52737 @@ -4268,7 +4268,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
52738 "slow_ring buffer\n");
52739 goto debug_failed;
52740 }
52741 - atomic_set(&phba->slow_ring_trc_cnt, 0);
52742 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
52743 memset(phba->slow_ring_trc, 0,
52744 (sizeof(struct lpfc_debugfs_trc) *
52745 lpfc_debugfs_max_slow_ring_trc));
52746 @@ -4314,7 +4314,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
52747 "buffer\n");
52748 goto debug_failed;
52749 }
52750 - atomic_set(&vport->disc_trc_cnt, 0);
52751 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
52752
52753 snprintf(name, sizeof(name), "discovery_trace");
52754 vport->debug_disc_trc =
52755 diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
52756 index e8c8c1e..5f2e11c 100644
52757 --- a/drivers/scsi/lpfc/lpfc_init.c
52758 +++ b/drivers/scsi/lpfc/lpfc_init.c
52759 @@ -11406,8 +11406,10 @@ lpfc_init(void)
52760 "misc_register returned with status %d", error);
52761
52762 if (lpfc_enable_npiv) {
52763 - lpfc_transport_functions.vport_create = lpfc_vport_create;
52764 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
52765 + pax_open_kernel();
52766 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
52767 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
52768 + pax_close_kernel();
52769 }
52770 lpfc_transport_template =
52771 fc_attach_transport(&lpfc_transport_functions);
52772 diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
52773 index c140f99..11b2505 100644
52774 --- a/drivers/scsi/lpfc/lpfc_scsi.c
52775 +++ b/drivers/scsi/lpfc/lpfc_scsi.c
52776 @@ -261,7 +261,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
52777 unsigned long expires;
52778
52779 spin_lock_irqsave(&phba->hbalock, flags);
52780 - atomic_inc(&phba->num_rsrc_err);
52781 + atomic_inc_unchecked(&phba->num_rsrc_err);
52782 phba->last_rsrc_error_time = jiffies;
52783
52784 expires = phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL;
52785 @@ -303,8 +303,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
52786 unsigned long num_rsrc_err, num_cmd_success;
52787 int i;
52788
52789 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
52790 - num_cmd_success = atomic_read(&phba->num_cmd_success);
52791 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
52792 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
52793
52794 /*
52795 * The error and success command counters are global per
52796 @@ -331,8 +331,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
52797 }
52798 }
52799 lpfc_destroy_vport_work_array(phba, vports);
52800 - atomic_set(&phba->num_rsrc_err, 0);
52801 - atomic_set(&phba->num_cmd_success, 0);
52802 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
52803 + atomic_set_unchecked(&phba->num_cmd_success, 0);
52804 }
52805
52806 /**
52807 diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
52808 index 3f26147..ee8efd1 100644
52809 --- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
52810 +++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
52811 @@ -1509,7 +1509,7 @@ _scsih_get_resync(struct device *dev)
52812 {
52813 struct scsi_device *sdev = to_scsi_device(dev);
52814 struct MPT2SAS_ADAPTER *ioc = shost_priv(sdev->host);
52815 - static struct _raid_device *raid_device;
52816 + struct _raid_device *raid_device;
52817 unsigned long flags;
52818 Mpi2RaidVolPage0_t vol_pg0;
52819 Mpi2ConfigReply_t mpi_reply;
52820 @@ -1561,7 +1561,7 @@ _scsih_get_state(struct device *dev)
52821 {
52822 struct scsi_device *sdev = to_scsi_device(dev);
52823 struct MPT2SAS_ADAPTER *ioc = shost_priv(sdev->host);
52824 - static struct _raid_device *raid_device;
52825 + struct _raid_device *raid_device;
52826 unsigned long flags;
52827 Mpi2RaidVolPage0_t vol_pg0;
52828 Mpi2ConfigReply_t mpi_reply;
52829 @@ -6641,7 +6641,7 @@ _scsih_sas_ir_operation_status_event(struct MPT2SAS_ADAPTER *ioc,
52830 Mpi2EventDataIrOperationStatus_t *event_data =
52831 (Mpi2EventDataIrOperationStatus_t *)
52832 fw_event->event_data;
52833 - static struct _raid_device *raid_device;
52834 + struct _raid_device *raid_device;
52835 unsigned long flags;
52836 u16 handle;
52837
52838 @@ -7112,7 +7112,7 @@ _scsih_scan_for_devices_after_reset(struct MPT2SAS_ADAPTER *ioc)
52839 u64 sas_address;
52840 struct _sas_device *sas_device;
52841 struct _sas_node *expander_device;
52842 - static struct _raid_device *raid_device;
52843 + struct _raid_device *raid_device;
52844 u8 retry_count;
52845 unsigned long flags;
52846
52847 diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
52848 index ed31d8c..ab856b3 100644
52849 --- a/drivers/scsi/pmcraid.c
52850 +++ b/drivers/scsi/pmcraid.c
52851 @@ -200,8 +200,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
52852 res->scsi_dev = scsi_dev;
52853 scsi_dev->hostdata = res;
52854 res->change_detected = 0;
52855 - atomic_set(&res->read_failures, 0);
52856 - atomic_set(&res->write_failures, 0);
52857 + atomic_set_unchecked(&res->read_failures, 0);
52858 + atomic_set_unchecked(&res->write_failures, 0);
52859 rc = 0;
52860 }
52861 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
52862 @@ -2640,9 +2640,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
52863
52864 /* If this was a SCSI read/write command keep count of errors */
52865 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
52866 - atomic_inc(&res->read_failures);
52867 + atomic_inc_unchecked(&res->read_failures);
52868 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
52869 - atomic_inc(&res->write_failures);
52870 + atomic_inc_unchecked(&res->write_failures);
52871
52872 if (!RES_IS_GSCSI(res->cfg_entry) &&
52873 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
52874 @@ -3468,7 +3468,7 @@ static int pmcraid_queuecommand_lck(
52875 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
52876 * hrrq_id assigned here in queuecommand
52877 */
52878 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
52879 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
52880 pinstance->num_hrrq;
52881 cmd->cmd_done = pmcraid_io_done;
52882
52883 @@ -3782,7 +3782,7 @@ static long pmcraid_ioctl_passthrough(
52884 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
52885 * hrrq_id assigned here in queuecommand
52886 */
52887 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
52888 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
52889 pinstance->num_hrrq;
52890
52891 if (request_size) {
52892 @@ -4420,7 +4420,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
52893
52894 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
52895 /* add resources only after host is added into system */
52896 - if (!atomic_read(&pinstance->expose_resources))
52897 + if (!atomic_read_unchecked(&pinstance->expose_resources))
52898 return;
52899
52900 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
52901 @@ -5237,8 +5237,8 @@ static int pmcraid_init_instance(struct pci_dev *pdev, struct Scsi_Host *host,
52902 init_waitqueue_head(&pinstance->reset_wait_q);
52903
52904 atomic_set(&pinstance->outstanding_cmds, 0);
52905 - atomic_set(&pinstance->last_message_id, 0);
52906 - atomic_set(&pinstance->expose_resources, 0);
52907 + atomic_set_unchecked(&pinstance->last_message_id, 0);
52908 + atomic_set_unchecked(&pinstance->expose_resources, 0);
52909
52910 INIT_LIST_HEAD(&pinstance->free_res_q);
52911 INIT_LIST_HEAD(&pinstance->used_res_q);
52912 @@ -5951,7 +5951,7 @@ static int pmcraid_probe(struct pci_dev *pdev,
52913 /* Schedule worker thread to handle CCN and take care of adding and
52914 * removing devices to OS
52915 */
52916 - atomic_set(&pinstance->expose_resources, 1);
52917 + atomic_set_unchecked(&pinstance->expose_resources, 1);
52918 schedule_work(&pinstance->worker_q);
52919 return rc;
52920
52921 diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
52922 index e1d150f..6c6df44 100644
52923 --- a/drivers/scsi/pmcraid.h
52924 +++ b/drivers/scsi/pmcraid.h
52925 @@ -748,7 +748,7 @@ struct pmcraid_instance {
52926 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
52927
52928 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
52929 - atomic_t last_message_id;
52930 + atomic_unchecked_t last_message_id;
52931
52932 /* configuration table */
52933 struct pmcraid_config_table *cfg_table;
52934 @@ -777,7 +777,7 @@ struct pmcraid_instance {
52935 atomic_t outstanding_cmds;
52936
52937 /* should add/delete resources to mid-layer now ?*/
52938 - atomic_t expose_resources;
52939 + atomic_unchecked_t expose_resources;
52940
52941
52942
52943 @@ -813,8 +813,8 @@ struct pmcraid_resource_entry {
52944 struct pmcraid_config_table_entry_ext cfg_entry_ext;
52945 };
52946 struct scsi_device *scsi_dev; /* Link scsi_device structure */
52947 - atomic_t read_failures; /* count of failed READ commands */
52948 - atomic_t write_failures; /* count of failed WRITE commands */
52949 + atomic_unchecked_t read_failures; /* count of failed READ commands */
52950 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
52951
52952 /* To indicate add/delete/modify during CCN */
52953 u8 change_detected;
52954 diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
52955 index 82b92c4..3178171 100644
52956 --- a/drivers/scsi/qla2xxx/qla_attr.c
52957 +++ b/drivers/scsi/qla2xxx/qla_attr.c
52958 @@ -2192,7 +2192,7 @@ qla24xx_vport_disable(struct fc_vport *fc_vport, bool disable)
52959 return 0;
52960 }
52961
52962 -struct fc_function_template qla2xxx_transport_functions = {
52963 +fc_function_template_no_const qla2xxx_transport_functions = {
52964
52965 .show_host_node_name = 1,
52966 .show_host_port_name = 1,
52967 @@ -2240,7 +2240,7 @@ struct fc_function_template qla2xxx_transport_functions = {
52968 .bsg_timeout = qla24xx_bsg_timeout,
52969 };
52970
52971 -struct fc_function_template qla2xxx_transport_vport_functions = {
52972 +fc_function_template_no_const qla2xxx_transport_vport_functions = {
52973
52974 .show_host_node_name = 1,
52975 .show_host_port_name = 1,
52976 diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
52977 index 7686bfe..4710893 100644
52978 --- a/drivers/scsi/qla2xxx/qla_gbl.h
52979 +++ b/drivers/scsi/qla2xxx/qla_gbl.h
52980 @@ -571,8 +571,8 @@ extern void qla2x00_get_sym_node_name(scsi_qla_host_t *, uint8_t *, size_t);
52981 struct device_attribute;
52982 extern struct device_attribute *qla2x00_host_attrs[];
52983 struct fc_function_template;
52984 -extern struct fc_function_template qla2xxx_transport_functions;
52985 -extern struct fc_function_template qla2xxx_transport_vport_functions;
52986 +extern fc_function_template_no_const qla2xxx_transport_functions;
52987 +extern fc_function_template_no_const qla2xxx_transport_vport_functions;
52988 extern void qla2x00_alloc_sysfs_attr(scsi_qla_host_t *);
52989 extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *, bool);
52990 extern void qla2x00_init_host_attr(scsi_qla_host_t *);
52991 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
52992 index 7462dd7..5b64c24 100644
52993 --- a/drivers/scsi/qla2xxx/qla_os.c
52994 +++ b/drivers/scsi/qla2xxx/qla_os.c
52995 @@ -1435,8 +1435,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
52996 !pci_set_consistent_dma_mask(ha->pdev, DMA_BIT_MASK(64))) {
52997 /* Ok, a 64bit DMA mask is applicable. */
52998 ha->flags.enable_64bit_addressing = 1;
52999 - ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
53000 - ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
53001 + pax_open_kernel();
53002 + *(void **)&ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
53003 + *(void **)&ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
53004 + pax_close_kernel();
53005 return;
53006 }
53007 }
53008 diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
53009 index 8f6d0fb..1b21097 100644
53010 --- a/drivers/scsi/qla4xxx/ql4_def.h
53011 +++ b/drivers/scsi/qla4xxx/ql4_def.h
53012 @@ -305,7 +305,7 @@ struct ddb_entry {
53013 * (4000 only) */
53014 atomic_t relogin_timer; /* Max Time to wait for
53015 * relogin to complete */
53016 - atomic_t relogin_retry_count; /* Num of times relogin has been
53017 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
53018 * retried */
53019 uint32_t default_time2wait; /* Default Min time between
53020 * relogins (+aens) */
53021 diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
53022 index 6d25879..3031a9f 100644
53023 --- a/drivers/scsi/qla4xxx/ql4_os.c
53024 +++ b/drivers/scsi/qla4xxx/ql4_os.c
53025 @@ -4491,12 +4491,12 @@ static void qla4xxx_check_relogin_flash_ddb(struct iscsi_cls_session *cls_sess)
53026 */
53027 if (!iscsi_is_session_online(cls_sess)) {
53028 /* Reset retry relogin timer */
53029 - atomic_inc(&ddb_entry->relogin_retry_count);
53030 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
53031 DEBUG2(ql4_printk(KERN_INFO, ha,
53032 "%s: index[%d] relogin timed out-retrying"
53033 " relogin (%d), retry (%d)\n", __func__,
53034 ddb_entry->fw_ddb_index,
53035 - atomic_read(&ddb_entry->relogin_retry_count),
53036 + atomic_read_unchecked(&ddb_entry->relogin_retry_count),
53037 ddb_entry->default_time2wait + 4));
53038 set_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags);
53039 atomic_set(&ddb_entry->retry_relogin_timer,
53040 @@ -6604,7 +6604,7 @@ static void qla4xxx_setup_flash_ddb_entry(struct scsi_qla_host *ha,
53041
53042 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
53043 atomic_set(&ddb_entry->relogin_timer, 0);
53044 - atomic_set(&ddb_entry->relogin_retry_count, 0);
53045 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
53046 def_timeout = le16_to_cpu(ddb_entry->fw_ddb_entry.def_timeout);
53047 ddb_entry->default_relogin_timeout =
53048 (def_timeout > LOGIN_TOV) && (def_timeout < LOGIN_TOV * 10) ?
53049 diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
53050 index 3833bf5..95feaf1 100644
53051 --- a/drivers/scsi/scsi.c
53052 +++ b/drivers/scsi/scsi.c
53053 @@ -637,7 +637,7 @@ void scsi_finish_command(struct scsi_cmnd *cmd)
53054
53055 good_bytes = scsi_bufflen(cmd);
53056 if (cmd->request->cmd_type != REQ_TYPE_BLOCK_PC) {
53057 - int old_good_bytes = good_bytes;
53058 + unsigned int old_good_bytes = good_bytes;
53059 drv = scsi_cmd_to_driver(cmd);
53060 if (drv->done)
53061 good_bytes = drv->done(cmd);
53062 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
53063 index b1a2631..5bcd9c8 100644
53064 --- a/drivers/scsi/scsi_lib.c
53065 +++ b/drivers/scsi/scsi_lib.c
53066 @@ -1597,7 +1597,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
53067 shost = sdev->host;
53068 scsi_init_cmd_errh(cmd);
53069 cmd->result = DID_NO_CONNECT << 16;
53070 - atomic_inc(&cmd->device->iorequest_cnt);
53071 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
53072
53073 /*
53074 * SCSI request completion path will do scsi_device_unbusy(),
53075 @@ -1620,9 +1620,9 @@ static void scsi_softirq_done(struct request *rq)
53076
53077 INIT_LIST_HEAD(&cmd->eh_entry);
53078
53079 - atomic_inc(&cmd->device->iodone_cnt);
53080 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
53081 if (cmd->result)
53082 - atomic_inc(&cmd->device->ioerr_cnt);
53083 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
53084
53085 disposition = scsi_decide_disposition(cmd);
53086 if (disposition != SUCCESS &&
53087 @@ -1663,7 +1663,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
53088 struct Scsi_Host *host = cmd->device->host;
53089 int rtn = 0;
53090
53091 - atomic_inc(&cmd->device->iorequest_cnt);
53092 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
53093
53094 /* check if the device is still usable */
53095 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
53096 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
53097 index 1ac38e7..6acc656 100644
53098 --- a/drivers/scsi/scsi_sysfs.c
53099 +++ b/drivers/scsi/scsi_sysfs.c
53100 @@ -788,7 +788,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
53101 char *buf) \
53102 { \
53103 struct scsi_device *sdev = to_scsi_device(dev); \
53104 - unsigned long long count = atomic_read(&sdev->field); \
53105 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
53106 return snprintf(buf, 20, "0x%llx\n", count); \
53107 } \
53108 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
53109 diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
53110 index 24eaaf6..de30ec9 100644
53111 --- a/drivers/scsi/scsi_transport_fc.c
53112 +++ b/drivers/scsi/scsi_transport_fc.c
53113 @@ -502,7 +502,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class,
53114 * Netlink Infrastructure
53115 */
53116
53117 -static atomic_t fc_event_seq;
53118 +static atomic_unchecked_t fc_event_seq;
53119
53120 /**
53121 * fc_get_event_number - Obtain the next sequential FC event number
53122 @@ -515,7 +515,7 @@ static atomic_t fc_event_seq;
53123 u32
53124 fc_get_event_number(void)
53125 {
53126 - return atomic_add_return(1, &fc_event_seq);
53127 + return atomic_add_return_unchecked(1, &fc_event_seq);
53128 }
53129 EXPORT_SYMBOL(fc_get_event_number);
53130
53131 @@ -659,7 +659,7 @@ static __init int fc_transport_init(void)
53132 {
53133 int error;
53134
53135 - atomic_set(&fc_event_seq, 0);
53136 + atomic_set_unchecked(&fc_event_seq, 0);
53137
53138 error = transport_class_register(&fc_host_class);
53139 if (error)
53140 @@ -849,7 +849,7 @@ static int fc_str_to_dev_loss(const char *buf, unsigned long *val)
53141 char *cp;
53142
53143 *val = simple_strtoul(buf, &cp, 0);
53144 - if ((*cp && (*cp != '\n')) || (*val < 0))
53145 + if (*cp && (*cp != '\n'))
53146 return -EINVAL;
53147 /*
53148 * Check for overflow; dev_loss_tmo is u32
53149 diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
53150 index 67d43e3..8cee73c 100644
53151 --- a/drivers/scsi/scsi_transport_iscsi.c
53152 +++ b/drivers/scsi/scsi_transport_iscsi.c
53153 @@ -79,7 +79,7 @@ struct iscsi_internal {
53154 struct transport_container session_cont;
53155 };
53156
53157 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
53158 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
53159 static struct workqueue_struct *iscsi_eh_timer_workq;
53160
53161 static DEFINE_IDA(iscsi_sess_ida);
53162 @@ -2071,7 +2071,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
53163 int err;
53164
53165 ihost = shost->shost_data;
53166 - session->sid = atomic_add_return(1, &iscsi_session_nr);
53167 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
53168
53169 if (target_id == ISCSI_MAX_TARGET) {
53170 id = ida_simple_get(&iscsi_sess_ida, 0, 0, GFP_KERNEL);
53171 @@ -4515,7 +4515,7 @@ static __init int iscsi_transport_init(void)
53172 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
53173 ISCSI_TRANSPORT_VERSION);
53174
53175 - atomic_set(&iscsi_session_nr, 0);
53176 + atomic_set_unchecked(&iscsi_session_nr, 0);
53177
53178 err = class_register(&iscsi_transport_class);
53179 if (err)
53180 diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
53181 index f115f67..b80b2c1 100644
53182 --- a/drivers/scsi/scsi_transport_srp.c
53183 +++ b/drivers/scsi/scsi_transport_srp.c
53184 @@ -35,7 +35,7 @@
53185 #include "scsi_priv.h"
53186
53187 struct srp_host_attrs {
53188 - atomic_t next_port_id;
53189 + atomic_unchecked_t next_port_id;
53190 };
53191 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
53192
53193 @@ -100,7 +100,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
53194 struct Scsi_Host *shost = dev_to_shost(dev);
53195 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
53196
53197 - atomic_set(&srp_host->next_port_id, 0);
53198 + atomic_set_unchecked(&srp_host->next_port_id, 0);
53199 return 0;
53200 }
53201
53202 @@ -744,7 +744,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
53203 rport_fast_io_fail_timedout);
53204 INIT_DELAYED_WORK(&rport->dev_loss_work, rport_dev_loss_timedout);
53205
53206 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
53207 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
53208 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
53209
53210 transport_setup_device(&rport->dev);
53211 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
53212 index 7f9d65f..e856438 100644
53213 --- a/drivers/scsi/sd.c
53214 +++ b/drivers/scsi/sd.c
53215 @@ -111,7 +111,7 @@ static int sd_resume(struct device *);
53216 static void sd_rescan(struct device *);
53217 static int sd_init_command(struct scsi_cmnd *SCpnt);
53218 static void sd_uninit_command(struct scsi_cmnd *SCpnt);
53219 -static int sd_done(struct scsi_cmnd *);
53220 +static unsigned int sd_done(struct scsi_cmnd *);
53221 static int sd_eh_action(struct scsi_cmnd *, int);
53222 static void sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer);
53223 static void scsi_disk_release(struct device *cdev);
53224 @@ -1646,7 +1646,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
53225 *
53226 * Note: potentially run from within an ISR. Must not block.
53227 **/
53228 -static int sd_done(struct scsi_cmnd *SCpnt)
53229 +static unsigned int sd_done(struct scsi_cmnd *SCpnt)
53230 {
53231 int result = SCpnt->result;
53232 unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
53233 @@ -2973,7 +2973,7 @@ static int sd_probe(struct device *dev)
53234 sdkp->disk = gd;
53235 sdkp->index = index;
53236 atomic_set(&sdkp->openers, 0);
53237 - atomic_set(&sdkp->device->ioerr_cnt, 0);
53238 + atomic_set_unchecked(&sdkp->device->ioerr_cnt, 0);
53239
53240 if (!sdp->request_queue->rq_timeout) {
53241 if (sdp->type != TYPE_MOD)
53242 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
53243 index 9d7b7db..33ecc51 100644
53244 --- a/drivers/scsi/sg.c
53245 +++ b/drivers/scsi/sg.c
53246 @@ -1083,7 +1083,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
53247 sdp->disk->disk_name,
53248 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
53249 NULL,
53250 - (char *)arg);
53251 + (char __user *)arg);
53252 case BLKTRACESTART:
53253 return blk_trace_startstop(sdp->device->request_queue, 1);
53254 case BLKTRACESTOP:
53255 diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
53256 index 8bd54a6..dd037a5 100644
53257 --- a/drivers/scsi/sr.c
53258 +++ b/drivers/scsi/sr.c
53259 @@ -80,7 +80,7 @@ static DEFINE_MUTEX(sr_mutex);
53260 static int sr_probe(struct device *);
53261 static int sr_remove(struct device *);
53262 static int sr_init_command(struct scsi_cmnd *SCpnt);
53263 -static int sr_done(struct scsi_cmnd *);
53264 +static unsigned int sr_done(struct scsi_cmnd *);
53265 static int sr_runtime_suspend(struct device *dev);
53266
53267 static struct dev_pm_ops sr_pm_ops = {
53268 @@ -312,11 +312,11 @@ do_tur:
53269 * It will be notified on the end of a SCSI read / write, and will take one
53270 * of several actions based on success or failure.
53271 */
53272 -static int sr_done(struct scsi_cmnd *SCpnt)
53273 +static unsigned int sr_done(struct scsi_cmnd *SCpnt)
53274 {
53275 int result = SCpnt->result;
53276 - int this_count = scsi_bufflen(SCpnt);
53277 - int good_bytes = (result == 0 ? this_count : 0);
53278 + unsigned int this_count = scsi_bufflen(SCpnt);
53279 + unsigned int good_bytes = (result == 0 ? this_count : 0);
53280 int block_sectors = 0;
53281 long error_sector;
53282 struct scsi_cd *cd = scsi_cd(SCpnt->request->rq_disk);
53283 diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
53284 index 9a1c342..525ab4c 100644
53285 --- a/drivers/scsi/st.c
53286 +++ b/drivers/scsi/st.c
53287 @@ -1274,9 +1274,9 @@ static int st_open(struct inode *inode, struct file *filp)
53288 spin_lock(&st_use_lock);
53289 STp->in_use = 0;
53290 spin_unlock(&st_use_lock);
53291 - scsi_tape_put(STp);
53292 if (resumed)
53293 scsi_autopm_put_device(STp->device);
53294 + scsi_tape_put(STp);
53295 return retval;
53296
53297 }
53298 diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c
53299 index c0d660f..24a5854 100644
53300 --- a/drivers/soc/tegra/fuse/fuse-tegra.c
53301 +++ b/drivers/soc/tegra/fuse/fuse-tegra.c
53302 @@ -71,7 +71,7 @@ static ssize_t fuse_read(struct file *fd, struct kobject *kobj,
53303 return i;
53304 }
53305
53306 -static struct bin_attribute fuse_bin_attr = {
53307 +static bin_attribute_no_const fuse_bin_attr = {
53308 .attr = { .name = "fuse", .mode = S_IRUGO, },
53309 .read = fuse_read,
53310 };
53311 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
53312 index d35c1a1..eda08dc 100644
53313 --- a/drivers/spi/spi.c
53314 +++ b/drivers/spi/spi.c
53315 @@ -2206,7 +2206,7 @@ int spi_bus_unlock(struct spi_master *master)
53316 EXPORT_SYMBOL_GPL(spi_bus_unlock);
53317
53318 /* portable code must never pass more than 32 bytes */
53319 -#define SPI_BUFSIZ max(32, SMP_CACHE_BYTES)
53320 +#define SPI_BUFSIZ max(32UL, SMP_CACHE_BYTES)
53321
53322 static u8 *buf;
53323
53324 diff --git a/drivers/staging/android/timed_output.c b/drivers/staging/android/timed_output.c
53325 index b41429f..2de5373 100644
53326 --- a/drivers/staging/android/timed_output.c
53327 +++ b/drivers/staging/android/timed_output.c
53328 @@ -25,7 +25,7 @@
53329 #include "timed_output.h"
53330
53331 static struct class *timed_output_class;
53332 -static atomic_t device_count;
53333 +static atomic_unchecked_t device_count;
53334
53335 static ssize_t enable_show(struct device *dev, struct device_attribute *attr,
53336 char *buf)
53337 @@ -65,7 +65,7 @@ static int create_timed_output_class(void)
53338 timed_output_class = class_create(THIS_MODULE, "timed_output");
53339 if (IS_ERR(timed_output_class))
53340 return PTR_ERR(timed_output_class);
53341 - atomic_set(&device_count, 0);
53342 + atomic_set_unchecked(&device_count, 0);
53343 timed_output_class->dev_groups = timed_output_groups;
53344 }
53345
53346 @@ -83,7 +83,7 @@ int timed_output_dev_register(struct timed_output_dev *tdev)
53347 if (ret < 0)
53348 return ret;
53349
53350 - tdev->index = atomic_inc_return(&device_count);
53351 + tdev->index = atomic_inc_return_unchecked(&device_count);
53352 tdev->dev = device_create(timed_output_class, NULL,
53353 MKDEV(0, tdev->index), NULL, "%s", tdev->name);
53354 if (IS_ERR(tdev->dev))
53355 diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
53356 index e78ddbe..ac437c0 100644
53357 --- a/drivers/staging/comedi/comedi_fops.c
53358 +++ b/drivers/staging/comedi/comedi_fops.c
53359 @@ -297,8 +297,8 @@ static void comedi_file_reset(struct file *file)
53360 }
53361 cfp->last_attached = dev->attached;
53362 cfp->last_detach_count = dev->detach_count;
53363 - ACCESS_ONCE(cfp->read_subdev) = read_s;
53364 - ACCESS_ONCE(cfp->write_subdev) = write_s;
53365 + ACCESS_ONCE_RW(cfp->read_subdev) = read_s;
53366 + ACCESS_ONCE_RW(cfp->write_subdev) = write_s;
53367 }
53368
53369 static void comedi_file_check(struct file *file)
53370 @@ -1951,7 +1951,7 @@ static int do_setrsubd_ioctl(struct comedi_device *dev, unsigned long arg,
53371 !(s_old->async->cmd.flags & CMDF_WRITE))
53372 return -EBUSY;
53373
53374 - ACCESS_ONCE(cfp->read_subdev) = s_new;
53375 + ACCESS_ONCE_RW(cfp->read_subdev) = s_new;
53376 return 0;
53377 }
53378
53379 @@ -1993,7 +1993,7 @@ static int do_setwsubd_ioctl(struct comedi_device *dev, unsigned long arg,
53380 (s_old->async->cmd.flags & CMDF_WRITE))
53381 return -EBUSY;
53382
53383 - ACCESS_ONCE(cfp->write_subdev) = s_new;
53384 + ACCESS_ONCE_RW(cfp->write_subdev) = s_new;
53385 return 0;
53386 }
53387
53388 diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
53389 index 53b748b..a5ae0b3 100644
53390 --- a/drivers/staging/fbtft/fbtft-core.c
53391 +++ b/drivers/staging/fbtft/fbtft-core.c
53392 @@ -680,7 +680,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
53393 {
53394 struct fb_info *info;
53395 struct fbtft_par *par;
53396 - struct fb_ops *fbops = NULL;
53397 + fb_ops_no_const *fbops = NULL;
53398 struct fb_deferred_io *fbdefio = NULL;
53399 struct fbtft_platform_data *pdata = dev->platform_data;
53400 u8 *vmem = NULL;
53401 diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h
53402 index 9fd98cb..a9cf912 100644
53403 --- a/drivers/staging/fbtft/fbtft.h
53404 +++ b/drivers/staging/fbtft/fbtft.h
53405 @@ -106,7 +106,7 @@ struct fbtft_ops {
53406
53407 int (*set_var)(struct fbtft_par *par);
53408 int (*set_gamma)(struct fbtft_par *par, unsigned long *curves);
53409 -};
53410 +} __no_const;
53411
53412 /**
53413 * struct fbtft_display - Describes the display properties
53414 diff --git a/drivers/staging/gdm724x/gdm_tty.c b/drivers/staging/gdm724x/gdm_tty.c
53415 index 001348c..cfaac8a 100644
53416 --- a/drivers/staging/gdm724x/gdm_tty.c
53417 +++ b/drivers/staging/gdm724x/gdm_tty.c
53418 @@ -44,7 +44,7 @@
53419 #define gdm_tty_send_control(n, r, v, d, l) (\
53420 n->tty_dev->send_control(n->tty_dev->priv_dev, r, v, d, l))
53421
53422 -#define GDM_TTY_READY(gdm) (gdm && gdm->tty_dev && gdm->port.count)
53423 +#define GDM_TTY_READY(gdm) (gdm && gdm->tty_dev && atomic_read(&gdm->port.count))
53424
53425 static struct tty_driver *gdm_driver[TTY_MAX_COUNT];
53426 static struct gdm *gdm_table[TTY_MAX_COUNT][GDM_TTY_MINOR];
53427 diff --git a/drivers/staging/i2o/i2o.h b/drivers/staging/i2o/i2o.h
53428 index d23c3c2..eb63c81 100644
53429 --- a/drivers/staging/i2o/i2o.h
53430 +++ b/drivers/staging/i2o/i2o.h
53431 @@ -565,7 +565,7 @@ struct i2o_controller {
53432 struct i2o_device *exec; /* Executive */
53433 #if BITS_PER_LONG == 64
53434 spinlock_t context_list_lock; /* lock for context_list */
53435 - atomic_t context_list_counter; /* needed for unique contexts */
53436 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
53437 struct list_head context_list; /* list of context id's
53438 and pointers */
53439 #endif
53440 diff --git a/drivers/staging/i2o/i2o_proc.c b/drivers/staging/i2o/i2o_proc.c
53441 index 780fee3..ca9dcae 100644
53442 --- a/drivers/staging/i2o/i2o_proc.c
53443 +++ b/drivers/staging/i2o/i2o_proc.c
53444 @@ -253,12 +253,6 @@ static char *scsi_devices[] = {
53445 "Array Controller Device"
53446 };
53447
53448 -static char *chtostr(char *tmp, u8 *chars, int n)
53449 -{
53450 - tmp[0] = 0;
53451 - return strncat(tmp, (char *)chars, n);
53452 -}
53453 -
53454 static int i2o_report_query_status(struct seq_file *seq, int block_status,
53455 char *group)
53456 {
53457 @@ -711,9 +705,9 @@ static int i2o_seq_show_status(struct seq_file *seq, void *v)
53458 static int i2o_seq_show_hw(struct seq_file *seq, void *v)
53459 {
53460 struct i2o_controller *c = (struct i2o_controller *)seq->private;
53461 - static u32 work32[5];
53462 - static u8 *work8 = (u8 *) work32;
53463 - static u16 *work16 = (u16 *) work32;
53464 + u32 work32[5];
53465 + u8 *work8 = (u8 *) work32;
53466 + u16 *work16 = (u16 *) work32;
53467 int token;
53468 u32 hwcap;
53469
53470 @@ -794,7 +788,6 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
53471 } *result;
53472
53473 i2o_exec_execute_ddm_table ddm_table;
53474 - char tmp[28 + 1];
53475
53476 result = kmalloc(sizeof(*result), GFP_KERNEL);
53477 if (!result)
53478 @@ -829,8 +822,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
53479
53480 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
53481 seq_printf(seq, "%-#8x", ddm_table.module_id);
53482 - seq_printf(seq, "%-29s",
53483 - chtostr(tmp, ddm_table.module_name_version, 28));
53484 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
53485 seq_printf(seq, "%9d ", ddm_table.data_size);
53486 seq_printf(seq, "%8d", ddm_table.code_size);
53487
53488 @@ -897,7 +889,6 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
53489
53490 i2o_driver_result_table *result;
53491 i2o_driver_store_table *dst;
53492 - char tmp[28 + 1];
53493
53494 result = kmalloc(sizeof(i2o_driver_result_table), GFP_KERNEL);
53495 if (result == NULL)
53496 @@ -932,9 +923,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
53497
53498 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
53499 seq_printf(seq, "%-#8x", dst->module_id);
53500 - seq_printf(seq, "%-29s",
53501 - chtostr(tmp, dst->module_name_version, 28));
53502 - seq_printf(seq, "%-9s", chtostr(tmp, dst->date, 8));
53503 + seq_printf(seq, "%-.28s", dst->module_name_version);
53504 + seq_printf(seq, "%-.8s", dst->date);
53505 seq_printf(seq, "%8d ", dst->module_size);
53506 seq_printf(seq, "%8d ", dst->mpb_size);
53507 seq_printf(seq, "0x%04x", dst->module_flags);
53508 @@ -1250,11 +1240,10 @@ static int i2o_seq_show_authorized_users(struct seq_file *seq, void *v)
53509 static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
53510 {
53511 struct i2o_device *d = (struct i2o_device *)seq->private;
53512 - static u32 work32[128]; // allow for "stuff" + up to 256 byte (max) serial number
53513 + u32 work32[128]; // allow for "stuff" + up to 256 byte (max) serial number
53514 // == (allow) 512d bytes (max)
53515 - static u16 *work16 = (u16 *) work32;
53516 + u16 *work16 = (u16 *) work32;
53517 int token;
53518 - char tmp[16 + 1];
53519
53520 token = i2o_parm_field_get(d, 0xF100, -1, &work32, sizeof(work32));
53521
53522 @@ -1266,14 +1255,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
53523 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
53524 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
53525 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
53526 - seq_printf(seq, "Vendor info : %s\n",
53527 - chtostr(tmp, (u8 *) (work32 + 2), 16));
53528 - seq_printf(seq, "Product info : %s\n",
53529 - chtostr(tmp, (u8 *) (work32 + 6), 16));
53530 - seq_printf(seq, "Description : %s\n",
53531 - chtostr(tmp, (u8 *) (work32 + 10), 16));
53532 - seq_printf(seq, "Product rev. : %s\n",
53533 - chtostr(tmp, (u8 *) (work32 + 14), 8));
53534 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
53535 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
53536 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
53537 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
53538
53539 seq_printf(seq, "Serial number : ");
53540 print_serial_number(seq, (u8 *) (work32 + 16),
53541 @@ -1310,8 +1295,6 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
53542 u8 pad[256]; // allow up to 256 byte (max) serial number
53543 } result;
53544
53545 - char tmp[24 + 1];
53546 -
53547 token = i2o_parm_field_get(d, 0xF101, -1, &result, sizeof(result));
53548
53549 if (token < 0) {
53550 @@ -1320,10 +1303,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
53551 }
53552
53553 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
53554 - seq_printf(seq, "Module name : %s\n",
53555 - chtostr(tmp, result.module_name, 24));
53556 - seq_printf(seq, "Module revision : %s\n",
53557 - chtostr(tmp, result.module_rev, 8));
53558 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
53559 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
53560
53561 seq_printf(seq, "Serial number : ");
53562 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
53563 @@ -1347,8 +1328,6 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
53564 u8 instance_number[4];
53565 } result;
53566
53567 - char tmp[64 + 1];
53568 -
53569 token = i2o_parm_field_get(d, 0xF102, -1, &result, sizeof(result));
53570
53571 if (token < 0) {
53572 @@ -1356,14 +1335,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
53573 return 0;
53574 }
53575
53576 - seq_printf(seq, "Device name : %s\n",
53577 - chtostr(tmp, result.device_name, 64));
53578 - seq_printf(seq, "Service name : %s\n",
53579 - chtostr(tmp, result.service_name, 64));
53580 - seq_printf(seq, "Physical name : %s\n",
53581 - chtostr(tmp, result.physical_location, 64));
53582 - seq_printf(seq, "Instance number : %s\n",
53583 - chtostr(tmp, result.instance_number, 4));
53584 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
53585 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
53586 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
53587 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
53588
53589 return 0;
53590 }
53591 @@ -1372,9 +1347,9 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
53592 static int i2o_seq_show_sgl_limits(struct seq_file *seq, void *v)
53593 {
53594 struct i2o_device *d = (struct i2o_device *)seq->private;
53595 - static u32 work32[12];
53596 - static u16 *work16 = (u16 *) work32;
53597 - static u8 *work8 = (u8 *) work32;
53598 + u32 work32[12];
53599 + u16 *work16 = (u16 *) work32;
53600 + u8 *work8 = (u8 *) work32;
53601 int token;
53602
53603 token = i2o_parm_field_get(d, 0xF103, -1, &work32, sizeof(work32));
53604 diff --git a/drivers/staging/i2o/iop.c b/drivers/staging/i2o/iop.c
53605 index 23bdbe4..4e1f340 100644
53606 --- a/drivers/staging/i2o/iop.c
53607 +++ b/drivers/staging/i2o/iop.c
53608 @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
53609
53610 spin_lock_irqsave(&c->context_list_lock, flags);
53611
53612 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
53613 - atomic_inc(&c->context_list_counter);
53614 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
53615 + atomic_inc_unchecked(&c->context_list_counter);
53616
53617 - entry->context = atomic_read(&c->context_list_counter);
53618 + entry->context = atomic_read_unchecked(&c->context_list_counter);
53619
53620 list_add(&entry->list, &c->context_list);
53621
53622 @@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(void)
53623
53624 #if BITS_PER_LONG == 64
53625 spin_lock_init(&c->context_list_lock);
53626 - atomic_set(&c->context_list_counter, 0);
53627 + atomic_set_unchecked(&c->context_list_counter, 0);
53628 INIT_LIST_HEAD(&c->context_list);
53629 #endif
53630
53631 diff --git a/drivers/staging/iio/accel/lis3l02dq_ring.c b/drivers/staging/iio/accel/lis3l02dq_ring.c
53632 index b892f2c..9b4898a 100644
53633 --- a/drivers/staging/iio/accel/lis3l02dq_ring.c
53634 +++ b/drivers/staging/iio/accel/lis3l02dq_ring.c
53635 @@ -118,7 +118,7 @@ static int lis3l02dq_get_buffer_element(struct iio_dev *indio_dev,
53636 int scan_count = bitmap_weight(indio_dev->active_scan_mask,
53637 indio_dev->masklength);
53638
53639 - rx_array = kcalloc(4, scan_count, GFP_KERNEL);
53640 + rx_array = kcalloc(scan_count, 4, GFP_KERNEL);
53641 if (!rx_array)
53642 return -ENOMEM;
53643 ret = lis3l02dq_read_all(indio_dev, rx_array);
53644 diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c
53645 index d98e229..9c59bc2 100644
53646 --- a/drivers/staging/iio/adc/ad7280a.c
53647 +++ b/drivers/staging/iio/adc/ad7280a.c
53648 @@ -547,8 +547,8 @@ static int ad7280_attr_init(struct ad7280_state *st)
53649 {
53650 int dev, ch, cnt;
53651
53652 - st->iio_attr = kcalloc(2, sizeof(*st->iio_attr) *
53653 - (st->slave_num + 1) * AD7280A_CELLS_PER_DEV,
53654 + st->iio_attr = kcalloc(sizeof(*st->iio_attr) *
53655 + (st->slave_num + 1) * AD7280A_CELLS_PER_DEV, 2,
53656 GFP_KERNEL);
53657 if (st->iio_attr == NULL)
53658 return -ENOMEM;
53659 diff --git a/drivers/staging/lustre/lnet/selftest/brw_test.c b/drivers/staging/lustre/lnet/selftest/brw_test.c
53660 index 658f458..0564216 100644
53661 --- a/drivers/staging/lustre/lnet/selftest/brw_test.c
53662 +++ b/drivers/staging/lustre/lnet/selftest/brw_test.c
53663 @@ -487,13 +487,11 @@ brw_server_handle(struct srpc_server_rpc *rpc)
53664 return 0;
53665 }
53666
53667 -sfw_test_client_ops_t brw_test_client;
53668 -void brw_init_test_client(void)
53669 -{
53670 - brw_test_client.tso_init = brw_client_init;
53671 - brw_test_client.tso_fini = brw_client_fini;
53672 - brw_test_client.tso_prep_rpc = brw_client_prep_rpc;
53673 - brw_test_client.tso_done_rpc = brw_client_done_rpc;
53674 +sfw_test_client_ops_t brw_test_client = {
53675 + .tso_init = brw_client_init,
53676 + .tso_fini = brw_client_fini,
53677 + .tso_prep_rpc = brw_client_prep_rpc,
53678 + .tso_done_rpc = brw_client_done_rpc,
53679 };
53680
53681 srpc_service_t brw_test_service;
53682 diff --git a/drivers/staging/lustre/lnet/selftest/framework.c b/drivers/staging/lustre/lnet/selftest/framework.c
53683 index a93a90d..c51dde6 100644
53684 --- a/drivers/staging/lustre/lnet/selftest/framework.c
53685 +++ b/drivers/staging/lustre/lnet/selftest/framework.c
53686 @@ -1628,12 +1628,10 @@ static srpc_service_t sfw_services[] = {
53687
53688 extern sfw_test_client_ops_t ping_test_client;
53689 extern srpc_service_t ping_test_service;
53690 -extern void ping_init_test_client(void);
53691 extern void ping_init_test_service(void);
53692
53693 extern sfw_test_client_ops_t brw_test_client;
53694 extern srpc_service_t brw_test_service;
53695 -extern void brw_init_test_client(void);
53696 extern void brw_init_test_service(void);
53697
53698
53699 @@ -1675,12 +1673,10 @@ sfw_startup(void)
53700 INIT_LIST_HEAD(&sfw_data.fw_zombie_rpcs);
53701 INIT_LIST_HEAD(&sfw_data.fw_zombie_sessions);
53702
53703 - brw_init_test_client();
53704 brw_init_test_service();
53705 rc = sfw_register_test(&brw_test_service, &brw_test_client);
53706 LASSERT(rc == 0);
53707
53708 - ping_init_test_client();
53709 ping_init_test_service();
53710 rc = sfw_register_test(&ping_test_service, &ping_test_client);
53711 LASSERT(rc == 0);
53712 diff --git a/drivers/staging/lustre/lnet/selftest/ping_test.c b/drivers/staging/lustre/lnet/selftest/ping_test.c
53713 index 644069a..83cbd26 100644
53714 --- a/drivers/staging/lustre/lnet/selftest/ping_test.c
53715 +++ b/drivers/staging/lustre/lnet/selftest/ping_test.c
53716 @@ -211,14 +211,12 @@ ping_server_handle(struct srpc_server_rpc *rpc)
53717 return 0;
53718 }
53719
53720 -sfw_test_client_ops_t ping_test_client;
53721 -void ping_init_test_client(void)
53722 -{
53723 - ping_test_client.tso_init = ping_client_init;
53724 - ping_test_client.tso_fini = ping_client_fini;
53725 - ping_test_client.tso_prep_rpc = ping_client_prep_rpc;
53726 - ping_test_client.tso_done_rpc = ping_client_done_rpc;
53727 -}
53728 +sfw_test_client_ops_t ping_test_client = {
53729 + .tso_init = ping_client_init,
53730 + .tso_fini = ping_client_fini,
53731 + .tso_prep_rpc = ping_client_prep_rpc,
53732 + .tso_done_rpc = ping_client_done_rpc,
53733 +};
53734
53735 srpc_service_t ping_test_service;
53736 void ping_init_test_service(void)
53737 diff --git a/drivers/staging/lustre/lustre/include/lustre_dlm.h b/drivers/staging/lustre/lustre/include/lustre_dlm.h
53738 index bac9902..0225fe1 100644
53739 --- a/drivers/staging/lustre/lustre/include/lustre_dlm.h
53740 +++ b/drivers/staging/lustre/lustre/include/lustre_dlm.h
53741 @@ -1139,7 +1139,7 @@ struct ldlm_callback_suite {
53742 ldlm_completion_callback lcs_completion;
53743 ldlm_blocking_callback lcs_blocking;
53744 ldlm_glimpse_callback lcs_glimpse;
53745 -};
53746 +} __no_const;
53747
53748 /* ldlm_lockd.c */
53749 int ldlm_del_waiting_lock(struct ldlm_lock *lock);
53750 diff --git a/drivers/staging/lustre/lustre/include/obd.h b/drivers/staging/lustre/lustre/include/obd.h
53751 index 2a88b80..62e7e5f 100644
53752 --- a/drivers/staging/lustre/lustre/include/obd.h
53753 +++ b/drivers/staging/lustre/lustre/include/obd.h
53754 @@ -1362,7 +1362,7 @@ struct md_ops {
53755 * lprocfs_alloc_md_stats() in obdclass/lprocfs_status.c. Also, add a
53756 * wrapper function in include/linux/obd_class.h.
53757 */
53758 -};
53759 +} __no_const;
53760
53761 struct lsm_operations {
53762 void (*lsm_free)(struct lov_stripe_md *);
53763 diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
53764 index a4c252f..b21acac 100644
53765 --- a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
53766 +++ b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
53767 @@ -258,7 +258,7 @@ ldlm_process_flock_lock(struct ldlm_lock *req, __u64 *flags, int first_enq,
53768 int added = (mode == LCK_NL);
53769 int overlaps = 0;
53770 int splitted = 0;
53771 - const struct ldlm_callback_suite null_cbs = { NULL };
53772 + const struct ldlm_callback_suite null_cbs = { };
53773
53774 CDEBUG(D_DLMTRACE,
53775 "flags %#llx owner %llu pid %u mode %u start %llu end %llu\n",
53776 diff --git a/drivers/staging/lustre/lustre/libcfs/module.c b/drivers/staging/lustre/lustre/libcfs/module.c
53777 index f0ee76a..1d01af9 100644
53778 --- a/drivers/staging/lustre/lustre/libcfs/module.c
53779 +++ b/drivers/staging/lustre/lustre/libcfs/module.c
53780 @@ -380,11 +380,11 @@ out:
53781
53782
53783 struct cfs_psdev_ops libcfs_psdev_ops = {
53784 - libcfs_psdev_open,
53785 - libcfs_psdev_release,
53786 - NULL,
53787 - NULL,
53788 - libcfs_ioctl
53789 + .p_open = libcfs_psdev_open,
53790 + .p_close = libcfs_psdev_release,
53791 + .p_read = NULL,
53792 + .p_write = NULL,
53793 + .p_ioctl = libcfs_ioctl
53794 };
53795
53796 static int init_libcfs_module(void)
53797 @@ -631,7 +631,7 @@ static int proc_console_max_delay_cs(struct ctl_table *table, int write,
53798 loff_t *ppos)
53799 {
53800 int rc, max_delay_cs;
53801 - struct ctl_table dummy = *table;
53802 + ctl_table_no_const dummy = *table;
53803 long d;
53804
53805 dummy.data = &max_delay_cs;
53806 @@ -664,7 +664,7 @@ static int proc_console_min_delay_cs(struct ctl_table *table, int write,
53807 loff_t *ppos)
53808 {
53809 int rc, min_delay_cs;
53810 - struct ctl_table dummy = *table;
53811 + ctl_table_no_const dummy = *table;
53812 long d;
53813
53814 dummy.data = &min_delay_cs;
53815 @@ -696,7 +696,7 @@ static int proc_console_backoff(struct ctl_table *table, int write,
53816 void __user *buffer, size_t *lenp, loff_t *ppos)
53817 {
53818 int rc, backoff;
53819 - struct ctl_table dummy = *table;
53820 + ctl_table_no_const dummy = *table;
53821
53822 dummy.data = &backoff;
53823 dummy.proc_handler = &proc_dointvec;
53824 diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
53825 index 22667db..8b703b6 100644
53826 --- a/drivers/staging/octeon/ethernet-rx.c
53827 +++ b/drivers/staging/octeon/ethernet-rx.c
53828 @@ -354,14 +354,14 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
53829 /* Increment RX stats for virtual ports */
53830 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
53831 #ifdef CONFIG_64BIT
53832 - atomic64_add(1,
53833 + atomic64_add_unchecked(1,
53834 (atomic64_t *)&priv->stats.rx_packets);
53835 - atomic64_add(skb->len,
53836 + atomic64_add_unchecked(skb->len,
53837 (atomic64_t *)&priv->stats.rx_bytes);
53838 #else
53839 - atomic_add(1,
53840 + atomic_add_unchecked(1,
53841 (atomic_t *)&priv->stats.rx_packets);
53842 - atomic_add(skb->len,
53843 + atomic_add_unchecked(skb->len,
53844 (atomic_t *)&priv->stats.rx_bytes);
53845 #endif
53846 }
53847 @@ -373,10 +373,10 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
53848 dev->name);
53849 */
53850 #ifdef CONFIG_64BIT
53851 - atomic64_add(1,
53852 + atomic64_add_unchecked(1,
53853 (atomic64_t *)&priv->stats.rx_dropped);
53854 #else
53855 - atomic_add(1,
53856 + atomic_add_unchecked(1,
53857 (atomic_t *)&priv->stats.rx_dropped);
53858 #endif
53859 dev_kfree_skb_irq(skb);
53860 diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
53861 index fbbe866..2943243 100644
53862 --- a/drivers/staging/octeon/ethernet.c
53863 +++ b/drivers/staging/octeon/ethernet.c
53864 @@ -251,11 +251,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
53865 * since the RX tasklet also increments it.
53866 */
53867 #ifdef CONFIG_64BIT
53868 - atomic64_add(rx_status.dropped_packets,
53869 - (atomic64_t *)&priv->stats.rx_dropped);
53870 + atomic64_add_unchecked(rx_status.dropped_packets,
53871 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
53872 #else
53873 - atomic_add(rx_status.dropped_packets,
53874 - (atomic_t *)&priv->stats.rx_dropped);
53875 + atomic_add_unchecked(rx_status.dropped_packets,
53876 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
53877 #endif
53878 }
53879
53880 diff --git a/drivers/staging/rtl8188eu/include/hal_intf.h b/drivers/staging/rtl8188eu/include/hal_intf.h
53881 index 3b476d8..f522d68 100644
53882 --- a/drivers/staging/rtl8188eu/include/hal_intf.h
53883 +++ b/drivers/staging/rtl8188eu/include/hal_intf.h
53884 @@ -225,7 +225,7 @@ struct hal_ops {
53885
53886 void (*hal_notch_filter)(struct adapter *adapter, bool enable);
53887 void (*hal_reset_security_engine)(struct adapter *adapter);
53888 -};
53889 +} __no_const;
53890
53891 enum rt_eeprom_type {
53892 EEPROM_93C46,
53893 diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h
53894 index 070cc03..6806e37 100644
53895 --- a/drivers/staging/rtl8712/rtl871x_io.h
53896 +++ b/drivers/staging/rtl8712/rtl871x_io.h
53897 @@ -108,7 +108,7 @@ struct _io_ops {
53898 u8 *pmem);
53899 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
53900 u8 *pmem);
53901 -};
53902 +} __no_const;
53903
53904 struct io_req {
53905 struct list_head list;
53906 diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
53907 index dbbb2f8..5232114 100644
53908 --- a/drivers/staging/sm750fb/sm750.c
53909 +++ b/drivers/staging/sm750fb/sm750.c
53910 @@ -780,6 +780,7 @@ static struct fb_ops lynxfb_ops = {
53911 .fb_set_par = lynxfb_ops_set_par,
53912 .fb_setcolreg = lynxfb_ops_setcolreg,
53913 .fb_blank = lynxfb_ops_blank,
53914 + .fb_pan_display = lynxfb_ops_pan_display,
53915 .fb_fillrect = cfb_fillrect,
53916 .fb_imageblit = cfb_imageblit,
53917 .fb_copyarea = cfb_copyarea,
53918 @@ -827,8 +828,10 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
53919 par->index = index;
53920 output->channel = &crtc->channel;
53921 sm750fb_set_drv(par);
53922 - lynxfb_ops.fb_pan_display = lynxfb_ops_pan_display;
53923
53924 + pax_open_kernel();
53925 + *(void **)&lynxfb_ops.fb_pan_display = lynxfb_ops_pan_display;
53926 + pax_close_kernel();
53927
53928 /* set current cursor variable and proc pointer,
53929 * must be set after crtc member initialized */
53930 @@ -850,7 +853,9 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
53931 crtc->cursor.share = share;
53932 memset_io(crtc->cursor.vstart, 0, crtc->cursor.size);
53933 if (!g_hwcursor) {
53934 - lynxfb_ops.fb_cursor = NULL;
53935 + pax_open_kernel();
53936 + *(void **)&lynxfb_ops.fb_cursor = NULL;
53937 + pax_close_kernel();
53938 crtc->cursor.disable(&crtc->cursor);
53939 }
53940
53941 @@ -858,9 +863,11 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
53942 /* set info->fbops, must be set before fb_find_mode */
53943 if (!share->accel_off) {
53944 /* use 2d acceleration */
53945 - lynxfb_ops.fb_fillrect = lynxfb_ops_fillrect;
53946 - lynxfb_ops.fb_copyarea = lynxfb_ops_copyarea;
53947 - lynxfb_ops.fb_imageblit = lynxfb_ops_imageblit;
53948 + pax_open_kernel();
53949 + *(void **)&lynxfb_ops.fb_fillrect = lynxfb_ops_fillrect;
53950 + *(void **)&lynxfb_ops.fb_copyarea = lynxfb_ops_copyarea;
53951 + *(void **)&lynxfb_ops.fb_imageblit = lynxfb_ops_imageblit;
53952 + pax_close_kernel();
53953 }
53954 info->fbops = &lynxfb_ops;
53955
53956 diff --git a/drivers/staging/unisys/visorchipset/visorchipset.h b/drivers/staging/unisys/visorchipset/visorchipset.h
53957 index bd46df9..a0a5274 100644
53958 --- a/drivers/staging/unisys/visorchipset/visorchipset.h
53959 +++ b/drivers/staging/unisys/visorchipset/visorchipset.h
53960 @@ -170,7 +170,7 @@ struct visorchipset_busdev_notifiers {
53961 void (*device_resume)(ulong bus_no, ulong dev_no);
53962 int (*get_channel_info)(uuid_le type_uuid, ulong *min_size,
53963 ulong *max_size);
53964 -};
53965 +} __no_const;
53966
53967 /* These functions live inside visorchipset, and will be called to indicate
53968 * responses to specific events (by code outside of visorchipset).
53969 @@ -185,7 +185,7 @@ struct visorchipset_busdev_responders {
53970 void (*device_destroy)(ulong bus_no, ulong dev_no, int response);
53971 void (*device_pause)(ulong bus_no, ulong dev_no, int response);
53972 void (*device_resume)(ulong bus_no, ulong dev_no, int response);
53973 -};
53974 +} __no_const;
53975
53976 /** Register functions (in the bus driver) to get called by visorchipset
53977 * whenever a bus or device appears for which this service partition is
53978 diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
53979 index 18b0f97..9c7716e 100644
53980 --- a/drivers/target/sbp/sbp_target.c
53981 +++ b/drivers/target/sbp/sbp_target.c
53982 @@ -61,7 +61,7 @@ static const u32 sbp_unit_directory_template[] = {
53983
53984 #define SESSION_MAINTENANCE_INTERVAL HZ
53985
53986 -static atomic_t login_id = ATOMIC_INIT(0);
53987 +static atomic_unchecked_t login_id = ATOMIC_INIT(0);
53988
53989 static void session_maintenance_work(struct work_struct *);
53990 static int sbp_run_transaction(struct fw_card *, int, int, int, int,
53991 @@ -443,7 +443,7 @@ static void sbp_management_request_login(
53992 login->lun = se_lun;
53993 login->status_fifo_addr = sbp2_pointer_to_addr(&req->orb.status_fifo);
53994 login->exclusive = LOGIN_ORB_EXCLUSIVE(be32_to_cpu(req->orb.misc));
53995 - login->login_id = atomic_inc_return(&login_id);
53996 + login->login_id = atomic_inc_return_unchecked(&login_id);
53997
53998 login->tgt_agt = sbp_target_agent_register(login);
53999 if (IS_ERR(login->tgt_agt)) {
54000 diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
54001 index ce5f768..a4f884a 100644
54002 --- a/drivers/target/target_core_device.c
54003 +++ b/drivers/target/target_core_device.c
54004 @@ -1496,7 +1496,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
54005 spin_lock_init(&dev->se_tmr_lock);
54006 spin_lock_init(&dev->qf_cmd_lock);
54007 sema_init(&dev->caw_sem, 1);
54008 - atomic_set(&dev->dev_ordered_id, 0);
54009 + atomic_set_unchecked(&dev->dev_ordered_id, 0);
54010 INIT_LIST_HEAD(&dev->t10_wwn.t10_vpd_list);
54011 spin_lock_init(&dev->t10_wwn.t10_vpd_lock);
54012 INIT_LIST_HEAD(&dev->t10_pr.registration_list);
54013 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
54014 index 675f2d9..1389429 100644
54015 --- a/drivers/target/target_core_transport.c
54016 +++ b/drivers/target/target_core_transport.c
54017 @@ -1208,7 +1208,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
54018 * Used to determine when ORDERED commands should go from
54019 * Dormant to Active status.
54020 */
54021 - cmd->se_ordered_id = atomic_inc_return(&dev->dev_ordered_id);
54022 + cmd->se_ordered_id = atomic_inc_return_unchecked(&dev->dev_ordered_id);
54023 pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
54024 cmd->se_ordered_id, cmd->sam_task_attr,
54025 dev->transport->name);
54026 diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
54027 index 031018e..90981a1 100644
54028 --- a/drivers/thermal/int340x_thermal/int3400_thermal.c
54029 +++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
54030 @@ -272,8 +272,10 @@ static int int3400_thermal_probe(struct platform_device *pdev)
54031 platform_set_drvdata(pdev, priv);
54032
54033 if (priv->uuid_bitmap & 1 << INT3400_THERMAL_PASSIVE_1) {
54034 - int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
54035 - int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
54036 + pax_open_kernel();
54037 + *(void **)&int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
54038 + *(void **)&int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
54039 + pax_close_kernel();
54040 }
54041 priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0,
54042 priv, &int3400_thermal_ops,
54043 diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
54044 index 668fb1b..2737bbe 100644
54045 --- a/drivers/thermal/of-thermal.c
54046 +++ b/drivers/thermal/of-thermal.c
54047 @@ -31,6 +31,7 @@
54048 #include <linux/export.h>
54049 #include <linux/string.h>
54050 #include <linux/thermal.h>
54051 +#include <linux/mm.h>
54052
54053 #include "thermal_core.h"
54054
54055 @@ -412,9 +413,11 @@ thermal_zone_of_add_sensor(struct device_node *zone,
54056 tz->ops = ops;
54057 tz->sensor_data = data;
54058
54059 - tzd->ops->get_temp = of_thermal_get_temp;
54060 - tzd->ops->get_trend = of_thermal_get_trend;
54061 - tzd->ops->set_emul_temp = of_thermal_set_emul_temp;
54062 + pax_open_kernel();
54063 + *(void **)&tzd->ops->get_temp = of_thermal_get_temp;
54064 + *(void **)&tzd->ops->get_trend = of_thermal_get_trend;
54065 + *(void **)&tzd->ops->set_emul_temp = of_thermal_set_emul_temp;
54066 + pax_close_kernel();
54067 mutex_unlock(&tzd->lock);
54068
54069 return tzd;
54070 @@ -544,9 +547,11 @@ void thermal_zone_of_sensor_unregister(struct device *dev,
54071 return;
54072
54073 mutex_lock(&tzd->lock);
54074 - tzd->ops->get_temp = NULL;
54075 - tzd->ops->get_trend = NULL;
54076 - tzd->ops->set_emul_temp = NULL;
54077 + pax_open_kernel();
54078 + *(void **)&tzd->ops->get_temp = NULL;
54079 + *(void **)&tzd->ops->get_trend = NULL;
54080 + *(void **)&tzd->ops->set_emul_temp = NULL;
54081 + pax_close_kernel();
54082
54083 tz->ops = NULL;
54084 tz->sensor_data = NULL;
54085 diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
54086 index 9ea3d9d..53e8792 100644
54087 --- a/drivers/thermal/x86_pkg_temp_thermal.c
54088 +++ b/drivers/thermal/x86_pkg_temp_thermal.c
54089 @@ -567,7 +567,7 @@ static int pkg_temp_thermal_cpu_callback(struct notifier_block *nfb,
54090 return NOTIFY_OK;
54091 }
54092
54093 -static struct notifier_block pkg_temp_thermal_notifier __refdata = {
54094 +static struct notifier_block pkg_temp_thermal_notifier __refconst = {
54095 .notifier_call = pkg_temp_thermal_cpu_callback,
54096 };
54097
54098 diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
54099 index fd66f57..48e6376 100644
54100 --- a/drivers/tty/cyclades.c
54101 +++ b/drivers/tty/cyclades.c
54102 @@ -1570,10 +1570,10 @@ static int cy_open(struct tty_struct *tty, struct file *filp)
54103 printk(KERN_DEBUG "cyc:cy_open ttyC%d, count = %d\n", info->line,
54104 info->port.count);
54105 #endif
54106 - info->port.count++;
54107 + atomic_inc(&info->port.count);
54108 #ifdef CY_DEBUG_COUNT
54109 printk(KERN_DEBUG "cyc:cy_open (%d): incrementing count to %d\n",
54110 - current->pid, info->port.count);
54111 + current->pid, atomic_read(&info->port.count));
54112 #endif
54113
54114 /*
54115 @@ -3974,7 +3974,7 @@ static int cyclades_proc_show(struct seq_file *m, void *v)
54116 for (j = 0; j < cy_card[i].nports; j++) {
54117 info = &cy_card[i].ports[j];
54118
54119 - if (info->port.count) {
54120 + if (atomic_read(&info->port.count)) {
54121 /* XXX is the ldisc num worth this? */
54122 struct tty_struct *tty;
54123 struct tty_ldisc *ld;
54124 diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
54125 index 4fcec1d..5a036f7 100644
54126 --- a/drivers/tty/hvc/hvc_console.c
54127 +++ b/drivers/tty/hvc/hvc_console.c
54128 @@ -342,7 +342,7 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
54129
54130 spin_lock_irqsave(&hp->port.lock, flags);
54131 /* Check and then increment for fast path open. */
54132 - if (hp->port.count++ > 0) {
54133 + if (atomic_inc_return(&hp->port.count) > 1) {
54134 spin_unlock_irqrestore(&hp->port.lock, flags);
54135 hvc_kick();
54136 return 0;
54137 @@ -397,7 +397,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
54138
54139 spin_lock_irqsave(&hp->port.lock, flags);
54140
54141 - if (--hp->port.count == 0) {
54142 + if (atomic_dec_return(&hp->port.count) == 0) {
54143 spin_unlock_irqrestore(&hp->port.lock, flags);
54144 /* We are done with the tty pointer now. */
54145 tty_port_tty_set(&hp->port, NULL);
54146 @@ -419,9 +419,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
54147 */
54148 tty_wait_until_sent_from_close(tty, HVC_CLOSE_WAIT);
54149 } else {
54150 - if (hp->port.count < 0)
54151 + if (atomic_read(&hp->port.count) < 0)
54152 printk(KERN_ERR "hvc_close %X: oops, count is %d\n",
54153 - hp->vtermno, hp->port.count);
54154 + hp->vtermno, atomic_read(&hp->port.count));
54155 spin_unlock_irqrestore(&hp->port.lock, flags);
54156 }
54157 }
54158 @@ -451,12 +451,12 @@ static void hvc_hangup(struct tty_struct *tty)
54159 * open->hangup case this can be called after the final close so prevent
54160 * that from happening for now.
54161 */
54162 - if (hp->port.count <= 0) {
54163 + if (atomic_read(&hp->port.count) <= 0) {
54164 spin_unlock_irqrestore(&hp->port.lock, flags);
54165 return;
54166 }
54167
54168 - hp->port.count = 0;
54169 + atomic_set(&hp->port.count, 0);
54170 spin_unlock_irqrestore(&hp->port.lock, flags);
54171 tty_port_tty_set(&hp->port, NULL);
54172
54173 @@ -504,7 +504,7 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count
54174 return -EPIPE;
54175
54176 /* FIXME what's this (unprotected) check for? */
54177 - if (hp->port.count <= 0)
54178 + if (atomic_read(&hp->port.count) <= 0)
54179 return -EIO;
54180
54181 spin_lock_irqsave(&hp->lock, flags);
54182 diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
54183 index 81ff7e1..dfb7b71 100644
54184 --- a/drivers/tty/hvc/hvcs.c
54185 +++ b/drivers/tty/hvc/hvcs.c
54186 @@ -83,6 +83,7 @@
54187 #include <asm/hvcserver.h>
54188 #include <asm/uaccess.h>
54189 #include <asm/vio.h>
54190 +#include <asm/local.h>
54191
54192 /*
54193 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
54194 @@ -416,7 +417,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
54195
54196 spin_lock_irqsave(&hvcsd->lock, flags);
54197
54198 - if (hvcsd->port.count > 0) {
54199 + if (atomic_read(&hvcsd->port.count) > 0) {
54200 spin_unlock_irqrestore(&hvcsd->lock, flags);
54201 printk(KERN_INFO "HVCS: vterm state unchanged. "
54202 "The hvcs device node is still in use.\n");
54203 @@ -1127,7 +1128,7 @@ static int hvcs_install(struct tty_driver *driver, struct tty_struct *tty)
54204 }
54205 }
54206
54207 - hvcsd->port.count = 0;
54208 + atomic_set(&hvcsd->port.count, 0);
54209 hvcsd->port.tty = tty;
54210 tty->driver_data = hvcsd;
54211
54212 @@ -1180,7 +1181,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
54213 unsigned long flags;
54214
54215 spin_lock_irqsave(&hvcsd->lock, flags);
54216 - hvcsd->port.count++;
54217 + atomic_inc(&hvcsd->port.count);
54218 hvcsd->todo_mask |= HVCS_SCHED_READ;
54219 spin_unlock_irqrestore(&hvcsd->lock, flags);
54220
54221 @@ -1216,7 +1217,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
54222 hvcsd = tty->driver_data;
54223
54224 spin_lock_irqsave(&hvcsd->lock, flags);
54225 - if (--hvcsd->port.count == 0) {
54226 + if (atomic_dec_and_test(&hvcsd->port.count)) {
54227
54228 vio_disable_interrupts(hvcsd->vdev);
54229
54230 @@ -1241,10 +1242,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
54231
54232 free_irq(irq, hvcsd);
54233 return;
54234 - } else if (hvcsd->port.count < 0) {
54235 + } else if (atomic_read(&hvcsd->port.count) < 0) {
54236 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
54237 " is missmanaged.\n",
54238 - hvcsd->vdev->unit_address, hvcsd->port.count);
54239 + hvcsd->vdev->unit_address, atomic_read(&hvcsd->port.count));
54240 }
54241
54242 spin_unlock_irqrestore(&hvcsd->lock, flags);
54243 @@ -1266,7 +1267,7 @@ static void hvcs_hangup(struct tty_struct * tty)
54244
54245 spin_lock_irqsave(&hvcsd->lock, flags);
54246 /* Preserve this so that we know how many kref refs to put */
54247 - temp_open_count = hvcsd->port.count;
54248 + temp_open_count = atomic_read(&hvcsd->port.count);
54249
54250 /*
54251 * Don't kref put inside the spinlock because the destruction
54252 @@ -1281,7 +1282,7 @@ static void hvcs_hangup(struct tty_struct * tty)
54253 tty->driver_data = NULL;
54254 hvcsd->port.tty = NULL;
54255
54256 - hvcsd->port.count = 0;
54257 + atomic_set(&hvcsd->port.count, 0);
54258
54259 /* This will drop any buffered data on the floor which is OK in a hangup
54260 * scenario. */
54261 @@ -1352,7 +1353,7 @@ static int hvcs_write(struct tty_struct *tty,
54262 * the middle of a write operation? This is a crummy place to do this
54263 * but we want to keep it all in the spinlock.
54264 */
54265 - if (hvcsd->port.count <= 0) {
54266 + if (atomic_read(&hvcsd->port.count) <= 0) {
54267 spin_unlock_irqrestore(&hvcsd->lock, flags);
54268 return -ENODEV;
54269 }
54270 @@ -1426,7 +1427,7 @@ static int hvcs_write_room(struct tty_struct *tty)
54271 {
54272 struct hvcs_struct *hvcsd = tty->driver_data;
54273
54274 - if (!hvcsd || hvcsd->port.count <= 0)
54275 + if (!hvcsd || atomic_read(&hvcsd->port.count) <= 0)
54276 return 0;
54277
54278 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
54279 diff --git a/drivers/tty/hvc/hvsi.c b/drivers/tty/hvc/hvsi.c
54280 index 4190199..06d5bfa 100644
54281 --- a/drivers/tty/hvc/hvsi.c
54282 +++ b/drivers/tty/hvc/hvsi.c
54283 @@ -85,7 +85,7 @@ struct hvsi_struct {
54284 int n_outbuf;
54285 uint32_t vtermno;
54286 uint32_t virq;
54287 - atomic_t seqno; /* HVSI packet sequence number */
54288 + atomic_unchecked_t seqno; /* HVSI packet sequence number */
54289 uint16_t mctrl;
54290 uint8_t state; /* HVSI protocol state */
54291 uint8_t flags;
54292 @@ -295,7 +295,7 @@ static int hvsi_version_respond(struct hvsi_struct *hp, uint16_t query_seqno)
54293
54294 packet.hdr.type = VS_QUERY_RESPONSE_PACKET_HEADER;
54295 packet.hdr.len = sizeof(struct hvsi_query_response);
54296 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
54297 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
54298 packet.verb = VSV_SEND_VERSION_NUMBER;
54299 packet.u.version = HVSI_VERSION;
54300 packet.query_seqno = query_seqno+1;
54301 @@ -555,7 +555,7 @@ static int hvsi_query(struct hvsi_struct *hp, uint16_t verb)
54302
54303 packet.hdr.type = VS_QUERY_PACKET_HEADER;
54304 packet.hdr.len = sizeof(struct hvsi_query);
54305 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
54306 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
54307 packet.verb = verb;
54308
54309 pr_debug("%s: sending %i bytes\n", __func__, packet.hdr.len);
54310 @@ -597,7 +597,7 @@ static int hvsi_set_mctrl(struct hvsi_struct *hp, uint16_t mctrl)
54311 int wrote;
54312
54313 packet.hdr.type = VS_CONTROL_PACKET_HEADER,
54314 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
54315 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
54316 packet.hdr.len = sizeof(struct hvsi_control);
54317 packet.verb = VSV_SET_MODEM_CTL;
54318 packet.mask = HVSI_TSDTR;
54319 @@ -680,7 +680,7 @@ static int hvsi_put_chars(struct hvsi_struct *hp, const char *buf, int count)
54320 BUG_ON(count > HVSI_MAX_OUTGOING_DATA);
54321
54322 packet.hdr.type = VS_DATA_PACKET_HEADER;
54323 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
54324 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
54325 packet.hdr.len = count + sizeof(struct hvsi_header);
54326 memcpy(&packet.data, buf, count);
54327
54328 @@ -697,7 +697,7 @@ static void hvsi_close_protocol(struct hvsi_struct *hp)
54329 struct hvsi_control packet __ALIGNED__;
54330
54331 packet.hdr.type = VS_CONTROL_PACKET_HEADER;
54332 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
54333 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
54334 packet.hdr.len = 6;
54335 packet.verb = VSV_CLOSE_PROTOCOL;
54336
54337 @@ -725,7 +725,7 @@ static int hvsi_open(struct tty_struct *tty, struct file *filp)
54338
54339 tty_port_tty_set(&hp->port, tty);
54340 spin_lock_irqsave(&hp->lock, flags);
54341 - hp->port.count++;
54342 + atomic_inc(&hp->port.count);
54343 atomic_set(&hp->seqno, 0);
54344 h_vio_signal(hp->vtermno, VIO_IRQ_ENABLE);
54345 spin_unlock_irqrestore(&hp->lock, flags);
54346 @@ -782,7 +782,7 @@ static void hvsi_close(struct tty_struct *tty, struct file *filp)
54347
54348 spin_lock_irqsave(&hp->lock, flags);
54349
54350 - if (--hp->port.count == 0) {
54351 + if (atomic_dec_return(&hp->port.count) == 0) {
54352 tty_port_tty_set(&hp->port, NULL);
54353 hp->inbuf_end = hp->inbuf; /* discard remaining partial packets */
54354
54355 @@ -815,9 +815,9 @@ static void hvsi_close(struct tty_struct *tty, struct file *filp)
54356
54357 spin_lock_irqsave(&hp->lock, flags);
54358 }
54359 - } else if (hp->port.count < 0)
54360 + } else if (atomic_read(&hp->port.count) < 0)
54361 printk(KERN_ERR "hvsi_close %lu: oops, count is %d\n",
54362 - hp - hvsi_ports, hp->port.count);
54363 + hp - hvsi_ports, atomic_read(&hp->port.count));
54364
54365 spin_unlock_irqrestore(&hp->lock, flags);
54366 }
54367 @@ -832,7 +832,7 @@ static void hvsi_hangup(struct tty_struct *tty)
54368 tty_port_tty_set(&hp->port, NULL);
54369
54370 spin_lock_irqsave(&hp->lock, flags);
54371 - hp->port.count = 0;
54372 + atomic_set(&hp->port.count, 0);
54373 hp->n_outbuf = 0;
54374 spin_unlock_irqrestore(&hp->lock, flags);
54375 }
54376 diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
54377 index a270f04..7c77b5d 100644
54378 --- a/drivers/tty/hvc/hvsi_lib.c
54379 +++ b/drivers/tty/hvc/hvsi_lib.c
54380 @@ -8,7 +8,7 @@
54381
54382 static int hvsi_send_packet(struct hvsi_priv *pv, struct hvsi_header *packet)
54383 {
54384 - packet->seqno = cpu_to_be16(atomic_inc_return(&pv->seqno));
54385 + packet->seqno = cpu_to_be16(atomic_inc_return_unchecked(&pv->seqno));
54386
54387 /* Assumes that always succeeds, works in practice */
54388 return pv->put_chars(pv->termno, (char *)packet, packet->len);
54389 @@ -20,7 +20,7 @@ static void hvsi_start_handshake(struct hvsi_priv *pv)
54390
54391 /* Reset state */
54392 pv->established = 0;
54393 - atomic_set(&pv->seqno, 0);
54394 + atomic_set_unchecked(&pv->seqno, 0);
54395
54396 pr_devel("HVSI@%x: Handshaking started\n", pv->termno);
54397
54398 diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
54399 index 345cebb..d5a1e9e 100644
54400 --- a/drivers/tty/ipwireless/tty.c
54401 +++ b/drivers/tty/ipwireless/tty.c
54402 @@ -28,6 +28,7 @@
54403 #include <linux/tty_driver.h>
54404 #include <linux/tty_flip.h>
54405 #include <linux/uaccess.h>
54406 +#include <asm/local.h>
54407
54408 #include "tty.h"
54409 #include "network.h"
54410 @@ -93,10 +94,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
54411 return -ENODEV;
54412
54413 mutex_lock(&tty->ipw_tty_mutex);
54414 - if (tty->port.count == 0)
54415 + if (atomic_read(&tty->port.count) == 0)
54416 tty->tx_bytes_queued = 0;
54417
54418 - tty->port.count++;
54419 + atomic_inc(&tty->port.count);
54420
54421 tty->port.tty = linux_tty;
54422 linux_tty->driver_data = tty;
54423 @@ -112,9 +113,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
54424
54425 static void do_ipw_close(struct ipw_tty *tty)
54426 {
54427 - tty->port.count--;
54428 -
54429 - if (tty->port.count == 0) {
54430 + if (atomic_dec_return(&tty->port.count) == 0) {
54431 struct tty_struct *linux_tty = tty->port.tty;
54432
54433 if (linux_tty != NULL) {
54434 @@ -135,7 +134,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
54435 return;
54436
54437 mutex_lock(&tty->ipw_tty_mutex);
54438 - if (tty->port.count == 0) {
54439 + if (atomic_read(&tty->port.count) == 0) {
54440 mutex_unlock(&tty->ipw_tty_mutex);
54441 return;
54442 }
54443 @@ -158,7 +157,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
54444
54445 mutex_lock(&tty->ipw_tty_mutex);
54446
54447 - if (!tty->port.count) {
54448 + if (!atomic_read(&tty->port.count)) {
54449 mutex_unlock(&tty->ipw_tty_mutex);
54450 return;
54451 }
54452 @@ -197,7 +196,7 @@ static int ipw_write(struct tty_struct *linux_tty,
54453 return -ENODEV;
54454
54455 mutex_lock(&tty->ipw_tty_mutex);
54456 - if (!tty->port.count) {
54457 + if (!atomic_read(&tty->port.count)) {
54458 mutex_unlock(&tty->ipw_tty_mutex);
54459 return -EINVAL;
54460 }
54461 @@ -237,7 +236,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
54462 if (!tty)
54463 return -ENODEV;
54464
54465 - if (!tty->port.count)
54466 + if (!atomic_read(&tty->port.count))
54467 return -EINVAL;
54468
54469 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
54470 @@ -279,7 +278,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
54471 if (!tty)
54472 return 0;
54473
54474 - if (!tty->port.count)
54475 + if (!atomic_read(&tty->port.count))
54476 return 0;
54477
54478 return tty->tx_bytes_queued;
54479 @@ -360,7 +359,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty)
54480 if (!tty)
54481 return -ENODEV;
54482
54483 - if (!tty->port.count)
54484 + if (!atomic_read(&tty->port.count))
54485 return -EINVAL;
54486
54487 return get_control_lines(tty);
54488 @@ -376,7 +375,7 @@ ipw_tiocmset(struct tty_struct *linux_tty,
54489 if (!tty)
54490 return -ENODEV;
54491
54492 - if (!tty->port.count)
54493 + if (!atomic_read(&tty->port.count))
54494 return -EINVAL;
54495
54496 return set_control_lines(tty, set, clear);
54497 @@ -390,7 +389,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty,
54498 if (!tty)
54499 return -ENODEV;
54500
54501 - if (!tty->port.count)
54502 + if (!atomic_read(&tty->port.count))
54503 return -EINVAL;
54504
54505 /* FIXME: Exactly how is the tty object locked here .. */
54506 @@ -546,7 +545,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
54507 * are gone */
54508 mutex_lock(&ttyj->ipw_tty_mutex);
54509 }
54510 - while (ttyj->port.count)
54511 + while (atomic_read(&ttyj->port.count))
54512 do_ipw_close(ttyj);
54513 ipwireless_disassociate_network_ttys(network,
54514 ttyj->channel_idx);
54515 diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c
54516 index 14c54e0..1efd4f2 100644
54517 --- a/drivers/tty/moxa.c
54518 +++ b/drivers/tty/moxa.c
54519 @@ -1189,7 +1189,7 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
54520 }
54521
54522 ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
54523 - ch->port.count++;
54524 + atomic_inc(&ch->port.count);
54525 tty->driver_data = ch;
54526 tty_port_tty_set(&ch->port, tty);
54527 mutex_lock(&ch->port.mutex);
54528 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
54529 index 2c34c32..81d10e1 100644
54530 --- a/drivers/tty/n_gsm.c
54531 +++ b/drivers/tty/n_gsm.c
54532 @@ -1644,7 +1644,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
54533 spin_lock_init(&dlci->lock);
54534 mutex_init(&dlci->mutex);
54535 dlci->fifo = &dlci->_fifo;
54536 - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
54537 + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
54538 kfree(dlci);
54539 return NULL;
54540 }
54541 @@ -2958,7 +2958,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
54542 struct gsm_dlci *dlci = tty->driver_data;
54543 struct tty_port *port = &dlci->port;
54544
54545 - port->count++;
54546 + atomic_inc(&port->count);
54547 tty_port_tty_set(port, tty);
54548
54549 dlci->modem_rx = 0;
54550 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
54551 index 396344c..875c1d6 100644
54552 --- a/drivers/tty/n_tty.c
54553 +++ b/drivers/tty/n_tty.c
54554 @@ -116,7 +116,7 @@ struct n_tty_data {
54555 int minimum_to_wake;
54556
54557 /* consumer-published */
54558 - size_t read_tail;
54559 + size_t read_tail __intentional_overflow(-1);
54560 size_t line_start;
54561
54562 /* protected by output lock */
54563 @@ -2572,6 +2572,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
54564 {
54565 *ops = tty_ldisc_N_TTY;
54566 ops->owner = NULL;
54567 - ops->refcount = ops->flags = 0;
54568 + atomic_set(&ops->refcount, 0);
54569 + ops->flags = 0;
54570 }
54571 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
54572 diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
54573 index 4d5e840..a2340a6 100644
54574 --- a/drivers/tty/pty.c
54575 +++ b/drivers/tty/pty.c
54576 @@ -849,8 +849,10 @@ static void __init unix98_pty_init(void)
54577 panic("Couldn't register Unix98 pts driver");
54578
54579 /* Now create the /dev/ptmx special device */
54580 + pax_open_kernel();
54581 tty_default_fops(&ptmx_fops);
54582 - ptmx_fops.open = ptmx_open;
54583 + *(void **)&ptmx_fops.open = ptmx_open;
54584 + pax_close_kernel();
54585
54586 cdev_init(&ptmx_cdev, &ptmx_fops);
54587 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
54588 diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
54589 index c8dd8dc..dca6cfd 100644
54590 --- a/drivers/tty/rocket.c
54591 +++ b/drivers/tty/rocket.c
54592 @@ -914,7 +914,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
54593 tty->driver_data = info;
54594 tty_port_tty_set(port, tty);
54595
54596 - if (port->count++ == 0) {
54597 + if (atomic_inc_return(&port->count) == 1) {
54598 atomic_inc(&rp_num_ports_open);
54599
54600 #ifdef ROCKET_DEBUG_OPEN
54601 @@ -923,7 +923,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
54602 #endif
54603 }
54604 #ifdef ROCKET_DEBUG_OPEN
54605 - printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, info->port.count);
54606 + printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, atomic-read(&info->port.count));
54607 #endif
54608
54609 /*
54610 @@ -1515,7 +1515,7 @@ static void rp_hangup(struct tty_struct *tty)
54611 spin_unlock_irqrestore(&info->port.lock, flags);
54612 return;
54613 }
54614 - if (info->port.count)
54615 + if (atomic_read(&info->port.count))
54616 atomic_dec(&rp_num_ports_open);
54617 clear_bit((info->aiop * 8) + info->chan, (void *) &xmit_flags[info->board]);
54618 spin_unlock_irqrestore(&info->port.lock, flags);
54619 diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
54620 index 4506e40..ac0b470 100644
54621 --- a/drivers/tty/serial/8250/8250_core.c
54622 +++ b/drivers/tty/serial/8250/8250_core.c
54623 @@ -3241,9 +3241,9 @@ static void univ8250_release_port(struct uart_port *port)
54624
54625 static void univ8250_rsa_support(struct uart_ops *ops)
54626 {
54627 - ops->config_port = univ8250_config_port;
54628 - ops->request_port = univ8250_request_port;
54629 - ops->release_port = univ8250_release_port;
54630 + *(void **)&ops->config_port = univ8250_config_port;
54631 + *(void **)&ops->request_port = univ8250_request_port;
54632 + *(void **)&ops->release_port = univ8250_release_port;
54633 }
54634
54635 #else
54636 @@ -3286,8 +3286,10 @@ static void __init serial8250_isa_init_ports(void)
54637 }
54638
54639 /* chain base port ops to support Remote Supervisor Adapter */
54640 - univ8250_port_ops = *base_ops;
54641 + pax_open_kernel();
54642 + memcpy((void *)&univ8250_port_ops, base_ops, sizeof univ8250_port_ops);
54643 univ8250_rsa_support(&univ8250_port_ops);
54644 + pax_close_kernel();
54645
54646 if (share_irqs)
54647 irqflag = IRQF_SHARED;
54648 diff --git a/drivers/tty/serial/ioc4_serial.c b/drivers/tty/serial/ioc4_serial.c
54649 index aa28209..e08fb85 100644
54650 --- a/drivers/tty/serial/ioc4_serial.c
54651 +++ b/drivers/tty/serial/ioc4_serial.c
54652 @@ -437,7 +437,7 @@ struct ioc4_soft {
54653 } is_intr_info[MAX_IOC4_INTR_ENTS];
54654
54655 /* Number of entries active in the above array */
54656 - atomic_t is_num_intrs;
54657 + atomic_unchecked_t is_num_intrs;
54658 } is_intr_type[IOC4_NUM_INTR_TYPES];
54659
54660 /* is_ir_lock must be held while
54661 @@ -974,7 +974,7 @@ intr_connect(struct ioc4_soft *soft, int type,
54662 BUG_ON(!((type == IOC4_SIO_INTR_TYPE)
54663 || (type == IOC4_OTHER_INTR_TYPE)));
54664
54665 - i = atomic_inc_return(&soft-> is_intr_type[type].is_num_intrs) - 1;
54666 + i = atomic_inc_return_unchecked(&soft-> is_intr_type[type].is_num_intrs) - 1;
54667 BUG_ON(!(i < MAX_IOC4_INTR_ENTS || (printk("i %d\n", i), 0)));
54668
54669 /* Save off the lower level interrupt handler */
54670 @@ -1001,7 +1001,7 @@ static irqreturn_t ioc4_intr(int irq, void *arg)
54671
54672 soft = arg;
54673 for (intr_type = 0; intr_type < IOC4_NUM_INTR_TYPES; intr_type++) {
54674 - num_intrs = (int)atomic_read(
54675 + num_intrs = (int)atomic_read_unchecked(
54676 &soft->is_intr_type[intr_type].is_num_intrs);
54677
54678 this_mir = this_ir = pending_intrs(soft, intr_type);
54679 diff --git a/drivers/tty/serial/kgdb_nmi.c b/drivers/tty/serial/kgdb_nmi.c
54680 index 129dc5b..1da5bb8 100644
54681 --- a/drivers/tty/serial/kgdb_nmi.c
54682 +++ b/drivers/tty/serial/kgdb_nmi.c
54683 @@ -53,7 +53,9 @@ static int kgdb_nmi_console_setup(struct console *co, char *options)
54684 * I/O utilities that messages sent to the console will automatically
54685 * be displayed on the dbg_io.
54686 */
54687 - dbg_io_ops->is_console = true;
54688 + pax_open_kernel();
54689 + *(int *)&dbg_io_ops->is_console = true;
54690 + pax_close_kernel();
54691
54692 return 0;
54693 }
54694 diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
54695 index a260cde..6b2b5ce 100644
54696 --- a/drivers/tty/serial/kgdboc.c
54697 +++ b/drivers/tty/serial/kgdboc.c
54698 @@ -24,8 +24,9 @@
54699 #define MAX_CONFIG_LEN 40
54700
54701 static struct kgdb_io kgdboc_io_ops;
54702 +static struct kgdb_io kgdboc_io_ops_console;
54703
54704 -/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
54705 +/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
54706 static int configured = -1;
54707
54708 static char config[MAX_CONFIG_LEN];
54709 @@ -151,6 +152,8 @@ static void cleanup_kgdboc(void)
54710 kgdboc_unregister_kbd();
54711 if (configured == 1)
54712 kgdb_unregister_io_module(&kgdboc_io_ops);
54713 + else if (configured == 2)
54714 + kgdb_unregister_io_module(&kgdboc_io_ops_console);
54715 }
54716
54717 static int configure_kgdboc(void)
54718 @@ -160,13 +163,13 @@ static int configure_kgdboc(void)
54719 int err;
54720 char *cptr = config;
54721 struct console *cons;
54722 + int is_console = 0;
54723
54724 err = kgdboc_option_setup(config);
54725 if (err || !strlen(config) || isspace(config[0]))
54726 goto noconfig;
54727
54728 err = -ENODEV;
54729 - kgdboc_io_ops.is_console = 0;
54730 kgdb_tty_driver = NULL;
54731
54732 kgdboc_use_kms = 0;
54733 @@ -187,7 +190,7 @@ static int configure_kgdboc(void)
54734 int idx;
54735 if (cons->device && cons->device(cons, &idx) == p &&
54736 idx == tty_line) {
54737 - kgdboc_io_ops.is_console = 1;
54738 + is_console = 1;
54739 break;
54740 }
54741 cons = cons->next;
54742 @@ -197,7 +200,13 @@ static int configure_kgdboc(void)
54743 kgdb_tty_line = tty_line;
54744
54745 do_register:
54746 - err = kgdb_register_io_module(&kgdboc_io_ops);
54747 + if (is_console) {
54748 + err = kgdb_register_io_module(&kgdboc_io_ops_console);
54749 + configured = 2;
54750 + } else {
54751 + err = kgdb_register_io_module(&kgdboc_io_ops);
54752 + configured = 1;
54753 + }
54754 if (err)
54755 goto noconfig;
54756
54757 @@ -205,8 +214,6 @@ do_register:
54758 if (err)
54759 goto nmi_con_failed;
54760
54761 - configured = 1;
54762 -
54763 return 0;
54764
54765 nmi_con_failed:
54766 @@ -223,7 +230,7 @@ noconfig:
54767 static int __init init_kgdboc(void)
54768 {
54769 /* Already configured? */
54770 - if (configured == 1)
54771 + if (configured >= 1)
54772 return 0;
54773
54774 return configure_kgdboc();
54775 @@ -272,7 +279,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
54776 if (config[len - 1] == '\n')
54777 config[len - 1] = '\0';
54778
54779 - if (configured == 1)
54780 + if (configured >= 1)
54781 cleanup_kgdboc();
54782
54783 /* Go and configure with the new params. */
54784 @@ -312,6 +319,15 @@ static struct kgdb_io kgdboc_io_ops = {
54785 .post_exception = kgdboc_post_exp_handler,
54786 };
54787
54788 +static struct kgdb_io kgdboc_io_ops_console = {
54789 + .name = "kgdboc",
54790 + .read_char = kgdboc_get_char,
54791 + .write_char = kgdboc_put_char,
54792 + .pre_exception = kgdboc_pre_exp_handler,
54793 + .post_exception = kgdboc_post_exp_handler,
54794 + .is_console = 1
54795 +};
54796 +
54797 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
54798 /* This is only available if kgdboc is a built in for early debugging */
54799 static int __init kgdboc_early_init(char *opt)
54800 diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
54801 index b73889c..9f74f0a 100644
54802 --- a/drivers/tty/serial/msm_serial.c
54803 +++ b/drivers/tty/serial/msm_serial.c
54804 @@ -1012,7 +1012,7 @@ static struct uart_driver msm_uart_driver = {
54805 .cons = MSM_CONSOLE,
54806 };
54807
54808 -static atomic_t msm_uart_next_id = ATOMIC_INIT(0);
54809 +static atomic_unchecked_t msm_uart_next_id = ATOMIC_INIT(0);
54810
54811 static const struct of_device_id msm_uartdm_table[] = {
54812 { .compatible = "qcom,msm-uartdm-v1.1", .data = (void *)UARTDM_1P1 },
54813 @@ -1036,7 +1036,7 @@ static int msm_serial_probe(struct platform_device *pdev)
54814 line = pdev->id;
54815
54816 if (line < 0)
54817 - line = atomic_inc_return(&msm_uart_next_id) - 1;
54818 + line = atomic_inc_return_unchecked(&msm_uart_next_id) - 1;
54819
54820 if (unlikely(line < 0 || line >= UART_NR))
54821 return -ENXIO;
54822 diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
54823 index a0ae942..befa48d 100644
54824 --- a/drivers/tty/serial/samsung.c
54825 +++ b/drivers/tty/serial/samsung.c
54826 @@ -987,11 +987,16 @@ static void s3c24xx_serial_shutdown(struct uart_port *port)
54827 ourport->tx_in_progress = 0;
54828 }
54829
54830 +static int s3c64xx_serial_startup(struct uart_port *port);
54831 static int s3c24xx_serial_startup(struct uart_port *port)
54832 {
54833 struct s3c24xx_uart_port *ourport = to_ourport(port);
54834 int ret;
54835
54836 + /* Startup sequence is different for s3c64xx and higher SoC's */
54837 + if (s3c24xx_serial_has_interrupt_mask(port))
54838 + return s3c64xx_serial_startup(port);
54839 +
54840 dbg("s3c24xx_serial_startup: port=%p (%08llx,%p)\n",
54841 port, (unsigned long long)port->mapbase, port->membase);
54842
54843 @@ -1698,10 +1703,6 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
54844 /* setup info for port */
54845 port->dev = &platdev->dev;
54846
54847 - /* Startup sequence is different for s3c64xx and higher SoC's */
54848 - if (s3c24xx_serial_has_interrupt_mask(port))
54849 - s3c24xx_serial_ops.startup = s3c64xx_serial_startup;
54850 -
54851 port->uartclk = 1;
54852
54853 if (cfg->uart_flags & UPF_CONS_FLOW) {
54854 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
54855 index 0b7bb12..ebe191a 100644
54856 --- a/drivers/tty/serial/serial_core.c
54857 +++ b/drivers/tty/serial/serial_core.c
54858 @@ -1376,7 +1376,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
54859 state = drv->state + tty->index;
54860 port = &state->port;
54861 spin_lock_irq(&port->lock);
54862 - --port->count;
54863 + atomic_dec(&port->count);
54864 spin_unlock_irq(&port->lock);
54865 return;
54866 }
54867 @@ -1386,7 +1386,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
54868
54869 pr_debug("uart_close(%d) called\n", uport ? uport->line : -1);
54870
54871 - if (!port->count || tty_port_close_start(port, tty, filp) == 0)
54872 + if (!atomic_read(&port->count) || tty_port_close_start(port, tty, filp) == 0)
54873 return;
54874
54875 /*
54876 @@ -1510,7 +1510,7 @@ static void uart_hangup(struct tty_struct *tty)
54877 uart_flush_buffer(tty);
54878 uart_shutdown(tty, state);
54879 spin_lock_irqsave(&port->lock, flags);
54880 - port->count = 0;
54881 + atomic_set(&port->count, 0);
54882 clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
54883 spin_unlock_irqrestore(&port->lock, flags);
54884 tty_port_tty_set(port, NULL);
54885 @@ -1597,7 +1597,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
54886 pr_debug("uart_open(%d) called\n", line);
54887
54888 spin_lock_irq(&port->lock);
54889 - ++port->count;
54890 + atomic_inc(&port->count);
54891 spin_unlock_irq(&port->lock);
54892
54893 /*
54894 diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
54895 index b1c6bd3..5f038e2 100644
54896 --- a/drivers/tty/serial/uartlite.c
54897 +++ b/drivers/tty/serial/uartlite.c
54898 @@ -341,13 +341,13 @@ static int ulite_request_port(struct uart_port *port)
54899 return -EBUSY;
54900 }
54901
54902 - port->private_data = &uartlite_be;
54903 + port->private_data = (void *)&uartlite_be;
54904 ret = uart_in32(ULITE_CONTROL, port);
54905 uart_out32(ULITE_CONTROL_RST_TX, ULITE_CONTROL, port);
54906 ret = uart_in32(ULITE_STATUS, port);
54907 /* Endianess detection */
54908 if ((ret & ULITE_STATUS_TXEMPTY) != ULITE_STATUS_TXEMPTY)
54909 - port->private_data = &uartlite_le;
54910 + port->private_data = (void *)&uartlite_le;
54911
54912 return 0;
54913 }
54914 diff --git a/drivers/tty/synclink.c b/drivers/tty/synclink.c
54915 index b799170..87dafd5 100644
54916 --- a/drivers/tty/synclink.c
54917 +++ b/drivers/tty/synclink.c
54918 @@ -3090,7 +3090,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp)
54919
54920 if (debug_level >= DEBUG_LEVEL_INFO)
54921 printk("%s(%d):mgsl_close(%s) entry, count=%d\n",
54922 - __FILE__,__LINE__, info->device_name, info->port.count);
54923 + __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count));
54924
54925 if (tty_port_close_start(&info->port, tty, filp) == 0)
54926 goto cleanup;
54927 @@ -3108,7 +3108,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp)
54928 cleanup:
54929 if (debug_level >= DEBUG_LEVEL_INFO)
54930 printk("%s(%d):mgsl_close(%s) exit, count=%d\n", __FILE__,__LINE__,
54931 - tty->driver->name, info->port.count);
54932 + tty->driver->name, atomic_read(&info->port.count));
54933
54934 } /* end of mgsl_close() */
54935
54936 @@ -3207,8 +3207,8 @@ static void mgsl_hangup(struct tty_struct *tty)
54937
54938 mgsl_flush_buffer(tty);
54939 shutdown(info);
54940 -
54941 - info->port.count = 0;
54942 +
54943 + atomic_set(&info->port.count, 0);
54944 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
54945 info->port.tty = NULL;
54946
54947 @@ -3296,10 +3296,10 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
54948
54949 if (debug_level >= DEBUG_LEVEL_INFO)
54950 printk("%s(%d):block_til_ready before block on %s count=%d\n",
54951 - __FILE__,__LINE__, tty->driver->name, port->count );
54952 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
54953
54954 spin_lock_irqsave(&info->irq_spinlock, flags);
54955 - port->count--;
54956 + atomic_dec(&port->count);
54957 spin_unlock_irqrestore(&info->irq_spinlock, flags);
54958 port->blocked_open++;
54959
54960 @@ -3327,7 +3327,7 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
54961
54962 if (debug_level >= DEBUG_LEVEL_INFO)
54963 printk("%s(%d):block_til_ready blocking on %s count=%d\n",
54964 - __FILE__,__LINE__, tty->driver->name, port->count );
54965 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
54966
54967 tty_unlock(tty);
54968 schedule();
54969 @@ -3339,12 +3339,12 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
54970
54971 /* FIXME: Racy on hangup during close wait */
54972 if (!tty_hung_up_p(filp))
54973 - port->count++;
54974 + atomic_inc(&port->count);
54975 port->blocked_open--;
54976
54977 if (debug_level >= DEBUG_LEVEL_INFO)
54978 printk("%s(%d):block_til_ready after blocking on %s count=%d\n",
54979 - __FILE__,__LINE__, tty->driver->name, port->count );
54980 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
54981
54982 if (!retval)
54983 port->flags |= ASYNC_NORMAL_ACTIVE;
54984 @@ -3396,7 +3396,7 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp)
54985
54986 if (debug_level >= DEBUG_LEVEL_INFO)
54987 printk("%s(%d):mgsl_open(%s), old ref count = %d\n",
54988 - __FILE__,__LINE__,tty->driver->name, info->port.count);
54989 + __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count));
54990
54991 /* If port is closing, signal caller to try again */
54992 if (info->port.flags & ASYNC_CLOSING){
54993 @@ -3415,10 +3415,10 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp)
54994 spin_unlock_irqrestore(&info->netlock, flags);
54995 goto cleanup;
54996 }
54997 - info->port.count++;
54998 + atomic_inc(&info->port.count);
54999 spin_unlock_irqrestore(&info->netlock, flags);
55000
55001 - if (info->port.count == 1) {
55002 + if (atomic_read(&info->port.count) == 1) {
55003 /* 1st open on this device, init hardware */
55004 retval = startup(info);
55005 if (retval < 0)
55006 @@ -3442,8 +3442,8 @@ cleanup:
55007 if (retval) {
55008 if (tty->count == 1)
55009 info->port.tty = NULL; /* tty layer will release tty struct */
55010 - if(info->port.count)
55011 - info->port.count--;
55012 + if (atomic_read(&info->port.count))
55013 + atomic_dec(&info->port.count);
55014 }
55015
55016 return retval;
55017 @@ -7661,7 +7661,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
55018 unsigned short new_crctype;
55019
55020 /* return error if TTY interface open */
55021 - if (info->port.count)
55022 + if (atomic_read(&info->port.count))
55023 return -EBUSY;
55024
55025 switch (encoding)
55026 @@ -7756,7 +7756,7 @@ static int hdlcdev_open(struct net_device *dev)
55027
55028 /* arbitrate between network and tty opens */
55029 spin_lock_irqsave(&info->netlock, flags);
55030 - if (info->port.count != 0 || info->netcount != 0) {
55031 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
55032 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
55033 spin_unlock_irqrestore(&info->netlock, flags);
55034 return -EBUSY;
55035 @@ -7842,7 +7842,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
55036 printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name);
55037
55038 /* return error if TTY interface open */
55039 - if (info->port.count)
55040 + if (atomic_read(&info->port.count))
55041 return -EBUSY;
55042
55043 if (cmd != SIOCWANDEV)
55044 diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
55045 index 0e8c39b..e0cb171 100644
55046 --- a/drivers/tty/synclink_gt.c
55047 +++ b/drivers/tty/synclink_gt.c
55048 @@ -670,7 +670,7 @@ static int open(struct tty_struct *tty, struct file *filp)
55049 tty->driver_data = info;
55050 info->port.tty = tty;
55051
55052 - DBGINFO(("%s open, old ref count = %d\n", info->device_name, info->port.count));
55053 + DBGINFO(("%s open, old ref count = %d\n", info->device_name, atomic_read(&info->port.count)));
55054
55055 /* If port is closing, signal caller to try again */
55056 if (info->port.flags & ASYNC_CLOSING){
55057 @@ -691,10 +691,10 @@ static int open(struct tty_struct *tty, struct file *filp)
55058 mutex_unlock(&info->port.mutex);
55059 goto cleanup;
55060 }
55061 - info->port.count++;
55062 + atomic_inc(&info->port.count);
55063 spin_unlock_irqrestore(&info->netlock, flags);
55064
55065 - if (info->port.count == 1) {
55066 + if (atomic_read(&info->port.count) == 1) {
55067 /* 1st open on this device, init hardware */
55068 retval = startup(info);
55069 if (retval < 0) {
55070 @@ -715,8 +715,8 @@ cleanup:
55071 if (retval) {
55072 if (tty->count == 1)
55073 info->port.tty = NULL; /* tty layer will release tty struct */
55074 - if(info->port.count)
55075 - info->port.count--;
55076 + if(atomic_read(&info->port.count))
55077 + atomic_dec(&info->port.count);
55078 }
55079
55080 DBGINFO(("%s open rc=%d\n", info->device_name, retval));
55081 @@ -729,7 +729,7 @@ static void close(struct tty_struct *tty, struct file *filp)
55082
55083 if (sanity_check(info, tty->name, "close"))
55084 return;
55085 - DBGINFO(("%s close entry, count=%d\n", info->device_name, info->port.count));
55086 + DBGINFO(("%s close entry, count=%d\n", info->device_name, atomic_read(&info->port.count)));
55087
55088 if (tty_port_close_start(&info->port, tty, filp) == 0)
55089 goto cleanup;
55090 @@ -746,7 +746,7 @@ static void close(struct tty_struct *tty, struct file *filp)
55091 tty_port_close_end(&info->port, tty);
55092 info->port.tty = NULL;
55093 cleanup:
55094 - DBGINFO(("%s close exit, count=%d\n", tty->driver->name, info->port.count));
55095 + DBGINFO(("%s close exit, count=%d\n", tty->driver->name, atomic_read(&info->port.count)));
55096 }
55097
55098 static void hangup(struct tty_struct *tty)
55099 @@ -764,7 +764,7 @@ static void hangup(struct tty_struct *tty)
55100 shutdown(info);
55101
55102 spin_lock_irqsave(&info->port.lock, flags);
55103 - info->port.count = 0;
55104 + atomic_set(&info->port.count, 0);
55105 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
55106 info->port.tty = NULL;
55107 spin_unlock_irqrestore(&info->port.lock, flags);
55108 @@ -1449,7 +1449,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
55109 unsigned short new_crctype;
55110
55111 /* return error if TTY interface open */
55112 - if (info->port.count)
55113 + if (atomic_read(&info->port.count))
55114 return -EBUSY;
55115
55116 DBGINFO(("%s hdlcdev_attach\n", info->device_name));
55117 @@ -1544,7 +1544,7 @@ static int hdlcdev_open(struct net_device *dev)
55118
55119 /* arbitrate between network and tty opens */
55120 spin_lock_irqsave(&info->netlock, flags);
55121 - if (info->port.count != 0 || info->netcount != 0) {
55122 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
55123 DBGINFO(("%s hdlc_open busy\n", dev->name));
55124 spin_unlock_irqrestore(&info->netlock, flags);
55125 return -EBUSY;
55126 @@ -1629,7 +1629,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
55127 DBGINFO(("%s hdlcdev_ioctl\n", dev->name));
55128
55129 /* return error if TTY interface open */
55130 - if (info->port.count)
55131 + if (atomic_read(&info->port.count))
55132 return -EBUSY;
55133
55134 if (cmd != SIOCWANDEV)
55135 @@ -2413,7 +2413,7 @@ static irqreturn_t slgt_interrupt(int dummy, void *dev_id)
55136 if (port == NULL)
55137 continue;
55138 spin_lock(&port->lock);
55139 - if ((port->port.count || port->netcount) &&
55140 + if ((atomic_read(&port->port.count) || port->netcount) &&
55141 port->pending_bh && !port->bh_running &&
55142 !port->bh_requested) {
55143 DBGISR(("%s bh queued\n", port->device_name));
55144 @@ -3299,7 +3299,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
55145 add_wait_queue(&port->open_wait, &wait);
55146
55147 spin_lock_irqsave(&info->lock, flags);
55148 - port->count--;
55149 + atomic_dec(&port->count);
55150 spin_unlock_irqrestore(&info->lock, flags);
55151 port->blocked_open++;
55152
55153 @@ -3335,7 +3335,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
55154 remove_wait_queue(&port->open_wait, &wait);
55155
55156 if (!tty_hung_up_p(filp))
55157 - port->count++;
55158 + atomic_inc(&port->count);
55159 port->blocked_open--;
55160
55161 if (!retval)
55162 diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
55163 index c3f9091..abe4601 100644
55164 --- a/drivers/tty/synclinkmp.c
55165 +++ b/drivers/tty/synclinkmp.c
55166 @@ -750,7 +750,7 @@ static int open(struct tty_struct *tty, struct file *filp)
55167
55168 if (debug_level >= DEBUG_LEVEL_INFO)
55169 printk("%s(%d):%s open(), old ref count = %d\n",
55170 - __FILE__,__LINE__,tty->driver->name, info->port.count);
55171 + __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count));
55172
55173 /* If port is closing, signal caller to try again */
55174 if (info->port.flags & ASYNC_CLOSING){
55175 @@ -769,10 +769,10 @@ static int open(struct tty_struct *tty, struct file *filp)
55176 spin_unlock_irqrestore(&info->netlock, flags);
55177 goto cleanup;
55178 }
55179 - info->port.count++;
55180 + atomic_inc(&info->port.count);
55181 spin_unlock_irqrestore(&info->netlock, flags);
55182
55183 - if (info->port.count == 1) {
55184 + if (atomic_read(&info->port.count) == 1) {
55185 /* 1st open on this device, init hardware */
55186 retval = startup(info);
55187 if (retval < 0)
55188 @@ -796,8 +796,8 @@ cleanup:
55189 if (retval) {
55190 if (tty->count == 1)
55191 info->port.tty = NULL; /* tty layer will release tty struct */
55192 - if(info->port.count)
55193 - info->port.count--;
55194 + if(atomic_read(&info->port.count))
55195 + atomic_dec(&info->port.count);
55196 }
55197
55198 return retval;
55199 @@ -815,7 +815,7 @@ static void close(struct tty_struct *tty, struct file *filp)
55200
55201 if (debug_level >= DEBUG_LEVEL_INFO)
55202 printk("%s(%d):%s close() entry, count=%d\n",
55203 - __FILE__,__LINE__, info->device_name, info->port.count);
55204 + __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count));
55205
55206 if (tty_port_close_start(&info->port, tty, filp) == 0)
55207 goto cleanup;
55208 @@ -834,7 +834,7 @@ static void close(struct tty_struct *tty, struct file *filp)
55209 cleanup:
55210 if (debug_level >= DEBUG_LEVEL_INFO)
55211 printk("%s(%d):%s close() exit, count=%d\n", __FILE__,__LINE__,
55212 - tty->driver->name, info->port.count);
55213 + tty->driver->name, atomic_read(&info->port.count));
55214 }
55215
55216 /* Called by tty_hangup() when a hangup is signaled.
55217 @@ -857,7 +857,7 @@ static void hangup(struct tty_struct *tty)
55218 shutdown(info);
55219
55220 spin_lock_irqsave(&info->port.lock, flags);
55221 - info->port.count = 0;
55222 + atomic_set(&info->port.count, 0);
55223 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
55224 info->port.tty = NULL;
55225 spin_unlock_irqrestore(&info->port.lock, flags);
55226 @@ -1565,7 +1565,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
55227 unsigned short new_crctype;
55228
55229 /* return error if TTY interface open */
55230 - if (info->port.count)
55231 + if (atomic_read(&info->port.count))
55232 return -EBUSY;
55233
55234 switch (encoding)
55235 @@ -1660,7 +1660,7 @@ static int hdlcdev_open(struct net_device *dev)
55236
55237 /* arbitrate between network and tty opens */
55238 spin_lock_irqsave(&info->netlock, flags);
55239 - if (info->port.count != 0 || info->netcount != 0) {
55240 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
55241 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
55242 spin_unlock_irqrestore(&info->netlock, flags);
55243 return -EBUSY;
55244 @@ -1746,7 +1746,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
55245 printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name);
55246
55247 /* return error if TTY interface open */
55248 - if (info->port.count)
55249 + if (atomic_read(&info->port.count))
55250 return -EBUSY;
55251
55252 if (cmd != SIOCWANDEV)
55253 @@ -2621,7 +2621,7 @@ static irqreturn_t synclinkmp_interrupt(int dummy, void *dev_id)
55254 * do not request bottom half processing if the
55255 * device is not open in a normal mode.
55256 */
55257 - if ( port && (port->port.count || port->netcount) &&
55258 + if ( port && (atomic_read(&port->port.count) || port->netcount) &&
55259 port->pending_bh && !port->bh_running &&
55260 !port->bh_requested ) {
55261 if ( debug_level >= DEBUG_LEVEL_ISR )
55262 @@ -3318,10 +3318,10 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
55263
55264 if (debug_level >= DEBUG_LEVEL_INFO)
55265 printk("%s(%d):%s block_til_ready() before block, count=%d\n",
55266 - __FILE__,__LINE__, tty->driver->name, port->count );
55267 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
55268
55269 spin_lock_irqsave(&info->lock, flags);
55270 - port->count--;
55271 + atomic_dec(&port->count);
55272 spin_unlock_irqrestore(&info->lock, flags);
55273 port->blocked_open++;
55274
55275 @@ -3349,7 +3349,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
55276
55277 if (debug_level >= DEBUG_LEVEL_INFO)
55278 printk("%s(%d):%s block_til_ready() count=%d\n",
55279 - __FILE__,__LINE__, tty->driver->name, port->count );
55280 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
55281
55282 tty_unlock(tty);
55283 schedule();
55284 @@ -3359,12 +3359,12 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
55285 set_current_state(TASK_RUNNING);
55286 remove_wait_queue(&port->open_wait, &wait);
55287 if (!tty_hung_up_p(filp))
55288 - port->count++;
55289 + atomic_inc(&port->count);
55290 port->blocked_open--;
55291
55292 if (debug_level >= DEBUG_LEVEL_INFO)
55293 printk("%s(%d):%s block_til_ready() after, count=%d\n",
55294 - __FILE__,__LINE__, tty->driver->name, port->count );
55295 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
55296
55297 if (!retval)
55298 port->flags |= ASYNC_NORMAL_ACTIVE;
55299 diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
55300 index 843f2cd..7d530a6 100644
55301 --- a/drivers/tty/sysrq.c
55302 +++ b/drivers/tty/sysrq.c
55303 @@ -1086,7 +1086,7 @@ EXPORT_SYMBOL(unregister_sysrq_key);
55304 static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
55305 size_t count, loff_t *ppos)
55306 {
55307 - if (count) {
55308 + if (count && capable(CAP_SYS_ADMIN)) {
55309 char c;
55310
55311 if (get_user(c, buf))
55312 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
55313 index e569546..fbce20c 100644
55314 --- a/drivers/tty/tty_io.c
55315 +++ b/drivers/tty/tty_io.c
55316 @@ -3509,7 +3509,7 @@ EXPORT_SYMBOL(tty_devnum);
55317
55318 void tty_default_fops(struct file_operations *fops)
55319 {
55320 - *fops = tty_fops;
55321 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
55322 }
55323
55324 /*
55325 diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
55326 index 3737f55..7cef448 100644
55327 --- a/drivers/tty/tty_ldisc.c
55328 +++ b/drivers/tty/tty_ldisc.c
55329 @@ -71,7 +71,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
55330 raw_spin_lock_irqsave(&tty_ldiscs_lock, flags);
55331 tty_ldiscs[disc] = new_ldisc;
55332 new_ldisc->num = disc;
55333 - new_ldisc->refcount = 0;
55334 + atomic_set(&new_ldisc->refcount, 0);
55335 raw_spin_unlock_irqrestore(&tty_ldiscs_lock, flags);
55336
55337 return ret;
55338 @@ -99,7 +99,7 @@ int tty_unregister_ldisc(int disc)
55339 return -EINVAL;
55340
55341 raw_spin_lock_irqsave(&tty_ldiscs_lock, flags);
55342 - if (tty_ldiscs[disc]->refcount)
55343 + if (atomic_read(&tty_ldiscs[disc]->refcount))
55344 ret = -EBUSY;
55345 else
55346 tty_ldiscs[disc] = NULL;
55347 @@ -120,7 +120,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
55348 if (ldops) {
55349 ret = ERR_PTR(-EAGAIN);
55350 if (try_module_get(ldops->owner)) {
55351 - ldops->refcount++;
55352 + atomic_inc(&ldops->refcount);
55353 ret = ldops;
55354 }
55355 }
55356 @@ -133,7 +133,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
55357 unsigned long flags;
55358
55359 raw_spin_lock_irqsave(&tty_ldiscs_lock, flags);
55360 - ldops->refcount--;
55361 + atomic_dec(&ldops->refcount);
55362 module_put(ldops->owner);
55363 raw_spin_unlock_irqrestore(&tty_ldiscs_lock, flags);
55364 }
55365 diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
55366 index 40b31835..94d92ae 100644
55367 --- a/drivers/tty/tty_port.c
55368 +++ b/drivers/tty/tty_port.c
55369 @@ -236,7 +236,7 @@ void tty_port_hangup(struct tty_port *port)
55370 unsigned long flags;
55371
55372 spin_lock_irqsave(&port->lock, flags);
55373 - port->count = 0;
55374 + atomic_set(&port->count, 0);
55375 port->flags &= ~ASYNC_NORMAL_ACTIVE;
55376 tty = port->tty;
55377 if (tty)
55378 @@ -398,7 +398,7 @@ int tty_port_block_til_ready(struct tty_port *port,
55379
55380 /* The port lock protects the port counts */
55381 spin_lock_irqsave(&port->lock, flags);
55382 - port->count--;
55383 + atomic_dec(&port->count);
55384 port->blocked_open++;
55385 spin_unlock_irqrestore(&port->lock, flags);
55386
55387 @@ -440,7 +440,7 @@ int tty_port_block_til_ready(struct tty_port *port,
55388 we must not mess that up further */
55389 spin_lock_irqsave(&port->lock, flags);
55390 if (!tty_hung_up_p(filp))
55391 - port->count++;
55392 + atomic_inc(&port->count);
55393 port->blocked_open--;
55394 if (retval == 0)
55395 port->flags |= ASYNC_NORMAL_ACTIVE;
55396 @@ -476,19 +476,19 @@ int tty_port_close_start(struct tty_port *port,
55397 return 0;
55398
55399 spin_lock_irqsave(&port->lock, flags);
55400 - if (tty->count == 1 && port->count != 1) {
55401 + if (tty->count == 1 && atomic_read(&port->count) != 1) {
55402 printk(KERN_WARNING
55403 "tty_port_close_start: tty->count = 1 port count = %d.\n",
55404 - port->count);
55405 - port->count = 1;
55406 + atomic_read(&port->count));
55407 + atomic_set(&port->count, 1);
55408 }
55409 - if (--port->count < 0) {
55410 + if (atomic_dec_return(&port->count) < 0) {
55411 printk(KERN_WARNING "tty_port_close_start: count = %d\n",
55412 - port->count);
55413 - port->count = 0;
55414 + atomic_read(&port->count));
55415 + atomic_set(&port->count, 0);
55416 }
55417
55418 - if (port->count) {
55419 + if (atomic_read(&port->count)) {
55420 spin_unlock_irqrestore(&port->lock, flags);
55421 return 0;
55422 }
55423 @@ -590,7 +590,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
55424 struct file *filp)
55425 {
55426 spin_lock_irq(&port->lock);
55427 - ++port->count;
55428 + atomic_inc(&port->count);
55429 spin_unlock_irq(&port->lock);
55430 tty_port_tty_set(port, tty);
55431
55432 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
55433 index 8a89f6e..50b32af 100644
55434 --- a/drivers/tty/vt/keyboard.c
55435 +++ b/drivers/tty/vt/keyboard.c
55436 @@ -641,6 +641,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
55437 kbd->kbdmode == VC_OFF) &&
55438 value != KVAL(K_SAK))
55439 return; /* SAK is allowed even in raw mode */
55440 +
55441 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
55442 + {
55443 + void *func = fn_handler[value];
55444 + if (func == fn_show_state || func == fn_show_ptregs ||
55445 + func == fn_show_mem)
55446 + return;
55447 + }
55448 +#endif
55449 +
55450 fn_handler[value](vc);
55451 }
55452
55453 @@ -1776,9 +1786,6 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
55454 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
55455 return -EFAULT;
55456
55457 - if (!capable(CAP_SYS_TTY_CONFIG))
55458 - perm = 0;
55459 -
55460 switch (cmd) {
55461 case KDGKBENT:
55462 /* Ensure another thread doesn't free it under us */
55463 @@ -1793,6 +1800,9 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
55464 spin_unlock_irqrestore(&kbd_event_lock, flags);
55465 return put_user(val, &user_kbe->kb_value);
55466 case KDSKBENT:
55467 + if (!capable(CAP_SYS_TTY_CONFIG))
55468 + perm = 0;
55469 +
55470 if (!perm)
55471 return -EPERM;
55472 if (!i && v == K_NOSUCHMAP) {
55473 @@ -1883,9 +1893,6 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
55474 int i, j, k;
55475 int ret;
55476
55477 - if (!capable(CAP_SYS_TTY_CONFIG))
55478 - perm = 0;
55479 -
55480 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
55481 if (!kbs) {
55482 ret = -ENOMEM;
55483 @@ -1919,6 +1926,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
55484 kfree(kbs);
55485 return ((p && *p) ? -EOVERFLOW : 0);
55486 case KDSKBSENT:
55487 + if (!capable(CAP_SYS_TTY_CONFIG))
55488 + perm = 0;
55489 +
55490 if (!perm) {
55491 ret = -EPERM;
55492 goto reterr;
55493 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
55494 index 65bf067..b3b2e13 100644
55495 --- a/drivers/uio/uio.c
55496 +++ b/drivers/uio/uio.c
55497 @@ -25,6 +25,7 @@
55498 #include <linux/kobject.h>
55499 #include <linux/cdev.h>
55500 #include <linux/uio_driver.h>
55501 +#include <asm/local.h>
55502
55503 #define UIO_MAX_DEVICES (1U << MINORBITS)
55504
55505 @@ -231,7 +232,7 @@ static ssize_t event_show(struct device *dev,
55506 struct device_attribute *attr, char *buf)
55507 {
55508 struct uio_device *idev = dev_get_drvdata(dev);
55509 - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
55510 + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
55511 }
55512 static DEVICE_ATTR_RO(event);
55513
55514 @@ -393,7 +394,7 @@ void uio_event_notify(struct uio_info *info)
55515 {
55516 struct uio_device *idev = info->uio_dev;
55517
55518 - atomic_inc(&idev->event);
55519 + atomic_inc_unchecked(&idev->event);
55520 wake_up_interruptible(&idev->wait);
55521 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
55522 }
55523 @@ -446,7 +447,7 @@ static int uio_open(struct inode *inode, struct file *filep)
55524 }
55525
55526 listener->dev = idev;
55527 - listener->event_count = atomic_read(&idev->event);
55528 + listener->event_count = atomic_read_unchecked(&idev->event);
55529 filep->private_data = listener;
55530
55531 if (idev->info->open) {
55532 @@ -497,7 +498,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
55533 return -EIO;
55534
55535 poll_wait(filep, &idev->wait, wait);
55536 - if (listener->event_count != atomic_read(&idev->event))
55537 + if (listener->event_count != atomic_read_unchecked(&idev->event))
55538 return POLLIN | POLLRDNORM;
55539 return 0;
55540 }
55541 @@ -522,7 +523,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
55542 do {
55543 set_current_state(TASK_INTERRUPTIBLE);
55544
55545 - event_count = atomic_read(&idev->event);
55546 + event_count = atomic_read_unchecked(&idev->event);
55547 if (event_count != listener->event_count) {
55548 if (copy_to_user(buf, &event_count, count))
55549 retval = -EFAULT;
55550 @@ -579,9 +580,13 @@ static ssize_t uio_write(struct file *filep, const char __user *buf,
55551 static int uio_find_mem_index(struct vm_area_struct *vma)
55552 {
55553 struct uio_device *idev = vma->vm_private_data;
55554 + unsigned long size;
55555
55556 if (vma->vm_pgoff < MAX_UIO_MAPS) {
55557 - if (idev->info->mem[vma->vm_pgoff].size == 0)
55558 + size = idev->info->mem[vma->vm_pgoff].size;
55559 + if (size == 0)
55560 + return -1;
55561 + if (vma->vm_end - vma->vm_start > size)
55562 return -1;
55563 return (int)vma->vm_pgoff;
55564 }
55565 @@ -813,7 +818,7 @@ int __uio_register_device(struct module *owner,
55566 idev->owner = owner;
55567 idev->info = info;
55568 init_waitqueue_head(&idev->wait);
55569 - atomic_set(&idev->event, 0);
55570 + atomic_set_unchecked(&idev->event, 0);
55571
55572 ret = uio_get_minor(idev);
55573 if (ret)
55574 diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
55575 index 813d4d3..a71934f 100644
55576 --- a/drivers/usb/atm/cxacru.c
55577 +++ b/drivers/usb/atm/cxacru.c
55578 @@ -472,7 +472,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
55579 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
55580 if (ret < 2)
55581 return -EINVAL;
55582 - if (index < 0 || index > 0x7f)
55583 + if (index > 0x7f)
55584 return -EINVAL;
55585 pos += tmp;
55586
55587 diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
55588 index dada014..1d0d517 100644
55589 --- a/drivers/usb/atm/usbatm.c
55590 +++ b/drivers/usb/atm/usbatm.c
55591 @@ -331,7 +331,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
55592 if (printk_ratelimit())
55593 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
55594 __func__, vpi, vci);
55595 - atomic_inc(&vcc->stats->rx_err);
55596 + atomic_inc_unchecked(&vcc->stats->rx_err);
55597 return;
55598 }
55599
55600 @@ -358,7 +358,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
55601 if (length > ATM_MAX_AAL5_PDU) {
55602 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
55603 __func__, length, vcc);
55604 - atomic_inc(&vcc->stats->rx_err);
55605 + atomic_inc_unchecked(&vcc->stats->rx_err);
55606 goto out;
55607 }
55608
55609 @@ -367,14 +367,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
55610 if (sarb->len < pdu_length) {
55611 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
55612 __func__, pdu_length, sarb->len, vcc);
55613 - atomic_inc(&vcc->stats->rx_err);
55614 + atomic_inc_unchecked(&vcc->stats->rx_err);
55615 goto out;
55616 }
55617
55618 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
55619 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
55620 __func__, vcc);
55621 - atomic_inc(&vcc->stats->rx_err);
55622 + atomic_inc_unchecked(&vcc->stats->rx_err);
55623 goto out;
55624 }
55625
55626 @@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
55627 if (printk_ratelimit())
55628 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
55629 __func__, length);
55630 - atomic_inc(&vcc->stats->rx_drop);
55631 + atomic_inc_unchecked(&vcc->stats->rx_drop);
55632 goto out;
55633 }
55634
55635 @@ -414,7 +414,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
55636
55637 vcc->push(vcc, skb);
55638
55639 - atomic_inc(&vcc->stats->rx);
55640 + atomic_inc_unchecked(&vcc->stats->rx);
55641 out:
55642 skb_trim(sarb, 0);
55643 }
55644 @@ -612,7 +612,7 @@ static void usbatm_tx_process(unsigned long data)
55645 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
55646
55647 usbatm_pop(vcc, skb);
55648 - atomic_inc(&vcc->stats->tx);
55649 + atomic_inc_unchecked(&vcc->stats->tx);
55650
55651 skb = skb_dequeue(&instance->sndqueue);
55652 }
55653 @@ -756,11 +756,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t *pos, char *page
55654 if (!left--)
55655 return sprintf(page,
55656 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
55657 - atomic_read(&atm_dev->stats.aal5.tx),
55658 - atomic_read(&atm_dev->stats.aal5.tx_err),
55659 - atomic_read(&atm_dev->stats.aal5.rx),
55660 - atomic_read(&atm_dev->stats.aal5.rx_err),
55661 - atomic_read(&atm_dev->stats.aal5.rx_drop));
55662 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
55663 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
55664 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
55665 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
55666 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
55667
55668 if (!left--) {
55669 if (instance->disconnected)
55670 diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
55671 index 2a3bbdf..91d72cf 100644
55672 --- a/drivers/usb/core/devices.c
55673 +++ b/drivers/usb/core/devices.c
55674 @@ -126,7 +126,7 @@ static const char format_endpt[] =
55675 * time it gets called.
55676 */
55677 static struct device_connect_event {
55678 - atomic_t count;
55679 + atomic_unchecked_t count;
55680 wait_queue_head_t wait;
55681 } device_event = {
55682 .count = ATOMIC_INIT(1),
55683 @@ -164,7 +164,7 @@ static const struct class_info clas_info[] = {
55684
55685 void usbfs_conn_disc_event(void)
55686 {
55687 - atomic_add(2, &device_event.count);
55688 + atomic_add_unchecked(2, &device_event.count);
55689 wake_up(&device_event.wait);
55690 }
55691
55692 @@ -652,7 +652,7 @@ static unsigned int usb_device_poll(struct file *file,
55693
55694 poll_wait(file, &device_event.wait, wait);
55695
55696 - event_count = atomic_read(&device_event.count);
55697 + event_count = atomic_read_unchecked(&device_event.count);
55698 if (file->f_version != event_count) {
55699 file->f_version = event_count;
55700 return POLLIN | POLLRDNORM;
55701 diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
55702 index 4b0448c..fc84bec 100644
55703 --- a/drivers/usb/core/devio.c
55704 +++ b/drivers/usb/core/devio.c
55705 @@ -187,7 +187,7 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
55706 struct usb_dev_state *ps = file->private_data;
55707 struct usb_device *dev = ps->dev;
55708 ssize_t ret = 0;
55709 - unsigned len;
55710 + size_t len;
55711 loff_t pos;
55712 int i;
55713
55714 @@ -229,22 +229,22 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
55715 for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
55716 struct usb_config_descriptor *config =
55717 (struct usb_config_descriptor *)dev->rawdescriptors[i];
55718 - unsigned int length = le16_to_cpu(config->wTotalLength);
55719 + size_t length = le16_to_cpu(config->wTotalLength);
55720
55721 if (*ppos < pos + length) {
55722
55723 /* The descriptor may claim to be longer than it
55724 * really is. Here is the actual allocated length. */
55725 - unsigned alloclen =
55726 + size_t alloclen =
55727 le16_to_cpu(dev->config[i].desc.wTotalLength);
55728
55729 - len = length - (*ppos - pos);
55730 + len = length + pos - *ppos;
55731 if (len > nbytes)
55732 len = nbytes;
55733
55734 /* Simply don't write (skip over) unallocated parts */
55735 if (alloclen > (*ppos - pos)) {
55736 - alloclen -= (*ppos - pos);
55737 + alloclen = alloclen + pos - *ppos;
55738 if (copy_to_user(buf,
55739 dev->rawdescriptors[i] + (*ppos - pos),
55740 min(len, alloclen))) {
55741 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
55742 index 45a915c..09f9735 100644
55743 --- a/drivers/usb/core/hcd.c
55744 +++ b/drivers/usb/core/hcd.c
55745 @@ -1551,7 +1551,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
55746 */
55747 usb_get_urb(urb);
55748 atomic_inc(&urb->use_count);
55749 - atomic_inc(&urb->dev->urbnum);
55750 + atomic_inc_unchecked(&urb->dev->urbnum);
55751 usbmon_urb_submit(&hcd->self, urb);
55752
55753 /* NOTE requirements on root-hub callers (usbfs and the hub
55754 @@ -1578,7 +1578,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
55755 urb->hcpriv = NULL;
55756 INIT_LIST_HEAD(&urb->urb_list);
55757 atomic_dec(&urb->use_count);
55758 - atomic_dec(&urb->dev->urbnum);
55759 + atomic_dec_unchecked(&urb->dev->urbnum);
55760 if (atomic_read(&urb->reject))
55761 wake_up(&usb_kill_urb_queue);
55762 usb_put_urb(urb);
55763 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
55764 index 3b71516..1f26579 100644
55765 --- a/drivers/usb/core/hub.c
55766 +++ b/drivers/usb/core/hub.c
55767 @@ -26,6 +26,7 @@
55768 #include <linux/mutex.h>
55769 #include <linux/random.h>
55770 #include <linux/pm_qos.h>
55771 +#include <linux/grsecurity.h>
55772
55773 #include <asm/uaccess.h>
55774 #include <asm/byteorder.h>
55775 @@ -4665,6 +4666,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
55776 goto done;
55777 return;
55778 }
55779 +
55780 + if (gr_handle_new_usb())
55781 + goto done;
55782 +
55783 if (hub_is_superspeed(hub->hdev))
55784 unit_load = 150;
55785 else
55786 diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
55787 index f368d20..0c30ac5 100644
55788 --- a/drivers/usb/core/message.c
55789 +++ b/drivers/usb/core/message.c
55790 @@ -128,7 +128,7 @@ static int usb_internal_control_msg(struct usb_device *usb_dev,
55791 * Return: If successful, the number of bytes transferred. Otherwise, a negative
55792 * error number.
55793 */
55794 -int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
55795 +int __intentional_overflow(-1) usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
55796 __u8 requesttype, __u16 value, __u16 index, void *data,
55797 __u16 size, int timeout)
55798 {
55799 @@ -180,7 +180,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg);
55800 * If successful, 0. Otherwise a negative error number. The number of actual
55801 * bytes transferred will be stored in the @actual_length parameter.
55802 */
55803 -int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
55804 +int __intentional_overflow(-1) usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
55805 void *data, int len, int *actual_length, int timeout)
55806 {
55807 return usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout);
55808 @@ -220,7 +220,7 @@ EXPORT_SYMBOL_GPL(usb_interrupt_msg);
55809 * bytes transferred will be stored in the @actual_length parameter.
55810 *
55811 */
55812 -int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
55813 +int __intentional_overflow(-1) usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
55814 void *data, int len, int *actual_length, int timeout)
55815 {
55816 struct urb *urb;
55817 diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
55818 index d269738..7340cd7 100644
55819 --- a/drivers/usb/core/sysfs.c
55820 +++ b/drivers/usb/core/sysfs.c
55821 @@ -244,7 +244,7 @@ static ssize_t urbnum_show(struct device *dev, struct device_attribute *attr,
55822 struct usb_device *udev;
55823
55824 udev = to_usb_device(dev);
55825 - return sprintf(buf, "%d\n", atomic_read(&udev->urbnum));
55826 + return sprintf(buf, "%d\n", atomic_read_unchecked(&udev->urbnum));
55827 }
55828 static DEVICE_ATTR_RO(urbnum);
55829
55830 diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
55831 index 8d5b2f4..3896940 100644
55832 --- a/drivers/usb/core/usb.c
55833 +++ b/drivers/usb/core/usb.c
55834 @@ -447,7 +447,7 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
55835 set_dev_node(&dev->dev, dev_to_node(bus->controller));
55836 dev->state = USB_STATE_ATTACHED;
55837 dev->lpm_disable_count = 1;
55838 - atomic_set(&dev->urbnum, 0);
55839 + atomic_set_unchecked(&dev->urbnum, 0);
55840
55841 INIT_LIST_HEAD(&dev->ep0.urb_list);
55842 dev->ep0.desc.bLength = USB_DT_ENDPOINT_SIZE;
55843 diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
55844 index 8cfc319..4868255 100644
55845 --- a/drivers/usb/early/ehci-dbgp.c
55846 +++ b/drivers/usb/early/ehci-dbgp.c
55847 @@ -98,7 +98,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
55848
55849 #ifdef CONFIG_KGDB
55850 static struct kgdb_io kgdbdbgp_io_ops;
55851 -#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
55852 +static struct kgdb_io kgdbdbgp_io_ops_console;
55853 +#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
55854 #else
55855 #define dbgp_kgdb_mode (0)
55856 #endif
55857 @@ -1043,6 +1044,13 @@ static struct kgdb_io kgdbdbgp_io_ops = {
55858 .write_char = kgdbdbgp_write_char,
55859 };
55860
55861 +static struct kgdb_io kgdbdbgp_io_ops_console = {
55862 + .name = "kgdbdbgp",
55863 + .read_char = kgdbdbgp_read_char,
55864 + .write_char = kgdbdbgp_write_char,
55865 + .is_console = 1
55866 +};
55867 +
55868 static int kgdbdbgp_wait_time;
55869
55870 static int __init kgdbdbgp_parse_config(char *str)
55871 @@ -1058,8 +1066,10 @@ static int __init kgdbdbgp_parse_config(char *str)
55872 ptr++;
55873 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
55874 }
55875 - kgdb_register_io_module(&kgdbdbgp_io_ops);
55876 - kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
55877 + if (early_dbgp_console.index != -1)
55878 + kgdb_register_io_module(&kgdbdbgp_io_ops_console);
55879 + else
55880 + kgdb_register_io_module(&kgdbdbgp_io_ops);
55881
55882 return 0;
55883 }
55884 diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
55885 index 0495c94..289e201 100644
55886 --- a/drivers/usb/gadget/configfs.c
55887 +++ b/drivers/usb/gadget/configfs.c
55888 @@ -571,7 +571,7 @@ static struct config_group *function_make(
55889 if (IS_ERR(fi))
55890 return ERR_CAST(fi);
55891
55892 - ret = config_item_set_name(&fi->group.cg_item, name);
55893 + ret = config_item_set_name(&fi->group.cg_item, "%s", name);
55894 if (ret) {
55895 usb_put_function_instance(fi);
55896 return ERR_PTR(ret);
55897 diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
55898 index 7856b33..8b7fe09 100644
55899 --- a/drivers/usb/gadget/function/f_uac1.c
55900 +++ b/drivers/usb/gadget/function/f_uac1.c
55901 @@ -14,6 +14,7 @@
55902 #include <linux/module.h>
55903 #include <linux/device.h>
55904 #include <linux/atomic.h>
55905 +#include <linux/module.h>
55906
55907 #include "u_uac1.h"
55908
55909 diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
55910 index 7ee05793..2e31e99 100644
55911 --- a/drivers/usb/gadget/function/u_serial.c
55912 +++ b/drivers/usb/gadget/function/u_serial.c
55913 @@ -732,9 +732,9 @@ static int gs_open(struct tty_struct *tty, struct file *file)
55914 spin_lock_irq(&port->port_lock);
55915
55916 /* already open? Great. */
55917 - if (port->port.count) {
55918 + if (atomic_read(&port->port.count)) {
55919 status = 0;
55920 - port->port.count++;
55921 + atomic_inc(&port->port.count);
55922
55923 /* currently opening/closing? wait ... */
55924 } else if (port->openclose) {
55925 @@ -793,7 +793,7 @@ static int gs_open(struct tty_struct *tty, struct file *file)
55926 tty->driver_data = port;
55927 port->port.tty = tty;
55928
55929 - port->port.count = 1;
55930 + atomic_set(&port->port.count, 1);
55931 port->openclose = false;
55932
55933 /* if connected, start the I/O stream */
55934 @@ -835,11 +835,11 @@ static void gs_close(struct tty_struct *tty, struct file *file)
55935
55936 spin_lock_irq(&port->port_lock);
55937
55938 - if (port->port.count != 1) {
55939 - if (port->port.count == 0)
55940 + if (atomic_read(&port->port.count) != 1) {
55941 + if (atomic_read(&port->port.count) == 0)
55942 WARN_ON(1);
55943 else
55944 - --port->port.count;
55945 + atomic_dec(&port->port.count);
55946 goto exit;
55947 }
55948
55949 @@ -849,7 +849,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
55950 * and sleep if necessary
55951 */
55952 port->openclose = true;
55953 - port->port.count = 0;
55954 + atomic_set(&port->port.count, 0);
55955
55956 gser = port->port_usb;
55957 if (gser && gser->disconnect)
55958 @@ -1065,7 +1065,7 @@ static int gs_closed(struct gs_port *port)
55959 int cond;
55960
55961 spin_lock_irq(&port->port_lock);
55962 - cond = (port->port.count == 0) && !port->openclose;
55963 + cond = (atomic_read(&port->port.count) == 0) && !port->openclose;
55964 spin_unlock_irq(&port->port_lock);
55965 return cond;
55966 }
55967 @@ -1208,7 +1208,7 @@ int gserial_connect(struct gserial *gser, u8 port_num)
55968 /* if it's already open, start I/O ... and notify the serial
55969 * protocol about open/close status (connect/disconnect).
55970 */
55971 - if (port->port.count) {
55972 + if (atomic_read(&port->port.count)) {
55973 pr_debug("gserial_connect: start ttyGS%d\n", port->port_num);
55974 gs_start_io(port);
55975 if (gser->connect)
55976 @@ -1255,7 +1255,7 @@ void gserial_disconnect(struct gserial *gser)
55977
55978 port->port_usb = NULL;
55979 gser->ioport = NULL;
55980 - if (port->port.count > 0 || port->openclose) {
55981 + if (atomic_read(&port->port.count) > 0 || port->openclose) {
55982 wake_up_interruptible(&port->drain_wait);
55983 if (port->port.tty)
55984 tty_hangup(port->port.tty);
55985 @@ -1271,7 +1271,7 @@ void gserial_disconnect(struct gserial *gser)
55986
55987 /* finally, free any unused/unusable I/O buffers */
55988 spin_lock_irqsave(&port->port_lock, flags);
55989 - if (port->port.count == 0 && !port->openclose)
55990 + if (atomic_read(&port->port.count) == 0 && !port->openclose)
55991 gs_buf_free(&port->port_write_buf);
55992 gs_free_requests(gser->out, &port->read_pool, NULL);
55993 gs_free_requests(gser->out, &port->read_queue, NULL);
55994 diff --git a/drivers/usb/gadget/function/u_uac1.c b/drivers/usb/gadget/function/u_uac1.c
55995 index c78c841..48fd281 100644
55996 --- a/drivers/usb/gadget/function/u_uac1.c
55997 +++ b/drivers/usb/gadget/function/u_uac1.c
55998 @@ -17,6 +17,7 @@
55999 #include <linux/ctype.h>
56000 #include <linux/random.h>
56001 #include <linux/syscalls.h>
56002 +#include <linux/module.h>
56003
56004 #include "u_uac1.h"
56005
56006 diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
56007 index 6920844..480bb7e 100644
56008 --- a/drivers/usb/host/ehci-hub.c
56009 +++ b/drivers/usb/host/ehci-hub.c
56010 @@ -772,7 +772,7 @@ static struct urb *request_single_step_set_feature_urb(
56011 urb->transfer_flags = URB_DIR_IN;
56012 usb_get_urb(urb);
56013 atomic_inc(&urb->use_count);
56014 - atomic_inc(&urb->dev->urbnum);
56015 + atomic_inc_unchecked(&urb->dev->urbnum);
56016 urb->setup_dma = dma_map_single(
56017 hcd->self.controller,
56018 urb->setup_packet,
56019 @@ -839,7 +839,7 @@ static int ehset_single_step_set_feature(struct usb_hcd *hcd, int port)
56020 urb->status = -EINPROGRESS;
56021 usb_get_urb(urb);
56022 atomic_inc(&urb->use_count);
56023 - atomic_inc(&urb->dev->urbnum);
56024 + atomic_inc_unchecked(&urb->dev->urbnum);
56025 retval = submit_single_step_set_feature(hcd, urb, 0);
56026 if (!retval && !wait_for_completion_timeout(&done,
56027 msecs_to_jiffies(2000))) {
56028 diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
56029 index 1db0626..4948782 100644
56030 --- a/drivers/usb/host/hwa-hc.c
56031 +++ b/drivers/usb/host/hwa-hc.c
56032 @@ -337,7 +337,10 @@ static int __hwahc_op_bwa_set(struct wusbhc *wusbhc, s8 stream_index,
56033 struct hwahc *hwahc = container_of(wusbhc, struct hwahc, wusbhc);
56034 struct wahc *wa = &hwahc->wa;
56035 struct device *dev = &wa->usb_iface->dev;
56036 - u8 mas_le[UWB_NUM_MAS/8];
56037 + u8 *mas_le = kmalloc(UWB_NUM_MAS/8, GFP_KERNEL);
56038 +
56039 + if (mas_le == NULL)
56040 + return -ENOMEM;
56041
56042 /* Set the stream index */
56043 result = usb_control_msg(wa->usb_dev, usb_sndctrlpipe(wa->usb_dev, 0),
56044 @@ -356,10 +359,12 @@ static int __hwahc_op_bwa_set(struct wusbhc *wusbhc, s8 stream_index,
56045 WUSB_REQ_SET_WUSB_MAS,
56046 USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
56047 0, wa->usb_iface->cur_altsetting->desc.bInterfaceNumber,
56048 - mas_le, 32, USB_CTRL_SET_TIMEOUT);
56049 + mas_le, UWB_NUM_MAS/8, USB_CTRL_SET_TIMEOUT);
56050 if (result < 0)
56051 dev_err(dev, "Cannot set WUSB MAS allocation: %d\n", result);
56052 out:
56053 + kfree(mas_le);
56054 +
56055 return result;
56056 }
56057
56058 diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
56059 index a0a3827..d7ec10b 100644
56060 --- a/drivers/usb/misc/appledisplay.c
56061 +++ b/drivers/usb/misc/appledisplay.c
56062 @@ -84,7 +84,7 @@ struct appledisplay {
56063 struct mutex sysfslock; /* concurrent read and write */
56064 };
56065
56066 -static atomic_t count_displays = ATOMIC_INIT(0);
56067 +static atomic_unchecked_t count_displays = ATOMIC_INIT(0);
56068 static struct workqueue_struct *wq;
56069
56070 static void appledisplay_complete(struct urb *urb)
56071 @@ -288,7 +288,7 @@ static int appledisplay_probe(struct usb_interface *iface,
56072
56073 /* Register backlight device */
56074 snprintf(bl_name, sizeof(bl_name), "appledisplay%d",
56075 - atomic_inc_return(&count_displays) - 1);
56076 + atomic_inc_return_unchecked(&count_displays) - 1);
56077 memset(&props, 0, sizeof(struct backlight_properties));
56078 props.type = BACKLIGHT_RAW;
56079 props.max_brightness = 0xff;
56080 diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
56081 index 3806e70..55c508b 100644
56082 --- a/drivers/usb/serial/console.c
56083 +++ b/drivers/usb/serial/console.c
56084 @@ -126,7 +126,7 @@ static int usb_console_setup(struct console *co, char *options)
56085
56086 info->port = port;
56087
56088 - ++port->port.count;
56089 + atomic_inc(&port->port.count);
56090 if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
56091 if (serial->type->set_termios) {
56092 /*
56093 @@ -175,7 +175,7 @@ static int usb_console_setup(struct console *co, char *options)
56094 }
56095 /* Now that any required fake tty operations are completed restore
56096 * the tty port count */
56097 - --port->port.count;
56098 + atomic_dec(&port->port.count);
56099 /* The console is special in terms of closing the device so
56100 * indicate this port is now acting as a system console. */
56101 port->port.console = 1;
56102 @@ -188,7 +188,7 @@ static int usb_console_setup(struct console *co, char *options)
56103 put_tty:
56104 tty_kref_put(tty);
56105 reset_open_count:
56106 - port->port.count = 0;
56107 + atomic_set(&port->port.count, 0);
56108 usb_autopm_put_interface(serial->interface);
56109 error_get_interface:
56110 usb_serial_put(serial);
56111 @@ -199,7 +199,7 @@ static int usb_console_setup(struct console *co, char *options)
56112 static void usb_console_write(struct console *co,
56113 const char *buf, unsigned count)
56114 {
56115 - static struct usbcons_info *info = &usbcons_info;
56116 + struct usbcons_info *info = &usbcons_info;
56117 struct usb_serial_port *port = info->port;
56118 struct usb_serial *serial;
56119 int retval = -ENODEV;
56120 diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
56121 index 307e339..6aa97cb 100644
56122 --- a/drivers/usb/storage/usb.h
56123 +++ b/drivers/usb/storage/usb.h
56124 @@ -63,7 +63,7 @@ struct us_unusual_dev {
56125 __u8 useProtocol;
56126 __u8 useTransport;
56127 int (*initFunction)(struct us_data *);
56128 -};
56129 +} __do_const;
56130
56131
56132 /* Dynamic bitflag definitions (us->dflags): used in set_bit() etc. */
56133 diff --git a/drivers/usb/usbip/vhci.h b/drivers/usb/usbip/vhci.h
56134 index a863a98..d272795 100644
56135 --- a/drivers/usb/usbip/vhci.h
56136 +++ b/drivers/usb/usbip/vhci.h
56137 @@ -83,7 +83,7 @@ struct vhci_hcd {
56138 unsigned resuming:1;
56139 unsigned long re_timeout;
56140
56141 - atomic_t seqnum;
56142 + atomic_unchecked_t seqnum;
56143
56144 /*
56145 * NOTE:
56146 diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
56147 index e9ef1ec..c3a0b04 100644
56148 --- a/drivers/usb/usbip/vhci_hcd.c
56149 +++ b/drivers/usb/usbip/vhci_hcd.c
56150 @@ -440,7 +440,7 @@ static void vhci_tx_urb(struct urb *urb)
56151
56152 spin_lock(&vdev->priv_lock);
56153
56154 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
56155 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
56156 if (priv->seqnum == 0xffff)
56157 dev_info(&urb->dev->dev, "seqnum max\n");
56158
56159 @@ -685,7 +685,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
56160 return -ENOMEM;
56161 }
56162
56163 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
56164 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
56165 if (unlink->seqnum == 0xffff)
56166 pr_info("seqnum max\n");
56167
56168 @@ -889,7 +889,7 @@ static int vhci_start(struct usb_hcd *hcd)
56169 vdev->rhport = rhport;
56170 }
56171
56172 - atomic_set(&vhci->seqnum, 0);
56173 + atomic_set_unchecked(&vhci->seqnum, 0);
56174 spin_lock_init(&vhci->lock);
56175
56176 hcd->power_budget = 0; /* no limit */
56177 diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
56178 index 00e4a54..d676f85 100644
56179 --- a/drivers/usb/usbip/vhci_rx.c
56180 +++ b/drivers/usb/usbip/vhci_rx.c
56181 @@ -80,7 +80,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
56182 if (!urb) {
56183 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
56184 pr_info("max seqnum %d\n",
56185 - atomic_read(&the_controller->seqnum));
56186 + atomic_read_unchecked(&the_controller->seqnum));
56187 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
56188 return;
56189 }
56190 diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
56191 index edc7267..9f65ce2 100644
56192 --- a/drivers/usb/wusbcore/wa-hc.h
56193 +++ b/drivers/usb/wusbcore/wa-hc.h
56194 @@ -240,7 +240,7 @@ struct wahc {
56195 spinlock_t xfer_list_lock;
56196 struct work_struct xfer_enqueue_work;
56197 struct work_struct xfer_error_work;
56198 - atomic_t xfer_id_count;
56199 + atomic_unchecked_t xfer_id_count;
56200
56201 kernel_ulong_t quirks;
56202 };
56203 @@ -305,7 +305,7 @@ static inline void wa_init(struct wahc *wa)
56204 INIT_WORK(&wa->xfer_enqueue_work, wa_urb_enqueue_run);
56205 INIT_WORK(&wa->xfer_error_work, wa_process_errored_transfers_run);
56206 wa->dto_in_use = 0;
56207 - atomic_set(&wa->xfer_id_count, 1);
56208 + atomic_set_unchecked(&wa->xfer_id_count, 1);
56209 /* init the buf in URBs */
56210 for (index = 0; index < WA_MAX_BUF_IN_URBS; ++index)
56211 usb_init_urb(&(wa->buf_in_urbs[index]));
56212 diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
56213 index 69af4fd..da390d7 100644
56214 --- a/drivers/usb/wusbcore/wa-xfer.c
56215 +++ b/drivers/usb/wusbcore/wa-xfer.c
56216 @@ -314,7 +314,7 @@ static void wa_xfer_completion(struct wa_xfer *xfer)
56217 */
56218 static void wa_xfer_id_init(struct wa_xfer *xfer)
56219 {
56220 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
56221 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
56222 }
56223
56224 /* Return the xfer's ID. */
56225 diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
56226 index e1278fe..7fdeac4 100644
56227 --- a/drivers/vfio/vfio.c
56228 +++ b/drivers/vfio/vfio.c
56229 @@ -517,7 +517,7 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
56230 return 0;
56231
56232 /* TODO Prevent device auto probing */
56233 - WARN("Device %s added to live group %d!\n", dev_name(dev),
56234 + WARN(1, "Device %s added to live group %d!\n", dev_name(dev),
56235 iommu_group_id(group->iommu_group));
56236
56237 return 0;
56238 diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
56239 index 3bb02c6..a01ff38 100644
56240 --- a/drivers/vhost/vringh.c
56241 +++ b/drivers/vhost/vringh.c
56242 @@ -551,7 +551,7 @@ static inline void __vringh_notify_disable(struct vringh *vrh,
56243 static inline int getu16_user(const struct vringh *vrh, u16 *val, const __virtio16 *p)
56244 {
56245 __virtio16 v = 0;
56246 - int rc = get_user(v, (__force __virtio16 __user *)p);
56247 + int rc = get_user(v, (__force_user __virtio16 *)p);
56248 *val = vringh16_to_cpu(vrh, v);
56249 return rc;
56250 }
56251 @@ -559,12 +559,12 @@ static inline int getu16_user(const struct vringh *vrh, u16 *val, const __virtio
56252 static inline int putu16_user(const struct vringh *vrh, __virtio16 *p, u16 val)
56253 {
56254 __virtio16 v = cpu_to_vringh16(vrh, val);
56255 - return put_user(v, (__force __virtio16 __user *)p);
56256 + return put_user(v, (__force_user __virtio16 *)p);
56257 }
56258
56259 static inline int copydesc_user(void *dst, const void *src, size_t len)
56260 {
56261 - return copy_from_user(dst, (__force void __user *)src, len) ?
56262 + return copy_from_user(dst, (void __force_user *)src, len) ?
56263 -EFAULT : 0;
56264 }
56265
56266 @@ -572,19 +572,19 @@ static inline int putused_user(struct vring_used_elem *dst,
56267 const struct vring_used_elem *src,
56268 unsigned int num)
56269 {
56270 - return copy_to_user((__force void __user *)dst, src,
56271 + return copy_to_user((void __force_user *)dst, src,
56272 sizeof(*dst) * num) ? -EFAULT : 0;
56273 }
56274
56275 static inline int xfer_from_user(void *src, void *dst, size_t len)
56276 {
56277 - return copy_from_user(dst, (__force void __user *)src, len) ?
56278 + return copy_from_user(dst, (void __force_user *)src, len) ?
56279 -EFAULT : 0;
56280 }
56281
56282 static inline int xfer_to_user(void *dst, void *src, size_t len)
56283 {
56284 - return copy_to_user((__force void __user *)dst, src, len) ?
56285 + return copy_to_user((void __force_user *)dst, src, len) ?
56286 -EFAULT : 0;
56287 }
56288
56289 @@ -621,9 +621,9 @@ int vringh_init_user(struct vringh *vrh, u64 features,
56290 vrh->last_used_idx = 0;
56291 vrh->vring.num = num;
56292 /* vring expects kernel addresses, but only used via accessors. */
56293 - vrh->vring.desc = (__force struct vring_desc *)desc;
56294 - vrh->vring.avail = (__force struct vring_avail *)avail;
56295 - vrh->vring.used = (__force struct vring_used *)used;
56296 + vrh->vring.desc = (__force_kernel struct vring_desc *)desc;
56297 + vrh->vring.avail = (__force_kernel struct vring_avail *)avail;
56298 + vrh->vring.used = (__force_kernel struct vring_used *)used;
56299 return 0;
56300 }
56301 EXPORT_SYMBOL(vringh_init_user);
56302 @@ -826,7 +826,7 @@ static inline int getu16_kern(const struct vringh *vrh,
56303
56304 static inline int putu16_kern(const struct vringh *vrh, __virtio16 *p, u16 val)
56305 {
56306 - ACCESS_ONCE(*p) = cpu_to_vringh16(vrh, val);
56307 + ACCESS_ONCE_RW(*p) = cpu_to_vringh16(vrh, val);
56308 return 0;
56309 }
56310
56311 diff --git a/drivers/video/backlight/kb3886_bl.c b/drivers/video/backlight/kb3886_bl.c
56312 index 84a110a..96312c3 100644
56313 --- a/drivers/video/backlight/kb3886_bl.c
56314 +++ b/drivers/video/backlight/kb3886_bl.c
56315 @@ -78,7 +78,7 @@ static struct kb3886bl_machinfo *bl_machinfo;
56316 static unsigned long kb3886bl_flags;
56317 #define KB3886BL_SUSPENDED 0x01
56318
56319 -static struct dmi_system_id kb3886bl_device_table[] __initdata = {
56320 +static const struct dmi_system_id kb3886bl_device_table[] __initconst = {
56321 {
56322 .ident = "Sahara Touch-iT",
56323 .matches = {
56324 diff --git a/drivers/video/fbdev/arcfb.c b/drivers/video/fbdev/arcfb.c
56325 index 1b0b233..6f34c2c 100644
56326 --- a/drivers/video/fbdev/arcfb.c
56327 +++ b/drivers/video/fbdev/arcfb.c
56328 @@ -458,7 +458,7 @@ static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
56329 return -ENOSPC;
56330
56331 err = 0;
56332 - if ((count + p) > fbmemlength) {
56333 + if (count > (fbmemlength - p)) {
56334 count = fbmemlength - p;
56335 err = -ENOSPC;
56336 }
56337 diff --git a/drivers/video/fbdev/aty/aty128fb.c b/drivers/video/fbdev/aty/aty128fb.c
56338 index 0156954..c07d4e0 100644
56339 --- a/drivers/video/fbdev/aty/aty128fb.c
56340 +++ b/drivers/video/fbdev/aty/aty128fb.c
56341 @@ -149,7 +149,7 @@ enum {
56342 };
56343
56344 /* Must match above enum */
56345 -static char * const r128_family[] = {
56346 +static const char * const r128_family[] = {
56347 "AGP",
56348 "PCI",
56349 "PRO AGP",
56350 diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
56351 index 8789e48..698fe4c 100644
56352 --- a/drivers/video/fbdev/aty/atyfb_base.c
56353 +++ b/drivers/video/fbdev/aty/atyfb_base.c
56354 @@ -1326,10 +1326,14 @@ static int atyfb_set_par(struct fb_info *info)
56355 par->accel_flags = var->accel_flags; /* hack */
56356
56357 if (var->accel_flags) {
56358 - info->fbops->fb_sync = atyfb_sync;
56359 + pax_open_kernel();
56360 + *(void **)&info->fbops->fb_sync = atyfb_sync;
56361 + pax_close_kernel();
56362 info->flags &= ~FBINFO_HWACCEL_DISABLED;
56363 } else {
56364 - info->fbops->fb_sync = NULL;
56365 + pax_open_kernel();
56366 + *(void **)&info->fbops->fb_sync = NULL;
56367 + pax_close_kernel();
56368 info->flags |= FBINFO_HWACCEL_DISABLED;
56369 }
56370
56371 diff --git a/drivers/video/fbdev/aty/mach64_cursor.c b/drivers/video/fbdev/aty/mach64_cursor.c
56372 index 2fa0317..4983f2a 100644
56373 --- a/drivers/video/fbdev/aty/mach64_cursor.c
56374 +++ b/drivers/video/fbdev/aty/mach64_cursor.c
56375 @@ -8,6 +8,7 @@
56376 #include "../core/fb_draw.h"
56377
56378 #include <asm/io.h>
56379 +#include <asm/pgtable.h>
56380
56381 #ifdef __sparc__
56382 #include <asm/fbio.h>
56383 @@ -218,7 +219,9 @@ int aty_init_cursor(struct fb_info *info)
56384 info->sprite.buf_align = 16; /* and 64 lines tall. */
56385 info->sprite.flags = FB_PIXMAP_IO;
56386
56387 - info->fbops->fb_cursor = atyfb_cursor;
56388 + pax_open_kernel();
56389 + *(void **)&info->fbops->fb_cursor = atyfb_cursor;
56390 + pax_close_kernel();
56391
56392 return 0;
56393 }
56394 diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
56395 index d6cab1f..112f680 100644
56396 --- a/drivers/video/fbdev/core/fb_defio.c
56397 +++ b/drivers/video/fbdev/core/fb_defio.c
56398 @@ -207,7 +207,9 @@ void fb_deferred_io_init(struct fb_info *info)
56399
56400 BUG_ON(!fbdefio);
56401 mutex_init(&fbdefio->lock);
56402 - info->fbops->fb_mmap = fb_deferred_io_mmap;
56403 + pax_open_kernel();
56404 + *(void **)&info->fbops->fb_mmap = fb_deferred_io_mmap;
56405 + pax_close_kernel();
56406 INIT_DELAYED_WORK(&info->deferred_work, fb_deferred_io_work);
56407 INIT_LIST_HEAD(&fbdefio->pagelist);
56408 if (fbdefio->delay == 0) /* set a default of 1 s */
56409 @@ -238,7 +240,7 @@ void fb_deferred_io_cleanup(struct fb_info *info)
56410 page->mapping = NULL;
56411 }
56412
56413 - info->fbops->fb_mmap = NULL;
56414 + *(void **)&info->fbops->fb_mmap = NULL;
56415 mutex_destroy(&fbdefio->lock);
56416 }
56417 EXPORT_SYMBOL_GPL(fb_deferred_io_cleanup);
56418 diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
56419 index 0705d88..d9429bf 100644
56420 --- a/drivers/video/fbdev/core/fbmem.c
56421 +++ b/drivers/video/fbdev/core/fbmem.c
56422 @@ -1301,7 +1301,7 @@ static int do_fscreeninfo_to_user(struct fb_fix_screeninfo *fix,
56423 __u32 data;
56424 int err;
56425
56426 - err = copy_to_user(&fix32->id, &fix->id, sizeof(fix32->id));
56427 + err = copy_to_user(fix32->id, &fix->id, sizeof(fix32->id));
56428
56429 data = (__u32) (unsigned long) fix->smem_start;
56430 err |= put_user(data, &fix32->smem_start);
56431 diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
56432 index 807ee22..7814cd6 100644
56433 --- a/drivers/video/fbdev/hyperv_fb.c
56434 +++ b/drivers/video/fbdev/hyperv_fb.c
56435 @@ -240,7 +240,7 @@ static uint screen_fb_size;
56436 static inline int synthvid_send(struct hv_device *hdev,
56437 struct synthvid_msg *msg)
56438 {
56439 - static atomic64_t request_id = ATOMIC64_INIT(0);
56440 + static atomic64_unchecked_t request_id = ATOMIC64_INIT(0);
56441 int ret;
56442
56443 msg->pipe_hdr.type = PIPE_MSG_DATA;
56444 @@ -248,7 +248,7 @@ static inline int synthvid_send(struct hv_device *hdev,
56445
56446 ret = vmbus_sendpacket(hdev->channel, msg,
56447 msg->vid_hdr.size + sizeof(struct pipe_msg_hdr),
56448 - atomic64_inc_return(&request_id),
56449 + atomic64_inc_return_unchecked(&request_id),
56450 VM_PKT_DATA_INBAND, 0);
56451
56452 if (ret)
56453 diff --git a/drivers/video/fbdev/i810/i810_accel.c b/drivers/video/fbdev/i810/i810_accel.c
56454 index 7672d2e..b56437f 100644
56455 --- a/drivers/video/fbdev/i810/i810_accel.c
56456 +++ b/drivers/video/fbdev/i810/i810_accel.c
56457 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
56458 }
56459 }
56460 printk("ringbuffer lockup!!!\n");
56461 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
56462 i810_report_error(mmio);
56463 par->dev_flags |= LOCKUP;
56464 info->pixmap.scan_align = 1;
56465 diff --git a/drivers/video/fbdev/matrox/matroxfb_DAC1064.c b/drivers/video/fbdev/matrox/matroxfb_DAC1064.c
56466 index a01147f..5d896f8 100644
56467 --- a/drivers/video/fbdev/matrox/matroxfb_DAC1064.c
56468 +++ b/drivers/video/fbdev/matrox/matroxfb_DAC1064.c
56469 @@ -1088,14 +1088,20 @@ static void MGAG100_restore(struct matrox_fb_info *minfo)
56470
56471 #ifdef CONFIG_FB_MATROX_MYSTIQUE
56472 struct matrox_switch matrox_mystique = {
56473 - MGA1064_preinit, MGA1064_reset, MGA1064_init, MGA1064_restore,
56474 + .preinit = MGA1064_preinit,
56475 + .reset = MGA1064_reset,
56476 + .init = MGA1064_init,
56477 + .restore = MGA1064_restore,
56478 };
56479 EXPORT_SYMBOL(matrox_mystique);
56480 #endif
56481
56482 #ifdef CONFIG_FB_MATROX_G
56483 struct matrox_switch matrox_G100 = {
56484 - MGAG100_preinit, MGAG100_reset, MGAG100_init, MGAG100_restore,
56485 + .preinit = MGAG100_preinit,
56486 + .reset = MGAG100_reset,
56487 + .init = MGAG100_init,
56488 + .restore = MGAG100_restore,
56489 };
56490 EXPORT_SYMBOL(matrox_G100);
56491 #endif
56492 diff --git a/drivers/video/fbdev/matrox/matroxfb_Ti3026.c b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
56493 index 195ad7c..09743fc 100644
56494 --- a/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
56495 +++ b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
56496 @@ -738,7 +738,10 @@ static int Ti3026_preinit(struct matrox_fb_info *minfo)
56497 }
56498
56499 struct matrox_switch matrox_millennium = {
56500 - Ti3026_preinit, Ti3026_reset, Ti3026_init, Ti3026_restore
56501 + .preinit = Ti3026_preinit,
56502 + .reset = Ti3026_reset,
56503 + .init = Ti3026_init,
56504 + .restore = Ti3026_restore
56505 };
56506 EXPORT_SYMBOL(matrox_millennium);
56507 #endif
56508 diff --git a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
56509 index fe92eed..106e085 100644
56510 --- a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
56511 +++ b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
56512 @@ -312,14 +312,18 @@ void mb862xxfb_init_accel(struct fb_info *info, int xres)
56513 struct mb862xxfb_par *par = info->par;
56514
56515 if (info->var.bits_per_pixel == 32) {
56516 - info->fbops->fb_fillrect = cfb_fillrect;
56517 - info->fbops->fb_copyarea = cfb_copyarea;
56518 - info->fbops->fb_imageblit = cfb_imageblit;
56519 + pax_open_kernel();
56520 + *(void **)&info->fbops->fb_fillrect = cfb_fillrect;
56521 + *(void **)&info->fbops->fb_copyarea = cfb_copyarea;
56522 + *(void **)&info->fbops->fb_imageblit = cfb_imageblit;
56523 + pax_close_kernel();
56524 } else {
56525 outreg(disp, GC_L0EM, 3);
56526 - info->fbops->fb_fillrect = mb86290fb_fillrect;
56527 - info->fbops->fb_copyarea = mb86290fb_copyarea;
56528 - info->fbops->fb_imageblit = mb86290fb_imageblit;
56529 + pax_open_kernel();
56530 + *(void **)&info->fbops->fb_fillrect = mb86290fb_fillrect;
56531 + *(void **)&info->fbops->fb_copyarea = mb86290fb_copyarea;
56532 + *(void **)&info->fbops->fb_imageblit = mb86290fb_imageblit;
56533 + pax_close_kernel();
56534 }
56535 outreg(draw, GDC_REG_DRAW_BASE, 0);
56536 outreg(draw, GDC_REG_MODE_MISC, 0x8000);
56537 diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
56538 index 4273c6e..b413013 100644
56539 --- a/drivers/video/fbdev/nvidia/nvidia.c
56540 +++ b/drivers/video/fbdev/nvidia/nvidia.c
56541 @@ -665,19 +665,23 @@ static int nvidiafb_set_par(struct fb_info *info)
56542 info->fix.line_length = (info->var.xres_virtual *
56543 info->var.bits_per_pixel) >> 3;
56544 if (info->var.accel_flags) {
56545 - info->fbops->fb_imageblit = nvidiafb_imageblit;
56546 - info->fbops->fb_fillrect = nvidiafb_fillrect;
56547 - info->fbops->fb_copyarea = nvidiafb_copyarea;
56548 - info->fbops->fb_sync = nvidiafb_sync;
56549 + pax_open_kernel();
56550 + *(void **)&info->fbops->fb_imageblit = nvidiafb_imageblit;
56551 + *(void **)&info->fbops->fb_fillrect = nvidiafb_fillrect;
56552 + *(void **)&info->fbops->fb_copyarea = nvidiafb_copyarea;
56553 + *(void **)&info->fbops->fb_sync = nvidiafb_sync;
56554 + pax_close_kernel();
56555 info->pixmap.scan_align = 4;
56556 info->flags &= ~FBINFO_HWACCEL_DISABLED;
56557 info->flags |= FBINFO_READS_FAST;
56558 NVResetGraphics(info);
56559 } else {
56560 - info->fbops->fb_imageblit = cfb_imageblit;
56561 - info->fbops->fb_fillrect = cfb_fillrect;
56562 - info->fbops->fb_copyarea = cfb_copyarea;
56563 - info->fbops->fb_sync = NULL;
56564 + pax_open_kernel();
56565 + *(void **)&info->fbops->fb_imageblit = cfb_imageblit;
56566 + *(void **)&info->fbops->fb_fillrect = cfb_fillrect;
56567 + *(void **)&info->fbops->fb_copyarea = cfb_copyarea;
56568 + *(void **)&info->fbops->fb_sync = NULL;
56569 + pax_close_kernel();
56570 info->pixmap.scan_align = 1;
56571 info->flags |= FBINFO_HWACCEL_DISABLED;
56572 info->flags &= ~FBINFO_READS_FAST;
56573 @@ -1169,8 +1173,11 @@ static int nvidia_set_fbinfo(struct fb_info *info)
56574 info->pixmap.size = 8 * 1024;
56575 info->pixmap.flags = FB_PIXMAP_SYSTEM;
56576
56577 - if (!hwcur)
56578 - info->fbops->fb_cursor = NULL;
56579 + if (!hwcur) {
56580 + pax_open_kernel();
56581 + *(void **)&info->fbops->fb_cursor = NULL;
56582 + pax_close_kernel();
56583 + }
56584
56585 info->var.accel_flags = (!noaccel);
56586
56587 diff --git a/drivers/video/fbdev/omap2/dss/display.c b/drivers/video/fbdev/omap2/dss/display.c
56588 index ef5b902..47cf7f5 100644
56589 --- a/drivers/video/fbdev/omap2/dss/display.c
56590 +++ b/drivers/video/fbdev/omap2/dss/display.c
56591 @@ -161,12 +161,14 @@ int omapdss_register_display(struct omap_dss_device *dssdev)
56592 if (dssdev->name == NULL)
56593 dssdev->name = dssdev->alias;
56594
56595 + pax_open_kernel();
56596 if (drv && drv->get_resolution == NULL)
56597 - drv->get_resolution = omapdss_default_get_resolution;
56598 + *(void **)&drv->get_resolution = omapdss_default_get_resolution;
56599 if (drv && drv->get_recommended_bpp == NULL)
56600 - drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
56601 + *(void **)&drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
56602 if (drv && drv->get_timings == NULL)
56603 - drv->get_timings = omapdss_default_get_timings;
56604 + *(void **)&drv->get_timings = omapdss_default_get_timings;
56605 + pax_close_kernel();
56606
56607 mutex_lock(&panel_list_mutex);
56608 list_add_tail(&dssdev->panel_list, &panel_list);
56609 diff --git a/drivers/video/fbdev/s1d13xxxfb.c b/drivers/video/fbdev/s1d13xxxfb.c
56610 index 83433cb..71e9b98 100644
56611 --- a/drivers/video/fbdev/s1d13xxxfb.c
56612 +++ b/drivers/video/fbdev/s1d13xxxfb.c
56613 @@ -881,8 +881,10 @@ static int s1d13xxxfb_probe(struct platform_device *pdev)
56614
56615 switch(prod_id) {
56616 case S1D13506_PROD_ID: /* activate acceleration */
56617 - s1d13xxxfb_fbops.fb_fillrect = s1d13xxxfb_bitblt_solidfill;
56618 - s1d13xxxfb_fbops.fb_copyarea = s1d13xxxfb_bitblt_copyarea;
56619 + pax_open_kernel();
56620 + *(void **)&s1d13xxxfb_fbops.fb_fillrect = s1d13xxxfb_bitblt_solidfill;
56621 + *(void **)&s1d13xxxfb_fbops.fb_copyarea = s1d13xxxfb_bitblt_copyarea;
56622 + pax_close_kernel();
56623 info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_YPAN |
56624 FBINFO_HWACCEL_FILLRECT | FBINFO_HWACCEL_COPYAREA;
56625 break;
56626 diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
56627 index 82c0a8c..42499a1 100644
56628 --- a/drivers/video/fbdev/sh_mobile_lcdcfb.c
56629 +++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c
56630 @@ -439,9 +439,9 @@ static unsigned long lcdc_sys_read_data(void *handle)
56631 }
56632
56633 static struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
56634 - lcdc_sys_write_index,
56635 - lcdc_sys_write_data,
56636 - lcdc_sys_read_data,
56637 + .write_index = lcdc_sys_write_index,
56638 + .write_data = lcdc_sys_write_data,
56639 + .read_data = lcdc_sys_read_data,
56640 };
56641
56642 static int sh_mobile_lcdc_sginit(struct fb_info *info,
56643 diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
56644 index 9279e5f..d5f5276 100644
56645 --- a/drivers/video/fbdev/smscufx.c
56646 +++ b/drivers/video/fbdev/smscufx.c
56647 @@ -1174,7 +1174,9 @@ static int ufx_ops_release(struct fb_info *info, int user)
56648 fb_deferred_io_cleanup(info);
56649 kfree(info->fbdefio);
56650 info->fbdefio = NULL;
56651 - info->fbops->fb_mmap = ufx_ops_mmap;
56652 + pax_open_kernel();
56653 + *(void **)&info->fbops->fb_mmap = ufx_ops_mmap;
56654 + pax_close_kernel();
56655 }
56656
56657 pr_debug("released /dev/fb%d user=%d count=%d",
56658 diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
56659 index ff2b873..626a8d5 100644
56660 --- a/drivers/video/fbdev/udlfb.c
56661 +++ b/drivers/video/fbdev/udlfb.c
56662 @@ -623,11 +623,11 @@ static int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
56663 dlfb_urb_completion(urb);
56664
56665 error:
56666 - atomic_add(bytes_sent, &dev->bytes_sent);
56667 - atomic_add(bytes_identical, &dev->bytes_identical);
56668 - atomic_add(width*height*2, &dev->bytes_rendered);
56669 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
56670 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
56671 + atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
56672 end_cycles = get_cycles();
56673 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
56674 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
56675 >> 10)), /* Kcycles */
56676 &dev->cpu_kcycles_used);
56677
56678 @@ -748,11 +748,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
56679 dlfb_urb_completion(urb);
56680
56681 error:
56682 - atomic_add(bytes_sent, &dev->bytes_sent);
56683 - atomic_add(bytes_identical, &dev->bytes_identical);
56684 - atomic_add(bytes_rendered, &dev->bytes_rendered);
56685 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
56686 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
56687 + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
56688 end_cycles = get_cycles();
56689 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
56690 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
56691 >> 10)), /* Kcycles */
56692 &dev->cpu_kcycles_used);
56693 }
56694 @@ -991,7 +991,9 @@ static int dlfb_ops_release(struct fb_info *info, int user)
56695 fb_deferred_io_cleanup(info);
56696 kfree(info->fbdefio);
56697 info->fbdefio = NULL;
56698 - info->fbops->fb_mmap = dlfb_ops_mmap;
56699 + pax_open_kernel();
56700 + *(void **)&info->fbops->fb_mmap = dlfb_ops_mmap;
56701 + pax_close_kernel();
56702 }
56703
56704 pr_warn("released /dev/fb%d user=%d count=%d\n",
56705 @@ -1373,7 +1375,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
56706 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56707 struct dlfb_data *dev = fb_info->par;
56708 return snprintf(buf, PAGE_SIZE, "%u\n",
56709 - atomic_read(&dev->bytes_rendered));
56710 + atomic_read_unchecked(&dev->bytes_rendered));
56711 }
56712
56713 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
56714 @@ -1381,7 +1383,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
56715 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56716 struct dlfb_data *dev = fb_info->par;
56717 return snprintf(buf, PAGE_SIZE, "%u\n",
56718 - atomic_read(&dev->bytes_identical));
56719 + atomic_read_unchecked(&dev->bytes_identical));
56720 }
56721
56722 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
56723 @@ -1389,7 +1391,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
56724 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56725 struct dlfb_data *dev = fb_info->par;
56726 return snprintf(buf, PAGE_SIZE, "%u\n",
56727 - atomic_read(&dev->bytes_sent));
56728 + atomic_read_unchecked(&dev->bytes_sent));
56729 }
56730
56731 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
56732 @@ -1397,7 +1399,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
56733 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56734 struct dlfb_data *dev = fb_info->par;
56735 return snprintf(buf, PAGE_SIZE, "%u\n",
56736 - atomic_read(&dev->cpu_kcycles_used));
56737 + atomic_read_unchecked(&dev->cpu_kcycles_used));
56738 }
56739
56740 static ssize_t edid_show(
56741 @@ -1457,10 +1459,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
56742 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56743 struct dlfb_data *dev = fb_info->par;
56744
56745 - atomic_set(&dev->bytes_rendered, 0);
56746 - atomic_set(&dev->bytes_identical, 0);
56747 - atomic_set(&dev->bytes_sent, 0);
56748 - atomic_set(&dev->cpu_kcycles_used, 0);
56749 + atomic_set_unchecked(&dev->bytes_rendered, 0);
56750 + atomic_set_unchecked(&dev->bytes_identical, 0);
56751 + atomic_set_unchecked(&dev->bytes_sent, 0);
56752 + atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
56753
56754 return count;
56755 }
56756 diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
56757 index d32d1c4..46722e6 100644
56758 --- a/drivers/video/fbdev/uvesafb.c
56759 +++ b/drivers/video/fbdev/uvesafb.c
56760 @@ -19,6 +19,7 @@
56761 #include <linux/io.h>
56762 #include <linux/mutex.h>
56763 #include <linux/slab.h>
56764 +#include <linux/moduleloader.h>
56765 #include <video/edid.h>
56766 #include <video/uvesafb.h>
56767 #ifdef CONFIG_X86
56768 @@ -565,10 +566,32 @@ static int uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
56769 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
56770 par->pmi_setpal = par->ypan = 0;
56771 } else {
56772 +
56773 +#ifdef CONFIG_PAX_KERNEXEC
56774 +#ifdef CONFIG_MODULES
56775 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
56776 +#endif
56777 + if (!par->pmi_code) {
56778 + par->pmi_setpal = par->ypan = 0;
56779 + return 0;
56780 + }
56781 +#endif
56782 +
56783 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
56784 + task->t.regs.edi);
56785 +
56786 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56787 + pax_open_kernel();
56788 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
56789 + pax_close_kernel();
56790 +
56791 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
56792 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
56793 +#else
56794 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
56795 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
56796 +#endif
56797 +
56798 printk(KERN_INFO "uvesafb: protected mode interface info at "
56799 "%04x:%04x\n",
56800 (u16)task->t.regs.es, (u16)task->t.regs.edi);
56801 @@ -813,13 +836,14 @@ static int uvesafb_vbe_init(struct fb_info *info)
56802 par->ypan = ypan;
56803
56804 if (par->pmi_setpal || par->ypan) {
56805 +#if !defined(CONFIG_MODULES) || !defined(CONFIG_PAX_KERNEXEC)
56806 if (__supported_pte_mask & _PAGE_NX) {
56807 par->pmi_setpal = par->ypan = 0;
56808 printk(KERN_WARNING "uvesafb: NX protection is active, "
56809 "better not use the PMI.\n");
56810 - } else {
56811 + } else
56812 +#endif
56813 uvesafb_vbe_getpmi(task, par);
56814 - }
56815 }
56816 #else
56817 /* The protected mode interface is not available on non-x86. */
56818 @@ -1452,8 +1476,11 @@ static void uvesafb_init_info(struct fb_info *info, struct vbe_mode_ib *mode)
56819 info->fix.ywrapstep = (par->ypan > 1) ? 1 : 0;
56820
56821 /* Disable blanking if the user requested so. */
56822 - if (!blank)
56823 - info->fbops->fb_blank = NULL;
56824 + if (!blank) {
56825 + pax_open_kernel();
56826 + *(void **)&info->fbops->fb_blank = NULL;
56827 + pax_close_kernel();
56828 + }
56829
56830 /*
56831 * Find out how much IO memory is required for the mode with
56832 @@ -1524,8 +1551,11 @@ static void uvesafb_init_info(struct fb_info *info, struct vbe_mode_ib *mode)
56833 info->flags = FBINFO_FLAG_DEFAULT |
56834 (par->ypan ? FBINFO_HWACCEL_YPAN : 0);
56835
56836 - if (!par->ypan)
56837 - info->fbops->fb_pan_display = NULL;
56838 + if (!par->ypan) {
56839 + pax_open_kernel();
56840 + *(void **)&info->fbops->fb_pan_display = NULL;
56841 + pax_close_kernel();
56842 + }
56843 }
56844
56845 static void uvesafb_init_mtrr(struct fb_info *info)
56846 @@ -1786,6 +1816,11 @@ out_mode:
56847 out:
56848 kfree(par->vbe_modes);
56849
56850 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56851 + if (par->pmi_code)
56852 + module_memfree_exec(par->pmi_code);
56853 +#endif
56854 +
56855 framebuffer_release(info);
56856 return err;
56857 }
56858 @@ -1810,6 +1845,11 @@ static int uvesafb_remove(struct platform_device *dev)
56859 kfree(par->vbe_state_orig);
56860 kfree(par->vbe_state_saved);
56861
56862 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56863 + if (par->pmi_code)
56864 + module_memfree_exec(par->pmi_code);
56865 +#endif
56866 +
56867 framebuffer_release(info);
56868 }
56869 return 0;
56870 diff --git a/drivers/video/fbdev/vesafb.c b/drivers/video/fbdev/vesafb.c
56871 index d79a0ac..2d0c3d4 100644
56872 --- a/drivers/video/fbdev/vesafb.c
56873 +++ b/drivers/video/fbdev/vesafb.c
56874 @@ -9,6 +9,7 @@
56875 */
56876
56877 #include <linux/module.h>
56878 +#include <linux/moduleloader.h>
56879 #include <linux/kernel.h>
56880 #include <linux/errno.h>
56881 #include <linux/string.h>
56882 @@ -52,8 +53,8 @@ static int vram_remap; /* Set amount of memory to be used */
56883 static int vram_total; /* Set total amount of memory */
56884 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
56885 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
56886 -static void (*pmi_start)(void) __read_mostly;
56887 -static void (*pmi_pal) (void) __read_mostly;
56888 +static void (*pmi_start)(void) __read_only;
56889 +static void (*pmi_pal) (void) __read_only;
56890 static int depth __read_mostly;
56891 static int vga_compat __read_mostly;
56892 /* --------------------------------------------------------------------- */
56893 @@ -233,6 +234,7 @@ static int vesafb_probe(struct platform_device *dev)
56894 unsigned int size_remap;
56895 unsigned int size_total;
56896 char *option = NULL;
56897 + void *pmi_code = NULL;
56898
56899 /* ignore error return of fb_get_options */
56900 fb_get_options("vesafb", &option);
56901 @@ -279,10 +281,6 @@ static int vesafb_probe(struct platform_device *dev)
56902 size_remap = size_total;
56903 vesafb_fix.smem_len = size_remap;
56904
56905 -#ifndef __i386__
56906 - screen_info.vesapm_seg = 0;
56907 -#endif
56908 -
56909 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
56910 printk(KERN_WARNING
56911 "vesafb: cannot reserve video memory at 0x%lx\n",
56912 @@ -312,9 +310,21 @@ static int vesafb_probe(struct platform_device *dev)
56913 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
56914 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
56915
56916 +#ifdef __i386__
56917 +
56918 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56919 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
56920 + if (!pmi_code)
56921 +#elif !defined(CONFIG_PAX_KERNEXEC)
56922 + if (0)
56923 +#endif
56924 +
56925 +#endif
56926 + screen_info.vesapm_seg = 0;
56927 +
56928 if (screen_info.vesapm_seg) {
56929 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
56930 - screen_info.vesapm_seg,screen_info.vesapm_off);
56931 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
56932 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
56933 }
56934
56935 if (screen_info.vesapm_seg < 0xc000)
56936 @@ -322,9 +332,25 @@ static int vesafb_probe(struct platform_device *dev)
56937
56938 if (ypan || pmi_setpal) {
56939 unsigned short *pmi_base;
56940 +
56941 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
56942 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
56943 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
56944 +
56945 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56946 + pax_open_kernel();
56947 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
56948 +#else
56949 + pmi_code = pmi_base;
56950 +#endif
56951 +
56952 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
56953 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
56954 +
56955 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56956 + pmi_start = ktva_ktla(pmi_start);
56957 + pmi_pal = ktva_ktla(pmi_pal);
56958 + pax_close_kernel();
56959 +#endif
56960 +
56961 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
56962 if (pmi_base[3]) {
56963 printk(KERN_INFO "vesafb: pmi: ports = ");
56964 @@ -477,8 +503,11 @@ static int vesafb_probe(struct platform_device *dev)
56965 info->flags = FBINFO_FLAG_DEFAULT | FBINFO_MISC_FIRMWARE |
56966 (ypan ? FBINFO_HWACCEL_YPAN : 0);
56967
56968 - if (!ypan)
56969 - info->fbops->fb_pan_display = NULL;
56970 + if (!ypan) {
56971 + pax_open_kernel();
56972 + *(void **)&info->fbops->fb_pan_display = NULL;
56973 + pax_close_kernel();
56974 + }
56975
56976 if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
56977 err = -ENOMEM;
56978 @@ -492,6 +521,11 @@ static int vesafb_probe(struct platform_device *dev)
56979 fb_info(info, "%s frame buffer device\n", info->fix.id);
56980 return 0;
56981 err:
56982 +
56983 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56984 + module_memfree_exec(pmi_code);
56985 +#endif
56986 +
56987 if (info->screen_base)
56988 iounmap(info->screen_base);
56989 framebuffer_release(info);
56990 diff --git a/drivers/video/fbdev/via/via_clock.h b/drivers/video/fbdev/via/via_clock.h
56991 index 88714ae..16c2e11 100644
56992 --- a/drivers/video/fbdev/via/via_clock.h
56993 +++ b/drivers/video/fbdev/via/via_clock.h
56994 @@ -56,7 +56,7 @@ struct via_clock {
56995
56996 void (*set_engine_pll_state)(u8 state);
56997 void (*set_engine_pll)(struct via_pll_config config);
56998 -};
56999 +} __no_const;
57000
57001
57002 static inline u32 get_pll_internal_frequency(u32 ref_freq,
57003 diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
57004 index 3c14e43..2630570 100644
57005 --- a/drivers/video/logo/logo_linux_clut224.ppm
57006 +++ b/drivers/video/logo/logo_linux_clut224.ppm
57007 @@ -2,1603 +2,1123 @@ P3
57008 # Standard 224-color Linux logo
57009 80 80
57010 255
57011 - 0 0 0 0 0 0 0 0 0 0 0 0
57012 - 0 0 0 0 0 0 0 0 0 0 0 0
57013 - 0 0 0 0 0 0 0 0 0 0 0 0
57014 - 0 0 0 0 0 0 0 0 0 0 0 0
57015 - 0 0 0 0 0 0 0 0 0 0 0 0
57016 - 0 0 0 0 0 0 0 0 0 0 0 0
57017 - 0 0 0 0 0 0 0 0 0 0 0 0
57018 - 0 0 0 0 0 0 0 0 0 0 0 0
57019 - 0 0 0 0 0 0 0 0 0 0 0 0
57020 - 6 6 6 6 6 6 10 10 10 10 10 10
57021 - 10 10 10 6 6 6 6 6 6 6 6 6
57022 - 0 0 0 0 0 0 0 0 0 0 0 0
57023 - 0 0 0 0 0 0 0 0 0 0 0 0
57024 - 0 0 0 0 0 0 0 0 0 0 0 0
57025 - 0 0 0 0 0 0 0 0 0 0 0 0
57026 - 0 0 0 0 0 0 0 0 0 0 0 0
57027 - 0 0 0 0 0 0 0 0 0 0 0 0
57028 - 0 0 0 0 0 0 0 0 0 0 0 0
57029 - 0 0 0 0 0 0 0 0 0 0 0 0
57030 - 0 0 0 0 0 0 0 0 0 0 0 0
57031 - 0 0 0 0 0 0 0 0 0 0 0 0
57032 - 0 0 0 0 0 0 0 0 0 0 0 0
57033 - 0 0 0 0 0 0 0 0 0 0 0 0
57034 - 0 0 0 0 0 0 0 0 0 0 0 0
57035 - 0 0 0 0 0 0 0 0 0 0 0 0
57036 - 0 0 0 0 0 0 0 0 0 0 0 0
57037 - 0 0 0 0 0 0 0 0 0 0 0 0
57038 - 0 0 0 0 0 0 0 0 0 0 0 0
57039 - 0 0 0 6 6 6 10 10 10 14 14 14
57040 - 22 22 22 26 26 26 30 30 30 34 34 34
57041 - 30 30 30 30 30 30 26 26 26 18 18 18
57042 - 14 14 14 10 10 10 6 6 6 0 0 0
57043 - 0 0 0 0 0 0 0 0 0 0 0 0
57044 - 0 0 0 0 0 0 0 0 0 0 0 0
57045 - 0 0 0 0 0 0 0 0 0 0 0 0
57046 - 0 0 0 0 0 0 0 0 0 0 0 0
57047 - 0 0 0 0 0 0 0 0 0 0 0 0
57048 - 0 0 0 0 0 0 0 0 0 0 0 0
57049 - 0 0 0 0 0 0 0 0 0 0 0 0
57050 - 0 0 0 0 0 0 0 0 0 0 0 0
57051 - 0 0 0 0 0 0 0 0 0 0 0 0
57052 - 0 0 0 0 0 1 0 0 1 0 0 0
57053 - 0 0 0 0 0 0 0 0 0 0 0 0
57054 - 0 0 0 0 0 0 0 0 0 0 0 0
57055 - 0 0 0 0 0 0 0 0 0 0 0 0
57056 - 0 0 0 0 0 0 0 0 0 0 0 0
57057 - 0 0 0 0 0 0 0 0 0 0 0 0
57058 - 0 0 0 0 0 0 0 0 0 0 0 0
57059 - 6 6 6 14 14 14 26 26 26 42 42 42
57060 - 54 54 54 66 66 66 78 78 78 78 78 78
57061 - 78 78 78 74 74 74 66 66 66 54 54 54
57062 - 42 42 42 26 26 26 18 18 18 10 10 10
57063 - 6 6 6 0 0 0 0 0 0 0 0 0
57064 - 0 0 0 0 0 0 0 0 0 0 0 0
57065 - 0 0 0 0 0 0 0 0 0 0 0 0
57066 - 0 0 0 0 0 0 0 0 0 0 0 0
57067 - 0 0 0 0 0 0 0 0 0 0 0 0
57068 - 0 0 0 0 0 0 0 0 0 0 0 0
57069 - 0 0 0 0 0 0 0 0 0 0 0 0
57070 - 0 0 0 0 0 0 0 0 0 0 0 0
57071 - 0 0 0 0 0 0 0 0 0 0 0 0
57072 - 0 0 1 0 0 0 0 0 0 0 0 0
57073 - 0 0 0 0 0 0 0 0 0 0 0 0
57074 - 0 0 0 0 0 0 0 0 0 0 0 0
57075 - 0 0 0 0 0 0 0 0 0 0 0 0
57076 - 0 0 0 0 0 0 0 0 0 0 0 0
57077 - 0 0 0 0 0 0 0 0 0 0 0 0
57078 - 0 0 0 0 0 0 0 0 0 10 10 10
57079 - 22 22 22 42 42 42 66 66 66 86 86 86
57080 - 66 66 66 38 38 38 38 38 38 22 22 22
57081 - 26 26 26 34 34 34 54 54 54 66 66 66
57082 - 86 86 86 70 70 70 46 46 46 26 26 26
57083 - 14 14 14 6 6 6 0 0 0 0 0 0
57084 - 0 0 0 0 0 0 0 0 0 0 0 0
57085 - 0 0 0 0 0 0 0 0 0 0 0 0
57086 - 0 0 0 0 0 0 0 0 0 0 0 0
57087 - 0 0 0 0 0 0 0 0 0 0 0 0
57088 - 0 0 0 0 0 0 0 0 0 0 0 0
57089 - 0 0 0 0 0 0 0 0 0 0 0 0
57090 - 0 0 0 0 0 0 0 0 0 0 0 0
57091 - 0 0 0 0 0 0 0 0 0 0 0 0
57092 - 0 0 1 0 0 1 0 0 1 0 0 0
57093 - 0 0 0 0 0 0 0 0 0 0 0 0
57094 - 0 0 0 0 0 0 0 0 0 0 0 0
57095 - 0 0 0 0 0 0 0 0 0 0 0 0
57096 - 0 0 0 0 0 0 0 0 0 0 0 0
57097 - 0 0 0 0 0 0 0 0 0 0 0 0
57098 - 0 0 0 0 0 0 10 10 10 26 26 26
57099 - 50 50 50 82 82 82 58 58 58 6 6 6
57100 - 2 2 6 2 2 6 2 2 6 2 2 6
57101 - 2 2 6 2 2 6 2 2 6 2 2 6
57102 - 6 6 6 54 54 54 86 86 86 66 66 66
57103 - 38 38 38 18 18 18 6 6 6 0 0 0
57104 - 0 0 0 0 0 0 0 0 0 0 0 0
57105 - 0 0 0 0 0 0 0 0 0 0 0 0
57106 - 0 0 0 0 0 0 0 0 0 0 0 0
57107 - 0 0 0 0 0 0 0 0 0 0 0 0
57108 - 0 0 0 0 0 0 0 0 0 0 0 0
57109 - 0 0 0 0 0 0 0 0 0 0 0 0
57110 - 0 0 0 0 0 0 0 0 0 0 0 0
57111 - 0 0 0 0 0 0 0 0 0 0 0 0
57112 - 0 0 0 0 0 0 0 0 0 0 0 0
57113 - 0 0 0 0 0 0 0 0 0 0 0 0
57114 - 0 0 0 0 0 0 0 0 0 0 0 0
57115 - 0 0 0 0 0 0 0 0 0 0 0 0
57116 - 0 0 0 0 0 0 0 0 0 0 0 0
57117 - 0 0 0 0 0 0 0 0 0 0 0 0
57118 - 0 0 0 6 6 6 22 22 22 50 50 50
57119 - 78 78 78 34 34 34 2 2 6 2 2 6
57120 - 2 2 6 2 2 6 2 2 6 2 2 6
57121 - 2 2 6 2 2 6 2 2 6 2 2 6
57122 - 2 2 6 2 2 6 6 6 6 70 70 70
57123 - 78 78 78 46 46 46 22 22 22 6 6 6
57124 - 0 0 0 0 0 0 0 0 0 0 0 0
57125 - 0 0 0 0 0 0 0 0 0 0 0 0
57126 - 0 0 0 0 0 0 0 0 0 0 0 0
57127 - 0 0 0 0 0 0 0 0 0 0 0 0
57128 - 0 0 0 0 0 0 0 0 0 0 0 0
57129 - 0 0 0 0 0 0 0 0 0 0 0 0
57130 - 0 0 0 0 0 0 0 0 0 0 0 0
57131 - 0 0 0 0 0 0 0 0 0 0 0 0
57132 - 0 0 1 0 0 1 0 0 1 0 0 0
57133 - 0 0 0 0 0 0 0 0 0 0 0 0
57134 - 0 0 0 0 0 0 0 0 0 0 0 0
57135 - 0 0 0 0 0 0 0 0 0 0 0 0
57136 - 0 0 0 0 0 0 0 0 0 0 0 0
57137 - 0 0 0 0 0 0 0 0 0 0 0 0
57138 - 6 6 6 18 18 18 42 42 42 82 82 82
57139 - 26 26 26 2 2 6 2 2 6 2 2 6
57140 - 2 2 6 2 2 6 2 2 6 2 2 6
57141 - 2 2 6 2 2 6 2 2 6 14 14 14
57142 - 46 46 46 34 34 34 6 6 6 2 2 6
57143 - 42 42 42 78 78 78 42 42 42 18 18 18
57144 - 6 6 6 0 0 0 0 0 0 0 0 0
57145 - 0 0 0 0 0 0 0 0 0 0 0 0
57146 - 0 0 0 0 0 0 0 0 0 0 0 0
57147 - 0 0 0 0 0 0 0 0 0 0 0 0
57148 - 0 0 0 0 0 0 0 0 0 0 0 0
57149 - 0 0 0 0 0 0 0 0 0 0 0 0
57150 - 0 0 0 0 0 0 0 0 0 0 0 0
57151 - 0 0 0 0 0 0 0 0 0 0 0 0
57152 - 0 0 1 0 0 0 0 0 1 0 0 0
57153 - 0 0 0 0 0 0 0 0 0 0 0 0
57154 - 0 0 0 0 0 0 0 0 0 0 0 0
57155 - 0 0 0 0 0 0 0 0 0 0 0 0
57156 - 0 0 0 0 0 0 0 0 0 0 0 0
57157 - 0 0 0 0 0 0 0 0 0 0 0 0
57158 - 10 10 10 30 30 30 66 66 66 58 58 58
57159 - 2 2 6 2 2 6 2 2 6 2 2 6
57160 - 2 2 6 2 2 6 2 2 6 2 2 6
57161 - 2 2 6 2 2 6 2 2 6 26 26 26
57162 - 86 86 86 101 101 101 46 46 46 10 10 10
57163 - 2 2 6 58 58 58 70 70 70 34 34 34
57164 - 10 10 10 0 0 0 0 0 0 0 0 0
57165 - 0 0 0 0 0 0 0 0 0 0 0 0
57166 - 0 0 0 0 0 0 0 0 0 0 0 0
57167 - 0 0 0 0 0 0 0 0 0 0 0 0
57168 - 0 0 0 0 0 0 0 0 0 0 0 0
57169 - 0 0 0 0 0 0 0 0 0 0 0 0
57170 - 0 0 0 0 0 0 0 0 0 0 0 0
57171 - 0 0 0 0 0 0 0 0 0 0 0 0
57172 - 0 0 1 0 0 1 0 0 1 0 0 0
57173 - 0 0 0 0 0 0 0 0 0 0 0 0
57174 - 0 0 0 0 0 0 0 0 0 0 0 0
57175 - 0 0 0 0 0 0 0 0 0 0 0 0
57176 - 0 0 0 0 0 0 0 0 0 0 0 0
57177 - 0 0 0 0 0 0 0 0 0 0 0 0
57178 - 14 14 14 42 42 42 86 86 86 10 10 10
57179 - 2 2 6 2 2 6 2 2 6 2 2 6
57180 - 2 2 6 2 2 6 2 2 6 2 2 6
57181 - 2 2 6 2 2 6 2 2 6 30 30 30
57182 - 94 94 94 94 94 94 58 58 58 26 26 26
57183 - 2 2 6 6 6 6 78 78 78 54 54 54
57184 - 22 22 22 6 6 6 0 0 0 0 0 0
57185 - 0 0 0 0 0 0 0 0 0 0 0 0
57186 - 0 0 0 0 0 0 0 0 0 0 0 0
57187 - 0 0 0 0 0 0 0 0 0 0 0 0
57188 - 0 0 0 0 0 0 0 0 0 0 0 0
57189 - 0 0 0 0 0 0 0 0 0 0 0 0
57190 - 0 0 0 0 0 0 0 0 0 0 0 0
57191 - 0 0 0 0 0 0 0 0 0 0 0 0
57192 - 0 0 0 0 0 0 0 0 0 0 0 0
57193 - 0 0 0 0 0 0 0 0 0 0 0 0
57194 - 0 0 0 0 0 0 0 0 0 0 0 0
57195 - 0 0 0 0 0 0 0 0 0 0 0 0
57196 - 0 0 0 0 0 0 0 0 0 0 0 0
57197 - 0 0 0 0 0 0 0 0 0 6 6 6
57198 - 22 22 22 62 62 62 62 62 62 2 2 6
57199 - 2 2 6 2 2 6 2 2 6 2 2 6
57200 - 2 2 6 2 2 6 2 2 6 2 2 6
57201 - 2 2 6 2 2 6 2 2 6 26 26 26
57202 - 54 54 54 38 38 38 18 18 18 10 10 10
57203 - 2 2 6 2 2 6 34 34 34 82 82 82
57204 - 38 38 38 14 14 14 0 0 0 0 0 0
57205 - 0 0 0 0 0 0 0 0 0 0 0 0
57206 - 0 0 0 0 0 0 0 0 0 0 0 0
57207 - 0 0 0 0 0 0 0 0 0 0 0 0
57208 - 0 0 0 0 0 0 0 0 0 0 0 0
57209 - 0 0 0 0 0 0 0 0 0 0 0 0
57210 - 0 0 0 0 0 0 0 0 0 0 0 0
57211 - 0 0 0 0 0 0 0 0 0 0 0 0
57212 - 0 0 0 0 0 1 0 0 1 0 0 0
57213 - 0 0 0 0 0 0 0 0 0 0 0 0
57214 - 0 0 0 0 0 0 0 0 0 0 0 0
57215 - 0 0 0 0 0 0 0 0 0 0 0 0
57216 - 0 0 0 0 0 0 0 0 0 0 0 0
57217 - 0 0 0 0 0 0 0 0 0 6 6 6
57218 - 30 30 30 78 78 78 30 30 30 2 2 6
57219 - 2 2 6 2 2 6 2 2 6 2 2 6
57220 - 2 2 6 2 2 6 2 2 6 2 2 6
57221 - 2 2 6 2 2 6 2 2 6 10 10 10
57222 - 10 10 10 2 2 6 2 2 6 2 2 6
57223 - 2 2 6 2 2 6 2 2 6 78 78 78
57224 - 50 50 50 18 18 18 6 6 6 0 0 0
57225 - 0 0 0 0 0 0 0 0 0 0 0 0
57226 - 0 0 0 0 0 0 0 0 0 0 0 0
57227 - 0 0 0 0 0 0 0 0 0 0 0 0
57228 - 0 0 0 0 0 0 0 0 0 0 0 0
57229 - 0 0 0 0 0 0 0 0 0 0 0 0
57230 - 0 0 0 0 0 0 0 0 0 0 0 0
57231 - 0 0 0 0 0 0 0 0 0 0 0 0
57232 - 0 0 1 0 0 0 0 0 0 0 0 0
57233 - 0 0 0 0 0 0 0 0 0 0 0 0
57234 - 0 0 0 0 0 0 0 0 0 0 0 0
57235 - 0 0 0 0 0 0 0 0 0 0 0 0
57236 - 0 0 0 0 0 0 0 0 0 0 0 0
57237 - 0 0 0 0 0 0 0 0 0 10 10 10
57238 - 38 38 38 86 86 86 14 14 14 2 2 6
57239 - 2 2 6 2 2 6 2 2 6 2 2 6
57240 - 2 2 6 2 2 6 2 2 6 2 2 6
57241 - 2 2 6 2 2 6 2 2 6 2 2 6
57242 - 2 2 6 2 2 6 2 2 6 2 2 6
57243 - 2 2 6 2 2 6 2 2 6 54 54 54
57244 - 66 66 66 26 26 26 6 6 6 0 0 0
57245 - 0 0 0 0 0 0 0 0 0 0 0 0
57246 - 0 0 0 0 0 0 0 0 0 0 0 0
57247 - 0 0 0 0 0 0 0 0 0 0 0 0
57248 - 0 0 0 0 0 0 0 0 0 0 0 0
57249 - 0 0 0 0 0 0 0 0 0 0 0 0
57250 - 0 0 0 0 0 0 0 0 0 0 0 0
57251 - 0 0 0 0 0 0 0 0 0 0 0 0
57252 - 0 0 0 0 0 1 0 0 1 0 0 0
57253 - 0 0 0 0 0 0 0 0 0 0 0 0
57254 - 0 0 0 0 0 0 0 0 0 0 0 0
57255 - 0 0 0 0 0 0 0 0 0 0 0 0
57256 - 0 0 0 0 0 0 0 0 0 0 0 0
57257 - 0 0 0 0 0 0 0 0 0 14 14 14
57258 - 42 42 42 82 82 82 2 2 6 2 2 6
57259 - 2 2 6 6 6 6 10 10 10 2 2 6
57260 - 2 2 6 2 2 6 2 2 6 2 2 6
57261 - 2 2 6 2 2 6 2 2 6 6 6 6
57262 - 14 14 14 10 10 10 2 2 6 2 2 6
57263 - 2 2 6 2 2 6 2 2 6 18 18 18
57264 - 82 82 82 34 34 34 10 10 10 0 0 0
57265 - 0 0 0 0 0 0 0 0 0 0 0 0
57266 - 0 0 0 0 0 0 0 0 0 0 0 0
57267 - 0 0 0 0 0 0 0 0 0 0 0 0
57268 - 0 0 0 0 0 0 0 0 0 0 0 0
57269 - 0 0 0 0 0 0 0 0 0 0 0 0
57270 - 0 0 0 0 0 0 0 0 0 0 0 0
57271 - 0 0 0 0 0 0 0 0 0 0 0 0
57272 - 0 0 1 0 0 0 0 0 0 0 0 0
57273 - 0 0 0 0 0 0 0 0 0 0 0 0
57274 - 0 0 0 0 0 0 0 0 0 0 0 0
57275 - 0 0 0 0 0 0 0 0 0 0 0 0
57276 - 0 0 0 0 0 0 0 0 0 0 0 0
57277 - 0 0 0 0 0 0 0 0 0 14 14 14
57278 - 46 46 46 86 86 86 2 2 6 2 2 6
57279 - 6 6 6 6 6 6 22 22 22 34 34 34
57280 - 6 6 6 2 2 6 2 2 6 2 2 6
57281 - 2 2 6 2 2 6 18 18 18 34 34 34
57282 - 10 10 10 50 50 50 22 22 22 2 2 6
57283 - 2 2 6 2 2 6 2 2 6 10 10 10
57284 - 86 86 86 42 42 42 14 14 14 0 0 0
57285 - 0 0 0 0 0 0 0 0 0 0 0 0
57286 - 0 0 0 0 0 0 0 0 0 0 0 0
57287 - 0 0 0 0 0 0 0 0 0 0 0 0
57288 - 0 0 0 0 0 0 0 0 0 0 0 0
57289 - 0 0 0 0 0 0 0 0 0 0 0 0
57290 - 0 0 0 0 0 0 0 0 0 0 0 0
57291 - 0 0 0 0 0 0 0 0 0 0 0 0
57292 - 0 0 1 0 0 1 0 0 1 0 0 0
57293 - 0 0 0 0 0 0 0 0 0 0 0 0
57294 - 0 0 0 0 0 0 0 0 0 0 0 0
57295 - 0 0 0 0 0 0 0 0 0 0 0 0
57296 - 0 0 0 0 0 0 0 0 0 0 0 0
57297 - 0 0 0 0 0 0 0 0 0 14 14 14
57298 - 46 46 46 86 86 86 2 2 6 2 2 6
57299 - 38 38 38 116 116 116 94 94 94 22 22 22
57300 - 22 22 22 2 2 6 2 2 6 2 2 6
57301 - 14 14 14 86 86 86 138 138 138 162 162 162
57302 -154 154 154 38 38 38 26 26 26 6 6 6
57303 - 2 2 6 2 2 6 2 2 6 2 2 6
57304 - 86 86 86 46 46 46 14 14 14 0 0 0
57305 - 0 0 0 0 0 0 0 0 0 0 0 0
57306 - 0 0 0 0 0 0 0 0 0 0 0 0
57307 - 0 0 0 0 0 0 0 0 0 0 0 0
57308 - 0 0 0 0 0 0 0 0 0 0 0 0
57309 - 0 0 0 0 0 0 0 0 0 0 0 0
57310 - 0 0 0 0 0 0 0 0 0 0 0 0
57311 - 0 0 0 0 0 0 0 0 0 0 0 0
57312 - 0 0 0 0 0 0 0 0 0 0 0 0
57313 - 0 0 0 0 0 0 0 0 0 0 0 0
57314 - 0 0 0 0 0 0 0 0 0 0 0 0
57315 - 0 0 0 0 0 0 0 0 0 0 0 0
57316 - 0 0 0 0 0 0 0 0 0 0 0 0
57317 - 0 0 0 0 0 0 0 0 0 14 14 14
57318 - 46 46 46 86 86 86 2 2 6 14 14 14
57319 -134 134 134 198 198 198 195 195 195 116 116 116
57320 - 10 10 10 2 2 6 2 2 6 6 6 6
57321 -101 98 89 187 187 187 210 210 210 218 218 218
57322 -214 214 214 134 134 134 14 14 14 6 6 6
57323 - 2 2 6 2 2 6 2 2 6 2 2 6
57324 - 86 86 86 50 50 50 18 18 18 6 6 6
57325 - 0 0 0 0 0 0 0 0 0 0 0 0
57326 - 0 0 0 0 0 0 0 0 0 0 0 0
57327 - 0 0 0 0 0 0 0 0 0 0 0 0
57328 - 0 0 0 0 0 0 0 0 0 0 0 0
57329 - 0 0 0 0 0 0 0 0 0 0 0 0
57330 - 0 0 0 0 0 0 0 0 0 0 0 0
57331 - 0 0 0 0 0 0 0 0 1 0 0 0
57332 - 0 0 1 0 0 1 0 0 1 0 0 0
57333 - 0 0 0 0 0 0 0 0 0 0 0 0
57334 - 0 0 0 0 0 0 0 0 0 0 0 0
57335 - 0 0 0 0 0 0 0 0 0 0 0 0
57336 - 0 0 0 0 0 0 0 0 0 0 0 0
57337 - 0 0 0 0 0 0 0 0 0 14 14 14
57338 - 46 46 46 86 86 86 2 2 6 54 54 54
57339 -218 218 218 195 195 195 226 226 226 246 246 246
57340 - 58 58 58 2 2 6 2 2 6 30 30 30
57341 -210 210 210 253 253 253 174 174 174 123 123 123
57342 -221 221 221 234 234 234 74 74 74 2 2 6
57343 - 2 2 6 2 2 6 2 2 6 2 2 6
57344 - 70 70 70 58 58 58 22 22 22 6 6 6
57345 - 0 0 0 0 0 0 0 0 0 0 0 0
57346 - 0 0 0 0 0 0 0 0 0 0 0 0
57347 - 0 0 0 0 0 0 0 0 0 0 0 0
57348 - 0 0 0 0 0 0 0 0 0 0 0 0
57349 - 0 0 0 0 0 0 0 0 0 0 0 0
57350 - 0 0 0 0 0 0 0 0 0 0 0 0
57351 - 0 0 0 0 0 0 0 0 0 0 0 0
57352 - 0 0 0 0 0 0 0 0 0 0 0 0
57353 - 0 0 0 0 0 0 0 0 0 0 0 0
57354 - 0 0 0 0 0 0 0 0 0 0 0 0
57355 - 0 0 0 0 0 0 0 0 0 0 0 0
57356 - 0 0 0 0 0 0 0 0 0 0 0 0
57357 - 0 0 0 0 0 0 0 0 0 14 14 14
57358 - 46 46 46 82 82 82 2 2 6 106 106 106
57359 -170 170 170 26 26 26 86 86 86 226 226 226
57360 -123 123 123 10 10 10 14 14 14 46 46 46
57361 -231 231 231 190 190 190 6 6 6 70 70 70
57362 - 90 90 90 238 238 238 158 158 158 2 2 6
57363 - 2 2 6 2 2 6 2 2 6 2 2 6
57364 - 70 70 70 58 58 58 22 22 22 6 6 6
57365 - 0 0 0 0 0 0 0 0 0 0 0 0
57366 - 0 0 0 0 0 0 0 0 0 0 0 0
57367 - 0 0 0 0 0 0 0 0 0 0 0 0
57368 - 0 0 0 0 0 0 0 0 0 0 0 0
57369 - 0 0 0 0 0 0 0 0 0 0 0 0
57370 - 0 0 0 0 0 0 0 0 0 0 0 0
57371 - 0 0 0 0 0 0 0 0 1 0 0 0
57372 - 0 0 1 0 0 1 0 0 1 0 0 0
57373 - 0 0 0 0 0 0 0 0 0 0 0 0
57374 - 0 0 0 0 0 0 0 0 0 0 0 0
57375 - 0 0 0 0 0 0 0 0 0 0 0 0
57376 - 0 0 0 0 0 0 0 0 0 0 0 0
57377 - 0 0 0 0 0 0 0 0 0 14 14 14
57378 - 42 42 42 86 86 86 6 6 6 116 116 116
57379 -106 106 106 6 6 6 70 70 70 149 149 149
57380 -128 128 128 18 18 18 38 38 38 54 54 54
57381 -221 221 221 106 106 106 2 2 6 14 14 14
57382 - 46 46 46 190 190 190 198 198 198 2 2 6
57383 - 2 2 6 2 2 6 2 2 6 2 2 6
57384 - 74 74 74 62 62 62 22 22 22 6 6 6
57385 - 0 0 0 0 0 0 0 0 0 0 0 0
57386 - 0 0 0 0 0 0 0 0 0 0 0 0
57387 - 0 0 0 0 0 0 0 0 0 0 0 0
57388 - 0 0 0 0 0 0 0 0 0 0 0 0
57389 - 0 0 0 0 0 0 0 0 0 0 0 0
57390 - 0 0 0 0 0 0 0 0 0 0 0 0
57391 - 0 0 0 0 0 0 0 0 1 0 0 0
57392 - 0 0 1 0 0 0 0 0 1 0 0 0
57393 - 0 0 0 0 0 0 0 0 0 0 0 0
57394 - 0 0 0 0 0 0 0 0 0 0 0 0
57395 - 0 0 0 0 0 0 0 0 0 0 0 0
57396 - 0 0 0 0 0 0 0 0 0 0 0 0
57397 - 0 0 0 0 0 0 0 0 0 14 14 14
57398 - 42 42 42 94 94 94 14 14 14 101 101 101
57399 -128 128 128 2 2 6 18 18 18 116 116 116
57400 -118 98 46 121 92 8 121 92 8 98 78 10
57401 -162 162 162 106 106 106 2 2 6 2 2 6
57402 - 2 2 6 195 195 195 195 195 195 6 6 6
57403 - 2 2 6 2 2 6 2 2 6 2 2 6
57404 - 74 74 74 62 62 62 22 22 22 6 6 6
57405 - 0 0 0 0 0 0 0 0 0 0 0 0
57406 - 0 0 0 0 0 0 0 0 0 0 0 0
57407 - 0 0 0 0 0 0 0 0 0 0 0 0
57408 - 0 0 0 0 0 0 0 0 0 0 0 0
57409 - 0 0 0 0 0 0 0 0 0 0 0 0
57410 - 0 0 0 0 0 0 0 0 0 0 0 0
57411 - 0 0 0 0 0 0 0 0 1 0 0 1
57412 - 0 0 1 0 0 0 0 0 1 0 0 0
57413 - 0 0 0 0 0 0 0 0 0 0 0 0
57414 - 0 0 0 0 0 0 0 0 0 0 0 0
57415 - 0 0 0 0 0 0 0 0 0 0 0 0
57416 - 0 0 0 0 0 0 0 0 0 0 0 0
57417 - 0 0 0 0 0 0 0 0 0 10 10 10
57418 - 38 38 38 90 90 90 14 14 14 58 58 58
57419 -210 210 210 26 26 26 54 38 6 154 114 10
57420 -226 170 11 236 186 11 225 175 15 184 144 12
57421 -215 174 15 175 146 61 37 26 9 2 2 6
57422 - 70 70 70 246 246 246 138 138 138 2 2 6
57423 - 2 2 6 2 2 6 2 2 6 2 2 6
57424 - 70 70 70 66 66 66 26 26 26 6 6 6
57425 - 0 0 0 0 0 0 0 0 0 0 0 0
57426 - 0 0 0 0 0 0 0 0 0 0 0 0
57427 - 0 0 0 0 0 0 0 0 0 0 0 0
57428 - 0 0 0 0 0 0 0 0 0 0 0 0
57429 - 0 0 0 0 0 0 0 0 0 0 0 0
57430 - 0 0 0 0 0 0 0 0 0 0 0 0
57431 - 0 0 0 0 0 0 0 0 0 0 0 0
57432 - 0 0 0 0 0 0 0 0 0 0 0 0
57433 - 0 0 0 0 0 0 0 0 0 0 0 0
57434 - 0 0 0 0 0 0 0 0 0 0 0 0
57435 - 0 0 0 0 0 0 0 0 0 0 0 0
57436 - 0 0 0 0 0 0 0 0 0 0 0 0
57437 - 0 0 0 0 0 0 0 0 0 10 10 10
57438 - 38 38 38 86 86 86 14 14 14 10 10 10
57439 -195 195 195 188 164 115 192 133 9 225 175 15
57440 -239 182 13 234 190 10 232 195 16 232 200 30
57441 -245 207 45 241 208 19 232 195 16 184 144 12
57442 -218 194 134 211 206 186 42 42 42 2 2 6
57443 - 2 2 6 2 2 6 2 2 6 2 2 6
57444 - 50 50 50 74 74 74 30 30 30 6 6 6
57445 - 0 0 0 0 0 0 0 0 0 0 0 0
57446 - 0 0 0 0 0 0 0 0 0 0 0 0
57447 - 0 0 0 0 0 0 0 0 0 0 0 0
57448 - 0 0 0 0 0 0 0 0 0 0 0 0
57449 - 0 0 0 0 0 0 0 0 0 0 0 0
57450 - 0 0 0 0 0 0 0 0 0 0 0 0
57451 - 0 0 0 0 0 0 0 0 0 0 0 0
57452 - 0 0 0 0 0 0 0 0 0 0 0 0
57453 - 0 0 0 0 0 0 0 0 0 0 0 0
57454 - 0 0 0 0 0 0 0 0 0 0 0 0
57455 - 0 0 0 0 0 0 0 0 0 0 0 0
57456 - 0 0 0 0 0 0 0 0 0 0 0 0
57457 - 0 0 0 0 0 0 0 0 0 10 10 10
57458 - 34 34 34 86 86 86 14 14 14 2 2 6
57459 -121 87 25 192 133 9 219 162 10 239 182 13
57460 -236 186 11 232 195 16 241 208 19 244 214 54
57461 -246 218 60 246 218 38 246 215 20 241 208 19
57462 -241 208 19 226 184 13 121 87 25 2 2 6
57463 - 2 2 6 2 2 6 2 2 6 2 2 6
57464 - 50 50 50 82 82 82 34 34 34 10 10 10
57465 - 0 0 0 0 0 0 0 0 0 0 0 0
57466 - 0 0 0 0 0 0 0 0 0 0 0 0
57467 - 0 0 0 0 0 0 0 0 0 0 0 0
57468 - 0 0 0 0 0 0 0 0 0 0 0 0
57469 - 0 0 0 0 0 0 0 0 0 0 0 0
57470 - 0 0 0 0 0 0 0 0 0 0 0 0
57471 - 0 0 0 0 0 0 0 0 0 0 0 0
57472 - 0 0 0 0 0 0 0 0 0 0 0 0
57473 - 0 0 0 0 0 0 0 0 0 0 0 0
57474 - 0 0 0 0 0 0 0 0 0 0 0 0
57475 - 0 0 0 0 0 0 0 0 0 0 0 0
57476 - 0 0 0 0 0 0 0 0 0 0 0 0
57477 - 0 0 0 0 0 0 0 0 0 10 10 10
57478 - 34 34 34 82 82 82 30 30 30 61 42 6
57479 -180 123 7 206 145 10 230 174 11 239 182 13
57480 -234 190 10 238 202 15 241 208 19 246 218 74
57481 -246 218 38 246 215 20 246 215 20 246 215 20
57482 -226 184 13 215 174 15 184 144 12 6 6 6
57483 - 2 2 6 2 2 6 2 2 6 2 2 6
57484 - 26 26 26 94 94 94 42 42 42 14 14 14
57485 - 0 0 0 0 0 0 0 0 0 0 0 0
57486 - 0 0 0 0 0 0 0 0 0 0 0 0
57487 - 0 0 0 0 0 0 0 0 0 0 0 0
57488 - 0 0 0 0 0 0 0 0 0 0 0 0
57489 - 0 0 0 0 0 0 0 0 0 0 0 0
57490 - 0 0 0 0 0 0 0 0 0 0 0 0
57491 - 0 0 0 0 0 0 0 0 0 0 0 0
57492 - 0 0 0 0 0 0 0 0 0 0 0 0
57493 - 0 0 0 0 0 0 0 0 0 0 0 0
57494 - 0 0 0 0 0 0 0 0 0 0 0 0
57495 - 0 0 0 0 0 0 0 0 0 0 0 0
57496 - 0 0 0 0 0 0 0 0 0 0 0 0
57497 - 0 0 0 0 0 0 0 0 0 10 10 10
57498 - 30 30 30 78 78 78 50 50 50 104 69 6
57499 -192 133 9 216 158 10 236 178 12 236 186 11
57500 -232 195 16 241 208 19 244 214 54 245 215 43
57501 -246 215 20 246 215 20 241 208 19 198 155 10
57502 -200 144 11 216 158 10 156 118 10 2 2 6
57503 - 2 2 6 2 2 6 2 2 6 2 2 6
57504 - 6 6 6 90 90 90 54 54 54 18 18 18
57505 - 6 6 6 0 0 0 0 0 0 0 0 0
57506 - 0 0 0 0 0 0 0 0 0 0 0 0
57507 - 0 0 0 0 0 0 0 0 0 0 0 0
57508 - 0 0 0 0 0 0 0 0 0 0 0 0
57509 - 0 0 0 0 0 0 0 0 0 0 0 0
57510 - 0 0 0 0 0 0 0 0 0 0 0 0
57511 - 0 0 0 0 0 0 0 0 0 0 0 0
57512 - 0 0 0 0 0 0 0 0 0 0 0 0
57513 - 0 0 0 0 0 0 0 0 0 0 0 0
57514 - 0 0 0 0 0 0 0 0 0 0 0 0
57515 - 0 0 0 0 0 0 0 0 0 0 0 0
57516 - 0 0 0 0 0 0 0 0 0 0 0 0
57517 - 0 0 0 0 0 0 0 0 0 10 10 10
57518 - 30 30 30 78 78 78 46 46 46 22 22 22
57519 -137 92 6 210 162 10 239 182 13 238 190 10
57520 -238 202 15 241 208 19 246 215 20 246 215 20
57521 -241 208 19 203 166 17 185 133 11 210 150 10
57522 -216 158 10 210 150 10 102 78 10 2 2 6
57523 - 6 6 6 54 54 54 14 14 14 2 2 6
57524 - 2 2 6 62 62 62 74 74 74 30 30 30
57525 - 10 10 10 0 0 0 0 0 0 0 0 0
57526 - 0 0 0 0 0 0 0 0 0 0 0 0
57527 - 0 0 0 0 0 0 0 0 0 0 0 0
57528 - 0 0 0 0 0 0 0 0 0 0 0 0
57529 - 0 0 0 0 0 0 0 0 0 0 0 0
57530 - 0 0 0 0 0 0 0 0 0 0 0 0
57531 - 0 0 0 0 0 0 0 0 0 0 0 0
57532 - 0 0 0 0 0 0 0 0 0 0 0 0
57533 - 0 0 0 0 0 0 0 0 0 0 0 0
57534 - 0 0 0 0 0 0 0 0 0 0 0 0
57535 - 0 0 0 0 0 0 0 0 0 0 0 0
57536 - 0 0 0 0 0 0 0 0 0 0 0 0
57537 - 0 0 0 0 0 0 0 0 0 10 10 10
57538 - 34 34 34 78 78 78 50 50 50 6 6 6
57539 - 94 70 30 139 102 15 190 146 13 226 184 13
57540 -232 200 30 232 195 16 215 174 15 190 146 13
57541 -168 122 10 192 133 9 210 150 10 213 154 11
57542 -202 150 34 182 157 106 101 98 89 2 2 6
57543 - 2 2 6 78 78 78 116 116 116 58 58 58
57544 - 2 2 6 22 22 22 90 90 90 46 46 46
57545 - 18 18 18 6 6 6 0 0 0 0 0 0
57546 - 0 0 0 0 0 0 0 0 0 0 0 0
57547 - 0 0 0 0 0 0 0 0 0 0 0 0
57548 - 0 0 0 0 0 0 0 0 0 0 0 0
57549 - 0 0 0 0 0 0 0 0 0 0 0 0
57550 - 0 0 0 0 0 0 0 0 0 0 0 0
57551 - 0 0 0 0 0 0 0 0 0 0 0 0
57552 - 0 0 0 0 0 0 0 0 0 0 0 0
57553 - 0 0 0 0 0 0 0 0 0 0 0 0
57554 - 0 0 0 0 0 0 0 0 0 0 0 0
57555 - 0 0 0 0 0 0 0 0 0 0 0 0
57556 - 0 0 0 0 0 0 0 0 0 0 0 0
57557 - 0 0 0 0 0 0 0 0 0 10 10 10
57558 - 38 38 38 86 86 86 50 50 50 6 6 6
57559 -128 128 128 174 154 114 156 107 11 168 122 10
57560 -198 155 10 184 144 12 197 138 11 200 144 11
57561 -206 145 10 206 145 10 197 138 11 188 164 115
57562 -195 195 195 198 198 198 174 174 174 14 14 14
57563 - 2 2 6 22 22 22 116 116 116 116 116 116
57564 - 22 22 22 2 2 6 74 74 74 70 70 70
57565 - 30 30 30 10 10 10 0 0 0 0 0 0
57566 - 0 0 0 0 0 0 0 0 0 0 0 0
57567 - 0 0 0 0 0 0 0 0 0 0 0 0
57568 - 0 0 0 0 0 0 0 0 0 0 0 0
57569 - 0 0 0 0 0 0 0 0 0 0 0 0
57570 - 0 0 0 0 0 0 0 0 0 0 0 0
57571 - 0 0 0 0 0 0 0 0 0 0 0 0
57572 - 0 0 0 0 0 0 0 0 0 0 0 0
57573 - 0 0 0 0 0 0 0 0 0 0 0 0
57574 - 0 0 0 0 0 0 0 0 0 0 0 0
57575 - 0 0 0 0 0 0 0 0 0 0 0 0
57576 - 0 0 0 0 0 0 0 0 0 0 0 0
57577 - 0 0 0 0 0 0 6 6 6 18 18 18
57578 - 50 50 50 101 101 101 26 26 26 10 10 10
57579 -138 138 138 190 190 190 174 154 114 156 107 11
57580 -197 138 11 200 144 11 197 138 11 192 133 9
57581 -180 123 7 190 142 34 190 178 144 187 187 187
57582 -202 202 202 221 221 221 214 214 214 66 66 66
57583 - 2 2 6 2 2 6 50 50 50 62 62 62
57584 - 6 6 6 2 2 6 10 10 10 90 90 90
57585 - 50 50 50 18 18 18 6 6 6 0 0 0
57586 - 0 0 0 0 0 0 0 0 0 0 0 0
57587 - 0 0 0 0 0 0 0 0 0 0 0 0
57588 - 0 0 0 0 0 0 0 0 0 0 0 0
57589 - 0 0 0 0 0 0 0 0 0 0 0 0
57590 - 0 0 0 0 0 0 0 0 0 0 0 0
57591 - 0 0 0 0 0 0 0 0 0 0 0 0
57592 - 0 0 0 0 0 0 0 0 0 0 0 0
57593 - 0 0 0 0 0 0 0 0 0 0 0 0
57594 - 0 0 0 0 0 0 0 0 0 0 0 0
57595 - 0 0 0 0 0 0 0 0 0 0 0 0
57596 - 0 0 0 0 0 0 0 0 0 0 0 0
57597 - 0 0 0 0 0 0 10 10 10 34 34 34
57598 - 74 74 74 74 74 74 2 2 6 6 6 6
57599 -144 144 144 198 198 198 190 190 190 178 166 146
57600 -154 121 60 156 107 11 156 107 11 168 124 44
57601 -174 154 114 187 187 187 190 190 190 210 210 210
57602 -246 246 246 253 253 253 253 253 253 182 182 182
57603 - 6 6 6 2 2 6 2 2 6 2 2 6
57604 - 2 2 6 2 2 6 2 2 6 62 62 62
57605 - 74 74 74 34 34 34 14 14 14 0 0 0
57606 - 0 0 0 0 0 0 0 0 0 0 0 0
57607 - 0 0 0 0 0 0 0 0 0 0 0 0
57608 - 0 0 0 0 0 0 0 0 0 0 0 0
57609 - 0 0 0 0 0 0 0 0 0 0 0 0
57610 - 0 0 0 0 0 0 0 0 0 0 0 0
57611 - 0 0 0 0 0 0 0 0 0 0 0 0
57612 - 0 0 0 0 0 0 0 0 0 0 0 0
57613 - 0 0 0 0 0 0 0 0 0 0 0 0
57614 - 0 0 0 0 0 0 0 0 0 0 0 0
57615 - 0 0 0 0 0 0 0 0 0 0 0 0
57616 - 0 0 0 0 0 0 0 0 0 0 0 0
57617 - 0 0 0 10 10 10 22 22 22 54 54 54
57618 - 94 94 94 18 18 18 2 2 6 46 46 46
57619 -234 234 234 221 221 221 190 190 190 190 190 190
57620 -190 190 190 187 187 187 187 187 187 190 190 190
57621 -190 190 190 195 195 195 214 214 214 242 242 242
57622 -253 253 253 253 253 253 253 253 253 253 253 253
57623 - 82 82 82 2 2 6 2 2 6 2 2 6
57624 - 2 2 6 2 2 6 2 2 6 14 14 14
57625 - 86 86 86 54 54 54 22 22 22 6 6 6
57626 - 0 0 0 0 0 0 0 0 0 0 0 0
57627 - 0 0 0 0 0 0 0 0 0 0 0 0
57628 - 0 0 0 0 0 0 0 0 0 0 0 0
57629 - 0 0 0 0 0 0 0 0 0 0 0 0
57630 - 0 0 0 0 0 0 0 0 0 0 0 0
57631 - 0 0 0 0 0 0 0 0 0 0 0 0
57632 - 0 0 0 0 0 0 0 0 0 0 0 0
57633 - 0 0 0 0 0 0 0 0 0 0 0 0
57634 - 0 0 0 0 0 0 0 0 0 0 0 0
57635 - 0 0 0 0 0 0 0 0 0 0 0 0
57636 - 0 0 0 0 0 0 0 0 0 0 0 0
57637 - 6 6 6 18 18 18 46 46 46 90 90 90
57638 - 46 46 46 18 18 18 6 6 6 182 182 182
57639 -253 253 253 246 246 246 206 206 206 190 190 190
57640 -190 190 190 190 190 190 190 190 190 190 190 190
57641 -206 206 206 231 231 231 250 250 250 253 253 253
57642 -253 253 253 253 253 253 253 253 253 253 253 253
57643 -202 202 202 14 14 14 2 2 6 2 2 6
57644 - 2 2 6 2 2 6 2 2 6 2 2 6
57645 - 42 42 42 86 86 86 42 42 42 18 18 18
57646 - 6 6 6 0 0 0 0 0 0 0 0 0
57647 - 0 0 0 0 0 0 0 0 0 0 0 0
57648 - 0 0 0 0 0 0 0 0 0 0 0 0
57649 - 0 0 0 0 0 0 0 0 0 0 0 0
57650 - 0 0 0 0 0 0 0 0 0 0 0 0
57651 - 0 0 0 0 0 0 0 0 0 0 0 0
57652 - 0 0 0 0 0 0 0 0 0 0 0 0
57653 - 0 0 0 0 0 0 0 0 0 0 0 0
57654 - 0 0 0 0 0 0 0 0 0 0 0 0
57655 - 0 0 0 0 0 0 0 0 0 0 0 0
57656 - 0 0 0 0 0 0 0 0 0 6 6 6
57657 - 14 14 14 38 38 38 74 74 74 66 66 66
57658 - 2 2 6 6 6 6 90 90 90 250 250 250
57659 -253 253 253 253 253 253 238 238 238 198 198 198
57660 -190 190 190 190 190 190 195 195 195 221 221 221
57661 -246 246 246 253 253 253 253 253 253 253 253 253
57662 -253 253 253 253 253 253 253 253 253 253 253 253
57663 -253 253 253 82 82 82 2 2 6 2 2 6
57664 - 2 2 6 2 2 6 2 2 6 2 2 6
57665 - 2 2 6 78 78 78 70 70 70 34 34 34
57666 - 14 14 14 6 6 6 0 0 0 0 0 0
57667 - 0 0 0 0 0 0 0 0 0 0 0 0
57668 - 0 0 0 0 0 0 0 0 0 0 0 0
57669 - 0 0 0 0 0 0 0 0 0 0 0 0
57670 - 0 0 0 0 0 0 0 0 0 0 0 0
57671 - 0 0 0 0 0 0 0 0 0 0 0 0
57672 - 0 0 0 0 0 0 0 0 0 0 0 0
57673 - 0 0 0 0 0 0 0 0 0 0 0 0
57674 - 0 0 0 0 0 0 0 0 0 0 0 0
57675 - 0 0 0 0 0 0 0 0 0 0 0 0
57676 - 0 0 0 0 0 0 0 0 0 14 14 14
57677 - 34 34 34 66 66 66 78 78 78 6 6 6
57678 - 2 2 6 18 18 18 218 218 218 253 253 253
57679 -253 253 253 253 253 253 253 253 253 246 246 246
57680 -226 226 226 231 231 231 246 246 246 253 253 253
57681 -253 253 253 253 253 253 253 253 253 253 253 253
57682 -253 253 253 253 253 253 253 253 253 253 253 253
57683 -253 253 253 178 178 178 2 2 6 2 2 6
57684 - 2 2 6 2 2 6 2 2 6 2 2 6
57685 - 2 2 6 18 18 18 90 90 90 62 62 62
57686 - 30 30 30 10 10 10 0 0 0 0 0 0
57687 - 0 0 0 0 0 0 0 0 0 0 0 0
57688 - 0 0 0 0 0 0 0 0 0 0 0 0
57689 - 0 0 0 0 0 0 0 0 0 0 0 0
57690 - 0 0 0 0 0 0 0 0 0 0 0 0
57691 - 0 0 0 0 0 0 0 0 0 0 0 0
57692 - 0 0 0 0 0 0 0 0 0 0 0 0
57693 - 0 0 0 0 0 0 0 0 0 0 0 0
57694 - 0 0 0 0 0 0 0 0 0 0 0 0
57695 - 0 0 0 0 0 0 0 0 0 0 0 0
57696 - 0 0 0 0 0 0 10 10 10 26 26 26
57697 - 58 58 58 90 90 90 18 18 18 2 2 6
57698 - 2 2 6 110 110 110 253 253 253 253 253 253
57699 -253 253 253 253 253 253 253 253 253 253 253 253
57700 -250 250 250 253 253 253 253 253 253 253 253 253
57701 -253 253 253 253 253 253 253 253 253 253 253 253
57702 -253 253 253 253 253 253 253 253 253 253 253 253
57703 -253 253 253 231 231 231 18 18 18 2 2 6
57704 - 2 2 6 2 2 6 2 2 6 2 2 6
57705 - 2 2 6 2 2 6 18 18 18 94 94 94
57706 - 54 54 54 26 26 26 10 10 10 0 0 0
57707 - 0 0 0 0 0 0 0 0 0 0 0 0
57708 - 0 0 0 0 0 0 0 0 0 0 0 0
57709 - 0 0 0 0 0 0 0 0 0 0 0 0
57710 - 0 0 0 0 0 0 0 0 0 0 0 0
57711 - 0 0 0 0 0 0 0 0 0 0 0 0
57712 - 0 0 0 0 0 0 0 0 0 0 0 0
57713 - 0 0 0 0 0 0 0 0 0 0 0 0
57714 - 0 0 0 0 0 0 0 0 0 0 0 0
57715 - 0 0 0 0 0 0 0 0 0 0 0 0
57716 - 0 0 0 6 6 6 22 22 22 50 50 50
57717 - 90 90 90 26 26 26 2 2 6 2 2 6
57718 - 14 14 14 195 195 195 250 250 250 253 253 253
57719 -253 253 253 253 253 253 253 253 253 253 253 253
57720 -253 253 253 253 253 253 253 253 253 253 253 253
57721 -253 253 253 253 253 253 253 253 253 253 253 253
57722 -253 253 253 253 253 253 253 253 253 253 253 253
57723 -250 250 250 242 242 242 54 54 54 2 2 6
57724 - 2 2 6 2 2 6 2 2 6 2 2 6
57725 - 2 2 6 2 2 6 2 2 6 38 38 38
57726 - 86 86 86 50 50 50 22 22 22 6 6 6
57727 - 0 0 0 0 0 0 0 0 0 0 0 0
57728 - 0 0 0 0 0 0 0 0 0 0 0 0
57729 - 0 0 0 0 0 0 0 0 0 0 0 0
57730 - 0 0 0 0 0 0 0 0 0 0 0 0
57731 - 0 0 0 0 0 0 0 0 0 0 0 0
57732 - 0 0 0 0 0 0 0 0 0 0 0 0
57733 - 0 0 0 0 0 0 0 0 0 0 0 0
57734 - 0 0 0 0 0 0 0 0 0 0 0 0
57735 - 0 0 0 0 0 0 0 0 0 0 0 0
57736 - 6 6 6 14 14 14 38 38 38 82 82 82
57737 - 34 34 34 2 2 6 2 2 6 2 2 6
57738 - 42 42 42 195 195 195 246 246 246 253 253 253
57739 -253 253 253 253 253 253 253 253 253 250 250 250
57740 -242 242 242 242 242 242 250 250 250 253 253 253
57741 -253 253 253 253 253 253 253 253 253 253 253 253
57742 -253 253 253 250 250 250 246 246 246 238 238 238
57743 -226 226 226 231 231 231 101 101 101 6 6 6
57744 - 2 2 6 2 2 6 2 2 6 2 2 6
57745 - 2 2 6 2 2 6 2 2 6 2 2 6
57746 - 38 38 38 82 82 82 42 42 42 14 14 14
57747 - 6 6 6 0 0 0 0 0 0 0 0 0
57748 - 0 0 0 0 0 0 0 0 0 0 0 0
57749 - 0 0 0 0 0 0 0 0 0 0 0 0
57750 - 0 0 0 0 0 0 0 0 0 0 0 0
57751 - 0 0 0 0 0 0 0 0 0 0 0 0
57752 - 0 0 0 0 0 0 0 0 0 0 0 0
57753 - 0 0 0 0 0 0 0 0 0 0 0 0
57754 - 0 0 0 0 0 0 0 0 0 0 0 0
57755 - 0 0 0 0 0 0 0 0 0 0 0 0
57756 - 10 10 10 26 26 26 62 62 62 66 66 66
57757 - 2 2 6 2 2 6 2 2 6 6 6 6
57758 - 70 70 70 170 170 170 206 206 206 234 234 234
57759 -246 246 246 250 250 250 250 250 250 238 238 238
57760 -226 226 226 231 231 231 238 238 238 250 250 250
57761 -250 250 250 250 250 250 246 246 246 231 231 231
57762 -214 214 214 206 206 206 202 202 202 202 202 202
57763 -198 198 198 202 202 202 182 182 182 18 18 18
57764 - 2 2 6 2 2 6 2 2 6 2 2 6
57765 - 2 2 6 2 2 6 2 2 6 2 2 6
57766 - 2 2 6 62 62 62 66 66 66 30 30 30
57767 - 10 10 10 0 0 0 0 0 0 0 0 0
57768 - 0 0 0 0 0 0 0 0 0 0 0 0
57769 - 0 0 0 0 0 0 0 0 0 0 0 0
57770 - 0 0 0 0 0 0 0 0 0 0 0 0
57771 - 0 0 0 0 0 0 0 0 0 0 0 0
57772 - 0 0 0 0 0 0 0 0 0 0 0 0
57773 - 0 0 0 0 0 0 0 0 0 0 0 0
57774 - 0 0 0 0 0 0 0 0 0 0 0 0
57775 - 0 0 0 0 0 0 0 0 0 0 0 0
57776 - 14 14 14 42 42 42 82 82 82 18 18 18
57777 - 2 2 6 2 2 6 2 2 6 10 10 10
57778 - 94 94 94 182 182 182 218 218 218 242 242 242
57779 -250 250 250 253 253 253 253 253 253 250 250 250
57780 -234 234 234 253 253 253 253 253 253 253 253 253
57781 -253 253 253 253 253 253 253 253 253 246 246 246
57782 -238 238 238 226 226 226 210 210 210 202 202 202
57783 -195 195 195 195 195 195 210 210 210 158 158 158
57784 - 6 6 6 14 14 14 50 50 50 14 14 14
57785 - 2 2 6 2 2 6 2 2 6 2 2 6
57786 - 2 2 6 6 6 6 86 86 86 46 46 46
57787 - 18 18 18 6 6 6 0 0 0 0 0 0
57788 - 0 0 0 0 0 0 0 0 0 0 0 0
57789 - 0 0 0 0 0 0 0 0 0 0 0 0
57790 - 0 0 0 0 0 0 0 0 0 0 0 0
57791 - 0 0 0 0 0 0 0 0 0 0 0 0
57792 - 0 0 0 0 0 0 0 0 0 0 0 0
57793 - 0 0 0 0 0 0 0 0 0 0 0 0
57794 - 0 0 0 0 0 0 0 0 0 0 0 0
57795 - 0 0 0 0 0 0 0 0 0 6 6 6
57796 - 22 22 22 54 54 54 70 70 70 2 2 6
57797 - 2 2 6 10 10 10 2 2 6 22 22 22
57798 -166 166 166 231 231 231 250 250 250 253 253 253
57799 -253 253 253 253 253 253 253 253 253 250 250 250
57800 -242 242 242 253 253 253 253 253 253 253 253 253
57801 -253 253 253 253 253 253 253 253 253 253 253 253
57802 -253 253 253 253 253 253 253 253 253 246 246 246
57803 -231 231 231 206 206 206 198 198 198 226 226 226
57804 - 94 94 94 2 2 6 6 6 6 38 38 38
57805 - 30 30 30 2 2 6 2 2 6 2 2 6
57806 - 2 2 6 2 2 6 62 62 62 66 66 66
57807 - 26 26 26 10 10 10 0 0 0 0 0 0
57808 - 0 0 0 0 0 0 0 0 0 0 0 0
57809 - 0 0 0 0 0 0 0 0 0 0 0 0
57810 - 0 0 0 0 0 0 0 0 0 0 0 0
57811 - 0 0 0 0 0 0 0 0 0 0 0 0
57812 - 0 0 0 0 0 0 0 0 0 0 0 0
57813 - 0 0 0 0 0 0 0 0 0 0 0 0
57814 - 0 0 0 0 0 0 0 0 0 0 0 0
57815 - 0 0 0 0 0 0 0 0 0 10 10 10
57816 - 30 30 30 74 74 74 50 50 50 2 2 6
57817 - 26 26 26 26 26 26 2 2 6 106 106 106
57818 -238 238 238 253 253 253 253 253 253 253 253 253
57819 -253 253 253 253 253 253 253 253 253 253 253 253
57820 -253 253 253 253 253 253 253 253 253 253 253 253
57821 -253 253 253 253 253 253 253 253 253 253 253 253
57822 -253 253 253 253 253 253 253 253 253 253 253 253
57823 -253 253 253 246 246 246 218 218 218 202 202 202
57824 -210 210 210 14 14 14 2 2 6 2 2 6
57825 - 30 30 30 22 22 22 2 2 6 2 2 6
57826 - 2 2 6 2 2 6 18 18 18 86 86 86
57827 - 42 42 42 14 14 14 0 0 0 0 0 0
57828 - 0 0 0 0 0 0 0 0 0 0 0 0
57829 - 0 0 0 0 0 0 0 0 0 0 0 0
57830 - 0 0 0 0 0 0 0 0 0 0 0 0
57831 - 0 0 0 0 0 0 0 0 0 0 0 0
57832 - 0 0 0 0 0 0 0 0 0 0 0 0
57833 - 0 0 0 0 0 0 0 0 0 0 0 0
57834 - 0 0 0 0 0 0 0 0 0 0 0 0
57835 - 0 0 0 0 0 0 0 0 0 14 14 14
57836 - 42 42 42 90 90 90 22 22 22 2 2 6
57837 - 42 42 42 2 2 6 18 18 18 218 218 218
57838 -253 253 253 253 253 253 253 253 253 253 253 253
57839 -253 253 253 253 253 253 253 253 253 253 253 253
57840 -253 253 253 253 253 253 253 253 253 253 253 253
57841 -253 253 253 253 253 253 253 253 253 253 253 253
57842 -253 253 253 253 253 253 253 253 253 253 253 253
57843 -253 253 253 253 253 253 250 250 250 221 221 221
57844 -218 218 218 101 101 101 2 2 6 14 14 14
57845 - 18 18 18 38 38 38 10 10 10 2 2 6
57846 - 2 2 6 2 2 6 2 2 6 78 78 78
57847 - 58 58 58 22 22 22 6 6 6 0 0 0
57848 - 0 0 0 0 0 0 0 0 0 0 0 0
57849 - 0 0 0 0 0 0 0 0 0 0 0 0
57850 - 0 0 0 0 0 0 0 0 0 0 0 0
57851 - 0 0 0 0 0 0 0 0 0 0 0 0
57852 - 0 0 0 0 0 0 0 0 0 0 0 0
57853 - 0 0 0 0 0 0 0 0 0 0 0 0
57854 - 0 0 0 0 0 0 0 0 0 0 0 0
57855 - 0 0 0 0 0 0 6 6 6 18 18 18
57856 - 54 54 54 82 82 82 2 2 6 26 26 26
57857 - 22 22 22 2 2 6 123 123 123 253 253 253
57858 -253 253 253 253 253 253 253 253 253 253 253 253
57859 -253 253 253 253 253 253 253 253 253 253 253 253
57860 -253 253 253 253 253 253 253 253 253 253 253 253
57861 -253 253 253 253 253 253 253 253 253 253 253 253
57862 -253 253 253 253 253 253 253 253 253 253 253 253
57863 -253 253 253 253 253 253 253 253 253 250 250 250
57864 -238 238 238 198 198 198 6 6 6 38 38 38
57865 - 58 58 58 26 26 26 38 38 38 2 2 6
57866 - 2 2 6 2 2 6 2 2 6 46 46 46
57867 - 78 78 78 30 30 30 10 10 10 0 0 0
57868 - 0 0 0 0 0 0 0 0 0 0 0 0
57869 - 0 0 0 0 0 0 0 0 0 0 0 0
57870 - 0 0 0 0 0 0 0 0 0 0 0 0
57871 - 0 0 0 0 0 0 0 0 0 0 0 0
57872 - 0 0 0 0 0 0 0 0 0 0 0 0
57873 - 0 0 0 0 0 0 0 0 0 0 0 0
57874 - 0 0 0 0 0 0 0 0 0 0 0 0
57875 - 0 0 0 0 0 0 10 10 10 30 30 30
57876 - 74 74 74 58 58 58 2 2 6 42 42 42
57877 - 2 2 6 22 22 22 231 231 231 253 253 253
57878 -253 253 253 253 253 253 253 253 253 253 253 253
57879 -253 253 253 253 253 253 253 253 253 250 250 250
57880 -253 253 253 253 253 253 253 253 253 253 253 253
57881 -253 253 253 253 253 253 253 253 253 253 253 253
57882 -253 253 253 253 253 253 253 253 253 253 253 253
57883 -253 253 253 253 253 253 253 253 253 253 253 253
57884 -253 253 253 246 246 246 46 46 46 38 38 38
57885 - 42 42 42 14 14 14 38 38 38 14 14 14
57886 - 2 2 6 2 2 6 2 2 6 6 6 6
57887 - 86 86 86 46 46 46 14 14 14 0 0 0
57888 - 0 0 0 0 0 0 0 0 0 0 0 0
57889 - 0 0 0 0 0 0 0 0 0 0 0 0
57890 - 0 0 0 0 0 0 0 0 0 0 0 0
57891 - 0 0 0 0 0 0 0 0 0 0 0 0
57892 - 0 0 0 0 0 0 0 0 0 0 0 0
57893 - 0 0 0 0 0 0 0 0 0 0 0 0
57894 - 0 0 0 0 0 0 0 0 0 0 0 0
57895 - 0 0 0 6 6 6 14 14 14 42 42 42
57896 - 90 90 90 18 18 18 18 18 18 26 26 26
57897 - 2 2 6 116 116 116 253 253 253 253 253 253
57898 -253 253 253 253 253 253 253 253 253 253 253 253
57899 -253 253 253 253 253 253 250 250 250 238 238 238
57900 -253 253 253 253 253 253 253 253 253 253 253 253
57901 -253 253 253 253 253 253 253 253 253 253 253 253
57902 -253 253 253 253 253 253 253 253 253 253 253 253
57903 -253 253 253 253 253 253 253 253 253 253 253 253
57904 -253 253 253 253 253 253 94 94 94 6 6 6
57905 - 2 2 6 2 2 6 10 10 10 34 34 34
57906 - 2 2 6 2 2 6 2 2 6 2 2 6
57907 - 74 74 74 58 58 58 22 22 22 6 6 6
57908 - 0 0 0 0 0 0 0 0 0 0 0 0
57909 - 0 0 0 0 0 0 0 0 0 0 0 0
57910 - 0 0 0 0 0 0 0 0 0 0 0 0
57911 - 0 0 0 0 0 0 0 0 0 0 0 0
57912 - 0 0 0 0 0 0 0 0 0 0 0 0
57913 - 0 0 0 0 0 0 0 0 0 0 0 0
57914 - 0 0 0 0 0 0 0 0 0 0 0 0
57915 - 0 0 0 10 10 10 26 26 26 66 66 66
57916 - 82 82 82 2 2 6 38 38 38 6 6 6
57917 - 14 14 14 210 210 210 253 253 253 253 253 253
57918 -253 253 253 253 253 253 253 253 253 253 253 253
57919 -253 253 253 253 253 253 246 246 246 242 242 242
57920 -253 253 253 253 253 253 253 253 253 253 253 253
57921 -253 253 253 253 253 253 253 253 253 253 253 253
57922 -253 253 253 253 253 253 253 253 253 253 253 253
57923 -253 253 253 253 253 253 253 253 253 253 253 253
57924 -253 253 253 253 253 253 144 144 144 2 2 6
57925 - 2 2 6 2 2 6 2 2 6 46 46 46
57926 - 2 2 6 2 2 6 2 2 6 2 2 6
57927 - 42 42 42 74 74 74 30 30 30 10 10 10
57928 - 0 0 0 0 0 0 0 0 0 0 0 0
57929 - 0 0 0 0 0 0 0 0 0 0 0 0
57930 - 0 0 0 0 0 0 0 0 0 0 0 0
57931 - 0 0 0 0 0 0 0 0 0 0 0 0
57932 - 0 0 0 0 0 0 0 0 0 0 0 0
57933 - 0 0 0 0 0 0 0 0 0 0 0 0
57934 - 0 0 0 0 0 0 0 0 0 0 0 0
57935 - 6 6 6 14 14 14 42 42 42 90 90 90
57936 - 26 26 26 6 6 6 42 42 42 2 2 6
57937 - 74 74 74 250 250 250 253 253 253 253 253 253
57938 -253 253 253 253 253 253 253 253 253 253 253 253
57939 -253 253 253 253 253 253 242 242 242 242 242 242
57940 -253 253 253 253 253 253 253 253 253 253 253 253
57941 -253 253 253 253 253 253 253 253 253 253 253 253
57942 -253 253 253 253 253 253 253 253 253 253 253 253
57943 -253 253 253 253 253 253 253 253 253 253 253 253
57944 -253 253 253 253 253 253 182 182 182 2 2 6
57945 - 2 2 6 2 2 6 2 2 6 46 46 46
57946 - 2 2 6 2 2 6 2 2 6 2 2 6
57947 - 10 10 10 86 86 86 38 38 38 10 10 10
57948 - 0 0 0 0 0 0 0 0 0 0 0 0
57949 - 0 0 0 0 0 0 0 0 0 0 0 0
57950 - 0 0 0 0 0 0 0 0 0 0 0 0
57951 - 0 0 0 0 0 0 0 0 0 0 0 0
57952 - 0 0 0 0 0 0 0 0 0 0 0 0
57953 - 0 0 0 0 0 0 0 0 0 0 0 0
57954 - 0 0 0 0 0 0 0 0 0 0 0 0
57955 - 10 10 10 26 26 26 66 66 66 82 82 82
57956 - 2 2 6 22 22 22 18 18 18 2 2 6
57957 -149 149 149 253 253 253 253 253 253 253 253 253
57958 -253 253 253 253 253 253 253 253 253 253 253 253
57959 -253 253 253 253 253 253 234 234 234 242 242 242
57960 -253 253 253 253 253 253 253 253 253 253 253 253
57961 -253 253 253 253 253 253 253 253 253 253 253 253
57962 -253 253 253 253 253 253 253 253 253 253 253 253
57963 -253 253 253 253 253 253 253 253 253 253 253 253
57964 -253 253 253 253 253 253 206 206 206 2 2 6
57965 - 2 2 6 2 2 6 2 2 6 38 38 38
57966 - 2 2 6 2 2 6 2 2 6 2 2 6
57967 - 6 6 6 86 86 86 46 46 46 14 14 14
57968 - 0 0 0 0 0 0 0 0 0 0 0 0
57969 - 0 0 0 0 0 0 0 0 0 0 0 0
57970 - 0 0 0 0 0 0 0 0 0 0 0 0
57971 - 0 0 0 0 0 0 0 0 0 0 0 0
57972 - 0 0 0 0 0 0 0 0 0 0 0 0
57973 - 0 0 0 0 0 0 0 0 0 0 0 0
57974 - 0 0 0 0 0 0 0 0 0 6 6 6
57975 - 18 18 18 46 46 46 86 86 86 18 18 18
57976 - 2 2 6 34 34 34 10 10 10 6 6 6
57977 -210 210 210 253 253 253 253 253 253 253 253 253
57978 -253 253 253 253 253 253 253 253 253 253 253 253
57979 -253 253 253 253 253 253 234 234 234 242 242 242
57980 -253 253 253 253 253 253 253 253 253 253 253 253
57981 -253 253 253 253 253 253 253 253 253 253 253 253
57982 -253 253 253 253 253 253 253 253 253 253 253 253
57983 -253 253 253 253 253 253 253 253 253 253 253 253
57984 -253 253 253 253 253 253 221 221 221 6 6 6
57985 - 2 2 6 2 2 6 6 6 6 30 30 30
57986 - 2 2 6 2 2 6 2 2 6 2 2 6
57987 - 2 2 6 82 82 82 54 54 54 18 18 18
57988 - 6 6 6 0 0 0 0 0 0 0 0 0
57989 - 0 0 0 0 0 0 0 0 0 0 0 0
57990 - 0 0 0 0 0 0 0 0 0 0 0 0
57991 - 0 0 0 0 0 0 0 0 0 0 0 0
57992 - 0 0 0 0 0 0 0 0 0 0 0 0
57993 - 0 0 0 0 0 0 0 0 0 0 0 0
57994 - 0 0 0 0 0 0 0 0 0 10 10 10
57995 - 26 26 26 66 66 66 62 62 62 2 2 6
57996 - 2 2 6 38 38 38 10 10 10 26 26 26
57997 -238 238 238 253 253 253 253 253 253 253 253 253
57998 -253 253 253 253 253 253 253 253 253 253 253 253
57999 -253 253 253 253 253 253 231 231 231 238 238 238
58000 -253 253 253 253 253 253 253 253 253 253 253 253
58001 -253 253 253 253 253 253 253 253 253 253 253 253
58002 -253 253 253 253 253 253 253 253 253 253 253 253
58003 -253 253 253 253 253 253 253 253 253 253 253 253
58004 -253 253 253 253 253 253 231 231 231 6 6 6
58005 - 2 2 6 2 2 6 10 10 10 30 30 30
58006 - 2 2 6 2 2 6 2 2 6 2 2 6
58007 - 2 2 6 66 66 66 58 58 58 22 22 22
58008 - 6 6 6 0 0 0 0 0 0 0 0 0
58009 - 0 0 0 0 0 0 0 0 0 0 0 0
58010 - 0 0 0 0 0 0 0 0 0 0 0 0
58011 - 0 0 0 0 0 0 0 0 0 0 0 0
58012 - 0 0 0 0 0 0 0 0 0 0 0 0
58013 - 0 0 0 0 0 0 0 0 0 0 0 0
58014 - 0 0 0 0 0 0 0 0 0 10 10 10
58015 - 38 38 38 78 78 78 6 6 6 2 2 6
58016 - 2 2 6 46 46 46 14 14 14 42 42 42
58017 -246 246 246 253 253 253 253 253 253 253 253 253
58018 -253 253 253 253 253 253 253 253 253 253 253 253
58019 -253 253 253 253 253 253 231 231 231 242 242 242
58020 -253 253 253 253 253 253 253 253 253 253 253 253
58021 -253 253 253 253 253 253 253 253 253 253 253 253
58022 -253 253 253 253 253 253 253 253 253 253 253 253
58023 -253 253 253 253 253 253 253 253 253 253 253 253
58024 -253 253 253 253 253 253 234 234 234 10 10 10
58025 - 2 2 6 2 2 6 22 22 22 14 14 14
58026 - 2 2 6 2 2 6 2 2 6 2 2 6
58027 - 2 2 6 66 66 66 62 62 62 22 22 22
58028 - 6 6 6 0 0 0 0 0 0 0 0 0
58029 - 0 0 0 0 0 0 0 0 0 0 0 0
58030 - 0 0 0 0 0 0 0 0 0 0 0 0
58031 - 0 0 0 0 0 0 0 0 0 0 0 0
58032 - 0 0 0 0 0 0 0 0 0 0 0 0
58033 - 0 0 0 0 0 0 0 0 0 0 0 0
58034 - 0 0 0 0 0 0 6 6 6 18 18 18
58035 - 50 50 50 74 74 74 2 2 6 2 2 6
58036 - 14 14 14 70 70 70 34 34 34 62 62 62
58037 -250 250 250 253 253 253 253 253 253 253 253 253
58038 -253 253 253 253 253 253 253 253 253 253 253 253
58039 -253 253 253 253 253 253 231 231 231 246 246 246
58040 -253 253 253 253 253 253 253 253 253 253 253 253
58041 -253 253 253 253 253 253 253 253 253 253 253 253
58042 -253 253 253 253 253 253 253 253 253 253 253 253
58043 -253 253 253 253 253 253 253 253 253 253 253 253
58044 -253 253 253 253 253 253 234 234 234 14 14 14
58045 - 2 2 6 2 2 6 30 30 30 2 2 6
58046 - 2 2 6 2 2 6 2 2 6 2 2 6
58047 - 2 2 6 66 66 66 62 62 62 22 22 22
58048 - 6 6 6 0 0 0 0 0 0 0 0 0
58049 - 0 0 0 0 0 0 0 0 0 0 0 0
58050 - 0 0 0 0 0 0 0 0 0 0 0 0
58051 - 0 0 0 0 0 0 0 0 0 0 0 0
58052 - 0 0 0 0 0 0 0 0 0 0 0 0
58053 - 0 0 0 0 0 0 0 0 0 0 0 0
58054 - 0 0 0 0 0 0 6 6 6 18 18 18
58055 - 54 54 54 62 62 62 2 2 6 2 2 6
58056 - 2 2 6 30 30 30 46 46 46 70 70 70
58057 -250 250 250 253 253 253 253 253 253 253 253 253
58058 -253 253 253 253 253 253 253 253 253 253 253 253
58059 -253 253 253 253 253 253 231 231 231 246 246 246
58060 -253 253 253 253 253 253 253 253 253 253 253 253
58061 -253 253 253 253 253 253 253 253 253 253 253 253
58062 -253 253 253 253 253 253 253 253 253 253 253 253
58063 -253 253 253 253 253 253 253 253 253 253 253 253
58064 -253 253 253 253 253 253 226 226 226 10 10 10
58065 - 2 2 6 6 6 6 30 30 30 2 2 6
58066 - 2 2 6 2 2 6 2 2 6 2 2 6
58067 - 2 2 6 66 66 66 58 58 58 22 22 22
58068 - 6 6 6 0 0 0 0 0 0 0 0 0
58069 - 0 0 0 0 0 0 0 0 0 0 0 0
58070 - 0 0 0 0 0 0 0 0 0 0 0 0
58071 - 0 0 0 0 0 0 0 0 0 0 0 0
58072 - 0 0 0 0 0 0 0 0 0 0 0 0
58073 - 0 0 0 0 0 0 0 0 0 0 0 0
58074 - 0 0 0 0 0 0 6 6 6 22 22 22
58075 - 58 58 58 62 62 62 2 2 6 2 2 6
58076 - 2 2 6 2 2 6 30 30 30 78 78 78
58077 -250 250 250 253 253 253 253 253 253 253 253 253
58078 -253 253 253 253 253 253 253 253 253 253 253 253
58079 -253 253 253 253 253 253 231 231 231 246 246 246
58080 -253 253 253 253 253 253 253 253 253 253 253 253
58081 -253 253 253 253 253 253 253 253 253 253 253 253
58082 -253 253 253 253 253 253 253 253 253 253 253 253
58083 -253 253 253 253 253 253 253 253 253 253 253 253
58084 -253 253 253 253 253 253 206 206 206 2 2 6
58085 - 22 22 22 34 34 34 18 14 6 22 22 22
58086 - 26 26 26 18 18 18 6 6 6 2 2 6
58087 - 2 2 6 82 82 82 54 54 54 18 18 18
58088 - 6 6 6 0 0 0 0 0 0 0 0 0
58089 - 0 0 0 0 0 0 0 0 0 0 0 0
58090 - 0 0 0 0 0 0 0 0 0 0 0 0
58091 - 0 0 0 0 0 0 0 0 0 0 0 0
58092 - 0 0 0 0 0 0 0 0 0 0 0 0
58093 - 0 0 0 0 0 0 0 0 0 0 0 0
58094 - 0 0 0 0 0 0 6 6 6 26 26 26
58095 - 62 62 62 106 106 106 74 54 14 185 133 11
58096 -210 162 10 121 92 8 6 6 6 62 62 62
58097 -238 238 238 253 253 253 253 253 253 253 253 253
58098 -253 253 253 253 253 253 253 253 253 253 253 253
58099 -253 253 253 253 253 253 231 231 231 246 246 246
58100 -253 253 253 253 253 253 253 253 253 253 253 253
58101 -253 253 253 253 253 253 253 253 253 253 253 253
58102 -253 253 253 253 253 253 253 253 253 253 253 253
58103 -253 253 253 253 253 253 253 253 253 253 253 253
58104 -253 253 253 253 253 253 158 158 158 18 18 18
58105 - 14 14 14 2 2 6 2 2 6 2 2 6
58106 - 6 6 6 18 18 18 66 66 66 38 38 38
58107 - 6 6 6 94 94 94 50 50 50 18 18 18
58108 - 6 6 6 0 0 0 0 0 0 0 0 0
58109 - 0 0 0 0 0 0 0 0 0 0 0 0
58110 - 0 0 0 0 0 0 0 0 0 0 0 0
58111 - 0 0 0 0 0 0 0 0 0 0 0 0
58112 - 0 0 0 0 0 0 0 0 0 0 0 0
58113 - 0 0 0 0 0 0 0 0 0 6 6 6
58114 - 10 10 10 10 10 10 18 18 18 38 38 38
58115 - 78 78 78 142 134 106 216 158 10 242 186 14
58116 -246 190 14 246 190 14 156 118 10 10 10 10
58117 - 90 90 90 238 238 238 253 253 253 253 253 253
58118 -253 253 253 253 253 253 253 253 253 253 253 253
58119 -253 253 253 253 253 253 231 231 231 250 250 250
58120 -253 253 253 253 253 253 253 253 253 253 253 253
58121 -253 253 253 253 253 253 253 253 253 253 253 253
58122 -253 253 253 253 253 253 253 253 253 253 253 253
58123 -253 253 253 253 253 253 253 253 253 246 230 190
58124 -238 204 91 238 204 91 181 142 44 37 26 9
58125 - 2 2 6 2 2 6 2 2 6 2 2 6
58126 - 2 2 6 2 2 6 38 38 38 46 46 46
58127 - 26 26 26 106 106 106 54 54 54 18 18 18
58128 - 6 6 6 0 0 0 0 0 0 0 0 0
58129 - 0 0 0 0 0 0 0 0 0 0 0 0
58130 - 0 0 0 0 0 0 0 0 0 0 0 0
58131 - 0 0 0 0 0 0 0 0 0 0 0 0
58132 - 0 0 0 0 0 0 0 0 0 0 0 0
58133 - 0 0 0 6 6 6 14 14 14 22 22 22
58134 - 30 30 30 38 38 38 50 50 50 70 70 70
58135 -106 106 106 190 142 34 226 170 11 242 186 14
58136 -246 190 14 246 190 14 246 190 14 154 114 10
58137 - 6 6 6 74 74 74 226 226 226 253 253 253
58138 -253 253 253 253 253 253 253 253 253 253 253 253
58139 -253 253 253 253 253 253 231 231 231 250 250 250
58140 -253 253 253 253 253 253 253 253 253 253 253 253
58141 -253 253 253 253 253 253 253 253 253 253 253 253
58142 -253 253 253 253 253 253 253 253 253 253 253 253
58143 -253 253 253 253 253 253 253 253 253 228 184 62
58144 -241 196 14 241 208 19 232 195 16 38 30 10
58145 - 2 2 6 2 2 6 2 2 6 2 2 6
58146 - 2 2 6 6 6 6 30 30 30 26 26 26
58147 -203 166 17 154 142 90 66 66 66 26 26 26
58148 - 6 6 6 0 0 0 0 0 0 0 0 0
58149 - 0 0 0 0 0 0 0 0 0 0 0 0
58150 - 0 0 0 0 0 0 0 0 0 0 0 0
58151 - 0 0 0 0 0 0 0 0 0 0 0 0
58152 - 0 0 0 0 0 0 0 0 0 0 0 0
58153 - 6 6 6 18 18 18 38 38 38 58 58 58
58154 - 78 78 78 86 86 86 101 101 101 123 123 123
58155 -175 146 61 210 150 10 234 174 13 246 186 14
58156 -246 190 14 246 190 14 246 190 14 238 190 10
58157 -102 78 10 2 2 6 46 46 46 198 198 198
58158 -253 253 253 253 253 253 253 253 253 253 253 253
58159 -253 253 253 253 253 253 234 234 234 242 242 242
58160 -253 253 253 253 253 253 253 253 253 253 253 253
58161 -253 253 253 253 253 253 253 253 253 253 253 253
58162 -253 253 253 253 253 253 253 253 253 253 253 253
58163 -253 253 253 253 253 253 253 253 253 224 178 62
58164 -242 186 14 241 196 14 210 166 10 22 18 6
58165 - 2 2 6 2 2 6 2 2 6 2 2 6
58166 - 2 2 6 2 2 6 6 6 6 121 92 8
58167 -238 202 15 232 195 16 82 82 82 34 34 34
58168 - 10 10 10 0 0 0 0 0 0 0 0 0
58169 - 0 0 0 0 0 0 0 0 0 0 0 0
58170 - 0 0 0 0 0 0 0 0 0 0 0 0
58171 - 0 0 0 0 0 0 0 0 0 0 0 0
58172 - 0 0 0 0 0 0 0 0 0 0 0 0
58173 - 14 14 14 38 38 38 70 70 70 154 122 46
58174 -190 142 34 200 144 11 197 138 11 197 138 11
58175 -213 154 11 226 170 11 242 186 14 246 190 14
58176 -246 190 14 246 190 14 246 190 14 246 190 14
58177 -225 175 15 46 32 6 2 2 6 22 22 22
58178 -158 158 158 250 250 250 253 253 253 253 253 253
58179 -253 253 253 253 253 253 253 253 253 253 253 253
58180 -253 253 253 253 253 253 253 253 253 253 253 253
58181 -253 253 253 253 253 253 253 253 253 253 253 253
58182 -253 253 253 253 253 253 253 253 253 253 253 253
58183 -253 253 253 250 250 250 242 242 242 224 178 62
58184 -239 182 13 236 186 11 213 154 11 46 32 6
58185 - 2 2 6 2 2 6 2 2 6 2 2 6
58186 - 2 2 6 2 2 6 61 42 6 225 175 15
58187 -238 190 10 236 186 11 112 100 78 42 42 42
58188 - 14 14 14 0 0 0 0 0 0 0 0 0
58189 - 0 0 0 0 0 0 0 0 0 0 0 0
58190 - 0 0 0 0 0 0 0 0 0 0 0 0
58191 - 0 0 0 0 0 0 0 0 0 0 0 0
58192 - 0 0 0 0 0 0 0 0 0 6 6 6
58193 - 22 22 22 54 54 54 154 122 46 213 154 11
58194 -226 170 11 230 174 11 226 170 11 226 170 11
58195 -236 178 12 242 186 14 246 190 14 246 190 14
58196 -246 190 14 246 190 14 246 190 14 246 190 14
58197 -241 196 14 184 144 12 10 10 10 2 2 6
58198 - 6 6 6 116 116 116 242 242 242 253 253 253
58199 -253 253 253 253 253 253 253 253 253 253 253 253
58200 -253 253 253 253 253 253 253 253 253 253 253 253
58201 -253 253 253 253 253 253 253 253 253 253 253 253
58202 -253 253 253 253 253 253 253 253 253 253 253 253
58203 -253 253 253 231 231 231 198 198 198 214 170 54
58204 -236 178 12 236 178 12 210 150 10 137 92 6
58205 - 18 14 6 2 2 6 2 2 6 2 2 6
58206 - 6 6 6 70 47 6 200 144 11 236 178 12
58207 -239 182 13 239 182 13 124 112 88 58 58 58
58208 - 22 22 22 6 6 6 0 0 0 0 0 0
58209 - 0 0 0 0 0 0 0 0 0 0 0 0
58210 - 0 0 0 0 0 0 0 0 0 0 0 0
58211 - 0 0 0 0 0 0 0 0 0 0 0 0
58212 - 0 0 0 0 0 0 0 0 0 10 10 10
58213 - 30 30 30 70 70 70 180 133 36 226 170 11
58214 -239 182 13 242 186 14 242 186 14 246 186 14
58215 -246 190 14 246 190 14 246 190 14 246 190 14
58216 -246 190 14 246 190 14 246 190 14 246 190 14
58217 -246 190 14 232 195 16 98 70 6 2 2 6
58218 - 2 2 6 2 2 6 66 66 66 221 221 221
58219 -253 253 253 253 253 253 253 253 253 253 253 253
58220 -253 253 253 253 253 253 253 253 253 253 253 253
58221 -253 253 253 253 253 253 253 253 253 253 253 253
58222 -253 253 253 253 253 253 253 253 253 253 253 253
58223 -253 253 253 206 206 206 198 198 198 214 166 58
58224 -230 174 11 230 174 11 216 158 10 192 133 9
58225 -163 110 8 116 81 8 102 78 10 116 81 8
58226 -167 114 7 197 138 11 226 170 11 239 182 13
58227 -242 186 14 242 186 14 162 146 94 78 78 78
58228 - 34 34 34 14 14 14 6 6 6 0 0 0
58229 - 0 0 0 0 0 0 0 0 0 0 0 0
58230 - 0 0 0 0 0 0 0 0 0 0 0 0
58231 - 0 0 0 0 0 0 0 0 0 0 0 0
58232 - 0 0 0 0 0 0 0 0 0 6 6 6
58233 - 30 30 30 78 78 78 190 142 34 226 170 11
58234 -239 182 13 246 190 14 246 190 14 246 190 14
58235 -246 190 14 246 190 14 246 190 14 246 190 14
58236 -246 190 14 246 190 14 246 190 14 246 190 14
58237 -246 190 14 241 196 14 203 166 17 22 18 6
58238 - 2 2 6 2 2 6 2 2 6 38 38 38
58239 -218 218 218 253 253 253 253 253 253 253 253 253
58240 -253 253 253 253 253 253 253 253 253 253 253 253
58241 -253 253 253 253 253 253 253 253 253 253 253 253
58242 -253 253 253 253 253 253 253 253 253 253 253 253
58243 -250 250 250 206 206 206 198 198 198 202 162 69
58244 -226 170 11 236 178 12 224 166 10 210 150 10
58245 -200 144 11 197 138 11 192 133 9 197 138 11
58246 -210 150 10 226 170 11 242 186 14 246 190 14
58247 -246 190 14 246 186 14 225 175 15 124 112 88
58248 - 62 62 62 30 30 30 14 14 14 6 6 6
58249 - 0 0 0 0 0 0 0 0 0 0 0 0
58250 - 0 0 0 0 0 0 0 0 0 0 0 0
58251 - 0 0 0 0 0 0 0 0 0 0 0 0
58252 - 0 0 0 0 0 0 0 0 0 10 10 10
58253 - 30 30 30 78 78 78 174 135 50 224 166 10
58254 -239 182 13 246 190 14 246 190 14 246 190 14
58255 -246 190 14 246 190 14 246 190 14 246 190 14
58256 -246 190 14 246 190 14 246 190 14 246 190 14
58257 -246 190 14 246 190 14 241 196 14 139 102 15
58258 - 2 2 6 2 2 6 2 2 6 2 2 6
58259 - 78 78 78 250 250 250 253 253 253 253 253 253
58260 -253 253 253 253 253 253 253 253 253 253 253 253
58261 -253 253 253 253 253 253 253 253 253 253 253 253
58262 -253 253 253 253 253 253 253 253 253 253 253 253
58263 -250 250 250 214 214 214 198 198 198 190 150 46
58264 -219 162 10 236 178 12 234 174 13 224 166 10
58265 -216 158 10 213 154 11 213 154 11 216 158 10
58266 -226 170 11 239 182 13 246 190 14 246 190 14
58267 -246 190 14 246 190 14 242 186 14 206 162 42
58268 -101 101 101 58 58 58 30 30 30 14 14 14
58269 - 6 6 6 0 0 0 0 0 0 0 0 0
58270 - 0 0 0 0 0 0 0 0 0 0 0 0
58271 - 0 0 0 0 0 0 0 0 0 0 0 0
58272 - 0 0 0 0 0 0 0 0 0 10 10 10
58273 - 30 30 30 74 74 74 174 135 50 216 158 10
58274 -236 178 12 246 190 14 246 190 14 246 190 14
58275 -246 190 14 246 190 14 246 190 14 246 190 14
58276 -246 190 14 246 190 14 246 190 14 246 190 14
58277 -246 190 14 246 190 14 241 196 14 226 184 13
58278 - 61 42 6 2 2 6 2 2 6 2 2 6
58279 - 22 22 22 238 238 238 253 253 253 253 253 253
58280 -253 253 253 253 253 253 253 253 253 253 253 253
58281 -253 253 253 253 253 253 253 253 253 253 253 253
58282 -253 253 253 253 253 253 253 253 253 253 253 253
58283 -253 253 253 226 226 226 187 187 187 180 133 36
58284 -216 158 10 236 178 12 239 182 13 236 178 12
58285 -230 174 11 226 170 11 226 170 11 230 174 11
58286 -236 178 12 242 186 14 246 190 14 246 190 14
58287 -246 190 14 246 190 14 246 186 14 239 182 13
58288 -206 162 42 106 106 106 66 66 66 34 34 34
58289 - 14 14 14 6 6 6 0 0 0 0 0 0
58290 - 0 0 0 0 0 0 0 0 0 0 0 0
58291 - 0 0 0 0 0 0 0 0 0 0 0 0
58292 - 0 0 0 0 0 0 0 0 0 6 6 6
58293 - 26 26 26 70 70 70 163 133 67 213 154 11
58294 -236 178 12 246 190 14 246 190 14 246 190 14
58295 -246 190 14 246 190 14 246 190 14 246 190 14
58296 -246 190 14 246 190 14 246 190 14 246 190 14
58297 -246 190 14 246 190 14 246 190 14 241 196 14
58298 -190 146 13 18 14 6 2 2 6 2 2 6
58299 - 46 46 46 246 246 246 253 253 253 253 253 253
58300 -253 253 253 253 253 253 253 253 253 253 253 253
58301 -253 253 253 253 253 253 253 253 253 253 253 253
58302 -253 253 253 253 253 253 253 253 253 253 253 253
58303 -253 253 253 221 221 221 86 86 86 156 107 11
58304 -216 158 10 236 178 12 242 186 14 246 186 14
58305 -242 186 14 239 182 13 239 182 13 242 186 14
58306 -242 186 14 246 186 14 246 190 14 246 190 14
58307 -246 190 14 246 190 14 246 190 14 246 190 14
58308 -242 186 14 225 175 15 142 122 72 66 66 66
58309 - 30 30 30 10 10 10 0 0 0 0 0 0
58310 - 0 0 0 0 0 0 0 0 0 0 0 0
58311 - 0 0 0 0 0 0 0 0 0 0 0 0
58312 - 0 0 0 0 0 0 0 0 0 6 6 6
58313 - 26 26 26 70 70 70 163 133 67 210 150 10
58314 -236 178 12 246 190 14 246 190 14 246 190 14
58315 -246 190 14 246 190 14 246 190 14 246 190 14
58316 -246 190 14 246 190 14 246 190 14 246 190 14
58317 -246 190 14 246 190 14 246 190 14 246 190 14
58318 -232 195 16 121 92 8 34 34 34 106 106 106
58319 -221 221 221 253 253 253 253 253 253 253 253 253
58320 -253 253 253 253 253 253 253 253 253 253 253 253
58321 -253 253 253 253 253 253 253 253 253 253 253 253
58322 -253 253 253 253 253 253 253 253 253 253 253 253
58323 -242 242 242 82 82 82 18 14 6 163 110 8
58324 -216 158 10 236 178 12 242 186 14 246 190 14
58325 -246 190 14 246 190 14 246 190 14 246 190 14
58326 -246 190 14 246 190 14 246 190 14 246 190 14
58327 -246 190 14 246 190 14 246 190 14 246 190 14
58328 -246 190 14 246 190 14 242 186 14 163 133 67
58329 - 46 46 46 18 18 18 6 6 6 0 0 0
58330 - 0 0 0 0 0 0 0 0 0 0 0 0
58331 - 0 0 0 0 0 0 0 0 0 0 0 0
58332 - 0 0 0 0 0 0 0 0 0 10 10 10
58333 - 30 30 30 78 78 78 163 133 67 210 150 10
58334 -236 178 12 246 186 14 246 190 14 246 190 14
58335 -246 190 14 246 190 14 246 190 14 246 190 14
58336 -246 190 14 246 190 14 246 190 14 246 190 14
58337 -246 190 14 246 190 14 246 190 14 246 190 14
58338 -241 196 14 215 174 15 190 178 144 253 253 253
58339 -253 253 253 253 253 253 253 253 253 253 253 253
58340 -253 253 253 253 253 253 253 253 253 253 253 253
58341 -253 253 253 253 253 253 253 253 253 253 253 253
58342 -253 253 253 253 253 253 253 253 253 218 218 218
58343 - 58 58 58 2 2 6 22 18 6 167 114 7
58344 -216 158 10 236 178 12 246 186 14 246 190 14
58345 -246 190 14 246 190 14 246 190 14 246 190 14
58346 -246 190 14 246 190 14 246 190 14 246 190 14
58347 -246 190 14 246 190 14 246 190 14 246 190 14
58348 -246 190 14 246 186 14 242 186 14 190 150 46
58349 - 54 54 54 22 22 22 6 6 6 0 0 0
58350 - 0 0 0 0 0 0 0 0 0 0 0 0
58351 - 0 0 0 0 0 0 0 0 0 0 0 0
58352 - 0 0 0 0 0 0 0 0 0 14 14 14
58353 - 38 38 38 86 86 86 180 133 36 213 154 11
58354 -236 178 12 246 186 14 246 190 14 246 190 14
58355 -246 190 14 246 190 14 246 190 14 246 190 14
58356 -246 190 14 246 190 14 246 190 14 246 190 14
58357 -246 190 14 246 190 14 246 190 14 246 190 14
58358 -246 190 14 232 195 16 190 146 13 214 214 214
58359 -253 253 253 253 253 253 253 253 253 253 253 253
58360 -253 253 253 253 253 253 253 253 253 253 253 253
58361 -253 253 253 253 253 253 253 253 253 253 253 253
58362 -253 253 253 250 250 250 170 170 170 26 26 26
58363 - 2 2 6 2 2 6 37 26 9 163 110 8
58364 -219 162 10 239 182 13 246 186 14 246 190 14
58365 -246 190 14 246 190 14 246 190 14 246 190 14
58366 -246 190 14 246 190 14 246 190 14 246 190 14
58367 -246 190 14 246 190 14 246 190 14 246 190 14
58368 -246 186 14 236 178 12 224 166 10 142 122 72
58369 - 46 46 46 18 18 18 6 6 6 0 0 0
58370 - 0 0 0 0 0 0 0 0 0 0 0 0
58371 - 0 0 0 0 0 0 0 0 0 0 0 0
58372 - 0 0 0 0 0 0 6 6 6 18 18 18
58373 - 50 50 50 109 106 95 192 133 9 224 166 10
58374 -242 186 14 246 190 14 246 190 14 246 190 14
58375 -246 190 14 246 190 14 246 190 14 246 190 14
58376 -246 190 14 246 190 14 246 190 14 246 190 14
58377 -246 190 14 246 190 14 246 190 14 246 190 14
58378 -242 186 14 226 184 13 210 162 10 142 110 46
58379 -226 226 226 253 253 253 253 253 253 253 253 253
58380 -253 253 253 253 253 253 253 253 253 253 253 253
58381 -253 253 253 253 253 253 253 253 253 253 253 253
58382 -198 198 198 66 66 66 2 2 6 2 2 6
58383 - 2 2 6 2 2 6 50 34 6 156 107 11
58384 -219 162 10 239 182 13 246 186 14 246 190 14
58385 -246 190 14 246 190 14 246 190 14 246 190 14
58386 -246 190 14 246 190 14 246 190 14 246 190 14
58387 -246 190 14 246 190 14 246 190 14 242 186 14
58388 -234 174 13 213 154 11 154 122 46 66 66 66
58389 - 30 30 30 10 10 10 0 0 0 0 0 0
58390 - 0 0 0 0 0 0 0 0 0 0 0 0
58391 - 0 0 0 0 0 0 0 0 0 0 0 0
58392 - 0 0 0 0 0 0 6 6 6 22 22 22
58393 - 58 58 58 154 121 60 206 145 10 234 174 13
58394 -242 186 14 246 186 14 246 190 14 246 190 14
58395 -246 190 14 246 190 14 246 190 14 246 190 14
58396 -246 190 14 246 190 14 246 190 14 246 190 14
58397 -246 190 14 246 190 14 246 190 14 246 190 14
58398 -246 186 14 236 178 12 210 162 10 163 110 8
58399 - 61 42 6 138 138 138 218 218 218 250 250 250
58400 -253 253 253 253 253 253 253 253 253 250 250 250
58401 -242 242 242 210 210 210 144 144 144 66 66 66
58402 - 6 6 6 2 2 6 2 2 6 2 2 6
58403 - 2 2 6 2 2 6 61 42 6 163 110 8
58404 -216 158 10 236 178 12 246 190 14 246 190 14
58405 -246 190 14 246 190 14 246 190 14 246 190 14
58406 -246 190 14 246 190 14 246 190 14 246 190 14
58407 -246 190 14 239 182 13 230 174 11 216 158 10
58408 -190 142 34 124 112 88 70 70 70 38 38 38
58409 - 18 18 18 6 6 6 0 0 0 0 0 0
58410 - 0 0 0 0 0 0 0 0 0 0 0 0
58411 - 0 0 0 0 0 0 0 0 0 0 0 0
58412 - 0 0 0 0 0 0 6 6 6 22 22 22
58413 - 62 62 62 168 124 44 206 145 10 224 166 10
58414 -236 178 12 239 182 13 242 186 14 242 186 14
58415 -246 186 14 246 190 14 246 190 14 246 190 14
58416 -246 190 14 246 190 14 246 190 14 246 190 14
58417 -246 190 14 246 190 14 246 190 14 246 190 14
58418 -246 190 14 236 178 12 216 158 10 175 118 6
58419 - 80 54 7 2 2 6 6 6 6 30 30 30
58420 - 54 54 54 62 62 62 50 50 50 38 38 38
58421 - 14 14 14 2 2 6 2 2 6 2 2 6
58422 - 2 2 6 2 2 6 2 2 6 2 2 6
58423 - 2 2 6 6 6 6 80 54 7 167 114 7
58424 -213 154 11 236 178 12 246 190 14 246 190 14
58425 -246 190 14 246 190 14 246 190 14 246 190 14
58426 -246 190 14 242 186 14 239 182 13 239 182 13
58427 -230 174 11 210 150 10 174 135 50 124 112 88
58428 - 82 82 82 54 54 54 34 34 34 18 18 18
58429 - 6 6 6 0 0 0 0 0 0 0 0 0
58430 - 0 0 0 0 0 0 0 0 0 0 0 0
58431 - 0 0 0 0 0 0 0 0 0 0 0 0
58432 - 0 0 0 0 0 0 6 6 6 18 18 18
58433 - 50 50 50 158 118 36 192 133 9 200 144 11
58434 -216 158 10 219 162 10 224 166 10 226 170 11
58435 -230 174 11 236 178 12 239 182 13 239 182 13
58436 -242 186 14 246 186 14 246 190 14 246 190 14
58437 -246 190 14 246 190 14 246 190 14 246 190 14
58438 -246 186 14 230 174 11 210 150 10 163 110 8
58439 -104 69 6 10 10 10 2 2 6 2 2 6
58440 - 2 2 6 2 2 6 2 2 6 2 2 6
58441 - 2 2 6 2 2 6 2 2 6 2 2 6
58442 - 2 2 6 2 2 6 2 2 6 2 2 6
58443 - 2 2 6 6 6 6 91 60 6 167 114 7
58444 -206 145 10 230 174 11 242 186 14 246 190 14
58445 -246 190 14 246 190 14 246 186 14 242 186 14
58446 -239 182 13 230 174 11 224 166 10 213 154 11
58447 -180 133 36 124 112 88 86 86 86 58 58 58
58448 - 38 38 38 22 22 22 10 10 10 6 6 6
58449 - 0 0 0 0 0 0 0 0 0 0 0 0
58450 - 0 0 0 0 0 0 0 0 0 0 0 0
58451 - 0 0 0 0 0 0 0 0 0 0 0 0
58452 - 0 0 0 0 0 0 0 0 0 14 14 14
58453 - 34 34 34 70 70 70 138 110 50 158 118 36
58454 -167 114 7 180 123 7 192 133 9 197 138 11
58455 -200 144 11 206 145 10 213 154 11 219 162 10
58456 -224 166 10 230 174 11 239 182 13 242 186 14
58457 -246 186 14 246 186 14 246 186 14 246 186 14
58458 -239 182 13 216 158 10 185 133 11 152 99 6
58459 -104 69 6 18 14 6 2 2 6 2 2 6
58460 - 2 2 6 2 2 6 2 2 6 2 2 6
58461 - 2 2 6 2 2 6 2 2 6 2 2 6
58462 - 2 2 6 2 2 6 2 2 6 2 2 6
58463 - 2 2 6 6 6 6 80 54 7 152 99 6
58464 -192 133 9 219 162 10 236 178 12 239 182 13
58465 -246 186 14 242 186 14 239 182 13 236 178 12
58466 -224 166 10 206 145 10 192 133 9 154 121 60
58467 - 94 94 94 62 62 62 42 42 42 22 22 22
58468 - 14 14 14 6 6 6 0 0 0 0 0 0
58469 - 0 0 0 0 0 0 0 0 0 0 0 0
58470 - 0 0 0 0 0 0 0 0 0 0 0 0
58471 - 0 0 0 0 0 0 0 0 0 0 0 0
58472 - 0 0 0 0 0 0 0 0 0 6 6 6
58473 - 18 18 18 34 34 34 58 58 58 78 78 78
58474 -101 98 89 124 112 88 142 110 46 156 107 11
58475 -163 110 8 167 114 7 175 118 6 180 123 7
58476 -185 133 11 197 138 11 210 150 10 219 162 10
58477 -226 170 11 236 178 12 236 178 12 234 174 13
58478 -219 162 10 197 138 11 163 110 8 130 83 6
58479 - 91 60 6 10 10 10 2 2 6 2 2 6
58480 - 18 18 18 38 38 38 38 38 38 38 38 38
58481 - 38 38 38 38 38 38 38 38 38 38 38 38
58482 - 38 38 38 38 38 38 26 26 26 2 2 6
58483 - 2 2 6 6 6 6 70 47 6 137 92 6
58484 -175 118 6 200 144 11 219 162 10 230 174 11
58485 -234 174 13 230 174 11 219 162 10 210 150 10
58486 -192 133 9 163 110 8 124 112 88 82 82 82
58487 - 50 50 50 30 30 30 14 14 14 6 6 6
58488 - 0 0 0 0 0 0 0 0 0 0 0 0
58489 - 0 0 0 0 0 0 0 0 0 0 0 0
58490 - 0 0 0 0 0 0 0 0 0 0 0 0
58491 - 0 0 0 0 0 0 0 0 0 0 0 0
58492 - 0 0 0 0 0 0 0 0 0 0 0 0
58493 - 6 6 6 14 14 14 22 22 22 34 34 34
58494 - 42 42 42 58 58 58 74 74 74 86 86 86
58495 -101 98 89 122 102 70 130 98 46 121 87 25
58496 -137 92 6 152 99 6 163 110 8 180 123 7
58497 -185 133 11 197 138 11 206 145 10 200 144 11
58498 -180 123 7 156 107 11 130 83 6 104 69 6
58499 - 50 34 6 54 54 54 110 110 110 101 98 89
58500 - 86 86 86 82 82 82 78 78 78 78 78 78
58501 - 78 78 78 78 78 78 78 78 78 78 78 78
58502 - 78 78 78 82 82 82 86 86 86 94 94 94
58503 -106 106 106 101 101 101 86 66 34 124 80 6
58504 -156 107 11 180 123 7 192 133 9 200 144 11
58505 -206 145 10 200 144 11 192 133 9 175 118 6
58506 -139 102 15 109 106 95 70 70 70 42 42 42
58507 - 22 22 22 10 10 10 0 0 0 0 0 0
58508 - 0 0 0 0 0 0 0 0 0 0 0 0
58509 - 0 0 0 0 0 0 0 0 0 0 0 0
58510 - 0 0 0 0 0 0 0 0 0 0 0 0
58511 - 0 0 0 0 0 0 0 0 0 0 0 0
58512 - 0 0 0 0 0 0 0 0 0 0 0 0
58513 - 0 0 0 0 0 0 6 6 6 10 10 10
58514 - 14 14 14 22 22 22 30 30 30 38 38 38
58515 - 50 50 50 62 62 62 74 74 74 90 90 90
58516 -101 98 89 112 100 78 121 87 25 124 80 6
58517 -137 92 6 152 99 6 152 99 6 152 99 6
58518 -138 86 6 124 80 6 98 70 6 86 66 30
58519 -101 98 89 82 82 82 58 58 58 46 46 46
58520 - 38 38 38 34 34 34 34 34 34 34 34 34
58521 - 34 34 34 34 34 34 34 34 34 34 34 34
58522 - 34 34 34 34 34 34 38 38 38 42 42 42
58523 - 54 54 54 82 82 82 94 86 76 91 60 6
58524 -134 86 6 156 107 11 167 114 7 175 118 6
58525 -175 118 6 167 114 7 152 99 6 121 87 25
58526 -101 98 89 62 62 62 34 34 34 18 18 18
58527 - 6 6 6 0 0 0 0 0 0 0 0 0
58528 - 0 0 0 0 0 0 0 0 0 0 0 0
58529 - 0 0 0 0 0 0 0 0 0 0 0 0
58530 - 0 0 0 0 0 0 0 0 0 0 0 0
58531 - 0 0 0 0 0 0 0 0 0 0 0 0
58532 - 0 0 0 0 0 0 0 0 0 0 0 0
58533 - 0 0 0 0 0 0 0 0 0 0 0 0
58534 - 0 0 0 6 6 6 6 6 6 10 10 10
58535 - 18 18 18 22 22 22 30 30 30 42 42 42
58536 - 50 50 50 66 66 66 86 86 86 101 98 89
58537 -106 86 58 98 70 6 104 69 6 104 69 6
58538 -104 69 6 91 60 6 82 62 34 90 90 90
58539 - 62 62 62 38 38 38 22 22 22 14 14 14
58540 - 10 10 10 10 10 10 10 10 10 10 10 10
58541 - 10 10 10 10 10 10 6 6 6 10 10 10
58542 - 10 10 10 10 10 10 10 10 10 14 14 14
58543 - 22 22 22 42 42 42 70 70 70 89 81 66
58544 - 80 54 7 104 69 6 124 80 6 137 92 6
58545 -134 86 6 116 81 8 100 82 52 86 86 86
58546 - 58 58 58 30 30 30 14 14 14 6 6 6
58547 - 0 0 0 0 0 0 0 0 0 0 0 0
58548 - 0 0 0 0 0 0 0 0 0 0 0 0
58549 - 0 0 0 0 0 0 0 0 0 0 0 0
58550 - 0 0 0 0 0 0 0 0 0 0 0 0
58551 - 0 0 0 0 0 0 0 0 0 0 0 0
58552 - 0 0 0 0 0 0 0 0 0 0 0 0
58553 - 0 0 0 0 0 0 0 0 0 0 0 0
58554 - 0 0 0 0 0 0 0 0 0 0 0 0
58555 - 0 0 0 6 6 6 10 10 10 14 14 14
58556 - 18 18 18 26 26 26 38 38 38 54 54 54
58557 - 70 70 70 86 86 86 94 86 76 89 81 66
58558 - 89 81 66 86 86 86 74 74 74 50 50 50
58559 - 30 30 30 14 14 14 6 6 6 0 0 0
58560 - 0 0 0 0 0 0 0 0 0 0 0 0
58561 - 0 0 0 0 0 0 0 0 0 0 0 0
58562 - 0 0 0 0 0 0 0 0 0 0 0 0
58563 - 6 6 6 18 18 18 34 34 34 58 58 58
58564 - 82 82 82 89 81 66 89 81 66 89 81 66
58565 - 94 86 66 94 86 76 74 74 74 50 50 50
58566 - 26 26 26 14 14 14 6 6 6 0 0 0
58567 - 0 0 0 0 0 0 0 0 0 0 0 0
58568 - 0 0 0 0 0 0 0 0 0 0 0 0
58569 - 0 0 0 0 0 0 0 0 0 0 0 0
58570 - 0 0 0 0 0 0 0 0 0 0 0 0
58571 - 0 0 0 0 0 0 0 0 0 0 0 0
58572 - 0 0 0 0 0 0 0 0 0 0 0 0
58573 - 0 0 0 0 0 0 0 0 0 0 0 0
58574 - 0 0 0 0 0 0 0 0 0 0 0 0
58575 - 0 0 0 0 0 0 0 0 0 0 0 0
58576 - 6 6 6 6 6 6 14 14 14 18 18 18
58577 - 30 30 30 38 38 38 46 46 46 54 54 54
58578 - 50 50 50 42 42 42 30 30 30 18 18 18
58579 - 10 10 10 0 0 0 0 0 0 0 0 0
58580 - 0 0 0 0 0 0 0 0 0 0 0 0
58581 - 0 0 0 0 0 0 0 0 0 0 0 0
58582 - 0 0 0 0 0 0 0 0 0 0 0 0
58583 - 0 0 0 6 6 6 14 14 14 26 26 26
58584 - 38 38 38 50 50 50 58 58 58 58 58 58
58585 - 54 54 54 42 42 42 30 30 30 18 18 18
58586 - 10 10 10 0 0 0 0 0 0 0 0 0
58587 - 0 0 0 0 0 0 0 0 0 0 0 0
58588 - 0 0 0 0 0 0 0 0 0 0 0 0
58589 - 0 0 0 0 0 0 0 0 0 0 0 0
58590 - 0 0 0 0 0 0 0 0 0 0 0 0
58591 - 0 0 0 0 0 0 0 0 0 0 0 0
58592 - 0 0 0 0 0 0 0 0 0 0 0 0
58593 - 0 0 0 0 0 0 0 0 0 0 0 0
58594 - 0 0 0 0 0 0 0 0 0 0 0 0
58595 - 0 0 0 0 0 0 0 0 0 0 0 0
58596 - 0 0 0 0 0 0 0 0 0 6 6 6
58597 - 6 6 6 10 10 10 14 14 14 18 18 18
58598 - 18 18 18 14 14 14 10 10 10 6 6 6
58599 - 0 0 0 0 0 0 0 0 0 0 0 0
58600 - 0 0 0 0 0 0 0 0 0 0 0 0
58601 - 0 0 0 0 0 0 0 0 0 0 0 0
58602 - 0 0 0 0 0 0 0 0 0 0 0 0
58603 - 0 0 0 0 0 0 0 0 0 6 6 6
58604 - 14 14 14 18 18 18 22 22 22 22 22 22
58605 - 18 18 18 14 14 14 10 10 10 6 6 6
58606 - 0 0 0 0 0 0 0 0 0 0 0 0
58607 - 0 0 0 0 0 0 0 0 0 0 0 0
58608 - 0 0 0 0 0 0 0 0 0 0 0 0
58609 - 0 0 0 0 0 0 0 0 0 0 0 0
58610 - 0 0 0 0 0 0 0 0 0 0 0 0
58611 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58612 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58613 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58614 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58615 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58616 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58617 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58618 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58619 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58620 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58621 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58622 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58623 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58624 +4 4 4 4 4 4
58625 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58626 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58627 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58628 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58629 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58630 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58631 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58632 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58633 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58634 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58635 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58636 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58637 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58638 +4 4 4 4 4 4
58639 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58640 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58641 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58642 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58643 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58644 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58645 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58646 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58647 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58648 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58649 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58650 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58651 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58652 +4 4 4 4 4 4
58653 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58654 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58655 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58656 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58657 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58658 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58659 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58660 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58661 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58662 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58663 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58664 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58665 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58666 +4 4 4 4 4 4
58667 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58668 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58669 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58670 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58671 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58672 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58673 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58674 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58675 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58676 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58677 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58678 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58679 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58680 +4 4 4 4 4 4
58681 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58682 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58683 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58684 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58685 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58686 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58687 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58688 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58689 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58690 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58691 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58692 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58693 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58694 +4 4 4 4 4 4
58695 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58696 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58697 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58698 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58699 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
58700 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
58701 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58702 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58703 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58704 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
58705 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
58706 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
58707 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58708 +4 4 4 4 4 4
58709 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58710 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58711 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58712 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58713 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
58714 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
58715 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58716 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58717 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58718 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
58719 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
58720 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
58721 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58722 +4 4 4 4 4 4
58723 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58724 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58725 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58726 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58727 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
58728 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
58729 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
58730 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58731 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58732 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
58733 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
58734 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
58735 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
58736 +4 4 4 4 4 4
58737 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58738 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58739 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58740 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
58741 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
58742 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
58743 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
58744 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58745 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
58746 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
58747 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
58748 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
58749 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
58750 +4 4 4 4 4 4
58751 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58752 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58753 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58754 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
58755 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
58756 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
58757 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
58758 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
58759 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
58760 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
58761 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
58762 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
58763 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
58764 +4 4 4 4 4 4
58765 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58766 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58767 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
58768 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
58769 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
58770 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
58771 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
58772 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
58773 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
58774 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
58775 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
58776 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
58777 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
58778 +4 4 4 4 4 4
58779 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58780 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58781 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
58782 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
58783 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
58784 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
58785 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
58786 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
58787 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
58788 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
58789 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
58790 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
58791 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
58792 +4 4 4 4 4 4
58793 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58794 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58795 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
58796 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
58797 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
58798 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
58799 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
58800 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
58801 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
58802 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
58803 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
58804 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
58805 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
58806 +4 4 4 4 4 4
58807 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58808 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58809 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
58810 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
58811 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
58812 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
58813 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
58814 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
58815 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
58816 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
58817 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
58818 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
58819 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
58820 +4 4 4 4 4 4
58821 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58822 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58823 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
58824 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
58825 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
58826 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
58827 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
58828 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
58829 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
58830 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
58831 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
58832 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
58833 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
58834 +4 4 4 4 4 4
58835 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58836 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
58837 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
58838 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
58839 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
58840 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
58841 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
58842 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
58843 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
58844 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
58845 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
58846 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
58847 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
58848 +4 4 4 4 4 4
58849 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
58850 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
58851 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
58852 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
58853 +153 152 153 125 1
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)